diff --git a/tests/linux/2021.FontOnLake/45E9.elf.simple b/tests/linux/2021.FontOnLake/45E9.elf.simple
index b5af98f31..6e5e1614f 100644
--- a/tests/linux/2021.FontOnLake/45E9.elf.simple
+++ b/tests/linux/2021.FontOnLake/45E9.elf.simple
@@ -1,4 +1,5 @@
 # linux/2021.FontOnLake/45E9.elf: critical
+3P/elastic/rootkit: high
 3P/elastic/rootkit_fontonlake: critical
 anti-static/packer/upx: high
 c2/addr/ip: high
diff --git a/tests/macOS/2023.3CX/libffmpeg.change_decrease.mdiff b/tests/macOS/2023.3CX/libffmpeg.change_decrease.mdiff
index 51b89261a..00f6b179e 100644
Binary files a/tests/macOS/2023.3CX/libffmpeg.change_decrease.mdiff and b/tests/macOS/2023.3CX/libffmpeg.change_decrease.mdiff differ
diff --git a/tests/macOS/2023.3CX/libffmpeg.change_increase.mdiff b/tests/macOS/2023.3CX/libffmpeg.change_increase.mdiff
index b3befcc33..6a76d5292 100644
Binary files a/tests/macOS/2023.3CX/libffmpeg.change_increase.mdiff and b/tests/macOS/2023.3CX/libffmpeg.change_increase.mdiff differ
diff --git a/tests/macOS/2023.3CX/libffmpeg.dirty.dylib.simple b/tests/macOS/2023.3CX/libffmpeg.dirty.dylib.simple
index 0f76eff0d..25fc2cb5d 100644
--- a/tests/macOS/2023.3CX/libffmpeg.dirty.dylib.simple
+++ b/tests/macOS/2023.3CX/libffmpeg.dirty.dylib.simple
@@ -1,8 +1,6 @@
 # macOS/2023.3CX/libffmpeg.dirty.dylib: critical
 3P/sig_base/3cxdesktopapp_backdoor: critical
 3P/sig_base/nk_3cx_dylib: critical
-3P/sig_base/susp_xored_mozilla: critical
-3P/volexity/iconic: critical
 anti-static/xor/user_agent: critical
 c2/addr/url: low
 c2/tool_transfer/arch: low
diff --git a/tests/macOS/2023.3CX/libffmpeg.dirty.mdiff b/tests/macOS/2023.3CX/libffmpeg.dirty.mdiff
index b3befcc33..6a76d5292 100644
Binary files a/tests/macOS/2023.3CX/libffmpeg.dirty.mdiff and b/tests/macOS/2023.3CX/libffmpeg.dirty.mdiff differ
diff --git a/tests/macOS/2023.3CX/libffmpeg.increase.mdiff b/tests/macOS/2023.3CX/libffmpeg.increase.mdiff
index b3befcc33..6a76d5292 100644
Binary files a/tests/macOS/2023.3CX/libffmpeg.increase.mdiff and b/tests/macOS/2023.3CX/libffmpeg.increase.mdiff differ
diff --git a/tests/windows/2024.aspdasdksa2/callback.bat.json b/tests/windows/2024.aspdasdksa2/callback.bat.json
index f16a7eb3b..79aa78a6c 100644
--- a/tests/windows/2024.aspdasdksa2/callback.bat.json
+++ b/tests/windows/2024.aspdasdksa2/callback.bat.json
@@ -12,11 +12,11 @@
                     ],
                     "RiskScore": 4,
                     "RiskLevel": "CRITICAL",
-                    "RuleURL": "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L52-L91",
+                    "RuleURL": "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L52-L91",
                     "ReferenceURL": "Internal%20Research",
                     "RuleAuthor": "Florian Roth (Nextron Systems)",
                     "RuleLicense": "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE",
-                    "RuleLicenseURL": "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE",
+                    "RuleLicenseURL": "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE",
                     "ID": "3P/sig_base/powershell_webdownload",
                     "RuleName": "SIGNATURE_BASE_Suspicious_Powershell_Webdownload_1"
                 },
diff --git a/third_party/yara/YARAForge/RELEASE b/third_party/yara/YARAForge/RELEASE
index f4039d392..565e340cc 100644
--- a/third_party/yara/YARAForge/RELEASE
+++ b/third_party/yara/YARAForge/RELEASE
@@ -1 +1 @@
-20241208
+20241215
diff --git a/third_party/yara/YARAForge/yara-rules-full.yar b/third_party/yara/YARAForge/yara-rules-full.yar
index 06fb55eb7..bd8ac24e0 100644
--- a/third_party/yara/YARAForge/yara-rules-full.yar
+++ b/third_party/yara/YARAForge/yara-rules-full.yar
@@ -12,15 +12,15 @@
  * Force Exclude Importance Level: 0
  * Minimum Age (in days): 0
  * Minimum Score: 40
- * Creation Date: 2024-12-08
- * Number of Rules: 12311
+ * Creation Date: 2024-12-15
+ * Number of Rules: 12313
  * Skipped: 0 (age), 222 (quality), 7 (score), 0 (importance)
  */
 /*
  * YARA Rule Set
  * Repository Name: ReversingLabs
  * Repository: https://github.com/reversinglabs/reversinglabs-yara-rules/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 9bcb61c86aa4583e393269828225349a81ea08a4
  * Number of Rules: 1218
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -55,13 +55,13 @@ rule REVERSINGLABS_Win32_Exploit_CVE20200601 : TC_DETECTION MALICIOUS EXPLOIT CV
 	meta:
 		description = "Yara rule that detects CVE-2020-0601 exploit."
 		author = "ReversingLabs"
-		id = "6a03fd5e-3b7f-5b71-b897-5cac81721a56"
+		id = "c97026c5-0147-569b-a369-8eaa747f213f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/exploit/Win32.Exploit.CVE20200601.yara#L3-L253"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e4d915560ad72e0fde63276f9ffece00535c7983125efaa8298adc11d5e54817"
+		logic_hash = "v1_sha256_e4d915560ad72e0fde63276f9ffece00535c7983125efaa8298adc11d5e54817"
 		score = 75
 		quality = 88
 		tags = "TC_DETECTION, MALICIOUS, EXPLOIT, CVE-2020-0601, FILE"
@@ -274,20 +274,20 @@ rule REVERSINGLABS_Win32_Exploit_CVE20200601 : TC_DETECTION MALICIOUS EXPLOIT CV
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($oid_prime_explicit) and ( any of ($ecc_public_key_*)) and (pe.number_of_signatures>0)
+		uint16( 0 ) == 0x5A4D and ( $oid_prime_explicit ) and ( any of ( $ecc_public_key_* ) ) and ( pe.number_of_signatures > 0 )
 }
 rule REVERSINGLABS_Linux_Backdoor_GTPDOOR : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GTPDOOR backdoor."
 		author = "ReversingLabs"
-		id = "9e6df856-fe54-504c-8530-321adc91cd5a"
+		id = "4c2a886c-7a59-5e99-972f-8513d229f4d9"
 		date = "2024-09-10"
 		modified = "2024-09-10"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Linux.Backdoor.GTPDOOR.yara#L1-L264"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b7b4b33b7838142e34c6d02260b6585305c4730c90e12b1adc099f9aeecf071a"
+		logic_hash = "v1_sha256_b7b4b33b7838142e34c6d02260b6585305c4730c90e12b1adc099f9aeecf071a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -504,20 +504,20 @@ rule REVERSINGLABS_Linux_Backdoor_GTPDOOR : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint32(0)==0x464C457F and ((( all of ($send_result_to_peer_v1_p*)) and ($execute_remote_command_v1) and ( all of ($send_reply_v1_p*)) and ($daemon_already_running_check_v1)) or (( all of ($send_result_to_peer_v2_p*)) and ($execute_remote_command_v2) and ( all of ($main_routine_v2_p*))))
+		uint32( 0 ) == 0x464C457F and ( ( ( all of ( $send_result_to_peer_v1_p* ) ) and ( $execute_remote_command_v1 ) and ( all of ( $send_reply_v1_p* ) ) and ( $daemon_already_running_check_v1 ) ) or ( ( all of ( $send_result_to_peer_v2_p* ) ) and ( $execute_remote_command_v2 ) and ( all of ( $main_routine_v2_p* ) ) ) )
 }
 rule REVERSINGLABS_Win64_Backdoor_Voldemort : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Voldemort backdoor."
 		author = "ReversingLabs"
-		id = "d770bd79-5141-50a0-8cf7-bca1cf5f23e1"
+		id = "6c681727-7dd8-5780-9545-0750a5163bb1"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Win64.Backdoor.Voldemort.yara#L1-L208"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1fe2abe17436d2965e34d1f10223af50d9600809fdef234e7d89c74fa33228a9"
+		logic_hash = "v1_sha256_1fe2abe17436d2965e34d1f10223af50d9600809fdef234e7d89c74fa33228a9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -693,20 +693,20 @@ rule REVERSINGLABS_Win64_Backdoor_Voldemort : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($decrypt_configuration_p*)) and ($decryption_algorithm) and ( all of ($request_access_token_p*)) and ( all of ($network_communication_p*)) and ( all of ($download_data_from_c2_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $decrypt_configuration_p* ) ) and ( $decryption_algorithm ) and ( all of ( $request_access_token_p* ) ) and ( all of ( $network_communication_p* ) ) and ( all of ( $download_data_from_c2_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Njrat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects NjRAT backdoor."
 		author = "ReversingLabs"
-		id = "578c813f-4bba-52cd-bcc7-4de2c3943cf7"
+		id = "28f657a1-3290-599f-b2fc-677f07520873"
 		date = "2024-07-31"
 		modified = "2024-07-31"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/ByteCode.MSIL.Backdoor.NjRAT.yara#L1-L266"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "eeecf90965e6952d8b9efc9d1e96eaa47709b1d69fc7d435f4aebaaf0191f317"
+		logic_hash = "v1_sha256_eeecf90965e6952d8b9efc9d1e96eaa47709b1d69fc7d435f4aebaaf0191f317"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -923,20 +923,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Njrat : TC_DETECTION MALICIOUS MALWARE
     }
 
 	condition:
-		uint16(0)==0x5A4D and ((( all of ($persistence_mechanism_v1_p*)) and ( all of ($connect_v1_p*)) and ($send_v1) and ( all of ($receive_v1_p*))) or (($connect_v2) and ($receive_v2) and ( all of ($get_system_information_v2_p*)) and ($send_v2)))
+		uint16( 0 ) == 0x5A4D and ( ( ( all of ( $persistence_mechanism_v1_p* ) ) and ( all of ( $connect_v1_p* ) ) and ( $send_v1 ) and ( all of ( $receive_v1_p* ) ) ) or ( ( $connect_v2 ) and ( $receive_v2 ) and ( all of ( $get_system_information_v2_p* ) ) and ( $send_v2 ) ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Agentracoon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects AgentRacoon backdoor."
 		author = "ReversingLabs"
-		id = "ad74d530-ffbd-589f-b941-3a5d9ec737b6"
+		id = "f8b49ced-5a19-5837-b446-b6934e4ff6df"
 		date = "2023-12-15"
 		modified = "2023-12-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/ByteCode.MSIL.Backdoor.AgentRacoon.yara#L1-L128"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3ba73f19f59c2e5880df820c52f16997047d7299eb14d421ae2ed8f3790bcfe9"
+		logic_hash = "v1_sha256_3ba73f19f59c2e5880df820c52f16997047d7299eb14d421ae2ed8f3790bcfe9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -1036,20 +1036,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Agentracoon : TC_DETECTION MALICIOUS M
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($unpack_response_p*)) and ($upload) and ($perform_request) and ($get_txt_record) and ($main_loop)
+		uint16( 0 ) == 0x5A4D and ( all of ( $unpack_response_p* ) ) and ( $upload ) and ( $perform_request ) and ( $get_txt_record ) and ( $main_loop )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Limerat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects LimeRAT backdoor."
 		author = "ReversingLabs"
-		id = "c2ef6f27-3fb8-55f4-97a6-9e25a3d1ce49"
+		id = "7d124765-4fef-5f39-920c-447302378ff8"
 		date = "2024-03-04"
 		modified = "2024-03-04"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/ByteCode.MSIL.Backdoor.LimeRAT.yara#L1-L91"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "03eaa2ac41950f036601222b32a28c03aae3b3445501e988e2f87e231a1a1522"
+		logic_hash = "v1_sha256_03eaa2ac41950f036601222b32a28c03aae3b3445501e988e2f87e231a1a1522"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -1116,20 +1116,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Limerat : TC_DETECTION MALICIOUS MALWA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($persistence_mechanism) and ($crypto_miner) and ($downloader) and ( all of ($network_communication_p*))
+		uint16( 0 ) == 0x5A4D and ( $persistence_mechanism ) and ( $crypto_miner ) and ( $downloader ) and ( all of ( $network_communication_p* ) )
 }
 rule REVERSINGLABS_Win32_Backdoor_Konni : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Konni backdoor."
 		author = "ReversingLabs"
-		id = "6fe230b1-357a-54f7-a9a8-15d0369fec71"
+		id = "3adee6b6-f4a2-56fb-9de9-07b61006faa9"
 		date = "2023-12-07"
 		modified = "2023-12-07"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Win32.Backdoor.Konni.yara#L1-L190"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7907a657d804d485718ba13bb23513de0b909e7d455c2b3ee193b5329edd3ac6"
+		logic_hash = "v1_sha256_7907a657d804d485718ba13bb23513de0b909e7d455c2b3ee193b5329edd3ac6"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -1291,20 +1291,20 @@ rule REVERSINGLABS_Win32_Backdoor_Konni : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($network_communication_p*)) and ( all of ($handle_c2_commands_p*)) and ( all of ($create_cab_file_and_upload_p*)) and ($cmd_expand_payload)
+		uint16( 0 ) == 0x5A4D and ( all of ( $network_communication_p* ) ) and ( all of ( $handle_c2_commands_p* ) ) and ( all of ( $create_cab_file_and_upload_p* ) ) and ( $cmd_expand_payload )
 }
 rule REVERSINGLABS_Win64_Backdoor_Sidetwist : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects SideTwist backdoor."
 		author = "ReversingLabs"
-		id = "979b442e-8739-54a8-b486-39fc5673791e"
+		id = "37766cd5-d063-5994-b1ca-fe511e60d4db"
 		date = "2024-03-18"
 		modified = "2024-03-18"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Win64.Backdoor.SideTwist.yara#L1-L154"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "811fa73ede59493c71435743848a3fce3a1604ec4065ffcb0b43e9715dfa5c31"
+		logic_hash = "v1_sha256_811fa73ede59493c71435743848a3fce3a1604ec4065ffcb0b43e9715dfa5c31"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -1426,20 +1426,20 @@ rule REVERSINGLABS_Win64_Backdoor_Sidetwist : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($anti_sandbox_detect_environment) and ($collect_host_information) and ($contact_c2_server) and ($parse_c2_response) and ( all of ($download_file_from_c2_p*)) and ($reply_to_c2_server)
+		uint16( 0 ) == 0x5A4D and ( $anti_sandbox_detect_environment ) and ( $collect_host_information ) and ( $contact_c2_server ) and ( $parse_c2_response ) and ( all of ( $download_file_from_c2_p* ) ) and ( $reply_to_c2_server )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Orcusrat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects OrcusRAT backdoor."
 		author = "ReversingLabs"
-		id = "d4700cd1-73a4-552d-bc27-7408508a28e7"
+		id = "2045e507-5dd2-5b84-babb-ed28fc3993fc"
 		date = "2024-09-10"
 		modified = "2024-09-10"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/ByteCode.MSIL.Backdoor.OrcusRAT.yara#L1-L134"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "17a85613e9e4c862ce81fee49065c250381dbf8a50cf07d496f5fd2c1b82d92e"
+		logic_hash = "v1_sha256_17a85613e9e4c862ce81fee49065c250381dbf8a50cf07d496f5fd2c1b82d92e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -1543,20 +1543,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Orcusrat : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($get_tcp_connections) or ( all of ($get_operating_system_information_p*)) or ($take_screenshot) or ($get_passwords) or ($process_key_action))
+		uint16( 0 ) == 0x5A4D and ( ( $get_tcp_connections ) or ( all of ( $get_operating_system_information_p* ) ) or ( $take_screenshot ) or ( $get_passwords ) or ( $process_key_action ) )
 }
 rule REVERSINGLABS_Win32_Backdoor_Minodo : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Minodo backdoor."
 		author = "ReversingLabs"
-		id = "0eeff863-1a46-5b25-8780-5cd887e3b1e2"
+		id = "c215948c-79af-5f96-b975-0d3dcf304fad"
 		date = "2023-06-07"
 		modified = "2023-06-07"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Win64.Backdoor.Minodo.yara#L1-L110"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "807408699fe00c8d1170598050e533dd0d79bb170f2538b6b6227cda7410060b"
+		logic_hash = "v1_sha256_807408699fe00c8d1170598050e533dd0d79bb170f2538b6b6227cda7410060b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -1639,20 +1639,20 @@ rule REVERSINGLABS_Win32_Backdoor_Minodo : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($generate_system_id) and ($generate_encrypt_and_send_key) and ($get_encrypt_and_send_system_info) and ($copy_payload_into_allocated_memory) and ($execute_payload_from_temp)
+		uint16( 0 ) == 0x5A4D and ( $generate_system_id ) and ( $generate_encrypt_and_send_key ) and ( $get_encrypt_and_send_system_info ) and ( $copy_payload_into_allocated_memory ) and ( $execute_payload_from_temp )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Asyncrat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects AsyncRAT backdoor."
 		author = "ReversingLabs"
-		id = "78ff36e1-1620-50f4-8abd-adcf8b1242da"
+		id = "80672778-cc1f-5bd5-a997-0ab67ac3dece"
 		date = "2024-05-22"
 		modified = "2024-05-22"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/ByteCode.MSIL.Backdoor.AsyncRAT.yara#L1-L149"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "53a13975cd53b571910f951adc44707c11b86c003eeb7b88dbe701253645ac89"
+		logic_hash = "v1_sha256_53a13975cd53b571910f951adc44707c11b86c003eeb7b88dbe701253645ac89"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -1763,20 +1763,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Asyncrat : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($read_server_data_v1) and ($send_v1) and ( all of ($read_packet_v1_p*))) or (($send_v2) and ($open_url_v2) and ($monitoring_v2)))
+		uint16( 0 ) == 0x5A4D and ( ( ( $read_server_data_v1 ) and ( $send_v1 ) and ( all of ( $read_packet_v1_p* ) ) ) or ( ( $send_v2 ) and ( $open_url_v2 ) and ( $monitoring_v2 ) ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Menorah : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Menorah backdoor."
 		author = "ReversingLabs"
-		id = "4f13a6c6-bd97-58aa-ac3b-399866b5c63b"
+		id = "97f0b6c1-baa3-5d5b-8475-79ab46b109dc"
 		date = "2024-05-10"
 		modified = "2024-05-10"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/ByteCode.MSIL.Backdoor.Menorah.yara#L1-L169"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "770aefca192ceb3a778c0b1259105ace8e64cb35d0c34acb15c45fb6f22ad94b"
+		logic_hash = "v1_sha256_770aefca192ceb3a778c0b1259105ace8e64cb35d0c34acb15c45fb6f22ad94b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -1922,20 +1922,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Menorah : TC_DETECTION MALICIOUS MALWA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($send_fingerprint_to_c2_p*)) and ( all of ($get_files_and_directories_p*)) and ( all of ($upload_file_to_c2_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $send_fingerprint_to_c2_p* ) ) and ( all of ( $get_files_and_directories_p* ) ) and ( all of ( $upload_file_to_c2_p* ) )
 }
 rule REVERSINGLABS_Linux_Backdoor_Krasue : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Krasue backdoor."
 		author = "ReversingLabs"
-		id = "3187eebf-ef70-585f-85cf-5813025c785e"
+		id = "06135c47-e3d8-5599-9c74-f7958e82f445"
 		date = "2024-03-04"
 		modified = "2024-03-04"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Linux.Backdoor.Krasue.yara#L1-L127"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e2daa35ef9e0793062c9fb3bd8e4838e1e81ee3d228d8117b1c3b0e72eb8e151"
+		logic_hash = "v1_sha256_e2daa35ef9e0793062c9fb3bd8e4838e1e81ee3d228d8117b1c3b0e72eb8e151"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -2033,20 +2033,20 @@ rule REVERSINGLABS_Linux_Backdoor_Krasue : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint32(0)==0x464C457F and ($switch_server) and ($get_hostname) and ( all of ($start_server_p*)) and ($send_encrypt) and ($notify_server)
+		uint32( 0 ) == 0x464C457F and ( $switch_server ) and ( $get_hostname ) and ( all of ( $start_server_p* ) ) and ( $send_encrypt ) and ( $notify_server )
 }
 rule REVERSINGLABS_Linux_Trojan_Chinaz : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects ChinaZ trojan."
 		author = "ReversingLabs"
-		id = "f99c224b-db54-5cae-b5fb-8939ebee3250"
+		id = "bb31f71d-f8e7-57fb-b745-e7f727a9b6a8"
 		date = "2024-07-31"
 		modified = "2024-07-31"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Linux.Trojan.ChinaZ.yara#L1-L246"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d8d08f4f3f36ecc7b219b6b1aae3c76d26e8fb3a44444763929190c6124532ff"
+		logic_hash = "v1_sha256_d8d08f4f3f36ecc7b219b6b1aae3c76d26e8fb3a44444763929190c6124532ff"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -2243,20 +2243,20 @@ rule REVERSINGLABS_Linux_Trojan_Chinaz : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint32(0)==0x464C457F and ((( all of ($collect_system_information_32_p*)) and ($send_system_info_32) and ($parse_c2_commands_32) and ( all of ($dns_flood_32_p*))) or (( all of ($collect_system_information_64_p*)) and ($send_system_info_64) and ($parse_c2_commands_64) and ( all of ($dns_flood_64_p*))))
+		uint32( 0 ) == 0x464C457F and ( ( ( all of ( $collect_system_information_32_p* ) ) and ( $send_system_info_32 ) and ( $parse_c2_commands_32 ) and ( all of ( $dns_flood_32_p* ) ) ) or ( ( all of ( $collect_system_information_64_p* ) ) and ( $send_system_info_64 ) and ( $parse_c2_commands_64 ) and ( all of ( $dns_flood_64_p* ) ) ) )
 }
 rule REVERSINGLABS_Linux_Backdoor_Noodrat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects NoodRAT backdoor."
 		author = "ReversingLabs"
-		id = "ac5eae27-dc42-5060-b639-c23c0bbabb50"
+		id = "8a2bded9-1c95-584d-ab0a-f654373db615"
 		date = "2024-08-26"
 		modified = "2024-08-26"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Linux.Backdoor.NoodRAT.yara#L1-L162"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2ec4a8ba7428054edb4dcdb6a00015b9758badf515f2c210bb946ba5402674d2"
+		logic_hash = "v1_sha256_2ec4a8ba7428054edb4dcdb6a00015b9758badf515f2c210bb946ba5402674d2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -2390,20 +2390,20 @@ rule REVERSINGLABS_Linux_Backdoor_Noodrat : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint32(0)==0x464C457F and (( all of ($change_name_on_system_p*)) and ( all of ($decrypt_configuration_p*)) and ($encrypt_and_send_data) and ($receive_and_decrypt_data))
+		uint32( 0 ) == 0x464C457F and ( ( all of ( $change_name_on_system_p* ) ) and ( all of ( $decrypt_configuration_p* ) ) and ( $encrypt_and_send_data ) and ( $receive_and_decrypt_data ) )
 }
 rule REVERSINGLABS_Win64_Backdoor_Konni : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Konni backdoor."
 		author = "ReversingLabs"
-		id = "c45c23c6-be15-58cc-ae4d-631bed4a3bb2"
+		id = "4e42748c-63d0-504f-8200-0e2956842dbe"
 		date = "2023-12-07"
 		modified = "2023-12-07"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Win64.Backdoor.Konni.yara#L1-L205"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "37c45e3ed23ca9f4de876f666c9f6d9bf7eee5cb1650b02cdd9f58e2ccc4b5cb"
+		logic_hash = "v1_sha256_37c45e3ed23ca9f4de876f666c9f6d9bf7eee5cb1650b02cdd9f58e2ccc4b5cb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -2579,20 +2579,20 @@ rule REVERSINGLABS_Win64_Backdoor_Konni : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($network_communication_p*)) and ( all of ($handle_c2_commands_p*)) and ( all of ($create_cab_file_and_upload_p*)) and ( all of ($cmd_expand_payload_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $network_communication_p* ) ) and ( all of ( $handle_c2_commands_p* ) ) and ( all of ( $create_cab_file_and_upload_p* ) ) and ( all of ( $cmd_expand_payload_p* ) )
 }
 rule REVERSINGLABS_Linux_Backdoor_Linodas : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Linodas backdoor."
 		author = "ReversingLabs"
-		id = "2b197346-abce-5cff-938f-bb8742e03168"
+		id = "59e8249b-b374-596c-aebb-6f77f2bf5ca5"
 		date = "2024-05-22"
 		modified = "2024-05-22"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/backdoor/Linux.Backdoor.Linodas.yara#L1-L216"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "12445771106e36b74b1ea292a8a25cab66bcaf0a08cf88d39a9f1bb13c6f525b"
+		logic_hash = "v1_sha256_12445771106e36b74b1ea292a8a25cab66bcaf0a08cf88d39a9f1bb13c6f525b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -2760,20 +2760,20 @@ rule REVERSINGLABS_Linux_Backdoor_Linodas : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint32(0)==0x464C457F and (($persistence_mechanism_ubuntu) and ( all of ($network_communication_*)) and ((($change_timestamp_and_read_config_v11) and ($persistence_mechanism_redhat_v11) and ($generate_machine_id_v11)) or (($persistence_mechanism_redhat_v7) and ($get_device_name_v7) and ($generate_machine_id_v7))))
+		uint32( 0 ) == 0x464C457F and ( ( $persistence_mechanism_ubuntu ) and ( all of ( $network_communication_* ) ) and ( ( ( $change_timestamp_and_read_config_v11 ) and ( $persistence_mechanism_redhat_v11 ) and ( $generate_machine_id_v11 ) ) or ( ( $persistence_mechanism_redhat_v7 ) and ( $get_device_name_v7 ) and ( $generate_machine_id_v7 ) ) ) )
 }
 rule REVERSINGLABS_Win32_Downloader_Dlmarlboro : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects dlMarlboro downloader."
 		author = "ReversingLabs"
-		id = "4c99b5a4-dc6b-579b-b1bd-bd4c93c6e68c"
+		id = "cb634c2d-9bd2-5d9e-9a94-084c1b958fef"
 		date = "2020-07-23"
 		modified = "2020-07-23"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/downloader/Win32.Downloader.dlMarlboro.yara#L1-L79"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "465a3b3a9686889001ac0b929d0349e44b6015eaeed3386361366def5013164a"
+		logic_hash = "v1_sha256_465a3b3a9686889001ac0b929d0349e44b6015eaeed3386361366def5013164a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -2842,20 +2842,20 @@ rule REVERSINGLABS_Win32_Downloader_Dlmarlboro : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $ping_apnic and $download_bin_1 and $download_bin_2
+		uint16( 0 ) == 0x5A4D and $ping_apnic and $download_bin_1 and $download_bin_2
 }
 rule REVERSINGLABS_Win32_PUA_Domaiq : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Domaiq potentially unwanted application."
 		author = "ReversingLabs"
-		id = "44129e4b-7dc2-5af0-b466-80dc4f4d6388"
+		id = "b4a275a4-b66e-55fe-88ac-08bcaaaddb53"
 		date = "2020-07-28"
 		modified = "2020-07-28"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/pua/Win32.PUA.Domaiq.yara#L1-L169"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e291a639aa027a2257eec2853e40a222afabf23b32898326a1d5b48be823202c"
+		logic_hash = "v1_sha256_e291a639aa027a2257eec2853e40a222afabf23b32898326a1d5b48be823202c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -2986,20 +2986,20 @@ rule REVERSINGLABS_Win32_PUA_Domaiq : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $payload and ($NSIS_CheckIntegrity or ($UPX_Decompression and $UPX_Encrypting) or $NSIS_ErrorPart or $dumping_functionv2014 or $dumping_functionMidVersion or ($exception1 and $exception2 and $exceptionallock) or $dumping_functionP or $dumping_functionE or $dumping_functionB or $dumping_function111 or $dumping_function2 or $lib_loader)
+		uint16( 0 ) == 0x5A4D and $payload and ( $NSIS_CheckIntegrity or ( $UPX_Decompression and $UPX_Encrypting ) or $NSIS_ErrorPart or $dumping_functionv2014 or $dumping_functionMidVersion or ( $exception1 and $exception2 and $exceptionallock ) or $dumping_functionP or $dumping_functionE or $dumping_functionB or $dumping_function111 or $dumping_function2 or $lib_loader )
 }
 rule REVERSINGLABS_Win32_Trojan_Trickbot : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects TrickBot trojan."
 		author = "ReversingLabs"
-		id = "4ed253cc-0398-542b-a2b7-c42a0b9431fb"
+		id = "3e2397ba-02cf-509f-8767-397770d07585"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/trojan/Win32.Trojan.TrickBot.yara#L1-L46"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e10f16c70f1ff7cf11d3e25f06e4c5d9e20c51688582d2b51322f768a8e06d7e"
+		logic_hash = "v1_sha256_e10f16c70f1ff7cf11d3e25f06e4c5d9e20c51688582d2b51322f768a8e06d7e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3030,20 +3030,20 @@ rule REVERSINGLABS_Win32_Trojan_Trickbot : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $entry_setup and ($decrypt_function_snippet or $decrypt_function_snippet_wrapper)
+		uint16( 0 ) == 0x5A4D and $entry_setup and ( $decrypt_function_snippet or $decrypt_function_snippet_wrapper )
 }
 rule REVERSINGLABS_Linux_Trojan_Bibiwiper : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BiBiWiper trojan."
 		author = "ReversingLabs"
-		id = "c370dde0-71ff-5832-b131-6d61beb02b9b"
+		id = "02f6df69-b20d-5341-af11-78bcb31d3412"
 		date = "2023-11-28"
 		modified = "2023-11-28"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/trojan/Linux.Trojan.BiBiWiper.yara#L1-L76"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8f290141d5da660463dede6df571d774448e136e2993a0a4c706245464e1239e"
+		logic_hash = "v1_sha256_8f290141d5da660463dede6df571d774448e136e2993a0a4c706245464e1239e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3106,20 +3106,20 @@ rule REVERSINGLABS_Linux_Trojan_Bibiwiper : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint32(0)==0x464C457F and ( all of ($destroy_files_p*))
+		uint32( 0 ) == 0x464C457F and ( all of ( $destroy_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Trojan_Emotet : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Emotet trojan."
 		author = "ReversingLabs"
-		id = "9742743d-753a-582b-9701-7278c8ed0e4e"
+		id = "7b53dbaf-9563-5400-ad3f-9f4fd82ba3fb"
 		date = "2021-11-16"
 		modified = "2021-11-16"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/trojan/Win32.Trojan.Emotet.yara#L1-L182"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "747d603c9849a66782c95050a4a634ffdb4ce2882adcfc5d63e1f1ea1651b25e"
+		logic_hash = "v1_sha256_747d603c9849a66782c95050a4a634ffdb4ce2882adcfc5d63e1f1ea1651b25e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3252,20 +3252,20 @@ rule REVERSINGLABS_Win32_Trojan_Emotet : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($decrypt_resource_v1 and $generate_filename_v1) or ($decrypt_resource_v2 and $generate_filename_v2) or ($decrypt_resource_v3 and $generate_filename_v3) or ($decrypt_resource_v4 and $generate_filename_snippet_v4) or ($decrypt_resource_snippet_v5 and all of ($liblzf_decompression_*)) or ($decrypt_resource_snippet_v6 and all of ($liblzf_decompression_*)) or ($decrypt_resource_snippet_v7 and $state_machine_snippet_v7)
+		uint16( 0 ) == 0x5A4D and ( $decrypt_resource_v1 and $generate_filename_v1 ) or ( $decrypt_resource_v2 and $generate_filename_v2 ) or ( $decrypt_resource_v3 and $generate_filename_v3 ) or ( $decrypt_resource_v4 and $generate_filename_snippet_v4 ) or ( $decrypt_resource_snippet_v5 and all of ( $liblzf_decompression_* ) ) or ( $decrypt_resource_snippet_v6 and all of ( $liblzf_decompression_* ) ) or ( $decrypt_resource_snippet_v7 and $state_machine_snippet_v7 )
 }
 rule REVERSINGLABS_Win32_Trojan_Dridex : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Dridex trojan."
 		author = "ReversingLabs"
-		id = "bc68aca1-69e6-57e6-9277-70c89fda1e5d"
+		id = "bab5036c-68a3-5fb5-a48d-e0d065eb69a0"
 		date = "2020-09-16"
 		modified = "2020-09-16"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/trojan/Win32.Trojan.Dridex.yara#L1-L80"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7eddc8f33846dfb61302b7d7fddd8dec59a1bde05b14135c14131a02e2c19600"
+		logic_hash = "v1_sha256_7eddc8f33846dfb61302b7d7fddd8dec59a1bde05b14135c14131a02e2c19600"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3325,20 +3325,20 @@ rule REVERSINGLABS_Win32_Trojan_Dridex : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($resolve_api_wrapper_*) and any of ($find_first_file_snippet_*))
+		uint16( 0 ) == 0x5A4D and ( any of ( $resolve_api_wrapper_* ) and any of ( $find_first_file_snippet_* ) )
 }
 rule REVERSINGLABS_Linux_Trojan_Acidrain : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects AcidRain trojan."
 		author = "ReversingLabs"
-		id = "802c7eb7-d407-5b07-a6b4-4648d3ad80e9"
+		id = "2b4638c1-6d93-5513-8063-80efe3c43815"
 		date = "2024-05-10"
 		modified = "2024-05-10"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/trojan/Linux.Trojan.AcidRain.yara#L1-L67"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5b47a0de8bda09d217f8a148e561f3da7ce4945f011f4a9b5dbbca88157d3080"
+		logic_hash = "v1_sha256_5b47a0de8bda09d217f8a148e561f3da7ce4945f011f4a9b5dbbca88157d3080"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3386,20 +3386,20 @@ rule REVERSINGLABS_Linux_Trojan_Acidrain : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint32(0)==0x464C457F and ($destroy_files_using_ioctls) and ($destroy_files_using_overwrite) and ($redundant_reboot_attempts)
+		uint32( 0 ) == 0x464C457F and ( $destroy_files_using_ioctls ) and ( $destroy_files_using_overwrite ) and ( $redundant_reboot_attempts )
 }
 rule REVERSINGLABS_Win32_Trojan_Isaacwiper : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects IsaacWiper trojan."
 		author = "ReversingLabs"
-		id = "c0924e5e-a942-57a3-a9f9-e6be6efa4c73"
+		id = "d4b32bc7-dc28-5977-8620-688cfb1202ff"
 		date = "2022-03-02"
 		modified = "2022-03-02"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/trojan/Win32.Trojan.IsaacWiper.yara#L1-L76"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c9fa43f44c33816a66f61255d101294da63df1afc5a27ed5817072040cd1eec5"
+		logic_hash = "v1_sha256_c9fa43f44c33816a66f61255d101294da63df1afc5a27ed5817072040cd1eec5"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3464,20 +3464,20 @@ rule REVERSINGLABS_Win32_Trojan_Isaacwiper : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enumerate_physical_drives and $corrupt_drive_thread)
+		uint16( 0 ) == 0x5A4D and ( $enumerate_physical_drives and $corrupt_drive_thread )
 }
 rule REVERSINGLABS_Win32_Trojan_Bibiwiper : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BiBiWiper trojan."
 		author = "ReversingLabs"
-		id = "8462ceb8-ec54-5f92-a3e7-c96e52647ca7"
+		id = "98a2bc59-6e22-54bb-979f-0f5b10790580"
 		date = "2023-11-28"
 		modified = "2023-11-28"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/trojan/Win32.Trojan.BiBiWiper.yara#L1-L102"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d75954c05a8f82ad90a4adf6a2a3748928488ddebe40d8f8a790bfcde0b02a11"
+		logic_hash = "v1_sha256_d75954c05a8f82ad90a4adf6a2a3748928488ddebe40d8f8a790bfcde0b02a11"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3562,20 +3562,20 @@ rule REVERSINGLABS_Win32_Trojan_Bibiwiper : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($delete_shadow_copies_p*)) and ( all of ($destroy_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $delete_shadow_copies_p* ) ) and ( all of ( $destroy_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Trojan_Hermeticwiper : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects HermeticWiper trojan."
 		author = "ReversingLabs"
-		id = "252dfb3d-9d4e-51a4-80c9-64e17922d997"
+		id = "167e4cda-7bb8-565e-99ec-b82d3e9f10d9"
 		date = "2022-02-24"
 		modified = "2022-02-24"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/trojan/Win32.Trojan.HermeticWiper.yara#L1-L50"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0fa519ce8285ffe4e49c2a301e8a0fd0516a05dc6b41ee0b010fdc76dd6e195e"
+		logic_hash = "v1_sha256_0fa519ce8285ffe4e49c2a301e8a0fd0516a05dc6b41ee0b010fdc76dd6e195e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3615,20 +3615,20 @@ rule REVERSINGLABS_Win32_Trojan_Hermeticwiper : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($corrupt_physical_drive)
+		uint16( 0 ) == 0x5A4D and ( $corrupt_physical_drive )
 }
 rule REVERSINGLABS_Win32_Trojan_Caddywiper : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects CaddyWiper trojan."
 		author = "ReversingLabs"
-		id = "ad437f29-4ad8-5a88-a0b6-03de55e7375f"
+		id = "4d605eea-b7d0-5095-91e6-f29b42720522"
 		date = "2022-03-15"
 		modified = "2022-03-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/trojan/Win32.Trojan.CaddyWiper.yara#L1-L95"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "178ff4171c09866f6b303bdff234beff1116d268995ee4dc236332e472d645b1"
+		logic_hash = "v1_sha256_178ff4171c09866f6b303bdff234beff1116d268995ee4dc236332e472d645b1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3702,20 +3702,20 @@ rule REVERSINGLABS_Win32_Trojan_Caddywiper : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($destroy_if_not_controller) and ($erase_drive_data) and ( all of ($erase_drives_recursively_*))
+		uint16( 0 ) == 0x5A4D and ( $destroy_if_not_controller ) and ( $erase_drive_data ) and ( all of ( $erase_drives_recursively_* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Dualshot : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Dualshot ransomware."
 		author = "ReversingLabs"
-		id = "17828c85-0f1b-581b-842a-24e6f26e0b4d"
+		id = "1c060c6b-b231-538e-b103-143b53b53276"
 		date = "2020-11-20"
 		modified = "2020-11-20"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Dualshot.yara#L1-L112"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a401369357901f42ad83227b025d3b14b3acd1f50705da82afbe8e4f85501919"
+		logic_hash = "v1_sha256_a401369357901f42ad83227b025d3b14b3acd1f50705da82afbe8e4f85501919"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3806,20 +3806,20 @@ rule REVERSINGLABS_Win32_Ransomware_Dualshot : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($internal_encrypt_file)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $internal_encrypt_file )
 }
 rule REVERSINGLABS_Win64_Ransomware_Seedlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects SeedLocker ransomware."
 		author = "ReversingLabs"
-		id = "efa3dd2e-faf4-5882-aef8-85189e65f0f9"
+		id = "afdf575a-4c54-5e6d-adbe-34f8168db3c2"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.SeedLocker.yara#L1-L91"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a478efcfb03e3eeebe72d9a71629456cf061c3c779fbdde99539854caf8c7c33"
+		logic_hash = "v1_sha256_a478efcfb03e3eeebe72d9a71629456cf061c3c779fbdde99539854caf8c7c33"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -3899,20 +3899,20 @@ rule REVERSINGLABS_Win64_Ransomware_Seedlocker : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_files and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and $search_files and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Hentaioniichan : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Hentai Oniichan ransomware."
 		author = "ReversingLabs"
-		id = "cd5e916f-7195-5bb6-abff-b08231053f9a"
+		id = "963df5fd-ffe0-5a40-aa44-90ade5e7ff5b"
 		date = "2021-03-05"
 		modified = "2021-03-05"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.HentaiOniichan.yara#L1-L140"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "153526e5a2f05bc8e3f77d83eefce6b4cd962ea093b6f1c0ab8fcabe8d8a7ad9"
+		logic_hash = "v1_sha256_153526e5a2f05bc8e3f77d83eefce6b4cd962ea093b6f1c0ab8fcabe8d8a7ad9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -4027,20 +4027,20 @@ rule REVERSINGLABS_Win32_Ransomware_Hentaioniichan : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($inject_code_into_process) and ( all of ($find_files_p*)) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $inject_code_into_process ) and ( all of ( $find_files_p* ) ) and ( $encrypt_files ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Knot : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Knot ransomware."
 		author = "ReversingLabs"
-		id = "4dfe9da5-7ab1-57dc-95fc-b05777f235b8"
+		id = "da7ae347-ceaf-5150-bf77-2457dd40d52e"
 		date = "2021-03-19"
 		modified = "2021-03-19"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Knot.yara#L1-L118"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a7a3e13139d68314e583ec225a5d56373a551e67d46984dcf9a228a1f7275f14"
+		logic_hash = "v1_sha256_a7a3e13139d68314e583ec225a5d56373a551e67d46984dcf9a228a1f7275f14"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -4137,20 +4137,20 @@ rule REVERSINGLABS_Win32_Ransomware_Knot : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Serpent : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Serpent ransomware."
 		author = "ReversingLabs"
-		id = "0757ad7c-b2b1-5323-960a-55ffe3eaed12"
+		id = "b421570c-73d7-5754-8ebc-62e66a8200ae"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Serpent.yara#L1-L122"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5e1917e8d23a5edc65ac423f3d18cc78c3848bd6c1ccc67d052eb37172857081"
+		logic_hash = "v1_sha256_5e1917e8d23a5edc65ac423f3d18cc78c3848bd6c1ccc67d052eb37172857081"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -4261,20 +4261,20 @@ rule REVERSINGLABS_Win32_Ransomware_Serpent : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and $do_dll_stuff_and_create_thread and $find_files and $remote_connection and $remote_ftp_connection
+		uint16( 0 ) == 0x5A4D and $do_dll_stuff_and_create_thread and $find_files and $remote_connection and $remote_ftp_connection
 }
 rule REVERSINGLABS_Win64_Ransomware_Rook : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Rook ransomware."
 		author = "ReversingLabs"
-		id = "60bbfd57-18bb-58b3-9abc-ab30943bbddd"
+		id = "f0d22841-c3e0-54ec-9a32-b9ad96717fd2"
 		date = "2022-01-17"
 		modified = "2022-01-17"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Rook.yara#L1-L122"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dc8b37e55b634de52855dd851dbaaf3e690adfb2e875d0e0c9ef5f4846c6ff30"
+		logic_hash = "v1_sha256_dc8b37e55b634de52855dd851dbaaf3e690adfb2e875d0e0c9ef5f4846c6ff30"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -4371,20 +4371,20 @@ rule REVERSINGLABS_Win64_Ransomware_Rook : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_shares) and ($enum_procs) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_shares ) and ( $enum_procs ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Farattack : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects FarAttack ransomware."
 		author = "ReversingLabs"
-		id = "7ee7121a-4ca2-513c-96dc-53b5c48d719f"
+		id = "0d886f84-d417-5c45-b279-2c677d98fcae"
 		date = "2022-06-21"
 		modified = "2022-06-21"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.FarAttack.yara#L1-L93"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "af22b8110c2b545f083b443c7a1fa7e7639324e9188eefadfe1fe70ebb1bb7fb"
+		logic_hash = "v1_sha256_af22b8110c2b545f083b443c7a1fa7e7639324e9188eefadfe1fe70ebb1bb7fb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -4457,20 +4457,20 @@ rule REVERSINGLABS_Win32_Ransomware_Farattack : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($create_key) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $create_key ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Winword64 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects WinWord64 ransomware."
 		author = "ReversingLabs"
-		id = "a5f7967d-58f4-5fdd-b67f-5f5dbfec0f4b"
+		id = "626128d7-7a36-5d82-aa87-b46f525a68dc"
 		date = "2021-02-11"
 		modified = "2021-02-11"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.WinWord64.yara#L1-L215"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "73d8c4f1b3bed365320b26332f1f1b49404d8e6536f3e25042f5f64e5bc09bd4"
+		logic_hash = "v1_sha256_73d8c4f1b3bed365320b26332f1f1b49404d8e6536f3e25042f5f64e5bc09bd4"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -4659,20 +4659,20 @@ rule REVERSINGLABS_Win32_Ransomware_Winword64 : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Princesslocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects PrincessLocker ransomware."
 		author = "ReversingLabs"
-		id = "b76ef137-aa0b-5fd3-9876-2459cb6535ff"
+		id = "765d0f55-b40f-57cd-8441-23e3079c8cff"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.PrincessLocker.yara#L1-L92"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5be4ca3bd0b0afed1d2f3a59e2951d74a8de94c5a4d5a2c6cc29add49eab9ec0"
+		logic_hash = "v1_sha256_5be4ca3bd0b0afed1d2f3a59e2951d74a8de94c5a4d5a2c6cc29add49eab9ec0"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -4754,20 +4754,20 @@ rule REVERSINGLABS_Win32_Ransomware_Princesslocker : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_files and $remote_connection_1 and $remote_connection_2
+		uint16( 0 ) == 0x5A4D and $encrypt_files and $remote_connection_1 and $remote_connection_2
 }
 rule REVERSINGLABS_Win32_Ransomware_Ouroboros : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ouroboros ransomware."
 		author = "ReversingLabs"
-		id = "af0b9311-a7dd-56e8-a004-0828af5af5ef"
+		id = "b1396afd-627a-5a77-b461-fa9705b69cb2"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Ouroboros.yara#L1-L175"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b573f303318452010ff46f21a02b6290820f9a27bf4c51b72f6ed15263b5f433"
+		logic_hash = "v1_sha256_b573f303318452010ff46f21a02b6290820f9a27bf4c51b72f6ed15263b5f433"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -4913,20 +4913,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ouroboros : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and (( all of ($encrypt_files_p*)) or ($encrypt_files_angus_version)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( ( all of ( $encrypt_files_p* ) ) or ( $encrypt_files_angus_version ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cring : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Cring ransomware."
 		author = "ReversingLabs"
-		id = "76530a6d-145b-5316-8200-4b191d0754fd"
+		id = "b4417071-575b-5c0f-b957-af762dbc00ee"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Cring.yara#L1-L66"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "05cf60ad39c9dcc592345f13b63c99b153b9253297a8ad9e52e0439081d8c796"
+		logic_hash = "v1_sha256_05cf60ad39c9dcc592345f13b63c99b153b9253297a8ad9e52e0439081d8c796"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -4976,20 +4976,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cring : TC_DETECTION MALICIOUS MALWA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Harpoonlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects HarpoonLocker ransomware."
 		author = "ReversingLabs"
-		id = "3605d354-5a33-54b1-83ad-ad514c78357b"
+		id = "b1dfc37c-d721-5edf-9628-d50526aa0798"
 		date = "2022-01-27"
 		modified = "2022-01-27"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.HarpoonLocker.yara#L1-L96"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "20587f9dce5981934498d9979843a090224ba649def8b694adf7799b7060cc25"
+		logic_hash = "v1_sha256_20587f9dce5981934498d9979843a090224ba649def8b694adf7799b7060cc25"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -5065,20 +5065,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Harpoonlocker : TC_DETECTION MALICIO
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($change_boot) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $change_boot ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Rokku : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Rokku ransomware."
 		author = "ReversingLabs"
-		id = "8722ed4a-b480-57ec-bba7-ce7d0f3704b9"
+		id = "d6709e78-3cd0-538a-aa63-56b973b29bee"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Rokku.yara#L1-L147"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fefb342f8a9afac3b40c343b830f334225ff4198d55504846aa855acf5dfc9ba"
+		logic_hash = "v1_sha256_fefb342f8a9afac3b40c343b830f334225ff4198d55504846aa855acf5dfc9ba"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -5203,20 +5203,20 @@ rule REVERSINGLABS_Win32_Ransomware_Rokku : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_folders and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)))
+		uint16( 0 ) == 0x5A4D and ( $find_folders and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Medusalocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects MedusaLocker ransomware."
 		author = "ReversingLabs"
-		id = "8bfcfe13-b519-5c03-9770-cf245b01c395"
+		id = "991bd5c5-6b0f-547c-9daf-bea5dbb30ee4"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.MedusaLocker.yara#L1-L174"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "73f915d476d1411d2e008d00c5ffa03596e3b62bcdbc4d91dc7226599a066c08"
+		logic_hash = "v1_sha256_73f915d476d1411d2e008d00c5ffa03596e3b62bcdbc4d91dc7226599a066c08"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -5356,20 +5356,20 @@ rule REVERSINGLABS_Win32_Ransomware_Medusalocker : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($kill_processes_call) and ($kill_processes) and ($enum_resources) and ( all of ($search_files_*)) and ( all of ($encrypt_files_p*)) and ($enum_resources_call)
+		uint16( 0 ) == 0x5A4D and ( $kill_processes_call ) and ( $kill_processes ) and ( $enum_resources ) and ( all of ( $search_files_* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $enum_resources_call )
 }
 rule REVERSINGLABS_Win32_Ransomware_Termite : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Termite ransomware."
 		author = "ReversingLabs"
-		id = "350011fa-1e3c-5079-8fe7-968340a3aca0"
+		id = "cacfa08f-2fbb-5743-a2d6-c9d0a6b5d474"
 		date = "2020-08-31"
 		modified = "2020-08-31"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Termite.yara#L1-L151"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "df273de81fc58cb0bacf021ee539ec6dbfa1f1a3e13bd46519ee313595cafb4c"
+		logic_hash = "v1_sha256_df273de81fc58cb0bacf021ee539ec6dbfa1f1a3e13bd46519ee313595cafb4c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -5500,20 +5500,20 @@ rule REVERSINGLABS_Win32_Ransomware_Termite : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Blackbasta : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BlackBasta ransomware."
 		author = "ReversingLabs"
-		id = "7a4ad567-0612-5a9c-8a06-4d615bc7e24a"
+		id = "fceb40c0-723e-567b-9d3e-15926eb486d7"
 		date = "2022-12-13"
 		modified = "2022-12-13"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.BlackBasta.yara#L1-L293"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "79c81a4470e9eabbd714b1a91621c7b2bbe42d5371ba2c799529662d5f5c479a"
+		logic_hash = "v1_sha256_79c81a4470e9eabbd714b1a91621c7b2bbe42d5371ba2c799529662d5f5c479a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -5747,20 +5747,20 @@ rule REVERSINGLABS_Win64_Ransomware_Blackbasta : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($find_files) and ( all of ($find_system_volumes_v1_p*)) and ( all of ($set_default_icon_p*)) and ($cmd_prompt) and ($exclude_from_encryption) and ($encrypt_files_v1)) or (($find_files) and ($cmd_prompt) and ($find_system_volumes_v2) and ($drop_ransom_note) and ( all of ($encrypt_files_v2_p*))))
+		uint16( 0 ) == 0x5A4D and ( ( ( $find_files ) and ( all of ( $find_system_volumes_v1_p* ) ) and ( all of ( $set_default_icon_p* ) ) and ( $cmd_prompt ) and ( $exclude_from_encryption ) and ( $encrypt_files_v1 ) ) or ( ( $find_files ) and ( $cmd_prompt ) and ( $find_system_volumes_v2 ) and ( $drop_ransom_note ) and ( all of ( $encrypt_files_v2_p* ) ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Garrantydecrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GarrantyDecrypt ransomware."
 		author = "ReversingLabs"
-		id = "0aa05f06-1773-5ce8-892d-04468f5deccc"
+		id = "f89cab43-4e85-5a80-a7ab-9e1ab699d30f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.GarrantyDecrypt.yara#L1-L79"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7194c1e0e15a89f2c691a7d586b9db68295cc52a5f042d0f7eb558c326430444"
+		logic_hash = "v1_sha256_7194c1e0e15a89f2c691a7d586b9db68295cc52a5f042d0f7eb558c326430444"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -5829,20 +5829,20 @@ rule REVERSINGLABS_Win32_Ransomware_Garrantydecrypt : TC_DETECTION MALICIOUS MAL
         }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and $find_files and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Albabat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Albabat ransomware."
 		author = "ReversingLabs"
-		id = "11941c0d-45fb-5746-bbad-f43f336d4b1d"
+		id = "ea9bb46e-2790-503e-88da-8bd6270124b4"
 		date = "2024-03-18"
 		modified = "2024-03-18"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Albabat.yara#L1-L139"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "38ec8388b9006f6ab9a397858b89f4bfd7def2ffcf525cfc736abae49bc6034a"
+		logic_hash = "v1_sha256_38ec8388b9006f6ab9a397858b89f4bfd7def2ffcf525cfc736abae49bc6034a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -5956,21 +5956,21 @@ rule REVERSINGLABS_Win64_Ransomware_Albabat : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note) and ($change_desktop_wallpaper)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $drop_ransom_note ) and ( $change_desktop_wallpaper )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Oct : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Oct ransomware."
 		author = "ReversingLabs"
-		id = "e811a0ba-52df-5e88-ab71-df91d5cb584a"
-		date = "2024-10-08"
-		date = "2024-10-08"
+		id = "d054239a-564e-5f1a-a380-62dadb020d8d"
+		date = "2024-10-15"
+		date = "2024-10-15"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Oct.yara#L1-L68"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3973794d6bf26eaa752cfc70a217c059a190c63a0dd92b06de7c0893d92d9e88"
+		logic_hash = "v1_sha256_3973794d6bf26eaa752cfc70a217c059a190c63a0dd92b06de7c0893d92d9e88"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6018,20 +6018,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Oct : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($collect_env_and_start_enc_proc) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $collect_env_and_start_enc_proc ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Policerecords : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects PoliceRecords ransomware."
 		author = "ReversingLabs"
-		id = "bacd3f98-a069-58ca-8423-01fcef7d4062"
+		id = "ec46da8b-cc38-5c6d-925a-b88da22095cc"
 		date = "2022-08-02"
 		modified = "2022-08-02"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.PoliceRecords.yara#L1-L79"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "55cb1a5d030c47abb1a9ca9970fb19b3124128e409bc9515c173c33b2bb49a16"
+		logic_hash = "v1_sha256_55cb1a5d030c47abb1a9ca9970fb19b3124128e409bc9515c173c33b2bb49a16"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6087,20 +6087,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Policerecords : TC_DETECTION MALICIO
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($desktop_kill_tick) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $desktop_kill_tick ) and ( $drop_ransom_note )
 }
 rule REVERSINGLABS_Win32_Ransomware_Delphimorix : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Delphimorix ransomware."
 		author = "ReversingLabs"
-		id = "1f964601-9819-5597-ba6e-db3a30e3aa5a"
+		id = "3630e7d1-e9a2-5abb-b1ca-7dd87a87932b"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Delphimorix.yara#L1-L67"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6d401d488d57b2d75e93a1dfd47ece687a5791d1f0a52768300f4af8a8787212"
+		logic_hash = "v1_sha256_6d401d488d57b2d75e93a1dfd47ece687a5791d1f0a52768300f4af8a8787212"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6151,20 +6151,20 @@ rule REVERSINGLABS_Win32_Ransomware_Delphimorix : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Denizkizi : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects DenizKizi ransomware."
 		author = "ReversingLabs"
-		id = "e16a00d6-d5b8-5702-9cd7-d037b0ff46a3"
+		id = "dbc4d6fd-4983-520e-99cb-76b19e95c65e"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.DenizKizi.yara#L1-L88"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fbeb01263d6f68141e094ba8fb1c1a54c601ab24292f5c6b0eb8cb0c49f46afc"
+		logic_hash = "v1_sha256_fbeb01263d6f68141e094ba8fb1c1a54c601ab24292f5c6b0eb8cb0c49f46afc"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6233,20 +6233,20 @@ rule REVERSINGLABS_Win32_Ransomware_Denizkizi : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($delete_shadow_copies)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $delete_shadow_copies )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Apis : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Apis ransomware."
 		author = "ReversingLabs"
-		id = "63791250-e21e-53d1-932c-9b5d16a7cad9"
+		id = "55ff2db5-a9fd-55d8-90ca-749cb60b464c"
 		date = "2021-11-25"
 		modified = "2021-11-25"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Apis.yara#L1-L75"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0915469884a268f124da348d6a182eb4a0f69063d4041b46628794ab011227ef"
+		logic_hash = "v1_sha256_0915469884a268f124da348d6a182eb4a0f69063d4041b46628794ab011227ef"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6302,20 +6302,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Apis : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $setup_env ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Ghostbin : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ghostbin ransomware."
 		author = "ReversingLabs"
-		id = "4d576854-7a30-527d-9a7a-f22018183540"
+		id = "548c3089-cc4b-56d9-9109-529fca0f4f72"
 		date = "2021-09-06"
 		modified = "2021-09-06"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Ghostbin.yara#L1-L61"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3881e1c83ac2a31fdd8a081d3e6e6ea759771dbc183c3af9528930619bcddf9e"
+		logic_hash = "v1_sha256_3881e1c83ac2a31fdd8a081d3e6e6ea759771dbc183c3af9528930619bcddf9e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6357,20 +6357,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Ghostbin : TC_DETECTION MALICIOUS MA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $setup_env ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Tblocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects TBLocker ransomware."
 		author = "ReversingLabs"
-		id = "91793018-baf6-5e70-83b6-8793482c3bec"
+		id = "822548b4-9389-51ab-aec3-c300b1b0cd79"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.TBLocker.yara#L1-L85"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "81f0077655ac0e59cd8dc05be602ae500c938668bd57d3cf4a51fbff2a5b6b83"
+		logic_hash = "v1_sha256_81f0077655ac0e59cd8dc05be602ae500c938668bd57d3cf4a51fbff2a5b6b83"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6437,20 +6437,20 @@ rule REVERSINGLABS_Win32_Ransomware_Tblocker : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($main_ransomware_function_p*)) and $search_files and $encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( ( all of ( $main_ransomware_function_p* ) ) and $search_files and $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Clop : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Clop ransomware."
 		author = "ReversingLabs"
-		id = "0ea63119-3773-5404-b332-8e3966fd35df"
+		id = "5d7a4d58-6836-5110-be34-05c4fddccdeb"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Clop.yara#L1-L109"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0b63db16a4b1cae27a97d0ff9df692a63f1a11120ffac69c05a5c71fbd224007"
+		logic_hash = "v1_sha256_0b63db16a4b1cae27a97d0ff9df692a63f1a11120ffac69c05a5c71fbd224007"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6538,20 +6538,20 @@ rule REVERSINGLABS_Win32_Ransomware_Clop : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($uninstall_eset_av)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( $uninstall_eset_av )
 }
 rule REVERSINGLABS_Win32_Ransomware_Dearcry : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects DearCry ransomware."
 		author = "ReversingLabs"
-		id = "6e2097e0-6495-5185-bbbc-e8168fa0ca7f"
+		id = "64304d23-9ba6-526c-abde-17840142e65e"
 		date = "2021-03-12"
 		modified = "2021-03-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.DearCry.yara#L1-L96"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "40dde232255018e1bc0aadf2378a7a86a99327d13dda58d8ffc5bb38e164de26"
+		logic_hash = "v1_sha256_40dde232255018e1bc0aadf2378a7a86a99327d13dda58d8ffc5bb38e164de26"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6630,20 +6630,20 @@ rule REVERSINGLABS_Win32_Ransomware_Dearcry : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($drop_ransom_note_p*)) and ( all of ($find_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $drop_ransom_note_p* ) ) and ( all of ( $find_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Kovter : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Kovter ransomware."
 		author = "ReversingLabs"
-		id = "9362ac5a-0b6c-5ac5-ac2b-59dcc1191dc6"
+		id = "6786410f-59ba-555c-b633-9ef0a6ad531e"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Kovter.yara#L1-L141"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3082e036b54a73ce8397cfa6e8dc2a807c587d9f17286e75af6cdbe622fae1e1"
+		logic_hash = "v1_sha256_3082e036b54a73ce8397cfa6e8dc2a807c587d9f17286e75af6cdbe622fae1e1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6772,20 +6772,20 @@ rule REVERSINGLABS_Win32_Ransomware_Kovter : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files and $decrypt_payload_script and ( all of ($remote_connection_*))
+		uint16( 0 ) == 0x5A4D and $find_files and $decrypt_payload_script and ( all of ( $remote_connection_* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_EAF : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects EAF ransomware."
 		author = "ReversingLabs"
-		id = "6903030e-b1a1-5238-b377-ce8e4b18d3f3"
+		id = "8f7a1015-41b8-5a53-bc16-bfd870856cb5"
 		date = "2022-07-22"
 		modified = "2022-07-22"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.EAF.yara#L1-L89"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3d10c852f95e8aa9bcd3543b96650b98ac57bcd2aa2b374e0badb63b5a4c0396"
+		logic_hash = "v1_sha256_3d10c852f95e8aa9bcd3543b96650b98ac57bcd2aa2b374e0badb63b5a4c0396"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6853,20 +6853,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_EAF : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($destroy_exe_file)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $destroy_exe_file )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cobralocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects CobraLocker ransomware."
 		author = "ReversingLabs"
-		id = "dada6370-3ae3-5931-ba9f-da56ebbcd8c8"
+		id = "d32a3414-b8e5-589e-84ac-46a94d57457d"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Bytecode.MSIL.Ransomware.CobraLocker.yara#L1-L59"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "95f4c645c7c237d23b5028f824f78a5f9f8f0a4737b391d877582afe08264d7e"
+		logic_hash = "v1_sha256_95f4c645c7c237d23b5028f824f78a5f9f8f0a4737b391d877582afe08264d7e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -6910,20 +6910,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cobralocker : TC_DETECTION MALICIOUS
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Plague17 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Plague17 ransomware."
 		author = "ReversingLabs"
-		id = "065c47b5-f459-529e-8046-7394a742b50a"
+		id = "a91de3a9-225f-5450-8e42-4e2b1b10842f"
 		date = "2021-02-19"
 		modified = "2021-02-19"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Plague17.yara#L1-L263"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e0e518fc83a62d70b83df273c6ba469e6f0fdf9c035126428ec7561e04437b6f"
+		logic_hash = "v1_sha256_e0e518fc83a62d70b83df273c6ba469e6f0fdf9c035126428ec7561e04437b6f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -7156,20 +7156,20 @@ rule REVERSINGLABS_Win32_Ransomware_Plague17 : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ransomexx : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ransomexx ransomware."
 		author = "ReversingLabs"
-		id = "5e62660d-2696-56c7-9322-fed6ce9d36ff"
+		id = "b5dc5ed0-12f5-5bcb-83e0-469f061d4324"
 		date = "2020-11-26"
 		modified = "2020-11-26"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Ransomexx.yara#L1-L147"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "27b4132b7f16cafc40687e96a552ce59cc24ebf7679575680f170e3beee8a0a9"
+		logic_hash = "v1_sha256_27b4132b7f16cafc40687e96a552ce59cc24ebf7679575680f170e3beee8a0a9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -7293,20 +7293,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ransomexx : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_network_resources) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_network_resources ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Khonsari : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Khonsari ransomware."
 		author = "ReversingLabs"
-		id = "c3c64256-af1f-5a9d-8a59-8d72993bb8da"
+		id = "a1e5a56e-361a-59b6-b7a2-35e31607b41f"
 		date = "2022-01-27"
 		modified = "2022-01-27"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Khonsari.yara#L1-L68"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f1003b7863215bcd8e5cdce8ce40551105fb668ea2b8ac765909f9fa5373e6ca"
+		logic_hash = "v1_sha256_f1003b7863215bcd8e5cdce8ce40551105fb668ea2b8ac765909f9fa5373e6ca"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -7355,20 +7355,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Khonsari : TC_DETECTION MALICIOUS MA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($get_key) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $get_key ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Wsir : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects WsIR ransomware."
 		author = "ReversingLabs"
-		id = "cb4ab736-9421-5b92-b4a5-c5db0b61725a"
+		id = "f4364c88-f9ff-549f-add9-69ae98993c09"
 		date = "2022-08-02"
 		modified = "2022-08-02"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.WsIR.yara#L1-L73"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c22c01f93945c7721ebfe5e7a09c3bf2b9d0ad95740bc0a76b4e61741f61d82c"
+		logic_hash = "v1_sha256_c22c01f93945c7721ebfe5e7a09c3bf2b9d0ad95740bc0a76b4e61741f61d82c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -7422,20 +7422,20 @@ rule REVERSINGLABS_Win32_Ransomware_Wsir : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($exec_proc)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $exec_proc )
 }
 rule REVERSINGLABS_Win32_Ransomware_Lorenz : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Lorenz ransomware."
 		author = "ReversingLabs"
-		id = "cc97dd15-d518-5d9f-9384-3dcf81e34e81"
+		id = "3d89b04b-b752-5086-b1be-cab417c385c5"
 		date = "2022-10-24"
 		modified = "2022-10-24"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Lorenz.yara#L1-L252"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b8668fcc560d264c37e3fbb52d5a5f1223a282abd9e984b3109efe9ab454be9f"
+		logic_hash = "v1_sha256_b8668fcc560d264c37e3fbb52d5a5f1223a282abd9e984b3109efe9ab454be9f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -7634,20 +7634,20 @@ rule REVERSINGLABS_Win32_Ransomware_Lorenz : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((( all of ($encrypt_files_v1_p*)) and ( all of ($find_files_v1_p*)) and ($create_scheduled_task_v1) and ($remote_connection_v1) and ($check_mutex_v1)) or (($find_files_v2) and ( all of ($encrypt_files_v2_p*)) and ($remote_connection_v2) and ( all of ($drop_ransom_note_v2_p*))))
+		uint16( 0 ) == 0x5A4D and ( ( ( all of ( $encrypt_files_v1_p* ) ) and ( all of ( $find_files_v1_p* ) ) and ( $create_scheduled_task_v1 ) and ( $remote_connection_v1 ) and ( $check_mutex_v1 ) ) or ( ( $find_files_v2 ) and ( all of ( $encrypt_files_v2_p* ) ) and ( $remote_connection_v2 ) and ( all of ( $drop_ransom_note_v2_p* ) ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ophionlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects OphionLocker ransomware."
 		author = "ReversingLabs"
-		id = "75335749-66bd-539e-92b3-dd92c0b332d8"
+		id = "2e2ff287-c593-5923-833e-c83da7f3237b"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.OphionLocker.yara#L1-L105"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3c54a948a6a45ec5f5bc32fbbdbc8822f402b1332e9109b20b90635464dbe2ac"
+		logic_hash = "v1_sha256_3c54a948a6a45ec5f5bc32fbbdbc8822f402b1332e9109b20b90635464dbe2ac"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -7739,20 +7739,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ophionlocker : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($ol_do_filetypes_1 and $ol_do_filetypes_2 and $ol_do_filetypes_3) and ($ol_ecies_key_1 and $ol_ecies_key_2 and $ol_ecies_key_3))
+		uint16( 0 ) == 0x5A4D and ( ( $ol_do_filetypes_1 and $ol_do_filetypes_2 and $ol_do_filetypes_3 ) and ( $ol_ecies_key_1 and $ol_ecies_key_2 and $ol_ecies_key_3 ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Curator : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Curator ransomware."
 		author = "ReversingLabs"
-		id = "401f1d64-afd9-55b1-8e87-b808d4679e9a"
+		id = "ed64eaea-054c-5063-8878-7f66ded9cfd0"
 		date = "2021-04-22"
 		modified = "2021-04-22"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Curator.yara#L1-L94"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8bd29195cea0f1194e27c48ed07c52100abb7dd3de2ef7f51a645d32c3527eb3"
+		logic_hash = "v1_sha256_8bd29195cea0f1194e27c48ed07c52100abb7dd3de2ef7f51a645d32c3527eb3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -7826,20 +7826,20 @@ rule REVERSINGLABS_Win64_Ransomware_Curator : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win64_Ransomware_Pandora : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Pandora ransomware."
 		author = "ReversingLabs"
-		id = "18182bbe-1678-5d0b-a7ee-80c4bbaee99e"
+		id = "62ed0685-edc2-5c48-9a09-f9fedbac615c"
 		date = "2022-06-01"
 		modified = "2022-06-01"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Pandora.yara#L1-L95"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6576bde36ae9a9bc2e9dd878db788c608083b84d96d31e6898f48a264c6b7f1a"
+		logic_hash = "v1_sha256_6576bde36ae9a9bc2e9dd878db788c608083b84d96d31e6898f48a264c6b7f1a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -7914,7 +7914,7 @@ rule REVERSINGLABS_Win64_Ransomware_Pandora : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($generate_key) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $generate_key ) and ( $drop_ransom_note )
 }
 import "pe"
 
@@ -7923,13 +7923,13 @@ rule REVERSINGLABS_Win32_Ransomware_Wannacry : TC_DETECTION MALICIOUS MALWARE FI
 	meta:
 		description = "Yara rule that detects WannaCry ransomware."
 		author = "ReversingLabs"
-		id = "61734d47-2525-5e3a-94b4-60493dfe2b93"
+		id = "4ae1a076-eff1-5692-93b6-eb7c6cf952ae"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.WannaCry.yara#L3-L135"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fed58b533a9f7c3eb1b3e4f8fbe1f519aab94d1c066ae6937c21876693be0eac"
+		logic_hash = "v1_sha256_fed58b533a9f7c3eb1b3e4f8fbe1f519aab94d1c066ae6937c21876693be0eac"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -8042,20 +8042,20 @@ rule REVERSINGLABS_Win32_Ransomware_Wannacry : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($entrypoint_all at pe.entry_point) and ($main_1 or $main_2 or ($main_3 and $start_service_3) or $main_4 or $main_5 or ($main_6 and ($set_reg_key_6 or $download_tor_6)) or $main_7 or $main_8)
+		uint16( 0 ) == 0x5A4D and ( $entrypoint_all at pe.entry_point ) and ( $main_1 or $main_2 or ( $main_3 and $start_service_3 ) or $main_4 or $main_5 or ( $main_6 and ( $set_reg_key_6 or $download_tor_6 ) ) or $main_7 or $main_8 )
 }
 rule REVERSINGLABS_Linux_Ransomware_Kraken : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Kraken ransomware."
 		author = "ReversingLabs"
-		id = "7c302c2e-6ffc-5f51-90f4-c4ebd6c1c28b"
+		id = "4415659c-7465-5982-862b-4b4b29ecba20"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Kraken.yara#L1-L151"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4a3867aba4dbdce5d008331a3058f57b00db246975fc4d77b79ab49d5f0bbb15"
+		logic_hash = "v1_sha256_4a3867aba4dbdce5d008331a3058f57b00db246975fc4d77b79ab49d5f0bbb15"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -8181,20 +8181,20 @@ rule REVERSINGLABS_Linux_Ransomware_Kraken : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_volumes and $find_files and ( all of ($enum_shares_p*)) and ( all of ($encrypt_files_p*)))
+		uint16( 0 ) == 0x5A4D and ( $enum_volumes and $find_files and ( all of ( $enum_shares_p* ) ) and ( all of ( $encrypt_files_p* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Reveton : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Reveton ransomware."
 		author = "ReversingLabs"
-		id = "14446b94-cd57-5930-b0af-b21091b61f68"
+		id = "8f4a8a63-426e-5253-8c17-f13faba15a57"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Reveton.yara#L1-L118"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2d316c558cdb5591788ef89c6e20327882a118f2928f4a31fb5b8b3083931ac5"
+		logic_hash = "v1_sha256_2d316c558cdb5591788ef89c6e20327882a118f2928f4a31fb5b8b3083931ac5"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -8293,20 +8293,20 @@ rule REVERSINGLABS_Win32_Ransomware_Reveton : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($http_connection_1 and $file_search_1_1 and $file_search_1_2 and $file_search_1_3 and $raw_socket_connection_1_1 and $raw_socket_connection_1_2 and $raw_socket_connection_1_3 and $raw_socket_connection_1_4 and $raw_socket_connection_1_5) or ($raw_socket_connection_2 and $file_search_1_1 and $file_search_1_2 and $file_search_1_3))
+		uint16( 0 ) == 0x5A4D and ( ( $http_connection_1 and $file_search_1_1 and $file_search_1_2 and $file_search_1_3 and $raw_socket_connection_1_1 and $raw_socket_connection_1_2 and $raw_socket_connection_1_3 and $raw_socket_connection_1_4 and $raw_socket_connection_1_5 ) or ( $raw_socket_connection_2 and $file_search_1_1 and $file_search_1_2 and $file_search_1_3 ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Solaso : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Solaso ransomware."
 		author = "ReversingLabs"
-		id = "53f56ad8-ccdf-58f0-a5d9-e58f2c18ac76"
+		id = "ff512105-0f98-51e4-a8f1-4eb60e1e63a0"
 		date = "2021-11-02"
 		modified = "2021-11-02"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Solaso.yara#L1-L171"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "368a80a9f2e264d17c61d6ed4c22baec838ba0b0bc2e5c79344830bf861aa5a2"
+		logic_hash = "v1_sha256_368a80a9f2e264d17c61d6ed4c22baec838ba0b0bc2e5c79344830bf861aa5a2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -8455,20 +8455,20 @@ rule REVERSINGLABS_Win64_Ransomware_Solaso : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Pacman : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Pacman ransomware."
 		author = "ReversingLabs"
-		id = "a440769b-030b-5b72-a6f2-cf478dd7acd2"
+		id = "2df67e17-4ecd-54f9-9691-8426f2338d58"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Pacman.yara#L1-L68"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0634303a4db2631edb40a9435444f3bdc4bc6eb745c7e43a54478e54e7507403"
+		logic_hash = "v1_sha256_0634303a4db2631edb40a9435444f3bdc4bc6eb745c7e43a54478e54e7507403"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -8526,20 +8526,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Pacman : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($pacman_find_encrypted_1 and $pacman_find_encrypted_2 and $pacman_encrypt)
+		uint16( 0 ) == 0x5A4D and ( $pacman_find_encrypted_1 and $pacman_find_encrypted_2 and $pacman_encrypt )
 }
 rule REVERSINGLABS_Win32_Ransomware_Marsjoke : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects MarsJoke ransomware."
 		author = "ReversingLabs"
-		id = "8164c586-f548-5414-9df8-61e0c51cbe29"
+		id = "eb5030ca-99ea-5891-9a2f-8d60dc473805"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.MarsJoke.yara#L1-L157"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "298b2fd99793a15b3537853289e1337648d3fa84f12038e6f6831741404b7c5c"
+		logic_hash = "v1_sha256_298b2fd99793a15b3537853289e1337648d3fa84f12038e6f6831741404b7c5c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -8686,20 +8686,20 @@ rule REVERSINGLABS_Win32_Ransomware_Marsjoke : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_and_encrypt_files and $remote_connection_1 and $remote_connection_2
+		uint16( 0 ) == 0x5A4D and $search_and_encrypt_files and $remote_connection_1 and $remote_connection_2
 }
 rule REVERSINGLABS_Win32_Ransomware_Lechiffre : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects LeChiffre ransomware."
 		author = "ReversingLabs"
-		id = "5d2698fe-9a0b-549d-9a83-72e2ccfc1966"
+		id = "98839690-ee79-5bf4-88d7-7ff727ef659c"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.LeChiffre.yara#L1-L123"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0b96f5f48700f2cba22da91187b3111946074e9cc58a502f25d7b96059a043cb"
+		logic_hash = "v1_sha256_0b96f5f48700f2cba22da91187b3111946074e9cc58a502f25d7b96059a043cb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -8809,20 +8809,20 @@ rule REVERSINGLABS_Win32_Ransomware_Lechiffre : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files and $encrypt_files_1 and $encrypt_files_2 and $remote_connection_1 and $remote_connection_2 and $remote_connection_3
+		uint16( 0 ) == 0x5A4D and $find_files and $encrypt_files_1 and $encrypt_files_2 and $remote_connection_1 and $remote_connection_2 and $remote_connection_3
 }
 rule REVERSINGLABS_Win32_Ransomware_Encoded01 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Encoded01 ransomware."
 		author = "ReversingLabs"
-		id = "923d987e-f888-5b6a-9ebd-ee1257124aed"
+		id = "f449107a-d02c-5901-86b4-0d32f11317a4"
 		date = "2021-12-16"
 		modified = "2021-12-16"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Encoded01.yara#L1-L141"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f6f872290f15f4c564911bb099824c47cb13164457e1bcdb02dee441bc2d6b6a"
+		logic_hash = "v1_sha256_f6f872290f15f4c564911bb099824c47cb13164457e1bcdb02dee441bc2d6b6a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -8938,20 +8938,20 @@ rule REVERSINGLABS_Win32_Ransomware_Encoded01 : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ( all of ($find_files_p*)) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_resources ) and ( all of ( $find_files_p* ) ) and ( $encrypt_files ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Acepy : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Acepy ransomware."
 		author = "ReversingLabs"
-		id = "3ffb45b1-6bde-5bf8-957e-433b9488ba91"
+		id = "7793fb34-bc87-5750-991e-5ae216541779"
 		date = "2022-08-04"
 		modified = "2022-08-04"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Acepy.yara#L1-L69"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "92c543a0b8c3c884f83647119d32c7b46f5fe839694bb8a8de0146c5c77bc587"
+		logic_hash = "v1_sha256_92c543a0b8c3c884f83647119d32c7b46f5fe839694bb8a8de0146c5c77bc587"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -8999,7 +8999,7 @@ rule REVERSINGLABS_Win32_Ransomware_Acepy : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($find_files) and ($encrypt_files) and ($drop_ransom_note))
+		uint16( 0 ) == 0x5A4D and ( ( $find_files ) and ( $encrypt_files ) and ( $drop_ransom_note ) )
 }
 import "pe"
 
@@ -9008,13 +9008,13 @@ rule REVERSINGLABS_Win32_Ransomware_Archiveus : TC_DETECTION MALICIOUS MALWARE F
 	meta:
 		description = "Yara rule that detects Archiveus ransomware."
 		author = "ReversingLabs"
-		id = "89e5af93-1153-5367-a539-6af77c99c214"
+		id = "2fc61910-e1d4-5016-8204-28d877f89225"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Archiveus.yara#L3-L50"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2b8a42b98ab3e8b97d2e226e979f342a6a72f21d8f068f59c21ad95764077f8a"
+		logic_hash = "v1_sha256_2b8a42b98ab3e8b97d2e226e979f342a6a72f21d8f068f59c21ad95764077f8a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -9050,20 +9050,20 @@ rule REVERSINGLABS_Win32_Ransomware_Archiveus : TC_DETECTION MALICIOUS MALWARE F
 		$instruction_string = "INSTRUCTIONS HOW TO GET YOUR FILES BACK.txt" wide
 
 	condition:
-		uint16(0)==0x5A4D and ($entry_point at pe.entry_point) and $dump_instruction and $extension_rule and $instruction_string
+		uint16( 0 ) == 0x5A4D and ( $entry_point at pe.entry_point ) and $dump_instruction and $extension_rule and $instruction_string
 }
 rule REVERSINGLABS_Win32_Ransomware_Meow : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Meow ransomware."
 		author = "ReversingLabs"
-		id = "7cebb04d-1cda-5ad1-b412-8b38df7b2550"
+		id = "b4170467-44e2-5364-bff6-0bb09943c21f"
 		date = "2022-10-24"
 		modified = "2022-10-24"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Meow.yara#L1-L84"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b00753d2b150a815279297ddf40d70051d25de1c32bb90f5b706ea7fd36bb871"
+		logic_hash = "v1_sha256_b00753d2b150a815279297ddf40d70051d25de1c32bb90f5b706ea7fd36bb871"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -9127,20 +9127,20 @@ rule REVERSINGLABS_Win32_Ransomware_Meow : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( $drop_ransom_note )
 }
 rule REVERSINGLABS_Win32_Ransomware_Dragon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Dragon ransomware."
 		author = "ReversingLabs"
-		id = "dbeab955-f1fe-57eb-a9a4-c8c885ab7fad"
+		id = "ba8cbb0e-d70f-5bae-9106-ea598e893276"
 		date = "2020-10-30"
 		modified = "2020-10-30"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Dragon.yara#L1-L149"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7298c5681deaf04abb6a656cefc09b5ee4096ff7a5028caab1d7b107e97be90a"
+		logic_hash = "v1_sha256_7298c5681deaf04abb6a656cefc09b5ee4096ff7a5028caab1d7b107e97be90a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -9263,20 +9263,20 @@ rule REVERSINGLABS_Win32_Ransomware_Dragon : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($skip_hk_china_taiwan_p*)) and ( all of ($find_files_*)) and ($crypt_files) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $skip_hk_china_taiwan_p* ) ) and ( all of ( $find_files_* ) ) and ( $crypt_files ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Cryptojoker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects CryptoJoker ransomware."
 		author = "ReversingLabs"
-		id = "50a9280b-a352-5a2b-acee-5690e509dfd7"
+		id = "f4c5dba6-49e0-5600-950e-6ff2bed86b7a"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.CryptoJoker.yara#L1-L140"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "42ee1e63ada1ae986f43a1300eda0b1fa7b54c26be31ef5637bb321defffbe40"
+		logic_hash = "v1_sha256_42ee1e63ada1ae986f43a1300eda0b1fa7b54c26be31ef5637bb321defffbe40"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -9400,20 +9400,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cryptojoker : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($call_encrypt and $encrypt_files and $start_process) or ($msgbox_timer) or ($unzip_packed_file and $resolve_assembly))
+		uint16( 0 ) == 0x5A4D and ( ( $call_encrypt and $encrypt_files and $start_process ) or ( $msgbox_timer ) or ( $unzip_packed_file and $resolve_assembly ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Thanatos : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Thanatos ransomware."
 		author = "ReversingLabs"
-		id = "190adbd0-30a7-5619-ab70-3ab031ece2f7"
+		id = "31e0482f-8f39-5393-a03d-8b4b1c0f33b5"
 		date = "2020-11-13"
 		modified = "2020-11-13"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Thanatos.yara#L1-L85"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a51fa9cf1a08e4cd252a8b385be3bfde909585e2a799baaede977e40ecff5313"
+		logic_hash = "v1_sha256_a51fa9cf1a08e4cd252a8b385be3bfde909585e2a799baaede977e40ecff5313"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -9482,20 +9482,20 @@ rule REVERSINGLABS_Win32_Ransomware_Thanatos : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Bandarchor : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BandarChor ransomware."
 		author = "ReversingLabs"
-		id = "c645a081-7ff6-58fc-af8e-55f43f56d0ea"
+		id = "3d7334cf-9035-58d2-bbd8-94facaf44413"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BandarChor.yara#L1-L97"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1c0c33ef7de089fc7ed6b364c7693499d1a93f79a48d6f2a5c375e47aea176bc"
+		logic_hash = "v1_sha256_1c0c33ef7de089fc7ed6b364c7693499d1a93f79a48d6f2a5c375e47aea176bc"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -9577,20 +9577,20 @@ rule REVERSINGLABS_Win32_Ransomware_Bandarchor : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($file_extensions_1 and $file_extensions_2 and $file_extensions_3 and $file_extensions_4 and $file_extensions_5) and $parse_server_commands)
+		uint16( 0 ) == 0x5A4D and ( ( $file_extensions_1 and $file_extensions_2 and $file_extensions_3 and $file_extensions_4 and $file_extensions_5 ) and $parse_server_commands )
 }
 rule REVERSINGLABS_Win32_Ransomware_Teslacrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Teslacrypt ransomware."
 		author = "ReversingLabs"
-		id = "842dae76-573c-564d-b658-ccdda451df21"
+		id = "5b78ea5c-7327-5930-a21e-caf59e9bfb45"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Teslacrypt.yara#L1-L665"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cc054be68d833d9f29a4ebd1c202922881b0d22a2605edc7def1048dc08f6325"
+		logic_hash = "v1_sha256_cc054be68d833d9f29a4ebd1c202922881b0d22a2605edc7def1048dc08f6325"
 		score = 75
 		quality = 65
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -10170,20 +10170,20 @@ rule REVERSINGLABS_Win32_Ransomware_Teslacrypt : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($file_search_0_3_1_1 and $file_search_0_3_1_2 and $encrypt_file_0_2_6a_1 and $encrypt_file_0_2_6a_2 and $server_communication_0_2_6a_1 and $server_communication_0_2_6a_2) or ($file_search_0_3_1_1 and $file_search_0_3_1_2 and $encrypt_file_0_3_1 and $server_communication_0_3_1_1 and $server_communication_0_3_1_2) or ($file_search_0_3_3_1 and $file_search_0_3_3_2 and $encrypt_file_0_3_3_1 and $encrypt_file_0_3_3_2 and $server_communication_0_3_3_1 and $server_communication_0_3_3_2) or ($file_search_0_3_4a_1 and $file_search_0_3_4a_2 and $encrypt_file_0_3_4a_1 and $encrypt_file_0_3_4a_2 and $server_communication_0_3_4a_1 and $server_communication_0_3_4a_2) or ($file_search_0_3_5a_1 and $file_search_0_3_5a_2 and $encrypt_file_0_3_5a_1 and $encrypt_file_0_3_5a_2 and $server_communication_0_3_5a_1 and $server_communication_0_3_5a_2) or ($server_communication_2_0_4e and $search_and_encrypt_2_0_4e_1 and $search_and_encrypt_2_0_4e_2 and $search_and_encrypt_2_0_4e_3 and $search_and_encrypt_2_0_4e_4 and $search_and_encrypt_2_0_4e_5) or ($server_communication_4_0_1 and $server_communication_4_0_2 and $server_communication_4_0_3 and $file_search_4_0_1 and $file_search_4_0_2 and $file_search_4_0_3) or ($file_search_4_1b_1 and $file_search_4_1b_2 and $file_search_4_1b_3 and $server_communication_4_1b_1 and $server_communication_4_1b_2 and $server_communication_4_1b_3 and $server_communication_4_1b_4 and $server_communication_4_1b_5) or ($file_search_4_2_1 and $file_search_4_2_2 and $server_communication_4_1b_1 and $server_communication_4_2_1 and $server_communication_4_2_2 and $server_communication_4_2_3 and $server_communication_4_2_4 and $server_communication_4_2_5) or ($server_communication_4_0_1 and $server_communication_3_1 and $server_communication_3_2 and $file_search_3_1 and $file_search_3_1_1 and $file_search_3_1_2 and $search_and_encrypt_3_1 and $search_and_encrypt_3_2 and $search_and_encrypt_3_3 and $search_and_encrypt_3_4) or ($server_communication_4_0_1 and $server_communication_3_1 and $server_communication_3_2 and $file_search_3_1 and $file_search_3_2_1 and $file_search_3_2_2 and $search_and_encrypt_3_1 and $search_and_encrypt_3_2 and $search_and_encrypt_3_3 and $search_and_encrypt_3_4))
+		uint16( 0 ) == 0x5A4D and ( ( $file_search_0_3_1_1 and $file_search_0_3_1_2 and $encrypt_file_0_2_6a_1 and $encrypt_file_0_2_6a_2 and $server_communication_0_2_6a_1 and $server_communication_0_2_6a_2 ) or ( $file_search_0_3_1_1 and $file_search_0_3_1_2 and $encrypt_file_0_3_1 and $server_communication_0_3_1_1 and $server_communication_0_3_1_2 ) or ( $file_search_0_3_3_1 and $file_search_0_3_3_2 and $encrypt_file_0_3_3_1 and $encrypt_file_0_3_3_2 and $server_communication_0_3_3_1 and $server_communication_0_3_3_2 ) or ( $file_search_0_3_4a_1 and $file_search_0_3_4a_2 and $encrypt_file_0_3_4a_1 and $encrypt_file_0_3_4a_2 and $server_communication_0_3_4a_1 and $server_communication_0_3_4a_2 ) or ( $file_search_0_3_5a_1 and $file_search_0_3_5a_2 and $encrypt_file_0_3_5a_1 and $encrypt_file_0_3_5a_2 and $server_communication_0_3_5a_1 and $server_communication_0_3_5a_2 ) or ( $server_communication_2_0_4e and $search_and_encrypt_2_0_4e_1 and $search_and_encrypt_2_0_4e_2 and $search_and_encrypt_2_0_4e_3 and $search_and_encrypt_2_0_4e_4 and $search_and_encrypt_2_0_4e_5 ) or ( $server_communication_4_0_1 and $server_communication_4_0_2 and $server_communication_4_0_3 and $file_search_4_0_1 and $file_search_4_0_2 and $file_search_4_0_3 ) or ( $file_search_4_1b_1 and $file_search_4_1b_2 and $file_search_4_1b_3 and $server_communication_4_1b_1 and $server_communication_4_1b_2 and $server_communication_4_1b_3 and $server_communication_4_1b_4 and $server_communication_4_1b_5 ) or ( $file_search_4_2_1 and $file_search_4_2_2 and $server_communication_4_1b_1 and $server_communication_4_2_1 and $server_communication_4_2_2 and $server_communication_4_2_3 and $server_communication_4_2_4 and $server_communication_4_2_5 ) or ( $server_communication_4_0_1 and $server_communication_3_1 and $server_communication_3_2 and $file_search_3_1 and $file_search_3_1_1 and $file_search_3_1_2 and $search_and_encrypt_3_1 and $search_and_encrypt_3_2 and $search_and_encrypt_3_3 and $search_and_encrypt_3_4 ) or ( $server_communication_4_0_1 and $server_communication_3_1 and $server_communication_3_2 and $file_search_3_1 and $file_search_3_2_1 and $file_search_3_2_2 and $search_and_encrypt_3_1 and $search_and_encrypt_3_2 and $search_and_encrypt_3_3 and $search_and_encrypt_3_4 ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Zhen : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Zhen ransomware."
 		author = "ReversingLabs"
-		id = "ce6bc48d-934b-582c-8ce7-3dd595cbf5dd"
+		id = "381ddd93-8849-5d84-81ba-f846d3308630"
 		date = "2021-04-28"
 		modified = "2021-04-28"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Zhen.yara#L1-L176"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "17b24e7baeccd90b8695eb8d21d9ee4a317806ed7713252d315d06bee3f93e65"
+		logic_hash = "v1_sha256_17b24e7baeccd90b8695eb8d21d9ee4a317806ed7713252d315d06bee3f93e65"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -10335,20 +10335,20 @@ rule REVERSINGLABS_Win32_Ransomware_Zhen : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($scan_network_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $scan_network_p* ) ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Afrodita : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Afrodita ransomware."
 		author = "ReversingLabs"
-		id = "513963fd-5f3d-5d31-a65a-37f6f5c72260"
+		id = "9f0e2173-c44d-5084-a666-26f146f55c53"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Afrodita.yara#L1-L119"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ce7cc445d4c1f59c25b9505fc1f7f9dd0d286ab80510e2977b50ff15433aea60"
+		logic_hash = "v1_sha256_ce7cc445d4c1f59c25b9505fc1f7f9dd0d286ab80510e2977b50ff15433aea60"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -10441,20 +10441,20 @@ rule REVERSINGLABS_Win32_Ransomware_Afrodita : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files) and (($exclude_directories_and_drop_ransom_note) or ($drop_ransom_note_no_dir_exclusion))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $encrypt_files ) and ( ( $exclude_directories_and_drop_ransom_note ) or ( $drop_ransom_note_no_dir_exclusion ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ragnarok : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ragnarok ransomware."
 		author = "ReversingLabs"
-		id = "263a671e-dfdb-5ab8-9bb9-355c76a88c10"
+		id = "3e4094cc-3408-5299-82f4-0edae31a0d6a"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Ragnarok.yara#L1-L110"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "aaa17ab98b59a5c8c71a2b82a9bf29dd3a1a1719deaf08a3bafa77895bc10311"
+		logic_hash = "v1_sha256_aaa17ab98b59a5c8c71a2b82a9bf29dd3a1a1719deaf08a3bafa77895bc10311"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -10543,20 +10543,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ragnarok : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($disable_fw_and_delete_shadow_volumes) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $disable_fw_and_delete_shadow_volumes ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Guscrypter : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GusCrypter ransomware."
 		author = "ReversingLabs"
-		id = "64aa468c-ec24-58aa-8ea9-23f0cebed227"
+		id = "c166a4e9-bec1-5e14-9885-320fdc75e017"
 		date = "2020-11-26"
 		modified = "2020-11-26"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.GusCrypter.yara#L1-L129"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cfe6005028c0e5f5d713af2a549574203678bab2ee48acc1727702bcf91522b1"
+		logic_hash = "v1_sha256_cfe6005028c0e5f5d713af2a549574203678bab2ee48acc1727702bcf91522b1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -10663,20 +10663,20 @@ rule REVERSINGLABS_Win32_Ransomware_Guscrypter : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($misc_checks_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $misc_checks_p* ) ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Sherminator : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Sherminator ransomware."
 		author = "ReversingLabs"
-		id = "99792a22-8027-557f-927f-30eac4d1e690"
+		id = "a3783699-c093-537d-a676-1537c04b9428"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Sherminator.yara#L1-L157"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "22ac61b95f6ca4530e81a23fdd05be93e368647ca7100097a94eae3c6ce3b7d1"
+		logic_hash = "v1_sha256_22ac61b95f6ca4530e81a23fdd05be93e368647ca7100097a94eae3c6ce3b7d1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -10809,20 +10809,20 @@ rule REVERSINGLABS_Win32_Ransomware_Sherminator : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_resources_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $enum_resources_p* ) ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ladon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ladon ransomware."
 		author = "ReversingLabs"
-		id = "ebc8f957-cdcf-54eb-bd02-74088cf51768"
+		id = "6a9ae2c4-3ce4-523f-80ed-7a1514ccc18e"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Ladon.yara#L1-L101"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "979e3f3bf6a67bf10b6bfdd2eeb722d8836096076b7e88c6d4aca041a1a9eecb"
+		logic_hash = "v1_sha256_979e3f3bf6a67bf10b6bfdd2eeb722d8836096076b7e88c6d4aca041a1a9eecb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -10903,20 +10903,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ladon : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Gibon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Gibon ransomware."
 		author = "ReversingLabs"
-		id = "3f1a5bee-8fc0-5596-b898-e97073731930"
+		id = "70b6f314-cc26-5112-83de-58ce2d9f0475"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Gibon.yara#L1-L122"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cace0f35529307487f39aace6ae8989c7b878f82ebe890b256dfac563551a099"
+		logic_hash = "v1_sha256_cace0f35529307487f39aace6ae8989c7b878f82ebe890b256dfac563551a099"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -11020,20 +11020,20 @@ rule REVERSINGLABS_Win32_Ransomware_Gibon : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($remote_server_connection_1_0 and $remote_server_connection_1_1 and ( all of ($encryption_loop_1_*)))
+		uint16( 0 ) == 0x5A4D and ( $remote_server_connection_1_0 and $remote_server_connection_1_1 and ( all of ( $encryption_loop_1_* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Satan : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Satan ransomware."
 		author = "ReversingLabs"
-		id = "7ec379d8-172c-52ee-9284-6898dd446468"
+		id = "4f3d1d04-0ae0-5718-a041-933afcfcbce3"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Satan.yara#L1-L152"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0074090c2a6cc483deffdc83dc1c0bfbd150e201c27e54f998dd2c0a7660f917"
+		logic_hash = "v1_sha256_0074090c2a6cc483deffdc83dc1c0bfbd150e201c27e54f998dd2c0a7660f917"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -11164,20 +11164,20 @@ rule REVERSINGLABS_Win32_Ransomware_Satan : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_processes and ( all of ($search_files_in_specific_folders_p*)) and $encrypt_files and $remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $search_processes and ( all of ( $search_files_in_specific_folders_p* ) ) and $encrypt_files and $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_MZP : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects MZP ransomware."
 		author = "ReversingLabs"
-		id = "c08a4080-fa26-5b7b-869d-5f59096b1a12"
+		id = "e249b807-3ef2-568e-b7c5-eebdc60d917f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.MZP.yara#L1-L147"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "724ae1033bfb8ff494b30e6b3333e6c848375f1b001b75e71c9444c9f9f31251"
+		logic_hash = "v1_sha256_724ae1033bfb8ff494b30e6b3333e6c848375f1b001b75e71c9444c9f9f31251"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -11295,20 +11295,20 @@ rule REVERSINGLABS_Win32_Ransomware_MZP : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_config_file) and ( all of ($find_files_p*)) and ($track_mouse_event_for_entropy) and ($encrypt_files) and ( all of ($show_ransom_note_p*))
+		uint16( 0 ) == 0x5A4D and ( $search_config_file ) and ( all of ( $find_files_p* ) ) and ( $track_mouse_event_for_entropy ) and ( $encrypt_files ) and ( all of ( $show_ransom_note_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Braincrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BrainCrypt ransomware."
 		author = "ReversingLabs"
-		id = "190798d5-594d-5b80-aa0e-8d7ff167f1c0"
+		id = "98889b01-942e-569f-aabf-a64355631bc3"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BrainCrypt.yara#L1-L121"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "85866d6ffa136bf3ed27bbab55ae5430af4a1363930ebacab0df9ad24f8734cb"
+		logic_hash = "v1_sha256_85866d6ffa136bf3ed27bbab55ae5430af4a1363930ebacab0df9ad24f8734cb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -11415,20 +11415,20 @@ rule REVERSINGLABS_Win32_Ransomware_Braincrypt : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($get_files_for_encryption_32 and $encrypt_file_32 and $attach_to_server_32) or ($get_files_for_encryption_64 and $encrypt_file_64 and $attach_to_server_64))
+		uint16( 0 ) == 0x5A4D and ( ( $get_files_for_encryption_32 and $encrypt_file_32 and $attach_to_server_32 ) or ( $get_files_for_encryption_64 and $encrypt_file_64 and $attach_to_server_64 ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Magniber : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Magniber ransomware."
 		author = "ReversingLabs"
-		id = "07b6c938-aa25-5ff6-95d2-9e0f84c41b41"
+		id = "350da96b-7f4b-5893-9dda-00e0fd1f4cb4"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Magniber.yara#L1-L114"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "05b516f9b466489ea3a30e2fe5eb08290e85ece7a63e29e8bbbeb81c87d0a6f1"
+		logic_hash = "v1_sha256_05b516f9b466489ea3a30e2fe5eb08290e85ece7a63e29e8bbbeb81c87d0a6f1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -11525,20 +11525,20 @@ rule REVERSINGLABS_Win32_Ransomware_Magniber : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_files and ( all of ($encrypt_files_*)) and $remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $search_files and ( all of ( $encrypt_files_* ) ) and $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Desucrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects DesuCrypt ransomware."
 		author = "ReversingLabs"
-		id = "b9b3ce2b-f184-5bfa-8e1c-a7b996ac708a"
+		id = "1ca7dbed-d5ed-5887-af4f-010c962186c8"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.DesuCrypt.yara#L1-L93"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bd3ba8ea0fc16aad859a73628d0eda180d49298162fe239acf81c7c4e371eaad"
+		logic_hash = "v1_sha256_bd3ba8ea0fc16aad859a73628d0eda180d49298162fe239acf81c7c4e371eaad"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -11616,7 +11616,7 @@ rule REVERSINGLABS_Win32_Ransomware_Desucrypt : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files and $encrypt_files and $enum_shares)
+		uint16( 0 ) == 0x5A4D and ( $find_files and $encrypt_files and $enum_shares )
 }
 import "pe"
 
@@ -11625,13 +11625,13 @@ rule REVERSINGLABS_Win32_Ransomware_Cryptowall : TC_DETECTION MALICIOUS MALWARE
 	meta:
 		description = "Yara rule that detects CryptoWall ransomware."
 		author = "ReversingLabs"
-		id = "06d8b106-d69a-526a-8e16-c95d39eb2993"
+		id = "eaa68024-0428-5461-a6a9-8b9f0a8efdbc"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.CryptoWall.yara#L3-L312"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "74baa04ee506732e0bb64a77cfd2d2216fcc978f13447ef07862e0116c093c14"
+		logic_hash = "v1_sha256_74baa04ee506732e0bb64a77cfd2d2216fcc978f13447ef07862e0116c093c14"
 		score = 75
 		quality = 88
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -11905,20 +11905,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cryptowall : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($v30_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_1_find_file_1 and $v30_1_find_file_2 and $v30_1_encrypt_file_1 and $v30_1_encrypt_file_2 and $v30_1_encrypt_file_3) or (($v30_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_2_find_file_1 and $v30_2_find_file_2 and $v30_2_encrypt_file_1 and $v30_2_encrypt_file_2 and $v30_2_encrypt_file_3) or (($v20_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_2_find_file_1 and $v30_2_find_file_2 and $v20_1_encrypt_file_1 and $v20_1_encrypt_file_2 and $v20_1_encrypt_file_3) or (($v30_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_3_find_file_1 and $v30_3_find_file_2 and $v30_3_encrypt_file_1 and $v30_3_encrypt_file_2 and $v30_3_encrypt_file_3))
+		uint16( 0 ) == 0x5A4D and ( ( ( $v30_entrypoint at pe.entry_point ) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_1_find_file_1 and $v30_1_find_file_2 and $v30_1_encrypt_file_1 and $v30_1_encrypt_file_2 and $v30_1_encrypt_file_3 ) or ( ( $v30_entrypoint at pe.entry_point ) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_2_find_file_1 and $v30_2_find_file_2 and $v30_2_encrypt_file_1 and $v30_2_encrypt_file_2 and $v30_2_encrypt_file_3 ) or ( ( $v20_entrypoint at pe.entry_point ) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_2_find_file_1 and $v30_2_find_file_2 and $v20_1_encrypt_file_1 and $v20_1_encrypt_file_2 and $v20_1_encrypt_file_3 ) or ( ( $v30_entrypoint at pe.entry_point ) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_3_find_file_1 and $v30_3_find_file_2 and $v30_3_encrypt_file_1 and $v30_3_encrypt_file_2 and $v30_3_encrypt_file_3 ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Flamingo : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Flamingo ransomware."
 		author = "ReversingLabs"
-		id = "333ef1f9-ac54-5a3d-9b2b-50483eeb93e1"
+		id = "74b8a575-df86-55a1-ab91-d481ffd88134"
 		date = "2021-04-14"
 		modified = "2021-04-14"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Flamingo.yara#L1-L54"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "446c0d332af01c0fceb0356d5ab273eb55764869cc8343468b75625e5d4d1036"
+		logic_hash = "v1_sha256_446c0d332af01c0fceb0356d5ab273eb55764869cc8343468b75625e5d4d1036"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -11957,20 +11957,20 @@ rule REVERSINGLABS_Win32_Ransomware_Flamingo : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Good : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Good ransomware."
 		author = "ReversingLabs"
-		id = "e0f97200-7fe9-5811-b6cd-708ecc3a2fbc"
+		id = "e0f3fb76-021b-5e71-b687-c2ee1766b04a"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Good.yara#L1-L82"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6737853a77a6008f9fd2141bb6b13d595f1cb7e832be944596f709e1fcdf8003"
+		logic_hash = "v1_sha256_6737853a77a6008f9fd2141bb6b13d595f1cb7e832be944596f709e1fcdf8003"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -12033,20 +12033,20 @@ rule REVERSINGLABS_Win32_Ransomware_Good : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Fenixlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects FenixLocker ransomware."
 		author = "ReversingLabs"
-		id = "4868ced4-885d-548c-993c-ae25ab188172"
+		id = "92b5822a-2539-56e2-819b-256c0966f76f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.FenixLocker.yara#L1-L143"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "72712616df2c73c5c17696a7c5cb93f767910acf5f49cda27373fccfa29c5a4d"
+		logic_hash = "v1_sha256_72712616df2c73c5c17696a7c5cb93f767910acf5f49cda27373fccfa29c5a4d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -12176,20 +12176,20 @@ rule REVERSINGLABS_Win32_Ransomware_Fenixlocker : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($encrypt_files_1 and $encrypt_files_2 and $encrypt_files_3) or ($encrypt_files_1 and $encrypt_files_4 and $encrypt_files_5)
+		uint16( 0 ) == 0x5A4D and ( $encrypt_files_1 and $encrypt_files_2 and $encrypt_files_3 ) or ( $encrypt_files_1 and $encrypt_files_4 and $encrypt_files_5 )
 }
 rule REVERSINGLABS_Win32_Ransomware_Infodot : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects InfoDot ransomware."
 		author = "ReversingLabs"
-		id = "2f6447f4-523b-5ea1-a16d-d68bb9bcc79d"
+		id = "5e4ce52c-2366-5910-9066-096d44fdd705"
 		date = "2021-02-16"
 		modified = "2021-02-16"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.InfoDot.yara#L1-L115"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "24a1c25c1d70c21323417ae0892c613361c4bfc829737ef86b6fa7616ae668c6"
+		logic_hash = "v1_sha256_24a1c25c1d70c21323417ae0892c613361c4bfc829737ef86b6fa7616ae668c6"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -12286,20 +12286,20 @@ rule REVERSINGLABS_Win32_Ransomware_Infodot : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Techandstrat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects TechandStrat ransomware."
 		author = "ReversingLabs"
-		id = "525d0b48-2018-5848-b9e7-def8395254eb"
+		id = "73d7d56b-a692-5a04-b447-306aff43e4da"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.TechandStrat.yara#L1-L106"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "80e201cf91adeee100e05af3ba5227fc61968bb6e0ce602107ba1217a7a62856"
+		logic_hash = "v1_sha256_80e201cf91adeee100e05af3ba5227fc61968bb6e0ce602107ba1217a7a62856"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -12383,20 +12383,20 @@ rule REVERSINGLABS_Win32_Ransomware_Techandstrat : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_shares_p*)) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $enum_shares_p* ) ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Jemd : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Jemd ransomware."
 		author = "ReversingLabs"
-		id = "ef981ffa-8801-50f0-9441-5f2bfcf44133"
+		id = "5f055fc7-1694-5d47-8606-b5a9f4b26169"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Jemd.yara#L1-L105"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "552e0fc118031e953dee2e7c6bf8234a5a90de8c34b0e2724dfe99f2b28b8c51"
+		logic_hash = "v1_sha256_552e0fc118031e953dee2e7c6bf8234a5a90de8c34b0e2724dfe99f2b28b8c51"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -12480,20 +12480,20 @@ rule REVERSINGLABS_Win32_Ransomware_Jemd : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($main_routine) and ( all of ($find_files_*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $main_routine ) and ( all of ( $find_files_* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Blackmoon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BlackMoon ransomware."
 		author = "ReversingLabs"
-		id = "95ebb6c4-b0c9-5f9a-8424-a2f4d33953eb"
+		id = "2f4bac0f-186b-5182-9401-7a6094893ca0"
 		date = "2020-11-11"
 		modified = "2020-11-11"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BlackMoon.yara#L1-L70"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "428409096a8637978bf2a1efb3238e4ba87715a909693b0cd26c0f689d567a09"
+		logic_hash = "v1_sha256_428409096a8637978bf2a1efb3238e4ba87715a909693b0cd26c0f689d567a09"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -12547,20 +12547,20 @@ rule REVERSINGLABS_Win32_Ransomware_Blackmoon : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Pay2Key : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Pay2Key ransomware."
 		author = "ReversingLabs"
-		id = "2e482222-0483-5fe3-bb87-cfadda8e7e7a"
+		id = "e37df21a-02bf-55df-8622-6b4e64015a36"
 		date = "2021-04-14"
 		modified = "2021-04-14"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Pay2Key.yara#L1-L99"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2497504f3afc99523cb29e51652a24f4374316d57d4baf5cde8d22e75a425585"
+		logic_hash = "v1_sha256_2497504f3afc99523cb29e51652a24f4374316d57d4baf5cde8d22e75a425585"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -12638,20 +12638,20 @@ rule REVERSINGLABS_Win32_Ransomware_Pay2Key : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Linux_Ransomware_Redalert : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects RedAlert ransomware."
 		author = "ReversingLabs"
-		id = "ec7567bf-2c39-529f-ae93-74270a161827"
+		id = "4adbf149-d96c-5299-ba96-fa3ee0848cf6"
 		date = "2022-09-01"
 		modified = "2022-09-01"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Linux.Ransomware.RedAlert.yara#L1-L146"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fe0d10c2ef1dacdb5374f319e470274b91f4f171db49de8c89e8aaa9aa75a45c"
+		logic_hash = "v1_sha256_fe0d10c2ef1dacdb5374f319e470274b91f4f171db49de8c89e8aaa9aa75a45c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -12772,20 +12772,20 @@ rule REVERSINGLABS_Linux_Ransomware_Redalert : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint32(0)==0x464C457F and ($setup_environment) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($make_configuration)
+		uint32( 0 ) == 0x464C457F and ( $setup_environment ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $make_configuration )
 }
 rule REVERSINGLABS_Win32_Ransomware_Velso : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Velso ransomware."
 		author = "ReversingLabs"
-		id = "72c7baaa-4f83-54c5-ba71-2b45e5eeefd2"
+		id = "cddd3bea-33e4-5abd-ba2b-9363f50aa900"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Velso.yara#L1-L230"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "602be848a26106a1bd46cfc515578f0628687e6cb352e609a274220a61bcb620"
+		logic_hash = "v1_sha256_602be848a26106a1bd46cfc515578f0628687e6cb352e609a274220a61bcb620"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -12985,20 +12985,20 @@ rule REVERSINGLABS_Win32_Ransomware_Velso : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_resources_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $enum_resources_p* ) ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Zerolocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects ZeroLocker ransomware."
 		author = "ReversingLabs"
-		id = "291b5640-387c-54d9-97a6-13823932fa60"
+		id = "f527aa4d-48d8-5c20-9530-3afc3a8257d1"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.ZeroLocker.yara#L1-L70"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "147e4b390bcfaff8f05059c1d9a98b50f544fc32e820406417894fe5046e0f71"
+		logic_hash = "v1_sha256_147e4b390bcfaff8f05059c1d9a98b50f544fc32e820406417894fe5046e0f71"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -13058,20 +13058,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Zerolocker : TC_DETECTION MALICIOUS
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($encrypt_routine_1 and $encrypt_routine_2 and $encrypt_routine_3)
+		uint16( 0 ) == 0x5A4D and ( $encrypt_routine_1 and $encrypt_routine_2 and $encrypt_routine_3 )
 }
 rule REVERSINGLABS_Win32_Ransomware_HDMR : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects HDMR ransomware."
 		author = "ReversingLabs"
-		id = "97b5020c-6cb1-5ec6-84a4-2f35eae761c2"
+		id = "4f928d8b-7df6-5ea7-8d07-642dfaa9ac1a"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.HDMR.yara#L1-L161"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "035c6596db8dc14a663679c1f7e682b85963927cc034b01e390cc22fdee3334a"
+		logic_hash = "v1_sha256_035c6596db8dc14a663679c1f7e682b85963927cc034b01e390cc22fdee3334a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -13208,20 +13208,20 @@ rule REVERSINGLABS_Win32_Ransomware_HDMR : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($find_MS_xchange_backups_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $find_MS_xchange_backups_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Conti : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Conti ransomware."
 		author = "ReversingLabs"
-		id = "548b8836-83cb-560c-af5f-33bdb24d15ed"
+		id = "4a148961-2c6f-53ed-a5ad-25af113aeb17"
 		date = "2020-12-14"
 		modified = "2020-12-14"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Conti.yara#L1-L74"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4f2b96c8eaf8d112a7bb60647db49616935a336396c705d39d5bb51dfd90c60b"
+		logic_hash = "v1_sha256_4f2b96c8eaf8d112a7bb60647db49616935a336396c705d39d5bb51dfd90c60b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -13279,20 +13279,20 @@ rule REVERSINGLABS_Win32_Ransomware_Conti : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Crypmic : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Crypmic ransomware."
 		author = "ReversingLabs"
-		id = "0d5c2141-c0ca-53c8-91fd-ec2d5f163df2"
+		id = "8ef9aef9-7673-52f3-8665-7ec394c48bca"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Crypmic.yara#L1-L56"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ee97c4d35cee68e080a4e9e0a21ecd3698da638463881a58f5daaf906ef86f75"
+		logic_hash = "v1_sha256_ee97c4d35cee68e080a4e9e0a21ecd3698da638463881a58f5daaf906ef86f75"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -13336,20 +13336,20 @@ rule REVERSINGLABS_Win32_Ransomware_Crypmic : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($search_and_encrypt_*)))
+		uint16( 0 ) == 0x5A4D and ( ( all of ( $search_and_encrypt_* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_District : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects District ransomware."
 		author = "ReversingLabs"
-		id = "fc6abbc7-66f9-56e6-8106-5f360f25b092"
+		id = "1e9ed54c-9415-5233-88a0-82fad7ad6c9f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.District.yara#L1-L194"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9ce395636fd7719f503726df82998e1ac72e9e80fd7a4534bd2251ac9283af38"
+		logic_hash = "v1_sha256_9ce395636fd7719f503726df82998e1ac72e9e80fd7a4534bd2251ac9283af38"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -13514,20 +13514,20 @@ rule REVERSINGLABS_Win32_Ransomware_District : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($encrypt_files_p*)) and ($find_files) and ( all of ($enum_resources_1_p*)) and ( all of ($enum_resources_2_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $encrypt_files_p* ) ) and ( $find_files ) and ( all of ( $enum_resources_1_p* ) ) and ( all of ( $enum_resources_2_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Atlas : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Atlas ransomware."
 		author = "ReversingLabs"
-		id = "2c702b24-4b7e-505c-a694-0d915cc47315"
+		id = "28069774-438c-5150-87df-9e7c3ec3dcd1"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Atlas.yara#L1-L99"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1486f931ec096a00d913de0568ddd8aa5a091256445bc28aba90e3e194ebd045"
+		logic_hash = "v1_sha256_1486f931ec096a00d913de0568ddd8aa5a091256445bc28aba90e3e194ebd045"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -13614,20 +13614,20 @@ rule REVERSINGLABS_Win32_Ransomware_Atlas : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_files and $remote_server_1 and $remote_server_2 and $send_post_packet and $send_get_request
+		uint16( 0 ) == 0x5A4D and $encrypt_files and $remote_server_1 and $remote_server_2 and $send_post_packet and $send_get_request
 }
 rule REVERSINGLABS_Win32_Ransomware_Defray : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Defray ransomware."
 		author = "ReversingLabs"
-		id = "bc9e2dfe-168b-5b99-8523-07bfdcba44f2"
+		id = "de8a10a9-835c-51f4-9816-8fc63dd05aa0"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Defray.yara#L1-L157"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "82d883c77f49e50edbc7af05a108d4d54a46dca7661e4d0cd8aeffa19cb8df98"
+		logic_hash = "v1_sha256_82d883c77f49e50edbc7af05a108d4d54a46dca7661e4d0cd8aeffa19cb8df98"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -13755,20 +13755,20 @@ rule REVERSINGLABS_Win32_Ransomware_Defray : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($find_special_folders) and ($encrypt_files_1) and ( all of ($encrypt_files_2_p*)) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $find_special_folders ) and ( $encrypt_files_1 ) and ( all of ( $encrypt_files_2_p* ) ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Motocos : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Motocos ransomware."
 		author = "ReversingLabs"
-		id = "cda44b86-c747-5b48-acd8-e68311ab24a3"
+		id = "4bc92f3f-e8b7-5be5-903c-d1e08d1fc785"
 		date = "2021-09-17"
 		modified = "2021-09-17"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Motocos.yara#L1-L75"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "34b99847f029a291808f08ba6e6ae62a54e6fed5acc928fe4828054801786881"
+		logic_hash = "v1_sha256_34b99847f029a291808f08ba6e6ae62a54e6fed5acc928fe4828054801786881"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -13824,20 +13824,20 @@ rule REVERSINGLABS_Win32_Ransomware_Motocos : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($generate_key) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $generate_key ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Zeoticus : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Zeoticus ransomware."
 		author = "ReversingLabs"
-		id = "483b20a4-2c16-5509-a503-2462a53d4d31"
+		id = "f27a220f-5072-5605-8b2b-3f4204444470"
 		date = "2021-03-19"
 		modified = "2021-03-19"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Zeoticus.yara#L1-L90"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "adf42b96139ad98f4253f3eba2c4af1be9545825605e0851185cc15284d9e9a0"
+		logic_hash = "v1_sha256_adf42b96139ad98f4253f3eba2c4af1be9545825605e0851185cc15284d9e9a0"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -13907,20 +13907,20 @@ rule REVERSINGLABS_Win32_Ransomware_Zeoticus : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($enum_shares_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( all of ( $enum_shares_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Maktub : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Maktub ransomware."
 		author = "ReversingLabs"
-		id = "23ca4232-77ff-5519-b6b0-ccec6cb35fe1"
+		id = "165affc7-9b68-5058-b0c0-145e2372f386"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Maktub.yara#L1-L116"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ee3213213e9521f7d19ce6340cd2f98057c22b1188ceefc30c17c18b6ec54e20"
+		logic_hash = "v1_sha256_ee3213213e9521f7d19ce6340cd2f98057c22b1188ceefc30c17c18b6ec54e20"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -14026,20 +14026,20 @@ rule REVERSINGLABS_Win32_Ransomware_Maktub : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_files and $previous_encrypt_files and $encrypt_files
+		uint16( 0 ) == 0x5A4D and $search_files and $previous_encrypt_files and $encrypt_files
 }
 rule REVERSINGLABS_Win32_Ransomware_Dmalocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects DMALocker ransomware."
 		author = "ReversingLabs"
-		id = "3ddef0f1-61c9-59f6-a02c-35768c2cd4d6"
+		id = "5b236427-3f05-5a6c-9726-84e85aeb99db"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.DMALocker.yara#L1-L149"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "107dbc4cacd9d451e9c6fe8aa91cd612f70ac767ee70f74f3a77d1e5548b054f"
+		logic_hash = "v1_sha256_107dbc4cacd9d451e9c6fe8aa91cd612f70ac767ee70f74f3a77d1e5548b054f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -14167,20 +14167,20 @@ rule REVERSINGLABS_Win32_Ransomware_Dmalocker : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_1) or ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_2) or ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_3) or ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_1 and $dmalock_v2_enum_logical_disks) or ($dmalock_v4_encrypt_file_1 and $dmalock_v4_encrypt_file_2 and $dmalock_v4_remote_server_communication and $dmalock_v2_enum_logical_disks)
+		uint16( 0 ) == 0x5A4D and ( $dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_1 ) or ( $dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_2 ) or ( $dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_3 ) or ( $dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_1 and $dmalock_v2_enum_logical_disks ) or ( $dmalock_v4_encrypt_file_1 and $dmalock_v4_encrypt_file_2 and $dmalock_v4_remote_server_communication and $dmalock_v2_enum_logical_disks )
 }
 rule REVERSINGLABS_Win32_Ransomware_Henry : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Henry ransomware."
 		author = "ReversingLabs"
-		id = "63627f2b-3205-5790-ba97-8e0d1da39d7c"
+		id = "c308ea61-2ccd-51a0-b00b-7f4b3d4e1852"
 		date = "2021-06-14"
 		modified = "2021-06-14"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Henry.yara#L1-L80"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e6ab2a8a344d40407118e29ff78f5a0144f42a0fbdee19a80b341b59f056d292"
+		logic_hash = "v1_sha256_e6ab2a8a344d40407118e29ff78f5a0144f42a0fbdee19a80b341b59f056d292"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -14237,20 +14237,20 @@ rule REVERSINGLABS_Win32_Ransomware_Henry : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($setup_environment) and ($init_components)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $setup_environment ) and ( $init_components )
 }
 rule REVERSINGLABS_Win32_Ransomware_Darkside : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects DarkSide ransomware."
 		author = "ReversingLabs"
-		id = "061b00cb-9b70-521f-ab3f-7e6b3c129194"
+		id = "4cc1e6bc-4b97-52df-8ab3-9378008ef9b7"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.DarkSide.yara#L1-L94"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "128af9a1b143e4b0928dd2b243e69497be906175f44815cc5703f17cce48ec9d"
+		logic_hash = "v1_sha256_128af9a1b143e4b0928dd2b243e69497be906175f44815cc5703f17cce48ec9d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -14321,20 +14321,20 @@ rule REVERSINGLABS_Win32_Ransomware_Darkside : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($find_files_v1 and $enumerate_drives and $escalate_privileges) or ($find_files_v2 and $enumerate_netshare))
+		uint16( 0 ) == 0x5A4D and ( ( $find_files_v1 and $enumerate_drives and $escalate_privileges ) or ( $find_files_v2 and $enumerate_netshare ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_MRAC : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects MRAC ransomware."
 		author = "ReversingLabs"
-		id = "135c3dc9-bf08-5f00-bade-7054d9f33830"
+		id = "9dc78634-5a27-5daa-a307-dfc9b0b9cd63"
 		date = "2022-02-21"
 		modified = "2022-02-21"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.MRAC.yara#L1-L69"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "04e8364dc9c726f4bb2d3035e5b7e8dab4cae124b2f047be6f11b865fab557a7"
+		logic_hash = "v1_sha256_04e8364dc9c726f4bb2d3035e5b7e8dab4cae124b2f047be6f11b865fab557a7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -14384,20 +14384,20 @@ rule REVERSINGLABS_Win32_Ransomware_MRAC : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($import_key) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $import_key ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Ghostencryptor : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GhosTEncryptor ransomware."
 		author = "ReversingLabs"
-		id = "9f035e39-e0fe-54f3-8206-08fbbd9206b4"
+		id = "6992ae36-f5a1-5a8c-a1f6-ad0755c93d38"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.GhosTEncryptor.yara#L1-L69"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "85c1f6e5acf746388b0a9ddeb1f0ad1d2219fff7358c9a981849863155c13e3c"
+		logic_hash = "v1_sha256_85c1f6e5acf746388b0a9ddeb1f0ad1d2219fff7358c9a981849863155c13e3c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -14445,20 +14445,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Ghostencryptor : TC_DETECTION MALICI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_folders) and ( all of ($deep_search_p*)) and ( all of ($encrypt_folder_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_folders ) and ( all of ( $deep_search_p* ) ) and ( all of ( $encrypt_folder_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Hakunamatata : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects HakunaMatata ransomware."
 		author = "ReversingLabs"
-		id = "17438fcd-7a51-5fb6-96ac-38523bc1744f"
+		id = "8ec11cae-346e-5486-82ba-6084d1d29803"
 		date = "2020-11-11"
 		modified = "2020-11-11"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.HakunaMatata.yara#L1-L373"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e363ff93fce286d60a3f5ea20ba3ec03564b7a5321c3f6448cc82187f23e8a9f"
+		logic_hash = "v1_sha256_e363ff93fce286d60a3f5ea20ba3ec03564b7a5321c3f6448cc82187f23e8a9f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -14806,20 +14806,20 @@ rule REVERSINGLABS_Win32_Ransomware_Hakunamatata : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($search_files and $encrypt_files and $remote_connection) or ($encrypt_files_2 and $remote_connection and $search_files) or ($search_files_2 and $encrypt_files_3 and $remote_connection_2) or ($install_service and $search_files_3 and $encrypt_files_4) or ($search_files_4 and $encrypt_files_5 and $remote_connection_3))
+		uint16( 0 ) == 0x5A4D and ( ( $search_files and $encrypt_files and $remote_connection ) or ( $encrypt_files_2 and $remote_connection and $search_files ) or ( $search_files_2 and $encrypt_files_3 and $remote_connection_2 ) or ( $install_service and $search_files_3 and $encrypt_files_4 ) or ( $search_files_4 and $encrypt_files_5 and $remote_connection_3 ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Crysis : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Crysis ransomware."
 		author = "ReversingLabs"
-		id = "bba2bbf5-ff77-5ec4-ae7f-afae1b564fb7"
+		id = "dd48f136-bfe6-5734-a28e-46e6a0926569"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Crysis.yara#L1-L108"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3c9250206f94ac65c1fc24e83cf8cdd76d10066086ef1f34ec14791d237c0263"
+		logic_hash = "v1_sha256_3c9250206f94ac65c1fc24e83cf8cdd76d10066086ef1f34ec14791d237c0263"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -14910,20 +14910,20 @@ rule REVERSINGLABS_Win32_Ransomware_Crysis : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enumerate_resources and $enumerate_files and $encrypt_files and $remote_connection_1)
+		uint16( 0 ) == 0x5A4D and ( $enumerate_resources and $enumerate_files and $encrypt_files and $remote_connection_1 )
 }
 rule REVERSINGLABS_Win32_Ransomware_Marlboro : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Marlboro ransomware."
 		author = "ReversingLabs"
-		id = "7cd3b436-47e3-5711-9b59-cef70efe3b45"
+		id = "8663cc6c-8bb4-5187-93a3-e196ce3aca33"
 		date = "2020-07-23"
 		modified = "2020-07-23"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Marlboro.yara#L1-L117"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d36c3cf52af47e9f638f58aabc19298e8c58831c3083f82e4c194319503eeaaa"
+		logic_hash = "v1_sha256_d36c3cf52af47e9f638f58aabc19298e8c58831c3083f82e4c194319503eeaaa"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15022,20 +15022,20 @@ rule REVERSINGLABS_Win32_Ransomware_Marlboro : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and $ping_apnic and $remote_server_connection_1 and $remote_server_connection_2 and $remote_server_connection_3 and $remote_server_connection_4 and $encrypt_file
+		uint16( 0 ) == 0x5A4D and $ping_apnic and $remote_server_connection_1 and $remote_server_connection_2 and $remote_server_connection_3 and $remote_server_connection_4 and $encrypt_file
 }
 rule REVERSINGLABS_Win64_Ransomware_Seth : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Seth ransomware."
 		author = "ReversingLabs"
-		id = "001de900-4556-5428-a243-7ec07a7ed05e"
+		id = "8489530f-f881-50c3-8bd0-872de4df79ea"
 		date = "2021-04-02"
 		modified = "2021-04-02"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Seth.yara#L1-L122"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "72a9d902eea2381f40d42faa7f1686c4ca54d364af0cbd8711697bbc1a235646"
+		logic_hash = "v1_sha256_72a9d902eea2381f40d42faa7f1686c4ca54d364af0cbd8711697bbc1a235646"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15136,20 +15136,20 @@ rule REVERSINGLABS_Win64_Ransomware_Seth : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Dharma : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Dharma ransomware."
 		author = "ReversingLabs"
-		id = "8157b20b-717c-581f-83c1-5fc8d2312238"
+		id = "3a66c2bd-d806-5c29-8e03-fdf5d63da420"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Dharma.yara#L1-L108"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6f33281523b462aaff68bb04f2f6869c3e6cd60cd9306ed80bb0c3e3b699f315"
+		logic_hash = "v1_sha256_6f33281523b462aaff68bb04f2f6869c3e6cd60cd9306ed80bb0c3e3b699f315"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15245,20 +15245,20 @@ rule REVERSINGLABS_Win32_Ransomware_Dharma : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $file_search and $enum_shares and $file_encrypt_1 and $file_encrypt_2
+		uint16( 0 ) == 0x5A4D and $file_search and $enum_shares and $file_encrypt_1 and $file_encrypt_2
 }
 rule REVERSINGLABS_Win32_Ransomware_Saturn : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Saturn ransomware."
 		author = "ReversingLabs"
-		id = "70a8d937-aee5-54d8-9409-c5d2d0830a2b"
+		id = "7624b920-beb6-5c96-81c9-6d980d4ac506"
 		date = "2020-10-19"
 		modified = "2020-10-19"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Saturn.yara#L1-L105"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "efa748346ad8c46e654542d302e81d633a2d12f421636c477431a12a34636132"
+		logic_hash = "v1_sha256_efa748346ad8c46e654542d302e81d633a2d12f421636c477431a12a34636132"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15345,20 +15345,20 @@ rule REVERSINGLABS_Win32_Ransomware_Saturn : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Gpcode : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Gpcode ransomware."
 		author = "ReversingLabs"
-		id = "168833dd-44ab-59e1-a610-b9219b2907ff"
+		id = "1fc4c6ae-d8c8-5b6a-96a0-fb483d49965a"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Gpcode.yara#L1-L67"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "329309873977f73a8ebe758018ebc8ba42e15c3c7cbb9a65865631d235f5bb48"
+		logic_hash = "v1_sha256_329309873977f73a8ebe758018ebc8ba42e15c3c7cbb9a65865631d235f5bb48"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15410,20 +15410,20 @@ rule REVERSINGLABS_Win32_Ransomware_Gpcode : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($drive_loop and $encrypt_routine and $set_ransom_wallpaper and $read_config_file)
+		uint16( 0 ) == 0x5A4D and ( $drive_loop and $encrypt_routine and $set_ransom_wallpaper and $read_config_file )
 }
 rule REVERSINGLABS_Win32_Ransomware_Bluelocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BlueLocker ransomware."
 		author = "ReversingLabs"
-		id = "145ff05e-c90d-598a-a3d5-220bd6df718a"
+		id = "53f13a5c-9f46-53e5-b4f6-49e46f0f89c9"
 		date = "2022-08-04"
 		modified = "2022-08-04"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BlueLocker.yara#L1-L130"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fbe5f246f4554e63b5da6a0aca169e8221a84fce18fd437ae7ad9b068e9ca576"
+		logic_hash = "v1_sha256_fbe5f246f4554e63b5da6a0aca169e8221a84fce18fd437ae7ad9b068e9ca576"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15531,20 +15531,20 @@ rule REVERSINGLABS_Win32_Ransomware_Bluelocker : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($create_crypt_context) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $create_crypt_context ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Wasplocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects WaspLocker ransomware."
 		author = "ReversingLabs"
-		id = "596bf965-700a-58f5-b0e5-61ec57c23a3e"
+		id = "f0b53b72-a2d6-59b1-972b-ee81b9614fc5"
 		date = "2022-06-28"
 		modified = "2022-06-28"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.WaspLocker.yara#L1-L76"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "852ec52328fca36d651e3176ac33a57ce26cefecadc2aad27235548e5b9813c1"
+		logic_hash = "v1_sha256_852ec52328fca36d651e3176ac33a57ce26cefecadc2aad27235548e5b9813c1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15601,20 +15601,20 @@ rule REVERSINGLABS_Win32_Ransomware_Wasplocker : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($drop_aux_files) and ($drop_ransom_notes)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $drop_aux_files ) and ( $drop_ransom_notes )
 }
 rule REVERSINGLABS_Linux_Ransomware_Luckyjoe : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects LuckyJoe ransomware."
 		author = "ReversingLabs"
-		id = "8dc98d71-b79d-5b09-9383-11f2b57baeb5"
+		id = "9e1cfe30-04d8-5c20-9617-1157f032c3dc"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Linux.Ransomware.LuckyJoe.yara#L1-L146"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1e7df2c45bee072af233cf8f355a84ec931fe96afa3fbdcd225dded1b75ea961"
+		logic_hash = "v1_sha256_1e7df2c45bee072af233cf8f355a84ec931fe96afa3fbdcd225dded1b75ea961"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15737,20 +15737,20 @@ rule REVERSINGLABS_Linux_Ransomware_Luckyjoe : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint32(0)==0x464C457F and ( all of ($main_call_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($encrypt_internal_message_p*))
+		uint32( 0 ) == 0x464C457F and ( all of ( $main_call_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $encrypt_internal_message_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Shadowcryptor : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects ShadowCryptor ransomware."
 		author = "ReversingLabs"
-		id = "983e8927-4829-540f-9697-886226fd54ce"
+		id = "b2253d8f-9cf8-5f6b-8173-73f0f9523e8e"
 		date = "2021-02-11"
 		modified = "2021-02-11"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.ShadowCryptor.yara#L1-L89"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "875150db9fc36cd992988bba7d0c05487418b901980bf428ebd427c82fbcacd7"
+		logic_hash = "v1_sha256_875150db9fc36cd992988bba7d0c05487418b901980bf428ebd427c82fbcacd7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15819,20 +15819,20 @@ rule REVERSINGLABS_Win32_Ransomware_Shadowcryptor : TC_DETECTION MALICIOUS MALWA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($terminate_antivirus_processes_p*)) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $terminate_antivirus_processes_p* ) ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Networm : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Networm ransomware."
 		author = "ReversingLabs"
-		id = "3b17b97d-c882-5f65-8b89-847e2300873c"
+		id = "41e4e5e7-ae32-5baf-9478-3a58ec724cdc"
 		date = "2021-07-05"
 		modified = "2021-07-05"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Networm.yara#L1-L103"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ff9bcb9868522f9d4abf2ab9f94d5b7c9b009e5c6d0cf832c7d052f18e048b31"
+		logic_hash = "v1_sha256_ff9bcb9868522f9d4abf2ab9f94d5b7c9b009e5c6d0cf832c7d052f18e048b31"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -15914,20 +15914,20 @@ rule REVERSINGLABS_Win32_Ransomware_Networm : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Bam2021 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Bam2021 ransomware."
 		author = "ReversingLabs"
-		id = "31ae99e3-223c-51fb-97c1-353ff063057f"
+		id = "4eb74707-9fec-5d76-b47e-4c4f73467735"
 		date = "2021-09-17"
 		modified = "2021-09-17"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Bam2021.yara#L1-L167"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5b717510991b78f07806e88f3dfe1c27d6ec1ec21af61a7c4f1edf7c915785d5"
+		logic_hash = "v1_sha256_5b717510991b78f07806e88f3dfe1c27d6ec1ec21af61a7c4f1edf7c915785d5"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16064,20 +16064,20 @@ rule REVERSINGLABS_Win32_Ransomware_Bam2021 : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_shares) and ( all of ($find_files_p*)) and ($generate_key) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $enum_shares ) and ( all of ( $find_files_p* ) ) and ( $generate_key ) and ( all of ( $encrypt_files_p* ) ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Vegalocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects VegaLocker ransomware."
 		author = "ReversingLabs"
-		id = "53eec8d1-bab0-5556-92c0-1b70eb763fa5"
+		id = "55ca45a5-74bd-566d-91f7-32a8741696b9"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.VegaLocker.yara#L1-L100"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8616e72fc435676179e83a304d4111c8f29ebf3cd79ff5b2d229cca8fc97c2a3"
+		logic_hash = "v1_sha256_8616e72fc435676179e83a304d4111c8f29ebf3cd79ff5b2d229cca8fc97c2a3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16160,20 +16160,20 @@ rule REVERSINGLABS_Win32_Ransomware_Vegalocker : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Moisha : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Moisha ransomware."
 		author = "ReversingLabs"
-		id = "c72f654f-955e-5ff6-ac91-19fbb858265c"
+		id = "55148aa0-0685-56ec-b854-127f9a54b878"
 		date = "2022-10-11"
 		modified = "2022-10-11"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Moisha.yara#L1-L86"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "89cefbbb8ec722216721bb43eb14cc33fcd4671585051359a06b62236cbf3a6c"
+		logic_hash = "v1_sha256_89cefbbb8ec722216721bb43eb14cc33fcd4671585051359a06b62236cbf3a6c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16238,20 +16238,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Moisha : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($import_priv_key) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $import_priv_key ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Timecrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects TimeCrypt ransomware."
 		author = "ReversingLabs"
-		id = "38a0c383-8be6-5258-aa93-0cf09b18e5f7"
+		id = "a705b8f2-f9b9-537f-bb5c-fcaba3d37d11"
 		date = "2021-12-06"
 		modified = "2021-12-06"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.TimeCrypt.yara#L1-L69"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6849d6d5010d7bcb4052c10d5bd7cc29320ffc986f36289b272a1e9a8d14fab9"
+		logic_hash = "v1_sha256_6849d6d5010d7bcb4052c10d5bd7cc29320ffc986f36289b272a1e9a8d14fab9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16297,20 +16297,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Timecrypt : TC_DETECTION MALICIOUS M
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($send_http_request) and ($send_dns_request)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $send_http_request ) and ( $send_dns_request )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Eternity : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Eternity ransomware."
 		author = "ReversingLabs"
-		id = "7bb0f3b0-a8c0-5239-a1b4-532d403f59bc"
+		id = "3a85c694-9b64-5b12-a206-1b8effff0c83"
 		date = "2022-07-22"
 		modified = "2022-07-22"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Eternity.yara#L1-L74"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a2298a26e9bbe2b779eb2afeeda28d4321bc2d26db46bbb377bf86abaf8fa929"
+		logic_hash = "v1_sha256_a2298a26e9bbe2b779eb2afeeda28d4321bc2d26db46bbb377bf86abaf8fa929"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16361,20 +16361,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Eternity : TC_DETECTION MALICIOUS MA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($aes_encrypt) and ($encrypt_pass)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $aes_encrypt ) and ( $encrypt_pass )
 }
 rule REVERSINGLABS_Win64_Ransomware_DST : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects DST ransomware."
 		author = "ReversingLabs"
-		id = "bcc9933d-14eb-5f83-a136-5f009c7a3282"
+		id = "9c58c08d-73f3-5481-9e38-713314578c91"
 		date = "2021-12-06"
 		modified = "2021-12-06"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.DST.yara#L1-L170"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b658093232a2265d425e3b38758268c116bbac51fa5eed372b5b4f00de4c6880"
+		logic_hash = "v1_sha256_b658093232a2265d425e3b38758268c116bbac51fa5eed372b5b4f00de4c6880"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16520,20 +16520,20 @@ rule REVERSINGLABS_Win64_Ransomware_DST : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($kill_procs_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $kill_procs_p* ) ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Retis : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Retis ransomware."
 		author = "ReversingLabs"
-		id = "3d1de7c2-abb7-5411-a598-6bc68229a22a"
+		id = "90889c95-ba2e-5081-907c-818b8f3a92e3"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Retis.yara#L1-L74"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3e3429041acc5730b009916efbcd35c7cfd2b2877dc1d2cf980f7fb7d399d532"
+		logic_hash = "v1_sha256_3e3429041acc5730b009916efbcd35c7cfd2b2877dc1d2cf980f7fb7d399d532"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16591,20 +16591,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Retis : TC_DETECTION MALICIOUS MALWA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_files and $search_drives and $encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $search_files and $search_drives and $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Zeppelin : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Zeppelin ransomware."
 		author = "ReversingLabs"
-		id = "f5cf514d-4dd0-58b7-82d0-5cb516a139a3"
+		id = "a05a39f6-c12a-5565-9ec3-ffc5bc26873f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Zeppelin.yara#L1-L109"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8fb07e49d2ff9d497fb36a5d901748315ae519f5ef845d1a5ec6341d0eb1f68c"
+		logic_hash = "v1_sha256_8fb07e49d2ff9d497fb36a5d901748315ae519f5ef845d1a5ec6341d0eb1f68c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16689,20 +16689,20 @@ rule REVERSINGLABS_Win32_Ransomware_Zeppelin : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($kill_processes) and ($enum_shares) and ( all of ($search_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $kill_processes ) and ( $enum_shares ) and ( all of ( $search_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Kawaiilocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects KawaiiLocker ransomware."
 		author = "ReversingLabs"
-		id = "8c368e2d-3c6f-5c4b-880b-ebdb06dcf901"
+		id = "f2b6e9d8-5020-56fd-9076-5bfa1525e890"
 		date = "2020-08-17"
 		modified = "2020-08-17"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.KawaiiLocker.yara#L1-L135"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d86b41ef1c43da55869ad26facd5efdf232277f0e33483690a69a04c4ba8f7da"
+		logic_hash = "v1_sha256_d86b41ef1c43da55869ad26facd5efdf232277f0e33483690a69a04c4ba8f7da"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16826,20 +16826,20 @@ rule REVERSINGLABS_Win32_Ransomware_Kawaiilocker : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_files and $encrypt_files and $remote_connection
+		uint16( 0 ) == 0x5A4D and $search_files and $encrypt_files and $remote_connection
 }
 rule REVERSINGLABS_Win32_Ransomware_Cuba : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Cuba ransomware."
 		author = "ReversingLabs"
-		id = "b2c81849-9fa6-58b6-b6fe-4d9a5f0923ea"
+		id = "a1ea23a4-ef35-56a2-8bbb-971fb26a31d3"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Cuba.yara#L1-L126"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0a8dea6e38a6407897b994ea119bc8b0712a94363b7b3942dcd32c65ee5548d4"
+		logic_hash = "v1_sha256_0a8dea6e38a6407897b994ea119bc8b0712a94363b7b3942dcd32c65ee5548d4"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -16944,20 +16944,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cuba : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_resources ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Telecrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects TeleCrypt ransomware."
 		author = "ReversingLabs"
-		id = "c4eada2d-72c0-5efe-bf2b-8f053348d89d"
+		id = "27a18ed0-6f9b-5624-aa49-5c94e8428230"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.TeleCrypt.yara#L1-L109"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9d856eae4369cd7ba1d88bd6ef37931e069127e2c05a84a44f5274f681e83fc0"
+		logic_hash = "v1_sha256_9d856eae4369cd7ba1d88bd6ef37931e069127e2c05a84a44f5274f681e83fc0"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17052,7 +17052,7 @@ rule REVERSINGLABS_Win32_Ransomware_Telecrypt : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($generate_strings_to_encrypt and $encrypt_file and $server_communication and $exec_payload) or ($encrypt_file and $server_communication_1 and $copy_payload))
+		uint16( 0 ) == 0x5A4D and ( ( $generate_strings_to_encrypt and $encrypt_file and $server_communication and $exec_payload ) or ( $encrypt_file and $server_communication_1 and $copy_payload ) )
 }
 import "pe"
 
@@ -17061,13 +17061,13 @@ rule REVERSINGLABS_Win32_Ransomware_Dirtydecrypt : TC_DETECTION MALICIOUS MALWAR
 	meta:
 		description = "Yara rule that detects DirtyDecrypt ransomware."
 		author = "ReversingLabs"
-		id = "f4d69c3e-a082-5bc9-bf72-4cc330d3de74"
+		id = "fd29d316-d249-5c1c-8985-e001782b46ce"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.DirtyDecrypt.yara#L3-L112"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "eb6a1c376b0739848b523e741d0d1ebdbc87056d51931fb94c744aa094d6479f"
+		logic_hash = "v1_sha256_eb6a1c376b0739848b523e741d0d1ebdbc87056d51931fb94c744aa094d6479f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17160,20 +17160,20 @@ rule REVERSINGLABS_Win32_Ransomware_Dirtydecrypt : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($dd_ep at pe.entry_point) and $dd_hash and $dd_getkey and $dd_destroykey and $dd_importkey and $dd_decrypt and $dd_encrypt and $dd_provparam and $dd_acquirecontext and $dd_mrwhite
+		uint16( 0 ) == 0x5A4D and ( $dd_ep at pe.entry_point ) and $dd_hash and $dd_getkey and $dd_destroykey and $dd_importkey and $dd_decrypt and $dd_encrypt and $dd_provparam and $dd_acquirecontext and $dd_mrwhite
 }
 rule REVERSINGLABS_Win64_Ransomware_Awesomescott : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects AwesomeScott ransomware."
 		author = "ReversingLabs"
-		id = "36d3b801-dbdb-585a-ac80-1827a6749c87"
+		id = "8cffdd89-8188-54e6-bbcf-2c4dc6ae830e"
 		date = "2020-09-16"
 		modified = "2020-09-16"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.AwesomeScott.yara#L1-L101"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ed8096a4abbd015f79f4ec7239cd4070194ad70fa03da6714e499a41f9fb9423"
+		logic_hash = "v1_sha256_ed8096a4abbd015f79f4ec7239cd4070194ad70fa03da6714e499a41f9fb9423"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17263,20 +17263,20 @@ rule REVERSINGLABS_Win64_Ransomware_Awesomescott : TC_DETECTION MALICIOUS MALWAR
       }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and $find_files and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Nokoyawa : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Nokoyawa ransomware."
 		author = "ReversingLabs"
-		id = "31470ce4-381f-50d2-bbca-03c592e62a7d"
+		id = "c960ed63-5b79-5def-9957-26b583bfa5ed"
 		date = "2022-06-06"
 		modified = "2022-06-06"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Nokoyawa.yara#L1-L104"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "85b7d93db06007d0043b1489b532410ccc700cf082b641fff8a09de2ffe9101d"
+		logic_hash = "v1_sha256_85b7d93db06007d0043b1489b532410ccc700cf082b641fff8a09de2ffe9101d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17360,20 +17360,20 @@ rule REVERSINGLABS_Win64_Ransomware_Nokoyawa : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($enum_shares) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $enum_shares ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Timetime : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects TimeTime ransomware."
 		author = "ReversingLabs"
-		id = "27bff941-01ce-5bf7-a9d8-d01d2db3bfd3"
+		id = "5ce2657d-32d2-5c4c-aa14-63d5ee30c11f"
 		date = "2022-02-21"
 		modified = "2022-02-21"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.TimeTime.yara#L1-L75"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "43867dd793bc84e6f39ca2de1aff4047a742b295dc4df94cd337bd2ef89e4a62"
+		logic_hash = "v1_sha256_43867dd793bc84e6f39ca2de1aff4047a742b295dc4df94cd337bd2ef89e4a62"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17425,20 +17425,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Timetime : TC_DETECTION MALICIOUS MA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($encrypt_folder) and ($rename_files)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $encrypt_folder ) and ( $rename_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Sifrelendi : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Sifrelendi ransomware."
 		author = "ReversingLabs"
-		id = "b9083b7c-eb09-52da-a240-39b51df892f9"
+		id = "d1aca0b5-47a2-53f2-83c4-795d91e66b5f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Sifrelendi.yara#L1-L67"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "430d3877c10c86fcb19b5624dd8886d61e54ccd0453678329309b49712c6d5c6"
+		logic_hash = "v1_sha256_430d3877c10c86fcb19b5624dd8886d61e54ccd0453678329309b49712c6d5c6"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17490,20 +17490,20 @@ rule REVERSINGLABS_Win32_Ransomware_Sifrelendi : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $search_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Sarbloh : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Sarbloh ransomware."
 		author = "ReversingLabs"
-		id = "532abd77-f091-5c54-87a3-7e8be5253efd"
+		id = "61207ca2-c42f-5e2e-881d-e3093bfbd654"
 		date = "2021-05-21"
 		modified = "2021-05-21"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Sarbloh.yara#L1-L88"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7259aa9d1fe657db220ee50f1610e6439ff61673d92f46ebc3b8cadd990f002c"
+		logic_hash = "v1_sha256_7259aa9d1fe657db220ee50f1610e6439ff61673d92f46ebc3b8cadd990f002c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17574,20 +17574,20 @@ rule REVERSINGLABS_Win32_Ransomware_Sarbloh : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Gomer : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Gomer ransomware."
 		author = "ReversingLabs"
-		id = "b76ac856-2abe-531d-b093-461569b9afb7"
+		id = "0b9421a2-ae37-5abc-8003-4779be8ab886"
 		date = "2020-10-08"
 		modified = "2020-10-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Gomer.yara#L1-L106"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a53d37fcb877a12a4969a6ea1aaa67fc4106c3fbdd80a4fd39ad5a66a9df47fc"
+		logic_hash = "v1_sha256_a53d37fcb877a12a4969a6ea1aaa67fc4106c3fbdd80a4fd39ad5a66a9df47fc"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17672,20 +17672,20 @@ rule REVERSINGLABS_Win32_Ransomware_Gomer : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_drives_p*)) and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $enum_drives_p* ) ) and ( all of ( $find_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Badblock : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BadBlock ransomware."
 		author = "ReversingLabs"
-		id = "a5afb7d6-4bc1-5465-a35d-fe40e7f11c3e"
+		id = "7b160f80-7450-5fc9-972e-e9c4a2e21cbf"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BadBlock.yara#L1-L100"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "421e6a3772eeec6ef0cbb2427b7e044b450a2b2146cee2ca7d8c3a3a92918557"
+		logic_hash = "v1_sha256_421e6a3772eeec6ef0cbb2427b7e044b450a2b2146cee2ca7d8c3a3a92918557"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17770,20 +17770,20 @@ rule REVERSINGLABS_Win32_Ransomware_Badblock : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_files and $encrypt_files and $remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $search_files and $encrypt_files and $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Torrentlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects TorrentLocker ransomware."
 		author = "ReversingLabs"
-		id = "64bdb0db-ea0c-5a0d-9d3e-db1df86c132b"
+		id = "1415bb79-c0cb-5cb3-833d-a304b908133e"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.TorrentLocker.yara#L1-L98"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f1aa523fa95e142b7e421286d26918e3da4bd3e268fef3f98f00820296291bfc"
+		logic_hash = "v1_sha256_f1aa523fa95e142b7e421286d26918e3da4bd3e268fef3f98f00820296291bfc"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17866,20 +17866,20 @@ rule REVERSINGLABS_Win32_Ransomware_Torrentlocker : TC_DETECTION MALICIOUS MALWA
       }
 
 	condition:
-		uint16(0)==0x5A4D and (($tlocker_ep and $tlocker_get_server_data and $tlocker_remove_shadow_copies and $tlocker_find_files) and ($tlocker_contact_server_1 or ($tlocker_contact_server_2_1 and $tlocker_contact_server_2_2)))
+		uint16( 0 ) == 0x5A4D and ( ( $tlocker_ep and $tlocker_get_server_data and $tlocker_remove_shadow_copies and $tlocker_find_files ) and ( $tlocker_contact_server_1 or ( $tlocker_contact_server_2_1 and $tlocker_contact_server_2_2 ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ransoc : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ransoc ransomware."
 		author = "ReversingLabs"
-		id = "a990754e-eafa-5501-a123-bcbd5aa26ca6"
+		id = "7d9244ff-d20c-5dc5-a37d-a8d16fbd5e30"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Ransoc.yara#L1-L114"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1f48f1b713c18b099e863d8a11e872ae84df0ea355f01cba765e8333d8d98575"
+		logic_hash = "v1_sha256_1f48f1b713c18b099e863d8a11e872ae84df0ea355f01cba765e8333d8d98575"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -17982,20 +17982,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ransoc : TC_DETECTION MALICIOUS MALWARE FILE
       }
 
 	condition:
-		uint16(0)==0x5A4D and $scan_for_services and $find_files and $encrypt_files and $remote_connection
+		uint16( 0 ) == 0x5A4D and $scan_for_services and $find_files and $encrypt_files and $remote_connection
 }
 rule REVERSINGLABS_Win32_Ransomware_Avaddon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Avaddon ransomware."
 		author = "ReversingLabs"
-		id = "f3a57482-5799-594b-bcfa-1137ca04dfd5"
+		id = "4e67c4c4-1a0c-59dc-9c88-ea2b270eddfe"
 		date = "2020-10-19"
 		modified = "2020-10-19"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Avaddon.yara#L1-L148"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1b2c449d5bad02dd06cb4a980fcca1feaf02b1d8127096bb39deecbc544272a6"
+		logic_hash = "v1_sha256_1b2c449d5bad02dd06cb4a980fcca1feaf02b1d8127096bb39deecbc544272a6"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -18115,20 +18115,20 @@ rule REVERSINGLABS_Win32_Ransomware_Avaddon : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($enum_resources_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $enum_resources_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Cryakl : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Cryakl ransomware."
 		author = "ReversingLabs"
-		id = "5c668278-458e-5b13-83c4-63beab5249ed"
+		id = "c9687951-e436-5e67-8771-d0df5e829222"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Cryakl.yara#L1-L64"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "51d50ab1ce021e2facbca3a35af372186287a8d69b66651c9804234a409d9932"
+		logic_hash = "v1_sha256_51d50ab1ce021e2facbca3a35af372186287a8d69b66651c9804234a409d9932"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -18180,20 +18180,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cryakl : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($enum_and_encrypt_files_*)))
+		uint16( 0 ) == 0x5A4D and ( ( all of ( $enum_and_encrypt_files_* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Jamper : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Jamper ransomware."
 		author = "ReversingLabs"
-		id = "9ba9358e-8f67-5d0e-a9bc-b3b10cd3a8b2"
+		id = "1472d212-2676-5fd9-ba49-21bdc4d3c905"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Jamper.yara#L1-L110"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "826f8fa7cc92b279c609a9ab6a87c32940e37b4c2476854af75bbed29cb3eaf2"
+		logic_hash = "v1_sha256_826f8fa7cc92b279c609a9ab6a87c32940e37b4c2476854af75bbed29cb3eaf2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -18283,20 +18283,20 @@ rule REVERSINGLABS_Win32_Ransomware_Jamper : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_resources ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_5Ss5C : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects 5ss5c ransomware."
 		author = "ReversingLabs"
-		id = "c69f44de-8e48-518d-87bf-d21d11223a2f"
+		id = "3abf3e50-c374-51de-939d-008799856a45"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.5ss5c.yara#L1-L267"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "74fcec568906a01dade7091c63cffbe4afa49c4705d9c1f21d10b4eee655a805"
+		logic_hash = "v1_sha256_74fcec568906a01dade7091c63cffbe4afa49c4705d9c1f21d10b4eee655a805"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -18533,20 +18533,20 @@ rule REVERSINGLABS_Win32_Ransomware_5Ss5C : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Wastedlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects WastedLocker ransomware."
 		author = "ReversingLabs"
-		id = "68090960-9878-5836-8caa-bf8f408a474e"
+		id = "92e2ebe8-5c29-5fd1-a30f-eb7b130c4939"
 		date = "2020-12-07"
 		modified = "2020-12-07"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Wastedlocker.yara#L1-L86"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0899d3cc3bcea8eae60689a54f34e57bdc52088c879c8420b8e6d0b1969cb186"
+		logic_hash = "v1_sha256_0899d3cc3bcea8eae60689a54f34e57bdc52088c879c8420b8e6d0b1969cb186"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -18615,20 +18615,20 @@ rule REVERSINGLABS_Win32_Ransomware_Wastedlocker : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Lolkek : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Lolkek ransomware."
 		author = "ReversingLabs"
-		id = "441badd6-3708-5f74-90f3-4d3a0fc45aff"
+		id = "96c1a4c0-2b33-569b-92bc-321cc3d0f683"
 		date = "2020-10-23"
 		modified = "2020-10-23"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Lolkek.yara#L1-L106"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d18545b25a33bba1a6e01ab37768bd4f15fb125dcb8cbe7909d9a8bbe08e63fa"
+		logic_hash = "v1_sha256_d18545b25a33bba1a6e01ab37768bd4f15fb125dcb8cbe7909d9a8bbe08e63fa"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -18713,20 +18713,20 @@ rule REVERSINGLABS_Win32_Ransomware_Lolkek : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_volumes_p*)) and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_volumes_p* ) ) and ( all of ( $find_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Tarrak : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects TaRRaK ransomware."
 		author = "ReversingLabs"
-		id = "a783df87-0c9b-5868-9af0-c32b11e8b71b"
+		id = "f92f25f2-2187-5c7c-bdf8-d50ab90b9b5b"
 		date = "2021-09-06"
 		modified = "2021-09-06"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.TaRRaK.yara#L1-L96"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a8c4c4a501d94da94ae4a2e1eb2846e841249659be64dd45f46584885d000635"
+		logic_hash = "v1_sha256_a8c4c4a501d94da94ae4a2e1eb2846e841249659be64dd45f46584885d000635"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -18795,20 +18795,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Tarrak : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($change_desktop) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $change_desktop ) and ( $drop_ransom_note )
 }
 rule REVERSINGLABS_Win32_Ransomware_Redeemer : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Redeemer ransomware."
 		author = "ReversingLabs"
-		id = "080ab595-862b-5dc2-aaff-a0efd819a9fa"
+		id = "af98af44-30d0-57f6-92d1-05bdae9e807f"
 		date = "2022-01-17"
 		modified = "2022-01-17"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Redeemer.yara#L1-L105"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "28287f6620a2f7a90057d1f97947e065721119e26398fe659331dc5fe99761de"
+		logic_hash = "v1_sha256_28287f6620a2f7a90057d1f97947e065721119e26398fe659331dc5fe99761de"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -18892,20 +18892,20 @@ rule REVERSINGLABS_Win32_Ransomware_Redeemer : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($modify_processes_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $modify_processes_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Koxic : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Koxic ransomware."
 		author = "ReversingLabs"
-		id = "73c4afb0-cfa8-5bc5-bca3-49a7710f4ab9"
+		id = "1b90094f-407f-58de-b956-a0c315d4ef95"
 		date = "2022-04-21"
 		modified = "2022-04-21"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Koxic.yara#L1-L87"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "739faf047b95fd538422a42943fcaad6538549bf4cf33ed91385c61365af4f09"
+		logic_hash = "v1_sha256_739faf047b95fd538422a42943fcaad6538549bf4cf33ed91385c61365af4f09"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -18972,20 +18972,20 @@ rule REVERSINGLABS_Win32_Ransomware_Koxic : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($enum_shares_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( all of ( $enum_shares_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Nefilim : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Nefilim ransomware."
 		author = "ReversingLabs"
-		id = "aec298c1-abf8-5446-9dbb-795f9fcf8e94"
+		id = "2c8eec2d-fa30-53d6-b90d-d130eb4cfa52"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Nefilim.yara#L1-L150"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fae0350e51aee2777475d2222848b30fd39fa39ceea260132b0c7fbc536b3a86"
+		logic_hash = "v1_sha256_fae0350e51aee2777475d2222848b30fd39fa39ceea260132b0c7fbc536b3a86"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19108,20 +19108,20 @@ rule REVERSINGLABS_Win32_Ransomware_Nefilim : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_*)) and ($create_encryption_key) and ($encrypt_encryption_key) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_* ) ) and ( $create_encryption_key ) and ( $encrypt_encryption_key ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Paradise : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Paradise ransomware."
 		author = "ReversingLabs"
-		id = "9a92a05c-5f26-59ed-9934-a24bb7c31d8d"
+		id = "eaed8348-f339-5336-84c9-ea106cb4a722"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Paradise.yara#L1-L81"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fc029bee999ec72416ac91d8386d4d270070035ad078bcab1dec11eea032c10b"
+		logic_hash = "v1_sha256_fc029bee999ec72416ac91d8386d4d270070035ad078bcab1dec11eea032c10b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19191,20 +19191,20 @@ rule REVERSINGLABS_Win32_Ransomware_Paradise : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_files and $http_remote_connection and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and $search_files and $http_remote_connection and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Revil : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Revil ransomware."
 		author = "ReversingLabs"
-		id = "67c2f49e-b9dc-5900-a89d-49ba41088ac3"
+		id = "ae170044-52fd-5494-8f4e-871e7b536a2b"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Revil.yara#L1-L101"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "24a79477eb797d7a7121d1248ebbece833ccd256de55729ff96084135ce8d426"
+		logic_hash = "v1_sha256_24a79477eb797d7a7121d1248ebbece833ccd256de55729ff96084135ce8d426"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19282,20 +19282,20 @@ rule REVERSINGLABS_Win32_Ransomware_Revil : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($search_files) and ($encrypt_files) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $enum_resources ) and ( $search_files ) and ( $encrypt_files ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Killdisk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects KillDisk ransomware."
 		author = "ReversingLabs"
-		id = "bd04ac88-987a-58f0-8f0a-508662b3c930"
+		id = "3ea3a2c4-c5b1-56c2-b6c9-fdc383b96a9f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.KillDisk.yara#L1-L80"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6148e6fc1363ff8995a9100e07139bfa658c72892db4d30a973bad0f2b3e6c3f"
+		logic_hash = "v1_sha256_6148e6fc1363ff8995a9100e07139bfa658c72892db4d30a973bad0f2b3e6c3f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19365,20 +19365,20 @@ rule REVERSINGLABS_Win32_Ransomware_Killdisk : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_files and $app_whitelisting_1 and $app_whitelisting_2
+		uint16( 0 ) == 0x5A4D and $encrypt_files and $app_whitelisting_1 and $app_whitelisting_2
 }
 rule REVERSINGLABS_Win32_Ransomware_Makop : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Makop ransomware."
 		author = "ReversingLabs"
-		id = "9b7d42f3-0417-5228-8b25-244224cbc414"
+		id = "aa48c700-4ae7-5e21-98a4-554d80bb6d5a"
 		date = "2020-10-30"
 		modified = "2020-10-30"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Makop.yara#L1-L99"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0ff4739d32b4a775d07a5f22d551ed67025681d4986e4404c9a01ad4078468f3"
+		logic_hash = "v1_sha256_0ff4739d32b4a775d07a5f22d551ed67025681d4986e4404c9a01ad4078468f3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19457,20 +19457,20 @@ rule REVERSINGLABS_Win32_Ransomware_Makop : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_network_resources) and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $enum_network_resources ) and ( all of ( $find_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Goodwill : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GoodWill ransomware."
 		author = "ReversingLabs"
-		id = "66358802-450b-5276-8088-b3550519b1e8"
+		id = "d1687ecf-5483-50e8-895a-d2e0aac14de6"
 		date = "2022-06-28"
 		modified = "2022-06-28"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.GoodWill.yara#L1-L89"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "94e2950f415ba737fe5ca9d32a3d850dd5744e547c4ca094ad28545e19033cb2"
+		logic_hash = "v1_sha256_94e2950f415ba737fe5ca9d32a3d850dd5744e547c4ca094ad28545e19033cb2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19535,20 +19535,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Goodwill : TC_DETECTION MALICIOUS MA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_file) and ($aes_encrypt) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $encrypt_file ) and ( $aes_encrypt ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Prometey : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Prometey ransomware."
 		author = "ReversingLabs"
-		id = "a5902fc6-2752-520f-be84-df9ea7b1e27d"
+		id = "e817c47a-ece1-5859-b34e-90f03b91645a"
 		date = "2021-06-07"
 		modified = "2021-06-07"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Prometey.yara#L1-L156"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f14c9605e2d375176b461fd396be66754b0ace7dcaada8ca33ad86f6eda10b73"
+		logic_hash = "v1_sha256_f14c9605e2d375176b461fd396be66754b0ace7dcaada8ca33ad86f6eda10b73"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19681,7 +19681,7 @@ rule REVERSINGLABS_Win32_Ransomware_Prometey : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $encrypt_files ) and ( all of ( $remote_connection_p* ) )
 }
 import "pe"
 
@@ -19690,13 +19690,13 @@ rule REVERSINGLABS_Win32_Ransomware_Cryptolocker : TC_DETECTION MALICIOUS MALWAR
 	meta:
 		description = "Yara rule that detects CryptoLocker ransomware."
 		author = "ReversingLabs"
-		id = "8cc3ac4b-9179-5e2c-97e1-65304f9dfe22"
+		id = "81baddbc-6483-549f-a924-b93f80bdd855"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.CryptoLocker.yara#L3-L154"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "08430b0c5689840d592bdda5dbc2ed06e0d0fa1e2c0f19aff4316580c6a0b23d"
+		logic_hash = "v1_sha256_08430b0c5689840d592bdda5dbc2ed06e0d0fa1e2c0f19aff4316580c6a0b23d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19823,20 +19823,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cryptolocker : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($file_loop_1 and $encrypt_data_1 and $decrypt_data_1 and $decrypt_strings_1 and $decrypt_1) or ($file_loop_2 and $encrypt_data_2 and $decrypt_data_2 and $decrypt_strings_2 and $decrypt_2) or ($file_loop_3 and $encrypt_data_3 and $decrypt_data_3 and $decrypt_3)) and ($entrypoint_all at pe.entry_point))
+		uint16( 0 ) == 0x5A4D and ( ( ( $file_loop_1 and $encrypt_data_1 and $decrypt_data_1 and $decrypt_strings_1 and $decrypt_1 ) or ( $file_loop_2 and $encrypt_data_2 and $decrypt_data_2 and $decrypt_strings_2 and $decrypt_2 ) or ( $file_loop_3 and $encrypt_data_3 and $decrypt_data_3 and $decrypt_3 ) ) and ( $entrypoint_all at pe.entry_point ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Nanolocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects NanoLocker ransomware."
 		author = "ReversingLabs"
-		id = "a31dad2e-2738-527b-a6e9-322757e2ec30"
+		id = "ea1f8987-3112-507e-8e4e-84b2f3d8a187"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.NanoLocker.yara#L1-L79"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7fdb021f22d97bf8a00fd856ef913695a0d6fbaad1138b5a5cc2cc8768b130be"
+		logic_hash = "v1_sha256_7fdb021f22d97bf8a00fd856ef913695a0d6fbaad1138b5a5cc2cc8768b130be"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19903,20 +19903,20 @@ rule REVERSINGLABS_Win32_Ransomware_Nanolocker : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_file_1 and $encrypt_file_2 and $remote_server_1 and $remote_server_2 and $enum_shares_and_encrypt_files
+		uint16( 0 ) == 0x5A4D and $encrypt_file_1 and $encrypt_file_2 and $remote_server_1 and $remote_server_2 and $enum_shares_and_encrypt_files
 }
 rule REVERSINGLABS_Win32_Ransomware_Alcatraz : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Alcatraz ransomware."
 		author = "ReversingLabs"
-		id = "7ff37483-ae63-5c82-a355-81ef68e2f663"
+		id = "1703e33f-493a-5921-9487-392b67b089ca"
 		date = "2020-07-28"
 		modified = "2020-07-28"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Alcatraz.yara#L1-L91"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ddd35c8da0c08bce17cacfba8bb8a8b8a8c08c3e59261a88a79c63b03d29000f"
+		logic_hash = "v1_sha256_ddd35c8da0c08bce17cacfba8bb8a8b8a8c08c3e59261a88a79c63b03d29000f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -19997,7 +19997,7 @@ rule REVERSINGLABS_Win32_Ransomware_Alcatraz : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_files and $remote_server and $remote_server_2
+		uint16( 0 ) == 0x5A4D and $encrypt_files and $remote_server and $remote_server_2
 }
 import "pe"
 
@@ -20006,13 +20006,13 @@ rule REVERSINGLABS_Win32_Ransomware_Bitcrypt : TC_DETECTION MALICIOUS MALWARE FI
 	meta:
 		description = "Yara rule that detects BitCrypt ransomware."
 		author = "ReversingLabs"
-		id = "f00a0fd8-31a9-5ee6-b560-09ccf6fe490b"
+		id = "ced7d4d8-cbf5-5bb5-9f9f-6e41a183630e"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BitCrypt.yara#L3-L112"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "66cfe16a182e7f20d6358be9569ada5e6c36c94d44781d8c741638e1b174d44e"
+		logic_hash = "v1_sha256_66cfe16a182e7f20d6358be9569ada5e6c36c94d44781d8c741638e1b174d44e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -20106,20 +20106,20 @@ rule REVERSINGLABS_Win32_Ransomware_Bitcrypt : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($bc_main_1 at pe.entry_point) and $bc_main_2 and $bc_main2 and $bc_bcdedit and $bc_enum_drives_a_z and $bc_do_extensions_1 and $bc_do_extensions_2 and $bc_do_files_1 and $bc_do_files_2
+		uint16( 0 ) == 0x5A4D and ( $bc_main_1 at pe.entry_point ) and $bc_main_2 and $bc_main2 and $bc_bcdedit and $bc_enum_drives_a_z and $bc_do_extensions_1 and $bc_do_extensions_2 and $bc_do_files_1 and $bc_do_files_2
 }
 rule REVERSINGLABS_Win32_Ransomware_Lockbit : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects LockBit ransomware."
 		author = "ReversingLabs"
-		id = "9a6405dc-da1f-5426-a424-a73bceb1928c"
+		id = "c51b16bb-3e7b-56a6-ab9c-83e6ea0f782d"
 		date = "2022-03-31"
 		modified = "2022-03-31"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.LockBit.yara#L1-L282"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "030222bd659c7e0e03858fa062067b1483aca3b7973cce19a1e7cdbb48d4405c"
+		logic_hash = "v1_sha256_030222bd659c7e0e03858fa062067b1483aca3b7973cce19a1e7cdbb48d4405c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -20349,20 +20349,20 @@ rule REVERSINGLABS_Win32_Ransomware_Lockbit : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($enum_resources_v1) and ( all of ($find_files_v1_*)) and ( all of ($encrypt_files_v1_*))) or (($check_blacklisted_languages_v2) and ($fnv1a_hashing_v2) and ($create_net_host_trav_threads_v2) and ( all of ($decrypt_configuration_v2_*)) and ( all of ($encrypt_files_v2_p*))))
+		uint16( 0 ) == 0x5A4D and ( ( ( $enum_resources_v1 ) and ( all of ( $find_files_v1_* ) ) and ( all of ( $encrypt_files_v1_* ) ) ) or ( ( $check_blacklisted_languages_v2 ) and ( $fnv1a_hashing_v2 ) and ( $create_net_host_trav_threads_v2 ) and ( all of ( $decrypt_configuration_v2_* ) ) and ( all of ( $encrypt_files_v2_p* ) ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Sevensevenseven : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects SevenSevenSeven ransomware."
 		author = "ReversingLabs"
-		id = "049531bd-9505-5da1-9512-980383c8c5ec"
+		id = "30629ea0-ba08-5455-b408-2a5077212cf6"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.SevenSevenSeven.yara#L1-L148"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "583a8ac746cd749bd3927f10c864a3ac84f82f8bbd8d0ebf117e22b016d7ca94"
+		logic_hash = "v1_sha256_583a8ac746cd749bd3927f10c864a3ac84f82f8bbd8d0ebf117e22b016d7ca94"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -20474,20 +20474,20 @@ rule REVERSINGLABS_Win32_Ransomware_Sevensevenseven : TC_DETECTION MALICIOUS MAL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($file_search_p*)) and ((($encrypt_file_1) and ($remote_server_1)) or (($encrypt_file_2) and ($remote_server_2)))
+		uint16( 0 ) == 0x5A4D and ( all of ( $file_search_p* ) ) and ( ( ( $encrypt_file_1 ) and ( $remote_server_1 ) ) or ( ( $encrypt_file_2 ) and ( $remote_server_2 ) ) )
 }
 rule REVERSINGLABS_Linux_Ransomware_Gwisinlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GwisinLocker ransomware."
 		author = "ReversingLabs"
-		id = "9f00e1b4-3692-5824-b614-724073532c1f"
+		id = "e8e7151a-bc99-5280-8791-13ec0c052a4c"
 		date = "2022-10-11"
 		modified = "2022-10-11"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Linux.Ransomware.GwisinLocker.yara#L1-L354"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c23c0b73bbefbd644ffe1398e1f14eec3a89945cb3c3ccbc6f46c57046b53505"
+		logic_hash = "v1_sha256_c23c0b73bbefbd644ffe1398e1f14eec3a89945cb3c3ccbc6f46c57046b53505"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -20783,20 +20783,20 @@ rule REVERSINGLABS_Linux_Ransomware_Gwisinlocker : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint32(0)==0x464C457F and ((( all of ($find_files_v1_p*)) and ( all of ($kill_processes_v1_p*)) and ($init_key_v1) and ( all of ($encrypt_files_v1_p*)) and ($shut_down_esxi_v1)) or (( all of ($find_files_v2_p*)) and ( all of ($kill_processes_v2_p*)) and ($init_key_v2) and ( all of ($encrypt_files_v2_p*))))
+		uint32( 0 ) == 0x464C457F and ( ( ( all of ( $find_files_v1_p* ) ) and ( all of ( $kill_processes_v1_p* ) ) and ( $init_key_v1 ) and ( all of ( $encrypt_files_v1_p* ) ) and ( $shut_down_esxi_v1 ) ) or ( ( all of ( $find_files_v2_p* ) ) and ( all of ( $kill_processes_v2_p* ) ) and ( $init_key_v2 ) and ( all of ( $encrypt_files_v2_p* ) ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Cicada3301 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Cicada3301 ransomware."
 		author = "ReversingLabs"
-		id = "c1a60870-0b68-5f2f-a74f-34e493a5e251"
+		id = "65af6436-83c2-5d93-b08b-bd067ed78f8d"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Cicada3301.yara#L1-L309"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9479667fd4c7f865607ece6af985ab6fa7b62f98738c338e4155059551db8a21"
+		logic_hash = "v1_sha256_9479667fd4c7f865607ece6af985ab6fa7b62f98738c338e4155059551db8a21"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -21066,20 +21066,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cicada3301 : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($collect_files_recursively_p*)) and ($get_valid_drives) and ((( all of ($encrypt_files_full_v1_p*))) or (( all of ($encrypt_files_full_v2_p*))))
+		uint16( 0 ) == 0x5A4D and ( all of ( $collect_files_recursively_p* ) ) and ( $get_valid_drives ) and ( ( ( all of ( $encrypt_files_full_v1_p* ) ) ) or ( ( all of ( $encrypt_files_full_v2_p* ) ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Teslarvng : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Teslarvng ransomware."
 		author = "ReversingLabs"
-		id = "7045b13e-95a5-54da-b540-75d464e7673d"
+		id = "060b098c-64fb-5f81-8311-4474be306bf9"
 		date = "2020-12-14"
 		modified = "2020-12-14"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Teslarvng.yara#L1-L137"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "670621aa196a80fbb694e4b1690d7da60e881c5b826133939e61cd6c2406ea98"
+		logic_hash = "v1_sha256_670621aa196a80fbb694e4b1690d7da60e881c5b826133939e61cd6c2406ea98"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -21194,20 +21194,20 @@ rule REVERSINGLABS_Win32_Ransomware_Teslarvng : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_shares_p*)) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $enum_shares_p* ) ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_FCT : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects FCT ransomware."
 		author = "ReversingLabs"
-		id = "ea3d5514-d6f2-5fd0-9247-a3f6b920d8d9"
+		id = "d50f50ce-42e7-5532-9606-236d3b6823d5"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.FCT.yara#L1-L86"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b158ad56c92a926f7398a27b3576c259e39c9716ef192fa5944ce3cffdc6d7d0"
+		logic_hash = "v1_sha256_b158ad56c92a926f7398a27b3576c259e39c9716ef192fa5944ce3cffdc6d7d0"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -21276,20 +21276,20 @@ rule REVERSINGLABS_Win32_Ransomware_FCT : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Hydracrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects HydraCrypt ransomware."
 		author = "ReversingLabs"
-		id = "2e780f7c-8d6d-51c8-b65e-330cc3b17bb7"
+		id = "4a24ea1f-08f8-594f-93c6-c03cc0213d04"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.HydraCrypt.yara#L1-L174"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "910a6f23f06cecb8d3115ebfed42a66412dbd0d3a519e39f21df81b0c2028f48"
+		logic_hash = "v1_sha256_910a6f23f06cecb8d3115ebfed42a66412dbd0d3a519e39f21df81b0c2028f48"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -21432,20 +21432,20 @@ rule REVERSINGLABS_Win32_Ransomware_Hydracrypt : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($encrypt_files_1 and $remote_connection_1 and $remote_connection_2 and $remote_connection_3) or ($encrypt_files_2 and $encrypt_files_3 and $encrypt_files_4 and $remote_connection_4 and $remote_connection_5))
+		uint16( 0 ) == 0x5A4D and ( ( $encrypt_files_1 and $remote_connection_1 and $remote_connection_2 and $remote_connection_3 ) or ( $encrypt_files_2 and $encrypt_files_3 and $encrypt_files_4 and $remote_connection_4 and $remote_connection_5 ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Xorist : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Xorist ransomware."
 		author = "ReversingLabs"
-		id = "804ae039-fc3b-5f19-860e-df9efe87ee4d"
+		id = "4c1710ed-be11-5d31-b0dc-01c41e23c5b9"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Xorist.yara#L1-L150"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c428838cdd103f62508a23c9333b08567625291e110aa437324ecf37c62dca36"
+		logic_hash = "v1_sha256_c428838cdd103f62508a23c9333b08567625291e110aa437324ecf37c62dca36"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -21565,20 +21565,20 @@ rule REVERSINGLABS_Win32_Ransomware_Xorist : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($extract_rsrc_v1) and ( all of ($search_and_encrypt_v1_p*))) or (($extract_rsrc_v2) and ( all of ($search_and_encrypt_v2_p*)))
+		uint16( 0 ) == 0x5A4D and ( ( $extract_rsrc_v1 ) and ( all of ( $search_and_encrypt_v1_p* ) ) ) or ( ( $extract_rsrc_v2 ) and ( all of ( $search_and_encrypt_v2_p* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Nemty : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Nemty ransomware."
 		author = "ReversingLabs"
-		id = "c56ecd32-5903-5bcc-aa69-a070f2c247c4"
+		id = "da3216eb-b3bd-5656-976b-6e7cd21cfcdb"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Nemty.yara#L1-L205"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dc8cfdcdea8ecb2018b1b04bb1b645f6dbdc6c07357719100677c75945edef40"
+		logic_hash = "v1_sha256_dc8cfdcdea8ecb2018b1b04bb1b645f6dbdc6c07357719100677c75945edef40"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -21750,20 +21750,20 @@ rule REVERSINGLABS_Win32_Ransomware_Nemty : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_1_p*)) and ( all of ($find_files_2_p*)) and ( all of ($enum_resources_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_1_p* ) ) and ( all of ( $find_files_2_p* ) ) and ( all of ( $enum_resources_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Notpetya : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects NotPetya ransomware."
 		author = "ReversingLabs"
-		id = "ea655048-4ef7-5dd7-872e-f1c2e38234cf"
+		id = "61a218f3-1c98-5204-af76-34dede62cfbb"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.NotPetya.yara#L1-L73"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "328f0e527fee2145879ee13c003d375db832f7f3eacf7a1eb303393c1c8b5a36"
+		logic_hash = "v1_sha256_328f0e527fee2145879ee13c003d375db832f7f3eacf7a1eb303393c1c8b5a36"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -21824,20 +21824,20 @@ rule REVERSINGLABS_Win32_Ransomware_Notpetya : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_file and $main and $encryption_loop and $shutdown
+		uint16( 0 ) == 0x5A4D and $encrypt_file and $main and $encryption_loop and $shutdown
 }
 rule REVERSINGLABS_Win32_Ransomware_Jsworm : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects JSWorm ransomware."
 		author = "ReversingLabs"
-		id = "a4702cc3-1e08-5631-b832-5d28cb92a819"
+		id = "ccdfa97c-ca84-5741-b00f-26cb9b2b4ee3"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.JSWorm.yara#L1-L93"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8ba5e2f29f5f06e6e6714bbba1129862da8c3a83bf7f296818eddee2593cae38"
+		logic_hash = "v1_sha256_8ba5e2f29f5f06e6e6714bbba1129862da8c3a83bf7f296818eddee2593cae38"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -21918,20 +21918,20 @@ rule REVERSINGLABS_Win32_Ransomware_Jsworm : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $find_drives and $find_files and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and $find_drives and $find_files and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Babuk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Babuk ransomware."
 		author = "ReversingLabs"
-		id = "8a96f400-193f-5fd1-ba03-4da464345e1c"
+		id = "74ae99f1-4046-504f-adfb-e11775adb15e"
 		date = "2021-01-26"
 		modified = "2021-01-26"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Babuk.yara#L1-L117"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "70327b3f9d0b0505ade7ee6de6d7facf56820c7e8477bd172f738f374311144f"
+		logic_hash = "v1_sha256_70327b3f9d0b0505ade7ee6de6d7facf56820c7e8477bd172f738f374311144f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22027,20 +22027,20 @@ rule REVERSINGLABS_Win32_Ransomware_Babuk : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($enum_resources)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( $enum_resources )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Invert : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Invert ransomware."
 		author = "ReversingLabs"
-		id = "7ef77946-a902-5dc6-9b3c-b7b6a687eb96"
+		id = "4b14fa6d-14bd-5e50-8c95-94f5f3ed262c"
 		date = "2021-11-11"
 		modified = "2021-11-11"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Invert.yara#L1-L66"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1608b8bbfc03b18a79752e60f211da7d7703862bc06b2ddf094074ae5efd0d14"
+		logic_hash = "v1_sha256_1608b8bbfc03b18a79752e60f211da7d7703862bc06b2ddf094074ae5efd0d14"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22087,20 +22087,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Invert : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($get_file_list) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $get_file_list ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Jormungand : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Jormungand ransomware."
 		author = "ReversingLabs"
-		id = "418c3d9f-2338-593f-a8ec-a1e25afa50d4"
+		id = "9299fd4c-e337-5c60-b685-b5cdf5ba6fa9"
 		date = "2021-10-22"
 		modified = "2021-10-22"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Jormungand.yara#L1-L135"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "049eb4533b37d8d72e50dd1e803a897758386643770d47b3e7690f58e44d5236"
+		logic_hash = "v1_sha256_049eb4533b37d8d72e50dd1e803a897758386643770d47b3e7690f58e44d5236"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22210,20 +22210,20 @@ rule REVERSINGLABS_Win32_Ransomware_Jormungand : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_*)) and ( all of ($remote_connection_p*)) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_* ) ) and ( all of ( $remote_connection_p* ) ) and ( $drop_ransom_note )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ragnarlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects RagnarLocker ransomware."
 		author = "ReversingLabs"
-		id = "3bc3765a-f1f8-59bc-bbe8-6821654b334f"
+		id = "69f546bd-78e1-50f7-880d-d7b3eadeb9fa"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.RagnarLocker.yara#L1-L108"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "398f0e5e003f87edf90cdea718be6b10470df317214d00db4dc6c4cccc5b6748"
+		logic_hash = "v1_sha256_398f0e5e003f87edf90cdea718be6b10470df317214d00db4dc6c4cccc5b6748"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22312,20 +22312,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ragnarlocker : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Erica : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Erica ransomware."
 		author = "ReversingLabs"
-		id = "38f57157-bd49-5a63-8c69-497eb9efe274"
+		id = "f556e8fd-4948-5cc3-ac3f-0b6209bde869"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Erica.yara#L1-L76"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "93512091943f3a3b395c38fa3b0f5ecdbbf1cdf967ccfea4d7145c940076e046"
+		logic_hash = "v1_sha256_93512091943f3a3b395c38fa3b0f5ecdbbf1cdf967ccfea4d7145c940076e046"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22385,20 +22385,20 @@ rule REVERSINGLABS_Win32_Ransomware_Erica : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_NB65 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects NB65 ransomware."
 		author = "ReversingLabs"
-		id = "1aba009e-8065-5fb0-98e7-a595cb324076"
+		id = "a239df8f-f3ea-587e-b35c-5ce8a0253115"
 		date = "2022-06-01"
 		modified = "2022-06-01"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.NB65.yara#L1-L68"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f8a0e265fc72a9f017b37ce4b6dbb878285a5d298ab1b8c69f9fde7159426981"
+		logic_hash = "v1_sha256_f8a0e265fc72a9f017b37ce4b6dbb878285a5d298ab1b8c69f9fde7159426981"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22447,20 +22447,20 @@ rule REVERSINGLABS_Win32_Ransomware_NB65 : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($enum_procs) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $enum_procs ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Juicylemon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects JuicyLemon ransomware."
 		author = "ReversingLabs"
-		id = "35e4bbd6-422b-562e-98fc-fe932270dbb8"
+		id = "4c0f3f01-29e4-5bba-8258-9fa9757800c0"
 		date = "2020-08-17"
 		modified = "2020-08-17"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.JuicyLemon.yara#L1-L116"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "596d89843793307f4940dbb85b2e7081f02250f6adfdcd01f2d3c5f2b8b90875"
+		logic_hash = "v1_sha256_596d89843793307f4940dbb85b2e7081f02250f6adfdcd01f2d3c5f2b8b90875"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22566,20 +22566,20 @@ rule REVERSINGLABS_Win32_Ransomware_Juicylemon : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files_and_encrypt and $remote_connection_1 and $remote_connection_2
+		uint16( 0 ) == 0x5A4D and $find_files_and_encrypt and $remote_connection_1 and $remote_connection_2
 }
 rule REVERSINGLABS_Win32_Ransomware_Crypren : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Crypren ransomware."
 		author = "ReversingLabs"
-		id = "9a6ff190-b26b-5b75-9103-95a3b2e80701"
+		id = "e19efa6c-afc4-53ea-b72a-9ec01f75290e"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Crypren.yara#L1-L144"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7047d48782762e42544063fde6f2be62eb19f22853ea84abb5bce67c962da172"
+		logic_hash = "v1_sha256_7047d48782762e42544063fde6f2be62eb19f22853ea84abb5bce67c962da172"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22698,20 +22698,20 @@ rule REVERSINGLABS_Win32_Ransomware_Crypren : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($enum_directories_p*)) and ( all of ($enum_drives_p*)) and ( all of ($encrypt_files_p*)))
+		uint16( 0 ) == 0x5A4D and ( ( all of ( $enum_directories_p* ) ) and ( all of ( $enum_drives_p* ) ) and ( all of ( $encrypt_files_p* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Mountlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects MountLocker ransomware."
 		author = "ReversingLabs"
-		id = "8ce7e5c4-9eca-5dd2-ab92-39b915900d72"
+		id = "463dedc6-95e7-5d3c-aa77-a91e7dbb5f7c"
 		date = "2021-03-25"
 		modified = "2021-03-25"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.MountLocker.yara#L1-L86"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d203217c229d54802e96e19dc66d38ecb0443d19e0492efe337df471a99559dc"
+		logic_hash = "v1_sha256_d203217c229d54802e96e19dc66d38ecb0443d19e0492efe337df471a99559dc"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22780,20 +22780,20 @@ rule REVERSINGLABS_Win32_Ransomware_Mountlocker : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Vhdlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects VHDLocker ransomware."
 		author = "ReversingLabs"
-		id = "696f8145-342b-5da5-b9ec-6f0d16afc465"
+		id = "33ecee3f-b31f-5b96-bb66-178f11643df4"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.VHDLocker.yara#L1-L152"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "39d1fbfc79d5ea866498bb1e40d2290469df774ce65b1da04a85c0e4e5b4493c"
+		logic_hash = "v1_sha256_39d1fbfc79d5ea866498bb1e40d2290469df774ce65b1da04a85c0e4e5b4493c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -22922,20 +22922,20 @@ rule REVERSINGLABS_Win32_Ransomware_Vhdlocker : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($get_logical_drives_list_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $get_logical_drives_list_p* ) ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Wildfire : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects WildFire ransomware."
 		author = "ReversingLabs"
-		id = "0c44f017-703c-5db7-b777-62fcd181af9a"
+		id = "1df2a243-2ba1-5198-8da8-0d6dc31d8621"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.WildFire.yara#L1-L77"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d3be2eac7967853aae6e1317d9c22d95a3dc4b3e5bf8acbe97a7bbeabc9eab38"
+		logic_hash = "v1_sha256_d3be2eac7967853aae6e1317d9c22d95a3dc4b3e5bf8acbe97a7bbeabc9eab38"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -23001,20 +23001,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Wildfire : TC_DETECTION MALICIOUS MA
         }
 
 	condition:
-		uint16(0)==0x5A4D and $enum_drives and $file_search and $encrypt_files and $remote_server_communication_1
+		uint16( 0 ) == 0x5A4D and $enum_drives and $file_search and $encrypt_files and $remote_server_communication_1
 }
 rule REVERSINGLABS_Win32_Ransomware_Fuxsocy : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects FuxSocy ransomware."
 		author = "ReversingLabs"
-		id = "f4a45469-9d51-523f-8238-c7044f353cf6"
+		id = "04f68f21-3158-5248-a160-5b66bd75befc"
 		date = "2021-03-01"
 		modified = "2021-03-01"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.FuxSocy.yara#L1-L114"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8b3c04eb5d60fcc82e47cb8e78da0a98642666546d6799baef24b56926e3aceb"
+		logic_hash = "v1_sha256_8b3c04eb5d60fcc82e47cb8e78da0a98642666546d6799baef24b56926e3aceb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -23110,20 +23110,20 @@ rule REVERSINGLABS_Win32_Ransomware_Fuxsocy : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_*)) and ( all of ($encrypt_files_*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_* ) ) and ( all of ( $encrypt_files_* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Major : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Major ransomware."
 		author = "ReversingLabs"
-		id = "0c85aff8-1fb5-5e47-ae49-72445a000eaa"
+		id = "76b0e4bc-47c2-586f-9bb5-88996b6be84e"
 		date = "2021-01-26"
 		modified = "2021-01-26"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Major.yara#L1-L261"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "16fb7763e3806fca6937fef7e8b3d8bccd61cb39549061d359d630c7d266c270"
+		logic_hash = "v1_sha256_16fb7763e3806fca6937fef7e8b3d8bccd61cb39549061d359d630c7d266c270"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -23357,20 +23357,20 @@ rule REVERSINGLABS_Win32_Ransomware_Major : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and $remote_connection)
+		uint16( 0 ) == 0x5A4D and ( ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Blackcat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BlackCat ransomware."
 		author = "ReversingLabs"
-		id = "e623340d-8df8-5f13-b75f-379bd0038f64"
+		id = "145b65fa-267e-58be-9e65-0b63f07b686c"
 		date = "2022-02-14"
 		modified = "2022-02-14"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BlackCat.yara#L1-L109"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "24932baa625aedd14b5776ba3209c9ee330e84538c5267eeb5e09e352f655835"
+		logic_hash = "v1_sha256_24932baa625aedd14b5776ba3209c9ee330e84538c5267eeb5e09e352f655835"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -23454,20 +23454,20 @@ rule REVERSINGLABS_Win32_Ransomware_Blackcat : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_procs) and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_procs ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Matsnu : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Matsnu ransomware."
 		author = "ReversingLabs"
-		id = "2f0bddd5-bd48-5d38-84f4-2dbccbe04a46"
+		id = "4f81e07e-2260-521c-a683-29d70e15556e"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Matsnu.yara#L1-L116"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "76ef1b4a292f27ccd904e80f0279a7a327f7399a21f2266ef3ea959e5339ffac"
+		logic_hash = "v1_sha256_76ef1b4a292f27ccd904e80f0279a7a327f7399a21f2266ef3ea959e5339ffac"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -23571,20 +23571,20 @@ rule REVERSINGLABS_Win32_Ransomware_Matsnu : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $enum_files_1 and $enum_files_2 and $crypto_file and $crypt_file and $remote_connection
+		uint16( 0 ) == 0x5A4D and $enum_files_1 and $enum_files_2 and $crypto_file and $crypt_file and $remote_connection
 }
 rule REVERSINGLABS_Win32_Ransomware_Buran : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Buran ransomware."
 		author = "ReversingLabs"
-		id = "c2a36a8b-5c21-5c31-994d-b424c038dd21"
+		id = "74865ff1-dcf3-5571-94b1-e9019d1a1fd7"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Buran.yara#L1-L91"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5606e0acecd99ccf2feaa995353211302903a09bb2c4ec65903566215e2d5ca4"
+		logic_hash = "v1_sha256_5606e0acecd99ccf2feaa995353211302903a09bb2c4ec65903566215e2d5ca4"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -23655,20 +23655,20 @@ rule REVERSINGLABS_Win32_Ransomware_Buran : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Spora : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Spora ransomware."
 		author = "ReversingLabs"
-		id = "f07ee1d4-d99b-5cbf-a1f0-a3802d9e3b47"
+		id = "2c01082a-d96f-5816-b00c-0cab015a270b"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Spora.yara#L1-L124"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4e18bb42277ce9194bf75fa45d95ea7e2bd51c5d7791d3d6e013fc07626e65b0"
+		logic_hash = "v1_sha256_4e18bb42277ce9194bf75fa45d95ea7e2bd51c5d7791d3d6e013fc07626e65b0"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -23778,20 +23778,20 @@ rule REVERSINGLABS_Win32_Ransomware_Spora : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($create_key_file and $create_lst_file and $enumerate_resources and $encrypt_files) or ($create_key and $enumerate_resources and $encrypt_files))
+		uint16( 0 ) == 0x5A4D and ( ( $create_key_file and $create_lst_file and $enumerate_resources and $encrypt_files ) or ( $create_key and $enumerate_resources and $encrypt_files ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_IFN643 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects IFN643 ransomware."
 		author = "ReversingLabs"
-		id = "a4d211a7-6735-541e-885d-555bbc11e2cf"
+		id = "713e6789-9353-57c2-ae66-8a9e3dbb5fbc"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.IFN643.yara#L1-L90"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ced234018f1f05601dd3be55eaecd2a1e116ad0b7bb9e0292434f11f19916ebe"
+		logic_hash = "v1_sha256_ced234018f1f05601dd3be55eaecd2a1e116ad0b7bb9e0292434f11f19916ebe"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -23870,20 +23870,20 @@ rule REVERSINGLABS_Win32_Ransomware_IFN643 : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_files_1 and $search_files_2 and $encrypt_files
+		uint16( 0 ) == 0x5A4D and $search_files_1 and $search_files_2 and $encrypt_files
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Venom : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Venom ransomware."
 		author = "ReversingLabs"
-		id = "72149ec2-888e-5bed-baf1-0ec44e48328e"
+		id = "e6d9fcb4-2483-5517-9582-116d435bfc82"
 		date = "2022-06-06"
 		modified = "2022-06-06"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Venom.yara#L1-L68"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5817ece6a1cc304835f7fc243c4cfdc3c7cacd2251a9ac294a6662b58d2552e8"
+		logic_hash = "v1_sha256_5817ece6a1cc304835f7fc243c4cfdc3c7cacd2251a9ac294a6662b58d2552e8"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -23932,20 +23932,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Venom : TC_DETECTION MALICIOUS MALWA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $setup_env ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win64_Ransomware_Ako : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ako ransomware."
 		author = "ReversingLabs"
-		id = "fce98a6a-f7bd-52ee-a2b8-31b48f6134ca"
+		id = "6c33e546-a1f6-56bb-8d3e-a7ae355c86e3"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Ako.yara#L1-L173"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8321a4ace66ae48e3a6896daf02c184fa7767fa6bd10cd83b322ad01698008cf"
+		logic_hash = "v1_sha256_8321a4ace66ae48e3a6896daf02c184fa7767fa6bd10cd83b322ad01698008cf"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -24095,20 +24095,20 @@ rule REVERSINGLABS_Win64_Ransomware_Ako : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files_win64) and ( all of ($encrypt_files_win64_p*)) and ( all of ($encrypt_network_shares_win64_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files_win64 ) and ( all of ( $encrypt_files_win64_p* ) ) and ( all of ( $encrypt_network_shares_win64_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Chupacabra : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects ChupaCabra ransomware."
 		author = "ReversingLabs"
-		id = "e44a101d-53c3-51f2-84ca-f6a5858c169b"
+		id = "baf9bd45-3e5b-5dde-8908-6e0c91323154"
 		date = "2021-10-12"
 		modified = "2021-10-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.ChupaCabra.yara#L1-L90"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7f247778e0bd8057670abf42b2d1011ebae891ffcb21ebad50060f9a7986bf93"
+		logic_hash = "v1_sha256_7f247778e0bd8057670abf42b2d1011ebae891ffcb21ebad50060f9a7986bf93"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -24177,20 +24177,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Chupacabra : TC_DETECTION MALICIOUS
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $drop_ransom_note )
 }
 rule REVERSINGLABS_Win32_Ransomware_Cybervolk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects CyberVolk ransomware."
 		author = "ReversingLabs"
-		id = "4d8bf096-d5c9-5a77-99e6-2c66e480da36"
+		id = "bd76fc9e-c52f-5be3-be3e-db6321f20734"
 		date = "2024-11-27"
 		modified = "2024-11-27"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.CyberVolk.yara#L1-L293"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "59ed7c4f576fa7cd4cceb724d14f258598c140e434ed309fe2e599c3aaa667d9"
+		logic_hash = "v1_sha256_59ed7c4f576fa7cd4cceb724d14f258598c140e434ed309fe2e599c3aaa667d9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -24443,20 +24443,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cybervolk : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($manage_gui_p*)) and ((( all of ($find_files_v1_p*)) and ( all of ($encrypt_files_v1_p*))) or (( all of ($find_files_v2_p*)) and ( all of ($encrypt_files_v2_p*))))
+		uint16( 0 ) == 0x5A4D and ( all of ( $manage_gui_p* ) ) and ( ( ( all of ( $find_files_v1_p* ) ) and ( all of ( $encrypt_files_v1_p* ) ) ) or ( ( all of ( $find_files_v2_p* ) ) and ( all of ( $encrypt_files_v2_p* ) ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Mafia : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Mafia ransomware."
 		author = "ReversingLabs"
-		id = "67f09000-751f-539a-b222-25b1502c2728"
+		id = "c1408b50-2233-5a66-a081-aed696fb99dd"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Mafia.yara#L1-L142"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5c17b799f0b4f1f8f72a2e4203a6606f7783ceec2034694f8a21ff65e5afdb26"
+		logic_hash = "v1_sha256_5c17b799f0b4f1f8f72a2e4203a6606f7783ceec2034694f8a21ff65e5afdb26"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -24575,20 +24575,20 @@ rule REVERSINGLABS_Win32_Ransomware_Mafia : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Vovalex : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Vovalex ransomware."
 		author = "ReversingLabs"
-		id = "dd4d7969-1afc-5e5d-9324-89f432523173"
+		id = "06cfa4bf-a8d6-5945-a822-71fbba681ce2"
 		date = "2021-03-12"
 		modified = "2021-03-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Vovalex.yara#L1-L81"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0c0f065224988bcba45b5aba2dceb080479b0bab235d544daabc3cae72e48318"
+		logic_hash = "v1_sha256_0c0f065224988bcba45b5aba2dceb080479b0bab235d544daabc3cae72e48318"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -24653,20 +24653,20 @@ rule REVERSINGLABS_Win64_Ransomware_Vovalex : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Dogecrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects DogeCrypt ransomware."
 		author = "ReversingLabs"
-		id = "e0ca22a5-70bb-5d2c-bce4-bac49c2a81d2"
+		id = "02134ccd-416a-5fd0-801d-4edea616554c"
 		date = "2021-04-28"
 		modified = "2021-04-28"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.DogeCrypt.yara#L1-L114"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1c19862884cf1e59d12c84f5ff6f799a4087ddc8bd887e0d2ce7da053642b851"
+		logic_hash = "v1_sha256_1c19862884cf1e59d12c84f5ff6f799a4087ddc8bd887e0d2ce7da053642b851"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -24760,20 +24760,20 @@ rule REVERSINGLABS_Win32_Ransomware_Dogecrypt : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($decrypt_DesucryptKeyContainer_DogeCrypt) and ($find_files_DogeCrypt) and ( all of ($encrypt_files_DogeCrypt_p*))
+		uint16( 0 ) == 0x5A4D and ( $decrypt_DesucryptKeyContainer_DogeCrypt ) and ( $find_files_DogeCrypt ) and ( all of ( $encrypt_files_DogeCrypt_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Cryptofortress : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects CryptoFortress ransomware."
 		author = "ReversingLabs"
-		id = "460289b1-f775-5e0b-8c44-4f6e5c92da60"
+		id = "34f8c19c-2ce3-53f0-ae30-64d0fcc3660c"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.CryptoFortress.yara#L1-L162"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "474893b63523de5ff9eb8a0c91b0677b99ce65056af7f5d02a73e43fa65453c9"
+		logic_hash = "v1_sha256_474893b63523de5ff9eb8a0c91b0677b99ce65056af7f5d02a73e43fa65453c9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -24908,20 +24908,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cryptofortress : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($read_config_file and $file_type_loop and $encrypt_routine) or ($enum_drives and $enum_shared_resources and $find_files and $encrypt_files))
+		uint16( 0 ) == 0x5A4D and ( ( $read_config_file and $file_type_loop and $encrypt_routine ) or ( $enum_drives and $enum_shared_resources and $find_files and $encrypt_files ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ferrlock : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ferrlock ransomware."
 		author = "ReversingLabs"
-		id = "745ce529-46d0-56ed-a8fa-b41b26b068f4"
+		id = "d2c00d5c-e9b0-57d6-9337-75c05da100b7"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Ferrlock.yara#L1-L131"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b94bc77489dbb74573813631009e605bc848e17995a0a512d08b194ee3020b75"
+		logic_hash = "v1_sha256_b94bc77489dbb74573813631009e605bc848e17995a0a512d08b194ee3020b75"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25026,20 +25026,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ferrlock : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_rsrc) and ( all of ($search_files_p*)) and ( all of ($create_test_file_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_rsrc ) and ( all of ( $search_files_p* ) ) and ( all of ( $create_test_file_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Antiwar : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects AntiWar ransomware."
 		author = "ReversingLabs"
-		id = "3113ec26-e149-527b-9478-4dd86c7fa464"
+		id = "695dff11-4454-5247-bdf0-58f2a4ece393"
 		date = "2022-04-21"
 		modified = "2022-04-21"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.AntiWar.yara#L1-L146"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2d885f35454aaf7cb33f03c30b6681aa16cbe8353003bbae0b1e9fdecb2ff8a7"
+		logic_hash = "v1_sha256_2d885f35454aaf7cb33f03c30b6681aa16cbe8353003bbae0b1e9fdecb2ff8a7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25160,20 +25160,20 @@ rule REVERSINGLABS_Win64_Ransomware_Antiwar : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($enum_shares))
+		uint16( 0 ) == 0x5A4D and ( ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $enum_shares ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Redroman : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects RedRoman ransomware."
 		author = "ReversingLabs"
-		id = "c860586a-fa50-5bb4-a3b4-13506f9d6030"
+		id = "0cc3a539-d201-58f3-b91d-ad0ebb6cd199"
 		date = "2021-05-10"
 		modified = "2021-05-10"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.RedRoman.yara#L1-L82"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6fb2ac0e7f7ac095766e27c057e5124406dc493c08d01a7e5381403d794c7240"
+		logic_hash = "v1_sha256_6fb2ac0e7f7ac095766e27c057e5124406dc493c08d01a7e5381403d794c7240"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25239,20 +25239,20 @@ rule REVERSINGLABS_Win64_Ransomware_Redroman : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Kangaroo : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Kangaroo ransomware."
 		author = "ReversingLabs"
-		id = "ec4342c1-adc9-5ddb-b403-83c2b1ce5899"
+		id = "6d04fc64-f4de-5d28-8c1c-932c771817c0"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Kangaroo.yara#L1-L91"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1078fb3d47ad737548419e5ee66e686f705c02fea27a58c0097446547325772c"
+		logic_hash = "v1_sha256_1078fb3d47ad737548419e5ee66e686f705c02fea27a58c0097446547325772c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25323,20 +25323,20 @@ rule REVERSINGLABS_Win32_Ransomware_Kangaroo : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($enum_resources)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( $enum_resources )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Povlsomware : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Povlsomware ransomware."
 		author = "ReversingLabs"
-		id = "317d7cca-4fe8-55ab-8f5f-e42be727ec26"
+		id = "013359d7-6904-5ac0-bf46-76b75bee6555"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Povlsomware.yara#L1-L64"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "465dc1b1d7e9eb3091f36efb51029cd3383d05ece054e814b18f379e58c7e457"
+		logic_hash = "v1_sha256_465dc1b1d7e9eb3091f36efb51029cd3383d05ece054e814b18f379e58c7e457"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25381,20 +25381,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Povlsomware : TC_DETECTION MALICIOUS
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_attack) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $setup_attack ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Blackbasta : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BlackBasta ransomware."
 		author = "ReversingLabs"
-		id = "7c451fde-b8b1-5a35-855e-7e30f3e75cbb"
+		id = "eb74273e-c6ac-5094-a012-afe5645ddeff"
 		date = "2022-12-13"
 		modified = "2022-12-13"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BlackBasta.yara#L1-L531"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c68671e51489af00e9e0cf28373e5ec01bda042653dbcca8843357eede41f27f"
+		logic_hash = "v1_sha256_c68671e51489af00e9e0cf28373e5ec01bda042653dbcca8843357eede41f27f"
 		score = 75
 		quality = 88
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25785,20 +25785,20 @@ rule REVERSINGLABS_Win32_Ransomware_Blackbasta : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($find_files) and ($encrypt_files_v1) and ($cmd_prompt) and ($exclude_from_encryption_v1)) or (($find_files) and ($cmd_prompt) and ($ldap_connect) and ($encrypt_files_v2) and ($exclude_from_encryption_v1)) or (($find_files) and ($cmd_prompt) and ($ldap_connect) and ($encrypt_files_v3) and ($exclude_from_encryption_v1)) or (($find_files) and ($encrypt_files_v4) and ($drop_ransom_note_v1) and ( all of ($exclude_from_encryption_v2_p*))) or (($find_files) and ($exclude_from_encryption_v1) and ( any of ($encrypt_files_v5)) and ( all of ($find_system_volumes_v2_p*))) or (( all of ($encrypt_files_v5_p*)) and ( all of ($set_default_icon_p*)) and ($find_system_volumes) and ( all of ($drop_ransom_note_v2_p*)) and ($find_files)) or (( all of ($encrypt_files_v6_p*)) and ( all of ($set_default_icon_p*)) and ( all of ($drop_ransom_note_v2_p*)) and ($find_files)))
+		uint16( 0 ) == 0x5A4D and ( ( ( $find_files ) and ( $encrypt_files_v1 ) and ( $cmd_prompt ) and ( $exclude_from_encryption_v1 ) ) or ( ( $find_files ) and ( $cmd_prompt ) and ( $ldap_connect ) and ( $encrypt_files_v2 ) and ( $exclude_from_encryption_v1 ) ) or ( ( $find_files ) and ( $cmd_prompt ) and ( $ldap_connect ) and ( $encrypt_files_v3 ) and ( $exclude_from_encryption_v1 ) ) or ( ( $find_files ) and ( $encrypt_files_v4 ) and ( $drop_ransom_note_v1 ) and ( all of ( $exclude_from_encryption_v2_p* ) ) ) or ( ( $find_files ) and ( $exclude_from_encryption_v1 ) and ( any of ( $encrypt_files_v5 ) ) and ( all of ( $find_system_volumes_v2_p* ) ) ) or ( ( all of ( $encrypt_files_v5_p* ) ) and ( all of ( $set_default_icon_p* ) ) and ( $find_system_volumes ) and ( all of ( $drop_ransom_note_v2_p* ) ) and ( $find_files ) ) or ( ( all of ( $encrypt_files_v6_p* ) ) and ( all of ( $set_default_icon_p* ) ) and ( all of ( $drop_ransom_note_v2_p* ) ) and ( $find_files ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Bananacrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BananaCrypt ransomware."
 		author = "ReversingLabs"
-		id = "9e47d094-d7fc-57dd-826c-5321d0219273"
+		id = "d0677fd0-6654-5db4-abe8-d1168dd7e842"
 		date = "2020-09-14"
 		modified = "2020-09-14"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BananaCrypt.yara#L1-L103"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6bde4430e438947b0d7f10c4de11216929ec03af81b3d74f8b7bb8ed134d08d2"
+		logic_hash = "v1_sha256_6bde4430e438947b0d7f10c4de11216929ec03af81b3d74f8b7bb8ed134d08d2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25883,20 +25883,20 @@ rule REVERSINGLABS_Win32_Ransomware_Bananacrypt : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Hotcoffee : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects HotCoffee ransomware."
 		author = "ReversingLabs"
-		id = "11b26b91-96ae-58d3-8a8a-02a3e7d0b82e"
+		id = "3ffb7dc9-c571-51a8-bd51-c08189dfa69f"
 		date = "2021-11-25"
 		modified = "2021-11-25"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.HotCoffee.yara#L1-L111"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "15ae428c37fcc5a09d324fd9be5a8df3a812e6459cb1ce8eec56eabf785b4c05"
+		logic_hash = "v1_sha256_15ae428c37fcc5a09d324fd9be5a8df3a812e6459cb1ce8eec56eabf785b4c05"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25983,20 +25983,20 @@ rule REVERSINGLABS_Win64_Ransomware_Hotcoffee : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_drives) and ($find_files) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( $enum_drives ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( $drop_ransom_note )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Fantom : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Fantom ransomware."
 		author = "ReversingLabs"
-		id = "cd32de8b-2c14-5fb4-be79-365d9848f341"
+		id = "e6a91181-dbbf-5d6d-b20c-add58f1b0098"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Fantom.yara#L1-L97"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f2aaa9776b7ca302052b3303d45df24cc151a4efc7ea9f4bb3c1f53d10ded03a"
+		logic_hash = "v1_sha256_f2aaa9776b7ca302052b3303d45df24cc151a4efc7ea9f4bb3c1f53d10ded03a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26075,20 +26075,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Fantom : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($encrypt_files_*)) and $lockfile and $lockdir and $sendkey)
+		uint16( 0 ) == 0x5A4D and ( ( all of ( $encrypt_files_* ) ) and $lockfile and $lockdir and $sendkey )
 }
 rule REVERSINGLABS_Win32_Ransomware_Outsider : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Outsider ransomware."
 		author = "ReversingLabs"
-		id = "44edccb1-9e2a-5ff9-b4b5-72ceec2f7947"
+		id = "23f5d65c-d318-5f0d-94b8-fb1254fe67f4"
 		date = "2020-10-23"
 		modified = "2020-10-23"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Outsider.yara#L1-L88"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "80c5a93b5b72b7b66e36f1726486b0c7620588d05bd925510d76f020a40b124c"
+		logic_hash = "v1_sha256_80c5a93b5b72b7b66e36f1726486b0c7620588d05bd925510d76f020a40b124c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26156,20 +26156,20 @@ rule REVERSINGLABS_Win32_Ransomware_Outsider : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_resources ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_DMR : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects DMR ransomware."
 		author = "ReversingLabs"
-		id = "45d8f91f-d2d0-5c6e-a29e-b8c9c29dc296"
+		id = "27cefe87-afb3-53cc-886c-6a55e0e37d0c"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.DMR.yara#L1-L214"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "55e19f3017c2cc8355c27f9a516e611b58b108f15bfed41b88d5662b55677a59"
+		logic_hash = "v1_sha256_55e19f3017c2cc8355c27f9a516e611b58b108f15bfed41b88d5662b55677a59"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26359,20 +26359,20 @@ rule REVERSINGLABS_Win32_Ransomware_DMR : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Chichi : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects ChiChi ransomware."
 		author = "ReversingLabs"
-		id = "95062789-a55d-5c1c-a359-206b58f311e5"
+		id = "822cfd19-71f4-5303-a544-dc8ff1093e5b"
 		date = "2022-02-14"
 		modified = "2022-02-14"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.ChiChi.yara#L1-L66"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "863a30e4c708e13ea0f4c6ad42a919de463926508783d6552c0cec746730baa5"
+		logic_hash = "v1_sha256_863a30e4c708e13ea0f4c6ad42a919de463926508783d6552c0cec746730baa5"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26419,20 +26419,20 @@ rule REVERSINGLABS_Win32_Ransomware_Chichi : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($generate_key) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $generate_key ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Wormlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects WormLocker ransomware."
 		author = "ReversingLabs"
-		id = "6d7b55b7-2e1b-56e0-950f-07a2d3fa17ae"
+		id = "2b49e09a-17ac-5080-b183-efd5a74faa42"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.WormLocker.yara#L1-L69"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "87a4f805de78d7e7dffb176302407453108ca01552c682aeee38f8d0201263c9"
+		logic_hash = "v1_sha256_87a4f805de78d7e7dffb176302407453108ca01552c682aeee38f8d0201263c9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26481,20 +26481,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Wormlocker : TC_DETECTION MALICIOUS
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($set_environment) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $set_environment ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Montserrat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Montserrat ransomware."
 		author = "ReversingLabs"
-		id = "deeb5f1a-1329-5964-93e1-8ca6a20fcd89"
+		id = "9204116c-399d-50e9-87e9-fae2ce6da73f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Montserrat.yara#L1-L118"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c8782a8cb2b87e76ff1f804ee8affd01405827d0914ea725bb0e9ddace7dde10"
+		logic_hash = "v1_sha256_c8782a8cb2b87e76ff1f804ee8affd01405827d0914ea725bb0e9ddace7dde10"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26590,20 +26590,20 @@ rule REVERSINGLABS_Win32_Ransomware_Montserrat : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($shutdown_services_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $shutdown_services_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Sage : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Sage ransomware."
 		author = "ReversingLabs"
-		id = "81f4c666-93f9-51bb-8dda-431ef7a81b74"
+		id = "f5f41fd2-5c17-58ef-a2f6-99998fd076dd"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Sage.yara#L1-L77"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "69079b7176050096cdbaaaff30dd0359366b3a6a74e8bc17db348794388f71ba"
+		logic_hash = "v1_sha256_69079b7176050096cdbaaaff30dd0359366b3a6a74e8bc17db348794388f71ba"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26661,20 +26661,20 @@ rule REVERSINGLABS_Win32_Ransomware_Sage : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Satana : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Satana ransomware."
 		author = "ReversingLabs"
-		id = "8dc5bf7c-d4cb-5961-804b-035676dacbc0"
+		id = "75c4a0cd-dfd0-5b8b-99fb-39f00da5ce7a"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Satana.yara#L1-L123"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5deb6ac2e8b64fb6f7af8c41a9b9e695668ca66c96c65f0c7350b11cd4ae0c50"
+		logic_hash = "v1_sha256_5deb6ac2e8b64fb6f7af8c41a9b9e695668ca66c96c65f0c7350b11cd4ae0c50"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26776,20 +26776,20 @@ rule REVERSINGLABS_Win32_Ransomware_Satana : TC_DETECTION MALICIOUS MALWARE FILE
       }
 
 	condition:
-		uint16(0)==0x5A4D and ($remote_connection and ( all of ($search_files_p*)) and ( all of ($encrypt_files_p*)))
+		uint16( 0 ) == 0x5A4D and ( $remote_connection and ( all of ( $search_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Globeimposter : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GlobeImposter ransomware."
 		author = "ReversingLabs"
-		id = "6634a554-b4bb-503d-a4f1-9997b4caa1f0"
+		id = "7dc040e8-e5f8-5ed1-ac83-13394951a161"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.GlobeImposter.yara#L1-L171"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4345a767f270428f3b509fdad5a96bf9b494b190d3a836c4bf53dfd75da5bacb"
+		logic_hash = "v1_sha256_4345a767f270428f3b509fdad5a96bf9b494b190d3a836c4bf53dfd75da5bacb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26928,21 +26928,21 @@ rule REVERSINGLABS_Win32_Ransomware_Globeimposter : TC_DETECTION MALICIOUS MALWA
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($search_files_1 and $encrypt_files_1 and $kill_specific_processes_1) or ($search_files_1 and $encrypt_files_2 and $kill_specific_processes_2) or ($search_files_2 and $encrypt_files_3 and $kill_specific_processes_3))
+		uint16( 0 ) == 0x5A4D and ( ( $search_files_1 and $encrypt_files_1 and $kill_specific_processes_1 ) or ( $search_files_1 and $encrypt_files_2 and $kill_specific_processes_2 ) or ( $search_files_2 and $encrypt_files_3 and $kill_specific_processes_3 ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_ONI : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Oni ransomware."
 		author = "ReversingLabs"
-		id = "9190aee2-1119-546e-82ca-a7aba44a9d7f"
-		date = "2024-12-08"
-		date = "2024-12-08"
+		id = "dff47f41-92e1-5a62-933e-cada3a698604"
+		date = "2024-12-15"
+		date = "2024-12-15"
 		modified = "2020-12-07"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Oni.yara#L1-L82"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "685abf5a5edba5bae19faaf6521ce617370cdab1404fe84d846e82a60182dfff"
+		logic_hash = "v1_sha256_685abf5a5edba5bae19faaf6521ce617370cdab1404fe84d846e82a60182dfff"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27004,20 +27004,20 @@ rule REVERSINGLABS_Win32_Ransomware_ONI : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_processes) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $search_processes ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Linux_Ransomware_Killdisk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects KillDisk ransomware."
 		author = "ReversingLabs"
-		id = "af6652dd-c668-5ae1-b51b-e272cb440c20"
+		id = "7c9c113f-2e7d-5b1e-a6e9-3cdae37c9499"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Linux.Ransomware.KillDisk.yara#L1-L144"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3ed1fb2b7b24cd4d5100d93ed53a9ab28e1482bd0998a0538d8710a962ee839f"
+		logic_hash = "v1_sha256_3ed1fb2b7b24cd4d5100d93ed53a9ab28e1482bd0998a0538d8710a962ee839f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27143,20 +27143,20 @@ rule REVERSINGLABS_Linux_Ransomware_Killdisk : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint32(0)==0x464C457F and ($search_files and ( all of ($encrypt_files_*)) and ( all of ($subvert_grub_*)))
+		uint32( 0 ) == 0x464C457F and ( $search_files and ( all of ( $encrypt_files_* ) ) and ( all of ( $subvert_grub_* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ransomplus : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects RansomPlus ransomware."
 		author = "ReversingLabs"
-		id = "ee96eab6-104d-560f-adae-6d5f0ba5d469"
+		id = "02e8240a-c6d6-559f-bc7a-d80c802a1373"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.RansomPlus.yara#L1-L95"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8ab18c6bcb939eac0e74f015dea773141b5086c5fcb4783666eeac1f395bc208"
+		logic_hash = "v1_sha256_8ab18c6bcb939eac0e74f015dea773141b5086c5fcb4783666eeac1f395bc208"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27240,20 +27240,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ransomplus : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files_1_0 and $find_files_1_1 and $find_files_1_2 and $encrypt_files
+		uint16( 0 ) == 0x5A4D and $find_files_1_0 and $find_files_1_1 and $find_files_1_2 and $encrypt_files
 }
 rule REVERSINGLABS_Win32_Ransomware_Hermes : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Hermes ransomware."
 		author = "ReversingLabs"
-		id = "1f1f363a-5be0-59e5-b1c1-5e277922790c"
+		id = "3e1dcb0e-59e6-5dbb-b48c-17a754fc5c5c"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Hermes.yara#L1-L284"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6db95c422ee2f9dd8a1795031ee8d7d5ed84e16cde47512becc006b6a849e890"
+		logic_hash = "v1_sha256_6db95c422ee2f9dd8a1795031ee8d7d5ed84e16cde47512becc006b6a849e890"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27492,20 +27492,20 @@ rule REVERSINGLABS_Win32_Ransomware_Hermes : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((( all of ($hermes_find_files_v1_p*)) and ( all of ($hermes_encrypt_files_v1_p*))) or (( all of ($hermes_find_files_v2_p*)) and ( all of ($hermes_encrypt_files_v2_p*)))) and ( any of ($hermes_enum_resources_v*))
+		uint16( 0 ) == 0x5A4D and ( ( ( all of ( $hermes_find_files_v1_p* ) ) and ( all of ( $hermes_encrypt_files_v1_p* ) ) ) or ( ( all of ( $hermes_find_files_v2_p* ) ) and ( all of ( $hermes_encrypt_files_v2_p* ) ) ) ) and ( any of ( $hermes_enum_resources_v* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ryuk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ryuk ransomware."
 		author = "ReversingLabs"
-		id = "179c9277-0bdc-522a-a822-cf93febff408"
+		id = "14332f05-2428-5c37-8edb-b165e9d0b582"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Ryuk.yara#L1-L199"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bf93892b281be20917656e242cbb0f3b3694439556b7e5e40a424ba1aa909105"
+		logic_hash = "v1_sha256_bf93892b281be20917656e242cbb0f3b3694439556b7e5e40a424ba1aa909105"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27679,20 +27679,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ryuk : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Antefrigus : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects AnteFrigus ransomware."
 		author = "ReversingLabs"
-		id = "903ac92c-1a4a-5645-92db-d00b3bfd6ada"
+		id = "79657c2b-611e-56cd-82b8-a5ea9d78dcc2"
 		date = "2021-03-05"
 		modified = "2021-03-05"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.AnteFrigus.yara#L1-L210"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b84c01da0ee97a4eb8bf099c71094f994feb4c7185ad75b8b2ccda5eee283a92"
+		logic_hash = "v1_sha256_b84c01da0ee97a4eb8bf099c71094f994feb4c7185ad75b8b2ccda5eee283a92"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27876,20 +27876,20 @@ rule REVERSINGLABS_Win32_Ransomware_Antefrigus : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Cryptobit : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects CryptoBit ransomware."
 		author = "ReversingLabs"
-		id = "8566e516-9884-5b20-90c4-7ed38fa96999"
+		id = "89e39f4f-6bcd-577e-be63-6ddeebbb7886"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.CryptoBit.yara#L1-L113"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ccc8a0f1c5e11211649992d0f2b309968c97b49f1c7359e62d622f364e117429"
+		logic_hash = "v1_sha256_ccc8a0f1c5e11211649992d0f2b309968c97b49f1c7359e62d622f364e117429"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27981,20 +27981,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cryptobit : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($remote_connection and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)))
+		uint16( 0 ) == 0x5A4D and ( $remote_connection and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Hddcryptor : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects HDDCryptor ransomware."
 		author = "ReversingLabs"
-		id = "2c6a8ca3-0f7a-52b7-af6d-74fa9407feca"
+		id = "9d9d7c94-2850-589e-8224-93af2a20a8b7"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.HDDCryptor.yara#L1-L157"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "47915f315bb4956507362f56024f5632cb1bcec569ceaf77fe9d7cb9c25d1d8a"
+		logic_hash = "v1_sha256_47915f315bb4956507362f56024f5632cb1bcec569ceaf77fe9d7cb9c25d1d8a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28109,20 +28109,20 @@ rule REVERSINGLABS_Win32_Ransomware_Hddcryptor : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($deploy_components) and ($get_shares_info) and ($encrypt_discs)) or (($extract_diskcryptor_from_resources) and ($create_diskcryptor_service) and ( all of ($encrypt_files_using_diskcryptor_p*)) and ($reboot)))
+		uint16( 0 ) == 0x5A4D and ( ( ( $deploy_components ) and ( $get_shares_info ) and ( $encrypt_discs ) ) or ( ( $extract_diskcryptor_from_resources ) and ( $create_diskcryptor_service ) and ( all of ( $encrypt_files_using_diskcryptor_p* ) ) and ( $reboot ) ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Bkransomware : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects BKRansomware ransomware."
 		author = "ReversingLabs"
-		id = "88dc5c4a-046a-52e2-b108-0a90b91d4fb6"
+		id = "12f8e9a3-70c6-51ed-bee3-346fa751b0fe"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.BKRansomware.yara#L1-L79"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3118098f05a13bd161af0cb1ec322878b371ff70b9f3815a04115a214c0965a2"
+		logic_hash = "v1_sha256_3118098f05a13bd161af0cb1ec322878b371ff70b9f3815a04115a214c0965a2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28185,20 +28185,20 @@ rule REVERSINGLABS_Win32_Ransomware_Bkransomware : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $search_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Armage : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Armage ransomware."
 		author = "ReversingLabs"
-		id = "94cf639b-7d9e-51ca-b547-e0d591581df2"
+		id = "f5773231-475a-5775-8848-404b6e017280"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Armage.yara#L1-L128"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "aa8ddcbb0fdcad15e603e000db1d4f86eae7d42efce1c1d21dc3dd57ee9f4319"
+		logic_hash = "v1_sha256_aa8ddcbb0fdcad15e603e000db1d4f86eae7d42efce1c1d21dc3dd57ee9f4319"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28304,20 +28304,20 @@ rule REVERSINGLABS_Win32_Ransomware_Armage : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_resources_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $enum_resources_p* ) ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Targetcompany : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects TargetCompany ransomware."
 		author = "ReversingLabs"
-		id = "7e6983f9-2aca-5cfa-aad6-38aa64fa2062"
+		id = "534b1b27-933f-55fd-a223-ee6b2343902d"
 		date = "2021-09-27"
 		modified = "2021-09-27"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.TargetCompany.yara#L1-L141"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "05fa81afa8aa1e3b9955ad24a274ddef4fb32d678902af7aae6d6c67ed3bf0fd"
+		logic_hash = "v1_sha256_05fa81afa8aa1e3b9955ad24a274ddef4fb32d678902af7aae6d6c67ed3bf0fd"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28432,20 +28432,20 @@ rule REVERSINGLABS_Win32_Ransomware_Targetcompany : TC_DETECTION MALICIOUS MALWA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($generate_key) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $generate_key ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Howareyou : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects HowAreYou ransomware."
 		author = "ReversingLabs"
-		id = "998fbebe-099d-5779-ad4a-91b7b6c8ad6b"
+		id = "1224d329-1fd2-5829-9871-0f07ab947ce0"
 		date = "2021-06-14"
 		modified = "2021-06-14"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.HowAreYou.yara#L1-L205"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "90568365aac61d120886f9efa9822ccc23df79a1a55e522c81db6e77477c4f04"
+		logic_hash = "v1_sha256_90568365aac61d120886f9efa9822ccc23df79a1a55e522c81db6e77477c4f04"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28624,20 +28624,20 @@ rule REVERSINGLABS_Win32_Ransomware_Howareyou : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Retmydata : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects RetMyData ransomware."
 		author = "ReversingLabs"
-		id = "f7a091d9-7ace-5aad-95b4-d5101fa7fdea"
+		id = "deedb074-eae8-5330-a994-016aae9dd6d0"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.RetMyData.yara#L1-L79"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "54ce38d75e9ab82a77b9c338f75e180e19ac745f149289c7478a4aa3b44d70fd"
+		logic_hash = "v1_sha256_54ce38d75e9ab82a77b9c338f75e180e19ac745f149289c7478a4aa3b44d70fd"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28697,20 +28697,20 @@ rule REVERSINGLABS_Win32_Ransomware_Retmydata : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $enum_resources ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Monalisa : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Monalisa ransomware."
 		author = "ReversingLabs"
-		id = "34addb63-2426-59a2-b79b-052a9161d361"
+		id = "eee02601-2cc3-5a69-a0bd-9e4125f6115c"
 		date = "2022-05-13"
 		modified = "2022-05-13"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Monalisa.yara#L1-L83"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0bcb79dff111ec05ac93bbe9a777546bd6234dc60d9f6982c03cd0bc3b26b038"
+		logic_hash = "v1_sha256_0bcb79dff111ec05ac93bbe9a777546bd6234dc60d9f6982c03cd0bc3b26b038"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28770,20 +28770,20 @@ rule REVERSINGLABS_Win32_Ransomware_Monalisa : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($write_proc_mem) and ($generate_key) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $write_proc_mem ) and ( $generate_key ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win64_Ransomware_Wintenzz : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Wintenzz ransomware."
 		author = "ReversingLabs"
-		id = "6bf569e8-b050-51ef-a948-0eb294248d63"
+		id = "92035bb8-06bc-5338-b0b9-249636741402"
 		date = "2021-11-02"
 		modified = "2021-11-02"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Wintenzz.yara#L1-L83"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ff4bdf2f6ee185b98d0014b3066806fe7e25ea94f46837948bc5262440bf8a56"
+		logic_hash = "v1_sha256_ff4bdf2f6ee185b98d0014b3066806fe7e25ea94f46837948bc5262440bf8a56"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28846,20 +28846,20 @@ rule REVERSINGLABS_Win64_Ransomware_Wintenzz : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_*)) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_* ) ) and ( $drop_ransom_note )
 }
 rule REVERSINGLABS_Win32_Ransomware_Sepsis : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Sepsis ransomware."
 		author = "ReversingLabs"
-		id = "0c26d6e0-1d64-5f47-8e21-6710a531bc74"
+		id = "4f36609d-23d5-5aa7-a573-4ebe20cfab44"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Sepsis.yara#L1-L126"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "171ad074a780b45195c6e02b111b3883c58a4028e635c4d6b8ce27c5e05e35d7"
+		logic_hash = "v1_sha256_171ad074a780b45195c6e02b111b3883c58a4028e635c4d6b8ce27c5e05e35d7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28963,20 +28963,20 @@ rule REVERSINGLABS_Win32_Ransomware_Sepsis : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($search_files_*)) and ( all of ($encrypt_files_*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $search_files_* ) ) and ( all of ( $encrypt_files_* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Ako : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Ako ransomware."
 		author = "ReversingLabs"
-		id = "00d67696-998c-5bc3-95e7-0320ca558cdb"
+		id = "abfc6e91-5850-5ef7-934e-c01c612d098a"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Ako.yara#L1-L152"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "488e9b528f75fcfaa8dd19859801e6e5a73575c33cd70c98ebaa9ae93025018b"
+		logic_hash = "v1_sha256_488e9b528f75fcfaa8dd19859801e6e5a73575c33cd70c98ebaa9ae93025018b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29104,20 +29104,20 @@ rule REVERSINGLABS_Win32_Ransomware_Ako : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_win32_p*)) and ( all of ($encrypt_files_win32_p*)) and ( all of ($encrypt_network_shares_win32_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_win32_p* ) ) and ( all of ( $encrypt_files_win32_p* ) ) and ( all of ( $encrypt_network_shares_win32_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_FLKR : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects FLKR ransomware."
 		author = "ReversingLabs"
-		id = "7f3abcd0-8dfa-5914-9ad0-566c16c2e2ab"
+		id = "05157ff7-f17e-5d29-94a8-0b75bb10026b"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.FLKR.yara#L1-L71"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4ab00ba82baceec9899556d3a774ec08c83c10930cec194e18e3b4e16ebacb58"
+		logic_hash = "v1_sha256_4ab00ba82baceec9899556d3a774ec08c83c10930cec194e18e3b4e16ebacb58"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29178,20 +29178,20 @@ rule REVERSINGLABS_Win32_Ransomware_FLKR : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($search_and_encrypt_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $search_and_encrypt_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Sanwai : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Sanwai ransomware."
 		author = "ReversingLabs"
-		id = "01912621-4a34-5e34-8542-5b561e8da567"
+		id = "6cf7b717-e235-5500-8481-c44526159b8a"
 		date = "2021-11-11"
 		modified = "2021-11-11"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Sanwai.yara#L1-L71"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a7a95b2403fe539dce0d856cc1c04d15440677ea39c0a22e818b42333a64e92c"
+		logic_hash = "v1_sha256_a7a95b2403fe539dce0d856cc1c04d15440677ea39c0a22e818b42333a64e92c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29243,20 +29243,20 @@ rule REVERSINGLABS_Win32_Ransomware_Sanwai : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($import_key) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $import_key ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win64_Ransomware_Whiteblackcrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects WhiteBlackCrypt ransomware."
 		author = "ReversingLabs"
-		id = "9855c10d-563d-54e0-bc79-945daef947de"
+		id = "a4edb094-8984-5491-9db7-bf8db4994b7c"
 		date = "2021-07-05"
 		modified = "2021-07-05"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.WhiteBlackCrypt.yara#L1-L91"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "37b95cc3412f2f2d02d19c4c15b529c4f67453cb195627b5bab2f353e7602354"
+		logic_hash = "v1_sha256_37b95cc3412f2f2d02d19c4c15b529c4f67453cb195627b5bab2f353e7602354"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29327,20 +29327,20 @@ rule REVERSINGLABS_Win64_Ransomware_Whiteblackcrypt : TC_DETECTION MALICIOUS MAL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($register_service_p*)) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $register_service_p* ) ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Hog : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Hog ransomware."
 		author = "ReversingLabs"
-		id = "b4f26acf-5ff1-5c49-8cfa-8f619af84efd"
+		id = "ffd17025-4aa9-57cd-a0c8-d564e61087c8"
 		date = "2021-10-12"
 		modified = "2021-10-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Hog.yara#L1-L70"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c5cbc79fee9083ed3befa6b0d348f2d38064bb9012b8f0ca11afd7137243866d"
+		logic_hash = "v1_sha256_c5cbc79fee9083ed3befa6b0d348f2d38064bb9012b8f0ca11afd7137243866d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29390,20 +29390,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Hog : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($generate_key) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $generate_key ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Thanos : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Thanos ransomware."
 		author = "ReversingLabs"
-		id = "e607255d-45a6-573d-956e-f6faa2aa7e9f"
+		id = "4c3a7afd-e2a6-5ed5-8830-78dcf6e4e56f"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Thanos.yara#L1-L106"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f6bc0c2188a04d2fb2a82a6b6d6cdf7763c32047bec725fe07f01415edf0b4cd"
+		logic_hash = "v1_sha256_f6bc0c2188a04d2fb2a82a6b6d6cdf7763c32047bec725fe07f01415edf0b4cd"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29488,20 +29488,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Thanos : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $encrypt_files ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Cincoo : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Cincoo ransomware."
 		author = "ReversingLabs"
-		id = "c7c2773c-5056-5127-8af7-7f5c5a8ea8a1"
+		id = "888eb475-1f81-5769-b8a7-e62e739e6ca0"
 		date = "2022-06-21"
 		modified = "2022-06-21"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Cincoo.yara#L1-L78"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6a7562cae90754ea75a9fb98ce73ebdb9acf1ad7f28f2240abe6cb592d717ca3"
+		logic_hash = "v1_sha256_6a7562cae90754ea75a9fb98ce73ebdb9acf1ad7f28f2240abe6cb592d717ca3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29560,20 +29560,20 @@ rule REVERSINGLABS_Win32_Ransomware_Cincoo : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $drop_ransom_note )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Namaste : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Namaste ransomware."
 		author = "ReversingLabs"
-		id = "e85d7ec3-367b-5bde-a570-8caa1f6cd61b"
+		id = "0e9afc57-2a0a-54ef-a1c6-eda77c9ce559"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Namaste.yara#L1-L81"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5a952276f41b5524bcb82a9ceb076983d2faf2864b3bbd0a06d49bbd5edc1e0e"
+		logic_hash = "v1_sha256_5a952276f41b5524bcb82a9ceb076983d2faf2864b3bbd0a06d49bbd5edc1e0e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29636,20 +29636,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Namaste : TC_DETECTION MALICIOUS MAL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Regretlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects RegretLocker ransomware."
 		author = "ReversingLabs"
-		id = "c4e515cc-b0c2-57b2-a230-619ec01ac8d4"
+		id = "77d0d3e5-816b-596f-accb-1c8e8d994ff4"
 		date = "2021-04-02"
 		modified = "2021-04-02"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.RegretLocker.yara#L1-L206"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3927dfecacd74f60a169f82b68df5747daa90eaba77f24c5e730ce4c48d426a3"
+		logic_hash = "v1_sha256_3927dfecacd74f60a169f82b68df5747daa90eaba77f24c5e730ce4c48d426a3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29830,20 +29830,20 @@ rule REVERSINGLABS_Win32_Ransomware_Regretlocker : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Badbeeteam : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Badbeeteam ransomware."
 		author = "ReversingLabs"
-		id = "39490b21-34b9-51cb-a3ed-672b3186a233"
+		id = "a32fad99-9ebe-526e-abbd-5e2cde7bb262"
 		date = "2020-11-13"
 		modified = "2020-11-13"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Badbeeteam.yara#L1-L137"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9b5367655c7c70958332d31524833d96d03027aab693393b19f478a80482abd0"
+		logic_hash = "v1_sha256_9b5367655c7c70958332d31524833d96d03027aab693393b19f478a80482abd0"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29958,20 +29958,20 @@ rule REVERSINGLABS_Win32_Ransomware_Badbeeteam : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($drop_hta_file_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( all of ( $drop_hta_file_p* ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Hermeticransom : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects HermeticRansom ransomware."
 		author = "ReversingLabs"
-		id = "6aaf89f4-0cf8-5f0e-b89d-01ac7edd06c0"
+		id = "780dc0e8-9acc-5a99-80d8-5a897e39866f"
 		date = "2022-05-13"
 		modified = "2022-05-13"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.HermeticRansom.yara#L1-L105"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "123d569a9d9b9d855b3baafd6194f102d82a594fd7a2bba073843a8654a317cb"
+		logic_hash = "v1_sha256_123d569a9d9b9d855b3baafd6194f102d82a594fd7a2bba073843a8654a317cb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30056,20 +30056,20 @@ rule REVERSINGLABS_Win64_Ransomware_Hermeticransom : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( $drop_ransom_note )
 }
 rule REVERSINGLABS_Win32_Ransomware_Horsedeal : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Horsedeal ransomware."
 		author = "ReversingLabs"
-		id = "c722bc5b-756e-5d46-8530-e20ebb73737c"
+		id = "f720a697-a862-59a2-b7e8-59bdf6ee9269"
 		date = "2020-10-01"
 		modified = "2020-10-01"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Horsedeal.yara#L1-L106"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fa8c425b08606399b5dc7673f3898e3dba7efb6a62e56db8f500cf5072bb590b"
+		logic_hash = "v1_sha256_fa8c425b08606399b5dc7673f3898e3dba7efb6a62e56db8f500cf5072bb590b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30151,20 +30151,20 @@ rule REVERSINGLABS_Win32_Ransomware_Horsedeal : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($search_processes) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $enum_resources ) and ( $search_processes ) and ( $find_files ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Gandcrab : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GandCrab ransomware."
 		author = "ReversingLabs"
-		id = "a09ed7e6-f3a6-5f44-9d5b-a9c529cf1190"
+		id = "1c6a2318-4d84-53ab-8b9a-e15944627277"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.GandCrab.yara#L1-L892"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "79381635681482fc90defe4e10e97bf16d534837518fc06ae579822e9d77b461"
+		logic_hash = "v1_sha256_79381635681482fc90defe4e10e97bf16d534837518fc06ae579822e9d77b461"
 		score = 75
 		quality = 88
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31001,20 +31001,20 @@ rule REVERSINGLABS_Win32_Ransomware_Gandcrab : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($search_antivirus_processes and $find_files and $crypt_files and $remote_connection) or ($find_files_v2 and $crypt_files_v2 and $search_antivirus_processes_v2 and $remote_connection_v2) or ($search_antivirus_processes_v2 and $find_files_v2_1 and $crypt_files_v2_1 and $remote_connection_v2_1) or ($search_antivirus_processes_v4_1_2 and $find_files_v4_1_2 and $crypt_files_v4_1_2 and $remote_connection_v4_1_2 and $url_parameters_setup_v4_1_2) or ($search_antivirus_processes_v4 and $find_files_v4 and $crypt_files_v4 and $url_parameters_setup_v4) or ($search_antivirus_processes_v2 and $find_files_v2_1 and $remote_connection_v2_1 and $crypt_files_v3) or ($search_antivirus_processes_v5 and $find_files_v5 and $crypt_files_v5 and $remote_connection_v5 and $url_parameters_setup_v5) or ($search_antivirus_processes_v5_0_1 and $find_files_v5_0_1 and $crypt_files_v5_0_1 and $url_parameters_setup_v5_0_1 and $remote_connection_v5_0_1) or ($search_antivirus_processes_v5_0_2 and $find_files_v5_0_2 and $crypt_files_v5_0_2 and $set_url_parameters_v5_0_2 and $remote_connection_v5_0_2) or ($search_antivirus_processes_v5_0_2 and $find_files_v5_0_2 and $crypt_files_v5_0_3 and $set_url_parameters_v5_0_3 and $remote_connection_v5_0_3))
+		uint16( 0 ) == 0x5A4D and ( ( $search_antivirus_processes and $find_files and $crypt_files and $remote_connection ) or ( $find_files_v2 and $crypt_files_v2 and $search_antivirus_processes_v2 and $remote_connection_v2 ) or ( $search_antivirus_processes_v2 and $find_files_v2_1 and $crypt_files_v2_1 and $remote_connection_v2_1 ) or ( $search_antivirus_processes_v4_1_2 and $find_files_v4_1_2 and $crypt_files_v4_1_2 and $remote_connection_v4_1_2 and $url_parameters_setup_v4_1_2 ) or ( $search_antivirus_processes_v4 and $find_files_v4 and $crypt_files_v4 and $url_parameters_setup_v4 ) or ( $search_antivirus_processes_v2 and $find_files_v2_1 and $remote_connection_v2_1 and $crypt_files_v3 ) or ( $search_antivirus_processes_v5 and $find_files_v5 and $crypt_files_v5 and $remote_connection_v5 and $url_parameters_setup_v5 ) or ( $search_antivirus_processes_v5_0_1 and $find_files_v5_0_1 and $crypt_files_v5_0_1 and $url_parameters_setup_v5_0_1 and $remote_connection_v5_0_1 ) or ( $search_antivirus_processes_v5_0_2 and $find_files_v5_0_2 and $crypt_files_v5_0_2 and $set_url_parameters_v5_0_2 and $remote_connection_v5_0_2 ) or ( $search_antivirus_processes_v5_0_2 and $find_files_v5_0_2 and $crypt_files_v5_0_3 and $set_url_parameters_v5_0_3 and $remote_connection_v5_0_3 ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Sifreli : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Sifreli ransomware."
 		author = "ReversingLabs"
-		id = "974f81e2-6907-54da-97e3-3116c41b5ed4"
+		id = "ca2b2e89-8703-59c5-8365-fe9d438c0762"
 		date = "2020-10-08"
 		modified = "2020-10-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Sifreli.yara#L1-L119"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "48f6cc678bea81afece0ae203fb27b61e2c6e4f7188a3bd260190f568c9a8a06"
+		logic_hash = "v1_sha256_48f6cc678bea81afece0ae203fb27b61e2c6e4f7188a3bd260190f568c9a8a06"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31110,7 +31110,7 @@ rule REVERSINGLABS_Win32_Ransomware_Sifreli : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_*)) and ( all of ($remote_connection_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_* ) ) and ( all of ( $remote_connection_p* ) )
 }
 import "pe"
 
@@ -31119,13 +31119,13 @@ rule REVERSINGLABS_Win32_Ransomware_Petya : TC_DETECTION MALICIOUS MALWARE FILE
 	meta:
 		description = "Yara rule that detects Petya ransomware."
 		author = "ReversingLabs"
-		id = "93d9fb33-88d1-50ec-bf99-1888201c0ec2"
+		id = "43994b48-374a-5d79-83c8-c3de6444d4ac"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Petya.yara#L3-L58"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d2adafcb21b627d614eab79e64e2b96ad09fae796d0670452a19490d8781ce99"
+		logic_hash = "v1_sha256_d2adafcb21b627d614eab79e64e2b96ad09fae796d0670452a19490d8781ce99"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31169,20 +31169,20 @@ rule REVERSINGLABS_Win32_Ransomware_Petya : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($entry_point at pe.entry_point) and $shutdown_pattern and $sectionxxxx_pattern and $crypt_gen_pattern
+		uint16( 0 ) == 0x5A4D and ( $entry_point at pe.entry_point ) and $shutdown_pattern and $sectionxxxx_pattern and $crypt_gen_pattern
 }
 rule REVERSINGLABS_Win32_Ransomware_Blitzkrieg : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Blitzkrieg ransomware."
 		author = "ReversingLabs"
-		id = "078f7f9d-edd4-52b4-a30e-e968542da95c"
+		id = "80cb1024-622e-5a10-b14b-afbc3634e570"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Blitzkrieg.yara#L1-L127"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "22dd16c886a1982186fe927e633be9951da7d7e664e877e11fa976696b2bc86f"
+		logic_hash = "v1_sha256_22dd16c886a1982186fe927e633be9951da7d7e664e877e11fa976696b2bc86f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31286,20 +31286,20 @@ rule REVERSINGLABS_Win32_Ransomware_Blitzkrieg : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($disable_services_p*)) and ( all of ($search_files_p*)) and ($encrypt_files))
+		uint16( 0 ) == 0x5A4D and ( ( all of ( $disable_services_p* ) ) and ( all of ( $search_files_p* ) ) and ( $encrypt_files ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_PXJ : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects PXJ ransomware."
 		author = "ReversingLabs"
-		id = "c1549905-5b31-55c0-a275-0ab8133b3504"
+		id = "1a02dc4e-340e-5a77-8bdf-c9adc516d122"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.PXJ.yara#L1-L158"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e88d27dcd7ad3af459bd7e34fcc827822365441446b0e4e7bbec399c9a948cb7"
+		logic_hash = "v1_sha256_e88d27dcd7ad3af459bd7e34fcc827822365441446b0e4e7bbec399c9a948cb7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31434,20 +31434,20 @@ rule REVERSINGLABS_Win32_Ransomware_PXJ : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($delete_volumes_snapshots_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $delete_volumes_snapshots_p* ) ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Gpgqwerty : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GPGQwerty ransomware."
 		author = "ReversingLabs"
-		id = "8848e00a-a695-575b-a29d-fc9521859e12"
+		id = "6f9ee028-57a5-591b-8aea-4ac5e59941bc"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.GPGQwerty.yara#L1-L83"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e59adadd66b4d242ac7337ce4b3c3ec6c60724f4cf5b86305f1e31b88745928c"
+		logic_hash = "v1_sha256_e59adadd66b4d242ac7337ce4b3c3ec6c60724f4cf5b86305f1e31b88745928c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31514,20 +31514,20 @@ rule REVERSINGLABS_Win32_Ransomware_Gpgqwerty : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Janelle : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Janelle ransomware."
 		author = "ReversingLabs"
-		id = "4fef3be5-8332-5ce2-b1e9-3993e6963331"
+		id = "555fbf4b-0b65-5b54-8020-ab2f4b02e3f7"
 		date = "2021-12-16"
 		modified = "2021-12-16"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Janelle.yara#L1-L96"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "49f1eac82930606183ab9cf1d5c6c42534d58735876134793e9712e78eb5a4c7"
+		logic_hash = "v1_sha256_49f1eac82930606183ab9cf1d5c6c42534d58735876134793e9712e78eb5a4c7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31603,20 +31603,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Janelle : TC_DETECTION MALICIOUS MAL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($setup_env_p*)) and ($find_files) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( all of ( $setup_env_p* ) ) and ( $find_files ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Zerocrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects ZeroCrypt ransomware."
 		author = "ReversingLabs"
-		id = "89e47d7f-1ac4-570d-8ae1-30f0acc21462"
+		id = "8a3f47dd-1f5c-54a4-8326-2c2387a357cf"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.ZeroCrypt.yara#L1-L94"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "947925206ded187eac31c5046d75ab017869ae3f8dc906f2e5536d4db219f108"
+		logic_hash = "v1_sha256_947925206ded187eac31c5046d75ab017869ae3f8dc906f2e5536d4db219f108"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31700,20 +31700,20 @@ rule REVERSINGLABS_Win32_Ransomware_Zerocrypt : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_file_1 and $encrypt_file_2 and $encrypt_file_3
+		uint16( 0 ) == 0x5A4D and $encrypt_file_1 and $encrypt_file_2 and $encrypt_file_3
 }
 rule REVERSINGLABS_Win32_Ransomware_Zoldon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Zoldon ransomware."
 		author = "ReversingLabs"
-		id = "5d28e6f0-9d6b-54f4-81ed-aadb58352c80"
+		id = "50620a61-7c84-5473-b19c-a0afd811ed5b"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Zoldon.yara#L1-L107"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4821b8506e7ba00987978f2744da1c532e03d73f3275cb15e39cdf87f6018223"
+		logic_hash = "v1_sha256_4821b8506e7ba00987978f2744da1c532e03d73f3275cb15e39cdf87f6018223"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31799,20 +31799,20 @@ rule REVERSINGLABS_Win32_Ransomware_Zoldon : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($write_zoldon_regkey) and ( all of ($find_files_p*)) and ( all of ($main_encrypt_function_p*))
+		uint16( 0 ) == 0x5A4D and ( $write_zoldon_regkey ) and ( all of ( $find_files_p* ) ) and ( all of ( $main_encrypt_function_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Loocipher : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects LooCipher ransomware."
 		author = "ReversingLabs"
-		id = "b5aa2bd0-72b0-5013-a60e-9b4f1ee1de1f"
+		id = "821433b8-14bb-5ccb-a164-bffa78c1d2d1"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.LooCipher.yara#L1-L87"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "aa0598d63b5fad6aea0945a0aa2030d3d6e2cd9f1fea16f3dd17cdceb68323e3"
+		logic_hash = "v1_sha256_aa0598d63b5fad6aea0945a0aa2030d3d6e2cd9f1fea16f3dd17cdceb68323e3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31880,20 +31880,20 @@ rule REVERSINGLABS_Win32_Ransomware_Loocipher : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($remote_connection)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( $encrypt_files ) and ( $remote_connection )
 }
 rule REVERSINGLABS_Win32_Ransomware_Skystars : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Skystars ransomware."
 		author = "ReversingLabs"
-		id = "9dc19bda-c5bd-58fb-8c4f-a7d8a6fbbce9"
+		id = "90529d44-8741-58f7-ac0d-0e54f22fb26d"
 		date = "2020-11-20"
 		modified = "2020-11-20"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Skystars.yara#L1-L97"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "352d22183b0974908ce684725fe85b4714ac5959c3bddf093b54383195881a5a"
+		logic_hash = "v1_sha256_352d22183b0974908ce684725fe85b4714ac5959c3bddf093b54383195881a5a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31970,20 +31970,20 @@ rule REVERSINGLABS_Win32_Ransomware_Skystars : TC_DETECTION MALICIOUS MALWARE FI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($main_routine) and ( all of ($search_files_p*)) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $main_routine ) and ( all of ( $search_files_p* ) ) and ( $encrypt_files )
 }
 rule REVERSINGLABS_Win32_Ransomware_Sigrun : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Sigrun ransomware."
 		author = "ReversingLabs"
-		id = "fa627192-ed80-5115-a028-014f67f4571d"
+		id = "7d92db58-2e6d-53b1-902c-509d97b5912a"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Sigrun.yara#L1-L111"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ea29ec64cdfc0c714fe0acdce5878cb1302dd5aa916811121c644948ce275935"
+		logic_hash = "v1_sha256_ea29ec64cdfc0c714fe0acdce5878cb1302dd5aa916811121c644948ce275935"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32072,20 +32072,20 @@ rule REVERSINGLABS_Win32_Ransomware_Sigrun : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_resources_*)) and ($find_files) and ( all of ($encrypt_files_*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $enum_resources_* ) ) and ( $find_files ) and ( all of ( $encrypt_files_* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Asn1Encoder : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects ASN1Encoder ransomware."
 		author = "ReversingLabs"
-		id = "5fa361e5-4ab0-5856-92b2-6f434e33c350"
+		id = "85d76df8-15d9-5bdb-951a-d8b676b04480"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.ASN1Encoder.yara#L1-L136"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "000fd846fa5f09af19ead4623bb5a8eb51cdb4c751013569bf070710d3e0d61d"
+		logic_hash = "v1_sha256_000fd846fa5f09af19ead4623bb5a8eb51cdb4c751013569bf070710d3e0d61d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32200,20 +32200,20 @@ rule REVERSINGLABS_Win32_Ransomware_Asn1Encoder : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*)))
+		uint16( 0 ) == 0x5A4D and ( $find_files and ( all of ( $encrypt_files_p* ) ) and ( all of ( $remote_connection_p* ) ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Mcburglar : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects McBurglar ransomware."
 		author = "ReversingLabs"
-		id = "11816401-87c3-5aff-b161-da0fa4eb4bca"
+		id = "eddcf970-f4d2-5108-9c5a-68c1f2f53dd0"
 		date = "2021-09-27"
 		modified = "2021-09-27"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.McBurglar.yara#L1-L75"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "57fefcdc1528fc1c8da36a431cd09774e33ea08a394ac4f8d19a27504e72676d"
+		logic_hash = "v1_sha256_57fefcdc1528fc1c8da36a431cd09774e33ea08a394ac4f8d19a27504e72676d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32264,20 +32264,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Mcburglar : TC_DETECTION MALICIOUS M
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($generate_salt) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $setup_env ) and ( $find_files ) and ( $generate_salt ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Win64_Ransomware_Cactus : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Cactus ransomware."
 		author = "ReversingLabs"
-		id = "f391919a-b433-5f8d-8051-f0467118fa1b"
+		id = "232248f9-f977-551f-a622-6a3b2f41ca0f"
 		date = "2023-12-15"
 		modified = "2023-12-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win64.Ransomware.Cactus.yara#L1-L190"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2953b67e926cb653df0de208b098da3d5c16e6690842ab28fbf8c37cd16f54d7"
+		logic_hash = "v1_sha256_2953b67e926cb653df0de208b098da3d5c16e6690842ab28fbf8c37cd16f54d7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32439,20 +32439,20 @@ rule REVERSINGLABS_Win64_Ransomware_Cactus : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($check_processes) and ( all of ($kill_file_processes_p*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) ) and ( $check_processes ) and ( all of ( $kill_file_processes_p* ) )
 }
 rule REVERSINGLABS_Win32_Ransomware_Balaclava : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Balaclava ransomware."
 		author = "ReversingLabs"
-		id = "1a17f2e8-f161-55bc-b44e-f8f47ebd9869"
+		id = "16ac2306-466b-531f-af08-ca4821a10051"
 		date = "2020-10-01"
 		modified = "2020-10-01"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.Balaclava.yara#L1-L113"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "01b43e6ea7ceebdbdda7e1f7c5bd2439a460b8aed4a1837755fa3679e9893ff3"
+		logic_hash = "v1_sha256_01b43e6ea7ceebdbdda7e1f7c5bd2439a460b8aed4a1837755fa3679e9893ff3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32544,20 +32544,20 @@ rule REVERSINGLABS_Win32_Ransomware_Balaclava : TC_DETECTION MALICIOUS MALWARE F
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_volumes) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16( 0 ) == 0x5A4D and ( $find_volumes ) and ( all of ( $find_files_p* ) ) and ( all of ( $encrypt_files_p* ) )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Dusk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Dusk ransomware."
 		author = "ReversingLabs"
-		id = "cde30f40-f13c-53da-8656-cc293433aa36"
+		id = "749bbb5f-4702-5696-8bd1-088e15261e90"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/ByteCode.MSIL.Ransomware.Dusk.yara#L1-L73"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b6b0b3be7c17115dc5f225a13228f8a4811d84ae095c3ceba2d89f569f2d40c7"
+		logic_hash = "v1_sha256_b6b0b3be7c17115dc5f225a13228f8a4811d84ae095c3ceba2d89f569f2d40c7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32610,20 +32610,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Dusk : TC_DETECTION MALICIOUS MALWAR
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($dusk_delete_itself)
+		uint16( 0 ) == 0x5A4D and ( $find_files ) and ( all of ( $encrypt_files_p* ) ) and ( $dusk_delete_itself )
 }
 rule REVERSINGLABS_Win32_Ransomware_Avoslocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects AvosLocker ransomware."
 		author = "ReversingLabs"
-		id = "a803283d-6424-5a64-89e6-c73a3322ba1e"
+		id = "201b3e77-4989-5b00-a5e8-8d5ede6b7f13"
 		date = "2021-10-22"
 		modified = "2021-10-22"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/ransomware/Win32.Ransomware.AvosLocker.yara#L1-L108"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4d81b801a95a54a35989c4a985d92578971568d1412f625bca911d0fa1eee1fe"
+		logic_hash = "v1_sha256_4d81b801a95a54a35989c4a985d92578971568d1412f625bca911d0fa1eee1fe"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32708,7 +32708,7 @@ rule REVERSINGLABS_Win32_Ransomware_Avoslocker : TC_DETECTION MALICIOUS MALWARE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ($import_key) and ($encrypt_files)
+		uint16( 0 ) == 0x5A4D and ( $enum_resources ) and ( $find_files ) and ( $import_key ) and ( $encrypt_files )
 }
 import "pe"
 
@@ -32717,13 +32717,13 @@ rule REVERSINGLABS_Cert_Blocklist_05E2E6A4Cd09Ea54D665B075Fe22A256 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "824c6b2f-081a-5f38-b949-d802f59e6ced"
+		id = "74e54dc0-a87e-504b-8b84-b9c5250d5460"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L27-L43"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "43da21d9c7ae9bfcc7fe4ee69f9d46cbce1954785d56c1d424b36deb8afe592e"
+		logic_hash = "v1_sha256_43da21d9c7ae9bfcc7fe4ee69f9d46cbce1954785d56c1d424b36deb8afe592e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32733,7 +32733,7 @@ rule REVERSINGLABS_Cert_Blocklist_05E2E6A4Cd09Ea54D665B075Fe22A256 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "*.google.com" and pe.signatures[i].serial=="05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "*.google.com" and pe.signatures [ i ] . serial == "05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32742,13 +32742,13 @@ rule REVERSINGLABS_Cert_Blocklist_77019A082385E4B73F569569C9F87Bb8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4046a31b-d7c8-5c63-b5b2-2179b0817b03"
+		id = "4c18a7c7-23b4-5dcb-8afa-f6005be9510e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L45-L61"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8613986005bdd30d92e633fa2058be5c43f1c530b9dc6d80ec953f12f6d66ce7"
+		logic_hash = "v1_sha256_8613986005bdd30d92e633fa2058be5c43f1c530b9dc6d80ec953f12f6d66ce7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32758,7 +32758,7 @@ rule REVERSINGLABS_Cert_Blocklist_77019A082385E4B73F569569C9F87Bb8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AND LLC" and pe.signatures[i].serial=="77:01:9a:08:23:85:e4:b7:3f:56:95:69:c9:f8:7b:b8" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AND LLC" and pe.signatures [ i ] . serial == "77:01:9a:08:23:85:e4:b7:3f:56:95:69:c9:f8:7b:b8" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32767,13 +32767,13 @@ rule REVERSINGLABS_Cert_Blocklist_4F2Ef29Ca5F96E5777B82C62F34Fd3A6 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "6cfb6ae0-8eba-503b-8bb7-ac72746d9aa2"
+		id = "3affd4a4-b6e1-50ee-8412-50d98c4e6a93"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L63-L79"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e8f27c4a72f416a16acabb1de606fdde7dc694256809fdb952a25313dda0d34e"
+		logic_hash = "v1_sha256_e8f27c4a72f416a16acabb1de606fdde7dc694256809fdb952a25313dda0d34e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32783,7 +32783,7 @@ rule REVERSINGLABS_Cert_Blocklist_4F2Ef29Ca5F96E5777B82C62F34Fd3A6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bit9, Inc" and pe.signatures[i].serial=="4f:2e:f2:9c:a5:f9:6e:57:77:b8:2c:62:f3:4f:d3:a6" and 1342051200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bit9, Inc" and pe.signatures [ i ] . serial == "4f:2e:f2:9c:a5:f9:6e:57:77:b8:2c:62:f3:4f:d3:a6" and 1342051200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32792,13 +32792,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Cc1Db2Ad0A290A4Bfe7A5F336D6800C : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "89bc7c99-dea2-50ce-a0d2-4292c14d049e"
+		id = "11e119de-9832-5370-9198-fa9162a490eb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L81-L97"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c9f91edb525a02041bc20dff25ec58323f8fabd4d2a2eca63238ecb10ccef2a6"
+		logic_hash = "v1_sha256_c9f91edb525a02041bc20dff25ec58323f8fabd4d2a2eca63238ecb10ccef2a6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32808,7 +32808,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Cc1Db2Ad0A290A4Bfe7A5F336D6800C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bit9, Inc" and pe.signatures[i].serial=="7c:c1:db:2a:d0:a2:90:a4:bf:e7:a5:f3:36:d6:80:0c" and 1342051200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bit9, Inc" and pe.signatures [ i ] . serial == "7c:c1:db:2a:d0:a2:90:a4:bf:e7:a5:f3:36:d6:80:0c" and 1342051200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32817,13 +32817,13 @@ rule REVERSINGLABS_Cert_Blocklist_13C8351Aece71C731158980F575F4133 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b6a1eb97-f0da-571e-951c-57f49cf62057"
+		id = "aa38231a-6f8f-5b0c-b903-bd6c9e6e4af5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L99-L115"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f96723845adc8030b72c119311103d5c2cf136e79de226d31141d8b925ce8e75"
+		logic_hash = "v1_sha256_f96723845adc8030b72c119311103d5c2cf136e79de226d31141d8b925ce8e75"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32833,7 +32833,7 @@ rule REVERSINGLABS_Cert_Blocklist_13C8351Aece71C731158980F575F4133 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Opera Software ASA" and pe.signatures[i].serial=="13:c8:35:1a:ec:e7:1c:73:11:58:98:0f:57:5f:41:33" and 1371513600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Opera Software ASA" and pe.signatures [ i ] . serial == "13:c8:35:1a:ec:e7:1c:73:11:58:98:0f:57:5f:41:33" and 1371513600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32842,13 +32842,13 @@ rule REVERSINGLABS_Cert_Blocklist_4531954F6265304055F66Ce4F624F95B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "da1aaa4c-ac71-5c4c-b663-3d1b57d69040"
+		id = "b4f36de6-9443-5726-a866-80089e115f46"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L117-L133"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "58d3a2a5e3f6730f329bddb171ad6332794fa95848825b892c3b8324f503ae89"
+		logic_hash = "v1_sha256_58d3a2a5e3f6730f329bddb171ad6332794fa95848825b892c3b8324f503ae89"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32858,7 +32858,7 @@ rule REVERSINGLABS_Cert_Blocklist_4531954F6265304055F66Ce4F624F95B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IDAutomation.com" and pe.signatures[i].serial=="45:31:95:4f:62:65:30:40:55:f6:6c:e4:f6:24:f9:5b" and 1384819199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IDAutomation.com" and pe.signatures [ i ] . serial == "45:31:95:4f:62:65:30:40:55:f6:6c:e4:f6:24:f9:5b" and 1384819199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32867,13 +32867,13 @@ rule REVERSINGLABS_Cert_Blocklist_0E808F231515Bc519Eea1A73Cdf3266F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Careto malware."
 		author = "ReversingLabs"
-		id = "1f1eb5c2-bfef-58df-b51e-c558d87cd5d2"
+		id = "374ab19a-66be-5467-ad4a-eb084c1ab343"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L135-L151"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "05e466e304ed7a8f5c1c93aac4a4b7019d6fb1e07aeb45d078b657f838d1f3bd"
+		logic_hash = "v1_sha256_05e466e304ed7a8f5c1c93aac4a4b7019d6fb1e07aeb45d078b657f838d1f3bd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32883,7 +32883,7 @@ rule REVERSINGLABS_Cert_Blocklist_0E808F231515Bc519Eea1A73Cdf3266F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TecSystem Ltd." and pe.signatures[i].serial=="0e:80:8f:23:15:15:bc:51:9e:ea:1a:73:cd:f3:26:6f" and 1468799999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TecSystem Ltd." and pe.signatures [ i ] . serial == "0e:80:8f:23:15:15:bc:51:9e:ea:1a:73:cd:f3:26:6f" and 1468799999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32892,13 +32892,13 @@ rule REVERSINGLABS_Cert_Blocklist_36Be4Ad457F062Fa77D87595B8Ccc8Cf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Careto malware."
 		author = "ReversingLabs"
-		id = "224ec8ed-e4f0-5d1b-8cdd-a669a7e3e859"
+		id = "b256c13b-c6ad-50f2-a785-717e3be04b61"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L153-L169"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d19a6f22a1e702a4da69c867195722adf8f1dd84539f2c584af428fe4b1caf79"
+		logic_hash = "v1_sha256_d19a6f22a1e702a4da69c867195722adf8f1dd84539f2c584af428fe4b1caf79"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32908,7 +32908,7 @@ rule REVERSINGLABS_Cert_Blocklist_36Be4Ad457F062Fa77D87595B8Ccc8Cf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TecSystem Ltd." and pe.signatures[i].serial=="36:be:4a:d4:57:f0:62:fa:77:d8:75:95:b8:cc:c8:cf" and 1372377599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TecSystem Ltd." and pe.signatures [ i ] . serial == "36:be:4a:d4:57:f0:62:fa:77:d8:75:95:b8:cc:c8:cf" and 1372377599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32917,13 +32917,13 @@ rule REVERSINGLABS_Cert_Blocklist_75A38507Bf403B152125B8F5Ce1B97Ad : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Zeus malware."
 		author = "ReversingLabs"
-		id = "6805abd8-217e-5179-ab5a-297e2a17e65e"
+		id = "16f81122-d09c-505c-982a-40c994160ab6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L171-L187"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "af21cee3ee92268c3aa0106a245e5a00c5ba892fca3e4fd2dc55e302ed5d470a"
+		logic_hash = "v1_sha256_af21cee3ee92268c3aa0106a245e5a00c5ba892fca3e4fd2dc55e302ed5d470a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32933,7 +32933,7 @@ rule REVERSINGLABS_Cert_Blocklist_75A38507Bf403B152125B8F5Ce1B97Ad : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "isonet ag" and pe.signatures[i].serial=="75:a3:85:07:bf:40:3b:15:21:25:b8:f5:ce:1b:97:ad" and 1395359999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "isonet ag" and pe.signatures [ i ] . serial == "75:a3:85:07:bf:40:3b:15:21:25:b8:f5:ce:1b:97:ad" and 1395359999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32942,13 +32942,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Effa8B216E24B16202940C1Bc2Fa8A5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "541a169e-a263-5901-9d8e-768306b8b8ba"
+		id = "294f1385-486e-5485-a706-20cac8669695"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L189-L205"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b5282fc85bbbee50c5307fff923e9e477fed8c011288e2ebd61c4b3ee801bc62"
+		logic_hash = "v1_sha256_b5282fc85bbbee50c5307fff923e9e477fed8c011288e2ebd61c4b3ee801bc62"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32958,7 +32958,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Effa8B216E24B16202940C1Bc2Fa8A5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Henan Maijiamai Technology Co., Ltd." and pe.signatures[i].serial=="4e:ff:a8:b2:16:e2:4b:16:20:29:40:c1:bc:2f:a8:a5" and 1404691199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Henan Maijiamai Technology Co., Ltd." and pe.signatures [ i ] . serial == "4e:ff:a8:b2:16:e2:4b:16:20:29:40:c1:bc:2f:a8:a5" and 1404691199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32967,13 +32967,13 @@ rule REVERSINGLABS_Cert_Blocklist_57D7153A89Bbf4729Be87F3C927043Aa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9b778a20-8a0c-5c9f-8cc3-9e5054713e13"
+		id = "fabbf43e-6750-57ad-9245-3d69db57235c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L207-L223"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a8de7951bd25c8a9346ef341d8bf9c9147f9fa6913e952be40fb43d3d7a370c1"
+		logic_hash = "v1_sha256_a8de7951bd25c8a9346ef341d8bf9c9147f9fa6913e952be40fb43d3d7a370c1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -32983,7 +32983,7 @@ rule REVERSINGLABS_Cert_Blocklist_57D7153A89Bbf4729Be87F3C927043Aa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, zhenganjun" and pe.signatures[i].serial=="57:d7:15:3a:89:bb:f4:72:9b:e8:7f:3c:92:70:43:aa" and 1469059200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, zhenganjun" and pe.signatures [ i ] . serial == "57:d7:15:3a:89:bb:f4:72:9b:e8:7f:3c:92:70:43:aa" and 1469059200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -32992,13 +32992,13 @@ rule REVERSINGLABS_Cert_Blocklist_028E1Deccf93D38Ecf396118Dfe908B4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6dfb0181-299f-5a28-b647-137d75f747a6"
+		id = "e43c15c5-be2c-544a-b400-503e4c4122cc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L225-L241"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b07c797652ef19c7e0b23c3eddbbbf2700160d743d71a0005b950160474638d8"
+		logic_hash = "v1_sha256_b07c797652ef19c7e0b23c3eddbbbf2700160d743d71a0005b950160474638d8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33008,7 +33008,7 @@ rule REVERSINGLABS_Cert_Blocklist_028E1Deccf93D38Ecf396118Dfe908B4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fortuna Games Co., Ltd." and pe.signatures[i].serial=="02:8e:1d:ec:cf:93:d3:8e:cf:39:61:18:df:e9:08:b4" and 1392163199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fortuna Games Co., Ltd." and pe.signatures [ i ] . serial == "02:8e:1d:ec:cf:93:d3:8e:cf:39:61:18:df:e9:08:b4" and 1392163199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33017,13 +33017,13 @@ rule REVERSINGLABS_Cert_Blocklist_40575Df73Eaa1B6140C7Ef62C08Bf216 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6a6e6320-8e01-5ec7-8119-3e90f1eacc4e"
+		id = "bb03fea5-e0c2-523b-9072-119c08b1c836"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L243-L259"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7da8e98f38413e5cbb18e3c7771c530afb766dd9fbeb8fdd2264617aff24f920"
+		logic_hash = "v1_sha256_7da8e98f38413e5cbb18e3c7771c530afb766dd9fbeb8fdd2264617aff24f920"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33033,7 +33033,7 @@ rule REVERSINGLABS_Cert_Blocklist_40575Df73Eaa1B6140C7Ef62C08Bf216 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dali Feifang Tech Co.,LTD." and pe.signatures[i].serial=="40:57:5d:f7:3e:aa:1b:61:40:c7:ef:62:c0:8b:f2:16" and 1394063999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dali Feifang Tech Co.,LTD." and pe.signatures [ i ] . serial == "40:57:5d:f7:3e:aa:1b:61:40:c7:ef:62:c0:8b:f2:16" and 1394063999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33042,13 +33042,13 @@ rule REVERSINGLABS_Cert_Blocklist_049Ce8C47F1F0E650Cb086F0Cfa7Ca53 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "aebba591-2024-584a-bba6-9a27049cf4b8"
+		id = "6622f335-30b2-57ad-b141-af3eb2a942a3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L261-L277"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9ae4a236e1252afc1db6fae4e388a53ebde7e724cc07c213d4bfc176cf0a0096"
+		logic_hash = "v1_sha256_9ae4a236e1252afc1db6fae4e388a53ebde7e724cc07c213d4bfc176cf0a0096"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33058,7 +33058,7 @@ rule REVERSINGLABS_Cert_Blocklist_049Ce8C47F1F0E650Cb086F0Cfa7Ca53 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Select'Assistance Pro" and pe.signatures[i].serial=="04:9c:e8:c4:7f:1f:0e:65:0c:b0:86:f0:cf:a7:ca:53" and 1393804799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Select'Assistance Pro" and pe.signatures [ i ] . serial == "04:9c:e8:c4:7f:1f:0e:65:0c:b0:86:f0:cf:a7:ca:53" and 1393804799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33067,13 +33067,13 @@ rule REVERSINGLABS_Cert_Blocklist_29F42680E653Cf8Fafd0E935553F7E86 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f616e92c-ed9f-581c-aa15-970bddfb073a"
+		id = "dd513a20-68ca-5a36-9e7e-fc15495c47c0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L279-L295"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6c726e4c2933a6472d256a18ea5265660ff035d05036ab9cae3409ab5a7c7598"
+		logic_hash = "v1_sha256_6c726e4c2933a6472d256a18ea5265660ff035d05036ab9cae3409ab5a7c7598"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33083,7 +33083,7 @@ rule REVERSINGLABS_Cert_Blocklist_29F42680E653Cf8Fafd0E935553F7E86 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Wemade Entertainment co.,Ltd" and pe.signatures[i].serial=="29:f4:26:80:e6:53:cf:8f:af:d0:e9:35:55:3f:7e:86" and 1390175999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Wemade Entertainment co.,Ltd" and pe.signatures [ i ] . serial == "29:f4:26:80:e6:53:cf:8f:af:d0:e9:35:55:3f:7e:86" and 1390175999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33092,13 +33092,13 @@ rule REVERSINGLABS_Cert_Blocklist_0C15 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4a7a5404-1a20-53a7-9670-6f5215582c9d"
+		id = "0ca07a33-8f75-543d-8c28-870e32f67295"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L297-L313"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1ee88813270dddeeedd90edbce9be2ce74303a6799ee64b0e9bfaea7377d3b2d"
+		logic_hash = "v1_sha256_1ee88813270dddeeedd90edbce9be2ce74303a6799ee64b0e9bfaea7377d3b2d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33108,7 +33108,7 @@ rule REVERSINGLABS_Cert_Blocklist_0C15 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "William Richard John" and pe.signatures[i].serial=="0c:15" and 1387324799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "William Richard John" and pe.signatures [ i ] . serial == "0c:15" and 1387324799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33117,13 +33117,13 @@ rule REVERSINGLABS_Cert_Blocklist_0C0F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "919a62ba-2902-5088-ad92-9f1bae23e68f"
+		id = "06caf6bc-a9a4-5f11-9d39-3adae6e38d55"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L315-L331"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0f8fda07dc362b7e04892446f1abe1e5f5717ee715824a2c1f6550096c366701"
+		logic_hash = "v1_sha256_0f8fda07dc362b7e04892446f1abe1e5f5717ee715824a2c1f6550096c366701"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33133,7 +33133,7 @@ rule REVERSINGLABS_Cert_Blocklist_0C0F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dmitry Vasilev" and pe.signatures[i].serial=="0c:0f" and 1386719999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dmitry Vasilev" and pe.signatures [ i ] . serial == "0c:0f" and 1386719999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33142,13 +33142,13 @@ rule REVERSINGLABS_Cert_Blocklist_06A164Ec5978497741Ee6Cec9966871B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6c73206d-3d5c-5540-a2e1-d00138d7e1b5"
+		id = "8962c47c-53b4-5050-9e03-6e90d2b0f143"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L333-L349"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8a27015d94a3bd8543a8ca9202831ffc9c9e65f61bf26ed6825c3e746b6af0d4"
+		logic_hash = "v1_sha256_8a27015d94a3bd8543a8ca9202831ffc9c9e65f61bf26ed6825c3e746b6af0d4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33158,7 +33158,7 @@ rule REVERSINGLABS_Cert_Blocklist_06A164Ec5978497741Ee6Cec9966871B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JOHN WILLIAM RICHARD" and pe.signatures[i].serial=="06:a1:64:ec:59:78:49:77:41:ee:6c:ec:99:66:87:1b" and 1385596799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JOHN WILLIAM RICHARD" and pe.signatures [ i ] . serial == "06:a1:64:ec:59:78:49:77:41:ee:6c:ec:99:66:87:1b" and 1385596799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33167,13 +33167,13 @@ rule REVERSINGLABS_Cert_Blocklist_1121Ed568764E75Be35574448Feadefcd3Bc : INFO FI
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "44fa007f-f5f7-5001-8b92-eb4a657ea756"
+		id = "a6fc788c-bbdc-5c78-8234-0ea986aa3be5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L351-L367"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3316a2536920c5aa9dd627cec7678e6fe33c722b4830dd740009c20dd013c9ab"
+		logic_hash = "v1_sha256_3316a2536920c5aa9dd627cec7678e6fe33c722b4830dd740009c20dd013c9ab"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33183,7 +33183,7 @@ rule REVERSINGLABS_Cert_Blocklist_1121Ed568764E75Be35574448Feadefcd3Bc : INFO FI
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FRINORTE COMERCIO DE PECAS E SERVICOS LTDA - ME" and pe.signatures[i].serial=="11:21:ed:56:87:64:e7:5b:e3:55:74:44:8f:ea:de:fc:d3:bc" and 1385337599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FRINORTE COMERCIO DE PECAS E SERVICOS LTDA - ME" and pe.signatures [ i ] . serial == "11:21:ed:56:87:64:e7:5b:e3:55:74:44:8f:ea:de:fc:d3:bc" and 1385337599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33192,13 +33192,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Ed2450Ceac0F72E73Fda1727E66E654 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c19ddbde-eec0-5ebb-8f11-1e7dcb489bc8"
+		id = "d7c40af6-ece5-5c1a-8ec0-e34a0dbb31ee"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L369-L385"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0e5af7795c825367d441c8abc2aa835fa83083eb8ee1f723c7d2dacff1ca88ff"
+		logic_hash = "v1_sha256_0e5af7795c825367d441c8abc2aa835fa83083eb8ee1f723c7d2dacff1ca88ff"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33208,7 +33208,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Ed2450Ceac0F72E73Fda1727E66E654 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hohhot Handing Trade and Business Co., Ltd." and pe.signatures[i].serial=="6e:d2:45:0c:ea:c0:f7:2e:73:fd:a1:72:7e:66:e6:54" and 1376092799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Hohhot Handing Trade and Business Co., Ltd." and pe.signatures [ i ] . serial == "6e:d2:45:0c:ea:c0:f7:2e:73:fd:a1:72:7e:66:e6:54" and 1376092799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33217,13 +33217,13 @@ rule REVERSINGLABS_Cert_Blocklist_32665079C5A5854A6833623Ca77Ff5Ac : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7078e95f-8bbe-5446-b9cb-c079f8448cb1"
+		id = "3d98324d-4605-5613-995a-ba53c4b4deea"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L387-L403"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6b734ca733c5fbadcb490ffd4c19c951e0fc17dd9b660eca948b126038c42cdb"
+		logic_hash = "v1_sha256_6b734ca733c5fbadcb490ffd4c19c951e0fc17dd9b660eca948b126038c42cdb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33233,7 +33233,7 @@ rule REVERSINGLABS_Cert_Blocklist_32665079C5A5854A6833623Ca77Ff5Ac : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ohanae" and pe.signatures[i].serial=="32:66:50:79:c5:a5:85:4a:68:33:62:3c:a7:7f:f5:ac" and 1381967999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ohanae" and pe.signatures [ i ] . serial == "32:66:50:79:c5:a5:85:4a:68:33:62:3c:a7:7f:f5:ac" and 1381967999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33242,13 +33242,13 @@ rule REVERSINGLABS_Cert_Blocklist_01A90094C83412C00Cf98Dd2Eb0D7042 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e5059974-9ea2-5497-a728-c21a6cdd30e4"
+		id = "6d2c33f9-4b0b-5eea-b866-ffce6b67b1aa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L405-L421"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5a3de0e6de5cda39e40988f9e2324cbee3e059aff5ceaf7fd819de8bf7215808"
+		logic_hash = "v1_sha256_5a3de0e6de5cda39e40988f9e2324cbee3e059aff5ceaf7fd819de8bf7215808"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33258,7 +33258,7 @@ rule REVERSINGLABS_Cert_Blocklist_01A90094C83412C00Cf98Dd2Eb0D7042 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FreeVox SA" and pe.signatures[i].serial=="01:a9:00:94:c8:34:12:c0:0c:f9:8d:d2:eb:0d:70:42" and 1376956799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FreeVox SA" and pe.signatures [ i ] . serial == "01:a9:00:94:c8:34:12:c0:0c:f9:8d:d2:eb:0d:70:42" and 1376956799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33267,13 +33267,13 @@ rule REVERSINGLABS_Cert_Blocklist_55Efe24B9674855Baf16E67716479C71 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c1a4102e-ce78-5a4d-95ea-b9e394df0c28"
+		id = "d1074848-c9a1-5400-a6b2-459b92679b1c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L423-L439"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2cf7a76ae3c3a698564013ff545c74d0319face5aa19416c93bf10f45f84f8c9"
+		logic_hash = "v1_sha256_2cf7a76ae3c3a698564013ff545c74d0319face5aa19416c93bf10f45f84f8c9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33283,7 +33283,7 @@ rule REVERSINGLABS_Cert_Blocklist_55Efe24B9674855Baf16E67716479C71 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "S2BVISIO BELGIQUE SA" and pe.signatures[i].serial=="55:ef:e2:4b:96:74:85:5b:af:16:e6:77:16:47:9c:71" and 1374451199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "S2BVISIO BELGIQUE SA" and pe.signatures [ i ] . serial == "55:ef:e2:4b:96:74:85:5b:af:16:e6:77:16:47:9c:71" and 1374451199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33292,13 +33292,13 @@ rule REVERSINGLABS_Cert_Blocklist_094Bf19D509D3074913995160B195B6C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8241e2c6-e4e7-581c-b759-6314d2e28a4d"
+		id = "c306f52d-270c-5ccf-a430-d792f804b7b8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L441-L457"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3c1ed012716f36876d9375838befb9821b87cafc6aca57a0f18392f80f5ba325"
+		logic_hash = "v1_sha256_3c1ed012716f36876d9375838befb9821b87cafc6aca57a0f18392f80f5ba325"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33308,7 +33308,7 @@ rule REVERSINGLABS_Cert_Blocklist_094Bf19D509D3074913995160B195B6C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Porral Twinware S.L.L." and pe.signatures[i].serial=="09:4b:f1:9d:50:9d:30:74:91:39:95:16:0b:19:5b:6c" and 1373241599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Porral Twinware S.L.L." and pe.signatures [ i ] . serial == "09:4b:f1:9d:50:9d:30:74:91:39:95:16:0b:19:5b:6c" and 1373241599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33317,13 +33317,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A77Cf3Ba49B64E6Cbe5Fb4A6A6Aacc6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4fb06917-ccbd-514c-a936-e337c31c6e65"
+		id = "6bae9d83-fffc-53c1-b61a-4cb97a5216d3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L459-L475"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3bebc4a36b57526505167d8f075d468e4775d66c81ce08644c506d9be94efba0"
+		logic_hash = "v1_sha256_3bebc4a36b57526505167d8f075d468e4775d66c81ce08644c506d9be94efba0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33333,7 +33333,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A77Cf3Ba49B64E6Cbe5Fb4A6A6Aacc6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "I.ST.SAN. Srl" and pe.signatures[i].serial=="0a:77:cf:3b:a4:9b:64:e6:cb:e5:fb:4a:6a:6a:ac:c6" and 1371081599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "I.ST.SAN. Srl" and pe.signatures [ i ] . serial == "0a:77:cf:3b:a4:9b:64:e6:cb:e5:fb:4a:6a:6a:ac:c6" and 1371081599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33342,13 +33342,13 @@ rule REVERSINGLABS_Cert_Blocklist_1F4C22Da1107D20C1Eda04569D58E573 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4ff75d18-926e-51aa-8e1c-b9699669bbd0"
+		id = "68bcabbb-8ad3-549c-b4f0-11089f66addf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L477-L493"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fe19c4b21c3b70ec571461ca6d9c370a971c01f2d68e3c3916aa1fa0f13b20f8"
+		logic_hash = "v1_sha256_fe19c4b21c3b70ec571461ca6d9c370a971c01f2d68e3c3916aa1fa0f13b20f8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33358,7 +33358,7 @@ rule REVERSINGLABS_Cert_Blocklist_1F4C22Da1107D20C1Eda04569D58E573 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PlanView, Inc." and pe.signatures[i].serial=="1f:4c:22:da:11:07:d2:0c:1e:da:04:56:9d:58:e5:73" and 1366156799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PlanView, Inc." and pe.signatures [ i ] . serial == "1f:4c:22:da:11:07:d2:0c:1e:da:04:56:9d:58:e5:73" and 1366156799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33367,13 +33367,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Fe68D48634893D18De040D8F1C289D2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "40aed582-2960-5b42-acde-7350a2595b4b"
+		id = "49ec12c2-7573-5695-8669-207c77c1893d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L495-L511"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "41feebc8800a084ac369b5c5721b1362d371bd503b67823986bad2839157a4b0"
+		logic_hash = "v1_sha256_41feebc8800a084ac369b5c5721b1362d371bd503b67823986bad2839157a4b0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33383,7 +33383,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Fe68D48634893D18De040D8F1C289D2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xinghua Yile Network Tech Co.,Ltd." and pe.signatures[i].serial=="4f:e6:8d:48:63:48:93:d1:8d:e0:40:d8:f1:c2:89:d2" and 1371081600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xinghua Yile Network Tech Co.,Ltd." and pe.signatures [ i ] . serial == "4f:e6:8d:48:63:48:93:d1:8d:e0:40:d8:f1:c2:89:d2" and 1371081600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33392,13 +33392,13 @@ rule REVERSINGLABS_Cert_Blocklist_6767Def972D6Ea702D8C8A53Af1832D3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c60497b4-5abe-52b0-aac9-88953ea6cdf1"
+		id = "df69d46c-a443-5e33-b261-e1389f2eb03c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L513-L529"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "aa7f997449b4b8dcf488cfb7f45ee98ca540d39fb861f5b01ff4bb4aa1875b72"
+		logic_hash = "v1_sha256_aa7f997449b4b8dcf488cfb7f45ee98ca540d39fb861f5b01ff4bb4aa1875b72"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33408,7 +33408,7 @@ rule REVERSINGLABS_Cert_Blocklist_6767Def972D6Ea702D8C8A53Af1832D3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Guangzhou typical corner Network Technology Co., Ltd." and pe.signatures[i].serial=="67:67:de:f9:72:d6:ea:70:2d:8c:8a:53:af:18:32:d3" and 1361750400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Guangzhou typical corner Network Technology Co., Ltd." and pe.signatures [ i ] . serial == "67:67:de:f9:72:d6:ea:70:2d:8c:8a:53:af:18:32:d3" and 1361750400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33417,13 +33417,13 @@ rule REVERSINGLABS_Cert_Blocklist_06477E3425F1448995Ced539789E6842 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "21da6056-bf4e-5fc4-bef5-37010ebe8f05"
+		id = "55acdab2-95ad-542e-9abb-aeeed6bc1715"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L531-L547"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c0bc7808bb6bcc8273a887203c1b47d1a49fcb7719863e6bc97b5c7404a254f7"
+		logic_hash = "v1_sha256_c0bc7808bb6bcc8273a887203c1b47d1a49fcb7719863e6bc97b5c7404a254f7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33433,7 +33433,7 @@ rule REVERSINGLABS_Cert_Blocklist_06477E3425F1448995Ced539789E6842 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Karim Lammali" and pe.signatures[i].serial=="06:47:7e:34:25:f1:44:89:95:ce:d5:39:78:9e:68:42" and 1334275199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Karim Lammali" and pe.signatures [ i ] . serial == "06:47:7e:34:25:f1:44:89:95:ce:d5:39:78:9e:68:42" and 1334275199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33442,13 +33442,13 @@ rule REVERSINGLABS_Cert_Blocklist_0450A7C1C36951Da09C8Ad0E7F716Ff2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b4a56bbe-f2ba-52df-832d-35b92ab73683"
+		id = "b29f9623-4cbb-5900-90d7-a76db41d20a5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L549-L565"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cb594607ceef1b8d79145ad3905fb2c38d2ed3f3e6c8a0a793fc2dc9d0a21855"
+		logic_hash = "v1_sha256_cb594607ceef1b8d79145ad3905fb2c38d2ed3f3e6c8a0a793fc2dc9d0a21855"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33458,7 +33458,7 @@ rule REVERSINGLABS_Cert_Blocklist_0450A7C1C36951Da09C8Ad0E7F716Ff2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PS Partnership" and pe.signatures[i].serial=="04:50:a7:c1:c3:69:51:da:09:c8:ad:0e:7f:71:6f:f2" and 1362182399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PS Partnership" and pe.signatures [ i ] . serial == "04:50:a7:c1:c3:69:51:da:09:c8:ad:0e:7f:71:6f:f2" and 1362182399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33467,13 +33467,13 @@ rule REVERSINGLABS_Cert_Blocklist_0F9Fbdab9B39645Cf3211F87Abb5Ddb7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ad24d2e9-ae3d-5fae-b58d-965bd1de2a99"
+		id = "9898f0b7-5f4b-51aa-8d4d-0efe3bb91b70"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L567-L583"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ba5885c7769b5ead261815880033b0df50dc4f7684fdb37398ab01bfebda0e37"
+		logic_hash = "v1_sha256_ba5885c7769b5ead261815880033b0df50dc4f7684fdb37398ab01bfebda0e37"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33483,7 +33483,7 @@ rule REVERSINGLABS_Cert_Blocklist_0F9Fbdab9B39645Cf3211F87Abb5Ddb7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "The Motivo Group, Inc." and pe.signatures[i].serial=="0f:9f:bd:ab:9b:39:64:5c:f3:21:1f:87:ab:b5:dd:b7" and 1361318399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "The Motivo Group, Inc." and pe.signatures [ i ] . serial == "0f:9f:bd:ab:9b:39:64:5c:f3:21:1f:87:ab:b5:dd:b7" and 1361318399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33492,13 +33492,13 @@ rule REVERSINGLABS_Cert_Blocklist_4211D2E4F0E87127319302C55B85Bcf2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dbe2a945-cf13-564a-a95a-24534c70a723"
+		id = "99752033-2532-52ed-8988-10023b7a8606"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L585-L601"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "edf9bbface7fe943dfa4f5a6e8469802ccdbd3de9d3e6b8fabebb024c21bb9a9"
+		logic_hash = "v1_sha256_edf9bbface7fe943dfa4f5a6e8469802ccdbd3de9d3e6b8fabebb024c21bb9a9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33508,7 +33508,7 @@ rule REVERSINGLABS_Cert_Blocklist_4211D2E4F0E87127319302C55B85Bcf2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "yinsheng xie" and pe.signatures[i].serial=="42:11:d2:e4:f0:e8:71:27:31:93:02:c5:5b:85:bc:f2" and 1360713599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "yinsheng xie" and pe.signatures [ i ] . serial == "42:11:d2:e4:f0:e8:71:27:31:93:02:c5:5b:85:bc:f2" and 1360713599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33517,13 +33517,13 @@ rule REVERSINGLABS_Cert_Blocklist_07B44Cdbfffb78De05F4261672A67312 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "18787692-1233-5ea8-869c-feb530d06237"
+		id = "616aa3ba-163a-55d0-9918-a707abde1948"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L603-L619"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c88a8543782fc49d8aa68f3fc8052bd3316d10118dfb2ef2eef5006de657b6f1"
+		logic_hash = "v1_sha256_c88a8543782fc49d8aa68f3fc8052bd3316d10118dfb2ef2eef5006de657b6f1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33533,7 +33533,7 @@ rule REVERSINGLABS_Cert_Blocklist_07B44Cdbfffb78De05F4261672A67312 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Buster Paper Comercial Ltda" and pe.signatures[i].serial=="07:b4:4c:db:ff:fb:78:de:05:f4:26:16:72:a6:73:12" and 1359503999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Buster Paper Comercial Ltda" and pe.signatures [ i ] . serial == "07:b4:4c:db:ff:fb:78:de:05:f4:26:16:72:a6:73:12" and 1359503999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33542,13 +33542,13 @@ rule REVERSINGLABS_Cert_Blocklist_4F8B9A1Ba5E60C754Dbb40Ddee7905E2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9b6ba6bb-a796-59e1-a38b-04d4b60a99a6"
+		id = "004c2d1c-b1b7-5408-88a9-a16663236135"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L621-L637"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2a0d07d47cd41db5dc170a29607b6c1f2e3b7c0785f83b211f68f9cb9368e350"
+		logic_hash = "v1_sha256_2a0d07d47cd41db5dc170a29607b6c1f2e3b7c0785f83b211f68f9cb9368e350"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33558,7 +33558,7 @@ rule REVERSINGLABS_Cert_Blocklist_4F8B9A1Ba5E60C754Dbb40Ddee7905E2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NOX Entertainment Co., Ltd" and pe.signatures[i].serial=="4f:8b:9a:1b:a5:e6:0c:75:4d:bb:40:dd:ee:79:05:e2" and 1348617599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NOX Entertainment Co., Ltd" and pe.signatures [ i ] . serial == "4f:8b:9a:1b:a5:e6:0c:75:4d:bb:40:dd:ee:79:05:e2" and 1348617599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33567,13 +33567,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A389B95Ee736Dd13Bc0Ed743Fd74D2F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "43cce248-2322-5607-8706-aeab046a30b9"
+		id = "b08f2c25-ac0f-5bfa-8522-26c78e54eca9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L639-L655"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8b83e4aa47cea7cadf4b4a9f4e044478a62f4233e082fb52f9ed906d80a552aa"
+		logic_hash = "v1_sha256_8b83e4aa47cea7cadf4b4a9f4e044478a62f4233e082fb52f9ed906d80a552aa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33583,7 +33583,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A389B95Ee736Dd13Bc0Ed743Fd74D2F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BUSTER ASSISTENCIA TECNICA ELETRONICA LTDA - ME" and pe.signatures[i].serial=="0a:38:9b:95:ee:73:6d:d1:3b:c0:ed:74:3f:d7:4d:2f" and 1351814399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BUSTER ASSISTENCIA TECNICA ELETRONICA LTDA - ME" and pe.signatures [ i ] . serial == "0a:38:9b:95:ee:73:6d:d1:3b:c0:ed:74:3f:d7:4d:2f" and 1351814399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33592,13 +33592,13 @@ rule REVERSINGLABS_Cert_Blocklist_1A3Faaeb3A8B93B2394Fec36345996E6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "343e4dbe-21a6-5758-be81-e5e7918c54fa"
+		id = "4c9abece-37fd-52f3-b86a-dfe3fdbc75d5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L657-L673"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a3bd9aaba8dbdb340b5d3013684584524eb08b11339985ba6ca0291b8c8bc692"
+		logic_hash = "v1_sha256_a3bd9aaba8dbdb340b5d3013684584524eb08b11339985ba6ca0291b8c8bc692"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33608,7 +33608,7 @@ rule REVERSINGLABS_Cert_Blocklist_1A3Faaeb3A8B93B2394Fec36345996E6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "salvatore macchiarella" and pe.signatures[i].serial=="1a:3f:aa:eb:3a:8b:93:b2:39:4f:ec:36:34:59:96:e6" and 1468454400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "salvatore macchiarella" and pe.signatures [ i ] . serial == "1a:3f:aa:eb:3a:8b:93:b2:39:4f:ec:36:34:59:96:e6" and 1468454400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33617,13 +33617,13 @@ rule REVERSINGLABS_Cert_Blocklist_1A35Acce5B0C77206B1C3Dc2A6A2417C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0e42ffb8-07f2-55e4-977d-7760e923d76d"
+		id = "c15c09d8-5a52-5830-8cff-b2292c5641c7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L675-L691"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ce161fdd511e0efa042516ead09c6ab5f8dcf54f2087cdccbfed8e7cdfbd25b2"
+		logic_hash = "v1_sha256_ce161fdd511e0efa042516ead09c6ab5f8dcf54f2087cdccbfed8e7cdfbd25b2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33633,7 +33633,7 @@ rule REVERSINGLABS_Cert_Blocklist_1A35Acce5B0C77206B1C3Dc2A6A2417C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "cd ingegneri associati srl" and pe.signatures[i].serial=="1a:35:ac:ce:5b:0c:77:20:6b:1c:3d:c2:a6:a2:41:7c" and 1166054399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "cd ingegneri associati srl" and pe.signatures [ i ] . serial == "1a:35:ac:ce:5b:0c:77:20:6b:1c:3d:c2:a6:a2:41:7c" and 1166054399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33642,13 +33642,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Eb40Ea11Eaac847B050De9B59E25Bdc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e9f94ae9-0158-5789-b4d2-88f750442274"
+		id = "983ebcbf-1ae2-5476-9c1e-351dd1393800"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L693-L709"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d0e7ab78fb42c9a8f19cba8e6a8b15d584651a23f1088e1f311589d46145e963"
+		logic_hash = "v1_sha256_d0e7ab78fb42c9a8f19cba8e6a8b15d584651a23f1088e1f311589d46145e963"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33658,7 +33658,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Eb40Ea11Eaac847B050De9B59E25Bdc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "My Free Internet Update" and pe.signatures[i].serial=="6e:b4:0e:a1:1e:aa:c8:47:b0:50:de:9b:59:e2:5b:dc" and 1062201599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "My Free Internet Update" and pe.signatures [ i ] . serial == "6e:b4:0e:a1:1e:aa:c8:47:b0:50:de:9b:59:e2:5b:dc" and 1062201599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33667,13 +33667,13 @@ rule REVERSINGLABS_Cert_Blocklist_6724340Ddbc7252F7Fb714B812A5C04D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2b61de88-9fea-5c3f-a7ab-db91e90b4965"
+		id = "c129e911-dd5f-5a03-8706-56db1c553c58"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L711-L727"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bc72c2ca5f81198684233e23260831da5b9ef4e7ac5a25abbdb303eecc38bd53"
+		logic_hash = "v1_sha256_bc72c2ca5f81198684233e23260831da5b9ef4e7ac5a25abbdb303eecc38bd53"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33683,7 +33683,7 @@ rule REVERSINGLABS_Cert_Blocklist_6724340Ddbc7252F7Fb714B812A5C04D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "YNK JAPAN Inc" and pe.signatures[i].serial=="67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d" and 1306195199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "YNK JAPAN Inc" and pe.signatures [ i ] . serial == "67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d" and 1306195199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33692,13 +33692,13 @@ rule REVERSINGLABS_Cert_Blocklist_0813Ee9B7B9D7C46001D6Bc8784Df1Dd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0915fae0-ac6f-5a92-ab44-80f840fd5061"
+		id = "9afe28b5-b524-520a-9f8c-7f748fa48f65"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L729-L745"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1a25a2f25fa8d5075113cbafb73e80e741268d6b2f9e629fd54ffca9e82409b0"
+		logic_hash = "v1_sha256_1a25a2f25fa8d5075113cbafb73e80e741268d6b2f9e629fd54ffca9e82409b0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33708,7 +33708,7 @@ rule REVERSINGLABS_Cert_Blocklist_0813Ee9B7B9D7C46001D6Bc8784Df1Dd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Les Garcons s'habillent" and pe.signatures[i].serial=="08:13:ee:9b:7b:9d:7c:46:00:1d:6b:c8:78:4d:f1:dd" and 1334707199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Les Garcons s'habillent" and pe.signatures [ i ] . serial == "08:13:ee:9b:7b:9d:7c:46:00:1d:6b:c8:78:4d:f1:dd" and 1334707199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33717,13 +33717,13 @@ rule REVERSINGLABS_Cert_Blocklist_530591C61B5E1212F659138B7Cea0A97 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "71cf0653-5aab-5d5c-aa3a-f42f40196412"
+		id = "3866d6a5-c700-5695-864f-f1229f4e04ec"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L747-L763"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0ef01e542d145475713bbd373bdcdae5f25bfd823a60e7d40fe9a6b6039c83e0"
+		logic_hash = "v1_sha256_0ef01e542d145475713bbd373bdcdae5f25bfd823a60e7d40fe9a6b6039c83e0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33733,7 +33733,7 @@ rule REVERSINGLABS_Cert_Blocklist_530591C61B5E1212F659138B7Cea0A97 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x97\\xA5\\xE7\\x85\\xA7\\xE5\\xB3\\xB0\\xE5\\xB7\\x9D\\xE5\\x9B\\xBD\\xE9\\x99\\x85\\xE7\\x9F\\xBF\\xE4\\xB8\\x9A\\xE8\\xB4\\xB8\\xE6\\x98\\x93\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="53:05:91:c6:1b:5e:12:12:f6:59:13:8b:7c:ea:0a:97" and 1403654399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE6\\x97\\xA5\\xE7\\x85\\xA7\\xE5\\xB3\\xB0\\xE5\\xB7\\x9D\\xE5\\x9B\\xBD\\xE9\\x99\\x85\\xE7\\x9F\\xBF\\xE4\\xB8\\x9A\\xE8\\xB4\\xB8\\xE6\\x98\\x93\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "53:05:91:c6:1b:5e:12:12:f6:59:13:8b:7c:ea:0a:97" and 1403654399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33742,13 +33742,13 @@ rule REVERSINGLABS_Cert_Blocklist_07270Ff9 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "fcd2d82a-b51d-53ff-bfae-3c83147c1903"
+		id = "eb2c068b-f175-541b-911e-fe193af2aeb1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L765-L781"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8f0da7c330464184fa1d5bf8d51dd8ad2e8637710a36972dcab03629cb57e910"
+		logic_hash = "v1_sha256_8f0da7c330464184fa1d5bf8d51dd8ad2e8637710a36972dcab03629cb57e910"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33758,7 +33758,7 @@ rule REVERSINGLABS_Cert_Blocklist_07270Ff9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar Cyber CA" and pe.signatures[i].serial=="07:27:0f:f9" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar Cyber CA" and pe.signatures [ i ] . serial == "07:27:0f:f9" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33767,13 +33767,13 @@ rule REVERSINGLABS_Cert_Blocklist_0727100D : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "1ee866ec-a445-5a79-b824-37f28a49f20b"
+		id = "b5f61bb9-bb58-5064-84ee-963744c6fd31"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L783-L799"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a09f4004ed002b90d67a3baddde74832e6c7b70e8b330347ef169460750aa344"
+		logic_hash = "v1_sha256_a09f4004ed002b90d67a3baddde74832e6c7b70e8b330347ef169460750aa344"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33783,7 +33783,7 @@ rule REVERSINGLABS_Cert_Blocklist_0727100D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar Cyber CA" and pe.signatures[i].serial=="07:27:10:0d" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar Cyber CA" and pe.signatures [ i ] . serial == "07:27:10:0d" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33792,13 +33792,13 @@ rule REVERSINGLABS_Cert_Blocklist_07271003 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "7573c436-5bf9-5522-9952-e30dbbccd092"
+		id = "457c2218-ad90-5e68-b97a-a54bfbaa7648"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L801-L817"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "14c201b4fdda5b3553732a173a3d6705129c54f2a50d26997d63a77be8504285"
+		logic_hash = "v1_sha256_14c201b4fdda5b3553732a173a3d6705129c54f2a50d26997d63a77be8504285"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33808,7 +33808,7 @@ rule REVERSINGLABS_Cert_Blocklist_07271003 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar Cyber CA" and pe.signatures[i].serial=="07:27:10:03" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar Cyber CA" and pe.signatures [ i ] . serial == "07:27:10:03" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33817,13 +33817,13 @@ rule REVERSINGLABS_Cert_Blocklist_013134Bf : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "a3292707-c481-56a8-abf9-e1a762c76cb6"
+		id = "4e73717a-91a7-5f63-b6b4-009b582e5d12"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L819-L835"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1ade100c310c22bce25bcc6687855bd4eb6364b64cf31514b2548509a16e4a36"
+		logic_hash = "v1_sha256_1ade100c310c22bce25bcc6687855bd4eb6364b64cf31514b2548509a16e4a36"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33833,7 +33833,7 @@ rule REVERSINGLABS_Cert_Blocklist_013134Bf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar PKIoverheid CA Organisatie - G2" and pe.signatures[i].serial=="01:31:34:bf" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar PKIoverheid CA Organisatie - G2" and pe.signatures [ i ] . serial == "01:31:34:bf" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33842,13 +33842,13 @@ rule REVERSINGLABS_Cert_Blocklist_01314476 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "e0a52ad1-cebd-5ffc-953f-e0b09fc6d710"
+		id = "43aafa3a-ffdd-5a29-8b58-104948bfbd3c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L837-L853"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6f2f3f3ae009fbb9ebe589fc6b640be89c4a7b734eda515f182c7e9c9ffb4779"
+		logic_hash = "v1_sha256_6f2f3f3ae009fbb9ebe589fc6b640be89c4a7b734eda515f182c7e9c9ffb4779"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33858,7 +33858,7 @@ rule REVERSINGLABS_Cert_Blocklist_01314476 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar PKIoverheid CA Overheid" and pe.signatures[i].serial=="01:31:44:76" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar PKIoverheid CA Overheid" and pe.signatures [ i ] . serial == "01:31:44:76" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33867,13 +33867,13 @@ rule REVERSINGLABS_Cert_Blocklist_013169B0 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "a5f68c0a-635a-5aa9-94d2-7628999f06c2"
+		id = "2e16665b-3764-5ff0-b667-e269a7ece222"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L855-L871"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "354421ebad7fd0b73c9ba63630c91d481901ca9ec39be3c6b66843221e4b5aad"
+		logic_hash = "v1_sha256_354421ebad7fd0b73c9ba63630c91d481901ca9ec39be3c6b66843221e4b5aad"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33883,7 +33883,7 @@ rule REVERSINGLABS_Cert_Blocklist_013169B0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar PKIoverheid CA Overheid en Bedrijven" and pe.signatures[i].serial=="01:31:69:b0" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar PKIoverheid CA Overheid en Bedrijven" and pe.signatures [ i ] . serial == "01:31:69:b0" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33892,13 +33892,13 @@ rule REVERSINGLABS_Cert_Blocklist_0C76Da9C910C4E2C9Efe15D058933C4C : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "a9b06d49-1ab2-539e-bd1f-16da40b654b2"
+		id = "008bc831-2634-56f3-82bb-d1cd19b3c263"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L873-L889"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "883e93bff42161ba68f69fb17f7e78377d7f3cb6b6cdf72cffb4166466f8bc7b"
+		logic_hash = "v1_sha256_883e93bff42161ba68f69fb17f7e78377d7f3cb6b6cdf72cffb4166466f8bc7b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33908,7 +33908,7 @@ rule REVERSINGLABS_Cert_Blocklist_0C76Da9C910C4E2C9Efe15D058933C4C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar Root CA" and pe.signatures[i].serial=="0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4c" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar Root CA" and pe.signatures [ i ] . serial == "0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4c" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33917,13 +33917,13 @@ rule REVERSINGLABS_Cert_Blocklist_469C2Caf : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "12d7c4a8-0a84-502a-855b-674972a2e2e1"
+		id = "9d379a33-fe23-5627-8513-1f196869678e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L891-L907"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2490dbd74a5d3eede494d284f96af835c270d2fb0752b887aadbaf92bf34e6d4"
+		logic_hash = "v1_sha256_2490dbd74a5d3eede494d284f96af835c270d2fb0752b887aadbaf92bf34e6d4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33933,7 +33933,7 @@ rule REVERSINGLABS_Cert_Blocklist_469C2Caf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar Root CA" and pe.signatures[i].serial=="46:9c:2c:af" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar Root CA" and pe.signatures [ i ] . serial == "46:9c:2c:af" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33942,13 +33942,13 @@ rule REVERSINGLABS_Cert_Blocklist_469C3Cc9 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "36d76a9f-d18f-56bf-b00a-f7320f04f39a"
+		id = "af049b58-3b7d-52ed-b005-5bb37dc39ccf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L909-L925"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7327b7cbeb616bc46c82975aed6b3ea1caafa74fd431e2d98ca55b00851e22c8"
+		logic_hash = "v1_sha256_7327b7cbeb616bc46c82975aed6b3ea1caafa74fd431e2d98ca55b00851e22c8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33958,7 +33958,7 @@ rule REVERSINGLABS_Cert_Blocklist_469C3Cc9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar Root CA" and pe.signatures[i].serial=="46:9c:3c:c9" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar Root CA" and pe.signatures [ i ] . serial == "46:9c:3c:c9" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33967,13 +33967,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A82Bd1E144E8814D75B1A5527Bebf3E : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "f3d7d714-8085-524a-814c-ab8cc59ceb4f"
+		id = "ffabaf6b-264e-5961-b70a-3144f9b06d01"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L927-L943"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2534e58ce1e5adbb10dbacb664d40cc32faec341bdb93b926cc85b666cc7b77e"
+		logic_hash = "v1_sha256_2534e58ce1e5adbb10dbacb664d40cc32faec341bdb93b926cc85b666cc7b77e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -33983,7 +33983,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A82Bd1E144E8814D75B1A5527Bebf3E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar Root CA G2" and pe.signatures[i].serial=="0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3e" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar Root CA G2" and pe.signatures [ i ] . serial == "0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3e" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -33992,13 +33992,13 @@ rule REVERSINGLABS_Cert_Blocklist_469C2Cb0 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "dd19b988-747d-55b9-825b-2ada1ca83691"
+		id = "7c3d2b3c-3ca4-5f78-9171-739e2502da30"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L945-L961"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "67ff84475cbe231f97daa3ce623689e7936db8e56be562778f8a4c1ebf7bf316"
+		logic_hash = "v1_sha256_67ff84475cbe231f97daa3ce623689e7936db8e56be562778f8a4c1ebf7bf316"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34008,7 +34008,7 @@ rule REVERSINGLABS_Cert_Blocklist_469C2Cb0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DigiNotar Services 1024 CA" and pe.signatures[i].serial=="46:9c:2c:b0" and 1308182400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DigiNotar Services 1024 CA" and pe.signatures [ i ] . serial == "46:9c:2c:b0" and 1308182400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34017,13 +34017,13 @@ rule REVERSINGLABS_Cert_Blocklist_4C0E636A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "beb2039c-3b0e-5649-96ca-40175493e62c"
+		id = "dc06d595-041d-50aa-b430-43308496227b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L963-L979"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "20169cf9ce3f271a22d1376bcf0ff0914f43937738c9ed61fd8e40179405136b"
+		logic_hash = "v1_sha256_20169cf9ce3f271a22d1376bcf0ff0914f43937738c9ed61fd8e40179405136b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34033,7 +34033,7 @@ rule REVERSINGLABS_Cert_Blocklist_4C0E636A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Digisign Server ID - (Enrich)" and pe.signatures[i].serial=="4c:0e:63:6a" and 1320191999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Digisign Server ID - (Enrich)" and pe.signatures [ i ] . serial == "4c:0e:63:6a" and 1320191999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34042,13 +34042,13 @@ rule REVERSINGLABS_Cert_Blocklist_072714A9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "15ad6936-78a4-58b1-8c68-27ec4ed38649"
+		id = "ba228fe2-0b8a-5a2d-944d-a4526b547430"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L981-L997"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8bea4cfb60056446043ef90a7d01ecc52d82d9e7005a145a4daa61a522ecd2ae"
+		logic_hash = "v1_sha256_8bea4cfb60056446043ef90a7d01ecc52d82d9e7005a145a4daa61a522ecd2ae"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34058,7 +34058,7 @@ rule REVERSINGLABS_Cert_Blocklist_072714A9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Digisign Server ID (Enrich)" and pe.signatures[i].serial=="07:27:14:a9" and 1320191999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Digisign Server ID (Enrich)" and pe.signatures [ i ] . serial == "07:27:14:a9" and 1320191999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34067,13 +34067,13 @@ rule REVERSINGLABS_Cert_Blocklist_00D8F35F4Eb7872B2Dab0692E315382Fb0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2c051732-76d7-5562-a79e-c5bbdc8373b2"
+		id = "744f2f0f-44bd-5620-bcc8-16641a58133c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L999-L1017"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "463757c59c32859163ea80e694e1f39239c857124aad3895f22f83b47645910c"
+		logic_hash = "v1_sha256_463757c59c32859163ea80e694e1f39239c857124aad3895f22f83b47645910c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34083,7 +34083,7 @@ rule REVERSINGLABS_Cert_Blocklist_00D8F35F4Eb7872B2Dab0692E315382Fb0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "global trustee" and (pe.signatures[i].serial=="00:d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0" or pe.signatures[i].serial=="d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0") and 1300060800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "global trustee" and ( pe.signatures [ i ] . serial == "00:d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0" or pe.signatures [ i ] . serial == "d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0" ) and 1300060800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34092,13 +34092,13 @@ rule REVERSINGLABS_Cert_Blocklist_750E40Ff97F047Edf556C7084Eb1Abfd : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "7ae4ba81-82be-57f9-aa8c-0e5c30e412c6"
+		id = "4d02b423-cf06-5ec8-9b15-d5bfa989e479"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1019-L1035"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "21c2468905514e1725a206814b0c61c576cf7f97f184bac857bca9283f49a957"
+		logic_hash = "v1_sha256_21c2468905514e1725a206814b0c61c576cf7f97f184bac857bca9283f49a957"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34108,7 +34108,7 @@ rule REVERSINGLABS_Cert_Blocklist_750E40Ff97F047Edf556C7084Eb1Abfd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Corporation" and pe.signatures[i].serial=="75:0e:40:ff:97:f0:47:ed:f5:56:c7:08:4e:b1:ab:fd" and 980899199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Microsoft Corporation" and pe.signatures [ i ] . serial == "75:0e:40:ff:97:f0:47:ed:f5:56:c7:08:4e:b1:ab:fd" and 980899199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34117,13 +34117,13 @@ rule REVERSINGLABS_Cert_Blocklist_1B5190F73724399C9254Cd424637996A : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "dfb08450-c35c-5b7b-9d04-2c9a6af9bcf8"
+		id = "3d4ef9bc-22e7-59fa-b20b-451c2cee7015"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1037-L1053"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "08f287ccda93e03a7e796d5625ab35ef0de782d07e5db4e2264f612fc5ebaa21"
+		logic_hash = "v1_sha256_08f287ccda93e03a7e796d5625ab35ef0de782d07e5db4e2264f612fc5ebaa21"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34133,7 +34133,7 @@ rule REVERSINGLABS_Cert_Blocklist_1B5190F73724399C9254Cd424637996A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Corporation" and pe.signatures[i].serial=="1b:51:90:f7:37:24:39:9c:92:54:cd:42:46:37:99:6a" and 980812799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Microsoft Corporation" and pe.signatures [ i ] . serial == "1b:51:90:f7:37:24:39:9c:92:54:cd:42:46:37:99:6a" and 980812799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34142,13 +34142,13 @@ rule REVERSINGLABS_Cert_Blocklist_00Ebaa11D62E2481081820 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "e192d271-b5de-5acc-a04f-02a26d9231ac"
+		id = "ff10274b-a6d0-5656-8def-f5559770f147"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1055-L1072"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2fafc6775ec88b5a1000afbc7234fbef6b03e9eaf866dae660dd2d749996cb5c"
+		logic_hash = "v1_sha256_2fafc6775ec88b5a1000afbc7234fbef6b03e9eaf866dae660dd2d749996cb5c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34158,7 +34158,7 @@ rule REVERSINGLABS_Cert_Blocklist_00Ebaa11D62E2481081820 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Enforced Licensing Intermediate PCA" and (pe.signatures[i].serial=="00:eb:aa:11:d6:2e:24:81:08:18:20" or pe.signatures[i].serial=="eb:aa:11:d6:2e:24:81:08:18:20"))
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Microsoft Enforced Licensing Intermediate PCA" and ( pe.signatures [ i ] . serial == "00:eb:aa:11:d6:2e:24:81:08:18:20" or pe.signatures [ i ] . serial == "eb:aa:11:d6:2e:24:81:08:18:20" ) )
 }
 import "pe"
 
@@ -34167,13 +34167,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Aab11Dee52F1B19D056 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "c6334520-7f93-59d0-8a22-721b928c14d1"
+		id = "1e4cdde4-b43a-55ad-91c6-b9ba3ba845bb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1074-L1089"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1f1215143dc828596e6d7eeff99983755b17eaeb3ab9d7643abdbb48e9957c78"
+		logic_hash = "v1_sha256_1f1215143dc828596e6d7eeff99983755b17eaeb3ab9d7643abdbb48e9957c78"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34183,7 +34183,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Aab11Dee52F1B19D056 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Enforced Licensing Intermediate PCA" and pe.signatures[i].serial=="3a:ab:11:de:e5:2f:1b:19:d0:56")
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Microsoft Enforced Licensing Intermediate PCA" and pe.signatures [ i ] . serial == "3a:ab:11:de:e5:2f:1b:19:d0:56" )
 }
 import "pe"
 
@@ -34192,13 +34192,13 @@ rule REVERSINGLABS_Cert_Blocklist_6102B01900000000002F : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "b98769c6-805e-5cd0-96f1-67418fec40a6"
+		id = "ff0a4a7b-333d-55c5-94ca-593d10688a64"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1091-L1106"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6c42daa8b8730541bb422ac860ec4b0830e00fdb732e4bb503054dbcae1ff6d4"
+		logic_hash = "v1_sha256_6c42daa8b8730541bb422ac860ec4b0830e00fdb732e4bb503054dbcae1ff6d4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34208,7 +34208,7 @@ rule REVERSINGLABS_Cert_Blocklist_6102B01900000000002F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Enforced Licensing Registration Authority CA (SHA1)" and pe.signatures[i].serial=="61:02:b0:19:00:00:00:00:00:2f")
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Microsoft Enforced Licensing Registration Authority CA (SHA1)" and pe.signatures [ i ] . serial == "61:02:b0:19:00:00:00:00:00:2f" )
 }
 import "pe"
 
@@ -34217,13 +34217,13 @@ rule REVERSINGLABS_Cert_Blocklist_01E2B4F759811C64379Fca0Be76D2Dce : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "00effc8a-066c-54ff-891e-c635d161b171"
+		id = "6b784721-6d07-547c-ac1c-0e38bbacfb33"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1108-L1124"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0dff7a9f2e152c20427ea231449b942a040e964cb7dad90271d2865290535326"
+		logic_hash = "v1_sha256_0dff7a9f2e152c20427ea231449b942a040e964cb7dad90271d2865290535326"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34233,7 +34233,7 @@ rule REVERSINGLABS_Cert_Blocklist_01E2B4F759811C64379Fca0Be76D2Dce : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sony Pictures Entertainment Inc." and pe.signatures[i].serial=="01:e2:b4:f7:59:81:1c:64:37:9f:ca:0b:e7:6d:2d:ce" and 1417651200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sony Pictures Entertainment Inc." and pe.signatures [ i ] . serial == "01:e2:b4:f7:59:81:1c:64:37:9f:ca:0b:e7:6d:2d:ce" and 1417651200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34242,13 +34242,13 @@ rule REVERSINGLABS_Cert_Blocklist_03E5A010B05C9287F823C2585F547B80 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "14ad79c7-f669-59a6-94d1-978a13fbb337"
+		id = "ee32b812-6dac-56ff-93ea-b3d4aae159b8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1126-L1142"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1d57b640ee313ad4d53dc64ce4df3e4ed57976e7750cfd80d62bf9982d964d26"
+		logic_hash = "v1_sha256_1d57b640ee313ad4d53dc64ce4df3e4ed57976e7750cfd80d62bf9982d964d26"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34258,7 +34258,7 @@ rule REVERSINGLABS_Cert_Blocklist_03E5A010B05C9287F823C2585F547B80 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MOCOMSYS INC" and pe.signatures[i].serial=="03:e5:a0:10:b0:5c:92:87:f8:23:c2:58:5f:54:7b:80" and 1385423999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MOCOMSYS INC" and pe.signatures [ i ] . serial == "03:e5:a0:10:b0:5c:92:87:f8:23:c2:58:5f:54:7b:80" and 1385423999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34267,13 +34267,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Fe7Df6C4B9A33B83D04E23E98A77Cce : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "47a10658-c5c4-58b6-b154-7babcfbc50a2"
+		id = "ce9f5342-e720-5ad0-bb91-1f5f5bee0b93"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1144-L1160"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "da5ed07def8d0c04ea58aacd90f9fa5588f868f6d0057b9148587f2f0b381f25"
+		logic_hash = "v1_sha256_da5ed07def8d0c04ea58aacd90f9fa5588f868f6d0057b9148587f2f0b381f25"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34283,7 +34283,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Fe7Df6C4B9A33B83D04E23E98A77Cce : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PIXELPLUS CO., LTD." and pe.signatures[i].serial=="0f:e7:df:6c:4b:9a:33:b8:3d:04:e2:3e:98:a7:7c:ce" and 1396310399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PIXELPLUS CO., LTD." and pe.signatures [ i ] . serial == "0f:e7:df:6c:4b:9a:33:b8:3d:04:e2:3e:98:a7:7c:ce" and 1396310399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34292,13 +34292,13 @@ rule REVERSINGLABS_Cert_Blocklist_065569A3E261409128A40Affa90D6D10 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "924c210b-f72a-51eb-af2a-9897faf8f677"
+		id = "60acfe13-e39a-52bf-beb9-c377f8489e31"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1162-L1178"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f8d68758704e41325e95ec69334aaf7fabe08a6d5557e0a81bac2f02d3ab5977"
+		logic_hash = "v1_sha256_f8d68758704e41325e95ec69334aaf7fabe08a6d5557e0a81bac2f02d3ab5977"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34308,7 +34308,7 @@ rule REVERSINGLABS_Cert_Blocklist_065569A3E261409128A40Affa90D6D10 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Police Mutual Aid Association" and pe.signatures[i].serial=="06:55:69:a3:e2:61:40:91:28:a4:0a:ff:a9:0d:6d:10" and 1381795199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Police Mutual Aid Association" and pe.signatures [ i ] . serial == "06:55:69:a3:e2:61:40:91:28:a4:0a:ff:a9:0d:6d:10" and 1381795199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34317,13 +34317,13 @@ rule REVERSINGLABS_Cert_Blocklist_0979616733E062C544Df0Abd315E3B92 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "73222a8d-df63-5784-b5a2-0d936db8ddcb"
+		id = "243c4f32-f5eb-5fbd-9677-2633dd97994e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1180-L1196"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "034b233d6b6dd82ad9fa1ec99db1effa3daaa5bb478d448133c479ac728117ad"
+		logic_hash = "v1_sha256_034b233d6b6dd82ad9fa1ec99db1effa3daaa5bb478d448133c479ac728117ad"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34333,7 +34333,7 @@ rule REVERSINGLABS_Cert_Blocklist_0979616733E062C544Df0Abd315E3B92 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jessica Karam" and pe.signatures[i].serial=="09:79:61:67:33:e0:62:c5:44:df:0a:bd:31:5e:3b:92" and 1408319999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Jessica Karam" and pe.signatures [ i ] . serial == "09:79:61:67:33:e0:62:c5:44:df:0a:bd:31:5e:3b:92" and 1408319999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34342,13 +34342,13 @@ rule REVERSINGLABS_Cert_Blocklist_7D3250B27E0547C77307030491B42802 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "54073485-e9a5-5a0b-a907-0e8a528da85d"
+		id = "c31fb253-84cf-5eee-a1e9-abbddd807792"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1198-L1214"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "65f036921dfb9cbce3275aefb7111711e50874440096b2e3c3b55190cfc14ddb"
+		logic_hash = "v1_sha256_65f036921dfb9cbce3275aefb7111711e50874440096b2e3c3b55190cfc14ddb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34358,7 +34358,7 @@ rule REVERSINGLABS_Cert_Blocklist_7D3250B27E0547C77307030491B42802 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Banco do Brasil S.A." and pe.signatures[i].serial=="7d:32:50:b2:7e:05:47:c7:73:07:03:04:91:b4:28:02" and 1412207999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Banco do Brasil S.A." and pe.signatures [ i ] . serial == "7d:32:50:b2:7e:05:47:c7:73:07:03:04:91:b4:28:02" and 1412207999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34367,13 +34367,13 @@ rule REVERSINGLABS_Cert_Blocklist_00D1836Bd37C331A67 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4d99e2ee-823e-568d-88b1-48aaf6d44286"
+		id = "41ce0e19-5660-5215-b867-de902db14615"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1216-L1234"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8af1d10085c5be8924eb6e4ea3a9b8e936c7706d8ec43d42f24a9a293c7f9d27"
+		logic_hash = "v1_sha256_8af1d10085c5be8924eb6e4ea3a9b8e936c7706d8ec43d42f24a9a293c7f9d27"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34383,7 +34383,7 @@ rule REVERSINGLABS_Cert_Blocklist_00D1836Bd37C331A67 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MINDSTORM LLC" and (pe.signatures[i].serial=="00:d1:83:6b:d3:7c:33:1a:67" or pe.signatures[i].serial=="d1:83:6b:d3:7c:33:1a:67") and 1422835199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MINDSTORM LLC" and ( pe.signatures [ i ] . serial == "00:d1:83:6b:d3:7c:33:1a:67" or pe.signatures [ i ] . serial == "d1:83:6b:d3:7c:33:1a:67" ) and 1422835199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34392,13 +34392,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Ca028D1A4De0Eb743135Edecf74D7Af : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "19e1bce7-ad37-5223-b934-b20e78dfd071"
+		id = "4c9908c1-7367-54e3-9833-291d817c98d3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1236-L1252"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "60b6351194e23153d425eaa0c25f840080a29abb5eb1bbcd41bb76a3d4130edd"
+		logic_hash = "v1_sha256_60b6351194e23153d425eaa0c25f840080a29abb5eb1bbcd41bb76a3d4130edd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34408,7 +34408,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Ca028D1A4De0Eb743135Edecf74D7Af : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="2c:a0:28:d1:a4:de:0e:b7:43:13:5e:de:cf:74:d7:af" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "2c:a0:28:d1:a4:de:0e:b7:43:13:5e:de:cf:74:d7:af" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34417,13 +34417,13 @@ rule REVERSINGLABS_Cert_Blocklist_Dbb14Dcf973Eada14Ece7Ea79C895C11 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "139f2e4f-7997-5cfd-aba2-dcf8d7525f5e"
+		id = "531f7801-9e3f-56cf-8081-3d978eebd169"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1254-L1270"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c73c83f5cb6d840b887e1aa41e96a29529f975434ac27a5aa57f2e14b342f63d"
+		logic_hash = "v1_sha256_c73c83f5cb6d840b887e1aa41e96a29529f975434ac27a5aa57f2e14b342f63d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34433,7 +34433,7 @@ rule REVERSINGLABS_Cert_Blocklist_Dbb14Dcf973Eada14Ece7Ea79C895C11 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="db:b1:4d:cf:97:3e:ad:a1:4e:ce:7e:a7:9c:89:5c:11" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "db:b1:4d:cf:97:3e:ad:a1:4e:ce:7e:a7:9c:89:5c:11" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34442,13 +34442,13 @@ rule REVERSINGLABS_Cert_Blocklist_F8C2239De3977B8D4A3Dcbedc9031A51 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "3e102d0a-30e3-5f0a-9b67-a5fd15117e69"
+		id = "a21a6ab5-b747-5a4a-ae19-a5c0b4c12059"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1272-L1288"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "aa4f39790bc58b0a50e05e7670abad654d7f3d73e500bd5f054fece4a979ebfa"
+		logic_hash = "v1_sha256_aa4f39790bc58b0a50e05e7670abad654d7f3d73e500bd5f054fece4a979ebfa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34458,7 +34458,7 @@ rule REVERSINGLABS_Cert_Blocklist_F8C2239De3977B8D4A3Dcbedc9031A51 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="f8:c2:23:9d:e3:97:7b:8d:4a:3d:cb:ed:c9:03:1a:51" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "f8:c2:23:9d:e3:97:7b:8d:4a:3d:cb:ed:c9:03:1a:51" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34467,13 +34467,13 @@ rule REVERSINGLABS_Cert_Blocklist_Caad8222705D3Fb3430E114A31C8C6A4 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "d95b5e25-679c-57f8-b790-8f5633a23e4b"
+		id = "d68cb2b0-387d-55fe-a82d-90b36e4c8655"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1290-L1306"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "35c4f46322da4f5b9f938c1098c8e57effc8abfc03db865190c343df7b8990ea"
+		logic_hash = "v1_sha256_35c4f46322da4f5b9f938c1098c8e57effc8abfc03db865190c343df7b8990ea"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34483,7 +34483,7 @@ rule REVERSINGLABS_Cert_Blocklist_Caad8222705D3Fb3430E114A31C8C6A4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="ca:ad:82:22:70:5d:3f:b3:43:0e:11:4a:31:c8:c6:a4" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "ca:ad:82:22:70:5d:3f:b3:43:0e:11:4a:31:c8:c6:a4" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34492,13 +34492,13 @@ rule REVERSINGLABS_Cert_Blocklist_B191812516E6618D49E6Ccf5E63Dc343 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "8f316011-9a29-5366-a26a-1fe20651ef17"
+		id = "9ad59c1f-392a-5920-ab3d-1021f6cea138"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1308-L1324"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "40c03e683b4b8e8a23ca84da7dfd3bd998d3708b27b7df7a22f25fb364c3a69b"
+		logic_hash = "v1_sha256_40c03e683b4b8e8a23ca84da7dfd3bd998d3708b27b7df7a22f25fb364c3a69b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34508,7 +34508,7 @@ rule REVERSINGLABS_Cert_Blocklist_B191812516E6618D49E6Ccf5E63Dc343 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="b1:91:81:25:16:e6:61:8d:49:e6:cc:f5:e6:3d:c3:43" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "b1:91:81:25:16:e6:61:8d:49:e6:cc:f5:e6:3d:c3:43" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34517,13 +34517,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Ba7Fb8Ee1Deff8F4A1525E1E0580057 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "af912c64-334d-51f5-8ca4-707fcec512ba"
+		id = "b6d24664-ba2f-51e1-a82f-c3488b9e650c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1326-L1342"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "324157b9fec2653cb8874c7a1a5b6e39b121992cd52856b8c4a2a8b7cee86a69"
+		logic_hash = "v1_sha256_324157b9fec2653cb8874c7a1a5b6e39b121992cd52856b8c4a2a8b7cee86a69"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34533,7 +34533,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Ba7Fb8Ee1Deff8F4A1525E1E0580057 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="4b:a7:fb:8e:e1:de:ff:8f:4a:15:25:e1:e0:58:00:57" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "4b:a7:fb:8e:e1:de:ff:8f:4a:15:25:e1:e0:58:00:57" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34542,13 +34542,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Df9F7Eb6Cdc5Ca243B33122E3941E25 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "da1895fd-ec29-513d-b8ae-2317f84b8280"
+		id = "ff708876-f157-5593-a542-1be2599454a8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1344-L1360"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "703eccd5573fe42f03ec82887660d50e942156d840394746c90ba87d82507803"
+		logic_hash = "v1_sha256_703eccd5573fe42f03ec82887660d50e942156d840394746c90ba87d82507803"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34558,7 +34558,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Df9F7Eb6Cdc5Ca243B33122E3941E25 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="2d:f9:f7:eb:6c:dc:5c:a2:43:b3:31:22:e3:94:1e:25" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "2d:f9:f7:eb:6c:dc:5c:a2:43:b3:31:22:e3:94:1e:25" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34567,13 +34567,13 @@ rule REVERSINGLABS_Cert_Blocklist_58A541D50F9E2Fab4380C6A2Ed433B82 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "19a26581-5c94-5c8d-8e3e-b2ef1d770968"
+		id = "58f91572-9ced-5a82-a71c-a963c482ac8e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1362-L1378"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "69ddc58b6fec159d6eded8c78237a6a0626b1aedb58b0c9867b758fd09db46ad"
+		logic_hash = "v1_sha256_69ddc58b6fec159d6eded8c78237a6a0626b1aedb58b0c9867b758fd09db46ad"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34583,7 +34583,7 @@ rule REVERSINGLABS_Cert_Blocklist_58A541D50F9E2Fab4380C6A2Ed433B82 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="58:a5:41:d5:0f:9e:2f:ab:43:80:c6:a2:ed:43:3b:82" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "58:a5:41:d5:0f:9e:2f:ab:43:80:c6:a2:ed:43:3b:82" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34592,13 +34592,13 @@ rule REVERSINGLABS_Cert_Blocklist_5F273626859Ae4Bc4Becbbeb71E2Ab2D : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "a80dcaba-73f9-51d0-a75a-b6348fd305c6"
+		id = "57d60f5b-fcc0-512a-9835-522ec65c7305"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1380-L1396"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c8be504f075041508f299b1df03d9cb9e58d9a89f49b7a926676033d18b108ba"
+		logic_hash = "v1_sha256_c8be504f075041508f299b1df03d9cb9e58d9a89f49b7a926676033d18b108ba"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34608,7 +34608,7 @@ rule REVERSINGLABS_Cert_Blocklist_5F273626859Ae4Bc4Becbbeb71E2Ab2D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="5f:27:36:26:85:9a:e4:bc:4b:ec:bb:eb:71:e2:ab:2d" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "5f:27:36:26:85:9a:e4:bc:4b:ec:bb:eb:71:e2:ab:2d" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34617,13 +34617,13 @@ rule REVERSINGLABS_Cert_Blocklist_B1Ad46Ce4Db160B348C24F66C9663178 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "df34eb28-18ec-568b-8257-0b2f7959868c"
+		id = "1b72ffa5-4977-5cc5-b554-13d8ca51b5b7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1398-L1414"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "59ce2b7a2e881853d07446b3dda74b296f2be09651364d0e131552cf76dab751"
+		logic_hash = "v1_sha256_59ce2b7a2e881853d07446b3dda74b296f2be09651364d0e131552cf76dab751"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34633,7 +34633,7 @@ rule REVERSINGLABS_Cert_Blocklist_B1Ad46Ce4Db160B348C24F66C9663178 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Adobe Systems" and pe.signatures[i].serial=="b1:ad:46:ce:4d:b1:60:b3:48:c2:4f:66:c9:66:31:78" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Adobe Systems" and pe.signatures [ i ] . serial == "b1:ad:46:ce:4d:b1:60:b3:48:c2:4f:66:c9:66:31:78" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34642,13 +34642,13 @@ rule REVERSINGLABS_Cert_Blocklist_256541E204619033F8B09F9Eb7C88Ef8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d4a5eb19-2964-5d3a-b4c5-ee4396e76814"
+		id = "c6e4f2ef-ab4f-505e-bae3-f128da97eca9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1416-L1432"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e33cedf1dd24ac73f77461de0cef25cad57909be2a69469fec450ead7da85c65"
+		logic_hash = "v1_sha256_e33cedf1dd24ac73f77461de0cef25cad57909be2a69469fec450ead7da85c65"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34658,7 +34658,7 @@ rule REVERSINGLABS_Cert_Blocklist_256541E204619033F8B09F9Eb7C88Ef8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HON HAI PRECISION INDUSTRY CO. LTD." and pe.signatures[i].serial=="25:65:41:e2:04:61:90:33:f8:b0:9f:9e:b7:c8:8e:f8" and 1424303999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HON HAI PRECISION INDUSTRY CO. LTD." and pe.signatures [ i ] . serial == "25:65:41:e2:04:61:90:33:f8:b0:9f:9e:b7:c8:8e:f8" and 1424303999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34667,13 +34667,13 @@ rule REVERSINGLABS_Cert_Blocklist_00E8Cc18Cf100B6B27443Ef26319398734 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing GovRAT malware."
 		author = "ReversingLabs"
-		id = "f7e80c51-9dcf-599a-8164-c07cf4c9c5ff"
+		id = "fcb5a1d8-0e7d-5aac-bc39-a9d6a845fac9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1434-L1452"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "68e9df056109cae41d981090c7a98ddc192a445647d7475569ddbe4118e570c5"
+		logic_hash = "v1_sha256_68e9df056109cae41d981090c7a98ddc192a445647d7475569ddbe4118e570c5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34683,7 +34683,7 @@ rule REVERSINGLABS_Cert_Blocklist_00E8Cc18Cf100B6B27443Ef26319398734 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Syngenta" and (pe.signatures[i].serial=="00:e8:cc:18:cf:10:0b:6b:27:44:3e:f2:63:19:39:87:34" or pe.signatures[i].serial=="e8:cc:18:cf:10:0b:6b:27:44:3e:f2:63:19:39:87:34") and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Syngenta" and ( pe.signatures [ i ] . serial == "00:e8:cc:18:cf:10:0b:6b:27:44:3e:f2:63:19:39:87:34" or pe.signatures [ i ] . serial == "e8:cc:18:cf:10:0b:6b:27:44:3e:f2:63:19:39:87:34" ) and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34692,13 +34692,13 @@ rule REVERSINGLABS_Cert_Blocklist_62Af28A7657Ba8Ab10Fa8E2D47250C69 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing GovRAT malware."
 		author = "ReversingLabs"
-		id = "cba20a1b-5d24-5a1f-8f2f-8c47add846d6"
+		id = "9bea3365-e4fa-5b00-b6c7-9324820be295"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1454-L1470"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c3c034cb4e2c65e2269fbfd9c045eb294badde60389ae62ed694ea4d61c5eb35"
+		logic_hash = "v1_sha256_c3c034cb4e2c65e2269fbfd9c045eb294badde60389ae62ed694ea4d61c5eb35"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34708,7 +34708,7 @@ rule REVERSINGLABS_Cert_Blocklist_62Af28A7657Ba8Ab10Fa8E2D47250C69 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AFINA Fintek" and pe.signatures[i].serial=="62:af:28:a7:65:7b:a8:ab:10:fa:8e:2d:47:25:0c:69" and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AFINA Fintek" and pe.signatures [ i ] . serial == "62:af:28:a7:65:7b:a8:ab:10:fa:8e:2d:47:25:0c:69" and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34717,13 +34717,13 @@ rule REVERSINGLABS_Cert_Blocklist_04C8Eca7243208A110Dea926C7Ad89Ce : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing GovRAT malware."
 		author = "ReversingLabs"
-		id = "484d0aa6-0447-5e60-946b-89b01a5e43dd"
+		id = "ccfee04c-4877-5d99-9702-9bd39fc379b8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1472-L1488"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0012436e83704397026a8b2e500e5d61915e0f4c8ad4100176e200a975562e8f"
+		logic_hash = "v1_sha256_0012436e83704397026a8b2e500e5d61915e0f4c8ad4100176e200a975562e8f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34733,7 +34733,7 @@ rule REVERSINGLABS_Cert_Blocklist_04C8Eca7243208A110Dea926C7Ad89Ce : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, SINGH ADITYA" and pe.signatures[i].serial=="04:c8:ec:a7:24:32:08:a1:10:de:a9:26:c7:ad:89:ce" and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, SINGH ADITYA" and pe.signatures [ i ] . serial == "04:c8:ec:a7:24:32:08:a1:10:de:a9:26:c7:ad:89:ce" and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34742,13 +34742,13 @@ rule REVERSINGLABS_Cert_Blocklist_157C3A4A6Bcf35Cf8453E6B6C0072E1D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing GovRAT malware."
 		author = "ReversingLabs"
-		id = "4bae3fb2-7e30-598e-8708-b985697bf63a"
+		id = "fb93889c-6c83-5507-bc86-29b8c1e9bcd5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1490-L1506"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2a68051ab6d0b967f08e44d91b9f13d75587ea0f16e2a5536ccf5898445e1a58"
+		logic_hash = "v1_sha256_2a68051ab6d0b967f08e44d91b9f13d75587ea0f16e2a5536ccf5898445e1a58"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34758,7 +34758,7 @@ rule REVERSINGLABS_Cert_Blocklist_157C3A4A6Bcf35Cf8453E6B6C0072E1D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Favorite-III" and pe.signatures[i].serial=="15:7c:3a:4a:6b:cf:35:cf:84:53:e6:b6:c0:07:2e:1d" and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Favorite-III" and pe.signatures [ i ] . serial == "15:7c:3a:4a:6b:cf:35:cf:84:53:e6:b6:c0:07:2e:1d" and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34767,13 +34767,13 @@ rule REVERSINGLABS_Cert_Blocklist_04422F12037Bc2032521Dbb6Ae02Ea0E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing GovRAT malware."
 		author = "ReversingLabs"
-		id = "0dc659e8-1f3b-5130-a776-dd9e4141f5f3"
+		id = "83d38930-0699-5eb5-a766-9275641d6d2a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1508-L1524"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "381d749d24121d6634656fd33adcda5c3e500ee77a6333f525f351a2ee589e2c"
+		logic_hash = "v1_sha256_381d749d24121d6634656fd33adcda5c3e500ee77a6333f525f351a2ee589e2c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34783,7 +34783,7 @@ rule REVERSINGLABS_Cert_Blocklist_04422F12037Bc2032521Dbb6Ae02Ea0E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, Muhammad Lee" and pe.signatures[i].serial=="04:42:2f:12:03:7b:c2:03:25:21:db:b6:ae:02:ea:0e" and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, Muhammad Lee" and pe.signatures [ i ] . serial == "04:42:2f:12:03:7b:c2:03:25:21:db:b6:ae:02:ea:0e" and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34792,13 +34792,13 @@ rule REVERSINGLABS_Cert_Blocklist_65Eae6C98111Dc40Bf4F962Bf27227F2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing GovRAT malware."
 		author = "ReversingLabs"
-		id = "34275efd-b941-56f5-8e1b-30a43f1936e2"
+		id = "5a974cb1-238b-5ad9-90c5-90d50a76f8a3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1526-L1542"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "20c0f4e9783586e68ff363fe6a72398f6ea27aef5d25f98872d1203ce1a0c9bd"
+		logic_hash = "v1_sha256_20c0f4e9783586e68ff363fe6a72398f6ea27aef5d25f98872d1203ce1a0c9bd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34808,7 +34808,7 @@ rule REVERSINGLABS_Cert_Blocklist_65Eae6C98111Dc40Bf4F962Bf27227F2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, BHARATH KUCHANGI" and pe.signatures[i].serial=="65:ea:e6:c9:81:11:dc:40:bf:4f:96:2b:f2:72:27:f2" and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, BHARATH KUCHANGI" and pe.signatures [ i ] . serial == "65:ea:e6:c9:81:11:dc:40:bf:4f:96:2b:f2:72:27:f2" and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34817,13 +34817,13 @@ rule REVERSINGLABS_Cert_Blocklist_12D5A4B29Fe6156D4195Fba55Ae0D9A9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing GovRAT malware."
 		author = "ReversingLabs"
-		id = "45c37c98-1006-51e4-8832-b8e5c9fba416"
+		id = "b126cd79-33ba-5ef6-ade0-3b03bff21451"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1544-L1560"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "860550745f6dbcd7dd0925d9b8f04e8e08e8b7c06343a4c070e131a815c42e12"
+		logic_hash = "v1_sha256_860550745f6dbcd7dd0925d9b8f04e8e08e8b7c06343a4c070e131a815c42e12"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34833,7 +34833,7 @@ rule REVERSINGLABS_Cert_Blocklist_12D5A4B29Fe6156D4195Fba55Ae0D9A9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, Marc Chapon" and pe.signatures[i].serial=="12:d5:a4:b2:9f:e6:15:6d:41:95:fb:a5:5a:e0:d9:a9" and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, Marc Chapon" and pe.signatures [ i ] . serial == "12:d5:a4:b2:9f:e6:15:6d:41:95:fb:a5:5a:e0:d9:a9" and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34842,13 +34842,13 @@ rule REVERSINGLABS_Cert_Blocklist_0087D60D1E2B9374Eb7A735Dce4Bbdae56 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing GovRAT malware."
 		author = "ReversingLabs"
-		id = "8759a40a-648e-548e-a519-bedc812aefe4"
+		id = "714b862e-0b97-5aaa-ae20-841b5351bbdd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1562-L1580"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d6e0d22e926a237f1cc6b71c6f8ce01e497723032c9efba1e6af7327a786b608"
+		logic_hash = "v1_sha256_d6e0d22e926a237f1cc6b71c6f8ce01e497723032c9efba1e6af7327a786b608"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34858,7 +34858,7 @@ rule REVERSINGLABS_Cert_Blocklist_0087D60D1E2B9374Eb7A735Dce4Bbdae56 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMO-K Limited Liability Company" and (pe.signatures[i].serial=="00:87:d6:0d:1e:2b:93:74:eb:7a:73:5d:ce:4b:bd:ae:56" or pe.signatures[i].serial=="87:d6:0d:1e:2b:93:74:eb:7a:73:5d:ce:4b:bd:ae:56") and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMO-K Limited Liability Company" and ( pe.signatures [ i ] . serial == "00:87:d6:0d:1e:2b:93:74:eb:7a:73:5d:ce:4b:bd:ae:56" or pe.signatures [ i ] . serial == "87:d6:0d:1e:2b:93:74:eb:7a:73:5d:ce:4b:bd:ae:56" ) and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34867,13 +34867,13 @@ rule REVERSINGLABS_Cert_Blocklist_0860C8A7Ed18C3F030A32722Fd2B220C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "335a1cd3-520a-5f0f-abda-6ec8a122de4b"
+		id = "d8fe70e7-ee11-5658-8862-d09e5404bee8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1582-L1598"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3c777fb157a6669bfdf3143e77f69265e09458a2b42b75b72680eb043da71e85"
+		logic_hash = "v1_sha256_3c777fb157a6669bfdf3143e77f69265e09458a2b42b75b72680eb043da71e85"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34883,7 +34883,7 @@ rule REVERSINGLABS_Cert_Blocklist_0860C8A7Ed18C3F030A32722Fd2B220C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, Tony Yeh" and pe.signatures[i].serial=="08:60:c8:a7:ed:18:c3:f0:30:a3:27:22:fd:2b:22:0c" and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, Tony Yeh" and pe.signatures [ i ] . serial == "08:60:c8:a7:ed:18:c3:f0:30:a3:27:22:fd:2b:22:0c" and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34892,13 +34892,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Fdadd0740572270203F8138692C4A83 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0b289c4e-c564-5513-a1a5-42e8551c6218"
+		id = "2d02db0c-d06e-5a94-840c-21337c36ffbc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1600-L1616"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "18ce7ed721a454c5bb3cd6ab26df703b1e08b94b8c518055feffa38ad42afa50"
+		logic_hash = "v1_sha256_18ce7ed721a454c5bb3cd6ab26df703b1e08b94b8c518055feffa38ad42afa50"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34908,7 +34908,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Fdadd0740572270203F8138692C4A83 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, William Zoltan" and pe.signatures[i].serial=="2f:da:dd:07:40:57:22:70:20:3f:81:38:69:2c:4a:83" and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, William Zoltan" and pe.signatures [ i ] . serial == "2f:da:dd:07:40:57:22:70:20:3f:81:38:69:2c:4a:83" and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34917,13 +34917,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Fc13D6220C629043A26F81B1Cad72D8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c2573adc-6580-58aa-a58c-c21bf6b79364"
+		id = "f06763f5-afd3-5ff6-b59a-f1d6c5bb67c4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1618-L1634"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5572c278f6c9be62b2bba09ea610fd170438c6893ee5283ff4a5b3bb2852b07b"
+		logic_hash = "v1_sha256_5572c278f6c9be62b2bba09ea610fd170438c6893ee5283ff4a5b3bb2852b07b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34933,7 +34933,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Fc13D6220C629043A26F81B1Cad72D8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, meicun ge" and pe.signatures[i].serial=="4f:c1:3d:62:20:c6:29:04:3a:26:f8:1b:1c:ad:72:d8" and 1404172799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, meicun ge" and pe.signatures [ i ] . serial == "4f:c1:3d:62:20:c6:29:04:3a:26:f8:1b:1c:ad:72:d8" and 1404172799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34942,13 +34942,13 @@ rule REVERSINGLABS_Cert_Blocklist_3457A918C6D3701B2Eaca6A92474A7Cc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "12526715-7b54-5c31-aa2a-b77ed067e3ee"
+		id = "bf526f41-0408-5a7d-941b-2b30fa1bc6f6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1636-L1652"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "70d4bece52a86bfe8958f6d4195b833cea609596e3b68bb90087c262501bd462"
+		logic_hash = "v1_sha256_70d4bece52a86bfe8958f6d4195b833cea609596e3b68bb90087c262501bd462"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34958,7 +34958,7 @@ rule REVERSINGLABS_Cert_Blocklist_3457A918C6D3701B2Eaca6A92474A7Cc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KONSALTING PLUS OOO" and pe.signatures[i].serial=="34:57:a9:18:c6:d3:70:1b:2e:ac:a6:a9:24:74:a7:cc" and 1432252799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KONSALTING PLUS OOO" and pe.signatures [ i ] . serial == "34:57:a9:18:c6:d3:70:1b:2e:ac:a6:a9:24:74:a7:cc" and 1432252799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34967,13 +34967,13 @@ rule REVERSINGLABS_Cert_Blocklist_621Ed8265B0Ad872D9F4B4Ed6D560513 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b64e640c-264f-597c-90a5-d0ad57aa5075"
+		id = "2d4a10e4-caad-55ec-bc65-7b226bd26385"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1654-L1670"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c133d6eea5d27e597d0a656c7c930a5ca84adb46aa2fec66381b6b5c759e22aa"
+		logic_hash = "v1_sha256_c133d6eea5d27e597d0a656c7c930a5ca84adb46aa2fec66381b6b5c759e22aa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -34983,7 +34983,7 @@ rule REVERSINGLABS_Cert_Blocklist_621Ed8265B0Ad872D9F4B4Ed6D560513 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fan Li" and pe.signatures[i].serial=="62:1e:d8:26:5b:0a:d8:72:d9:f4:b4:ed:6d:56:05:13" and 1413183357<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fan Li" and pe.signatures [ i ] . serial == "62:1e:d8:26:5b:0a:d8:72:d9:f4:b4:ed:6d:56:05:13" and 1413183357 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -34992,13 +34992,13 @@ rule REVERSINGLABS_Cert_Blocklist_56E22B992B4C7F1Afeac1D63B492Bf54 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "28609e75-47cb-5017-bb92-046a9e8931c6"
+		id = "1bfd81bf-caad-5825-8b32-b3ff2a55c333"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1672-L1688"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ef058c0ec352260fa3db0fc74331d1da3c9eb8d161cef7635632fd7c569198c6"
+		logic_hash = "v1_sha256_ef058c0ec352260fa3db0fc74331d1da3c9eb8d161cef7635632fd7c569198c6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35008,7 +35008,7 @@ rule REVERSINGLABS_Cert_Blocklist_56E22B992B4C7F1Afeac1D63B492Bf54 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, Hetem Ramadani" and pe.signatures[i].serial=="56:e2:2b:99:2b:4c:7f:1a:fe:ac:1d:63:b4:92:bf:54" and 1435622399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, Hetem Ramadani" and pe.signatures [ i ] . serial == "56:e2:2b:99:2b:4c:7f:1a:fe:ac:1d:63:b4:92:bf:54" and 1435622399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35017,13 +35017,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Bc3Bae4118D46F3Fdd9Beeeab749Fee : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0d2f1f5f-119a-5069-abcb-e4e93d9964c3"
+		id = "fe41ed11-1a14-5c04-a43c-315c59b9fed2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1690-L1706"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fcbda27f8bf4dca8aa32103bb344380c82f0c701c25766df94c182ef94805a12"
+		logic_hash = "v1_sha256_fcbda27f8bf4dca8aa32103bb344380c82f0c701c25766df94c182ef94805a12"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35033,7 +35033,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Bc3Bae4118D46F3Fdd9Beeeab749Fee : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x9D\\x8E\\xE9\\x9B\\xAA\\xE6\\xA2\\x85" and pe.signatures[i].serial=="3b:c3:ba:e4:11:8d:46:f3:fd:d9:be:ee:ab:74:9f:ee" and 1442275199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE6\\x9D\\x8E\\xE9\\x9B\\xAA\\xE6\\xA2\\x85" and pe.signatures [ i ] . serial == "3b:c3:ba:e4:11:8d:46:f3:fd:d9:be:ee:ab:74:9f:ee" and 1442275199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35042,13 +35042,13 @@ rule REVERSINGLABS_Cert_Blocklist_0F0449F7691E5B4C8E74E71Cae822179 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "17c99772-f2f9-56bc-be01-d9f62626a9ff"
+		id = "f5e27b65-c048-5191-a9f6-fc57d92836c2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1708-L1724"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f8d3593b357f27240a4399e877ae9044f783bb944ad47ec9fe8bbecc63be864c"
+		logic_hash = "v1_sha256_f8d3593b357f27240a4399e877ae9044f783bb944ad47ec9fe8bbecc63be864c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35058,7 +35058,7 @@ rule REVERSINGLABS_Cert_Blocklist_0F0449F7691E5B4C8E74E71Cae822179 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SBO INVEST" and pe.signatures[i].serial=="0f:04:49:f7:69:1e:5b:4c:8e:74:e7:1c:ae:82:21:79" and 1432079999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SBO INVEST" and pe.signatures [ i ] . serial == "0f:04:49:f7:69:1e:5b:4c:8e:74:e7:1c:ae:82:21:79" and 1432079999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35067,13 +35067,13 @@ rule REVERSINGLABS_Cert_Blocklist_43Db4448D870D7Bdc275F36A01Fba36F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "47b3e681-87ae-5e70-8d02-18aa0daab0dc"
+		id = "f334b4de-c598-5bdf-926a-ce730f287b68"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1726-L1742"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "951e35e2c3f1bd90a33f8b76b6ede5686ee9b9c97a4c71df5b9dff15956209c5"
+		logic_hash = "v1_sha256_951e35e2c3f1bd90a33f8b76b6ede5686ee9b9c97a4c71df5b9dff15956209c5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35083,7 +35083,7 @@ rule REVERSINGLABS_Cert_Blocklist_43Db4448D870D7Bdc275F36A01Fba36F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "3-T TOV" and pe.signatures[i].serial=="43:db:44:48:d8:70:d7:bd:c2:75:f3:6a:01:fb:a3:6f" and 1436227199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "3-T TOV" and pe.signatures [ i ] . serial == "43:db:44:48:d8:70:d7:bd:c2:75:f3:6a:01:fb:a3:6f" and 1436227199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35092,13 +35092,13 @@ rule REVERSINGLABS_Cert_Blocklist_2880A7F7Ff2D334Aa08744A8754Fab2C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b079b564-9284-59b6-9703-4e33f2b2c44d"
+		id = "a18bfeee-ba7a-5441-9611-51e68f8a6405"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1744-L1760"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "03c7e1251c44e8824ae3b648a95cf34f4c56db65d76806306a062a343981d87f"
+		logic_hash = "v1_sha256_03c7e1251c44e8824ae3b648a95cf34f4c56db65d76806306a062a343981d87f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35108,7 +35108,7 @@ rule REVERSINGLABS_Cert_Blocklist_2880A7F7Ff2D334Aa08744A8754Fab2C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Garena Online Pte Ltd" and pe.signatures[i].serial=="28:80:a7:f7:ff:2d:33:4a:a0:87:44:a8:75:4f:ab:2c" and 1393891199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Garena Online Pte Ltd" and pe.signatures [ i ] . serial == "28:80:a7:f7:ff:2d:33:4a:a0:87:44:a8:75:4f:ab:2c" and 1393891199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35117,13 +35117,13 @@ rule REVERSINGLABS_Cert_Blocklist_0492F5C18E26Fa0Cd7E15067674Aff1C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6a176d4a-5d3e-5184-b923-12d561e7034a"
+		id = "23736437-4673-5dfa-8fc4-cf92d4e7df77"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1762-L1778"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d47d59d7680000d6c35181be2d9b034c2ecb7ca754a39c8e11750ddd7246b47c"
+		logic_hash = "v1_sha256_d47d59d7680000d6c35181be2d9b034c2ecb7ca754a39c8e11750ddd7246b47c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35133,7 +35133,7 @@ rule REVERSINGLABS_Cert_Blocklist_0492F5C18E26Fa0Cd7E15067674Aff1C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ghada Saffarini" and pe.signatures[i].serial=="04:92:f5:c1:8e:26:fa:0c:d7:e1:50:67:67:4a:ff:1c" and 1445990399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ghada Saffarini" and pe.signatures [ i ] . serial == "04:92:f5:c1:8e:26:fa:0c:d7:e1:50:67:67:4a:ff:1c" and 1445990399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35142,13 +35142,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Aa668Cd6A9De1Fdd476Ea8225326937 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bfff2210-8545-594d-8674-243e57e3dd09"
+		id = "cb6b18e3-8d93-50a3-9418-1a646eedaa0a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1780-L1796"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "706e16995af40a6c9176dcbca07fb406f2efe4d47dbd9629d1a6b1ab1d09b045"
+		logic_hash = "v1_sha256_706e16995af40a6c9176dcbca07fb406f2efe4d47dbd9629d1a6b1ab1d09b045"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35158,7 +35158,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Aa668Cd6A9De1Fdd476Ea8225326937 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BSCP LIMITED" and pe.signatures[i].serial=="6a:a6:68:cd:6a:9d:e1:fd:d4:76:ea:82:25:32:69:37" and 1441583999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BSCP LIMITED" and pe.signatures [ i ] . serial == "6a:a6:68:cd:6a:9d:e1:fd:d4:76:ea:82:25:32:69:37" and 1441583999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35167,13 +35167,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Cb06Dccb482255728671Ea12Ac41620 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5a7f61a4-15ba-5f5c-89e1-b8b986e13f19"
+		id = "623e6bb6-9746-5727-b0d9-491f37afa268"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1798-L1814"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e0867ffe2ddd28282fe78b27b3b12ebac525b33a27dd242bc6f55bcd2e066a18"
+		logic_hash = "v1_sha256_e0867ffe2ddd28282fe78b27b3b12ebac525b33a27dd242bc6f55bcd2e066a18"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35183,7 +35183,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Cb06Dccb482255728671Ea12Ac41620 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fangzhen Li" and pe.signatures[i].serial=="1c:b0:6d:cc:b4:82:25:57:28:67:1e:a1:2a:c4:16:20" and 1445126399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fangzhen Li" and pe.signatures [ i ] . serial == "1c:b0:6d:cc:b4:82:25:57:28:67:1e:a1:2a:c4:16:20" and 1445126399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35192,13 +35192,13 @@ rule REVERSINGLABS_Cert_Blocklist_370C2467C41D6019Bbecd72E00C5D73D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "18c5d1bb-21b8-5157-a03b-8bcbdc74c0cd"
+		id = "ae5a04c0-6ee1-5841-8924-50b7734c99d4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1816-L1832"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2b99522b75ee83d85b30146cb292b5a8a46dc300fb43dd9d39d9ca96c9d32d9b"
+		logic_hash = "v1_sha256_2b99522b75ee83d85b30146cb292b5a8a46dc300fb43dd9d39d9ca96c9d32d9b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35208,7 +35208,7 @@ rule REVERSINGLABS_Cert_Blocklist_370C2467C41D6019Bbecd72E00C5D73D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UNINFO SISTEMAS LTDA ME" and pe.signatures[i].serial=="37:0c:24:67:c4:1d:60:19:bb:ec:d7:2e:00:c5:d7:3d" and 1445299199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "UNINFO SISTEMAS LTDA ME" and pe.signatures [ i ] . serial == "37:0c:24:67:c4:1d:60:19:bb:ec:d7:2e:00:c5:d7:3d" and 1445299199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35217,13 +35217,13 @@ rule REVERSINGLABS_Cert_Blocklist_5067339614C5Cc219C489D40420F3Bf9 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "6e0cb6f9-0a92-5eb2-b13f-f9c4eb0ae6b1"
+		id = "5a889259-0acd-52c1-9b6c-f2f18cb3e299"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1834-L1850"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1716087285a093a3467583f79d7ae9bee641997227e6d4f95047905aedcc97c6"
+		logic_hash = "v1_sha256_1716087285a093a3467583f79d7ae9bee641997227e6d4f95047905aedcc97c6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35233,7 +35233,7 @@ rule REVERSINGLABS_Cert_Blocklist_5067339614C5Cc219C489D40420F3Bf9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "D-LINK CORPORATION" and pe.signatures[i].serial=="50:67:33:96:14:c5:cc:21:9c:48:9d:40:42:0f:3b:f9" and 1441238400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "D-LINK CORPORATION" and pe.signatures [ i ] . serial == "50:67:33:96:14:c5:cc:21:9c:48:9d:40:42:0f:3b:f9" and 1441238400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35242,13 +35242,13 @@ rule REVERSINGLABS_Cert_Blocklist_6E32531Ae83992F0573120A5E78De271 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "37fc58ea-63d4-569d-968f-f4775403b0bb"
+		id = "24b36182-58c1-5ade-b23a-8bd848bdd713"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1852-L1868"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2b6d54ea8395c3666906b2e60c30b970c2c1b6f55ded874cbcc22dc79391fb34"
+		logic_hash = "v1_sha256_2b6d54ea8395c3666906b2e60c30b970c2c1b6f55ded874cbcc22dc79391fb34"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35258,7 +35258,7 @@ rule REVERSINGLABS_Cert_Blocklist_6E32531Ae83992F0573120A5E78De271 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "3 AM CHP" and pe.signatures[i].serial=="6e:32:53:1a:e8:39:92:f0:57:31:20:a5:e7:8d:e2:71" and 1451606399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "3 AM CHP" and pe.signatures [ i ] . serial == "6e:32:53:1a:e8:39:92:f0:57:31:20:a5:e7:8d:e2:71" and 1451606399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35267,13 +35267,13 @@ rule REVERSINGLABS_Cert_Blocklist_6967A89Bcf6Efef160Aaeebbff376C0A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d6714f50-600b-5437-8be6-097f7dd93dc7"
+		id = "b6d9fdf7-b919-5bb9-b124-8553547dd059"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1870-L1886"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "deb7465e453aa5838f81e15e270abc958a65e1a6051a88a5910244edbe874451"
+		logic_hash = "v1_sha256_deb7465e453aa5838f81e15e270abc958a65e1a6051a88a5910244edbe874451"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35283,7 +35283,7 @@ rule REVERSINGLABS_Cert_Blocklist_6967A89Bcf6Efef160Aaeebbff376C0A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Chang Yucheng" and pe.signatures[i].serial=="69:67:a8:9b:cf:6e:fe:f1:60:aa:ee:bb:ff:37:6c:0a" and 1451174399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Chang Yucheng" and pe.signatures [ i ] . serial == "69:67:a8:9b:cf:6e:fe:f1:60:aa:ee:bb:ff:37:6c:0a" and 1451174399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35292,13 +35292,13 @@ rule REVERSINGLABS_Cert_Blocklist_7473D95405D2B0B3A8F28785Ce6E74Ca : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7f44b9d8-917b-5fc4-9651-cce89358e415"
+		id = "83f29658-690a-54ff-81e2-b7dad3797467"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1888-L1904"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e15b990b13617017ca2d1f8caf03d8ff3785ca9b860bf11f81af5dadf17a9be5"
+		logic_hash = "v1_sha256_e15b990b13617017ca2d1f8caf03d8ff3785ca9b860bf11f81af5dadf17a9be5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35308,7 +35308,7 @@ rule REVERSINGLABS_Cert_Blocklist_7473D95405D2B0B3A8F28785Ce6E74Ca : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dmitrij Emelyanov" and pe.signatures[i].serial=="74:73:d9:54:05:d2:b0:b3:a8:f2:87:85:ce:6e:74:ca" and 1453939199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dmitrij Emelyanov" and pe.signatures [ i ] . serial == "74:73:d9:54:05:d2:b0:b3:a8:f2:87:85:ce:6e:74:ca" and 1453939199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35317,13 +35317,13 @@ rule REVERSINGLABS_Cert_Blocklist_04F380F97579F1702A85E0169Bbdfd78 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "860027ff-2df2-5519-afde-60ebee270290"
+		id = "1c240ac4-fa7e-5cba-a8b8-a7d28ad3681c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1906-L1922"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "73dc6e36fdaf5c80b33f20f2a9157805ce1d0218f3898104de16522ee9cfd51b"
+		logic_hash = "v1_sha256_73dc6e36fdaf5c80b33f20f2a9157805ce1d0218f3898104de16522ee9cfd51b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35333,7 +35333,7 @@ rule REVERSINGLABS_Cert_Blocklist_04F380F97579F1702A85E0169Bbdfd78 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GRANIFLOR" and pe.signatures[i].serial=="04:f3:80:f9:75:79:f1:70:2a:85:e0:16:9b:bd:fd:78" and 1454889599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GRANIFLOR" and pe.signatures [ i ] . serial == "04:f3:80:f9:75:79:f1:70:2a:85:e0:16:9b:bd:fd:78" and 1454889599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35342,13 +35342,13 @@ rule REVERSINGLABS_Cert_Blocklist_04D6B8Cc6Dce353Fcf3Ae8A532Be7255 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "937dd780-52f7-5f27-ac2e-a0245997d449"
+		id = "9178b6ac-b2cd-58d2-bce1-ad079d97294a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1924-L1940"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a316ad7f554428d02a850fb3bb04f349d30ecd2ccd4597e7a63461bf5e866e6f"
+		logic_hash = "v1_sha256_a316ad7f554428d02a850fb3bb04f349d30ecd2ccd4597e7a63461bf5e866e6f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35358,7 +35358,7 @@ rule REVERSINGLABS_Cert_Blocklist_04D6B8Cc6Dce353Fcf3Ae8A532Be7255 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MADERA" and pe.signatures[i].serial=="04:d6:b8:cc:6d:ce:35:3f:cf:3a:e8:a5:32:be:72:55" and 1451692799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MADERA" and pe.signatures [ i ] . serial == "04:d6:b8:cc:6d:ce:35:3f:cf:3a:e8:a5:32:be:72:55" and 1451692799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35367,13 +35367,13 @@ rule REVERSINGLABS_Cert_Blocklist_191322A00200F793 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4011e54c-ca28-536f-8759-077fcce6d45f"
+		id = "81fe75a6-fd0d-5d4a-aebb-8bfccff1edeb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1942-L1958"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1b816785f86189817c124636e50a0f369ec85cfd898223c4ba43758a877f1cf3"
+		logic_hash = "v1_sha256_1b816785f86189817c124636e50a0f369ec85cfd898223c4ba43758a877f1cf3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35383,7 +35383,7 @@ rule REVERSINGLABS_Cert_Blocklist_191322A00200F793 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PRABHAKAR NARAYAN" and pe.signatures[i].serial=="19:13:22:a0:02:00:f7:93" and 1442966399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PRABHAKAR NARAYAN" and pe.signatures [ i ] . serial == "19:13:22:a0:02:00:f7:93" and 1442966399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35392,13 +35392,13 @@ rule REVERSINGLABS_Cert_Blocklist_451C9D0B413E6E8Df175 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "adc832c0-166d-52d1-aeec-2fc92ff52d02"
+		id = "83e818ef-bf03-5469-a47d-54109422196e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1960-L1976"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7c94d87f79c9add4d7bf2a63d0774449319aa56cbc631dd9b0f19ed9bb9837d4"
+		logic_hash = "v1_sha256_7c94d87f79c9add4d7bf2a63d0774449319aa56cbc631dd9b0f19ed9bb9837d4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35408,7 +35408,7 @@ rule REVERSINGLABS_Cert_Blocklist_451C9D0B413E6E8Df175 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PRASAD UPENDRA" and pe.signatures[i].serial=="45:1c:9d:0b:41:3e:6e:8d:f1:75" and 1442275199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PRASAD UPENDRA" and pe.signatures [ i ] . serial == "45:1c:9d:0b:41:3e:6e:8d:f1:75" and 1442275199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35417,13 +35417,13 @@ rule REVERSINGLABS_Cert_Blocklist_03943858218F35Adb7073A6027555621 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fbaf4c7a-5f20-57f7-b6b7-143fdbf0e5c2"
+		id = "e8b490f2-7b49-5a32-96de-7f43d4c99bc2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1978-L1994"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "93369d51b73591559494a48fafa5e4f7d46301ecaa379d8de70a70ac4d2d2728"
+		logic_hash = "v1_sha256_93369d51b73591559494a48fafa5e4f7d46301ecaa379d8de70a70ac4d2d2728"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35433,7 +35433,7 @@ rule REVERSINGLABS_Cert_Blocklist_03943858218F35Adb7073A6027555621 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RuN APps FOrEver lld" and pe.signatures[i].serial=="03:94:38:58:21:8f:35:ad:b7:07:3a:60:27:55:56:21" and 1480550399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RuN APps FOrEver lld" and pe.signatures [ i ] . serial == "03:94:38:58:21:8f:35:ad:b7:07:3a:60:27:55:56:21" and 1480550399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35442,13 +35442,13 @@ rule REVERSINGLABS_Cert_Blocklist_09813Ee7318452C28A1F6426D1Cee12D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "db3c1992-b6a1-5aaf-ae3a-c626b531529a"
+		id = "f0cd893e-80c6-5142-a7a5-97f75e8cc515"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L1996-L2012"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "89eb019192f822f9fe070403161d81e425fb8acdbc80e55fa516b5607eb8f8c7"
+		logic_hash = "v1_sha256_89eb019192f822f9fe070403161d81e425fb8acdbc80e55fa516b5607eb8f8c7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35458,7 +35458,7 @@ rule REVERSINGLABS_Cert_Blocklist_09813Ee7318452C28A1F6426D1Cee12D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Saly Younes" and pe.signatures[i].serial=="09:81:3e:e7:31:84:52:c2:8a:1f:64:26:d1:ce:e1:2d" and 1455667199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Saly Younes" and pe.signatures [ i ] . serial == "09:81:3e:e7:31:84:52:c2:8a:1f:64:26:d1:ce:e1:2d" and 1455667199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35467,13 +35467,13 @@ rule REVERSINGLABS_Cert_Blocklist_476Bf24A4B1E9F4Bc2A61B152115E1Fe : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Derusbi malware."
 		author = "ReversingLabs"
-		id = "a41e8196-f5ad-5046-82ac-38c6fe753bdb"
+		id = "59f6775d-4344-5a5e-b50a-e4c6ae345d79"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2014-L2030"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0ec0f44d2a7a53ad5653334378b631abde1834ebfcf72efcdcce353c6b9ae17d"
+		logic_hash = "v1_sha256_0ec0f44d2a7a53ad5653334378b631abde1834ebfcf72efcdcce353c6b9ae17d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35483,7 +35483,7 @@ rule REVERSINGLABS_Cert_Blocklist_476Bf24A4B1E9F4Bc2A61B152115E1Fe : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Wemade Entertainment co.,Ltd" and pe.signatures[i].serial=="47:6b:f2:4a:4b:1e:9f:4b:c2:a6:1b:15:21:15:e1:fe" and 1414454399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Wemade Entertainment co.,Ltd" and pe.signatures [ i ] . serial == "47:6b:f2:4a:4b:1e:9f:4b:c2:a6:1b:15:21:15:e1:fe" and 1414454399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35492,13 +35492,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Bd55818C5971B63Dc45Cf57Cbeb950B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Derusbi malware."
 		author = "ReversingLabs"
-		id = "9269cc5c-039e-5d98-ac13-c7b99606e7fa"
+		id = "4146c8d8-2f8d-5d52-8d34-6e8c4b4579d9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2032-L2048"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5aa41a2d6a86a30559b36818602e1bdf2bfd38b799a4869c26c150052d6d788c"
+		logic_hash = "v1_sha256_5aa41a2d6a86a30559b36818602e1bdf2bfd38b799a4869c26c150052d6d788c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35508,7 +35508,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Bd55818C5971B63Dc45Cf57Cbeb950B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "XL Games Co.,Ltd." and pe.signatures[i].serial=="7b:d5:58:18:c5:97:1b:63:dc:45:cf:57:cb:eb:95:0b" and 1371513599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "XL Games Co.,Ltd." and pe.signatures [ i ] . serial == "7b:d5:58:18:c5:97:1b:63:dc:45:cf:57:cb:eb:95:0b" and 1371513599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35517,13 +35517,13 @@ rule REVERSINGLABS_Cert_Blocklist_4C0B2E9D2Ef909D15270D4Dd7Fa5A4A5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Derusbi malware."
 		author = "ReversingLabs"
-		id = "97005464-1219-56d7-bd5c-f047558be1dc"
+		id = "7ea27d85-e09b-5cac-ac23-dc8e57f6e172"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2050-L2066"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9c74eb025bb413503b97ffdba6f19eadecf3789ce3a5d5419f84e32e25c9b5b1"
+		logic_hash = "v1_sha256_9c74eb025bb413503b97ffdba6f19eadecf3789ce3a5d5419f84e32e25c9b5b1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35533,7 +35533,7 @@ rule REVERSINGLABS_Cert_Blocklist_4C0B2E9D2Ef909D15270D4Dd7Fa5A4A5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fuqing Dawu Technology Co.,Ltd." and pe.signatures[i].serial=="4c:0b:2e:9d:2e:f9:09:d1:52:70:d4:dd:7f:a5:a4:a5" and 1372118399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fuqing Dawu Technology Co.,Ltd." and pe.signatures [ i ] . serial == "4c:0b:2e:9d:2e:f9:09:d1:52:70:d4:dd:7f:a5:a4:a5" and 1372118399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35542,13 +35542,13 @@ rule REVERSINGLABS_Cert_Blocklist_5E3D76Dc7E273E2F313Fc0775847A2A2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Sakula and Derusbi malware."
 		author = "ReversingLabs"
-		id = "93707307-a250-526d-a3d4-32ed5d2a63a6"
+		id = "56a5288c-ae62-5bd0-8038-16aa46815469"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2068-L2084"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b943057fc3e97cfccadb4b8f61289a93b659aacf2a40217fcf519d4882e70708"
+		logic_hash = "v1_sha256_b943057fc3e97cfccadb4b8f61289a93b659aacf2a40217fcf519d4882e70708"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35558,7 +35558,7 @@ rule REVERSINGLABS_Cert_Blocklist_5E3D76Dc7E273E2F313Fc0775847A2A2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NexG" and pe.signatures[i].serial=="5e:3d:76:dc:7e:27:3e:2f:31:3f:c0:77:58:47:a2:a2" and 1372723199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NexG" and pe.signatures [ i ] . serial == "5e:3d:76:dc:7e:27:3e:2f:31:3f:c0:77:58:47:a2:a2" and 1372723199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35567,13 +35567,13 @@ rule REVERSINGLABS_Cert_Blocklist_47D5D5372Bcb1562B4C9F4C2Bdf13587 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Sakula malware."
 		author = "ReversingLabs"
-		id = "d888478e-3883-5d9d-a2b3-d59b57409b8d"
+		id = "7cd3951c-9caa-5350-b364-a526a6e28fc9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2086-L2102"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fb4994647a2ed95c73625d90315c9b6deb6fb3b81b4aa6e847b0193f0a76650c"
+		logic_hash = "v1_sha256_fb4994647a2ed95c73625d90315c9b6deb6fb3b81b4aa6e847b0193f0a76650c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35583,7 +35583,7 @@ rule REVERSINGLABS_Cert_Blocklist_47D5D5372Bcb1562B4C9F4C2Bdf13587 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DTOPTOOLZ Co.,Ltd." and pe.signatures[i].serial=="47:d5:d5:37:2b:cb:15:62:b4:c9:f4:c2:bd:f1:35:87" and 1400803199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DTOPTOOLZ Co.,Ltd." and pe.signatures [ i ] . serial == "47:d5:d5:37:2b:cb:15:62:b4:c9:f4:c2:bd:f1:35:87" and 1400803199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35592,13 +35592,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Ac10E68F1Ce519E84Ddcd28B11Fa542 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Sakula malware."
 		author = "ReversingLabs"
-		id = "9cc0e518-84c8-5b23-b8cb-e0e0fe7849bd"
+		id = "5d642fc9-a444-53bf-b03f-3306ca56ec90"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2104-L2120"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dac3b6b7609ec1e82afe4f9c6c14e2d32b6f5d8d49c59d6c605f2a94d71bc107"
+		logic_hash = "v1_sha256_dac3b6b7609ec1e82afe4f9c6c14e2d32b6f5d8d49c59d6c605f2a94d71bc107"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35608,7 +35608,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Ac10E68F1Ce519E84Ddcd28B11Fa542 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "U-Tech IT service" and pe.signatures[i].serial=="3a:c1:0e:68:f1:ce:51:9e:84:dd:cd:28:b1:1f:a5:42" and 1420156799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "U-Tech IT service" and pe.signatures [ i ] . serial == "3a:c1:0e:68:f1:ce:51:9e:84:dd:cd:28:b1:1f:a5:42" and 1420156799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35617,13 +35617,13 @@ rule REVERSINGLABS_Cert_Blocklist_31062E483E0106B18C982F0053185C36 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Sakula malware."
 		author = "ReversingLabs"
-		id = "84bce7c1-efba-5a76-8865-dcfcc8e50d41"
+		id = "bfeaaaac-f8d7-5e76-abbe-4a18ef5f5eb7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2122-L2138"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e45fc5b4d1b9f5cd35c56aad381e26e30675a9d99747cd318f3c77ea2af0e14a"
+		logic_hash = "v1_sha256_e45fc5b4d1b9f5cd35c56aad381e26e30675a9d99747cd318f3c77ea2af0e14a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35633,7 +35633,7 @@ rule REVERSINGLABS_Cert_Blocklist_31062E483E0106B18C982F0053185C36 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MICRO DIGITAL INC." and pe.signatures[i].serial=="31:06:2e:48:3e:01:06:b1:8c:98:2f:00:53:18:5c:36" and 1332287999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MICRO DIGITAL INC." and pe.signatures [ i ] . serial == "31:06:2e:48:3e:01:06:b1:8c:98:2f:00:53:18:5c:36" and 1332287999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35642,13 +35642,13 @@ rule REVERSINGLABS_Cert_Blocklist_20D0Ee42Fc901E6B3A8Fefe8C1E6087A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing Sakula malware."
 		author = "ReversingLabs"
-		id = "ba37919a-584b-5ff7-b4d5-5b711cc87b1f"
+		id = "8dff7c52-d6aa-5540-a094-252437eb9e1b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2140-L2156"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2225302de1e8fe9f2ad064e19b2b1d9faf90c7cafbebff6ddd0921bf57c5f9e6"
+		logic_hash = "v1_sha256_2225302de1e8fe9f2ad064e19b2b1d9faf90c7cafbebff6ddd0921bf57c5f9e6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35658,7 +35658,7 @@ rule REVERSINGLABS_Cert_Blocklist_20D0Ee42Fc901E6B3A8Fefe8C1E6087A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SJ SYSTEM" and pe.signatures[i].serial=="20:d0:ee:42:fc:90:1e:6b:3a:8f:ef:e8:c1:e6:08:7a" and 1391299199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SJ SYSTEM" and pe.signatures [ i ] . serial == "20:d0:ee:42:fc:90:1e:6b:3a:8f:ef:e8:c1:e6:08:7a" and 1391299199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35667,13 +35667,13 @@ rule REVERSINGLABS_Cert_Blocklist_127251B32B9A50Bd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing OSX DokSpy backdoor."
 		author = "ReversingLabs"
-		id = "3581085c-a6e7-571f-8253-f8d9e90e78fc"
+		id = "831d550b-c18b-5434-92aa-e749ac26d471"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2158-L2174"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8552ce9e9ab8d6b1025ab3c6e7b2485ef855236114c426475fde0b5f2e231ec9"
+		logic_hash = "v1_sha256_8552ce9e9ab8d6b1025ab3c6e7b2485ef855236114c426475fde0b5f2e231ec9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35683,7 +35683,7 @@ rule REVERSINGLABS_Cert_Blocklist_127251B32B9A50Bd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Developer ID Application: Edouard Roulet (W7J9LRHXTG)" and pe.signatures[i].serial=="12:72:51:b3:2b:9a:50:bd" and 1493769599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Developer ID Application: Edouard Roulet (W7J9LRHXTG)" and pe.signatures [ i ] . serial == "12:72:51:b3:2b:9a:50:bd" and 1493769599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35692,13 +35692,13 @@ rule REVERSINGLABS_Cert_Blocklist_48Cad4E6966E22D6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing OSX DokSpy backdoor."
 		author = "ReversingLabs"
-		id = "22d62d7e-3f76-5f6b-a3f1-a6b087fb63e2"
+		id = "b276bbaa-0b32-577b-9529-c70fdd7520e8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2176-L2192"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7733b8a97d9f3538db04309a2e3f9df6cb64930b0b6f7f241c3e629be2dd7804"
+		logic_hash = "v1_sha256_7733b8a97d9f3538db04309a2e3f9df6cb64930b0b6f7f241c3e629be2dd7804"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35708,7 +35708,7 @@ rule REVERSINGLABS_Cert_Blocklist_48Cad4E6966E22D6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Developer ID Application: Seven Muller (FUP9692NN6)" and pe.signatures[i].serial=="48:ca:d4:e6:96:6e:22:d6" and 1492732799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Developer ID Application: Seven Muller (FUP9692NN6)" and pe.signatures [ i ] . serial == "48:ca:d4:e6:96:6e:22:d6" and 1492732799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35717,13 +35717,13 @@ rule REVERSINGLABS_Cert_Blocklist_5E15205F180442Cc6C3C0F03E1A33D9F : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "4a0d995a-37df-52a4-a66f-4bc6c290c10a"
+		id = "bae1b19d-3d31-5e27-9ceb-20f004146bdc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2194-L2210"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1ca238b5da4ff9940425c99f55542c931ccdf0ea3b0a2acbf00ffbbb54171ae0"
+		logic_hash = "v1_sha256_1ca238b5da4ff9940425c99f55542c931ccdf0ea3b0a2acbf00ffbbb54171ae0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35733,7 +35733,7 @@ rule REVERSINGLABS_Cert_Blocklist_5E15205F180442Cc6C3C0F03E1A33D9F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ziber Ltd" and pe.signatures[i].serial=="5e:15:20:5f:18:04:42:cc:6c:3c:0f:03:e1:a3:3d:9f" and 1498607999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ziber Ltd" and pe.signatures [ i ] . serial == "5e:15:20:5f:18:04:42:cc:6c:3c:0f:03:e1:a3:3d:9f" and 1498607999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35742,13 +35742,13 @@ rule REVERSINGLABS_Cert_Blocklist_4C8E3B1613F73542F7106F272094Eb23 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "06f79efe-134e-5941-80fe-3b6482ac9668"
+		id = "fb0ad329-cccb-50d4-8312-d01d01447004"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2212-L2228"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "15c21b783409d904a0b4971dbdcbd0740083d13f3c633ee77c87df46d3aca748"
+		logic_hash = "v1_sha256_15c21b783409d904a0b4971dbdcbd0740083d13f3c633ee77c87df46d3aca748"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35758,7 +35758,7 @@ rule REVERSINGLABS_Cert_Blocklist_4C8E3B1613F73542F7106F272094Eb23 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADD Audit" and pe.signatures[i].serial=="4c:8e:3b:16:13:f7:35:42:f7:10:6f:27:20:94:eb:23" and 1472687999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ADD Audit" and pe.signatures [ i ] . serial == "4c:8e:3b:16:13:f7:35:42:f7:10:6f:27:20:94:eb:23" and 1472687999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35767,13 +35767,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Ce2Bd0Ad3Cfde9Ea73Eec7Ca30400Da : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "b7439b38-c8b7-5dcb-8d10-952862ce3465"
+		id = "e26cfb12-4584-583b-8657-3b6d8533fe32"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2230-L2246"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a879ecd957acd29e8a5bad6c97cd10453ab857949680b522735bd77eb561d2ee"
+		logic_hash = "v1_sha256_a879ecd957acd29e8a5bad6c97cd10453ab857949680b522735bd77eb561d2ee"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35783,7 +35783,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Ce2Bd0Ad3Cfde9Ea73Eec7Ca30400Da : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Media Lid" and pe.signatures[i].serial=="2c:e2:bd:0a:d3:cf:de:9e:a7:3e:ec:7c:a3:04:00:da" and 1493337599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Media Lid" and pe.signatures [ i ] . serial == "2c:e2:bd:0a:d3:cf:de:9e:a7:3e:ec:7c:a3:04:00:da" and 1493337599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35792,13 +35792,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Fbc30Db127A536C34D7A0Fa81B48193 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "c755a6c1-e113-5513-9a61-87bf6d7dcb3e"
+		id = "cc5c248c-9c05-5353-b6c6-30b4c8d9fe9e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2248-L2264"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6b109b5636aa297a6e07f9d9213f7f07a7767b58442d03dc2f34f8a9b3eaba2b"
+		logic_hash = "v1_sha256_6b109b5636aa297a6e07f9d9213f7f07a7767b58442d03dc2f34f8a9b3eaba2b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35808,7 +35808,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Fbc30Db127A536C34D7A0Fa81B48193 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Megabit, OOO" and pe.signatures[i].serial=="0f:bc:30:db:12:7a:53:6c:34:d7:a0:fa:81:b4:81:93" and 1466121599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Megabit, OOO" and pe.signatures [ i ] . serial == "0f:bc:30:db:12:7a:53:6c:34:d7:a0:fa:81:b4:81:93" and 1466121599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35817,13 +35817,13 @@ rule REVERSINGLABS_Cert_Blocklist_08448Bd6Ee9105Ae31228Ea5Fe496F63 : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "489ffe25-43cf-55b6-b249-17d251b9774e"
+		id = "3d7713f2-4a5e-53ec-aefa-6d1c8737f83d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2266-L2282"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9bc044b4fdf381274a2c31bc997dcdfd553595d92de7b33dc472353a00011711"
+		logic_hash = "v1_sha256_9bc044b4fdf381274a2c31bc997dcdfd553595d92de7b33dc472353a00011711"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35833,7 +35833,7 @@ rule REVERSINGLABS_Cert_Blocklist_08448Bd6Ee9105Ae31228Ea5Fe496F63 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Raffaele Carnacina" and pe.signatures[i].serial=="08:44:8b:d6:ee:91:05:ae:31:22:8e:a5:fe:49:6f:63" and 1445212799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Raffaele Carnacina" and pe.signatures [ i ] . serial == "08:44:8b:d6:ee:91:05:ae:31:22:8e:a5:fe:49:6f:63" and 1445212799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35842,13 +35842,13 @@ rule REVERSINGLABS_Cert_Blocklist_02F17566Ef568Dc06C9A379Ea2F4Faea : INFO FILE
 	meta:
 		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "a14e16ff-844c-53ff-9297-8760265da747"
+		id = "f329536b-17a3-57be-a082-0c49edc1d74f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2284-L2300"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e3ec8a6de817354862880301e78a999f45f02c2fa8512bba6d27c9776f1a3417"
+		logic_hash = "v1_sha256_e3ec8a6de817354862880301e78a999f45f02c2fa8512bba6d27c9776f1a3417"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35858,7 +35858,7 @@ rule REVERSINGLABS_Cert_Blocklist_02F17566Ef568Dc06C9A379Ea2F4Faea : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VALERIANO BEDESCHI" and pe.signatures[i].serial=="02:f1:75:66:ef:56:8d:c0:6c:9a:37:9e:a2:f4:fa:ea" and 1441324799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VALERIANO BEDESCHI" and pe.signatures [ i ] . serial == "02:f1:75:66:ef:56:8d:c0:6c:9a:37:9e:a2:f4:fa:ea" and 1441324799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35867,13 +35867,13 @@ rule REVERSINGLABS_Cert_Blocklist_7D824Ba1F7F730319C50D64C9A7Ed507 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4372aea7-a25b-5211-befd-9e0bcfb09199"
+		id = "23dd5d56-ac05-5324-902d-3305796eff9a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2302-L2318"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "407611603974c910d9a6a0ed71ecdf54ddcc59abb0f48c60846e61d6d4191933"
+		logic_hash = "v1_sha256_407611603974c910d9a6a0ed71ecdf54ddcc59abb0f48c60846e61d6d4191933"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35883,7 +35883,7 @@ rule REVERSINGLABS_Cert_Blocklist_7D824Ba1F7F730319C50D64C9A7Ed507 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "joaweb" and pe.signatures[i].serial=="7d:82:4b:a1:f7:f7:30:31:9c:50:d6:4c:9a:7e:d5:07" and 1238025599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "joaweb" and pe.signatures [ i ] . serial == "7d:82:4b:a1:f7:f7:30:31:9c:50:d6:4c:9a:7e:d5:07" and 1238025599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35892,13 +35892,13 @@ rule REVERSINGLABS_Cert_Blocklist_77A64759F12766E363D779998C71Bdc9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "98acd01b-c452-530d-8814-2591810ecd53"
+		id = "d90085b5-e6c7-53b3-b34c-f8d1bc8acd5e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2320-L2336"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2bf3d99ddec6b76da1ca60a9285767a5b34b84455db58195fc5d8fd8a22c9f8a"
+		logic_hash = "v1_sha256_2bf3d99ddec6b76da1ca60a9285767a5b34b84455db58195fc5d8fd8a22c9f8a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35908,7 +35908,7 @@ rule REVERSINGLABS_Cert_Blocklist_77A64759F12766E363D779998C71Bdc9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Gigabit Times Technology Co., Ltd" and pe.signatures[i].serial=="77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9" and 1301011199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Gigabit Times Technology Co., Ltd" and pe.signatures [ i ] . serial == "77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9" and 1301011199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35917,13 +35917,13 @@ rule REVERSINGLABS_Cert_Blocklist_0B0D17Ec1449B4B2D38Fcb0F20Fbcd3A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4484b00d-8fad-5f8f-9030-67216f2820a3"
+		id = "c2479c2b-7fdb-5adf-8bb2-5933188ff0f8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2338-L2354"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3121f2c49d0d4c396023924521f2c980045b6f07d082e49447429e9cd640e0ef"
+		logic_hash = "v1_sha256_3121f2c49d0d4c396023924521f2c980045b6f07d082e49447429e9cd640e0ef"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35933,7 +35933,7 @@ rule REVERSINGLABS_Cert_Blocklist_0B0D17Ec1449B4B2D38Fcb0F20Fbcd3A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WEBPIC DESENVOLVIMENTO DE SOFTWARE LTDA" and pe.signatures[i].serial=="0b:0d:17:ec:14:49:b4:b2:d3:8f:cb:0f:20:fb:cd:3a" and 1394150399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "WEBPIC DESENVOLVIMENTO DE SOFTWARE LTDA" and pe.signatures [ i ] . serial == "0b:0d:17:ec:14:49:b4:b2:d3:8f:cb:0f:20:fb:cd:3a" and 1394150399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35942,13 +35942,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fe9404Dc73Cf1C2Ba1450B8398305557 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "17700719-81ea-58d4-87f5-4d5c1b19bf64"
+		id = "478b502f-562a-5ca8-bea5-c77c991538b0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2356-L2374"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c0132d71de1384f6e534dd154eba88c4a51c43b7dfe984f3064ba4feffa4dd5a"
+		logic_hash = "v1_sha256_c0132d71de1384f6e534dd154eba88c4a51c43b7dfe984f3064ba4feffa4dd5a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35958,7 +35958,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fe9404Dc73Cf1C2Ba1450B8398305557 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x8E\\xA6\\xE9\\x97\\xA8\\xE7\\xBF\\x94\\xE9\\x80\\x9A\\xE4\\xBF\\xA1\\xE6\\x81\\xAF\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE5\\x88\\x86\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and (pe.signatures[i].serial=="00:fe:94:04:dc:73:cf:1c:2b:a1:45:0b:83:98:30:55:57" or pe.signatures[i].serial=="fe:94:04:dc:73:cf:1c:2b:a1:45:0b:83:98:30:55:57") and 1287360000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\x8E\\xA6\\xE9\\x97\\xA8\\xE7\\xBF\\x94\\xE9\\x80\\x9A\\xE4\\xBF\\xA1\\xE6\\x81\\xAF\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE5\\x88\\x86\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and ( pe.signatures [ i ] . serial == "00:fe:94:04:dc:73:cf:1c:2b:a1:45:0b:83:98:30:55:57" or pe.signatures [ i ] . serial == "fe:94:04:dc:73:cf:1c:2b:a1:45:0b:83:98:30:55:57" ) and 1287360000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35967,13 +35967,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Cb2D523A6Bf7A066642C578De1C9Be4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d2c87c29-cb64-5d43-847b-64c888421c1f"
+		id = "35b4c6d5-2441-5981-b780-ea7b090ab62a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2376-L2392"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5a786b9ade5a59b8a1e0bbef1eb3dcb65404dcee19d572dc60f9ec9f45e4755b"
+		logic_hash = "v1_sha256_5a786b9ade5a59b8a1e0bbef1eb3dcb65404dcee19d572dc60f9ec9f45e4755b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -35983,7 +35983,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Cb2D523A6Bf7A066642C578De1C9Be4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shenzhen Hua\\xE2\\x80\\x99nan Xingfa Electronic Equipment Firm" and pe.signatures[i].serial=="1c:b2:d5:23:a6:bf:7a:06:66:42:c5:78:de:1c:9b:e4" and 1400889599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shenzhen Hua\\xE2\\x80\\x99nan Xingfa Electronic Equipment Firm" and pe.signatures [ i ] . serial == "1c:b2:d5:23:a6:bf:7a:06:66:42:c5:78:de:1c:9b:e4" and 1400889599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -35992,13 +35992,13 @@ rule REVERSINGLABS_Cert_Blocklist_3A6Ccabb1C62F3Be3Eb03869Fa43Dc4A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b16f7bb7-88fe-5f8f-9592-8d309f556419"
+		id = "1dae33e9-147c-54bf-b075-11940a4efc00"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2394-L2410"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ccb603c8a5f4fb63876e78d763f80a97098c23aa10673c7b04a48026268f57d3"
+		logic_hash = "v1_sha256_ccb603c8a5f4fb63876e78d763f80a97098c23aa10673c7b04a48026268f57d3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36008,7 +36008,7 @@ rule REVERSINGLABS_Cert_Blocklist_3A6Ccabb1C62F3Be3Eb03869Fa43Dc4A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xB8\\xB8\\xE5\\xB7\\x9E\\xE9\\xAA\\x8F\\xE6\\x99\\xAF\\xE9\\x80\\x9A\\xE8\\x81\\x94\\xE6\\x95\\xB0\\xE5\\xAD\\x97\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="3a:6c:ca:bb:1c:62:f3:be:3e:b0:38:69:fa:43:dc:4a" and 1259798399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\xB8\\xB8\\xE5\\xB7\\x9E\\xE9\\xAA\\x8F\\xE6\\x99\\xAF\\xE9\\x80\\x9A\\xE8\\x81\\x94\\xE6\\x95\\xB0\\xE5\\xAD\\x97\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "3a:6c:ca:bb:1c:62:f3:be:3e:b0:38:69:fa:43:dc:4a" and 1259798399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36017,13 +36017,13 @@ rule REVERSINGLABS_Cert_Blocklist_864196F01971Dbec7002B48642A7013A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "80478430-ce01-5fae-bcaf-2b7a445bc20d"
+		id = "c8763456-02b4-5c88-b2f3-0fc3d5cffb3f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2412-L2430"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a3173bb08e673caaa64ab22854840a135e891044b165bbc67733c951ec6aa991"
+		logic_hash = "v1_sha256_a3173bb08e673caaa64ab22854840a135e891044b165bbc67733c951ec6aa991"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36033,7 +36033,7 @@ rule REVERSINGLABS_Cert_Blocklist_864196F01971Dbec7002B48642A7013A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WLE DESENVOLVIMENTO DE SOFTWARE E ASSESSORIA LTDA EPP" and (pe.signatures[i].serial=="00:86:41:96:f0:19:71:db:ec:70:02:b4:86:42:a7:01:3a" or pe.signatures[i].serial=="86:41:96:f0:19:71:db:ec:70:02:b4:86:42:a7:01:3a") and 1384300799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "WLE DESENVOLVIMENTO DE SOFTWARE E ASSESSORIA LTDA EPP" and ( pe.signatures [ i ] . serial == "00:86:41:96:f0:19:71:db:ec:70:02:b4:86:42:a7:01:3a" or pe.signatures [ i ] . serial == "86:41:96:f0:19:71:db:ec:70:02:b4:86:42:a7:01:3a" ) and 1384300799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36042,13 +36042,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Fda1E121B61Adeca936A6Aebe079303 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fba98d6b-dc09-5294-ad86-2f4e0d8ad320"
+		id = "3b3f1366-16ad-522e-a490-35c42ac0209f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2432-L2448"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "70a04c83e79c98024bacf1688bb46d80c9b8491e25dd32d6d92bf3cf61c62e48"
+		logic_hash = "v1_sha256_70a04c83e79c98024bacf1688bb46d80c9b8491e25dd32d6d92bf3cf61c62e48"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36058,7 +36058,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Fda1E121B61Adeca936A6Aebe079303 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Laizhou wanlei stone Co., LTD" and pe.signatures[i].serial=="4f:da:1e:12:1b:61:ad:ec:a9:36:a6:ae:be:07:93:03" and 1310687999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Laizhou wanlei stone Co., LTD" and pe.signatures [ i ] . serial == "4f:da:1e:12:1b:61:ad:ec:a9:36:a6:ae:be:07:93:03" and 1310687999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36067,13 +36067,13 @@ rule REVERSINGLABS_Cert_Blocklist_03866Deb183Abfbf4Ff458D4De7Bd73A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2641eb86-94f0-537c-a82a-6a5e1596ee84"
+		id = "48f082bc-c58d-579d-a19d-41b1861ab660"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2450-L2466"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "90d09d0d2d01500e0670277d0e8de574feecf7443cf4d077912b1166a9c14c43"
+		logic_hash = "v1_sha256_90d09d0d2d01500e0670277d0e8de574feecf7443cf4d077912b1166a9c14c43"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36083,7 +36083,7 @@ rule REVERSINGLABS_Cert_Blocklist_03866Deb183Abfbf4Ff458D4De7Bd73A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE9\\x87\\x8D\\xE5\\xBA\\x86\\xE8\\xAF\\x9D\\xE8\\xAF\\xAD\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="03:86:6d:eb:18:3a:bf:bf:4f:f4:58:d4:de:7b:d7:3a" and 1371772799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE9\\x87\\x8D\\xE5\\xBA\\x86\\xE8\\xAF\\x9D\\xE8\\xAF\\xAD\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "03:86:6d:eb:18:3a:bf:bf:4f:f4:58:d4:de:7b:d7:3a" and 1371772799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36092,13 +36092,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Be41B34127Ca9E6270830D2070Db426 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bee69e9d-db8e-5d4e-8e97-b3791b4f717d"
+		id = "e44afe7f-3a7c-50ff-bd18-1ff1b0b5f4a3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2468-L2484"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b66c4b9264be70d53838442a3112c4bacbdf2dda90840d71c3eb949e630b3f17"
+		logic_hash = "v1_sha256_b66c4b9264be70d53838442a3112c4bacbdf2dda90840d71c3eb949e630b3f17"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36108,7 +36108,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Be41B34127Ca9E6270830D2070Db426 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE8\\x80\\x98\\xE5\\x8D\\x87\\xE5\\xA4\\xA9\\xE4\\xB8\\x8B\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="1b:e4:1b:34:12:7c:a9:e6:27:08:30:d2:07:0d:b4:26" and 1352764799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE8\\x80\\x98\\xE5\\x8D\\x87\\xE5\\xA4\\xA9\\xE4\\xB8\\x8B\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "1b:e4:1b:34:12:7c:a9:e6:27:08:30:d2:07:0d:b4:26" and 1352764799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36117,13 +36117,13 @@ rule REVERSINGLABS_Cert_Blocklist_9B108B8A1Daa0D5581F59Fcee0447901 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cacb2af8-dbc6-5d61-a2d5-641c5c09bc79"
+		id = "3dac7711-674e-5d9c-8099-e15f5fa33a51"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2486-L2504"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "696e3da511f74f9cfb10b96130a36ae9f48c22f1e0deb76092db1262980ab3ac"
+		logic_hash = "v1_sha256_696e3da511f74f9cfb10b96130a36ae9f48c22f1e0deb76092db1262980ab3ac"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36133,7 +36133,7 @@ rule REVERSINGLABS_Cert_Blocklist_9B108B8A1Daa0D5581F59Fcee0447901 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CharacTell Ltd" and (pe.signatures[i].serial=="00:9b:10:8b:8a:1d:aa:0d:55:81:f5:9f:ce:e0:44:79:01" or pe.signatures[i].serial=="9b:10:8b:8a:1d:aa:0d:55:81:f5:9f:ce:e0:44:79:01") and 1380671999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CharacTell Ltd" and ( pe.signatures [ i ] . serial == "00:9b:10:8b:8a:1d:aa:0d:55:81:f5:9f:ce:e0:44:79:01" or pe.signatures [ i ] . serial == "9b:10:8b:8a:1d:aa:0d:55:81:f5:9f:ce:e0:44:79:01" ) and 1380671999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36142,13 +36142,13 @@ rule REVERSINGLABS_Cert_Blocklist_5F8203C430Fc7Db4E61F6684F6829Ffc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "975cd500-2f08-55c9-a821-4dde3a54ae0c"
+		id = "11194d47-3c2a-552f-ae67-e00497f9b656"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2506-L2522"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cd22d1beea12d1f6c50f69e76074c2582ce5567887056c43d4d6c87d33fce1bf"
+		logic_hash = "v1_sha256_cd22d1beea12d1f6c50f69e76074c2582ce5567887056c43d4d6c87d33fce1bf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36158,7 +36158,7 @@ rule REVERSINGLABS_Cert_Blocklist_5F8203C430Fc7Db4E61F6684F6829Ffc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Haivision Network Video" and pe.signatures[i].serial=="5f:82:03:c4:30:fc:7d:b4:e6:1f:66:84:f6:82:9f:fc" and 1382572799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Haivision Network Video" and pe.signatures [ i ] . serial == "5f:82:03:c4:30:fc:7d:b4:e6:1f:66:84:f6:82:9f:fc" and 1382572799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36167,13 +36167,13 @@ rule REVERSINGLABS_Cert_Blocklist_6B6Daef5Be29F20Ddce4B0F5E9Fa6Ea5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "55611c9a-d45d-55fa-8e5e-a5621223cc9d"
+		id = "005428ab-00bf-5d2f-8cc1-1cfcf047f4b1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2524-L2540"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "edd2f302d2fac65f6a93372a24c3f80757f2b175af661032917366e9629c5491"
+		logic_hash = "v1_sha256_edd2f302d2fac65f6a93372a24c3f80757f2b175af661032917366e9629c5491"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36183,7 +36183,7 @@ rule REVERSINGLABS_Cert_Blocklist_6B6Daef5Be29F20Ddce4B0F5E9Fa6Ea5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Calibration Consultants" and pe.signatures[i].serial=="6b:6d:ae:f5:be:29:f2:0d:dc:e4:b0:f5:e9:fa:6e:a5" and 1280447999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Calibration Consultants" and pe.signatures [ i ] . serial == "6b:6d:ae:f5:be:29:f2:0d:dc:e4:b0:f5:e9:fa:6e:a5" and 1280447999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36192,13 +36192,13 @@ rule REVERSINGLABS_Cert_Blocklist_57D6Dff1Ef96F01B9430666B2733Cc87 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c20b81a1-7331-57a9-9daf-007ec516a473"
+		id = "6fc6e7dd-85d9-54eb-9f88-b86d44875ad7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2542-L2558"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "40d22137e9c5345859c5f000166da2a3117bcfcc19b4c5e81083cad80dfa6ee4"
+		logic_hash = "v1_sha256_40d22137e9c5345859c5f000166da2a3117bcfcc19b4c5e81083cad80dfa6ee4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36208,7 +36208,7 @@ rule REVERSINGLABS_Cert_Blocklist_57D6Dff1Ef96F01B9430666B2733Cc87 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Smart Plugin Ltda" and pe.signatures[i].serial=="57:d6:df:f1:ef:96:f0:1b:94:30:66:6b:27:33:cc:87" and 1314575999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Smart Plugin Ltda" and pe.signatures [ i ] . serial == "57:d6:df:f1:ef:96:f0:1b:94:30:66:6b:27:33:cc:87" and 1314575999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36217,13 +36217,13 @@ rule REVERSINGLABS_Cert_Blocklist_0166B65038D61E5435B48204Cae4795A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "04bdefc5-ee4e-5a46-94d6-e3a5d8b56ce0"
+		id = "10ee6bc5-947a-589e-b83a-7fef1e204a13"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2560-L2576"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4e289eda4d5381250bcd6e36daade6f1e1803b6d16578d7eaee4454cef6981d0"
+		logic_hash = "v1_sha256_4e289eda4d5381250bcd6e36daade6f1e1803b6d16578d7eaee4454cef6981d0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36233,7 +36233,7 @@ rule REVERSINGLABS_Cert_Blocklist_0166B65038D61E5435B48204Cae4795A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TOLGA KAPLAN" and pe.signatures[i].serial=="01:66:b6:50:38:d6:1e:54:35:b4:82:04:ca:e4:79:5a" and 1403999999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TOLGA KAPLAN" and pe.signatures [ i ] . serial == "01:66:b6:50:38:d6:1e:54:35:b4:82:04:ca:e4:79:5a" and 1403999999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36242,13 +36242,13 @@ rule REVERSINGLABS_Cert_Blocklist_784F226B45C3Bd8E4089243D747D1F59 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f2a979e0-2027-5143-8cb4-ffcfd19faf45"
+		id = "2eb740f6-c2e1-51e4-8006-3814067890ff"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2578-L2594"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "df8ca35a07ec6815d1efb68fa6fbf8f80c57032ecb99d0b038da0604ceffe8cf"
+		logic_hash = "v1_sha256_df8ca35a07ec6815d1efb68fa6fbf8f80c57032ecb99d0b038da0604ceffe8cf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36258,7 +36258,7 @@ rule REVERSINGLABS_Cert_Blocklist_784F226B45C3Bd8E4089243D747D1F59 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FSPro Labs" and pe.signatures[i].serial=="78:4f:22:6b:45:c3:bd:8e:40:89:24:3d:74:7d:1f:59" and 1242777599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FSPro Labs" and pe.signatures [ i ] . serial == "78:4f:22:6b:45:c3:bd:8e:40:89:24:3d:74:7d:1f:59" and 1242777599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36267,13 +36267,13 @@ rule REVERSINGLABS_Cert_Blocklist_11690F05604445Fae0De539Eeeeec584 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e6513bd1-2524-5baa-8484-b7e0f2f0c02a"
+		id = "3d816e2d-2a75-5be6-a250-3af16851109a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2596-L2612"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b66257f562f698559910eb9576f8fdf0ce3a750cc0a96a27e2ec1a18872ad13f"
+		logic_hash = "v1_sha256_b66257f562f698559910eb9576f8fdf0ce3a750cc0a96a27e2ec1a18872ad13f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36283,7 +36283,7 @@ rule REVERSINGLABS_Cert_Blocklist_11690F05604445Fae0De539Eeeeec584 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tera information Technology co.Ltd" and pe.signatures[i].serial=="11:69:0f:05:60:44:45:fa:e0:de:53:9e:ee:ee:c5:84" and 1294703999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Tera information Technology co.Ltd" and pe.signatures [ i ] . serial == "11:69:0f:05:60:44:45:fa:e0:de:53:9e:ee:ee:c5:84" and 1294703999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36292,13 +36292,13 @@ rule REVERSINGLABS_Cert_Blocklist_Aa146Bff4B832Bdbfe30B84580356763 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "90fab567-f39f-5d0b-b0d9-a93693a05a01"
+		id = "94b31fa1-925a-52c9-b36b-f47e5c7ec4a5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2614-L2632"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "37abe7a4fd773fd34f5d7dbe725ba4edcfb8ebb501dc41f386b8b0629161051f"
+		logic_hash = "v1_sha256_37abe7a4fd773fd34f5d7dbe725ba4edcfb8ebb501dc41f386b8b0629161051f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36308,7 +36308,7 @@ rule REVERSINGLABS_Cert_Blocklist_Aa146Bff4B832Bdbfe30B84580356763 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yancheng Peoples Information Technology Service Co., Ltd" and (pe.signatures[i].serial=="00:aa:14:6b:ff:4b:83:2b:db:fe:30:b8:45:80:35:67:63" or pe.signatures[i].serial=="aa:14:6b:ff:4b:83:2b:db:fe:30:b8:45:80:35:67:63") and 1295481599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yancheng Peoples Information Technology Service Co., Ltd" and ( pe.signatures [ i ] . serial == "00:aa:14:6b:ff:4b:83:2b:db:fe:30:b8:45:80:35:67:63" or pe.signatures [ i ] . serial == "aa:14:6b:ff:4b:83:2b:db:fe:30:b8:45:80:35:67:63" ) and 1295481599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36317,13 +36317,13 @@ rule REVERSINGLABS_Cert_Blocklist_E86F46B60142092Aae81B8F6Fa3D9C7C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fde17cc1-a968-5134-b12b-d65cb34c086f"
+		id = "6b146164-3cb1-51ce-a08d-e75afb3f4e3d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2634-L2652"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6de16a44bc84fbf8f1d3d82526e1d7f8fd4ae3da6deaa471c77d2c8df47a14b0"
+		logic_hash = "v1_sha256_6de16a44bc84fbf8f1d3d82526e1d7f8fd4ae3da6deaa471c77d2c8df47a14b0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36333,7 +36333,7 @@ rule REVERSINGLABS_Cert_Blocklist_E86F46B60142092Aae81B8F6Fa3D9C7C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Syncode Sistemas e Tecnologia Ltda" and (pe.signatures[i].serial=="00:e8:6f:46:b6:01:42:09:2a:ae:81:b8:f6:fa:3d:9c:7c" or pe.signatures[i].serial=="e8:6f:46:b6:01:42:09:2a:ae:81:b8:f6:fa:3d:9c:7c") and 1373932799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Syncode Sistemas e Tecnologia Ltda" and ( pe.signatures [ i ] . serial == "00:e8:6f:46:b6:01:42:09:2a:ae:81:b8:f6:fa:3d:9c:7c" or pe.signatures [ i ] . serial == "e8:6f:46:b6:01:42:09:2a:ae:81:b8:f6:fa:3d:9c:7c" ) and 1373932799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36342,13 +36342,13 @@ rule REVERSINGLABS_Cert_Blocklist_1A0Fd2A4Ef4C2A36Ab9C5E8F792A35E2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7148a21a-97d6-59a2-a1cf-442c271bc0b5"
+		id = "067b1ce8-a011-5ca6-8cff-e9192b02adbe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2654-L2670"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8e768415998a6a92961986cb0a9d310514d928be93b3e5a9aaa9ec71bf5886ad"
+		logic_hash = "v1_sha256_8e768415998a6a92961986cb0a9d310514d928be93b3e5a9aaa9ec71bf5886ad"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36358,7 +36358,7 @@ rule REVERSINGLABS_Cert_Blocklist_1A0Fd2A4Ef4C2A36Ab9C5E8F792A35E2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE9\\x87\\x91\\xE5\\x88\\xA9\\xE5\\xAE\\x8F\\xE6\\x98\\x8C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="1a:0f:d2:a4:ef:4c:2a:36:ab:9c:5e:8f:79:2a:35:e2" and 1389311999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE9\\x87\\x91\\xE5\\x88\\xA9\\xE5\\xAE\\x8F\\xE6\\x98\\x8C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "1a:0f:d2:a4:ef:4c:2a:36:ab:9c:5e:8f:79:2a:35:e2" and 1389311999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36367,13 +36367,13 @@ rule REVERSINGLABS_Cert_Blocklist_53Bb753B79A99E61A6E822Ac52460C70 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6339d548-775b-52b9-84c5-a79de23a16b2"
+		id = "017d6bcb-9f94-52ad-8de7-83976d9ce58b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2672-L2688"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "24ff4f46fa6e85c25e130459f9b8d6907cf6cd51098e0cf45ec11d54d7de509b"
+		logic_hash = "v1_sha256_24ff4f46fa6e85c25e130459f9b8d6907cf6cd51098e0cf45ec11d54d7de509b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36383,7 +36383,7 @@ rule REVERSINGLABS_Cert_Blocklist_53Bb753B79A99E61A6E822Ac52460C70 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xEB\\x8D\\xB0\\xEC\\x8A\\xA4\\xED\\x81\\xAC\\xED\\x83\\x91\\xEC\\x95\\x84\\xEC\\x9D\\xB4\\xEC\\xBD\\x98" and pe.signatures[i].serial=="53:bb:75:3b:79:a9:9e:61:a6:e8:22:ac:52:46:0c:70" and 1400543999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xEB\\x8D\\xB0\\xEC\\x8A\\xA4\\xED\\x81\\xAC\\xED\\x83\\x91\\xEC\\x95\\x84\\xEC\\x9D\\xB4\\xEC\\xBD\\x98" and pe.signatures [ i ] . serial == "53:bb:75:3b:79:a9:9e:61:a6:e8:22:ac:52:46:0c:70" and 1400543999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36392,13 +36392,13 @@ rule REVERSINGLABS_Cert_Blocklist_83F68Fc6834Bf8Bd2C801A2D1F1Acc76 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "763d4faf-19af-5349-a643-4773055df47a"
+		id = "b539502e-a25a-57af-a4e3-d657db6f581b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2690-L2708"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "35552242f9f0a56b45e30e6f376877446f33e24690ff5d7b03dc776fab178afd"
+		logic_hash = "v1_sha256_35552242f9f0a56b45e30e6f376877446f33e24690ff5d7b03dc776fab178afd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36408,7 +36408,7 @@ rule REVERSINGLABS_Cert_Blocklist_83F68Fc6834Bf8Bd2C801A2D1F1Acc76 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Helpful Technologies, Inc" and (pe.signatures[i].serial=="00:83:f6:8f:c6:83:4b:f8:bd:2c:80:1a:2d:1f:1a:cc:76" or pe.signatures[i].serial=="83:f6:8f:c6:83:4b:f8:bd:2c:80:1a:2d:1f:1a:cc:76") and 1407715199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Helpful Technologies, Inc" and ( pe.signatures [ i ] . serial == "00:83:f6:8f:c6:83:4b:f8:bd:2c:80:1a:2d:1f:1a:cc:76" or pe.signatures [ i ] . serial == "83:f6:8f:c6:83:4b:f8:bd:2c:80:1a:2d:1f:1a:cc:76" ) and 1407715199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36417,13 +36417,13 @@ rule REVERSINGLABS_Cert_Blocklist_F385E765Acfb95605C9B35Ca4C32F80E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "865f8daf-35c4-5437-9c97-9b9fc48d7d70"
+		id = "0af9dec6-2a34-53dc-b7fa-9b8ced50d772"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2710-L2728"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c73c8f1913d3423a52f5e77751813460ae9200eb3cb1cc6e2ec30f37f0da8152"
+		logic_hash = "v1_sha256_c73c8f1913d3423a52f5e77751813460ae9200eb3cb1cc6e2ec30f37f0da8152"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36433,7 +36433,7 @@ rule REVERSINGLABS_Cert_Blocklist_F385E765Acfb95605C9B35Ca4C32F80E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CWI SOFTWARE LTDA" and (pe.signatures[i].serial=="00:f3:85:e7:65:ac:fb:95:60:5c:9b:35:ca:4c:32:f8:0e" or pe.signatures[i].serial=="f3:85:e7:65:ac:fb:95:60:5c:9b:35:ca:4c:32:f8:0e") and 1382313599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CWI SOFTWARE LTDA" and ( pe.signatures [ i ] . serial == "00:f3:85:e7:65:ac:fb:95:60:5c:9b:35:ca:4c:32:f8:0e" or pe.signatures [ i ] . serial == "f3:85:e7:65:ac:fb:95:60:5c:9b:35:ca:4c:32:f8:0e" ) and 1382313599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36442,13 +36442,13 @@ rule REVERSINGLABS_Cert_Blocklist_F62C9C4Efc81Caf0D5A2608009D48018 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "176434ae-7162-5b35-91f7-888536250884"
+		id = "d4f1d184-2083-54c5-a2fd-c8338cafcd1b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2730-L2748"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "08fcff795297c0608b1a1d71465279cbf76d4dff06de2a2262a58debbb2f9e0d"
+		logic_hash = "v1_sha256_08fcff795297c0608b1a1d71465279cbf76d4dff06de2a2262a58debbb2f9e0d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36458,7 +36458,7 @@ rule REVERSINGLABS_Cert_Blocklist_F62C9C4Efc81Caf0D5A2608009D48018 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x94\\x90\\xE5\\xB1\\xB1\\xE4\\xB8\\x87\\xE4\\xB8\\x9C\\xE6\\xB6\\xA6\\xE6\\x92\\xAD\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and (pe.signatures[i].serial=="00:f6:2c:9c:4e:fc:81:ca:f0:d5:a2:60:80:09:d4:80:18" or pe.signatures[i].serial=="f6:2c:9c:4e:fc:81:ca:f0:d5:a2:60:80:09:d4:80:18") and 1292889599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\x94\\x90\\xE5\\xB1\\xB1\\xE4\\xB8\\x87\\xE4\\xB8\\x9C\\xE6\\xB6\\xA6\\xE6\\x92\\xAD\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and ( pe.signatures [ i ] . serial == "00:f6:2c:9c:4e:fc:81:ca:f0:d5:a2:60:80:09:d4:80:18" or pe.signatures [ i ] . serial == "f6:2c:9c:4e:fc:81:ca:f0:d5:a2:60:80:09:d4:80:18" ) and 1292889599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36467,13 +36467,13 @@ rule REVERSINGLABS_Cert_Blocklist_Cc8D902Da36587C9B2113Cd76C3C3F8D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f9e542aa-eaa5-50a5-95dc-fb55f8575c89"
+		id = "12e62503-d8b6-5cd1-b798-2ef500a8f338"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2750-L2768"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "25e524d23ccc1c06f602a086369ffd44b8c97b76c29f068764081339556b3465"
+		logic_hash = "v1_sha256_25e524d23ccc1c06f602a086369ffd44b8c97b76c29f068764081339556b3465"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36483,7 +36483,7 @@ rule REVERSINGLABS_Cert_Blocklist_Cc8D902Da36587C9B2113Cd76C3C3F8D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE4\\xB8\\x8A\\xE6\\xB5\\xB7\\xE9\\x87\\x91\\xE4\\xBF\\x8A\\xE5\\x9D\\xA4\\xE8\\xAE\\xA1\\xE7\\xAE\\x97\\xE6\\x9C\\xBA\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x8D\\xE5\\x8A\\xA1\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and (pe.signatures[i].serial=="00:cc:8d:90:2d:a3:65:87:c9:b2:11:3c:d7:6c:3c:3f:8d" or pe.signatures[i].serial=="cc:8d:90:2d:a3:65:87:c9:b2:11:3c:d7:6c:3c:3f:8d") and 1292544000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE4\\xB8\\x8A\\xE6\\xB5\\xB7\\xE9\\x87\\x91\\xE4\\xBF\\x8A\\xE5\\x9D\\xA4\\xE8\\xAE\\xA1\\xE7\\xAE\\x97\\xE6\\x9C\\xBA\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x8D\\xE5\\x8A\\xA1\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and ( pe.signatures [ i ] . serial == "00:cc:8d:90:2d:a3:65:87:c9:b2:11:3c:d7:6c:3c:3f:8d" or pe.signatures [ i ] . serial == "cc:8d:90:2d:a3:65:87:c9:b2:11:3c:d7:6c:3c:3f:8d" ) and 1292544000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36492,13 +36492,13 @@ rule REVERSINGLABS_Cert_Blocklist_328Bdcc0F679C4649147Fbb3Eb0E9Bc6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8e2c2204-8905-5e05-9ec8-e1577ae4c2cb"
+		id = "1645c47d-5cee-5f64-9157-ee834fdad420"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2770-L2786"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6d9e1f25ca252ca9dda7714c52a2e57fd3b5dca08cd2a45c9dec18a31d3bb342"
+		logic_hash = "v1_sha256_6d9e1f25ca252ca9dda7714c52a2e57fd3b5dca08cd2a45c9dec18a31d3bb342"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36508,7 +36508,7 @@ rule REVERSINGLABS_Cert_Blocklist_328Bdcc0F679C4649147Fbb3Eb0E9Bc6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nooly Systems LTD" and pe.signatures[i].serial=="32:8b:dc:c0:f6:79:c4:64:91:47:fb:b3:eb:0e:9b:c6" and 1204847999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Nooly Systems LTD" and pe.signatures [ i ] . serial == "32:8b:dc:c0:f6:79:c4:64:91:47:fb:b3:eb:0e:9b:c6" and 1204847999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36517,13 +36517,13 @@ rule REVERSINGLABS_Cert_Blocklist_5F78149Eb4F75Eb17404A8143Aaeaed7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4c9d3bba-4e7f-5bf5-ab90-f2b900ec0b2a"
+		id = "84bc0de2-7527-53ca-900f-a981ce4cf763"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2788-L2804"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0c7c9e8d2a9304e0407b8a1a29977312a9ba766a4052c6b874855fa187c85585"
+		logic_hash = "v1_sha256_0c7c9e8d2a9304e0407b8a1a29977312a9ba766a4052c6b874855fa187c85585"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36533,7 +36533,7 @@ rule REVERSINGLABS_Cert_Blocklist_5F78149Eb4F75Eb17404A8143Aaeaed7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE4\\xB8\\x8A\\xE6\\xB5\\xB7\\xE5\\x9F\\x9F\\xE8\\x81\\x94\\xE8\\xBD\\xAF\\xE4\\xBB\\xB6\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="5f:78:14:9e:b4:f7:5e:b1:74:04:a8:14:3a:ae:ae:d7" and 1303116124<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE4\\xB8\\x8A\\xE6\\xB5\\xB7\\xE5\\x9F\\x9F\\xE8\\x81\\x94\\xE8\\xBD\\xAF\\xE4\\xBB\\xB6\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "5f:78:14:9e:b4:f7:5e:b1:74:04:a8:14:3a:ae:ae:d7" and 1303116124 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36542,13 +36542,13 @@ rule REVERSINGLABS_Cert_Blocklist_629D120Dd84F9C1688D4Da40366Fab7A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7e6249ba-3a4f-5096-be32-779e73c88221"
+		id = "f73eb563-ac88-5f3e-b2e8-75bd296e2fcf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2806-L2822"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "187f6ef0de869500526d1b0d5c6f6762b0a939e06781e633a602834687c64023"
+		logic_hash = "v1_sha256_187f6ef0de869500526d1b0d5c6f6762b0a939e06781e633a602834687c64023"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36558,7 +36558,7 @@ rule REVERSINGLABS_Cert_Blocklist_629D120Dd84F9C1688D4Da40366Fab7A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Delta Controls" and pe.signatures[i].serial=="62:9d:12:0d:d8:4f:9c:16:88:d4:da:40:36:6f:ab:7a" and 1306799999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Delta Controls" and pe.signatures [ i ] . serial == "62:9d:12:0d:d8:4f:9c:16:88:d4:da:40:36:6f:ab:7a" and 1306799999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36567,13 +36567,13 @@ rule REVERSINGLABS_Cert_Blocklist_039E5D0E3297F574Db99E1D9503853D9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "969ffa17-de06-58d5-a74e-c115b49a9a6c"
+		id = "6a459a5e-86f8-5789-aac9-f4fa8872a0b3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2824-L2840"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2f150f60b7dce583fc68705f0b29a7c8684f1b69020275b2ec1ac6beeaa63952"
+		logic_hash = "v1_sha256_2f150f60b7dce583fc68705f0b29a7c8684f1b69020275b2ec1ac6beeaa63952"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36583,7 +36583,7 @@ rule REVERSINGLABS_Cert_Blocklist_039E5D0E3297F574Db99E1D9503853D9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cigam Software Corporativo LTDA" and pe.signatures[i].serial=="03:9e:5d:0e:32:97:f5:74:db:99:e1:d9:50:38:53:d9" and 1378079999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cigam Software Corporativo LTDA" and pe.signatures [ i ] . serial == "03:9e:5d:0e:32:97:f5:74:db:99:e1:d9:50:38:53:d9" and 1378079999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36592,13 +36592,13 @@ rule REVERSINGLABS_Cert_Blocklist_Bc32Bbe5Bbb4F06F490C50651Cd5Da50 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "eb6ccc6d-2a66-5113-8b78-c32012431123"
+		id = "2b7c548c-06e6-5ba2-a970-0cee3e4df71e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2842-L2860"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "104be481b7d4b1cb3c43c72314afc3641983838b5177c34a88d6da0d0e7b89c9"
+		logic_hash = "v1_sha256_104be481b7d4b1cb3c43c72314afc3641983838b5177c34a88d6da0d0e7b89c9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36608,7 +36608,7 @@ rule REVERSINGLABS_Cert_Blocklist_Bc32Bbe5Bbb4F06F490C50651Cd5Da50 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Remedica Medical Education and Publishing Ltd" and (pe.signatures[i].serial=="00:bc:32:bb:e5:bb:b4:f0:6f:49:0c:50:65:1c:d5:da:50" or pe.signatures[i].serial=="bc:32:bb:e5:bb:b4:f0:6f:49:0c:50:65:1c:d5:da:50") and 1387151999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Remedica Medical Education and Publishing Ltd" and ( pe.signatures [ i ] . serial == "00:bc:32:bb:e5:bb:b4:f0:6f:49:0c:50:65:1c:d5:da:50" or pe.signatures [ i ] . serial == "bc:32:bb:e5:bb:b4:f0:6f:49:0c:50:65:1c:d5:da:50" ) and 1387151999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36617,13 +36617,13 @@ rule REVERSINGLABS_Cert_Blocklist_3E1656Dfcaacfed7C2D2564355698Aa3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "57b75eaa-2cb2-5713-8eb3-065f90a1fdd5"
+		id = "39a5f43e-930b-5d48-a5ba-c3a0984eb592"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2862-L2878"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ba7cca8d71f571644cabd3d491cddefffd05ca7a838f262a343a01e4a09bb72a"
+		logic_hash = "v1_sha256_ba7cca8d71f571644cabd3d491cddefffd05ca7a838f262a343a01e4a09bb72a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36633,7 +36633,7 @@ rule REVERSINGLABS_Cert_Blocklist_3E1656Dfcaacfed7C2D2564355698Aa3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "John W.Richard" and pe.signatures[i].serial=="3e:16:56:df:ca:ac:fe:d7:c2:d2:56:43:55:69:8a:a3" and 1385251199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "John W.Richard" and pe.signatures [ i ] . serial == "3e:16:56:df:ca:ac:fe:d7:c2:d2:56:43:55:69:8a:a3" and 1385251199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36642,13 +36642,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Bf1D68E926E2Dd8966008C44F95Ea1C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c82170a4-911c-5206-bae8-6503a5449df9"
+		id = "00726514-4782-54a2-b0f6-832e0f92e468"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2880-L2896"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "44b5aae8380e3590ebb6e2365e89b3827432e8330e5290dc8f8603a00bcf62f6"
+		logic_hash = "v1_sha256_44b5aae8380e3590ebb6e2365e89b3827432e8330e5290dc8f8603a00bcf62f6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36658,7 +36658,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Bf1D68E926E2Dd8966008C44F95Ea1C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Technical and Commercial Consulting Pvt. Ltd." and pe.signatures[i].serial=="4b:f1:d6:8e:92:6e:2d:d8:96:60:08:c4:4f:95:ea:1c" and 1322092799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Technical and Commercial Consulting Pvt. Ltd." and pe.signatures [ i ] . serial == "4b:f1:d6:8e:92:6e:2d:d8:96:60:08:c4:4f:95:ea:1c" and 1322092799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36667,13 +36667,13 @@ rule REVERSINGLABS_Cert_Blocklist_149C12083C145E28155510Cfc19Db0Fe : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8d9b0b1c-df7c-560a-8d51-bc8738952457"
+		id = "e7eb69ce-63fd-5396-9057-8baf9db87c4e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2898-L2914"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f616fc470e223d65ac4c984394a38d566265ab37829ff566012de0a1527396c2"
+		logic_hash = "v1_sha256_f616fc470e223d65ac4c984394a38d566265ab37829ff566012de0a1527396c2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36683,7 +36683,7 @@ rule REVERSINGLABS_Cert_Blocklist_149C12083C145E28155510Cfc19Db0Fe : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "3rd Eye Solutions Ltd" and pe.signatures[i].serial=="14:9c:12:08:3c:14:5e:28:15:55:10:cf:c1:9d:b0:fe" and 1209340799<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "3rd Eye Solutions Ltd" and pe.signatures [ i ] . serial == "14:9c:12:08:3c:14:5e:28:15:55:10:cf:c1:9d:b0:fe" and 1209340799 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36692,13 +36692,13 @@ rule REVERSINGLABS_Cert_Blocklist_77E0117E8B2B8Faa84Bed961019D5Ef8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2733cc5b-bc1f-5ba9-a2f4-50f472fc288e"
+		id = "a23972fb-9c83-5282-b77f-820c2dab2f74"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2916-L2932"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bea94b9da8c176f22a66fe7a4545dcc3a38f727a75a0bc7920d9aece8e24b9b7"
+		logic_hash = "v1_sha256_bea94b9da8c176f22a66fe7a4545dcc3a38f727a75a0bc7920d9aece8e24b9b7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36708,7 +36708,7 @@ rule REVERSINGLABS_Cert_Blocklist_77E0117E8B2B8Faa84Bed961019D5Ef8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Reiner Wodey Informationssysteme" and pe.signatures[i].serial=="77:e0:11:7e:8b:2b:8f:aa:84:be:d9:61:01:9d:5e:f8" and 1383695999<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Reiner Wodey Informationssysteme" and pe.signatures [ i ] . serial == "77:e0:11:7e:8b:2b:8f:aa:84:be:d9:61:01:9d:5e:f8" and 1383695999 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36717,13 +36717,13 @@ rule REVERSINGLABS_Cert_Blocklist_4F3Feb4Baf377Aea90A463C5Dee63884 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8de9bcf3-d705-590f-8898-52218f937571"
+		id = "510e999b-73d5-5303-a9d1-adab22b9254e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2934-L2950"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "56c37e758db33aa40e9a2c1c5a4eb14c2c370f614e838d86bf20c64f79e2a746"
+		logic_hash = "v1_sha256_56c37e758db33aa40e9a2c1c5a4eb14c2c370f614e838d86bf20c64f79e2a746"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36733,7 +36733,7 @@ rule REVERSINGLABS_Cert_Blocklist_4F3Feb4Baf377Aea90A463C5Dee63884 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "F3D LIMITED" and pe.signatures[i].serial=="4f:3f:eb:4b:af:37:7a:ea:90:a4:63:c5:de:e6:38:84" and 1526601599<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "F3D LIMITED" and pe.signatures [ i ] . serial == "4f:3f:eb:4b:af:37:7a:ea:90:a4:63:c5:de:e6:38:84" and 1526601599 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36742,13 +36742,13 @@ rule REVERSINGLABS_Cert_Blocklist_3D2580E89526F7852B570654Efd9A8Bf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing LockerGoga ransomware."
 		author = "ReversingLabs"
-		id = "0514759c-2d10-5b29-aa2f-d16eb45b2816"
+		id = "3cdd0cfa-a4f3-5083-9fd0-957759004e50"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2952-L2968"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0f46fcfc8ee06756646899450daa254d3e5261bdc5c2339f20d01971608fff7b"
+		logic_hash = "v1_sha256_0f46fcfc8ee06756646899450daa254d3e5261bdc5c2339f20d01971608fff7b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36758,7 +36758,7 @@ rule REVERSINGLABS_Cert_Blocklist_3D2580E89526F7852B570654Efd9A8Bf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MIKL LIMITED" and pe.signatures[i].serial=="3d:25:80:e8:95:26:f7:85:2b:57:06:54:ef:d9:a8:bf" and 1529888400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MIKL LIMITED" and pe.signatures [ i ] . serial == "3d:25:80:e8:95:26:f7:85:2b:57:06:54:ef:d9:a8:bf" and 1529888400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36767,13 +36767,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Fffe432A53Ff03B9223F88Be1B83D9D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing BabyShark malware."
 		author = "ReversingLabs"
-		id = "25a4c68b-5774-51a2-9aba-1326c85a5251"
+		id = "86e4473e-82ef-5692-bed1-e109f74ed660"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2970-L2986"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e7dbe6b95877f9473661ccf26fa6e5142147609adfe0a9bb8b493875325710af"
+		logic_hash = "v1_sha256_e7dbe6b95877f9473661ccf26fa6e5142147609adfe0a9bb8b493875325710af"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36783,7 +36783,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Fffe432A53Ff03B9223F88Be1B83D9D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EGIS Co., Ltd." and pe.signatures[i].serial=="0f:ff:e4:32:a5:3f:f0:3b:92:23:f8:8b:e1:b8:3d:9d" and 1498524050<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EGIS Co., Ltd." and pe.signatures [ i ] . serial == "0f:ff:e4:32:a5:3f:f0:3b:92:23:f8:8b:e1:b8:3d:9d" and 1498524050 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36792,13 +36792,13 @@ rule REVERSINGLABS_Cert_Blocklist_832E161Aea5206D815F973E5A1Feb3E7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing SeedLocker ransomware."
 		author = "ReversingLabs"
-		id = "ecaa250b-d4ac-5cc9-9e5e-5d6f45db18ad"
+		id = "eaec6895-edf7-57f9-b656-4daa3ec78f7d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L2988-L3006"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "da908de031c78aa012809988e44dea564d32b88b65a2010925c1af85d578a68a"
+		logic_hash = "v1_sha256_da908de031c78aa012809988e44dea564d32b88b65a2010925c1af85d578a68a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36808,7 +36808,7 @@ rule REVERSINGLABS_Cert_Blocklist_832E161Aea5206D815F973E5A1Feb3E7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Project NSRM Ltd" and (pe.signatures[i].serial=="00:83:2e:16:1a:ea:52:06:d8:15:f9:73:e5:a1:fe:b3:e7" or pe.signatures[i].serial=="83:2e:16:1a:ea:52:06:d8:15:f9:73:e5:a1:fe:b3:e7") and 1549830060<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Project NSRM Ltd" and ( pe.signatures [ i ] . serial == "00:83:2e:16:1a:ea:52:06:d8:15:f9:73:e5:a1:fe:b3:e7" or pe.signatures [ i ] . serial == "83:2e:16:1a:ea:52:06:d8:15:f9:73:e5:a1:fe:b3:e7" ) and 1549830060 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36817,13 +36817,13 @@ rule REVERSINGLABS_Cert_Blocklist_09Aecea45Bfd40Ce7D62D7D711916D7D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "421425b1-13ad-5d80-b044-8bd43c60b3ff"
+		id = "da012503-3863-526e-9ab3-112314dec526"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3008-L3024"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d1c6bfb10a244ba866c8aabdff6055388afa8096fd4bd77bb21f781794333e9b"
+		logic_hash = "v1_sha256_d1c6bfb10a244ba866c8aabdff6055388afa8096fd4bd77bb21f781794333e9b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36833,7 +36833,7 @@ rule REVERSINGLABS_Cert_Blocklist_09Aecea45Bfd40Ce7D62D7D711916D7D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALINA LTD" and pe.signatures[i].serial=="09:ae:ce:a4:5b:fd:40:ce:7d:62:d7:d7:11:91:6d:7d" and 1551052800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALINA LTD" and pe.signatures [ i ] . serial == "09:ae:ce:a4:5b:fd:40:ce:7d:62:d7:d7:11:91:6d:7d" and 1551052800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36842,13 +36842,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Ff4Eda5Fa641E70162713426401F438 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3e34aa1b-a4b1-593d-bd93-0f5913ab96b9"
+		id = "833dd5cb-1b1a-5c15-a2f1-56f60f011d62"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3026-L3042"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "58f5e163d9807520497ba55e42c048020f6b7653ed71f3954e7ffb490f4de0e4"
+		logic_hash = "v1_sha256_58f5e163d9807520497ba55e42c048020f6b7653ed71f3954e7ffb490f4de0e4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36858,7 +36858,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Ff4Eda5Fa641E70162713426401F438 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DUHANEY LIMITED" and pe.signatures[i].serial=="4f:f4:ed:a5:fa:64:1e:70:16:27:13:42:64:01:f4:38" and 1555349604<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DUHANEY LIMITED" and pe.signatures [ i ] . serial == "4f:f4:ed:a5:fa:64:1e:70:16:27:13:42:64:01:f4:38" and 1555349604 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36867,13 +36867,13 @@ rule REVERSINGLABS_Cert_Blocklist_067Dffc5E3026Eb4C62971C98Ac8A900 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9b9771bb-c2a4-5a6e-8fdb-b3e98f62f9b1"
+		id = "43e9f762-5589-5d3a-abab-ef281c9feb6b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3044-L3060"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2b7c4cded14afd8ba3feabb6debaa1317917b811b44e22aa8a0b3ea00d689141"
+		logic_hash = "v1_sha256_2b7c4cded14afd8ba3feabb6debaa1317917b811b44e22aa8a0b3ea00d689141"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36883,7 +36883,7 @@ rule REVERSINGLABS_Cert_Blocklist_067Dffc5E3026Eb4C62971C98Ac8A900 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DVERI FADO, TOV" and pe.signatures[i].serial=="06:7d:ff:c5:e3:02:6e:b4:c6:29:71:c9:8a:c8:a9:00" and 1552176000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DVERI FADO, TOV" and pe.signatures [ i ] . serial == "06:7d:ff:c5:e3:02:6e:b4:c6:29:71:c9:8a:c8:a9:00" and 1552176000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36892,13 +36892,13 @@ rule REVERSINGLABS_Cert_Blocklist_B1Da219688E51Fd0Bfac2C891D56Cbb8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "245c582a-b168-53ce-9a3c-b291ae5bc2a0"
+		id = "6ec59dff-13fc-5d56-8411-cae3b4e5b807"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3062-L3080"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "03549214940a8689213bd2eb891da1c1991627c81c8b7f26860141c397409d46"
+		logic_hash = "v1_sha256_03549214940a8689213bd2eb891da1c1991627c81c8b7f26860141c397409d46"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36908,7 +36908,7 @@ rule REVERSINGLABS_Cert_Blocklist_B1Da219688E51Fd0Bfac2C891D56Cbb8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FIRNEEZ EUROPE LIMITED" and (pe.signatures[i].serial=="00:b1:da:21:96:88:e5:1f:d0:bf:ac:2c:89:1d:56:cb:b8" or pe.signatures[i].serial=="b1:da:21:96:88:e5:1f:d0:bf:ac:2c:89:1d:56:cb:b8") and 1542931200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FIRNEEZ EUROPE LIMITED" and ( pe.signatures [ i ] . serial == "00:b1:da:21:96:88:e5:1f:d0:bf:ac:2c:89:1d:56:cb:b8" or pe.signatures [ i ] . serial == "b1:da:21:96:88:e5:1f:d0:bf:ac:2c:89:1d:56:cb:b8" ) and 1542931200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36917,13 +36917,13 @@ rule REVERSINGLABS_Cert_Blocklist_7289B0F9Bd641E3E352Dc3183F8De6Be : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dc8a745f-7150-57b7-9ddc-e5a1721d8c02"
+		id = "6e0ea548-67a2-58f6-8e43-ec98c7e71af1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3082-L3098"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "42b068e85b3aff5e6dd5ec4979f546dc5338ebf8719d86c0641ffb8353959af9"
+		logic_hash = "v1_sha256_42b068e85b3aff5e6dd5ec4979f546dc5338ebf8719d86c0641ffb8353959af9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36933,7 +36933,7 @@ rule REVERSINGLABS_Cert_Blocklist_7289B0F9Bd641E3E352Dc3183F8De6Be : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ICE ACTIVATION LIMITED" and pe.signatures[i].serial=="72:89:b0:f9:bd:64:1e:3e:35:2d:c3:18:3f:8d:e6:be" and 1557933274<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ICE ACTIVATION LIMITED" and pe.signatures [ i ] . serial == "72:89:b0:f9:bd:64:1e:3e:35:2d:c3:18:3f:8d:e6:be" and 1557933274 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36942,13 +36942,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fd7B7A8678A67181A54Bc7499Eba44Da : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d6456cb6-e950-54be-a7f4-5c1d622c6aab"
+		id = "b74f6f5f-dc93-5d86-b5b8-43f39e374385"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3100-L3118"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f1e26ea26890043be2c8b9c35ba2e6758b60fe173f00bf4c77cc5289ce0d5600"
+		logic_hash = "v1_sha256_f1e26ea26890043be2c8b9c35ba2e6758b60fe173f00bf4c77cc5289ce0d5600"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36958,7 +36958,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fd7B7A8678A67181A54Bc7499Eba44Da : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IMRAN IT SERVICES LTD" and (pe.signatures[i].serial=="00:fd:7b:7a:86:78:a6:71:81:a5:4b:c7:49:9e:ba:44:da" or pe.signatures[i].serial=="fd:7b:7a:86:78:a6:71:81:a5:4b:c7:49:9e:ba:44:da") and 1548028800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IMRAN IT SERVICES LTD" and ( pe.signatures [ i ] . serial == "00:fd:7b:7a:86:78:a6:71:81:a5:4b:c7:49:9e:ba:44:da" or pe.signatures [ i ] . serial == "fd:7b:7a:86:78:a6:71:81:a5:4b:c7:49:9e:ba:44:da" ) and 1548028800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36967,13 +36967,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ebbdd6Cdeda40Ca64513280Ecd625C54 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2cf769dc-5108-5f18-a51e-e152180a2b66"
+		id = "7229d413-ec61-57ae-a8a7-9f8ae7e84fdf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3120-L3138"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1d419f2fe2a9bf744bdde48adc50e0bc48746f1576f96570385a2a1c9ba92d21"
+		logic_hash = "v1_sha256_1d419f2fe2a9bf744bdde48adc50e0bc48746f1576f96570385a2a1c9ba92d21"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -36983,7 +36983,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ebbdd6Cdeda40Ca64513280Ecd625C54 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IT PUT LIMITED" and (pe.signatures[i].serial=="00:eb:bd:d6:cd:ed:a4:0c:a6:45:13:28:0e:cd:62:5c:54" or pe.signatures[i].serial=="eb:bd:d6:cd:ed:a4:0c:a6:45:13:28:0e:cd:62:5c:54") and 1549238400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IT PUT LIMITED" and ( pe.signatures [ i ] . serial == "00:eb:bd:d6:cd:ed:a4:0c:a6:45:13:28:0e:cd:62:5c:54" or pe.signatures [ i ] . serial == "eb:bd:d6:cd:ed:a4:0c:a6:45:13:28:0e:cd:62:5c:54" ) and 1549238400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -36992,13 +36992,13 @@ rule REVERSINGLABS_Cert_Blocklist_61Da676C1Dcfcf188276E2C70D68082E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d974b740-38fa-564d-b4c6-8955568a4e77"
+		id = "301c714e-5628-5353-af01-fcbf3195bafc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3140-L3156"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4f8af4a5c9812e6559218e387e32bc02cb0adcd40d9d4963fefc929f6101ae9a"
+		logic_hash = "v1_sha256_4f8af4a5c9812e6559218e387e32bc02cb0adcd40d9d4963fefc929f6101ae9a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37008,7 +37008,7 @@ rule REVERSINGLABS_Cert_Blocklist_61Da676C1Dcfcf188276E2C70D68082E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "P2N ONLINE LTD" and pe.signatures[i].serial=="61:da:67:6c:1d:cf:cf:18:82:76:e2:c7:0d:68:08:2e" and 1552723954<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "P2N ONLINE LTD" and pe.signatures [ i ] . serial == "61:da:67:6c:1d:cf:cf:18:82:76:e2:c7:0d:68:08:2e" and 1552723954 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37017,13 +37017,13 @@ rule REVERSINGLABS_Cert_Blocklist_767436921B2698Bd18400A24B01341B6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3e3b2b75-9416-5c4f-ad47-88f92039f532"
+		id = "3b388db4-7903-598b-9168-5cb45804ea94"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3158-L3174"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "759bbbc5929463ad68d5dcd28b30401b9ff680f522172ed8d5d7dd3772e07587"
+		logic_hash = "v1_sha256_759bbbc5929463ad68d5dcd28b30401b9ff680f522172ed8d5d7dd3772e07587"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37033,7 +37033,7 @@ rule REVERSINGLABS_Cert_Blocklist_767436921B2698Bd18400A24B01341B6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REBROSE LEISURE LIMITED" and pe.signatures[i].serial=="76:74:36:92:1b:26:98:bd:18:40:0a:24:b0:13:41:b6" and 1556284480<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "REBROSE LEISURE LIMITED" and pe.signatures [ i ] . serial == "76:74:36:92:1b:26:98:bd:18:40:0a:24:b0:13:41:b6" and 1556284480 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37042,13 +37042,13 @@ rule REVERSINGLABS_Cert_Blocklist_3E795531B3265510F935187Eca59920A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "953434f4-cc19-5a0a-923b-4deaadacef00"
+		id = "cd8cc713-44a9-55b9-95b9-2eea20336687"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3176-L3192"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d597e88314f9f20283b40058dd74167d0d72f7518277a57f26c15e44b670b386"
+		logic_hash = "v1_sha256_d597e88314f9f20283b40058dd74167d0d72f7518277a57f26c15e44b670b386"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37058,7 +37058,7 @@ rule REVERSINGLABS_Cert_Blocklist_3E795531B3265510F935187Eca59920A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "sasha catering ltd" and pe.signatures[i].serial=="3e:79:55:31:b3:26:55:10:f9:35:18:7e:ca:59:92:0a" and 1557243644<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "sasha catering ltd" and pe.signatures [ i ] . serial == "3e:79:55:31:b3:26:55:10:f9:35:18:7e:ca:59:92:0a" and 1557243644 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37067,13 +37067,13 @@ rule REVERSINGLABS_Cert_Blocklist_8F40B1485309A064A28B96Bfa3F55F36 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bad5b57e-185a-5872-9817-a7d688e24fe7"
+		id = "dc978d9d-136f-53ef-8af0-62964dc74502"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3194-L3212"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "58dd47bfd2acd698bc27fb03eb51e4b8598ef6c71f7193e3cc4eea63982855f0"
+		logic_hash = "v1_sha256_58dd47bfd2acd698bc27fb03eb51e4b8598ef6c71f7193e3cc4eea63982855f0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37083,7 +37083,7 @@ rule REVERSINGLABS_Cert_Blocklist_8F40B1485309A064A28B96Bfa3F55F36 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Singh Agile Content Design Limited" and (pe.signatures[i].serial=="00:8f:40:b1:48:53:09:a0:64:a2:8b:96:bf:a3:f5:5f:36" or pe.signatures[i].serial=="8f:40:b1:48:53:09:a0:64:a2:8b:96:bf:a3:f5:5f:36") and 1542585600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Singh Agile Content Design Limited" and ( pe.signatures [ i ] . serial == "00:8f:40:b1:48:53:09:a0:64:a2:8b:96:bf:a3:f5:5f:36" or pe.signatures [ i ] . serial == "8f:40:b1:48:53:09:a0:64:a2:8b:96:bf:a3:f5:5f:36" ) and 1542585600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37092,13 +37092,13 @@ rule REVERSINGLABS_Cert_Blocklist_B2120Facadbb92Cc0A176759604C6A0F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8a90cc61-4d39-58eb-a102-c22d096d99ae"
+		id = "1ae77175-2d5d-58ee-8cc7-eed2f773b257"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3214-L3232"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "08462b1bd3d45824aeea901a4db19365c28d8b8b0f594657df7a59250111729b"
+		logic_hash = "v1_sha256_08462b1bd3d45824aeea901a4db19365c28d8b8b0f594657df7a59250111729b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37108,7 +37108,7 @@ rule REVERSINGLABS_Cert_Blocklist_B2120Facadbb92Cc0A176759604C6A0F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLON LTD" and (pe.signatures[i].serial=="00:b2:12:0f:ac:ad:bb:92:cc:0a:17:67:59:60:4c:6a:0f" or pe.signatures[i].serial=="b2:12:0f:ac:ad:bb:92:cc:0a:17:67:59:60:4c:6a:0f") and 1554249600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SLON LTD" and ( pe.signatures [ i ] . serial == "00:b2:12:0f:ac:ad:bb:92:cc:0a:17:67:59:60:4c:6a:0f" or pe.signatures [ i ] . serial == "b2:12:0f:ac:ad:bb:92:cc:0a:17:67:59:60:4c:6a:0f" ) and 1554249600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37117,13 +37117,13 @@ rule REVERSINGLABS_Cert_Blocklist_4F407Eb50803845Cc43937823E1344C0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6989cda1-f28e-58b7-8572-a7dc2e84d9e3"
+		id = "492ee284-80da-58a0-8dbd-53f3883461d3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3234-L3250"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4d5a2b0619be902d8a437f204ae1b87222c73d3186930809b1f694bad429aea8"
+		logic_hash = "v1_sha256_4d5a2b0619be902d8a437f204ae1b87222c73d3186930809b1f694bad429aea8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37133,7 +37133,7 @@ rule REVERSINGLABS_Cert_Blocklist_4F407Eb50803845Cc43937823E1344C0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLOW COOKED VENTURES LTD" and pe.signatures[i].serial=="4f:40:7e:b5:08:03:84:5c:c4:39:37:82:3e:13:44:c0" and 1556555362<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SLOW COOKED VENTURES LTD" and pe.signatures [ i ] . serial == "4f:40:7e:b5:08:03:84:5c:c4:39:37:82:3e:13:44:c0" and 1556555362 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37142,13 +37142,13 @@ rule REVERSINGLABS_Cert_Blocklist_6922Bb5De88E4127E1Ac6969E6A199F5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "86e16068-8b0b-5f0f-af5e-5ee9f518a915"
+		id = "cc5bcb85-418b-53cf-8cd9-72ec5014c935"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3252-L3268"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "39dbaa232ea9125934b3682d780e3821d12e771f2b844d027d99a432fe249d9f"
+		logic_hash = "v1_sha256_39dbaa232ea9125934b3682d780e3821d12e771f2b844d027d99a432fe249d9f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37158,7 +37158,7 @@ rule REVERSINGLABS_Cert_Blocklist_6922Bb5De88E4127E1Ac6969E6A199F5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SMACHNA PLITKA, TOV" and pe.signatures[i].serial=="69:22:bb:5d:e8:8e:41:27:e1:ac:69:69:e6:a1:99:f5" and 1552692162<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SMACHNA PLITKA, TOV" and pe.signatures [ i ] . serial == "69:22:bb:5d:e8:8e:41:27:e1:ac:69:69:e6:a1:99:f5" and 1552692162 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37167,13 +37167,13 @@ rule REVERSINGLABS_Cert_Blocklist_73065Efa163B7901Fa1Ccb0A54E80540 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "949f55a9-7aa0-50de-bb81-fed5d27c3d24"
+		id = "00f13686-9393-5529-8243-10e40a63201c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3270-L3286"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e420c37c04aa676c266a4c2c228063239815c173a83c39d426c5a674648f1934"
+		logic_hash = "v1_sha256_e420c37c04aa676c266a4c2c228063239815c173a83c39d426c5a674648f1934"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37183,7 +37183,7 @@ rule REVERSINGLABS_Cert_Blocklist_73065Efa163B7901Fa1Ccb0A54E80540 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SOVA CONSULTANCY LTD" and pe.signatures[i].serial=="73:06:5e:fa:16:3b:79:01:fa:1c:cb:0a:54:e8:05:40" and 1548115200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SOVA CONSULTANCY LTD" and pe.signatures [ i ] . serial == "73:06:5e:fa:16:3b:79:01:fa:1c:cb:0a:54:e8:05:40" and 1548115200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37192,13 +37192,13 @@ rule REVERSINGLABS_Cert_Blocklist_4842Afad00904Ed8C98811E652Ccb3B7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f09723aa-85a6-5d96-a71e-94f0e0a0f23c"
+		id = "d39aa4dc-dfc6-52d2-b7c6-ba612bfabda0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3288-L3304"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2b5c7c13369c7b89f1ea5474de3644a12bf6412cb3fa8ade5b66de280fb10cbf"
+		logic_hash = "v1_sha256_2b5c7c13369c7b89f1ea5474de3644a12bf6412cb3fa8ade5b66de280fb10cbf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37208,7 +37208,7 @@ rule REVERSINGLABS_Cert_Blocklist_4842Afad00904Ed8C98811E652Ccb3B7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\"VERY EXCLUSIVE LTD\"" and pe.signatures[i].serial=="48:42:af:ad:00:90:4e:d8:c9:88:11:e6:52:cc:b3:b7" and 1545177600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\"VERY EXCLUSIVE LTD\"" and pe.signatures [ i ] . serial == "48:42:af:ad:00:90:4e:d8:c9:88:11:e6:52:cc:b3:b7" and 1545177600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37217,13 +37217,13 @@ rule REVERSINGLABS_Cert_Blocklist_5A59A686B4A904D0Fca07153Ea6Db6Cc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "018e511f-191d-5fd4-8ab0-0e5bbff44d58"
+		id = "8bbe8d3e-87ed-5e4c-b116-c8aeac58f1f5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3306-L3322"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7597b2ba870ec58ac0786a97fb92956406fe019c81f6176cc1a581988d3a9632"
+		logic_hash = "v1_sha256_7597b2ba870ec58ac0786a97fb92956406fe019c81f6176cc1a581988d3a9632"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37233,7 +37233,7 @@ rule REVERSINGLABS_Cert_Blocklist_5A59A686B4A904D0Fca07153Ea6Db6Cc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABADAN PIZZA LTD" and pe.signatures[i].serial=="5a:59:a6:86:b4:a9:04:d0:fc:a0:71:53:ea:6d:b6:cc" and 1563403380<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ABADAN PIZZA LTD" and pe.signatures [ i ] . serial == "5a:59:a6:86:b4:a9:04:d0:fc:a0:71:53:ea:6d:b6:cc" and 1563403380 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37242,13 +37242,13 @@ rule REVERSINGLABS_Cert_Blocklist_0B6D8152F4A06Ba781C6677Eea5Ab74B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dacac5fe-00dc-5080-a725-9ef69473c45e"
+		id = "b548f16e-fcf1-563c-a1df-2406a2eae0b3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3324-L3340"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bd20cf8e4cab2117361dbe05ae2efe813e7f55667b1f3825cd893313d98dcb5f"
+		logic_hash = "v1_sha256_bd20cf8e4cab2117361dbe05ae2efe813e7f55667b1f3825cd893313d98dcb5f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37258,7 +37258,7 @@ rule REVERSINGLABS_Cert_Blocklist_0B6D8152F4A06Ba781C6677Eea5Ab74B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GLARYSOFT LTD" and pe.signatures[i].serial=="0b:6d:81:52:f4:a0:6b:a7:81:c6:67:7e:ea:5a:b7:4b" and 1568246400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GLARYSOFT LTD" and pe.signatures [ i ] . serial == "0b:6d:81:52:f4:a0:6b:a7:81:c6:67:7e:ea:5a:b7:4b" and 1568246400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37267,13 +37267,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Ad60Cea73E1Dd1A3E6C02D9B339C380 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "80b39632-29a7-5932-a47b-736a9e8ed686"
+		id = "999a4198-027f-5246-91c3-fd25b5155bdc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3342-L3358"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fb83cf25be19e7cccd2c8369c3a37a90af72cb2f76db3619b8311d2a851335a8"
+		logic_hash = "v1_sha256_fb83cf25be19e7cccd2c8369c3a37a90af72cb2f76db3619b8311d2a851335a8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37283,7 +37283,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Ad60Cea73E1Dd1A3E6C02D9B339C380 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CUS Software GmbH" and pe.signatures[i].serial=="3a:d6:0c:ea:73:e1:dd:1a:3e:6c:02:d9:b3:39:c3:80" and 1567036800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CUS Software GmbH" and pe.signatures [ i ] . serial == "3a:d6:0c:ea:73:e1:dd:1a:3e:6c:02:d9:b3:39:c3:80" and 1567036800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37292,13 +37292,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Df2Dfed47C6Fd6542131847Cffbc102 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "306444d8-7573-58c6-b6fe-14d701942275"
+		id = "1ce1cf4c-a9b6-504d-ad47-a41eea02fd0c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3360-L3376"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fc6adbfd45ff6ac465aecb3db862421f02170e977fc044017f3ddc306a9f7a37"
+		logic_hash = "v1_sha256_fc6adbfd45ff6ac465aecb3db862421f02170e977fc044017f3ddc306a9f7a37"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37308,7 +37308,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Df2Dfed47C6Fd6542131847Cffbc102 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AFVIMPEX SRL" and pe.signatures[i].serial=="7d:f2:df:ed:47:c6:fd:65:42:13:18:47:cf:fb:c1:02" and 1567036800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AFVIMPEX SRL" and pe.signatures [ i ] . serial == "7d:f2:df:ed:47:c6:fd:65:42:13:18:47:cf:fb:c1:02" and 1567036800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37317,13 +37317,13 @@ rule REVERSINGLABS_Cert_Blocklist_74Fedf0F8398060Fa8378C6D174465C8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "eea46214-d0f5-5e92-b678-4a1df09025ce"
+		id = "b49bf14f-bf2f-580a-8ba0-fa7e2ccb97b5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3378-L3394"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "406821c7990f05fdad91704f6418304f53dd4800bc4b41912177a1695858fade"
+		logic_hash = "v1_sha256_406821c7990f05fdad91704f6418304f53dd4800bc4b41912177a1695858fade"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37333,7 +37333,7 @@ rule REVERSINGLABS_Cert_Blocklist_74Fedf0F8398060Fa8378C6D174465C8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DOCS PTY LTD" and pe.signatures[i].serial=="74:fe:df:0f:83:98:06:0f:a8:37:8c:6d:17:44:65:c8" and 1566172800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DOCS PTY LTD" and pe.signatures [ i ] . serial == "74:fe:df:0f:83:98:06:0f:a8:37:8c:6d:17:44:65:c8" and 1566172800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37342,13 +37342,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Bd6A5Bba28E7C1Ca44880159Dace237 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c80245bd-908a-5b89-92e3-af0dd7bed63a"
+		id = "38b29b2e-eaff-520d-a6d1-e48f7510fe36"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3396-L3412"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f885c782148947d09133a3cc65319e02204c21d6c6d911b360840f25f37601dc"
+		logic_hash = "v1_sha256_f885c782148947d09133a3cc65319e02204c21d6c6d911b360840f25f37601dc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37358,7 +37358,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Bd6A5Bba28E7C1Ca44880159Dace237 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TECHNO BEAVERS LIMITED" and pe.signatures[i].serial=="3b:d6:a5:bb:a2:8e:7c:1c:a4:48:80:15:9d:ac:e2:37" and 1563408000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TECHNO BEAVERS LIMITED" and pe.signatures [ i ] . serial == "3b:d6:a5:bb:a2:8e:7c:1c:a4:48:80:15:9d:ac:e2:37" and 1563408000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37367,13 +37367,13 @@ rule REVERSINGLABS_Cert_Blocklist_C04F8F1E00C69E96A51Bf14Aab1C6Ae0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6513160e-ece5-500b-8b0b-4b8a6e04c0af"
+		id = "b19746b5-a4bd-5581-9c3a-35cee7153387"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3414-L3432"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c2b5ffa305b761b57dd91c0acea0d8f82bec6b7d3608be10a20ea63621f3f3e8"
+		logic_hash = "v1_sha256_c2b5ffa305b761b57dd91c0acea0d8f82bec6b7d3608be10a20ea63621f3f3e8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37383,7 +37383,7 @@ rule REVERSINGLABS_Cert_Blocklist_C04F8F1E00C69E96A51Bf14Aab1C6Ae0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CHAIKA, TOV" and (pe.signatures[i].serial=="00:c0:4f:8f:1e:00:c6:9e:96:a5:1b:f1:4a:ab:1c:6a:e0" or pe.signatures[i].serial=="c0:4f:8f:1e:00:c6:9e:96:a5:1b:f1:4a:ab:1c:6a:e0") and 1551398400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CHAIKA, TOV" and ( pe.signatures [ i ] . serial == "00:c0:4f:8f:1e:00:c6:9e:96:a5:1b:f1:4a:ab:1c:6a:e0" or pe.signatures [ i ] . serial == "c0:4f:8f:1e:00:c6:9e:96:a5:1b:f1:4a:ab:1c:6a:e0" ) and 1551398400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37392,13 +37392,13 @@ rule REVERSINGLABS_Cert_Blocklist_23F537Ce13C6Cccdfd3F8Ce81Fb981Cb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f48b7818-5b34-5609-822a-39a2e7fb44c5"
+		id = "4141d035-98ce-5ea7-963c-040799b808eb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3434-L3450"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d347bce3eddd0cac276a7504955f0342ae44fd93d238e514af5b1fdc208b68fc"
+		logic_hash = "v1_sha256_d347bce3eddd0cac276a7504955f0342ae44fd93d238e514af5b1fdc208b68fc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37408,7 +37408,7 @@ rule REVERSINGLABS_Cert_Blocklist_23F537Ce13C6Cccdfd3F8Ce81Fb981Cb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ISECURE GROUP PTY LTD" and pe.signatures[i].serial=="23:f5:37:ce:13:c6:cc:cd:fd:3f:8c:e8:1f:b9:81:cb" and 1566086400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ISECURE GROUP PTY LTD" and pe.signatures [ i ] . serial == "23:f5:37:ce:13:c6:cc:cd:fd:3f:8c:e8:1f:b9:81:cb" and 1566086400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37417,13 +37417,13 @@ rule REVERSINGLABS_Cert_Blocklist_73Ecfdbb99Aec176Ddfcf7958D120E1A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "84e20878-e4ea-53a5-9c1b-04f3c66276de"
+		id = "73865e3c-6827-5002-899c-e13e8d73e6d9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3452-L3468"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d911156707cef97acf79c096b5d4a4db166ddf05237168f1ecffb0c0a2ebd8fa"
+		logic_hash = "v1_sha256_d911156707cef97acf79c096b5d4a4db166ddf05237168f1ecffb0c0a2ebd8fa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37433,7 +37433,7 @@ rule REVERSINGLABS_Cert_Blocklist_73Ecfdbb99Aec176Ddfcf7958D120E1A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MHOW PTY LTD" and pe.signatures[i].serial=="73:ec:fd:bb:99:ae:c1:76:dd:fc:f7:95:8d:12:0e:1a" and 1566864000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MHOW PTY LTD" and pe.signatures [ i ] . serial == "73:ec:fd:bb:99:ae:c1:76:dd:fc:f7:95:8d:12:0e:1a" and 1566864000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37442,13 +37442,13 @@ rule REVERSINGLABS_Cert_Blocklist_675129Bb174A5B05E330Cc09F8Bbd70A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "97046206-efc4-58dd-a9df-4966bad3902d"
+		id = "c20b2560-7210-5469-a417-0e671bb1d814"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3470-L3486"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d989ea5233e8a64bffa0e29645c3458ef1f5173158ced7814c3b473b92ef49f4"
+		logic_hash = "v1_sha256_d989ea5233e8a64bffa0e29645c3458ef1f5173158ced7814c3b473b92ef49f4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37458,7 +37458,7 @@ rule REVERSINGLABS_Cert_Blocklist_675129Bb174A5B05E330Cc09F8Bbd70A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALEX & CO PTY LIMITED" and pe.signatures[i].serial=="67:51:29:bb:17:4a:5b:05:e3:30:cc:09:f8:bb:d7:0a" and 1565568000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALEX & CO PTY LIMITED" and pe.signatures [ i ] . serial == "67:51:29:bb:17:4a:5b:05:e3:30:cc:09:f8:bb:d7:0a" and 1565568000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37467,13 +37467,13 @@ rule REVERSINGLABS_Cert_Blocklist_De13Fe2Dbb8F890287E1780Aff6Ffd22 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d2b15920-76ae-54e4-988c-278a3622ec52"
+		id = "b7a7dfcd-3663-56cf-81ce-71de38a030c9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3488-L3504"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ebd983bcfa1e5d54af9d9e07d80d05f4752040eab92e63cd986db789fa07026f"
+		logic_hash = "v1_sha256_ebd983bcfa1e5d54af9d9e07d80d05f4752040eab92e63cd986db789fa07026f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37483,7 +37483,7 @@ rule REVERSINGLABS_Cert_Blocklist_De13Fe2Dbb8F890287E1780Aff6Ffd22 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LAST TIME PTY LTD" and pe.signatures[i].serial=="de:13:fe:2d:bb:8f:89:02:87:e1:78:0a:ff:6f:fd:22" and 1566259200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LAST TIME PTY LTD" and pe.signatures [ i ] . serial == "de:13:fe:2d:bb:8f:89:02:87:e1:78:0a:ff:6f:fd:22" and 1566259200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37492,13 +37492,13 @@ rule REVERSINGLABS_Cert_Blocklist_Da000D18949C247D4Ddfc2585Cc8Bd0F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3e939b73-abe4-5941-93ab-18bcde854aaf"
+		id = "0f73c82e-6a30-5650-b293-b8e4d08081d3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3506-L3524"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3453f13e633a2c233f78d0389c655bb5304e567407b3e0c5c47e5e7127c345ca"
+		logic_hash = "v1_sha256_3453f13e633a2c233f78d0389c655bb5304e567407b3e0c5c47e5e7127c345ca"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37508,7 +37508,7 @@ rule REVERSINGLABS_Cert_Blocklist_Da000D18949C247D4Ddfc2585Cc8Bd0F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PORT-SERVIS LTD" and (pe.signatures[i].serial=="00:da:00:0d:18:94:9c:24:7d:4d:df:c2:58:5c:c8:bd:0f" or pe.signatures[i].serial=="da:00:0d:18:94:9c:24:7d:4d:df:c2:58:5c:c8:bd:0f") and 1564444800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PORT-SERVIS LTD" and ( pe.signatures [ i ] . serial == "00:da:00:0d:18:94:9c:24:7d:4d:df:c2:58:5c:c8:bd:0f" or pe.signatures [ i ] . serial == "da:00:0d:18:94:9c:24:7d:4d:df:c2:58:5c:c8:bd:0f" ) and 1564444800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37517,13 +37517,13 @@ rule REVERSINGLABS_Cert_Blocklist_06E842D3Ea6249D783D6B55E29C060C7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "37829f07-c569-5e46-8b7a-2137c4c801e8"
+		id = "e78168d4-cb46-57cd-a68c-f251d93791b7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3526-L3542"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9f71de0119527c8580f9e47e3fba07242814c5a537d727d4541fd7a802b0cb86"
+		logic_hash = "v1_sha256_9f71de0119527c8580f9e47e3fba07242814c5a537d727d4541fd7a802b0cb86"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37533,7 +37533,7 @@ rule REVERSINGLABS_Cert_Blocklist_06E842D3Ea6249D783D6B55E29C060C7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PORT-SERVIS LTD, TOV" and pe.signatures[i].serial=="06:e8:42:d3:ea:62:49:d7:83:d6:b5:5e:29:c0:60:c7" and 1565568000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PORT-SERVIS LTD, TOV" and pe.signatures [ i ] . serial == "06:e8:42:d3:ea:62:49:d7:83:d6:b5:5e:29:c0:60:c7" and 1565568000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37542,13 +37542,13 @@ rule REVERSINGLABS_Cert_Blocklist_06473C3C19D9E1A9429B58B6Faec2967 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "01eba681-8c98-5553-b369-941b6dba11e2"
+		id = "f21f11d8-aa91-5766-af64-dd54e7b185fb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3544-L3560"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f9ca49ce65d213dce803806956c0ce1da0c4068bea173daae9cb06dab0a86268"
+		logic_hash = "v1_sha256_f9ca49ce65d213dce803806956c0ce1da0c4068bea173daae9cb06dab0a86268"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37558,7 +37558,7 @@ rule REVERSINGLABS_Cert_Blocklist_06473C3C19D9E1A9429B58B6Faec2967 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Digital Leadership Solutions Limited" and pe.signatures[i].serial=="06:47:3c:3c:19:d9:e1:a9:42:9b:58:b6:fa:ec:29:67" and 1581984001<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Digital Leadership Solutions Limited" and pe.signatures [ i ] . serial == "06:47:3c:3c:19:d9:e1:a9:42:9b:58:b6:fa:ec:29:67" and 1581984001 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37567,13 +37567,13 @@ rule REVERSINGLABS_Cert_Blocklist_39F56251Df2088223Cc03494084E6081 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0c475e89-9729-53b9-a301-7a9faa0fef91"
+		id = "297c6614-6d5d-5231-932e-794dfb5cf5a2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3562-L3578"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c87850f91758a5bb3bdf6f6d7de9a3f53077d64cebdde541ac0742d3cea4f4e0"
+		logic_hash = "v1_sha256_c87850f91758a5bb3bdf6f6d7de9a3f53077d64cebdde541ac0742d3cea4f4e0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37583,7 +37583,7 @@ rule REVERSINGLABS_Cert_Blocklist_39F56251Df2088223Cc03494084E6081 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Inter Med Pty. Ltd." and pe.signatures[i].serial=="39:f5:62:51:df:20:88:22:3c:c0:34:94:08:4e:60:81" and 1583539200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Inter Med Pty. Ltd." and pe.signatures [ i ] . serial == "39:f5:62:51:df:20:88:22:3c:c0:34:94:08:4e:60:81" and 1583539200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37592,13 +37592,13 @@ rule REVERSINGLABS_Cert_Blocklist_1362E56D34Dc7B501E17Fa1Ac3C3E3D9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9dccd009-eca1-5f21-b5ef-1a75f9d93c7d"
+		id = "3ac3d879-1b81-58d9-89c5-17c52e4da99c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3580-L3596"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0415c5a49076bab23dfc29ef2d6168b93d6bfde07a89ccb0368d2c967422407a"
+		logic_hash = "v1_sha256_0415c5a49076bab23dfc29ef2d6168b93d6bfde07a89ccb0368d2c967422407a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37608,7 +37608,7 @@ rule REVERSINGLABS_Cert_Blocklist_1362E56D34Dc7B501E17Fa1Ac3C3E3D9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO  \"Amaranth\"" and pe.signatures[i].serial=="13:62:e5:6d:34:dc:7b:50:1e:17:fa:1a:c3:c3:e3:d9" and 1575936000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO  \"Amaranth\"" and pe.signatures [ i ] . serial == "13:62:e5:6d:34:dc:7b:50:1e:17:fa:1a:c3:c3:e3:d9" and 1575936000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37617,13 +37617,13 @@ rule REVERSINGLABS_Cert_Blocklist_4B83593Fc78D92Cfaa9Bdf3F97383964 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8b5a8a8e-16f5-5098-83e5-72820f4f548a"
+		id = "8f8cdd7c-a21e-533f-a366-180d7c52ac03"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3598-L3614"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "775e41fc102cbaeb9374984380b0e073de2a0075b9a200f8ab644bd1369ba015"
+		logic_hash = "v1_sha256_775e41fc102cbaeb9374984380b0e073de2a0075b9a200f8ab644bd1369ba015"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37633,7 +37633,7 @@ rule REVERSINGLABS_Cert_Blocklist_4B83593Fc78D92Cfaa9Bdf3F97383964 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Kometa" and pe.signatures[i].serial=="4b:83:59:3f:c7:8d:92:cf:aa:9b:df:3f:97:38:39:64" and 1579996800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Kometa" and pe.signatures [ i ] . serial == "4b:83:59:3f:c7:8d:92:cf:aa:9b:df:3f:97:38:39:64" and 1579996800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37642,13 +37642,13 @@ rule REVERSINGLABS_Cert_Blocklist_C7505E7464E00Ec1Dccd8D1B466D15Ff : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a75cc09f-de73-5db4-9ace-189e8da99053"
+		id = "5534af7d-71c8-5c30-9b4c-b45d4207531a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3616-L3634"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7c5c84cb9071eff6a1bd7062506b807466bb4a432d1ed073961898c6c08cc4bd"
+		logic_hash = "v1_sha256_7c5c84cb9071eff6a1bd7062506b807466bb4a432d1ed073961898c6c08cc4bd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37658,7 +37658,7 @@ rule REVERSINGLABS_Cert_Blocklist_C7505E7464E00Ec1Dccd8D1B466D15Ff : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ltd. \"Eve Beauty\"" and (pe.signatures[i].serial=="00:c7:50:5e:74:64:e0:0e:c1:dc:cd:8d:1b:46:6d:15:ff" or pe.signatures[i].serial=="c7:50:5e:74:64:e0:0e:c1:dc:cd:8d:1b:46:6d:15:ff") and 1583824676<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ltd. \"Eve Beauty\"" and ( pe.signatures [ i ] . serial == "00:c7:50:5e:74:64:e0:0e:c1:dc:cd:8d:1b:46:6d:15:ff" or pe.signatures [ i ] . serial == "c7:50:5e:74:64:e0:0e:c1:dc:cd:8d:1b:46:6d:15:ff" ) and 1583824676 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37667,13 +37667,13 @@ rule REVERSINGLABS_Cert_Blocklist_Cbf91988Fb83511De1B3A7A520712E9C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d2d71058-f7b9-594f-b099-75aa4774306f"
+		id = "9713b4eb-9489-5757-967c-db95f54f4d7c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3636-L3654"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5862a8ec43d2e545f36b815ada2bb31c4384a8161c6956a31f3bd517532923fd"
+		logic_hash = "v1_sha256_5862a8ec43d2e545f36b815ada2bb31c4384a8161c6956a31f3bd517532923fd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37683,7 +37683,7 @@ rule REVERSINGLABS_Cert_Blocklist_Cbf91988Fb83511De1B3A7A520712E9C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ltd. \"Eve Beauty\"" and (pe.signatures[i].serial=="00:cb:f9:19:88:fb:83:51:1d:e1:b3:a7:a5:20:71:2e:9c" or pe.signatures[i].serial=="cb:f9:19:88:fb:83:51:1d:e1:b3:a7:a5:20:71:2e:9c") and 1578786662<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ltd. \"Eve Beauty\"" and ( pe.signatures [ i ] . serial == "00:cb:f9:19:88:fb:83:51:1d:e1:b3:a7:a5:20:71:2e:9c" or pe.signatures [ i ] . serial == "cb:f9:19:88:fb:83:51:1d:e1:b3:a7:a5:20:71:2e:9c" ) and 1578786662 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37692,13 +37692,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ce3675Ae4Abfe688870Bcacb63060F4F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "586c9de9-e1b0-5d17-9783-c9e18dfdf463"
+		id = "84702e36-0b27-5ed8-a891-54f983a0b526"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3656-L3674"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0c6f2ef55bef283a3f915fd8c1ced27c3c665f7f490caeea0f180c2d7fa2b2b5"
+		logic_hash = "v1_sha256_0c6f2ef55bef283a3f915fd8c1ced27c3c665f7f490caeea0f180c2d7fa2b2b5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37708,7 +37708,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ce3675Ae4Abfe688870Bcacb63060F4F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO \"MPS\"" and (pe.signatures[i].serial=="00:ce:36:75:ae:4a:bf:e6:88:87:0b:ca:cb:63:06:0f:4f" or pe.signatures[i].serial=="ce:36:75:ae:4a:bf:e6:88:87:0b:ca:cb:63:06:0f:4f") and 1582675200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO \"MPS\"" and ( pe.signatures [ i ] . serial == "00:ce:36:75:ae:4a:bf:e6:88:87:0b:ca:cb:63:06:0f:4f" or pe.signatures [ i ] . serial == "ce:36:75:ae:4a:bf:e6:88:87:0b:ca:cb:63:06:0f:4f" ) and 1582675200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37717,13 +37717,13 @@ rule REVERSINGLABS_Cert_Blocklist_9813229Efe0046D23542Cc7569D5A403 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0cf7573f-290d-58ac-989f-f82e9313d54e"
+		id = "36aebce1-04f7-5d10-8adc-163ff92294a0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3676-L3694"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0d8f0df83572b8d31f29cb76f44d524fd1ae0467d2d99af959e45694524d18e8"
+		logic_hash = "v1_sha256_0d8f0df83572b8d31f29cb76f44d524fd1ae0467d2d99af959e45694524d18e8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37733,7 +37733,7 @@ rule REVERSINGLABS_Cert_Blocklist_9813229Efe0046D23542Cc7569D5A403 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO \"MPS\"" and (pe.signatures[i].serial=="00:98:13:22:9e:fe:00:46:d2:35:42:cc:75:69:d5:a4:03" or pe.signatures[i].serial=="98:13:22:9e:fe:00:46:d2:35:42:cc:75:69:d5:a4:03") and 1575849600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO \"MPS\"" and ( pe.signatures [ i ] . serial == "00:98:13:22:9e:fe:00:46:d2:35:42:cc:75:69:d5:a4:03" or pe.signatures [ i ] . serial == "98:13:22:9e:fe:00:46:d2:35:42:cc:75:69:d5:a4:03" ) and 1575849600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37742,13 +37742,13 @@ rule REVERSINGLABS_Cert_Blocklist_86E5A9B9E89E5075C475006D0Ca03832 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f3058f56-dcbb-532a-b914-5ac0e6d70e6e"
+		id = "800de760-3157-5b1c-8a37-fcefc26bfb9c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3696-L3714"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5ba0b0f1b104eb11023590b8ef2b9cc747372bc9310a754694d45d3b3ce293e9"
+		logic_hash = "v1_sha256_5ba0b0f1b104eb11023590b8ef2b9cc747372bc9310a754694d45d3b3ce293e9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37758,7 +37758,7 @@ rule REVERSINGLABS_Cert_Blocklist_86E5A9B9E89E5075C475006D0Ca03832 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BlueMarble GmbH" and (pe.signatures[i].serial=="00:86:e5:a9:b9:e8:9e:50:75:c4:75:00:6d:0c:a0:38:32" or pe.signatures[i].serial=="86:e5:a9:b9:e8:9e:50:75:c4:75:00:6d:0c:a0:38:32") and 1574791194<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BlueMarble GmbH" and ( pe.signatures [ i ] . serial == "00:86:e5:a9:b9:e8:9e:50:75:c4:75:00:6d:0c:a0:38:32" or pe.signatures [ i ] . serial == "86:e5:a9:b9:e8:9e:50:75:c4:75:00:6d:0c:a0:38:32" ) and 1574791194 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37767,13 +37767,13 @@ rule REVERSINGLABS_Cert_Blocklist_075Dca9Ca84B93E8A89B775128F90302 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2fa6b400-7c6c-5bc4-9cac-78d52003a24e"
+		id = "ae702caf-abbe-5bc1-8730-50a515d652ae"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3716-L3732"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "32af21e71fb3475c50de4cd8a24fa0aec1ee67bc01c1a3720c12f9ce822833c3"
+		logic_hash = "v1_sha256_32af21e71fb3475c50de4cd8a24fa0aec1ee67bc01c1a3720c12f9ce822833c3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37783,7 +37783,7 @@ rule REVERSINGLABS_Cert_Blocklist_075Dca9Ca84B93E8A89B775128F90302 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UAB GT-servis" and pe.signatures[i].serial=="07:5d:ca:9c:a8:4b:93:e8:a8:9b:77:51:28:f9:03:02" and 1579305601<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "UAB GT-servis" and pe.signatures [ i ] . serial == "07:5d:ca:9c:a8:4b:93:e8:a8:9b:77:51:28:f9:03:02" and 1579305601 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37792,13 +37792,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Ddce8Cdc91B5B649Bb4B45Ffbba6C6C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9de11ec8-f408-593c-895f-08dff703ff10"
+		id = "e86eaa00-a5fe-561d-b6ad-227a27c9ab70"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3734-L3750"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "622e6ed08ca26908539519f37cf493f8030100bd5e88cb05e851b7d56b0f4c0d"
+		logic_hash = "v1_sha256_622e6ed08ca26908539519f37cf493f8030100bd5e88cb05e851b7d56b0f4c0d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37808,7 +37808,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Ddce8Cdc91B5B649Bb4B45Ffbba6C6C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLIM DOG GROUP SP Z O O" and pe.signatures[i].serial=="0d:dc:e8:cd:c9:1b:5b:64:9b:b4:b4:5f:fb:ba:6c:6c" and 1580722435<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SLIM DOG GROUP SP Z O O" and pe.signatures [ i ] . serial == "0d:dc:e8:cd:c9:1b:5b:64:9b:b4:b4:5f:fb:ba:6c:6c" and 1580722435 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37817,13 +37817,13 @@ rule REVERSINGLABS_Cert_Blocklist_9Bd614D5869Bb66C96B67E154D517384 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "eb42b516-aac6-5bee-af1d-70e0e66700f5"
+		id = "b0bf3e33-70b7-50c0-8f14-afed558fc172"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3752-L3770"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d9eea38a1340797cef129b12cf2bb46c444e6f312db7356260f0ac0d9e63183d"
+		logic_hash = "v1_sha256_d9eea38a1340797cef129b12cf2bb46c444e6f312db7356260f0ac0d9e63183d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37833,7 +37833,7 @@ rule REVERSINGLABS_Cert_Blocklist_9Bd614D5869Bb66C96B67E154D517384 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\"CENTR MBP\"" and (pe.signatures[i].serial=="00:9b:d6:14:d5:86:9b:b6:6c:96:b6:7e:15:4d:51:73:84" or pe.signatures[i].serial=="9b:d6:14:d5:86:9b:b6:6c:96:b6:7e:15:4d:51:73:84") and 1581618180<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\"CENTR MBP\"" and ( pe.signatures [ i ] . serial == "00:9b:d6:14:d5:86:9b:b6:6c:96:b6:7e:15:4d:51:73:84" or pe.signatures [ i ] . serial == "9b:d6:14:d5:86:9b:b6:6c:96:b6:7e:15:4d:51:73:84" ) and 1581618180 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37842,13 +37842,13 @@ rule REVERSINGLABS_Cert_Blocklist_540Cea639D5D48669B7F2F64 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bfc514b6-43ef-5343-b5f2-d39168ba3e8d"
+		id = "b0c0ddc6-91c9-5ee3-bc36-c9c51385f138"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3772-L3788"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3d3774f10ff9949ea13a7892662438b84b3eb895fc986092649fa9b192170d48"
+		logic_hash = "v1_sha256_3d3774f10ff9949ea13a7892662438b84b3eb895fc986092649fa9b192170d48"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37858,7 +37858,7 @@ rule REVERSINGLABS_Cert_Blocklist_540Cea639D5D48669B7F2F64 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CENTR MBP LLC" and pe.signatures[i].serial=="54:0c:ea:63:9d:5d:48:66:9b:7f:2f:64" and 1570871755<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CENTR MBP LLC" and pe.signatures [ i ] . serial == "54:0c:ea:63:9d:5d:48:66:9b:7f:2f:64" and 1570871755 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37867,13 +37867,13 @@ rule REVERSINGLABS_Cert_Blocklist_03A7748A4355020A652466B5E02E07De : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "10134543-04fa-5a2f-8f77-98444ad1d7f0"
+		id = "e8a92f1c-79a4-5873-b666-e1f7260e3a6d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3790-L3806"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6dc6d0fd2b702939847981ff31c2d8103227ccd0c19f999849ff89c64a90f92f"
+		logic_hash = "v1_sha256_6dc6d0fd2b702939847981ff31c2d8103227ccd0c19f999849ff89c64a90f92f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37883,7 +37883,7 @@ rule REVERSINGLABS_Cert_Blocklist_03A7748A4355020A652466B5E02E07De : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Teleneras MB" and pe.signatures[i].serial=="03:a7:74:8a:43:55:02:0a:65:24:66:b5:e0:2e:07:de" and 1575244801<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Teleneras MB" and pe.signatures [ i ] . serial == "03:a7:74:8a:43:55:02:0a:65:24:66:b5:e0:2e:07:de" and 1575244801 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37892,13 +37892,13 @@ rule REVERSINGLABS_Cert_Blocklist_B881A72D4117Bbc38B81D3C65C792C1A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "593c1799-a5df-5b3e-8a8b-826d808a14f0"
+		id = "1d6b118d-4d7f-5629-91f3-0289e578924e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3808-L3826"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bad2a06090f077ebc635d21446b47c9f115fe477567afb3d5994043f5a7883b1"
+		logic_hash = "v1_sha256_bad2a06090f077ebc635d21446b47c9f115fe477567afb3d5994043f5a7883b1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37908,7 +37908,7 @@ rule REVERSINGLABS_Cert_Blocklist_B881A72D4117Bbc38B81D3C65C792C1A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Red GmbH" and (pe.signatures[i].serial=="00:b8:81:a7:2d:41:17:bb:c3:8b:81:d3:c6:5c:79:2c:1a" or pe.signatures[i].serial=="b8:81:a7:2d:41:17:bb:c3:8b:81:d3:c6:5c:79:2c:1a") and 1581936420<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Red GmbH" and ( pe.signatures [ i ] . serial == "00:b8:81:a7:2d:41:17:bb:c3:8b:81:d3:c6:5c:79:2c:1a" or pe.signatures [ i ] . serial == "b8:81:a7:2d:41:17:bb:c3:8b:81:d3:c6:5c:79:2c:1a" ) and 1581936420 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37917,13 +37917,13 @@ rule REVERSINGLABS_Cert_Blocklist_08653Ef2Ed9E6Ebb56Ffa7E93F963235 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9ac976c0-260f-5207-ae39-bbb722c38a92"
+		id = "f0b58bac-69b4-51d4-80d5-3cb01ce29ecd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3828-L3844"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5ae8d2fb03cd0f945c2f5eb86de4e5da4fbb1cdf233d8a808157304538ced872"
+		logic_hash = "v1_sha256_5ae8d2fb03cd0f945c2f5eb86de4e5da4fbb1cdf233d8a808157304538ced872"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37933,7 +37933,7 @@ rule REVERSINGLABS_Cert_Blocklist_08653Ef2Ed9E6Ebb56Ffa7E93F963235 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Haw Farm LIMITED" and pe.signatures[i].serial=="08:65:3e:f2:ed:9e:6e:bb:56:ff:a7:e9:3f:96:32:35" and 1581465601<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Haw Farm LIMITED" and pe.signatures [ i ] . serial == "08:65:3e:f2:ed:9e:6e:bb:56:ff:a7:e9:3f:96:32:35" and 1581465601 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37942,13 +37942,13 @@ rule REVERSINGLABS_Cert_Blocklist_9C4816D900A6Ecdbe54Adf72B19Ebcf5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bd22372d-774b-5e25-b4e5-47d34fe1c40b"
+		id = "489d1dbd-64fc-5a71-9a81-a74a5307b6af"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3846-L3864"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "92e8130f444417d5bc3788721280338bbed33e3362104de0cf27bc7c1fc30d0e"
+		logic_hash = "v1_sha256_92e8130f444417d5bc3788721280338bbed33e3362104de0cf27bc7c1fc30d0e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37958,7 +37958,7 @@ rule REVERSINGLABS_Cert_Blocklist_9C4816D900A6Ecdbe54Adf72B19Ebcf5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Datamingo Limited" and (pe.signatures[i].serial=="00:9c:48:16:d9:00:a6:ec:db:e5:4a:df:72:b1:9e:bc:f5" or pe.signatures[i].serial=="9c:48:16:d9:00:a6:ec:db:e5:4a:df:72:b1:9e:bc:f5") and 1557187200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Datamingo Limited" and ( pe.signatures [ i ] . serial == "00:9c:48:16:d9:00:a6:ec:db:e5:4a:df:72:b1:9e:bc:f5" or pe.signatures [ i ] . serial == "9c:48:16:d9:00:a6:ec:db:e5:4a:df:72:b1:9e:bc:f5" ) and 1557187200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37967,13 +37967,13 @@ rule REVERSINGLABS_Cert_Blocklist_269174F9Fe7C6Ed4E1D19B26C3F5B35F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fbcf1f18-f612-5516-9a67-2564de76c456"
+		id = "542a6f40-afbf-5f00-91a6-f8a63833a517"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3866-L3882"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "95c9720d6311c2fe7026b6cac092d59967479e6c9382eac1d26f7745efa92860"
+		logic_hash = "v1_sha256_95c9720d6311c2fe7026b6cac092d59967479e6c9382eac1d26f7745efa92860"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -37983,7 +37983,7 @@ rule REVERSINGLABS_Cert_Blocklist_269174F9Fe7C6Ed4E1D19B26C3F5B35F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GO ONLINE d.o.o." and pe.signatures[i].serial=="26:91:74:f9:fe:7c:6e:d4:e1:d1:9b:26:c3:f5:b3:5f" and 1586386919<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GO ONLINE d.o.o." and pe.signatures [ i ] . serial == "26:91:74:f9:fe:7c:6e:d4:e1:d1:9b:26:c3:f5:b3:5f" and 1586386919 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -37992,13 +37992,13 @@ rule REVERSINGLABS_Cert_Blocklist_523Fb4036368Dc26192D68827F2D889B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bfce2ea9-cbe0-5b58-b7f8-39d2dad28db6"
+		id = "6f36517e-1177-52fb-be01-0778dc4f226d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3884-L3900"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f1886a046305637d335c493972560de56d8186bf99183aed5e2040b2e530fc22"
+		logic_hash = "v1_sha256_f1886a046305637d335c493972560de56d8186bf99183aed5e2040b2e530fc22"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38008,7 +38008,7 @@ rule REVERSINGLABS_Cert_Blocklist_523Fb4036368Dc26192D68827F2D889B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO MEDUZA SERVICE GROUP" and pe.signatures[i].serial=="52:3f:b4:03:63:68:dc:26:19:2d:68:82:7f:2d:88:9b" and 1586847880<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO MEDUZA SERVICE GROUP" and pe.signatures [ i ] . serial == "52:3f:b4:03:63:68:dc:26:19:2d:68:82:7f:2d:88:9b" and 1586847880 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38017,13 +38017,13 @@ rule REVERSINGLABS_Cert_Blocklist_84F842F6D33Cd2F25B88Dd1710E21137 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "202593d3-d63a-5852-b680-516504d92031"
+		id = "5bf7d159-35af-517b-ab52-737213324f9c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3902-L3920"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5aad8e95d1306626b63d767fce4706104330dd776b75c09cc404227863564307"
+		logic_hash = "v1_sha256_5aad8e95d1306626b63d767fce4706104330dd776b75c09cc404227863564307"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38033,7 +38033,7 @@ rule REVERSINGLABS_Cert_Blocklist_84F842F6D33Cd2F25B88Dd1710E21137 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DataNext s.r.o." and (pe.signatures[i].serial=="00:84:f8:42:f6:d3:3c:d2:f2:5b:88:dd:17:10:e2:11:37" or pe.signatures[i].serial=="84:f8:42:f6:d3:3c:d2:f2:5b:88:dd:17:10:e2:11:37") and 1586775720<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DataNext s.r.o." and ( pe.signatures [ i ] . serial == "00:84:f8:42:f6:d3:3c:d2:f2:5b:88:dd:17:10:e2:11:37" or pe.signatures [ i ] . serial == "84:f8:42:f6:d3:3c:d2:f2:5b:88:dd:17:10:e2:11:37" ) and 1586775720 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38042,13 +38042,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Fbcaa289Ba925B4E247809B6B028202 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d0c4c6c0-d8e3-5efc-a87b-01d1f98a2c18"
+		id = "4b372679-4789-5587-8d86-36b39cb1b38c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3922-L3938"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c41a4f9ccda54b9735313edf9042b831e6eaca149c089f74a823cee6719e1064"
+		logic_hash = "v1_sha256_c41a4f9ccda54b9735313edf9042b831e6eaca149c089f74a823cee6719e1064"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38058,7 +38058,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Fbcaa289Ba925B4E247809B6B028202 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kimjac ApS" and pe.signatures[i].serial=="4f:bc:aa:28:9b:a9:25:b4:e2:47:80:9b:6b:02:82:02" and 1588227220<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kimjac ApS" and pe.signatures [ i ] . serial == "4f:bc:aa:28:9b:a9:25:b4:e2:47:80:9b:6b:02:82:02" and 1588227220 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38067,13 +38067,13 @@ rule REVERSINGLABS_Cert_Blocklist_1F2E8Effbb08C7Dbcc7A7F2D835457B5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cf032593-e742-56d5-a579-3f38a31e2c0c"
+		id = "a6ab629a-a720-5cca-8d10-e18b593fd74f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3940-L3956"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0b446641617d435c3d312592957e19c3d391b0149eafcf9ac2da51e8d9080eb4"
+		logic_hash = "v1_sha256_0b446641617d435c3d312592957e19c3d391b0149eafcf9ac2da51e8d9080eb4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38083,7 +38083,7 @@ rule REVERSINGLABS_Cert_Blocklist_1F2E8Effbb08C7Dbcc7A7F2D835457B5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RTI, OOO" and pe.signatures[i].serial=="1f:2e:8e:ff:bb:08:c7:db:cc:7a:7f:2d:83:54:57:b5" and 1581382360<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RTI, OOO" and pe.signatures [ i ] . serial == "1f:2e:8e:ff:bb:08:c7:db:cc:7a:7f:2d:83:54:57:b5" and 1581382360 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38092,13 +38092,13 @@ rule REVERSINGLABS_Cert_Blocklist_Aeba4C39306Fdd022849867801645814 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f8cb78cf-541c-5038-b7af-83679c978ec8"
+		id = "256a339d-9540-518e-b7bf-fec5c903bd5f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3958-L3976"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "82c149f1d8ef93a0df2035690c5cdca935236687bc36a35a84c3d6610eb6902c"
+		logic_hash = "v1_sha256_82c149f1d8ef93a0df2035690c5cdca935236687bc36a35a84c3d6610eb6902c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38108,7 +38108,7 @@ rule REVERSINGLABS_Cert_Blocklist_Aeba4C39306Fdd022849867801645814 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SK AI MAS GmbH" and (pe.signatures[i].serial=="00:ae:ba:4c:39:30:6f:dd:02:28:49:86:78:01:64:58:14" or pe.signatures[i].serial=="ae:ba:4c:39:30:6f:dd:02:28:49:86:78:01:64:58:14") and 1579478400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SK AI MAS GmbH" and ( pe.signatures [ i ] . serial == "00:ae:ba:4c:39:30:6f:dd:02:28:49:86:78:01:64:58:14" or pe.signatures [ i ] . serial == "ae:ba:4c:39:30:6f:dd:02:28:49:86:78:01:64:58:14" ) and 1579478400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38117,13 +38117,13 @@ rule REVERSINGLABS_Cert_Blocklist_028D50Ae0C554B49148E82Db5B1C2699 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "76ccda8a-bdea-5db2-a3a4-11292bfb3c95"
+		id = "12d55d8a-d086-5ee9-9bbd-a318841e38dc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3978-L3994"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e3cc0066cad56d78a3f42e092befa3b0855b2ed33c8465c5ecbb19fec082d35e"
+		logic_hash = "v1_sha256_e3cc0066cad56d78a3f42e092befa3b0855b2ed33c8465c5ecbb19fec082d35e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38133,7 +38133,7 @@ rule REVERSINGLABS_Cert_Blocklist_028D50Ae0C554B49148E82Db5B1C2699 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VAS CO PTY LTD" and pe.signatures[i].serial=="02:8d:50:ae:0c:55:4b:49:14:8e:82:db:5b:1c:26:99" and 1579478400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VAS CO PTY LTD" and pe.signatures [ i ] . serial == "02:8d:50:ae:0c:55:4b:49:14:8e:82:db:5b:1c:26:99" and 1579478400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38142,13 +38142,13 @@ rule REVERSINGLABS_Cert_Blocklist_684F478C7259Dde0Cfe2260112Ca9846 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "840af428-47e0-529e-9db9-8ab9c968f2e3"
+		id = "4a23a94a-ef9f-5a47-bbe6-56247a926206"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L3996-L4012"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "59654ba1df27029a04ef3b1a1bb54f6c15b727f2013923a11a729752b8829743"
+		logic_hash = "v1_sha256_59654ba1df27029a04ef3b1a1bb54f6c15b727f2013923a11a729752b8829743"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38158,7 +38158,7 @@ rule REVERSINGLABS_Cert_Blocklist_684F478C7259Dde0Cfe2260112Ca9846 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC \"IP EM\"" and pe.signatures[i].serial=="68:4f:47:8c:72:59:dd:e0:cf:e2:26:01:12:ca:98:46" and 1584981648<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LLC \"IP EM\"" and pe.signatures [ i ] . serial == "68:4f:47:8c:72:59:dd:e0:cf:e2:26:01:12:ca:98:46" and 1584981648 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38167,13 +38167,13 @@ rule REVERSINGLABS_Cert_Blocklist_0B7C32208A954A483Dd102E1Be094867 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d16e74d8-2c46-508b-b518-a542603ca726"
+		id = "41984ca7-7514-5cfb-aa55-db2b8fd6e6ff"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4014-L4030"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "49e2208a7d2b5684283c1dfc9856f864d16b50f951f58e0252c97419819a46ec"
+		logic_hash = "v1_sha256_49e2208a7d2b5684283c1dfc9856f864d16b50f951f58e0252c97419819a46ec"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38183,7 +38183,7 @@ rule REVERSINGLABS_Cert_Blocklist_0B7C32208A954A483Dd102E1Be094867 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Win Sp Z O O" and pe.signatures[i].serial=="0b:7c:32:20:8a:95:4a:48:3d:d1:02:e1:be:09:48:67" and 1583884800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Win Sp Z O O" and pe.signatures [ i ] . serial == "0b:7c:32:20:8a:95:4a:48:3d:d1:02:e1:be:09:48:67" and 1583884800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38192,13 +38192,13 @@ rule REVERSINGLABS_Cert_Blocklist_3E72Daf2B9A4449E946009E5084A8E76 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "aa7c6cbe-0794-59e3-a675-93beeccc9784"
+		id = "40757a7e-f776-5151-ad11-3364533d5988"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4032-L4048"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f1a7bf6c18e0ebf8aef53feb7d7789ce87c96e00962c64e07a37d968702d2fa5"
+		logic_hash = "v1_sha256_f1a7bf6c18e0ebf8aef53feb7d7789ce87c96e00962c64e07a37d968702d2fa5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38208,7 +38208,7 @@ rule REVERSINGLABS_Cert_Blocklist_3E72Daf2B9A4449E946009E5084A8E76 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Infoteh63" and pe.signatures[i].serial=="3e:72:da:f2:b9:a4:44:9e:94:60:09:e5:08:4a:8e:76" and 1591787570<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Infoteh63" and pe.signatures [ i ] . serial == "3e:72:da:f2:b9:a4:44:9e:94:60:09:e5:08:4a:8e:76" and 1591787570 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38217,13 +38217,13 @@ rule REVERSINGLABS_Cert_Blocklist_11Edd343E21C36Ac985555D85C16135F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "219f709f-4e05-5d0e-97a4-eca1e65153a3"
+		id = "0da68966-6e67-5098-ac1b-fc88fdc5eee7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4050-L4066"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "17feeed4be074a30572eb12fc81dc15d1b06f2d3f7b4b4fb4443391c62ac4d9b"
+		logic_hash = "v1_sha256_17feeed4be074a30572eb12fc81dc15d1b06f2d3f7b4b4fb4443391c62ac4d9b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38233,7 +38233,7 @@ rule REVERSINGLABS_Cert_Blocklist_11Edd343E21C36Ac985555D85C16135F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pribyl Handels GmbH" and pe.signatures[i].serial=="11:ed:d3:43:e2:1c:36:ac:98:55:55:d8:5c:16:13:5f" and 1589925600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Pribyl Handels GmbH" and pe.signatures [ i ] . serial == "11:ed:d3:43:e2:1c:36:ac:98:55:55:d8:5c:16:13:5f" and 1589925600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38242,13 +38242,13 @@ rule REVERSINGLABS_Cert_Blocklist_093Fe63D1A5F68F14Ecaac871A03F7A3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ce0b23fd-5f79-5b90-8d5c-2ff59ac39df6"
+		id = "5e39a81b-20a1-5ef6-b3c2-d1b6514a6a9a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4068-L4084"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "333c58a9af2d94604b637ab0a7280b6688a89ff73e30a93a8daed040fab7f620"
+		logic_hash = "v1_sha256_333c58a9af2d94604b637ab0a7280b6688a89ff73e30a93a8daed040fab7f620"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38258,7 +38258,7 @@ rule REVERSINGLABS_Cert_Blocklist_093Fe63D1A5F68F14Ecaac871A03F7A3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPECTACLE IMAGE LTD" and pe.signatures[i].serial=="09:3f:e6:3d:1a:5f:68:f1:4e:ca:ac:87:1a:03:f7:a3" and 1562716800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SPECTACLE IMAGE LTD" and pe.signatures [ i ] . serial == "09:3f:e6:3d:1a:5f:68:f1:4e:ca:ac:87:1a:03:f7:a3" and 1562716800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38267,13 +38267,13 @@ rule REVERSINGLABS_Cert_Blocklist_Bb26B7B6634D5Db548C437B5085B01C1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "443a876a-dfd7-5a9e-bb15-a44a53363494"
+		id = "6912d4e9-c0e8-54af-a391-75d9fa3d1663"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4086-L4104"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "58d574b196f84416eb04000205cd8f4817618003f2948bb0eb7d951c282ef6ff"
+		logic_hash = "v1_sha256_58d574b196f84416eb04000205cd8f4817618003f2948bb0eb7d951c282ef6ff"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38283,7 +38283,7 @@ rule REVERSINGLABS_Cert_Blocklist_Bb26B7B6634D5Db548C437B5085B01C1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO \"IT Mott\"" and (pe.signatures[i].serial=="00:bb:26:b7:b6:63:4d:5d:b5:48:c4:37:b5:08:5b:01:c1" or pe.signatures[i].serial=="bb:26:b7:b6:63:4d:5d:b5:48:c4:37:b5:08:5b:01:c1") and 1591919307<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO \"IT Mott\"" and ( pe.signatures [ i ] . serial == "00:bb:26:b7:b6:63:4d:5d:b5:48:c4:37:b5:08:5b:01:c1" or pe.signatures [ i ] . serial == "bb:26:b7:b6:63:4d:5d:b5:48:c4:37:b5:08:5b:01:c1" ) and 1591919307 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38292,13 +38292,13 @@ rule REVERSINGLABS_Cert_Blocklist_29128A56E7B3Bfb230742591Ac8B4718 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b868d2f2-3852-57a3-be01-32cc16eb2ff7"
+		id = "0012272c-b784-5dd0-85a4-e3e27331de7c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4106-L4122"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5a89fec015e56ddddaed75be91a87288dcd27841937d26e3416187913c4f0b85"
+		logic_hash = "v1_sha256_5a89fec015e56ddddaed75be91a87288dcd27841937d26e3416187913c4f0b85"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38308,7 +38308,7 @@ rule REVERSINGLABS_Cert_Blocklist_29128A56E7B3Bfb230742591Ac8B4718 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Programavimo paslaugos, MB" and pe.signatures[i].serial=="29:12:8a:56:e7:b3:bf:b2:30:74:25:91:ac:8b:47:18" and 1590900909<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Programavimo paslaugos, MB" and pe.signatures [ i ] . serial == "29:12:8a:56:e7:b3:bf:b2:30:74:25:91:ac:8b:47:18" and 1590900909 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38317,13 +38317,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Bfbfdfef43608730Ee14779Ee3Ee2Cb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fdc2f6a0-8fae-537e-812f-b0c292f76b1e"
+		id = "a5e8ad86-5720-5c1c-90f0-dc4f8d7c4efa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4124-L4140"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f8f233b78e9d3558b0cd7978e3c5fa32645a3bb706c6fdec7f1e4195cf513f10"
+		logic_hash = "v1_sha256_f8f233b78e9d3558b0cd7978e3c5fa32645a3bb706c6fdec7f1e4195cf513f10"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38333,7 +38333,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Bfbfdfef43608730Ee14779Ee3Ee2Cb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CSTech Software Inc." and pe.signatures[i].serial=="7b:fb:fd:fe:f4:36:08:73:0e:e1:47:79:ee:3e:e2:cb" and 1590537600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CSTech Software Inc." and pe.signatures [ i ] . serial == "7b:fb:fd:fe:f4:36:08:73:0e:e1:47:79:ee:3e:e2:cb" and 1590537600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38342,13 +38342,13 @@ rule REVERSINGLABS_Cert_Blocklist_62205361A758B00572D417Cba014F007 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "85da8e0e-d791-5fed-b9ea-c681462651a6"
+		id = "f8f94762-be3b-5b36-8fd4-3df51025c0b1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4142-L4158"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ebf28921c81191bcf6130baf6532122bb320cc916e38ab225f0acdcb57ea00f3"
+		logic_hash = "v1_sha256_ebf28921c81191bcf6130baf6532122bb320cc916e38ab225f0acdcb57ea00f3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38358,7 +38358,7 @@ rule REVERSINGLABS_Cert_Blocklist_62205361A758B00572D417Cba014F007 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UNITEKH-S, OOO" and pe.signatures[i].serial=="62:20:53:61:a7:58:b0:05:72:d4:17:cb:a0:14:f0:07" and 1590470683<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "UNITEKH-S, OOO" and pe.signatures [ i ] . serial == "62:20:53:61:a7:58:b0:05:72:d4:17:cb:a0:14:f0:07" and 1590470683 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38367,13 +38367,13 @@ rule REVERSINGLABS_Cert_Blocklist_4B47D18Dbea57Abd1563Ddf89F87A6C2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "689c1f80-3b3c-5bd7-9129-4f508cad7fb4"
+		id = "e5409489-1391-5abb-b325-6388cf6f2dc5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4160-L4176"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2e464f4e9bfe0c9510a78552acffb241d2435ea9bf3f5f2501353d7f8f280d78"
+		logic_hash = "v1_sha256_2e464f4e9bfe0c9510a78552acffb241d2435ea9bf3f5f2501353d7f8f280d78"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38383,7 +38383,7 @@ rule REVERSINGLABS_Cert_Blocklist_4B47D18Dbea57Abd1563Ddf89F87A6C2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KBK, OOO" and pe.signatures[i].serial=="4b:47:d1:8d:be:a5:7a:bd:15:63:dd:f8:9f:87:a6:c2" and 1590485607<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KBK, OOO" and pe.signatures [ i ] . serial == "4b:47:d1:8d:be:a5:7a:bd:15:63:dd:f8:9f:87:a6:c2" and 1590485607 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38392,13 +38392,13 @@ rule REVERSINGLABS_Cert_Blocklist_Be41E2C7Bb2493044B9241Abb732599D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "81e5a8f3-0893-534a-ab4f-5c2c47078b40"
+		id = "98a353c0-7b68-5ce7-aa32-492c835577e5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4178-L4196"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "eb5d94b80fd030d14dc26878895c61761825f3c77209ca0280e88dcd1800f9c2"
+		logic_hash = "v1_sha256_eb5d94b80fd030d14dc26878895c61761825f3c77209ca0280e88dcd1800f9c2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38408,7 +38408,7 @@ rule REVERSINGLABS_Cert_Blocklist_Be41E2C7Bb2493044B9241Abb732599D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Company Babylon" and (pe.signatures[i].serial=="00:be:41:e2:c7:bb:24:93:04:4b:92:41:ab:b7:32:59:9d" or pe.signatures[i].serial=="be:41:e2:c7:bb:24:93:04:4b:92:41:ab:b7:32:59:9d") and 1589146251<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Company Babylon" and ( pe.signatures [ i ] . serial == "00:be:41:e2:c7:bb:24:93:04:4b:92:41:ab:b7:32:59:9d" or pe.signatures [ i ] . serial == "be:41:e2:c7:bb:24:93:04:4b:92:41:ab:b7:32:59:9d" ) and 1589146251 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38417,13 +38417,13 @@ rule REVERSINGLABS_Cert_Blocklist_15C5Af15Afecf1C900Cbab0Ca9165629 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "de734943-e735-5895-b76e-5f8588a77540"
+		id = "8dbaaf3b-8ff2-5b47-b82b-4cb8d0657f03"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4198-L4214"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5c54f32dbac271b2b60ec40bd052b5566a512cd2bcb4255057b21262806882d2"
+		logic_hash = "v1_sha256_5c54f32dbac271b2b60ec40bd052b5566a512cd2bcb4255057b21262806882d2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38433,7 +38433,7 @@ rule REVERSINGLABS_Cert_Blocklist_15C5Af15Afecf1C900Cbab0Ca9165629 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kompaniya Auttek" and pe.signatures[i].serial=="15:c5:af:15:af:ec:f1:c9:00:cb:ab:0c:a9:16:56:29" and 1586091840<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kompaniya Auttek" and pe.signatures [ i ] . serial == "15:c5:af:15:af:ec:f1:c9:00:cb:ab:0c:a9:16:56:29" and 1586091840 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38442,13 +38442,13 @@ rule REVERSINGLABS_Cert_Blocklist_476De2F108D20B43Ba3Bae6F331Af8F1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5a741e6d-9b58-5536-8987-b3c36cdfcd5f"
+		id = "55d2d0d6-b485-5379-af98-552acf0be063"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4216-L4232"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e5edf3e15b2139ba6cd85f2cfea63b53f7fa36a3fd7224a4a9ccbe5de6eb6f1d"
+		logic_hash = "v1_sha256_e5edf3e15b2139ba6cd85f2cfea63b53f7fa36a3fd7224a4a9ccbe5de6eb6f1d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38458,7 +38458,7 @@ rule REVERSINGLABS_Cert_Blocklist_476De2F108D20B43Ba3Bae6F331Af8F1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Digiwill Limited" and pe.signatures[i].serial=="47:6d:e2:f1:08:d2:0b:43:ba:3b:ae:6f:33:1a:f8:f1" and 1588135722<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Digiwill Limited" and pe.signatures [ i ] . serial == "47:6d:e2:f1:08:d2:0b:43:ba:3b:ae:6f:33:1a:f8:f1" and 1588135722 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38467,13 +38467,13 @@ rule REVERSINGLABS_Cert_Blocklist_08Ddcc67F8Cad6929607E4Cda29B3503 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3563547f-556b-56e3-ad25-cfec0294fe93"
+		id = "a8e97bdd-2493-5847-9014-5fb2b950cd6b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4234-L4250"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4cd975312ca825b51f34f5c89184a56526877436224c1e7407d715b28ebfd9d5"
+		logic_hash = "v1_sha256_4cd975312ca825b51f34f5c89184a56526877436224c1e7407d715b28ebfd9d5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38483,7 +38483,7 @@ rule REVERSINGLABS_Cert_Blocklist_08Ddcc67F8Cad6929607E4Cda29B3503 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FAN-CHAI, TOV" and pe.signatures[i].serial=="08:dd:cc:67:f8:ca:d6:92:96:07:e4:cd:a2:9b:35:03" and 1564310268<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FAN-CHAI, TOV" and pe.signatures [ i ] . serial == "08:dd:cc:67:f8:ca:d6:92:96:07:e4:cd:a2:9b:35:03" and 1564310268 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38492,13 +38492,13 @@ rule REVERSINGLABS_Cert_Blocklist_052242Ace583Adf2A3B96Adcb04D0812 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "22104929-e2c5-565c-975c-826f666e78e2"
+		id = "69994d14-e9eb-5973-af2d-5c88e7b84ca3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4252-L4268"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e1593a2bf375912e411d5f19d9e232c6b87f0897bb6f1c0b0539380b34b05af5"
+		logic_hash = "v1_sha256_e1593a2bf375912e411d5f19d9e232c6b87f0897bb6f1c0b0539380b34b05af5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38508,7 +38508,7 @@ rule REVERSINGLABS_Cert_Blocklist_052242Ace583Adf2A3B96Adcb04D0812 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FAN-CHAI, TOV" and pe.signatures[i].serial=="05:22:42:ac:e5:83:ad:f2:a3:b9:6a:dc:b0:4d:08:12" and 1573603200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FAN-CHAI, TOV" and pe.signatures [ i ] . serial == "05:22:42:ac:e5:83:ad:f2:a3:b9:6a:dc:b0:4d:08:12" and 1573603200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38517,13 +38517,13 @@ rule REVERSINGLABS_Cert_Blocklist_Bebef5C533Ce92Efc402Fab8605C43Ec : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "59d3dd01-47bc-59ee-8fe7-fd5b1af8f9f4"
+		id = "5622523b-f857-5b50-95ac-98f6b2fb67bf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4270-L4288"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "daa57ad622799467c60693060e6c9eea18bdf0bb26f178e8b03453aab486ccf4"
+		logic_hash = "v1_sha256_daa57ad622799467c60693060e6c9eea18bdf0bb26f178e8b03453aab486ccf4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38533,7 +38533,7 @@ rule REVERSINGLABS_Cert_Blocklist_Bebef5C533Ce92Efc402Fab8605C43Ec : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO VEKTOR" and (pe.signatures[i].serial=="00:be:be:f5:c5:33:ce:92:ef:c4:02:fa:b8:60:5c:43:ec" or pe.signatures[i].serial=="be:be:f5:c5:33:ce:92:ef:c4:02:fa:b8:60:5c:43:ec") and 1587513600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO VEKTOR" and ( pe.signatures [ i ] . serial == "00:be:be:f5:c5:33:ce:92:ef:c4:02:fa:b8:60:5c:43:ec" or pe.signatures [ i ] . serial == "be:be:f5:c5:33:ce:92:ef:c4:02:fa:b8:60:5c:43:ec" ) and 1587513600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38542,13 +38542,13 @@ rule REVERSINGLABS_Cert_Blocklist_1D3F39F481Fe067F8A9289Bb49E05A04 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0c4b6efb-c793-5505-bcd6-f62266c984c6"
+		id = "7b414d16-5a8d-5261-830d-b7f960a62f36"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4290-L4306"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2fdf8b59d302d2ce81a1e9a5715138adc1ec45bd86871c4c2e46412407e329f9"
+		logic_hash = "v1_sha256_2fdf8b59d302d2ce81a1e9a5715138adc1ec45bd86871c4c2e46412407e329f9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38558,7 +38558,7 @@ rule REVERSINGLABS_Cert_Blocklist_1D3F39F481Fe067F8A9289Bb49E05A04 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LOGIKA, OOO" and pe.signatures[i].serial=="1d:3f:39:f4:81:fe:06:7f:8a:92:89:bb:49:e0:5a:04" and 1592553220<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LOGIKA, OOO" and pe.signatures [ i ] . serial == "1d:3f:39:f4:81:fe:06:7f:8a:92:89:bb:49:e0:5a:04" and 1592553220 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38567,13 +38567,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Be35D025E65Cc7A4Ee01F72 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "533bcad1-b589-5a05-8f35-32fcb79c7f68"
+		id = "607807ef-57b2-5d52-81d3-17a599f93d07"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4308-L4324"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dad7ab834a67d36c0b63e45922aea566dc0aaf922be2b74161616b3caea83fdc"
+		logic_hash = "v1_sha256_dad7ab834a67d36c0b63e45922aea566dc0aaf922be2b74161616b3caea83fdc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38583,7 +38583,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Be35D025E65Cc7A4Ee01F72 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Logika OOO" and pe.signatures[i].serial=="7b:e3:5d:02:5e:65:cc:7a:4e:e0:1f:72" and 1594976445<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Logika OOO" and pe.signatures [ i ] . serial == "7b:e3:5d:02:5e:65:cc:7a:4e:e0:1f:72" and 1594976445 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38592,13 +38592,13 @@ rule REVERSINGLABS_Cert_Blocklist_351Fe2Efdc0Ac56A0C822Cf8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ac6b7c6d-781b-5c91-80fe-b822ee00ea7f"
+		id = "db24fc4a-3524-5d62-a78b-f2bf377dd185"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4326-L4342"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "46b87c3531e01ba150f056ec3270564426363ef8c58256eeedbcab247c7625e4"
+		logic_hash = "v1_sha256_46b87c3531e01ba150f056ec3270564426363ef8c58256eeedbcab247c7625e4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38608,7 +38608,7 @@ rule REVERSINGLABS_Cert_Blocklist_351Fe2Efdc0Ac56A0C822Cf8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Logika OOO" and pe.signatures[i].serial=="35:1f:e2:ef:dc:0a:c5:6a:0c:82:2c:f8" and 1594976475<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Logika OOO" and pe.signatures [ i ] . serial == "35:1f:e2:ef:dc:0a:c5:6a:0c:82:2c:f8" and 1594976475 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38617,13 +38617,13 @@ rule REVERSINGLABS_Cert_Blocklist_9Cfbb4C69008821Aaacecde97Ee149Ab : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a8ba633b-fbbe-51ca-9f67-fb91ce9ac2f7"
+		id = "961033b2-afeb-5fe1-8885-070e08a72d2d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4344-L4362"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d74b13eeb5d0a57c5dd3257480230c504a68a8422e77a46bb2e101abb2c7f282"
+		logic_hash = "v1_sha256_d74b13eeb5d0a57c5dd3257480230c504a68a8422e77a46bb2e101abb2c7f282"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38633,7 +38633,7 @@ rule REVERSINGLABS_Cert_Blocklist_9Cfbb4C69008821Aaacecde97Ee149Ab : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kivaliz Prest s.r.l." and (pe.signatures[i].serial=="00:9c:fb:b4:c6:90:08:82:1a:aa:ce:cd:e9:7e:e1:49:ab" or pe.signatures[i].serial=="9c:fb:b4:c6:90:08:82:1a:aa:ce:cd:e9:7e:e1:49:ab") and 1592363914<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kivaliz Prest s.r.l." and ( pe.signatures [ i ] . serial == "00:9c:fb:b4:c6:90:08:82:1a:aa:ce:cd:e9:7e:e1:49:ab" or pe.signatures [ i ] . serial == "9c:fb:b4:c6:90:08:82:1a:aa:ce:cd:e9:7e:e1:49:ab" ) and 1592363914 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38642,13 +38642,13 @@ rule REVERSINGLABS_Cert_Blocklist_C04F5D17Af872Cb2C37E3367Fe761D0D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d7ef2bdf-afba-5254-bef2-78f4b6d5ecea"
+		id = "7486c321-fbcd-597e-a4dd-69db39976dce"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4364-L4382"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4a4d60aa3722a710fe23d5e11c55a28bfe721bb4e797b041d58f62a994487799"
+		logic_hash = "v1_sha256_4a4d60aa3722a710fe23d5e11c55a28bfe721bb4e797b041d58f62a994487799"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38658,7 +38658,7 @@ rule REVERSINGLABS_Cert_Blocklist_C04F5D17Af872Cb2C37E3367Fe761D0D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DES SP Z O O" and (pe.signatures[i].serial=="00:c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d" or pe.signatures[i].serial=="c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d") and 1594590024<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DES SP Z O O" and ( pe.signatures [ i ] . serial == "00:c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d" or pe.signatures [ i ] . serial == "c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d" ) and 1594590024 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38667,13 +38667,13 @@ rule REVERSINGLABS_Cert_Blocklist_02C5351936Abe405Ac760228A40387E8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6a1e5115-ac72-57a3-8418-7c81f38f76af"
+		id = "ddc0932b-e324-5c3e-bd07-f159f8c207cf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4384-L4400"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5a990f8d1a3f467cdafa0f625bc162745d9201e15ce43fdc93cd6b1730572e89"
+		logic_hash = "v1_sha256_5a990f8d1a3f467cdafa0f625bc162745d9201e15ce43fdc93cd6b1730572e89"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38683,7 +38683,7 @@ rule REVERSINGLABS_Cert_Blocklist_02C5351936Abe405Ac760228A40387E8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RESURS-RM OOO" and pe.signatures[i].serial=="02:c5:35:19:36:ab:e4:05:ac:76:02:28:a4:03:87:e8" and 1589932801<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RESURS-RM OOO" and pe.signatures [ i ] . serial == "02:c5:35:19:36:ab:e4:05:ac:76:02:28:a4:03:87:e8" and 1589932801 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38692,13 +38692,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Ecd829Adcc55D9D6Afe30Dc371Ebda6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "db9f022b-f650-5d40-ae84-4df92b0f3a96"
+		id = "8dde377c-5237-5f3d-b195-df746fbf6e8b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4402-L4420"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "02955f4df7deccab52cdd82fd04d5012db7440f85c87d750fa9f81ff85e2dab0"
+		logic_hash = "v1_sha256_02955f4df7deccab52cdd82fd04d5012db7440f85c87d750fa9f81ff85e2dab0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38708,7 +38708,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Ecd829Adcc55D9D6Afe30Dc371Ebda6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Komp.IT" and (pe.signatures[i].serial=="00:1e:cd:82:9a:dc:c5:5d:9d:6a:fe:30:dc:37:1e:bd:a6" or pe.signatures[i].serial=="1e:cd:82:9a:dc:c5:5d:9d:6a:fe:30:dc:37:1e:bd:a6") and 1588723200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Komp.IT" and ( pe.signatures [ i ] . serial == "00:1e:cd:82:9a:dc:c5:5d:9d:6a:fe:30:dc:37:1e:bd:a6" or pe.signatures [ i ] . serial == "1e:cd:82:9a:dc:c5:5d:9d:6a:fe:30:dc:37:1e:bd:a6" ) and 1588723200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38717,13 +38717,13 @@ rule REVERSINGLABS_Cert_Blocklist_B0167124Ca59149E64D292Eb4B142014 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "384ce73e-3ad5-54d9-a140-cb242f9a91e6"
+		id = "76a1bbba-740c-5109-98ae-a10136f0e88f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4422-L4440"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "10d980d4a71dab4679376f5a6d6a6999e0b59af4f25587a7b8d1ef52a7808cc9"
+		logic_hash = "v1_sha256_10d980d4a71dab4679376f5a6d6a6999e0b59af4f25587a7b8d1ef52a7808cc9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38733,7 +38733,7 @@ rule REVERSINGLABS_Cert_Blocklist_B0167124Ca59149E64D292Eb4B142014 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Euro May SP Z O O" and (pe.signatures[i].serial=="00:b0:16:71:24:ca:59:14:9e:64:d2:92:eb:4b:14:20:14" or pe.signatures[i].serial=="b0:16:71:24:ca:59:14:9e:64:d2:92:eb:4b:14:20:14") and 1585267200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Euro May SP Z O O" and ( pe.signatures [ i ] . serial == "00:b0:16:71:24:ca:59:14:9e:64:d2:92:eb:4b:14:20:14" or pe.signatures [ i ] . serial == "b0:16:71:24:ca:59:14:9e:64:d2:92:eb:4b:14:20:14" ) and 1585267200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38742,13 +38742,13 @@ rule REVERSINGLABS_Cert_Blocklist_112613B7B5F696Cf377680F6463Fcc8C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c0015521-b163-51ab-8c27-da3b1a8df084"
+		id = "af4bd5aa-75f5-5549-bcc8-af494c62fa7d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4442-L4458"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "50fd35617e059a5fe9d9e0fdb4b880c20e406357bbb2d037f9e6e9db47b8e49f"
+		logic_hash = "v1_sha256_50fd35617e059a5fe9d9e0fdb4b880c20e406357bbb2d037f9e6e9db47b8e49f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38758,7 +38758,7 @@ rule REVERSINGLABS_Cert_Blocklist_112613B7B5F696Cf377680F6463Fcc8C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Infoware Cloud Limited" and pe.signatures[i].serial=="11:26:13:b7:b5:f6:96:cf:37:76:80:f6:46:3f:cc:8c" and 1566518400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Infoware Cloud Limited" and pe.signatures [ i ] . serial == "11:26:13:b7:b5:f6:96:cf:37:76:80:f6:46:3f:cc:8c" and 1566518400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38767,13 +38767,13 @@ rule REVERSINGLABS_Cert_Blocklist_B3F906E5E6B2Cf61C5E51Be79B4E8777 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dc826355-bd15-58b3-adcb-55b704f03c0d"
+		id = "4e585a68-e9fa-5d5f-a7d5-2b2740917940"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4460-L4478"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "037e154854c1128fb73d2221c2b7d7211d977492378614fcf4fde959207e34b3"
+		logic_hash = "v1_sha256_037e154854c1128fb73d2221c2b7d7211d977492378614fcf4fde959207e34b3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38783,7 +38783,7 @@ rule REVERSINGLABS_Cert_Blocklist_B3F906E5E6B2Cf61C5E51Be79B4E8777 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Accelerate Technologies Ltd" and (pe.signatures[i].serial=="00:b3:f9:06:e5:e6:b2:cf:61:c5:e5:1b:e7:9b:4e:87:77" or pe.signatures[i].serial=="b3:f9:06:e5:e6:b2:cf:61:c5:e5:1b:e7:9b:4e:87:77") and 1594900020<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Accelerate Technologies Ltd" and ( pe.signatures [ i ] . serial == "00:b3:f9:06:e5:e6:b2:cf:61:c5:e5:1b:e7:9b:4e:87:77" or pe.signatures [ i ] . serial == "b3:f9:06:e5:e6:b2:cf:61:c5:e5:1b:e7:9b:4e:87:77" ) and 1594900020 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38792,13 +38792,13 @@ rule REVERSINGLABS_Cert_Blocklist_566Ac16A57B132D3F64Dced14De790Ee : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cb2ebbd5-5036-52f6-a064-11609f02309f"
+		id = "c82cb6c1-0e5a-51c4-8d62-5743bfca578e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4480-L4496"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "48f4d334614f6c413907d51f4d6312554b13c4f5a3c03070ceba48baa13a8247"
+		logic_hash = "v1_sha256_48f4d334614f6c413907d51f4d6312554b13c4f5a3c03070ceba48baa13a8247"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38808,7 +38808,7 @@ rule REVERSINGLABS_Cert_Blocklist_566Ac16A57B132D3F64Dced14De790Ee : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unirad LLC" and pe.signatures[i].serial=="56:6a:c1:6a:57:b1:32:d3:f6:4d:ce:d1:4d:e7:90:ee" and 1562889600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Unirad LLC" and pe.signatures [ i ] . serial == "56:6a:c1:6a:57:b1:32:d3:f6:4d:ce:d1:4d:e7:90:ee" and 1562889600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38817,13 +38817,13 @@ rule REVERSINGLABS_Cert_Blocklist_D2Caf7908Aaebfa1A8F3E2136Fece024 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6c2c4fc6-5359-55fa-bf79-9202caa5f326"
+		id = "fb132f40-2061-5856-97ad-e0745d0c48ff"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4498-L4516"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cf4d17274ef36d61e78578d34634bf6e5fb0fb857a9a92184916b0f3b8484568"
+		logic_hash = "v1_sha256_cf4d17274ef36d61e78578d34634bf6e5fb0fb857a9a92184916b0f3b8484568"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38833,7 +38833,7 @@ rule REVERSINGLABS_Cert_Blocklist_D2Caf7908Aaebfa1A8F3E2136Fece024 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FANATOR, OOO" and (pe.signatures[i].serial=="00:d2:ca:f7:90:8a:ae:bf:a1:a8:f3:e2:13:6f:ec:e0:24" or pe.signatures[i].serial=="d2:ca:f7:90:8a:ae:bf:a1:a8:f3:e2:13:6f:ec:e0:24") and 1599041760<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FANATOR, OOO" and ( pe.signatures [ i ] . serial == "00:d2:ca:f7:90:8a:ae:bf:a1:a8:f3:e2:13:6f:ec:e0:24" or pe.signatures [ i ] . serial == "d2:ca:f7:90:8a:ae:bf:a1:a8:f3:e2:13:6f:ec:e0:24" ) and 1599041760 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38842,13 +38842,13 @@ rule REVERSINGLABS_Cert_Blocklist_E04A344B397F752A45B128A594A3D6B5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b396e08c-b7dc-5498-9c68-2d8cdc5dd3d3"
+		id = "7303068a-202f-522e-8d79-8204455d171b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4518-L4536"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0489577c6050f0c5d1dad5bda8c4f3c895902b932cd0324087712ccb83f14680"
+		logic_hash = "v1_sha256_0489577c6050f0c5d1dad5bda8c4f3c895902b932cd0324087712ccb83f14680"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38858,7 +38858,7 @@ rule REVERSINGLABS_Cert_Blocklist_E04A344B397F752A45B128A594A3D6B5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Highweb Ireland Operations Limited" and (pe.signatures[i].serial=="00:e0:4a:34:4b:39:7f:75:2a:45:b1:28:a5:94:a3:d6:b5" or pe.signatures[i].serial=="e0:4a:34:4b:39:7f:75:2a:45:b1:28:a5:94:a3:d6:b5") and 1597708800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Highweb Ireland Operations Limited" and ( pe.signatures [ i ] . serial == "00:e0:4a:34:4b:39:7f:75:2a:45:b1:28:a5:94:a3:d6:b5" or pe.signatures [ i ] . serial == "e0:4a:34:4b:39:7f:75:2a:45:b1:28:a5:94:a3:d6:b5" ) and 1597708800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38867,13 +38867,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Bcaed3Ef678F2F9Bf38D09E149B8D70 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0aea5110-569b-5d9c-a2ce-a6a9fe75b58e"
+		id = "d7873219-f50e-55be-a5b1-87fd9c1d8cc1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4538-L4554"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dbf85cbd1d92823287749dac312f95576900753f60a694347b31b1e3aaa288a8"
+		logic_hash = "v1_sha256_dbf85cbd1d92823287749dac312f95576900753f60a694347b31b1e3aaa288a8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38883,7 +38883,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Bcaed3Ef678F2F9Bf38D09E149B8D70 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "StarY Media Inc." and pe.signatures[i].serial=="3b:ca:ed:3e:f6:78:f2:f9:bf:38:d0:9e:14:9b:8d:70" and 1599091200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "StarY Media Inc." and pe.signatures [ i ] . serial == "3b:ca:ed:3e:f6:78:f2:f9:bf:38:d0:9e:14:9b:8d:70" and 1599091200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38892,13 +38892,13 @@ rule REVERSINGLABS_Cert_Blocklist_56D576A062491Ea0A5877Ced418203A1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3db67353-6310-54ad-b46a-97daf63fee42"
+		id = "5d2a7120-f1c5-5700-981e-d6ad672f7385"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4556-L4572"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "19bd6834b432f3dc8786b449241082b359275559a112a8ef4a51efe185b256dc"
+		logic_hash = "v1_sha256_19bd6834b432f3dc8786b449241082b359275559a112a8ef4a51efe185b256dc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38908,7 +38908,7 @@ rule REVERSINGLABS_Cert_Blocklist_56D576A062491Ea0A5877Ced418203A1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Silvo LLC" and pe.signatures[i].serial=="56:d5:76:a0:62:49:1e:a0:a5:87:7c:ed:41:82:03:a1" and 1596249885<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Silvo LLC" and pe.signatures [ i ] . serial == "56:d5:76:a0:62:49:1e:a0:a5:87:7c:ed:41:82:03:a1" and 1596249885 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38917,13 +38917,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Fcba260Df7Da602Ecf4D4D6Fc89D5Dd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ce248602-1f28-5707-b921-640271176e7f"
+		id = "d9aeca7a-9834-5553-91d6-c0e63e2a9b9e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4574-L4590"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4e9a3e516342820248ebf9b3605b8ce2dbf1d9b4255a5b74f7369dd2f1cdd9d8"
+		logic_hash = "v1_sha256_4e9a3e516342820248ebf9b3605b8ce2dbf1d9b4255a5b74f7369dd2f1cdd9d8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38933,7 +38933,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Fcba260Df7Da602Ecf4D4D6Fc89D5Dd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gold Stroy SP Z O O" and pe.signatures[i].serial=="0f:cb:a2:60:df:7d:a6:02:ec:f4:d4:d6:fc:89:d5:dd" and 1593388801<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Gold Stroy SP Z O O" and pe.signatures [ i ] . serial == "0f:cb:a2:60:df:7d:a6:02:ec:f4:d4:d6:fc:89:d5:dd" and 1593388801 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38942,13 +38942,13 @@ rule REVERSINGLABS_Cert_Blocklist_4152169F22454Ed604D03555B7Afb175 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e8975a1a-ac7c-5016-a206-de9ca7eea37f"
+		id = "772ba395-c5b3-5744-97a9-baf73d46c1df"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4592-L4608"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fbb2124b934c270739f564317526d5b23b996364372426485d7c994a83293866"
+		logic_hash = "v1_sha256_fbb2124b934c270739f564317526d5b23b996364372426485d7c994a83293866"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38958,7 +38958,7 @@ rule REVERSINGLABS_Cert_Blocklist_4152169F22454Ed604D03555B7Afb175 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SMACKTECH SOFTWARE LIMITED" and pe.signatures[i].serial=="41:52:16:9f:22:45:4e:d6:04:d0:35:55:b7:af:b1:75" and 1595808000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SMACKTECH SOFTWARE LIMITED" and pe.signatures [ i ] . serial == "41:52:16:9f:22:45:4e:d6:04:d0:35:55:b7:af:b1:75" and 1595808000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38967,13 +38967,13 @@ rule REVERSINGLABS_Cert_Blocklist_01C88Ccbd219500139D1Af138A9E898E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e3bd6be6-461c-56fd-8dfd-8205845f731e"
+		id = "cfb21b7f-c6cf-5db2-8f38-1d25349fd282"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4610-L4626"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d1acb0a7d6e20158797e77c066be42548cee9293fa94f24f936a95977ac16d91"
+		logic_hash = "v1_sha256_d1acb0a7d6e20158797e77c066be42548cee9293fa94f24f936a95977ac16d91"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -38983,7 +38983,7 @@ rule REVERSINGLABS_Cert_Blocklist_01C88Ccbd219500139D1Af138A9E898E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Raymond Yanagita" and pe.signatures[i].serial=="01:c8:8c:cb:d2:19:50:01:39:d1:af:13:8a:9e:89:8e" and 1593041280<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Raymond Yanagita" and pe.signatures [ i ] . serial == "01:c8:8c:cb:d2:19:50:01:39:d1:af:13:8a:9e:89:8e" and 1593041280 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -38992,13 +38992,13 @@ rule REVERSINGLABS_Cert_Blocklist_41D05676E0D31908Be4Dead3486Aeae3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bca4533d-e721-5f23-984a-3b741ca8b53f"
+		id = "2118e870-a77c-5fc7-9acb-d1a76379f16d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4628-L4644"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c4905f02c74df6d05b3f9a6fe2c4f5f32a02bb10da4db929314be043be76d703"
+		logic_hash = "v1_sha256_c4905f02c74df6d05b3f9a6fe2c4f5f32a02bb10da4db929314be043be76d703"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39008,7 +39008,7 @@ rule REVERSINGLABS_Cert_Blocklist_41D05676E0D31908Be4Dead3486Aeae3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rov SP Z O O" and pe.signatures[i].serial=="41:d0:56:76:e0:d3:19:08:be:4d:ea:d3:48:6a:ea:e3" and 1594857600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rov SP Z O O" and pe.signatures [ i ] . serial == "41:d0:56:76:e0:d3:19:08:be:4d:ea:d3:48:6a:ea:e3" and 1594857600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39017,13 +39017,13 @@ rule REVERSINGLABS_Cert_Blocklist_8Cff807Edaf368A60E4106906D8Df319 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c964a540-6124-52f0-b17f-692cd4b9b3af"
+		id = "58612562-39c3-5e83-9d77-10622049eb6c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4646-L4664"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6fc98519faf218d90bb4e01821e6014e009c0b525cfd3c906a64ef82bc20beda"
+		logic_hash = "v1_sha256_6fc98519faf218d90bb4e01821e6014e009c0b525cfd3c906a64ef82bc20beda"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39033,7 +39033,7 @@ rule REVERSINGLABS_Cert_Blocklist_8Cff807Edaf368A60E4106906D8Df319 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KRAFT BOKS OOO" and (pe.signatures[i].serial=="00:8c:ff:80:7e:da:f3:68:a6:0e:41:06:90:6d:8d:f3:19" or pe.signatures[i].serial=="8c:ff:80:7e:da:f3:68:a6:0e:41:06:90:6d:8d:f3:19") and 1598334455<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KRAFT BOKS OOO" and ( pe.signatures [ i ] . serial == "00:8c:ff:80:7e:da:f3:68:a6:0e:41:06:90:6d:8d:f3:19" or pe.signatures [ i ] . serial == "8c:ff:80:7e:da:f3:68:a6:0e:41:06:90:6d:8d:f3:19" ) and 1598334455 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39042,13 +39042,13 @@ rule REVERSINGLABS_Cert_Blocklist_A3E62Be1572293Ad618F58A8Aa32857F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2f67abf3-390a-5c67-afed-e586e20692af"
+		id = "52f393d6-2980-5b99-b788-10c185e6e135"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4666-L4684"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f849898465bc651f19f6f1b54315c061466d8c5860ecf1a07f54c8c8292f6a95"
+		logic_hash = "v1_sha256_f849898465bc651f19f6f1b54315c061466d8c5860ecf1a07f54c8c8292f6a95"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39058,7 +39058,7 @@ rule REVERSINGLABS_Cert_Blocklist_A3E62Be1572293Ad618F58A8Aa32857F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ISIDA, TOV" and (pe.signatures[i].serial=="00:a3:e6:2b:e1:57:22:93:ad:61:8f:58:a8:aa:32:85:7f" or pe.signatures[i].serial=="a3:e6:2b:e1:57:22:93:ad:61:8f:58:a8:aa:32:85:7f") and 1596585600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ISIDA, TOV" and ( pe.signatures [ i ] . serial == "00:a3:e6:2b:e1:57:22:93:ad:61:8f:58:a8:aa:32:85:7f" or pe.signatures [ i ] . serial == "a3:e6:2b:e1:57:22:93:ad:61:8f:58:a8:aa:32:85:7f" ) and 1596585600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39067,13 +39067,13 @@ rule REVERSINGLABS_Cert_Blocklist_672D4428450Afcc24Fc60969A5063A3E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fcd8e808-dbd6-5903-868a-0aa4541e6321"
+		id = "ac0efb69-27cb-5857-b114-9abf2343b1a8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4686-L4702"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8f5927e96109184bad7de4513994fd1021fe1cc5977e60fa72d808df95cb4516"
+		logic_hash = "v1_sha256_8f5927e96109184bad7de4513994fd1021fe1cc5977e60fa72d808df95cb4516"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39083,7 +39083,7 @@ rule REVERSINGLABS_Cert_Blocklist_672D4428450Afcc24Fc60969A5063A3E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MEP, OOO" and pe.signatures[i].serial=="67:2d:44:28:45:0a:fc:c2:4f:c6:09:69:a5:06:3a:3e" and 1597381260<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MEP, OOO" and pe.signatures [ i ] . serial == "67:2d:44:28:45:0a:fc:c2:4f:c6:09:69:a5:06:3a:3e" and 1597381260 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39092,13 +39092,13 @@ rule REVERSINGLABS_Cert_Blocklist_Df479E14A70C7970A4De3Dd3E4Bb0318 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "465fc41c-920d-55e6-8616-a51d1f77b158"
+		id = "19f54736-9c4b-5ef0-bbdd-90f6091460b8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4704-L4722"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "35b1f04cf5d5d1d89db537bf75737e3af5945e594f4d4231e9ae3e7fba52fc0d"
+		logic_hash = "v1_sha256_35b1f04cf5d5d1d89db537bf75737e3af5945e594f4d4231e9ae3e7fba52fc0d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39108,7 +39108,7 @@ rule REVERSINGLABS_Cert_Blocklist_Df479E14A70C7970A4De3Dd3E4Bb0318 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SOFTWARE HUB IT LTD" and (pe.signatures[i].serial=="00:df:47:9e:14:a7:0c:79:70:a4:de:3d:d3:e4:bb:03:18" or pe.signatures[i].serial=="df:47:9e:14:a7:0c:79:70:a4:de:3d:d3:e4:bb:03:18") and 1591660800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SOFTWARE HUB IT LTD" and ( pe.signatures [ i ] . serial == "00:df:47:9e:14:a7:0c:79:70:a4:de:3d:d3:e4:bb:03:18" or pe.signatures [ i ] . serial == "df:47:9e:14:a7:0c:79:70:a4:de:3d:d3:e4:bb:03:18" ) and 1591660800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39117,13 +39117,13 @@ rule REVERSINGLABS_Cert_Blocklist_2924785Fd7990B2D510675176Dae2Bed : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6898e95c-ee31-57a3-b764-99bf9008d0fe"
+		id = "f29bd774-edd2-5ab5-a158-3a3e7894530a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4724-L4740"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e308ca5f24ed5811e947289caf9aa820a16b08ea183c7aa9826f8a726fb5c3cf"
+		logic_hash = "v1_sha256_e308ca5f24ed5811e947289caf9aa820a16b08ea183c7aa9826f8a726fb5c3cf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39133,7 +39133,7 @@ rule REVERSINGLABS_Cert_Blocklist_2924785Fd7990B2D510675176Dae2Bed : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Neoopt LLC" and pe.signatures[i].serial=="29:24:78:5f:d7:99:0b:2d:51:06:75:17:6d:ae:2b:ed" and 1595000258<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Neoopt LLC" and pe.signatures [ i ] . serial == "29:24:78:5f:d7:99:0b:2d:51:06:75:17:6d:ae:2b:ed" and 1595000258 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39142,13 +39142,13 @@ rule REVERSINGLABS_Cert_Blocklist_F4D2Def53Bccb0Dd2B7D54E4853A2Fc5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3c1bec34-9eac-5c7c-bb36-2e24b6ee52dc"
+		id = "6f45e4d0-d986-5f01-b2ff-21ba6dbcc3d2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4742-L4760"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9991f44b8e984bd79269c44999481258d94bec9c21b154b63c6c30ae52344b3c"
+		logic_hash = "v1_sha256_9991f44b8e984bd79269c44999481258d94bec9c21b154b63c6c30ae52344b3c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39158,7 +39158,7 @@ rule REVERSINGLABS_Cert_Blocklist_F4D2Def53Bccb0Dd2B7D54E4853A2Fc5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PETROYL GROUP, TOV" and (pe.signatures[i].serial=="00:f4:d2:de:f5:3b:cc:b0:dd:2b:7d:54:e4:85:3a:2f:c5" or pe.signatures[i].serial=="f4:d2:de:f5:3b:cc:b0:dd:2b:7d:54:e4:85:3a:2f:c5") and 1598347687<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PETROYL GROUP, TOV" and ( pe.signatures [ i ] . serial == "00:f4:d2:de:f5:3b:cc:b0:dd:2b:7d:54:e4:85:3a:2f:c5" or pe.signatures [ i ] . serial == "f4:d2:de:f5:3b:cc:b0:dd:2b:7d:54:e4:85:3a:2f:c5" ) and 1598347687 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39167,13 +39167,13 @@ rule REVERSINGLABS_Cert_Blocklist_03Bf9Ef4Cf037A2385649026C3Da9D3E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d7396af1-2eae-594a-9933-3d148503c0ea"
+		id = "dcb7b9cb-c66d-5a83-aa37-857601ca0f10"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4762-L4778"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "14196bad586b1349e6e8a1eb5621ce0d8d346ff8021c8ef80804de1533fd40d9"
+		logic_hash = "v1_sha256_14196bad586b1349e6e8a1eb5621ce0d8d346ff8021c8ef80804de1533fd40d9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39183,7 +39183,7 @@ rule REVERSINGLABS_Cert_Blocklist_03Bf9Ef4Cf037A2385649026C3Da9D3E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "COLLECTIVE SOFTWARE INC." and pe.signatures[i].serial=="03:bf:9e:f4:cf:03:7a:23:85:64:90:26:c3:da:9d:3e" and 1595371955<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "COLLECTIVE SOFTWARE INC." and pe.signatures [ i ] . serial == "03:bf:9e:f4:cf:03:7a:23:85:64:90:26:c3:da:9d:3e" and 1595371955 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39192,13 +39192,13 @@ rule REVERSINGLABS_Cert_Blocklist_790177A54209D55560A55Db97C5900D6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cc49f477-269a-55af-8344-39d2f24c1e7f"
+		id = "ed9d5c65-db03-55a6-bebd-1b00eafa42c8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4780-L4796"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "07c8e21fe604b481beebae784eb49e32bebee70e749581a55313bfbc757752e2"
+		logic_hash = "v1_sha256_07c8e21fe604b481beebae784eb49e32bebee70e749581a55313bfbc757752e2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39208,7 +39208,7 @@ rule REVERSINGLABS_Cert_Blocklist_790177A54209D55560A55Db97C5900D6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MAK GmbH" and pe.signatures[i].serial=="79:01:77:a5:42:09:d5:55:60:a5:5d:b9:7c:59:00:d6" and 1594080000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MAK GmbH" and pe.signatures [ i ] . serial == "79:01:77:a5:42:09:d5:55:60:a5:5d:b9:7c:59:00:d6" and 1594080000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39217,13 +39217,13 @@ rule REVERSINGLABS_Cert_Blocklist_048F7B5F67D8E2B3030F75Eb7Be2713D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e746516a-c51f-5cb8-8157-a5fe1f2c7abe"
+		id = "ea29c2b9-8c88-588b-8105-446031c9389d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4798-L4814"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6d1b47f3c9d7b90a5470f83a848adeebff2cf9341a1eb41ca8b45d08b469b17f"
+		logic_hash = "v1_sha256_6d1b47f3c9d7b90a5470f83a848adeebff2cf9341a1eb41ca8b45d08b469b17f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39233,7 +39233,7 @@ rule REVERSINGLABS_Cert_Blocklist_048F7B5F67D8E2B3030F75Eb7Be2713D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RITEIL SERVIS, OOO" and pe.signatures[i].serial=="04:8f:7b:5f:67:d8:e2:b3:03:0f:75:eb:7b:e2:71:3d" and 1591142400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RITEIL SERVIS, OOO" and pe.signatures [ i ] . serial == "04:8f:7b:5f:67:d8:e2:b3:03:0f:75:eb:7b:e2:71:3d" and 1591142400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39242,13 +39242,13 @@ rule REVERSINGLABS_Cert_Blocklist_082023879112289Bf351D297Cc8Efcfc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "94a4e3d6-2d0a-5e5d-9ae8-574ef9be017e"
+		id = "01554ff6-0f1c-5e97-b707-8a7124f698b8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4816-L4832"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "58bec160445765ce45a26bf9d96ba6cfe61eee31e0953009d40a7ec64920c677"
+		logic_hash = "v1_sha256_58bec160445765ce45a26bf9d96ba6cfe61eee31e0953009d40a7ec64920c677"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39258,7 +39258,7 @@ rule REVERSINGLABS_Cert_Blocklist_082023879112289Bf351D297Cc8Efcfc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STA-R TOV" and pe.signatures[i].serial=="08:20:23:87:91:12:28:9b:f3:51:d2:97:cc:8e:fc:fc" and 1573430400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "STA-R TOV" and pe.signatures [ i ] . serial == "08:20:23:87:91:12:28:9b:f3:51:d2:97:cc:8e:fc:fc" and 1573430400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39267,13 +39267,13 @@ rule REVERSINGLABS_Cert_Blocklist_0D53690631Dd186C56Be9026Eb931Ae2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4f60613c-4162-5b3d-989f-f79a06450f4d"
+		id = "6c909943-5384-5782-baa1-76affce18202"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4834-L4850"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3d0a80c062800f935fa3837755e8a91245e01a4e2450a05fecab5564cb62c15c"
+		logic_hash = "v1_sha256_3d0a80c062800f935fa3837755e8a91245e01a4e2450a05fecab5564cb62c15c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39283,7 +39283,7 @@ rule REVERSINGLABS_Cert_Blocklist_0D53690631Dd186C56Be9026Eb931Ae2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STA-R TOV" and pe.signatures[i].serial=="0d:53:69:06:31:dd:18:6c:56:be:90:26:eb:93:1a:e2" and 1592190240<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "STA-R TOV" and pe.signatures [ i ] . serial == "0d:53:69:06:31:dd:18:6c:56:be:90:26:eb:93:1a:e2" and 1592190240 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39292,13 +39292,13 @@ rule REVERSINGLABS_Cert_Blocklist_32119925A6Ce4710Aecc4006C28E749F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cfd51cb8-bd04-5ede-a73e-e924815a01f0"
+		id = "72c416c8-99f9-51a0-aa6c-2b8e51c478e0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4852-L4868"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ca812cdfbb7ca984fae1e16159eb0eeb1e65767fcc6aa07eeb84966853146f9d"
+		logic_hash = "v1_sha256_ca812cdfbb7ca984fae1e16159eb0eeb1e65767fcc6aa07eeb84966853146f9d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39308,7 +39308,7 @@ rule REVERSINGLABS_Cert_Blocklist_32119925A6Ce4710Aecc4006C28E749F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Maxiol" and pe.signatures[i].serial=="32:11:99:25:a6:ce:47:10:ae:cc:40:06:c2:8e:74:9f" and 1592438400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Maxiol" and pe.signatures [ i ] . serial == "32:11:99:25:a6:ce:47:10:ae:cc:40:06:c2:8e:74:9f" and 1592438400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39317,13 +39317,13 @@ rule REVERSINGLABS_Cert_Blocklist_2C90Eaf4De3Afc03Ba924C719435C2A3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "06edc1a3-65b1-5a69-ab6b-4ffc3963513c"
+		id = "a9972b24-0e02-5a5a-a729-2d285bdf6ed9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4870-L4888"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5bb78a5e39f9d023cf63edabdc83d4965fc79f6f04f9fea9bcf2a53223fbd4ca"
+		logic_hash = "v1_sha256_5bb78a5e39f9d023cf63edabdc83d4965fc79f6f04f9fea9bcf2a53223fbd4ca"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39333,7 +39333,7 @@ rule REVERSINGLABS_Cert_Blocklist_2C90Eaf4De3Afc03Ba924C719435C2A3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AntiFIX s.r.o." and (pe.signatures[i].serial=="00:2c:90:ea:f4:de:3a:fc:03:ba:92:4c:71:94:35:c2:a3" or pe.signatures[i].serial=="2c:90:ea:f4:de:3a:fc:03:ba:92:4c:71:94:35:c2:a3") and 1586293430<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AntiFIX s.r.o." and ( pe.signatures [ i ] . serial == "00:2c:90:ea:f4:de:3a:fc:03:ba:92:4c:71:94:35:c2:a3" or pe.signatures [ i ] . serial == "2c:90:ea:f4:de:3a:fc:03:ba:92:4c:71:94:35:c2:a3" ) and 1586293430 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39342,13 +39342,13 @@ rule REVERSINGLABS_Cert_Blocklist_Aff762E907F0644E76Ed8A7485Fb12A1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3b3bbbdd-9c2d-5c80-a121-3e3ad13e9ac6"
+		id = "e1d0cb25-f7d4-5995-b11f-3c397ddb9589"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4890-L4908"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ad05389e0eb30cb894b03842d213b8c956f66357a913c73d8d8b79f8336bf980"
+		logic_hash = "v1_sha256_ad05389e0eb30cb894b03842d213b8c956f66357a913c73d8d8b79f8336bf980"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39358,7 +39358,7 @@ rule REVERSINGLABS_Cert_Blocklist_Aff762E907F0644E76Ed8A7485Fb12A1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lets Start SP Z O O" and (pe.signatures[i].serial=="00:af:f7:62:e9:07:f0:64:4e:76:ed:8a:74:85:fb:12:a1" or pe.signatures[i].serial=="af:f7:62:e9:07:f0:64:4e:76:ed:8a:74:85:fb:12:a1") and 1594882330<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Lets Start SP Z O O" and ( pe.signatures [ i ] . serial == "00:af:f7:62:e9:07:f0:64:4e:76:ed:8a:74:85:fb:12:a1" or pe.signatures [ i ] . serial == "af:f7:62:e9:07:f0:64:4e:76:ed:8a:74:85:fb:12:a1" ) and 1594882330 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39367,13 +39367,13 @@ rule REVERSINGLABS_Cert_Blocklist_D8530214Ca0F512946496B5164C61201 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0125a67a-d5e7-5c93-a58c-cacb6d8fa60b"
+		id = "082a3ba4-8e82-5463-8322-4809854047f2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4910-L4928"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "377962915586c9f5a5737c24b698c96efc2e819e52ee16109c405f9af2d57e7f"
+		logic_hash = "v1_sha256_377962915586c9f5a5737c24b698c96efc2e819e52ee16109c405f9af2d57e7f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39383,7 +39383,7 @@ rule REVERSINGLABS_Cert_Blocklist_D8530214Ca0F512946496B5164C61201 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DJ ONLINE MARKETING LIMITED" and (pe.signatures[i].serial=="00:d8:53:02:14:ca:0f:51:29:46:49:6b:51:64:c6:12:01" or pe.signatures[i].serial=="d8:53:02:14:ca:0f:51:29:46:49:6b:51:64:c6:12:01") and 1595485920<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DJ ONLINE MARKETING LIMITED" and ( pe.signatures [ i ] . serial == "00:d8:53:02:14:ca:0f:51:29:46:49:6b:51:64:c6:12:01" or pe.signatures [ i ] . serial == "d8:53:02:14:ca:0f:51:29:46:49:6b:51:64:c6:12:01" ) and 1595485920 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39392,13 +39392,13 @@ rule REVERSINGLABS_Cert_Blocklist_661Ba8F3C9D1B348413484E9A49502F7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a0c501c9-a856-55b6-b845-aeab4db5ab51"
+		id = "260d2578-6792-5d10-ae4b-2cea417ab65d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4930-L4948"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4840b311c1e2c0ae14bb2cf6fa8d96ab1a434ceac861db540697f3aed1a6833f"
+		logic_hash = "v1_sha256_4840b311c1e2c0ae14bb2cf6fa8d96ab1a434ceac861db540697f3aed1a6833f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39408,7 +39408,7 @@ rule REVERSINGLABS_Cert_Blocklist_661Ba8F3C9D1B348413484E9A49502F7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unique Digital Services Ltd." and (pe.signatures[i].serial=="00:66:1b:a8:f3:c9:d1:b3:48:41:34:84:e9:a4:95:02:f7" or pe.signatures[i].serial=="66:1b:a8:f3:c9:d1:b3:48:41:34:84:e9:a4:95:02:f7") and 1594942800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Unique Digital Services Ltd." and ( pe.signatures [ i ] . serial == "00:66:1b:a8:f3:c9:d1:b3:48:41:34:84:e9:a4:95:02:f7" or pe.signatures [ i ] . serial == "66:1b:a8:f3:c9:d1:b3:48:41:34:84:e9:a4:95:02:f7" ) and 1594942800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39417,13 +39417,13 @@ rule REVERSINGLABS_Cert_Blocklist_51Aead5A9Ab2D841B449Fa82De3A8A00 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c4909945-f2f1-53b2-b438-edf411fda7ed"
+		id = "394a7fee-ff73-5c8b-be4e-12e857376fe3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4950-L4966"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e53095aab9d6c2745125e8cd933334ebc2e51a9725714d31a46baa74b8e42ed9"
+		logic_hash = "v1_sha256_e53095aab9d6c2745125e8cd933334ebc2e51a9725714d31a46baa74b8e42ed9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39433,7 +39433,7 @@ rule REVERSINGLABS_Cert_Blocklist_51Aead5A9Ab2D841B449Fa82De3A8A00 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Corsair Software Solution Inc." and pe.signatures[i].serial=="51:ae:ad:5a:9a:b2:d8:41:b4:49:fa:82:de:3a:8a:00" and 1501577475<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Corsair Software Solution Inc." and pe.signatures [ i ] . serial == "51:ae:ad:5a:9a:b2:d8:41:b4:49:fa:82:de:3a:8a:00" and 1501577475 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39442,13 +39442,13 @@ rule REVERSINGLABS_Cert_Blocklist_03B630F9645531F8868Dae8Ac0F8Cfe6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "be945687-9b8c-5d84-9992-fd317eddae54"
+		id = "bc1540b2-9af0-57fa-b148-8f1d0813ad52"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4968-L4984"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6d2f4346760bf52a438c4c996e92a2641bebfd536248776383d7c8394e094e6a"
+		logic_hash = "v1_sha256_6d2f4346760bf52a438c4c996e92a2641bebfd536248776383d7c8394e094e6a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39458,7 +39458,7 @@ rule REVERSINGLABS_Cert_Blocklist_03B630F9645531F8868Dae8Ac0F8Cfe6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Geksan LLC" and pe.signatures[i].serial=="03:b6:30:f9:64:55:31:f8:86:8d:ae:8a:c0:f8:cf:e6" and 1594252801<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Geksan LLC" and pe.signatures [ i ] . serial == "03:b6:30:f9:64:55:31:f8:86:8d:ae:8a:c0:f8:cf:e6" and 1594252801 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39467,13 +39467,13 @@ rule REVERSINGLABS_Cert_Blocklist_6F8373Cf89F1B49138F4328118487F9E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "80c5d205-7f5e-5e06-b490-f33205154974"
+		id = "af7f1735-37f8-5780-9593-0380744a40b9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L4986-L5002"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f926c2f73d47d463721a0cad48d9866192df55d71867941a40cba7e0b7725102"
+		logic_hash = "v1_sha256_f926c2f73d47d463721a0cad48d9866192df55d71867941a40cba7e0b7725102"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39483,7 +39483,7 @@ rule REVERSINGLABS_Cert_Blocklist_6F8373Cf89F1B49138F4328118487F9E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "30 PTY LTD" and pe.signatures[i].serial=="6f:83:73:cf:89:f1:b4:91:38:f4:32:81:18:48:7f:9e" and 1572566400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "30 PTY LTD" and pe.signatures [ i ] . serial == "6f:83:73:cf:89:f1:b4:91:38:f4:32:81:18:48:7f:9e" and 1572566400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39492,13 +39492,13 @@ rule REVERSINGLABS_Cert_Blocklist_E38259Cf24Cc702Ce441B683Ad578911 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fc5df86f-b8c9-58b1-bd41-e03ed50829dd"
+		id = "81e206c2-db07-55aa-8d39-546d2115636e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5004-L5022"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2428df14a18f4aed1a3db85c1fb43a847fae8a922c6dc948f3bc514dc4cae09c"
+		logic_hash = "v1_sha256_2428df14a18f4aed1a3db85c1fb43a847fae8a922c6dc948f3bc514dc4cae09c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39508,7 +39508,7 @@ rule REVERSINGLABS_Cert_Blocklist_E38259Cf24Cc702Ce441B683Ad578911 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Akhirah Technologies Inc." and (pe.signatures[i].serial=="00:e3:82:59:cf:24:cc:70:2c:e4:41:b6:83:ad:57:89:11" or pe.signatures[i].serial=="e3:82:59:cf:24:cc:70:2c:e4:41:b6:83:ad:57:89:11") and 1597276800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Akhirah Technologies Inc." and ( pe.signatures [ i ] . serial == "00:e3:82:59:cf:24:cc:70:2c:e4:41:b6:83:ad:57:89:11" or pe.signatures [ i ] . serial == "e3:82:59:cf:24:cc:70:2c:e4:41:b6:83:ad:57:89:11" ) and 1597276800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39517,13 +39517,13 @@ rule REVERSINGLABS_Cert_Blocklist_Bdc81Bc76090Dae0Eee2E1Eb744A4F9A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "66feefd2-9cec-56fc-a1c1-11004363462d"
+		id = "aee6afc4-0984-5c5c-b62f-9ad6c7b34cb4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5024-L5042"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4fc3e57bedb6fb7c96e6a1ee2ad2aec3860716ac714d52ea58b86be4bbda4660"
+		logic_hash = "v1_sha256_4fc3e57bedb6fb7c96e6a1ee2ad2aec3860716ac714d52ea58b86be4bbda4660"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39533,7 +39533,7 @@ rule REVERSINGLABS_Cert_Blocklist_Bdc81Bc76090Dae0Eee2E1Eb744A4F9A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALM4U GmbH" and (pe.signatures[i].serial=="00:bd:c8:1b:c7:60:90:da:e0:ee:e2:e1:eb:74:4a:4f:9a" or pe.signatures[i].serial=="bd:c8:1b:c7:60:90:da:e0:ee:e2:e1:eb:74:4a:4f:9a") and 1579824000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALM4U GmbH" and ( pe.signatures [ i ] . serial == "00:bd:c8:1b:c7:60:90:da:e0:ee:e2:e1:eb:74:4a:4f:9a" or pe.signatures [ i ] . serial == "bd:c8:1b:c7:60:90:da:e0:ee:e2:e1:eb:74:4a:4f:9a" ) and 1579824000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39542,13 +39542,13 @@ rule REVERSINGLABS_Cert_Blocklist_B2E730B0526F36Faf7D093D48D6D9997 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "eb82e05b-9aee-5ea7-88a5-8d186b8aafb8"
+		id = "48c46ca2-d884-53e4-a1d8-2befa2402d28"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5044-L5062"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f74cc94428d7739abf6ee76f6cbd53aa47cea815a014de0d786fe53b15f66201"
+		logic_hash = "v1_sha256_f74cc94428d7739abf6ee76f6cbd53aa47cea815a014de0d786fe53b15f66201"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39558,7 +39558,7 @@ rule REVERSINGLABS_Cert_Blocklist_B2E730B0526F36Faf7D093D48D6D9997 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bamboo Connect s.r.o." and (pe.signatures[i].serial=="00:b2:e7:30:b0:52:6f:36:fa:f7:d0:93:d4:8d:6d:99:97" or pe.signatures[i].serial=="b2:e7:30:b0:52:6f:36:fa:f7:d0:93:d4:8d:6d:99:97") and 1597276800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bamboo Connect s.r.o." and ( pe.signatures [ i ] . serial == "00:b2:e7:30:b0:52:6f:36:fa:f7:d0:93:d4:8d:6d:99:97" or pe.signatures [ i ] . serial == "b2:e7:30:b0:52:6f:36:fa:f7:d0:93:d4:8d:6d:99:97" ) and 1597276800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39567,13 +39567,13 @@ rule REVERSINGLABS_Cert_Blocklist_7156Ec47Ef01Ab8359Ef4304E5Af1A05 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b285a407-7f71-5c7e-baae-bfa111a50101"
+		id = "e6f0b220-5a00-5687-8c8e-fa92ad1aa4c2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5064-L5080"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7bb093287dd309ce12859eca9a9fc98095b3d52ec860626fe6e743bace262fde"
+		logic_hash = "v1_sha256_7bb093287dd309ce12859eca9a9fc98095b3d52ec860626fe6e743bace262fde"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39583,7 +39583,7 @@ rule REVERSINGLABS_Cert_Blocklist_7156Ec47Ef01Ab8359Ef4304E5Af1A05 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BOREC, OOO" and pe.signatures[i].serial=="71:56:ec:47:ef:01:ab:83:59:ef:43:04:e5:af:1a:05" and 1597363200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BOREC, OOO" and pe.signatures [ i ] . serial == "71:56:ec:47:ef:01:ab:83:59:ef:43:04:e5:af:1a:05" and 1597363200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39592,13 +39592,13 @@ rule REVERSINGLABS_Cert_Blocklist_13794371C052Ec0559E9B492Abb25C26 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "31f119a3-e0da-5875-826f-68c40c6f8b88"
+		id = "da20a58f-046f-5489-b19c-db68755337ad"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5082-L5098"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7383d1fb1fa6e49f8fa9e1eecfe3fcedb8a11702fbd3700630a11b12da29fedf"
+		logic_hash = "v1_sha256_7383d1fb1fa6e49f8fa9e1eecfe3fcedb8a11702fbd3700630a11b12da29fedf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39608,7 +39608,7 @@ rule REVERSINGLABS_Cert_Blocklist_13794371C052Ec0559E9B492Abb25C26 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Carmel group LLC" and pe.signatures[i].serial=="13:79:43:71:c0:52:ec:05:59:e9:b4:92:ab:b2:5c:26" and 1599177600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Carmel group LLC" and pe.signatures [ i ] . serial == "13:79:43:71:c0:52:ec:05:59:e9:b4:92:ab:b2:5c:26" and 1599177600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39617,13 +39617,13 @@ rule REVERSINGLABS_Cert_Blocklist_5C7E78F53C31D6Aa5B45De14B47Eb5C4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5906107a-03ce-5ca4-b0a7-12b0b45359dd"
+		id = "26a806f4-656e-53e2-83fc-30d3e2fc89d0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5100-L5116"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7521abc5c93f0336af4fab95268962aa3d3fb48fed6a8ba7fdb98e373158b327"
+		logic_hash = "v1_sha256_7521abc5c93f0336af4fab95268962aa3d3fb48fed6a8ba7fdb98e373158b327"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39633,7 +39633,7 @@ rule REVERSINGLABS_Cert_Blocklist_5C7E78F53C31D6Aa5B45De14B47Eb5C4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cubic Information Systems, UAB" and pe.signatures[i].serial=="5c:7e:78:f5:3c:31:d6:aa:5b:45:de:14:b4:7e:b5:c4" and 1579824000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cubic Information Systems, UAB" and pe.signatures [ i ] . serial == "5c:7e:78:f5:3c:31:d6:aa:5b:45:de:14:b4:7e:b5:c4" and 1579824000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39642,13 +39642,13 @@ rule REVERSINGLABS_Cert_Blocklist_Dadf44E4046372313Ee97B8E394C4079 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bebfbbd7-8d42-50a3-8efa-85b641eb069a"
+		id = "a227de3a-1860-5261-a930-bf227b58ab63"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5118-L5136"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "170533935b91776ec2413106c55ed4a01c33f32a469a855824cac796f2e132a0"
+		logic_hash = "v1_sha256_170533935b91776ec2413106c55ed4a01c33f32a469a855824cac796f2e132a0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39658,7 +39658,7 @@ rule REVERSINGLABS_Cert_Blocklist_Dadf44E4046372313Ee97B8E394C4079 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Digital Capital Management Ireland Limited" and (pe.signatures[i].serial=="00:da:df:44:e4:04:63:72:31:3e:e9:7b:8e:39:4c:40:79" or pe.signatures[i].serial=="da:df:44:e4:04:63:72:31:3e:e9:7b:8e:39:4c:40:79") and 1600244736<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Digital Capital Management Ireland Limited" and ( pe.signatures [ i ] . serial == "00:da:df:44:e4:04:63:72:31:3e:e9:7b:8e:39:4c:40:79" or pe.signatures [ i ] . serial == "da:df:44:e4:04:63:72:31:3e:e9:7b:8e:39:4c:40:79" ) and 1600244736 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39667,13 +39667,13 @@ rule REVERSINGLABS_Cert_Blocklist_F8C2E08438Bb0E9Adc955E4B493E5821 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "65297530-2482-5773-8914-461fb56cb41d"
+		id = "448840e4-a3e5-5d56-886d-61a0d81881d0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5138-L5156"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5dbe554032c945c46ffd61ef1e0deb59d396a70dd63994bf44c65d849ec8220a"
+		logic_hash = "v1_sha256_5dbe554032c945c46ffd61ef1e0deb59d396a70dd63994bf44c65d849ec8220a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39683,7 +39683,7 @@ rule REVERSINGLABS_Cert_Blocklist_F8C2E08438Bb0E9Adc955E4B493E5821 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DocsGen Software Solutions Inc." and (pe.signatures[i].serial=="00:f8:c2:e0:84:38:bb:0e:9a:dc:95:5e:4b:49:3e:58:21" or pe.signatures[i].serial=="f8:c2:e0:84:38:bb:0e:9a:dc:95:5e:4b:49:3e:58:21") and 1599523200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DocsGen Software Solutions Inc." and ( pe.signatures [ i ] . serial == "00:f8:c2:e0:84:38:bb:0e:9a:dc:95:5e:4b:49:3e:58:21" or pe.signatures [ i ] . serial == "f8:c2:e0:84:38:bb:0e:9a:dc:95:5e:4b:49:3e:58:21" ) and 1599523200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39692,13 +39692,13 @@ rule REVERSINGLABS_Cert_Blocklist_70E1Ebd170Db8102D8C28E58392E5632 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e3b0f68c-8cc9-5275-988a-8d955ea25a47"
+		id = "918eb26d-3409-54cc-aa07-0da48b17a599"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5158-L5174"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e1738eddc1da0876a373ee7f35bff155d56c1b98a23cb117c0e7a966f8fa3c92"
+		logic_hash = "v1_sha256_e1738eddc1da0876a373ee7f35bff155d56c1b98a23cb117c0e7a966f8fa3c92"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39708,7 +39708,7 @@ rule REVERSINGLABS_Cert_Blocklist_70E1Ebd170Db8102D8C28E58392E5632 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Equal Cash Technologies Limited" and pe.signatures[i].serial=="70:e1:eb:d1:70:db:81:02:d8:c2:8e:58:39:2e:56:32" and 1599264000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Equal Cash Technologies Limited" and pe.signatures [ i ] . serial == "70:e1:eb:d1:70:db:81:02:d8:c2:8e:58:39:2e:56:32" and 1599264000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39717,13 +39717,13 @@ rule REVERSINGLABS_Cert_Blocklist_09C89De6F64A7Fdf657E69353C5Fdd44 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f86eafb5-ec59-58c5-b5f9-01a6704fb555"
+		id = "106589b2-3cda-519e-a7a4-504df7869845"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5176-L5192"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1cb57cd68cda91754307d2e4d94ea011975bbfff0f15134081a5aa11870b0db1"
+		logic_hash = "v1_sha256_1cb57cd68cda91754307d2e4d94ea011975bbfff0f15134081a5aa11870b0db1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39733,7 +39733,7 @@ rule REVERSINGLABS_Cert_Blocklist_09C89De6F64A7Fdf657E69353C5Fdd44 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EXON RENTAL SP Z O O" and pe.signatures[i].serial=="09:c8:9d:e6:f6:4a:7f:df:65:7e:69:35:3c:5f:dd:44" and 1601337601<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EXON RENTAL SP Z O O" and pe.signatures [ i ] . serial == "09:c8:9d:e6:f6:4a:7f:df:65:7e:69:35:3c:5f:dd:44" and 1601337601 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39742,13 +39742,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ffff2Ce862378B26440Df49Ca9175B70 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d5d1e84d-328f-53ac-adb6-3824fa77a47d"
+		id = "4f1c541b-eee3-5281-bb00-a3b86936b3f9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5194-L5212"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8ed7b0643b07ce4954f570157e1534ee1ed647717cce00fe7f2b572c9b5d0042"
+		logic_hash = "v1_sha256_8ed7b0643b07ce4954f570157e1534ee1ed647717cce00fe7f2b572c9b5d0042"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39758,7 +39758,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ffff2Ce862378B26440Df49Ca9175B70 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "F & A.TIM d.o.o." and (pe.signatures[i].serial=="00:ff:ff:2c:e8:62:37:8b:26:44:0d:f4:9c:a9:17:5b:70" or pe.signatures[i].serial=="ff:ff:2c:e8:62:37:8b:26:44:0d:f4:9c:a9:17:5b:70") and 1576195200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "F & A.TIM d.o.o." and ( pe.signatures [ i ] . serial == "00:ff:ff:2c:e8:62:37:8b:26:44:0d:f4:9c:a9:17:5b:70" or pe.signatures [ i ] . serial == "ff:ff:2c:e8:62:37:8b:26:44:0d:f4:9c:a9:17:5b:70" ) and 1576195200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39767,13 +39767,13 @@ rule REVERSINGLABS_Cert_Blocklist_3223B4616C2687C04865Bee8321726A8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "089aae56-4f46-563c-800a-dbf57db2bde6"
+		id = "69605fb5-7f3d-5e5f-b3df-6e0305480853"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5214-L5230"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fcb0a14866b3612c5ec5a7db7a3333e20a4605695b3d019eef84de85d7b3ea4d"
+		logic_hash = "v1_sha256_fcb0a14866b3612c5ec5a7db7a3333e20a4605695b3d019eef84de85d7b3ea4d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39783,7 +39783,7 @@ rule REVERSINGLABS_Cert_Blocklist_3223B4616C2687C04865Bee8321726A8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTUNE STAR TRADING, INC." and pe.signatures[i].serial=="32:23:b4:61:6c:26:87:c0:48:65:be:e8:32:17:26:a8" and 1601337600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FORTUNE STAR TRADING, INC." and pe.signatures [ i ] . serial == "32:23:b4:61:6c:26:87:c0:48:65:be:e8:32:17:26:a8" and 1601337600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39792,13 +39792,13 @@ rule REVERSINGLABS_Cert_Blocklist_7709D2Df39E9A4F7Db2F3Cbc29B49743 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7227daa3-453d-5bb8-804c-8a97cd0d81c6"
+		id = "d18eb0bd-beef-52b2-b7b2-4bb546208096"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5232-L5248"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c9ade45e0f9fb737a08ffa94d1fff89471a1cbcbacc139730fab88e382226d0b"
+		logic_hash = "v1_sha256_c9ade45e0f9fb737a08ffa94d1fff89471a1cbcbacc139730fab88e382226d0b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39808,7 +39808,7 @@ rule REVERSINGLABS_Cert_Blocklist_7709D2Df39E9A4F7Db2F3Cbc29B49743 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Grina LLC" and pe.signatures[i].serial=="77:09:d2:df:39:e9:a4:f7:db:2f:3c:bc:29:b4:97:43" and 1556353331<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Grina LLC" and pe.signatures [ i ] . serial == "77:09:d2:df:39:e9:a4:f7:db:2f:3c:bc:29:b4:97:43" and 1556353331 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39817,13 +39817,13 @@ rule REVERSINGLABS_Cert_Blocklist_E29690E14518874D2Dcf00234Ae94F1F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6b4f26d3-b943-5a2e-bfb9-0e290031926a"
+		id = "59c7ef55-cf69-5912-93d0-e0304d7de478"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5250-L5268"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ef84815798b213dc49a142e3076cc6dd680dccabe72643fc86234024a46468f9"
+		logic_hash = "v1_sha256_ef84815798b213dc49a142e3076cc6dd680dccabe72643fc86234024a46468f9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39833,7 +39833,7 @@ rule REVERSINGLABS_Cert_Blocklist_E29690E14518874D2Dcf00234Ae94F1F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GRIND & TAMP ENTERPRISES PTY LTD" and (pe.signatures[i].serial=="00:e2:96:90:e1:45:18:87:4d:2d:cf:00:23:4a:e9:4f:1f" or pe.signatures[i].serial=="e2:96:90:e1:45:18:87:4d:2d:cf:00:23:4a:e9:4f:1f") and 1570838400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GRIND & TAMP ENTERPRISES PTY LTD" and ( pe.signatures [ i ] . serial == "00:e2:96:90:e1:45:18:87:4d:2d:cf:00:23:4a:e9:4f:1f" or pe.signatures [ i ] . serial == "e2:96:90:e1:45:18:87:4d:2d:cf:00:23:4a:e9:4f:1f" ) and 1570838400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39842,13 +39842,13 @@ rule REVERSINGLABS_Cert_Blocklist_Cfac705C7E6845904F99995324F7562C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "42aa3105-a077-5962-8d5d-50429254582b"
+		id = "4815ecf9-b51c-5f5c-9a26-20a3a7e6ce87"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5270-L5288"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "68bcfe60c2e7154f427c20d0471ede99e55c8200149a4438d5a2a75982fcd419"
+		logic_hash = "v1_sha256_68bcfe60c2e7154f427c20d0471ede99e55c8200149a4438d5a2a75982fcd419"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39858,7 +39858,7 @@ rule REVERSINGLABS_Cert_Blocklist_Cfac705C7E6845904F99995324F7562C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HMWOCFPSDLAFMFZIVD" and (pe.signatures[i].serial=="cf:ac:70:5c:7e:68:45:90:4f:99:99:53:24:f7:56:2c" or pe.signatures[i].serial=="30:53:8f:a3:81:97:ba:6f:b0:66:66:ac:db:08:a9:d4") and 1601918720<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HMWOCFPSDLAFMFZIVD" and ( pe.signatures [ i ] . serial == "cf:ac:70:5c:7e:68:45:90:4f:99:99:53:24:f7:56:2c" or pe.signatures [ i ] . serial == "30:53:8f:a3:81:97:ba:6f:b0:66:66:ac:db:08:a9:d4" ) and 1601918720 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39867,13 +39867,13 @@ rule REVERSINGLABS_Cert_Blocklist_A7989F8Be0C82D35A19E7B3Dd4Be30E5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "21d54d40-442e-50f5-a561-41b3d6239bac"
+		id = "48b9b712-a872-52e2-816a-70c498e36bdc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5290-L5308"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a50129908a471e6692bcf663abd5ef52861d4a46fdf528f39efe816ee6150edf"
+		logic_hash = "v1_sha256_a50129908a471e6692bcf663abd5ef52861d4a46fdf528f39efe816ee6150edf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39883,7 +39883,7 @@ rule REVERSINGLABS_Cert_Blocklist_A7989F8Be0C82D35A19E7B3Dd4Be30E5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Instamix Limited" and (pe.signatures[i].serial=="00:a7:98:9f:8b:e0:c8:2d:35:a1:9e:7b:3d:d4:be:30:e5" or pe.signatures[i].serial=="a7:98:9f:8b:e0:c8:2d:35:a1:9e:7b:3d:d4:be:30:e5") and 1598054400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Instamix Limited" and ( pe.signatures [ i ] . serial == "00:a7:98:9f:8b:e0:c8:2d:35:a1:9e:7b:3d:d4:be:30:e5" or pe.signatures [ i ] . serial == "a7:98:9f:8b:e0:c8:2d:35:a1:9e:7b:3d:d4:be:30:e5" ) and 1598054400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39892,13 +39892,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Fa13Ae98E17Ae23Fcfe7Ae873D0C120 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "87a47456-4d90-5a7d-af9d-7a6d5fb8efac"
+		id = "6185be58-f0df-57e5-9317-331743162e15"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5310-L5326"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "415f39f82b6a45acd196ccf246ec660806a8d66c61df8c7d2850e5b244118d04"
+		logic_hash = "v1_sha256_415f39f82b6a45acd196ccf246ec660806a8d66c61df8c7d2850e5b244118d04"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39908,7 +39908,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Fa13Ae98E17Ae23Fcfe7Ae873D0C120 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KLAKSON, LLC" and pe.signatures[i].serial=="0f:a1:3a:e9:8e:17:ae:23:fc:fe:7a:e8:73:d0:c1:20" and 1597276801<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KLAKSON, LLC" and pe.signatures [ i ] . serial == "0f:a1:3a:e9:8e:17:ae:23:fc:fe:7a:e8:73:d0:c1:20" and 1597276801 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39917,13 +39917,13 @@ rule REVERSINGLABS_Cert_Blocklist_3696883055975D571199C6B5D48F3Cd5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f68338f9-8614-5793-981d-70547dbc65ce"
+		id = "5f943a91-a036-5be7-8e35-65a104dd5c70"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5328-L5344"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d6f77b9ca928167341a35b83e353886d4db8dfcecf45cde0f0f93d65059b5200"
+		logic_hash = "v1_sha256_d6f77b9ca928167341a35b83e353886d4db8dfcecf45cde0f0f93d65059b5200"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39933,7 +39933,7 @@ rule REVERSINGLABS_Cert_Blocklist_3696883055975D571199C6B5D48F3Cd5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Korist Networks Incorporated" and pe.signatures[i].serial=="36:96:88:30:55:97:5d:57:11:99:c6:b5:d4:8f:3c:d5" and 1600069289<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Korist Networks Incorporated" and pe.signatures [ i ] . serial == "36:96:88:30:55:97:5d:57:11:99:c6:b5:d4:8f:3c:d5" and 1600069289 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39942,13 +39942,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ee678930D5Bdfaa2Ab0172Fa4C10Ae07 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e2c2c34a-6177-5457-9ed9-fa34f82ee4cd"
+		id = "0335af6e-6318-54c2-824b-89656e70bd82"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5346-L5364"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f1e254450fdbe94172a4fa2d2727c3ade5ae436cf4c0c1153a15e9a2f64f2452"
+		logic_hash = "v1_sha256_f1e254450fdbe94172a4fa2d2727c3ade5ae436cf4c0c1153a15e9a2f64f2452"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39958,7 +39958,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ee678930D5Bdfaa2Ab0172Fa4C10Ae07 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LEX CORPORATION PTY LTD" and (pe.signatures[i].serial=="00:ee:67:89:30:d5:bd:fa:a2:ab:01:72:fa:4c:10:ae:07" or pe.signatures[i].serial=="ee:67:89:30:d5:bd:fa:a2:ab:01:72:fa:4c:10:ae:07") and 1571011200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LEX CORPORATION PTY LTD" and ( pe.signatures [ i ] . serial == "00:ee:67:89:30:d5:bd:fa:a2:ab:01:72:fa:4c:10:ae:07" or pe.signatures [ i ] . serial == "ee:67:89:30:d5:bd:fa:a2:ab:01:72:fa:4c:10:ae:07" ) and 1571011200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39967,13 +39967,13 @@ rule REVERSINGLABS_Cert_Blocklist_D7C432E8D4Edef515Bfb9D1C214Ff0F5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5aed508e-2da1-52a0-98f3-52e903e95b7d"
+		id = "cfc7779c-da9c-50dd-b781-5a36701f0678"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5366-L5384"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "63741513f3ab2f51ecd66dc973239c9dc194b86504fe26b2dd4a7f31299e5497"
+		logic_hash = "v1_sha256_63741513f3ab2f51ecd66dc973239c9dc194b86504fe26b2dd4a7f31299e5497"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -39983,7 +39983,7 @@ rule REVERSINGLABS_Cert_Blocklist_D7C432E8D4Edef515Bfb9D1C214Ff0F5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC \"MILKY PUT\"" and (pe.signatures[i].serial=="00:d7:c4:32:e8:d4:ed:ef:51:5b:fb:9d:1c:21:4f:f0:f5" or pe.signatures[i].serial=="d7:c4:32:e8:d4:ed:ef:51:5b:fb:9d:1c:21:4f:f0:f5") and 1601596800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LLC \"MILKY PUT\"" and ( pe.signatures [ i ] . serial == "00:d7:c4:32:e8:d4:ed:ef:51:5b:fb:9d:1c:21:4f:f0:f5" or pe.signatures [ i ] . serial == "d7:c4:32:e8:d4:ed:ef:51:5b:fb:9d:1c:21:4f:f0:f5" ) and 1601596800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -39992,13 +39992,13 @@ rule REVERSINGLABS_Cert_Blocklist_5B440A47E8Ce3Dd202271E5C7A666C78 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6f9852cb-277d-5942-b3f7-525593a41027"
+		id = "e551053a-c705-5752-bb9b-e0d336126492"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5386-L5402"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "eb4387d58e391c356ed774d8c13bb4bbb2befed585bb44674459d3ef519aec58"
+		logic_hash = "v1_sha256_eb4387d58e391c356ed774d8c13bb4bbb2befed585bb44674459d3ef519aec58"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40008,7 +40008,7 @@ rule REVERSINGLABS_Cert_Blocklist_5B440A47E8Ce3Dd202271E5C7A666C78 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Master Networking s.r.o." and pe.signatures[i].serial=="5b:44:0a:47:e8:ce:3d:d2:02:27:1e:5c:7a:66:6c:78" and 1601895571<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Master Networking s.r.o." and pe.signatures [ i ] . serial == "5b:44:0a:47:e8:ce:3d:d2:02:27:1e:5c:7a:66:6c:78" and 1601895571 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40017,13 +40017,13 @@ rule REVERSINGLABS_Cert_Blocklist_B82C6553B2186C219797621Aaa233Edb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e1dd9783-078f-582e-8493-7c493cda9c62"
+		id = "83f2f813-f4a6-5a22-8d82-1ced318dfe03"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5404-L5422"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "72e3e1740a4adc4315d2dd9c9f7b8cee2d89c3006014dec663b70d3419f43ca3"
+		logic_hash = "v1_sha256_72e3e1740a4adc4315d2dd9c9f7b8cee2d89c3006014dec663b70d3419f43ca3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40033,7 +40033,7 @@ rule REVERSINGLABS_Cert_Blocklist_B82C6553B2186C219797621Aaa233Edb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MC Commerce SP Z o o" and (pe.signatures[i].serial=="00:b8:2c:65:53:b2:18:6c:21:97:97:62:1a:aa:23:3e:db" or pe.signatures[i].serial=="b8:2c:65:53:b2:18:6c:21:97:97:62:1a:aa:23:3e:db") and 1585785600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MC Commerce SP Z o o" and ( pe.signatures [ i ] . serial == "00:b8:2c:65:53:b2:18:6c:21:97:97:62:1a:aa:23:3e:db" or pe.signatures [ i ] . serial == "b8:2c:65:53:b2:18:6c:21:97:97:62:1a:aa:23:3e:db" ) and 1585785600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40042,13 +40042,13 @@ rule REVERSINGLABS_Cert_Blocklist_F360F7Ad0Ed065Fec0B44F98E04481A0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "96219c86-f463-5f11-950d-ca2af75d5559"
+		id = "3b575e56-f1c0-5f65-9466-6b1b6a13b562"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5424-L5442"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2a25f1121f492dec461e570ff56acb0e3957cdf9100002f2ff0b6c3d3b35fee5"
+		logic_hash = "v1_sha256_2a25f1121f492dec461e570ff56acb0e3957cdf9100002f2ff0b6c3d3b35fee5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40058,7 +40058,7 @@ rule REVERSINGLABS_Cert_Blocklist_F360F7Ad0Ed065Fec0B44F98E04481A0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MEHANIKUM OOO" and (pe.signatures[i].serial=="00:f3:60:f7:ad:0e:d0:65:fe:c0:b4:4f:98:e0:44:81:a0" or pe.signatures[i].serial=="f3:60:f7:ad:0e:d0:65:fe:c0:b4:4f:98:e0:44:81:a0") and 1599031121<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MEHANIKUM OOO" and ( pe.signatures [ i ] . serial == "00:f3:60:f7:ad:0e:d0:65:fe:c0:b4:4f:98:e0:44:81:a0" or pe.signatures [ i ] . serial == "f3:60:f7:ad:0e:d0:65:fe:c0:b4:4f:98:e0:44:81:a0" ) and 1599031121 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40067,13 +40067,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fe41941464B9992A69B7317418Ae8Eb7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dd84a6b2-e616-5f93-af50-1a4fc15f3c45"
+		id = "a74708bc-69a8-589b-b7ae-0ae63b8fd31b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5444-L5462"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bd5131f2b44deec6a7a68577b80ef4d066c331da2976539ce52ac6cff8d5560e"
+		logic_hash = "v1_sha256_bd5131f2b44deec6a7a68577b80ef4d066c331da2976539ce52ac6cff8d5560e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40083,7 +40083,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fe41941464B9992A69B7317418Ae8Eb7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Milsean Software Limited" and (pe.signatures[i].serial=="00:fe:41:94:14:64:b9:99:2a:69:b7:31:74:18:ae:8e:b7" or pe.signatures[i].serial=="fe:41:94:14:64:b9:99:2a:69:b7:31:74:18:ae:8e:b7") and 1599523200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Milsean Software Limited" and ( pe.signatures [ i ] . serial == "00:fe:41:94:14:64:b9:99:2a:69:b7:31:74:18:ae:8e:b7" or pe.signatures [ i ] . serial == "fe:41:94:14:64:b9:99:2a:69:b7:31:74:18:ae:8e:b7" ) and 1599523200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40092,13 +40092,13 @@ rule REVERSINGLABS_Cert_Blocklist_0C14B611A44A1Bae0E8C7581651845B6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "116beeac-49c6-56b0-a1c0-855623f604d9"
+		id = "c3ab1646-ccbb-5856-a562-a1dca8ee8d36"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5464-L5480"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7f6028181e33e4ba8264ee367169e7259e19ff49dcae9a337a4ba78c06b459e6"
+		logic_hash = "v1_sha256_7f6028181e33e4ba8264ee367169e7259e19ff49dcae9a337a4ba78c06b459e6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40108,7 +40108,7 @@ rule REVERSINGLABS_Cert_Blocklist_0C14B611A44A1Bae0E8C7581651845B6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NEEDCODE SP Z O O" and pe.signatures[i].serial=="0c:14:b6:11:a4:4a:1b:ae:0e:8c:75:81:65:18:45:b6" and 1600300801<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NEEDCODE SP Z O O" and pe.signatures [ i ] . serial == "0c:14:b6:11:a4:4a:1b:ae:0e:8c:75:81:65:18:45:b6" and 1600300801 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40117,13 +40117,13 @@ rule REVERSINGLABS_Cert_Blocklist_690910Dc89D7857C3500Fb74Bed2B08D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7c427b1a-fbe9-5e97-9810-87863c70988d"
+		id = "35111140-4028-588c-bf7a-22e2c03109ec"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5482-L5498"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3c5da6238279296854eb95ecaed802f453e80c6bceb71c3fa587df0f7d40cf96"
+		logic_hash = "v1_sha256_3c5da6238279296854eb95ecaed802f453e80c6bceb71c3fa587df0f7d40cf96"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40133,7 +40133,7 @@ rule REVERSINGLABS_Cert_Blocklist_690910Dc89D7857C3500Fb74Bed2B08D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OLIMP STROI, OOO" and pe.signatures[i].serial=="69:09:10:dc:89:d7:85:7c:35:00:fb:74:be:d2:b0:8d" and 1597276800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OLIMP STROI, OOO" and pe.signatures [ i ] . serial == "69:09:10:dc:89:d7:85:7c:35:00:fb:74:be:d2:b0:8d" and 1597276800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40142,13 +40142,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fd41E6Bd7428D3008C8A05F68C9Ac6F2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ef59a76a-3b59-55a2-9da5-c3ba844bbe77"
+		id = "2414f272-96ca-52a6-9488-86a71d9dfedb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5500-L5518"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e387664dc9aa746e127b4efb2ef43675f8fb6df66e99d33ef765e8fa306a4f18"
+		logic_hash = "v1_sha256_e387664dc9aa746e127b4efb2ef43675f8fb6df66e99d33ef765e8fa306a4f18"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40158,7 +40158,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fd41E6Bd7428D3008C8A05F68C9Ac6F2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OM-FAS d.o.o." and (pe.signatures[i].serial=="00:fd:41:e6:bd:74:28:d3:00:8c:8a:05:f6:8c:9a:c6:f2" or pe.signatures[i].serial=="fd:41:e6:bd:74:28:d3:00:8c:8a:05:f6:8c:9a:c6:f2") and 1575590400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OM-FAS d.o.o." and ( pe.signatures [ i ] . serial == "00:fd:41:e6:bd:74:28:d3:00:8c:8a:05:f6:8c:9a:c6:f2" or pe.signatures [ i ] . serial == "fd:41:e6:bd:74:28:d3:00:8c:8a:05:f6:8c:9a:c6:f2" ) and 1575590400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40167,13 +40167,13 @@ rule REVERSINGLABS_Cert_Blocklist_C7079866C0E48B01246Ba0C148E70D4D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2c985bd9-cb2a-553a-af63-a2a0a80cc641"
+		id = "4dc4393b-7cdc-5dcd-b70b-5d17d535b14c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5520-L5538"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cc144760e0ca21fd98b55ac222db540900def61f54e9644f8cab5f711ec7bf24"
+		logic_hash = "v1_sha256_cc144760e0ca21fd98b55ac222db540900def61f54e9644f8cab5f711ec7bf24"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40183,7 +40183,7 @@ rule REVERSINGLABS_Cert_Blocklist_C7079866C0E48B01246Ba0C148E70D4D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO GARANT" and (pe.signatures[i].serial=="00:c7:07:98:66:c0:e4:8b:01:24:6b:a0:c1:48:e7:0d:4d" or pe.signatures[i].serial=="c7:07:98:66:c0:e4:8b:01:24:6b:a0:c1:48:e7:0d:4d") and 1588679105<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO GARANT" and ( pe.signatures [ i ] . serial == "00:c7:07:98:66:c0:e4:8b:01:24:6b:a0:c1:48:e7:0d:4d" or pe.signatures [ i ] . serial == "c7:07:98:66:c0:e4:8b:01:24:6b:a0:c1:48:e7:0d:4d" ) and 1588679105 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40192,13 +40192,13 @@ rule REVERSINGLABS_Cert_Blocklist_D591Da22F33C800A7024Aecff2Cd6C6D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "294cbf90-cd1f-5743-a51a-46e1d04ef34e"
+		id = "10b5234f-79c6-5528-ae98-50b7c5b08527"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5540-L5558"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "30e421d5ea3c5693c5c9bd0e3dd997ceda9755d17e3fb16d2a8e6c4a327ae32f"
+		logic_hash = "v1_sha256_30e421d5ea3c5693c5c9bd0e3dd997ceda9755d17e3fb16d2a8e6c4a327ae32f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40208,7 +40208,7 @@ rule REVERSINGLABS_Cert_Blocklist_D591Da22F33C800A7024Aecff2Cd6C6D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO T2 Soft" and (pe.signatures[i].serial=="00:d5:91:da:22:f3:3c:80:0a:70:24:ae:cf:f2:cd:6c:6d" or pe.signatures[i].serial=="d5:91:da:22:f3:3c:80:0a:70:24:ae:cf:f2:cd:6c:6d") and 1588679107<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO T2 Soft" and ( pe.signatures [ i ] . serial == "00:d5:91:da:22:f3:3c:80:0a:70:24:ae:cf:f2:cd:6c:6d" or pe.signatures [ i ] . serial == "d5:91:da:22:f3:3c:80:0a:70:24:ae:cf:f2:cd:6c:6d" ) and 1588679107 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40217,13 +40217,13 @@ rule REVERSINGLABS_Cert_Blocklist_B36E0F2053Caee9C3B966F7Be0B40Fc3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8ed732ae-1c25-59fc-8ebe-50a1eb81e4a9"
+		id = "46fac83d-9624-5da9-b892-d61e7cb6b42e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5560-L5578"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2444c78aefdb9e8c8004598a318db016d7e781ede6da2ba3ee85316456c3e77b"
+		logic_hash = "v1_sha256_2444c78aefdb9e8c8004598a318db016d7e781ede6da2ba3ee85316456c3e77b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40233,7 +40233,7 @@ rule REVERSINGLABS_Cert_Blocklist_B36E0F2053Caee9C3B966F7Be0B40Fc3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PARTS-JEST d.o.o." and (pe.signatures[i].serial=="00:b3:6e:0f:20:53:ca:ee:9c:3b:96:6f:7b:e0:b4:0f:c3" or pe.signatures[i].serial=="b3:6e:0f:20:53:ca:ee:9c:3b:96:6f:7b:e0:b4:0f:c3") and 1600172855<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PARTS-JEST d.o.o." and ( pe.signatures [ i ] . serial == "00:b3:6e:0f:20:53:ca:ee:9c:3b:96:6f:7b:e0:b4:0f:c3" or pe.signatures [ i ] . serial == "b3:6e:0f:20:53:ca:ee:9c:3b:96:6f:7b:e0:b4:0f:c3" ) and 1600172855 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40242,13 +40242,13 @@ rule REVERSINGLABS_Cert_Blocklist_5B320A2F46C99C1Ba1357Bee : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3912fdfc-7a84-51ce-abd2-977ad183af26"
+		id = "cf2fc150-b922-573b-877c-0fab4d7a2f6c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5580-L5596"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "12797f80bce9d64c6c07e185aa309a0c4f910835745a7f2cc1874fb1211624d8"
+		logic_hash = "v1_sha256_12797f80bce9d64c6c07e185aa309a0c4f910835745a7f2cc1874fb1211624d8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40258,7 +40258,7 @@ rule REVERSINGLABS_Cert_Blocklist_5B320A2F46C99C1Ba1357Bee : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REGION TOURISM LLC" and pe.signatures[i].serial=="5b:32:0a:2f:46:c9:9c:1b:a1:35:7b:ee" and 1602513116<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "REGION TOURISM LLC" and pe.signatures [ i ] . serial == "5b:32:0a:2f:46:c9:9c:1b:a1:35:7b:ee" and 1602513116 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40267,13 +40267,13 @@ rule REVERSINGLABS_Cert_Blocklist_08D4352185317271C1Cec9D05C279Af7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0165920f-5f4d-5b35-990d-120786b4c5ba"
+		id = "1b80cb3a-0253-53e6-b702-1fe45555481d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5598-L5614"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b240962ab23729b241413ed1e53ac6541bf6b8a673c57522efd0cfe0c7eb9dd4"
+		logic_hash = "v1_sha256_b240962ab23729b241413ed1e53ac6541bf6b8a673c57522efd0cfe0c7eb9dd4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40283,7 +40283,7 @@ rule REVERSINGLABS_Cert_Blocklist_08D4352185317271C1Cec9D05C279Af7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Retalit LLC" and pe.signatures[i].serial=="08:d4:35:21:85:31:72:71:c1:ce:c9:d0:5c:27:9a:f7" and 1596585601<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Retalit LLC" and pe.signatures [ i ] . serial == "08:d4:35:21:85:31:72:71:c1:ce:c9:d0:5c:27:9a:f7" and 1596585601 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40292,13 +40292,13 @@ rule REVERSINGLABS_Cert_Blocklist_B514E4C5309Ef9F27Add05Bedd4339A0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4b5abcfe-259e-5029-822b-c191b8d2c607"
+		id = "c44f6ae2-cd2a-592f-b36f-3d7e375e9e77"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5616-L5634"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "665b280218528bbe3d5c65d043266469e5288587ed9d85d01797bef7ce132a6f"
+		logic_hash = "v1_sha256_665b280218528bbe3d5c65d043266469e5288587ed9d85d01797bef7ce132a6f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40308,7 +40308,7 @@ rule REVERSINGLABS_Cert_Blocklist_B514E4C5309Ef9F27Add05Bedd4339A0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SCABONE PTY LTD" and (pe.signatures[i].serial=="00:b5:14:e4:c5:30:9e:f9:f2:7a:dd:05:be:dd:43:39:a0" or pe.signatures[i].serial=="b5:14:e4:c5:30:9e:f9:f2:7a:dd:05:be:dd:43:39:a0") and 1572566400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SCABONE PTY LTD" and ( pe.signatures [ i ] . serial == "00:b5:14:e4:c5:30:9e:f9:f2:7a:dd:05:be:dd:43:39:a0" or pe.signatures [ i ] . serial == "b5:14:e4:c5:30:9e:f9:f2:7a:dd:05:be:dd:43:39:a0" ) and 1572566400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40317,13 +40317,13 @@ rule REVERSINGLABS_Cert_Blocklist_13C7B92282Aae782Bfb00Baf879935F4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cc147c06-e0cf-5536-be3c-17e838b346a9"
+		id = "5bd724e9-23e6-55bc-a596-747f22f45526"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5636-L5652"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d4edbb446a51e5153ba88d6757d5fb610303eac3fd4bdd3b987b508dc618d2dc"
+		logic_hash = "v1_sha256_d4edbb446a51e5153ba88d6757d5fb610303eac3fd4bdd3b987b508dc618d2dc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40333,7 +40333,7 @@ rule REVERSINGLABS_Cert_Blocklist_13C7B92282Aae782Bfb00Baf879935F4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures[i].serial=="13:c7:b9:22:82:aa:e7:82:bf:b0:0b:af:87:99:35:f4" and 1603130510<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures [ i ] . serial == "13:c7:b9:22:82:aa:e7:82:bf:b0:0b:af:87:99:35:f4" and 1603130510 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40342,13 +40342,13 @@ rule REVERSINGLABS_Cert_Blocklist_D627F1000D12485995514Bfbdefc55D9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4696fc12-16b7-575f-b90f-aa0a5cc12852"
+		id = "51581274-6fa7-5ab4-a7f6-b65a879a8518"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5654-L5672"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7ca590d71997879d17054a936238dd5273a52f3438d1b231a75927abfb118ffd"
+		logic_hash = "v1_sha256_7ca590d71997879d17054a936238dd5273a52f3438d1b231a75927abfb118ffd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40358,7 +40358,7 @@ rule REVERSINGLABS_Cert_Blocklist_D627F1000D12485995514Bfbdefc55D9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THREE D CORPORATION PTY LTD" and (pe.signatures[i].serial=="00:d6:27:f1:00:0d:12:48:59:95:51:4b:fb:de:fc:55:d9" or pe.signatures[i].serial=="d6:27:f1:00:0d:12:48:59:95:51:4b:fb:de:fc:55:d9") and 1597622400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THREE D CORPORATION PTY LTD" and ( pe.signatures [ i ] . serial == "00:d6:27:f1:00:0d:12:48:59:95:51:4b:fb:de:fc:55:d9" or pe.signatures [ i ] . serial == "d6:27:f1:00:0d:12:48:59:95:51:4b:fb:de:fc:55:d9" ) and 1597622400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40367,13 +40367,13 @@ rule REVERSINGLABS_Cert_Blocklist_5Fb6Bae8834Edd8D3D58818Edc86D7D7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "52b11933-f22c-53ea-88b7-75b3242907dd"
+		id = "684fb349-5bc7-5d21-8908-75493f906561"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5674-L5690"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a8cec0479bfd53f34e291d56538187c05375e80d20af7f0af08f0db8e1d6ed22"
+		logic_hash = "v1_sha256_a8cec0479bfd53f34e291d56538187c05375e80d20af7f0af08f0db8e1d6ed22"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40383,7 +40383,7 @@ rule REVERSINGLABS_Cert_Blocklist_5Fb6Bae8834Edd8D3D58818Edc86D7D7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tramplink LLC" and pe.signatures[i].serial=="5f:b6:ba:e8:83:4e:dd:8d:3d:58:81:8e:dc:86:d7:d7" and 1600781989<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Tramplink LLC" and pe.signatures [ i ] . serial == "5f:b6:ba:e8:83:4e:dd:8d:3d:58:81:8e:dc:86:d7:d7" and 1600781989 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40392,13 +40392,13 @@ rule REVERSINGLABS_Cert_Blocklist_E5Ad42C509A7C24605530D35832C091E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "29b1803e-90ee-5390-9548-20b24a3de218"
+		id = "79dc96a7-8487-5fa0-bd72-78de55318816"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5692-L5710"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2d57d1c171734d0da167ce7eba47aecd88cd15063488d79659804c6c2fae00a2"
+		logic_hash = "v1_sha256_2d57d1c171734d0da167ce7eba47aecd88cd15063488d79659804c6c2fae00a2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40408,7 +40408,7 @@ rule REVERSINGLABS_Cert_Blocklist_E5Ad42C509A7C24605530D35832C091E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VESNA, OOO" and (pe.signatures[i].serial=="00:e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e" or pe.signatures[i].serial=="e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e") and 1600786458<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VESNA, OOO" and ( pe.signatures [ i ] . serial == "00:e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e" or pe.signatures [ i ] . serial == "e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e" ) and 1600786458 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40417,13 +40417,13 @@ rule REVERSINGLABS_Cert_Blocklist_8E3D89C682F7C0Dad70110Cb7B7C8263 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1adc776c-1549-5149-bd2f-81920a8d7255"
+		id = "b52e4c48-7914-550c-ab64-be9024f490bf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5712-L5730"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a0f42c5492469e7f132b000aead2d674fed4ea9c0e168579fd55a6c89b45ae4d"
+		logic_hash = "v1_sha256_a0f42c5492469e7f132b000aead2d674fed4ea9c0e168579fd55a6c89b45ae4d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40433,7 +40433,7 @@ rule REVERSINGLABS_Cert_Blocklist_8E3D89C682F7C0Dad70110Cb7B7C8263 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WORK PLACEMENTS INTERNATIONAL LIMITED" and (pe.signatures[i].serial=="00:8e:3d:89:c6:82:f7:c0:da:d7:01:10:cb:7b:7c:82:63" or pe.signatures[i].serial=="8e:3d:89:c6:82:f7:c0:da:d7:01:10:cb:7b:7c:82:63") and 1570626662<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "WORK PLACEMENTS INTERNATIONAL LIMITED" and ( pe.signatures [ i ] . serial == "00:8e:3d:89:c6:82:f7:c0:da:d7:01:10:cb:7b:7c:82:63" or pe.signatures [ i ] . serial == "8e:3d:89:c6:82:f7:c0:da:d7:01:10:cb:7b:7c:82:63" ) and 1570626662 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40442,13 +40442,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ef2D35F2Ae82A767A16Be582Ab0D1Ba0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dc8f49b8-fda2-510c-8374-3261e75d11a9"
+		id = "fe8a01ed-8aa4-5007-bf7c-00824b6ad418"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5732-L5750"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0709290aeb18bcb855518e150c2768c24ab311f5c727cdc4c40145b879ff88b6"
+		logic_hash = "v1_sha256_0709290aeb18bcb855518e150c2768c24ab311f5c727cdc4c40145b879ff88b6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40458,7 +40458,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ef2D35F2Ae82A767A16Be582Ab0D1Ba0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Workstage Limited" and (pe.signatures[i].serial=="00:ef:2d:35:f2:ae:82:a7:67:a1:6b:e5:82:ab:0d:1b:a0" or pe.signatures[i].serial=="ef:2d:35:f2:ae:82:a7:67:a1:6b:e5:82:ab:0d:1b:a0") and 1567123200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Workstage Limited" and ( pe.signatures [ i ] . serial == "00:ef:2d:35:f2:ae:82:a7:67:a1:6b:e5:82:ab:0d:1b:a0" or pe.signatures [ i ] . serial == "ef:2d:35:f2:ae:82:a7:67:a1:6b:e5:82:ab:0d:1b:a0" ) and 1567123200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40467,13 +40467,13 @@ rule REVERSINGLABS_Cert_Blocklist_039668034826Df47E6207Ec9Daed57C3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c2a3477a-a4cf-586e-ba70-555cc577ab2c"
+		id = "ec11ced8-d3c2-52c2-9f8e-c3867df7edcd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5752-L5768"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "792860feec6e599ba22ae3869ef132cf5b7be2e0572e23503e293444fd7c382d"
+		logic_hash = "v1_sha256_792860feec6e599ba22ae3869ef132cf5b7be2e0572e23503e293444fd7c382d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40483,7 +40483,7 @@ rule REVERSINGLABS_Cert_Blocklist_039668034826Df47E6207Ec9Daed57C3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CHOO FSP, LLC" and pe.signatures[i].serial=="03:96:68:03:48:26:df:47:e6:20:7e:c9:da:ed:57:c3" and 1601424001<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CHOO FSP, LLC" and pe.signatures [ i ] . serial == "03:96:68:03:48:26:df:47:e6:20:7e:c9:da:ed:57:c3" and 1601424001 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40492,13 +40492,13 @@ rule REVERSINGLABS_Cert_Blocklist_07Bb6A9D1C642C5973C16D5353B17Ca4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "094a02ee-394b-5989-9f73-6b942aca5500"
+		id = "0fc2d7f4-30ae-5186-b86b-b4fed5f50deb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5770-L5786"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b98dcd4f0ebe870a9dad55cac5b0db81be6062216337b75a74a0aff8436df57f"
+		logic_hash = "v1_sha256_b98dcd4f0ebe870a9dad55cac5b0db81be6062216337b75a74a0aff8436df57f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40508,7 +40508,7 @@ rule REVERSINGLABS_Cert_Blocklist_07Bb6A9D1C642C5973C16D5353B17Ca4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MADAS d.o.o." and pe.signatures[i].serial=="07:bb:6a:9d:1c:64:2c:59:73:c1:6d:53:53:b1:7c:a4" and 1601856001<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MADAS d.o.o." and pe.signatures [ i ] . serial == "07:bb:6a:9d:1c:64:2c:59:73:c1:6d:53:53:b1:7c:a4" and 1601856001 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40517,13 +40517,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A1Dc99E4D5264C45A5090F93242A30A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9b85ed8d-ddda-51d0-bfac-5cdc6e4fd94f"
+		id = "62e4dbb6-2219-5cc4-81b7-b01b4329e595"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5788-L5804"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1985c9c4f4a93c3088eaec3031df93cf87a9d7ee36b94322330caf3c21982f3c"
+		logic_hash = "v1_sha256_1985c9c4f4a93c3088eaec3031df93cf87a9d7ee36b94322330caf3c21982f3c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40533,7 +40533,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A1Dc99E4D5264C45A5090F93242A30A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "K & D KOMPANI d.o.o." and pe.signatures[i].serial=="0a:1d:c9:9e:4d:52:64:c4:5a:50:90:f9:32:42:a3:0a" and 1600905601<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "K & D KOMPANI d.o.o." and pe.signatures [ i ] . serial == "0a:1d:c9:9e:4d:52:64:c4:5a:50:90:f9:32:42:a3:0a" and 1600905601 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40542,13 +40542,13 @@ rule REVERSINGLABS_Cert_Blocklist_018093Cfad72Cdf402Eecbe18B33Ec71 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d9ab2e5c-a107-53c1-9b8d-b4625eed03b0"
+		id = "7f7ff64b-121b-55fc-965b-edf459426f9e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5806-L5822"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ac398ef89e691158742598777c320832a750a7410904448778afc7ef3c63c255"
+		logic_hash = "v1_sha256_ac398ef89e691158742598777c320832a750a7410904448778afc7ef3c63c255"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40558,7 +40558,7 @@ rule REVERSINGLABS_Cert_Blocklist_018093Cfad72Cdf402Eecbe18B33Ec71 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FAT11 d.o.o." and pe.signatures[i].serial=="01:80:93:cf:ad:72:cd:f4:02:ee:cb:e1:8b:33:ec:71" and 1602000390<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FAT11 d.o.o." and pe.signatures [ i ] . serial == "01:80:93:cf:ad:72:cd:f4:02:ee:cb:e1:8b:33:ec:71" and 1602000390 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40567,13 +40567,13 @@ rule REVERSINGLABS_Cert_Blocklist_569E03988Af60D80Ce60728940850D9B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a4432990-8c2f-523c-8a9d-cba578aaefc5"
+		id = "1aa7e141-490c-5a78-923e-8446ac855d8f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5824-L5842"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3ea894d9e088c2123f9ec87cbf097e2275fae18cad26e926641fe64921808b1e"
+		logic_hash = "v1_sha256_3ea894d9e088c2123f9ec87cbf097e2275fae18cad26e926641fe64921808b1e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40583,7 +40583,7 @@ rule REVERSINGLABS_Cert_Blocklist_569E03988Af60D80Ce60728940850D9B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OORT inc." and (pe.signatures[i].serial=="00:56:9e:03:98:8a:f6:0d:80:ce:60:72:89:40:85:0d:9b" or pe.signatures[i].serial=="56:9e:03:98:8a:f6:0d:80:ce:60:72:89:40:85:0d:9b") and 1601006510<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OORT inc." and ( pe.signatures [ i ] . serial == "00:56:9e:03:98:8a:f6:0d:80:ce:60:72:89:40:85:0d:9b" or pe.signatures [ i ] . serial == "56:9e:03:98:8a:f6:0d:80:ce:60:72:89:40:85:0d:9b" ) and 1601006510 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40592,13 +40592,13 @@ rule REVERSINGLABS_Cert_Blocklist_418F6D959A8A0F82Bef07Ceba3603E52 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ecfb72ef-04c4-55b6-b9e0-e95053e03425"
+		id = "ee093467-9c08-588a-af31-0511680357c1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5844-L5862"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6c13c5e85d6e053319193d1d94f216eeec64405c86d15971419078a1ce6c8ac9"
+		logic_hash = "v1_sha256_6c13c5e85d6e053319193d1d94f216eeec64405c86d15971419078a1ce6c8ac9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40608,7 +40608,7 @@ rule REVERSINGLABS_Cert_Blocklist_418F6D959A8A0F82Bef07Ceba3603E52 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OORT inc." and (pe.signatures[i].serial=="00:41:8f:6d:95:9a:8a:0f:82:be:f0:7c:eb:a3:60:3e:52" or pe.signatures[i].serial=="41:8f:6d:95:9a:8a:0f:82:be:f0:7c:eb:a3:60:3e:52") and 1601928240<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OORT inc." and ( pe.signatures [ i ] . serial == "00:41:8f:6d:95:9a:8a:0f:82:be:f0:7c:eb:a3:60:3e:52" or pe.signatures [ i ] . serial == "41:8f:6d:95:9a:8a:0f:82:be:f0:7c:eb:a3:60:3e:52" ) and 1601928240 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40617,13 +40617,13 @@ rule REVERSINGLABS_Cert_Blocklist_5378C5Bbeba0D3309A35Bb47F63037F7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7f367505-d7c1-5b8c-83bd-df3fec789d12"
+		id = "22d08e9d-8daf-5893-bb58-7c37fa7b5e92"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5864-L5882"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a96acf93ca6da4d3bf5177b51996825cd3ea70443577622deccdd11fde579c31"
+		logic_hash = "v1_sha256_a96acf93ca6da4d3bf5177b51996825cd3ea70443577622deccdd11fde579c31"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40633,7 +40633,7 @@ rule REVERSINGLABS_Cert_Blocklist_5378C5Bbeba0D3309A35Bb47F63037F7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OORT inc." and (pe.signatures[i].serial=="00:53:78:c5:bb:eb:a0:d3:30:9a:35:bb:47:f6:30:37:f7" or pe.signatures[i].serial=="53:78:c5:bb:eb:a0:d3:30:9a:35:bb:47:f6:30:37:f7") and 1601427420<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OORT inc." and ( pe.signatures [ i ] . serial == "00:53:78:c5:bb:eb:a0:d3:30:9a:35:bb:47:f6:30:37:f7" or pe.signatures [ i ] . serial == "53:78:c5:bb:eb:a0:d3:30:9a:35:bb:47:f6:30:37:f7" ) and 1601427420 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40642,13 +40642,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Bab6A2Aa84B495D9E554A4C42C0126D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7b6d364c-3e27-5314-b604-d44bb408fc4e"
+		id = "5ceb1dd7-79c8-57b9-a62c-2983a7d8c5d5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5884-L5900"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "79b6df421c78fd3e2f05a60f7d875e02519297a0278614c9f63dff8b1b2a2d18"
+		logic_hash = "v1_sha256_79b6df421c78fd3e2f05a60f7d875e02519297a0278614c9f63dff8b1b2a2d18"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40658,7 +40658,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Bab6A2Aa84B495D9E554A4C42C0126D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NOSOV SP Z O O" and pe.signatures[i].serial=="0b:ab:6a:2a:a8:4b:49:5d:9e:55:4a:4c:42:c0:12:6d" and 1597971600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NOSOV SP Z O O" and pe.signatures [ i ] . serial == "0b:ab:6a:2a:a8:4b:49:5d:9e:55:4a:4c:42:c0:12:6d" and 1597971600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40667,13 +40667,13 @@ rule REVERSINGLABS_Cert_Blocklist_6314001C3235Cd59Bcc3F5278C518804 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "aff0fb76-587b-5493-810c-ac32a6ba9576"
+		id = "62f6454f-80cd-531e-8bdc-65ccd7f7a3b2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5902-L5918"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4320f3884c0f7e4939e8988a4e83b8028a5e01fb425ae4faa2273134db835813"
+		logic_hash = "v1_sha256_4320f3884c0f7e4939e8988a4e83b8028a5e01fb425ae4faa2273134db835813"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40683,7 +40683,7 @@ rule REVERSINGLABS_Cert_Blocklist_6314001C3235Cd59Bcc3F5278C518804 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GIE-MUTUALISTE" and pe.signatures[i].serial=="63:14:00:1c:32:35:cd:59:bc:c3:f5:27:8c:51:88:04" and 1600304400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GIE-MUTUALISTE" and pe.signatures [ i ] . serial == "63:14:00:1c:32:35:cd:59:bc:c3:f5:27:8c:51:88:04" and 1600304400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40692,13 +40692,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Ed8Ade5D73B73Dade6943D557Ff87E5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dbfae40c-2f81-5daf-8655-d06ae38ffa8f"
+		id = "c5e5a2e5-acc0-5bde-9ebf-2fa7b74a399e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5920-L5936"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7796b6e7da900be8634e7f1e51cda1275ab1e7c2709af7ecaa8777ab0b518494"
+		logic_hash = "v1_sha256_7796b6e7da900be8634e7f1e51cda1275ab1e7c2709af7ecaa8777ab0b518494"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40708,7 +40708,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Ed8Ade5D73B73Dade6943D557Ff87E5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rumikon LLC" and pe.signatures[i].serial=="0e:d8:ad:e5:d7:3b:73:da:de:69:43:d5:57:ff:87:e5" and 1597885200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rumikon LLC" and pe.signatures [ i ] . serial == "0e:d8:ad:e5:d7:3b:73:da:de:69:43:d5:57:ff:87:e5" and 1597885200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40717,13 +40717,13 @@ rule REVERSINGLABS_Cert_Blocklist_0292C7D574132Ba5C0441D1C7Ffcb805 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ef58cf01-9c54-5dbb-99a7-d3ca42663133"
+		id = "93fa72d6-2863-5e2d-bc37-bcb4054294b7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5938-L5954"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d2bcf72f4c5829d161bc40e820eb0b1a85deaa49b749422d5429e27b7fb2b1fe"
+		logic_hash = "v1_sha256_d2bcf72f4c5829d161bc40e820eb0b1a85deaa49b749422d5429e27b7fb2b1fe"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40733,7 +40733,7 @@ rule REVERSINGLABS_Cert_Blocklist_0292C7D574132Ba5C0441D1C7Ffcb805 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TES LOGISTIKA d.o.o." and pe.signatures[i].serial=="02:92:c7:d5:74:13:2b:a5:c0:44:1d:1c:7f:fc:b8:05" and 1602183720<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TES LOGISTIKA d.o.o." and pe.signatures [ i ] . serial == "02:92:c7:d5:74:13:2b:a5:c0:44:1d:1c:7f:fc:b8:05" and 1602183720 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40742,13 +40742,13 @@ rule REVERSINGLABS_Cert_Blocklist_1F23F001458716D435Cca1A55D660Ec5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "16614e20-1cf1-55c0-a04c-d99c06fb29a2"
+		id = "de5eeaeb-2a15-5d68-8e61-0c460a447bef"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5956-L5972"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bacfb4b7900ab57d23474e0422bd74fff113296b8db37e8eae3bd456443d28d6"
+		logic_hash = "v1_sha256_bacfb4b7900ab57d23474e0422bd74fff113296b8db37e8eae3bd456443d28d6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40758,7 +40758,7 @@ rule REVERSINGLABS_Cert_Blocklist_1F23F001458716D435Cca1A55D660Ec5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Ringen" and pe.signatures[i].serial=="1f:23:f0:01:45:87:16:d4:35:cc:a1:a5:5d:66:0e:c5" and 1603176940<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Ringen" and pe.signatures [ i ] . serial == "1f:23:f0:01:45:87:16:d4:35:cc:a1:a5:5d:66:0e:c5" and 1603176940 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40767,13 +40767,13 @@ rule REVERSINGLABS_Cert_Blocklist_6E0Ccbdfb4777E10Ea6221B90Dc350C2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "64007bd7-b273-5579-8224-68337f1bc54d"
+		id = "8ae9183f-4c6e-523c-8126-40cb52c978a8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5974-L5990"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "08a1ff7cc3a7680fdbb3235a7b46709cd4ba530a9afeab4344671db9fe893cc4"
+		logic_hash = "v1_sha256_08a1ff7cc3a7680fdbb3235a7b46709cd4ba530a9afeab4344671db9fe893cc4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40783,7 +40783,7 @@ rule REVERSINGLABS_Cert_Blocklist_6E0Ccbdfb4777E10Ea6221B90Dc350C2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRAUMALAB INTERNATIONAL APS" and pe.signatures[i].serial=="6e:0c:cb:df:b4:77:7e:10:ea:62:21:b9:0d:c3:50:c2" and 1603046620<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TRAUMALAB INTERNATIONAL APS" and pe.signatures [ i ] . serial == "6e:0c:cb:df:b4:77:7e:10:ea:62:21:b9:0d:c3:50:c2" and 1603046620 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40792,13 +40792,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Ed1847A2Ae5D71Def1E833Fddd33D38 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "11fd3bbe-5d15-57b7-a461-fc9c90046dbc"
+		id = "0d8664e3-42e1-5362-be0d-4bfb367d74fc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L5992-L6008"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0ec5eb8ff1f630284fabfba5c58dd563d471343ace718f79dad08cfe75c3070d"
+		logic_hash = "v1_sha256_0ec5eb8ff1f630284fabfba5c58dd563d471343ace718f79dad08cfe75c3070d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40808,7 +40808,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Ed1847A2Ae5D71Def1E833Fddd33D38 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SNAB-RESURS, OOO" and pe.signatures[i].serial=="0e:d1:84:7a:2a:e5:d7:1d:ef:1e:83:3f:dd:d3:3d:38" and 1598662800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SNAB-RESURS, OOO" and pe.signatures [ i ] . serial == "0e:d1:84:7a:2a:e5:d7:1d:ef:1e:83:3f:dd:d3:3d:38" and 1598662800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40817,13 +40817,13 @@ rule REVERSINGLABS_Cert_Blocklist_97Df46Acb26B7C81A13Cc467B47688C8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "68e2fdc7-61cd-5e0a-8bc7-5e0ca96271c5"
+		id = "22d4bd7a-016c-5cf9-ad0f-d332eb51e508"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6010-L6028"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6f6e0e175caee83eaec2dacedaf564b642195a8815cfd0d4564f581070b0c545"
+		logic_hash = "v1_sha256_6f6e0e175caee83eaec2dacedaf564b642195a8815cfd0d4564f581070b0c545"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40833,7 +40833,7 @@ rule REVERSINGLABS_Cert_Blocklist_97Df46Acb26B7C81A13Cc467B47688C8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Information Civilized System Oy" and (pe.signatures[i].serial=="00:97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8" or pe.signatures[i].serial=="97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8") and 1602636910<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Information Civilized System Oy" and ( pe.signatures [ i ] . serial == "00:97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8" or pe.signatures [ i ] . serial == "97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8" ) and 1602636910 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40842,13 +40842,13 @@ rule REVERSINGLABS_Cert_Blocklist_186D49Fac34Ce99775B8E7Ffbf50679D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9279d4ee-3f53-5d68-aaa1-af6ed579310f"
+		id = "c5fa77aa-cd3a-561c-a325-3d3d74b5c425"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6030-L6046"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0444a5052ee384451ebd85918bbc6bf6d6a75334899a63a8b5828ef06cb9c7ca"
+		logic_hash = "v1_sha256_0444a5052ee384451ebd85918bbc6bf6d6a75334899a63a8b5828ef06cb9c7ca"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40858,7 +40858,7 @@ rule REVERSINGLABS_Cert_Blocklist_186D49Fac34Ce99775B8E7Ffbf50679D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hairis LLC" and pe.signatures[i].serial=="18:6d:49:fa:c3:4c:e9:97:75:b8:e7:ff:bf:50:67:9d" and 1602234590<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Hairis LLC" and pe.signatures [ i ] . serial == "18:6d:49:fa:c3:4c:e9:97:75:b8:e7:ff:bf:50:67:9d" and 1602234590 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40867,13 +40867,13 @@ rule REVERSINGLABS_Cert_Blocklist_B1Aea98Bf0Ce789B6C952310F14Edde0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f039f379-e3d5-56bd-83b7-016881538017"
+		id = "2a85ccf9-18fc-5296-87e9-d9b9f5b1c6aa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6048-L6066"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6e78750d6aca91e9e6d8f2651a5682ccdab5cd20ee3a74e1f8582eb7bc45d614"
+		logic_hash = "v1_sha256_6e78750d6aca91e9e6d8f2651a5682ccdab5cd20ee3a74e1f8582eb7bc45d614"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40883,7 +40883,7 @@ rule REVERSINGLABS_Cert_Blocklist_B1Aea98Bf0Ce789B6C952310F14Edde0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Absolut LLC" and (pe.signatures[i].serial=="00:b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0" or pe.signatures[i].serial=="b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0") and 1602612570<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Absolut LLC" and ( pe.signatures [ i ] . serial == "00:b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0" or pe.signatures [ i ] . serial == "b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0" ) and 1602612570 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40892,13 +40892,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Dcd0699Da08915Dde6D044Cb474157C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e1f56719-e726-5f81-99d4-937e343cbcc9"
+		id = "5190ab6a-bf05-5a95-aa94-b19d57df462a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6068-L6084"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e1a3f27b8b9b642fe1ca73ec54d225f4470b53d0d06f2eea55ad1ad43ec67b39"
+		logic_hash = "v1_sha256_e1a3f27b8b9b642fe1ca73ec54d225f4470b53d0d06f2eea55ad1ad43ec67b39"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40908,7 +40908,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Dcd0699Da08915Dde6D044Cb474157C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VENTE DE TOUT" and pe.signatures[i].serial=="2d:cd:06:99:da:08:91:5d:de:6d:04:4c:b4:74:15:7c" and 1601830010<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VENTE DE TOUT" and pe.signatures [ i ] . serial == "2d:cd:06:99:da:08:91:5d:de:6d:04:4c:b4:74:15:7c" and 1601830010 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40917,13 +40917,13 @@ rule REVERSINGLABS_Cert_Blocklist_4B03Cabe6A0481F17A2Dbeb9Aefad425 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "30108ce3-b133-5e1d-924f-7caaf390e836"
+		id = "1942f9f9-4428-5a99-b310-6a22f8ed04fa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6086-L6102"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6986e7bd90842647ec6a168c30dca2d5ae8ae5b1c1014f966dd596a78859ac6e"
+		logic_hash = "v1_sha256_6986e7bd90842647ec6a168c30dca2d5ae8ae5b1c1014f966dd596a78859ac6e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40933,7 +40933,7 @@ rule REVERSINGLABS_Cert_Blocklist_4B03Cabe6A0481F17A2Dbeb9Aefad425 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RASSVET, OOO" and pe.signatures[i].serial=="4b:03:ca:be:6a:04:81:f1:7a:2d:be:b9:ae:fa:d4:25" and 1603230930<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RASSVET, OOO" and pe.signatures [ i ] . serial == "4b:03:ca:be:6a:04:81:f1:7a:2d:be:b9:ae:fa:d4:25" and 1603230930 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40942,13 +40942,13 @@ rule REVERSINGLABS_Cert_Blocklist_64Cd303Fa289790Afa03C403E9240002 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "86644ef8-4218-5a04-9655-c7d51729872d"
+		id = "74c285a3-b700-5c43-9b06-802e04887ec7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6104-L6120"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f51556a8a12affbd7f7633bf8daa50e6332fa3d3448ea08853cf8ed28e593680"
+		logic_hash = "v1_sha256_f51556a8a12affbd7f7633bf8daa50e6332fa3d3448ea08853cf8ed28e593680"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40958,7 +40958,7 @@ rule REVERSINGLABS_Cert_Blocklist_64Cd303Fa289790Afa03C403E9240002 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MAITLAND TRIFECTA, INC." and pe.signatures[i].serial=="64:cd:30:3f:a2:89:79:0a:fa:03:c4:03:e9:24:00:02" and 1602723600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MAITLAND TRIFECTA, INC." and pe.signatures [ i ] . serial == "64:cd:30:3f:a2:89:79:0a:fa:03:c4:03:e9:24:00:02" and 1602723600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40967,13 +40967,13 @@ rule REVERSINGLABS_Cert_Blocklist_07Cef66A71C35Bc3Aed6D100C6493863 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9c16c370-a382-54f7-ba2e-3b738740966f"
+		id = "0aaf99d0-ad47-59c8-9d82-9ed62318f4e2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6122-L6138"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e741fc13fe4d03b145ed1d86e738b415a7260eae5b0908c6991c9ea9896f14cf"
+		logic_hash = "v1_sha256_e741fc13fe4d03b145ed1d86e738b415a7260eae5b0908c6991c9ea9896f14cf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -40983,7 +40983,7 @@ rule REVERSINGLABS_Cert_Blocklist_07Cef66A71C35Bc3Aed6D100C6493863 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fubon Technologies Ltd" and pe.signatures[i].serial=="07:ce:f6:6a:71:c3:5b:c3:ae:d6:d1:00:c6:49:38:63" and 1602740890<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fubon Technologies Ltd" and pe.signatures [ i ] . serial == "07:ce:f6:6a:71:c3:5b:c3:ae:d6:d1:00:c6:49:38:63" and 1602740890 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -40992,13 +40992,13 @@ rule REVERSINGLABS_Cert_Blocklist_Be77Fe5C58B7A360Add6A3Fced4E8334 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1bbaebe9-b3ca-5ee2-91ac-b2343ca8bb86"
+		id = "feeb21fc-4c02-58dd-b17a-93a6a3992967"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6140-L6158"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cea0d217206562c0045843405802d3b2fad01bdb2a4cfb52057625b43f5f8eee"
+		logic_hash = "v1_sha256_cea0d217206562c0045843405802d3b2fad01bdb2a4cfb52057625b43f5f8eee"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41008,7 +41008,7 @@ rule REVERSINGLABS_Cert_Blocklist_Be77Fe5C58B7A360Add6A3Fced4E8334 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Incar LLC" and (pe.signatures[i].serial=="00:be:77:fe:5c:58:b7:a3:60:ad:d6:a3:fc:ed:4e:83:34" or pe.signatures[i].serial=="be:77:fe:5c:58:b7:a3:60:ad:d6:a3:fc:ed:4e:83:34") and 1602530730<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Incar LLC" and ( pe.signatures [ i ] . serial == "00:be:77:fe:5c:58:b7:a3:60:ad:d6:a3:fc:ed:4e:83:34" or pe.signatures [ i ] . serial == "be:77:fe:5c:58:b7:a3:60:ad:d6:a3:fc:ed:4e:83:34" ) and 1602530730 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41017,13 +41017,13 @@ rule REVERSINGLABS_Cert_Blocklist_F097E59809Ae2E771B7B9Ae5Fc3408D7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1eed6f30-0648-5b8e-81ff-9f3af0f1c91d"
+		id = "d8857d67-34e0-5362-917c-f4defa214f3d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6160-L6178"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9e23ff26d3e1ea181e48fc23383e3717804858bc517a31ec508fa0753730c78e"
+		logic_hash = "v1_sha256_9e23ff26d3e1ea181e48fc23383e3717804858bc517a31ec508fa0753730c78e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41033,7 +41033,7 @@ rule REVERSINGLABS_Cert_Blocklist_F097E59809Ae2E771B7B9Ae5Fc3408D7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABEL RENOVATIONS, INC." and (pe.signatures[i].serial=="00:f0:97:e5:98:09:ae:2e:77:1b:7b:9a:e5:fc:34:08:d7" or pe.signatures[i].serial=="f0:97:e5:98:09:ae:2e:77:1b:7b:9a:e5:fc:34:08:d7") and 1602542033<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ABEL RENOVATIONS, INC." and ( pe.signatures [ i ] . serial == "00:f0:97:e5:98:09:ae:2e:77:1b:7b:9a:e5:fc:34:08:d7" or pe.signatures [ i ] . serial == "f0:97:e5:98:09:ae:2e:77:1b:7b:9a:e5:fc:34:08:d7" ) and 1602542033 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41042,13 +41042,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Cf1Ed2A6Ff4Bee621Efdf725Ea174B7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7f7ecbcd-7a92-526d-99a8-d849fffa19cb"
+		id = "5273b2bc-85f6-52ba-824f-c2f84e22afbe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6180-L6196"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7030c122905105c72833cfcb41692bd9a67cf456e3309afce0b8f9e65c6aa5c1"
+		logic_hash = "v1_sha256_7030c122905105c72833cfcb41692bd9a67cf456e3309afce0b8f9e65c6aa5c1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41058,7 +41058,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Cf1Ed2A6Ff4Bee621Efdf725Ea174B7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LEVEL LIST SP Z O O" and pe.signatures[i].serial=="0c:f1:ed:2a:6f:f4:be:e6:21:ef:df:72:5e:a1:74:b7" and 1603036100<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LEVEL LIST SP Z O O" and pe.signatures [ i ] . serial == "0c:f1:ed:2a:6f:f4:be:e6:21:ef:df:72:5e:a1:74:b7" and 1603036100 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41067,13 +41067,13 @@ rule REVERSINGLABS_Cert_Blocklist_1249Aa2Ada4967969B71Ce63Bf187C38 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5b2876a2-8dfa-5456-a615-4ea69df53422"
+		id = "9dc5db74-7ec6-519f-8a17-29f9ca337702"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6198-L6214"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f84568cfe6304af0307a34bfed6dd346a74e714005b5e6f22a354b14f853ec65"
+		logic_hash = "v1_sha256_f84568cfe6304af0307a34bfed6dd346a74e714005b5e6f22a354b14f853ec65"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41083,7 +41083,7 @@ rule REVERSINGLABS_Cert_Blocklist_1249Aa2Ada4967969B71Ce63Bf187C38 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Umbrella LLC" and pe.signatures[i].serial=="12:49:aa:2a:da:49:67:96:9b:71:ce:63:bf:18:7c:38" and 1599181200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Umbrella LLC" and pe.signatures [ i ] . serial == "12:49:aa:2a:da:49:67:96:9b:71:ce:63:bf:18:7c:38" and 1599181200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41092,13 +41092,13 @@ rule REVERSINGLABS_Cert_Blocklist_D59A05955A4A421500F9561Ce983Aac4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "088f0f98-328b-50fa-b1e4-1d80023b3c09"
+		id = "73bdc59f-cea6-5046-a950-92e017752d55"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6216-L6234"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b7ed87a03f20872669369cc3cad4eae40ba597f06222194bd67262c094083ec1"
+		logic_hash = "v1_sha256_b7ed87a03f20872669369cc3cad4eae40ba597f06222194bd67262c094083ec1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41108,7 +41108,7 @@ rule REVERSINGLABS_Cert_Blocklist_D59A05955A4A421500F9561Ce983Aac4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Olymp LLC" and (pe.signatures[i].serial=="00:d5:9a:05:95:5a:4a:42:15:00:f9:56:1c:e9:83:aa:c4" or pe.signatures[i].serial=="d5:9a:05:95:5a:4a:42:15:00:f9:56:1c:e9:83:aa:c4") and 1601895290<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Olymp LLC" and ( pe.signatures [ i ] . serial == "00:d5:9a:05:95:5a:4a:42:15:00:f9:56:1c:e9:83:aa:c4" or pe.signatures [ i ] . serial == "d5:9a:05:95:5a:4a:42:15:00:f9:56:1c:e9:83:aa:c4" ) and 1601895290 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41117,13 +41117,13 @@ rule REVERSINGLABS_Cert_Blocklist_539015999E304A5952985A994F9C3A53 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ccb4da10-3178-5d8f-be17-9c689e794418"
+		id = "1104a05f-9503-5630-b8df-c5d2752cf171"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6236-L6252"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "feeb1710bd5b048c689a2e45575529624cd1622dcc73db8fe7de6c133fdc5698"
+		logic_hash = "v1_sha256_feeb1710bd5b048c689a2e45575529624cd1622dcc73db8fe7de6c133fdc5698"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41133,7 +41133,7 @@ rule REVERSINGLABS_Cert_Blocklist_539015999E304A5952985A994F9C3A53 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Service lab LLC" and pe.signatures[i].serial=="53:90:15:99:9e:30:4a:59:52:98:5a:99:4f:9c:3a:53" and 1599181200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Service lab LLC" and pe.signatures [ i ] . serial == "53:90:15:99:9e:30:4a:59:52:98:5a:99:4f:9c:3a:53" and 1599181200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41142,13 +41142,13 @@ rule REVERSINGLABS_Cert_Blocklist_0B1926A5E8Ae50A0Efa504F005F93869 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ce437144-0f99-5c41-8d15-edeceb34de4d"
+		id = "b3a67595-5683-5dcf-a516-dd5c909002c8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6254-L6270"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1cbdf39a873c83d2b55723215fb4930a3ce23b6cab2d71a6cd5f16b2721e30f9"
+		logic_hash = "v1_sha256_1cbdf39a873c83d2b55723215fb4930a3ce23b6cab2d71a6cd5f16b2721e30f9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41158,7 +41158,7 @@ rule REVERSINGLABS_Cert_Blocklist_0B1926A5E8Ae50A0Efa504F005F93869 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nordkod LLC" and pe.signatures[i].serial=="0b:19:26:a5:e8:ae:50:a0:ef:a5:04:f0:05:f9:38:69" and 1600650000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Nordkod LLC" and pe.signatures [ i ] . serial == "0b:19:26:a5:e8:ae:50:a0:ef:a5:04:f0:05:f9:38:69" and 1600650000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41167,13 +41167,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A23B660E7322E54D7Bd0E5Acc890966 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "daae5f42-59ff-5838-9444-93357eaa9d60"
+		id = "e2aa285b-7943-59eb-a438-f597914587c8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6272-L6288"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "17996dd0ec81623dbd4eeea98f9bbe37c11c911ca840833ecb9301bb0a9ddb52"
+		logic_hash = "v1_sha256_17996dd0ec81623dbd4eeea98f9bbe37c11c911ca840833ecb9301bb0a9ddb52"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41183,7 +41183,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A23B660E7322E54D7Bd0E5Acc890966 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ARTBUD RADOM SP Z O O" and pe.signatures[i].serial=="0a:23:b6:60:e7:32:2e:54:d7:bd:0e:5a:cc:89:09:66" and 1601254800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ARTBUD RADOM SP Z O O" and pe.signatures [ i ] . serial == "0a:23:b6:60:e7:32:2e:54:d7:bd:0e:5a:cc:89:09:66" and 1601254800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41192,13 +41192,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Cfa5050C819C4Acbb8Fa75979688Dff : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f91ecc17-7406-552a-8864-c9e1657a5ca9"
+		id = "b26e366d-dffd-5dd4-8987-f591633c0237"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6290-L6308"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cffc234be78446191dd5f5990db9f17c7e28eeaa3e16f1eb8ad4ed1e58fdc25e"
+		logic_hash = "v1_sha256_cffc234be78446191dd5f5990db9f17c7e28eeaa3e16f1eb8ad4ed1e58fdc25e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41208,7 +41208,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Cfa5050C819C4Acbb8Fa75979688Dff : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elite Web Development Ltd." and (pe.signatures[i].serial=="00:6c:fa:50:50:c8:19:c4:ac:bb:8f:a7:59:79:68:8d:ff" or pe.signatures[i].serial=="6c:fa:50:50:c8:19:c4:ac:bb:8f:a7:59:79:68:8d:ff") and 1600176940<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Elite Web Development Ltd." and ( pe.signatures [ i ] . serial == "00:6c:fa:50:50:c8:19:c4:ac:bb:8f:a7:59:79:68:8d:ff" or pe.signatures [ i ] . serial == "6c:fa:50:50:c8:19:c4:ac:bb:8f:a7:59:79:68:8d:ff" ) and 1600176940 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41217,13 +41217,13 @@ rule REVERSINGLABS_Cert_Blocklist_044E05Bb1A01A1Cbb50Cfb6Cd24E5D6B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c0796bc3-96cd-5d12-a0ee-97d8ed4a3076"
+		id = "7a0d5e9f-0c4e-5ab5-aef3-422334696734"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6310-L6326"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "40c80d3b6bedb0b3454e14501745a6e82b6ea9ac202748867a2e937fb79c6f6c"
+		logic_hash = "v1_sha256_40c80d3b6bedb0b3454e14501745a6e82b6ea9ac202748867a2e937fb79c6f6c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41233,7 +41233,7 @@ rule REVERSINGLABS_Cert_Blocklist_044E05Bb1A01A1Cbb50Cfb6Cd24E5D6B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MUSTER PLUS SP Z O O" and pe.signatures[i].serial=="04:4e:05:bb:1a:01:a1:cb:b5:0c:fb:6c:d2:4e:5d:6b" and 1601427600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MUSTER PLUS SP Z O O" and pe.signatures [ i ] . serial == "04:4e:05:bb:1a:01:a1:cb:b5:0c:fb:6c:d2:4e:5d:6b" and 1601427600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41242,13 +41242,13 @@ rule REVERSINGLABS_Cert_Blocklist_B7F19B13De9Bee8A52Ff365Ced6F67Fa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0e7e235e-3f0b-5396-9c19-9336d9cbb95a"
+		id = "5a8069a3-0730-5a3f-a69b-d147fca8efbf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6328-L6346"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a8d2a92b44cdd7b123907a6a77ba0fc9fde4961f9ac846b36f1e87730a1efae6"
+		logic_hash = "v1_sha256_a8d2a92b44cdd7b123907a6a77ba0fc9fde4961f9ac846b36f1e87730a1efae6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41258,7 +41258,7 @@ rule REVERSINGLABS_Cert_Blocklist_B7F19B13De9Bee8A52Ff365Ced6F67Fa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALEXIS SECURITY GROUP, LLC" and (pe.signatures[i].serial=="00:b7:f1:9b:13:de:9b:ee:8a:52:ff:36:5c:ed:6f:67:fa" or pe.signatures[i].serial=="b7:f1:9b:13:de:9b:ee:8a:52:ff:36:5c:ed:6f:67:fa") and 1574914319<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALEXIS SECURITY GROUP, LLC" and ( pe.signatures [ i ] . serial == "00:b7:f1:9b:13:de:9b:ee:8a:52:ff:36:5c:ed:6f:67:fa" or pe.signatures [ i ] . serial == "b7:f1:9b:13:de:9b:ee:8a:52:ff:36:5c:ed:6f:67:fa" ) and 1574914319 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41267,13 +41267,13 @@ rule REVERSINGLABS_Cert_Blocklist_B61B8E71514059Adc604Da05C283E514 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2587d30d-e9c8-599c-9cc4-4d4a7aa83c34"
+		id = "517683e3-bcfb-50b8-86eb-2f3b7e3de30f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6348-L6366"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1255cef74082c9cad41ac8e7d62e740f69e6ba44171bb45655a68ee5db204e57"
+		logic_hash = "v1_sha256_1255cef74082c9cad41ac8e7d62e740f69e6ba44171bb45655a68ee5db204e57"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41283,7 +41283,7 @@ rule REVERSINGLABS_Cert_Blocklist_B61B8E71514059Adc604Da05C283E514 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APP DIVISION ApS" and (pe.signatures[i].serial=="00:b6:1b:8e:71:51:40:59:ad:c6:04:da:05:c2:83:e5:14" or pe.signatures[i].serial=="b6:1b:8e:71:51:40:59:ad:c6:04:da:05:c2:83:e5:14") and 1603328400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APP DIVISION ApS" and ( pe.signatures [ i ] . serial == "00:b6:1b:8e:71:51:40:59:ad:c6:04:da:05:c2:83:e5:14" or pe.signatures [ i ] . serial == "b6:1b:8e:71:51:40:59:ad:c6:04:da:05:c2:83:e5:14" ) and 1603328400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41292,13 +41292,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ece6Cbf67Dc41635A5E5D075F286Af23 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3e451a5a-835b-572d-ab17-ff52d3614a86"
+		id = "68d0e8ba-d4f2-5702-9393-c999e66a1a77"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6368-L6386"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f560e6f4a65eaac8db1d8accb0748de17048e66ccf989468e6350a3ec1d70dc8"
+		logic_hash = "v1_sha256_f560e6f4a65eaac8db1d8accb0748de17048e66ccf989468e6350a3ec1d70dc8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41308,7 +41308,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ece6Cbf67Dc41635A5E5D075F286Af23 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THRANE AGENTUR ApS" and (pe.signatures[i].serial=="00:ec:e6:cb:f6:7d:c4:16:35:a5:e5:d0:75:f2:86:af:23" or pe.signatures[i].serial=="ec:e6:cb:f6:7d:c4:16:35:a5:e5:d0:75:f2:86:af:23") and 1603369254<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THRANE AGENTUR ApS" and ( pe.signatures [ i ] . serial == "00:ec:e6:cb:f6:7d:c4:16:35:a5:e5:d0:75:f2:86:af:23" or pe.signatures [ i ] . serial == "ec:e6:cb:f6:7d:c4:16:35:a5:e5:d0:75:f2:86:af:23" ) and 1603369254 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41317,13 +41317,13 @@ rule REVERSINGLABS_Cert_Blocklist_014A98D697B44F43Ded21F18Eb6Ad0Ba : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4fcd4e89-658c-593b-8f94-edd5df19da6e"
+		id = "08ee4154-90be-5f9b-95b9-98e85cf1e398"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6388-L6404"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9f1cc61b944974696113912bc1d1a0b45b9911fa4d6de382a48c0d22d2d20953"
+		logic_hash = "v1_sha256_9f1cc61b944974696113912bc1d1a0b45b9911fa4d6de382a48c0d22d2d20953"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41333,7 +41333,7 @@ rule REVERSINGLABS_Cert_Blocklist_014A98D697B44F43Ded21F18Eb6Ad0Ba : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hillcoe Software Inc." and pe.signatures[i].serial=="01:4a:98:d6:97:b4:4f:43:de:d2:1f:18:eb:6a:d0:ba" and 1605364760<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Hillcoe Software Inc." and pe.signatures [ i ] . serial == "01:4a:98:d6:97:b4:4f:43:de:d2:1f:18:eb:6a:d0:ba" and 1605364760 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41342,13 +41342,13 @@ rule REVERSINGLABS_Cert_Blocklist_063A7D09107Eddd8Aa1F733634C6591B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0169cf47-72b0-53ec-bc8f-c2a80febad3a"
+		id = "73472fa3-59d5-5822-a861-7434e981f5ce"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6406-L6422"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "19f11e1d9ce95eb4bc75387a0118c230388a13cd07b02e00ea1d65cdcc0b2bd7"
+		logic_hash = "v1_sha256_19f11e1d9ce95eb4bc75387a0118c230388a13cd07b02e00ea1d65cdcc0b2bd7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41358,7 +41358,7 @@ rule REVERSINGLABS_Cert_Blocklist_063A7D09107Eddd8Aa1F733634C6591B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Smart Line Logistics" and pe.signatures[i].serial=="06:3a:7d:09:10:7e:dd:d8:aa:1f:73:36:34:c6:59:1b" and 1605712706<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Smart Line Logistics" and pe.signatures [ i ] . serial == "06:3a:7d:09:10:7e:dd:d8:aa:1f:73:36:34:c6:59:1b" and 1605712706 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41367,13 +41367,13 @@ rule REVERSINGLABS_Cert_Blocklist_1E74Cfe7De8C5F57840A61034414Ca9F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d7fd0c3f-0292-5d27-b8e6-559b829440b4"
+		id = "0c266fed-d400-57c0-aaee-95ba0470af38"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6424-L6442"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d82220d908283f1707ec15882503b02cb8dc80095279a9e7d6cbdd113c25d8ae"
+		logic_hash = "v1_sha256_d82220d908283f1707ec15882503b02cb8dc80095279a9e7d6cbdd113c25d8ae"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41383,7 +41383,7 @@ rule REVERSINGLABS_Cert_Blocklist_1E74Cfe7De8C5F57840A61034414Ca9F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Insta Software Solution Inc." and (pe.signatures[i].serial=="00:1e:74:cf:e7:de:8c:5f:57:84:0a:61:03:44:14:ca:9f" or pe.signatures[i].serial=="1e:74:cf:e7:de:8c:5f:57:84:0a:61:03:44:14:ca:9f") and 1601733106<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Insta Software Solution Inc." and ( pe.signatures [ i ] . serial == "00:1e:74:cf:e7:de:8c:5f:57:84:0a:61:03:44:14:ca:9f" or pe.signatures [ i ] . serial == "1e:74:cf:e7:de:8c:5f:57:84:0a:61:03:44:14:ca:9f" ) and 1601733106 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41392,13 +41392,13 @@ rule REVERSINGLABS_Cert_Blocklist_75Cf729F8A740Bbdef183A1C4D86A02F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e96fdf57-3884-526e-a704-93e783c95241"
+		id = "f3bdebaa-8cb2-534a-b7f9-055bafd40d51"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6444-L6460"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "691fadaa653ecd29e60f2db39b7c5154d7c85f388f72eccd0a4b5fe42eaee0dd"
+		logic_hash = "v1_sha256_691fadaa653ecd29e60f2db39b7c5154d7c85f388f72eccd0a4b5fe42eaee0dd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41408,7 +41408,7 @@ rule REVERSINGLABS_Cert_Blocklist_75Cf729F8A740Bbdef183A1C4D86A02F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Umbor LLC" and pe.signatures[i].serial=="75:cf:72:9f:8a:74:0b:bd:ef:18:3a:1c:4d:86:a0:2f" and 1604223894<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Umbor LLC" and pe.signatures [ i ] . serial == "75:cf:72:9f:8a:74:0b:bd:ef:18:3a:1c:4d:86:a0:2f" and 1604223894 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41417,13 +41417,13 @@ rule REVERSINGLABS_Cert_Blocklist_2F64677254D3844Efdac2922123D05D1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "de9ef02d-a723-5013-9f91-e394edc23855"
+		id = "00110f99-1e0e-5321-b93a-e13633036387"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6462-L6478"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f9f1f629e03563ece0fe5186b199e2f030dce7f58fb259de1aeb7387c76fa902"
+		logic_hash = "v1_sha256_f9f1f629e03563ece0fe5186b199e2f030dce7f58fb259de1aeb7387c76fa902"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41433,7 +41433,7 @@ rule REVERSINGLABS_Cert_Blocklist_2F64677254D3844Efdac2922123D05D1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORGANICUP ApS" and pe.signatures[i].serial=="2f:64:67:72:54:d3:84:4e:fd:ac:29:22:12:3d:05:d1" and 1605640092<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ORGANICUP ApS" and pe.signatures [ i ] . serial == "2f:64:67:72:54:d3:84:4e:fd:ac:29:22:12:3d:05:d1" and 1605640092 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41442,13 +41442,13 @@ rule REVERSINGLABS_Cert_Blocklist_32Fbf8Cfa43Dca3F85Efabe96Dfefa49 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "22bd8590-7a95-564c-ad77-fb20569de51d"
+		id = "b2b8d763-5834-547f-ad84-a068f9e30f1b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6480-L6496"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "73d80e6a0dc2316524a55a9627792b9b4488d238ef529f1767de182956b0865e"
+		logic_hash = "v1_sha256_73d80e6a0dc2316524a55a9627792b9b4488d238ef529f1767de182956b0865e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41458,7 +41458,7 @@ rule REVERSINGLABS_Cert_Blocklist_32Fbf8Cfa43Dca3F85Efabe96Dfefa49 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foxstyle LLC" and pe.signatures[i].serial=="32:fb:f8:cf:a4:3d:ca:3f:85:ef:ab:e9:6d:fe:fa:49" and 1598255906<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Foxstyle LLC" and pe.signatures [ i ] . serial == "32:fb:f8:cf:a4:3d:ca:3f:85:ef:ab:e9:6d:fe:fa:49" and 1598255906 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41467,13 +41467,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ef9D0Cf071D463Cd63D13083046A7B8D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8751f71b-0ebb-5820-927c-684a5ae5ee7b"
+		id = "450aa178-3e80-58ee-9680-2b7915092e4f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6498-L6516"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2923979811504f78a79a2480600285a2697845e51870a44ed231a81e79807121"
+		logic_hash = "v1_sha256_2923979811504f78a79a2480600285a2697845e51870a44ed231a81e79807121"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41483,7 +41483,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ef9D0Cf071D463Cd63D13083046A7B8D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rubin LLC" and (pe.signatures[i].serial=="00:ef:9d:0c:f0:71:d4:63:cd:63:d1:30:83:04:6a:7b:8d" or pe.signatures[i].serial=="ef:9d:0c:f0:71:d4:63:cd:63:d1:30:83:04:6a:7b:8d") and 1605358307<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rubin LLC" and ( pe.signatures [ i ] . serial == "00:ef:9d:0c:f0:71:d4:63:cd:63:d1:30:83:04:6a:7b:8d" or pe.signatures [ i ] . serial == "ef:9d:0c:f0:71:d4:63:cd:63:d1:30:83:04:6a:7b:8d" ) and 1605358307 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41492,13 +41492,13 @@ rule REVERSINGLABS_Cert_Blocklist_115Cf1353A0E33E19099A4867A4C750A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c2564461-6731-5d7b-8dbb-560929b568d0"
+		id = "3dab0eed-8672-5a8a-8ee3-4da89572b508"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6518-L6536"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2a3353c655531b113dc019a86288310881e3bbcb6c03670a805f22b185e09e6c"
+		logic_hash = "v1_sha256_2a3353c655531b113dc019a86288310881e3bbcb6c03670a805f22b185e09e6c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41508,7 +41508,7 @@ rule REVERSINGLABS_Cert_Blocklist_115Cf1353A0E33E19099A4867A4C750A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "212 NY Gifts, Inc." and (pe.signatures[i].serial=="00:11:5c:f1:35:3a:0e:33:e1:90:99:a4:86:7a:4c:75:0a" or pe.signatures[i].serial=="11:5c:f1:35:3a:0e:33:e1:90:99:a4:86:7a:4c:75:0a") and 1605515909<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "212 NY Gifts, Inc." and ( pe.signatures [ i ] . serial == "00:11:5c:f1:35:3a:0e:33:e1:90:99:a4:86:7a:4c:75:0a" or pe.signatures [ i ] . serial == "11:5c:f1:35:3a:0e:33:e1:90:99:a4:86:7a:4c:75:0a" ) and 1605515909 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41517,13 +41517,13 @@ rule REVERSINGLABS_Cert_Blocklist_5Cf3778Bb11115A884E192A7Cb807599 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cd643ad5-254a-5c53-a6f2-b263ff539cd3"
+		id = "df43930a-ff33-59ba-a912-691f26637be9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6538-L6556"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4242ef4a30bb09463ec5a6df9367915788a2aa782df6c463bcf966d2aad63c1d"
+		logic_hash = "v1_sha256_4242ef4a30bb09463ec5a6df9367915788a2aa782df6c463bcf966d2aad63c1d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41533,7 +41533,7 @@ rule REVERSINGLABS_Cert_Blocklist_5Cf3778Bb11115A884E192A7Cb807599 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLOMATIC d.o.o." and (pe.signatures[i].serial=="00:5c:f3:77:8b:b1:11:15:a8:84:e1:92:a7:cb:80:75:99" or pe.signatures[i].serial=="5c:f3:77:8b:b1:11:15:a8:84:e1:92:a7:cb:80:75:99") and 1605006199<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SLOMATIC d.o.o." and ( pe.signatures [ i ] . serial == "00:5c:f3:77:8b:b1:11:15:a8:84:e1:92:a7:cb:80:75:99" or pe.signatures [ i ] . serial == "5c:f3:77:8b:b1:11:15:a8:84:e1:92:a7:cb:80:75:99" ) and 1605006199 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41542,13 +41542,13 @@ rule REVERSINGLABS_Cert_Blocklist_82Cb93593B658100Cdd7A00C874287F2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "85df653a-a4a3-5d0e-86f4-cad0249cd3d3"
+		id = "1999de58-2fe1-5c7e-a126-09aa5dac4285"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6558-L6576"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c77881e0365c9fc398097d0b6e077330a5f0fcbb53279bfde96b3c01df914c55"
+		logic_hash = "v1_sha256_c77881e0365c9fc398097d0b6e077330a5f0fcbb53279bfde96b3c01df914c55"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41558,7 +41558,7 @@ rule REVERSINGLABS_Cert_Blocklist_82Cb93593B658100Cdd7A00C874287F2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sportsonline24 B.V." and (pe.signatures[i].serial=="00:82:cb:93:59:3b:65:81:00:cd:d7:a0:0c:87:42:87:f2" or pe.signatures[i].serial=="82:cb:93:59:3b:65:81:00:cd:d7:a0:0c:87:42:87:f2") and 1605117874<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sportsonline24 B.V." and ( pe.signatures [ i ] . serial == "00:82:cb:93:59:3b:65:81:00:cd:d7:a0:0c:87:42:87:f2" or pe.signatures [ i ] . serial == "82:cb:93:59:3b:65:81:00:cd:d7:a0:0c:87:42:87:f2" ) and 1605117874 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41567,13 +41567,13 @@ rule REVERSINGLABS_Cert_Blocklist_9A8Bcfd05F86B15D0C99F50Cf414Bd00 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4446aead-9505-545a-8d3a-6ad844d348d3"
+		id = "b3722fe3-978b-58ca-b339-4714f8c95eb2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6578-L6596"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "803d70dddeff51b753b577ea196b12570847c6875ae676a2d12cf1ca9323be34"
+		logic_hash = "v1_sha256_803d70dddeff51b753b577ea196b12570847c6875ae676a2d12cf1ca9323be34"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41583,7 +41583,7 @@ rule REVERSINGLABS_Cert_Blocklist_9A8Bcfd05F86B15D0C99F50Cf414Bd00 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AI Software a.s." and (pe.signatures[i].serial=="00:9a:8b:cf:d0:5f:86:b1:5d:0c:99:f5:0c:f4:14:bd:00" or pe.signatures[i].serial=="9a:8b:cf:d0:5f:86:b1:5d:0c:99:f5:0c:f4:14:bd:00") and 1592442000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AI Software a.s." and ( pe.signatures [ i ] . serial == "00:9a:8b:cf:d0:5f:86:b1:5d:0c:99:f5:0c:f4:14:bd:00" or pe.signatures [ i ] . serial == "9a:8b:cf:d0:5f:86:b1:5d:0c:99:f5:0c:f4:14:bd:00" ) and 1592442000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41592,13 +41592,13 @@ rule REVERSINGLABS_Cert_Blocklist_95E5793F2Abe0B4Ec9Be54Fd24F76Ae5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6b992971-6a1f-53e3-8651-f25a6b761c41"
+		id = "9359d701-b0c2-5595-ab91-76e0b5611619"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6598-L6616"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bd198665ae952e11c91adc329908e3cd55a55365875200cd81d2f71fd092f1fe"
+		logic_hash = "v1_sha256_bd198665ae952e11c91adc329908e3cd55a55365875200cd81d2f71fd092f1fe"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41608,7 +41608,7 @@ rule REVERSINGLABS_Cert_Blocklist_95E5793F2Abe0B4Ec9Be54Fd24F76Ae5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kommservice LLC" and (pe.signatures[i].serial=="00:95:e5:79:3f:2a:be:0b:4e:c9:be:54:fd:24:f7:6a:e5" or pe.signatures[i].serial=="95:e5:79:3f:2a:be:0b:4e:c9:be:54:fd:24:f7:6a:e5") and 1604933746<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kommservice LLC" and ( pe.signatures [ i ] . serial == "00:95:e5:79:3f:2a:be:0b:4e:c9:be:54:fd:24:f7:6a:e5" or pe.signatures [ i ] . serial == "95:e5:79:3f:2a:be:0b:4e:c9:be:54:fd:24:f7:6a:e5" ) and 1604933746 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41617,13 +41617,13 @@ rule REVERSINGLABS_Cert_Blocklist_133565779808C3B79D8E3F70A9C3Ffac : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bc3f54a6-723d-5de5-9a59-2be8a005cedc"
+		id = "d46ef07a-26fd-563c-8fb8-b8e0af962358"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6618-L6634"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b9fb2e3cc150b0278e67c673f7c01174c30b2cc4458c9c5e573661071795b793"
+		logic_hash = "v1_sha256_b9fb2e3cc150b0278e67c673f7c01174c30b2cc4458c9c5e573661071795b793"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41633,7 +41633,7 @@ rule REVERSINGLABS_Cert_Blocklist_133565779808C3B79D8E3F70A9C3Ffac : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Istok" and pe.signatures[i].serial=="13:35:65:77:98:08:c3:b7:9d:8e:3f:70:a9:c3:ff:ac" and 1605019819<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Istok" and pe.signatures [ i ] . serial == "13:35:65:77:98:08:c3:b7:9d:8e:3f:70:a9:c3:ff:ac" and 1605019819 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41642,13 +41642,13 @@ rule REVERSINGLABS_Cert_Blocklist_7E0Ccda0Ef37Acef6C2Ebe4538627E5C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4668ceb3-8bf2-5be4-9a1a-d0d902c35cf0"
+		id = "332c96a9-61e2-5659-9800-279181ac7d29"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6636-L6654"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f13f9b70a2a3187522e4fff45a8a425863ad6242f82592aa9319c8d5fddeeefa"
+		logic_hash = "v1_sha256_f13f9b70a2a3187522e4fff45a8a425863ad6242f82592aa9319c8d5fddeeefa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41658,7 +41658,7 @@ rule REVERSINGLABS_Cert_Blocklist_7E0Ccda0Ef37Acef6C2Ebe4538627E5C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Orangetree B.V." and (pe.signatures[i].serial=="00:7e:0c:cd:a0:ef:37:ac:ef:6c:2e:be:45:38:62:7e:5c" or pe.signatures[i].serial=="7e:0c:cd:a0:ef:37:ac:ef:6c:2e:be:45:38:62:7e:5c") and 1606159604<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Orangetree B.V." and ( pe.signatures [ i ] . serial == "00:7e:0c:cd:a0:ef:37:ac:ef:6c:2e:be:45:38:62:7e:5c" or pe.signatures [ i ] . serial == "7e:0c:cd:a0:ef:37:ac:ef:6c:2e:be:45:38:62:7e:5c" ) and 1606159604 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41667,13 +41667,13 @@ rule REVERSINGLABS_Cert_Blocklist_Bad35Fd70025D46C56B89E32B1A3954C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "871e399f-8498-5d66-ab5e-24e48491124f"
+		id = "2b24603c-89a1-551f-b2b8-d739d3479fc1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6656-L6674"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1020250fc5030e50bc1e7d0f0c5a77e462a53f47bfcc4383c682b34fed567492"
+		logic_hash = "v1_sha256_1020250fc5030e50bc1e7d0f0c5a77e462a53f47bfcc4383c682b34fed567492"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41683,7 +41683,7 @@ rule REVERSINGLABS_Cert_Blocklist_Bad35Fd70025D46C56B89E32B1A3954C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fort LLC" and (pe.signatures[i].serial=="00:ba:d3:5f:d7:00:25:d4:6c:56:b8:9e:32:b1:a3:95:4c" or pe.signatures[i].serial=="ba:d3:5f:d7:00:25:d4:6c:56:b8:9e:32:b1:a3:95:4c") and 1604937337<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fort LLC" and ( pe.signatures [ i ] . serial == "00:ba:d3:5f:d7:00:25:d4:6c:56:b8:9e:32:b1:a3:95:4c" or pe.signatures [ i ] . serial == "ba:d3:5f:d7:00:25:d4:6c:56:b8:9e:32:b1:a3:95:4c" ) and 1604937337 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41692,13 +41692,13 @@ rule REVERSINGLABS_Cert_Blocklist_7B91468122273Aa32B7Cfc80C331Ea13 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2a949015-3b7b-5123-8df1-f2199ef636c9"
+		id = "7e57e4f4-8fe8-5504-8603-e2937c7407f5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6676-L6692"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "49d6fd8b325df4bc688275a09cee35e1040172eb6f3680aa2b6f0f3640c0782e"
+		logic_hash = "v1_sha256_49d6fd8b325df4bc688275a09cee35e1040172eb6f3680aa2b6f0f3640c0782e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41708,7 +41708,7 @@ rule REVERSINGLABS_Cert_Blocklist_7B91468122273Aa32B7Cfc80C331Ea13 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO KBI" and pe.signatures[i].serial=="7b:91:46:81:22:27:3a:a3:2b:7c:fc:80:c3:31:ea:13" and 1586942863<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO KBI" and pe.signatures [ i ] . serial == "7b:91:46:81:22:27:3a:a3:2b:7c:fc:80:c3:31:ea:13" and 1586942863 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41717,13 +41717,13 @@ rule REVERSINGLABS_Cert_Blocklist_3E267B5D14Cdf1F645C1Ec545Cec3Aee : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "adff6ae2-076c-5c97-9fea-f95d770a3821"
+		id = "e3f62fc2-6097-5583-9812-e8f6b2199685"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6694-L6710"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e36ae57d715a71aa7d26dd003d647dfa7ab16d64e5411b6c49831544fc482645"
+		logic_hash = "v1_sha256_e36ae57d715a71aa7d26dd003d647dfa7ab16d64e5411b6c49831544fc482645"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41733,7 +41733,7 @@ rule REVERSINGLABS_Cert_Blocklist_3E267B5D14Cdf1F645C1Ec545Cec3Aee : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO KBI" and pe.signatures[i].serial=="3e:26:7b:5d:14:cd:f1:f6:45:c1:ec:54:5c:ec:3a:ee" and 1579825892<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO KBI" and pe.signatures [ i ] . serial == "3e:26:7b:5d:14:cd:f1:f6:45:c1:ec:54:5c:ec:3a:ee" and 1579825892 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41742,13 +41742,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ae6D3C0269Ef6497E14379C51A8507Ba : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5b8e7730-cb8b-5c51-9784-d944453bc898"
+		id = "da66796a-51d0-50d8-bcb3-a9933004ea3c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6712-L6730"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "23570962c80bddce28a3dee9d4d864cf3cf64018eec6fbcbdd3ca2658c9f660f"
+		logic_hash = "v1_sha256_23570962c80bddce28a3dee9d4d864cf3cf64018eec6fbcbdd3ca2658c9f660f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41758,7 +41758,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ae6D3C0269Ef6497E14379C51A8507Ba : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VELES PROPERTIES LIMITED" and (pe.signatures[i].serial=="00:ae:6d:3c:02:69:ef:64:97:e1:43:79:c5:1a:85:07:ba" or pe.signatures[i].serial=="ae:6d:3c:02:69:ef:64:97:e1:43:79:c5:1a:85:07:ba") and 1578566034<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VELES PROPERTIES LIMITED" and ( pe.signatures [ i ] . serial == "00:ae:6d:3c:02:69:ef:64:97:e1:43:79:c5:1a:85:07:ba" or pe.signatures [ i ] . serial == "ae:6d:3c:02:69:ef:64:97:e1:43:79:c5:1a:85:07:ba" ) and 1578566034 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41767,13 +41767,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fd8C468Cc1B45C9Cfb41Cbd8C835Cc9E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f0050a52-65d5-54b2-b06d-08812af98948"
+		id = "caf6d703-96b7-5a2f-ae8e-f2383b25d893"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6732-L6750"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "230d33f0d1d31d4cb76bf3b13f109d3cc9ace846daef145e1dc7666b33c8a42a"
+		logic_hash = "v1_sha256_230d33f0d1d31d4cb76bf3b13f109d3cc9ace846daef145e1dc7666b33c8a42a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41783,7 +41783,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fd8C468Cc1B45C9Cfb41Cbd8C835Cc9E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pivo ZLoun s.r.o." and (pe.signatures[i].serial=="00:fd:8c:46:8c:c1:b4:5c:9c:fb:41:cb:d8:c8:35:cc:9e" or pe.signatures[i].serial=="fd:8c:46:8c:c1:b4:5c:9c:fb:41:cb:d8:c8:35:cc:9e") and 1604019600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Pivo ZLoun s.r.o." and ( pe.signatures [ i ] . serial == "00:fd:8c:46:8c:c1:b4:5c:9c:fb:41:cb:d8:c8:35:cc:9e" or pe.signatures [ i ] . serial == "fd:8c:46:8c:c1:b4:5c:9c:fb:41:cb:d8:c8:35:cc:9e" ) and 1604019600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41792,13 +41792,13 @@ rule REVERSINGLABS_Cert_Blocklist_7C061Baa3118327255161F6A7Fa4E21D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f597956a-d11b-54e4-91b6-0572c0b10279"
+		id = "5d276cfb-42b6-5b29-b34c-8f1069e1ba40"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6752-L6770"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4193fce69af03b3521a3cc442b762c52f8585b44fa6b0bd78b9ace171b807ed4"
+		logic_hash = "v1_sha256_4193fce69af03b3521a3cc442b762c52f8585b44fa6b0bd78b9ace171b807ed4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41808,7 +41808,7 @@ rule REVERSINGLABS_Cert_Blocklist_7C061Baa3118327255161F6A7Fa4E21D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "YUTAKS, OOO" and (pe.signatures[i].serial=="00:7c:06:1b:aa:31:18:32:72:55:16:1f:6a:7f:a4:e2:1d" or pe.signatures[i].serial=="7c:06:1b:aa:31:18:32:72:55:16:1f:6a:7f:a4:e2:1d") and 1599611338<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "YUTAKS, OOO" and ( pe.signatures [ i ] . serial == "00:7c:06:1b:aa:31:18:32:72:55:16:1f:6a:7f:a4:e2:1d" or pe.signatures [ i ] . serial == "7c:06:1b:aa:31:18:32:72:55:16:1f:6a:7f:a4:e2:1d" ) and 1599611338 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41817,13 +41817,13 @@ rule REVERSINGLABS_Cert_Blocklist_04332C16724Ffeda5868D22Af56Aea43 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1e5a2708-2875-50ab-af6b-3be91f38e13f"
+		id = "ec2f13ef-a438-5190-9bd8-b194f42a9107"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6772-L6788"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6b62d5c7a3c6e3096797cd2f515d86045fa77682638bda44175d05c5b6c5bbc0"
+		logic_hash = "v1_sha256_6b62d5c7a3c6e3096797cd2f515d86045fa77682638bda44175d05c5b6c5bbc0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41833,7 +41833,7 @@ rule REVERSINGLABS_Cert_Blocklist_04332C16724Ffeda5868D22Af56Aea43 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bespoke Software Solutions Limited" and pe.signatures[i].serial=="04:33:2c:16:72:4f:fe:da:58:68:d2:2a:f5:6a:ea:43" and 1597971601<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bespoke Software Solutions Limited" and pe.signatures [ i ] . serial == "04:33:2c:16:72:4f:fe:da:58:68:d2:2a:f5:6a:ea:43" and 1597971601 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41842,13 +41842,13 @@ rule REVERSINGLABS_Cert_Blocklist_030012F134E64347669F3256C7D050C5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1e61a781-d5fb-5f05-81c4-3cc697ece13c"
+		id = "6d973548-cab8-5c36-b2a0-5323663a2826"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6790-L6806"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1a55856bfa4c632b2b0404686dc7ba5e7238b619dd4d2eb68c3d291bc86e52c4"
+		logic_hash = "v1_sha256_1a55856bfa4c632b2b0404686dc7ba5e7238b619dd4d2eb68c3d291bc86e52c4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41858,7 +41858,7 @@ rule REVERSINGLABS_Cert_Blocklist_030012F134E64347669F3256C7D050C5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Futumarket LLC" and pe.signatures[i].serial=="03:00:12:f1:34:e6:43:47:66:9f:32:56:c7:d0:50:c5" and 1604036657<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Futumarket LLC" and pe.signatures [ i ] . serial == "03:00:12:f1:34:e6:43:47:66:9f:32:56:c7:d0:50:c5" and 1604036657 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41867,13 +41867,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fa3Dcac19B884B44Ef4F81541184D6B0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "574ee0d4-ba7c-5c74-b711-222f92196f4a"
+		id = "b5efea26-c8b2-5273-b9c2-59451c9153e9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6808-L6826"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "324de84cb8c2f5402c9326749e3456e11312828df2523954fd84f7fb3298fdf3"
+		logic_hash = "v1_sha256_324de84cb8c2f5402c9326749e3456e11312828df2523954fd84f7fb3298fdf3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41883,7 +41883,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fa3Dcac19B884B44Ef4F81541184D6B0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unicom Ltd" and (pe.signatures[i].serial=="00:fa:3d:ca:c1:9b:88:4b:44:ef:4f:81:54:11:84:d6:b0" or pe.signatures[i].serial=="fa:3d:ca:c1:9b:88:4b:44:ef:4f:81:54:11:84:d6:b0") and 1603958571<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Unicom Ltd" and ( pe.signatures [ i ] . serial == "00:fa:3d:ca:c1:9b:88:4b:44:ef:4f:81:54:11:84:d6:b0" or pe.signatures [ i ] . serial == "fa:3d:ca:c1:9b:88:4b:44:ef:4f:81:54:11:84:d6:b0" ) and 1603958571 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41892,13 +41892,13 @@ rule REVERSINGLABS_Cert_Blocklist_0E6F4Cb8B06E01C3Bd296Ace3A95F814 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7a829a63-eeb4-50ef-829d-fc13572c1148"
+		id = "df6abd9b-ca8b-54bc-8749-5979618dd991"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6828-L6844"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f3184a9d1fe2a1cf2dcc04d26c284aa9a651d2f00aa28642d7f951550a050138"
+		logic_hash = "v1_sha256_f3184a9d1fe2a1cf2dcc04d26c284aa9a651d2f00aa28642d7f951550a050138"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41908,7 +41908,7 @@ rule REVERSINGLABS_Cert_Blocklist_0E6F4Cb8B06E01C3Bd296Ace3A95F814 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EVATON, s.r.o." and pe.signatures[i].serial=="0e:6f:4c:b8:b0:6e:01:c3:bd:29:6a:ce:3a:95:f8:14" and 1603957781<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EVATON, s.r.o." and pe.signatures [ i ] . serial == "0e:6f:4c:b8:b0:6e:01:c3:bd:29:6a:ce:3a:95:f8:14" and 1603957781 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41917,13 +41917,13 @@ rule REVERSINGLABS_Cert_Blocklist_085B70224253486624Fc36Fa658A1E32 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7d27604e-4ecd-559c-9180-4914e7f1f6c9"
+		id = "0a6afccd-bfaa-554b-9eaa-78da192fb6ee"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6846-L6862"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "50ff48a421a109f8c6bf92032691d9b673945bc591005004ff17dc18c97d4aea"
+		logic_hash = "v1_sha256_50ff48a421a109f8c6bf92032691d9b673945bc591005004ff17dc18c97d4aea"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41933,7 +41933,7 @@ rule REVERSINGLABS_Cert_Blocklist_085B70224253486624Fc36Fa658A1E32 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Best Fud, OOO" and pe.signatures[i].serial=="08:5b:70:22:42:53:48:66:24:fc:36:fa:65:8a:1e:32" and 1597971601<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Best Fud, OOO" and pe.signatures [ i ] . serial == "08:5b:70:22:42:53:48:66:24:fc:36:fa:65:8a:1e:32" and 1597971601 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41942,13 +41942,13 @@ rule REVERSINGLABS_Cert_Blocklist_51Cd5393514F7Ace2B407C3Dbfb09D8D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ac86893f-2edd-5f1c-96eb-4cb140e8e001"
+		id = "0c0f003d-cd67-5de7-961b-a9be194cf9a1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6864-L6880"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4cd08b9113a7c1f4f2d438ac59ad0be503daded3a08b8c8e8ce3e0dfdddf259e"
+		logic_hash = "v1_sha256_4cd08b9113a7c1f4f2d438ac59ad0be503daded3a08b8c8e8ce3e0dfdddf259e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41958,7 +41958,7 @@ rule REVERSINGLABS_Cert_Blocklist_51Cd5393514F7Ace2B407C3Dbfb09D8D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APPI CZ a.s" and pe.signatures[i].serial=="51:cd:53:93:51:4f:7a:ce:2b:40:7c:3d:bf:b0:9d:8d" and 1605299467<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APPI CZ a.s" and pe.signatures [ i ] . serial == "51:cd:53:93:51:4f:7a:ce:2b:40:7c:3d:bf:b0:9d:8d" and 1605299467 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41967,13 +41967,13 @@ rule REVERSINGLABS_Cert_Blocklist_B72179C027B9037Ee220E81Ab18Fe56D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "85639e74-80b0-59c6-b31b-5b3d9587b37a"
+		id = "2af1644b-568a-5107-97e7-c3c3d025766a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6882-L6900"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1416768011ff824307d112bdeecce1ad50d1f673e92bef8fddbbeb58ff98b1b1"
+		logic_hash = "v1_sha256_1416768011ff824307d112bdeecce1ad50d1f673e92bef8fddbbeb58ff98b1b1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -41983,7 +41983,7 @@ rule REVERSINGLABS_Cert_Blocklist_B72179C027B9037Ee220E81Ab18Fe56D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Planeta, TOV" and (pe.signatures[i].serial=="00:b7:21:79:c0:27:b9:03:7e:e2:20:e8:1a:b1:8f:e5:6d" or pe.signatures[i].serial=="b7:21:79:c0:27:b9:03:7e:e2:20:e8:1a:b1:8f:e5:6d") and 1603381300<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Planeta, TOV" and ( pe.signatures [ i ] . serial == "00:b7:21:79:c0:27:b9:03:7e:e2:20:e8:1a:b1:8f:e5:6d" or pe.signatures [ i ] . serial == "b7:21:79:c0:27:b9:03:7e:e2:20:e8:1a:b1:8f:e5:6d" ) and 1603381300 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -41992,13 +41992,13 @@ rule REVERSINGLABS_Cert_Blocklist_07B74C70C4Aa092648B7F0D1A8A3A28F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f941b7d6-f168-57aa-881a-54679a2b948c"
+		id = "2601f8bb-e6bf-5671-93c5-231e84031109"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6902-L6918"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "97759fa2e519936115f0493e251f9abc0cce3ada437776a5a370388512235491"
+		logic_hash = "v1_sha256_97759fa2e519936115f0493e251f9abc0cce3ada437776a5a370388512235491"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42008,7 +42008,7 @@ rule REVERSINGLABS_Cert_Blocklist_07B74C70C4Aa092648B7F0D1A8A3A28F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rad-Grad D.O.O." and pe.signatures[i].serial=="07:b7:4c:70:c4:aa:09:26:48:b7:f0:d1:a8:a3:a2:8f" and 1603240965<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rad-Grad D.O.O." and pe.signatures [ i ] . serial == "07:b7:4c:70:c4:aa:09:26:48:b7:f0:d1:a8:a3:a2:8f" and 1603240965 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42017,13 +42017,13 @@ rule REVERSINGLABS_Cert_Blocklist_4C8Def294478B7D59Ee95C61Fae3D965 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "549249df-690c-5b75-ac1a-77b509c9e163"
+		id = "8efb6f0e-2465-5ec6-b76e-6ce2d8e17477"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6920-L6936"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3b7b10afa5f0212bd494ba8fe32bef18f2bbd77c8ab2ad498b9557a0575cc177"
+		logic_hash = "v1_sha256_3b7b10afa5f0212bd494ba8fe32bef18f2bbd77c8ab2ad498b9557a0575cc177"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42033,7 +42033,7 @@ rule REVERSINGLABS_Cert_Blocklist_4C8Def294478B7D59Ee95C61Fae3D965 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DREAM SECURITY USA INC" and pe.signatures[i].serial=="4c:8d:ef:29:44:78:b7:d5:9e:e9:5c:61:fa:e3:d9:65" and 1592961292<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DREAM SECURITY USA INC" and pe.signatures [ i ] . serial == "4c:8d:ef:29:44:78:b7:d5:9e:e9:5c:61:fa:e3:d9:65" and 1592961292 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42042,13 +42042,13 @@ rule REVERSINGLABS_Cert_Blocklist_7D36Cbb64Bc9Add17Ba71737D3Ecceca : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ce10840c-150d-5ecd-ab9a-7bc96092ebfd"
+		id = "8f00c4b7-856d-562f-9729-75006a919a18"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6938-L6954"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5874860582ed5be6908dca38e6ecae831eeeb0c2b768e8065ada9fd5ac2bda89"
+		logic_hash = "v1_sha256_5874860582ed5be6908dca38e6ecae831eeeb0c2b768e8065ada9fd5ac2bda89"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42058,7 +42058,7 @@ rule REVERSINGLABS_Cert_Blocklist_7D36Cbb64Bc9Add17Ba71737D3Ecceca : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LTD SERVICES LIMITED" and pe.signatures[i].serial=="7d:36:cb:b6:4b:c9:ad:d1:7b:a7:17:37:d3:ec:ce:ca" and 1616025600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LTD SERVICES LIMITED" and pe.signatures [ i ] . serial == "7d:36:cb:b6:4b:c9:ad:d1:7b:a7:17:37:d3:ec:ce:ca" and 1616025600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42067,13 +42067,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ad255D4Ebefa751F3782587396C08629 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e42d2881-efda-5aa0-b455-dabbd3a77e97"
+		id = "e5d743e6-c7a3-5c5b-a6cf-33bf6f0ce105"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6956-L6974"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "43f44cbedf37094416628c9df23767be3b036519f93222812597777a146ecb24"
+		logic_hash = "v1_sha256_43f44cbedf37094416628c9df23767be3b036519f93222812597777a146ecb24"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42083,7 +42083,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ad255D4Ebefa751F3782587396C08629 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Ornitek" and (pe.signatures[i].serial=="00:ad:25:5d:4e:be:fa:75:1f:37:82:58:73:96:c0:86:29" or pe.signatures[i].serial=="ad:25:5d:4e:be:fa:75:1f:37:82:58:73:96:c0:86:29") and 1614643200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Ornitek" and ( pe.signatures [ i ] . serial == "00:ad:25:5d:4e:be:fa:75:1f:37:82:58:73:96:c0:86:29" or pe.signatures [ i ] . serial == "ad:25:5d:4e:be:fa:75:1f:37:82:58:73:96:c0:86:29" ) and 1614643200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42092,13 +42092,13 @@ rule REVERSINGLABS_Cert_Blocklist_262Ca7Ae19D688138E75932832B18F9D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7151fd62-7f6c-59d7-800b-65e5b4db279b"
+		id = "6de10413-2adc-5eb8-a5fe-acb05a26e25b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6976-L6992"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a5bb946c6199cd47a087ac26f0a996261318d1830191ea7c0e7797ff03984558"
+		logic_hash = "v1_sha256_a5bb946c6199cd47a087ac26f0a996261318d1830191ea7c0e7797ff03984558"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42108,7 +42108,7 @@ rule REVERSINGLABS_Cert_Blocklist_262Ca7Ae19D688138E75932832B18F9D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bisoyetutu Ltd Ltd" and pe.signatures[i].serial=="26:2c:a7:ae:19:d6:88:13:8e:75:93:28:32:b1:8f:9d" and 1616025600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bisoyetutu Ltd Ltd" and pe.signatures [ i ] . serial == "26:2c:a7:ae:19:d6:88:13:8e:75:93:28:32:b1:8f:9d" and 1616025600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42117,13 +42117,13 @@ rule REVERSINGLABS_Cert_Blocklist_59A57E8Ba3Dcf2B6F59981Fda14B03 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "12c80895-57fd-5341-b3ef-d59c25d4c234"
+		id = "0fc1fb74-a611-507a-a17a-c01e7c84fd83"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L6994-L7010"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6e77c7d0bd7e5e9bc8880cc6ffc3f5f4f738e3dde22c270ad7a6f6672a99de53"
+		logic_hash = "v1_sha256_6e77c7d0bd7e5e9bc8880cc6ffc3f5f4f738e3dde22c270ad7a6f6672a99de53"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42133,7 +42133,7 @@ rule REVERSINGLABS_Cert_Blocklist_59A57E8Ba3Dcf2B6F59981Fda14B03 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Medium LLC" and pe.signatures[i].serial=="59:a5:7e:8b:a3:dc:f2:b6:f5:99:81:fd:a1:4b:03" and 1609113600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Medium LLC" and pe.signatures [ i ] . serial == "59:a5:7e:8b:a3:dc:f2:b6:f5:99:81:fd:a1:4b:03" and 1609113600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42142,13 +42142,13 @@ rule REVERSINGLABS_Cert_Blocklist_Aebe117A13B8Bca21685Df48C74F584D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ec525737-9770-585e-922a-43f14e0a4a37"
+		id = "23642318-b818-541d-ac1c-14ec4f2cbaf5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7012-L7030"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e7fbc1f32adec39c94dc046933e152cd6d3946da4a168306484b7b6bc7f26fb6"
+		logic_hash = "v1_sha256_e7fbc1f32adec39c94dc046933e152cd6d3946da4a168306484b7b6bc7f26fb6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42158,7 +42158,7 @@ rule REVERSINGLABS_Cert_Blocklist_Aebe117A13B8Bca21685Df48C74F584D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NANAX d.o.o." and (pe.signatures[i].serial=="00:ae:be:11:7a:13:b8:bc:a2:16:85:df:48:c7:4f:58:4d" or pe.signatures[i].serial=="ae:be:11:7a:13:b8:bc:a2:16:85:df:48:c7:4f:58:4d") and 1613520000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NANAX d.o.o." and ( pe.signatures [ i ] . serial == "00:ae:be:11:7a:13:b8:bc:a2:16:85:df:48:c7:4f:58:4d" or pe.signatures [ i ] . serial == "ae:be:11:7a:13:b8:bc:a2:16:85:df:48:c7:4f:58:4d" ) and 1613520000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42167,13 +42167,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Dcd19A94535F034Ee36Af4676740633 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c09778b6-17c9-5b24-8977-1bd998083c23"
+		id = "071c2510-f192-5641-996e-ad37b46b1e05"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7032-L7048"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7079d4f1973ad4de21e1f88282c94b11c4d63f8bad12b35ef76a481e154d9da3"
+		logic_hash = "v1_sha256_7079d4f1973ad4de21e1f88282c94b11c4d63f8bad12b35ef76a481e154d9da3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42183,7 +42183,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Dcd19A94535F034Ee36Af4676740633 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Toko Saya ApS" and pe.signatures[i].serial=="7d:cd:19:a9:45:35:f0:34:ee:36:af:46:76:74:06:33" and 1609200000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Toko Saya ApS" and pe.signatures [ i ] . serial == "7d:cd:19:a9:45:35:f0:34:ee:36:af:46:76:74:06:33" and 1609200000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42192,13 +42192,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ca4822E6905Aa4Fca9E28523F04F14A3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "004454a0-20f9-58f5-8c24-8097f7586c5b"
+		id = "ec232099-a3ae-51e0-8f89-05b89abfc76f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7050-L7068"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9633f3494e9ece3a698d47c5ba2b7ee7f82cee4be36ac418c969c36285c4963c"
+		logic_hash = "v1_sha256_9633f3494e9ece3a698d47c5ba2b7ee7f82cee4be36ac418c969c36285c4963c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42208,7 +42208,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ca4822E6905Aa4Fca9E28523F04F14A3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ELISTREID, OOO" and (pe.signatures[i].serial=="00:ca:48:22:e6:90:5a:a4:fc:a9:e2:85:23:f0:4f:14:a3" or pe.signatures[i].serial=="ca:48:22:e6:90:5a:a4:fc:a9:e2:85:23:f0:4f:14:a3") and 1614643200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ELISTREID, OOO" and ( pe.signatures [ i ] . serial == "00:ca:48:22:e6:90:5a:a4:fc:a9:e2:85:23:f0:4f:14:a3" or pe.signatures [ i ] . serial == "ca:48:22:e6:90:5a:a4:fc:a9:e2:85:23:f0:4f:14:a3" ) and 1614643200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42217,13 +42217,13 @@ rule REVERSINGLABS_Cert_Blocklist_24C1Ef800F275Ab2780280C595De3464 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "251212a5-95ce-5d9f-aec0-e6d3dd099349"
+		id = "a2cdb857-e4ea-516f-b7a3-68d910b6eff5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7070-L7086"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7536ec92f388234bea3b33bee4af52e0e0ce9cd86b1c8321a503f70bfe5faa76"
+		logic_hash = "v1_sha256_7536ec92f388234bea3b33bee4af52e0e0ce9cd86b1c8321a503f70bfe5faa76"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42233,7 +42233,7 @@ rule REVERSINGLABS_Cert_Blocklist_24C1Ef800F275Ab2780280C595De3464 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HOLGAN LIMITED" and pe.signatures[i].serial=="24:c1:ef:80:0f:27:5a:b2:78:02:80:c5:95:de:34:64" and 1614729600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HOLGAN LIMITED" and pe.signatures [ i ] . serial == "24:c1:ef:80:0f:27:5a:b2:78:02:80:c5:95:de:34:64" and 1614729600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42242,13 +42242,13 @@ rule REVERSINGLABS_Cert_Blocklist_6401831B46588B9D872B02076C3A7B00 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "61b67e68-9e15-5848-b12a-437a0ad8399e"
+		id = "4cc51dd8-afb9-562e-8fd2-4bc3ecf5eae6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7088-L7104"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cb84b27391fa0260061bc5444039967e83f2134f7b56f9cccf6a421d4a65a577"
+		logic_hash = "v1_sha256_cb84b27391fa0260061bc5444039967e83f2134f7b56f9cccf6a421d4a65a577"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42258,7 +42258,7 @@ rule REVERSINGLABS_Cert_Blocklist_6401831B46588B9D872B02076C3A7B00 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTIV GROUP ApS" and pe.signatures[i].serial=="64:01:83:1b:46:58:8b:9d:87:2b:02:07:6c:3a:7b:00" and 1615507200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ACTIV GROUP ApS" and pe.signatures [ i ] . serial == "64:01:83:1b:46:58:8b:9d:87:2b:02:07:6c:3a:7b:00" and 1615507200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42267,13 +42267,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A01A91Cce63Ede5Eaa3Dac4883Aea05 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a1efbce8-3cca-5e07-a652-d67007c72a18"
+		id = "119ceb6b-e993-5996-a81b-9ef445880bd8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7106-L7122"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "58a26b44e485814fa645bfa490f3442745884026bb7a70327d4f51645ad3f69c"
+		logic_hash = "v1_sha256_58a26b44e485814fa645bfa490f3442745884026bb7a70327d4f51645ad3f69c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42283,7 +42283,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A01A91Cce63Ede5Eaa3Dac4883Aea05 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Seacloud Technologies Pte. Ltd." and pe.signatures[i].serial=="0a:01:a9:1c:ce:63:ed:e5:ea:a3:da:c4:88:3a:ea:05" and 1618876800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Seacloud Technologies Pte. Ltd." and pe.signatures [ i ] . serial == "0a:01:a9:1c:ce:63:ed:e5:ea:a3:da:c4:88:3a:ea:05" and 1618876800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42292,13 +42292,13 @@ rule REVERSINGLABS_Cert_Blocklist_54Cd7Ae1C27F1421136Ed25088F4979A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "76999ae0-966e-5c52-8e00-a3af8afd8fae"
+		id = "d59e680a-c103-50b1-aae6-29fd19b36d29"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7124-L7140"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c7cd84a225216ff1464a147c2572de2b0a2f69f7a315cdebef5ad2bab843b72a"
+		logic_hash = "v1_sha256_c7cd84a225216ff1464a147c2572de2b0a2f69f7a315cdebef5ad2bab843b72a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42308,7 +42308,7 @@ rule REVERSINGLABS_Cert_Blocklist_54Cd7Ae1C27F1421136Ed25088F4979A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABBYMAJUTA LTD LIMITED" and pe.signatures[i].serial=="54:cd:7a:e1:c2:7f:14:21:13:6e:d2:50:88:f4:97:9a" and 1616371200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ABBYMAJUTA LTD LIMITED" and pe.signatures [ i ] . serial == "54:cd:7a:e1:c2:7f:14:21:13:6e:d2:50:88:f4:97:9a" and 1616371200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42317,13 +42317,13 @@ rule REVERSINGLABS_Cert_Blocklist_F2D693Aad63E6920782A0027Dfc97D91 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c4876bdd-35bc-5a3f-9f55-9a730e7ff5c8"
+		id = "f23c393d-66df-5995-beef-2c35b0e005d4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7142-L7160"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8f29e65b39608518d16f708faef68db37b6e179c567819dccb6681adcec262e3"
+		logic_hash = "v1_sha256_8f29e65b39608518d16f708faef68db37b6e179c567819dccb6681adcec262e3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42333,7 +42333,7 @@ rule REVERSINGLABS_Cert_Blocklist_F2D693Aad63E6920782A0027Dfc97D91 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EKO-KHIM TOV" and (pe.signatures[i].serial=="00:f2:d6:93:aa:d6:3e:69:20:78:2a:00:27:df:c9:7d:91" or pe.signatures[i].serial=="f2:d6:93:aa:d6:3e:69:20:78:2a:00:27:df:c9:7d:91") and 1598989763<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EKO-KHIM TOV" and ( pe.signatures [ i ] . serial == "00:f2:d6:93:aa:d6:3e:69:20:78:2a:00:27:df:c9:7d:91" or pe.signatures [ i ] . serial == "f2:d6:93:aa:d6:3e:69:20:78:2a:00:27:df:c9:7d:91" ) and 1598989763 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42342,13 +42342,13 @@ rule REVERSINGLABS_Cert_Blocklist_F8E8F6C92Ba666B0688A8Cacce9Acccf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "909d0ce9-406c-539f-9d0e-d7ab1b277ee3"
+		id = "d67c6d53-18b2-5bd5-827e-5c01e4bf551b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7162-L7180"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "aa419bc044be55d4c94481998be4e9c0310416740084eb8376842cf5416d78bf"
+		logic_hash = "v1_sha256_aa419bc044be55d4c94481998be4e9c0310416740084eb8376842cf5416d78bf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42358,7 +42358,7 @@ rule REVERSINGLABS_Cert_Blocklist_F8E8F6C92Ba666B0688A8Cacce9Acccf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "5 th Dimension LTD Oy" and (pe.signatures[i].serial=="00:f8:e8:f6:c9:2b:a6:66:b0:68:8a:8c:ac:ce:9a:cc:cf" or pe.signatures[i].serial=="f8:e8:f6:c9:2b:a6:66:b0:68:8a:8c:ac:ce:9a:cc:cf") and 1618531200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "5 th Dimension LTD Oy" and ( pe.signatures [ i ] . serial == "00:f8:e8:f6:c9:2b:a6:66:b0:68:8a:8c:ac:ce:9a:cc:cf" or pe.signatures [ i ] . serial == "f8:e8:f6:c9:2b:a6:66:b0:68:8a:8c:ac:ce:9a:cc:cf" ) and 1618531200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42367,13 +42367,13 @@ rule REVERSINGLABS_Cert_Blocklist_E3D5089D4B8F01Aadce2731062Fb0Cce : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "25df791f-1128-51f9-90da-9977262d00c7"
+		id = "0086651c-e772-502f-bff3-2ded048cd26a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7182-L7200"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7f10b86f156ccac695f480661dfea8bcc455477afd9575230c2f8510327d1996"
+		logic_hash = "v1_sha256_7f10b86f156ccac695f480661dfea8bcc455477afd9575230c2f8510327d1996"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42383,7 +42383,7 @@ rule REVERSINGLABS_Cert_Blocklist_E3D5089D4B8F01Aadce2731062Fb0Cce : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DEVELOP - Residence s. r. o." and (pe.signatures[i].serial=="00:e3:d5:08:9d:4b:8f:01:aa:dc:e2:73:10:62:fb:0c:ce" or pe.signatures[i].serial=="e3:d5:08:9d:4b:8f:01:aa:dc:e2:73:10:62:fb:0c:ce") and 1618358400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DEVELOP - Residence s. r. o." and ( pe.signatures [ i ] . serial == "00:e3:d5:08:9d:4b:8f:01:aa:dc:e2:73:10:62:fb:0c:ce" or pe.signatures [ i ] . serial == "e3:d5:08:9d:4b:8f:01:aa:dc:e2:73:10:62:fb:0c:ce" ) and 1618358400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42392,13 +42392,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Ed801843Fa001B8Add52D3A97B25931 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7c685bb7-3201-5ffc-856b-657d824595ab"
+		id = "24e20d47-6820-54f2-b87e-51cc3dee342d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7202-L7218"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b7c9424520afe16bd4769e1be84163ac37b8fb37433931f2e362d90cacc01093"
+		logic_hash = "v1_sha256_b7c9424520afe16bd4769e1be84163ac37b8fb37433931f2e362d90cacc01093"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42408,7 +42408,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Ed801843Fa001B8Add52D3A97B25931 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AM El-Teknik ApS" and pe.signatures[i].serial=="7e:d8:01:84:3f:a0:01:b8:ad:d5:2d:3a:97:b2:59:31" and 1614297600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AM El-Teknik ApS" and pe.signatures [ i ] . serial == "7e:d8:01:84:3f:a0:01:b8:ad:d5:2d:3a:97:b2:59:31" and 1614297600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42417,13 +42417,13 @@ rule REVERSINGLABS_Cert_Blocklist_D9E834182Dec62C654E775E809Ac1D1B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "30831e91-c2aa-50bc-a0e9-ee7574fc58f4"
+		id = "55d4d3b4-161f-5ba4-aff0-977e0f6d6e2d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7220-L7238"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3d8075e34fa3dc221bc2abc2630a93f32efbdde6df270a77b1d6b64d8ce56133"
+		logic_hash = "v1_sha256_3d8075e34fa3dc221bc2abc2630a93f32efbdde6df270a77b1d6b64d8ce56133"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42433,7 +42433,7 @@ rule REVERSINGLABS_Cert_Blocklist_D9E834182Dec62C654E775E809Ac1D1B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FoodLehto Oy" and (pe.signatures[i].serial=="00:d9:e8:34:18:2d:ec:62:c6:54:e7:75:e8:09:ac:1d:1b" or pe.signatures[i].serial=="d9:e8:34:18:2d:ec:62:c6:54:e7:75:e8:09:ac:1d:1b") and 1614297600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FoodLehto Oy" and ( pe.signatures [ i ] . serial == "00:d9:e8:34:18:2d:ec:62:c6:54:e7:75:e8:09:ac:1d:1b" or pe.signatures [ i ] . serial == "d9:e8:34:18:2d:ec:62:c6:54:e7:75:e8:09:ac:1d:1b" ) and 1614297600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42442,13 +42442,13 @@ rule REVERSINGLABS_Cert_Blocklist_801689896Ed339237464A41A2900A969 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0ef4ce5c-b2a1-59e8-8d39-3cf7ab9fd0e1"
+		id = "a27d8232-38e3-55d2-9f84-88e037a06339"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7240-L7258"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a371092cbf5a1a0c8051ba2b4c9dd758d829a2f0c21c86d1920164a0ae7751e6"
+		logic_hash = "v1_sha256_a371092cbf5a1a0c8051ba2b4c9dd758d829a2f0c21c86d1920164a0ae7751e6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42458,7 +42458,7 @@ rule REVERSINGLABS_Cert_Blocklist_801689896Ed339237464A41A2900A969 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GLG Rental ApS" and (pe.signatures[i].serial=="00:80:16:89:89:6e:d3:39:23:74:64:a4:1a:29:00:a9:69" or pe.signatures[i].serial=="80:16:89:89:6e:d3:39:23:74:64:a4:1a:29:00:a9:69") and 1615507200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GLG Rental ApS" and ( pe.signatures [ i ] . serial == "00:80:16:89:89:6e:d3:39:23:74:64:a4:1a:29:00:a9:69" or pe.signatures [ i ] . serial == "80:16:89:89:6e:d3:39:23:74:64:a4:1a:29:00:a9:69" ) and 1615507200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42467,13 +42467,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Fd3661533Eef209153C9Afec3Ba4D8A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e45d66b0-58ae-5054-b0a7-47a001daac7a"
+		id = "2b0380b4-af5a-5287-9538-d3692e26a194"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7260-L7276"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ce6c07b8ae54db03e4fa2739856a8d3dc2051c051a10c3c73501dad4296dde97"
+		logic_hash = "v1_sha256_ce6c07b8ae54db03e4fa2739856a8d3dc2051c051a10c3c73501dad4296dde97"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42483,7 +42483,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Fd3661533Eef209153C9Afec3Ba4D8A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SFB Regnskabsservice ApS" and pe.signatures[i].serial=="3f:d3:66:15:33:ee:f2:09:15:3c:9a:fe:c3:ba:4d:8a" and 1614816000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SFB Regnskabsservice ApS" and pe.signatures [ i ] . serial == "3f:d3:66:15:33:ee:f2:09:15:3c:9a:fe:c3:ba:4d:8a" and 1614816000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42492,13 +42492,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Ced87Bd70B092Cb93B182Fac32655F6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b9e6a35f-08c2-5f29-9bcf-07a3cddf0fbe"
+		id = "483fa837-20b3-5dbc-8c45-9861bea04d6e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7278-L7294"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4e2c967b9502d9009c61831f019ba19367b866e898ca1246a1099d75ad0eb4d5"
+		logic_hash = "v1_sha256_4e2c967b9502d9009c61831f019ba19367b866e898ca1246a1099d75ad0eb4d5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42508,7 +42508,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Ced87Bd70B092Cb93B182Fac32655F6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Creator Soft Limited" and pe.signatures[i].serial=="0c:ed:87:bd:70:b0:92:cb:93:b1:82:fa:c3:26:55:f6" and 1614816000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Creator Soft Limited" and pe.signatures [ i ] . serial == "0c:ed:87:bd:70:b0:92:cb:93:b1:82:fa:c3:26:55:f6" and 1614816000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42517,13 +42517,13 @@ rule REVERSINGLABS_Cert_Blocklist_047801D5B55C800B48411Fd8C320Ca5B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "602b8c18-3dad-55b9-bb47-3f9835a049ac"
+		id = "761cb2c1-6d64-5412-886c-7f0fe00a1edb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7296-L7312"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ef26b4e3c658f53f3048d10bd1b7a2a198cd402e1b7c60e84adadb4f236ccb5d"
+		logic_hash = "v1_sha256_ef26b4e3c658f53f3048d10bd1b7a2a198cd402e1b7c60e84adadb4f236ccb5d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42533,7 +42533,7 @@ rule REVERSINGLABS_Cert_Blocklist_047801D5B55C800B48411Fd8C320Ca5B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LICHFIELD STUDIO GLASS LIMITED" and pe.signatures[i].serial=="04:78:01:d5:b5:5c:80:0b:48:41:1f:d8:c3:20:ca:5b" and 1614297600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LICHFIELD STUDIO GLASS LIMITED" and pe.signatures [ i ] . serial == "04:78:01:d5:b5:5c:80:0b:48:41:1f:d8:c3:20:ca:5b" and 1614297600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42542,13 +42542,13 @@ rule REVERSINGLABS_Cert_Blocklist_0F0Ed5318848703405D40F7C62D0F39A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "30e3a977-caa3-5ae0-9cd0-6b2ce62ccebd"
+		id = "b4fce387-661c-54c1-b35a-b89f901bf0e1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7314-L7330"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "484932ddfe614fd5ab22361ab281cda62803c98279f938aa5237237fae6a95d6"
+		logic_hash = "v1_sha256_484932ddfe614fd5ab22361ab281cda62803c98279f938aa5237237fae6a95d6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42558,7 +42558,7 @@ rule REVERSINGLABS_Cert_Blocklist_0F0Ed5318848703405D40F7C62D0F39A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SIES UPRAVLENIE PROTSESSAMI, OOO" and pe.signatures[i].serial=="0f:0e:d5:31:88:48:70:34:05:d4:0f:7c:62:d0:f3:9a" and 1614729600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SIES UPRAVLENIE PROTSESSAMI, OOO" and pe.signatures [ i ] . serial == "0f:0e:d5:31:88:48:70:34:05:d4:0f:7c:62:d0:f3:9a" and 1614729600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42567,13 +42567,13 @@ rule REVERSINGLABS_Cert_Blocklist_4E7545C9Fc5938F5198Ab9F1749Ca31C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d5f810ee-127a-5df0-9299-ffeaddf369ee"
+		id = "46428d7a-661d-58bf-97fb-497a94bb98f2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7332-L7348"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f6be57eb6744ad6d239a0a2cc1ec8c39c9dfd4e4eeb3be9e699516c259f617f0"
+		logic_hash = "v1_sha256_f6be57eb6744ad6d239a0a2cc1ec8c39c9dfd4e4eeb3be9e699516c259f617f0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42583,7 +42583,7 @@ rule REVERSINGLABS_Cert_Blocklist_4E7545C9Fc5938F5198Ab9F1749Ca31C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "For M d.o.o." and pe.signatures[i].serial=="4e:75:45:c9:fc:59:38:f5:19:8a:b9:f1:74:9c:a3:1c" and 1614297600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "For M d.o.o." and pe.signatures [ i ] . serial == "4e:75:45:c9:fc:59:38:f5:19:8a:b9:f1:74:9c:a3:1c" and 1614297600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42592,13 +42592,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Ddd3796A427B42F2E52D7C7Af0Ca54F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5c2e1f5b-5ff7-51d7-9642-0a527856814c"
+		id = "3753b9e7-a428-52a5-81cc-5152d7b5b864"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7350-L7366"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "804ab8c44e5d97d8e14f852d61094e90d1e3ace66316781e9e79ab46fc7db8e7"
+		logic_hash = "v1_sha256_804ab8c44e5d97d8e14f852d61094e90d1e3ace66316781e9e79ab46fc7db8e7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42608,7 +42608,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Ddd3796A427B42F2E52D7C7Af0Ca54F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Fobos" and pe.signatures[i].serial=="7d:dd:37:96:a4:27:b4:2f:2e:52:d7:c7:af:0c:a5:4f" and 1612915200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Fobos" and pe.signatures [ i ] . serial == "7d:dd:37:96:a4:27:b4:2f:2e:52:d7:c7:af:0c:a5:4f" and 1612915200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42617,13 +42617,13 @@ rule REVERSINGLABS_Cert_Blocklist_03B27D7F4Ee21A462A064A17Eef70D6C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9d32947c-778f-5e2d-b0b1-4a17a108035e"
+		id = "bc251583-4a5d-5325-aa8c-94acd1be5be2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7368-L7384"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b303751e354c346f73368de94b66a960dd12efa0730d2ab14af743810669ac81"
+		logic_hash = "v1_sha256_b303751e354c346f73368de94b66a960dd12efa0730d2ab14af743810669ac81"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42633,7 +42633,7 @@ rule REVERSINGLABS_Cert_Blocklist_03B27D7F4Ee21A462A064A17Eef70D6C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CCL TRADING LIMITED" and pe.signatures[i].serial=="03:b2:7d:7f:4e:e2:1a:46:2a:06:4a:17:ee:f7:0d:6c" and 1613952000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CCL TRADING LIMITED" and pe.signatures [ i ] . serial == "03:b2:7d:7f:4e:e2:1a:46:2a:06:4a:17:ee:f7:0d:6c" and 1613952000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42642,13 +42642,13 @@ rule REVERSINGLABS_Cert_Blocklist_B0A308Fc2E71Ac4Ac40677B9C27Ccbad : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7e13e257-a264-5a40-b670-889045504acf"
+		id = "5ee289f4-eb64-5887-8d15-767bf47fd2bd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7386-L7404"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "21fd7625399c939b6d03100b731709616d206a3811197af2b86991be9d89b4eb"
+		logic_hash = "v1_sha256_21fd7625399c939b6d03100b731709616d206a3811197af2b86991be9d89b4eb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42658,7 +42658,7 @@ rule REVERSINGLABS_Cert_Blocklist_B0A308Fc2E71Ac4Ac40677B9C27Ccbad : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Volpayk LLC" and (pe.signatures[i].serial=="00:b0:a3:08:fc:2e:71:ac:4a:c4:06:77:b9:c2:7c:cb:ad" or pe.signatures[i].serial=="b0:a3:08:fc:2e:71:ac:4a:c4:06:77:b9:c2:7c:cb:ad") and 1611705600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Volpayk LLC" and ( pe.signatures [ i ] . serial == "00:b0:a3:08:fc:2e:71:ac:4a:c4:06:77:b9:c2:7c:cb:ad" or pe.signatures [ i ] . serial == "b0:a3:08:fc:2e:71:ac:4a:c4:06:77:b9:c2:7c:cb:ad" ) and 1611705600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42667,13 +42667,13 @@ rule REVERSINGLABS_Cert_Blocklist_61B11Ef9726Ab2E78132E01Bd791B336 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "573a024e-11f0-5cf9-8f0d-a946cdca34c5"
+		id = "bfbbbbae-9cf9-536b-a9ce-a91bad4b4f52"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7406-L7422"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1a8e72f31039a5a5602d0314f017a2596a23e4a796dc66167dfefc0c9790e3e3"
+		logic_hash = "v1_sha256_1a8e72f31039a5a5602d0314f017a2596a23e4a796dc66167dfefc0c9790e3e3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42683,7 +42683,7 @@ rule REVERSINGLABS_Cert_Blocklist_61B11Ef9726Ab2E78132E01Bd791B336 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Skalari" and pe.signatures[i].serial=="61:b1:1e:f9:72:6a:b2:e7:81:32:e0:1b:d7:91:b3:36" and 1609372800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Skalari" and pe.signatures [ i ] . serial == "61:b1:1e:f9:72:6a:b2:e7:81:32:e0:1b:d7:91:b3:36" and 1609372800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42692,13 +42692,13 @@ rule REVERSINGLABS_Cert_Blocklist_8Fe807310D98357A59382090634B93F0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "690e7919-0344-5bd1-849f-e7bfe2f19276"
+		id = "51470200-7dca-5c81-8174-83d8dfe5fad6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7424-L7442"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0ec56bd4783c854efef863050ff729fd99efa98b7b19e04e56a080ee3e75cd90"
+		logic_hash = "v1_sha256_0ec56bd4783c854efef863050ff729fd99efa98b7b19e04e56a080ee3e75cd90"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42708,7 +42708,7 @@ rule REVERSINGLABS_Cert_Blocklist_8Fe807310D98357A59382090634B93F0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MAVE MEDIA" and (pe.signatures[i].serial=="00:8f:e8:07:31:0d:98:35:7a:59:38:20:90:63:4b:93:f0" or pe.signatures[i].serial=="8f:e8:07:31:0d:98:35:7a:59:38:20:90:63:4b:93:f0") and 1613433600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MAVE MEDIA" and ( pe.signatures [ i ] . serial == "00:8f:e8:07:31:0d:98:35:7a:59:38:20:90:63:4b:93:f0" or pe.signatures [ i ] . serial == "8f:e8:07:31:0d:98:35:7a:59:38:20:90:63:4b:93:f0" ) and 1613433600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42717,13 +42717,13 @@ rule REVERSINGLABS_Cert_Blocklist_B97F66Bb221772Dc07Ef1D4Bed8F6085 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c83918d8-fe90-59dc-8f4e-0e7b10238780"
+		id = "912d2a87-6b24-5565-906c-dfc8183e69da"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7444-L7462"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "794dc27ff9b2588d3f2c31cdb83e53616c604aa41da7d8c895034e1cf9da5dd8"
+		logic_hash = "v1_sha256_794dc27ff9b2588d3f2c31cdb83e53616c604aa41da7d8c895034e1cf9da5dd8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42733,7 +42733,7 @@ rule REVERSINGLABS_Cert_Blocklist_B97F66Bb221772Dc07Ef1D4Bed8F6085 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "S-PRO d.o.o." and (pe.signatures[i].serial=="00:b9:7f:66:bb:22:17:72:dc:07:ef:1d:4b:ed:8f:60:85" or pe.signatures[i].serial=="b9:7f:66:bb:22:17:72:dc:07:ef:1d:4b:ed:8f:60:85") and 1614556800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "S-PRO d.o.o." and ( pe.signatures [ i ] . serial == "00:b9:7f:66:bb:22:17:72:dc:07:ef:1d:4b:ed:8f:60:85" or pe.signatures [ i ] . serial == "b9:7f:66:bb:22:17:72:dc:07:ef:1d:4b:ed:8f:60:85" ) and 1614556800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42742,13 +42742,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fed006Fbf85Cd1C6Ba6B4345B198E1E6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ab84282d-9c35-5e52-a117-1d85c03cc6f4"
+		id = "e33e1257-5f4c-57bb-81ae-ef95c80c87d4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7464-L7482"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0360c6760f1018f9388ef5639ab2306879134f33da12677f954fa31b8a71aa16"
+		logic_hash = "v1_sha256_0360c6760f1018f9388ef5639ab2306879134f33da12677f954fa31b8a71aa16"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42758,7 +42758,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fed006Fbf85Cd1C6Ba6B4345B198E1E6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LoL d.o.o." and (pe.signatures[i].serial=="00:fe:d0:06:fb:f8:5c:d1:c6:ba:6b:43:45:b1:98:e1:e6" or pe.signatures[i].serial=="fe:d0:06:fb:f8:5c:d1:c6:ba:6b:43:45:b1:98:e1:e6") and 1614297600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LoL d.o.o." and ( pe.signatures [ i ] . serial == "00:fe:d0:06:fb:f8:5c:d1:c6:ba:6b:43:45:b1:98:e1:e6" or pe.signatures [ i ] . serial == "fe:d0:06:fb:f8:5c:d1:c6:ba:6b:43:45:b1:98:e1:e6" ) and 1614297600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42767,13 +42767,13 @@ rule REVERSINGLABS_Cert_Blocklist_Aa28C9Bd16D9D304F18Af223B27Bfa1E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "facb8bba-a8cc-5b2a-9ef6-ba290cbf9b24"
+		id = "6b467480-7e8a-58c3-9f29-762013c630f2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7484-L7502"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "feaa8d645eea46c7cbbba4ba86c92184df7515a50f1f905ab818c59079a0c96a"
+		logic_hash = "v1_sha256_feaa8d645eea46c7cbbba4ba86c92184df7515a50f1f905ab818c59079a0c96a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42783,7 +42783,7 @@ rule REVERSINGLABS_Cert_Blocklist_Aa28C9Bd16D9D304F18Af223B27Bfa1E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tecno trade d.o.o." and (pe.signatures[i].serial=="00:aa:28:c9:bd:16:d9:d3:04:f1:8a:f2:23:b2:7b:fa:1e" or pe.signatures[i].serial=="aa:28:c9:bd:16:d9:d3:04:f1:8a:f2:23:b2:7b:fa:1e") and 1611705600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Tecno trade d.o.o." and ( pe.signatures [ i ] . serial == "00:aa:28:c9:bd:16:d9:d3:04:f1:8a:f2:23:b2:7b:fa:1e" or pe.signatures [ i ] . serial == "aa:28:c9:bd:16:d9:d3:04:f1:8a:f2:23:b2:7b:fa:1e" ) and 1611705600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42792,13 +42792,13 @@ rule REVERSINGLABS_Cert_Blocklist_19Beff8A6C129663E5E8C18953Dc1F67 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "300d9e11-9283-500e-9716-5b628ef41853"
+		id = "ace301b4-39ca-56d9-b308-734dc724c9ca"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7504-L7520"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0ec031c781ebad7447cfc53ce791aacc8f24e38f039c84e2ee547de64729ae76"
+		logic_hash = "v1_sha256_0ec031c781ebad7447cfc53ce791aacc8f24e38f039c84e2ee547de64729ae76"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42808,7 +42808,7 @@ rule REVERSINGLABS_Cert_Blocklist_19Beff8A6C129663E5E8C18953Dc1F67 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CULNADY LTD LTD" and pe.signatures[i].serial=="19:be:ff:8a:6c:12:96:63:e5:e8:c1:89:53:dc:1f:67" and 1608163200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CULNADY LTD LTD" and pe.signatures [ i ] . serial == "19:be:ff:8a:6c:12:96:63:e5:e8:c1:89:53:dc:1f:67" and 1608163200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42817,13 +42817,13 @@ rule REVERSINGLABS_Cert_Blocklist_029685Cda1C8233D2409A31206F78F9F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f7894a48-459b-574f-9df3-8505578de42b"
+		id = "f3c15b8b-1cc8-55e4-b244-f41ae10598fe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7522-L7538"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d541ce73e5039541ea221f27cc4d033f0c477e41a148206c26cc39ae07c4caaa"
+		logic_hash = "v1_sha256_d541ce73e5039541ea221f27cc4d033f0c477e41a148206c26cc39ae07c4caaa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42833,7 +42833,7 @@ rule REVERSINGLABS_Cert_Blocklist_029685Cda1C8233D2409A31206F78F9F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KOTO TRADE, dru\\xC5\\xBEba za posredovanje, d.o.o." and pe.signatures[i].serial=="02:96:85:cd:a1:c8:23:3d:24:09:a3:12:06:f7:8f:9f" and 1612396800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KOTO TRADE, dru\\xC5\\xBEba za posredovanje, d.o.o." and pe.signatures [ i ] . serial == "02:96:85:cd:a1:c8:23:3d:24:09:a3:12:06:f7:8f:9f" and 1612396800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42842,13 +42842,13 @@ rule REVERSINGLABS_Cert_Blocklist_D609B6C95428954A999A8A99D4F198Af : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4ce9b2ce-5dda-5741-bd29-cadae44c3b28"
+		id = "5d607298-89f6-5d2a-998b-9fbddb3de942"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7540-L7558"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a124f80d599051ecd7c17e6818d181ea018db14c9f0514bbcc5b677ba3656d65"
+		logic_hash = "v1_sha256_a124f80d599051ecd7c17e6818d181ea018db14c9f0514bbcc5b677ba3656d65"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42858,7 +42858,7 @@ rule REVERSINGLABS_Cert_Blocklist_D609B6C95428954A999A8A99D4F198Af : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Fudl" and (pe.signatures[i].serial=="00:d6:09:b6:c9:54:28:95:4a:99:9a:8a:99:d4:f1:98:af" or pe.signatures[i].serial=="d6:09:b6:c9:54:28:95:4a:99:9a:8a:99:d4:f1:98:af") and 1612828800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Fudl" and ( pe.signatures [ i ] . serial == "00:d6:09:b6:c9:54:28:95:4a:99:9a:8a:99:d4:f1:98:af" or pe.signatures [ i ] . serial == "d6:09:b6:c9:54:28:95:4a:99:9a:8a:99:d4:f1:98:af" ) and 1612828800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42867,13 +42867,13 @@ rule REVERSINGLABS_Cert_Blocklist_D3356318924C8C42959Bf1D1574E6482 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "36b12300-6535-5644-9145-9f532b49a421"
+		id = "18728003-5574-55f3-815d-0db5a9f4fee0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7560-L7578"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a672054a776d0715fc888578bcb559d24ef54b4c523f7d49a39ded2586c3140a"
+		logic_hash = "v1_sha256_a672054a776d0715fc888578bcb559d24ef54b4c523f7d49a39ded2586c3140a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42883,7 +42883,7 @@ rule REVERSINGLABS_Cert_Blocklist_D3356318924C8C42959Bf1D1574E6482 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADV TOURS d.o.o." and (pe.signatures[i].serial=="00:d3:35:63:18:92:4c:8c:42:95:9b:f1:d1:57:4e:64:82" or pe.signatures[i].serial=="d3:35:63:18:92:4c:8c:42:95:9b:f1:d1:57:4e:64:82") and 1613001600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ADV TOURS d.o.o." and ( pe.signatures [ i ] . serial == "00:d3:35:63:18:92:4c:8c:42:95:9b:f1:d1:57:4e:64:82" or pe.signatures [ i ] . serial == "d3:35:63:18:92:4c:8c:42:95:9b:f1:d1:57:4e:64:82" ) and 1613001600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42892,13 +42892,13 @@ rule REVERSINGLABS_Cert_Blocklist_31D852F5Fca1A5966B5Ed08A14825C54 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "362a6eb7-f49e-502b-9870-522aea13e04b"
+		id = "f4a33ae2-d2d7-5018-9a0a-6c77c831b1f4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7580-L7596"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8c98b856d53e6862e94042bb133f5739bddcec2e208e43961b23e244584c6ee4"
+		logic_hash = "v1_sha256_8c98b856d53e6862e94042bb133f5739bddcec2e208e43961b23e244584c6ee4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42908,7 +42908,7 @@ rule REVERSINGLABS_Cert_Blocklist_31D852F5Fca1A5966B5Ed08A14825C54 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BBT KLA d.o.o." and pe.signatures[i].serial=="31:d8:52:f5:fc:a1:a5:96:6b:5e:d0:8a:14:82:5c:54" and 1612396800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BBT KLA d.o.o." and pe.signatures [ i ] . serial == "31:d8:52:f5:fc:a1:a5:96:6b:5e:d0:8a:14:82:5c:54" and 1612396800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42917,13 +42917,13 @@ rule REVERSINGLABS_Cert_Blocklist_17D99Cc2F5B29522D422332E681F3E18 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0d0a58a4-353d-51f9-a739-a135d77357c9"
+		id = "54e13971-67ad-5c8a-8e5a-99266e2e95fe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7598-L7614"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "55cc1634cdc5209d68b98fdb0d9e97e0a34346cdcb10f243d13217cda01195f1"
+		logic_hash = "v1_sha256_55cc1634cdc5209d68b98fdb0d9e97e0a34346cdcb10f243d13217cda01195f1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42933,7 +42933,7 @@ rule REVERSINGLABS_Cert_Blocklist_17D99Cc2F5B29522D422332E681F3E18 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PKV Trading ApS" and pe.signatures[i].serial=="17:d9:9c:c2:f5:b2:95:22:d4:22:33:2e:68:1f:3e:18" and 1613088000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PKV Trading ApS" and pe.signatures [ i ] . serial == "17:d9:9c:c2:f5:b2:95:22:d4:22:33:2e:68:1f:3e:18" and 1613088000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42942,13 +42942,13 @@ rule REVERSINGLABS_Cert_Blocklist_6A568F85De2061F67Ded98707D4988Df : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "962c3096-2c3d-5137-9637-b45d00b2ee9b"
+		id = "44810935-f0a4-5962-a1de-55553621d466"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7616-L7632"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "793be308a4df55c3b325e1ee3185159c4155f6dfabc311216d3763bd43680bd4"
+		logic_hash = "v1_sha256_793be308a4df55c3b325e1ee3185159c4155f6dfabc311216d3763bd43680bd4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42958,7 +42958,7 @@ rule REVERSINGLABS_Cert_Blocklist_6A568F85De2061F67Ded98707D4988Df : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Apladis" and pe.signatures[i].serial=="6a:56:8f:85:de:20:61:f6:7d:ed:98:70:7d:49:88:df" and 1613001600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Apladis" and pe.signatures [ i ] . serial == "6a:56:8f:85:de:20:61:f6:7d:ed:98:70:7d:49:88:df" and 1613001600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42967,13 +42967,13 @@ rule REVERSINGLABS_Cert_Blocklist_038Fc745523B41B40D653B83Aa381B80 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3f7f9d58-3a7a-5f84-bf6e-795a9c8bcd38"
+		id = "3954b7a9-b19f-513f-b7f4-9f1a0eeb8bb8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7634-L7650"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "016ca6dcb5c7c56c80e4486b84d97fb3869a959ef3e8392e4376a0a0de06092f"
+		logic_hash = "v1_sha256_016ca6dcb5c7c56c80e4486b84d97fb3869a959ef3e8392e4376a0a0de06092f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -42983,7 +42983,7 @@ rule REVERSINGLABS_Cert_Blocklist_038Fc745523B41B40D653B83Aa381B80 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Optima" and pe.signatures[i].serial=="03:8f:c7:45:52:3b:41:b4:0d:65:3b:83:aa:38:1b:80" and 1606143708<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Optima" and pe.signatures [ i ] . serial == "03:8f:c7:45:52:3b:41:b4:0d:65:3b:83:aa:38:1b:80" and 1606143708 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -42992,13 +42992,13 @@ rule REVERSINGLABS_Cert_Blocklist_30Af0D0E6D8201A5369664C5Ebbb010F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "aaa31642-a0f4-5652-b3cd-c81cfb1ab127"
+		id = "cdb7da47-0e0b-58b6-9abe-c355bb8ae9f8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7652-L7668"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "018e5a0fbeeaded2569b83e2f91230e0055a5ffa2059b7a064a5c2eda55ed2de"
+		logic_hash = "v1_sha256_018e5a0fbeeaded2569b83e2f91230e0055a5ffa2059b7a064a5c2eda55ed2de"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43008,7 +43008,7 @@ rule REVERSINGLABS_Cert_Blocklist_30Af0D0E6D8201A5369664C5Ebbb010F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "3N-\\xC5\\xA0PORT podjetje za in\\xC5\\xBEeniring, storitve in trgovino d.o.o." and pe.signatures[i].serial=="30:af:0d:0e:6d:82:01:a5:36:96:64:c5:eb:bb:01:0f" and 1613433600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "3N-\\xC5\\xA0PORT podjetje za in\\xC5\\xBEeniring, storitve in trgovino d.o.o." and pe.signatures [ i ] . serial == "30:af:0d:0e:6d:82:01:a5:36:96:64:c5:eb:bb:01:0f" and 1613433600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43017,13 +43017,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ac0A7B9420B369Af3Ddb748385B981 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "82d6c0f5-80d1-5003-a5c9-9eadd9654460"
+		id = "e400c27f-bf0d-535c-839f-11eff4c05d0f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7670-L7688"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2bc31eaa64be487cb85873a64b7462d90d1c28839def070ce5db7ae555383421"
+		logic_hash = "v1_sha256_2bc31eaa64be487cb85873a64b7462d90d1c28839def070ce5db7ae555383421"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43033,7 +43033,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ac0A7B9420B369Af3Ddb748385B981 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Tochka" and (pe.signatures[i].serial=="00:ac:0a:7b:94:20:b3:69:af:3d:db:74:83:85:b9:81" or pe.signatures[i].serial=="ac:0a:7b:94:20:b3:69:af:3d:db:74:83:85:b9:81") and 1604620800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Tochka" and ( pe.signatures [ i ] . serial == "00:ac:0a:7b:94:20:b3:69:af:3d:db:74:83:85:b9:81" or pe.signatures [ i ] . serial == "ac:0a:7b:94:20:b3:69:af:3d:db:74:83:85:b9:81" ) and 1604620800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43042,13 +43042,13 @@ rule REVERSINGLABS_Cert_Blocklist_C167F04B338B1E8747B92C2197403C43 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0bf561ac-0283-557f-a685-4603e2b58273"
+		id = "b7d933c6-7472-5235-82d4-7420523b95ae"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7690-L7708"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8e0a11efc739baefe23a3d77e4eefc9dc23c74821c91fc219822dbc5dbb468b1"
+		logic_hash = "v1_sha256_8e0a11efc739baefe23a3d77e4eefc9dc23c74821c91fc219822dbc5dbb468b1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43058,7 +43058,7 @@ rule REVERSINGLABS_Cert_Blocklist_C167F04B338B1E8747B92C2197403C43 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTUNE STAR TRADING, INC." and (pe.signatures[i].serial=="00:c1:67:f0:4b:33:8b:1e:87:47:b9:2c:21:97:40:3c:43" or pe.signatures[i].serial=="c1:67:f0:4b:33:8b:1e:87:47:b9:2c:21:97:40:3c:43") and 1604361600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FORTUNE STAR TRADING, INC." and ( pe.signatures [ i ] . serial == "00:c1:67:f0:4b:33:8b:1e:87:47:b9:2c:21:97:40:3c:43" or pe.signatures [ i ] . serial == "c1:67:f0:4b:33:8b:1e:87:47:b9:2c:21:97:40:3c:43" ) and 1604361600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43067,13 +43067,13 @@ rule REVERSINGLABS_Cert_Blocklist_9272607Cfc982B782A5D36C4B78F5E7B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e3ad8f20-d12f-54e9-a6da-7aad28a10287"
+		id = "57378d08-6fcb-5174-a133-61ed5f8f9bd4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7710-L7728"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2b1d6f27fb513542589a5c9011e501a9d298282bba6882eac0fc7bf3e6ebb291"
+		logic_hash = "v1_sha256_2b1d6f27fb513542589a5c9011e501a9d298282bba6882eac0fc7bf3e6ebb291"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43083,7 +43083,7 @@ rule REVERSINGLABS_Cert_Blocklist_9272607Cfc982B782A5D36C4B78F5E7B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rada SP Z o o" and (pe.signatures[i].serial=="00:92:72:60:7c:fc:98:2b:78:2a:5d:36:c4:b7:8f:5e:7b" or pe.signatures[i].serial=="92:72:60:7c:fc:98:2b:78:2a:5d:36:c4:b7:8f:5e:7b") and 1605139200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rada SP Z o o" and ( pe.signatures [ i ] . serial == "00:92:72:60:7c:fc:98:2b:78:2a:5d:36:c4:b7:8f:5e:7b" or pe.signatures [ i ] . serial == "92:72:60:7c:fc:98:2b:78:2a:5d:36:c4:b7:8f:5e:7b" ) and 1605139200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43092,13 +43092,13 @@ rule REVERSINGLABS_Cert_Blocklist_45Eb9187A2505D8E6C842E6D366Ad0C8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1b8390aa-16b9-558b-aee8-e30fc7100af4"
+		id = "9b2481d7-736e-59be-b998-43d02c38c65c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7730-L7746"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4ae755e814ae2488d4bd6b8136ab6d78e4809a2ddacb7f88cf1d2b64c1488898"
+		logic_hash = "v1_sha256_4ae755e814ae2488d4bd6b8136ab6d78e4809a2ddacb7f88cf1d2b64c1488898"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43108,7 +43108,7 @@ rule REVERSINGLABS_Cert_Blocklist_45Eb9187A2505D8E6C842E6D366Ad0C8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BAKERA s.r.o." and pe.signatures[i].serial=="45:eb:91:87:a2:50:5d:8e:6c:84:2e:6d:36:6a:d0:c8" and 1607040000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BAKERA s.r.o." and pe.signatures [ i ] . serial == "45:eb:91:87:a2:50:5d:8e:6c:84:2e:6d:36:6a:d0:c8" and 1607040000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43117,13 +43117,13 @@ rule REVERSINGLABS_Cert_Blocklist_56Fff139Df5Ae7E788E5D72196Dd563A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4f34fd37-908c-573c-ba53-5ab622589e88"
+		id = "a20aba17-47b3-55cf-ae9b-a7e3018d53e6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7748-L7764"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4b58c83901605d8b43519f1bc2d4ac8dc10c794f027681378b2bee2a8ff81604"
+		logic_hash = "v1_sha256_4b58c83901605d8b43519f1bc2d4ac8dc10c794f027681378b2bee2a8ff81604"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43133,7 +43133,7 @@ rule REVERSINGLABS_Cert_Blocklist_56Fff139Df5Ae7E788E5D72196Dd563A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cifromatika LLC" and pe.signatures[i].serial=="56:ff:f1:39:df:5a:e7:e7:88:e5:d7:21:96:dd:56:3a" and 1606435200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cifromatika LLC" and pe.signatures [ i ] . serial == "56:ff:f1:39:df:5a:e7:e7:88:e5:d7:21:96:dd:56:3a" and 1606435200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43142,13 +43142,13 @@ rule REVERSINGLABS_Cert_Blocklist_E161F76Da3B5E4623892C8E6Fda1Ea3D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "386c81ef-87aa-514e-81d7-dddfb90e0dc2"
+		id = "9dea3f43-78f2-5463-bcbf-df2fe8444b66"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7766-L7784"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "883545593b48aa11c11f7fa1a1f77c62321ea86067f1ed108dcd00c8c6cd3495"
+		logic_hash = "v1_sha256_883545593b48aa11c11f7fa1a1f77c62321ea86067f1ed108dcd00c8c6cd3495"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43158,7 +43158,7 @@ rule REVERSINGLABS_Cert_Blocklist_E161F76Da3B5E4623892C8E6Fda1Ea3D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TGN Nedelica d.o.o." and (pe.signatures[i].serial=="00:e1:61:f7:6d:a3:b5:e4:62:38:92:c8:e6:fd:a1:ea:3d" or pe.signatures[i].serial=="e1:61:f7:6d:a3:b5:e4:62:38:92:c8:e6:fd:a1:ea:3d") and 1604966400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TGN Nedelica d.o.o." and ( pe.signatures [ i ] . serial == "00:e1:61:f7:6d:a3:b5:e4:62:38:92:c8:e6:fd:a1:ea:3d" or pe.signatures [ i ] . serial == "e1:61:f7:6d:a3:b5:e4:62:38:92:c8:e6:fd:a1:ea:3d" ) and 1604966400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43167,13 +43167,13 @@ rule REVERSINGLABS_Cert_Blocklist_9Ae5B177Ac3A7Ce2Aadf1C891B574924 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c72b8b2a-3e49-5ac3-ab4d-55b86ce7f061"
+		id = "09f43ef4-6a6d-5fd1-bdf5-068c88fad28e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7786-L7804"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "03ac299459a1aaf2e4a2e62884cd321e16100fee78b4b0e271acdd8a4e32525c"
+		logic_hash = "v1_sha256_03ac299459a1aaf2e4a2e62884cd321e16100fee78b4b0e271acdd8a4e32525c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43183,7 +43183,7 @@ rule REVERSINGLABS_Cert_Blocklist_9Ae5B177Ac3A7Ce2Aadf1C891B574924 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Kolorit" and (pe.signatures[i].serial=="00:9a:e5:b1:77:ac:3a:7c:e2:aa:df:1c:89:1b:57:49:24" or pe.signatures[i].serial=="9a:e5:b1:77:ac:3a:7c:e2:aa:df:1c:89:1b:57:49:24") and 1608076800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Kolorit" and ( pe.signatures [ i ] . serial == "00:9a:e5:b1:77:ac:3a:7c:e2:aa:df:1c:89:1b:57:49:24" or pe.signatures [ i ] . serial == "9a:e5:b1:77:ac:3a:7c:e2:aa:df:1c:89:1b:57:49:24" ) and 1608076800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43192,13 +43192,13 @@ rule REVERSINGLABS_Cert_Blocklist_A03Ea3A4Fa772B17037A0B80F1F968Aa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cbc0c6ca-fab2-531e-b368-4d3fdc72509f"
+		id = "9952dd19-b161-5c61-a7e9-7447e67a8919"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7806-L7824"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e2044c6ddb80f3add13dfc3b623d0460ce8e9a66c5a98582f80d906edbbbd829"
+		logic_hash = "v1_sha256_e2044c6ddb80f3add13dfc3b623d0460ce8e9a66c5a98582f80d906edbbbd829"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43208,7 +43208,7 @@ rule REVERSINGLABS_Cert_Blocklist_A03Ea3A4Fa772B17037A0B80F1F968Aa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DREVOKAPITAL, s.r.o." and (pe.signatures[i].serial=="00:a0:3e:a3:a4:fa:77:2b:17:03:7a:0b:80:f1:f9:68:aa" or pe.signatures[i].serial=="a0:3e:a3:a4:fa:77:2b:17:03:7a:0b:80:f1:f9:68:aa") and 1608076800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DREVOKAPITAL, s.r.o." and ( pe.signatures [ i ] . serial == "00:a0:3e:a3:a4:fa:77:2b:17:03:7a:0b:80:f1:f9:68:aa" or pe.signatures [ i ] . serial == "a0:3e:a3:a4:fa:77:2b:17:03:7a:0b:80:f1:f9:68:aa" ) and 1608076800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43217,13 +43217,13 @@ rule REVERSINGLABS_Cert_Blocklist_333Ca7D100B139B0D9C1A97Cb458E226 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c2c32499-4b0d-51ad-a10e-1ddd7218df84"
+		id = "497527ff-24bc-5f47-8732-78d675ca438a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7826-L7842"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b3a31a54132fd8ca2c11b7806503207a4197f16af78693387bac56879b5e1448"
+		logic_hash = "v1_sha256_b3a31a54132fd8ca2c11b7806503207a4197f16af78693387bac56879b5e1448"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43233,7 +43233,7 @@ rule REVERSINGLABS_Cert_Blocklist_333Ca7D100B139B0D9C1A97Cb458E226 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FSE, d.o.o." and pe.signatures[i].serial=="33:3c:a7:d1:00:b1:39:b0:d9:c1:a9:7c:b4:58:e2:26" and 1608076800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FSE, d.o.o." and pe.signatures [ i ] . serial == "33:3c:a7:d1:00:b1:39:b0:d9:c1:a9:7c:b4:58:e2:26" and 1608076800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43242,13 +43242,13 @@ rule REVERSINGLABS_Cert_Blocklist_9245D1511923F541844Faa3C6Bfebcbe : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7d4033b8-da1d-55f5-aa80-f96636650633"
+		id = "9202c913-a805-56bf-9965-80feb9c8e420"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7844-L7862"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b965e897b42c39841e663cc144cf6e4a81fc9bcb64ce3a15a7ca021e95866b08"
+		logic_hash = "v1_sha256_b965e897b42c39841e663cc144cf6e4a81fc9bcb64ce3a15a7ca021e95866b08"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43258,7 +43258,7 @@ rule REVERSINGLABS_Cert_Blocklist_9245D1511923F541844Faa3C6Bfebcbe : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LEHTEH d.o.o., Ljubljana" and (pe.signatures[i].serial=="00:92:45:d1:51:19:23:f5:41:84:4f:aa:3c:6b:fe:bc:be" or pe.signatures[i].serial=="92:45:d1:51:19:23:f5:41:84:4f:aa:3c:6b:fe:bc:be") and 1607040000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LEHTEH d.o.o., Ljubljana" and ( pe.signatures [ i ] . serial == "00:92:45:d1:51:19:23:f5:41:84:4f:aa:3c:6b:fe:bc:be" or pe.signatures [ i ] . serial == "92:45:d1:51:19:23:f5:41:84:4f:aa:3c:6b:fe:bc:be" ) and 1607040000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43267,13 +43267,13 @@ rule REVERSINGLABS_Cert_Blocklist_2888Cf0F953A4A3640Ee4Cfc6304D9D4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "75ec52c5-4c59-51d8-bd9b-928c75d3521a"
+		id = "407aac59-d305-59a7-8e92-59e7f34adf09"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7864-L7880"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a9ee8534d89b8ac8705bb1777718513a28e4531ed398f482f46a72f2760af161"
+		logic_hash = "v1_sha256_a9ee8534d89b8ac8705bb1777718513a28e4531ed398f482f46a72f2760af161"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43283,7 +43283,7 @@ rule REVERSINGLABS_Cert_Blocklist_2888Cf0F953A4A3640Ee4Cfc6304D9D4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lotte Schmidt" and pe.signatures[i].serial=="28:88:cf:0f:95:3a:4a:36:40:ee:4c:fc:63:04:d9:d4" and 1608024974<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Lotte Schmidt" and pe.signatures [ i ] . serial == "28:88:cf:0f:95:3a:4a:36:40:ee:4c:fc:63:04:d9:d4" and 1608024974 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43292,13 +43292,13 @@ rule REVERSINGLABS_Cert_Blocklist_C8Edcfe8Be174C2F204D858C5B91Dea5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "92baa26f-1352-53ed-bb9f-0a632e471dd5"
+		id = "702f3959-4902-53ba-a614-ac6b9b6a7bbf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7882-L7900"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b3e6927abfce69548374bfd430a3ae3a1c5a8d05f0f40e43091b4d12025c5b1a"
+		logic_hash = "v1_sha256_b3e6927abfce69548374bfd430a3ae3a1c5a8d05f0f40e43091b4d12025c5b1a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43308,7 +43308,7 @@ rule REVERSINGLABS_Cert_Blocklist_C8Edcfe8Be174C2F204D858C5B91Dea5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Paarcopy Oy" and (pe.signatures[i].serial=="00:c8:ed:cf:e8:be:17:4c:2f:20:4d:85:8c:5b:91:de:a5" or pe.signatures[i].serial=="c8:ed:cf:e8:be:17:4c:2f:20:4d:85:8c:5b:91:de:a5") and 1608076800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Paarcopy Oy" and ( pe.signatures [ i ] . serial == "00:c8:ed:cf:e8:be:17:4c:2f:20:4d:85:8c:5b:91:de:a5" or pe.signatures [ i ] . serial == "c8:ed:cf:e8:be:17:4c:2f:20:4d:85:8c:5b:91:de:a5" ) and 1608076800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43317,13 +43317,13 @@ rule REVERSINGLABS_Cert_Blocklist_9Faf8705A3Eaef9340800Cc4Fd38597C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d2988928-4ef3-56bf-a407-f735756c7f81"
+		id = "f888f349-cc02-513b-b4f8-6b3d84ec0c9d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7902-L7920"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "66a340f169e401705ba229d2d4548cef1a57bf1d2d320b108d12b2049b063b92"
+		logic_hash = "v1_sha256_66a340f169e401705ba229d2d4548cef1a57bf1d2d320b108d12b2049b063b92"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43333,7 +43333,7 @@ rule REVERSINGLABS_Cert_Blocklist_9Faf8705A3Eaef9340800Cc4Fd38597C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tekhnokod LLC" and (pe.signatures[i].serial=="00:9f:af:87:05:a3:ea:ef:93:40:80:0c:c4:fd:38:59:7c" or pe.signatures[i].serial=="9f:af:87:05:a3:ea:ef:93:40:80:0c:c4:fd:38:59:7c") and 1605744000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Tekhnokod LLC" and ( pe.signatures [ i ] . serial == "00:9f:af:87:05:a3:ea:ef:93:40:80:0c:c4:fd:38:59:7c" or pe.signatures [ i ] . serial == "9f:af:87:05:a3:ea:ef:93:40:80:0c:c4:fd:38:59:7c" ) and 1605744000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43342,13 +43342,13 @@ rule REVERSINGLABS_Cert_Blocklist_0940Fa9A4080F35052B2077333769C2F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "358391b7-649b-5792-b4bd-d97b388c5d12"
+		id = "88f81b92-a692-51d1-aa24-678d4d737149"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7922-L7938"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "45636ea33751fea61572539fe6f28bccd05df9b6b9e7f2d77bb738f7c69c53a2"
+		logic_hash = "v1_sha256_45636ea33751fea61572539fe6f28bccd05df9b6b9e7f2d77bb738f7c69c53a2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43358,7 +43358,7 @@ rule REVERSINGLABS_Cert_Blocklist_0940Fa9A4080F35052B2077333769C2F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROFF LAIN, OOO" and pe.signatures[i].serial=="09:40:fa:9a:40:80:f3:50:52:b2:07:73:33:76:9c:2f" and 1603497600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PROFF LAIN, OOO" and pe.signatures [ i ] . serial == "09:40:fa:9a:40:80:f3:50:52:b2:07:73:33:76:9c:2f" and 1603497600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43367,13 +43367,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ea720222D92Dc8D48E3B3C3B0Fc360A6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8415406b-ede8-5404-8208-34eb649f7325"
+		id = "d318623b-67f0-5e89-b241-e2330f4433fb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7940-L7958"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c60e1ccf178f03f930a3bc41e9a92be20df0362f067ed1fcfc7c93627a056d75"
+		logic_hash = "v1_sha256_c60e1ccf178f03f930a3bc41e9a92be20df0362f067ed1fcfc7c93627a056d75"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43383,7 +43383,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ea720222D92Dc8D48E3B3C3B0Fc360A6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CAVANAGH NETS LIMITED" and (pe.signatures[i].serial=="00:ea:72:02:22:d9:2d:c8:d4:8e:3b:3c:3b:0f:c3:60:a6" or pe.signatures[i].serial=="ea:72:02:22:d9:2d:c8:d4:8e:3b:3c:3b:0f:c3:60:a6") and 1608640280<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CAVANAGH NETS LIMITED" and ( pe.signatures [ i ] . serial == "00:ea:72:02:22:d9:2d:c8:d4:8e:3b:3c:3b:0f:c3:60:a6" or pe.signatures [ i ] . serial == "ea:72:02:22:d9:2d:c8:d4:8e:3b:3c:3b:0f:c3:60:a6" ) and 1608640280 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43392,13 +43392,13 @@ rule REVERSINGLABS_Cert_Blocklist_4743E140C05B33F0449023946Bd05Acb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f783bad3-f350-5a74-8e3f-5b7220e4de8f"
+		id = "72753fbf-e9b7-525c-894f-e960080736cd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7960-L7976"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "69ce1512d7df4926ee2b470b18fbe51a2aa81e07b37b2536617d6353045e0d19"
+		logic_hash = "v1_sha256_69ce1512d7df4926ee2b470b18fbe51a2aa81e07b37b2536617d6353045e0d19"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43408,7 +43408,7 @@ rule REVERSINGLABS_Cert_Blocklist_4743E140C05B33F0449023946Bd05Acb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STROI RENOV SARL" and pe.signatures[i].serial=="47:43:e1:40:c0:5b:33:f0:44:90:23:94:6b:d0:5a:cb" and 1607644800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "STROI RENOV SARL" and pe.signatures [ i ] . serial == "47:43:e1:40:c0:5b:33:f0:44:90:23:94:6b:d0:5a:cb" and 1607644800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43417,13 +43417,13 @@ rule REVERSINGLABS_Cert_Blocklist_A496Bc774575C31Abec861B68C36Dcb6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "51941c0d-a7a1-5c17-bef8-290e5db66fb7"
+		id = "272be425-6aec-5075-b3a8-739922e8597d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7978-L7996"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f82214f982c9972e547f77966c44e935e9de701cc9108ceca34a4fede850d243"
+		logic_hash = "v1_sha256_f82214f982c9972e547f77966c44e935e9de701cc9108ceca34a4fede850d243"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43433,7 +43433,7 @@ rule REVERSINGLABS_Cert_Blocklist_A496Bc774575C31Abec861B68C36Dcb6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORGLE DVORSAK, d.o.o" and (pe.signatures[i].serial=="00:a4:96:bc:77:45:75:c3:1a:be:c8:61:b6:8c:36:dc:b6" or pe.signatures[i].serial=="a4:96:bc:77:45:75:c3:1a:be:c8:61:b6:8c:36:dc:b6") and 1606867200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ORGLE DVORSAK, d.o.o" and ( pe.signatures [ i ] . serial == "00:a4:96:bc:77:45:75:c3:1a:be:c8:61:b6:8c:36:dc:b6" or pe.signatures [ i ] . serial == "a4:96:bc:77:45:75:c3:1a:be:c8:61:b6:8c:36:dc:b6" ) and 1606867200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43442,13 +43442,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A55C15F733Bf1633E9Ffae8A6E3B37D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "32cefe84-b305-5542-a5d3-1832dcbf6d61"
+		id = "849d3fa9-4cb9-5445-9b2a-d6ce5e231416"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L7998-L8014"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "89ca9f1c5cf0b029748528d8c5bb65f89ee05877bfdc13b4ce3d2d3e7feafb5d"
+		logic_hash = "v1_sha256_89ca9f1c5cf0b029748528d8c5bb65f89ee05877bfdc13b4ce3d2d3e7feafb5d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43458,7 +43458,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A55C15F733Bf1633E9Ffae8A6E3B37D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Osnova OOO" and pe.signatures[i].serial=="0a:55:c1:5f:73:3b:f1:63:3e:9f:fa:e8:a6:e3:b3:7d" and 1604016000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Osnova OOO" and pe.signatures [ i ] . serial == "0a:55:c1:5f:73:3b:f1:63:3e:9f:fa:e8:a6:e3:b3:7d" and 1604016000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43467,13 +43467,13 @@ rule REVERSINGLABS_Cert_Blocklist_C650Ae531100A91389A7F030228B3095 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5d506480-96ca-5e71-9fb2-185b2f8ddc6c"
+		id = "e5eef96b-65d1-55b6-80ed-c3dc1ced8d0a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8016-L8034"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "186b66283491cfebcaade57b1010ce4304c08ddb131153984210c2c7025961aa"
+		logic_hash = "v1_sha256_186b66283491cfebcaade57b1010ce4304c08ddb131153984210c2c7025961aa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43483,7 +43483,7 @@ rule REVERSINGLABS_Cert_Blocklist_C650Ae531100A91389A7F030228B3095 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "POKEROWA STRUNA SP Z O O" and (pe.signatures[i].serial=="00:c6:50:ae:53:11:00:a9:13:89:a7:f0:30:22:8b:30:95" or pe.signatures[i].serial=="c6:50:ae:53:11:00:a9:13:89:a7:f0:30:22:8b:30:95") and 1606089600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "POKEROWA STRUNA SP Z O O" and ( pe.signatures [ i ] . serial == "00:c6:50:ae:53:11:00:a9:13:89:a7:f0:30:22:8b:30:95" or pe.signatures [ i ] . serial == "c6:50:ae:53:11:00:a9:13:89:a7:f0:30:22:8b:30:95" ) and 1606089600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43492,13 +43492,13 @@ rule REVERSINGLABS_Cert_Blocklist_3990362C34015Ce4C23Ecc3377Fd3C06 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "453b5da2-ae26-5005-8a56-1105a960fde6"
+		id = "6371f3d4-7afb-55d9-94f0-6afcb7260214"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8036-L8052"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0625800fcb166b56cab2e16d0d757983a6f880b68627ed8c3c38419dd9a32999"
+		logic_hash = "v1_sha256_0625800fcb166b56cab2e16d0d757983a6f880b68627ed8c3c38419dd9a32999"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43508,7 +43508,7 @@ rule REVERSINGLABS_Cert_Blocklist_3990362C34015Ce4C23Ecc3377Fd3C06 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RZOH ApS" and pe.signatures[i].serial=="39:90:36:2c:34:01:5c:e4:c2:3e:cc:33:77:fd:3c:06" and 1606780800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RZOH ApS" and pe.signatures [ i ] . serial == "39:90:36:2c:34:01:5c:e4:c2:3e:cc:33:77:fd:3c:06" and 1606780800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43517,13 +43517,13 @@ rule REVERSINGLABS_Cert_Blocklist_121Fca3Cfa4Bd011669F5Cc4E053Aa3F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ebc47e1e-e6fe-581c-86b3-22e2e67a0b81"
+		id = "2e4ba9f0-2a1f-5c0a-a59e-73eeaa98b4c1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8054-L8070"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1edd5be3f970202be15080cd7ef19c0cce7fcba73cb6120d7cb7d518e877cf85"
+		logic_hash = "v1_sha256_1edd5be3f970202be15080cd7ef19c0cce7fcba73cb6120d7cb7d518e877cf85"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43533,7 +43533,7 @@ rule REVERSINGLABS_Cert_Blocklist_121Fca3Cfa4Bd011669F5Cc4E053Aa3F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kymijoen Projektipalvelut Oy" and pe.signatures[i].serial=="12:1f:ca:3c:fa:4b:d0:11:66:9f:5c:c4:e0:53:aa:3f" and 1606953600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kymijoen Projektipalvelut Oy" and pe.signatures [ i ] . serial == "12:1f:ca:3c:fa:4b:d0:11:66:9f:5c:c4:e0:53:aa:3f" and 1606953600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43542,13 +43542,13 @@ rule REVERSINGLABS_Cert_Blocklist_D338F8A490E37E6C2Be80A0E349929Fa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "93ca450e-7278-5c6c-aba8-e90728570e0c"
+		id = "05925b7d-d54c-5e2e-b86c-0466d3d56b0e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8072-L8090"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "39d9695803e96508b5ad12a7d9f8b65d13288dbe94b21a4952e096dd576e11ce"
+		logic_hash = "v1_sha256_39d9695803e96508b5ad12a7d9f8b65d13288dbe94b21a4952e096dd576e11ce"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43558,7 +43558,7 @@ rule REVERSINGLABS_Cert_Blocklist_D338F8A490E37E6C2Be80A0E349929Fa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAGUARO ApS" and (pe.signatures[i].serial=="00:d3:38:f8:a4:90:e3:7e:6c:2b:e8:0a:0e:34:99:29:fa" or pe.signatures[i].serial=="d3:38:f8:a4:90:e3:7e:6c:2b:e8:0a:0e:34:99:29:fa") and 1607558400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SAGUARO ApS" and ( pe.signatures [ i ] . serial == "00:d3:38:f8:a4:90:e3:7e:6c:2b:e8:0a:0e:34:99:29:fa" or pe.signatures [ i ] . serial == "d3:38:f8:a4:90:e3:7e:6c:2b:e8:0a:0e:34:99:29:fa" ) and 1607558400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43567,13 +43567,13 @@ rule REVERSINGLABS_Cert_Blocklist_2C1Ee9B583310B5E34A1Ee6945A34B26 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "70fc063e-f032-5e63-ae53-65a25d5a29c3"
+		id = "1ccc0dfe-5436-5bde-9243-5a70cc748946"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8092-L8108"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7752e49e8848863d78c5de03c3d194498765d80da00a84c5164c7a9010d13474"
+		logic_hash = "v1_sha256_7752e49e8848863d78c5de03c3d194498765d80da00a84c5164c7a9010d13474"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43583,7 +43583,7 @@ rule REVERSINGLABS_Cert_Blocklist_2C1Ee9B583310B5E34A1Ee6945A34B26 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Artmarket" and pe.signatures[i].serial=="2c:1e:e9:b5:83:31:0b:5e:34:a1:ee:69:45:a3:4b:26" and 1607558400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Artmarket" and pe.signatures [ i ] . serial == "2c:1e:e9:b5:83:31:0b:5e:34:a1:ee:69:45:a3:4b:26" and 1607558400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43592,13 +43592,13 @@ rule REVERSINGLABS_Cert_Blocklist_D875B3E3F2Db6C3Eb426E24946066111 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4aedeb77-181b-5422-bec4-93c84412bae4"
+		id = "0157634c-26ee-5caf-a9bd-b741c293040c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8110-L8128"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9e181271d46c828b9ec266331e077b3b4891a193c71173447da383fad91ae878"
+		logic_hash = "v1_sha256_9e181271d46c828b9ec266331e077b3b4891a193c71173447da383fad91ae878"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43608,7 +43608,7 @@ rule REVERSINGLABS_Cert_Blocklist_D875B3E3F2Db6C3Eb426E24946066111 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kubit LLC" and (pe.signatures[i].serial=="00:d8:75:b3:e3:f2:db:6c:3e:b4:26:e2:49:46:06:61:11" or pe.signatures[i].serial=="d8:75:b3:e3:f2:db:6c:3e:b4:26:e2:49:46:06:61:11") and 1606953600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kubit LLC" and ( pe.signatures [ i ] . serial == "00:d8:75:b3:e3:f2:db:6c:3e:b4:26:e2:49:46:06:61:11" or pe.signatures [ i ] . serial == "d8:75:b3:e3:f2:db:6c:3e:b4:26:e2:49:46:06:61:11" ) and 1606953600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43617,13 +43617,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ad0A958Cdf188Bed43154A54Bf23Afba : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "183d9d02-885b-5f2f-b455-dd72af7bc5a6"
+		id = "24e8cf1c-d69b-5200-aeab-ee99cd82c349"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8130-L8148"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "07e53e59f90aa3cd3a98dbca2627672606f6c6f8f3bda8456e32122463729c4b"
+		logic_hash = "v1_sha256_07e53e59f90aa3cd3a98dbca2627672606f6c6f8f3bda8456e32122463729c4b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43633,7 +43633,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ad0A958Cdf188Bed43154A54Bf23Afba : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RHM Ltd" and (pe.signatures[i].serial=="00:ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba" or pe.signatures[i].serial=="ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba") and 1612915200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RHM Ltd" and ( pe.signatures [ i ] . serial == "00:ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba" or pe.signatures [ i ] . serial == "ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba" ) and 1612915200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43642,13 +43642,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Cee26C125B8C188F316C3Fa78D9C2F1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "79989b9b-60e4-577d-97e2-cb447c38baf3"
+		id = "8d6f8d4e-b7ff-508c-aa36-8a0b296d5bb0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8150-L8166"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5c64f8e40c31822ce8d2e34f96ccc977085e429f0c068a5f6b44099117837de1"
+		logic_hash = "v1_sha256_5c64f8e40c31822ce8d2e34f96ccc977085e429f0c068a5f6b44099117837de1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43658,7 +43658,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Cee26C125B8C188F316C3Fa78D9C2F1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bitubit LLC" and pe.signatures[i].serial=="3c:ee:26:c1:25:b8:c1:88:f3:16:c3:fa:78:d9:c2:f1" and 1606435200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bitubit LLC" and pe.signatures [ i ] . serial == "3c:ee:26:c1:25:b8:c1:88:f3:16:c3:fa:78:d9:c2:f1" and 1606435200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43667,13 +43667,13 @@ rule REVERSINGLABS_Cert_Blocklist_4C687A0022C36F89E253F91D1F6954E2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c45a2125-dd7c-5ff1-89a8-35cbe1d924d7"
+		id = "b8b8af69-a7f3-5fb0-9233-c78a432ac795"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8168-L8184"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "287c0c7a25e33e0e7def6efa23dbd2efba7c4ac3aa8f5deb8568a60a95e08bbe"
+		logic_hash = "v1_sha256_287c0c7a25e33e0e7def6efa23dbd2efba7c4ac3aa8f5deb8568a60a95e08bbe"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43683,7 +43683,7 @@ rule REVERSINGLABS_Cert_Blocklist_4C687A0022C36F89E253F91D1F6954E2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HETCO ApS" and pe.signatures[i].serial=="4c:68:7a:00:22:c3:6f:89:e2:53:f9:1d:1f:69:54:e2" and 1606780800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HETCO ApS" and pe.signatures [ i ] . serial == "4c:68:7a:00:22:c3:6f:89:e2:53:f9:1d:1f:69:54:e2" and 1606780800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43692,13 +43692,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ca646B4275406Df639Cf603756F63D77 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b176b7f8-e3d1-593c-91c3-03e781f6ef7b"
+		id = "251b669d-e2fe-565d-90b0-28890842e81a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8186-L8204"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a690e3f6a656835984e47d999271fe441a5fbf424208da8d5b3c9ddcef47b70e"
+		logic_hash = "v1_sha256_a690e3f6a656835984e47d999271fe441a5fbf424208da8d5b3c9ddcef47b70e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43708,7 +43708,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ca646B4275406Df639Cf603756F63D77 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHOECORP LIMITED" and (pe.signatures[i].serial=="00:ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77" or pe.signatures[i].serial=="ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77") and 1605830400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SHOECORP LIMITED" and ( pe.signatures [ i ] . serial == "00:ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77" or pe.signatures [ i ] . serial == "ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77" ) and 1605830400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43717,13 +43717,13 @@ rule REVERSINGLABS_Cert_Blocklist_Addbec454B5479Cabd940A72Df4500Af : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f2488d44-5a9a-5ab6-be6f-f3444f72444a"
+		id = "b2f37561-38bd-59c3-9b19-13ad83a706d1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8206-L8224"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "799629791646c524d170b900339b87474aed73b7156a8c4dd20f7c13cbe97929"
+		logic_hash = "v1_sha256_799629791646c524d170b900339b87474aed73b7156a8c4dd20f7c13cbe97929"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43733,7 +43733,7 @@ rule REVERSINGLABS_Cert_Blocklist_Addbec454B5479Cabd940A72Df4500Af : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHAT LIMITED" and (pe.signatures[i].serial=="00:ad:db:ec:45:4b:54:79:ca:bd:94:0a:72:df:45:00:af" or pe.signatures[i].serial=="ad:db:ec:45:4b:54:79:ca:bd:94:0a:72:df:45:00:af") and 1612828800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SHAT LIMITED" and ( pe.signatures [ i ] . serial == "00:ad:db:ec:45:4b:54:79:ca:bd:94:0a:72:df:45:00:af" or pe.signatures [ i ] . serial == "ad:db:ec:45:4b:54:79:ca:bd:94:0a:72:df:45:00:af" ) and 1612828800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43742,13 +43742,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ac307E5257Bb814B818D3633B630326F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c33d798a-854c-5fab-afbe-e94d142befa7"
+		id = "863241ce-ecaa-5aff-bfb3-bd0b5ac8ea5e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8226-L8244"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "10819bd2194fface6db812f8c6770c306c183386d2d9ba97467a5b55fd997194"
+		logic_hash = "v1_sha256_10819bd2194fface6db812f8c6770c306c183386d2d9ba97467a5b55fd997194"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43758,7 +43758,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ac307E5257Bb814B818D3633B630326F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aqua Direct s.r.o." and (pe.signatures[i].serial=="00:ac:30:7e:52:57:bb:81:4b:81:8d:36:33:b6:30:32:6f" or pe.signatures[i].serial=="ac:30:7e:52:57:bb:81:4b:81:8d:36:33:b6:30:32:6f") and 1606089600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Aqua Direct s.r.o." and ( pe.signatures [ i ] . serial == "00:ac:30:7e:52:57:bb:81:4b:81:8d:36:33:b6:30:32:6f" or pe.signatures [ i ] . serial == "ac:30:7e:52:57:bb:81:4b:81:8d:36:33:b6:30:32:6f" ) and 1606089600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43767,13 +43767,13 @@ rule REVERSINGLABS_Cert_Blocklist_0D83E7F47189Cdbfc7Fa3E5F58882329 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d6bda332-06fc-5b1a-99fb-fc9578dc5326"
+		id = "5a075334-2608-5dce-86dd-3f4cecf148ec"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8246-L8262"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b344f9fd6d8378b7d77a34b14c5f37eea253f3d13a8eb0777925f195fb3cf502"
+		logic_hash = "v1_sha256_b344f9fd6d8378b7d77a34b14c5f37eea253f3d13a8eb0777925f195fb3cf502"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43783,7 +43783,7 @@ rule REVERSINGLABS_Cert_Blocklist_0D83E7F47189Cdbfc7Fa3E5F58882329 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures[i].serial=="0d:83:e7:f4:71:89:cd:bf:c7:fa:3e:5f:58:88:23:29" and 1605830400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures [ i ] . serial == "0d:83:e7:f4:71:89:cd:bf:c7:fa:3e:5f:58:88:23:29" and 1605830400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43792,13 +43792,13 @@ rule REVERSINGLABS_Cert_Blocklist_58Aa64564A50E8B2D6E31D5Cd6250Fde : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "00e096f6-2955-5936-9a75-f537c2da3621"
+		id = "d6085b1b-ed30-508a-b4f1-88e165230881"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8264-L8280"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f6b50ebf707b67650fe832d81c6fe8d2411cd83432ef94432d181db0c29aa48b"
+		logic_hash = "v1_sha256_f6b50ebf707b67650fe832d81c6fe8d2411cd83432ef94432d181db0c29aa48b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43808,7 +43808,7 @@ rule REVERSINGLABS_Cert_Blocklist_58Aa64564A50E8B2D6E31D5Cd6250Fde : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foreground" and pe.signatures[i].serial=="58:aa:64:56:4a:50:e8:b2:d6:e3:1d:5c:d6:25:0f:de" and 1609002028<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Foreground" and pe.signatures [ i ] . serial == "58:aa:64:56:4a:50:e8:b2:d6:e3:1d:5c:d6:25:0f:de" and 1609002028 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43817,13 +43817,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Aa0Ae245B487C8926C88Ee6D736D1Ca : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d2d61fd7-2392-5d75-9c5b-4e4fddfc7a83"
+		id = "302f4685-6b40-54b5-9e8c-27f07f10a385"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8282-L8298"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5a362175600552983ae838ca18aa378dc748b8b68bd8b67a9387794d983ed1a2"
+		logic_hash = "v1_sha256_5a362175600552983ae838ca18aa378dc748b8b68bd8b67a9387794d983ed1a2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43833,7 +43833,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Aa0Ae245B487C8926C88Ee6D736D1Ca : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PILOTE SPRL" and pe.signatures[i].serial=="2a:a0:ae:24:5b:48:7c:89:26:c8:8e:e6:d7:36:d1:ca" and 1612262280<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PILOTE SPRL" and pe.signatures [ i ] . serial == "2a:a0:ae:24:5b:48:7c:89:26:c8:8e:e6:d7:36:d1:ca" and 1612262280 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43842,13 +43842,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Aec3D3F752A38617C1D7A677D0B5591 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "02f2bf36-e573-502c-8ecc-843a6e627c2b"
+		id = "fea0592d-c3f2-561f-9e18-c08ea85e991a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8300-L8316"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b299833a19944ca6943ba9c974ec95369c57cd61acc8b2e1b5310edd077762c2"
+		logic_hash = "v1_sha256_b299833a19944ca6943ba9c974ec95369c57cd61acc8b2e1b5310edd077762c2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43858,7 +43858,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Aec3D3F752A38617C1D7A677D0B5591 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SILVER d.o.o." and pe.signatures[i].serial=="1a:ec:3d:3f:75:2a:38:61:7c:1d:7a:67:7d:0b:55:91" and 1611705600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SILVER d.o.o." and pe.signatures [ i ] . serial == "1a:ec:3d:3f:75:2a:38:61:7c:1d:7a:67:7d:0b:55:91" and 1611705600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43867,13 +43867,13 @@ rule REVERSINGLABS_Cert_Blocklist_A7E1Dc5352C3852C5523030F57F2425C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a2795796-2897-55ad-936c-456c3b93bf14"
+		id = "58488ca8-d1a5-54c0-bd78-57e6025cc819"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8318-L8336"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "79c42c9a4eeeb69a62a16590e2b0b63818785509a40d543c7efe27ec6baaa19e"
+		logic_hash = "v1_sha256_79c42c9a4eeeb69a62a16590e2b0b63818785509a40d543c7efe27ec6baaa19e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43883,7 +43883,7 @@ rule REVERSINGLABS_Cert_Blocklist_A7E1Dc5352C3852C5523030F57F2425C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pushka LLC" and (pe.signatures[i].serial=="00:a7:e1:dc:53:52:c3:85:2c:55:23:03:0f:57:f2:42:5c" or pe.signatures[i].serial=="a7:e1:dc:53:52:c3:85:2c:55:23:03:0f:57:f2:42:5c") and 1611792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Pushka LLC" and ( pe.signatures [ i ] . serial == "00:a7:e1:dc:53:52:c3:85:2c:55:23:03:0f:57:f2:42:5c" or pe.signatures [ i ] . serial == "a7:e1:dc:53:52:c3:85:2c:55:23:03:0f:57:f2:42:5c" ) and 1611792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43892,13 +43892,13 @@ rule REVERSINGLABS_Cert_Blocklist_Bbd4Dc3768A51Aa2B3059C1Bad569276 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ee861c79-fea2-5931-873d-b76e5bdef593"
+		id = "28e4f24a-7973-5ffb-8223-c89ccf73351d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8338-L8356"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f336570834e0663c6e589fa22b3541f4f79c40ff945dd91f1fd1258a96adeceb"
+		logic_hash = "v1_sha256_f336570834e0663c6e589fa22b3541f4f79c40ff945dd91f1fd1258a96adeceb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43908,7 +43908,7 @@ rule REVERSINGLABS_Cert_Blocklist_Bbd4Dc3768A51Aa2B3059C1Bad569276 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JJ ELECTRICAL SERVICES LIMITED" and (pe.signatures[i].serial=="00:bb:d4:dc:37:68:a5:1a:a2:b3:05:9c:1b:ad:56:92:76" or pe.signatures[i].serial=="bb:d4:dc:37:68:a5:1a:a2:b3:05:9c:1b:ad:56:92:76") and 1607472000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JJ ELECTRICAL SERVICES LIMITED" and ( pe.signatures [ i ] . serial == "00:bb:d4:dc:37:68:a5:1a:a2:b3:05:9c:1b:ad:56:92:76" or pe.signatures [ i ] . serial == "bb:d4:dc:37:68:a5:1a:a2:b3:05:9c:1b:ad:56:92:76" ) and 1607472000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43917,13 +43917,13 @@ rule REVERSINGLABS_Cert_Blocklist_08622B9Dd9D78E67678Ecc21E026522E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "66d942c7-ceb9-54e5-bccc-1adf641fd70e"
+		id = "f186d873-7485-5d73-ac59-b91d986f66b3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8358-L8374"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "09507b09b035195b74434f56041588f67245fa097183228dffc612bb4901825b"
+		logic_hash = "v1_sha256_09507b09b035195b74434f56041588f67245fa097183228dffc612bb4901825b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43933,7 +43933,7 @@ rule REVERSINGLABS_Cert_Blocklist_08622B9Dd9D78E67678Ecc21E026522E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kayak Republic af 2015 APS" and pe.signatures[i].serial=="08:62:2b:9d:d9:d7:8e:67:67:8e:cc:21:e0:26:52:2e" and 1611619200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kayak Republic af 2015 APS" and pe.signatures [ i ] . serial == "08:62:2b:9d:d9:d7:8e:67:67:8e:cc:21:e0:26:52:2e" and 1611619200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43942,13 +43942,13 @@ rule REVERSINGLABS_Cert_Blocklist_E69A6De0074Ece38C2F30F0D4A808456 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "17571f1e-1dce-5216-8f45-467e5d77ccf1"
+		id = "d2387e7e-d2af-5678-9b64-6c596ecda458"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8376-L8394"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "21d8641d2394120847044f0e6f4d868095a1e30c0b594a3d045877ab9b3808a1"
+		logic_hash = "v1_sha256_21d8641d2394120847044f0e6f4d868095a1e30c0b594a3d045877ab9b3808a1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43958,7 +43958,7 @@ rule REVERSINGLABS_Cert_Blocklist_E69A6De0074Ece38C2F30F0D4A808456 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Semantic" and (pe.signatures[i].serial=="00:e6:9a:6d:e0:07:4e:ce:38:c2:f3:0f:0d:4a:80:84:56" or pe.signatures[i].serial=="e6:9a:6d:e0:07:4e:ce:38:c2:f3:0f:0d:4a:80:84:56") and 1611532800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Semantic" and ( pe.signatures [ i ] . serial == "00:e6:9a:6d:e0:07:4e:ce:38:c2:f3:0f:0d:4a:80:84:56" or pe.signatures [ i ] . serial == "e6:9a:6d:e0:07:4e:ce:38:c2:f3:0f:0d:4a:80:84:56" ) and 1611532800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43967,13 +43967,13 @@ rule REVERSINGLABS_Cert_Blocklist_8385684419Ab26A3F2640B1496E1Fe94 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "03e861a0-156e-5366-a312-dc2aa73b0393"
+		id = "341e483e-73ae-52a4-a6ca-9337addea867"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8396-L8414"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "24f75badc335160a8053a4c7e8bbd8ddbd3266c3a18059a937d5989df97ae9d9"
+		logic_hash = "v1_sha256_24f75badc335160a8053a4c7e8bbd8ddbd3266c3a18059a937d5989df97ae9d9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -43983,7 +43983,7 @@ rule REVERSINGLABS_Cert_Blocklist_8385684419Ab26A3F2640B1496E1Fe94 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CAUSE FOR CHANGE LTD" and (pe.signatures[i].serial=="00:83:85:68:44:19:ab:26:a3:f2:64:0b:14:96:e1:fe:94" or pe.signatures[i].serial=="83:85:68:44:19:ab:26:a3:f2:64:0b:14:96:e1:fe:94") and 1612137600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CAUSE FOR CHANGE LTD" and ( pe.signatures [ i ] . serial == "00:83:85:68:44:19:ab:26:a3:f2:64:0b:14:96:e1:fe:94" or pe.signatures [ i ] . serial == "83:85:68:44:19:ab:26:a3:f2:64:0b:14:96:e1:fe:94" ) and 1612137600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -43992,13 +43992,13 @@ rule REVERSINGLABS_Cert_Blocklist_21E3Cae5B77C41528658Ada08509C392 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fdb1903b-15c1-5cb7-892f-58957303d3b4"
+		id = "730833d4-db48-5890-b44a-ae80c9e3ad71"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8416-L8432"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2e24ed0bd0bf3c36cae4bf106a2c17386bfb58b76372068be9745c2d501f30fc"
+		logic_hash = "v1_sha256_2e24ed0bd0bf3c36cae4bf106a2c17386bfb58b76372068be9745c2d501f30fc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44008,7 +44008,7 @@ rule REVERSINGLABS_Cert_Blocklist_21E3Cae5B77C41528658Ada08509C392 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Network Design International Holdings Limited" and pe.signatures[i].serial=="21:e3:ca:e5:b7:7c:41:52:86:58:ad:a0:85:09:c3:92" and 1609233559<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Network Design International Holdings Limited" and pe.signatures [ i ] . serial == "21:e3:ca:e5:b7:7c:41:52:86:58:ad:a0:85:09:c3:92" and 1609233559 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44017,13 +44017,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Abd2Eef14D480Dfea9Ca9Fdd823Cf03 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d6cb1371-113d-5155-aed2-c575321f0973"
+		id = "e8d0936e-8189-5f6f-a6ea-b4c034780854"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8434-L8450"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2dfc220c44d3dda28a253e5115ae9a087b6ddbf1a7ca1e9bcae5bd9ac5b2e1a0"
+		logic_hash = "v1_sha256_2dfc220c44d3dda28a253e5115ae9a087b6ddbf1a7ca1e9bcae5bd9ac5b2e1a0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44033,7 +44033,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Abd2Eef14D480Dfea9Ca9Fdd823Cf03 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BE SOL d.o.o." and pe.signatures[i].serial=="2a:bd:2e:ef:14:d4:80:df:ea:9c:a9:fd:d8:23:cf:03" and 1611100800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BE SOL d.o.o." and pe.signatures [ i ] . serial == "2a:bd:2e:ef:14:d4:80:df:ea:9c:a9:fd:d8:23:cf:03" and 1611100800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44042,13 +44042,13 @@ rule REVERSINGLABS_Cert_Blocklist_86909B91F07F9316984D888D1E28Ab76 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3cde0016-14d8-5b3a-860e-f5128f899542"
+		id = "f2518af1-f3e2-5097-87aa-ba404b12ba83"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8452-L8470"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "abd84492ed008125688a53e20d51780fa0b8c2309dcf751ff76a03d6f337beaa"
+		logic_hash = "v1_sha256_abd84492ed008125688a53e20d51780fa0b8c2309dcf751ff76a03d6f337beaa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44058,7 +44058,7 @@ rule REVERSINGLABS_Cert_Blocklist_86909B91F07F9316984D888D1E28Ab76 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dantherm Intelligent Monitoring A/S" and (pe.signatures[i].serial=="00:86:90:9b:91:f0:7f:93:16:98:4d:88:8d:1e:28:ab:76" or pe.signatures[i].serial=="86:90:9b:91:f0:7f:93:16:98:4d:88:8d:1e:28:ab:76") and 1611273600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dantherm Intelligent Monitoring A/S" and ( pe.signatures [ i ] . serial == "00:86:90:9b:91:f0:7f:93:16:98:4d:88:8d:1e:28:ab:76" or pe.signatures [ i ] . serial == "86:90:9b:91:f0:7f:93:16:98:4d:88:8d:1e:28:ab:76" ) and 1611273600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44067,13 +44067,13 @@ rule REVERSINGLABS_Cert_Blocklist_D1B8F1Fe56381Befdb2E73Ffef2A4B28 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "226371ea-670f-52f2-8dfc-78b30a29a5cc"
+		id = "a1bc09ab-3a56-576d-9b2b-cb30ba0cae57"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8472-L8490"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c118cb46914e7a6df8dd33dd14d5f9cf2692d98311503ec850cc66f02c20839e"
+		logic_hash = "v1_sha256_c118cb46914e7a6df8dd33dd14d5f9cf2692d98311503ec850cc66f02c20839e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44083,7 +44083,7 @@ rule REVERSINGLABS_Cert_Blocklist_D1B8F1Fe56381Befdb2E73Ffef2A4B28 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sein\\xC3\\xA4joen Squash ja Bowling Oy" and (pe.signatures[i].serial=="00:d1:b8:f1:fe:56:38:1b:ef:db:2e:73:ff:ef:2a:4b:28" or pe.signatures[i].serial=="d1:b8:f1:fe:56:38:1b:ef:db:2e:73:ff:ef:2a:4b:28") and 1617667200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sein\\xC3\\xA4joen Squash ja Bowling Oy" and ( pe.signatures [ i ] . serial == "00:d1:b8:f1:fe:56:38:1b:ef:db:2e:73:ff:ef:2a:4b:28" or pe.signatures [ i ] . serial == "d1:b8:f1:fe:56:38:1b:ef:db:2e:73:ff:ef:2a:4b:28" ) and 1617667200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44092,13 +44092,13 @@ rule REVERSINGLABS_Cert_Blocklist_D4Ef1Ab6Ab5D3Cb35E4Efb7984Def7A2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "41b2e05f-1dcd-5ebc-97da-275512deaf72"
+		id = "f2dbfdb3-6dd9-5b25-8ae5-81099d3edf90"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8492-L8510"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ecc2f6bfda1a0afd016f0a5183c0d1cdfe5d5e06c893a7d9a3d7cb7f9bc4bf16"
+		logic_hash = "v1_sha256_ecc2f6bfda1a0afd016f0a5183c0d1cdfe5d5e06c893a7d9a3d7cb7f9bc4bf16"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44108,7 +44108,7 @@ rule REVERSINGLABS_Cert_Blocklist_D4Ef1Ab6Ab5D3Cb35E4Efb7984Def7A2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REIGN BROS ApS" and (pe.signatures[i].serial=="00:d4:ef:1a:b6:ab:5d:3c:b3:5e:4e:fb:79:84:de:f7:a2" or pe.signatures[i].serial=="d4:ef:1a:b6:ab:5d:3c:b3:5e:4e:fb:79:84:de:f7:a2") and 1611187200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "REIGN BROS ApS" and ( pe.signatures [ i ] . serial == "00:d4:ef:1a:b6:ab:5d:3c:b3:5e:4e:fb:79:84:de:f7:a2" or pe.signatures [ i ] . serial == "d4:ef:1a:b6:ab:5d:3c:b3:5e:4e:fb:79:84:de:f7:a2" ) and 1611187200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44117,13 +44117,13 @@ rule REVERSINGLABS_Cert_Blocklist_066276Af2F2C7E246D3B1Cab1B4Aa42E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "97f791d5-7a73-5da7-984e-32bb94d0e83f"
+		id = "a8423f22-a442-5500-b963-e511116dd148"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8512-L8528"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "30d4fa2cbc75d3a6258cdf0374159f25ea152c39784f8b7e9c461978df865dc0"
+		logic_hash = "v1_sha256_30d4fa2cbc75d3a6258cdf0374159f25ea152c39784f8b7e9c461978df865dc0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44133,7 +44133,7 @@ rule REVERSINGLABS_Cert_Blocklist_066276Af2F2C7E246D3B1Cab1B4Aa42E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IQ Trade ApS" and pe.signatures[i].serial=="06:62:76:af:2f:2c:7e:24:6d:3b:1c:ab:1b:4a:a4:2e" and 1616630400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IQ Trade ApS" and pe.signatures [ i ] . serial == "06:62:76:af:2f:2c:7e:24:6d:3b:1c:ab:1b:4a:a4:2e" and 1616630400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44142,13 +44142,13 @@ rule REVERSINGLABS_Cert_Blocklist_65Cd323C2483668B90A44A711D2A6B98 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e2ed910d-2264-58c1-a1a0-3c131020a2cf"
+		id = "6a1059af-af43-5558-aaf9-2eaea84a4283"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8530-L8546"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "653aff6f3913f1bf51e90e7a835dbb5441457175797cefdddd234a6c2c0f11ad"
+		logic_hash = "v1_sha256_653aff6f3913f1bf51e90e7a835dbb5441457175797cefdddd234a6c2c0f11ad"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44158,7 +44158,7 @@ rule REVERSINGLABS_Cert_Blocklist_65Cd323C2483668B90A44A711D2A6B98 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Giperion" and pe.signatures[i].serial=="65:cd:32:3c:24:83:66:8b:90:a4:4a:71:1d:2a:6b:98" and 1602547200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Giperion" and pe.signatures [ i ] . serial == "65:cd:32:3c:24:83:66:8b:90:a4:4a:71:1d:2a:6b:98" and 1602547200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44167,13 +44167,13 @@ rule REVERSINGLABS_Cert_Blocklist_5A17D5De74Fd8F09Df596Df3123139Bb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4a3ffa4a-c080-5d76-9655-010cde091ae2"
+		id = "678a3c0c-64ab-5f00-86aa-ff1485e1d505"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8548-L8564"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7ed62740fe191d961ad32b2a79463cc9cbce557ea757e413860f7b4974904c03"
+		logic_hash = "v1_sha256_7ed62740fe191d961ad32b2a79463cc9cbce557ea757e413860f7b4974904c03"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44183,7 +44183,7 @@ rule REVERSINGLABS_Cert_Blocklist_5A17D5De74Fd8F09Df596Df3123139Bb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTA FIS d.o.o." and pe.signatures[i].serial=="5a:17:d5:de:74:fd:8f:09:df:59:6d:f3:12:31:39:bb" and 1611273600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ACTA FIS d.o.o." and pe.signatures [ i ] . serial == "5a:17:d5:de:74:fd:8f:09:df:59:6d:f3:12:31:39:bb" and 1611273600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44192,13 +44192,13 @@ rule REVERSINGLABS_Cert_Blocklist_15Da61D7E1A631803431561674Fb9B90 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "07518dc2-bd6c-5a4c-b537-68f5a462cdc2"
+		id = "1ef26a79-29f9-519b-abbf-ea8618b184ef"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8566-L8582"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "75d2c3b47fe9c863812f2c98fc565af9050b909a03528e2ea4a96542a3ec0c0d"
+		logic_hash = "v1_sha256_75d2c3b47fe9c863812f2c98fc565af9050b909a03528e2ea4a96542a3ec0c0d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44208,7 +44208,7 @@ rule REVERSINGLABS_Cert_Blocklist_15Da61D7E1A631803431561674Fb9B90 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JAY DANCE STUDIO d.o.o." and pe.signatures[i].serial=="15:da:61:d7:e1:a6:31:80:34:31:56:16:74:fb:9b:90" and 1610668800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JAY DANCE STUDIO d.o.o." and pe.signatures [ i ] . serial == "15:da:61:d7:e1:a6:31:80:34:31:56:16:74:fb:9b:90" and 1610668800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44217,13 +44217,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Ab21306B11Ff280A93Fc445876988Ab : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "656bb2a6-bb41-5190-af10-280351e64c66"
+		id = "1a3b5130-8d6d-51d0-bb3b-69d97e65d28d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8584-L8600"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0cda954aa807336a6737716d0fa43d696376c240ab7be9d8477baf8800604bf1"
+		logic_hash = "v1_sha256_0cda954aa807336a6737716d0fa43d696376c240ab7be9d8477baf8800604bf1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44233,7 +44233,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Ab21306B11Ff280A93Fc445876988Ab : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABC BIOS d.o.o." and pe.signatures[i].serial=="7a:b2:13:06:b1:1f:f2:80:a9:3f:c4:45:87:69:88:ab" and 1611014400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ABC BIOS d.o.o." and pe.signatures [ i ] . serial == "7a:b2:13:06:b1:1f:f2:80:a9:3f:c4:45:87:69:88:ab" and 1611014400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44242,13 +44242,13 @@ rule REVERSINGLABS_Cert_Blocklist_634E16E38F12E9A71Aca08E4C6B2Dbb9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4aa7bea7-06fb-5d90-bac4-c8ca1ca5c02f"
+		id = "be400dee-54c0-54c1-a20a-9c4376c7cc2c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8602-L8618"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "08950f276e5cf3fe4b5f7421ba671dfd72585aac3bbed7868fdb0e5aa90ec10e"
+		logic_hash = "v1_sha256_08950f276e5cf3fe4b5f7421ba671dfd72585aac3bbed7868fdb0e5aa90ec10e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44258,7 +44258,7 @@ rule REVERSINGLABS_Cert_Blocklist_634E16E38F12E9A71Aca08E4C6B2Dbb9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AUTO RESPONSE LTD CYF" and pe.signatures[i].serial=="63:4e:16:e3:8f:12:e9:a7:1a:ca:08:e4:c6:b2:db:b9" and 1616112000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AUTO RESPONSE LTD CYF" and pe.signatures [ i ] . serial == "63:4e:16:e3:8f:12:e9:a7:1a:ca:08:e4:c6:b2:db:b9" and 1616112000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44267,13 +44267,13 @@ rule REVERSINGLABS_Cert_Blocklist_289051A83F350A2C600187C99B6C0A73 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "55497d57-7d4f-50e1-85a6-e60786084e3f"
+		id = "6b1b5584-d564-5e91-b131-d0f3a9ece262"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8620-L8636"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cd5d6f95f0cfdbf8d37ea78d061ce00512b6cb7c899152b1640673494d539dd1"
+		logic_hash = "v1_sha256_cd5d6f95f0cfdbf8d37ea78d061ce00512b6cb7c899152b1640673494d539dd1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44283,7 +44283,7 @@ rule REVERSINGLABS_Cert_Blocklist_289051A83F350A2C600187C99B6C0A73 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HALL HAULAGE LTD LTD" and pe.signatures[i].serial=="28:90:51:a8:3f:35:0a:2c:60:01:87:c9:9b:6c:0a:73" and 1616716800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HALL HAULAGE LTD LTD" and pe.signatures [ i ] . serial == "28:90:51:a8:3f:35:0a:2c:60:01:87:c9:9b:6c:0a:73" and 1616716800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44292,13 +44292,13 @@ rule REVERSINGLABS_Cert_Blocklist_818631110B5D14331Dac7E6Ad998B902 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6a8f3abd-199c-5e2f-a60e-46e869831445"
+		id = "b0a0e69a-2644-5526-890d-4c5982e94ed8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8638-L8656"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5e0de3848adf933632c2eb8cf5ead61d6470237386ba8b48d57a278d99dba324"
+		logic_hash = "v1_sha256_5e0de3848adf933632c2eb8cf5ead61d6470237386ba8b48d57a278d99dba324"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44308,7 +44308,7 @@ rule REVERSINGLABS_Cert_Blocklist_818631110B5D14331Dac7E6Ad998B902 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2 TOY GUYS LLC" and (pe.signatures[i].serial=="00:81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02" or pe.signatures[i].serial=="81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02") and 1571616000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "2 TOY GUYS LLC" and ( pe.signatures [ i ] . serial == "00:81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02" or pe.signatures [ i ] . serial == "81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02" ) and 1571616000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44317,13 +44317,13 @@ rule REVERSINGLABS_Cert_Blocklist_277Cd16De5D61B9398B645Afe41C09C7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d863faac-7b6e-5e1d-960f-8379347c6838"
+		id = "27967cb8-6026-5f8f-8090-2aeca34d0004"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8658-L8674"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "696467d699dec060b205f36f53dbe157b241823757d72798b35235d6530fd193"
+		logic_hash = "v1_sha256_696467d699dec060b205f36f53dbe157b241823757d72798b35235d6530fd193"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44333,7 +44333,7 @@ rule REVERSINGLABS_Cert_Blocklist_277Cd16De5D61B9398B645Afe41C09C7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE SIGN COMPANY LIMITED" and pe.signatures[i].serial=="27:7c:d1:6d:e5:d6:1b:93:98:b6:45:af:e4:1c:09:c7" and 1619049600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THE SIGN COMPANY LIMITED" and pe.signatures [ i ] . serial == "27:7c:d1:6d:e5:d6:1b:93:98:b6:45:af:e4:1c:09:c7" and 1619049600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44342,13 +44342,13 @@ rule REVERSINGLABS_Cert_Blocklist_D0Eda76C13D30C97015708790Bb94214 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "aa323bac-a9f5-560f-b44a-3cf2b26351bb"
+		id = "faa2e47c-3370-5de9-af17-a3f239ad1ba5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8676-L8694"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2112ebfb7c9ebbbccb20cefcd23bb49142da770feb16ee8eef5eb27646226785"
+		logic_hash = "v1_sha256_2112ebfb7c9ebbbccb20cefcd23bb49142da770feb16ee8eef5eb27646226785"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44358,7 +44358,7 @@ rule REVERSINGLABS_Cert_Blocklist_D0Eda76C13D30C97015708790Bb94214 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LAEN ApS" and (pe.signatures[i].serial=="00:d0:ed:a7:6c:13:d3:0c:97:01:57:08:79:0b:b9:42:14" or pe.signatures[i].serial=="d0:ed:a7:6c:13:d3:0c:97:01:57:08:79:0b:b9:42:14") and 1619136000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LAEN ApS" and ( pe.signatures [ i ] . serial == "00:d0:ed:a7:6c:13:d3:0c:97:01:57:08:79:0b:b9:42:14" or pe.signatures [ i ] . serial == "d0:ed:a7:6c:13:d3:0c:97:01:57:08:79:0b:b9:42:14" ) and 1619136000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44367,13 +44367,13 @@ rule REVERSINGLABS_Cert_Blocklist_6333Ed618F88A05B4D82Ad7Bf66Cb0Fa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c4d3603e-57e2-57df-a055-c43d449242c7"
+		id = "e696c6fa-2cc4-5ac9-9119-09db0063cac4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8696-L8712"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b088ac4b74a8cf3dddb67c8de2b7c3c5f537287a0454c0030c0eb4069c465c7d"
+		logic_hash = "v1_sha256_b088ac4b74a8cf3dddb67c8de2b7c3c5f537287a0454c0030c0eb4069c465c7d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44383,7 +44383,7 @@ rule REVERSINGLABS_Cert_Blocklist_6333Ed618F88A05B4D82Ad7Bf66Cb0Fa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RHM LIMITED" and pe.signatures[i].serial=="63:33:ed:61:8f:88:a0:5b:4d:82:ad:7b:f6:6c:b0:fa" and 1616457600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RHM LIMITED" and pe.signatures [ i ] . serial == "63:33:ed:61:8f:88:a0:5b:4d:82:ad:7b:f6:6c:b0:fa" and 1616457600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44392,13 +44392,13 @@ rule REVERSINGLABS_Cert_Blocklist_3B777165B125Bccc181D0Bac3F5B55B3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f065e99f-9cce-55cb-a592-60b89c26028a"
+		id = "ed7f7ee9-78ec-5336-b438-f30e6201789d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8714-L8730"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "80aff3d6f45f5847d5d39b170b9d0e70168d02569ca6d86a2c39150399d290fc"
+		logic_hash = "v1_sha256_80aff3d6f45f5847d5d39b170b9d0e70168d02569ca6d86a2c39150399d290fc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44408,7 +44408,7 @@ rule REVERSINGLABS_Cert_Blocklist_3B777165B125Bccc181D0Bac3F5B55B3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STAND ALONE MUSIC LTD" and pe.signatures[i].serial=="3b:77:71:65:b1:25:bc:cc:18:1d:0b:ac:3f:5b:55:b3" and 1607299200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "STAND ALONE MUSIC LTD" and pe.signatures [ i ] . serial == "3b:77:71:65:b1:25:bc:cc:18:1d:0b:ac:3f:5b:55:b3" and 1607299200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44417,13 +44417,13 @@ rule REVERSINGLABS_Cert_Blocklist_5B37Ac3479283B6F9D75Ddf0F8742D06 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cc124d3f-2446-57a2-a206-0a5e569fc703"
+		id = "c440013d-942a-5056-911b-67b7c0389a82"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8732-L8748"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b7abd389ac31cd970e6611c7c303714fdd658f45d4857ad524f5e8368edbb875"
+		logic_hash = "v1_sha256_b7abd389ac31cd970e6611c7c303714fdd658f45d4857ad524f5e8368edbb875"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44433,7 +44433,7 @@ rule REVERSINGLABS_Cert_Blocklist_5B37Ac3479283B6F9D75Ddf0F8742D06 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ART BOOK PHOTO s.r.o." and pe.signatures[i].serial=="5b:37:ac:34:79:28:3b:6f:9d:75:dd:f0:f8:74:2d:06" and 1619740800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ART BOOK PHOTO s.r.o." and pe.signatures [ i ] . serial == "5b:37:ac:34:79:28:3b:6f:9d:75:dd:f0:f8:74:2d:06" and 1619740800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44442,13 +44442,13 @@ rule REVERSINGLABS_Cert_Blocklist_3112C69D460C781Fd649C71E61Bfec82 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f4d2f240-49a7-51f3-8db1-1c569aa63177"
+		id = "b6b1a06c-a014-55cf-9201-ea672531a63f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8750-L8766"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ed31b0a24d18a451163867f0f49df12af3ca0768f250ac8ce66d41405393130d"
+		logic_hash = "v1_sha256_ed31b0a24d18a451163867f0f49df12af3ca0768f250ac8ce66d41405393130d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44458,7 +44458,7 @@ rule REVERSINGLABS_Cert_Blocklist_3112C69D460C781Fd649C71E61Bfec82 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KREATURHANDLER BJARNE ANDERSEN ApS" and pe.signatures[i].serial=="31:12:c6:9d:46:0c:78:1f:d6:49:c7:1e:61:bf:ec:82" and 1614902400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KREATURHANDLER BJARNE ANDERSEN ApS" and pe.signatures [ i ] . serial == "31:12:c6:9d:46:0c:78:1f:d6:49:c7:1e:61:bf:ec:82" and 1614902400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44467,13 +44467,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A5B4F67Ad8B22Afc2Debe6Ce5F8F679 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7dd5ba42-2d04-52d7-b15a-2bdba2e742fb"
+		id = "14b2c6d6-7a44-5316-9653-c5bad26483b7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8768-L8784"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "938efb7ee19970484aded5cd46b2ff730f8882706bec3f062bdebde3cc9a4799"
+		logic_hash = "v1_sha256_938efb7ee19970484aded5cd46b2ff730f8882706bec3f062bdebde3cc9a4799"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44483,7 +44483,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A5B4F67Ad8B22Afc2Debe6Ce5F8F679 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Farad LLC" and pe.signatures[i].serial=="0a:5b:4f:67:ad:8b:22:af:c2:de:be:6c:e5:f8:f6:79" and 1607472000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Farad LLC" and pe.signatures [ i ] . serial == "0a:5b:4f:67:ad:8b:22:af:c2:de:be:6c:e5:f8:f6:79" and 1607472000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44492,13 +44492,13 @@ rule REVERSINGLABS_Cert_Blocklist_Df45B36C9D0Bd248C3F9494E7Ca822 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d7d0d1c4-b341-5651-8179-4035f537ba98"
+		id = "831ec8a5-9b0e-5409-a700-4db2eba0453e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8786-L8804"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9c03522376b0d807cd36a0641e474d770bc3b4f8221f26d232878d2d320d072b"
+		logic_hash = "v1_sha256_9c03522376b0d807cd36a0641e474d770bc3b4f8221f26d232878d2d320d072b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44508,7 +44508,7 @@ rule REVERSINGLABS_Cert_Blocklist_Df45B36C9D0Bd248C3F9494E7Ca822 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MPO STORITVE d.o.o." and (pe.signatures[i].serial=="00:df:45:b3:6c:9d:0b:d2:48:c3:f9:49:4e:7c:a8:22" or pe.signatures[i].serial=="df:45:b3:6c:9d:0b:d2:48:c3:f9:49:4e:7c:a8:22") and 1619740800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MPO STORITVE d.o.o." and ( pe.signatures [ i ] . serial == "00:df:45:b3:6c:9d:0b:d2:48:c3:f9:49:4e:7c:a8:22" or pe.signatures [ i ] . serial == "df:45:b3:6c:9d:0b:d2:48:c3:f9:49:4e:7c:a8:22" ) and 1619740800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44517,13 +44517,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Ae3C4Eccecda2127D43Be390A850Dda : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a9d8906b-64f6-5c5d-80e0-ab916e83b613"
+		id = "cecfde0c-3737-5f70-a119-23d76c41f5d3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8806-L8822"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8a2ff4f7a5ac996127778b1670e79291bddcb5dee6e7da2b540fd254537ee27e"
+		logic_hash = "v1_sha256_8a2ff4f7a5ac996127778b1670e79291bddcb5dee6e7da2b540fd254537ee27e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44533,7 +44533,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Ae3C4Eccecda2127D43Be390A850Dda : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PARTYNET LIMITED" and pe.signatures[i].serial=="1a:e3:c4:ec:ce:cd:a2:12:7d:43:be:39:0a:85:0d:da" and 1614902400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PARTYNET LIMITED" and pe.signatures [ i ] . serial == "1a:e3:c4:ec:ce:cd:a2:12:7d:43:be:39:0a:85:0d:da" and 1614902400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44542,13 +44542,13 @@ rule REVERSINGLABS_Cert_Blocklist_2E36360538624C9B1Afd78A2Fb756028 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "549a566b-0c94-516c-9231-a5e54136785f"
+		id = "f30dbe31-50bc-5d0c-9adb-75b6e5f8e3d0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8824-L8840"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9cbb50c7d383048fd506506fa9ee8bf7c6d82feaf21bcde4008ab99b82e234a7"
+		logic_hash = "v1_sha256_9cbb50c7d383048fd506506fa9ee8bf7c6d82feaf21bcde4008ab99b82e234a7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44558,7 +44558,7 @@ rule REVERSINGLABS_Cert_Blocklist_2E36360538624C9B1Afd78A2Fb756028 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ts Trade ApS" and pe.signatures[i].serial=="2e:36:36:05:38:62:4c:9b:1a:fd:78:a2:fb:75:60:28" and 1615766400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ts Trade ApS" and pe.signatures [ i ] . serial == "2e:36:36:05:38:62:4c:9b:1a:fd:78:a2:fb:75:60:28" and 1615766400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44567,13 +44567,13 @@ rule REVERSINGLABS_Cert_Blocklist_Addb899F8229Fd53E6435E08Bbd3A733 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1e5f0577-ba05-5e43-a817-c75f65547c3d"
+		id = "302fbb48-ed03-5b04-b466-5165302af1a8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8842-L8860"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ecb8e31b8c56b92cef601618e0adc2f6d88999318805b92389693aa9e8050d18"
+		logic_hash = "v1_sha256_ecb8e31b8c56b92cef601618e0adc2f6d88999318805b92389693aa9e8050d18"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44583,7 +44583,7 @@ rule REVERSINGLABS_Cert_Blocklist_Addb899F8229Fd53E6435E08Bbd3A733 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "U.K. STEEL EXPORTS LIMITED" and (pe.signatures[i].serial=="00:ad:db:89:9f:82:29:fd:53:e6:43:5e:08:bb:d3:a7:33" or pe.signatures[i].serial=="ad:db:89:9f:82:29:fd:53:e6:43:5e:08:bb:d3:a7:33") and 1616630400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "U.K. STEEL EXPORTS LIMITED" and ( pe.signatures [ i ] . serial == "00:ad:db:89:9f:82:29:fd:53:e6:43:5e:08:bb:d3:a7:33" or pe.signatures [ i ] . serial == "ad:db:89:9f:82:29:fd:53:e6:43:5e:08:bb:d3:a7:33" ) and 1616630400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44592,13 +44592,13 @@ rule REVERSINGLABS_Cert_Blocklist_C1A1Db95D7Bf80290Aa6E82D8F8F996A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c04a2731-5eb8-5db4-9e88-cab9b61952e4"
+		id = "d470433f-0996-58a3-8d27-84e083231c3f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8862-L8880"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "84c7c0e53facadcdfd752e9cf3811fbfd6aac4bef4109acf430a67b6dcd37bfc"
+		logic_hash = "v1_sha256_84c7c0e53facadcdfd752e9cf3811fbfd6aac4bef4109acf430a67b6dcd37bfc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44608,7 +44608,7 @@ rule REVERSINGLABS_Cert_Blocklist_C1A1Db95D7Bf80290Aa6E82D8F8F996A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Software Two Pty Ltd" and (pe.signatures[i].serial=="00:c1:a1:db:95:d7:bf:80:29:0a:a6:e8:2d:8f:8f:99:6a" or pe.signatures[i].serial=="c1:a1:db:95:d7:bf:80:29:0a:a6:e8:2d:8f:8f:99:6a") and 1615334400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Software Two Pty Ltd" and ( pe.signatures [ i ] . serial == "00:c1:a1:db:95:d7:bf:80:29:0a:a6:e8:2d:8f:8f:99:6a" or pe.signatures [ i ] . serial == "c1:a1:db:95:d7:bf:80:29:0a:a6:e8:2d:8f:8f:99:6a" ) and 1615334400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44617,13 +44617,13 @@ rule REVERSINGLABS_Cert_Blocklist_C667Ffe3A5B0A5Ae7Cf3A9E41682E91B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "83a5e5c2-0932-526b-80aa-800b37088bbd"
+		id = "df9450a7-a3a1-5dd4-8877-1c75ba8f420a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8882-L8900"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "be2cd688f2d7c458ee764bd7a7250e0116328702db5585b444d631f05cdc701b"
+		logic_hash = "v1_sha256_be2cd688f2d7c458ee764bd7a7250e0116328702db5585b444d631f05cdc701b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44633,7 +44633,7 @@ rule REVERSINGLABS_Cert_Blocklist_C667Ffe3A5B0A5Ae7Cf3A9E41682E91B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NAILS UNLIMITED LIMITED" and (pe.signatures[i].serial=="00:c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b" or pe.signatures[i].serial=="c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b") and 1616976000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NAILS UNLIMITED LIMITED" and ( pe.signatures [ i ] . serial == "00:c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b" or pe.signatures [ i ] . serial == "c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b" ) and 1616976000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44642,13 +44642,13 @@ rule REVERSINGLABS_Cert_Blocklist_E0A83917660D05Cf476374659D3C7B85 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3387f396-01f7-58b1-a5bd-b308105c66d6"
+		id = "7271b540-9fd0-58e9-9d5b-0a898cfb52a6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8902-L8920"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f60753ecb775d664e07e78611568799eaf06fb4742bcef3bf0c28202daf98c50"
+		logic_hash = "v1_sha256_f60753ecb775d664e07e78611568799eaf06fb4742bcef3bf0c28202daf98c50"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44658,7 +44658,7 @@ rule REVERSINGLABS_Cert_Blocklist_E0A83917660D05Cf476374659D3C7B85 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PIK MOTEL S.R.L." and (pe.signatures[i].serial=="00:e0:a8:39:17:66:0d:05:cf:47:63:74:65:9d:3c:7b:85" or pe.signatures[i].serial=="e0:a8:39:17:66:0d:05:cf:47:63:74:65:9d:3c:7b:85") and 1621468800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PIK MOTEL S.R.L." and ( pe.signatures [ i ] . serial == "00:e0:a8:39:17:66:0d:05:cf:47:63:74:65:9d:3c:7b:85" or pe.signatures [ i ] . serial == "e0:a8:39:17:66:0d:05:cf:47:63:74:65:9d:3c:7b:85" ) and 1621468800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44667,13 +44667,13 @@ rule REVERSINGLABS_Cert_Blocklist_Afc5522898143Aafaab7Fd52304Cf00C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "016ad027-bd6a-58e0-9099-341b81dd6f70"
+		id = "9213d2e1-dd3c-59e9-8c6a-f361b98f4ca5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8922-L8940"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bfcf2fbbd9be97202eeb44c0f81f0a0713d4d30c466f2b170231c7f9df0e9e6d"
+		logic_hash = "v1_sha256_bfcf2fbbd9be97202eeb44c0f81f0a0713d4d30c466f2b170231c7f9df0e9e6d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44683,7 +44683,7 @@ rule REVERSINGLABS_Cert_Blocklist_Afc5522898143Aafaab7Fd52304Cf00C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "YAN CHING LIMITED" and (pe.signatures[i].serial=="00:af:c5:52:28:98:14:3a:af:aa:b7:fd:52:30:4c:f0:0c" or pe.signatures[i].serial=="af:c5:52:28:98:14:3a:af:aa:b7:fd:52:30:4c:f0:0c") and 1622419200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "YAN CHING LIMITED" and ( pe.signatures [ i ] . serial == "00:af:c5:52:28:98:14:3a:af:aa:b7:fd:52:30:4c:f0:0c" or pe.signatures [ i ] . serial == "af:c5:52:28:98:14:3a:af:aa:b7:fd:52:30:4c:f0:0c" ) and 1622419200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44692,13 +44692,13 @@ rule REVERSINGLABS_Cert_Blocklist_8B3333D32B2C2A1D33B41Ba5Db9D4D2D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f7f72cd2-0bf4-5aa7-804e-4ae354eda055"
+		id = "06a8c9dd-8e8d-5bb6-ab02-736515352d87"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8942-L8960"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cdb3f1983ed17df22d17c6321bc2ead2c391d70fdca4a9f6f4784f62196b85d0"
+		logic_hash = "v1_sha256_cdb3f1983ed17df22d17c6321bc2ead2c391d70fdca4a9f6f4784f62196b85d0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44708,7 +44708,7 @@ rule REVERSINGLABS_Cert_Blocklist_8B3333D32B2C2A1D33B41Ba5Db9D4D2D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BOOK CAF\\xC3\\x89, s.r.o." and (pe.signatures[i].serial=="00:8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d" or pe.signatures[i].serial=="8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d") and 1620000000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BOOK CAF\\xC3\\x89, s.r.o." and ( pe.signatures [ i ] . serial == "00:8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d" or pe.signatures [ i ] . serial == "8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d" ) and 1620000000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44717,13 +44717,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fbb1198Bd8Bddb0D693Eb72A8613Fe3F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f9983426-9f05-56e2-8ad0-1c5a48ab04be"
+		id = "28db12e1-979d-5ce3-97c3-98ef7e0e4cf2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8962-L8980"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2e004116d0f8df5a625b190127655926336fc74b4cce4ae40cd516a135e5d719"
+		logic_hash = "v1_sha256_2e004116d0f8df5a625b190127655926336fc74b4cce4ae40cd516a135e5d719"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44733,7 +44733,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fbb1198Bd8Bddb0D693Eb72A8613Fe3F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trade Hunters, s. r. o." and (pe.signatures[i].serial=="00:fb:b1:19:8b:d8:bd:db:0d:69:3e:b7:2a:86:13:fe:3f" or pe.signatures[i].serial=="fb:b1:19:8b:d8:bd:db:0d:69:3e:b7:2a:86:13:fe:3f") and 1620000000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Trade Hunters, s. r. o." and ( pe.signatures [ i ] . serial == "00:fb:b1:19:8b:d8:bd:db:0d:69:3e:b7:2a:86:13:fe:3f" or pe.signatures [ i ] . serial == "fb:b1:19:8b:d8:bd:db:0d:69:3e:b7:2a:86:13:fe:3f" ) and 1620000000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44742,13 +44742,13 @@ rule REVERSINGLABS_Cert_Blocklist_846F77D9919Fc4405Aefe1701309Bd67 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c326fbf0-2d95-5aa1-9ae4-6cb04b9c2212"
+		id = "7ac97a9f-926f-5c02-887c-e52af634b072"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L8982-L9000"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6739049a61183d506daf9aaf44a3b15cbf2234c6af307ec95bc07fa3d8501105"
+		logic_hash = "v1_sha256_6739049a61183d506daf9aaf44a3b15cbf2234c6af307ec95bc07fa3d8501105"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44758,7 +44758,7 @@ rule REVERSINGLABS_Cert_Blocklist_846F77D9919Fc4405Aefe1701309Bd67 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IPM Skupina d.o.o." and (pe.signatures[i].serial=="00:84:6f:77:d9:91:9f:c4:40:5a:ef:e1:70:13:09:bd:67" or pe.signatures[i].serial=="84:6f:77:d9:91:9f:c4:40:5a:ef:e1:70:13:09:bd:67") and 1621382400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IPM Skupina d.o.o." and ( pe.signatures [ i ] . serial == "00:84:6f:77:d9:91:9f:c4:40:5a:ef:e1:70:13:09:bd:67" or pe.signatures [ i ] . serial == "84:6f:77:d9:91:9f:c4:40:5a:ef:e1:70:13:09:bd:67" ) and 1621382400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44767,13 +44767,13 @@ rule REVERSINGLABS_Cert_Blocklist_0939C2Bad859C0432E8E98A6C0162C02 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5dba4570-51d8-5c23-85a5-5de9a048793f"
+		id = "aa1e7585-ad21-51db-8dd2-474fe0eae075"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9002-L9018"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3c48241e52e58600bfa0385742831dba59d9cbd959cd6853fe8e030f5df79c23"
+		logic_hash = "v1_sha256_3c48241e52e58600bfa0385742831dba59d9cbd959cd6853fe8e030f5df79c23"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44783,7 +44783,7 @@ rule REVERSINGLABS_Cert_Blocklist_0939C2Bad859C0432E8E98A6C0162C02 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Activ Expeditions ApS" and pe.signatures[i].serial=="09:39:c2:ba:d8:59:c0:43:2e:8e:98:a6:c0:16:2c:02" and 1615939200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Activ Expeditions ApS" and pe.signatures [ i ] . serial == "09:39:c2:ba:d8:59:c0:43:2e:8e:98:a6:c0:16:2c:02" and 1615939200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44792,13 +44792,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Fba0E19919Ac50D700Ba60250D02C8B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8828c863-2800-5f66-968e-96a41a071218"
+		id = "4bf10cfc-d821-5019-8bab-0dac957182c4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9020-L9036"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8c803111df930056bdc3ef7560f07bf4d255b93286d01ecc55f790e72565ba5d"
+		logic_hash = "v1_sha256_8c803111df930056bdc3ef7560f07bf4d255b93286d01ecc55f790e72565ba5d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44808,7 +44808,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Fba0E19919Ac50D700Ba60250D02C8B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Diamartis" and pe.signatures[i].serial=="7f:ba:0e:19:91:9a:c5:0d:70:0b:a6:02:50:d0:2c:8b" and 1623196800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Diamartis" and pe.signatures [ i ] . serial == "7f:ba:0e:19:91:9a:c5:0d:70:0b:a6:02:50:d0:2c:8b" and 1623196800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44817,13 +44817,13 @@ rule REVERSINGLABS_Cert_Blocklist_A758504E7971869D0Aec2775Fffa03D5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cc8c0cca-1848-5a5e-a421-c5ecdea6ba53"
+		id = "65aa9412-2ace-53f8-9a45-ea96755902c5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9038-L9056"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dcb1ac4c7dcbebd0a432515da82e4a97be6c6c2a54f9d642aa8c1a2bcbdce5de"
+		logic_hash = "v1_sha256_dcb1ac4c7dcbebd0a432515da82e4a97be6c6c2a54f9d642aa8c1a2bcbdce5de"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44833,7 +44833,7 @@ rule REVERSINGLABS_Cert_Blocklist_A758504E7971869D0Aec2775Fffa03D5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Amcert LLC" and (pe.signatures[i].serial=="00:a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5" or pe.signatures[i].serial=="a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5") and 1623628800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Amcert LLC" and ( pe.signatures [ i ] . serial == "00:a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5" or pe.signatures [ i ] . serial == "a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5" ) and 1623628800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44842,13 +44842,13 @@ rule REVERSINGLABS_Cert_Blocklist_37A67Cf754Ee5Ae284B4Cf8B9D651604 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e85434e1-1ef5-5660-8ba6-b35cbbe7510d"
+		id = "248b06e8-f98e-5b47-bd24-268fe141fffe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9058-L9074"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "22cb71eebbb212a4436847c11c7ca9cefaf118086b024014c12498a6a5953af5"
+		logic_hash = "v1_sha256_22cb71eebbb212a4436847c11c7ca9cefaf118086b024014c12498a6a5953af5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44858,7 +44858,7 @@ rule REVERSINGLABS_Cert_Blocklist_37A67Cf754Ee5Ae284B4Cf8B9D651604 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTH PROPERTY LTD" and pe.signatures[i].serial=="37:a6:7c:f7:54:ee:5a:e2:84:b4:cf:8b:9d:65:16:04" and 1617321600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FORTH PROPERTY LTD" and pe.signatures [ i ] . serial == "37:a6:7c:f7:54:ee:5a:e2:84:b4:cf:8b:9d:65:16:04" and 1617321600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44867,13 +44867,13 @@ rule REVERSINGLABS_Cert_Blocklist_119Acead668Bad57A48B4F42F294F8F0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7ec33498-b299-58e0-be42-9e4fb9549e28"
+		id = "8af769e1-adbb-5795-8b7e-f5ec901220e7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9076-L9092"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "61c49c60fc4fd5d654a6376fcee43e986a5351f085a5652a3c8888774557e053"
+		logic_hash = "v1_sha256_61c49c60fc4fd5d654a6376fcee43e986a5351f085a5652a3c8888774557e053"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44883,7 +44883,7 @@ rule REVERSINGLABS_Cert_Blocklist_119Acead668Bad57A48B4F42F294F8F0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PB03 TRANSPORT LTD." and pe.signatures[i].serial=="11:9a:ce:ad:66:8b:ad:57:a4:8b:4f:42:f2:94:f8:f0" and 1619654400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PB03 TRANSPORT LTD." and pe.signatures [ i ] . serial == "11:9a:ce:ad:66:8b:ad:57:a4:8b:4f:42:f2:94:f8:f0" and 1619654400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44892,13 +44892,13 @@ rule REVERSINGLABS_Cert_Blocklist_7A6D30A6Eb2Fa0C3369283725704Ac4C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b7830a3a-ddcc-54ef-84dd-5d4b13863f90"
+		id = "f1598928-45c7-5d0e-9450-cb9228692304"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9094-L9110"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "788abb53ed7974d87c1b1bdbe31dcd3e852ea64745d94780d78d1217ee0206fe"
+		logic_hash = "v1_sha256_788abb53ed7974d87c1b1bdbe31dcd3e852ea64745d94780d78d1217ee0206fe"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44908,7 +44908,7 @@ rule REVERSINGLABS_Cert_Blocklist_7A6D30A6Eb2Fa0C3369283725704Ac4C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trade By International ApS" and pe.signatures[i].serial=="7a:6d:30:a6:eb:2f:a0:c3:36:92:83:72:57:04:ac:4c" and 1619568000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Trade By International ApS" and pe.signatures [ i ] . serial == "7a:6d:30:a6:eb:2f:a0:c3:36:92:83:72:57:04:ac:4c" and 1619568000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44917,13 +44917,13 @@ rule REVERSINGLABS_Cert_Blocklist_670C3494206B9F0C18714Fdcffaaa42F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "210a0c72-7eb7-5c78-bf5b-1ac292e7fa11"
+		id = "8b1fc707-d8d4-5f20-bdb4-384839df9696"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9112-L9128"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3b1e244b5f543a05beb2475020aa20dfc723f4dce3a5a0a963db1672d3295721"
+		logic_hash = "v1_sha256_3b1e244b5f543a05beb2475020aa20dfc723f4dce3a5a0a963db1672d3295721"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44933,7 +44933,7 @@ rule REVERSINGLABS_Cert_Blocklist_670C3494206B9F0C18714Fdcffaaa42F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADRIATIK PORT SERVIS, d.o.o." and pe.signatures[i].serial=="67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f" and 1622160000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ADRIATIK PORT SERVIS, d.o.o." and pe.signatures [ i ] . serial == "67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f" and 1622160000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44942,13 +44942,13 @@ rule REVERSINGLABS_Cert_Blocklist_0E8Aa328Af207Ce8Bcae1Dc15C626188 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9718f290-6ecd-5d67-9013-af99f98fffef"
+		id = "c57f8e6c-b111-5afb-983e-5d5d116b6a46"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9130-L9146"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4022abb8efbda944e35ff529c5b3b3c9f6370127a945f3eec1310149bb5d06e4"
+		logic_hash = "v1_sha256_4022abb8efbda944e35ff529c5b3b3c9f6370127a945f3eec1310149bb5d06e4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44958,7 +44958,7 @@ rule REVERSINGLABS_Cert_Blocklist_0E8Aa328Af207Ce8Bcae1Dc15C626188 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PRO SAT SRL" and pe.signatures[i].serial=="0e:8a:a3:28:af:20:7c:e8:bc:ae:1d:c1:5c:62:61:88" and 1627344000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PRO SAT SRL" and pe.signatures [ i ] . serial == "0e:8a:a3:28:af:20:7c:e8:bc:ae:1d:c1:5c:62:61:88" and 1627344000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44967,13 +44967,13 @@ rule REVERSINGLABS_Cert_Blocklist_Cfad6Be1D823B4Eacb803B720F525A7D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "844e295f-b22f-5eb0-9f98-0d6e574d2954"
+		id = "3c8fc16c-b1ee-5ce6-85d2-40c212555fbe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9148-L9166"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d8005774e6011d8198039a6588834cd0b13dd728103b63c3ea8b6e0dc3878f05"
+		logic_hash = "v1_sha256_d8005774e6011d8198039a6588834cd0b13dd728103b63c3ea8b6e0dc3878f05"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -44983,7 +44983,7 @@ rule REVERSINGLABS_Cert_Blocklist_Cfad6Be1D823B4Eacb803B720F525A7D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sistema LLC" and (pe.signatures[i].serial=="00:cf:ad:6b:e1:d8:23:b4:ea:cb:80:3b:72:0f:52:5a:7d" or pe.signatures[i].serial=="cf:ad:6b:e1:d8:23:b4:ea:cb:80:3b:72:0f:52:5a:7d") and 1627430400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sistema LLC" and ( pe.signatures [ i ] . serial == "00:cf:ad:6b:e1:d8:23:b4:ea:cb:80:3b:72:0f:52:5a:7d" or pe.signatures [ i ] . serial == "cf:ad:6b:e1:d8:23:b4:ea:cb:80:3b:72:0f:52:5a:7d" ) and 1627430400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -44992,13 +44992,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Ebcb54B7E0E6410B28610De0743D4Dd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "84140bbd-23a0-5355-9d1a-918cc93c3352"
+		id = "74eb9b2b-fb4c-5842-83b5-55ca31f4b768"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9168-L9184"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c9444ff9e13192bf300afac12554bc4cc2defb37bb5b57906b6163db378c515a"
+		logic_hash = "v1_sha256_c9444ff9e13192bf300afac12554bc4cc2defb37bb5b57906b6163db378c515a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45008,7 +45008,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Ebcb54B7E0E6410B28610De0743D4Dd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SIA \"MWorx\"" and pe.signatures[i].serial=="7e:bc:b5:4b:7e:0e:64:10:b2:86:10:de:07:43:d4:dd" and 1625616000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SIA \"MWorx\"" and pe.signatures [ i ] . serial == "7e:bc:b5:4b:7e:0e:64:10:b2:86:10:de:07:43:d4:dd" and 1625616000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45017,13 +45017,13 @@ rule REVERSINGLABS_Cert_Blocklist_01106Cc293772Ca905A2B6Eff02Bf0F5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1ec81090-91a1-5019-be91-14f60d6722fc"
+		id = "191ee551-e54a-5872-b46e-5443696ae90d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9186-L9202"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "81e19c06de4546a2cee974230ef7aa15291f20f2e6b6f89c9b12107c26836b5e"
+		logic_hash = "v1_sha256_81e19c06de4546a2cee974230ef7aa15291f20f2e6b6f89c9b12107c26836b5e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45033,7 +45033,7 @@ rule REVERSINGLABS_Cert_Blocklist_01106Cc293772Ca905A2B6Eff02Bf0F5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DMR Consulting Ltd." and pe.signatures[i].serial=="01:10:6c:c2:93:77:2c:a9:05:a2:b6:ef:f0:2b:f0:f5" and 1627084800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DMR Consulting Ltd." and pe.signatures [ i ] . serial == "01:10:6c:c2:93:77:2c:a9:05:a2:b6:ef:f0:2b:f0:f5" and 1627084800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45042,13 +45042,13 @@ rule REVERSINGLABS_Cert_Blocklist_05Bb162F6Efe852B7Bd4712Fd737A61E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "82b2198e-140a-54d0-afa8-ad89980c7899"
+		id = "0692b7f4-6281-5bef-8c97-014564b200c5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9204-L9220"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d2fcbce0826c1478338827376d2c7869e5b38dc6d5e737a2f986600c6f71b1e6"
+		logic_hash = "v1_sha256_d2fcbce0826c1478338827376d2c7869e5b38dc6d5e737a2f986600c6f71b1e6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45058,7 +45058,7 @@ rule REVERSINGLABS_Cert_Blocklist_05Bb162F6Efe852B7Bd4712Fd737A61E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Wellpro Impact Solutions Oy" and pe.signatures[i].serial=="05:bb:16:2f:6e:fe:85:2b:7b:d4:71:2f:d7:37:a6:1e" and 1628726400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Wellpro Impact Solutions Oy" and pe.signatures [ i ] . serial == "05:bb:16:2f:6e:fe:85:2b:7b:d4:71:2f:d7:37:a6:1e" and 1628726400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45067,13 +45067,13 @@ rule REVERSINGLABS_Cert_Blocklist_6171990Ba1C8E71049Ebb296A35Bd160 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f81697ca-e49a-5a3d-9e0f-6192159e098b"
+		id = "f023524a-768c-54e7-803d-3d93616f443d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9222-L9238"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e922bb850b7c5c70db80e6a2b99310eac48d3b10b94a7259899facd681916bfa"
+		logic_hash = "v1_sha256_e922bb850b7c5c70db80e6a2b99310eac48d3b10b94a7259899facd681916bfa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45083,7 +45083,7 @@ rule REVERSINGLABS_Cert_Blocklist_6171990Ba1C8E71049Ebb296A35Bd160 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OWLNET LIMITED" and pe.signatures[i].serial=="61:71:99:0b:a1:c8:e7:10:49:eb:b2:96:a3:5b:d1:60" and 1620000000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OWLNET LIMITED" and pe.signatures [ i ] . serial == "61:71:99:0b:a1:c8:e7:10:49:eb:b2:96:a3:5b:d1:60" and 1620000000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45092,13 +45092,13 @@ rule REVERSINGLABS_Cert_Blocklist_2114Ca3Bd2Afd63D7Fa29D744992B043 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7d112cb8-a29f-5560-9c3c-cd8891623d96"
+		id = "2a86dea8-52e9-56f8-b5c4-ea8b8435c0ad"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9240-L9256"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "241fe5a9f233fa36a665d22b38fd360bee21bc9832c15ac9c9d9b17adc3bb306"
+		logic_hash = "v1_sha256_241fe5a9f233fa36a665d22b38fd360bee21bc9832c15ac9c9d9b17adc3bb306"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45108,7 +45108,7 @@ rule REVERSINGLABS_Cert_Blocklist_2114Ca3Bd2Afd63D7Fa29D744992B043 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MATCH CONSULTANTS LTD" and pe.signatures[i].serial=="21:14:ca:3b:d2:af:d6:3d:7f:a2:9d:74:49:92:b0:43" and 1625097600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MATCH CONSULTANTS LTD" and pe.signatures [ i ] . serial == "21:14:ca:3b:d2:af:d6:3d:7f:a2:9d:74:49:92:b0:43" and 1625097600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45117,13 +45117,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Aaa62208A3A78Bfac1443007D031E61 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dd6dca76-ff5b-51a8-9318-20a88eb44ffb"
+		id = "49d98081-3018-5c24-9eec-b531c5442a2c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9258-L9274"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7ba7f69514230fe636efc0a12fb9ac489a5a80ca1f5bcdb050dd30ee8f69659c"
+		logic_hash = "v1_sha256_7ba7f69514230fe636efc0a12fb9ac489a5a80ca1f5bcdb050dd30ee8f69659c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45133,7 +45133,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Aaa62208A3A78Bfac1443007D031E61 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Solar LLC" and pe.signatures[i].serial=="6a:aa:62:20:8a:3a:78:bf:ac:14:43:00:7d:03:1e:61" and 1608163200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Solar LLC" and pe.signatures [ i ] . serial == "6a:aa:62:20:8a:3a:78:bf:ac:14:43:00:7d:03:1e:61" and 1608163200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45142,13 +45142,13 @@ rule REVERSINGLABS_Cert_Blocklist_09450B8F73Ea43E39D2Cdd56049Dbe40 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e6914a29-f6f7-56fc-8606-95666d31cf33"
+		id = "95f035e3-1b06-5a4b-b024-8709d69f4aab"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9276-L9292"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "22b344b8befc00b0154d225603c81c6058399770f54cb6a09d0f7908c5c8188c"
+		logic_hash = "v1_sha256_22b344b8befc00b0154d225603c81c6058399770f54cb6a09d0f7908c5c8188c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45158,7 +45158,7 @@ rule REVERSINGLABS_Cert_Blocklist_09450B8F73Ea43E39D2Cdd56049Dbe40 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE4\\xB9\\x9D\\xE6\\xB1\\x9F\\xE5\\xAE\\x8F\\xE5\\x9B\\xBE\\xE6\\x97\\xA0\\xE5\\xBF\\xA7\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="09:45:0b:8f:73:ea:43:e3:9d:2c:dd:56:04:9d:be:40" and 1561602110<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE4\\xB9\\x9D\\xE6\\xB1\\x9F\\xE5\\xAE\\x8F\\xE5\\x9B\\xBE\\xE6\\x97\\xA0\\xE5\\xBF\\xA7\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "09:45:0b:8f:73:ea:43:e3:9d:2c:dd:56:04:9d:be:40" and 1561602110 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45167,13 +45167,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Efd9Bd4B4281C6522D96011Df46C9C4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7bd6616b-fef7-56aa-a78a-606601afa4f3"
+		id = "08379b10-f8d2-5432-b730-9aaf98f5f02a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9294-L9310"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8f8a5e3457c05c5e70e33041c5b0b971cf8f19313d47055fd760ed17d94c8794"
+		logic_hash = "v1_sha256_8f8a5e3457c05c5e70e33041c5b0b971cf8f19313d47055fd760ed17d94c8794"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45183,7 +45183,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Efd9Bd4B4281C6522D96011Df46C9C4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE9\\x9B\\xB7\\xE7\\xA5\\x9E\\xEF\\xBC\\x88\\xE6\\xAD\\xA6\\xE6\\xB1\\x89\\xEF\\xBC\\x89\\xE4\\xBF\\xA1\\xE6\\x81\\xAF\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="0e:fd:9b:d4:b4:28:1c:65:22:d9:60:11:df:46:c9:c4" and 1586249095<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE9\\x9B\\xB7\\xE7\\xA5\\x9E\\xEF\\xBC\\x88\\xE6\\xAD\\xA6\\xE6\\xB1\\x89\\xEF\\xBC\\x89\\xE4\\xBF\\xA1\\xE6\\x81\\xAF\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "0e:fd:9b:d4:b4:28:1c:65:22:d9:60:11:df:46:c9:c4" and 1586249095 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45192,13 +45192,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Dd7D4A785990584D8C0837659173272 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d5e3d85b-cc4e-5522-8558-f2703c38c4e6"
+		id = "e2c57c59-465a-5d2c-bddd-9d933d36350e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9312-L9328"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d18a479f07f2bdb890437e2bcb0213abdfb0eb684cdaf17c5eb0583039f2edb4"
+		logic_hash = "v1_sha256_d18a479f07f2bdb890437e2bcb0213abdfb0eb684cdaf17c5eb0583039f2edb4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45208,7 +45208,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Dd7D4A785990584D8C0837659173272 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE9\\x9B\\xB7\\xE7\\xA5\\x9E\\xEF\\xBC\\x88\\xE6\\xAD\\xA6\\xE6\\xB1\\x89\\xEF\\xBC\\x89\\xE4\\xBF\\xA1\\xE6\\x81\\xAF\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="0d:d7:d4:a7:85:99:05:84:d8:c0:83:76:59:17:32:72" and 1586249095<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE9\\x9B\\xB7\\xE7\\xA5\\x9E\\xEF\\xBC\\x88\\xE6\\xAD\\xA6\\xE6\\xB1\\x89\\xEF\\xBC\\x89\\xE4\\xBF\\xA1\\xE6\\x81\\xAF\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "0d:d7:d4:a7:85:99:05:84:d8:c0:83:76:59:17:32:72" and 1586249095 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45217,13 +45217,13 @@ rule REVERSINGLABS_Cert_Blocklist_0C59D46580F039Af2C4Ab6Ba0Ffed197 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "969e05a1-8ae1-5ea6-9607-5bf164f34e7b"
+		id = "8c1e8d24-4f14-5999-bd68-a367e5897a4a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9330-L9346"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "32eea2a436f386ef44a00ef72be8be7d4070b02f84ba71c7ee1ca407fddce8ec"
+		logic_hash = "v1_sha256_32eea2a436f386ef44a00ef72be8be7d4070b02f84ba71c7ee1ca407fddce8ec"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45233,7 +45233,7 @@ rule REVERSINGLABS_Cert_Blocklist_0C59D46580F039Af2C4Ab6Ba0Ffed197 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xA4\\xA7\\xE8\\xBF\\x9E\\xE7\\xBA\\xB5\\xE6\\xA2\\xA6\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="0c:59:d4:65:80:f0:39:af:2c:4a:b6:ba:0f:fe:d1:97" and 1585108595<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\xA4\\xA7\\xE8\\xBF\\x9E\\xE7\\xBA\\xB5\\xE6\\xA2\\xA6\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "0c:59:d4:65:80:f0:39:af:2c:4a:b6:ba:0f:fe:d1:97" and 1585108595 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45242,13 +45242,13 @@ rule REVERSINGLABS_Cert_Blocklist_0448Ec8D26597F99912138500Cc41C1B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0c306a1f-e810-5988-a44c-964b6a67c918"
+		id = "906c899a-dd49-5dfb-af3f-ade4103c957b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9348-L9364"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "001556c31cfb0d94978adc48dc0d24c83666512348c65508975cc9e1a119aeae"
+		logic_hash = "v1_sha256_001556c31cfb0d94978adc48dc0d24c83666512348c65508975cc9e1a119aeae"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45258,7 +45258,7 @@ rule REVERSINGLABS_Cert_Blocklist_0448Ec8D26597F99912138500Cc41C1B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xA4\\xA7\\xE8\\xBF\\x9E\\xE7\\xBA\\xB5\\xE6\\xA2\\xA6\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="04:48:ec:8d:26:59:7f:99:91:21:38:50:0c:c4:1c:1b" and 1585108595<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\xA4\\xA7\\xE8\\xBF\\x9E\\xE7\\xBA\\xB5\\xE6\\xA2\\xA6\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "04:48:ec:8d:26:59:7f:99:91:21:38:50:0c:c4:1c:1b" and 1585108595 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45267,13 +45267,13 @@ rule REVERSINGLABS_Cert_Blocklist_0108Cbaee60728F5Bf06E45A56D6F170 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2be3a0d2-2c6a-5c66-856a-d3a70a490ba3"
+		id = "3dbc0172-eb09-590c-b162-b27d84231f1c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9366-L9382"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "52027548e20c819e73ea5e9afd87faaca4498bc39e54dd30ad99a24e3ace57fd"
+		logic_hash = "v1_sha256_52027548e20c819e73ea5e9afd87faaca4498bc39e54dd30ad99a24e3ace57fd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45283,7 +45283,7 @@ rule REVERSINGLABS_Cert_Blocklist_0108Cbaee60728F5Bf06E45A56D6F170 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\xAD\\xA6\\xE6\\xB1\\x89\\xE4\\xB8\\x9C\\xE6\\xB9\\x96\\xE6\\x96\\xB0\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE5\\xBC\\x80\\xE5\\x8F\\x91\\xE5\\x8C\\xBA" and pe.signatures[i].serial=="01:08:cb:ae:e6:07:28:f5:bf:06:e4:5a:56:d6:f1:70" and 1605680260<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE6\\xAD\\xA6\\xE6\\xB1\\x89\\xE4\\xB8\\x9C\\xE6\\xB9\\x96\\xE6\\x96\\xB0\\xE6\\x8A\\x80\\xE6\\x9C\\xAF\\xE5\\xBC\\x80\\xE5\\x8F\\x91\\xE5\\x8C\\xBA" and pe.signatures [ i ] . serial == "01:08:cb:ae:e6:07:28:f5:bf:06:e4:5a:56:d6:f1:70" and 1605680260 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45292,13 +45292,13 @@ rule REVERSINGLABS_Cert_Blocklist_038D56A12153E8B5C74C69Bff65Cbe3F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "48162554-a95b-5cd3-9bbb-bcf6a1d96592"
+		id = "3ecee8d7-f540-532d-89d5-0c5fd8979aeb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9384-L9400"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ed3a81231f93f9d2ae462481503ba37072c3800dd1379baae11737f093a27af1"
+		logic_hash = "v1_sha256_ed3a81231f93f9d2ae462481503ba37072c3800dd1379baae11737f093a27af1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45308,7 +45308,7 @@ rule REVERSINGLABS_Cert_Blocklist_038D56A12153E8B5C74C69Bff65Cbe3F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\xAD\\xA6\\xE6\\xB1\\x89\\xE5\\x86\\x85\\xE7\\x91\\x9F\\xE6\\x96\\xAF\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="03:8d:56:a1:21:53:e8:b5:c7:4c:69:bf:f6:5c:be:3f" and 1605680260<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE6\\xAD\\xA6\\xE6\\xB1\\x89\\xE5\\x86\\x85\\xE7\\x91\\x9F\\xE6\\x96\\xAF\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "03:8d:56:a1:21:53:e8:b5:c7:4c:69:bf:f6:5c:be:3f" and 1605680260 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45317,13 +45317,13 @@ rule REVERSINGLABS_Cert_Blocklist_060D94E2Ccae84536654D9Daf39Fef1E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ac5d29ef-fd52-536b-bcbc-44433dda8a21"
+		id = "a375e694-3feb-5e9c-a04c-43c8227263f8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9402-L9418"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "49000f3a3ce1ad9aef87162d7527b8f062e0aa12276b82c7335f0ccc14b7d38a"
+		logic_hash = "v1_sha256_49000f3a3ce1ad9aef87162d7527b8f062e0aa12276b82c7335f0ccc14b7d38a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45333,7 +45333,7 @@ rule REVERSINGLABS_Cert_Blocklist_060D94E2Ccae84536654D9Daf39Fef1E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HasCred ApS" and pe.signatures[i].serial=="06:0d:94:e2:cc:ae:84:53:66:54:d9:da:f3:9f:ef:1e" and 1627948800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HasCred ApS" and pe.signatures [ i ] . serial == "06:0d:94:e2:cc:ae:84:53:66:54:d9:da:f3:9f:ef:1e" and 1627948800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45342,13 +45342,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Bc9B800F480691Bd6B60963466B0C75 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "614f88ca-183a-548b-99f1-30cf4c4027ce"
+		id = "3cbcc1a0-695e-5dc9-9e64-f02fca12324d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9420-L9436"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6a498fd30c611976e9aad2f9b85b13c3c29246582cdfefc800615db88e40dac2"
+		logic_hash = "v1_sha256_6a498fd30c611976e9aad2f9b85b13c3c29246582cdfefc800615db88e40dac2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45358,7 +45358,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Bc9B800F480691Bd6B60963466B0C75 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HasCred ApS" and pe.signatures[i].serial=="0b:c9:b8:00:f4:80:69:1b:d6:b6:09:63:46:6b:0c:75" and 1629158400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HasCred ApS" and pe.signatures [ i ] . serial == "0b:c9:b8:00:f4:80:69:1b:d6:b6:09:63:46:6b:0c:75" and 1629158400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45367,13 +45367,13 @@ rule REVERSINGLABS_Cert_Blocklist_0C4324Ff41F0A7B16Ffcc93Dffa8Fa99 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "34594a57-f9fd-5b9d-afb6-691be33da9b5"
+		id = "0721b19a-7ec9-55ec-bc0e-b1509d377513"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9438-L9454"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d3ce83fb0497c533a5474d46300c341677ec243686723783798bfbaec4f6e369"
+		logic_hash = "v1_sha256_d3ce83fb0497c533a5474d46300c341677ec243686723783798bfbaec4f6e369"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45383,7 +45383,7 @@ rule REVERSINGLABS_Cert_Blocklist_0C4324Ff41F0A7B16Ffcc93Dffa8Fa99 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE7\\xA6\\x8F\\xE5\\xBB\\xBA\\xE7\\x9C\\x81\\xE4\\xBA\\x94\\xE6\\x98\\x9F\\xE4\\xBF\\xA1\\xE6\\x81\\xAF\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="0c:43:24:ff:41:f0:a7:b1:6f:fc:c9:3d:ff:a8:fa:99" and 1600300800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE7\\xA6\\x8F\\xE5\\xBB\\xBA\\xE7\\x9C\\x81\\xE4\\xBA\\x94\\xE6\\x98\\x9F\\xE4\\xBF\\xA1\\xE6\\x81\\xAF\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "0c:43:24:ff:41:f0:a7:b1:6f:fc:c9:3d:ff:a8:fa:99" and 1600300800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45392,13 +45392,13 @@ rule REVERSINGLABS_Cert_Blocklist_0B980Fc8783E4F158E41829Ab21Bab81 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f7358f71-421f-57fa-abdf-ab479f4b7007"
+		id = "58bfa9eb-3470-57d2-b7f3-76acab259dd7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9456-L9472"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b0f43caec1cfc5b2d1512d7fcf0bcf1e02fc81764b4376b081f38c4de328eab2"
+		logic_hash = "v1_sha256_b0f43caec1cfc5b2d1512d7fcf0bcf1e02fc81764b4376b081f38c4de328eab2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45408,7 +45408,7 @@ rule REVERSINGLABS_Cert_Blocklist_0B980Fc8783E4F158E41829Ab21Bab81 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Idris Kanchwala Holding Corp." and pe.signatures[i].serial=="0b:98:0f:c8:78:3e:4f:15:8e:41:82:9a:b2:1b:ab:81" and 1631750400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Idris Kanchwala Holding Corp." and pe.signatures [ i ] . serial == "0b:98:0f:c8:78:3e:4f:15:8e:41:82:9a:b2:1b:ab:81" and 1631750400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45417,13 +45417,13 @@ rule REVERSINGLABS_Cert_Blocklist_D8F515715Aeffef0A0E4E37F16C254Fa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "50ffd0a0-d861-53d7-a7dc-f74ccc49eff8"
+		id = "08c4940b-614e-5b56-aef4-86283bcbf161"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9474-L9492"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3c7d57a655f76a6e5ef6b0e770db7c91d0830b6b0b37caef5ef9e3e78ad1fd75"
+		logic_hash = "v1_sha256_3c7d57a655f76a6e5ef6b0e770db7c91d0830b6b0b37caef5ef9e3e78ad1fd75"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45433,7 +45433,7 @@ rule REVERSINGLABS_Cert_Blocklist_D8F515715Aeffef0A0E4E37F16C254Fa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HOLDING LA LTD" and (pe.signatures[i].serial=="00:d8:f5:15:71:5a:ef:fe:f0:a0:e4:e3:7f:16:c2:54:fa" or pe.signatures[i].serial=="d8:f5:15:71:5a:ef:fe:f0:a0:e4:e3:7f:16:c2:54:fa") and 1619136000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HOLDING LA LTD" and ( pe.signatures [ i ] . serial == "00:d8:f5:15:71:5a:ef:fe:f0:a0:e4:e3:7f:16:c2:54:fa" or pe.signatures [ i ] . serial == "d8:f5:15:71:5a:ef:fe:f0:a0:e4:e3:7f:16:c2:54:fa" ) and 1619136000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45442,13 +45442,13 @@ rule REVERSINGLABS_Cert_Blocklist_D79739187C585E453C00Afc11D77B523 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ed427336-6833-5e09-8ebe-039c8cd50846"
+		id = "65c25440-c800-5b7e-89fe-01565d807d7a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9494-L9512"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6d6db87227d7be559afa67c4f2b65b01f26741fdf337d920241a633bb036426f"
+		logic_hash = "v1_sha256_6d6db87227d7be559afa67c4f2b65b01f26741fdf337d920241a633bb036426f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45458,7 +45458,7 @@ rule REVERSINGLABS_Cert_Blocklist_D79739187C585E453C00Afc11D77B523 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAN MARINO INVESTMENTS PTY LTD" and (pe.signatures[i].serial=="00:d7:97:39:18:7c:58:5e:45:3c:00:af:c1:1d:77:b5:23" or pe.signatures[i].serial=="d7:97:39:18:7c:58:5e:45:3c:00:af:c1:1d:77:b5:23") and 1631059200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SAN MARINO INVESTMENTS PTY LTD" and ( pe.signatures [ i ] . serial == "00:d7:97:39:18:7c:58:5e:45:3c:00:af:c1:1d:77:b5:23" or pe.signatures [ i ] . serial == "d7:97:39:18:7c:58:5e:45:3c:00:af:c1:1d:77:b5:23" ) and 1631059200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45467,13 +45467,13 @@ rule REVERSINGLABS_Cert_Blocklist_961Cecb0227845317549E9343A980E91 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f319592a-5f08-5f2c-b840-5f897695e054"
+		id = "8d75a136-bcb9-575f-be49-80ac55e376fc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9514-L9532"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c74512e95e2d6aedecb1dbd30fac6fde40d1e9520c89b785519694d9bc9ba854"
+		logic_hash = "v1_sha256_c74512e95e2d6aedecb1dbd30fac6fde40d1e9520c89b785519694d9bc9ba854"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45483,7 +45483,7 @@ rule REVERSINGLABS_Cert_Blocklist_961Cecb0227845317549E9343A980E91 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AmiraCo Oy" and (pe.signatures[i].serial=="00:96:1c:ec:b0:22:78:45:31:75:49:e9:34:3a:98:0e:91" or pe.signatures[i].serial=="96:1c:ec:b0:22:78:45:31:75:49:e9:34:3a:98:0e:91") and 1615248000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AmiraCo Oy" and ( pe.signatures [ i ] . serial == "00:96:1c:ec:b0:22:78:45:31:75:49:e9:34:3a:98:0e:91" or pe.signatures [ i ] . serial == "96:1c:ec:b0:22:78:45:31:75:49:e9:34:3a:98:0e:91" ) and 1615248000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45492,13 +45492,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Ef6392B2993A6F67578299659467Ea8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "123e5aed-0ef4-5146-81bb-5d455a9cf92e"
+		id = "bb6cf84e-48c7-551e-a3fe-8e5b63a7a67d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9534-L9550"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f6b454a575ea7635d5edebffe3c9c83e95312ee33245e733987532348258733e"
+		logic_hash = "v1_sha256_f6b454a575ea7635d5edebffe3c9c83e95312ee33245e733987532348258733e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45508,7 +45508,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Ef6392B2993A6F67578299659467Ea8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALUSEN d. o. o." and pe.signatures[i].serial=="1e:f6:39:2b:29:93:a6:f6:75:78:29:96:59:46:7e:a8" and 1618531200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALUSEN d. o. o." and pe.signatures [ i ] . serial == "1e:f6:39:2b:29:93:a6:f6:75:78:29:96:59:46:7e:a8" and 1618531200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45517,13 +45517,13 @@ rule REVERSINGLABS_Cert_Blocklist_A918455C0D4Da7Ca474F41F11A7Cf38C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "959b10fe-fbd0-5642-a5d9-4ac2e0474666"
+		id = "f1eca1c5-a687-575e-8dd5-760ffe7bad59"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9552-L9570"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ea30d85c057f9363ce29d4c024097c50a8752dd2095481181322fe5d5c92bb4b"
+		logic_hash = "v1_sha256_ea30d85c057f9363ce29d4c024097c50a8752dd2095481181322fe5d5c92bb4b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45533,7 +45533,7 @@ rule REVERSINGLABS_Cert_Blocklist_A918455C0D4Da7Ca474F41F11A7Cf38C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MIDDRA INTERNATIONAL CORP." and (pe.signatures[i].serial=="00:a9:18:45:5c:0d:4d:a7:ca:47:4f:41:f1:1a:7c:f3:8c" or pe.signatures[i].serial=="a9:18:45:5c:0d:4d:a7:ca:47:4f:41:f1:1a:7c:f3:8c") and 1618963200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MIDDRA INTERNATIONAL CORP." and ( pe.signatures [ i ] . serial == "00:a9:18:45:5c:0d:4d:a7:ca:47:4f:41:f1:1a:7c:f3:8c" or pe.signatures [ i ] . serial == "a9:18:45:5c:0d:4d:a7:ca:47:4f:41:f1:1a:7c:f3:8c" ) and 1618963200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45542,13 +45542,13 @@ rule REVERSINGLABS_Cert_Blocklist_936Bc256D2057Ca9B9Ec3034C3Ed0Ee6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4dbe7db7-2f61-558c-a6dc-875ba87322c7"
+		id = "e9ef9ac3-2d79-58c5-b3fa-b19cde79a8d8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9572-L9590"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7e90c29bcfe4632e70b61a0cf2ab48a3de986bd5c6c730f64a363f4f3d79a3f4"
+		logic_hash = "v1_sha256_7e90c29bcfe4632e70b61a0cf2ab48a3de986bd5c6c730f64a363f4f3d79a3f4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45558,7 +45558,7 @@ rule REVERSINGLABS_Cert_Blocklist_936Bc256D2057Ca9B9Ec3034C3Ed0Ee6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SALES & MAINTENANCE LIMITED" and (pe.signatures[i].serial=="00:93:6b:c2:56:d2:05:7c:a9:b9:ec:30:34:c3:ed:0e:e6" or pe.signatures[i].serial=="93:6b:c2:56:d2:05:7c:a9:b9:ec:30:34:c3:ed:0e:e6") and 1616889600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SALES & MAINTENANCE LIMITED" and ( pe.signatures [ i ] . serial == "00:93:6b:c2:56:d2:05:7c:a9:b9:ec:30:34:c3:ed:0e:e6" or pe.signatures [ i ] . serial == "93:6b:c2:56:d2:05:7c:a9:b9:ec:30:34:c3:ed:0e:e6" ) and 1616889600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45567,13 +45567,13 @@ rule REVERSINGLABS_Cert_Blocklist_Afe8Fee94B41422E01E4897Bcd52D0A4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "83d08ca6-2a0b-5da3-8d53-7bf8bcc361cf"
+		id = "637f35cb-a3e8-52e4-9e7a-45cb5b4e7b48"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9592-L9610"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "02c55b182bc9843334baed9c0a7cca2c88cd1de00ca9b47b10ec79b7a5acf9bb"
+		logic_hash = "v1_sha256_02c55b182bc9843334baed9c0a7cca2c88cd1de00ca9b47b10ec79b7a5acf9bb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45583,7 +45583,7 @@ rule REVERSINGLABS_Cert_Blocklist_Afe8Fee94B41422E01E4897Bcd52D0A4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TLGM ApS" and (pe.signatures[i].serial=="00:af:e8:fe:e9:4b:41:42:2e:01:e4:89:7b:cd:52:d0:a4" or pe.signatures[i].serial=="af:e8:fe:e9:4b:41:42:2e:01:e4:89:7b:cd:52:d0:a4") and 1617062400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TLGM ApS" and ( pe.signatures [ i ] . serial == "00:af:e8:fe:e9:4b:41:42:2e:01:e4:89:7b:cd:52:d0:a4" or pe.signatures [ i ] . serial == "af:e8:fe:e9:4b:41:42:2e:01:e4:89:7b:cd:52:d0:a4" ) and 1617062400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45592,13 +45592,13 @@ rule REVERSINGLABS_Cert_Blocklist_718E89Ddb33257Ea77Ba74Be7F2Baf1D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d173c2b2-2b76-521a-aac1-ae69fdf5b16b"
+		id = "dd6c1ffd-9446-552e-b6ad-88ddcb68bee7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9612-L9628"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2f0defa1e1d905d937677e96f2a0955d9737f6976596932cc093fdecfea3fdb0"
+		logic_hash = "v1_sha256_2f0defa1e1d905d937677e96f2a0955d9737f6976596932cc093fdecfea3fdb0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45608,7 +45608,7 @@ rule REVERSINGLABS_Cert_Blocklist_718E89Ddb33257Ea77Ba74Be7F2Baf1D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trap Capital ApS" and pe.signatures[i].serial=="71:8e:89:dd:b3:32:57:ea:77:ba:74:be:7f:2b:af:1d" and 1635462927<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Trap Capital ApS" and pe.signatures [ i ] . serial == "71:8e:89:dd:b3:32:57:ea:77:ba:74:be:7f:2b:af:1d" and 1635462927 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45617,13 +45617,13 @@ rule REVERSINGLABS_Cert_Blocklist_4D3E38F4Aebbc32257450726B29Be117 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "173f89ca-e7b3-507b-96c1-325dd06210f8"
+		id = "15fbb08b-8913-5a89-b3c9-37f5ef089d50"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9630-L9646"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f618547942fcd9b3d1104cb5bedeecec8596fa7cc34bca838b6120085b305d73"
+		logic_hash = "v1_sha256_f618547942fcd9b3d1104cb5bedeecec8596fa7cc34bca838b6120085b305d73"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45633,7 +45633,7 @@ rule REVERSINGLABS_Cert_Blocklist_4D3E38F4Aebbc32257450726B29Be117 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "POLE & AERIAL FITNESS LIMITED" and pe.signatures[i].serial=="4d:3e:38:f4:ae:bb:c3:22:57:45:07:26:b2:9b:e1:17" and 1636123882<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "POLE & AERIAL FITNESS LIMITED" and pe.signatures [ i ] . serial == "4d:3e:38:f4:ae:bb:c3:22:57:45:07:26:b2:9b:e1:17" and 1636123882 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45642,13 +45642,13 @@ rule REVERSINGLABS_Cert_Blocklist_8F4C49Dae1F1Ff0Ebe9104C6F73242Bd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b7731056-1674-5375-a3cb-69632670d6d9"
+		id = "d4dd5229-77ee-50a0-9843-c164d743502e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9648-L9666"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a8c99cc30b791a76fe3cd48184bf95ee47abb30bd200128efd2f5295ee18f7b1"
+		logic_hash = "v1_sha256_a8c99cc30b791a76fe3cd48184bf95ee47abb30bd200128efd2f5295ee18f7b1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45658,7 +45658,7 @@ rule REVERSINGLABS_Cert_Blocklist_8F4C49Dae1F1Ff0Ebe9104C6F73242Bd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Contact Merger Holding ApS" and (pe.signatures[i].serial=="00:8f:4c:49:da:e1:f1:ff:0e:be:91:04:c6:f7:32:42:bd" or pe.signatures[i].serial=="8f:4c:49:da:e1:f1:ff:0e:be:91:04:c6:f7:32:42:bd") and 1636039748<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Contact Merger Holding ApS" and ( pe.signatures [ i ] . serial == "00:8f:4c:49:da:e1:f1:ff:0e:be:91:04:c6:f7:32:42:bd" or pe.signatures [ i ] . serial == "8f:4c:49:da:e1:f1:ff:0e:be:91:04:c6:f7:32:42:bd" ) and 1636039748 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45667,13 +45667,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ac3C05F1Cb9453De8E7110F589Fb32C0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2578655e-6420-5a67-9116-cab5cf5bc195"
+		id = "51f2c464-6986-5ecd-95ec-20479dec5fcc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9668-L9686"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6328fd5dbb497c69ddc9151f85754669760b709ecbff3e8f320a40a62ca0dd2c"
+		logic_hash = "v1_sha256_6328fd5dbb497c69ddc9151f85754669760b709ecbff3e8f320a40a62ca0dd2c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45683,7 +45683,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ac3C05F1Cb9453De8E7110F589Fb32C0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRAIN BUILDING TEAM s.r.o." and (pe.signatures[i].serial=="00:ac:3c:05:f1:cb:94:53:de:8e:71:10:f5:89:fb:32:c0" or pe.signatures[i].serial=="ac:3c:05:f1:cb:94:53:de:8e:71:10:f5:89:fb:32:c0") and 1635854205<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TRAIN BUILDING TEAM s.r.o." and ( pe.signatures [ i ] . serial == "00:ac:3c:05:f1:cb:94:53:de:8e:71:10:f5:89:fb:32:c0" or pe.signatures [ i ] . serial == "ac:3c:05:f1:cb:94:53:de:8e:71:10:f5:89:fb:32:c0" ) and 1635854205 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45692,13 +45692,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fbb96A90B6718810311767Ca25Ab1E48 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "77319b9c-6075-5ac7-958c-d76916873e85"
+		id = "28fb7fa8-1c00-515e-8341-8bde5eb0f113"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9688-L9706"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "431e3364a42b272d9b71b92dee44cc185ef034a45a0b72bbda82cf7e9b29c355"
+		logic_hash = "v1_sha256_431e3364a42b272d9b71b92dee44cc185ef034a45a0b72bbda82cf7e9b29c355"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45708,7 +45708,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fbb96A90B6718810311767Ca25Ab1E48 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rakurs LLC" and (pe.signatures[i].serial=="00:fb:b9:6a:90:b6:71:88:10:31:17:67:ca:25:ab:1e:48" or pe.signatures[i].serial=="fb:b9:6a:90:b6:71:88:10:31:17:67:ca:25:ab:1e:48") and 1636046757<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rakurs LLC" and ( pe.signatures [ i ] . serial == "00:fb:b9:6a:90:b6:71:88:10:31:17:67:ca:25:ab:1e:48" or pe.signatures [ i ] . serial == "fb:b9:6a:90:b6:71:88:10:31:17:67:ca:25:ab:1e:48" ) and 1636046757 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45717,13 +45717,13 @@ rule REVERSINGLABS_Cert_Blocklist_Cfd38423Aef875A10B16644D058297E2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f53e4f44-dde2-5f7a-8cab-71e91ff75d28"
+		id = "b82c88c5-810d-5ea1-8e36-b0c566509199"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9708-L9726"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a2f67cbf31c9db2891892c31a7ed4ce7eccd834bfb10ae70f58e46f8e68e7c17"
+		logic_hash = "v1_sha256_a2f67cbf31c9db2891892c31a7ed4ce7eccd834bfb10ae70f58e46f8e68e7c17"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45733,7 +45733,7 @@ rule REVERSINGLABS_Cert_Blocklist_Cfd38423Aef875A10B16644D058297E2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRUST DANMARK ApS" and (pe.signatures[i].serial=="00:cf:d3:84:23:ae:f8:75:a1:0b:16:64:4d:05:82:97:e2" or pe.signatures[i].serial=="cf:d3:84:23:ae:f8:75:a1:0b:16:64:4d:05:82:97:e2") and 1632884040<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TRUST DANMARK ApS" and ( pe.signatures [ i ] . serial == "00:cf:d3:84:23:ae:f8:75:a1:0b:16:64:4d:05:82:97:e2" or pe.signatures [ i ] . serial == "cf:d3:84:23:ae:f8:75:a1:0b:16:64:4d:05:82:97:e2" ) and 1632884040 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45742,13 +45742,13 @@ rule REVERSINGLABS_Cert_Blocklist_E6C05C5A2222Bf92818324A3A7374Ad3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2b5b79d8-e8fa-5593-b4c4-89af1f711152"
+		id = "f3484e62-c689-5ea2-8c56-655dfe572689"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9728-L9746"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bea8fea49144abc109e33a5964bb8e113aa61b4cd70c72a43183cb0840429571"
+		logic_hash = "v1_sha256_bea8fea49144abc109e33a5964bb8e113aa61b4cd70c72a43183cb0840429571"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45758,7 +45758,7 @@ rule REVERSINGLABS_Cert_Blocklist_E6C05C5A2222Bf92818324A3A7374Ad3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ANAQA EVENTS LTD" and (pe.signatures[i].serial=="00:e6:c0:5c:5a:22:22:bf:92:81:83:24:a3:a7:37:4a:d3" or pe.signatures[i].serial=="e6:c0:5c:5a:22:22:bf:92:81:83:24:a3:a7:37:4a:d3") and 1634720407<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ANAQA EVENTS LTD" and ( pe.signatures [ i ] . serial == "00:e6:c0:5c:5a:22:22:bf:92:81:83:24:a3:a7:37:4a:d3" or pe.signatures [ i ] . serial == "e6:c0:5c:5a:22:22:bf:92:81:83:24:a3:a7:37:4a:d3" ) and 1634720407 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45767,13 +45767,13 @@ rule REVERSINGLABS_Cert_Blocklist_75Ce08Bdbad44123299Dbe9D7C1D20De : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e8e2d3b6-077f-56ba-9f2a-1941bf2ebdeb"
+		id = "42b8d51b-f00d-50ec-90fd-6c3bb3e0436d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9748-L9764"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8ba66ab55f9a6755e11a7f39152aa26917271c7f6bc5ffdb42d07ad791fb47d7"
+		logic_hash = "v1_sha256_8ba66ab55f9a6755e11a7f39152aa26917271c7f6bc5ffdb42d07ad791fb47d7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45783,7 +45783,7 @@ rule REVERSINGLABS_Cert_Blocklist_75Ce08Bdbad44123299Dbe9D7C1D20De : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rose Holm International ApS" and pe.signatures[i].serial=="75:ce:08:bd:ba:d4:41:23:29:9d:be:9d:7c:1d:20:de" and 1631007095<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rose Holm International ApS" and pe.signatures [ i ] . serial == "75:ce:08:bd:ba:d4:41:23:29:9d:be:9d:7c:1d:20:de" and 1631007095 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45792,13 +45792,13 @@ rule REVERSINGLABS_Cert_Blocklist_333705C20B56E57F60B5Eb191Eef0D90 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7f98e550-fca6-564f-bbad-40e153f17adc"
+		id = "698935da-4df5-558d-98b1-5bffc4501633"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9766-L9782"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "30eeec467b837f6b1759cd0fd6a8bc2e8942f2400df170c671287f4159652479"
+		logic_hash = "v1_sha256_30eeec467b837f6b1759cd0fd6a8bc2e8942f2400df170c671287f4159652479"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45808,7 +45808,7 @@ rule REVERSINGLABS_Cert_Blocklist_333705C20B56E57F60B5Eb191Eef0D90 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TASK Holding ApS" and pe.signatures[i].serial=="33:37:05:c2:0b:56:e5:7f:60:b5:eb:19:1e:ef:0d:90" and 1634233052<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TASK Holding ApS" and pe.signatures [ i ] . serial == "33:37:05:c2:0b:56:e5:7f:60:b5:eb:19:1e:ef:0d:90" and 1634233052 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45817,13 +45817,13 @@ rule REVERSINGLABS_Cert_Blocklist_A2A0Ba281262Acce7A00119E25564386 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ab0c7b78-5e7e-5cb9-ae61-d88f3f8d9684"
+		id = "d05d0457-bdd3-538e-b659-115949ef6dbd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9784-L9802"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f5e3c16f6caaf5f3152d90dc48895d0bbcdb296c368beeebb96157f03a8ded40"
+		logic_hash = "v1_sha256_f5e3c16f6caaf5f3152d90dc48895d0bbcdb296c368beeebb96157f03a8ded40"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45833,7 +45833,7 @@ rule REVERSINGLABS_Cert_Blocklist_A2A0Ba281262Acce7A00119E25564386 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sopiteks LLC" and (pe.signatures[i].serial=="00:a2:a0:ba:28:12:62:ac:ce:7a:00:11:9e:25:56:43:86" or pe.signatures[i].serial=="a2:a0:ba:28:12:62:ac:ce:7a:00:11:9e:25:56:43:86") and 1631908320<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sopiteks LLC" and ( pe.signatures [ i ] . serial == "00:a2:a0:ba:28:12:62:ac:ce:7a:00:11:9e:25:56:43:86" or pe.signatures [ i ] . serial == "a2:a0:ba:28:12:62:ac:ce:7a:00:11:9e:25:56:43:86" ) and 1631908320 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45842,13 +45842,13 @@ rule REVERSINGLABS_Cert_Blocklist_338483Cc174C16Ebc454A3803Ffd4217 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ce30ace6-c2c2-5f3e-a2f7-1f08825d44eb"
+		id = "fb23d49d-d0de-51bd-bd62-157cfdc6cb38"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9804-L9820"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7d7dd55eaab15cf458e5e57f0e5fbebdcc9313aee05394310a5cf9d9b4def153"
+		logic_hash = "v1_sha256_7d7dd55eaab15cf458e5e57f0e5fbebdcc9313aee05394310a5cf9d9b4def153"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45858,7 +45858,7 @@ rule REVERSINGLABS_Cert_Blocklist_338483Cc174C16Ebc454A3803Ffd4217 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lpr:n Laatu-Ravintolat Oy" and pe.signatures[i].serial=="33:84:83:cc:17:4c:16:eb:c4:54:a3:80:3f:fd:42:17" and 1635208206<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Lpr:n Laatu-Ravintolat Oy" and pe.signatures [ i ] . serial == "33:84:83:cc:17:4c:16:eb:c4:54:a3:80:3f:fd:42:17" and 1635208206 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45867,13 +45867,13 @@ rule REVERSINGLABS_Cert_Blocklist_Be89936C26Cd0D845074F6B7B47F480C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3ff8149b-4a90-5593-b12a-d815b04fce7e"
+		id = "91cb0b68-e8cb-5949-82e3-71d749e6fdeb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9822-L9840"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "348df24620bfe6322c410cb593f5caad67492b0b5af234ee89b0411beb4b48f9"
+		logic_hash = "v1_sha256_348df24620bfe6322c410cb593f5caad67492b0b5af234ee89b0411beb4b48f9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45883,7 +45883,7 @@ rule REVERSINGLABS_Cert_Blocklist_Be89936C26Cd0D845074F6B7B47F480C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Argus Security Maintenance Systems Inc." and (pe.signatures[i].serial=="00:be:89:93:6c:26:cd:0d:84:50:74:f6:b7:b4:7f:48:0c" or pe.signatures[i].serial=="be:89:93:6c:26:cd:0d:84:50:74:f6:b7:b4:7f:48:0c") and 1634235015<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Argus Security Maintenance Systems Inc." and ( pe.signatures [ i ] . serial == "00:be:89:93:6c:26:cd:0d:84:50:74:f6:b7:b4:7f:48:0c" or pe.signatures [ i ] . serial == "be:89:93:6c:26:cd:0d:84:50:74:f6:b7:b4:7f:48:0c" ) and 1634235015 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45892,13 +45892,13 @@ rule REVERSINGLABS_Cert_Blocklist_0F20A5155E53Ce20Bb644F646Ed6A2Fd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d52066d5-9bc1-5f72-8e97-7efda88c14b2"
+		id = "4699ca3c-cb63-55a5-9ab0-fb31541c6126"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9842-L9858"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "70d57f2c24d4ae6f17339bfb998589a3b10f5dd4b19ac8a5bc99e082145c4ed0"
+		logic_hash = "v1_sha256_70d57f2c24d4ae6f17339bfb998589a3b10f5dd4b19ac8a5bc99e082145c4ed0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45908,7 +45908,7 @@ rule REVERSINGLABS_Cert_Blocklist_0F20A5155E53Ce20Bb644F646Ed6A2Fd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CB CAM SP Z O O" and pe.signatures[i].serial=="0f:20:a5:15:5e:53:ce:20:bb:64:4f:64:6e:d6:a2:fd" and 1635196200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CB CAM SP Z O O" and pe.signatures [ i ] . serial == "0f:20:a5:15:5e:53:ce:20:bb:64:4f:64:6e:d6:a2:fd" and 1635196200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45917,13 +45917,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ea734E1Dfb6E69Ed2Bc55E513Bf95B5E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8e059a2a-c436-5247-b395-a2f594c1c9a9"
+		id = "4305355e-43e1-5a90-8536-b9c159475957"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9860-L9878"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a18d1c1e5e22c1aa041a4b2d23d2aefcbedbd3517a079d578e1a143ecadb4533"
+		logic_hash = "v1_sha256_a18d1c1e5e22c1aa041a4b2d23d2aefcbedbd3517a079d578e1a143ecadb4533"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45933,7 +45933,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ea734E1Dfb6E69Ed2Bc55E513Bf95B5E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Postmarket LLC" and (pe.signatures[i].serial=="00:ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e" or pe.signatures[i].serial=="ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e") and 1635153791<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Postmarket LLC" and ( pe.signatures [ i ] . serial == "00:ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e" or pe.signatures [ i ] . serial == "ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e" ) and 1635153791 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45942,13 +45942,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ba67B0De51Ebb9B1179804E75357Ab26 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "63938a97-2cb3-52b0-9717-c8949e3fae46"
+		id = "5c23cb5f-e702-5550-ab0f-0c9bf109a098"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9880-L9898"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "69b9012fc4ab9636d159de49ff452f054030c1157cf70a95512b2a0748dad7c0"
+		logic_hash = "v1_sha256_69b9012fc4ab9636d159de49ff452f054030c1157cf70a95512b2a0748dad7c0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45958,7 +45958,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ba67B0De51Ebb9B1179804E75357Ab26 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fjordland Bike Wear ApS" and (pe.signatures[i].serial=="00:ba:67:b0:de:51:eb:b9:b1:17:98:04:e7:53:57:ab:26" or pe.signatures[i].serial=="ba:67:b0:de:51:eb:b9:b1:17:98:04:e7:53:57:ab:26") and 1636145940<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fjordland Bike Wear ApS" and ( pe.signatures [ i ] . serial == "00:ba:67:b0:de:51:eb:b9:b1:17:98:04:e7:53:57:ab:26" or pe.signatures [ i ] . serial == "ba:67:b0:de:51:eb:b9:b1:17:98:04:e7:53:57:ab:26" ) and 1636145940 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45967,13 +45967,13 @@ rule REVERSINGLABS_Cert_Blocklist_Cff2B275Ba8A1Dde83Ac7Ff858399A62 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "50cc539a-1f00-566d-a83f-b4d8459506d8"
+		id = "7147d5e4-ce86-54bd-be45-b76070b82f49"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9900-L9918"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d37e1d94048339a86b8fa173d3ab753fc5e79329b73df9fda5815cd622c57745"
+		logic_hash = "v1_sha256_d37e1d94048339a86b8fa173d3ab753fc5e79329b73df9fda5815cd622c57745"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -45983,7 +45983,7 @@ rule REVERSINGLABS_Cert_Blocklist_Cff2B275Ba8A1Dde83Ac7Ff858399A62 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "XL-FORCE ApS" and (pe.signatures[i].serial=="00:cf:f2:b2:75:ba:8a:1d:de:83:ac:7f:f8:58:39:9a:62" or pe.signatures[i].serial=="cf:f2:b2:75:ba:8a:1d:de:83:ac:7f:f8:58:39:9a:62") and 1636111842<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "XL-FORCE ApS" and ( pe.signatures [ i ] . serial == "00:cf:f2:b2:75:ba:8a:1d:de:83:ac:7f:f8:58:39:9a:62" or pe.signatures [ i ] . serial == "cf:f2:b2:75:ba:8a:1d:de:83:ac:7f:f8:58:39:9a:62" ) and 1636111842 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -45992,13 +45992,13 @@ rule REVERSINGLABS_Cert_Blocklist_D22E026C5B5966F1Cf6Ef00A7C06682E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a72a0001-a272-506d-b610-c028ed8ac6da"
+		id = "57401f7a-7e4c-528f-a708-284384f40b53"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9920-L9938"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "33a05d46b40ffdf49bfa5facca41ebdf6bedcabc1cb1f5b9bf2d043ad1c869b0"
+		logic_hash = "v1_sha256_33a05d46b40ffdf49bfa5facca41ebdf6bedcabc1cb1f5b9bf2d043ad1c869b0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46008,7 +46008,7 @@ rule REVERSINGLABS_Cert_Blocklist_D22E026C5B5966F1Cf6Ef00A7C06682E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT, LLC" and (pe.signatures[i].serial=="00:d2:2e:02:6c:5b:59:66:f1:cf:6e:f0:0a:7c:06:68:2e" or pe.signatures[i].serial=="d2:2e:02:6c:5b:59:66:f1:cf:6e:f0:0a:7c:06:68:2e") and 1636456620<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT, LLC" and ( pe.signatures [ i ] . serial == "00:d2:2e:02:6c:5b:59:66:f1:cf:6e:f0:0a:7c:06:68:2e" or pe.signatures [ i ] . serial == "d2:2e:02:6c:5b:59:66:f1:cf:6e:f0:0a:7c:06:68:2e" ) and 1636456620 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46017,13 +46017,13 @@ rule REVERSINGLABS_Cert_Blocklist_3054F940C931Bad7B238A24376C6A5Cc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e5643d08-5957-58b0-8b46-d5e339dfba9c"
+		id = "58541366-547c-5e0c-9838-573686e8f4cc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9940-L9956"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "21c8e8f10d1e4b9eb917c86ac868de2afcd5776a9c1d59149df1d07d8c3e14b9"
+		logic_hash = "v1_sha256_21c8e8f10d1e4b9eb917c86ac868de2afcd5776a9c1d59149df1d07d8c3e14b9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46033,7 +46033,7 @@ rule REVERSINGLABS_Cert_Blocklist_3054F940C931Bad7B238A24376C6A5Cc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "POLE CLEAN LTD" and pe.signatures[i].serial=="30:54:f9:40:c9:31:ba:d7:b2:38:a2:43:76:c6:a5:cc" and 1637030220<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "POLE CLEAN LTD" and pe.signatures [ i ] . serial == "30:54:f9:40:c9:31:ba:d7:b2:38:a2:43:76:c6:a5:cc" and 1637030220 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46042,13 +46042,13 @@ rule REVERSINGLABS_Cert_Blocklist_A617E23D6Ca8F34E2F7413Cd299Fc72B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3ffb592c-eec5-51b1-9840-b6b72269fc31"
+		id = "18e4d04b-ef20-5119-beab-023532f8329a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9958-L9976"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f307a0b598f0876c003aa43db50e024698b6f93931e626c085f98553c14ec2ae"
+		logic_hash = "v1_sha256_f307a0b598f0876c003aa43db50e024698b6f93931e626c085f98553c14ec2ae"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46058,7 +46058,7 @@ rule REVERSINGLABS_Cert_Blocklist_A617E23D6Ca8F34E2F7413Cd299Fc72B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EXPRESS BOOKS LTD" and (pe.signatures[i].serial=="00:a6:17:e2:3d:6c:a8:f3:4e:2f:74:13:cd:29:9f:c7:2b" or pe.signatures[i].serial=="a6:17:e2:3d:6c:a8:f3:4e:2f:74:13:cd:29:9f:c7:2b") and 1636971821<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EXPRESS BOOKS LTD" and ( pe.signatures [ i ] . serial == "00:a6:17:e2:3d:6c:a8:f3:4e:2f:74:13:cd:29:9f:c7:2b" or pe.signatures [ i ] . serial == "a6:17:e2:3d:6c:a8:f3:4e:2f:74:13:cd:29:9f:c7:2b" ) and 1636971821 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46067,13 +46067,13 @@ rule REVERSINGLABS_Cert_Blocklist_387Eeb89B8Bf626Bbf4C7C9F5B998B40 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2f4a26f2-689a-57bd-8028-d3554e339e60"
+		id = "7897e88e-2e46-5aed-99a9-9c193d48de42"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9978-L9994"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2377eeb5316d25752443735e78d0ad7de398a2677f5a0fd45fd6e6c87720d49b"
+		logic_hash = "v1_sha256_2377eeb5316d25752443735e78d0ad7de398a2677f5a0fd45fd6e6c87720d49b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46083,7 +46083,7 @@ rule REVERSINGLABS_Cert_Blocklist_387Eeb89B8Bf626Bbf4C7C9F5B998B40 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ULTRA ACADEMY LTD" and pe.signatures[i].serial=="38:7e:eb:89:b8:bf:62:6b:bf:4c:7c:9f:5b:99:8b:40" and 1637141034<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ULTRA ACADEMY LTD" and pe.signatures [ i ] . serial == "38:7e:eb:89:b8:bf:62:6b:bf:4c:7c:9f:5b:99:8b:40" and 1637141034 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46092,13 +46092,13 @@ rule REVERSINGLABS_Cert_Blocklist_292Eb1133507F42E6F36C5549C189D5E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b557864d-c573-5789-9959-8df3036d5ac5"
+		id = "d575f9c6-b681-532a-9292-27ba900ebb05"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L9996-L10012"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bc3ef217455b74900cae114d25b02325d2bef25c11873342df1dd2369cbce76a"
+		logic_hash = "v1_sha256_bc3ef217455b74900cae114d25b02325d2bef25c11873342df1dd2369cbce76a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46108,7 +46108,7 @@ rule REVERSINGLABS_Cert_Blocklist_292Eb1133507F42E6F36C5549C189D5E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Affairs-case s.r.o." and pe.signatures[i].serial=="29:2e:b1:13:35:07:f4:2e:6f:36:c5:54:9c:18:9d:5e" and 1638832273<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Affairs-case s.r.o." and pe.signatures [ i ] . serial == "29:2e:b1:13:35:07:f4:2e:6f:36:c5:54:9c:18:9d:5e" and 1638832273 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46117,13 +46117,13 @@ rule REVERSINGLABS_Cert_Blocklist_5Fbf16A33D26390A15F046C310030Cf0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "620c04df-e613-5319-aa00-646c7e0c8031"
+		id = "95d4810c-e3af-5a7a-8afa-abd412da7820"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10014-L10030"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "24bee3563e0867ef6702e7f57bbce7075f766410650ae5ce1e2e8c7b14a3eaca"
+		logic_hash = "v1_sha256_24bee3563e0867ef6702e7f57bbce7075f766410650ae5ce1e2e8c7b14a3eaca"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46133,7 +46133,7 @@ rule REVERSINGLABS_Cert_Blocklist_5Fbf16A33D26390A15F046C310030Cf0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MACHINES SATU MARE SRL" and pe.signatures[i].serial=="5f:bf:16:a3:3d:26:39:0a:15:f0:46:c3:10:03:0c:f0" and 1638390070<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MACHINES SATU MARE SRL" and pe.signatures [ i ] . serial == "5f:bf:16:a3:3d:26:39:0a:15:f0:46:c3:10:03:0c:f0" and 1638390070 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46142,13 +46142,13 @@ rule REVERSINGLABS_Cert_Blocklist_0F007898Afcba5F8Af8Ae65D01803617 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6678bd73-bf4d-5576-8bf2-b721ee288da7"
+		id = "d9a85882-ffea-50c7-a86c-dc897b63cf46"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10032-L10048"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "27610bb3bf069991803611474abf44a3bf82fc9283d0412a1c24ae46a3f5352e"
+		logic_hash = "v1_sha256_27610bb3bf069991803611474abf44a3bf82fc9283d0412a1c24ae46a3f5352e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46158,7 +46158,7 @@ rule REVERSINGLABS_Cert_Blocklist_0F007898Afcba5F8Af8Ae65D01803617 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TechnoElek s.r.o." and pe.signatures[i].serial=="0f:00:78:98:af:cb:a5:f8:af:8a:e6:5d:01:80:36:17" and 1638372946<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TechnoElek s.r.o." and pe.signatures [ i ] . serial == "0f:00:78:98:af:cb:a5:f8:af:8a:e6:5d:01:80:36:17" and 1638372946 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46167,13 +46167,13 @@ rule REVERSINGLABS_Cert_Blocklist_E55Be88Ddbd93C423220468D430905Dd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "37e60515-0395-51a5-8bfa-35e3e336d60c"
+		id = "b7d539b9-ab81-5286-b993-f4042163c7b2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10050-L10068"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "05b2f297454e7080591b85991b224193eb89fc5074eb3c2e484ceadad2de4cb7"
+		logic_hash = "v1_sha256_05b2f297454e7080591b85991b224193eb89fc5074eb3c2e484ceadad2de4cb7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46183,7 +46183,7 @@ rule REVERSINGLABS_Cert_Blocklist_E55Be88Ddbd93C423220468D430905Dd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VALVE ACTUATION LTD" and (pe.signatures[i].serial=="00:e5:5b:e8:8d:db:d9:3c:42:32:20:46:8d:43:09:05:dd" or pe.signatures[i].serial=="e5:5b:e8:8d:db:d9:3c:42:32:20:46:8d:43:09:05:dd") and 1637712000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VALVE ACTUATION LTD" and ( pe.signatures [ i ] . serial == "00:e5:5b:e8:8d:db:d9:3c:42:32:20:46:8d:43:09:05:dd" or pe.signatures [ i ] . serial == "e5:5b:e8:8d:db:d9:3c:42:32:20:46:8d:43:09:05:dd" ) and 1637712000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46192,13 +46192,13 @@ rule REVERSINGLABS_Cert_Blocklist_06Bcb74291D96096577Bdb1E165Dce85 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "da483b60-d400-54ef-84e0-ea00b299b466"
+		id = "e43ddd3d-d507-5ac1-9537-e6ba4e869ba0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10070-L10086"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "00b7ff8f3cbc04c48c71433c384d7a7884b856f261850e33ea4413a12cf5a1b5"
+		logic_hash = "v1_sha256_00b7ff8f3cbc04c48c71433c384d7a7884b856f261850e33ea4413a12cf5a1b5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46208,7 +46208,7 @@ rule REVERSINGLABS_Cert_Blocklist_06Bcb74291D96096577Bdb1E165Dce85 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Revo Security SRL" and pe.signatures[i].serial=="06:bc:b7:42:91:d9:60:96:57:7b:db:1e:16:5d:ce:85" and 1637971201<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Revo Security SRL" and pe.signatures [ i ] . serial == "06:bc:b7:42:91:d9:60:96:57:7b:db:1e:16:5d:ce:85" and 1637971201 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46217,13 +46217,13 @@ rule REVERSINGLABS_Cert_Blocklist_C8442A8185082Ef1Ed7Dc3Fff2176Aa7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2a56ff80-584b-5b8b-80ae-e763339cd17a"
+		id = "1f4aecf7-2be1-505f-8e97-4c4a7395128d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10088-L10106"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "74b1b48f0179187ea7bb8ef4663bf13da47f5c6405ecc5589706184564c05727"
+		logic_hash = "v1_sha256_74b1b48f0179187ea7bb8ef4663bf13da47f5c6405ecc5589706184564c05727"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46233,7 +46233,7 @@ rule REVERSINGLABS_Cert_Blocklist_C8442A8185082Ef1Ed7Dc3Fff2176Aa7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ambidekstr LLC" and (pe.signatures[i].serial=="00:c8:44:2a:81:85:08:2e:f1:ed:7d:c3:ff:f2:17:6a:a7" or pe.signatures[i].serial=="c8:44:2a:81:85:08:2e:f1:ed:7d:c3:ff:f2:17:6a:a7") and 1616976000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ambidekstr LLC" and ( pe.signatures [ i ] . serial == "00:c8:44:2a:81:85:08:2e:f1:ed:7d:c3:ff:f2:17:6a:a7" or pe.signatures [ i ] . serial == "c8:44:2a:81:85:08:2e:f1:ed:7d:c3:ff:f2:17:6a:a7" ) and 1616976000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46242,13 +46242,13 @@ rule REVERSINGLABS_Cert_Blocklist_0406C4A1521A38C8D0C4Aa214388E4Dc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9019330e-5ab5-5d37-85a1-0e882dbd68ce"
+		id = "b33acd6e-5bcf-5d3f-bcf6-1c7de4b4e23e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10108-L10124"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f6780751ae553771eb57201a8672847a24512e6279b6a4fd843d8ee2f326860a"
+		logic_hash = "v1_sha256_f6780751ae553771eb57201a8672847a24512e6279b6a4fd843d8ee2f326860a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46258,7 +46258,7 @@ rule REVERSINGLABS_Cert_Blocklist_0406C4A1521A38C8D0C4Aa214388E4Dc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Venezia Design SRL" and pe.signatures[i].serial=="04:06:c4:a1:52:1a:38:c8:d0:c4:aa:21:43:88:e4:dc" and 1641859201<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Venezia Design SRL" and pe.signatures [ i ] . serial == "04:06:c4:a1:52:1a:38:c8:d0:c4:aa:21:43:88:e4:dc" and 1641859201 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46267,13 +46267,13 @@ rule REVERSINGLABS_Cert_Blocklist_12705Fb66Bc22C68372A1C4E5Fa662E2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "78f9fdf0-d8c6-5316-8053-42f77adf95d1"
+		id = "e567de47-c085-5798-8903-0af2a870fc78"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10126-L10142"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f10316a26e2d34400b7c2e403eab18ab6c1cc94b35f0ac8a3f490d101d29dc8d"
+		logic_hash = "v1_sha256_f10316a26e2d34400b7c2e403eab18ab6c1cc94b35f0ac8a3f490d101d29dc8d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46283,7 +46283,7 @@ rule REVERSINGLABS_Cert_Blocklist_12705Fb66Bc22C68372A1C4E5Fa662E2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APRIL BROTHERS LTD" and pe.signatures[i].serial=="12:70:5f:b6:6b:c2:2c:68:37:2a:1c:4e:5f:a6:62:e2" and 1642464000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APRIL BROTHERS LTD" and pe.signatures [ i ] . serial == "12:70:5f:b6:6b:c2:2c:68:37:2a:1c:4e:5f:a6:62:e2" and 1642464000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46292,13 +46292,13 @@ rule REVERSINGLABS_Cert_Blocklist_3B0914E2982Be8980Aa23F49848555E5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "88ca65c4-ba0d-5676-979b-4fac737d4f21"
+		id = "b28819ae-6c3d-5502-b9b8-9ea65249e0c0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10144-L10160"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ea7d9fa7817751fef775765b54be5dd4d00c15ca50ac10fb40fb46cc3634c7b0"
+		logic_hash = "v1_sha256_ea7d9fa7817751fef775765b54be5dd4d00c15ca50ac10fb40fb46cc3634c7b0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46308,7 +46308,7 @@ rule REVERSINGLABS_Cert_Blocklist_3B0914E2982Be8980Aa23F49848555E5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Office Rat s.r.o." and pe.signatures[i].serial=="3b:09:14:e2:98:2b:e8:98:0a:a2:3f:49:84:85:55:e5" and 1643155200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Office Rat s.r.o." and pe.signatures [ i ] . serial == "3b:09:14:e2:98:2b:e8:98:0a:a2:3f:49:84:85:55:e5" and 1643155200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46317,13 +46317,13 @@ rule REVERSINGLABS_Cert_Blocklist_029Bf7E1Cb09Fe277564Bd27C267De5A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1e66d13c-3345-592c-9bf8-b8a566c8b9e6"
+		id = "6d59b221-d608-5c17-b23b-f43aeb6d1866"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10162-L10178"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3f64372d11d61c669580d90cdf2201e7f2904fb3d73d27be2ff1559c9c37614a"
+		logic_hash = "v1_sha256_3f64372d11d61c669580d90cdf2201e7f2904fb3d73d27be2ff1559c9c37614a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46333,7 +46333,7 @@ rule REVERSINGLABS_Cert_Blocklist_029Bf7E1Cb09Fe277564Bd27C267De5A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAMOYAJ LIMITED" and pe.signatures[i].serial=="02:9b:f7:e1:cb:09:fe:27:75:64:bd:27:c2:67:de:5a" and 1637712001<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SAMOYAJ LIMITED" and pe.signatures [ i ] . serial == "02:9b:f7:e1:cb:09:fe:27:75:64:bd:27:c2:67:de:5a" and 1637712001 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46342,13 +46342,13 @@ rule REVERSINGLABS_Cert_Blocklist_D3Aee8Abb9948844A3Ac1C04Cc7E6Bdf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6da50886-7f15-5565-9a1a-f6fb25a729ac"
+		id = "d1a109c0-a904-52f6-906c-b4e1e76b8d02"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10180-L10198"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3f3f1d5c871d2b73627d4281ac5bcd08799fb47f94155e82795d97c87de35e40"
+		logic_hash = "v1_sha256_3f3f1d5c871d2b73627d4281ac5bcd08799fb47f94155e82795d97c87de35e40"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46358,7 +46358,7 @@ rule REVERSINGLABS_Cert_Blocklist_D3Aee8Abb9948844A3Ac1C04Cc7E6Bdf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HOUSE 9A s.r.o" and (pe.signatures[i].serial=="00:d3:ae:e8:ab:b9:94:88:44:a3:ac:1c:04:cc:7e:6b:df" or pe.signatures[i].serial=="d3:ae:e8:ab:b9:94:88:44:a3:ac:1c:04:cc:7e:6b:df") and 1640822400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HOUSE 9A s.r.o" and ( pe.signatures [ i ] . serial == "00:d3:ae:e8:ab:b9:94:88:44:a3:ac:1c:04:cc:7e:6b:df" or pe.signatures [ i ] . serial == "d3:ae:e8:ab:b9:94:88:44:a3:ac:1c:04:cc:7e:6b:df" ) and 1640822400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46367,13 +46367,13 @@ rule REVERSINGLABS_Cert_Blocklist_734819463C1195Bd6E135Ce4D5Bf49Bc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f7dd21fa-1501-50b2-bd9c-c33cfd932a6b"
+		id = "207ac3ef-4fb6-5c0f-974a-b2481001650f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10200-L10216"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a63c05cca23b61ba6eabda2b60c617b966a2669fd3a0da30354792e5c1ae2140"
+		logic_hash = "v1_sha256_a63c05cca23b61ba6eabda2b60c617b966a2669fd3a0da30354792e5c1ae2140"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46383,7 +46383,7 @@ rule REVERSINGLABS_Cert_Blocklist_734819463C1195Bd6E135Ce4D5Bf49Bc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "videoalarm s. r. o." and pe.signatures[i].serial=="73:48:19:46:3c:11:95:bd:6e:13:5c:e4:d5:bf:49:bc" and 1637884800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "videoalarm s. r. o." and pe.signatures [ i ] . serial == "73:48:19:46:3c:11:95:bd:6e:13:5c:e4:d5:bf:49:bc" and 1637884800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46392,13 +46392,13 @@ rule REVERSINGLABS_Cert_Blocklist_Db95B22362D46A73C39E0Ac924883C5B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "527b7963-340e-5d8f-b7e1-1269c0073ec9"
+		id = "3e0e19be-bfab-5598-8bf3-cb5033ad0b5a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10218-L10236"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "895983bcb7f3a0c5ce54504f4a2ff8d652137434b8951380d756de6556d0844e"
+		logic_hash = "v1_sha256_895983bcb7f3a0c5ce54504f4a2ff8d652137434b8951380d756de6556d0844e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46408,7 +46408,7 @@ rule REVERSINGLABS_Cert_Blocklist_Db95B22362D46A73C39E0Ac924883C5B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPSLTD PLYMOUTH LTD" and (pe.signatures[i].serial=="00:db:95:b2:23:62:d4:6a:73:c3:9e:0a:c9:24:88:3c:5b" or pe.signatures[i].serial=="db:95:b2:23:62:d4:6a:73:c3:9e:0a:c9:24:88:3c:5b") and 1621296000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SPSLTD PLYMOUTH LTD" and ( pe.signatures [ i ] . serial == "00:db:95:b2:23:62:d4:6a:73:c3:9e:0a:c9:24:88:3c:5b" or pe.signatures [ i ] . serial == "db:95:b2:23:62:d4:6a:73:c3:9e:0a:c9:24:88:3c:5b" ) and 1621296000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46417,13 +46417,13 @@ rule REVERSINGLABS_Cert_Blocklist_0C48732873Ac8Ccebaf8F0E1E8329Cec : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b531341a-e8ac-5b56-a202-3c072f5d2ce0"
+		id = "74c0953c-e661-59f1-b9d9-6d05ce318dc8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10238-L10254"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7c9476a4119e013c8bb3c14b607090d592feaa5f2fc0f78d810555681d4a3733"
+		logic_hash = "v1_sha256_7c9476a4119e013c8bb3c14b607090d592feaa5f2fc0f78d810555681d4a3733"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46433,7 +46433,7 @@ rule REVERSINGLABS_Cert_Blocklist_0C48732873Ac8Ccebaf8F0E1E8329Cec : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hermetica Digital Ltd" and pe.signatures[i].serial=="0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec" and 1618272000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Hermetica Digital Ltd" and pe.signatures [ i ] . serial == "0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec" and 1618272000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46442,13 +46442,13 @@ rule REVERSINGLABS_Cert_Blocklist_C51F4Cf4D82Bc920421E1Ad93E39D490 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "727aba82-c908-51a6-9f1f-7fd8df424d8c"
+		id = "a8eba8f4-e96d-5480-92ac-b14ac82a7bf7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10256-L10274"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cef717e7fe3eb0fb958d405caaf98fa51b22b150ccbf1286d3b4634e9df81ade"
+		logic_hash = "v1_sha256_cef717e7fe3eb0fb958d405caaf98fa51b22b150ccbf1286d3b4634e9df81ade"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46458,7 +46458,7 @@ rule REVERSINGLABS_Cert_Blocklist_C51F4Cf4D82Bc920421E1Ad93E39D490 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CUT AHEAD LTD" and (pe.signatures[i].serial=="00:c5:1f:4c:f4:d8:2b:c9:20:42:1e:1a:d9:3e:39:d4:90" or pe.signatures[i].serial=="c5:1f:4c:f4:d8:2b:c9:20:42:1e:1a:d9:3e:39:d4:90") and 1644624000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CUT AHEAD LTD" and ( pe.signatures [ i ] . serial == "00:c5:1f:4c:f4:d8:2b:c9:20:42:1e:1a:d9:3e:39:d4:90" or pe.signatures [ i ] . serial == "c5:1f:4c:f4:d8:2b:c9:20:42:1e:1a:d9:3e:39:d4:90" ) and 1644624000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46467,13 +46467,13 @@ rule REVERSINGLABS_Cert_Blocklist_C96086F1894E6420D2B4Bdeea834C4D7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1268461b-676c-59b8-80c1-c54dbe1a265f"
+		id = "b9975050-82fa-5606-93e0-4950d495fb3f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10276-L10294"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "949bbd41ad4c83a05c1f004786cd296e2af80a3a559955ec90a4675cdfa04258"
+		logic_hash = "v1_sha256_949bbd41ad4c83a05c1f004786cd296e2af80a3a559955ec90a4675cdfa04258"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46483,7 +46483,7 @@ rule REVERSINGLABS_Cert_Blocklist_C96086F1894E6420D2B4Bdeea834C4D7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE FAITH SP Z O O" and (pe.signatures[i].serial=="00:c9:60:86:f1:89:4e:64:20:d2:b4:bd:ee:a8:34:c4:d7" or pe.signatures[i].serial=="c9:60:86:f1:89:4e:64:20:d2:b4:bd:ee:a8:34:c4:d7") and 1644969600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THE FAITH SP Z O O" and ( pe.signatures [ i ] . serial == "00:c9:60:86:f1:89:4e:64:20:d2:b4:bd:ee:a8:34:c4:d7" or pe.signatures [ i ] . serial == "c9:60:86:f1:89:4e:64:20:d2:b4:bd:ee:a8:34:c4:d7" ) and 1644969600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46492,13 +46492,13 @@ rule REVERSINGLABS_Cert_Blocklist_06Fa27A121Cc82230C3013Ee634B6C62 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4520e544-7a41-5dde-b90b-46cf3349297c"
+		id = "ca88f7ec-57ff-5e4e-9ccb-1d97dc2aff26"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10296-L10312"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "23ac7a97e7632536ed27cf9078b6bc1a734f1e991a20a228734b45117582f367"
+		logic_hash = "v1_sha256_23ac7a97e7632536ed27cf9078b6bc1a734f1e991a20a228734b45117582f367"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46508,7 +46508,7 @@ rule REVERSINGLABS_Cert_Blocklist_06Fa27A121Cc82230C3013Ee634B6C62 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zimmi Consulting Inc" and pe.signatures[i].serial=="06:fa:27:a1:21:cc:82:23:0c:30:13:ee:63:4b:6c:62" and 1645142401<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Zimmi Consulting Inc" and pe.signatures [ i ] . serial == "06:fa:27:a1:21:cc:82:23:0c:30:13:ee:63:4b:6c:62" and 1645142401 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46517,13 +46517,13 @@ rule REVERSINGLABS_Cert_Blocklist_9Dd3B2F7957Ba99F4B04Fcdbe03B7Aac : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "25229478-e891-5e0a-b738-6ca1fdd0012c"
+		id = "96da816e-c564-51f6-89c0-1b8fa54250c5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10314-L10332"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d4f1b75dddd47fe8a19bd8e794b4930bdcaf54d63db57422db0a9b631d4f488d"
+		logic_hash = "v1_sha256_d4f1b75dddd47fe8a19bd8e794b4930bdcaf54d63db57422db0a9b631d4f488d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46533,7 +46533,7 @@ rule REVERSINGLABS_Cert_Blocklist_9Dd3B2F7957Ba99F4B04Fcdbe03B7Aac : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DOD MEDIA LIMITED" and (pe.signatures[i].serial=="00:9d:d3:b2:f7:95:7b:a9:9f:4b:04:fc:db:e0:3b:7a:ac" or pe.signatures[i].serial=="9d:d3:b2:f7:95:7b:a9:9f:4b:04:fc:db:e0:3b:7a:ac") and 1646438400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DOD MEDIA LIMITED" and ( pe.signatures [ i ] . serial == "00:9d:d3:b2:f7:95:7b:a9:9f:4b:04:fc:db:e0:3b:7a:ac" or pe.signatures [ i ] . serial == "9d:d3:b2:f7:95:7b:a9:9f:4b:04:fc:db:e0:3b:7a:ac" ) and 1646438400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46542,13 +46542,13 @@ rule REVERSINGLABS_Cert_Blocklist_061051Ff2A8Afab10347A6F1Ff08Ecb6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4e23648f-9770-53ad-9c62-6e6239a02aa7"
+		id = "1670f233-0aa8-5076-8314-345c2b2b3610"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10334-L10350"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "db3ac3ee326c60e9abc94a2fb53d801637f044e7ab72d69e53958799e48747b7"
+		logic_hash = "v1_sha256_db3ac3ee326c60e9abc94a2fb53d801637f044e7ab72d69e53958799e48747b7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46558,7 +46558,7 @@ rule REVERSINGLABS_Cert_Blocklist_061051Ff2A8Afab10347A6F1Ff08Ecb6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TACHOPARTS SP Z O O" and pe.signatures[i].serial=="06:10:51:ff:2a:8a:fa:b1:03:47:a6:f1:ff:08:ec:b6" and 1606435200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TACHOPARTS SP Z O O" and pe.signatures [ i ] . serial == "06:10:51:ff:2a:8a:fa:b1:03:47:a6:f1:ff:08:ec:b6" and 1606435200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46567,13 +46567,13 @@ rule REVERSINGLABS_Cert_Blocklist_Eda2429083Bfafb04E6E7Bdda1B08834 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0f5852c4-7866-5e12-97e9-c73972def6c5"
+		id = "ce1ecadb-7f9d-506f-b82a-ac5967108595"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10352-L10370"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4f7d5c6929fe364c8868fddb28dd7bbf7cdcf3896d57836466af1a538190d11c"
+		logic_hash = "v1_sha256_4f7d5c6929fe364c8868fddb28dd7bbf7cdcf3896d57836466af1a538190d11c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46583,7 +46583,7 @@ rule REVERSINGLABS_Cert_Blocklist_Eda2429083Bfafb04E6E7Bdda1B08834 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OWLNET LIMITED" and (pe.signatures[i].serial=="00:ed:a2:42:90:83:bf:af:b0:4e:6e:7b:dd:a1:b0:88:34" or pe.signatures[i].serial=="ed:a2:42:90:83:bf:af:b0:4e:6e:7b:dd:a1:b0:88:34") and 1625011200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OWLNET LIMITED" and ( pe.signatures [ i ] . serial == "00:ed:a2:42:90:83:bf:af:b0:4e:6e:7b:dd:a1:b0:88:34" or pe.signatures [ i ] . serial == "ed:a2:42:90:83:bf:af:b0:4e:6e:7b:dd:a1:b0:88:34" ) and 1625011200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46592,13 +46592,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A590154B5980E566314122987Dea548 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fd2a2165-494b-5655-a322-73f033643c74"
+		id = "c559c6e7-25e4-5aa1-95b1-d5d69666378c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10372-L10388"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d5fdf2bc61fadf3e73bcf1695c48ebc465e614cdd2310f9e5f40648d9615afc4"
+		logic_hash = "v1_sha256_d5fdf2bc61fadf3e73bcf1695c48ebc465e614cdd2310f9e5f40648d9615afc4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46608,7 +46608,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A590154B5980E566314122987Dea548 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Maya logistika d.o.o." and pe.signatures[i].serial=="0a:59:01:54:b5:98:0e:56:63:14:12:29:87:de:a5:48" and 1636416000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Maya logistika d.o.o." and pe.signatures [ i ] . serial == "0a:59:01:54:b5:98:0e:56:63:14:12:29:87:de:a5:48" and 1636416000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46617,13 +46617,13 @@ rule REVERSINGLABS_Cert_Blocklist_69A72F5591Ad78A0825Fbb9402Ab9543 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "938cdd31-433d-5df7-b00e-54a7e440810b"
+		id = "47c47734-b299-50bf-8f47-db30eb25acdf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10390-L10406"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "72ca07b7722f9506c5c42b5e58c5ce9b3a7d607164a5f265015769f2831cd588"
+		logic_hash = "v1_sha256_72ca07b7722f9506c5c42b5e58c5ce9b3a7d607164a5f265015769f2831cd588"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46633,7 +46633,7 @@ rule REVERSINGLABS_Cert_Blocklist_69A72F5591Ad78A0825Fbb9402Ab9543 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PUSH BANK LIMITED" and pe.signatures[i].serial=="69:a7:2f:55:91:ad:78:a0:82:5f:bb:94:02:ab:95:43" and 1581811200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PUSH BANK LIMITED" and pe.signatures [ i ] . serial == "69:a7:2f:55:91:ad:78:a0:82:5f:bb:94:02:ab:95:43" and 1581811200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46642,13 +46642,13 @@ rule REVERSINGLABS_Cert_Blocklist_0883Db137021B51F3A2A08A76A4Bc066 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "792111be-7c8a-53f5-9ec3-e1f25f083666"
+		id = "13158822-8817-5f37-b7eb-0565fb4f0f30"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10408-L10424"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5e3c8654169830790665992f5d7669d0ca6c1c8048580b3ae70331ad2a763a6c"
+		logic_hash = "v1_sha256_5e3c8654169830790665992f5d7669d0ca6c1c8048580b3ae70331ad2a763a6c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46658,7 +46658,7 @@ rule REVERSINGLABS_Cert_Blocklist_0883Db137021B51F3A2A08A76A4Bc066 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Divertida Creative Limited" and pe.signatures[i].serial=="08:83:db:13:70:21:b5:1f:3a:2a:08:a7:6a:4b:c0:66" and 1627430400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Divertida Creative Limited" and pe.signatures [ i ] . serial == "08:83:db:13:70:21:b5:1f:3a:2a:08:a7:6a:4b:c0:66" and 1627430400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46667,13 +46667,13 @@ rule REVERSINGLABS_Cert_Blocklist_2B921Aaaba777B5A99507196C6F1C46C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0cb5be9e-a0b7-5785-87f3-ad097d4ab479"
+		id = "26dbc0cd-c6a5-5f05-8e94-6e75ca475882"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10426-L10442"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a00eb9837f7700d83862dff2077d85c68c24621d7aacf857b42587dc37976465"
+		logic_hash = "v1_sha256_a00eb9837f7700d83862dff2077d85c68c24621d7aacf857b42587dc37976465"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46683,7 +46683,7 @@ rule REVERSINGLABS_Cert_Blocklist_2B921Aaaba777B5A99507196C6F1C46C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Python Software Foundation" and pe.signatures[i].serial=="2b:92:1a:aa:ba:77:7b:5a:99:50:71:96:c6:f1:c4:6c" and 1648425600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Python Software Foundation" and pe.signatures [ i ] . serial == "2b:92:1a:aa:ba:77:7b:5a:99:50:71:96:c6:f1:c4:6c" and 1648425600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46692,13 +46692,13 @@ rule REVERSINGLABS_Cert_Blocklist_0332D5C942869Bdcabf5A8266197Cd14 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b1c650bb-b53f-5cca-8cc2-4d3498285d31"
+		id = "f3ab27d5-3661-52dd-838d-5effe5315deb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10444-L10460"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "726ac44dd8109fcd0a9120f6c0673b8ecf7d5b3a4bb81976f48402e21502201a"
+		logic_hash = "v1_sha256_726ac44dd8109fcd0a9120f6c0673b8ecf7d5b3a4bb81976f48402e21502201a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46708,7 +46708,7 @@ rule REVERSINGLABS_Cert_Blocklist_0332D5C942869Bdcabf5A8266197Cd14 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JAWRO SP Z O O" and pe.signatures[i].serial=="03:32:d5:c9:42:86:9b:dc:ab:f5:a8:26:61:97:cd:14" and 1622160000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JAWRO SP Z O O" and pe.signatures [ i ] . serial == "03:32:d5:c9:42:86:9b:dc:ab:f5:a8:26:61:97:cd:14" and 1622160000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46717,13 +46717,13 @@ rule REVERSINGLABS_Cert_Blocklist_4679C5398A279318365Fd77A84445699 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8d1810e7-9b64-52b3-91c6-f03832d61d3a"
+		id = "791a842f-af74-5500-b3c3-a93a19c1efd7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10462-L10478"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bdb68be92b3ba6b5eaa6e8e963529c0b9213942ba2552c687496ad5d12d5b472"
+		logic_hash = "v1_sha256_bdb68be92b3ba6b5eaa6e8e963529c0b9213942ba2552c687496ad5d12d5b472"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46733,7 +46733,7 @@ rule REVERSINGLABS_Cert_Blocklist_4679C5398A279318365Fd77A84445699 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HURT GROUP HOLDINGS LIMITED" and pe.signatures[i].serial=="46:79:c5:39:8a:27:93:18:36:5f:d7:7a:84:44:56:99" and 1643846400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HURT GROUP HOLDINGS LIMITED" and pe.signatures [ i ] . serial == "46:79:c5:39:8a:27:93:18:36:5f:d7:7a:84:44:56:99" and 1643846400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46742,13 +46742,13 @@ rule REVERSINGLABS_Cert_Blocklist_101D6A5A29D9A77807553Ceac669D853 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "918fa696-5c92-551b-a87b-6410a6dc718a"
+		id = "ce9b507c-03cf-5965-bc76-f6cc2df1bab1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10480-L10496"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bce92750f71477ecfa7b8213724344708066c0e6133a47cd6758bbd9f8f9da5f"
+		logic_hash = "v1_sha256_bce92750f71477ecfa7b8213724344708066c0e6133a47cd6758bbd9f8f9da5f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46758,7 +46758,7 @@ rule REVERSINGLABS_Cert_Blocklist_101D6A5A29D9A77807553Ceac669D853 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIC GROUP LIMITED" and pe.signatures[i].serial=="10:1d:6a:5a:29:d9:a7:78:07:55:3c:ea:c6:69:d8:53" and 1646352000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIC GROUP LIMITED" and pe.signatures [ i ] . serial == "10:1d:6a:5a:29:d9:a7:78:07:55:3c:ea:c6:69:d8:53" and 1646352000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46767,13 +46767,13 @@ rule REVERSINGLABS_Cert_Blocklist_6000F8C02B0A15B1E53B8399845Faddf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b025fe73-89fa-55f2-8b3a-cb46251669e6"
+		id = "f14ad762-0a8e-524c-93d2-438d38250311"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10498-L10514"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "00ceb241555154cab97ef616042dbd966f3a8fae257e142dfe6bad9559bd1724"
+		logic_hash = "v1_sha256_00ceb241555154cab97ef616042dbd966f3a8fae257e142dfe6bad9559bd1724"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46783,7 +46783,7 @@ rule REVERSINGLABS_Cert_Blocklist_6000F8C02B0A15B1E53B8399845Faddf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAY LIMITED" and pe.signatures[i].serial=="60:00:f8:c0:2b:0a:15:b1:e5:3b:83:99:84:5f:ad:df" and 1644278400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SAY LIMITED" and pe.signatures [ i ] . serial == "60:00:f8:c0:2b:0a:15:b1:e5:3b:83:99:84:5f:ad:df" and 1644278400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46792,13 +46792,13 @@ rule REVERSINGLABS_Cert_Blocklist_121070Be1E782F206985543Bc7Bc58B6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3f5eee11-4106-5923-9563-84f81199bea0"
+		id = "6ac0c735-d903-5cb7-9a4b-0002a7356381"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10516-L10532"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a5d603cf64c8a16fa12daf9c6b5d0850e6145fb39b38442ed724ec0f849b8be9"
+		logic_hash = "v1_sha256_a5d603cf64c8a16fa12daf9c6b5d0850e6145fb39b38442ed724ec0f849b8be9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46808,7 +46808,7 @@ rule REVERSINGLABS_Cert_Blocklist_121070Be1E782F206985543Bc7Bc58B6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Prod Can Holdings Inc." and pe.signatures[i].serial=="12:10:70:be:1e:78:2f:20:69:85:54:3b:c7:bc:58:b6" and 1647820800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Prod Can Holdings Inc." and pe.signatures [ i ] . serial == "12:10:70:be:1e:78:2f:20:69:85:54:3b:c7:bc:58:b6" and 1647820800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46817,13 +46817,13 @@ rule REVERSINGLABS_Cert_Blocklist_5226A724Cfa0B4Bc0164Ecda3F02A3Dc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5a4abffb-ac0d-5e70-8193-0cd1a83377ac"
+		id = "4de027e4-fce6-54d6-af6c-eb3f38b29e4b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10534-L10550"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0ba1155b30761f48674aaa82a70a06fea30cced6518f089f3f9f173a4eb06a09"
+		logic_hash = "v1_sha256_0ba1155b30761f48674aaa82a70a06fea30cced6518f089f3f9f173a4eb06a09"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46833,7 +46833,7 @@ rule REVERSINGLABS_Cert_Blocklist_5226A724Cfa0B4Bc0164Ecda3F02A3Dc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VALENTE SP Z O O" and pe.signatures[i].serial=="52:26:a7:24:cf:a0:b4:bc:01:64:ec:da:3f:02:a3:dc" and 1647302400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VALENTE SP Z O O" and pe.signatures [ i ] . serial == "52:26:a7:24:cf:a0:b4:bc:01:64:ec:da:3f:02:a3:dc" and 1647302400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46842,13 +46842,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A7Be7722B65A866Ebcd3Bd7F8F10825 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2b177573-8b9f-538f-8d07-b7baede1148d"
+		id = "4bcefc41-f1a6-578e-8b59-305b1e007bd5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10552-L10568"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c4aa22241ef72d454db4ec0fb0933abfa7b1d8d1029b45410475832cda4a2af4"
+		logic_hash = "v1_sha256_c4aa22241ef72d454db4ec0fb0933abfa7b1d8d1029b45410475832cda4a2af4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46858,7 +46858,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A7Be7722B65A866Ebcd3Bd7F8F10825 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rebound Infotech Limited" and pe.signatures[i].serial=="0a:7b:e7:72:2b:65:a8:66:eb:cd:3b:d7:f8:f1:08:25" and 1637971200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rebound Infotech Limited" and pe.signatures [ i ] . serial == "0a:7b:e7:72:2b:65:a8:66:eb:cd:3b:d7:f8:f1:08:25" and 1637971200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46867,13 +46867,13 @@ rule REVERSINGLABS_Cert_Blocklist_05634456Dbedb3556Ca8415E64815C5D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c9a05c35-2aed-5944-aad7-65ae2c290c6c"
+		id = "4382f846-0ce0-5b1f-a69f-b52e9f3dfab3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10570-L10586"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f5941c74821c0cd76633393d0346a9de2c7bccc666dc20b34c5b4d733faefc8f"
+		logic_hash = "v1_sha256_f5941c74821c0cd76633393d0346a9de2c7bccc666dc20b34c5b4d733faefc8f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46883,7 +46883,7 @@ rule REVERSINGLABS_Cert_Blocklist_05634456Dbedb3556Ca8415E64815C5D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Walden Intertech Inc." and pe.signatures[i].serial=="05:63:44:56:db:ed:b3:55:6c:a8:41:5e:64:81:5c:5d" and 1648425600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Walden Intertech Inc." and pe.signatures [ i ] . serial == "05:63:44:56:db:ed:b3:55:6c:a8:41:5e:64:81:5c:5d" and 1648425600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46892,13 +46892,13 @@ rule REVERSINGLABS_Cert_Blocklist_2E07A8D6E3B25Ae010C8Ed2C4Ab0Fb37 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "39d23cbf-862f-5a3d-9e30-b3f0929963d5"
+		id = "e297b902-b471-5c8c-9733-f7058b5c83fe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10588-L10604"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bad2144c9cde02a75fa968e3c24178f3ba73b0addb2b4967f24733b933e0eeb6"
+		logic_hash = "v1_sha256_bad2144c9cde02a75fa968e3c24178f3ba73b0addb2b4967f24733b933e0eeb6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46908,7 +46908,7 @@ rule REVERSINGLABS_Cert_Blocklist_2E07A8D6E3B25Ae010C8Ed2C4Ab0Fb37 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Emurasoft, Inc." and pe.signatures[i].serial=="2e:07:a8:d6:e3:b2:5a:e0:10:c8:ed:2c:4a:b0:fb:37" and 1650499200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Emurasoft, Inc." and pe.signatures [ i ] . serial == "2e:07:a8:d6:e3:b2:5a:e0:10:c8:ed:2c:4a:b0:fb:37" and 1650499200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46917,13 +46917,13 @@ rule REVERSINGLABS_Cert_Blocklist_30B4Eeebd88Fd205Acc8577Bbaed8655 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "27c60ade-41e1-5ba4-be8d-275edc01b5ba"
+		id = "d443322d-3193-518a-aabd-fb087867e02d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10606-L10622"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "673ec5a1cacb9a7be101a4a533baf5a1eab4e6dd8721c69e56636701c5303c72"
+		logic_hash = "v1_sha256_673ec5a1cacb9a7be101a4a533baf5a1eab4e6dd8721c69e56636701c5303c72"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46933,7 +46933,7 @@ rule REVERSINGLABS_Cert_Blocklist_30B4Eeebd88Fd205Acc8577Bbaed8655 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Enforcer Srl" and pe.signatures[i].serial=="30:b4:ee:eb:d8:8f:d2:05:ac:c8:57:7b:ba:ed:86:55" and 1646179200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Enforcer Srl" and pe.signatures [ i ] . serial == "30:b4:ee:eb:d8:8f:d2:05:ac:c8:57:7b:ba:ed:86:55" and 1646179200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46942,13 +46942,13 @@ rule REVERSINGLABS_Cert_Blocklist_B3391A6C1B3C6836533959E2384Ab4Ca : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ab274ae3-0884-517a-a221-2c952fc9d74c"
+		id = "59d20f81-c017-50cf-b36c-6b7f3be01ff2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10624-L10642"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "38e38acfbfbf63b7179d2f8656f70224afa9269a7bdecd10ccbbbd92a6a216d3"
+		logic_hash = "v1_sha256_38e38acfbfbf63b7179d2f8656f70224afa9269a7bdecd10ccbbbd92a6a216d3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46958,7 +46958,7 @@ rule REVERSINGLABS_Cert_Blocklist_B3391A6C1B3C6836533959E2384Ab4Ca : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VERIFIED SOFTWARE LLC" and (pe.signatures[i].serial=="00:b3:39:1a:6c:1b:3c:68:36:53:39:59:e2:38:4a:b4:ca" or pe.signatures[i].serial=="b3:39:1a:6c:1b:3c:68:36:53:39:59:e2:38:4a:b4:ca") and 1595462400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VERIFIED SOFTWARE LLC" and ( pe.signatures [ i ] . serial == "00:b3:39:1a:6c:1b:3c:68:36:53:39:59:e2:38:4a:b4:ca" or pe.signatures [ i ] . serial == "b3:39:1a:6c:1b:3c:68:36:53:39:59:e2:38:4a:b4:ca" ) and 1595462400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46967,13 +46967,13 @@ rule REVERSINGLABS_Cert_Blocklist_05D50A0E09Bb9A836Ffb90A3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f2e0959f-3bc6-5552-8f7a-f84672fb597d"
+		id = "0f5e412a-bafc-5518-bca6-0d72ba076778"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10644-L10660"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1bd1960cd6dd8bf83472dc2b1809b84ceb3db68a5e6c3ba68f28ad922230b2ed"
+		logic_hash = "v1_sha256_1bd1960cd6dd8bf83472dc2b1809b84ceb3db68a5e6c3ba68f28ad922230b2ed"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -46983,7 +46983,7 @@ rule REVERSINGLABS_Cert_Blocklist_05D50A0E09Bb9A836Ffb90A3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Toliz Info Tech Solutions INC." and pe.signatures[i].serial=="05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3" and 1643892810<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Toliz Info Tech Solutions INC." and pe.signatures [ i ] . serial == "05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3" and 1643892810 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -46992,13 +46992,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A2787Fbb4627C91611573E323584113 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "64848927-6a60-5ea9-bae5-7d15c3f35ca6"
+		id = "4ce05212-6d22-558f-8eb9-e1a405f7493c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10662-L10678"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "efa352beafb56b95a89554bc8929f8e01a4da46eef1f6cf8a1487a2a06bc1b3e"
+		logic_hash = "v1_sha256_efa352beafb56b95a89554bc8929f8e01a4da46eef1f6cf8a1487a2a06bc1b3e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47008,7 +47008,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A2787Fbb4627C91611573E323584113 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "exxon.com" and pe.signatures[i].serial=="0a:27:87:fb:b4:62:7c:91:61:15:73:e3:23:58:41:13" and 1640822400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "exxon.com" and pe.signatures [ i ] . serial == "0a:27:87:fb:b4:62:7c:91:61:15:73:e3:23:58:41:13" and 1640822400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47017,13 +47017,13 @@ rule REVERSINGLABS_Cert_Blocklist_1D36C4F439D651503589318F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f72b8e2c-b799-5aec-a69a-e42cdb3e2ae1"
+		id = "e6fb66f9-acf1-5fe0-bda2-e408a68f6fc6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10680-L10696"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "73dc3c01041d50100a8d5519afe1a80f470c30175f9ad1bf76ac287ac199a959"
+		logic_hash = "v1_sha256_73dc3c01041d50100a8d5519afe1a80f470c30175f9ad1bf76ac287ac199a959"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47033,7 +47033,7 @@ rule REVERSINGLABS_Cert_Blocklist_1D36C4F439D651503589318F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REDWOOD MARKETING SOLUTIONS INC." and pe.signatures[i].serial=="1d:36:c4:f4:39:d6:51:50:35:89:31:8f" and 1651518469<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "REDWOOD MARKETING SOLUTIONS INC." and pe.signatures [ i ] . serial == "1d:36:c4:f4:39:d6:51:50:35:89:31:8f" and 1651518469 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47042,13 +47042,13 @@ rule REVERSINGLABS_Cert_Blocklist_26F855A25890B749578F13E4B9459768 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d873b0d4-dff5-5ee2-a70f-b067602b217e"
+		id = "cce72c4a-e100-5dc2-ad42-963afb837443"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10698-L10714"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "35bfa39ef8f03d10af884f288278ea6ad3aff31cbae111057c2b619c6dc0a752"
+		logic_hash = "v1_sha256_35bfa39ef8f03d10af884f288278ea6ad3aff31cbae111057c2b619c6dc0a752"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47058,7 +47058,7 @@ rule REVERSINGLABS_Cert_Blocklist_26F855A25890B749578F13E4B9459768 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Boo\\xE2\\x80\\x99s Q & Sweets Corporation" and pe.signatures[i].serial=="26:f8:55:a2:58:90:b7:49:57:8f:13:e4:b9:45:97:68" and 1645401600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Boo\\xE2\\x80\\x99s Q & Sweets Corporation" and pe.signatures [ i ] . serial == "26:f8:55:a2:58:90:b7:49:57:8f:13:e4:b9:45:97:68" and 1645401600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47067,13 +47067,13 @@ rule REVERSINGLABS_Cert_Blocklist_0F1Ae2239Bb96C5Aef49D0Ae50266912 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "44c878ab-75b2-5cd3-a019-94982a508e0f"
+		id = "b0664ef1-2178-5e89-82aa-eebc9ef2d2bb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10716-L10732"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4f88df4fc2f4cd89aa177ce09caab3e2660267ae883f7ab54c22a9ba1657bad0"
+		logic_hash = "v1_sha256_4f88df4fc2f4cd89aa177ce09caab3e2660267ae883f7ab54c22a9ba1657bad0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47083,7 +47083,7 @@ rule REVERSINGLABS_Cert_Blocklist_0F1Ae2239Bb96C5Aef49D0Ae50266912 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aarav Consulting Inc." and pe.signatures[i].serial=="0f:1a:e2:23:9b:b9:6c:5a:ef:49:d0:ae:50:26:69:12" and 1653004800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Aarav Consulting Inc." and pe.signatures [ i ] . serial == "0f:1a:e2:23:9b:b9:6c:5a:ef:49:d0:ae:50:26:69:12" and 1653004800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47092,13 +47092,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Deea179F5757Fe529043577762419Df : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ef29c813-e914-5766-990f-76c14d18ec79"
+		id = "0f606b37-21db-5153-875b-00599fc32fdb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10734-L10750"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "67c3d3496caf54ca0b1afc4d1dcc902e2f3632ac6708f85e163d427b567d098f"
+		logic_hash = "v1_sha256_67c3d3496caf54ca0b1afc4d1dcc902e2f3632ac6708f85e163d427b567d098f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47108,7 +47108,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Deea179F5757Fe529043577762419Df : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPIRIT CONSULTING s. r. o." and pe.signatures[i].serial=="1d:ee:a1:79:f5:75:7f:e5:29:04:35:77:76:24:19:df" and 1645401600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SPIRIT CONSULTING s. r. o." and pe.signatures [ i ] . serial == "1d:ee:a1:79:f5:75:7f:e5:29:04:35:77:76:24:19:df" and 1645401600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47117,13 +47117,13 @@ rule REVERSINGLABS_Cert_Blocklist_5B1F9Ec88D185631Ab032Dbfd5166C0D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "51c596cd-3033-51ef-914f-310d2bbfbd5f"
+		id = "eade6cd2-4b87-5a82-a666-d1c48645e6e8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10752-L10768"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dec9d43c6911deb5f35c45692bfd6ef47f85d955f5e59041e58a1f0d2fc306e3"
+		logic_hash = "v1_sha256_dec9d43c6911deb5f35c45692bfd6ef47f85d955f5e59041e58a1f0d2fc306e3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47133,7 +47133,7 @@ rule REVERSINGLABS_Cert_Blocklist_5B1F9Ec88D185631Ab032Dbfd5166C0D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TOPFLIGHT GROUP LIMITED" and pe.signatures[i].serial=="5b:1f:9e:c8:8d:18:56:31:ab:03:2d:bf:d5:16:6c:0d" and 1656028800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TOPFLIGHT GROUP LIMITED" and pe.signatures [ i ] . serial == "5b:1f:9e:c8:8d:18:56:31:ab:03:2d:bf:d5:16:6c:0d" and 1656028800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47142,13 +47142,13 @@ rule REVERSINGLABS_Cert_Blocklist_58Af00Ce542760Fc116B41Fa92E18589 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bb58ae8d-ef28-5644-abe8-2d4d8c892e95"
+		id = "acd28f30-2705-5456-85ac-cdfeed62b18d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10770-L10786"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0ff773d252e5e0402171ae15d7ab43bcfd313eb8c326ed5f128a89ec43386a52"
+		logic_hash = "v1_sha256_0ff773d252e5e0402171ae15d7ab43bcfd313eb8c326ed5f128a89ec43386a52"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47158,7 +47158,7 @@ rule REVERSINGLABS_Cert_Blocklist_58Af00Ce542760Fc116B41Fa92E18589 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DICKIE MUSDALE WINDFARM LIMITED" and pe.signatures[i].serial=="58:af:00:ce:54:27:60:fc:11:6b:41:fa:92:e1:85:89" and 1654819200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DICKIE MUSDALE WINDFARM LIMITED" and pe.signatures [ i ] . serial == "58:af:00:ce:54:27:60:fc:11:6b:41:fa:92:e1:85:89" and 1654819200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47167,13 +47167,13 @@ rule REVERSINGLABS_Cert_Blocklist_25Ba18A267D6D8E08Ebc6E2457D58D1E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "eb06576e-11ea-58ba-aa19-68c161f6aa68"
+		id = "02a02f47-26a5-5947-b6e8-4cfa74caf29f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10788-L10804"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "174fe170c26a8197486e7b390d9fce4da61fb68ee5dc9486d43dbeb3cf659c3a"
+		logic_hash = "v1_sha256_174fe170c26a8197486e7b390d9fce4da61fb68ee5dc9486d43dbeb3cf659c3a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47183,7 +47183,7 @@ rule REVERSINGLABS_Cert_Blocklist_25Ba18A267D6D8E08Ebc6E2457D58D1E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "5Y TECHNOLOGY LIMITED" and pe.signatures[i].serial=="25:ba:18:a2:67:d6:d8:e0:8e:bc:6e:24:57:d5:8d:1e" and 1648684800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "5Y TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "25:ba:18:a2:67:d6:d8:e0:8e:bc:6e:24:57:d5:8d:1e" and 1648684800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47192,13 +47192,13 @@ rule REVERSINGLABS_Cert_Blocklist_12Df5Ff3460979Cec1288D874A9Fbf83 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9158c9a5-37fc-54bc-9601-3aa347a421ab"
+		id = "fedd2fd6-1a04-5110-a9ed-eea4a52fee73"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10806-L10822"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3d4b5e56962d04bc35451eeab4c1870c8653c9afcbb28dc6bad7cfb1711e9df1"
+		logic_hash = "v1_sha256_3d4b5e56962d04bc35451eeab4c1870c8653c9afcbb28dc6bad7cfb1711e9df1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47208,7 +47208,7 @@ rule REVERSINGLABS_Cert_Blocklist_12Df5Ff3460979Cec1288D874A9Fbf83 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORWARD MUSIC AGENCY SRL" and pe.signatures[i].serial=="12:df:5f:f3:46:09:79:ce:c1:28:8d:87:4a:9f:bf:83" and 1599091200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FORWARD MUSIC AGENCY SRL" and pe.signatures [ i ] . serial == "12:df:5f:f3:46:09:79:ce:c1:28:8d:87:4a:9f:bf:83" and 1599091200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47217,13 +47217,13 @@ rule REVERSINGLABS_Cert_Blocklist_Df2547B2Cab5689A81D61De80Eaaa3A2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1e76a088-b0f2-54d6-b730-77552c74d7bd"
+		id = "a23a764d-09e1-5fe5-b28a-392ff98ea1a9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10824-L10842"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cde89ae5b77ff6833fe642bdd74e81763ef068e31c07e7881906e4e4a5939942"
+		logic_hash = "v1_sha256_cde89ae5b77ff6833fe642bdd74e81763ef068e31c07e7881906e4e4a5939942"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47233,7 +47233,7 @@ rule REVERSINGLABS_Cert_Blocklist_Df2547B2Cab5689A81D61De80Eaaa3A2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORWARD MUSIC AGENCY SRL" and (pe.signatures[i].serial=="00:df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2" or pe.signatures[i].serial=="df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2") and 1657756800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FORWARD MUSIC AGENCY SRL" and ( pe.signatures [ i ] . serial == "00:df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2" or pe.signatures [ i ] . serial == "df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2" ) and 1657756800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47242,13 +47242,13 @@ rule REVERSINGLABS_Cert_Blocklist_28B691272719B1Ee : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8f1d125a-de0f-525b-8dac-702bc123cc53"
+		id = "9bc8c99e-6b00-597f-a7b3-58064657235e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10844-L10860"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0bd973f415b7cfa0858c705c4486da9f181c7259af01d1cff486fb6b8e8e775b"
+		logic_hash = "v1_sha256_0bd973f415b7cfa0858c705c4486da9f181c7259af01d1cff486fb6b8e8e775b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47258,7 +47258,7 @@ rule REVERSINGLABS_Cert_Blocklist_28B691272719B1Ee : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and pe.signatures[i].serial=="28:b6:91:27:27:19:b1:ee" and 1616410532<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "2021945 Ontario Inc." and pe.signatures [ i ] . serial == "28:b6:91:27:27:19:b1:ee" and 1616410532 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47267,13 +47267,13 @@ rule REVERSINGLABS_Cert_Blocklist_1C897216E58E83Cbe74Ad03284E1Fb82 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8805805d-312d-5bd4-94da-c18270ac26bf"
+		id = "4616de7a-eb1c-5ba4-aad0-e69320438333"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10862-L10878"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6b3b2708d3a442fa6425e60ae900c94fc22fbfdb47f290ff56e9d349d99fd85f"
+		logic_hash = "v1_sha256_6b3b2708d3a442fa6425e60ae900c94fc22fbfdb47f290ff56e9d349d99fd85f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47283,7 +47283,7 @@ rule REVERSINGLABS_Cert_Blocklist_1C897216E58E83Cbe74Ad03284E1Fb82 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "M-Trans Maciej Caban" and pe.signatures[i].serial=="1c:89:72:16:e5:8e:83:cb:e7:4a:d0:32:84:e1:fb:82" and 1639119705<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "M-Trans Maciej Caban" and pe.signatures [ i ] . serial == "1c:89:72:16:e5:8e:83:cb:e7:4a:d0:32:84:e1:fb:82" and 1639119705 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47292,13 +47292,13 @@ rule REVERSINGLABS_Cert_Blocklist_5A364C4957D93406F76321C2316F42F0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "49e36ae5-25f0-5e1d-82f0-c7ada2b4d914"
+		id = "98154f77-c7f8-5982-9dd6-9bdec66eadf6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10880-L10896"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fe3a2b906debb3f03e6a403829fca02c751754e9a02442a962c66defb84aed83"
+		logic_hash = "v1_sha256_fe3a2b906debb3f03e6a403829fca02c751754e9a02442a962c66defb84aed83"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47308,7 +47308,7 @@ rule REVERSINGLABS_Cert_Blocklist_5A364C4957D93406F76321C2316F42F0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Board Game Bucket Ltd" and pe.signatures[i].serial=="5a:36:4c:49:57:d9:34:06:f7:63:21:c2:31:6f:42:f0" and 1661337307<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Board Game Bucket Ltd" and pe.signatures [ i ] . serial == "5a:36:4c:49:57:d9:34:06:f7:63:21:c2:31:6f:42:f0" and 1661337307 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47317,13 +47317,13 @@ rule REVERSINGLABS_Cert_Blocklist_E7E7F7180666546Ce7A8Da32119F5Ce1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8984ac03-2646-54a1-a6d3-4c2cc72806e7"
+		id = "0d461f01-a0bf-53b5-bbde-329b1b6f692c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10898-L10916"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "940f6508208998593f309ffeeeda20ab475d427c952a14871b6e58e17d2a4c85"
+		logic_hash = "v1_sha256_940f6508208998593f309ffeeeda20ab475d427c952a14871b6e58e17d2a4c85"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47333,7 +47333,7 @@ rule REVERSINGLABS_Cert_Blocklist_E7E7F7180666546Ce7A8Da32119F5Ce1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "C\\xC3\\x94NG TY TNHH PDF SOFTWARE" and (pe.signatures[i].serial=="00:e7:e7:f7:18:06:66:54:6c:e7:a8:da:32:11:9f:5c:e1" or pe.signatures[i].serial=="e7:e7:f7:18:06:66:54:6c:e7:a8:da:32:11:9f:5c:e1") and 1661558399<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "C\\xC3\\x94NG TY TNHH PDF SOFTWARE" and ( pe.signatures [ i ] . serial == "00:e7:e7:f7:18:06:66:54:6c:e7:a8:da:32:11:9f:5c:e1" or pe.signatures [ i ] . serial == "e7:e7:f7:18:06:66:54:6c:e7:a8:da:32:11:9f:5c:e1" ) and 1661558399 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47342,13 +47342,13 @@ rule REVERSINGLABS_Cert_Blocklist_062B2827500C5Df35A83F661B3Af5Dd3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "784c58d9-9a13-5402-867e-c1b144512957"
+		id = "ea1caf0b-8f2f-5ba3-941f-0412e8b054e8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10918-L10934"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4edc263b08b21428b5f2f4f14f9582c0f96f79cb49fbba563c103bf8bb2037a6"
+		logic_hash = "v1_sha256_4edc263b08b21428b5f2f4f14f9582c0f96f79cb49fbba563c103bf8bb2037a6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47358,7 +47358,7 @@ rule REVERSINGLABS_Cert_Blocklist_062B2827500C5Df35A83F661B3Af5Dd3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "*.eos.com" and pe.signatures[i].serial=="06:2b:28:27:50:0c:5d:f3:5a:83:f6:61:b3:af:5d:d3" and 1651449600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "*.eos.com" and pe.signatures [ i ] . serial == "06:2b:28:27:50:0c:5d:f3:5a:83:f6:61:b3:af:5d:d3" and 1651449600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47367,13 +47367,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Bf27695Fd20B588F2B2F173B6Caf2Ba : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a3e6923a-f2c4-5d7c-aeab-bdb7fe03c597"
+		id = "7730635c-c41d-56f4-a1c2-e38d4a6232f7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10936-L10952"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "94d8739761b6a8ee91550be47432b046609b076aab6e57996de123a0fcaba73e"
+		logic_hash = "v1_sha256_94d8739761b6a8ee91550be47432b046609b076aab6e57996de123a0fcaba73e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47383,7 +47383,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Bf27695Fd20B588F2B2F173B6Caf2Ba : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Game Warriors Limited" and pe.signatures[i].serial=="7b:f2:76:95:fd:20:b5:88:f2:b2:f1:73:b6:ca:f2:ba" and 1662112800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Game Warriors Limited" and pe.signatures [ i ] . serial == "7b:f2:76:95:fd:20:b5:88:f2:b2:f1:73:b6:ca:f2:ba" and 1662112800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47392,13 +47392,13 @@ rule REVERSINGLABS_Cert_Blocklist_1B248C8508042D36Bbd5D92D189C61D8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4ad05207-10d1-53c5-8383-a3c71a447ed6"
+		id = "9698b60c-11a8-5dbe-ab8b-0ce827ca2fd8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10954-L10970"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2c063d0878a8bf6cd637e1dac2cb9164beb52c951e01858a7c3c9c4c1a853f54"
+		logic_hash = "v1_sha256_2c063d0878a8bf6cd637e1dac2cb9164beb52c951e01858a7c3c9c4c1a853f54"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47408,7 +47408,7 @@ rule REVERSINGLABS_Cert_Blocklist_1B248C8508042D36Bbd5D92D189C61D8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Digital Robin Limited" and pe.signatures[i].serial=="1b:24:8c:85:08:04:2d:36:bb:d5:d9:2d:18:9c:61:d8" and 1663171218<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Digital Robin Limited" and pe.signatures [ i ] . serial == "1b:24:8c:85:08:04:2d:36:bb:d5:d9:2d:18:9c:61:d8" and 1663171218 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47417,13 +47417,13 @@ rule REVERSINGLABS_Cert_Blocklist_032660Ee1D49Ad35086027473E2614E5E724 : INFO FI
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "29cb9255-0a34-58e8-88b2-fad988c7d229"
+		id = "b7b2a0ae-aeea-553d-b195-de6ba4f46047"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10972-L10988"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8d1435d2fa70db12cde2f9098e35ca1737f5aac36bac91329b28f03aad090e90"
+		logic_hash = "v1_sha256_8d1435d2fa70db12cde2f9098e35ca1737f5aac36bac91329b28f03aad090e90"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47433,7 +47433,7 @@ rule REVERSINGLABS_Cert_Blocklist_032660Ee1D49Ad35086027473E2614E5E724 : INFO FI
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "sunshine.com" and pe.signatures[i].serial=="03:26:60:ee:1d:49:ad:35:08:60:27:47:3e:26:14:e5:e7:24" and 1660238245<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "sunshine.com" and pe.signatures [ i ] . serial == "03:26:60:ee:1d:49:ad:35:08:60:27:47:3e:26:14:e5:e7:24" and 1660238245 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47442,13 +47442,13 @@ rule REVERSINGLABS_Cert_Blocklist_043052956E1E6Dbd5F6Ae3D8B82Cad2A2Ed8 : INFO FI
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ac09f8ac-fbdd-5989-a7e7-07373a69213b"
+		id = "1f0d8573-6497-573c-95f5-e6c3bcf7997e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L10990-L11006"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c29fb109c741437a3739f1c42aadace8f612ef1e3ea90e3e2bdd8a92c85e766a"
+		logic_hash = "v1_sha256_c29fb109c741437a3739f1c42aadace8f612ef1e3ea90e3e2bdd8a92c85e766a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47458,7 +47458,7 @@ rule REVERSINGLABS_Cert_Blocklist_043052956E1E6Dbd5F6Ae3D8B82Cad2A2Ed8 : INFO FI
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ok.com" and pe.signatures[i].serial=="04:30:52:95:6e:1e:6d:bd:5f:6a:e3:d8:b8:2c:ad:2a:2e:d8" and 1662149613<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ok.com" and pe.signatures [ i ] . serial == "04:30:52:95:6e:1e:6d:bd:5f:6a:e3:d8:b8:2c:ad:2a:2e:d8" and 1662149613 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47467,13 +47467,13 @@ rule REVERSINGLABS_Cert_Blocklist_Dbc03Ca7E6Ae6Db6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a5ac5da6-0bb0-5327-ac3a-b53d2f103fe6"
+		id = "0873c226-3eb9-5734-8288-bba401b5ee23"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11008-L11026"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0077b9c46ddd98a4929878ba4ba9476ed7fb1d7bf6e30c3ae0f950445d01e8f3"
+		logic_hash = "v1_sha256_0077b9c46ddd98a4929878ba4ba9476ed7fb1d7bf6e30c3ae0f950445d01e8f3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47483,7 +47483,7 @@ rule REVERSINGLABS_Cert_Blocklist_Dbc03Ca7E6Ae6Db6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPIDER DEVELOPMENTS PTY LTD" and (pe.signatures[i].serial=="00:db:c0:3c:a7:e6:ae:6d:b6" or pe.signatures[i].serial=="db:c0:3c:a7:e6:ae:6d:b6") and 1600826873<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SPIDER DEVELOPMENTS PTY LTD" and ( pe.signatures [ i ] . serial == "00:db:c0:3c:a7:e6:ae:6d:b6" or pe.signatures [ i ] . serial == "db:c0:3c:a7:e6:ae:6d:b6" ) and 1600826873 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47492,13 +47492,13 @@ rule REVERSINGLABS_Cert_Blocklist_7D27332C3Cb3A382A4Fd232C5C66A2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d8390528-ff27-514d-ab89-fd563a19ce3c"
+		id = "66d89af3-9849-5604-a230-c06b62f8748d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11028-L11044"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c1c50015db7f97b530819b40e2578463a6021bfff8e2582858a4c3fbd1a9b9bc"
+		logic_hash = "v1_sha256_c1c50015db7f97b530819b40e2578463a6021bfff8e2582858a4c3fbd1a9b9bc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47508,7 +47508,7 @@ rule REVERSINGLABS_Cert_Blocklist_7D27332C3Cb3A382A4Fd232C5C66A2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MALVINA RECRUITMENT LIMITED" and pe.signatures[i].serial=="7d:27:33:2c:3c:b3:a3:82:a4:fd:23:2c:5c:66:a2" and 1655424000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MALVINA RECRUITMENT LIMITED" and pe.signatures [ i ] . serial == "7d:27:33:2c:3c:b3:a3:82:a4:fd:23:2c:5c:66:a2" and 1655424000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47517,13 +47517,13 @@ rule REVERSINGLABS_Cert_Blocklist_82D224323Efa65060B641F51Fadfef02 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "166949cf-dbff-5713-950e-46d1f3edc61f"
+		id = "a84518d6-7f16-58c4-8cea-8e437991316f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11046-L11064"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9d361c91ed24b6c20a7b35957e26f208ce8e0a3d79c5a6fed6278acd826ccf49"
+		logic_hash = "v1_sha256_9d361c91ed24b6c20a7b35957e26f208ce8e0a3d79c5a6fed6278acd826ccf49"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47533,7 +47533,7 @@ rule REVERSINGLABS_Cert_Blocklist_82D224323Efa65060B641F51Fadfef02 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAVAS INVESTMENTS PTY LTD" and (pe.signatures[i].serial=="00:82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02" or pe.signatures[i].serial=="82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02") and 1665100800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SAVAS INVESTMENTS PTY LTD" and ( pe.signatures [ i ] . serial == "00:82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02" or pe.signatures [ i ] . serial == "82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02" ) and 1665100800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47542,13 +47542,13 @@ rule REVERSINGLABS_Cert_Blocklist_890570B6B0E2868A53Be3F8F904A88Ee : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "681d233c-d5a2-5f25-bdb9-125149a291c4"
+		id = "e066c464-2128-557a-b663-7d8fdd5a3f30"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11066-L11084"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fb7af8ec09da2fecaaaed8c7770966f11ef8a44a131553a9d1412387db2fb7ea"
+		logic_hash = "v1_sha256_fb7af8ec09da2fecaaaed8c7770966f11ef8a44a131553a9d1412387db2fb7ea"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47558,7 +47558,7 @@ rule REVERSINGLABS_Cert_Blocklist_890570B6B0E2868A53Be3F8F904A88Ee : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JESEN LESS d.o.o." and (pe.signatures[i].serial=="00:89:05:70:b6:b0:e2:86:8a:53:be:3f:8f:90:4a:88:ee" or pe.signatures[i].serial=="89:05:70:b6:b0:e2:86:8a:53:be:3f:8f:90:4a:88:ee") and 1636588800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JESEN LESS d.o.o." and ( pe.signatures [ i ] . serial == "00:89:05:70:b6:b0:e2:86:8a:53:be:3f:8f:90:4a:88:ee" or pe.signatures [ i ] . serial == "89:05:70:b6:b0:e2:86:8a:53:be:3f:8f:90:4a:88:ee" ) and 1636588800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47567,13 +47567,13 @@ rule REVERSINGLABS_Cert_Blocklist_2642Fe865F7566Ce3123A5142C207094 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "508d9c00-c209-55b2-9a40-b62ff4d866c9"
+		id = "15111c86-572b-54fd-a67b-b28d53ab3465"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11086-L11102"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1ad4adf8b05a6cc065d289e6963480d37a92712a318744a30a16aad22380f238"
+		logic_hash = "v1_sha256_1ad4adf8b05a6cc065d289e6963480d37a92712a318744a30a16aad22380f238"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47583,7 +47583,7 @@ rule REVERSINGLABS_Cert_Blocklist_2642Fe865F7566Ce3123A5142C207094 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "C.W.D. INSTAL LTD" and pe.signatures[i].serial=="26:42:fe:86:5f:75:66:ce:31:23:a5:14:2c:20:70:94" and 1666310400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "C.W.D. INSTAL LTD" and pe.signatures [ i ] . serial == "26:42:fe:86:5f:75:66:ce:31:23:a5:14:2c:20:70:94" and 1666310400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47592,13 +47592,13 @@ rule REVERSINGLABS_Cert_Blocklist_4A2E337Fff23E5B2A1321Ffde56D1759 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e5cae614-eff1-5c3d-a7f6-c41b0a2c412e"
+		id = "c05ce577-3aeb-54a3-aea0-294fd001bd69"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11104-L11120"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bc2df95ddf1ef3d5f83d14852e1cf6cbf4b71bfbe88fc97c2a4553e8581ddf47"
+		logic_hash = "v1_sha256_bc2df95ddf1ef3d5f83d14852e1cf6cbf4b71bfbe88fc97c2a4553e8581ddf47"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47608,7 +47608,7 @@ rule REVERSINGLABS_Cert_Blocklist_4A2E337Fff23E5B2A1321Ffde56D1759 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Karolina Klimowska" and pe.signatures[i].serial=="4a:2e:33:7f:ff:23:e5:b2:a1:32:1f:fd:e5:6d:17:59" and 1660314070<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Karolina Klimowska" and pe.signatures [ i ] . serial == "4a:2e:33:7f:ff:23:e5:b2:a1:32:1f:fd:e5:6d:17:59" and 1660314070 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47617,13 +47617,13 @@ rule REVERSINGLABS_Cert_Blocklist_92D9B92F8Cf7A1Ba8B2C025Be730C300 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bc37efaa-9ceb-5079-999f-b3d17c585b1c"
+		id = "c37d9ae5-047c-5c28-993e-9c5b36b49a6f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11122-L11140"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2a0be6157e589705ad19756971bd865edad2d54760d03c2e6f47a461b402ad68"
+		logic_hash = "v1_sha256_2a0be6157e589705ad19756971bd865edad2d54760d03c2e6f47a461b402ad68"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47633,7 +47633,7 @@ rule REVERSINGLABS_Cert_Blocklist_92D9B92F8Cf7A1Ba8B2C025Be730C300 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UPLagga Systems s.r.o." and (pe.signatures[i].serial=="00:92:d9:b9:2f:8c:f7:a1:ba:8b:2c:02:5b:e7:30:c3:00" or pe.signatures[i].serial=="92:d9:b9:2f:8c:f7:a1:ba:8b:2c:02:5b:e7:30:c3:00") and 1598054400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "UPLagga Systems s.r.o." and ( pe.signatures [ i ] . serial == "00:92:d9:b9:2f:8c:f7:a1:ba:8b:2c:02:5b:e7:30:c3:00" or pe.signatures [ i ] . serial == "92:d9:b9:2f:8c:f7:a1:ba:8b:2c:02:5b:e7:30:c3:00" ) and 1598054400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47642,13 +47642,13 @@ rule REVERSINGLABS_Cert_Blocklist_B8164F7143E1A313003Ab0C834562F1F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "50d50330-4098-59dd-b2da-0714eefdfc66"
+		id = "cb0d2973-96e7-5168-b3ae-787210db1e6a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11142-L11160"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a42fec2e0e8d37948420f16907f39c3d502c535be98024d04a777dfbc633004d"
+		logic_hash = "v1_sha256_a42fec2e0e8d37948420f16907f39c3d502c535be98024d04a777dfbc633004d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47658,7 +47658,7 @@ rule REVERSINGLABS_Cert_Blocklist_B8164F7143E1A313003Ab0C834562F1F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ekitai Data Inc." and (pe.signatures[i].serial=="00:b8:16:4f:71:43:e1:a3:13:00:3a:b0:c8:34:56:2f:1f" or pe.signatures[i].serial=="b8:16:4f:71:43:e1:a3:13:00:3a:b0:c8:34:56:2f:1f") and 1598313600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ekitai Data Inc." and ( pe.signatures [ i ] . serial == "00:b8:16:4f:71:43:e1:a3:13:00:3a:b0:c8:34:56:2f:1f" or pe.signatures [ i ] . serial == "b8:16:4f:71:43:e1:a3:13:00:3a:b0:c8:34:56:2f:1f" ) and 1598313600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47667,13 +47667,13 @@ rule REVERSINGLABS_Cert_Blocklist_24E4A2B3Db6Be1007B9Ddc91995Bc0C8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8e533ebf-a124-53a9-8647-6f4b40aaa066"
+		id = "61a16cf2-4d9e-55c2-ac52-b65f1f840051"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11162-L11178"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "861691ce7bae4366f3b35d01c84bb0031b54653869f52eaccf20808b1b55d2af"
+		logic_hash = "v1_sha256_861691ce7bae4366f3b35d01c84bb0031b54653869f52eaccf20808b1b55d2af"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47683,7 +47683,7 @@ rule REVERSINGLABS_Cert_Blocklist_24E4A2B3Db6Be1007B9Ddc91995Bc0C8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLY BETTER s.r.o." and pe.signatures[i].serial=="24:e4:a2:b3:db:6b:e1:00:7b:9d:dc:91:99:5b:c0:c8" and 1645142400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FLY BETTER s.r.o." and pe.signatures [ i ] . serial == "24:e4:a2:b3:db:6b:e1:00:7b:9d:dc:91:99:5b:c0:c8" and 1645142400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47692,13 +47692,13 @@ rule REVERSINGLABS_Cert_Blocklist_881573Fc67Ff7395Dde5Bccfbce5B088 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d188c65c-ee7b-586f-95f0-8de5b506c325"
+		id = "ef82de35-ba21-5c31-8f66-a6253e50b719"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11180-L11198"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ce489a4a2f07181d6fbf295f426deeaf51310e061bac2e56d65b37eeb397ff9a"
+		logic_hash = "v1_sha256_ce489a4a2f07181d6fbf295f426deeaf51310e061bac2e56d65b37eeb397ff9a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47708,7 +47708,7 @@ rule REVERSINGLABS_Cert_Blocklist_881573Fc67Ff7395Dde5Bccfbce5B088 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trade in Brasil s.r.o." and (pe.signatures[i].serial=="00:88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88" or pe.signatures[i].serial=="88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88") and 1620000000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Trade in Brasil s.r.o." and ( pe.signatures [ i ] . serial == "00:88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88" or pe.signatures [ i ] . serial == "88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88" ) and 1620000000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47717,13 +47717,13 @@ rule REVERSINGLABS_Cert_Blocklist_53E1F226Cb77574F8Fbeb5682Da091Bb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fe3abe27-c8c8-54b8-b031-0546c9bfda90"
+		id = "42e639e5-ea97-55a6-b8f5-87b48e5c5868"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11200-L11216"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "591846225d5faf3ee8f3102acaad066f0187219044077bbdaf32345613b00965"
+		logic_hash = "v1_sha256_591846225d5faf3ee8f3102acaad066f0187219044077bbdaf32345613b00965"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47733,7 +47733,7 @@ rule REVERSINGLABS_Cert_Blocklist_53E1F226Cb77574F8Fbeb5682Da091Bb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OdyLab Inc" and pe.signatures[i].serial=="53:e1:f2:26:cb:77:57:4f:8f:be:b5:68:2d:a0:91:bb" and 1654020559<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OdyLab Inc" and pe.signatures [ i ] . serial == "53:e1:f2:26:cb:77:57:4f:8f:be:b5:68:2d:a0:91:bb" and 1654020559 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47742,13 +47742,13 @@ rule REVERSINGLABS_Cert_Blocklist_0772B4D1D63233D2B8771997Bc8Da5C4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fe602ac3-fa34-5056-a2cc-5ae9de728559"
+		id = "5b905af3-6089-5038-84b2-21cd410cfbf7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11218-L11234"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "30586a643b29f3c943b3f35bb1639c5b9fa48ecbd776775086e35af502aa4a7a"
+		logic_hash = "v1_sha256_30586a643b29f3c943b3f35bb1639c5b9fa48ecbd776775086e35af502aa4a7a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47758,7 +47758,7 @@ rule REVERSINGLABS_Cert_Blocklist_0772B4D1D63233D2B8771997Bc8Da5C4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Maya logistika d.o.o." and pe.signatures[i].serial=="07:72:b4:d1:d6:32:33:d2:b8:77:19:97:bc:8d:a5:c4" and 1637971201<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Maya logistika d.o.o." and pe.signatures [ i ] . serial == "07:72:b4:d1:d6:32:33:d2:b8:77:19:97:bc:8d:a5:c4" and 1637971201 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47767,13 +47767,13 @@ rule REVERSINGLABS_Cert_Blocklist_02B6656292310B84022Db5541Bc48Faf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d679238f-a697-5322-815c-9986c9d24032"
+		id = "aec042ca-6aea-527b-948c-fc3ed29066e6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11236-L11252"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "40b570b28e10ebd2a1ba515dc3fa45bdb5c0b76044e4dda7a6819976072a67a2"
+		logic_hash = "v1_sha256_40b570b28e10ebd2a1ba515dc3fa45bdb5c0b76044e4dda7a6819976072a67a2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47783,7 +47783,7 @@ rule REVERSINGLABS_Cert_Blocklist_02B6656292310B84022Db5541Bc48Faf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DILA d.o.o." and pe.signatures[i].serial=="02:b6:65:62:92:31:0b:84:02:2d:b5:54:1b:c4:8f:af" and 1613865600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DILA d.o.o." and pe.signatures [ i ] . serial == "02:b6:65:62:92:31:0b:84:02:2d:b5:54:1b:c4:8f:af" and 1613865600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47792,13 +47792,13 @@ rule REVERSINGLABS_Cert_Blocklist_64C2505C7306639Fc8Eae544B0305338 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b0e4057f-a0e7-5e2e-a47f-dc8188b6b506"
+		id = "6fb26699-60f0-513b-b417-54d3a21e8dcb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11254-L11270"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9b6fb002d603135391958668be0ef805e441928a035c9c4da4bb9915aa3086e8"
+		logic_hash = "v1_sha256_9b6fb002d603135391958668be0ef805e441928a035c9c4da4bb9915aa3086e8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47808,7 +47808,7 @@ rule REVERSINGLABS_Cert_Blocklist_64C2505C7306639Fc8Eae544B0305338 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MANILA Solution as" and pe.signatures[i].serial=="64:c2:50:5c:73:06:63:9f:c8:ea:e5:44:b0:30:53:38" and 1609418043<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MANILA Solution as" and pe.signatures [ i ] . serial == "64:c2:50:5c:73:06:63:9f:c8:ea:e5:44:b0:30:53:38" and 1609418043 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47817,13 +47817,13 @@ rule REVERSINGLABS_Cert_Blocklist_2F96A89Bfec6E44Dd224E8Fd7E72D9Bb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bdca8435-c1fd-598d-bd82-20a3a3b2a959"
+		id = "9668c591-b961-5921-a2e7-f61d3f403f09"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11272-L11288"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c0c8e5c0e2e120ee6b055e9a6b2af3d424bed0832c2619beab658fe01757f69f"
+		logic_hash = "v1_sha256_c0c8e5c0e2e120ee6b055e9a6b2af3d424bed0832c2619beab658fe01757f69f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47833,7 +47833,7 @@ rule REVERSINGLABS_Cert_Blocklist_2F96A89Bfec6E44Dd224E8Fd7E72D9Bb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NAILS UNLIMITED LIMITED" and pe.signatures[i].serial=="2f:96:a8:9b:fe:c6:e4:4d:d2:24:e8:fd:7e:72:d9:bb" and 1625529600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NAILS UNLIMITED LIMITED" and pe.signatures [ i ] . serial == "2f:96:a8:9b:fe:c6:e4:4d:d2:24:e8:fd:7e:72:d9:bb" and 1625529600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47842,13 +47842,13 @@ rule REVERSINGLABS_Cert_Blocklist_B649A966410F62999C939384Af553919 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "03533c22-eb16-546c-af55-675af9c833ce"
+		id = "1ff1c322-c041-55c0-80c2-a06e4a5b736d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11290-L11308"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "623a2f931198eacf44fd233065e96a4dcadb5b3bbc7ca56df2b6ae9eafc4faa5"
+		logic_hash = "v1_sha256_623a2f931198eacf44fd233065e96a4dcadb5b3bbc7ca56df2b6ae9eafc4faa5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47858,7 +47858,7 @@ rule REVERSINGLABS_Cert_Blocklist_B649A966410F62999C939384Af553919 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "F.A.T. SARL" and (pe.signatures[i].serial=="00:b6:49:a9:66:41:0f:62:99:9c:93:93:84:af:55:39:19" or pe.signatures[i].serial=="b6:49:a9:66:41:0f:62:99:9c:93:93:84:af:55:39:19") and 1590537600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "F.A.T. SARL" and ( pe.signatures [ i ] . serial == "00:b6:49:a9:66:41:0f:62:99:9c:93:93:84:af:55:39:19" or pe.signatures [ i ] . serial == "b6:49:a9:66:41:0f:62:99:9c:93:93:84:af:55:39:19" ) and 1590537600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47867,13 +47867,13 @@ rule REVERSINGLABS_Cert_Blocklist_45245Eef53Fcf38169C715Cf68F44452 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "514eac5a-9264-58ef-b4ee-65ec24b43e5a"
+		id = "1f7a8ecb-4d3d-51ba-8d0f-121da70d4114"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11310-L11326"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7e0c3147e657802e457f6df271b7f5a64c81fd13f936a8935aa991022e4ab238"
+		logic_hash = "v1_sha256_7e0c3147e657802e457f6df271b7f5a64c81fd13f936a8935aa991022e4ab238"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47883,7 +47883,7 @@ rule REVERSINGLABS_Cert_Blocklist_45245Eef53Fcf38169C715Cf68F44452 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PAPER AND CORE SUPPLIES LTD" and pe.signatures[i].serial=="45:24:5e:ef:53:fc:f3:81:69:c7:15:cf:68:f4:44:52" and 1639958400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PAPER AND CORE SUPPLIES LTD" and pe.signatures [ i ] . serial == "45:24:5e:ef:53:fc:f3:81:69:c7:15:cf:68:f4:44:52" and 1639958400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47892,13 +47892,13 @@ rule REVERSINGLABS_Cert_Blocklist_1895433Ee9E2Bd48619D75132262616F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d7bf59df-708c-5260-bc98-1a86b2c9c988"
+		id = "a96f1811-2456-5197-b87f-884a6f661b82"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11328-L11344"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f00a29ff5dddae40225ab62cb2d4b9dec1539ad58c8cd27d686480eecdb3e31d"
+		logic_hash = "v1_sha256_f00a29ff5dddae40225ab62cb2d4b9dec1539ad58c8cd27d686480eecdb3e31d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47908,7 +47908,7 @@ rule REVERSINGLABS_Cert_Blocklist_1895433Ee9E2Bd48619D75132262616F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Evetrans Ltd" and pe.signatures[i].serial=="18:95:43:3e:e9:e2:bd:48:61:9d:75:13:22:62:61:6f" and 1619789516<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Evetrans Ltd" and pe.signatures [ i ] . serial == "18:95:43:3e:e9:e2:bd:48:61:9d:75:13:22:62:61:6f" and 1619789516 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47917,13 +47917,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Ffc9825644Caf5B1F521780C5C7F42C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3d806d90-e029-5521-b191-6967e2691c0f"
+		id = "db9bd835-6aa4-5799-95df-15f7fee0e20a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11346-L11362"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1a9263c809f5633d01d4d4d0091c8dc214bad73af0eff3c9a94b33bca513f26d"
+		logic_hash = "v1_sha256_1a9263c809f5633d01d4d4d0091c8dc214bad73af0eff3c9a94b33bca513f26d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47933,7 +47933,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Ffc9825644Caf5B1F521780C5C7F42C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTIVUS LIMITED" and pe.signatures[i].serial=="1f:fc:98:25:64:4c:af:5b:1f:52:17:80:c5:c7:f4:2c" and 1615507200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ACTIVUS LIMITED" and pe.signatures [ i ] . serial == "1f:fc:98:25:64:4c:af:5b:1f:52:17:80:c5:c7:f4:2c" and 1615507200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47942,13 +47942,13 @@ rule REVERSINGLABS_Cert_Blocklist_8D52Fb12A2511E86Bbb0Ba75C517Eab0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1bc9d36c-381e-5359-bba4-8dd870ed9267"
+		id = "2e7965a0-5739-5a3a-afd0-1ac7a851cbe5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11364-L11382"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "023830ab3d71ed8ecf8f0e271c56dc267dcd000f5ff156c70d31089cd7010da8"
+		logic_hash = "v1_sha256_023830ab3d71ed8ecf8f0e271c56dc267dcd000f5ff156c70d31089cd7010da8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47958,7 +47958,7 @@ rule REVERSINGLABS_Cert_Blocklist_8D52Fb12A2511E86Bbb0Ba75C517Eab0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VThink Software Consulting Inc." and (pe.signatures[i].serial=="00:8d:52:fb:12:a2:51:1e:86:bb:b0:ba:75:c5:17:ea:b0" or pe.signatures[i].serial=="8d:52:fb:12:a2:51:1e:86:bb:b0:ba:75:c5:17:ea:b0") and 1599177600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VThink Software Consulting Inc." and ( pe.signatures [ i ] . serial == "00:8d:52:fb:12:a2:51:1e:86:bb:b0:ba:75:c5:17:ea:b0" or pe.signatures [ i ] . serial == "8d:52:fb:12:a2:51:1e:86:bb:b0:ba:75:c5:17:ea:b0" ) and 1599177600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47967,13 +47967,13 @@ rule REVERSINGLABS_Cert_Blocklist_332Bd5801E8415585E72C87E0E2Ec71D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d251afda-7582-5a00-a100-fd3acff2f995"
+		id = "13af634e-c483-50d2-ad81-61c9956705cd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11384-L11400"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3648c3a8dbcdbd24746b9fa8cb3071d5f5019e5917848d88437158c6cb165445"
+		logic_hash = "v1_sha256_3648c3a8dbcdbd24746b9fa8cb3071d5f5019e5917848d88437158c6cb165445"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -47983,7 +47983,7 @@ rule REVERSINGLABS_Cert_Blocklist_332Bd5801E8415585E72C87E0E2Ec71D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elite Marketing Strategies, Inc." and pe.signatures[i].serial=="33:2b:d5:80:1e:84:15:58:5e:72:c8:7e:0e:2e:c7:1d" and 1662616824<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Elite Marketing Strategies, Inc." and pe.signatures [ i ] . serial == "33:2b:d5:80:1e:84:15:58:5e:72:c8:7e:0e:2e:c7:1d" and 1662616824 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -47992,13 +47992,13 @@ rule REVERSINGLABS_Cert_Blocklist_E3B80C0932B52A708477939B0D32186F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e7cdf040-3fe2-55ed-8f66-702fb4455653"
+		id = "0d0af87c-0d2f-593e-b64b-c5e63b5c83a4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11402-L11420"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "acdfce4dc25cbc9e9817453d5cf56c7d319bebdf7a039ea47412ec3b2f68cb02"
+		logic_hash = "v1_sha256_acdfce4dc25cbc9e9817453d5cf56c7d319bebdf7a039ea47412ec3b2f68cb02"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48008,7 +48008,7 @@ rule REVERSINGLABS_Cert_Blocklist_E3B80C0932B52A708477939B0D32186F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BISOYETUTU LTD LIMITED" and (pe.signatures[i].serial=="00:e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f" or pe.signatures[i].serial=="e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f") and 1617062400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BISOYETUTU LTD LIMITED" and ( pe.signatures [ i ] . serial == "00:e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f" or pe.signatures [ i ] . serial == "e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f" ) and 1617062400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48017,13 +48017,13 @@ rule REVERSINGLABS_Cert_Blocklist_C79F817F082986Bef3209F6723C8Da97 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b3978831-57d6-5f25-a271-fa4f449d37b3"
+		id = "a33e037e-771a-57d8-8f13-8110ea6d4e98"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11422-L11440"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a5960f4c2ed768ccc5779d3754f51463c7b14a3a887c690944add23fba464f1a"
+		logic_hash = "v1_sha256_a5960f4c2ed768ccc5779d3754f51463c7b14a3a887c690944add23fba464f1a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48033,7 +48033,7 @@ rule REVERSINGLABS_Cert_Blocklist_C79F817F082986Bef3209F6723C8Da97 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Al-Faris group d.o.o." and (pe.signatures[i].serial=="00:c7:9f:81:7f:08:29:86:be:f3:20:9f:67:23:c8:da:97" or pe.signatures[i].serial=="c7:9f:81:7f:08:29:86:be:f3:20:9f:67:23:c8:da:97") and 1616371200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Al-Faris group d.o.o." and ( pe.signatures [ i ] . serial == "00:c7:9f:81:7f:08:29:86:be:f3:20:9f:67:23:c8:da:97" or pe.signatures [ i ] . serial == "c7:9f:81:7f:08:29:86:be:f3:20:9f:67:23:c8:da:97" ) and 1616371200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48042,13 +48042,13 @@ rule REVERSINGLABS_Cert_Blocklist_1E5Efa53A14599Cc82F56F0790E20B17 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f87dac0c-4b46-5b30-a715-f21e7c3a98e0"
+		id = "be062650-19f7-54f9-85ff-ed0a4719b570"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11442-L11458"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "78cbfeb5d7b58029a5b4107f2a59e892ff9d71788cf74e88ac823cb85ba35a94"
+		logic_hash = "v1_sha256_78cbfeb5d7b58029a5b4107f2a59e892ff9d71788cf74e88ac823cb85ba35a94"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48058,7 +48058,7 @@ rule REVERSINGLABS_Cert_Blocklist_1E5Efa53A14599Cc82F56F0790E20B17 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Storeks LLC" and pe.signatures[i].serial=="1e:5e:fa:53:a1:45:99:cc:82:f5:6f:07:90:e2:0b:17" and 1623196800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Storeks LLC" and pe.signatures [ i ] . serial == "1e:5e:fa:53:a1:45:99:cc:82:f5:6f:07:90:e2:0b:17" and 1623196800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48067,13 +48067,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Cf2D0B5Bfdd68Cf777A0C12F806A569 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2900c6ae-9e61-5bad-a7b4-b8eca925a1ea"
+		id = "cdb94df6-21f7-5032-bb76-2cda0df1fafd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11460-L11476"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4d8fd52cd12f9512c0b148f9915860152f108884d29617a5fbfd62500d3a14c4"
+		logic_hash = "v1_sha256_4d8fd52cd12f9512c0b148f9915860152f108884d29617a5fbfd62500d3a14c4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48083,7 +48083,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Cf2D0B5Bfdd68Cf777A0C12F806A569 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROTIP d.o.o. - v ste\\xC4\\x8Daju" and pe.signatures[i].serial=="0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69" and 1611705600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PROTIP d.o.o. - v ste\\xC4\\x8Daju" and pe.signatures [ i ] . serial == "0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69" and 1611705600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48092,13 +48092,13 @@ rule REVERSINGLABS_Cert_Blocklist_F675139Ea68B897A865A98F8E4611F00 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3bac20a3-1415-53af-9d04-a30aa7488dd7"
+		id = "d972345a-5f3c-59c7-b8c0-3a34fe98e4f4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11478-L11496"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2306e90d376f5de8a4eb6d4a696bc1781686d7094cb0a2db48019ee93c1bf60a"
+		logic_hash = "v1_sha256_2306e90d376f5de8a4eb6d4a696bc1781686d7094cb0a2db48019ee93c1bf60a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48108,7 +48108,7 @@ rule REVERSINGLABS_Cert_Blocklist_F675139Ea68B897A865A98F8E4611F00 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BS TEHNIK d.o.o." and (pe.signatures[i].serial=="00:f6:75:13:9e:a6:8b:89:7a:86:5a:98:f8:e4:61:1f:00" or pe.signatures[i].serial=="f6:75:13:9e:a6:8b:89:7a:86:5a:98:f8:e4:61:1f:00") and 1606953600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BS TEHNIK d.o.o." and ( pe.signatures [ i ] . serial == "00:f6:75:13:9e:a6:8b:89:7a:86:5a:98:f8:e4:61:1f:00" or pe.signatures [ i ] . serial == "f6:75:13:9e:a6:8b:89:7a:86:5a:98:f8:e4:61:1f:00" ) and 1606953600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48117,13 +48117,13 @@ rule REVERSINGLABS_Cert_Blocklist_4728189Fa0F57793484Cdf764F5E283D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fd1b83aa-bfcc-590c-8f97-875badf09698"
+		id = "52ee03fb-d843-5946-b313-9bbeff513ba0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11498-L11514"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9ec7e84c77583bd52ccfb8d6d5831f3634ed0a401d8103376c4775b7f2c43d81"
+		logic_hash = "v1_sha256_9ec7e84c77583bd52ccfb8d6d5831f3634ed0a401d8103376c4775b7f2c43d81"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48133,7 +48133,7 @@ rule REVERSINGLABS_Cert_Blocklist_4728189Fa0F57793484Cdf764F5E283D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Power Save Systems s.r.o." and pe.signatures[i].serial=="47:28:18:9f:a0:f5:77:93:48:4c:df:76:4f:5e:28:3d" and 1647302400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Power Save Systems s.r.o." and pe.signatures [ i ] . serial == "47:28:18:9f:a0:f5:77:93:48:4c:df:76:4f:5e:28:3d" and 1647302400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48142,13 +48142,13 @@ rule REVERSINGLABS_Cert_Blocklist_9Bd81A9Adaf71F1Ff081C1F4A05D7Fd7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "727167de-5678-558d-b948-8a40839d0500"
+		id = "4f23229b-d59e-50b8-bd6f-00a04e3f5e23"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11516-L11534"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e275a1fd2eb931030fa8b5fc11cd1b335835aaa553a42455053cb93fef5e6e72"
+		logic_hash = "v1_sha256_e275a1fd2eb931030fa8b5fc11cd1b335835aaa553a42455053cb93fef5e6e72"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48158,7 +48158,7 @@ rule REVERSINGLABS_Cert_Blocklist_9Bd81A9Adaf71F1Ff081C1F4A05D7Fd7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SMART TOYS AND GAMES, INC" and (pe.signatures[i].serial=="00:9b:d8:1a:9a:da:f7:1f:1f:f0:81:c1:f4:a0:5d:7f:d7" or pe.signatures[i].serial=="9b:d8:1a:9a:da:f7:1f:1f:f0:81:c1:f4:a0:5d:7f:d7") and 1601683200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SMART TOYS AND GAMES, INC" and ( pe.signatures [ i ] . serial == "00:9b:d8:1a:9a:da:f7:1f:1f:f0:81:c1:f4:a0:5d:7f:d7" or pe.signatures [ i ] . serial == "9b:d8:1a:9a:da:f7:1f:1f:f0:81:c1:f4:a0:5d:7f:d7" ) and 1601683200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48167,13 +48167,13 @@ rule REVERSINGLABS_Cert_Blocklist_C81319D20C6F1F1Aec3398522189D90C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0a196a18-002e-58e4-bff2-83d1a67a82ce"
+		id = "ff0ab7f9-c8fd-5012-960a-d1d8106a4c52"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11536-L11554"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2a9f13f5e79a12f7e9d9d4a0dcaac065e1fc5167c67bc9f3fd7ba1c374b26d96"
+		logic_hash = "v1_sha256_2a9f13f5e79a12f7e9d9d4a0dcaac065e1fc5167c67bc9f3fd7ba1c374b26d96"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48183,7 +48183,7 @@ rule REVERSINGLABS_Cert_Blocklist_C81319D20C6F1F1Aec3398522189D90C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and (pe.signatures[i].serial=="00:c8:13:19:d2:0c:6f:1f:1a:ec:33:98:52:21:89:d9:0c" or pe.signatures[i].serial=="c8:13:19:d2:0c:6f:1f:1a:ec:33:98:52:21:89:d9:0c") and 1643500800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT,LLC" and ( pe.signatures [ i ] . serial == "00:c8:13:19:d2:0c:6f:1f:1a:ec:33:98:52:21:89:d9:0c" or pe.signatures [ i ] . serial == "c8:13:19:d2:0c:6f:1f:1a:ec:33:98:52:21:89:d9:0c" ) and 1643500800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48192,13 +48192,13 @@ rule REVERSINGLABS_Cert_Blocklist_C318D876768258A696Ab9Dd825E27Acd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c6e93547-5be0-5303-b537-655db3d78ad4"
+		id = "b5ae8c40-659c-52ca-a1b0-258722255725"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11556-L11574"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "691b57929c93d14f8700e0e61170b9248499fd36b80aec90f2054c32d6a3a9eb"
+		logic_hash = "v1_sha256_691b57929c93d14f8700e0e61170b9248499fd36b80aec90f2054c32d6a3a9eb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48208,7 +48208,7 @@ rule REVERSINGLABS_Cert_Blocklist_C318D876768258A696Ab9Dd825E27Acd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Genezis" and (pe.signatures[i].serial=="00:c3:18:d8:76:76:82:58:a6:96:ab:9d:d8:25:e2:7a:cd" or pe.signatures[i].serial=="c3:18:d8:76:76:82:58:a6:96:ab:9d:d8:25:e2:7a:cd") and 1615161600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Genezis" and ( pe.signatures [ i ] . serial == "00:c3:18:d8:76:76:82:58:a6:96:ab:9d:d8:25:e2:7a:cd" or pe.signatures [ i ] . serial == "c3:18:d8:76:76:82:58:a6:96:ab:9d:d8:25:e2:7a:cd" ) and 1615161600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48217,13 +48217,13 @@ rule REVERSINGLABS_Cert_Blocklist_06Df5C318759D6Ea9D090Bfb2Faf1D94 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a61e61c1-9fa0-5fd9-b197-bb9d1b68c8f4"
+		id = "d44d8da2-8b08-5830-bf55-4231a6164e7b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11576-L11592"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5f151ee5781a15cca4394fdd8200162eae47e9d088a0b1551c9ed22ce11473a2"
+		logic_hash = "v1_sha256_5f151ee5781a15cca4394fdd8200162eae47e9d088a0b1551c9ed22ce11473a2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48233,7 +48233,7 @@ rule REVERSINGLABS_Cert_Blocklist_06Df5C318759D6Ea9D090Bfb2Faf1D94 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SpiffyTech Inc." and pe.signatures[i].serial=="06:df:5c:31:87:59:d6:ea:9d:09:0b:fb:2f:af:1d:94" and 1634515201<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SpiffyTech Inc." and pe.signatures [ i ] . serial == "06:df:5c:31:87:59:d6:ea:9d:09:0b:fb:2f:af:1d:94" and 1634515201 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48242,13 +48242,13 @@ rule REVERSINGLABS_Cert_Blocklist_02De1Cc6C487954592F1Bf574Ca2B000 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2a15d527-7f42-5c56-9740-9c2503a66f4f"
+		id = "ed675082-efc7-5af7-a92f-3d5aed9c3627"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11594-L11610"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "40b78005d343684d08bb93e92c51eee10e674e8deb9eec290bc9ffe3b23061b1"
+		logic_hash = "v1_sha256_40b78005d343684d08bb93e92c51eee10e674e8deb9eec290bc9ffe3b23061b1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48258,7 +48258,7 @@ rule REVERSINGLABS_Cert_Blocklist_02De1Cc6C487954592F1Bf574Ca2B000 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Orca System" and pe.signatures[i].serial=="02:de:1c:c6:c4:87:95:45:92:f1:bf:57:4c:a2:b0:00" and 1613735394<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Orca System" and pe.signatures [ i ] . serial == "02:de:1c:c6:c4:87:95:45:92:f1:bf:57:4c:a2:b0:00" and 1613735394 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48267,13 +48267,13 @@ rule REVERSINGLABS_Cert_Blocklist_A32B8B4F1Be43C23Eb2848Ab4Ef06Bb2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2ced71bb-622c-5597-91c3-210b9b5f3a4e"
+		id = "e1f3cd90-6e0d-5dfd-a58d-a43987d41163"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11612-L11630"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dd7d44349baaf4a2e2f61b38cef31f288110bb03944fd4593f52a0ab03b9d172"
+		logic_hash = "v1_sha256_dd7d44349baaf4a2e2f61b38cef31f288110bb03944fd4593f52a0ab03b9d172"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48283,7 +48283,7 @@ rule REVERSINGLABS_Cert_Blocklist_A32B8B4F1Be43C23Eb2848Ab4Ef06Bb2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pak El AB" and (pe.signatures[i].serial=="00:a3:2b:8b:4f:1b:e4:3c:23:eb:28:48:ab:4e:f0:6b:b2" or pe.signatures[i].serial=="a3:2b:8b:4f:1b:e4:3c:23:eb:28:48:ab:4e:f0:6b:b2") and 1673395200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Pak El AB" and ( pe.signatures [ i ] . serial == "00:a3:2b:8b:4f:1b:e4:3c:23:eb:28:48:ab:4e:f0:6b:b2" or pe.signatures [ i ] . serial == "a3:2b:8b:4f:1b:e4:3c:23:eb:28:48:ab:4e:f0:6b:b2" ) and 1673395200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48292,13 +48292,13 @@ rule REVERSINGLABS_Cert_Blocklist_626735Ed30E50E3E0553986D806Bfc54 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e0cfc0e6-b36e-5d4e-bfe6-21f13499dc0c"
+		id = "67900877-237c-5132-92d0-7281d809c465"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11632-L11648"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0a2acf8528a12fd05cf58c2ed5224f7472d14251b342ce4df6d9c10c6a6decfc"
+		logic_hash = "v1_sha256_0a2acf8528a12fd05cf58c2ed5224f7472d14251b342ce4df6d9c10c6a6decfc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48308,7 +48308,7 @@ rule REVERSINGLABS_Cert_Blocklist_626735Ed30E50E3E0553986D806Bfc54 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FISH ACCOUNTING & TRANSLATING LIMITED" and pe.signatures[i].serial=="62:67:35:ed:30:e5:0e:3e:05:53:98:6d:80:6b:fc:54" and 1666742400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FISH ACCOUNTING & TRANSLATING LIMITED" and pe.signatures [ i ] . serial == "62:67:35:ed:30:e5:0e:3e:05:53:98:6d:80:6b:fc:54" and 1666742400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48317,13 +48317,13 @@ rule REVERSINGLABS_Cert_Blocklist_34D42E871Ddb1C92Fa20B55B384E1259 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "98a8f4b0-08d0-5e09-b46e-74b46f4df223"
+		id = "57fabc29-a599-598d-b898-07cab35c0595"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11650-L11666"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8af5f4abe6425713b7c1fd17deaa78b2cfd6ef73ad960bce883e95661c2dbb56"
+		logic_hash = "v1_sha256_8af5f4abe6425713b7c1fd17deaa78b2cfd6ef73ad960bce883e95661c2dbb56"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48333,7 +48333,7 @@ rule REVERSINGLABS_Cert_Blocklist_34D42E871Ddb1C92Fa20B55B384E1259 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VENS CORP" and pe.signatures[i].serial=="34:d4:2e:87:1d:db:1c:92:fa:20:b5:5b:38:4e:12:59" and 1630368000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VENS CORP" and pe.signatures [ i ] . serial == "34:d4:2e:87:1d:db:1c:92:fa:20:b5:5b:38:4e:12:59" and 1630368000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48342,13 +48342,13 @@ rule REVERSINGLABS_Cert_Blocklist_08D4Dc90047B8470Ccaf3924Dfbd8B5F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2abe218a-1d93-5efe-9878-4314cf9ecdf7"
+		id = "62cd657f-836e-5569-b960-8f61efee5eea"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11668-L11684"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "569db2f6d6f4da9985c57812a03f91bce88f2150b17659249e0f746a0d15150b"
+		logic_hash = "v1_sha256_569db2f6d6f4da9985c57812a03f91bce88f2150b17659249e0f746a0d15150b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48358,7 +48358,7 @@ rule REVERSINGLABS_Cert_Blocklist_08D4Dc90047B8470Ccaf3924Dfbd8B5F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Dibies" and pe.signatures[i].serial=="08:d4:dc:90:04:7b:84:70:cc:af:39:24:df:bd:8b:5f" and 1619136000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Dibies" and pe.signatures [ i ] . serial == "08:d4:dc:90:04:7b:84:70:cc:af:39:24:df:bd:8b:5f" and 1619136000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48367,13 +48367,13 @@ rule REVERSINGLABS_Cert_Blocklist_C2Fc83D458E653837Fcfc132C9B03062 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "135d638c-9ee5-52cf-a6e7-c12e4feef594"
+		id = "897fe729-78d0-570d-bc6c-91bf6adb0ce0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11686-L11704"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "836cec8d8396680dd64f95d4dd41f7f5876cb4268d983238a01d2e0990cce74a"
+		logic_hash = "v1_sha256_836cec8d8396680dd64f95d4dd41f7f5876cb4268d983238a01d2e0990cce74a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48383,7 +48383,7 @@ rule REVERSINGLABS_Cert_Blocklist_C2Fc83D458E653837Fcfc132C9B03062 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Vertical" and (pe.signatures[i].serial=="00:c2:fc:83:d4:58:e6:53:83:7f:cf:c1:32:c9:b0:30:62" or pe.signatures[i].serial=="c2:fc:83:d4:58:e6:53:83:7f:cf:c1:32:c9:b0:30:62") and 1602201600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Vertical" and ( pe.signatures [ i ] . serial == "00:c2:fc:83:d4:58:e6:53:83:7f:cf:c1:32:c9:b0:30:62" or pe.signatures [ i ] . serial == "c2:fc:83:d4:58:e6:53:83:7f:cf:c1:32:c9:b0:30:62" ) and 1602201600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48392,13 +48392,13 @@ rule REVERSINGLABS_Cert_Blocklist_54C793D2224Bdd6Ca527Bb2B7B9Dfe9D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "80e92980-f4eb-5ac2-9f68-14c352758791"
+		id = "ab6f81d5-d8b0-591b-ae39-e539bb769c11"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11706-L11722"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "81c9c1d841d4aae3de229cc499ee84920d89928590a3eb157f7a7a7fbc46b4a8"
+		logic_hash = "v1_sha256_81c9c1d841d4aae3de229cc499ee84920d89928590a3eb157f7a7a7fbc46b4a8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48408,7 +48408,7 @@ rule REVERSINGLABS_Cert_Blocklist_54C793D2224Bdd6Ca527Bb2B7B9Dfe9D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CODE - HANDLE, s. r. o." and pe.signatures[i].serial=="54:c7:93:d2:22:4b:dd:6c:a5:27:bb:2b:7b:9d:fe:9d" and 1629676800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CODE - HANDLE, s. r. o." and pe.signatures [ i ] . serial == "54:c7:93:d2:22:4b:dd:6c:a5:27:bb:2b:7b:9d:fe:9d" and 1629676800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48417,13 +48417,13 @@ rule REVERSINGLABS_Cert_Blocklist_8Cece6Df54Cf6Ad63596546D77Ba3581 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bde12eeb-c4f8-5da3-8493-0f94cb1bf1f7"
+		id = "55d885c1-2f77-5910-b67e-5f391cbcc788"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11724-L11742"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d6b5bca36ef492ce9b79be905c86c66d43ef38701dafeed977229034119bd00d"
+		logic_hash = "v1_sha256_d6b5bca36ef492ce9b79be905c86c66d43ef38701dafeed977229034119bd00d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48433,7 +48433,7 @@ rule REVERSINGLABS_Cert_Blocklist_8Cece6Df54Cf6Ad63596546D77Ba3581 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mikael LLC" and (pe.signatures[i].serial=="00:8c:ec:e6:df:54:cf:6a:d6:35:96:54:6d:77:ba:35:81" or pe.signatures[i].serial=="8c:ec:e6:df:54:cf:6a:d6:35:96:54:6d:77:ba:35:81") and 1613088000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Mikael LLC" and ( pe.signatures [ i ] . serial == "00:8c:ec:e6:df:54:cf:6a:d6:35:96:54:6d:77:ba:35:81" or pe.signatures [ i ] . serial == "8c:ec:e6:df:54:cf:6a:d6:35:96:54:6d:77:ba:35:81" ) and 1613088000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48442,13 +48442,13 @@ rule REVERSINGLABS_Cert_Blocklist_984E84Cfe362E278F558E2C70Aaafac2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "180f1209-7031-50fb-b1fc-3d357f2b73a1"
+		id = "ec27ad99-875c-57a7-a7d5-2dbbedcda07c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11744-L11762"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e7a8f3dff77121df53d5f932f861e15208b0607ba77712f40927bc14b17a53cd"
+		logic_hash = "v1_sha256_e7a8f3dff77121df53d5f932f861e15208b0607ba77712f40927bc14b17a53cd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48458,7 +48458,7 @@ rule REVERSINGLABS_Cert_Blocklist_984E84Cfe362E278F558E2C70Aaafac2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Arctic Nights \\xC3\\x84k\\xC3\\xA4slompolo Oy" and (pe.signatures[i].serial=="00:98:4e:84:cf:e3:62:e2:78:f5:58:e2:c7:0a:aa:fa:c2" or pe.signatures[i].serial=="98:4e:84:cf:e3:62:e2:78:f5:58:e2:c7:0a:aa:fa:c2") and 1640304000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Arctic Nights \\xC3\\x84k\\xC3\\xA4slompolo Oy" and ( pe.signatures [ i ] . serial == "00:98:4e:84:cf:e3:62:e2:78:f5:58:e2:c7:0a:aa:fa:c2" or pe.signatures [ i ] . serial == "98:4e:84:cf:e3:62:e2:78:f5:58:e2:c7:0a:aa:fa:c2" ) and 1640304000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48467,13 +48467,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ff52Eb011Bb748Fee75153Cbe1E50Dd6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "acd29c6d-27ed-587a-b17c-989e69082434"
+		id = "b91076c1-3d05-5bfe-964c-cd514c430809"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11764-L11782"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8c80ed4e4f77df34ff9fcc712deda4c1bbedc588f2b01d02aa705e368fb98c5e"
+		logic_hash = "v1_sha256_8c80ed4e4f77df34ff9fcc712deda4c1bbedc588f2b01d02aa705e368fb98c5e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48483,7 +48483,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ff52Eb011Bb748Fee75153Cbe1E50Dd6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TASK ANNA LIMITED" and (pe.signatures[i].serial=="00:ff:52:eb:01:1b:b7:48:fe:e7:51:53:cb:e1:e5:0d:d6" or pe.signatures[i].serial=="ff:52:eb:01:1b:b7:48:fe:e7:51:53:cb:e1:e5:0d:d6") and 1647388800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TASK ANNA LIMITED" and ( pe.signatures [ i ] . serial == "00:ff:52:eb:01:1b:b7:48:fe:e7:51:53:cb:e1:e5:0d:d6" or pe.signatures [ i ] . serial == "ff:52:eb:01:1b:b7:48:fe:e7:51:53:cb:e1:e5:0d:d6" ) and 1647388800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48492,13 +48492,13 @@ rule REVERSINGLABS_Cert_Blocklist_84A4A0D0657E217B176B455E2465Aee0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1484a28d-ce7c-506f-8cbb-73ac541a0907"
+		id = "12cd8fe8-8ea5-561a-83af-24dc36223814"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11784-L11802"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "92f6e90bd21182bece68ac1651105f96a18c5b1497d30e0040a978e349341bdb"
+		logic_hash = "v1_sha256_92f6e90bd21182bece68ac1651105f96a18c5b1497d30e0040a978e349341bdb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48508,7 +48508,7 @@ rule REVERSINGLABS_Cert_Blocklist_84A4A0D0657E217B176B455E2465Aee0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AATB ApS" and (pe.signatures[i].serial=="00:84:a4:a0:d0:65:7e:21:7b:17:6b:45:5e:24:65:ae:e0" or pe.signatures[i].serial=="84:a4:a0:d0:65:7e:21:7b:17:6b:45:5e:24:65:ae:e0") and 1616457600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AATB ApS" and ( pe.signatures [ i ] . serial == "00:84:a4:a0:d0:65:7e:21:7b:17:6b:45:5e:24:65:ae:e0" or pe.signatures [ i ] . serial == "84:a4:a0:d0:65:7e:21:7b:17:6b:45:5e:24:65:ae:e0" ) and 1616457600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48517,13 +48517,13 @@ rule REVERSINGLABS_Cert_Blocklist_B8F726508Cf1D7B7913Bf4Bbd1E5C19C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "eb441b57-0f28-5609-b987-157e1f026b0c"
+		id = "87f4f7ec-ef6d-50c7-b152-230c9b682ef9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11804-L11822"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ec05c7e41e309aff00ae819c63f5bdc8e4172c611779da345efd211e48c9efb1"
+		logic_hash = "v1_sha256_ec05c7e41e309aff00ae819c63f5bdc8e4172c611779da345efd211e48c9efb1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48533,7 +48533,7 @@ rule REVERSINGLABS_Cert_Blocklist_B8F726508Cf1D7B7913Bf4Bbd1E5C19C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Merkuri LLC" and (pe.signatures[i].serial=="00:b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c" or pe.signatures[i].serial=="b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c") and 1619568000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Merkuri LLC" and ( pe.signatures [ i ] . serial == "00:b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c" or pe.signatures [ i ] . serial == "b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c" ) and 1619568000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48542,13 +48542,13 @@ rule REVERSINGLABS_Cert_Blocklist_6A241Ffe96A6349Df608D22C02942268 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8a8decfe-c91a-562c-9376-462cab598373"
+		id = "04b9ed66-a10b-5b04-be34-e48f21286c02"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11824-L11840"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "79db8be7ca3ed80eb1e3a9401e8fec2b83da8b95b16789ed0b59bb7f4639a94d"
+		logic_hash = "v1_sha256_79db8be7ca3ed80eb1e3a9401e8fec2b83da8b95b16789ed0b59bb7f4639a94d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48558,7 +48558,7 @@ rule REVERSINGLABS_Cert_Blocklist_6A241Ffe96A6349Df608D22C02942268 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HELP, d.o.o." and pe.signatures[i].serial=="6a:24:1f:fe:96:a6:34:9d:f6:08:d2:2c:02:94:22:68" and 1605052800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HELP, d.o.o." and pe.signatures [ i ] . serial == "6a:24:1f:fe:96:a6:34:9d:f6:08:d2:2c:02:94:22:68" and 1605052800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48567,13 +48567,13 @@ rule REVERSINGLABS_Cert_Blocklist_Aa1D84779792B57F91Fe7A4Bde041942 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8ec25296-2e51-53ec-a2f5-a25961079c27"
+		id = "d68e973c-9d18-5641-a8b2-ed024aab9668"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11842-L11860"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "682af8c799acaca531724c5b3184b855e64ec4531fcc333a485ba2f63331cdae"
+		logic_hash = "v1_sha256_682af8c799acaca531724c5b3184b855e64ec4531fcc333a485ba2f63331cdae"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48583,7 +48583,7 @@ rule REVERSINGLABS_Cert_Blocklist_Aa1D84779792B57F91Fe7A4Bde041942 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AXIUM NORTHWESTERN HYDRO INC." and (pe.signatures[i].serial=="00:aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42" or pe.signatures[i].serial=="aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42") and 1639872000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AXIUM NORTHWESTERN HYDRO INC." and ( pe.signatures [ i ] . serial == "00:aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42" or pe.signatures [ i ] . serial == "aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42" ) and 1639872000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48592,13 +48592,13 @@ rule REVERSINGLABS_Cert_Blocklist_3C98B6872Fbb1F4Ae37A4Caa749D24C2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f4cc9c94-eb96-5380-9e12-cab5ec010ab8"
+		id = "432a3407-6e11-5e85-b87e-74bdc9e04324"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11862-L11878"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c534ad306f85e12eca2336e998120deb4ba8d0d63b8331986ec7fe4ac69ba65a"
+		logic_hash = "v1_sha256_c534ad306f85e12eca2336e998120deb4ba8d0d63b8331986ec7fe4ac69ba65a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48608,7 +48608,7 @@ rule REVERSINGLABS_Cert_Blocklist_3C98B6872Fbb1F4Ae37A4Caa749D24C2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO SMART" and pe.signatures[i].serial=="3c:98:b6:87:2f:bb:1f:4a:e3:7a:4c:aa:74:9d:24:c2" and 1613370100<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO SMART" and pe.signatures [ i ] . serial == "3c:98:b6:87:2f:bb:1f:4a:e3:7a:4c:aa:74:9d:24:c2" and 1613370100 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48617,13 +48617,13 @@ rule REVERSINGLABS_Cert_Blocklist_E4E795Fd1Fd25595B869Ce22Aa7Dc49F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9c6d2be7-093c-5ce2-83af-6ab9b46603bc"
+		id = "c6e80a3e-99b9-585f-8064-ff9db4c31d15"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11880-L11898"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ced47bd69b58de9e6b2aa7518ccceca088884acb79c0803c3defe6b115a0abb6"
+		logic_hash = "v1_sha256_ced47bd69b58de9e6b2aa7518ccceca088884acb79c0803c3defe6b115a0abb6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48633,7 +48633,7 @@ rule REVERSINGLABS_Cert_Blocklist_E4E795Fd1Fd25595B869Ce22Aa7Dc49F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OASIS COURT LIMITED" and (pe.signatures[i].serial=="00:e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f" or pe.signatures[i].serial=="e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f") and 1608508800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OASIS COURT LIMITED" and ( pe.signatures [ i ] . serial == "00:e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f" or pe.signatures [ i ] . serial == "e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f" ) and 1608508800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48642,13 +48642,13 @@ rule REVERSINGLABS_Cert_Blocklist_E953Ada7E8F1438E5F7680Ff599Ae43E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2bce88d4-24e6-59e5-ae02-5284ec43cfa4"
+		id = "5a81c0df-5a12-55e1-91d4-730b26e3df61"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11900-L11918"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7cb7d77abefd35f0756c5aa0983f7403cca4cbacd94dcc6b510c929bc96c8309"
+		logic_hash = "v1_sha256_7cb7d77abefd35f0756c5aa0983f7403cca4cbacd94dcc6b510c929bc96c8309"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48658,7 +48658,7 @@ rule REVERSINGLABS_Cert_Blocklist_E953Ada7E8F1438E5F7680Ff599Ae43E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KULBYT LLC" and (pe.signatures[i].serial=="00:e9:53:ad:a7:e8:f1:43:8e:5f:76:80:ff:59:9a:e4:3e" or pe.signatures[i].serial=="e9:53:ad:a7:e8:f1:43:8e:5f:76:80:ff:59:9a:e4:3e") and 1614729600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KULBYT LLC" and ( pe.signatures [ i ] . serial == "00:e9:53:ad:a7:e8:f1:43:8e:5f:76:80:ff:59:9a:e4:3e" or pe.signatures [ i ] . serial == "e9:53:ad:a7:e8:f1:43:8e:5f:76:80:ff:59:9a:e4:3e" ) and 1614729600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48667,13 +48667,13 @@ rule REVERSINGLABS_Cert_Blocklist_28C57Df09Ce7Cc3Fde2243Beb4D00101 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "63e2edab-11a4-55ba-b042-c88b6d2750a5"
+		id = "feb45241-c3a1-5e5c-83ec-aacb03fc7367"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11920-L11936"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "84402dc0a58fca36424d8d6d13c60b80342bb3792f4e32e23878530264358726"
+		logic_hash = "v1_sha256_84402dc0a58fca36424d8d6d13c60b80342bb3792f4e32e23878530264358726"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48683,7 +48683,7 @@ rule REVERSINGLABS_Cert_Blocklist_28C57Df09Ce7Cc3Fde2243Beb4D00101 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WATER, s.r.o." and pe.signatures[i].serial=="28:c5:7d:f0:9c:e7:cc:3f:de:22:43:be:b4:d0:01:01" and 1622678400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "WATER, s.r.o." and pe.signatures [ i ] . serial == "28:c5:7d:f0:9c:e7:cc:3f:de:22:43:be:b4:d0:01:01" and 1622678400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48692,13 +48692,13 @@ rule REVERSINGLABS_Cert_Blocklist_2D8Cfcf04209Dc7F771D8D18E462C35A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5ce5c076-87de-50f0-9fa1-a3efef8dd7f8"
+		id = "dd246d9a-57a1-5cb1-9719-796f6a194b36"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11938-L11954"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2b784e46268d78046365400ef914d7ca673503c93962d0b0740ca2ac9faf7857"
+		logic_hash = "v1_sha256_2b784e46268d78046365400ef914d7ca673503c93962d0b0740ca2ac9faf7857"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48708,7 +48708,7 @@ rule REVERSINGLABS_Cert_Blocklist_2D8Cfcf04209Dc7F771D8D18E462C35A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AA PLUS INVEST d.o.o." and pe.signatures[i].serial=="2d:8c:fc:f0:42:09:dc:7f:77:1d:8d:18:e4:62:c3:5a" and 1631491200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AA PLUS INVEST d.o.o." and pe.signatures [ i ] . serial == "2d:8c:fc:f0:42:09:dc:7f:77:1d:8d:18:e4:62:c3:5a" and 1631491200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48717,13 +48717,13 @@ rule REVERSINGLABS_Cert_Blocklist_016836311Fc39Fbb8E6F308Bb03Cc2B3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2c4061e8-0b8e-5c33-a746-6557449b17ed"
+		id = "f354d7bd-8f9c-5a17-9c98-0d87f4d9b579"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11956-L11972"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c5f6372a207d02283840e745619e93194d954eedff7bae34aadcb645b1cb78fc"
+		logic_hash = "v1_sha256_c5f6372a207d02283840e745619e93194d954eedff7bae34aadcb645b1cb78fc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48733,7 +48733,7 @@ rule REVERSINGLABS_Cert_Blocklist_016836311Fc39Fbb8E6F308Bb03Cc2B3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SERVICE STREAM LIMITED" and pe.signatures[i].serial=="01:68:36:31:1f:c3:9f:bb:8e:6f:30:8b:b0:3c:c2:b3" and 1602547200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SERVICE STREAM LIMITED" and pe.signatures [ i ] . serial == "01:68:36:31:1f:c3:9f:bb:8e:6f:30:8b:b0:3c:c2:b3" and 1602547200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48742,13 +48742,13 @@ rule REVERSINGLABS_Cert_Blocklist_435Abf46053A0A445C54217A8C233A7F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "538d7405-be17-519e-beb5-fbef3beaedd3"
+		id = "881fed2a-69c9-5a0c-b11f-710864626229"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11974-L11990"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "839f55e8fe7a86aad406e657fdef48925543b5d3884927104fd3786444a8fccc"
+		logic_hash = "v1_sha256_839f55e8fe7a86aad406e657fdef48925543b5d3884927104fd3786444a8fccc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48758,7 +48758,7 @@ rule REVERSINGLABS_Cert_Blocklist_435Abf46053A0A445C54217A8C233A7F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Kodemika" and pe.signatures[i].serial=="43:5a:bf:46:05:3a:0a:44:5c:54:21:7a:8c:23:3a:7f" and 1616976000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Kodemika" and pe.signatures [ i ] . serial == "43:5a:bf:46:05:3a:0a:44:5c:54:21:7a:8c:23:3a:7f" and 1616976000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48767,13 +48767,13 @@ rule REVERSINGLABS_Cert_Blocklist_B2F9C693A2E6634565F63C79B01Dd8F8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c094666a-0bb3-5cb6-82a8-3074b9eed32b"
+		id = "9bc8ada3-10ff-585f-887e-56ceb7403c21"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L11992-L12010"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f5ec67c082be21a2495ef90fd0a6d4fc4b1379c4903dcc051d39cf1913d5cf20"
+		logic_hash = "v1_sha256_f5ec67c082be21a2495ef90fd0a6d4fc4b1379c4903dcc051d39cf1913d5cf20"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48783,7 +48783,7 @@ rule REVERSINGLABS_Cert_Blocklist_B2F9C693A2E6634565F63C79B01Dd8F8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PHL E STATE ApS" and (pe.signatures[i].serial=="00:b2:f9:c6:93:a2:e6:63:45:65:f6:3c:79:b0:1d:d8:f8" or pe.signatures[i].serial=="b2:f9:c6:93:a2:e6:63:45:65:f6:3c:79:b0:1d:d8:f8") and 1620000000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PHL E STATE ApS" and ( pe.signatures [ i ] . serial == "00:b2:f9:c6:93:a2:e6:63:45:65:f6:3c:79:b0:1d:d8:f8" or pe.signatures [ i ] . serial == "b2:f9:c6:93:a2:e6:63:45:65:f6:3c:79:b0:1d:d8:f8" ) and 1620000000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48792,13 +48792,13 @@ rule REVERSINGLABS_Cert_Blocklist_54A6D33F73129E0Ef059Ccf51Be0C35E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1cf2bda8-05e6-5f0a-a28a-2f5fa02775c9"
+		id = "62b0e468-c1c1-5ff1-b14a-b77215bbf838"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12012-L12028"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6fbed9c8537ea2baeb58044a934fc9741730b8a3ae4d059c23b033973d7ff7d3"
+		logic_hash = "v1_sha256_6fbed9c8537ea2baeb58044a934fc9741730b8a3ae4d059c23b033973d7ff7d3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48808,7 +48808,7 @@ rule REVERSINGLABS_Cert_Blocklist_54A6D33F73129E0Ef059Ccf51Be0C35E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STAFFORD MEAT COMPANY, INC." and pe.signatures[i].serial=="54:a6:d3:3f:73:12:9e:0e:f0:59:cc:f5:1b:e0:c3:5e" and 1607100127<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "STAFFORD MEAT COMPANY, INC." and pe.signatures [ i ] . serial == "54:a6:d3:3f:73:12:9e:0e:f0:59:cc:f5:1b:e0:c3:5e" and 1607100127 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48817,13 +48817,13 @@ rule REVERSINGLABS_Cert_Blocklist_142Aac4217E22B525C8587589773Ba9B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "488be2f7-e3d4-51e3-b7bb-142caa7b2bd5"
+		id = "2d2e7993-68c0-5235-8181-a9f7caf682d0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12030-L12046"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f169925c27f5e0f8d5f658b83d1b9fa4548c4443b16bd4d7f87aa2b8e44bf06b"
+		logic_hash = "v1_sha256_f169925c27f5e0f8d5f658b83d1b9fa4548c4443b16bd4d7f87aa2b8e44bf06b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48833,7 +48833,7 @@ rule REVERSINGLABS_Cert_Blocklist_142Aac4217E22B525C8587589773Ba9B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "A.B. gostinstvo trgovina posredni\\xC5\\xA1tvo in druge storitve, d.o.o." and pe.signatures[i].serial=="14:2a:ac:42:17:e2:2b:52:5c:85:87:58:97:73:ba:9b" and 1614124800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "A.B. gostinstvo trgovina posredni\\xC5\\xA1tvo in druge storitve, d.o.o." and pe.signatures [ i ] . serial == "14:2a:ac:42:17:e2:2b:52:5c:85:87:58:97:73:ba:9b" and 1614124800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48842,13 +48842,13 @@ rule REVERSINGLABS_Cert_Blocklist_239664C12Baeb5A6D787912888051392 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4d24a880-6fa5-5c22-875e-29f4985e3750"
+		id = "0ce448fd-88ba-5685-bf12-b248d0246278"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12048-L12064"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ab2c228088a4c11b3a0f1a5f0acf181cc31e548781cb3f1205475bfbe39c7236"
+		logic_hash = "v1_sha256_ab2c228088a4c11b3a0f1a5f0acf181cc31e548781cb3f1205475bfbe39c7236"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48858,7 +48858,7 @@ rule REVERSINGLABS_Cert_Blocklist_239664C12Baeb5A6D787912888051392 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTH PROPERTY LTD" and pe.signatures[i].serial=="23:96:64:c1:2b:ae:b5:a6:d7:87:91:28:88:05:13:92" and 1618272000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FORTH PROPERTY LTD" and pe.signatures [ i ] . serial == "23:96:64:c1:2b:ae:b5:a6:d7:87:91:28:88:05:13:92" and 1618272000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48867,13 +48867,13 @@ rule REVERSINGLABS_Cert_Blocklist_0218Ebfd5A9Bfd55D2F661F0D18D1D71 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d03619c7-c4e8-57bd-a19e-1452ab7a76df"
+		id = "6c943e3c-e449-5602-86ae-7a809a1477b0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12066-L12082"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4aabe3beab0055b6ef8f6114c5236940f5693b44e94efd14132b450bb9232c03"
+		logic_hash = "v1_sha256_4aabe3beab0055b6ef8f6114c5236940f5693b44e94efd14132b450bb9232c03"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48883,7 +48883,7 @@ rule REVERSINGLABS_Cert_Blocklist_0218Ebfd5A9Bfd55D2F661F0D18D1D71 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REI LUX UK LIMITED" and pe.signatures[i].serial=="02:18:eb:fd:5a:9b:fd:55:d2:f6:61:f0:d1:8d:1d:71" and 1608508800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "REI LUX UK LIMITED" and pe.signatures [ i ] . serial == "02:18:eb:fd:5a:9b:fd:55:d2:f6:61:f0:d1:8d:1d:71" and 1608508800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48892,13 +48892,13 @@ rule REVERSINGLABS_Cert_Blocklist_35590Ebe4A02Dc23317D8Ce47A947A9B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2f72a686-c30c-572d-a78c-03747ac325b6"
+		id = "88c6aaf7-cf17-5d14-9d21-75ab65e18702"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12084-L12100"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2d4bc88943cdc8af00effab745e64e60ef662c668a0b2193c256d11831ef1554"
+		logic_hash = "v1_sha256_2d4bc88943cdc8af00effab745e64e60ef662c668a0b2193c256d11831ef1554"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48908,7 +48908,7 @@ rule REVERSINGLABS_Cert_Blocklist_35590Ebe4A02Dc23317D8Ce47A947A9B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Largos" and pe.signatures[i].serial=="35:59:0e:be:4a:02:dc:23:31:7d:8c:e4:7a:94:7a:9b" and 1602201600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Largos" and pe.signatures [ i ] . serial == "35:59:0e:be:4a:02:dc:23:31:7d:8c:e4:7a:94:7a:9b" and 1602201600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48917,13 +48917,13 @@ rule REVERSINGLABS_Cert_Blocklist_Aa07D4F2857119Cee514A0Bd412F8201 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6bb83f26-90f5-587f-8c69-fa06beaead3e"
+		id = "f7037358-2bb2-52e6-8644-f7c9f5089211"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12102-L12120"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fbbea89f2070b2a527bba6199022fbffd269e664b000988a59adf4ca0d4a9f22"
+		logic_hash = "v1_sha256_fbbea89f2070b2a527bba6199022fbffd269e664b000988a59adf4ca0d4a9f22"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48933,7 +48933,7 @@ rule REVERSINGLABS_Cert_Blocklist_Aa07D4F2857119Cee514A0Bd412F8201 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HANGA GIP d.o.o." and (pe.signatures[i].serial=="00:aa:07:d4:f2:85:71:19:ce:e5:14:a0:bd:41:2f:82:01" or pe.signatures[i].serial=="aa:07:d4:f2:85:71:19:ce:e5:14:a0:bd:41:2f:82:01") and 1615766400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HANGA GIP d.o.o." and ( pe.signatures [ i ] . serial == "00:aa:07:d4:f2:85:71:19:ce:e5:14:a0:bd:41:2f:82:01" or pe.signatures [ i ] . serial == "aa:07:d4:f2:85:71:19:ce:e5:14:a0:bd:41:2f:82:01" ) and 1615766400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48942,13 +48942,13 @@ rule REVERSINGLABS_Cert_Blocklist_40F5660A90301E7A8A8C3B42 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c47bb4f0-d60b-5948-ac10-6083606ed46a"
+		id = "0b41b94c-b144-5daf-bc7a-9a9553348216"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12122-L12138"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3573d1d5f11df106f1f6f44f8b0164992f2a50707c6df7b08b05ed9ea7d9173b"
+		logic_hash = "v1_sha256_3573d1d5f11df106f1f6f44f8b0164992f2a50707c6df7b08b05ed9ea7d9173b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48958,7 +48958,7 @@ rule REVERSINGLABS_Cert_Blocklist_40F5660A90301E7A8A8C3B42 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Booz Allen Hamilton Inc." and pe.signatures[i].serial=="40:f5:66:0a:90:30:1e:7a:8a:8c:3b:42" and 1641833688<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Booz Allen Hamilton Inc." and pe.signatures [ i ] . serial == "40:f5:66:0a:90:30:1e:7a:8a:8c:3b:42" and 1641833688 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48967,13 +48967,13 @@ rule REVERSINGLABS_Cert_Blocklist_0400C7614F86D75Fe4Ee3F6192B6Feda : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "500c9604-cc07-52b1-8c46-09894d132205"
+		id = "c4fd7da9-8811-5288-8c4d-af4fb4e1f55e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12140-L12156"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "47735267e9a0fb8107f6c4008bacc8aada1705f6714a0447dacc3928fc20cad6"
+		logic_hash = "v1_sha256_47735267e9a0fb8107f6c4008bacc8aada1705f6714a0447dacc3928fc20cad6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -48983,7 +48983,7 @@ rule REVERSINGLABS_Cert_Blocklist_0400C7614F86D75Fe4Ee3F6192B6Feda : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "StackUp ApS" and pe.signatures[i].serial=="04:00:c7:61:4f:86:d7:5f:e4:ee:3f:61:92:b6:fe:da" and 1626393601<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "StackUp ApS" and pe.signatures [ i ] . serial == "04:00:c7:61:4f:86:d7:5f:e4:ee:3f:61:92:b6:fe:da" and 1626393601 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -48992,13 +48992,13 @@ rule REVERSINGLABS_Cert_Blocklist_E573D9C8B403C41Bd59Ffa0A8Efd4168 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2e799dd9-d143-55a7-9d07-d5f289477b24"
+		id = "c83ef41c-6a99-575c-b301-7f6b801881b6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12158-L12176"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "425126b90fe2ab7c1ec7bf2fd5a91e4438a81992f20f99ed87ec62e7f20043cd"
+		logic_hash = "v1_sha256_425126b90fe2ab7c1ec7bf2fd5a91e4438a81992f20f99ed87ec62e7f20043cd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49008,7 +49008,7 @@ rule REVERSINGLABS_Cert_Blocklist_E573D9C8B403C41Bd59Ffa0A8Efd4168 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\"VERONIKA 2\" OOO" and (pe.signatures[i].serial=="00:e5:73:d9:c8:b4:03:c4:1b:d5:9f:fa:0a:8e:fd:41:68" or pe.signatures[i].serial=="e5:73:d9:c8:b4:03:c4:1b:d5:9f:fa:0a:8e:fd:41:68") and 1563148800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\"VERONIKA 2\" OOO" and ( pe.signatures [ i ] . serial == "00:e5:73:d9:c8:b4:03:c4:1b:d5:9f:fa:0a:8e:fd:41:68" or pe.signatures [ i ] . serial == "e5:73:d9:c8:b4:03:c4:1b:d5:9f:fa:0a:8e:fd:41:68" ) and 1563148800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49017,13 +49017,13 @@ rule REVERSINGLABS_Cert_Blocklist_B06Bc166Fc765Dacd2F7448C8Cdd9205 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4b27c958-58f1-5fbd-8a39-aedfe4dafe39"
+		id = "8ec2b868-8380-5bbe-aa66-cc4bc34e4879"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12178-L12196"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2c47166f02c7f94bb4f82296e3220ff7ca3c6c53566d855b2fe77cb842a5fb43"
+		logic_hash = "v1_sha256_2c47166f02c7f94bb4f82296e3220ff7ca3c6c53566d855b2fe77cb842a5fb43"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49033,7 +49033,7 @@ rule REVERSINGLABS_Cert_Blocklist_B06Bc166Fc765Dacd2F7448C8Cdd9205 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GAS Avto, d.o.o." and (pe.signatures[i].serial=="00:b0:6b:c1:66:fc:76:5d:ac:d2:f7:44:8c:8c:dd:92:05" or pe.signatures[i].serial=="b0:6b:c1:66:fc:76:5d:ac:d2:f7:44:8c:8c:dd:92:05") and 1615507200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GAS Avto, d.o.o." and ( pe.signatures [ i ] . serial == "00:b0:6b:c1:66:fc:76:5d:ac:d2:f7:44:8c:8c:dd:92:05" or pe.signatures [ i ] . serial == "b0:6b:c1:66:fc:76:5d:ac:d2:f7:44:8c:8c:dd:92:05" ) and 1615507200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49042,13 +49042,13 @@ rule REVERSINGLABS_Cert_Blocklist_E9268Ed63A7D7E9Dfd40A664Ddfbaf18 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a93b0a98-cfec-5e32-9fd8-b3d6c4353558"
+		id = "c81a9978-cd84-5148-8b0b-6b24389d59c3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12198-L12216"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fc840c0b37867c3b0aa80d4dc609feaaab77d3f0c6f84c8bb2ea7c5a6461ebb8"
+		logic_hash = "v1_sha256_fc840c0b37867c3b0aa80d4dc609feaaab77d3f0c6f84c8bb2ea7c5a6461ebb8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49058,7 +49058,7 @@ rule REVERSINGLABS_Cert_Blocklist_E9268Ed63A7D7E9Dfd40A664Ddfbaf18 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Casta, s.r.o." and (pe.signatures[i].serial=="00:e9:26:8e:d6:3a:7d:7e:9d:fd:40:a6:64:dd:fb:af:18" or pe.signatures[i].serial=="e9:26:8e:d6:3a:7d:7e:9d:fd:40:a6:64:dd:fb:af:18") and 1647302400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Casta, s.r.o." and ( pe.signatures [ i ] . serial == "00:e9:26:8e:d6:3a:7d:7e:9d:fd:40:a6:64:dd:fb:af:18" or pe.signatures [ i ] . serial == "e9:26:8e:d6:3a:7d:7e:9d:fd:40:a6:64:dd:fb:af:18" ) and 1647302400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49067,13 +49067,13 @@ rule REVERSINGLABS_Cert_Blocklist_425Dc3E0Ca8Bcdce19D00D87E3F0Ba28 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "df6e1403-c300-5d97-b57d-dc70d61b2229"
+		id = "2c04cd8b-05ae-5616-b717-3e22e0f2b23f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12218-L12234"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "67a975f2806825bf0da27fcaf33c2ff497fe9bb2af12c22ff505b49070516960"
+		logic_hash = "v1_sha256_67a975f2806825bf0da27fcaf33c2ff497fe9bb2af12c22ff505b49070516960"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49083,7 +49083,7 @@ rule REVERSINGLABS_Cert_Blocklist_425Dc3E0Ca8Bcdce19D00D87E3F0Ba28 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Protover LLC" and pe.signatures[i].serial=="42:5d:c3:e0:ca:8b:cd:ce:19:d0:0d:87:e3:f0:ba:28" and 1621900800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Protover LLC" and pe.signatures [ i ] . serial == "42:5d:c3:e0:ca:8b:cd:ce:19:d0:0d:87:e3:f0:ba:28" and 1621900800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49092,13 +49092,13 @@ rule REVERSINGLABS_Cert_Blocklist_Afc0Ddb7Bdc8207E8C3B7204018Eecd3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "73f4d6e2-6924-59fa-8ec1-305f2d5dc5a3"
+		id = "14f74bb2-4c87-5913-a73e-d27e65d05171"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12236-L12254"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "302e2d6b31ca5c2c33c4ec7294630fd88a9c40f70ddecdc606ccff27b24e1cd4"
+		logic_hash = "v1_sha256_302e2d6b31ca5c2c33c4ec7294630fd88a9c40f70ddecdc606ccff27b24e1cd4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49108,7 +49108,7 @@ rule REVERSINGLABS_Cert_Blocklist_Afc0Ddb7Bdc8207E8C3B7204018Eecd3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE9\\x83\\xB4\\xE5\\xB7\\x9E\\xE8\\x9C\\x97\\xE7\\x89\\x9B\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and (pe.signatures[i].serial=="00:af:c0:dd:b7:bd:c8:20:7e:8c:3b:72:04:01:8e:ec:d3" or pe.signatures[i].serial=="af:c0:dd:b7:bd:c8:20:7e:8c:3b:72:04:01:8e:ec:d3") and 1629676800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE9\\x83\\xB4\\xE5\\xB7\\x9E\\xE8\\x9C\\x97\\xE7\\x89\\x9B\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and ( pe.signatures [ i ] . serial == "00:af:c0:dd:b7:bd:c8:20:7e:8c:3b:72:04:01:8e:ec:d3" or pe.signatures [ i ] . serial == "af:c0:dd:b7:bd:c8:20:7e:8c:3b:72:04:01:8e:ec:d3" ) and 1629676800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49117,13 +49117,13 @@ rule REVERSINGLABS_Cert_Blocklist_38989Ec61Ecdb7391Ff5647F7D58Ad18 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1841bbd1-4c7a-5b89-8c63-58d8a3ae1cef"
+		id = "9bce9c96-4e4e-517a-98ab-6f6d485f31c8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12256-L12272"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1795812d4daa458b157280cac7a9b13e9b67a2d78eac077691bbce2bf8aeec34"
+		logic_hash = "v1_sha256_1795812d4daa458b157280cac7a9b13e9b67a2d78eac077691bbce2bf8aeec34"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49133,7 +49133,7 @@ rule REVERSINGLABS_Cert_Blocklist_38989Ec61Ecdb7391Ff5647F7D58Ad18 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RotA Games ApS" and pe.signatures[i].serial=="38:98:9e:c6:1e:cd:b7:39:1f:f5:64:7f:7d:58:ad:18" and 1613088000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RotA Games ApS" and pe.signatures [ i ] . serial == "38:98:9e:c6:1e:cd:b7:39:1f:f5:64:7f:7d:58:ad:18" and 1613088000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49142,13 +49142,13 @@ rule REVERSINGLABS_Cert_Blocklist_Bc6C43D206A360F2D6B58537C456B709 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fd19ce61-056b-549a-946e-72543ff1f7c0"
+		id = "d334902e-8ee4-58c7-8bba-88c82d2884df"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12274-L12292"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "eb5288d2b96ff7a7783c2b2b02f9f1168784352ed84ad6463dce00c12daca6cb"
+		logic_hash = "v1_sha256_eb5288d2b96ff7a7783c2b2b02f9f1168784352ed84ad6463dce00c12daca6cb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49158,7 +49158,7 @@ rule REVERSINGLABS_Cert_Blocklist_Bc6C43D206A360F2D6B58537C456B709 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ANKADA GROUP, d.o.o." and (pe.signatures[i].serial=="00:bc:6c:43:d2:06:a3:60:f2:d6:b5:85:37:c4:56:b7:09" or pe.signatures[i].serial=="bc:6c:43:d2:06:a3:60:f2:d6:b5:85:37:c4:56:b7:09") and 1616630400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ANKADA GROUP, d.o.o." and ( pe.signatures [ i ] . serial == "00:bc:6c:43:d2:06:a3:60:f2:d6:b5:85:37:c4:56:b7:09" or pe.signatures [ i ] . serial == "bc:6c:43:d2:06:a3:60:f2:d6:b5:85:37:c4:56:b7:09" ) and 1616630400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49167,13 +49167,13 @@ rule REVERSINGLABS_Cert_Blocklist_4929Ab561C812Af93Ddb9758B545F546 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6e8ffb39-d00d-54ca-a4be-68f6dd92d798"
+		id = "111aa066-48be-5dfc-b3bc-3aa20788952b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12294-L12310"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "12235e324b92b83e9cfaed7cbcff5d093b8b1d7528dd5ac327159cde6e9a4d1f"
+		logic_hash = "v1_sha256_12235e324b92b83e9cfaed7cbcff5d093b8b1d7528dd5ac327159cde6e9a4d1f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49183,7 +49183,7 @@ rule REVERSINGLABS_Cert_Blocklist_4929Ab561C812Af93Ddb9758B545F546 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Everything Wow s.r.o." and pe.signatures[i].serial=="49:29:ab:56:1c:81:2a:f9:3d:db:97:58:b5:45:f5:46" and 1594252800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Everything Wow s.r.o." and pe.signatures [ i ] . serial == "49:29:ab:56:1c:81:2a:f9:3d:db:97:58:b5:45:f5:46" and 1594252800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49192,13 +49192,13 @@ rule REVERSINGLABS_Cert_Blocklist_25C6Dbce3D5499F65D9Df16E9007465D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f6d0808d-4748-5b9f-9be2-7753292a6209"
+		id = "fc20b80a-d556-55b6-b214-29763d101909"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12312-L12328"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "978f05f86734c63afe1e5929a58f3cfff75ef749ffda07252db90b6fe12508ec"
+		logic_hash = "v1_sha256_978f05f86734c63afe1e5929a58f3cfff75ef749ffda07252db90b6fe12508ec"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49208,7 +49208,7 @@ rule REVERSINGLABS_Cert_Blocklist_25C6Dbce3D5499F65D9Df16E9007465D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5d" and 1626566400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT,LLC" and pe.signatures [ i ] . serial == "25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5d" and 1626566400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49217,13 +49217,13 @@ rule REVERSINGLABS_Cert_Blocklist_Bc6A1812E001362469541108973Bbd52 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ac5ac6d7-898b-5547-8d35-a483f20edcd6"
+		id = "159aa768-7dfe-537e-a1d8-025f969607c6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12330-L12348"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9b678e9fb1e1eda3ac8e027b5e449af446de4379fea46ef7ff820240c73795ee"
+		logic_hash = "v1_sha256_9b678e9fb1e1eda3ac8e027b5e449af446de4379fea46ef7ff820240c73795ee"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49233,7 +49233,7 @@ rule REVERSINGLABS_Cert_Blocklist_Bc6A1812E001362469541108973Bbd52 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and (pe.signatures[i].serial=="00:bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52" or pe.signatures[i].serial=="bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52") and 1623801600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT,LLC" and ( pe.signatures [ i ] . serial == "00:bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52" or pe.signatures [ i ] . serial == "bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52" ) and 1623801600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49242,13 +49242,13 @@ rule REVERSINGLABS_Cert_Blocklist_Bde1D6Dc3622724F427A39E6A34F5124 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6b6958c0-3b43-5c17-9354-d0e2326b97fd"
+		id = "f15afc5b-4f70-5f63-b05e-954111ee4bb8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12350-L12368"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f1cf0b6855269a771447a0b38f4a02996b6527d7df4b143b69598ed591719ca0"
+		logic_hash = "v1_sha256_f1cf0b6855269a771447a0b38f4a02996b6527d7df4b143b69598ed591719ca0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49258,7 +49258,7 @@ rule REVERSINGLABS_Cert_Blocklist_Bde1D6Dc3622724F427A39E6A34F5124 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and (pe.signatures[i].serial=="00:bd:e1:d6:dc:36:22:72:4f:42:7a:39:e6:a3:4f:51:24" or pe.signatures[i].serial=="bd:e1:d6:dc:36:22:72:4f:42:7a:39:e6:a3:4f:51:24") and 1628553600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT,LLC" and ( pe.signatures [ i ] . serial == "00:bd:e1:d6:dc:36:22:72:4f:42:7a:39:e6:a3:4f:51:24" or pe.signatures [ i ] . serial == "bd:e1:d6:dc:36:22:72:4f:42:7a:39:e6:a3:4f:51:24" ) and 1628553600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49267,13 +49267,13 @@ rule REVERSINGLABS_Cert_Blocklist_5C9F5F96726A6E6Fc3B8Bb153Ac82Af2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f7619c39-33a0-5f99-b911-9d8a61a4683d"
+		id = "934a96ce-f689-5298-b18b-788bd1fa89a9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12370-L12386"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a61bcc4a90a75a429366e3f93929005b67325eccc6cad3df6b7a0c3692597828"
+		logic_hash = "v1_sha256_a61bcc4a90a75a429366e3f93929005b67325eccc6cad3df6b7a0c3692597828"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49283,7 +49283,7 @@ rule REVERSINGLABS_Cert_Blocklist_5C9F5F96726A6E6Fc3B8Bb153Ac82Af2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "1105 SOFTWARE LLC" and pe.signatures[i].serial=="5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2" and 1679061408<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "1105 SOFTWARE LLC" and pe.signatures [ i ] . serial == "5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2" and 1679061408 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49292,13 +49292,13 @@ rule REVERSINGLABS_Cert_Blocklist_6E889Bb3B7F7194B674C6A0335A608E0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d164846d-9552-5108-8b01-1b4b3e7c0b60"
+		id = "6ae78275-2be3-59bb-88ec-93208909baaf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12388-L12404"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fa2a47f4fb822089fcc958850ce516c8c5d95a6d9b575f3b1d1d4a2ceb2537e4"
+		logic_hash = "v1_sha256_fa2a47f4fb822089fcc958850ce516c8c5d95a6d9b575f3b1d1d4a2ceb2537e4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49308,7 +49308,7 @@ rule REVERSINGLABS_Cert_Blocklist_6E889Bb3B7F7194B674C6A0335A608E0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CLEVERCONTROL LLC" and pe.signatures[i].serial=="6e:88:9b:b3:b7:f7:19:4b:67:4c:6a:03:35:a6:08:e0" and 1646956800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CLEVERCONTROL LLC" and pe.signatures [ i ] . serial == "6e:88:9b:b3:b7:f7:19:4b:67:4c:6a:03:35:a6:08:e0" and 1646956800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49317,13 +49317,13 @@ rule REVERSINGLABS_Cert_Blocklist_0F62F760704Bdf8Dc30C7Baa7376F484 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fe326fb9-fe1e-5fc9-8599-6b4cfd6506dd"
+		id = "634f9d1f-d240-56bc-be19-ce74592a9159"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12406-L12422"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d54d52e116b9404782ce80664f218d2e142577dac672c53c41b82f0466c7375a"
+		logic_hash = "v1_sha256_d54d52e116b9404782ce80664f218d2e142577dac672c53c41b82f0466c7375a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49333,7 +49333,7 @@ rule REVERSINGLABS_Cert_Blocklist_0F62F760704Bdf8Dc30C7Baa7376F484 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shanghai XuSong investment partnership Enterprise(Limited)" and pe.signatures[i].serial=="0f:62:f7:60:70:4b:df:8d:c3:0c:7b:aa:73:76:f4:84" and 1659398400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shanghai XuSong investment partnership Enterprise(Limited)" and pe.signatures [ i ] . serial == "0f:62:f7:60:70:4b:df:8d:c3:0c:7b:aa:73:76:f4:84" and 1659398400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49342,13 +49342,13 @@ rule REVERSINGLABS_Cert_Blocklist_071202Dbfda40B629C5E7Acac947C2D3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4206c383-0e6d-5129-8e6a-05bd54c48e65"
+		id = "7097c3a6-0d4d-59ca-b12e-f9e5779e86f7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12424-L12440"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cc51b0ae6a59f68e61ee0b4ff33ea0e1ee9ef04e4c994e1c98da6befab62a5b9"
+		logic_hash = "v1_sha256_cc51b0ae6a59f68e61ee0b4ff33ea0e1ee9ef04e4c994e1c98da6befab62a5b9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49358,7 +49358,7 @@ rule REVERSINGLABS_Cert_Blocklist_071202Dbfda40B629C5E7Acac947C2D3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Crossfire Industries, LLC" and pe.signatures[i].serial=="07:12:02:db:fd:a4:0b:62:9c:5e:7a:ca:c9:47:c2:d3" and 1658620801<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Crossfire Industries, LLC" and pe.signatures [ i ] . serial == "07:12:02:db:fd:a4:0b:62:9c:5e:7a:ca:c9:47:c2:d3" and 1658620801 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49367,13 +49367,13 @@ rule REVERSINGLABS_Cert_Blocklist_98Ab9585C04D7F0E4Cf4De98C14B684D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "445bb30e-e021-5a75-a47e-29fa567acfa5"
+		id = "3e67a2b3-3330-5c2a-998d-1895eb8c7587"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12442-L12460"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ba43dd15b13623bb99d88c93fb9e751deb95a546325a1142d9137b25430d07fd"
+		logic_hash = "v1_sha256_ba43dd15b13623bb99d88c93fb9e751deb95a546325a1142d9137b25430d07fd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49383,7 +49383,7 @@ rule REVERSINGLABS_Cert_Blocklist_98Ab9585C04D7F0E4Cf4De98C14B684D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and (pe.signatures[i].serial=="00:98:ab:95:85:c0:4d:7f:0e:4c:f4:de:98:c1:4b:68:4d" or pe.signatures[i].serial=="98:ab:95:85:c0:4d:7f:0e:4c:f4:de:98:c1:4b:68:4d") and 1656547200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT,LLC" and ( pe.signatures [ i ] . serial == "00:98:ab:95:85:c0:4d:7f:0e:4c:f4:de:98:c1:4b:68:4d" or pe.signatures [ i ] . serial == "98:ab:95:85:c0:4d:7f:0e:4c:f4:de:98:c1:4b:68:4d" ) and 1656547200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49392,13 +49392,13 @@ rule REVERSINGLABS_Cert_Blocklist_4631713E66E91347F0388B98Cf747794 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6c541522-98ab-5acb-af84-c005c9721e1f"
+		id = "3edec0d8-76ac-51fe-af6d-d9b178dc6246"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12462-L12478"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cb517cda67150b7e17ee3bd946903e8e8eca81742a362032249a2f2387e71c50"
+		logic_hash = "v1_sha256_cb517cda67150b7e17ee3bd946903e8e8eca81742a362032249a2f2387e71c50"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49408,7 +49408,7 @@ rule REVERSINGLABS_Cert_Blocklist_4631713E66E91347F0388B98Cf747794 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xB9\\xBF\\xE5\\xB7\\x9E\\xE6\\x98\\x8A\\xE5\\x8A\\xA8\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="46:31:71:3e:66:e9:13:47:f0:38:8b:98:cf:74:77:94" and 1488240000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\xB9\\xBF\\xE5\\xB7\\x9E\\xE6\\x98\\x8A\\xE5\\x8A\\xA8\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "46:31:71:3e:66:e9:13:47:f0:38:8b:98:cf:74:77:94" and 1488240000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49417,13 +49417,13 @@ rule REVERSINGLABS_Cert_Blocklist_E963F8983D21B4C1A69C66A9D37498E5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4cbc6cc9-1795-5d43-84a1-dd835d7ef349"
+		id = "7c0d882a-3925-539d-8e9f-8fe84707f98e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12480-L12498"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b7c715e28f003351d10ba53657e9e667b635a0e4433276d91d26f4482a61191d"
+		logic_hash = "v1_sha256_b7c715e28f003351d10ba53657e9e667b635a0e4433276d91d26f4482a61191d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49433,7 +49433,7 @@ rule REVERSINGLABS_Cert_Blocklist_E963F8983D21B4C1A69C66A9D37498E5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Max Steinhard" and (pe.signatures[i].serial=="00:e9:63:f8:98:3d:21:b4:c1:a6:9c:66:a9:d3:74:98:e5" or pe.signatures[i].serial=="e9:63:f8:98:3d:21:b4:c1:a6:9c:66:a9:d3:74:98:e5") and 1656288000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Max Steinhard" and ( pe.signatures [ i ] . serial == "00:e9:63:f8:98:3d:21:b4:c1:a6:9c:66:a9:d3:74:98:e5" or pe.signatures [ i ] . serial == "e9:63:f8:98:3d:21:b4:c1:a6:9c:66:a9:d3:74:98:e5" ) and 1656288000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49442,13 +49442,13 @@ rule REVERSINGLABS_Cert_Blocklist_6E44Fcedd49F22F7A28Cecc99104F61A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b69a4e06-a732-5462-b2b1-bdde3fd34e31"
+		id = "dda8c05f-ecc7-5b55-a454-6ab57e7cefd5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12500-L12516"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "caff0cbca45c0dffb673367585824783371f2f4e31a0c9629afb7de708098892"
+		logic_hash = "v1_sha256_caff0cbca45c0dffb673367585824783371f2f4e31a0c9629afb7de708098892"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49458,7 +49458,7 @@ rule REVERSINGLABS_Cert_Blocklist_6E44Fcedd49F22F7A28Cecc99104F61A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "M-Trans Maciej Caban" and pe.signatures[i].serial=="6e:44:fc:ed:d4:9f:22:f7:a2:8c:ec:c9:91:04:f6:1a" and 1672923378<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "M-Trans Maciej Caban" and pe.signatures [ i ] . serial == "6e:44:fc:ed:d4:9f:22:f7:a2:8c:ec:c9:91:04:f6:1a" and 1672923378 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49467,13 +49467,13 @@ rule REVERSINGLABS_Cert_Blocklist_35B49Ee870Aea532E6Ef0A4987105C8F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "88dedb69-52f4-59d3-b397-6a091a866cc5"
+		id = "14dcc331-43e4-5ee7-ae1c-d62b802f8308"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12518-L12534"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a9d8e9db453f40e32a0cb6412db8885db54053fdf3d7908b884361a493f97b1f"
+		logic_hash = "v1_sha256_a9d8e9db453f40e32a0cb6412db8885db54053fdf3d7908b884361a493f97b1f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49483,7 +49483,7 @@ rule REVERSINGLABS_Cert_Blocklist_35B49Ee870Aea532E6Ef0A4987105C8F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kancelaria Adwokacka Adwokat Aleksandra Krzemi\\xC5\\x84ska" and pe.signatures[i].serial=="35:b4:9e:e8:70:ae:a5:32:e6:ef:0a:49:87:10:5c:8f" and 1663151018<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kancelaria Adwokacka Adwokat Aleksandra Krzemi\\xC5\\x84ska" and pe.signatures [ i ] . serial == "35:b4:9e:e8:70:ae:a5:32:e6:ef:0a:49:87:10:5c:8f" and 1663151018 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49492,13 +49492,13 @@ rule REVERSINGLABS_Cert_Blocklist_063Dcd7D7B0Bc77Cac844C7213Be3989 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1bf4b84b-4a32-5908-8ccb-9fce2e5944e6"
+		id = "dd4dea05-3c12-5659-831f-90f5b4a80d39"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12536-L12552"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "091d00b0731f0a3d9917eee945249f001e4b5b1b603cad2fc21eed70ec86aa99"
+		logic_hash = "v1_sha256_091d00b0731f0a3d9917eee945249f001e4b5b1b603cad2fc21eed70ec86aa99"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49508,7 +49508,7 @@ rule REVERSINGLABS_Cert_Blocklist_063Dcd7D7B0Bc77Cac844C7213Be3989 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HANNAH SISK LIMITED" and pe.signatures[i].serial=="06:3d:cd:7d:7b:0b:c7:7c:ac:84:4c:72:13:be:39:89" and 1656892801<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HANNAH SISK LIMITED" and pe.signatures [ i ] . serial == "06:3d:cd:7d:7b:0b:c7:7c:ac:84:4c:72:13:be:39:89" and 1656892801 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49517,13 +49517,13 @@ rule REVERSINGLABS_Cert_Blocklist_6F8777Aa866142Ad7120E5E1C9321E37 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ace8a8b4-5288-56c4-bd47-9eb42ea41ecb"
+		id = "9a49260d-870d-5ae2-af26-ad38a93e5a05"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12554-L12570"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ca3ff0c7192ba90932d35d053712816555dea051ce15d29a7ccf4e37da989899"
+		logic_hash = "v1_sha256_ca3ff0c7192ba90932d35d053712816555dea051ce15d29a7ccf4e37da989899"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49533,7 +49533,7 @@ rule REVERSINGLABS_Cert_Blocklist_6F8777Aa866142Ad7120E5E1C9321E37 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CLOUD SOFTWARE LINE CO., LTD." and pe.signatures[i].serial=="6f:87:77:aa:86:61:42:ad:71:20:e5:e1:c9:32:1e:37" and 1629676800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CLOUD SOFTWARE LINE CO., LTD." and pe.signatures [ i ] . serial == "6f:87:77:aa:86:61:42:ad:71:20:e5:e1:c9:32:1e:37" and 1629676800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49542,13 +49542,13 @@ rule REVERSINGLABS_Cert_Blocklist_4A7F07C5D4Ad2E23F9E8E03F0E229Dd4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "76be58d9-d1a3-5dec-807e-941714be80f9"
+		id = "5b1caafb-229f-5223-b8a8-bfb713f4ab47"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12572-L12588"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6dc2bfac77117e294cacc772f7bfaea8b2e3caa26a0afd3729d517e91ca20ea5"
+		logic_hash = "v1_sha256_6dc2bfac77117e294cacc772f7bfaea8b2e3caa26a0afd3729d517e91ca20ea5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49558,7 +49558,7 @@ rule REVERSINGLABS_Cert_Blocklist_4A7F07C5D4Ad2E23F9E8E03F0E229Dd4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Danalis LLC" and pe.signatures[i].serial=="4a:7f:07:c5:d4:ad:2e:23:f9:e8:e0:3f:0e:22:9d:d4" and 1608681600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Danalis LLC" and pe.signatures [ i ] . serial == "4a:7f:07:c5:d4:ad:2e:23:f9:e8:e0:3f:0e:22:9d:d4" and 1608681600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49567,13 +49567,13 @@ rule REVERSINGLABS_Cert_Blocklist_F5F9C8F8C33E4Ce84Dd48Fcb03Ccb075 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "74203aa1-e5d0-59d9-b9f8-b79f5fbe271e"
+		id = "4faae355-3ea8-55f2-a9f6-81c299cc5aa1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12590-L12608"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ac3bab3f5a93099f39b0862b419346d1eb3d0f75d86e121ba30626d496c46c57"
+		logic_hash = "v1_sha256_ac3bab3f5a93099f39b0862b419346d1eb3d0f75d86e121ba30626d496c46c57"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49583,7 +49583,7 @@ rule REVERSINGLABS_Cert_Blocklist_F5F9C8F8C33E4Ce84Dd48Fcb03Ccb075 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Abdulkadir \\xC5\\x9Eahin" and (pe.signatures[i].serial=="00:f5:f9:c8:f8:c3:3e:4c:e8:4d:d4:8f:cb:03:cc:b0:75" or pe.signatures[i].serial=="f5:f9:c8:f8:c3:3e:4c:e8:4d:d4:8f:cb:03:cc:b0:75") and 1545004800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Abdulkadir \\xC5\\x9Eahin" and ( pe.signatures [ i ] . serial == "00:f5:f9:c8:f8:c3:3e:4c:e8:4d:d4:8f:cb:03:cc:b0:75" or pe.signatures [ i ] . serial == "f5:f9:c8:f8:c3:3e:4c:e8:4d:d4:8f:cb:03:cc:b0:75" ) and 1545004800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49592,13 +49592,13 @@ rule REVERSINGLABS_Cert_Blocklist_57Fc55239F21F139978609E323097132 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e71d575c-5a30-5158-80ee-3508cdaf5636"
+		id = "eb9c8793-ec97-5560-ae2c-effbe1ed269d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12610-L12626"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "030bb847e524e672ee382e0284ba3f027920f60c70bbd153d4b9cdd2669e6a99"
+		logic_hash = "v1_sha256_030bb847e524e672ee382e0284ba3f027920f60c70bbd153d4b9cdd2669e6a99"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49608,7 +49608,7 @@ rule REVERSINGLABS_Cert_Blocklist_57Fc55239F21F139978609E323097132 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aidem Media Limited" and pe.signatures[i].serial=="57:fc:55:23:9f:21:f1:39:97:86:09:e3:23:09:71:32" and 1501632000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Aidem Media Limited" and pe.signatures [ i ] . serial == "57:fc:55:23:9f:21:f1:39:97:86:09:e3:23:09:71:32" and 1501632000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49617,13 +49617,13 @@ rule REVERSINGLABS_Cert_Blocklist_Eeefec4308Abe63323600E1608F5E6F2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "265f70f4-f8cf-52cf-8d9b-ddfefb8a1b79"
+		id = "32582f0b-e953-58a0-962e-2bab71fdf07b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12628-L12646"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "71ab4bd7e85155bfbc1612941c5f15c409629b116258c38b79bd808512df006a"
+		logic_hash = "v1_sha256_71ab4bd7e85155bfbc1612941c5f15c409629b116258c38b79bd808512df006a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49633,7 +49633,7 @@ rule REVERSINGLABS_Cert_Blocklist_Eeefec4308Abe63323600E1608F5E6F2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "YUPITER-STROI, OOO" and (pe.signatures[i].serial=="00:ee:ef:ec:43:08:ab:e6:33:23:60:0e:16:08:f5:e6:f2" or pe.signatures[i].serial=="ee:ef:ec:43:08:ab:e6:33:23:60:0e:16:08:f5:e6:f2") and 1491177600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "YUPITER-STROI, OOO" and ( pe.signatures [ i ] . serial == "00:ee:ef:ec:43:08:ab:e6:33:23:60:0e:16:08:f5:e6:f2" or pe.signatures [ i ] . serial == "ee:ef:ec:43:08:ab:e6:33:23:60:0e:16:08:f5:e6:f2" ) and 1491177600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49642,13 +49642,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Ecd460Ce14Bd8Ef2926Da2Cd9A44176 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "94128695-0206-5c04-b792-34400f8ce890"
+		id = "d93de023-ffcf-5fb5-8e38-59795b7bcad8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12648-L12664"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "58fa244c125415ef7a3cf0feb79add4db7c84f94c23e5d27e840fb17c18d67ef"
+		logic_hash = "v1_sha256_58fa244c125415ef7a3cf0feb79add4db7c84f94c23e5d27e840fb17c18d67ef"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49658,7 +49658,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Ecd460Ce14Bd8Ef2926Da2Cd9A44176 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rabah Azrarak" and pe.signatures[i].serial=="0e:cd:46:0c:e1:4b:d8:ef:29:26:da:2c:d9:a4:41:76" and 1463035153<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rabah Azrarak" and pe.signatures [ i ] . serial == "0e:cd:46:0c:e1:4b:d8:ef:29:26:da:2c:d9:a4:41:76" and 1463035153 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49667,13 +49667,13 @@ rule REVERSINGLABS_Cert_Blocklist_5E75E997F3D70Bb8C182D56B25B7D836 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3578b97f-1d87-517a-8ea9-17606017e46a"
+		id = "3a2f659c-2f27-5684-b524-9a26dcd5925f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12666-L12682"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a2c6a57759fb0717951f83a32c00deeae82cad772b6cb7f60fa96232b6b82560"
+		logic_hash = "v1_sha256_a2c6a57759fb0717951f83a32c00deeae82cad772b6cb7f60fa96232b6b82560"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49683,7 +49683,7 @@ rule REVERSINGLABS_Cert_Blocklist_5E75E997F3D70Bb8C182D56B25B7D836 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Primetech Ltd." and pe.signatures[i].serial=="5e:75:e9:97:f3:d7:0b:b8:c1:82:d5:6b:25:b7:d8:36" and 1324252800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Primetech Ltd." and pe.signatures [ i ] . serial == "5e:75:e9:97:f3:d7:0b:b8:c1:82:d5:6b:25:b7:d8:36" and 1324252800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49692,13 +49692,13 @@ rule REVERSINGLABS_Cert_Blocklist_D5690D94F15315E143Db10Af35497Dc5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "324b2e2f-bad7-5ac4-864c-044d99fa01dc"
+		id = "fb55bfd6-6379-598a-aea9-d2a0d46c9b7d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12684-L12702"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4ac17d0f0e4ef2bb5f6cda8e7cb07a641d49c83465a0a80c46ff6e0e752d1847"
+		logic_hash = "v1_sha256_4ac17d0f0e4ef2bb5f6cda8e7cb07a641d49c83465a0a80c46ff6e0e752d1847"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49708,7 +49708,7 @@ rule REVERSINGLABS_Cert_Blocklist_D5690D94F15315E143Db10Af35497Dc5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PET SERVICES d.o.o." and (pe.signatures[i].serial=="00:d5:69:0d:94:f1:53:15:e1:43:db:10:af:35:49:7d:c5" or pe.signatures[i].serial=="d5:69:0d:94:f1:53:15:e1:43:db:10:af:35:49:7d:c5") and 1576195200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PET SERVICES d.o.o." and ( pe.signatures [ i ] . serial == "00:d5:69:0d:94:f1:53:15:e1:43:db:10:af:35:49:7d:c5" or pe.signatures [ i ] . serial == "d5:69:0d:94:f1:53:15:e1:43:db:10:af:35:49:7d:c5" ) and 1576195200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49717,13 +49717,13 @@ rule REVERSINGLABS_Cert_Blocklist_8223C74185Add0927246F5E33Ebac467 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dfe87130-7b2f-5f8a-8c2d-8653c2bd0cd3"
+		id = "55f82f94-9dc5-5797-b5b8-aa3ef760dc79"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12704-L12722"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f700b4f7cdfda9f678c3a5259d4293640c50567ec277c5b3db69756534e2007f"
+		logic_hash = "v1_sha256_f700b4f7cdfda9f678c3a5259d4293640c50567ec277c5b3db69756534e2007f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49733,7 +49733,7 @@ rule REVERSINGLABS_Cert_Blocklist_8223C74185Add0927246F5E33Ebac467 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TOV Virikton" and (pe.signatures[i].serial=="00:82:23:c7:41:85:ad:d0:92:72:46:f5:e3:3e:ba:c4:67" or pe.signatures[i].serial=="82:23:c7:41:85:ad:d0:92:72:46:f5:e3:3e:ba:c4:67") and 1463616000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TOV Virikton" and ( pe.signatures [ i ] . serial == "00:82:23:c7:41:85:ad:d0:92:72:46:f5:e3:3e:ba:c4:67" or pe.signatures [ i ] . serial == "82:23:c7:41:85:ad:d0:92:72:46:f5:e3:3e:ba:c4:67" ) and 1463616000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49742,13 +49742,13 @@ rule REVERSINGLABS_Cert_Blocklist_Dd9E9E1D7C573714E3F567C5380Ae6D0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "72745795-0261-5b7b-b25e-8220bced90ec"
+		id = "84370a16-5c72-5abd-9566-f477145ec696"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12724-L12742"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7bbcdb989d53bafbb2bdb694be72d4f7305323c01e8f1eafcb7cd889df165ff6"
+		logic_hash = "v1_sha256_7bbcdb989d53bafbb2bdb694be72d4f7305323c01e8f1eafcb7cd889df165ff6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49758,7 +49758,7 @@ rule REVERSINGLABS_Cert_Blocklist_Dd9E9E1D7C573714E3F567C5380Ae6D0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CREA&COM d.o.o." and (pe.signatures[i].serial=="00:dd:9e:9e:1d:7c:57:37:14:e3:f5:67:c5:38:0a:e6:d0" or pe.signatures[i].serial=="dd:9e:9e:1d:7c:57:37:14:e3:f5:67:c5:38:0a:e6:d0") and 1575849600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CREA&COM d.o.o." and ( pe.signatures [ i ] . serial == "00:dd:9e:9e:1d:7c:57:37:14:e3:f5:67:c5:38:0a:e6:d0" or pe.signatures [ i ] . serial == "dd:9e:9e:1d:7c:57:37:14:e3:f5:67:c5:38:0a:e6:d0" ) and 1575849600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49767,13 +49767,13 @@ rule REVERSINGLABS_Cert_Blocklist_3D5E71 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7180b20d-f367-5260-88cd-dd2a1269f89b"
+		id = "56e36b31-804c-5b6a-acc2-8ed9dc7fad76"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12744-L12760"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "aa73ac6569e4bb0084d7b148b2186ec2737a691a133319b21b666aa16bca9f2d"
+		logic_hash = "v1_sha256_aa73ac6569e4bb0084d7b148b2186ec2737a691a133319b21b666aa16bca9f2d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49783,7 +49783,7 @@ rule REVERSINGLABS_Cert_Blocklist_3D5E71 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OF.PL sp. z o.o." and pe.signatures[i].serial=="3d:5e:71" and 1066997730<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OF.PL sp. z o.o." and pe.signatures [ i ] . serial == "3d:5e:71" and 1066997730 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49792,13 +49792,13 @@ rule REVERSINGLABS_Cert_Blocklist_C33187Fe848A65E8484Ea492Cb2Cbb18 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fa05113a-a21e-5f21-aae3-b646e5b42dfb"
+		id = "a38f32ef-cde0-5b5f-814e-3d218f16ea4f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12762-L12780"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b66d67b74d73a143cb5301b232abd5f0f84f058223d4494b924a25dffb49037a"
+		logic_hash = "v1_sha256_b66d67b74d73a143cb5301b232abd5f0f84f058223d4494b924a25dffb49037a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49808,7 +49808,7 @@ rule REVERSINGLABS_Cert_Blocklist_C33187Fe848A65E8484Ea492Cb2Cbb18 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SELCUK GUNDOGDU" and (pe.signatures[i].serial=="00:c3:31:87:fe:84:8a:65:e8:48:4e:a4:92:cb:2c:bb:18" or pe.signatures[i].serial=="c3:31:87:fe:84:8a:65:e8:48:4e:a4:92:cb:2c:bb:18") and 1426204800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SELCUK GUNDOGDU" and ( pe.signatures [ i ] . serial == "00:c3:31:87:fe:84:8a:65:e8:48:4e:a4:92:cb:2c:bb:18" or pe.signatures [ i ] . serial == "c3:31:87:fe:84:8a:65:e8:48:4e:a4:92:cb:2c:bb:18" ) and 1426204800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49817,13 +49817,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Fc143Ba34Cabf1De7A4C7F8F4Cdad6D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "546692ed-2506-56ad-b678-e74b857380a3"
+		id = "5aeb7001-676d-5fac-92bf-9f7d9434e9c5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12782-L12798"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ffe25e4478a2245d4e5b330bb9300fb6cb48afb0fe3bd72bd62a589eeee3fe89"
+		logic_hash = "v1_sha256_ffe25e4478a2245d4e5b330bb9300fb6cb48afb0fe3bd72bd62a589eeee3fe89"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49833,7 +49833,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Fc143Ba34Cabf1De7A4C7F8F4Cdad6D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "World Telecom International Inc." and pe.signatures[i].serial=="6f:c1:43:ba:34:ca:bf:1d:e7:a4:c7:f8:f4:cd:ad:6d" and 1147046400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "World Telecom International Inc." and pe.signatures [ i ] . serial == "6f:c1:43:ba:34:ca:bf:1d:e7:a4:c7:f8:f4:cd:ad:6d" and 1147046400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49842,13 +49842,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Ac6268B2E431A2C1369346D175D0E30 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "12664460-19e1-5b73-8299-cfe19dffc0b4"
+		id = "5d8df872-076c-5ef0-b6da-cb22dcc29e6c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12800-L12816"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "27efaba9bd9cd116f640007c1e951bb77757efbe148b5f953e71d6621d7f16b2"
+		logic_hash = "v1_sha256_27efaba9bd9cd116f640007c1e951bb77757efbe148b5f953e71d6621d7f16b2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49858,7 +49858,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Ac6268B2E431A2C1369346D175D0E30 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Install Sync" and pe.signatures[i].serial=="6a:c6:26:8b:2e:43:1a:2c:13:69:34:6d:17:5d:0e:30" and 1436140800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Install Sync" and pe.signatures [ i ] . serial == "6a:c6:26:8b:2e:43:1a:2c:13:69:34:6d:17:5d:0e:30" and 1436140800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49867,13 +49867,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Fc4D9178B8Df2C19E269Ac6F43Dd708 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b336ff6c-d94e-5715-bb97-6b60cda90911"
+		id = "2d88ffcd-a1d0-5c73-a1e9-1321972e771f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12818-L12834"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "41dfe37b464d337268a8bb0e23124df7b50ab966038e8ad33bda81a4d86040ca"
+		logic_hash = "v1_sha256_41dfe37b464d337268a8bb0e23124df7b50ab966038e8ad33bda81a4d86040ca"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49883,7 +49883,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Fc4D9178B8Df2C19E269Ac6F43Dd708 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PK Partnership, OOO" and pe.signatures[i].serial=="0f:c4:d9:17:8b:8d:f2:c1:9e:26:9a:c6:f4:3d:d7:08" and 1466553600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PK Partnership, OOO" and pe.signatures [ i ] . serial == "0f:c4:d9:17:8b:8d:f2:c1:9e:26:9a:c6:f4:3d:d7:08" and 1466553600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49892,13 +49892,13 @@ rule REVERSINGLABS_Cert_Blocklist_E01407871E2146C9Baab1Ae7Ab8Ab172 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "229772ae-68a2-566b-bf61-988cb41d7d8f"
+		id = "25ed88d0-d7be-5968-bb84-dc02d917940d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12836-L12854"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1801e7f15bd5f916fc08d263a845d296d334ca9de1040008f619719c1b5c0a3b"
+		logic_hash = "v1_sha256_1801e7f15bd5f916fc08d263a845d296d334ca9de1040008f619719c1b5c0a3b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49908,7 +49908,7 @@ rule REVERSINGLABS_Cert_Blocklist_E01407871E2146C9Baab1Ae7Ab8Ab172 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TOV Intalev Ukraina" and (pe.signatures[i].serial=="00:e0:14:07:87:1e:21:46:c9:ba:ab:1a:e7:ab:8a:b1:72" or pe.signatures[i].serial=="e0:14:07:87:1e:21:46:c9:ba:ab:1a:e7:ab:8a:b1:72") and 1464220800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TOV Intalev Ukraina" and ( pe.signatures [ i ] . serial == "00:e0:14:07:87:1e:21:46:c9:ba:ab:1a:e7:ab:8a:b1:72" or pe.signatures [ i ] . serial == "e0:14:07:87:1e:21:46:c9:ba:ab:1a:e7:ab:8a:b1:72" ) and 1464220800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49917,13 +49917,13 @@ rule REVERSINGLABS_Cert_Blocklist_Effc6D19D6Fc85872E4E5B3Ccee6D301 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "56114e31-2e9b-5d16-8435-708bbb2687cc"
+		id = "d3dd893b-56cd-55c8-93d9-def495cabf5b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12856-L12874"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a746c4193f1264cb96eae0ea85c2c76b5caf3b72ca950f76af426b4d68d210b3"
+		logic_hash = "v1_sha256_a746c4193f1264cb96eae0ea85c2c76b5caf3b72ca950f76af426b4d68d210b3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49933,7 +49933,7 @@ rule REVERSINGLABS_Cert_Blocklist_Effc6D19D6Fc85872E4E5B3Ccee6D301 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "C\\xC3\\x93IR IP LIMITED" and (pe.signatures[i].serial=="00:ef:fc:6d:19:d6:fc:85:87:2e:4e:5b:3c:ce:e6:d3:01" or pe.signatures[i].serial=="ef:fc:6d:19:d6:fc:85:87:2e:4e:5b:3c:ce:e6:d3:01") and 1572307200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "C\\xC3\\x93IR IP LIMITED" and ( pe.signatures [ i ] . serial == "00:ef:fc:6d:19:d6:fc:85:87:2e:4e:5b:3c:ce:e6:d3:01" or pe.signatures [ i ] . serial == "ef:fc:6d:19:d6:fc:85:87:2e:4e:5b:3c:ce:e6:d3:01" ) and 1572307200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49942,13 +49942,13 @@ rule REVERSINGLABS_Cert_Blocklist_2F4A25D52B16Eb4C9Dfe71Ebbd8121Bb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1afd5d2b-fd6d-58ca-b966-788d465cd0ed"
+		id = "3b1c49b3-6dc3-5dc2-9c3c-8c36a9c9279e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12876-L12892"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7b237ae0574afeafcc05f71512c09d3170edbee20e512a1b0af5b431923dc25c"
+		logic_hash = "v1_sha256_7b237ae0574afeafcc05f71512c09d3170edbee20e512a1b0af5b431923dc25c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49958,7 +49958,7 @@ rule REVERSINGLABS_Cert_Blocklist_2F4A25D52B16Eb4C9Dfe71Ebbd8121Bb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Blist LLC" and pe.signatures[i].serial=="2f:4a:25:d5:2b:16:eb:4c:9d:fe:71:eb:bd:81:21:bb" and 1629763200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Blist LLC" and pe.signatures [ i ] . serial == "2f:4a:25:d5:2b:16:eb:4c:9d:fe:71:eb:bd:81:21:bb" and 1629763200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49967,13 +49967,13 @@ rule REVERSINGLABS_Cert_Blocklist_6889Aab6202Bcc5F11Caedf4D04F435B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d4499a1d-aa8d-5056-ad91-439f27f00c33"
+		id = "d448e02e-84e7-5894-a5f8-2df9068a8595"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12894-L12910"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b2261ed8001929be8f80f73cc0c5076138f4794c73cbffd63773da5fc44639a8"
+		logic_hash = "v1_sha256_b2261ed8001929be8f80f73cc0c5076138f4794c73cbffd63773da5fc44639a8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -49983,7 +49983,7 @@ rule REVERSINGLABS_Cert_Blocklist_6889Aab6202Bcc5F11Caedf4D04F435B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "C4DL Media" and pe.signatures[i].serial=="68:89:aa:b6:20:2b:cc:5f:11:ca:ed:f4:d0:4f:43:5b" and 1231891200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "C4DL Media" and pe.signatures [ i ] . serial == "68:89:aa:b6:20:2b:cc:5f:11:ca:ed:f4:d0:4f:43:5b" and 1231891200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -49992,13 +49992,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Be63083Fbb1787B445Da97583721419 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6839595d-b645-5963-bd96-a668bfdd667f"
+		id = "98b2800f-0758-54ce-8fa7-03708d35d101"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12912-L12928"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f39f5a632544bc01c3b4c9e2f2dd33f7109c44375f54011a34181e10da79debc"
+		logic_hash = "v1_sha256_f39f5a632544bc01c3b4c9e2f2dd33f7109c44375f54011a34181e10da79debc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50008,7 +50008,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Be63083Fbb1787B445Da97583721419 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\"SMART GREY\" LLC" and pe.signatures[i].serial=="3b:e6:30:83:fb:b1:78:7b:44:5d:a9:75:83:72:14:19" and 1493942400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\"SMART GREY\" LLC" and pe.signatures [ i ] . serial == "3b:e6:30:83:fb:b1:78:7b:44:5d:a9:75:83:72:14:19" and 1493942400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50017,13 +50017,13 @@ rule REVERSINGLABS_Cert_Blocklist_6E2D3449272B6B96B8B9F728E87580D5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6975acb9-3b37-51f5-8b4d-0d1a090a18e2"
+		id = "85a0a9bd-9a1e-536a-8cc0-a78217eebbaa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12930-L12946"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0155a8c71bf8426bbb980798772b04c145df5b8c4b60ff1a610a1236a47547ef"
+		logic_hash = "v1_sha256_0155a8c71bf8426bbb980798772b04c145df5b8c4b60ff1a610a1236a47547ef"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50033,7 +50033,7 @@ rule REVERSINGLABS_Cert_Blocklist_6E2D3449272B6B96B8B9F728E87580D5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RADIANT, OOO" and pe.signatures[i].serial=="6e:2d:34:49:27:2b:6b:96:b8:b9:f7:28:e8:75:80:d5" and 1421107200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RADIANT, OOO" and pe.signatures [ i ] . serial == "6e:2d:34:49:27:2b:6b:96:b8:b9:f7:28:e8:75:80:d5" and 1421107200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50042,13 +50042,13 @@ rule REVERSINGLABS_Cert_Blocklist_268C0D7028A154Ac3B6349C5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0e18d9ef-e861-5583-a2a3-5f54fae8d813"
+		id = "371c49b7-20f0-5478-9432-1bf04d26abb3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12948-L12964"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8311b36f008e31b7ac27b439fa46da4c90ab4be6c7c89426f8e1939963bc3d7d"
+		logic_hash = "v1_sha256_8311b36f008e31b7ac27b439fa46da4c90ab4be6c7c89426f8e1939963bc3d7d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50058,7 +50058,7 @@ rule REVERSINGLABS_Cert_Blocklist_268C0D7028A154Ac3B6349C5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="26:8c:0d:70:28:a1:54:ac:3b:63:49:c5" and 1474266712<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "26:8c:0d:70:28:a1:54:ac:3b:63:49:c5" and 1474266712 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50067,13 +50067,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Daa8D629Cc0410A9482E62A0F8Bf8Fc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "71e627d9-0892-5501-8189-26eae36b7965"
+		id = "1de1aaa0-4f9f-5050-abb6-c99bd691b37e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12966-L12982"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cfb2631bc1832f65fb9d77c812bf2a1e05121e825254bd57ae8b21e7b10b2344"
+		logic_hash = "v1_sha256_cfb2631bc1832f65fb9d77c812bf2a1e05121e825254bd57ae8b21e7b10b2344"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50083,7 +50083,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Daa8D629Cc0410A9482E62A0F8Bf8Fc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DON'T MISS A WORD LIMITED" and pe.signatures[i].serial=="2d:aa:8d:62:9c:c0:41:0a:94:82:e6:2a:0f:8b:f8:fc" and 1543449600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DON'T MISS A WORD LIMITED" and pe.signatures [ i ] . serial == "2d:aa:8d:62:9c:c0:41:0a:94:82:e6:2a:0f:8b:f8:fc" and 1543449600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50092,13 +50092,13 @@ rule REVERSINGLABS_Cert_Blocklist_9A727E200Ea76570 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d133dac3-3959-50f0-913e-b279ca6a1c2c"
+		id = "949fdd92-afea-592a-95b1-84e10098d532"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L12984-L13002"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "337dc486f2bdca1f7682887d5e5c0f82961850a8fd9c9a20b9a43a75334070d8"
+		logic_hash = "v1_sha256_337dc486f2bdca1f7682887d5e5c0f82961850a8fd9c9a20b9a43a75334070d8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50108,7 +50108,7 @@ rule REVERSINGLABS_Cert_Blocklist_9A727E200Ea76570 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Alexsandro Da Rosa - ME" and (pe.signatures[i].serial=="00:9a:72:7e:20:0e:a7:65:70" or pe.signatures[i].serial=="9a:72:7e:20:0e:a7:65:70") and 1539056530<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Alexsandro Da Rosa - ME" and ( pe.signatures [ i ] . serial == "00:9a:72:7e:20:0e:a7:65:70" or pe.signatures [ i ] . serial == "9a:72:7e:20:0e:a7:65:70" ) and 1539056530 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50117,13 +50117,13 @@ rule REVERSINGLABS_Cert_Blocklist_0954A3C876Df9262Cde5817F9870F0C6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "89f3a334-cd2f-51b9-83b2-2baca3c59ba5"
+		id = "519b26fa-8b21-542d-b0c0-d3664cebf0ac"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13004-L13020"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "164b064a9df31d4a122236dfee7b713417a44d47a7f304b2bf55686a7f038feb"
+		logic_hash = "v1_sha256_164b064a9df31d4a122236dfee7b713417a44d47a7f304b2bf55686a7f038feb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50133,7 +50133,7 @@ rule REVERSINGLABS_Cert_Blocklist_0954A3C876Df9262Cde5817F9870F0C6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dialer Access" and pe.signatures[i].serial=="09:54:a3:c8:76:df:92:62:cd:e5:81:7f:98:70:f0:c6" and 1160438400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dialer Access" and pe.signatures [ i ] . serial == "09:54:a3:c8:76:df:92:62:cd:e5:81:7f:98:70:f0:c6" and 1160438400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50142,13 +50142,13 @@ rule REVERSINGLABS_Cert_Blocklist_3C30930E53Bb026F9A5D7440155F7118 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ad7d8be0-ecb1-508f-bfce-7a5cecfd4e2f"
+		id = "26789d7f-a24f-58be-878c-d6befe4cc8f2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13022-L13038"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "260a58669043d21ee0ffccbdee95c9d04ef338497685d42f1951660f658a164d"
+		logic_hash = "v1_sha256_260a58669043d21ee0ffccbdee95c9d04ef338497685d42f1951660f658a164d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50158,7 +50158,7 @@ rule REVERSINGLABS_Cert_Blocklist_3C30930E53Bb026F9A5D7440155F7118 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CPM Media, Ltd." and pe.signatures[i].serial=="3c:30:93:0e:53:bb:02:6f:9a:5d:74:40:15:5f:71:18" and 1064534400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CPM Media, Ltd." and pe.signatures [ i ] . serial == "3c:30:93:0e:53:bb:02:6f:9a:5d:74:40:15:5f:71:18" and 1064534400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50167,13 +50167,13 @@ rule REVERSINGLABS_Cert_Blocklist_432Eefc0D4Dc0326Eb277A518Cc4310A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "eeccb477-0bf7-5b79-94df-710e6e0db78f"
+		id = "86b9ef28-588c-5926-9c00-3402963499e9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13040-L13056"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d5a0b7f19f66f18b5ef1c548276b675ead74fed6be94310c303bfad6c85f18be"
+		logic_hash = "v1_sha256_d5a0b7f19f66f18b5ef1c548276b675ead74fed6be94310c303bfad6c85f18be"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50183,7 +50183,7 @@ rule REVERSINGLABS_Cert_Blocklist_432Eefc0D4Dc0326Eb277A518Cc4310A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures[i].serial=="43:2e:ef:c0:d4:dc:03:26:eb:27:7a:51:8c:c4:31:0a" and 1466121600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures [ i ] . serial == "43:2e:ef:c0:d4:dc:03:26:eb:27:7a:51:8c:c4:31:0a" and 1466121600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50192,13 +50192,13 @@ rule REVERSINGLABS_Cert_Blocklist_470D6Ce21A6940320261F09E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "00b92b5d-59e3-5aae-954d-a90bd8cc1370"
+		id = "974e28a6-7910-5900-a626-58356be15626"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13058-L13074"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cae1d381bf2018a0ce56feb245d01f2bfea55b67894264d32d78dbb41873c792"
+		logic_hash = "v1_sha256_cae1d381bf2018a0ce56feb245d01f2bfea55b67894264d32d78dbb41873c792"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50208,7 +50208,7 @@ rule REVERSINGLABS_Cert_Blocklist_470D6Ce21A6940320261F09E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="47:0d:6c:e2:1a:69:40:32:02:61:f0:9e" and 1474523038<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "47:0d:6c:e2:1a:69:40:32:02:61:f0:9e" and 1474523038 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50217,13 +50217,13 @@ rule REVERSINGLABS_Cert_Blocklist_7E6Bc7E5A49E2C28E6F5D042 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a7b815d9-e247-5de1-9bcb-96294b3b91c0"
+		id = "07183e92-ea19-579e-839f-b042c76c625c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13076-L13092"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f378c490ff4f32fc095c822f75abac44a8d94327404cd97546c63e7441e07632"
+		logic_hash = "v1_sha256_f378c490ff4f32fc095c822f75abac44a8d94327404cd97546c63e7441e07632"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50233,7 +50233,7 @@ rule REVERSINGLABS_Cert_Blocklist_7E6Bc7E5A49E2C28E6F5D042 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shang Hai Jian Ji Wang Luo Ke Ji You Xian Gong Si" and pe.signatures[i].serial=="7e:6b:c7:e5:a4:9e:2c:28:e6:f5:d0:42" and 1560995284<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shang Hai Jian Ji Wang Luo Ke Ji You Xian Gong Si" and pe.signatures [ i ] . serial == "7e:6b:c7:e5:a4:9e:2c:28:e6:f5:d0:42" and 1560995284 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50242,13 +50242,13 @@ rule REVERSINGLABS_Cert_Blocklist_4C5020899147C850196C4Ebf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8ac60604-6548-5f11-bf89-ec7e927b20f7"
+		id = "0880fe8f-5e2f-5404-b9b6-78207e3bdc05"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13094-L13110"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "112e834a24c50d639f8607740faa609f1a36539058357544e5dbcddf841f3116"
+		logic_hash = "v1_sha256_112e834a24c50d639f8607740faa609f1a36539058357544e5dbcddf841f3116"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50258,7 +50258,7 @@ rule REVERSINGLABS_Cert_Blocklist_4C5020899147C850196C4Ebf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="4c:50:20:89:91:47:c8:50:19:6c:4e:bf" and 1476693792<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "4c:50:20:89:91:47:c8:50:19:6c:4e:bf" and 1476693792 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50267,13 +50267,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Efcf7Adc21F070E590D49Ddb8081397 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "df467418-9d57-5ad0-b396-2ef519a22989"
+		id = "096ea645-4c04-585d-983f-b42884846604"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13112-L13128"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d60a5bbd50484d620ab60cfd40840abc541c2b7bc1005a9076b69ddd1b938652"
+		logic_hash = "v1_sha256_d60a5bbd50484d620ab60cfd40840abc541c2b7bc1005a9076b69ddd1b938652"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50283,7 +50283,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Efcf7Adc21F070E590D49Ddb8081397 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ding Ruan" and pe.signatures[i].serial=="4e:fc:f7:ad:c2:1f:07:0e:59:0d:49:dd:b8:08:13:97" and 1476921600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ding Ruan" and pe.signatures [ i ] . serial == "4e:fc:f7:ad:c2:1f:07:0e:59:0d:49:dd:b8:08:13:97" and 1476921600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50292,13 +50292,13 @@ rule REVERSINGLABS_Cert_Blocklist_Cbd37C0A651913Ee25A6860D7D5Ccdf2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e56205d6-9f02-5a8a-8dd3-b8c323fba4bf"
+		id = "0ec676fc-c6e2-5f8d-9ad0-347159dc01ed"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13130-L13148"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "77cc439aea6eaa5a835b6b1aa50904c1df0d5379228e424ab2d68a3cb654834c"
+		logic_hash = "v1_sha256_77cc439aea6eaa5a835b6b1aa50904c1df0d5379228e424ab2d68a3cb654834c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50308,7 +50308,7 @@ rule REVERSINGLABS_Cert_Blocklist_Cbd37C0A651913Ee25A6860D7D5Ccdf2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Amma" and (pe.signatures[i].serial=="00:cb:d3:7c:0a:65:19:13:ee:25:a6:86:0d:7d:5c:cd:f2" or pe.signatures[i].serial=="cb:d3:7c:0a:65:19:13:ee:25:a6:86:0d:7d:5c:cd:f2") and 1431734400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Amma" and ( pe.signatures [ i ] . serial == "00:cb:d3:7c:0a:65:19:13:ee:25:a6:86:0d:7d:5c:cd:f2" or pe.signatures [ i ] . serial == "cb:d3:7c:0a:65:19:13:ee:25:a6:86:0d:7d:5c:cd:f2" ) and 1431734400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50317,13 +50317,13 @@ rule REVERSINGLABS_Cert_Blocklist_5Fe0Ad6B03C57Ab67A352159004Ca3Db : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d1cf11fc-eb30-54fc-9e34-91ad0c67e694"
+		id = "5d5430c2-503f-5e6f-9259-e55d36a7a4fe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13150-L13166"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6f2489421f2effa2089b744f7e137818935fe2339d9216a42686012c51da677b"
+		logic_hash = "v1_sha256_6f2489421f2effa2089b744f7e137818935fe2339d9216a42686012c51da677b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50333,7 +50333,7 @@ rule REVERSINGLABS_Cert_Blocklist_5Fe0Ad6B03C57Ab67A352159004Ca3Db : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SpectorSoft Corp." and pe.signatures[i].serial=="5f:e0:ad:6b:03:c5:7a:b6:7a:35:21:59:00:4c:a3:db" and 1402272000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SpectorSoft Corp." and pe.signatures [ i ] . serial == "5f:e0:ad:6b:03:c5:7a:b6:7a:35:21:59:00:4c:a3:db" and 1402272000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50342,13 +50342,13 @@ rule REVERSINGLABS_Cert_Blocklist_642Ad8E5Ef8B3Ac767F0D5C1A999Bdaa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d29e2342-2d38-5939-aa3f-4506fb36c74a"
+		id = "7fb35d65-d182-5f7c-b341-3d6639cf7821"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13168-L13184"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d42d40ca381b99b68a3384cecf585aab2acca66d4e13503d337b1605d587d0b5"
+		logic_hash = "v1_sha256_d42d40ca381b99b68a3384cecf585aab2acca66d4e13503d337b1605d587d0b5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50358,7 +50358,7 @@ rule REVERSINGLABS_Cert_Blocklist_642Ad8E5Ef8B3Ac767F0D5C1A999Bdaa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Itgms Ltd" and pe.signatures[i].serial=="64:2a:d8:e5:ef:8b:3a:c7:67:f0:d5:c1:a9:99:bd:aa" and 1447804800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Itgms Ltd" and pe.signatures [ i ] . serial == "64:2a:d8:e5:ef:8b:3a:c7:67:f0:d5:c1:a9:99:bd:aa" and 1447804800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50367,13 +50367,13 @@ rule REVERSINGLABS_Cert_Blocklist_5333D3079D8Afda715703775E1389991 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4db299c6-5be9-5900-a944-07a0a41920a4"
+		id = "39d90d8b-4515-5c4e-89b0-38e58436eabe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13186-L13202"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "98bd9d35c4e196a11943826115ab495833f7ef1d95f9736cc24255d6dd4fd21c"
+		logic_hash = "v1_sha256_98bd9d35c4e196a11943826115ab495833f7ef1d95f9736cc24255d6dd4fd21c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50383,7 +50383,7 @@ rule REVERSINGLABS_Cert_Blocklist_5333D3079D8Afda715703775E1389991 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trambambon LLC" and pe.signatures[i].serial=="53:33:d3:07:9d:8a:fd:a7:15:70:37:75:e1:38:99:91" and 1239148800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Trambambon LLC" and pe.signatures [ i ] . serial == "53:33:d3:07:9d:8a:fd:a7:15:70:37:75:e1:38:99:91" and 1239148800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50392,13 +50392,13 @@ rule REVERSINGLABS_Cert_Blocklist_139A7Ee1F1A7735C151089755Df5D373 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "eaab67a1-ed7a-58f3-afb3-3637c3b72020"
+		id = "dee53db5-9ea8-5b75-8fb7-f32e5c4710c4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13204-L13220"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "86072fef7d1488dc257c3ca8fbb99620ec06f8ecb671b4e20d09d0ce6cc8601d"
+		logic_hash = "v1_sha256_86072fef7d1488dc257c3ca8fbb99620ec06f8ecb671b4e20d09d0ce6cc8601d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50408,7 +50408,7 @@ rule REVERSINGLABS_Cert_Blocklist_139A7Ee1F1A7735C151089755Df5D373 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yongli Li" and pe.signatures[i].serial=="13:9a:7e:e1:f1:a7:73:5c:15:10:89:75:5d:f5:d3:73" and 1476057600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yongli Li" and pe.signatures [ i ] . serial == "13:9a:7e:e1:f1:a7:73:5c:15:10:89:75:5d:f5:d3:73" and 1476057600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50417,13 +50417,13 @@ rule REVERSINGLABS_Cert_Blocklist_74Dbe83082E1B3Dfa29F9C24 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dbb75cf2-1b48-52f1-8d06-e35d48c4fea4"
+		id = "cac2c9d2-d68f-5ff6-865d-7461bbe537af"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13222-L13238"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1fdf6471d0b869df1a8630108cdaf1cc97d33e91d4726073913cdc54c7cf0042"
+		logic_hash = "v1_sha256_1fdf6471d0b869df1a8630108cdaf1cc97d33e91d4726073913cdc54c7cf0042"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50433,7 +50433,7 @@ rule REVERSINGLABS_Cert_Blocklist_74Dbe83082E1B3Dfa29F9C24 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EVANGEL TECHNOLOGY(HK) LIMITED" and pe.signatures[i].serial=="74:db:e8:30:82:e1:b3:df:a2:9f:9c:24" and 1468817578<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EVANGEL TECHNOLOGY(HK) LIMITED" and pe.signatures [ i ] . serial == "74:db:e8:30:82:e1:b3:df:a2:9f:9c:24" and 1468817578 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50442,13 +50442,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A466553A6391Aafd181B400266C7B18 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ef8ff250-840f-5b55-b0c7-85ca54aadc59"
+		id = "6c0cb8c7-2a05-592d-8410-b7ae141640db"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13240-L13256"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cb21e5759887904d6a38cd1b363610ebc0bfd9a357050c602210468992815cbe"
+		logic_hash = "v1_sha256_cb21e5759887904d6a38cd1b363610ebc0bfd9a357050c602210468992815cbe"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50458,7 +50458,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A466553A6391Aafd181B400266C7B18 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PhaseQ Limited" and pe.signatures[i].serial=="0a:46:65:53:a6:39:1a:af:d1:81:b4:00:26:6c:7b:18" and 1555545600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PhaseQ Limited" and pe.signatures [ i ] . serial == "0a:46:65:53:a6:39:1a:af:d1:81:b4:00:26:6c:7b:18" and 1555545600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50467,13 +50467,13 @@ rule REVERSINGLABS_Cert_Blocklist_0D3Dec8794Fa7228D1Ee40Eeb8187149 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "54e9ec00-d054-521b-b60b-81efe3a8ce12"
+		id = "8f66a709-bc85-5f92-b4aa-44aaccc51eb6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13258-L13274"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "20084dc0b069d65755f859f5aef4be5599d1f066ba006199d3ce803b0d8f041e"
+		logic_hash = "v1_sha256_20084dc0b069d65755f859f5aef4be5599d1f066ba006199d3ce803b0d8f041e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50483,7 +50483,7 @@ rule REVERSINGLABS_Cert_Blocklist_0D3Dec8794Fa7228D1Ee40Eeb8187149 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Financial Security Institute, Inc." and pe.signatures[i].serial=="0d:3d:ec:87:94:fa:72:28:d1:ee:40:ee:b8:18:71:49" and 1582675200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Financial Security Institute, Inc." and pe.signatures [ i ] . serial == "0d:3d:ec:87:94:fa:72:28:d1:ee:40:ee:b8:18:71:49" and 1582675200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50492,13 +50492,13 @@ rule REVERSINGLABS_Cert_Blocklist_24Af70B5D17A63Ad053E5821 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "034228b3-1864-5a76-ad9d-531778be10ec"
+		id = "f5c8a95e-e126-5a86-bf4f-b7b01c886d6a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13276-L13292"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d78f709067c83169484d9dd6e1dd8a88852362da028551d4e55e5703a22e04a7"
+		logic_hash = "v1_sha256_d78f709067c83169484d9dd6e1dd8a88852362da028551d4e55e5703a22e04a7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50508,7 +50508,7 @@ rule REVERSINGLABS_Cert_Blocklist_24Af70B5D17A63Ad053E5821 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="24:af:70:b5:d1:7a:63:ad:05:3e:58:21" and 1474179615<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "24:af:70:b5:d1:7a:63:ad:05:3e:58:21" and 1474179615 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50517,13 +50517,13 @@ rule REVERSINGLABS_Cert_Blocklist_402E9Fcba61E5Eaf9C0C7B3Bfd6259D9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a24e1201-4a90-5d0f-ac19-4d88a4e4cfe5"
+		id = "21e71b9e-2db9-5c9d-8b41-a11ee9fb9c19"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13294-L13310"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1bfc2610745a98ebcf0f77504815d9d1c448697fbe407d6c2e075219b401de50"
+		logic_hash = "v1_sha256_1bfc2610745a98ebcf0f77504815d9d1c448697fbe407d6c2e075219b401de50"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50533,7 +50533,7 @@ rule REVERSINGLABS_Cert_Blocklist_402E9Fcba61E5Eaf9C0C7B3Bfd6259D9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yongli Li" and pe.signatures[i].serial=="40:2e:9f:cb:a6:1e:5e:af:9c:0c:7b:3b:fd:62:59:d9" and 1477440000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yongli Li" and pe.signatures [ i ] . serial == "40:2e:9f:cb:a6:1e:5e:af:9c:0c:7b:3b:fd:62:59:d9" and 1477440000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50542,13 +50542,13 @@ rule REVERSINGLABS_Cert_Blocklist_2C84F9136059E96134F8766670Eacd52 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "af7eb5ff-570f-5886-b550-3d327d05fabe"
+		id = "1a4ebffa-cfaf-525c-ae0e-e021901701d8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13312-L13328"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d6778630dcc3e4fe2816e6dee1b823e616f53de8a924057495c7c252948a71b4"
+		logic_hash = "v1_sha256_d6778630dcc3e4fe2816e6dee1b823e616f53de8a924057495c7c252948a71b4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50558,7 +50558,7 @@ rule REVERSINGLABS_Cert_Blocklist_2C84F9136059E96134F8766670Eacd52 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, DIEGO MANUEL RODRIGUEZ" and pe.signatures[i].serial=="2c:84:f9:13:60:59:e9:61:34:f8:76:66:70:ea:cd:52" and 1442215311<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, DIEGO MANUEL RODRIGUEZ" and pe.signatures [ i ] . serial == "2c:84:f9:13:60:59:e9:61:34:f8:76:66:70:ea:cd:52" and 1442215311 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50567,13 +50567,13 @@ rule REVERSINGLABS_Cert_Blocklist_6716A9C195987D5Cfe53A094779461E7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fbd05f8b-3289-565c-a5f4-a1514d06ae37"
+		id = "1b545bd5-678a-505b-808e-ed5dd1b23940"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13330-L13346"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "648fd70432a791b3e589f5eda1b1510045b465623914a9762ff3dfb4a3e022f8"
+		logic_hash = "v1_sha256_648fd70432a791b3e589f5eda1b1510045b465623914a9762ff3dfb4a3e022f8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50583,7 +50583,7 @@ rule REVERSINGLABS_Cert_Blocklist_6716A9C195987D5Cfe53A094779461E7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Inter Technologies Ltd." and pe.signatures[i].serial=="67:16:a9:c1:95:98:7d:5c:fe:53:a0:94:77:94:61:e7" and 1169424000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Inter Technologies Ltd." and pe.signatures [ i ] . serial == "67:16:a9:c1:95:98:7d:5c:fe:53:a0:94:77:94:61:e7" and 1169424000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50592,13 +50592,13 @@ rule REVERSINGLABS_Cert_Blocklist_876C00Bd665Df98B35554F67A5C1C32A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "830af0ac-fb01-5c6a-a7a3-2cf5c9d016fc"
+		id = "19d10d6d-7238-5064-a737-94be5f56433b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13348-L13366"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "90bde1313db78d4166e8c87e7e4111c576880922b1c983f3a842ea030d38a0da"
+		logic_hash = "v1_sha256_90bde1313db78d4166e8c87e7e4111c576880922b1c983f3a842ea030d38a0da"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50608,7 +50608,7 @@ rule REVERSINGLABS_Cert_Blocklist_876C00Bd665Df98B35554F67A5C1C32A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lossera-M, OOO" and (pe.signatures[i].serial=="00:87:6c:00:bd:66:5d:f9:8b:35:55:4f:67:a5:c1:c3:2a" or pe.signatures[i].serial=="87:6c:00:bd:66:5d:f9:8b:35:55:4f:67:a5:c1:c3:2a") and 1493078400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Lossera-M, OOO" and ( pe.signatures [ i ] . serial == "00:87:6c:00:bd:66:5d:f9:8b:35:55:4f:67:a5:c1:c3:2a" or pe.signatures [ i ] . serial == "87:6c:00:bd:66:5d:f9:8b:35:55:4f:67:a5:c1:c3:2a" ) and 1493078400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50617,13 +50617,13 @@ rule REVERSINGLABS_Cert_Blocklist_4B093Cb60D4B992266F550934A4Ac7D0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c459c3ac-205c-5c13-959d-c6b40f81222f"
+		id = "d4a959a9-7bc9-5125-898b-9678625b8fc0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13368-L13384"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4b634bc706638d72f2d036d41cf092cac538e930d7d407eebc225b482fd64f51"
+		logic_hash = "v1_sha256_4b634bc706638d72f2d036d41cf092cac538e930d7d407eebc225b482fd64f51"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50633,7 +50633,7 @@ rule REVERSINGLABS_Cert_Blocklist_4B093Cb60D4B992266F550934A4Ac7D0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LCB SISTEMAS LTDA ME" and pe.signatures[i].serial=="4b:09:3c:b6:0d:4b:99:22:66:f5:50:93:4a:4a:c7:d0" and 1478649600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LCB SISTEMAS LTDA ME" and pe.signatures [ i ] . serial == "4b:09:3c:b6:0d:4b:99:22:66:f5:50:93:4a:4a:c7:d0" and 1478649600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50642,13 +50642,13 @@ rule REVERSINGLABS_Cert_Blocklist_2050B54146B011Ed30F60F61 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0db2d42d-bdc3-50bc-b360-a39ccec4df41"
+		id = "3dddd025-25a8-546c-bd5d-aae9bc933664"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13386-L13402"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "74749317fcefcdb698046a6f42c6c6e05cc1eab1370b3b1fd7d025f49de4a032"
+		logic_hash = "v1_sha256_74749317fcefcdb698046a6f42c6c6e05cc1eab1370b3b1fd7d025f49de4a032"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50658,7 +50658,7 @@ rule REVERSINGLABS_Cert_Blocklist_2050B54146B011Ed30F60F61 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="20:50:b5:41:46:b0:11:ed:30:f6:0f:61" and 1476773926<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "20:50:b5:41:46:b0:11:ed:30:f6:0f:61" and 1476773926 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50667,13 +50667,13 @@ rule REVERSINGLABS_Cert_Blocklist_73E2F34C9C2435F29Bbe0A3C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "284c206f-8a0c-5bb6-8f28-d8e5e60efe3e"
+		id = "333783a1-74b4-560c-b8f0-05efbde714f8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13404-L13420"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "503429e737e8bdad735cf88e2bb2877d1f52b2c38be101a7a129c02db608a347"
+		logic_hash = "v1_sha256_503429e737e8bdad735cf88e2bb2877d1f52b2c38be101a7a129c02db608a347"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50683,7 +50683,7 @@ rule REVERSINGLABS_Cert_Blocklist_73E2F34C9C2435F29Bbe0A3C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="73:e2:f3:4c:9c:24:35:f2:9b:be:0a:3c" and 1480312984<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "73:e2:f3:4c:9c:24:35:f2:9b:be:0a:3c" and 1480312984 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50692,13 +50692,13 @@ rule REVERSINGLABS_Cert_Blocklist_68C457D7495D2A8D0D7B9042836135C2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a8ed2e72-d94e-5141-8ceb-181459a729ad"
+		id = "308e9d36-ccf1-5af2-9c24-664172583daa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13422-L13438"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3eb63f75f258eec611fa4288302f0ce5e47149ca876265a4a4b65dc33313aaa6"
+		logic_hash = "v1_sha256_3eb63f75f258eec611fa4288302f0ce5e47149ca876265a4a4b65dc33313aaa6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50708,7 +50708,7 @@ rule REVERSINGLABS_Cert_Blocklist_68C457D7495D2A8D0D7B9042836135C2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Zhang" and pe.signatures[i].serial=="68:c4:57:d7:49:5d:2a:8d:0d:7b:90:42:83:61:35:c2" and 1476921600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Zhang" and pe.signatures [ i ] . serial == "68:c4:57:d7:49:5d:2a:8d:0d:7b:90:42:83:61:35:c2" and 1476921600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50717,13 +50717,13 @@ rule REVERSINGLABS_Cert_Blocklist_6B72Ca367D40Fbef16E73E6Eba6A9A59 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e1cf9568-9a6a-58cb-81a4-25063ccc1ac7"
+		id = "250ec3fa-977b-53fa-a77a-ad9be23bf02d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13440-L13456"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2b20c16dafcd891c36b28b36093cd3ad3a15f3795f0f2adda61fb0db2835d02d"
+		logic_hash = "v1_sha256_2b20c16dafcd891c36b28b36093cd3ad3a15f3795f0f2adda61fb0db2835d02d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50733,7 +50733,7 @@ rule REVERSINGLABS_Cert_Blocklist_6B72Ca367D40Fbef16E73E6Eba6A9A59 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="6b:72:ca:36:7d:40:fb:ef:16:e7:3e:6e:ba:6a:9a:59" and 1476748800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "6b:72:ca:36:7d:40:fb:ef:16:e7:3e:6e:ba:6a:9a:59" and 1476748800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50742,13 +50742,13 @@ rule REVERSINGLABS_Cert_Blocklist_736B7663D322533413F36E3E7E55F920 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1991779a-8b5d-5188-8a36-c8451923e88f"
+		id = "5e20c072-62d7-580c-8ec1-1d2e06341d5e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13458-L13474"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "44e86319106a4bf8edba6c1be2f90d68b3d1ef4591f0cc23921a0dc4da4a407b"
+		logic_hash = "v1_sha256_44e86319106a4bf8edba6c1be2f90d68b3d1ef4591f0cc23921a0dc4da4a407b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50758,7 +50758,7 @@ rule REVERSINGLABS_Cert_Blocklist_736B7663D322533413F36E3E7E55F920 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Net Technology" and pe.signatures[i].serial=="73:6b:76:63:d3:22:53:34:13:f3:6e:3e:7e:55:f9:20" and 1159488000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Net Technology" and pe.signatures [ i ] . serial == "73:6b:76:63:d3:22:53:34:13:f3:6e:3e:7e:55:f9:20" and 1159488000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50767,13 +50767,13 @@ rule REVERSINGLABS_Cert_Blocklist_54A170102461Fdc967Acfafe4Bbbc7F0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d012df1d-5e85-57b4-8a79-5da91369a14a"
+		id = "c838dd21-8414-5d0a-a32c-d4219735f671"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13476-L13492"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ddae18d566fa2fd077f51d0afff74fb8a8e525f88f23908c7402a4b2c092ad24"
+		logic_hash = "v1_sha256_ddae18d566fa2fd077f51d0afff74fb8a8e525f88f23908c7402a4b2c092ad24"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50783,7 +50783,7 @@ rule REVERSINGLABS_Cert_Blocklist_54A170102461Fdc967Acfafe4Bbbc7F0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="54:a1:70:10:24:61:fd:c9:67:ac:fa:fe:4b:bb:c7:f0" and 1476748800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "54:a1:70:10:24:61:fd:c9:67:ac:fa:fe:4b:bb:c7:f0" and 1476748800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50792,13 +50792,13 @@ rule REVERSINGLABS_Cert_Blocklist_0C501B8B113209C96C8119Cf7A6B8B79 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9ec73230-10cd-55ad-9ef7-56a875294cab"
+		id = "b7f5cb85-8606-5779-ab0b-43965c1bfc84"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13494-L13510"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dca37fda83650979566fb6ffbedaf713955a3c7f03ecc62e2e155475b7ca00e4"
+		logic_hash = "v1_sha256_dca37fda83650979566fb6ffbedaf713955a3c7f03ecc62e2e155475b7ca00e4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50808,7 +50808,7 @@ rule REVERSINGLABS_Cert_Blocklist_0C501B8B113209C96C8119Cf7A6B8B79 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Zhang" and pe.signatures[i].serial=="0c:50:1b:8b:11:32:09:c9:6c:81:19:cf:7a:6b:8b:79" and 1474329600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Zhang" and pe.signatures [ i ] . serial == "0c:50:1b:8b:11:32:09:c9:6c:81:19:cf:7a:6b:8b:79" and 1474329600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50817,13 +50817,13 @@ rule REVERSINGLABS_Cert_Blocklist_0300Ee4A4C52443147821A8186D04309 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "abccf84f-ba18-5644-897c-d23a228facff"
+		id = "971e1cca-1bec-58c8-9ef8-7fd10e8709e3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13512-L13528"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8476ece98427c1ffd99d820c25fe664397de2c393473f7d5ee0846d8d840fd9e"
+		logic_hash = "v1_sha256_8476ece98427c1ffd99d820c25fe664397de2c393473f7d5ee0846d8d840fd9e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50833,7 +50833,7 @@ rule REVERSINGLABS_Cert_Blocklist_0300Ee4A4C52443147821A8186D04309 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Buster Ind Com Imp e Exp de Acessorios P Autos Ltda" and pe.signatures[i].serial=="03:00:ee:4a:4c:52:44:31:47:82:1a:81:86:d0:43:09" and 1494892800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Buster Ind Com Imp e Exp de Acessorios P Autos Ltda" and pe.signatures [ i ] . serial == "03:00:ee:4a:4c:52:44:31:47:82:1a:81:86:d0:43:09" and 1494892800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50842,13 +50842,13 @@ rule REVERSINGLABS_Cert_Blocklist_202Cf8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1c442ed6-a48a-52f4-b345-300428ec9c76"
+		id = "afeeba5f-e88f-5623-928b-fdea75ca98f7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13530-L13546"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "671a4b522761fdff75d1c0c608e8cfb21c7ab538c8c30c8620315bc58ed358e6"
+		logic_hash = "v1_sha256_671a4b522761fdff75d1c0c608e8cfb21c7ab538c8c30c8620315bc58ed358e6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50858,7 +50858,7 @@ rule REVERSINGLABS_Cert_Blocklist_202Cf8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DATALINE LTD." and pe.signatures[i].serial=="20:2c:f8" and 1087841761<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DATALINE LTD." and pe.signatures [ i ] . serial == "20:2c:f8" and 1087841761 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50867,13 +50867,13 @@ rule REVERSINGLABS_Cert_Blocklist_6651Cc8B4850D4Dec61961503Ea7956B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "88679114-9c85-5810-af21-d5c2a8dc759e"
+		id = "27842d3c-0804-5b5f-8c6a-006300429ef0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13548-L13564"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "29bfe9c8b340b55a9daa2644e8d55b2b783cc95c85541732e6e0decca8c10ff6"
+		logic_hash = "v1_sha256_29bfe9c8b340b55a9daa2644e8d55b2b783cc95c85541732e6e0decca8c10ff6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50883,7 +50883,7 @@ rule REVERSINGLABS_Cert_Blocklist_6651Cc8B4850D4Dec61961503Ea7956B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NUSAAPPINSTALL(APPS INSTALLER S.L.)" and pe.signatures[i].serial=="66:51:cc:8b:48:50:d4:de:c6:19:61:50:3e:a7:95:6b" and 1436175828<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NUSAAPPINSTALL(APPS INSTALLER S.L.)" and pe.signatures [ i ] . serial == "66:51:cc:8b:48:50:d4:de:c6:19:61:50:3e:a7:95:6b" and 1436175828 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50892,13 +50892,13 @@ rule REVERSINGLABS_Cert_Blocklist_25Bef28467E4750331D2F403458113B8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a97723cb-7814-5f08-af94-6244c1cf4145"
+		id = "6b4751c6-5176-507f-a920-4fe6c278d46f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13566-L13582"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dc59fdecf60f3781e92cfe8469be2e0c1cb1cfdd3e9f9757d159667437cb37f5"
+		logic_hash = "v1_sha256_dc59fdecf60f3781e92cfe8469be2e0c1cb1cfdd3e9f9757d159667437cb37f5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50908,7 +50908,7 @@ rule REVERSINGLABS_Cert_Blocklist_25Bef28467E4750331D2F403458113B8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures[i].serial=="25:be:f2:84:67:e4:75:03:31:d2:f4:03:45:81:13:b8" and 1474156800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures [ i ] . serial == "25:be:f2:84:67:e4:75:03:31:d2:f4:03:45:81:13:b8" and 1474156800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50917,13 +50917,13 @@ rule REVERSINGLABS_Cert_Blocklist_0296Cf3314F434C5B74D0C3E36616Dd1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ae7d8c3c-0ac8-5ea5-8013-97ccb2ace4e4"
+		id = "09c6c0df-7d05-5e66-ba01-d3125f639287"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13584-L13600"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "acf3b7460c79fa71c1b131b26a40bbc286c9da0a5fe7071bbe8b386a3ca91de4"
+		logic_hash = "v1_sha256_acf3b7460c79fa71c1b131b26a40bbc286c9da0a5fe7071bbe8b386a3ca91de4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50933,7 +50933,7 @@ rule REVERSINGLABS_Cert_Blocklist_0296Cf3314F434C5B74D0C3E36616Dd1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="02:96:cf:33:14:f4:34:c5:b7:4d:0c:3e:36:61:6d:d1" and 1474934400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "02:96:cf:33:14:f4:34:c5:b7:4d:0c:3e:36:61:6d:d1" and 1474934400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50942,13 +50942,13 @@ rule REVERSINGLABS_Cert_Blocklist_045D57D63E13775C8F812E1864797F5A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c2c37ddc-51bc-58da-b770-df97aebca01d"
+		id = "e67bff5d-e1ae-5b57-bd1f-05ce5dc4ce96"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13602-L13618"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d3e61e9a43f5b17ebb08b71dc39648d1f20273a18214f39605f365f9f0f72c10"
+		logic_hash = "v1_sha256_d3e61e9a43f5b17ebb08b71dc39648d1f20273a18214f39605f365f9f0f72c10"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50958,7 +50958,7 @@ rule REVERSINGLABS_Cert_Blocklist_045D57D63E13775C8F812E1864797F5A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Mei" and pe.signatures[i].serial=="04:5d:57:d6:3e:13:77:5c:8f:81:2e:18:64:79:7f:5a" and 1485043200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Mei" and pe.signatures [ i ] . serial == "04:5d:57:d6:3e:13:77:5c:8f:81:2e:18:64:79:7f:5a" and 1485043200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50967,13 +50967,13 @@ rule REVERSINGLABS_Cert_Blocklist_6D633Df9Bb6015Fc3Ecea99Dff309Ee7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b85bf9c5-f438-5973-83ab-926e44cf2298"
+		id = "e1049977-84ad-58bb-9bd8-133c90772026"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13620-L13636"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "84e2f427ee79b47db8d0e5f1e2217a7e1c1ea64047e01b4ea6db69f529501f36"
+		logic_hash = "v1_sha256_84e2f427ee79b47db8d0e5f1e2217a7e1c1ea64047e01b4ea6db69f529501f36"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -50983,7 +50983,7 @@ rule REVERSINGLABS_Cert_Blocklist_6D633Df9Bb6015Fc3Ecea99Dff309Ee7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Zhang" and pe.signatures[i].serial=="6d:63:3d:f9:bb:60:15:fc:3e:ce:a9:9d:ff:30:9e:e7" and 1474156800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Zhang" and pe.signatures [ i ] . serial == "6d:63:3d:f9:bb:60:15:fc:3e:ce:a9:9d:ff:30:9e:e7" and 1474156800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -50992,13 +50992,13 @@ rule REVERSINGLABS_Cert_Blocklist_22E2A66E63B8Cb4Ec6989Bf7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5c028a6c-890c-54f1-aea2-ac04ce654907"
+		id = "9adb5aa9-330d-5792-a771-05649029e4c7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13638-L13654"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2099c508d1fd986f34f14aa396a5aaa136e2cdd2226099acdca9c14f6f6342eb"
+		logic_hash = "v1_sha256_2099c508d1fd986f34f14aa396a5aaa136e2cdd2226099acdca9c14f6f6342eb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51008,7 +51008,7 @@ rule REVERSINGLABS_Cert_Blocklist_22E2A66E63B8Cb4Ec6989Bf7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sivi Technology Limited" and pe.signatures[i].serial=="22:e2:a6:6e:63:b8:cb:4e:c6:98:9b:f7" and 1466995365<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sivi Technology Limited" and pe.signatures [ i ] . serial == "22:e2:a6:6e:63:b8:cb:4e:c6:98:9b:f7" and 1466995365 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51017,13 +51017,13 @@ rule REVERSINGLABS_Cert_Blocklist_654B406De388Ec2Aec253Ff2Ba4C4Bbd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9820112d-d59b-57e7-ae78-7b427f70d529"
+		id = "7c1ac237-d553-5314-a00c-e036010abf6d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13656-L13672"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a1aadaded55c8b0d85ac09ba9ab27fefaeec2969cdabaf26ff0c41bf33422ddc"
+		logic_hash = "v1_sha256_a1aadaded55c8b0d85ac09ba9ab27fefaeec2969cdabaf26ff0c41bf33422ddc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51033,7 +51033,7 @@ rule REVERSINGLABS_Cert_Blocklist_654B406De388Ec2Aec253Ff2Ba4C4Bbd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yijiajian (Amoy) Jiankan Tech Co.,LTD." and pe.signatures[i].serial=="65:4b:40:6d:e3:88:ec:2a:ec:25:3f:f2:ba:4c:4b:bd" and 1398902400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yijiajian (Amoy) Jiankan Tech Co.,LTD." and pe.signatures [ i ] . serial == "65:4b:40:6d:e3:88:ec:2a:ec:25:3f:f2:ba:4c:4b:bd" and 1398902400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51042,13 +51042,13 @@ rule REVERSINGLABS_Cert_Blocklist_78D1817Ebcf338B4E9C810F9740A726B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3d0a97a4-c45a-5238-a287-867529b470cb"
+		id = "6f4ffa0c-ee59-5b71-a94d-863ad6033a22"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13674-L13690"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "62e59130ef0ac35b17a265bb8bc2031cac6a75c11925ccb21eb4601b8fbe1a63"
+		logic_hash = "v1_sha256_62e59130ef0ac35b17a265bb8bc2031cac6a75c11925ccb21eb4601b8fbe1a63"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51058,7 +51058,7 @@ rule REVERSINGLABS_Cert_Blocklist_78D1817Ebcf338B4E9C810F9740A726B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CONSTRUTORA NOVO PARQUE LTDA - ME" and pe.signatures[i].serial=="78:d1:81:7e:bc:f3:38:b4:e9:c8:10:f9:74:0a:72:6b" and 1431734400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CONSTRUTORA NOVO PARQUE LTDA - ME" and pe.signatures [ i ] . serial == "78:d1:81:7e:bc:f3:38:b4:e9:c8:10:f9:74:0a:72:6b" and 1431734400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51067,13 +51067,13 @@ rule REVERSINGLABS_Cert_Blocklist_45Fbcdb1Fbd3D702Fb77257B45D8C58E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6bfd7c1d-2608-5ca0-8e1e-04c73588895a"
+		id = "88a693f4-8dcf-5425-b2f0-e19a89f1aa33"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13692-L13708"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "441e10f49515d75ee9e8983ba4321377fee13a91ca5eeddc08b393136ce8ccfd"
+		logic_hash = "v1_sha256_441e10f49515d75ee9e8983ba4321377fee13a91ca5eeddc08b393136ce8ccfd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51083,7 +51083,7 @@ rule REVERSINGLABS_Cert_Blocklist_45Fbcdb1Fbd3D702Fb77257B45D8C58E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ding Ruan" and pe.signatures[i].serial=="45:fb:cd:b1:fb:d3:d7:02:fb:77:25:7b:45:d8:c5:8e" and 1476662400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ding Ruan" and pe.signatures [ i ] . serial == "45:fb:cd:b1:fb:d3:d7:02:fb:77:25:7b:45:d8:c5:8e" and 1476662400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51092,13 +51092,13 @@ rule REVERSINGLABS_Cert_Blocklist_4B5D8Ed5Ca011679F141F124 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c8bc0968-29d0-51a9-8cfe-7c8f447cef3d"
+		id = "eb31bd34-1686-5306-8b48-bf35a1e66d98"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13710-L13726"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "39ff0d5fd711524ce181596033d1d51579cd086eb20b87722aebf39623bbaa17"
+		logic_hash = "v1_sha256_39ff0d5fd711524ce181596033d1d51579cd086eb20b87722aebf39623bbaa17"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51108,7 +51108,7 @@ rule REVERSINGLABS_Cert_Blocklist_4B5D8Ed5Ca011679F141F124 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="4b:5d:8e:d5:ca:01:16:79:f1:41:f1:24" and 1480644725<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "4b:5d:8e:d5:ca:01:16:79:f1:41:f1:24" and 1480644725 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51117,13 +51117,13 @@ rule REVERSINGLABS_Cert_Blocklist_33671F1Bcbd0F5E231Fc386F4895000E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0863e1ed-7b9c-5a60-82ac-eadc3c23fbd9"
+		id = "0fcd78eb-4840-5ff1-a60f-780ab0bb87fd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13728-L13744"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9199c8d76e3390ec9038808b4e88b803b3f3d6966af6206d0c9968d9ab673f31"
+		logic_hash = "v1_sha256_9199c8d76e3390ec9038808b4e88b803b3f3d6966af6206d0c9968d9ab673f31"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51133,7 +51133,7 @@ rule REVERSINGLABS_Cert_Blocklist_33671F1Bcbd0F5E231Fc386F4895000E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALAIS, OOO" and pe.signatures[i].serial=="33:67:1f:1b:cb:d0:f5:e2:31:fc:38:6f:48:95:00:0e" and 1491868800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALAIS, OOO" and pe.signatures [ i ] . serial == "33:67:1f:1b:cb:d0:f5:e2:31:fc:38:6f:48:95:00:0e" and 1491868800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51142,13 +51142,13 @@ rule REVERSINGLABS_Cert_Blocklist_32Bc299F0694C19Ec21E71265B1D7E17 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "fa2302c3-4002-5bf0-812b-45298abbda8d"
+		id = "764143b1-944c-5c75-a157-0e7a674bb73c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13746-L13762"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cb522e3084d382c451a8b040095e75582675f90dbb588e370f2f0054f4c2d14b"
+		logic_hash = "v1_sha256_cb522e3084d382c451a8b040095e75582675f90dbb588e370f2f0054f4c2d14b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51158,7 +51158,7 @@ rule REVERSINGLABS_Cert_Blocklist_32Bc299F0694C19Ec21E71265B1D7E17 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="32:bc:29:9f:06:94:c1:9e:c2:1e:71:26:5b:1d:7e:17" and 1474416000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "32:bc:29:9f:06:94:c1:9e:c2:1e:71:26:5b:1d:7e:17" and 1474416000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51167,13 +51167,13 @@ rule REVERSINGLABS_Cert_Blocklist_7B75C6B0A09Afdb9787F6Dff75Ae7844 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0b34c7ce-fa75-5340-a473-fa87fab93b86"
+		id = "97238465-4308-5586-927e-25b0937e7105"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13764-L13780"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8fd125a526b3433fbb8a5c6fa74ce0b0e2de8ff789880c355625d4140cd902a2"
+		logic_hash = "v1_sha256_8fd125a526b3433fbb8a5c6fa74ce0b0e2de8ff789880c355625d4140cd902a2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51183,7 +51183,7 @@ rule REVERSINGLABS_Cert_Blocklist_7B75C6B0A09Afdb9787F6Dff75Ae7844 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Zhang" and pe.signatures[i].serial=="7b:75:c6:b0:a0:9a:fd:b9:78:7f:6d:ff:75:ae:78:44" and 1476662400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Zhang" and pe.signatures [ i ] . serial == "7b:75:c6:b0:a0:9a:fd:b9:78:7f:6d:ff:75:ae:78:44" and 1476662400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51192,13 +51192,13 @@ rule REVERSINGLABS_Cert_Blocklist_167Fd1295B3Bb102Dbb37292C838E7Cd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "42cf5f07-4c43-567c-a517-42c898658ab8"
+		id = "9c773d9a-9397-5b02-bc48-5e79c4a7ec4f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13782-L13798"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1cc7d441291fd9c4dc37320d411f94fb362523d47d37ab35c20b3ac9d4cd75cb"
+		logic_hash = "v1_sha256_1cc7d441291fd9c4dc37320d411f94fb362523d47d37ab35c20b3ac9d4cd75cb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51208,7 +51208,7 @@ rule REVERSINGLABS_Cert_Blocklist_167Fd1295B3Bb102Dbb37292C838E7Cd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="16:7f:d1:29:5b:3b:b1:02:db:b3:72:92:c8:38:e7:cd" and 1476921600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "16:7f:d1:29:5b:3b:b1:02:db:b3:72:92:c8:38:e7:cd" and 1476921600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51217,13 +51217,13 @@ rule REVERSINGLABS_Cert_Blocklist_253Ad25E39Abe8F8Fda9Fcf6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f09ca101-dd40-54d8-9235-1faf1e774dd4"
+		id = "8c1f98e2-8239-5929-9355-e99e0e4dbcf5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13800-L13816"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1d46ccaa136cd7be30ffbf0eb09eb6485c543ff4bdbe99fa7ea3846841cbd41b"
+		logic_hash = "v1_sha256_1d46ccaa136cd7be30ffbf0eb09eb6485c543ff4bdbe99fa7ea3846841cbd41b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51233,7 +51233,7 @@ rule REVERSINGLABS_Cert_Blocklist_253Ad25E39Abe8F8Fda9Fcf6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DVERI FADO, TOV" and pe.signatures[i].serial=="25:3a:d2:5e:39:ab:e8:f8:fd:a9:fc:f6" and 1538662130<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DVERI FADO, TOV" and pe.signatures [ i ] . serial == "25:3a:d2:5e:39:ab:e8:f8:fd:a9:fc:f6" and 1538662130 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51242,13 +51242,13 @@ rule REVERSINGLABS_Cert_Blocklist_A9C1523Cb2C73A82771D318124963E87 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b21365d0-eaff-51da-8b8e-6a6ee75a5b95"
+		id = "3199e7b3-48be-58f9-9911-da72bfcb196b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13818-L13836"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "87e314d14361f56935b7a8fb93468cfaf2c73e16c25d68a61ec80ad9334d3115"
+		logic_hash = "v1_sha256_87e314d14361f56935b7a8fb93468cfaf2c73e16c25d68a61ec80ad9334d3115"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51258,7 +51258,7 @@ rule REVERSINGLABS_Cert_Blocklist_A9C1523Cb2C73A82771D318124963E87 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ULTERA" and (pe.signatures[i].serial=="00:a9:c1:52:3c:b2:c7:3a:82:77:1d:31:81:24:96:3e:87" or pe.signatures[i].serial=="a9:c1:52:3c:b2:c7:3a:82:77:1d:31:81:24:96:3e:87") and 1499731200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ULTERA" and ( pe.signatures [ i ] . serial == "00:a9:c1:52:3c:b2:c7:3a:82:77:1d:31:81:24:96:3e:87" or pe.signatures [ i ] . serial == "a9:c1:52:3c:b2:c7:3a:82:77:1d:31:81:24:96:3e:87" ) and 1499731200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51267,13 +51267,13 @@ rule REVERSINGLABS_Cert_Blocklist_68E1B2C210B19Bb1F2A24176709B165B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e17bf185-3dfc-5a2f-a87f-525ac0e4084b"
+		id = "b5993d02-70bf-5ce3-be99-edd6675e9410"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13838-L13854"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8e88ad992c58d37ff1ac34e2d9cf121f3bc692ae78c0ad79140974abdec2f317"
+		logic_hash = "v1_sha256_8e88ad992c58d37ff1ac34e2d9cf121f3bc692ae78c0ad79140974abdec2f317"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51283,7 +51283,7 @@ rule REVERSINGLABS_Cert_Blocklist_68E1B2C210B19Bb1F2A24176709B165B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="68:e1:b2:c2:10:b1:9b:b1:f2:a2:41:76:70:9b:16:5b" and 1474502400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "68:e1:b2:c2:10:b1:9b:b1:f2:a2:41:76:70:9b:16:5b" and 1474502400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51292,13 +51292,13 @@ rule REVERSINGLABS_Cert_Blocklist_5C88313Bd98Bde99C9B9Ac1408A63249 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5108fa8f-3fe6-518c-9bae-b1c44a0ec7a8"
+		id = "ce016ba2-fd18-5185-842b-c73e6c697e9c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13856-L13872"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f958e46e00bf4ab8ecf071502bcda63a84265029bc9c72cea1eaaf72e9003a84"
+		logic_hash = "v1_sha256_f958e46e00bf4ab8ecf071502bcda63a84265029bc9c72cea1eaaf72e9003a84"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51308,7 +51308,7 @@ rule REVERSINGLABS_Cert_Blocklist_5C88313Bd98Bde99C9B9Ac1408A63249 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="5c:88:31:3b:d9:8b:de:99:c9:b9:ac:14:08:a6:32:49" and 1474243200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "5c:88:31:3b:d9:8b:de:99:c9:b9:ac:14:08:a6:32:49" and 1474243200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51317,13 +51317,13 @@ rule REVERSINGLABS_Cert_Blocklist_7A632A6Ecfc6C49Ec1F42F76 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "863a109c-034f-5168-9470-8fd4945e6e92"
+		id = "a291433c-7a77-5e29-bfc1-8f4d423d1275"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13874-L13890"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "038badeab61c00476b79684308bf91f8a63716641f2be16fe0a3b25ebd3a9a1e"
+		logic_hash = "v1_sha256_038badeab61c00476b79684308bf91f8a63716641f2be16fe0a3b25ebd3a9a1e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51333,7 +51333,7 @@ rule REVERSINGLABS_Cert_Blocklist_7A632A6Ecfc6C49Ec1F42F76 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="7a:63:2a:6e:cf:c6:c4:9e:c1:f4:2f:76" and 1474959780<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "7a:63:2a:6e:cf:c6:c4:9e:c1:f4:2f:76" and 1474959780 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51342,13 +51342,13 @@ rule REVERSINGLABS_Cert_Blocklist_F57Df6A6Eee3854D513D0Ba8585049B7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b31f73d5-ff9e-5be7-b806-8838ddb5d29d"
+		id = "8974f324-bba1-537c-b099-b311c2342b10"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13892-L13910"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "09d5998960fb65eda56cd698c5ff50d87ba7a811cbb128bc7485c0f124e14cba"
+		logic_hash = "v1_sha256_09d5998960fb65eda56cd698c5ff50d87ba7a811cbb128bc7485c0f124e14cba"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51358,7 +51358,7 @@ rule REVERSINGLABS_Cert_Blocklist_F57Df6A6Eee3854D513D0Ba8585049B7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "smnetworks" and (pe.signatures[i].serial=="00:f5:7d:f6:a6:ee:e3:85:4d:51:3d:0b:a8:58:50:49:b7" or pe.signatures[i].serial=="f5:7d:f6:a6:ee:e3:85:4d:51:3d:0b:a8:58:50:49:b7") and 1277769600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "smnetworks" and ( pe.signatures [ i ] . serial == "00:f5:7d:f6:a6:ee:e3:85:4d:51:3d:0b:a8:58:50:49:b7" or pe.signatures [ i ] . serial == "f5:7d:f6:a6:ee:e3:85:4d:51:3d:0b:a8:58:50:49:b7" ) and 1277769600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51367,13 +51367,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Ac5Ac5D323122E6D8E92D6E191B1432 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9a363a84-c21c-5afe-9812-9ce16962b28a"
+		id = "a0cd8075-d413-5e90-b579-fe0e6d528591"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13912-L13928"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d5e62d3cdfacfaea70f9ee11230501bb9c4099508077d50a2a143cb69476f02a"
+		logic_hash = "v1_sha256_d5e62d3cdfacfaea70f9ee11230501bb9c4099508077d50a2a143cb69476f02a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51383,7 +51383,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Ac5Ac5D323122E6D8E92D6E191B1432 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Certified Software" and pe.signatures[i].serial=="0a:c5:ac:5d:32:31:22:e6:d8:e9:2d:6e:19:1b:14:32" and 1140134400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Certified Software" and pe.signatures [ i ] . serial == "0a:c5:ac:5d:32:31:22:e6:d8:e9:2d:6e:19:1b:14:32" and 1140134400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51392,13 +51392,13 @@ rule REVERSINGLABS_Cert_Blocklist_2433D9Df7Efbccb870Ee5904D62A0101 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6cd46771-06ea-51c9-ad84-4b28f4f8442b"
+		id = "1be97331-83f7-5439-8206-3238315a1582"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13930-L13946"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "92a2effe1b94345f52130e4cb1db181f1990e58eaefb9c74375c14249cc1be22"
+		logic_hash = "v1_sha256_92a2effe1b94345f52130e4cb1db181f1990e58eaefb9c74375c14249cc1be22"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51408,7 +51408,7 @@ rule REVERSINGLABS_Cert_Blocklist_2433D9Df7Efbccb870Ee5904D62A0101 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Conpavi AG" and pe.signatures[i].serial=="24:33:d9:df:7e:fb:cc:b8:70:ee:59:04:d6:2a:01:01" and 1322438400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Conpavi AG" and pe.signatures [ i ] . serial == "24:33:d9:df:7e:fb:cc:b8:70:ee:59:04:d6:2a:01:01" and 1322438400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51417,13 +51417,13 @@ rule REVERSINGLABS_Cert_Blocklist_462Baada57570F70Df76D10B9E7Bf2B7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2863a050-ebce-5322-b64a-9160adf6cc21"
+		id = "7a41c7dc-cc78-5286-9345-9c6240c91cdb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13948-L13964"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c48207907339ce3fb7b6bc630097761a24495a9d4e69d421f2bdb36ddc92abcb"
+		logic_hash = "v1_sha256_c48207907339ce3fb7b6bc630097761a24495a9d4e69d421f2bdb36ddc92abcb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51433,7 +51433,7 @@ rule REVERSINGLABS_Cert_Blocklist_462Baada57570F70Df76D10B9E7Bf2B7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DVERI FADO, TOV" and pe.signatures[i].serial=="46:2b:aa:da:57:57:0f:70:df:76:d1:0b:9e:7b:f2:b7" and 1551744000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DVERI FADO, TOV" and pe.signatures [ i ] . serial == "46:2b:aa:da:57:57:0f:70:df:76:d1:0b:9e:7b:f2:b7" and 1551744000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51442,13 +51442,13 @@ rule REVERSINGLABS_Cert_Blocklist_83320D93Dd8Cf16D11F99B1078B0A7Cb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "12ce9be9-4644-5b59-aed2-ce4b04fcc46a"
+		id = "6b67bf8e-bae0-5e7d-9bd9-e55532015187"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13966-L13984"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "94ec5e05357767cc0c4cd1fc8ff6d1a366359ba699c43f3710204d761e7e707f"
+		logic_hash = "v1_sha256_94ec5e05357767cc0c4cd1fc8ff6d1a366359ba699c43f3710204d761e7e707f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51458,7 +51458,7 @@ rule REVERSINGLABS_Cert_Blocklist_83320D93Dd8Cf16D11F99B1078B0A7Cb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRANS LTD" and (pe.signatures[i].serial=="00:83:32:0d:93:dd:8c:f1:6d:11:f9:9b:10:78:b0:a7:cb" or pe.signatures[i].serial=="83:32:0d:93:dd:8c:f1:6d:11:f9:9b:10:78:b0:a7:cb") and 1524614400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TRANS LTD" and ( pe.signatures [ i ] . serial == "00:83:32:0d:93:dd:8c:f1:6d:11:f9:9b:10:78:b0:a7:cb" or pe.signatures [ i ] . serial == "83:32:0d:93:dd:8c:f1:6d:11:f9:9b:10:78:b0:a7:cb" ) and 1524614400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51467,13 +51467,13 @@ rule REVERSINGLABS_Cert_Blocklist_10Bae1D20Cb4Cc36A0Ffac86 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a07d1c35-0026-526a-bf08-e6b07008da03"
+		id = "fb5958ba-dee5-52de-a1d9-5ab360bc2158"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L13986-L14002"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "44e91fbf4da8e81859a21408ee9f1971f1e8f48d22553fcaa6469156d4a0670b"
+		logic_hash = "v1_sha256_44e91fbf4da8e81859a21408ee9f1971f1e8f48d22553fcaa6469156d4a0670b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51483,7 +51483,7 @@ rule REVERSINGLABS_Cert_Blocklist_10Bae1D20Cb4Cc36A0Ffac86 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="10:ba:e1:d2:0c:b4:cc:36:a0:ff:ac:86" and 1476773830<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "10:ba:e1:d2:0c:b4:cc:36:a0:ff:ac:86" and 1476773830 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51492,13 +51492,13 @@ rule REVERSINGLABS_Cert_Blocklist_230716Bfe915Dd6203B2E2A35674C2Ee : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "849c390e-f81f-558e-88a3-19242c127a56"
+		id = "f604eee8-319d-57f8-9e90-7043ce254d26"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14004-L14020"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0197ff46ceb1017488da4383436fd0ddc375904f36cc16c5a8ef21d633ec387c"
+		logic_hash = "v1_sha256_0197ff46ceb1017488da4383436fd0ddc375904f36cc16c5a8ef21d633ec387c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51508,7 +51508,7 @@ rule REVERSINGLABS_Cert_Blocklist_230716Bfe915Dd6203B2E2A35674C2Ee : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jiang Liu" and pe.signatures[i].serial=="23:07:16:bf:e9:15:dd:62:03:b2:e2:a3:56:74:c2:ee" and 1472169600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Jiang Liu" and pe.signatures [ i ] . serial == "23:07:16:bf:e9:15:dd:62:03:b2:e2:a3:56:74:c2:ee" and 1472169600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51517,13 +51517,13 @@ rule REVERSINGLABS_Cert_Blocklist_36A77D37E68E02Fd3D043C7197E044Ca : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "721e48fb-3046-5b2d-8ad9-ae340e598794"
+		id = "958309b7-4e33-5bc1-ba86-a4e95a4340e7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14022-L14038"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fc13ac5880cc2c8eac9ff8d09f6c5c2055b2de54d460a284936a4f6cd78192e8"
+		logic_hash = "v1_sha256_fc13ac5880cc2c8eac9ff8d09f6c5c2055b2de54d460a284936a4f6cd78192e8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51533,7 +51533,7 @@ rule REVERSINGLABS_Cert_Blocklist_36A77D37E68E02Fd3D043C7197E044Ca : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Direct Systems Ltd" and pe.signatures[i].serial=="36:a7:7d:37:e6:8e:02:fd:3d:04:3c:71:97:e0:44:ca" and 1515542400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Direct Systems Ltd" and pe.signatures [ i ] . serial == "36:a7:7d:37:e6:8e:02:fd:3d:04:3c:71:97:e0:44:ca" and 1515542400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51542,13 +51542,13 @@ rule REVERSINGLABS_Cert_Blocklist_73Bff2Fb714F986C1707165F0B0F2E0E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f014b446-0ddc-51df-898c-200bd60181a0"
+		id = "f10512c5-c954-5026-bfd8-93a661a0c0a5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14040-L14056"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d79ab926cbc0049d39f5f4c6e57afc71b1a30311a4816fdb66a9c2e257cc84af"
+		logic_hash = "v1_sha256_d79ab926cbc0049d39f5f4c6e57afc71b1a30311a4816fdb66a9c2e257cc84af"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51558,7 +51558,7 @@ rule REVERSINGLABS_Cert_Blocklist_73Bff2Fb714F986C1707165F0B0F2E0E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tecnopolis Consulting Ltd" and pe.signatures[i].serial=="73:bf:f2:fb:71:4f:98:6c:17:07:16:5f:0b:0f:2e:0e" and 1090886400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Tecnopolis Consulting Ltd" and pe.signatures [ i ] . serial == "73:bf:f2:fb:71:4f:98:6c:17:07:16:5f:0b:0f:2e:0e" and 1090886400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51567,13 +51567,13 @@ rule REVERSINGLABS_Cert_Blocklist_33B24170694Ca0Cf4D2Bdf4Aadf475A3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c02d7aaf-e88a-5aba-a8ee-db34562e53b1"
+		id = "9dfe1a5f-0958-56a4-8d45-e2e835973c1c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14058-L14074"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "795bcb46b41ded084e4d12d98e335748ec1db3e0abbbb2d933e819d955075138"
+		logic_hash = "v1_sha256_795bcb46b41ded084e4d12d98e335748ec1db3e0abbbb2d933e819d955075138"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51583,7 +51583,7 @@ rule REVERSINGLABS_Cert_Blocklist_33B24170694Ca0Cf4D2Bdf4Aadf475A3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="33:b2:41:70:69:4c:a0:cf:4d:2b:df:4a:ad:f4:75:a3" and 1474934400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "33:b2:41:70:69:4c:a0:cf:4d:2b:df:4a:ad:f4:75:a3" and 1474934400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51592,13 +51592,13 @@ rule REVERSINGLABS_Cert_Blocklist_3A9Bdec10E00E780316Baaebfe7A772C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "56f62454-84a1-5843-b2f4-fa84b37040f3"
+		id = "efb7781a-8c21-5c3d-9b92-f8d05f5a43fa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14076-L14092"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ea9bc11efd2969f6b7112338f2b084ea3551e072e46b1162bd47b08be549cdd4"
+		logic_hash = "v1_sha256_ea9bc11efd2969f6b7112338f2b084ea3551e072e46b1162bd47b08be549cdd4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51608,7 +51608,7 @@ rule REVERSINGLABS_Cert_Blocklist_3A9Bdec10E00E780316Baaebfe7A772C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PLAN ALPHA LIMITED" and pe.signatures[i].serial=="3a:9b:de:c1:0e:00:e7:80:31:6b:aa:eb:fe:7a:77:2c" and 1556582400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PLAN ALPHA LIMITED" and pe.signatures [ i ] . serial == "3a:9b:de:c1:0e:00:e7:80:31:6b:aa:eb:fe:7a:77:2c" and 1556582400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51617,13 +51617,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Cad9C37F7Affa8F4D8229F97607E265 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dae6b474-e4f0-5c73-b32e-d2680f508799"
+		id = "a8878a12-98c0-5011-853f-708cf991cdab"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14094-L14110"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0f88989c64bece23e7eccf8022e038fdd9c360766de71268cf71616f74adc56c"
+		logic_hash = "v1_sha256_0f88989c64bece23e7eccf8022e038fdd9c360766de71268cf71616f74adc56c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51633,7 +51633,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Cad9C37F7Affa8F4D8229F97607E265 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Funbit" and pe.signatures[i].serial=="7c:ad:9c:37:f7:af:fa:8f:4d:82:29:f9:76:07:e2:65" and 1122508800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Funbit" and pe.signatures [ i ] . serial == "7c:ad:9c:37:f7:af:fa:8f:4d:82:29:f9:76:07:e2:65" and 1122508800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51642,13 +51642,13 @@ rule REVERSINGLABS_Cert_Blocklist_098A57 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4604f1a6-2fdb-5917-943d-f0e2dbaaa29e"
+		id = "99ce0cd0-c024-59e2-94dd-bb966c199f35"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14112-L14128"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5e203f87dd4608ba5d583e02ce86fbe230e45fff86a7a697766e149d0cf6f436"
+		logic_hash = "v1_sha256_5e203f87dd4608ba5d583e02ce86fbe230e45fff86a7a697766e149d0cf6f436"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51658,7 +51658,7 @@ rule REVERSINGLABS_Cert_Blocklist_098A57 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ELECTRONIC GROUP" and pe.signatures[i].serial=="09:8a:57" and 1032855179<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ELECTRONIC GROUP" and pe.signatures [ i ] . serial == "09:8a:57" and 1032855179 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51667,13 +51667,13 @@ rule REVERSINGLABS_Cert_Blocklist_5389Cc6286Da3Bfa1Dc4Df498Bf68361 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "973aaf33-25a2-5f40-a5a7-d9f77e3589b3"
+		id = "9590000c-88ea-5dbb-8638-ad885d3066ad"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14130-L14146"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d25d998c980f47f4da065155451503dcbc677ad041af85a6ed7060ecadec66b3"
+		logic_hash = "v1_sha256_d25d998c980f47f4da065155451503dcbc677ad041af85a6ed7060ecadec66b3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51683,7 +51683,7 @@ rule REVERSINGLABS_Cert_Blocklist_5389Cc6286Da3Bfa1Dc4Df498Bf68361 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Joerm.com" and pe.signatures[i].serial=="53:89:cc:62:86:da:3b:fa:1d:c4:df:49:8b:f6:83:61" and 1495497600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Joerm.com" and pe.signatures [ i ] . serial == "53:89:cc:62:86:da:3b:fa:1d:c4:df:49:8b:f6:83:61" and 1495497600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51692,13 +51692,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ed9Caeb7911B31Bd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1eeff730-c2ce-5689-a8cb-455618738a82"
+		id = "af3b48f1-1216-5699-b7b9-aefa2593c70a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14148-L14166"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "02cfdf883212387a465af3e692b29b8d0eb8249e0a260f18bec2f662d775b606"
+		logic_hash = "v1_sha256_02cfdf883212387a465af3e692b29b8d0eb8249e0a260f18bec2f662d775b606"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51708,7 +51708,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ed9Caeb7911B31Bd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE4\\xB8\\x8A\\xE6\\xB5\\xB7\\xE5\\xA4\\xA9\\xE6\\xB8\\xB8\\xE8\\xBD\\xAF\\xE4\\xBB\\xB6\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and (pe.signatures[i].serial=="00:ed:9c:ae:b7:91:1b:31:bd" or pe.signatures[i].serial=="ed:9c:ae:b7:91:1b:31:bd") and 1506001740<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE4\\xB8\\x8A\\xE6\\xB5\\xB7\\xE5\\xA4\\xA9\\xE6\\xB8\\xB8\\xE8\\xBD\\xAF\\xE4\\xBB\\xB6\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and ( pe.signatures [ i ] . serial == "00:ed:9c:ae:b7:91:1b:31:bd" or pe.signatures [ i ] . serial == "ed:9c:ae:b7:91:1b:31:bd" ) and 1506001740 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51717,13 +51717,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Fd2B19A941B7009Cc728A37Cb1B10B9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "125c0b95-82bb-5900-8e8c-4359b8cd18ab"
+		id = "b6c3be89-957c-50ab-84a4-153c8393e0ba"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14168-L14184"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6b5cc47f4df9e57c59bc66c32188e02390d4855a1b9e56bd7471fd641a245c3c"
+		logic_hash = "v1_sha256_6b5cc47f4df9e57c59bc66c32188e02390d4855a1b9e56bd7471fd641a245c3c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51733,7 +51733,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Fd2B19A941B7009Cc728A37Cb1B10B9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BEAR AND CILLA LTD" and pe.signatures[i].serial=="0f:d2:b1:9a:94:1b:70:09:cc:72:8a:37:cb:1b:10:b9" and 1560470400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BEAR AND CILLA LTD" and pe.signatures [ i ] . serial == "0f:d2:b1:9a:94:1b:70:09:cc:72:8a:37:cb:1b:10:b9" and 1560470400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51742,13 +51742,13 @@ rule REVERSINGLABS_Cert_Blocklist_2D88C0Af1Fe2609961C171213C03Bd23 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0e844bef-1cfe-5eba-af4d-d8477e55470c"
+		id = "2f57c6da-bf7f-513a-b6b8-93126f93847a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14186-L14202"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2d181b9b517732f14d196c1a6c5661d8de4dbbfe6f120954dd3f9dcad00ff0fe"
+		logic_hash = "v1_sha256_2d181b9b517732f14d196c1a6c5661d8de4dbbfe6f120954dd3f9dcad00ff0fe"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51758,7 +51758,7 @@ rule REVERSINGLABS_Cert_Blocklist_2D88C0Af1Fe2609961C171213C03Bd23 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuzhou Lizhong Precision Manufacturing Technology Co., Ltd." and pe.signatures[i].serial=="2d:88:c0:af:1f:e2:60:99:61:c1:71:21:3c:03:bd:23" and 1683676800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Zhuzhou Lizhong Precision Manufacturing Technology Co., Ltd." and pe.signatures [ i ] . serial == "2d:88:c0:af:1f:e2:60:99:61:c1:71:21:3c:03:bd:23" and 1683676800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51767,13 +51767,13 @@ rule REVERSINGLABS_Cert_Blocklist_6E7Cc176062D91225Cfdcbdf5B5F0Ea5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "cb6ae82f-ac1e-528d-aa17-6dc14019793c"
+		id = "97cdb975-6872-5e08-85c6-4890f44bcff7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14204-L14220"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1d2ffa7ec3559061432c2aff23f568cb580fb9093d0af7d8a6a0b91add89c9cc"
+		logic_hash = "v1_sha256_1d2ffa7ec3559061432c2aff23f568cb580fb9093d0af7d8a6a0b91add89c9cc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51783,7 +51783,7 @@ rule REVERSINGLABS_Cert_Blocklist_6E7Cc176062D91225Cfdcbdf5B5F0Ea5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SG Internet" and pe.signatures[i].serial=="6e:7c:c1:76:06:2d:91:22:5c:fd:cb:df:5b:5f:0e:a5" and 1317945600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SG Internet" and pe.signatures [ i ] . serial == "6e:7c:c1:76:06:2d:91:22:5c:fd:cb:df:5b:5f:0e:a5" and 1317945600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51792,13 +51792,13 @@ rule REVERSINGLABS_Cert_Blocklist_Cecedd2Efc985C2Dbf0019669D270079 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "60a3e63c-4f44-5c75-9928-69859d77af3e"
+		id = "81437268-91ab-521c-acd4-054c76aba338"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14222-L14240"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1dfb5959db6929643126a850de84e54a84d7197518cde475c802987721b71020"
+		logic_hash = "v1_sha256_1dfb5959db6929643126a850de84e54a84d7197518cde475c802987721b71020"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51808,7 +51808,7 @@ rule REVERSINGLABS_Cert_Blocklist_Cecedd2Efc985C2Dbf0019669D270079 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRANS LTD" and (pe.signatures[i].serial=="00:ce:ce:dd:2e:fc:98:5c:2d:bf:00:19:66:9d:27:00:79" or pe.signatures[i].serial=="ce:ce:dd:2e:fc:98:5c:2d:bf:00:19:66:9d:27:00:79") and 1527811200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TRANS LTD" and ( pe.signatures [ i ] . serial == "00:ce:ce:dd:2e:fc:98:5c:2d:bf:00:19:66:9d:27:00:79" or pe.signatures [ i ] . serial == "ce:ce:dd:2e:fc:98:5c:2d:bf:00:19:66:9d:27:00:79" ) and 1527811200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51817,13 +51817,13 @@ rule REVERSINGLABS_Cert_Blocklist_61Fe6F00Bd79684210534050Ff46Bc92 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b88e0bbf-ab3a-51ac-8542-d4f92116f5e9"
+		id = "7b22f75c-f94c-5e79-a769-b9ae4d45164a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14242-L14258"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e8ebc5de081e2d1e653493a2d85699ebfb5227b7fab656468025c2043903f597"
+		logic_hash = "v1_sha256_e8ebc5de081e2d1e653493a2d85699ebfb5227b7fab656468025c2043903f597"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51833,7 +51833,7 @@ rule REVERSINGLABS_Cert_Blocklist_61Fe6F00Bd79684210534050Ff46Bc92 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xingning Dexin Network Technology Co., Ltd." and pe.signatures[i].serial=="61:fe:6f:00:bd:79:68:42:10:53:40:50:ff:46:bc:92" and 1512000000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xingning Dexin Network Technology Co., Ltd." and pe.signatures [ i ] . serial == "61:fe:6f:00:bd:79:68:42:10:53:40:50:ff:46:bc:92" and 1512000000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51842,13 +51842,13 @@ rule REVERSINGLABS_Cert_Blocklist_0323Cc4E38735B0E6Efba76Ea25C73B7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0f3889d5-fb57-5745-999e-7dff0ddf7ee9"
+		id = "01ce740e-4335-5bff-a240-b0ff4d4e1926"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14260-L14276"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "48bda7f61c9705ae70add3940f10d65fc7f7a776cec91a244f0e5bde07303831"
+		logic_hash = "v1_sha256_48bda7f61c9705ae70add3940f10d65fc7f7a776cec91a244f0e5bde07303831"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51858,7 +51858,7 @@ rule REVERSINGLABS_Cert_Blocklist_0323Cc4E38735B0E6Efba76Ea25C73B7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xingning Dexin Network Technology Co., Ltd." and pe.signatures[i].serial=="03:23:cc:4e:38:73:5b:0e:6e:fb:a7:6e:a2:5c:73:b7" and 1512000000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xingning Dexin Network Technology Co., Ltd." and pe.signatures [ i ] . serial == "03:23:cc:4e:38:73:5b:0e:6e:fb:a7:6e:a2:5c:73:b7" and 1512000000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51867,13 +51867,13 @@ rule REVERSINGLABS_Cert_Blocklist_1F9Aca069Ac1B6Bfb0E14861Ec857Bf6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b78e3bc2-5b65-507a-9183-148f97baa3e8"
+		id = "8da9feac-18c1-598e-8531-5440be611d28"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14278-L14294"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d7c9a471455768a00deeb73900bf80a98f0b2c9da1fd09d568e2998deaf404d2"
+		logic_hash = "v1_sha256_d7c9a471455768a00deeb73900bf80a98f0b2c9da1fd09d568e2998deaf404d2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51883,7 +51883,7 @@ rule REVERSINGLABS_Cert_Blocklist_1F9Aca069Ac1B6Bfb0E14861Ec857Bf6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Zhang" and pe.signatures[i].serial=="1f:9a:ca:06:9a:c1:b6:bf:b0:e1:48:61:ec:85:7b:f6" and 1477440000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Zhang" and pe.signatures [ i ] . serial == "1f:9a:ca:06:9a:c1:b6:bf:b0:e1:48:61:ec:85:7b:f6" and 1477440000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51892,13 +51892,13 @@ rule REVERSINGLABS_Cert_Blocklist_3E9D26Dcf703Ca3B140D7E7Ad48312E2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3ad650b2-45ea-5324-b8dc-b48094ae2376"
+		id = "4afee2f5-2c00-5f8c-8947-660ffaeb1207"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14296-L14312"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d8f70ba61509f3df34705bea0bfcb4cce3e92a33f0f1b65315d886eb5592f152"
+		logic_hash = "v1_sha256_d8f70ba61509f3df34705bea0bfcb4cce3e92a33f0f1b65315d886eb5592f152"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51908,7 +51908,7 @@ rule REVERSINGLABS_Cert_Blocklist_3E9D26Dcf703Ca3B140D7E7Ad48312E2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dong Qian" and pe.signatures[i].serial=="3e:9d:26:dc:f7:03:ca:3b:14:0d:7e:7a:d4:83:12:e2" and 1440580240<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dong Qian" and pe.signatures [ i ] . serial == "3e:9d:26:dc:f7:03:ca:3b:14:0d:7e:7a:d4:83:12:e2" and 1440580240 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51917,13 +51917,13 @@ rule REVERSINGLABS_Cert_Blocklist_4E2523E76Ea455941E75Fb8240474A75 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "be5e6f35-6177-50bb-82ea-55628acda4c2"
+		id = "1973b4c4-2140-5e54-ba08-d5b81d405168"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14314-L14330"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e89f722345fda82fd894d34169d1463997ae1d567d46badbf3138faa04cf8fa4"
+		logic_hash = "v1_sha256_e89f722345fda82fd894d34169d1463997ae1d567d46badbf3138faa04cf8fa4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51933,7 +51933,7 @@ rule REVERSINGLABS_Cert_Blocklist_4E2523E76Ea455941E75Fb8240474A75 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="4e:25:23:e7:6e:a4:55:94:1e:75:fb:82:40:47:4a:75" and 1476403200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "4e:25:23:e7:6e:a4:55:94:1e:75:fb:82:40:47:4a:75" and 1476403200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51942,13 +51942,13 @@ rule REVERSINGLABS_Cert_Blocklist_6102468293Ba7308D17Efb43Ad6Bfb58 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bcf0f1cc-44f2-5498-b9d7-9ad3f38e33bc"
+		id = "36991b89-9834-5072-b0c6-e9f9584c3075"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14332-L14348"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c1ae1562595ac6515a071a16195b46db6fad4ee0fe9757d366ee78b914e1de7f"
+		logic_hash = "v1_sha256_c1ae1562595ac6515a071a16195b46db6fad4ee0fe9757d366ee78b914e1de7f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51958,7 +51958,7 @@ rule REVERSINGLABS_Cert_Blocklist_6102468293Ba7308D17Efb43Ad6Bfb58 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures[i].serial=="61:02:46:82:93:ba:73:08:d1:7e:fb:43:ad:6b:fb:58" and 1470960000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures [ i ] . serial == "61:02:46:82:93:ba:73:08:d1:7e:fb:43:ad:6b:fb:58" and 1470960000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51967,13 +51967,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Ded1A7Ff6Da152A98A57A2F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "033c9ce3-1676-5ad1-9ec1-08b3ffc585bb"
+		id = "125fad94-de39-5947-95f1-ebec16e726dd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14350-L14366"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "20ec1e8e0570eb216304fd8453df315a26d9c170224177c325c10cbefc1993fb"
+		logic_hash = "v1_sha256_20ec1e8e0570eb216304fd8453df315a26d9c170224177c325c10cbefc1993fb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -51983,7 +51983,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Ded1A7Ff6Da152A98A57A2F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="6d:ed:1a:7f:f6:da:15:2a:98:a5:7a:2f" and 1479094343<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "6d:ed:1a:7f:f6:da:15:2a:98:a5:7a:2f" and 1479094343 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -51992,13 +51992,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Ce65Ea057B975D2C17Eaf2C2297B1Eb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f86fbd6f-1635-56d7-b390-e067f81b8705"
+		id = "c4db1fbd-3bcd-5880-8374-29f8490ecc70"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14368-L14384"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e17988cb2503e285cfe2ea74d7bc61c577d828e14fd5d8d8062e469dc75c449e"
+		logic_hash = "v1_sha256_e17988cb2503e285cfe2ea74d7bc61c577d828e14fd5d8d8062e469dc75c449e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52008,7 +52008,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Ce65Ea057B975D2C17Eaf2C2297B1Eb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRANS LTD" and pe.signatures[i].serial=="3c:e6:5e:a0:57:b9:75:d2:c1:7e:af:2c:22:97:b1:eb" and 1528243200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TRANS LTD" and pe.signatures [ i ] . serial == "3c:e6:5e:a0:57:b9:75:d2:c1:7e:af:2c:22:97:b1:eb" and 1528243200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52017,13 +52017,13 @@ rule REVERSINGLABS_Cert_Blocklist_5D085A9A288549D09Edc4941 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8fa1f434-2061-5131-9378-58c584eff447"
+		id = "b1a0b2fb-ba22-5536-ba1f-d175f99e0e16"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14386-L14402"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dff7c2d727acca753b030d05028590e1a5577121bb2b4c0dcfcb70b4c9d77cbf"
+		logic_hash = "v1_sha256_dff7c2d727acca753b030d05028590e1a5577121bb2b4c0dcfcb70b4c9d77cbf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52033,7 +52033,7 @@ rule REVERSINGLABS_Cert_Blocklist_5D085A9A288549D09Edc4941 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="5d:08:5a:9a:28:85:49:d0:9e:dc:49:41" and 1478757821<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "5d:08:5a:9a:28:85:49:d0:9e:dc:49:41" and 1478757821 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52042,13 +52042,13 @@ rule REVERSINGLABS_Cert_Blocklist_7D20Dec3797A1Ac30649Ebb184265B79 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5344bda2-bc11-5700-a0f7-52792c5bb87a"
+		id = "471a73e2-bbf5-5b22-af10-8950c7c59eaa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14404-L14420"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "78c0575a1c9ecf37ef5bac0612c20f96b8641875b0ba786979adc8a77f001a5e"
+		logic_hash = "v1_sha256_78c0575a1c9ecf37ef5bac0612c20f96b8641875b0ba786979adc8a77f001a5e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52058,7 +52058,7 @@ rule REVERSINGLABS_Cert_Blocklist_7D20Dec3797A1Ac30649Ebb184265B79 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jiang Liu" and pe.signatures[i].serial=="7d:20:de:c3:79:7a:1a:c3:06:49:eb:b1:84:26:5b:79" and 1474156800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Jiang Liu" and pe.signatures [ i ] . serial == "7d:20:de:c3:79:7a:1a:c3:06:49:eb:b1:84:26:5b:79" and 1474156800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52067,13 +52067,13 @@ rule REVERSINGLABS_Cert_Blocklist_187D92861076E469B5B7A19E2A9Fd4Ba : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0a156a49-c737-5bdb-9178-34121af490d6"
+		id = "b8bc636f-6119-556a-839d-d5678a2736cb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14422-L14438"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7383a7fb31a0a913dff1740015ff702642fbb41d8e5a528a8684c80e66026e9d"
+		logic_hash = "v1_sha256_7383a7fb31a0a913dff1740015ff702642fbb41d8e5a528a8684c80e66026e9d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52083,7 +52083,7 @@ rule REVERSINGLABS_Cert_Blocklist_187D92861076E469B5B7A19E2A9Fd4Ba : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="18:7d:92:86:10:76:e4:69:b5:b7:a1:9e:2a:9f:d4:ba" and 1476748800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "18:7d:92:86:10:76:e4:69:b5:b7:a1:9e:2a:9f:d4:ba" and 1476748800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52092,13 +52092,13 @@ rule REVERSINGLABS_Cert_Blocklist_199A9476Feca3C004Ff889D34545De07 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4bb98380-70e5-5ad9-adb2-2e6e10f35258"
+		id = "07e338f4-df4c-5a0e-9f2d-195f06ab2256"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14440-L14456"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "39c6efefcbd78d5e08ffd8d3989cab3bdf273a1847b2a961f9e68c9ee95e85b6"
+		logic_hash = "v1_sha256_39c6efefcbd78d5e08ffd8d3989cab3bdf273a1847b2a961f9e68c9ee95e85b6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52108,7 +52108,7 @@ rule REVERSINGLABS_Cert_Blocklist_199A9476Feca3C004Ff889D34545De07 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Funcall" and pe.signatures[i].serial=="19:9a:94:76:fe:ca:3c:00:4f:f8:89:d3:45:45:de:07" and 1138060800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Funcall" and pe.signatures [ i ] . serial == "19:9a:94:76:fe:ca:3c:00:4f:f8:89:d3:45:45:de:07" and 1138060800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52117,13 +52117,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Efe65 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e402e3b4-a598-504d-85b8-8c1994cb51fc"
+		id = "494c4607-9ecd-5c55-b171-94b6c8f7a23a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14458-L14474"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f849b6899b6766807cfddf99ecb809fe923f35f04de09b62235da352ce6e6e24"
+		logic_hash = "v1_sha256_f849b6899b6766807cfddf99ecb809fe923f35f04de09b62235da352ce6e6e24"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52133,7 +52133,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Efe65 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Software Plugin Ltd." and pe.signatures[i].serial=="1e:fe:65" and 1063224491<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Software Plugin Ltd." and pe.signatures [ i ] . serial == "1e:fe:65" and 1063224491 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52142,13 +52142,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Af7E2B6A3Deb99291Dcaf66 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f9c18796-995e-58f8-8406-9adcad143ae7"
+		id = "d1a5c8d5-17d4-55c6-9eb6-8d32b57fafa3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14476-L14492"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "270b5655a0f54abceb520eaca714ed4f6d4de720883e2759acd5bb2f027dfd2b"
+		logic_hash = "v1_sha256_270b5655a0f54abceb520eaca714ed4f6d4de720883e2759acd5bb2f027dfd2b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52158,7 +52158,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Af7E2B6A3Deb99291Dcaf66 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="0a:f7:e2:b6:a3:de:b9:92:91:dc:af:66" and 1474523112<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "0a:f7:e2:b6:a3:de:b9:92:91:dc:af:66" and 1474523112 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52167,13 +52167,13 @@ rule REVERSINGLABS_Cert_Blocklist_45E27C4Dfa5E6175566A13B1B6Ddf3F5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b4ab6397-5e15-5eb3-9f5d-658c5e3a7e3d"
+		id = "ffbdeff5-4fbc-567d-9563-67c142f384e1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14494-L14510"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9bcbb84207984b259463482f094bf0f3815f0d74317b6b864dab44769ff5e7e8"
+		logic_hash = "v1_sha256_9bcbb84207984b259463482f094bf0f3815f0d74317b6b864dab44769ff5e7e8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52183,7 +52183,7 @@ rule REVERSINGLABS_Cert_Blocklist_45E27C4Dfa5E6175566A13B1B6Ddf3F5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Selig Michael Irfan" and pe.signatures[i].serial=="45:e2:7c:4d:fa:5e:61:75:56:6a:13:b1:b6:dd:f3:f5" and 1465474542<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Selig Michael Irfan" and pe.signatures [ i ] . serial == "45:e2:7c:4d:fa:5e:61:75:56:6a:13:b1:b6:dd:f3:f5" and 1465474542 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52192,13 +52192,13 @@ rule REVERSINGLABS_Cert_Blocklist_37D36A4E61C0Ac68Ceb8Bfcef2Dbf283 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8fc73b48-6797-558a-8265-9aca396e899f"
+		id = "600fbb01-f65b-51f2-a269-684cc4cb00e6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14512-L14528"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "41e126600aae5646b808ed0a4294faa9a63e47842e9cde4fee9e5e65919af7ee"
+		logic_hash = "v1_sha256_41e126600aae5646b808ed0a4294faa9a63e47842e9cde4fee9e5e65919af7ee"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52208,7 +52208,7 @@ rule REVERSINGLABS_Cert_Blocklist_37D36A4E61C0Ac68Ceb8Bfcef2Dbf283 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ANAVERIS LIMITED" and pe.signatures[i].serial=="37:d3:6a:4e:61:c0:ac:68:ce:b8:bf:ce:f2:db:f2:83" and 1532476800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ANAVERIS LIMITED" and pe.signatures [ i ] . serial == "37:d3:6a:4e:61:c0:ac:68:ce:b8:bf:ce:f2:db:f2:83" and 1532476800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52217,13 +52217,13 @@ rule REVERSINGLABS_Cert_Blocklist_4321De10738278B93683Ca542407F103 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bf800655-cde4-59fa-9574-1055522fe074"
+		id = "8b5ecd67-93aa-50db-b753-86e16884ab15"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14530-L14546"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2787375605310877891ef924268f4660d1c8aa020e00674c1b1d7eb3c4f5b2fb"
+		logic_hash = "v1_sha256_2787375605310877891ef924268f4660d1c8aa020e00674c1b1d7eb3c4f5b2fb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52233,7 +52233,7 @@ rule REVERSINGLABS_Cert_Blocklist_4321De10738278B93683Ca542407F103 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "We Build Toolbars LLC" and pe.signatures[i].serial=="43:21:de:10:73:82:78:b9:36:83:ca:54:24:07:f1:03" and 1367884800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "We Build Toolbars LLC" and pe.signatures [ i ] . serial == "43:21:de:10:73:82:78:b9:36:83:ca:54:24:07:f1:03" and 1367884800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52242,13 +52242,13 @@ rule REVERSINGLABS_Cert_Blocklist_2A6B2Df210Be14F4E18E10C7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "150773ee-5d85-522d-a693-63bb6a7d1de2"
+		id = "33037c70-449b-5f5a-ae73-1cbd0fe4650c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14548-L14564"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "24ae1664c35b7947e2e638bf620d9ab572c70df9cdc1403cc00b422a45ff9194"
+		logic_hash = "v1_sha256_24ae1664c35b7947e2e638bf620d9ab572c70df9cdc1403cc00b422a45ff9194"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52258,7 +52258,7 @@ rule REVERSINGLABS_Cert_Blocklist_2A6B2Df210Be14F4E18E10C7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="2a:6b:2d:f2:10:be:14:f4:e1:8e:10:c7" and 1472095404<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "2a:6b:2d:f2:10:be:14:f4:e1:8e:10:c7" and 1472095404 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52267,13 +52267,13 @@ rule REVERSINGLABS_Cert_Blocklist_412Ab2A50E8028Ddcbc499Ddf45F2045 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "aabb3a66-5677-5359-9d81-92c8d4c7d910"
+		id = "d29ea38d-8442-5982-8bee-60f4f5c4f60a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14566-L14582"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a5b85d13dee51d68af28394ecee3dcc2efe7add4d26c2a8033d1855b33ac6271"
+		logic_hash = "v1_sha256_a5b85d13dee51d68af28394ecee3dcc2efe7add4d26c2a8033d1855b33ac6271"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52283,7 +52283,7 @@ rule REVERSINGLABS_Cert_Blocklist_412Ab2A50E8028Ddcbc499Ddf45F2045 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ding Ruan" and pe.signatures[i].serial=="41:2a:b2:a5:0e:80:28:dd:cb:c4:99:dd:f4:5f:20:45" and 1479340800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ding Ruan" and pe.signatures [ i ] . serial == "41:2a:b2:a5:0e:80:28:dd:cb:c4:99:dd:f4:5f:20:45" and 1479340800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52292,13 +52292,13 @@ rule REVERSINGLABS_Cert_Blocklist_0747F6A8C3542F954B113Fd98C7607Cf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "de5fbb40-7d41-5f3e-97c9-a6882c19ebb5"
+		id = "87373ffa-d416-5816-8c6f-c3153e89a588"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14584-L14600"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9d5e5c98f3ef372532cfc4f544d5d3f620dc2e49d8b6e1c96df29d2a38042019"
+		logic_hash = "v1_sha256_9d5e5c98f3ef372532cfc4f544d5d3f620dc2e49d8b6e1c96df29d2a38042019"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52308,7 +52308,7 @@ rule REVERSINGLABS_Cert_Blocklist_0747F6A8C3542F954B113Fd98C7607Cf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="07:47:f6:a8:c3:54:2f:95:4b:11:3f:d9:8c:76:07:cf" and 1474329600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "07:47:f6:a8:c3:54:2f:95:4b:11:3f:d9:8c:76:07:cf" and 1474329600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52317,13 +52317,13 @@ rule REVERSINGLABS_Cert_Blocklist_2572B484Fa0A61Be7288D785D7Bda7D3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b1d71baa-9100-512d-91f4-7286a740e5f2"
+		id = "0d512280-5702-5502-854e-110c0adcc670"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14602-L14618"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d6b23ba706a640a1e76ad7ab0a70c845c9366ac8355eea5439f76f6993c9c6be"
+		logic_hash = "v1_sha256_d6b23ba706a640a1e76ad7ab0a70c845c9366ac8355eea5439f76f6993c9c6be"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52333,7 +52333,7 @@ rule REVERSINGLABS_Cert_Blocklist_2572B484Fa0A61Be7288D785D7Bda7D3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SILVA, OOO" and pe.signatures[i].serial=="25:72:b4:84:fa:0a:61:be:72:88:d7:85:d7:bd:a7:d3" and 1495152000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SILVA, OOO" and pe.signatures [ i ] . serial == "25:72:b4:84:fa:0a:61:be:72:88:d7:85:d7:bd:a7:d3" and 1495152000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52342,13 +52342,13 @@ rule REVERSINGLABS_Cert_Blocklist_6726Bd04204746C46857887F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ef882d82-f535-57c3-9d45-8d47ecc7f607"
+		id = "6792a104-d47c-523d-890f-eebee8adc6c3"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14620-L14636"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "11d25dff7e05e6f97725e919cc6c978d7f2e64a91cf04b72461c71d592dfc2dc"
+		logic_hash = "v1_sha256_11d25dff7e05e6f97725e919cc6c978d7f2e64a91cf04b72461c71d592dfc2dc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52358,7 +52358,7 @@ rule REVERSINGLABS_Cert_Blocklist_6726Bd04204746C46857887F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="67:26:bd:04:20:47:46:c4:68:57:88:7f" and 1474352405<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "67:26:bd:04:20:47:46:c4:68:57:88:7f" and 1474352405 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52367,13 +52367,13 @@ rule REVERSINGLABS_Cert_Blocklist_4463D8B31E0F87C14233D4D0D2C487A0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "eefd6fa2-7ed7-51d0-bddd-90f0727a93cc"
+		id = "ced47c95-f379-5a36-9c96-a4f12e195c46"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14638-L14654"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "04ce664fceb4a617294e860d5364d8a4ce8e055fd2baebb8be69f258d9c70ac7"
+		logic_hash = "v1_sha256_04ce664fceb4a617294e860d5364d8a4ce8e055fd2baebb8be69f258d9c70ac7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52383,7 +52383,7 @@ rule REVERSINGLABS_Cert_Blocklist_4463D8B31E0F87C14233D4D0D2C487A0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="44:63:d8:b3:1e:0f:87:c1:42:33:d4:d0:d2:c4:87:a0" and 1477612800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "44:63:d8:b3:1e:0f:87:c1:42:33:d4:d0:d2:c4:87:a0" and 1477612800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52392,13 +52392,13 @@ rule REVERSINGLABS_Cert_Blocklist_387982605E542D6D52F231Ca6F5657Cc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2d5731e1-b18b-544e-ae14-40d70b679618"
+		id = "aea4f488-2be7-5a28-b119-8de650059a68"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14656-L14672"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d55cfd45bc0d330c0ed433a882874e4633ffbaa0d68288bea9058fe269d75ed9"
+		logic_hash = "v1_sha256_d55cfd45bc0d330c0ed433a882874e4633ffbaa0d68288bea9058fe269d75ed9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52408,7 +52408,7 @@ rule REVERSINGLABS_Cert_Blocklist_387982605E542D6D52F231Ca6F5657Cc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jiang Liu" and pe.signatures[i].serial=="38:79:82:60:5e:54:2d:6d:52:f2:31:ca:6f:56:57:cc" and 1475884800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Jiang Liu" and pe.signatures [ i ] . serial == "38:79:82:60:5e:54:2d:6d:52:f2:31:ca:6f:56:57:cc" and 1475884800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52417,13 +52417,13 @@ rule REVERSINGLABS_Cert_Blocklist_E0134C41E7Eda6863C4Eee5B003976Dd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "395c14fd-2fec-53ad-bc8e-2dd4bb3522d2"
+		id = "69fe4f68-a98c-514f-8103-e37f2066eedd"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14674-L14692"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fbe34baf52e3fa7d7cdfcfaef9b8851c4cbeb46d17eeade61750e59cf0c13291"
+		logic_hash = "v1_sha256_fbe34baf52e3fa7d7cdfcfaef9b8851c4cbeb46d17eeade61750e59cf0c13291"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52433,7 +52433,7 @@ rule REVERSINGLABS_Cert_Blocklist_E0134C41E7Eda6863C4Eee5B003976Dd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "5000 LIMITED" and (pe.signatures[i].serial=="00:e0:13:4c:41:e7:ed:a6:86:3c:4e:ee:5b:00:39:76:dd" or pe.signatures[i].serial=="e0:13:4c:41:e7:ed:a6:86:3c:4e:ee:5b:00:39:76:dd") and 1528070400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "5000 LIMITED" and ( pe.signatures [ i ] . serial == "00:e0:13:4c:41:e7:ed:a6:86:3c:4e:ee:5b:00:39:76:dd" or pe.signatures [ i ] . serial == "e0:13:4c:41:e7:ed:a6:86:3c:4e:ee:5b:00:39:76:dd" ) and 1528070400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52442,13 +52442,13 @@ rule REVERSINGLABS_Cert_Blocklist_5B47A4739Dd8Ffe81D9B5307 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9688b091-9a77-59c2-b7f9-a8b652201b8f"
+		id = "713a879b-0562-5db0-9ad2-12ceb74aa7fe"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14694-L14710"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5f35f520d4af26fa648553894a5b0db043d0c32302d94f531b6cb48691396a92"
+		logic_hash = "v1_sha256_5f35f520d4af26fa648553894a5b0db043d0c32302d94f531b6cb48691396a92"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52458,7 +52458,7 @@ rule REVERSINGLABS_Cert_Blocklist_5B47A4739Dd8Ffe81D9B5307 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="5b:47:a4:73:9d:d8:ff:e8:1d:9b:53:07" and 1476953007<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "5b:47:a4:73:9d:d8:ff:e8:1d:9b:53:07" and 1476953007 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52467,13 +52467,13 @@ rule REVERSINGLABS_Cert_Blocklist_4F5A9Bf75Da76B949645475473793A7D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "90cdf420-bdfc-509a-a64f-f30710f09f3b"
+		id = "4c2528be-50e0-56bd-8df0-9e79f7f3d4d2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14712-L14728"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8c58d30b1b6ef80409d9da5f5f4bc26a8818b01cc388b5966c8b68ed0e4c5a2a"
+		logic_hash = "v1_sha256_8c58d30b1b6ef80409d9da5f5f4bc26a8818b01cc388b5966c8b68ed0e4c5a2a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52483,7 +52483,7 @@ rule REVERSINGLABS_Cert_Blocklist_4F5A9Bf75Da76B949645475473793A7D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EXEC CONTROL LIMITED" and pe.signatures[i].serial=="4f:5a:9b:f7:5d:a7:6b:94:96:45:47:54:73:79:3a:7d" and 1553817600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EXEC CONTROL LIMITED" and pe.signatures [ i ] . serial == "4f:5a:9b:f7:5d:a7:6b:94:96:45:47:54:73:79:3a:7d" and 1553817600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52492,13 +52492,13 @@ rule REVERSINGLABS_Cert_Blocklist_081Df56C9A48D02571F08907 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4f4fb099-406a-5def-9a26-46c6807cfe7f"
+		id = "2ed5d1fc-93dc-50c5-8dca-29d88ce9c551"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14730-L14746"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "25d91f09e0731ab09a05855442b72589eb30e1c7d5e4c0a7af760eea540d786f"
+		logic_hash = "v1_sha256_25d91f09e0731ab09a05855442b72589eb30e1c7d5e4c0a7af760eea540d786f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52508,7 +52508,7 @@ rule REVERSINGLABS_Cert_Blocklist_081Df56C9A48D02571F08907 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="08:1d:f5:6c:9a:48:d0:25:71:f0:89:07" and 1474870728<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "08:1d:f5:6c:9a:48:d0:25:71:f0:89:07" and 1474870728 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52517,13 +52517,13 @@ rule REVERSINGLABS_Cert_Blocklist_77D5C1A3E623575999C74409Dc19753C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8f8ce24d-8330-509a-a7a1-2727c6f8bdd9"
+		id = "1082c8f3-65e8-57e5-8d7d-f45445b7e571"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14748-L14764"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "54921ce39a0876511b33ac6fa088c3342e2ea7fa037423fe72825bfe9c83bce6"
+		logic_hash = "v1_sha256_54921ce39a0876511b33ac6fa088c3342e2ea7fa037423fe72825bfe9c83bce6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52533,7 +52533,7 @@ rule REVERSINGLABS_Cert_Blocklist_77D5C1A3E623575999C74409Dc19753C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="77:d5:c1:a3:e6:23:57:59:99:c7:44:09:dc:19:75:3c" and 1475884800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "77:d5:c1:a3:e6:23:57:59:99:c7:44:09:dc:19:75:3c" and 1475884800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52542,13 +52542,13 @@ rule REVERSINGLABS_Cert_Blocklist_E9756B3F38B1172Ea89Fdbdfdba5F979 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "77d7470c-0c60-5ef4-b1d9-35642c147afe"
+		id = "e7d23767-3855-5d5f-9afe-05cdb469a430"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14766-L14784"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "997a9433f907896d82f22ae323bf9cfe9aa04a2a49c5505e98adbb34277fcc15"
+		logic_hash = "v1_sha256_997a9433f907896d82f22ae323bf9cfe9aa04a2a49c5505e98adbb34277fcc15"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52558,7 +52558,7 @@ rule REVERSINGLABS_Cert_Blocklist_E9756B3F38B1172Ea89Fdbdfdba5F979 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kreamer Ltd" and (pe.signatures[i].serial=="00:e9:75:6b:3f:38:b1:17:2e:a8:9f:db:df:db:a5:f9:79" or pe.signatures[i].serial=="e9:75:6b:3f:38:b1:17:2e:a8:9f:db:df:db:a5:f9:79") and 1492732800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kreamer Ltd" and ( pe.signatures [ i ] . serial == "00:e9:75:6b:3f:38:b1:17:2e:a8:9f:db:df:db:a5:f9:79" or pe.signatures [ i ] . serial == "e9:75:6b:3f:38:b1:17:2e:a8:9f:db:df:db:a5:f9:79" ) and 1492732800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52567,13 +52567,13 @@ rule REVERSINGLABS_Cert_Blocklist_09Fb28 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e7701457-c6cd-5b20-b227-8a9cdcde8213"
+		id = "0dc6599e-9add-5823-89cd-7fe3f84f9a1e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14786-L14802"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5ed65d33b73977e869460ba51271aff94811fa2f41e4a2993c47233add2f38dd"
+		logic_hash = "v1_sha256_5ed65d33b73977e869460ba51271aff94811fa2f41e4a2993c47233add2f38dd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52583,7 +52583,7 @@ rule REVERSINGLABS_Cert_Blocklist_09Fb28 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "New Dial spa" and pe.signatures[i].serial=="09:fb:28" and 1046968418<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "New Dial spa" and pe.signatures [ i ] . serial == "09:fb:28" and 1046968418 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52592,13 +52592,13 @@ rule REVERSINGLABS_Cert_Blocklist_197Dc32D915458953562D2Fe78Bf2468 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9c25410f-6a3d-5e6e-b270-ccec3be34e80"
+		id = "db15dea9-d670-571d-85b0-c544c570fce0"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14804-L14820"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e61284a74765592fe97b90ca1c260efa46ea31286e6d09ab32d6c664b8271f2a"
+		logic_hash = "v1_sha256_e61284a74765592fe97b90ca1c260efa46ea31286e6d09ab32d6c664b8271f2a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52608,7 +52608,7 @@ rule REVERSINGLABS_Cert_Blocklist_197Dc32D915458953562D2Fe78Bf2468 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Y.L. Knafo, Ltd." and pe.signatures[i].serial=="19:7d:c3:2d:91:54:58:95:35:62:d2:fe:78:bf:24:68" and 1575331200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Y.L. Knafo, Ltd." and pe.signatures [ i ] . serial == "19:7d:c3:2d:91:54:58:95:35:62:d2:fe:78:bf:24:68" and 1575331200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52617,13 +52617,13 @@ rule REVERSINGLABS_Cert_Blocklist_7C0Be3D14787351E3156F5F37F2B3663 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "14a292da-36c1-5a37-b27e-20c982e44c25"
+		id = "1a814dfa-21ed-53c2-b31a-7e6159a0d12c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14822-L14838"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "66c2cd84fccedd2afef00495c49d0c2844e2e5e190e6a859d2970e8ddb4a35c2"
+		logic_hash = "v1_sha256_66c2cd84fccedd2afef00495c49d0c2844e2e5e190e6a859d2970e8ddb4a35c2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52633,7 +52633,7 @@ rule REVERSINGLABS_Cert_Blocklist_7C0Be3D14787351E3156F5F37F2B3663 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Apex Tech, SIA" and pe.signatures[i].serial=="7c:0b:e3:d1:47:87:35:1e:31:56:f5:f3:7f:2b:36:63" and 1523318400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Apex Tech, SIA" and pe.signatures [ i ] . serial == "7c:0b:e3:d1:47:87:35:1e:31:56:f5:f3:7f:2b:36:63" and 1523318400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52642,13 +52642,13 @@ rule REVERSINGLABS_Cert_Blocklist_05054Fdea356F3Dd7Db479Fa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c78d42bc-f8ca-579a-af49-ba9c7b63ef07"
+		id = "36dd4606-2c92-5718-8bec-850b8e700dab"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14840-L14856"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "02ec52e060a6b8b3edfad0a1f5b1f2d6c409645d5233612d0d353ad74bcd4568"
+		logic_hash = "v1_sha256_02ec52e060a6b8b3edfad0a1f5b1f2d6c409645d5233612d0d353ad74bcd4568"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52658,7 +52658,7 @@ rule REVERSINGLABS_Cert_Blocklist_05054Fdea356F3Dd7Db479Fa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="05:05:4f:de:a3:56:f3:dd:7d:b4:79:fa" and 1474436511<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "05:05:4f:de:a3:56:f3:dd:7d:b4:79:fa" and 1474436511 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52667,13 +52667,13 @@ rule REVERSINGLABS_Cert_Blocklist_08Aaa069E92517F21Ce67Ca713F6Ea63 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d468530e-8a51-583e-a108-e409f0144165"
+		id = "9758a8b0-bf03-526d-9346-d2784f22b5bb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14858-L14874"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "28ad7e9c75a701425003cde4a7eb10fa471394628cd5004412778d8d7cddb50b"
+		logic_hash = "v1_sha256_28ad7e9c75a701425003cde4a7eb10fa471394628cd5004412778d8d7cddb50b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52683,7 +52683,7 @@ rule REVERSINGLABS_Cert_Blocklist_08Aaa069E92517F21Ce67Ca713F6Ea63 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "pioneersoft" and pe.signatures[i].serial=="08:aa:a0:69:e9:25:17:f2:1c:e6:7c:a7:13:f6:ea:63" and 1368403200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "pioneersoft" and pe.signatures [ i ] . serial == "08:aa:a0:69:e9:25:17:f2:1c:e6:7c:a7:13:f6:ea:63" and 1368403200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52692,13 +52692,13 @@ rule REVERSINGLABS_Cert_Blocklist_1B7B54E0Dd4D7E45A0B46834De52658D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "376da749-3cd4-5e37-b1ee-013e839f98ce"
+		id = "e8ab312c-e192-507f-97f1-38fbe226be45"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14876-L14892"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5febbce8c39440bfc4846f509f0b1dd4f71a8b4dc24fa18afb561d26e53c2446"
+		logic_hash = "v1_sha256_5febbce8c39440bfc4846f509f0b1dd4f71a8b4dc24fa18afb561d26e53c2446"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52708,7 +52708,7 @@ rule REVERSINGLABS_Cert_Blocklist_1B7B54E0Dd4D7E45A0B46834De52658D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="1b:7b:54:e0:dd:4d:7e:45:a0:b4:68:34:de:52:65:8d" and 1476662400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "1b:7b:54:e0:dd:4d:7e:45:a0:b4:68:34:de:52:65:8d" and 1476662400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52717,13 +52717,13 @@ rule REVERSINGLABS_Cert_Blocklist_B63E4299D0B0E2Dcdaeb976167A23235 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "44af31cc-e0c9-5f3f-9645-a0453bc81e62"
+		id = "6c082d8d-cb84-5bb4-a6d2-7fa935b9d9fc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14894-L14912"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "da7415d0bc0245dea6a4ec325da5140c79c723c20fb7c04ff14f59a3089a5c88"
+		logic_hash = "v1_sha256_da7415d0bc0245dea6a4ec325da5140c79c723c20fb7c04ff14f59a3089a5c88"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52733,7 +52733,7 @@ rule REVERSINGLABS_Cert_Blocklist_B63E4299D0B0E2Dcdaeb976167A23235 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Baltservis LLC" and (pe.signatures[i].serial=="00:b6:3e:42:99:d0:b0:e2:dc:da:eb:97:61:67:a2:32:35" or pe.signatures[i].serial=="b6:3e:42:99:d0:b0:e2:dc:da:eb:97:61:67:a2:32:35") and 1604102400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Baltservis LLC" and ( pe.signatures [ i ] . serial == "00:b6:3e:42:99:d0:b0:e2:dc:da:eb:97:61:67:a2:32:35" or pe.signatures [ i ] . serial == "b6:3e:42:99:d0:b0:e2:dc:da:eb:97:61:67:a2:32:35" ) and 1604102400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52742,13 +52742,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Dabae616705F5A51152Eac48423F354 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8b050402-d5d3-5733-9a72-02386d850a04"
+		id = "cceeb5bc-dd0f-5360-ad5a-1c4d60f4ed8b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14914-L14930"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0bb14ececa3a78e1a2e71cfdee8bc57678251b15151d156ef5fa754b2438ee35"
+		logic_hash = "v1_sha256_0bb14ececa3a78e1a2e71cfdee8bc57678251b15151d156ef5fa754b2438ee35"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52758,7 +52758,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Dabae616705F5A51152Eac48423F354 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="1d:ab:ae:61:67:05:f5:a5:11:52:ea:c4:84:23:f3:54" and 1470960000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "1d:ab:ae:61:67:05:f5:a5:11:52:ea:c4:84:23:f3:54" and 1470960000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52767,13 +52767,13 @@ rule REVERSINGLABS_Cert_Blocklist_50D08F3C9Bf86Fba52Cf592B4Fe6Eacf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f315cdda-4b95-534d-94db-9a04e2da6385"
+		id = "c20c204a-2510-5111-92aa-36b38ff4996c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14932-L14948"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ca613e4b45b9bb1ef7564b9fc6321bccc0f683298de692a3db2bf841db9010ef"
+		logic_hash = "v1_sha256_ca613e4b45b9bb1ef7564b9fc6321bccc0f683298de692a3db2bf841db9010ef"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52783,7 +52783,7 @@ rule REVERSINGLABS_Cert_Blocklist_50D08F3C9Bf86Fba52Cf592B4Fe6Eacf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CLEVERCYBER LTD" and pe.signatures[i].serial=="50:d0:8f:3c:9b:f8:6f:ba:52:cf:59:2b:4f:e6:ea:cf" and 1518134400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CLEVERCYBER LTD" and pe.signatures [ i ] . serial == "50:d0:8f:3c:9b:f8:6f:ba:52:cf:59:2b:4f:e6:ea:cf" and 1518134400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52792,13 +52792,13 @@ rule REVERSINGLABS_Cert_Blocklist_7C7Fc3616F3157A28F702Cc1Df275Dcd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "78d2adb9-fc1c-5f48-80cb-3f1bd12b6ba5"
+		id = "7fb866fd-b542-5619-ac6a-5e7d4753922e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14950-L14966"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c2dcea21c7a3e3aef6408f11c23edbce6d8f655f298654552a607a9b0caabb28"
+		logic_hash = "v1_sha256_c2dcea21c7a3e3aef6408f11c23edbce6d8f655f298654552a607a9b0caabb28"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52808,7 +52808,7 @@ rule REVERSINGLABS_Cert_Blocklist_7C7Fc3616F3157A28F702Cc1Df275Dcd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CFES Projects Ltd" and pe.signatures[i].serial=="7c:7f:c3:61:6f:31:57:a2:8f:70:2c:c1:df:27:5d:cd" and 1522972800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CFES Projects Ltd" and pe.signatures [ i ] . serial == "7c:7f:c3:61:6f:31:57:a2:8f:70:2c:c1:df:27:5d:cd" and 1522972800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52817,13 +52817,13 @@ rule REVERSINGLABS_Cert_Blocklist_73Ed1B2F4Bf8Dd37A8Ad9Bb775774592 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "19c9e100-b017-5b5c-8e8f-c94ea9e228c2"
+		id = "6ae10b54-cef2-59a1-8d76-77a02e22130e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14968-L14984"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "69865935e07ea255a5d690e170911b33574ea61550b00bebc2ceff91ba9a33da"
+		logic_hash = "v1_sha256_69865935e07ea255a5d690e170911b33574ea61550b00bebc2ceff91ba9a33da"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52833,7 +52833,7 @@ rule REVERSINGLABS_Cert_Blocklist_73Ed1B2F4Bf8Dd37A8Ad9Bb775774592 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "5000 LIMITED" and pe.signatures[i].serial=="73:ed:1b:2f:4b:f8:dd:37:a8:ad:9b:b7:75:77:45:92" and 1528243200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "5000 LIMITED" and pe.signatures [ i ] . serial == "73:ed:1b:2f:4b:f8:dd:37:a8:ad:9b:b7:75:77:45:92" and 1528243200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52842,13 +52842,13 @@ rule REVERSINGLABS_Cert_Blocklist_211B5Dfe65Bc6F34Bc9D3A54 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5181b6e4-6a25-58f6-88c5-0eae98250648"
+		id = "301e01ac-2c13-596b-9a67-11d02eecd0db"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L14986-L15002"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cf2e4c0dd98efb77c28b63641196c83e60afc0d6ab64802743c351581506dbb5"
+		logic_hash = "v1_sha256_cf2e4c0dd98efb77c28b63641196c83e60afc0d6ab64802743c351581506dbb5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52858,7 +52858,7 @@ rule REVERSINGLABS_Cert_Blocklist_211B5Dfe65Bc6F34Bc9D3A54 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RAFO TECHNOLOGY INC" and pe.signatures[i].serial=="21:1b:5d:fe:65:bc:6f:34:bc:9d:3a:54" and 1526717931<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RAFO TECHNOLOGY INC" and pe.signatures [ i ] . serial == "21:1b:5d:fe:65:bc:6f:34:bc:9d:3a:54" and 1526717931 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52867,13 +52867,13 @@ rule REVERSINGLABS_Cert_Blocklist_5400D1C1406528B1Ef625976 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2b35f2db-ebf1-5533-858c-644dbd6dfb2b"
+		id = "23de6ff7-d94d-527c-9fb1-a47aacff6138"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15004-L15020"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fbdd37e050d68c4287e897f050a673aea071df105a35b07475d3233da3f03feb"
+		logic_hash = "v1_sha256_fbdd37e050d68c4287e897f050a673aea071df105a35b07475d3233da3f03feb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52883,7 +52883,7 @@ rule REVERSINGLABS_Cert_Blocklist_5400D1C1406528B1Ef625976 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="54:00:d1:c1:40:65:28:b1:ef:62:59:76" and 1474266628<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "54:00:d1:c1:40:65:28:b1:ef:62:59:76" and 1474266628 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52892,13 +52892,13 @@ rule REVERSINGLABS_Cert_Blocklist_013472D7D665557Bfa0Dc21B350A361B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9b63f06d-9808-5936-aad2-d387c74eccdd"
+		id = "d181bff1-6265-5d47-85bf-26cb0f553a25"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15022-L15038"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ab908ef0fca56753bcba8bc85e2fdf5859b4e226c179ec5c6eb6eb3dc4014a8e"
+		logic_hash = "v1_sha256_ab908ef0fca56753bcba8bc85e2fdf5859b4e226c179ec5c6eb6eb3dc4014a8e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52908,7 +52908,7 @@ rule REVERSINGLABS_Cert_Blocklist_013472D7D665557Bfa0Dc21B350A361B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yongli Zhang" and pe.signatures[i].serial=="01:34:72:d7:d6:65:55:7b:fa:0d:c2:1b:35:0a:36:1b" and 1470960000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yongli Zhang" and pe.signatures [ i ] . serial == "01:34:72:d7:d6:65:55:7b:fa:0d:c2:1b:35:0a:36:1b" and 1470960000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52917,13 +52917,13 @@ rule REVERSINGLABS_Cert_Blocklist_66C758A22Bfbbce327616815616Ddd07 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4a7130ad-8b66-52a1-afd2-6d10776b4451"
+		id = "56159231-f06d-57ba-a6fd-b913a027947d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15040-L15056"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "37f0f64e2d84ef6591e1f07a05abca35b37827d26c828269fb5f38d8546a60a7"
+		logic_hash = "v1_sha256_37f0f64e2d84ef6591e1f07a05abca35b37827d26c828269fb5f38d8546a60a7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52933,7 +52933,7 @@ rule REVERSINGLABS_Cert_Blocklist_66C758A22Bfbbce327616815616Ddd07 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TIM Konstrakshn, TOV" and pe.signatures[i].serial=="66:c7:58:a2:2b:fb:bc:e3:27:61:68:15:61:6d:dd:07" and 1469404800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TIM Konstrakshn, TOV" and pe.signatures [ i ] . serial == "66:c7:58:a2:2b:fb:bc:e3:27:61:68:15:61:6d:dd:07" and 1469404800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52942,13 +52942,13 @@ rule REVERSINGLABS_Cert_Blocklist_E61B0366D940896430Bcfe3E93Baac5B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "24eb38c1-48a5-5d9b-a42d-345c4fda6c36"
+		id = "9025cf63-6274-597f-9c54-5adbd3f40eaf"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15058-L15076"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1b1fd0c2237446ab22c7359d1e89d822a4b9b6ad345447740154d7d52635c2ea"
+		logic_hash = "v1_sha256_1b1fd0c2237446ab22c7359d1e89d822a4b9b6ad345447740154d7d52635c2ea"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52958,7 +52958,7 @@ rule REVERSINGLABS_Cert_Blocklist_E61B0366D940896430Bcfe3E93Baac5B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRANS LTD" and (pe.signatures[i].serial=="00:e6:1b:03:66:d9:40:89:64:30:bc:fe:3e:93:ba:ac:5b" or pe.signatures[i].serial=="e6:1b:03:66:d9:40:89:64:30:bc:fe:3e:93:ba:ac:5b") and 1528156800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TRANS LTD" and ( pe.signatures [ i ] . serial == "00:e6:1b:03:66:d9:40:89:64:30:bc:fe:3e:93:ba:ac:5b" or pe.signatures [ i ] . serial == "e6:1b:03:66:d9:40:89:64:30:bc:fe:3e:93:ba:ac:5b" ) and 1528156800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52967,13 +52967,13 @@ rule REVERSINGLABS_Cert_Blocklist_6294B8Acc35Dea7D32A95Ac5D4536F8F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bc380123-20fc-55de-ad1c-4f13ac173cc9"
+		id = "88b72c24-de02-50f6-af2f-7d4533a42b6c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15078-L15094"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ac92ff8e533121071a620ca5280ae66629576f9c4af9831ddac5bb487e4348af"
+		logic_hash = "v1_sha256_ac92ff8e533121071a620ca5280ae66629576f9c4af9831ddac5bb487e4348af"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -52983,7 +52983,7 @@ rule REVERSINGLABS_Cert_Blocklist_6294B8Acc35Dea7D32A95Ac5D4536F8F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE9\\x87\\x8D\\xE5\\xBA\\x86\\xE6\\x8E\\xA2\\xE9\\x95\\xBF\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="62:94:b8:ac:c3:5d:ea:7d:32:a9:5a:c5:d4:53:6f:8f" and 1517443200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE9\\x87\\x8D\\xE5\\xBA\\x86\\xE6\\x8E\\xA2\\xE9\\x95\\xBF\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "62:94:b8:ac:c3:5d:ea:7d:32:a9:5a:c5:d4:53:6f:8f" and 1517443200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -52992,13 +52992,13 @@ rule REVERSINGLABS_Cert_Blocklist_485E4626C32493C16283Cfd9E30D17Ad : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7e6834e5-ce32-5ba6-82cf-99d7b90fb4f0"
+		id = "b047f50b-0aaf-55ff-8bbd-0aab08884564"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15096-L15112"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "faf860786e8473493d24abf6e61cf0b906e98d786516be6d2098181368214020"
+		logic_hash = "v1_sha256_faf860786e8473493d24abf6e61cf0b906e98d786516be6d2098181368214020"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53008,7 +53008,7 @@ rule REVERSINGLABS_Cert_Blocklist_485E4626C32493C16283Cfd9E30D17Ad : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="48:5e:46:26:c3:24:93:c1:62:83:cf:d9:e3:0d:17:ad" and 1473292800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "48:5e:46:26:c3:24:93:c1:62:83:cf:d9:e3:0d:17:ad" and 1473292800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53017,13 +53017,13 @@ rule REVERSINGLABS_Cert_Blocklist_D0312F9177Cd46B943Df3Ef22Db4608B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b36ba3c9-4a64-505a-ae27-ec8ee969dc29"
+		id = "e856c8fb-2c6e-534f-bb30-e469f5ec15f2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15114-L15132"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2eb955e91c927980cee031c6284e48bad315e891c32cdaf41b844090e841c44d"
+		logic_hash = "v1_sha256_2eb955e91c927980cee031c6284e48bad315e891c32cdaf41b844090e841c44d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53033,7 +53033,7 @@ rule REVERSINGLABS_Cert_Blocklist_D0312F9177Cd46B943Df3Ef22Db4608B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "United Systems Technology, Inc." and (pe.signatures[i].serial=="00:d0:31:2f:91:77:cd:46:b9:43:df:3e:f2:2d:b4:60:8b" or pe.signatures[i].serial=="d0:31:2f:91:77:cd:46:b9:43:df:3e:f2:2d:b4:60:8b") and 1341273600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "United Systems Technology, Inc." and ( pe.signatures [ i ] . serial == "00:d0:31:2f:91:77:cd:46:b9:43:df:3e:f2:2d:b4:60:8b" or pe.signatures [ i ] . serial == "d0:31:2f:91:77:cd:46:b9:43:df:3e:f2:2d:b4:60:8b" ) and 1341273600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53042,13 +53042,13 @@ rule REVERSINGLABS_Cert_Blocklist_202702 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "befb8867-37d6-5b0a-9801-c069b92f8edc"
+		id = "cb88737f-3370-5990-b3c6-a765a9d3ae60"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15134-L15150"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bc097e97c1c4c4a71cbf66be811636fecfa23682cb2cc47ab1fcd680a646fb14"
+		logic_hash = "v1_sha256_bc097e97c1c4c4a71cbf66be811636fecfa23682cb2cc47ab1fcd680a646fb14"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53058,7 +53058,7 @@ rule REVERSINGLABS_Cert_Blocklist_202702 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RDCTO Ltd" and pe.signatures[i].serial=="20:27:02" and 1087391361<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RDCTO Ltd" and pe.signatures [ i ] . serial == "20:27:02" and 1087391361 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53067,13 +53067,13 @@ rule REVERSINGLABS_Cert_Blocklist_369A02E5D90B2649040E7F87 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2b81466f-3eb1-5c12-8878-9257dde968fb"
+		id = "0442a302-2c79-52e1-accd-44962339af9a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15152-L15168"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e2a2e231914f166410580a42ca9d4aac18c5cba94d1f11d22e7acd6d375851d8"
+		logic_hash = "v1_sha256_e2a2e231914f166410580a42ca9d4aac18c5cba94d1f11d22e7acd6d375851d8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53083,7 +53083,7 @@ rule REVERSINGLABS_Cert_Blocklist_369A02E5D90B2649040E7F87 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="36:9a:02:e5:d9:0b:26:49:04:0e:7f:87" and 1479094204<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "36:9a:02:e5:d9:0b:26:49:04:0e:7f:87" and 1479094204 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53092,13 +53092,13 @@ rule REVERSINGLABS_Cert_Blocklist_60497070Ff4A83Bc87Bdea24Da5B431D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "510ab702-103b-5863-ac9a-46a917879e72"
+		id = "d80b8435-311e-5a42-a830-1413dc300b28"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15170-L15186"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "30998e3f5299a37cdee83b1232249b84dbb3c154ef99237da5ce1b16f9db5da3"
+		logic_hash = "v1_sha256_30998e3f5299a37cdee83b1232249b84dbb3c154ef99237da5ce1b16f9db5da3"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53108,7 +53108,7 @@ rule REVERSINGLABS_Cert_Blocklist_60497070Ff4A83Bc87Bdea24Da5B431D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="60:49:70:70:ff:4a:83:bc:87:bd:ea:24:da:5b:43:1d" and 1477008000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "60:49:70:70:ff:4a:83:bc:87:bd:ea:24:da:5b:43:1d" and 1477008000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53117,13 +53117,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A333E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5eaac242-ca22-5c73-9027-308d351080bf"
+		id = "ad94e250-1cd1-57c5-8e04-9b9ab98f446d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15188-L15204"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f76d21e0ae2cf9b28825c813fc509d533c10aba38f8f0c2884365047c1272c1f"
+		logic_hash = "v1_sha256_f76d21e0ae2cf9b28825c813fc509d533c10aba38f8f0c2884365047c1272c1f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53133,7 +53133,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A333E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Coulomb Limited" and pe.signatures[i].serial=="0a:33:3e" and 1052750648<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Coulomb Limited" and pe.signatures [ i ] . serial == "0a:33:3e" and 1052750648 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53142,13 +53142,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Cb6519B2528D006D1Da987153Dad2B3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "774e28f7-46ba-533d-a73c-00d2536c7d2b"
+		id = "eb68bdc7-bc08-5990-a901-83d6aca820a2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15206-L15222"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "776402fc3a7de4843373bc1981f965fe9c2a9f1fe2374b142a96952fd05a591b"
+		logic_hash = "v1_sha256_776402fc3a7de4843373bc1981f965fe9c2a9f1fe2374b142a96952fd05a591b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53158,7 +53158,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Cb6519B2528D006D1Da987153Dad2B3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "D and D Internet Services" and pe.signatures[i].serial=="1c:b6:51:9b:25:28:d0:06:d1:da:98:71:53:da:d2:b3" and 1012780800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "D and D Internet Services" and pe.signatures [ i ] . serial == "1c:b6:51:9b:25:28:d0:06:d1:da:98:71:53:da:d2:b3" and 1012780800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53167,13 +53167,13 @@ rule REVERSINGLABS_Cert_Blocklist_621E696C3A6371E77A678Cbf0Ee34Ab2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "606749dc-f4ef-526a-8583-486401866759"
+		id = "0d57ef1b-adfa-5139-b594-c838c3e91286"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15224-L15240"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "67c9fd92681d6dd1172509113e167e74e07f1f86fd62456758b3e3930180b528"
+		logic_hash = "v1_sha256_67c9fd92681d6dd1172509113e167e74e07f1f86fd62456758b3e3930180b528"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53183,7 +53183,7 @@ rule REVERSINGLABS_Cert_Blocklist_621E696C3A6371E77A678Cbf0Ee34Ab2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="62:1e:69:6c:3a:63:71:e7:7a:67:8c:bf:0e:e3:4a:b2" and 1467072000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "62:1e:69:6c:3a:63:71:e7:7a:67:8c:bf:0e:e3:4a:b2" and 1467072000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53192,13 +53192,13 @@ rule REVERSINGLABS_Cert_Blocklist_21B991 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "333a0901-21e7-5b4a-8daa-6a04fc2c4e86"
+		id = "2383e664-f818-5d58-9a52-c47d2a50302e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15242-L15258"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "54ca9b19adfc9357a3fb74f0670ad929319c4d06a7de7ae400f8285a31052276"
+		logic_hash = "v1_sha256_54ca9b19adfc9357a3fb74f0670ad929319c4d06a7de7ae400f8285a31052276"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53208,7 +53208,7 @@ rule REVERSINGLABS_Cert_Blocklist_21B991 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Web Nexus d.o.o." and pe.signatures[i].serial=="21:b9:91" and 1125477041<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Web Nexus d.o.o." and pe.signatures [ i ] . serial == "21:b9:91" and 1125477041 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53217,13 +53217,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Cc37De5Dbed097F98F56Dbc : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8c362133-a30f-599d-88e0-a1448433178a"
+		id = "e047ff92-dab8-5dd6-a944-da5029f9fd70"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15260-L15276"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a2d04275b9fe37308c8f1dca75f4cc3c4a8985930f901e1f46e3ddc2977eea32"
+		logic_hash = "v1_sha256_a2d04275b9fe37308c8f1dca75f4cc3c4a8985930f901e1f46e3ddc2977eea32"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53233,7 +53233,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Cc37De5Dbed097F98F56Dbc : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="1c:c3:7d:e5:db:ed:09:7f:98:f5:6d:bc" and 1476693977<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "1c:c3:7d:e5:db:ed:09:7f:98:f5:6d:bc" and 1476693977 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53242,13 +53242,13 @@ rule REVERSINGLABS_Cert_Blocklist_50F66Ab0D7Ed19B69D48F635E69572Fa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9938b4c5-4a2b-5f4a-92a0-28c3519b1ed3"
+		id = "104a1b03-f087-5196-9d02-d14de8d21ae5"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15278-L15294"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "28f71c0572e769d4a0cb289071912bc79cddfd98a3a8161c5400c7bee7090bf5"
+		logic_hash = "v1_sha256_28f71c0572e769d4a0cb289071912bc79cddfd98a3a8161c5400c7bee7090bf5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53258,7 +53258,7 @@ rule REVERSINGLABS_Cert_Blocklist_50F66Ab0D7Ed19B69D48F635E69572Fa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Wei Liu" and pe.signatures[i].serial=="50:f6:6a:b0:d7:ed:19:b6:9d:48:f6:35:e6:95:72:fa" and 1467158400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Wei Liu" and pe.signatures [ i ] . serial == "50:f6:6a:b0:d7:ed:19:b6:9d:48:f6:35:e6:95:72:fa" and 1467158400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53267,13 +53267,13 @@ rule REVERSINGLABS_Cert_Blocklist_11212F502836A784752160351Defb136Cf09 : INFO FI
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7609083d-145b-5594-a04b-72c2862873eb"
+		id = "597d0b5d-1be6-585d-8d07-dfb30b500438"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15296-L15312"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "63d4c1aaafdf6de14d0ae78035644cf6b0fefab8b0063d2566ca38af9f9498d2"
+		logic_hash = "v1_sha256_63d4c1aaafdf6de14d0ae78035644cf6b0fefab8b0063d2566ca38af9f9498d2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53283,7 +53283,7 @@ rule REVERSINGLABS_Cert_Blocklist_11212F502836A784752160351Defb136Cf09 : INFO FI
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EVANGEL TECHNOLOGY(HK) LIMITED" and pe.signatures[i].serial=="11:21:2f:50:28:36:a7:84:75:21:60:35:1d:ef:b1:36:cf:09" and 1463726573<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EVANGEL TECHNOLOGY(HK) LIMITED" and pe.signatures [ i ] . serial == "11:21:2f:50:28:36:a7:84:75:21:60:35:1d:ef:b1:36:cf:09" and 1463726573 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53292,13 +53292,13 @@ rule REVERSINGLABS_Cert_Blocklist_2C16Be9A7Ce2A23Ab7A4B4Eb7Da3400C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4e17aed7-fd76-549f-bcf7-84c97efc44e4"
+		id = "9d4c474f-a684-5c02-b4f2-05bbaf36851c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15314-L15330"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "917f324cbe91718efc9b2f41ef947fa8f1a501dde319936774d702d57b1e6b37"
+		logic_hash = "v1_sha256_917f324cbe91718efc9b2f41ef947fa8f1a501dde319936774d702d57b1e6b37"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53308,7 +53308,7 @@ rule REVERSINGLABS_Cert_Blocklist_2C16Be9A7Ce2A23Ab7A4B4Eb7Da3400C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Prince city music bar" and pe.signatures[i].serial=="2c:16:be:9a:7c:e2:a2:3a:b7:a4:b4:eb:7d:a3:40:0c" and 1371081600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Prince city music bar" and pe.signatures [ i ] . serial == "2c:16:be:9a:7c:e2:a2:3a:b7:a4:b4:eb:7d:a3:40:0c" and 1371081600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53317,13 +53317,13 @@ rule REVERSINGLABS_Cert_Blocklist_22Accad235Fb1Ac7422Ebe5Ea7Ac9Bc5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "218543f3-298f-5038-8fa9-3abeda9e4d8f"
+		id = "0d13dc14-2c84-55b0-bd1f-4086f424c257"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15332-L15348"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b348c502aeae036f6d17283260ed4479427f89c8c25f2b6d59e137e90694dbe4"
+		logic_hash = "v1_sha256_b348c502aeae036f6d17283260ed4479427f89c8c25f2b6d59e137e90694dbe4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53333,7 +53333,7 @@ rule REVERSINGLABS_Cert_Blocklist_22Accad235Fb1Ac7422Ebe5Ea7Ac9Bc5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IMS INTERACTIVE MEDIA SOLUTIONS" and pe.signatures[i].serial=="22:ac:ca:d2:35:fb:1a:c7:42:2e:be:5e:a7:ac:9b:c5" and 1019001600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IMS INTERACTIVE MEDIA SOLUTIONS" and pe.signatures [ i ] . serial == "22:ac:ca:d2:35:fb:1a:c7:42:2e:be:5e:a7:ac:9b:c5" and 1019001600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53342,13 +53342,13 @@ rule REVERSINGLABS_Cert_Blocklist_4D29757C4Fbfc32B97091D96E3723002 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e1834597-4e45-5866-97f4-e00c79190930"
+		id = "95edd9f4-cda9-5f87-8d95-c9d995962094"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15350-L15366"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "78ede4b02cb1b07500cd0c4f1f33da598938940d0f58430edda00d79b19b16a5"
+		logic_hash = "v1_sha256_78ede4b02cb1b07500cd0c4f1f33da598938940d0f58430edda00d79b19b16a5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53358,7 +53358,7 @@ rule REVERSINGLABS_Cert_Blocklist_4D29757C4Fbfc32B97091D96E3723002 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="4d:29:75:7c:4f:bf:c3:2b:97:09:1d:96:e3:72:30:02" and 1474848000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "4d:29:75:7c:4f:bf:c3:2b:97:09:1d:96:e3:72:30:02" and 1474848000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53367,13 +53367,13 @@ rule REVERSINGLABS_Cert_Blocklist_3A949Ef03D9Dd2D150B24B274Ff6D7B4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6ea47017-1296-5409-8ff2-ef69434233ff"
+		id = "41adf049-7cfb-5f5f-bcf4-1ac7d16f6035"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15368-L15384"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "88c63a921a300e1b985d084c3ab1a2485713b4c674dafd419d092e5562f121d7"
+		logic_hash = "v1_sha256_88c63a921a300e1b985d084c3ab1a2485713b4c674dafd419d092e5562f121d7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53383,7 +53383,7 @@ rule REVERSINGLABS_Cert_Blocklist_3A949Ef03D9Dd2D150B24B274Ff6D7B4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="3a:94:9e:f0:3d:9d:d2:d1:50:b2:4b:27:4f:f6:d7:b4" and 1474156800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "3a:94:9e:f0:3d:9d:d2:d1:50:b2:4b:27:4f:f6:d7:b4" and 1474156800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53392,13 +53392,13 @@ rule REVERSINGLABS_Cert_Blocklist_954D0577D5Ce8999E0387A5364829F66 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "70e770dd-95fd-5273-b6ee-9bb5eea30e3b"
+		id = "62e9febe-fdf7-5a96-b721-2739e5fc290d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15386-L15404"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "84ddc08a0a55200f644778a0e3482f15e82d74c524f12a7ad91b1c3d4acfc731"
+		logic_hash = "v1_sha256_84ddc08a0a55200f644778a0e3482f15e82d74c524f12a7ad91b1c3d4acfc731"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53408,7 +53408,7 @@ rule REVERSINGLABS_Cert_Blocklist_954D0577D5Ce8999E0387A5364829F66 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Soblosol Limited" and (pe.signatures[i].serial=="00:95:4d:05:77:d5:ce:89:99:e0:38:7a:53:64:82:9f:66" or pe.signatures[i].serial=="95:4d:05:77:d5:ce:89:99:e0:38:7a:53:64:82:9f:66") and 1543968000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Soblosol Limited" and ( pe.signatures [ i ] . serial == "00:95:4d:05:77:d5:ce:89:99:e0:38:7a:53:64:82:9f:66" or pe.signatures [ i ] . serial == "95:4d:05:77:d5:ce:89:99:e0:38:7a:53:64:82:9f:66" ) and 1543968000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53417,13 +53417,13 @@ rule REVERSINGLABS_Cert_Blocklist_Df5121Dc99D1Ab6B7E5229F6832123Ef : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8dfc50be-7316-5a52-937b-4551aa642b7e"
+		id = "4448b62d-8c44-5a4b-b887-da4934ba1893"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15406-L15424"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3b5e5b81890f1dea3dc0858cade54e7f88a21861818be79c3e7fba066f80d491"
+		logic_hash = "v1_sha256_3b5e5b81890f1dea3dc0858cade54e7f88a21861818be79c3e7fba066f80d491"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53433,7 +53433,7 @@ rule REVERSINGLABS_Cert_Blocklist_Df5121Dc99D1Ab6B7E5229F6832123Ef : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "INC SALYUT" and (pe.signatures[i].serial=="00:df:51:21:dc:99:d1:ab:6b:7e:52:29:f6:83:21:23:ef" or pe.signatures[i].serial=="df:51:21:dc:99:d1:ab:6b:7e:52:29:f6:83:21:23:ef") and 1613433600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "INC SALYUT" and ( pe.signatures [ i ] . serial == "00:df:51:21:dc:99:d1:ab:6b:7e:52:29:f6:83:21:23:ef" or pe.signatures [ i ] . serial == "df:51:21:dc:99:d1:ab:6b:7e:52:29:f6:83:21:23:ef" ) and 1613433600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53442,13 +53442,13 @@ rule REVERSINGLABS_Cert_Blocklist_760Cef386B63406751Ae83A9Eae92342 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c2cbd1fd-ef68-5128-9c45-88b73a49130f"
+		id = "793fbe35-45cd-5105-814f-5a56f1533721"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15426-L15442"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "43b56736afe081a1215db67b933413d7fbafbfc1be8213b330668578921ebca7"
+		logic_hash = "v1_sha256_43b56736afe081a1215db67b933413d7fbafbfc1be8213b330668578921ebca7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53458,7 +53458,7 @@ rule REVERSINGLABS_Cert_Blocklist_760Cef386B63406751Ae83A9Eae92342 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gidrokon LLC" and pe.signatures[i].serial=="76:0c:ef:38:6b:63:40:67:51:ae:83:a9:ea:e9:23:42" and 1601942400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Gidrokon LLC" and pe.signatures [ i ] . serial == "76:0c:ef:38:6b:63:40:67:51:ae:83:a9:ea:e9:23:42" and 1601942400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53467,13 +53467,13 @@ rule REVERSINGLABS_Cert_Blocklist_5C2625Fa836A64F4882C56Cc7A45F0Ed : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "db968865-fb1e-57b5-8968-6510e83c02ac"
+		id = "1c67f200-60d6-5c17-ae27-e83a1fa8aaaa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15444-L15460"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "85e187684d62c33ef6f69323b837ef2d44facab8278b512d7bd6afd49eaed976"
+		logic_hash = "v1_sha256_85e187684d62c33ef6f69323b837ef2d44facab8278b512d7bd6afd49eaed976"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53483,7 +53483,7 @@ rule REVERSINGLABS_Cert_Blocklist_5C2625Fa836A64F4882C56Cc7A45F0Ed : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="5c:26:25:fa:83:6a:64:f4:88:2c:56:cc:7a:45:f0:ed" and 1474416000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "5c:26:25:fa:83:6a:64:f4:88:2c:56:cc:7a:45:f0:ed" and 1474416000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53492,13 +53492,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Df6Fa580F84493C414Ee0E431086737 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "27afa64e-0c9e-58ca-a4e1-db97cde66427"
+		id = "7a0fabd2-3b29-5414-aa6c-005b57f4f6fc"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15462-L15478"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ef244587c9eb1e1cb2f8a9c161e5dd9ff70e9764586f16e011334400ee400ed9"
+		logic_hash = "v1_sha256_ef244587c9eb1e1cb2f8a9c161e5dd9ff70e9764586f16e011334400ee400ed9"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53508,7 +53508,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Df6Fa580F84493C414Ee0E431086737 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="7d:f6:fa:58:0f:84:49:3c:41:4e:e0:e4:31:08:67:37" and 1477440000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "7d:f6:fa:58:0f:84:49:3c:41:4e:e0:e4:31:08:67:37" and 1477440000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53517,13 +53517,13 @@ rule REVERSINGLABS_Cert_Blocklist_309D2E115F1Fe2993Ee2E063 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "7182f3f2-7b2a-5c29-b7a9-607feafbe570"
+		id = "ae735ab8-3c12-5363-afd8-28e1d3cc76bb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15480-L15496"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "15fdb95fe5429cdc0263615c2b7c90d21f37b52954c5ce568c1293cd3a544730"
+		logic_hash = "v1_sha256_15fdb95fe5429cdc0263615c2b7c90d21f37b52954c5ce568c1293cd3a544730"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53533,7 +53533,7 @@ rule REVERSINGLABS_Cert_Blocklist_309D2E115F1Fe2993Ee2E063 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="30:9d:2e:11:5f:1f:e2:99:3e:e2:e0:63" and 1467102525<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "30:9d:2e:11:5f:1f:e2:99:3e:e2:e0:63" and 1467102525 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53542,13 +53542,13 @@ rule REVERSINGLABS_Cert_Blocklist_90E33C1068F54913315B6Ce9311141B9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "61c5d5ed-ca2c-5f71-893b-4c933b37fa27"
+		id = "806002dc-f147-532e-a72a-864a33572755"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15498-L15516"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4a97171c6dfaa8d249ab0be1ce264b596d266ff4697d869a4d1f90cc0e2c49b7"
+		logic_hash = "v1_sha256_4a97171c6dfaa8d249ab0be1ce264b596d266ff4697d869a4d1f90cc0e2c49b7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53558,7 +53558,7 @@ rule REVERSINGLABS_Cert_Blocklist_90E33C1068F54913315B6Ce9311141B9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GERMES, OOO" and (pe.signatures[i].serial=="00:90:e3:3c:10:68:f5:49:13:31:5b:6c:e9:31:11:41:b9" or pe.signatures[i].serial=="90:e3:3c:10:68:f5:49:13:31:5b:6c:e9:31:11:41:b9") and 1487635200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GERMES, OOO" and ( pe.signatures [ i ] . serial == "00:90:e3:3c:10:68:f5:49:13:31:5b:6c:e9:31:11:41:b9" or pe.signatures [ i ] . serial == "90:e3:3c:10:68:f5:49:13:31:5b:6c:e9:31:11:41:b9" ) and 1487635200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53567,13 +53567,13 @@ rule REVERSINGLABS_Cert_Blocklist_3F15C3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "10bee456-21c0-51a0-988b-43daf65e596b"
+		id = "1e4ebeed-8b68-5253-916d-15a3eb100f5d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15518-L15534"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "03ea946fa99ed7a6ab23cb26dbf514b6c062d63371c9e2a5ddf999acd1954955"
+		logic_hash = "v1_sha256_03ea946fa99ed7a6ab23cb26dbf514b6c062d63371c9e2a5ddf999acd1954955"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53583,7 +53583,7 @@ rule REVERSINGLABS_Cert_Blocklist_3F15C3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Certified Software" and pe.signatures[i].serial=="3f:15:c3" and 1110577130<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Certified Software" and pe.signatures [ i ] . serial == "3f:15:c3" and 1110577130 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53592,13 +53592,13 @@ rule REVERSINGLABS_Cert_Blocklist_285Eccbd1D0000E640B84307Ef88Cd9F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4dc1523f-edc8-52e2-99aa-7389c0eb5e54"
+		id = "c19afe42-8c78-5f3a-a2d5-ebe662620a69"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15536-L15552"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "267df1c327b65938b2b82a53ec8345290659560c69c9a70f2866fe7bd73513a7"
+		logic_hash = "v1_sha256_267df1c327b65938b2b82a53ec8345290659560c69c9a70f2866fe7bd73513a7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53608,7 +53608,7 @@ rule REVERSINGLABS_Cert_Blocklist_285Eccbd1D0000E640B84307Ef88Cd9F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DRAGON BUSINESS EQUIPMENT LIMITED" and pe.signatures[i].serial=="28:5e:cc:bd:1d:00:00:e6:40:b8:43:07:ef:88:cd:9f" and 1611619200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DRAGON BUSINESS EQUIPMENT LIMITED" and pe.signatures [ i ] . serial == "28:5e:cc:bd:1d:00:00:e6:40:b8:43:07:ef:88:cd:9f" and 1611619200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53617,13 +53617,13 @@ rule REVERSINGLABS_Cert_Blocklist_55Ab71A3F9Dde3Ef20C788Dd1D5Ff6C3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c8b5b632-26e6-5a78-99be-b50b1240dbec"
+		id = "5efde272-280e-52d1-9004-8e857cb3bc03"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15554-L15570"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4bee740eaf359462cd85c6232160c6b1fc3df67acfe731da9978f0b8a304a93f"
+		logic_hash = "v1_sha256_4bee740eaf359462cd85c6232160c6b1fc3df67acfe731da9978f0b8a304a93f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53633,7 +53633,7 @@ rule REVERSINGLABS_Cert_Blocklist_55Ab71A3F9Dde3Ef20C788Dd1D5Ff6C3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhengzhoushi Tiekelian Information Technology Co.,Ltd" and pe.signatures[i].serial=="55:ab:71:a3:f9:dd:e3:ef:20:c7:88:dd:1d:5f:f6:c3" and 1323907200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Zhengzhoushi Tiekelian Information Technology Co.,Ltd" and pe.signatures [ i ] . serial == "55:ab:71:a3:f9:dd:e3:ef:20:c7:88:dd:1d:5f:f6:c3" and 1323907200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53642,13 +53642,13 @@ rule REVERSINGLABS_Cert_Blocklist_4Beca26210737A5442Ff8B47 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "30570c07-9ba1-5b7c-a369-c6def80f9dc5"
+		id = "997a4895-b4c1-5216-8157-a9c4e88cb354"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15572-L15588"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7a1130413ae8807dc1ec96a6b1c3bac705a1520f7268db2848b997f6f3f9fc9b"
+		logic_hash = "v1_sha256_7a1130413ae8807dc1ec96a6b1c3bac705a1520f7268db2848b997f6f3f9fc9b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53658,7 +53658,7 @@ rule REVERSINGLABS_Cert_Blocklist_4Beca26210737A5442Ff8B47 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="4b:ec:a2:62:10:73:7a:54:42:ff:8b:47" and 1476437049<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "4b:ec:a2:62:10:73:7a:54:42:ff:8b:47" and 1476437049 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53667,13 +53667,13 @@ rule REVERSINGLABS_Cert_Blocklist_0F203839A9C63B8798A7Cb31 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dc8428f3-ff28-5fcf-9855-f20c68973afe"
+		id = "3d6a258f-e472-5768-86cd-1d2c2db6728a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15590-L15606"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "604ba3fa671cc98e42caf80d07bc9650d193f898413517b46482f183b0f7008a"
+		logic_hash = "v1_sha256_604ba3fa671cc98e42caf80d07bc9650d193f898413517b46482f183b0f7008a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53683,7 +53683,7 @@ rule REVERSINGLABS_Cert_Blocklist_0F203839A9C63B8798A7Cb31 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="0f:20:38:39:a9:c6:3b:87:98:a7:cb:31" and 1480923809<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "0f:20:38:39:a9:c6:3b:87:98:a7:cb:31" and 1480923809 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53692,13 +53692,13 @@ rule REVERSINGLABS_Cert_Blocklist_Dc992Ea8E6Bb4926931Df656D5Eef8A0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "506b217e-ea82-5f14-880e-b6c0cbb001fb"
+		id = "cade3f03-4bc6-50ef-bd18-559d8b062456"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15608-L15626"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2b261624677a1c4a1ef539106bedcef30f272fda3d833d4c8095e9797d592e1f"
+		logic_hash = "v1_sha256_2b261624677a1c4a1ef539106bedcef30f272fda3d833d4c8095e9797d592e1f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53708,7 +53708,7 @@ rule REVERSINGLABS_Cert_Blocklist_Dc992Ea8E6Bb4926931Df656D5Eef8A0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MEGAPOLISELIT, OOO" and (pe.signatures[i].serial=="00:dc:99:2e:a8:e6:bb:49:26:93:1d:f6:56:d5:ee:f8:a0" or pe.signatures[i].serial=="dc:99:2e:a8:e6:bb:49:26:93:1d:f6:56:d5:ee:f8:a0") and 1497916800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MEGAPOLISELIT, OOO" and ( pe.signatures [ i ] . serial == "00:dc:99:2e:a8:e6:bb:49:26:93:1d:f6:56:d5:ee:f8:a0" or pe.signatures [ i ] . serial == "dc:99:2e:a8:e6:bb:49:26:93:1d:f6:56:d5:ee:f8:a0" ) and 1497916800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53717,13 +53717,13 @@ rule REVERSINGLABS_Cert_Blocklist_41Bd49Bb456644D8183B3Dae72Ec8F22 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4645eeae-2aea-59aa-a6bf-095bb9d0d711"
+		id = "6267cf29-61d7-593c-9921-7bbacdcb5eca"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15628-L15644"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0516af7b27d244f21c9cea62fe599725d412e385e34f5f3f4f618d565365d321"
+		logic_hash = "v1_sha256_0516af7b27d244f21c9cea62fe599725d412e385e34f5f3f4f618d565365d321"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53733,7 +53733,7 @@ rule REVERSINGLABS_Cert_Blocklist_41Bd49Bb456644D8183B3Dae72Ec8F22 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="41:bd:49:bb:45:66:44:d8:18:3b:3d:ae:72:ec:8f:22" and 1468454400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "41:bd:49:bb:45:66:44:d8:18:3b:3d:ae:72:ec:8f:22" and 1468454400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53742,13 +53742,13 @@ rule REVERSINGLABS_Cert_Blocklist_A8D40Da6708679C08Aebddea6D3F6B8A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a4224bf1-1875-5b2c-b79d-998d3766d163"
+		id = "c7bc8e95-aae7-5341-8dfe-11966ecdf33e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15646-L15664"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "27ec32791eaeccb8aa95d023c4fc8943f0435c32d8a17bde98d7d0b02ba17e59"
+		logic_hash = "v1_sha256_27ec32791eaeccb8aa95d023c4fc8943f0435c32d8a17bde98d7d0b02ba17e59"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53758,7 +53758,7 @@ rule REVERSINGLABS_Cert_Blocklist_A8D40Da6708679C08Aebddea6D3F6B8A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VELES LTD." and (pe.signatures[i].serial=="00:a8:d4:0d:a6:70:86:79:c0:8a:eb:dd:ea:6d:3f:6b:8a" or pe.signatures[i].serial=="a8:d4:0d:a6:70:86:79:c0:8a:eb:dd:ea:6d:3f:6b:8a") and 1547424000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VELES LTD." and ( pe.signatures [ i ] . serial == "00:a8:d4:0d:a6:70:86:79:c0:8a:eb:dd:ea:6d:3f:6b:8a" or pe.signatures [ i ] . serial == "a8:d4:0d:a6:70:86:79:c0:8a:eb:dd:ea:6d:3f:6b:8a" ) and 1547424000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53767,13 +53767,13 @@ rule REVERSINGLABS_Cert_Blocklist_307642E1F3A92C6Cc2E7Fb6E18F2Ddcb : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6dd35efb-daea-5668-a01d-f5b80371b04c"
+		id = "7602e88e-0ce4-5bac-846e-e5ee1d9baf03"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15666-L15682"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8c96fbd10672b0b258a80f3abaf0320540c5ff0a4636f011cfe7cfa8ccc482d0"
+		logic_hash = "v1_sha256_8c96fbd10672b0b258a80f3abaf0320540c5ff0a4636f011cfe7cfa8ccc482d0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53783,7 +53783,7 @@ rule REVERSINGLABS_Cert_Blocklist_307642E1F3A92C6Cc2E7Fb6E18F2Ddcb : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IBM" and pe.signatures[i].serial=="30:76:42:e1:f3:a9:2c:6c:c2:e7:fb:6e:18:f2:dd:cb" and 1500422400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IBM" and pe.signatures [ i ] . serial == "30:76:42:e1:f3:a9:2c:6c:c2:e7:fb:6e:18:f2:dd:cb" and 1500422400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53792,13 +53792,13 @@ rule REVERSINGLABS_Cert_Blocklist_52379131A1C69263C795A7D398Db0997 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "478994c1-c1c4-5f11-b78f-fe237b687bef"
+		id = "22b2e5b4-0fe1-5ceb-96de-ddf17c9a330b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15684-L15700"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "245e994024e08add755ec704b895286c115ac00eb5aeecde98fce96f35f6e9e0"
+		logic_hash = "v1_sha256_245e994024e08add755ec704b895286c115ac00eb5aeecde98fce96f35f6e9e0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53808,7 +53808,7 @@ rule REVERSINGLABS_Cert_Blocklist_52379131A1C69263C795A7D398Db0997 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures[i].serial=="52:37:91:31:a1:c6:92:63:c7:95:a7:d3:98:db:09:97" and 1476748800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures [ i ] . serial == "52:37:91:31:a1:c6:92:63:c7:95:a7:d3:98:db:09:97" and 1476748800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53817,13 +53817,13 @@ rule REVERSINGLABS_Cert_Blocklist_44312Cb9A927B4111360762B4D4Bdd6D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9bc1a8f4-36b7-52bd-9a65-fcd8ec2acf92"
+		id = "394edc06-9c9e-55f5-b5dd-b0878aff91ec"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15702-L15718"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8e34636ed815812af478dd01eacd5298fa2cfeb420ee2f45e055f557534cae71"
+		logic_hash = "v1_sha256_8e34636ed815812af478dd01eacd5298fa2cfeb420ee2f45e055f557534cae71"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53833,7 +53833,7 @@ rule REVERSINGLABS_Cert_Blocklist_44312Cb9A927B4111360762B4D4Bdd6D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BEAR ADAMS CONSULTING LIMITED" and pe.signatures[i].serial=="44:31:2c:b9:a9:27:b4:11:13:60:76:2b:4d:4b:dd:6d" and 1554768000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BEAR ADAMS CONSULTING LIMITED" and pe.signatures [ i ] . serial == "44:31:2c:b9:a9:27:b4:11:13:60:76:2b:4d:4b:dd:6d" and 1554768000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53842,13 +53842,13 @@ rule REVERSINGLABS_Cert_Blocklist_123A5074069162F4Ed68Fc7D48F464C2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "601ddd98-8cd5-5c52-a59a-d4a0556fc316"
+		id = "3c45d36b-2cb1-5666-a4f6-94180cd4a926"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15720-L15736"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f55835c7404edab96bc5c8fe3844f3380f1f6bc8b43da1d51213de899629e8f5"
+		logic_hash = "v1_sha256_f55835c7404edab96bc5c8fe3844f3380f1f6bc8b43da1d51213de899629e8f5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53858,7 +53858,7 @@ rule REVERSINGLABS_Cert_Blocklist_123A5074069162F4Ed68Fc7D48F464C2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="12:3a:50:74:06:91:62:f4:ed:68:fc:7d:48:f4:64:c2" and 1472428800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "12:3a:50:74:06:91:62:f4:ed:68:fc:7d:48:f4:64:c2" and 1472428800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53867,13 +53867,13 @@ rule REVERSINGLABS_Cert_Blocklist_64Eb04B8Def382B5Efa75F63E0E85Ad0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5f4da614-3bc8-5ae8-b04b-e4b3972522ff"
+		id = "c6b4bed3-1086-59e8-b59e-f7a05add5d98"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15738-L15754"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "03adb8a9bf2a8f0633b34d5c39816b47e60b9e598208f7de79ad9d9a7ab8cc5e"
+		logic_hash = "v1_sha256_03adb8a9bf2a8f0633b34d5c39816b47e60b9e598208f7de79ad9d9a7ab8cc5e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53883,7 +53883,7 @@ rule REVERSINGLABS_Cert_Blocklist_64Eb04B8Def382B5Efa75F63E0E85Ad0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TOV \"MARIYA\"" and pe.signatures[i].serial=="64:eb:04:b8:de:f3:82:b5:ef:a7:5f:63:e0:e8:5a:d0" and 1535587200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TOV \"MARIYA\"" and pe.signatures [ i ] . serial == "64:eb:04:b8:de:f3:82:b5:ef:a7:5f:63:e0:e8:5a:d0" and 1535587200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53892,13 +53892,13 @@ rule REVERSINGLABS_Cert_Blocklist_76D8D908Eed2F9857Dc5676A680Ceac9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f7eae73e-6b12-5507-846e-d3b409243adf"
+		id = "dbc78450-e2a4-55f2-89ba-0b398f5f8c08"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15756-L15772"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "87f9930967d5832d3003672eeb89669b54feed1ca2ea5eec478c50e3cb7a7571"
+		logic_hash = "v1_sha256_87f9930967d5832d3003672eeb89669b54feed1ca2ea5eec478c50e3cb7a7571"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53908,7 +53908,7 @@ rule REVERSINGLABS_Cert_Blocklist_76D8D908Eed2F9857Dc5676A680Ceac9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="76:d8:d9:08:ee:d2:f9:85:7d:c5:67:6a:68:0c:ea:c9" and 1467158400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "76:d8:d9:08:ee:d2:f9:85:7d:c5:67:6a:68:0c:ea:c9" and 1467158400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53917,13 +53917,13 @@ rule REVERSINGLABS_Cert_Blocklist_083E3F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b9a1b1a7-2333-5a6f-85c9-6c19d34c4aa4"
+		id = "f9e36ab4-57b1-58da-9cac-95a3865d6e23"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15774-L15790"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6977d48a2e31235d780cba1b84b39a90e409ee8ea5555e01cbc34989ecd3882d"
+		logic_hash = "v1_sha256_6977d48a2e31235d780cba1b84b39a90e409ee8ea5555e01cbc34989ecd3882d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53933,7 +53933,7 @@ rule REVERSINGLABS_Cert_Blocklist_083E3F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Telefonicasa" and pe.signatures[i].serial=="08:3e:3f" and 999002664<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Telefonicasa" and pe.signatures [ i ] . serial == "08:3e:3f" and 999002664 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53942,13 +53942,13 @@ rule REVERSINGLABS_Cert_Blocklist_79227311Acdd575759198Dbd3544Cca7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "350f7c25-f20f-5e8f-aa52-163cf3de3be1"
+		id = "4d5710b5-578d-5ed6-8dd9-82c2e85455d9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15792-L15808"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "73e920d51faf7150329ce189d1693c29a2285a02d54fee27e5af5afe3238295b"
+		logic_hash = "v1_sha256_73e920d51faf7150329ce189d1693c29a2285a02d54fee27e5af5afe3238295b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53958,7 +53958,7 @@ rule REVERSINGLABS_Cert_Blocklist_79227311Acdd575759198Dbd3544Cca7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="79:22:73:11:ac:dd:57:57:59:19:8d:bd:35:44:cc:a7" and 1478131200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "79:22:73:11:ac:dd:57:57:59:19:8d:bd:35:44:cc:a7" and 1478131200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53967,13 +53967,13 @@ rule REVERSINGLABS_Cert_Blocklist_13Ae38C9Ae21A8576C0D024D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "416c5eb3-bc6d-5fb0-a7fe-58cdd6c7c39d"
+		id = "434e8e84-dc01-55a9-b7b6-7e632252a202"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15810-L15826"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7be892eaf9e2e31442f7ef5ffd296dd17696d6c95d20eb2758ede2c553b05f38"
+		logic_hash = "v1_sha256_7be892eaf9e2e31442f7ef5ffd296dd17696d6c95d20eb2758ede2c553b05f38"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -53983,7 +53983,7 @@ rule REVERSINGLABS_Cert_Blocklist_13Ae38C9Ae21A8576C0D024D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="13:ae:38:c9:ae:21:a8:57:6c:0d:02:4d" and 1475062802<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "13:ae:38:c9:ae:21:a8:57:6c:0d:02:4d" and 1475062802 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -53992,13 +53992,13 @@ rule REVERSINGLABS_Cert_Blocklist_557B0Abf44045827F1F36Efbc96271Ec : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "64db0b43-b73f-594d-9f04-2cdf76df7c9b"
+		id = "61b66c82-103f-5f49-a570-00beb3694491"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15828-L15844"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "633e8d6b44d62443d991738fa82b9742ac5634051bba5d0cdb3d6b35d66bdc8f"
+		logic_hash = "v1_sha256_633e8d6b44d62443d991738fa82b9742ac5634051bba5d0cdb3d6b35d66bdc8f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54008,7 +54008,7 @@ rule REVERSINGLABS_Cert_Blocklist_557B0Abf44045827F1F36Efbc96271Ec : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Zhang" and pe.signatures[i].serial=="55:7b:0a:bf:44:04:58:27:f1:f3:6e:fb:c9:62:71:ec" and 1480291200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Zhang" and pe.signatures [ i ] . serial == "55:7b:0a:bf:44:04:58:27:f1:f3:6e:fb:c9:62:71:ec" and 1480291200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54017,13 +54017,13 @@ rule REVERSINGLABS_Cert_Blocklist_7903870184E18A80899740845A15E2B2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a55bed5b-906f-5c9d-bddd-b4d53d6351de"
+		id = "d01a0062-8bd9-5dd0-9bd0-05f9248a7c29"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15846-L15862"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ad32491b463d0b3b4c85ed78e81bb69802e5f90ae835f73e270b28f02b36f840"
+		logic_hash = "v1_sha256_ad32491b463d0b3b4c85ed78e81bb69802e5f90ae835f73e270b28f02b36f840"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54033,7 +54033,7 @@ rule REVERSINGLABS_Cert_Blocklist_7903870184E18A80899740845A15E2B2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Qool Aid, LLC" and pe.signatures[i].serial=="79:03:87:01:84:e1:8a:80:89:97:40:84:5a:15:e2:b2" and 1079654400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Qool Aid, LLC" and pe.signatures [ i ] . serial == "79:03:87:01:84:e1:8a:80:89:97:40:84:5a:15:e2:b2" and 1079654400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54042,13 +54042,13 @@ rule REVERSINGLABS_Cert_Blocklist_5Fba9B373F812C16Aef531D4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "129e981a-064a-5930-bd45-d03ed008451c"
+		id = "e05740d2-9f9d-5d48-b04c-2dcfcf262737"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15864-L15880"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8b7340359778e3aa56f6ea300973af74eb77efd54108d2ca2b6b8f04d89a1c39"
+		logic_hash = "v1_sha256_8b7340359778e3aa56f6ea300973af74eb77efd54108d2ca2b6b8f04d89a1c39"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54058,7 +54058,7 @@ rule REVERSINGLABS_Cert_Blocklist_5Fba9B373F812C16Aef531D4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="5f:ba:9b:37:3f:81:2c:16:ae:f5:31:d4" and 1473329076<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "5f:ba:9b:37:3f:81:2c:16:ae:f5:31:d4" and 1473329076 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54067,13 +54067,13 @@ rule REVERSINGLABS_Cert_Blocklist_616A5205238590B01D7B761E444E4Ad9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "09e9e481-c767-53d3-9af1-11dec636cafb"
+		id = "0dfc5744-d4e7-5ad1-bd75-5ac7292a0d3d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15882-L15898"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "463ccd3ace9021569a7a6d5fcbaadf34b15d2b07baf3df526b271b547cf2bbc5"
+		logic_hash = "v1_sha256_463ccd3ace9021569a7a6d5fcbaadf34b15d2b07baf3df526b271b547cf2bbc5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54083,7 +54083,7 @@ rule REVERSINGLABS_Cert_Blocklist_616A5205238590B01D7B761E444E4Ad9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lerges" and pe.signatures[i].serial=="61:6a:52:05:23:85:90:b0:1d:7b:76:1e:44:4e:4a:d9" and 1421452800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Lerges" and pe.signatures [ i ] . serial == "61:6a:52:05:23:85:90:b0:1d:7b:76:1e:44:4e:4a:d9" and 1421452800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54092,13 +54092,13 @@ rule REVERSINGLABS_Cert_Blocklist_29Be2278113Dd062Eadca32De6B242D0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a2dfd6e0-4475-537a-859e-126dd4a02af7"
+		id = "fe82288d-f41e-57aa-a395-a9ef9f8bfdf4"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15900-L15916"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3df7afba9eda9022a64647ce2a91119d0bdf6fe5b164a1e82b1819409024fbee"
+		logic_hash = "v1_sha256_3df7afba9eda9022a64647ce2a91119d0bdf6fe5b164a1e82b1819409024fbee"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54108,7 +54108,7 @@ rule REVERSINGLABS_Cert_Blocklist_29Be2278113Dd062Eadca32De6B242D0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BLADES" and pe.signatures[i].serial=="29:be:22:78:11:3d:d0:62:ea:dc:a3:2d:e6:b2:42:d0" and 1536883200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BLADES" and pe.signatures [ i ] . serial == "29:be:22:78:11:3d:d0:62:ea:dc:a3:2d:e6:b2:42:d0" and 1536883200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54117,13 +54117,13 @@ rule REVERSINGLABS_Cert_Blocklist_05F70A557Afd4A443F44D0Baf0Bc8C60 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9ce5b6c7-fede-508f-a7d0-f9d0b8838645"
+		id = "f7d24640-2b8a-5738-b07f-639f9b440d0f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15918-L15934"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3945f515b65ca3ffb6c2b64c884bb2790d703a277e1a5ba128c81bc63ed20a25"
+		logic_hash = "v1_sha256_3945f515b65ca3ffb6c2b64c884bb2790d703a277e1a5ba128c81bc63ed20a25"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54133,7 +54133,7 @@ rule REVERSINGLABS_Cert_Blocklist_05F70A557Afd4A443F44D0Baf0Bc8C60 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="05:f7:0a:55:7a:fd:4a:44:3f:44:d0:ba:f0:bc:8c:60" and 1477440000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "05:f7:0a:55:7a:fd:4a:44:3f:44:d0:ba:f0:bc:8c:60" and 1477440000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54142,13 +54142,13 @@ rule REVERSINGLABS_Cert_Blocklist_4E0665D61997072294A70C662F72Eae3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1370a3b5-a254-5197-ac85-5b33e8d9fa38"
+		id = "eea7f482-4a5b-532d-80a4-f48fb51b35be"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15936-L15952"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f07cdfd522db0a92fe1dba30f158b2c89bb5424bdcdfda50ae42fcfddeac19ba"
+		logic_hash = "v1_sha256_f07cdfd522db0a92fe1dba30f158b2c89bb5424bdcdfda50ae42fcfddeac19ba"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54158,7 +54158,7 @@ rule REVERSINGLABS_Cert_Blocklist_4E0665D61997072294A70C662F72Eae3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Zhang" and pe.signatures[i].serial=="4e:06:65:d6:19:97:07:22:94:a7:0c:66:2f:72:ea:e3" and 1474502400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Zhang" and pe.signatures [ i ] . serial == "4e:06:65:d6:19:97:07:22:94:a7:0c:66:2f:72:ea:e3" and 1474502400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54167,13 +54167,13 @@ rule REVERSINGLABS_Cert_Blocklist_74702Dff5D4056B847D009A2265Fb1B3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "55f1e321-ce70-519a-9a39-4278162edbef"
+		id = "715aa8a8-5d61-5e26-84b6-1d3bea017a67"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15954-L15970"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8acc57bbf334a48043dbee6fab7b7a54a44801b2ccd0ccd9d14194689c75c021"
+		logic_hash = "v1_sha256_8acc57bbf334a48043dbee6fab7b7a54a44801b2ccd0ccd9d14194689c75c021"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54183,7 +54183,7 @@ rule REVERSINGLABS_Cert_Blocklist_74702Dff5D4056B847D009A2265Fb1B3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shulan Hou" and pe.signatures[i].serial=="74:70:2d:ff:5d:40:56:b8:47:d0:09:a2:26:5f:b1:b3" and 1469664000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shulan Hou" and pe.signatures [ i ] . serial == "74:70:2d:ff:5d:40:56:b8:47:d0:09:a2:26:5f:b1:b3" and 1469664000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54192,13 +54192,13 @@ rule REVERSINGLABS_Cert_Blocklist_353B1Cf7866Ee0B0Acdd532D0Bb1A220 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "20b95b80-94a9-51c3-9c6c-2a0ef75b0c0b"
+		id = "f320f38d-8002-59b3-a04d-2ff76a0a0d96"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15972-L15988"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "aa8f0fe1517134b6e562c2accc46420a4f0afd77c3a7bbe98d551c54e68ed4c7"
+		logic_hash = "v1_sha256_aa8f0fe1517134b6e562c2accc46420a4f0afd77c3a7bbe98d551c54e68ed4c7"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54208,7 +54208,7 @@ rule REVERSINGLABS_Cert_Blocklist_353B1Cf7866Ee0B0Acdd532D0Bb1A220 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Network Freak Limited" and pe.signatures[i].serial=="35:3b:1c:f7:86:6e:e0:b0:ac:dd:53:2d:0b:b1:a2:20" and 1558915200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Network Freak Limited" and pe.signatures [ i ] . serial == "35:3b:1c:f7:86:6e:e0:b0:ac:dd:53:2d:0b:b1:a2:20" and 1558915200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54217,13 +54217,13 @@ rule REVERSINGLABS_Cert_Blocklist_093Ff2870Fa33Eaf47259457Ee58C2E0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3fd458e6-bf5a-51f3-9b46-344e9f8e0ffe"
+		id = "fa66acb4-6005-5e8a-bd57-38fbdbafdbaa"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L15990-L16006"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1aafe547b8645f07498bac6f0ffd6d5aefbac160aa7a6fb8d1d891e70701ce99"
+		logic_hash = "v1_sha256_1aafe547b8645f07498bac6f0ffd6d5aefbac160aa7a6fb8d1d891e70701ce99"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54233,7 +54233,7 @@ rule REVERSINGLABS_Cert_Blocklist_093Ff2870Fa33Eaf47259457Ee58C2E0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AEEPZ Limited" and pe.signatures[i].serial=="09:3f:f2:87:0f:a3:3e:af:47:25:94:57:ee:58:c2:e0" and 1503532800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AEEPZ Limited" and pe.signatures [ i ] . serial == "09:3f:f2:87:0f:a3:3e:af:47:25:94:57:ee:58:c2:e0" and 1503532800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54242,13 +54242,13 @@ rule REVERSINGLABS_Cert_Blocklist_719C17A823839Dca813Ee85888B3B39A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ca5b9ec0-2c46-50db-bc47-b3c6c61e990e"
+		id = "d4eefd60-9a79-5588-9637-b89c4e75023a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16008-L16024"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a160ada48048e11632082e7538459554d77d31539e53709cd897f3c454af8236"
+		logic_hash = "v1_sha256_a160ada48048e11632082e7538459554d77d31539e53709cd897f3c454af8236"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54258,7 +54258,7 @@ rule REVERSINGLABS_Cert_Blocklist_719C17A823839Dca813Ee85888B3B39A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Zhang" and pe.signatures[i].serial=="71:9c:17:a8:23:83:9d:ca:81:3e:e8:58:88:b3:b3:9a" and 1479686400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Zhang" and pe.signatures [ i ] . serial == "71:9c:17:a8:23:83:9d:ca:81:3e:e8:58:88:b3:b3:9a" and 1479686400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54267,13 +54267,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Dc86Ebf5863568E2237B2D89582D705 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "24741dc7-6252-5964-a69f-bef4b2dfe1a7"
+		id = "29879b94-696d-5fac-bc5d-d2447df9cf3f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16026-L16042"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f24cdf890bd0b51a83ca333c37bc22068ab1f7e7ef36b36d94a133773097bd37"
+		logic_hash = "v1_sha256_f24cdf890bd0b51a83ca333c37bc22068ab1f7e7ef36b36d94a133773097bd37"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54283,7 +54283,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Dc86Ebf5863568E2237B2D89582D705 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dening Hu" and pe.signatures[i].serial=="6d:c8:6e:bf:58:63:56:8e:22:37:b2:d8:95:82:d7:05" and 1471305600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dening Hu" and pe.signatures [ i ] . serial == "6d:c8:6e:bf:58:63:56:8e:22:37:b2:d8:95:82:d7:05" and 1471305600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54292,13 +54292,13 @@ rule REVERSINGLABS_Cert_Blocklist_214Df59Fe53874Cc011Dd45727035F51 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9265bb94-b183-523f-91bf-9bc76ab63d6b"
+		id = "a57cbe6a-0c6a-5320-85e6-74557bb86c51"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16044-L16060"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "96269f41f82621aee029f343acfce70c781bf7713588dfe78fac35a3d1d3f7cd"
+		logic_hash = "v1_sha256_96269f41f82621aee029f343acfce70c781bf7713588dfe78fac35a3d1d3f7cd"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54308,7 +54308,7 @@ rule REVERSINGLABS_Cert_Blocklist_214Df59Fe53874Cc011Dd45727035F51 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="21:4d:f5:9f:e5:38:74:cc:01:1d:d4:57:27:03:5f:51" and 1468800000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "21:4d:f5:9f:e5:38:74:cc:01:1d:d4:57:27:03:5f:51" and 1468800000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54317,13 +54317,13 @@ rule REVERSINGLABS_Cert_Blocklist_37Ca4F66Fdcc8732992723199859886C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9dd87769-73d0-5299-b6ed-936703abc78e"
+		id = "67f1f0c7-4fb1-502c-ac12-ac67123ab544"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16062-L16078"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "190dffc36c17c27c43337d7914683b7bab3ff18a50de5278ed2a66f04b9e395d"
+		logic_hash = "v1_sha256_190dffc36c17c27c43337d7914683b7bab3ff18a50de5278ed2a66f04b9e395d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54333,7 +54333,7 @@ rule REVERSINGLABS_Cert_Blocklist_37Ca4F66Fdcc8732992723199859886C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aleman Ltd" and pe.signatures[i].serial=="37:ca:4f:66:fd:cc:87:32:99:27:23:19:98:59:88:6c" and 1505952000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Aleman Ltd" and pe.signatures [ i ] . serial == "37:ca:4f:66:fd:cc:87:32:99:27:23:19:98:59:88:6c" and 1505952000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54342,13 +54342,13 @@ rule REVERSINGLABS_Cert_Blocklist_Be2F22C152Bb218B898C4029056816A9 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d5ca9d9d-e80f-56c1-90b7-ef931e61ba92"
+		id = "0bd4fe17-1f1f-5838-b4f8-ed1a1c6e615e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16080-L16098"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "cd99e4d97d9a60f409cf072bbae254486c307ae3cb6e34c5cd9648c972615f36"
+		logic_hash = "v1_sha256_cd99e4d97d9a60f409cf072bbae254486c307ae3cb6e34c5cd9648c972615f36"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54358,7 +54358,7 @@ rule REVERSINGLABS_Cert_Blocklist_Be2F22C152Bb218B898C4029056816A9 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marts GmbH" and (pe.signatures[i].serial=="00:be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9" or pe.signatures[i].serial=="be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9") and 1676246400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Marts GmbH" and ( pe.signatures [ i ] . serial == "00:be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9" or pe.signatures [ i ] . serial == "be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9" ) and 1676246400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54367,13 +54367,13 @@ rule REVERSINGLABS_Cert_Blocklist_Fc7065Abf8303Fb472B8Af85918F5C24 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "1aebd2be-b22c-5102-a449-27025f61cce6"
+		id = "650f86cf-fc1f-565b-ac98-e47cbb84cf02"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16100-L16118"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f57ae32d7efd9cd4c0a207897e30b871dc32405c5b9ad844c9bb7eee4827cc5a"
+		logic_hash = "v1_sha256_f57ae32d7efd9cd4c0a207897e30b871dc32405c5b9ad844c9bb7eee4827cc5a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54383,7 +54383,7 @@ rule REVERSINGLABS_Cert_Blocklist_Fc7065Abf8303Fb472B8Af85918F5C24 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIG IN VISION SP Z O O" and (pe.signatures[i].serial=="00:fc:70:65:ab:f8:30:3f:b4:72:b8:af:85:91:8f:5c:24" or pe.signatures[i].serial=="fc:70:65:ab:f8:30:3f:b4:72:b8:af:85:91:8f:5c:24") and 1604361600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DIG IN VISION SP Z O O" and ( pe.signatures [ i ] . serial == "00:fc:70:65:ab:f8:30:3f:b4:72:b8:af:85:91:8f:5c:24" or pe.signatures [ i ] . serial == "fc:70:65:ab:f8:30:3f:b4:72:b8:af:85:91:8f:5c:24" ) and 1604361600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54392,13 +54392,13 @@ rule REVERSINGLABS_Cert_Blocklist_698Ff388Adb50B88Afb832E76B0A0Ad1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8a6f4a15-08a5-5ca5-a743-55075726e744"
+		id = "6a592d2c-427c-5ece-87af-e0e3bb914654"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16120-L16136"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b29bc69c8fd9543dba8f7d2a18d52b1bcbb8a8ae6f553d8b232ca74709b9addc"
+		logic_hash = "v1_sha256_b29bc69c8fd9543dba8f7d2a18d52b1bcbb8a8ae6f553d8b232ca74709b9addc"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54408,7 +54408,7 @@ rule REVERSINGLABS_Cert_Blocklist_698Ff388Adb50B88Afb832E76B0A0Ad1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BELLAP LIMITED" and pe.signatures[i].serial=="69:8f:f3:88:ad:b5:0b:88:af:b8:32:e7:6b:0a:0a:d1" and 1675070541<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BELLAP LIMITED" and pe.signatures [ i ] . serial == "69:8f:f3:88:ad:b5:0b:88:af:b8:32:e7:6b:0a:0a:d1" and 1675070541 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54417,13 +54417,13 @@ rule REVERSINGLABS_Cert_Blocklist_391Ae38670Ab188A5De26E07 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "aca9ac98-1c3b-5231-b6e5-97e3b8fec6de"
+		id = "01e16423-6364-5ee6-a013-e00e99aaccee"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16138-L16154"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f7ccfadab650ae3b6f950c9d1b35f86aa4a4e6c05479c014ab18881a405678f0"
+		logic_hash = "v1_sha256_f7ccfadab650ae3b6f950c9d1b35f86aa4a4e6c05479c014ab18881a405678f0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54433,7 +54433,7 @@ rule REVERSINGLABS_Cert_Blocklist_391Ae38670Ab188A5De26E07 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DVERI FADO, TOV" and pe.signatures[i].serial=="39:1a:e3:86:70:ab:18:8a:5d:e2:6e:07" and 1540832872<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DVERI FADO, TOV" and pe.signatures [ i ] . serial == "39:1a:e3:86:70:ab:18:8a:5d:e2:6e:07" and 1540832872 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54442,13 +54442,13 @@ rule REVERSINGLABS_Cert_Blocklist_D08D83Ff118Df3777E371C5C482Cce7B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5acd2e61-1c04-5cc5-8773-25856fc163c4"
+		id = "c98cd3f0-18b6-5e6b-9cf1-e488307fee2f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16156-L16174"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5fdaf01c6a23057ab976e3ad2a8b40558b16693161410b0f30d7b884de7e3985"
+		logic_hash = "v1_sha256_5fdaf01c6a23057ab976e3ad2a8b40558b16693161410b0f30d7b884de7e3985"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54458,7 +54458,7 @@ rule REVERSINGLABS_Cert_Blocklist_D08D83Ff118Df3777E371C5C482Cce7B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMO-K Limited Liability Company" and (pe.signatures[i].serial=="00:d0:8d:83:ff:11:8d:f3:77:7e:37:1c:5c:48:2c:ce:7b" or pe.signatures[i].serial=="d0:8d:83:ff:11:8d:f3:77:7e:37:1c:5c:48:2c:ce:7b") and 1444780800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMO-K Limited Liability Company" and ( pe.signatures [ i ] . serial == "00:d0:8d:83:ff:11:8d:f3:77:7e:37:1c:5c:48:2c:ce:7b" or pe.signatures [ i ] . serial == "d0:8d:83:ff:11:8d:f3:77:7e:37:1c:5c:48:2c:ce:7b" ) and 1444780800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54467,13 +54467,13 @@ rule REVERSINGLABS_Cert_Blocklist_06Ce209477F1Ac19A2049Bdc5846A831 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "21c16e2c-bc0c-5e1d-bc44-6d7c4afc34cb"
+		id = "04409e81-53a3-5773-ba92-e397dfd07a81"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16176-L16192"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "24474c4033a8cad1690160da64b75a1eec570f56e830967256c19574bde59384"
+		logic_hash = "v1_sha256_24474c4033a8cad1690160da64b75a1eec570f56e830967256c19574bde59384"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54483,7 +54483,7 @@ rule REVERSINGLABS_Cert_Blocklist_06Ce209477F1Ac19A2049Bdc5846A831 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Select'Assistance Pro" and pe.signatures[i].serial=="06:ce:20:94:77:f1:ac:19:a2:04:9b:dc:58:46:a8:31" and 1426710344<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Select'Assistance Pro" and pe.signatures [ i ] . serial == "06:ce:20:94:77:f1:ac:19:a2:04:9b:dc:58:46:a8:31" and 1426710344 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54492,13 +54492,13 @@ rule REVERSINGLABS_Cert_Blocklist_447F449121B883211663B7B7E2Ead868 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "a3ee3618-0e20-5d9c-a514-9020607bd1b0"
+		id = "86d4e9fd-3c05-538f-9042-3ed6cb2ab773"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16194-L16210"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f473a939d1a27cf53c09d0e4a3753a9444ae3674a55d5b0feafeef6b75dd487f"
+		logic_hash = "v1_sha256_f473a939d1a27cf53c09d0e4a3753a9444ae3674a55d5b0feafeef6b75dd487f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54508,7 +54508,7 @@ rule REVERSINGLABS_Cert_Blocklist_447F449121B883211663B7B7E2Ead868 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "3 AM CHP" and pe.signatures[i].serial=="44:7f:44:91:21:b8:83:21:16:63:b7:b7:e2:ea:d8:68" and 1443052800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "3 AM CHP" and pe.signatures [ i ] . serial == "44:7f:44:91:21:b8:83:21:16:63:b7:b7:e2:ea:d8:68" and 1443052800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54517,13 +54517,13 @@ rule REVERSINGLABS_Cert_Blocklist_6366A9Ac97Df4De17366943C9B291Aaa : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "77d6756b-e948-5771-9ec1-f5159b0e792c"
+		id = "0139ec87-00b8-54f8-ba8d-0e933a7fbc65"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16212-L16228"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "dcdfb78d4d779b1cabcdf5b2da1fa27aaa9faaed4d4967630ce45f30304fe227"
+		logic_hash = "v1_sha256_dcdfb78d4d779b1cabcdf5b2da1fa27aaa9faaed4d4967630ce45f30304fe227"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54533,7 +54533,7 @@ rule REVERSINGLABS_Cert_Blocklist_6366A9Ac97Df4De17366943C9B291Aaa : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "xlgames" and pe.signatures[i].serial=="63:66:a9:ac:97:df:4d:e1:73:66:94:3c:9b:29:1a:aa" and 1326796477<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "xlgames" and pe.signatures [ i ] . serial == "63:66:a9:ac:97:df:4d:e1:73:66:94:3c:9b:29:1a:aa" and 1326796477 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54542,13 +54542,13 @@ rule REVERSINGLABS_Cert_Blocklist_66E3F0B4459F15Ac7F2A2B44990Dd709 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2fc1303f-e559-59ba-a1b9-b74a154d8805"
+		id = "eaa42b63-e6a2-5cc7-a6d2-e45f1bf3ea23"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16230-L16246"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a563f1485ae8887c46f45d1366f676894c7db55954671825b37372f786ce0d3d"
+		logic_hash = "v1_sha256_a563f1485ae8887c46f45d1366f676894c7db55954671825b37372f786ce0d3d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54558,7 +54558,7 @@ rule REVERSINGLABS_Cert_Blocklist_66E3F0B4459F15Ac7F2A2B44990Dd709 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KOG Co., Ltd." and pe.signatures[i].serial=="66:e3:f0:b4:45:9f:15:ac:7f:2a:2b:44:99:0d:d7:09" and 1320288125<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KOG Co., Ltd." and pe.signatures [ i ] . serial == "66:e3:f0:b4:45:9f:15:ac:7f:2a:2b:44:99:0d:d7:09" and 1320288125 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54567,13 +54567,13 @@ rule REVERSINGLABS_Cert_Blocklist_610039D6349Ee531E4Caa3A65D100C7D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "de018b47-9fbd-590e-b3d1-b50029496718"
+		id = "a15f1b09-678a-505f-b555-4b4c2f5776ef"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16248-L16264"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e6b6a90cf40283d2e4d2d9c5732a078c9f2f117e3639ab5c0dd6c5323cb7c9ff"
+		logic_hash = "v1_sha256_e6b6a90cf40283d2e4d2d9c5732a078c9f2f117e3639ab5c0dd6c5323cb7c9ff"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54583,7 +54583,7 @@ rule REVERSINGLABS_Cert_Blocklist_610039D6349Ee531E4Caa3A65D100C7D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Wemade Entertainment" and pe.signatures[i].serial=="61:00:39:d6:34:9e:e5:31:e4:ca:a3:a6:5d:10:0c:7d" and 1341792000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Wemade Entertainment" and pe.signatures [ i ] . serial == "61:00:39:d6:34:9e:e5:31:e4:ca:a3:a6:5d:10:0c:7d" and 1341792000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54592,13 +54592,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Caa0D0Dadf32A2404A75195Ae47820A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5c1f82a4-c64d-556c-8c7a-213582e7bd5a"
+		id = "e6b48549-c07d-5ef9-a87d-cf973935bf99"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16266-L16282"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ab71e485c0b541fae79d246d34b1f4fb146747c1c3fb723aa87a7a32378ff974"
+		logic_hash = "v1_sha256_ab71e485c0b541fae79d246d34b1f4fb146747c1c3fb723aa87a7a32378ff974"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54608,7 +54608,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Caa0D0Dadf32A2404A75195Ae47820A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LivePlex Corp" and pe.signatures[i].serial=="1c:aa:0d:0d:ad:f3:2a:24:04:a7:51:95:ae:47:82:0a" and 1324425600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LivePlex Corp" and pe.signatures [ i ] . serial == "1c:aa:0d:0d:ad:f3:2a:24:04:a7:51:95:ae:47:82:0a" and 1324425600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54617,13 +54617,13 @@ rule REVERSINGLABS_Cert_Blocklist_140D2C515E8Ee9739Bb5F1B2637Dc478 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "69f3ee46-87d2-5630-ba7c-4ed2924cf650"
+		id = "6ac84678-ff45-5ab1-9127-182168715673"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16284-L16300"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e6724fe80959592c8741621ce604518d3e964cee5941257a99dda78b9c8bbdac"
+		logic_hash = "v1_sha256_e6724fe80959592c8741621ce604518d3e964cee5941257a99dda78b9c8bbdac"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54633,7 +54633,7 @@ rule REVERSINGLABS_Cert_Blocklist_140D2C515E8Ee9739Bb5F1B2637Dc478 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Guangzhou YuanLuo Technology Co.,Ltd" and pe.signatures[i].serial=="14:0d:2c:51:5e:8e:e9:73:9b:b5:f1:b2:63:7d:c4:78" and 1386806400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Guangzhou YuanLuo Technology Co.,Ltd" and pe.signatures [ i ] . serial == "14:0d:2c:51:5e:8e:e9:73:9b:b5:f1:b2:63:7d:c4:78" and 1386806400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54642,13 +54642,13 @@ rule REVERSINGLABS_Cert_Blocklist_58015Acd501Fc9C344264Eace2Ce5730 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "28a56bcf-1f13-5478-a6d5-7595464da198"
+		id = "1bc5d209-9243-5b74-8f49-07e4450d4b2d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16302-L16318"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7c1bec5059d40fc326bb08775888ed169abc746228eeb42c897f479992c5acab"
+		logic_hash = "v1_sha256_7c1bec5059d40fc326bb08775888ed169abc746228eeb42c897f479992c5acab"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54658,7 +54658,7 @@ rule REVERSINGLABS_Cert_Blocklist_58015Acd501Fc9C344264Eace2Ce5730 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nanjing Ranyi Technology Co., Ltd. " and pe.signatures[i].serial=="58:01:5a:cd:50:1f:c9:c3:44:26:4e:ac:e2:ce:57:30" and 1352246400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Nanjing Ranyi Technology Co., Ltd. " and pe.signatures [ i ] . serial == "58:01:5a:cd:50:1f:c9:c3:44:26:4e:ac:e2:ce:57:30" and 1352246400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54667,13 +54667,13 @@ rule REVERSINGLABS_Cert_Blocklist_0B7279068Beb15Ffe8060D2C56153C35 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "78bfa550-d85e-5776-a65d-ff0039abd2c4"
+		id = "415507fb-2ce3-50ac-b3d7-13afd351a997"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16320-L16336"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ca00f1adacd6ff16e54b85be38c3a4545a10c76548e0647f7f3f6cfa4dff412d"
+		logic_hash = "v1_sha256_ca00f1adacd6ff16e54b85be38c3a4545a10c76548e0647f7f3f6cfa4dff412d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54683,7 +54683,7 @@ rule REVERSINGLABS_Cert_Blocklist_0B7279068Beb15Ffe8060D2C56153C35 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Guangzhou YuanLuo Technology Co.,Ltd" and pe.signatures[i].serial=="0b:72:79:06:8b:eb:15:ff:e8:06:0d:2c:56:15:3c:35" and 1350864000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Guangzhou YuanLuo Technology Co.,Ltd" and pe.signatures [ i ] . serial == "0b:72:79:06:8b:eb:15:ff:e8:06:0d:2c:56:15:3c:35" and 1350864000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54692,13 +54692,13 @@ rule REVERSINGLABS_Cert_Blocklist_0Bc0F18Da36702E302Db170D91Dc9202 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "977d9686-d811-5416-b090-d4f45d7935d0"
+		id = "ada35248-eb0e-5246-9c51-1798c9f0cc05"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16338-L16354"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d9ee2cf63a4edb28f894ea49a5b4df9b818d5764d9a74721b1d5222f53859462"
+		logic_hash = "v1_sha256_d9ee2cf63a4edb28f894ea49a5b4df9b818d5764d9a74721b1d5222f53859462"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54708,7 +54708,7 @@ rule REVERSINGLABS_Cert_Blocklist_0Bc0F18Da36702E302Db170D91Dc9202 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foresee Consulting Inc." and pe.signatures[i].serial=="0b:c0:f1:8d:a3:67:02:e3:02:db:17:0d:91:dc:92:02" and 1637712000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Foresee Consulting Inc." and pe.signatures [ i ] . serial == "0b:c0:f1:8d:a3:67:02:e3:02:db:17:0d:91:dc:92:02" and 1637712000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54717,13 +54717,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ca9B6F49B8B41204A174C751C73Dc393 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d09658e4-44e4-5c10-a866-ba486000f1b6"
+		id = "95cd0496-94b7-54eb-b293-83453e75fce6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16356-L16374"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0b6558a7a1b78d471aaadced959ba91e411df50e3cc08e447fe9bd97f9e5cced"
+		logic_hash = "v1_sha256_0b6558a7a1b78d471aaadced959ba91e411df50e3cc08e447fe9bd97f9e5cced"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54733,7 +54733,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ca9B6F49B8B41204A174C751C73Dc393 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CodeDance Ltd" and (pe.signatures[i].serial=="00:ca:9b:6f:49:b8:b4:12:04:a1:74:c7:51:c7:3d:c3:93" or pe.signatures[i].serial=="ca:9b:6f:49:b8:b4:12:04:a1:74:c7:51:c7:3d:c3:93") and 1654646400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CodeDance Ltd" and ( pe.signatures [ i ] . serial == "00:ca:9b:6f:49:b8:b4:12:04:a1:74:c7:51:c7:3d:c3:93" or pe.signatures [ i ] . serial == "ca:9b:6f:49:b8:b4:12:04:a1:74:c7:51:c7:3d:c3:93" ) and 1654646400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54742,13 +54742,13 @@ rule REVERSINGLABS_Cert_Blocklist_Aaf65B8E7A2E68Bc8C9E8F27331B795C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ccb36b8b-301d-5cc2-9c8e-4956b92c1116"
+		id = "06ee2521-277f-577a-8ccc-2eccbea2236e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16376-L16394"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "390d074da09d8e5b4bb2a6f4157a5125474ab5c22de62729d4fc4075edade289"
+		logic_hash = "v1_sha256_390d074da09d8e5b4bb2a6f4157a5125474ab5c22de62729d4fc4075edade289"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54758,7 +54758,7 @@ rule REVERSINGLABS_Cert_Blocklist_Aaf65B8E7A2E68Bc8C9E8F27331B795C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALISA L LIMITED" and (pe.signatures[i].serial=="00:aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5c" or pe.signatures[i].serial=="aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5c") and 1549324800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALISA L LIMITED" and ( pe.signatures [ i ] . serial == "00:aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5c" or pe.signatures [ i ] . serial == "aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5c" ) and 1549324800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54767,13 +54767,13 @@ rule REVERSINGLABS_Cert_Blocklist_C6Ed0Efe2844Fa44Aae350C6845C3331 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d748bea4-8d2b-53b2-8184-ea0972ad9199"
+		id = "ecbdbf31-8788-52b1-9b28-cab285826998"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16396-L16414"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5c4afcd8ceb5cc2f1df2303183ede2081b86365eeee7d4e1319a8ed9a45bbf0b"
+		logic_hash = "v1_sha256_5c4afcd8ceb5cc2f1df2303183ede2081b86365eeee7d4e1319a8ed9a45bbf0b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54783,7 +54783,7 @@ rule REVERSINGLABS_Cert_Blocklist_C6Ed0Efe2844Fa44Aae350C6845C3331 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE COMPANY OF WORDS LTD" and (pe.signatures[i].serial=="00:c6:ed:0e:fe:28:44:fa:44:aa:e3:50:c6:84:5c:33:31" or pe.signatures[i].serial=="c6:ed:0e:fe:28:44:fa:44:aa:e3:50:c6:84:5c:33:31") and 1549324800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THE COMPANY OF WORDS LTD" and ( pe.signatures [ i ] . serial == "00:c6:ed:0e:fe:28:44:fa:44:aa:e3:50:c6:84:5c:33:31" or pe.signatures [ i ] . serial == "c6:ed:0e:fe:28:44:fa:44:aa:e3:50:c6:84:5c:33:31" ) and 1549324800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54792,13 +54792,13 @@ rule REVERSINGLABS_Cert_Blocklist_Ede6Cfbf9Fa18337B0Fdb49C1F693020 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0389d5ba-4535-5277-9c77-bd178e66417f"
+		id = "63f578d7-4542-5c95-a1a8-f74cc5cbd925"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16416-L16434"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "a7f18d0028cbc0001a196bc915b7881244a5833dd65f96dd7d2e8ab1b0622e0c"
+		logic_hash = "v1_sha256_a7f18d0028cbc0001a196bc915b7881244a5833dd65f96dd7d2e8ab1b0622e0c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54808,7 +54808,7 @@ rule REVERSINGLABS_Cert_Blocklist_Ede6Cfbf9Fa18337B0Fdb49C1F693020 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "START ARCHITECTURE LTD" and (pe.signatures[i].serial=="00:ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20" or pe.signatures[i].serial=="ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20") and 1554940800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "START ARCHITECTURE LTD" and ( pe.signatures [ i ] . serial == "00:ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20" or pe.signatures [ i ] . serial == "ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20" ) and 1554940800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54817,13 +54817,13 @@ rule REVERSINGLABS_Cert_Blocklist_Eda0F47B3B38E781Cdf6Ef6Be5D3F6Ee : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "308a73cd-a142-56ad-8dca-808ab455b43e"
+		id = "99f7b743-34e1-557a-a8c9-90d7c3c9f166"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16436-L16454"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "af3cd543a6feec3118ba4e5fdc8455584aa763bd8339f036ab332977fc0fb20e"
+		logic_hash = "v1_sha256_af3cd543a6feec3118ba4e5fdc8455584aa763bd8339f036ab332977fc0fb20e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54833,7 +54833,7 @@ rule REVERSINGLABS_Cert_Blocklist_Eda0F47B3B38E781Cdf6Ef6Be5D3F6Ee : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADVANCED ACCESS SERVICES LTD" and (pe.signatures[i].serial=="00:ed:a0:f4:7b:3b:38:e7:81:cd:f6:ef:6b:e5:d3:f6:ee" or pe.signatures[i].serial=="ed:a0:f4:7b:3b:38:e7:81:cd:f6:ef:6b:e5:d3:f6:ee") and 1650931200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ADVANCED ACCESS SERVICES LTD" and ( pe.signatures [ i ] . serial == "00:ed:a0:f4:7b:3b:38:e7:81:cd:f6:ef:6b:e5:d3:f6:ee" or pe.signatures [ i ] . serial == "ed:a0:f4:7b:3b:38:e7:81:cd:f6:ef:6b:e5:d3:f6:ee" ) and 1650931200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54842,13 +54842,13 @@ rule REVERSINGLABS_Cert_Blocklist_5Da173Eb1Ac76340Ac058E1Ff4Bf5E1B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0f9fa6c6-372d-5948-94ba-9e3fee956647"
+		id = "b5c4b52d-ea26-5c1d-9863-affcb3700524"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16456-L16472"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "71da69fca275caead6a822e6587e0a07fc882f712afeafe18f4a595c269f6737"
+		logic_hash = "v1_sha256_71da69fca275caead6a822e6587e0a07fc882f712afeafe18f4a595c269f6737"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54858,7 +54858,7 @@ rule REVERSINGLABS_Cert_Blocklist_5Da173Eb1Ac76340Ac058E1Ff4Bf5E1B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALISA LTD" and pe.signatures[i].serial=="5d:a1:73:eb:1a:c7:63:40:ac:05:8e:1f:f4:bf:5e:1b" and 1550793600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALISA LTD" and pe.signatures [ i ] . serial == "5d:a1:73:eb:1a:c7:63:40:ac:05:8e:1f:f4:bf:5e:1b" and 1550793600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54867,13 +54867,13 @@ rule REVERSINGLABS_Cert_Blocklist_1380A7Ccf2Bf36Bc496B00D8 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "dc473451-e1a9-53b4-acf6-9ff8036ecf31"
+		id = "b7908367-65f0-5b9c-ba1f-659549dcdfc1"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16474-L16490"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "88708d7d139a9d6e92f78df460b527a1ae6a404d0bcccb801c8c8cb1263a46c6"
+		logic_hash = "v1_sha256_88708d7d139a9d6e92f78df460b527a1ae6a404d0bcccb801c8c8cb1263a46c6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54883,7 +54883,7 @@ rule REVERSINGLABS_Cert_Blocklist_1380A7Ccf2Bf36Bc496B00D8 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="13:80:a7:cc:f2:bf:36:bc:49:6b:00:d8" and 1478069976<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "13:80:a7:cc:f2:bf:36:bc:49:6b:00:d8" and 1478069976 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54892,13 +54892,13 @@ rule REVERSINGLABS_Cert_Blocklist_02Eaf27E6F1575E365Fc7Fe4E0Be43F7 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5d1aad80-9444-5cc3-8ff4-b70fb089cda0"
+		id = "897993eb-ce09-5ad9-8644-3c90e5499681"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16492-L16508"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "333a43bdfbc400727b8eae1efeb03484b959fc45ed6b8b0dd5e6a553fa27e87f"
+		logic_hash = "v1_sha256_333a43bdfbc400727b8eae1efeb03484b959fc45ed6b8b0dd5e6a553fa27e87f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54908,7 +54908,7 @@ rule REVERSINGLABS_Cert_Blocklist_02Eaf27E6F1575E365Fc7Fe4E0Be43F7 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Theravada Solutions Ltd" and pe.signatures[i].serial=="02:ea:f2:7e:6f:15:75:e3:65:fc:7f:e4:e0:be:43:f7" and 1562889600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Theravada Solutions Ltd" and pe.signatures [ i ] . serial == "02:ea:f2:7e:6f:15:75:e3:65:fc:7f:e4:e0:be:43:f7" and 1562889600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54917,13 +54917,13 @@ rule REVERSINGLABS_Cert_Blocklist_6Eb02Ac2Beb9611Ed57Eb12E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "64350364-fe74-54df-886d-1197146e00e7"
+		id = "9c03fe30-fcca-527e-86fb-51876f17d82f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16510-L16526"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7f2a6c61ae82fec6829924d11190da776aebdd3d72c7e001fdc29b215649261c"
+		logic_hash = "v1_sha256_7f2a6c61ae82fec6829924d11190da776aebdd3d72c7e001fdc29b215649261c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54933,7 +54933,7 @@ rule REVERSINGLABS_Cert_Blocklist_6Eb02Ac2Beb9611Ed57Eb12E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x9D\\xA8\\xE5\\x87\\x8C\\xE4\\xBC\\xAF\\xE4\\xB9\\x90\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="6e:b0:2a:c2:be:b9:61:1e:d5:7e:b1:2e" and 1585023767<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE6\\x9D\\xA8\\xE5\\x87\\x8C\\xE4\\xBC\\xAF\\xE4\\xB9\\x90\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "6e:b0:2a:c2:be:b9:61:1e:d5:7e:b1:2e" and 1585023767 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54942,13 +54942,13 @@ rule REVERSINGLABS_Cert_Blocklist_010000000001297Dba69Dd : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "f6a63e79-4dde-590f-ad65-ba9cc29ff48c"
+		id = "b73a522d-d2fd-5eca-bb3c-a8fce0d47e6f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16528-L16544"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bbc3e740d5043d1811ff44c7366c69192fb78c95215b30fd4f4c782812ad591c"
+		logic_hash = "v1_sha256_bbc3e740d5043d1811ff44c7366c69192fb78c95215b30fd4f4c782812ad591c"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54958,7 +54958,7 @@ rule REVERSINGLABS_Cert_Blocklist_010000000001297Dba69Dd : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ROSSO INDEX K.K." and pe.signatures[i].serial=="01:00:00:00:00:01:29:7d:ba:69:dd" and 1277713154<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ROSSO INDEX K.K." and pe.signatures [ i ] . serial == "01:00:00:00:00:01:29:7d:ba:69:dd" and 1277713154 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54967,13 +54967,13 @@ rule REVERSINGLABS_Cert_Blocklist_7Def22Ef4C645B1Decfb36B6D3539Dbf : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "aeb10a64-633c-5fc6-87af-360e1a402ad4"
+		id = "c264def8-feff-5322-adaf-0988887bf460"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16546-L16562"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "655ed87ee65f937c7cec95085fe612f8d733e0853c87aa50b4aa1fda9e5f7a5d"
+		logic_hash = "v1_sha256_655ed87ee65f937c7cec95085fe612f8d733e0853c87aa50b4aa1fda9e5f7a5d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -54983,7 +54983,7 @@ rule REVERSINGLABS_Cert_Blocklist_7Def22Ef4C645B1Decfb36B6D3539Dbf : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures[i].serial=="7d:ef:22:ef:4c:64:5b:1d:ec:fb:36:b6:d3:53:9d:bf" and 1474416000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures [ i ] . serial == "7d:ef:22:ef:4c:64:5b:1d:ec:fb:36:b6:d3:53:9d:bf" and 1474416000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -54992,13 +54992,13 @@ rule REVERSINGLABS_Cert_Blocklist_3E39C2Ccc494438Bb8C2560F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "87477ad5-fc7e-5407-9c6e-bef3d4d8981d"
+		id = "07c63f08-cef6-5407-9e36-798169eb3f9d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16564-L16580"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "3b4a55149b3895eeea5f96297d1fc9787eb74e2fcef8170148ef1a2ced334311"
+		logic_hash = "v1_sha256_3b4a55149b3895eeea5f96297d1fc9787eb74e2fcef8170148ef1a2ced334311"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55008,7 +55008,7 @@ rule REVERSINGLABS_Cert_Blocklist_3E39C2Ccc494438Bb8C2560F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="3e:39:c2:cc:c4:94:43:8b:b8:c2:56:0f" and 1466142876<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "3e:39:c2:cc:c4:94:43:8b:b8:c2:56:0f" and 1466142876 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55017,13 +55017,13 @@ rule REVERSINGLABS_Cert_Blocklist_6E3B09F43C3A0Fd53B7D600F08Fae2B5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "66025c6e-5d85-5660-87f1-3094a536bbe2"
+		id = "df472d21-5192-583c-bcf5-85287836128b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16582-L16598"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "86b06519858dce4b77cb870905297a1fd1c767053fd07c0b0469eb7fc3ba6b32"
+		logic_hash = "v1_sha256_86b06519858dce4b77cb870905297a1fd1c767053fd07c0b0469eb7fc3ba6b32"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55033,7 +55033,7 @@ rule REVERSINGLABS_Cert_Blocklist_6E3B09F43C3A0Fd53B7D600F08Fae2B5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Divisible Limited" and pe.signatures[i].serial=="6e:3b:09:f4:3c:3a:0f:d5:3b:7d:60:0f:08:fa:e2:b5" and 1507248000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Divisible Limited" and pe.signatures [ i ] . serial == "6e:3b:09:f4:3c:3a:0f:d5:3b:7d:60:0f:08:fa:e2:b5" and 1507248000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55042,13 +55042,13 @@ rule REVERSINGLABS_Cert_Blocklist_21220646C639D62C16992F46 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b80b1832-6bfa-555b-8462-cd17f9e5e0e1"
+		id = "e6515650-5853-527f-86e7-f58caafd3519"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16600-L16616"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "87202c29867e6410d59c1e3b5ab09a24ebac5c68c61d7b932b91a91dcf3707e2"
+		logic_hash = "v1_sha256_87202c29867e6410d59c1e3b5ab09a24ebac5c68c61d7b932b91a91dcf3707e2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55058,7 +55058,7 @@ rule REVERSINGLABS_Cert_Blocklist_21220646C639D62C16992F46 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sivi Technology Limited" and pe.signatures[i].serial=="21:22:06:46:c6:39:d6:2c:16:99:2f:46" and 1466130984<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sivi Technology Limited" and pe.signatures [ i ] . serial == "21:22:06:46:c6:39:d6:2c:16:99:2f:46" and 1466130984 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55067,13 +55067,13 @@ rule REVERSINGLABS_Cert_Blocklist_738663F2C9E4Adb3Ad5306Aa5E7Cc548 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "9fa41321-9736-5e67-b561-005b6d893e3f"
+		id = "1484186c-d978-5c47-8665-0adb6167f01b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16618-L16634"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "518a22e31432ee42e6aceb861815f7f9e84f2430b7fb3a78b498e45c584584ab"
+		logic_hash = "v1_sha256_518a22e31432ee42e6aceb861815f7f9e84f2430b7fb3a78b498e45c584584ab"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55083,7 +55083,7 @@ rule REVERSINGLABS_Cert_Blocklist_738663F2C9E4Adb3Ad5306Aa5E7Cc548 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GIN-Konsalt" and pe.signatures[i].serial=="73:86:63:f2:c9:e4:ad:b3:ad:53:06:aa:5e:7c:c5:48" and 1498435200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GIN-Konsalt" and pe.signatures [ i ] . serial == "73:86:63:f2:c9:e4:ad:b3:ad:53:06:aa:5e:7c:c5:48" and 1498435200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55092,13 +55092,13 @@ rule REVERSINGLABS_Cert_Blocklist_4280F2C8Ce1D98E5F8Da7Ecb005Eeae5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "559dc522-bc23-5716-b8ad-9e9df102936b"
+		id = "51b1dd1e-66cc-5ac1-ab86-8ceffe8f9b85"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16636-L16652"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4cc8f00a9704f595f3e48375942a19cd6f8d6c0e53afc932a61f5a4326be4bcb"
+		logic_hash = "v1_sha256_4cc8f00a9704f595f3e48375942a19cd6f8d6c0e53afc932a61f5a4326be4bcb"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55108,7 +55108,7 @@ rule REVERSINGLABS_Cert_Blocklist_4280F2C8Ce1D98E5F8Da7Ecb005Eeae5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures[i].serial=="42:80:f2:c8:ce:1d:98:e5:f8:da:7e:cb:00:5e:ea:e5" and 1476316800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures [ i ] . serial == "42:80:f2:c8:ce:1d:98:e5:f8:da:7e:cb:00:5e:ea:e5" and 1476316800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55117,13 +55117,13 @@ rule REVERSINGLABS_Cert_Blocklist_2946397Be9C5Ae44E95C99Af : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "46bc3ade-544c-5ee1-8d5d-4b8a269120c9"
+		id = "29be00dc-6f70-5626-b4fc-66def0d3498a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16654-L16670"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b7b4925482fcc47dea81eb3d84af31cc572f1b19080b98dda330b0bf6d7c80f4"
+		logic_hash = "v1_sha256_b7b4925482fcc47dea81eb3d84af31cc572f1b19080b98dda330b0bf6d7c80f4"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55133,7 +55133,7 @@ rule REVERSINGLABS_Cert_Blocklist_2946397Be9C5Ae44E95C99Af : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="29:46:39:7b:e9:c5:ae:44:e9:5c:99:af" and 1476092708<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "29:46:39:7b:e9:c5:ae:44:e9:5c:99:af" and 1476092708 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55142,13 +55142,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Df453588177Cf1C0C297Ff4 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c3a18989-239e-56d7-b1c2-92895c02b7d8"
+		id = "9979f0cc-69bc-5c71-8017-d9263b3a83b2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16672-L16688"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b0c82388fd87a89841d190ce4020cc5a2ea21c9d765ceca6bc25d64162479231"
+		logic_hash = "v1_sha256_b0c82388fd87a89841d190ce4020cc5a2ea21c9d765ceca6bc25d64162479231"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55158,7 +55158,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Df453588177Cf1C0C297Ff4 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shenzhen Yunhuitianxia Technology Co.,Ltd." and pe.signatures[i].serial=="2d:f4:53:58:81:77:cf:1c:0c:29:7f:f4" and 1479735173<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shenzhen Yunhuitianxia Technology Co.,Ltd." and pe.signatures [ i ] . serial == "2d:f4:53:58:81:77:cf:1c:0c:29:7f:f4" and 1479735173 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55167,13 +55167,13 @@ rule REVERSINGLABS_Cert_Blocklist_0619C5E39A4Fc60A32F9B07F6A4Ca328 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "ae3ef9cf-4b67-5cb8-9c9b-3edb95da222c"
+		id = "f81cb5f0-7cd8-50f1-9683-3cd4539b5a1f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16690-L16706"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "75e3dfd593d7fdc268de54430be617c015957a624f2ca36bc0036d4cbde5b686"
+		logic_hash = "v1_sha256_75e3dfd593d7fdc268de54430be617c015957a624f2ca36bc0036d4cbde5b686"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55183,7 +55183,7 @@ rule REVERSINGLABS_Cert_Blocklist_0619C5E39A4Fc60A32F9B07F6A4Ca328 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yuanyuan Zhang" and pe.signatures[i].serial=="06:19:c5:e3:9a:4f:c6:0a:32:f9:b0:7f:6a:4c:a3:28" and 1475884800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yuanyuan Zhang" and pe.signatures [ i ] . serial == "06:19:c5:e3:9a:4f:c6:0a:32:f9:b0:7f:6a:4c:a3:28" and 1475884800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55192,13 +55192,13 @@ rule REVERSINGLABS_Cert_Blocklist_2Bffef48E6A321B418041310Fdb9B0D0 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6a29551f-8359-5394-9acd-00c3b25d7064"
+		id = "7960333c-3d82-5dee-b6bc-72e55184bbcb"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16708-L16724"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "30a079b55b75b292f7af4f5ae99184cbb3cca1ce4cf20f2f5c961b533673db00"
+		logic_hash = "v1_sha256_30a079b55b75b292f7af4f5ae99184cbb3cca1ce4cf20f2f5c961b533673db00"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55208,7 +55208,7 @@ rule REVERSINGLABS_Cert_Blocklist_2Bffef48E6A321B418041310Fdb9B0D0 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "A&D DOMUS LIMITED" and pe.signatures[i].serial=="2b:ff:ef:48:e6:a3:21:b4:18:04:13:10:fd:b9:b0:d0" and 1554681600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "A&D DOMUS LIMITED" and pe.signatures [ i ] . serial == "2b:ff:ef:48:e6:a3:21:b4:18:04:13:10:fd:b9:b0:d0" and 1554681600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55217,13 +55217,13 @@ rule REVERSINGLABS_Cert_Blocklist_34Ec9565805F34204C6966Fb81E36Ba1 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "bd032608-8622-5c7a-a3a7-808d73e611d7"
+		id = "ec7546b2-6ade-5990-9d91-c8029639020e"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16726-L16742"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e434a02f5b9b22a25d8fe7a0bb7bd81b1cd8bc5356b4b626e3bfceb3f554a085"
+		logic_hash = "v1_sha256_e434a02f5b9b22a25d8fe7a0bb7bd81b1cd8bc5356b4b626e3bfceb3f554a085"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55233,7 +55233,7 @@ rule REVERSINGLABS_Cert_Blocklist_34Ec9565805F34204C6966Fb81E36Ba1 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="34:ec:95:65:80:5f:34:20:4c:69:66:fb:81:e3:6b:a1" and 1476921600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "34:ec:95:65:80:5f:34:20:4c:69:66:fb:81:e3:6b:a1" and 1476921600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55242,13 +55242,13 @@ rule REVERSINGLABS_Cert_Blocklist_B2B934B7F01E0Ac1E577814992243709 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "19930e7b-09cb-5c04-b838-3d8d73ba194b"
+		id = "2e28d081-d43f-509b-a9ca-298078554509"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16744-L16762"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "37b254ab76d144c09cc7b622dba59f5e372bf01ae12ce260a06143abb52062f6"
+		logic_hash = "v1_sha256_37b254ab76d144c09cc7b622dba59f5e372bf01ae12ce260a06143abb52062f6"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55258,7 +55258,7 @@ rule REVERSINGLABS_Cert_Blocklist_B2B934B7F01E0Ac1E577814992243709 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MS CORP SOFTWARE LTD" and (pe.signatures[i].serial=="00:b2:b9:34:b7:f0:1e:0a:c1:e5:77:81:49:92:24:37:09" or pe.signatures[i].serial=="b2:b9:34:b7:f0:1e:0a:c1:e5:77:81:49:92:24:37:09") and 1590710400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MS CORP SOFTWARE LTD" and ( pe.signatures [ i ] . serial == "00:b2:b9:34:b7:f0:1e:0a:c1:e5:77:81:49:92:24:37:09" or pe.signatures [ i ] . serial == "b2:b9:34:b7:f0:1e:0a:c1:e5:77:81:49:92:24:37:09" ) and 1590710400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55267,13 +55267,13 @@ rule REVERSINGLABS_Cert_Blocklist_3A1B397Fd9451E3B5891Fc69681Ed73D : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "6bdba43f-4003-5807-9adc-20691fbc8d14"
+		id = "b79d0be4-f0af-5e5a-8ac0-88ce6054ca3a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16764-L16780"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ca43c7bacd8cb5a896c3135abf4a131bdb4a7f5093e64c8d1df743fad0c1c64a"
+		logic_hash = "v1_sha256_ca43c7bacd8cb5a896c3135abf4a131bdb4a7f5093e64c8d1df743fad0c1c64a"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55283,7 +55283,7 @@ rule REVERSINGLABS_Cert_Blocklist_3A1B397Fd9451E3B5891Fc69681Ed73D : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yongli Zhang" and pe.signatures[i].serial=="3a:1b:39:7f:d9:45:1e:3b:58:91:fc:69:68:1e:d7:3d" and 1470614400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yongli Zhang" and pe.signatures [ i ] . serial == "3a:1b:39:7f:d9:45:1e:3b:58:91:fc:69:68:1e:d7:3d" and 1470614400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55292,13 +55292,13 @@ rule REVERSINGLABS_Cert_Blocklist_1Eb816Aa49E4894D9E9F78729E53Cd48 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "d2e66765-bdf6-59ff-ac6c-1a82ecefa731"
+		id = "d4b117d2-3ef6-568b-9178-7c54d14e541d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16782-L16798"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "4e22568612aec050c7f78b81ba6749528a9c25c0ba43e14260a581a9bea7a2f0"
+		logic_hash = "v1_sha256_4e22568612aec050c7f78b81ba6749528a9c25c0ba43e14260a581a9bea7a2f0"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55308,7 +55308,7 @@ rule REVERSINGLABS_Cert_Blocklist_1Eb816Aa49E4894D9E9F78729E53Cd48 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x96\\x84\\xE5\\x90\\x9B \\xE9\\x9F\\xA6" and pe.signatures[i].serial=="1e:b8:16:aa:49:e4:89:4d:9e:9f:78:72:9e:53:cd:48" and 1429056000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\x96\\x84\\xE5\\x90\\x9B \\xE9\\x9F\\xA6" and pe.signatures [ i ] . serial == "1e:b8:16:aa:49:e4:89:4d:9e:9f:78:72:9e:53:cd:48" and 1429056000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55317,13 +55317,13 @@ rule REVERSINGLABS_Cert_Blocklist_383Ca88D6D9379C740609560 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "46166e9e-515d-530a-a651-59821d979f01"
+		id = "bd72a9d8-f1a5-5588-ab24-f09fefe5085b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16800-L16816"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ce41d046a7ca320d034fa226b5e8c22022cc6bfc97eb9ef294b1aca232aaacef"
+		logic_hash = "v1_sha256_ce41d046a7ca320d034fa226b5e8c22022cc6bfc97eb9ef294b1aca232aaacef"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55333,7 +55333,7 @@ rule REVERSINGLABS_Cert_Blocklist_383Ca88D6D9379C740609560 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="38:3c:a8:8d:6d:93:79:c7:40:60:95:60" and 1478250214<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "38:3c:a8:8d:6d:93:79:c7:40:60:95:60" and 1478250214 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55342,13 +55342,13 @@ rule REVERSINGLABS_Cert_Blocklist_6731Cb1430F18B8C0C43Ab40E1154169 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "df2423da-37ec-5adc-8497-2ac975b0b7ff"
+		id = "163f6cc5-b7cd-5674-a64a-db2ec244e4f6"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16818-L16834"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "c05349166919ffc18ac6ecb61b822a8365f87a82164c5e110ef94345bdc4de6f"
+		logic_hash = "v1_sha256_c05349166919ffc18ac6ecb61b822a8365f87a82164c5e110ef94345bdc4de6f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55358,7 +55358,7 @@ rule REVERSINGLABS_Cert_Blocklist_6731Cb1430F18B8C0C43Ab40E1154169 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "3 AM CHP" and pe.signatures[i].serial=="67:31:cb:14:30:f1:8b:8c:0c:43:ab:40:e1:15:41:69" and 1436313600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "3 AM CHP" and pe.signatures [ i ] . serial == "67:31:cb:14:30:f1:8b:8c:0c:43:ab:40:e1:15:41:69" and 1436313600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55367,13 +55367,13 @@ rule REVERSINGLABS_Cert_Blocklist_159505E6456B9A9352F7C47168D89B96 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3d078c5d-e469-54f1-bd69-aebeec1c25f1"
+		id = "eba19907-f92c-5cc3-a86d-8d8d8130334c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16836-L16852"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d6d0d5c86dd88afa29fb3c7cc3c0ab2e3401637a23e062ee9bab693a715cf16f"
+		logic_hash = "v1_sha256_d6d0d5c86dd88afa29fb3c7cc3c0ab2e3401637a23e062ee9bab693a715cf16f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55383,7 +55383,7 @@ rule REVERSINGLABS_Cert_Blocklist_159505E6456B9A9352F7C47168D89B96 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shan Feng" and pe.signatures[i].serial=="15:95:05:e6:45:6b:9a:93:52:f7:c4:71:68:d8:9b:96" and 1469404800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shan Feng" and pe.signatures [ i ] . serial == "15:95:05:e6:45:6b:9a:93:52:f7:c4:71:68:d8:9b:96" and 1469404800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55392,13 +55392,13 @@ rule REVERSINGLABS_Cert_Blocklist_04A0E92B0B9Ebbb797Df6Ef52Bd5Ad05 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "c6ba359e-4883-534d-bc86-8c063e54c92f"
+		id = "2e7a0b23-ae62-5d9c-b77f-53c5b2868769"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16854-L16870"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ff2a2d06c48bd3426fa42526d966152e3e7166c4170b4e08bb65ee5d876eda93"
+		logic_hash = "v1_sha256_ff2a2d06c48bd3426fa42526d966152e3e7166c4170b4e08bb65ee5d876eda93"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55408,7 +55408,7 @@ rule REVERSINGLABS_Cert_Blocklist_04A0E92B0B9Ebbb797Df6Ef52Bd5Ad05 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures[i].serial=="04:a0:e9:2b:0b:9e:bb:b7:97:df:6e:f5:2b:d5:ad:05" and 1479081600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures [ i ] . serial == "04:a0:e9:2b:0b:9e:bb:b7:97:df:6e:f5:2b:d5:ad:05" and 1479081600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55417,13 +55417,13 @@ rule REVERSINGLABS_Cert_Blocklist_25F222Ab2613Dc4270B2Aabc2519A101 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "4458df2d-82c2-5377-9746-101c2de52913"
+		id = "5278ee3b-32d0-5bb2-aa6b-a66cc0506a6d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16872-L16888"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2c6673f6821c4ba11fc015cf3e9edefeb7c45209bc9dcd18501c4681444a9b9e"
+		logic_hash = "v1_sha256_2c6673f6821c4ba11fc015cf3e9edefeb7c45209bc9dcd18501c4681444a9b9e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55433,7 +55433,7 @@ rule REVERSINGLABS_Cert_Blocklist_25F222Ab2613Dc4270B2Aabc2519A101 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aeroscan TOV" and pe.signatures[i].serial=="25:f2:22:ab:26:13:dc:42:70:b2:aa:bc:25:19:a1:01" and 1445299200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Aeroscan TOV" and pe.signatures [ i ] . serial == "25:f2:22:ab:26:13:dc:42:70:b2:aa:bc:25:19:a1:01" and 1445299200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55442,13 +55442,13 @@ rule REVERSINGLABS_Cert_Blocklist_212Ca239866F88C3D5B000B3004A569C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b433cddc-25c3-5627-99b5-ff9bc7fa73ed"
+		id = "4010ffe7-2b73-5458-bb75-96d6d8c8bd8f"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16890-L16906"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "23ab2343b17dce74fb4166a690ca5dd300b3ed20d3a6b43b922f456410d3035d"
+		logic_hash = "v1_sha256_23ab2343b17dce74fb4166a690ca5dd300b3ed20d3a6b43b922f456410d3035d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55458,7 +55458,7 @@ rule REVERSINGLABS_Cert_Blocklist_212Ca239866F88C3D5B000B3004A569C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "XECURE LAB CO., LTD." and pe.signatures[i].serial=="21:2c:a2:39:86:6f:88:c3:d5:b0:00:b3:00:4a:56:9c" and 1347840000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "XECURE LAB CO., LTD." and pe.signatures [ i ] . serial == "21:2c:a2:39:86:6f:88:c3:d5:b0:00:b3:00:4a:56:9c" and 1347840000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55467,13 +55467,13 @@ rule REVERSINGLABS_Cert_Blocklist_18B700A319Aa98Ae71B279D4E8030B82 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "8d1a98aa-a895-5e79-905c-760166352d4f"
+		id = "77ac5c41-8b2c-51ea-8f41-0d0863cbe4df"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16908-L16924"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "e201498acfd9afebc68321887a806bb5c1d74c64a7cd93530feae2a944bd30fa"
+		logic_hash = "v1_sha256_e201498acfd9afebc68321887a806bb5c1d74c64a7cd93530feae2a944bd30fa"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55483,7 +55483,7 @@ rule REVERSINGLABS_Cert_Blocklist_18B700A319Aa98Ae71B279D4E8030B82 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="18:b7:00:a3:19:aa:98:ae:71:b2:79:d4:e8:03:0b:82" and 1479686400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "18:b7:00:a3:19:aa:98:ae:71:b2:79:d4:e8:03:0b:82" and 1479686400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55492,13 +55492,13 @@ rule REVERSINGLABS_Cert_Blocklist_169138A86954Be1D9B264F47 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "56653f72-39af-50e7-9908-e516f9b21084"
+		id = "15f910d8-1283-5271-a378-a9282f8418b8"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16926-L16942"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1584e39b4e2025611bcb7bbbd92b97d25d12ddbb1e5c282db87730a03f7f56b1"
+		logic_hash = "v1_sha256_1584e39b4e2025611bcb7bbbd92b97d25d12ddbb1e5c282db87730a03f7f56b1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55508,7 +55508,7 @@ rule REVERSINGLABS_Cert_Blocklist_169138A86954Be1D9B264F47 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="16:91:38:a8:69:54:be:1d:9b:26:4f:47" and 1477636474<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIG JOURNEY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "16:91:38:a8:69:54:be:1d:9b:26:4f:47" and 1477636474 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55517,13 +55517,13 @@ rule REVERSINGLABS_Cert_Blocklist_33412168Eeb3C0E4C7Dd0508A9Ffecd5 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "db2ae33e-d3af-5200-ad15-824e29434e2c"
+		id = "22b40c83-1572-55c4-9150-7eb2dcac852b"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16944-L16960"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d634af0637c3349fe1718ee807b8a75007ab46b141494331901a22ce54e9fc5d"
+		logic_hash = "v1_sha256_d634af0637c3349fe1718ee807b8a75007ab46b141494331901a22ce54e9fc5d"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55533,7 +55533,7 @@ rule REVERSINGLABS_Cert_Blocklist_33412168Eeb3C0E4C7Dd0508A9Ffecd5 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures[i].serial=="33:41:21:68:ee:b3:c0:e4:c7:dd:05:08:a9:ff:ec:d5" and 1467590400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Caiyunshidai Technology Co., Ltd." and pe.signatures [ i ] . serial == "33:41:21:68:ee:b3:c0:e4:c7:dd:05:08:a9:ff:ec:d5" and 1467590400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55542,13 +55542,13 @@ rule REVERSINGLABS_Cert_Blocklist_422Ab71Ac7Fb125Ad7171B0C99510B0E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "002e344e-a073-5d00-9488-d73fad51c66a"
+		id = "8a0209eb-1d20-5d1d-a4fc-a29ed279ea46"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16962-L16978"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "7366e5064a9a9f66260730575327e404eadea096ba3f6cf28c83c47bef9bca58"
+		logic_hash = "v1_sha256_7366e5064a9a9f66260730575327e404eadea096ba3f6cf28c83c47bef9bca58"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55558,7 +55558,7 @@ rule REVERSINGLABS_Cert_Blocklist_422Ab71Ac7Fb125Ad7171B0C99510B0E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="42:2a:b7:1a:c7:fb:12:5a:d7:17:1b:0c:99:51:0b:0e" and 1475193600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "42:2a:b7:1a:c7:fb:12:5a:d7:17:1b:0c:99:51:0b:0e" and 1475193600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55567,13 +55567,13 @@ rule REVERSINGLABS_Cert_Blocklist_6F18946E5B773B7E32D9E7B4Fb8D434C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "53205508-568c-5356-9717-2915c8f3806c"
+		id = "c0044a6d-3b98-5a14-9ee5-3d88bdceb912"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16980-L16996"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fa285c17b43d1acdb05888074ecb16047209ade8f7f6191274f58eca7438dadf"
+		logic_hash = "v1_sha256_fa285c17b43d1acdb05888074ecb16047209ade8f7f6191274f58eca7438dadf"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55583,7 +55583,7 @@ rule REVERSINGLABS_Cert_Blocklist_6F18946E5B773B7E32D9E7B4Fb8D434C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VECTOR LLC (VEKTOR, OOO)" and pe.signatures[i].serial=="6f:18:94:6e:5b:77:3b:7e:32:d9:e7:b4:fb:8d:43:4c" and 1454716800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VECTOR LLC (VEKTOR, OOO)" and pe.signatures [ i ] . serial == "6f:18:94:6e:5b:77:3b:7e:32:d9:e7:b4:fb:8d:43:4c" and 1454716800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55592,13 +55592,13 @@ rule REVERSINGLABS_Cert_Blocklist_3596Dfc23B9A42C66700982250Da2906 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "15c3551f-7b08-5e7f-a540-68b3eccac316"
+		id = "9215ee37-3c56-54f0-8031-506e51caeb7a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L16998-L17014"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "1b69bf520fde5255069cf8752d5c67716e9bc297ddde1566551a563a563197ea"
+		logic_hash = "v1_sha256_1b69bf520fde5255069cf8752d5c67716e9bc297ddde1566551a563a563197ea"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55608,7 +55608,7 @@ rule REVERSINGLABS_Cert_Blocklist_3596Dfc23B9A42C66700982250Da2906 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Open Source Developer, Song WU" and pe.signatures[i].serial=="35:96:df:c2:3b:9a:42:c6:67:00:98:22:50:da:29:06" and 1397219344<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Open Source Developer, Song WU" and pe.signatures [ i ] . serial == "35:96:df:c2:3b:9a:42:c6:67:00:98:22:50:da:29:06" and 1397219344 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55617,13 +55617,13 @@ rule REVERSINGLABS_Cert_Blocklist_486Bbddc8C5Ee99F051Ecaeb3F99D2A3 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "07b43dd7-e8f1-5b14-a0f4-42294b5b597e"
+		id = "c6a2a350-8969-5785-af6a-3e2707dbd867"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17016-L17032"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "75855e26ba4e01b56a551a006e789c6032cfb02c6f6125a9bdf8becb848db5b2"
+		logic_hash = "v1_sha256_75855e26ba4e01b56a551a006e789c6032cfb02c6f6125a9bdf8becb848db5b2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55633,7 +55633,7 @@ rule REVERSINGLABS_Cert_Blocklist_486Bbddc8C5Ee99F051Ecaeb3F99D2A3 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="48:6b:bd:dc:8c:5e:e9:9f:05:1e:ca:eb:3f:99:d2:a3" and 1473292800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "48:6b:bd:dc:8c:5e:e9:9f:05:1e:ca:eb:3f:99:d2:a3" and 1473292800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55642,13 +55642,13 @@ rule REVERSINGLABS_Cert_Blocklist_11211Eea9D0D1D1A325B5Eae1B2B1951120F : INFO FI
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "09b8b3f3-a4aa-5584-b8d0-751cc87267bf"
+		id = "43b52d35-93b4-5fea-9d0e-fd0e20b3884d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17034-L17050"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bafab986605be61d25a6764042937bc5d8c55196ea8ea9aa9360764d9681351b"
+		logic_hash = "v1_sha256_bafab986605be61d25a6764042937bc5d8c55196ea8ea9aa9360764d9681351b"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55658,7 +55658,7 @@ rule REVERSINGLABS_Cert_Blocklist_11211Eea9D0D1D1A325B5Eae1B2B1951120F : INFO FI
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC HERMES" and pe.signatures[i].serial=="11:21:1e:ea:9d:0d:1d:1a:32:5b:5e:ae:1b:2b:19:51:12:0f" and 1460147212<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LLC HERMES" and pe.signatures [ i ] . serial == "11:21:1e:ea:9d:0d:1d:1a:32:5b:5e:ae:1b:2b:19:51:12:0f" and 1460147212 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55667,13 +55667,13 @@ rule REVERSINGLABS_Cert_Blocklist_172Fea8Cb06Ffced6Bfac7F2F6B77754 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "0890bf55-ebd5-5b68-8047-14692a5f1ae7"
+		id = "25b24b0e-16de-568b-8138-ee26211bbc8c"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17052-L17068"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8e1e3e7d002ce084600c5444dc9b0bad8771370cb7919a3bb5ebc899040e4cf2"
+		logic_hash = "v1_sha256_8e1e3e7d002ce084600c5444dc9b0bad8771370cb7919a3bb5ebc899040e4cf2"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55683,7 +55683,7 @@ rule REVERSINGLABS_Cert_Blocklist_172Fea8Cb06Ffced6Bfac7F2F6B77754 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xin Zhou" and pe.signatures[i].serial=="17:2f:ea:8c:b0:6f:fc:ed:6b:fa:c7:f2:f6:b7:77:54" and 1467936000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xin Zhou" and pe.signatures [ i ] . serial == "17:2f:ea:8c:b0:6f:fc:ed:6b:fa:c7:f2:f6:b7:77:54" and 1467936000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55692,13 +55692,13 @@ rule REVERSINGLABS_Cert_Blocklist_3Ee50Bb98Fadca2D662A0920E76685A2 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "5c35c73e-e4f6-5707-ad91-1db7c0a0ec81"
+		id = "91cbe98e-d04b-556b-b9af-9c9e5a927587"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17070-L17086"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "d232923ed962fbf4a9a30890778c2380d6c6967a693c6f77c2f558bb4347e60e"
+		logic_hash = "v1_sha256_d232923ed962fbf4a9a30890778c2380d6c6967a693c6f77c2f558bb4347e60e"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55708,7 +55708,7 @@ rule REVERSINGLABS_Cert_Blocklist_3Ee50Bb98Fadca2D662A0920E76685A2 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABDULKADIR SAHIN" and pe.signatures[i].serial=="3e:e5:0b:b9:8f:ad:ca:2d:66:2a:09:20:e7:66:85:a2" and 1330041600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ABDULKADIR SAHIN" and pe.signatures [ i ] . serial == "3e:e5:0b:b9:8f:ad:ca:2d:66:2a:09:20:e7:66:85:a2" and 1330041600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55717,13 +55717,13 @@ rule REVERSINGLABS_Cert_Blocklist_21Bfddb6A66435D1Adce2Ceb23Ed7C9A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "2009c47b-8a15-50fd-a229-5e34244ede1f"
+		id = "c1c1a81c-4cff-5522-a920-0f2cc68b31b2"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17088-L17104"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "22ad68974a1c6729da369c26372ba93c25ddf68df880580c727bf2d3ee2d3a86"
+		logic_hash = "v1_sha256_22ad68974a1c6729da369c26372ba93c25ddf68df880580c727bf2d3ee2d3a86"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55733,7 +55733,7 @@ rule REVERSINGLABS_Cert_Blocklist_21Bfddb6A66435D1Adce2Ceb23Ed7C9A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x9D\\xA8\\xE6\\xB7\\x87\\xE6\\x99\\xBA" and pe.signatures[i].serial=="21:bf:dd:b6:a6:64:35:d1:ad:ce:2c:eb:23:ed:7c:9a" and 1395297334<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE6\\x9D\\xA8\\xE6\\xB7\\x87\\xE6\\x99\\xBA" and pe.signatures [ i ] . serial == "21:bf:dd:b6:a6:64:35:d1:ad:ce:2c:eb:23:ed:7c:9a" and 1395297334 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55742,13 +55742,13 @@ rule REVERSINGLABS_Cert_Blocklist_5B1C3F7Bbaa91Ca49B06A5C1004Ee5Be : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "b78e7f2b-8122-5df6-ad79-393db9e0498d"
+		id = "e33a0889-2d9c-51af-b7ce-8dd878e9e958"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17106-L17122"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9a8d9acc87668a6fbd9fdd52b6ef69d18de8f19d8f3d3ca8eeb630c6e8c25c65"
+		logic_hash = "v1_sha256_9a8d9acc87668a6fbd9fdd52b6ef69d18de8f19d8f3d3ca8eeb630c6e8c25c65"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55758,7 +55758,7 @@ rule REVERSINGLABS_Cert_Blocklist_5B1C3F7Bbaa91Ca49B06A5C1004Ee5Be : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jin Yuguang" and pe.signatures[i].serial=="5b:1c:3f:7b:ba:a9:1c:a4:9b:06:a5:c1:00:4e:e5:be" and 1440643213<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Jin Yuguang" and pe.signatures [ i ] . serial == "5b:1c:3f:7b:ba:a9:1c:a4:9b:06:a5:c1:00:4e:e5:be" and 1440643213 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55767,13 +55767,13 @@ rule REVERSINGLABS_Cert_Blocklist_0A2089 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "51e603bb-ef21-55e8-8f2b-94865f1213c9"
+		id = "bcb3dc52-b157-50fe-a3f7-4b212a893f24"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17124-L17140"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "07ce4d39af1e56fbbfa400cf139956826999043480f93c0fc43ed056f6420d7f"
+		logic_hash = "v1_sha256_07ce4d39af1e56fbbfa400cf139956826999043480f93c0fc43ed056f6420d7f"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55783,7 +55783,7 @@ rule REVERSINGLABS_Cert_Blocklist_0A2089 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RocketMedia S.r.l." and pe.signatures[i].serial=="0a:20:89" and 1050073884<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RocketMedia S.r.l." and pe.signatures [ i ] . serial == "0a:20:89" and 1050073884 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55792,13 +55792,13 @@ rule REVERSINGLABS_Cert_Blocklist_1F84E030A0Ed10D5Ffe2B81B : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "170dae5a-ed7e-5f20-9ccd-94724e4b2084"
+		id = "9332b833-3c37-5bbf-90a3-e73ae63e9b37"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17142-L17158"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "097655cb2965ae71efb905ddf20ed30c240d25e03d08a1b6c87b472533ccc9d8"
+		logic_hash = "v1_sha256_097655cb2965ae71efb905ddf20ed30c240d25e03d08a1b6c87b472533ccc9d8"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55808,7 +55808,7 @@ rule REVERSINGLABS_Cert_Blocklist_1F84E030A0Ed10D5Ffe2B81B : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures[i].serial=="1f:84:e0:30:a0:ed:10:d5:ff:e2:b8:1b" and 1476869735<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VANKY TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "1f:84:e0:30:a0:ed:10:d5:ff:e2:b8:1b" and 1476869735 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55817,13 +55817,13 @@ rule REVERSINGLABS_Cert_Blocklist_88346267057C0A82E2F39851D1B9694C : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "3be920eb-7b71-53c4-94b7-0ffc88d14c59"
+		id = "71f13e2d-4280-5788-8e1d-ba17280d1b5a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17160-L17178"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "60acdbad8ad3e1d4a863ce160d93abd0b5e2b214858cba84f7a1b907d2491486"
+		logic_hash = "v1_sha256_60acdbad8ad3e1d4a863ce160d93abd0b5e2b214858cba84f7a1b907d2491486"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55833,7 +55833,7 @@ rule REVERSINGLABS_Cert_Blocklist_88346267057C0A82E2F39851D1B9694C : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hudson LLC" and (pe.signatures[i].serial=="00:88:34:62:67:05:7c:0a:82:e2:f3:98:51:d1:b9:69:4c" or pe.signatures[i].serial=="88:34:62:67:05:7c:0a:82:e2:f3:98:51:d1:b9:69:4c") and 1595376000<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Hudson LLC" and ( pe.signatures [ i ] . serial == "00:88:34:62:67:05:7c:0a:82:e2:f3:98:51:d1:b9:69:4c" or pe.signatures [ i ] . serial == "88:34:62:67:05:7c:0a:82:e2:f3:98:51:d1:b9:69:4c" ) and 1595376000 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55842,13 +55842,13 @@ rule REVERSINGLABS_Cert_Blocklist_A46F9D8784778Baa48167C48Bbc56F30 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "72d36a5f-6599-5456-ac67-0589e37bd035"
+		id = "dd7ec730-dba5-5ccb-ad92-a8e1b0e23451"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17180-L17198"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fffb6309355bc6764b0ab033db5964599c86c9a2f6d8985975a07f6b3ebb40ed"
+		logic_hash = "v1_sha256_fffb6309355bc6764b0ab033db5964599c86c9a2f6d8985975a07f6b3ebb40ed"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55858,7 +55858,7 @@ rule REVERSINGLABS_Cert_Blocklist_A46F9D8784778Baa48167C48Bbc56F30 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mapping OOO" and (pe.signatures[i].serial=="00:a4:6f:9d:87:84:77:8b:aa:48:16:7c:48:bb:c5:6f:30" or pe.signatures[i].serial=="a4:6f:9d:87:84:77:8b:aa:48:16:7c:48:bb:c5:6f:30") and 1618963200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Mapping OOO" and ( pe.signatures [ i ] . serial == "00:a4:6f:9d:87:84:77:8b:aa:48:16:7c:48:bb:c5:6f:30" or pe.signatures [ i ] . serial == "a4:6f:9d:87:84:77:8b:aa:48:16:7c:48:bb:c5:6f:30" ) and 1618963200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55867,13 +55867,13 @@ rule REVERSINGLABS_Cert_Blocklist_525B5529Db20D17A85Be284D6B7952Ea : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "52cdf082-7212-53e6-9e55-b86153e6afe8"
+		id = "e91e29fb-961d-59ca-8fac-e2b2666e12a9"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17200-L17216"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "8fd406004b634e4826659b1dff88c61074fd321969b9fd63ea45d8e9608b35f1"
+		logic_hash = "v1_sha256_8fd406004b634e4826659b1dff88c61074fd321969b9fd63ea45d8e9608b35f1"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55883,7 +55883,7 @@ rule REVERSINGLABS_Cert_Blocklist_525B5529Db20D17A85Be284D6B7952Ea : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Buster Ind Com Imp e Exp de Acessorios P Autos Ltda" and pe.signatures[i].serial=="52:5b:55:29:db:20:d1:7a:85:be:28:4d:6b:79:52:ea" and 1508198400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Buster Ind Com Imp e Exp de Acessorios P Autos Ltda" and pe.signatures [ i ] . serial == "52:5b:55:29:db:20:d1:7a:85:be:28:4d:6b:79:52:ea" and 1508198400 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55892,13 +55892,13 @@ rule REVERSINGLABS_Cert_Blocklist_70Ae0E517D2Ef6D5Eed06B56730A1A9A : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "98c19385-555e-5827-b03c-59645ad2a101"
+		id = "a49a5912-d381-586f-a930-c1d9afa8f52d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17218-L17234"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "017eed878daf706eb96b638a8d1f4428466bc1d00ce27f32628bd249a658a813"
+		logic_hash = "v1_sha256_017eed878daf706eb96b638a8d1f4428466bc1d00ce27f32628bd249a658a813"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55908,7 +55908,7 @@ rule REVERSINGLABS_Cert_Blocklist_70Ae0E517D2Ef6D5Eed06B56730A1A9A : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Yu Bao" and pe.signatures[i].serial=="70:ae:0e:51:7d:2e:f6:d5:ee:d0:6b:56:73:0a:1a:9a" and 1475193600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Yu Bao" and pe.signatures [ i ] . serial == "70:ae:0e:51:7d:2e:f6:d5:ee:d0:6b:56:73:0a:1a:9a" and 1475193600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55917,13 +55917,13 @@ rule REVERSINGLABS_Cert_Blocklist_57C3717C5E2Ce9A2E0Cf0340C03F458E : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "47207784-5aee-5fa3-bed9-2c12d9932c38"
+		id = "405a5f4b-8f23-5d81-81d6-41c18a310cb7"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17236-L17252"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "fd710146874528c43ad8a9f847b7704c44ba4564cf79e20e6b23aa98b0ee2ea5"
+		logic_hash = "v1_sha256_fd710146874528c43ad8a9f847b7704c44ba4564cf79e20e6b23aa98b0ee2ea5"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55933,7 +55933,7 @@ rule REVERSINGLABS_Cert_Blocklist_57C3717C5E2Ce9A2E0Cf0340C03F458E : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Citizen Travel Ltd" and pe.signatures[i].serial=="57:c3:71:7c:5e:2c:e9:a2:e0:cf:03:40:c0:3f:45:8e" and 1450915200<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Citizen Travel Ltd" and pe.signatures [ i ] . serial == "57:c3:71:7c:5e:2c:e9:a2:e0:cf:03:40:c0:3f:45:8e" and 1450915200 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55942,13 +55942,13 @@ rule REVERSINGLABS_Cert_Blocklist_0761110Efe0B688C469D687512828C1F : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "e8575a71-124b-5040-91b1-ccad371e10da"
+		id = "00c04b44-9b83-59b6-a64f-b27e7b61e65d"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17254-L17270"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0ba60e1f58c7335ba5aa261031d09ee83a0ee51e05f8f26078b2a5c776ad0add"
+		logic_hash = "v1_sha256_0ba60e1f58c7335ba5aa261031d09ee83a0ee51e05f8f26078b2a5c776ad0add"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55958,7 +55958,7 @@ rule REVERSINGLABS_Cert_Blocklist_0761110Efe0B688C469D687512828C1F : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ENP Games Co., Ltd." and pe.signatures[i].serial=="07:61:11:0e:fe:0b:68:8c:46:9d:68:75:12:82:8c:1f" and 1433721600<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ENP Games Co., Ltd." and pe.signatures [ i ] . serial == "07:61:11:0e:fe:0b:68:8c:46:9d:68:75:12:82:8c:1f" and 1433721600 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -55967,13 +55967,13 @@ rule REVERSINGLABS_Cert_Blocklist_08Aa03F385F870E3A6D243B74B1Dadf6 : INFO FILE
 	meta:
 		description = "Certificate used for digitally signing malware."
 		author = "ReversingLabs"
-		id = "64aa17fe-676d-5c6e-babc-15b5e8dc72bb"
+		id = "db67a5aa-7fa5-5f11-8add-b7cb75ee6c8a"
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/certificate/blocklist.yara#L17272-L17288"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ef49a28a93d31c55dd2dfd3bec645f757a0a1a7eb8718ce92cf47bf9af126aed"
+		logic_hash = "v1_sha256_ef49a28a93d31c55dd2dfd3bec645f757a0a1a7eb8718ce92cf47bf9af126aed"
 		score = 75
 		quality = 90
 		tags = "INFO, FILE"
@@ -55983,20 +55983,20 @@ rule REVERSINGLABS_Cert_Blocklist_08Aa03F385F870E3A6D243B74B1Dadf6 : INFO FILE
 		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE4\\xB8\\x9C\\xE8\\x8E\\x9E\\xE5\\xB8\\x82\\xE8\\x85\\xBE\\xE4\\xBA\\x91\\xE8\\xAE\\xA1\\xE7\\xAE\\x97\\xE6\\x9C\\xBA\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="08:aa:03:f3:85:f8:70:e3:a6:d2:43:b7:4b:1d:ad:f6" and 1352678400<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5A4D and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE4\\xB8\\x9C\\xE8\\x8E\\x9E\\xE5\\xB8\\x82\\xE8\\x85\\xBE\\xE4\\xBA\\x91\\xE8\\xAE\\xA1\\xE7\\xAE\\x97\\xE6\\x9C\\xBA\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "08:aa:03:f3:85:f8:70:e3:a6:d2:43:b7:4b:1d:ad:f6" and 1352678400 <= pe.signatures [ i ] . not_after )
 }
 rule REVERSINGLABS_Bytecode_MSIL_Infostealer_Gomorrahstealer : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects GomorrahStealer infostealer."
 		author = "ReversingLabs"
-		id = "f3c14d23-47a2-5b09-8f48-0c2f9350516a"
+		id = "b4125be8-065c-5e79-a077-eb64d74b6c24"
 		date = "2024-11-27"
 		modified = "2024-11-27"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/infostealer/ByteCode.MSIL.Infostealer.GomorrahStealer.yara#L1-L111"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "75d86ea2ef9f24487ef54979508170651cd60abba6daa4c3117e20a77bb3b086"
+		logic_hash = "v1_sha256_75d86ea2ef9f24487ef54979508170651cd60abba6daa4c3117e20a77bb3b086"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -56080,20 +56080,20 @@ rule REVERSINGLABS_Bytecode_MSIL_Infostealer_Gomorrahstealer : TC_DETECTION MALI
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($get_browser_autofill_data) and ($get_browser_cookies) and ($take_screenshot) and ($get_antivirus_information) and ($get_browser_history)
+		uint16( 0 ) == 0x5A4D and ( $get_browser_autofill_data ) and ( $get_browser_cookies ) and ( $take_screenshot ) and ( $get_antivirus_information ) and ( $get_browser_history )
 }
 rule REVERSINGLABS_Win64_Infostealer_Daolpu : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects Daolpu infostealer."
 		author = "ReversingLabs"
-		id = "bf815556-6ccf-506a-b858-5f4c18282c05"
+		id = "3ef2721e-f125-554a-aa22-c324870cca9b"
 		date = "2024-08-26"
 		modified = "2024-08-26"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/infostealer/Win64.Infostealer.Daolpu.yara#L1-L322"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "5ffd0427c6c8e666cfabc48426e7771595a7024548706f37a1de3538e4e2d559"
+		logic_hash = "v1_sha256_5ffd0427c6c8e666cfabc48426e7771595a7024548706f37a1de3538e4e2d559"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -56378,20 +56378,20 @@ rule REVERSINGLABS_Win64_Infostealer_Daolpu : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($network_communication) and ( all of ($find_sensitive_files_p*)) and ( all of ($parse_firefox_configuration_p*)) and ( all of ($collect_browser_passwords_p*)) and ( all of ($collect_cookies_p*)))
+		uint16( 0 ) == 0x5A4D and ( ( $network_communication ) and ( all of ( $find_sensitive_files_p* ) ) and ( all of ( $parse_firefox_configuration_p* ) ) and ( all of ( $collect_browser_passwords_p* ) ) and ( all of ( $collect_cookies_p* ) ) )
 }
 rule REVERSINGLABS_Win32_Infostealer_Lumarstealer : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects LumarStealer infostealer."
 		author = "ReversingLabs"
-		id = "a1358846-7cc2-53ac-89a9-c6c99f492284"
+		id = "1f7206a7-3f3f-54f8-b0ff-741ac988d5e1"
 		date = "2023-12-07"
 		modified = "2023-12-07"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/infostealer/Win32.Infostealer.LumarStealer.yara#L1-L190"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "0bc9e12396b1e85f69b965e9ea50960c59c50aba40317fb4de8f6abd092ec7d2"
+		logic_hash = "v1_sha256_0bc9e12396b1e85f69b965e9ea50960c59c50aba40317fb4de8f6abd092ec7d2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -56553,20 +56553,20 @@ rule REVERSINGLABS_Win32_Infostealer_Lumarstealer : TC_DETECTION MALICIOUS MALWA
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($collect_os_information_p*)) and ( all of ($send_data_to_c2_p*)) and ( all of ($find_files_p*)) and ( all of ($find_crypto_wallets_*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $collect_os_information_p* ) ) and ( all of ( $send_data_to_c2_p* ) ) and ( all of ( $find_files_p* ) ) and ( all of ( $find_crypto_wallets_* ) )
 }
 rule REVERSINGLABS_Win32_Infostealer_Stealc : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects StealC infostealer."
 		author = "ReversingLabs"
-		id = "b53bbf15-3e94-513c-91a9-83dda421063b"
+		id = "f8e00c44-6860-539b-8a54-09434ea67ef1"
 		date = "2023-06-07"
 		modified = "2023-06-07"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/infostealer/Win32.Infostealer.StealC.yara#L1-L57"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "bea1cf370150387eb185deff726e10e660e7eb571c20d22878def08b36f457bf"
+		logic_hash = "v1_sha256_bea1cf370150387eb185deff726e10e660e7eb571c20d22878def08b36f457bf"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -56604,20 +56604,20 @@ rule REVERSINGLABS_Win32_Infostealer_Stealc : TC_DETECTION MALICIOUS MALWARE FIL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($resolve_windows_api) and ($load_sqlite3_functions) and ($check_license_expiration_date)
+		uint16( 0 ) == 0x5A4D and ( $resolve_windows_api ) and ( $load_sqlite3_functions ) and ( $check_license_expiration_date )
 }
 rule REVERSINGLABS_Win32_Infostealer_Multigrainpos : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects MultigrainPOS infostealer."
 		author = "ReversingLabs"
-		id = "595c04af-802f-556d-b22b-23cac79b256e"
+		id = "867670fd-531e-5ea8-bbf2-3c10f887d1b4"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/infostealer/Win32.Infostealer.MultigrainPOS.yara#L1-L88"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "9808c95b850a54677c4132057b8372cabf0159920b7e0e6834a83f0d39c088fa"
+		logic_hash = "v1_sha256_9808c95b850a54677c4132057b8372cabf0159920b7e0e6834a83f0d39c088fa"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -56688,20 +56688,20 @@ rule REVERSINGLABS_Win32_Infostealer_Multigrainpos : TC_DETECTION MALICIOUS MALW
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($data_exfiltration_v10_1 and $memory_scraping_v10_1 and $process_search_v10_1 and $service_creation_v10_1) or ($process_search_v11_1 and $memory_scraping_v11_1 and $data_exfiltration_v11_1 and $service_creation_v11_1))
+		uint16( 0 ) == 0x5A4D and ( ( $data_exfiltration_v10_1 and $memory_scraping_v10_1 and $process_search_v10_1 and $service_creation_v10_1 ) or ( $process_search_v11_1 and $memory_scraping_v11_1 and $data_exfiltration_v11_1 and $service_creation_v11_1 ) )
 }
 rule REVERSINGLABS_Win32_Infostealer_Projecthookpos : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
 		description = "Yara rule that detects ProjectHookPOS infostealer."
 		author = "ReversingLabs"
-		id = "dcb96a99-c8c0-5878-a3a5-fe3cfeec43c6"
+		id = "b1dc1c2f-d5f4-53d5-8b1e-699e1878d033"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/infostealer/Win32.Infostealer.ProjectHookPOS.yara#L1-L98"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "b7534c9e905256aaf80f04b746a92c50689437b288f7e393ef13fde1740c4a4e"
+		logic_hash = "v1_sha256_b7534c9e905256aaf80f04b746a92c50689437b288f7e393ef13fde1740c4a4e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -56783,7 +56783,7 @@ rule REVERSINGLABS_Win32_Infostealer_Projecthookpos : TC_DETECTION MALICIOUS MAL
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($calc_luhn and $track_1_reverse and $check_validity_1 and $encode_and_send_1 and $form_create_1 and $form_create_2 and $form_create_3)
+		uint16( 0 ) == 0x5A4D and ( $calc_luhn and $track_1_reverse and $check_validity_1 and $encode_and_send_1 and $form_create_1 and $form_create_2 and $form_create_3 )
 }
 import "pe"
 
@@ -56792,13 +56792,13 @@ rule REVERSINGLABS_Win32_Virus_Elerad : TC_DETECTION MALICIOUS MALWARE FILE
 	meta:
 		description = "Yara rule that detects Elerad virus."
 		author = "ReversingLabs"
-		id = "0307a136-ea2c-584c-bfda-f41e2c46fd09"
+		id = "de786e90-72b0-5eed-a379-f685388f96f4"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/virus/Win32.Virus.Elerad.yara#L3-L33"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "930594bf99daf55ef02542ce7b393c1c23ead75946b3da3b555102a2e7142e33"
+		logic_hash = "v1_sha256_930594bf99daf55ef02542ce7b393c1c23ead75946b3da3b555102a2e7142e33"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -56821,7 +56821,7 @@ rule REVERSINGLABS_Win32_Virus_Elerad : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($elerad_body at pe.entry_point)
+		uint16( 0 ) == 0x5A4D and ( $elerad_body at pe.entry_point )
 }
 import "pe"
 
@@ -56830,13 +56830,13 @@ rule REVERSINGLABS_Win32_Virus_Mocket : TC_DETECTION MALICIOUS MALWARE FILE
 	meta:
 		description = "Yara rule that detects Mocket virus."
 		author = "ReversingLabs"
-		id = "878c2162-9a79-52e6-af7b-95f9667f9e78"
+		id = "d0ef9e50-0964-5811-98df-e2698b7aed0b"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/virus/Win32.Virus.Mocket.yara#L3-L58"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "af16974396efe7a1a46aa39b812482dcc49d0fe95db6640c1703db479e7ea9dc"
+		logic_hash = "v1_sha256_af16974396efe7a1a46aa39b812482dcc49d0fe95db6640c1703db479e7ea9dc"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -56883,7 +56883,7 @@ rule REVERSINGLABS_Win32_Virus_Mocket : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($mocket_body_1 at pe.entry_point) and $mocket_body_2 and $mocket_body_3
+		uint16( 0 ) == 0x5A4D and ( $mocket_body_1 at pe.entry_point ) and $mocket_body_2 and $mocket_body_3
 }
 import "pe"
 
@@ -56892,13 +56892,13 @@ rule REVERSINGLABS_Win32_Virus_Greenp : TC_DETECTION MALICIOUS MALWARE FILE
 	meta:
 		description = "Yara rule that detects Greenp virus."
 		author = "ReversingLabs"
-		id = "5751e91c-652b-59bd-93b8-ece677ad4911"
+		id = "9082ed95-7709-50f3-ac8d-e83588f916b9"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/virus/Win32.Virus.Greenp.yara#L3-L46"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "ca6df34ee2ad9d93e35b0d1a2d4765f681f3981ffe2786bbc822c3090212fd02"
+		logic_hash = "v1_sha256_ca6df34ee2ad9d93e35b0d1a2d4765f681f3981ffe2786bbc822c3090212fd02"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -56934,7 +56934,7 @@ rule REVERSINGLABS_Win32_Virus_Greenp : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($greenp_body_1 at pe.entry_point) and $greenp_body_2
+		uint16( 0 ) == 0x5A4D and ( $greenp_body_1 at pe.entry_point ) and $greenp_body_2
 }
 import "pe"
 
@@ -56943,13 +56943,13 @@ rule REVERSINGLABS_Win32_Virus_Cmay : TC_DETECTION MALICIOUS MALWARE FILE
 	meta:
 		description = "Yara rule that detects Cmay virus."
 		author = "ReversingLabs"
-		id = "d61e09f1-1d3f-5e1e-9884-25f1a465e88d"
+		id = "e8597e05-e609-5061-8b7a-5baff08ba291"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/virus/Win32.Virus.Cmay.yara#L3-L73"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "f3bdf772eb80c632a913621732d12ae4a02bc7d3ba41f51711aa329be2ca6220"
+		logic_hash = "v1_sha256_f3bdf772eb80c632a913621732d12ae4a02bc7d3ba41f51711aa329be2ca6220"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -57010,7 +57010,7 @@ rule REVERSINGLABS_Win32_Virus_Cmay : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($cmay_body_1 at pe.entry_point) and $cmay_body_2
+		uint16( 0 ) == 0x5A4D and ( $cmay_body_1 at pe.entry_point ) and $cmay_body_2
 }
 import "elf"
 
@@ -57019,14 +57019,14 @@ rule REVERSINGLABS_Linux_Virus_Vit : TC_DETECTION MALICIOUS MALWARE FILE
 	meta:
 		description = "Yara rule that detects Vit virus."
 		author = "ReversingLabs"
-		id = "4515fe43-4c5a-521d-82b7-273823f0c64e"
-		date = "2024-12-08"
-		date = "2024-12-08"
+		id = "744a8269-5855-5222-ad8f-525c5d0534e6"
+		date = "2024-12-15"
+		date = "2024-12-15"
 		modified = "2023-06-07"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/virus/Linux.Virus.Vit.yara#L3-L36"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "2fba7a081dfca85aee5c7f3b33414b799ed52ca6aa5bbf031da040aaa75acde9"
+		logic_hash = "v1_sha256_2fba7a081dfca85aee5c7f3b33414b799ed52ca6aa5bbf031da040aaa75acde9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -57050,7 +57050,7 @@ rule REVERSINGLABS_Linux_Virus_Vit : TC_DETECTION MALICIOUS MALWARE FILE
 		$vit_str = "vi324.tmp"
 
 	condition:
-		uint32(0)==0x464C457F and $vit_entry_point at elf.entry_point and $vit_str
+		uint32( 0 ) == 0x464C457F and $vit_entry_point at elf.entry_point and $vit_str
 }
 import "pe"
 
@@ -57059,13 +57059,13 @@ rule REVERSINGLABS_Win32_Virus_Deadcode : TC_DETECTION MALICIOUS MALWARE FILE
 	meta:
 		description = "Yara rule that detects DeadCode virus."
 		author = "ReversingLabs"
-		id = "89ec2e39-a163-5ba6-9b19-9c94b1923d47"
+		id = "56101239-8d9d-519a-9548-2751b7c54e0f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/virus/Win32.Virus.DeadCode.yara#L3-L76"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "6ac2e48daaed222f0a19afd4d03a02834705e0e3762db3217f68569554171846"
+		logic_hash = "v1_sha256_6ac2e48daaed222f0a19afd4d03a02834705e0e3762db3217f68569554171846"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -57123,7 +57123,7 @@ rule REVERSINGLABS_Win32_Virus_Deadcode : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($deadcode_ep_1 at pe.entry_point) and ($deadcode_marker at 0x40)) or (($deadcode_ep_2 at pe.entry_point) and ($deadcode_marker at 0x40)) or (($deadcode_ep_3 at pe.entry_point) and ($deadcode_marker at 0x40)) or ($deadcode_body_1 and $deadcode_body_2))
+		uint16( 0 ) == 0x5A4D and ( ( ( $deadcode_ep_1 at pe.entry_point ) and ( $deadcode_marker at 0x40 ) ) or ( ( $deadcode_ep_2 at pe.entry_point ) and ( $deadcode_marker at 0x40 ) ) or ( ( $deadcode_ep_3 at pe.entry_point ) and ( $deadcode_marker at 0x40 ) ) or ( $deadcode_body_1 and $deadcode_body_2 ) )
 }
 import "pe"
 
@@ -57132,13 +57132,13 @@ rule REVERSINGLABS_Win32_Virus_Negt : TC_DETECTION MALICIOUS MALWARE FILE
 	meta:
 		description = "Yara rule that detects Negt virus."
 		author = "ReversingLabs"
-		id = "80e83105-dd98-5fad-9119-f851ec3199af"
+		id = "cf1c0932-76f9-5725-bbe4-37a56fba372b"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/virus/Win32.Virus.Negt.yara#L3-L94"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "43057ef111fc505678606386c8d428653da391f4b65844d81479ca05e3517346"
+		logic_hash = "v1_sha256_43057ef111fc505678606386c8d428653da391f4b65844d81479ca05e3517346"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -57216,7 +57216,7 @@ rule REVERSINGLABS_Win32_Virus_Negt : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($negt_infector at pe.entry_point) or (($negt_body_and_infector_1 at pe.entry_point) and $negt_body_and_infector_2 and $negt_body_and_infector_3 and $negt_body_and_infector_4))
+		uint16( 0 ) == 0x5A4D and ( ( $negt_infector at pe.entry_point ) or ( ( $negt_body_and_infector_1 at pe.entry_point ) and $negt_body_and_infector_2 and $negt_body_and_infector_3 and $negt_body_and_infector_4 ) )
 }
 import "pe"
 
@@ -57225,13 +57225,13 @@ rule REVERSINGLABS_Win32_Virus_Awfull : TC_DETECTION MALICIOUS MALWARE FILE
 	meta:
 		description = "Yara rule that detects Awfull virus."
 		author = "ReversingLabs"
-		id = "34104923-b401-5d39-883b-aa9a5a8e64f3"
+		id = "5effb5c5-8574-5d88-a9f2-97bea792460c"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
 		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/yara/virus/Win32.Virus.Awfull.yara#L3-L33"
 		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/9bcb61c86aa4583e393269828225349a81ea08a4/LICENSE"
-		logic_hash = "84a4faee4cbbb3387ad25bd9230c6482b8db461bc008312bc782f23e3df2eae3"
+		logic_hash = "v1_sha256_84a4faee4cbbb3387ad25bd9230c6482b8db461bc008312bc782f23e3df2eae3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -57254,15 +57254,15 @@ rule REVERSINGLABS_Win32_Virus_Awfull : TC_DETECTION MALICIOUS MALWARE FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($awfull_body at pe.entry_point)
+		uint16( 0 ) == 0x5A4D and ( $awfull_body at pe.entry_point )
 }
 /*
  * YARA Rule Set
  * Repository Name: Elastic
  * Repository: https://github.com/elastic/protections-artifacts/
- * Retrieval Date: 2024-12-08
- * Git Commit: 8824c8f250f189be8f7caf30dac0d045b7fb8651
- * Number of Rules: 1842
+ * Retrieval Date: 2024-12-15
+ * Git Commit: 401b9f547292bee56d26a35f5f9d313b0c513e89
+ * Number of Rules: 1848
  * Skipped: 0 (age), 7 (quality), 0 (score), 0 (importance)
  *
  *
@@ -57372,10 +57372,10 @@ rule ELASTIC_Windows_Trojan_Warmcookie_7D32Fa90 : FILE MEMORY
 		date = "2024-04-29"
 		modified = "2024-05-08"
 		reference = "https://www.elastic.co/security-labs/dipping-into-danger"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_WarmCookie.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_WarmCookie.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13"
-		logic_hash = "ed3be6e5c6127ef87f9ef6fe35b17815b96706e8e73a393ee9b0a8e3b0cd8f66"
+		logic_hash = "v1_sha256_ed3be6e5c6127ef87f9ef6fe35b17815b96706e8e73a393ee9b0a8e3b0cd8f66"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57402,7 +57402,7 @@ rule ELASTIC_Windows_Trojan_Warmcookie_7D32Fa90 : FILE MEMORY
 		$decrypt_str6 = "%ls\\*.*" wide fullword
 
 	condition:
-		(3 of ($plain*)) or (2 of ($seq*)) or 4 of ($decrypt*)
+		(3 of ( $plain* ) ) or ( 2 of ( $seq* ) ) or 4 of ( $decrypt* )
 }
 rule ELASTIC_Windows_Trojan_Warmcookie_E8Cd480D : FILE MEMORY
 {
@@ -57413,10 +57413,10 @@ rule ELASTIC_Windows_Trojan_Warmcookie_E8Cd480D : FILE MEMORY
 		date = "2024-09-20"
 		modified = "2024-09-30"
 		reference = "https://www.elastic.co/security-labs/dipping-into-danger"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_WarmCookie.yar#L34-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_WarmCookie.yar#L34-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f4d2c9470b322af29b9188a3a590cbe85bacb9cc8fcd7c2e94d82271ded3f659"
-		logic_hash = "addbc2e454771592a0ce6e92784ceec3f9c061f2798fe7450ac750cda5734d36"
+		logic_hash = "v1_sha256_addbc2e454771592a0ce6e92784ceec3f9c061f2798fe7450ac750cda5734d36"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57446,10 +57446,10 @@ rule ELASTIC_Linux_Trojan_Truncpx_894D60F8 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Truncpx.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Truncpx.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2f09f2884fd5d3f5193bfc392656005bce6b935c12b3049ac8eb96862e4645ba"
-		logic_hash = "9bc0a7fbddac532b53c72681f349bca0370b1fe6fb2d16f539560085b3ec4be3"
+		logic_hash = "v1_sha256_9bc0a7fbddac532b53c72681f349bca0370b1fe6fb2d16f539560085b3ec4be3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57475,10 +57475,10 @@ rule ELASTIC_Windows_Trojan_Blackshades_9D095C44 : FILE MEMORY
 		date = "2022-02-28"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BlackShades.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BlackShades.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e58e352edaa8ae7f95ab840c53fcaf7f14eb640df9223475304788533713c722"
-		logic_hash = "2a2e6325d3de9289cc8bc26e1fe89a8fa81d9aae50b92ba2cf21c4cc6556ac9e"
+		logic_hash = "v1_sha256_2a2e6325d3de9289cc8bc26e1fe89a8fa81d9aae50b92ba2cf21c4cc6556ac9e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57500,7 +57500,7 @@ rule ELASTIC_Windows_Trojan_Blackshades_9D095C44 : FILE MEMORY
 		$b5 = "tmrLiveLogger" ascii fullword
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		1 of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Blackshades_Be382Dac : FILE MEMORY
 {
@@ -57511,10 +57511,10 @@ rule ELASTIC_Windows_Trojan_Blackshades_Be382Dac : FILE MEMORY
 		date = "2022-02-28"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BlackShades.yar#L28-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BlackShades.yar#L28-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e58e352edaa8ae7f95ab840c53fcaf7f14eb640df9223475304788533713c722"
-		logic_hash = "a13e37e7930d2d1ed1aa4fdeb282f11bfeb7fe008625589e2bfeab0beea43580"
+		logic_hash = "v1_sha256_a13e37e7930d2d1ed1aa4fdeb282f11bfeb7fe008625589e2bfeab0beea43580"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57540,10 +57540,10 @@ rule ELASTIC_Windows_Exploit_Generic_E95Cc41C : FILE
 		date = "2024-02-28"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_Generic.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_Generic.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4cce9e39c376f67c16df3bcd69efd9b7472c3b478e2e5ef347e1410f1105c38d"
-		logic_hash = "9b620988a6ee84ed0cbb0fb0a3cca633fffc8e6369ed45455e9e1e6c021ea461"
+		logic_hash = "v1_sha256_9b620988a6ee84ed0cbb0fb0a3cca633fffc8e6369ed45455e9e1e6c021ea461"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -57582,10 +57582,10 @@ rule ELASTIC_Windows_Exploit_Generic_008359Cf : FILE
 		date = "2024-02-28"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_Generic.yar#L34-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_Generic.yar#L34-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "73225a3a54560965f4c4fae73f7ee234e31217bc06ff8ba1d0b36ebab5e76a87"
-		logic_hash = "9514241b5573c8d01ccd012195e29aefc3ef8a12eb982e6dd9ec66b00c064bd8"
+		logic_hash = "v1_sha256_9514241b5573c8d01ccd012195e29aefc3ef8a12eb982e6dd9ec66b00c064bd8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -57605,7 +57605,7 @@ rule ELASTIC_Windows_Exploit_Generic_008359Cf : FILE
 		$b4 = "NtDeviceIoControlFile"
 
 	condition:
-		1 of ($a*) and 3 of ($b*)
+		1 of ( $a* ) and 3 of ( $b* )
 }
 rule ELASTIC_Windows_Exploit_Generic_8C54846D : FILE
 {
@@ -57616,10 +57616,10 @@ rule ELASTIC_Windows_Exploit_Generic_8C54846D : FILE
 		date = "2024-02-29"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_Generic.yar#L59-L87"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_Generic.yar#L59-L87"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b6ea4815a38e606d4a2d6e6d711e610afec084db6899b7d6fc874491dd939495"
-		logic_hash = "0662c8edb449e15b16be3e53a88cf62af46b4a656c1a49b399e131c2ad71b55a"
+		logic_hash = "v1_sha256_0662c8edb449e15b16be3e53a88cf62af46b4a656c1a49b399e131c2ad71b55a"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -57644,7 +57644,7 @@ rule ELASTIC_Windows_Exploit_Generic_8C54846D : FILE
 		$b2 = { 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C }
 
 	condition:
-		any of ($a*) or all of ($b*)
+		any of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Donutloader_F40E3759 : FILE MEMORY
 {
@@ -57655,9 +57655,9 @@ rule ELASTIC_Windows_Trojan_Donutloader_F40E3759 : FILE MEMORY
 		date = "2021-09-15"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Donutloader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "541a4ca1da41f7cf54dff3fee917b219fadb60fd93a89b93b5efa3c1a57af81d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Donutloader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_541a4ca1da41f7cf54dff3fee917b219fadb60fd93a89b93b5efa3c1a57af81d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57684,9 +57684,9 @@ rule ELASTIC_Windows_Trojan_Donutloader_5C38878D : FILE MEMORY
 		date = "2021-09-15"
 		modified = "2021-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Donutloader.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "897880d13318027ac5008fe8d008f09780d6fa807d6cc828b57975443358750c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Donutloader.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_897880d13318027ac5008fe8d008f09780d6fa807d6cc828b57975443358750c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57712,10 +57712,10 @@ rule ELASTIC_Windows_Trojan_Donutloader_21E801E0 : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Donutloader.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Donutloader.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c3bda62725bb1047d203575bbe033f0f95d4dd6402c05f9d0c69d24bd3224ca6"
-		logic_hash = "19ef7bc8c7117024ca72956376954254c36eeb673f9379aa00475f763084a169"
+		logic_hash = "v1_sha256_19ef7bc8c7117024ca72956376954254c36eeb673f9379aa00475f763084a169"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57741,9 +57741,9 @@ rule ELASTIC_Windows_Trojan_Snakekeylogger_Af3Faa65 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SnakeKeylogger.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "54180a642d40b5366f1b400c347c25dc31397d662d6bb8af33c7d2319c97d3fb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SnakeKeylogger.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_54180a642d40b5366f1b400c347c25dc31397d662d6bb8af33c7d2319c97d3fb"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -57772,7 +57772,7 @@ rule ELASTIC_Windows_Trojan_Snakekeylogger_Af3Faa65 : FILE MEMORY
 		$c1 = "SNAKE-KEYLOGGER" ascii fullword
 
 	condition:
-		8 of ($a*) or #b1>5 or #c1>5
+		8 of ( $a* ) or #b1 > 5 or #c1 > 5
 }
 rule ELASTIC_Windows_Hacktool_Seatbelt_674Fd535 : FILE MEMORY
 {
@@ -57783,10 +57783,10 @@ rule ELASTIC_Windows_Hacktool_Seatbelt_674Fd535 : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Seatbelt.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Seatbelt.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a0e467aacd383727d46e766f1c45b424a6d46248118c155c22c538e8773b3ae7"
-		logic_hash = "1bff820ec5cc9e56e7be4b290a48628115cc1ace5e41278fa76898bf39ef893e"
+		logic_hash = "v1_sha256_1bff820ec5cc9e56e7be4b290a48628115cc1ace5e41278fa76898bf39ef893e"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -57808,7 +57808,7 @@ rule ELASTIC_Windows_Hacktool_Seatbelt_674Fd535 : FILE MEMORY
 		$str6 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii wide
 
 	condition:
-		$guid or all of ($str*)
+		$guid or all of ( $str* )
 }
 rule ELASTIC_Linux_Trojan_Subsevux_E9E80C1E : FILE MEMORY
 {
@@ -57819,10 +57819,10 @@ rule ELASTIC_Linux_Trojan_Subsevux_E9E80C1E : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Subsevux.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Subsevux.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a4ccd399ea99d4e31fbf2bbf8017c5368d29e630dc2985e90f07c10c980fa084"
-		logic_hash = "8bc38f26da5a3350cbae3e93b890220bb461ff77e83993a842f68db8f757e435"
+		logic_hash = "v1_sha256_8bc38f26da5a3350cbae3e93b890220bb461ff77e83993a842f68db8f757e435"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57848,10 +57848,10 @@ rule ELASTIC_Windows_Trojan_Darkcloud_9905Abce : FILE MEMORY
 		date = "2023-05-03"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DarkCloud.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DarkCloud.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "500cb8459c19acd5a1144c4b509c14dbddec74ad623896bfe946fde1cd99a571"
-		logic_hash = "27d3841d6acf87f5c9c03d643c7859d9eaf42e49ed0241b761f858c669c4e931"
+		logic_hash = "v1_sha256_27d3841d6acf87f5c9c03d643c7859d9eaf42e49ed0241b761f858c669c4e931"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57878,10 +57878,10 @@ rule ELASTIC_Windows_Trojan_Nanocore_D8C4E3C5 : FILE MEMORY
 		date = "2021-06-13"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Nanocore.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Nanocore.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd"
-		logic_hash = "fcc13e834cd8a1f86b453fe3c0333cd358e129d6838a339a824f1a095d85552d"
+		logic_hash = "v1_sha256_fcc13e834cd8a1f86b453fe3c0333cd358e129d6838a339a824f1a095d85552d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57906,7 +57906,7 @@ rule ELASTIC_Windows_Trojan_Nanocore_D8C4E3C5 : FILE MEMORY
 		$b9 = "IClientLoggingHost" ascii fullword
 
 	condition:
-		1 of ($a*) or 6 of ($b*)
+		1 of ( $a* ) or 6 of ( $b* )
 }
 rule ELASTIC_Linux_Trojan_Hiddad_E35Bff7B : FILE MEMORY
 {
@@ -57917,10 +57917,10 @@ rule ELASTIC_Linux_Trojan_Hiddad_E35Bff7B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Hiddad.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Hiddad.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "22a418e660b5a7a2e0cc1c1f3fe1d150831d75c4fedeed9817a221194522efcf"
-		logic_hash = "3881222807585dc933cb61473751d13297fa7eb085a50d435d3b680354a35ee9"
+		logic_hash = "v1_sha256_3881222807585dc933cb61473751d13297fa7eb085a50d435d3b680354a35ee9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57946,10 +57946,10 @@ rule ELASTIC_Linux_Ransomware_Erebus_Ead4F55B : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Erebus.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Erebus.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6558330f07a7c90c40006346ed09e859b588d031193f8a9679fe11a85c8ccb37"
-		logic_hash = "82e81577372298623ee3ed3583bb18b2c0cfff30abbacf2909e7efca35c83bd7"
+		logic_hash = "v1_sha256_82e81577372298623ee3ed3583bb18b2c0cfff30abbacf2909e7efca35c83bd7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -57977,10 +57977,10 @@ rule ELASTIC_Windows_Vulndriver_Echodrv_D17Ff31C : FILE
 		date = "2023-10-31"
 		modified = "2023-11-03"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_EchoDrv.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_EchoDrv.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ea3c5569405ed02ec24298534a983bcb5de113c18bc3fd01a4dd0b5839cd17b9"
-		logic_hash = "0b2eb3c5da8703749ee63662495d6e8738ccdc353f3ac3df48e25a77312c0da0"
+		logic_hash = "v1_sha256_0b2eb3c5da8703749ee63662495d6e8738ccdc353f3ac3df48e25a77312c0da0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -57995,7 +57995,7 @@ rule ELASTIC_Windows_Vulndriver_Echodrv_D17Ff31C : FILE
 		$str1 = "D:\\WACATACC\\Projects\\Programs\\Echo\\x64\\Release\\echo-driver.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $str1
 }
 rule ELASTIC_Windows_Trojan_Deimos_F53Aee03 : FILE MEMORY
 {
@@ -58006,10 +58006,10 @@ rule ELASTIC_Windows_Trojan_Deimos_F53Aee03 : FILE MEMORY
 		date = "2021-09-18"
 		modified = "2022-01-13"
 		reference = "https://www.elastic.co/security-labs/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Deimos.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Deimos.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
-		logic_hash = "07675844a8790f8485b6545e7466cdef8ac4f92dec4cd8289aeaad2a0a448691"
+		logic_hash = "v1_sha256_07675844a8790f8485b6545e7466cdef8ac4f92dec4cd8289aeaad2a0a448691"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58026,7 +58026,7 @@ rule ELASTIC_Windows_Trojan_Deimos_F53Aee03 : FILE MEMORY
 		$a3 = "Deimos" ascii fullword
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Deimos_C70677B4 : FILE MEMORY
 {
@@ -58037,10 +58037,10 @@ rule ELASTIC_Windows_Trojan_Deimos_C70677B4 : FILE MEMORY
 		date = "2021-09-18"
 		modified = "2022-01-13"
 		reference = "https://www.elastic.co/security-labs/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Deimos.yar#L24-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Deimos.yar#L24-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
-		logic_hash = "c969221f025b114b9d5738d43b6021ab9481dbc6b35eb129ea4f806160b1adc3"
+		logic_hash = "v1_sha256_c969221f025b114b9d5738d43b6021ab9481dbc6b35eb129ea4f806160b1adc3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58056,7 +58056,7 @@ rule ELASTIC_Windows_Trojan_Deimos_C70677B4 : FILE MEMORY
 		$a2 = { 0C 08 16 1F 68 9D 08 17 1F 77 9D 08 18 1F 69 9D 08 19 1F 64 9D }
 
 	condition:
-		1 of ($a*)
+		1 of ( $a* )
 }
 rule ELASTIC_Macos_Infostealer_Mdquerypassw_6125F987 : FILE MEMORY
 {
@@ -58067,9 +58067,9 @@ rule ELASTIC_Macos_Infostealer_Mdquerypassw_6125F987 : FILE MEMORY
 		date = "2023-04-11"
 		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Infostealer_MdQueryPassw.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "72e0c1a7507733157f93e2bff82e6ec10d50986020eeeb27a02aba5cd8c78a81"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Infostealer_MdQueryPassw.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_72e0c1a7507733157f93e2bff82e6ec10d50986020eeeb27a02aba5cd8c78a81"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -58085,7 +58085,7 @@ rule ELASTIC_Macos_Infostealer_Mdquerypassw_6125F987 : FILE MEMORY
 		$string2 = /kMDItemDisplayName\s{1,50}==\s{1,50}\S{1,50}passw\S{1,50}/ ascii wide nocase
 
 	condition:
-		any of ($string1,$string2)
+		any of ( $string1 , $string2 )
 }
 rule ELASTIC_Linux_Trojan_Rooter_C8D08D3A : FILE MEMORY
 {
@@ -58096,10 +58096,10 @@ rule ELASTIC_Linux_Trojan_Rooter_C8D08D3A : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rooter.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rooter.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f55e3aa4d875d8322cdd7caa17aa56e620473fe73c9b5ae0e18da5fbc602a6ba"
-		logic_hash = "c91f3112cc61acec08ab3cd59bab2ae833ba0d8ac565ffb26a46982f38af0e71"
+		logic_hash = "v1_sha256_c91f3112cc61acec08ab3cd59bab2ae833ba0d8ac565ffb26a46982f38af0e71"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58125,10 +58125,10 @@ rule ELASTIC_Linux_Trojan_Shark_B918Ab75 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Shark.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Shark.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8b6fe9f496996784e42b75fb42702aa47aefe32eac6f63dd16a0eb55358b6054"
-		logic_hash = "16302c29f2ae4109b8679933eb7fd9ef9306b0c215f20e8fff992b0b848974a9"
+		logic_hash = "v1_sha256_16302c29f2ae4109b8679933eb7fd9ef9306b0c215f20e8fff992b0b848974a9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58154,10 +58154,10 @@ rule ELASTIC_Windows_Vulndriver_Procexp_Aeb4E5C0 : FILE
 		date = "2022-04-04"
 		modified = "2022-10-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_ProcExp.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_ProcExp.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
-		logic_hash = "827bb2efb6d3442233f81e87a42a3f5ee5caaeadc459070c6d347c6515866c93"
+		logic_hash = "v1_sha256_827bb2efb6d3442233f81e87a42a3f5ee5caaeadc459070c6d347c6515866c93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -58174,7 +58174,7 @@ rule ELASTIC_Windows_Vulndriver_Procexp_Aeb4E5C0 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\xff][\x00-\xff])([\x00-\x10][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\xff][\x00-\xff])([\x00-\x0f][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\xfe][\x00-\xff])([\x00-\x10][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\xff][\x00-\xff])([\x00-\x10][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xfe][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Trojan_Servhelper_F4Dee200 : FILE MEMORY
 {
@@ -58185,10 +58185,10 @@ rule ELASTIC_Windows_Trojan_Servhelper_F4Dee200 : FILE MEMORY
 		date = "2022-03-22"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_ServHelper.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_ServHelper.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "05d183430a7afe16a3857fc4e87568fcc18518e108823c37eabf0514660aa17c"
-		logic_hash = "abab541ebddf36c05e351d506d4f978a30d8a44ff09233a667d62a1692dabe15"
+		logic_hash = "v1_sha256_abab541ebddf36c05e351d506d4f978a30d8a44ff09233a667d62a1692dabe15"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58215,10 +58215,10 @@ rule ELASTIC_Windows_Trojan_Servhelper_370C5287 : FILE MEMORY
 		date = "2022-03-24"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_ServHelper.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_ServHelper.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "05d183430a7afe16a3857fc4e87568fcc18518e108823c37eabf0514660aa17c"
-		logic_hash = "8a2934c28efef6a5fed26dc88d074aee15b0869370c66f6a4d6eaedf070eaa9e"
+		logic_hash = "v1_sha256_8a2934c28efef6a5fed26dc88d074aee15b0869370c66f6a4d6eaedf070eaa9e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58244,10 +58244,10 @@ rule ELASTIC_Linux_Exploit_CVE_2018_10561_0F246E33 : FILE MEMORY CVE_2018_10561
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2018_10561.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2018_10561.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "eac08c105495e6fadd8651d2e9e650b6feba601ec78f537b17fb0e73f2973a1c"
-		logic_hash = "2c3785ddfded7128e983f3ec17a9f77c856d903f07e325b08f9f463950576ebe"
+		logic_hash = "v1_sha256_2c3785ddfded7128e983f3ec17a9f77c856d903f07e325b08f9f463950576ebe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2018-10561"
@@ -58273,9 +58273,9 @@ rule ELASTIC_Windows_Ransomware_Thanos_C3522Fd0 : BETA FILE MEMORY
 		date = "2020-11-03"
 		modified = "2021-08-23"
 		reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Thanos.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "00d28aafd242308ad6561547ed8c80dad3086859dacab09ffdd43d436bf9ec52"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Thanos.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_00d28aafd242308ad6561547ed8c80dad3086859dacab09ffdd43d436bf9ec52"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -58293,7 +58293,7 @@ rule ELASTIC_Windows_Ransomware_Thanos_C3522Fd0 : BETA FILE MEMORY
 		$c3 = { 00 2F 00 18 46 00 54 00 50 00 20 00 55 00 73 00 65 00 72 00 4E 00 }
 
 	condition:
-		2 of ($c*)
+		2 of ( $c* )
 }
 rule ELASTIC_Windows_Ransomware_Thanos_A6C09942 : BETA FILE MEMORY
 {
@@ -58304,9 +58304,9 @@ rule ELASTIC_Windows_Ransomware_Thanos_A6C09942 : BETA FILE MEMORY
 		date = "2020-11-03"
 		modified = "2021-08-23"
 		reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Thanos.yar#L24-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "cecdeb21e041c90769b8fd8431fa87943461c1f7faa5ad15918524b91ba5c792"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Thanos.yar#L24-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_cecdeb21e041c90769b8fd8431fa87943461c1f7faa5ad15918524b91ba5c792"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -58323,7 +58323,7 @@ rule ELASTIC_Windows_Ransomware_Thanos_A6C09942 : BETA FILE MEMORY
 		$b2 = { 01 0E 0E 05 00 02 0E 0E 0E 04 00 01 01 0E 04 00 01 0E 0E 06 00 03 01 0E 0E 0E 80 90 55 00 30 00 39 00 47 00 56 00 46 00 64 00 42 00 55 00 6B 00 56 00 63 00 54 00 57 00 6C 00 6A 00 63 00 6D 00 39 00 7A 00 62 00 32 00 5A 00 30 00 58 00 46 00 64 00 70 00 62 00 6D 00 52 00 76 00 64 00 33 00 4D 00 67 00 54 00 6C 00 52 00 63 00 51 00 33 00 56 00 79 00 63 00 6D 00 56 00 75 00 64 00 46 00 5A 00 6C 00 63 00 6E 00 4E 00 70 00 62 00 32 00 35 00 63 00 56 00 32 00 6C 00 }
 
 	condition:
-		1 of ($b*)
+		1 of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Thanos_E19Feca1 : BETA FILE MEMORY
 {
@@ -58334,9 +58334,9 @@ rule ELASTIC_Windows_Ransomware_Thanos_E19Feca1 : BETA FILE MEMORY
 		date = "2020-11-03"
 		modified = "2021-08-23"
 		reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Thanos.yar#L46-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "1f5a69b6749e887a5576843abb83388d5364e47601cf11fcac594008ace8e973"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Thanos.yar#L46-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_1f5a69b6749e887a5576843abb83388d5364e47601cf11fcac594008ace8e973"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -58364,7 +58364,7 @@ rule ELASTIC_Windows_Ransomware_Thanos_E19Feca1 : BETA FILE MEMORY
 		$b9 = "c3RvcCBjY0V2dE1nciAveQ==" wide fullword
 
 	condition:
-		(4 of ($a*)) or (3 of ($b*))
+		(4 of ( $a* ) ) or ( 3 of ( $b* ) )
 }
 rule ELASTIC_Windows_Hacktool_Godpotato_5F1Aad81 : FILE MEMORY
 {
@@ -58375,10 +58375,10 @@ rule ELASTIC_Windows_Hacktool_Godpotato_5F1Aad81 : FILE MEMORY
 		date = "2024-06-24"
 		modified = "2024-07-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_GodPotato.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_GodPotato.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "00171bb6e9e4a9b8601e988a8c4ac6f5413e31e1b6d86d24b0b53520cd02184c"
-		logic_hash = "3028c84a616d47b37b4ef2d41d35ccef5121c06aa042096bca8ea53b528a1eb9"
+		logic_hash = "v1_sha256_3028c84a616d47b37b4ef2d41d35ccef5121c06aa042096bca8ea53b528a1eb9"
 		score = 75
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -58413,10 +58413,10 @@ rule ELASTIC_Windows_Trojan_Xworm_732E6C12 : FILE MEMORY
 		date = "2023-04-03"
 		modified = "2024-10-15"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_XWorm.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_XWorm.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bf5ea8d5fd573abb86de0f27e64df194e7f9efbaadd5063dee8ff9c5c3baeaa2"
-		logic_hash = "6aa72029eeeb2edd2472bf0db80b9c0ae4033d7d977cbee75ac94414d1cdff7a"
+		logic_hash = "v1_sha256_6aa72029eeeb2edd2472bf0db80b9c0ae4033d7d977cbee75ac94414d1cdff7a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58448,10 +58448,10 @@ rule ELASTIC_Windows_Trojan_Xworm_B7D6Eaa8 : FILE MEMORY
 		date = "2024-09-10"
 		modified = "2024-10-15"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_XWorm.yar#L27-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_XWorm.yar#L27-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6fc4ff3f025545f7e092408b035066c1138253b972a2e9ef178e871d36f03acd"
-		logic_hash = "6a9da68dd1475974e71043a0e5a51d70762473c385d6acef34945019c7016b02"
+		logic_hash = "v1_sha256_6a9da68dd1475974e71043a0e5a51d70762473c385d6acef34945019c7016b02"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58482,10 +58482,10 @@ rule ELASTIC_Windows_Trojan_Xworm_7078E1C8 : FILE MEMORY
 		date = "2024-10-10"
 		modified = "2024-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_XWorm.yar#L52-L70"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_XWorm.yar#L52-L70"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "034c8a18c15521069af36595357d9c8413a33544af8d3ea5f0ac7d471841e0ec"
-		logic_hash = "4c69648e4a68c8c46cf435f4dcac79176a023d8cd7209f9fa6a6b244797c66f3"
+		logic_hash = "v1_sha256_4c69648e4a68c8c46cf435f4dcac79176a023d8cd7209f9fa6a6b244797c66f3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58511,10 +58511,10 @@ rule ELASTIC_Windows_Backdoor_Teamviewer_Df8E7326 : FILE MEMORY
 		date = "2022-10-29"
 		modified = "2022-12-20"
 		reference = "https://vms.drweb.com/virus/?i=8172096"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Backdoor_TeamViewer.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Backdoor_TeamViewer.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "68d9ffb6e00c2694d0d827108d0410d5a66d4f8cf839afddd17c5887b0149350"
-		logic_hash = "3d42c76626c76959e450a81001c73d8d47b52789cab324e0cc7af09303c1367d"
+		logic_hash = "v1_sha256_3d42c76626c76959e450a81001c73d8d47b52789cab324e0cc7af09303c1367d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58534,7 +58534,7 @@ rule ELASTIC_Windows_Backdoor_Teamviewer_Df8E7326 : FILE MEMORY
 		$b1 = { 55 8B EC 56 E8 BF 25 00 00 50 E8 7B 5B 00 00 8B F0 59 85 F6 75 2C 8B 75 08 56 E8 A9 25 00 00 50 }
 
 	condition:
-		5 of ($a*) or 1 of ($b*)
+		5 of ( $a* ) or 1 of ( $b* )
 }
 rule ELASTIC_Linux_Ransomware_Agenda_4562A654 : FILE MEMORY
 {
@@ -58545,10 +58545,10 @@ rule ELASTIC_Linux_Ransomware_Agenda_4562A654 : FILE MEMORY
 		date = "2024-09-12"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Agenda.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Agenda.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cd27a31e618fe93df37603e5ece3352a91f27671ee73bdc8ce9ad793cad72a0f"
-		logic_hash = "9e9adad7640cda1142c31e801d1473e4ddb84574ce1bb1694e40d96850fcb815"
+		logic_hash = "v1_sha256_9e9adad7640cda1142c31e801d1473e4ddb84574ce1bb1694e40d96850fcb815"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58577,10 +58577,10 @@ rule ELASTIC_Macos_Trojan_Kandykorn_A7Bb6944 : FILE MEMORY
 		date = "2023-10-23"
 		modified = "2023-10-23"
 		reference = "https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_KandyKorn.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_KandyKorn.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "51dd4efcf714e64b4ad472ea556bf1a017f40a193a647b9e28bf356979651077"
-		logic_hash = "65decd519dee947894dd684c52d91202ebe5587acfecc0b8b56cd73f2981e387"
+		logic_hash = "v1_sha256_65decd519dee947894dd684c52d91202ebe5587acfecc0b8b56cd73f2981e387"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58604,7 +58604,7 @@ rule ELASTIC_Macos_Trojan_Kandykorn_A7Bb6944 : FILE MEMORY
 		$rc4_key = { D9 F9 36 CE 62 8C 3E 5D 9B 36 95 69 4D 1C DE 79 E4 70 E9 38 06 4D 98 FB F4 EF 98 0A 55 58 D1 C9 0C 7E 65 0C 23 62 A2 1B 91 4A BD 17 3A BA 5C 0E 58 37 C4 7B 89 F7 4C 5B 23 A7 29 4C C1 CF D1 1B }
 
 	condition:
-		4 of ($str*) or 3 of ($seq*) or $rc4_key
+		4 of ( $str* ) or 3 of ( $seq* ) or $rc4_key
 }
 rule ELASTIC_Windows_Trojan_Quasarrat_E52Df647 : FILE MEMORY
 {
@@ -58615,10 +58615,10 @@ rule ELASTIC_Windows_Trojan_Quasarrat_E52Df647 : FILE MEMORY
 		date = "2021-06-27"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Quasarrat.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Quasarrat.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d"
-		logic_hash = "41f32e0c9b3b43d10baef10060e064ad860558bcdeb4281a30d30c16615ed21d"
+		logic_hash = "v1_sha256_41f32e0c9b3b43d10baef10060e064ad860558bcdeb4281a30d30c16615ed21d"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -58648,10 +58648,10 @@ rule ELASTIC_Windows_Trojan_Sourshark_F0247Cce : FILE MEMORY
 		date = "2024-06-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SourShark.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SourShark.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "07eb88c69437ee6e3ea2fbab5f2fbd8e846125d18c1da7d72bb462e9d083c9fc"
-		logic_hash = "0c5d802b5bfc771bdf5df541b18c7ab9de4f420fd3928bfd85b1a71cca2af1bc"
+		logic_hash = "v1_sha256_0c5d802b5bfc771bdf5df541b18c7ab9de4f420fd3928bfd85b1a71cca2af1bc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58679,10 +58679,10 @@ rule ELASTIC_Windows_Trojan_Sourshark_Adee8A17 : FILE MEMORY
 		date = "2024-06-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SourShark.yar#L23-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SourShark.yar#L23-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "07eb88c69437ee6e3ea2fbab5f2fbd8e846125d18c1da7d72bb462e9d083c9fc"
-		logic_hash = "98a4d31849a1828c2154b5032a81580f5dcc8d4a65b96dea3a727e2a82a51666"
+		logic_hash = "v1_sha256_98a4d31849a1828c2154b5032a81580f5dcc8d4a65b96dea3a727e2a82a51666"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58708,10 +58708,10 @@ rule ELASTIC_Windows_Shellcode_Rdi_Edc62A10 : FILE MEMORY
 		date = "2023-06-23"
 		modified = "2023-07-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Shellcode_Rdi.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Shellcode_Rdi.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "64485ffc283e981c8b77db5a675c7ba2a04d3effaced522531185aa46eb6a36b"
-		logic_hash = "986cb6c28d2d9767a2fd084fdd71edb7a1c36e78ddedf3c562076cf6f5b5afd1"
+		logic_hash = "v1_sha256_986cb6c28d2d9767a2fd084fdd71edb7a1c36e78ddedf3c562076cf6f5b5afd1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58737,10 +58737,10 @@ rule ELASTIC_Windows_Shellcode_Rdi_Eee75D2C : FILE MEMORY
 		date = "2023-08-25"
 		modified = "2023-11-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Shellcode_Rdi.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Shellcode_Rdi.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8c4de69e89dcc659d2fff52d695764f1efd7e64e0a80983ce6d0cb9eeddb806c"
-		logic_hash = "18cd9be4af210686872610f832ac0ad58a48588a1226fc6093348ceb8371c6b4"
+		logic_hash = "v1_sha256_18cd9be4af210686872610f832ac0ad58a48588a1226fc6093348ceb8371c6b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58766,10 +58766,10 @@ rule ELASTIC_Linux_Hacktool_Ligolong_027C0134 : FILE MEMORY
 		date = "2024-09-20"
 		modified = "2024-11-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_LigoloNG.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_LigoloNG.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "eda6037bda3ccf6bbbaf105be0826669d5c4ac205273fefe103d8c648271de54"
-		logic_hash = "a6f3c1f4c044765d841992758f451666e8bf5225e1a9f02925619c99fe8e03cb"
+		logic_hash = "v1_sha256_a6f3c1f4c044765d841992758f451666e8bf5225e1a9f02925619c99fe8e03cb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58797,9 +58797,9 @@ rule ELASTIC_Linux_Trojan_Xorddos_2Aef46A6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d2c88774eb5227cf2d133644c648ebe5ba40c7e0acb2b432bc6a1a9da10bfb3f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d2c88774eb5227cf2d133644c648ebe5ba40c7e0acb2b432bc6a1a9da10bfb3f"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -58825,10 +58825,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_A6572D63 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2ff33adb421a166895c3816d506a63dff4e1e8fa91f2ac8fb763dc6e8df59d6e"
-		logic_hash = "237392fe51c8528cb5ed446facfcd3535b8e1d594d77a542361873bd52426fa7"
+		logic_hash = "v1_sha256_237392fe51c8528cb5ed446facfcd3535b8e1d594d77a542361873bd52426fa7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58854,9 +58854,9 @@ rule ELASTIC_Linux_Trojan_Xorddos_E41143E1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L40-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "4564bf2019ff5086071ff147c9cf1e16b8627ce5d70cbe8370aecbd518d94b57"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L40-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_4564bf2019ff5086071ff147c9cf1e16b8627ce5d70cbe8370aecbd518d94b57"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58882,10 +58882,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_0Eb147Ca : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L59-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L59-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "45f25d2ffa2fc2566ed0eab6bdaf6989006315bbbbc591288be39b65abf2410b"
-		logic_hash = "b20479af0767e5e8579489b5298648b9cc84b3e0778f58d8dc9deb252d0f4806"
+		logic_hash = "v1_sha256_b20479af0767e5e8579489b5298648b9cc84b3e0778f58d8dc9deb252d0f4806"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58911,10 +58911,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_Ba961Ed2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L79-L97"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L79-L97"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "45f25d2ffa2fc2566ed0eab6bdaf6989006315bbbbc591288be39b65abf2410b"
-		logic_hash = "5b486c698c9c61dc126be5dbeea862b1f9bb5a6859c02a0fff125a9890147a6b"
+		logic_hash = "v1_sha256_5b486c698c9c61dc126be5dbeea862b1f9bb5a6859c02a0fff125a9890147a6b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58940,9 +58940,9 @@ rule ELASTIC_Linux_Trojan_Xorddos_2084099A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L99-L116"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "6674be1438ec290550c9586afda335755279a4aedadde455ffc0b41d1a0e634d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L99-L116"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_6674be1438ec290550c9586afda335755279a4aedadde455ffc0b41d1a0e634d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58968,10 +58968,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_61C88137 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L118-L136"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L118-L136"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "479ef38fa00bb13a3aa8448aa4a4434613c6729975e193eec29fc5047f339111"
-		logic_hash = "e999355606ee7389be160ce3e96c6a62d7f9132b95cfec7d9f8b1a670551e6b8"
+		logic_hash = "v1_sha256_e999355606ee7389be160ce3e96c6a62d7f9132b95cfec7d9f8b1a670551e6b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -58997,10 +58997,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_Debb98A1 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L138-L156"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L138-L156"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "494f549e3dd144e8bcb230dd7b3faa8ff5107d86d9548b21b619a0318e362cad"
-		logic_hash = "c2e43818fcf18d34a6a3611aaaafde31d96b41867d15dfdb1dec20203f5907eb"
+		logic_hash = "v1_sha256_c2e43818fcf18d34a6a3611aaaafde31d96b41867d15dfdb1dec20203f5907eb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59026,10 +59026,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_1D6E10Fd : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L158-L176"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L158-L176"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4c7851316f01ae84ee64165be3ba910ab9b415d7f0e2f5b7e5c5a0eaefa3c287"
-		logic_hash = "01ec1af1ca03173e867113c3bec7911990a0c8c2d9f19b5233715a7f7490f5f1"
+		logic_hash = "v1_sha256_01ec1af1ca03173e867113c3bec7911990a0c8c2d9f19b5233715a7f7490f5f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59055,10 +59055,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_E3Ffbbcc : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L178-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L178-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "28b7ddf2548411910af033b41982cdc74efd8a6ef059a54fda1b6cbd59faa8f6"
-		logic_hash = "54711c2d3e6d73cf4358ba4a65cb19d996adcfa905c0089a18a61fe841fe9a34"
+		logic_hash = "v1_sha256_54711c2d3e6d73cf4358ba4a65cb19d996adcfa905c0089a18a61fe841fe9a34"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59084,10 +59084,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_30F3B4D4 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L198-L216"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L198-L216"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b15d43d3535965ec9b84334cf9def0e8c3d064ffc022f6890320cd6045175bc"
-		logic_hash = "99efc257ff2afb779304451bd9f6f6ce9e88f54954189601ed10e95e2268dd4f"
+		logic_hash = "v1_sha256_99efc257ff2afb779304451bd9f6f6ce9e88f54954189601ed10e95e2268dd4f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59113,10 +59113,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_Ca75589C : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L218-L236"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L218-L236"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0448c1b2c7c738404ba11ff4b38cdc8f865ccf1e202f6711345da53ce46e7e16"
-		logic_hash = "c717e6f85a5b30514803ba43c85d82e2aaa4533b7f74db5345df83d1cc4c6551"
+		logic_hash = "v1_sha256_c717e6f85a5b30514803ba43c85d82e2aaa4533b7f74db5345df83d1cc4c6551"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59142,10 +59142,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_7909Cdd2 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L238-L256"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L238-L256"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0a4a5874f43adbe71da88dc0ef124f1bf2f4e70d0b1b5461b2788587445f79d9"
-		logic_hash = "4b2557ab78d22ae4f46e5813ba5dc4663cd92b945a1add3155f77d3030ccc92d"
+		logic_hash = "v1_sha256_4b2557ab78d22ae4f46e5813ba5dc4663cd92b945a1add3155f77d3030ccc92d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59171,10 +59171,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_2522D611 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L258-L276"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L258-L276"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0c2be53e298c285db8b028f563e97bf1cdced0c4564a34e740289b340db2aac1"
-		logic_hash = "59f2552809bc48e16719cb9b4d2a7b99999307803fce031ca39eb24e14b88908"
+		logic_hash = "v1_sha256_59f2552809bc48e16719cb9b4d2a7b99999307803fce031ca39eb24e14b88908"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59200,10 +59200,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_56Bd04D3 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L278-L296"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L278-L296"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0d2ce3891851808fb36779a348a83bf4aa9de1a2b2684fd0692434682afac5ec"
-		logic_hash = "47a33fcd69dd78cbc6c3274aeaa8dddabe119ae65b59077e1807657b8a67fed3"
+		logic_hash = "v1_sha256_47a33fcd69dd78cbc6c3274aeaa8dddabe119ae65b59077e1807657b8a67fed3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59229,10 +59229,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_F412E4B4 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L298-L316"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L298-L316"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0e3a3f7973f747fcb23c72289116659c7f158c604d937d6ca7302fbab71851e9"
-		logic_hash = "b4e1b193e80aa88b91255df3a5f2e45de7f23fdba4a28d3ceb12db63098e70e5"
+		logic_hash = "v1_sha256_b4e1b193e80aa88b91255df3a5f2e45de7f23fdba4a28d3ceb12db63098e70e5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59258,10 +59258,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_71F8E26C : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L318-L336"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L318-L336"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "13f873f83b84a0d38eb3437102f174f24a0ad3c5a53b83f0ee51c62c29fb1465"
-		logic_hash = "f9f2f22acd4f52cc313e3ecf425604651e0b8c78e33480d4d05bae5b8c9661fb"
+		logic_hash = "v1_sha256_f9f2f22acd4f52cc313e3ecf425604651e0b8c78e33480d4d05bae5b8c9661fb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59287,10 +59287,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_1A562D3B : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L338-L356"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L338-L356"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "15731db615b32c49c34f41fe84944eeaf2fc79dafaaa9ad6bf1b07d26482f055"
-		logic_hash = "8d3b369bdcecd675f99cedf26dba202256555be0f5feae612404f9b5e109fa93"
+		logic_hash = "v1_sha256_8d3b369bdcecd675f99cedf26dba202256555be0f5feae612404f9b5e109fa93"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59316,10 +59316,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_410256Ac : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L358-L376"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L358-L376"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "15f44e10ece90dec1a6104d5be1effefa17614d9f0cfb2784305dab85367b741"
-		logic_hash = "88227af6d2f365b761961bdf4b94bed81bca79e23d546e69900faa17c3e4dc71"
+		logic_hash = "v1_sha256_88227af6d2f365b761961bdf4b94bed81bca79e23d546e69900faa17c3e4dc71"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59345,10 +59345,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_93Fa87F1 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L378-L396"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L378-L396"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "165b4a28fd6335d4e4dfefb6c40f41f16d8c7d9ab0941ccd23e36cda931f715e"
-		logic_hash = "2a1e797d4dd2599b5c67e73e3c909a1803e604edf0b6ba228713ee375ccc9b16"
+		logic_hash = "v1_sha256_2a1e797d4dd2599b5c67e73e3c909a1803e604edf0b6ba228713ee375ccc9b16"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59374,10 +59374,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_8677Dca3 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L398-L416"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L398-L416"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "23813dc4aa56683e1426e5823adc3aab854469c9c0f3ec1a3fad40fa906929f2"
-		logic_hash = "9902758dfb61e8b60b281f3f51cda8a10d58eb0cc20743f97998d7bcf120c299"
+		logic_hash = "v1_sha256_9902758dfb61e8b60b281f3f51cda8a10d58eb0cc20743f97998d7bcf120c299"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59403,10 +59403,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_Ebce4304 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L418-L436"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L418-L436"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2e06caf864595f2df7f6936bb1ccaa1e0cae325aee8659ee283b2857e6ef1e5b"
-		logic_hash = "42fbfc2c2636c2e3a5da5e51c6bf99f6114ec7d00b88371a34e1fdbe81d1264a"
+		logic_hash = "v1_sha256_42fbfc2c2636c2e3a5da5e51c6bf99f6114ec7d00b88371a34e1fdbe81d1264a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59432,10 +59432,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_073E6161 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L438-L456"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L438-L456"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2e06caf864595f2df7f6936bb1ccaa1e0cae325aee8659ee283b2857e6ef1e5b"
-		logic_hash = "2c98058add77c55ab68491eec041d7670f726a9ec93258ae7bb8f0e6721b4ca3"
+		logic_hash = "v1_sha256_2c98058add77c55ab68491eec041d7670f726a9ec93258ae7bb8f0e6721b4ca3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59461,10 +59461,10 @@ rule ELASTIC_Linux_Trojan_Xorddos_Bef22375 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xorddos.yar#L458-L476"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xorddos.yar#L458-L476"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f47baf48deb71910716beab9da1b1e24dc6de9575963e238735b6bcedfe73122"
-		logic_hash = "3991ebdb310338516d5fdd137ba2ac63dc870337785a31d59dcad49135f190e5"
+		logic_hash = "v1_sha256_3991ebdb310338516d5fdd137ba2ac63dc870337785a31d59dcad49135f190e5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59490,10 +59490,10 @@ rule ELASTIC_Windows_Trojan_Dodgebox_095012D2 : FILE MEMORY
 		date = "2024-07-11"
 		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DodgeBox.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DodgeBox.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c6a3a1ea84251aed908702a1f2a565496d583239c5f467f5dcd0cfc5bfb1a6db"
-		logic_hash = "f1fe9b05deaebaddd83dda0ad98602b49682f8ba767de8c0ffad761d344c5115"
+		logic_hash = "v1_sha256_f1fe9b05deaebaddd83dda0ad98602b49682f8ba767de8c0ffad761d344c5115"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59523,10 +59523,10 @@ rule ELASTIC_Windows_Trojan_Systembc_5E883723 : FILE MEMORY
 		date = "2022-03-22"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SystemBC.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SystemBC.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b432805eb6b2b58dd957481aa8a973be58915c26c04630ce395753c6a5196b14"
-		logic_hash = "fde2e0b5debd4d26838fb245fdf8e5103ab5aab9feff900cbba00c1950adc61a"
+		logic_hash = "v1_sha256_fde2e0b5debd4d26838fb245fdf8e5103ab5aab9feff900cbba00c1950adc61a"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -59557,10 +59557,10 @@ rule ELASTIC_Windows_Trojan_Systembc_C1B58C2F : FILE MEMORY
 		date = "2024-05-02"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SystemBC.yar#L26-L49"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SystemBC.yar#L26-L49"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "016fc1db90d9d18fe25ed380606346ef12b886e1db0d80fe58c22da23f6d677d"
-		logic_hash = "16ed14dac0c30500c5e91759b0a1b321f3bd53ae6aab1389a685582eba72c222"
+		logic_hash = "v1_sha256_16ed14dac0c30500c5e91759b0a1b321f3bd53ae6aab1389a685582eba72c222"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59591,10 +59591,10 @@ rule ELASTIC_Linux_Trojan_Xhide_7F0A131B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xhide.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xhide.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
-		logic_hash = "4843042576d1f4f37b5a7cda1b261831030d9145c49b57e9b4c66e2658cc8cf9"
+		logic_hash = "v1_sha256_4843042576d1f4f37b5a7cda1b261831030d9145c49b57e9b4c66e2658cc8cf9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59620,10 +59620,10 @@ rule ELASTIC_Linux_Trojan_Xhide_Cd8489F7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xhide.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xhide.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
-		logic_hash = "34924260c811f1796ae37faec922bc21bb312ebb0672042d3ec27855f63ed61e"
+		logic_hash = "v1_sha256_34924260c811f1796ae37faec922bc21bb312ebb0672042d3ec27855f63ed61e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59649,10 +59649,10 @@ rule ELASTIC_Linux_Trojan_Xhide_840B27C7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xhide.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xhide.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
-		logic_hash = "6b0bfe69558399af6e0469a31741dcf2eb91fbe3e130267139240d3458eb8a0d"
+		logic_hash = "v1_sha256_6b0bfe69558399af6e0469a31741dcf2eb91fbe3e130267139240d3458eb8a0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59678,10 +59678,10 @@ rule ELASTIC_Linux_Hacktool_Prochide_7333221A : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Prochide.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Prochide.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fad956a6a38abac8a8a0f14cc50f473ec6fc1c9fd204e235b89523183931090b"
-		logic_hash = "413f19744240eae0a87d56da1e524e2afa0fe0ec385bd9369218713b13a93495"
+		logic_hash = "v1_sha256_413f19744240eae0a87d56da1e524e2afa0fe0ec385bd9369218713b13a93495"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59707,10 +59707,10 @@ rule ELASTIC_Linux_Trojan_Sfloost_69A5343A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sfloost.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sfloost.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0cd73db5165671c7bbd9493c34d693d25b845a9a21706081e1bf44bf0312ef9"
-		logic_hash = "bd3cd33d02c7ca1d3a0364e5e3e2f968f32da8f087f744232f3cb786da6c7875"
+		logic_hash = "v1_sha256_bd3cd33d02c7ca1d3a0364e5e3e2f968f32da8f087f744232f3cb786da6c7875"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59736,10 +59736,10 @@ rule ELASTIC_Linux_Trojan_Iroffer_53692410 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Iroffer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Iroffer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
-		logic_hash = "b8aa25fbde4d9ca36656f583e7601118a06e57703862c8b28b273881eef504fe"
+		logic_hash = "v1_sha256_b8aa25fbde4d9ca36656f583e7601118a06e57703862c8b28b273881eef504fe"
 		score = 60
 		quality = 23
 		tags = "FILE, MEMORY"
@@ -59765,10 +59765,10 @@ rule ELASTIC_Linux_Trojan_Iroffer_013E07De : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Iroffer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Iroffer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
-		logic_hash = "ce21de61f94d41aa3abb73b9391a4d9c8ddeea75f1a2b36be58111b70a9590fe"
+		logic_hash = "v1_sha256_ce21de61f94d41aa3abb73b9391a4d9c8ddeea75f1a2b36be58111b70a9590fe"
 		score = 60
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -59794,10 +59794,10 @@ rule ELASTIC_Linux_Trojan_Iroffer_0De95Cab : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Iroffer.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Iroffer.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "717bea3902109d1b1d57e57c26b81442c0705af774139cd73105b2994ab89514"
-		logic_hash = "adec3e1d3110bcc22262d5f1f2ad14a347616f4a809f29170a9fbb5d1669a4c3"
+		logic_hash = "v1_sha256_adec3e1d3110bcc22262d5f1f2ad14a347616f4a809f29170a9fbb5d1669a4c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59823,10 +59823,10 @@ rule ELASTIC_Linux_Trojan_Iroffer_711259E4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Iroffer.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Iroffer.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
-		logic_hash = "a71dbb979bc1f7671ab9958b6aa502e6ded4ee1c1b026080fd377eb772ebb1d5"
+		logic_hash = "v1_sha256_a71dbb979bc1f7671ab9958b6aa502e6ded4ee1c1b026080fd377eb772ebb1d5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59852,10 +59852,10 @@ rule ELASTIC_Linux_Trojan_Iroffer_7478Ddd9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Iroffer.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Iroffer.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "20e1509c23d7ef14b15823e4c56b9a590e70c5b7960a04e94b662fc34152266c"
-		logic_hash = "e650ee830b735a11088b628e865cd40a15054437ca05849f2eaa7838eac152e3"
+		logic_hash = "v1_sha256_e650ee830b735a11088b628e865cd40a15054437ca05849f2eaa7838eac152e3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59881,10 +59881,10 @@ rule ELASTIC_Windows_Vulndriver_Lha_F72Bff9A : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Lha.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Lha.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
-		logic_hash = "cea05432b47cf14982bda74476c8c8582068c22fe7dec6468c9756c20412dca2"
+		logic_hash = "v1_sha256_cea05432b47cf14982bda74476c8c8582068c22fe7dec6468c9756c20412dca2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -59900,7 +59900,7 @@ rule ELASTIC_Windows_Vulndriver_Lha_F72Bff9A : FILE
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4C 00 48 00 41 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Linux_Worm_Generic_920D273F : FILE MEMORY
 {
@@ -59911,10 +59911,10 @@ rule ELASTIC_Linux_Worm_Generic_920D273F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Worm_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Worm_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "04a65bc73fab91f654d448b2d7f8f15ac782965dcdeec586e20b5c7a8cc42d73"
-		logic_hash = "d0ed260857ae3002483ea7ef242b82514caaa95c2700b39dd0a03d39fdde090d"
+		logic_hash = "v1_sha256_d0ed260857ae3002483ea7ef242b82514caaa95c2700b39dd0a03d39fdde090d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59940,10 +59940,10 @@ rule ELASTIC_Linux_Worm_Generic_98Efcd38 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Worm_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Worm_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "87507f5cd73fffdb264d76db9b75f30fe21cc113bcf82c524c5386b5a380d4bb"
-		logic_hash = "c1a130d2ef8d09cb28adc4e347cbd1a083c78241752ecf3f935b03d774d00a81"
+		logic_hash = "v1_sha256_c1a130d2ef8d09cb28adc4e347cbd1a083c78241752ecf3f935b03d774d00a81"
 		score = 60
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -59969,10 +59969,10 @@ rule ELASTIC_Linux_Worm_Generic_Bd64472E : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Worm_Generic.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Worm_Generic.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b3334a3b61b1a3fc14763dc3d590100ed5e85a97493c89b499b02b76f7a0a7d0"
-		logic_hash = "9a7267a0ebc1073d0b1f81a61b963642cc816b563b43ff4d9508dd8bc195a0e1"
+		logic_hash = "v1_sha256_9a7267a0ebc1073d0b1f81a61b963642cc816b563b43ff4d9508dd8bc195a0e1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -59998,10 +59998,10 @@ rule ELASTIC_Linux_Worm_Generic_3Ff8F75B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Worm_Generic.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Worm_Generic.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "991175a96b719982f3a846df4a66161a02225c21b12a879e233e19124e90bd35"
-		logic_hash = "798e98f286201f1cda18bf1bf433826cf8a949b584f016b24a684425069d1024"
+		logic_hash = "v1_sha256_798e98f286201f1cda18bf1bf433826cf8a949b584f016b24a684425069d1024"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60027,10 +60027,10 @@ rule ELASTIC_Windows_Vulndriver_Asio_5F9F29Be : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_AsIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_AsIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "52a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15"
-		logic_hash = "a901d81737c7e6d00e87f0eec758dd063eade59d9883e85e04a33bb18f2f99de"
+		logic_hash = "v1_sha256_a901d81737c7e6d00e87f0eec758dd063eade59d9883e85e04a33bb18f2f99de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -60045,7 +60045,7 @@ rule ELASTIC_Windows_Vulndriver_Asio_5F9F29Be : FILE
 		$str1 = "\\AsIO.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Trojan_Zpevdo_7F563544 : FILE MEMORY
 {
@@ -60056,9 +60056,9 @@ rule ELASTIC_Linux_Trojan_Zpevdo_7F563544 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Zpevdo.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "9cbbb5a9166184cef630d1aba8fec721f676b868d22b1f96ffc1430e98ae974c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Zpevdo.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_9cbbb5a9166184cef630d1aba8fec721f676b868d22b1f96ffc1430e98ae974c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60084,10 +60084,10 @@ rule ELASTIC_Linux_Cryptominer_Miancha_646803Ef : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Miancha.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Miancha.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4c7761c9376ed065887dc6ce852491641419eb2d1f393c37ed0a5cb29bd108d4"
-		logic_hash = "8fd386c0e7037565e8ab206642cc8c11f05ca727b365b94ffdd991f4bed95556"
+		logic_hash = "v1_sha256_8fd386c0e7037565e8ab206642cc8c11f05ca727b365b94ffdd991f4bed95556"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60113,10 +60113,10 @@ rule ELASTIC_Windows_Trojan_Babble_0D6C9505 : FILE MEMORY
 		date = "2024-11-18"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Babble.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Babble.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fa292bfcf81223bab0f79d4ce08187e37d68960005629df0241ea22f0b95d7a8"
-		logic_hash = "e77a2e865e0a13bf2b5445e21d85d21fb0d1f816ac5c315cefda98cbb6cb7cca"
+		logic_hash = "v1_sha256_e77a2e865e0a13bf2b5445e21d85d21fb0d1f816ac5c315cefda98cbb6cb7cca"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60143,10 +60143,10 @@ rule ELASTIC_Windows_Infostealer_Strela_0Dc3E4A1 : MEMORY
 		date = "2024-03-25"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Infostealer_Strela.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Infostealer_Strela.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e6991b12e86629b38e178fef129dfda1d454391ffbb236703f8c026d6d55b9a1"
-		logic_hash = "ac1b53f2857fd13ba0e33aa94c65f0d5fa22b76d504fff347b3ff0a53f37ee26"
+		logic_hash = "v1_sha256_ac1b53f2857fd13ba0e33aa94c65f0d5fa22b76d504fff347b3ff0a53f37ee26"
 		score = 75
 		quality = 75
 		tags = "MEMORY"
@@ -60167,7 +60167,7 @@ rule ELASTIC_Windows_Infostealer_Strela_0Dc3E4A1 : MEMORY
 		$old_pdb = "Projects\\StrelaDLLCompile\\Release\\StrelaDLLCompile.pdb" fullword
 
 	condition:
-		3 of ($s*) or $old_pdb
+		3 of ( $s* ) or $old_pdb
 }
 rule ELASTIC_Windows_Virus_Expiro_84E99Ff0 : FILE MEMORY
 {
@@ -60178,10 +60178,10 @@ rule ELASTIC_Windows_Virus_Expiro_84E99Ff0 : FILE MEMORY
 		date = "2023-09-26"
 		modified = "2023-11-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Virus_Expiro.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Virus_Expiro.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "47107836ead700bddbe9e8a0c016b5b1443c785442b2addbb50a70445779bad7"
-		logic_hash = "ce4847bf5850c1f30dca9603bfbbfbb69339285f096ac469c6d2d4b04f5562b4"
+		logic_hash = "v1_sha256_ce4847bf5850c1f30dca9603bfbbfbb69339285f096ac469c6d2d4b04f5562b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60208,10 +60208,10 @@ rule ELASTIC_Windows_Virus_Neshta_2A5A14C8 : FILE MEMORY
 		date = "2024-01-22"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Virus_Neshta.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Virus_Neshta.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f298214764ee9ab690cb4b376d8a7893edcd9c05a3c4e6f3a56010974a130bd7"
-		logic_hash = "0b5d0603f4c20a2368f697dd84cfe1790a5d0e5904c76066601c9e3d1b5ed1e1"
+		logic_hash = "v1_sha256_0b5d0603f4c20a2368f697dd84cfe1790a5d0e5904c76066601c9e3d1b5ed1e1"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -60238,9 +60238,9 @@ rule ELASTIC_Windows_Trojan_Powerseal_D63F5E54 : FILE MEMORY
 		date = "2023-03-16"
 		modified = "2023-05-26"
 		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PowerSeal.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "523dcff68a51ea8fb022066b5f09394e8174d6c157222a08100de30669898057"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PowerSeal.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_523dcff68a51ea8fb022066b5f09394e8174d6c157222a08100de30669898057"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60269,9 +60269,9 @@ rule ELASTIC_Windows_Trojan_Powerseal_2E50F393 : FILE MEMORY
 		date = "2023-05-10"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PowerSeal.yar#L24-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "3ca1d4568fea7b2e4e9d30ba03662a2c28ee8623d887a0336e27989b5c98b55f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PowerSeal.yar#L24-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_3ca1d4568fea7b2e4e9d30ba03662a2c28ee8623d887a0336e27989b5c98b55f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60299,10 +60299,10 @@ rule ELASTIC_Windows_Vulndriver_Powertool_044A8645 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_PowerTool.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_PowerTool.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
-		logic_hash = "b21c16cb72d003c505aa0ac4cc21b92513a100bad6870460090994c02cad875a"
+		logic_hash = "v1_sha256_b21c16cb72d003c505aa0ac4cc21b92513a100bad6870460090994c02cad875a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -60318,7 +60318,7 @@ rule ELASTIC_Windows_Vulndriver_Powertool_044A8645 : FILE
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6B 00 45 00 76 00 50 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Windows_Trojan_Icedid_1Cd868A6 : FILE MEMORY
 {
@@ -60329,10 +60329,10 @@ rule ELASTIC_Windows_Trojan_Icedid_1Cd868A6 : FILE MEMORY
 		date = "2021-02-28"
 		modified = "2021-08-23"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff"
-		logic_hash = "4765b2b1d463f09d7e21367c2832b3ad668aa67d8078798a14295b6e6c846c1c"
+		logic_hash = "v1_sha256_4765b2b1d463f09d7e21367c2832b3ad668aa67d8078798a14295b6e6c846c1c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60358,10 +60358,10 @@ rule ELASTIC_Windows_Trojan_Icedid_237E9Fb6 : FILE MEMORY
 		date = "2021-02-28"
 		modified = "2021-08-23"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b21f9afc6443548427bf83b5f93e7a54ac3af306d9d71b8348a6f146b2819457"
-		logic_hash = "31479eae077b2d78cb1770eef3b37bec941f35c9ceb329e01dd65a32e785fa74"
+		logic_hash = "v1_sha256_31479eae077b2d78cb1770eef3b37bec941f35c9ceb329e01dd65a32e785fa74"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60387,10 +60387,10 @@ rule ELASTIC_Windows_Trojan_Icedid_F1Ce2F0A : FILE MEMORY
 		date = "2021-02-28"
 		modified = "2021-08-23"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L45-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L45-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b21f9afc6443548427bf83b5f93e7a54ac3af306d9d71b8348a6f146b2819457"
-		logic_hash = "a1f1824a7208201616dde40bea514dfc2cdf908bd8ed24b9f96c2bcad2c8107f"
+		logic_hash = "v1_sha256_a1f1824a7208201616dde40bea514dfc2cdf908bd8ed24b9f96c2bcad2c8107f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60416,10 +60416,10 @@ rule ELASTIC_Windows_Trojan_Icedid_08530E24 : FILE MEMORY
 		date = "2021-03-21"
 		modified = "2021-08-23"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L67-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L67-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "31db92c7920e82e49a968220480e9f130dea9b386083b78a79985b554ecdc6e4"
-		logic_hash = "a63511edde9d873e184ddb4720b4752b0e7df4bdb2114b05c16f2ca0594eb6b8"
+		logic_hash = "v1_sha256_a63511edde9d873e184ddb4720b4752b0e7df4bdb2114b05c16f2ca0594eb6b8"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -60447,7 +60447,7 @@ rule ELASTIC_Windows_Trojan_Icedid_08530E24 : FILE MEMORY
 		$b10 = "WinHttpSetStatusCallback" ascii fullword
 
 	condition:
-		all of ($a*) and 5 of ($b*)
+		all of ( $a* ) and 5 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Icedid_11D24D35 : FILE MEMORY
 {
@@ -60458,10 +60458,10 @@ rule ELASTIC_Windows_Trojan_Icedid_11D24D35 : FILE MEMORY
 		date = "2022-02-16"
 		modified = "2022-04-06"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L101-L121"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L101-L121"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b8d794f6449669ff2d11bc635490d9efdd1f4e92fcb3be5cdb4b40e4470c0982"
-		logic_hash = "4a5d0f37e3e80e370ae79fd45256dbd274ed8f8bcd021e8d6f95a0bc0bc5321f"
+		logic_hash = "v1_sha256_4a5d0f37e3e80e370ae79fd45256dbd274ed8f8bcd021e8d6f95a0bc0bc5321f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60477,7 +60477,7 @@ rule ELASTIC_Windows_Trojan_Icedid_11D24D35 : FILE MEMORY
 		$a2 = "loader_dll_64.dll" ascii fullword
 
 	condition:
-		1 of ($a*)
+		1 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Icedid_0B62E783 : FILE MEMORY
 {
@@ -60488,10 +60488,10 @@ rule ELASTIC_Windows_Trojan_Icedid_0B62E783 : FILE MEMORY
 		date = "2022-04-06"
 		modified = "2022-06-09"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L123-L142"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L123-L142"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
-		logic_hash = "aca126529dfa8047ed7dfdc60d970759ab5307448d7d764f88e402cd8d2a016f"
+		logic_hash = "v1_sha256_aca126529dfa8047ed7dfdc60d970759ab5307448d7d764f88e402cd8d2a016f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60517,10 +60517,10 @@ rule ELASTIC_Windows_Trojan_Icedid_91562D18 : FILE MEMORY
 		date = "2022-04-06"
 		modified = "2022-06-09"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L144-L163"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L144-L163"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
-		logic_hash = "81c87d0d6726bc2dde42fe93c77af53cdd29bb6437fe3d47d1b4550140722c88"
+		logic_hash = "v1_sha256_81c87d0d6726bc2dde42fe93c77af53cdd29bb6437fe3d47d1b4550140722c88"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60546,10 +60546,10 @@ rule ELASTIC_Windows_Trojan_Icedid_2086Aecb : FILE MEMORY
 		date = "2022-04-06"
 		modified = "2022-03-02"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L165-L184"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L165-L184"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
-		logic_hash = "561bf7eacfbbf1b4e0c111347f0d6ff4325bdbce8db73bee1ba836b610569c0d"
+		logic_hash = "v1_sha256_561bf7eacfbbf1b4e0c111347f0d6ff4325bdbce8db73bee1ba836b610569c0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60575,10 +60575,10 @@ rule ELASTIC_Windows_Trojan_Icedid_48029E37 : FILE MEMORY
 		date = "2022-04-06"
 		modified = "2022-06-09"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L186-L205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L186-L205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
-		logic_hash = "1fe337d7a0607938aaf57cf25c1373aadf315b7a8cec133d6d30a38bd58e1027"
+		logic_hash = "v1_sha256_1fe337d7a0607938aaf57cf25c1373aadf315b7a8cec133d6d30a38bd58e1027"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60604,10 +60604,10 @@ rule ELASTIC_Windows_Trojan_Icedid_56459277 : FILE MEMORY
 		date = "2022-08-21"
 		modified = "2023-03-02"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L207-L237"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L207-L237"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "21b1a635db2723266af4b46539f67253171399830102167c607c6dbf83d6d41c"
-		logic_hash = "a18557217c69a3bb8c3da7725d2e0ed849741f8e36341a4ea80eea09d47a5b45"
+		logic_hash = "v1_sha256_a18557217c69a3bb8c3da7725d2e0ed849741f8e36341a4ea80eea09d47a5b45"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60633,7 +60633,7 @@ rule ELASTIC_Windows_Trojan_Icedid_56459277 : FILE MEMORY
 		$seq_string_decrypt = { 0F B7 44 24 ?? 0F B7 4C 24 ?? 3B C1 7D ?? 8B 4C 24 ?? E8 [4] 89 44 24 ?? 0F B7 44 24 ?? 48 8B 4C 24 ?? 0F B6 04 01 0F B6 4C 24 ?? 33 C1 0F B7 4C 24 ?? 48 8B 54 24 ?? 88 04 0A EB }
 
 	condition:
-		5 of ($str*) or 2 of ($seq_*)
+		5 of ( $str* ) or 2 of ( $seq_* )
 }
 rule ELASTIC_Windows_Trojan_Icedid_7C1619E3 : FILE MEMORY
 {
@@ -60644,10 +60644,10 @@ rule ELASTIC_Windows_Trojan_Icedid_7C1619E3 : FILE MEMORY
 		date = "2022-12-20"
 		modified = "2023-02-01"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L239-L261"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L239-L261"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4f6de748628b8b06eeef3a5fabfe486bfd7aaa92f50dc5a8a8c70ec038cd33b1"
-		logic_hash = "24ddaf474dabc5e91cce08734a035feced9048a3faac4ff236bc97e6caabd642"
+		logic_hash = "v1_sha256_24ddaf474dabc5e91cce08734a035feced9048a3faac4ff236bc97e6caabd642"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60676,10 +60676,10 @@ rule ELASTIC_Windows_Trojan_Icedid_D8B23Cd6 : FILE MEMORY
 		date = "2023-01-03"
 		modified = "2023-01-03"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L263-L294"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L263-L294"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bd4da2f84c29437bc7efe9599a3a41f574105d449ac0d9b270faaca8795153ab"
-		logic_hash = "47e427a4f088de523115f438cad9fc26233158b0518d87703c282df351110762"
+		logic_hash = "v1_sha256_47e427a4f088de523115f438cad9fc26233158b0518d87703c282df351110762"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60717,9 +60717,9 @@ rule ELASTIC_Windows_Trojan_Icedid_A2Ca5F80 : FILE MEMORY
 		date = "2023-01-16"
 		modified = "2023-04-23"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L296-L323"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e36266cd66b9542f2eb9d38f9a01f7b480f2bcdbe61fe20944dca33e22bd3281"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L296-L323"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e36266cd66b9542f2eb9d38f9a01f7b480f2bcdbe61fe20944dca33e22bd3281"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60754,10 +60754,10 @@ rule ELASTIC_Windows_Trojan_Icedid_B8C59889 : FILE MEMORY
 		date = "2023-05-05"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L325-L349"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L325-L349"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a63d08cd53053bfda17b8707ab3a94cf3d6021097335dc40d5d211fb9faed045"
-		logic_hash = "08c6c604d1791c35a8494e5ec8a96e8c5dd2ca3d6c57971da20057ce8960fa1d"
+		logic_hash = "v1_sha256_08c6c604d1791c35a8494e5ec8a96e8c5dd2ca3d6c57971da20057ce8960fa1d"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -60777,7 +60777,7 @@ rule ELASTIC_Windows_Trojan_Icedid_B8C59889 : FILE MEMORY
 		$seq_crypto = { 83 E1 03 83 E0 03 48 8D 14 8A 41 8B 0C 80 4D 8D 04 80 41 0F B6 00 83 E1 07 02 02 41 32 04 29 41 88 04 19 49 FF C1 8B 02 }
 
 	condition:
-		4 of ($a*) or 1 of ($seq*)
+		4 of ( $a* ) or 1 of ( $seq* )
 }
 rule ELASTIC_Windows_Trojan_Icedid_81Eff9A3 : FILE MEMORY
 {
@@ -60788,10 +60788,10 @@ rule ELASTIC_Windows_Trojan_Icedid_81Eff9A3 : FILE MEMORY
 		date = "2023-05-05"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_IcedID.yar#L351-L371"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_IcedID.yar#L351-L371"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "96dacdf50d1db495c8395d7cf454aa3a824801cf366ac368fe496f89b5f98fe7"
-		logic_hash = "923dd8166cce0ec32b3b8b20cad192b3c15b7ce7c17fd44ddda739ad205a6c06"
+		logic_hash = "v1_sha256_923dd8166cce0ec32b3b8b20cad192b3c15b7ce7c17fd44ddda739ad205a6c06"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60818,10 +60818,10 @@ rule ELASTIC_Windows_Ransomware_Hellokitty_8859E8E8 : FILE MEMORY
 		date = "2021-05-03"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Hellokitty.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Hellokitty.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
-		logic_hash = "72cc718724d9d9a391a9f7a0932ebf397c2ab79558437533bef6e380b06baff9"
+		logic_hash = "v1_sha256_72cc718724d9d9a391a9f7a0932ebf397c2ab79558437533bef6e380b06baff9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60849,7 +60849,7 @@ rule ELASTIC_Windows_Ransomware_Hellokitty_8859E8E8 : FILE MEMORY
 		$b4 = "stop %s" wide fullword
 
 	condition:
-		(2 of ($a*) and 2 of ($b*)) or (5 of ($a*))
+		(2 of ( $a* ) and 2 of ( $b* ) ) or ( 5 of ( $a* ) )
 }
 rule ELASTIC_Windows_Ransomware_Hellokitty_4B668121 : FILE MEMORY
 {
@@ -60860,10 +60860,10 @@ rule ELASTIC_Windows_Ransomware_Hellokitty_4B668121 : FILE MEMORY
 		date = "2021-05-03"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Hellokitty.yar#L34-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Hellokitty.yar#L34-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
-		logic_hash = "00c7a492c304f12b9909e35cf069618a1103311a69e3e8951ca196c3c663b12a"
+		logic_hash = "v1_sha256_00c7a492c304f12b9909e35cf069618a1103311a69e3e8951ca196c3c663b12a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60896,10 +60896,10 @@ rule ELASTIC_Windows_Ransomware_Hellokitty_D9391A1A : FILE MEMORY
 		date = "2021-05-03"
 		modified = "2023-01-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Hellokitty.yar#L61-L80"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Hellokitty.yar#L61-L80"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
-		logic_hash = "074ca47c0526d9828f3c07c7d6dbdd1cec609670d70340b022ae2c712ad80305"
+		logic_hash = "v1_sha256_074ca47c0526d9828f3c07c7d6dbdd1cec609670d70340b022ae2c712ad80305"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -60926,10 +60926,10 @@ rule ELASTIC_Windows_Vulndriver_Viragt_5F92F226 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Viragt.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Viragt.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
-		logic_hash = "e7ade7aec563c1dc602dfd7fda8c063058f47ae2a915959468792fce389b38f1"
+		logic_hash = "v1_sha256_e7ade7aec563c1dc602dfd7fda8c063058f47ae2a915959468792fce389b38f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -60946,7 +60946,7 @@ rule ELASTIC_Windows_Vulndriver_Viragt_5F92F226 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x50][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x4f][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Viragt_84D508Ad : FILE
 {
@@ -60957,10 +60957,10 @@ rule ELASTIC_Windows_Vulndriver_Viragt_84D508Ad : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Viragt.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Viragt.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
-		logic_hash = "a3e1b41155c7dd347976a1057cb763ab60c50c34e981fef050bd54f060a412fc"
+		logic_hash = "v1_sha256_a3e1b41155c7dd347976a1057cb763ab60c50c34e981fef050bd54f060a412fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -60977,7 +60977,7 @@ rule ELASTIC_Windows_Vulndriver_Viragt_84D508Ad : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x0b][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Ransomware_Cuba_E64A16B1 : FILE MEMORY
 {
@@ -60988,10 +60988,10 @@ rule ELASTIC_Windows_Ransomware_Cuba_E64A16B1 : FILE MEMORY
 		date = "2021-08-04"
 		modified = "2021-10-04"
 		reference = "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Cuba.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Cuba.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e"
-		logic_hash = "915425ad49f1b9ebde114f92155d5969ec707304403f46d891d014b399165a4d"
+		logic_hash = "v1_sha256_915425ad49f1b9ebde114f92155d5969ec707304403f46d891d014b399165a4d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61018,10 +61018,10 @@ rule ELASTIC_Windows_Ransomware_Cuba_95A98E69 : FILE MEMORY
 		date = "2021-08-04"
 		modified = "2021-10-04"
 		reference = "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Cuba.yar#L23-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Cuba.yar#L23-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "00f18713f860dc8394fb23a1a2b6280d1eb2f20a487c175433a7b495a1ba408d"
-		logic_hash = "d17ef93943e826613be4c21ad1e41d1daa33db9da0fa6106bb8ba6334ebe1d08"
+		logic_hash = "v1_sha256_d17ef93943e826613be4c21ad1e41d1daa33db9da0fa6106bb8ba6334ebe1d08"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61049,10 +61049,10 @@ rule ELASTIC_Multi_Hacktool_Rakshasa_D5D3Ef21 : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-01-29"
 		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Hacktool_Rakshasa.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Hacktool_Rakshasa.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ccfa30a40445d5237aaee1e015ecfcd9bdbe7665a6dc2736b28e5ebf07ec4597"
-		logic_hash = "123cbea0ce02012a9b22a4a241d11aa9acbb58b50a1bd9228da7cadbf0fa1b4e"
+		logic_hash = "v1_sha256_123cbea0ce02012a9b22a4a241d11aa9acbb58b50a1bd9228da7cadbf0fa1b4e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61082,10 +61082,10 @@ rule ELASTIC_Windows_Trojan_Sythe_02B2811A : FILE MEMORY
 		date = "2023-05-10"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Sythe.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Sythe.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2d54a8ba40cc9a1c74db7a889bc75a38f16ae2d025268aa07851c1948daa1b4d"
-		logic_hash = "ba472b35f583dd4cf125df575129d07de289d6d7dc12ecdcc518ce1eb9f18def"
+		logic_hash = "v1_sha256_ba472b35f583dd4cf125df575129d07de289d6d7dc12ecdcc518ce1eb9f18def"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61114,10 +61114,10 @@ rule ELASTIC_Windows_Hacktool_Executeassembly_F41F4Df6 : FILE MEMORY
 		date = "2023-03-28"
 		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_ExecuteAssembly.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_ExecuteAssembly.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a468ba2ba77aafa2a572c8947d414e74604a7c1c6e68a0b87fbfce4f8854dd61"
-		logic_hash = "ab72dec636a96338e16fd57f2db4bb52e38fe61315b42c2ffe9c4566fc0326d3"
+		logic_hash = "v1_sha256_ab72dec636a96338e16fd57f2db4bb52e38fe61315b42c2ffe9c4566fc0326d3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61144,9 +61144,9 @@ rule ELASTIC_Windows_Trojan_Modpipe_12Bc2604 : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_ModPipe.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "0a26de1b2fb48d65cde61b60c0eba478da73a3eeaeb785d1b2d6095eccbe34e2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_ModPipe.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_0a26de1b2fb48d65cde61b60c0eba478da73a3eeaeb785d1b2d6095eccbe34e2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61175,10 +61175,10 @@ rule ELASTIC_Macos_Trojan_Adload_4995469F : FILE MEMORY
 		date = "2021-10-04"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Adload.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Adload.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6464ca7b36197cccf0dac00f21c43f0cb09f900006b1934e2b3667b367114de5"
-		logic_hash = "cceb804a11b93b0e3f491016c47a823d9e6a31294c3ed05d4404601323b30993"
+		logic_hash = "v1_sha256_cceb804a11b93b0e3f491016c47a823d9e6a31294c3ed05d4404601323b30993"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61204,10 +61204,10 @@ rule ELASTIC_Macos_Trojan_Adload_9B9F86C7 : FILE MEMORY
 		date = "2021-10-04"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Adload.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Adload.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "952e6004ce164ba607ac7fddc1df3d0d6cac07d271d90be02d790c52e49cb73c"
-		logic_hash = "82297db23e036f22c90eee7b2654e84df847eb1c2b1ea4dcf358c48a14819709"
+		logic_hash = "v1_sha256_82297db23e036f22c90eee7b2654e84df847eb1c2b1ea4dcf358c48a14819709"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -61233,10 +61233,10 @@ rule ELASTIC_Macos_Trojan_Adload_F6B18A0A : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Adload.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Adload.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "06f38bb811e6a6c38b5e2db708d4063f4aea27fcd193d57c60594f25a86488c8"
-		logic_hash = "20d43fbf0b8155940e2e181f376a7b1979ce248d88dc08409aaa1a916777231c"
+		logic_hash = "v1_sha256_20d43fbf0b8155940e2e181f376a7b1979ce248d88dc08409aaa1a916777231c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61262,10 +61262,10 @@ rule ELASTIC_Linux_Trojan_Connectback_Bf194C93 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Connectback.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Connectback.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6784cb86460bddf1226f71f5f5361463cbda487f813d19cd88e8a4a1eb1a417b"
-		logic_hash = "148626e05caee4a2b2542726ea4e4dab074eeab0572a65fdbd32f5d96544daf8"
+		logic_hash = "v1_sha256_148626e05caee4a2b2542726ea4e4dab074eeab0572a65fdbd32f5d96544daf8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61291,10 +61291,10 @@ rule ELASTIC_Linux_Exploit_CVE_2014_3153_1C1E02Ad : FILE MEMORY CVE_2014_3153
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2014_3153.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2014_3153.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "64b8c61b73f0c0c0bd44ea5c2bcfb7b665fcca219dbe074a4a16ae20cd565812"
-		logic_hash = "42e9de7f306343c4c3e7fd02b414b429faacb837fb2910f98f0c1519da40074c"
+		logic_hash = "v1_sha256_42e9de7f306343c4c3e7fd02b414b429faacb837fb2910f98f0c1519da40074c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2014-3153"
@@ -61320,10 +61320,10 @@ rule ELASTIC_Windows_Ransomware_Makop_3Ac2C13C : FILE MEMORY
 		date = "2021-08-05"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Makop.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Makop.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "854226fc4f5388d40cd9e7312797dd63739444d69a67e4126ef60817fa6972ad"
-		logic_hash = "3fa7c506010a87ac97f415db32c21af091dff26fd912a8f9f5bb5e8d43a8da9e"
+		logic_hash = "v1_sha256_3fa7c506010a87ac97f415db32c21af091dff26fd912a8f9f5bb5e8d43a8da9e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61349,10 +61349,10 @@ rule ELASTIC_Windows_Ransomware_Makop_3E388338 : FILE MEMORY
 		date = "2021-08-05"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Makop.yar#L21-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Makop.yar#L21-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "854226fc4f5388d40cd9e7312797dd63739444d69a67e4126ef60817fa6972ad"
-		logic_hash = "5a6e5fd725f3d042c0c95b42ad00c93965a49aa6bda6ec5383a239f18d74742e"
+		logic_hash = "v1_sha256_5a6e5fd725f3d042c0c95b42ad00c93965a49aa6bda6ec5383a239f18d74742e"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -61383,10 +61383,10 @@ rule ELASTIC_Windows_Trojan_Darkgate_Fa1F1338 : FILE MEMORY
 		date = "2023-12-14"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DarkGate.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DarkGate.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1fce9ee9254dd0641387cc3b6ea5f6a60f4753132c20ca03ce4eed2aa1042876"
-		logic_hash = "d5447a57fc57af52c263b84522346a3e94a464a698de8be77eab3b56156164f2"
+		logic_hash = "v1_sha256_d5447a57fc57af52c263b84522346a3e94a464a698de8be77eab3b56156164f2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61414,10 +61414,10 @@ rule ELASTIC_Windows_Trojan_Darkgate_07Ef6F14 : FILE MEMORY
 		date = "2023-12-14"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DarkGate.yar#L23-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DarkGate.yar#L23-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1fce9ee9254dd0641387cc3b6ea5f6a60f4753132c20ca03ce4eed2aa1042876"
-		logic_hash = "2820286b362b107fc7fc3ec8f1a004a7d7926a84318f2943f58239f1f7e8f1f0"
+		logic_hash = "v1_sha256_2820286b362b107fc7fc3ec8f1a004a7d7926a84318f2943f58239f1f7e8f1f0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61444,10 +61444,10 @@ rule ELASTIC_Windows_Ransomware_Magniber_Ea0140A1 : FILE MEMORY
 		date = "2021-08-03"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Magniber.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Magniber.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a2448b93d7c50801056052fb429d04bcf94a478a0a012191d60e595fed63eec4"
-		logic_hash = "e2c05e2c92444d7bcb2bf68e97f809072d2ccdc8a171214d2e7a498b20d08f90"
+		logic_hash = "v1_sha256_e2c05e2c92444d7bcb2bf68e97f809072d2ccdc8a171214d2e7a498b20d08f90"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61473,10 +61473,10 @@ rule ELASTIC_Windows_Ransomware_Magniber_97D7575B : FILE MEMORY
 		date = "2021-08-03"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Magniber.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Magniber.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a2448b93d7c50801056052fb429d04bcf94a478a0a012191d60e595fed63eec4"
-		logic_hash = "9c85f98aaae28e9e90a94d6ce18389467013ea6b569f46f6acaf26a6c7e027fc"
+		logic_hash = "v1_sha256_9c85f98aaae28e9e90a94d6ce18389467013ea6b569f46f6acaf26a6c7e027fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61502,10 +61502,10 @@ rule ELASTIC_Macos_Infostealer_Encodedosascript_Eeb54A7E : FILE MEMORY
 		date = "2024-08-19"
 		modified = "2024-08-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Macos_Infostealer_EncodedOsascript.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Macos_Infostealer_EncodedOsascript.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c1693ee747e31541919f84dfa89e36ca5b74074044b181656d95d7f40af34a05"
-		logic_hash = "2f450c9afd92f52cdd8333e39e41b7334a01ddc39371c118260820a878359742"
+		logic_hash = "v1_sha256_2f450c9afd92f52cdd8333e39e41b7334a01ddc39371c118260820a878359742"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -61533,10 +61533,10 @@ rule ELASTIC_Linux_Trojan_Xzbackdoor_74E87A9D : FILE MEMORY
 		date = "2024-03-30"
 		modified = "2024-04-03"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_XZBackdoor.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_XZBackdoor.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5448850cdc3a7ae41ff53b433c2adbd0ff492515012412ee63a40d2685db3049"
-		logic_hash = "c777171c36d9369ade7bf44c7cc4e5aee16bb4c803431bc480cc0f8ebb2819c0"
+		logic_hash = "v1_sha256_c777171c36d9369ade7bf44c7cc4e5aee16bb4c803431bc480cc0f8ebb2819c0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61555,7 +61555,7 @@ rule ELASTIC_Linux_Trojan_Xzbackdoor_74E87A9D : FILE MEMORY
 		$b3 = { 4D 8B 6C 24 08 45 8B 3C 24 4C 8B 63 10 89 85 78 F1 FF FF 31 C0 83 BD 78 F1 FF FF 00 F3 AB 79 07 }
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		1 of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Pandora_Bca8Ce23 : FILE MEMORY
 {
@@ -61566,10 +61566,10 @@ rule ELASTIC_Windows_Ransomware_Pandora_Bca8Ce23 : FILE MEMORY
 		date = "2022-03-14"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Pandora.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Pandora.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c940a35025dd3847f7c954a282f65e9c2312d2ada28686f9d1dc73d1c500224"
-		logic_hash = "52203c1af994667ba6833defe547e886dd02167e4d76c57711080e3be0473bfc"
+		logic_hash = "v1_sha256_52203c1af994667ba6833defe547e886dd02167e4d76c57711080e3be0473bfc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61597,10 +61597,10 @@ rule ELASTIC_Macos_Backdoor_Applejeus_31872Ae2 : FILE MEMORY
 		date = "2021-10-18"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Backdoor_Applejeus.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Backdoor_Applejeus.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e352d6ea4da596abfdf51f617584611fc9321d5a6d1c22aff243aecdef8e7e55"
-		logic_hash = "1d6f06668a7d048a93e53b294c5ab8ffe4cd610f3bef3fd80f14425ef8a85a29"
+		logic_hash = "v1_sha256_1d6f06668a7d048a93e53b294c5ab8ffe4cd610f3bef3fd80f14425ef8a85a29"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61626,10 +61626,10 @@ rule ELASTIC_Windows_Ransomware_Haron_A1C12E7E : FILE MEMORY
 		date = "2021-08-03"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Haron.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Haron.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
-		logic_hash = "84df5a13495acee5dc2007cf1d6e1828a832d46fcbad2ca8676643fd47756248"
+		logic_hash = "v1_sha256_84df5a13495acee5dc2007cf1d6e1828a832d46fcbad2ca8676643fd47756248"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61656,10 +61656,10 @@ rule ELASTIC_Windows_Ransomware_Haron_23B76Cb7 : FILE MEMORY
 		date = "2021-08-03"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Haron.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Haron.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
-		logic_hash = "e53c92be617444da0057680ee1ac45cbc1f707194281644bececa44e4ebe3580"
+		logic_hash = "v1_sha256_e53c92be617444da0057680ee1ac45cbc1f707194281644bececa44e4ebe3580"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61686,10 +61686,10 @@ rule ELASTIC_Windows_Trojan_Oskistealer_A158B1E3 : FILE MEMORY
 		date = "2022-03-21"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_OskiStealer.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_OskiStealer.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "568cd515c9a3bce7ef21520761b02cbfc95d8884d5b2dc38fc352af92356c694"
-		logic_hash = "0ddbe0b234ed60f5a3fc537cdaebf39f639ee24fd66143c9036a9f4786d4c51b"
+		logic_hash = "v1_sha256_0ddbe0b234ed60f5a3fc537cdaebf39f639ee24fd66143c9036a9f4786d4c51b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61719,10 +61719,10 @@ rule ELASTIC_Linux_Exploit_Pulse_2Bea17E8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Pulse.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Pulse.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c29cb4c2d83127cf4731573a7fac531f90f27799857f5e250b9f71362108f559"
-		logic_hash = "bc71efa6cc79171666d89fe3e755411ee8032f56ae5bd73e0de440eee5b718ab"
+		logic_hash = "v1_sha256_bc71efa6cc79171666d89fe3e755411ee8032f56ae5bd73e0de440eee5b718ab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61748,10 +61748,10 @@ rule ELASTIC_Linux_Exploit_Pulse_246E6F31 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Pulse.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Pulse.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c29cb4c2d83127cf4731573a7fac531f90f27799857f5e250b9f71362108f559"
-		logic_hash = "f6755f10863b78303899cefcd81f609884fbbf2dffabd9219686ed869f2cc7e3"
+		logic_hash = "v1_sha256_f6755f10863b78303899cefcd81f609884fbbf2dffabd9219686ed869f2cc7e3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61777,9 +61777,9 @@ rule ELASTIC_Windows_Ransomware_Doppelpaymer_6660D29F : BETA FILE MEMORY
 		date = "2020-06-28"
 		modified = "2021-08-23"
 		reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "4c12eaa44f82c6f729e51242c9c1836eb1856959c682e2d2e21b975104c197b6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_4c12eaa44f82c6f729e51242c9c1836eb1856959c682e2d2e21b975104c197b6"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -61796,7 +61796,7 @@ rule ELASTIC_Windows_Ransomware_Doppelpaymer_6660D29F : BETA FILE MEMORY
 		$a2 = "RtlComputeCrc32" ascii fullword
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule ELASTIC_Windows_Ransomware_Doppelpaymer_6Ab188Da : BETA FILE MEMORY
 {
@@ -61807,9 +61807,9 @@ rule ELASTIC_Windows_Ransomware_Doppelpaymer_6Ab188Da : BETA FILE MEMORY
 		date = "2020-06-28"
 		modified = "2021-08-23"
 		reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L23-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "429c87d293b7f517a594e8be020cbe7f8302a8b6eb8337f090ca18973aafbde4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L23-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_429c87d293b7f517a594e8be020cbe7f8302a8b6eb8337f090ca18973aafbde4"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -61825,7 +61825,7 @@ rule ELASTIC_Windows_Ransomware_Doppelpaymer_6Ab188Da : BETA FILE MEMORY
 		$d1 = { 56 55 55 55 F7 EF B8 56 55 55 55 8B EA F7 E9 8B C2 8B D1 C1 FA 1F 2B C2 C1 FF 1F 2B EF 8D 14 40 B8 F3 1A CA 6B 2B CA 03 E9 F7 ED 8B CD C1 FA 05 C1 F9 1F 2B D1 6B CA B4 03 CD 74 1C 81 E1 03 00 00 80 7D 07 83 E9 01 83 C9 FC 41 8B C1 F7 D8 85 C9 8D 7C 05 04 0F 45 EF 8D 44 55 02 5D 5F C3 }
 
 	condition:
-		1 of ($d*)
+		1 of ( $d* )
 }
 rule ELASTIC_Windows_Ransomware_Doppelpaymer_4Fb1A155 : BETA FILE MEMORY
 {
@@ -61836,9 +61836,9 @@ rule ELASTIC_Windows_Ransomware_Doppelpaymer_4Fb1A155 : BETA FILE MEMORY
 		date = "2020-06-28"
 		modified = "2021-08-23"
 		reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L44-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "eb041a836b2bc73312a2f87523d817d5274f3d43d3e5fe6aacfad1399c61a9de"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L44-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_eb041a836b2bc73312a2f87523d817d5274f3d43d3e5fe6aacfad1399c61a9de"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -61854,7 +61854,7 @@ rule ELASTIC_Windows_Ransomware_Doppelpaymer_4Fb1A155 : BETA FILE MEMORY
 		$c1 = { 83 EC 64 8B E9 8B 44 24 ?? 8B 00 0F B7 10 83 FA 5C 75 }
 
 	condition:
-		1 of ($c*)
+		1 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Limerat_24269A79 : FILE MEMORY
 {
@@ -61865,10 +61865,10 @@ rule ELASTIC_Windows_Trojan_Limerat_24269A79 : FILE MEMORY
 		date = "2021-08-17"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Limerat.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Limerat.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ec781a714d6bc6fac48d59890d9ae594ffd4dbc95710f2da1f1aa3d5b87b9e01"
-		logic_hash = "053a6abe589db23c4b9baed24729c8bcdd9019535fd0d9efc60ab4035c9779f3"
+		logic_hash = "v1_sha256_053a6abe589db23c4b9baed24729c8bcdd9019535fd0d9efc60ab4035c9779f3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61894,9 +61894,9 @@ rule ELASTIC_Linux_Trojan_Godlua_Ed8E6228 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Godlua.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "848ef3b198737f080f19c5fa55dfbc31356427398074f9125c65cb532c52ce7a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Godlua.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_848ef3b198737f080f19c5fa55dfbc31356427398074f9125c65cb532c52ce7a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -61922,9 +61922,9 @@ rule ELASTIC_Windows_Ransomware_Egregor_F24023F3 : BETA FILE MEMORY
 		date = "2020-10-15"
 		modified = "2021-08-23"
 		reference = "https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Egregor.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "5695b44f6ce018a91a99b6c94feae740ff4ac187e232bc9044e51d62d1f42bfa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Egregor.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_5695b44f6ce018a91a99b6c94feae740ff4ac187e232bc9044e51d62d1f42bfa"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -61945,7 +61945,7 @@ rule ELASTIC_Windows_Ransomware_Egregor_F24023F3 : BETA FILE MEMORY
 		$a6 = "Do not redact this special technical block, we need this to authorize you." ascii wide
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule ELASTIC_Windows_Ransomware_Egregor_4Ec2B90C : BETA FILE MEMORY
 {
@@ -61956,9 +61956,9 @@ rule ELASTIC_Windows_Ransomware_Egregor_4Ec2B90C : BETA FILE MEMORY
 		date = "2020-10-15"
 		modified = "2021-08-23"
 		reference = "https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Egregor.yar#L27-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8342d92e1486b1289645828e5ee5f1f6f21a0e645dd7cc4eca908ed59c2f1c4c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Egregor.yar#L27-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8342d92e1486b1289645828e5ee5f1f6f21a0e645dd7cc4eca908ed59c2f1c4c"
 		score = 75
 		quality = 73
 		tags = "BETA, FILE, MEMORY"
@@ -61976,7 +61976,7 @@ rule ELASTIC_Windows_Ransomware_Egregor_4Ec2B90C : BETA FILE MEMORY
 		$b3 = { BB 05 10 D4 BB 05 10 E0 BB 05 10 EC BB 05 10 F8 BB 05 10 04 BC 05 10 10 BC 05 10 1C BC 05 10 2C BC 05 10 3C BC 05 10 50 BC 05 10 68 BC 05 10 80 BC 05 10 90 BC 05 10 A8 BC 05 10 B4 BC 05 10 C0 }
 
 	condition:
-		1 of ($b*)
+		1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Metastealer_F94E2464 : FILE MEMORY
 {
@@ -61987,10 +61987,10 @@ rule ELASTIC_Windows_Trojan_Metastealer_F94E2464 : FILE MEMORY
 		date = "2024-03-27"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_MetaStealer.yar#L1-L34"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_MetaStealer.yar#L1-L34"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "14ca15c0751207103c38f1a2f8fdc73e5dd3d58772f6e5641e54e0c790ecd132"
-		logic_hash = "bf374bda2ca7c7bcec1ff092bbc9c3fd95c33faa78a6ea105a7b12b8e80a2e23"
+		logic_hash = "v1_sha256_bf374bda2ca7c7bcec1ff092bbc9c3fd95c33faa78a6ea105a7b12b8e80a2e23"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62031,10 +62031,10 @@ rule ELASTIC_Windows_Trojan_Metastealer_A07E395C : FILE MEMORY
 		date = "2024-10-23"
 		modified = "2024-10-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_MetaStealer.yar#L36-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_MetaStealer.yar#L36-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a"
-		logic_hash = "2464cf1dc5747c93598354329371ea6111c3cbf34a6db83076c9465b867a0e47"
+		logic_hash = "v1_sha256_2464cf1dc5747c93598354329371ea6111c3cbf34a6db83076c9465b867a0e47"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -62062,9 +62062,9 @@ rule ELASTIC_Macos_Infostealer_Mdquerysecret_5535Ab96 : FILE MEMORY
 		date = "2023-04-11"
 		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Infostealer_MdQuerySecret.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "c755e617b9dd41505bb225ea836ecdde8f3f6f9ab7ae79697e6d85190e206c41"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Infostealer_MdQuerySecret.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_c755e617b9dd41505bb225ea836ecdde8f3f6f9ab7ae79697e6d85190e206c41"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -62080,7 +62080,7 @@ rule ELASTIC_Macos_Infostealer_Mdquerysecret_5535Ab96 : FILE MEMORY
 		$string2 = /kMDItemDisplayName\s{1,50}==\s{1,50}\S{1,50}secret\S{1,50}/ ascii wide nocase
 
 	condition:
-		any of ($string1,$string2)
+		any of ( $string1 , $string2 )
 }
 rule ELASTIC_Windows_Generic_Threat_Bc6Ae28D : FILE MEMORY
 {
@@ -62091,10 +62091,10 @@ rule ELASTIC_Windows_Generic_Threat_Bc6Ae28D : FILE MEMORY
 		date = "2023-12-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ce00873eb423c0259c18157a07bf7fd9b07333e528a5b9d48be79194310c9d97"
-		logic_hash = "0ca5ec945858a5238eac048520dea4597f706ad2c96be322d341c84c4ddbce33"
+		logic_hash = "v1_sha256_0ca5ec945858a5238eac048520dea4597f706ad2c96be322d341c84c4ddbce33"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62120,10 +62120,10 @@ rule ELASTIC_Windows_Generic_Threat_Ce98C4Bc : FILE MEMORY
 		date = "2023-12-17"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L21-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L21-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "950e8a29f516ef3cf1a81501e97fbbbedb289ad9fb93352edb563f749378da35"
-		logic_hash = "74914f41c03cb2dcb1dc3175cc76574a0d40b66a1a3854af8f50c9858704b66b"
+		logic_hash = "v1_sha256_74914f41c03cb2dcb1dc3175cc76574a0d40b66a1a3854af8f50c9858704b66b"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -62150,10 +62150,10 @@ rule ELASTIC_Windows_Generic_Threat_0Cc1481E : FILE MEMORY
 		date = "2023-12-17"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L42-L60"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L42-L60"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6ec7781e472a6827c1406a53ed4699407659bd57c33dd4ab51cabfe8ece6f23f"
-		logic_hash = "1a094cf337cb85aa4b7d1d2025571ab0661a7be1fd03d53d8c7370a90385f38c"
+		logic_hash = "v1_sha256_1a094cf337cb85aa4b7d1d2025571ab0661a7be1fd03d53d8c7370a90385f38c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62179,10 +62179,10 @@ rule ELASTIC_Windows_Generic_Threat_2507C37C : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L62-L80"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L62-L80"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "04296258f054a958f0fd013b3c6a3435280b28e9a27541463e6fc9afe30363cc"
-		logic_hash = "8c5ea1290260993ea5140baa4645f3fd0ebb4d43fce0e9a25f8e8948e683aec1"
+		logic_hash = "v1_sha256_8c5ea1290260993ea5140baa4645f3fd0ebb4d43fce0e9a25f8e8948e683aec1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62208,10 +62208,10 @@ rule ELASTIC_Windows_Generic_Threat_E052D248 : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L82-L100"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L82-L100"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ed2bbc0d120665044aacb089d8c99d7c946b54d1b08a078aebbb3b91f593da6e"
-		logic_hash = "1a16ce6d1c6707560425156e625ad19a82315564b3f03adafbcc3e65b0e98a6d"
+		logic_hash = "v1_sha256_1a16ce6d1c6707560425156e625ad19a82315564b3f03adafbcc3e65b0e98a6d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62237,10 +62237,10 @@ rule ELASTIC_Windows_Generic_Threat_2Bb7Fbe3 : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L102-L120"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L102-L120"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "65cc8704c0e431589d196eadb0ac8a19151631c8d4ab7375d7cb18f7b763ba7b"
-		logic_hash = "36e1ab766e09e8d06b9179f67a1cb842ba257f140610964a941fb462ed3e803c"
+		logic_hash = "v1_sha256_36e1ab766e09e8d06b9179f67a1cb842ba257f140610964a941fb462ed3e803c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62266,10 +62266,10 @@ rule ELASTIC_Windows_Generic_Threat_994F2330 : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L122-L140"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L122-L140"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0a30cb09c480a2659b6f989ac9fe1bfba1802ae3aad98fa5db7cdd146fee3916"
-		logic_hash = "ace99deae7f5faa22f273ec4fe45ef07f03acd1ae4d9c0f18687ef6cf5b560c2"
+		logic_hash = "v1_sha256_ace99deae7f5faa22f273ec4fe45ef07f03acd1ae4d9c0f18687ef6cf5b560c2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62295,10 +62295,10 @@ rule ELASTIC_Windows_Generic_Threat_Bf7Aae24 : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L142-L160"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L142-L160"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6dfc63894f15fc137e27516f2d2a56514c51f25b41b00583123142cf50645e4e"
-		logic_hash = "b6dfa6f4c46bddd643f2f89f6275404c19fd4ed1bbae561029fffa884e99e167"
+		logic_hash = "v1_sha256_b6dfa6f4c46bddd643f2f89f6275404c19fd4ed1bbae561029fffa884e99e167"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62324,10 +62324,10 @@ rule ELASTIC_Windows_Generic_Threat_D542E5A5 : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L162-L180"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L162-L180"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3fc4ae7115e0bfa3fc6b75dcff867e7bf9ade9c7f558f31916359d37d001901b"
-		logic_hash = "3c16c02d4fc6e019f0ab0ff4daad61f59275afd8fb3ee263b1b59876233a686e"
+		logic_hash = "v1_sha256_3c16c02d4fc6e019f0ab0ff4daad61f59275afd8fb3ee263b1b59876233a686e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62353,10 +62353,10 @@ rule ELASTIC_Windows_Generic_Threat_8D10790B : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L182-L200"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L182-L200"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "911535923a5451c10239e20e7130d371e8ee37172e0f14fc8cf224d41f7f4c0f"
-		logic_hash = "84c017abbce1c8702efbe8657e5a857ae222721b0db2260dc814652f4528df26"
+		logic_hash = "v1_sha256_84c017abbce1c8702efbe8657e5a857ae222721b0db2260dc814652f4528df26"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62382,10 +62382,10 @@ rule ELASTIC_Windows_Generic_Threat_347F9F54 : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L202-L220"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L202-L220"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "45a051651ce1edddd33ecef09bb0fbb978adec9044e64f786b13ed81cabf6a3f"
-		logic_hash = "63df388393a45ffec68ba01ae6d7707b6d5277e0162ded6e631c1f76ad76b711"
+		logic_hash = "v1_sha256_63df388393a45ffec68ba01ae6d7707b6d5277e0162ded6e631c1f76ad76b711"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62411,10 +62411,10 @@ rule ELASTIC_Windows_Generic_Threat_20469956 : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L222-L240"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L222-L240"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a1f2923f68f5963499a64bfd0affe0a729f5e7bd6bcccfb9bed1d62831a93c47"
-		logic_hash = "da351bec0039a32bb9de1d8623ab3dc26eb752d30a64e613de96f70e1b1c2463"
+		logic_hash = "v1_sha256_da351bec0039a32bb9de1d8623ab3dc26eb752d30a64e613de96f70e1b1c2463"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62440,10 +62440,10 @@ rule ELASTIC_Windows_Generic_Threat_742E8A70 : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L242-L260"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L242-L260"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "94f7678be47651aa457256375f3e4d362ae681a9524388c97dc9ed34ba881090"
-		logic_hash = "2925eb8da80ef791b5cf7800a9bf9462203ab6aa743bc69f4fd2343e97eaab7c"
+		logic_hash = "v1_sha256_2925eb8da80ef791b5cf7800a9bf9462203ab6aa743bc69f4fd2343e97eaab7c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62469,10 +62469,10 @@ rule ELASTIC_Windows_Generic_Threat_79174B5C : FILE MEMORY
 		date = "2023-12-18"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L262-L280"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L262-L280"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c15118230059e85e7a6b65fe1c0ceee8997a3d4e9f1966c8340017a41e0c254c"
-		logic_hash = "06a2f0613719f1273a6b3f62f248c22b1cab2fe6054904619e3720f3f6c55e2e"
+		logic_hash = "v1_sha256_06a2f0613719f1273a6b3f62f248c22b1cab2fe6054904619e3720f3f6c55e2e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62498,10 +62498,10 @@ rule ELASTIC_Windows_Generic_Threat_232B71A9 : FILE MEMORY
 		date = "2023-12-20"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L282-L300"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L282-L300"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1e8b34da2d675af96b34041d4e493e34139fc8779f806dbcf62a6c9c4d9980fe"
-		logic_hash = "c3bef1509c0d0172dbbc7e0e2b5c69e5ec47dc22365d98a914002b53b0f7d918"
+		logic_hash = "v1_sha256_c3bef1509c0d0172dbbc7e0e2b5c69e5ec47dc22365d98a914002b53b0f7d918"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -62527,10 +62527,10 @@ rule ELASTIC_Windows_Generic_Threat_D331D190 : FILE MEMORY
 		date = "2023-12-20"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L302-L320"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L302-L320"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6d869d320d977f83aa3f0e7719967c7e54c1bdae9ae3729668d755ee3397a96f"
-		logic_hash = "901601c892d709fa596c44df1fbe7772a9f20576c71666570713bf96727a809b"
+		logic_hash = "v1_sha256_901601c892d709fa596c44df1fbe7772a9f20576c71666570713bf96727a809b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62556,10 +62556,10 @@ rule ELASTIC_Windows_Generic_Threat_24191082 : FILE MEMORY
 		date = "2023-12-20"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L322-L340"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L322-L340"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4d20878c16d2b401e76d8e7c288cf8ef5aa3c8d4865f440ee6b44d9f3d0cbf33"
-		logic_hash = "a5ea76032a9c189f923d91cd03deb44bd61868e5ad6081afe63249156cbd8927"
+		logic_hash = "v1_sha256_a5ea76032a9c189f923d91cd03deb44bd61868e5ad6081afe63249156cbd8927"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62585,10 +62585,10 @@ rule ELASTIC_Windows_Generic_Threat_Efdb9E81 : FILE MEMORY
 		date = "2024-01-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L342-L361"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L342-L361"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1c3302b14324c9f4e07829f41cd767ec654db18ff330933c6544c46bd19e89dd"
-		logic_hash = "eae78b07f6c31e3a30ae041a27c67553bb8ea915bc7724583d78832475021955"
+		logic_hash = "v1_sha256_eae78b07f6c31e3a30ae041a27c67553bb8ea915bc7724583d78832475021955"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -62615,10 +62615,10 @@ rule ELASTIC_Windows_Generic_Threat_34622A35 : FILE MEMORY
 		date = "2024-01-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L363-L381"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L363-L381"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c021c6adca0ddf38563a13066a652e4d97726175983854674b8dae2f6e59c83f"
-		logic_hash = "2b49bd5d3a18307a46f44d9dfeea858ddaa6084f86f96b83b874cee7603e1c11"
+		logic_hash = "v1_sha256_2b49bd5d3a18307a46f44d9dfeea858ddaa6084f86f96b83b874cee7603e1c11"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62644,10 +62644,10 @@ rule ELASTIC_Windows_Generic_Threat_0Ff403Df : FILE MEMORY
 		date = "2024-01-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L383-L401"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L383-L401"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b3119dc4cea05bef51d1f373b87d69bcff514f6575d4c92da4b1c557f8d8db8f"
-		logic_hash = "38bdd9b6f61ab4bb13abc7af94e92151928df95ade061756611218104e7245fd"
+		logic_hash = "v1_sha256_38bdd9b6f61ab4bb13abc7af94e92151928df95ade061756611218104e7245fd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62673,10 +62673,10 @@ rule ELASTIC_Windows_Generic_Threat_B1F6F662 : FILE MEMORY
 		date = "2024-01-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L403-L423"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L403-L423"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1b7eaef3cf1bb8021a00df092c829932cccac333990db1c5dac6558a5d906400"
-		logic_hash = "e52ff1eaee00334e1a07367bf88f3907bb0b13035717683d9d98371b92bc45c0"
+		logic_hash = "v1_sha256_e52ff1eaee00334e1a07367bf88f3907bb0b13035717683d9d98371b92bc45c0"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -62704,10 +62704,10 @@ rule ELASTIC_Windows_Generic_Threat_2C80562D : FILE MEMORY
 		date = "2024-01-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L425-L445"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L425-L445"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ee8decf1e8e5a927e3a6c10e88093bb4b7708c3fd542d98d43f1a882c6b0198e"
-		logic_hash = "07487ae646ac81b94f940c8d3493dbee023bce687297465fe09375f40dff0fb2"
+		logic_hash = "v1_sha256_07487ae646ac81b94f940c8d3493dbee023bce687297465fe09375f40dff0fb2"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -62735,10 +62735,10 @@ rule ELASTIC_Windows_Generic_Threat_E96F9E97 : FILE MEMORY
 		date = "2024-01-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L447-L465"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L447-L465"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bfbab69e9fc517bc46ae88afd0603a498a4c77409e83466d05db2797234ea7fc"
-		logic_hash = "1dcf81b8982425ff74107b899e85e2432f0464554e923f85a7555cda65293b54"
+		logic_hash = "v1_sha256_1dcf81b8982425ff74107b899e85e2432f0464554e923f85a7555cda65293b54"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -62764,10 +62764,10 @@ rule ELASTIC_Windows_Generic_Threat_005Fd471 : FILE MEMORY
 		date = "2024-01-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L467-L487"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L467-L487"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "502814ed565a923da15626d46fde8cc7fd422790e32b3cad973ed8ec8602b228"
-		logic_hash = "10493253a6b2ce3141ee980e0607bdbba72580bb4a076f2f4636e9665ffc6db8"
+		logic_hash = "v1_sha256_10493253a6b2ce3141ee980e0607bdbba72580bb4a076f2f4636e9665ffc6db8"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -62795,10 +62795,10 @@ rule ELASTIC_Windows_Generic_Threat_54B0Ec47 : FILE MEMORY
 		date = "2024-01-03"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L489-L508"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L489-L508"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9c14203069ff6003e7f408bed71e75394de7a6c1451266c59c5639360bf5718c"
-		logic_hash = "e3d74162a8874fe05042fec98d25b8db50e7f537566fd9f4e40f92bfe868259a"
+		logic_hash = "v1_sha256_e3d74162a8874fe05042fec98d25b8db50e7f537566fd9f4e40f92bfe868259a"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -62825,10 +62825,10 @@ rule ELASTIC_Windows_Generic_Threat_Acf6222B : FILE MEMORY
 		date = "2024-01-03"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L510-L528"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L510-L528"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ce0def96be08193ab96817ce1279e8406746a76cfcf4bf44e394920d7acbcaa6"
-		logic_hash = "a284b6c163dbc022bd36f19fbc1d7ff70143bee566328ad23e7b8b79abd39e91"
+		logic_hash = "v1_sha256_a284b6c163dbc022bd36f19fbc1d7ff70143bee566328ad23e7b8b79abd39e91"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62854,10 +62854,10 @@ rule ELASTIC_Windows_Generic_Threat_5E718A0C : FILE MEMORY
 		date = "2024-01-03"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L530-L548"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L530-L548"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "430b9369b779208bd3976bd2adc3e63d3f71e5edfea30490e6e93040c1b3bac6"
-		logic_hash = "45068afeda7abae0fe922a21f8f768b6c74a6e0f8e9e8b1f68c3ddf92940bf9a"
+		logic_hash = "v1_sha256_45068afeda7abae0fe922a21f8f768b6c74a6e0f8e9e8b1f68c3ddf92940bf9a"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -62883,10 +62883,10 @@ rule ELASTIC_Windows_Generic_Threat_Fac6D993 : FILE MEMORY
 		date = "2024-01-03"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L550-L568"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L550-L568"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e7c88e72cf0c1f4cbee588972fc1434065f7cc9bd95d52379bade1b8520278"
-		logic_hash = "3486793324dbe43c908432e1956bbbdb870beb4641da46b3786581fd3e78811a"
+		logic_hash = "v1_sha256_3486793324dbe43c908432e1956bbbdb870beb4641da46b3786581fd3e78811a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62912,9 +62912,9 @@ rule ELASTIC_Windows_Generic_Threat_E7Eaa4Ca : FILE MEMORY
 		date = "2024-01-04"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L570-L587"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "600da0c88dc0606e05f60ecd3b9a90469eef8ac7a702ef800c833f7fd17eb13e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L570-L587"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_600da0c88dc0606e05f60ecd3b9a90469eef8ac7a702ef800c833f7fd17eb13e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62940,10 +62940,10 @@ rule ELASTIC_Windows_Generic_Threat_97703189 : FILE MEMORY
 		date = "2024-01-04"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L589-L607"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L589-L607"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "968ba3112c54f3437b9abb6137f633d919d75137d790af074df40a346891cfb5"
-		logic_hash = "318bc82d49e9a3467ec0e0086aaf1092d2aa7c589b5f16ce6fbb3778eda7ef0b"
+		logic_hash = "v1_sha256_318bc82d49e9a3467ec0e0086aaf1092d2aa7c589b5f16ce6fbb3778eda7ef0b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62969,10 +62969,10 @@ rule ELASTIC_Windows_Generic_Threat_Ca0686E1 : FILE MEMORY
 		date = "2024-01-05"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L609-L627"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L609-L627"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "15c7ce1bc55549efc86dea74a90f42fb4665fe15b14f760037897c772159a5b5"
-		logic_hash = "12b2ff66d1be6e2d27f24489b389b5c84660921e8de41653b2b425077cc87669"
+		logic_hash = "v1_sha256_12b2ff66d1be6e2d27f24489b389b5c84660921e8de41653b2b425077cc87669"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -62998,10 +62998,10 @@ rule ELASTIC_Windows_Generic_Threat_97C1A260 : FILE MEMORY
 		date = "2024-01-07"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L629-L647"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L629-L647"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2cc85ebb1ef07948b1ddf1a793809b76ee61d78c07b8bf6e702c9b17346a20f1"
-		logic_hash = "5bd84cbdd4ba699c9e9d87e684071342b23138538bd83ffea8c524fcee26a59b"
+		logic_hash = "v1_sha256_5bd84cbdd4ba699c9e9d87e684071342b23138538bd83ffea8c524fcee26a59b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63027,10 +63027,10 @@ rule ELASTIC_Windows_Generic_Threat_A440F624 : FILE MEMORY
 		date = "2024-01-07"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L649-L668"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L649-L668"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3564fec3d47dfafc7e9c662654865aed74aedeac7371af8a77e573ea92cbd072"
-		logic_hash = "23c759a0db5698b28a69232077a6b714f71e8eaa069d2f02a7d3efc48b178a2b"
+		logic_hash = "v1_sha256_23c759a0db5698b28a69232077a6b714f71e8eaa069d2f02a7d3efc48b178a2b"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -63057,10 +63057,10 @@ rule ELASTIC_Windows_Generic_Threat_B577C086 : FILE MEMORY
 		date = "2024-01-07"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L670-L688"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L670-L688"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "27dd61d4d9997738e63e813f8b8ea9d5cf1291eb02d20d1a2ad75ac8aa99459c"
-		logic_hash = "a7684340171415ee01e855706192cdffcccd6c82362707229b2c1d096f87dfa8"
+		logic_hash = "v1_sha256_a7684340171415ee01e855706192cdffcccd6c82362707229b2c1d096f87dfa8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63086,10 +63086,10 @@ rule ELASTIC_Windows_Generic_Threat_62E1F5Fc : FILE MEMORY
 		date = "2024-01-07"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L690-L710"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L690-L710"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4a692e244a389af0339de8c2d429b541d6d763afb0a2b1bb20bee879330f2f42"
-		logic_hash = "76e21746ee396f13073b3db1e876246f01cef547d312691dff3dc895ea3a2b82"
+		logic_hash = "v1_sha256_76e21746ee396f13073b3db1e876246f01cef547d312691dff3dc895ea3a2b82"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -63117,10 +63117,10 @@ rule ELASTIC_Windows_Generic_Threat_55D6A1Ab : FILE MEMORY
 		date = "2024-01-07"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L712-L731"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L712-L731"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ca6ed610479b5aaaf193a2afed8f2ca1e32c0c5550a195d88f689caab60c6fb"
-		logic_hash = "4f3a0b2e45ae4e6a00f137798b700a0925fa6eb19ea6b871d7eeb565548888ba"
+		logic_hash = "v1_sha256_4f3a0b2e45ae4e6a00f137798b700a0925fa6eb19ea6b871d7eeb565548888ba"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -63147,10 +63147,10 @@ rule ELASTIC_Windows_Generic_Threat_F7D3Cdfd : FILE MEMORY
 		date = "2024-01-07"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L733-L751"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L733-L751"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f9df83d0b0e06884cdb4a02cd2091ee1fadeabb2ea16ca34cbfef4129ede251f"
-		logic_hash = "23e1008f222eb94a4bd34372834924377e813dc76efa8544b0dcbe7d3e3addde"
+		logic_hash = "v1_sha256_23e1008f222eb94a4bd34372834924377e813dc76efa8544b0dcbe7d3e3addde"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63176,10 +63176,10 @@ rule ELASTIC_Windows_Generic_Threat_0350Ed31 : FILE MEMORY
 		date = "2024-01-07"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L753-L771"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L753-L771"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "008f9352765d1b3360726363e3e179b527a566bc59acecea06bd16eb16b66c5d"
-		logic_hash = "149dd26466f47b2e7f514bdcc9822470334490da2898840f35fe6b537ce104f6"
+		logic_hash = "v1_sha256_149dd26466f47b2e7f514bdcc9822470334490da2898840f35fe6b537ce104f6"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -63205,10 +63205,10 @@ rule ELASTIC_Windows_Generic_Threat_A1Cef0Cd : FILE MEMORY
 		date = "2024-01-08"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L773-L791"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L773-L791"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "71f519c6bd598e17e1298d247a4ad37b78685ca6fd423d560d397d34d16b7db8"
-		logic_hash = "2772906e3a8a088e7c6ea1370af5e5bbe2cbae4f49de9b939524e317be8ddde4"
+		logic_hash = "v1_sha256_2772906e3a8a088e7c6ea1370af5e5bbe2cbae4f49de9b939524e317be8ddde4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63234,10 +63234,10 @@ rule ELASTIC_Windows_Generic_Threat_E5F4703F : FILE MEMORY
 		date = "2024-01-09"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L793-L811"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L793-L811"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "362bda1fad3fefce7d173617909d3c1a0a8e234e22caf3215ee7c6cef6b2743b"
-		logic_hash = "f81476d5e5a9bcb42b32d6ec3d4b620165f2878c50691ecf59ef6f34b6ad9d1b"
+		logic_hash = "v1_sha256_f81476d5e5a9bcb42b32d6ec3d4b620165f2878c50691ecf59ef6f34b6ad9d1b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63263,10 +63263,10 @@ rule ELASTIC_Windows_Generic_Threat_8B790Aba : FILE MEMORY
 		date = "2024-01-09"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L813-L832"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L813-L832"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ec98bfff01d384bdff6bbbc5e17620b31fa57c662516157fd476ef587b8d239e"
-		logic_hash = "8a0b2af3d0c95466ca138dfcc3d6f6a702ec92f5cd4f791b1200c79ffd973840"
+		logic_hash = "v1_sha256_8a0b2af3d0c95466ca138dfcc3d6f6a702ec92f5cd4f791b1200c79ffd973840"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -63293,10 +63293,10 @@ rule ELASTIC_Windows_Generic_Threat_76A7579F : FILE MEMORY
 		date = "2024-01-09"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L834-L852"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L834-L852"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "76c73934bcff7e4ee08b068d1e02b8f5c22161262d127de2b4ac2e81d09d84f6"
-		logic_hash = "08ed2d318e7154195911aaf3705626307b48a54aa195eaa054ec53766d3e198d"
+		logic_hash = "v1_sha256_08ed2d318e7154195911aaf3705626307b48a54aa195eaa054ec53766d3e198d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63322,10 +63322,10 @@ rule ELASTIC_Windows_Generic_Threat_3F060B9C : FILE MEMORY
 		date = "2024-01-10"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L854-L872"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L854-L872"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "32e7a40b13ddbf9fc73bd12c234336b1ae11e2f39476de99ebacd7bbfd22fba0"
-		logic_hash = "193583f63f22452f96c8372fdc9ef04e2a684f847564a7fe75145ea30d426901"
+		logic_hash = "v1_sha256_193583f63f22452f96c8372fdc9ef04e2a684f847564a7fe75145ea30d426901"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63351,10 +63351,10 @@ rule ELASTIC_Windows_Generic_Threat_Dbae6542 : FILE MEMORY
 		date = "2024-01-10"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L874-L892"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L874-L892"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c73f533f96ed894b9ff717da195083a594673e218ee9a269e360353b9c9a0283"
-		logic_hash = "673c6b4e6aaa127d45b21d0283437000fbc507a84ecd7a326448869d63759aee"
+		logic_hash = "v1_sha256_673c6b4e6aaa127d45b21d0283437000fbc507a84ecd7a326448869d63759aee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63380,10 +63380,10 @@ rule ELASTIC_Windows_Generic_Threat_808F680E : FILE MEMORY
 		date = "2024-01-10"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L894-L912"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L894-L912"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "df6955522532e365239b94e9d834ff5eeeb354eec3e3672c48be88725849ac1c"
-		logic_hash = "22d91a87c01b401d4a203fbabb93a9b45fd6d8819125c56d9c427449b06d2f84"
+		logic_hash = "v1_sha256_22d91a87c01b401d4a203fbabb93a9b45fd6d8819125c56d9c427449b06d2f84"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63409,10 +63409,10 @@ rule ELASTIC_Windows_Generic_Threat_073909Cf : FILE MEMORY
 		date = "2024-01-10"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L914-L932"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L914-L932"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "89a6dc518c119b39252889632bd18d9dfdae687f7621310fb14b684d2f85dad8"
-		logic_hash = "5b42a74010549c884ff85a67b9add6b82a8109a953473cc1439581976f8f545e"
+		logic_hash = "v1_sha256_5b42a74010549c884ff85a67b9add6b82a8109a953473cc1439581976f8f545e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63438,10 +63438,10 @@ rule ELASTIC_Windows_Generic_Threat_820Fe9C9 : FILE MEMORY
 		date = "2024-01-11"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L934-L952"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L934-L952"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1102a499b8a863bdbfd978a1d17270990e6b7fe60ce54b9dd17492234aad2f8c"
-		logic_hash = "81a1359bd5781e1eefb6ae06c6b2ad9e94cc6318c1f81f84c06f0b236b6e84d1"
+		logic_hash = "v1_sha256_81a1359bd5781e1eefb6ae06c6b2ad9e94cc6318c1f81f84c06f0b236b6e84d1"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -63467,10 +63467,10 @@ rule ELASTIC_Windows_Generic_Threat_89Efd1B4 : FILE MEMORY
 		date = "2024-01-11"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L954-L972"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L954-L972"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "937c8bc3c89bb9c05b2cb859c4bf0f47020917a309bbadca36236434c8cdc8b9"
-		logic_hash = "49a7875fd9c31c5c9b593aed75a28fadb586294422b75c7a8eeba2e8ff254753"
+		logic_hash = "v1_sha256_49a7875fd9c31c5c9b593aed75a28fadb586294422b75c7a8eeba2e8ff254753"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63496,10 +63496,10 @@ rule ELASTIC_Windows_Generic_Threat_61315534 : FILE MEMORY
 		date = "2024-01-11"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L974-L992"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L974-L992"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "819447ca71080f083b1061ed6e333bd9ef816abd5b0dd0b5e6a58511ab1ce8b9"
-		logic_hash = "0fdfe3bb6ebdaac4324a45dac8680f00684d0030419f26f3f72ed002bf5a2a34"
+		logic_hash = "v1_sha256_0fdfe3bb6ebdaac4324a45dac8680f00684d0030419f26f3f72ed002bf5a2a34"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63525,10 +63525,10 @@ rule ELASTIC_Windows_Generic_Threat_Eab96Cf2 : FILE MEMORY
 		date = "2024-01-11"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L994-L1012"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L994-L1012"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2be8a2c524f1fb2acb2af92bc56eb9377c4e16923a06f5ac2373811041ea7982"
-		logic_hash = "cc1dfc2c9c5e1fbc6282342dfbf3a6c834fa56fb6fc46569a24fa78535c5845f"
+		logic_hash = "v1_sha256_cc1dfc2c9c5e1fbc6282342dfbf3a6c834fa56fb6fc46569a24fa78535c5845f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63554,10 +63554,10 @@ rule ELASTIC_Windows_Generic_Threat_11A56097 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1014-L1033"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1014-L1033"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "98d538c8f074d831b7a91e549e78f6549db5d2c53a10dbe82209d15d1c2e9b56"
-		logic_hash = "42f955c079752c787ac70682bc41fa31f3196d30051d7032276a0d4279d59d58"
+		logic_hash = "v1_sha256_42f955c079752c787ac70682bc41fa31f3196d30051d7032276a0d4279d59d58"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -63584,10 +63584,10 @@ rule ELASTIC_Windows_Generic_Threat_F3Bef434 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1035-L1053"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1035-L1053"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "98d538c8f074d831b7a91e549e78f6549db5d2c53a10dbe82209d15d1c2e9b56"
-		logic_hash = "efba0e1fbe6562a9aeaac23b851c31350e4ac6551e505be4986bddade92ca303"
+		logic_hash = "v1_sha256_efba0e1fbe6562a9aeaac23b851c31350e4ac6551e505be4986bddade92ca303"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63613,10 +63613,10 @@ rule ELASTIC_Windows_Generic_Threat_C6F131C5 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1055-L1073"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1055-L1073"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "247314baaaa993b8db9de7ef0e2998030f13b99d6fd0e17ffd59e31a8d17747a"
-		logic_hash = "5702a77fee0cd564916abdbfedf76d069bb7a5b6de0c4623150991d52dc02e42"
+		logic_hash = "v1_sha256_5702a77fee0cd564916abdbfedf76d069bb7a5b6de0c4623150991d52dc02e42"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63642,10 +63642,10 @@ rule ELASTIC_Windows_Generic_Threat_B2A054F8 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1075-L1095"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1075-L1095"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "63d2478a5db820731a48a7ad5a20d7a4deca35c6b865a17de86248bef7a64da7"
-		logic_hash = "f64b1666f78646322a4c37dc887d8fcfdb275b0bca812e360579cefd9e323c02"
+		logic_hash = "v1_sha256_f64b1666f78646322a4c37dc887d8fcfdb275b0bca812e360579cefd9e323c02"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -63673,10 +63673,10 @@ rule ELASTIC_Windows_Generic_Threat_Fcab7E76 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1097-L1115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1097-L1115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "67d7e016e401bd5d435eecaa9e8ead341aed2f373a1179069f53b64bda3f1f56"
-		logic_hash = "90f50d1227b8e462eaa393690dc2b25601444bf80f2108445a0413bff6bedae8"
+		logic_hash = "v1_sha256_90f50d1227b8e462eaa393690dc2b25601444bf80f2108445a0413bff6bedae8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63702,10 +63702,10 @@ rule ELASTIC_Windows_Generic_Threat_90E4F085 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1117-L1137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1117-L1137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1a6a290d98f5957d00756fc55187c78030de7031544a981fd2bb4cfeae732168"
-		logic_hash = "2afeae6de965ae155914dcedbfe375327a9fca3b42733c23360dd4fddfcc8a3d"
+		logic_hash = "v1_sha256_2afeae6de965ae155914dcedbfe375327a9fca3b42733c23360dd4fddfcc8a3d"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -63733,10 +63733,10 @@ rule ELASTIC_Windows_Generic_Threat_04A9C177 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1139-L1157"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1139-L1157"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0cccdde4dcc8916fb6399c181722eb0da2775d86146ce3cb3fc7f8cf6cd67c29"
-		logic_hash = "ca7cf71228b1e13ec05c62cd9924ea5089fdf903d8ea4a5151866996ea81e01e"
+		logic_hash = "v1_sha256_ca7cf71228b1e13ec05c62cd9924ea5089fdf903d8ea4a5151866996ea81e01e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63762,10 +63762,10 @@ rule ELASTIC_Windows_Generic_Threat_45D1E986 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1159-L1177"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1159-L1177"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fd159cf2f9bd48b0f6f5958eef8af8feede2bcbbea035a7e56ce1ff72d3f47eb"
-		logic_hash = "d53a4d189b9a49f9b6477e12bce0d41e62827306d1df79e6494ab67669d84f35"
+		logic_hash = "v1_sha256_d53a4d189b9a49f9b6477e12bce0d41e62827306d1df79e6494ab67669d84f35"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63791,10 +63791,10 @@ rule ELASTIC_Windows_Generic_Threat_83C38E63 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1179-L1198"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1179-L1198"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2121a0e5debcfeedf200d7473030062bc9f5fbd5edfdcd464dfedde272ff1ae7"
-		logic_hash = "89d4036290a29b372918205bba85698d6343109503766cbb13999b5177fc3152"
+		logic_hash = "v1_sha256_89d4036290a29b372918205bba85698d6343109503766cbb13999b5177fc3152"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -63821,10 +63821,10 @@ rule ELASTIC_Windows_Generic_Threat_Bd24Be68 : FILE MEMORY
 		date = "2024-01-12"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1200-L1218"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1200-L1218"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fd159cf2f9bd48b0f6f5958eef8af8feede2bcbbea035a7e56ce1ff72d3f47eb"
-		logic_hash = "8536593696930d03f1e62586886f0df5438d13fb796b4605df7ad67d9633d5f9"
+		logic_hash = "v1_sha256_8536593696930d03f1e62586886f0df5438d13fb796b4605df7ad67d9633d5f9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63850,10 +63850,10 @@ rule ELASTIC_Windows_Generic_Threat_A0C7B402 : FILE MEMORY
 		date = "2024-01-16"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1220-L1238"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1220-L1238"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5814d7712304800d92487b8e1108d20ad7b44f48910b1fb0a99e9b36baa4333a"
-		logic_hash = "d0aa75debbefb301b9fc46ceca4944ae8c4b009118214a9589440b59089b853e"
+		logic_hash = "v1_sha256_d0aa75debbefb301b9fc46ceca4944ae8c4b009118214a9589440b59089b853e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63879,10 +63879,10 @@ rule ELASTIC_Windows_Generic_Threat_42B3E0D7 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1240-L1258"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1240-L1258"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "99ad416b155970fda383a63fe61de2e4d0254e9c9e09564e17938e8e2b49b5b7"
-		logic_hash = "58b4c667b6d796f4525afeb706394f593d03393e3a48e2a0b7664f121e6a78fe"
+		logic_hash = "v1_sha256_58b4c667b6d796f4525afeb706394f593d03393e3a48e2a0b7664f121e6a78fe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63908,10 +63908,10 @@ rule ELASTIC_Windows_Generic_Threat_66142106 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1260-L1278"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1260-L1278"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cd164a65fb2a496ad7b54c782f25fbfca0540d46d2c0d6b098d7be516c4ce021"
-		logic_hash = "bf5d8db3ed6d2abc3158b04e904351250bf17a6d766e31769b3c5a6e534165b0"
+		logic_hash = "v1_sha256_bf5d8db3ed6d2abc3158b04e904351250bf17a6d766e31769b3c5a6e534165b0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63937,10 +63937,10 @@ rule ELASTIC_Windows_Generic_Threat_51A1D82B : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1280-L1298"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1280-L1298"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1a7adde856991fa25fac79048461102fba58cda9492d4f5203b817d767a81018"
-		logic_hash = "2d6b0560e1980deb6aad8e0902d065eeda406506b70bb8bb27c7fa58be9842f8"
+		logic_hash = "v1_sha256_2d6b0560e1980deb6aad8e0902d065eeda406506b70bb8bb27c7fa58be9842f8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -63966,10 +63966,10 @@ rule ELASTIC_Windows_Generic_Threat_Dee3B4Bf : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1300-L1318"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1300-L1318"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c7f4b63fa5c7386d6444c0d0428a8fe328446efcef5fda93821f05e86efd2fba"
-		logic_hash = "cfd7f9250ab44ffe12b62f84ae753032642d9aa2524d88a6d4d989a2afa043a3"
+		logic_hash = "v1_sha256_cfd7f9250ab44ffe12b62f84ae753032642d9aa2524d88a6d4d989a2afa043a3"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -63995,10 +63995,10 @@ rule ELASTIC_Windows_Generic_Threat_Fdbcd3F2 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1320-L1338"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1320-L1338"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9258e4fe077be21ad7ae348868f1ac6226f6e9d404c664025006ab4b64222369"
-		logic_hash = "ca9136ca44a61795cca44ac9bb0494fdc34c08d6578603ba3be3582956f4a98f"
+		logic_hash = "v1_sha256_ca9136ca44a61795cca44ac9bb0494fdc34c08d6578603ba3be3582956f4a98f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64024,10 +64024,10 @@ rule ELASTIC_Windows_Generic_Threat_B7852Ccf : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1340-L1360"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1340-L1360"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5ac70fa959be4ee37c0c56f0dd04061a5fed78fcbde21b8449fc93e44a8c133a"
-		logic_hash = "4d5c29cceaacfda0c41bcd13cf95e90397b1b6c0c6beeb19b9184f435c8669b9"
+		logic_hash = "v1_sha256_4d5c29cceaacfda0c41bcd13cf95e90397b1b6c0c6beeb19b9184f435c8669b9"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -64055,10 +64055,10 @@ rule ELASTIC_Windows_Generic_Threat_C3C8F21A : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1362-L1380"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1362-L1380"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9a102873dd37d08f53dcf6b5dad2555598a954d18fb3090bbf842655c5fded35"
-		logic_hash = "b4d2b28fb2c9d46884b0b34f7821151b88891a8d881885c704e0e192cf7fca70"
+		logic_hash = "v1_sha256_b4d2b28fb2c9d46884b0b34f7821151b88891a8d881885c704e0e192cf7fca70"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64084,10 +64084,10 @@ rule ELASTIC_Windows_Generic_Threat_A3D51E0C : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1382-L1400"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1382-L1400"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "18bd25df1025cd04b0642e507b0170bc1a2afba71b2dc4bd5e83cc487860db0d"
-		logic_hash = "f128f6a037abb4af2c11605b182852146780be6451b3062a2914bedb5c286843"
+		logic_hash = "v1_sha256_f128f6a037abb4af2c11605b182852146780be6451b3062a2914bedb5c286843"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64113,10 +64113,10 @@ rule ELASTIC_Windows_Generic_Threat_54Ccad4D : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1402-L1422"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1402-L1422"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fe4aad002722d2173dd661b7b34cdb0e3d4d8cd600e4165975c48bf1b135763f"
-		logic_hash = "b9fb525be22dd2f235c3ac68688ced5298da45194ad032423689f5a085df6e31"
+		logic_hash = "v1_sha256_b9fb525be22dd2f235c3ac68688ced5298da45194ad032423689f5a085df6e31"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -64144,10 +64144,10 @@ rule ELASTIC_Windows_Generic_Threat_6Ee18020 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1424-L1442"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1424-L1442"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d58d8f5a7efcb02adac92362d8c608e6d056824641283497b2e1c1f0e2d19b0a"
-		logic_hash = "8a08973ae2ddde275e007686fc6eca831c1fb398b7221d5022da10f90da0e44d"
+		logic_hash = "v1_sha256_8a08973ae2ddde275e007686fc6eca831c1fb398b7221d5022da10f90da0e44d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64173,10 +64173,10 @@ rule ELASTIC_Windows_Generic_Threat_8Eb547Db : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1444-L1462"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1444-L1462"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3fc821b63dfa653b86b11201073997fa4dc273124d050c2a7c267ac789d8a447"
-		logic_hash = "73cabad0656c6b347def017b07138fdbdd5b41da5ccf7d701fea764669058f39"
+		logic_hash = "v1_sha256_73cabad0656c6b347def017b07138fdbdd5b41da5ccf7d701fea764669058f39"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64202,10 +64202,10 @@ rule ELASTIC_Windows_Generic_Threat_803Feff4 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1464-L1482"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1464-L1482"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8f150dfb13e4a2ff36231f873e4c0677b5db4aa235d8f0aeb41e02f7e31c1e05"
-		logic_hash = "e22b8b208ff104e2843d897c425467f2f0ec0c586c4db578da90aeaef0209e1d"
+		logic_hash = "v1_sha256_e22b8b208ff104e2843d897c425467f2f0ec0c586c4db578da90aeaef0209e1d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64231,10 +64231,10 @@ rule ELASTIC_Windows_Generic_Threat_9C7D2333 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1484-L1502"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1484-L1502"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "85219f1402c88ab1e69aa99fe4bed75b2ad1918f4e95c448cdc6a4b9d2f9a5d4"
-		logic_hash = "561290ebf3ca2a01914f514d63121be930e7a8c06cfc90ff4b8f0c7cef3408fe"
+		logic_hash = "v1_sha256_561290ebf3ca2a01914f514d63121be930e7a8c06cfc90ff4b8f0c7cef3408fe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64260,10 +64260,10 @@ rule ELASTIC_Windows_Generic_Threat_747B58Af : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1504-L1524"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1504-L1524"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ee28e93412c59d63155fd79bc99979a5664c48dcb3c77e121d17fa985fcb0ebe"
-		logic_hash = "fd6b36ca50c1017035474b491f716bfb0d53b181fce4b5478a57a1d1a6ddc3e7"
+		logic_hash = "v1_sha256_fd6b36ca50c1017035474b491f716bfb0d53b181fce4b5478a57a1d1a6ddc3e7"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -64291,10 +64291,10 @@ rule ELASTIC_Windows_Generic_Threat_C3C4E847 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1526-L1544"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1526-L1544"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "86b37f0b2d9d7a810b5739776b4104f1ded3a1228c4ec2d104d26d8eb26aa7ba"
-		logic_hash = "fa147abf7aa872f409e7684c4c60485fc58f57543062573526e56ff9866f8dfe"
+		logic_hash = "v1_sha256_fa147abf7aa872f409e7684c4c60485fc58f57543062573526e56ff9866f8dfe"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -64320,10 +64320,10 @@ rule ELASTIC_Windows_Generic_Threat_6542Ebda : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1546-L1564"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1546-L1564"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2073e51c7db7040c6046e36585873a0addc2bcddeb6e944b46f96c607dd83595"
-		logic_hash = "30263341bf51a001503dfda9be5771d401bc5b5423682c29a6d4ebc457415d3e"
+		logic_hash = "v1_sha256_30263341bf51a001503dfda9be5771d401bc5b5423682c29a6d4ebc457415d3e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64349,10 +64349,10 @@ rule ELASTIC_Windows_Generic_Threat_1417511B : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1566-L1584"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1566-L1584"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2fc9bd91753ff3334ef7f9861dc1ae79cf5915d79fa50f7104cbb3262b7037da"
-		logic_hash = "e6b53082fa447ac3cf56784771aca742696922e6f740a24d014e04250dc5020c"
+		logic_hash = "v1_sha256_e6b53082fa447ac3cf56784771aca742696922e6f740a24d014e04250dc5020c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64378,10 +64378,10 @@ rule ELASTIC_Windows_Generic_Threat_7526F106 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1586-L1605"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1586-L1605"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5a297c446c27a8d851c444b6b32a346a7f9f5b5e783564742d39e90cd583e0f0"
-		logic_hash = "a0f9eb760be05196f0c5c3e3bf250929b48341a58a11c24722978fa19c4a9f57"
+		logic_hash = "v1_sha256_a0f9eb760be05196f0c5c3e3bf250929b48341a58a11c24722978fa19c4a9f57"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -64408,10 +64408,10 @@ rule ELASTIC_Windows_Generic_Threat_Cbe3313A : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1607-L1625"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1607-L1625"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ca2a28c851070b9bfe1f7dd655f2ea10ececef49276c998a1d2a1b48f84cef3"
-		logic_hash = "41a731cefe0c8ee95f1db598b68a8860ef7ff06137ce94d0dd0b5c60c4240e85"
+		logic_hash = "v1_sha256_41a731cefe0c8ee95f1db598b68a8860ef7ff06137ce94d0dd0b5c60c4240e85"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64437,10 +64437,10 @@ rule ELASTIC_Windows_Generic_Threat_779Cf969 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1627-L1645"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1627-L1645"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ef281230c248442c804f1930caba48f0ae6cef110665020139f826ab99bbf274"
-		logic_hash = "ad0f2d78386abf4c6dc6b5a4a88b4dcf8e5bf8086b08bac91e5e00be9936e908"
+		logic_hash = "v1_sha256_ad0f2d78386abf4c6dc6b5a4a88b4dcf8e5bf8086b08bac91e5e00be9936e908"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -64466,10 +64466,10 @@ rule ELASTIC_Windows_Generic_Threat_D568682A : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1647-L1665"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1647-L1665"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0d98bc52259e0625ec2f24078cf4ae3233e5be0ade8f97a80ca590a0f1418582"
-		logic_hash = "97e172502037c7a5d66327fcc4a237e5548694fc7d73a535838ad56367f15d76"
+		logic_hash = "v1_sha256_97e172502037c7a5d66327fcc4a237e5548694fc7d73a535838ad56367f15d76"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64495,10 +64495,10 @@ rule ELASTIC_Windows_Generic_Threat_Ccb6A7A2 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1667-L1686"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1667-L1686"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "60503212db3f27a4d68bbfc94048ffede04ad37c78a19c4fe428b50f27af7a0d"
-		logic_hash = "312265bbc4330a463bbe7478c70233f5df3353bda3c450562f2414f3675ba91e"
+		logic_hash = "v1_sha256_312265bbc4330a463bbe7478c70233f5df3353bda3c450562f2414f3675ba91e"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -64525,10 +64525,10 @@ rule ELASTIC_Windows_Generic_Threat_D62F1D01 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1688-L1706"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1688-L1706"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "380892397b86f47ec5e6ed1845317bf3fd9c00d01f516cedfe032c0549eef239"
-		logic_hash = "fd65eb56f3a48c37f83d3544c039d29c231cac1e2f8f07d176d709432a75a4c3"
+		logic_hash = "v1_sha256_fd65eb56f3a48c37f83d3544c039d29c231cac1e2f8f07d176d709432a75a4c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64554,10 +64554,10 @@ rule ELASTIC_Windows_Generic_Threat_2Bb6F41D : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1708-L1728"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1708-L1728"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "afa060352346dda4807dffbcac75bf07e8800d87ff72971b65e9805fabef39c0"
-		logic_hash = "7c4e62b69880eb8a901d7e94b7539786e8ac58808df07cb1cbe9ff45efce518e"
+		logic_hash = "v1_sha256_7c4e62b69880eb8a901d7e94b7539786e8ac58808df07cb1cbe9ff45efce518e"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -64585,9 +64585,9 @@ rule ELASTIC_Windows_Generic_Threat_C54Ed0Ed : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1730-L1747"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "f0f4878cb003371522ed1419984f15fd5049f1adeb8e051b8b51b31b0d620e96"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1730-L1747"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_f0f4878cb003371522ed1419984f15fd5049f1adeb8e051b8b51b31b0d620e96"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64613,10 +64613,10 @@ rule ELASTIC_Windows_Generic_Threat_Dbe41439 : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1749-L1767"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1749-L1767"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "64afd2bc6cec17402473a29b94325ae2e26989caf5a8b916dc21952149d71b00"
-		logic_hash = "288cdc285d024f2b69847e0d49bd4dc1c86a2a6a24a7b4fb248071855ba39a38"
+		logic_hash = "v1_sha256_288cdc285d024f2b69847e0d49bd4dc1c86a2a6a24a7b4fb248071855ba39a38"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64642,10 +64642,10 @@ rule ELASTIC_Windows_Generic_Threat_51A52B44 : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1769-L1787"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1769-L1787"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "303aafcc660baa803344bed6a3a7a5b150668f88a222c28182db588fc1e744e0"
-		logic_hash = "aad1c350f43cf2e0512e085e1a04db6099c568e375423afb9518b1fb89801c21"
+		logic_hash = "v1_sha256_aad1c350f43cf2e0512e085e1a04db6099c568e375423afb9518b1fb89801c21"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -64671,10 +64671,10 @@ rule ELASTIC_Windows_Generic_Threat_5C18A7F9 : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1789-L1807"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1789-L1807"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fd272678098eae8f5ec8428cf25d2f1d8b65566c59e363d42c7ce9ffab90faaa"
-		logic_hash = "05cea396567ed3e23907dec4e6e3a6629cd1044d9123cde0575a04b73bae6c20"
+		logic_hash = "v1_sha256_05cea396567ed3e23907dec4e6e3a6629cd1044d9123cde0575a04b73bae6c20"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64700,10 +64700,10 @@ rule ELASTIC_Windows_Generic_Threat_Ab01Ba9E : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1809-L1829"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1809-L1829"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2b237716d0c0c9877f54b3fa03823068728dfe0710c5b05e9808eab365a1408e"
-		logic_hash = "cc8d79950e21270938d2ea7e501c7c8fdbebe92767b48b46bb03c08c377e095b"
+		logic_hash = "v1_sha256_cc8d79950e21270938d2ea7e501c7c8fdbebe92767b48b46bb03c08c377e095b"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -64731,10 +64731,10 @@ rule ELASTIC_Windows_Generic_Threat_917D7645 : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1831-L1849"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1831-L1849"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "19b54a20cfa74cbb0f4724155244b52ca854054a205be6d148f826fa008d6c55"
-		logic_hash = "65748ff2e4448f305b9541ea9864cc6bda054d37be5ed34110a2f64c8fef30c7"
+		logic_hash = "v1_sha256_65748ff2e4448f305b9541ea9864cc6bda054d37be5ed34110a2f64c8fef30c7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64760,10 +64760,10 @@ rule ELASTIC_Windows_Generic_Threat_7A09E97D : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1851-L1869"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1851-L1869"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0c1e333e60547a90ec9d9dac3fc6698b088769bc0f5ec25883b2c4d1fd680a9"
-		logic_hash = "b65b2d12901953c137687a7b466c78e0537a2830c37a4cb13dd0eda457bba937"
+		logic_hash = "v1_sha256_b65b2d12901953c137687a7b466c78e0537a2830c37a4cb13dd0eda457bba937"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64789,10 +64789,10 @@ rule ELASTIC_Windows_Generic_Threat_Dc4Ede3B : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1871-L1889"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1871-L1889"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c49f20c5b42c6d813e6364b1fcb68c1b63a2f7def85a3ddfc4e664c4e90f8798"
-		logic_hash = "c402d5f16f2be32912d7a054b51ab6dafc6173bb5a267a7846b3ac9df1c4c19f"
+		logic_hash = "v1_sha256_c402d5f16f2be32912d7a054b51ab6dafc6173bb5a267a7846b3ac9df1c4c19f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64818,10 +64818,10 @@ rule ELASTIC_Windows_Generic_Threat_Bb480769 : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1891-L1909"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1891-L1909"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "010e3aeb26533d418bb7d2fdcfb5ec21b36603b6abb63511be25a37f99635bce"
-		logic_hash = "1087e0befceac2606ce5dc5f2b42b45ebad888e7d3e451c3fb89de7e932a31f5"
+		logic_hash = "v1_sha256_1087e0befceac2606ce5dc5f2b42b45ebad888e7d3e451c3fb89de7e932a31f5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64847,10 +64847,10 @@ rule ELASTIC_Windows_Generic_Threat_5Fbf5680 : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1911-L1929"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1911-L1929"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1b0553a9873d4cda213f5464b5e98904163e347a49282db679394f70d4571e77"
-		logic_hash = "ec5399f6fb29125cb4c096851b9194fa35fb1e5ddd1f4d4f07b155471ae5c619"
+		logic_hash = "v1_sha256_ec5399f6fb29125cb4c096851b9194fa35fb1e5ddd1f4d4f07b155471ae5c619"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64876,10 +64876,10 @@ rule ELASTIC_Windows_Generic_Threat_Aa30A738 : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1931-L1949"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1931-L1949"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7726a691bd6c1ee51a9682e0087403a2c5a798ad172c1402acf2209c34092d18"
-		logic_hash = "64967fbc0e74435452752731a8b9385345cc771d27ee33cd018cccdeb26bb75e"
+		logic_hash = "v1_sha256_64967fbc0e74435452752731a8b9385345cc771d27ee33cd018cccdeb26bb75e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64905,10 +64905,10 @@ rule ELASTIC_Windows_Generic_Threat_9A8Dc290 : FILE MEMORY
 		date = "2024-01-21"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1951-L1969"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1951-L1969"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d951562a841f3706005d7696052d45397e3b4296d4cd96bf187920175fbb1676"
-		logic_hash = "0097a13187b953ebe97809dda2be818cfcd94991c03e75f344e34a3d2c4fe902"
+		logic_hash = "v1_sha256_0097a13187b953ebe97809dda2be818cfcd94991c03e75f344e34a3d2c4fe902"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64934,10 +64934,10 @@ rule ELASTIC_Windows_Generic_Threat_Bbf2A354 : FILE MEMORY
 		date = "2024-01-22"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1971-L1989"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1971-L1989"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b4e6c748ad88070e39b53a9373946e9e404623326f710814bed439e5ea61fc3e"
-		logic_hash = "6be2fae41199daea6b9d0394c9af7713543333a50620ef417bb8439d5a07f336"
+		logic_hash = "v1_sha256_6be2fae41199daea6b9d0394c9af7713543333a50620ef417bb8439d5a07f336"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -64963,10 +64963,10 @@ rule ELASTIC_Windows_Generic_Threat_Da0F3Cbb : FILE MEMORY
 		date = "2024-01-22"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L1991-L2009"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L1991-L2009"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b2c456d0051ffe1ca7e9de1e944692b10ed466eabb38242ea88e663a23157c58"
-		logic_hash = "262d0bbb69adde8c4c8645813b048f3aaa2dbcc83996606e7ca21c3edea2b5d8"
+		logic_hash = "v1_sha256_262d0bbb69adde8c4c8645813b048f3aaa2dbcc83996606e7ca21c3edea2b5d8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -64992,10 +64992,10 @@ rule ELASTIC_Windows_Generic_Threat_7D555B55 : FILE MEMORY
 		date = "2024-01-22"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2011-L2029"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2011-L2029"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7efa5c8fd55a20fbc3a270cf2329d4a38f10ca372f3428bee4c42279fbe6f9c3"
-		logic_hash = "dc3a3622abbc7d0a02d8d9ed4446d0a72a603ecfd6594ecfa615e5418a9c9970"
+		logic_hash = "v1_sha256_dc3a3622abbc7d0a02d8d9ed4446d0a72a603ecfd6594ecfa615e5418a9c9970"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65021,10 +65021,10 @@ rule ELASTIC_Windows_Generic_Threat_0A38C7D0 : FILE MEMORY
 		date = "2024-01-22"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2031-L2049"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2031-L2049"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "69ea7d2ea3ed6826ddcefb3c1daa63d8ab53dc6e66c59cf5c2506a8af1c62ef4"
-		logic_hash = "e3fde76825772683c57f830759168fc9a3b3f3387f091828fd971e9ebba06d8a"
+		logic_hash = "v1_sha256_e3fde76825772683c57f830759168fc9a3b3f3387f091828fd971e9ebba06d8a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65050,10 +65050,10 @@ rule ELASTIC_Windows_Generic_Threat_98527D90 : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2051-L2069"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2051-L2069"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fa24e7c6777e89928afa2a0afb2fab4db854ed3887056b5a76aef42ae38c3c82"
-		logic_hash = "5a93f0a372f3a51233c6b2334539017df922f35a0d5f7d1749e0dd79268cb836"
+		logic_hash = "v1_sha256_5a93f0a372f3a51233c6b2334539017df922f35a0d5f7d1749e0dd79268cb836"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65079,10 +65079,10 @@ rule ELASTIC_Windows_Generic_Threat_Baba80Fb : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2071-L2089"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2071-L2089"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dd22cb2318d66fa30702368a7f06e445fba4b69daf9c45f8e83562d2c170a073"
-		logic_hash = "ba0da35bc00b776ae9b427e3a4b312b1b75bdc9b972fb52f26a5df6737f1ddc9"
+		logic_hash = "v1_sha256_ba0da35bc00b776ae9b427e3a4b312b1b75bdc9b972fb52f26a5df6737f1ddc9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65108,10 +65108,10 @@ rule ELASTIC_Windows_Generic_Threat_9F4A80B2 : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2091-L2109"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2091-L2109"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "47d57d00e2de43f33cd56ff653adb59b804e4dbe37304a5fa6a202ee20b50c24"
-		logic_hash = "1df3b8245bc0e995443d598feb5fe2605e05df64b863d4f47c17ecbe8d28c3ea"
+		logic_hash = "v1_sha256_1df3b8245bc0e995443d598feb5fe2605e05df64b863d4f47c17ecbe8d28c3ea"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65137,10 +65137,10 @@ rule ELASTIC_Windows_Generic_Threat_39E1Eb4C : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2111-L2129"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2111-L2129"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a733258bf04ffa058db95c8c908a79650400ebd92600b96dd28ceecac311f94a"
-		logic_hash = "d7791ae7513bc5645bcfa93a2d7bf9f7ef47a6727ea2ba5eb85f3c8528761429"
+		logic_hash = "v1_sha256_d7791ae7513bc5645bcfa93a2d7bf9f7ef47a6727ea2ba5eb85f3c8528761429"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65166,10 +65166,10 @@ rule ELASTIC_Windows_Generic_Threat_D51Dd31B : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2131-L2150"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2131-L2150"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2a61c0305d82b6b4180c3d817c28286ab8ee56de44e171522bd07a60a1d8492d"
-		logic_hash = "85fc7aa81489b304c348ead2d7042bb5518ff4579b1d3e837290032c4b144e47"
+		logic_hash = "v1_sha256_85fc7aa81489b304c348ead2d7042bb5518ff4579b1d3e837290032c4b144e47"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -65196,10 +65196,10 @@ rule ELASTIC_Windows_Generic_Threat_3A321F0A : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2152-L2170"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2152-L2170"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "91056e8c53dc1e97c7feafab31f0943f150d89a0b0026bcfb3664d2e93ccfe2b"
-		logic_hash = "83834dd7d4df5de4b6a032f1896f52c1ebdf16ca8ad9766e8872243f1a6da67e"
+		logic_hash = "v1_sha256_83834dd7d4df5de4b6a032f1896f52c1ebdf16ca8ad9766e8872243f1a6da67e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65225,10 +65225,10 @@ rule ELASTIC_Windows_Generic_Threat_A82F45A8 : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2172-L2190"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2172-L2190"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ad07428104d3aa7abec2fd86562eaa8600d3e4b0f8d78ba1446f340d10008b53"
-		logic_hash = "70ebab6b03af38ef8c81664cf49ab07066a9672666599d99c91291a9d2e3af0b"
+		logic_hash = "v1_sha256_70ebab6b03af38ef8c81664cf49ab07066a9672666599d99c91291a9d2e3af0b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65254,10 +65254,10 @@ rule ELASTIC_Windows_Generic_Threat_D6625Ad7 : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2192-L2210"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2192-L2210"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "878c9745320593573597d62c8f3adb3bef0b554cd51b18216f6d9f5d1a32a931"
-		logic_hash = "e90aff7c35f60cc3446f9eeb2131edb7125bfa04eb8f90c5671d06e9ff269755"
+		logic_hash = "v1_sha256_e90aff7c35f60cc3446f9eeb2131edb7125bfa04eb8f90c5671d06e9ff269755"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -65283,10 +65283,10 @@ rule ELASTIC_Windows_Generic_Threat_61Bbb571 : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2212-L2230"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2212-L2230"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "41e2a6cecb1735e8f09b1ba5dccff3c08afe395b6214396e545347927d1815a8"
-		logic_hash = "6b1ec666f3689638b9db9f041b0a89660b27c32590b747c5da3f4a02f01c7112"
+		logic_hash = "v1_sha256_6b1ec666f3689638b9db9f041b0a89660b27c32590b747c5da3f4a02f01c7112"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65312,10 +65312,10 @@ rule ELASTIC_Windows_Generic_Threat_4A605E93 : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2232-L2250"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2232-L2250"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1a84e25505a54e8e308714b53123396df74df1bde223bb306c0dc6220c1f0bbb"
-		logic_hash = "6ad7afa5bd03916917e2bbf4d736331f4319b20bfde296d7e62315584813699f"
+		logic_hash = "v1_sha256_6ad7afa5bd03916917e2bbf4d736331f4319b20bfde296d7e62315584813699f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65341,10 +65341,10 @@ rule ELASTIC_Windows_Generic_Threat_B509Dfc8 : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2252-L2270"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2252-L2270"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9b5124e5e1be30d3f2ad1020bbdb93e2ceeada4c4d36f71b2abbd728bd5292b8"
-		logic_hash = "90b00caf612f56a898b24c28ae6febda3fd11f382ab1deba522bdd2e2ba254b4"
+		logic_hash = "v1_sha256_90b00caf612f56a898b24c28ae6febda3fd11f382ab1deba522bdd2e2ba254b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65370,10 +65370,10 @@ rule ELASTIC_Windows_Generic_Threat_7A49053E : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2272-L2292"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2272-L2292"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "29fb2b18cfd72a2966640ff59e67c89f93f83fc17afad2dfcacf9f53e9ea3446"
-		logic_hash = "6db95f20a2bcdfd7cb37cb33dae6351dd19f51a8c3cae54b1bb034af17378094"
+		logic_hash = "v1_sha256_6db95f20a2bcdfd7cb37cb33dae6351dd19f51a8c3cae54b1bb034af17378094"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -65401,10 +65401,10 @@ rule ELASTIC_Windows_Generic_Threat_Fca7F863 : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2294-L2312"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2294-L2312"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9d0e786dd8f1dc05eae910c6bcf15b5d05b4b6b0543618ca0c2ff3c4bb657af3"
-		logic_hash = "ad45fe6e8257d012824b36aaee1beccb82c1b78031de86c1f1dd26d5be88aa6f"
+		logic_hash = "v1_sha256_ad45fe6e8257d012824b36aaee1beccb82c1b78031de86c1f1dd26d5be88aa6f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65430,10 +65430,10 @@ rule ELASTIC_Windows_Generic_Threat_Cafbd6A3 : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2314-L2333"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2314-L2333"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "97081a51aa016d0e6c9ecadc09ff858bf43364265a006db9d7cc133f8429bc46"
-		logic_hash = "28813fc8a49b6ec3fe7675409fde923f0f30851429a526c142e0a228b4e0efa6"
+		logic_hash = "v1_sha256_28813fc8a49b6ec3fe7675409fde923f0f30851429a526c142e0a228b4e0efa6"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -65460,10 +65460,10 @@ rule ELASTIC_Windows_Generic_Threat_D8F834A9 : FILE MEMORY
 		date = "2024-01-29"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2335-L2353"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2335-L2353"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c118c2064a5839ebd57a67a7be731fffe89669a8f17c1fe678432d4ff85e7929"
-		logic_hash = "9fa1a65f3290867e4c59f14242f7261741e792b8be48c053ac320a315f2c1beb"
+		logic_hash = "v1_sha256_9fa1a65f3290867e4c59f14242f7261741e792b8be48c053ac320a315f2c1beb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65489,10 +65489,10 @@ rule ELASTIC_Windows_Generic_Threat_De3F91C6 : FILE MEMORY
 		date = "2024-01-31"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2355-L2373"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2355-L2373"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e2cd4a8ccbf4a3a93c1387c66d94e9506b5981357004929ce5a41fcedfffb20f"
-		logic_hash = "032ac2adb11782d823f50bfedf4e4decb731dbe7d3abbb3b05ccff598ba7edb8"
+		logic_hash = "v1_sha256_032ac2adb11782d823f50bfedf4e4decb731dbe7d3abbb3b05ccff598ba7edb8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65518,10 +65518,10 @@ rule ELASTIC_Windows_Generic_Threat_F0516E98 : FILE MEMORY
 		date = "2024-01-31"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2375-L2394"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2375-L2394"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "21d01bd53f43aa54f22786d7776c7bc90320ec6f7a6501b168790be46ff69632"
-		logic_hash = "28f5b1a05d90745f432aee6bb9da3855d70b18d556153059794c5e53bbd5117c"
+		logic_hash = "v1_sha256_28f5b1a05d90745f432aee6bb9da3855d70b18d556153059794c5e53bbd5117c"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -65548,10 +65548,10 @@ rule ELASTIC_Windows_Generic_Threat_3C4D9Cbe : FILE MEMORY
 		date = "2024-01-31"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2396-L2414"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2396-L2414"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "21d01bd53f43aa54f22786d7776c7bc90320ec6f7a6501b168790be46ff69632"
-		logic_hash = "b32f9a3b86c60d4d69c59250ac59e93aee70ede890b059b13be999adbe043d2c"
+		logic_hash = "v1_sha256_b32f9a3b86c60d4d69c59250ac59e93aee70ede890b059b13be999adbe043d2c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65577,10 +65577,10 @@ rule ELASTIC_Windows_Generic_Threat_Deb82E8C : FILE MEMORY
 		date = "2024-01-31"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2416-L2435"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2416-L2435"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0f5791588a9898a3db29326785d31b52b524c3097370f6aa28564473d353cd38"
-		logic_hash = "c24baecab39c72f6bb30713022297cb9fb41ef5339a353702f3f780a630d5b27"
+		logic_hash = "v1_sha256_c24baecab39c72f6bb30713022297cb9fb41ef5339a353702f3f780a630d5b27"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -65607,10 +65607,10 @@ rule ELASTIC_Windows_Generic_Threat_278C589E : FILE MEMORY
 		date = "2024-01-31"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2437-L2455"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2437-L2455"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cccc6c1bf15a7d5725981de950475e272c277bc3b9d266c5debf0fc698770355"
-		logic_hash = "59bbbecd73541750f7221b12895ccf51e1a6863ceca62e23f541df904ad23587"
+		logic_hash = "v1_sha256_59bbbecd73541750f7221b12895ccf51e1a6863ceca62e23f541df904ad23587"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -65636,10 +65636,10 @@ rule ELASTIC_Windows_Generic_Threat_6B621667 : FILE MEMORY
 		date = "2024-01-31"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2457-L2475"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2457-L2475"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b50b39e460ecd7633a42f0856359088de20512c932fc35af6531ff48c9fa638a"
-		logic_hash = "3574b7ef24c4387a9919ed9831af7657047b26d8922ab78788619bbd3d0edd56"
+		logic_hash = "v1_sha256_3574b7ef24c4387a9919ed9831af7657047b26d8922ab78788619bbd3d0edd56"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65665,10 +65665,10 @@ rule ELASTIC_Windows_Generic_Threat_7693D7Fd : FILE MEMORY
 		date = "2024-02-13"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2477-L2495"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2477-L2495"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc40cc5d0bd3722126302f74ace414e6934eca3a8a5c63a11feada2130b34b89"
-		logic_hash = "886ad084f33faf8baae8a650a88095757c2cff9e18c8f5c50ff36120b43ec082"
+		logic_hash = "v1_sha256_886ad084f33faf8baae8a650a88095757c2cff9e18c8f5c50ff36120b43ec082"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65694,10 +65694,10 @@ rule ELASTIC_Windows_Generic_Threat_Df5De012 : FILE MEMORY
 		date = "2024-02-14"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2497-L2515"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2497-L2515"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "13c06d7b030a46c6bb6351f40184af9fafaf4c67b6a2627a45925dd17501d659"
-		logic_hash = "1a1ce3644c33a4591ab6582525366d47e07bdc2350aa6066ec5b5fedc605b037"
+		logic_hash = "v1_sha256_1a1ce3644c33a4591ab6582525366d47e07bdc2350aa6066ec5b5fedc605b037"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -65723,10 +65723,10 @@ rule ELASTIC_Windows_Generic_Threat_0E8530F5 : FILE MEMORY
 		date = "2024-02-14"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2517-L2536"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2517-L2536"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9f44d9acf79ed4450195223a9da185c0b0e8a8ea661d365a3ddea38f2732e2b8"
-		logic_hash = "f4a010366625c059151d3e704f6ece1808f367401729feaf6cc423cf4d5c5c60"
+		logic_hash = "v1_sha256_f4a010366625c059151d3e704f6ece1808f367401729feaf6cc423cf4d5c5c60"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -65753,10 +65753,10 @@ rule ELASTIC_Windows_Generic_Threat_Ba807E3E : FILE MEMORY
 		date = "2024-02-14"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2538-L2556"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2538-L2556"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cabd0633b37e6465ece334195ff4cc5c3f44cfe46211165efc07f4073aed1049"
-		logic_hash = "896eedb949eec6dff3e867ae3179b741382dd25ba06c6db452ac1ae5bc6bc757"
+		logic_hash = "v1_sha256_896eedb949eec6dff3e867ae3179b741382dd25ba06c6db452ac1ae5bc6bc757"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -65782,10 +65782,10 @@ rule ELASTIC_Windows_Generic_Threat_4578Ee8C : FILE MEMORY
 		date = "2024-02-14"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2558-L2576"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2558-L2576"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "699fecdb0bf27994d67492dc480f4ba1320acdd75e5881afbc5f73c982453fed"
-		logic_hash = "1a519bb84aae29057536ea09e53ff97cfe34a70c84ac6fa7d1ec173de3754f03"
+		logic_hash = "v1_sha256_1a519bb84aae29057536ea09e53ff97cfe34a70c84ac6fa7d1ec173de3754f03"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -65811,10 +65811,10 @@ rule ELASTIC_Windows_Generic_Threat_Ebf62328 : FILE MEMORY
 		date = "2024-02-14"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2578-L2598"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2578-L2598"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dfce19aa2e1a3e983c3bfb2e4bbd7617b96d57602d7a6da6fee7b282e354c9e1"
-		logic_hash = "e99b56dde761c5efad14f935befa4d1dbb31cd305b5d6af05a90d44dc3cd0098"
+		logic_hash = "v1_sha256_e99b56dde761c5efad14f935befa4d1dbb31cd305b5d6af05a90d44dc3cd0098"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -65842,10 +65842,10 @@ rule ELASTIC_Windows_Generic_Threat_Dcc622A4 : FILE MEMORY
 		date = "2024-02-14"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2600-L2618"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2600-L2618"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "94a3f10396c07783586070119becf0924de9a7caf449d6e07065837d54e6222d"
-		logic_hash = "9254226918f39389ccc347de1c5064552a8500ccef1884b8e27b6e98c651f45b"
+		logic_hash = "v1_sha256_9254226918f39389ccc347de1c5064552a8500ccef1884b8e27b6e98c651f45b"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -65871,10 +65871,10 @@ rule ELASTIC_Windows_Generic_Threat_046Aa1Ec : FILE MEMORY
 		date = "2024-02-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2620-L2638"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2620-L2638"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c74cf499fb9298d43a6e64930addb1f8a8d8336c796b9bc02ffc260684ec60a2"
-		logic_hash = "da6552da3db4851806f5a0ce3c324a79acf4ee4b2690cb02cc8d8c88a2ba28f8"
+		logic_hash = "v1_sha256_da6552da3db4851806f5a0ce3c324a79acf4ee4b2690cb02cc8d8c88a2ba28f8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65900,10 +65900,10 @@ rule ELASTIC_Windows_Generic_Threat_85C73807 : FILE MEMORY
 		date = "2024-02-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2640-L2658"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2640-L2658"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7f560a22c1f7511518656ac30350229f7a6847d26e1b3857e283f7dcee2604a0"
-		logic_hash = "90aa64f17b91ccdf367e1976cd1f5e89e15c7369a58b2d19187143e70939d756"
+		logic_hash = "v1_sha256_90aa64f17b91ccdf367e1976cd1f5e89e15c7369a58b2d19187143e70939d756"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65929,10 +65929,10 @@ rule ELASTIC_Windows_Generic_Threat_642Df623 : FILE MEMORY
 		date = "2024-02-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2660-L2678"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2660-L2678"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e5ba85d1a6a54df38b5fa655703c3457783f4a4f71e178f83d8aac878d4847da"
-		logic_hash = "555eb66f117312fa4ff3a49c0c40f89caddec3eb4b93d11bda2cce40529d46a0"
+		logic_hash = "v1_sha256_555eb66f117312fa4ff3a49c0c40f89caddec3eb4b93d11bda2cce40529d46a0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65958,10 +65958,10 @@ rule ELASTIC_Windows_Generic_Threat_27A2994F : FILE MEMORY
 		date = "2024-02-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2680-L2698"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2680-L2698"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e534914e06d90e119ce87f5abb446c57ec3473a29a7a9e7dc066fdc00dc68adc"
-		logic_hash = "66f34ba3052e2369528aeaf076f10d58f8f3dca420666246e02191fecb057f8c"
+		logic_hash = "v1_sha256_66f34ba3052e2369528aeaf076f10d58f8f3dca420666246e02191fecb057f8c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -65987,10 +65987,10 @@ rule ELASTIC_Windows_Generic_Threat_Dbceec58 : FILE MEMORY
 		date = "2024-02-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2700-L2718"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2700-L2718"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fbec30528e6f261aebf0d41f3cd6d35fcc937f1e20e1070f99b1b327f02b91e0"
-		logic_hash = "2a99fb7b342b43e3a4f0136d7d618625ca5708ae32e6fcabb11420bd8c89915b"
+		logic_hash = "v1_sha256_2a99fb7b342b43e3a4f0136d7d618625ca5708ae32e6fcabb11420bd8c89915b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66016,10 +66016,10 @@ rule ELASTIC_Windows_Generic_Threat_7407Eb79 : FILE MEMORY
 		date = "2024-02-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2720-L2738"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2720-L2738"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9ae0f053c8e2c4f4381eac8265170b79301d4a22ec1fdb86e5eb212c51a75d14"
-		logic_hash = "a60c3e54493f9dab71584ba301c41c43f30d554df8c0b05674995faaf407ee48"
+		logic_hash = "v1_sha256_a60c3e54493f9dab71584ba301c41c43f30d554df8c0b05674995faaf407ee48"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66045,10 +66045,10 @@ rule ELASTIC_Windows_Generic_Threat_3613Fa12 : FILE MEMORY
 		date = "2024-02-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2740-L2758"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2740-L2758"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1403ec99f262c964e3de133a10815e34d2f104b113b0197ab43c6b7b40b536c0"
-		logic_hash = "77b23aaf384de138214e64342e170f3dce667ee41c3063c999286da9af6fff42"
+		logic_hash = "v1_sha256_77b23aaf384de138214e64342e170f3dce667ee41c3063c999286da9af6fff42"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66074,10 +66074,10 @@ rule ELASTIC_Windows_Generic_Threat_B125Fff2 : FILE MEMORY
 		date = "2024-02-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2760-L2778"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2760-L2778"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9c641c0c8c2fd8831ee4e3b29a2a65f070b54775e64821c50b8ccd387e602097"
-		logic_hash = "054f3f36c688e1f5c3116e7a926df12df90f79dc1d42bee2616b5251f6ad2c24"
+		logic_hash = "v1_sha256_054f3f36c688e1f5c3116e7a926df12df90f79dc1d42bee2616b5251f6ad2c24"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66103,10 +66103,10 @@ rule ELASTIC_Windows_Generic_Threat_D7E5Ec2D : FILE MEMORY
 		date = "2024-02-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2780-L2798"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2780-L2798"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68"
-		logic_hash = "4edb8cc1da81e0b9b3a8facc9a9a7d1e27dff0d2db7851d06a209beec3ccb463"
+		logic_hash = "v1_sha256_4edb8cc1da81e0b9b3a8facc9a9a7d1e27dff0d2db7851d06a209beec3ccb463"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66132,10 +66132,10 @@ rule ELASTIC_Windows_Generic_Threat_1636C2Bf : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2800-L2818"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2800-L2818"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6e43916db43d8217214bbe4eb32ed3d82d0ac423cffc91d053a317a3dbe6dafb"
-		logic_hash = "c8b198cd5f9277ff3808ee2a313ab979d544b9e609d6623876d2e3c3c5668e38"
+		logic_hash = "v1_sha256_c8b198cd5f9277ff3808ee2a313ab979d544b9e609d6623876d2e3c3c5668e38"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66161,10 +66161,10 @@ rule ELASTIC_Windows_Generic_Threat_0A640296 : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2820-L2838"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2820-L2838"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3682eff62caaf2c90adef447d3ff48a3f9c34c571046f379d2eaf121976f1d07"
-		logic_hash = "743c47c7a58e7d65261818b4b444aaf8015b9b55d3e54526b1d63a8770a6c5aa"
+		logic_hash = "v1_sha256_743c47c7a58e7d65261818b4b444aaf8015b9b55d3e54526b1d63a8770a6c5aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66190,10 +66190,10 @@ rule ELASTIC_Windows_Generic_Threat_B1Ef4828 : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2840-L2859"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2840-L2859"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "29b20ff8ebad05e4a33c925251d08824ca155f5d9fa72d6f9e359e6ec6c61279"
-		logic_hash = "d5d63f38308c6f8e5ca54567c7c8b93fcde69601fbcc28d56d5231edd28163cf"
+		logic_hash = "v1_sha256_d5d63f38308c6f8e5ca54567c7c8b93fcde69601fbcc28d56d5231edd28163cf"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -66220,10 +66220,10 @@ rule ELASTIC_Windows_Generic_Threat_48Cbdc20 : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2861-L2880"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2861-L2880"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7a7704c64e64d3a1f76fc718d5b5a5e3d46beeeb62f0493f22e50865ddf66594"
-		logic_hash = "687d0f3dc85a7e4b23019deec59ee77c211101d40ed6622a952e69ebc4151483"
+		logic_hash = "v1_sha256_687d0f3dc85a7e4b23019deec59ee77c211101d40ed6622a952e69ebc4151483"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -66250,10 +66250,10 @@ rule ELASTIC_Windows_Generic_Threat_420E1Cdc : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2882-L2900"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2882-L2900"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b20254e03f7f1e79fec51d614ee0cfe0cb87432f3a53cf98cf8c047c13e2d774"
-		logic_hash = "6bd8a7bd4392e04d64f2e0b93d80978f59f9af634a0c971ca61cb9cb593743e0"
+		logic_hash = "v1_sha256_6bd8a7bd4392e04d64f2e0b93d80978f59f9af634a0c971ca61cb9cb593743e0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66279,10 +66279,10 @@ rule ELASTIC_Windows_Generic_Threat_4C37E16E : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2902-L2921"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2902-L2921"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d83a8ed5e192b3fe9d74f3a9966fa094d23676c7e6586c9240d97c252b8e4e74"
-		logic_hash = "dabac8aa6a3f4d4bd726161fc6573ca9de4088e7d818c3cf33cafc91f680e7aa"
+		logic_hash = "v1_sha256_dabac8aa6a3f4d4bd726161fc6573ca9de4088e7d818c3cf33cafc91f680e7aa"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -66309,10 +66309,10 @@ rule ELASTIC_Windows_Generic_Threat_5Be3A474 : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2923-L2941"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2923-L2941"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b902954d634307260d5bd8fb6248271f933c1cbc649aa2073bf05e79c1aedb66"
-		logic_hash = "0f0f46e3bdebb47a4f43ccb64d65ab1e15d68d38c117cb25e5723ec16e7e0758"
+		logic_hash = "v1_sha256_0f0f46e3bdebb47a4f43ccb64d65ab1e15d68d38c117cb25e5723ec16e7e0758"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66338,10 +66338,10 @@ rule ELASTIC_Windows_Generic_Threat_B191061E : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2943-L2961"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2943-L2961"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bd4ef6fae7f29def8e5894bf05057653248f009422de85c1e425d04a0b2df258"
-		logic_hash = "cbee10eab984249ceb9f8a82dc06aa014d6a249321f3d4f0d1e5657aab205ec8"
+		logic_hash = "v1_sha256_cbee10eab984249ceb9f8a82dc06aa014d6a249321f3d4f0d1e5657aab205ec8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66367,10 +66367,10 @@ rule ELASTIC_Windows_Generic_Threat_05F52E4D : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2963-L2981"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2963-L2981"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e578b795f8ed77c1057d8e6b827f7426fd4881f02949bfc83bcad11fa7eb2403"
-		logic_hash = "79898b59b6d3564aad85d823a1450600faff5b1d2dbfbe0cee4cc59971e4f542"
+		logic_hash = "v1_sha256_79898b59b6d3564aad85d823a1450600faff5b1d2dbfbe0cee4cc59971e4f542"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66396,10 +66396,10 @@ rule ELASTIC_Windows_Generic_Threat_C34E19E9 : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L2983-L3001"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L2983-L3001"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f9048348a59d9f824b45b16b1fdba9bfeda513aa9fbe671442f84b81679232db"
-		logic_hash = "87999b6f2cf359b6436ee7e57691ac73fc41f3947bf8fef3f6b98148e17f180d"
+		logic_hash = "v1_sha256_87999b6f2cf359b6436ee7e57691ac73fc41f3947bf8fef3f6b98148e17f180d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66425,10 +66425,10 @@ rule ELASTIC_Windows_Generic_Threat_E691Eaa1 : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3003-L3021"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3003-L3021"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "afa5f36860e69b9134b93e9ad32fed0a5923772e701437e1054ea98e76f28a77"
-		logic_hash = "0ac310e3f7cf99b77c2dcfea582752e2f1414caf43965c25d2f3f03cf27586cc"
+		logic_hash = "v1_sha256_0ac310e3f7cf99b77c2dcfea582752e2f1414caf43965c25d2f3f03cf27586cc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66454,10 +66454,10 @@ rule ELASTIC_Windows_Generic_Threat_5E33Bb4B : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3023-L3041"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3023-L3041"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "13c06d7b030a46c6bb6351f40184af9fafaf4c67b6a2627a45925dd17501d659"
-		logic_hash = "7e2002c3917ccab7d9f56a7aa20ea75be71aa7fdc64b7c3f87edb68be38e74b2"
+		logic_hash = "v1_sha256_7e2002c3917ccab7d9f56a7aa20ea75be71aa7fdc64b7c3f87edb68be38e74b2"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -66483,10 +66483,10 @@ rule ELASTIC_Windows_Generic_Threat_Be64Ba10 : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3043-L3062"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3043-L3062"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "24bb4fc117aa57fd170e878263973a392d094c94d3a5f651fad7528d5d73b58a"
-		logic_hash = "c6acce53610baf119a0e2d55fc698a976463bbd21b739d4ac39a75383fa5fed2"
+		logic_hash = "v1_sha256_c6acce53610baf119a0e2d55fc698a976463bbd21b739d4ac39a75383fa5fed2"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -66513,10 +66513,10 @@ rule ELASTIC_Windows_Generic_Threat_7Bb75582 : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3064-L3082"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3064-L3082"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "35f9698e9b9f611b3dd92466f18f97f4a8b4506ed6f10d4ac84303177f43522d"
-		logic_hash = "d959f755d28782b332248085034950a8d4cad3cde13b22254c90ca3952919e1b"
+		logic_hash = "v1_sha256_d959f755d28782b332248085034950a8d4cad3cde13b22254c90ca3952919e1b"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -66542,10 +66542,10 @@ rule ELASTIC_Windows_Generic_Threat_59698796 : FILE MEMORY
 		date = "2024-03-04"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3084-L3102"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3084-L3102"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "35f9698e9b9f611b3dd92466f18f97f4a8b4506ed6f10d4ac84303177f43522d"
-		logic_hash = "59569049dbb09b7e15110fb8de1a146eb7fd606f116b4dd6c75ca973fb62296e"
+		logic_hash = "v1_sha256_59569049dbb09b7e15110fb8de1a146eb7fd606f116b4dd6c75ca973fb62296e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66571,10 +66571,10 @@ rule ELASTIC_Windows_Generic_Threat_2Ae9B09E : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3104-L3122"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3104-L3122"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dc8f4784c368676cd411b7d618407c416d9e56d116dd3cd17c3f750e6cb60c40"
-		logic_hash = "183249214e5f8143eb91caf20778b870d17d7a52b6d71ad603827e8716e7e447"
+		logic_hash = "v1_sha256_183249214e5f8143eb91caf20778b870d17d7a52b6d71ad603827e8716e7e447"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66600,10 +66600,10 @@ rule ELASTIC_Windows_Generic_Threat_604A8763 : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3124-L3142"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3124-L3142"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2a51fb11032ec011448184a4f2837d05638a7673d16dcf5dcf4005de3f87883a"
-		logic_hash = "cf88c0d102680fc7c16d49b6e8dc49c16b27d5940edf078e667a45e70ebe3883"
+		logic_hash = "v1_sha256_cf88c0d102680fc7c16d49b6e8dc49c16b27d5940edf078e667a45e70ebe3883"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66629,10 +66629,10 @@ rule ELASTIC_Windows_Generic_Threat_F45B3F09 : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3144-L3162"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3144-L3162"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "577f1dbd76030c7e44ed28c748551691d446e268189af94e1fa1545f06395178"
-		logic_hash = "9b01ad1271cc5052a793e5a885aa7289cbaea4a928f60d64194477c3036496ed"
+		logic_hash = "v1_sha256_9b01ad1271cc5052a793e5a885aa7289cbaea4a928f60d64194477c3036496ed"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66658,10 +66658,10 @@ rule ELASTIC_Windows_Generic_Threat_3F390999 : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3164-L3182"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3164-L3182"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1b6fc4eaef3515058f85551e7e5dffb68b9a0550cd7f9ebcbac158dac9ababf1"
-		logic_hash = "462a7a38ebbb39515ac2c0a10353660d0cadcfb99360adcd200edc1db5a716ba"
+		logic_hash = "v1_sha256_462a7a38ebbb39515ac2c0a10353660d0cadcfb99360adcd200edc1db5a716ba"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66687,10 +66687,10 @@ rule ELASTIC_Windows_Generic_Threat_Abd1C09D : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3184-L3202"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3184-L3202"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ff09d2352c2163465d8c86f94baa25ba85c35698a5e3fbc52bc95afc06b7e85"
-		logic_hash = "80e6f317e5cd91cb3819e9251efc8c96218071bec577a38c8784826dd4a657cb"
+		logic_hash = "v1_sha256_80e6f317e5cd91cb3819e9251efc8c96218071bec577a38c8784826dd4a657cb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66716,10 +66716,10 @@ rule ELASTIC_Windows_Generic_Threat_B7870213 : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3204-L3222"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3204-L3222"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "04cb0d5eecea673acc575e54439398cc00e78cc54d8f43c4b9bc353e4fc4430d"
-		logic_hash = "79b8385543def42259cd9c09d4d7059ff6bb02a9e87cff1bc0a8861e3b333c5f"
+		logic_hash = "v1_sha256_79b8385543def42259cd9c09d4d7059ff6bb02a9e87cff1bc0a8861e3b333c5f"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -66745,10 +66745,10 @@ rule ELASTIC_Windows_Generic_Threat_2Bba6Bae : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3224-L3242"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3224-L3242"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d9955c716371422750b77d64256dade6fbd028c8d965db05c0d889d953480373"
-		logic_hash = "59e4b173c21b0ab161adf8d89f253f21403bca706b6bf40b3da00697f87dd509"
+		logic_hash = "v1_sha256_59e4b173c21b0ab161adf8d89f253f21403bca706b6bf40b3da00697f87dd509"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -66774,10 +66774,10 @@ rule ELASTIC_Windows_Generic_Threat_4Db75701 : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3244-L3262"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3244-L3262"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fa7847d21d5a350cf96d7ecbcf13dce63e6a0937971cfb479700c5b31850bba9"
-		logic_hash = "65f7d15ed551e069b30ce6c0a5f15d01d24b8b29727950269c9956fcf6dc799d"
+		logic_hash = "v1_sha256_65f7d15ed551e069b30ce6c0a5f15d01d24b8b29727950269c9956fcf6dc799d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66803,10 +66803,10 @@ rule ELASTIC_Windows_Generic_Threat_54A914C9 : FILE MEMORY
 		date = "2024-03-25"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3264-L3282"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3264-L3282"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c418c5ad8030985bb5067cda61caba3b7a0d24cb8d3f93fc09d452fbdf4174ec"
-		logic_hash = "0cc3797564b4c722423f915493e07b0e0fec3085e7a535f9914f82d73c797bed"
+		logic_hash = "v1_sha256_0cc3797564b4c722423f915493e07b0e0fec3085e7a535f9914f82d73c797bed"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66832,10 +66832,10 @@ rule ELASTIC_Windows_Generic_Threat_38A88967 : FILE MEMORY
 		date = "2024-03-25"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3284-L3302"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3284-L3302"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6e425eb1a27c4337f05d12992e33fe0047e30259380002797639d51ef9509739"
-		logic_hash = "ddbdb1c39a07141d83173504214c889aff75487570d906413ebc6f262fedf9ae"
+		logic_hash = "v1_sha256_ddbdb1c39a07141d83173504214c889aff75487570d906413ebc6f262fedf9ae"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66861,10 +66861,10 @@ rule ELASTIC_Windows_Generic_Threat_E8Abb835 : FILE MEMORY
 		date = "2024-03-26"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3304-L3322"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3304-L3322"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e42262671325bec300afa722cefb584e477c3f2782c8d4c6402d6863df348cac"
-		logic_hash = "0ad56b8c741a79a600a0d5588c4e8760a6d19fef72ff7814a00cfb84a90f23aa"
+		logic_hash = "v1_sha256_0ad56b8c741a79a600a0d5588c4e8760a6d19fef72ff7814a00cfb84a90f23aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66890,10 +66890,10 @@ rule ELASTIC_Windows_Generic_Threat_492D7223 : FILE MEMORY
 		date = "2024-03-26"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3324-L3342"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3324-L3342"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0d9c9297836aceb4400bcb0877d1df90ca387f18f735de195852a909c67b7ef"
-		logic_hash = "9fb2a00def86ed8476d906514a0bc630e28093ac37d757541d8801d2c8e0efc3"
+		logic_hash = "v1_sha256_9fb2a00def86ed8476d906514a0bc630e28093ac37d757541d8801d2c8e0efc3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66919,10 +66919,10 @@ rule ELASTIC_Windows_Generic_Threat_Ea296356 : FILE MEMORY
 		date = "2024-05-22"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3344-L3362"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3344-L3362"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4c48a0fe90f3da7bfdd32961da7771a0124b77e1ac1910168020babe8143e959"
-		logic_hash = "73ffd16f0047cd57311853aa9083fc21427f2eb21646c6edc7b8def86da90f90"
+		logic_hash = "v1_sha256_73ffd16f0047cd57311853aa9083fc21427f2eb21646c6edc7b8def86da90f90"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66948,10 +66948,10 @@ rule ELASTIC_Windows_Generic_Threat_Aeaeb5Cf : FILE MEMORY
 		date = "2024-05-22"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3364-L3382"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3364-L3382"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f57d955d485904f0c729acff9db1de9cb42f32af993393d58538f07fa273b431"
-		logic_hash = "640966296bad70234e0fe7b6f87b92fcf4fc111189d307d44f32e926785f76cb"
+		logic_hash = "v1_sha256_640966296bad70234e0fe7b6f87b92fcf4fc111189d307d44f32e926785f76cb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -66977,10 +66977,10 @@ rule ELASTIC_Windows_Generic_Threat_C8424507 : FILE MEMORY
 		date = "2024-05-22"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3384-L3403"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3384-L3403"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d556b02733385b823cfe4db7e562e90aa520e2e6fb00fceb76cc0a6a1ff47692"
-		logic_hash = "78d56257cb6e1d67f9343ee30b844fe20138e27ca3b6312a07112e5dbb797851"
+		logic_hash = "v1_sha256_78d56257cb6e1d67f9343ee30b844fe20138e27ca3b6312a07112e5dbb797851"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -67007,10 +67007,10 @@ rule ELASTIC_Windows_Generic_Threat_9Af87Ddb : FILE MEMORY
 		date = "2024-05-23"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3405-L3423"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3405-L3423"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b1fbc11744e21dc08599412887a3a966572614ce25ccd3c8c98f04bcbdda3898"
-		logic_hash = "99174c5740324d7704a5c6ae924254f9b5f241c97901dfdb771fc176a76e4a30"
+		logic_hash = "v1_sha256_99174c5740324d7704a5c6ae924254f9b5f241c97901dfdb771fc176a76e4a30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67036,10 +67036,10 @@ rule ELASTIC_Windows_Generic_Threat_D7B57912 : FILE MEMORY
 		date = "2024-05-23"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3425-L3443"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3425-L3443"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0906599be152dd598c7f540498c44cc38efe9ea976731da05137ee6520288fe4"
-		logic_hash = "a774e3030d81e29805a9784cfbbc0b69c4fedebe0daa25e403777e1f46f9094f"
+		logic_hash = "v1_sha256_a774e3030d81e29805a9784cfbbc0b69c4fedebe0daa25e403777e1f46f9094f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67065,10 +67065,10 @@ rule ELASTIC_Windows_Generic_Threat_23D33B48 : FILE MEMORY
 		date = "2024-06-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3445-L3463"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3445-L3463"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "acbc22df07888498ae6f52f5458e3fb8e0682e443a8c2bc97177a0320b4e2098"
-		logic_hash = "c9fb93bb74e4d45197d0da5b641860738a42a583b15cc098e86ea79bb8690bf7"
+		logic_hash = "v1_sha256_c9fb93bb74e4d45197d0da5b641860738a42a583b15cc098e86ea79bb8690bf7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67094,10 +67094,10 @@ rule ELASTIC_Windows_Generic_Threat_4B0B73Ce : FILE MEMORY
 		date = "2024-06-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3465-L3483"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3465-L3483"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "236fc00cd7c75f70904239935ab90f51b03ff347798f56cec1bdd73a286b24c1"
-		logic_hash = "d53923df612dd7fe0b1b2c94c1c5d747b08723df129089326ec27c5049769cef"
+		logic_hash = "v1_sha256_d53923df612dd7fe0b1b2c94c1c5d747b08723df129089326ec27c5049769cef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67123,10 +67123,10 @@ rule ELASTIC_Windows_Generic_Threat_1F2E969C : FILE MEMORY
 		date = "2024-06-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3485-L3503"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3485-L3503"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7def75df729ed66511fbe91eadf15bc69a03618e78c48e27c35497db2a6a97ae"
-		logic_hash = "7d984a902f9bf40c9b49da89aba9249f80b41b24ca1cdb6189f541b40ef41742"
+		logic_hash = "v1_sha256_7d984a902f9bf40c9b49da89aba9249f80b41b24ca1cdb6189f541b40ef41742"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67152,10 +67152,10 @@ rule ELASTIC_Windows_Generic_Threat_27C975Fd : FILE MEMORY
 		date = "2024-10-10"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3505-L3523"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3505-L3523"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0108af363959f90919f24220caf426fba50be3d61f3735bb0f2acbbcc1f56e0c"
-		logic_hash = "f4c500331ce0857b17970206fae4f8501c6f3a65824f37b6cdde47d0a03ceb78"
+		logic_hash = "v1_sha256_f4c500331ce0857b17970206fae4f8501c6f3a65824f37b6cdde47d0a03ceb78"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67181,10 +67181,10 @@ rule ELASTIC_Windows_Generic_Threat_D170474C : FILE MEMORY
 		date = "2024-10-10"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3525-L3543"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3525-L3543"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "63da7ea6d4cd240485ad5c546dd60b90cb98d6f4f18df4bc708f5ec689be952f"
-		logic_hash = "45089557acec0549acc3f5856c4eef89543ed048984474718376a73085edcb08"
+		logic_hash = "v1_sha256_45089557acec0549acc3f5856c4eef89543ed048984474718376a73085edcb08"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67210,10 +67210,10 @@ rule ELASTIC_Windows_Generic_Threat_F57E5E2A : FILE MEMORY
 		date = "2024-10-10"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3545-L3563"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3545-L3563"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bff5112830cc3547c206fb1d028c592a11a3c7cd457ef445b765af86a1e76001"
-		logic_hash = "ce972e45f87792599b0800883e848221b0c2c99c9a0432659c655903f530e852"
+		logic_hash = "v1_sha256_ce972e45f87792599b0800883e848221b0c2c99c9a0432659c655903f530e852"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67239,10 +67239,10 @@ rule ELASTIC_Windows_Generic_Threat_4Fe0Deb6 : FILE MEMORY
 		date = "2024-10-10"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3565-L3583"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3565-L3583"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5836ef66985e851b37a369b04cce579afdb3b241d46a096bf8b1e8d4df053cd2"
-		logic_hash = "7737c264c98a0256c0a0075ab6b2e9525550e0ef60fd64a6c50cf8075639e96c"
+		logic_hash = "v1_sha256_7737c264c98a0256c0a0075ab6b2e9525550e0ef60fd64a6c50cf8075639e96c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67268,10 +67268,10 @@ rule ELASTIC_Windows_Generic_Threat_C9003B7B : FILE MEMORY
 		date = "2024-10-10"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3585-L3603"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3585-L3603"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ff2a1def8c4fae4166e249edab62d73f44ba3c05d5e3c9fda11399bfe1fcee6c"
-		logic_hash = "deac86398c04c462d4aa3361c911acec99d422e2ce995ba82fc3e8fe9772c33b"
+		logic_hash = "v1_sha256_deac86398c04c462d4aa3361c911acec99d422e2ce995ba82fc3e8fe9772c33b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67297,10 +67297,10 @@ rule ELASTIC_Windows_Generic_Threat_21253888 : FILE MEMORY
 		date = "2024-10-11"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3605-L3623"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3605-L3623"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "95e523f4003a10a906ef7c68a258d402e25f235fa9f2b022faff7cae41185b9c"
-		logic_hash = "121fc74ff09ebd9f2d6eda370b6fa6b5137e0ae59cf6d6f8f18d13e1cc053e15"
+		logic_hash = "v1_sha256_121fc74ff09ebd9f2d6eda370b6fa6b5137e0ae59cf6d6f8f18d13e1cc053e15"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -67326,10 +67326,10 @@ rule ELASTIC_Windows_Generic_Threat_06Dcb833 : FILE MEMORY
 		date = "2024-10-11"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3625-L3643"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3625-L3643"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f7fde85aefb7123ef805c85394907ef73e0983499b49f2290a83aa2b0a2e5e9d"
-		logic_hash = "cbddf2b858278ad4a9330dac767f0a0bc7691cbf6a93ac389f48cb2286c8cbdc"
+		logic_hash = "v1_sha256_cbddf2b858278ad4a9330dac767f0a0bc7691cbf6a93ac389f48cb2286c8cbdc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67355,10 +67355,10 @@ rule ELASTIC_Windows_Generic_Threat_5435Fe36 : FILE MEMORY
 		date = "2024-10-11"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3645-L3663"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3645-L3663"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8c0e26af4f9c783844ea457c3eb7bb2bbe1bf3f860ce180bacab00456f3ae7c1"
-		logic_hash = "7295e8addf2dcd6192eab261d7a2ca817006a3962dd2e792f51154495be54298"
+		logic_hash = "v1_sha256_7295e8addf2dcd6192eab261d7a2ca817006a3962dd2e792f51154495be54298"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67384,10 +67384,10 @@ rule ELASTIC_Windows_Generic_Threat_491A8310 : FILE MEMORY
 		date = "2024-10-11"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3665-L3683"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3665-L3683"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "59c6846b4676378d9c80d7ced825f0463d1b333546bfcad919ee262cbf6db250"
-		logic_hash = "45b1017a7ba8d5dc321ac018613587c371380a3340f6893a046a6bdc8a1d2431"
+		logic_hash = "v1_sha256_45b1017a7ba8d5dc321ac018613587c371380a3340f6893a046a6bdc8a1d2431"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67413,10 +67413,10 @@ rule ELASTIC_Windows_Generic_Threat_2F726F2D : FILE MEMORY
 		date = "2024-10-11"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Generic_Threat.yar#L3685-L3703"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Generic_Threat.yar#L3685-L3703"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ede9bd928a216c9844f290be0de6985ed54dceaff041906dca3a3468293464b6"
-		logic_hash = "41314d0685f957a3cdfa37f8f2275ab19137da289c57069b8d3a3e40e4b802e7"
+		logic_hash = "v1_sha256_41314d0685f957a3cdfa37f8f2275ab19137da289c57069b8d3a3e40e4b802e7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67442,10 +67442,10 @@ rule ELASTIC_Linux_Trojan_Mobidash_52A15A93 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "ceaf5b06108baa6043e31010d777099ed6ac9b4054e86d41309bd7c2b0ffda11"
+		logic_hash = "v1_sha256_ceaf5b06108baa6043e31010d777099ed6ac9b4054e86d41309bd7c2b0ffda11"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67471,10 +67471,10 @@ rule ELASTIC_Linux_Trojan_Mobidash_D0Ad9C82 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "8351cb61f5b712c65962e734a7c29271fa4805720e14b6badc9bc1c0364778f8"
+		logic_hash = "v1_sha256_8351cb61f5b712c65962e734a7c29271fa4805720e14b6badc9bc1c0364778f8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67500,10 +67500,10 @@ rule ELASTIC_Linux_Trojan_Mobidash_E2C89606 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "64cb8d8ec04a53f663b216208279afba3c10f148fe99822f9a45100a4f73ed28"
+		logic_hash = "v1_sha256_64cb8d8ec04a53f663b216208279afba3c10f148fe99822f9a45100a4f73ed28"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67529,9 +67529,9 @@ rule ELASTIC_Linux_Trojan_Mobidash_82B4E3F3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L61-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8c91f85bc807605a3233d28a5eb8b6e1cf847fb288cbc4427e86226eed7a2055"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L61-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8c91f85bc807605a3233d28a5eb8b6e1cf847fb288cbc4427e86226eed7a2055"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67557,10 +67557,10 @@ rule ELASTIC_Linux_Trojan_Mobidash_601352Dc : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5714e130075f4780e025fb3810f58a63e618659ac34d12abe211a1b6f2f80269"
-		logic_hash = "adeeea73b711fc867b88775c06a14011380118ed85691660ba771381e51160e3"
+		logic_hash = "v1_sha256_adeeea73b711fc867b88775c06a14011380118ed85691660ba771381e51160e3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67586,9 +67586,9 @@ rule ELASTIC_Linux_Trojan_Mobidash_Ddca1181 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L100-L117"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "076d4ac69f6bc29975b22e19d429c25ef357443ec8fcaf5165e0a8069112af74"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L100-L117"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_076d4ac69f6bc29975b22e19d429c25ef357443ec8fcaf5165e0a8069112af74"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67614,10 +67614,10 @@ rule ELASTIC_Linux_Trojan_Mobidash_65E666C0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L119-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L119-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "19f9b5382d3e8e604be321aefd47cb72c2337a170403613b853307c266d065dd"
-		logic_hash = "2d2bec8f89986b19bf1c806b6654405ac6523f49aeafd759b7631d9587d780c8"
+		logic_hash = "v1_sha256_2d2bec8f89986b19bf1c806b6654405ac6523f49aeafd759b7631d9587d780c8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67643,10 +67643,10 @@ rule ELASTIC_Linux_Trojan_Mobidash_494D5B0F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L139-L157"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L139-L157"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7e08df5279f4d22f1f27553946b0dadd60bb8242d522a8dceb45ab7636433c2f"
-		logic_hash = "6ddb94f9f44fe749a442592d491343a99bd870ea2d79596631d857516425e72b"
+		logic_hash = "v1_sha256_6ddb94f9f44fe749a442592d491343a99bd870ea2d79596631d857516425e72b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67672,10 +67672,10 @@ rule ELASTIC_Linux_Trojan_Mobidash_Bb4F7F39 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L159-L177"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L159-L177"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "33e8fcbb29cc38b4a8365845eb3a1488e13be964f7383b28a158a98fb259acb4"
+		logic_hash = "v1_sha256_33e8fcbb29cc38b4a8365845eb3a1488e13be964f7383b28a158a98fb259acb4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67701,9 +67701,9 @@ rule ELASTIC_Linux_Trojan_Mobidash_8679E1Cb : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L179-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "6055ac4800397f6582e60cdf15fa74584986e1e7cf49a541b0ec746445834819"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L179-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_6055ac4800397f6582e60cdf15fa74584986e1e7cf49a541b0ec746445834819"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67729,9 +67729,9 @@ rule ELASTIC_Linux_Trojan_Mobidash_29B86E6A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L198-L215"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "dd5f44249cc4c91f39a0e7d0b236ebeed8f78d5fcb03c7ebc80ef1c738b18336"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L198-L215"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_dd5f44249cc4c91f39a0e7d0b236ebeed8f78d5fcb03c7ebc80ef1c738b18336"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67757,10 +67757,10 @@ rule ELASTIC_Linux_Trojan_Mobidash_E3086563 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L217-L235"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L217-L235"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "5545f7ce8fa45dc56bc4bb5140ce1db527997dfaa1dd2bbb1e4a12af45300065"
+		logic_hash = "v1_sha256_5545f7ce8fa45dc56bc4bb5140ce1db527997dfaa1dd2bbb1e4a12af45300065"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67786,10 +67786,10 @@ rule ELASTIC_Linux_Trojan_Mobidash_2F114992 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mobidash.yar#L237-L255"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mobidash.yar#L237-L255"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "f93fe72e08c8ec135cccc8cdab2ecedbb694e9ad39f2572d060864bb3290e25c"
+		logic_hash = "v1_sha256_f93fe72e08c8ec135cccc8cdab2ecedbb694e9ad39f2572d060864bb3290e25c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67815,10 +67815,10 @@ rule ELASTIC_Windows_Trojan_Xtremerat_Cd5B60Be : FILE MEMORY
 		date = "2022-03-15"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_XtremeRAT.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_XtremeRAT.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "735f7bf255bdc5ce8e69259c8e24164e5364aeac3ee78782b7b5275c1d793da8"
-		logic_hash = "a6997ae4842bd45c440925ef2a5848b57c58e2373c0971ce6b328ea297ee97b4"
+		logic_hash = "v1_sha256_a6997ae4842bd45c440925ef2a5848b57c58e2373c0971ce6b328ea297ee97b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67842,7 +67842,7 @@ rule ELASTIC_Windows_Trojan_Xtremerat_Cd5B60Be : FILE MEMORY
 		$s10 = "shellexecute=" wide fullword
 
 	condition:
-		7 of ($s*)
+		7 of ( $s* )
 }
 rule ELASTIC_Windows_Trojan_Bughatch_21269Be4 : FILE MEMORY
 {
@@ -67853,10 +67853,10 @@ rule ELASTIC_Windows_Trojan_Bughatch_21269Be4 : FILE MEMORY
 		date = "2022-05-09"
 		modified = "2022-06-09"
 		reference = "https://www.elastic.co/security-labs/bughatch-malware-analysis"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bughatch.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bughatch.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f"
-		logic_hash = "a8a2cae51a31e48ffe729df61ec96e3257f9c997ad5234075f85ed55de96f11d"
+		logic_hash = "v1_sha256_a8a2cae51a31e48ffe729df61ec96e3257f9c997ad5234075f85ed55de96f11d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67884,10 +67884,10 @@ rule ELASTIC_Windows_Trojan_Bughatch_98F3C0Be : FILE MEMORY
 		date = "2022-05-09"
 		modified = "2022-06-09"
 		reference = "https://www.elastic.co/security-labs/bughatch-malware-analysis"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bughatch.yar#L24-L51"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bughatch.yar#L24-L51"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f"
-		logic_hash = "d578515fece7bd464bb09cc5ddb5caf70f4022e8b10388db689e67e662d57f66"
+		logic_hash = "v1_sha256_d578515fece7bd464bb09cc5ddb5caf70f4022e8b10388db689e67e662d57f66"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67921,10 +67921,10 @@ rule ELASTIC_Linux_Hacktool_Cleanlog_C2907D77 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Cleanlog.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Cleanlog.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "613ac236130ab1654f051d6f0661fa62414f3bef036ea4cc585b4b21a4bb9d2b"
-		logic_hash = "39b72973bbcddf14604b8ea08339657cba317c23fd4d69d4aa0903b262397988"
+		logic_hash = "v1_sha256_39b72973bbcddf14604b8ea08339657cba317c23fd4d69d4aa0903b262397988"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67950,10 +67950,10 @@ rule ELASTIC_Linux_Hacktool_Cleanlog_3Eb725D1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Cleanlog.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Cleanlog.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4df4ebcc61ab2cdb8e5112eeb4e2f29e4e841048de43d7426b1ec11afe175bf6"
-		logic_hash = "a9530aca53d935f3e77a5f0fc332db16e3a2832be67c067e5a6d18e7ec00e39f"
+		logic_hash = "v1_sha256_a9530aca53d935f3e77a5f0fc332db16e3a2832be67c067e5a6d18e7ec00e39f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -67979,10 +67979,10 @@ rule ELASTIC_Linux_Hacktool_Cleanlog_400B7595 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Cleanlog.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Cleanlog.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4df4ebcc61ab2cdb8e5112eeb4e2f29e4e841048de43d7426b1ec11afe175bf6"
-		logic_hash = "e36acf708875efda88143124e11fef5b0e2f99d17b0c49344db969cf0d454db1"
+		logic_hash = "v1_sha256_e36acf708875efda88143124e11fef5b0e2f99d17b0c49344db969cf0d454db1"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -68008,10 +68008,10 @@ rule ELASTIC_Linux_Trojan_Ddostf_E4874Cd4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ddostf.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ddostf.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
-		logic_hash = "1523fe8f7bbbc7e42f8c2efe5b28dd381007846a1ba7078a6f1a30aedace884b"
+		logic_hash = "v1_sha256_1523fe8f7bbbc7e42f8c2efe5b28dd381007846a1ba7078a6f1a30aedace884b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68037,9 +68037,9 @@ rule ELASTIC_Linux_Trojan_Ddostf_32C35334 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ddostf.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d62d450d48756c09f8788b27301de889c864e597924a0526a325fa602f91f376"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ddostf.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d62d450d48756c09f8788b27301de889c864e597924a0526a325fa602f91f376"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68065,10 +68065,10 @@ rule ELASTIC_Linux_Trojan_Ddostf_6Dc1Caab : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ddostf.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ddostf.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f4587bd45e57d4106ebe502d2eaa1d97fd68613095234038d67490e74c62ba70"
-		logic_hash = "fd70960ed6e06f4d152bbd211fbe491dad596010da12cd53c93b577b551b8053"
+		logic_hash = "v1_sha256_fd70960ed6e06f4d152bbd211fbe491dad596010da12cd53c93b577b551b8053"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68094,10 +68094,10 @@ rule ELASTIC_Linux_Trojan_Ddostf_Dc47A873 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ddostf.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ddostf.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
-		logic_hash = "2f5bd9e012fd778388074cf29b56c7cd59391840f994835d087b7b661445d316"
+		logic_hash = "v1_sha256_2f5bd9e012fd778388074cf29b56c7cd59391840f994835d087b7b661445d316"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68123,10 +68123,10 @@ rule ELASTIC_Linux_Trojan_Ddostf_Cb0358A0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ddostf.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ddostf.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
-		logic_hash = "1f152b69bf0b2bfa539fdd42c432e456b9efb3766a450333a987313bb12c1826"
+		logic_hash = "v1_sha256_1f152b69bf0b2bfa539fdd42c432e456b9efb3766a450333a987313bb12c1826"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68152,10 +68152,10 @@ rule ELASTIC_Windows_Hacktool_Sharpup_E5C87C9A : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpUp.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpUp.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "45e92b991b3633b446473115f97366d9f35acd446d00cd4a05981a056660ad27"
-		logic_hash = "62e9aafd308aacbc7a124c707e230c5a9ffde4f6929a5feada5497e3eae7668c"
+		logic_hash = "v1_sha256_62e9aafd308aacbc7a124c707e230c5a9ffde4f6929a5feada5497e3eae7668c"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -68176,7 +68176,7 @@ rule ELASTIC_Windows_Hacktool_Sharpup_E5C87C9A : FILE MEMORY
 		$print_str3 = "Registry AutoLogon Found" ascii wide
 
 	condition:
-		$guid or ( all of ($str*) and 1 of ($print_str*))
+		$guid or ( all of ( $str* ) and 1 of ( $print_str* ) )
 }
 rule ELASTIC_Linux_Cryptominer_Casdet_5D0D33Be : FILE MEMORY
 {
@@ -68187,10 +68187,10 @@ rule ELASTIC_Linux_Cryptominer_Casdet_5D0D33Be : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Casdet.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Casdet.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4b09115c876a8b610e1941c768100e03c963c76b250fdd5b12a74253ef9e5fb6"
-		logic_hash = "e3264f614e257d853070907866b838d1cb53c1f60f7a0123ec503f1d540a15d7"
+		logic_hash = "v1_sha256_e3264f614e257d853070907866b838d1cb53c1f60f7a0123ec503f1d540a15d7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68216,10 +68216,10 @@ rule ELASTIC_Windows_Hacktool_Coffloader_81Ba13B8 : FILE MEMORY
 		date = "2024-04-22"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_COFFLoader.yar#L1-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_COFFLoader.yar#L1-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c2e03659eb1594dc958e01344cfa9ba126d66736b089db5e3dd1b1c3e3e7d2f7"
-		logic_hash = "d4f061af200a0ae9f3276fd6dfcb09ecdf662f29b7c43ea47c69a53d9fe66793"
+		logic_hash = "v1_sha256_d4f061af200a0ae9f3276fd6dfcb09ecdf662f29b7c43ea47c69a53d9fe66793"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -68258,7 +68258,7 @@ rule ELASTIC_Windows_Hacktool_Coffloader_81Ba13B8 : FILE MEMORY
 		$b2 = "COFFLoader.x86.dll"
 
 	condition:
-		5 of ($a*) or 1 of ($b*)
+		5 of ( $a* ) or 1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Nimplant_44Ff3211 : FILE MEMORY
 {
@@ -68269,10 +68269,10 @@ rule ELASTIC_Windows_Trojan_Nimplant_44Ff3211 : FILE MEMORY
 		date = "2023-06-23"
 		modified = "2023-07-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Nimplant.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Nimplant.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b56e20384f98e1d2417bb7dcdbfb375987dd075911b74ea7ead082494836b8f4"
-		logic_hash = "ee519d8d722404ed440b385d283a41921bc34ee11f0e7273cdc074b377494c39"
+		logic_hash = "v1_sha256_ee519d8d722404ed440b385d283a41921bc34ee11f0e7273cdc074b377494c39"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68300,10 +68300,10 @@ rule ELASTIC_Linux_Exploit_Wuftpd_0991E62F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Wuftpd.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Wuftpd.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0b6303300f38013840abe17abe192db6a99ace78c83bc7ef705f5c568bc98fd"
-		logic_hash = "71ad26a182c7f16e7e0ad7f7afe0dcf1d38fe953dc0806341d7e21ee4acea87d"
+		logic_hash = "v1_sha256_71ad26a182c7f16e7e0ad7f7afe0dcf1d38fe953dc0806341d7e21ee4acea87d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68329,10 +68329,10 @@ rule ELASTIC_Windows_Hacktool_Capcom_7Abae448 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Capcom.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Capcom.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24"
-		logic_hash = "88f25c479cc8970e05ef9d08143afbbbfa17322f34379ba571e3a09105b33ee0"
+		logic_hash = "v1_sha256_88f25c479cc8970e05ef9d08143afbbbfa17322f34379ba571e3a09105b33ee0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -68348,7 +68348,7 @@ rule ELASTIC_Windows_Hacktool_Capcom_7Abae448 : FILE
 		$subject_name = { 06 03 55 04 03 [2] 43 41 50 43 4F 4D 20 43 6F 2E 2C 4C 74 64 2E }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $subject_name
 }
 rule ELASTIC_Windows_Trojan_Latrodectus_841Ff697 : FILE MEMORY
 {
@@ -68359,10 +68359,10 @@ rule ELASTIC_Windows_Trojan_Latrodectus_841Ff697 : FILE MEMORY
 		date = "2024-03-13"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Latrodectus.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Latrodectus.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c"
-		logic_hash = "aa1a4813a18b4eb4f07e805ff9c87523ad74f59c0ed538212918335eaeee29d7"
+		logic_hash = "v1_sha256_aa1a4813a18b4eb4f07e805ff9c87523ad74f59c0ed538212918335eaeee29d7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68395,10 +68395,10 @@ rule ELASTIC_Linux_Rootkit_Fontonlake_8Fa41F5E : FILE MEMORY
 		date = "2021-10-12"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Fontonlake.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Fontonlake.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "826222d399e2fb17ae6bc6a4e1493003881b1406154c4b817f0216249d04a234"
-		logic_hash = "e90ace26dd74ae948d2469c6f532af5ec3070a21092f8b2c4d47c4f5b9d04c09"
+		logic_hash = "v1_sha256_e90ace26dd74ae948d2469c6f532af5ec3070a21092f8b2c4d47c4f5b9d04c09"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -68420,7 +68420,7 @@ rule ELASTIC_Linux_Rootkit_Fontonlake_8Fa41F5E : FILE MEMORY
 		$tmp2 = "/tmp/.tmp_" fullword
 
 	condition:
-		( all of ($a*) and 1 of ($tmp*)) or ( all of ($h*))
+		( all of ( $a* ) and 1 of ( $tmp* ) ) or ( all of ( $h* ) )
 }
 rule ELASTIC_Linux_Trojan_Orbit_57C23178 : FILE MEMORY
 {
@@ -68431,10 +68431,10 @@ rule ELASTIC_Linux_Trojan_Orbit_57C23178 : FILE MEMORY
 		date = "2022-07-20"
 		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Orbit.yar#L1-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Orbit.yar#L1-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "40b5127c8cf9d6bec4dbeb61ba766a95c7b2d0cafafcb82ede5a3a679a3e3020"
-		logic_hash = "25b29e874ea9d400662418ddbb1c995a5a5b49f8ba6f51f59f7aa57cdda74054"
+		logic_hash = "v1_sha256_25b29e874ea9d400662418ddbb1c995a5a5b49f8ba6f51f59f7aa57cdda74054"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -68470,7 +68470,7 @@ rule ELASTIC_Linux_Trojan_Orbit_57C23178 : FILE MEMORY
 		$hosts_access = { 8B 45 ?? 48 98 C6 84 05 D0 EF FF FF 00 48 8B 05 ?? ?? ?? ?? 48 8B 80 ?? ?? 00 00 48 8B 95 C8 EF FF FF 48 89 D7 FF D0 89 45 ?? 48 8D 85 D0 EF FF FF 48 89 45 ?? EB }
 
 	condition:
-		7 of ($loaderstrings*) or ( all of ($functionName*) and $tmppath and all of ($execvStrings*)) or 2 of ($pam_log_password,$load_hidden_ports,$hosts_access)
+		7 of ( $loaderstrings* ) or ( all of ( $functionName* ) and $tmppath and all of ( $execvStrings* ) ) or 2 of ( $pam_log_password , $load_hidden_ports , $hosts_access )
 }
 rule ELASTIC_Linux_Ransomware_Gonnacry_53C3832D : FILE MEMORY
 {
@@ -68481,10 +68481,10 @@ rule ELASTIC_Linux_Ransomware_Gonnacry_53C3832D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Gonnacry.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Gonnacry.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f5de75a6db591fe6bb6b656aa1dcfc8f7fe0686869c34192bfa4ec092554a4ac"
-		logic_hash = "2b7453c4eb71b71e6a241f728b077a2ee63d988d55a64fedf61c34222799e262"
+		logic_hash = "v1_sha256_2b7453c4eb71b71e6a241f728b077a2ee63d988d55a64fedf61c34222799e262"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68510,10 +68510,10 @@ rule ELASTIC_Linux_Exploit_CVE_2009_2908_406C2Fef : FILE MEMORY CVE_2009_2908
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2009_2908.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2009_2908.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1e05a23f5b3b9cfde183aec26b723147e1816b95dc0fb7f9ac57376efcb22fcd"
-		logic_hash = "ae379ca7564eb97f141f6ad71ca12973bf1a38cda4bc03e3f4dca1939a9b6b38"
+		logic_hash = "v1_sha256_ae379ca7564eb97f141f6ad71ca12973bf1a38cda4bc03e3f4dca1939a9b6b38"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2009-2908"
@@ -68539,10 +68539,10 @@ rule ELASTIC_Linux_Ransomware_Itssoeasy_30Bd68E0 : FILE MEMORY
 		date = "2023-07-28"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_ItsSoEasy.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_ItsSoEasy.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "efb1024654e86c0c30d2ac5f97d27f5f27b4dd3f7f6ada65d58691f0d703461c"
-		logic_hash = "a8838af442d1106bc9a7df93d6d8335ff0275bf5928acbb605e9bad58ce6bbd4"
+		logic_hash = "v1_sha256_a8838af442d1106bc9a7df93d6d8335ff0275bf5928acbb605e9bad58ce6bbd4"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -68569,10 +68569,10 @@ rule ELASTIC_Windows_Ransomware_Gandcrab_8D0Ca31D : FILE MEMORY
 		date = "2024-08-27"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_GandCrab.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_GandCrab.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "29eee4f8b088ec1cdac03a04ca834479fce9a0fdf696224c6f19d573f4e2a703"
-		logic_hash = "0ee46c41031a7e7fbdae0b80bd8c53bfd1a0b9d255072971e74470988e492430"
+		logic_hash = "v1_sha256_0ee46c41031a7e7fbdae0b80bd8c53bfd1a0b9d255072971e74470988e492430"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68600,10 +68600,10 @@ rule ELASTIC_Linux_Trojan_Masan_5369C678 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Masan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Masan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f2de9f39ca3910d5b383c245d8ca3c1bdf98e2309553599e0283062e0aeff17f"
-		logic_hash = "e57b105004216a6054b0561b69cce00c35255c5bd33aa8e403d0a3967cd0697e"
+		logic_hash = "v1_sha256_e57b105004216a6054b0561b69cce00c35255c5bd33aa8e403d0a3967cd0697e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68629,10 +68629,10 @@ rule ELASTIC_Linux_Ransomware_Babuk_Bd216Cab : FILE MEMORY
 		date = "2024-05-09"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Babuk.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Babuk.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d305a30017baef4f08cee38a851b57869676e45c66e64bb7cc58d40bf0142fe0"
-		logic_hash = "b0538be9d8deccc3f77640da28e5fd38a07557e9e5e3c09b11349d7eb50a56b5"
+		logic_hash = "v1_sha256_b0538be9d8deccc3f77640da28e5fd38a07557e9e5e3c09b11349d7eb50a56b5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68659,10 +68659,10 @@ rule ELASTIC_Linux_Trojan_Mechbot_F2E1C5Aa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mechbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mechbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5f8e80e6877ff2de09a12135ee1fc17bee8eb6d811a65495bcbcddf14ecb44a3"
-		logic_hash = "2ba9ece1ab2360702a59a737a20b6dbd8fca276b543477f9290ab80c6f51e2f1"
+		logic_hash = "v1_sha256_2ba9ece1ab2360702a59a737a20b6dbd8fca276b543477f9290ab80c6f51e2f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68688,10 +68688,10 @@ rule ELASTIC_Windows_Trojan_Remcos_B296E965 : FILE MEMORY
 		date = "2021-06-10"
 		modified = "2021-08-23"
 		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Remcos.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Remcos.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed"
-		logic_hash = "069072abd1182eee50cb9937503d47845e7315d8e3cd6b63576adc8f21820c82"
+		logic_hash = "v1_sha256_069072abd1182eee50cb9937503d47845e7315d8e3cd6b63576adc8f21820c82"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68720,10 +68720,10 @@ rule ELASTIC_Windows_Trojan_Remcos_7591E9F1 : FILE MEMORY
 		date = "2023-06-23"
 		modified = "2023-07-10"
 		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Remcos.yar#L25-L49"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Remcos.yar#L25-L49"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4e6e5ecd1cf9c88d536c894d74320c77967fe08c75066098082bf237283842fa"
-		logic_hash = "96acf1ba7740a8d34d929ed4a4fa446c984c3a8f64a603d428e782b6997e4d20"
+		logic_hash = "v1_sha256_96acf1ba7740a8d34d929ed4a4fa446c984c3a8f64a603d428e782b6997e4d20"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68754,10 +68754,10 @@ rule ELASTIC_Windows_Trojan_Zeus_E51C60D7 : FILE MEMORY
 		date = "2021-02-07"
 		modified = "2021-10-04"
 		reference = "https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Zeus.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Zeus.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3"
-		logic_hash = "cde738f95dbad1fbad59e20528b2f577e5e3ee5fcb37c68a45d53c689d2af525"
+		logic_hash = "v1_sha256_cde738f95dbad1fbad59e20528b2f577e5e3ee5fcb37c68a45d53c689d2af525"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68788,10 +68788,10 @@ rule ELASTIC_Windows_Hacktool_Phant0M_2D6F9B57 : FILE MEMORY
 		date = "2024-02-28"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Phant0m.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Phant0m.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "30978aadd7d7bc86e735facb5046942792ad1beab6919754e6765e0ccbcf89d6"
-		logic_hash = "a66f8779f77b216f7831617a34c008e4202f36e74f2866c9792cee34b804408d"
+		logic_hash = "v1_sha256_a66f8779f77b216f7831617a34c008e4202f36e74f2866c9792cee34b804408d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68811,7 +68811,7 @@ rule ELASTIC_Windows_Hacktool_Phant0M_2D6F9B57 : FILE MEMORY
 		$s5 = "Windows EventLog module %S at %p"
 
 	condition:
-		$api and 2 of ($s*)
+		$api and 2 of ( $s* )
 }
 rule ELASTIC_Linux_Trojan_Metasploit_69E20012 : FILE MEMORY
 {
@@ -68822,10 +68822,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_69E20012 : FILE MEMORY
 		date = "2024-05-03"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "debb5d12c1b876f47a0057aad19b897c21f17de7b02c0e42f4cce478970f0120"
-		logic_hash = "5d3c3e3ba7d5d0c20d2fa1a53032da9a93a6727dcd6cb3497bb7bfb8272e4f2b"
+		logic_hash = "v1_sha256_5d3c3e3ba7d5d0c20d2fa1a53032da9a93a6727dcd6cb3497bb7bfb8272e4f2b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68856,10 +68856,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_0C629849 : FILE MEMORY
 		date = "2024-05-03"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L26-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L26-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ad070542729f3c80d6a981b351095ab8ac836b89a5c788dff367760a2d8b1dbb"
-		logic_hash = "2bea8f569728ba81af4024bf062a06a5c91b1f057a0b62fe6d51b6fcadedf58c"
+		logic_hash = "v1_sha256_2bea8f569728ba81af4024bf062a06a5c91b1f057a0b62fe6d51b6fcadedf58c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68889,10 +68889,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_849Cc5D5 : FILE MEMORY
 		date = "2024-05-03"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L50-L71"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L50-L71"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "42d734dbd33295bd68e5a545a29303a2104a5a92e5fee31d645e2a6410cc03e9"
-		logic_hash = "01c708b1e000aecf473e0a1cf23f3812a337b9b21f5b81f7a5e481d06fdaeb16"
+		logic_hash = "v1_sha256_01c708b1e000aecf473e0a1cf23f3812a337b9b21f5b81f7a5e481d06fdaeb16"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68910,7 +68910,7 @@ rule ELASTIC_Linux_Trojan_Metasploit_849Cc5D5 : FILE MEMORY
 		$shell2 = { 48 96 6A 2B 58 0F 05 50 56 5F 6A 09 58 99 B6 10 48 89 D6 4D 31 C9 6A 22 41 5A B2 07 0F 05 48 96 48 97 5F 0F 05 FF E6 }
 
 	condition:
-		all of ($init*) and 1 of ($shell*)
+		all of ( $init* ) and 1 of ( $shell* )
 }
 rule ELASTIC_Linux_Trojan_Metasploit_Da378432 : FILE MEMORY
 {
@@ -68921,10 +68921,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_Da378432 : FILE MEMORY
 		date = "2024-05-03"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L73-L93"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L73-L93"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "277499da700e0dbe27269c7cfb1fc385313c4483912a9a3f0c15adba33ecd0bf"
-		logic_hash = "cd9df6dff23986d61176e4d3440516b0590abdeebef0e456d1f4924724556fe9"
+		logic_hash = "v1_sha256_cd9df6dff23986d61176e4d3440516b0590abdeebef0e456d1f4924724556fe9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68952,10 +68952,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_B957E45D : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L95-L115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L95-L115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "78af84bad4934283024f4bf72dfbf9cc081d2b92a9de32cc36e1289131c783ab"
-		logic_hash = "27281303d007e6723308e88f335f52723b3ff0ef733d1a0712f5ba268e53a073"
+		logic_hash = "v1_sha256_27281303d007e6723308e88f335f52723b3ff0ef733d1a0712f5ba268e53a073"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -68983,10 +68983,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_1A98F2E2 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L117-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L117-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "89be4507c9c24c4ec9a7282f197a9a6819e696d2832df81f7e544095d048fc22"
-		logic_hash = "23ea1c255472a67746b470e50d982bc91d22ede5e2582cf5cfaa90a1ed4e8805"
+		logic_hash = "v1_sha256_23ea1c255472a67746b470e50d982bc91d22ede5e2582cf5cfaa90a1ed4e8805"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69014,10 +69014,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_D74153F6 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L139-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L139-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2823d27492e2e7a95b67a08cb269eb6f4175451d58b098ae429330913397d40a"
-		logic_hash = "c60e7e63183f5bf0354a03f8399576e494e44a30257339ebccb6c19e954d6f3a"
+		logic_hash = "v1_sha256_c60e7e63183f5bf0354a03f8399576e494e44a30257339ebccb6c19e954d6f3a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69045,10 +69045,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_F7A31E87 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L161-L182"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L161-L182"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "82b55d8c0f0175d02399aaf88ad9e92e2e37ef27d52c7f71271f3516ba884847"
-		logic_hash = "49583ba4f2bedb9337a8c10df4246bb76a3e60b08ba1a6b8684537fee985d911"
+		logic_hash = "v1_sha256_49583ba4f2bedb9337a8c10df4246bb76a3e60b08ba1a6b8684537fee985d911"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69066,7 +69066,7 @@ rule ELASTIC_Linux_Trojan_Metasploit_F7A31E87 : FILE MEMORY
 		$payload2 = { 5F 89 FB 6A 02 59 6A 3F 58 CD 80 49 79 ?? 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80 }
 
 	condition:
-		$setup and 1 of ($payload*)
+		$setup and 1 of ( $payload* )
 }
 rule ELASTIC_Linux_Trojan_Metasploit_B0D2D4A4 : FILE MEMORY
 {
@@ -69077,10 +69077,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_B0D2D4A4 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L184-L205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L184-L205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a37c888875e84069763303476f0df6769df6015b33aded59fc1e23eb604f2163"
-		logic_hash = "bcabf74900222074ecf9051b6e0cb4ca7a240acd047a1b27137d1d198e23f161"
+		logic_hash = "v1_sha256_bcabf74900222074ecf9051b6e0cb4ca7a240acd047a1b27137d1d198e23f161"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69109,10 +69109,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_5D26689F : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L207-L229"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L207-L229"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dafefb4d79d848384442a697b1316d93fef2741fca854be744896ce1d7f82073"
-		logic_hash = "e7906273aa7f42920be9d06cdae89c81e0a99e532cdcd7bd714acc5f2bbb0ed5"
+		logic_hash = "v1_sha256_e7906273aa7f42920be9d06cdae89c81e0a99e532cdcd7bd714acc5f2bbb0ed5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69131,7 +69131,7 @@ rule ELASTIC_Linux_Trojan_Metasploit_5D26689F : FILE MEMORY
 		$reg_bind_execve = { B0 0B 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 41 CD 80 }
 
 	condition:
-		($tiny_bind) or ( all of ($reg_bind*))
+		($tiny_bind ) or ( all of ( $reg_bind* ) )
 }
 rule ELASTIC_Linux_Trojan_Metasploit_1C8C98Ae : FILE MEMORY
 {
@@ -69142,10 +69142,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_1C8C98Ae : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L231-L251"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L231-L251"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1a2c40531584ed485f3ff532f4269241a76ff171956d03e4f0d3f9c950f186d4"
-		logic_hash = "fc32aa29f58478f0b7f4f5be61aadec65842c05b7d8ded840530503eae28b8eb"
+		logic_hash = "v1_sha256_fc32aa29f58478f0b7f4f5be61aadec65842c05b7d8ded840530503eae28b8eb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69173,10 +69173,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_47F4B334 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L253-L277"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L253-L277"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c3821f63a7ec8861a6168b4bb494bf8cbac436b3abf5eaffbc6907fd68ebedb8"
-		logic_hash = "34c8182d3b5ecbebd122d2d58fc0502a6bbca020b528ffdcc9ee988f21512d99"
+		logic_hash = "v1_sha256_34c8182d3b5ecbebd122d2d58fc0502a6bbca020b528ffdcc9ee988f21512d99"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69197,7 +69197,7 @@ rule ELASTIC_Linux_Trojan_Metasploit_47F4B334 : FILE MEMORY
 		$payload3c = { 57 53 89 E1 CD 80 }
 
 	condition:
-		$payload1 or ( all of ($payload2*)) or ( all of ($payload3*))
+		$payload1 or ( all of ( $payload2* ) ) or ( all of ( $payload3* ) )
 }
 rule ELASTIC_Linux_Trojan_Metasploit_0B014E0E : FILE MEMORY
 {
@@ -69208,10 +69208,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_0B014E0E : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L279-L303"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L279-L303"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a24443331508cc72b3391353f91cd009cafcc223ac5939eab12faf57447e3162"
-		logic_hash = "cb19a0461d5fe6066d1fed4898ea12a9818be69d870e511559b19d5c7c959819"
+		logic_hash = "v1_sha256_cb19a0461d5fe6066d1fed4898ea12a9818be69d870e511559b19d5c7c959819"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69232,7 +69232,7 @@ rule ELASTIC_Linux_Trojan_Metasploit_0B014E0E : FILE MEMORY
 		$payload3c = { 56 57 54 5E 6A 3B 58 0F 05 }
 
 	condition:
-		$payload1 or ( all of ($payload2*)) or ( all of ($payload3*))
+		$payload1 or ( all of ( $payload2* ) ) or ( all of ( $payload3* ) )
 }
 rule ELASTIC_Linux_Trojan_Metasploit_Ccc99Be1 : FILE MEMORY
 {
@@ -69243,10 +69243,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_Ccc99Be1 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L305-L327"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L305-L327"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0e9f52d7aa6bff33bfbdba6513d402db3913d4036a5e1c1c83f4ccd5cc8107c8"
-		logic_hash = "96af2123251587ece32e424202ff61cfa70faf2916cacddf5fcd9d81bf483032"
+		logic_hash = "v1_sha256_96af2123251587ece32e424202ff61cfa70faf2916cacddf5fcd9d81bf483032"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69276,10 +69276,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_Ed4B2C85 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L329-L348"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L329-L348"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0709a60149ca110f6e016a257f9ac35c6f64f50cfbd71075c4ca8bfe843c3211"
-		logic_hash = "79e466b2f40a6769db498cc28cb22ba72ec20f92c8450d6f1f8301d00012f967"
+		logic_hash = "v1_sha256_79e466b2f40a6769db498cc28cb22ba72ec20f92c8450d6f1f8301d00012f967"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69306,10 +69306,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_2B0Ad6F0 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L350-L371"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L350-L371"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "aa2bce61511c72ac03562b5178aad57bce8b46916160689ed07693790cbfbeec"
-		logic_hash = "91b4547e44c40cafe09dd415f0b5dfe5980fcb10d50aeae844cf21e7608d9a9d"
+		logic_hash = "v1_sha256_91b4547e44c40cafe09dd415f0b5dfe5980fcb10d50aeae844cf21e7608d9a9d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69338,10 +69338,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_Bf205D5A : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L373-L397"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L373-L397"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2162a89f70edd7a7f93f8972c6a13782fb466cdada41f255f0511730ec20d037"
-		logic_hash = "9f4c84fadc3d7555c80efc9c9c5dcb01d4ea65d2ff191aa63ae8316f763ded3f"
+		logic_hash = "v1_sha256_9f4c84fadc3d7555c80efc9c9c5dcb01d4ea65d2ff191aa63ae8316f763ded3f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69362,7 +69362,7 @@ rule ELASTIC_Linux_Trojan_Metasploit_Bf205D5A : FILE MEMORY
 		$socket = { 51 50 89 E1 6A 66 58 CD 80 D1 E3 B0 66 CD 80 57 43 B0 66 89 51 04 CD 80 }
 
 	condition:
-		3 of ($str*) and $ipv6 and $socket
+		3 of ( $str* ) and $ipv6 and $socket
 }
 rule ELASTIC_Linux_Trojan_Metasploit_E5B61173 : FILE MEMORY
 {
@@ -69373,10 +69373,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_E5B61173 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L399-L420"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L399-L420"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8032a7a320102c8e038db16d51b8615ee49f04dab1444326463f75ce0c5947a5"
-		logic_hash = "f60d2de0b7fac06b62616d7c7f51e9374df3895eb30a07040e742cbcb462a418"
+		logic_hash = "v1_sha256_f60d2de0b7fac06b62616d7c7f51e9374df3895eb30a07040e742cbcb462a418"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69405,10 +69405,10 @@ rule ELASTIC_Linux_Trojan_Metasploit_Dd5Fd075 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Metasploit.yar#L422-L443"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Metasploit.yar#L422-L443"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b47132a92b66c32c88f39fe36d0287c6b864043273939116225235d4c5b4043a"
-		logic_hash = "f5101d5ddb1a84127e755677da70d9154849c546ac6ef0e7ef2639c82911eb92"
+		logic_hash = "v1_sha256_f5101d5ddb1a84127e755677da70d9154849c546ac6ef0e7ef2639c82911eb92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69437,9 +69437,9 @@ rule ELASTIC_Linux_Cryptominer_Bulz_2Aa8Fbb5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Bulz.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "21d8bec73476783e01d2a51a99233f186d7c72b49c9292c42e19e1aa6397d415"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Bulz.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_21d8bec73476783e01d2a51a99233f186d7c72b49c9292c42e19e1aa6397d415"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69465,9 +69465,9 @@ rule ELASTIC_Linux_Cryptominer_Bulz_0998F811 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Bulz.yar#L20-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "178f6c42582dd99cc5418388d020d4d76f2a9204297a673359fe0a300121c35b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Bulz.yar#L20-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_178f6c42582dd99cc5418388d020d4d76f2a9204297a673359fe0a300121c35b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69493,10 +69493,10 @@ rule ELASTIC_Windows_Trojan_Pandastealer_8B333E76 : FILE MEMORY
 		date = "2021-09-02"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Pandastealer.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Pandastealer.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ec346bd56be375b695b4bc76720959fa07d1357ffc3783eb61de9b8d91b3d935"
-		logic_hash = "5878799338fc18bac0f946faeadd59c921dee32c9391fc12d22c72c0cd6733a8"
+		logic_hash = "v1_sha256_5878799338fc18bac0f946faeadd59c921dee32c9391fc12d22c72c0cd6733a8"
 		score = 75
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -69526,10 +69526,10 @@ rule ELASTIC_Linux_Trojan_Mirai_268Aac0B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
-		logic_hash = "6eae3aba35d3379fa194b66a1b4e0d78d0d0b88386cd4ea5dfeb3c072642c7ba"
+		logic_hash = "v1_sha256_6eae3aba35d3379fa194b66a1b4e0d78d0d0b88386cd4ea5dfeb3c072642c7ba"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69555,10 +69555,10 @@ rule ELASTIC_Linux_Trojan_Mirai_D5F2Abe2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c490586fbf90d360cf3b2f9e2dc943809441df3dfd64dadad27fc9f5ee96ec74"
-		logic_hash = "169e7e5d1a7ea8c219464e22df9be8bc8caa2e78e1bc725674c8e0b14f6b9fc5"
+		logic_hash = "v1_sha256_169e7e5d1a7ea8c219464e22df9be8bc8caa2e78e1bc725674c8e0b14f6b9fc5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69584,9 +69584,9 @@ rule ELASTIC_Linux_Trojan_Mirai_1Cb033F3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L41-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "ebaf45ce58124aa91b07ebb48779e6da73baa0b80b13e663c13d8fb2bb47ad0d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L41-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_ebaf45ce58124aa91b07ebb48779e6da73baa0b80b13e663c13d8fb2bb47ad0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69612,10 +69612,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Fa3Ad9D0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "5890c85872ea4508e673235b20b481972f613f6e5f9564c0237c458995532347"
+		logic_hash = "v1_sha256_5890c85872ea4508e673235b20b481972f613f6e5f9564c0237c458995532347"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69641,10 +69641,10 @@ rule ELASTIC_Linux_Trojan_Mirai_0Cb1699C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "97307f583240290de2bfc663b99f8dcdedace92885bd3e0c0340709b94c0bc2a"
+		logic_hash = "v1_sha256_97307f583240290de2bfc663b99f8dcdedace92885bd3e0c0340709b94c0bc2a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69670,10 +69670,10 @@ rule ELASTIC_Linux_Trojan_Mirai_6F021787 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L100-L118"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L100-L118"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "88183d71359c16d91a3252085ad5a270ad3e196fe431e3019b0810ecfd85ae10"
-		logic_hash = "7e8062682a0babbaa3c00975807ba9fc34c465afde55e4144944e7598f0ea1fd"
+		logic_hash = "v1_sha256_7e8062682a0babbaa3c00975807ba9fc34c465afde55e4144944e7598f0ea1fd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69699,10 +69699,10 @@ rule ELASTIC_Linux_Trojan_Mirai_1E0C5Ce0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L120-L138"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L120-L138"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d"
-		logic_hash = "591cc3ef6932bf990f56c932866b34778e8eccd0e343f9bd6126eb8205a12ecc"
+		logic_hash = "v1_sha256_591cc3ef6932bf990f56c932866b34778e8eccd0e343f9bd6126eb8205a12ecc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69728,10 +69728,10 @@ rule ELASTIC_Linux_Trojan_Mirai_22965A6D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L140-L158"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L140-L158"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "09c821aa8977f67878f8769f717c792d69436a951bb5ac06ce5052f46da80a48"
-		logic_hash = "6b2a46694edf709d28267268252cfe95d88049b7dca854059cfe44479ada7423"
+		logic_hash = "v1_sha256_6b2a46694edf709d28267268252cfe95d88049b7dca854059cfe44479ada7423"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69757,10 +69757,10 @@ rule ELASTIC_Linux_Trojan_Mirai_4032Ade1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L160-L178"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L160-L178"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6150fbbefb916583a0e888dee8ed3df8ec197ba7c04f89fb24f31de50226e688"
-		logic_hash = "9c5e24c4efd4035408897f638d3579c3798139fd18178cee4a944b49c13e1532"
+		logic_hash = "v1_sha256_9c5e24c4efd4035408897f638d3579c3798139fd18178cee4a944b49c13e1532"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69786,9 +69786,9 @@ rule ELASTIC_Linux_Trojan_Mirai_B14F4C5D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L180-L197"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "1a2114a7b397c850d732940a0e154bc04fbee1fdc12d343947b343b9b27a8af1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L180-L197"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_1a2114a7b397c850d732940a0e154bc04fbee1fdc12d343947b343b9b27a8af1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69814,10 +69814,10 @@ rule ELASTIC_Linux_Trojan_Mirai_C8385B81 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L199-L217"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L199-L217"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3d27736caccdd3199a14ce29d91b1812d1d597a4fa8472698e6df6ef716f5ce9"
-		logic_hash = "4ff1f0912fb92e7ac5af49e1738dac897ff1f0a118d8ff905da45b0a91b3f4a7"
+		logic_hash = "v1_sha256_4ff1f0912fb92e7ac5af49e1738dac897ff1f0a118d8ff905da45b0a91b3f4a7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69843,10 +69843,10 @@ rule ELASTIC_Linux_Trojan_Mirai_122Ff2E6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L219-L237"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L219-L237"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4"
-		logic_hash = "62884309b9095cdd6219c9ef6cd77a0f712640d8a1db4afe5b1d01f4bbe5acc2"
+		logic_hash = "v1_sha256_62884309b9095cdd6219c9ef6cd77a0f712640d8a1db4afe5b1d01f4bbe5acc2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69872,10 +69872,10 @@ rule ELASTIC_Linux_Trojan_Mirai_26Cba88C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L239-L257"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L239-L257"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4b4758bff3dcaa5640e340d27abba5c2e2b02c3c4a582374e183986375e49be8"
-		logic_hash = "bb5a0f9e68655556ab9fccc27d11bf7828c299720bb67948455579d6a7eb2a9f"
+		logic_hash = "v1_sha256_bb5a0f9e68655556ab9fccc27d11bf7828c299720bb67948455579d6a7eb2a9f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69901,10 +69901,10 @@ rule ELASTIC_Linux_Trojan_Mirai_93Fc3657 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L259-L277"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L259-L277"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "0b5278feddd00b0b24ca735bf7cd1440379c6ce5aca6d2a6f38c9fdcedcb3c0d"
+		logic_hash = "v1_sha256_0b5278feddd00b0b24ca735bf7cd1440379c6ce5aca6d2a6f38c9fdcedcb3c0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69930,9 +69930,9 @@ rule ELASTIC_Linux_Trojan_Mirai_7C88Acbc : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L279-L296"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "76373f8e09b7467ac5d36e8baad3025a57568e891434297e53f2629a72cf8929"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L279-L296"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_76373f8e09b7467ac5d36e8baad3025a57568e891434297e53f2629a72cf8929"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69958,10 +69958,10 @@ rule ELASTIC_Linux_Trojan_Mirai_804F8E7C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L298-L316"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L298-L316"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "711d74406d9b0d658b3b29f647bd659699ac0af9cd482403122124ec6054f1ec"
+		logic_hash = "v1_sha256_711d74406d9b0d658b3b29f647bd659699ac0af9cd482403122124ec6054f1ec"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -69987,10 +69987,10 @@ rule ELASTIC_Linux_Trojan_Mirai_A2D2E15A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L318-L336"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L318-L336"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "567c3ce9bbbda760be81c286bfb2252418f551a64ba1189f6c0ec8ec059cee49"
-		logic_hash = "c76fe953c4a70110346a020f2b27c7e79f4ad8a24fd92ac26e5ddd1fed068f65"
+		logic_hash = "v1_sha256_c76fe953c4a70110346a020f2b27c7e79f4ad8a24fd92ac26e5ddd1fed068f65"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70016,10 +70016,10 @@ rule ELASTIC_Linux_Trojan_Mirai_5946F41B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L338-L356"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L338-L356"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f0b6bf8a683f8692973ea8291129c9764269a6739650ec3f9ee50d222df0a38a"
-		logic_hash = "43691675db419426413ccc24aa9dfe94456fa1007630652b08a625eafd1f17b8"
+		logic_hash = "v1_sha256_43691675db419426413ccc24aa9dfe94456fa1007630652b08a625eafd1f17b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70045,10 +70045,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Da4Aa3B3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L358-L376"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L358-L376"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dbc246032d432318f23a4c1e5b6fcd787df29da3bf418613f588f758dcd80617"
-		logic_hash = "84ddc505d2e2be955b88a0fe3b78d435f73c0a315b513e105933e84be78ba2ad"
+		logic_hash = "v1_sha256_84ddc505d2e2be955b88a0fe3b78d435f73c0a315b513e105933e84be78ba2ad"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70074,10 +70074,10 @@ rule ELASTIC_Linux_Trojan_Mirai_70Ef58F1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L378-L396"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L378-L396"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "3ad201d643e8f93a6f9075c03a76020d78186702a19bf9174b08688a2e94ef5c"
+		logic_hash = "v1_sha256_3ad201d643e8f93a6f9075c03a76020d78186702a19bf9174b08688a2e94ef5c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70103,10 +70103,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Ea584243 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L398-L416"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L398-L416"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f363d9bd2132d969cd41e79f29c53ef403da64ca8afc4643084cc50076ddfb47"
-		logic_hash = "34c6f800c849c295797cdd971fb4f3d16d680530f9a98c291388345569708208"
+		logic_hash = "v1_sha256_34c6f800c849c295797cdd971fb4f3d16d680530f9a98c291388345569708208"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70132,10 +70132,10 @@ rule ELASTIC_Linux_Trojan_Mirai_564B8Eda : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L418-L436"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L418-L436"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee"
-		logic_hash = "4bf11492f480911629623250146554f2456f3a527f5f80402ef74b22c1460462"
+		logic_hash = "v1_sha256_4bf11492f480911629623250146554f2456f3a527f5f80402ef74b22c1460462"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70161,10 +70161,10 @@ rule ELASTIC_Linux_Trojan_Mirai_7E9F85Fb : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L438-L456"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L438-L456"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4333e80fd311b28c948bab7fb3f5efb40adda766f1ea4bed96a8db5fe0d80ea1"
-		logic_hash = "f4ce912e190bc5dcb56541f54ba8e47b6103c482bdc7e83b44693d2c066c0170"
+		logic_hash = "v1_sha256_f4ce912e190bc5dcb56541f54ba8e47b6103c482bdc7e83b44693d2c066c0170"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70190,10 +70190,10 @@ rule ELASTIC_Linux_Trojan_Mirai_3A85A418 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L458-L476"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L458-L476"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a"
-		logic_hash = "bd7fe497fb2557c9e9c26ec90e783f03cbbc9bdaa8d20b364ce65edf6c1e5fa3"
+		logic_hash = "v1_sha256_bd7fe497fb2557c9e9c26ec90e783f03cbbc9bdaa8d20b364ce65edf6c1e5fa3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70219,10 +70219,10 @@ rule ELASTIC_Linux_Trojan_Mirai_24C5B7D6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L478-L496"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L478-L496"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7c2f8ba2d6f1e67d1b4a3a737a449429c322d945d49dafb9e8c66608ab2154c4"
-		logic_hash = "f790f6b8fcf932773054525ed74a3f15998d91a2626ae9c56486de8dabc2035c"
+		logic_hash = "v1_sha256_f790f6b8fcf932773054525ed74a3f15998d91a2626ae9c56486de8dabc2035c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70248,10 +70248,10 @@ rule ELASTIC_Linux_Trojan_Mirai_99D78950 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L498-L516"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L498-L516"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "bfd628a9973f85ed0a8be2723c7ff4bd028af00ea98c9cbcde9df6aabcf394b2"
+		logic_hash = "v1_sha256_bfd628a9973f85ed0a8be2723c7ff4bd028af00ea98c9cbcde9df6aabcf394b2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70277,9 +70277,9 @@ rule ELASTIC_Linux_Trojan_Mirai_3Fe3C668 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L518-L535"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e75b2dca7de7d9f31a0ae5940dc45d0e6d0f1ca110b5458fc99912400da97bde"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L518-L535"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e75b2dca7de7d9f31a0ae5940dc45d0e6d0f1ca110b5458fc99912400da97bde"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70305,10 +70305,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Eedfbfc6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L537-L555"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L537-L555"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b7342f7437a3a16805a7a8d4a667e0e018584f9a99591413650e05d21d3e6da6"
-		logic_hash = "949b32db1a00570fc84fbbe510f57f6e898d089efd3fedbd7719f8059021b6bc"
+		logic_hash = "v1_sha256_949b32db1a00570fc84fbbe510f57f6e898d089efd3fedbd7719f8059021b6bc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70334,10 +70334,10 @@ rule ELASTIC_Linux_Trojan_Mirai_6D96Ae91 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L557-L575"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L557-L575"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e3a1d92df6fb566e09c389cfb085126d2ea0f51a776ec099afb8913ef5e96f9b"
-		logic_hash = "43b0ac7090620eb6c892f1105778c395bf18f5ac309ce1b2d9015b5abccbfc2a"
+		logic_hash = "v1_sha256_43b0ac7090620eb6c892f1105778c395bf18f5ac309ce1b2d9015b5abccbfc2a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70363,10 +70363,10 @@ rule ELASTIC_Linux_Trojan_Mirai_D8779A57 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L577-L595"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L577-L595"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c490586fbf90d360cf3b2f9e2dc943809441df3dfd64dadad27fc9f5ee96ec74"
-		logic_hash = "2154786bbb6dbcc280aaa9e2b75106b585d04c7c85f6162f441c81dc54663cb3"
+		logic_hash = "v1_sha256_2154786bbb6dbcc280aaa9e2b75106b585d04c7c85f6162f441c81dc54663cb3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70392,10 +70392,10 @@ rule ELASTIC_Linux_Trojan_Mirai_3E72E107 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L597-L615"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L597-L615"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "57d04035b68950246dd152054e949008dafb810f3705710d09911876cd44aec7"
-		logic_hash = "ba0ba56ded8977502ad9f8a1ceebd30efbff964d576bbfeedff5761f0538d8f0"
+		logic_hash = "v1_sha256_ba0ba56ded8977502ad9f8a1ceebd30efbff964d576bbfeedff5761f0538d8f0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70421,10 +70421,10 @@ rule ELASTIC_Linux_Trojan_Mirai_5C62E6B2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L617-L635"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L617-L635"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
-		logic_hash = "6505c4272f0f7c8c5f2d3f7cefdc3947c4015b0dfd94efde4357a506af93a99d"
+		logic_hash = "v1_sha256_6505c4272f0f7c8c5f2d3f7cefdc3947c4015b0dfd94efde4357a506af93a99d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70450,10 +70450,10 @@ rule ELASTIC_Linux_Trojan_Mirai_C5430Ff9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L637-L655"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L637-L655"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5676773882a84d0efc220dd7595c4594bc824cbe3eeddfadc00ac3c8e899aa77"
-		logic_hash = "8c385980560cd4b24e703744b57a9d5ea1bca8fbeea066e98dd4b40009e56104"
+		logic_hash = "v1_sha256_8c385980560cd4b24e703744b57a9d5ea1bca8fbeea066e98dd4b40009e56104"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70479,10 +70479,10 @@ rule ELASTIC_Linux_Trojan_Mirai_402Adc45 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L657-L675"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L657-L675"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ae0cd7e5bac967e31771873b4b41a1887abddfcdfcc76fa9149bb2054b03ca4"
-		logic_hash = "dab879d57507d5e119ddf4ce6ed33570c74f185a2260e97a7ec1d6c844943e5d"
+		logic_hash = "v1_sha256_dab879d57507d5e119ddf4ce6ed33570c74f185a2260e97a7ec1d6c844943e5d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70508,9 +70508,9 @@ rule ELASTIC_Linux_Trojan_Mirai_A39Dfaa7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L677-L694"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "98fde36fc412b6aa50c80c12118975a6bf754a9fba94f1cc3cdeed22565d6b0d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L677-L694"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_98fde36fc412b6aa50c80c12118975a6bf754a9fba94f1cc3cdeed22565d6b0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70536,10 +70536,10 @@ rule ELASTIC_Linux_Trojan_Mirai_E3E6D768 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L696-L714"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L696-L714"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b505cb26d3ead5a0ef82d2c87a9b352cc0268ef0571f5e28defca7131065545e"
-		logic_hash = "b848c7200f405d77553d661a6c49fb958df225875957ead35b35091995f307d1"
+		logic_hash = "v1_sha256_b848c7200f405d77553d661a6c49fb958df225875957ead35b35091995f307d1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70565,9 +70565,9 @@ rule ELASTIC_Linux_Trojan_Mirai_520Deeb8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L716-L733"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "671c17835f30cce1e5d68dbf3a73d340069b1b55a2ac42fc132c008cb2da622e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L716-L733"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_671c17835f30cce1e5d68dbf3a73d340069b1b55a2ac42fc132c008cb2da622e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70593,10 +70593,10 @@ rule ELASTIC_Linux_Trojan_Mirai_77137320 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L735-L753"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L735-L753"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
-		logic_hash = "ee48e0478845a61dbbdb5cc3ee5194eb272fcf6dcf139381f068c9af1557d0d4"
+		logic_hash = "v1_sha256_ee48e0478845a61dbbdb5cc3ee5194eb272fcf6dcf139381f068c9af1557d0d4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70622,9 +70622,9 @@ rule ELASTIC_Linux_Trojan_Mirai_A6A81F9C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L755-L772"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "0d31cc1f4a673c13e6c81c492acbe16e1e0dfb0b15913fb276ea4abff18b32af"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L755-L772"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_0d31cc1f4a673c13e6c81c492acbe16e1e0dfb0b15913fb276ea4abff18b32af"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70650,10 +70650,10 @@ rule ELASTIC_Linux_Trojan_Mirai_485C4B13 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L774-L792"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L774-L792"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
-		logic_hash = "9625e4190559cc77f41ebef24f9bfa5e3d2e2259c12b301148c614b0f98b5835"
+		logic_hash = "v1_sha256_9625e4190559cc77f41ebef24f9bfa5e3d2e2259c12b301148c614b0f98b5835"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70679,9 +70679,9 @@ rule ELASTIC_Linux_Trojan_Mirai_7146E518 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L794-L811"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "374602254be1f5c1dbb00ad25d870722e03d674033dfcf953a2895e1f50c637d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L794-L811"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_374602254be1f5c1dbb00ad25d870722e03d674033dfcf953a2895e1f50c637d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70707,9 +70707,9 @@ rule ELASTIC_Linux_Trojan_Mirai_6A77Af0F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L813-L830"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7d7623dfc1e16c7c02294607ddf46edd12cdc7d39a2b920d8711dc47c383731b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L813-L830"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7d7623dfc1e16c7c02294607ddf46edd12cdc7d39a2b920d8711dc47c383731b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70735,9 +70735,9 @@ rule ELASTIC_Linux_Trojan_Mirai_5F7B67B8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L832-L849"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "b2aedc0361c1093d7a996f26d907da3e4654c32a6dbcdbab441c19d4207f2e2a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L832-L849"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_b2aedc0361c1093d7a996f26d907da3e4654c32a6dbcdbab441c19d4207f2e2a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70763,10 +70763,10 @@ rule ELASTIC_Linux_Trojan_Mirai_A3Cedc45 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L851-L869"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L851-L869"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ae0cd7e5bac967e31771873b4b41a1887abddfcdfcc76fa9149bb2054b03ca4"
-		logic_hash = "9233e6faa43d8ea43ff3c71ecb5248d5d311b2a593825c299cac4466278cd020"
+		logic_hash = "v1_sha256_9233e6faa43d8ea43ff3c71ecb5248d5d311b2a593825c299cac4466278cd020"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70792,10 +70792,10 @@ rule ELASTIC_Linux_Trojan_Mirai_7D05725E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L871-L889"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L871-L889"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "ac2d0b81325ce7984bc09f93e61b42c8e312a31c75f09d37313d70cd40d3cf8b"
+		logic_hash = "v1_sha256_ac2d0b81325ce7984bc09f93e61b42c8e312a31c75f09d37313d70cd40d3cf8b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70821,10 +70821,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Fa48B592 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L891-L909"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L891-L909"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee"
-		logic_hash = "5648bcc96b1fdd1529b4b8765b1738594d0d61f7880b763e803cd89bd117e96b"
+		logic_hash = "v1_sha256_5648bcc96b1fdd1529b4b8765b1738594d0d61f7880b763e803cd89bd117e96b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70850,9 +70850,9 @@ rule ELASTIC_Linux_Trojan_Mirai_B9A9D04B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L911-L928"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "61575576be4c1991bc381965a40e5d9d751bba2680a42907b0148651716419fc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L911-L928"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_61575576be4c1991bc381965a40e5d9d751bba2680a42907b0148651716419fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70878,10 +70878,10 @@ rule ELASTIC_Linux_Trojan_Mirai_D2205527 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L930-L948"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L930-L948"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e4f584d1f75f0d7c98b325adc55025304d55907e8eb77b328c007600180d6f06"
-		logic_hash = "172ba256873cce61047a5198733cacaff4ef343c9cbd76f2fbbf0e1ed8003236"
+		logic_hash = "v1_sha256_172ba256873cce61047a5198733cacaff4ef343c9cbd76f2fbbf0e1ed8003236"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70907,10 +70907,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Ab073861 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L950-L968"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L950-L968"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "175444a9c9ca78565de4b2eabe341f51b55e59dec00090574ee0f1875422cbac"
-		logic_hash = "251b92c4fec9d113025c6869c279247a3dd16ee094c8861fe43a33f87132bf75"
+		logic_hash = "v1_sha256_251b92c4fec9d113025c6869c279247a3dd16ee094c8861fe43a33f87132bf75"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70936,9 +70936,9 @@ rule ELASTIC_Linux_Trojan_Mirai_637F2C04 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L970-L987"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "cff4aa6c613ccc64f64441f7e40f79d3a22b5c12856c32814545bd41d5f112bd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L970-L987"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_cff4aa6c613ccc64f64441f7e40f79d3a22b5c12856c32814545bd41d5f112bd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70964,9 +70964,9 @@ rule ELASTIC_Linux_Trojan_Mirai_Aa39Fb02 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L989-L1006"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "ffa95d92a2b619008bd5918cd34a17cd034b2830dc09d495db4b0c397b1cb53a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L989-L1006"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_ffa95d92a2b619008bd5918cd34a17cd034b2830dc09d495db4b0c397b1cb53a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -70992,10 +70992,10 @@ rule ELASTIC_Linux_Trojan_Mirai_0Bce98A2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1008-L1026"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1008-L1026"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80"
-		logic_hash = "04d10ef03c178fb101d3c6b6d3b36f0aa04149b9b35a33c3d10d17af1fc07625"
+		logic_hash = "v1_sha256_04d10ef03c178fb101d3c6b6d3b36f0aa04149b9b35a33c3d10d17af1fc07625"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71021,9 +71021,9 @@ rule ELASTIC_Linux_Trojan_Mirai_3A56423B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1028-L1045"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "0c2765a5c1b331eb9ff5e542bc72eff7be3506e6caef94128413d500086715c6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1028-L1045"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_0c2765a5c1b331eb9ff5e542bc72eff7be3506e6caef94128413d500086715c6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71049,10 +71049,10 @@ rule ELASTIC_Linux_Trojan_Mirai_D18B3463 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1047-L1065"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1047-L1065"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cd86534d709877ec737ceb016b2a5889d2e3562ffa45a278bc615838c2e9ebc3"
-		logic_hash = "f906c6f9baae6d6fa3f42e84607549bae44ed9ca847fd916d04f2671eef1caa1"
+		logic_hash = "v1_sha256_f906c6f9baae6d6fa3f42e84607549bae44ed9ca847fd916d04f2671eef1caa1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71078,9 +71078,9 @@ rule ELASTIC_Linux_Trojan_Mirai_Fe721Dc5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1067-L1084"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e9312eefb5f14a27d96e973139e45098c2f62a24d5254ca24dea64b9888a4448"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1067-L1084"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e9312eefb5f14a27d96e973139e45098c2f62a24d5254ca24dea64b9888a4448"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71106,9 +71106,9 @@ rule ELASTIC_Linux_Trojan_Mirai_575F5Bc8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1086-L1103"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "dec143d096f5774f297ce90ef664ae50c40ae4f87843bbb34e496565c0faf3b2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1086-L1103"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_dec143d096f5774f297ce90ef664ae50c40ae4f87843bbb34e496565c0faf3b2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71134,10 +71134,10 @@ rule ELASTIC_Linux_Trojan_Mirai_449937Aa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1105-L1123"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1105-L1123"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe"
-		logic_hash = "d459e46893115dbdef46bcaceb6a66255ef3a389f1bf7173b0e0bd0d8ce024fb"
+		logic_hash = "v1_sha256_d459e46893115dbdef46bcaceb6a66255ef3a389f1bf7173b0e0bd0d8ce024fb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71163,10 +71163,10 @@ rule ELASTIC_Linux_Trojan_Mirai_2E3F67A9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1125-L1143"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1125-L1143"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "8c83c5d32c58041444f33264f692a7580c76324d2cbad736fdd737bdfcd63595"
+		logic_hash = "v1_sha256_8c83c5d32c58041444f33264f692a7580c76324d2cbad736fdd737bdfcd63595"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71192,9 +71192,9 @@ rule ELASTIC_Linux_Trojan_Mirai_01E4A728 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1145-L1162"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "753936b97a36c774975a1d0988f6f908d4b5e5906498aa34c606d4cd971f1ba5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1145-L1162"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_753936b97a36c774975a1d0988f6f908d4b5e5906498aa34c606d4cd971f1ba5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71220,10 +71220,10 @@ rule ELASTIC_Linux_Trojan_Mirai_64D5Cde2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1164-L1182"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1164-L1182"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "caf2a8c199156db2f39dbb0a303db56040f615c4410e074ef56be2662752ca9d"
-		logic_hash = "08f3635e5517185cae936b39f503bbeba5aed2e36abdd805170a259bc5e3644f"
+		logic_hash = "v1_sha256_08f3635e5517185cae936b39f503bbeba5aed2e36abdd805170a259bc5e3644f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71249,10 +71249,10 @@ rule ELASTIC_Linux_Trojan_Mirai_0D73971C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1184-L1202"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1184-L1202"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
-		logic_hash = "56f3bac05fce0a0458e5b80197335e7bef6dcd50b9feb6f1008b8679f29cf37a"
+		logic_hash = "v1_sha256_56f3bac05fce0a0458e5b80197335e7bef6dcd50b9feb6f1008b8679f29cf37a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71278,10 +71278,10 @@ rule ELASTIC_Linux_Trojan_Mirai_82C361D4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1204-L1222"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1204-L1222"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f8dbcf0fc52f0c717c8680cb5171a8c6c395f14fd40a2af75efc9ba5684a5b49"
-		logic_hash = "766a964d7d35525fbc88adcf86fb69d11f9c63c0d28ceefb3ae79797a7161193"
+		logic_hash = "v1_sha256_766a964d7d35525fbc88adcf86fb69d11f9c63c0d28ceefb3ae79797a7161193"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71307,10 +71307,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Ec591E81 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1224-L1242"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1224-L1242"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7d45a4a128c25f317020b5d042ab893e9875b6ff0ef17482b984f5b3fe87e451"
-		logic_hash = "f2a147fe7f98d2b3141a1fda118ee803c81d9bc6f498bfaf3557665397eb44da"
+		logic_hash = "v1_sha256_f2a147fe7f98d2b3141a1fda118ee803c81d9bc6f498bfaf3557665397eb44da"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71336,10 +71336,10 @@ rule ELASTIC_Linux_Trojan_Mirai_0Eba3F5A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1244-L1262"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1244-L1262"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2e4f89c76dfefd4b2bfd1cf0467ac0324026355723950d12d7ed51195fd998cf"
-		logic_hash = "bcb2f1e1659102f39977fac43b119c58d6c72f828c3065e2318f671146e911da"
+		logic_hash = "v1_sha256_bcb2f1e1659102f39977fac43b119c58d6c72f828c3065e2318f671146e911da"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71365,10 +71365,10 @@ rule ELASTIC_Linux_Trojan_Mirai_E43A8744 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1264-L1282"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1264-L1282"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f363d9bd2132d969cd41e79f29c53ef403da64ca8afc4643084cc50076ddfb47"
-		logic_hash = "17c52d2b720fa2e98c3e9bb077525a695a6e547a66e8c44fcc1e26e48df81adf"
+		logic_hash = "v1_sha256_17c52d2b720fa2e98c3e9bb077525a695a6e547a66e8c44fcc1e26e48df81adf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71394,9 +71394,9 @@ rule ELASTIC_Linux_Trojan_Mirai_6E8E9257 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1284-L1301"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "67973257e578783838f18dc8ae994f221ad1c1b3f4a04a2b6b523da5ebd8c95b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1284-L1301"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_67973257e578783838f18dc8ae994f221ad1c1b3f4a04a2b6b523da5ebd8c95b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71422,10 +71422,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Ac253E4F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1303-L1321"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1303-L1321"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
-		logic_hash = "1ab463fce01148c2cc95659fdf8b05e597d9b4eeabe81a9cdfa1da3632d72291"
+		logic_hash = "v1_sha256_1ab463fce01148c2cc95659fdf8b05e597d9b4eeabe81a9cdfa1da3632d72291"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71451,10 +71451,10 @@ rule ELASTIC_Linux_Trojan_Mirai_994535C4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1323-L1341"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1323-L1341"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "376a2771a2a973628e22379b3dbb9a8015c828505bbe18a0c027b5d513c9e90d"
-		logic_hash = "c83c8c9cdfea1bf322115e5b23d751b226a5dbf42fc41faac172d36192ccf31f"
+		logic_hash = "v1_sha256_c83c8c9cdfea1bf322115e5b23d751b226a5dbf42fc41faac172d36192ccf31f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71480,10 +71480,10 @@ rule ELASTIC_Linux_Trojan_Mirai_A68E498C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1343-L1361"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1343-L1361"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "e4552813dc92b397c5ba78f32ee6507520f337b55779a3fc705de7e961f8eb8f"
+		logic_hash = "v1_sha256_e4552813dc92b397c5ba78f32ee6507520f337b55779a3fc705de7e961f8eb8f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71509,10 +71509,10 @@ rule ELASTIC_Linux_Trojan_Mirai_88De437F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1363-L1381"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1363-L1381"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "233dbf3d13c35f4c9c7078d67ea60086355c801ce6515f9d3c518e95afd39d85"
+		logic_hash = "v1_sha256_233dbf3d13c35f4c9c7078d67ea60086355c801ce6515f9d3c518e95afd39d85"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71538,10 +71538,10 @@ rule ELASTIC_Linux_Trojan_Mirai_95E0056C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1383-L1401"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1383-L1401"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "45f67d4c18abc1bad9a9cc6305983abf3234cd955d2177f1a72c146ced50a380"
-		logic_hash = "9e34891d28034d1f4fc3da5cb99df8fc74f0b876903088f5eab5fe36e0e0e603"
+		logic_hash = "v1_sha256_9e34891d28034d1f4fc3da5cb99df8fc74f0b876903088f5eab5fe36e0e0e603"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71567,10 +71567,10 @@ rule ELASTIC_Linux_Trojan_Mirai_B548632D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1403-L1421"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1403-L1421"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "639d9d6da22e84fb6b6fc676a1c4cfd74a8ed546ce8661500ab2ef971242df07"
-		logic_hash = "bfb46457f8b79548726e3988d649f94e04f26f9e546aae70ece94defae6bab8a"
+		logic_hash = "v1_sha256_bfb46457f8b79548726e3988d649f94e04f26f9e546aae70ece94defae6bab8a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71596,9 +71596,9 @@ rule ELASTIC_Linux_Trojan_Mirai_E0Cf29E2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1423-L1440"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "693e27da8cbab32954cc2c9ba648151ad9fc21fe53251628145d7b436ec5e976"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1423-L1440"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_693e27da8cbab32954cc2c9ba648151ad9fc21fe53251628145d7b436ec5e976"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71624,10 +71624,10 @@ rule ELASTIC_Linux_Trojan_Mirai_1754B331 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1442-L1460"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1442-L1460"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0d89fc59d0de2584af0e4614a1561d1d343faa766edfef27d1ea96790ac7014b"
-		logic_hash = "fde04b0e31a00326f9d011198995999ff9b15628f5ff4139ec7dec19ac0c59c9"
+		logic_hash = "v1_sha256_fde04b0e31a00326f9d011198995999ff9b15628f5ff4139ec7dec19ac0c59c9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71653,10 +71653,10 @@ rule ELASTIC_Linux_Trojan_Mirai_3278F1B8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1462-L1480"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1462-L1480"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "4d709e8e2062099ac06b241408e52bcb86bbf8163faaffbcff68a05f864e1b3f"
+		logic_hash = "v1_sha256_4d709e8e2062099ac06b241408e52bcb86bbf8163faaffbcff68a05f864e1b3f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71682,10 +71682,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Ab804Bb7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1482-L1500"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1482-L1500"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8f0cc764729498b4cb9c5446f1a84cde54e828e913dc78faf537004a7df21b20"
-		logic_hash = "cef2ffafe152332502fb0d72d014c81b90dc9ad4f4491f1b2f2f9c1f73cc7958"
+		logic_hash = "v1_sha256_cef2ffafe152332502fb0d72d014c81b90dc9ad4f4491f1b2f2f9c1f73cc7958"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71711,10 +71711,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Dca3B9B4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1502-L1520"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1502-L1520"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a839437deba6d30e7a22104561e38f60776729199a96a71da3a88a7c7990246a"
-		logic_hash = "f85dfc1c00706d7ac11ef35c41c471383ef8b019a5c2566b27072a5ef5ad5c93"
+		logic_hash = "v1_sha256_f85dfc1c00706d7ac11ef35c41c471383ef8b019a5c2566b27072a5ef5ad5c93"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71740,9 +71740,9 @@ rule ELASTIC_Linux_Trojan_Mirai_Ae9D0Fa6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1522-L1539"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8da5b14b95d96de5ced8bcab98e23973e449c1b5ca101f39a2114bb8e74fd9a5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1522-L1539"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8da5b14b95d96de5ced8bcab98e23973e449c1b5ca101f39a2114bb8e74fd9a5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71768,10 +71768,10 @@ rule ELASTIC_Linux_Trojan_Mirai_612B407C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1541-L1559"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1541-L1559"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7833bc89778461a9f46cc47a78c67dda48b498ee40b09a80a21e67cb70c6add1"
-		logic_hash = "6514725a32f7c28be7de5ff6fe1363df7c50e2cd6c8c79824ec4cbeadda2ca31"
+		logic_hash = "v1_sha256_6514725a32f7c28be7de5ff6fe1363df7c50e2cd6c8c79824ec4cbeadda2ca31"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71797,10 +71797,10 @@ rule ELASTIC_Linux_Trojan_Mirai_D5Da717F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1561-L1579"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1561-L1579"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1f6bcdfc7d1c56228897cd7548266bb0b9a41b913be354036816643ac21b6f66"
-		logic_hash = "034dae5bea7536e8c8aa22b8b891b9c991b94f04be12c9fe6d78ddf07a2365d9"
+		logic_hash = "v1_sha256_034dae5bea7536e8c8aa22b8b891b9c991b94f04be12c9fe6d78ddf07a2365d9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71826,10 +71826,10 @@ rule ELASTIC_Linux_Trojan_Mirai_D33095D4 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1581-L1599"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1581-L1599"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "72326a3a9160e9481dd6fc87159f7ebf8a358f52bf0c17fbc3df80217d032635"
-		logic_hash = "b7feaec65d72907d08c98b09fb4ac494ceee7d7bd51c09063363c617e3f057a4"
+		logic_hash = "v1_sha256_b7feaec65d72907d08c98b09fb4ac494ceee7d7bd51c09063363c617e3f057a4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71855,10 +71855,10 @@ rule ELASTIC_Linux_Trojan_Mirai_4E2246Fb : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1601-L1619"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1601-L1619"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1f6bcdfc7d1c56228897cd7548266bb0b9a41b913be354036816643ac21b6f66"
-		logic_hash = "6d2e1300286751a5e1ae683e9aab2f59bfbb20d1cc18dcce89c06ecadf25a3e6"
+		logic_hash = "v1_sha256_6d2e1300286751a5e1ae683e9aab2f59bfbb20d1cc18dcce89c06ecadf25a3e6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71884,10 +71884,10 @@ rule ELASTIC_Linux_Trojan_Mirai_D5981806 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1621-L1639"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1621-L1639"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "784f2005853b5375efaf3995208e4611b81b8c52f67b6dc139fd9fec7b49d9dc"
-		logic_hash = "e625323543aa5c8374a179dfa51c3f5be1446459c45fa7c7a27ae383cf0f551b"
+		logic_hash = "v1_sha256_e625323543aa5c8374a179dfa51c3f5be1446459c45fa7c7a27ae383cf0f551b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71913,10 +71913,10 @@ rule ELASTIC_Linux_Trojan_Mirai_C6055Dc9 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1641-L1659"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1641-L1659"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c1718d7fdeef886caa33951e75cbd9139467fa1724605fdf76c8cdb1ec20e024"
-		logic_hash = "4d9d7c44f0d3ae60275720ae5faf3c25c368aa6e7d9ab5ed706a30f9a7ffd3b8"
+		logic_hash = "v1_sha256_4d9d7c44f0d3ae60275720ae5faf3c25c368aa6e7d9ab5ed706a30f9a7ffd3b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71942,10 +71942,10 @@ rule ELASTIC_Linux_Trojan_Mirai_3B9675Fd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1661-L1679"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1661-L1679"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4ec4bc88156bd51451fdaf0550c21c799c6adacbfc654c8ec634ebca3383bd66"
-		logic_hash = "61ff7cb8d664291de5cf0c82b80cf0f4001c41d3f02b7f4762f67eb8128df15d"
+		logic_hash = "v1_sha256_61ff7cb8d664291de5cf0c82b80cf0f4001c41d3f02b7f4762f67eb8128df15d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -71971,10 +71971,10 @@ rule ELASTIC_Linux_Trojan_Mirai_1C0D246D : FILE MEMORY
 		date = "2021-04-13"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1681-L1700"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1681-L1700"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "211cfe9d158c8a6840a53f2d1db2bf94ae689946fffb791eed3acceef7f0e3dd"
-		logic_hash = "7a101e6d2265e09eb6c8d0f1a2fe54c9aa353dfd8bd156926937f4aec86c3ef1"
+		logic_hash = "v1_sha256_7a101e6d2265e09eb6c8d0f1a2fe54c9aa353dfd8bd156926937f4aec86c3ef1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72001,9 +72001,9 @@ rule ELASTIC_Linux_Trojan_Mirai_Ad337D2F : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "012b717909a8b251ec1e0c284b3c795865a32a1f4b79706d2254a4eb289c30a7"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1702-L1720"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "dba630c1deb00b0dbd9f895a9b93393bc634150c8f32527b02d8dd71dc806e7d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1702-L1720"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_dba630c1deb00b0dbd9f895a9b93393bc634150c8f32527b02d8dd71dc806e7d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72029,9 +72029,9 @@ rule ELASTIC_Linux_Trojan_Mirai_88A1B067 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "1a62db02343edda916cbbf463d8e07ec2ad4509fd0f15a5f6946d0ec6c332dd9"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1722-L1740"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "0755f1f974734ccd4ecc444217bf52ed306d1dc32c05841ba9ca6d259e1a147e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1722-L1740"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_0755f1f974734ccd4ecc444217bf52ed306d1dc32c05841ba9ca6d259e1a147e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72057,9 +72057,9 @@ rule ELASTIC_Linux_Trojan_Mirai_76Bbc4Ca : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "1a9ff86a66d417678c387102932a71fd879972173901c04f3462de0e519c3b51"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1742-L1760"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "855b7938b92b5645fcefd2ec1e2ccb71269654816f362282ccbf9aef1c01c8a0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1742-L1760"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_855b7938b92b5645fcefd2ec1e2ccb71269654816f362282ccbf9aef1c01c8a0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72085,10 +72085,10 @@ rule ELASTIC_Linux_Trojan_Mirai_0Bfc17Bd : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1762-L1780"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1762-L1780"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1cdd94f2a1cb2b93134646c171d947e325a498f7a13db021e88c05a4cbb68903"
-		logic_hash = "ef83bc9ae3c881d09b691db42a1712b500a5bb8df34060a6786cfdc6caaf5530"
+		logic_hash = "v1_sha256_ef83bc9ae3c881d09b691db42a1712b500a5bb8df34060a6786cfdc6caaf5530"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72114,10 +72114,10 @@ rule ELASTIC_Linux_Trojan_Mirai_389Ee3E9 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1782-L1800"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1782-L1800"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
-		logic_hash = "fedeae98d468a11c3eaa561b9d5433ec206bdd4caed5aed7926434730f7f866b"
+		logic_hash = "v1_sha256_fedeae98d468a11c3eaa561b9d5433ec206bdd4caed5aed7926434730f7f866b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72143,10 +72143,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Cc93863B : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1802-L1820"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1802-L1820"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
-		logic_hash = "881998dee010270d7cefae5b59a888e541d4a2b93e3e52ae0abe0df41371c50d"
+		logic_hash = "v1_sha256_881998dee010270d7cefae5b59a888e541d4a2b93e3e52ae0abe0df41371c50d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72172,10 +72172,10 @@ rule ELASTIC_Linux_Trojan_Mirai_8Aa7B5D3 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1822-L1840"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1822-L1840"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
-		logic_hash = "3c99b7b126184b75802c7198c81f4783af776920edc6e964dbe726d28d88f64d"
+		logic_hash = "v1_sha256_3c99b7b126184b75802c7198c81f4783af776920edc6e964dbe726d28d88f64d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72201,10 +72201,10 @@ rule ELASTIC_Linux_Trojan_Mirai_76908C99 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1842-L1860"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1842-L1860"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "533a90959bfb337fd7532fb844501fd568f5f4a49998d5d479daf5dfbd01abb2"
-		logic_hash = "bd8254e888b1ea93ca9aad92ea2c8ece1f2d03ae2949ca4c3743b6e339ee21e0"
+		logic_hash = "v1_sha256_bd8254e888b1ea93ca9aad92ea2c8ece1f2d03ae2949ca4c3743b6e339ee21e0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72230,10 +72230,10 @@ rule ELASTIC_Linux_Trojan_Mirai_1538Ce1A : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1862-L1880"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1862-L1880"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2382996a8fd44111376253da227120649a1a94b5c61739e87a4e8acc1130e662"
-		logic_hash = "cf2dd11da520640c6a64e05c4679072a714d8cf93d5f5aa3a1eca8eb3e9c8b3b"
+		logic_hash = "v1_sha256_cf2dd11da520640c6a64e05c4679072a714d8cf93d5f5aa3a1eca8eb3e9c8b3b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72259,10 +72259,10 @@ rule ELASTIC_Linux_Trojan_Mirai_07B1F4F6 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1882-L1900"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1882-L1900"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2382996a8fd44111376253da227120649a1a94b5c61739e87a4e8acc1130e662"
-		logic_hash = "4af1a20e29e0c9b62e1530031e49a3d7b37d4e9a547d89a270a2e59e0c7852cc"
+		logic_hash = "v1_sha256_4af1a20e29e0c9b62e1530031e49a3d7b37d4e9a547d89a270a2e59e0c7852cc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72288,10 +72288,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Feaa98Ff : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1902-L1920"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1902-L1920"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2382996a8fd44111376253da227120649a1a94b5c61739e87a4e8acc1130e662"
-		logic_hash = "06be9d8bcfcb7e6b600103cf29fa8a94a457ff56e8c7018336c270978a57ccbf"
+		logic_hash = "v1_sha256_06be9d8bcfcb7e6b600103cf29fa8a94a457ff56e8c7018336c270978a57ccbf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72317,10 +72317,10 @@ rule ELASTIC_Linux_Trojan_Mirai_3Acd6Ed4 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1922-L1940"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1922-L1940"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2644447de8befa1b4fe39b2117d49754718a2f230d6d5f977166386aa88e7b84"
-		logic_hash = "ab284d41af8e1920fa54ac8bfab84bac493adf816aebce60490ab22c0e502201"
+		logic_hash = "v1_sha256_ab284d41af8e1920fa54ac8bfab84bac493adf816aebce60490ab22c0e502201"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72346,10 +72346,10 @@ rule ELASTIC_Linux_Trojan_Mirai_Eb940856 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mirai.yar#L1942-L1960"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mirai.yar#L1942-L1960"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fbf814c04234fc95b6a288b62fb9513d6bbad2e601b96db14bb65ab153e65fef"
-		logic_hash = "d7bb2373a35ea97a11513e80e9a561f53a8f0b9345f392e8e7f042d4cb2d7d20"
+		logic_hash = "v1_sha256_d7bb2373a35ea97a11513e80e9a561f53a8f0b9345f392e8e7f042d4cb2d7d20"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72375,10 +72375,10 @@ rule ELASTIC_Macos_Trojan_Electrorat_B4Dbfd1D : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Electrorat.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Electrorat.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b1028b38fcce0d54f2013c89a9c0605ccb316c36c27faf3a35adf435837025a4"
-		logic_hash = "a36143a8c93cb187dba0a88a15550219c19f1483502f782dfefc1e53829cfbf1"
+		logic_hash = "v1_sha256_a36143a8c93cb187dba0a88a15550219c19f1483502f782dfefc1e53829cfbf1"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -72407,10 +72407,10 @@ rule ELASTIC_Windows_Trojan_Suddenicon_99487621 : FILE MEMORY
 		date = "2023-03-29"
 		modified = "2023-03-30"
 		reference = "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SuddenIcon.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SuddenIcon.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
-		logic_hash = "9a441c47e8b95d8aaec6f495d6ddfec2ed6b0762637ea48e64c9ea01b0945019"
+		logic_hash = "v1_sha256_9a441c47e8b95d8aaec6f495d6ddfec2ed6b0762637ea48e64c9ea01b0945019"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72431,7 +72431,7 @@ rule ELASTIC_Windows_Trojan_Suddenicon_99487621 : FILE MEMORY
 		$seq_virtualprotect = { FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF D5 48 85 C0 74 ?? 81 7B ?? CA 7D 0F 00 75 ?? 48 8D 54 24 ?? 48 8D 4C 24 ?? FF D0 8B F8 44 8B 44 24 ?? 4C 8D 4C 24 ?? BA 00 10 00 00 48 8B CD FF 15 ?? ?? ?? ?? }
 
 	condition:
-		5 of ($str*) or 2 of ($seq*)
+		5 of ( $str* ) or 2 of ( $seq* )
 }
 rule ELASTIC_Windows_Trojan_Suddenicon_8B07C275 : FILE MEMORY
 {
@@ -72442,10 +72442,10 @@ rule ELASTIC_Windows_Trojan_Suddenicon_8B07C275 : FILE MEMORY
 		date = "2023-03-29"
 		modified = "2023-03-30"
 		reference = "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SuddenIcon.yar#L28-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SuddenIcon.yar#L28-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
-		logic_hash = "64e8bd8929c9fb8cae16f772e3266b02b4ddec770ff8d5379a93a483eb8ff660"
+		logic_hash = "v1_sha256_64e8bd8929c9fb8cae16f772e3266b02b4ddec770ff8d5379a93a483eb8ff660"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72472,9 +72472,9 @@ rule ELASTIC_Windows_Trojan_Suddenicon_Ac021Ae0 : FILE MEMORY
 		date = "2023-03-30"
 		modified = "2023-03-30"
 		reference = "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SuddenIcon.yar#L50-L76"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "033eabdd8ce8ecc4e1a657161c1f298c7dfe536ee2dbf9375cfda894638a7bee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SuddenIcon.yar#L50-L76"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_033eabdd8ce8ecc4e1a657161c1f298c7dfe536ee2dbf9375cfda894638a7bee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72497,7 +72497,7 @@ rule ELASTIC_Windows_Trojan_Suddenicon_Ac021Ae0 : FILE MEMORY
 		$b1 = "\\3CXDesktopApp\\config.json" wide fullword
 
 	condition:
-		6 of ($str*) or 1 of ($b*)
+		6 of ( $str* ) or 1 of ( $b* )
 }
 rule ELASTIC_Windows_Vulndriver_Llaccess_C57534E8 : FILE
 {
@@ -72508,10 +72508,10 @@ rule ELASTIC_Windows_Vulndriver_Llaccess_C57534E8 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_LLAccess.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_LLAccess.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
-		logic_hash = "8bf629fd2ce0b1f15c7aacd573659b649dcf968556232683b29d68b27d12e577"
+		logic_hash = "v1_sha256_8bf629fd2ce0b1f15c7aacd573659b649dcf968556232683b29d68b27d12e577"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -72528,7 +72528,7 @@ rule ELASTIC_Windows_Vulndriver_Llaccess_C57534E8 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x12][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x11][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Shellcode_Generic_8C487E57 : FILE MEMORY
 {
@@ -72539,9 +72539,9 @@ rule ELASTIC_Windows_Shellcode_Generic_8C487E57 : FILE MEMORY
 		date = "2022-05-23"
 		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Shellcode_Generic.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "a86ea8e15248e83ce7322c10e308a5a24096b1d7c67f5673687563dec8229dfe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Shellcode_Generic.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_a86ea8e15248e83ce7322c10e308a5a24096b1d7c67f5673687563dec8229dfe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72567,9 +72567,9 @@ rule ELASTIC_Windows_Shellcode_Generic_F27D7Beb : FILE MEMORY
 		date = "2022-06-08"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Shellcode_Generic.yar#L20-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8530a74a002d0286711cd86545aff0bf853de6b6684473b6211d678797c3639f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Shellcode_Generic.yar#L20-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8530a74a002d0286711cd86545aff0bf853de6b6684473b6211d678797c3639f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72595,9 +72595,9 @@ rule ELASTIC_Windows_Shellcode_Generic_29Dcbf7A : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Shellcode_Generic.yar#L39-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "c2a81cc27e696a2e488df7d2f96784bbaed83df5783efab312fc5ccbfd524b43"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Shellcode_Generic.yar#L39-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_c2a81cc27e696a2e488df7d2f96784bbaed83df5783efab312fc5ccbfd524b43"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72623,10 +72623,10 @@ rule ELASTIC_Windows_Hacktool_Cpulocker_73B41444 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_CpuLocker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_CpuLocker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dbfc90fa2c5dc57899cc75ccb9dc7b102cb4556509cdfecde75b36f602d7da66"
-		logic_hash = "8fb33744326781c51bb6bd18d0574602256b813b62ec8344d5338e6442bb2de0"
+		logic_hash = "v1_sha256_8fb33744326781c51bb6bd18d0574602256b813b62ec8344d5338e6442bb2de0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -72641,7 +72641,7 @@ rule ELASTIC_Windows_Hacktool_Cpulocker_73B41444 : FILE
 		$str1 = "\\CPULocker.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Trojan_Ngioweb_8Bd3002C : FILE MEMORY
 {
@@ -72652,10 +72652,10 @@ rule ELASTIC_Linux_Trojan_Ngioweb_8Bd3002C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ngioweb.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ngioweb.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
-		logic_hash = "578fd1c3e6091df9550b3c2caf999d7a0432f037b0cc4b15642531e7fdffd7b7"
+		logic_hash = "v1_sha256_578fd1c3e6091df9550b3c2caf999d7a0432f037b0cc4b15642531e7fdffd7b7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72681,10 +72681,10 @@ rule ELASTIC_Linux_Trojan_Ngioweb_A592A280 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ngioweb.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ngioweb.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
-		logic_hash = "b16cf5b527782680cc1da6f61dd537596792fed615993b19965ef2dbde701e64"
+		logic_hash = "v1_sha256_b16cf5b527782680cc1da6f61dd537596792fed615993b19965ef2dbde701e64"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72710,10 +72710,10 @@ rule ELASTIC_Linux_Trojan_Ngioweb_D57Aa841 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ngioweb.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ngioweb.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "555d60bd863caff231700c5f606d0034d5aa8362862d1fd0c816615d59f582f7"
-		logic_hash = "b0db72ad81d27f5b2ac2d2bb903ff10849c304d40619fd95a39e7d48c64c45ba"
+		logic_hash = "v1_sha256_b0db72ad81d27f5b2ac2d2bb903ff10849c304d40619fd95a39e7d48c64c45ba"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72739,10 +72739,10 @@ rule ELASTIC_Linux_Trojan_Ngioweb_B97E0253 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ngioweb.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ngioweb.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
-		logic_hash = "dc11d50166a4d1b400c0df81295054192d42822dd3e065e374a92a31727d4dbd"
+		logic_hash = "v1_sha256_dc11d50166a4d1b400c0df81295054192d42822dd3e065e374a92a31727d4dbd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72768,10 +72768,10 @@ rule ELASTIC_Linux_Trojan_Ngioweb_66C465A0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ngioweb.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ngioweb.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7454ee074812d7fa49044de8190e17b5034b3f08625f547d1b04aae4054fd81a"
-		logic_hash = "71f224e3ee1ff29787258a61f29a37a9ddc51e9cb5df0693ea52fd4b6f0b5ad8"
+		logic_hash = "v1_sha256_71f224e3ee1ff29787258a61f29a37a9ddc51e9cb5df0693ea52fd4b6f0b5ad8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72797,10 +72797,10 @@ rule ELASTIC_Linux_Trojan_Ngioweb_D8573802 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ngioweb.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ngioweb.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7454ee074812d7fa49044de8190e17b5034b3f08625f547d1b04aae4054fd81a"
-		logic_hash = "b51ab7a7c26e889a4e8efc2b9883f709c17d82032b0c28ab3e30229d6f296367"
+		logic_hash = "v1_sha256_b51ab7a7c26e889a4e8efc2b9883f709c17d82032b0c28ab3e30229d6f296367"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72826,10 +72826,10 @@ rule ELASTIC_Linux_Trojan_Ngioweb_7926Bc8E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ngioweb.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ngioweb.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "555d60bd863caff231700c5f606d0034d5aa8362862d1fd0c816615d59f582f7"
-		logic_hash = "ac42dd714696825d64402861e96122cce7cd09ae8d9c43a19dd9cf95d7b09610"
+		logic_hash = "v1_sha256_ac42dd714696825d64402861e96122cce7cd09ae8d9c43a19dd9cf95d7b09610"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72855,10 +72855,10 @@ rule ELASTIC_Linux_Trojan_Ngioweb_E2377400 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ngioweb.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ngioweb.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b88daf00a0e890b6750e691856b0fe7428d90d417d9503f62a917053e340228b"
-		logic_hash = "71276698d1bdb9bc494fe6f1aa9755940583331836abc490e0b5ac3454d35de6"
+		logic_hash = "v1_sha256_71276698d1bdb9bc494fe6f1aa9755940583331836abc490e0b5ac3454d35de6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72884,9 +72884,9 @@ rule ELASTIC_Linux_Trojan_Ngioweb_994F1E97 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ngioweb.yar#L161-L178"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "2384e787877b622445d7d14053a8340d2e97d3ab103a3fabfa08a40068726ad0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ngioweb.yar#L161-L178"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2384e787877b622445d7d14053a8340d2e97d3ab103a3fabfa08a40068726ad0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -72912,10 +72912,10 @@ rule ELASTIC_Windows_Hacktool_Sharpshares_88Cdcd52 : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpShares.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpShares.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41"
-		logic_hash = "85c59b939da6158f931e779c2884cea77b80fab54ee5e157d86afa19f0253db3"
+		logic_hash = "v1_sha256_85c59b939da6158f931e779c2884cea77b80fab54ee5e157d86afa19f0253db3"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -72941,7 +72941,7 @@ rule ELASTIC_Windows_Hacktool_Sharpshares_88Cdcd52 : FILE MEMORY
 		$str7 = "[-] \\\\{0}\\{1}" ascii wide
 
 	condition:
-		$guid or all of ($print_str*) or 4 of ($str*)
+		$guid or all of ( $print_str* ) or 4 of ( $str* )
 }
 rule ELASTIC_Windows_Trojan_Mylobot_A895174A : FILE MEMORY
 {
@@ -72952,10 +72952,10 @@ rule ELASTIC_Windows_Trojan_Mylobot_A895174A : FILE MEMORY
 		date = "2024-05-15"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_MyloBot.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_MyloBot.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "33831d9ad64d0f52f507f08ef81607aafa6ced58a189969af6cf57c659c982d2"
-		logic_hash = "16f2d8eeb6c85944030a33bd250e4e8b98985a6c877a0ec3ad5a6037e7c00159"
+		logic_hash = "v1_sha256_16f2d8eeb6c85944030a33bd250e4e8b98985a6c877a0ec3ad5a6037e7c00159"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -72987,10 +72987,10 @@ rule ELASTIC_Windows_Vulndriver_Msio_Aa20A3C6 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_MsIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_MsIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6"
-		logic_hash = "3b383934dc91536f69e2c6cb2cf2054c5f8a08766ecf1d1804c57f3a2c39c1c2"
+		logic_hash = "v1_sha256_3b383934dc91536f69e2c6cb2cf2054c5f8a08766ecf1d1804c57f3a2c39c1c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -73005,7 +73005,7 @@ rule ELASTIC_Windows_Vulndriver_Msio_Aa20A3C6 : FILE
 		$str1 = "\\MsIo32.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Vulndriver_Msio_Ce0Bda23 : FILE
 {
@@ -73016,10 +73016,10 @@ rule ELASTIC_Windows_Vulndriver_Msio_Ce0Bda23 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_MsIo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_MsIo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
-		logic_hash = "f7fbe0255a006cce42aff61b294512c11e1cceaf11d5c1b6f75b96fb3b155895"
+		logic_hash = "v1_sha256_f7fbe0255a006cce42aff61b294512c11e1cceaf11d5c1b6f75b96fb3b155895"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -73034,7 +73034,7 @@ rule ELASTIC_Windows_Vulndriver_Msio_Ce0Bda23 : FILE
 		$str1 = "\\MsIo64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Virus_Gmon_E544D891 : FILE MEMORY
 {
@@ -73045,10 +73045,10 @@ rule ELASTIC_Linux_Virus_Gmon_E544D891 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Virus_Gmon.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Virus_Gmon.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d0fe377664aa0bc0d1fd3a307650f211dd3ef2e2f04597abee465e836e6a6f32"
-		logic_hash = "6dcfd51aaa79d7bac0100d9c891aa4275b8e1f7614cda46a5da4c738d376c729"
+		logic_hash = "v1_sha256_6dcfd51aaa79d7bac0100d9c891aa4275b8e1f7614cda46a5da4c738d376c729"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73074,10 +73074,10 @@ rule ELASTIC_Linux_Virus_Gmon_192Bd9B3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Virus_Gmon.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Virus_Gmon.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d0fe377664aa0bc0d1fd3a307650f211dd3ef2e2f04597abee465e836e6a6f32"
-		logic_hash = "3df275349d14a845c73087375f96e0c9a069ff685beb89249590ef9448e50373"
+		logic_hash = "v1_sha256_3df275349d14a845c73087375f96e0c9a069ff685beb89249590ef9448e50373"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73103,10 +73103,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_57C0C6D7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "100dc1ede4c0832a729d77725784d9deb358b3a768dfaf7ff9e96535f5b5a361"
-		logic_hash = "d3a272d488cebe4f774c994001a14d825372a27f16267bc0339b7e3b22ada8db"
+		logic_hash = "v1_sha256_d3a272d488cebe4f774c994001a14d825372a27f16267bc0339b7e3b22ada8db"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73132,10 +73132,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_7E42Bf80 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "551b6e6617fa3f438ec1b3bd558b3cbc981141904cab261c0ac082a697e5b07d"
-		logic_hash = "ad8c8f0081d07f7e2a5400de6af2c6b311f77ff336d7576f7fb0bfe2593a9062"
+		logic_hash = "v1_sha256_ad8c8f0081d07f7e2a5400de6af2c6b311f77ff336d7576f7fb0bfe2593a9062"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73161,10 +73161,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_271121Fb : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "19aeafb63430b5ac98e93dfd6469c20b9c1145e6b5b86202553bd7bd9e118842"
-		logic_hash = "f43b1527ad4bbd07023126def89c1af47698cc832f71f4a1381ed0d621d79ed5"
+		logic_hash = "v1_sha256_f43b1527ad4bbd07023126def89c1af47698cc832f71f4a1381ed0d621d79ed5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73190,9 +73190,9 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_E7E64Fb7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L61-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e325ac02c51526c5a36bdd6c2bcb3bee51f1214d78eff8048c8a1ae88334a9e8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L61-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e325ac02c51526c5a36bdd6c2bcb3bee51f1214d78eff8048c8a1ae88334a9e8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73218,9 +73218,9 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_79B42B21 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L80-L97"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "db42871193960ea4c2cbe5f5040cbc1097d57d9e4dc291bcc77ed72b588311ab"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L80-L97"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_db42871193960ea4c2cbe5f5040cbc1097d57d9e4dc291bcc77ed72b588311ab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73246,10 +73246,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_77Fbc695 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L99-L117"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L99-L117"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e723a2b976adddb01abb1101f2d3407b783067bec042a135b21b14d63bc18a68"
-		logic_hash = "af8e09cd5d6b7532af0c06273aa465cf6c40ad6c919a679fd09191a1c2a302f5"
+		logic_hash = "v1_sha256_af8e09cd5d6b7532af0c06273aa465cf6c40ad6c919a679fd09191a1c2a302f5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73275,10 +73275,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_403B0A12 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L119-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L119-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "54d806b3060404ccde80d9f3153eebe8fdda49b6e8cdba197df0659c6724a52d"
-		logic_hash = "5b7662124eb980b11f88a50665292e7a405595f7ad85c5c448dd087ea096689a"
+		logic_hash = "v1_sha256_5b7662124eb980b11f88a50665292e7a405595f7ad85c5c448dd087ea096689a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73304,9 +73304,9 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_Bffa106B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L139-L156"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d7214ad9c4291205b50567d142d99b8a19a9cfa69d3cd0a644774c3a1adb6b49"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L139-L156"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d7214ad9c4291205b50567d142d99b8a19a9cfa69d3cd0a644774c3a1adb6b49"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73332,10 +73332,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_73Faf972 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L158-L176"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L158-L176"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "00e29303b66cb39a8bc23fe91379c087376ea26baa21f6b7f7817289ba89f655"
-		logic_hash = "a6a9d304d215302bf399c90ed0dd77a681796254c51a2a20e4a316dba43b387f"
+		logic_hash = "v1_sha256_a6a9d304d215302bf399c90ed0dd77a681796254c51a2a20e4a316dba43b387f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73361,10 +73361,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_Af809Eea : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L178-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L178-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "00e29303b66cb39a8bc23fe91379c087376ea26baa21f6b7f7817289ba89f655"
-		logic_hash = "4ae4b119a3eecfdb47a88fe5a89a4f79ae96eecf5d08eef08997357de7e6538a"
+		logic_hash = "v1_sha256_4ae4b119a3eecfdb47a88fe5a89a4f79ae96eecf5d08eef08997357de7e6538a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73390,10 +73390,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_9F6Ac00F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L198-L216"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L198-L216"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9cd58c1759056c0c5bbd78248b9192c4f8c568ed89894aff3724fdb2be44ca43"
-		logic_hash = "9fa8e7be5c35c9a649c42613d0d5d5cecff3d9c3e9a572e4be1ca661876748a5"
+		logic_hash = "v1_sha256_9fa8e7be5c35c9a649c42613d0d5d5cecff3d9c3e9a572e4be1ca661876748a5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73419,10 +73419,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrig_Dbcc9D87 : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrig.yar#L218-L236"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrig.yar#L218-L236"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "da9b8fb5c26e81fb3aed3b0bc95d855339fced303aae2af281daf0f1a873e585"
-		logic_hash = "b7fa60e32cb53484d8b76b13066eda1f2275ee2660ac2dc02b0078b921998e79"
+		logic_hash = "v1_sha256_b7fa60e32cb53484d8b76b13066eda1f2275ee2660ac2dc02b0078b921998e79"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73448,10 +73448,10 @@ rule ELASTIC_Linux_Trojan_Gognt_50C3D9Da : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gognt.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gognt.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "79602bc786edda7017c5f576814b683fba41e4cb4cf3f837e963c6d0d42c50ee"
-		logic_hash = "ecd9cd94b3bf8c50c347e70aab3da03ea6589530b20941a9f62dac501f8144fc"
+		logic_hash = "v1_sha256_ecd9cd94b3bf8c50c347e70aab3da03ea6589530b20941a9f62dac501f8144fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73477,10 +73477,10 @@ rule ELASTIC_Linux_Trojan_Gognt_05B10F4B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gognt.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gognt.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e43aaf2345dbb5c303d5a5e53cd2e2e84338d12f69ad809865f20fd1a5c2716f"
-		logic_hash = "1dfc3417f75aa81aea5eda3d6da076f1cacf82dbfc039252b1d16f52b81a5a65"
+		logic_hash = "v1_sha256_1dfc3417f75aa81aea5eda3d6da076f1cacf82dbfc039252b1d16f52b81a5a65"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73506,10 +73506,10 @@ rule ELASTIC_Macos_Hacktool_Jokerspy_58A6B26D : FILE MEMORY
 		date = "2023-06-19"
 		modified = "2023-06-19"
 		reference = "https://www.elastic.co/security-labs/inital-research-of-jokerspy"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Macos_Hacktool_JokerSpy.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Macos_Hacktool_JokerSpy.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d895075057e491b34b0f8c0392b44e43ade425d19eaaacea6ef8c5c9bd3487d8"
-		logic_hash = "e9e1333c7172d5a0f06093a902edefd7f128963dbaadf77e829f032ccb04ce56"
+		logic_hash = "v1_sha256_e9e1333c7172d5a0f06093a902edefd7f128963dbaadf77e829f032ccb04ce56"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73540,10 +73540,10 @@ rule ELASTIC_Windows_Trojan_Cybergate_517Aac7D : FILE MEMORY
 		date = "2022-02-28"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CyberGate.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CyberGate.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365"
-		logic_hash = "50e061d0c358655c03b95ccbe2d05e252501c3e6afd21dd20513019cd67e6147"
+		logic_hash = "v1_sha256_50e061d0c358655c03b95ccbe2d05e252501c3e6afd21dd20513019cd67e6147"
 		score = 75
 		quality = 48
 		tags = "FILE, MEMORY"
@@ -73573,10 +73573,10 @@ rule ELASTIC_Windows_Trojan_Cybergate_9996D800 : FILE MEMORY
 		date = "2022-02-28"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CyberGate.yar#L25-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CyberGate.yar#L25-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365"
-		logic_hash = "efefc171b6390c9792145973708358f62b18b8d0180feacaf5b9267563c3f7cc"
+		logic_hash = "v1_sha256_efefc171b6390c9792145973708358f62b18b8d0180feacaf5b9267563c3f7cc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73602,10 +73602,10 @@ rule ELASTIC_Windows_Trojan_Cybergate_C219A2F3 : FILE MEMORY
 		date = "2023-05-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CyberGate.yar#L45-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CyberGate.yar#L45-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b7204f8caf6ace6ae1aed267de0ad6b39660d0e636d8ee0ecf88135f8a58dc42"
-		logic_hash = "8075892728c610c1ceacd0df54615d2a3e833d728d631a9bf81311e8c6485f6e"
+		logic_hash = "v1_sha256_8075892728c610c1ceacd0df54615d2a3e833d728d631a9bf81311e8c6485f6e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73632,10 +73632,10 @@ rule ELASTIC_Linux_Hacktool_Aduh_6Cae7C78 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Aduh.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Aduh.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9c67207546ad274dc78a0819444d1c8805537f9ac36d3c53eba9278ed44b360c"
-		logic_hash = "130df108de5b6cdfb9227f96301bdaa1e272d47b8cb9ad96c3aa574bf65870b2"
+		logic_hash = "v1_sha256_130df108de5b6cdfb9227f96301bdaa1e272d47b8cb9ad96c3aa574bf65870b2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73661,10 +73661,10 @@ rule ELASTIC_Windows_Vulndriver_Mhyprot_26214176 : FILE
 		date = "2022-08-25"
 		modified = "2022-08-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Mhyprot.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Mhyprot.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6"
-		logic_hash = "61d1713c689b9d663f2d3360d07735b07ca10365b5ce424b2df726bd6cc434d3"
+		logic_hash = "v1_sha256_61d1713c689b9d663f2d3360d07735b07ca10365b5ce424b2df726bd6cc434d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -73682,7 +73682,7 @@ rule ELASTIC_Windows_Vulndriver_Mhyprot_26214176 : FILE
 		$str1 = "\\Device\\mhyprot2" wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $subject_name and $version and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $subject_name and $version and $str1
 }
 rule ELASTIC_Multi_Hacktool_Gsocket_761D3A0F : FILE MEMORY
 {
@@ -73693,10 +73693,10 @@ rule ELASTIC_Multi_Hacktool_Gsocket_761D3A0F : FILE MEMORY
 		date = "2024-09-20"
 		modified = "2024-11-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Hacktool_Gsocket.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Hacktool_Gsocket.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "193efd61ae10f286d06390968537fa85e4df40995fd424d1afe426c089d172ab"
-		logic_hash = "6f60b63f406b42ac2a43cbe3afbbc98789504d7c6036d50f852a5bc4a6c46cef"
+		logic_hash = "v1_sha256_6f60b63f406b42ac2a43cbe3afbbc98789504d7c6036d50f852a5bc4a6c46cef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73735,10 +73735,10 @@ rule ELASTIC_Windows_Trojan_Eagerbee_7029Ba21 : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_EagerBee.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_EagerBee.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "09005775fc587ac7bf150c05352e59dc01008b7bf8c1d870d1cea87561aa0b06"
-		logic_hash = "874959361b14ba74e13e6e674da75c9bdb6b9475d8b286572825c940b41f679f"
+		logic_hash = "v1_sha256_874959361b14ba74e13e6e674da75c9bdb6b9475d8b286572825c940b41f679f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73765,10 +73765,10 @@ rule ELASTIC_Windows_Trojan_Eagerbee_A64B323B : FILE MEMORY
 		date = "2023-09-04"
 		modified = "2023-09-20"
 		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_EagerBee.yar#L23-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_EagerBee.yar#L23-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "339e4fdbccb65b0b06a1421c719300a8da844789a2016d58e8ce4227cb5dc91b"
-		logic_hash = "e1c25cf8ce0ff434727c9104c6b79110ff5cfa84eb3e939119fd05cf676727c6"
+		logic_hash = "v1_sha256_e1c25cf8ce0ff434727c9104c6b79110ff5cfa84eb3e939119fd05cf676727c6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73797,10 +73797,10 @@ rule ELASTIC_Linux_Trojan_Lala_51Deb1F9 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Lala.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Lala.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3af65d3307fbdc2e8ce6e1358d1413ebff5eeb5dbedc051394377a4dabffa82"
-		logic_hash = "73a7ec230be9aabcc301095c9c075f839852155419bdd8d5542287f34699ab33"
+		logic_hash = "v1_sha256_73a7ec230be9aabcc301095c9c075f839852155419bdd8d5542287f34699ab33"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73826,10 +73826,10 @@ rule ELASTIC_Windows_Trojan_Bitrat_34Bd6C83 : FILE MEMORY
 		date = "2021-06-13"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bitrat.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bitrat.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "37f70ae0e4e671c739d402c00f708761e98b155a1eefbedff1236637c4b7690a"
-		logic_hash = "d386fc2a4b6a98638328d1aa05a8d8dbb7a1bbcd72943457b1a5a27b056744ef"
+		logic_hash = "v1_sha256_d386fc2a4b6a98638328d1aa05a8d8dbb7a1bbcd72943457b1a5a27b056744ef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73859,10 +73859,10 @@ rule ELASTIC_Windows_Trojan_Bitrat_54916275 : FILE MEMORY
 		date = "2022-08-29"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bitrat.yar#L25-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bitrat.yar#L25-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d3b2c410b431c006c59f14b33e95c0e44e6221b1118340c745911712296f659f"
-		logic_hash = "4c66f79f4bf6bde49bfb9208e6dc1d3b5d041927565e7302381838b0f32da6f4"
+		logic_hash = "v1_sha256_4c66f79f4bf6bde49bfb9208e6dc1d3b5d041927565e7302381838b0f32da6f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73888,10 +73888,10 @@ rule ELASTIC_Linux_Trojan_Mumblehard_523450Aa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mumblehard.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mumblehard.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a637ea8f070e1edf2c9c81450e83934c177696171b24b4dff32dfb23cefa56d3"
-		logic_hash = "60b4cc388975ce030e03c5c3a48adcfeec25299105206909163f20100fbf45d8"
+		logic_hash = "v1_sha256_60b4cc388975ce030e03c5c3a48adcfeec25299105206909163f20100fbf45d8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73917,10 +73917,10 @@ rule ELASTIC_Windows_Hacktool_Sharpstay_Eac706C5 : FILE MEMORY
 		date = "2022-11-20"
 		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpStay.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpStay.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "498d201f65b57a007a79259ce7015eb7eb1bba660d44deafea716e36316a9caa"
-		logic_hash = "b85679018658e33e81cd2589e9f99cf9ed16ac25b27d93bece26cb5ccc2e379a"
+		logic_hash = "v1_sha256_b85679018658e33e81cd2589e9f99cf9ed16ac25b27d93bece26cb5ccc2e379a"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -73939,7 +73939,7 @@ rule ELASTIC_Windows_Hacktool_Sharpstay_Eac706C5 : FILE MEMORY
 		$print_str3 = "[+] Cleaned up %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Indexing.{0}" ascii wide fullword
 
 	condition:
-		$guid or all of ($print_str*)
+		$guid or all of ( $print_str* )
 }
 rule ELASTIC_Windows_Trojan_Pipedance_01C18057 : FILE MEMORY
 {
@@ -73950,10 +73950,10 @@ rule ELASTIC_Windows_Trojan_Pipedance_01C18057 : FILE MEMORY
 		date = "2023-02-02"
 		modified = "2023-02-22"
 		reference = "https://www.elastic.co/security-labs/twice-around-the-dance-floor-with-pipedance"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PipeDance.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PipeDance.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9d3f739e35182992f1e3ade48b8999fb3a5049f48c14db20e38ee63eddc5a1e7"
-		logic_hash = "0c03a725ae930eb829d6a6a9f681489d61aa7f69e72b6b298776f75a98115398"
+		logic_hash = "v1_sha256_0c03a725ae930eb829d6a6a9f681489d61aa7f69e72b6b298776f75a98115398"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -73975,7 +73975,7 @@ rule ELASTIC_Windows_Trojan_Pipedance_01C18057 : FILE MEMORY
 		$seq_icmp = { 59 6A 61 5E 89 45 ?? 8B D0 89 5D ?? 2B F0 8D 04 16 8D 4B ?? 88 0A 83 F8 77 7E ?? 80 E9 17 88 0A 43 42 83 FB 20 }
 
 	condition:
-		4 of ($str*) or 2 of ($seq*)
+		4 of ( $str* ) or 2 of ( $seq* )
 }
 rule ELASTIC_Linux_Trojan_Ganiw_99349371 : FILE MEMORY
 {
@@ -73986,10 +73986,10 @@ rule ELASTIC_Linux_Trojan_Ganiw_99349371 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ganiw.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ganiw.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e8dbb246fdd1a50226a36c407ac90eb44b0cf5e92bf0b92c89218f474f9c2afb"
-		logic_hash = "26160e855c63fc0b73e415de2fe058f2005df1ec5544d21865d022c5474df30c"
+		logic_hash = "v1_sha256_26160e855c63fc0b73e415de2fe058f2005df1ec5544d21865d022c5474df30c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74015,9 +74015,9 @@ rule ELASTIC_Linux_Trojan_Ganiw_B9F045Aa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ganiw.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "2565101b261bee22ddecf6898ff0ac8a114d09c822d8db26ba3e3571ebe06b12"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ganiw.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2565101b261bee22ddecf6898ff0ac8a114d09c822d8db26ba3e3571ebe06b12"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74043,10 +74043,10 @@ rule ELASTIC_Linux_Trojan_Dnsamp_C31Eebd4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dnsamp.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dnsamp.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4b86de97819a49a90961d59f9c3ab9f8e57e19add9fe1237d2a2948b4ff22de6"
-		logic_hash = "b998065eff9f67a1cdf19644a13edb0cef3c619d8b6e16c412d58f5d538e4617"
+		logic_hash = "v1_sha256_b998065eff9f67a1cdf19644a13edb0cef3c619d8b6e16c412d58f5d538e4617"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74072,10 +74072,10 @@ rule ELASTIC_Multi_Generic_Threat_19854Dc2 : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Generic_Threat.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Generic_Threat.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "be216fa9cbf0b64d769d1e8ecddcfc3319c7ca8e610e438dcdfefc491730d208"
-		logic_hash = "beed6d6cd7b7b6eb3f4ab6a45fd19f2ebfb661e470d468691b68634994e2eef7"
+		logic_hash = "v1_sha256_beed6d6cd7b7b6eb3f4ab6a45fd19f2ebfb661e470d468691b68634994e2eef7"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -74101,10 +74101,10 @@ rule ELASTIC_Linux_Trojan_Sdbot_98628Ea1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sdbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sdbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5568ae1f8a1eb879eb4705db5b3820e36c5ecea41eb54a8eef5b742f477cbdd8"
-		logic_hash = "55b8e3fa755965b85a043015f9303644b8e06fe8bfdc0e2062de75bdc2881541"
+		logic_hash = "v1_sha256_55b8e3fa755965b85a043015f9303644b8e06fe8bfdc0e2062de75bdc2881541"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74130,10 +74130,10 @@ rule ELASTIC_Windows_Vulndriver_Elrawdisk_F9Fd1A80 : FILE
 		date = "2022-10-07"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_ElRawDisk.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_ElRawDisk.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ed4f2b3db9a79535228af253959a0749b93291ad8b1058c7a41644b73035931b"
-		logic_hash = "43f9f1f6ad6c1defe2f0d6dd0cd380bea1a8ead19bc0bf203bdfe4f83b9c284d"
+		logic_hash = "v1_sha256_43f9f1f6ad6c1defe2f0d6dd0cd380bea1a8ead19bc0bf203bdfe4f83b9c284d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -74148,7 +74148,7 @@ rule ELASTIC_Windows_Vulndriver_Elrawdisk_F9Fd1A80 : FILE
 		$str1 = "\\elrawdsk.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Multi_Trojan_Sliver_42298C4A : FILE MEMORY
 {
@@ -74159,10 +74159,10 @@ rule ELASTIC_Multi_Trojan_Sliver_42298C4A : FILE MEMORY
 		date = "2021-10-20"
 		modified = "2022-01-14"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Trojan_Sliver.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_Sliver.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007"
-		logic_hash = "a84bdb51fcdeb4629365bdb727b53087604ee0eb112c8d6c3ecf315598ec678a"
+		logic_hash = "v1_sha256_a84bdb51fcdeb4629365bdb727b53087604ee0eb112c8d6c3ecf315598ec678a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74194,10 +74194,10 @@ rule ELASTIC_Multi_Trojan_Sliver_3Bde542D : FILE MEMORY
 		date = "2022-08-31"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Trojan_Sliver.yar#L27-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_Sliver.yar#L27-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "05461e1c2a2e581a7c30e14d04bd3d09670e281f9f7c60f4169e9614d22ce1b3"
-		logic_hash = "23a0e28c1423f577a147efdf927f2dc71871760e38d4d7494ead2920b90ef05e"
+		logic_hash = "v1_sha256_23a0e28c1423f577a147efdf927f2dc71871760e38d4d7494ead2920b90ef05e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74217,7 +74217,7 @@ rule ELASTIC_Multi_Trojan_Sliver_3Bde542D : FILE MEMORY
 		$b5 = "RegistryReadReq" ascii fullword
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		1 of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Multi_Trojan_Sliver_3D6B7Cd3 : FILE MEMORY
 {
@@ -74228,10 +74228,10 @@ rule ELASTIC_Multi_Trojan_Sliver_3D6B7Cd3 : FILE MEMORY
 		date = "2022-12-01"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Trojan_Sliver.yar#L52-L88"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_Sliver.yar#L52-L88"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9846124cfd124eed466465d187eeacb4d405c558dd84ba8e575d8a7b3290403e"
-		logic_hash = "3cbd3358b7d59d6a2912069f4cb8de005b6fafd61e44111d1f6cf0418eb2d1fc"
+		logic_hash = "v1_sha256_3cbd3358b7d59d6a2912069f4cb8de005b6fafd61e44111d1f6cf0418eb2d1fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74264,7 +74264,7 @@ rule ELASTIC_Multi_Trojan_Sliver_3D6B7Cd3 : FILE MEMORY
 		$register_x86_5 = { 8B 04 24 89 84 24 ?? ?? ?? ?? 8B 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 04 24 8B 4C 24 ?? 8B 54 24 ?? 85 D2 74 ?? 31 C0 31 C9 89 4C 24 ?? 89 84 24 ?? ?? ?? ?? 8D 15 ?? ?? ?? ?? 89 14 24 E8 ?? ?? ?? ?? }
 
 	condition:
-		1 of ($session_start_*) and 1 of ($register_*)
+		1 of ( $session_start_* ) and 1 of ( $register_* )
 }
 rule ELASTIC_Windows_PUP_Mediaarena_A9E3B4A1 : FILE MEMORY
 {
@@ -74275,10 +74275,10 @@ rule ELASTIC_Windows_PUP_Mediaarena_A9E3B4A1 : FILE MEMORY
 		date = "2023-06-02"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_PUP_MediaArena.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_PUP_MediaArena.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c071e0b67e4c105c87b876183900f97a4e8bc1a7c18e61c028dee59ce690b1ac"
-		logic_hash = "8e52b29f2848498aae2fd7ad35494362d6c07f0e752b628840a256923aca32c7"
+		logic_hash = "v1_sha256_8e52b29f2848498aae2fd7ad35494362d6c07f0e752b628840a256923aca32c7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74310,9 +74310,9 @@ rule ELASTIC_Multi_EICAR_Ac8F42D6 : FILE MEMORY
 		date = "2021-01-21"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_EICAR.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "05c92058aab1229dfa31e006276c2c83fa484e813bdfe66edf387763797d9d57"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_EICAR.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_05c92058aab1229dfa31e006276c2c83fa484e813bdfe66edf387763797d9d57"
 		score = 75
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -74338,10 +74338,10 @@ rule ELASTIC_Macos_Virus_Maxofferdeal_53Df500F : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Virus_Maxofferdeal.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Virus_Maxofferdeal.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ecd62ef880da057726ca55c6826ce4e1584ec6fc3afaabed7f66154fc39ffef8"
-		logic_hash = "ed63c14e31c200f906b525c7ef1cd671511a89c8833cfa1a605fc9870fe91043"
+		logic_hash = "v1_sha256_ed63c14e31c200f906b525c7ef1cd671511a89c8833cfa1a605fc9870fe91043"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74367,10 +74367,10 @@ rule ELASTIC_Macos_Virus_Maxofferdeal_F4681Eba : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Virus_Maxofferdeal.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Virus_Maxofferdeal.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ecd62ef880da057726ca55c6826ce4e1584ec6fc3afaabed7f66154fc39ffef8"
-		logic_hash = "cf478ec5313b40d74d110e4d6e97da5f671d5af331adc3ab059a69616e78c76c"
+		logic_hash = "v1_sha256_cf478ec5313b40d74d110e4d6e97da5f671d5af331adc3ab059a69616e78c76c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74396,10 +74396,10 @@ rule ELASTIC_Macos_Virus_Maxofferdeal_4091E373 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Virus_Maxofferdeal.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Virus_Maxofferdeal.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c38c4bdd3c1fa16fd32db06d44d0db1b25bb099462f8d2936dbdd42af325b37c"
-		logic_hash = "ce82f6d3a2e4b7ffe7010629bf91a9144a94e50513682a6c0622603d28248d51"
+		logic_hash = "v1_sha256_ce82f6d3a2e4b7ffe7010629bf91a9144a94e50513682a6c0622603d28248d51"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74425,10 +74425,10 @@ rule ELASTIC_Macos_Virus_Maxofferdeal_20A0091E : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Virus_Maxofferdeal.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Virus_Maxofferdeal.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b00a61c908cd06dbc26bee059ba290e7ce2ad6b66c453ea272c7287ffa29c5ab"
-		logic_hash = "bb90b7e1637fd86e91763b4801a0b3bb8a1b956f328d07e96cf1b26e42b1931b"
+		logic_hash = "v1_sha256_bb90b7e1637fd86e91763b4801a0b3bb8a1b956f328d07e96cf1b26e42b1931b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74454,10 +74454,10 @@ rule ELASTIC_Linux_Webshell_Generic_E80Ff633 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Webshell_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Webshell_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7640ba6f2417931ef901044152d5bfe1b266219d13b5983d92ddbdf644de5818"
-		logic_hash = "d345e6ce3e51ed55064aafb1709e9bee7ef2ce87ec80165ac1b58eebd83cefee"
+		logic_hash = "v1_sha256_d345e6ce3e51ed55064aafb1709e9bee7ef2ce87ec80165ac1b58eebd83cefee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74483,9 +74483,9 @@ rule ELASTIC_Linux_Webshell_Generic_41A5Fa40 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "18ac7fbc3d8d3bb8581139a20a7fee8ea5b7fcfea4a9373e3d22c71bae3c9de0"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Webshell_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "574148bc58626aac00add1989c65ad56315c7e2a8d27c7b96be404d831a7a576"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Webshell_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_574148bc58626aac00add1989c65ad56315c7e2a8d27c7b96be404d831a7a576"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -74511,10 +74511,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_4557_B7E15F5E : FILE MEMORY CVE_2016_4557
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_4557.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_4557.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bbed2f81104b5eb4a8475deff73b29a350dc8b0f96dcc4987d0112b993675271"
-		logic_hash = "9c40233fec9607404ca4f78313e0f62922180e5ef88dbf801dd60725af61bdde"
+		logic_hash = "v1_sha256_9c40233fec9607404ca4f78313e0f62922180e5ef88dbf801dd60725af61bdde"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY, CVE-2016-4557"
@@ -74540,10 +74540,10 @@ rule ELASTIC_Linux_Trojan_Skidmap_Aa7B661D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Skidmap.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Skidmap.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4282ba9b7bee69d42bfff129fff45494fb8f7db0e1897fc5aa1e4265cb6831d9"
-		logic_hash = "aa976158d004d582234a92ff648d4581440f9c933a0abef212d9d837d9607ba4"
+		logic_hash = "v1_sha256_aa976158d004d582234a92ff648d4581440f9c933a0abef212d9d837d9607ba4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74569,10 +74569,10 @@ rule ELASTIC_Linux_Trojan_Skidmap_52Fb8489 : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Skidmap.yar#L21-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Skidmap.yar#L21-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4282ba9b7bee69d42bfff129fff45494fb8f7db0e1897fc5aa1e4265cb6831d9"
-		logic_hash = "9d199666f36a703b77d6b2a47e8d2065c25746a5776df63f5bfacb912afa582b"
+		logic_hash = "v1_sha256_9d199666f36a703b77d6b2a47e8d2065c25746a5776df63f5bfacb912afa582b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74605,7 +74605,7 @@ rule ELASTIC_Linux_Trojan_Skidmap_52Fb8489 : FILE MEMORY
 		$str4 = "kswaped"
 
 	condition:
-		3 of ($func*) or 4 of ($hook*) or 3 of ($str*)
+		3 of ( $func* ) or 4 of ( $hook* ) or 3 of ( $str* )
 }
 rule ELASTIC_Linux_Trojan_Backegmm_B59712E6 : FILE MEMORY
 {
@@ -74616,10 +74616,10 @@ rule ELASTIC_Linux_Trojan_Backegmm_B59712E6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Backegmm.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Backegmm.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d6c8e15cb65102b442b7ee42186c58fa69cd0cb68f4fd47eb5ad23763371e0be"
-		logic_hash = "a2e6016bfd8475880c28c89b5f5beeef1335de9529d44bbe7c5aaa352aab9a29"
+		logic_hash = "v1_sha256_a2e6016bfd8475880c28c89b5f5beeef1335de9529d44bbe7c5aaa352aab9a29"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74645,10 +74645,10 @@ rule ELASTIC_Linux_Trojan_Roopre_B6B9E71D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Roopre.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Roopre.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "36ae2bf773135fdb0ead7fbbd46f90fd41d6f973569de1941c8723158fc6cfcc"
-		logic_hash = "32294e476a014a919d2d738bdc940a7fc5f91e1b13c005f164a5b6bf84eb2635"
+		logic_hash = "v1_sha256_32294e476a014a919d2d738bdc940a7fc5f91e1b13c005f164a5b6bf84eb2635"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74674,10 +74674,10 @@ rule ELASTIC_Linux_Trojan_Roopre_05F7F237 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Roopre.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Roopre.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "36ae2bf773135fdb0ead7fbbd46f90fd41d6f973569de1941c8723158fc6cfcc"
-		logic_hash = "12e14ac31932033f2448b7a3bfd6ce826fff17494547ac4baefb20f6713baf5f"
+		logic_hash = "v1_sha256_12e14ac31932033f2448b7a3bfd6ce826fff17494547ac4baefb20f6713baf5f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74703,10 +74703,10 @@ rule ELASTIC_Windows_Clickfraud_Luckyslots_A82433B6 : FILE MEMORY
 		date = "2024-08-21"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Clickfraud_LuckySlots.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Clickfraud_LuckySlots.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6503770b34c53025793f1674af87d80a8f6ed44b5780490796012a2b771b8f84"
-		logic_hash = "342dafb67ae8557de66ac810482e2747ae88c76f07c244f1a465351fcc72cab9"
+		logic_hash = "v1_sha256_342dafb67ae8557de66ac810482e2747ae88c76f07c244f1a465351fcc72cab9"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -74738,10 +74738,10 @@ rule ELASTIC_Linux_Backdoor_Python_00606Bac : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Backdoor_Python.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Backdoor_Python.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b3e3728d43535f47a1c15b915c2d29835d9769a9dc69eb1b16e40d5ba1b98460"
-		logic_hash = "92ad2cf4aa848c8f3bcedd319654bf5ef873cd4daba62572381c7e20f0296b82"
+		logic_hash = "v1_sha256_92ad2cf4aa848c8f3bcedd319654bf5ef873cd4daba62572381c7e20f0296b82"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74767,10 +74767,10 @@ rule ELASTIC_Windows_Trojan_Asyncrat_11A11Ba1 : FILE MEMORY
 		date = "2021-08-05"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Asyncrat.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Asyncrat.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1"
-		logic_hash = "c6c4ce9ccf01c280be6c25c0c82c34b601626bc200b84d3e77b08be473335d3d"
+		logic_hash = "v1_sha256_c6c4ce9ccf01c280be6c25c0c82c34b601626bc200b84d3e77b08be473335d3d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74801,10 +74801,10 @@ rule ELASTIC_Windows_Trojan_M0Yv_92F66467 : FILE MEMORY
 		date = "2023-05-03"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_M0yv.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_M0yv.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0004d22dd18c0239b722c085101c0a32b967159e2066a0b7b9104bb43f5cdea0"
-		logic_hash = "a47b20679aee9559213de22783cfbc55c6091785e4dc288349963e863b78cf41"
+		logic_hash = "v1_sha256_a47b20679aee9559213de22783cfbc55c6091785e4dc288349963e863b78cf41"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -74832,10 +74832,10 @@ rule ELASTIC_Windows_Trojan_Whispergate_9192618B : FILE MEMORY
 		date = "2022-01-17"
 		modified = "2022-01-17"
 		reference = "https://www.elastic.co/security-labs/operation-bleeding-bear"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_WhisperGate.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_WhisperGate.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
-		logic_hash = "28bb08d61d99d2bfc49ba18cdbabc34c31a715ae6439ab25bbce8cc6958ed381"
+		logic_hash = "v1_sha256_28bb08d61d99d2bfc49ba18cdbabc34c31a715ae6439ab25bbce8cc6958ed381"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74865,10 +74865,10 @@ rule ELASTIC_Linux_Exploit_Intfour_0Ca45Cd3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Intfour.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Intfour.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9d32c5447aa5182b4be66b7a283616cf531a2fd3ba3dde1bc363b24d8b22682f"
-		logic_hash = "088d8daa9ba4f53c8de229282ed8a7b30b1e567687e7807ac6c3df9524dabba9"
+		logic_hash = "v1_sha256_088d8daa9ba4f53c8de229282ed8a7b30b1e567687e7807ac6c3df9524dabba9"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -74894,10 +74894,10 @@ rule ELASTIC_Linux_Downloader_Generic_0Bd15Ae0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Downloader_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Downloader_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e511efb068e76a4a939c2ce2f2f0a089ef55ca56ee5f2ba922828d23e6181f09"
-		logic_hash = "c9558562d9e9d3b55bd1fba9e55b332e6b4db5a170e0dd349bef1e35f0c7fd21"
+		logic_hash = "v1_sha256_c9558562d9e9d3b55bd1fba9e55b332e6b4db5a170e0dd349bef1e35f0c7fd21"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74923,9 +74923,9 @@ rule ELASTIC_Windows_Trojan_Rudebird_3Cbf7Bc6 : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RudeBird.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "2095c3b6bde779b5661c7796b5e33bb0c43facf791b272a603b786f889a06a95"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RudeBird.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2095c3b6bde779b5661c7796b5e33bb0c43facf791b272a603b786f889a06a95"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74951,10 +74951,10 @@ rule ELASTIC_Linux_Cryptominer_Bscope_348B7Fa0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Bscope.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Bscope.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a6fb80d77986e00a6b861585bd4e573a927e970fb0061bf5516f83400ad7c0db"
-		logic_hash = "bc6a59dcc36676273c61fa71231fd8709884beebb7ab64b58f22551393b20c71"
+		logic_hash = "v1_sha256_bc6a59dcc36676273c61fa71231fd8709884beebb7ab64b58f22551393b20c71"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -74980,10 +74980,10 @@ rule ELASTIC_Linux_Hacktool_Earthworm_4De7B584 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Earthworm.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Earthworm.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9d61aabcf935121b4f7fc6b0d082d7d6c31cb43bf253a8603dd46435e66b7955"
-		logic_hash = "019b2504df192e673f96a86464bb5e8ba5e89190e51bfe7d702753f76c00b979"
+		logic_hash = "v1_sha256_019b2504df192e673f96a86464bb5e8ba5e89190e51bfe7d702753f76c00b979"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -75009,10 +75009,10 @@ rule ELASTIC_Linux_Hacktool_Earthworm_E3Da43E2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Earthworm.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Earthworm.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "da0cffc4222d11825778fe4fa985fef2945caa0cc3b4de26af0a06509ebafb21"
-		logic_hash = "b129b7060b6af4ff2aae2678a455b969579132891fba44e4fdc2481a5437bdf9"
+		logic_hash = "v1_sha256_b129b7060b6af4ff2aae2678a455b969579132891fba44e4fdc2481a5437bdf9"
 		score = 60
 		quality = 45
 		tags = "FILE, MEMORY"
@@ -75038,10 +75038,10 @@ rule ELASTIC_Linux_Hacktool_Earthworm_82D5C4Cf : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Earthworm.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Earthworm.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dc412d4f2b0e9ca92063a47adfb0657507d3f2a54a415619db5a7ccb59afb204"
-		logic_hash = "81f35293bd3dd0cfbbf67f036773e16625bb74e06320fa1fff5bc428ef2f3a43"
+		logic_hash = "v1_sha256_81f35293bd3dd0cfbbf67f036773e16625bb74e06320fa1fff5bc428ef2f3a43"
 		score = 60
 		quality = 45
 		tags = "FILE, MEMORY"
@@ -75067,10 +75067,10 @@ rule ELASTIC_Linux_Hacktool_Earthworm_4Ec2Ec63 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Earthworm.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Earthworm.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dc412d4f2b0e9ca92063a47adfb0657507d3f2a54a415619db5a7ccb59afb204"
-		logic_hash = "25f616c5440a48aef0f824cb6859e88787db4f42c1ec904a3d3bd72f3a64116e"
+		logic_hash = "v1_sha256_25f616c5440a48aef0f824cb6859e88787db4f42c1ec904a3d3bd72f3a64116e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75096,10 +75096,10 @@ rule ELASTIC_Windows_Hacktool_Darkloadlibrary_C25Ee4Eb : FILE MEMORY
 		date = "2022-12-02"
 		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_DarkLoadLibrary.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_DarkLoadLibrary.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5546194a71bc449789c3697f9c106860ac0a21e1ccf2b1196120b3f92f4b5306"
-		logic_hash = "c585abbe72834e9ba2e5f1c8070a43b0f10c2b574c72ffe1def4bfd431096415"
+		logic_hash = "v1_sha256_c585abbe72834e9ba2e5f1c8070a43b0f10c2b574c72ffe1def4bfd431096415"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -75124,7 +75124,7 @@ rule ELASTIC_Windows_Hacktool_Darkloadlibrary_C25Ee4Eb : FILE MEMORY
 		$print_str9 = "Failed to close handle on DLL file" wide
 
 	condition:
-		$guid or 4 of ($print_str*)
+		$guid or 4 of ( $print_str* )
 }
 rule ELASTIC_Linux_Rootkit_Generic_61229Bdf : FILE MEMORY
 {
@@ -75135,9 +75135,9 @@ rule ELASTIC_Linux_Rootkit_Generic_61229Bdf : FILE MEMORY
 		date = "2024-11-14"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Generic.yar#L1-L74"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "624c599a073c59f9c7f7c7492053470e4aafd1735519bf2c3eef290999e4e4ad"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Generic.yar#L1-L74"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_624c599a073c59f9c7f7c7492053470e4aafd1735519bf2c3eef290999e4e4ad"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -75208,7 +75208,140 @@ rule ELASTIC_Linux_Rootkit_Generic_61229Bdf : FILE MEMORY
 		$str57 = "unhide_udp6_port"
 
 	condition:
-		4 of ($str*)
+		4 of ( $str* )
+}
+rule ELASTIC_Linux_Rootkit_Generic_482Bca48 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Rootkit Generic (Linux.Rootkit.Generic)"
+		author = "Elastic Security"
+		id = "482bca48-c337-45d9-9513-301909cbda73"
+		date = "2024-11-14"
+		modified = "2024-12-09"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Generic.yar#L76-L116"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_5b73588523e7ae66e9346c1b7a078cc04fab42672c8d2ff5900d4346385143c7"
+		score = 75
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "a2a005777e1bc236a30f3efff8d85af360665bd9418b77aa8d0aaf72a72df88a"
+		severity = 100
+		arch_context = "x86, arm64"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$str1 = "sys_call_table"
+		$str2 = "kallsyms_lookup_name"
+		$str3 = "retpoline=Y"
+		$str4 = "kprobe"
+		$rk1 = "rootkit"
+		$rk2 = "hide_"
+		$rk3 = "hacked_"
+		$rk4 = "fake_"
+		$rk5 = "hooked_"
+		$hook1 = "_getdents"
+		$hook2 = "_kill"
+		$hook3 = "_seq_show_ipv4_tcp"
+		$hook4 = "_seq_show_ipv4_udp"
+		$hook5 = "_seq_show_ipv6_tcp"
+		$hook6 = "_seq_show_ipv6_udp"
+		$hook7 = "_tcp4_port"
+		$hook8 = "_tcp4_seq_show"
+		$hook9 = "_tcp6_port"
+		$hook10 = "_tcp6_seq_show"
+		$hook11 = "_udp4_port"
+		$hook12 = "_udp4_seq_show"
+		$hook13 = "_udp6_port"
+		$hook14 = "_udp6_seq_show"
+		$hook15 = "_unlink"
+
+	condition:
+		3 of ( $str* ) and ( ( all of ( $rk* ) ) or ( 3 of ( $rk* ) and 5 of ( $hook* ) ) )
+}
+rule ELASTIC_Linux_Rootkit_Generic_D0C5Cfe0 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Rootkit Generic (Linux.Rootkit.Generic)"
+		author = "Elastic Security"
+		id = "d0c5cfe0-850b-432c-924d-547252ca0dd0"
+		date = "2024-11-14"
+		modified = "2024-12-09"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Generic.yar#L118-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e5d7e5a7147724f3c6baa3697ab51ed105d34ffbd7a14dec22a95181a6361d5f"
+		score = 75
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "6c005d7126485220c8ea1a7fb2a3215ade16f1b9dda7b89daf7a8cc408288efa"
+		severity = 100
+		arch_context = "x86, arm64"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$str1 = "sys_call_table"
+		$str2 = "kallsyms_lookup_name"
+		$str3 = "retpoline=Y"
+		$str4 = "kprobe"
+		$init1 = "init_module"
+		$init2 = "finit_module"
+		$hook1 = "getdents"
+		$hook2 = "seq_show_ipv4_tcp"
+		$hook3 = "seq_show_ipv4_udp"
+		$hook4 = "seq_show_ipv6_tcp"
+		$hook5 = "seq_show_ipv6_udp"
+		$hook6 = "sys_kill"
+		$hook7 = "tcp4_port"
+		$hook8 = "tcp4_seq_show"
+		$hook9 = "tcp6_port"
+		$hook10 = "tcp6_seq_show"
+		$hook11 = "udp4_port"
+		$hook12 = "udp4_seq_show"
+		$hook13 = "udp6_port"
+		$hook14 = "udp6_seq_show"
+		$rk1 = "rootkit"
+		$rk2 = "dropper"
+		$rk3 = "hide"
+		$rk4 = "hook"
+		$rk5 = "hacked"
+
+	condition:
+		2 of ( $str* ) and 1 of ( $init* ) and 3 of ( $hook* ) and 3 of ( $rk* )
+}
+rule ELASTIC_Linux_Rootkit_Generic_F07Bcabe : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Rootkit Generic (Linux.Rootkit.Generic)"
+		author = "Elastic Security"
+		id = "f07bcabe-f91e-4872-8677-dee6307e79d0"
+		date = "2024-12-02"
+		modified = "2024-12-09"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Generic.yar#L161-L180"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2e63ceede0347ad6cf80f9a0d8acce42c8b34bd1a549cfc20993af76f780dd2f"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "7335426e705383ff6f62299943a139390b83ce2af4cbfc145cfe78c0f0015a26"
+		severity = 100
+		arch_context = "x86, arm64"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$str1 = "fh_install_hook"
+		$str2 = "fh_remove_hook"
+		$str3 = "fh_resolve_hook_address"
+
+	condition:
+		2 of them
 }
 rule ELASTIC_Linux_Cryptominer_Attribute_3683D149 : FILE MEMORY
 {
@@ -75219,10 +75352,10 @@ rule ELASTIC_Linux_Cryptominer_Attribute_3683D149 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Attribute.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Attribute.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ec9e74d52d745275718fe272bfd755335739ad5f680f73f5a4e66df6eb141a63"
-		logic_hash = "71aa8aa4171671af4aa0271b64da95ac1d8766de12a949c97ebcac9369224ecd"
+		logic_hash = "v1_sha256_71aa8aa4171671af4aa0271b64da95ac1d8766de12a949c97ebcac9369224ecd"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -75248,10 +75381,10 @@ rule ELASTIC_Windows_Ransomware_Akira_C8C298Ba : FILE MEMORY
 		date = "2024-05-02"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Akira.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Akira.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a2df5477cf924bd41241a3326060cc2f913aff2379858b148ddec455e4da67bc"
-		logic_hash = "9058c83693e93f6daee8894453e56e0d9a4867d551ec3a6b66d7a517f65d8b07"
+		logic_hash = "v1_sha256_9058c83693e93f6daee8894453e56e0d9a4867d551ec3a6b66d7a517f65d8b07"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75282,9 +75415,9 @@ rule ELASTIC_Windows_Ransomware_Snake_550E0265 : BETA FILE MEMORY
 		date = "2020-06-30"
 		modified = "2021-08-23"
 		reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Snake.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d9c2f6961a4ef560743060ed176bdc606561ca1b8270b8826cb0dbadaf4e5dbc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Snake.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d9c2f6961a4ef560743060ed176bdc606561ca1b8270b8826cb0dbadaf4e5dbc"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -75304,7 +75437,7 @@ rule ELASTIC_Windows_Ransomware_Snake_550E0265 : BETA FILE MEMORY
 		$a5 = "%Desktop%\\Fix-Your-Files.txt" nocase
 
 	condition:
-		1 of ($a*)
+		1 of ( $a* )
 }
 rule ELASTIC_Windows_Ransomware_Snake_119F9C83 : BETA FILE MEMORY
 {
@@ -75315,9 +75448,9 @@ rule ELASTIC_Windows_Ransomware_Snake_119F9C83 : BETA FILE MEMORY
 		date = "2020-06-30"
 		modified = "2021-08-23"
 		reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Snake.yar#L26-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "cf6c81e7332acc798409a05a548460bad0ac3621402672c242e48a1b6bccdae6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Snake.yar#L26-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_cf6c81e7332acc798409a05a548460bad0ac3621402672c242e48a1b6bccdae6"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -75334,7 +75467,7 @@ rule ELASTIC_Windows_Ransomware_Snake_119F9C83 : BETA FILE MEMORY
 		$c2 = { 00 30 64 7C 00 50 64 7C 00 70 64 7C 00 B0 64 7C 00 D0 64 7C 00 30 73 7C 00 F0 64 7C 00 90 71 7C 00 10 65 7C 00 30 65 7C 00 50 65 7C 00 90 72 7C 00 B0 72 7C 00 70 6E 7C 00 70 65 7C 00 B0 65 7C 00 D0 65 7C 00 F0 65 7C 00 10 66 7C 00 30 66 7C 00 50 66 7C 00 70 66 7C 00 90 66 7C 00 B0 66 7C 00 D0 66 7C 00 F0 66 7C 00 30 67 7C 00 90 6E 7C 00 B0 6E 7C 00 D0 6E 7C }
 
 	condition:
-		1 of ($c*)
+		1 of ( $c* )
 }
 rule ELASTIC_Windows_Ransomware_Snake_20Bc5Abc : BETA FILE MEMORY
 {
@@ -75345,9 +75478,9 @@ rule ELASTIC_Windows_Ransomware_Snake_20Bc5Abc : BETA FILE MEMORY
 		date = "2020-06-30"
 		modified = "2021-08-23"
 		reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Snake.yar#L48-L67"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "f3d8a523e04e516e8e059c9f13df355e6caf29a528cfebdf730e3a7d135e3351"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Snake.yar#L48-L67"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_f3d8a523e04e516e8e059c9f13df355e6caf29a528cfebdf730e3a7d135e3351"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -75363,7 +75496,7 @@ rule ELASTIC_Windows_Ransomware_Snake_20Bc5Abc : BETA FILE MEMORY
 		$b1 = { 57 12 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A }
 
 	condition:
-		1 of ($b*)
+		1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Fickerstealer_Cc02E75E : FILE MEMORY
 {
@@ -75374,10 +75507,10 @@ rule ELASTIC_Windows_Trojan_Fickerstealer_Cc02E75E : FILE MEMORY
 		date = "2021-07-22"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Fickerstealer.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Fickerstealer.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a4113ccb55e06e783b6cb213647614f039aa7dbb454baa338459ccf37897ebd6"
-		logic_hash = "ccfd7edf7625c13eea5b88fa29f9b8d3d873688f328f3e52c0500ac722c84511"
+		logic_hash = "v1_sha256_ccfd7edf7625c13eea5b88fa29f9b8d3d873688f328f3e52c0500ac722c84511"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -75404,10 +75537,10 @@ rule ELASTIC_Windows_Trojan_Fickerstealer_F2159Bec : FILE MEMORY
 		date = "2021-07-22"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Fickerstealer.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Fickerstealer.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a4113ccb55e06e783b6cb213647614f039aa7dbb454baa338459ccf37897ebd6"
-		logic_hash = "d36cb90b526a291858291d615272baa78881309c83376f4d4cce1768c740ddbc"
+		logic_hash = "v1_sha256_d36cb90b526a291858291d615272baa78881309c83376f4d4cce1768c740ddbc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75433,10 +75566,10 @@ rule ELASTIC_Linux_Ransomware_Redalert_39642D52 : FILE MEMORY
 		date = "2022-07-06"
 		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_RedAlert.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_RedAlert.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09"
-		logic_hash = "fa8fc16f0c8a55dd78781d334d7f55db6aa5e60f76cebf5282150af8ceb08dc3"
+		logic_hash = "v1_sha256_fa8fc16f0c8a55dd78781d334d7f55db6aa5e60f76cebf5282150af8ceb08dc3"
 		score = 75
 		quality = 48
 		tags = "FILE, MEMORY"
@@ -75455,7 +75588,7 @@ rule ELASTIC_Linux_Ransomware_Redalert_39642D52 : FILE MEMORY
 		$byte_checkvm = { 48 8B 14 DD ?? ?? ?? ?? 31 C0 48 83 C9 FF FC 48 89 EE 48 89 D7 F2 AE 4C 89 E7 48 F7 D1 E8 }
 
 	condition:
-		3 of ($str_*) or ($byte_checkvm and $str_print)
+		3 of ( $str_* ) or ( $byte_checkvm and $str_print )
 }
 rule ELASTIC_Macos_Backdoor_Useragent_1A02Fc3A : FILE MEMORY
 {
@@ -75466,10 +75599,10 @@ rule ELASTIC_Macos_Backdoor_Useragent_1A02Fc3A : FILE MEMORY
 		date = "2021-11-11"
 		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Backdoor_Useragent.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Backdoor_Useragent.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "623f99cbe20af8b79cbfea7f485d47d3462d927153d24cac4745d7043c15619a"
-		logic_hash = "90debdfc24ef100952302808a2e418bca2a46be3e505add9a0ccf4c49aff5102"
+		logic_hash = "v1_sha256_90debdfc24ef100952302808a2e418bca2a46be3e505add9a0ccf4c49aff5102"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75499,10 +75632,10 @@ rule ELASTIC_Windows_Trojan_Xeno_F92Ffb82 : FILE MEMORY
 		date = "2024-10-10"
 		modified = "2024-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Xeno.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Xeno.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "22dbdbcdd4c8b6899006f9f07e87c19b6a2947eeff8cc89c653309379b388cf4"
-		logic_hash = "17d5107b297c150cf737382c175e491e6bc4b17b2db583ff193f4acd40fdd459"
+		logic_hash = "v1_sha256_17d5107b297c150cf737382c175e491e6bc4b17b2db583ff193f4acd40fdd459"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75528,10 +75661,10 @@ rule ELASTIC_Windows_Trojan_Xeno_89F9F060 : FILE MEMORY
 		date = "2024-10-25"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Xeno.yar#L21-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Xeno.yar#L21-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b74733d68e95220ab0630a68ddf973b0c959fd421628e639c1b91e465ba9299b"
-		logic_hash = "a98bf8d1411449b41f0e35d368de3355ace837d9a406eee4f8fb087737eb283e"
+		logic_hash = "v1_sha256_a98bf8d1411449b41f0e35d368de3355ace837d9a406eee4f8fb087737eb283e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75552,7 +75685,7 @@ rule ELASTIC_Windows_Trojan_Xeno_89F9F060 : FILE MEMORY
 		$str_5 = "XenoStealer" ascii fullword
 
 	condition:
-		(($sc_1 or $sc_2) and ($str_1 or $str_2)) and (1 of ($str_3,$str_4,$str_5))
+		(( $sc_1 or $sc_2 ) and ( $str_1 or $str_2 ) ) and ( 1 of ( $str_3 , $str_4 , $str_5 ) )
 }
 rule ELASTIC_Windows_Trojan_Caesarkbd_32Bb198B : FILE
 {
@@ -75563,10 +75696,10 @@ rule ELASTIC_Windows_Trojan_Caesarkbd_32Bb198B : FILE
 		date = "2022-04-04"
 		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CaesarKbd.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CaesarKbd.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d4335f4189240a3bcafa05fab01f0707cc8e3dd7a2998af734c24916d9e37ca8"
-		logic_hash = "f708706524515f98ebf612ac98318ee7172347096251d9ccd723f439070521de"
+		logic_hash = "v1_sha256_f708706524515f98ebf612ac98318ee7172347096251d9ccd723f439070521de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -75581,7 +75714,7 @@ rule ELASTIC_Windows_Trojan_Caesarkbd_32Bb198B : FILE
 		$str1 = "CaesarKbd_IOCtrl"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Vulndriver_Xtier_48Bb4B2C : FILE
 {
@@ -75592,10 +75725,10 @@ rule ELASTIC_Windows_Vulndriver_Xtier_48Bb4B2C : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_XTier.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_XTier.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0f726d8ce21c0c9e01ebe6b55913c519ad6086bcaec1a89f8308f3effacd435f"
-		logic_hash = "fd6ae610a4d2cbf02aae2302d181d07780e723ac7e61b5aa3fd18ba834160729"
+		logic_hash = "v1_sha256_fd6ae610a4d2cbf02aae2302d181d07780e723ac7e61b5aa3fd18ba834160729"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -75612,7 +75745,7 @@ rule ELASTIC_Windows_Vulndriver_Xtier_48Bb4B2C : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Xtier_8A2F6Dc1 : FILE
 {
@@ -75623,10 +75756,10 @@ rule ELASTIC_Windows_Vulndriver_Xtier_8A2F6Dc1 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_XTier.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_XTier.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
-		logic_hash = "90e1efd9d918f15459dd3fabb4737cbdeded66da1d556becca051bdda5867c11"
+		logic_hash = "v1_sha256_90e1efd9d918f15459dd3fabb4737cbdeded66da1d556becca051bdda5867c11"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -75643,7 +75776,7 @@ rule ELASTIC_Windows_Vulndriver_Xtier_8A2F6Dc1 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Xtier_F4760D4A : FILE
 {
@@ -75654,10 +75787,10 @@ rule ELASTIC_Windows_Vulndriver_Xtier_F4760D4A : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_XTier.yar#L45-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_XTier.yar#L45-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0e14a4401011a9f4e444028ac5b1595da34bbbf9af04a00670f15ff839734003"
-		logic_hash = "dc83771e08b8530bf138782ba8c7724e7ecff40c973407a7f654346302a284d5"
+		logic_hash = "v1_sha256_dc83771e08b8530bf138782ba8c7724e7ecff40c973407a7f654346302a284d5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -75674,7 +75807,7 @@ rule ELASTIC_Windows_Vulndriver_Xtier_F4760D4A : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Xtier_6A7De49F : FILE
 {
@@ -75685,10 +75818,10 @@ rule ELASTIC_Windows_Vulndriver_Xtier_6A7De49F : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_XTier.yar#L67-L87"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_XTier.yar#L67-L87"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "26c86227d3f387897c1efd77dc711eef748eb90be84149cb306e3d4c45cc71c7"
-		logic_hash = "de0d25377103d50b33a95a804b9c3eb9ef221d56fa1dfda0a32f14dcd95ee4b1"
+		logic_hash = "v1_sha256_de0d25377103d50b33a95a804b9c3eb9ef221d56fa1dfda0a32f14dcd95ee4b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -75705,7 +75838,7 @@ rule ELASTIC_Windows_Vulndriver_Xtier_6A7De49F : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Linux_Backdoor_Bash_E427876D : FILE MEMORY
 {
@@ -75716,10 +75849,10 @@ rule ELASTIC_Linux_Backdoor_Bash_E427876D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Backdoor_Bash.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Backdoor_Bash.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
-		logic_hash = "fdd066b746416730419787d21eb53fa2ba997679a237d9db3a2e1365d43df892"
+		logic_hash = "v1_sha256_fdd066b746416730419787d21eb53fa2ba997679a237d9db3a2e1365d43df892"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -75745,10 +75878,10 @@ rule ELASTIC_Windows_Hacktool_Certify_Ffe1Cca2 : FILE MEMORY
 		date = "2024-03-27"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Certify.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Certify.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3c7f759a6c38d0c0780fba2d43be6dcf9e4869d54b66f16c0703ec8e58124953"
-		logic_hash = "e1d37ad683bfbe34433dc5e13ae2cf7c873fed640e1c58a3b0274b4b34900e53"
+		logic_hash = "v1_sha256_e1d37ad683bfbe34433dc5e13ae2cf7c873fed640e1c58a3b0274b4b34900e53"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -75771,7 +75904,7 @@ rule ELASTIC_Windows_Hacktool_Certify_Ffe1Cca2 : FILE MEMORY
 		$b4 = "Certify.exe request /ca" wide
 
 	condition:
-		all of ($a*) or any of ($b*)
+		all of ( $a* ) or any of ( $b* )
 }
 rule ELASTIC_Linux_Rootkit_Reptile_B2Ccf852 : FILE MEMORY
 {
@@ -75782,10 +75915,10 @@ rule ELASTIC_Linux_Rootkit_Reptile_B2Ccf852 : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Reptile.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Reptile.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "331494780c1869e8367c3e16a2b99aeadc604c73b87f09a01dda00ade686675b"
-		logic_hash = "efb4c0a9894e09b5a2a614a02810524e66b21f00b76ad583cc1eb551f4a73dcc"
+		logic_hash = "v1_sha256_efb4c0a9894e09b5a2a614a02810524e66b21f00b76ad583cc1eb551f4a73dcc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75804,7 +75937,7 @@ rule ELASTIC_Linux_Rootkit_Reptile_B2Ccf852 : FILE MEMORY
 		$func5 = "reptile_exit"
 
 	condition:
-		2 of ($func*)
+		2 of ( $func* )
 }
 rule ELASTIC_Linux_Rootkit_Reptile_C9F8806D : FILE MEMORY
 {
@@ -75815,10 +75948,10 @@ rule ELASTIC_Linux_Rootkit_Reptile_C9F8806D : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Reptile.yar#L25-L53"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Reptile.yar#L25-L53"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "331494780c1869e8367c3e16a2b99aeadc604c73b87f09a01dda00ade686675b"
-		logic_hash = "de1f8dc139ca506581119edcbd8d9b19576b0522e86b7f36713538f67a235446"
+		logic_hash = "v1_sha256_de1f8dc139ca506581119edcbd8d9b19576b0522e86b7f36713538f67a235446"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75843,7 +75976,7 @@ rule ELASTIC_Linux_Rootkit_Reptile_C9F8806D : FILE MEMORY
 		$blob = "_blob"
 
 	condition:
-		((3 of ($str*)) or ( all of ($loader*))) and $blob
+		(( 3 of ( $str* ) ) or ( all of ( $loader* ) ) ) and $blob
 }
 rule ELASTIC_Linux_Rootkit_Reptile_Eb201301 : FILE MEMORY
 {
@@ -75854,10 +75987,10 @@ rule ELASTIC_Linux_Rootkit_Reptile_Eb201301 : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Reptile.yar#L55-L92"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Reptile.yar#L55-L92"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "331494780c1869e8367c3e16a2b99aeadc604c73b87f09a01dda00ade686675b"
-		logic_hash = "665c791cdcdc3aed7b9dcd6b839b12e3f9a838bef54c698b5d353b44922ea87c"
+		logic_hash = "v1_sha256_665c791cdcdc3aed7b9dcd6b839b12e3f9a838bef54c698b5d353b44922ea87c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75891,7 +76024,7 @@ rule ELASTIC_Linux_Rootkit_Reptile_Eb201301 : FILE MEMORY
 		$rep2 = "S3cr3tP@ss"
 
 	condition:
-		all of ($rep*) or (1 of ($str*) and (4 of ($opt*) or 4 of ($help*)))
+		all of ( $rep* ) or ( 1 of ( $str* ) and ( 4 of ( $opt* ) or 4 of ( $help* ) ) )
 }
 rule ELASTIC_Linux_Rootkit_Reptile_85Abf958 : FILE MEMORY
 {
@@ -75902,10 +76035,10 @@ rule ELASTIC_Linux_Rootkit_Reptile_85Abf958 : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Reptile.yar#L94-L118"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Reptile.yar#L94-L118"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "331494780c1869e8367c3e16a2b99aeadc604c73b87f09a01dda00ade686675b"
-		logic_hash = "955dc251eeec64216eafa5c1ff7574e2ee96e72413b689ba147de9fbfc994864"
+		logic_hash = "v1_sha256_955dc251eeec64216eafa5c1ff7574e2ee96e72413b689ba147de9fbfc994864"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75926,7 +76059,7 @@ rule ELASTIC_Linux_Rootkit_Reptile_85Abf958 : FILE MEMORY
 		$str2 = "exec bash --rcfi"
 
 	condition:
-		any of ($byte*) or all of ($str*)
+		any of ( $byte* ) or all of ( $str* )
 }
 rule ELASTIC_Linux_Cryptominer_Ksmdbot_Ebeedb3C : FILE MEMORY
 {
@@ -75937,10 +76070,10 @@ rule ELASTIC_Linux_Cryptominer_Ksmdbot_Ebeedb3C : FILE MEMORY
 		date = "2022-12-14"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Ksmdbot.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Ksmdbot.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b927e0fe58219305d86df8b3e44493a7c854a6ea4f76d1ebe531a7bfd4365b54"
-		logic_hash = "67f97cc4f2886ed296b5b3827dc1d1792136ba8d9d27c20b677c9467618c879d"
+		logic_hash = "v1_sha256_67f97cc4f2886ed296b5b3827dc1d1792136ba8d9d27c20b677c9467618c879d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -75970,11 +76103,11 @@ rule ELASTIC_Windows_Vulndriver_Iobitunlocker_Defb90Fd : FILE
 		date = "2023-07-25"
 		modified = "2023-07-25"
 		reference = "https://theevilbit.github.io/posts/iobit_unlocker_lpe/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_IoBitUnlocker.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_IoBitUnlocker.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0aff83f28d70f425539fee3d6a780210d0406264f8a4eb124e32b074e8ffd556"
 		hash = "5ce1a8eac73ef1d0741f34d9fb2661da322117a63bffe60ccad092da89664c42"
-		logic_hash = "4b0f440c66b7c9a193f0d6675c2a4246036ebc5c0c83856f45ec40a041e9cd07"
+		logic_hash = "v1_sha256_4b0f440c66b7c9a193f0d6675c2a4246036ebc5c0c83856f45ec40a041e9cd07"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -75993,7 +76126,7 @@ rule ELASTIC_Windows_Vulndriver_Iobitunlocker_Defb90Fd : FILE
 		$pdb_filename = "IObitUnlocker.pdb" fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and (($original_file_name and $product_version) or ($subject and $pdb_filename))
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and ( ( $original_file_name and $product_version ) or ( $subject and $pdb_filename ) )
 }
 rule ELASTIC_Windows_Trojan_Bumblebee_35F50Bea : FILE MEMORY
 {
@@ -76004,10 +76137,10 @@ rule ELASTIC_Windows_Trojan_Bumblebee_35F50Bea : FILE MEMORY
 		date = "2022-04-28"
 		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bumblebee.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bumblebee.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6"
-		logic_hash = "9f22b1b7f9e2d7858738d02730ef5477f8d430ad3606ebf4ac8b01314fdc9c46"
+		logic_hash = "v1_sha256_9f22b1b7f9e2d7858738d02730ef5477f8d430ad3606ebf4ac8b01314fdc9c46"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76034,10 +76167,10 @@ rule ELASTIC_Windows_Trojan_Bumblebee_70Bed4F3 : FILE MEMORY
 		date = "2022-04-28"
 		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bumblebee.yar#L22-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bumblebee.yar#L22-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6"
-		logic_hash = "3ff97986bfd8df812c4ef94395b3ac7f9ead4d059c398f8984ee217a1bcee4af"
+		logic_hash = "v1_sha256_3ff97986bfd8df812c4ef94395b3ac7f9ead4d059c398f8984ee217a1bcee4af"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76069,10 +76202,10 @@ rule ELASTIC_Windows_Trojan_Spectralviper_43Abeeeb : FILE MEMORY
 		date = "2023-04-13"
 		modified = "2023-05-26"
 		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SpectralViper.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SpectralViper.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb"
-		logic_hash = "976e5b5b4ba73f1b392c2f6b32a86b09b5fd9e5a3510c60b77a39f1e0d705822"
+		logic_hash = "v1_sha256_976e5b5b4ba73f1b392c2f6b32a86b09b5fd9e5a3510c60b77a39f1e0d705822"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76105,10 +76238,10 @@ rule ELASTIC_Windows_Trojan_Spectralviper_368C36A0 : FILE MEMORY
 		date = "2023-05-10"
 		modified = "2023-05-10"
 		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SpectralViper.yar#L29-L53"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SpectralViper.yar#L29-L53"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d1c32176b46ce171dbce46493eb3c5312db134b0a3cfa266071555c704e6cff8"
-		logic_hash = "6182bde93e18dc6a83a94b50b193f5f29ed9abfa89b53c290818e7dab5bbb334"
+		logic_hash = "v1_sha256_6182bde93e18dc6a83a94b50b193f5f29ed9abfa89b53c290818e7dab5bbb334"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76128,7 +76261,7 @@ rule ELASTIC_Windows_Trojan_Spectralviper_368C36A0 : FILE MEMORY
 		$s3 = { 48 83 EC 28 4C 8B 41 18 4C 8B C9 48 B8 AB AA AA AA AA AA AA AA 48 F7 61 10 48 8B 49 08 48 C1 EA }
 
 	condition:
-		2 of ($a*) or any of ($s*)
+		2 of ( $a* ) or any of ( $s* )
 }
 rule ELASTIC_Windows_Trojan_Downtown_901C4Fdd : FILE MEMORY
 {
@@ -76139,9 +76272,9 @@ rule ELASTIC_Windows_Trojan_Downtown_901C4Fdd : FILE MEMORY
 		date = "2023-05-10"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DownTown.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "6368d37fa9ba4e32131e16bceaee322f2fa8507873d01ebd687536e593354725"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DownTown.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_6368d37fa9ba4e32131e16bceaee322f2fa8507873d01ebd687536e593354725"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76169,9 +76302,9 @@ rule ELASTIC_Windows_Trojan_Downtown_145Ecd2F : FILE MEMORY
 		date = "2023-08-23"
 		modified = "2023-09-20"
 		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DownTown.yar#L23-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "744a51c5317e265177185d9d0b8838a8fc939b4c56cc5e5bc51d5432d046d9f1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DownTown.yar#L23-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_744a51c5317e265177185d9d0b8838a8fc939b4c56cc5e5bc51d5432d046d9f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76200,10 +76333,10 @@ rule ELASTIC_Macos_Trojan_Thiefquest_9130C0F3 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Thiefquest.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Thiefquest.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bed3561210e44c290cd410adadcdc58462816a03c15d20b5be45d227cd7dca6b"
-		logic_hash = "20e9ea15a437a17c4ef68f2472186f6d1ab3118d5b392f84fcb2bd376ec3863a"
+		logic_hash = "v1_sha256_20e9ea15a437a17c4ef68f2472186f6d1ab3118d5b392f84fcb2bd376ec3863a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76232,10 +76365,10 @@ rule ELASTIC_Macos_Trojan_Thiefquest_Fc2E1271 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Thiefquest.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Thiefquest.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
-		logic_hash = "a20c76e53874fc0fec5fd2660c63c6f1e7c1b2055cbd2a9efdfd114cd6bdda5c"
+		logic_hash = "v1_sha256_a20c76e53874fc0fec5fd2660c63c6f1e7c1b2055cbd2a9efdfd114cd6bdda5c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76261,10 +76394,10 @@ rule ELASTIC_Macos_Trojan_Thiefquest_86F9Ef0C : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Thiefquest.yar#L44-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Thiefquest.yar#L44-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "59fb018e338908eb69be72ab11837baebf8d96cdb289757f1f4977228e7640a0"
-		logic_hash = "426d533d39e594123f742b15d0a93ded986b9b308685f7b2cfaf5de0b32cdbff"
+		logic_hash = "v1_sha256_426d533d39e594123f742b15d0a93ded986b9b308685f7b2cfaf5de0b32cdbff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76290,10 +76423,10 @@ rule ELASTIC_Macos_Trojan_Thiefquest_40F9C1C3 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Thiefquest.yar#L64-L82"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Thiefquest.yar#L64-L82"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e402063ca317867de71e8e3189de67988e2be28d5d773bbaf75618202e80f9f6"
-		logic_hash = "546edc2d6d715eac47e7a8d3ceb91cf314fa6dbee04f0475a5c4a84ba53fd722"
+		logic_hash = "v1_sha256_546edc2d6d715eac47e7a8d3ceb91cf314fa6dbee04f0475a5c4a84ba53fd722"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76319,10 +76452,10 @@ rule ELASTIC_Macos_Trojan_Thiefquest_0F9Fe37C : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Thiefquest.yar#L84-L102"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Thiefquest.yar#L84-L102"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
-		logic_hash = "84f9e8938d7e2b0210003fc8334b8fa781a40afffeda8d2341970b84ed5d3b5a"
+		logic_hash = "v1_sha256_84f9e8938d7e2b0210003fc8334b8fa781a40afffeda8d2341970b84ed5d3b5a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76348,10 +76481,10 @@ rule ELASTIC_Macos_Trojan_Thiefquest_1F4Bac78 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Thiefquest.yar#L104-L122"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Thiefquest.yar#L104-L122"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
-		logic_hash = "96db33e135138846f978026867bb2536226539997d060f41e7081f7f29b66c85"
+		logic_hash = "v1_sha256_96db33e135138846f978026867bb2536226539997d060f41e7081f7f29b66c85"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76377,10 +76510,10 @@ rule ELASTIC_Linux_Ransomware_Blacksuit_9F53E7E5 : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_BlackSuit.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_BlackSuit.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e"
-		logic_hash = "121e0139385cfef5dff394c4ea36d950314b00c6d7021cf2ca667ee942e74763"
+		logic_hash = "v1_sha256_121e0139385cfef5dff394c4ea36d950314b00c6d7021cf2ca667ee942e74763"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -76408,10 +76541,10 @@ rule ELASTIC_Macos_Trojan_Generic_A829D361 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b2a1cd801ae68a890b40dbd1601cdfeb5085574637ae8658417d0975be8acb5"
-		logic_hash = "70a954e8b44b1ce46f5ce0ebcf43b46e1292f0b8cdb46aa67f980d3c9b0a6f61"
+		logic_hash = "v1_sha256_70a954e8b44b1ce46f5ce0ebcf43b46e1292f0b8cdb46aa67f980d3c9b0a6f61"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76437,10 +76570,10 @@ rule ELASTIC_Windows_Exploit_CVE_2022_38028_31Fdb122 : FILE MEMORY CVE_2022_3802
 		date = "2024-06-06"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_CVE_2022_38028.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_CVE_2022_38028.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6b311c0a977d21e772ac4e99762234da852bbf84293386fbe78622a96c0b052f"
-		logic_hash = "df0ef11ce8e840c331d1db8f98917367dc2a33b6f1be48adb9d0b86729ecbe99"
+		logic_hash = "v1_sha256_df0ef11ce8e840c331d1db8f98917367dc2a33b6f1be48adb9d0b86729ecbe99"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY, CVE-2022-38028"
@@ -76466,10 +76599,10 @@ rule ELASTIC_Macos_Trojan_Rustbucket_E64F7A92 : FILE MEMORY
 		date = "2023-06-26"
 		modified = "2023-06-29"
 		reference = "https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_RustBucket.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_RustBucket.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747"
-		logic_hash = "bd6005d72faba6aaeebdcbd8c771995cbfc667faf01eb93825afe985954a47fc"
+		logic_hash = "v1_sha256_bd6005d72faba6aaeebdcbd8c771995cbfc667faf01eb93825afe985954a47fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76497,10 +76630,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_D13544D7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "85fa30ba59602199fd99463acf50bd607e755c2e18cd8843ffcfb6b1aca24bb3"
-		logic_hash = "fcb2fc7a84fbcd23f9a9d9fd2750c45ff881689670a373fce0cc444183d11999"
+		logic_hash = "v1_sha256_fcb2fc7a84fbcd23f9a9d9fd2750c45ff881689670a373fce0cc444183d11999"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76526,10 +76659,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_Ad09E090 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
-		logic_hash = "6c2d548ba9f01444e8fe4b0aa8a0556970acac06d39bb7c87446b6b91ab0d129"
+		logic_hash = "v1_sha256_6c2d548ba9f01444e8fe4b0aa8a0556970acac06d39bb7c87446b6b91ab0d129"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76555,10 +76688,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_12299814 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "eb3802496bd2fef72bd2a07e32ea753f69f1c2cc0b5a605e480f3bbb80b22676"
-		logic_hash = "52e8bcd0512cedf0fa048b6990a5d331f4302d99b00681c83a76587415894b1e"
+		logic_hash = "v1_sha256_52e8bcd0512cedf0fa048b6990a5d331f4302d99b00681c83a76587415894b1e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76584,10 +76717,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_A47B77E4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "995b43ccb20343494e314824343a567fd85f430e241fdeb43704d9d4937d76cc"
-		logic_hash = "bd2b14c8b8e2649af837224fadb32bf0fb67ac403189063a8cb10ad344fb8015"
+		logic_hash = "v1_sha256_bd2b14c8b8e2649af837224fadb32bf0fb67ac403189063a8cb10ad344fb8015"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76613,10 +76746,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_21D0550B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
-		logic_hash = "c9a12eee281b1e944b5572142c5e18ff087989f45026a94268df22d483210178"
+		logic_hash = "v1_sha256_c9a12eee281b1e944b5572142c5e18ff087989f45026a94268df22d483210178"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76642,10 +76775,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_C8Adb449 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "00ec7a6e9611b5c0e26c148ae5ebfedc57cf52b21e93c2fe3eac85bf88edc7ea"
-		logic_hash = "9c43602dc752dd737a983874bee5ec6af145ce5fdd45d03864a1afdc2aec3ad4"
+		logic_hash = "v1_sha256_9c43602dc752dd737a983874bee5ec6af145ce5fdd45d03864a1afdc2aec3ad4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76671,10 +76804,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_Bcab1E8F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "19df7fd22051abe3f782432398ea30f8be88cf42ef14bc301b1676f35b37cd7e"
-		logic_hash = "72643b2860f40c7e901c671d7cc9992870b91912df5d75d2ffba0dfb8684f8d3"
+		logic_hash = "v1_sha256_72643b2860f40c7e901c671d7cc9992870b91912df5d75d2ffba0dfb8684f8d3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76700,10 +76833,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_6671F33A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "85fa30ba59602199fd99463acf50bd607e755c2e18cd8843ffcfb6b1aca24bb3"
-		logic_hash = "a15c842c7c7ec3b11183a1502f8ec03ea786e3f0d47fbab58c62ffff7b018030"
+		logic_hash = "v1_sha256_a15c842c7c7ec3b11183a1502f8ec03ea786e3f0d47fbab58c62ffff7b018030"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76729,10 +76862,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_74418Ec5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d79ad967ac9fc0b1b6d54e844de60d7ba3eaad673ee69d30f9f804e5ccbf2880"
-		logic_hash = "e74463f53611baaec7c8e126218d8353c6e3a5e71c20e98a7035df6b771b690b"
+		logic_hash = "v1_sha256_e74463f53611baaec7c8e126218d8353c6e3a5e71c20e98a7035df6b771b690b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76758,9 +76891,9 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_979160F6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L181-L198"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e70097fb263c90576e87e76cc7be391dbf9c9d73bbd7fb8e5ec282e6ac1f648d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L181-L198"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e70097fb263c90576e87e76cc7be391dbf9c9d73bbd7fb8e5ec282e6ac1f648d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76786,10 +76919,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_Fe7139E5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L200-L218"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L200-L218"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8b13dc59db58b6c4cd51abf9c1d6f350fa2cb0dbb44b387d3e171eacc82a04de"
-		logic_hash = "d1ef74f2a74950845091b2ebc2f7fd05980bcbd2aea4fdd9549c54cec1768501"
+		logic_hash = "v1_sha256_d1ef74f2a74950845091b2ebc2f7fd05980bcbd2aea4fdd9549c54cec1768501"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76815,10 +76948,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_F35A670C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L220-L238"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L220-L238"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a73808211ba00b92f8d0027831b3aa74db15f068c53dd7f20fcadb294224f480"
-		logic_hash = "95a8aeffb7193c3f4adfea5b7f0741a53528620c57cbdb4d471d756db03c6493"
+		logic_hash = "v1_sha256_95a8aeffb7193c3f4adfea5b7f0741a53528620c57cbdb4d471d756db03c6493"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76844,10 +76977,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_70E5946E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L240-L258"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L240-L258"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
-		logic_hash = "324deafee2b14c125100e49b90ea95bc1fc55020a7e81a69c7730a57430560f4"
+		logic_hash = "v1_sha256_324deafee2b14c125100e49b90ea95bc1fc55020a7e81a69c7730a57430560f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76873,10 +77006,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_033F06Dd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L260-L278"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L260-L278"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3afc8d2d85aca61108d21f82355ad813eba7a189e81dde263d318988c5ea50bd"
-		logic_hash = "a0c788dbcd43cab2af1614d5d90ed9e07a45b547241f729e09709d2a1ec24e60"
+		logic_hash = "v1_sha256_a0c788dbcd43cab2af1614d5d90ed9e07a45b547241f729e09709d2a1ec24e60"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -76902,10 +77035,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_Ce0C185F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L280-L298"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L280-L298"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
-		logic_hash = "f88c5a295cc62f5a91e26731fc60aaf450376cbb282f43304ba2a5ac5d149dd4"
+		logic_hash = "v1_sha256_f88c5a295cc62f5a91e26731fc60aaf450376cbb282f43304ba2a5ac5d149dd4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76931,10 +77064,10 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_Da08E491 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Malxmr.yar#L300-L318"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Malxmr.yar#L300-L318"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4638d9ece32cd1385121146378772d487666548066aecd7e40c3ba5231f54cc0"
-		logic_hash = "f98252c33f8d76981bbc51de87a11a7edca7292a864fc2a305d29cd21961729e"
+		logic_hash = "v1_sha256_f98252c33f8d76981bbc51de87a11a7edca7292a864fc2a305d29cd21961729e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76960,10 +77093,10 @@ rule ELASTIC_Windows_Trojan_Plugx_5F3844Ff : FILE MEMORY
 		date = "2023-08-28"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PlugX.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PlugX.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a823380e46878dfa8deb3ca0dc394db1db23bb2544e2d6e49c0eceeffb595875"
-		logic_hash = "a1a484f4cf00ec0775a3f322bae66ce5f9cc52f08306b38f079445233c49bf52"
+		logic_hash = "v1_sha256_a1a484f4cf00ec0775a3f322bae66ce5f9cc52f08306b38f079445233c49bf52"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -76993,10 +77126,10 @@ rule ELASTIC_Windows_Trojan_Plugx_F338Dab5 : FILE MEMORY
 		date = "2024-06-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PlugX.yar#L25-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PlugX.yar#L25-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8af3fc1f8bd13519d78ee83af43daaa8c5e2c3f184c09f5c41941e0c6f68f0f7"
-		logic_hash = "0482305a73bc500aa7c266536cb8286ea796f6b1eaba39547bed22313bbb4457"
+		logic_hash = "v1_sha256_0482305a73bc500aa7c266536cb8286ea796f6b1eaba39547bed22313bbb4457"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77024,10 +77157,10 @@ rule ELASTIC_Linux_Trojan_Merlin_55Beddd3 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Merlin.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Merlin.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "15ccdf2b948fe6bd3d3a7f5370e72cf3badec83f0ec7f47cdf116990fb551adf"
-		logic_hash = "293158c981463544abd0c38694bfc8635ad1a679bbae115521b65879f145cea6"
+		logic_hash = "v1_sha256_293158c981463544abd0c38694bfc8635ad1a679bbae115521b65879f145cea6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77053,10 +77186,10 @@ rule ELASTIC_Linux_Trojan_Merlin_Bbad69B8 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Merlin.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Merlin.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d9955487f7d08f705e41a5ff848fb6f02d6c88286a52ec837b7b555fb422d1b6"
-		logic_hash = "e18079c9f018dc8d7f2fdf5c950b405f9f84ad2a5b18775dbef829fe1cb770c3"
+		logic_hash = "v1_sha256_e18079c9f018dc8d7f2fdf5c950b405f9f84ad2a5b18775dbef829fe1cb770c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77082,10 +77215,10 @@ rule ELASTIC_Linux_Trojan_Merlin_C6097296 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Merlin.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Merlin.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d9955487f7d08f705e41a5ff848fb6f02d6c88286a52ec837b7b555fb422d1b6"
-		logic_hash = "f48ed7f19ab29633600fde4bfea274bf36e7f60d700c9806b334d38a51d28b92"
+		logic_hash = "v1_sha256_f48ed7f19ab29633600fde4bfea274bf36e7f60d700c9806b334d38a51d28b92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77111,10 +77244,10 @@ rule ELASTIC_Windows_Vulndriver_Hrsword_15B431Ee : FILE MEMORY
 		date = "2023-05-25"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_HrSword.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_HrSword.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "272e934cec4a84ab92b2bccb98539d73542ea9184960a2c9923d4edc667f4d4f"
-		logic_hash = "d8aed70f101a717efe83adceea0f220fb0b145ab8aa39b6250ac2bc057bf51ce"
+		logic_hash = "v1_sha256_d8aed70f101a717efe83adceea0f220fb0b145ab8aa39b6250ac2bc057bf51ce"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77130,7 +77263,7 @@ rule ELASTIC_Windows_Vulndriver_Hrsword_15B431Ee : FILE MEMORY
 		$str1 = "Huorong Internet Security Core Kext" wide
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $original_file_name and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $original_file_name and $str1
 }
 rule ELASTIC_Windows_Ransomware_Stop_1E8D48Ff : FILE MEMORY
 {
@@ -77141,10 +77274,10 @@ rule ELASTIC_Windows_Ransomware_Stop_1E8D48Ff : FILE MEMORY
 		date = "2021-06-10"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Stop.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Stop.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3"
-		logic_hash = "d743feae072a5f3e1b008354352bef48218bb041bc8a5ba39526815ab9cd2690"
+		logic_hash = "v1_sha256_d743feae072a5f3e1b008354352bef48218bb041bc8a5ba39526815ab9cd2690"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77171,10 +77304,10 @@ rule ELASTIC_Windows_Hacktool_Blackbone_2Ff5Ec38 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_BlackBone.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_BlackBone.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4e3887f950bff034efedd40f1e949579854a24140128246fa6141f2c34de6017"
-		logic_hash = "0c32bd04460cdf7a56664253992a684c2c684b15ac9ca853b27ab24f07f71607"
+		logic_hash = "v1_sha256_0c32bd04460cdf7a56664253992a684c2c684b15ac9ca853b27ab24f07f71607"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -77189,7 +77322,7 @@ rule ELASTIC_Windows_Hacktool_Blackbone_2Ff5Ec38 : FILE
 		$str1 = "BlackBone: %s: ZwCreateThreadEx hThread 0x%X"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Cryptominer_Xmrminer_70C153B5 : FILE MEMORY
 {
@@ -77200,10 +77333,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_70C153B5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "55b133ba805bb691dc27a5d16d3473650360c988e48af8adc017377eed07935b"
-		logic_hash = "e2fc0721435c656a16e59b6747563df17f0f54a4620efc403a3bba717ccb0f38"
+		logic_hash = "v1_sha256_e2fc0721435c656a16e59b6747563df17f0f54a4620efc403a3bba717ccb0f38"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77229,10 +77362,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_98B00F9C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c01b88c5d3df7ce828e567bd8d639b135c48106e388cd81497fcbd5dcf30f332"
-		logic_hash = "cf8c5deddf22e7699cd880bd3f9f28721db5ece6705be4f932e1d041893eef71"
+		logic_hash = "v1_sha256_cf8c5deddf22e7699cd880bd3f9f28721db5ece6705be4f932e1d041893eef71"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77258,10 +77391,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_2B250178 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "636605cf63d3e335fe9481d4d110c43572e9ab365edfa2b6d16d96b52d6283ef"
-		logic_hash = "067705c52de710372b4a2a3b77427106068ad2d9a8e56602e315d09e7b8b6206"
+		logic_hash = "v1_sha256_067705c52de710372b4a2a3b77427106068ad2d9a8e56602e315d09e7b8b6206"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77287,10 +77420,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_67Bf4B54 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9d33fba4fda6831d22afc72bf3d6d5349c5393abb3823dfa2a5c9e391d2b9ddf"
-		logic_hash = "448f5b9dc3c17984464c15f6d542f495a52b0531acc362dedfe3d1a20b932969"
+		logic_hash = "v1_sha256_448f5b9dc3c17984464c15f6d542f495a52b0531acc362dedfe3d1a20b932969"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77316,9 +77449,9 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_504B42Ca : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L81-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "dd3ed5350e0229ac714178a30de28893c30708734faec329c776e189493cf930"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L81-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_dd3ed5350e0229ac714178a30de28893c30708734faec329c776e189493cf930"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77344,10 +77477,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_D1Bb752F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L100-L118"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L100-L118"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bea55bc9495ee51c78ceedadf3a685ea9d6dd428170888c67276c100d4d94beb"
-		logic_hash = "47aa5516350d5c00d1387649df46ce8f09d87bdfafeaa4cbf1c3ef5f2e0b9023"
+		logic_hash = "v1_sha256_47aa5516350d5c00d1387649df46ce8f09d87bdfafeaa4cbf1c3ef5f2e0b9023"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77373,9 +77506,9 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_D625Fcd2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L120-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "b95b66392e1a07e0b6acd718a9501cede76e57561e69701e9e881bd3fbd3fe39"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L120-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_b95b66392e1a07e0b6acd718a9501cede76e57561e69701e9e881bd3fbd3fe39"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77401,10 +77534,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_02D19C01 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L139-L157"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L139-L157"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b6df662f5f7566851b95884c0058e7476e49aeb7a96d2aa203393d88e584972f"
-		logic_hash = "43a1dc49bf75cd13637c37290d47b4d6fc1b2c2ac252b64725c0c64e1dd745c6"
+		logic_hash = "v1_sha256_43a1dc49bf75cd13637c37290d47b4d6fc1b2c2ac252b64725c0c64e1dd745c6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77430,10 +77563,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_2Dd045Fc : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L159-L177"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L159-L177"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "30a77ab582f0558829a78960929f657a7c3c03c2cf89cd5a0f6934b79a74b7a4"
-		logic_hash = "fa23ca75027f7a5e73652173c9e84112a0b5cd3008fc453fdb33c980dc7b7b24"
+		logic_hash = "v1_sha256_fa23ca75027f7a5e73652173c9e84112a0b5cd3008fc453fdb33c980dc7b7b24"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77459,10 +77592,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_D1A814B0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L179-L197"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L179-L197"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bea55bc9495ee51c78ceedadf3a685ea9d6dd428170888c67276c100d4d94beb"
-		logic_hash = "a06f5d5be87153be1253c2e20a60fa36701a745813926be03ee466ce8e2285b0"
+		logic_hash = "v1_sha256_a06f5d5be87153be1253c2e20a60fa36701a745813926be03ee466ce8e2285b0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77488,10 +77621,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_C6218E30 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L199-L217"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L199-L217"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b43ddd8e355b0c538c123c43832e7c8c557e4aee9e914baaed0866ee5d68ee55"
-		logic_hash = "3efbc3cb1591a9340df10640b411a9ab4c41e0aa26c1677d9def8b82e4c246f4"
+		logic_hash = "v1_sha256_3efbc3cb1591a9340df10640b411a9ab4c41e0aa26c1677d9def8b82e4c246f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77517,10 +77650,10 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_B17A7888 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xmrminer.yar#L219-L237"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xmrminer.yar#L219-L237"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "65c9fdd7c559554af06cd394dcebece1bc0fdc7dd861929a35c74547376324a6"
-		logic_hash = "a7f6daa5c42d186d2c5a027fdb35b45287c3564a7b57b8a2f53659e6ca90602a"
+		logic_hash = "v1_sha256_a7f6daa5c42d186d2c5a027fdb35b45287c3564a7b57b8a2f53659e6ca90602a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77546,10 +77679,10 @@ rule ELASTIC_Windows_Trojan_Behinder_B9A49F4B : FILE MEMORY
 		date = "2023-03-02"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Behinder.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Behinder.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a50ca8df4181918fe0636272f31e19815f1b97cce6d871e15e03b0ee0e3da17b"
-		logic_hash = "2303ef82e4dc5e8be87ddc4563dcd06963d17e1fbf25cf246a6c81e4e74adbcb"
+		logic_hash = "v1_sha256_2303ef82e4dc5e8be87ddc4563dcd06963d17e1fbf25cf246a6c81e4e74adbcb"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -77577,10 +77710,10 @@ rule ELASTIC_Windows_Trojan_Dustywarehouse_A6Cfc9F7 : FILE MEMORY
 		date = "2023-08-25"
 		modified = "2023-11-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DustyWarehouse.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DustyWarehouse.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8c4de69e89dcc659d2fff52d695764f1efd7e64e0a80983ce6d0cb9eeddb806c"
-		logic_hash = "2b4cd9316e2fda882c95673edecb9c82a03ef4fdcc2d2e25783644cc5dfb5bf0"
+		logic_hash = "v1_sha256_2b4cd9316e2fda882c95673edecb9c82a03ef4fdcc2d2e25783644cc5dfb5bf0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77610,10 +77743,10 @@ rule ELASTIC_Windows_Trojan_Dustywarehouse_3Fef514B : FILE MEMORY
 		date = "2024-05-30"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DustyWarehouse.yar#L25-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DustyWarehouse.yar#L25-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4ad024f53595fdd380f5b5950b62595cd47ac424d2427c176a7b2dfe4e1f35f7"
-		logic_hash = "865ea1e54950a465b71939a41f7a726ccddcfa9f0d777ea853926f65bca0da84"
+		logic_hash = "v1_sha256_865ea1e54950a465b71939a41f7a726ccddcfa9f0d777ea853926f65bca0da84"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77639,10 +77772,10 @@ rule ELASTIC_Linux_Exploit_Criscras_Fc505C1D : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Criscras.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Criscras.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7399f6b8fbd6d6c6fb56ab350c84910fe19cc5da67e4de37065ff3d4648078ab"
-		logic_hash = "4d84570c13c584fb7360e798df9f3e6039ee74fdb6ad597add0ea150e3deaa80"
+		logic_hash = "v1_sha256_4d84570c13c584fb7360e798df9f3e6039ee74fdb6ad597add0ea150e3deaa80"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77668,10 +77801,10 @@ rule ELASTIC_Windows_Hacktool_Sharpgpoabuse_14Ea480E : FILE MEMORY
 		date = "2024-03-25"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpGPOAbuse.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpGPOAbuse.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d13f87b9eaf09ef95778b2f1469aa34d03186d127c8f73c73299957d386c78d1"
-		logic_hash = "efc1259f4ed05c8f41df75c056d36fd5a808a92b5c88cfb0522caedea39476b4"
+		logic_hash = "v1_sha256_efc1259f4ed05c8f41df75c056d36fd5a808a92b5c88cfb0522caedea39476b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77693,7 +77826,7 @@ rule ELASTIC_Windows_Hacktool_Sharpgpoabuse_14Ea480E : FILE MEMORY
 		$s7 = "NewImmediateTask" wide fullword
 
 	condition:
-		($name and 1 of ($s*)) or all of ($s*)
+		($name and 1 of ( $s* ) ) or all of ( $s* )
 }
 rule ELASTIC_Windows_Vulndriver_Threatfire_Cbe7Ac92 : FILE MEMORY
 {
@@ -77704,10 +77837,10 @@ rule ELASTIC_Windows_Vulndriver_Threatfire_Cbe7Ac92 : FILE MEMORY
 		date = "2024-08-19"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_ThreatFire.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_ThreatFire.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1c1a4ca2cbac9fe5954763a20aeb82da9b10d028824f42fff071503dcbe15856"
-		logic_hash = "689e17c9fdfc9de10a2cf3d39306103712504ab46db35ac65ed0340c83af240d"
+		logic_hash = "v1_sha256_689e17c9fdfc9de10a2cf3d39306103712504ab46db35ac65ed0340c83af240d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77723,7 +77856,7 @@ rule ELASTIC_Windows_Vulndriver_Threatfire_Cbe7Ac92 : FILE MEMORY
 		$str1 = "ThreatFire" wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and all of them
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and all of them
 }
 rule ELASTIC_Windows_Hacktool_Clroxide_D92D9575 : FILE MEMORY
 {
@@ -77734,10 +77867,10 @@ rule ELASTIC_Windows_Hacktool_Clroxide_D92D9575 : FILE MEMORY
 		date = "2024-02-29"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_ClrOxide.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_ClrOxide.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3a4900eff80563bff586ced172c3988347980f902aceef2f9f9f6d188fac8e3"
-		logic_hash = "01bb071e1286bb139c5e1c37e421153ef1b28a5994feeaedf6ad27ad7dade5e9"
+		logic_hash = "v1_sha256_01bb071e1286bb139c5e1c37e421153ef1b28a5994feeaedf6ad27ad7dade5e9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77769,9 +77902,9 @@ rule ELASTIC_Windows_Hacktool_Askcreds_34E3E3D4 : FILE MEMORY
 		date = "2023-05-16"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_AskCreds.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d911566ca546a8546928cd0ffa838fd344b35f75a4a7e80789d20e52c7cd38d0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_AskCreds.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d911566ca546a8546928cd0ffa838fd344b35f75a4a7e80789d20e52c7cd38d0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77799,10 +77932,10 @@ rule ELASTIC_Windows_Trojan_Generic_A681F24A : FILE MEMORY
 		date = "2021-06-10"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa"
-		logic_hash = "72bfefc8f92dbe65d197e02bf896315dcbc54d7b68d0434f43de026ccf934f40"
+		logic_hash = "v1_sha256_72bfefc8f92dbe65d197e02bf896315dcbc54d7b68d0434f43de026ccf934f40"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -77830,9 +77963,9 @@ rule ELASTIC_Windows_Trojan_Generic_Ae824B13 : REF1296 FILE MEMORY
 		date = "2022-02-03"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "cee46c1efdaa1815606f932a4f79b316e02c1b481e73c4c2f8b7c72023e8684c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_cee46c1efdaa1815606f932a4f79b316e02c1b481e73c4c2f8b7c72023e8684c"
 		score = 75
 		quality = 67
 		tags = "REF1296, FILE, MEMORY"
@@ -77861,9 +77994,9 @@ rule ELASTIC_Windows_Trojan_Generic_Eb47E754 : REF1296 FILE MEMORY
 		date = "2022-02-03"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L45-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "1d96e813ed0261bd0d7caca2803ed8d5fe4d77ea00efc9130eef86aa872c4656"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L45-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_1d96e813ed0261bd0d7caca2803ed8d5fe4d77ea00efc9130eef86aa872c4656"
 		score = 75
 		quality = 67
 		tags = "REF1296, FILE, MEMORY"
@@ -77892,10 +78025,10 @@ rule ELASTIC_Windows_Trojan_Generic_C7Fd8D38 : FILE MEMORY
 		date = "2022-02-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L67-L89"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L67-L89"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a1702ec12c2bf4a52e11fbdab6156358084ad2c662c8b3691918ef7eabacde96"
-		logic_hash = "81c56cd741692a7f2a894c2b8f2676aad47f14221228b9466a2ab0f05d76c623"
+		logic_hash = "v1_sha256_81c56cd741692a7f2a894c2b8f2676aad47f14221228b9466a2ab0f05d76c623"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77925,10 +78058,10 @@ rule ELASTIC_Windows_Trojan_Generic_Bbe6C282 : FILE MEMORY
 		date = "2022-03-02"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L91-L109"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L91-L109"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a44c46d4b9cf1254aaabd1e689f84c4d2c3dd213597f827acabface03a1ae6d1"
-		logic_hash = "fe874d69ae71775cf997845c90e731479569e2ac1ac882a4b8c3c73d015b1f30"
+		logic_hash = "v1_sha256_fe874d69ae71775cf997845c90e731479569e2ac1ac882a4b8c3c73d015b1f30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -77954,10 +78087,10 @@ rule ELASTIC_Windows_Trojan_Generic_889B1248 : FILE MEMORY
 		date = "2022-03-11"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L111-L132"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L111-L132"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a48d57a139c7e3efa0c47f8699e2cf6159dc8cdd823b16ce36257eb8c9d14d53"
-		logic_hash = "b3bb93b95377d6c6606d29671395b78c0954cc47d5cc450436799638d0458469"
+		logic_hash = "v1_sha256_b3bb93b95377d6c6606d29671395b78c0954cc47d5cc450436799638d0458469"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -77986,10 +78119,10 @@ rule ELASTIC_Windows_Trojan_Generic_02A87A20 : FILE MEMORY
 		date = "2022-03-04"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L134-L152"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L134-L152"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
-		logic_hash = "610db1b429ed2ecfc552f73ed4782cb56254e6fc98b728ffeff6938fbcce9616"
+		logic_hash = "v1_sha256_610db1b429ed2ecfc552f73ed4782cb56254e6fc98b728ffeff6938fbcce9616"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78015,10 +78148,10 @@ rule ELASTIC_Windows_Trojan_Generic_4Fbff084 : FILE MEMORY
 		date = "2023-02-28"
 		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L154-L175"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L154-L175"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7010a69ba77e65e70f4f3f4a10af804e6932c2218ff4abd5f81240026822b401"
-		logic_hash = "47d1a01e0edee3239d99ff1f32eb4cfc77d6e38823fed799a562e142d3d3a22d"
+		logic_hash = "v1_sha256_47d1a01e0edee3239d99ff1f32eb4cfc77d6e38823fed799a562e142d3d3a22d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78047,10 +78180,10 @@ rule ELASTIC_Windows_Trojan_Generic_73Ed7375 : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L177-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L177-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2b17328a3ef0e389419c9c86f81db4118cf79640799e5c6fdc97de0fc65ad556"
-		logic_hash = "7e27c9377d0b2058a2a36da4ac7d37a54c566f3246e69aa356171edae6b478c5"
+		logic_hash = "v1_sha256_7e27c9377d0b2058a2a36da4ac7d37a54c566f3246e69aa356171edae6b478c5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78077,10 +78210,10 @@ rule ELASTIC_Windows_Trojan_Generic_96Cdf3C4 : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L198-L217"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L198-L217"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9a4d68de36f1706a3083de7eb41f839d8c7a4b8b585cc767353df12866a48c81"
-		logic_hash = "f92e5549aca320d71e1eec8daa82e8bbf3517c7f23f376bb355fdfa32da2e7a9"
+		logic_hash = "v1_sha256_f92e5549aca320d71e1eec8daa82e8bbf3517c7f23f376bb355fdfa32da2e7a9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78107,10 +78240,10 @@ rule ELASTIC_Windows_Trojan_Generic_F0C79978 : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L219-L238"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L219-L238"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8f800b35bfbc8474f64b76199b846fe56b24a3ffd8c7529b92ff98a450d3bd38"
-		logic_hash = "b16971ed0947660dda8d79c11531a9498a80e00f2dbc2c0eb63895b7f5c5f980"
+		logic_hash = "v1_sha256_b16971ed0947660dda8d79c11531a9498a80e00f2dbc2c0eb63895b7f5c5f980"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78137,10 +78270,10 @@ rule ELASTIC_Windows_Trojan_Generic_40899C85 : FILE MEMORY
 		date = "2023-12-15"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L240-L260"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L240-L260"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "88eb4f2e7085947bfbd03c69573fdca0de4a74bab844f09ecfcf88e358af20cc"
-		logic_hash = "317034add0343baa26548712de8b2acc04946385fbee048cea0bd8d7ae642b36"
+		logic_hash = "v1_sha256_317034add0343baa26548712de8b2acc04946385fbee048cea0bd8d7ae642b36"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78168,9 +78301,9 @@ rule ELASTIC_Windows_Trojan_Generic_9997489C : FILE MEMORY
 		date = "2024-01-31"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L262-L290"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "857bbf64ced06f76eb50afbfbb699c62e11625196213c2e5267b828cca911b74"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L262-L290"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_857bbf64ced06f76eb50afbfbb699c62e11625196213c2e5267b828cca911b74"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78207,10 +78340,10 @@ rule ELASTIC_Windows_Trojan_Generic_2993E5A5 : FILE MEMORY
 		date = "2024-03-18"
 		modified = "2024-03-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L292-L310"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L292-L310"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9f9b926cef69e879462d9fa914dda8c60a01f3d409b55afb68c3fb94bf1a339b"
-		logic_hash = "37a10597d1afeb9411f6c652537186628291cbe6af680abe12bb96591add7e78"
+		logic_hash = "v1_sha256_37a10597d1afeb9411f6c652537186628291cbe6af680abe12bb96591add7e78"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78236,10 +78369,10 @@ rule ELASTIC_Windows_Trojan_Generic_0E135D58 : FILE MEMORY
 		date = "2024-03-19"
 		modified = "2024-03-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Generic.yar#L312-L330"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Generic.yar#L312-L330"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c"
-		logic_hash = "bc10218b1d761f72836bb5f9bb41d3f0fe13c4baa1109025269f938ec642aec4"
+		logic_hash = "v1_sha256_bc10218b1d761f72836bb5f9bb41d3f0fe13c4baa1109025269f938ec642aec4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78265,10 +78398,10 @@ rule ELASTIC_Windows_Vulndriver_Cpuz_A53D1446 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Cpuz.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Cpuz.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6"
-		logic_hash = "37da20f5fe1377fe85594055dc811424f52e53a9d77060c6784c2e4d1279e26f"
+		logic_hash = "v1_sha256_37da20f5fe1377fe85594055dc811424f52e53a9d77060c6784c2e4d1279e26f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -78285,7 +78418,7 @@ rule ELASTIC_Windows_Vulndriver_Cpuz_A53D1446 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x04][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Trojan_Bloodalchemy_3793364E : FILE MEMORY
 {
@@ -78296,9 +78429,9 @@ rule ELASTIC_Windows_Trojan_Bloodalchemy_3793364E : FILE MEMORY
 		date = "2023-09-25"
 		modified = "2023-09-25"
 		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BloodAlchemy.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "c9f03767b92bb2c44f6b386e1f0a521f1a7a063cf73799844cc3423d4a7de7be"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BloodAlchemy.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_c9f03767b92bb2c44f6b386e1f0a521f1a7a063cf73799844cc3423d4a7de7be"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78325,9 +78458,9 @@ rule ELASTIC_Windows_Trojan_Bloodalchemy_E510798D : FILE MEMORY
 		date = "2023-09-25"
 		modified = "2023-09-25"
 		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BloodAlchemy.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7919bb5f19745a1620e6be91622c40083cbd2ddb02905215736a2ed11e9af5c4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BloodAlchemy.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7919bb5f19745a1620e6be91622c40083cbd2ddb02905215736a2ed11e9af5c4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78354,9 +78487,9 @@ rule ELASTIC_Windows_Trojan_Bloodalchemy_63084Eea : FILE MEMORY
 		date = "2023-09-25"
 		modified = "2023-09-25"
 		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BloodAlchemy.yar#L43-L61"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "3fe64502992281511e942b8f4541d61b33e900dbe23ea9f976c7eb9522ce4cbd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BloodAlchemy.yar#L43-L61"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_3fe64502992281511e942b8f4541d61b33e900dbe23ea9f976c7eb9522ce4cbd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78382,9 +78515,9 @@ rule ELASTIC_Windows_Trojan_Bloodalchemy_C2D80609 : FILE MEMORY
 		date = "2023-09-25"
 		modified = "2023-09-25"
 		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BloodAlchemy.yar#L63-L81"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "694a0f917f106fbdde4c8e5dd8f9cdce56e9423ce5a7c3a5bf30bf43308d42e9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BloodAlchemy.yar#L63-L81"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_694a0f917f106fbdde4c8e5dd8f9cdce56e9423ce5a7c3a5bf30bf43308d42e9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78410,9 +78543,9 @@ rule ELASTIC_Windows_Trojan_Bloodalchemy_De591C5A : FILE MEMORY
 		date = "2023-09-25"
 		modified = "2023-11-02"
 		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BloodAlchemy.yar#L83-L106"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "fd5cfe2558a7c02a617003140cdcf477ec451ecea4adf2808bef8f93673c28f1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BloodAlchemy.yar#L83-L106"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_fd5cfe2558a7c02a617003140cdcf477ec451ecea4adf2808bef8f93673c28f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78432,7 +78565,7 @@ rule ELASTIC_Windows_Trojan_Bloodalchemy_De591C5A : FILE MEMORY
 		$com_tm_iid = { C0 C7 A4 AB 2F A9 4D 13 40 96 97 20 CC 3F D4 0F 85 }
 
 	condition:
-		any of ($crypto_*) and all of ($com_tm_*)
+		any of ( $crypto_* ) and all of ( $com_tm_* )
 }
 rule ELASTIC_Windows_Vulndriver_Rweverything_Aee156A5 : FILE
 {
@@ -78443,10 +78576,10 @@ rule ELASTIC_Windows_Vulndriver_Rweverything_Aee156A5 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_RWEverything.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_RWEverything.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3c5bf92c26398695f9ced7ce647a7e9f6ddcc89eea66b45aa3607196a187431b"
-		logic_hash = "46b7f2ad46564c6b99f0df6146dff7c88ccbe3ad6c6d1bcbefe756606c4fe40e"
+		logic_hash = "v1_sha256_46b7f2ad46564c6b99f0df6146dff7c88ccbe3ad6c6d1bcbefe756606c4fe40e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -78462,7 +78595,7 @@ rule ELASTIC_Windows_Vulndriver_Rweverything_Aee156A5 : FILE
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 52 00 77 00 44 00 72 00 76 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Windows_Trojan_Bazar_711D59F6 : FILE MEMORY
 {
@@ -78473,10 +78606,10 @@ rule ELASTIC_Windows_Trojan_Bazar_711D59F6 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bazar.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bazar.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f29253139dab900b763ef436931213387dc92e860b9d3abb7dcd46040ac28a0e"
-		logic_hash = "3bde62b468c44bdc18878fd369a7f0cf06f7be64149587a11524f725fa875f69"
+		logic_hash = "v1_sha256_3bde62b468c44bdc18878fd369a7f0cf06f7be64149587a11524f725fa875f69"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78502,10 +78635,10 @@ rule ELASTIC_Windows_Trojan_Bazar_9Dddea36 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bazar.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bazar.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "63df43daa61f9a0fbea2e5409b8f0063f7af3363b6bc8d6984ce7e90c264727d"
-		logic_hash = "cf88e2e896fce742ad3325d53523167d6eb42188309ed4e66f73601bbb85574e"
+		logic_hash = "v1_sha256_cf88e2e896fce742ad3325d53523167d6eb42188309ed4e66f73601bbb85574e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78531,10 +78664,10 @@ rule ELASTIC_Windows_Trojan_Bazar_3A2Cc53B : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bazar.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bazar.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b057eb94e711995fd5fd6c57aa38a243575521b11b98734359658a7a9829b417"
-		logic_hash = "8cde37be646dbcf7e7f5e3f28f0fe8c95480861c62fa2ee8cdd990859313756c"
+		logic_hash = "v1_sha256_8cde37be646dbcf7e7f5e3f28f0fe8c95480861c62fa2ee8cdd990859313756c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78560,10 +78693,10 @@ rule ELASTIC_Windows_Trojan_Bazar_De8D625A : FILE MEMORY
 		date = "2022-01-14"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bazar.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bazar.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ad9ac4785b82c8bfa355c7343b9afc7b1f163471c41671ea2f9152a1b550f0c"
-		logic_hash = "5fd7bb4ac818ec1b4bfcb7d236868a31b2f726182407c07c7f06c1d7e9c15d02"
+		logic_hash = "v1_sha256_5fd7bb4ac818ec1b4bfcb7d236868a31b2f726182407c07c7f06c1d7e9c15d02"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78589,10 +78722,10 @@ rule ELASTIC_Windows_Trojan_Xpertrat_Ce03C41D : FILE MEMORY
 		date = "2021-08-06"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Xpertrat.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Xpertrat.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d7f2fddb43eb63f9246f0a4535dfcca6da2817592455d7eceaacde666cf1aaae"
-		logic_hash = "f6ff0a11f261bc75c9d0015131f177d39bb9e8e30346a75209ba8fa808ac4fcb"
+		logic_hash = "v1_sha256_f6ff0a11f261bc75c9d0015131f177d39bb9e8e30346a75209ba8fa808ac4fcb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78620,10 +78753,10 @@ rule ELASTIC_Windows_Hacktool_Sharplaps_381C3F40 : FILE MEMORY
 		date = "2022-12-22"
 		modified = "2022-12-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpLAPS.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpLAPS.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ef0d508b3051fe6f99ba55202a17237f29fdbc0085e3f5c99b1aef52c8ebe425"
-		logic_hash = "d94f9e4200a63283346919c121873130ad90e4ad5979c017cb71dc0cc910a64a"
+		logic_hash = "v1_sha256_d94f9e4200a63283346919c121873130ad90e4ad5979c017cb71dc0cc910a64a"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -78645,7 +78778,7 @@ rule ELASTIC_Windows_Hacktool_Sharplaps_381C3F40 : FILE MEMORY
 		$str6 = "ms-Mcs-AdmPwd" ascii wide
 
 	condition:
-		$guid or 6 of ($str*)
+		$guid or 6 of ( $str* )
 }
 rule ELASTIC_Windows_Trojan_Masslogger_511B001E : FILE MEMORY
 {
@@ -78656,10 +78789,10 @@ rule ELASTIC_Windows_Trojan_Masslogger_511B001E : FILE MEMORY
 		date = "2022-03-02"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_MassLogger.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_MassLogger.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "177875c756a494872c516000beb6011cec22bd9a73e58ba6b2371dba2ab8c337"
-		logic_hash = "5abac5e32e55467710842e19c25cab5c7f1cdb0f8a68fb6808d54467c69ebdf6"
+		logic_hash = "v1_sha256_5abac5e32e55467710842e19c25cab5c7f1cdb0f8a68fb6808d54467c69ebdf6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78690,10 +78823,10 @@ rule ELASTIC_Linux_Rootkit_Melofee_25D42Bdd : FILE MEMORY
 		date = "2024-11-14"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Melofee.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Melofee.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5830862707711a032728dfa6a85c904020766fa316ea85b3eef9c017f0e898cc"
-		logic_hash = "5af18434295e80403c3587165cd9db3b771d8f06eaa467e1161a0cd213446bee"
+		logic_hash = "v1_sha256_5af18434295e80403c3587165cd9db3b771d8f06eaa467e1161a0cd213446bee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78727,10 +78860,10 @@ rule ELASTIC_Linux_Cryptominer_Loudminer_581F57A9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Loudminer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Loudminer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
-		logic_hash = "82db0985f215da1d84e16fce94df7553b43b06082bf5475515dbbcf016c40fe4"
+		logic_hash = "v1_sha256_82db0985f215da1d84e16fce94df7553b43b06082bf5475515dbbcf016c40fe4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78756,10 +78889,10 @@ rule ELASTIC_Linux_Cryptominer_Loudminer_F2298A50 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Loudminer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Loudminer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
-		logic_hash = "6c2c9b6aea1fb35f8f600dd084ed9cfd56123f7502036e76dd168ccd8b43b28f"
+		logic_hash = "v1_sha256_6c2c9b6aea1fb35f8f600dd084ed9cfd56123f7502036e76dd168ccd8b43b28f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78785,10 +78918,10 @@ rule ELASTIC_Linux_Cryptominer_Loudminer_851Fc7Aa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Loudminer.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Loudminer.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
-		logic_hash = "9f271a16fe30fbf0c16533522b733228f19e0c44d173e4c0ef43bf13323e7383"
+		logic_hash = "v1_sha256_9f271a16fe30fbf0c16533522b733228f19e0c44d173e4c0ef43bf13323e7383"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78814,10 +78947,10 @@ rule ELASTIC_Windows_Vulndriver_Windivert_25991186 : FILE MEMORY
 		date = "2024-06-20"
 		modified = "2024-07-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_WinDivert.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_WinDivert.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2"
-		logic_hash = "a67679bb2f23d1f6691c9ad23da1fd4c2402701ba1929c7abf078d7d95011a08"
+		logic_hash = "v1_sha256_a67679bb2f23d1f6691c9ad23da1fd4c2402701ba1929c7abf078d7d95011a08"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78832,7 +78965,7 @@ rule ELASTIC_Windows_Vulndriver_Windivert_25991186 : FILE MEMORY
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 57 00 69 00 6E 00 44 00 69 00 76 00 65 00 72 00 74 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $original_file_name
 }
 rule ELASTIC_Linux_Trojan_Sshdkit_18A0B82A : FILE MEMORY
 {
@@ -78843,10 +78976,10 @@ rule ELASTIC_Linux_Trojan_Sshdkit_18A0B82A : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sshdkit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sshdkit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "003245047359e17706e4504f8988905a219fcb48865afea934e6aafa7f97cef6"
-		logic_hash = "4b7a78ebf3c114809148cc9855379b2e63c959966272ad45759838d570b42016"
+		logic_hash = "v1_sha256_4b7a78ebf3c114809148cc9855379b2e63c959966272ad45759838d570b42016"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78872,10 +79005,10 @@ rule ELASTIC_Windows_Trojan_Raccoon_Af6Decc6 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Raccoon.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Raccoon.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fe09bef10b21f085e9ca411e24e0602392ab5044b7268eaa95fb88790f1a124d"
-		logic_hash = "50ec446e8fd51129c7333c943dfe62db099fe1379530441f6b102fcbe3bc0dbd"
+		logic_hash = "v1_sha256_50ec446e8fd51129c7333c943dfe62db099fe1379530441f6b102fcbe3bc0dbd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78902,10 +79035,10 @@ rule ELASTIC_Windows_Trojan_Raccoon_58091F64 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Raccoon.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Raccoon.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fe09bef10b21f085e9ca411e24e0602392ab5044b7268eaa95fb88790f1a124d"
-		logic_hash = "8a7388e9c3dd0dd1a79215dbabcd964a0afa883490611afb6bb500635fbfff9a"
+		logic_hash = "v1_sha256_8a7388e9c3dd0dd1a79215dbabcd964a0afa883490611afb6bb500635fbfff9a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78931,10 +79064,10 @@ rule ELASTIC_Windows_Trojan_Raccoon_Deb6325C : FILE MEMORY
 		date = "2022-06-28"
 		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Raccoon.yar#L42-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Raccoon.yar#L42-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f7b1aaae018d5287444990606fc43a0f2deb4ac0c7b2712cc28331781d43ae27"
-		logic_hash = "94f70c60ed4fab021e013cf6a632321e0e1bdeef25a48a598d9e7388e7e445ca"
+		logic_hash = "v1_sha256_94f70c60ed4fab021e013cf6a632321e0e1bdeef25a48a598d9e7388e7e445ca"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -78963,10 +79096,10 @@ rule ELASTIC_Windows_Vulndriver_Arpot_09C714C5 : FILE
 		date = "2022-04-27"
 		modified = "2022-05-03"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_ArPot.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_ArPot.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
-		logic_hash = "e5f972ad9a31aefbd20237e6ea3dd19a025c2e3487fa080e9f9b8acf1e3f58e6"
+		logic_hash = "v1_sha256_e5f972ad9a31aefbd20237e6ea3dd19a025c2e3487fa080e9f9b8acf1e3f58e6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -78983,7 +79116,7 @@ rule ELASTIC_Windows_Vulndriver_Arpot_09C714C5 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\xbb][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x14][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xba][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Linux_Trojan_Rekoobe_E75472Fa : FILE MEMORY
 {
@@ -78994,10 +79127,10 @@ rule ELASTIC_Linux_Trojan_Rekoobe_E75472Fa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rekoobe.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rekoobe.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8d2a9e363752839a09001a9e3044ab7919daffd9d9aee42d936bc97394164a88"
-		logic_hash = "e3e9934ee8ce6933f676949c5b5c82ad044ac32f08fe86697b0a0cf7fb63fc5e"
+		logic_hash = "v1_sha256_e3e9934ee8ce6933f676949c5b5c82ad044ac32f08fe86697b0a0cf7fb63fc5e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79023,10 +79156,10 @@ rule ELASTIC_Linux_Trojan_Rekoobe_52462Fe8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rekoobe.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rekoobe.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c1d8c64105caecbd90c6e19cf89301a4dc091c44ab108e780bdc8791a94caaad"
-		logic_hash = "1ab6979392eeaa7bd6bd84f8d3531bd9071c54b58306a42dcfdd27bf7ec8f8cd"
+		logic_hash = "v1_sha256_1ab6979392eeaa7bd6bd84f8d3531bd9071c54b58306a42dcfdd27bf7ec8f8cd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79052,10 +79185,10 @@ rule ELASTIC_Linux_Trojan_Rekoobe_De9E7Bdf : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rekoobe.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rekoobe.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "447da7bee72c98c2202f1919561543e54ec1b9b67bd67e639b9fb6e42172d951"
-		logic_hash = "bdc4a3e4eeffc0d32e6a86dda54beceab8301d0065731d9ade390392ab4c6126"
+		logic_hash = "v1_sha256_bdc4a3e4eeffc0d32e6a86dda54beceab8301d0065731d9ade390392ab4c6126"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79081,10 +79214,10 @@ rule ELASTIC_Linux_Trojan_Rekoobe_B41F70C2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rekoobe.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rekoobe.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "19c1a54279be1710724fc75a112741575936fe70379d166effc557420da714cd"
-		logic_hash = "02de55c537da1cc03af26a171c768ad87984e45983c3739f90ad9983c70e7ccf"
+		logic_hash = "v1_sha256_02de55c537da1cc03af26a171c768ad87984e45983c3739f90ad9983c70e7ccf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79110,10 +79243,10 @@ rule ELASTIC_Linux_Trojan_Rekoobe_1D307D7C : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rekoobe.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rekoobe.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "00bc669f79b2903c5d9e6412050655486111647c646698f9a789e481a7c98662"
-		logic_hash = "de4807353d2ba977459a1bf7f51fd815e311c0bdc5fccd5e99fd44a766f6866f"
+		logic_hash = "v1_sha256_de4807353d2ba977459a1bf7f51fd815e311c0bdc5fccd5e99fd44a766f6866f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79139,10 +79272,10 @@ rule ELASTIC_Linux_Trojan_Rekoobe_7F7Aba78 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rekoobe.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rekoobe.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "50b73742726b0b7e00856e288e758412c74371ea2f0eaf75b957d73dfb396fd7"
-		logic_hash = "a3b46d29fa51dd6a911cb9cb0e67e9d57d3f3b6697dc8edcc4d82f09d9819a92"
+		logic_hash = "v1_sha256_a3b46d29fa51dd6a911cb9cb0e67e9d57d3f3b6697dc8edcc4d82f09d9819a92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79168,10 +79301,10 @@ rule ELASTIC_Linux_Trojan_Rekoobe_Ab8Ba790 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rekoobe.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rekoobe.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2aee0c74d9642ffab1f313179c26400acf60d7cbd2188bade28534d403f468d4"
-		logic_hash = "2a7a71712ad3f756a2dc53ec80bd9fb625f7c679fd9566945ebfeb392b9874a9"
+		logic_hash = "v1_sha256_2a7a71712ad3f756a2dc53ec80bd9fb625f7c679fd9566945ebfeb392b9874a9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79197,10 +79330,10 @@ rule ELASTIC_Linux_Trojan_Dofloo_Be1973Ed : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dofloo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dofloo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
-		logic_hash = "65f9daabf44006fe4405032bf93570185248bc62cd287650c68f854b23aa2158"
+		logic_hash = "v1_sha256_65f9daabf44006fe4405032bf93570185248bc62cd287650c68f854b23aa2158"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79226,10 +79359,10 @@ rule ELASTIC_Linux_Trojan_Dofloo_1D057993 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dofloo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dofloo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
-		logic_hash = "c5e15e21946816052d5a8dc293db3830f1d6d06cdbf22eb8667b655206dbbc1f"
+		logic_hash = "v1_sha256_c5e15e21946816052d5a8dc293db3830f1d6d06cdbf22eb8667b655206dbbc1f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79255,10 +79388,10 @@ rule ELASTIC_Linux_Trojan_Dofloo_29C12775 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dofloo.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dofloo.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
-		logic_hash = "a8eb79fdf57811f4ffd5a7c5ec54cf46c06281f8cd4d677aec1ad168d6648a08"
+		logic_hash = "v1_sha256_a8eb79fdf57811f4ffd5a7c5ec54cf46c06281f8cd4d677aec1ad168d6648a08"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79284,10 +79417,10 @@ rule ELASTIC_Linux_Trojan_Pnscan_20E34E35 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Pnscan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Pnscan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7dbd5b709f16296ba7dac66dc35b9c3373cf88452396d79d0c92d7502c1b0005"
-		logic_hash = "1e69ef50d25ffd0f38ed0eb81ab3295822aa183c5e06f307caf02826b1dfa011"
+		logic_hash = "v1_sha256_1e69ef50d25ffd0f38ed0eb81ab3295822aa183c5e06f307caf02826b1dfa011"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79313,10 +79446,10 @@ rule ELASTIC_Linux_Cryptominer_Stak_05088561 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Stak.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Stak.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d0d2bab33076121cf6a0a2c4ff1738759464a09ae4771c39442a865a76daff59"
-		logic_hash = "2b0f8a4efdfb13abcc2a1b43e9c39828ea1de6015fef0ef613bd754da5aa3e9a"
+		logic_hash = "v1_sha256_2b0f8a4efdfb13abcc2a1b43e9c39828ea1de6015fef0ef613bd754da5aa3e9a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79342,9 +79475,9 @@ rule ELASTIC_Linux_Cryptominer_Stak_Ae8B98A9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Stak.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "aade76488aa2f557de9082647153cca374a4819cd8e539ebba4bfef2334221b0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Stak.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_aade76488aa2f557de9082647153cca374a4819cd8e539ebba4bfef2334221b0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79370,10 +79503,10 @@ rule ELASTIC_Linux_Cryptominer_Stak_D707Fd3A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Stak.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Stak.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d0d2bab33076121cf6a0a2c4ff1738759464a09ae4771c39442a865a76daff59"
-		logic_hash = "b825247372aace6e3ce0ff1d9685b6bb041b7277f8967d5f5926b49813cfadc9"
+		logic_hash = "v1_sha256_b825247372aace6e3ce0ff1d9685b6bb041b7277f8967d5f5926b49813cfadc9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79399,10 +79532,10 @@ rule ELASTIC_Linux_Cryptominer_Stak_52Dc7Af3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Stak.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Stak.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a9c14b51f95d0c368bf90fb10e7d821a2fbcc79df32fd9f068a7fc053cbd7e83"
-		logic_hash = "81998164f517b6f1ef72b10227cfff86aa8bbd2b4e2668f946c8ed59696ae74d"
+		logic_hash = "v1_sha256_81998164f517b6f1ef72b10227cfff86aa8bbd2b4e2668f946c8ed59696ae74d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79428,10 +79561,10 @@ rule ELASTIC_Linux_Cryptominer_Stak_Bb3153Ac : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Stak.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Stak.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b974b6e6a239bcdc067c53cc8a6180c900052d7874075244dc49aaaa9414cca"
-		logic_hash = "e8516a24358b12863fe52c823ca67f0004457017334fe77dabf5f08d6bf2d907"
+		logic_hash = "v1_sha256_e8516a24358b12863fe52c823ca67f0004457017334fe77dabf5f08d6bf2d907"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -79457,10 +79590,10 @@ rule ELASTIC_Windows_Ransomware_Blackmatter_B548D151 : FILE MEMORY
 		date = "2021-08-03"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Blackmatter.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Blackmatter.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486"
-		logic_hash = "cf76a311de9d292a2ea09b3937b8eb7fd761b7c33a464a31acf6b9a5bf121959"
+		logic_hash = "v1_sha256_cf76a311de9d292a2ea09b3937b8eb7fd761b7c33a464a31acf6b9a5bf121959"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79486,10 +79619,10 @@ rule ELASTIC_Windows_Ransomware_Blackmatter_8394F6D5 : FILE MEMORY
 		date = "2021-08-03"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Blackmatter.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Blackmatter.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486"
-		logic_hash = "50a9b65ca6dde4fc32d2d57e72042f4380dd6c263ec5c33ce7c158151b91a5ae"
+		logic_hash = "v1_sha256_50a9b65ca6dde4fc32d2d57e72042f4380dd6c263ec5c33ce7c158151b91a5ae"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79515,10 +79648,10 @@ rule ELASTIC_Windows_Trojan_STRRAT_A3E48Cd2 : MEMORY
 		date = "2024-03-13"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_STRRAT.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_STRRAT.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9"
-		logic_hash = "32f79695829f703bf9996d212aeb563791aed28e1bbb9f700cb45325fd02db77"
+		logic_hash = "v1_sha256_32f79695829f703bf9996d212aeb563791aed28e1bbb9f700cb45325fd02db77"
 		score = 75
 		quality = 75
 		tags = "MEMORY"
@@ -79545,10 +79678,10 @@ rule ELASTIC_Linux_Rootkit_Perfctl_Ce456896 : FILE MEMORY
 		date = "2024-11-14"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Perfctl.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Perfctl.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "69de4c062eebb13bf2ee3ee0febfd4a621f2a17c3048416d897aecf14503213a"
-		logic_hash = "d3782e9674b20fc3efccf7491659969e09f74c2467f1643fe8f5019102f4ee54"
+		logic_hash = "v1_sha256_d3782e9674b20fc3efccf7491659969e09f74c2467f1643fe8f5019102f4ee54"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79567,7 +79700,7 @@ rule ELASTIC_Linux_Rootkit_Perfctl_Ce456896 : FILE MEMORY
 		$str3 = "rrr01" wide
 
 	condition:
-		any of ($a*) or 2 of ($str*)
+		any of ( $a* ) or 2 of ( $str* )
 }
 rule ELASTIC_Windows_Ransomware_Rook_Ee21Fa67 : FILE MEMORY
 {
@@ -79578,10 +79711,10 @@ rule ELASTIC_Windows_Ransomware_Rook_Ee21Fa67 : FILE MEMORY
 		date = "2022-01-14"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Rook.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Rook.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac"
-		logic_hash = "6fe19cfc572a3dceba5e26615d111a3c0fa1036e275a5640a5c5a8f8cdaf6dc1"
+		logic_hash = "v1_sha256_6fe19cfc572a3dceba5e26615d111a3c0fa1036e275a5640a5c5a8f8cdaf6dc1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79607,10 +79740,10 @@ rule ELASTIC_Windows_Ransomware_Maui_266Dea64 : FILE MEMORY
 		date = "2022-07-08"
 		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Maui.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Maui.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b7ecf7e9d0715f1122baf4ce745c5fcd769dee48150616753fec4d6da16e99e"
-		logic_hash = "2094920615b6297adb222003d25a8d0934a89f24869e7e70644a4956021c7afc"
+		logic_hash = "v1_sha256_2094920615b6297adb222003d25a8d0934a89f24869e7e70644a4956021c7afc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79635,7 +79768,7 @@ rule ELASTIC_Windows_Ransomware_Maui_266Dea64 : FILE MEMORY
 		$seq_get_pub_key = { B9 F4 FF FF FF 2B 4C 24 ?? 6A 02 51 53 E8 ?? ?? ?? ?? 8B 54 24 ?? 8B 07 53 6A ?? 52 50 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 32 DB 8B C7 E8 ?? ?? ?? ?? 89 46 28 8B 0F 51 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 83 C4 ?? 5F 8B C6 5E 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 }
 
 	condition:
-		5 of ($a*) or 2 of ($seq*)
+		5 of ( $a* ) or 2 of ( $seq* )
 }
 rule ELASTIC_Windows_Vulndriver_Fidpci_Cb7F69B5 : FILE
 {
@@ -79646,10 +79779,10 @@ rule ELASTIC_Windows_Vulndriver_Fidpci_Cb7F69B5 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Fidpci.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Fidpci.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46"
-		logic_hash = "459429fb4e5156890f19c451e48676c9cd06eaab1c2eaea9236737c795086b5f"
+		logic_hash = "v1_sha256_459429fb4e5156890f19c451e48676c9cd06eaab1c2eaea9236737c795086b5f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -79664,7 +79797,7 @@ rule ELASTIC_Windows_Vulndriver_Fidpci_Cb7F69B5 : FILE
 		$str1 = "\\fidpcidrv64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Rootkit_Arkd_Bbd56917 : FILE MEMORY
 {
@@ -79675,10 +79808,10 @@ rule ELASTIC_Linux_Rootkit_Arkd_Bbd56917 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Arkd.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Arkd.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e0765f0e90839b551778214c2f9ae567dd44838516a3df2c73396a488227a600"
-		logic_hash = "5e1ce9c37d92222e21b43f9e5f3275a70c6e8eb541c3762f9382c5d5c72fb50d"
+		logic_hash = "v1_sha256_5e1ce9c37d92222e21b43f9e5f3275a70c6e8eb541c3762f9382c5d5c72fb50d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79704,10 +79837,10 @@ rule ELASTIC_Windows_Hacktool_Sharpdump_7C17D8B1 : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpDump.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpDump.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "14c3ea569a1bd9ac3aced4f8dd58314532dbf974bfa359979e6c7b6a4bbf41ca"
-		logic_hash = "10ca29b097d9f1cef27349751e8f1e584ead1056a636224a80f00823ca878c13"
+		logic_hash = "v1_sha256_10ca29b097d9f1cef27349751e8f1e584ead1056a636224a80f00823ca878c13"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -79726,7 +79859,7 @@ rule ELASTIC_Windows_Hacktool_Sharpdump_7C17D8B1 : FILE MEMORY
 		$print_str3 = "[X] Not in high integrity, unable to MiniDump!" ascii wide
 
 	condition:
-		$guid or all of ($print_str*)
+		$guid or all of ( $print_str* )
 }
 rule ELASTIC_Linux_Ransomware_Royalpest_502A3Db6 : FILE MEMORY
 {
@@ -79737,10 +79870,10 @@ rule ELASTIC_Linux_Ransomware_Royalpest_502A3Db6 : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_RoyalPest.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_RoyalPest.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "09a79e5e20fa4f5aae610c8ce3fe954029a91972b56c6576035ff7e0ec4c1d14"
-		logic_hash = "aefb5a286636b827b50e4bc0ea978a75ba6a9e572504bfbc0a7700372c54a077"
+		logic_hash = "v1_sha256_aefb5a286636b827b50e4bc0ea978a75ba6a9e572504bfbc0a7700372c54a077"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79769,10 +79902,10 @@ rule ELASTIC_Windows_Rootkit_R77_5Bab748B : FILE MEMORY
 		date = "2022-03-04"
 		modified = "2022-04-12"
 		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Rootkit_R77.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Rootkit_R77.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c"
-		logic_hash = "ebf851ef41fde8e3118acc742cd2b38651f662a00f11dd6f7c65cf56019c43d5"
+		logic_hash = "v1_sha256_ebf851ef41fde8e3118acc742cd2b38651f662a00f11dd6f7c65cf56019c43d5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79798,10 +79931,10 @@ rule ELASTIC_Windows_Rootkit_R77_Eb366Abc : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Rootkit_R77.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Rootkit_R77.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "21e7f69986987fc75bce67c4deda42bd7605365bac83cf2cecb25061b2d86d4f"
-		logic_hash = "3d6f1c60bf749c53f4a4fcfd6490d309e4450d5f7e64de4665c3d80af1bce44f"
+		logic_hash = "v1_sha256_3d6f1c60bf749c53f4a4fcfd6490d309e4450d5f7e64de4665c3d80af1bce44f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79828,10 +79961,10 @@ rule ELASTIC_Windows_Rootkit_R77_99050E7D : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Rootkit_R77.yar#L44-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Rootkit_R77.yar#L44-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3dc94c88caa3169e096715eb6c2e6de1b011120117c0a51d12f572b4ba999ea6"
-		logic_hash = "0fedf4698cc652076090b1fe256d05d2c0bc3ad2ab7ed5faa270c5c7fe0efca1"
+		logic_hash = "v1_sha256_0fedf4698cc652076090b1fe256d05d2c0bc3ad2ab7ed5faa270c5c7fe0efca1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79858,10 +79991,10 @@ rule ELASTIC_Windows_Rootkit_R77_Be403E3C : FILE MEMORY
 		date = "2023-05-18"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Rootkit_R77.yar#L66-L85"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Rootkit_R77.yar#L66-L85"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "91c6e2621121a6871af091c52fafe41220ae12d6e47e52fd13a7b9edd8e31796"
-		logic_hash = "efbf924c7a299f2543c639b6262007eb3bdbf6ff5e33dab7d6102814b9477811"
+		logic_hash = "v1_sha256_efbf924c7a299f2543c639b6262007eb3bdbf6ff5e33dab7d6102814b9477811"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79887,10 +80020,10 @@ rule ELASTIC_Windows_Rootkit_R77_Ee853C9F : FILE MEMORY
 		date = "2023-05-18"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Rootkit_R77.yar#L87-L112"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Rootkit_R77.yar#L87-L112"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "916c805b0d512dd7bbd88f46632d66d9613de61691b4bd368e4b7cb1f0ac7f60"
-		logic_hash = "94f080f310ecace76da32ba2b4edcc80dedfb339113823708167c1d842db8cf3"
+		logic_hash = "v1_sha256_94f080f310ecace76da32ba2b4edcc80dedfb339113823708167c1d842db8cf3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79911,7 +80044,7 @@ rule ELASTIC_Windows_Rootkit_R77_Ee853C9F : FILE MEMORY
 		$amsi_patch_ps = "[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3)" wide fullword
 
 	condition:
-		($obfuscate_ps and $amsi_patch_ps) or ( all of ($r77_str*))
+		($obfuscate_ps and $amsi_patch_ps ) or ( all of ( $r77_str* ) )
 }
 rule ELASTIC_Windows_Rootkit_R77_D0367E28 : FILE MEMORY
 {
@@ -79922,10 +80055,10 @@ rule ELASTIC_Windows_Rootkit_R77_D0367E28 : FILE MEMORY
 		date = "2023-05-18"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Rootkit_R77.yar#L114-L141"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Rootkit_R77.yar#L114-L141"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "96849108e13172d14591169f8fdcbf8a8aa6be05b7b6ef396d65529eacc02d89"
-		logic_hash = "588b18c54c344ca267b86143df20c7dcaab081e0ef6acae0bd0dae61593eb521"
+		logic_hash = "v1_sha256_588b18c54c344ca267b86143df20c7dcaab081e0ef6acae0bd0dae61593eb521"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -79948,7 +80081,7 @@ rule ELASTIC_Windows_Rootkit_R77_D0367E28 : FILE MEMORY
 		$binary1 = { 8B 56 04 8B 4F 04 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 08 8B 4F 08 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 0C 8B 4F 0C E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 10 8B 4F 10 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 14 8B 4F 14 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 18 8B 4F 18 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 1C 8B 4F 1C }
 
 	condition:
-		( all of ($str*)) or $binary0 or $binary1
+		( all of ( $str* ) ) or $binary0 or $binary1
 }
 rule ELASTIC_Linux_Exploit_Perl_4A4B8A42 : FILE MEMORY
 {
@@ -79959,10 +80092,10 @@ rule ELASTIC_Linux_Exploit_Perl_4A4B8A42 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Perl.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Perl.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
-		logic_hash = "c1f7b1c20fe6db6acbe46be38cc97a40de6ca047a4e4490e86610dbff356b395"
+		logic_hash = "v1_sha256_c1f7b1c20fe6db6acbe46be38cc97a40de6ca047a4e4490e86610dbff356b395"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -79988,10 +80121,10 @@ rule ELASTIC_Linux_Exploit_Perl_982Bb709 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Perl.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Perl.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e4e2b5af9d0c72aae83cec57e5c091a95c549f826e8f13559aaf7d300f6e13"
-		logic_hash = "b38e6cb15034c38c31f6b267b9ecaabe8dfa950a2fc8863cfff7705182cffb3a"
+		logic_hash = "v1_sha256_b38e6cb15034c38c31f6b267b9ecaabe8dfa950a2fc8863cfff7705182cffb3a"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -80017,10 +80150,10 @@ rule ELASTIC_Windows_Trojan_Diamondfox_18Bc11E3 : FILE MEMORY
 		date = "2022-03-02"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DiamondFox.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DiamondFox.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a44c46d4b9cf1254aaabd1e689f84c4d2c3dd213597f827acabface03a1ae6d1"
-		logic_hash = "c64e4b3349b33cfd0fec1fe41f91ad819bb6b6751e822d7ab8d14638ad27571d"
+		logic_hash = "v1_sha256_c64e4b3349b33cfd0fec1fe41f91ad819bb6b6751e822d7ab8d14638ad27571d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80050,10 +80183,10 @@ rule ELASTIC_Windows_Trojan_Amadey_7Abb059B : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Amadey.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Amadey.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e"
-		logic_hash = "23b75d6df9e2a7f8e1efee46ecaf1fc84247312b19a8a1941ddbca1b2ce5e1db"
+		logic_hash = "v1_sha256_23b75d6df9e2a7f8e1efee46ecaf1fc84247312b19a8a1941ddbca1b2ce5e1db"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80079,10 +80212,10 @@ rule ELASTIC_Windows_Trojan_Amadey_C4Df8D4A : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Amadey.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Amadey.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2"
-		logic_hash = "7f96c4de585223033fb7e7906be6d6898651ecf30be51ed01abde18ef52c0e1e"
+		logic_hash = "v1_sha256_7f96c4de585223033fb7e7906be6d6898651ecf30be51ed01abde18ef52c0e1e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80108,10 +80241,10 @@ rule ELASTIC_Linux_Trojan_Swrort_5Ad1A4F9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Swrort.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Swrort.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fa5695c355a6dc1f368a4b36a45e8f18958dacdbe0eac80c618fbec976bac8fe"
-		logic_hash = "3a1fa978e0c8ab0dd4e7965a3f91306d6123c19f21b86d3f8088979bf58c3a07"
+		logic_hash = "v1_sha256_3a1fa978e0c8ab0dd4e7965a3f91306d6123c19f21b86d3f8088979bf58c3a07"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80137,10 +80270,10 @@ rule ELASTIC_Linux_Trojan_Swrort_4Cb5B116 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Swrort.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Swrort.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "703c16d4fcc6f815f540d50d8408ea00b4cf8060cc5f6f3ba21be047e32758e0"
-		logic_hash = "9404856fc3290f3a8f9bf891fde9a614fc4484719eb3b51ce7ab601a41e0c3a5"
+		logic_hash = "v1_sha256_9404856fc3290f3a8f9bf891fde9a614fc4484719eb3b51ce7ab601a41e0c3a5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80166,10 +80299,10 @@ rule ELASTIC_Linux_Trojan_Swrort_22C2D6B6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Swrort.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Swrort.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6df073767f48dd79f98e60aa1079f3ab0b89e4f13eedc1af3c2c073e5e235bbc"
-		logic_hash = "f661544d267a55feec786ab3d4fc4f002afa8e2b58833461f56b745ec65acfd4"
+		logic_hash = "v1_sha256_f661544d267a55feec786ab3d4fc4f002afa8e2b58833461f56b745ec65acfd4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80195,10 +80328,10 @@ rule ELASTIC_Windows_Trojan_Doubleback_D2246A35 : FILE MEMORY
 		date = "2022-05-29"
 		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DoubleBack.yar#L1-L31"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DoubleBack.yar#L1-L31"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "03d2a0747d06458ccddf65ff5847a511a105e0ad4dcb5134082623af6f705012"
-		logic_hash = "2241d2c6e5b5896fe6f3b02cb1786c39fa620ee503c4585bd75c8763b6d3c06a"
+		logic_hash = "v1_sha256_2241d2c6e5b5896fe6f3b02cb1786c39fa620ee503c4585bd75c8763b6d3c06a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80225,7 +80358,7 @@ rule ELASTIC_Windows_Trojan_Doubleback_D2246A35 : FILE MEMORY
 		$x86_guid = { 55 8B EC 83 EC ?? B8 DD CC BB AA 56 57 6A ?? 8D 75 ?? 5F }
 
 	condition:
-		5 of ($s*) or 2 of ($x64_*) or 2 of ($x86_*)
+		5 of ( $s* ) or 2 of ( $x64_* ) or 2 of ( $x86_* )
 }
 rule ELASTIC_Windows_Wiper_Caddywiper_484Bd98A : FILE MEMORY
 {
@@ -80236,10 +80369,10 @@ rule ELASTIC_Windows_Wiper_Caddywiper_484Bd98A : FILE MEMORY
 		date = "2022-03-14"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Wiper_CaddyWiper.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Wiper_CaddyWiper.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
-		logic_hash = "f473673afc211b02328f4e9d88e709acd95bf4b1fa565f5aca972b92324bf589"
+		logic_hash = "v1_sha256_f473673afc211b02328f4e9d88e709acd95bf4b1fa565f5aca972b92324bf589"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80268,10 +80401,10 @@ rule ELASTIC_Windows_Hacktool_Ringq_B9715540 : FILE MEMORY
 		date = "2024-06-28"
 		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_RingQ.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_RingQ.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "450e01c32618cd4e4a327147896352ed1b34dca9fb28389dba450acf95f8b735"
-		logic_hash = "80d693c43a7026d28121e035ae875689512fd46d7f06c3f469b83d6fe707f36b"
+		logic_hash = "v1_sha256_80d693c43a7026d28121e035ae875689512fd46d7f06c3f469b83d6fe707f36b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80303,10 +80436,10 @@ rule ELASTIC_Windows_Hacktool_Sharpwmi_A67D6Fe5 : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpWMI.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpWMI.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2134a5e1a5eece1336f831a7686c5ea3b6ca5aaa63ab7e7820be937da0678e15"
-		logic_hash = "de8749951ece8d4798ade4661d531515e12edf8e8606ddc330000d847a66a26c"
+		logic_hash = "v1_sha256_de8749951ece8d4798ade4661d531515e12edf8e8606ddc330000d847a66a26c"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -80329,7 +80462,7 @@ rule ELASTIC_Windows_Hacktool_Sharpwmi_A67D6Fe5 : FILE MEMORY
 		$print_str1 = "[+] Attempted to terminate remote process ({0}). Returned: {1}" ascii wide
 
 	condition:
-		$guid or ( all of ($str*) and 1 of ($print_str*))
+		$guid or ( all of ( $str* ) and 1 of ( $print_str* ) )
 }
 rule ELASTIC_Windows_Vulndriver_Powerprofiler_2Eedff78 : FILE
 {
@@ -80340,10 +80473,10 @@ rule ELASTIC_Windows_Vulndriver_Powerprofiler_2Eedff78 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_PowerProfiler.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_PowerProfiler.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
-		logic_hash = "c4a7ae2ffdf70984cea5b543af93b202c78b6108da1e442186d24071b44d6259"
+		logic_hash = "v1_sha256_c4a7ae2ffdf70984cea5b543af93b202c78b6108da1e442186d24071b44d6259"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -80360,7 +80493,7 @@ rule ELASTIC_Windows_Vulndriver_Powerprofiler_2Eedff78 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Iqvw_B8B45E6B : FILE
 {
@@ -80371,10 +80504,10 @@ rule ELASTIC_Windows_Vulndriver_Iqvw_B8B45E6B : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Iqvw.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Iqvw.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
-		logic_hash = "b0a8716f550ba231ca7db61bafd6effbc351faa45864f9ebf7be81f63f14a933"
+		logic_hash = "v1_sha256_b0a8716f550ba231ca7db61bafd6effbc351faa45864f9ebf7be81f63f14a933"
 		score = 60
 		quality = 55
 		tags = "FILE"
@@ -80391,7 +80524,7 @@ rule ELASTIC_Windows_Vulndriver_Iqvw_B8B45E6B : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x04][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x03][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Linux_Virus_Rst_1214E2Ae : FILE MEMORY
 {
@@ -80402,10 +80535,10 @@ rule ELASTIC_Linux_Virus_Rst_1214E2Ae : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Virus_Rst.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Virus_Rst.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b0e4f44d2456960bb6b20cb468c4ca1390338b83774b7af783c3d03e49eebe44"
-		logic_hash = "82de4a97f414d591daba2d5d49b941ec4c51d6a6af36f97f062eaac5c74ebe30"
+		logic_hash = "v1_sha256_82de4a97f414d591daba2d5d49b941ec4c51d6a6af36f97f062eaac5c74ebe30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80431,10 +80564,10 @@ rule ELASTIC_Windows_Trojan_Revcoderat_8E6D4182 : FILE MEMORY
 		date = "2021-09-02"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Revcoderat.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Revcoderat.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210"
-		logic_hash = "35626d752b291e343350534aece35f1d875068c2c050d12312a60e67753c71e1"
+		logic_hash = "v1_sha256_35626d752b291e343350534aece35f1d875068c2c050d12312a60e67753c71e1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80463,10 +80596,10 @@ rule ELASTIC_Windows_Trojan_Vidar_9007Feb2 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Vidar.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Vidar.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec"
-		logic_hash = "fcdef7397f17ee402155e526c6fa8b51f3ea96e203a095b0b4c36cb7d3cc83d1"
+		logic_hash = "v1_sha256_fcdef7397f17ee402155e526c6fa8b51f3ea96e203a095b0b4c36cb7d3cc83d1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80492,10 +80625,10 @@ rule ELASTIC_Windows_Trojan_Vidar_114258D5 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Vidar.yar#L21-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Vidar.yar#L21-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec"
-		logic_hash = "9ea3ea0533d14edd0332fa688497efd566a890d1507214fc8591a0a11433d060"
+		logic_hash = "v1_sha256_9ea3ea0533d14edd0332fa688497efd566a890d1507214fc8591a0a11433d060"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80515,7 +80648,7 @@ rule ELASTIC_Windows_Trojan_Vidar_114258D5 : FILE MEMORY
 		$b3 = "Autofill\\%s_%s.txt" fullword
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		1 of ( $a* ) and 1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Vidar_32Fea8Da : FILE MEMORY
 {
@@ -80526,10 +80659,10 @@ rule ELASTIC_Windows_Trojan_Vidar_32Fea8Da : FILE MEMORY
 		date = "2023-05-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Vidar.yar#L46-L66"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Vidar.yar#L46-L66"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6f5c24fc5af2085233c96159402cec9128100c221cb6cb0d1c005ced7225e211"
-		logic_hash = "1a18cdc3bd533c34eb05b239830ecec418dc76ee9f4fcfc48afc73b07d55b3cd"
+		logic_hash = "v1_sha256_1a18cdc3bd533c34eb05b239830ecec418dc76ee9f4fcfc48afc73b07d55b3cd"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -80557,10 +80690,10 @@ rule ELASTIC_Windows_Trojan_Vidar_C374Cd85 : FILE MEMORY
 		date = "2024-01-31"
 		modified = "2024-10-14"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Vidar.yar#L68-L86"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Vidar.yar#L68-L86"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1c677585a8b724332849c411ffe2563b2b753fd6699c210f0720352f52a6ab72"
-		logic_hash = "8e183f780400f3bf9840798d53b431a4bf28bc43e07d69a3d614217e02f5dd79"
+		logic_hash = "v1_sha256_8e183f780400f3bf9840798d53b431a4bf28bc43e07d69a3d614217e02f5dd79"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80586,10 +80719,10 @@ rule ELASTIC_Windows_Trojan_Vidar_65D3D7E5 : FILE MEMORY
 		date = "2024-10-14"
 		modified = "2024-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Vidar.yar#L88-L114"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Vidar.yar#L88-L114"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "83d7c2b437a5cbb314c457d3b7737305dadb2bc02d6562a98a8a8994061fe929"
-		logic_hash = "2b340f43faf563c7edbce6323d551208c4d9541d7153ea6c1c0d9a95b351e54b"
+		logic_hash = "v1_sha256_2b340f43faf563c7edbce6323d551208c4d9541d7153ea6c1c0d9a95b351e54b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80623,10 +80756,10 @@ rule ELASTIC_Windows_Trojan_Havoc_77F3D40E : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Havoc.yar#L1-L35"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Havoc.yar#L1-L35"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3427dac129b760a03f2c40590c01065c9bf2340d2dfa4a4a7cf4830a02e95879"
-		logic_hash = "3d2733ed24d90e9e851ec36a08c497e9c90b47c3dcbb8755e3f6b6a6bd3a8b54"
+		logic_hash = "v1_sha256_3d2733ed24d90e9e851ec36a08c497e9c90b47c3dcbb8755e3f6b6a6bd3a8b54"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80657,7 +80790,7 @@ rule ELASTIC_Windows_Trojan_Havoc_77F3D40E : FILE MEMORY
 		$hashes_14 = { D7 53 22 AC }
 
 	condition:
-		$core or ($commands_table and all of ($hashes*))
+		$core or ( $commands_table and all of ( $hashes* ) )
 }
 rule ELASTIC_Windows_Trojan_Havoc_9C7Bb863 : FILE MEMORY
 {
@@ -80668,10 +80801,10 @@ rule ELASTIC_Windows_Trojan_Havoc_9C7Bb863 : FILE MEMORY
 		date = "2023-04-28"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Havoc.yar#L37-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Havoc.yar#L37-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "261b92d9e8dcb9d0abf1627b791831ec89779f2b7973b1926c6ec9691288dd57"
-		logic_hash = "c1245c38c54b0a72fb335680d9ea191390e4e2fe7e47a3ed776878c5e01a3e16"
+		logic_hash = "v1_sha256_c1245c38c54b0a72fb335680d9ea191390e4e2fe7e47a3ed776878c5e01a3e16"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80698,10 +80831,10 @@ rule ELASTIC_Windows_Trojan_Havoc_88053562 : FILE MEMORY
 		date = "2024-01-04"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Havoc.yar#L58-L76"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Havoc.yar#L58-L76"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2f0b59f8220edd0d34fba92905faf0b51aead95d53be8b5f022eed7e21bdb4af"
-		logic_hash = "f79b39cc2ca4bbf6ad4b6585a9914a75797110d6fb68bcb7141c5c3d0429c412"
+		logic_hash = "v1_sha256_f79b39cc2ca4bbf6ad4b6585a9914a75797110d6fb68bcb7141c5c3d0429c412"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80727,10 +80860,10 @@ rule ELASTIC_Windows_Trojan_Havoc_Ffecc8Af : FILE MEMORY
 		date = "2024-04-29"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Havoc.yar#L78-L107"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Havoc.yar#L78-L107"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "495d323651c252e38814b77b9c6c913b9489e769252ac8bbaf8432f15e0efe44"
-		logic_hash = "c9da6215db1de91a6cd52dd6558dc5a60bbd69abc6fa0db8714f001cdae20ddb"
+		logic_hash = "v1_sha256_c9da6215db1de91a6cd52dd6558dc5a60bbd69abc6fa0db8714f001cdae20ddb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80756,7 +80889,7 @@ rule ELASTIC_Windows_Trojan_Havoc_Ffecc8Af : FILE MEMORY
 		$hash_ntopenthreadtoken = { D2 47 33 80 }
 
 	condition:
-		$commands_table and 4 of ($hash_*)
+		$commands_table and 4 of ( $hash_* )
 }
 rule ELASTIC_Linux_Trojan_Snessik_D166F98C : FILE MEMORY
 {
@@ -80767,10 +80900,10 @@ rule ELASTIC_Linux_Trojan_Snessik_D166F98C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Snessik.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Snessik.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3ececc2edfff2f92d80ed3a5140af55b6bebf7cae8642a0d46843162eeddddd"
-		logic_hash = "44f15a87d48338aafa408d4bcabef844c8864cd95640ad99208b5035e28ccd27"
+		logic_hash = "v1_sha256_44f15a87d48338aafa408d4bcabef844c8864cd95640ad99208b5035e28ccd27"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80796,10 +80929,10 @@ rule ELASTIC_Linux_Trojan_Snessik_E435A79C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Snessik.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Snessik.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e24749b07f824a4839b462ec4e086a4064b29069e7224c24564e2ad7028d5d60"
-		logic_hash = "4850530a0566844447f56f4e5cb43c5982b1dcb784bb1aef3e377525b8651ed3"
+		logic_hash = "v1_sha256_4850530a0566844447f56f4e5cb43c5982b1dcb784bb1aef3e377525b8651ed3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80825,10 +80958,10 @@ rule ELASTIC_Linux_Rootkit_Hiddenwasp_8408057B : FILE MEMORY
 		date = "2024-11-14"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_HiddenWasp.yar#L1-L34"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_HiddenWasp.yar#L1-L34"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7c5e20872bc0ac5cce83d4c68485743cd16a818cd1e495f97438caad0399c847"
-		logic_hash = "1d21cdd38d7428c498eface37fb8b1ca1e99295c88f57cb638871753d0be0f15"
+		logic_hash = "v1_sha256_1d21cdd38d7428c498eface37fb8b1ca1e99295c88f57cb638871753d0be0f15"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80858,7 +80991,7 @@ rule ELASTIC_Linux_Rootkit_Hiddenwasp_8408057B : FILE MEMORY
 		$func14 = "hidden_services"
 
 	condition:
-		all of ($str*) or 5 of ($func*)
+		all of ( $str* ) or 5 of ( $func* )
 }
 rule ELASTIC_Linux_Ransomware_Monti_9C64F016 : FILE MEMORY
 {
@@ -80869,10 +81002,10 @@ rule ELASTIC_Linux_Ransomware_Monti_9C64F016 : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Monti.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Monti.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ad8d1b28405d9aebae6f42db1a09daec471bf342e9e0a10ab4e0a258a7fa8713"
-		logic_hash = "c22a4efaaf97d68deaf1978e637dd7f790541e5007c6323629bcc9e3d4eecd06"
+		logic_hash = "v1_sha256_c22a4efaaf97d68deaf1978e637dd7f790541e5007c6323629bcc9e3d4eecd06"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80901,9 +81034,9 @@ rule ELASTIC_Linux_Trojan_Ebury_7B13E9B6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ebury.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "30d126ffc5b782236663c23734f1eef21e1cc929d549a37bba8e1e7b41321111"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ebury.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_30d126ffc5b782236663c23734f1eef21e1cc929d549a37bba8e1e7b41321111"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -80929,10 +81062,10 @@ rule ELASTIC_Linux_Backdoor_Fontonlake_Fe916A45 : FILE MEMORY
 		date = "2021-10-12"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Backdoor_Fontonlake.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Backdoor_Fontonlake.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8a0a9740cf928b3bd1157a9044c6aced0dfeef3aa25e9ff9c93e113cbc1117ee"
-		logic_hash = "590b28264345ea0bdbd53791f422cb4f1fad143df2b790824fc182356a568d7d"
+		logic_hash = "v1_sha256_590b28264345ea0bdbd53791f422cb4f1fad143df2b790824fc182356a568d7d"
 		score = 75
 		quality = 48
 		tags = "FILE, MEMORY"
@@ -80968,10 +81101,10 @@ rule ELASTIC_Windows_Vulndriver_Asrock_986D2D3C : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Asrock.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Asrock.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
-		logic_hash = "d767a1ecdff557753f80ac9d73f02364dd035f7a287d0f260316f807364af2d5"
+		logic_hash = "v1_sha256_d767a1ecdff557753f80ac9d73f02364dd035f7a287d0f260316f807364af2d5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -80986,7 +81119,7 @@ rule ELASTIC_Windows_Vulndriver_Asrock_986D2D3C : FILE
 		$str1 = "\\AsrDrv106.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Vulndriver_Asrock_Cdf192F9 : FILE
 {
@@ -80997,10 +81130,10 @@ rule ELASTIC_Windows_Vulndriver_Asrock_Cdf192F9 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Asrock.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Asrock.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d"
-		logic_hash = "2f844b6d3fa19fd39097395175162578ad71d78c61dad104efd320cd8285fa6b"
+		logic_hash = "v1_sha256_2f844b6d3fa19fd39097395175162578ad71d78c61dad104efd320cd8285fa6b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -81015,7 +81148,7 @@ rule ELASTIC_Windows_Vulndriver_Asrock_Cdf192F9 : FILE
 		$str1 = "\\AsrDrv103.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Vulndriver_Asrock_0Eca57Dc : FILE
 {
@@ -81026,11 +81159,11 @@ rule ELASTIC_Windows_Vulndriver_Asrock_0Eca57Dc : FILE
 		date = "2023-07-20"
 		modified = "2023-07-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Asrock.yar#L41-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Asrock.yar#L41-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9d9346e6f46f831e263385a9bd32428e01919cca26a035bbb8e9cb00bf410bc3"
 		hash = "a0728184caead84f2e88777d833765f2d8af6a20aad77b426e07e76ef91f5c3f"
-		logic_hash = "82a0cba571dc58ed8d3fd87d3650ec0c1016e6c8e972547f6120ba91c8febce1"
+		logic_hash = "v1_sha256_82a0cba571dc58ed8d3fd87d3650ec0c1016e6c8e972547f6120ba91c8febce1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -81047,7 +81180,7 @@ rule ELASTIC_Windows_Vulndriver_Asrock_0Eca57Dc : FILE
 		$file_version = { 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E [1-8] 31 00 2E 00 30 00 30 00 2E 00 30 00 30 00 2E 00 30 00 30 00 30 00 30 00 20 00 62 00 75 00 69 00 6C 00 74 00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E 00 44 00 44 00 4B }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $file_version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $file_version
 }
 rule ELASTIC_Windows_Trojan_Phoreal_66E91De3 : FILE MEMORY
 {
@@ -81058,10 +81191,10 @@ rule ELASTIC_Windows_Trojan_Phoreal_66E91De3 : FILE MEMORY
 		date = "2022-02-16"
 		modified = "2022-04-12"
 		reference = "https://www.elastic.co/security-labs/phoreal-malware-targets-the-southeast-asian-financial-sector"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Phoreal.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Phoreal.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "88f073552b30462a00d1d612b1638b0508e4ef02c15cf46203998091f0aef4de"
-		logic_hash = "c68131fd5e0272d3d473db387a186056a38e6611925ae448d5b668022e6e163a"
+		logic_hash = "v1_sha256_c68131fd5e0272d3d473db387a186056a38e6611925ae448d5b668022e6e163a"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -81090,10 +81223,10 @@ rule ELASTIC_Windows_Trojan_Hancitor_6738D84A : FILE MEMORY
 		date = "2021-06-17"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Hancitor.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Hancitor.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a674898f39377e538f9ec54197689c6fa15f00f51aa0b5cc75c2bafd86384a40"
-		logic_hash = "448243b6925c4e419b1fd492ac5e8d43a7baa4492ba7a5a0b44bc8e036c77ec2"
+		logic_hash = "v1_sha256_448243b6925c4e419b1fd492ac5e8d43a7baa4492ba7a5a0b44bc8e036c77ec2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81110,7 +81243,7 @@ rule ELASTIC_Windows_Trojan_Hancitor_6738D84A : FILE MEMORY
 		$b2 = "MASSLoader.dll" ascii fullword
 
 	condition:
-		$a1 or all of ($b*)
+		$a1 or all of ( $b* )
 }
 rule ELASTIC_Windows_Vulndriver_Speedfan_9B590Eee : FILE
 {
@@ -81121,10 +81254,10 @@ rule ELASTIC_Windows_Vulndriver_Speedfan_9B590Eee : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Speedfan.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Speedfan.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
-		logic_hash = "6f75c0e6b89dd1ceb85c73b7e51fd261ca2804e14a5f8ed6ce3352b3f1bcdfe4"
+		logic_hash = "v1_sha256_6f75c0e6b89dd1ceb85c73b7e51fd261ca2804e14a5f8ed6ce3352b3f1bcdfe4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -81140,7 +81273,7 @@ rule ELASTIC_Windows_Vulndriver_Speedfan_9B590Eee : FILE
 		$subject_name = { 06 03 55 04 03 [2] 53 6F 6B 6E 6F 20 53 2E 52 2E 4C 2E }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $subject_name
 }
 rule ELASTIC_Linux_Hacktool_Flooder_825B6808 : FILE MEMORY
 {
@@ -81151,10 +81284,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_825B6808 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7db9a0760dd16e23cb299559a0e31a431b836a105d5309a9880fa4b821937659"
-		logic_hash = "f5f997d8401f1505e81072dcb0e24ad7a78f0b56133698b70d8dd93ef25ddaf3"
+		logic_hash = "v1_sha256_f5f997d8401f1505e81072dcb0e24ad7a78f0b56133698b70d8dd93ef25ddaf3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81180,10 +81313,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_A44Ab8Cd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4b2068a4a666b0279358b8eb4f480d2df4c518a8b4518d0d77c6687c3bff0a32"
-		logic_hash = "a0501f76aff532366292189d34a57844ba999748b94f349be2f391dfd96e2106"
+		logic_hash = "v1_sha256_a0501f76aff532366292189d34a57844ba999748b94f349be2f391dfd96e2106"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81209,10 +81342,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_7026F674 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b7a77ebb66664c54d01a57abed5bb034ef2933a9590b595bba0566938b099438"
-		logic_hash = "ec8ece1f922260f620fb30d82469f77a4d0239da536fc464fc37a3943cd6e463"
+		logic_hash = "v1_sha256_ec8ece1f922260f620fb30d82469f77a4d0239da536fc464fc37a3943cd6e463"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81238,10 +81371,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_761Ad88E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
-		logic_hash = "2b0c64da713e2f8ff671cbe086638810bc02a983d42851e78c68a57bde9f023c"
+		logic_hash = "v1_sha256_2b0c64da713e2f8ff671cbe086638810bc02a983d42851e78c68a57bde9f023c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81267,9 +81400,9 @@ rule ELASTIC_Linux_Hacktool_Flooder_B93655D3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L81-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "34cb06385543c6c2c562f757df2f641d8402e7c9f95fa924e17652a1c38d695f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L81-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_34cb06385543c6c2c562f757df2f641d8402e7c9f95fa924e17652a1c38d695f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81295,10 +81428,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_Af9F75E6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L100-L118"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L100-L118"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705"
-		logic_hash = "b74f5fad3c7219038e51eb4fa12fb9d55d7f65a9f4bab0adff8609fabb0afdab"
+		logic_hash = "v1_sha256_b74f5fad3c7219038e51eb4fa12fb9d55d7f65a9f4bab0adff8609fabb0afdab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81324,10 +81457,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_1Bf0E994 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L120-L138"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L120-L138"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ea2dc13eec0d7a8ec20307f5afac8e9344d827a6037bb96a54ad7b12f65b59c"
-		logic_hash = "2c1099b8078ac306f7cb67be5b5b5e34f57414b9aa26bdd6c26d3636c80846cd"
+		logic_hash = "v1_sha256_2c1099b8078ac306f7cb67be5b5b5e34f57414b9aa26bdd6c26d3636c80846cd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81353,10 +81486,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_D710A5Da : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L140-L158"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L140-L158"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ba895a9c449bf9bf6c092df88b6d862a3e8ed4079ef795e5520cb163a45bcdb4"
-		logic_hash = "118a29cc0ccd191181dabc134de282ba134e041113faaa4d95e0aa201646438b"
+		logic_hash = "v1_sha256_118a29cc0ccd191181dabc134de282ba134e041113faaa4d95e0aa201646438b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81382,10 +81515,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_F434A3Fb : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L160-L178"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L160-L178"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ba895a9c449bf9bf6c092df88b6d862a3e8ed4079ef795e5520cb163a45bcdb4"
-		logic_hash = "11b173f73b87f50775be50c6b4528bd9b148ea4266297aec76ae126cab0facb0"
+		logic_hash = "v1_sha256_11b173f73b87f50775be50c6b4528bd9b148ea4266297aec76ae126cab0facb0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81411,10 +81544,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_A2795A4C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L180-L198"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L180-L198"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9a564d6b29d2aaff960e6f84cd0ef4c701fefa2a62e2ea690106f3fdbabb0d71"
-		logic_hash = "18e15b8a417f9ff2fd9277a01eb3224c761807ce9541ece568f4525ae66eb81f"
+		logic_hash = "v1_sha256_18e15b8a417f9ff2fd9277a01eb3224c761807ce9541ece568f4525ae66eb81f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81440,10 +81573,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_678C1145 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L200-L218"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L200-L218"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "559793b9cb5340478f76aaf5f81c8dbfbcfa826657713d5257dac3c496b243a6"
-		logic_hash = "5ff15c8d92bca62700bbb67aeebc41fd603687dbc0c93733955bf59375df40a1"
+		logic_hash = "v1_sha256_5ff15c8d92bca62700bbb67aeebc41fd603687dbc0c93733955bf59375df40a1"
 		score = 60
 		quality = 45
 		tags = "FILE, MEMORY"
@@ -81469,10 +81602,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_3Cbdfb1F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L220-L238"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L220-L238"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bd40ac964f3ad2011841c7eb4bf7cab332d4d95191122e830ab031dc9511c079"
-		logic_hash = "38e8ca59bf55c32b99aa76a89f60edcf09956b7cad0b4745fab92eca327c52db"
+		logic_hash = "v1_sha256_38e8ca59bf55c32b99aa76a89f60edcf09956b7cad0b4745fab92eca327c52db"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -81498,10 +81631,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_8B63Ff02 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L240-L258"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L240-L258"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304"
-		logic_hash = "3b68353c8eeb21a3eba7a02ae76b66b4f094ec52d5309582544d247cc6548da3"
+		logic_hash = "v1_sha256_3b68353c8eeb21a3eba7a02ae76b66b4f094ec52d5309582544d247cc6548da3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81527,10 +81660,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_30973084 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L260-L278"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L260-L278"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a22ffa748bcaaed801f48f38b26a9cfdd5e62183a9f6f31c8a1d4a8443bf62a4"
-		logic_hash = "d965a032c0fb6020c6187aa3117f7251dd8c9287c45453e3d5ae2ac62b3067bb"
+		logic_hash = "v1_sha256_d965a032c0fb6020c6187aa3117f7251dd8c9287c45453e3d5ae2ac62b3067bb"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -81556,10 +81689,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_1Cfa95Dd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L280-L298"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L280-L298"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
-		logic_hash = "f73a96cc379c8dc060bfe5668ef7e47c5bcd037b3f41c300ef20c2f2f653cb00"
+		logic_hash = "v1_sha256_f73a96cc379c8dc060bfe5668ef7e47c5bcd037b3f41c300ef20c2f2f653cb00"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81585,10 +81718,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_25C48456 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L300-L318"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L300-L318"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "eba6f3e4f7b53e22522d82bdbdf5271c3fc701cbe07e9ecb7b4c0b85adc9d6b4"
-		logic_hash = "4ed4b901fccaed834b9908fb447da1521bf31f283ae55b6d8f6090814cf8fcd2"
+		logic_hash = "v1_sha256_4ed4b901fccaed834b9908fb447da1521bf31f283ae55b6d8f6090814cf8fcd2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81614,10 +81747,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_B1Ca2Abd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L320-L338"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L320-L338"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
-		logic_hash = "05b906a9823bf9ba25ba1ed490beb8f338429cbc744ca230c5c4cbb41ab9f140"
+		logic_hash = "v1_sha256_05b906a9823bf9ba25ba1ed490beb8f338429cbc744ca230c5c4cbb41ab9f140"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81643,10 +81776,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_Cce8C792 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L340-L358"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L340-L358"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ea56da9584fc36dc67cb1e746bd13c95c4d878f9d594e33221baad7e01571ee6"
-		logic_hash = "14700d24e8682ec04f2aae02f5820c4d956db60583b1bc61038b47e709705d0d"
+		logic_hash = "v1_sha256_14700d24e8682ec04f2aae02f5820c4d956db60583b1bc61038b47e709705d0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81672,10 +81805,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_4Bcea1C4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L360-L378"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L360-L378"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9a564d6b29d2aaff960e6f84cd0ef4c701fefa2a62e2ea690106f3fdbabb0d71"
-		logic_hash = "76019729a3a33fc04ff983f38b4fbf174a66da7ffc05cd07eb93e3cd5aecaaa2"
+		logic_hash = "v1_sha256_76019729a3a33fc04ff983f38b4fbf174a66da7ffc05cd07eb93e3cd5aecaaa2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81701,10 +81834,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_Ab561A1B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L380-L398"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L380-L398"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1b7df0d491974bead05d04ede6cf763ecac30ecff4d27bb4097c90cc9c3f4155"
-		logic_hash = "5720d2ada4b33514f2d528417876606d2951786df8b0512f9e8833b8ec87127a"
+		logic_hash = "v1_sha256_5720d2ada4b33514f2d528417876606d2951786df8b0512f9e8833b8ec87127a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81730,10 +81863,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_1A4Eb229 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L400-L418"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L400-L418"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705"
-		logic_hash = "83b04e366a05a46ad67b9aaf6b9658520e119003cd65941dd69416cbc5229c30"
+		logic_hash = "v1_sha256_83b04e366a05a46ad67b9aaf6b9658520e119003cd65941dd69416cbc5229c30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81759,10 +81892,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_51Ef0659 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L420-L438"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L420-L438"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b7a2bc75dd9c44c38b2a6e4e7e579142ece92a75b8a3f815940c5aa31470be2b"
-		logic_hash = "26dd95cb1cdaec10d408e294a3baca85d741cf5e56649cdcc79ef7216e4cb440"
+		logic_hash = "v1_sha256_26dd95cb1cdaec10d408e294a3baca85d741cf5e56649cdcc79ef7216e4cb440"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81788,10 +81921,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_D90C4Cbe : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L440-L458"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L440-L458"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
-		logic_hash = "145d32f8a06af18e6f13b0905cc51fd7b1a9e00b41b0f0a5d537ada2b54a94b5"
+		logic_hash = "v1_sha256_145d32f8a06af18e6f13b0905cc51fd7b1a9e00b41b0f0a5d537ada2b54a94b5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81817,10 +81950,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_C680C9Fd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L460-L478"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L460-L478"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ea56da9584fc36dc67cb1e746bd13c95c4d878f9d594e33221baad7e01571ee6"
-		logic_hash = "a283132ffdd109b8b1f01e5a3e2700b70b742945c7ae8b15b2b244fb249a5e3d"
+		logic_hash = "v1_sha256_a283132ffdd109b8b1f01e5a3e2700b70b742945c7ae8b15b2b244fb249a5e3d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81846,10 +81979,10 @@ rule ELASTIC_Linux_Hacktool_Flooder_E63396F4 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L480-L498"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L480-L498"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "913e6d2538bd7eed3a8f3d958cf445fe11c5c299a70e5385e0df6a9b2f638323"
-		logic_hash = "d3f7c62a7411caf86ee574a686b4b1972066602f89d39ae9e49ba66d9917c7c9"
+		logic_hash = "v1_sha256_d3f7c62a7411caf86ee574a686b4b1972066602f89d39ae9e49ba66d9917c7c9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81875,9 +82008,9 @@ rule ELASTIC_Linux_Hacktool_Flooder_7D5355Da : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "03397525f90c8c2242058d2f6afc81ceab199c5abcab8fd460fabb6b083d8d20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L500-L518"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "b4540f941ca1a36c460d056ef263ebd67c6388f3f6f373f50371f7cca2739bc4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L500-L518"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_b4540f941ca1a36c460d056ef263ebd67c6388f3f6f373f50371f7cca2739bc4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81903,9 +82036,9 @@ rule ELASTIC_Linux_Hacktool_Flooder_A9E8A90F : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "0558cf8cab0ba1515b3b69ac32975e5e18d754874e7a54d19098e7240ebf44e4"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L520-L538"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8f1fcb736a9363142a25426ef2d166f92526bffaf8069f1b12056c9cf5825379"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L520-L538"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8f1fcb736a9363142a25426ef2d166f92526bffaf8069f1b12056c9cf5825379"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81931,9 +82064,9 @@ rule ELASTIC_Linux_Hacktool_Flooder_A598192A : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "101f2240cd032831b9c0930a68ea6f74688f68ae801c776c71b488e17bc71871"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L540-L558"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "19909f53acca8c84125c95fc651765a25162c5f916366da8351e67675393e583"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L540-L558"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_19909f53acca8c84125c95fc651765a25162c5f916366da8351e67675393e583"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81959,9 +82092,9 @@ rule ELASTIC_Linux_Hacktool_Flooder_53Bf4E37 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "101f2240cd032831b9c0930a68ea6f74688f68ae801c776c71b488e17bc71871"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L560-L578"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d1aabf8067b74dac114e197722d51c4bbb9a78e6ba9b5401399930c29d55bdcc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L560-L578"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d1aabf8067b74dac114e197722d51c4bbb9a78e6ba9b5401399930c29d55bdcc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -81987,9 +82120,9 @@ rule ELASTIC_Linux_Hacktool_Flooder_50158A6E : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "1e0cdb655e48d21a6b02d2e1e62052ffaaec9fdfe65a3d180fc8afabc249e1d8"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L580-L598"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "67c22fcf514a3e8c2c27817798c796aacf00ba82e1090894aa2c1170a1e2a096"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L580-L598"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_67c22fcf514a3e8c2c27817798c796aacf00ba82e1090894aa2c1170a1e2a096"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82015,9 +82148,9 @@ rule ELASTIC_Linux_Hacktool_Flooder_F454Ec10 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "0297e1ad6e180af85256a175183102776212d324a2ce0c4f32e8a44a2e2e9dad"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L600-L618"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e5afb215632ad6359ba95df86316d496ea5e36edb79901c34e0710a6bd9c97d1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L600-L618"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e5afb215632ad6359ba95df86316d496ea5e36edb79901c34e0710a6bd9c97d1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82043,9 +82176,9 @@ rule ELASTIC_Linux_Hacktool_Flooder_9417F77B : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "60ff13e27dad5e6eadb04011aa653a15e1a07200b6630fdd0d0d72a9ba797d68"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Flooder.yar#L620-L638"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "470b7e44cd875b1f6abcfa5e4d33d2808a65630dc914b38643c9efb14db5f1ff"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Flooder.yar#L620-L638"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_470b7e44cd875b1f6abcfa5e4d33d2808a65630dc914b38643c9efb14db5f1ff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82071,9 +82204,9 @@ rule ELASTIC_Windows_Trojan_Dcrat_1Aeea1Ac : FILE MEMORY
 		date = "2022-01-15"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DCRat.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "6163e04a40ed52d5e94662131511c3ae08d473719c364e0f7de60dff7fa92cf7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DCRat.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_6163e04a40ed52d5e94662131511c3ae08d473719c364e0f7de60dff7fa92cf7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82094,7 +82227,7 @@ rule ELASTIC_Windows_Trojan_Dcrat_1Aeea1Ac : FILE MEMORY
 		$b2 = "DcRat By qwqdanchun1" ascii fullword
 
 	condition:
-		5 of ($a*) or 1 of ($b*)
+		5 of ( $a* ) or 1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Wineloader_13E8860A : FILE MEMORY
 {
@@ -82105,10 +82238,10 @@ rule ELASTIC_Windows_Trojan_Wineloader_13E8860A : FILE MEMORY
 		date = "2024-03-24"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_WineLoader.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_WineLoader.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f5cb3234eff0dbbd653d5cdce1d4b1026fa9574ebeaf16aaae3d4e921b6a7f9d"
-		logic_hash = "c072abb73377ed59c0dd9fab25a4c84575ab9badbddfda1ed51e576e4e12fa82"
+		logic_hash = "v1_sha256_c072abb73377ed59c0dd9fab25a4c84575ab9badbddfda1ed51e576e4e12fa82"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82136,10 +82269,10 @@ rule ELASTIC_Windows_Hacktool_Dinvokerust_512D3B59 : FILE MEMORY
 		date = "2024-02-28"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_DinvokeRust.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_DinvokeRust.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ebf0f1bfd166d2d49b642fa43cb0c7364c0c605d9a7f108dc49d9f1cc859ab4a"
-		logic_hash = "7be1a4e25cf41e47ab135c718b7ec5a49a2890cf873c52597f8dab4d47636ed8"
+		logic_hash = "v1_sha256_7be1a4e25cf41e47ab135c718b7ec5a49a2890cf873c52597f8dab4d47636ed8"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -82170,10 +82303,10 @@ rule ELASTIC_Windows_Trojan_Shadowpad_Be71209D : FILE MEMORY
 		date = "2023-01-31"
 		modified = "2023-02-01"
 		reference = "https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_ShadowPad.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_ShadowPad.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "452b08d6d2aa673fb6ccc4af6cebdcb12b5df8722f4d70d1c3491479e7b39c05"
-		logic_hash = "24e035bbcd5d44877e6e582a995d0035ad26c53e832c34b0c8a3836cb1a11637"
+		logic_hash = "v1_sha256_24e035bbcd5d44877e6e582a995d0035ad26c53e832c34b0c8a3836cb1a11637"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82200,10 +82333,10 @@ rule ELASTIC_Windows_Trojan_Shadowpad_0D899241 : MEMORY
 		date = "2023-01-31"
 		modified = "2023-02-01"
 		reference = "https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_ShadowPad.yar#L23-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_ShadowPad.yar#L23-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cb3a425565b854f7b892e6ebfb3734c92418c83cd590fc1ee9506bcf4d8e02ea"
-		logic_hash = "57385e149c6419aed2dcd3ecbbe26d8598918395a6480dd5cdb799ce7328901a"
+		logic_hash = "v1_sha256_57385e149c6419aed2dcd3ecbbe26d8598918395a6480dd5cdb799ce7328901a"
 		score = 75
 		quality = 75
 		tags = "MEMORY"
@@ -82235,10 +82368,10 @@ rule ELASTIC_Windows_Backdoor_Goldbackdoor_91902940 : FILE MEMORY
 		date = "2022-04-29"
 		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Backdoor_Goldbackdoor.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Backdoor_Goldbackdoor.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "485246b411ef5ea9e903397a5490d106946a8323aaf79e6041bdf94763a0c028"
-		logic_hash = "71e26cce6d730560e1303b2a4f49d0da6d1341263bb47ade46338f03e528cbf7"
+		logic_hash = "v1_sha256_71e26cce6d730560e1303b2a4f49d0da6d1341263bb47ade46338f03e528cbf7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82260,7 +82393,7 @@ rule ELASTIC_Windows_Backdoor_Goldbackdoor_91902940 : FILE MEMORY
 		$b = { 66 8B 02 83 C2 02 66 85 C0 75 ?? 2B D1 D1 FA 75 ?? 33 C0 E9 ?? ?? ?? ?? 6A 40 8D 45 ?? 6A 00 50 E8 }
 
 	condition:
-		($pdf and $agent) or ( all of ($str*) and $a and $b)
+		($pdf and $agent ) or ( all of ( $str* ) and $a and $b )
 }
 rule ELASTIC_Windows_Backdoor_Goldbackdoor_F11D57Df : FILE MEMORY
 {
@@ -82271,10 +82404,10 @@ rule ELASTIC_Windows_Backdoor_Goldbackdoor_F11D57Df : FILE MEMORY
 		date = "2022-04-29"
 		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Backdoor_Goldbackdoor.yar#L28-L51"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Backdoor_Goldbackdoor.yar#L28-L51"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "45ece107409194f5f1ec2fbd902d041f055a914e664f8ed2aa1f90e223339039"
-		logic_hash = "6401b215523289a3842dec6d3e016a2ca99512c5889e87cb5ff13023bb0b8e1e"
+		logic_hash = "v1_sha256_6401b215523289a3842dec6d3e016a2ca99512c5889e87cb5ff13023bb0b8e1e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82305,10 +82438,10 @@ rule ELASTIC_Windows_Trojan_Hijackloader_A8444812 : FILE MEMORY
 		date = "2023-11-15"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_HijackLoader.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_HijackLoader.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "065c379a33ef1539e8a68fd4b7638fe8a30ec19fc128642ed0c68539656374b9"
-		logic_hash = "6cd88adc7a0d35013a26d1135efb294ee6f9ddab99b4549e82d3d6f5f65509b6"
+		logic_hash = "v1_sha256_6cd88adc7a0d35013a26d1135efb294ee6f9ddab99b4549e82d3d6f5f65509b6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82339,10 +82472,10 @@ rule ELASTIC_Windows_Trojan_Arkeistealer_84C7086A : FILE MEMORY
 		date = "2022-02-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_ArkeiStealer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_ArkeiStealer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2"
-		logic_hash = "b7129094389f789f0b43f0da54645c24a6d1149f53d6536c14714e3ff44f935b"
+		logic_hash = "v1_sha256_b7129094389f789f0b43f0da54645c24a6d1149f53d6536c14714e3ff44f935b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82368,9 +82501,9 @@ rule ELASTIC_Windows_Ransomware_Clop_6A1670Aa : BETA FILE MEMORY
 		date = "2020-05-03"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Clop.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "afe28000d50495bf2f2adc6cbf0159591ce87bff207f3c6a1d38e09f9ed328d7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Clop.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_afe28000d50495bf2f2adc6cbf0159591ce87bff207f3c6a1d38e09f9ed328d7"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -82386,7 +82519,7 @@ rule ELASTIC_Windows_Ransomware_Clop_6A1670Aa : BETA FILE MEMORY
 		$b1 = { FF 15 04 E1 40 00 83 F8 03 74 0A 83 F8 02 }
 
 	condition:
-		1 of ($b*)
+		1 of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Clop_E04959B5 : BETA FILE MEMORY
 {
@@ -82397,9 +82530,9 @@ rule ELASTIC_Windows_Ransomware_Clop_E04959B5 : BETA FILE MEMORY
 		date = "2020-05-03"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Clop.yar#L22-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "039fcb0e48898c7546588cd095fac16f06cf5e5568141aefb6db382a61e80a8d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Clop.yar#L22-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_039fcb0e48898c7546588cd095fac16f06cf5e5568141aefb6db382a61e80a8d"
 		score = 75
 		quality = 50
 		tags = "BETA, FILE, MEMORY"
@@ -82424,7 +82557,7 @@ rule ELASTIC_Windows_Ransomware_Clop_E04959B5 : BETA FILE MEMORY
 		$a10 = "MoneyP#666" wide fullword
 
 	condition:
-		1 of ($a*)
+		1 of ( $a* )
 }
 rule ELASTIC_Windows_Ransomware_Clop_9Ac9Ea3E : BETA FILE MEMORY
 {
@@ -82435,9 +82568,9 @@ rule ELASTIC_Windows_Ransomware_Clop_9Ac9Ea3E : BETA FILE MEMORY
 		date = "2020-05-03"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Clop.yar#L52-L71"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "1228ee4b934faf1d5f8cf4518974cd2c80a73d84c8a354bde4813fb97ba516d7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Clop.yar#L52-L71"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_1228ee4b934faf1d5f8cf4518974cd2c80a73d84c8a354bde4813fb97ba516d7"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -82453,7 +82586,7 @@ rule ELASTIC_Windows_Ransomware_Clop_9Ac9Ea3E : BETA FILE MEMORY
 		$c1 = { 8B 1D D8 E0 40 00 33 F6 8B 3D BC E0 40 00 }
 
 	condition:
-		1 of ($c*)
+		1 of ( $c* )
 }
 rule ELASTIC_Windows_Ransomware_Clop_606020E7 : BETA FILE MEMORY
 {
@@ -82464,9 +82597,9 @@ rule ELASTIC_Windows_Ransomware_Clop_606020E7 : BETA FILE MEMORY
 		date = "2020-05-03"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Clop.yar#L73-L92"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "f5169b324bc19f6f5a04c99f1d3326c97300d038ec383c3eab94eb258963ac30"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Clop.yar#L73-L92"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_f5169b324bc19f6f5a04c99f1d3326c97300d038ec383c3eab94eb258963ac30"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -82482,7 +82615,7 @@ rule ELASTIC_Windows_Ransomware_Clop_606020E7 : BETA FILE MEMORY
 		$d1 = { B8 E1 83 0F 3E F7 E6 8B C6 C1 EA 04 8B CA C1 E1 05 03 CA }
 
 	condition:
-		1 of ($d*)
+		1 of ( $d* )
 }
 rule ELASTIC_Windows_Trojan_Metasploit_A6E956C9 : FILE MEMORY
 {
@@ -82493,9 +82626,9 @@ rule ELASTIC_Windows_Trojan_Metasploit_A6E956C9 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "fb4e3e54618075d5ef6ec98d1ba9c332ce9f677f0879e07b34a2ca08b2180dd9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_fb4e3e54618075d5ef6ec98d1ba9c332ce9f677f0879e07b34a2ca08b2180dd9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82522,9 +82655,9 @@ rule ELASTIC_Windows_Trojan_Metasploit_38B8Ceec : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8e3bc02661cedb9885467373f8120542bb7fc8b0944803bc01642fbc8426298b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8e3bc02661cedb9885467373f8120542bb7fc8b0944803bc01642fbc8426298b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82551,9 +82684,9 @@ rule ELASTIC_Windows_Trojan_Metasploit_7Bc0F998 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "29cb48086dbcd48bd83c5042ed78370e127e1ea5170ee7383b88659b31e896b5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_29cb48086dbcd48bd83c5042ed78370e127e1ea5170ee7383b88659b31e896b5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82580,9 +82713,9 @@ rule ELASTIC_Windows_Trojan_Metasploit_F7F826B4 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "2f5264e07c65d5ef4efe49a48c24ccef9a4b9379db581d2cf18e1131982e6f2f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2f5264e07c65d5ef4efe49a48c24ccef9a4b9379db581d2cf18e1131982e6f2f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82609,9 +82742,9 @@ rule ELASTIC_Windows_Trojan_Metasploit_24338919 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "af8cceebdebca863019860afca5d7c6400b68c8450bc17b7d7b74aeab2d62d16"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_af8cceebdebca863019860afca5d7c6400b68c8450bc17b7d7b74aeab2d62d16"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82638,9 +82771,9 @@ rule ELASTIC_Windows_Trojan_Metasploit_0F5A852D : FILE MEMORY
 		date = "2021-04-07"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "11cddf2191a2f70222a0c8c591e387b4b5667bc432a2f686629def9252361c1d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_11cddf2191a2f70222a0c8c591e387b4b5667bc432a2f686629def9252361c1d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82667,9 +82800,9 @@ rule ELASTIC_Windows_Trojan_Metasploit_C9773203 : FILE MEMORY
 		date = "2021-04-07"
 		modified = "2021-08-23"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L121-L140"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "1d6503ccf05b8e8b4368ed0fb2e57aa2be94151ce7e2445b5face7b226a118e9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L121-L140"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_1d6503ccf05b8e8b4368ed0fb2e57aa2be94151ce7e2445b5face7b226a118e9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82696,10 +82829,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_Dd5Ce989 : FILE MEMORY
 		date = "2021-04-14"
 		modified = "2021-08-23"
 		reference = "https://www.rapid7.com/blog/post/2015/03/25/stageless-meterpreter-payloads/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L142-L164"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L142-L164"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "86cf98bf854b01a55e3f306597437900e11d429ac6b7781e090eeda3a5acb360"
-		logic_hash = "5c094979be1cd347ffee944816b819b6fbb62804b183a6120cd3a93d2759155b"
+		logic_hash = "v1_sha256_5c094979be1cd347ffee944816b819b6fbb62804b183a6120cd3a93d2759155b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82717,7 +82850,7 @@ rule ELASTIC_Windows_Trojan_Metasploit_Dd5Ce989 : FILE MEMORY
 		$b1 = "ReflectiveLoader"
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		1 of ( $a* ) and 1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Metasploit_96233B6B : FILE MEMORY
 {
@@ -82728,10 +82861,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_96233B6B : FILE MEMORY
 		date = "2021-06-10"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L166-L185"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L166-L185"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e7a2d966deea3a2df6ce1aeafa8c2caa753824215a8368e0a96b394fb46b753b"
-		logic_hash = "09a2b9414a126367df65322966b671fe7ea963cd65ef48e316c9d139ee502d31"
+		logic_hash = "v1_sha256_09a2b9414a126367df65322966b671fe7ea963cd65ef48e316c9d139ee502d31"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82758,10 +82891,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_4A1C4Da8 : FILE MEMORY
 		date = "2021-06-10"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L187-L206"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L187-L206"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22"
-		logic_hash = "9d3a3164ed1019dcb557cf20734a81be9964a555ddb2e0104f7202880b2ed177"
+		logic_hash = "v1_sha256_9d3a3164ed1019dcb557cf20734a81be9964a555ddb2e0104f7202880b2ed177"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82788,10 +82921,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_91Bc5D7D : FILE MEMORY
 		date = "2021-08-02"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L208-L226"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L208-L226"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0dd993ff3917dc56ef02324375165f0d66506c5a9b9548eda57c58e041030987"
-		logic_hash = "74154902b03c36a4ee9bc54ae9399bae9e6afb7fe8d0fe232b88250afc368d6f"
+		logic_hash = "v1_sha256_74154902b03c36a4ee9bc54ae9399bae9e6afb7fe8d0fe232b88250afc368d6f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82817,10 +82950,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_A91A6571 : FILE MEMORY
 		date = "2022-06-08"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L228-L246"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L228-L246"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ff7795edff95a45b15b03d698cbdf70c19bc452daf4e2d5e86b2bbac55494472"
-		logic_hash = "cc59320ba9f8907d1d9b9dc120d8b4807b419e49c55be1fd5d2cdbb0c5d4e5cc"
+		logic_hash = "v1_sha256_cc59320ba9f8907d1d9b9dc120d8b4807b419e49c55be1fd5d2cdbb0c5d4e5cc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82846,10 +82979,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_B29Fe355 : FILE MEMORY
 		date = "2022-06-08"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L248-L268"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L248-L268"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4f0ab4e42e6c10bc9e4a699d8d8819b04c17ed1917047f770dc6980a0a378a68"
-		logic_hash = "7a2189b59175acb66a7497c692a43c413a476f5c4371f797bf03a8ddb550992c"
+		logic_hash = "v1_sha256_7a2189b59175acb66a7497c692a43c413a476f5c4371f797bf03a8ddb550992c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82877,10 +83010,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_66140F58 : FILE MEMORY
 		date = "2022-08-15"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L270-L288"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L270-L288"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01a0c5630fbbfc7043d21a789440fa9dadc6e4f79640b370f1a21c6ebf6a710a"
-		logic_hash = "0a855b7296f7cea39cc5d57b239d3906133ea43a0811ec60e4d91765cf89aced"
+		logic_hash = "v1_sha256_0a855b7296f7cea39cc5d57b239d3906133ea43a0811ec60e4d91765cf89aced"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82906,10 +83039,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_2092C42A : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L290-L309"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L290-L309"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e47d88c11a89dcc84257841de0c9f1ec388698006f55a0e15567354b33f07d3c"
-		logic_hash = "83c46c6b957f10d406ea9985c518eb2fba3e82b9023bfdefa8bdd4be7fb67826"
+		logic_hash = "v1_sha256_83c46c6b957f10d406ea9985c518eb2fba3e82b9023bfdefa8bdd4be7fb67826"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -82936,10 +83069,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_46E1C247 : FILE MEMORY
 		date = "2023-05-10"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L311-L330"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L311-L330"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ef70e1faa3b1f40d92b0a161c96e13c96c43ec6651e7c87ee3977ed07b950bab"
-		logic_hash = "760a4e28e312a7d744208dc833ffad8d139ce7c536b407625a7fb0dff5ddb1d1"
+		logic_hash = "v1_sha256_760a4e28e312a7d744208dc833ffad8d139ce7c536b407625a7fb0dff5ddb1d1"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -82966,10 +83099,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_B62Aac1E : FILE MEMORY
 		date = "2023-05-10"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L332-L351"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L332-L351"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "af9af81f7e46217330b447900f80c9ce38171655becb3b63e51f913b95c71e70"
-		logic_hash = "3ef6b7fb258b060ae00b060dbf9b07620f8cda0d9a827985bbb3ed9617969ef6"
+		logic_hash = "v1_sha256_3ef6b7fb258b060ae00b060dbf9b07620f8cda0d9a827985bbb3ed9617969ef6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -82996,10 +83129,10 @@ rule ELASTIC_Windows_Trojan_Metasploit_47F5D54A : FILE MEMORY
 		date = "2023-11-13"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Metasploit.yar#L353-L372"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Metasploit.yar#L353-L372"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bc3754cf4a04491a7ad7a75f69dd3bb2ddf0d8592ce078b740d7c9c7bc85a7e1"
-		logic_hash = "be080d0aae457348c4a02c204507a8cb14d1728d1bc50d7cf12b577aa06daf9f"
+		logic_hash = "v1_sha256_be080d0aae457348c4a02c204507a8cb14d1728d1bc50d7cf12b577aa06daf9f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83026,10 +83159,10 @@ rule ELASTIC_Windows_Trojan_Dbatloader_F93A8E90 : FILE MEMORY
 		date = "2022-03-11"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DBatLoader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DBatLoader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f72d7e445702bbf6b762ebb19d521452b9c76953d93b4d691e0e3e508790256e"
-		logic_hash = "6fe91d91bb383c66a6dc623b02817411a39b88030142517f4048c5c25fbb4ac5"
+		logic_hash = "v1_sha256_6fe91d91bb383c66a6dc623b02817411a39b88030142517f4048c5c25fbb4ac5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83055,10 +83188,10 @@ rule ELASTIC_Linux_Hacktool_Portscan_A40C7Ef0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Portscan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Portscan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c389c42bac5d4261dbca50c848f22c701df4c9a2c5877dc01e2eaa81300bdc29"
-		logic_hash = "6118ea86d628450e79ee658f4b95bae40080764a25240698d8ca7fcb7e6adaaf"
+		logic_hash = "v1_sha256_6118ea86d628450e79ee658f4b95bae40080764a25240698d8ca7fcb7e6adaaf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83084,10 +83217,10 @@ rule ELASTIC_Linux_Hacktool_Portscan_6C6000C2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Portscan.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Portscan.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8877009fc8ee27ba3b35a7680b80d21c84ee7296bcabe1de51aeeafcc8978da7"
-		logic_hash = "0cae81cbc0fdf48b4e7ac09865f05e2ad93d79b7a6f1af76a632727127ab050f"
+		logic_hash = "v1_sha256_0cae81cbc0fdf48b4e7ac09865f05e2ad93d79b7a6f1af76a632727127ab050f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83113,10 +83246,10 @@ rule ELASTIC_Linux_Hacktool_Portscan_E191222D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Portscan.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Portscan.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e2f4313538c3ef23adbfc50f37451c318bfd1ffd0e5aaa346cce4cc37417f812"
-		logic_hash = "6ffb2add4a76214ffd555cf1fe356371acd3638216094097b355670ecfe02ecd"
+		logic_hash = "v1_sha256_6ffb2add4a76214ffd555cf1fe356371acd3638216094097b355670ecfe02ecd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83142,10 +83275,10 @@ rule ELASTIC_Linux_Hacktool_Portscan_E57B0A0C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Portscan.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Portscan.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f8ee385316b60ee551565876287c06d76ac5765f005ca584d1ca6da13a6eb619"
-		logic_hash = "b2f67805e9381864591fdf61846284da97f8dd2f5c60484ce9c6e76d2f6f3872"
+		logic_hash = "v1_sha256_b2f67805e9381864591fdf61846284da97f8dd2f5c60484ce9c6e76d2f6f3872"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83171,10 +83304,10 @@ rule ELASTIC_Linux_Trojan_Rozena_56651C1D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rozena.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rozena.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "997684fb438af3f5530b0066d2c9e0d066263ca9da269d6a7e160fa757a51e04"
-		logic_hash = "a6d283b0c398cb1004defe7f5669f912112262e5aaf677ae4ca7fd15565cb988"
+		logic_hash = "v1_sha256_a6d283b0c398cb1004defe7f5669f912112262e5aaf677ae4ca7fd15565cb988"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83200,10 +83333,10 @@ rule ELASTIC_Windows_Trojan_A310Logger_520Cd7Ec : FILE MEMORY
 		date = "2022-01-11"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_A310logger.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_A310logger.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "60fb9597e5843c72d761525f73ca728409579d81901860981ebd84f7d153cfa3"
-		logic_hash = "6095ce913e3fb1cfc2f1b091598fc06b2dfec30c2353be7df08dcbb1a06b07c3"
+		logic_hash = "v1_sha256_6095ce913e3fb1cfc2f1b091598fc06b2dfec30c2353be7df08dcbb1a06b07c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83233,10 +83366,10 @@ rule ELASTIC_Windows_Trojan_Dridex_63Ddf193 : FILE MEMORY
 		date = "2021-08-07"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Dridex.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Dridex.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b1d66350978808577159acc7dc7faaa273e82c103487a90bf0d040afa000cb0d"
-		logic_hash = "e792f4693be0a7c71d1e638212a8fb3acb1e14dedd48218861fad8c09811da29"
+		logic_hash = "v1_sha256_e792f4693be0a7c71d1e638212a8fb3acb1e14dedd48218861fad8c09811da29"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83263,10 +83396,10 @@ rule ELASTIC_Windows_Trojan_Dridex_C6F01353 : FILE MEMORY
 		date = "2021-08-07"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Dridex.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Dridex.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "739682ccb54170e435730c54ba9f7e09f32a3473c07d2d18ae669235dcfe84de"
-		logic_hash = "7146204d779610c04badfc7d884ff882ff5f1439b61f889d1edf4419240c5751"
+		logic_hash = "v1_sha256_7146204d779610c04badfc7d884ff882ff5f1439b61f889d1edf4419240c5751"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83292,10 +83425,10 @@ rule ELASTIC_Linux_Trojan_Getshell_98D002Bf : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Getshell.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Getshell.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "97b7650ab083f7ba23417e6d5d9c1d133b9158e2c10427d1f1e50dfe6c0e7541"
-		logic_hash = "358575f55910b060bde94bbc55daa9650a43cf1470b77d1842ddcaa8b299700a"
+		logic_hash = "v1_sha256_358575f55910b060bde94bbc55daa9650a43cf1470b77d1842ddcaa8b299700a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83321,9 +83454,9 @@ rule ELASTIC_Linux_Trojan_Getshell_213D4D69 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "05fc4dcce9e9e1e627ebf051a190bd1f73bc83d876c78c6b3d86fc97b0dfd8e8"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Getshell.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "2075def88b31ac32e44c270ab20273c8b91f37e25a837c0353f76bcf431cdcb3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Getshell.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2075def88b31ac32e44c270ab20273c8b91f37e25a837c0353f76bcf431cdcb3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83349,9 +83482,9 @@ rule ELASTIC_Linux_Trojan_Getshell_3Cf5480B : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "0e41c0d6286fb7cd3288892286548eaebf67c16f1a50a69924f39127eb73ff38"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Getshell.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "87b0db74e81d4f236b11f51a72fba2e4263c988402292b2182d19293858c6126"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Getshell.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_87b0db74e81d4f236b11f51a72fba2e4263c988402292b2182d19293858c6126"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83377,9 +83510,9 @@ rule ELASTIC_Linux_Trojan_Getshell_8A79B859 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "1154ba394176730e51c7c7094ff3274e9f68aaa2ed323040a94e1c6f7fb976a2"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Getshell.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "2aa3914ec4cc04e5daa2da1460410b4f0e5e7a37c5a2eae5a02ff5f55382f1fe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Getshell.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2aa3914ec4cc04e5daa2da1460410b4f0e5e7a37c5a2eae5a02ff5f55382f1fe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83405,10 +83538,10 @@ rule ELASTIC_Windows_Vulndriver_Ryzen_7Df5A747 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Ryzen.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Ryzen.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
-		logic_hash = "192b51f0bbd2cab4c1d3da6f82fbee7129a53abaa6e8769d3681821112017824"
+		logic_hash = "v1_sha256_192b51f0bbd2cab4c1d3da6f82fbee7129a53abaa6e8769d3681821112017824"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -83425,7 +83558,7 @@ rule ELASTIC_Windows_Vulndriver_Ryzen_7Df5A747 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x05][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x04][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Ryzen_9B01C718 : FILE
 {
@@ -83436,10 +83569,10 @@ rule ELASTIC_Windows_Vulndriver_Ryzen_9B01C718 : FILE
 		date = "2023-01-22"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Ryzen.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Ryzen.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bb82d8c29127955d58dff58978605a9daa718425c74c4bce5ae3e53712909148"
-		logic_hash = "5734f6a249656f22a2a363b42ae77b5e6b7673bc96bad34b04b1be7f2b584b08"
+		logic_hash = "v1_sha256_5734f6a249656f22a2a363b42ae77b5e6b7673bc96bad34b04b1be7f2b584b08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -83456,7 +83589,7 @@ rule ELASTIC_Windows_Vulndriver_Ryzen_9B01C718 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x07][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x06][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $original_file_name and $version
 }
 rule ELASTIC_Linux_Exploit_CVE_2019_13272_583Dd2C0 : FILE MEMORY CVE_2019_13272
 {
@@ -83467,10 +83600,10 @@ rule ELASTIC_Linux_Exploit_CVE_2019_13272_583Dd2C0 : FILE MEMORY CVE_2019_13272
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2019_13272.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2019_13272.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3191b9473f3e59f55e062e6bdcfe61b88974602c36477bfa6855ccd92ff7ca83"
-		logic_hash = "0b25f0d979d2fc3f7d646a9b3eccf2a293b41181b499c790d3e99515fcd09603"
+		logic_hash = "v1_sha256_0b25f0d979d2fc3f7d646a9b3eccf2a293b41181b499c790d3e99515fcd09603"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2019-13272"
@@ -83496,9 +83629,9 @@ rule ELASTIC_Windows_Trojan_Octopus_15813E26 : FILE MEMORY
 		date = "2021-11-10"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Octopus.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "0d30b96ead4ccba75e08f6ba1db73cee61a29b5b0c7ee0fb523cbcd61dce9d87"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Octopus.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_0d30b96ead4ccba75e08f6ba1db73cee61a29b5b0c7ee0fb523cbcd61dce9d87"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83525,10 +83658,10 @@ rule ELASTIC_Linux_Trojan_Dinodasrat_1D371D10 : FILE MEMORY
 		date = "2024-04-02"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_DinodasRAT.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_DinodasRAT.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bf830191215e0c8db207ea320d8e795990cf6b3e6698932e6e0c9c0588fc9eff"
-		logic_hash = "933e78882be1d8dd9553ba90f038963d1b6f8f643888258541b7668aa3434808"
+		logic_hash = "v1_sha256_933e78882be1d8dd9553ba90f038963d1b6f8f643888258541b7668aa3434808"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83559,10 +83692,10 @@ rule ELASTIC_Windows_Trojan_Flawedgrace_8C5Eb04B : FILE MEMORY
 		date = "2023-11-01"
 		modified = "2023-11-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_FlawedGrace.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_FlawedGrace.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "966112f3143d751a95c000a990709572ac8b49b23c0e57b2691955d6fda1016e"
-		logic_hash = "dc07197cb9a02ff8d271f78756c2784c74d09e530af20377a584dbfe77e973aa"
+		logic_hash = "v1_sha256_dc07197cb9a02ff8d271f78756c2784c74d09e530af20377a584dbfe77e973aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83592,10 +83725,10 @@ rule ELASTIC_Windows_Vulndriver_Rtkio_13B3C88B : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Rtkio.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Rtkio.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
-		logic_hash = "1e37650292884e28dcc51c42bc1b1d1e8efc13b0727f7865ff1dc7b8e1a72380"
+		logic_hash = "v1_sha256_1e37650292884e28dcc51c42bc1b1d1e8efc13b0727f7865ff1dc7b8e1a72380"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -83611,7 +83744,7 @@ rule ELASTIC_Windows_Vulndriver_Rtkio_13B3C88B : FILE
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Windows_Vulndriver_Rtkio_D595781E : FILE
 {
@@ -83622,10 +83755,10 @@ rule ELASTIC_Windows_Vulndriver_Rtkio_D595781E : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Rtkio.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Rtkio.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7"
-		logic_hash = "289eb17025d989cc74e109b1c03378e9760817a84f1a759153ff6ff6b6401e6d"
+		logic_hash = "v1_sha256_289eb17025d989cc74e109b1c03378e9760817a84f1a759153ff6ff6b6401e6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -83641,7 +83774,7 @@ rule ELASTIC_Windows_Vulndriver_Rtkio_D595781E : FILE
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 36 00 34 00 2E 00 73 00 79 00 73 00 20 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Windows_Vulndriver_Rtkio_B09Af431 : FILE
 {
@@ -83652,10 +83785,10 @@ rule ELASTIC_Windows_Vulndriver_Rtkio_B09Af431 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Rtkio.yar#L43-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Rtkio.yar#L43-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038"
-		logic_hash = "916a6e63dc4c7ee0bfdf4a455ee467a1d03c1042db60806511aa7cbf3b096190"
+		logic_hash = "v1_sha256_916a6e63dc4c7ee0bfdf4a455ee467a1d03c1042db60806511aa7cbf3b096190"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -83671,7 +83804,7 @@ rule ELASTIC_Windows_Vulndriver_Rtkio_B09Af431 : FILE
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 77 00 38 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Windows_Vulndriver_Rtkio_5693E967 : FILE
 {
@@ -83682,10 +83815,10 @@ rule ELASTIC_Windows_Vulndriver_Rtkio_5693E967 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Rtkio.yar#L64-L83"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Rtkio.yar#L64-L83"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
-		logic_hash = "4cbc7a52de7f610cdb12bf40a9099bcfae818dcb5e4119a8c34499433aeebd7e"
+		logic_hash = "v1_sha256_4cbc7a52de7f610cdb12bf40a9099bcfae818dcb5e4119a8c34499433aeebd7e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -83701,7 +83834,7 @@ rule ELASTIC_Windows_Vulndriver_Rtkio_5693E967 : FILE
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 77 00 31 00 30 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 20 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Windows_Trojan_Darkcomet_1Df27Bcc : FILE MEMORY
 {
@@ -83712,10 +83845,10 @@ rule ELASTIC_Windows_Trojan_Darkcomet_1Df27Bcc : FILE MEMORY
 		date = "2021-08-16"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Darkcomet.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Darkcomet.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7fbe87545eef49da0df850719536bb30b196f7ad2d5a34ee795c01381ffda569"
-		logic_hash = "5886e3316839e64f934a0e84d85074e076f3e1e44f86fee35a87eb560bfa2aa7"
+		logic_hash = "v1_sha256_5886e3316839e64f934a0e84d85074e076f3e1e44f86fee35a87eb560bfa2aa7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83745,10 +83878,10 @@ rule ELASTIC_Linux_Trojan_Generic_402Be6C5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d30a8f5971763831f92d9a6dd4720f52a1638054672a74fdb59357ae1c9e6deb"
-		logic_hash = "b32111972bc21822f0f2c8e47198c90b70e78667410175257b9542c212fc3a1d"
+		logic_hash = "v1_sha256_b32111972bc21822f0f2c8e47198c90b70e78667410175257b9542c212fc3a1d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83774,10 +83907,10 @@ rule ELASTIC_Linux_Trojan_Generic_5420D3E7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "103b8fced0aebd73cb8ba9eff1a55e6b6fa13bb0a099c9234521f298ee8d2f9f"
-		logic_hash = "8ba3566ec900e37f05f11d40c65ffe1dfc587c553fa9c28b71ced7a9a90f50c3"
+		logic_hash = "v1_sha256_8ba3566ec900e37f05f11d40c65ffe1dfc587c553fa9c28b71ced7a9a90f50c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83803,10 +83936,10 @@ rule ELASTIC_Linux_Trojan_Generic_4F4Cc3Ea : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "32e25641360dbfd50125c43754cd327cf024f1b3bfd75b617cdf8a17024e2da5"
-		logic_hash = "9eb0d93b8c1a579ca8362d033edecbbe6a9ade82f6ae5688c183b97ed7b97faa"
+		logic_hash = "v1_sha256_9eb0d93b8c1a579ca8362d033edecbbe6a9ade82f6ae5688c183b97ed7b97faa"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -83832,10 +83965,10 @@ rule ELASTIC_Linux_Trojan_Generic_703A0258 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b086d0119042fc960fe540c23d0a274dd0fb6f3570607823895c9158d4f75974"
-		logic_hash = "cb37930637b8da91188d199ee20f1b64a0b1f13e966a99e69b983e623dac51de"
+		logic_hash = "v1_sha256_cb37930637b8da91188d199ee20f1b64a0b1f13e966a99e69b983e623dac51de"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83861,10 +83994,10 @@ rule ELASTIC_Linux_Trojan_Generic_378765E4 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ed42910e09e88777ae9958439d14176cb77271edf110053e1a29372fce21ec1"
-		logic_hash = "dd10305f553fa94ff83fafa84cff3d544f097b617fca20760eef838902e1f7db"
+		logic_hash = "v1_sha256_dd10305f553fa94ff83fafa84cff3d544f097b617fca20760eef838902e1f7db"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83890,10 +84023,10 @@ rule ELASTIC_Linux_Trojan_Generic_F657Fb4F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ed42910e09e88777ae9958439d14176cb77271edf110053e1a29372fce21ec1"
-		logic_hash = "af4fa2c21b47f360b425ebbfea624e3728cd682e54e367d265b4f3a6515b0720"
+		logic_hash = "v1_sha256_af4fa2c21b47f360b425ebbfea624e3728cd682e54e367d265b4f3a6515b0720"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83919,10 +84052,10 @@ rule ELASTIC_Linux_Trojan_Generic_Be1757Ef : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e4e2b5af9d0c72aae83cec57e5c091a95c549f826e8f13559aaf7d300f6e13"
-		logic_hash = "567d33c262e5f812c6a702bcc0a1f0cf576b67bf7cf67bb82b5f9ce9f233aaff"
+		logic_hash = "v1_sha256_567d33c262e5f812c6a702bcc0a1f0cf576b67bf7cf67bb82b5f9ce9f233aaff"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -83948,10 +84081,10 @@ rule ELASTIC_Linux_Trojan_Generic_7A95Ef79 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f59340a740af8f7f4b96e3ea46d38dbe81f2b776820b6f53b7028119c5db4355"
-		logic_hash = "6da43e4bab6b2024b49dfc943f099fb21c06d8d4a082a05594b07cb55989183c"
+		logic_hash = "v1_sha256_6da43e4bab6b2024b49dfc943f099fb21c06d8d4a082a05594b07cb55989183c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -83977,10 +84110,10 @@ rule ELASTIC_Linux_Trojan_Generic_1C5E42B7 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b078a02963610475217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
-		logic_hash = "cd759b87a303fafb9461d0a73b6a6b3f468b1f3db0189ba0e584a629e5d78da1"
+		logic_hash = "v1_sha256_cd759b87a303fafb9461d0a73b6a6b3f468b1f3db0189ba0e584a629e5d78da1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84006,10 +84139,10 @@ rule ELASTIC_Linux_Trojan_Generic_8Ca4B663 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ddf479e504867dfa27a2f23809e6255089fa0e2e7dcf31b6ce7d08f8d88947e"
-		logic_hash = "43b8cae2075f55a98b226f865d54e1c96345db0564815d849b3458d3f3ffee7f"
+		logic_hash = "v1_sha256_43b8cae2075f55a98b226f865d54e1c96345db0564815d849b3458d3f3ffee7f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84035,10 +84168,10 @@ rule ELASTIC_Linux_Trojan_Generic_D3Fe3Fae : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2a2542142adb05bff753e0652e119c1d49232d61c49134f13192425653332dc3"
-		logic_hash = "0b980a0bcf8340410fe2b53d109f629c6e871ebe82af467153d7b50b73fd8644"
+		logic_hash = "v1_sha256_0b980a0bcf8340410fe2b53d109f629c6e871ebe82af467153d7b50b73fd8644"
 		score = 60
 		quality = 43
 		tags = "FILE, MEMORY"
@@ -84064,10 +84197,10 @@ rule ELASTIC_Linux_Trojan_Generic_5E981634 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "448e8d71e335cabf5c4e9e8d2d31e6b52f620dbf408d8cc9a6232a81c051441b"
-		logic_hash = "4623c07a15588788ec8a484642a33f2d18127849302d57520a0dac875564f62c"
+		logic_hash = "v1_sha256_4623c07a15588788ec8a484642a33f2d18127849302d57520a0dac875564f62c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84093,10 +84226,10 @@ rule ELASTIC_Linux_Trojan_Generic_D8953Ca0 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "552753661c3cc7b3a4326721789808482a4591cb662bc813ee50d95f101a3501"
-		logic_hash = "cbc1a60a1d9525f7230336dff07f56e6a0b99e7c70c99d3f4363c06ed0071716"
+		logic_hash = "v1_sha256_cbc1a60a1d9525f7230336dff07f56e6a0b99e7c70c99d3f4363c06ed0071716"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84122,10 +84255,10 @@ rule ELASTIC_Linux_Trojan_Generic_181054Af : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L261-L279"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L261-L279"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e677f1eed0dbb4c680549e0bf86d92b0a28a85c6d571417baaba0d0719da5f93"
-		logic_hash = "e92807b603dd33fe7a083985644a213913a77e81c068623fdac7931148207b91"
+		logic_hash = "v1_sha256_e92807b603dd33fe7a083985644a213913a77e81c068623fdac7931148207b91"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84151,10 +84284,10 @@ rule ELASTIC_Linux_Trojan_Generic_C3D529A2 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b46135ae52db6399b680e5c53f891d101228de5cd6c06b6ae115e4a763a5fb22"
-		logic_hash = "a508acd95844a4385943166f715606199048d96be0098bc89f9be7b9db34833e"
+		logic_hash = "v1_sha256_a508acd95844a4385943166f715606199048d96be0098bc89f9be7b9db34833e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84180,10 +84313,10 @@ rule ELASTIC_Linux_Trojan_Generic_4675Dffa : FILE MEMORY
 		date = "2023-07-28"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L301-L320"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L301-L320"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "43e14c9713b1ca1f3a7f4bcb57dd3959d3a964be5121eb5aba312de41e2fb7a6"
-		logic_hash = "d2865a869d0cf0bf784106fe6242a4c7f58e58a43c4d4ae0241b10569810904d"
+		logic_hash = "v1_sha256_d2865a869d0cf0bf784106fe6242a4c7f58e58a43c4d4ae0241b10569810904d"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -84210,9 +84343,9 @@ rule ELASTIC_Linux_Trojan_Generic_5E3Bc3B3 : FILE MEMORY
 		date = "2024-09-20"
 		modified = "2024-11-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Generic.yar#L322-L344"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "33c14a6b8b5a2fc105ea6f1d5ee89e53f6c5e44126b9cf687058de64d649b5ca"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Generic.yar#L322-L344"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_33c14a6b8b5a2fc105ea6f1d5ee89e53f6c5e44126b9cf687058de64d649b5ca"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -84232,7 +84365,7 @@ rule ELASTIC_Linux_Trojan_Generic_5E3Bc3B3 : FILE MEMORY
 		$key = "yyyyyyyy"
 
 	condition:
-		1 of ($enc*) and $key
+		1 of ( $enc* ) and $key
 }
 rule ELASTIC_Windows_Backdoor_Dragoncastling_4Ecf6F9F : FILE MEMORY
 {
@@ -84243,10 +84376,10 @@ rule ELASTIC_Windows_Backdoor_Dragoncastling_4Ecf6F9F : FILE MEMORY
 		date = "2022-11-08"
 		modified = "2022-12-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Backdoor_DragonCastling.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Backdoor_DragonCastling.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9776c7ae6ca73f87d7c838257a5bcd946372fbb77ebed42eebdfb633b13cd387"
-		logic_hash = "26ff86354230f1006bd451eab5c1634b91888330d124a06dd2dfa5ab515d6e1a"
+		logic_hash = "v1_sha256_26ff86354230f1006bd451eab5c1634b91888330d124a06dd2dfa5ab515d6e1a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84280,10 +84413,10 @@ rule ELASTIC_Windows_Trojan_Squirrelwaffle_88033Ff1 : FILE MEMORY
 		date = "2021-09-20"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Squirrelwaffle.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Squirrelwaffle.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c"
-		logic_hash = "695d7d411a4de23ba1517a06bda3ce73add37dca1e6fe9046e7c2dcae237389e"
+		logic_hash = "v1_sha256_695d7d411a4de23ba1517a06bda3ce73add37dca1e6fe9046e7c2dcae237389e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84312,10 +84445,10 @@ rule ELASTIC_Windows_Trojan_Squirrelwaffle_D3B685A1 : FILE MEMORY
 		date = "2021-09-21"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Squirrelwaffle.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Squirrelwaffle.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c"
-		logic_hash = "7d187aa75fc767f5009f3090852de4894776f4b3f99f189478e7e9fd9c3acbe7"
+		logic_hash = "v1_sha256_7d187aa75fc767f5009f3090852de4894776f4b3f99f189478e7e9fd9c3acbe7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84341,10 +84474,10 @@ rule ELASTIC_Linux_Exploit_Abrox_5641Ba81 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Abrox.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Abrox.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8de96c8e61536cae870f4a24127d28b86bd8122428bf13965c596f92182625aa"
-		logic_hash = "29c894720c8d9134623427768ab1ab3d5e66fbeae86dd957f449d00091db9019"
+		logic_hash = "v1_sha256_29c894720c8d9134623427768ab1ab3d5e66fbeae86dd957f449d00091db9019"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84370,9 +84503,9 @@ rule ELASTIC_Multi_Attacksimulation_Blindspot_D93F54C5 : FILE MEMORY
 		date = "2022-05-23"
 		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_AttackSimulation_Blindspot.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "41984a0ad20ab21186252bb2f3f68604d2cbeea0e1ce22895dd163f7acbf2ca1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_AttackSimulation_Blindspot.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_41984a0ad20ab21186252bb2f3f68604d2cbeea0e1ce22895dd163f7acbf2ca1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84398,10 +84531,10 @@ rule ELASTIC_Linux_Trojan_Dropperl_B97Baf37 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dropperl.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dropperl.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "aff94f915fc81d5a2649ebd7c21ec8a4c2fc0d622ec9b790b43cc49f7feb83da"
-		logic_hash = "e58130c33242bc3020602c2c0254bed2bbc564c4a11806c6cfcd858fd724c362"
+		logic_hash = "v1_sha256_e58130c33242bc3020602c2c0254bed2bbc564c4a11806c6cfcd858fd724c362"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84427,10 +84560,10 @@ rule ELASTIC_Linux_Trojan_Dropperl_E2443Be5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dropperl.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dropperl.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "aff94f915fc81d5a2649ebd7c21ec8a4c2fc0d622ec9b790b43cc49f7feb83da"
-		logic_hash = "85733ff904cfa3eddaa4c4fbfc51c00494c3a3725e2eb722bbf33c82e7135336"
+		logic_hash = "v1_sha256_85733ff904cfa3eddaa4c4fbfc51c00494c3a3725e2eb722bbf33c82e7135336"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84456,10 +84589,10 @@ rule ELASTIC_Linux_Trojan_Dropperl_683C2Ba1 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dropperl.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dropperl.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a02e166fbf002dd4217c012f24bb3a8dbe310a9f0b0635eb20a7d315049367e1"
-		logic_hash = "eef2bdef7e20633f7dc92f653b43e3a217e8cbdbac63d05540bdd520e22dd1ed"
+		logic_hash = "v1_sha256_eef2bdef7e20633f7dc92f653b43e3a217e8cbdbac63d05540bdd520e22dd1ed"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84485,10 +84618,10 @@ rule ELASTIC_Linux_Trojan_Dropperl_8Bca73F6 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dropperl.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dropperl.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e7c17b7916b38494b9a07c249acb99499808959ba67125c29afec194ca4ae36c"
-		logic_hash = "2cfad4e436198391185fdae5c4af18ae43841db19da33473fdf18b64b0399613"
+		logic_hash = "v1_sha256_2cfad4e436198391185fdae5c4af18ae43841db19da33473fdf18b64b0399613"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84514,10 +84647,10 @@ rule ELASTIC_Linux_Trojan_Dropperl_C4018572 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dropperl.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dropperl.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c1515b3a7a91650948af7577b613ee019166f116729b7ff6309b218047141f6d"
-		logic_hash = "10d70540532c5c2984dc7e492672450924cb8f34c8158638191886057596b0a1"
+		logic_hash = "v1_sha256_10d70540532c5c2984dc7e492672450924cb8f34c8158638191886057596b0a1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84543,10 +84676,10 @@ rule ELASTIC_Linux_Trojan_Dropperl_733C0330 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dropperl.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dropperl.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b303f241a2687dba8d7b4987b7a46b5569bd2272e2da3e0c5e597b342d4561b6"
-		logic_hash = "37bf7777e26e556f09b8cb0e7e3c8425226a6412c3bed0d95fdab7229b6f4815"
+		logic_hash = "v1_sha256_37bf7777e26e556f09b8cb0e7e3c8425226a6412c3bed0d95fdab7229b6f4815"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84572,10 +84705,10 @@ rule ELASTIC_Linux_Trojan_Dropperl_39F4Cd0D : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Dropperl.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Dropperl.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c08e1347877dc77ad73c1e017f928c69c8c78a0e3c16ac5455668d2ad22500f3"
-		logic_hash = "5b61f54604b110d2c8efaf1782a2e520baac96c6d3e8d1eda0877475c504bf89"
+		logic_hash = "v1_sha256_5b61f54604b110d2c8efaf1782a2e520baac96c6d3e8d1eda0877475c504bf89"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84601,10 +84734,10 @@ rule ELASTIC_Macos_Trojan_Fplayer_1C1Fae37 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Fplayer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Fplayer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f57e651088dee2236328d09705cef5e98461e97d1eb2150c372d00ca7c685725"
-		logic_hash = "0d65717bdbac694ffb2535a1ff584f7ec2aa7b553a08d29113c6e2bd7b2ff1aa"
+		logic_hash = "v1_sha256_0d65717bdbac694ffb2535a1ff584f7ec2aa7b553a08d29113c6e2bd7b2ff1aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84630,10 +84763,10 @@ rule ELASTIC_Windows_Remoteadmin_Ultravnc_965F054A : FILE MEMORY
 		date = "2023-03-18"
 		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_RemoteAdmin_UltraVNC.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_RemoteAdmin_UltraVNC.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "59bddb5ccdc1c37c838c8a3d96a865a28c75b5807415fd931eaff0af931d1820"
-		logic_hash = "a9b9d0958f09b23fa7b27ef7ec32b3feb98edca3be5a21552a3a2f50e3fd41c1"
+		logic_hash = "v1_sha256_a9b9d0958f09b23fa7b27ef7ec32b3feb98edca3be5a21552a3a2f50e3fd41c1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84665,10 +84798,10 @@ rule ELASTIC_Linux_Trojan_Sambashell_F423755D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sambashell.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sambashell.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bd8a3728a59afbf433799578ef597b9a7211c8d62e87a25209398814851a77ea"
-		logic_hash = "b93c671fae87cd635679142d248cb2b754389ba3b416f3370ea331640eb906ab"
+		logic_hash = "v1_sha256_b93c671fae87cd635679142d248cb2b754389ba3b416f3370ea331640eb906ab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84694,9 +84827,9 @@ rule ELASTIC_Linux_Trojan_Kinsing_196523Fa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Kinsing.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "baa5808fcf22700ae96844dbf8cb3bec52425eec365d2ba4c71b73ece11a69a2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Kinsing.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_baa5808fcf22700ae96844dbf8cb3bec52425eec365d2ba4c71b73ece11a69a2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84722,10 +84855,10 @@ rule ELASTIC_Linux_Trojan_Kinsing_7Cdbe9Fa : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Kinsing.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Kinsing.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
-		logic_hash = "c6f5d2cf0430301ec0eae57808100203b69428f258e0e6882fecbc762d73f4bf"
+		logic_hash = "v1_sha256_c6f5d2cf0430301ec0eae57808100203b69428f258e0e6882fecbc762d73f4bf"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -84751,10 +84884,10 @@ rule ELASTIC_Linux_Trojan_Kinsing_2C1Ffe78 : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Kinsing.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Kinsing.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
-		logic_hash = "9561511710eef5877c5afa49890b77fbad31a6e312b5cd33fc01f91ff2a73583"
+		logic_hash = "v1_sha256_9561511710eef5877c5afa49890b77fbad31a6e312b5cd33fc01f91ff2a73583"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -84780,10 +84913,10 @@ rule ELASTIC_Linux_Trojan_Kinsing_85276Fb4 : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Kinsing.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Kinsing.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
-		logic_hash = "6919afd133e7e369eece10ea79d9d17a1a3fbb6210593395e0be157f8c262811"
+		logic_hash = "v1_sha256_6919afd133e7e369eece10ea79d9d17a1a3fbb6210593395e0be157f8c262811"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84809,10 +84942,10 @@ rule ELASTIC_Windows_Trojan_Falsefont_D1F0D357 : FILE MEMORY
 		date = "2024-03-26"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_FalseFont.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_FalseFont.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
-		logic_hash = "af356dec77f773cec01626a3823dbea7e9d3719b9d152ec4057c0b97efabf0df"
+		logic_hash = "v1_sha256_af356dec77f773cec01626a3823dbea7e9d3719b9d152ec4057c0b97efabf0df"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84845,10 +84978,10 @@ rule ELASTIC_Linux_Exploit_CVE_2009_1897_6Cf0A073 : FILE MEMORY CVE_2009_1897
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2009_1897.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2009_1897.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "85f371bf73ee6d8fcb6fa9a8a68b38c5e023151257fd549855c4c290cc340724"
-		logic_hash = "dcde454fda09cb6bc7b213b76d70eafd65d2601cfda70ff25c6940b55ce3adb6"
+		logic_hash = "v1_sha256_dcde454fda09cb6bc7b213b76d70eafd65d2601cfda70ff25c6940b55ce3adb6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2009-1897"
@@ -84874,10 +85007,10 @@ rule ELASTIC_Linux_Trojan_Snowlight_F5C83D35 : FILE MEMORY
 		date = "2024-05-16"
 		modified = "2024-06-12"
 		reference = "https://www.mandiant.com/resources/blog/initial-access-brokers-exploit-f5-screenconnect"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Snowlight.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Snowlight.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7d6652d8fa3748d7f58d7e15cefee5a48126d0209cf674818f55e9a68248be01"
-		logic_hash = "fef8f44e897a0f453be2f84d28886d27e261f8256c53c0425c5265b138ce5f40"
+		logic_hash = "v1_sha256_fef8f44e897a0f453be2f84d28886d27e261f8256c53c0425c5265b138ce5f40"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84903,10 +85036,10 @@ rule ELASTIC_Linux_Ransomware_Conti_53A640F4 : FILE MEMORY
 		date = "2022-09-22"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Conti.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Conti.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8b57e96e90cd95fc2ba421204b482005fe41c28f506730b6148bcef8316a3201"
-		logic_hash = "b83a47664d8acce7de17ac5972d9fd5e708c8cd3d8ebedc2bacf1397fd25f5d3"
+		logic_hash = "v1_sha256_b83a47664d8acce7de17ac5972d9fd5e708c8cd3d8ebedc2bacf1397fd25f5d3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84932,10 +85065,10 @@ rule ELASTIC_Linux_Ransomware_Conti_A89C26Cf : FILE MEMORY
 		date = "2023-07-30"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Conti.yar#L21-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Conti.yar#L21-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "95776f31cbcac08eb3f3e9235d07513a6d7a6bf9f1b7f3d400b2cf0afdb088a7"
-		logic_hash = "301f3f3ece06a1cd6788db6e3003497b27470780eaaad95f40ed926e7623793e"
+		logic_hash = "v1_sha256_301f3f3ece06a1cd6788db6e3003497b27470780eaaad95f40ed926e7623793e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -84964,10 +85097,10 @@ rule ELASTIC_Linux_Hacktool_Fontonlake_68Ad8568 : FILE MEMORY
 		date = "2021-10-12"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Fontonlake.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Fontonlake.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "717953f52318e7687fc95626561cc607d4875d77ff7e3cf5c7b21cf91f576fa4"
-		logic_hash = "63dd5769305c715e27e3c62160f7b0f65b57204009ed46383b5b477c67cfac8e"
+		logic_hash = "v1_sha256_63dd5769305c715e27e3c62160f7b0f65b57204009ed46383b5b477c67cfac8e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85004,10 +85137,10 @@ rule ELASTIC_Windows_Trojan_Pony_D5516Fe8 : FILE MEMORY
 		date = "2021-08-14"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Pony.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Pony.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567"
-		logic_hash = "4a850d32fb28477e7e3fef2dda6ba327b800e2ebcae1a483970cde78f34a4ff7"
+		logic_hash = "v1_sha256_4a850d32fb28477e7e3fef2dda6ba327b800e2ebcae1a483970cde78f34a4ff7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85039,10 +85172,10 @@ rule ELASTIC_Windows_Trojan_Twistedtinsel_Aa56E527 : FILE MEMORY
 		date = "2023-12-06"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_TwistedTinsel.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_TwistedTinsel.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ef1cbdf9a23ae028a858e1d09529982eaeda61197ae029e091918690d3a86e2e"
-		logic_hash = "de31d0a5560baf6b37897eba3a637b00b539f542a2620983c3407a6898e003c7"
+		logic_hash = "v1_sha256_de31d0a5560baf6b37897eba3a637b00b539f542a2620983c3407a6898e003c7"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -85069,10 +85202,10 @@ rule ELASTIC_Linux_Exploit_CVE_2017_100011_21025F50 : FILE MEMORY CVE_2017_10001
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2017_100011.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2017_100011.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "32db88b2c964ce48e6d1397ca655075ea54ce298340af55ea890a2411a67d554"
-		logic_hash = "3ec54a7639ccfc019e01fa287f69a93af57087e2d67d0c8574a646afb9043db5"
+		logic_hash = "v1_sha256_3ec54a7639ccfc019e01fa287f69a93af57087e2d67d0c8574a646afb9043db5"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY, CVE-2017-100011"
@@ -85098,10 +85231,10 @@ rule ELASTIC_Windows_Vulndriver_Rentdrv_B6711B6B : FILE MEMORY
 		date = "2024-08-19"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_RentDrv.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_RentDrv.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9165d4f3036919a96b86d24b64d75d692802c7513f2b3054b20be40c212240a5"
-		logic_hash = "3b3d66fefb4f0efbc8b86687925eac25284a6efad3acc74ad4a627d975cd5e7b"
+		logic_hash = "v1_sha256_3b3d66fefb4f0efbc8b86687925eac25284a6efad3acc74ad4a627d975cd5e7b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85117,7 +85250,7 @@ rule ELASTIC_Windows_Vulndriver_Rentdrv_B6711B6B : FILE MEMORY
 		$str2 = "KillProcess"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and all of them
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and all of them
 }
 rule ELASTIC_Windows_Vulndriver_Rtcore_4Eeb2Ce5 : FILE
 {
@@ -85128,10 +85261,10 @@ rule ELASTIC_Windows_Vulndriver_Rtcore_4Eeb2Ce5 : FILE
 		date = "2022-04-04"
 		modified = "2022-08-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_RtCore.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_RtCore.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd"
-		logic_hash = "f547bce6554c60e8f3ef8e128c05533cf1f35ce0ee414d5a1c5e9a205b05d8fe"
+		logic_hash = "v1_sha256_f547bce6554c60e8f3ef8e128c05533cf1f35ce0ee414d5a1c5e9a205b05d8fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -85147,7 +85280,7 @@ rule ELASTIC_Windows_Vulndriver_Rtcore_4Eeb2Ce5 : FILE
 		$str2 = "Kaspersky Lab Anti-Rootkit Monitor Driver" wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1 and not $str2
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1 and not $str2
 }
 rule ELASTIC_Windows_Trojan_Babylonrat_0F66E73B : FILE MEMORY
 {
@@ -85158,10 +85291,10 @@ rule ELASTIC_Windows_Trojan_Babylonrat_0F66E73B : FILE MEMORY
 		date = "2021-09-02"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Babylonrat.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Babylonrat.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4278064ec50f87bb0471053c068b13955ed9d599434e687a64bf2060438a7511"
-		logic_hash = "66223dc9e2ef7330e26c91f0c82c555e96e4c794a637ab2cbe36410f3eca202a"
+		logic_hash = "v1_sha256_66223dc9e2ef7330e26c91f0c82c555e96e4c794a637ab2cbe36410f3eca202a"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -85190,10 +85323,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_D7Bd0E5D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "afcfd67af99e437f553029ccf97b91ed0ca891f9bcc01c148c2b38c75482d671"
-		logic_hash = "1f87721fdfe58d029c0696bc99385a0052c771bc48b2c9ce01b72c3e42359654"
+		logic_hash = "v1_sha256_1f87721fdfe58d029c0696bc99385a0052c771bc48b2c9ce01b72c3e42359654"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85219,10 +85352,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_69E1A763 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b04d9fabd1e8fc42d1fa8e90a3299a3c36e6f05d858dfbed9f5e90a84b68bcbb"
-		logic_hash = "d0dac8e2c9571d9e622c8c1250a54a7671ad1b9b00dba584c3741b714c22d8e0"
+		logic_hash = "v1_sha256_d0dac8e2c9571d9e622c8c1250a54a7671ad1b9b00dba584c3741b714c22d8e0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85248,10 +85381,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_397A86Bd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "79c47a80ecc6e0f5f87749319f6d5d6a3f0fbff7c34082d747155b9b20510cde"
-		logic_hash = "6b46a82d1aea0357f5a48c9ae1d93e3d4d31bd98b9c9b4e0b0d0629e7f159499"
+		logic_hash = "v1_sha256_6b46a82d1aea0357f5a48c9ae1d93e3d4d31bd98b9c9b4e0b0d0629e7f159499"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85277,10 +85410,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_37C3F8D3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "efbddf1020d0845b7a524da357893730981b9ee65a90e54976d7289d46d0ffd4"
-		logic_hash = "e7bdd185ea4227b0960c3e677e7d8ac7488d53eaa77efd631be828b2ca079bb8"
+		logic_hash = "v1_sha256_e7bdd185ea4227b0960c3e677e7d8ac7488d53eaa77efd631be828b2ca079bb8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85306,10 +85439,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_28A80546 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "96cc225cf20240592e1dcc8a13a69f2f97637ed8bc89e30a78b8b2423991d850"
-		logic_hash = "120e9f7cad0fc8aebd843374c0edca8cbb701882ab55a7f24aced1d80d8cd697"
+		logic_hash = "v1_sha256_120e9f7cad0fc8aebd843374c0edca8cbb701882ab55a7f24aced1d80d8cd697"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85335,10 +85468,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_9D531F70 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "36f2ce4e34faf42741f0a15f62e8b3477d69193bf289818e22d0e3ee3e906eb0"
-		logic_hash = "87d3cb7049975d52f2a6d6aa10e6b6d0d008d166ca5f9889ad1413a573d8b58e"
+		logic_hash = "v1_sha256_87d3cb7049975d52f2a6d6aa10e6b6d0d008d166ca5f9889ad1413a573d8b58e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85364,10 +85497,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_23A5C29A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1320d7a2b5e3b65fe974a95374b4ea7ed1a5aa27d76cd3d9517d3a271121103f"
-		logic_hash = "c2608e7ee73102e0737a859a18c5482877c6dc0e597d8a14d8d41f5e01a0b1f4"
+		logic_hash = "v1_sha256_c2608e7ee73102e0737a859a18c5482877c6dc0e597d8a14d8d41f5e01a0b1f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85393,10 +85526,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_Ea5703Ce : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bec6eea63025e2afa5940d27ead403bfda3a7b95caac979079cabef88af5ee0b"
-		logic_hash = "bbf0191ecff24fd24376fd3dec2e96644188ca4d26b4ca4f087e212bae2eab85"
+		logic_hash = "v1_sha256_bbf0191ecff24fd24376fd3dec2e96644188ca4d26b4ca4f087e212bae2eab85"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85422,10 +85555,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_6A4F4255 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
-		logic_hash = "133290dc7423174bb3b41b152bab038d118b47baaca52705b66fd9be01692a03"
+		logic_hash = "v1_sha256_133290dc7423174bb3b41b152bab038d118b47baaca52705b66fd9be01692a03"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85451,10 +85584,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_9088D00B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8abb2b058ec475b0b6fd0c994685db72e98d87ee3eec58e29cf5c324672df04a"
-		logic_hash = "3ebc8cb6d647138e72194528dafc644c90222440855d657ec50109f11ff936da"
+		logic_hash = "v1_sha256_3ebc8cb6d647138e72194528dafc644c90222440855d657ec50109f11ff936da"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85480,10 +85613,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_71024C4A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "afe81c84dcb693326ee207ccd8aeed6ed62603ad3c8d361e8d75035f6ce7c80f"
-		logic_hash = "0c66a3388fe8546ae180e52d50ef05a28755d24e47b3b56f390d5c6fcb0b89eb"
+		logic_hash = "v1_sha256_0c66a3388fe8546ae180e52d50ef05a28755d24e47b3b56f390d5c6fcb0b89eb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85509,10 +85642,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_D81368A3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "71225e4702f2e0a0ecf79f7ec6c6a1efc95caf665fda93a646519f6f5744990b"
-		logic_hash = "0e30c9ebd8f2d3a489180f114daf91a3655ce9075ae25ea3d6ef5be472d7721a"
+		logic_hash = "v1_sha256_0e30c9ebd8f2d3a489180f114daf91a3655ce9075ae25ea3d6ef5be472d7721a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85538,10 +85671,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_97E9Cebe : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b4ff62d92bd4d423379f26b37530776b3f4d927cc8a22bd9504ef6f457de4b7a"
-		logic_hash = "8aad31db2646fb9971b9af886e30f6c5a62a9c7de86cb9dc9e1341ac3b7762eb"
+		logic_hash = "v1_sha256_8aad31db2646fb9971b9af886e30f6c5a62a9c7de86cb9dc9e1341ac3b7762eb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85567,10 +85700,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_98Ff0F36 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L261-L279"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L261-L279"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4c14aaf05149bb38bbff041432bf9574dd38e851038638aeb121b464a1e60dcc"
-		logic_hash = "60f17855b08cfc51e497003cbb5ed25d9168fb29c57d8bfd7105b9b5e714e3a1"
+		logic_hash = "v1_sha256_60f17855b08cfc51e497003cbb5ed25d9168fb29c57d8bfd7105b9b5e714e3a1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85596,10 +85729,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_1512Cf40 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc063a0e763894e86cdfcd2b1c73d588ae6ecb411c97df2a7a802cd85ee3f46d"
-		logic_hash = "0d43e6a4bd5036c2b6adb61f2d7b11e625c20e9a3d29242c7c34cfc7708561be"
+		logic_hash = "v1_sha256_0d43e6a4bd5036c2b6adb61f2d7b11e625c20e9a3d29242c7c34cfc7708561be"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85625,10 +85758,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_0D6005A1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L301-L319"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L301-L319"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "230d46b39b036552e8ca6525a0d2f7faadbf4246cdb5e0ac9a8569584ef295d4"
-		logic_hash = "c3fd32e7582f0900b94fe3ba6b6bcdf238f78e2e343d70d5b0196a968a41cf26"
+		logic_hash = "v1_sha256_c3fd32e7582f0900b94fe3ba6b6bcdf238f78e2e343d70d5b0196a968a41cf26"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85654,10 +85787,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_E1Ff020A : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L321-L339"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L321-L339"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b611898f1605751a3d518173b5b3d4864b4bb4d1f8d9064cc90ad836dd61812"
-		logic_hash = "be801989b9770f3b70217bd5f13795b5dd0b516209f631d900b6647e0afe8d98"
+		logic_hash = "v1_sha256_be801989b9770f3b70217bd5f13795b5dd0b516209f631d900b6647e0afe8d98"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85683,10 +85816,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_102D6F7C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L341-L359"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L341-L359"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bd40c2fbf775e3c8cb4de4a1c7c02bc4bcfa5b459855b2e5f1a8ab40f2fb1f9e"
-		logic_hash = "52966eaaef5522e711dc89bd796b1e12019a8485ee789e8d5112d86f7e630170"
+		logic_hash = "v1_sha256_52966eaaef5522e711dc89bd796b1e12019a8485ee789e8d5112d86f7e630170"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85712,10 +85845,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_9C8F3B1A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L361-L379"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L361-L379"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "74d8344139c5deea854d8f82970e06fc6a51a6bf845e763de603bde7b8aa80ac"
-		logic_hash = "f7ab9990b417c1c81903dcb7adaae910d20ea7fce6689d4846dd6002bea3e721"
+		logic_hash = "v1_sha256_f7ab9990b417c1c81903dcb7adaae910d20ea7fce6689d4846dd6002bea3e721"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85741,10 +85874,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_76Cb94A9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L381-L399"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L381-L399"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1320d7a2b5e3b65fe974a95374b4ea7ed1a5aa27d76cd3d9517d3a271121103f"
-		logic_hash = "758ee41048c94576e7a872bfdacc6b6f2be3d460169905c876585037e11fdaa8"
+		logic_hash = "v1_sha256_758ee41048c94576e7a872bfdacc6b6f2be3d460169905c876585037e11fdaa8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85770,10 +85903,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_616Afaa1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L401-L419"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L401-L419"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0901672d2688660baa26fdaac05082c9e199c06337871d2ae40f369f5d575f71"
-		logic_hash = "53a309a6a274558e4ae8cfa8f3e258f23dc9ceafab3be46351c00d24f5d790ec"
+		logic_hash = "v1_sha256_53a309a6a274558e4ae8cfa8f3e258f23dc9ceafab3be46351c00d24f5d790ec"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85799,10 +85932,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_18Af74B2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L421-L439"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L421-L439"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "52707aa413c488693da32bf2705d4ac702af34faee3f605b207db55cdcc66318"
-		logic_hash = "d8ec9bd01fcabdd4a80e07287ecc85026007672bbc3cd2d4cbb2aef98da88ed5"
+		logic_hash = "v1_sha256_d8ec9bd01fcabdd4a80e07287ecc85026007672bbc3cd2d4cbb2aef98da88ed5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85828,10 +85961,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_1B76C066 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L441-L459"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L441-L459"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f60302de1a0e756e3af9da2547a28da5f57864191f448e341af1911d64e5bc8b"
-		logic_hash = "be239bc14d1adf05a5c6bf2b2557551566330644a049b256a7a5c0ab9549bd06"
+		logic_hash = "v1_sha256_be239bc14d1adf05a5c6bf2b2557551566330644a049b256a7a5c0ab9549bd06"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85857,10 +85990,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_B6Ea5Ee1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L461-L479"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L461-L479"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "19b442c9aa229cd724ed9cbaa73f9dfaf0ed61aa3fd1bee7bf8ba964fc23a2b8"
-		logic_hash = "529119e07aa0243afddc3141dc441c314c3f75bdf3aee473b8bb7749c95fa78a"
+		logic_hash = "v1_sha256_529119e07aa0243afddc3141dc441c314c3f75bdf3aee473b8bb7749c95fa78a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85886,10 +86019,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_050Ac14C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L481-L499"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L481-L499"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "36f2ce4e34faf42741f0a15f62e8b3477d69193bf289818e22d0e3ee3e906eb0"
-		logic_hash = "c34b0ff3ce867a76ef57fad7642de7916fa7baebf1a2a8d514f7b74be7231fd4"
+		logic_hash = "v1_sha256_c34b0ff3ce867a76ef57fad7642de7916fa7baebf1a2a8d514f7b74be7231fd4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85915,10 +86048,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_Df937Caa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L501-L519"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L501-L519"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "19b442c9aa229cd724ed9cbaa73f9dfaf0ed61aa3fd1bee7bf8ba964fc23a2b8"
-		logic_hash = "d76a6008576687088f28674fb752e1a79ad2046e0208a65c21d0fcd284812ad8"
+		logic_hash = "v1_sha256_d76a6008576687088f28674fb752e1a79ad2046e0208a65c21d0fcd284812ad8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85944,10 +86077,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_E9Ff82A8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L521-L539"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L521-L539"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "62ea137e42ce32680066693f02f57a0fb03483f78c365dffcebc1f992bb49c7a"
-		logic_hash = "9309aaad6643fa212bb04ce8dc7d24978839fe475f17d36e3b692320563b6fad"
+		logic_hash = "v1_sha256_9309aaad6643fa212bb04ce8dc7d24978839fe475f17d36e3b692320563b6fad"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -85973,10 +86106,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_A5267Ea3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L541-L559"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L541-L559"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b342ceeef58b3eeb7a312038622bcce4d76fc112b9925379566b24f45390be7d"
-		logic_hash = "081633b5aa0490dbffcc0b8ab9850b59dbbd67d947c0fe68d28338a352e94676"
+		logic_hash = "v1_sha256_081633b5aa0490dbffcc0b8ab9850b59dbbd67d947c0fe68d28338a352e94676"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86002,10 +86135,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_4E9075E6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L561-L579"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L561-L579"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "098bf2f1ce9d7f125e1c9618f349ae798a987316e95345c037a744964277f0fe"
-		logic_hash = "fe117f65666b9eac19fa588ee631f9be7551a3a9e3695b7ecbb77806658678aa"
+		logic_hash = "v1_sha256_fe117f65666b9eac19fa588ee631f9be7551a3a9e3695b7ecbb77806658678aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86031,9 +86164,9 @@ rule ELASTIC_Linux_Cryptominer_Generic_3A8D0974 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "193fe9ea690759f8e155458ef8f8e9efe9efc8c22ec8073bbb760e4f96b5aef7"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L581-L599"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7039d461d8339d635a543fae2c6dbea284ce1b727d6585b69d8d621c603f37ac"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L581-L599"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7039d461d8339d635a543fae2c6dbea284ce1b727d6585b69d8d621c603f37ac"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86059,10 +86192,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_B9E6Ffdf : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L601-L619"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L601-L619"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0f3200a93f1be4589eec562c4f688e379e687d09c03d1d8850cc4b5f90f192a"
-		logic_hash = "57d5b3eb5812a849d04695bdb1fb728a5ebd3bf5201ac3e7f36d37af0622eec2"
+		logic_hash = "v1_sha256_57d5b3eb5812a849d04695bdb1fb728a5ebd3bf5201ac3e7f36d37af0622eec2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86088,10 +86221,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_7Ef74003 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L621-L639"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L621-L639"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a172cfecdec8ebd365603ae094a16e247846fdbb47ba7fd79564091b7e8942a0"
-		logic_hash = "1bde07dbb88357fcc02171512725be94d9fc0427c03afb2d59fbd0658c5d8e2e"
+		logic_hash = "v1_sha256_1bde07dbb88357fcc02171512725be94d9fc0427c03afb2d59fbd0658c5d8e2e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86117,10 +86250,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_1D0700B8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L641-L659"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L641-L659"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "de59bee1793b88e7b48b6278a52e579770f5204e92042142cc3a9b2d683798dd"
-		logic_hash = "a24264cb071d269c82718aed5bc5c6c955e1cb2c7a63fe74d4033bfa6adf8385"
+		logic_hash = "v1_sha256_a24264cb071d269c82718aed5bc5c6c955e1cb2c7a63fe74d4033bfa6adf8385"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86146,10 +86279,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_55Beb2Ee : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L661-L679"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L661-L679"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "edda1c6b3395e7f14dd201095c1e9303968d02c127ff9bf6c76af6b3d02e80ad"
-		logic_hash = "8a31b4866100b35d559d50f5db6f80d51bced93f9aac3f0d2d1de71ba692a3c5"
+		logic_hash = "v1_sha256_8a31b4866100b35d559d50f5db6f80d51bced93f9aac3f0d2d1de71ba692a3c5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86175,10 +86308,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_Fdd7340F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L681-L699"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L681-L699"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "de59bee1793b88e7b48b6278a52e579770f5204e92042142cc3a9b2d683798dd"
-		logic_hash = "fd39ba5cf050d23de0889feefa9cd74dfb6385a09aa9dba90dc1d5d6cb020867"
+		logic_hash = "v1_sha256_fd39ba5cf050d23de0889feefa9cd74dfb6385a09aa9dba90dc1d5d6cb020867"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86204,10 +86337,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_E36A35B0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L701-L719"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L701-L719"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ab6d8f09df67a86fed4faabe4127cc65570dbb9ec56a1bdc484e72b72476f5a4"
-		logic_hash = "0572f584746a2af6f545798b25445fd4e764a9eecc01b7476e5c1af631eb314a"
+		logic_hash = "v1_sha256_0572f584746a2af6f545798b25445fd4e764a9eecc01b7476e5c1af631eb314a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86233,10 +86366,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_6Dad0380 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L721-L739"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L721-L739"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "628b1cc8ccdbe2ae0d4ef621da047e07e2532d00fe3d4da65f0a0bcab20fb546"
-		logic_hash = "b305448d5517212adb7586e7af12842095e1a263520511329e40f0865fe4f81b"
+		logic_hash = "v1_sha256_b305448d5517212adb7586e7af12842095e1a263520511329e40f0865fe4f81b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86262,10 +86395,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_E73F501E : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L741-L759"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L741-L759"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2f646ced4d05ba1807f8e08a46ae92ae3eea7199e4a58daf27f9bd0f63108266"
-		logic_hash = "2f6187f3447f9409485e9e8aa047114aa3c38bcc338106c3ed8680152dff121a"
+		logic_hash = "v1_sha256_2f6187f3447f9409485e9e8aa047114aa3c38bcc338106c3ed8680152dff121a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86291,10 +86424,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_5E56D076 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L761-L779"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L761-L779"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "32e1cb0369803f817a0c61f25ca410774b4f37882cab966133b4f3e9c74fac09"
-		logic_hash = "c8e2ebcffe8a169c2cc311c95538b674937fa87e06d2946a6ed3b0c1f039f7fc"
+		logic_hash = "v1_sha256_c8e2ebcffe8a169c2cc311c95538b674937fa87e06d2946a6ed3b0c1f039f7fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86320,10 +86453,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_54357231 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L781-L799"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L781-L799"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "388b927b850b388e0a46a6c9a22b733d469e0f93dc053ebd78996e903b25e38a"
-		logic_hash = "a895c9fd124d6bd55748093c3ef54606e5692285260aa21bd70dca02126239d2"
+		logic_hash = "v1_sha256_a895c9fd124d6bd55748093c3ef54606e5692285260aa21bd70dca02126239d2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86349,10 +86482,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_467C4D46 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L801-L819"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L801-L819"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "388b927b850b388e0a46a6c9a22b733d469e0f93dc053ebd78996e903b25e38a"
-		logic_hash = "b28f871365c1fa6315b1c2fc6698bdd224961972cd578db05c311406c239ac22"
+		logic_hash = "v1_sha256_b28f871365c1fa6315b1c2fc6698bdd224961972cd578db05c311406c239ac22"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86378,10 +86511,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_E0Cca9Dc : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L821-L839"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L821-L839"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "59a1d8aa677739f2edbb8bd34f566b31f19d729b0a115fef2eac8ab1d1acc383"
-		logic_hash = "fa4089f74fc78e99427b4e8eda9f8348e042dc876c7281a4a2173c83076bfbd2"
+		logic_hash = "v1_sha256_fa4089f74fc78e99427b4e8eda9f8348e042dc876c7281a4a2173c83076bfbd2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86407,10 +86540,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_36E404E2 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L841-L859"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L841-L859"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "59a1d8aa677739f2edbb8bd34f566b31f19d729b0a115fef2eac8ab1d1acc383"
-		logic_hash = "d38cc5714721c0b00cfa47cb9828fd76ff57ec8180e5cfe1fec67a092dd87904"
+		logic_hash = "v1_sha256_d38cc5714721c0b00cfa47cb9828fd76ff57ec8180e5cfe1fec67a092dd87904"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86436,10 +86569,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_947Dcc5E : FILE MEMORY
 		date = "2024-04-19"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L861-L879"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L861-L879"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7c5a6ac425abe60e8ea5df5dfa8211a7c34a307048b4e677336b735237dcd8fd"
-		logic_hash = "c4aac006561386fbfe0fa0fe3df6b6798d2915a3dbfb5384583ebf9b2f413115"
+		logic_hash = "v1_sha256_c4aac006561386fbfe0fa0fe3df6b6798d2915a3dbfb5384583ebf9b2f413115"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86465,10 +86598,10 @@ rule ELASTIC_Linux_Cryptominer_Generic_B4C2D007 : FILE MEMORY
 		date = "2024-04-19"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Generic.yar#L881-L899"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Generic.yar#L881-L899"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e1e518ba226d30869e404b92bfa810bae27c8b1476766934961e80c44e39c738"
-		logic_hash = "cb52d9233028918210b8bd3959a6649d75b5c6873befff0cf62d9e71dfecc302"
+		logic_hash = "v1_sha256_cb52d9233028918210b8bd3959a6649d75b5c6873befff0cf62d9e71dfecc302"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86494,10 +86627,10 @@ rule ELASTIC_Windows_Vulndriver_Vmdrv_7C674F8E : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Vmdrv.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Vmdrv.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
-		logic_hash = "87f29b861d5239c60e44541fe31ed90696068225b1b6d824dc9b06fcdb1597ae"
+		logic_hash = "v1_sha256_87f29b861d5239c60e44541fe31ed90696068225b1b6d824dc9b06fcdb1597ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -86514,7 +86647,7 @@ rule ELASTIC_Windows_Vulndriver_Vmdrv_7C674F8E : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x00][\x00-\x40]|[\x00-\xff][\x00-\x3f])([\x00-\x1b][\x00-\x27]|[\x00-\xff][\x00-\x26])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x1a][\x00-\x27]|[\x00-\xff][\x00-\x26]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Hacktool_Sharphound_5Adf9D6D : FILE MEMORY
 {
@@ -86525,10 +86658,10 @@ rule ELASTIC_Windows_Hacktool_Sharphound_5Adf9D6D : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpHound.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpHound.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1f74ed6e61880d19e53cde5b0d67a0507bfda0be661860300dcb0f20ea9a45f4"
-		logic_hash = "2c9f38187866985109a42ffdf8940b5d195aadd3815b2de952b190d4b0b95c3c"
+		logic_hash = "v1_sha256_2c9f38187866985109a42ffdf8940b5d195aadd3815b2de952b190d4b0b95c3c"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -86547,7 +86680,7 @@ rule ELASTIC_Windows_Hacktool_Sharphound_5Adf9D6D : FILE MEMORY
 		$print_str2 = "[-] Removed DCOM Collection" ascii wide
 
 	condition:
-		$guid0 or $guid1 or all of ($print_str*)
+		$guid0 or $guid1 or all of ( $print_str* )
 }
 rule ELASTIC_Windows_Trojan_Smokeloader_4E31426E : FILE MEMORY
 {
@@ -86558,10 +86691,10 @@ rule ELASTIC_Windows_Trojan_Smokeloader_4E31426E : FILE MEMORY
 		date = "2021-07-21"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Smokeloader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Smokeloader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174"
-		logic_hash = "44ac7659964519ae72f83076bcd1b3e5244eb9cadd9a3b123dda78b0e9e07424"
+		logic_hash = "v1_sha256_44ac7659964519ae72f83076bcd1b3e5244eb9cadd9a3b123dda78b0e9e07424"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86587,10 +86720,10 @@ rule ELASTIC_Windows_Trojan_Smokeloader_4Ee15B92 : FILE MEMORY
 		date = "2022-02-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Smokeloader.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Smokeloader.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "09b9283286463b35ea2d5abfa869110eb124eb8c1788eb2630480d058e82abf2"
-		logic_hash = "7d5ba6a4cc1f1b87f7ea1963b41749f5488197ea28b31f20a235091236250463"
+		logic_hash = "v1_sha256_7d5ba6a4cc1f1b87f7ea1963b41749f5488197ea28b31f20a235091236250463"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86616,10 +86749,10 @@ rule ELASTIC_Windows_Trojan_Smokeloader_Ea14B2A5 : FILE MEMORY
 		date = "2023-05-03"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Smokeloader.yar#L41-L60"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Smokeloader.yar#L41-L60"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "15fe237276b9c2c6ceae405c0739479d165b406321891c8a31883023e7b15d54"
-		logic_hash = "8a96985902f82979f1512d4d30cfa41fd23562b8f86bf2f722351ef2adf4365f"
+		logic_hash = "v1_sha256_8a96985902f82979f1512d4d30cfa41fd23562b8f86bf2f722351ef2adf4365f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86646,10 +86779,10 @@ rule ELASTIC_Windows_Trojan_Smokeloader_De52Ed44 : FILE MEMORY
 		date = "2023-05-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Smokeloader.yar#L62-L81"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Smokeloader.yar#L62-L81"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c689a384f626616005d37a94e6a5a713b9eead1b819a238e4e586452871f6718"
-		logic_hash = "95a60079a316016ca3f78f18e7920b962f5770bef4211dd70e37f45bbe069406"
+		logic_hash = "v1_sha256_95a60079a316016ca3f78f18e7920b962f5770bef4211dd70e37f45bbe069406"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86676,10 +86809,10 @@ rule ELASTIC_Windows_Trojan_Smokeloader_Bf391Fe0 : FILE MEMORY
 		date = "2024-08-27"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Smokeloader.yar#L83-L102"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Smokeloader.yar#L83-L102"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fe2489230d024f5e0e7d0da0210f93e70248dc282192c092cbb5e0eddc7bd528"
-		logic_hash = "8a697596f8aa9a2af230b294c64ee844fcb593814a070ebf10e084c18e7f5ac7"
+		logic_hash = "v1_sha256_8a697596f8aa9a2af230b294c64ee844fcb593814a070ebf10e084c18e7f5ac7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86706,10 +86839,10 @@ rule ELASTIC_Windows_Trojan_Smokeloader_A01Aa3Ab : FILE MEMORY
 		date = "2024-08-27"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Smokeloader.yar#L104-L123"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Smokeloader.yar#L104-L123"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3a189a736cfdfbb1e3789326c35cecfa901a2adccc08c66c5de1cac8e4c1791b"
-		logic_hash = "385f93a98e71f8e78e2f916775bd8db182842c8439a2f15238780388b63e2e91"
+		logic_hash = "v1_sha256_385f93a98e71f8e78e2f916775bd8db182842c8439a2f15238780388b63e2e91"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86736,10 +86869,10 @@ rule ELASTIC_Windows_Trojan_Smokeloader_62Eb5427 : FILE MEMORY
 		date = "2024-08-27"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Smokeloader.yar#L125-L145"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Smokeloader.yar#L125-L145"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "21e7fcce8ffb7826108800b6aee21d6b8ea9275975b639ed5ca9f8ddd747329e"
-		logic_hash = "e3c70731792a8fbf0b08443f6df3c42f44a548fa9d19be7ee98c677952600e5b"
+		logic_hash = "v1_sha256_e3c70731792a8fbf0b08443f6df3c42f44a548fa9d19be7ee98c677952600e5b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86767,10 +86900,10 @@ rule ELASTIC_Windows_Trojan_Raspberryrobin_4B4D6899 : FILE MEMORY
 		date = "2023-12-13"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RaspberryRobin.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RaspberryRobin.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2f0451f38adb74cb96c857de455887b00c5038b68210294c7f52b0b5ff64cc1e"
-		logic_hash = "bbafad9509b367e811e86cb8f2f64d9c1d59f82b5cd58a7af43325bb7fa9d9c3"
+		logic_hash = "v1_sha256_bbafad9509b367e811e86cb8f2f64d9c1d59f82b5cd58a7af43325bb7fa9d9c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86796,10 +86929,10 @@ rule ELASTIC_Linux_Trojan_Azeela_Aad9D6Cc : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Azeela.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Azeela.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6c476a7457ae07eca3d3d19eda6bb6b6b3fa61fa72722958b5a77caff899aaa6"
-		logic_hash = "8cd3c383ac2149e0cd18589bf838848d81b5ff72e3123a8b523ee2467023a8f6"
+		logic_hash = "v1_sha256_8cd3c383ac2149e0cd18589bf838848d81b5ff72e3123a8b523ee2467023a8f6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86815,7 +86948,7 @@ rule ELASTIC_Linux_Trojan_Azeela_Aad9D6Cc : FILE MEMORY
 		$a2 = "The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin."
 
 	condition:
-		any of ($a*)
+		any of ( $a* )
 }
 rule ELASTIC_Linux_Trojan_Xpmmap_7Dcc3534 : FILE MEMORY
 {
@@ -86826,10 +86959,10 @@ rule ELASTIC_Linux_Trojan_Xpmmap_7Dcc3534 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Xpmmap.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Xpmmap.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "765546a981921187a4a2bed9904fbc2ccb2a5876e0d45c72e79f04a517c1bda3"
-		logic_hash = "f88cc0f02797651e8cdf8e25b67a92f7825ec616b79df21daae798b613baf334"
+		logic_hash = "v1_sha256_f88cc0f02797651e8cdf8e25b67a92f7825ec616b79df21daae798b613baf334"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86855,10 +86988,10 @@ rule ELASTIC_Windows_Vulndriver_Ccprotect_0D3Ee86F : FILE MEMORY
 		date = "2024-09-09"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_CCProtect.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_CCProtect.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5f0cfe8357bb52b45068ddbac053e32bc38e6cb5e086746f5402657b0a5cfb1c"
-		logic_hash = "4da5cf6b5cd00f8f7ba6daf8e8b4c6161cf9e0166dea39943b32a54f35dfd6c2"
+		logic_hash = "v1_sha256_4da5cf6b5cd00f8f7ba6daf8e8b4c6161cf9e0166dea39943b32a54f35dfd6c2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86875,7 +87008,7 @@ rule ELASTIC_Windows_Vulndriver_Ccprotect_0D3Ee86F : FILE MEMORY
 		$file_version = { 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 00 00 31 00 2E 00 ( 30 | 31 | 32 | 33 ) 00 3? 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and all of them
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and all of them
 }
 rule ELASTIC_Linux_Trojan_Shellbot_65Aa6568 : FILE MEMORY
 {
@@ -86886,10 +87019,10 @@ rule ELASTIC_Linux_Trojan_Shellbot_65Aa6568 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Shellbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Shellbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "457d1f4e1db41a9bdbfad78a6815f42e45da16ad0252673b9a2b5dcefc02c47b"
-		logic_hash = "46558801151ddc2f25bf46a278719f027acca2a18d2a9fcb275f4d787fbb1f0b"
+		logic_hash = "v1_sha256_46558801151ddc2f25bf46a278719f027acca2a18d2a9fcb275f4d787fbb1f0b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86915,10 +87048,10 @@ rule ELASTIC_Linux_Trojan_Nuker_12F26779 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Nuker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Nuker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "440105a62c75dea5575a1660fe217c9104dc19fb5a9238707fe40803715392bf"
-		logic_hash = "8bafbc2792bd4cacd309efd72d2d8787342685d66785ea41cb57c91519a3c545"
+		logic_hash = "v1_sha256_8bafbc2792bd4cacd309efd72d2d8787342685d66785ea41cb57c91519a3c545"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86944,10 +87077,10 @@ rule ELASTIC_Windows_Ransomware_Wannacry_D9855102 : FILE MEMORY
 		date = "2022-08-29"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_WannaCry.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_WannaCry.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0b7878babbaf7c63d808f3ce32c7306cb785fdfb1ceb73be07fb48fdd091fdfb"
-		logic_hash = "5edf6a42c9f20de3819b46f24be243940b79e7e9004fee3d601794ea0b534cf1"
+		logic_hash = "v1_sha256_5edf6a42c9f20de3819b46f24be243940b79e7e9004fee3d601794ea0b534cf1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -86969,7 +87102,7 @@ rule ELASTIC_Windows_Ransomware_Wannacry_D9855102 : FILE MEMORY
 		$b3 = { 56 8B 74 24 08 57 8B 3D 70 70 00 10 56 E8 2E FF FF FF 83 C4 04 A3 8C DD 00 10 85 C0 75 09 68 88 }
 
 	condition:
-		5 of ($a*) or 1 of ($b*)
+		5 of ( $a* ) or 1 of ( $b* )
 }
 rule ELASTIC_Linux_Virus_Staffcounter_D2D608A8 : FILE MEMORY
 {
@@ -86980,9 +87113,9 @@ rule ELASTIC_Linux_Virus_Staffcounter_D2D608A8 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "06e562b54b7ee2ffee229c2410c9e2c42090e77f6211ce4b9fa26459ff310315"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Virus_Staffcounter.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e30f1312eb1cbbc4faba3f67527a4e0e955b5684a1ba58cdd82a7a0f1ce3d2b9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Virus_Staffcounter.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e30f1312eb1cbbc4faba3f67527a4e0e955b5684a1ba58cdd82a7a0f1ce3d2b9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87008,10 +87141,10 @@ rule ELASTIC_Linux_Ransomware_Ragnarlocker_9F5982B8 : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_RagnarLocker.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_RagnarLocker.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f668f74d8808f5658153ff3e6aee8653b6324ada70a4aa2034dfa20d96875836"
-		logic_hash = "c08579dc675a709add392a0189d01e05af61034b72f451d2b024c89c1299ee6c"
+		logic_hash = "v1_sha256_c08579dc675a709add392a0189d01e05af61034b72f451d2b024c89c1299ee6c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87039,10 +87172,10 @@ rule ELASTIC_Windows_Ransomware_Royal_B7D42109 : FILE MEMORY
 		date = "2022-11-04"
 		modified = "2022-12-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Royal.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Royal.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "491c2b32095174b9de2fd799732a6f84878c2e23b9bb560cd3155cbdc65e2b80"
-		logic_hash = "06f4a1487e97e0b8c1f5df380ab4f90b37ef0a508aba7dac272c16c8371d8143"
+		logic_hash = "v1_sha256_06f4a1487e97e0b8c1f5df380ab4f90b37ef0a508aba7dac272c16c8371d8143"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87071,10 +87204,10 @@ rule ELASTIC_Windows_Ransomware_Lockbit_89E64044 : FILE MEMORY
 		date = "2021-08-06"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Lockbit.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Lockbit.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d"
-		logic_hash = "bd504b078704b9f307a50c8556c143eee061015a9727670137aadc47ae93e2a6"
+		logic_hash = "v1_sha256_bd504b078704b9f307a50c8556c143eee061015a9727670137aadc47ae93e2a6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87102,10 +87235,10 @@ rule ELASTIC_Windows_Ransomware_Lockbit_A1C60939 : FILE MEMORY
 		date = "2021-08-06"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Lockbit.yar#L23-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Lockbit.yar#L23-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d"
-		logic_hash = "6e6d88251e93f69788ad22fc915133f3ba0267984d6a5004d5ca44dcd9f5f052"
+		logic_hash = "v1_sha256_6e6d88251e93f69788ad22fc915133f3ba0267984d6a5004d5ca44dcd9f5f052"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87131,10 +87264,10 @@ rule ELASTIC_Windows_Ransomware_Lockbit_369E1E94 : FILE MEMORY
 		date = "2022-07-05"
 		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Lockbit.yar#L43-L67"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Lockbit.yar#L43-L67"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee"
-		logic_hash = "c34dafc024d85902b85fc3424573abb8781d6fab58edd86c255266db3635ce98"
+		logic_hash = "v1_sha256_c34dafc024d85902b85fc3424573abb8781d6fab58edd86c255266db3635ce98"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87155,7 +87288,7 @@ rule ELASTIC_Windows_Ransomware_Lockbit_369E1E94 : FILE MEMORY
 		$b4 = "Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files!" ascii fullword
 
 	condition:
-		2 of ($a*) or all of ($b*)
+		2 of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Darkside_D7Fc4594 : FILE MEMORY
 {
@@ -87166,10 +87299,10 @@ rule ELASTIC_Windows_Ransomware_Darkside_D7Fc4594 : FILE MEMORY
 		date = "2021-05-20"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Darkside.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Darkside.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893"
-		logic_hash = "0083fb64955973e7dbbb35d08cb780fa0b4ff4d064c102dc8f86e29af8358bad"
+		logic_hash = "v1_sha256_0083fb64955973e7dbbb35d08cb780fa0b4ff4d064c102dc8f86e29af8358bad"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87195,10 +87328,10 @@ rule ELASTIC_Windows_Ransomware_Darkside_Aceac5D9 : FILE MEMORY
 		date = "2021-05-20"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Darkside.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Darkside.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893"
-		logic_hash = "888ab06b55b07879ee6b9a45c04f1a09c570aeb4be55c698300566d57fd47252"
+		logic_hash = "v1_sha256_888ab06b55b07879ee6b9a45c04f1a09c570aeb4be55c698300566d57fd47252"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87224,10 +87357,10 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_1388212A : FILE MEMORY
 		date = "2021-04-13"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Mimikatz.yar#L1-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Mimikatz.yar#L1-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "66b4a0681cae02c302a9b6f1d611ac2df8c519d6024abdb506b4b166b93f636a"
-		logic_hash = "1b717453810455e3f530e399f5f9f163d1ad0d71a5464fa5c68aa82edd699cda"
+		logic_hash = "v1_sha256_1b717453810455e3f530e399f5f9f163d1ad0d71a5464fa5c68aa82edd699cda"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -87266,7 +87399,7 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_1388212A : FILE MEMORY
 		$a25 = " * Username : %wZ" wide fullword
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule ELASTIC_Windows_Hacktool_Mimikatz_674Fd079 : FILE MEMORY
 {
@@ -87277,10 +87410,10 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_674Fd079 : FILE MEMORY
 		date = "2021-04-14"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Mimikatz.yar#L45-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Mimikatz.yar#L45-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "66b4a0681cae02c302a9b6f1d611ac2df8c519d6024abdb506b4b166b93f636a"
-		logic_hash = "f63f3de05dd4f4f40cda6df67b75e37d7baa82c4b4cafd3ebdca35adfb0b15f8"
+		logic_hash = "v1_sha256_f63f3de05dd4f4f40cda6df67b75e37d7baa82c4b4cafd3ebdca35adfb0b15f8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87309,7 +87442,7 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_674Fd079 : FILE MEMORY
 		$b1 = { 6D 69 6D 69 C7 84 24 8C 00 00 00 6C 73 61 2E C7 84 24 90 00 00 00 6C 6F 67 }
 
 	condition:
-		all of ($a*) or $b1
+		all of ( $a* ) or $b1
 }
 rule ELASTIC_Windows_Hacktool_Mimikatz_355D5D3A : FILE MEMORY
 {
@@ -87320,10 +87453,10 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_355D5D3A : FILE MEMORY
 		date = "2021-04-14"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Mimikatz.yar#L79-L112"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Mimikatz.yar#L79-L112"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "945245ca795e0a3575ee4fdc174df9d377a598476c2bf4bf0cdb0cde4286af96"
-		logic_hash = "c6b48ab2cc92deb507d7eead1fb6381ee40b698e84d9eaac45288f95dbda66b3"
+		logic_hash = "v1_sha256_c6b48ab2cc92deb507d7eead1fb6381ee40b698e84d9eaac45288f95dbda66b3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87353,7 +87486,7 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_355D5D3A : FILE MEMORY
 		$c10 = "#If a remote process to inject in to is specified, get a handle to it" fullword
 
 	condition:
-		(1 of ($a*) or 2 of ($b*)) or 5 of ($c*)
+		(1 of ( $a* ) or 2 of ( $b* ) ) or 5 of ( $c* )
 }
 rule ELASTIC_Windows_Hacktool_Mimikatz_71Fe23D9 : FILE
 {
@@ -87364,10 +87497,10 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_71Fe23D9 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Mimikatz.yar#L114-L133"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Mimikatz.yar#L114-L133"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "856687718b208341e7caeea2d96da10f880f9b5a75736796a1158d4c8755f678"
-		logic_hash = "6d1e84bb8532c6271ad3966055eac8d60ec019d8ae6632efb59463c35b46ad9b"
+		logic_hash = "v1_sha256_6d1e84bb8532c6271ad3966055eac8d60ec019d8ae6632efb59463c35b46ad9b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87383,7 +87516,7 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_71Fe23D9 : FILE
 		$subject_name = { 06 03 55 04 03 [2] 42 65 6E 6A 61 6D 69 6E 20 44 65 6C 70 79 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $subject_name
 }
 rule ELASTIC_Windows_Hacktool_Mimikatz_B393864F : FILE
 {
@@ -87394,10 +87527,10 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_B393864F : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Mimikatz.yar#L135-L154"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Mimikatz.yar#L135-L154"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe"
-		logic_hash = "d09cb7f753675e0b6ecd8a7977ca7f8d313e5d525f05170fc54b265c2ae6c188"
+		logic_hash = "v1_sha256_d09cb7f753675e0b6ecd8a7977ca7f8d313e5d525f05170fc54b265c2ae6c188"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87413,7 +87546,7 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_B393864F : FILE
 		$subject_name = { 06 03 55 04 03 [2] 4F 70 65 6E 20 53 6F 75 72 63 65 20 44 65 76 65 6C 6F 70 65 72 2C 20 42 65 6E 6A 61 6D 69 6E 20 44 65 6C 70 79 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $subject_name
 }
 rule ELASTIC_Windows_Hacktool_Mimikatz_1Ff74F7E : FILE MEMORY
 {
@@ -87424,10 +87557,10 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_1Ff74F7E : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Mimikatz.yar#L156-L175"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Mimikatz.yar#L156-L175"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1b6aad500d45de7b076942d31b7c3e77487643811a335ae5ce6783368a4a5081"
-		logic_hash = "f47f760b4c373a073399c69681e76eb9dde6cfdb36c1cc31d7131376493931c0"
+		logic_hash = "v1_sha256_f47f760b4c373a073399c69681e76eb9dde6cfdb36c1cc31d7131376493931c0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87454,10 +87587,10 @@ rule ELASTIC_Windows_Vulndriver_Hpportio_B31E3473 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_HpPortIo.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_HpPortIo.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
-		logic_hash = "e449b45f3cf2836254614bbdc957aa7093162fc1acd672edd931d5f240503963"
+		logic_hash = "v1_sha256_e449b45f3cf2836254614bbdc957aa7093162fc1acd672edd931d5f240503963"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87474,7 +87607,7 @@ rule ELASTIC_Windows_Vulndriver_Hpportio_B31E3473 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x09][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Linux_Exploit_CVE_2009_2698_12374E97 : FILE MEMORY CVE_2009_2698
 {
@@ -87485,10 +87618,10 @@ rule ELASTIC_Linux_Exploit_CVE_2009_2698_12374E97 : FILE MEMORY CVE_2009_2698
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2009_2698.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2009_2698.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "656fddc1bf4743a08a455628b6151076b81e604ff49c93d797fa49b1f7d09c2f"
-		logic_hash = "ed86a239b909681f2ab3503cfedf202dbe5f53a6f554cf4db13f08bee625c0b7"
+		logic_hash = "v1_sha256_ed86a239b909681f2ab3503cfedf202dbe5f53a6f554cf4db13f08bee625c0b7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2009-2698"
@@ -87514,10 +87647,10 @@ rule ELASTIC_Linux_Exploit_CVE_2009_2698_Cc04Dddd : FILE MEMORY CVE_2009_2698
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2009_2698.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2009_2698.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "502b73ea04095e8a7ec4e8d7cc306242b45850ad28690156754beac8cd8d7b2d"
-		logic_hash = "68daa56ca98cc8f713faa138432190d19c27f07b2182a1f82347a3bfc5821ebb"
+		logic_hash = "v1_sha256_68daa56ca98cc8f713faa138432190d19c27f07b2182a1f82347a3bfc5821ebb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2009-2698"
@@ -87543,10 +87676,10 @@ rule ELASTIC_Linux_Trojan_Morpes_D2Ae1Edf : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Morpes.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Morpes.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "14c4c297388afe4be47be091146aea6c6230880e9ea43759ef29fc1471c4b86b"
-		logic_hash = "27eb8b4d0f91477c2ac26a5e25bfc52903faf5501300ec40773d3fc6797c3218"
+		logic_hash = "v1_sha256_27eb8b4d0f91477c2ac26a5e25bfc52903faf5501300ec40773d3fc6797c3218"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87572,10 +87705,10 @@ rule ELASTIC_Windows_Trojan_Tofsee_26124Fe4 : FILE MEMORY
 		date = "2022-03-31"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Tofsee.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Tofsee.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494"
-		logic_hash = "e765953dec7c7b2a1fbebf92c2fff46453c8258722ad5ca92ba4c7526a8b0c66"
+		logic_hash = "v1_sha256_e765953dec7c7b2a1fbebf92c2fff46453c8258722ad5ca92ba4c7526a8b0c66"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87602,10 +87735,10 @@ rule ELASTIC_Windows_Vulndriver_Biostar_D6Cc23Af : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Biostar.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Biostar.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
-		logic_hash = "6a1f5de3a0daf446ceb812a9f5749410a3a7752dce44e935adc288c95816f59d"
+		logic_hash = "v1_sha256_6a1f5de3a0daf446ceb812a9f5749410a3a7752dce44e935adc288c95816f59d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87622,7 +87755,7 @@ rule ELASTIC_Windows_Vulndriver_Biostar_D6Cc23Af : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x98][\x00-\x08]|[\x00-\xff][\x00-\x07])([\x00-\x0e][\x00-\x07]|[\x00-\xff][\x00-\x06])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0d][\x00-\x07]|[\x00-\xff][\x00-\x06]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Biostar_68682378 : FILE
 {
@@ -87633,10 +87766,10 @@ rule ELASTIC_Windows_Vulndriver_Biostar_68682378 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Biostar.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Biostar.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
-		logic_hash = "8510de6fc33bde153f3bd4d1bb8b0d98ce69aae479d242c6043ac8c712dbb888"
+		logic_hash = "v1_sha256_8510de6fc33bde153f3bd4d1bb8b0d98ce69aae479d242c6043ac8c712dbb888"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87653,7 +87786,7 @@ rule ELASTIC_Windows_Vulndriver_Biostar_68682378 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Biostar_684A5123 : FILE
 {
@@ -87664,10 +87797,10 @@ rule ELASTIC_Windows_Vulndriver_Biostar_684A5123 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Biostar.yar#L45-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Biostar.yar#L45-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
-		logic_hash = "7c0c7e14f9b5085a87e5dbe27feb8e49bdb4d2fdcfbcbc643999d7969d118240"
+		logic_hash = "v1_sha256_7c0c7e14f9b5085a87e5dbe27feb8e49bdb4d2fdcfbcbc643999d7969d118240"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87684,7 +87817,7 @@ rule ELASTIC_Windows_Vulndriver_Biostar_684A5123 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Biostar_E0B6Cf55 : FILE
 {
@@ -87695,10 +87828,10 @@ rule ELASTIC_Windows_Vulndriver_Biostar_E0B6Cf55 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Biostar.yar#L67-L85"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Biostar.yar#L67-L85"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e"
-		logic_hash = "dccbf6fa46de1a8bc6438578b651055e2d02d15bd04461be74059e6fde40fca3"
+		logic_hash = "v1_sha256_dccbf6fa46de1a8bc6438578b651055e2d02d15bd04461be74059e6fde40fca3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87713,7 +87846,7 @@ rule ELASTIC_Windows_Vulndriver_Biostar_E0B6Cf55 : FILE
 		$str1 = "\\BS_RCIO.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Ransomware_Conti_89F3F6Fa : FILE MEMORY
 {
@@ -87724,10 +87857,10 @@ rule ELASTIC_Windows_Ransomware_Conti_89F3F6Fa : FILE MEMORY
 		date = "2021-08-05"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Conti.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Conti.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "eae876886f19ba384f55778634a35a1d975414e83f22f6111e3e792f706301fe"
-		logic_hash = "4c1834e45d5e42f466249b75a89561ce1e88b9e3c07070e2833d4897fbed22ee"
+		logic_hash = "v1_sha256_4c1834e45d5e42f466249b75a89561ce1e88b9e3c07070e2833d4897fbed22ee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87753,10 +87886,10 @@ rule ELASTIC_Macos_Backdoor_Keyboardrecord_832F7Bac : FILE
 		date = "2021-11-11"
 		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Backdoor_Keyboardrecord.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Backdoor_Keyboardrecord.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "570cd76bf49cf52e0cb347a68bdcf0590b2eaece134e1b1eba7e8d66261bdbe6"
-		logic_hash = "5719681d50134edacb5341034314c33ed27e9325de0ae26b2a01d350429c533b"
+		logic_hash = "v1_sha256_5719681d50134edacb5341034314c33ed27e9325de0ae26b2a01d350429c533b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87777,6 +87910,35 @@ rule ELASTIC_Macos_Backdoor_Keyboardrecord_832F7Bac : FILE
 	condition:
 		3 of them
 }
+rule ELASTIC_Windows_Trojan_Sadbridge_6E83Eaeb : FILE MEMORY
+{
+	meta:
+		description = "Detects Windows Trojan Sadbridge (Windows.Trojan.SadBridge)"
+		author = "Elastic Security"
+		id = "6e83eaeb-12f8-4abd-8ad9-17f9a301a1c8"
+		date = "2024-11-05"
+		modified = "2024-12-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SadBridge.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		hash = "b432cdd217b171f3ad4a8a959fa0357bd7917f078a9546aed1649af00fc4bda6"
+		logic_hash = "v1_sha256_5883675a7c6f0271f26d70031a48ed59504ef4f01826e978124ab4876d23cbf2"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "0b53af98d044001a34779b27bc77f9d61f590826361441d93b6460fdbd1086d0"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$a = { 48 81 EC A0 07 00 33 FF C7 00 45 A0 30 31 32 33 48 8B 00 DA 40 88 7D AC 0F 57 C0 09 C0 00 BC 33 A1 00 CC 8B F1 48 00 89 45 F0 48 8D 55 A0 C7 00 45 A4 34 35 36 37 48 8D 00 4D D0 C7 45 A8 38 39 }
+
+	condition:
+		all of them
+}
 rule ELASTIC_Windows_Hacktool_Sleepobfloader_460A1A75 : FILE MEMORY
 {
 	meta:
@@ -87786,10 +87948,10 @@ rule ELASTIC_Windows_Hacktool_Sleepobfloader_460A1A75 : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-01-29"
 		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SleepObfLoader.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SleepObfLoader.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "84b3bc58ec04ab272544d31f5e573c0dd7812b56df4fa445194e7466f280e16d"
-		logic_hash = "c0bc1b7ef71c1a91fc487f904315c6f187530ab39825f90f55ac36625d5b93cf"
+		logic_hash = "v1_sha256_c0bc1b7ef71c1a91fc487f904315c6f187530ab39825f90f55ac36625d5b93cf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87817,10 +87979,10 @@ rule ELASTIC_Windows_Vulndriver_Tmcomm_333F3851 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_TmComm.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_TmComm.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
-		logic_hash = "a4464fb7edbacb6d9c8d6b385f9cc28685f0bed40876eecd5a7c87e0707e3025"
+		logic_hash = "v1_sha256_a4464fb7edbacb6d9c8d6b385f9cc28685f0bed40876eecd5a7c87e0707e3025"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87837,7 +87999,7 @@ rule ELASTIC_Windows_Vulndriver_Tmcomm_333F3851 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x08][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x07][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Fiddrv_E7875A5A : FILE
 {
@@ -87848,10 +88010,10 @@ rule ELASTIC_Windows_Vulndriver_Fiddrv_E7875A5A : FILE
 		date = "2023-07-25"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_FidDrv.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_FidDrv.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4bf4cced4209c73aa37a9e2bf9ff27d458d8d7201eefa6f6ad4849ee276ad158"
-		logic_hash = "aa1635c651c8364ad2ee93b369dd583fce699001d753e46de013c476d185eef1"
+		logic_hash = "v1_sha256_aa1635c651c8364ad2ee93b369dd583fce699001d753e46de013c476d185eef1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -87870,7 +88032,7 @@ rule ELASTIC_Windows_Vulndriver_Fiddrv_E7875A5A : FILE
 		$ioctl_check = { 48 8B 82 B8 00 00 00 8B 48 18 81 E9 84 2A 22 00 0F 84 ?? ?? ?? ?? 83 E9 04 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and all of them
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and all of them
 }
 rule ELASTIC_Windows_Trojan_Netwire_6A7Df287 : FILE MEMORY
 {
@@ -87881,10 +88043,10 @@ rule ELASTIC_Windows_Trojan_Netwire_6A7Df287 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Netwire.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Netwire.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e6f446dbefd4469b6c4d24988dd6c9ccd331c8b36bdbc4aaf2e5fc49de2c3254"
-		logic_hash = "d5f36e2a81cf0a9037267d39266b4c31ca9c07b05fb9772e296aeac2da6051a5"
+		logic_hash = "v1_sha256_d5f36e2a81cf0a9037267d39266b4c31ca9c07b05fb9772e296aeac2da6051a5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87910,10 +88072,10 @@ rule ELASTIC_Windows_Trojan_Netwire_1B43Df38 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-08-23"
 		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Netwire.yar#L22-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Netwire.yar#L22-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e6f446dbefd4469b6c4d24988dd6c9ccd331c8b36bdbc4aaf2e5fc49de2c3254"
-		logic_hash = "bb0eb1c1969bc1416e933822843293c5d41bf9bc3d402fa5dbdc3cdf2f4b394a"
+		logic_hash = "v1_sha256_bb0eb1c1969bc1416e933822843293c5d41bf9bc3d402fa5dbdc3cdf2f4b394a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87941,10 +88103,10 @@ rule ELASTIC_Windows_Trojan_Netwire_F85E4Abc : FILE MEMORY
 		date = "2022-08-14"
 		modified = "2022-09-29"
 		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Netwire.yar#L45-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Netwire.yar#L45-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ab037c87d8072c63dc22b22ff9cfcd9b4837c1fee2f7391d594776a6ac8f6776"
-		logic_hash = "af8fc8fff2e1a0b6c87ac6d24fecf2e1cefe6313ec66da13fddd1be25c1c3d92"
+		logic_hash = "v1_sha256_af8fc8fff2e1a0b6c87ac6d24fecf2e1cefe6313ec66da13fddd1be25c1c3d92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -87970,10 +88132,10 @@ rule ELASTIC_Windows_Trojan_Netwire_F42Cb379 : FILE MEMORY
 		date = "2022-08-14"
 		modified = "2022-09-29"
 		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Netwire.yar#L66-L90"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Netwire.yar#L66-L90"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ab037c87d8072c63dc22b22ff9cfcd9b4837c1fee2f7391d594776a6ac8f6776"
-		logic_hash = "fc1436596987d3971a464e707ee6fd5689e7d2800df471c125c1e3f748537f5d"
+		logic_hash = "v1_sha256_fc1436596987d3971a464e707ee6fd5689e7d2800df471c125c1e3f748537f5d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88004,10 +88166,10 @@ rule ELASTIC_Windows_Exploit_Rpcjunction_0405253B : FILE
 		date = "2024-02-28"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_RpcJunction.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_RpcJunction.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "05588fe3d2aae1273e9d0b0ac00c867d92bcdea41c33661760dcbe84439e7949"
-		logic_hash = "c663285d81e00bf6b028cdb043da3c6d5033a0c100d9c626acfa26d67bc1c093"
+		logic_hash = "v1_sha256_c663285d81e00bf6b028cdb043da3c6d5033a0c100d9c626acfa26d67bc1c093"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -88035,10 +88197,10 @@ rule ELASTIC_Windows_PUP_Veriato_Fae5978C : FILE MEMORY
 		date = "2022-06-08"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_PUP_Veriato.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_PUP_Veriato.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "53f09e60b188e67cdbf28bda669728a1f83d47b0279debf3d0a8d5176479d17f"
-		logic_hash = "8ae6f8b2b6e3849b33e6a477af52982efe137d7ebeff0c92cee5667d75f05145"
+		logic_hash = "v1_sha256_8ae6f8b2b6e3849b33e6a477af52982efe137d7ebeff0c92cee5667d75f05145"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88055,7 +88217,7 @@ rule ELASTIC_Windows_PUP_Veriato_Fae5978C : FILE MEMORY
 		$a2 = "C:\\Windows\\winipbin\\svrltmgr64.dll" fullword
 
 	condition:
-		$s1 and ($a1 or $a2)
+		$s1 and ( $a1 or $a2 )
 }
 rule ELASTIC_Windows_Hacktool_Sharpersist_06606812 : FILE MEMORY
 {
@@ -88066,10 +88228,10 @@ rule ELASTIC_Windows_Hacktool_Sharpersist_06606812 : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharPersist.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharPersist.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e9711f47cf9171f79bf34b342279f6fd9275c8ae65f3eb2c6ebb0b8432ea14f8"
-		logic_hash = "ddabfb54422f6fb2ad6999b724b1d8f186adf71f96f01a8770715029529e869a"
+		logic_hash = "v1_sha256_ddabfb54422f6fb2ad6999b724b1d8f186adf71f96f01a8770715029529e869a"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -88088,7 +88250,7 @@ rule ELASTIC_Windows_Hacktool_Sharpersist_06606812 : FILE MEMORY
 		$print_str3 = "[+] SUCCESS: Keepass persistence backdoor added" ascii wide
 
 	condition:
-		$guid or all of ($print_str*)
+		$guid or all of ( $print_str* )
 }
 rule ELASTIC_Windows_Trojan_Lurker_0Ee51802 : FILE
 {
@@ -88099,10 +88261,10 @@ rule ELASTIC_Windows_Trojan_Lurker_0Ee51802 : FILE
 		date = "2022-04-04"
 		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Lurker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Lurker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5718fd4f807e29e48a8b6a6f4484426ba96c61ec8630dc78677686e0c9ba2b87"
-		logic_hash = "782926c927dce82b95e51634d5607c474937e1edc0f7f739acefa0f4c03aa753"
+		logic_hash = "v1_sha256_782926c927dce82b95e51634d5607c474937e1edc0f7f739acefa0f4c03aa753"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -88117,7 +88279,7 @@ rule ELASTIC_Windows_Trojan_Lurker_0Ee51802 : FILE
 		$str1 = "\\Device\\ZHWLurker0410" wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Ransomware_Echoraix_Ea9532Df : FILE MEMORY
 {
@@ -88128,10 +88290,10 @@ rule ELASTIC_Linux_Ransomware_Echoraix_Ea9532Df : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_EchoRaix.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_EchoRaix.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dfe32d97eb48fb2afc295eecfda3196cba5d27ced6217532d119a764071c6297"
-		logic_hash = "4944f5a2632bfe0abebfa6f658ed3f71e4d97efcb428ed0987e2071dfd66e6a9"
+		logic_hash = "v1_sha256_4944f5a2632bfe0abebfa6f658ed3f71e4d97efcb428ed0987e2071dfd66e6a9"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -88157,10 +88319,10 @@ rule ELASTIC_Linux_Ransomware_Echoraix_Ee0C719A : FILE MEMORY
 		date = "2023-07-29"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_EchoRaix.yar#L21-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_EchoRaix.yar#L21-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e711b2d9323582aa390cf34846a2064457ae065c7d2ee1a78f5ed0859b40f9c0"
-		logic_hash = "3ca12ea0f1794935ea570dda83f33d04ffb19b6664cc1c8b1cbeed59ac04a01a"
+		logic_hash = "v1_sha256_3ca12ea0f1794935ea570dda83f33d04ffb19b6664cc1c8b1cbeed59ac04a01a"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -88187,10 +88349,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_364F3B7B : FILE MEMORY CVE_2016_5195
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0d4c43bf0cdd6486a4bcab988517e58b8c15d276f41600e596ecc28b0b728e69"
-		logic_hash = "5950195453232e4752b58c9e466c4df1b5ca2b22d5325730de69cd4178438aa7"
+		logic_hash = "v1_sha256_5950195453232e4752b58c9e466c4df1b5ca2b22d5325730de69cd4178438aa7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88216,10 +88378,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_3A2Ed31B : FILE MEMORY CVE_2016_5195
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ebbf3bc39ec661e2029d88960a5608e348de92089099019348bc0e891841690f"
-		logic_hash = "30cd10e38cbda719d9c344efd813e9a19e738a5251e3622957c8349e94366a29"
+		logic_hash = "v1_sha256_30cd10e38cbda719d9c344efd813e9a19e738a5251e3622957c8349e94366a29"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88245,10 +88407,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_7448814C : FILE MEMORY CVE_2016_5195
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e95d0783b635e34743109d090af17aef2e507e8c90060d171e71d9ac79e083ba"
-		logic_hash = "0024b2cc22bf6c2dfc3b73ba91080cea8d502659db38d94b19338382e2fc0c84"
+		logic_hash = "v1_sha256_0024b2cc22bf6c2dfc3b73ba91080cea8d502659db38d94b19338382e2fc0c84"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88274,10 +88436,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_2Fa988E3 : FILE MEMORY CVE_2016_5195
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "679392e78d4abefc05b885e43aaccc2da235bd7f2a267c6ecfbe2cf824776993"
-		logic_hash = "55c3992ca62ebaf8d45aff818d3261838d239f2004125689ea81edca2cfa59c2"
+		logic_hash = "v1_sha256_55c3992ca62ebaf8d45aff818d3261838d239f2004125689ea81edca2cfa59c2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88303,10 +88465,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ea8801Ac : FILE MEMORY CVE_2016_5195
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7acccfd8c2e5555a3e3bf979ad2314c12a939c1ef32b66e61e30a712f07164fd"
-		logic_hash = "00a7f71a0559f937ace15465059147839598897467db6176040882d86111bcd2"
+		logic_hash = "v1_sha256_00a7f71a0559f937ace15465059147839598897467db6176040882d86111bcd2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88332,10 +88494,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_B2Ebdebd : FILE MEMORY CVE_2016_5195
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dee49d4b7f406fd1728dad4dc217484ced2586e014e2cd265ea64eff70a2633d"
-		logic_hash = "a9d6ffa65b503f9aa13a0054fa92e346c86585418b6b72131efc00340f8ec224"
+		logic_hash = "v1_sha256_a9d6ffa65b503f9aa13a0054fa92e346c86585418b6b72131efc00340f8ec224"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88361,10 +88523,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_9190D516 : FILE MEMORY CVE_2016_5195
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "837ffed1f23293dc9c7cb994601488fc121751a249ffde51326947c33c5fca7f"
-		logic_hash = "370248d2b6bb625d65f160b62f1b4a7d2809f3fedfb98a009b19dab61f0ba57e"
+		logic_hash = "v1_sha256_370248d2b6bb625d65f160b62f1b4a7d2809f3fedfb98a009b19dab61f0ba57e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88390,10 +88552,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_3B460716 : FILE MEMORY CVE_2016_5195
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8c4d49d4881ebdab1bd0e083d4e644cfc8eb7af3b96664598526ab3d175fc420"
-		logic_hash = "759e08c9e3405d841aa467c3343cfac01fed9e9d86aca90139d0eae8855942e5"
+		logic_hash = "v1_sha256_759e08c9e3405d841aa467c3343cfac01fed9e9d86aca90139d0eae8855942e5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88419,10 +88581,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ccfd7518 : FILE MEMORY CVE_2016_5195
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b1017db71cf195aa565c57fed91ff1cdfcce344dc76526256d5817018f1351bf"
-		logic_hash = "02720152af167f1a7e5707f97aa920c6d955458df58d8ef0d9eba868da6a16af"
+		logic_hash = "v1_sha256_02720152af167f1a7e5707f97aa920c6d955458df58d8ef0d9eba868da6a16af"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88448,10 +88610,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_D41C2C63 : FILE MEMORY CVE_2016_5195
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a4e5751b4e8fa2e9b70e1e234f435a03290c414f9547dc7709ce2ee4263a35f1"
-		logic_hash = "c9460cfc2b6d686145be9afd3ed670619f04c7155b03caa193222cba8405160d"
+		logic_hash = "v1_sha256_c9460cfc2b6d686145be9afd3ed670619f04c7155b03caa193222cba8405160d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88477,10 +88639,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ffa7F059 : FILE MEMORY CVE_2016_5195
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
-		logic_hash = "b558066b80232ceb32c625f49a0ddeccd4b3bc52e664e5a72f2aa7361bcec352"
+		logic_hash = "v1_sha256_b558066b80232ceb32c625f49a0ddeccd4b3bc52e664e5a72f2aa7361bcec352"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88506,10 +88668,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_Fb24C7E4 : FILE MEMORY CVE_2016_5195
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
-		logic_hash = "17a2a628f2d1fa088a1e0c5b2ad3f08e24b8504033b328c944b9ae83a5d12fcc"
+		logic_hash = "v1_sha256_17a2a628f2d1fa088a1e0c5b2ad3f08e24b8504033b328c944b9ae83a5d12fcc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88535,10 +88697,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_B45098Df : FILE MEMORY CVE_2016_5195
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e053aca86570b3781b3e08daab51382712270d2a375257c8b5789d3d87149314"
-		logic_hash = "4622551b73a12c5399df1f4e052ce32b4cee04486a870bc92942c8597dcad1f7"
+		logic_hash = "v1_sha256_4622551b73a12c5399df1f4e052ce32b4cee04486a870bc92942c8597dcad1f7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88564,10 +88726,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_9C67A994 : FILE MEMORY CVE_2016_5195
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L261-L279"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L261-L279"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "70429d67402a43ed801e295b1ae1757e4fccd5d786c09ee054591ae51dfc1b25"
-		logic_hash = "742ce59fadefe242ca97d8ce603976fa8b5e1ba55ede38434c04dcd6f4891712"
+		logic_hash = "v1_sha256_742ce59fadefe242ca97d8ce603976fa8b5e1ba55ede38434c04dcd6f4891712"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88593,10 +88755,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ab87C1Ed : FILE MEMORY CVE_2016_5195
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c13c32d3a14cbc9c2580b1c76625cce8d48c5ae683230149a3f41640655e7f28"
-		logic_hash = "737f5ff982d2b656918ad3258ca20bce2ec416f2af743335b9a87a86f78be810"
+		logic_hash = "v1_sha256_737f5ff982d2b656918ad3258ca20bce2ec416f2af743335b9a87a86f78be810"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88622,10 +88784,10 @@ rule ELASTIC_Linux_Exploit_CVE_2016_5195_F1C0482A : FILE MEMORY CVE_2016_5195
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L301-L319"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L301-L319"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a12a1e8253ee1244b018fd3bdcb6b7729dfe16e06aed470f6b08344a110a4061"
-		logic_hash = "084ba60d8464ef5bf3a3aa942bb88caf447c6cee3ebf023157bd261226057663"
+		logic_hash = "v1_sha256_084ba60d8464ef5bf3a3aa942bb88caf447c6cee3ebf023157bd261226057663"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2016-5195"
@@ -88651,10 +88813,10 @@ rule ELASTIC_Linux_Trojan_Sshdoor_5B78Aa01 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sshdoor.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sshdoor.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2e1d909e4a6ba843194f9912826728bd2639b0f34ee512e0c3c9e5ce4d27828e"
-		logic_hash = "bcf285ac220b2b2ed9caf0943fa22ee830e5b26501c54a223e483a33e2fc63c0"
+		logic_hash = "v1_sha256_bcf285ac220b2b2ed9caf0943fa22ee830e5b26501c54a223e483a33e2fc63c0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88680,10 +88842,10 @@ rule ELASTIC_Linux_Trojan_Sshdoor_1B443A9B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sshdoor.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sshdoor.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a33112daa5a7d31ea1a1ca9b910475843b7d8c84d4658ccc00bafee044382709"
-		logic_hash = "4afcd7103a14d59abc08d9e03182a985e3d0250c09aad5e81fd110c6a95f29e0"
+		logic_hash = "v1_sha256_4afcd7103a14d59abc08d9e03182a985e3d0250c09aad5e81fd110c6a95f29e0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88709,10 +88871,10 @@ rule ELASTIC_Linux_Trojan_Sshdoor_7C36D3Dd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sshdoor.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sshdoor.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "def4de838d58c70f9f0ae026cdad3bf09b711a55af97ed20804fa1e34e7b59e9"
-		logic_hash = "c1b61fce7593a44e47043fac8a6356f9aa9e74b66db005400684a5a79b69a5cd"
+		logic_hash = "v1_sha256_c1b61fce7593a44e47043fac8a6356f9aa9e74b66db005400684a5a79b69a5cd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88738,10 +88900,10 @@ rule ELASTIC_Linux_Trojan_Sshdoor_3E81B1B7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sshdoor.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sshdoor.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "def4de838d58c70f9f0ae026cdad3bf09b711a55af97ed20804fa1e34e7b59e9"
-		logic_hash = "54253df560e6552a728dc2651c557bc23ae8ec4847760290701438821c52342e"
+		logic_hash = "v1_sha256_54253df560e6552a728dc2651c557bc23ae8ec4847760290701438821c52342e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88767,10 +88929,10 @@ rule ELASTIC_Linux_Trojan_Sshdoor_Cde7Cfd4 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sshdoor.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sshdoor.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cd646a1d59c99b9e038098b91cdb63c3fe9b35bb10583bef0ab07260dbd4d23d"
-		logic_hash = "47967d90a6dbb4461e22998aff5b7e68b4b9007ea7e5e30574ae1f1cfcbaa573"
+		logic_hash = "v1_sha256_47967d90a6dbb4461e22998aff5b7e68b4b9007ea7e5e30574ae1f1cfcbaa573"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88796,10 +88958,10 @@ rule ELASTIC_Linux_Trojan_Sshdoor_32D9Fb1B : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sshdoor.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sshdoor.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ee1f6dbea40d198e437e8c2ae81193472c89e41d1998bee071867dab1ce16b90"
-		logic_hash = "35ef4f3970484a46d705e6976a9932639d576717454b8e07ed24a72114d9c42d"
+		logic_hash = "v1_sha256_35ef4f3970484a46d705e6976a9932639d576717454b8e07ed24a72114d9c42d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88825,10 +88987,10 @@ rule ELASTIC_Linux_Trojan_Sshdoor_7C3Cfc62 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sshdoor.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sshdoor.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ee1f6dbea40d198e437e8c2ae81193472c89e41d1998bee071867dab1ce16b90"
-		logic_hash = "da9804489f30b575d2b459f82570f5df07c1777f105cd373c4268f8a31fa4e43"
+		logic_hash = "v1_sha256_da9804489f30b575d2b459f82570f5df07c1777f105cd373c4268f8a31fa4e43"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88854,10 +89016,10 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_A1311F49 : FILE MEMORY
 		date = "2023-10-06"
 		modified = "2023-10-26"
 		reference = "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_GhostPulse.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_GhostPulse.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0175448655e593aa299278d5f11b81f2af76638859e104975bdb5d30af5c0c11"
-		logic_hash = "21838f230ac1a77f09d01d30f4ea3b66313618660e63ab7012b030e0b819547e"
+		logic_hash = "v1_sha256_21838f230ac1a77f09d01d30f4ea3b66313618660e63ab7012b030e0b819547e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88884,9 +89046,9 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_3Fe1D02D : FILE MEMORY
 		date = "2023-10-12"
 		modified = "2023-10-26"
 		reference = "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_GhostPulse.yar#L23-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "4ef78d436a153ed751a8483c1e43ec2ba053dedfa0da2780fded42012d3042c1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_GhostPulse.yar#L23-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_4ef78d436a153ed751a8483c1e43ec2ba053dedfa0da2780fded42012d3042c1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88912,10 +89074,10 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_3673D337 : FILE MEMORY
 		date = "2023-12-11"
 		modified = "2024-01-12"
 		reference = "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_GhostPulse.yar#L43-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_GhostPulse.yar#L43-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3013ba32838f6d97d7d75e25394f9611b1c5def94d93588f0a05c90b25b7d6d5"
-		logic_hash = "a92815f27533338e17afd5ebdbe82e382636fb81167a82d1b613c0dccc5b7ed3"
+		logic_hash = "v1_sha256_a92815f27533338e17afd5ebdbe82e382636fb81167a82d1b613c0dccc5b7ed3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88942,10 +89104,10 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_8Ae8310B : FILE MEMORY
 		date = "2024-05-27"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_GhostPulse.yar#L65-L84"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_GhostPulse.yar#L65-L84"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b64f91b41a7390d89cd3b1fccf02b08b18b7fed17a43b0bfac63d75dc0df083"
-		logic_hash = "b3873a3c728e98d65984033620c0ac8ee93be21db5b6d9bd4665b9f7d0d759fa"
+		logic_hash = "v1_sha256_b3873a3c728e98d65984033620c0ac8ee93be21db5b6d9bd4665b9f7d0d759fa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -88972,10 +89134,10 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_9E22C56D : FILE MEMORY
 		date = "2024-07-21"
 		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_GhostPulse.yar#L86-L106"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_GhostPulse.yar#L86-L106"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "349b4dfa1e93144b010affba926663264288a5cfcb7b305320f466b2551b93df"
-		logic_hash = "5dbd0d6a936a73e933181017c67c36fde7576b47643ec00848f7b58170bd9c6b"
+		logic_hash = "v1_sha256_5dbd0d6a936a73e933181017c67c36fde7576b47643ec00848f7b58170bd9c6b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89003,10 +89165,10 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_Bb38Fcb3 : FILE MEMORY
 		date = "2024-10-15"
 		modified = "2024-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_GhostPulse.yar#L108-L127"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_GhostPulse.yar#L108-L127"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b54d9db283e6c958697bfc4f97a5dd0ba585bc1d05267569264a2d700f0799ae"
-		logic_hash = "95a7f663f0bac81a5426d722ec95e11f37fcde45cbf8ebd4e32b9f4c72873c2b"
+		logic_hash = "v1_sha256_95a7f663f0bac81a5426d722ec95e11f37fcde45cbf8ebd4e32b9f4c72873c2b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89033,10 +89195,10 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_Caea316B : FILE MEMORY
 		date = "2024-10-10"
 		modified = "2024-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_GhostPulse.yar#L129-L147"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_GhostPulse.yar#L129-L147"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "454e898405a10ecc06b4243c25f86c855203722a4970dee4c4e1a4e8e75f5137"
-		logic_hash = "740dad0ce9d6b7c5a4125db9c6ad36e767bacba478ee627032b7fe00431c6d7b"
+		logic_hash = "v1_sha256_740dad0ce9d6b7c5a4125db9c6ad36e767bacba478ee627032b7fe00431c6d7b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89062,10 +89224,10 @@ rule ELASTIC_Linux_Trojan_Malxmr_7054A0D0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Malxmr.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Malxmr.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3a6b3552ffac13aa70e24fef72b69f683ac221105415efb294fb9a2fc81c260a"
-		logic_hash = "f7153fb11e0e4bf422021cc0fab99536c2a193198bf70d7f2af2fa5c1971c028"
+		logic_hash = "v1_sha256_f7153fb11e0e4bf422021cc0fab99536c2a193198bf70d7f2af2fa5c1971c028"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -89091,10 +89253,10 @@ rule ELASTIC_Linux_Trojan_Malxmr_144994A5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Malxmr.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Malxmr.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
-		logic_hash = "4d40337895e63d3dc6f0d94889863f0f5017533658210b902b08d84cf3588cab"
+		logic_hash = "v1_sha256_4d40337895e63d3dc6f0d94889863f0f5017533658210b902b08d84cf3588cab"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -89120,10 +89282,10 @@ rule ELASTIC_Windows_Hacktool_Cheatengine_Fedac96D : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_CheatEngine.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_CheatEngine.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b20b339a7b61dc7dbc9a36c45492ba9654a8b8a7c8cbc202ed1dfed427cfd799"
-		logic_hash = "426b6d388f86dd935d8165af0fb7c8491c987542755ec4c7c53a35a9003f8680"
+		logic_hash = "v1_sha256_426b6d388f86dd935d8165af0fb7c8491c987542755ec4c7c53a35a9003f8680"
 		score = 75
 		quality = 35
 		tags = "FILE"
@@ -89139,7 +89301,7 @@ rule ELASTIC_Windows_Hacktool_Cheatengine_Fedac96D : FILE
 		$subject_name = { 06 03 55 04 03 [2] 43 68 65 61 74 20 45 6E 67 69 6E 65 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $subject_name
 }
 rule ELASTIC_Windows_Ransomware_Helloxd_0C50F01B : FILE MEMORY
 {
@@ -89150,10 +89312,10 @@ rule ELASTIC_Windows_Ransomware_Helloxd_0C50F01B : FILE MEMORY
 		date = "2022-06-14"
 		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Helloxd.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Helloxd.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "435781ab608ff908123d9f4758132fa45d459956755d27027a52b8c9e61f9589"
-		logic_hash = "71e09fa1a00fa6f3688129ee2b2a8957b84f64ef51fcba5123a6a9df80a9c7e1"
+		logic_hash = "v1_sha256_71e09fa1a00fa6f3688129ee2b2a8957b84f64ef51fcba5123a6a9df80a9c7e1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89175,7 +89337,7 @@ rule ELASTIC_Windows_Ransomware_Helloxd_0C50F01B : FILE MEMORY
 		$companyname = "MicloZ0ft" ascii wide
 
 	condition:
-		($mutex and all of ($ransomnote*)) or (3 of ($productname,$legalcopyright,$description,$companyname))
+		($mutex and all of ( $ransomnote* ) ) or ( 3 of ( $productname , $legalcopyright , $description , $companyname ) )
 }
 rule ELASTIC_Windows_Ransomware_Blackhunt_7B46Cb9C : FILE MEMORY
 {
@@ -89186,10 +89348,10 @@ rule ELASTIC_Windows_Ransomware_Blackhunt_7B46Cb9C : FILE MEMORY
 		date = "2024-03-12"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_BlackHunt.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_BlackHunt.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6c4e968c9b53906ba0e86a41eccdabe2b736238cb126852023e15850e956293d"
-		logic_hash = "97bb8436574fd814d8278e5a7043e011d0e4f9a7dd9df5e67605f28ac1af1e74"
+		logic_hash = "v1_sha256_97bb8436574fd814d8278e5a7043e011d0e4f9a7dd9df5e67605f28ac1af1e74"
 		score = 50
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89221,10 +89383,10 @@ rule ELASTIC_Linux_Exploit_Openssl_47C6Fad7 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Openssl.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Openssl.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8024af0931dff24b5444f0b06a27366a776014358aa0b7fc073030958f863ef8"
-		logic_hash = "4c60071ecd7b826e692710ae11b09be30e7df5833bcaa8642fea014e12b9abd7"
+		logic_hash = "v1_sha256_4c60071ecd7b826e692710ae11b09be30e7df5833bcaa8642fea014e12b9abd7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89250,10 +89412,10 @@ rule ELASTIC_Windows_Trojan_Lumma_693A5234 : FILE MEMORY
 		date = "2024-06-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Lumma.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Lumma.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "88340abcdc3cfe7574ee044aea44808446daf3bb7bf9fc60b16a2b1360c5d9c0"
-		logic_hash = "2b29ac9bc73f191bdbfc92601cab923aa9f2f3380c8123ee469ced3754625dd0"
+		logic_hash = "v1_sha256_2b29ac9bc73f191bdbfc92601cab923aa9f2f3380c8123ee469ced3754625dd0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89280,10 +89442,10 @@ rule ELASTIC_Windows_Trojan_Lumma_30608A8C : FILE MEMORY
 		date = "2024-10-07"
 		modified = "2024-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Lumma.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Lumma.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "672e06b9729da0616b103c19d68b812bed33e3e12c788a584f13925f81d68129"
-		logic_hash = "1793a535db3fd7e8ad3db4b2de22efffabbcd3e91d89f36de71e95dc0fa9012f"
+		logic_hash = "v1_sha256_1793a535db3fd7e8ad3db4b2de22efffabbcd3e91d89f36de71e95dc0fa9012f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89310,10 +89472,10 @@ rule ELASTIC_Windows_Trojan_Lumma_4Ad749B0 : FILE MEMORY
 		date = "2024-11-08"
 		modified = "2024-11-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Lumma.yar#L43-L61"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Lumma.yar#L43-L61"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1f953271bc983b3a561b85083bc14a13d18b81a34855d0a6d9fe902934347f92"
-		logic_hash = "2248fe539cd0ba17073f1e1650fb93fb755ebe4bc2505e11aa7db9635a0fcb8e"
+		logic_hash = "v1_sha256_2248fe539cd0ba17073f1e1650fb93fb755ebe4bc2505e11aa7db9635a0fcb8e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89339,10 +89501,10 @@ rule ELASTIC_Windows_Trojan_Garble_Eae7F2F7 : FILE MEMORY
 		date = "2022-06-08"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Garble.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Garble.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4820a1ec99981e03675a86c4c01acba6838f04945b5f753770b3de4e253e1b8c"
-		logic_hash = "5d88579b0f0f71b8b4310c141fb243f39696e158227da0a1e0140b030b783c65"
+		logic_hash = "v1_sha256_5d88579b0f0f71b8b4310c141fb243f39696e158227da0a1e0140b030b783c65"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89368,10 +89530,10 @@ rule ELASTIC_Windows_Trojan_Lobshot_013C1B0B : FILE MEMORY
 		date = "2023-04-18"
 		modified = "2023-04-23"
 		reference = "https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Lobshot.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Lobshot.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e4ea88887753a936eaf3361dcc00380b88b0c210dcbde24f8f7ce27991856bf6"
-		logic_hash = "e1fb245c3441c9bd393a47a9bed01bf7f62aa3ec36d460584d75e326e7e92ad4"
+		logic_hash = "v1_sha256_e1fb245c3441c9bd393a47a9bed01bf7f62aa3ec36d460584d75e326e7e92ad4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89396,7 +89558,7 @@ rule ELASTIC_Windows_Trojan_Lobshot_013C1B0B : FILE MEMORY
 		$seq_create_guid = { 8D 48 ?? 80 F9 ?? 77 ?? 2C ?? C1 E2 ?? 46 0F B6 C8 0B D1 83 FE ?? 7C ?? 5F 8B C2 5E C3 }
 
 	condition:
-		2 of ($seq*) or 5 of ($str*)
+		2 of ( $seq* ) or 5 of ( $str* )
 }
 rule ELASTIC_Linux_Shellcode_Generic_5669055F : FILE MEMORY
 {
@@ -89407,10 +89569,10 @@ rule ELASTIC_Linux_Shellcode_Generic_5669055F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Shellcode_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Shellcode_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "87ef4def16d956cdfecaea899cbb55ff59a6739bbb438bf44a8b5fec7fcfd85b"
-		logic_hash = "735b8dc7fff3c9cc96646a4eb7c5afd70be19dcc821e9e26ce906681130746be"
+		logic_hash = "v1_sha256_735b8dc7fff3c9cc96646a4eb7c5afd70be19dcc821e9e26ce906681130746be"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89436,10 +89598,10 @@ rule ELASTIC_Linux_Shellcode_Generic_D2C96B1D : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Shellcode_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Shellcode_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "403d53a65bd77856f7c565307af5003b07413f2aba50869655cdd88ce15b0c82"
-		logic_hash = "33d964e22c8e3046f114e8264d18e8b4a0e7b55eca59151b084db7eea07aa0b1"
+		logic_hash = "v1_sha256_33d964e22c8e3046f114e8264d18e8b4a0e7b55eca59151b084db7eea07aa0b1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89465,10 +89627,10 @@ rule ELASTIC_Linux_Shellcode_Generic_30C70926 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Shellcode_Generic.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Shellcode_Generic.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a742e23f26726293b1bff3db72864471d6bb4062db1cc6e1c4241f51ec0e21b1"
-		logic_hash = "3594994a911e5428198c472a51de189a6be74895170581ec577c49f8dbb9167a"
+		logic_hash = "v1_sha256_3594994a911e5428198c472a51de189a6be74895170581ec577c49f8dbb9167a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89494,10 +89656,10 @@ rule ELASTIC_Linux_Shellcode_Generic_224Bdcc4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Shellcode_Generic.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Shellcode_Generic.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bd22648babbee04555cef52bfe3e0285d33852e85d254b8ebc847e4e841b447e"
-		logic_hash = "8c4a2bb63f0926e7373caf0a027179b4730cc589f9af66d2071e88f4165b0f73"
+		logic_hash = "v1_sha256_8c4a2bb63f0926e7373caf0a027179b4730cc589f9af66d2071e88f4165b0f73"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89523,10 +89685,10 @@ rule ELASTIC_Linux_Shellcode_Generic_99B991Cd : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Shellcode_Generic.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Shellcode_Generic.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "954b5a073ce99075b60beec72936975e48787bea936b4c5f13e254496a20d81d"
-		logic_hash = "664e213314fe1d6f1920de237ebea3a94f7fbc42eff089475674ccef812f0f68"
+		logic_hash = "v1_sha256_664e213314fe1d6f1920de237ebea3a94f7fbc42eff089475674ccef812f0f68"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89552,10 +89714,10 @@ rule ELASTIC_Linux_Shellcode_Generic_24B9Aa12 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Shellcode_Generic.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Shellcode_Generic.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "24b2c1ccbbbe135d40597fbd23f7951d93260d0039e0281919de60fa74eb5977"
-		logic_hash = "4685253eb00a21d6dd6e874ff68209f20c8668262f24767086687555ccf934aa"
+		logic_hash = "v1_sha256_4685253eb00a21d6dd6e874ff68209f20c8668262f24767086687555ccf934aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89581,10 +89743,10 @@ rule ELASTIC_Linux_Shellcode_Generic_8Ac37612 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Shellcode_Generic.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Shellcode_Generic.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c199b902fa4b0fcf54dc6bf3e25ad16c12f862b47e055863a5e9e1f98c6bd6ca"
-		logic_hash = "c0af751bc54dcd9cf834fa5fe9fa120be5e49a56135ebb72fd6073948e956929"
+		logic_hash = "v1_sha256_c0af751bc54dcd9cf834fa5fe9fa120be5e49a56135ebb72fd6073948e956929"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89610,10 +89772,10 @@ rule ELASTIC_Linux_Shellcode_Generic_932Ed0F0 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Shellcode_Generic.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Shellcode_Generic.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f357597f718f86258e7a640250f2e9cf1c3363ab5af8ddbbabb10ebfa3c91251"
-		logic_hash = "20ae3f1d96f8afd0900ac919eacaff3bd748a7466af5bb2b9f77cfdc4b8b829e"
+		logic_hash = "v1_sha256_20ae3f1d96f8afd0900ac919eacaff3bd748a7466af5bb2b9f77cfdc4b8b829e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89639,10 +89801,10 @@ rule ELASTIC_Linux_Ransomware_Sfile_9E347B52 : FILE MEMORY
 		date = "2023-07-29"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_SFile.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_SFile.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "49473adedc4ee9b1252f120ad8a69e165dc62eabfa794370408ae055ec65db9d"
-		logic_hash = "394571fd5746132d15da97428c3afc149435d91d5432eadf1c838d4a6433c7c1"
+		logic_hash = "v1_sha256_394571fd5746132d15da97428c3afc149435d91d5432eadf1c838d4a6433c7c1"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -89669,10 +89831,10 @@ rule ELASTIC_Windows_Trojan_Pikabot_8C6750B5 : FILE MEMORY
 		date = "2023-06-05"
 		modified = "2023-06-19"
 		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PikaBot.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PikaBot.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1"
-		logic_hash = "03e36f927513625d1dd997c79843b1b14e344e8411155740213d7aff9794c5c6"
+		logic_hash = "v1_sha256_03e36f927513625d1dd997c79843b1b14e344e8411155740213d7aff9794c5c6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89703,10 +89865,10 @@ rule ELASTIC_Windows_Trojan_Pikabot_5B220E9C : FILE MEMORY
 		date = "2024-02-06"
 		modified = "2024-02-08"
 		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PikaBot.yar#L27-L52"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PikaBot.yar#L27-L52"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d836b06b0118e6d258e318b1cfdc509cacc0859c6a6b3d7c5f4d2525e00d97b2"
-		logic_hash = "1d2158716b7c32734f12f8528352a3872e21fea2f9b21a36d6ac44fcd50a9f3c"
+		logic_hash = "v1_sha256_1d2158716b7c32734f12f8528352a3872e21fea2f9b21a36d6ac44fcd50a9f3c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89738,9 +89900,9 @@ rule ELASTIC_Windows_Trojan_Pikabot_5441F511 : FILE MEMORY
 		date = "2024-02-15"
 		modified = "2024-02-21"
 		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PikaBot.yar#L54-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "fa44408874c6a007212dfc206cbecbac7a3e50df94da4ce02de2e04e9119c79f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PikaBot.yar#L54-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_fa44408874c6a007212dfc206cbecbac7a3e50df94da4ce02de2e04e9119c79f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89772,9 +89934,9 @@ rule ELASTIC_Windows_Trojan_Pikabot_95Db8B5A : FILE MEMORY
 		date = "2024-02-15"
 		modified = "2024-02-21"
 		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PikaBot.yar#L80-L103"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "74073ceae1b26b953b7644d56a2ec92993b83802a30ce82c6921df5448ebab06"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PikaBot.yar#L80-L103"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_74073ceae1b26b953b7644d56a2ec92993b83802a30ce82c6921df5448ebab06"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89805,10 +89967,10 @@ rule ELASTIC_Linux_Exploit_CVE_2021_4034_1C8F235D : FILE CVE_2021_4034
 		date = "2022-01-26"
 		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2021_4034.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2021_4034.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "94052c42aa41d0911e4b425dcfd6b829cec8f673bf1245af4050ef9c257f6c4b"
-		logic_hash = "217df6687076a715712a053672d7b02567a3ee38ce9c0ccf80d23fcfde35592a"
+		logic_hash = "v1_sha256_217df6687076a715712a053672d7b02567a3ee38ce9c0ccf80d23fcfde35592a"
 		score = 75
 		quality = 75
 		tags = "FILE, CVE-2021-4034"
@@ -89835,10 +89997,10 @@ rule ELASTIC_Macos_Infostealer_Mdquerytcc_142313Cb : FILE MEMORY
 		date = "2023-04-11"
 		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Infostealer_MdQueryTCC.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Infostealer_MdQueryTCC.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d895075057e491b34b0f8c0392b44e43ade425d19eaaacea6ef8c5c9bd3487d8"
-		logic_hash = "e00015867ad0a0c440a49364945fe828d50675ecfd2039028653d97c77cff323"
+		logic_hash = "v1_sha256_e00015867ad0a0c440a49364945fe828d50675ecfd2039028653d97c77cff323"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -89864,9 +90026,9 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_1Cab7Ea1 : BETA FILE MEMORY
 		date = "2020-05-03"
 		modified = "2021-08-23"
 		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ragnarok.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8bae3ea4304473209fc770673b680154bf227ce30f6299101d93fe830da0fe91"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ragnarok.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8bae3ea4304473209fc770673b680154bf227ce30f6299101d93fe830da0fe91"
 		score = 75
 		quality = 73
 		tags = "BETA, FILE, MEMORY"
@@ -89882,7 +90044,7 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_1Cab7Ea1 : BETA FILE MEMORY
 		$c1 = ".ragnarok" ascii wide fullword
 
 	condition:
-		1 of ($c*)
+		1 of ( $c* )
 }
 rule ELASTIC_Windows_Ransomware_Ragnarok_7E802F95 : BETA FILE MEMORY
 {
@@ -89893,9 +90055,9 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_7E802F95 : BETA FILE MEMORY
 		date = "2020-05-03"
 		modified = "2021-08-23"
 		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ragnarok.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8f293cdbdc3c395e18c304dfa43d0dcdb52b18bde5b5d084190ceec70aea6cbd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ragnarok.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8f293cdbdc3c395e18c304dfa43d0dcdb52b18bde5b5d084190ceec70aea6cbd"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -89912,7 +90074,7 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_7E802F95 : BETA FILE MEMORY
 		$d2 = { 68 90 94 42 00 FF 35 A0 77 43 00 E8 8F D6 00 00 8B 40 10 50 }
 
 	condition:
-		1 of ($d*)
+		1 of ( $d* )
 }
 rule ELASTIC_Windows_Ransomware_Ragnarok_Efafbe48 : BETA FILE MEMORY
 {
@@ -89923,9 +90085,9 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_Efafbe48 : BETA FILE MEMORY
 		date = "2020-05-03"
 		modified = "2021-08-23"
 		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ragnarok.yar#L44-L71"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "c9d203620e0e6e04d717595ca70a5e5efa74abfc11e4e732d729caab2d246c27"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ragnarok.yar#L44-L71"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_c9d203620e0e6e04d717595ca70a5e5efa74abfc11e4e732d729caab2d246c27"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -89949,7 +90111,7 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_Efafbe48 : BETA FILE MEMORY
 		$a10 = "&prv_ip=" ascii fullword
 
 	condition:
-		6 of ($a*)
+		6 of ( $a* )
 }
 rule ELASTIC_Windows_Ransomware_Ragnarok_5625D3F6 : BETA FILE MEMORY
 {
@@ -89960,9 +90122,9 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_5625D3F6 : BETA FILE MEMORY
 		date = "2020-05-03"
 		modified = "2021-08-23"
 		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ragnarok.yar#L73-L95"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8c22cf9dfbeba7391f6d2370c88129650ef4c778464e676752de1d0fd9c5b34e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ragnarok.yar#L73-L95"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8c22cf9dfbeba7391f6d2370c88129650ef4c778464e676752de1d0fd9c5b34e"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -89981,7 +90143,7 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_5625D3F6 : BETA FILE MEMORY
 		$b4 = "cometosee" ascii fullword
 
 	condition:
-		all of ($b*)
+		all of ( $b* )
 }
 rule ELASTIC_Macos_Trojan_Metasploit_6Cab0Ec0 : FILE MEMORY
 {
@@ -89992,10 +90154,10 @@ rule ELASTIC_Macos_Trojan_Metasploit_6Cab0Ec0 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
-		logic_hash = "c19fe812b74b034bfb42c0e2ee552d879ed038e054c5870b85e7e610d3184198"
+		logic_hash = "v1_sha256_c19fe812b74b034bfb42c0e2ee552d879ed038e054c5870b85e7e610d3184198"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90021,10 +90183,10 @@ rule ELASTIC_Macos_Trojan_Metasploit_293Bfea9 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L21-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L21-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
-		logic_hash = "b8bd0d034a6306f99333723d77724ae53c1a189dad3fad7417f2d2fde214c24a"
+		logic_hash = "v1_sha256_b8bd0d034a6306f99333723d77724ae53c1a189dad3fad7417f2d2fde214c24a"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -90053,10 +90215,10 @@ rule ELASTIC_Macos_Trojan_Metasploit_448Fa81D : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L44-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L44-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
-		logic_hash = "ab0608920b9f632bad99e1358f21a88bc6048f46fca21a488a1a10b7ef1e42ae"
+		logic_hash = "v1_sha256_ab0608920b9f632bad99e1358f21a88bc6048f46fca21a488a1a10b7ef1e42ae"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90084,9 +90246,9 @@ rule ELASTIC_Macos_Trojan_Metasploit_768Df39D : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_reverse_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L66-L85"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "140ba93d57b27325f66b36132ecaab205663e3e582818baf377e050802c8d152"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L66-L85"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_140ba93d57b27325f66b36132ecaab205663e3e582818baf377e050802c8d152"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90113,9 +90275,9 @@ rule ELASTIC_Macos_Trojan_Metasploit_7Ce0B709 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_bind_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L87-L106"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "56fc05ece464d562ff6e56247756454c940c07b03c4a4c783b2bae4d5807247a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L87-L106"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_56fc05ece464d562ff6e56247756454c940c07b03c4a4c783b2bae4d5807247a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90142,9 +90304,9 @@ rule ELASTIC_Macos_Trojan_Metasploit_F11Ccdac : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_find_port.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L108-L127"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "fcf578d3e98b591b33cb6f4bec1b9e92a7e1a88f0b56f3c501f9089d2094289c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L108-L127"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_fcf578d3e98b591b33cb6f4bec1b9e92a7e1a88f0b56f3c501f9089d2094289c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90171,9 +90333,9 @@ rule ELASTIC_Macos_Trojan_Metasploit_D9B16F4C : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/vforkshell_bind_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L129-L148"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8e082878fb52f6314ec8c725dd279447ee8a0fc403c47ffd997712adb496e7c3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L129-L148"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8e082878fb52f6314ec8c725dd279447ee8a0fc403c47ffd997712adb496e7c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90200,9 +90362,9 @@ rule ELASTIC_Macos_Trojan_Metasploit_2992B917 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/vforkshell_reverse_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L150-L169"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "10056ffb719092f83ad236a63ef6fa1f40568e500c042bd737575997bb67a8ec"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L150-L169"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_10056ffb719092f83ad236a63ef6fa1f40568e500c042bd737575997bb67a8ec"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90229,9 +90391,9 @@ rule ELASTIC_Macos_Trojan_Metasploit_27D409F1 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x64/shell_bind_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L171-L190"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "b757e0ab6665a3e4846c6bbe4386e9d9a730ece00a2453933ce771aec2dd716e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L171-L190"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_b757e0ab6665a3e4846c6bbe4386e9d9a730ece00a2453933ce771aec2dd716e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90258,9 +90420,9 @@ rule ELASTIC_Macos_Trojan_Metasploit_65A2394B : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stages/osx/x86/vforkshell.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L192-L211"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "f01f671b0bf9fa53aa3383c88ba871742f0e55dbdae4278f440ed29f35eb1ca1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L192-L211"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_f01f671b0bf9fa53aa3383c88ba871742f0e55dbdae4278f440ed29f35eb1ca1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90287,9 +90449,9 @@ rule ELASTIC_Macos_Trojan_Metasploit_C7B7A90B : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/osx/x86/reverse_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L213-L232"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d4b1f01bf8434dd69188d2ad0b376fad3a4d9c94ebe74d40f05019baf95b5496"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L213-L232"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d4b1f01bf8434dd69188d2ad0b376fad3a4d9c94ebe74d40f05019baf95b5496"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90316,9 +90478,9 @@ rule ELASTIC_Macos_Trojan_Metasploit_4Bd6Aaca : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/osx/x86/bind_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L234-L253"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "a3de610ced90679f6fa0dcdf7890a64369c774839ea30018a7ef6fe9289d3d17"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L234-L253"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_a3de610ced90679f6fa0dcdf7890a64369c774839ea30018a7ef6fe9289d3d17"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90345,10 +90507,10 @@ rule ELASTIC_Macos_Trojan_Metasploit_5E5B685F : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Metasploit.yar#L255-L273"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Metasploit.yar#L255-L273"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cdf0a3c07ef1479b53d49b8f22a9f93adcedeea3b869ef954cc043e54f65c3d0"
-		logic_hash = "003fb4f079b125f37899a2b3cb62d80edd5b3e5ccbed5bc1ea514a4a173d329d"
+		logic_hash = "v1_sha256_003fb4f079b125f37899a2b3cb62d80edd5b3e5ccbed5bc1ea514a4a173d329d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90374,10 +90536,10 @@ rule ELASTIC_Windows_Trojan_Beam_E41B243A : FILE MEMORY
 		date = "2021-12-07"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Beam.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Beam.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "233a1f1dcbb679d31dab7744358b434cccabfc752baf53ba991388ced098f7c8"
-		logic_hash = "295837743ecfa51e1713d19cba24ff8885c8716201caac058ae8b2bc9e008e6c"
+		logic_hash = "v1_sha256_295837743ecfa51e1713d19cba24ff8885c8716201caac058ae8b2bc9e008e6c"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -90406,10 +90568,10 @@ rule ELASTIC_Windows_Trojan_Beam_5A951D13 : FILE MEMORY
 		date = "2021-12-07"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Beam.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Beam.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "233a1f1dcbb679d31dab7744358b434cccabfc752baf53ba991388ced098f7c8"
-		logic_hash = "3419b649717b69f07334bd966f438dd0b77f03572fe14f4b88ce95a2a86cae07"
+		logic_hash = "v1_sha256_3419b649717b69f07334bd966f438dd0b77f03572fe14f4b88ce95a2a86cae07"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90435,10 +90597,10 @@ rule ELASTIC_Windows_Trojan_Afdk_C952Fcfa : FILE MEMORY
 		date = "2023-12-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Afdk.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Afdk.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6723a9489e7cfb5e2d37ff9160d55cda065f06907122d73764849808018eb7a0"
-		logic_hash = "a0589a3bf9e733e615b6e552395b3ff513e4fad7efd7d2ebea634aa91d2f60d9"
+		logic_hash = "v1_sha256_a0589a3bf9e733e615b6e552395b3ff513e4fad7efd7d2ebea634aa91d2f60d9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90464,10 +90626,10 @@ rule ELASTIC_Windows_Trojan_Afdk_5F8Cc135 : FILE MEMORY
 		date = "2023-12-01"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Afdk.yar#L21-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Afdk.yar#L21-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6723a9489e7cfb5e2d37ff9160d55cda065f06907122d73764849808018eb7a0"
-		logic_hash = "0523a0cc3a4446f2ac88c72999568313c6b40f7f8975b8e332c0c6b1e48c5d76"
+		logic_hash = "v1_sha256_0523a0cc3a4446f2ac88c72999568313c6b40f7f8975b8e332c0c6b1e48c5d76"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90495,10 +90657,10 @@ rule ELASTIC_Windows_Ransomware_Grief_9953339A : FILE MEMORY
 		date = "2021-08-04"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Grief.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Grief.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0864575d4f487e52a1479c61c2c4ad16742d92e16d0c10f5ed2b40506bbc6ca0"
-		logic_hash = "f99ea1e1f59dc2999659cbe649e76001dd7139b1438440717b60f081d1e99d70"
+		logic_hash = "v1_sha256_f99ea1e1f59dc2999659cbe649e76001dd7139b1438440717b60f081d1e99d70"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90524,10 +90686,10 @@ rule ELASTIC_Windows_Trojan_Rhadamanthys_21B60705 : FILE MEMORY
 		date = "2023-03-19"
 		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Rhadamanthys.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Rhadamanthys.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ba97c51ba503fa4bdcfd5580c75436bc88794b4ae883afa1d92bb0b2a0f5efe"
-		logic_hash = "ef3f60689d72553111b42b27e0a1a0316288ae07fbfaf159eea8c76380d528fa"
+		logic_hash = "v1_sha256_ef3f60689d72553111b42b27e0a1a0316288ae07fbfaf159eea8c76380d528fa"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -90559,10 +90721,10 @@ rule ELASTIC_Windows_Trojan_Rhadamanthys_1Da1C2C2 : FILE MEMORY
 		date = "2023-03-28"
 		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Rhadamanthys.yar#L27-L52"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Rhadamanthys.yar#L27-L52"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9bfc4fed7afc79a167cac173bf3602f9d1f90595d4e41dab68ff54973f2cedc1"
-		logic_hash = "bf5d45fe79dacfc6aee5cfd788ec6ce77e99e55d5a6d294da57c126bedf75ee9"
+		logic_hash = "v1_sha256_bf5d45fe79dacfc6aee5cfd788ec6ce77e99e55d5a6d294da57c126bedf75ee9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90595,10 +90757,10 @@ rule ELASTIC_Windows_Trojan_Rhadamanthys_Ae00F48C : FILE MEMORY
 		date = "2023-05-05"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Rhadamanthys.yar#L54-L74"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Rhadamanthys.yar#L54-L74"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "56b5ff5132ec1c5836223ced287d51a9ecee8d2b081f449245e136b1262a8714"
-		logic_hash = "423b68717a7aead3c871e7fc744e35dad1cfd7727bfba2bdaec69fb782540380"
+		logic_hash = "v1_sha256_423b68717a7aead3c871e7fc744e35dad1cfd7727bfba2bdaec69fb782540380"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -90626,10 +90788,10 @@ rule ELASTIC_Windows_Trojan_Rhadamanthys_Cf5Dd2E2 : FILE MEMORY
 		date = "2024-04-03"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Rhadamanthys.yar#L76-L97"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Rhadamanthys.yar#L76-L97"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "39ccc224c2c6d89d0bce3d9e2c677465cbc7524f2d2aa903f79ad26b340dec3d"
-		logic_hash = "039d6de0d072be6717ba3eb90735d7b4898d3bbac83db4feb75efcdbca8fd98b"
+		logic_hash = "v1_sha256_039d6de0d072be6717ba3eb90735d7b4898d3bbac83db4feb75efcdbca8fd98b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90658,10 +90820,10 @@ rule ELASTIC_Windows_Trojan_Rhadamanthys_C4760266 : FILE MEMORY
 		date = "2024-06-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Rhadamanthys.yar#L99-L117"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Rhadamanthys.yar#L99-L117"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165"
-		logic_hash = "b8c1c56681aac4e1b1741dfa3ea929677214873b6f1795423a80742f699249de"
+		logic_hash = "v1_sha256_b8c1c56681aac4e1b1741dfa3ea929677214873b6f1795423a80742f699249de"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90687,10 +90849,10 @@ rule ELASTIC_Windows_Trojan_Lokibot_1F885282 : FILE MEMORY
 		date = "2021-06-22"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Lokibot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Lokibot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409"
-		logic_hash = "c76941a83e18f11ed5af701e89616d324ddba613a95069997ea8f1830f328307"
+		logic_hash = "v1_sha256_c76941a83e18f11ed5af701e89616d324ddba613a95069997ea8f1830f328307"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90716,10 +90878,10 @@ rule ELASTIC_Windows_Trojan_Lokibot_0F421617 : FILE MEMORY
 		date = "2021-07-20"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Lokibot.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Lokibot.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080"
-		logic_hash = "0076ccbe43ae77e3a80164d43832643f077e659a595fff01c87694e2274c5e86"
+		logic_hash = "v1_sha256_0076ccbe43ae77e3a80164d43832643f077e659a595fff01c87694e2274c5e86"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90745,9 +90907,9 @@ rule ELASTIC_Windows_Trojan_P8Loader_E478A831 : FILE MEMORY
 		date = "2023-04-13"
 		modified = "2023-05-26"
 		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_P8Loader.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "f1a7de6bb4477ea82c18aea1ddc4481de2fc362ce5321f4205bb3b74c1c45a7e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_P8Loader.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_f1a7de6bb4477ea82c18aea1ddc4481de2fc362ce5321f4205bb3b74c1c45a7e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90780,10 +90942,10 @@ rule ELASTIC_Windows_Trojan_Stealc_B8Ab9Ab5 : FILE MEMORY
 		date = "2024-03-13"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Stealc.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Stealc.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0d1c07c84c54348db1637e21260dbed09bd6b7e675ef58e003d0fe8f017fd2c8"
-		logic_hash = "5fc5d5cea481d1d204d1aa6c52679a23eb59438df2fe547d14c00524772867bb"
+		logic_hash = "v1_sha256_5fc5d5cea481d1d204d1aa6c52679a23eb59438df2fe547d14c00524772867bb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90806,7 +90968,7 @@ rule ELASTIC_Windows_Trojan_Stealc_B8Ab9Ab5 : FILE MEMORY
 		$str5 = "/c timeout /t 5 & del /f /q" ascii fullword
 
 	condition:
-		(2 of ($seq*) or 4 of ($str*))
+		(2 of ( $seq* ) or 4 of ( $str* ) )
 }
 rule ELASTIC_Windows_Trojan_Stealc_A2B71Dc4 : FILE MEMORY
 {
@@ -90817,10 +90979,10 @@ rule ELASTIC_Windows_Trojan_Stealc_A2B71Dc4 : FILE MEMORY
 		date = "2024-03-13"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Stealc.yar#L29-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Stealc.yar#L29-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0d1c07c84c54348db1637e21260dbed09bd6b7e675ef58e003d0fe8f017fd2c8"
-		logic_hash = "b79ac3e65cd7d2819d6a49f59ec661241c97174f66a7c4ada91932f10fc43583"
+		logic_hash = "v1_sha256_b79ac3e65cd7d2819d6a49f59ec661241c97174f66a7c4ada91932f10fc43583"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90838,7 +91000,7 @@ rule ELASTIC_Windows_Trojan_Stealc_A2B71Dc4 : FILE MEMORY
 		$seq_4 = { 6A 7C 58 66 89 45 FC 8D 45 F0 50 8D 45 FC 50 FF 75 08 C7 45 F8 01 }
 
 	condition:
-		2 of ($seq*)
+		2 of ( $seq* )
 }
 rule ELASTIC_Windows_Trojan_Stealc_5D3F297C : FILE MEMORY
 {
@@ -90849,10 +91011,10 @@ rule ELASTIC_Windows_Trojan_Stealc_5D3F297C : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Stealc.yar#L52-L70"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Stealc.yar#L52-L70"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "885c8cd8f7ad93f0fd43ba4fb7f14d94dfdee3d223715da34a6e2fbb4d25b9f4"
-		logic_hash = "556d3bc9374a5ec23faa410900dfc94b5534434c9733165355d281976444a42b"
+		logic_hash = "v1_sha256_556d3bc9374a5ec23faa410900dfc94b5534434c9733165355d281976444a42b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90878,10 +91040,10 @@ rule ELASTIC_Linux_Cryptominer_Presenoker_3Bb5533D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Presenoker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Presenoker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bbc155c610c7aa439f98e32f97895d7eeaef06dab7cca05a5179b0eb3ba3cc00"
-		logic_hash = "13bf69ea6bc7df5ba9ebffe67234657f2ecab99e28fd76d0bbedceaf9706a4dd"
+		logic_hash = "v1_sha256_13bf69ea6bc7df5ba9ebffe67234657f2ecab99e28fd76d0bbedceaf9706a4dd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -90907,10 +91069,10 @@ rule ELASTIC_Windows_Hacktool_Sharpmove_05E28928 : FILE MEMORY
 		date = "2022-11-20"
 		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpMove.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpMove.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "051f60f9f4665b96f764810defe9525ae7b4f9898249b83a23094cee63fa0c3b"
-		logic_hash = "021a56dd47d9929e71b82b00d24aa8969a31945681dcf414c69b8d175fb0b6eb"
+		logic_hash = "v1_sha256_021a56dd47d9929e71b82b00d24aa8969a31945681dcf414c69b8d175fb0b6eb"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -90929,7 +91091,7 @@ rule ELASTIC_Windows_Hacktool_Sharpmove_05E28928 : FILE MEMORY
 		$print_str3 = "[+] Executing DCOM ExcelDDE   : {0}" ascii wide fullword
 
 	condition:
-		$guid or all of ($print_str*)
+		$guid or all of ( $print_str* )
 }
 rule ELASTIC_Windows_Vulndriver_Mtcbsv_7F6D642E : FILE
 {
@@ -90940,10 +91102,10 @@ rule ELASTIC_Windows_Vulndriver_Mtcbsv_7F6D642E : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_MtcBsv.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_MtcBsv.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ff803017d1acafde6149fe7d463aee23b1c4f6f3b97c698c05f3ca6f07e4df6c"
-		logic_hash = "dfd53a2b97ad722307561fc5f109dcba372bf600113786bb351ed1262fdc8556"
+		logic_hash = "v1_sha256_dfd53a2b97ad722307561fc5f109dcba372bf600113786bb351ed1262fdc8556"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -90960,7 +91122,7 @@ rule ELASTIC_Windows_Vulndriver_Mtcbsv_7F6D642E : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x14][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Macos_Trojan_Genieo_5E0F8980 : FILE MEMORY
 {
@@ -90971,10 +91133,10 @@ rule ELASTIC_Macos_Trojan_Genieo_5E0F8980 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Genieo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Genieo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6c698bac178892dfe03624905256a7d9abe468121163d7507cade48cf2131170"
-		logic_hash = "76b725f6ae5755bb00d384ef2ae1511789487257d8bb7cb61b893226f03a803e"
+		logic_hash = "v1_sha256_76b725f6ae5755bb00d384ef2ae1511789487257d8bb7cb61b893226f03a803e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91000,10 +91162,10 @@ rule ELASTIC_Macos_Trojan_Genieo_37878473 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Genieo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Genieo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0fadd926f8d763f7f15e64f857e77f44a492dcf5dc82ae965d3ddf80cd9c7a0d"
-		logic_hash = "bb04ae4e0a98e0dbd0c0708d5e767306e38edf76de2671523f4bd43cbcbfefc2"
+		logic_hash = "v1_sha256_bb04ae4e0a98e0dbd0c0708d5e767306e38edf76de2671523f4bd43cbcbfefc2"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -91029,10 +91191,10 @@ rule ELASTIC_Macos_Trojan_Genieo_0D003634 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Genieo.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Genieo.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bcd391b58338efec4769e876bd510d0c4b156a7830bab56c3b56585974435d70"
-		logic_hash = "0412f88408fb14d1126ef091d0a5cc0ee2b2e39aeb241bef55208b59830ca993"
+		logic_hash = "v1_sha256_0412f88408fb14d1126ef091d0a5cc0ee2b2e39aeb241bef55208b59830ca993"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -91058,10 +91220,10 @@ rule ELASTIC_Macos_Trojan_Genieo_9E178C0B : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Genieo.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Genieo.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b7760e73195c3ea8566f3ff0427d85d6f35c6eec7ee9184f3aceab06da8845d8"
-		logic_hash = "212f96ca964aceeb80c6d3282d488cfbb74aeffb9c0c9dd840a3a28f9bbdcbea"
+		logic_hash = "v1_sha256_212f96ca964aceeb80c6d3282d488cfbb74aeffb9c0c9dd840a3a28f9bbdcbea"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -91087,10 +91249,10 @@ rule ELASTIC_Windows_Trojan_Njrat_30F3C220 : FILE MEMORY
 		date = "2021-06-13"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Njrat.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Njrat.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b"
-		logic_hash = "76347165829415646f943bb984cd17ca138cf238d03f114c498dbcec081d5ae3"
+		logic_hash = "v1_sha256_76347165829415646f943bb984cd17ca138cf238d03f114c498dbcec081d5ae3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91121,10 +91283,10 @@ rule ELASTIC_Windows_Trojan_Njrat_Eb2698D2 : FILE MEMORY
 		date = "2023-05-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Njrat.yar#L26-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Njrat.yar#L26-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d537397bc41f0a1cb964fa7be6658add5fe58d929ac91500fc7770c116d49608"
-		logic_hash = "c32a641f2d639f56a8137b3e0d0be3261fba30084eeba9d1205974713413af9f"
+		logic_hash = "v1_sha256_c32a641f2d639f56a8137b3e0d0be3261fba30084eeba9d1205974713413af9f"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -91150,10 +91312,10 @@ rule ELASTIC_Windows_Trojan_Blackwood_2B94Bce9 : FILE MEMORY
 		date = "2024-03-22"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Blackwood.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Blackwood.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c37dd77f659059da7e12e13b063036ee69097a4d2f88c170832fff78f3788991"
-		logic_hash = "279e85ce3bb974ce5af541e7307cb2fd1031f36c9da013756883172a765b0e19"
+		logic_hash = "v1_sha256_279e85ce3bb974ce5af541e7307cb2fd1031f36c9da013756883172a765b0e19"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91175,7 +91337,7 @@ rule ELASTIC_Windows_Trojan_Blackwood_2B94Bce9 : FILE MEMORY
 		$b5 = "AllocateAndInitializeSid Error %u"
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		1 of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Macos_Virus_Vsearch_0Dd3Ec6F : FILE MEMORY
 {
@@ -91186,9 +91348,9 @@ rule ELASTIC_Macos_Virus_Vsearch_0Dd3Ec6F : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Virus_Vsearch.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "17a467b000117ea6c39fbd40b502ac9c7d59a97408c2cdfb09c65b2bb09924e5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Virus_Vsearch.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_17a467b000117ea6c39fbd40b502ac9c7d59a97408c2cdfb09c65b2bb09924e5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91214,9 +91376,9 @@ rule ELASTIC_Macos_Virus_Vsearch_2A0419F8 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Virus_Vsearch.yar#L20-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "fa9b811465e435bff5bc0f149ff65f57932c94f548a5ece4ec54ba775cdbb55a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Virus_Vsearch.yar#L20-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_fa9b811465e435bff5bc0f149ff65f57932c94f548a5ece4ec54ba775cdbb55a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91242,10 +91404,10 @@ rule ELASTIC_Windows_Wiper_Doublezero_65Ec0C50 : FILE MEMORY
 		date = "2022-03-22"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Wiper_DoubleZero.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Wiper_DoubleZero.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe"
-		logic_hash = "bce33817d99f71b9d087ea079ef8db08b496315b72cf9d1cf6f0b107a604e52c"
+		logic_hash = "v1_sha256_bce33817d99f71b9d087ea079ef8db08b496315b72cf9d1cf6f0b107a604e52c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91275,9 +91437,9 @@ rule ELASTIC_Linux_Trojan_Ladvix_Db41F9D2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ladvix.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "81642b4ff1b6488098f019c5e992fc942916bc6eb593006cf91e878ac41509d6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ladvix.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_81642b4ff1b6488098f019c5e992fc942916bc6eb593006cf91e878ac41509d6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91303,10 +91465,10 @@ rule ELASTIC_Linux_Trojan_Ladvix_77D184Fd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ladvix.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ladvix.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1bb44b567b3c82f7ee0e08b16f7326d1af57efe77d608a96b2df43aab5faa9f7"
-		logic_hash = "0ae9c41d3eb7964344f71b9708278a0e83776228e4455cf0ad7c08e288305203"
+		logic_hash = "v1_sha256_0ae9c41d3eb7964344f71b9708278a0e83776228e4455cf0ad7c08e288305203"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91332,10 +91494,10 @@ rule ELASTIC_Linux_Trojan_Ladvix_C9888Edb : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ladvix.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ladvix.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1d798e9f15645de89d73e2c9d142189d2eaf81f94ecf247876b0b865be081dca"
-		logic_hash = "608f2340b0ee4b843933d8137aa0908583a6de477e6c472fb4bd2e5bb62dfb80"
+		logic_hash = "v1_sha256_608f2340b0ee4b843933d8137aa0908583a6de477e6c472fb4bd2e5bb62dfb80"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91361,9 +91523,9 @@ rule ELASTIC_Linux_Trojan_Ladvix_81Fccd74 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "2a183f613fca5ec30dfd82c9abf72ab88a2c57d2dd6f6483375913f81aa1c5af"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ladvix.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "18f7ca953d22f02c1dbf03595a19b66ea582d2c1623f0042dcf15f86556ca41e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ladvix.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_18f7ca953d22f02c1dbf03595a19b66ea582d2c1623f0042dcf15f86556ca41e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91389,9 +91551,9 @@ rule ELASTIC_Windows_Trojan_Backoff_22798F00 : FILE MEMORY
 		date = "2022-08-10"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Backoff.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "65b5aff18a4e0bc29d7cc4cfbe2d5882f99a855727fe467b2ba2e2851c43d21b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Backoff.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_65b5aff18a4e0bc29d7cc4cfbe2d5882f99a855727fe467b2ba2e2851c43d21b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91422,10 +91584,10 @@ rule ELASTIC_Windows_Vulndriver_Gvci_F5A35359 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Gvci.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Gvci.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f"
-		logic_hash = "beb0c324358a016e708dae30a222373113a7eab8e3d90dfa1bbde6c2f7874362"
+		logic_hash = "v1_sha256_beb0c324358a016e708dae30a222373113a7eab8e3d90dfa1bbde6c2f7874362"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -91440,7 +91602,7 @@ rule ELASTIC_Windows_Vulndriver_Gvci_F5A35359 : FILE
 		$str1 = "\\GVCIDrv64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Trojan_Psybnc_563Ecb11 : FILE MEMORY
 {
@@ -91451,10 +91613,10 @@ rule ELASTIC_Linux_Trojan_Psybnc_563Ecb11 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Psybnc.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Psybnc.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f77216b169e8d12f22ef84e625159f3a51346c2b6777a1fcfb71268d17b06d39"
-		logic_hash = "b93e6ab097ccd4c348d228a48df098594e560e62256bfe019669ca9488221214"
+		logic_hash = "v1_sha256_b93e6ab097ccd4c348d228a48df098594e560e62256bfe019669ca9488221214"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91480,10 +91642,10 @@ rule ELASTIC_Linux_Trojan_Psybnc_Ab3396D5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Psybnc.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Psybnc.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c5ec84e7cc891af25d6319abb07b1cedd90b04cbb6c8656c60bcb07e60f0b620"
-		logic_hash = "8c083f66fc252a88395bb954a67d710d64f5b68efb9df4b60b260302874b400a"
+		logic_hash = "v1_sha256_8c083f66fc252a88395bb954a67d710d64f5b68efb9df4b60b260302874b400a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91509,10 +91671,10 @@ rule ELASTIC_Linux_Trojan_Psybnc_F07357F1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Psybnc.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Psybnc.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f77216b169e8d12f22ef84e625159f3a51346c2b6777a1fcfb71268d17b06d39"
-		logic_hash = "cfe217fe108de787600d1ef06ac6738d84aedfc46e5632143692a9f83cb62df7"
+		logic_hash = "v1_sha256_cfe217fe108de787600d1ef06ac6738d84aedfc46e5632143692a9f83cb62df7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91538,10 +91700,10 @@ rule ELASTIC_Linux_Exploit_Alie_E69De1Ee : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Alie.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Alie.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "882839549f062ab4cbe6df91336ed320eaf6c2300fc2ed64d1877426a0da567d"
-		logic_hash = "bb4625751c924b9ff5d32cc044fcff68892e82d9e94d679c4e4c8286f680a854"
+		logic_hash = "v1_sha256_bb4625751c924b9ff5d32cc044fcff68892e82d9e94d679c4e4c8286f680a854"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91567,10 +91729,10 @@ rule ELASTIC_Linux_Trojan_Springtail_35D5B90B : FILE MEMORY
 		date = "2024-05-18"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Springtail.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Springtail.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213"
-		logic_hash = "7158e60aedfde884d9ee01457abfe6d9b6b1df9cdc1c415231d98429866eaa6c"
+		logic_hash = "v1_sha256_7158e60aedfde884d9ee01457abfe6d9b6b1df9cdc1c415231d98429866eaa6c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91601,11 +91763,11 @@ rule ELASTIC_Windows_Trojan_Solarmarker_D466E548 : FILE MEMORY
 		date = "2023-12-12"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SolarMarker.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SolarMarker.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "330f5067c93041821be4e7097cf32fb569e2e1d00e952156c9aafcddb847b873"
 		hash = "e2a620e76352fa7ac58407a711821da52093d97d12293ae93d813163c58eb84b"
-		logic_hash = "c0792bc3c1a2f01ff4b8d0a12c95a74491c2805c876f95a26bbeaabecdff70e9"
+		logic_hash = "v1_sha256_c0792bc3c1a2f01ff4b8d0a12c95a74491c2805c876f95a26bbeaabecdff70e9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91631,10 +91793,10 @@ rule ELASTIC_Windows_Trojan_Solarmarker_08Bfc26B : FILE MEMORY
 		date = "2024-05-29"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SolarMarker.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SolarMarker.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c1a6d2d78cc50f080f1fe4cadc6043027bf201d194f2b73625ce3664433a3966"
-		logic_hash = "b31b9f8460b606426c1101eba39a41a75c7ecaafc62388a6a5ac0f24057561ed"
+		logic_hash = "v1_sha256_b31b9f8460b606426c1101eba39a41a75c7ecaafc62388a6a5ac0f24057561ed"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91662,10 +91824,10 @@ rule ELASTIC_Windows_Trojan_Nighthawk_9F3A5Abb : FILE MEMORY
 		date = "2022-11-24"
 		modified = "2023-06-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Nighthawk.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Nighthawk.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b775a8f7629966592cc7727e2081924a7d7cf83edd7447aa60627a2b67d87c94"
-		logic_hash = "27a34e48141fe260c16c12a2652e440d2540ca5f0c84b41c9c4762dcab44ffd4"
+		logic_hash = "v1_sha256_27a34e48141fe260c16c12a2652e440d2540ca5f0c84b41c9c4762dcab44ffd4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91687,7 +91849,7 @@ rule ELASTIC_Windows_Trojan_Nighthawk_9F3A5Abb : FILE MEMORY
 		$seq_byte_shift = { 48 83 C3 ?? 8D 4D ?? 48 03 CF 0F B6 41 ?? 0F B6 71 ?? C1 E6 08 0B F0 0F B6 41 ?? C1 E6 08 0B F0 0F B6 01 C1 E6 ?? 0B F0 41 3B 75 ?? 76 ?? B8 ?? ?? ?? ?? EB ?? }
 
 	condition:
-		($loader_build_iat0 and $loader_syscall_func) or (2 of ($seq*))
+		($loader_build_iat0 and $loader_syscall_func ) or ( 2 of ( $seq* ) )
 }
 rule ELASTIC_Windows_Trojan_Nighthawk_2A2E3B9D : FILE MEMORY
 {
@@ -91698,10 +91860,10 @@ rule ELASTIC_Windows_Trojan_Nighthawk_2A2E3B9D : FILE MEMORY
 		date = "2022-11-24"
 		modified = "2023-06-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Nighthawk.yar#L28-L47"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Nighthawk.yar#L28-L47"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "38881b87826f184cc91559555a3456ecf00128e01986a9df36a72d60fb179ccf"
-		logic_hash = "c42605ebba900fafb4ec2d34d93bb7adb69e731ce151b82a95889dd0d738da00"
+		logic_hash = "v1_sha256_c42605ebba900fafb4ec2d34d93bb7adb69e731ce151b82a95889dd0d738da00"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91728,10 +91890,10 @@ rule ELASTIC_Windows_Trojan_Nighthawk_23489175 : FILE MEMORY
 		date = "2023-06-14"
 		modified = "2023-07-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Nighthawk.yar#L49-L74"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Nighthawk.yar#L49-L74"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "697742d5dd071add40b700022fd30424cb231ffde223d21bd83a44890e06762f"
-		logic_hash = "be41fc53f7098ca3cf718e8066a488196423ede993466c9a24ad2af387e03b24"
+		logic_hash = "v1_sha256_be41fc53f7098ca3cf718e8066a488196423ede993466c9a24ad2af387e03b24"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91753,7 +91915,7 @@ rule ELASTIC_Windows_Trojan_Nighthawk_23489175 : FILE MEMORY
 		$seq_tcptable = { 41 BF 02 00 00 00 41 3B FF 74 ?? 83 FF 17 41 8B C7 75 ?? B8 08 00 00 00 }
 
 	condition:
-		(1 of ($pdb)) or (2 of ($seq*))
+		(1 of ( $pdb ) ) or ( 2 of ( $seq* ) )
 }
 rule ELASTIC_Windows_Infostealer_Phemedronestealer_Bed8Ea8A : FILE MEMORY
 {
@@ -91764,10 +91926,10 @@ rule ELASTIC_Windows_Infostealer_Phemedronestealer_Bed8Ea8A : FILE MEMORY
 		date = "2024-03-21"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Infostealer_PhemedroneStealer.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Infostealer_PhemedroneStealer.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "38279fdad25c7972be9426cadb5ad5e3ee7e9761b0a41ed617945cb9a3713702"
-		logic_hash = "88fc33abfe6c7a611aa0c354645b06e9e74121ffc9a5acd20b4d3a59287489d6"
+		logic_hash = "v1_sha256_88fc33abfe6c7a611aa0c354645b06e9e74121ffc9a5acd20b4d3a59287489d6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91793,7 +91955,7 @@ rule ELASTIC_Windows_Infostealer_Phemedronestealer_Bed8Ea8A : FILE MEMORY
 		$b6 = "Phemedrone Stealer Report"
 
 	condition:
-		all of ($a*) or all of ($b*)
+		all of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Bitpaymer_D74273B3 : BETA FILE MEMORY
 {
@@ -91804,9 +91966,9 @@ rule ELASTIC_Windows_Ransomware_Bitpaymer_D74273B3 : BETA FILE MEMORY
 		date = "2020-06-25"
 		modified = "2021-08-23"
 		reference = "https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Bitpaymer.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "126246689b28e92ed10bfa6165f06ff7d4f0e062de7c58b821eaaf5e3cae9306"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Bitpaymer.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_126246689b28e92ed10bfa6165f06ff7d4f0e062de7c58b821eaaf5e3cae9306"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -91822,7 +91984,7 @@ rule ELASTIC_Windows_Ransomware_Bitpaymer_D74273B3 : BETA FILE MEMORY
 		$b1 = { 24 E8 00 00 00 29 F0 19 F9 89 8C 24 88 00 00 00 89 84 24 84 00 }
 
 	condition:
-		1 of ($b*)
+		1 of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Bitpaymer_Bca25Ac6 : BETA FILE MEMORY
 {
@@ -91833,9 +91995,9 @@ rule ELASTIC_Windows_Ransomware_Bitpaymer_Bca25Ac6 : BETA FILE MEMORY
 		date = "2020-06-25"
 		modified = "2021-08-23"
 		reference = "https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Bitpaymer.yar#L22-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7670f9dafacc8fc5998c1974af66ede388c0997545da067648fec4fd053f0001"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Bitpaymer.yar#L22-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7670f9dafacc8fc5998c1974af66ede388c0997545da067648fec4fd053f0001"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -91858,7 +92020,7 @@ rule ELASTIC_Windows_Ransomware_Bitpaymer_Bca25Ac6 : BETA FILE MEMORY
 		$a8 = "k:\\softcare\\release\\h2O.pdb" fullword
 
 	condition:
-		1 of ($a*)
+		1 of ( $a* )
 }
 rule ELASTIC_Macos_Infostealer_Mdquerytoken_1C52D574 : FILE MEMORY
 {
@@ -91869,9 +92031,9 @@ rule ELASTIC_Macos_Infostealer_Mdquerytoken_1C52D574 : FILE MEMORY
 		date = "2023-04-11"
 		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Infostealer_MdQueryToken.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "ede29154aae99bb67075e21acb694b089f9a1b366a4e2505cb761142393994a8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Infostealer_MdQueryToken.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_ede29154aae99bb67075e21acb694b089f9a1b366a4e2505cb761142393994a8"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -91887,7 +92049,7 @@ rule ELASTIC_Macos_Infostealer_Mdquerytoken_1C52D574 : FILE MEMORY
 		$string2 = /kMDItemDisplayName\s{1,50}==\s{1,50}\S{1,50}token\S{1,50}/ ascii wide nocase
 
 	condition:
-		any of ($string1,$string2)
+		any of ( $string1 , $string2 )
 }
 rule ELASTIC_Macos_Virus_Pirrit_271B8Ed0 : FILE MEMORY
 {
@@ -91898,10 +92060,10 @@ rule ELASTIC_Macos_Virus_Pirrit_271B8Ed0 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Virus_Pirrit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Virus_Pirrit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7feda05d41b09c06a08c167c7f4dde597ac775c54bf0d74a82aa533644035177"
-		logic_hash = "cb77f6df1403afbc7f45d30551559b6de7eb1c3434778b46d31754da0a1b1f10"
+		logic_hash = "v1_sha256_cb77f6df1403afbc7f45d30551559b6de7eb1c3434778b46d31754da0a1b1f10"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91927,10 +92089,10 @@ rule ELASTIC_Windows_Hacktool_Sharpchromium_41Ce5080 : FILE MEMORY
 		date = "2022-11-20"
 		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpChromium.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpChromium.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9dd65aa53728d51f0f3b9aaf51a24f8a2c3f84b4a4024245575975cf9ad7f2e5"
-		logic_hash = "50972a6e6af1d7076243320fb6559193e0c46ac1300aa62d12390fdeb2fffdcd"
+		logic_hash = "v1_sha256_50972a6e6af1d7076243320fb6559193e0c46ac1300aa62d12390fdeb2fffdcd"
 		score = 75
 		quality = 48
 		tags = "FILE, MEMORY"
@@ -91949,7 +92111,7 @@ rule ELASTIC_Windows_Hacktool_Sharpchromium_41Ce5080 : FILE MEMORY
 		$print_str3 = "[*] {0} {1} extraction." ascii wide fullword
 
 	condition:
-		$guid or all of ($print_str*)
+		$guid or all of ( $print_str* )
 }
 rule ELASTIC_Windows_Trojan_Pingpull_09Dd9559 : FILE MEMORY
 {
@@ -91960,10 +92122,10 @@ rule ELASTIC_Windows_Trojan_Pingpull_09Dd9559 : FILE MEMORY
 		date = "2022-06-16"
 		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Pingpull.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Pingpull.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "de14f22c88e552b61c62ab28d27a617fb8c0737350ca7c631de5680850282761"
-		logic_hash = "114674b1a9acfc7643138d3b07885343a50c9d319b8d22a6ef34e916685c4469"
+		logic_hash = "v1_sha256_114674b1a9acfc7643138d3b07885343a50c9d319b8d22a6ef34e916685c4469"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -91995,10 +92157,10 @@ rule ELASTIC_Windows_Trojan_Privateloader_96Ac2734 : FILE MEMORY
 		date = "2023-01-03"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PrivateLoader.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PrivateLoader.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "077225467638a420cf29fb9b3f0241416dcb9ed5d4ba32fdcf2bf28f095740bb"
-		logic_hash = "9f96f1c54853866e124d0996504e6efd3d154111390617999cc10520d7f68fe6"
+		logic_hash = "v1_sha256_9f96f1c54853866e124d0996504e6efd3d154111390617999cc10520d7f68fe6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92016,7 +92178,7 @@ rule ELASTIC_Windows_Trojan_Privateloader_96Ac2734 : FILE MEMORY
 		$str2 = "https://db-ip.com/" wide
 
 	condition:
-		all of ($str*) and #xor_decrypt>3
+		all of ( $str* ) and #xor_decrypt > 3
 }
 rule ELASTIC_Linux_Virus_Thebe_1Eb5985A : FILE MEMORY
 {
@@ -92027,10 +92189,10 @@ rule ELASTIC_Linux_Virus_Thebe_1Eb5985A : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Virus_Thebe.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Virus_Thebe.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "30af289be070f4e0f8761f04fb44193a037ec1aab9cc029343a1a1f2a8d67670"
-		logic_hash = "7d4bc4b1615048dec1f1fac599afa667e06ccb369bb1242b25887e0ce2a5066a"
+		logic_hash = "v1_sha256_7d4bc4b1615048dec1f1fac599afa667e06ccb369bb1242b25887e0ce2a5066a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92056,10 +92218,10 @@ rule ELASTIC_Windows_Trojan_Onlylogger_B9E88336 : FILE MEMORY
 		date = "2022-03-22"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_OnlyLogger.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_OnlyLogger.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "69876ee4d89ba68ee86f1a4eaf0a7cb51a012752e14c952a177cd5ffd8190986"
-		logic_hash = "b8d1c4c1e33fc0b54a62f82b8f53c9a1b051ad8c2f578d2a43f504158d1d9247"
+		logic_hash = "v1_sha256_b8d1c4c1e33fc0b54a62f82b8f53c9a1b051ad8c2f578d2a43f504158d1d9247"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92077,7 +92239,7 @@ rule ELASTIC_Windows_Trojan_Onlylogger_B9E88336 : FILE MEMORY
 		$b3 = "WinHttpSendRequest" ascii fullword
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		1 of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Onlylogger_Ec14D5F2 : FILE MEMORY
 {
@@ -92088,10 +92250,10 @@ rule ELASTIC_Windows_Trojan_Onlylogger_Ec14D5F2 : FILE MEMORY
 		date = "2022-03-22"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_OnlyLogger.yar#L24-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_OnlyLogger.yar#L24-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f45adcc2aad5c0fd900df4521f404bc9ca71b01e3378a5490f5ae2f0c711912e"
-		logic_hash = "2838851a5e013705b64625801d2ab1d56cfc17c52f75a5fd71448cb0a4b4b683"
+		logic_hash = "v1_sha256_2838851a5e013705b64625801d2ab1d56cfc17c52f75a5fd71448cb0a4b4b683"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92121,10 +92283,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_01365E46 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5c450d4be39caef1d9ec943f5dfeb6517047175fec166a52970c08cd1558e172"
-		logic_hash = "4d61de2cb37e12f62326c1717f6ed44554f5d2aa7ede6033d0c988e5e64df54d"
+		logic_hash = "v1_sha256_4d61de2cb37e12f62326c1717f6ed44554f5d2aa7ede6033d0c988e5e64df54d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92150,9 +92312,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_06Fd4Ac4 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "bde387f1e22d1399fb99f6d41732a37635d8e90f29626f2995914a073a7cac89"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_bde387f1e22d1399fb99f6d41732a37635d8e90f29626f2995914a073a7cac89"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92179,9 +92341,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_Ce4305D1 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L41-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "c547114475383e5d84f6b8cb72585ddd5778ae3afa491deddeef8a5ec56be1b5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L41-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_c547114475383e5d84f6b8cb72585ddd5778ae3afa491deddeef8a5ec56be1b5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92207,9 +92369,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_1E56Fad7 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L60-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "815b37804f79fb4607e6b84294882d818233c3df13aececb3d341244900a2e44"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L60-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_815b37804f79fb4607e6b84294882d818233c3df13aececb3d341244900a2e44"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92235,9 +92397,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_93C9A2A4 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L79-L96"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "dadeeba6147b118b80e014ab067eac7a2c3c2990958a6c7016562d8b64fef53c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L79-L96"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_dadeeba6147b118b80e014ab067eac7a2c3c2990958a6c7016562d8b64fef53c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92263,9 +92425,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_5340Afa3 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L98-L115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8b9d3c978f0c4a04ee5b3446b990172206b17496036bc1cc04180ea7e9b99734"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L98-L115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8b9d3c978f0c4a04ee5b3446b990172206b17496036bc1cc04180ea7e9b99734"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92291,9 +92453,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_E7932501 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L117-L134"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "f82704a408a0cf1def2a5926dc4c02fa56afea1422c88ba41af50d44c60edb07"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L117-L134"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_f82704a408a0cf1def2a5926dc4c02fa56afea1422c88ba41af50d44c60edb07"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92319,9 +92481,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_Cd0868D5 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L136-L153"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "053a99e5e722fd2aa1cae96266cc344954f9c3a12d0851fa9d5e95a6420651f4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L136-L153"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_053a99e5e722fd2aa1cae96266cc344954f9c3a12d0851fa9d5e95a6420651f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92347,9 +92509,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_515504E2 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L155-L172"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "5410068e09de4a1283f98f6364ddf243373e228ba060b00699db6323f1167684"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L155-L172"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_5410068e09de4a1283f98f6364ddf243373e228ba060b00699db6323f1167684"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92375,9 +92537,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_A0Fc8F35 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L174-L191"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7ab2b45ddfc1d7fa409a6ea3dfd8d4940e1bdf3fc0cb6c7e8d49c60e7bda5b1b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L174-L191"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7ab2b45ddfc1d7fa409a6ea3dfd8d4940e1bdf3fc0cb6c7e8d49c60e7bda5b1b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92403,9 +92565,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_Cb95Dc06 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L193-L210"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "563b2311d37ace2d09601a70325352db3fcbf135e7ce518965f5410081b5d626"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L193-L210"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_563b2311d37ace2d09601a70325352db3fcbf135e7ce518965f5410081b5d626"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92431,9 +92593,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_9D4D3Fa4 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L212-L229"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7c3c9917a95248fd990b6947a0304ded473bf1bcceec8f4498a7955e879d348b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L212-L229"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7c3c9917a95248fd990b6947a0304ded473bf1bcceec8f4498a7955e879d348b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92459,9 +92621,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_34F00046 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L231-L248"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "f9d646645d6726e3aac5cc3eaea9edf1c89c7e743aff7cfa73998a72f3446711"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L231-L248"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_f9d646645d6726e3aac5cc3eaea9edf1c89c7e743aff7cfa73998a72f3446711"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92487,9 +92649,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_F2A18B09 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L250-L267"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "c4c4b0b1df1e8fde87284fb27d46e917c47b479a675fec60faeca6185511907d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L250-L267"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_c4c4b0b1df1e8fde87284fb27d46e917c47b479a675fec60faeca6185511907d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92515,9 +92677,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_D916Ae65 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L269-L286"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e0aafe498cd9f0e8addfef78027943a754ca797aafae0cb40f1c6425de501339"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L269-L286"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e0aafe498cd9f0e8addfef78027943a754ca797aafae0cb40f1c6425de501339"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92543,9 +92705,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_52722678 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L288-L305"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "6340171fdde68b32de480f1f410aa4c491a8fffa7c1f699bf5fa72a12ecb77b8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L288-L305"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_6340171fdde68b32de480f1f410aa4c491a8fffa7c1f699bf5fa72a12ecb77b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92571,9 +92733,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_28A60148 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L307-L324"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "20a26ed3f0da3a77867597494bf0069a2093ec19b1c5e179c0e7934c1b69d4b9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L307-L324"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_20a26ed3f0da3a77867597494bf0069a2093ec19b1c5e179c0e7934c1b69d4b9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92599,9 +92761,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_997B25A0 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L326-L343"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "ca688086c4628c64c32a99083d620bcb5373e3100d154331451a3e9f86081aca"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L326-L343"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_ca688086c4628c64c32a99083d620bcb5373e3100d154331451a3e9f86081aca"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92627,9 +92789,9 @@ rule ELASTIC_Windows_Trojan_Trickbot_B17B33A1 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L345-L362"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7fa69674d1e985bafe310597f23ae80113136768141f0a1931baf88b2509e6ef"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L345-L362"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7fa69674d1e985bafe310597f23ae80113136768141f0a1931baf88b2509e6ef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92655,10 +92817,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_23D77Ae5 : FILE MEMORY
 		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L364-L396"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L364-L396"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "844974a2d3266e1f9ba275520c0e8a5d176df69a0ccd5135b99facf798a5d209"
-		logic_hash = "e5f5cf854ebd0e25fffbd6796217f22223a06937e1cacb33baa105ac41731256"
+		logic_hash = "v1_sha256_e5f5cf854ebd0e25fffbd6796217f22223a06937e1cacb33baa105ac41731256"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92687,7 +92849,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_23D77Ae5 : FILE MEMORY
 		$a14 = "/chrome.exe {URL}" ascii fullword
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_5574Be7D : FILE MEMORY
 {
@@ -92698,10 +92860,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_5574Be7D : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L398-L432"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L398-L432"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8c5c0d27153f60ef8aec57def2f88e3d5f9a7385b5e8b8177bab55fa7fac7b18"
-		logic_hash = "ed0fc98c5d628ce38b923e1410eaf7a4a65ecffea42bed35314e30c99a52219b"
+		logic_hash = "v1_sha256_ed0fc98c5d628ce38b923e1410eaf7a4a65ecffea42bed35314e30c99a52219b"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -92732,7 +92894,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_5574Be7D : FILE MEMORY
 		$a16 = "<autoconf>" ascii fullword
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_1473F0B4 : FILE MEMORY
 {
@@ -92743,10 +92905,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_1473F0B4 : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L434-L459"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L434-L459"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9cfb441eb5c60ab1c90b58d4878543ee554ada2cceee98d6b867e73490d30fec"
-		logic_hash = "dc13625e58c029c60b8670f8e63cd7786bf3e9705c462f3cbbf5b39e7c02f9a1"
+		logic_hash = "v1_sha256_dc13625e58c029c60b8670f8e63cd7786bf3e9705c462f3cbbf5b39e7c02f9a1"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -92768,7 +92930,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_1473F0B4 : FILE MEMORY
 		$a7 = "Content-Length: %d" ascii fullword
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_Dcf25Dde : FILE MEMORY
 {
@@ -92779,10 +92941,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_Dcf25Dde : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L461-L502"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L461-L502"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ba2a255671d33677cab8d93531eb25c0b1f1ac3e3085b95365a017463662d787"
-		logic_hash = "64d15d92faf0919a8fa1ce6772750cde47eaa24b09cf4243393777334bad9712"
+		logic_hash = "v1_sha256_64d15d92faf0919a8fa1ce6772750cde47eaa24b09cf4243393777334bad9712"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -92820,7 +92982,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_Dcf25Dde : FILE MEMORY
 		$a23 = "Admin E-mail: %s" wide fullword
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_46Dc12Dd : FILE MEMORY
 {
@@ -92831,10 +92993,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_46Dc12Dd : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L504-L528"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L504-L528"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bf38a787aee5afdcab00b95ccdf036bc7f91f07151b4444b54165bb70d649ce5"
-		logic_hash = "e01209a83f4743cbad7dda01595c053277868bd47208e48214b557ae339b5b3c"
+		logic_hash = "v1_sha256_e01209a83f4743cbad7dda01595c053277868bd47208e48214b557ae339b5b3c"
 		score = 50
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92855,7 +93017,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_46Dc12Dd : FILE MEMORY
 		$a6 = "</addr>" ascii fullword
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_78A26074 : FILE MEMORY
 {
@@ -92866,10 +93028,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_78A26074 : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L530-L564"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L530-L564"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8cd75fa8650ebcf0a6200283e474a081cc0be57307e54909ee15f4d04621dde0"
-		logic_hash = "3837c22f7f9d55f03cb0bc1336798f0e2a91549c187b9f5136491cbafd26ce6e"
+		logic_hash = "v1_sha256_3837c22f7f9d55f03cb0bc1336798f0e2a91549c187b9f5136491cbafd26ce6e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92900,7 +93062,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_78A26074 : FILE MEMORY
 		$a16 = "TERM found: %d" wide fullword
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_217B9C97 : FILE MEMORY
 {
@@ -92911,10 +93073,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_217B9C97 : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L566-L601"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L566-L601"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1e90a73793017720c9a020069ed1c87879174c19c3b619e5b78db8220a63e9b7"
-		logic_hash = "9b2b8a8154d4aba06029fd35d896331449f7baa961f183fb0cb47e890610ff99"
+		logic_hash = "v1_sha256_9b2b8a8154d4aba06029fd35d896331449f7baa961f183fb0cb47e890610ff99"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -92946,7 +93108,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_217B9C97 : FILE MEMORY
 		$a17 = "Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2" wide fullword
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_D2110921 : FILE MEMORY
 {
@@ -92957,10 +93119,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_D2110921 : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L603-L632"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L603-L632"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "05ef40f7745db836de735ac73d6101406e1d9e58c6b5f5322254eb75b98d236a"
-		logic_hash = "39ef17836f29c358f596e0047d582b5f1d1af523c8f6354ac8a783eda9969554"
+		logic_hash = "v1_sha256_39ef17836f29c358f596e0047d582b5f1d1af523c8f6354ac8a783eda9969554"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -92986,7 +93148,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_D2110921 : FILE MEMORY
 		$a11 = "ServiceInfoControl" ascii fullword
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_0114D469 : FILE MEMORY
 {
@@ -92997,10 +93159,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_0114D469 : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L634-L667"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L634-L667"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "083cb35a7064aa5589efc544ac1ed1b04ec0f89f0e60383fcb1b02b63f4117e9"
-		logic_hash = "6ca8e73f758d3fa956fe53cc83abb43806359f93df05c42a58e2f394a1a3c117"
+		logic_hash = "v1_sha256_6ca8e73f758d3fa956fe53cc83abb43806359f93df05c42a58e2f394a1a3c117"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93030,7 +93192,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_0114D469 : FILE MEMORY
 		$a15 = "SELECT * FROM Win32_ComputerSystem" wide fullword
 
 	condition:
-		6 of ($a*)
+		6 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_07239Dad : FILE MEMORY
 {
@@ -93041,10 +93203,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_07239Dad : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L669-L703"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L669-L703"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dbd534f2b5739f89e99782563062169289f23aa335639a9552173bedc98bb834"
-		logic_hash = "231592d1a45798de6d22c922626ca28ef4019bae95d552a0f2822823d8dec384"
+		logic_hash = "v1_sha256_231592d1a45798de6d22c922626ca28ef4019bae95d552a0f2822823d8dec384"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93075,7 +93237,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_07239Dad : FILE MEMORY
 		$a16 = "NetServerStart" ascii fullword
 
 	condition:
-		6 of ($a*)
+		6 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_Fd7A39Af : FILE MEMORY
 {
@@ -93086,10 +93248,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_Fd7A39Af : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L705-L739"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L705-L739"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d5bb8d94b71d475b5eb9bb4235a428563f4104ea49f11ef02c8a08d2e859fd68"
-		logic_hash = "15cb286504e6167c78e194488555f565965a03e7714fe16692a115df26985a01"
+		logic_hash = "v1_sha256_15cb286504e6167c78e194488555f565965a03e7714fe16692a115df26985a01"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -93120,7 +93282,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_Fd7A39Af : FILE MEMORY
 		$a16 = "------MACHINE IN D-N------" wide fullword
 
 	condition:
-		5 of ($a*)
+		5 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_2D89E9Cd : FILE MEMORY
 {
@@ -93131,10 +93293,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_2D89E9Cd : FILE MEMORY
 		date = "2021-03-29"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L741-L785"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L741-L785"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3963649ebfabe8f6277190be4300ecdb68d4b497ac5f81f38231d3e6c862a0a8"
-		logic_hash = "c15833687c2aed55aae0bb5de83c088cb66edeb4ad1964543522f5477c1f1942"
+		logic_hash = "v1_sha256_c15833687c2aed55aae0bb5de83c088cb66edeb4ad1964543522f5477c1f1942"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -93175,7 +93337,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_2D89E9Cd : FILE MEMORY
 		$a26 = "Enter to Control: moduleHandle 0x%08X, unknown Ctl = \"%S\"" wide fullword
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_32930807 : FILE MEMORY
 {
@@ -93186,10 +93348,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_32930807 : FILE MEMORY
 		date = "2021-03-30"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L787-L808"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L787-L808"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e999b83629355ec7ff3b6fda465ef53ce6992c9327344fbf124f7eb37808389d"
-		logic_hash = "e98503696bd72cab4d0d1633991bdb87c0537fd1e2d95507ccd474125328f318"
+		logic_hash = "v1_sha256_e98503696bd72cab4d0d1633991bdb87c0537fd1e2d95507ccd474125328f318"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93218,10 +93380,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_618B27D2 : FILE MEMORY
 		date = "2021-03-30"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L810-L843"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L810-L843"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d3ec8f4a46b21fb189fc3d58f3d87bf9897653ecdf90b7952dcc71f3b4023b4e"
-		logic_hash = "e66a9dd7efdbff8b9e30119d0e99187e3dfa4ca1c1bc1ade0f8f1003d10e2620"
+		logic_hash = "v1_sha256_e66a9dd7efdbff8b9e30119d0e99187e3dfa4ca1c1bc1ade0f8f1003d10e2620"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93251,7 +93413,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_618B27D2 : FILE MEMORY
 		$a15 = "CryptApi" ascii fullword
 
 	condition:
-		5 of ($a*)
+		5 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_6Eb31E7B : FILE MEMORY
 {
@@ -93262,10 +93424,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_6Eb31E7B : FILE MEMORY
 		date = "2021-03-30"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L845-L872"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L845-L872"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3e3d82ea4764b117b71119e7c2eecf46b7c2126617eafccdfc6e96e13da973b1"
-		logic_hash = "5b6902c8644c79bd183725f0e41bf2f7ae425bf0eb1dddea6fd1a38b77f176ba"
+		logic_hash = "v1_sha256_5b6902c8644c79bd183725f0e41bf2f7ae425bf0eb1dddea6fd1a38b77f176ba"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93289,7 +93451,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_6Eb31E7B : FILE MEMORY
 		$a9 = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" wide fullword
 
 	condition:
-		5 of ($a*)
+		5 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_91516Cf4 : FILE MEMORY
 {
@@ -93300,10 +93462,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_91516Cf4 : FILE MEMORY
 		date = "2021-03-30"
 		modified = "2021-08-31"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L874-L896"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L874-L896"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6cd0d4666553fd7184895502d48c960294307d57be722ebb2188b004fc1a8066"
-		logic_hash = "6c0bdd6827bebb337c0012cdb6e931cd96ce2ad61f3764f288b96ff049b2d007"
+		logic_hash = "v1_sha256_6c0bdd6827bebb337c0012cdb6e931cd96ce2ad61f3764f288b96ff049b2d007"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93333,10 +93495,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_Be718Af9 : FILE MEMORY
 		date = "2021-03-30"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L898-L921"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L898-L921"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c1f1bc58456cff7413d7234e348d47a8acfdc9d019ae7a4aba1afc1b3ed55ffa"
-		logic_hash = "d020f7d1637fc4ee3246e97c9acae0be1782e688154bd109f53f807211beebd7"
+		logic_hash = "v1_sha256_d020f7d1637fc4ee3246e97c9acae0be1782e688154bd109f53f807211beebd7"
 		score = 75
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -93356,7 +93518,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_Be718Af9 : FILE MEMORY
 		$a5 = "\"%pueuu%" ascii fullword
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_F8Dac4Bc : FILE MEMORY
 {
@@ -93367,10 +93529,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_F8Dac4Bc : FILE MEMORY
 		date = "2021-03-30"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L923-L954"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L923-L954"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "13d102d546b9384f944f2a520ba32fb5606182bed45a8bba681e4374d7e5e322"
-		logic_hash = "d4536aac0ee402abcb87826e45c892d6f39562bc1e39b72ae8880dc077f230d9"
+		logic_hash = "v1_sha256_d4536aac0ee402abcb87826e45c892d6f39562bc1e39b72ae8880dc077f230d9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93398,7 +93560,7 @@ rule ELASTIC_Windows_Trojan_Trickbot_F8Dac4Bc : FILE MEMORY
 		$a13 = "rdp/mode" wide fullword
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Trickbot_9C0Fa8Fe : FILE MEMORY
 {
@@ -93409,10 +93571,10 @@ rule ELASTIC_Windows_Trojan_Trickbot_9C0Fa8Fe : FILE MEMORY
 		date = "2021-07-13"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Trickbot.yar#L956-L974"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Trickbot.yar#L956-L974"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f528c3ea7138df7c661d88fafe56d118b6ee1d639868212378232ca09dc9bfad"
-		logic_hash = "23aebc3139c34ecd609db7920fa0d5e194173409e1862555e4c468dad6c46299"
+		logic_hash = "v1_sha256_23aebc3139c34ecd609db7920fa0d5e194173409e1862555e4c468dad6c46299"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93438,10 +93600,10 @@ rule ELASTIC_Linux_Exploit_Cornelgen_584A227A : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Cornelgen.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Cornelgen.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c823cb669f1d6cb9258d6f0b187609c226af23396f9c5be26eb479e5722a9d97"
-		logic_hash = "db3b6bbab48074449ae8b404f8fa77d93cde1ab8e57bd4ad981ac2afb8226494"
+		logic_hash = "v1_sha256_db3b6bbab48074449ae8b404f8fa77d93cde1ab8e57bd4ad981ac2afb8226494"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93467,10 +93629,10 @@ rule ELASTIC_Linux_Exploit_Cornelgen_Be0Bc02D : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Cornelgen.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Cornelgen.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "24c0ba8ad4f543f9b0aff0d0b66537137bc78606b47ced9b6d08039bbae78d80"
-		logic_hash = "67c4f2d875f233b52fcbc24d9225c51af4dc09c27ce3915f0d756202bd4e5867"
+		logic_hash = "v1_sha256_67c4f2d875f233b52fcbc24d9225c51af4dc09c27ce3915f0d756202bd4e5867"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93496,10 +93658,10 @@ rule ELASTIC_Linux_Exploit_Cornelgen_03Ee53D3 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Cornelgen.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Cornelgen.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "711eafd09d4e5433be142d54db153993ee55b6c53779d8ec7e76ca534b4f81a5"
-		logic_hash = "e7d9c66621ad3c56f3bb8150c17b10495053d9485b2143750aeefd3c55ab7943"
+		logic_hash = "v1_sha256_e7d9c66621ad3c56f3bb8150c17b10495053d9485b2143750aeefd3c55ab7943"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93525,10 +93687,10 @@ rule ELASTIC_Windows_Trojan_Siestagraph_8C36Ddc1 : FILE MEMORY
 		date = "2022-12-14"
 		modified = "2022-12-15"
 		reference = "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SiestaGraph.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SiestaGraph.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "50c2f1bb99d742d8ae0ad7c049362b0e62d2d219b610dcf25ba50c303ccfef54"
-		logic_hash = "17ce8090b88100f00c07df0599cd51dc7682f4c43de989ce58621df97eca42fb"
+		logic_hash = "v1_sha256_17ce8090b88100f00c07df0599cd51dc7682f4c43de989ce58621df97eca42fb"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -93551,7 +93713,7 @@ rule ELASTIC_Windows_Trojan_Siestagraph_8C36Ddc1 : FILE MEMORY
 		$b4 = "delMail" ascii fullword
 
 	condition:
-		all of ($a*) and 2 of ($b*)
+		all of ( $a* ) and 2 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Siestagraph_Ad3Fe5C6 : FILE MEMORY
 {
@@ -93562,10 +93724,10 @@ rule ELASTIC_Windows_Trojan_Siestagraph_Ad3Fe5C6 : FILE MEMORY
 		date = "2023-09-12"
 		modified = "2023-09-20"
 		reference = "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SiestaGraph.yar#L30-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SiestaGraph.yar#L30-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fe8f99445ad139160a47b109a8f3291eef9c6a23b4869c48d341380d608ed4cb"
-		logic_hash = "b625221b77803c2c052db09c90a76666cf9e0ae34cb0d59ae303e890e646e94b"
+		logic_hash = "v1_sha256_b625221b77803c2c052db09c90a76666cf9e0ae34cb0d59ae303e890e646e94b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93598,10 +93760,10 @@ rule ELASTIC_Windows_Trojan_Siestagraph_D801Ce71 : FILE MEMORY
 		date = "2023-09-12"
 		modified = "2023-09-20"
 		reference = "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SiestaGraph.yar#L58-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SiestaGraph.yar#L58-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fe8f99445ad139160a47b109a8f3291eef9c6a23b4869c48d341380d608ed4cb"
-		logic_hash = "c2d00d64d69cb5d24d76f6c551b49aa1acef1e1bab96f7ed7facc148244a8370"
+		logic_hash = "v1_sha256_c2d00d64d69cb5d24d76f6c551b49aa1acef1e1bab96f7ed7facc148244a8370"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93629,10 +93791,10 @@ rule ELASTIC_Windows_Hacktool_Rubeus_43F18623 : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Rubeus.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Rubeus.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b7b4691ad1cdad7663c32d07e911a03d9cc8b104f724c2825fd4957007649235"
-		logic_hash = "8714f30e12c0dc61c83491a71dbf9f1e9b6bc66663a8f2c069e7a7841d52cf68"
+		logic_hash = "v1_sha256_8714f30e12c0dc61c83491a71dbf9f1e9b6bc66663a8f2c069e7a7841d52cf68"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -93655,7 +93817,7 @@ rule ELASTIC_Windows_Hacktool_Rubeus_43F18623 : FILE MEMORY
 		$print_str7 = "[*] Using a TGT /ticket to request service tickets" ascii wide
 
 	condition:
-		$guid or 4 of ($print_str*)
+		$guid or 4 of ( $print_str* )
 }
 rule ELASTIC_Multi_Ransomware_Luna_8614D3D7 : FILE MEMORY
 {
@@ -93666,10 +93828,10 @@ rule ELASTIC_Multi_Ransomware_Luna_8614D3D7 : FILE MEMORY
 		date = "2022-08-02"
 		modified = "2022-08-16"
 		reference = "https://www.elastic.co/security-labs/luna-ransomware-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Ransomware_Luna.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Ransomware_Luna.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1cbbf108f44c8f4babde546d26425ca5340dccf878d306b90eb0fbec2f83ab51"
-		logic_hash = "14e40c5b1a21ba31664ed31b04bfc4a8646b3e31f96d39e0928a3d6a50d79307"
+		logic_hash = "v1_sha256_14e40c5b1a21ba31664ed31b04bfc4a8646b3e31f96d39e0928a3d6a50d79307"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93691,7 +93853,7 @@ rule ELASTIC_Multi_Ransomware_Luna_8614D3D7 : FILE MEMORY
 		$chunk_calculation1 = { 48 C1 EA 12 48 89 D0 48 C1 E0 05 48 29 D0 48 29 D0 48 3D C4 EA 00 00 }
 
 	condition:
-		5 of ($str_*) or all of ($chunk_*)
+		5 of ( $str_* ) or all of ( $chunk_* )
 }
 rule ELASTIC_Linux_Trojan_Badbee_231Cb054 : FILE MEMORY
 {
@@ -93702,10 +93864,10 @@ rule ELASTIC_Linux_Trojan_Badbee_231Cb054 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Badbee.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Badbee.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "832ba859c3030e58b94398ff663ddfe27078946a83dcfc81a5ef88351d41f4e2"
-		logic_hash = "a1ed8f2da9b4f891a5c65d943424bb7c465f0d07e7756e292c617ce5ef14d182"
+		logic_hash = "v1_sha256_a1ed8f2da9b4f891a5c65d943424bb7c465f0d07e7756e292c617ce5ef14d182"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93731,10 +93893,10 @@ rule ELASTIC_Windows_Vulndriver_Marvinhw_37326842 : FILE
 		date = "2022-07-21"
 		modified = "2022-07-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_MarvinHW.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_MarvinHW.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
-		logic_hash = "f37290912ab7d997d718c074eef48a67a36444e9e97592b6be65855ade2ba246"
+		logic_hash = "v1_sha256_f37290912ab7d997d718c074eef48a67a36444e9e97592b6be65855ade2ba246"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -93752,7 +93914,7 @@ rule ELASTIC_Windows_Vulndriver_Marvinhw_37326842 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x09][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x08][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x08][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x09][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x07][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $subject_name and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $subject_name and $original_file_name and $version
 }
 rule ELASTIC_Macos_Cryptominer_Generic_D3F68E29 : FILE MEMORY
 {
@@ -93763,10 +93925,10 @@ rule ELASTIC_Macos_Cryptominer_Generic_D3F68E29 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Cryptominer_Generic.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Cryptominer_Generic.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d9c78c822dfd29a1d9b1909bf95cab2a9550903e8f5f178edeb7a5a80129fbdb"
-		logic_hash = "cc336e536e0f8dda47f9551dfabfc50c2094fffe4a69cdcec23824dd063dede0"
+		logic_hash = "v1_sha256_cc336e536e0f8dda47f9551dfabfc50c2094fffe4a69cdcec23824dd063dede0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93794,10 +93956,10 @@ rule ELASTIC_Macos_Cryptominer_Generic_365Ecbb9 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Cryptominer_Generic.yar#L23-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Cryptominer_Generic.yar#L23-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
-		logic_hash = "66f16c8694c5cfde1b5e4eea03c530fa32a15022fa35acdbb676bb696e7deae2"
+		logic_hash = "v1_sha256_66f16c8694c5cfde1b5e4eea03c530fa32a15022fa35acdbb676bb696e7deae2"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -93823,10 +93985,10 @@ rule ELASTIC_Macos_Cryptominer_Generic_4E7D4488 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Cryptominer_Generic.yar#L43-L61"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Cryptominer_Generic.yar#L43-L61"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
-		logic_hash = "708b21b687c8b853a9b5f8a50d31119e4f0a02a5b63f81ba1cac8c06acd19214"
+		logic_hash = "v1_sha256_708b21b687c8b853a9b5f8a50d31119e4f0a02a5b63f81ba1cac8c06acd19214"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -93852,10 +94014,10 @@ rule ELASTIC_Macos_Trojan_Hloader_A3945Baf : FILE MEMORY
 		date = "2023-10-23"
 		modified = "2023-10-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_HLoader.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_HLoader.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1"
-		logic_hash = "0383485b6bbcdae210a6c949f6796023b2f7ec3f1edbd2116207fc2b75a67849"
+		logic_hash = "v1_sha256_0383485b6bbcdae210a6c949f6796023b2f7ec3f1edbd2116207fc2b75a67849"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93872,7 +94034,7 @@ rule ELASTIC_Macos_Trojan_Hloader_A3945Baf : FILE MEMORY
 		$seq_rename = { 41 89 DE 84 DB 74 ?? 48 8B 7D ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? }
 
 	condition:
-		2 of ($seq*)
+		2 of ( $seq* )
 }
 rule ELASTIC_Linux_Trojan_Banload_D5E1C189 : FILE MEMORY
 {
@@ -93883,10 +94045,10 @@ rule ELASTIC_Linux_Trojan_Banload_D5E1C189 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Banload.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Banload.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "48bf0403f777db5da9c6a7eada17ad4ddf471bd73ea6cf02817dd202b49204f4"
-		logic_hash = "3f0bee251152a8c835a3bf71dc33c2e150705713c50ca2cfdbeb69361ed91a09"
+		logic_hash = "v1_sha256_3f0bee251152a8c835a3bf71dc33c2e150705713c50ca2cfdbeb69361ed91a09"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93912,10 +94074,10 @@ rule ELASTIC_Linux_Exploit_Foda_F41E9Ef9 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Foda.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Foda.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6059a6dd039b5efa36ce97acbb01406128aaf6062429474e422624ee69783ca8"
-		logic_hash = "7b15fef304b91601a76c6fcf48a892105d6eedf5a3e2395ab7c2937a84709d9f"
+		logic_hash = "v1_sha256_7b15fef304b91601a76c6fcf48a892105d6eedf5a3e2395ab7c2937a84709d9f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93941,10 +94103,10 @@ rule ELASTIC_Linux_Ransomware_Noescape_6De58E0C : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_NoEscape.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_NoEscape.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "46f1a4c77896f38a387f785b2af535f8c29d40a105b63a259d295cb14d36a561"
-		logic_hash = "c275d0cfdadcaabe57c432956e96b4bb344d947899fa5ad55b872e02b4d44274"
+		logic_hash = "v1_sha256_c275d0cfdadcaabe57c432956e96b4bb344d947899fa5ad55b872e02b4d44274"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -93972,10 +94134,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_83715433 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba"
-		logic_hash = "7a7328322c2c1e128e267e92de0964e78ad9f49b7de8ec69d7f0632c69723a7d"
+		logic_hash = "v1_sha256_7a7328322c2c1e128e267e92de0964e78ad9f49b7de8ec69d7f0632c69723a7d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94001,9 +94163,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_28A2Fe0C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "04bbc6c40cdd71b4185222a822d18b96ec8427006221f213a1c9e4d9c689ce5c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_04bbc6c40cdd71b4185222a822d18b96ec8427006221f213a1c9e4d9c689ce5c"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -94029,10 +94191,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Eb96Cc26 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "440318179ba2419cfa34ea199b49ee6bdecd076883d26329bbca6dca9d39c500"
-		logic_hash = "3d8740a6cca4856a73ea745877a3eb39cbf3ad4ca612daabd197f551116efa04"
+		logic_hash = "v1_sha256_3d8740a6cca4856a73ea745877a3eb39cbf3ad4ca612daabd197f551116efa04"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94058,10 +94220,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_5008Aee6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b32cd71fcfda0a2fcddad49d8c5ba8d4d68867b2ff2cb3b49d1a0e358346620c"
-		logic_hash = "538bae17dcf0298e379f656e1dba794b75af6c7448a23253a51994bde9d30524"
+		logic_hash = "v1_sha256_538bae17dcf0298e379f656e1dba794b75af6c7448a23253a51994bde9d30524"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94087,10 +94249,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_6321B565 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730"
-		logic_hash = "ad5c73ab68059101acf2fd8cfb3d676fd1ff58811e1c4b9008c291361ee951b8"
+		logic_hash = "v1_sha256_ad5c73ab68059101acf2fd8cfb3d676fd1ff58811e1c4b9008c291361ee951b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94116,10 +94278,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_A6A2Adb9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L100-L118"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L100-L118"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "8f5fc4cb1ad51178701509a44a793e119fe7e7fad97eafcac8be14fce64e3b7b"
+		logic_hash = "v1_sha256_8f5fc4cb1ad51178701509a44a793e119fe7e7fad97eafcac8be14fce64e3b7b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94145,10 +94307,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_C573932B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L120-L138"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L120-L138"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
-		logic_hash = "174a3fcebc1e17cc35ddc11fde1798164b5783fc51fdf16581a9690c3b4d6549"
+		logic_hash = "v1_sha256_174a3fcebc1e17cc35ddc11fde1798164b5783fc51fdf16581a9690c3b4d6549"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94174,9 +94336,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_A10161Ce : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L140-L157"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "12ba13a746300d1ab1d0386b86ec224eebf4e6d0b3688495c2fee6a7eccc361d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L140-L157"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_12ba13a746300d1ab1d0386b86ec224eebf4e6d0b3688495c2fee6a7eccc361d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94202,9 +94364,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Ae01D978 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L159-L176"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "c6c22b11dc1f0d4996e5da92c6edf58b7d21d7be40da87ddd39ed0e2d4c84072"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L159-L176"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_c6c22b11dc1f0d4996e5da92c6edf58b7d21d7be40da87ddd39ed0e2d4c84072"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94230,10 +94392,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_9E9530A7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L178-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L178-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
-		logic_hash = "6a5a80e58c86a80f8954e678a2cc26b258d7d7c50047a3e71f3580f1780e3454"
+		logic_hash = "v1_sha256_6a5a80e58c86a80f8954e678a2cc26b258d7d7c50047a3e71f3580f1780e3454"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94259,10 +94421,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_5Bf62Ce4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L198-L216"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L198-L216"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
-		logic_hash = "848e0c796584cfa21afc182da5f417f5467ae84c74f52cabc13e0f5de4990232"
+		logic_hash = "v1_sha256_848e0c796584cfa21afc182da5f417f5467ae84c74f52cabc13e0f5de4990232"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94288,10 +94450,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_F3D83A74 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L218-L236"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L218-L236"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "2db46180e66c9268a97d63cd1c4eb8439e6882b4e3277bc4848e940e4d25482f"
+		logic_hash = "v1_sha256_2db46180e66c9268a97d63cd1c4eb8439e6882b4e3277bc4848e940e4d25482f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94317,9 +94479,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_807911A2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L238-L255"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "66b15304d5ed22daea666bd0e2b18726b8a058361ff8d69b974bfded933a4d8c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L238-L255"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_66b15304d5ed22daea666bd0e2b18726b8a058361ff8d69b974bfded933a4d8c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94345,9 +94507,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_9C18716C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L257-L274"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "0e70dc82b2049a6f5efcc501e18e6f87e04a2d50efcb5143240c68c4a924de52"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L257-L274"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_0e70dc82b2049a6f5efcc501e18e6f87e04a2d50efcb5143240c68c4a924de52"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94373,10 +94535,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Fbed4652 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L276-L294"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L276-L294"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2ea21358205612f5dc0d5f417c498b236c070509531621650b8c215c98c49467"
-		logic_hash = "fc1f501123ab7421034e183186b077f65838b475f883d4ff04e8fc8a283424ef"
+		logic_hash = "v1_sha256_fc1f501123ab7421034e183186b077f65838b475f883d4ff04e8fc8a283424ef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94402,10 +94564,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_94A44Aa5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L296-L314"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L296-L314"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a7694202f9c32a9d73a571a30a9e4a431d5dfd7032a500084756ba9a48055dba"
-		logic_hash = "deb46c2960dc4868b7bac1255d8753895950bc066dec03674a714860ff72ef2c"
+		logic_hash = "v1_sha256_deb46c2960dc4868b7bac1255d8753895950bc066dec03674a714860ff72ef2c"
 		score = 60
 		quality = 45
 		tags = "FILE, MEMORY"
@@ -94431,10 +94593,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_E0673A90 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L316-L334"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L316-L334"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
-		logic_hash = "149147eedd66f9ca2dad9cb69f37abc849d44331ec1b5d2917ab3867ced0b274"
+		logic_hash = "v1_sha256_149147eedd66f9ca2dad9cb69f37abc849d44331ec1b5d2917ab3867ced0b274"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94460,10 +94622,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_821173Df : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L336-L354"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L336-L354"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "de7d1aff222c7d474e1a42b2368885ef16317e8da1ca3a63009bf06376026163"
-		logic_hash = "1c6c7666983c43176aa1a9628fb4352f8f11729e02dda13669ca2e62aed5f4ee"
+		logic_hash = "v1_sha256_1c6c7666983c43176aa1a9628fb4352f8f11729e02dda13669ca2e62aed5f4ee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94489,10 +94651,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_31796A40 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L356-L374"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L356-L374"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "227c7f13f7bdadf6a14cc85e8d2106b9d69ab80abe6fc0056af5edef3621d4fb"
-		logic_hash = "0e0e901d12edd77e77a205f8547f891f483fc8676493e9b7a324e970225af3c9"
+		logic_hash = "v1_sha256_0e0e901d12edd77e77a205f8547f891f483fc8676493e9b7a324e970225af3c9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94518,10 +94680,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_750Fe002 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L376-L394"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L376-L394"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
-		logic_hash = "eb9907d8a63822c2e3ab57d43dca8ede7876610f029e2f9c10c9eeace9ea0078"
+		logic_hash = "v1_sha256_eb9907d8a63822c2e3ab57d43dca8ede7876610f029e2f9c10c9eeace9ea0078"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94547,9 +94709,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_6122Acdf : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L396-L413"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "140b32a8f2b7493b068e63a05b3d9baec6ec14c9f2062c7e760dde96335e29f1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L396-L413"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_140b32a8f2b7493b068e63a05b3d9baec6ec14c9f2062c7e760dde96335e29f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94575,10 +94737,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_A0A4De11 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L415-L433"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L415-L433"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417"
-		logic_hash = "220c6ba82b906f070123b3bae9aafa72c0fb3bc8d5858a4f4bd65567076eb73d"
+		logic_hash = "v1_sha256_220c6ba82b906f070123b3bae9aafa72c0fb3bc8d5858a4f4bd65567076eb73d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94604,10 +94766,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_A473Dcb6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L435-L453"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L435-L453"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7ba74e3cb0d633de0e8dbe6cfc49d4fc77dd0c02a5f1867cc4a1f1d575def97d"
-		logic_hash = "106ee9cd9c368674ae08b835f54dbb6918b553e3097aae9b0de88f55420f046b"
+		logic_hash = "v1_sha256_106ee9cd9c368674ae08b835f54dbb6918b553e3097aae9b0de88f55420f046b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94633,10 +94795,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_30444846 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L455-L473"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L455-L473"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c84b81d79d437bb9b8a6bad3646aef646f2a8e1f1554501139648d2f9de561da"
-		logic_hash = "26bc95efb2ea69fece52cf3ab38ce35891c77fc0dac3e26e5580ba3a88e112e9"
+		logic_hash = "v1_sha256_26bc95efb2ea69fece52cf3ab38ce35891c77fc0dac3e26e5580ba3a88e112e9"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -94662,9 +94824,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Ea92Cca8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L475-L492"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "5a9598b3fd37b15444063403a481df1a43894ddcbbd343961e1c770cb74180c9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L475-L492"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_5a9598b3fd37b15444063403a481df1a43894ddcbbd343961e1c770cb74180c9"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -94690,10 +94852,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_D4227Dbf : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L494-L512"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L494-L512"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
-		logic_hash = "7953b8d08834315a6ca2c0c8ac1ec7b74a6ffcb71cec4fc053c24e1b59232c0c"
+		logic_hash = "v1_sha256_7953b8d08834315a6ca2c0c8ac1ec7b74a6ffcb71cec4fc053c24e1b59232c0c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94719,10 +94881,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_09C3070E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L514-L532"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L514-L532"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "f8f8e8883cf1e51fbaef81b8334ac5fa45a54682d285282da62c80e4aa50a48d"
+		logic_hash = "v1_sha256_f8f8e8883cf1e51fbaef81b8334ac5fa45a54682d285282da62c80e4aa50a48d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94748,10 +94910,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Fa19B8Fc : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L534-L552"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L534-L552"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a7cfc16ec33ec633cbdcbff3c4cefeed84d7cbe9ca1f4e2a3b3e43d39291cd6b"
-		logic_hash = "cddf3b9948b9bc685ff7d4c00377d0f80861169707777022297e549bd166dbf0"
+		logic_hash = "v1_sha256_cddf3b9948b9bc685ff7d4c00377d0f80861169707777022297e549bd166dbf0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94777,10 +94939,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Eaa9A668 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L554-L572"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L554-L572"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
-		logic_hash = "05e9047342a9d081a09f8514f0ec32d72bc43a286035014ada90b0243f92cfa8"
+		logic_hash = "v1_sha256_05e9047342a9d081a09f8514f0ec32d72bc43a286035014ada90b0243f92cfa8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94806,10 +94968,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_46Eec778 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L574-L592"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L574-L592"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1"
-		logic_hash = "08e77a31005e14a06197857301e22d20334c1f2ef7fc06a4208643438377f4c4"
+		logic_hash = "v1_sha256_08e77a31005e14a06197857301e22d20334c1f2ef7fc06a4208643438377f4c4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94835,10 +94997,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_F51C5Ac3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L594-L612"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L594-L612"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
-		logic_hash = "e82b5ddb760d5bdcd146e1de12ec34c4764e668543420765146e22dee6f5732b"
+		logic_hash = "v1_sha256_e82b5ddb760d5bdcd146e1de12ec34c4764e668543420765146e22dee6f5732b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94864,10 +95026,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_71E487Ea : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L614-L632"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L614-L632"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b8d044f2de21d20c7e4b43a2baf5d8cdb97fba95c3b99816848c0f214515295b"
-		logic_hash = "3de9e0e3334e9e6e5906886f95ff8ce3596f85772dc25021fb0ee148281cf81c"
+		logic_hash = "v1_sha256_3de9e0e3334e9e6e5906886f95ff8ce3596f85772dc25021fb0ee148281cf81c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94893,10 +95055,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_6620Ec67 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L634-L652"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L634-L652"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b91eb196605c155c98f824abf8afe122f113d1fed254074117652f93d0c9d6b2"
-		logic_hash = "2df2c8cdc2cb545f916159d44a800708b55a2993cd54a4dcf920a6a8dc6361e7"
+		logic_hash = "v1_sha256_2df2c8cdc2cb545f916159d44a800708b55a2993cd54a4dcf920a6a8dc6361e7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94922,10 +95084,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_D996D335 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L654-L672"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L654-L672"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda"
-		logic_hash = "212c75ab61eac8b3ed2049966628dfc81ae5a620b4a4b38aaa0696d594910dea"
+		logic_hash = "v1_sha256_212c75ab61eac8b3ed2049966628dfc81ae5a620b4a4b38aaa0696d594910dea"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94951,9 +95113,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_D0C57A2E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L674-L691"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "2ac51f0943d573fdc9a39837aeefd9158c27a4b3f35fbbb0a058a88392a53c14"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L674-L691"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2ac51f0943d573fdc9a39837aeefd9158c27a4b3f35fbbb0a058a88392a53c14"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -94979,9 +95141,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_751Acb94 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L693-L710"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "1963351d209168f4ae2268d245cfd5320e4442d00746d021088ffae98e5da454"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L693-L710"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_1963351d209168f4ae2268d245cfd5320e4442d00746d021088ffae98e5da454"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95007,10 +95169,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_656Bf077 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L712-L730"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L712-L730"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
-		logic_hash = "0c9728304e720eb2cd00afad8d16f309514473dece48fa94af6a72ca41705a36"
+		logic_hash = "v1_sha256_0c9728304e720eb2cd00afad8d16f309514473dece48fa94af6a72ca41705a36"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95036,10 +95198,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_E6D75E6F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L732-L750"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L732-L750"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8"
-		logic_hash = "339dd33a3313a4a94d2515cd4c2100ac6b9d5e0029881494c28dc3e7c8a05798"
+		logic_hash = "v1_sha256_339dd33a3313a4a94d2515cd4c2100ac6b9d5e0029881494c28dc3e7c8a05798"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95065,10 +95227,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_7167D08F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L752-L770"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L752-L770"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
-		logic_hash = "88c07bf06801192f38ef66229a0aa5c1ef6242caeb080ce1c7cd13ad0d540c82"
+		logic_hash = "v1_sha256_88c07bf06801192f38ef66229a0aa5c1ef6242caeb080ce1c7cd13ad0d540c82"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95094,10 +95256,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_27De1106 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L772-L790"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L772-L790"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
-		logic_hash = "4e266e1ae31d7d86866b112a04ca38c0a8185c18ebb10ac6497bbaa69f51b2fd"
+		logic_hash = "v1_sha256_4e266e1ae31d7d86866b112a04ca38c0a8185c18ebb10ac6497bbaa69f51b2fd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95123,10 +95285,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_148B91A2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L792-L810"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L792-L810"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825"
-		logic_hash = "1a974c0882c2d088c978a52e5b535807c86f117cf2f05c40c084e849b1849f5b"
+		logic_hash = "v1_sha256_1a974c0882c2d088c978a52e5b535807c86f117cf2f05c40c084e849b1849f5b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95152,10 +95314,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_20F5E74F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L812-L830"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L812-L830"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9084b00f9bb71524987dc000fb2bc6f38e722e2be2832589ca4bb1671e852f5b"
-		logic_hash = "067f1c15961c1ddceecb490b338db9f5b8501d89b38e870edfa628d21527dc1c"
+		logic_hash = "v1_sha256_067f1c15961c1ddceecb490b338db9f5b8501d89b38e870edfa628d21527dc1c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95181,10 +95343,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_1B2E2A3A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L832-L850"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L832-L850"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
-		logic_hash = "6f40f868d20f0125721eb2a7934b356d69b695d4a558155a2ddcd0107d3f8c30"
+		logic_hash = "v1_sha256_6f40f868d20f0125721eb2a7934b356d69b695d4a558155a2ddcd0107d3f8c30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95210,10 +95372,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_620087B9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L852-L870"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L852-L870"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
-		logic_hash = "411451ea326498a25af8be5cd43fe0b98973af354706268c89828b88ece5e497"
+		logic_hash = "v1_sha256_411451ea326498a25af8be5cd43fe0b98973af354706268c89828b88ece5e497"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95239,10 +95401,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Dd0D6173 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L872-L890"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L872-L890"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
-		logic_hash = "7061edef1981e2b93bcdd8be47c0f6067acc140a543eed748bf0513f182e0a59"
+		logic_hash = "v1_sha256_7061edef1981e2b93bcdd8be47c0f6067acc140a543eed748bf0513f182e0a59"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95268,10 +95430,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_779E142F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L892-L910"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L892-L910"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "80ba5a1cf333fafc6a1d7823ca4a8d5c30c1c07a01d6d681c22dd29e197089f1"
+		logic_hash = "v1_sha256_80ba5a1cf333fafc6a1d7823ca4a8d5c30c1c07a01d6d681c22dd29e197089f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95297,10 +95459,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Cf84C9F2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L912-L930"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L912-L930"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "9af164ece7e7e0f33dc32f18735a8f655593ae6cde34e05108f3221b71aa8676"
+		logic_hash = "v1_sha256_9af164ece7e7e0f33dc32f18735a8f655593ae6cde34e05108f3221b71aa8676"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95326,9 +95488,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_0Cd591Cd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L932-L949"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "4300bdd173dfb33ca34c0f2fe4fa6ee071e99d5db201262e914721aad0ad433b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L932-L949"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_4300bdd173dfb33ca34c0f2fe4fa6ee071e99d5db201262e914721aad0ad433b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95354,10 +95516,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_859042A0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L951-L969"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L951-L969"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0"
-		logic_hash = "b8daa4a136a6511472703687fe56fbca2bd005a1373802a46c8d211b6d039d75"
+		logic_hash = "v1_sha256_b8daa4a136a6511472703687fe56fbca2bd005a1373802a46c8d211b6d039d75"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95383,10 +95545,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_33B4111A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L971-L989"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L971-L989"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
-		logic_hash = "a08c0f7be26e2e9abfaa392712895bb3ce1d12583da4060ebe41e1a9c1491b7c"
+		logic_hash = "v1_sha256_a08c0f7be26e2e9abfaa392712895bb3ce1d12583da4060ebe41e1a9c1491b7c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95412,10 +95574,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_4F43B164 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L991-L1009"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L991-L1009"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f0fdb3de75f85e199766bbb39722865cac578cde754afa2d2f065ef028eec788"
-		logic_hash = "79a17e70e9b7af6e53f62211c33355a4c46a82e7c4e80c20ffe9684e24155808"
+		logic_hash = "v1_sha256_79a17e70e9b7af6e53f62211c33355a4c46a82e7c4e80c20ffe9684e24155808"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95441,9 +95603,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_E4A1982B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1011-L1028"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "4cd7aa205b3571cffca208e315d6311fa92a5993e2a8e40d342d6184811f42f0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1011-L1028"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_4cd7aa205b3571cffca208e315d6311fa92a5993e2a8e40d342d6184811f42f0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95469,10 +95631,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_862C4E0E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1030-L1048"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1030-L1048"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1"
-		logic_hash = "a1dce44e76f9d2a517c4849c58dfecb07e1ef0d78fddff10af601184d636583f"
+		logic_hash = "v1_sha256_a1dce44e76f9d2a517c4849c58dfecb07e1ef0d78fddff10af601184d636583f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95498,10 +95660,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_9127F7Be : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1050-L1068"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1050-L1068"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
-		logic_hash = "2b1fa115598561e081dfb9b5f24f6728b0d52cb81ac7933728d81646f461bcae"
+		logic_hash = "v1_sha256_2b1fa115598561e081dfb9b5f24f6728b0d52cb81ac7933728d81646f461bcae"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95527,9 +95689,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_0E03B7D3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1070-L1087"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "845be03fac893f8e914aabda5206000dc07947ade0b8f46cc5d58d8458f035f6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1070-L1087"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_845be03fac893f8e914aabda5206000dc07947ade0b8f46cc5d58d8458f035f6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95555,10 +95717,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_32Eb0C81 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1089-L1107"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1089-L1107"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "a06d9e1190ba79b0e19cab7468f01a49359629a6feb27b7d72f3d1d52d1483d7"
+		logic_hash = "v1_sha256_a06d9e1190ba79b0e19cab7468f01a49359629a6feb27b7d72f3d1d52d1483d7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95584,9 +95746,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_9Abf7E0C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1109-L1126"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "00276330e388d07368577c4134343cb9fc11957dba6cff5523331199f1ed04aa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1109-L1126"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_00276330e388d07368577c4134343cb9fc11957dba6cff5523331199f1ed04aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95612,10 +95774,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_33801844 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1128-L1146"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1128-L1146"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2ceff60e88c30c02c1c7b12a224aba1895669aad7316a40b575579275b3edbb3"
-		logic_hash = "20b8ebce14776e48310be099afd0dca0f28778d0024318b339b75e2689f70128"
+		logic_hash = "v1_sha256_20b8ebce14776e48310be099afd0dca0f28778d0024318b339b75e2689f70128"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95641,9 +95803,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_A33A8363 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1148-L1165"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "3fe17dc43f07dacdad6ababf141983854b977e244c0af824fea0ab953ad70fee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1148-L1165"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_3fe17dc43f07dacdad6ababf141983854b977e244c0af824fea0ab953ad70fee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95669,10 +95831,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_9A62845F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1167-L1185"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1167-L1185"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f67f8566beab9d7494350923aceb0e76cd28173bdf2c4256e9d45eff7fc8cb41"
-		logic_hash = "b3ab125c8bfb5b7a0be0e92cf5a50057e403ab3597698ec2e7a8bafa0d3a8b80"
+		logic_hash = "v1_sha256_b3ab125c8bfb5b7a0be0e92cf5a50057e403ab3597698ec2e7a8bafa0d3a8b80"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95698,10 +95860,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_4D81Ad42 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1187-L1205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1187-L1205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3021a861e6f03df3e7e3919e6255bdae6e48163b9a8ba4f1a5c5dced3e3e368b"
-		logic_hash = "57b54eed37690949ba2d4eff713691f16f00207d7b374beb7dfa2e368588dbb0"
+		logic_hash = "v1_sha256_57b54eed37690949ba2d4eff713691f16f00207d7b374beb7dfa2e368588dbb0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95727,9 +95889,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_6A510422 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1207-L1225"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "4384536817bf5df223d4cf145892b7714f2dbd1748930b6cd43152d4e35c9e56"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1207-L1225"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_4384536817bf5df223d4cf145892b7714f2dbd1748930b6cd43152d4e35c9e56"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95755,9 +95917,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_D2953F92 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1227-L1245"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d0af462d26f6ffe469c57d63f1f7d551e3fb9cc39c7e4c35b3e71f659c01c076"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1227-L1245"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d0af462d26f6ffe469c57d63f1f7d551e3fb9cc39c7e4c35b3e71f659c01c076"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95783,9 +95945,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_6Ae4B580 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1247-L1265"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "eb0fe44df1c995c5d4e3a361c3e466f78cb70bffbc76d1b7b345ee651b313b9e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1247-L1265"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_eb0fe44df1c995c5d4e3a361c3e466f78cb70bffbc76d1b7b345ee651b313b9e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95811,9 +95973,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_D608Cf3B : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1267-L1285"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "ad5b7d32c85adc7f778a8f4815e595b90a6f15dec048bcf97c6ab179582eb4f7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1267-L1285"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_ad5b7d32c85adc7f778a8f4815e595b90a6f15dec048bcf97c6ab179582eb4f7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95839,9 +96001,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_3F8Cf56E : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "1878f0783085cc6beb2b81cfda304ec983374264ce54b6b98a51c09aea9f750d"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1287-L1305"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "b2cf8b1913a88e6a6346f0ac8cd2e7c33b41d44bf60ff7327ae40a2d54748bd9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1287-L1305"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_b2cf8b1913a88e6a6346f0ac8cd2e7c33b41d44bf60ff7327ae40a2d54748bd9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95867,9 +96029,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Fb14E81F : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1307-L1325"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "2efb958c269640c374485502611372f4404cf35d7ab704d20ce37b8c1f69645d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1307-L1325"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2efb958c269640c374485502611372f4404cf35d7ab704d20ce37b8c1f69645d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95895,9 +96057,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_E09726Dc : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "1e64187b5e3b5fe71d34ea555ff31961404adad83f8e0bd1ce0aad056a878d73"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1327-L1345"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "ebd00e593a7fcd46e36fd0ca213e1f82c0f4a94448b6fd605d35cea45a490493"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1327-L1345"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_ebd00e593a7fcd46e36fd0ca213e1f82c0f4a94448b6fd605d35cea45a490493"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95923,9 +96085,9 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Ad12B9B6 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "f0411131acfddb40ac8069164ce2808e9c8928709898d3fb5dc88036003fe9c8"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1347-L1365"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "72a85d14eb8ab78364ea2e8b89d9409c0046b14602f4a3415d829f4985fb2de3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1347-L1365"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_72a85d14eb8ab78364ea2e8b89d9409c0046b14602f4a3415d829f4985fb2de3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95951,10 +96113,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_0535Ebf7 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1367-L1385"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1367-L1385"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "77e18bb5479b644ba01d074057c9e2bd532717f6ab3bb88ad2b7497b85d2a5de"
-		logic_hash = "eb574468e9d371def0da74e6aba827272181399a84388a14ffb167ec6ebd40d1"
+		logic_hash = "v1_sha256_eb574468e9d371def0da74e6aba827272181399a84388a14ffb167ec6ebd40d1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -95980,10 +96142,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_32A7Edd2 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1387-L1405"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1387-L1405"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
-		logic_hash = "af26549c1cad0975735e2c233bc71e5e1b0e283d02552fdaea02656332ecd854"
+		logic_hash = "v1_sha256_af26549c1cad0975735e2c233bc71e5e1b0e283d02552fdaea02656332ecd854"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96009,10 +96171,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_D7F35B54 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1407-L1425"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1407-L1425"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
-		logic_hash = "d827e21c09b8dce65db293aa57b39f49f034537bb708471989ad64e653c479be"
+		logic_hash = "v1_sha256_d827e21c09b8dce65db293aa57b39f49f034537bb708471989ad64e653c479be"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96038,10 +96200,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_F11E98Be : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1427-L1445"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1427-L1445"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
-		logic_hash = "9b9122f0897610dff6b37446b3cecbfcec3dce8dc7e1934e78cc32d5f6ac9648"
+		logic_hash = "v1_sha256_9b9122f0897610dff6b37446b3cecbfcec3dce8dc7e1934e78cc32d5f6ac9648"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96067,10 +96229,10 @@ rule ELASTIC_Linux_Trojan_Gafgyt_8D4E4F4A : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Gafgyt.yar#L1447-L1465"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Gafgyt.yar#L1447-L1465"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
-		logic_hash = "11ee101a936f8e6949701e840ef48a0fe102099ea3b71c790b9a5128e5c59029"
+		logic_hash = "v1_sha256_11ee101a936f8e6949701e840ef48a0fe102099ea3b71c790b9a5128e5c59029"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96096,10 +96258,10 @@ rule ELASTIC_Linux_Exploit_Iouring_D04C1C19 : FILE MEMORY
 		date = "2024-04-07"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_IOUring.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_IOUring.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "29e6a5f7b36e271219601528f3fd70831aacb8b9f05722779faa40afc97b3b60"
-		logic_hash = "b1d8d6090576b4b5bcd435eb69ee1dc1f1947115d38b62364cf1730a4f08d317"
+		logic_hash = "v1_sha256_b1d8d6090576b4b5bcd435eb69ee1dc1f1947115d38b62364cf1730a4f08d317"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96127,9 +96289,9 @@ rule ELASTIC_Multi_Trojan_Mythic_4Beb7E17 : FILE MEMORY
 		date = "2023-08-01"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Trojan_Mythic.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7b3b7bae1763f3c73df206f97065920fa55b973d22c967acb3d26ac8e89e60c7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_Mythic.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7b3b7bae1763f3c73df206f97065920fa55b973d22c967acb3d26ac8e89e60c7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96165,10 +96327,10 @@ rule ELASTIC_Multi_Trojan_Mythic_E0Ea7Ef9 : FILE MEMORY
 		date = "2024-05-23"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Trojan_Mythic.yar#L30-L61"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_Mythic.yar#L30-L61"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e091d63c8e8b0a32a3d25cffdf02419fdbec714f31e4061bafd80b1971831c5f"
-		logic_hash = "237307d85fe7886eb2cf351a9f7872e3e5551f05535f0b6a966a960d204aee90"
+		logic_hash = "v1_sha256_237307d85fe7886eb2cf351a9f7872e3e5551f05535f0b6a966a960d204aee90"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96196,7 +96358,7 @@ rule ELASTIC_Multi_Trojan_Mythic_E0Ea7Ef9 : FILE MEMORY
 		$rs_misc4 = "src/getprivs.rs"
 
 	condition:
-		all of ($profile*) and 8 of ($rs*)
+		all of ( $profile* ) and 8 of ( $rs* )
 }
 rule ELASTIC_Multi_Trojan_Mythic_528324B4 : FILE MEMORY
 {
@@ -96207,10 +96369,10 @@ rule ELASTIC_Multi_Trojan_Mythic_528324B4 : FILE MEMORY
 		date = "2024-05-23"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Trojan_Mythic.yar#L63-L89"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_Mythic.yar#L63-L89"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2cd883eab722a5eacbca7fa82e0eebb5f6c30cffa955abcb1ab8cf169af97202"
-		logic_hash = "8c85d086b30030a24fba9f519aed3fdf3c821932d71ceaecfe354fe07cd1d631"
+		logic_hash = "v1_sha256_8c85d086b30030a24fba9f519aed3fdf3c821932d71ceaecfe354fe07cd1d631"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96233,7 +96395,7 @@ rule ELASTIC_Multi_Trojan_Mythic_528324B4 : FILE MEMORY
 		$athena4 = "Athena.Profiles.HTTP.dll"
 
 	condition:
-		(2 of ($import*)) or (2 of ($athena*))
+		(2 of ( $import* ) ) or ( 2 of ( $athena* ) )
 }
 rule ELASTIC_Windows_Trojan_Hazelcobra_6A9Fe48A : FILE MEMORY
 {
@@ -96244,10 +96406,10 @@ rule ELASTIC_Windows_Trojan_Hazelcobra_6A9Fe48A : FILE MEMORY
 		date = "2023-11-01"
 		modified = "2023-11-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_HazelCobra.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_HazelCobra.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
-		logic_hash = "dc4d561497c2e3da270d305ceaf3194b48d64c0d8e212ee6f03a2d89c8e006e8"
+		logic_hash = "v1_sha256_dc4d561497c2e3da270d305ceaf3194b48d64c0d8e212ee6f03a2d89c8e006e8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96265,7 +96427,7 @@ rule ELASTIC_Windows_Trojan_Hazelcobra_6A9Fe48A : FILE MEMORY
 		$s3 = "Can't read data file" fullword
 
 	condition:
-		$a1 or all of ($s*)
+		$a1 or all of ( $s* )
 }
 rule ELASTIC_Windows_Vulndriver_ATSZIO_E22Cc429 : FILE
 {
@@ -96276,10 +96438,10 @@ rule ELASTIC_Windows_Vulndriver_ATSZIO_E22Cc429 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_ATSZIO.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_ATSZIO.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
-		logic_hash = "e3f057d5a5c47a1f3b4d50e2ad0ebb3a4ffe0efe513a0d375f827fadb3328d80"
+		logic_hash = "v1_sha256_e3f057d5a5c47a1f3b4d50e2ad0ebb3a4ffe0efe513a0d375f827fadb3328d80"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -96295,7 +96457,7 @@ rule ELASTIC_Windows_Vulndriver_ATSZIO_E22Cc429 : FILE
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 41 00 54 00 53 00 5A 00 49 00 4F 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Linux_Ransomware_Quantum_8513Fb8B : FILE MEMORY
 {
@@ -96306,10 +96468,10 @@ rule ELASTIC_Linux_Ransomware_Quantum_8513Fb8B : FILE MEMORY
 		date = "2023-07-28"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Quantum.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Quantum.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3bcb9ad92fdca53195f390fc4d8d721b504b38deeda25c1189a909a7011406c9"
-		logic_hash = "7e24be541bafc2427ecd8f76b7774fb65d7421bc300503eeb068b8104e168c70"
+		logic_hash = "v1_sha256_7e24be541bafc2427ecd8f76b7774fb65d7421bc300503eeb068b8104e168c70"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96336,10 +96498,10 @@ rule ELASTIC_Windows_Trojan_Bitsloth_05Fc3A0A : FILE MEMORY
 		date = "2024-07-16"
 		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BITSloth.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BITSloth.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0944b17a4330e1c97600f62717d6bae7e4a4260604043f2390a14c8d76ef1507"
-		logic_hash = "8210dc28cf408f7f836aad3c32868ea21dd0862070c2c37d98b089a80be9285e"
+		logic_hash = "v1_sha256_8210dc28cf408f7f836aad3c32868ea21dd0862070c2c37d98b089a80be9285e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96373,10 +96535,10 @@ rule ELASTIC_Windows_Hacktool_Physmem_Cc0978Df : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_PhysMem.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_PhysMem.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
-		logic_hash = "e2fabf5889dbdc98dc6942be4fb0de4351d64a06bab945993b2a2c4afe89984e"
+		logic_hash = "v1_sha256_e2fabf5889dbdc98dc6942be4fb0de4351d64a06bab945993b2a2c4afe89984e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -96392,7 +96554,7 @@ rule ELASTIC_Windows_Hacktool_Physmem_Cc0978Df : FILE
 		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 70 00 68 00 79 00 73 00 6D 00 65 00 6D 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Windows_Hacktool_Physmem_B3Fa382B : FILE
 {
@@ -96403,10 +96565,10 @@ rule ELASTIC_Windows_Hacktool_Physmem_B3Fa382B : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_PhysMem.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_PhysMem.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9"
-		logic_hash = "36a60b78de15a52721ad4830b37daffc33d7689e8b180fe148876da00562273a"
+		logic_hash = "v1_sha256_36a60b78de15a52721ad4830b37daffc33d7689e8b180fe148876da00562273a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -96421,7 +96583,7 @@ rule ELASTIC_Windows_Hacktool_Physmem_B3Fa382B : FILE
 		$str1 = "\\Phymemx64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Trojan_Asacub_D3C4Aa41 : FILE MEMORY
 {
@@ -96432,10 +96594,10 @@ rule ELASTIC_Linux_Trojan_Asacub_D3C4Aa41 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Asacub.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Asacub.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "15044273a506f825859e287689a57c6249b01bb0a848f113c946056163b7e5f1"
-		logic_hash = "3645e10e5ef8c50e5e82d749da07f5669c5162cb95aa5958ce45a414b870f619"
+		logic_hash = "v1_sha256_3645e10e5ef8c50e5e82d749da07f5669c5162cb95aa5958ce45a414b870f619"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96461,10 +96623,10 @@ rule ELASTIC_Windows_Trojan_Darkvnc_Bd803C2E : FILE MEMORY
 		date = "2023-01-23"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DarkVNC.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DarkVNC.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0fcc1b02fdaf211c772bd4fa1abcdeb5338d95911c226a9250200ff7f8e45601"
-		logic_hash = "d9e8a42a424d6a186939682e1cd2ed794c8a3765824188e863b1b2829650e2d5"
+		logic_hash = "v1_sha256_d9e8a42a424d6a186939682e1cd2ed794c8a3765824188e863b1b2829650e2d5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96494,10 +96656,10 @@ rule ELASTIC_Windows_Hacktool_Netfilter_E8243Dae : FILE
 		date = "2022-04-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_NetFilter.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_NetFilter.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "760be95d4c04b10df89a78414facf91c0961020e80561eee6e2cb94b43b76510"
-		logic_hash = "c551bd87e73f980d8836b13449490de5e639d768b72d9006d90969f3140b28e2"
+		logic_hash = "v1_sha256_c551bd87e73f980d8836b13449490de5e639d768b72d9006d90969f3140b28e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -96512,7 +96674,7 @@ rule ELASTIC_Windows_Hacktool_Netfilter_E8243Dae : FILE
 		$str1 = "[NetFlt]:CTRL NDIS ModifyARP"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Hacktool_Netfilter_Dd576D28 : FILE
 {
@@ -96523,10 +96685,10 @@ rule ELASTIC_Windows_Hacktool_Netfilter_Dd576D28 : FILE
 		date = "2022-04-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_NetFilter.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_NetFilter.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "88cfe6d7c81d0064045c4198d6ec7d3c50dc3ec8e36e053456ed1b50fc8c23bf"
-		logic_hash = "7635ed94ca77c7705df4d2a9c5546ece86bf831b5bf5355943419174e0387b86"
+		logic_hash = "v1_sha256_7635ed94ca77c7705df4d2a9c5546ece86bf831b5bf5355943419174e0387b86"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -96541,7 +96703,7 @@ rule ELASTIC_Windows_Hacktool_Netfilter_Dd576D28 : FILE
 		$str1 = "\\NetProxyDriver.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Hacktool_Netfilter_B4F2A520 : FILE
 {
@@ -96552,10 +96714,10 @@ rule ELASTIC_Windows_Hacktool_Netfilter_B4F2A520 : FILE
 		date = "2022-04-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_NetFilter.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_NetFilter.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5d0d5373c5e52c4405f4bd963413e6ef3490b7c4c919ec2d4e3fb92e91f397a0"
-		logic_hash = "520d2194593f1622a3b905fe182a0773447a4eee3472e7701cce977f5bf4fbae"
+		logic_hash = "v1_sha256_520d2194593f1622a3b905fe182a0773447a4eee3472e7701cce977f5bf4fbae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -96570,7 +96732,7 @@ rule ELASTIC_Windows_Hacktool_Netfilter_B4F2A520 : FILE
 		$str1 = "\\netfilterdrv.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Hacktool_Netfilter_1Cae6E26 : FILE
 {
@@ -96581,10 +96743,10 @@ rule ELASTIC_Windows_Hacktool_Netfilter_1Cae6E26 : FILE
 		date = "2022-04-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_NetFilter.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_NetFilter.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e2ec3b2a93c473d88bfdf2deb1969d15ab61737acc1ee8e08234bc5513ee87ea"
-		logic_hash = "29c0edc03934e6e7275c3870a8808e03ec85dacb1f54e10efca3123d2257db98"
+		logic_hash = "v1_sha256_29c0edc03934e6e7275c3870a8808e03ec85dacb1f54e10efca3123d2257db98"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -96599,7 +96761,7 @@ rule ELASTIC_Windows_Hacktool_Netfilter_1Cae6E26 : FILE
 		$str1 = "\\Driver_Map.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Ransomware_Ryuk_25D3C5Ba : BETA FILE MEMORY
 {
@@ -96610,9 +96772,9 @@ rule ELASTIC_Windows_Ransomware_Ryuk_25D3C5Ba : BETA FILE MEMORY
 		date = "2020-04-30"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ryuk.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "4d461ff9b87e3a17637cef89ff8a85ef22f69695d4664f6fe8f271a6a5f7b4bc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ryuk.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_4d461ff9b87e3a17637cef89ff8a85ef22f69695d4664f6fe8f271a6a5f7b4bc"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -96628,7 +96790,7 @@ rule ELASTIC_Windows_Ransomware_Ryuk_25D3C5Ba : BETA FILE MEMORY
 		$g1 = { 41 8B C0 45 03 C7 99 F7 FE 48 63 C2 8A 4C 84 20 }
 
 	condition:
-		1 of ($g*)
+		1 of ( $g* )
 }
 rule ELASTIC_Windows_Ransomware_Ryuk_878Bae7E : BETA FILE MEMORY
 {
@@ -96639,9 +96801,9 @@ rule ELASTIC_Windows_Ransomware_Ryuk_878Bae7E : BETA FILE MEMORY
 		date = "2020-04-30"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ryuk.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "94bed2220aeb41ae8069cee56cc5299b9fc56797d3b54085b8246a03d9e8bd93"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ryuk.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_94bed2220aeb41ae8069cee56cc5299b9fc56797d3b54085b8246a03d9e8bd93"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -96658,7 +96820,7 @@ rule ELASTIC_Windows_Ransomware_Ryuk_878Bae7E : BETA FILE MEMORY
 		$b3 = "RyukReadMe.txt" wide fullword
 
 	condition:
-		1 of ($b*)
+		1 of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Ryuk_6C726744 : BETA FILE MEMORY
 {
@@ -96669,9 +96831,9 @@ rule ELASTIC_Windows_Ransomware_Ryuk_6C726744 : BETA FILE MEMORY
 		date = "2020-04-30"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ryuk.yar#L44-L67"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "ee7586d5cbef23d1863a4dfcc5da9b97397c993268881922c681022bf4f293f0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ryuk.yar#L44-L67"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_ee7586d5cbef23d1863a4dfcc5da9b97397c993268881922c681022bf4f293f0"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -96691,7 +96853,7 @@ rule ELASTIC_Windows_Ransomware_Ryuk_6C726744 : BETA FILE MEMORY
 		$a5 = "delete[]" ascii fullword
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Ransomware_Ryuk_1A4Ad952 : BETA FILE MEMORY
 {
@@ -96702,9 +96864,9 @@ rule ELASTIC_Windows_Ransomware_Ryuk_1A4Ad952 : BETA FILE MEMORY
 		date = "2020-04-30"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ryuk.yar#L69-L88"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "bb854f5760f41e2c103c99d8f128a2546926a614dff8753eaa1287ac583e213a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ryuk.yar#L69-L88"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_bb854f5760f41e2c103c99d8f128a2546926a614dff8753eaa1287ac583e213a"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -96720,7 +96882,7 @@ rule ELASTIC_Windows_Ransomware_Ryuk_1A4Ad952 : BETA FILE MEMORY
 		$e1 = { 8B 0A 41 8D 45 01 45 03 C1 48 8D 52 08 41 3B C9 41 0F 45 C5 44 8B E8 49 63 C0 48 3B C3 72 E1 }
 
 	condition:
-		1 of ($e*)
+		1 of ( $e* )
 }
 rule ELASTIC_Windows_Ransomware_Ryuk_72B5Fd9D : BETA FILE MEMORY
 {
@@ -96731,9 +96893,9 @@ rule ELASTIC_Windows_Ransomware_Ryuk_72B5Fd9D : BETA FILE MEMORY
 		date = "2020-04-30"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ryuk.yar#L90-L109"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "b2abc8f70df5d730ce6a7d0bc125bb623f27b292e7d575914368a8bfc0fb5837"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ryuk.yar#L90-L109"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_b2abc8f70df5d730ce6a7d0bc125bb623f27b292e7d575914368a8bfc0fb5837"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -96749,7 +96911,7 @@ rule ELASTIC_Windows_Ransomware_Ryuk_72B5Fd9D : BETA FILE MEMORY
 		$d1 = { 48 2B C3 33 DB 66 89 1C 46 48 83 FF FF 0F }
 
 	condition:
-		1 of ($d*)
+		1 of ( $d* )
 }
 rule ELASTIC_Windows_Ransomware_Ryuk_8Ba51798 : BETA FILE MEMORY
 {
@@ -96760,9 +96922,9 @@ rule ELASTIC_Windows_Ransomware_Ryuk_8Ba51798 : BETA FILE MEMORY
 		date = "2020-04-30"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ryuk.yar#L111-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "0733ae6a7e38bc2a25aa76a816284482d3ee25626559ec5af554b5f5070e534a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ryuk.yar#L111-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_0733ae6a7e38bc2a25aa76a816284482d3ee25626559ec5af554b5f5070e534a"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -96785,7 +96947,7 @@ rule ELASTIC_Windows_Ransomware_Ryuk_8Ba51798 : BETA FILE MEMORY
 		$c8 = "UNIQUE_ID_DO_NOT_REMOVE" wide fullword
 
 	condition:
-		3 of ($c*)
+		3 of ( $c* )
 }
 rule ELASTIC_Windows_Ransomware_Ryuk_88Daaf8E : BETA FILE MEMORY
 {
@@ -96796,9 +96958,9 @@ rule ELASTIC_Windows_Ransomware_Ryuk_88Daaf8E : BETA FILE MEMORY
 		date = "2020-04-30"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ryuk.yar#L139-L158"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "6fc463976c0fb9c3e4f25d854545d07800c63730826f3974298f0077d272cff0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ryuk.yar#L139-L158"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_6fc463976c0fb9c3e4f25d854545d07800c63730826f3974298f0077d272cff0"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -96814,7 +96976,7 @@ rule ELASTIC_Windows_Ransomware_Ryuk_88Daaf8E : BETA FILE MEMORY
 		$f1 = { 48 8B CF E8 AB 25 00 00 85 C0 74 35 }
 
 	condition:
-		1 of ($f*)
+		1 of ( $f* )
 }
 rule ELASTIC_Multi_Hacktool_Stowaway_89F1D452 : FILE MEMORY
 {
@@ -96825,10 +96987,10 @@ rule ELASTIC_Multi_Hacktool_Stowaway_89F1D452 : FILE MEMORY
 		date = "2024-06-28"
 		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Hacktool_Stowaway.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Hacktool_Stowaway.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c073d3be469c8eea0f007bb37c722bad30e06dc994d3a59773838ed8be154c95"
-		logic_hash = "c5db1335fea606ec32f7a6540ee4dee637dd2ad5aee27e092b89fa03ad085690"
+		logic_hash = "v1_sha256_c5db1335fea606ec32f7a6540ee4dee637dd2ad5aee27e092b89fa03ad085690"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96862,10 +97024,10 @@ rule ELASTIC_Windows_Trojan_Bandook_38497690 : FILE MEMORY
 		date = "2022-08-10"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Bandook.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Bandook.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4d079586a51168aac708a9ab7d11a5a49dfe7a16d9ced852fbbc5884020c0c97"
-		logic_hash = "199614993f63636764808313f25199348afdf4d537c8dca06f673559e34636b8"
+		logic_hash = "v1_sha256_199614993f63636764808313f25199348afdf4d537c8dca06f673559e34636b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96896,10 +97058,10 @@ rule ELASTIC_Windows_Ransomware_Lockfile_74185716 : FILE MEMORY
 		date = "2021-08-31"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Lockfile.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Lockfile.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bf315c9c064b887ee3276e1342d43637d8c0e067260946db45942f39b970d7ce"
-		logic_hash = "e922c2fc9dd52dd0238847a9d48691bea90d028cf680fc3a1a0dbdfef1d8dce3"
+		logic_hash = "v1_sha256_e922c2fc9dd52dd0238847a9d48691bea90d028cf680fc3a1a0dbdfef1d8dce3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96928,10 +97090,10 @@ rule ELASTIC_Linux_Ransomware_Lockbit_D248E80E : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Lockbit.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Lockbit.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4800a67ceff340d2ab4f79406a01f58e5a97d589b29b35394b2a82a299b19745"
-		logic_hash = "5d33d243cd7f9d9189139eb34a4dd8d81882be200223d5c8e60dfd07ca98f94b"
+		logic_hash = "v1_sha256_5d33d243cd7f9d9189139eb34a4dd8d81882be200223d5c8e60dfd07ca98f94b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -96951,7 +97113,7 @@ rule ELASTIC_Linux_Ransomware_Lockbit_D248E80E : FILE MEMORY
 		$b5 = "crypto_generichash_blake2b_final" fullword
 
 	condition:
-		$a1 and 2 of ($b*)
+		$a1 and 2 of ( $b* )
 }
 rule ELASTIC_Linux_Ransomware_Lockbit_5B30A04B : FILE MEMORY
 {
@@ -96962,10 +97124,10 @@ rule ELASTIC_Linux_Ransomware_Lockbit_5B30A04B : FILE MEMORY
 		date = "2023-07-29"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Lockbit.yar#L26-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Lockbit.yar#L26-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "41cbb7d79388eaa4d6e704bd4a8bf8f34d486d27277001c343ea3ce112f4fb0d"
-		logic_hash = "b89d0f25f08ffa35e075def6a29cf52a80500c6499732146426a71c741059a3b"
+		logic_hash = "v1_sha256_b89d0f25f08ffa35e075def6a29cf52a80500c6499732146426a71c741059a3b"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -96993,10 +97155,10 @@ rule ELASTIC_Macos_Trojan_Amcleaner_445Bb666 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Amcleaner.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Amcleaner.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c85bf71310882bc0c0cf9b74c9931fd19edad97600bc86ca51cf94ed85a78052"
-		logic_hash = "664829ff761186ec8f3055531b5490b7516756b0aa9d0183d4c17240a5ca44c4"
+		logic_hash = "v1_sha256_664829ff761186ec8f3055531b5490b7516756b0aa9d0183d4c17240a5ca44c4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97022,10 +97184,10 @@ rule ELASTIC_Macos_Trojan_Amcleaner_A91D3907 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Amcleaner.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Amcleaner.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dc9c700f3f6a03ecb6e3f2801d4269599c32abce7bc5e6a1b7e6a64b0e025f58"
-		logic_hash = "e61ceea117acf444a6b137b93d7c335c6eb8a7e13a567177ec4ea44bf64fd5c6"
+		logic_hash = "v1_sha256_e61ceea117acf444a6b137b93d7c335c6eb8a7e13a567177ec4ea44bf64fd5c6"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -97051,10 +97213,10 @@ rule ELASTIC_Macos_Trojan_Amcleaner_8Ce3Fea8 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Amcleaner.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Amcleaner.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c85bf71310882bc0c0cf9b74c9931fd19edad97600bc86ca51cf94ed85a78052"
-		logic_hash = "08c4b5b4afefbf1ee207525f9b28bc7eed7b55cb07f8576fddfa0bbe95002769"
+		logic_hash = "v1_sha256_08c4b5b4afefbf1ee207525f9b28bc7eed7b55cb07f8576fddfa0bbe95002769"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -97080,10 +97242,10 @@ rule ELASTIC_Windows_Ransomware_Nightsky_A7F19411 : FILE MEMORY
 		date = "2022-01-11"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Nightsky.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Nightsky.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577"
-		logic_hash = "defc7ab43035c663302edfda60a4b57cb301b3d61662afe3ce1de2ac93cfc3e2"
+		logic_hash = "v1_sha256_defc7ab43035c663302edfda60a4b57cb301b3d61662afe3ce1de2ac93cfc3e2"
 		score = 75
 		quality = 48
 		tags = "FILE, MEMORY"
@@ -97112,10 +97274,10 @@ rule ELASTIC_Windows_Ransomware_Nightsky_253C4D0D : FILE MEMORY
 		date = "2022-03-14"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Nightsky.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Nightsky.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c940a35025dd3847f7c954a282f65e9c2312d2ada28686f9d1dc73d1c500224"
-		logic_hash = "ba9e6dab664e464e0fdc65bd8bdccc661846d85e7fd8fbf089e72e9e5b71fb17"
+		logic_hash = "v1_sha256_ba9e6dab664e464e0fdc65bd8bdccc661846d85e7fd8fbf089e72e9e5b71fb17"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97141,10 +97303,10 @@ rule ELASTIC_Linux_Exploit_Race_758A0884 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Race.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Race.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a4966baaa34b05cb782071ef114a53cac164e6dece275c862fe96a2cff4a6f06"
-		logic_hash = "ccba0e2ddefd53939cda6b4985def2d487ac5916cbad7374ac3143f02b9f7ff5"
+		logic_hash = "v1_sha256_ccba0e2ddefd53939cda6b4985def2d487ac5916cbad7374ac3143f02b9f7ff5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97170,10 +97332,10 @@ rule ELASTIC_Multi_Ransomware_Akira_21842Eb3 : FILE MEMORY
 		date = "2024-11-21"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Ransomware_Akira.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Ransomware_Akira.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75"
-		logic_hash = "1c50f4da476cef9f9818f8c0117621eae232be0245ad244babe51d493f0a5a48"
+		logic_hash = "v1_sha256_1c50f4da476cef9f9818f8c0117621eae232be0245ad244babe51d493f0a5a48"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97199,10 +97361,10 @@ rule ELASTIC_Linux_Rootkit_Snapekit_01205A75 : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Snapekit.yar#L1-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Snapekit.yar#L1-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "58d1e56fff04affb4c8cbb5fc3ea848e88d1f05c07e6f730e1cf17100ef1b666"
-		logic_hash = "ba9b40481afb29a6db33fe61fe23b9f3895744da6737167788018396987bb533"
+		logic_hash = "v1_sha256_ba9b40481afb29a6db33fe61fe23b9f3895744da6737167788018396987bb533"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -97254,7 +97416,7 @@ rule ELASTIC_Linux_Rootkit_Snapekit_01205A75 : FILE MEMORY
 		$hook26 = "hooked_udp6_seq_show"
 
 	condition:
-		3 of ($str*) or 3 of ($func*) or 5 of ($hook*)
+		3 of ( $str* ) or 3 of ( $func* ) or 5 of ( $hook* )
 }
 rule ELASTIC_Windows_Hacktool_Iox_98Cd1Cd8 : FILE MEMORY
 {
@@ -97265,10 +97427,10 @@ rule ELASTIC_Windows_Hacktool_Iox_98Cd1Cd8 : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-01-29"
 		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Iox.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Iox.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d4544a521d4e6eb07336816b1aae54f92c5c4fd2eb31dcfbdf26e4ef890e73db"
-		logic_hash = "d7f9e4f399410d54416e974fbd66b2caa27359ae0f2e33e01d62f1aa618daa34"
+		logic_hash = "v1_sha256_d7f9e4f399410d54416e974fbd66b2caa27359ae0f2e33e01d62f1aa618daa34"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97297,10 +97459,10 @@ rule ELASTIC_Linux_Cryptominer_Xpaj_Fdbd614E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Xpaj.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Xpaj.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3e2b1b36981713217301dd02db33fb01458b3ff47f28dfdc795d8d1d332f13ea"
-		logic_hash = "70e6450f98411750361481aaad0d3ea079f58b1ae09970f04da09c20137a50fa"
+		logic_hash = "v1_sha256_70e6450f98411750361481aaad0d3ea079f58b1ae09970f04da09c20137a50fa"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -97326,10 +97488,10 @@ rule ELASTIC_Windows_Trojan_Sysjoker_1Ef19A12 : FILE MEMORY
 		date = "2022-02-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SysJoker.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SysJoker.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc"
-		logic_hash = "25bd58d546549d208f9f95f4c27d1e58f86f87750dae1e293544cc92b25f8b32"
+		logic_hash = "v1_sha256_25bd58d546549d208f9f95f4c27d1e58f86f87750dae1e293544cc92b25f8b32"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97358,10 +97520,10 @@ rule ELASTIC_Windows_Trojan_Sysjoker_34559Bcd : FILE MEMORY
 		date = "2022-02-21"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SysJoker.yar#L24-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SysJoker.yar#L24-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c"
-		logic_hash = "ebe7f6037f14e37b6efe81614c06c6d26fe0cc17d0475b8b19715f80d0d9aad3"
+		logic_hash = "v1_sha256_ebe7f6037f14e37b6efe81614c06c6d26fe0cc17d0475b8b19715f80d0d9aad3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97393,10 +97555,10 @@ rule ELASTIC_Linux_Ransomware_Esxiargs_75A8Ec04 : FILE MEMORY
 		date = "2023-02-09"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Esxiargs.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Esxiargs.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
-		logic_hash = "7316cab75c1bcf41ae6c96afa41ef96c37ab1bb679f36a0cc1dd08002a357165"
+		logic_hash = "v1_sha256_7316cab75c1bcf41ae6c96afa41ef96c37ab1bb679f36a0cc1dd08002a357165"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97426,10 +97588,10 @@ rule ELASTIC_Windows_Trojan_Avemaria_31D2Bce9 : FILE MEMORY
 		date = "2021-05-30"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_AveMaria.yar#L1-L31"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_AveMaria.yar#L1-L31"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b"
-		logic_hash = "7ba59c3be07e35b415719b60b14a0f629619e5729c20f50f00dbea0c2f8bd026"
+		logic_hash = "v1_sha256_7ba59c3be07e35b415719b60b14a0f629619e5729c20f50f00dbea0c2f8bd026"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97456,7 +97618,7 @@ rule ELASTIC_Windows_Trojan_Avemaria_31D2Bce9 : FILE MEMORY
 		$a13 = "Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper" wide fullword
 
 	condition:
-		8 of ($a*)
+		8 of ( $a* )
 }
 rule ELASTIC_Linux_Exploit_Moogrey_81131B66 : FILE MEMORY
 {
@@ -97467,10 +97629,10 @@ rule ELASTIC_Linux_Exploit_Moogrey_81131B66 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Moogrey.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Moogrey.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cc27b9755bd9feb1fb2c510f66e36c20a1503e6769cdaeee2bea7fe962d22ccc"
-		logic_hash = "dc2fe7caa38f665d24bbc673ff63491ebdeec8d56a420092243ce241238846cf"
+		logic_hash = "v1_sha256_dc2fe7caa38f665d24bbc673ff63491ebdeec8d56a420092243ce241238846cf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97496,10 +97658,10 @@ rule ELASTIC_Windows_Vulndriver_Glckio_39C4Abd4 : FILE
 		date = "2022-04-04"
 		modified = "2022-08-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_GlckIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_GlckIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25"
-		logic_hash = "fd43503c9427a386674c06bb790e110ac23c27d8fc4adedbaa8a9b7cb0cbafd4"
+		logic_hash = "v1_sha256_fd43503c9427a386674c06bb790e110ac23c27d8fc4adedbaa8a9b7cb0cbafd4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -97514,7 +97676,7 @@ rule ELASTIC_Windows_Vulndriver_Glckio_39C4Abd4 : FILE
 		$str1 = "\\GLCKIO2.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $str1
 }
 rule ELASTIC_Windows_Vulndriver_Glckio_68D5Afbb : FILE
 {
@@ -97525,10 +97687,10 @@ rule ELASTIC_Windows_Vulndriver_Glckio_68D5Afbb : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_GlckIo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_GlckIo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a"
-		logic_hash = "0b5f0d408a5c4089ef496c5f8241a34d0468cc3d21e89e41dc105a0df0855d38"
+		logic_hash = "v1_sha256_0b5f0d408a5c4089ef496c5f8241a34d0468cc3d21e89e41dc105a0df0855d38"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -97543,7 +97705,7 @@ rule ELASTIC_Windows_Vulndriver_Glckio_68D5Afbb : FILE
 		$str1 = "[GLKIO2] Cannot resolve ZwQueryInformationProcess"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $str1
 }
 rule ELASTIC_Windows_Hacktool_Processhacker_3D01069E : FILE
 {
@@ -97554,10 +97716,10 @@ rule ELASTIC_Windows_Hacktool_Processhacker_3D01069E : FILE
 		date = "2022-03-30"
 		modified = "2022-03-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_ProcessHacker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_ProcessHacker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
-		logic_hash = "bcba74aa20b62329c48060bfebaf49ab12f89f9ec3a09fc0c0cb702de5e2b940"
+		logic_hash = "v1_sha256_bcba74aa20b62329c48060bfebaf49ab12f89f9ec3a09fc0c0cb702de5e2b940"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -97572,7 +97734,7 @@ rule ELASTIC_Windows_Hacktool_Processhacker_3D01069E : FILE
 		$original_file_name = "OriginalFilename\x00kprocesshacker.sys" wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name
 }
 rule ELASTIC_Linux_Hacktool_Bruteforce_Bad95Bd6 : FILE MEMORY
 {
@@ -97583,10 +97745,10 @@ rule ELASTIC_Linux_Hacktool_Bruteforce_Bad95Bd6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Bruteforce.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Bruteforce.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8e8be482357ebddc6ac3ea9ee60241d011063f7e558a59e6bd119e72e4862024"
-		logic_hash = "8001e6503baeb52c66c9b30026544913270085406a1fe4c45d14629811d36d5f"
+		logic_hash = "v1_sha256_8001e6503baeb52c66c9b30026544913270085406a1fe4c45d14629811d36d5f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97612,10 +97774,10 @@ rule ELASTIC_Linux_Hacktool_Bruteforce_66A14C03 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Bruteforce.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Bruteforce.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a2d8e2c34ae95243477820583c0b00dfe3f475811d57ffb95a557a227f94cd55"
-		logic_hash = "c8b2925c2e3f95e78f117ddd52e208d143d19ee75e9283f7f15d10e930eaac5f"
+		logic_hash = "v1_sha256_c8b2925c2e3f95e78f117ddd52e208d143d19ee75e9283f7f15d10e930eaac5f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97641,10 +97803,10 @@ rule ELASTIC_Linux_Hacktool_Bruteforce_Eb83B6Aa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Bruteforce.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Bruteforce.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8dec88576f61f37fbaece3c30e71d338c340c8fb9c231f9d7b1c32510d2c3167"
-		logic_hash = "bc79860e414d07ee8000eea3d61827272d66faa90a8bf6c65fcda90a4bd762ef"
+		logic_hash = "v1_sha256_bc79860e414d07ee8000eea3d61827272d66faa90a8bf6c65fcda90a4bd762ef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97670,10 +97832,10 @@ rule ELASTIC_Windows_Vulndriver_Dbutil_Ffe07C79 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_DBUtil.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_DBUtil.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3"
-		logic_hash = "18b1c93c395b105f446b4c968441e0a43e42b1bd7efcf6501a89eb92cbd21824"
+		logic_hash = "v1_sha256_18b1c93c395b105f446b4c968441e0a43e42b1bd7efcf6501a89eb92cbd21824"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -97688,7 +97850,7 @@ rule ELASTIC_Windows_Vulndriver_Dbutil_Ffe07C79 : FILE
 		$str1 = "\\DBUtilDrv2_32.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Vulndriver_Dbutil_852Ba283 : FILE
 {
@@ -97699,10 +97861,10 @@ rule ELASTIC_Windows_Vulndriver_Dbutil_852Ba283 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_DBUtil.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_DBUtil.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
-		logic_hash = "78acd081c2517f9c53cb311481c0cc40cc3699b222afc290da1a3698e7bf75b7"
+		logic_hash = "v1_sha256_78acd081c2517f9c53cb311481c0cc40cc3699b222afc290da1a3698e7bf75b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -97717,7 +97879,7 @@ rule ELASTIC_Windows_Vulndriver_Dbutil_852Ba283 : FILE
 		$str1 = "\\DBUtilDrv2_64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Ransomware_Clop_728Cf32A : FILE MEMORY
 {
@@ -97728,10 +97890,10 @@ rule ELASTIC_Linux_Ransomware_Clop_728Cf32A : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Clop.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Clop.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef"
-		logic_hash = "31c2fdfcfc46ad1dd69489536172937b9771d8505f36c7bd8dc796f40a2fe4d2"
+		logic_hash = "v1_sha256_31c2fdfcfc46ad1dd69489536172937b9771d8505f36c7bd8dc796f40a2fe4d2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97760,9 +97922,9 @@ rule ELASTIC_Linux_Trojan_Setag_351Eeb76 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Setag.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "3519d9e4bfa18c19b49d0fa15ef78151bd13db9614406c4569720d20830f3cbb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Setag.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_3519d9e4bfa18c19b49d0fa15ef78151bd13db9614406c4569720d20830f3cbb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97788,10 +97950,10 @@ rule ELASTIC_Linux_Trojan_Setag_01E2F79B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Setag.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Setag.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b5e8486174026491341a750f6367959999bbacd3689215f59a62dbb13a45fcc"
-		logic_hash = "1e0336760f364acbbe0e8aec10bc7bfb48ed7e33cde56d8914617664cb93fd9b"
+		logic_hash = "v1_sha256_1e0336760f364acbbe0e8aec10bc7bfb48ed7e33cde56d8914617664cb93fd9b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97817,10 +97979,10 @@ rule ELASTIC_Multi_Hacktool_Nps_C6Eb4A27 : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-01-29"
 		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Hacktool_Nps.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Hacktool_Nps.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4714e8ad9c625070ca0a151ffc98d87d8e5da7c8ef42037ca5f43baede6cfac1"
-		logic_hash = "53baf04f4ab8967761c6badb24f6632cc1bf4a448abf0049318b96855f30feea"
+		logic_hash = "v1_sha256_53baf04f4ab8967761c6badb24f6632cc1bf4a448abf0049318b96855f30feea"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -97851,10 +98013,10 @@ rule ELASTIC_Multi_Hacktool_Nps_F76F257D : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-01-29"
 		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Hacktool_Nps.yar#L27-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Hacktool_Nps.yar#L27-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "80721b20a8667536a33fca50236f5c8e0c0d07aa7805b980e40818ab92cd9f4a"
-		logic_hash = "0bbd7f86bfd2967dc390510c2e403d05e1b56551b965ea716b9e5330f75c9bd5"
+		logic_hash = "v1_sha256_0bbd7f86bfd2967dc390510c2e403d05e1b56551b965ea716b9e5330f75c9bd5"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -97884,10 +98046,10 @@ rule ELASTIC_Linux_Exploit_CVE_2021_3490_D369D615 : FILE MEMORY CVE_2021_3490
 		date = "2021-11-12"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2021_3490.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2021_3490.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e65ba616942fd1e893e10898d546fe54458debbc42e0d6826aff7a4bb4b2cf19"
-		logic_hash = "6fa4b36366d2c255f5ccf0e22a06c7e17df74fddd06963787dbcd713b3e8aca6"
+		logic_hash = "v1_sha256_6fa4b36366d2c255f5ccf0e22a06c7e17df74fddd06963787dbcd713b3e8aca6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2021-3490"
@@ -97924,10 +98086,10 @@ rule ELASTIC_Windows_Trojan_Hotpage_414F235F : FILE MEMORY
 		date = "2024-07-18"
 		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_HotPage.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_HotPage.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b8464126b64c809b4ab47aa91c5f322ce2c0ae4fd668a43de738a5caa7567225"
-		logic_hash = "cfa0036b22a83a5396b3f9014511720071246a775053ad493791ebc1212400f2"
+		logic_hash = "v1_sha256_cfa0036b22a83a5396b3f9014511720071246a775053ad493791ebc1212400f2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -97948,7 +98110,7 @@ rule ELASTIC_Windows_Trojan_Hotpage_414F235F : FILE MEMORY
 		$s6 = "[%s] ADDbrowser PID ->[%d]"
 
 	condition:
-		$SpcSpOpusInfo or 2 of ($s*)
+		$SpcSpOpusInfo or 2 of ( $s* )
 }
 rule ELASTIC_Linux_Trojan_Chinaz_A2140Ca1 : FILE MEMORY
 {
@@ -97959,10 +98121,10 @@ rule ELASTIC_Linux_Trojan_Chinaz_A2140Ca1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Chinaz.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Chinaz.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7c44c2ca77ef7a62446f6266a757817a6c9af5e010a219a43a1905e2bc5725b0"
-		logic_hash = "c9c63114e45b45b1c243af1f719cddc838a06a1f35d65dca6a2fb5574047eff0"
+		logic_hash = "v1_sha256_c9c63114e45b45b1c243af1f719cddc838a06a1f35d65dca6a2fb5574047eff0"
 		score = 60
 		quality = 45
 		tags = "FILE, MEMORY"
@@ -97988,10 +98150,10 @@ rule ELASTIC_Windows_Trojan_Matanbuchus_B521801B : FILE MEMORY
 		date = "2022-03-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Matanbuchus.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Matanbuchus.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
-		logic_hash = "609a0941b118d737124a5cd9c98c007e21557a239cfa3cf97cd3b4348c934f03"
+		logic_hash = "v1_sha256_609a0941b118d737124a5cd9c98c007e21557a239cfa3cf97cd3b4348c934f03"
 		score = 75
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -98020,10 +98182,10 @@ rule ELASTIC_Windows_Trojan_Matanbuchus_4Ce9Affb : FILE MEMORY
 		date = "2022-03-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Matanbuchus.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Matanbuchus.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
-		logic_hash = "16441eb4617b6b3cb1e7d600959a5cbfe15c72c00361b45551b7ef4c81f78462"
+		logic_hash = "v1_sha256_16441eb4617b6b3cb1e7d600959a5cbfe15c72c00361b45551b7ef4c81f78462"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98049,10 +98211,10 @@ rule ELASTIC_Windows_Trojan_Matanbuchus_58A61Aaa : FILE MEMORY
 		date = "2022-03-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Matanbuchus.yar#L44-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Matanbuchus.yar#L44-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
-		logic_hash = "7226e2f61bd6f1cca15c1f3f8d8697cb277d1e214f756295ffda5bc16304cc49"
+		logic_hash = "v1_sha256_7226e2f61bd6f1cca15c1f3f8d8697cb277d1e214f756295ffda5bc16304cc49"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98078,10 +98240,10 @@ rule ELASTIC_Windows_Trojan_Matanbuchus_C7811Ccc : FILE MEMORY
 		date = "2022-03-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Matanbuchus.yar#L64-L82"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Matanbuchus.yar#L64-L82"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
-		logic_hash = "e65dc05f6d9289a42c05afdc4da0ce1c18c1129dd87688a277ece925e83d7ef1"
+		logic_hash = "v1_sha256_e65dc05f6d9289a42c05afdc4da0ce1c18c1129dd87688a277ece925e83d7ef1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98107,10 +98269,10 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_17Ee6A17 : FILE MEMORY
 		date = "2021-06-12"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RedLineStealer.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RedLineStealer.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "497bc53c1c75003fe4ae3199b0ff656c085f21dffa71d00d7a3a33abce1a3382"
-		logic_hash = "0c868d0673c01e2c115d6822c34c877db77265251167f3a890a448a1de5c6a2d"
+		logic_hash = "v1_sha256_0c868d0673c01e2c115d6822c34c877db77265251167f3a890a448a1de5c6a2d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98133,7 +98295,7 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_17Ee6A17 : FILE MEMORY
 		$b6 = "<GrabUserAgent>k__BackingField" ascii fullword
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		1 of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Redlinestealer_F54632Eb : FILE MEMORY
 {
@@ -98144,10 +98306,10 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_F54632Eb : FILE MEMORY
 		date = "2021-06-12"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RedLineStealer.yar#L29-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RedLineStealer.yar#L29-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25"
-		logic_hash = "1779919556ee5c9a78342aabafb8408e035cb39632b25c54da6bf195894901dc"
+		logic_hash = "v1_sha256_1779919556ee5c9a78342aabafb8408e035cb39632b25c54da6bf195894901dc"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -98171,7 +98333,7 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_F54632Eb : FILE MEMORY
 		$a10 = "DataManager.Data.Credentials" ascii fullword
 
 	condition:
-		6 of ($a*)
+		6 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Redlinestealer_3D9371Fd : FILE MEMORY
 {
@@ -98182,10 +98344,10 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_3D9371Fd : FILE MEMORY
 		date = "2022-02-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RedLineStealer.yar#L58-L82"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RedLineStealer.yar#L58-L82"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a"
-		logic_hash = "1c8a64ce7615f502602ab960638dd55f4deaeea3b49d894274d64d4d0b6a1d10"
+		logic_hash = "v1_sha256_1c8a64ce7615f502602ab960638dd55f4deaeea3b49d894274d64d4d0b6a1d10"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -98217,10 +98379,10 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_63E7E006 : FILE MEMORY
 		date = "2023-05-01"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RedLineStealer.yar#L84-L104"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RedLineStealer.yar#L84-L104"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e062c99dc9f3fa780ea9c6249fa4ef96bbe17fd1df38dbe11c664a10a92deece"
-		logic_hash = "2085eaf622b52372124e9b23d19e3e4a7fdb7a4559ad9a09216c1cbae96ca5b6"
+		logic_hash = "v1_sha256_2085eaf622b52372124e9b23d19e3e4a7fdb7a4559ad9a09216c1cbae96ca5b6"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -98248,10 +98410,10 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_F07B3Cb4 : FILE MEMORY
 		date = "2023-05-03"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RedLineStealer.yar#L106-L125"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RedLineStealer.yar#L106-L125"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5e491625475fc25c465fc7f6db98def189c15a133af7d0ac1ecbc8d887c4feb6"
-		logic_hash = "64536e3b340254554154ac1b33adfb4f3c72a2c6c0d1ef27827621b905d431c5"
+		logic_hash = "v1_sha256_64536e3b340254554154ac1b33adfb4f3c72a2c6c0d1ef27827621b905d431c5"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -98278,10 +98440,10 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_4Df4Bcb6 : FILE MEMORY
 		date = "2023-05-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RedLineStealer.yar#L127-L145"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RedLineStealer.yar#L127-L145"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9389475bd26c1d3fd04a083557f2797d0ee89dfdd1f7de67775fcd19e61dfbb3"
-		logic_hash = "d9027fa9c8d9c938159a734431bb2be67fd7cca1f898c2208f7b909157524da4"
+		logic_hash = "v1_sha256_d9027fa9c8d9c938159a734431bb2be67fd7cca1f898c2208f7b909157524da4"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -98307,10 +98469,10 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_15Ee6903 : FILE MEMORY
 		date = "2023-05-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RedLineStealer.yar#L147-L166"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RedLineStealer.yar#L147-L166"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "46b506cafb2460ca2969f69bcb0ee0af63b6d65e6b2a6249ef7faa21bde1a6bd"
-		logic_hash = "22c8a1f4b5b94261cfabdbcc00e45b9437a0132d4e9d4543b734d4f303336696"
+		logic_hash = "v1_sha256_22c8a1f4b5b94261cfabdbcc00e45b9437a0132d4e9d4543b734d4f303336696"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -98337,10 +98499,10 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_6Dfafd7B : FILE MEMORY
 		date = "2024-01-05"
 		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RedLineStealer.yar#L168-L186"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RedLineStealer.yar#L168-L186"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "809e303ba26b894f006b8f2d3983ff697aef13b67c36957d98c56aae9afd8852"
-		logic_hash = "888bc2fdfae8673cd6bce56fc9894b3cab6d7e3c384d854d6bc8aef47fdecf1c"
+		logic_hash = "v1_sha256_888bc2fdfae8673cd6bce56fc9894b3cab6d7e3c384d854d6bc8aef47fdecf1c"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -98366,10 +98528,10 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_983Cd7A7 : FILE MEMORY
 		date = "2024-03-27"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_RedLineStealer.yar#L188-L208"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_RedLineStealer.yar#L188-L208"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7aa20c57b8815dd63c8ae951e1819c75b5d2deec5aae0597feec878272772f35"
-		logic_hash = "2104bad5ec42bc72ec611607a53086a85359bdb4bf084d7377e9a8e234b0e928"
+		logic_hash = "v1_sha256_2104bad5ec42bc72ec611607a53086a85359bdb4bf084d7377e9a8e234b0e928"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98388,6 +98550,41 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_983Cd7A7 : FILE MEMORY
 	condition:
 		all of them
 }
+rule ELASTIC_Multi_Trojan_Gosar_31Dba745 : FILE MEMORY
+{
+	meta:
+		description = "Detects Multi Trojan Gosar (Multi.Trojan.Gosar)"
+		author = "Elastic Security"
+		id = "31dba745-8079-4161-9299-84a4c33b95c8"
+		date = "2024-11-05"
+		modified = "2024-12-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_Gosar.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		hash = "4caf4b280e61745ce53f96f48a74dea3b69df299c3b9de78ba4731b83c76c334"
+		logic_hash = "v1_sha256_116fb9c44a992067d50cd95715ffa320c6141f133eb8c9dc91b2db8559a8ee2d"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "87e44b3050eb33edb24ad8aa8923ed91124f2e92e4eae42e94decefc49ccbf4c"
+		severity = 100
+		arch_context = "x86, arm64"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "multi"
+
+	strings:
+		$a1 = "GetRecoverAccounts"
+		$a2 = "GetIsFirstScreen"
+		$a3 = "DoWebcamStop"
+		$a4 = "DoAskElevate"
+		$a5 = "vibrant/proto/pb"
+		$a6 = "vibrant/network/sender"
+		$a7 = "vibrant/pkg/helpers"
+
+	condition:
+		3 of them
+}
 rule ELASTIC_Linux_Exploit_Local_47C64Fb6 : FILE MEMORY
 {
 	meta:
@@ -98397,10 +98594,10 @@ rule ELASTIC_Linux_Exploit_Local_47C64Fb6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0caa9035027ff88788e6b8e43bfc012a367a12148be809555c025942054a6360"
-		logic_hash = "7d977edd5fc90c6f03ed5558c690b3dd2102bbff9d7e5124403276405e15201b"
+		logic_hash = "v1_sha256_7d977edd5fc90c6f03ed5558c690b3dd2102bbff9d7e5124403276405e15201b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98426,10 +98623,10 @@ rule ELASTIC_Linux_Exploit_Local_76C24B62 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "330de2ca1add7e06389d94dfc541c367a484394c51663b26d27d89346b08ad1b"
-		logic_hash = "ff55d6a316394812cfa1108578aece91050bfb2f7e0f8c0440dcb64156f3e893"
+		logic_hash = "v1_sha256_ff55d6a316394812cfa1108578aece91050bfb2f7e0f8c0440dcb64156f3e893"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98455,10 +98652,10 @@ rule ELASTIC_Linux_Exploit_Local_30C21B03 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a09c81f185a4ceed134406fa7fefdfa7d8dfc10d639dd044c94fbb6d570fa029"
-		logic_hash = "396965c457b2e02d7d524d9d5fb3cc76852895ed9675c7b1205a94f47ba10144"
+		logic_hash = "v1_sha256_396965c457b2e02d7d524d9d5fb3cc76852895ed9675c7b1205a94f47ba10144"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98484,10 +98681,10 @@ rule ELASTIC_Linux_Exploit_Local_9Ace9649 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b38869605521531153cfd8077f05e0d6b52dca0fffbc627a4d5eaa84855a491c"
-		logic_hash = "d7a60b0cb7fcbd9e802660bda3e0456f7f4ef9db38b6dab131c160efce48909e"
+		logic_hash = "v1_sha256_d7a60b0cb7fcbd9e802660bda3e0456f7f4ef9db38b6dab131c160efce48909e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98513,10 +98710,10 @@ rule ELASTIC_Linux_Exploit_Local_705C9589 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "845727ea46491b46a665d4e1a3a9dbbe6cd0536d070f1c1efd533b91b75cdc88"
-		logic_hash = "9834d564c2acc688750d5e6c53db7c1201ef85c6fb3d1d0ea2425a5ba905ff18"
+		logic_hash = "v1_sha256_9834d564c2acc688750d5e6c53db7c1201ef85c6fb3d1d0ea2425a5ba905ff18"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98542,10 +98739,10 @@ rule ELASTIC_Linux_Exploit_Local_A677Fb9C : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d20b260c7485173264e3e674adc7563ea3891224a3dc98bdd342ebac4a1349e8"
-		logic_hash = "9b43e651f73d17dbd2143cec4c79929723689ce738924588e38c99a9554e5545"
+		logic_hash = "v1_sha256_9b43e651f73d17dbd2143cec4c79929723689ce738924588e38c99a9554e5545"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98571,10 +98768,10 @@ rule ELASTIC_Linux_Exploit_Local_78E50162 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "706c865257d5e1f5f434ae0f31e11dfc7e16423c4c639cb2763ec0f51bc73300"
-		logic_hash = "10a5bef486ec0ececfe0a9edfcad7ce053da2a97028cd1648aa27572fedd8ef6"
+		logic_hash = "v1_sha256_10a5bef486ec0ececfe0a9edfcad7ce053da2a97028cd1648aa27572fedd8ef6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98600,10 +98797,10 @@ rule ELASTIC_Linux_Exploit_Local_3B767A1F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e05fed9e514cccbdb775f295327d8f8838b73ad12f25e7bb0b9d607ff3d0511c"
-		logic_hash = "0f24a7d4e8ff0899430aa0a702000f35039b07400120b382b675825630f0ea4e"
+		logic_hash = "v1_sha256_0f24a7d4e8ff0899430aa0a702000f35039b07400120b382b675825630f0ea4e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98629,10 +98826,10 @@ rule ELASTIC_Linux_Exploit_Local_2535C9B6 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d0f9cc114f6a1f788f36e359e03a9bbf89c075f41aec006229b6ad20ebbfba0b"
-		logic_hash = "222e929d8352ed02714a59b0e1b9777b0f2d80d63cb369fa9bf33460c84efbb2"
+		logic_hash = "v1_sha256_222e929d8352ed02714a59b0e1b9777b0f2d80d63cb369fa9bf33460c84efbb2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98658,10 +98855,10 @@ rule ELASTIC_Linux_Exploit_Local_6A9B5D50 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "80ab71dc9ed2131b08b5b75b5a4a12719d499c6b6ee6819ad5a6626df4a1b862"
-		logic_hash = "99a18bfb62c195bdea89c688fed4456fee33477878ecdee8a78cd4bf18ad539b"
+		logic_hash = "v1_sha256_99a18bfb62c195bdea89c688fed4456fee33477878ecdee8a78cd4bf18ad539b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98687,10 +98884,10 @@ rule ELASTIC_Linux_Exploit_Local_66557224 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f58151a2f653972e744822cdc420ab1c2b8b642877d3dfa2e8b2b6915e8edf40"
-		logic_hash = "5583f086d594ebdf5890a8a5fbee5c04fbddfe42adcae07480532d87e474ef0c"
+		logic_hash = "v1_sha256_5583f086d594ebdf5890a8a5fbee5c04fbddfe42adcae07480532d87e474ef0c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98716,10 +98913,10 @@ rule ELASTIC_Linux_Exploit_Local_6229602F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Local.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Local.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4fdb15663a405f6fc4379aad9a5021040d7063b8bb82403bedb9578d45d428fa"
-		logic_hash = "c3ab6a36c0c2d430d576f7c0cfdc6d1affcd99d007e2d05596677da9bda5a19e"
+		logic_hash = "v1_sha256_c3ab6a36c0c2d430d576f7c0cfdc6d1affcd99d007e2d05596677da9bda5a19e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98745,9 +98942,9 @@ rule ELASTIC_Linux_Trojan_Marut_47Af730D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Marut.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "048ce8059be6697c5f507fb1912ac2adcedab87c75583dd84700984e6d0d81e6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Marut.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_048ce8059be6697c5f507fb1912ac2adcedab87c75583dd84700984e6d0d81e6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98773,10 +98970,10 @@ rule ELASTIC_Windows_Wiper_Hermeticwiper_7206A969 : FILE MEMORY
 		date = "2022-02-24"
 		modified = "2022-02-24"
 		reference = "https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Wiper_HermeticWiper.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Wiper_HermeticWiper.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
-		logic_hash = "84c61b8223a6ebf1ccfa4fdccee3c9091abca4553e55ac6c2492cff5503b4774"
+		logic_hash = "v1_sha256_84c61b8223a6ebf1ccfa4fdccee3c9091abca4553e55ac6c2492cff5503b4774"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98807,9 +99004,9 @@ rule ELASTIC_Macos_Exploit_Log4J_75A13888 : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Exploit_Log4j.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "b09d8dd9c422e7eb8aa23f8b1204d31fd290252925099300d6d19d73e562ca5e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Exploit_Log4j.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_b09d8dd9c422e7eb8aa23f8b1204d31fd290252925099300d6d19d73e562ca5e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98830,7 +99027,7 @@ rule ELASTIC_Macos_Exploit_Log4J_75A13888 : FILE MEMORY
 		$exp4 = "Exploit.java"
 
 	condition:
-		2 of ($jndi*) and 1 of ($exp*)
+		2 of ( $jndi* ) and 1 of ( $exp* )
 }
 rule ELASTIC_Macos_Trojan_Sugarloader_E7E1D99C : FILE MEMORY
 {
@@ -98841,10 +99038,10 @@ rule ELASTIC_Macos_Trojan_Sugarloader_E7E1D99C : FILE MEMORY
 		date = "2023-10-24"
 		modified = "2023-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_SugarLoader.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_SugarLoader.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940"
-		logic_hash = "0689b704add81e8e7968d9dba5f60d45c8791209330f4ee97e218f8eeb22c88f"
+		logic_hash = "v1_sha256_0689b704add81e8e7968d9dba5f60d45c8791209330f4ee97e218f8eeb22c88f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98863,7 +99060,7 @@ rule ELASTIC_Macos_Trojan_Sugarloader_E7E1D99C : FILE MEMORY
 		$seq_recieve_msg = { 45 85 FF 74 ?? 45 39 EF BA ?? ?? ?? ?? 41 0F 42 D7 41 8B 3C 24 48 89 DE 31 C9 E8 ?? ?? ?? ?? 41 29 C7 48 01 C3 48 85 C0 7F ?? B8 ?? ?? ?? ?? EB ?? }
 
 	condition:
-		3 of ($seq*)
+		3 of ( $seq* )
 }
 rule ELASTIC_Linux_Cryptominer_Ursu_3C05F8Ab : FILE MEMORY
 {
@@ -98874,10 +99071,10 @@ rule ELASTIC_Linux_Cryptominer_Ursu_3C05F8Ab : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Ursu.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Ursu.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d72361010184f5a48386860918052dbb8726d40e860ea0287994936702577956"
-		logic_hash = "8261e4ee40131cd7df61914cd7bdf154e8a2b5fa3abd9d301436f9371253f510"
+		logic_hash = "v1_sha256_8261e4ee40131cd7df61914cd7bdf154e8a2b5fa3abd9d301436f9371253f510"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98903,10 +99100,10 @@ rule ELASTIC_Linux_Ransomware_Limpdemon_95C748E0 : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_LimpDemon.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_LimpDemon.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a4200e90a821a2f2eb3056872f06cf5b057be154dcc410274955b2aaca831651"
-		logic_hash = "e66906725c0af657d91771642908ac0b2c72a97c4d4f651dcc907c2c1437f2da"
+		logic_hash = "v1_sha256_e66906725c0af657d91771642908ac0b2c72a97c4d4f651dcc907c2c1437f2da"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98935,10 +99132,10 @@ rule ELASTIC_Windows_Trojan_Wikiloader_C57F3F88 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_WikiLoader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_WikiLoader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0f71b1805d7feb6830b856c5a5328d3a132af4c37fcd747d82beb0f61c77f6f5"
-		logic_hash = "408c6d811232dbd0c87f75fd28508366151cf9f2f10f012919588db1919e406b"
+		logic_hash = "v1_sha256_408c6d811232dbd0c87f75fd28508366151cf9f2f10f012919588db1919e406b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98964,10 +99161,10 @@ rule ELASTIC_Windows_Trojan_Wikiloader_99681F1C : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_WikiLoader.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_WikiLoader.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0b02cfe16ac73f2e7dc52eaf3b93279b7d02b3d64d061782dfed0c55ab621a8e"
-		logic_hash = "fb293d74186e778856780377120ac2ebe9550a508a0b33e706c39f93a5509df8"
+		logic_hash = "v1_sha256_fb293d74186e778856780377120ac2ebe9550a508a0b33e706c39f93a5509df8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -98993,10 +99190,10 @@ rule ELASTIC_Linux_Trojan_Sckit_A244328F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sckit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sckit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "685da66303a007322d235b7808190c3ea78a828679277e8e03e6d8d511df0a30"
-		logic_hash = "8001c9fcf9f8b70c3e27554156b0b26ddcd6cab36bf97cf3b89a4c43c9ad883c"
+		logic_hash = "v1_sha256_8001c9fcf9f8b70c3e27554156b0b26ddcd6cab36bf97cf3b89a4c43c9ad883c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99022,10 +99219,10 @@ rule ELASTIC_Windows_Trojan_Hawkeye_77C36Ace : FILE MEMORY
 		date = "2021-08-16"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Hawkeye.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Hawkeye.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "28e28025060f1bafd4eb96c7477cab73497ca2144b52e664b254c616607d94cd"
-		logic_hash = "e8c1060efde0c4a073247d03a19dedb1c0acc8506fbf6eac93ac44f00fc73be1"
+		logic_hash = "v1_sha256_e8c1060efde0c4a073247d03a19dedb1c0acc8506fbf6eac93ac44f00fc73be1"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -99055,10 +99252,10 @@ rule ELASTIC_Windows_Trojan_Hawkeye_975D546C : FILE MEMORY
 		date = "2023-03-23"
 		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Hawkeye.yar#L25-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Hawkeye.yar#L25-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "aca133bf1d72cf379101e6877871979d6e6e8bc4cc692a5ba815289735014340"
-		logic_hash = "cbd8ce991059f961236a4bb83ea5a78efa661199b40fca8b09550856e932198b"
+		logic_hash = "v1_sha256_cbd8ce991059f961236a4bb83ea5a78efa661199b40fca8b09550856e932198b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99089,10 +99286,10 @@ rule ELASTIC_Windows_Hacktool_Sharpsccm_9Bef8Dab : FILE MEMORY
 		date = "2024-03-25"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpSCCM.yar#L1-L31"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpSCCM.yar#L1-L31"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2e169c4fd16627029445bb0365a2f9ee61ab6b3757b8ad02fd210ce85dc9c97f"
-		logic_hash = "560c780934a63b3c857a09841c09cbc350205868c696fac958e249e1379cc865"
+		logic_hash = "v1_sha256_560c780934a63b3c857a09841c09cbc350205868c696fac958e249e1379cc865"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99119,7 +99316,7 @@ rule ELASTIC_Windows_Hacktool_Sharpsccm_9Bef8Dab : FILE MEMORY
 		$s12 = "CCM_POST" wide fullword
 
 	condition:
-		($name and 2 of ($s*)) or 7 of ($s*)
+		($name and 2 of ( $s* ) ) or 7 of ( $s* )
 }
 rule ELASTIC_Linux_Exploit_Sorso_Ecf99F8F : FILE MEMORY
 {
@@ -99130,10 +99327,10 @@ rule ELASTIC_Linux_Exploit_Sorso_Ecf99F8F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Sorso.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Sorso.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
-		logic_hash = "c771ff109e548e37134cd76ac668f0d4abafcf262de12b00236ad94fc11a99d1"
+		logic_hash = "v1_sha256_c771ff109e548e37134cd76ac668f0d4abafcf262de12b00236ad94fc11a99d1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99159,10 +99356,10 @@ rule ELASTIC_Linux_Exploit_Sorso_91A4D487 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Sorso.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Sorso.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
-		logic_hash = "bb58c78ae3cc730aa1ef32974f65adabd63972ef181696aeb79954f904f2f405"
+		logic_hash = "v1_sha256_bb58c78ae3cc730aa1ef32974f65adabd63972ef181696aeb79954f904f2f405"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99188,10 +99385,10 @@ rule ELASTIC_Linux_Exploit_Sorso_61Eae7Dd : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Sorso.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Sorso.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
-		logic_hash = "a8bc8a2c8405b80b160ad21898003781405a762c0e627f13b34e9362e0aa51a1"
+		logic_hash = "v1_sha256_a8bc8a2c8405b80b160ad21898003781405a762c0e627f13b34e9362e0aa51a1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99217,10 +99414,10 @@ rule ELASTIC_Linux_Trojan_Melofee_C23D18F3 : FILE MEMORY
 		date = "2024-11-14"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Melofee.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Melofee.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b0abf6691e769ead1f11cfdcd300f8cd5291f19059be6bb40d556f793b1bc21e"
-		logic_hash = "fd769e0eca9ee858a3773a906189c510742364722b3e5c384158b3ec4158fc68"
+		logic_hash = "v1_sha256_fd769e0eca9ee858a3773a906189c510742364722b3e5c384158b3ec4158fc68"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -99251,10 +99448,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_D9E6B88E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a4ac275275e7be694a200fe6c5c5746256398c109cf54f45220637fe5d9e26ba"
-		logic_hash = "979d2ae62efca0f719ed1db2ff832dc9a0aa0347dcd50ccede29ec35cba6d296"
+		logic_hash = "v1_sha256_979d2ae62efca0f719ed1db2ff832dc9a0aa0347dcd50ccede29ec35cba6d296"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99280,10 +99477,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_30C039E2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b494ca3b7bae2ab9a5197b81e928baae5b8eac77dfdc7fe1223fee8f27024772"
-		logic_hash = "a9dbfede68a3209b403aa40dbc5b69326c3e1c14259ed6bc6351f0f9412cfce2"
+		logic_hash = "v1_sha256_a9dbfede68a3209b403aa40dbc5b69326c3e1c14259ed6bc6351f0f9412cfce2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99309,10 +99506,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_C94Eec37 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "294fcdd57fc0a53e2d63b620e85fa65c00942db2163921719d052d341aa2dc30"
-		logic_hash = "39a49e1661ac2ca6a43a56b0bd136976f6d506c0779d862a43ba2c25d6947fee"
+		logic_hash = "v1_sha256_39a49e1661ac2ca6a43a56b0bd136976f6d506c0779d862a43ba2c25d6947fee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99338,10 +99535,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_F806D5D9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5259495788f730a2a3bad7478c1873c8a6296506a778f18bc68e39ce48b979da"
-		logic_hash = "86336f662e3abcf2fe7635155782c549fc9eef514356bf78bfbc3b65192e2d90"
+		logic_hash = "v1_sha256_86336f662e3abcf2fe7635155782c549fc9eef514356bf78bfbc3b65192e2d90"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -99367,10 +99564,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_0Fa3A6E9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a"
-		logic_hash = "970062e909ffe5356b750605f2c44a6e893949bc5bc71be3ea98b16e51629d4d"
+		logic_hash = "v1_sha256_970062e909ffe5356b750605f2c44a6e893949bc5bc71be3ea98b16e51629d4d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99396,10 +99593,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_36A98405 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304"
-		logic_hash = "a32d324d1865a7796faefbc2f209e6043008a696929fe7837afbbc770e6f4c74"
+		logic_hash = "v1_sha256_a32d324d1865a7796faefbc2f209e6043008a696929fe7837afbbc770e6f4c74"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99425,10 +99622,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_0C6686B8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
-		logic_hash = "731bb3f9957e8777040c0b7b316a818f4ee1ca9a113fb9eed24ee61bfc71e11d"
+		logic_hash = "v1_sha256_731bb3f9957e8777040c0b7b316a818f4ee1ca9a113fb9eed24ee61bfc71e11d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99454,10 +99651,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_9Ce5B69F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ad63fbd15b7de4da0db1b38609b7481253c100e3028c19831a5d5c1926351829"
-		logic_hash = "b9756eb99e59ba3a9a616b391bcf26bda26a6ac0de115460f9ba52129f590764"
+		logic_hash = "v1_sha256_b9756eb99e59ba3a9a616b391bcf26bda26a6ac0de115460f9ba52129f590764"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99483,10 +99680,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_55A80Ab6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5259495788f730a2a3bad7478c1873c8a6296506a778f18bc68e39ce48b979da"
-		logic_hash = "1fc29f98e9ea2a5b67d0a88f37813a5e62b5f1d2a26aee74f90e9ead445dc713"
+		logic_hash = "v1_sha256_1fc29f98e9ea2a5b67d0a88f37813a5e62b5f1d2a26aee74f90e9ead445dc713"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -99512,10 +99709,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_E98B83Ee : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417"
-		logic_hash = "8b16c0fee991ee2143a20998097066a90b1f20060bac7b42e5c3188adcdc7907"
+		logic_hash = "v1_sha256_8b16c0fee991ee2143a20998097066a90b1f20060bac7b42e5c3188adcdc7907"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99541,10 +99738,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_8A11F9Be : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571"
-		logic_hash = "f80dcb3579a76da787e9bb2bfb02ef86e464aec1bea405f02642b8c8902c7663"
+		logic_hash = "v1_sha256_f80dcb3579a76da787e9bb2bfb02ef86e464aec1bea405f02642b8c8902c7663"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -99570,10 +99767,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_2462067E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3847f1c7c15ce771613079419de3d5e8adc07208e1fefa23f7dd416b532853a1"
-		logic_hash = "cf6c0703f9108f8193e0a9c18ba3d76263527a13fe44e194fa464d399512ae05"
+		logic_hash = "v1_sha256_cf6c0703f9108f8193e0a9c18ba3d76263527a13fe44e194fa464d399512ae05"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99599,10 +99796,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_0A028640 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e36081f0dbd6d523c9378cdd312e117642b0359b545b29a61d8f9027d8c0f2f0"
-		logic_hash = "663f110c7214498466759b66a83ff1844f5bf45ce706fa8ad0e8b205cc9c8f72"
+		logic_hash = "v1_sha256_663f110c7214498466759b66a83ff1844f5bf45ce706fa8ad0e8b205cc9c8f72"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99628,10 +99825,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_6B3974B2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04"
-		logic_hash = "7c44a0abcd51a6b775fc379b592652ebb10faf16c039ca23b20984183340cada"
+		logic_hash = "v1_sha256_7c44a0abcd51a6b775fc379b592652ebb10faf16c039ca23b20984183340cada"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99657,10 +99854,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_87Bcb848 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L301-L319"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L301-L319"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "575b0dc887d132aa3983e5712b8f642b03762b0685fbd5a32c104bca72871857"
-		logic_hash = "60e8aa7e27ea0bec665075a373ce150c21af4cddfd511b7ec771293126f0006c"
+		logic_hash = "v1_sha256_60e8aa7e27ea0bec665075a373ce150c21af4cddfd511b7ec771293126f0006c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99686,9 +99883,9 @@ rule ELASTIC_Linux_Trojan_Tsunami_Ad60D7E8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L321-L338"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "1253a8cd1a5230f1ec1f8c7ecd07f89f28acf5c2aa92395c6cb9e635c16a1e25"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L321-L338"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_1253a8cd1a5230f1ec1f8c7ecd07f89f28acf5c2aa92395c6cb9e635c16a1e25"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -99714,10 +99911,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_22646C0D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L340-L358"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L340-L358"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "20439a8fc21a94c194888725fbbb7a7fbeef5faf4b0f704559d89f1cd2e57d9d"
-		logic_hash = "548f531429132392f6d9bccff706b56ba87d8e44763116dedca5d0baa5097b92"
+		logic_hash = "v1_sha256_548f531429132392f6d9bccff706b56ba87d8e44763116dedca5d0baa5097b92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99743,10 +99940,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_019F0E75 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L360-L378"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L360-L378"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "575b0dc887d132aa3983e5712b8f642b03762b0685fbd5a32c104bca72871857"
-		logic_hash = "7a63eb94266b04a31ba67165c512e2e060c3e344665aeed748a51943143b2219"
+		logic_hash = "v1_sha256_7a63eb94266b04a31ba67165c512e2e060c3e344665aeed748a51943143b2219"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99772,10 +99969,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_7C545Abf : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L380-L398"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L380-L398"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "95691c7ad1d80f7f1b5541e1d1a1dbeba30a26702a4080d256f14edb75851c5d"
-		logic_hash = "fa50ccc4c85417d18a84b7f117f853609c44b17c488a937cdc7495e2d32757f7"
+		logic_hash = "v1_sha256_fa50ccc4c85417d18a84b7f117f853609c44b17c488a937cdc7495e2d32757f7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99801,10 +99998,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_32C0B950 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L400-L418"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L400-L418"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "214c1caf20ceae579476d3bf97f489484df4c5f1c0c44d37ff9b9066072cd83c"
-		logic_hash = "db077e5916327ca78fcc9dc35f64e5c497dbbe60c4a0c1eb7abb49c555765681"
+		logic_hash = "v1_sha256_db077e5916327ca78fcc9dc35f64e5c497dbbe60c4a0c1eb7abb49c555765681"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99830,10 +100027,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_Cbf50D9C : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L420-L438"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L420-L438"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b64d0cf4fc4149aa4f63900e61b6739e154d328ea1eb31f4c231016679fc4aa5"
-		logic_hash = "331a35fb3ecc54022b1d4d05bd64e7c5c6a7997b06dbea3a36c33ccc0a2f7086"
+		logic_hash = "v1_sha256_331a35fb3ecc54022b1d4d05bd64e7c5c6a7997b06dbea3a36c33ccc0a2f7086"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99859,10 +100056,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_40C25A06 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L440-L458"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L440-L458"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "61af6bb7be25465e7d469953763be5671f33c197d4b005e4a78227da11ae91e9"
-		logic_hash = "38976911ff9e56fae27fad8b9df01063ed703f43c8220b1fbcef7a3945b3f1ad"
+		logic_hash = "v1_sha256_38976911ff9e56fae27fad8b9df01063ed703f43c8220b1fbcef7a3945b3f1ad"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99888,10 +100085,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_35806Adc : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L460-L478"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L460-L478"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "15e7942ebf88a51346d3a5975bb1c2d87996799e6255db9e92aed798d279b36b"
-		logic_hash = "6e9d3e5c0a33208d1b5f4f84f8634955e70bd63395b367cd1ece67798ce5e502"
+		logic_hash = "v1_sha256_6e9d3e5c0a33208d1b5f4f84f8634955e70bd63395b367cd1ece67798ce5e502"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99917,10 +100114,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_D74D7F0C : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L480-L498"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L480-L498"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b0a8b2259c00d563aa387d7e1a1f1527405da19bf4741053f5822071699795e2"
-		logic_hash = "6f5313fc9e838bd06bd4e797ea7fb448073849dc714ecf18809f94900fa11ca2"
+		logic_hash = "v1_sha256_6f5313fc9e838bd06bd4e797ea7fb448073849dc714ecf18809f94900fa11ca2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99946,10 +100143,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_71D31510 : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L500-L518"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L500-L518"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "33dd6c0af99455a0ca3908c0117e16a513b39fabbf9c52ba24c7b09226ad8626"
-		logic_hash = "18bfe9347faf1811686a61e0ee0de5cef842beb25fb06793947309135c41de89"
+		logic_hash = "v1_sha256_18bfe9347faf1811686a61e0ee0de5cef842beb25fb06793947309135c41de89"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -99975,10 +100172,10 @@ rule ELASTIC_Linux_Trojan_Tsunami_97288Af8 : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Tsunami.yar#L520-L538"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Tsunami.yar#L520-L538"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c39eb055c5f71ebfd6881ff04e876f49495c0be5560687586fc47bf5faee0c84"
-		logic_hash = "c5b521cc887236a189dca419476758cee0f1513a8ad81c94b1ff42e4fe232b8e"
+		logic_hash = "v1_sha256_c5b521cc887236a189dca419476758cee0f1513a8ad81c94b1ff42e4fe232b8e"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -100004,10 +100201,10 @@ rule ELASTIC_Windows_Trojan_Dragonbreath_B27Bc56B : FILE MEMORY
 		date = "2024-06-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DragonBreath.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DragonBreath.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "45023fd0e694d66c284dfe17f78c624fd7e246a6c36860a0d892d232a30949be"
-		logic_hash = "b86d5541a7e03a698ad918cdbba987474c6680353b4d2de2f8422ecd0ebcac61"
+		logic_hash = "v1_sha256_b86d5541a7e03a698ad918cdbba987474c6680353b4d2de2f8422ecd0ebcac61"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -100035,10 +100232,10 @@ rule ELASTIC_Multi_Hacktool_Supershell_F7486598 : FILE MEMORY
 		date = "2024-09-12"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Hacktool_SuperShell.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Hacktool_SuperShell.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "18556a794f5d47f93d375e257fa94b9fb1088f3021cf79cc955eb4c1813a95da"
-		logic_hash = "8c2c3f13fad03ece29f7f3fd12e22807b61ecdc16dee00b6430b915631554cff"
+		logic_hash = "v1_sha256_8c2c3f13fad03ece29f7f3fd12e22807b61ecdc16dee00b6430b915631554cff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100056,7 +100253,7 @@ rule ELASTIC_Multi_Hacktool_Supershell_F7486598 : FILE MEMORY
 		$b3 = "Missing listening address"
 
 	condition:
-		$a and 1 of ($b*)
+		$a and 1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Naplistener_E8F16920 : FILE MEMORY
 {
@@ -100067,10 +100264,10 @@ rule ELASTIC_Windows_Trojan_Naplistener_E8F16920 : FILE MEMORY
 		date = "2023-02-28"
 		modified = "2023-03-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_NapListener.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_NapListener.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6e8c5bb2dfc90bca380c6f42af7458c8b8af40b7be95fab91e7c67b0dee664c4"
-		logic_hash = "6cb7b5051fab2b56f39b2805788b5b0838a095b41fcc623fe412b215736be5d4"
+		logic_hash = "v1_sha256_6cb7b5051fab2b56f39b2805788b5b0838a095b41fcc623fe412b215736be5d4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100098,10 +100295,10 @@ rule ELASTIC_Windows_Trojan_Naplistener_414180A7 : FILE MEMORY
 		date = "2023-02-28"
 		modified = "2023-03-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_NapListener.yar#L23-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_NapListener.yar#L23-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6e8c5bb2dfc90bca380c6f42af7458c8b8af40b7be95fab91e7c67b0dee664c4"
-		logic_hash = "52d3ddebdc1a8aa4bcb902273bd2d3b4f9b51f248d25e7ae1cc260a9550111f5"
+		logic_hash = "v1_sha256_52d3ddebdc1a8aa4bcb902273bd2d3b4f9b51f248d25e7ae1cc260a9550111f5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100132,10 +100329,10 @@ rule ELASTIC_Windows_Trojan_Protects_9F6Eaa90 : FILE
 		date = "2022-04-04"
 		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_ProtectS.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_ProtectS.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0330e072b7003f55a3153ac3e0859369b9c3e22779b113284e95ce1e2ce2099"
-		logic_hash = "ddc8c97598b2d961dc51bdf2c7ab96abcec63824acd39b767bc175371844c1e5"
+		logic_hash = "v1_sha256_ddc8c97598b2d961dc51bdf2c7ab96abcec63824acd39b767bc175371844c1e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -100150,7 +100347,7 @@ rule ELASTIC_Windows_Trojan_Protects_9F6Eaa90 : FILE
 		$str1 = "\\ProtectS.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Trojan_Sqlexp_1Aa5001E : FILE MEMORY
 {
@@ -100161,10 +100358,10 @@ rule ELASTIC_Linux_Trojan_Sqlexp_1Aa5001E : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sqlexp.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sqlexp.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "714a520fc69c54bcd422e75f4c3b71ce636cfae7fcec3c5c413d1294747d2dd6"
-		logic_hash = "48c7331c80aa7d918f46d282c6f38b8e780f9b5222cf9304bf1a8bb39cc129ab"
+		logic_hash = "v1_sha256_48c7331c80aa7d918f46d282c6f38b8e780f9b5222cf9304bf1a8bb39cc129ab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100190,10 +100387,10 @@ rule ELASTIC_Linux_Ransomware_Akira_02237952 : FILE MEMORY
 		date = "2023-07-28"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Akira.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Akira.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1d3b5c650533d13c81e325972a912e3ff8776e36e18bca966dae50735f8ab296"
-		logic_hash = "a9b3cdddb3387251d7da90f32b08b9c1eedcdff1fe90d51f4732183666a6d467"
+		logic_hash = "v1_sha256_a9b3cdddb3387251d7da90f32b08b9c1eedcdff1fe90d51f4732183666a6d467"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100222,10 +100419,10 @@ rule ELASTIC_Linux_Ransomware_Akira_27440619 : FILE MEMORY
 		date = "2024-11-21"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Akira.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Akira.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75"
-		logic_hash = "d2bb413b5919b3ed6239fbc714d025d2ddc321cb8a0b310aaae48b0869810be8"
+		logic_hash = "v1_sha256_d2bb413b5919b3ed6239fbc714d025d2ddc321cb8a0b310aaae48b0869810be8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100251,10 +100448,10 @@ rule ELASTIC_Linux_Hacktool_Wipelog_Daea1Aa4 : FILE MEMORY
 		date = "2022-03-17"
 		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Wipelog.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Wipelog.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "39b3a95928326012c3b2f64e2663663adde4b028d940c7e804ac4d3953677ea6"
-		logic_hash = "e2483b7719f4a1e28ec3732120770066333d8db269c9c9711813a8eeb75176d6"
+		logic_hash = "v1_sha256_e2483b7719f4a1e28ec3732120770066333d8db269c9c9711813a8eeb75176d6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100290,10 +100487,10 @@ rule ELASTIC_Linux_Exploit_Vmsplice_Cfa94001 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Vmsplice.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Vmsplice.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0a26e67692605253819c489cd4793a57e86089d50150124394c30a8801bf33e6"
-		logic_hash = "b5a86a79384997f977d353371ccaa8c736f5c24af40b85a24076d4c4fb79a237"
+		logic_hash = "v1_sha256_b5a86a79384997f977d353371ccaa8c736f5c24af40b85a24076d4c4fb79a237"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100319,10 +100516,10 @@ rule ELASTIC_Linux_Exploit_Vmsplice_A000F267 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Vmsplice.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Vmsplice.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c85cc6768a28fb7de16f1cad8d3c69d8f0b4aa01e00c8e48759d27092747ca6f"
-		logic_hash = "2a8cb11bb21f2ce620a6fa1f0fb932bef60a479fac836058ec4e8c760b5d60f9"
+		logic_hash = "v1_sha256_2a8cb11bb21f2ce620a6fa1f0fb932bef60a479fac836058ec4e8c760b5d60f9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100348,10 +100545,10 @@ rule ELASTIC_Linux_Exploit_Vmsplice_8B9E4F9F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Vmsplice.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Vmsplice.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0230c81ba747e588cd9b6113df6e1867dcabf9d8ada0c1921d1bffa9c1b9c75d"
-		logic_hash = "6979a900a2532a8da36711f3ffe13f71ec4efa7771aa2feec9391bd031aaa023"
+		logic_hash = "v1_sha256_6979a900a2532a8da36711f3ffe13f71ec4efa7771aa2feec9391bd031aaa023"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100377,10 +100574,10 @@ rule ELASTIC_Linux_Exploit_Vmsplice_055F88B8 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Vmsplice.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Vmsplice.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "607c8c5edc8cbbd79a40ce4a0eccf46e01447985d9415d1eff6a91bf64074507"
-		logic_hash = "29e59bb372f0b37b507c72e5b5bcb27ba0fa2aaac71ea77f0cab85af31708c8a"
+		logic_hash = "v1_sha256_29e59bb372f0b37b507c72e5b5bcb27ba0fa2aaac71ea77f0cab85af31708c8a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100406,9 +100603,9 @@ rule ELASTIC_Linux_Exploit_Vmsplice_431E689D : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "1cbb09223f16af4cd13545d72dbeeb996900535b1e279e4bcf447670728de1e1"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Vmsplice.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "5b9a7ffcd6fc6893a8224fd2b9ca59f4cff6086669a73190114db510a1ad9ff2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Vmsplice.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_5b9a7ffcd6fc6893a8224fd2b9ca59f4cff6086669a73190114db510a1ad9ff2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100434,10 +100631,10 @@ rule ELASTIC_Multi_Trojan_Sparkrat_9A21E541 : FILE MEMORY
 		date = "2023-11-13"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Trojan_SparkRat.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_SparkRat.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "23efecc03506a9428175546a4b7d40c8a943c252110e83dec132c6a5db8c4dd6"
-		logic_hash = "903c5c65436bea8dd044fd5f1f6dda3d1e90ab25802d508f67ba0f7fd06e92d4"
+		logic_hash = "v1_sha256_903c5c65436bea8dd044fd5f1f6dda3d1e90ab25802d508f67ba0f7fd06e92d4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100465,10 +100662,10 @@ rule ELASTIC_Linux_Trojan_Rbot_C69475E3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9d97c69b65d2900c39ca012fe0486e6a6abceebb890cbb6d2e091bb90f6b9690"
-		logic_hash = "2a8629ebf6e2082ce90f1b2130ae596e4e515f3289a25899f2fc57b99c01a654"
+		logic_hash = "v1_sha256_2a8629ebf6e2082ce90f1b2130ae596e4e515f3289a25899f2fc57b99c01a654"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100494,10 +100691,10 @@ rule ELASTIC_Linux_Trojan_Rbot_96625C8C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rbot.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rbot.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e"
-		logic_hash = "5a9671e10e7b9b58ecf9fab231de18b4b6039c9d351b145fae1705297acda95e"
+		logic_hash = "v1_sha256_5a9671e10e7b9b58ecf9fab231de18b4b6039c9d351b145fae1705297acda95e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100523,10 +100720,10 @@ rule ELASTIC_Linux_Trojan_Rbot_366F1599 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rbot.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rbot.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5553d154a0e02e7f97415299eeae78e5bb0ecfbf5454e3933d6fd9675d78b3eb"
-		logic_hash = "3efe0f35efd855b415149513e8abb2210a26ef6f3b6c31275c8147fabb634fab"
+		logic_hash = "v1_sha256_3efe0f35efd855b415149513e8abb2210a26ef6f3b6c31275c8147fabb634fab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100552,10 +100749,10 @@ rule ELASTIC_Linux_Exploit_Ramen_01B205Eb : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Ramen.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Ramen.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0b6303300f38013840abe17abe192db6a99ace78c83bc7ef705f5c568bc98fd"
-		logic_hash = "e477e93434db9e650f159995f2cb754394f3187dc341d2ea4c2466924e19a8a6"
+		logic_hash = "v1_sha256_e477e93434db9e650f159995f2cb754394f3187dc341d2ea4c2466924e19a8a6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100581,10 +100778,10 @@ rule ELASTIC_Linux_Rootkit_Adore_Fe3Fd09F : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Adore.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Adore.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f4e532b840e279daf3d206e9214a1b065f97deb7c1487a34ac5cbd7cbbf33e1a"
-		logic_hash = "cc07efb9484562cd870649a38126f08aa4e99ed5ad4662ece0488d9ffd97520e"
+		logic_hash = "v1_sha256_cc07efb9484562cd870649a38126f08aa4e99ed5ad4662ece0488d9ffd97520e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100610,10 +100807,10 @@ rule ELASTIC_Windows_Hacktool_Leigod_89397Ebf : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_LeiGod.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_LeiGod.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ae5cc99f3c61c86c7624b064fd188262e0160645c1676d231516bf4e716a22d3"
-		logic_hash = "e887c34c624a182a3c57a55abe02784c4350d3956bcfd9f7918f08a464819e63"
+		logic_hash = "v1_sha256_e887c34c624a182a3c57a55abe02784c4350d3956bcfd9f7918f08a464819e63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -100628,7 +100825,7 @@ rule ELASTIC_Windows_Hacktool_Leigod_89397Ebf : FILE
 		$str1 = "\\Device\\CtrlLeiGod" wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Hacktool_Leigod_3F5C98C4 : FILE
 {
@@ -100639,10 +100836,10 @@ rule ELASTIC_Windows_Hacktool_Leigod_3F5C98C4 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_LeiGod.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_LeiGod.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0c42fe45ffa9a9c36c87a7f01510a077da6340ffd86bf8509f02c6939da133c5"
-		logic_hash = "7570bf1a69df6b493bde41c1de27969e36a3fcb59be574ee2e24e3a61347a146"
+		logic_hash = "v1_sha256_7570bf1a69df6b493bde41c1de27969e36a3fcb59be574ee2e24e3a61347a146"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -100657,7 +100854,7 @@ rule ELASTIC_Windows_Hacktool_Leigod_3F5C98C4 : FILE
 		$str1 = "\\LgDCatcher.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Trojan_Buerloader_C8A60F46 : FILE MEMORY
 {
@@ -100668,10 +100865,10 @@ rule ELASTIC_Windows_Trojan_Buerloader_C8A60F46 : FILE MEMORY
 		date = "2021-08-16"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Buerloader.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Buerloader.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac"
-		logic_hash = "d11b117efc10547e77ce8979f8a1d42f34937101e58a0e36228baa37cd30d2aa"
+		logic_hash = "v1_sha256_d11b117efc10547e77ce8979f8a1d42f34937101e58a0e36228baa37cd30d2aa"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -100702,10 +100899,10 @@ rule ELASTIC_Linux_Trojan_Backconnect_C6803B39 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Backconnect.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Backconnect.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a5e6b084cdabe9a4557b5ff8b2313db6c3bb4ba424d107474024030115eeaa0f"
-		logic_hash = "02750b2788c2912bba0fc8594f6a12c75ce1f41d1075acf7c920f6e616ab65c7"
+		logic_hash = "v1_sha256_02750b2788c2912bba0fc8594f6a12c75ce1f41d1075acf7c920f6e616ab65c7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100731,10 +100928,10 @@ rule ELASTIC_Windows_Exploit_Ioring_1E4A8F47 : FILE MEMORY
 		date = "2024-02-28"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_IoRing.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_IoRing.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ba2bd270bf3f312dfa3f77f0716edb634c90506c87f82c04aee09445d18738eb"
-		logic_hash = "cbbea9a60bde13356ce88cd96aacaa02a3c99f4ae0b48c4ba84b72528a3d6b91"
+		logic_hash = "v1_sha256_cbbea9a60bde13356ce88cd96aacaa02a3c99f4ae0b48c4ba84b72528a3d6b91"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100763,10 +100960,10 @@ rule ELASTIC_Macos_Cryptominer_Xmrig_241780A1 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Cryptominer_Xmrig.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Cryptominer_Xmrig.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f"
-		logic_hash = "9e091f6881a96abdc6592db385eb9026806befdda6bda4489470b4e16e1d4d87"
+		logic_hash = "v1_sha256_9e091f6881a96abdc6592db385eb9026806befdda6bda4489470b4e16e1d4d87"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100795,10 +100992,10 @@ rule ELASTIC_Windows_Trojan_Fabookie_024F8759 : FILE MEMORY
 		date = "2023-06-22"
 		modified = "2023-07-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Fabookie.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Fabookie.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6c6345c6f0a5beadc4616170c87ec8a577de185d53345581e1b00e72af24c13e"
-		logic_hash = "9477406b718c6489161cf4636be66c4f72df923b9c5a7ee4069ef6a9552de485"
+		logic_hash = "v1_sha256_9477406b718c6489161cf4636be66c4f72df923b9c5a7ee4069ef6a9552de485"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100825,10 +101022,10 @@ rule ELASTIC_Windows_Trojan_Legionloader_F91120C6 : FILE MEMORY
 		date = "2024-06-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_LegionLoader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_LegionLoader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "45670ffa9b24542ae84e3c9eb5ce609c2bcd29129215a7f37eb74b6211e32b22"
-		logic_hash = "760402587a9ca3d3e6602fe57d3346ea6f60ba5c8d3a902bf493233baab597b0"
+		logic_hash = "v1_sha256_760402587a9ca3d3e6602fe57d3346ea6f60ba5c8d3a902bf493233baab597b0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100854,10 +101051,10 @@ rule ELASTIC_Macos_Hacktool_Swiftbelt_Bc62Ede6 : FILE MEMORY
 		date = "2021-10-12"
 		modified = "2021-10-25"
 		reference = "https://www.elastic.co/security-labs/inital-research-of-jokerspy"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Hacktool_Swiftbelt.yar#L1-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Hacktool_Swiftbelt.yar#L1-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "452c832a17436f61ad5f32ee1c97db05575160105ed1dcd0d3c6db9fb5a9aea1"
-		logic_hash = "51481baa6ddb09cf8463d989637319cb26b23fef625cc1a44c96d438c77362ca"
+		logic_hash = "v1_sha256_51481baa6ddb09cf8463d989637319cb26b23fef625cc1a44c96d438c77362ca"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -100907,10 +101104,10 @@ rule ELASTIC_Linux_Backdoor_Generic_Babf9101 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Backdoor_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Backdoor_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9ea73d2c2a5f480ae343846e2b6dd791937577cb2b3d8358f5b6ede8f3696b86"
-		logic_hash = "40084f3bed66c1d4a1cd2ffca99fd6789c8ed2db04031e4d4a4926b41d622355"
+		logic_hash = "v1_sha256_40084f3bed66c1d4a1cd2ffca99fd6789c8ed2db04031e4d4a4926b41d622355"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100936,10 +101133,10 @@ rule ELASTIC_Linux_Backdoor_Generic_5776Ae49 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Backdoor_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Backdoor_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e247a5decb5184fd5dee0d209018e402c053f4a950dae23be59b71c082eb910c"
-		logic_hash = "b606f12c47182d80e07f8715639c3cc73753274bd8833cb9f6380879356a2b12"
+		logic_hash = "v1_sha256_b606f12c47182d80e07f8715639c3cc73753274bd8833cb9f6380879356a2b12"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -100965,10 +101162,10 @@ rule ELASTIC_Windows_Exploit_Eternalblue_Ead33Bf8 : FILE
 		date = "2021-01-12"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_Eternalblue.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_Eternalblue.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7"
-		logic_hash = "4d0ab8bd7ef5b20e656110ac3c78b08803539387cb4fe1425a284d39c42aa199"
+		logic_hash = "v1_sha256_4d0ab8bd7ef5b20e656110ac3c78b08803539387cb4fe1425a284d39c42aa199"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -100994,10 +101191,10 @@ rule ELASTIC_Macos_Trojan_Aobokeylogger_Bd960F34 : FILE MEMORY
 		date = "2021-10-18"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Aobokeylogger.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Aobokeylogger.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2b50146c20621741642d039f1e3218ff68e5dbfde8bb9edaa0a560ca890f0970"
-		logic_hash = "f89fbf1d6bf041de0ce32f7920818c34ce0eeb6779bb7fac6f223bbea1c6f6fa"
+		logic_hash = "v1_sha256_f89fbf1d6bf041de0ce32f7920818c34ce0eeb6779bb7fac6f223bbea1c6f6fa"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -101023,9 +101220,9 @@ rule ELASTIC_Windows_Ransomware_Sodinokibi_83F05Fbe : BETA FILE MEMORY
 		date = "2020-06-18"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Sodinokibi.yar#L1-L34"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "c88fc2690deae3700e605b2affb5ecac3d1ffc92435f33209f31897d28715b8c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Sodinokibi.yar#L1-L34"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_c88fc2690deae3700e605b2affb5ecac3d1ffc92435f33209f31897d28715b8c"
 		score = 75
 		quality = 73
 		tags = "BETA, FILE, MEMORY"
@@ -101065,9 +101262,9 @@ rule ELASTIC_Windows_Ransomware_Sodinokibi_182B2Cea : BETA FILE MEMORY
 		date = "2020-06-18"
 		modified = "2021-10-04"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Sodinokibi.yar#L36-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "1c23effe5f8b35c5e03ebd5e57664c8937259d464f92dda0a9df344b982e8f8c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Sodinokibi.yar#L36-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_1c23effe5f8b35c5e03ebd5e57664c8937259d464f92dda0a9df344b982e8f8c"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -101089,7 +101286,7 @@ rule ELASTIC_Windows_Ransomware_Sodinokibi_182B2Cea : BETA FILE MEMORY
 		$b6 = ":!:(:/:6:C:\\:m:" ascii fullword
 
 	condition:
-		($a1 and 6 of ($b*))
+		($a1 and 6 of ( $b* ) )
 }
 rule ELASTIC_Windows_Ransomware_Sodinokibi_A282Ba44 : BETA FILE MEMORY
 {
@@ -101100,9 +101297,9 @@ rule ELASTIC_Windows_Ransomware_Sodinokibi_A282Ba44 : BETA FILE MEMORY
 		date = "2020-06-18"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Sodinokibi.yar#L64-L91"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "3a583069c9ab851a90f3a61c9c4fa67f8b918b8d168fcf7f25b2a3ae3465c596"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Sodinokibi.yar#L64-L91"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_3a583069c9ab851a90f3a61c9c4fa67f8b918b8d168fcf7f25b2a3ae3465c596"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -101125,7 +101322,7 @@ rule ELASTIC_Windows_Ransomware_Sodinokibi_A282Ba44 : BETA FILE MEMORY
 		$c8 = { 0C 89 46 0C 85 C0 75 2A 33 C0 EB 6C 8B 46 08 85 C0 74 62 6B }
 
 	condition:
-		(6 of ($c*))
+		(6 of ( $c* ) )
 }
 rule ELASTIC_Windows_Cryptominer_Generic_Dd1E4D1A : FILE
 {
@@ -101136,10 +101333,10 @@ rule ELASTIC_Windows_Cryptominer_Generic_Dd1E4D1A : FILE
 		date = "2021-01-12"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Cryptominer_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Cryptominer_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7ac1d7b6107307fb2442522604c8fa56010d931392d606ac74dcea6b7125954b"
-		logic_hash = "b7289c4688ec67d59e67755461f1f4e0c3f47ef9f8c73fc1dcc1d168baf11623"
+		logic_hash = "v1_sha256_b7289c4688ec67d59e67755461f1f4e0c3f47ef9f8c73fc1dcc1d168baf11623"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -101165,10 +101362,10 @@ rule ELASTIC_Windows_Cryptominer_Generic_F53Cfb9B : FILE MEMORY
 		date = "2024-03-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Cryptominer_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Cryptominer_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a9870a03ddc6543a5a12d50f95934ff49f26b60921096b2c8f2193cb411ed408"
-		logic_hash = "b2453862747e251afc34c57e887889b8d3a65a9cc876d4a95ff5ecfcc24e4bd3"
+		logic_hash = "v1_sha256_b2453862747e251afc34c57e887889b8d3a65a9cc876d4a95ff5ecfcc24e4bd3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101194,10 +101391,10 @@ rule ELASTIC_Windows_Hacktool_EDRWFP_F6D7Db7A : FILE
 		date = "2024-06-10"
 		modified = "2024-07-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_EDRWFP.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_EDRWFP.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a1fc2f3ded852f75e36e70ae39087e21ae5b6af10e2038d04e61bd500ba511e2"
-		logic_hash = "45d427e4f52346b4a18c154bb0afb636c18951fd9c7323846bf2eb7e47928ef6"
+		logic_hash = "v1_sha256_45d427e4f52346b4a18c154bb0afb636c18951fd9c7323846bf2eb7e47928ef6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -101226,10 +101423,10 @@ rule ELASTIC_Macos_Trojan_Getshell_F339D74C : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Getshell.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Getshell.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b2199c15500728a522c04320aee000938f7eb69d751a55d7e51a2806d8cd0fe7"
-		logic_hash = "77a409f1a0ab5f87a77a6b2ffa2d4ff7bd6d86c0f685c524e2083585bb3fb764"
+		logic_hash = "v1_sha256_77a409f1a0ab5f87a77a6b2ffa2d4ff7bd6d86c0f685c524e2083585bb3fb764"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101255,10 +101452,10 @@ rule ELASTIC_Windows_Trojan_Carberp_D6De82Ae : FILE MEMORY
 		date = "2021-02-07"
 		modified = "2021-08-23"
 		reference = "https://github.com/m0n0ph1/malware-1/blob/master/Carberp%20Botnet/source%20-%20absource/pro/all%20source/hvnc_dll/HVNC%20Lib/vnc/xvnc.h#L342"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Carberp.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Carberp.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f98fadb6feab71930bd5c08e85153898d686cc96c84fe349c00bf6d482de9b53"
-		logic_hash = "085020755c77b299b2bfd18b34af6c68450c29de67b8ae32ddf2b26299b923ae"
+		logic_hash = "v1_sha256_085020755c77b299b2bfd18b34af6c68450c29de67b8ae32ddf2b26299b923ae"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -101286,10 +101483,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_03C81Bd9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3fc701a2caab0297112501f55eaeb05264c5e4099c411dcadc7095627e19837a"
-		logic_hash = "dc2dfa128f509221cae8bae9864190e8316bb7a5ae081da1076081b5f4fdc870"
+		logic_hash = "v1_sha256_dc2dfa128f509221cae8bae9864190e8316bb7a5ae081da1076081b5f4fdc870"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101315,10 +101512,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_757637D9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0762fa4e0d74e3c21b2afc8e4c28e2292d1c3de3683c46b5b77f0f9fe1faeec7"
-		logic_hash = "b1f1784aae5958740d03ca50d0b9731e8db7d86d918d16e82cf6fc1e1bf663a9"
+		logic_hash = "v1_sha256_b1f1784aae5958740d03ca50d0b9731e8db7d86d918d16e82cf6fc1e1bf663a9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101344,10 +101541,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_78543893 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ff5b02d2b4dfa9c3d53e7218533f3c57e82315be8f62aa17e26eda55a3b53479"
-		logic_hash = "4bb6a6e063fd00569b04f4514ec1731357aa8e8ce4cfee354fdd86773a4358da"
+		logic_hash = "v1_sha256_4bb6a6e063fd00569b04f4514ec1731357aa8e8ce4cfee354fdd86773a4358da"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101373,10 +101570,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_4F8D83D2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d78128eca706557eeab8a454cf875362a097459347ddc32118f71bd6c73d5bbd"
-		logic_hash = "6fee488d97fe1d4be558b6886c603010c6d1423a750783b38a65d2fb3eeb76f4"
+		logic_hash = "v1_sha256_6fee488d97fe1d4be558b6886c603010c6d1423a750783b38a65d2fb3eeb76f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101402,10 +101599,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_F4Afd230 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "805e900ffc9edb9f550dcbc938a3b06d28e9e7d3fb604ff68a311a0accbcd2b1"
-		logic_hash = "9aba4ebbf946f07071bfb94fa50c6981ae8c659aca9ee6e05c7ef214432d7466"
+		logic_hash = "v1_sha256_9aba4ebbf946f07071bfb94fa50c6981ae8c659aca9ee6e05c7ef214432d7466"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101431,10 +101628,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_Bb384Bc9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ecc6635117b99419255af5d292a7af3887b06d5f3b0f59d158281eebfe606445"
-		logic_hash = "1e9faba4f245d8b0d6944430286a5fc3e11cd7e036a4151b29fc2c5f037894fb"
+		logic_hash = "v1_sha256_1e9faba4f245d8b0d6944430286a5fc3e11cd7e036a4151b29fc2c5f037894fb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101460,10 +101657,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_B293F6Ec : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
-		logic_hash = "0e310082714f5283f9b4ccde5a8e17994e3bc4acf3d744b22734c136dde7cebb"
+		logic_hash = "v1_sha256_0e310082714f5283f9b4ccde5a8e17994e3bc4acf3d744b22734c136dde7cebb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101489,10 +101686,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_C5983669 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d08be92a484991afae3567256b6cec60a53400e0e9b6f6b4d5c416a22ccca1cf"
-		logic_hash = "ff673070969f1ededf8ff2c7cadfc251c7d2e52da58906b15cfc04593a755d55"
+		logic_hash = "v1_sha256_ff673070969f1ededf8ff2c7cadfc251c7d2e52da58906b15cfc04593a755d55"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101518,10 +101715,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_Fbff22Da : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0762fa4e0d74e3c21b2afc8e4c28e2292d1c3de3683c46b5b77f0f9fe1faeec7"
-		logic_hash = "d3e3037593f5714dfb49c6e19631fd46331e2702c8bf6d6099bb5b34158321a9"
+		logic_hash = "v1_sha256_d3e3037593f5714dfb49c6e19631fd46331e2702c8bf6d6099bb5b34158321a9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101547,10 +101744,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_E2D5Fad8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7e54e57db3de32555c15e529c04b35f52d75af630e45b5f8d6c21149866b6929"
-		logic_hash = "b294ce1c4d928d73342bb6260456d850f9c59f3c48c7c4ffbce32ea9238f6eee"
+		logic_hash = "v1_sha256_b294ce1c4d928d73342bb6260456d850f9c59f3c48c7c4ffbce32ea9238f6eee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101576,10 +101773,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_F2F8Eb6B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01721b9c024ca943f42c402a57f45bd4c77203a604c5c2cd26e5670df76a95b2"
-		logic_hash = "b6555e69b663591550976fd44352ecbdf0a0aef1e07a64396a576125a4fe4ba6"
+		logic_hash = "v1_sha256_b6555e69b663591550976fd44352ecbdf0a0aef1e07a64396a576125a4fe4ba6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101605,10 +101802,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_89671B03 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "001098473574cfac1edaca9f1180ab2005569e094be63186c45b48c18f880cf8"
-		logic_hash = "dfa7027c4fa0cbde33df87063fea4ecf51a085f3cc1805123c62747882d0a07e"
+		logic_hash = "v1_sha256_dfa7027c4fa0cbde33df87063fea4ecf51a085f3cc1805123c62747882d0a07e"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -101634,10 +101831,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_Dbc73Db0 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L261-L279"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L261-L279"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9fe78e4dd7975856a74d8dfd83e69793a769143e0fe6994cbc3ef28ea37d6cf8"
-		logic_hash = "4a7453342fd72dacb781919d3fac3bab02e7ef7c882d5938a2e0e1274c704705"
+		logic_hash = "v1_sha256_4a7453342fd72dacb781919d3fac3bab02e7ef7c882d5938a2e0e1274c704705"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -101663,10 +101860,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_Ec339160 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0002b469972f5c77a29e2a2719186059a3e96a6f4b1ef2d18a68fee3205ea0ba"
-		logic_hash = "9c1d1254093b172798024c42a6d78f5e6720d20b8c2a8ad4ca26c8e88e42f0e8"
+		logic_hash = "v1_sha256_9c1d1254093b172798024c42a6d78f5e6720d20b8c2a8ad4ca26c8e88e42f0e8"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -101692,10 +101889,10 @@ rule ELASTIC_Linux_Exploit_Lotoor_7Cd57E18 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Lotoor.yar#L301-L319"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Lotoor.yar#L301-L319"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1eecf16dae302ae788d1bc81278139cd9f6af52d7bed48b8677b35ba5eb14e30"
-		logic_hash = "97604cdc9daa9993b9a18dc5df7ab105a5e6001129bcfcfeeb86640bee26f59d"
+		logic_hash = "v1_sha256_97604cdc9daa9993b9a18dc5df7ab105a5e6001129bcfcfeeb86640bee26f59d"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -101721,10 +101918,10 @@ rule ELASTIC_Windows_Trojan_Danabot_6F3Dadb2 : FILE MEMORY
 		date = "2021-08-15"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Danabot.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Danabot.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96"
-		logic_hash = "b9c895be9eab775726abd2c13256d598c5b79bceb2d652c30b1df4cfc37e4b93"
+		logic_hash = "v1_sha256_b9c895be9eab775726abd2c13256d598c5b79bceb2d652c30b1df4cfc37e4b93"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -101757,10 +101954,10 @@ rule ELASTIC_Linux_Rootkit_Kovid_B77Dc7F4 : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Kovid.yar#L1-L47"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Kovid.yar#L1-L47"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "933273ff95a57dfe0162175dc6143395e23c69e36d8ca366481b795deaab4fd0"
-		logic_hash = "090c92e108f78a6d7ba9d0ed796c32226f253b81cf0ad8a138736d073761856c"
+		logic_hash = "v1_sha256_090c92e108f78a6d7ba9d0ed796c32226f253b81cf0ad8a138736d073761856c"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -101803,7 +102000,7 @@ rule ELASTIC_Linux_Rootkit_Kovid_B77Dc7F4 : FILE MEMORY
 		$func9 = "kv_util_random_AZ_string"
 
 	condition:
-		4 of ($str*) or 4 of ($func*)
+		4 of ( $str* ) or 4 of ( $func* )
 }
 rule ELASTIC_Windows_Ransomware_Generic_99F5A632 : FILE MEMORY
 {
@@ -101814,10 +102011,10 @@ rule ELASTIC_Windows_Ransomware_Generic_99F5A632 : FILE MEMORY
 		date = "2022-02-24"
 		modified = "2022-02-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Generic.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Generic.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382"
-		logic_hash = "2284cfc91d17816f1733e8fe319af52bc66af467364d27f84e213082c216ae8b"
+		logic_hash = "v1_sha256_2284cfc91d17816f1733e8fe319af52bc66af467364d27f84e213082c216ae8b"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -101846,10 +102043,10 @@ rule ELASTIC_Windows_Vulndriver_Sandra_5D112Feb : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Sandra.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Sandra.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3a364a7a3f6c0f2f925a060e84fb18b16c118125165b5ea6c94363221dc1b6de"
-		logic_hash = "d234a1e74234400f51c2aa7a9fb1549be1bc422bdf585db7d2ec9ad1ec75e490"
+		logic_hash = "v1_sha256_d234a1e74234400f51c2aa7a9fb1549be1bc422bdf585db7d2ec9ad1ec75e490"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -101866,7 +102063,7 @@ rule ELASTIC_Windows_Vulndriver_Sandra_5D112Feb : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x0c][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0b][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Vulndriver_Sandra_612A7A16 : FILE
 {
@@ -101877,9 +102074,9 @@ rule ELASTIC_Windows_Vulndriver_Sandra_612A7A16 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Sandra.yar#L23-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8fda0e1775d903b73836d4103f6e8b0e2f052026b3acdb07bd345b9ddb3c873a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Sandra.yar#L23-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8fda0e1775d903b73836d4103f6e8b0e2f052026b3acdb07bd345b9ddb3c873a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -101896,7 +102093,7 @@ rule ELASTIC_Windows_Vulndriver_Sandra_612A7A16 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x0c][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0b][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Trojan_Agenttesla_D3Ac2B2F : FILE MEMORY
 {
@@ -101907,10 +102104,10 @@ rule ELASTIC_Windows_Trojan_Agenttesla_D3Ac2B2F : FILE MEMORY
 		date = "2021-03-22"
 		modified = "2022-06-20"
 		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_AgentTesla.yar#L1-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_AgentTesla.yar#L1-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4"
-		logic_hash = "9c13a99107593d476de1522ced10aa43d34535b844e8c3ae871b22358137c926"
+		logic_hash = "v1_sha256_9c13a99107593d476de1522ced10aa43d34535b844e8c3ae871b22358137c926"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -101963,7 +102160,7 @@ rule ELASTIC_Windows_Trojan_Agenttesla_D3Ac2B2F : FILE MEMORY
 		$a39 = "get_DefaultCredentials" ascii fullword
 
 	condition:
-		8 of ($a*)
+		8 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Agenttesla_E577E17E : FILE MEMORY
 {
@@ -101974,10 +102171,10 @@ rule ELASTIC_Windows_Trojan_Agenttesla_E577E17E : FILE MEMORY
 		date = "2022-03-11"
 		modified = "2022-04-12"
 		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_AgentTesla.yar#L60-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_AgentTesla.yar#L60-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6"
-		logic_hash = "84c5f1096735cee0f0f4ad41a81286c0a60dc17c276f23568b855271d996c8a2"
+		logic_hash = "v1_sha256_84c5f1096735cee0f0f4ad41a81286c0a60dc17c276f23568b855271d996c8a2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102003,10 +102200,10 @@ rule ELASTIC_Windows_Trojan_Agenttesla_F2A90D14 : FILE MEMORY
 		date = "2022-03-11"
 		modified = "2022-04-12"
 		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_AgentTesla.yar#L81-L100"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_AgentTesla.yar#L81-L100"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6"
-		logic_hash = "3f39b773f2b1524b05d3c1d9aa1fb54594ec9003d2e9da342b6d17ba885f5a03"
+		logic_hash = "v1_sha256_3f39b773f2b1524b05d3c1d9aa1fb54594ec9003d2e9da342b6d17ba885f5a03"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102032,10 +102229,10 @@ rule ELASTIC_Windows_Trojan_Agenttesla_A2D69E48 : FILE MEMORY
 		date = "2023-05-01"
 		modified = "2023-06-13"
 		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_AgentTesla.yar#L102-L122"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_AgentTesla.yar#L102-L122"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "edef51e59d10993155104d90fcd80175daa5ade63fec260e3272f17b237a6f44"
-		logic_hash = "1f90be86b7afa7f518a3dcec55028bfc915cf6d4fed1350a56e351946cc55f41"
+		logic_hash = "v1_sha256_1f90be86b7afa7f518a3dcec55028bfc915cf6d4fed1350a56e351946cc55f41"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102062,10 +102259,10 @@ rule ELASTIC_Windows_Trojan_Agenttesla_Ebf431A8 : FILE MEMORY
 		date = "2023-12-01"
 		modified = "2024-01-12"
 		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_AgentTesla.yar#L124-L148"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_AgentTesla.yar#L124-L148"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0cb3051a80a0515ce715b71fdf64abebfb8c71b9814903cb9abcf16c0403f62b"
-		logic_hash = "b02d6e2d68b336aaa37336e0c0c3ffa6c7a126bfcdb6cb6ad5a3432004c6030c"
+		logic_hash = "v1_sha256_b02d6e2d68b336aaa37336e0c0c3ffa6c7a126bfcdb6cb6ad5a3432004c6030c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102096,9 +102293,9 @@ rule ELASTIC_Windows_Ransomware_Dharma_Aa5Eefed : BETA FILE MEMORY
 		date = "2020-06-25"
 		modified = "2021-08-23"
 		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Dharma.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "bbafc2eac17562f315b09fa42eb601d0140152917d7962429df3a378abe67732"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Dharma.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_bbafc2eac17562f315b09fa42eb601d0140152917d7962429df3a378abe67732"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -102115,7 +102312,7 @@ rule ELASTIC_Windows_Ransomware_Dharma_Aa5Eefed : BETA FILE MEMORY
 		$c2 = { 21 0C 7D 01 02 04 08 10 20 40 80 1B 36 6C D8 AB 4D 9A 2F 5E BC 63 C6 97 35 6A D4 B3 7D FA EF C5 91 00 00 A5 63 63 C6 84 7C 7C F8 99 77 77 EE 8D 7B 7B F6 0D F2 F2 FF BD 6B 6B D6 B1 6F 6F DE 54 C5 C5 91 50 30 30 60 03 01 01 02 A9 67 67 CE 7D 2B 2B 56 }
 
 	condition:
-		1 of ($c*)
+		1 of ( $c* )
 }
 rule ELASTIC_Windows_Ransomware_Dharma_B31Cac3F : BETA FILE MEMORY
 {
@@ -102126,9 +102323,9 @@ rule ELASTIC_Windows_Ransomware_Dharma_B31Cac3F : BETA FILE MEMORY
 		date = "2020-06-25"
 		modified = "2021-08-23"
 		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Dharma.yar#L23-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "30500e35721e9db3d63cafa5ca10818557fa9f4e0bda9c0d02283183508cf7b5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Dharma.yar#L23-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_30500e35721e9db3d63cafa5ca10818557fa9f4e0bda9c0d02283183508cf7b5"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -102146,7 +102343,7 @@ rule ELASTIC_Windows_Ransomware_Dharma_B31Cac3F : BETA FILE MEMORY
 		$b3 = "RSDS%~m" ascii fullword
 
 	condition:
-		3 of ($b*)
+		3 of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Dharma_E9319E4A : BETA FILE MEMORY
 {
@@ -102157,9 +102354,9 @@ rule ELASTIC_Windows_Ransomware_Dharma_E9319E4A : BETA FILE MEMORY
 		date = "2020-06-25"
 		modified = "2021-08-23"
 		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Dharma.yar#L46-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "182ed508d645a0b1fab80fb6f975a05d33b64c43005bd3656df6470934cd71f4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Dharma.yar#L46-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_182ed508d645a0b1fab80fb6f975a05d33b64c43005bd3656df6470934cd71f4"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -102175,7 +102372,7 @@ rule ELASTIC_Windows_Ransomware_Dharma_E9319E4A : BETA FILE MEMORY
 		$d = { 08 8B 51 24 8B 45 08 8B 48 18 0F B7 14 51 85 D2 74 47 8B 45 08 8B }
 
 	condition:
-		1 of ($d*)
+		1 of ( $d* )
 }
 rule ELASTIC_Windows_Ransomware_Dharma_942142E3 : BETA FILE MEMORY
 {
@@ -102186,9 +102383,9 @@ rule ELASTIC_Windows_Ransomware_Dharma_942142E3 : BETA FILE MEMORY
 		date = "2020-06-25"
 		modified = "2021-08-23"
 		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Dharma.yar#L67-L86"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "af5068ef3442964e4d1c5e27090fb84eaf762ff23463b7a0c2902e523ae601c1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Dharma.yar#L67-L86"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_af5068ef3442964e4d1c5e27090fb84eaf762ff23463b7a0c2902e523ae601c1"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -102204,7 +102401,7 @@ rule ELASTIC_Windows_Ransomware_Dharma_942142E3 : BETA FILE MEMORY
 		$a1 = "C:\\crysis\\Release\\PDB\\payload.pdb" ascii fullword
 
 	condition:
-		1 of ($a*)
+		1 of ( $a* )
 }
 rule ELASTIC_Linux_Exploit_CVE_2017_16995_0C81A317 : FILE MEMORY CVE_2017_16995
 {
@@ -102215,10 +102412,10 @@ rule ELASTIC_Linux_Exploit_CVE_2017_16995_0C81A317 : FILE MEMORY CVE_2017_16995
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "48d927b4b18a03dfbce54bb5f4518869773737e449301ba2477eb797afbb9972"
-		logic_hash = "cdd6b309a1e802f1251d726b0ea74e3d11fdd10d1d0bfa4c6f3d802f819368ec"
+		logic_hash = "v1_sha256_cdd6b309a1e802f1251d726b0ea74e3d11fdd10d1d0bfa4c6f3d802f819368ec"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2017-16995"
@@ -102244,10 +102441,10 @@ rule ELASTIC_Linux_Exploit_CVE_2017_16995_82816Caa : FILE MEMORY CVE_2017_16995
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "14e6b788db0db57067d9885ab5ff3d3a5749639549d82abd98fa4fcf27000f34"
-		logic_hash = "3ae00290073d41ff5dba2f677510bf9a9c0ebaed221901eb8b1a8dda08157a46"
+		logic_hash = "v1_sha256_3ae00290073d41ff5dba2f677510bf9a9c0ebaed221901eb8b1a8dda08157a46"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2017-16995"
@@ -102273,10 +102470,10 @@ rule ELASTIC_Linux_Exploit_CVE_2017_16995_5Edb0181 : FILE MEMORY CVE_2017_16995
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e4df84e1dffbad217d07222314a7e13fd74771a9111d07adc467a89d8ba81127"
-		logic_hash = "f6eb19329db765938b48021039baaf1b5aeb3240c405ba20ed81863a0fb4b583"
+		logic_hash = "v1_sha256_f6eb19329db765938b48021039baaf1b5aeb3240c405ba20ed81863a0fb4b583"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2017-16995"
@@ -102302,10 +102499,10 @@ rule ELASTIC_Macos_Backdoor_Kagent_64Ca1865 : FILE MEMORY
 		date = "2021-11-11"
 		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Backdoor_Kagent.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Backdoor_Kagent.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d599d7814adbab0f1442f5a10074e00f3a776ce183ea924abcd6154f0d068bb4"
-		logic_hash = "dea0a1bbe8c3065b395de50b5ffc2fbdf479ed35ce284fa33298d6ed55e960c6"
+		logic_hash = "v1_sha256_dea0a1bbe8c3065b395de50b5ffc2fbdf479ed35ce284fa33298d6ed55e960c6"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -102337,10 +102534,10 @@ rule ELASTIC_Windows_Wiper_Isaacwiper_239Cd2Dc : FILE MEMORY
 		date = "2022-03-04"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Wiper_IsaacWiper.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Wiper_IsaacWiper.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
-		logic_hash = "102ffe215b1e1c39e1225cb39dfeb10a20a08c5b10f836490fc1501c6eb9e930"
+		logic_hash = "v1_sha256_102ffe215b1e1c39e1225cb39dfeb10a20a08c5b10f836490fc1501c6eb9e930"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102371,10 +102568,10 @@ rule ELASTIC_Windows_Trojan_Sliver_46525B49 : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Sliver.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Sliver.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ecce5071c28940a1098aca3124b3f82e0630c4453f4f32e1b91576aac357ac9c"
-		logic_hash = "6e61d82b191a740882bcfeac2f2cf337e19ace7b05784ff041b6af2f79ed8809"
+		logic_hash = "v1_sha256_6e61d82b191a740882bcfeac2f2cf337e19ace7b05784ff041b6af2f79ed8809"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102401,10 +102598,10 @@ rule ELASTIC_Windows_Trojan_Sliver_C9Cae357 : FILE MEMORY
 		date = "2023-05-10"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Sliver.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Sliver.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "27210d8d6e16c492c2ee61a59d39c461312f5563221ad4a0917d4e93b699418e"
-		logic_hash = "fea862352981787055961b1171de9b69a9c13d246f434809c8f4416d5c49a0ff"
+		logic_hash = "v1_sha256_fea862352981787055961b1171de9b69a9c13d246f434809c8f4416d5c49a0ff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102430,10 +102627,10 @@ rule ELASTIC_Windows_Trojan_Sliver_1Dd6D9C2 : FILE MEMORY
 		date = "2023-05-10"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Sliver.yar#L42-L61"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Sliver.yar#L42-L61"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dc508a3e9ea093200acfc1ceebebb2b56686f4764fd8c94ab8c58eec7ee85c8b"
-		logic_hash = "5ef70322a6ee3dec609d2881b7624d25bc0297a2e6f43ac60834745e6a258cf3"
+		logic_hash = "v1_sha256_5ef70322a6ee3dec609d2881b7624d25bc0297a2e6f43ac60834745e6a258cf3"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -102460,10 +102657,10 @@ rule ELASTIC_Linux_Rootkit_Suterusu_94667Bf2 : FILE MEMORY
 		date = "2024-11-14"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Suterusu.yar#L1-L60"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Suterusu.yar#L1-L60"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "753fd579a684e09a70ae0fd147441c45d24a5acae94a78a92e393058c3b69506"
-		logic_hash = "a02e2d05bc3bee902829087e21dcc7ed19320336c7d66d3938b0b9fd4c298bcb"
+		logic_hash = "v1_sha256_a02e2d05bc3bee902829087e21dcc7ed19320336c7d66d3938b0b9fd4c298bcb"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -102519,7 +102716,7 @@ rule ELASTIC_Linux_Rootkit_Suterusu_94667Bf2 : FILE MEMORY
 		$menu12 = "Unhide file/directory named [ARG]"
 
 	condition:
-		4 of ($str*) or 6 of ($func*) or 4 of ($menu*)
+		4 of ( $str* ) or 6 of ( $func* ) or 4 of ( $menu* )
 }
 rule ELASTIC_Windows_Infostealer_Generic_Acde9261 : FILE MEMORY
 {
@@ -102530,10 +102727,10 @@ rule ELASTIC_Windows_Infostealer_Generic_Acde9261 : FILE MEMORY
 		date = "2024-10-21"
 		modified = "2024-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Infostealer_Generic.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Infostealer_Generic.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b46239c47a835757bba49078728f693b7273b0e3755e2968deac4aa92e90364d"
-		logic_hash = "86897117295bdcf79fad9f2ad939fabe89e3770309122ba142c7a26c926148c5"
+		logic_hash = "v1_sha256_86897117295bdcf79fad9f2ad939fabe89e3770309122ba142c7a26c926148c5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102563,10 +102760,10 @@ rule ELASTIC_Linux_Cryptominer_Uwamson_C42Fd06D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Uwamson.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Uwamson.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
-		logic_hash = "4ff7aad11adaae8fccb23d36fc96937ba48a5517895a742f2864ba1973f3db3a"
+		logic_hash = "v1_sha256_4ff7aad11adaae8fccb23d36fc96937ba48a5517895a742f2864ba1973f3db3a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102592,10 +102789,10 @@ rule ELASTIC_Linux_Cryptominer_Uwamson_D08B1D2E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Uwamson.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Uwamson.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4f7ad24b53b8e255710e4080d55f797564aa8c270bf100129bdbe52a29906b78"
-		logic_hash = "8f489bb020397beae91f7bce82bc1b47912deab1b79224158f79c53f1d7c7fd3"
+		logic_hash = "v1_sha256_8f489bb020397beae91f7bce82bc1b47912deab1b79224158f79c53f1d7c7fd3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102621,10 +102818,10 @@ rule ELASTIC_Linux_Cryptominer_Uwamson_0797De34 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Uwamson.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Uwamson.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e4699e35ce8091f97decbeebff63d7fa8c868172a79f9d9d52b6778c3faab8f2"
-		logic_hash = "7ab5dd99d8bbef61ec764900df5bebf39ed90833a8f9481c427cbb46faf2c521"
+		logic_hash = "v1_sha256_7ab5dd99d8bbef61ec764900df5bebf39ed90833a8f9481c427cbb46faf2c521"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102650,10 +102847,10 @@ rule ELASTIC_Linux_Cryptominer_Uwamson_41E36585 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Uwamson.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Uwamson.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
-		logic_hash = "e176523afe8c3394ddda41a5ef11f825fed1e149476709a7c1ea26b8af72d4fc"
+		logic_hash = "v1_sha256_e176523afe8c3394ddda41a5ef11f825fed1e149476709a7c1ea26b8af72d4fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102679,10 +102876,10 @@ rule ELASTIC_Windows_Hacktool_Chromekatz_Fa232Bba : FILE MEMORY
 		date = "2024-03-27"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_ChromeKatz.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_ChromeKatz.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3f6922049422df14f1a1777001fea54b18fbfb0a4b03c4ee27786bfbc3b8ab87"
-		logic_hash = "c86291fadd51845cbd7428b159e401d78ac77090e14e34d06bf7bf2018f4502a"
+		logic_hash = "v1_sha256_c86291fadd51845cbd7428b159e401d78ac77090e14e34d06bf7bf2018f4502a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102717,10 +102914,10 @@ rule ELASTIC_Linux_Cryptominer_Minertr_9901E275 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Minertr.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Minertr.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f77246a93782fd8ee40f12659f41fccc5012a429a8600f332c67a7c2669e4e8f"
-		logic_hash = "a18e0763fe9aec6d89b39cefb872b1751727e2d88ec4733b9c8b443b83219763"
+		logic_hash = "v1_sha256_a18e0763fe9aec6d89b39cefb872b1751727e2d88ec4733b9c8b443b83219763"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102746,10 +102943,10 @@ rule ELASTIC_Windows_Trojan_Poshc2_E2D3881E : FILE MEMORY
 		date = "2023-03-29"
 		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PoshC2.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PoshC2.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7a718a4f74656346bd9a2e29e008705fc2b1c4d167a52bd4f6ff10b3f2cd9395"
-		logic_hash = "4f3e2a9f22826a155a3007193a0f75a5fde6e423734a60f30628ea3bb33d3457"
+		logic_hash = "v1_sha256_4f3e2a9f22826a155a3007193a0f75a5fde6e423734a60f30628ea3bb33d3457"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102771,7 +102968,7 @@ rule ELASTIC_Windows_Trojan_Poshc2_E2D3881E : FILE MEMORY
 		$b4 = "TVqQAAMAAAAEAAAA"
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		1 of ( $a* ) and 1 of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Crytox_29859242 : FILE MEMORY
 {
@@ -102782,10 +102979,10 @@ rule ELASTIC_Windows_Ransomware_Crytox_29859242 : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Crytox.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Crytox.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "55a27cb6280f31c077987d338151b13e9dc0cc1c14d47a32e64de6d6c1a6a742"
-		logic_hash = "47ca96e14b2b56bc6ef1ed22b42adac7aa557170632c2dc085fae3baf6198f40"
+		logic_hash = "v1_sha256_47ca96e14b2b56bc6ef1ed22b42adac7aa557170632c2dc085fae3baf6198f40"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102811,10 +103008,10 @@ rule ELASTIC_Linux_Rootkit_Jynx_C470Eaff : FILE MEMORY
 		date = "2024-11-14"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Jynx.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Jynx.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "79c2ae1a95b44f3df42d669cb44db606d2088c5c393e7de5af875f255865ecb4"
-		logic_hash = "02d1ec1670089a3d9743e57a8dd504f57cea897eca0f896c129fd4f30f24e700"
+		logic_hash = "v1_sha256_02d1ec1670089a3d9743e57a8dd504f57cea897eca0f896c129fd4f30f24e700"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102839,7 +103036,7 @@ rule ELASTIC_Linux_Rootkit_Jynx_C470Eaff : FILE MEMORY
 		$hook11 = "forge_proc_cpu"
 
 	condition:
-		4 of ($hook*)
+		4 of ( $hook* )
 }
 rule ELASTIC_Windows_Hacktool_Sharpview_2C7603Ad : FILE MEMORY
 {
@@ -102850,10 +103047,10 @@ rule ELASTIC_Windows_Hacktool_Sharpview_2C7603Ad : FILE MEMORY
 		date = "2022-10-20"
 		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpView.yar#L1-L34"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpView.yar#L1-L34"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c0621954bd329b5cabe45e92b31053627c27fa40853beb2cce2734fa677ffd93"
-		logic_hash = "1f80b2fd6121c2b36742c819a56626af2e1450dac0f62c67d93f09e4e140b75f"
+		logic_hash = "v1_sha256_1f80b2fd6121c2b36742c819a56626af2e1450dac0f62c67d93f09e4e140b75f"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -102883,7 +103080,7 @@ rule ELASTIC_Windows_Hacktool_Sharpview_2C7603Ad : FILE MEMORY
 		$str9 = "^S-1-5-.*-[1-9]\\d{3,}$" ascii wide
 
 	condition:
-		$guid or ( all of ($str*) and 1 of ($print_str*))
+		$guid or ( all of ( $str* ) and 1 of ( $print_str* ) )
 }
 rule ELASTIC_Windows_Trojan_Microbackdoor_903E33C3 : FILE MEMORY
 {
@@ -102894,10 +103091,10 @@ rule ELASTIC_Windows_Trojan_Microbackdoor_903E33C3 : FILE MEMORY
 		date = "2022-03-07"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_MicroBackdoor.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_MicroBackdoor.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fbbfcc81a976b57739ef13c1545ea4409a1c69720469c05ba249a42d532f9c21"
-		logic_hash = "5f96f68df442eb1da21d87c3ae954c4e36cf87db583cbef1775f8ca9e76b776e"
+		logic_hash = "v1_sha256_5f96f68df442eb1da21d87c3ae954c4e36cf87db583cbef1775f8ca9e76b776e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102923,10 +103120,10 @@ rule ELASTIC_Windows_Trojan_Microbackdoor_46F2E5Fd : FILE MEMORY
 		date = "2022-03-07"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_MicroBackdoor.yar#L21-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_MicroBackdoor.yar#L21-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fbbfcc81a976b57739ef13c1545ea4409a1c69720469c05ba249a42d532f9c21"
-		logic_hash = "580be4c5b058916c2bc67a7964522a7c369bb254394e3cedbf0da025105231c4"
+		logic_hash = "v1_sha256_580be4c5b058916c2bc67a7964522a7c369bb254394e3cedbf0da025105231c4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102957,10 +103154,10 @@ rule ELASTIC_Linux_Hacktool_Tcpscan_334D0Ca5 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Tcpscan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Tcpscan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "62de04185c2e3c22af349479a68ad53c31b3874794e7c4f0f33e8d125c37f6b0"
-		logic_hash = "94ee723c660294e35caec5a2b66eeea64896265cfebc839ed3f55cf8f8c67d7e"
+		logic_hash = "v1_sha256_94ee723c660294e35caec5a2b66eeea64896265cfebc839ed3f55cf8f8c67d7e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -102986,10 +103183,10 @@ rule ELASTIC_Linux_Trojan_Lady_75F6392C : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Lady.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Lady.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c257ac7bd3a9639e0d67a7db603d5bc8d8505f6f2107a26c2615c5838cf11826"
-		logic_hash = "5160b6ab4800c72b48b501787f3164c2ba1061a2abe21c63180e02d6791a4c12"
+		logic_hash = "v1_sha256_5160b6ab4800c72b48b501787f3164c2ba1061a2abe21c63180e02d6791a4c12"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103015,9 +103212,9 @@ rule ELASTIC_Linux_Trojan_Meterpreter_A82F5D21 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Meterpreter.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d76886222de7292e8a76717f6d49452f52aaffb957bb0326bcfc7a35c3fdfc6a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Meterpreter.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d76886222de7292e8a76717f6d49452f52aaffb957bb0326bcfc7a35c3fdfc6a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103043,10 +103240,10 @@ rule ELASTIC_Linux_Trojan_Meterpreter_383C6708 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Meterpreter.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Meterpreter.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d9d607f0bbc101f7f6dc0f16328bdd8f6ddb8ae83107b7eee34e1cc02072cb15"
-		logic_hash = "b0fd479722ab0808a4709cbacbb874282c48a425f4dbdaec9f74bc7f839c82e4"
+		logic_hash = "v1_sha256_b0fd479722ab0808a4709cbacbb874282c48a425f4dbdaec9f74bc7f839c82e4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103072,9 +103269,9 @@ rule ELASTIC_Linux_Trojan_Meterpreter_621054Fe : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Meterpreter.yar#L40-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "18f22bb0aa66ec2ecdaa9ca0e0d00ee59a2c9a3f231bd71915140e4464a4ea78"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Meterpreter.yar#L40-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_18f22bb0aa66ec2ecdaa9ca0e0d00ee59a2c9a3f231bd71915140e4464a4ea78"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103100,9 +103297,9 @@ rule ELASTIC_Linux_Trojan_Meterpreter_1Bda891E : FILE MEMORY
 		date = "2021-12-13"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Meterpreter.yar#L59-L76"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "74e7547472117de20159f5b158cee0ccacc02a9aba5e5ad64a52c552c966d539"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Meterpreter.yar#L59-L76"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_74e7547472117de20159f5b158cee0ccacc02a9aba5e5ad64a52c552c966d539"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103128,9 +103325,9 @@ rule ELASTIC_Macos_Creddump_Keychainaccess_535C1511 : FILE MEMORY
 		date = "2023-04-11"
 		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Creddump_KeychainAccess.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "c2995263622d62b11db93f7d163a7595e316ec24b51099f434bc5dbd0afefbfe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Creddump_KeychainAccess.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_c2995263622d62b11db93f7d163a7595e316ec24b51099f434bc5dbd0afefbfe"
 		score = 75
 		quality = 49
 		tags = "FILE, MEMORY"
@@ -103152,7 +103349,7 @@ rule ELASTIC_Macos_Creddump_Keychainaccess_535C1511 : FILE MEMORY
 		$strings8 = "Failed to get password" ascii wide nocase
 
 	condition:
-		all of ($strings1,$strings2) or $strings4 or all of ($strings3,$strings5) or all of ($strings6,$strings7,$strings8)
+		all of ( $strings1 , $strings2 ) or $strings4 or all of ( $strings3 , $strings5 ) or all of ( $strings6 , $strings7 , $strings8 )
 }
 rule ELASTIC_Windows_Trojan_Jesterstealer_B35C6F4B : FILE MEMORY
 {
@@ -103163,10 +103360,10 @@ rule ELASTIC_Windows_Trojan_Jesterstealer_B35C6F4B : FILE MEMORY
 		date = "2022-02-28"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_JesterStealer.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_JesterStealer.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "10c3846867f70dd26c5a54332ed22070c9e5e0e4f52f05fdae12ead801f7933b"
-		logic_hash = "acc49348267e963af9ff6ba7afa053d4056d4068b4386a872e33e025790ba759"
+		logic_hash = "v1_sha256_acc49348267e963af9ff6ba7afa053d4056d4068b4386a872e33e025790ba759"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103198,10 +103395,10 @@ rule ELASTIC_Windows_Trojan_Jesterstealer_8F657F58 : FILE MEMORY
 		date = "2022-02-28"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_JesterStealer.yar#L27-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_JesterStealer.yar#L27-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "10c3846867f70dd26c5a54332ed22070c9e5e0e4f52f05fdae12ead801f7933b"
-		logic_hash = "20a0d8be9c25d50d4dddd455ecb9739f772f57e988855c7fc2df597b2f67585b"
+		logic_hash = "v1_sha256_20a0d8be9c25d50d4dddd455ecb9739f772f57e988855c7fc2df597b2f67585b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103227,10 +103424,10 @@ rule ELASTIC_Linux_Trojan_Ircbot_Bb204B81 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ircbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ircbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6147481d083c707dc98905a1286827a6e7009e08490e7d7c280ed5a6356527ad"
-		logic_hash = "90d211c11281f5f8832210f3fc087fe5ff5a519b9b38628835e8b5fcc560bd9b"
+		logic_hash = "v1_sha256_90d211c11281f5f8832210f3fc087fe5ff5a519b9b38628835e8b5fcc560bd9b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103256,10 +103453,10 @@ rule ELASTIC_Linux_Trojan_Ircbot_7C60454D : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ircbot.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ircbot.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "14eeff3516de6d2cb11d6ada4026e3dcee1402940e3a0fb4fa224a5c030049d8"
-		logic_hash = "90dcd0a3d3f6345e66db0a4f8465e3830eb4e3bcb675db16c60a89e20f935aec"
+		logic_hash = "v1_sha256_90dcd0a3d3f6345e66db0a4f8465e3830eb4e3bcb675db16c60a89e20f935aec"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103285,10 +103482,10 @@ rule ELASTIC_Windows_Trojan_Blister_Cb99A1Df : FILE MEMORY
 		date = "2021-12-21"
 		modified = "2022-01-13"
 		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Blister.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Blister.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00"
-		logic_hash = "deb1be5300d8af12dda868dd5f4ccdbb3ec653bd97c33a09e567c13ecafb9e8a"
+		logic_hash = "v1_sha256_deb1be5300d8af12dda868dd5f4ccdbb3ec653bd97c33a09e567c13ecafb9e8a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103316,10 +103513,10 @@ rule ELASTIC_Windows_Trojan_Blister_9D757838 : FILE MEMORY
 		date = "2022-04-26"
 		modified = "2022-06-09"
 		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Blister.yar#L24-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Blister.yar#L24-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "863de84a39c9f741d8103db83b076695d0d10a7384e4e3ba319c05a6018d9737"
-		logic_hash = "4d9ce1622d77b2ac8b20b2dfb60ac672752dabab315221a5449ebd3c73a3edca"
+		logic_hash = "v1_sha256_4d9ce1622d77b2ac8b20b2dfb60ac672752dabab315221a5449ebd3c73a3edca"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103346,10 +103543,10 @@ rule ELASTIC_Windows_Trojan_Blister_68B53E1B : FILE MEMORY
 		date = "2023-08-02"
 		modified = "2023-08-08"
 		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Blister.yar#L46-L66"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Blister.yar#L46-L66"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5fc79a4499bafa3a881778ef51ce29ef015ee58a587e3614702e69da304395db"
-		logic_hash = "6d935461406a6b9b39867d52aa5ecb088945ae0f8c56895a67e8565e5a2a3699"
+		logic_hash = "v1_sha256_6d935461406a6b9b39867d52aa5ecb088945ae0f8c56895a67e8565e5a2a3699"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103376,10 +103573,10 @@ rule ELASTIC_Windows_Trojan_Blister_487B0966 : FILE MEMORY
 		date = "2023-09-11"
 		modified = "2023-09-20"
 		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Blister.yar#L68-L89"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Blister.yar#L68-L89"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5fc79a4499bafa3a881778ef51ce29ef015ee58a587e3614702e69da304395db"
-		logic_hash = "521409d03335205507cc6894e0de3ca627eb966a95a2f8e7b931e552ad78bbb7"
+		logic_hash = "v1_sha256_521409d03335205507cc6894e0de3ca627eb966a95a2f8e7b931e552ad78bbb7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103407,10 +103604,10 @@ rule ELASTIC_Windows_Trojan_Blister_26F8C5F2 : FILE MEMORY
 		date = "2024-09-25"
 		modified = "2024-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Blister.yar#L91-L110"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Blister.yar#L91-L110"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cba30fb1731e165acc256d99d32f3c9e5abfa27d152419d24a91d8b79c5c5cb0"
-		logic_hash = "dc87a3ae4edf0b8ee18cb7c34f9b4a0305c504b7ef66cb3232c91dc364d3563c"
+		logic_hash = "v1_sha256_dc87a3ae4edf0b8ee18cb7c34f9b4a0305c504b7ef66cb3232c91dc364d3563c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103437,10 +103634,10 @@ rule ELASTIC_Linux_Trojan_Ipstorm_3C43D4A7 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ipstorm.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ipstorm.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5103133574615fb49f6a94607540644689be017740d17005bc08b26be9485aa7"
-		logic_hash = "c7e9191312197f8925d7231d0b8badf8b5ca35685df909c0d1feb301b4385d7b"
+		logic_hash = "v1_sha256_c7e9191312197f8925d7231d0b8badf8b5ca35685df909c0d1feb301b4385d7b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103466,10 +103663,10 @@ rule ELASTIC_Linux_Trojan_Ipstorm_F9269F00 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ipstorm.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ipstorm.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5103133574615fb49f6a94607540644689be017740d17005bc08b26be9485aa7"
-		logic_hash = "5914d222b49aaf6c1040e48ffd93c04bd5df25f1d97bde79b034862fca6555f6"
+		logic_hash = "v1_sha256_5914d222b49aaf6c1040e48ffd93c04bd5df25f1d97bde79b034862fca6555f6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103495,10 +103692,10 @@ rule ELASTIC_Linux_Trojan_Ipstorm_08Bcf61C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Ipstorm.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Ipstorm.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "503f293d84de4f2c826f81a68180ad869e0d1448ea6c0dbf09a7b23801e1a9b9"
-		logic_hash = "fb2755c04b61d19788a92b8c9c1c9eb2552b62b27011e302840fdcf689b3d9b4"
+		logic_hash = "v1_sha256_fb2755c04b61d19788a92b8c9c1c9eb2552b62b27011e302840fdcf689b3d9b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103524,9 +103721,9 @@ rule ELASTIC_Windows_PUP_Generic_198B73Aa : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_PUP_Generic.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "a584c34b9dfc2d78bf8a1e594a2ed519d20088184ce1df09e679b2400aa396d3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_PUP_Generic.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_a584c34b9dfc2d78bf8a1e594a2ed519d20088184ce1df09e679b2400aa396d3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103554,10 +103751,10 @@ rule ELASTIC_Linux_Exploit_CVE_2010_3301_79D52Efd : FILE MEMORY CVE_2010_3301
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "53a2163ad17a414d9db95f5287d9981c9410e7eaeea096610ba622eb763a6970"
-		logic_hash = "1d4eb14042f552aa1577d0fe452e92c25bda66d0ad1a66e824677bee65908578"
+		logic_hash = "v1_sha256_1d4eb14042f552aa1577d0fe452e92c25bda66d0ad1a66e824677bee65908578"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2010-3301"
@@ -103583,10 +103780,10 @@ rule ELASTIC_Linux_Exploit_CVE_2010_3301_D0Eb0924 : FILE MEMORY CVE_2010_3301
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "907995e90a80d3ace862f2ffdf13fd361762b5acc5397e14135d85ca6a61619b"
-		logic_hash = "5229be3d1997ee4d05846d6804ffafd36c088dd8607a1fba39a0a43950e448c1"
+		logic_hash = "v1_sha256_5229be3d1997ee4d05846d6804ffafd36c088dd8607a1fba39a0a43950e448c1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2010-3301"
@@ -103612,10 +103809,10 @@ rule ELASTIC_Linux_Exploit_CVE_2010_3301_A5828970 : FILE MEMORY CVE_2010_3301
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4fc781f765a65b714ec27080f25c03f20e06830216506e06325240068ba62d83"
-		logic_hash = "61b0cb38a6e14efee157547e811450d2ed4674f79ac86656a8d984084f71a665"
+		logic_hash = "v1_sha256_61b0cb38a6e14efee157547e811450d2ed4674f79ac86656a8d984084f71a665"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2010-3301"
@@ -103641,10 +103838,10 @@ rule ELASTIC_Multi_Trojan_Coreimpact_37703Dc3 : FILE MEMORY
 		date = "2022-08-10"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Trojan_Coreimpact.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_Coreimpact.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2d954908da9f63cd3942c0df2e8bb5fe861ac5a336ddef2bd0a977cebe030ad7"
-		logic_hash = "0695f22d6eb8c1b335c43213087539db419562bebd6f5b948cbb168c454bd37c"
+		logic_hash = "v1_sha256_0695f22d6eb8c1b335c43213087539db419562bebd6f5b948cbb168c454bd37c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103674,9 +103871,9 @@ rule ELASTIC_Windows_Attacksimulation_Hovercraft_F5C7178F : FILE MEMORY
 		date = "2022-05-23"
 		modified = "2022-07-18"
 		reference = "046645b2a646c83b4434a893a0876ea9bd51ae05e70d4e72f2ccc648b0f18cb6"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_AttackSimulation_Hovercraft.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e707e89904a5fa4d30f94bfc625b736a411df6bb055c0e40df18ae65025a3740"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_AttackSimulation_Hovercraft.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e707e89904a5fa4d30f94bfc625b736a411df6bb055c0e40df18ae65025a3740"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103703,9 +103900,9 @@ rule ELASTIC_Linux_Cryptominer_Camelot_9Ac1654B : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "5de1f43803f3d3b94149ea39ed961e7b9a1ad86c15c5085e2e0a5f9c314e98ff"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_5de1f43803f3d3b94149ea39ed961e7b9a1ad86c15c5085e2e0a5f9c314e98ff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103731,9 +103928,9 @@ rule ELASTIC_Linux_Cryptominer_Camelot_Dd167Aa0 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L20-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "88be4fbb337fa866e126021b40a01d86a33029071af7efc289a8c5490d21ea8a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L20-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_88be4fbb337fa866e126021b40a01d86a33029071af7efc289a8c5490d21ea8a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103759,10 +103956,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_B25398Dd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L39-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L39-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6fb3b77be0a66a10124a82f9ec6ad22247d7865a4d26aa49c5d602320318ce3c"
-		logic_hash = "e7fdb3c573909e8f197417278a6d333cc3743b05257d81fed46769b185354183"
+		logic_hash = "v1_sha256_e7fdb3c573909e8f197417278a6d333cc3743b05257d81fed46769b185354183"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103788,10 +103985,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_6A279F19 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L59-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L59-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b01f72b2c53db9b8f253bb98c6584581ebd1af1b1aaee62659f54193c269fca"
-		logic_hash = "91e3c0d96fe5ab9c61b38f01d39639020ec459bec6348b1f87a2c5b1a874e24a"
+		logic_hash = "v1_sha256_91e3c0d96fe5ab9c61b38f01d39639020ec459bec6348b1f87a2c5b1a874e24a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103817,10 +104014,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_4E7945A4 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L79-L97"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L79-L97"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b7504ce57787956e486d951b4ff78d73807fcc2a7958b172febc6d914e7a23a7"
-		logic_hash = "aebc544076954fcce917e026467a8828b18446ce7c690b4c748562e311b7d491"
+		logic_hash = "v1_sha256_aebc544076954fcce917e026467a8828b18446ce7c690b4c748562e311b7d491"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103846,10 +104043,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_29C1C386 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L99-L117"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L99-L117"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc73bbfb12c64d2f20efa22a6d8d8c5782ef57cb0ca6d844669b262e80db2444"
-		logic_hash = "1a3a9065cbb59658c06dfbfc622ccd2e577e988370ffe47848a5859f96db4e24"
+		logic_hash = "v1_sha256_1a3a9065cbb59658c06dfbfc622ccd2e577e988370ffe47848a5859f96db4e24"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103875,9 +104072,9 @@ rule ELASTIC_Linux_Cryptominer_Camelot_25B63F54 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L119-L136"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "640ffe2040e382ad536c1b6947e05f8c25ff82897ef7ac673a7676815856a346"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L119-L136"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_640ffe2040e382ad536c1b6947e05f8c25ff82897ef7ac673a7676815856a346"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103903,10 +104100,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_73E2373E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L138-L156"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L138-L156"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc73bbfb12c64d2f20efa22a6d8d8c5782ef57cb0ca6d844669b262e80db2444"
-		logic_hash = "2377da6667860dc7204760ee64213cba95909c9181bd1a3ea96c3ad29988c9f7"
+		logic_hash = "v1_sha256_2377da6667860dc7204760ee64213cba95909c9181bd1a3ea96c3ad29988c9f7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103932,10 +104129,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_B8552Fff : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L158-L176"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L158-L176"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
-		logic_hash = "476b800422b6d98405d8bde727bb589c5cae36723436b269beaa65381b3d0abe"
+		logic_hash = "v1_sha256_476b800422b6d98405d8bde727bb589c5cae36723436b269beaa65381b3d0abe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103961,10 +104158,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_83550472 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L178-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L178-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d2d8421ffdcebb7fed00edcf306ec5e86fc30ad3e87d55e85b05bea5dc1f7d63"
-		logic_hash = "f62d4a2a7dfb312b2e362844bfa29bd4453a05f31b4f72550ef29ff40ed6fb9d"
+		logic_hash = "v1_sha256_f62d4a2a7dfb312b2e362844bfa29bd4453a05f31b4f72550ef29ff40ed6fb9d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -103990,10 +104187,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_8799D8D6 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L198-L216"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L198-L216"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4a6d98eae8951e5b9e0a226f1197732d6d14ed45c1b1534d3cdb4413261eb352"
-		logic_hash = "4bcd7931aeed09069d5dd248a66f119a2bdf628e03b9abed9ee2de59a149c2bc"
+		logic_hash = "v1_sha256_4bcd7931aeed09069d5dd248a66f119a2bdf628e03b9abed9ee2de59a149c2bc"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -104019,10 +104216,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_0F7C5375 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L218-L236"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L218-L236"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e75be5377ad65abdc69e6c7f9fe17429a98188a217d0ca3a6f40e75c4f0c07e8"
-		logic_hash = "05f4b16a7e4c7ffbc6b8a2f60050a4ac1d05d9efbe948e2da689055f6383cf82"
+		logic_hash = "v1_sha256_05f4b16a7e4c7ffbc6b8a2f60050a4ac1d05d9efbe948e2da689055f6383cf82"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104048,10 +104245,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_87639Dbd : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L238-L256"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L238-L256"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d2d8421ffdcebb7fed00edcf306ec5e86fc30ad3e87d55e85b05bea5dc1f7d63"
-		logic_hash = "b81af8c9baee999b91e63f97d5a46451d9960487b25b04079df5539f857be466"
+		logic_hash = "v1_sha256_b81af8c9baee999b91e63f97d5a46451d9960487b25b04079df5539f857be466"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104077,10 +104274,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_Cdd631C1 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L258-L276"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L258-L276"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "91549c171ae7f43c1a85a303be30169932a071b5c2b6cf3f4913f20073c97897"
-		logic_hash = "5e4b26a74fc3737c068917c7c1228048f885ac30fc326a2844611f7e707d1300"
+		logic_hash = "v1_sha256_5e4b26a74fc3737c068917c7c1228048f885ac30fc326a2844611f7e707d1300"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104106,10 +104303,10 @@ rule ELASTIC_Linux_Cryptominer_Camelot_209B02Dd : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Camelot.yar#L278-L296"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Camelot.yar#L278-L296"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "60d33d1fdabc6b10f7bb304f4937051a53d63f39613853836e6c4d095343092e"
-		logic_hash = "5cadc955242d4b7d5fd4365a0b425051d89c905e3d49ea03967150de0020225c"
+		logic_hash = "v1_sha256_5cadc955242d4b7d5fd4365a0b425051d89c905e3d49ea03967150de0020225c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104135,10 +104332,10 @@ rule ELASTIC_Windows_Vulndriver_Microstar_D72B85B2 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_MicroStar.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_MicroStar.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ed15a390d8dfbd8a8fb99e8367e19bfd1cced0e629dfe43ccdb46c863394b59"
-		logic_hash = "04e9c1f318acae5544cdc826938383bf8f6c6b838cb5828a7097383ac564f404"
+		logic_hash = "v1_sha256_04e9c1f318acae5544cdc826938383bf8f6c6b838cb5828a7097383ac564f404"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104155,7 +104352,7 @@ rule ELASTIC_Windows_Vulndriver_Microstar_D72B85B2 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Macos_Hacktool_Bifrost_39Bcbdf8 : FILE MEMORY
 {
@@ -104166,10 +104363,10 @@ rule ELASTIC_Macos_Hacktool_Bifrost_39Bcbdf8 : FILE MEMORY
 		date = "2021-10-12"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Hacktool_Bifrost.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Hacktool_Bifrost.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e2b64df0add316240b010db7d34d83fc9ac7001233259193e5a72b6e04aece46"
-		logic_hash = "a2ff4f1aca51e80f2b277e9171e99a80a75177d1d17d487de2eb8872832cb0d5"
+		logic_hash = "v1_sha256_a2ff4f1aca51e80f2b277e9171e99a80a75177d1d17d487de2eb8872832cb0d5"
 		score = 75
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -104203,10 +104400,10 @@ rule ELASTIC_Linux_Cryptominer_Zexaf_B90E7683 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Zexaf.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Zexaf.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "98650ebb7e463a06e737bcea4fd2b0f9036fafb0638ba8f002e6fe141b9fecfe"
-		logic_hash = "d8485d8fbf00d5c828d7c6c80fef61f228f308e3d27a762514cfb3f00053b30b"
+		logic_hash = "v1_sha256_d8485d8fbf00d5c828d7c6c80fef61f228f308e3d27a762514cfb3f00053b30b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104232,10 +104429,10 @@ rule ELASTIC_Windows_Vulndriver_Directio_7Bea6C8F : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_DirectIo.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_DirectIo.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1dadd707c55413a16320dc70d2ca7784b94c6658331a753b3424ae696c5d93ea"
-		logic_hash = "3b148fed9c52af1d2d1eb18b6c4b191fb80e547f2da1beccdaf3d3e0237ecc1b"
+		logic_hash = "v1_sha256_3b148fed9c52af1d2d1eb18b6c4b191fb80e547f2da1beccdaf3d3e0237ecc1b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104251,7 +104448,7 @@ rule ELASTIC_Windows_Vulndriver_Directio_7Bea6C8F : FILE
 		$str2 = { 9B 49 18 FC CD 5C EA D2 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1 and not $str2
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1 and not $str2
 }
 rule ELASTIC_Windows_Vulndriver_Directio_Abe8Bfa6 : FILE
 {
@@ -104262,10 +104459,10 @@ rule ELASTIC_Windows_Vulndriver_Directio_Abe8Bfa6 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_DirectIo.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_DirectIo.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5"
-		logic_hash = "5224938b0381943a171b1db00249e71c43ce2c179ef4bbe14b46cc0787e35cb2"
+		logic_hash = "v1_sha256_5224938b0381943a171b1db00249e71c43ce2c179ef4bbe14b46cc0787e35cb2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104281,7 +104478,7 @@ rule ELASTIC_Windows_Vulndriver_Directio_Abe8Bfa6 : FILE
 		$str2 = { 9B 49 18 FC CD 5C EA D2 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1 and not $str2
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1 and not $str2
 }
 rule ELASTIC_Windows_Vulndriver_Vbox_3315863F : FILE
 {
@@ -104292,10 +104489,10 @@ rule ELASTIC_Windows_Vulndriver_Vbox_3315863F : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_VBox.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_VBox.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "42d926cfb3794f9b1e3cb397498696cb687f505e15feb9df11b419c49c9af498"
-		logic_hash = "ba4e6a94516e36dcd6140b6732d959703e2c58a79add705b9260001ea26db738"
+		logic_hash = "v1_sha256_ba4e6a94516e36dcd6140b6732d959703e2c58a79add705b9260001ea26db738"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104311,7 +104508,7 @@ rule ELASTIC_Windows_Vulndriver_Vbox_3315863F : FILE
 		$subject_name = { 06 03 55 04 03 [2] 69 6E 6E 6F 74 65 6B 20 47 6D 62 48 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $subject_name
 }
 rule ELASTIC_Windows_Vulndriver_Vbox_1B1C5Cd5 : FILE
 {
@@ -104322,10 +104519,10 @@ rule ELASTIC_Windows_Vulndriver_Vbox_1B1C5Cd5 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_VBox.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_VBox.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1684e24dae20ab83ab5462aa1ff6473110ec53f52a32cfb8c1fe95a2642c6d22"
-		logic_hash = "5fcfffea021aee8d18172383df0e65f8c618fab545c800f1a7b659e8112c6c0f"
+		logic_hash = "v1_sha256_5fcfffea021aee8d18172383df0e65f8c618fab545c800f1a7b659e8112c6c0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104342,7 +104539,7 @@ rule ELASTIC_Windows_Vulndriver_Vbox_1B1C5Cd5 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Linux_Trojan_Pornoasset_927F314F : FILE MEMORY
 {
@@ -104353,10 +104550,10 @@ rule ELASTIC_Linux_Trojan_Pornoasset_927F314F : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Pornoasset.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Pornoasset.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93"
-		logic_hash = "7267375346c1628e04c8272c24bde04a5d6ae2b420f64dfe58657cfc3eecc0e7"
+		logic_hash = "v1_sha256_7267375346c1628e04c8272c24bde04a5d6ae2b420f64dfe58657cfc3eecc0e7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104382,10 +104579,10 @@ rule ELASTIC_Windows_Virus_Floxif_493D1897 : FILE MEMORY
 		date = "2023-09-26"
 		modified = "2023-11-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Virus_Floxif.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Virus_Floxif.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e628b7973ee25fdfd8f849fdf5923c6fba48141de802b0b4ce3e9ad2e40fe470"
-		logic_hash = "d3f516966bd4423c49771251075a1ea2f725aec91615f7f44dd098da2a4f3574"
+		logic_hash = "v1_sha256_d3f516966bd4423c49771251075a1ea2f725aec91615f7f44dd098da2a4f3574"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104411,10 +104608,10 @@ rule ELASTIC_Linux_Packer_Patched_UPX_62E11C64 : FILE
 		date = "2021-06-08"
 		modified = "2021-07-28"
 		reference = "https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Packer_Patched_UPX.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Packer_Patched_UPX.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "02f81a1e1edcb9032a1d7256a002b11e1e864b2e9989f5d24ea1c9b507895669"
-		logic_hash = "cb576fdd59c255234a96397460b81cbb2deeb38befaed101749b7bb515624028"
+		logic_hash = "v1_sha256_cb576fdd59c255234a96397460b81cbb2deeb38befaed101749b7bb515624028"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104429,7 +104626,7 @@ rule ELASTIC_Linux_Packer_Patched_UPX_62E11C64 : FILE
 		$a = { 55 50 58 21 [4] 00 00 00 00 00 00 00 00 00 00 00 00 }
 
 	condition:
-		all of them and $a in (0..255)
+		all of them and $a in ( 0 .. 255 )
 }
 rule ELASTIC_Windows_Vulndriver_Truesight_7429Ac81 : FILE MEMORY
 {
@@ -104440,10 +104637,10 @@ rule ELASTIC_Windows_Vulndriver_Truesight_7429Ac81 : FILE MEMORY
 		date = "2024-06-21"
 		modified = "2024-09-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_TrueSight.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_TrueSight.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c"
-		logic_hash = "8490947a632ca32822231631e19e52380b8b1a26c74c697d36898b0facbfcc9c"
+		logic_hash = "v1_sha256_8490947a632ca32822231631e19e52380b8b1a26c74c697d36898b0facbfcc9c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104459,7 +104656,7 @@ rule ELASTIC_Windows_Vulndriver_Truesight_7429Ac81 : FILE MEMORY
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x03][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x02][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $original_file_name and $version
 }
 rule ELASTIC_Windows_Hacktool_Edrrecon_69453Aff : FILE MEMORY
 {
@@ -104470,10 +104667,10 @@ rule ELASTIC_Windows_Hacktool_Edrrecon_69453Aff : FILE MEMORY
 		date = "2024-03-07"
 		modified = "2024-06-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_EDRrecon.yar#L1-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_EDRrecon.yar#L1-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f62e51b2405c0d42c53ff1f560376ef0530ba2eea1c97e18f2a3cf148346bcd1"
-		logic_hash = "3d0f6dc5d47a3c0957a7aa8d2918fee113d079d7d74f37a1c17c5429034ba41f"
+		logic_hash = "v1_sha256_3d0f6dc5d47a3c0957a7aa8d2918fee113d079d7d74f37a1c17c5429034ba41f"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -104539,10 +104736,10 @@ rule ELASTIC_Windows_Hacktool_Edrrecon_Ca314Aa1 : FILE MEMORY
 		date = "2024-03-07"
 		modified = "2024-06-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_EDRrecon.yar#L61-L115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_EDRrecon.yar#L61-L115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f62e51b2405c0d42c53ff1f560376ef0530ba2eea1c97e18f2a3cf148346bcd1"
-		logic_hash = "04b8681b0b6f8fa51eb90488edf35638da3334886c7db5fc22218712b0d23007"
+		logic_hash = "v1_sha256_04b8681b0b6f8fa51eb90488edf35638da3334886c7db5fc22218712b0d23007"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -104604,10 +104801,10 @@ rule ELASTIC_Windows_Vulndriver_Segwin_04A3962E : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Segwin.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Segwin.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
-		logic_hash = "1e9ba5fc78f2b4eeee56314c9e8cf3071817d726b44cb8510f8d7069e85ab7bf"
+		logic_hash = "v1_sha256_1e9ba5fc78f2b4eeee56314c9e8cf3071817d726b44cb8510f8d7069e85ab7bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104624,7 +104821,7 @@ rule ELASTIC_Windows_Vulndriver_Segwin_04A3962E : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x64][\x00-\x00])([\x00-\x02][\x00-\x00])([\x00-\x07][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x63][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x64][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x06][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Trojan_Cryptbot_489A6562 : FILE MEMORY
 {
@@ -104635,10 +104832,10 @@ rule ELASTIC_Windows_Trojan_Cryptbot_489A6562 : FILE MEMORY
 		date = "2021-08-18"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Cryptbot.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Cryptbot.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "423563995910af04cb2c4136bf50607fc26977dfa043a84433e8bd64b3315110"
-		logic_hash = "7fee3cc67419e66de790ba2ad8c3102425b3a45bdfe31801758dd38021a8439b"
+		logic_hash = "v1_sha256_7fee3cc67419e66de790ba2ad8c3102425b3a45bdfe31801758dd38021a8439b"
 		score = 75
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -104668,10 +104865,10 @@ rule ELASTIC_Linux_Trojan_Adlibrary_2E908E5F : FILE MEMORY
 		date = "2022-08-23"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Adlibrary.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Adlibrary.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "acb22b88ecfb31664dc07b2cb3490b78d949cd35a67f3fdcd65b1a4335f728f1"
-		logic_hash = "0d0df636876adf0268b7a409bfc9d8bfad298793d11297596ef91aeba86889da"
+		logic_hash = "v1_sha256_0d0df636876adf0268b7a409bfc9d8bfad298793d11297596ef91aeba86889da"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104697,10 +104894,10 @@ rule ELASTIC_Windows_Vulndriver_Toshibabios_2891972A : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_ToshibaBios.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_ToshibaBios.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
-		logic_hash = "c253181a754f421ee36ced994412672770497756848d78d557907957486e711b"
+		logic_hash = "v1_sha256_c253181a754f421ee36ced994412672770497756848d78d557907957486e711b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104717,7 +104914,7 @@ rule ELASTIC_Windows_Vulndriver_Toshibabios_2891972A : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x04][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x02][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Trojan_Pizzapotion_D334C613 : FILE MEMORY
 {
@@ -104728,10 +104925,10 @@ rule ELASTIC_Windows_Trojan_Pizzapotion_D334C613 : FILE MEMORY
 		date = "2023-09-13"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_PizzaPotion.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_PizzaPotion.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "37bee101cf34a84cba49adb67a555c6ebd3b8ac7c25d50247b0a014c82630003"
-		logic_hash = "de7d395c8a993abf9858858e56ba0ec4acbf0fa1c8bfe4a34ae95be2205967fc"
+		logic_hash = "v1_sha256_de7d395c8a993abf9858858e56ba0ec4acbf0fa1c8bfe4a34ae95be2205967fc"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -104762,10 +104959,10 @@ rule ELASTIC_Windows_Ransomware_Mespinoza_3Adb59F5 : FILE MEMORY
 		date = "2021-08-05"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Mespinoza.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Mespinoza.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6f3cd5f05ab4f404c78bab92f705c91d967b31a9b06017d910af312fa87ae3d6"
-		logic_hash = "28c8ad42a3af70fed274edc9105dae5cef13749d71510561a50428c822464934"
+		logic_hash = "v1_sha256_28c8ad42a3af70fed274edc9105dae5cef13749d71510561a50428c822464934"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104793,10 +104990,10 @@ rule ELASTIC_Windows_Trojan_Gh0St_Ee6De6Bc : FILE MEMORY
 		date = "2021-06-10"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Gh0st.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Gh0st.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ea1dc816dfc87c2340a8b8a77a4f97618bccf19ad3b006dce4994be02e13245d"
-		logic_hash = "3619df974c9f4ec76899afbafdfd6839070714862c7361be476cf8f83e766e2f"
+		logic_hash = "v1_sha256_3619df974c9f4ec76899afbafdfd6839070714862c7361be476cf8f83e766e2f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104826,10 +105023,10 @@ rule ELASTIC_Windows_Ransomware_Agenda_D7B1Af3F : FILE MEMORY
 		date = "2024-09-10"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Agenda.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Agenda.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "117fc30c25b1f28cd923b530ab9f91a0a818925b0b89b8bc9a7f820a9e630464"
-		logic_hash = "a68330bf98ae200ff2d0da51836436f2bdff5c10eb4e0145502f688055980493"
+		logic_hash = "v1_sha256_a68330bf98ae200ff2d0da51836436f2bdff5c10eb4e0145502f688055980493"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104858,10 +105055,10 @@ rule ELASTIC_Windows_Vulndriver_Gdrv_5368078B : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_GDrv.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_GDrv.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
-		logic_hash = "f4d43ac4a4b6d879ffb5ba637b38ec75c8b57f531db644015c1a71c2cdea45d5"
+		logic_hash = "v1_sha256_f4d43ac4a4b6d879ffb5ba637b38ec75c8b57f531db644015c1a71c2cdea45d5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104878,7 +105075,7 @@ rule ELASTIC_Windows_Vulndriver_Gdrv_5368078B : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\x26][\x00-\x07]|[\x00-\xff][\x00-\x06])([\x00-\xce][\x00-\x0e]|[\x00-\xff][\x00-\x0d])|([\x00-\xff][\x00-\xff])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x02][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xcd][\x00-\x0e]|[\x00-\xff][\x00-\x0d]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Windows_Ransomware_Whispergate_C80F3B4B : FILE MEMORY
 {
@@ -104889,10 +105086,10 @@ rule ELASTIC_Windows_Ransomware_Whispergate_C80F3B4B : FILE MEMORY
 		date = "2022-01-17"
 		modified = "2022-01-17"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_WhisperGate.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_WhisperGate.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
-		logic_hash = "04452141a867d4f6fce618c21795cc142a1265b56c62ecb9e579003d36b4b2b9"
+		logic_hash = "v1_sha256_04452141a867d4f6fce618c21795cc142a1265b56c62ecb9e579003d36b4b2b9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104919,10 +105116,10 @@ rule ELASTIC_Windows_Ransomware_Whispergate_3476008E : FILE MEMORY
 		date = "2022-01-18"
 		modified = "2022-01-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_WhisperGate.yar#L22-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_WhisperGate.yar#L22-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
-		logic_hash = "729818df1b6b82fc00eba0fe1c9139ec4746e1775146ab7fdea9e25dec1cddea"
+		logic_hash = "v1_sha256_729818df1b6b82fc00eba0fe1c9139ec4746e1775146ab7fdea9e25dec1cddea"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -104951,10 +105148,10 @@ rule ELASTIC_Windows_Vulndriver_BSMI_65223B8D : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_BSMI.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_BSMI.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
-		logic_hash = "c4fa65bbd9d374092137b65209f29744caeb8b04fbd364b1acc67b73c45604e8"
+		logic_hash = "v1_sha256_c4fa65bbd9d374092137b65209f29744caeb8b04fbd364b1acc67b73c45604e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -104971,7 +105168,7 @@ rule ELASTIC_Windows_Vulndriver_BSMI_65223B8D : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Linux_Rootkit_Brokepkg_7B7D4581 : FILE MEMORY
 {
@@ -104982,10 +105179,10 @@ rule ELASTIC_Linux_Rootkit_Brokepkg_7B7D4581 : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_BrokePKG.yar#L1-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_BrokePKG.yar#L1-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "97c5e011c7315a05c470eef4032030e461ec2a596513703beedeec0b0c6ed2da"
-		logic_hash = "a4e5916fa0ca6b07fcbb6f970abb0212a970cf723b906e605c18e620efc501dc"
+		logic_hash = "v1_sha256_a4e5916fa0ca6b07fcbb6f970abb0212a970cf723b906e605c18e620efc501dc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105019,7 +105216,7 @@ rule ELASTIC_Linux_Rootkit_Brokepkg_7B7D4581 : FILE MEMORY
 		$hook10 = "orig_getdents"
 
 	condition:
-		3 of ($license*) or 2 of ($str*) or 4 of ($hook*)
+		3 of ( $license* ) or 2 of ( $str* ) or 4 of ( $hook* )
 }
 rule ELASTIC_Windows_Hacktool_Dcsyncer_425579C5 : FILE MEMORY
 {
@@ -105030,10 +105227,10 @@ rule ELASTIC_Windows_Hacktool_Dcsyncer_425579C5 : FILE MEMORY
 		date = "2021-09-15"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Dcsyncer.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Dcsyncer.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "af7dbc84efeb186006d75d095f54a266f59e6b2348d0c20591da16ae7b7d509a"
-		logic_hash = "b0330adf1d4420ddf1f302974d2e4179f52ab1c8dc2f294ddf52286d714e0463"
+		logic_hash = "v1_sha256_b0330adf1d4420ddf1f302974d2e4179f52ab1c8dc2f294ddf52286d714e0463"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105063,10 +105260,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_66197D54 : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "7bccf37960e2f197bb0021ecb12872f0f715b674d9774d02ec4e396f18963029"
+		logic_hash = "v1_sha256_7bccf37960e2f197bb0021ecb12872f0f715b674d9774d02ec4e396f18963029"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105100,10 +105297,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_E8Ed269C : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L29-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L29-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "c56b6dfb2c3ae657615c825a4d5d5640c2204fa4217262e1ccb4359d5a914a63"
+		logic_hash = "v1_sha256_c56b6dfb2c3ae657615c825a4d5d5640c2204fa4217262e1ccb4359d5a914a63"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105139,10 +105336,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_413Caa6B : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L59-L87"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L59-L87"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "4f2417d61be5e68630408a151cd73372aef9e7f4638acf4e80bfa5b2811119a7"
+		logic_hash = "v1_sha256_4f2417d61be5e68630408a151cd73372aef9e7f4638acf4e80bfa5b2811119a7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105178,10 +105375,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_23Fee092 : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L89-L115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L89-L115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "ed019c9198b5d9ff8392bfd7e0b23a7b1383eabce4c71c665a3ca4a943c8b6ee"
+		logic_hash = "v1_sha256_ed019c9198b5d9ff8392bfd7e0b23a7b1383eabce4c71c665a3ca4a943c8b6ee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105215,10 +105412,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_861D3264 : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L117-L145"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L117-L145"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "e6a0a0a24c70d69c0aa56063d2db0f5a0fedcda5b96d945ac14520524b1d00fd"
+		logic_hash = "v1_sha256_e6a0a0a24c70d69c0aa56063d2db0f5a0fedcda5b96d945ac14520524b1d00fd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105254,10 +105451,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_57587F8C : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L147-L175"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L147-L175"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "175b8b6f9fca189f2fc41f1029ad512db2c8b0e52ea04bfbc3d410d355928ab9"
+		logic_hash = "v1_sha256_175b8b6f9fca189f2fc41f1029ad512db2c8b0e52ea04bfbc3d410d355928ab9"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -105293,10 +105490,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_Cae025B1 : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L177-L203"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L177-L203"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "9c34443cffed43513242321e2170484dbb0d41b251aee8ea640d44da76918122"
+		logic_hash = "v1_sha256_9c34443cffed43513242321e2170484dbb0d41b251aee8ea640d44da76918122"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105330,10 +105527,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_4A9B9603 : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L205-L231"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L205-L231"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "8d78483b54d3be6988b1f5df826b8709b7aa2045ff3a3e754c359365d053bb27"
+		logic_hash = "v1_sha256_8d78483b54d3be6988b1f5df826b8709b7aa2045ff3a3e754c359365d053bb27"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105367,10 +105564,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_4Db2C852 : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L233-L261"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L233-L261"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "88c88103a055d25ba97f08e2f47881001ad8a2200a33ac04246494963dfe6638"
+		logic_hash = "v1_sha256_88c88103a055d25ba97f08e2f47881001ad8a2200a33ac04246494963dfe6638"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105406,10 +105603,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_Bcedc8B2 : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L263-L291"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L263-L291"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "7f0a6a9168b5ff7cc02ccadd211cc8096307651be65c2b3e7cc9fdbbde08ab9f"
+		logic_hash = "v1_sha256_7f0a6a9168b5ff7cc02ccadd211cc8096307651be65c2b3e7cc9fdbbde08ab9f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105445,10 +105642,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_B6Bb3E7C : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L293-L321"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L293-L321"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "e2eaf91b9c5d3616fb2f6f6bc4b44841b1efa3b4efe7ac72afe225728523af75"
+		logic_hash = "v1_sha256_e2eaf91b9c5d3616fb2f6f6bc4b44841b1efa3b4efe7ac72afe225728523af75"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105484,10 +105681,10 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_94474B0B : FILE MEMORY
 		date = "2022-12-21"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L323-L351"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L323-L351"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "e209c9ce1f4b11c5fdeade3298329d62f5cf561403c87077d94b6921e81ffaea"
+		logic_hash = "v1_sha256_e209c9ce1f4b11c5fdeade3298329d62f5cf561403c87077d94b6921e81ffaea"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105523,10 +105720,10 @@ rule ELASTIC_Linux_Trojan_Cerbu_69D5657E : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Cerbu.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Cerbu.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f10bf3cf2fdfbd365d3c2d8dedb2d01b85236eaa97d15370dbcb5166149d70e9"
-		logic_hash = "644e8d5a1b5c8618e71497f21b0244215924e293e274b9164692dd927cd74ba8"
+		logic_hash = "v1_sha256_644e8d5a1b5c8618e71497f21b0244215924e293e274b9164692dd927cd74ba8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105552,10 +105749,10 @@ rule ELASTIC_Windows_Trojan_Guloader_8F10Fa66 : FILE MEMORY
 		date = "2021-08-17"
 		modified = "2021-10-04"
 		reference = "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Guloader.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Guloader.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a3e2d5013b80cd2346e37460753eca4a4fec3a7941586cc26e049a463277562e"
-		logic_hash = "f2cd08f6a32c075dc0294a0e26c51e686babc54ced4faa1873368c8821f0bfef"
+		logic_hash = "v1_sha256_f2cd08f6a32c075dc0294a0e26c51e686babc54ced4faa1873368c8821f0bfef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105585,10 +105782,10 @@ rule ELASTIC_Windows_Trojan_Guloader_C4D9Dd33 : FILE MEMORY
 		date = "2021-08-17"
 		modified = "2021-10-04"
 		reference = "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Guloader.yar#L26-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Guloader.yar#L26-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a3e2d5013b80cd2346e37460753eca4a4fec3a7941586cc26e049a463277562e"
-		logic_hash = "623ea751fc32648720bda40598024d4d5b6a9a11b3cce3c9427310ba17745643"
+		logic_hash = "v1_sha256_623ea751fc32648720bda40598024d4d5b6a9a11b3cce3c9427310ba17745643"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105614,10 +105811,10 @@ rule ELASTIC_Windows_Trojan_Guloader_2F1E44C8 : FILE MEMORY
 		date = "2023-10-30"
 		modified = "2023-11-02"
 		reference = "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Guloader.yar#L47-L70"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Guloader.yar#L47-L70"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6ae7089aa6beaa09b1c3aa3ecf28a884d8ca84f780aab39902223721493b1f99"
-		logic_hash = "434b33c3fdc6bf4b0f59cd4aba66327d0b7ab524be603b256494d46b609cecd5"
+		logic_hash = "v1_sha256_434b33c3fdc6bf4b0f59cd4aba66327d0b7ab524be603b256494d46b609cecd5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105647,10 +105844,10 @@ rule ELASTIC_Linux_Ransomware_Hive_Bdc7De59 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Hive.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Hive.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771"
-		logic_hash = "33908128258843d63c5dfe5acf15cfd68463f5cbdf08b88ef1bba394058a5a92"
+		logic_hash = "v1_sha256_33908128258843d63c5dfe5acf15cfd68463f5cbdf08b88ef1bba394058a5a92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105676,10 +105873,10 @@ rule ELASTIC_Windows_Trojan_Glupteba_70557305 : FILE MEMORY
 		date = "2021-08-08"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Glupteba.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Glupteba.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ad13fd7968f9574d2c822e579291c77a0c525991cfb785cbe6cdd500b737218"
-		logic_hash = "f3eee9808a1e8a2080116dda7ce795815e1179143c756ea8fdd26070f1f8f74a"
+		logic_hash = "v1_sha256_f3eee9808a1e8a2080116dda7ce795815e1179143c756ea8fdd26070f1f8f74a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105710,10 +105907,10 @@ rule ELASTIC_Windows_Trojan_Glupteba_4669Dcd6 : FILE MEMORY
 		date = "2021-08-08"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Glupteba.yar#L26-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Glupteba.yar#L26-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1b55042e06f218546db5ddc52d140be4303153d592dcfc1ce90e6077c05e77f7"
-		logic_hash = "64b2099f40f94b17bc5860b41773c41322420500696d320399ff1c016cb56e15"
+		logic_hash = "v1_sha256_64b2099f40f94b17bc5860b41773c41322420500696d320399ff1c016cb56e15"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105739,10 +105936,10 @@ rule ELASTIC_Windows_Ransomware_Hive_55619Cd0 : FILE MEMORY
 		date = "2021-08-26"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Hive.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Hive.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
-		logic_hash = "51e2b03a9f9b92819bbf05ecbb33a23662a40e7d51f9812aa8243c4506057f1f"
+		logic_hash = "v1_sha256_51e2b03a9f9b92819bbf05ecbb33a23662a40e7d51f9812aa8243c4506057f1f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105770,10 +105967,10 @@ rule ELASTIC_Windows_Ransomware_Hive_3Ed67Fe6 : FILE MEMORY
 		date = "2021-08-26"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Hive.yar#L23-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Hive.yar#L23-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
-		logic_hash = "a599f0d528bdbec00afa7e9a5cddec5e799ee755a7f30af70dde7d2459b70155"
+		logic_hash = "v1_sha256_a599f0d528bdbec00afa7e9a5cddec5e799ee755a7f30af70dde7d2459b70155"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105803,10 +106000,10 @@ rule ELASTIC_Windows_Ransomware_Hive_B97Ec33B : FILE MEMORY
 		date = "2021-08-26"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Hive.yar#L47-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Hive.yar#L47-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
-		logic_hash = "10034d9f53fd5099a423269e0c42c01eac18318f5d11599e1390912c8fd7af25"
+		logic_hash = "v1_sha256_10034d9f53fd5099a423269e0c42c01eac18318f5d11599e1390912c8fd7af25"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105832,9 +106029,9 @@ rule ELASTIC_Linux_Trojan_Bluez_50E87Fa9 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "1e526b6e3be273489afa8f0a3d50be233b97dc07f85815cc2231a87f5a651ef1"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Bluez.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "53754c538a7dea6f06e37980901350feddc3517821ea42544cb96e371709752f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Bluez.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_53754c538a7dea6f06e37980901350feddc3517821ea42544cb96e371709752f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -105860,9 +106057,9 @@ rule ELASTIC_Windows_Ransomware_Maze_61254061 : BETA FILE MEMORY
 		date = "2020-04-18"
 		modified = "2021-08-23"
 		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Maze.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "b8537add953cdd7bc6adbff97f7f5a94de028709f0bd71102ee96d26d55f4f20"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Maze.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_b8537add953cdd7bc6adbff97f7f5a94de028709f0bd71102ee96d26d55f4f20"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -105879,7 +106076,7 @@ rule ELASTIC_Windows_Ransomware_Maze_61254061 : BETA FILE MEMORY
 		$c2 = { 72 F0 0C 66 0F 72 D4 14 66 0F EB C4 66 0F 70 E0 39 66 0F FE E6 66 0F 70 }
 
 	condition:
-		1 of ($c*)
+		1 of ( $c* )
 }
 rule ELASTIC_Windows_Ransomware_Maze_46F40C40 : BETA FILE MEMORY
 {
@@ -105890,9 +106087,9 @@ rule ELASTIC_Windows_Ransomware_Maze_46F40C40 : BETA FILE MEMORY
 		date = "2020-04-18"
 		modified = "2021-10-04"
 		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Maze.yar#L23-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "99180f41aaaf1dfb0a8a40709dcc392fdbc2b2d3a4d4b4a1ab160dd5f2b4c703"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Maze.yar#L23-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_99180f41aaaf1dfb0a8a40709dcc392fdbc2b2d3a4d4b4a1ab160dd5f2b4c703"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -105910,7 +106107,7 @@ rule ELASTIC_Windows_Ransomware_Maze_46F40C40 : BETA FILE MEMORY
 		$b3 = "%s! Alert! %s! Alert! Dear %s Your files have been encrypted by %s! Attention! %s" wide fullword
 
 	condition:
-		2 of ($b*)
+		2 of ( $b* )
 }
 rule ELASTIC_Windows_Ransomware_Maze_20Caee5B : BETA FILE MEMORY
 {
@@ -105921,9 +106118,9 @@ rule ELASTIC_Windows_Ransomware_Maze_20Caee5B : BETA FILE MEMORY
 		date = "2020-04-18"
 		modified = "2021-08-23"
 		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Maze.yar#L46-L71"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e09c059b285d2176aeba1a1f70d39f13cef4e05dc023c7db25fb9d92bd9a67d9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Maze.yar#L46-L71"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e09c059b285d2176aeba1a1f70d39f13cef4e05dc023c7db25fb9d92bd9a67d9"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -105945,7 +106142,7 @@ rule ELASTIC_Windows_Ransomware_Maze_20Caee5B : BETA FILE MEMORY
 		$a7 = "process call create \"cmd /c start %s\"" wide fullword
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Ransomware_Maze_F88F136F : BETA FILE MEMORY
 {
@@ -105956,9 +106153,9 @@ rule ELASTIC_Windows_Ransomware_Maze_F88F136F : BETA FILE MEMORY
 		date = "2020-04-18"
 		modified = "2021-08-23"
 		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Maze.yar#L73-L94"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "5587f332a076650f6ad7b1e3b464ef6085d960e6dacf53607cf75c9f9ad07628"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Maze.yar#L73-L94"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_5587f332a076650f6ad7b1e3b464ef6085d960e6dacf53607cf75c9f9ad07628"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -105976,7 +106173,7 @@ rule ELASTIC_Windows_Ransomware_Maze_F88F136F : BETA FILE MEMORY
 		$d3 = { 77 B3 50 3C B1 9B 5D D4 87 F5 17 DB E1 C7 42 D8 53 24 C2 E2 6A A8 9B 1E FB E5 48 EB 10 48 44 28 64 F8 B6 A1 41 44 D0 42 FA 85 6F 17 57 09 C4 66 93 D2 21 C5 19 71 3A A1 C5 68 2E 67 B1 02 DC D1 }
 
 	condition:
-		1 of ($d*)
+		1 of ( $d* )
 }
 rule ELASTIC_Linux_Trojan_Winnti_61215D98 : FILE MEMORY
 {
@@ -105987,10 +106184,10 @@ rule ELASTIC_Linux_Trojan_Winnti_61215D98 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Winnti.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Winnti.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cc1455e3a479602581c1c7dc86a0e02605a3c14916b86817960397d5a2f41c31"
-		logic_hash = "051cc157f189094d25d45e66e410bdfd61ed7649a4c935d076cec1597c5debf5"
+		logic_hash = "v1_sha256_051cc157f189094d25d45e66e410bdfd61ed7649a4c935d076cec1597c5debf5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106016,9 +106213,9 @@ rule ELASTIC_Linux_Trojan_Winnti_4C5A1865 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "0d963a713093fc8e5928141f5747640c9b43f3aadc8a5478c949f7ec364b28ad"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Winnti.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "69f6dcba59ec8cd7f4dfe853495a35601e35d74476fad9e18bef7685a68ece51"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Winnti.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_69f6dcba59ec8cd7f4dfe853495a35601e35d74476fad9e18bef7685a68ece51"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106044,9 +106241,9 @@ rule ELASTIC_Linux_Trojan_Winnti_6F4Ca425 : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "161af780209aa24845863f7a8120aa982aa811f16ec04bcd797ed165955a09c1"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Winnti.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "a1ffc0e3d27c4bb9fd10f14d45b649b4f059c654b31449013ac06d0981ed25ed"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Winnti.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_a1ffc0e3d27c4bb9fd10f14d45b649b4f059c654b31449013ac06d0981ed25ed"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106072,9 +106269,9 @@ rule ELASTIC_Linux_Trojan_Winnti_De4B0F6E : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "a6b9b3ea19eaddd4d90e58c372c10bbe37dbfced638d167182be2c940e615710"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Winnti.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "fb7b0ff4757dfc1ba2ca8585d5ddf14aae03063e10bdc2565443362c6ba37c30"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Winnti.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_fb7b0ff4757dfc1ba2ca8585d5ddf14aae03063e10bdc2565443362c6ba37c30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106100,10 +106297,10 @@ rule ELASTIC_Windows_Hacktool_Safetykatz_072B7370 : FILE MEMORY
 		date = "2022-11-20"
 		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SafetyKatz.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SafetyKatz.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "89a456943cf6d2b3cd9cdc44f13a23640575435ed49fa754f7ed358c1a3b6ba9"
-		logic_hash = "cedd3ede487371a8e0d29804f2b81ae808c7ad01bd803fa39dc2c50e472cff43"
+		logic_hash = "v1_sha256_cedd3ede487371a8e0d29804f2b81ae808c7ad01bd803fa39dc2c50e472cff43"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -106122,7 +106319,7 @@ rule ELASTIC_Windows_Hacktool_Safetykatz_072B7370 : FILE MEMORY
 		$print_str3 = "[+] Dump successful!" ascii wide fullword
 
 	condition:
-		$guid or all of ($print_str*)
+		$guid or all of ( $print_str* )
 }
 rule ELASTIC_Windows_Trojan_Jupyter_56152E31 : FILE MEMORY
 {
@@ -106133,10 +106330,10 @@ rule ELASTIC_Windows_Trojan_Jupyter_56152E31 : FILE MEMORY
 		date = "2021-07-22"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Jupyter.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Jupyter.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ce486097ad2491aba8b1c120f6d0aa23eaf59cf698b57d2113faab696d03c601"
-		logic_hash = "7b32e9caca744f4f6b48aefa5fda111e6b7ac81a62dd1fb8873d2c800ac3c42b"
+		logic_hash = "v1_sha256_7b32e9caca744f4f6b48aefa5fda111e6b7ac81a62dd1fb8873d2c800ac3c42b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106154,7 +106351,7 @@ rule ELASTIC_Windows_Trojan_Jupyter_56152E31 : FILE MEMORY
 		$b2 = "jupyter" ascii fullword
 
 	condition:
-		1 of ($a*) or 2 of ($b*)
+		1 of ( $a* ) or 2 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Farfli_85D1Bcc9 : FILE MEMORY
 {
@@ -106165,10 +106362,10 @@ rule ELASTIC_Windows_Trojan_Farfli_85D1Bcc9 : FILE MEMORY
 		date = "2022-02-17"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Farfli.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Farfli.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e3e9ea1b547cc235e6f1a78b4ca620c69a54209f84c7de9af17eb5b02e9b58c3"
-		logic_hash = "746eb5a2583077189d82d1a96b499ff383f31220845bd8a6df5b7a7ceb11e6fb"
+		logic_hash = "v1_sha256_746eb5a2583077189d82d1a96b499ff383f31220845bd8a6df5b7a7ceb11e6fb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106194,11 +106391,11 @@ rule ELASTIC_Windows_Vulndriver_Agent64_8Ef48Aeb : FILE
 		date = "2022-07-19"
 		modified = "2022-07-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Agent64.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Agent64.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
 		hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
-		logic_hash = "a35f82202507e582e3cbc7018656545fcee1244ec1638a696f0b7c970fd5023c"
+		logic_hash = "v1_sha256_a35f82202507e582e3cbc7018656545fcee1244ec1638a696f0b7c970fd5023c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -106218,7 +106415,7 @@ rule ELASTIC_Windows_Vulndriver_Agent64_8Ef48Aeb : FILE
 		$product_name = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 [1-8] 44 00 72 00 69 00 76 00 65 00 72 00 41 00 67 00 65 00 6E 00 74 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and any of ($subject_name*) and $original_file_name and $product_version and $product_name
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and any of ( $subject_name* ) and $original_file_name and $product_version and $product_name
 }
 rule ELASTIC_Windows_Trojan_Formbook_1112E116 : FILE MEMORY
 {
@@ -106229,10 +106426,10 @@ rule ELASTIC_Windows_Trojan_Formbook_1112E116 : FILE MEMORY
 		date = "2021-06-14"
 		modified = "2021-08-23"
 		reference = "https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Formbook.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Formbook.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a"
-		logic_hash = "ec307a8681fa01fc0c7c0579b0e3eff10e7f373159ad58dae0a358ff16fbc10b"
+		logic_hash = "v1_sha256_ec307a8681fa01fc0c7c0579b0e3eff10e7f373159ad58dae0a358ff16fbc10b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106261,9 +106458,9 @@ rule ELASTIC_Windows_Trojan_Formbook_772Cc62D : FILE MEMORY
 		date = "2022-05-23"
 		modified = "2022-07-18"
 		reference = "https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Formbook.yar#L25-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "db9ab8df029856fc1c210499ed8e1b92c9722f7aa2264363670c47b51ec8fa83"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Formbook.yar#L25-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_db9ab8df029856fc1c210499ed8e1b92c9722f7aa2264363670c47b51ec8fa83"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106281,7 +106478,7 @@ rule ELASTIC_Windows_Trojan_Formbook_772Cc62D : FILE MEMORY
 		$r1 = /.\:\\Users\\[^\\]{1,50}\\AppData\\Roaming\\[a-zA-Z0-9]{8}\\[a-zA-Z0-9]{3}log\.ini/ wide
 
 	condition:
-		2 of ($a*) and $r1
+		2 of ( $a* ) and $r1
 }
 rule ELASTIC_Windows_Trojan_Formbook_5799D1F2 : FILE MEMORY
 {
@@ -106292,10 +106489,10 @@ rule ELASTIC_Windows_Trojan_Formbook_5799D1F2 : FILE MEMORY
 		date = "2022-06-08"
 		modified = "2022-09-29"
 		reference = "https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Formbook.yar#L48-L67"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Formbook.yar#L48-L67"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8555a6d313cb17f958fc2e08d6c042aaff9ceda967f8598ac65ab6333d14efd9"
-		logic_hash = "8e61eabd11beb9fb35c016983cfb3085f5ceddfc8268522f3b48d20be5b5df6a"
+		logic_hash = "v1_sha256_8e61eabd11beb9fb35c016983cfb3085f5ceddfc8268522f3b48d20be5b5df6a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106321,10 +106518,10 @@ rule ELASTIC_Linux_Ransomware_Blackbasta_96Eb3F20 : FILE MEMORY
 		date = "2022-08-06"
 		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_BlackBasta.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_BlackBasta.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "96339a7e87ffce6ced247feb9b4cb7c05b83ca315976a9522155bad726b8e5be"
-		logic_hash = "a5e0b60ba51490f70af53c9fba91e3349c712bebb10574eb4bed028ab961ae74"
+		logic_hash = "v1_sha256_a5e0b60ba51490f70af53c9fba91e3349c712bebb10574eb4bed028ab961ae74"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106345,7 +106542,7 @@ rule ELASTIC_Linux_Ransomware_Blackbasta_96Eb3F20 : FILE MEMORY
 		$seq_encrypt_thread = { 4C 8B 74 24 ?? 31 DB 45 31 FF 4D 8B 6E ?? 49 83 FD ?? 0F 87 ?? ?? ?? ?? 31 C0 4D 39 EF 0F 82 ?? ?? ?? ?? 48 01 C3 4C 39 EB 0F 83 ?? ?? ?? ?? }
 
 	condition:
-		3 of ($a*) and 1 of ($seq*)
+		3 of ( $a* ) and 1 of ( $seq* )
 }
 rule ELASTIC_Multi_Ransomware_Blackcat_Aaf312C3 : FILE MEMORY
 {
@@ -106356,10 +106553,10 @@ rule ELASTIC_Multi_Ransomware_Blackcat_Aaf312C3 : FILE MEMORY
 		date = "2022-02-02"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Ransomware_BlackCat.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Ransomware_BlackCat.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479"
-		logic_hash = "0771ab5a795af164a568bda036cccf08afeb33458f2cd5a7240349fca9b60ead"
+		logic_hash = "v1_sha256_0771ab5a795af164a568bda036cccf08afeb33458f2cd5a7240349fca9b60ead"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106386,10 +106583,10 @@ rule ELASTIC_Multi_Ransomware_Blackcat_00E525D7 : FILE MEMORY
 		date = "2022-02-02"
 		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Ransomware_BlackCat.yar#L22-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Ransomware_BlackCat.yar#L22-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479"
-		logic_hash = "e44625d0fa8308b9d4d63a9e6920b4da4a2ce124437f122b2c8fe5cf0ab85a6b"
+		logic_hash = "v1_sha256_e44625d0fa8308b9d4d63a9e6920b4da4a2ce124437f122b2c8fe5cf0ab85a6b"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -106418,10 +106615,10 @@ rule ELASTIC_Multi_Ransomware_Blackcat_C4B043E6 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Ransomware_BlackCat.yar#L45-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Ransomware_BlackCat.yar#L45-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "45b8678f74d29c87e2d06410245ab6c2762b76190594cafc9543fb9db90f3d4f"
-		logic_hash = "1262ca76581920f08a6482ead68023fdfff08a9ddd19e00230054e3167dc184c"
+		logic_hash = "v1_sha256_1262ca76581920f08a6482ead68023fdfff08a9ddd19e00230054e3167dc184c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106447,10 +106644,10 @@ rule ELASTIC_Multi_Ransomware_Blackcat_70171625 : FILE MEMORY
 		date = "2023-01-05"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Ransomware_BlackCat.yar#L65-L91"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Ransomware_BlackCat.yar#L65-L91"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479"
-		logic_hash = "fd07acd7c8627754f000c44827848bf65bcaa96f2dfb46e41542f3c9b40eee78"
+		logic_hash = "v1_sha256_fd07acd7c8627754f000c44827848bf65bcaa96f2dfb46e41542f3c9b40eee78"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106484,10 +106681,10 @@ rule ELASTIC_Multi_Ransomware_Blackcat_E066D802 : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Ransomware_BlackCat.yar#L93-L113"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Ransomware_BlackCat.yar#L93-L113"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "00360830bf5886288f23784b8df82804bf6f22258e410740db481df8a7701525"
-		logic_hash = "00fbb8013faf26c35b6cd8a72ebc246444c37c5ec7a0df2295830e96c01c8720"
+		logic_hash = "v1_sha256_00fbb8013faf26c35b6cd8a72ebc246444c37c5ec7a0df2295830e96c01c8720"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106515,10 +106712,10 @@ rule ELASTIC_Multi_Ransomware_Blackcat_0Ffb0A37 : FILE MEMORY
 		date = "2023-07-29"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Ransomware_BlackCat.yar#L115-L134"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Ransomware_BlackCat.yar#L115-L134"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "57136b118a0d6d3c71e522ea53e3305dae58b51f06c29cd01c0c28fa0fa34287"
-		logic_hash = "4f28281e4b23868c63438d4800b9e5978426e7c98b6142ef8082cfd251cafe57"
+		logic_hash = "v1_sha256_4f28281e4b23868c63438d4800b9e5978426e7c98b6142ef8082cfd251cafe57"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -106545,10 +106742,10 @@ rule ELASTIC_Linux_Trojan_Zerobot_185E2396 : FILE MEMORY
 		date = "2022-12-16"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Zerobot.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Zerobot.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f9fc370955490bdf38fc63ca0540ce1ea6f7eca5123aa4eef730cb618da8551f"
-		logic_hash = "caa21cc019d8e4549d976f8b4f98d930ef7acf4c39c41956ae35fa78c975e016"
+		logic_hash = "v1_sha256_caa21cc019d8e4549d976f8b4f98d930ef7acf4c39c41956ae35fa78c975e016"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106570,7 +106767,7 @@ rule ELASTIC_Linux_Trojan_Zerobot_185E2396 : FILE MEMORY
 		$start_service_1 = "systemctl enable sshf"
 
 	condition:
-		( all of ($startup_method_1_*) or all of ($startup_method_2_*)) and 1 of ($start_service_*)
+		( all of ( $startup_method_1_* ) or all of ( $startup_method_2_* ) ) and 1 of ( $start_service_* )
 }
 rule ELASTIC_Linux_Trojan_Zerobot_3A5B56Dd : FILE MEMORY
 {
@@ -106581,10 +106778,10 @@ rule ELASTIC_Linux_Trojan_Zerobot_3A5B56Dd : FILE MEMORY
 		date = "2022-12-16"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Zerobot.yar#L28-L51"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Zerobot.yar#L28-L51"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f9fc370955490bdf38fc63ca0540ce1ea6f7eca5123aa4eef730cb618da8551f"
-		logic_hash = "2491fff4ad0327e0440d842f221fb6623c8efd97e2991bf2090abceaef9c2ccf"
+		logic_hash = "v1_sha256_2491fff4ad0327e0440d842f221fb6623c8efd97e2991bf2090abceaef9c2ccf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106615,10 +106812,10 @@ rule ELASTIC_Linux_Trojan_Bedevil_A1A72C39 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Bedevil.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Bedevil.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "017a9d7290cf327444d23227518ab612111ca148da7225e64a9f6ebd253449ab"
-		logic_hash = "227adcc340c38cebf56ea2f39b483c965dd46827d83afe5f866ca844c932da76"
+		logic_hash = "v1_sha256_227adcc340c38cebf56ea2f39b483c965dd46827d83afe5f866ca844c932da76"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106644,10 +106841,10 @@ rule ELASTIC_Windows_Trojan_Stormkitty_6256031A : FILE MEMORY
 		date = "2022-03-21"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_StormKitty.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_StormKitty.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0c69015f534d1da3770dbc14183474a643c4332de6a599278832abd2b15ba027"
-		logic_hash = "a797e87eaf5b173da9dd43fcff03b3d26198dcafa29c3f2ca369773c73001234"
+		logic_hash = "v1_sha256_a797e87eaf5b173da9dd43fcff03b3d26198dcafa29c3f2ca369773c73001234"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106678,10 +106875,10 @@ rule ELASTIC_Windows_Trojan_Doorme_246Eda61 : FILE MEMORY
 		date = "2022-12-09"
 		modified = "2022-12-15"
 		reference = "https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_DoorMe.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_DoorMe.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "96b226e1dcfb8ea2155c2fa508125472c8c767569d009a881ab4c39453e4fe7f"
-		logic_hash = "01240f2e23904498c34ec805cc8bc3e9ac7b76c6519685ef6b367066f1a0bc5b"
+		logic_hash = "v1_sha256_01240f2e23904498c34ec805cc8bc3e9ac7b76c6519685ef6b367066f1a0bc5b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106701,7 +106898,7 @@ rule ELASTIC_Windows_Trojan_Doorme_246Eda61 : FILE MEMORY
 		$str_0 = ".?AVDoorme@@" ascii fullword
 
 	condition:
-		3 of ($seq*) or 1 of ($str*)
+		3 of ( $seq* ) or 1 of ( $str* )
 }
 rule ELASTIC_Linux_Hacktool_Lightning_D9A9173A : FILE MEMORY
 {
@@ -106712,10 +106909,10 @@ rule ELASTIC_Linux_Hacktool_Lightning_D9A9173A : FILE MEMORY
 		date = "2022-11-08"
 		modified = "2024-02-13"
 		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Lightning.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Lightning.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "48f9471c20316b295704e6f8feb2196dd619799edec5835734fc24051f45c5b7"
-		logic_hash = "93961d9771aa4e828e15923064a848291c7814ad4e15e30cd252fc41523d789e"
+		logic_hash = "v1_sha256_93961d9771aa4e828e15923064a848291c7814ad4e15e30cd252fc41523d789e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106744,10 +106941,10 @@ rule ELASTIC_Linux_Hacktool_Lightning_E87C9D50 : FILE MEMORY
 		date = "2022-11-08"
 		modified = "2024-02-13"
 		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Lightning.yar#L25-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Lightning.yar#L25-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fd285c2fb4d42dde23590118dba016bf5b846625da3abdbe48773530a07bcd1e"
-		logic_hash = "455ecf97e7becaf9c40843f8a3f60ec233d35e0061c6994f168428a8835c1b20"
+		logic_hash = "v1_sha256_455ecf97e7becaf9c40843f8a3f60ec233d35e0061c6994f168428a8835c1b20"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106777,10 +106974,10 @@ rule ELASTIC_Linux_Hacktool_Lightning_3Bcac358 : FILE MEMORY
 		date = "2022-11-08"
 		modified = "2024-02-13"
 		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Lightning.yar#L50-L72"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Lightning.yar#L50-L72"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ad16989a3ebf0b416681f8db31af098e02eabd25452f8d781383547ead395237"
-		logic_hash = "f260372b9f2ea32f93ff7a30dc8239766e713a1e177a483444b14538741c24af"
+		logic_hash = "v1_sha256_f260372b9f2ea32f93ff7a30dc8239766e713a1e177a483444b14538741c24af"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106809,10 +107006,10 @@ rule ELASTIC_Windows_Trojan_Qbot_D91C1384 : FILE MEMORY
 		date = "2021-07-08"
 		modified = "2021-08-23"
 		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Qbot.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Qbot.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "18ac3870aaa9aaaf6f4a5c0118daa4b43ad93d71c38bf42cb600db3d786c6dda"
-		logic_hash = "8fd8249a2af236c92ccbc20b2a8380f69ca75976bd64bad167828e9ab4c6ed90"
+		logic_hash = "v1_sha256_8fd8249a2af236c92ccbc20b2a8380f69ca75976bd64bad167828e9ab4c6ed90"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106838,10 +107035,10 @@ rule ELASTIC_Windows_Trojan_Qbot_7D5Dc64A : FILE MEMORY
 		date = "2021-10-04"
 		modified = "2022-01-13"
 		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Qbot.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Qbot.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a2bacde7210d88675564106406d9c2f3b738e2b1993737cb8bf621b78a9ebf56"
-		logic_hash = "5c8858502050494ab20a230f04c2c1cb4bfcd80f4a248dad82787d7ce67c741d"
+		logic_hash = "v1_sha256_5c8858502050494ab20a230f04c2c1cb4bfcd80f4a248dad82787d7ce67c741d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106868,10 +107065,10 @@ rule ELASTIC_Windows_Trojan_Qbot_6Fd34691 : FILE MEMORY
 		date = "2022-03-07"
 		modified = "2022-04-12"
 		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Qbot.yar#L44-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Qbot.yar#L44-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0838cd11d6f504203ea98f78cac8f066eb2096a2af16d27fb9903484e7e6a689"
-		logic_hash = "9422d9f276f0c8c2990ece3282d918abc6fcce7eeb6809d46ae6b768a501a877"
+		logic_hash = "v1_sha256_9422d9f276f0c8c2990ece3282d918abc6fcce7eeb6809d46ae6b768a501a877"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106898,10 +107095,10 @@ rule ELASTIC_Windows_Trojan_Qbot_3074A8D4 : FILE MEMORY
 		date = "2022-06-07"
 		modified = "2022-07-18"
 		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Qbot.yar#L66-L97"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Qbot.yar#L66-L97"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a"
-		logic_hash = "90c06bd09fe640bb5a6be8e4f2384fb15c7501674d57db005e790ed336740c99"
+		logic_hash = "v1_sha256_90c06bd09fe640bb5a6be8e4f2384fb15c7501674d57db005e790ed336740c99"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106939,10 +107136,10 @@ rule ELASTIC_Windows_Trojan_Qbot_1Ac22A26 : FILE MEMORY
 		date = "2022-12-29"
 		modified = "2023-02-01"
 		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Qbot.yar#L99-L136"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Qbot.yar#L99-L136"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a"
-		logic_hash = "d9beaf4a8c28a0b3c38dda6bf22a96b8c96ef715bd36de880504a9f970338fe2"
+		logic_hash = "v1_sha256_d9beaf4a8c28a0b3c38dda6bf22a96b8c96ef715bd36de880504a9f970338fe2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -106986,10 +107183,10 @@ rule ELASTIC_Windows_Vulndriver_Elby_65B09743 : FILE
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Elby.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Elby.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
-		logic_hash = "7c7438520b238daf38d4ac91cbdee48bbfa9c85bd76208a436ce59edcfcecb80"
+		logic_hash = "v1_sha256_7c7438520b238daf38d4ac91cbdee48bbfa9c85bd76208a436ce59edcfcecb80"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -107006,7 +107203,7 @@ rule ELASTIC_Windows_Vulndriver_Elby_65B09743 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\x02][\x00-\x00])([\x00-\x03][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Multi_Trojan_Merlin_32643F4C : FILE MEMORY
 {
@@ -107017,10 +107214,10 @@ rule ELASTIC_Multi_Trojan_Merlin_32643F4C : FILE MEMORY
 		date = "2024-03-01"
 		modified = "2024-05-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Trojan_Merlin.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Trojan_Merlin.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "84b988c4656677bc021e23df2a81258212d9ceba13be204867ac1d9d706404e2"
-		logic_hash = "7de2deec0e2c7fd3ce2b42762f88bfe87cb4ffb02b697953aa1716425d6f1612"
+		logic_hash = "v1_sha256_7de2deec0e2c7fd3ce2b42762f88bfe87cb4ffb02b697953aa1716425d6f1612"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107044,7 +107241,7 @@ rule ELASTIC_Multi_Trojan_Merlin_32643F4C : FILE MEMORY
 		$b3 = "github.com/Ne0nd0g/merlin"
 
 	condition:
-		all of ($a*) or all of ($b*)
+		all of ( $a* ) or all of ( $b* )
 }
 rule ELASTIC_Linux_Proxy_Frp_4213778F : FILE MEMORY
 {
@@ -107055,10 +107252,10 @@ rule ELASTIC_Linux_Proxy_Frp_4213778F : FILE MEMORY
 		date = "2021-10-20"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Proxy_Frp.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Proxy_Frp.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "16294086be1cc853f75e864a405f31e2da621cb9d6a59f2a71a2fca4e268b6c2"
-		logic_hash = "83eeb632026c38ac08357c27d971da31fbc9a0500ecf489e8332ac5862a77b85"
+		logic_hash = "v1_sha256_83eeb632026c38ac08357c27d971da31fbc9a0500ecf489e8332ac5862a77b85"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107082,7 +107279,7 @@ rule ELASTIC_Linux_Proxy_Frp_4213778F : FILE MEMORY
 		$p4 = "range section [%s] local_port and remote_port is necessary[ERR]"
 
 	condition:
-		2 of ($s*) and 2 of ($p*)
+		2 of ( $s* ) and 2 of ( $p* )
 }
 rule ELASTIC_Macos_Trojan_Bundlore_28B13E67 : FILE MEMORY
 {
@@ -107093,10 +107290,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_28B13E67 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0b50a38749ea8faf571169ebcfce3dfd668eaefeb9a91d25a96e6b3881e4a3e8"
-		logic_hash = "586ae19e570c51805afd3727b2e570cdb1c48344aa699e54774a708f02bc3a6f"
+		logic_hash = "v1_sha256_586ae19e570c51805afd3727b2e570cdb1c48344aa699e54774a708f02bc3a6f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107122,10 +107319,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_75C8Cb4E : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3d69912e19758958e1ebdef5e12c70c705d7911c3b9df03348c5d02dd06ebe4e"
-		logic_hash = "527fecb8460c0325c009beddd6992e0abbf8c5a05843e4cedf3b17deb4b19a1c"
+		logic_hash = "v1_sha256_527fecb8460c0325c009beddd6992e0abbf8c5a05843e4cedf3b17deb4b19a1c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107151,10 +107348,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_17B564B4 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "94f6e5ee6eb3a191faaf332ea948301bbb919f4ec6725b258e4f8e07b6a7881d"
-		logic_hash = "40cd2a793c8ed51a8191ecb9b358f50dc2035d997d0f773f6049f9c272291607"
+		logic_hash = "v1_sha256_40cd2a793c8ed51a8191ecb9b358f50dc2035d997d0f773f6049f9c272291607"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107180,10 +107377,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_C90C088A : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "875513f4ebeb63b9e4d82fb5bff2b2dc75b69c0bfa5dd8d2895f22eaa783f372"
-		logic_hash = "c82c5c8d1e38e0d2631c5611e384eb49b58c64daeafe0cc642682e5c64686b60"
+		logic_hash = "v1_sha256_c82c5c8d1e38e0d2631c5611e384eb49b58c64daeafe0cc642682e5c64686b60"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107209,10 +107406,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_3965578D : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d72543505e36db40e0ccbf14f4ce3853b1022a8aeadd96d173d84e068b4f68fa"
-		logic_hash = "6bd24640e0a3aa152fcd90b6975ee4fb7e99ab5f2d48d3a861bc804c526c90b6"
+		logic_hash = "v1_sha256_6bd24640e0a3aa152fcd90b6975ee4fb7e99ab5f2d48d3a861bc804c526c90b6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107238,10 +107435,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_00D9D0E9 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "73069b34e513ff1b742b03fed427dc947c22681f30cf46288a08ca545fc7d7dd"
-		logic_hash = "535831872408caa27984190d1b1b1a5954e502265925d50457e934219598dbfd"
+		logic_hash = "v1_sha256_535831872408caa27984190d1b1b1a5954e502265925d50457e934219598dbfd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107267,10 +107464,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_650B8Ff4 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "78fd2c4afd7e810d93d91811888172c4788a0a2af0b88008573ce8b6b819ae5a"
-		logic_hash = "e8a706db010e9c3d9714d5e7a376e9b2189af382a7b01db9a9e7ee947e9637bb"
+		logic_hash = "v1_sha256_e8a706db010e9c3d9714d5e7a376e9b2189af382a7b01db9a9e7ee947e9637bb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107296,10 +107493,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_C8Ad7Edd : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d4915473e1096a82afdaee405189a0d0ae961bd11a9e5e9adc420dd64cb48c24"
-		logic_hash = "be09b4bd612bb499044fe91ca4e1ab62405cf1e4d75b8e1da90e326d1c66e04f"
+		logic_hash = "v1_sha256_be09b4bd612bb499044fe91ca4e1ab62405cf1e4d75b8e1da90e326d1c66e04f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107325,10 +107522,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_Cb7344Eb : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "53373668d8c5dc17f58768bf59fb5ab6d261a62d0950037f0605f289102e3e56"
-		logic_hash = "6b5e868dfd14e9b1cdf3caeb1216764361b28c1dd38849526baf5dbdb1020d8d"
+		logic_hash = "v1_sha256_6b5e868dfd14e9b1cdf3caeb1216764361b28c1dd38849526baf5dbdb1020d8d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107354,10 +107551,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_753E5738 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "42aeea232b28724d1fa6e30b1aeb8f8b8c22e1bc8afd1bbb4f90e445e31bdfe9"
-		logic_hash = "7a6907b51c793e4182c1606eab6f2bcb71f0350a34aef93fa3f3a9f1a49961ba"
+		logic_hash = "v1_sha256_7a6907b51c793e4182c1606eab6f2bcb71f0350a34aef93fa3f3a9f1a49961ba"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107383,10 +107580,10 @@ rule ELASTIC_Macos_Trojan_Bundlore_7B9F0C28 : FILE MEMORY
 		date = "2021-10-05"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Bundlore.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Bundlore.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fc4da125fed359d3e1740dafaa06f4db1ffc91dbf22fd5e7993acf8597c4c283"
-		logic_hash = "32abbb76c866e3a555ee6a9c39f62a0712f641959b66068abfb4379baa9a9da9"
+		logic_hash = "v1_sha256_32abbb76c866e3a555ee6a9c39f62a0712f641959b66068abfb4379baa9a9da9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107412,10 +107609,10 @@ rule ELASTIC_Windows_Hacktool_Sharprdp_80895Fcb : FILE MEMORY
 		date = "2022-11-20"
 		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpRDP.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpRDP.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6e909861781a8812ee01bc59435fd73fd34da23fa9ad6d699eefbf9f84629876"
-		logic_hash = "ef9a92f2ed29f508dca591e9c65a6ce0013ccdfd0c62770e8840be2f3ee5982e"
+		logic_hash = "v1_sha256_ef9a92f2ed29f508dca591e9c65a6ce0013ccdfd0c62770e8840be2f3ee5982e"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -107434,7 +107631,7 @@ rule ELASTIC_Windows_Hacktool_Sharprdp_80895Fcb : FILE MEMORY
 		$print_str3 = "[X] Error: A password is required" ascii wide fullword
 
 	condition:
-		$guid or all of ($print_str*)
+		$guid or all of ( $print_str* )
 }
 rule ELASTIC_Windows_Trojan_Diceloader_B32C6B99 : FILE MEMORY
 {
@@ -107445,10 +107642,10 @@ rule ELASTIC_Windows_Trojan_Diceloader_B32C6B99 : FILE MEMORY
 		date = "2021-04-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Diceloader.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Diceloader.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a3b3f56a61c6dc8ba2aa25bdd9bd7dc2c5a4602c2670431c5cbc59a76e2b4c54"
-		logic_hash = "f9e023f340edc4c46b2926e750c2ad3a3798e34415e43c0ea2d83073e3dc526a"
+		logic_hash = "v1_sha256_f9e023f340edc4c46b2926e750c2ad3a3798e34415e43c0ea2d83073e3dc526a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107480,10 +107677,10 @@ rule ELASTIC_Windows_Trojan_Diceloader_15Eeb7B9 : FILE MEMORY
 		date = "2021-04-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Diceloader.yar#L27-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Diceloader.yar#L27-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746"
-		logic_hash = "f1ab9ad69f9ea75343c7404b82a3f7a4976a442b980a98fe5b95c55d4f9cb34e"
+		logic_hash = "v1_sha256_f1ab9ad69f9ea75343c7404b82a3f7a4976a442b980a98fe5b95c55d4f9cb34e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107510,10 +107707,10 @@ rule ELASTIC_Windows_Trojan_Gozi_Fd494041 : FILE MEMORY
 		date = "2021-03-22"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Gozi.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Gozi.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237"
-		logic_hash = "fdd18817e7377f1b4006d3bf135d924b8ead62a461ea56f57157b2856ba6846b"
+		logic_hash = "v1_sha256_fdd18817e7377f1b4006d3bf135d924b8ead62a461ea56f57157b2856ba6846b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107541,7 +107738,7 @@ rule ELASTIC_Windows_Trojan_Gozi_Fd494041 : FILE MEMORY
 		$a14 = "IE10RunOnceLastShown_TIMESTAMP" ascii fullword
 
 	condition:
-		8 of ($a*)
+		8 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Gozi_261F5Ac5 : FILE MEMORY
 {
@@ -107552,10 +107749,10 @@ rule ELASTIC_Windows_Trojan_Gozi_261F5Ac5 : FILE MEMORY
 		date = "2019-08-02"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Gozi.yar#L34-L60"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Gozi.yar#L34-L60"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f"
-		logic_hash = "23a7427e162e2f77ee0a281fe4bc54eab29a3bdca8e51015147e8eb223e7e2f7"
+		logic_hash = "v1_sha256_23a7427e162e2f77ee0a281fe4bc54eab29a3bdca8e51015147e8eb223e7e2f7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107578,7 +107775,7 @@ rule ELASTIC_Windows_Trojan_Gozi_261F5Ac5 : FILE MEMORY
 		$a9 = "Software\\AppDataLow\\Software\\Microsoft\\"
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_C851687A : FILE MEMORY
 {
@@ -107589,9 +107786,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_C851687A : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L1-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7fac6fb24ac18bd69dd9f8f4090c4a77d1cc6554b6ae5c846e32d7666e5a1971"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L1-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7fac6fb24ac18bd69dd9f8f4090c4a77d1cc6554b6ae5c846e32d7666e5a1971"
 		score = 75
 		quality = 25
 		tags = "FILE, MEMORY"
@@ -107625,7 +107822,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_C851687A : FILE MEMORY
 		$b16 = "[+] Privileged file copy success! %S" ascii fullword
 
 	condition:
-		2 of ($a*) or 10 of ($b*)
+		2 of ( $a* ) or 10 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_0B58325E : FILE MEMORY
 {
@@ -107636,9 +107833,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_0B58325E : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L39-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "3822431e946fcc38c700cc8ce213e95f33a155d7f38b6ab2a24cb998d42c8521"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L39-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_3822431e946fcc38c700cc8ce213e95f33a155d7f38b6ab2a24cb998d42c8521"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -107674,7 +107871,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_0B58325E : FILE MEMORY
 		$b16 = "[clear]" ascii fullword
 
 	condition:
-		1 of ($a*) and 14 of ($b*)
+		1 of ( $a* ) and 14 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_2B8Cddf8 : FILE MEMORY
 {
@@ -107685,9 +107882,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_2B8Cddf8 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L79-L114"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "5502c06d33b93bae3bc25ba7dd6a5a9a3b0b2b43bb7e867e601ecb206bf503ed"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L79-L114"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_5502c06d33b93bae3bc25ba7dd6a5a9a3b0b2b43bb7e867e601ecb206bf503ed"
 		score = 75
 		quality = 43
 		tags = "FILE, MEMORY"
@@ -107720,7 +107917,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_2B8Cddf8 : FILE MEMORY
 		$c8 = "__imp__KERNEL32$VirtualAllocEx" ascii fullword
 
 	condition:
-		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+		1 of ( $a* ) or 5 of ( $b* ) or 5 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_59B44767 : FILE MEMORY
 {
@@ -107731,9 +107928,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_59B44767 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L116-L142"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7027d0dcbdb1961d2604f29392a923957d298a047c268553599ea8c881f76a98"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L116-L142"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7027d0dcbdb1961d2604f29392a923957d298a047c268553599ea8c881f76a98"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -107757,7 +107954,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_59B44767 : FILE MEMORY
 		$c4 = "__imp_NTDLL$NtQuerySystemInformation" ascii fullword
 
 	condition:
-		1 of ($a*) or 3 of ($b*) or 3 of ($c*)
+		1 of ( $a* ) or 3 of ( $b* ) or 3 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_7Efd3C3F : FILE MEMORY
 {
@@ -107768,9 +107965,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_7Efd3C3F : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L144-L168"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "45a0aaba6c1be016fc5f4051680ee7e3aa62e8a5d9730b7adab08c14ae37da24"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L144-L168"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_45a0aaba6c1be016fc5f4051680ee7e3aa62e8a5d9730b7adab08c14ae37da24"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107792,7 +107989,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_7Efd3C3F : FILE MEMORY
 		$a7 = "[-] no results." ascii fullword
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_6E971281 : FILE MEMORY
 {
@@ -107803,9 +108000,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_6E971281 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L170-L201"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "f204965c0118dbdfe7e134d319c92b30d22585e888609ff31df90643116a2c38"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L170-L201"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_f204965c0118dbdfe7e134d319c92b30d22585e888609ff31df90643116a2c38"
 		score = 75
 		quality = 51
 		tags = "FILE, MEMORY"
@@ -107834,7 +108031,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_6E971281 : FILE MEMORY
 		$c6 = "__imp__LoadLibraryA" ascii fullword
 
 	condition:
-		1 of ($a*) or 4 of ($b*) or 4 of ($c*)
+		1 of ( $a* ) or 4 of ( $b* ) or 4 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_09B79Efa : FILE MEMORY
 {
@@ -107845,9 +108042,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_09B79Efa : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L203-L232"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "75fd003b9adf03aff8479b1b10da9c94955870b5fa4f1958f870e14acb2793c7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L203-L232"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_75fd003b9adf03aff8479b1b10da9c94955870b5fa4f1958f870e14acb2793c7"
 		score = 75
 		quality = 48
 		tags = "FILE, MEMORY"
@@ -107874,7 +108071,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_09B79Efa : FILE MEMORY
 		$c1 = { FF 57 0C 85 C0 78 40 8B 45 F8 8D 55 F4 8B 08 52 50 }
 
 	condition:
-		1 of ($a*) or 3 of ($b*) or 1 of ($c*)
+		1 of ( $a* ) or 3 of ( $b* ) or 1 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_6E77233E : FILE MEMORY
 {
@@ -107885,9 +108082,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_6E77233E : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L234-L269"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "93aa11523b794402b257d02d4f9edc5ad320bfdb5b8b0f671ff08f399ef9e674"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L234-L269"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_93aa11523b794402b257d02d4f9edc5ad320bfdb5b8b0f671ff08f399ef9e674"
 		score = 75
 		quality = 63
 		tags = "FILE, MEMORY"
@@ -107920,7 +108117,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_6E77233E : FILE MEMORY
 		$b7 = "_LsaCallKerberosPackage" ascii fullword
 
 	condition:
-		5 of ($a*) or 3 of ($b*)
+		5 of ( $a* ) or 3 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_De42495A : FILE MEMORY
 {
@@ -107931,9 +108128,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_De42495A : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L271-L301"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "2a13c73d221d80d25a432f9e0a1387153a78f58719066586e9d80d17613293ef"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L271-L301"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_2a13c73d221d80d25a432f9e0a1387153a78f58719066586e9d80d17613293ef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -107961,7 +108158,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_De42495A : FILE MEMORY
 		$b12 = "mimikatz_x64.compressed" wide
 
 	condition:
-		1 of ($a*) and 7 of ($b*)
+		1 of ( $a* ) and 7 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_72F68375 : FILE MEMORY
 {
@@ -107972,9 +108169,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_72F68375 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L303-L328"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "912e37829a9f99e00326745343c9e4593cd7cfb8d4dfafc66027cddcb4d883be"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L303-L328"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_912e37829a9f99e00326745343c9e4593cd7cfb8d4dfafc66027cddcb4d883be"
 		score = 75
 		quality = 63
 		tags = "FILE, MEMORY"
@@ -107997,7 +108194,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_72F68375 : FILE MEMORY
 		$c3 = "__imp__NETAPI32$DsGetDcNameA" ascii fullword
 
 	condition:
-		1 of ($a*) or 2 of ($b*) or 2 of ($c*)
+		1 of ( $a* ) or 2 of ( $b* ) or 2 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_15F680Fb : FILE MEMORY
 {
@@ -108008,9 +108205,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_15F680Fb : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L330-L360"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "0efe368ad82f5b0f6301121bfda9fd049b008ac246368bfa22bd976fa2c56b79"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L330-L360"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_0efe368ad82f5b0f6301121bfda9fd049b008ac246368bfa22bd976fa2c56b79"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108038,7 +108235,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_15F680Fb : FILE MEMORY
 		$b10 = "Logged on users at \\\\%s:" ascii fullword
 
 	condition:
-		2 of ($a*) or 6 of ($b*)
+		2 of ( $a* ) or 6 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_5B4383Ec : FILE MEMORY
 {
@@ -108049,9 +108246,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_5B4383Ec : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L362-L392"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "033bd831209958674f6309739d65c58d05acb9d17e53cede1cf171c6d6e84efa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L362-L392"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_033bd831209958674f6309739d65c58d05acb9d17e53cede1cf171c6d6e84efa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108079,7 +108276,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_5B4383Ec : FILE MEMORY
 		$b10 = "PREFERENCES!12345" ascii fullword
 
 	condition:
-		2 of ($a*) or 6 of ($b*)
+		2 of ( $a* ) or 6 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_91E08059 : FILE MEMORY
 {
@@ -108090,9 +108287,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_91E08059 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L394-L421"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d5a8c1a0baa5e915cff29bcac33e30a7d7260f938ecaa6171d3aa88425a69266"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L394-L421"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d5a8c1a0baa5e915cff29bcac33e30a7d7260f938ecaa6171d3aa88425a69266"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108117,7 +108314,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_91E08059 : FILE MEMORY
 		$b6 = "NetDomain" ascii fullword
 
 	condition:
-		2 of ($a*) or 4 of ($b*)
+		2 of ( $a* ) or 4 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_Ee756Db7 : FILE MEMORY
 {
@@ -108128,9 +108325,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_Ee756Db7 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L423-L491"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "8d594aa1b889e80000cfcedbfc470a1b768bdcc2a9c436cd449b495c91011918"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L423-L491"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_8d594aa1b889e80000cfcedbfc470a1b768bdcc2a9c436cd449b495c91011918"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -108196,7 +108393,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_Ee756Db7 : FILE MEMORY
 		$a51 = "Content-Length: %d" ascii fullword
 
 	condition:
-		6 of ($a*)
+		6 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_9C0D5561 : FILE MEMORY
 {
@@ -108207,9 +108404,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_9C0D5561 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L493-L523"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "a8929266950e0f540a68c4fedf708e8ddc27f208f9f2866245ad7bb7f6d87913"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L493-L523"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_a8929266950e0f540a68c4fedf708e8ddc27f208f9f2866245ad7bb7f6d87913"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108237,7 +108434,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_9C0D5561 : FILE MEMORY
 		$c2 = "z:\\devcenter\\aggressor\\external\\PowerShellRunner\\obj\\Release\\PowerShellRunner.pdb" ascii fullword
 
 	condition:
-		(1 of ($a*) and 4 of ($b*)) or 1 of ($c*)
+		(1 of ( $a* ) and 4 of ( $b* ) ) or 1 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_59Ed9124 : FILE MEMORY
 {
@@ -108248,9 +108445,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_59Ed9124 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L525-L560"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "a50fd291f5f1bf7ec41b1938a32473a23c3c082018b86eab87aff0d95b26ba06"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L525-L560"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_a50fd291f5f1bf7ec41b1938a32473a23c3c082018b86eab87aff0d95b26ba06"
 		score = 75
 		quality = 43
 		tags = "FILE, MEMORY"
@@ -108283,7 +108480,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_59Ed9124 : FILE MEMORY
 		$c8 = "__imp__ADVAPI32$CloseServiceHandle" ascii fullword
 
 	condition:
-		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+		1 of ( $a* ) or 5 of ( $b* ) or 5 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_8A791Eb7 : FILE MEMORY
 {
@@ -108294,9 +108491,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_8A791Eb7 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L562-L597"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "d1765e6cac9b1560d6484baa1fa5a1bc0b768a72b389c7c6a60e34115669933e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L562-L597"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_d1765e6cac9b1560d6484baa1fa5a1bc0b768a72b389c7c6a60e34115669933e"
 		score = 75
 		quality = 43
 		tags = "FILE, MEMORY"
@@ -108329,7 +108526,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_8A791Eb7 : FILE MEMORY
 		$c8 = "__imp__BeaconDataPtr" ascii fullword
 
 	condition:
-		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+		1 of ( $a* ) or 5 of ( $b* ) or 5 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_D00573A3 : FILE MEMORY
 {
@@ -108340,9 +108537,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_D00573A3 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L599-L625"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e458d41d28b76c989af6385f183f33aa9e11b93e529f032e95bd75433b80bd69"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L599-L625"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e458d41d28b76c989af6385f183f33aa9e11b93e529f032e95bd75433b80bd69"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108366,7 +108563,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_D00573A3 : FILE MEMORY
 		$b6 = "Adobe APP14 marker: version %d, flags 0x%04x 0x%04x, transform %d" ascii fullword
 
 	condition:
-		2 of ($a*) or 5 of ($b*)
+		2 of ( $a* ) or 5 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_7Bcd759C : FILE MEMORY
 {
@@ -108377,9 +108574,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_7Bcd759C : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L627-L648"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "bfbb8e8009182e87c49242ec3da6e98b23447b646f5c7ea5f97196ae929d7c5f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L627-L648"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_bfbb8e8009182e87c49242ec3da6e98b23447b646f5c7ea5f97196ae929d7c5f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108398,7 +108595,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_7Bcd759C : FILE MEMORY
 		$b2 = "\\\\.\\pipe\\PIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ascii fullword
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		1 of ( $a* ) and 1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_A56B820F : FILE MEMORY
 {
@@ -108409,9 +108606,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_A56B820F : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L650-L685"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "52de8110727c29b0f5c75cd470ce6b80ba7821d0ba78ad074536323e2e80b460"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L650-L685"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_52de8110727c29b0f5c75cd470ce6b80ba7821d0ba78ad074536323e2e80b460"
 		score = 75
 		quality = 43
 		tags = "FILE, MEMORY"
@@ -108444,7 +108641,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_A56B820F : FILE MEMORY
 		$c8 = "__imp__BeaconDataExtract" ascii fullword
 
 	condition:
-		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+		1 of ( $a* ) or 5 of ( $b* ) or 5 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_92F05172 : FILE MEMORY
 {
@@ -108455,9 +108652,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_92F05172 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L687-L716"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "7f0ff4ee14a043d72810826ab9d2b90b0f66724550ba9d3cdd2abe749f4874d0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L687-L716"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_7f0ff4ee14a043d72810826ab9d2b90b0f66724550ba9d3cdd2abe749f4874d0"
 		score = 75
 		quality = 63
 		tags = "FILE, MEMORY"
@@ -108484,7 +108681,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_92F05172 : FILE MEMORY
 		$c7 = "_willAutoElevate" ascii fullword
 
 	condition:
-		1 of ($a*) or 3 of ($b*) or 4 of ($c*)
+		1 of ( $a* ) or 3 of ( $b* ) or 4 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_417239B5 : FILE MEMORY
 {
@@ -108495,9 +108692,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_417239B5 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L718-L764"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "fda252747359e677459d82d65c4c9c8f2ff80bc8fd6a38712f858039f3cb8dd1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L718-L764"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_fda252747359e677459d82d65c4c9c8f2ff80bc8fd6a38712f858039f3cb8dd1"
 		score = 75
 		quality = 51
 		tags = "FILE, MEMORY"
@@ -108541,7 +108738,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_417239B5 : FILE MEMORY
 		$c12 = "_SpawnAsAdminX64" ascii fullword
 
 	condition:
-		1 of ($a*) or 9 of ($b*) or 7 of ($c*)
+		1 of ( $a* ) or 9 of ( $b* ) or 7 of ( $c* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_29374056 : FILE MEMORY
 {
@@ -108552,9 +108749,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_29374056 : FILE MEMORY
 		date = "2021-03-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L766-L785"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "09755b23a7057c70f3ea242ec48549de65ebc6f13bdc38cbe22d6d758c3718cf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L766-L785"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_09755b23a7057c70f3ea242ec48549de65ebc6f13bdc38cbe22d6d758c3718cf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108571,7 +108768,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_29374056 : FILE MEMORY
 		$a2 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 }
 
 	condition:
-		1 of ($a*)
+		1 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_949F10E3 : FILE MEMORY
 {
@@ -108582,9 +108779,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_949F10E3 : FILE MEMORY
 		date = "2021-03-25"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L787-L806"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e4b726c83013f4b9c9d61683f78a4a91935225e9ed3de0ce164b96b5a6719579"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L787-L806"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e4b726c83013f4b9c9d61683f78a4a91935225e9ed3de0ce164b96b5a6719579"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108612,9 +108809,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_8751Cdf9 : FILE MEMORY
 		date = "2021-03-25"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L808-L827"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "64fae95fd89ad46a50a00c943cf98a997a0842a83be64b3728b25151867b75a8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L808-L827"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_64fae95fd89ad46a50a00c943cf98a997a0842a83be64b3728b25151867b75a8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108642,9 +108839,9 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_663Fc95D : FILE MEMORY
 		date = "2021-04-01"
 		modified = "2021-12-17"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L829-L847"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "842a0a372cfb2316293f4a08e1690194fa98368a9f6ffe9c63222b2c4ab6532c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L829-L847"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_842a0a372cfb2316293f4a08e1690194fa98368a9f6ffe9c63222b2c4ab6532c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108671,10 +108868,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_B54B94Ac : FILE MEMORY
 		date = "2021-10-21"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L849-L872"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L849-L872"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "6f63e4c31e55da2008f95e9d05391e40d44e2757c511e666032563ab798e274c"
+		logic_hash = "v1_sha256_6f63e4c31e55da2008f95e9d05391e40d44e2757c511e666032563ab798e274c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108705,10 +108902,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_F0B627Fc : FILE MEMORY
 		date = "2021-10-21"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L874-L897"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L874-L897"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b"
-		logic_hash = "1087294af3a9ef59c00098f5fd7adfe0b335525e135d95e45ac30e44c6739a72"
+		logic_hash = "v1_sha256_1087294af3a9ef59c00098f5fd7adfe0b335525e135d95e45ac30e44c6739a72"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108739,10 +108936,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_Dcdcdd8C : FILE MEMORY
 		date = "2021-10-21"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L899-L923"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L899-L923"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "f3ae07282b763d3720e45a84878cc457f65041f381951cdc9affd5e3ce67e6cc"
+		logic_hash = "v1_sha256_f3ae07282b763d3720e45a84878cc457f65041f381951cdc9affd5e3ce67e6cc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108774,10 +108971,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_A3Fb2616 : FILE MEMORY
 		date = "2021-10-21"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L925-L947"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L925-L947"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "a3c36326ccc2bc828f6654ccaba507a283f92146fdc52f71d7d934f6908793e2"
+		logic_hash = "v1_sha256_a3c36326ccc2bc828f6654ccaba507a283f92146fdc52f71d7d934f6908793e2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108796,7 +108993,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_A3Fb2616 : FILE MEMORY
 		$b2 = "COBALTSTRIKE" ascii fullword
 
 	condition:
-		1 of ($a*) and 2 of ($b*)
+		1 of ( $a* ) and 2 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_8Ee55Ee5 : FILE MEMORY
 {
@@ -108807,10 +109004,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_8Ee55Ee5 : FILE MEMORY
 		date = "2021-10-21"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L949-L969"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L949-L969"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "d0cc321e15660311ae0b8e3261abe716a50a2455f82635c1b02d0a5444c8a89a"
+		logic_hash = "v1_sha256_d0cc321e15660311ae0b8e3261abe716a50a2455f82635c1b02d0a5444c8a89a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108827,7 +109024,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_8Ee55Ee5 : FILE MEMORY
 		$a2 = "z:\\devcenter\\aggressor\\external\\pxlib\\bin\\wmiexec.x86.o" ascii fullword
 
 	condition:
-		1 of ($a*)
+		1 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_8D5963A2 : FILE MEMORY
 {
@@ -108838,10 +109035,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_8D5963A2 : FILE MEMORY
 		date = "2022-08-10"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L971-L989"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L971-L989"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9fe43996a5c4e99aff6e2a1be743fedec35e96d1e6670579beb4f7e7ad591af9"
-		logic_hash = "f4f8fba807256bd885ccf4946eec8c2fb76eb04f86ed76d015178fe512a3c091"
+		logic_hash = "v1_sha256_f4f8fba807256bd885ccf4946eec8c2fb76eb04f86ed76d015178fe512a3c091"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108867,10 +109064,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_1787Eef5 : FILE MEMORY
 		date = "2022-08-29"
 		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L991-L1014"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L991-L1014"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "0b70c61e986dee3126fec6eea127e01fce4b647aff8e2d2d5072eb8328549225"
+		logic_hash = "v1_sha256_0b70c61e986dee3126fec6eea127e01fce4b647aff8e2d2d5072eb8328549225"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108890,7 +109087,7 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_1787Eef5 : FILE MEMORY
 		$a5 = { 4D 5A 41 52 55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 8D 1D ?? ?? ?? ?? 48 89 DF 48 81 C3 ?? ?? ?? ?? }
 
 	condition:
-		1 of ($a*)
+		1 of ( $a* )
 }
 rule ELASTIC_Windows_Trojan_Cobaltstrike_4106070A : FILE MEMORY
 {
@@ -108901,10 +109098,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_4106070A : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L1016-L1035"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L1016-L1035"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "98789a11c06c1dfff7e02f66146afca597233c17e0d4900d6a683a150f16b3a4"
-		logic_hash = "90f0209a55ca381ca58264664e04c007c799cf558f143d0c02983d4caf47bfb8"
+		logic_hash = "v1_sha256_90f0209a55ca381ca58264664e04c007c799cf558f143d0c02983d4caf47bfb8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108931,10 +109128,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_3Dc22D14 : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L1037-L1056"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L1037-L1056"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7898194ae0244611117ec948eb0b0a5acbc15cd1419b1ecc553404e63bc519f9"
-		logic_hash = "2f52cd5f3b782c28e372c3daa9b7ddc4d2b9f68832f5250983412c2e7a755e73"
+		logic_hash = "v1_sha256_2f52cd5f3b782c28e372c3daa9b7ddc4d2b9f68832f5250983412c2e7a755e73"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -108961,10 +109158,10 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_7F8Da98A : FILE MEMORY
 		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_CobaltStrike.yar#L1058-L1076"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_CobaltStrike.yar#L1058-L1076"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e3bc2bec4a55ad6cfdf49e5dbd4657fc704af1758ca1d6e31b83dcfb8bf0f89d"
-		logic_hash = "6c8698d65cbbf893f79ca1de5273535891418c87c234a2542f5f8079e56d9507"
+		logic_hash = "v1_sha256_6c8698d65cbbf893f79ca1de5273535891418c87c234a2542f5f8079e56d9507"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -108990,10 +109187,10 @@ rule ELASTIC_Windows_Exploit_Perfusion_5Ab5Ddee : FILE MEMORY
 		date = "2024-02-28"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_Perfusion.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_Perfusion.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7fdef25acb0d1447203b9768ae58a8e21db24816c602b160d105dab86ae34728"
-		logic_hash = "490f3fc89cf78dbe82f1feb012a147a8d187612720efb6e1eb4e97720b26ee59"
+		logic_hash = "v1_sha256_490f3fc89cf78dbe82f1feb012a147a8d187612720efb6e1eb4e97720b26ee59"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109022,10 +109219,10 @@ rule ELASTIC_Linux_Exploit_Courier_190258Dd : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Courier.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Courier.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "349866d0fb81d07a35b53eac6f11176721629bbd692526851e483eaa83d690c3"
-		logic_hash = "c318d78a11a021334c84a21db2be6d7df57440a1f3ad6feaaff9cc95ebf6f716"
+		logic_hash = "v1_sha256_c318d78a11a021334c84a21db2be6d7df57440a1f3ad6feaaff9cc95ebf6f716"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109051,10 +109248,10 @@ rule ELASTIC_Linux_Trojan_Kaiji_253C44De : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Kaiji.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Kaiji.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e31eb8880bb084b4c642eba127e64ce99435ea8299a98c183a63a2e6a139d926"
-		logic_hash = "81a07f60765f50c58b2c0f0153367ee570f36c579e9f88fb2f0e49ae5c08773f"
+		logic_hash = "v1_sha256_81a07f60765f50c58b2c0f0153367ee570f36c579e9f88fb2f0e49ae5c08773f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109080,10 +109277,10 @@ rule ELASTIC_Linux_Trojan_Kaiji_535F07Ac : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Kaiji.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Kaiji.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "28b2993d7c8c1d8dfce9cd2206b4a3971d0705fd797b9fde05211686297f6bb0"
-		logic_hash = "539977c1076b71873135cfe02153da87c0e9ac17122f04570977a22c92d2694f"
+		logic_hash = "v1_sha256_539977c1076b71873135cfe02153da87c0e9ac17122f04570977a22c92d2694f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109109,10 +109306,10 @@ rule ELASTIC_Linux_Trojan_Kaiji_Dcf6565E : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Kaiji.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Kaiji.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "49f3086105bdc160248e66334db00ce37cdc9167a98faac98800b2c97515b6e7"
-		logic_hash = "2bc943e100548e9aacd97930b3230353be760c8a292dbbbd1d0b5646f647c4fe"
+		logic_hash = "v1_sha256_2bc943e100548e9aacd97930b3230353be760c8a292dbbbd1d0b5646f647c4fe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109138,10 +109335,10 @@ rule ELASTIC_Linux_Trojan_Kaiji_91091Be3 : FILE MEMORY
 		date = "2022-09-12"
 		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Kaiji.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Kaiji.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dca574d13fcbd7d244d434fcbca68136e0097fefc5f131bec36e329448f9a202"
-		logic_hash = "3b55cb3be5775311af4dc90f9624448d30cc58ef1a42729f6ca4eb3b36ad8b06"
+		logic_hash = "v1_sha256_3b55cb3be5775311af4dc90f9624448d30cc58ef1a42729f6ca4eb3b36ad8b06"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109167,10 +109364,10 @@ rule ELASTIC_Windows_Trojan_Svcready_Af498D39 : FILE MEMORY
 		date = "2022-06-12"
 		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_SVCReady.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_SVCReady.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273"
-		logic_hash = "e3520103064cf82cd1747f8889667929d23466c9febfda7e4968a3679db97d71"
+		logic_hash = "v1_sha256_e3520103064cf82cd1747f8889667929d23466c9febfda7e4968a3679db97d71"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109200,10 +109397,10 @@ rule ELASTIC_Windows_Exploit_Dcom_7A1Bcec7 : FILE
 		date = "2021-01-12"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_Dcom.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_Dcom.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "84073caf71d0e0523adeb96169c85b8f0bfea09e7ef3bf677bfc19d3b536d8a5"
-		logic_hash = "484576ab5369f99dc7086d724ead12d464f2bedaf84c93b74e137ddd98600b06"
+		logic_hash = "v1_sha256_484576ab5369f99dc7086d724ead12d464f2bedaf84c93b74e137ddd98600b06"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -109229,10 +109426,10 @@ rule ELASTIC_Linux_Rootkit_Diamorphine_716C7Ffa : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Diamorphine.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Diamorphine.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01fb490fbe2c2b5368cc227abd97e011e83b5e99bb80945ef599fc80e85f8545"
-		logic_hash = "29ae87a563085ff0e4821a994ede16fa3f6fec693418c2e92ac90b839fcfa7cf"
+		logic_hash = "v1_sha256_29ae87a563085ff0e4821a994ede16fa3f6fec693418c2e92ac90b839fcfa7cf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109251,7 +109448,7 @@ rule ELASTIC_Linux_Rootkit_Diamorphine_716C7Ffa : FILE MEMORY
 		$license2 = "license=GPL"
 
 	condition:
-		2 of ($str*) and 1 of ($license*)
+		2 of ( $str* ) and 1 of ( $license* )
 }
 rule ELASTIC_Linux_Rootkit_Diamorphine_66Eb93C7 : FILE MEMORY
 {
@@ -109262,10 +109459,10 @@ rule ELASTIC_Linux_Rootkit_Diamorphine_66Eb93C7 : FILE MEMORY
 		date = "2024-11-13"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Diamorphine.yar#L25-L54"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Diamorphine.yar#L25-L54"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "01fb490fbe2c2b5368cc227abd97e011e83b5e99bb80945ef599fc80e85f8545"
-		logic_hash = "26063aacb585825f5d6b56d0d671e94efb273605175f4164d271c8edfdbc150a"
+		logic_hash = "v1_sha256_26063aacb585825f5d6b56d0d671e94efb273605175f4164d271c8edfdbc150a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109291,7 +109488,7 @@ rule ELASTIC_Linux_Rootkit_Diamorphine_66Eb93C7 : FILE MEMORY
 		$func9 = "write_cr0_forced"
 
 	condition:
-		1 of ($rk*) and 3 of ($func*)
+		1 of ( $rk* ) and 3 of ( $func* )
 }
 rule ELASTIC_Windows_Ransomware_Phobos_A5420148 : BETA FILE MEMORY
 {
@@ -109302,9 +109499,9 @@ rule ELASTIC_Windows_Ransomware_Phobos_A5420148 : BETA FILE MEMORY
 		date = "2020-06-25"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Phobos.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "9fcfe41102bee4f8ecf19f30d0bbb2de50e1a1aff4e17c587b5d9adb417527c5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Phobos.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_9fcfe41102bee4f8ecf19f30d0bbb2de50e1a1aff4e17c587b5d9adb417527c5"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -109322,7 +109519,7 @@ rule ELASTIC_Windows_Ransomware_Phobos_A5420148 : BETA FILE MEMORY
 		$a3 = { 31 00 63 00 64 00 00 00 33 00 64 00 73 00 00 00 33 00 66 00 72 00 00 00 33 00 67 00 32 00 00 00 33 00 67 00 70 00 00 00 37 00 7A 00 00 00 61 00 63 00 63 00 64 00 61 00 00 00 61 00 63 00 63 00 64 00 62 00 00 00 61 00 63 00 63 00 64 00 63 00 00 00 61 00 63 00 63 00 64 00 65 00 00 00 61 00 63 00 63 00 64 00 74 00 00 00 61 00 63 00 63 00 64 00 77 00 00 00 61 00 64 00 62 00 00 00 61 00 64 00 70 00 00 00 61 00 69 00 00 00 61 00 69 00 33 00 00 00 61 00 69 00 34 00 00 00 61 00 69 00 35 00 00 00 61 00 69 00 36 00 00 00 61 00 69 00 37 00 00 00 61 00 69 00 38 00 00 00 61 00 6E 00 69 00 6D 00 00 00 61 00 72 00 77 00 00 00 61 00 73 00 00 00 61 00 73 00 61 00 00 00 61 00 73 00 63 00 00 00 61 00 73 00 63 00 78 00 00 00 61 00 73 00 6D 00 00 00 61 00 73 00 6D 00 78 00 00 00 61 00 73 00 70 00 00 00 61 00 73 00 70 00 78 00 00 00 61 00 73 00 72 00 00 00 61 00 73 00 78 00 00 00 61 00 76 00 69 00 00 00 61 00 76 00 73 00 00 00 62 00 61 00 63 00 6B 00 75 00 70 00 00 00 62 00 61 00 6B 00 00 00 62 00 61 00 79 00 00 00 62 00 64 00 00 00 62 00 69 00 6E 00 00 00 62 00 6D 00 70 00 00 00 }
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule ELASTIC_Windows_Ransomware_Phobos_Ff55774D : BETA FILE MEMORY
 {
@@ -109333,9 +109530,9 @@ rule ELASTIC_Windows_Ransomware_Phobos_Ff55774D : BETA FILE MEMORY
 		date = "2020-06-25"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Phobos.yar#L24-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "9ee41b9638a8cc1d9f9b254878c935c531b2f599be59550b3617b1de8cba2ba5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Phobos.yar#L24-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_9ee41b9638a8cc1d9f9b254878c935c531b2f599be59550b3617b1de8cba2ba5"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -109351,7 +109548,7 @@ rule ELASTIC_Windows_Ransomware_Phobos_Ff55774D : BETA FILE MEMORY
 		$c1 = { 24 18 83 C4 0C 8B 4F 0C 03 C6 50 8D 54 24 18 52 51 6A 00 6A 00 89 44 }
 
 	condition:
-		1 of ($c*)
+		1 of ( $c* )
 }
 rule ELASTIC_Windows_Ransomware_Phobos_11Ea7Be5 : BETA FILE MEMORY
 {
@@ -109362,9 +109559,9 @@ rule ELASTIC_Windows_Ransomware_Phobos_11Ea7Be5 : BETA FILE MEMORY
 		date = "2020-06-25"
 		modified = "2021-08-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Phobos.yar#L45-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "1f86695f316200c92d0d02f5f3ba9f68854978f98db5d4291a81c06c9f0b8d28"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Phobos.yar#L45-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_1f86695f316200c92d0d02f5f3ba9f68854978f98db5d4291a81c06c9f0b8d28"
 		score = 75
 		quality = 75
 		tags = "BETA, FILE, MEMORY"
@@ -109380,7 +109577,7 @@ rule ELASTIC_Windows_Ransomware_Phobos_11Ea7Be5 : BETA FILE MEMORY
 		$b1 = { C0 74 30 33 C0 40 8B CE D3 E0 85 C7 74 19 66 8B 04 73 66 89 }
 
 	condition:
-		1 of ($b*)
+		1 of ( $b* )
 }
 rule ELASTIC_Linux_Exploit_CVE_2012_0056_06B2Dff5 : FILE MEMORY CVE_2012_0056
 {
@@ -109391,10 +109588,10 @@ rule ELASTIC_Linux_Exploit_CVE_2012_0056_06B2Dff5 : FILE MEMORY CVE_2012_0056
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "168b3fb1c675ab76224c641e228434495160502a738b64172c679e8ce791ac17"
-		logic_hash = "4361e6e74d6678d9e0823b23a7a2e4ae84119142cad319950154f806115845d5"
+		logic_hash = "v1_sha256_4361e6e74d6678d9e0823b23a7a2e4ae84119142cad319950154f806115845d5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2012-0056"
@@ -109420,10 +109617,10 @@ rule ELASTIC_Linux_Exploit_CVE_2012_0056_B39839F4 : FILE MEMORY CVE_2012_0056
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cf569647759e011ff31d8626cea65ed506e8d0ef1d26f3bbb7c02a4060ce58dc"
-		logic_hash = "553111c64d8abfc3688a88dd95088de0ea7e92f68592e9a778f8041b40071e84"
+		logic_hash = "v1_sha256_553111c64d8abfc3688a88dd95088de0ea7e92f68592e9a778f8041b40071e84"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2012-0056"
@@ -109449,10 +109646,10 @@ rule ELASTIC_Linux_Exploit_CVE_2012_0056_A1E53450 : FILE MEMORY CVE_2012_0056
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "15a4d149e935758199f6df946ff889e12097f5fec4ef450e9cbd554d1efbd5e6"
-		logic_hash = "f2ab5de83c36a9a834e41c8f6fdccd0dffdeb384adf7b1e1098e86a2ac52df18"
+		logic_hash = "v1_sha256_f2ab5de83c36a9a834e41c8f6fdccd0dffdeb384adf7b1e1098e86a2ac52df18"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2012-0056"
@@ -109478,10 +109675,10 @@ rule ELASTIC_Windows_Hacktool_Sharpapplocker_9645Cf22 : FILE MEMORY
 		date = "2022-11-20"
 		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_SharpAppLocker.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_SharpAppLocker.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0f7390905abc132889f7b9a6d5b42701173aafbff5b8f8882397af35d8c10965"
-		logic_hash = "cb72ecf7715b288acddac51dab091d84c64e3bd30276cba38a0d773e6693875c"
+		logic_hash = "v1_sha256_cb72ecf7715b288acddac51dab091d84c64e3bd30276cba38a0d773e6693875c"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -109499,7 +109696,7 @@ rule ELASTIC_Windows_Hacktool_Sharpapplocker_9645Cf22 : FILE MEMORY
 		$print_str2 = "SharpAppLocker.exe --effective --allow --rules=\"FileHashRule,FilePathRule\" --outfile=\"C:\\Windows\\Tasks\\Rules.json\"" ascii wide fullword
 
 	condition:
-		$guid or all of ($print_str*)
+		$guid or all of ( $print_str* )
 }
 rule ELASTIC_Linux_Exploit_CVE_2021_3156_F3Fb10Cd : FILE CVE_2021_3156
 {
@@ -109510,10 +109707,10 @@ rule ELASTIC_Linux_Exploit_CVE_2021_3156_F3Fb10Cd : FILE CVE_2021_3156
 		date = "2021-09-15"
 		modified = "2021-09-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2021_3156.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2021_3156.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "65fb8baa5ec3bfb4473e4b2f565b461dd59989d43c72b1c5ec2e1a68baa8b51a"
-		logic_hash = "cc80e0b2355877cd9ceecae19d4dcebb641d90a24c0751bf706134b31bf26750"
+		logic_hash = "v1_sha256_cc80e0b2355877cd9ceecae19d4dcebb641d90a24c0751bf706134b31bf26750"
 		score = 75
 		quality = 75
 		tags = "FILE, CVE-2021-3156"
@@ -109540,10 +109737,10 @@ rule ELASTIC_Linux_Exploit_CVE_2021_3156_7F5672D0 : FILE CVE_2021_3156
 		date = "2021-09-15"
 		modified = "2021-09-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2021_3156.yar#L22-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2021_3156.yar#L22-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1a4517d2582ac97b88ae568c23e75beba93daf8518bd3971985d6a798049fd61"
-		logic_hash = "e25907f11a2f292441a96e19834ad89636593a3f8998ec0010e43830f5aa0c64"
+		logic_hash = "v1_sha256_e25907f11a2f292441a96e19834ad89636593a3f8998ec0010e43830f5aa0c64"
 		score = 75
 		quality = 75
 		tags = "FILE, CVE-2021-3156"
@@ -109563,7 +109760,7 @@ rule ELASTIC_Linux_Exploit_CVE_2021_3156_7F5672D0 : FILE CVE_2021_3156
 		$msg3 = "symlink 2nd time success at: %d" fullword
 
 	condition:
-		( any of ($a*)) or ($sudo and 2 of ($msg*))
+		( any of ( $a* ) ) or ( $sudo and 2 of ( $msg* ) )
 }
 rule ELASTIC_Windows_Vulndriver_Procid_86605Fa9 : FILE
 {
@@ -109574,10 +109771,10 @@ rule ELASTIC_Windows_Vulndriver_Procid_86605Fa9 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_ProcId.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_ProcId.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29"
-		logic_hash = "882cdbd267d812e77e68e7080f1fca0ca3d7e75ab84c583c3ec148894b1cf644"
+		logic_hash = "v1_sha256_882cdbd267d812e77e68e7080f1fca0ca3d7e75ab84c583c3ec148894b1cf644"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -109592,7 +109789,47 @@ rule ELASTIC_Windows_Vulndriver_Procid_86605Fa9 : FILE
 		$str1 = "\\piddrv64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
+}
+rule ELASTIC_Linux_Trojan_Pumakit_B86138C3 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Pumakit (Linux.Trojan.Pumakit)"
+		author = "Elastic Security"
+		id = "b86138c3-c7b3-4f86-a695-bf8195f2458c"
+		date = "2024-12-09"
+		modified = "2024-12-11"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Pumakit.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		hash = "30b26707d5fb407ef39ebee37ded7edeea2890fb5ec1ebfa09a3b3edfc80db1f"
+		logic_hash = "v1_sha256_fc486aafee5cd4156ef7027ed6bf596c62397601787833d9173c198d5d919cde"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "c5cba5975be26ebcb14871527533d1f8f082b37f2d8b509904b608569fdb8b24"
+		severity = 100
+		arch_context = "x86, arm64"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$str1 = "PUMA %s"
+		$str2 = "Kitsune PID %ld"
+		$str3 = "/usr/share/zov_f"
+		$str4 = "zarya"
+		$str5 = ".puma-config"
+		$str6 = "ping_interval_s"
+		$str7 = "session_timeout_s"
+		$str8 = "c2_timeout_s"
+		$str9 = "LD_PRELOAD=/lib64/libs.so"
+		$str10 = "kit_so_len"
+		$str11 = "opsecurity1.art"
+		$str12 = "89.23.113.204"
+
+	condition:
+		4 of them
 }
 rule ELASTIC_Windows_Vulndriver_Winflash_881758Da : FILE
 {
@@ -109603,10 +109840,10 @@ rule ELASTIC_Windows_Vulndriver_Winflash_881758Da : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_WinFlash.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_WinFlash.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8596ea3952d84eeef8f5dc5b0b83014feb101ec295b2d80910f21508a95aa026"
-		logic_hash = "a46ac1f19ba5d9543c88434575870b61fbb935cd4c4e28cb80a077502af7d2db"
+		logic_hash = "v1_sha256_a46ac1f19ba5d9543c88434575870b61fbb935cd4c4e28cb80a077502af7d2db"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -109621,7 +109858,7 @@ rule ELASTIC_Windows_Vulndriver_Winflash_881758Da : FILE
 		$str1 = "\\WinFlash64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Ransomware_Sodinokibi_2883D7Cd : FILE MEMORY
 {
@@ -109632,10 +109869,10 @@ rule ELASTIC_Linux_Ransomware_Sodinokibi_2883D7Cd : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Sodinokibi.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Sodinokibi.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a322b230a3451fd11dcfe72af4da1df07183d6aaf1ab9e062f0e6b14cf6d23cd"
-		logic_hash = "97d6b1b641c4b5b596b67a809e8e70bb0bccb9219282cd6c41bc905e2ea44c84"
+		logic_hash = "v1_sha256_97d6b1b641c4b5b596b67a809e8e70bb0bccb9219282cd6c41bc905e2ea44c84"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109661,10 +109898,10 @@ rule ELASTIC_Linux_Rootkit_Dakkatoni_010D3Ac2 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Dakkatoni.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Dakkatoni.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "38b2d033eb5ce87faa4faa7fcac943d9373e432e0d45e741a0c01d714ee9d4d3"
-		logic_hash = "51119321f29aed695e09da22d3234eae96db93e8029d4525d018e56c7131f7b8"
+		logic_hash = "v1_sha256_51119321f29aed695e09da22d3234eae96db93e8029d4525d018e56c7131f7b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109690,10 +109927,10 @@ rule ELASTIC_Windows_Trojan_Ghostengine_8Ea2Aa65 : FILE MEMORY
 		date = "2024-05-07"
 		modified = "2024-05-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_GhostEngine.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_GhostEngine.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2fe78941d74d35f721556697491a438bf3573094d7ac091b42e4f59ecbd25753"
-		logic_hash = "3bddd2ac79d92d34df5d2df4a11cf96cc44ca39c3baece1b5c67b75a682778ff"
+		logic_hash = "v1_sha256_3bddd2ac79d92d34df5d2df4a11cf96cc44ca39c3baece1b5c67b75a682778ff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109715,7 +109952,7 @@ rule ELASTIC_Windows_Trojan_Ghostengine_8Ea2Aa65 : FILE MEMORY
 		$binary1 = { 83 F9 06 0F ?? ?? ?? ?? ?? 8B 10 81 FA 78 38 36 5F 0F 85 ?? ?? ?? ?? 0F B7 50 04 66 81 FA 36 34 74 ?? E9 ?? ?? 00 00 C7 04 24 00 E4 0B 54 C7 44 24 04 02 00 00 00 }
 
 	condition:
-		3 of ($str*) or 1 of ($binary*)
+		3 of ( $str* ) or 1 of ( $binary* )
 }
 rule ELASTIC_Macos_Trojan_Eggshell_Ddacf7B9 : FILE MEMORY
 {
@@ -109726,10 +109963,10 @@ rule ELASTIC_Macos_Trojan_Eggshell_Ddacf7B9 : FILE MEMORY
 		date = "2021-09-30"
 		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Trojan_Eggshell.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Trojan_Eggshell.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6d93a714dd008746569c0fbd00fadccbd5f15eef06b200a4e831df0dc8f3d05b"
-		logic_hash = "f986f7d1e3a68e27f82048017c6d6381a0354ffad2cd10f3eee69bbbfa940abd"
+		logic_hash = "v1_sha256_f986f7d1e3a68e27f82048017c6d6381a0354ffad2cd10f3eee69bbbfa940abd"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -109759,10 +109996,10 @@ rule ELASTIC_Windows_Trojan_Azorult_38Fce9Ea : FILE MEMORY
 		date = "2021-08-05"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Azorult.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Azorult.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491"
-		logic_hash = "e23b21992b7ff577d4521c733929638522f4bf57b54c72e5e46196d028d6be26"
+		logic_hash = "v1_sha256_e23b21992b7ff577d4521c733929638522f4bf57b54c72e5e46196d028d6be26"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109792,10 +110029,10 @@ rule ELASTIC_Windows_Exploit_Fakepipe_6Bc93551 : FILE MEMORY
 		date = "2024-02-28"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Exploit_FakePipe.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Exploit_FakePipe.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "545a41ccfcd0a4f09c1c62bef2dde61b52fa92abada71ab72b3f4febb9265f75"
-		logic_hash = "daf78c4a2db337f51054e108b5b54c8aa32300eae3bd39c5fc2d4769221c8aea"
+		logic_hash = "v1_sha256_daf78c4a2db337f51054e108b5b54c8aa32300eae3bd39c5fc2d4769221c8aea"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109813,7 +110050,7 @@ rule ELASTIC_Windows_Exploit_Fakepipe_6Bc93551 : FILE MEMORY
 		$s3 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 00 19 5C 00 70 00 69 00 70 00 65 00 5C }
 
 	condition:
-		$api and any of ($s*)
+		$api and any of ( $s* )
 }
 rule ELASTIC_Windows_Vulndriver_Fileseclab_4A21229A : FILE
 {
@@ -109824,10 +110061,10 @@ rule ELASTIC_Windows_Vulndriver_Fileseclab_4A21229A : FILE
 		date = "2024-03-05"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Fileseclab.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Fileseclab.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ae55a0e93e5ef3948adecf20fa55b0f555dcf40589917a5bfbaa732075f0cc12"
-		logic_hash = "bac78186f3d46c6765bacaf6a324ff94e449261cefe2594cb38c4cc25db1f0de"
+		logic_hash = "v1_sha256_bac78186f3d46c6765bacaf6a324ff94e449261cefe2594cb38c4cc25db1f0de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -109847,7 +110084,7 @@ rule ELASTIC_Windows_Vulndriver_Fileseclab_4A21229A : FILE
 		$b2 = { 32 00 2C 00 20 00 30 00 2C 00 20 00 30 00 2C 00 20 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and 1 of ($a*) and 1 of ($b*)
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and 1 of ( $a* ) and 1 of ( $b* )
 }
 rule ELASTIC_Linux_Rootkit_Bedevil_2Af79Cea : FILE MEMORY
 {
@@ -109858,10 +110095,10 @@ rule ELASTIC_Linux_Rootkit_Bedevil_2Af79Cea : FILE MEMORY
 		date = "2024-11-14"
 		modified = "2024-11-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Rootkit_Bedevil.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Rootkit_Bedevil.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8f8c598350632b32e72cd6af3a0ca93c05b4d9100fd03e2ae1aec97a946eb347"
-		logic_hash = "3acded46df45f88cf2cdd0eab424810d3dab51cac90845574a1361301e72be23"
+		logic_hash = "v1_sha256_3acded46df45f88cf2cdd0eab424810d3dab51cac90845574a1361301e72be23"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109886,7 +110123,7 @@ rule ELASTIC_Linux_Rootkit_Bedevil_2Af79Cea : FILE MEMORY
 		$str11 = "dropshell"
 
 	condition:
-		4 of ($str*)
+		4 of ( $str* )
 }
 rule ELASTIC_Macos_Backdoor_Fakeflashlxk_06Fd8071 : FILE MEMORY
 {
@@ -109897,10 +110134,10 @@ rule ELASTIC_Macos_Backdoor_Fakeflashlxk_06Fd8071 : FILE MEMORY
 		date = "2021-11-11"
 		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/MacOS_Backdoor_Fakeflashlxk.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/MacOS_Backdoor_Fakeflashlxk.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "107f844f19e638866d8249e6f735daf650168a48a322d39e39d5e36cfc1c8659"
-		logic_hash = "853d44465a472786bb48bbe1009e0ff925f79e4fd72f0eac537dd271c1ec3703"
+		logic_hash = "v1_sha256_853d44465a472786bb48bbe1009e0ff925f79e4fd72f0eac537dd271c1ec3703"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109928,10 +110165,10 @@ rule ELASTIC_Windows_Ransomware_Cicada3301_99Fee259 : FILE MEMORY
 		date = "2024-09-05"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Cicada3301.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Cicada3301.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e"
-		logic_hash = "18996d70192b0e997eba70c22ed70a2611a7e038a8825308f4d3d002b681939b"
+		logic_hash = "v1_sha256_18996d70192b0e997eba70c22ed70a2611a7e038a8825308f4d3d002b681939b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109961,10 +110198,10 @@ rule ELASTIC_Windows_Ransomware_Blackbasta_494D3C54 : FILE MEMORY
 		date = "2022-08-06"
 		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_BlackBasta.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_BlackBasta.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "357fe8c56e246ffacd54d12f4deb9f1adb25cb772b5cd2436246da3f2d01c222"
-		logic_hash = "1ecb3c95a2d3f91d267f0b625fffc8477612fde9de3942eff8eb13115c0af6b8"
+		logic_hash = "v1_sha256_1ecb3c95a2d3f91d267f0b625fffc8477612fde9de3942eff8eb13115c0af6b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -109998,10 +110235,10 @@ rule ELASTIC_Linux_Cryptominer_Pgminer_Ccf88A37 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Pgminer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Pgminer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3afc8d2d85aca61108d21f82355ad813eba7a189e81dde263d318988c5ea50bd"
-		logic_hash = "77833cdb319bc8e22db2503478677d5992774105f659fe7520177a691c83aa91"
+		logic_hash = "v1_sha256_77833cdb319bc8e22db2503478677d5992774105f659fe7520177a691c83aa91"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110027,10 +110264,10 @@ rule ELASTIC_Linux_Cryptominer_Pgminer_5Fb2Efd5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Pgminer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Pgminer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6d296648fdbc693e604f6375eaf7e28b87a73b8405dc8cd3147663b5e8b96ff0"
-		logic_hash = "4c247f40c9781332f04f82a244f6e8e22c9c744963f736937eddecf769b40a54"
+		logic_hash = "v1_sha256_4c247f40c9781332f04f82a244f6e8e22c9c744963f736937eddecf769b40a54"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110056,9 +110293,9 @@ rule ELASTIC_Windows_Trojan_Parallax_D72Ec0E2 : FILE MEMORY
 		date = "2022-09-05"
 		modified = "2022-09-29"
 		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Parallax.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "6c2c84624912f3b612ae435cf3e8000192a1b168b30205ed4a93b7fab7e336ad"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Parallax.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_6c2c84624912f3b612ae435cf3e8000192a1b168b30205ed4a93b7fab7e336ad"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110087,9 +110324,9 @@ rule ELASTIC_Windows_Trojan_Parallax_B4Ea4F1A : FILE MEMORY
 		date = "2022-09-08"
 		modified = "2022-09-29"
 		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Parallax.yar#L24-L55"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "731fe7bd339ec6b0372b4809004a21f53537bd82f084960b8d018f994dcdc06a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Parallax.yar#L24-L55"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_731fe7bd339ec6b0372b4809004a21f53537bd82f084960b8d018f994dcdc06a"
 		score = 75
 		quality = 42
 		tags = "FILE, MEMORY"
@@ -110117,7 +110354,7 @@ rule ELASTIC_Windows_Trojan_Parallax_B4Ea4F1A : FILE MEMORY
 		$parallax_payload_strings_13 = ".FileExists" ascii wide fullword
 
 	condition:
-		7 of ($parallax_payload_strings_*)
+		7 of ( $parallax_payload_strings_* )
 }
 rule ELASTIC_Linux_Ransomware_Hellokitty_35731270 : FILE MEMORY
 {
@@ -110128,10 +110365,10 @@ rule ELASTIC_Linux_Ransomware_Hellokitty_35731270 : FILE MEMORY
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Ransomware_Hellokitty.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Ransomware_Hellokitty.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed"
-		logic_hash = "40cb632d6b8561de56f2010a082a24b0c50d4cabed21e073168b5302ddff7044"
+		logic_hash = "v1_sha256_40cb632d6b8561de56f2010a082a24b0c50d4cabed21e073168b5302ddff7044"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110159,10 +110396,10 @@ rule ELASTIC_Windows_Packer_Scrubcrypt_6A75A4Bb : FILE MEMORY
 		date = "2023-04-18"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Packer_ScrubCrypt.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Packer_ScrubCrypt.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "05c1eea2ff8c31aa5baf1dfd8015988f7e737753275ed1c8c29013a3a7414b50"
-		logic_hash = "edcaa6f1cc85ef084ae5bf2524f39869a90b008dce85e72bca4835565f067ca7"
+		logic_hash = "v1_sha256_edcaa6f1cc85ef084ae5bf2524f39869a90b008dce85e72bca4835565f067ca7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110189,10 +110426,10 @@ rule ELASTIC_Windows_Trojan_Clipbanker_7Efaef9F : FILE MEMORY
 		date = "2022-02-28"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Clipbanker.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Clipbanker.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "02b06acb113c31f5a2ac9c99f9614e0fab0f78afc5ae872e46bae139c2c9b1f6"
-		logic_hash = "fa547d7c1623b332ef306672dd2293b44016d9974c1a3ec4b15e5ae0483ff879"
+		logic_hash = "v1_sha256_fa547d7c1623b332ef306672dd2293b44016d9974c1a3ec4b15e5ae0483ff879"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110222,10 +110459,10 @@ rule ELASTIC_Windows_Trojan_Clipbanker_B60A50B8 : FILE MEMORY
 		date = "2022-02-28"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Clipbanker.yar#L25-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Clipbanker.yar#L25-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "02b06acb113c31f5a2ac9c99f9614e0fab0f78afc5ae872e46bae139c2c9b1f6"
-		logic_hash = "fe585ab7efbc3b500ea23d1c164bc79ded658001e53fc71721e435ed7579182a"
+		logic_hash = "v1_sha256_fe585ab7efbc3b500ea23d1c164bc79ded658001e53fc71721e435ed7579182a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110251,10 +110488,10 @@ rule ELASTIC_Windows_Trojan_Clipbanker_F9F9E79D : FILE MEMORY
 		date = "2022-04-23"
 		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Clipbanker.yar#L45-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Clipbanker.yar#L45-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c"
-		logic_hash = "a71d75719133e8b84956ec002cb31f82386ef711fa2af79d204d176492cd354b"
+		logic_hash = "v1_sha256_a71d75719133e8b84956ec002cb31f82386ef711fa2af79d204d176492cd354b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110280,10 +110517,10 @@ rule ELASTIC_Windows_Trojan_Clipbanker_787B130B : FILE MEMORY
 		date = "2022-04-24"
 		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Clipbanker.yar#L65-L87"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Clipbanker.yar#L65-L87"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c"
-		logic_hash = "88783bde7014853f6556c6e7ee2dfd5cd5fcbfb4523ed158b4287e2bfba409f1"
+		logic_hash = "v1_sha256_88783bde7014853f6556c6e7ee2dfd5cd5fcbfb4523ed158b4287e2bfba409f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110313,10 +110550,10 @@ rule ELASTIC_Windows_Trojan_Revengerat_Db91Bcc6 : FILE MEMORY
 		date = "2021-09-02"
 		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Revengerat.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Revengerat.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd"
-		logic_hash = "1e33cb1d614aae0b2181ebaca694c69e7fc849b3a3b7ffff7059e8c43553f8cc"
+		logic_hash = "v1_sha256_1e33cb1d614aae0b2181ebaca694c69e7fc849b3a3b7ffff7059e8c43553f8cc"
 		score = 75
 		quality = 50
 		tags = "FILE, MEMORY"
@@ -110345,10 +110582,10 @@ rule ELASTIC_Linux_Cryptominer_Flystudio_579A3A4D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Flystudio.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Flystudio.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "84afc47554cf42e76ef8d28f2d29c28f3d35c2876cec2fb1581b0ac7cfe719dd"
-		logic_hash = "6579630a4fb6cf5bc8ccb2e4f93f5d549baa6ea9b742b2ee83a52f07352c4741"
+		logic_hash = "v1_sha256_6579630a4fb6cf5bc8ccb2e4f93f5d549baa6ea9b742b2ee83a52f07352c4741"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110374,9 +110611,9 @@ rule ELASTIC_Linux_Cryptominer_Flystudio_0A370634 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Flystudio.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "cf924ba45a7dba19fe571bb9da8c4896690c3ad02f732b759a10174b9f61883f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Flystudio.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_cf924ba45a7dba19fe571bb9da8c4896690c3ad02f732b759a10174b9f61883f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110402,10 +110639,10 @@ rule ELASTIC_Linux_Hacktool_Exploitscan_4327F817 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Exploitscan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Exploitscan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "66c6d0e58916d863a1a973b4f5cb7d691fbd01d26b408dbc8c74f0f1e4088dfb"
-		logic_hash = "7797d9bd75dff355e1ee84b856e77cf9e886dfe727fb8ce7a6fdbe5ed1eb0985"
+		logic_hash = "v1_sha256_7797d9bd75dff355e1ee84b856e77cf9e886dfe727fb8ce7a6fdbe5ed1eb0985"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110431,10 +110668,10 @@ rule ELASTIC_Linux_Backdoor_Tinyshell_67Ee6Fae : FILE MEMORY
 		date = "2021-10-12"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Backdoor_Tinyshell.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Backdoor_Tinyshell.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9d2e25ec0208a55fba97ac70b23d3d3753e9b906b4546d1b14d8c92f8d8eb03d"
-		logic_hash = "200d4267e21b8934deecc48273294f2e34464fcb412e39f3f5a006278631b9f1"
+		logic_hash = "v1_sha256_200d4267e21b8934deecc48273294f2e34464fcb412e39f3f5a006278631b9f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110452,7 +110689,7 @@ rule ELASTIC_Linux_Backdoor_Tinyshell_67Ee6Fae : FILE MEMORY
 		$b2 = "<hostname|cb> get <source-file> <dest-dir>" fullword
 
 	condition:
-		( all of ($a*)) or ( all of ($b*))
+		( all of ( $a* ) ) or ( all of ( $b* ) )
 }
 rule ELASTIC_Linux_Exploit_CVE_2022_0847_E831C285 : FILE MEMORY CVE_2022_0847
 {
@@ -110463,10 +110700,10 @@ rule ELASTIC_Linux_Exploit_CVE_2022_0847_E831C285 : FILE MEMORY CVE_2022_0847
 		date = "2022-03-10"
 		modified = "2022-03-14"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_CVE_2022_0847.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_CVE_2022_0847.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c6b2cef2f2bc04e3ae33e0d368eb39eb5ea38d1bca390df47f7096117c1aecca"
-		logic_hash = "e15daf5de9bf66060e373a6e772669eade543ed56bef6b6924a0ee44e59522e1"
+		logic_hash = "v1_sha256_e15daf5de9bf66060e373a6e772669eade543ed56bef6b6924a0ee44e59522e1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY, CVE-2022-0847"
@@ -110489,7 +110726,7 @@ rule ELASTIC_Linux_Exploit_CVE_2022_0847_E831C285 : FILE MEMORY CVE_2022_0847
 		$bs2 = { B8 00 10 00 00 81 7D F0 00 10 00 00 0F 46 45 F0 89 45 F8 8B 55 F8 48 8B 45 D8 8B 00 48 }
 
 	condition:
-		($pp and 2 of ($s*)) or ( all of ($bs*))
+		($pp and 2 of ( $s* ) ) or ( all of ( $bs* ) )
 }
 rule ELASTIC_Windows_Vulndriver_Atillk_18316Dd9 : FILE
 {
@@ -110500,10 +110737,10 @@ rule ELASTIC_Windows_Vulndriver_Atillk_18316Dd9 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Atillk.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Atillk.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173"
-		logic_hash = "02d218d0a0ea447e4ad0b03bff50c307ca5f36b8ed268787cd73c88a05aa4214"
+		logic_hash = "v1_sha256_02d218d0a0ea447e4ad0b03bff50c307ca5f36b8ed268787cd73c88a05aa4214"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -110520,7 +110757,7 @@ rule ELASTIC_Windows_Vulndriver_Atillk_18316Dd9 : FILE
 		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x0b][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x09][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0a][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0b][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x08][\x00-\x00]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $original_file_name and $version
 }
 rule ELASTIC_Linux_Trojan_Patpooty_E2E0Dff1 : FILE MEMORY
 {
@@ -110531,10 +110768,10 @@ rule ELASTIC_Linux_Trojan_Patpooty_E2E0Dff1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Patpooty.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Patpooty.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d38b9e76cbc863f69b29fc47262ceafd26ac476b0ae6283d3fa50985f93bedf3"
-		logic_hash = "ec7d12296383ca0ed20e3221fb96b9dbdaf6cc7f07f5c8383e43489a9fd6fcfe"
+		logic_hash = "v1_sha256_ec7d12296383ca0ed20e3221fb96b9dbdaf6cc7f07f5c8383e43489a9fd6fcfe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110560,10 +110797,10 @@ rule ELASTIC_Linux_Trojan_Patpooty_F90C7E43 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Patpooty.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Patpooty.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "79475a66be8741d9884bc60f593c81a44bdb212592cd1a7b6130166a724cb3d3"
-		logic_hash = "2d995722b06ce51a5378e395896764421f84afcf6b13855a87ed43d9b9e38982"
+		logic_hash = "v1_sha256_2d995722b06ce51a5378e395896764421f84afcf6b13855a87ed43d9b9e38982"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110589,10 +110826,10 @@ rule ELASTIC_Multi_Ransomware_Ransomhub_4A8A07Cd : FILE MEMORY
 		date = "2024-09-05"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Multi_Ransomware_RansomHub.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Multi_Ransomware_RansomHub.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bfbbba7d18be1aa2e85390fa69a761302756ee9348b7343af6f42f3b5d0a939c"
-		logic_hash = "8e2d062e890cf66418c18ce8988c0ac4744c9f00fdc296e8dd91df39ec240abe"
+		logic_hash = "v1_sha256_8e2d062e890cf66418c18ce8988c0ac4744c9f00fdc296e8dd91df39ec240abe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110625,9 +110862,9 @@ rule ELASTIC_Windows_Trojan_Bruteratel_1916686D : FILE MEMORY
 		date = "2022-06-23"
 		modified = "2022-12-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BruteRatel.yar#L1-L31"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "e0e7b8ba2865fc76845b21aa3e075ceab98888635a60bd722c0c81e0f4fcf58c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BruteRatel.yar#L1-L31"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_e0e7b8ba2865fc76845b21aa3e075ceab98888635a60bd722c0c81e0f4fcf58c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110655,7 +110892,7 @@ rule ELASTIC_Windows_Trojan_Bruteratel_1916686D : FILE MEMORY
 		$b1 = { 48 83 EC ?? 48 8D 35 ?? ?? ?? ?? 4C 63 E2 31 D2 48 8D 7C 24 ?? 48 89 CB 4D 89 E0 4C 89 E5 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A4 31 F6 BF ?? ?? ?? ?? 39 F5 7E ?? E8 ?? ?? ?? ?? 99 F7 FF 48 63 D2 8A 44 14 ?? 88 04 33 48 FF C6 EB ?? }
 
 	condition:
-		4 of ($a*) or 1 of ($b*)
+		4 of ( $a* ) or 1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Bruteratel_9B267F96 : FILE MEMORY
 {
@@ -110666,9 +110903,9 @@ rule ELASTIC_Windows_Trojan_Bruteratel_9B267F96 : FILE MEMORY
 		date = "2022-06-23"
 		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BruteRatel.yar#L33-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "fbaaf4bf2462119b39a5df90b91fb831be3e602b926cd893374a5dddf48f029d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BruteRatel.yar#L33-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_fbaaf4bf2462119b39a5df90b91fb831be3e602b926cd893374a5dddf48f029d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110690,7 +110927,7 @@ rule ELASTIC_Windows_Trojan_Bruteratel_9B267F96 : FILE MEMORY
 		$b1 = { 50 48 B8 E2 6A 15 64 56 22 0D 7E 50 48 B8 18 2C 05 7F BB 78 D7 27 50 48 B8 C9 EC BC 3D 84 54 9A 62 50 48 B8 A1 E1 3C 4E AF 2B F6 B1 50 48 B8 2E E6 7B A0 94 CA 9D F0 50 48 B8 61 52 80 AA 1A B6 4B 0E 50 48 B8 B2 13 11 5A 28 81 ED 60 50 48 B8 20 DE A9 34 89 08 C8 32 50 48 B8 9B DC C1 FF 79 CE 5B F5 50 48 B8 FD 57 3F 4C C7 D3 7A 21 50 48 B8 70 B8 63 0F AB 19 BF 1C 50 48 B8 48 F2 1B 72 1E 2A C6 8A 50 48 B8 E3 FA 38 E9 1D 76 E0 6F 50 48 B8 97 AD 75 }
 
 	condition:
-		3 of ($a*) or 1 of ($b*)
+		3 of ( $a* ) or 1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Bruteratel_684A39F2 : FILE MEMORY
 {
@@ -110701,10 +110938,10 @@ rule ELASTIC_Windows_Trojan_Bruteratel_684A39F2 : FILE MEMORY
 		date = "2023-01-24"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BruteRatel.yar#L59-L84"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BruteRatel.yar#L59-L84"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5f4782a34368bb661f413f33e2d1fb9f237b7f9637f2c0c21dc752316b02350c"
-		logic_hash = "7cb74176e1dbdd248295649568d29c9d88841fcd0c16479b6b7efc71c4a1d706"
+		logic_hash = "v1_sha256_7cb74176e1dbdd248295649568d29c9d88841fcd0c16479b6b7efc71c4a1d706"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110726,7 +110963,7 @@ rule ELASTIC_Windows_Trojan_Bruteratel_684A39F2 : FILE MEMORY
 		$cfg4 = { 22 00 7D 00 2C 00 22 00 6D 00 74 00 64 00 74 00 22 00 3A 00 7B 00 22 00 68 00 5F 00 6E 00 61 00 6D 00 65 00 22 00 3A 00 22 00 }
 
 	condition:
-		any of ($seq*) and all of ($cfg*)
+		any of ( $seq* ) and all of ( $cfg* )
 }
 rule ELASTIC_Windows_Trojan_Bruteratel_Ade6C9D5 : FILE MEMORY
 {
@@ -110737,10 +110974,10 @@ rule ELASTIC_Windows_Trojan_Bruteratel_Ade6C9D5 : FILE MEMORY
 		date = "2023-01-24"
 		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BruteRatel.yar#L86-L109"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BruteRatel.yar#L86-L109"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dc9757c9aa3aff76d86f9f23a3d20a817e48ca3d7294307cc67477177af5c0d4"
-		logic_hash = "8ff8ed1e2b909606fe6aae3f43ad02898d7b3906c3d329a508f6d40490ec75a0"
+		logic_hash = "v1_sha256_8ff8ed1e2b909606fe6aae3f43ad02898d7b3906c3d329a508f6d40490ec75a0"
 		score = 60
 		quality = 45
 		tags = "FILE, MEMORY"
@@ -110771,10 +111008,10 @@ rule ELASTIC_Windows_Trojan_Bruteratel_4110D879 : FILE MEMORY
 		date = "2023-05-10"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BruteRatel.yar#L111-L130"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BruteRatel.yar#L111-L130"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e0fbbc548fdb9da83a72ddc1040463e37ab6b8b544bf0d2b206bfff352175afe"
-		logic_hash = "22c27523ddd8183c41da40f7ff908ae5bdee3b482c8a3f70aaa63a4c419e515b"
+		logic_hash = "v1_sha256_22c27523ddd8183c41da40f7ff908ae5bdee3b482c8a3f70aaa63a4c419e515b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110801,10 +111038,10 @@ rule ELASTIC_Windows_Trojan_Bruteratel_5B12Cbab : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BruteRatel.yar#L132-L150"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BruteRatel.yar#L132-L150"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8165798fec8294523f25aedfc6699faad0c5d75f60bc7cefcbb2fa13dbc656e3"
-		logic_hash = "b86296dafaef1dfa0a41704cafa351694abb0e453e104dfe06836ed599338f38"
+		logic_hash = "v1_sha256_b86296dafaef1dfa0a41704cafa351694abb0e453e104dfe06836ed599338f38"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110830,10 +111067,10 @@ rule ELASTIC_Windows_Trojan_Bruteratel_5E383Ae0 : FILE MEMORY
 		date = "2024-03-27"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BruteRatel.yar#L152-L184"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BruteRatel.yar#L152-L184"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "0b506ef32f58ee2b1e5701ca8e13c67584739ab1d00ee4a0c2f532c09a15836f"
-		logic_hash = "5d87ada1c609e23742c389f8153a9266c4db95be4a5e10b50979aebc993a45e0"
+		logic_hash = "v1_sha256_5d87ada1c609e23742c389f8153a9266c4db95be4a5e10b50979aebc993a45e0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110862,7 +111099,7 @@ rule ELASTIC_Windows_Trojan_Bruteratel_5E383Ae0 : FILE MEMORY
 		$b4 = "__imp_NETAPI32$"
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		1 of ( $a* ) and 1 of ( $b* )
 }
 rule ELASTIC_Windows_Trojan_Bruteratel_644Ac114 : FILE MEMORY
 {
@@ -110873,10 +111110,10 @@ rule ELASTIC_Windows_Trojan_Bruteratel_644Ac114 : FILE MEMORY
 		date = "2024-04-17"
 		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_BruteRatel.yar#L186-L205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_BruteRatel.yar#L186-L205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ace6a99d95ef859d4ab74db6900753e754273a12a34721f1aa8f1a9df3d8ec35"
-		logic_hash = "06ffea16a0348f2276f379db150b5f9d2dbdffbcb2eee83c55c27c837ecb1e69"
+		logic_hash = "v1_sha256_06ffea16a0348f2276f379db150b5f9d2dbdffbcb2eee83c55c27c837ecb1e69"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110903,10 +111140,10 @@ rule ELASTIC_Windows_Ransomware_Avoslocker_7Ae4D4F2 : FILE MEMORY
 		date = "2021-07-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Avoslocker.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Avoslocker.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856"
-		logic_hash = "c87faf6f128fd6a8cabd68ec8de72fb10e6be42bdbe23ece374dd8f3cf0c1b15"
+		logic_hash = "v1_sha256_c87faf6f128fd6a8cabd68ec8de72fb10e6be42bdbe23ece374dd8f3cf0c1b15"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110936,10 +111173,10 @@ rule ELASTIC_Windows_Trojan_Kronos_Cdd2E2C5 : FILE MEMORY
 		date = "2021-02-07"
 		modified = "2021-08-23"
 		reference = "https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Kronos.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Kronos.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "baa9cedbbe0f5689be8f8028a6537c39e9ea8b0815ad76cb98f365ca5a41653f"
-		logic_hash = "a8943c5ef166446629cb46517d35db39c97a1e3efa3a7a0b5cb3d3ee9d1e6e9c"
+		logic_hash = "v1_sha256_a8943c5ef166446629cb46517d35db39c97a1e3efa3a7a0b5cb3d3ee9d1e6e9c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -110972,10 +111209,10 @@ rule ELASTIC_Windows_Vulndriver_Winio_C9Cc6D00 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_WinIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_WinIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf"
-		logic_hash = "4b6a78c2c807cf1f569ae9bc275d42d9c895efba7a2d64fec0652e3cb163d553"
+		logic_hash = "v1_sha256_4b6a78c2c807cf1f569ae9bc275d42d9c895efba7a2d64fec0652e3cb163d553"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -110990,7 +111227,7 @@ rule ELASTIC_Windows_Vulndriver_Winio_C9Cc6D00 : FILE
 		$str1 = "\\WinioSys.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Vulndriver_Winio_B0F21A70 : FILE
 {
@@ -111001,10 +111238,10 @@ rule ELASTIC_Windows_Vulndriver_Winio_B0F21A70 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_WinIo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_WinIo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374"
-		logic_hash = "c82d95e805898f9a9a1ffccb483e506df0a53dc420068314e7c724e4947f3572"
+		logic_hash = "v1_sha256_c82d95e805898f9a9a1ffccb483e506df0a53dc420068314e7c724e4947f3572"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -111019,7 +111256,7 @@ rule ELASTIC_Windows_Vulndriver_Winio_B0F21A70 : FILE
 		$str1 = "IOCTL_WINIO_WRITEMSR"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Ransomware_Mountlocker_126A76E2 : FILE MEMORY
 {
@@ -111030,10 +111267,10 @@ rule ELASTIC_Windows_Ransomware_Mountlocker_126A76E2 : FILE MEMORY
 		date = "2021-06-10"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Mountlocker.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Mountlocker.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1"
-		logic_hash = "5a5e157a245a75033abbe6bc7aa66fe6af6d91dc30abe1fdadce85f8f3905b1e"
+		logic_hash = "v1_sha256_5a5e157a245a75033abbe6bc7aa66fe6af6d91dc30abe1fdadce85f8f3905b1e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111063,10 +111300,10 @@ rule ELASTIC_Linux_Cryptominer_Roboto_0B6807F8 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Roboto.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Roboto.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "c2542e399f865b5c490ee66b882f5ff246786b3f004abb7489ec433c11007dda"
-		logic_hash = "d945c7a23b9f435851f3c998231da615e220c259051cf213186c28f3279be1dd"
+		logic_hash = "v1_sha256_d945c7a23b9f435851f3c998231da615e220c259051cf213186c28f3279be1dd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111092,10 +111329,10 @@ rule ELASTIC_Linux_Cryptominer_Roboto_1F1Cfe9A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Roboto.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Roboto.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "497a6d426ff93d5cd18cea623074fb209d4f407a02ef8f382f089f1ed3f108c5"
-		logic_hash = "2171284991b0019379c8d271013a35237c37bc2e13d807caed86f8fb9d2ba418"
+		logic_hash = "v1_sha256_2171284991b0019379c8d271013a35237c37bc2e13d807caed86f8fb9d2ba418"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111121,10 +111358,10 @@ rule ELASTIC_Windows_Vulndriver_Zam_928812A7 : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Zam.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Zam.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
-		logic_hash = "82ca874d60d8a0ee04aca39f59415f22797e7e0337314c88dd8ebad1a823d200"
+		logic_hash = "v1_sha256_82ca874d60d8a0ee04aca39f59415f22797e7e0337314c88dd8ebad1a823d200"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -111140,7 +111377,7 @@ rule ELASTIC_Windows_Vulndriver_Zam_928812A7 : FILE
 		$pdb_32 = "AntiMalware\\bin\\zam32.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and any of ($pdb_*)
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and any of ( $pdb_* )
 }
 rule ELASTIC_Windows_Vulndriver_Zam_7C86D260 : FILE MEMORY
 {
@@ -111151,10 +111388,10 @@ rule ELASTIC_Windows_Vulndriver_Zam_7C86D260 : FILE MEMORY
 		date = "2024-07-16"
 		modified = "2024-09-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Zam.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Zam.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c"
-		logic_hash = "cc29f26c222825eb5262d91065a00243bc913fe2071d8ad6b0dc61dd22798f1e"
+		logic_hash = "v1_sha256_cc29f26c222825eb5262d91065a00243bc913fe2071d8ad6b0dc61dd22798f1e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111171,7 +111408,7 @@ rule ELASTIC_Windows_Vulndriver_Zam_7C86D260 : FILE MEMORY
 		$s1 = "Advanced Malware Protection" wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $original_file_name and $version and $s1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and int16 ( uint32( 0x3C ) + 0x18 ) == 0x020b and $original_file_name and $version and $s1
 }
 rule ELASTIC_Linux_Trojan_Bpfdoor_59E029C3 : FILE MEMORY
 {
@@ -111182,10 +111419,10 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_59E029C3 : FILE MEMORY
 		date = "2022-05-10"
 		modified = "2022-05-10"
 		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_BPFDoor.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_BPFDoor.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
-		logic_hash = "64620a3404b331855d0b8018c1626c88cb28380785beac1a391613ae8dc1b1bf"
+		logic_hash = "v1_sha256_64620a3404b331855d0b8018c1626c88cb28380785beac1a391613ae8dc1b1bf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111215,10 +111452,10 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_0F768F60 : FILE MEMORY
 		date = "2022-05-10"
 		modified = "2022-05-10"
 		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_BPFDoor.yar#L26-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_BPFDoor.yar#L26-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3a1b174f0c19c28f71e1babde01982c56d38d3672ea14d47c35ae3062e49b155"
-		logic_hash = "1aaa74c2d8fbb230cbfc0e08fd6865b5f7e90e4abcdb97121e52afb7569b2dbc"
+		logic_hash = "v1_sha256_1aaa74c2d8fbb230cbfc0e08fd6865b5f7e90e4abcdb97121e52afb7569b2dbc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111249,10 +111486,10 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_8453771B : FILE MEMORY
 		date = "2022-05-10"
 		modified = "2022-05-10"
 		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_BPFDoor.yar#L52-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_BPFDoor.yar#L52-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
-		logic_hash = "546e5c56ceb6b99db14dc225a2ec4872cb54859a0f2f6ad520d4f446793e031e"
+		logic_hash = "v1_sha256_546e5c56ceb6b99db14dc225a2ec4872cb54859a0f2f6ad520d4f446793e031e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111285,10 +111522,10 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_F690Fe3B : FILE MEMORY
 		date = "2022-05-10"
 		modified = "2022-05-10"
 		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_BPFDoor.yar#L80-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_BPFDoor.yar#L80-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
-		logic_hash = "35c6be75348a30f415a1a4bb94ae7e3a2f49f54a0fb3ddc4bae1aa3e03c1a909"
+		logic_hash = "v1_sha256_35c6be75348a30f415a1a4bb94ae7e3a2f49f54a0fb3ddc4bae1aa3e03c1a909"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111314,10 +111551,10 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_1A7D804B : FILE MEMORY
 		date = "2022-05-10"
 		modified = "2022-05-10"
 		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_BPFDoor.yar#L101-L127"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_BPFDoor.yar#L101-L127"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
-		logic_hash = "b0c4b168d92947e599e8c74d0ae6a91766c8a034c34e9c07e2472620c9b61037"
+		logic_hash = "v1_sha256_b0c4b168d92947e599e8c74d0ae6a91766c8a034c34e9c07e2472620c9b61037"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111339,7 +111576,7 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_1A7D804B : FILE MEMORY
 		$b1 = { D0 48 89 45 F8 48 8B 45 F8 0F B6 40 0C C0 E8 04 0F B6 C0 C1 }
 
 	condition:
-		all of ($a*) or 1 of ($b*)
+		all of ( $a* ) or 1 of ( $b* )
 }
 rule ELASTIC_Linux_Trojan_Bpfdoor_E14B0B79 : FILE MEMORY
 {
@@ -111350,10 +111587,10 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_E14B0B79 : FILE MEMORY
 		date = "2022-05-10"
 		modified = "2022-05-10"
 		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_BPFDoor.yar#L129-L152"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_BPFDoor.yar#L129-L152"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dc8346bf443b7b453f062740d8ae8d8d7ce879672810f4296158f90359dcae3a"
-		logic_hash = "7cdf111ae253bffef7243ad3722f1a79f81f45d80f938f9542af8e056f75d3fc"
+		logic_hash = "v1_sha256_7cdf111ae253bffef7243ad3722f1a79f81f45d80f938f9542af8e056f75d3fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111383,10 +111620,10 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_F1Cd26Ad : FILE MEMORY
 		date = "2023-05-11"
 		modified = "2023-05-16"
 		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_BPFDoor.yar#L154-L175"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_BPFDoor.yar#L154-L175"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
-		logic_hash = "ad3e130d5a1203c55b5c8d369c7d9989f66f76c9bd57e2314a30f4c931e4b98d"
+		logic_hash = "v1_sha256_ad3e130d5a1203c55b5c8d369c7d9989f66f76c9bd57e2314a30f4c931e4b98d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111403,7 +111640,7 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_F1Cd26Ad : FILE MEMORY
 		$signals_setup = { BE 01 00 00 00 BF 02 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 01 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 03 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 0D 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 16 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 15 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 11 00 00 00 ?? ?? ?? ?? ?? BF 0A 00 00 00 }
 
 	condition:
-		($magic_bytes_check and $seq_binary) or $signals_setup
+		($magic_bytes_check and $seq_binary ) or $signals_setup
 }
 rule ELASTIC_Linux_Trojan_Bish_974B4B47 : FILE MEMORY
 {
@@ -111414,10 +111651,10 @@ rule ELASTIC_Linux_Trojan_Bish_974B4B47 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Bish.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Bish.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9171fd2bbe182f0a3cd35937f3ee0076c9358f52f5bc047498dd9e233ae11757"
-		logic_hash = "c5a7d036c89fe50626da51486d19ee731ad28cbc8d36def075d8f33a7b68961f"
+		logic_hash = "v1_sha256_c5a7d036c89fe50626da51486d19ee731ad28cbc8d36def075d8f33a7b68961f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111443,10 +111680,10 @@ rule ELASTIC_Windows_Vulndriver_Eneio_6E01882F : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_EneIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_EneIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347"
-		logic_hash = "144ac5375cb637b6301a2275f2412fbd0d0c5fb23105c7cce5aa7912cf68fa2c"
+		logic_hash = "v1_sha256_144ac5375cb637b6301a2275f2412fbd0d0c5fb23105c7cce5aa7912cf68fa2c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -111461,7 +111698,7 @@ rule ELASTIC_Windows_Vulndriver_Eneio_6E01882F : FILE
 		$str1 = "\\Release\\EneIo.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Linux_Trojan_Sysrv_85097F24 : FILE MEMORY
 {
@@ -111472,9 +111709,9 @@ rule ELASTIC_Linux_Trojan_Sysrv_85097F24 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "17fbc8e10dea69b29093fcf2aa018be4d58fe5462c5a0363a0adde60f448fb26"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Sysrv.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "96bee8b9b0e9c2afd684582301f9e110fd08fcabaea798bfb6259a4216f69be1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Sysrv.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_96bee8b9b0e9c2afd684582301f9e110fd08fcabaea798bfb6259a4216f69be1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111500,10 +111737,10 @@ rule ELASTIC_Linux_Trojan_Mech_D30Ec0A0 : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mech.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mech.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "710d1a0a8c7eecc6d793933c8a97cec66d284b3687efee7655a2dc31d15c0593"
-		logic_hash = "268aeb25d6468412d8123bab5eb2c8bd7704828d0ef3c3d771aa036e374127d7"
+		logic_hash = "v1_sha256_268aeb25d6468412d8123bab5eb2c8bd7704828d0ef3c3d771aa036e374127d7"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -111529,10 +111766,10 @@ rule ELASTIC_Linux_Trojan_Godropper_Bae099Bd : FILE MEMORY
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Godropper.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Godropper.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "704643f3fd11cda1d52260285bf2a03bccafe59cfba4466427646c1baf93881e"
-		logic_hash = "ef6274928f7cfc0312122ac3e4153fb0a78dc7d5fb2d68db6cbe4974f5497210"
+		logic_hash = "v1_sha256_ef6274928f7cfc0312122ac3e4153fb0a78dc7d5fb2d68db6cbe4974f5497210"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111558,10 +111795,10 @@ rule ELASTIC_Windows_Trojan_Emotet_18379A8D : FILE MEMORY
 		date = "2021-11-17"
 		modified = "2022-01-13"
 		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Emotet.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Emotet.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827"
-		logic_hash = "2ad72ce2a352b91a4fa597ee9e796035298cfcee6fdc13dd3f64579d8da96b97"
+		logic_hash = "v1_sha256_2ad72ce2a352b91a4fa597ee9e796035298cfcee6fdc13dd3f64579d8da96b97"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111587,10 +111824,10 @@ rule ELASTIC_Windows_Trojan_Emotet_5528B3B0 : FILE MEMORY
 		date = "2021-11-17"
 		modified = "2022-01-13"
 		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Emotet.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Emotet.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827"
-		logic_hash = "bb784ab0e064bafa8450b6bb15ef534af38254ea3c096807571c2c27f7cdfd76"
+		logic_hash = "v1_sha256_bb784ab0e064bafa8450b6bb15ef534af38254ea3c096807571c2c27f7cdfd76"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111616,10 +111853,10 @@ rule ELASTIC_Windows_Trojan_Emotet_1943Bbf2 : FILE MEMORY
 		date = "2021-11-18"
 		modified = "2022-01-13"
 		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Emotet.yar#L43-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Emotet.yar#L43-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38"
-		logic_hash = "41838e335b9314b8759922f23ec8709f46e6a26633f3685ac98ada5828191d35"
+		logic_hash = "v1_sha256_41838e335b9314b8759922f23ec8709f46e6a26633f3685ac98ada5828191d35"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111645,10 +111882,10 @@ rule ELASTIC_Windows_Trojan_Emotet_Db7D33Fa : FILE MEMORY
 		date = "2022-05-09"
 		modified = "2022-06-09"
 		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Emotet.yar#L64-L90"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Emotet.yar#L64-L90"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc"
-		logic_hash = "e220c112c15f384fde6fc2286b01c7eb9bedcf4817d02645d0fa7afb05e7b593"
+		logic_hash = "v1_sha256_e220c112c15f384fde6fc2286b01c7eb9bedcf4817d02645d0fa7afb05e7b593"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111681,10 +111918,10 @@ rule ELASTIC_Windows_Trojan_Emotet_D6Ac1Ea4 : FILE MEMORY
 		date = "2022-05-24"
 		modified = "2022-06-09"
 		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Emotet.yar#L92-L114"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Emotet.yar#L92-L114"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71"
-		logic_hash = "9b37940ea8752c6db52d4f09225de0389438c41468a11a7cda8f28b191192ef9"
+		logic_hash = "v1_sha256_9b37940ea8752c6db52d4f09225de0389438c41468a11a7cda8f28b191192ef9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111702,7 +111939,7 @@ rule ELASTIC_Windows_Trojan_Emotet_D6Ac1Ea4 : FILE MEMORY
 		$post = { 8B 44 24 ?? 89 44 24 ?? 48 83 C4 18 C3 }
 
 	condition:
-		#calc1>=10 and #pre>=5 and #setup>=5 and #post>=5
+		#calc1>= 10 and #pre >= 5 and #setup >= 5 and #post >= 5
 }
 rule ELASTIC_Windows_Trojan_Emotet_77C667B9 : FILE MEMORY
 {
@@ -111713,10 +111950,10 @@ rule ELASTIC_Windows_Trojan_Emotet_77C667B9 : FILE MEMORY
 		date = "2022-11-07"
 		modified = "2022-12-20"
 		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Emotet.yar#L116-L144"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Emotet.yar#L116-L144"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ffac0120c3ae022b807559e8ed7902fde0fa5f7cb9c5c8d612754fa498288572"
-		logic_hash = "f11769fe5e9789b451e8826c5fd22bde5b3eb9f7af1d5fec7eec71700fc1f482"
+		logic_hash = "v1_sha256_f11769fe5e9789b451e8826c5fd22bde5b3eb9f7af1d5fec7eec71700fc1f482"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111740,7 +111977,7 @@ rule ELASTIC_Windows_Trojan_Emotet_77C667B9 : FILE MEMORY
 		$key_1 = { 45 33 C9 4C 8B D0 48 85 C0 74 ?? 48 8D ?? ?? 4C 8B ?? 48 8B ?? 48 2B ?? 48 83 ?? ?? 48 C1 ?? ?? 48 3B ?? 49 0F 47 ?? 48 85 ?? 74 ?? 48 2B D8 42 8B 04 03 }
 
 	condition:
-		(1 of ($string_*)) and (($key_1 or (1 of ($c2_list*))) or (1 of ($c2_list*)))
+		(1 of ( $string_* ) ) and ( ( $key_1 or ( 1 of ( $c2_list* ) ) ) or ( 1 of ( $c2_list* ) ) )
 }
 rule ELASTIC_Windows_Trojan_Emotet_8B9449C1 : FILE MEMORY
 {
@@ -111751,10 +111988,10 @@ rule ELASTIC_Windows_Trojan_Emotet_8B9449C1 : FILE MEMORY
 		date = "2022-11-09"
 		modified = "2022-12-20"
 		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Emotet.yar#L146-L166"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Emotet.yar#L146-L166"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ffac0120c3ae022b807559e8ed7902fde0fa5f7cb9c5c8d612754fa498288572"
-		logic_hash = "5501354ebc1d97fe5ce894d5907adb29440f557f2dd235e1e983ae2d109199a2"
+		logic_hash = "v1_sha256_5501354ebc1d97fe5ce894d5907adb29440f557f2dd235e1e983ae2d109199a2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111781,10 +112018,10 @@ rule ELASTIC_Windows_Vulndriver_Amifldrv_E387D5Ad : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_VulnDriver_Amifldrv.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_VulnDriver_Amifldrv.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330"
-		logic_hash = "14d75b5aff2c82d69b041c654cdc0840f6b6e37a197f5c0c1c2698c9e8eba3e2"
+		logic_hash = "v1_sha256_14d75b5aff2c82d69b041c654cdc0840f6b6e37a197f5c0c1c2698c9e8eba3e2"
 		score = 60
 		quality = 55
 		tags = "FILE"
@@ -111799,7 +112036,7 @@ rule ELASTIC_Windows_Vulndriver_Amifldrv_E387D5Ad : FILE
 		$str1 = "\\amifldrv64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Hacktool_Gmer_8Aabdd5E : FILE
 {
@@ -111810,10 +112047,10 @@ rule ELASTIC_Windows_Hacktool_Gmer_8Aabdd5E : FILE
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Hacktool_Gmer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Hacktool_Gmer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
-		logic_hash = "acdab89a7703a743927cec60fbc84af2fd469403bee6f211c865fb96e9c92498"
+		logic_hash = "v1_sha256_acdab89a7703a743927cec60fbc84af2fd469403bee6f211c865fb96e9c92498"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -111828,7 +112065,7 @@ rule ELASTIC_Windows_Hacktool_Gmer_8Aabdd5E : FILE
 		$str1 = "\\gmer64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and $str1
 }
 rule ELASTIC_Windows_Ransomware_Ransomexx_Fabff49C : FILE MEMORY
 {
@@ -111839,10 +112076,10 @@ rule ELASTIC_Windows_Ransomware_Ransomexx_Fabff49C : FILE MEMORY
 		date = "2021-08-07"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Ransomware_Ransomexx.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Ransomware_Ransomexx.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "480af18104198ad3db1518501ee58f9c4aecd19dbbf2c5dd7694d1d87e9aeac7"
-		logic_hash = "67d5123b706685ea5ab939aec31cb1549297778d91dd38b14e109945c52da71a"
+		logic_hash = "v1_sha256_67d5123b706685ea5ab939aec31cb1549297778d91dd38b14e109945c52da71a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111871,9 +112108,9 @@ rule ELASTIC_Linux_Trojan_Rotajakiro_Fb24F399 : FILE MEMORY
 		date = "2021-06-28"
 		modified = "2021-09-16"
 		reference = "023a7f9ed082d9dd7be6eba5942bfa77f8e618c2d15a8bc384d85223c5b91a0c"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Rotajakiro.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
-		logic_hash = "be33fdda50ef0ea1a0cf45835cc2b7a805cecb3fff371ed6d93e01c2d477d867"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Rotajakiro.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
+		logic_hash = "v1_sha256_be33fdda50ef0ea1a0cf45835cc2b7a805cecb3fff371ed6d93e01c2d477d867"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111899,10 +112136,10 @@ rule ELASTIC_Windows_Trojan_Zloader_5Dd0A0Bf : FILE MEMORY
 		date = "2022-03-03"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Zloader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Zloader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
-		logic_hash = "1446a4147e1b06fa66907de857011079c55a8e6bf84276eb8518d33468ba1f83"
+		logic_hash = "v1_sha256_1446a4147e1b06fa66907de857011079c55a8e6bf84276eb8518d33468ba1f83"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111928,10 +112165,10 @@ rule ELASTIC_Windows_Trojan_Zloader_4Fe0F7F1 : FILE MEMORY
 		date = "2022-03-03"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Zloader.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Zloader.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
-		logic_hash = "b20fafc9db08c7668b49e18f45632594c3a69ec65fe865e79379c544fc424f8d"
+		logic_hash = "v1_sha256_b20fafc9db08c7668b49e18f45632594c3a69ec65fe865e79379c544fc424f8d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111957,10 +112194,10 @@ rule ELASTIC_Windows_Trojan_Zloader_363C65Ed : FILE MEMORY
 		date = "2022-03-03"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Zloader.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Zloader.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
-		logic_hash = "d3c530f9929db709067a9e1cc59b9cda9dcd8e19352c79ddaf7af6c91b242afd"
+		logic_hash = "v1_sha256_d3c530f9929db709067a9e1cc59b9cda9dcd8e19352c79ddaf7af6c91b242afd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -111986,10 +112223,10 @@ rule ELASTIC_Windows_Trojan_Zloader_79535191 : FILE MEMORY
 		date = "2022-03-03"
 		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Zloader.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Zloader.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
-		logic_hash = "c398a8ca46c6fe3e59481a092867be77a94809b1568cea918aa6450374063857"
+		logic_hash = "v1_sha256_c398a8ca46c6fe3e59481a092867be77a94809b1568cea918aa6450374063857"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112015,10 +112252,10 @@ rule ELASTIC_Linux_Cryptominer_Ccminer_18Fc60E5 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Ccminer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Ccminer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dbb403a00c75ef2a74b41b8b58d08a6749f37f922de6cc19127a8f244d901c60"
-		logic_hash = "75db45ccbeb558409ee9398065591472d4aee0382be5980adb9d0fb41e557789"
+		logic_hash = "v1_sha256_75db45ccbeb558409ee9398065591472d4aee0382be5980adb9d0fb41e557789"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112044,10 +112281,10 @@ rule ELASTIC_Linux_Cryptominer_Ccminer_3C593Bc3 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Cryptominer_Ccminer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Cryptominer_Ccminer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dbb403a00c75ef2a74b41b8b58d08a6749f37f922de6cc19127a8f244d901c60"
-		logic_hash = "94a0d33b474b3c60e926eaf06147eb0fdc56beac525f25326448bf2a5177d9c0"
+		logic_hash = "v1_sha256_94a0d33b474b3c60e926eaf06147eb0fdc56beac525f25326448bf2a5177d9c0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112073,10 +112310,10 @@ rule ELASTIC_Linux_Trojan_Mettle_E8Fdbcbd : FILE MEMORY
 		date = "2024-05-06"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mettle.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mettle.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "864eae4f27648b8a9d9b0eb1894169aa739311cdd02b1435a34881acf7059d58"
-		logic_hash = "d13c1e7fb815ebbefa78922e9b85a1ced015c03b8f1b2cf1885a9c483b8e0ab3"
+		logic_hash = "v1_sha256_d13c1e7fb815ebbefa78922e9b85a1ced015c03b8f1b2cf1885a9c483b8e0ab3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112095,7 +112332,7 @@ rule ELASTIC_Linux_Trojan_Mettle_E8Fdbcbd : FILE MEMORY
 		$mettle5 = "mettle_get_machine_id"
 
 	condition:
-		2 of ($mettle*)
+		2 of ( $mettle* )
 }
 rule ELASTIC_Linux_Trojan_Mettle_813B9B6C : FILE MEMORY
 {
@@ -112106,10 +112343,10 @@ rule ELASTIC_Linux_Trojan_Mettle_813B9B6C : FILE MEMORY
 		date = "2024-05-06"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mettle.yar#L25-L52"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mettle.yar#L25-L52"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "bb651d974ca3f349858db7b5a86f03a8d47d668294f27e709a823fa11e6963d7"
-		logic_hash = "a6a9cf424bf1ca7985e1c4b14123ed236208ffa3f7c9ffebbdd85765a90bfa54"
+		logic_hash = "v1_sha256_a6a9cf424bf1ca7985e1c4b14123ed236208ffa3f7c9ffebbdd85765a90bfa54"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112133,7 +112370,7 @@ rule ELASTIC_Linux_Trojan_Mettle_813B9B6C : FILE MEMORY
 		$func_c2_new_struct = { C7 46 14 00 00 00 00 C7 46 10 00 00 00 00 C7 46 18 00 00 00 00 8D 83 ?? ?? ?? ?? 89 46 20 C7 46 24 00 00 00 00 C7 46 28 00 00 00 00 C7 46 2C 00 00 00 00 C7 46 30 00 00 F0 3F 89 76 1C 83 EC 0C 56 E8 }
 
 	condition:
-		2 of ($process*) and 2 of ($file*) and 2 of ($func*)
+		2 of ( $process* ) and 2 of ( $file* ) and 2 of ( $func* )
 }
 rule ELASTIC_Linux_Trojan_Mettle_78Aead1C : FILE MEMORY
 {
@@ -112144,10 +112381,10 @@ rule ELASTIC_Linux_Trojan_Mettle_78Aead1C : FILE MEMORY
 		date = "2024-05-06"
 		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Trojan_Mettle.yar#L54-L81"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Trojan_Mettle.yar#L54-L81"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "864eae4f27648b8a9d9b0eb1894169aa739311cdd02b1435a34881acf7059d58"
-		logic_hash = "d68d37379b8a3a2d242030fd14884781488e9785823aa25fedfdd406748f8039"
+		logic_hash = "v1_sha256_d68d37379b8a3a2d242030fd14884781488e9785823aa25fedfdd406748f8039"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112171,7 +112408,7 @@ rule ELASTIC_Linux_Trojan_Mettle_78Aead1C : FILE MEMORY
 		$func_c2_new_struct = { 48 89 DF 48 C7 43 20 00 00 00 00 C7 43 28 00 00 00 00 48 C7 43 40 00 00 00 00 48 89 43 38 48 8B 05 D1 BE 09 00 48 89 5B 30 48 89 43 48 E8 }
 
 	condition:
-		2 of ($process*) and 2 of ($file*) and 2 of ($func*)
+		2 of ( $process* ) and 2 of ( $file* ) and 2 of ( $func* )
 }
 rule ELASTIC_Windows_Trojan_Grandoreiro_51236Ba2 : FILE MEMORY
 {
@@ -112182,10 +112419,10 @@ rule ELASTIC_Windows_Trojan_Grandoreiro_51236Ba2 : FILE MEMORY
 		date = "2022-08-23"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Windows_Trojan_Grandoreiro.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Windows_Trojan_Grandoreiro.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1bdf381e7080d9bed3f52f4b3db1991a80d3e58120a5790c3d1609617d1f439e"
-		logic_hash = "9a8549a1dd82f56458ea8aee5c30243ac073d15c820de28d78a58d2c067b10d6"
+		logic_hash = "v1_sha256_9a8549a1dd82f56458ea8aee5c30243ac073d15c820de28d78a58d2c067b10d6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112215,10 +112452,10 @@ rule ELASTIC_Linux_Exploit_Enoket_79B52A4C : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Enoket.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Enoket.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ae8f7e7df62316400d0c5fe0139d7a48c9f184e92706b552aad3d827d3dbbbf"
-		logic_hash = "204082a3be602b3f6aebb013a46e6f9c98b5dad2476350afa60c1954b13598fe"
+		logic_hash = "v1_sha256_204082a3be602b3f6aebb013a46e6f9c98b5dad2476350afa60c1954b13598fe"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -112244,10 +112481,10 @@ rule ELASTIC_Linux_Exploit_Enoket_5969A348 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Enoket.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Enoket.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4b4d7ca9e1ffa2c46cb097d4a014c59b1a9feb93b3adcb5936ef6a1dfef9b0ae"
-		logic_hash = "e47af0fba86c9152d17911b984070a8419b98da8916538ebb1065a5348da6e31"
+		logic_hash = "v1_sha256_e47af0fba86c9152d17911b984070a8419b98da8916538ebb1065a5348da6e31"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112273,10 +112510,10 @@ rule ELASTIC_Linux_Exploit_Enoket_80Fac3E9 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Enoket.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Enoket.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3355ad81c566914a7d7734b40c46ded0cfa53aa22c6e834d42e185bf8bbe6128"
-		logic_hash = "19cb7f02ca80095293c4a09f7ea616c31364af1e4189a9211aaba54aaa2db14e"
+		logic_hash = "v1_sha256_19cb7f02ca80095293c4a09f7ea616c31364af1e4189a9211aaba54aaa2db14e"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -112302,10 +112539,10 @@ rule ELASTIC_Linux_Exploit_Enoket_7Da5F86A : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Enoket.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Enoket.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "406b003978d79d453d3e2c21b991b113bf2fc53ffbf3a1724c5b97a4903ef550"
-		logic_hash = "df5769a87230f5e563849302f32673b5f5de2595e12de72c27921d45edc58928"
+		logic_hash = "v1_sha256_df5769a87230f5e563849302f32673b5f5de2595e12de72c27921d45edc58928"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112331,10 +112568,10 @@ rule ELASTIC_Linux_Exploit_Enoket_C77C0D6D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Enoket.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Enoket.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ae8f7e7df62316400d0c5fe0139d7a48c9f184e92706b552aad3d827d3dbbbf"
-		logic_hash = "504d61715bd5dba7f777fcb2d62eb53d8d54dad2dcf93f2fc2d7dcd359c4b994"
+		logic_hash = "v1_sha256_504d61715bd5dba7f777fcb2d62eb53d8d54dad2dcf93f2fc2d7dcd359c4b994"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -112360,10 +112597,10 @@ rule ELASTIC_Linux_Exploit_Enoket_Fbf508E1 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Exploit_Enoket.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Exploit_Enoket.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
-		logic_hash = "21b1d69677c3fddb210dcf5947e8321abccd5a1ebbde8438a83fee5d4b29443d"
+		logic_hash = "v1_sha256_21b1d69677c3fddb210dcf5947e8321abccd5a1ebbde8438a83fee5d4b29443d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112389,10 +112626,10 @@ rule ELASTIC_Linux_Generic_Threat_A658B75F : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "df430ab9f5084a3e62a6c97c6c6279f2461618f038832305057c51b441c648d9"
-		logic_hash = "1ef7267438b8d15ed770f0784a7d428cbc2680144b0ef179337875d5b4038d08"
+		logic_hash = "v1_sha256_1ef7267438b8d15ed770f0784a7d428cbc2680144b0ef179337875d5b4038d08"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -112419,10 +112656,10 @@ rule ELASTIC_Linux_Generic_Threat_Ea5Ade9A : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d75189d883b739d9fe558637b1fab7f41e414937a8bae7a9d58347c223a1fcaa"
-		logic_hash = "12a9b5e54d6d528ecb559b6e2ea3aa72effa7f0efbf2c33581a4efedc292e4c1"
+		logic_hash = "v1_sha256_12a9b5e54d6d528ecb559b6e2ea3aa72effa7f0efbf2c33581a4efedc292e4c1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112448,10 +112685,10 @@ rule ELASTIC_Linux_Generic_Threat_80Aea077 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L42-L60"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L42-L60"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "002827c41bc93772cd2832bc08dfc413302b1a29008adbb6822343861b9818f0"
-		logic_hash = "cab860ad5f0c49555adb845504acb4dbeabb94dbc287202be35020e055e6f27b"
+		logic_hash = "v1_sha256_cab860ad5f0c49555adb845504acb4dbeabb94dbc287202be35020e055e6f27b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112477,10 +112714,10 @@ rule ELASTIC_Linux_Generic_Threat_2E214A04 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L62-L81"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L62-L81"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cad65816cc1a83c131fad63a545a4bd0bdaa45ea8cf039cbc6191e3c9f19dead"
-		logic_hash = "0d29aa6214b0a05f9af10cdc080ffa33452156e13c057f31997630cebcda294a"
+		logic_hash = "v1_sha256_0d29aa6214b0a05f9af10cdc080ffa33452156e13c057f31997630cebcda294a"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -112507,10 +112744,10 @@ rule ELASTIC_Linux_Generic_Threat_0B770605 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L83-L102"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L83-L102"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "99418cbe1496d5cd4177a341e6121411bc1fab600d192a3c9772e8e6cd3c4e88"
-		logic_hash = "d4aae755870765a119ee7ae648d4388e0786e8ab6f7f196d81c6356be7d0ddfb"
+		logic_hash = "v1_sha256_d4aae755870765a119ee7ae648d4388e0786e8ab6f7f196d81c6356be7d0ddfb"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -112537,10 +112774,10 @@ rule ELASTIC_Linux_Generic_Threat_92064B27 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L104-L122"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L104-L122"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8e5cfcda52656a98105a48783b9362bad22f61bcb6a12a27207a08de826432d9"
-		logic_hash = "adb9ed7280065f77440bd1e106bc800ebe6251119151cd54b76dc2917b013f65"
+		logic_hash = "v1_sha256_adb9ed7280065f77440bd1e106bc800ebe6251119151cd54b76dc2917b013f65"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112566,10 +112803,10 @@ rule ELASTIC_Linux_Generic_Threat_De6Be095 : FILE MEMORY
 		date = "2024-01-17"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L124-L143"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L124-L143"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2431239d6e60ca24a5440e6c92da62b723a7e35c805f04db6b80f96c8cf9fee6"
-		logic_hash = "cbd7578830169703b047adb1785b05d226f2507a65c203ee344d8e2b3a24f6c9"
+		logic_hash = "v1_sha256_cbd7578830169703b047adb1785b05d226f2507a65c203ee344d8e2b3a24f6c9"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -112596,10 +112833,10 @@ rule ELASTIC_Linux_Generic_Threat_898D9308 : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L145-L164"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L145-L164"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ce89863a16787a6f39c25fd15ee48c4d196223668a264217f5d1cea31f8dc8ef"
-		logic_hash = "8b5deedf18d660d0b76dc987843ff5cc01432536a04ab4925e9b08269fd847e4"
+		logic_hash = "v1_sha256_8b5deedf18d660d0b76dc987843ff5cc01432536a04ab4925e9b08269fd847e4"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -112626,10 +112863,10 @@ rule ELASTIC_Linux_Generic_Threat_23D54A0E : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L166-L185"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L166-L185"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a2b54f789a1c4cbed13e0e2a5ab61e0ce5bb42d44fe52ad4b7dd3da610045257"
-		logic_hash = "7e52eaf9c49bd6cbdb89b0c525b448864e1ea55d00bc052898613174fe5956cc"
+		logic_hash = "v1_sha256_7e52eaf9c49bd6cbdb89b0c525b448864e1ea55d00bc052898613174fe5956cc"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -112656,10 +112893,10 @@ rule ELASTIC_Linux_Generic_Threat_D7802B0A : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L187-L205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L187-L205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a2b54f789a1c4cbed13e0e2a5ab61e0ce5bb42d44fe52ad4b7dd3da610045257"
-		logic_hash = "3e1452204fef11d63870af5f143ae73f4b8e5a4db83a53851444fbf8a0ea6a26"
+		logic_hash = "v1_sha256_3e1452204fef11d63870af5f143ae73f4b8e5a4db83a53851444fbf8a0ea6a26"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112685,10 +112922,10 @@ rule ELASTIC_Linux_Generic_Threat_08E4Ee8C : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L207-L225"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L207-L225"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "35eeba173fb481ac30c40c1659ccc129eae2d4d922e27cf071047698e8d95aea"
-		logic_hash = "a927415afbab32adee49a583fc35bc3d44764f87bbbb3497b38af6feb92cd9a8"
+		logic_hash = "v1_sha256_a927415afbab32adee49a583fc35bc3d44764f87bbbb3497b38af6feb92cd9a8"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -112714,10 +112951,10 @@ rule ELASTIC_Linux_Generic_Threat_D60E5924 : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L227-L246"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L227-L246"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fdcc2366033541053a7c2994e1789f049e9e6579226478e2b420ebe8a7cebcd3"
-		logic_hash = "012111e4a38c1f901dcd830cc26ef8dcfbde7986fcc8b8eebddb8d8b7a0cec6a"
+		logic_hash = "v1_sha256_012111e4a38c1f901dcd830cc26ef8dcfbde7986fcc8b8eebddb8d8b7a0cec6a"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -112744,10 +112981,10 @@ rule ELASTIC_Linux_Generic_Threat_6Bed4416 : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L248-L266"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L248-L266"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a2b54f789a1c4cbed13e0e2a5ab61e0ce5bb42d44fe52ad4b7dd3da610045257"
-		logic_hash = "c098e27a12d5d10af67d1b78572bc7daeb500504527428366e1d9a4e55e0f4d7"
+		logic_hash = "v1_sha256_c098e27a12d5d10af67d1b78572bc7daeb500504527428366e1d9a4e55e0f4d7"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -112773,10 +113010,10 @@ rule ELASTIC_Linux_Generic_Threat_Fc5B5B86 : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L268-L286"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L268-L286"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "134b063d9b5faed11c6db6848f800b63748ca81aeca46caa0a7c447d07a9cd9b"
-		logic_hash = "a11ed323df7283188cf99ca89abbd18673fef88660df1150d4dc72de04a836a8"
+		logic_hash = "v1_sha256_a11ed323df7283188cf99ca89abbd18673fef88660df1150d4dc72de04a836a8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112802,10 +113039,10 @@ rule ELASTIC_Linux_Generic_Threat_2C8D824C : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L288-L306"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L288-L306"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9106bdd27e67d6eebfaec5b1482069285949de10afb28a538804ce64add88890"
-		logic_hash = "c8fc90ec5e93ff39443f513e83f34140819a30b737da2a412ba97a7b221ca9dc"
+		logic_hash = "v1_sha256_c8fc90ec5e93ff39443f513e83f34140819a30b737da2a412ba97a7b221ca9dc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -112831,10 +113068,10 @@ rule ELASTIC_Linux_Generic_Threat_936B24D5 : FILE MEMORY
 		date = "2024-01-18"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L308-L326"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L308-L326"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "fb8eb0c876148a4199cc873b84fd9c1c6abc1341e02d118f72ffb0dae37592a4"
-		logic_hash = "972bbc4950c49ff7bc880b1d24b586072eb8541584b97a00ac501fac133a3157"
+		logic_hash = "v1_sha256_972bbc4950c49ff7bc880b1d24b586072eb8541584b97a00ac501fac133a3157"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -112860,10 +113097,10 @@ rule ELASTIC_Linux_Generic_Threat_98Bbca63 : FILE MEMORY
 		date = "2024-01-22"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L328-L347"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L328-L347"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1d4d3d8e089dcca348bb4a5115ee2991575c70584dce674da13b738dd0d6ff98"
-		logic_hash = "1728d47b3f364cff02ae61ccf381ecab0c1fe46a5c76d832731fdf7acc1caf55"
+		logic_hash = "v1_sha256_1728d47b3f364cff02ae61ccf381ecab0c1fe46a5c76d832731fdf7acc1caf55"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -112890,10 +113127,10 @@ rule ELASTIC_Linux_Generic_Threat_9Aaf894F : FILE MEMORY
 		date = "2024-01-22"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L349-L367"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L349-L367"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "467ac05956eec6c74217112721b3008186b2802af2cafed6d2038c79621bcb08"
-		logic_hash = "b28d6a8c23aba4371e2e5f48861d2bcc8bdfa7212738eda7b1b4a3059d159cf2"
+		logic_hash = "v1_sha256_b28d6a8c23aba4371e2e5f48861d2bcc8bdfa7212738eda7b1b4a3059d159cf2"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -112919,10 +113156,10 @@ rule ELASTIC_Linux_Generic_Threat_Ba3A047D : FILE MEMORY
 		date = "2024-01-22"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L369-L388"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L369-L388"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3064e89f3585f7f5b69852f1502e34a8423edf5b7da89b93fb8bd0bef0a28b8b"
-		logic_hash = "ffcfb90c0c796b7b343adbd2142193759ececddd0700c0bb4e2898947464b1a2"
+		logic_hash = "v1_sha256_ffcfb90c0c796b7b343adbd2142193759ececddd0700c0bb4e2898947464b1a2"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -112949,10 +113186,10 @@ rule ELASTIC_Linux_Generic_Threat_902Cfdc5 : FILE MEMORY
 		date = "2024-01-23"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L390-L408"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L390-L408"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3fa5057e1be1cfeb73f6ebcdf84e00c37e9e09f1bec347d5424dd730a2124fa8"
-		logic_hash = "0f86914cb598262744660e65048f75d071307ae47d069971bfcd049a7d4b36e5"
+		logic_hash = "v1_sha256_0f86914cb598262744660e65048f75d071307ae47d069971bfcd049a7d4b36e5"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -112978,10 +113215,10 @@ rule ELASTIC_Linux_Generic_Threat_094C1238 : FILE MEMORY
 		date = "2024-01-23"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L410-L428"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L410-L428"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2bfe7d51d59901af345ef06dafd8f0e950dcf8461922999670182bfc7082befd"
-		logic_hash = "fb82e16bf153c88377cc8655557bc1f021af6e04e1160129ce9555e078d00a0d"
+		logic_hash = "v1_sha256_fb82e16bf153c88377cc8655557bc1f021af6e04e1160129ce9555e078d00a0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113007,10 +113244,10 @@ rule ELASTIC_Linux_Generic_Threat_A8Faf785 : FILE MEMORY
 		date = "2024-01-23"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L430-L448"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L430-L448"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6028562baf0a7dd27329c8926585007ba3e0648da25088204ebab2ac8f723e70"
-		logic_hash = "3ab5d9ba39be2553173f6eb4d2a1ca22bfb9f1bd537fed247f273eba1eabd782"
+		logic_hash = "v1_sha256_3ab5d9ba39be2553173f6eb4d2a1ca22bfb9f1bd537fed247f273eba1eabd782"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113036,10 +113273,10 @@ rule ELASTIC_Linux_Generic_Threat_04E8E4A5 : FILE MEMORY
 		date = "2024-01-23"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L450-L468"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L450-L468"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "248f010f18962c8d1cc4587e6c8b683a120a1e838d091284ba141566a8a01b92"
-		logic_hash = "9b04725bf0a75340c011028b201ed08eb9de305a5b4630cc79156c0a847cdc9e"
+		logic_hash = "v1_sha256_9b04725bf0a75340c011028b201ed08eb9de305a5b4630cc79156c0a847cdc9e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113065,10 +113302,10 @@ rule ELASTIC_Linux_Generic_Threat_47B147Ec : FILE MEMORY
 		date = "2024-02-01"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L470-L488"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L470-L488"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cc7734a10998a4878b8f0c362971243ea051ce6c1689444ba6e71aea297fb70d"
-		logic_hash = "84c68f2ed76d644122daf81d41d4eb0be9aa8b1c82993464d3138ae30992110f"
+		logic_hash = "v1_sha256_84c68f2ed76d644122daf81d41d4eb0be9aa8b1c82993464d3138ae30992110f"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -113094,10 +113331,10 @@ rule ELASTIC_Linux_Generic_Threat_887671E9 : FILE MEMORY
 		date = "2024-02-01"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L490-L508"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L490-L508"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "701c7c75ed6a7aaf59f5a1f04192a1f7d49d73c1bd36453aed703ad5560606dc"
-		logic_hash = "eefe9391a9ce716dbe16f11b8ccea89d032fdad42fcabd84ffe584409c550847"
+		logic_hash = "v1_sha256_eefe9391a9ce716dbe16f11b8ccea89d032fdad42fcabd84ffe584409c550847"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113123,10 +113360,10 @@ rule ELASTIC_Linux_Generic_Threat_9Cf10F10 : FILE MEMORY
 		date = "2024-02-01"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L510-L528"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L510-L528"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d07c9be37dc37f43a54c8249fe887dbc4058708f238ff3d95ed21f874cbb84e8"
-		logic_hash = "ca4ae64b73fb7013008e8049d17479032d904a3faf5ad0f2ad079971a231a3b8"
+		logic_hash = "v1_sha256_ca4ae64b73fb7013008e8049d17479032d904a3faf5ad0f2ad079971a231a3b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113152,10 +113389,10 @@ rule ELASTIC_Linux_Generic_Threat_75813Ab2 : FILE MEMORY
 		date = "2024-02-01"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L530-L549"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L530-L549"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5819eb73254fd2a698eb71bd738cf3df7beb65e8fb5e866151e8135865e3fd9a"
-		logic_hash = "06e5daed278273137e416ef3ee6ac8496b144a9c3ce213ec92881ba61d7db6cb"
+		logic_hash = "v1_sha256_06e5daed278273137e416ef3ee6ac8496b144a9c3ce213ec92881ba61d7db6cb"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113182,10 +113419,10 @@ rule ELASTIC_Linux_Generic_Threat_11041685 : FILE MEMORY
 		date = "2024-02-01"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L551-L570"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L551-L570"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "296440107afb1c8c03e5efaf862f2e8cc6b5d2cf979f2c73ccac859d4b78865a"
-		logic_hash = "19f4109e73981424527ece8c375274f97fd3042427b7875071451a8081a9aae7"
+		logic_hash = "v1_sha256_19f4109e73981424527ece8c375274f97fd3042427b7875071451a8081a9aae7"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113212,10 +113449,10 @@ rule ELASTIC_Linux_Generic_Threat_0D22F19C : FILE MEMORY
 		date = "2024-02-01"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L572-L591"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L572-L591"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "da5a204af600e73184455d44aa6e01d82be8b480aa787b28a1df88bb281eb4db"
-		logic_hash = "ee43796b0717717cb012385d5bb3aece433c11780f1a293d280c39411f9fed98"
+		logic_hash = "v1_sha256_ee43796b0717717cb012385d5bb3aece433c11780f1a293d280c39411f9fed98"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113242,10 +113479,10 @@ rule ELASTIC_Linux_Generic_Threat_4A46B0E1 : FILE MEMORY
 		date = "2024-02-01"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L593-L612"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L593-L612"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "3ba47ba830ab8deebd9bb906ea45c7df1f7a281277b44d43c588c55c11eba34a"
-		logic_hash = "e3f6804f502fad8c893fb4c3c27506b6ef17d7e0d0a01399c6d185bad92e895a"
+		logic_hash = "v1_sha256_e3f6804f502fad8c893fb4c3c27506b6ef17d7e0d0a01399c6d185bad92e895a"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113272,10 +113509,10 @@ rule ELASTIC_Linux_Generic_Threat_0A02156C : FILE MEMORY
 		date = "2024-02-01"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L614-L633"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L614-L633"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "f23d4b1fd10e3cdd5499a12f426e72cdf0a098617e6b178401441f249836371e"
-		logic_hash = "3ceea812f0252ec703a92482ce7a3ef0aa65bad149df2aa0107e07a45490b8f1"
+		logic_hash = "v1_sha256_3ceea812f0252ec703a92482ce7a3ef0aa65bad149df2aa0107e07a45490b8f1"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113302,10 +113539,10 @@ rule ELASTIC_Linux_Generic_Threat_6D7Ec30A : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L635-L654"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L635-L654"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "1cad1ddad84cdd8788478c529ed4a5f25911fb98d0a6241dcf5f32b0cdfc3eb0"
-		logic_hash = "33c705b89a82989c25fc67f50b06aa3a613cae567ec652d86ae64bad4b253c28"
+		logic_hash = "v1_sha256_33c705b89a82989c25fc67f50b06aa3a613cae567ec652d86ae64bad4b253c28"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113332,10 +113569,10 @@ rule ELASTIC_Linux_Generic_Threat_900Ffdd4 : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L656-L674"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L656-L674"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "a3e1a1f22f6d32931d3f72c35a5ee50092b5492b3874e9e6309d015d82bddc5d"
-		logic_hash = "eb69bfc146b32e790fffdf4588b583335d2006182070b53fec43bb6e4971d779"
+		logic_hash = "v1_sha256_eb69bfc146b32e790fffdf4588b583335d2006182070b53fec43bb6e4971d779"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113361,10 +113598,10 @@ rule ELASTIC_Linux_Generic_Threat_Cb825102 : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L676-L694"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L676-L694"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4e24b72b24026e3dfbd65ddab9194bd03d09446f9ff0b3bcec76efbb5c096584"
-		logic_hash = "ac48f32ec82aac6df0697729d14aaee65fba82d91173332cd13c6ccccd63b1be"
+		logic_hash = "v1_sha256_ac48f32ec82aac6df0697729d14aaee65fba82d91173332cd13c6ccccd63b1be"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -113390,10 +113627,10 @@ rule ELASTIC_Linux_Generic_Threat_3Bcc1630 : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L696-L716"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L696-L716"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "62a6866e924af2e2f5c8c1f5009ce64000acf700bb5351a47c7cfce6a4b2ffeb"
-		logic_hash = "6f602aac6db46ac3f5b7716a1dac53b5dbd2c583505644bfc617d69be0a2d4de"
+		logic_hash = "v1_sha256_6f602aac6db46ac3f5b7716a1dac53b5dbd2c583505644bfc617d69be0a2d4de"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -113421,10 +113658,10 @@ rule ELASTIC_Linux_Generic_Threat_5D5Fd28E : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L718-L738"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L718-L738"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5b179a117e946ce639e99ff42ab70616ed9f3953ff90b131b4b3063f970fa955"
-		logic_hash = "b29ca34b98ee87151496f900fa3558190127957539afac3fd99db2dc51980213"
+		logic_hash = "v1_sha256_b29ca34b98ee87151496f900fa3558190127957539afac3fd99db2dc51980213"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -113452,10 +113689,10 @@ rule ELASTIC_Linux_Generic_Threat_B0B891Fb : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L740-L759"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L740-L759"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d666bc0600075f01d8139f8b09c5f4e4da17fa06a86ebb3fa0dc478562e541ae"
-		logic_hash = "9ec82691a230f3240b1253f99a45cd0baa3238b6fd533004a22a6152b6ac9a12"
+		logic_hash = "v1_sha256_9ec82691a230f3240b1253f99a45cd0baa3238b6fd533004a22a6152b6ac9a12"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113482,10 +113719,10 @@ rule ELASTIC_Linux_Generic_Threat_Cd9Ce063 : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L761-L779"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L761-L779"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "485581520dd73429b662b73083d504aa8118e01c5d37c1c08b21a5db0341a19d"
-		logic_hash = "ba070c2147028cad4be1c139b16a770c9d9854456d073373a93ed0b213f7b34c"
+		logic_hash = "v1_sha256_ba070c2147028cad4be1c139b16a770c9d9854456d073373a93ed0b213f7b34c"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -113511,10 +113748,10 @@ rule ELASTIC_Linux_Generic_Threat_B8B076F4 : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L781-L799"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L781-L799"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "4496e77ff00ad49a32e090750cb10c55e773752f4a50be05e3c7faacc97d2677"
-		logic_hash = "37f3be4cbda4a93136d66e32d7245d4c962a9fe1c98fb0325f42a1d16d6d9415"
+		logic_hash = "v1_sha256_37f3be4cbda4a93136d66e32d7245d4c962a9fe1c98fb0325f42a1d16d6d9415"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113540,10 +113777,10 @@ rule ELASTIC_Linux_Generic_Threat_1Ac392Ca : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L801-L819"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L801-L819"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "dca2d035b1f7191f7876eb727b13c308f63fe8f899cab643526f9492ec0fa16f"
-		logic_hash = "6ffa5099c0d18644cd11a0511db542d2f809e4cba974eccca814fedf5a2b0a5b"
+		logic_hash = "v1_sha256_6ffa5099c0d18644cd11a0511db542d2f809e4cba974eccca814fedf5a2b0a5b"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -113569,10 +113806,10 @@ rule ELASTIC_Linux_Generic_Threat_949Bf68C : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L821-L839"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L821-L839"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cc1b339ff6b33912a8713c192e8743d1207917825b62b6f585ab7c8d6ab4c044"
-		logic_hash = "aaae0a8a2827786513891bc8c3e3418823ae3f3291d891e80e82113b929f7513"
+		logic_hash = "v1_sha256_aaae0a8a2827786513891bc8c3e3418823ae3f3291d891e80e82113b929f7513"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113598,10 +113835,10 @@ rule ELASTIC_Linux_Generic_Threat_Bd35454B : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L841-L860"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L841-L860"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "cd729507d2e17aea23a56a56e0c593214dbda4197e8a353abe4ed0c5fbc4799c"
-		logic_hash = "d3619cdb002b4ac7167716234058f949623c42a64614f5eb7956866b68fff5e4"
+		logic_hash = "v1_sha256_d3619cdb002b4ac7167716234058f949623c42a64614f5eb7956866b68fff5e4"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113628,10 +113865,10 @@ rule ELASTIC_Linux_Generic_Threat_1E047045 : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L862-L880"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L862-L880"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "2c49772d89bcc4ad4ed0cc130f91ed0ce1e625262762a4e9279058f36f4f5841"
-		logic_hash = "0d28df53e030664e7225f1170888b51e94e64833537c5add3e10cfdb4f029a3a"
+		logic_hash = "v1_sha256_0d28df53e030664e7225f1170888b51e94e64833537c5add3e10cfdb4f029a3a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113657,10 +113894,10 @@ rule ELASTIC_Linux_Generic_Threat_1973391F : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L882-L901"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L882-L901"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "7bd76010f18061aeaf612ad96d7c03341519d85f6a1683fc4b2c74ea0508fe1f"
-		logic_hash = "632a43b68e498f463ff5dfa78212646b8bd108ea47ff11164c8c1a69e830c1ac"
+		logic_hash = "v1_sha256_632a43b68e498f463ff5dfa78212646b8bd108ea47ff11164c8c1a69e830c1ac"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113687,10 +113924,10 @@ rule ELASTIC_Linux_Generic_Threat_66D00A84 : FILE MEMORY
 		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L903-L921"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L903-L921"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "464e144bcbb54fc34262b4d81143f4e69e350fb526c803ebea1fdcfc8e57bf33"
-		logic_hash = "a1d60619d72b3309bfaaf8b4085dd5ed90142ff3e9ebfe80fcd7beba5f14a62e"
+		logic_hash = "v1_sha256_a1d60619d72b3309bfaaf8b4085dd5ed90142ff3e9ebfe80fcd7beba5f14a62e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113716,10 +113953,10 @@ rule ELASTIC_Linux_Generic_Threat_D2Dca9E7 : FILE MEMORY
 		date = "2024-05-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L923-L941"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L923-L941"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9b10bb3773011c4da44bf3a0f05b83079e4ad30f0b1eb2636a6025b927e03c7f"
-		logic_hash = "175b9a80314cf280b995a012f13e65bd4ce7e27faebf02ae5abe978dbd14447c"
+		logic_hash = "v1_sha256_175b9a80314cf280b995a012f13e65bd4ce7e27faebf02ae5abe978dbd14447c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113745,10 +113982,10 @@ rule ELASTIC_Linux_Generic_Threat_1F5D056B : FILE MEMORY
 		date = "2024-05-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L943-L962"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L943-L962"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "99d982701b156fe3523b359498c2d03899ea9805d6349416c9702b1067293471"
-		logic_hash = "8ad23b593880dc1bebc95c92d0efc3a90e6b1e143c350e30b1a4258502ce7fc7"
+		logic_hash = "v1_sha256_8ad23b593880dc1bebc95c92d0efc3a90e6b1e143c350e30b1a4258502ce7fc7"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113775,10 +114012,10 @@ rule ELASTIC_Linux_Generic_Threat_D94E1020 : FILE MEMORY
 		date = "2024-05-20"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L964-L982"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L964-L982"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "96a2bfbb55250b784e94b1006391cc51e4adecbdde1fe450eab53353186f6ff0"
-		logic_hash = "e4b4e588588080c66076aec02f56b4764a5f72059922db9651461c0287fe0351"
+		logic_hash = "v1_sha256_e4b4e588588080c66076aec02f56b4764a5f72059922db9651461c0287fe0351"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113804,10 +114041,10 @@ rule ELASTIC_Linux_Generic_Threat_Aa0C23D5 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L984-L1004"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L984-L1004"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8314290b81b827e1a1d157c41916a41a1c033e4f74876acc6806ed79ebbcc13d"
-		logic_hash = "092f0ece2dfca3e02493c00afffe48ca4feccf56ab6f22d952a7ba5f115f3765"
+		logic_hash = "v1_sha256_092f0ece2dfca3e02493c00afffe48ca4feccf56ab6f22d952a7ba5f115f3765"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -113835,10 +114072,10 @@ rule ELASTIC_Linux_Generic_Threat_8299C877 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1006-L1024"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1006-L1024"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "60c486049ec82b4fa2e0a53293ae6476216b76e2c23238ef1c723ac0a2ae070c"
-		logic_hash = "3e0653a02517faa3037fc5f3f01f6fb11164fecafc6eca457a122ef2d1a99010"
+		logic_hash = "v1_sha256_3e0653a02517faa3037fc5f3f01f6fb11164fecafc6eca457a122ef2d1a99010"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113864,10 +114101,10 @@ rule ELASTIC_Linux_Generic_Threat_81Aa5579 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1026-L1044"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1026-L1044"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6be0e2c98ba5255b76c31f689432a9de83a0d76a898c28dbed0ba11354fec6c2"
-		logic_hash = "c94d590daf61217335a72f3e1bc24b09084cf0a5a174c013c5aa97c01707c2bc"
+		logic_hash = "v1_sha256_c94d590daf61217335a72f3e1bc24b09084cf0a5a174c013c5aa97c01707c2bc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -113893,10 +114130,10 @@ rule ELASTIC_Linux_Generic_Threat_F2452362 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1046-L1065"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1046-L1065"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5ff46c27b5823e55f25c9567d687529a24a0d52dea5bc2423b36345782e6b8f6"
-		logic_hash = "95d51077cb7c0f4b089a2e2ee8fcbab204264ade7ddd64fc1ee0176183dc84e0"
+		logic_hash = "v1_sha256_95d51077cb7c0f4b089a2e2ee8fcbab204264ade7ddd64fc1ee0176183dc84e0"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113923,10 +114160,10 @@ rule ELASTIC_Linux_Generic_Threat_Da28Eb8B : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1067-L1086"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1067-L1086"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "b3b4fcd19d71814d3b4899528ee9c3c2188e4a7a4d8ddb88859b1a6868e8433f"
-		logic_hash = "8b0892d0dd8a012a1f9cd87a0ad3321ae751dd17a96205c12e6648946cf2afe2"
+		logic_hash = "v1_sha256_8b0892d0dd8a012a1f9cd87a0ad3321ae751dd17a96205c12e6648946cf2afe2"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -113953,10 +114190,10 @@ rule ELASTIC_Linux_Generic_Threat_A40Aaa96 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1088-L1108"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1088-L1108"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "6f965252141084524f85d94169b13938721bce24cc986bf870473566b7cfd81b"
-		logic_hash = "ab05cbf494b3b78083fd3e71703effed797d803b0203f8a413eb69b746656b1d"
+		logic_hash = "v1_sha256_ab05cbf494b3b78083fd3e71703effed797d803b0203f8a413eb69b746656b1d"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -113984,10 +114221,10 @@ rule ELASTIC_Linux_Generic_Threat_E24558E1 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1110-L1130"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1110-L1130"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "9f483ddd8971cad4b25bb36a5a0cfb95c35a12c7d5cb9124ef0cfd020da63e99"
-		logic_hash = "f1f33c719a4b41968c137ed43aa0591f97b4558d4dd9bd160df519dfbbc49205"
+		logic_hash = "v1_sha256_f1f33c719a4b41968c137ed43aa0591f97b4558d4dd9bd160df519dfbbc49205"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -114015,10 +114252,10 @@ rule ELASTIC_Linux_Generic_Threat_Ace836F1 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1132-L1150"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1132-L1150"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "116aaba80e2f303206d0ba84c8c58a4e3e34b70a8ca2717fa9cf1aa414d5ffcc"
-		logic_hash = "c80af9d6f3e4d92cfa53429abbda944069d335fc89421a89e04089d236f5dddf"
+		logic_hash = "v1_sha256_c80af9d6f3e4d92cfa53429abbda944069d335fc89421a89e04089d236f5dddf"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
@@ -114044,10 +114281,10 @@ rule ELASTIC_Linux_Generic_Threat_E9Aef030 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1152-L1170"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1152-L1170"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "5ab72be12cca8275d95a90188a1584d67f95d43a7903987e734002983b5a3925"
-		logic_hash = "1d458e147d6667e2e0740d6d26fee05ac02f49e9eba30002852e723308b1b462"
+		logic_hash = "v1_sha256_1d458e147d6667e2e0740d6d26fee05ac02f49e9eba30002852e723308b1b462"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -114073,10 +114310,10 @@ rule ELASTIC_Linux_Generic_Threat_A3C5F3Bd : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1172-L1192"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1172-L1192"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "8c093bcf3d83545ec442519637c956d2af62193ea6fd2769925cacda54e672b6"
-		logic_hash = "41e66d1f47e7197662aa661ef49ee1f3191fee07a49538dd631ce9cc6fdd56be"
+		logic_hash = "v1_sha256_41e66d1f47e7197662aa661ef49ee1f3191fee07a49538dd631ce9cc6fdd56be"
 		score = 75
 		quality = 69
 		tags = "FILE, MEMORY"
@@ -114104,10 +114341,10 @@ rule ELASTIC_Linux_Generic_Threat_3Fa2Df51 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1194-L1213"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1194-L1213"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "89ec224db6b63936e8bc772415d785ef063bfd9343319892e832034696ff6f15"
-		logic_hash = "f43b659dd093a635d9723b2443366763132217aaf28c582ed43f180725f92f19"
+		logic_hash = "v1_sha256_f43b659dd093a635d9723b2443366763132217aaf28c582ed43f180725f92f19"
 		score = 75
 		quality = 71
 		tags = "FILE, MEMORY"
@@ -114134,10 +114371,10 @@ rule ELASTIC_Linux_Generic_Threat_Be02B1C9 : FILE MEMORY
 		date = "2024-05-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Generic_Threat.yar#L1215-L1233"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Generic_Threat.yar#L1215-L1233"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "ef6d47ed26f9ac96836f112f1085656cf73fc445c8bacdb737b8be34d8e3bcd2"
-		logic_hash = "a278c3a8033139d84c99a53901526895b154b5ef363fbeed47095889a5fb8d31"
+		logic_hash = "v1_sha256_a278c3a8033139d84c99a53901526895b154b5ef363fbeed47095889a5fb8d31"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -114163,10 +114400,10 @@ rule ELASTIC_Linux_Hacktool_Infectionmonkey_6C84537B : FILE MEMORY
 		date = "2022-01-05"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/yara/rules/Linux_Hacktool_Infectionmonkey.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/8824c8f250f189be8f7caf30dac0d045b7fb8651/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/yara/rules/Linux_Hacktool_Infectionmonkey.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/401b9f547292bee56d26a35f5f9d313b0c513e89/LICENSE.txt"
 		hash = "d941943046db48cf0eb7f11e144a79749848ae6b50014833c5390936e829f6c3"
-		logic_hash = "24cb368040fffe2743d0361a955d45a62a95a31c1744f3de15089169e365bb89"
+		logic_hash = "v1_sha256_24cb368040fffe2743d0361a955d45a62a95a31c1744f3de15089169e365bb89"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
@@ -114187,7 +114424,7 @@ rule ELASTIC_Linux_Hacktool_Infectionmonkey_6C84537B : FILE MEMORY
  * YARA Rule Set
  * Repository Name: R3c0nst
  * Repository: https://github.com/fboldewin/YARA-rules/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 54e9e6899b258b72074b2b4db6909257683240c2
  * Number of Rules: 26
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -114202,13 +114439,13 @@ rule R3C0NST_ATM_Malware_Xfscashncr : FILE
 	meta:
 		description = "Detects ATM Malware XFSCashNCR"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "8886cd00-4f4a-5f25-99e0-0806f5e1b4b4"
+		id = "83ed9f7a-a7f3-595d-b3cf-6e841c8d2e85"
 		date = "2019-08-28"
 		modified = "2019-08-28"
 		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFSCashNCR.yar#L1-L21"
 		license_url = "N/A"
-		logic_hash = "87f197058d4b515cb4829b5e403a96b88eb95cda81e53a9e1484df8c743d8c4a"
+		logic_hash = "v1_sha256_87f197058d4b515cb4829b5e403a96b88eb95cda81e53a9e1484df8c743d8c4a"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114225,7 +114462,7 @@ rule R3C0NST_ATM_Malware_Xfscashncr : FILE
 		$LogFile = "XfsLog.txt" nocase ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1500KB and 4 of them
+		uint16( 0 ) == 0x5A4D and filesize < 1500KB and 4 of them
 }
 import "pe"
 
@@ -114234,13 +114471,13 @@ rule R3C0NST_Nighthawk_RAT : FILE
 	meta:
 		description = "Detects Nighthawk RAT"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "7a58b8bf-fb14-5758-bc2a-ad2c6fff1216"
+		id = "1918c4cb-ca5b-5610-9afc-8dc8dd956a2a"
 		date = "2022-11-30"
 		modified = "2022-11-30"
 		reference = "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/nighthawk.yar#L3-L28"
 		license_url = "N/A"
-		logic_hash = "5124f7c0186f40cf0a7706e17afe6ba791ca82ac4f4ee940f6fbae5223771a95"
+		logic_hash = "v1_sha256_5124f7c0186f40cf0a7706e17afe6ba791ca82ac4f4ee940f6fbae5223771a95"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114259,20 +114496,20 @@ rule R3C0NST_Nighthawk_RAT : FILE
 		$pattern6 = { 65 48 8B 04 25 30 00 00 00 48 8B 80 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize <2MB and (3 of ($pattern*) or (pe.section_index(".profile") and pe.section_index(".detourc") and pe.section_index(".detourd")))
+		uint16( 0 ) == 0x5A4D and filesize < 2MB and ( 3 of ( $pattern* ) or ( pe.section_index ( ".profile" ) and pe.section_index ( ".detourc" ) and pe.section_index ( ".detourd" ) ) )
 }
 rule R3C0NST_ATM_Malware_XFS_ALICE : FILE
 {
 	meta:
 		description = "Detects ATM Malware ALICE"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "6132730c-4684-517a-b90d-98ed250e2cba"
+		id = "4f2a179d-acb7-5598-a30e-e8ca091d48ad"
 		date = "2020-01-09"
 		modified = "2020-08-17"
 		reference = "https://twitter.com/r3c0nst/status/1215265889844637696"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ALICE.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "7dca049f024f09c2e778b0693a1015d1fc5a006fc564de914e85231cb5d73da3"
+		logic_hash = "v1_sha256_7dca049f024f09c2e778b0693a1015d1fc5a006fc564de914e85231cb5d73da3"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114290,20 +114527,20 @@ rule R3C0NST_ATM_Malware_XFS_ALICE : FILE
 		$Code3 = {68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 0B C0 75 29 6A}
 
 	condition:
-		uint16(0)==0x5A4D and filesize <200KB and 4 of ($String*) and all of ($Code*)
+		uint16( 0 ) == 0x5A4D and filesize < 200KB and 4 of ( $String* ) and all of ( $Code* )
 }
 rule R3C0NST_UNC2891_Steelcorgi : FILE
 {
 	meta:
 		description = "Detects UNC2891 Steelcorgi packed ELF binaries"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "94da7da5-5fc3-5221-97d6-1854aa7b1959"
+		id = "cad44f28-4757-5844-a2b1-15ac84a202e8"
 		date = "2022-03-30"
 		modified = "2023-01-05"
 		reference = "https://github.com/fboldewin/YARA-rules/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Steelcorgi.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "4f956b9eaec66bc606ffd0afa2fe9303194e9a8c12d4c3de6ab2334c9856dd99"
+		logic_hash = "v1_sha256_4f956b9eaec66bc606ffd0afa2fe9303194e9a8c12d4c3de6ab2334c9856dd99"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114316,20 +114553,20 @@ rule R3C0NST_UNC2891_Steelcorgi : FILE
 		$pattern2 = {FF 72 FF 6F FF 63 FF 2F FF 73 FF 65 FF 6C FF 66 FF 2F FF 65 FF 78 FF 65}
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint32( 0 ) == 0x464c457f and all of them
 }
 rule R3C0NST_ATM_Malware_Javadispcash : FILE
 {
 	meta:
 		description = "Detects ATM Malware JavaDispCash"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "606d1cb6-7879-569e-ac36-1e2f6a446dc1"
+		id = "aaf0bb83-6760-5060-b80d-79bd9d619da1"
 		date = "2019-03-28"
 		modified = "2019-03-28"
 		reference = "https://twitter.com/r3c0nst/status/1111254169623674882"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Mal.JavaDispCash.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "dd7c2ccc85038f3ba563f7f814c03668448b292fde36bcf9d06bf20fd341526f"
+		logic_hash = "v1_sha256_dd7c2ccc85038f3ba563f7f814c03668448b292fde36bcf9d06bf20fd341526f"
 		score = 75
 		quality = 74
 		tags = "FILE"
@@ -114345,7 +114582,7 @@ rule R3C0NST_ATM_Malware_Javadispcash : FILE
 		$log2 = ".loginside" nocase ascii wide
 
 	condition:
-		uint16(0)==0x4B50 and filesize <500KB and all of them
+		uint16( 0 ) == 0x4B50 and filesize < 500KB and all of them
 }
 import "pe"
 
@@ -114354,13 +114591,13 @@ rule R3C0NST_ATM_Malware_ATMITCH : FILE
 	meta:
 		description = "Detects ATM Malware ATMItch"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "4d7e9615-9db6-5fc7-b95e-b8c7b2c034a8"
+		id = "7036ee7d-e608-588d-abda-12c831c7ebfd"
 		date = "2019-03-18"
 		modified = "2019-03-18"
 		reference = "https://github.com/fboldewin/YARA-rules/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ATMItch.yar#L3-L14"
 		license_url = "N/A"
-		logic_hash = "4278cbcd8c465ba57b65a166e0bd48dcc73eae8660972478d3116bc0d73cf3c4"
+		logic_hash = "v1_sha256_4278cbcd8c465ba57b65a166e0bd48dcc73eae8660972478d3116bc0d73cf3c4"
 		score = 75
 		quality = 82
 		tags = "FILE"
@@ -114372,7 +114609,7 @@ rule R3C0NST_ATM_Malware_ATMITCH : FILE
 		$STRING4 = "Catch some money, bitch!" nocase ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and 1 of them ) or (pe.imphash()=="655ad5439db0832c5a3f86d0a68ddaac")
+		( uint16( 0 ) == 0x5A4D and 1 of them ) or ( pe.imphash ( ) == "655ad5439db0832c5a3f86d0a68ddaac" )
 }
 import "hash"
 
@@ -114381,13 +114618,13 @@ rule R3C0NST_ATM_Malware_Dispenserxfs : FILE
 	meta:
 		description = "No description has been set in the source file - R3c0nst"
 		author = "Frank Boldewin"
-		id = "52b1aa57-283b-54d7-bd1b-fb5da5f8d269"
+		id = "2cf94883-2fdc-5acc-bb90-fe5981ddc709"
 		date = "2019-02-28"
 		modified = "2019-02-28"
 		reference = "https://github.com/fboldewin/YARA-rules/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.DispenserXFS.yar#L3-L13"
 		license_url = "N/A"
-		logic_hash = "0e588e2ba03d5eb750183600cce278e791a71f86fbf933ba9d7fda352bd37e2f"
+		logic_hash = "v1_sha256_0e588e2ba03d5eb750183600cce278e791a71f86fbf933ba9d7fda352bd37e2f"
 		score = 75
 		quality = 59
 		tags = "FILE"
@@ -114398,20 +114635,20 @@ rule R3C0NST_ATM_Malware_Dispenserxfs : FILE
 		$PDB = "C:\\_bkittest\\dispenser\\Release_noToken\\dispenserXFS.pdb" nocase ascii wide
 
 	condition:
-		(hash.sha256(0, filesize )=="867991ade335186baa19a227e3a044c8321a6cef96c23c98eef21fe6b87edf6a") or ( uint16(0)==0x5A4D and 1 of them )
+		(hash.sha256 ( 0 , filesize ) == "867991ade335186baa19a227e3a044c8321a6cef96c23c98eef21fe6b87edf6a" ) or ( uint16( 0 ) == 0x5A4D and 1 of them )
 }
 rule R3C0NST_Prolock_Malware : FILE
 {
 	meta:
 		description = "Detects Prolock malware in encrypted and decrypted mode"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "1440b5f5-f1e7-522e-8852-84c326858bb9"
+		id = "4bc35837-dada-586c-a152-11ede6268c71"
 		date = "2020-05-17"
 		modified = "2020-05-20"
 		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Prolock.Malware.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "7502011eba1e36c8ec699f1b627c4980cc3009bb43c5aa5a58571330e93211ea"
+		logic_hash = "v1_sha256_7502011eba1e36c8ec699f1b627c4980cc3009bb43c5aa5a58571330e93211ea"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114427,20 +114664,20 @@ rule R3C0NST_Prolock_Malware : FILE
 		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}
 
 	condition:
-		(( uint16(0)==0x5A4D) or ( uint16(0)==0x4D42)) and filesize <100KB and all of ($DecryptionRoutine*) or (1 of ($DecryptedString*) and $CryptoCode)
+		(( uint16( 0 ) == 0x5A4D ) or ( uint16( 0 ) == 0x4D42 ) ) and filesize < 100KB and all of ( $DecryptionRoutine* ) or ( 1 of ( $DecryptedString* ) and $CryptoCode )
 }
 rule R3C0NST_Stealbit : FILE
 {
 	meta:
 		description = "Detects Stealbit used by Lockbit 2.0 Ransomware Gang"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "07b466cb-92b3-51f2-a702-2930bb7038c6"
+		id = "c24b0fac-2279-5b4e-9f0e-3e506d040081"
 		date = "2021-08-12"
 		modified = "2021-08-12"
 		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Lockbit2.Stealbit.yar"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Lockbit2.Stealbit.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "e5f770cc5887f09af0c5550073d51b9e5ffa9dcfa4db6b77bb28643f0f6224fb"
+		logic_hash = "v1_sha256_e5f770cc5887f09af0c5550073d51b9e5ffa9dcfa4db6b77bb28643f0f6224fb"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114451,7 +114688,7 @@ rule R3C0NST_Stealbit : FILE
 		$C2Decryption = {33 C9 8B C1 83 E0 0F 8A 80 ?? ?? ?? ?? 30 81 ?? ?? ?? ?? 41 83 F9 7C 72 E9 E8}
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and $C2Decryption
+		uint16( 0 ) == 0x5A4D and filesize < 100KB and $C2Decryption
 }
 import "hash"
 
@@ -114460,14 +114697,14 @@ rule R3C0NST_ATM_Malware_Atmspitter : FILE
 	meta:
 		description = "Detects ATM Malware ATMSpitter"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "4497f304-6f04-5f5d-91ba-9124e5262078"
+		id = "f9085803-ed52-5bc6-a7e0-931ea006e85d"
 		date = "2016-07-20"
 		modified = "2019-03-29"
 		reference = "https://topics.amcham.com.tw/2017/02/looking-back-at-the-first-banks-atm-heist/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ATMSpitter.yar#L3-L21"
 		license_url = "N/A"
 		hash = "658b0502b53f718bd0611a638dfd5969"
-		logic_hash = "684820ed29c50a41bd262862cb97c70c0cbb8554e7e4be300986519423249c50"
+		logic_hash = "v1_sha256_684820ed29c50a41bd262862cb97c70c0cbb8554e7e4be300986519423249c50"
 		score = 75
 		quality = 65
 		tags = "FILE"
@@ -114477,20 +114714,20 @@ rule R3C0NST_ATM_Malware_Atmspitter : FILE
 		$Service = "Congratulations! You are very skilled in reverse engineering!" nocase ascii
 
 	condition:
-		(hash.sha256(0, filesize )=="4035d977202b44666885f9781ac8755c799350a03838ff782eb730c0d7069958") or ($Code_Bytes and $Service)
+		(hash.sha256 ( 0 , filesize ) == "4035d977202b44666885f9781ac8755c799350a03838ff782eb730c0d7069958" ) or ( $Code_Bytes and $Service )
 }
 rule R3C0NST_Exploit_Outlook_CVE_2023_23397 : CVE_2023_23397 FILE
 {
 	meta:
 		description = "Detects Outlook appointments exploiting CVE-2023-23397"
 		author = "Frank Boldewin"
-		id = "7e355e5f-93ca-561d-9a12-f73f1d429e4d"
+		id = "126d94fe-b26d-5237-a1f6-af87cd60bbef"
 		date = "2023-03-19"
 		modified = "2023-03-25"
 		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Exploit_Outlook_CVE_2023_23397.yar#L1-L30"
 		license_url = "N/A"
-		logic_hash = "1847e8223b2f6d3ec5108e15ee46ef031ee1e26d3a5e8ed4a70c77b031f6a5b6"
+		logic_hash = "v1_sha256_1847e8223b2f6d3ec5108e15ee46ef031ee1e26d3a5e8ed4a70c77b031f6a5b6"
 		score = 75
 		quality = 86
 		tags = "CVE-2023-23397, FILE"
@@ -114513,20 +114750,20 @@ rule R3C0NST_Exploit_Outlook_CVE_2023_23397 : CVE_2023_23397 FILE
 		$mail2 = "received:" ascii wide nocase
 
 	condition:
-		(( uint32be(0)==0xD0CF11E0 or uint32be(0)==0x789F3E22) or ( all of ($mail*))) and (($ipmtask or $ipmappointment) or ($ipmtaskb64 or $ipmappointmentb64)) and (($unc_path1 or $unc_path2) or ($unc_a or $unc_w))
+		(( uint32be( 0 ) == 0xD0CF11E0 or uint32be( 0 ) == 0x789F3E22 ) or ( all of ( $mail* ) ) ) and ( ( $ipmtask or $ipmappointment ) or ( $ipmtaskb64 or $ipmappointmentb64 ) ) and ( ( $unc_path1 or $unc_path2 ) or ( $unc_a or $unc_w ) )
 }
 rule R3C0NST_Aplib_Decompression : FILE
 {
 	meta:
 		description = "Detects aPLib decompression code often used in malware"
 		author = "@r3c0nst"
-		id = "f45c73f5-d316-5fea-a8c4-fd930733415f"
+		id = "03d87988-1fa8-5eee-b48a-083162f37d59"
 		date = "2021-03-24"
 		modified = "2021-03-25"
 		reference = "https://ibsensoftware.com/files/aPLib-1.1.1.zip"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/aPLib_decompression.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "1150701724fdb487ebe8fb959afd12fff37a8e9137cb94e78e976a2566ec5fa4"
+		logic_hash = "v1_sha256_1150701724fdb487ebe8fb959afd12fff37a8e9137cb94e78e976a2566ec5fa4"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114537,20 +114774,20 @@ rule R3C0NST_Aplib_Decompression : FILE
 		$pattern3 = { 73 0A 80 FC 05 73 ?? 83 F8 7F 77 }
 
 	condition:
-		filesize <10MB and all of them
+		filesize < 10MB and all of them
 }
 rule R3C0NST_UNC2891_Caketap
 {
 	meta:
 		description = "Detects UNC2891 Rootkit Caketap"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "9c2ffe3d-69ca-5f93-bdb1-40e449139dec"
+		id = "418ee3b1-1091-5567-90dc-1f85845f0869"
 		date = "2022-03-30"
 		modified = "2023-01-05"
 		reference = "https://github.com/fboldewin/YARA-rules/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Caketap.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "530a7d062a218217d2c05460428b2576c3fe2a6099c93940aabde73c513a8914"
+		logic_hash = "v1_sha256_530a7d062a218217d2c05460428b2576c3fe2a6099c93940aabde73c513a8914"
 		score = 75
 		quality = 88
 		tags = ""
@@ -114562,20 +114799,20 @@ rule R3C0NST_UNC2891_Caketap
 		$code2 = {41 C6 46 01 3D 41 C6 46 08 32}
 
 	condition:
-		uint32(0)==0x464c457f and ( all of ($code*) or ( all of ($str*) and #str2==2))
+		uint32( 0 ) == 0x464c457f and ( all of ( $code* ) or ( all of ( $str* ) and #str2 == 2 ) )
 }
 rule R3C0NST_Gamaredon_Getimportbyhash : FILE
 {
 	meta:
 		description = "Detects Gamaredon APIHashing"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "8f28273e-e8ca-52cb-8dbc-a235598b1975"
+		id = "c10d6a44-e990-5559-a541-ce0d938592aa"
 		date = "2021-05-12"
 		modified = "2021-05-12"
 		reference = "https://github.com/fboldewin/YARA-rules/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/APT.Gamaredon.GetImportByHash.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "b3baebfb745ebc7b9e6df746bfa9622f925b8e8130932e44a148881e7d1fc162"
+		logic_hash = "v1_sha256_b3baebfb745ebc7b9e6df746bfa9622f925b8e8130932e44a148881e7d1fc162"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114588,20 +114825,20 @@ rule R3C0NST_Gamaredon_Getimportbyhash : FILE
 		$djb2Hashing = { 8B 75 08 BA 05 15 00 00 8B C2 C1 E2 05 03 D0 33 DB 8A 1E 03 D3 46 33 DB 8A 1E 85 DB 75 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule R3C0NST_ATM_Malware_Ripper : ATMRIPPER MALWARE FILE
 {
 	meta:
 		description = "Rule detects Thailand ATM Jackpot malware RIPPER (unpacked)"
 		author = "Frank Boldewin"
-		id = "38dfda5b-45cc-55d4-b619-91fa31c09a09"
+		id = "6e57c86c-e89d-5bfe-80fd-60140c723704"
 		date = "2016-08-01"
 		modified = "2019-02-27"
 		reference = "https://github.com/fboldewin/YARA-rules/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Ripper.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "bb7b474330defe6d071b9595687d4510961055fa243a26306698c1e029a935f1"
+		logic_hash = "v1_sha256_bb7b474330defe6d071b9595687d4510961055fa243a26306698c1e029a935f1"
 		score = 75
 		quality = 90
 		tags = "ATMRIPPER, MALWARE, FILE"
@@ -114617,7 +114854,7 @@ rule R3C0NST_ATM_Malware_Ripper : ATMRIPPER MALWARE FILE
 		$Service = "DBACKUP SERVICE" nocase wide
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 2 of ($Card_Hash*) and all of ($Code_Bytes*) and filesize <400KB and ($Service in (0x2f000..0x30000))
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and 2 of ( $Card_Hash* ) and all of ( $Code_Bytes* ) and filesize < 400KB and ( $Service in ( 0x2f000 .. 0x30000 ) )
 }
 import "pe"
 
@@ -114626,13 +114863,13 @@ rule R3C0NST_ATM_CINEO4060_Blackbox : FILE
 	meta:
 		description = "Detects Malware samples for Diebold Nixdorf CINEO 4060 ATMs used in blackboxing attacks across Europe since May 2021"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "8fa26e1c-2931-59c8-9cec-20dc6684b8d6"
+		id = "9a22c671-a442-5ba2-85b5-24fe5669baa6"
 		date = "2021-05-25"
 		modified = "2022-06-21"
 		reference = "https://twitter.com/r3c0nst/status/1539036442516660224"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM_CINEO4060_Blackbox.yar#L3-L27"
 		license_url = "N/A"
-		logic_hash = "80b919d03c1b9a198611994eaf2fafaf8254c73a6f0edb53b2b3eb90ea70d915"
+		logic_hash = "v1_sha256_80b919d03c1b9a198611994eaf2fafaf8254c73a6f0edb53b2b3eb90ea70d915"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114651,20 +114888,20 @@ rule R3C0NST_ATM_CINEO4060_Blackbox : FILE
 		$TRICK3 = {6A 06 8B 45 FC 8B 00 B1 4F BA 1C 00 00 00}
 
 	condition:
-		( uint16(0)==0x4b50 and filesize <50KB and all of ($MyAgent*)) or ( uint16(0)==0x5A4D and (pe.characteristics&pe.DLL) and $Hook and $Delphi and all of ($WMIHOOK*) or all of ($TRICK*))
+		( uint16( 0 ) == 0x4b50 and filesize < 50KB and all of ( $MyAgent* ) ) or ( uint16( 0 ) == 0x5A4D and ( pe.characteristics & pe.DLL ) and $Hook and $Delphi and all of ( $WMIHOOK* ) or all of ( $TRICK* ) )
 }
 rule R3C0NST_UNC2891_Winghook : FILE
 {
 	meta:
 		description = "Detects UNC2891 Winghook Keylogger"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "e5955fa0-8204-58e3-88a6-de4b47756ede"
+		id = "5c45f2d6-d04c-5ea2-b5c5-d0a4cdc38158"
 		date = "2022-03-30"
 		modified = "2023-01-05"
 		reference = "https://github.com/fboldewin/YARA-rules/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Winghook.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "b821d0809a91c54d06764f5a04c458ec7190b41823b2fe65d198342715f22050"
+		logic_hash = "v1_sha256_b821d0809a91c54d06764f5a04c458ec7190b41823b2fe65d198342715f22050"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114677,21 +114914,21 @@ rule R3C0NST_UNC2891_Winghook : FILE
 		$str2 = "read" ascii
 
 	condition:
-		uint32(0)==0x464c457f and filesize <100KB and 1 of ($code*) and all of ($str*)
+		uint32( 0 ) == 0x464c457f and filesize < 100KB and 1 of ( $code* ) and all of ( $str* )
 }
 rule R3C0NST_ATM_Malware_Loup : FILE
 {
 	meta:
 		description = "Detects ATM Malware Loup"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "4786362f-b2c5-5b69-8b06-9216561286e6"
+		id = "61ff98bb-b8c4-5437-b9c7-54d920245413"
 		date = "2020-08-17"
 		modified = "2020-08-17"
 		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Loup.yar#L1-L16"
 		license_url = "N/A"
 		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
-		logic_hash = "39efced4ee3a6147acf5732e4be3a5e9859268b35b79f5e8e87d7c4d77a588c0"
+		logic_hash = "v1_sha256_39efced4ee3a6147acf5732e4be3a5e9859268b35b79f5e8e87d7c4d77a588c0"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114702,20 +114939,20 @@ rule R3C0NST_ATM_Malware_Loup : FILE
 		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8}
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and all of ($String*) and $Code
+		uint16( 0 ) == 0x5A4D and filesize < 100KB and all of ( $String* ) and $Code
 }
 rule R3C0NST_Shellcode_Apihashing_FIN8
 {
 	meta:
 		description = "Detects FIN8 Shellcode APIHashing"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "a5b4a925-c4cc-5d3a-a2f1-3372f77ceea2"
+		id = "ddd4bc7c-f71a-54f4-a4c5-fe8157519dd2"
 		date = "2021-03-16"
 		modified = "2021-03-25"
 		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Shellcode.APIHashing.FIN8.yar#L1-L74"
 		license_url = "N/A"
-		logic_hash = "958d6a3c0c78ad22fb56896d6a97b9fe79c56813dc36a37385f3ce5621008624"
+		logic_hash = "v1_sha256_958d6a3c0c78ad22fb56896d6a97b9fe79c56813dc36a37385f3ce5621008624"
 		score = 75
 		quality = 90
 		tags = ""
@@ -114726,23 +114963,21 @@ rule R3C0NST_Shellcode_Apihashing_FIN8
 		$APIHashing64bit = {49 BF 65 19 6D 1E F2 55 03 88 49 BE 37 5C 32 F4 9B 59 27 21}
 
 	condition:
-		all of ($APIHashing32bit*) or $APIHashing64bit
+		all of ( $APIHashing32bit* ) or $APIHashing64bit
 }
-import "hash"
-
 rule R3C0NST_ATM_Malware_NVISOSPIT : FILE
 {
 	meta:
 		description = "Detects ATM Malware NVISOSPIT"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "faf9e78e-9d7a-5c9b-a08e-90b895333d5c"
+		id = "c98eb677-32cd-5cc6-b401-9dcc7b3484f2"
 		date = "2019-05-31"
 		modified = "2019-05-31"
 		reference = "https://twitter.com/r3c0nst/status/1134403094157115392"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.NVISOSPIT.yar#L3-L18"
 		license_url = "N/A"
 		hash = "d7ce7b152f0da49e96fa32a9336b35253905d9940b001288d0df55d8f8b3951f"
-		logic_hash = "11c1fea74b72a7821ce76a95846a2caff7354e71906496d9530cb44339a49a98"
+		logic_hash = "v1_sha256_11c1fea74b72a7821ce76a95846a2caff7354e71906496d9530cb44339a49a98"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114753,20 +114988,20 @@ rule R3C0NST_ATM_Malware_NVISOSPIT : FILE
 		$Code = {C6 85 7D F9 FF FF 4D C6 85 7E F9 FF FF 4D C6 85 7F F9 FF FF 4B}
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and 2 of them
+		uint16( 0 ) == 0x5A4D and filesize < 100KB and 2 of them
 }
 rule R3C0NST_Ransomware_Germanwiper : FILE
 {
 	meta:
 		description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "ea71849e-62a1-5b4d-9cf7-0728192361cc"
+		id = "9027a17f-0e5c-5b14-8588-e1914fe95ecd"
 		date = "2019-08-05"
 		modified = "2019-08-05"
 		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Ransomware.Germanwiper.yar#L1-L25"
 		license_url = "N/A"
-		logic_hash = "563ad59abd09d9a5fcfcf5ed48dc1e3c48b4bb198c20721d5af531da20d2b0d3"
+		logic_hash = "v1_sha256_563ad59abd09d9a5fcfcf5ed48dc1e3c48b4bb198c20721d5af531da20d2b0d3"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114787,20 +115022,20 @@ rule R3C0NST_Ransomware_Germanwiper : FILE
 		$RansomNote = "Entschluesselungs_Anleitung.html" nocase ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1000KB and 5 of them
+		uint16( 0 ) == 0x5A4D and filesize < 1000KB and 5 of them
 }
 rule R3C0NST_UNC2891_Slapstick : FILE
 {
 	meta:
 		description = "Detects UNC2891 Slapstick pam backdoor"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "a731acff-f657-5877-859e-7447230576df"
+		id = "c7774a73-3eee-5bc9-bc9c-aead8151e7bb"
 		date = "2022-03-30"
 		modified = "2023-01-05"
 		reference = "https://github.com/fboldewin/YARA-rules/"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Slapstick.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "7777c3b850f5b7ee326be5461ebc3bf37fb201b67ada78b50575fb31f50adf9a"
+		logic_hash = "v1_sha256_7777c3b850f5b7ee326be5461ebc3bf37fb201b67ada78b50575fb31f50adf9a"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114815,20 +115050,20 @@ rule R3C0NST_UNC2891_Slapstick : FILE
 		$str4 = "ACCESS GRANTED & WELCOME" xor
 
 	condition:
-		uint32(0)==0x464c457f and filesize <100KB and ( all of ($code*) or all of ($str*))
+		uint32( 0 ) == 0x464c457f and filesize < 100KB and ( all of ( $code* ) or all of ( $str* ) )
 }
 rule R3C0NST_ATM_Malware_XFS_DIRECT : FILE
 {
 	meta:
 		description = "Detects ATM Malware XFS_DIRECT"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "d1551c50-d3d2-56fd-a6b7-198d3a26ac72"
+		id = "93684e56-642e-5826-897b-bcd32beec4a5"
 		date = "2019-10-18"
 		modified = "2019-10-19"
 		reference = "https://twitter.com/r3c0nst/status/1185237040583106560"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFS_DIRECT.yar#L1-L37"
 		license_url = "N/A"
-		logic_hash = "844a334d0eb8516c0ef3780e48e3dbc8e23d41c80bdff10f01407b775e72709e"
+		logic_hash = "v1_sha256_844a334d0eb8516c0ef3780e48e3dbc8e23d41c80bdff10f01407b775e72709e"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114857,7 +115092,7 @@ rule R3C0NST_ATM_Malware_XFS_DIRECT : FILE
 		$Code2 = {8B ?? ?? ?? 68 2E 01 00 00 52 C7 ?? 06 01 00 00 00}
 
 	condition:
-		uint16(0)==0x5A4D and ( filesize <1500KB and all of ($EncLayer*)) or ( filesize <300KB and 4 of ($String*) and all of ($Code*))
+		uint16( 0 ) == 0x5A4D and ( filesize < 1500KB and all of ( $EncLayer* ) ) or ( filesize < 300KB and 4 of ( $String* ) and all of ( $Code* ) )
 }
 import "pe"
 
@@ -114866,13 +115101,13 @@ rule R3C0NST_ATM_Malware_Ploutusi : FILE
 	meta:
 		description = "Detects Ploutus I .NET samples based on MetabaseQ report"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "02104112-6f81-5d19-935d-45cfcd2fa41c"
+		id = "cdd6a63c-b961-5f01-84a1-27cfc6f59a4c"
 		date = "2021-03-03"
 		modified = "2021-03-04"
 		reference = "https://www.metabaseq.com/recursos/ploutus-is-back-targeting-itautec-atms-in-latin-america"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Ploutus-I.yar#L3-L26"
 		license_url = "N/A"
-		logic_hash = "77100d300a40219187f5c4b8270f599a91652b69980fe450b791181b8c30b5a4"
+		logic_hash = "v1_sha256_77100d300a40219187f5c4b8270f599a91652b69980fe450b791181b8c30b5a4"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114885,20 +115120,20 @@ rule R3C0NST_ATM_Malware_Ploutusi : FILE
 		$Code = {28 ?? 02 00 06 2a}
 
 	condition:
-		filesize <300KB and $Code and pe.pdb_path contains "Diebold.pdb" and pe.imports("mscoree.dll","_CorExeMain") and ( for any i in (0..pe.number_of_resources-1) : (pe.resources[i].type==pe.RESOURCE_TYPE_VERSION and (pe.version_info["InternalName"] contains "Diebold.exe")))
+		filesize < 300KB and $Code and pe.pdb_path contains "Diebold.pdb" and pe.imports ( "mscoree.dll" , "_CorExeMain" ) and ( for any i in ( 0 .. pe.number_of_resources - 1 ) : ( pe.resources [ i ] . type == pe.RESOURCE_TYPE_VERSION and ( pe.version_info [ "InternalName" ] contains "Diebold.exe" ) ) )
 }
 rule R3C0NST_ATM_Malware_XFSADM : FILE
 {
 	meta:
 		description = "Detects ATM Malware XFSADM"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "57124fef-73a1-5978-b165-b1b7d7c1196e"
+		id = "97fcc566-a0a9-5d3e-a142-90bd57280eae"
 		date = "2019-06-21"
 		modified = "2019-07-11"
 		reference = "https://twitter.com/r3c0nst/status/1149043362244308992"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFSADM.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "2dd0b9e0a2dd18725c9342a234520c96c6b30cf3ce7196562b2380a39f5f8673"
+		logic_hash = "v1_sha256_2dd0b9e0a2dd18725c9342a234520c96c6b30cf3ce7196562b2380a39f5f8673"
 		score = 75
 		quality = 84
 		tags = "FILE"
@@ -114918,20 +115153,20 @@ rule R3C0NST_ATM_Malware_XFSADM : FILE
 		$TmpFile = "~pipe.tmp" nocase ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <500KB and 4 of them
+		uint16( 0 ) == 0x5A4D and filesize < 500KB and 4 of them
 }
 rule R3C0NST_ATM_Malware_Dispcashbr : FILE
 {
 	meta:
 		description = "Detects ATM Malware DispCashBR"
 		author = "Frank Boldewin (@r3c0nst)"
-		id = "17d22120-0ca2-5b27-9816-21ab4a6fb20c"
+		id = "b1d93e57-a37a-54b3-b8c6-0ccddc451d0b"
 		date = "2020-02-27"
 		modified = "2020-08-17"
 		reference = "https://twitter.com/r3c0nst/status/1232944566208286720"
 		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.DispCashBR.yar#L1-L21"
 		license_url = "N/A"
-		logic_hash = "3fb5d62cb779ddc13e9b938290dfa9d2a3353d7969e639a662c1bcaca945de4d"
+		logic_hash = "v1_sha256_3fb5d62cb779ddc13e9b938290dfa9d2a3353d7969e639a662c1bcaca945de4d"
 		score = 75
 		quality = 90
 		tags = "FILE"
@@ -114948,16 +115183,16 @@ rule R3C0NST_ATM_Malware_Dispcashbr : FILE
 		$Code3 = {89 4C 24 08 C7 44 24 04 2E 01 00 00 89 04 24 E8}
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and 2 of ($String*) and 1 of ($DbgStr*) and all of ($Code*)
+		uint16( 0 ) == 0x5A4D and filesize < 100KB and 2 of ( $String* ) and 1 of ( $DbgStr* ) and all of ( $Code* )
 }
 /*
  * YARA Rule Set
  * Repository Name: CAPE
  * Repository: https://github.com/kevoreilly/CAPEv2
- * Retrieval Date: 2024-12-08
- * Git Commit: ca46353c771fd52356f83576df5b5c783af00d48
+ * Retrieval Date: 2024-12-15
+ * Git Commit: 7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43
  * Number of Rules: 165
- * Skipped: 0 (age), 14 (quality), 3 (score), 0 (importance)
+ * Skipped: 0 (age), 13 (quality), 3 (score), 0 (importance)
  *
  *
  * LICENSE
@@ -115633,13 +115868,13 @@ rule CAPE_Themida : FILE
 	meta:
 		description = "Themida Packer"
 		author = "kevoreilly"
-		id = "cd5c8b08-4864-57f7-b218-1bcb6892bea8"
+		id = "aa71ae58-2673-5c86-9c05-153c7d112f45"
 		date = "2024-09-11"
 		modified = "2024-09-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/binaries/Themida.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "c4f1e01a3fe3cb66062ce03253bfe9edc09dc6f1a77db99b281106e8ceff9257"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/binaries/Themida.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_c4f1e01a3fe3cb66062ce03253bfe9edc09dc6f1a77db99b281106e8ceff9257"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115649,20 +115884,20 @@ rule CAPE_Themida : FILE
 		$code = {FC 31 C9 49 89 CA 31 C0 31 DB AC 30 C8 88 E9 88 D5 88 F2 B6 08 66 D1 EB 66 D1 D8 73 09}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Megacortex : FILE
 {
 	meta:
 		description = "MegaCortex Payload"
 		author = "kevoreilly"
-		id = "ea3dd937-2cb1-5b0f-98b8-154aacaf8650"
+		id = "e7b56c55-dd08-53cf-9a20-3d15c524318f"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/MegaCortex.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "5de1d8241260070241c91b97f18feb2a90069e3b158e863e2d9f568799c244e6"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/MegaCortex.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_5de1d8241260070241c91b97f18feb2a90069e3b158e863e2d9f568799c244e6"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115674,20 +115909,20 @@ rule CAPE_Megacortex : FILE
 		$sha256 = {98 2F 8A 42 91 44 37 71 CF FB C0 B5 A5 DB B5 E9}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Sedreco : FILE
 {
 	meta:
 		description = "Sedreco encrypt function entry"
 		author = "kevoreilly"
-		id = "5b9ee4af-50a4-597c-8fa5-f2094c312d23"
+		id = "1802d857-dfc9-59fe-b678-5eb28685a697"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Sedreco.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "f735549606917f59a19157e604e54766e4456bc5d46e94cae3e0a3c18b52a7ca"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Sedreco.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_f735549606917f59a19157e604e54766e4456bc5d46e94cae3e0a3c18b52a7ca"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115699,20 +115934,20 @@ rule CAPE_Sedreco : FILE
 		$encrypt64_1 = {48 89 4C 24 08 53 55 56 57 41 54 41 56 48 83 EC 18 45 8D 34 10 48 8B E9 B8 AB AA AA AA 4D 8B E1 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA}
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt1 or $encrypt2 or $encrypt64_1
+		uint16( 0 ) == 0x5A4D and $encrypt1 or $encrypt2 or $encrypt64_1
 }
 rule CAPE_Kronos : FILE
 {
 	meta:
 		description = "Kronos Payload"
 		author = "kevoreilly"
-		id = "921a939b-a037-5973-bd8e-f9f55fce7f0f"
+		id = "b6a3b572-bc95-5787-8e22-4f84ce0356d0"
 		date = "2020-07-02"
 		modified = "2020-07-02"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Kronos.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "52ce9caf3627efe8ae86df6ca59e51e9f738e13ac0265f797e8d70123dbcaeb3"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Kronos.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_52ce9caf3627efe8ae86df6ca59e51e9f738e13ac0265f797e8d70123dbcaeb3"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115725,20 +115960,20 @@ rule CAPE_Kronos : FILE
 		$a4 = "Kronos" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and (2 of ($a*))
+		uint16( 0 ) == 0x5A4D and ( 2 of ( $a* ) )
 }
 rule CAPE_Varenyky : FILE
 {
 	meta:
 		description = "Varenyky Payload"
 		author = "kevoreilly"
-		id = "e01695fa-72a0-5d8e-86ab-8c909d28b8ec"
+		id = "40d4c34c-3afe-5681-b894-b133ac4c944e"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Varenyky.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "602f1b8b60b29565eabe2171fde4eb58546af68f8acecad402a7a51ea9a08ed9"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Varenyky.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_602f1b8b60b29565eabe2171fde4eb58546af68f8acecad402a7a51ea9a08ed9"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115748,21 +115983,21 @@ rule CAPE_Varenyky : FILE
 		$onion = "jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion"
 
 	condition:
-		uint16(0)==0x5A4D and ($onion)
+		uint16( 0 ) == 0x5A4D and ( $onion )
 }
 rule CAPE_Amadey : FILE
 {
 	meta:
 		description = "Amadey Payload"
 		author = "kevoreilly"
-		id = "b9d81aa8-5504-5b71-86c7-8c00d75479ad"
+		id = "e01382a4-3380-57c9-b495-c1b644897e28"
 		date = "2023-09-04"
 		modified = "2023-09-04"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Amadey.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Amadey.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "988258716d5296c1323303e8fe4efd7f4642c87bfdbe970fe9a3bb3f410f70a4"
-		logic_hash = "38f710b422a3644c9f0f3e80ad9ff28ef02050368c651a6cc2ce8b152b67bf48"
+		logic_hash = "v1_sha256_38f710b422a3644c9f0f3e80ad9ff28ef02050368c651a6cc2ce8b152b67bf48"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115774,20 +116009,20 @@ rule CAPE_Amadey : FILE
 		$decode3 = {8A 04 02 88 04 0F 41 8B 7D ?? 8D 42 01 3B CB 7C}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Rokrat : FILE
 {
 	meta:
 		description = "RokRat Payload"
 		author = "kevoreilly"
-		id = "12e05b90-9771-5901-ae82-9fd2ea6263e7"
+		id = "59353f62-2563-55c8-bce1-e217c21eae04"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/RokRat.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "2aaa7de7ccd59e0da690f4bc0c7deaacf61314d61f8d2aa3ce6f6892f50612ec"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/RokRat.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_2aaa7de7ccd59e0da690f4bc0c7deaacf61314d61f8d2aa3ce6f6892f50612ec"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115798,20 +116033,20 @@ rule CAPE_Rokrat : FILE
 		$string1 = "/pho_%s_%d.jpg" wide
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($code*)) and ( any of ($string*))
+		uint16( 0 ) == 0x5A4D and ( any of ( $code* ) ) and ( any of ( $string* ) )
 }
 rule CAPE_Eternalromance : FILE
 {
 	meta:
 		description = "EternalRomance Exploit"
 		author = "kevoreilly"
-		id = "34035076-9dda-5e32-bd0b-d0257a96329b"
+		id = "b8510e8b-fd5a-5934-8d97-39910f8a8b1e"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/EternalRomance.yar#L1-L33"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "5390fae3e2411a715cdc965df8648c0c4c511d53d5f76031714f1b784b58eb0d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/EternalRomance.yar#L1-L33"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_5390fae3e2411a715cdc965df8648c0c4c511d53d5f76031714f1b784b58eb0d"
 		score = 75
 		quality = 68
 		tags = "FILE"
@@ -115843,20 +116078,20 @@ rule CAPE_Eternalromance : FILE
 		$pipe12 = "wkssvc"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($SMB*)) and $ipc and ( any of ($session*)) and ( any of ($pipe*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $SMB* ) ) and $ipc and ( any of ( $session* ) ) and ( any of ( $pipe* ) )
 }
 rule CAPE_Vidar : FILE
 {
 	meta:
 		description = "Vidar Payload"
 		author = "kevoreilly,rony"
-		id = "9e4e797f-880e-54eb-ad44-caad0ec5683c"
+		id = "0759ea8a-2be5-5402-9cc9-3477c1483924"
 		date = "2023-04-21"
 		modified = "2023-04-21"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Vidar.yar#L1-L22"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "5d4c030536ed41cf4e0dcb77b2fe4553d789ee2b8095a4b3e050692335a8709d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Vidar.yar#L1-L22"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_5d4c030536ed41cf4e0dcb77b2fe4553d789ee2b8095a4b3e050692335a8709d"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115877,20 +116112,20 @@ rule CAPE_Vidar : FILE
 		$s8 = "Downloads\\%s_%s.txt" fullword ascii wide
 
 	condition:
-		uint16be(0)==0x4d5a and 6 of them
+		uint16be( 0 ) == 0x4d5a and 6 of them
 }
 rule CAPE_Zeuspanda : FILE
 {
 	meta:
 		description = "ZeusPanda Payload"
 		author = "kevoreilly"
-		id = "7891c021-6687-5457-b9e1-0beb0472647c"
+		id = "ad0f23bd-9622-567f-89e2-277a6d63b4e8"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/ZeusPanda.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "43d8a56cae9fd23c053f6956851734d3270b46a906236854502c136e3bb1e761"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/ZeusPanda.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_43d8a56cae9fd23c053f6956851734d3270b46a906236854502c136e3bb1e761"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115901,20 +116136,20 @@ rule CAPE_Zeuspanda : FILE
 		$code2 = {8D 85 B0 FD FF FF 50 68 ?? ?? ?? ?? 8D 85 90 FA FF FF 68 0E 01 00 00 50 E8 ?? ?? ?? ?? 83 C4 10 83 F8 FF 7E ?? 68 04 01 00 00 8D 85 B0 FD FF FF}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Nettraveler : FILE
 {
 	meta:
 		description = "NetTraveler Payload"
 		author = "kevoreilly"
-		id = "242e1c3f-5460-5393-9c07-cfab25860796"
+		id = "70c62d7c-38df-5162-8891-830363008a27"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/NetTraveler.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "bf5026f1a1cb3d6986a29d22657a9f1904b362391a6715d7468f8f8aca351233"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/NetTraveler.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_bf5026f1a1cb3d6986a29d22657a9f1904b362391a6715d7468f8f8aca351233"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115926,20 +116161,20 @@ rule CAPE_Nettraveler : FILE
 		$string3 = "Memory: Total:%dMB,Left:%dMB (for %.2f%s)"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Buerloader : FILE
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "kevoreilly & Rony (@r0ny_123)"
-		id = "95a9b4d7-db1e-50cd-bc08-01e4e4fd6dc4"
+		id = "ae102f11-4258-59e8-ac06-084707d809b4"
 		date = "2022-05-31"
 		modified = "2022-05-31"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/BuerLoader.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "05c1f008f0a2bb8232867977fb23a5ae8312f10f0637c6265561052596319c29"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/BuerLoader.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_05c1f008f0a2bb8232867977fb23a5ae8312f10f0637c6265561052596319c29"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115951,20 +116186,20 @@ rule CAPE_Buerloader : FILE
 		$op = {33 C0 85 D2 7E 1? 3B C7 7D [0-15] 40 3B C2 7C ?? EB 02}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Petya : FILE
 {
 	meta:
 		description = "Petya Payload"
 		author = "kevoreilly"
-		id = "e581747c-c40f-5689-84b4-d55134b532f7"
+		id = "5f036bc7-a580-5c27-bc5a-955db340102c"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Petya.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "f819261bb34f3b2eb7dc2f843b56be25105570fe902a77940a632a54fbe0d014"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Petya.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_f819261bb34f3b2eb7dc2f843b56be25105570fe902a77940a632a54fbe0d014"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -115976,21 +116211,21 @@ rule CAPE_Petya : FILE
 		$a3 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" wide
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Oyster
 {
 	meta:
 		description = "Oyster Payload"
 		author = "enzok"
-		id = "29443d00-e3de-53fd-b617-df470a30e805"
+		id = "0b785600-5165-5e76-b991-f6e1885884eb"
 		date = "2024-05-30"
 		modified = "2024-05-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Oyster.yar#L1-L19"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Oyster.yar#L1-L19"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "8bae0fa9f589cd434a689eebd7a1fde949cc09e6a65e1b56bb620998246a1650"
-		logic_hash = "23ab1518712dbce8319b87785d7ffc0c2b61de82c2bbf533ebf0aae39ec33540"
+		logic_hash = "v1_sha256_23ab1518712dbce8319b87785d7ffc0c2b61de82c2bbf533ebf0aae39ec33540"
 		score = 75
 		quality = 70
 		tags = ""
@@ -116014,13 +116249,13 @@ rule CAPE_Zerot : FILE
 	meta:
 		description = "ZeroT Payload"
 		author = "kevoreilly"
-		id = "dc5dc18c-2ec6-541d-905c-42543f17b16d"
+		id = "73d5355d-7133-5a8a-aeac-0a42194a2603"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/ZeroT.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "f60ae25ac3cd741b8bdc5100b5d3c474b5d9fbe8be88bfd184994bae106c3803"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/ZeroT.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_f60ae25ac3cd741b8bdc5100b5d3c474b5d9fbe8be88bfd184994bae106c3803"
 		score = 75
 		quality = 68
 		tags = "FILE"
@@ -116034,20 +116269,20 @@ rule CAPE_Zerot : FILE
 		$string4 = "open"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Quasarrat : FILE
 {
 	meta:
 		description = "QuasarRAT payload"
 		author = "ditekshen"
-		id = "f256b88f-eee6-5f8c-afd6-32ed10ea908d"
+		id = "f2b5ea2f-bfed-5c69-8771-20e610eeb1b5"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/QuasarRAT.yar#L1-L22"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "556b19dc0980761198ea31a285f281adae084463d24bff1eda15326436ad562b"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/QuasarRAT.yar#L1-L22"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_556b19dc0980761198ea31a285f281adae084463d24bff1eda15326436ad562b"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116069,20 +116304,20 @@ rule CAPE_Quasarrat : FILE
 		$us2 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ($mutex or ( all of ($ua*) and 2 of them ) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( $mutex or ( all of ( $ua* ) and 2 of them ) or 6 of ( $s* ) )
 }
 rule CAPE_Quasarrat_Kingrat
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "jeFF0Falltrades"
-		id = "dc0139e1-9f69-51da-b28f-212358b2f68b"
+		id = "bc63e504-9508-50a1-80de-635ccd5ea275"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/QuasarRAT.yar#L24-L43"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "1f4296a592134edbe52e256dc353143af02e897ff1afad98f3dac0c5ab13f3f7"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/QuasarRAT.yar#L24-L43"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_1f4296a592134edbe52e256dc353143af02e897ff1afad98f3dac0c5ab13f3f7"
 		score = 75
 		quality = 70
 		tags = ""
@@ -116102,20 +116337,20 @@ rule CAPE_Quasarrat_Kingrat
 		$patt_verify_hash = { 7e [3] 04 6f [3] 0a 6f [3] 0a 74 [3] 01 }
 
 	condition:
-		6 of them and #patt_config>=10
+		6 of them and #patt_config >= 10
 }
 rule CAPE_Ursnif : FILE
 {
 	meta:
 		description = "Ursnif Payload"
 		author = "kevoreilly & enzo"
-		id = "200c2227-0d34-5e4a-b5aa-ab63a077d141"
+		id = "d6392693-7bcb-52eb-b7ce-5e714a2728d1"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Ursnif.yar#L1-L19"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "46e79fde81ff5352314618021e394b2e0322df07170c7279363290b7134935fd"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Ursnif.yar#L1-L19"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_46e79fde81ff5352314618021e394b2e0322df07170c7279363290b7134935fd"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116132,20 +116367,20 @@ rule CAPE_Ursnif : FILE
 		$decrypt_config32 = {8B ?? 08 5? 33 F? 3B [1-2] 74 14 A1 0? ?? ?? ?? 35 ?? ?? ?? ?? 50 8B D? E8 ?? D? 00 00 EB 02 33 C0 ?B ?? ?? ?? ?? ?? ?? ?? 74 14 8D 4D ?? ?? ?? 50 FF D? 85 C0 74 08}
 
 	condition:
-		uint16(0)==0x5A4D and ($decrypt_config64 and any of ($crypto64*)) or ($decrypt_config32 and any of ($crypto32*))
+		uint16( 0 ) == 0x5A4D and ( $decrypt_config64 and any of ( $crypto64* ) ) or ( $decrypt_config32 and any of ( $crypto32* ) )
 }
 rule CAPE_Tscookie : FILE
 {
 	meta:
 		description = "TSCookie Payload"
 		author = "kevoreilly"
-		id = "e1efd356-7170-5454-bf40-68927c71816c"
+		id = "7ecf4235-c03b-5abf-83cd-72e1cf6694f7"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/TSCookie.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "0461c7fd14c74646437654f0a63a4a89d4efad620e197a8ca1e8d390618842c3"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/TSCookie.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_0461c7fd14c74646437654f0a63a4a89d4efad620e197a8ca1e8d390618842c3"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116157,20 +116392,20 @@ rule CAPE_Tscookie : FILE
 		$string3 = "\\wship6"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Dridexv4 : FILE
 {
 	meta:
 		description = "Dridex v4 Payload"
 		author = "kevoreilly"
-		id = "c396f664-9f0d-50ac-bce8-33fd8712645a"
+		id = "0ec7095b-fad7-51f7-9d99-ad1b47bfcf24"
 		date = "2022-05-31"
 		modified = "2022-05-31"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/DridexV4.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "cb103fe5f2d4792e3c612db4e2d84a4c8b0ce0f9a8443e9147e2c345f1dbdff6"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/DridexV4.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_cb103fe5f2d4792e3c612db4e2d84a4c8b0ce0f9a8443e9147e2c345f1dbdff6"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116184,20 +116419,20 @@ rule CAPE_Dridexv4 : FILE
 		$bot_stub_64 = {8B 44 24 ?? 89 C1 89 CA 4C 8B 05 [4] 4C 8B 4C 24 ?? 45 8A 14 11 83 E0 1F 89 C0 41 89 C3 47 2A 14 18 44 88 54 14}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Seduploader : FILE
 {
 	meta:
 		description = "Seduploader decrypt function"
 		author = "kevoreilly"
-		id = "a7152d8c-a197-5784-8a6d-453d41585df1"
+		id = "16204882-e060-5271-b15e-cb02694f22f6"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Seduploader.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "d70c886699169d4dafc5b063c93682a34af5667df6d293b52256ddc19ab9c516"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Seduploader.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_d70c886699169d4dafc5b063c93682a34af5667df6d293b52256ddc19ab9c516"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116207,20 +116442,20 @@ rule CAPE_Seduploader : FILE
 		$decrypt1 = {8D 0C 30 C7 45 FC 0A 00 00 00 33 D2 F7 75 FC 8A 82 ?? ?? ?? ?? 32 04 0F 88 01 8B 45 0C 40 89 45 0C 3B C3 7C DB}
 
 	condition:
-		uint16(0)==0x5A4D and any of ($decrypt*)
+		uint16( 0 ) == 0x5A4D and any of ( $decrypt* )
 }
 rule CAPE_Wanacry : FILE
 {
 	meta:
 		description = "WanaCry Payload"
 		author = "kevoreilly"
-		id = "a6525e0f-fccd-5542-9be8-e42d708fe502"
+		id = "5018de3a-dde6-5a49-867b-2ae3629da70e"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/WanaCry.yar#L1-L16"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "16d5e39f043d27bbf22f8f21e13971b7e0709b07e44746dd157d11ee4cc51944"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/WanaCry.yar#L1-L16"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_16d5e39f043d27bbf22f8f21e13971b7e0709b07e44746dd157d11ee4cc51944"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116234,20 +116469,20 @@ rule CAPE_Wanacry : FILE
 		$taskstart = {8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Bazar : FILE
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "kevoreilly"
-		id = "e042f180-2a82-5c93-9858-77281557dd10"
+		id = "c07c7874-de46-5875-9fa2-b1ca70c563d7"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Bazar.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "9375f59b56e47fd0b90b089afdf3be8f16f960038fc625523a2e2d5509ab099d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Bazar.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_9375f59b56e47fd0b90b089afdf3be8f16f960038fc625523a2e2d5509ab099d"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116258,20 +116493,20 @@ rule CAPE_Bazar : FILE
 		$rsa = {C7 00 52 53 41 33 48 8D 48 09 C7 40 04 00 08 00 00 4C 8D 05 [3] 00 C6 40 08 03 B8 09 00 00 00 [0-3] 48 8D 89 80 00 00 00 41 0F 10 00}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Remcos : FILE
 {
 	meta:
 		description = "Remcos Payload"
 		author = "kevoreilly"
-		id = "f77295ca-02d5-5b2c-80b8-b6566610bff8"
+		id = "10ad5554-bfc6-5fad-9be3-0da507b8e5df"
 		date = "2022-05-10"
 		modified = "2022-05-10"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Remcos.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "38142e784ad437d9592353b924f74777bb62e5ed176c811230a2021a437d4710"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Remcos.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_38142e784ad437d9592353b924f74777bb62e5ed176c811230a2021a437d4710"
 		score = 75
 		quality = 68
 		tags = "FILE"
@@ -116284,20 +116519,20 @@ rule CAPE_Remcos : FILE
 		$crypto2 = {0F B6 [1-7] 8B 45 08 [0-2] 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 ?? ?? FF FF 30 06 47 3B 7D 0C 72}
 
 	condition:
-		uint16(0)==0x5A4D and ($name) and ($time) and any of ($crypto*)
+		uint16( 0 ) == 0x5A4D and ( $name ) and ( $time ) and any of ( $crypto* )
 }
 rule CAPE_Cerber : FILE
 {
 	meta:
 		description = "Cerber Payload"
 		author = "kevoreilly"
-		id = "edf08795-cf54-5822-8bc4-35cfba0fe8e8"
+		id = "ba155915-545e-5806-ba25-54b5ed42019b"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Cerber.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "16a8f808c28d3b142c079a305aba7f553f2452e439710bf610a06f8f2924d5a3"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Cerber.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_16a8f808c28d3b142c079a305aba7f553f2452e439710bf610a06f8f2924d5a3"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116307,7 +116542,7 @@ rule CAPE_Cerber : FILE
 		$code1 = {33 C0 66 89 45 8? 8D 7D 8? AB AB AB AB AB [0-2] 66 AB 8D 45 8? [0-3] E8 ?? ?? 00 00}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 import "pe"
 
@@ -116316,13 +116551,13 @@ rule CAPE_Nighthawk
 	meta:
 		description = "NightHawk C2"
 		author = "Nikhil Ashok Hegde <@ka1do9>"
-		id = "096b9d13-6aa7-5b6e-aaeb-e25aa7c8c53f"
+		id = "e0a97066-f2cc-5888-984a-c54a6a016754"
 		date = "2022-12-05"
 		modified = "2022-12-05"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Nighthawk.yar#L3-L24"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "2d77912678e06503ffef0e8ed84aa4f9ac74357480d57742fbae619acebfb5f2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Nighthawk.yar#L3-L24"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_2d77912678e06503ffef0e8ed84aa4f9ac74357480d57742fbae619acebfb5f2"
 		score = 75
 		quality = 70
 		tags = ""
@@ -116334,21 +116569,21 @@ rule CAPE_Nighthawk
 		$aes_inv_sbox = { 52 09 6A D5 30 36 A5 38 BF }
 
 	condition:
-		pe.is_pe and for any s in pe.sections : (s.name==".profile") and all of them
+		pe.is_pe and for any s in pe.sections : ( s.name == ".profile" ) and all of them
 }
 rule CAPE_Qakbot5 : FILE
 {
 	meta:
 		description = "QakBot v5 Payload"
 		author = "kevoreilly, enzok"
-		id = "48866cdd-f60e-50b8-85f9-573710934b0b"
+		id = "af510223-ed0d-5d2c-abe1-7cec43de61ad"
 		date = "2024-04-28"
 		modified = "2024-04-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/QakBot.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/QakBot.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "59559e97962e40a15adb2237c4d01cfead03623aff1725616caeaa5a8d273a35"
-		logic_hash = "cc23a92f45619d44af824128b743c259dd9dfa7cb5106932f3425f3dfd1dccdf"
+		logic_hash = "v1_sha256_cc23a92f45619d44af824128b743c259dd9dfa7cb5106932f3425f3dfd1dccdf"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116361,20 +116596,20 @@ rule CAPE_Qakbot5 : FILE
 		$campaign = {0F B7 1D [4] B? [2] 00 00 E8 [4] 8B D3 4? 89 44 24 ?? 4? 33 C9 4? 8D 0D [4] 4? 8B C0 4? 8B F8 E8}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Qakbot4 : FILE
 {
 	meta:
 		description = "QakBot v4 Payload"
 		author = "kevoreilly"
-		id = "d2c5316c-22cc-5b6d-b6a2-b1d23a06d16b"
+		id = "478dd460-a6c7-5491-92a0-d3997d6bed67"
 		date = "2024-04-28"
 		modified = "2024-04-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/QakBot.yar#L17-L35"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "b2870e33abffbb3ff49b7891b0f5c538ab48ee63da5553929d4e37dec921344f"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/QakBot.yar#L17-L35"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_b2870e33abffbb3ff49b7891b0f5c538ab48ee63da5553929d4e37dec921344f"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116392,20 +116627,20 @@ rule CAPE_Qakbot4 : FILE
 		$call_decrypt = {83 7D ?? 00 56 74 0B FF 75 10 8B F3 E8 [4] 59 8B 45 0C 83 F8 28 72 19 8B 55 08 8B 37 8D 48 EC 6A 14 8D 42 14 52 E8}
 
 	condition:
-		uint16(0)==0x5A4D and any of ($*)
+		uint16( 0 ) == 0x5A4D and any of ( $* )
 }
 rule CAPE_Rozena
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "Kevin O'Reilly"
-		id = "38ca9da3-2a0e-500f-8eb8-9de69a7f2da5"
+		id = "6d92bdd0-f8de-578d-a554-1946611911aa"
 		date = "2024-03-15"
 		modified = "2024-03-15"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Rozena.yar#L1-L10"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "c415a8108b58a125a604031bb8d73b58a8aae5429b5b765e35fa8a4add9cd135"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Rozena.yar#L1-L10"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_c415a8108b58a125a604031bb8d73b58a8aae5429b5b765e35fa8a4add9cd135"
 		score = 75
 		quality = 70
 		tags = ""
@@ -116423,14 +116658,14 @@ rule CAPE_Zloader : FILE
 	meta:
 		description = "Zloader Payload"
 		author = "kevoreilly, enzok"
-		id = "ce0662b4-c615-5b87-b5c1-173f90a97db2"
+		id = "d467fbee-08e8-584f-818a-fd1a48ce1ebb"
 		date = "2024-05-06"
 		modified = "2024-05-06"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Zloader.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Zloader.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "adbd0c7096a7373be82dd03df1aae61cb39e0a155c00bbb9c67abc01d48718aa"
-		logic_hash = "a94efd87c69146cf5771341974e5abe789445d67dde3e045e1b87d3131539ff9"
+		logic_hash = "v1_sha256_a94efd87c69146cf5771341974e5abe789445d67dde3e045e1b87d3131539ff9"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116446,20 +116681,20 @@ rule CAPE_Zloader : FILE
 		$decrypt_key_3 = {48 8d 0d [3] 00 e8 [4] 66 89 [3] b? [4] e8 [4] 66 8b}
 
 	condition:
-		uint16(0)==0x5A4D and 1 of ($decrypt_conf*) and (1 of ($decrypt_key*) or $rc4_init)
+		uint16( 0 ) == 0x5A4D and 1 of ( $decrypt_conf* ) and ( 1 of ( $decrypt_key* ) or $rc4_init )
 }
 rule CAPE_Doomedloader : FILE
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "kevoreilly"
-		id = "88436e71-360e-5719-989f-24e71591ebe0"
+		id = "4743e58b-45ae-5e7e-95c9-c139c243489c"
 		date = "2024-05-09"
 		modified = "2024-05-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/DoomedLoader.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "54a5962ef49ebf987908c4ea1559788f7c96a7e4ea61d2973636e998a0239c77"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/DoomedLoader.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_54a5962ef49ebf987908c4ea1559788f7c96a7e4ea61d2973636e998a0239c77"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116471,20 +116706,20 @@ rule CAPE_Doomedloader : FILE
 		$syscall = {49 89 CA 8B 44 24 08 FF 64 24 10}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Icedid
 {
 	meta:
 		description = "IcedID Payload"
 		author = "kevoreilly, threathive"
-		id = "439342be-a1e6-5656-8813-5cebb0e88e98"
+		id = "ae23b8e3-d994-5dbb-959f-18bed53b54ea"
 		date = "2021-12-16"
 		modified = "2021-12-16"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/IcedID.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "e60ccbab7a360020744eba65961156ca3e2ae9cf23671014f913d71c1a96a331"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/IcedID.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_e60ccbab7a360020744eba65961156ca3e2ae9cf23671014f913d71c1a96a331"
 		score = 75
 		quality = 45
 		tags = ""
@@ -116501,20 +116736,20 @@ rule CAPE_Icedid
 		$stage_2_request_img = ".png"
 
 	condition:
-		any of ($crypt*,$download*,$major_ver) and all of ($stage_2_request_*)
+		any of ( $crypt* , $download* , $major_ver ) and all of ( $stage_2_request_* )
 }
 rule CAPE_Gandcrab : FILE
 {
 	meta:
 		description = "Gandcrab Payload"
 		author = "kevoreilly"
-		id = "0082e8c9-952e-508c-a438-4e17b8031864"
+		id = "62b88cc6-d1da-543d-9c2d-02bbf86a77e2"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Gandcrab.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "354ed566dbafbe8e9531bb771d9846952eb8c0e70ee94c26d09368159ce4142c"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Gandcrab.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_354ed566dbafbe8e9531bb771d9846952eb8c0e70ee94c26d09368159ce4142c"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116527,20 +116762,20 @@ rule CAPE_Gandcrab : FILE
 		$string4 = "KRAB-DECRYPT.txt" wide
 
 	condition:
-		uint16(0)==0x5A4D and any of ($string*)
+		uint16( 0 ) == 0x5A4D and any of ( $string* )
 }
 rule CAPE_Rcsession
 {
 	meta:
 		description = "RCSession Payload"
 		author = "kevoreilly"
-		id = "841e6bd1-4f09-54dc-8dec-2e9423a34003"
+		id = "d481c5be-dc3e-5d87-bca7-db9d03590e01"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/RCSession.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "ebd1e9e615a91c35b36332cad55519607323469df738cec4464288b45787630d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/RCSession.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_ebd1e9e615a91c35b36332cad55519607323469df738cec4464288b45787630d"
 		score = 75
 		quality = 70
 		tags = ""
@@ -116551,20 +116786,20 @@ rule CAPE_Rcsession
 		$a2 = {83 C4 10 85 C0 74 ?? BE ?? ?? ?? ?? 89 74 24 10 E8 ?? ?? ?? ?? 6A 03 68 48 0B 00 00 56 53 57 68 02 00 00 80 E8 ?? ?? ?? ?? 83 C4 18 85 C0 74 18 E8 ?? ?? ?? ?? 6A 03 68 48}
 
 	condition:
-		( any of ($a*))
+		( any of ( $a* ) )
 }
 rule CAPE_Ursnifv3 : FILE
 {
 	meta:
 		description = "UrsnifV3 Payload"
 		author = "kevoreilly"
-		id = "9dd32f80-b535-52a3-91e1-4db005362fd4"
+		id = "ee5df264-9375-5542-ada3-05895335c509"
 		date = "2023-03-23"
 		modified = "2023-03-23"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/UrsnifV3.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "501cd52388aba16f9d33b4555f310e1ad58326916b15358a485c701acb87abd8"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/UrsnifV3.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_501cd52388aba16f9d33b4555f310e1ad58326916b15358a485c701acb87abd8"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116581,20 +116816,20 @@ rule CAPE_Ursnifv3 : FILE
 		$cape_string = "cape_options"
 
 	condition:
-		uint16(0)==0x5A4D and 1 of ($crypto32_*) and $cpuid and not $cape_string
+		uint16( 0 ) == 0x5A4D and 1 of ( $crypto32_* ) and $cpuid and not $cape_string
 }
 rule CAPE_Formbook
 {
 	meta:
 		description = "Formbook Payload"
 		author = "kevoreilly"
-		id = "3389c0a7-eb86-5465-8a14-63f812d257db"
+		id = "9c31ac6d-3569-5c7a-b3d9-7c3b6f4895b8"
 		date = "2023-10-13"
 		modified = "2023-10-13"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Formbook.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "63ee4dd6fe5ed2a3e5ee88ba7de48d2c9e0024961a550d0fdb68891c9885e05e"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Formbook.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_63ee4dd6fe5ed2a3e5ee88ba7de48d2c9e0024961a550d0fdb68891c9885e05e"
 		score = 75
 		quality = 70
 		tags = ""
@@ -116618,13 +116853,13 @@ rule CAPE_Hermes : FILE
 	meta:
 		description = "Hermes Payload"
 		author = "kevoreilly"
-		id = "0ff44422-9c14-517b-9e71-8e9e19694f06"
+		id = "7f5f3476-4211-55a3-acac-d87edd001ba7"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Hermes.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "9bc974173f39a57e7adfbf8ae106a20d960557696b4c3ce16e9b4e47d3e9e95b"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Hermes.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_9bc974173f39a57e7adfbf8ae106a20d960557696b4c3ce16e9b4e47d3e9e95b"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116636,20 +116871,20 @@ rule CAPE_Hermes : FILE
 		$email = "supportdecrypt@firemail.cc" wide
 
 	condition:
-		uint16(0)==0x5A4D and all of ($*)
+		uint16( 0 ) == 0x5A4D and all of ( $* )
 }
 rule CAPE_Dcrat : FILE
 {
 	meta:
 		description = "DCRat payload"
 		author = "ditekSHen"
-		id = "16c81fe0-2c18-55e9-aa17-cfd4213d6a17"
+		id = "e4ee0c29-3c5d-53b1-b841-e34326584a31"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/DCRat.yar#L1-L66"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "5a02dcc2b9c7eb3efdba39047e37886240b45fb7e2db3b82aa5b4b9526dfb7f8"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/DCRat.yar#L1-L66"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_5a02dcc2b9c7eb3efdba39047e37886240b45fb7e2db3b82aa5b4b9526dfb7f8"
 		score = 75
 		quality = 45
 		tags = "FILE"
@@ -116710,20 +116945,20 @@ rule CAPE_Dcrat : FILE
 		$px14 = "[Other] Saving system information" wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($dc*) or all of ($string*) or 2 of ($x*) or 6 of ($v*) or 5 of ($px*)) or ($plugin and (4 of ($av*) or 5 of ($pl*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $dc* ) or all of ( $string* ) or 2 of ( $x* ) or 6 of ( $v* ) or 5 of ( $px* ) ) or ( $plugin and ( 4 of ( $av* ) or 5 of ( $pl* ) ) )
 }
 rule CAPE_Dcrat_Kingrat
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "jeFF0Falltrades"
-		id = "9b63e361-6678-5c95-be32-777feecd194b"
+		id = "850f416e-cac3-5137-a791-1e5bf6f07d1c"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/DCRat.yar#L68-L87"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "73ac27c3f0fc71d053e89690b5a7d29c1f8b0ea0a22e8595148a9001799fae54"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/DCRat.yar#L68-L87"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_73ac27c3f0fc71d053e89690b5a7d29c1f8b0ea0a22e8595148a9001799fae54"
 		score = 75
 		quality = 62
 		tags = ""
@@ -116743,20 +116978,20 @@ rule CAPE_Dcrat_Kingrat
 		$patt_verify_hash = { 7e [3] 04 6f [3] 0a 6f [3] 0a 74 [3] 01 }
 
 	condition:
-		( not any of ($venom*)) and 5 of them and #patt_config>=10
+		( not any of ( $venom* ) ) and 5 of them and #patt_config >= 10
 }
 rule CAPE_Kpot : FILE
 {
 	meta:
 		description = "Kpot Stealer"
 		author = "kevoreilly"
-		id = "724fd6ac-e734-5952-b459-01cbaffdb89d"
+		id = "80abac11-020b-5bc3-8fc6-53e7a61b61c8"
 		date = "2020-10-19"
 		modified = "2020-10-19"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Kpot.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "75abaab9a10e8ac8808425c389238285ab9bd9cb76f0cd03cc1e35b3ea0a1b0f"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Kpot.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_75abaab9a10e8ac8808425c389238285ab9bd9cb76f0cd03cc1e35b3ea0a1b0f"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116768,20 +117003,20 @@ rule CAPE_Kpot : FILE
 		$os = "OS: %S x%d"
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Emotetloader : FILE
 {
 	meta:
 		description = "Emotet Loader"
 		author = "kevoreilly"
-		id = "aea8ff2e-bdf7-5417-a41c-93566d1dd019"
+		id = "b77afddc-0296-55e3-96fa-779f34fcda1b"
 		date = "2022-05-31"
 		modified = "2022-05-31"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/EmotetLoader.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "410872d25ed3a89a2cba108f952d606cd1c3bf9ccc89ae6ab3377b83665c2773"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/EmotetLoader.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_410872d25ed3a89a2cba108f952d606cd1c3bf9ccc89ae6ab3377b83665c2773"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116791,20 +117026,20 @@ rule CAPE_Emotetloader : FILE
 		$antihook = {8B 15 ?? ?? ?? ?? 03 15 ?? ?? ?? ?? 89 95 28 FF FF FF A1 ?? ?? ?? ?? 2D 4D 01 00 00 A3 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 3B 0D ?? ?? ?? ?? 76 26 8B 95 18 FF FF FF 8B 42 38}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Gootkit : FILE
 {
 	meta:
 		description = "Gootkit Payload"
 		author = "kevoreilly"
-		id = "8935fd10-ac79-5196-80c2-fc8f2fe185b5"
+		id = "cb6409f4-307a-5b27-a3ef-b29a91055413"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Gootkit.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "26704b6b0adca51933fc9d5e097930320768fd0e9355dcefc725aee7775316e7"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Gootkit.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_26704b6b0adca51933fc9d5e097930320768fd0e9355dcefc725aee7775316e7"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116814,20 +117049,20 @@ rule CAPE_Gootkit : FILE
 		$code1 = {C7 45 ?? ?? ?? 4? 00 C7 45 ?? ?? 10 40 00 C7 45 E? D8 ?? ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 [1-2] 00 10 40 00 89 [5-6] 43 00 89 ?? ?? 68 E8 80 00 00 FF 15}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Kovter : FILE
 {
 	meta:
 		description = "Kovter Payload"
 		author = "kevoreilly"
-		id = "3dec3c4b-4678-5ed1-a4c3-c3d9abb58b1c"
+		id = "893f6090-ffa8-5b76-b64e-d49bb5fbca2e"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Kovter.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "888fccb8fbfbe6c05ec63bc5658b4743f8e10a96ef51b3868c2ff94afec76f2d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Kovter.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_888fccb8fbfbe6c05ec63bc5658b4743f8e10a96ef51b3868c2ff94afec76f2d"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116840,20 +117075,20 @@ rule CAPE_Kovter : FILE
 		$a4 = "Win Server 2008 R2"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Pikabotloader : FILE
 {
 	meta:
 		description = "Pikabot Loader"
 		author = "kevoreilly"
-		id = "e2c89cdd-0cdb-5367-8aae-2fe685eff972"
+		id = "6662e023-4085-5852-ad18-703d1fbb99d4"
 		date = "2024-03-13"
 		modified = "2024-03-13"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/PikaBot.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "7e5f1f2911545ee6bd36b54f2627fbdec1b957f4b91df901dd1c6cbd4dff0231"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/PikaBot.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_7e5f1f2911545ee6bd36b54f2627fbdec1b957f4b91df901dd1c6cbd4dff0231"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116865,20 +117100,20 @@ rule CAPE_Pikabotloader : FILE
 		$sysenter2 = {C7 44 24 0C 00 00 00 02 C7 44 24 08 00 00 00 02 8B 45 0C 89 44 24 04 8B 45 08 89 04 24 E8}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Pikabot : FILE
 {
 	meta:
 		description = "Pikabot Payload"
 		author = "kevoreilly"
-		id = "140a3e20-9837-5f66-85dc-af278d75e074"
+		id = "ae7ad8f5-e27b-5da1-9464-e1c7eb6c192d"
 		date = "2024-03-13"
 		modified = "2024-03-13"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/PikaBot.yar#L15-L28"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "ed07217c373831a9a67d914854154988696e6fcea70dedabf333385f0e7bb8b7"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/PikaBot.yar#L15-L28"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_ed07217c373831a9a67d914854154988696e6fcea70dedabf333385f0e7bb8b7"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116891,21 +117126,21 @@ rule CAPE_Pikabot : FILE
 		$config = {C7 44 24 [3] 00 00 C7 44 24 [4] 00 89 [1-4] ?? E8 [4] 31 C0 C7 44 24 [3] 00 00 89 44 24 ?? C7 04 24 [4] E8}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Pik23 : FILE
 {
 	meta:
 		description = "PikaBot Payload February 2023"
 		author = "kevoreilly"
-		id = "fc804c63-fc6c-5b26-92b1-aa5d2fbc4917"
+		id = "09a74105-77ef-5054-9b24-fa47a45715c3"
 		date = "2024-03-13"
 		modified = "2024-03-13"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/PikaBot.yar#L30-L44"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/PikaBot.yar#L30-L44"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1"
-		logic_hash = "71a71df2f2a075294941c54eed06cafaaa4d3294e45b3a0098c1cffddd0438bc"
+		logic_hash = "v1_sha256_71a71df2f2a075294941c54eed06cafaaa4d3294e45b3a0098c1cffddd0438bc"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116918,20 +117153,20 @@ rule CAPE_Pik23 : FILE
 		$rijndael = {EB 0F 0F B6 04 3? FE C? 8A 80 [4] 88 04 3? 0F B6 [3] 7C EA 5? 5? C9 C3}
 
 	condition:
-		uint16(0)==0x5A4D and 3 of them
+		uint16( 0 ) == 0x5A4D and 3 of them
 }
 rule CAPE_Hancitor : FILE
 {
 	meta:
 		description = "Hancitor Payload"
 		author = "threathive"
-		id = "b4e9a26a-db00-5553-acc2-f35148b0ffd5"
+		id = "68013b43-8cb2-5d51-bcb1-a5f3c9ce7d96"
 		date = "2020-10-20"
 		modified = "2020-10-20"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Hancitor.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "84003542a2f587b5fbd43731c4240759806f8ee46df2bd96aae4a3c09d97e41c"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Hancitor.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_84003542a2f587b5fbd43731c4240759806f8ee46df2bd96aae4a3c09d97e41c"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116944,20 +117179,20 @@ rule CAPE_Hancitor : FILE
 		$user_agent = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Bruteratel
 {
 	meta:
 		description = "BruteRatel Payload"
 		author = "kevoreilly"
-		id = "61b951e4-0c27-59c0-8ea2-715b673fdcee"
+		id = "cdae6558-3430-59cb-b1c5-79c66cfd72b1"
 		date = "2024-07-11"
 		modified = "2024-07-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/BruteRatel.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "0984977c716d6f8e068c045166eb5db77c9fbce27513e555dceca348375f1a66"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/BruteRatel.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_0984977c716d6f8e068c045166eb5db77c9fbce27513e555dceca348375f1a66"
 		score = 75
 		quality = 70
 		tags = ""
@@ -116977,13 +117212,13 @@ rule CAPE_Lokibot : FILE
 	meta:
 		description = "LokiBot Payload"
 		author = "kevoreilly"
-		id = "8cdf69e2-ecac-5241-adba-c458cce0610f"
+		id = "8c7da7b6-0f26-55ee-9fee-1dd355de3027"
 		date = "2022-02-01"
 		modified = "2022-02-01"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/LokiBot.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "a5b3d518371138740e913d2d6ce4fa22d3da5cea7e034c7d6b4b502e6bf44b06"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/LokiBot.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_a5b3d518371138740e913d2d6ce4fa22d3da5cea7e034c7d6b4b502e6bf44b06"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -116994,20 +117229,20 @@ rule CAPE_Lokibot : FILE
 		$a2 = "last_compatible_version"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Tclient : FILE
 {
 	meta:
 		description = "TClient Payload"
 		author = "kevoreilly"
-		id = "38c9ea20-9d91-5fb0-8b3b-170538ad7ea8"
+		id = "1be68238-75ea-5b4e-9cee-12f10bc81aac"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/TClient.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "6edcd01e4722b367723ed77d9596877d16ee35dc4c160885d125f83e45cee24d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/TClient.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_6edcd01e4722b367723ed77d9596877d16ee35dc4c160885d125f83e45cee24d"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117017,20 +117252,20 @@ rule CAPE_Tclient : FILE
 		$code1 = {41 0F B6 00 4D 8D 40 01 34 01 8B D7 83 E2 07 0F BE C8 FF C7 41 0F BE 04 91 0F AF C1 41 88 40 FF 81 FF 80 03 00 00 7C D8}
 
 	condition:
-		uint16(0)==0x5A4D and any of ($code*)
+		uint16( 0 ) == 0x5A4D and any of ( $code* )
 }
 rule CAPE_Rhadamanthys
 {
 	meta:
 		description = "Rhadamanthys Loader"
 		author = "kevoreilly"
-		id = "4683ef43-7397-5546-ae54-b4c000518182"
+		id = "ca3578d3-954a-5787-b236-235127563cee"
 		date = "2023-09-18"
 		modified = "2023-09-18"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Rhadamanthys.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "f71bee3ef1dd7b16a55397645d16c0a20d1fdd3bf662f241c0b11796629b11ff"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Rhadamanthys.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_f71bee3ef1dd7b16a55397645d16c0a20d1fdd3bf662f241c0b11796629b11ff"
 		score = 75
 		quality = 70
 		tags = ""
@@ -117050,13 +117285,13 @@ rule CAPE_Mole : FILE
 	meta:
 		description = "Mole Payload"
 		author = "kevoreilly"
-		id = "1185170f-4a5b-5347-807b-ef2af98a1a09"
+		id = "5bc8532c-5c03-5e72-b878-881201404c84"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Mole.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "8be4d190d554a610360c0e04b33da59eb00319395e5b2000d580546ce6503786"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Mole.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_8be4d190d554a610360c0e04b33da59eb00319395e5b2000d580546ce6503786"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117068,20 +117303,20 @@ rule CAPE_Mole : FILE
 		$a3 = "-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Magniber : FILE
 {
 	meta:
 		description = "Magniber Payload"
 		author = "kevoreilly"
-		id = "a704914f-2aa2-537d-975d-f8c23427951f"
+		id = "9d32f3ea-ad4a-53b2-bf93-eb5df496fcb5"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Magniber.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "1875754bdf98c1886f31f6c6e29992a98180f74d8fa168ae391e2c660d760618"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Magniber.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_1875754bdf98c1886f31f6c6e29992a98180f74d8fa168ae391e2c660d760618"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117091,20 +117326,20 @@ rule CAPE_Magniber : FILE
 		$a1 = {8B 55 FC 83 C2 01 89 55 FC 8B 45 FC 3B 45 08 7D 45 6A 01 6A 00 E8 26 FF FF FF 83 C4 08 89 45 F4 83 7D F4 00 75 18 6A 7A 6A 61 E8 11 FF FF FF 83 C4 08 8B 4D FC 8B 55 F8 66 89 04 4A EB 16}
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Nanolocker : FILE
 {
 	meta:
 		description = "NanoLocker Payload"
 		author = "kevoreilly"
-		id = "6fff6a27-a153-5461-9a75-2253c2f7d408"
+		id = "157b15e7-e089-5af8-b744-b5cbdb0f334a"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/NanoLocker.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "fe6c8a4e259c3c526f8f50771251f6762b2b92a4df2e8bfc705f282489f757db"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/NanoLocker.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_fe6c8a4e259c3c526f8f50771251f6762b2b92a4df2e8bfc705f282489f757db"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117116,20 +117351,20 @@ rule CAPE_Nanolocker : FILE
 		$a3 = "Decryptor.lnk"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Squirrelwaffle : FILE
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "kevoreilly & R3MRUM"
-		id = "0ae75f24-7a2a-57d3-8c6f-a61ac6cc08e7"
+		id = "8a07fb62-834e-564d-8cdd-f9380892cdf1"
 		date = "2021-10-13"
 		modified = "2021-10-13"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/SquirrelWaffle.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "5f799333398421d537ec7a87ca94f6cc9cf1e53e55b353036a5132440990e500"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/SquirrelWaffle.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_5f799333398421d537ec7a87ca94f6cc9cf1e53e55b353036a5132440990e500"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117140,20 +117375,20 @@ rule CAPE_Squirrelwaffle : FILE
 		$decode = {F7 75 ?? 83 7D ?? 10 8D 4D ?? 8D 45 ?? C6 45 ?? 00 0F 43 4D ?? 83 7D ?? 10 0F 43 45 ?? 8A 04 10 32 04 39}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Doppelpaymer : FILE
 {
 	meta:
 		description = "DoppelPaymer Payload"
 		author = "kevoreilly"
-		id = "c8178906-1722-5908-9ad4-7ee1eef39138"
+		id = "a4c8adac-6fb6-56b2-8e3b-da39279ef72d"
 		date = "2022-06-27"
 		modified = "2022-06-27"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/DoppelPaymer.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "73a2575671bafc31a70af3ce072d6f94ae172b12202baebba586a02524cb6f9d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/DoppelPaymer.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_73a2575671bafc31a70af3ce072d6f94ae172b12202baebba586a02524cb6f9d"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117164,20 +117399,20 @@ rule CAPE_Doppelpaymer : FILE
 		$cmd_string = "Setup run\\n" wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Ramnit : FILE
 {
 	meta:
 		description = "Ramnit Payload"
 		author = "kevoreilly"
-		id = "6df92055-05f6-5985-9268-b9c85e143567"
+		id = "39de0011-dad7-5def-9c34-12e995d1ca8a"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Ramnit.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "6f661f47bdf8377b0fb96f190fcb964c0ed2b43ce7ae7880f9dfce9e43837efd"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Ramnit.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_6f661f47bdf8377b0fb96f190fcb964c0ed2b43ce7ae7880f9dfce9e43837efd"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117189,20 +117424,20 @@ rule CAPE_Ramnit : FILE
 		$id_string = "{%08X-%04X-%04X-%04X-%08X%04X}"
 
 	condition:
-		uint16(0)==0x5A4D and all of ($*)
+		uint16( 0 ) == 0x5A4D and all of ( $* )
 }
 rule CAPE_Agent_Tesla
 {
 	meta:
 		description = "Detecting HTML strings used by Agent Tesla malware"
 		author = "Stormshield"
-		id = "5383994b-357d-539b-89b1-53be238f759d"
+		id = "040bc4fc-d1ed-5ca5-96d6-8901d1f57bbe"
 		date = "2024-03-22"
 		modified = "2024-03-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AgentTesla.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "3945754129dcc58e0abfd7485f5ff0c0afdd1078ae2cf164ca8f59a6f79db1be"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AgentTesla.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_3945754129dcc58e0abfd7485f5ff0c0afdd1078ae2cf164ca8f59a6f79db1be"
 		score = 75
 		quality = 70
 		tags = ""
@@ -117223,13 +117458,13 @@ rule CAPE_Agenttesla : FILE
 	meta:
 		description = "AgentTesla Payload"
 		author = "kevoreilly"
-		id = "f7b930f1-cecb-5d80-809b-9503f282247a"
+		id = "0e5dc336-75d3-5634-8b40-c8909d0b6c36"
 		date = "2024-03-22"
 		modified = "2024-03-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AgentTesla.yar#L19-L41"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AgentTesla.yar#L19-L41"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117249,20 +117484,20 @@ rule CAPE_Agenttesla : FILE
 		$agt4 = "GetSavedCookies" ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($string*) or 3 of ($agt*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $string* ) or 3 of ( $agt* ) )
 }
 rule CAPE_Agentteslav2 : FILE
 {
 	meta:
 		description = "AgenetTesla Type 2 Keylogger payload"
 		author = "ditekshen"
-		id = "e60ecee4-0a97-56a1-b21e-47190f8cd1f8"
+		id = "3db36094-1ab9-5f9a-b395-7b2ab1ea7bad"
 		date = "2024-03-22"
 		modified = "2024-03-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AgentTesla.yar#L43-L67"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AgentTesla.yar#L43-L67"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117286,20 +117521,20 @@ rule CAPE_Agentteslav2 : FILE
 		$cl6 = "Thunderbird" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of ($s*)) or (6 of ($s*) and 2 of ($cl*))
+		( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( 6 of ( $s* ) and 2 of ( $cl* ) )
 }
 rule CAPE_Agentteslav3 : FILE
 {
 	meta:
 		description = "AgentTeslaV3 infostealer payload"
 		author = "ditekshen"
-		id = "cfe00382-8663-54a4-a7c4-b932ec7ad5e3"
+		id = "aa88b79d-cca2-5b7f-8f01-85e227aebcb7"
 		date = "2024-03-22"
 		modified = "2024-03-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AgentTesla.yar#L69-L111"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "26c4fa0ce8de6982eb599f3872e8ab2a6e83da4741db7f3500c94e0a8fe5d459"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AgentTesla.yar#L69-L111"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_26c4fa0ce8de6982eb599f3872e8ab2a6e83da4741db7f3500c94e0a8fe5d459"
 		score = 75
 		quality = 68
 		tags = "FILE"
@@ -117340,20 +117575,20 @@ rule CAPE_Agentteslav3 : FILE
 		$m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and (8 of ($s*) or (6 of ($s*) and 4 of ($g*)))) or (2 of ($m*))
+		( uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 6 of ( $s* ) and 4 of ( $g* ) ) ) ) or ( 2 of ( $m* ) )
 }
 rule CAPE_Agentteslaxor : FILE
 {
 	meta:
 		description = "AgentTesla xor-based config decoding"
 		author = "kevoreilly"
-		id = "81eeb62f-578f-5c75-bc96-091d5727a20a"
+		id = "29ae5b7c-dd17-5350-9e45-121272990dd7"
 		date = "2024-03-22"
 		modified = "2024-03-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AgentTesla.yar#L113-L123"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "54581e83e5fa13fae4bda74016b3fa1d18c92e2659f493ebe54d70fd5f77bba5"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AgentTesla.yar#L113-L123"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_54581e83e5fa13fae4bda74016b3fa1d18c92e2659f493ebe54d70fd5f77bba5"
 		score = 75
 		quality = 20
 		tags = "FILE"
@@ -117363,20 +117598,20 @@ rule CAPE_Agentteslaxor : FILE
 		$decode = {06 91 06 61 20 [4] 61 D2 9C 06 17 58 0A 06 7E [4] 8E 69 FE 04 2D ?? 2A}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Agentteslav4 : FILE
 {
 	meta:
 		description = "AgentTesla Payload"
 		author = "kevoreilly"
-		id = "a39109ca-84cb-527d-b9c2-d8763fa6e496"
+		id = "dfe23345-beda-5619-83fc-1362c1a97366"
 		date = "2024-03-22"
 		modified = "2024-03-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AgentTesla.yar#L125-L138"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AgentTesla.yar#L125-L138"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117389,20 +117624,20 @@ rule CAPE_Agentteslav4 : FILE
 		$decode3 = {(07|FE 0C 01 00) (11 07|FE 0C 07 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (08|FE 0C 02 00) 91 61 D2 52}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Agentteslav4Jit
 {
 	meta:
 		description = "AgentTesla JIT-compiled native code"
 		author = "kevoreilly"
-		id = "a87dca44-4974-543c-9565-487ed99be2a6"
+		id = "3c8fa735-8773-5478-bc84-9fdb3cc2834b"
 		date = "2024-03-22"
 		modified = "2024-03-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AgentTesla.yar#L140-L153"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "8f7144d2a989ce8d291af926b292f5f0f7772e707b0e49797eba13ecf91b90bc"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AgentTesla.yar#L140-L153"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_8f7144d2a989ce8d291af926b292f5f0f7772e707b0e49797eba13ecf91b90bc"
 		score = 75
 		quality = 70
 		tags = ""
@@ -117422,13 +117657,13 @@ rule CAPE_Asyncrat : FILE
 	meta:
 		description = "AsyncRAT Payload"
 		author = "kevoreilly, JPCERT/CC Incident Response Group"
-		id = "478557fa-2418-5b13-99d9-2395ce83b9a2"
+		id = "75b7df5f-3ce9-5703-9817-2cf4c70b1ccb"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AsyncRAT.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "8f960131bb86e1c09127324bd5877364ab25e0cb37f5f9755230c7fed9094de3"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AsyncRAT.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_8f960131bb86e1c09127324bd5877364ab25e0cb37f5f9755230c7fed9094de3"
 		score = 75
 		quality = 66
 		tags = "FILE"
@@ -117444,20 +117679,20 @@ rule CAPE_Asyncrat : FILE
 		$kitty = "StormKitty" ascii
 
 	condition:
-		uint16(0)==0x5A4D and not $kitty and ($salt and (2 of ($str*) or 1 of ($b*))) or ( all of ($b*) and 2 of ($str*))
+		uint16( 0 ) == 0x5A4D and not $kitty and ( $salt and ( 2 of ( $str* ) or 1 of ( $b* ) ) ) or ( all of ( $b* ) and 2 of ( $str* ) )
 }
 rule CAPE_Asyncrat_Kingrat
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "jeFF0Falltrades"
-		id = "8fbab9a0-5736-543e-ba7b-c7598190c9e0"
+		id = "4339465b-7a74-56b5-85c7-762ae69b9a49"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AsyncRAT.yar#L19-L40"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "2699ef93ae10b205b79025098afc1d1cfe7dbdf192f4d98a6e34a8f3de154810"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AsyncRAT.yar#L19-L40"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_2699ef93ae10b205b79025098afc1d1cfe7dbdf192f4d98a6e34a8f3de154810"
 		score = 75
 		quality = 62
 		tags = ""
@@ -117478,20 +117713,20 @@ rule CAPE_Asyncrat_Kingrat
 		$patt_config = { 72 [3] 70 80 [3] 04 }
 
 	condition:
-		( not any of ($dcrat*)) and 6 of them and #patt_config>=10
+		( not any of ( $dcrat* ) ) and 6 of them and #patt_config >= 10
 }
 rule CAPE_Locky : FILE
 {
 	meta:
 		description = "Locky Payload"
 		author = "kevoreilly"
-		id = "664d0365-af49-5222-a4ed-9260332f6940"
+		id = "28f16221-97dd-588b-8325-91f25fb840c2"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Locky.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "9786c54a2644d9581fefe64be11b26e22806398e54e961fa4f19d26eae039cd7"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Locky.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_9786c54a2644d9581fefe64be11b26e22806398e54e961fa4f19d26eae039cd7"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117503,20 +117738,20 @@ rule CAPE_Locky : FILE
 		$string3 = "opt321" wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Cryptoshield : FILE
 {
 	meta:
 		description = "Cryptoshield Payload"
 		author = "kevoreilly"
-		id = "a7b60a0d-7d46-59c9-8273-ee23bae3fbbc"
+		id = "54efd2dd-484b-507d-8361-d53217ba85bb"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Cryptoshield.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "46064b4c69cb1af01330c5d194ef50728e0f0479e9fbf72828822935f8e37ac6"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Cryptoshield.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_46064b4c69cb1af01330c5d194ef50728e0f0479e9fbf72828822935f8e37ac6"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117528,20 +117763,20 @@ rule CAPE_Cryptoshield : FILE
 		$a3 = "r_sp@india.com - SUPPORT"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Darkgate
 {
 	meta:
 		description = "DarkGate Payload"
 		author = "enzok"
-		id = "ce81f452-4096-51d6-97cc-624f9fbefa86"
+		id = "278bd88a-9c5f-52f1-b7cd-bc71b85e71ce"
 		date = "2024-02-26"
 		modified = "2024-02-26"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/DarkGate.yar#L1-L16"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "25c0e77a83676c6a18445f8df0b1f7a9148de5f64eeb532f9a4f4d4652dd8191"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/DarkGate.yar#L1-L16"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_25c0e77a83676c6a18445f8df0b1f7a9148de5f64eeb532f9a4f4d4652dd8191"
 		score = 75
 		quality = 70
 		tags = ""
@@ -117556,21 +117791,21 @@ rule CAPE_Darkgate
 		$config2 = {8B 55 ?? 8D 45 ?? E8 [4] 8D 45 ?? 5? B? 06 00 00 00 B? 01 00 00 00 8B 45 ?? E8 [4] 8B 45 ?? B? [4] E8 [4] 75}
 
 	condition:
-		($alphabet) and ( any of ($part*) or all of ($config*))
+		($alphabet ) and ( any of ( $part* ) or all of ( $config* ) )
 }
 rule CAPE_Carbanak : FILE
 {
 	meta:
 		description = "Carnbanak Payload"
 		author = "enzok"
-		id = "e6d395d5-65ba-5efb-bcbc-c6d56a96f0c1"
+		id = "71c410c8-93ba-58f2-9f03-b5c71558cce1"
 		date = "2024-03-18"
 		modified = "2024-03-18"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Carbanak.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Carbanak.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "c9c1b06cb9c9bd6fc4451f5e2847a1f9524bb2870d7bb6f0ee09b9dd4e3e4c84"
-		logic_hash = "8ed5ab07f1635dc7cdf296e86a71a0a99d0b2faef8fc460f43d426b24b8c8367"
+		logic_hash = "v1_sha256_8ed5ab07f1635dc7cdf296e86a71a0a99d0b2faef8fc460f43d426b24b8c8367"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117582,22 +117817,22 @@ rule CAPE_Carbanak : FILE
 		$constants = {0F B7 05 [3] 00 0F B7 1D [3] 00 83 25 [3] 00 00 89 05 [3] 00 0F B7 05 [3] 00 89 1D [3] 00 89 05 [3] 00 33 C0 4? 8D 4D}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Blister : FILE
 {
 	meta:
 		description = "Blister Loader"
 		author = "kevoreilly"
-		id = "525fc600-2afc-5cf6-bf55-4ce0ea264dca"
+		id = "04ed1762-7201-58cd-a3c0-8dc1311a34fc"
 		date = "2023-09-20"
 		modified = "2023-09-20"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Blister.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Blister.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2"
 		hash = "d3eab2a134e7bd3f2e8767a6285b38d19cd3df421e8af336a7852b74f194802c"
-		logic_hash = "f26d85fdf0eb07e67fe38c43c5f6d024bfb7b2a333cb3411f5cdcff6bf5db12d"
+		logic_hash = "v1_sha256_f26d85fdf0eb07e67fe38c43c5f6d024bfb7b2a333cb3411f5cdcff6bf5db12d"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117611,20 +117846,20 @@ rule CAPE_Blister : FILE
 		$decode = {0F BE C0 49 03 CC 41 33 C1 44 69 C8 [4] 41 8B C1 C1 E8 0F 44 33 C8 8A 01 84 C0 75 E1 41 81 F9 [4] 74}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Jaff : FILE
 {
 	meta:
 		description = "Jaff Payload"
 		author = "kevoreilly"
-		id = "6681c1fe-6c88-5a49-bdfa-54ce08ea6707"
+		id = "7dfa9276-9a50-5b91-a56c-a555cf939eec"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Jaff.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "6806a5eeee04b7436ff694addc334bfc0f1ee611116904d57be9506acfd47418"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Jaff.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_6806a5eeee04b7436ff694addc334bfc0f1ee611116904d57be9506acfd47418"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117637,20 +117872,20 @@ rule CAPE_Jaff : FILE
 		$b2 = "2~1c0q4t7"
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($a*)) and (1 of ($b*))
+		uint16( 0 ) == 0x5A4D and ( any of ( $a* ) ) and ( 1 of ( $b* ) )
 }
 rule CAPE_Ryuk : FILE
 {
 	meta:
 		description = "Ryuk Payload"
 		author = "kevoreilly"
-		id = "594bbb8d-1f85-5a01-a864-ac2d95c45bf9"
+		id = "71d3850b-66a1-5b33-b56d-f33f2c8dfa93"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Ryuk.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "b4463993d8956e402b927a3dcfa2ca9693a959908187f720372f2d3a40e6db0c"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Ryuk.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_b4463993d8956e402b927a3dcfa2ca9693a959908187f720372f2d3a40e6db0c"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117663,20 +117898,20 @@ rule CAPE_Ryuk : FILE
 		$code = {48 8B 4D 10 48 8B 03 48 C1 E8 07 C1 E0 04 F7 D0 33 41 08 83 E0 10 31 41 08 48 8B 4D 10 48 8B 03 48 C1 E8 09 C1 E0 03 F7 D0 33 41 08 83 E0 08 31 41 08}
 
 	condition:
-		uint16(0)==0x5A4D and 3 of ($*)
+		uint16( 0 ) == 0x5A4D and 3 of ( $* )
 }
 rule CAPE_Smokeloader
 {
 	meta:
 		description = "SmokeLoader Payload"
 		author = "kevoreilly"
-		id = "d3ca7c8a-01dc-5174-9928-ee278b6cb107"
+		id = "ff903365-b0a7-5d3a-86d1-707776939938"
 		date = "2024-11-12"
 		modified = "2024-11-12"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/SmokeLoader.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "779e2ac213e5ced7bc06e6208826b65cf8fc3113a69ede6408b84055542fa76d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/SmokeLoader.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_779e2ac213e5ced7bc06e6208826b65cf8fc3113a69ede6408b84055542fa76d"
 		score = 75
 		quality = 70
 		tags = ""
@@ -117696,13 +117931,13 @@ rule CAPE_Xworm : FILE
 	meta:
 		description = "Detects XWorm"
 		author = "ditekSHen"
-		id = "bf9115a7-850a-5326-860c-a9a71bc7e50c"
+		id = "cf15944b-2740-5680-ae0f-3dae4ddcc032"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/XWorm.yar#L1-L27"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "5a86c2f0a188135e53d86c176806a208abbe3dd830bde364016859ffa5294bd7"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/XWorm.yar#L1-L27"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_5a86c2f0a188135e53d86c176806a208abbe3dd830bde364016859ffa5294bd7"
 		score = 75
 		quality = 68
 		tags = "FILE"
@@ -117729,20 +117964,20 @@ rule CAPE_Xworm : FILE
 		$v2_8 = "UACFunc" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($v2*))) or 6 of them )
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 3 of ( $s* ) or 3 of ( $v2* ) ) ) or 6 of them )
 }
 rule CAPE_Xworm_Kingrat
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "jeFF0Falltrades"
-		id = "76332a42-97c9-52fe-83dc-04ceb367f692"
+		id = "2051f6e5-3450-5aa8-81a7-98f827391d2e"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/XWorm.yar#L29-L46"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "3914be652bb7271e5e6b89d05edf10a54f8ddaf9e22d194b60501aa2cdd495d3"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/XWorm.yar#L29-L46"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_3914be652bb7271e5e6b89d05edf10a54f8ddaf9e22d194b60501aa2cdd495d3"
 		score = 75
 		quality = 66
 		tags = ""
@@ -117761,21 +117996,21 @@ rule CAPE_Xworm_Kingrat
 		$patt_config = { 72 [3] 70 80 [3] 04 }
 
 	condition:
-		5 of them and #patt_config>=7
+		5 of them and #patt_config >= 7
 }
 rule CAPE_Stealc : FILE
 {
 	meta:
 		description = "Stealc Payload"
 		author = "kevoreilly"
-		id = "77567584-7c84-5351-938b-d29d612a042d"
+		id = "cee4d906-ca28-59ae-ba83-5c6739eb66e5"
 		date = "2024-09-10"
 		modified = "2024-09-10"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Stealc.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Stealc.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d"
-		logic_hash = "a6165168b7c74761b91d1691465688c748227b830813067edb4e9bdc934271c4"
+		logic_hash = "v1_sha256_a6165168b7c74761b91d1691465688c748227b830813067edb4e9bdc934271c4"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117786,21 +118021,21 @@ rule CAPE_Stealc : FILE
 		$nugget2 = {64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 89 45 FC}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Blackdropper
 {
 	meta:
 		description = "BlackDropper"
 		author = "enzok"
-		id = "5cb92b67-d12c-5946-84b1-a9fce4a6d242"
+		id = "4b238de0-1a2e-5a40-98b2-1f79311ca5f8"
 		date = "2024-10-22"
 		modified = "2024-10-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/BlackDropper.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/BlackDropper.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "f8026ae3237bdd885e5fcaceb86bcab4087d8857e50ba472ca79ce44c12bc257"
-		logic_hash = "c7f7bc740d413b479ebe45611ddfc04f7e4f2978516b2882069b2569c7acdf28"
+		logic_hash = "v1_sha256_c7f7bc740d413b479ebe45611ddfc04f7e4f2978516b2882069b2569c7acdf28"
 		score = 75
 		quality = 70
 		tags = ""
@@ -117815,20 +118050,20 @@ rule CAPE_Blackdropper
 		$crypt3 = {E8 [4] 0F B6 4C 24 ?? 88 08 E9}
 
 	condition:
-		2 of ($string*) or 2 of ($crypt*)
+		2 of ( $string* ) or 2 of ( $crypt* )
 }
 rule CAPE_Cobaltstrikestager
 {
 	meta:
 		description = "Cobalt Strike Stager Payload"
 		author = "@dan__mayer <daniel@stairwell.com>"
-		id = "eedf71b1-9f27-5a6f-afe8-3ddae47f9a06"
+		id = "fc11fa30-8b4f-5e52-9cd9-f8a4200ba6e1"
 		date = "2023-01-18"
 		modified = "2023-01-18"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/CobaltStrikeStager.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "6a55b0c3ab5f557dfb7a3f8bd616ede1bd9b93198590fc9d52aa19c1154388c5"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/CobaltStrikeStager.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_6a55b0c3ab5f557dfb7a3f8bd616ede1bd9b93198590fc9d52aa19c1154388c5"
 		score = 75
 		quality = 70
 		tags = ""
@@ -117848,13 +118083,13 @@ rule CAPE_Atlas : FILE
 	meta:
 		description = "Atlas Payload"
 		author = "kevoreilly"
-		id = "22322e5c-ded6-56df-8a39-a8f5cbc18239"
+		id = "7998bc32-9299-5d76-bdc8-db4be98b01cf"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Atlas.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "c3f73b29df5caf804dbfe3e6ac07a9e2c772bd2a126f0487e4a65e72bd501e6e"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Atlas.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_c3f73b29df5caf804dbfe3e6ac07a9e2c772bd2a126f0487e4a65e72bd501e6e"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117866,21 +118101,21 @@ rule CAPE_Atlas : FILE
 		$a3 = "process call create \"cmd /c start vssadmin delete shadows /all /q"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Latrodectus
 {
 	meta:
 		description = "Latrodectus Payload"
 		author = "enzok"
-		id = "5fe6ddad-3252-5f49-9359-bd647b974fe6"
+		id = "fbf6b00e-77e5-5c35-9f95-a6b361a32971"
 		date = "2024-09-03"
 		modified = "2024-09-03"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Latrodectus.yar#L1-L16"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Latrodectus.yar#L1-L16"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "a547cff9991a713535e5c128a0711ca68acf9298cc2220c4ea0685d580f36811"
-		logic_hash = "2f98d570bf9a490eecd2807599b93023ccacab86f3b7674f0118bbebd4dd2776"
+		logic_hash = "v1_sha256_2f98d570bf9a490eecd2807599b93023ccacab86f3b7674f0118bbebd4dd2776"
 		score = 75
 		quality = 70
 		tags = ""
@@ -117901,14 +118136,14 @@ rule CAPE_Latrodectus_AES
 	meta:
 		description = "Latrodectus Payload"
 		author = "enzok"
-		id = "8a3dd88c-7840-54a3-8844-4e1a38f51df5"
+		id = "c26cb72f-1541-5e3e-b46b-efa289469d19"
 		date = "2024-09-03"
 		modified = "2024-09-03"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Latrodectus.yar#L18-L34"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Latrodectus.yar#L18-L34"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8"
-		logic_hash = "1f00f6f187f15d39a30e15ffd14dae07707141999271ad4ac6a75ff4d93dd54d"
+		logic_hash = "v1_sha256_1f00f6f187f15d39a30e15ffd14dae07707141999271ad4ac6a75ff4d93dd54d"
 		score = 75
 		quality = 70
 		tags = ""
@@ -117930,13 +118165,13 @@ rule CAPE_Codoso : FILE
 	meta:
 		description = "Codoso Payload"
 		author = "kevoreilly"
-		id = "4c3d8d77-ffa9-576d-bf88-7b5a1bfd1811"
+		id = "ebe80cb4-888a-5f94-b213-a04f7877b1fa"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Codoso.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "32c9ed2ac29e8905266977a9ee573a252442d96fb9ec97d88642180deceec3f8"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Codoso.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_32c9ed2ac29e8905266977a9ee573a252442d96fb9ec97d88642180deceec3f8"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -117948,20 +118183,20 @@ rule CAPE_Codoso : FILE
 		$a3 = "USERMODECMD"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Xenorat
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "jeFF0Falltrades"
-		id = "9708158d-06fc-5991-a084-df2bfe1d5c96"
+		id = "7944393b-cb0e-5721-8bd5-a85c653a0b25"
 		date = "2024-10-09"
 		modified = "2024-10-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/XenoRAT.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "26f520fb69a52d05786fac0e9e38f5db9601da0a3e7768e00975a9684f3560ef"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/XenoRAT.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_26f520fb69a52d05786fac0e9e38f5db9601da0a3e7768e00975a9684f3560ef"
 		score = 75
 		quality = 66
 		tags = ""
@@ -117976,20 +118211,20 @@ rule CAPE_Xenorat
 		$patt_config = { 72 [3] 70 80 [3] 04 }
 
 	condition:
-		4 of them and #patt_config>=5
+		4 of them and #patt_config >= 5
 }
 rule CAPE_Arkei : FILE
 {
 	meta:
 		description = "Arkei Payload"
 		author = "kevoreilly"
-		id = "22ebe194-19a9-5bf2-9cfc-ea27b7724572"
+		id = "c3426976-58c0-5721-b638-efa5f3204ccf"
 		date = "2020-02-11"
 		modified = "2020-02-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Arkei.yar#L1-L24"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "03980827db1c53d4090ab196ba820ca34b5d83dc7140b11ead9182cb5d28c7d3"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Arkei.yar#L1-L24"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_03980827db1c53d4090ab196ba820ca34b5d83dc7140b11ead9182cb5d28c7d3"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118011,20 +118246,20 @@ rule CAPE_Arkei : FILE
 		$v9 = "files\\cookies_" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($string*) or 7 of ($v*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $string* ) or 7 of ( $v* ) )
 }
 rule CAPE_Scarab : FILE
 {
 	meta:
 		description = "Scarab Payload"
 		author = "kevoreilly"
-		id = "2ba8ae50-1e56-5773-aaea-058161b59c78"
+		id = "d83f0494-9bc9-5a3d-a054-8916f061fe99"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Scarab.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "0d8fa7ab4c8e5699f17f9e9444e85a42563a840a8e7ee9eda54add3a6845d1c6"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Scarab.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_0d8fa7ab4c8e5699f17f9e9444e85a42563a840a8e7ee9eda54add3a6845d1c6"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118036,20 +118271,20 @@ rule CAPE_Scarab : FILE
 		$crypt3 = {8B 13 8B CA 81 E1 80 80 80 80 8B C1 C1 E8 07 50 8B C1 59 2B C1 25 1B 1B 1B 1B 8B CA 81 E1 7F 7F 7F 7F 03 C9 33 C1 8B C8 81 E1 80 80 80 80 8B F1 C1 EE 07}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Azorult : FILE
 {
 	meta:
 		description = "Azorult Payload"
 		author = "kevoreilly"
-		id = "ca76ec00-001f-56d0-bdbc-9dfd3239fba8"
+		id = "f7b8980e-9e81-5089-a577-73608a48086e"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Azorult.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "4691cf48d513d1965416b0cce1b6e19c8f7b393a940afd68b7c6ca8c0d125d90"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Azorult.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_4691cf48d513d1965416b0cce1b6e19c8f7b393a940afd68b7c6ca8c0d125d90"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118060,20 +118295,20 @@ rule CAPE_Azorult : FILE
 		$string1 = "SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),\"unixepoch\")"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Bumblebee : FILE
 {
 	meta:
 		description = "BumbleBee Payload"
 		author = "enzo & kevoreilly"
-		id = "b3a4dd53-014c-5e16-8ac1-7f3800ae017d"
+		id = "af79e592-7044-5da3-8ef3-f5c446232277"
 		date = "2024-10-29"
 		modified = "2024-10-29"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/BumbleBee.yar#L35-L50"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "bc7c2ce9d3cd598c9510dc64d78048999f2f89ee5a84cd0d6046dbdfabe260ee"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/BumbleBee.yar#L35-L50"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_bc7c2ce9d3cd598c9510dc64d78048999f2f89ee5a84cd0d6046dbdfabe260ee"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118088,20 +118323,20 @@ rule CAPE_Bumblebee : FILE
 		$str_gate = "/gate"
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($antivm*) or all of ($str_*))
+		uint16( 0 ) == 0x5A4D and ( any of ( $antivm* ) or all of ( $str_* ) )
 }
 rule CAPE_Bumblebee2024
 {
 	meta:
 		description = "BumbleBee 2024"
 		author = "enzok"
-		id = "ba92b894-912d-593c-acf9-99cb6ad6d61f"
+		id = "40e25684-e23c-570b-a1fe-a4e9fbeb88ef"
 		date = "2024-10-29"
 		modified = "2024-10-29"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/BumbleBee.yar#L52-L68"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "db58272c1ba74bc6e6a90bdacf7e8feec94be5da2b5123e0475ce86448f3edb2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/BumbleBee.yar#L52-L68"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_db58272c1ba74bc6e6a90bdacf7e8feec94be5da2b5123e0475ce86448f3edb2"
 		score = 75
 		quality = 70
 		tags = ""
@@ -118117,20 +118352,20 @@ rule CAPE_Bumblebee2024
 		$dga2 = {48 8D 0D [4] E8 [4] 8B F0 4C 89 6D ?? 4C 89 6D ?? 4C 89 75 ?? 4C 89 6D ?? 44 88 6D ?? 48 8D 15 [4] 44 38 2D [4] 75}
 
 	condition:
-		$rc4key and all of ($botid*) and 2 of ($port,$port,$dga1,$dga2)
+		$rc4key and all of ( $botid* ) and 2 of ( $port , $port , $dga1 , $dga2 )
 }
 rule CAPE_Nitrogenloader
 {
 	meta:
 		description = "Nitrogen Loader"
 		author = "enzok"
-		id = "45628576-3fbf-593d-a113-0bbfb12bd808"
+		id = "5b6843f1-0a3d-5448-80bb-2dc298a62f5c"
 		date = "2024-12-02"
 		modified = "2024-12-02"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/NitrogenLoader.yar#L1-L23"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "24117d6e04bc964c17c08c9918502410890d7ccdc2e9971f2d01f6f0b41d3836"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/NitrogenLoader.yar#L1-L23"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_24117d6e04bc964c17c08c9918502410890d7ccdc2e9971f2d01f6f0b41d3836"
 		score = 75
 		quality = 70
 		tags = ""
@@ -118152,20 +118387,20 @@ rule CAPE_Nitrogenloader
 		$decryptrsc2 = {8B ?? 24 [1-4] 33 C8 8B C1 48 63 4C 24 ?? 48 8B 94 24 [4] 88 04 0A}
 
 	condition:
-		( all of ($string*) or all of ($decrypt*)) and any of ($syscall*)
+		( all of ( $string* ) or all of ( $decrypt* ) ) and any of ( $syscall* )
 }
 rule CAPE_Badrabbit : FILE
 {
 	meta:
 		description = "BadRabbit Payload"
 		author = "kevoreilly"
-		id = "c7204772-6f14-57b7-88c1-e9156f9897d5"
+		id = "4f74db4c-7d11-5e1c-a78d-d083a3853531"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/BadRabbit.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "309e14ab4ea2f919358631f9d8b2aaff1f51e7708b6114e4e6bf4a9d9a5fc86c"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/BadRabbit.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_309e14ab4ea2f919358631f9d8b2aaff1f51e7708b6114e4e6bf4a9d9a5fc86c"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118177,20 +118412,20 @@ rule CAPE_Badrabbit : FILE
 		$a3 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal" wide
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Dreambot : FILE
 {
 	meta:
 		description = "Dreambot Payload"
 		author = "kevoreilly"
-		id = "675c2fea-fe48-5afd-9fa1-de919134892f"
+		id = "e5cc7449-9192-5ad0-8475-36dbe7fb2969"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Dreambot.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "29c6d648d5d38667c5824c2d20a83a20448c2ae6054ddddb2b2b7f8bdb69f74b"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Dreambot.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_29c6d648d5d38667c5824c2d20a83a20448c2ae6054ddddb2b2b7f8bdb69f74b"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118203,20 +118438,20 @@ rule CAPE_Dreambot : FILE
 		$b2 = ".bss"
 
 	condition:
-		uint16(0)==0x5A4D and (1 of ($a*)) and ( all of ($b*))
+		uint16( 0 ) == 0x5A4D and ( 1 of ( $a* ) ) and ( all of ( $b* ) )
 }
 rule CAPE_Fareit : FILE
 {
 	meta:
 		description = "Fareit Payload"
 		author = "kevoreilly"
-		id = "b3c4eb86-d104-5f31-afa4-5bf5f370f64e"
+		id = "62d33487-1d1c-5c78-94ea-f93209438f76"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Fareit.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "ed35391ffc949219f380da3f22bc8397a7d5c742bd68e227c3becdebcab5cf83"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Fareit.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_ed35391ffc949219f380da3f22bc8397a7d5c742bd68e227c3becdebcab5cf83"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118226,20 +118461,20 @@ rule CAPE_Fareit : FILE
 		$string1 = {0D 0A 09 09 0D 0A 0D 0A 09 20 20 20 3A 6B 74 6B 20 20 20 0D 0A 0D 0A 0D 0A 20 20 20 20 20 64 65 6C 20 20 20 20 09 20 25 31 20 20 0D 0A 09 69 66 20 20 09 09 20 65 78 69 73 74 20 09 20 20 20 25 31 20 20 09 20 20 67 6F 74 6F 20 09 0D 20 6B 74 6B 0D 0A 20 64 65 6C 20 09 20 20 25 30 20 00}
 
 	condition:
-		uint16(0)==0x5A4D and any of ($string*)
+		uint16( 0 ) == 0x5A4D and any of ( $string* )
 }
 rule CAPE_Masslogger : FILE
 {
 	meta:
 		description = "MassLogger"
 		author = "kevoreilly"
-		id = "0743421a-36f7-5b7c-859f-b461511151cb"
+		id = "1b7fbd5b-1b45-5e66-ae80-198c8917c4b7"
 		date = "2020-11-24"
 		modified = "2020-11-24"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/MassLogger.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "c8d82694810aafbdc6a35a661e7431e9536035e2f7fef90b9359064c4209b66c"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/MassLogger.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_c8d82694810aafbdc6a35a661e7431e9536035e2f7fef90b9359064c4209b66c"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118250,20 +118485,20 @@ rule CAPE_Masslogger : FILE
 		$fody = "Costura"
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Lumma : FILE
 {
 	meta:
 		description = "Lumma Payload"
 		author = "kevoreilly"
-		id = "6ec1e0dc-028b-5135-9d0a-462718d90fe3"
+		id = "08b47410-0392-514e-bf6a-5bc40f45c4e8"
 		date = "2024-10-22"
 		modified = "2024-10-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Lumma.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "44408ffa7870dbc1a8a31567dd743f46542da01ed8083e5413392920b9d1bafe"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Lumma.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_44408ffa7870dbc1a8a31567dd743f46542da01ed8083e5413392920b9d1bafe"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118277,20 +118512,20 @@ rule CAPE_Lumma : FILE
 		$decode3 = {B0 40 C3 B0 3F C3 80 F9 30 72 ?? 80 F9 39 77 06 80 C1 04 89 C8 C3}
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
 rule CAPE_Lockbit : FILE
 {
 	meta:
 		description = "Lockbit Payload"
 		author = "kevoreilly"
-		id = "ec9b4fec-0233-5277-b922-07057c2b4b34"
+		id = "6ad4325b-8ac8-53ae-8c8d-ef5aa84b6068"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Lockbit.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "80ab705c8246a0bd5b3de65146cf32b102f39bf9444bdf1d366b5a794c1229b9"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Lockbit.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_80ab705c8246a0bd5b3de65146cf32b102f39bf9444bdf1d366b5a794c1229b9"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118304,20 +118539,20 @@ rule CAPE_Lockbit : FILE
 		$decode2 = {8A 44 24 ?? 30 44 0C ?? 41 83 F9 ?? 72 F2}
 
 	condition:
-		uint16(0)==0x5A4D and (2 of them )
+		uint16( 0 ) == 0x5A4D and ( 2 of them )
 }
 rule CAPE_Aurorastealer : FILE
 {
 	meta:
 		description = "detects Aurora Stealer samples"
 		author = "Johannes Bader @viql"
-		id = "07779318-3e5d-5e67-8c04-f3f70d7e48b7"
+		id = "b8b3663e-4ec1-550e-b2b8-9ede3d88128f"
 		date = "2022-12-14"
 		modified = "2023-03-31"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/AuroraStealer.yar#L1-L74"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "0d10e9268184f494a73d5b4ab0d9a478ad0c26d2ef13d5134f8c9769f028b8f5"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/AuroraStealer.yar#L1-L74"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_0d10e9268184f494a73d5b4ab0d9a478ad0c26d2ef13d5134f8c9769f028b8f5"
 		score = 75
 		quality = 45
 		tags = "FILE"
@@ -118384,21 +118619,21 @@ rule CAPE_Aurorastealer : FILE
 		$varia_10 = "Crypto"
 
 	condition:
-		uint16(0)==0x5A4D and (32 of ($str_*) or 9 of ($varia_*))
+		uint16( 0 ) == 0x5A4D and ( 32 of ( $str_* ) or 9 of ( $varia_* ) )
 }
 rule CAPE_Koiloader
 {
 	meta:
 		description = "KoiLoader"
 		author = "YungBinary"
-		id = "258e8857-7ea6-5098-9949-06d9d83853d4"
+		id = "12b1c1f6-766a-52b8-ae4a-c87fbea05984"
 		date = "2024-10-25"
 		modified = "2024-10-25"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/KoiLoader.yar#L1-L35"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/KoiLoader.yar#L1-L35"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "b462e3235c7578450b2b56a8aff875a3d99d22f6970a01db3ba98f7ecb6b01a0"
-		logic_hash = "264a536632f8f11c904b00c9d2e505b3263c733ad8fbc2ef19c25a5ad58cef90"
+		logic_hash = "v1_sha256_264a536632f8f11c904b00c9d2e505b3263c733ad8fbc2ef19c25a5ad58cef90"
 		score = 75
 		quality = 70
 		tags = ""
@@ -118436,14 +118671,14 @@ rule CAPE_Cargobayloader : FILE
 	meta:
 		description = "CargoBay Loader"
 		author = "kevoreilly"
-		id = "5b347863-0bea-55d2-aaf3-b3d6e604be89"
+		id = "0135d03b-4a3d-5a60-9610-06e607f021d5"
 		date = "2023-02-20"
 		modified = "2023-02-20"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/CargoBayLoader.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/CargoBayLoader.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "75e975031371741498c5ba310882258c23b39310bd258239277708382bdbee9c"
-		logic_hash = "1d5c4ca79f97e1fac358189a8c6530be12506974fc2fb42f63b0b621536a45c9"
+		logic_hash = "v1_sha256_1d5c4ca79f97e1fac358189a8c6530be12506974fc2fb42f63b0b621536a45c9"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118454,20 +118689,20 @@ rule CAPE_Cargobayloader : FILE
 		$jmp2 = {84 DB 0F 85 [2] 00 00 48 8D 15 [4] 41 BE 03 00 00 00 41 B8 03 00 00 00 4C 8D 7C [2] 4C 89 F9 E8}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Socks5Systemz : FILE
 {
 	meta:
 		description = "Socks5Systemz Payload"
 		author = "kevoreilly"
-		id = "75831382-bb43-554e-93b1-f54a2255d8b9"
+		id = "3c98bc77-b311-5a58-a569-e66f0b3722dc"
 		date = "2024-05-22"
 		modified = "2024-05-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Socks5Systemz.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "44b83b6d2ab39b4258ae0d97d00d02afdbb62a3973fd788584e4dea9db69cc1b"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Socks5Systemz.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_44b83b6d2ab39b4258ae0d97d00d02afdbb62a3973fd788584e4dea9db69cc1b"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118484,20 +118719,20 @@ rule CAPE_Socks5Systemz : FILE
 		$chunk7 = {83 FA 04 E9 [3] (00|FF)}
 
 	condition:
-		uint16(0)==0x5A4D and 6 of them
+		uint16( 0 ) == 0x5A4D and 6 of them
 }
 rule CAPE_Conti : FILE
 {
 	meta:
 		description = "Conti Ransomware"
 		author = "kevoreilly"
-		id = "c94aed07-0eaf-5b51-a81e-e1992543673a"
+		id = "9b7bb3b8-9321-51ca-8887-430e94f80925"
 		date = "2021-03-15"
 		modified = "2021-03-15"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Conti.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "c9842f93d012d0189b9c6f10ad558b37ae66226bbb619ad677f6906ccaf0e848"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Conti.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_c9842f93d012d0189b9c6f10ad558b37ae66226bbb619ad677f6906ccaf0e848"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118509,20 +118744,20 @@ rule CAPE_Conti : FILE
 		$website2 = "https://contirecovery.best" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Petrwrap : FILE
 {
 	meta:
 		description = "PetrWrap Payload"
 		author = "kevoreilly"
-		id = "83762c87-6e96-50fe-b297-e1a5f893be43"
+		id = "e52dc8d1-d838-5d4c-a094-b13d729dfbc6"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/PetrWrap.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "6dd1cf5639b63d0ab41b24080dad68d285f2e3969ad34fd724c83e7a0dd4b968"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/PetrWrap.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_6dd1cf5639b63d0ab41b24080dad68d285f2e3969ad34fd724c83e7a0dd4b968"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118535,20 +118770,20 @@ rule CAPE_Petrwrap : FILE
 		$b2 = "http://mischa5xyix2mrhd.onion/"
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($a*)) and ( any of ($b*))
+		uint16( 0 ) == 0x5A4D and ( any of ( $a* ) ) and ( any of ( $b* ) )
 }
 rule CAPE_Bitpaymer : FILE
 {
 	meta:
 		description = "BitPaymer Payload"
 		author = "kevoreilly"
-		id = "c139b514-a1ba-5d47-8f4d-8e60cddfe2ba"
+		id = "98980216-a817-59f6-9e77-5c7b69427df6"
 		date = "2019-11-27"
 		modified = "2019-11-27"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/BitPaymer.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "6ae0dc9a36da13e483d8d653276b06f59ecc15c95c754c268dcc91b181677c4c"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/BitPaymer.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_6ae0dc9a36da13e483d8d653276b06f59ecc15c95c754c268dcc91b181677c4c"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118559,20 +118794,20 @@ rule CAPE_Bitpaymer : FILE
 		$antidefender = "TouchMeNot" wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Azer : FILE
 {
 	meta:
 		description = "Azer Payload"
 		author = "kevoreilly"
-		id = "4bda70c2-3cd9-543f-92f4-886b7dd899a1"
+		id = "8e9aa32f-38d5-5135-ab72-c8b6c8d4bbd9"
 		date = "2019-10-30"
 		modified = "2019-10-30"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Azer.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "48bd4a4e071f10d1911c4173a0cd39c69fed7a3b29eb92beffe709899f4cefa5"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Azer.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_48bd4a4e071f10d1911c4173a0cd39c69fed7a3b29eb92beffe709899f4cefa5"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118584,20 +118819,20 @@ rule CAPE_Azer : FILE
 		$a3 = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
 }
 rule CAPE_Nemty : FILE
 {
 	meta:
 		description = "Nemty Ransomware Payload"
 		author = "kevoreilly"
-		id = "3aa8e1d7-f9cb-5b04-923d-7bed15ab8c3f"
+		id = "ecfe4eab-58f5-5d63-aa78-d66670ab1165"
 		date = "2020-04-03"
 		modified = "2020-04-03"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/Nemty.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "a05974b561c67b4f1e0812639b74831edcf65686a06c0d380f0b45739e342419"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/Nemty.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_a05974b561c67b4f1e0812639b74831edcf65686a06c0d380f0b45739e342419"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118609,20 +118844,20 @@ rule CAPE_Nemty : FILE
 		$nemty = "NEMTY"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Trickbot
 {
 	meta:
 		description = "TrickBot Payload"
 		author = "sysopfb & kevoreilly"
-		id = "dc88eadd-7b84-5bd0-96d1-aad480632bee"
+		id = "f8135db0-c0d6-5269-8743-590c5503823e"
 		date = "2023-02-07"
 		modified = "2023-02-07"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/TrickBot.yar#L1-L20"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "47cc2070b43957601a72745329a9d14fb3fbfd4d2b31cacc35d4ac750dde31ea"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/TrickBot.yar#L1-L20"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_47cc2070b43957601a72745329a9d14fb3fbfd4d2b31cacc35d4ac750dde31ea"
 		score = 75
 		quality = 70
 		tags = ""
@@ -118641,21 +118876,21 @@ rule CAPE_Trickbot
 		$code7 = {B8 ?? ?? 00 00 85 C9 74 32 BE ?? ?? ?? ?? BA ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 03 F2 8B 2B 83 C3 04 33 2F 83 C7 04 89 29 83 C1 04 3B DE 0F 43 DA}
 
 	condition:
-		all of ($str*) or any of ($code*)
+		all of ( $str* ) or any of ( $code* )
 }
 rule CAPE_Trickbot_Permadll_UEFI_Module
 {
 	meta:
 		description = "Detects TrickBot Banking module permaDll"
 		author = "@VK_Intel | Advanced Intelligence"
-		id = "ba104164-0a1a-5a4c-8312-7653f7818e96"
+		id = "6157aceb-0626-584b-a67c-e63e4984c1ce"
 		date = "2023-02-07"
 		modified = "2023-02-07"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/TrickBot.yar#L22-L38"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/TrickBot.yar#L22-L38"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "491115422a6b94dc952982e6914adc39"
-		logic_hash = "564055f56fd19bed8900e6d451ba050b4e9013a9208a3bdc3d3d563567d225d2"
+		logic_hash = "v1_sha256_564055f56fd19bed8900e6d451ba050b4e9013a9208a3bdc3d3d563567d225d2"
 		score = 75
 		quality = 70
 		tags = ""
@@ -118677,13 +118912,13 @@ rule CAPE_Dridexloader : FILE
 	meta:
 		description = "Dridex v4 dropper C2 parsing function"
 		author = "kevoreilly"
-		id = "43bd9631-4611-567c-bee5-d926e060b977"
+		id = "dc3ef02d-b423-50c1-a4ef-1cd4504e983e"
 		date = "2021-03-10"
 		modified = "2021-03-10"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/data/yara/CAPE/DridexLoader.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "20696b1f14539c8ecf21bffc696596040c20b1ee2fcedc173945482c0baca588"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/data/yara/CAPE/DridexLoader.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_20696b1f14539c8ecf21bffc696596040c20b1ee2fcedc173945482c0baca588"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118698,20 +118933,20 @@ rule CAPE_Dridexloader : FILE
 		$c2parse_6 = {0F B7 53 ?? 89 10 0F B6 4B ?? 83 F9 0A 7F 03 8A 53 ?? 0F B6 53 ?? 85 D2 7E B9}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Singlestepantihook
 {
 	meta:
 		description = "Single-step anti-hook Bypass"
 		author = "kevoreilly"
-		id = "f7aca40b-d231-543b-81f3-5f4524abab78"
+		id = "86e80370-58c3-5d03-b2de-4c3838283bc4"
 		date = "2021-08-26"
 		modified = "2021-08-26"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/SingleStepAntiHook.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "fc9f36b0ecc13192fe8b6caaff256ac52c1f14480223d629a38ba84e90dd0809"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/SingleStepAntiHook.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_fc9f36b0ecc13192fe8b6caaff256ac52c1f14480223d629a38ba84e90dd0809"
 		score = 75
 		quality = 70
 		tags = ""
@@ -118728,13 +118963,13 @@ rule CAPE_Heavenssyscall : FILE
 	meta:
 		description = "Bypass variants of heaven's gate direct syscalls"
 		author = "kevoreilly"
-		id = "7c60102a-ac8b-5e28-8dbb-4b6c3f4cddff"
+		id = "97211e1a-76a6-5fdf-a745-03772f62eb86"
 		date = "2024-03-25"
 		modified = "2024-03-25"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/HeavensSyscall.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "aeb981fcba0936ff8b1be4c601445fd45e5d3b74856a9439d351edd57f5a50c3"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/HeavensSyscall.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_aeb981fcba0936ff8b1be4c601445fd45e5d3b74856a9439d351edd57f5a50c3"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118746,24 +118981,24 @@ rule CAPE_Heavenssyscall : FILE
 		$sysenter = {68 [4] E8 [4] E8 [4] C2 ?? 00 CC CC CC CC CC CC CC CC}
 
 	condition:
-		uint16(0)==0x8B55 and all of them
+		uint16( 0 ) == 0x8B55 and all of them
 }
 rule CAPE_Gettickcountantivm
 {
 	meta:
 		description = "GetTickCountAntiVM bypass"
 		author = "kevoreilly"
-		id = "d90b9768-0525-5963-9817-e3a53b1d4cf3"
+		id = "2c118a5c-95d1-5cb6-a7aa-c618b559aff3"
 		date = "2022-02-25"
 		modified = "2022-02-25"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/GetTickCountAntiVM.yar#L1-L20"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/GetTickCountAntiVM.yar#L1-L20"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "662bc7839ed7ddd82d5fdafa29fafd9a9ec299c28820fe4104fbba9be1a09c42"
 		hash = "00f1537b13933762e1146e41f3bac668123fac7eacd0aa1f7be0aa37a91ef3ce"
 		hash = "549bca48d0bac94b6a1e6eb36647cd007fed5c0e75a0e4aa315ceabdafe46541"
 		hash = "90c29a66209be554dfbd2740f6a54d12616da35d0e5e4af97eb2376b9d053457"
-		logic_hash = "9cdb0b2d2e058e1858c2f2baad67005a2019fbbdcb7ca54571c8d20dfbf33471"
+		logic_hash = "v1_sha256_9cdb0b2d2e058e1858c2f2baad67005a2019fbbdcb7ca54571c8d20dfbf33471"
 		score = 75
 		quality = 70
 		tags = ""
@@ -118785,13 +119020,13 @@ rule CAPE_Buerloader_1 : FILE
 	meta:
 		description = "BuerLoader RDTSC Trap Bypass"
 		author = "kevoreilly"
-		id = "38f01199-6bd2-5519-b570-8c0f46e74286"
+		id = "a8b922ef-45d4-54ac-95ad-d0ccb71c8ab6"
 		date = "2021-03-13"
 		modified = "2021-03-13"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/BuerLoader.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "6f9f9b4c01251c0643c61701084cca2bdfeea08ca95f982355565cf05483d940"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/BuerLoader.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_6f9f9b4c01251c0643c61701084cca2bdfeea08ca95f982355565cf05483d940"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118801,20 +119036,20 @@ rule CAPE_Buerloader_1 : FILE
 		$trap = {0F 31 89 45 ?? 6A 00 8D 45 ?? 8B CB 50 E8 [4] 0F 31}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Modiloader : FILE
 {
 	meta:
 		description = "ModiLoader detonation shim"
 		author = "ditekSHen"
-		id = "2b3fd8ec-b672-574b-9b50-1a9ca9f43299"
+		id = "b7735d58-09bd-5a5e-b5bb-bd860a0d1abe"
 		date = "2023-10-19"
 		modified = "2023-10-19"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/ModiLoader.yar#L1-L39"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "fc006377e6d41515503b0b234ff87f59d930a7d9f8b32d2e072de79b9c52ddc4"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/ModiLoader.yar#L1-L39"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_fc006377e6d41515503b0b234ff87f59d930a7d9f8b32d2e072de79b9c52ddc4"
 		score = 75
 		quality = 66
 		tags = "FILE"
@@ -118846,21 +119081,21 @@ rule CAPE_Modiloader : FILE
 		$g6 = "rmdir \"" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($x*) and ( all of ($g*) or (2 of ($s*) and 2 of ($c*)))) or ( all of ($s*) and (2 of ($c*) or all of ($g*))) or (4 of ($c*) and (1 of ($x*) or 2 of ($s*))) or ( all of ($g*) and 4 of ($c*)) or 13 of them )
+		uint16( 0 ) == 0x5a4d and ( ( 2 of ( $x* ) and ( all of ( $g* ) or ( 2 of ( $s* ) and 2 of ( $c* ) ) ) ) or ( all of ( $s* ) and ( 2 of ( $c* ) or all of ( $g* ) ) ) or ( 4 of ( $c* ) and ( 1 of ( $x* ) or 2 of ( $s* ) ) ) or ( all of ( $g* ) and 4 of ( $c* ) ) or 13 of them )
 }
 rule CAPE_Risepro : FILE
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "kevoreilly"
-		id = "63d9cb19-0688-5632-8477-ce9b7e986a55"
+		id = "fba64cd7-307a-5de1-97d8-551c22accacc"
 		date = "2023-12-16"
 		modified = "2023-12-16"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/RisePro.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/RisePro.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "1b69a1dd5961241b926605f0a015fa17149c3b2759fb077a30a22d4ddcc273f6"
-		logic_hash = "055ca8328923b91f93c116e4a856366356fa11155f4e9fde95da31129b51386a"
+		logic_hash = "v1_sha256_055ca8328923b91f93c116e4a856366356fa11155f4e9fde95da31129b51386a"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118872,20 +119107,20 @@ rule CAPE_Risepro : FILE
 		$c2 = {FF 75 30 83 3D [4] 10 BA [4] B9 [4] 0F 43 15 [4] 83 3D [4] 10 0F 43 0D [4] E8 [4] A3}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Privateloader
 {
 	meta:
 		description = "PrivateLoader indirect syscall capture"
 		author = "kevoreilly"
-		id = "3a0b16da-ec84-5761-bcf2-106362c5667d"
+		id = "5fd7457b-c49e-5011-b2e1-0af2bb446765"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/PrivateLoader.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "204a86bb3743f19fed0fe55ff5ccd716661f7f315b5966a29e434ccb3e160526"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/PrivateLoader.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_204a86bb3743f19fed0fe55ff5ccd716661f7f315b5966a29e434ccb3e160526"
 		score = 75
 		quality = 70
 		tags = ""
@@ -118903,13 +119138,13 @@ rule CAPE_Qakbot5_1 : FILE
 	meta:
 		description = "QakBot WMI anti-anti-vm"
 		author = "kevoreilly"
-		id = "d287b043-15df-5865-ad4c-9eb64ceec04c"
+		id = "8801195f-5a13-556b-8ae7-068e3ee835c1"
 		date = "2024-02-16"
 		modified = "2024-02-16"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/QakBot.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "303ea2d8d1a7f0fd0ca5508dae2c1b83c03b1e3e975760f15d36d93bcc152767"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/QakBot.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_303ea2d8d1a7f0fd0ca5508dae2c1b83c03b1e3e975760f15d36d93bcc152767"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118921,20 +119156,20 @@ rule CAPE_Qakbot5_1 : FILE
 		$conf = {0F B7 1D [4] B9 [2] 00 00 E8 [4] 8B D3 48 89 45 ?? 45 33 C9 48 8D 0D [4] 4C 8B C0 48 8B F8 E8}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Qakbot4_1 : FILE
 {
 	meta:
 		description = "QakBot Config Extraction"
 		author = "kevoreilly"
-		id = "401184cf-bbd7-5afe-9589-470f54721af1"
+		id = "1a39a06c-da71-56b1-a6c9-86cacb05aa0d"
 		date = "2024-02-16"
 		modified = "2024-02-16"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/QakBot.yar#L15-L29"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "ad75b07b9b786f634fd46cbe6dc089d3f732673320e70714e8ab058f0392c9f5"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/QakBot.yar#L15-L29"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_ad75b07b9b786f634fd46cbe6dc089d3f732673320e70714e8ab058f0392c9f5"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118948,21 +119183,21 @@ rule CAPE_Qakbot4_1 : FILE
 		$conf = {5F 5E 5B C9 C3 51 6A 00 E8 [4] 59 59 85 C0 75 01 C3}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Qakbotloader : FILE
 {
 	meta:
 		description = "QakBot Export Selection"
 		author = "kevoreilly"
-		id = "b2d5ef1c-0651-5249-9c4b-7e83235d4a30"
+		id = "8bae4c72-4e99-5406-ad40-e73417033fed"
 		date = "2024-02-16"
 		modified = "2024-02-16"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/QakBot.yar#L31-L46"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/QakBot.yar#L31-L46"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a"
-		logic_hash = "00869c0a9bf62cde3f46ca915b0ef689557b09dc58d6de34609e3998abfa7e98"
+		logic_hash = "v1_sha256_00869c0a9bf62cde3f46ca915b0ef689557b09dc58d6de34609e3998abfa7e98"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -118976,21 +119211,21 @@ rule CAPE_Qakbotloader : FILE
 		$getteb = {EB 00 55 8B EC 66 3B E4 74 ?? [1-5] 64 A1 18 00 00 00 5D EB}
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($export*)) and ($wind or $getteb)
+		uint16( 0 ) == 0x5A4D and ( any of ( $export* ) ) and ( $wind or $getteb )
 }
 rule CAPE_Qakbotantivm
 {
 	meta:
 		description = "QakBot AntiVM bypass"
 		author = "kevoreilly"
-		id = "7446522a-788a-512d-ad68-2fcc56169f5a"
+		id = "6ea67e18-79a3-5489-a00a-3fcb53ebef87"
 		date = "2024-02-16"
 		modified = "2024-02-16"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/QakBot.yar#L48-L59"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/QakBot.yar#L48-L59"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "e269497ce458b21c8427b3f6f6594a25d583490930af2d3395cb013b20d08ff7"
-		logic_hash = "20f1cd28f38945a3aa328e77e78525fb1ffc47ecf54d5a40c2f18264c3973989"
+		logic_hash = "v1_sha256_20f1cd28f38945a3aa328e77e78525fb1ffc47ecf54d5a40c2f18264c3973989"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119007,13 +119242,13 @@ rule CAPE_Zloader_1 : FILE
 	meta:
 		description = "Zloader API Spam Bypass"
 		author = "kevoreilly"
-		id = "8a8e7102-1138-59e7-95a6-8647d41d8521"
+		id = "ece349f1-f123-52e3-a32e-f447a34a8b56"
 		date = "2024-05-03"
 		modified = "2024-05-03"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Zloader.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "319adca805083c7f5854fe840447cf961addbd748f1f25eb8ec8cdeed7af38aa"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Zloader.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_319adca805083c7f5854fe840447cf961addbd748f1f25eb8ec8cdeed7af38aa"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119024,20 +119259,20 @@ rule CAPE_Zloader_1 : FILE
 		$traps = {6A 44 53 E8 [2] FF FF 83 C4 08 8D 85 ?? FF FF FF C7 85 ?? FF FF FF 44 00 00 00 50}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Zloader_2024 : FILE
 {
 	meta:
 		description = "Zloader Registry and Modulename Bypass"
 		author = "enzok"
-		id = "7100c27e-021f-552c-9a75-84b07a2f837e"
+		id = "b4e5dc9c-f994-5f10-86b2-f33dac27eab8"
 		date = "2024-05-03"
 		modified = "2024-05-03"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Zloader.yar#L14-L26"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "38d555ef5f613cf7ca043697c479100a7a22e7f043acf8b6a46f8009eb92fd7e"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Zloader.yar#L14-L26"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_38d555ef5f613cf7ca043697c479100a7a22e7f043acf8b6a46f8009eb92fd7e"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119049,20 +119284,20 @@ rule CAPE_Zloader_2024 : FILE
 		$name_1 = {56 5? 5? 4? 81 EC [4] C7 44 24 ?? 00 00 00 00 4? 8D 0D [4] E8 [4] 4? 89 [3] 4? 83 [3] 00 75}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Guloaderprecursor : FILE
 {
 	meta:
 		description = "Guloader precursor"
 		author = "kevoreilly"
-		id = "663f89d7-a18b-5b03-a7cb-52444a887fa4"
+		id = "8289ae16-bce3-58b9-8799-8045d79d648d"
 		date = "2023-10-02"
 		modified = "2023-10-02"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Guloader.yar#L17-L28"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "ea05c352739366a03da302074b01537382ba26f7fd5049004f156e47d284f070"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Guloader.yar#L17-L28"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_ea05c352739366a03da302074b01537382ba26f7fd5049004f156e47d284f070"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119073,20 +119308,20 @@ rule CAPE_Guloaderprecursor : FILE
 		$except = {8B 45 08 [0-3] 8B 00 [0-3] 8B 58 18 [0-20] 81 38 05 00 00 C0 0F 85 [4-7] 83 FB 00 (0F 84|74)}
 
 	condition:
-		2 of them and not uint16(0)==0x5A4D
+		2 of them and not uint16( 0 ) == 0x5A4D
 }
 rule CAPE_Rdtscpantivm
 {
 	meta:
 		description = "RdtscpAntiVM bypass"
 		author = "kevoreilly"
-		id = "11dc634b-1e2f-55b4-be60-98e51de42d43"
+		id = "6c0ec43a-2e82-5ffb-b8b2-9879806ddf98"
 		date = "2021-12-11"
 		modified = "2021-12-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/RdtscpAntiVM.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "be0f9b52fb630730a38160f4ad2d50b6b4bea5edd82e3ea4d1e257cf7b090910"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/RdtscpAntiVM.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_be0f9b52fb630730a38160f4ad2d50b6b4bea5edd82e3ea4d1e257cf7b090910"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119103,13 +119338,13 @@ rule CAPE_Icedidsyscallwritemem : FILE
 	meta:
 		description = "IcedID 'syscall' packer bypass - direct write variant"
 		author = "kevoreilly"
-		id = "67935058-4191-587f-ad19-497defd0eef1"
+		id = "d220d853-3236-56c8-be39-9724580aef7f"
 		date = "2023-11-28"
 		modified = "2023-11-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/IcedID.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "6b068106b038e9efeb9057cadf314d400c1ada1a1cc70336d3272da3a212c993"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/IcedID.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_6b068106b038e9efeb9057cadf314d400c1ada1a1cc70336d3272da3a212c993"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119121,20 +119356,20 @@ rule CAPE_Icedidsyscallwritemem : FILE
 		$tokencheck = {39 5D ?? 75 06 83 7D ?? 03 74 05 BB 01 00 00 00 41 89 1C ?? 48 8B 4D ?? 41 FF D?}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Icedidhook
 {
 	meta:
 		description = "IcedID hook fix"
 		author = "kevoreilly"
-		id = "011c9cb7-8080-5f8a-9dca-6397e9bf7bf6"
+		id = "994af780-d272-5dbc-8b60-6b5365220eae"
 		date = "2023-11-28"
 		modified = "2023-11-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/IcedID.yar#L15-L25"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "fd62e0ed6f2a18472fa9336daee0e8a3a55e21779a8385394e85f96da928e24f"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/IcedID.yar#L15-L25"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_fd62e0ed6f2a18472fa9336daee0e8a3a55e21779a8385394e85f96da928e24f"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119151,14 +119386,14 @@ rule CAPE_Icedidpackera : FILE
 	meta:
 		description = "IcedID export selection"
 		author = "kevoreilly"
-		id = "d793d8a1-0e17-56ad-933c-470e2290867b"
+		id = "d7bb4051-8fd2-5cc3-9872-5bd4f732d1d2"
 		date = "2023-11-28"
 		modified = "2023-11-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/IcedID.yar#L27-L40"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/IcedID.yar#L27-L40"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "fbad60002286599ca06d0ecb3624740efbf13ee5fda545341b3e0bf4d5348cfe"
-		logic_hash = "aa0681e7794546355e6d61f739c49035a493cdfca7e666531d74e3835ec44408"
+		logic_hash = "v1_sha256_aa0681e7794546355e6d61f739c49035a493cdfca7e666531d74e3835ec44408"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119170,21 +119405,21 @@ rule CAPE_Icedidpackera : FILE
 		$alloc = {8B 50 50 33 C9 44 8D 49 40 41 B8 00 30 00 00 FF 15 [4] 48 89 44 24 28 [0-3] 48 89 84 24 ?? 00 00 00 E9}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Icedidpackerb : FILE
 {
 	meta:
 		description = "IcedID export selection"
 		author = "kevoreilly"
-		id = "6bd0e64d-e60e-5cd2-af79-946a7f6dc9f5"
+		id = "fa6544d6-7e2f-54ed-a5e4-bf0483af339b"
 		date = "2023-11-28"
 		modified = "2023-11-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/IcedID.yar#L42-L56"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/IcedID.yar#L42-L56"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "6517ef2c579002ec62ddeb01a3175917c75d79ceca355c415a4462922c715cb6"
-		logic_hash = "fde1e2c0124d180b2fa3d0675b35e8d78fdd7b06cd27e9228c148aa29ce30ee7"
+		logic_hash = "v1_sha256_fde1e2c0124d180b2fa3d0675b35e8d78fdd7b06cd27e9228c148aa29ce30ee7"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119196,22 +119431,22 @@ rule CAPE_Icedidpackerb : FILE
 		$loop = {8B C2 48 8D 49 01 83 E0 07 FF C2 0F B6 44 30 ?? 30 41 FF 3B D5 72}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Icedidpackerc : FILE
 {
 	meta:
 		description = "IcedID export selection"
 		author = "kevoreilly"
-		id = "fddfd0d2-1bc0-56bb-b983-5850e17a3d0f"
+		id = "aab3a0bb-064c-5d33-a14f-0c588b19800d"
 		date = "2023-11-28"
 		modified = "2023-11-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/IcedID.yar#L58-L71"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/IcedID.yar#L58-L71"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "c06805b6efd482c1a671ec60c1469e47772c8937ec0496f74e987276fa9020a5"
 		hash = "265c1857ac7c20432f36e3967511f1be0b84b1c52e4867889e367c0b5828a844"
-		logic_hash = "f1e75e380ab0947fdfda012b7a5077a1c2ef51163239846ab2dc29cac95ba166"
+		logic_hash = "v1_sha256_f1e75e380ab0947fdfda012b7a5077a1c2ef51163239846ab2dc29cac95ba166"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119222,21 +119457,21 @@ rule CAPE_Icedidpackerc : FILE
 		$alloc = {41 B8 00 10 00 00 8B D0 33 C9 66 3B ?? (74|0F 84)}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Icedidpackerd : FILE
 {
 	meta:
 		description = "IcedID export selection"
 		author = "kevoreilly"
-		id = "df0ca4bd-1ea6-57ef-b85a-7ed0e2a20831"
+		id = "44707ca8-6a1d-5911-9ab1-9a3334a357f4"
 		date = "2023-11-28"
 		modified = "2023-11-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/IcedID.yar#L73-L86"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/IcedID.yar#L73-L86"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "7b226f8cc05fa7d846c52eb0ec386ab37f9bae04372372509daa6bacc9f885d8"
-		logic_hash = "6685e0246f5a11ce0ca33447837de06506b447a5f8591423e2b76f2ab0274dc7"
+		logic_hash = "v1_sha256_6685e0246f5a11ce0ca33447837de06506b447a5f8591423e2b76f2ab0274dc7"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119248,20 +119483,20 @@ rule CAPE_Icedidpackerd : FILE
 		$load = {41 B8 00 80 00 00 33 D2 48 8B 4C [2] EB ?? B9 69 04 00 00 E8 [4] 48 89 84 [2] 00 00 00 66 3B ED 74}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Icedsleep : FILE
 {
 	meta:
 		description = "IcedID sleep bypass"
 		author = "kevoreilly"
-		id = "d6bd708b-47bc-5620-b40e-8fe5f1a67ba4"
+		id = "251a448b-7e79-5d56-92bb-0abdbe8a4dfe"
 		date = "2023-11-28"
 		modified = "2023-11-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/IcedID.yar#L88-L99"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "0b1a8be95b1b8a3b066837f9e47561ee8202d741b39d64e626c0461c2fbf7c70"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/IcedID.yar#L88-L99"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_0b1a8be95b1b8a3b066837f9e47561ee8202d741b39d64e626c0461c2fbf7c70"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119272,20 +119507,20 @@ rule CAPE_Icedsleep : FILE
 		$sleep = {89 4C 24 08 48 83 EC 38 8B 44 24 40 48 69 C0 10 27 00 00 48 F7 D8 48 89 44 24 20 48 8D 54 24 20 33 C9 FF 15 [4] 48 83 C4 38 C3}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Ursnifv3_1
 {
 	meta:
 		description = "Ursnif Config Extraction"
 		author = "kevoreilly"
-		id = "4170b638-e51b-59c6-956a-50ff82f629ba"
+		id = "70a151d0-b5d6-56d8-b023-e166daa06ecf"
 		date = "2023-03-23"
 		modified = "2023-03-23"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/UrsnifV3.yar#L1-L16"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "d679546e37ee58087fce75920b2ce4e6d2b9ae55fb1ef80d14ec14309396757c"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/UrsnifV3.yar#L1-L16"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_d679546e37ee58087fce75920b2ce4e6d2b9ae55fb1ef80d14ec14309396757c"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119300,20 +119535,20 @@ rule CAPE_Ursnifv3_1
 		$cpuid = {8B C4 FF 18 8B F0 33 C0 0F A2 66 8C D8 66 8E D0 8B E5 8B C6 5E 5B 5D C3}
 
 	condition:
-		any of ($crypto32*) and $cpuid
+		any of ( $crypto32* ) and $cpuid
 }
 rule CAPE_Formhooka
 {
 	meta:
 		description = "Formbook Anti-hook Bypass"
 		author = "kevoreilly"
-		id = "6369de74-99eb-57ae-a315-c15f22effc73"
+		id = "c4cf6811-a337-5862-b141-296a73f0acff"
 		date = "2024-10-11"
 		modified = "2024-10-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Formbook.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "21b8101a7039cfad0e9d49cc1f055bc23a2eb4c973dcda2a81a007e452d77a6d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Formbook.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_21b8101a7039cfad0e9d49cc1f055bc23a2eb4c973dcda2a81a007e452d77a6d"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119333,13 +119568,13 @@ rule CAPE_Formhookb
 	meta:
 		description = "Formbook Anti-hook Bypass"
 		author = "kevoreilly"
-		id = "479afd45-8e59-5b31-8315-faf8284f0de4"
+		id = "193ac99b-df61-5488-ac16-8d8632b95b23"
 		date = "2024-10-11"
 		modified = "2024-10-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Formbook.yar#L16-L29"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "b8b677ca239c6c5faf44f7a46c1e3e231f5708fb13aac724fd3ac9f865b965d8"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Formbook.yar#L16-L29"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_b8b677ca239c6c5faf44f7a46c1e3e231f5708fb13aac724fd3ac9f865b965d8"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119359,13 +119594,13 @@ rule CAPE_Formconfa
 	meta:
 		description = "Formbook Config Extraction"
 		author = "kevoreilly"
-		id = "f9c3fc92-e2c8-5968-b0f4-80bd8199b7ca"
+		id = "e9b6c12d-1bc0-525f-9842-a7528d4b934d"
 		date = "2024-10-11"
 		modified = "2024-10-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Formbook.yar#L31-L43"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "b0aa4cec55a21245d8104380c531dd6cc0fdef64fbefd79616eadfb4e95b2d75"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Formbook.yar#L31-L43"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_b0aa4cec55a21245d8104380c531dd6cc0fdef64fbefd79616eadfb4e95b2d75"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119384,13 +119619,13 @@ rule CAPE_Formhelper
 	meta:
 		description = "Formbook Config Extraction"
 		author = "kevoreilly"
-		id = "88ff1354-1ae7-5380-a586-ef95212d59df"
+		id = "d7bf5b36-3489-5f84-a6c4-41c902683133"
 		date = "2024-10-11"
 		modified = "2024-10-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Formbook.yar#L45-L57"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "77cdfc94aac089c4f2590f4afbab35351fc6e104e67813548c68c59d27019a63"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Formbook.yar#L45-L57"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_77cdfc94aac089c4f2590f4afbab35351fc6e104e67813548c68c59d27019a63"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119409,13 +119644,13 @@ rule CAPE_Formconfb
 	meta:
 		description = "Formbook Config Extraction"
 		author = "kevoreilly"
-		id = "4c8c7939-07e8-5a1e-92a3-b62e322fb9b6"
+		id = "9f1770b9-2457-599e-a48e-f83884af35ce"
 		date = "2024-10-11"
 		modified = "2024-10-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Formbook.yar#L59-L73"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "8a96ef5c6cebb51186acd099b795066e8e8b2c2adbed4dcc66b81228f70e5c4f"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Formbook.yar#L59-L73"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_8a96ef5c6cebb51186acd099b795066e8e8b2c2adbed4dcc66b81228f70e5c4f"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119436,13 +119671,13 @@ rule CAPE_Formconfc
 	meta:
 		description = "Formbook Config Extraction"
 		author = "kevoreilly"
-		id = "cf155b6e-0821-5044-a84e-e4a101e55edd"
+		id = "0ba73bf6-0a30-56d4-aab7-b4b9a7bbc156"
 		date = "2024-10-11"
 		modified = "2024-10-11"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Formbook.yar#L75-L87"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "f52bce00d2ec88682115a8720f0a182b7ef7fe7b9b9fc466bb8ddc1779341509"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Formbook.yar#L75-L87"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_f52bce00d2ec88682115a8720f0a182b7ef7fe7b9b9fc466bb8ddc1779341509"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119461,14 +119696,14 @@ rule CAPE_Emotetpacker : FILE
 	meta:
 		description = "Emotet bypass"
 		author = "kevoreilly"
-		id = "67b8e14c-5fa8-52af-bb9a-1663b084fbf0"
+		id = "5f054906-4531-50fc-9cad-ef65817788d6"
 		date = "2022-06-09"
 		modified = "2022-06-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/EmotetPacker.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/EmotetPacker.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "5a95d1d87ce69881b58a0e3aafc1929861e2633cdd960021d7b23e2a36409e0d"
-		logic_hash = "5f27d9d18884f7e0805f69960869b332c1577bf8be8ac103285e8bf98cda0ffd"
+		logic_hash = "v1_sha256_5f27d9d18884f7e0805f69960869b332c1577bf8be8ac103285e8bf98cda0ffd"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119479,20 +119714,20 @@ rule CAPE_Emotetpacker : FILE
 		$trap2 = {F2 0F 10 15 [4] BE 01 00 00 00 0F 01 F9 C7 44 24 60 00 00 00 00 89 4C 24 60 0F 01 F9 C7 44 24 5C 00 00 00 00 89 4C 24 5C 0F 1F 84 00 00 00 00 00}
 
 	condition:
-		uint16(0)==0x5A4D and any of ($trap*)
+		uint16( 0 ) == 0x5A4D and any of ( $trap* )
 }
 rule CAPE_Mysterysnail
 {
 	meta:
 		description = "MysterySnail anti-sandbox bypass"
 		author = "kevoreilly"
-		id = "dfeb820a-3101-5588-8348-3b62a6900538"
+		id = "57cf8fd9-6719-5171-acba-49fca9de8365"
 		date = "2021-10-16"
 		modified = "2021-10-16"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/MysterySnail.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "9402dbbbfdd286e2309ee83fc08194f70f73657a3a4e3785dfbcb564dbee86a8"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/MysterySnail.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_9402dbbbfdd286e2309ee83fc08194f70f73657a3a4e3785dfbcb564dbee86a8"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119509,13 +119744,13 @@ rule CAPE_Bruteratelsyscall
 	meta:
 		description = "BruteRatel Syscall Bypass"
 		author = "kevoreilly"
-		id = "0ddc3e0a-c4ca-5342-b029-107ce1f2751e"
+		id = "aaaa50d1-4d02-5348-990a-bf1192b65196"
 		date = "2024-07-22"
 		modified = "2024-07-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/BruteRatel.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "5ed054b3cd5d2659c250945d55d6adac90945963c34ad2af0f8d7436141e86b6"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/BruteRatel.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_5ed054b3cd5d2659c250945d55d6adac90945963c34ad2af0f8d7436141e86b6"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119533,13 +119768,13 @@ rule CAPE_Bruteratelpacker
 	meta:
 		description = "BruteRatel Outer Encryption Layer"
 		author = "kevoreilly"
-		id = "631083be-7058-590a-a394-984545f42ad7"
+		id = "6dc17b53-42db-5dd9-906e-2a55b51bef8b"
 		date = "2024-07-22"
 		modified = "2024-07-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/BruteRatel.yar#L14-L26"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "2ccb17efe378d034df34d20d7580c58171d0fd11c18fef6c9a23f1ba238514e6"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/BruteRatel.yar#L14-L26"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_2ccb17efe378d034df34d20d7580c58171d0fd11c18fef6c9a23f1ba238514e6"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119551,20 +119786,20 @@ rule CAPE_Bruteratelpacker
 		$date = {48 8B 17 48 85 D2 0F 85 [2] 00 00 8B 47 08 85 C0 0F 85 [2] 00 00}
 
 	condition:
-		($outer) and not ($inner) and not ($date)
+		($outer ) and not ( $inner ) and not ( $date )
 }
 rule CAPE_Bruterateldate
 {
 	meta:
 		description = "BruteRatel Date Check Bypass"
 		author = "kevoreilly"
-		id = "94dd5cf3-ed59-51d6-92c8-aee73fe2926b"
+		id = "f7f40466-e17e-5de2-aa1c-db6158e875b7"
 		date = "2024-07-22"
 		modified = "2024-07-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/BruteRatel.yar#L28-L39"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "88589b2d08aea03565668ff1b9af20b6fe11cda50d867c60db7cb4d1826b0fd7"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/BruteRatel.yar#L28-L39"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_88589b2d08aea03565668ff1b9af20b6fe11cda50d867c60db7cb4d1826b0fd7"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119582,13 +119817,13 @@ rule CAPE_Bruteratelconfig
 	meta:
 		description = "BruteRatel Config Extraction"
 		author = "kevoreilly"
-		id = "5ae680b0-5ad2-5e82-87f8-b0af4fec18de"
+		id = "fafd8e2d-b712-5f66-9e7f-bff0aa347271"
 		date = "2024-07-22"
 		modified = "2024-07-22"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/BruteRatel.yar#L41-L51"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "b1815aafec940ab6c8daafc68ccf294845221ada260de5209dcb7e49ccd061c7"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/BruteRatel.yar#L41-L51"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_b1815aafec940ab6c8daafc68ccf294845221ada260de5209dcb7e49ccd061c7"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119605,13 +119840,13 @@ rule CAPE_Darkgateloader
 	meta:
 		description = "DarkGate Loader"
 		author = "enzok"
-		id = "ca39f39d-aa89-5018-bb07-008a6ea86c42"
+		id = "d765a863-c52b-5497-9a09-e91605da7735"
 		date = "2023-10-02"
 		modified = "2023-10-02"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/DarkGateLoader.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "56069f38edb7d50b0d5680a847d85b1aabc97e432a37911ac9d28aee3b12f526"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/DarkGateLoader.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_56069f38edb7d50b0d5680a847d85b1aabc97e432a37911ac9d28aee3b12f526"
 		score = 75
 		quality = 68
 		tags = ""
@@ -119625,20 +119860,20 @@ rule CAPE_Darkgateloader
 		$decrypt3 = {89 85 [4] 8B 85 [4] 8B F0 8D BD [4] B? 10 [3] F3 A5 8B 85 [4] 33 D2 [2] 8B 85 [4] 99}
 
 	condition:
-		$loader and any of ($decrypt*)
+		$loader and any of ( $decrypt* )
 }
 rule CAPE_Rhadamanthys_1
 {
 	meta:
 		description = "No description has been set in the source file - CAPE"
 		author = "kevoreilly"
-		id = "d9d387e1-76b3-55f6-a40f-a8c9cb9e9bea"
+		id = "f0c3586c-5cec-5ee3-88b3-19120f8129a3"
 		date = "2023-04-18"
 		modified = "2023-04-18"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Rhadamanthys.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "3c8fbfe14f81e099fc900023d9c856e3f45b99af38889ed952b2ac67a636f51d"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Rhadamanthys.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_3c8fbfe14f81e099fc900023d9c856e3f45b99af38889ed952b2ac67a636f51d"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119658,13 +119893,13 @@ rule CAPE_Agentteslav3Jit
 	meta:
 		description = "AgentTesla V3 JIT native string decryption"
 		author = "ClaudioWayne"
-		id = "590c5058-c1db-5366-8db5-57449a178999"
+		id = "2f83838c-c5bf-590e-a636-f2db52e5cfba"
 		date = "2024-02-27"
 		modified = "2024-02-27"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/AgentTesla.yar#L16-L26"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "62a49cf4295df637f96ba7c127cfc4aeb9af2fcced497fdf34d726a062edc1ec"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/AgentTesla.yar#L16-L26"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_62a49cf4295df637f96ba7c127cfc4aeb9af2fcced497fdf34d726a062edc1ec"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119681,13 +119916,13 @@ rule CAPE_Blister_1 : FILE
 	meta:
 		description = "Blister Sleep Bypass"
 		author = "kevoreilly"
-		id = "34657bab-f100-5ea8-9111-da2806f46b79"
+		id = "b7c5be3f-50a8-5bed-b556-4394855f03e9"
 		date = "2024-05-09"
 		modified = "2024-05-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Blister.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "aba379b93c85241cf250829832b2c8a5eaafb3abd0ff955dbaf0d06489c00deb"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Blister.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_aba379b93c85241cf250829832b2c8a5eaafb3abd0ff955dbaf0d06489c00deb"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119703,20 +119938,20 @@ rule CAPE_Blister_1 : FILE
 		$comp = {6A 04 59 A1 [4] 8B 78 04 8B 75 08 33 C0 F3 A7 75 0B 8B 45 0C 83 20 00 33 C0 40 EB 02 33 C0}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of ($protect,$lock,$comp) and all of ($sleep*)
+		uint16( 0 ) == 0x5A4D and 2 of ( $protect , $lock , $comp ) and all of ( $sleep* )
 }
 rule CAPE_Pikahook : FILE
 {
 	meta:
 		description = "Pikabot anti-hook bypass"
 		author = "kevoreilly"
-		id = "e1b7a807-135f-52d7-bc36-c0419e82b424"
+		id = "c1da74b4-c806-522d-b815-92ab6ac24abc"
 		date = "2024-03-12"
 		modified = "2024-03-12"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Pikabot.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "2a50a5f2d905122a5b7ac8ca3666b47caa24d325e246841129e53807daf2a1dd"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Pikabot.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_2a50a5f2d905122a5b7ac8ca3666b47caa24d325e246841129e53807daf2a1dd"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119729,21 +119964,21 @@ rule CAPE_Pikahook : FILE
 		$sysenter2 = {C7 44 24 0C 00 00 00 02 C7 44 24 08 00 00 00 02 8B 45 0C 89 44 24 04 8B 45 08 89 04 24 E8}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
 rule CAPE_Pikexport : FILE
 {
 	meta:
 		description = "Pikabot export selection"
 		author = "kevoreilly"
-		id = "7d2432f2-90ae-5ad0-b579-5789a1c14a08"
+		id = "e59f8eae-6f57-5bc4-bdd1-2715b1408426"
 		date = "2024-03-12"
 		modified = "2024-03-12"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Pikabot.yar#L16-L28"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Pikabot.yar#L16-L28"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646"
-		logic_hash = "33f58703a0e40c2361343dbdcc17111aafbf5cc912393edda79005c6ec566f42"
+		logic_hash = "v1_sha256_33f58703a0e40c2361343dbdcc17111aafbf5cc912393edda79005c6ec566f42"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119754,20 +119989,20 @@ rule CAPE_Pikexport : FILE
 		$pe = {B8 08 00 00 00 6B C8 00 8B 55 ?? 8B 45 ?? 03 44 0A 78 89 45 ?? 8B 4D ?? 8B 51 18 89 55 E8 C7 45 F8 00 00 00 00}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Vbcrypter
 {
 	meta:
 		description = "VBCrypter anti-hook Bypass"
 		author = "kevoreilly"
-		id = "2e010dfd-5096-5e81-af9b-174322a47d87"
+		id = "a65a987a-f6c0-5be4-ad98-9a411a7596d0"
 		date = "2021-03-28"
 		modified = "2021-03-28"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/VBCrypter.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "a62bca62ab624ab1a2c2e612c5b7e6d543006026a49c07c46800499e31e41c4e"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/VBCrypter.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_a62bca62ab624ab1a2c2e612c5b7e6d543006026a49c07c46800499e31e41c4e"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119784,13 +120019,13 @@ rule CAPE_Smokeloader_1 : FILE
 	meta:
 		description = "SmokeLoader Payload"
 		author = "kevoreilly"
-		id = "9df0eca1-009f-5e7e-af9f-9529581fb4b4"
+		id = "af8f85de-4992-5e1b-8564-69cbf83ce275"
 		date = "2023-02-06"
 		modified = "2023-02-06"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/SmokeLoader.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "4b15162f4b754cdd6a9124f29f0fd979085734063a0b17f2a97a9750f29e2e0b"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/SmokeLoader.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_4b15162f4b754cdd6a9124f29f0fd979085734063a0b17f2a97a9750f29e2e0b"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119800,20 +120035,20 @@ rule CAPE_Smokeloader_1 : FILE
 		$gate = {68 [2] 00 00 50 E8 [4] 8B 45 ?? 89 F1 8B 55 ?? 9A [2] 40 00 33 00 89 F9 89 FA 81 C1 [2] 00 00 81 C2 [2] 00 00 89 0A 8B 46 ?? 03 45 ?? 8B 4D ?? 8B 55 ?? 9A [2] 40 00 33 00}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Xworm_1
 {
 	meta:
 		description = "XWorm Config Extractor"
 		author = "kevoreilly"
-		id = "0f55dbfb-c239-53f2-a1e0-bfa494558d6e"
+		id = "7764eb2b-ab0b-5214-82ef-221060a895d9"
 		date = "2023-11-07"
 		modified = "2023-11-07"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/XWorm.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "d8e103f3470e83d71cd4992b74698c0721b8a69d764fdb7a4543997b2853014a"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/XWorm.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_d8e103f3470e83d71cd4992b74698c0721b8a69d764fdb7a4543997b2853014a"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119830,14 +120065,14 @@ rule CAPE_Stealcanti : FILE
 	meta:
 		description = "Stealc detonation bypass"
 		author = "kevoreilly"
-		id = "32e5c1cf-ef57-58eb-9deb-fab0064cc676"
+		id = "05e35b14-0465-55f6-bdfa-9a8495aaae64"
 		date = "2024-01-19"
 		modified = "2024-01-19"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Stealc.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Stealc.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d"
-		logic_hash = "4132e8094b0b49a89e9f40a8b1a6abbf105bbb04e4ddf3ce739e39fc2baf0d13"
+		logic_hash = "v1_sha256_4132e8094b0b49a89e9f40a8b1a6abbf105bbb04e4ddf3ce739e39fc2baf0d13"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119848,20 +120083,20 @@ rule CAPE_Stealcanti : FILE
 		$decode = {6A 03 33 D2 8B F8 59 F7 F1 8B C7 85 D2 74 04 2B C2 03 C1 6A 06 C1 E0 03 33 D2 59 F7 F1}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Stealcstrings : FILE
 {
 	meta:
 		description = "Stealc string decryption"
 		author = "kevoreilly"
-		id = "087b5532-e1e7-5df9-adb2-bf758c8ba352"
+		id = "0a685017-e4ee-5aed-a9f3-aa1458c6acee"
 		date = "2024-01-19"
 		modified = "2024-01-19"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Stealc.yar#L15-L26"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "6d402446a979c00b6257ace9924db381d98c530b22968bd2776c66d58c7faefc"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Stealc.yar#L15-L26"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_6d402446a979c00b6257ace9924db381d98c530b22968bd2776c66d58c7faefc"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119872,21 +120107,21 @@ rule CAPE_Stealcstrings : FILE
 		$decode = {51 8B 15 [4] 52 8B 45 ?? 50 E8 [4] 83 C4 0C 6A 04 6A 00 8D 4D ?? 51 FF 15 [4] 83 C4 0C 8B 45 ?? 8B E5 5D C3}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule CAPE_Latrodectus_1 : FILE
 {
 	meta:
 		description = "Latrodectus export selection"
 		author = "kevoreilly"
-		id = "7c6f167a-6b76-5509-b164-306d1cd19b0f"
+		id = "c688d6fa-610c-5c94-817c-e6e78bf03688"
 		date = "2024-02-26"
 		modified = "2024-02-26"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Latrodectus.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Latrodectus.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "378d220bc863a527c2bca204daba36f10358e058df49ef088f8b1045604d9d05"
-		logic_hash = "c2c9f23e287253d766425c05eb774f6e07bdcbabc259e04b723a1a87c8b91fbd"
+		logic_hash = "v1_sha256_c2c9f23e287253d766425c05eb774f6e07bdcbabc259e04b723a1a87c8b91fbd"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119896,21 +120131,21 @@ rule CAPE_Latrodectus_1 : FILE
 		$export = {48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 56 48 83 EC 30 4C 8B 05 [4] 33 D2 C7 40 [5] 88 50 ?? 49 63 40 3C 42 8B 8C 00 88 00 00 00 85 C9 0F 84}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Anticuckoo : FILE
 {
 	meta:
 		description = "AntiCuckoo bypass: https://github.com/therealdreg/anticuckoo"
 		author = "kevoreilly"
-		id = "e221e57b-313e-5998-a3fc-5b4e9671b989"
+		id = "b93d79b5-96f7-573a-982c-d2654e651df4"
 		date = "2023-03-17"
 		modified = "2023-03-17"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/AntiCuckoo.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/AntiCuckoo.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
 		hash = "ad5e52f144bb4a1dae3090978c6ecb4c7732538c9b62a6cedd32eccee6094be5"
-		logic_hash = "a039aeca2dae44980e8bffafacfda90975e107001be50f11ac916b35ad43592e"
+		logic_hash = "v1_sha256_a039aeca2dae44980e8bffafacfda90975e107001be50f11ac916b35ad43592e"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -119920,20 +120155,20 @@ rule CAPE_Anticuckoo : FILE
 		$HKActivOldStackCrash = {5B 81 FB FA FA FA FA 74 01 41 3B E0 75 ?? 83 E9 0B 83 F9 04 7F 04 C6 45 ?? 00 89 4D ?? 89 65 ?? 80 7D ?? 00 74}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule CAPE_Bumblebeeshellcode_1
 {
 	meta:
 		description = "BumbleBee Loader 2023"
 		author = "kevoreilly"
-		id = "20dd4668-497d-5f37-a61e-c154209503b8"
+		id = "7221ce0f-d848-5cda-b300-173db839f01a"
 		date = "2023-02-08"
 		modified = "2023-02-08"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/BumbleBee.yar#L18-L32"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "865510868ee7c089c2ada0645098e851ca2bb9084a74315ce16296eb19c93ab4"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/BumbleBee.yar#L18-L32"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_865510868ee7c089c2ada0645098e851ca2bb9084a74315ce16296eb19c93ab4"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119954,13 +120189,13 @@ rule CAPE_Loadersyscall
 	meta:
 		description = "Loader Syscall"
 		author = "enzok"
-		id = "45193b38-938e-55cf-9ea0-7bd48f0d77e4"
+		id = "5dc50e02-3085-5d19-a77e-6f9e03405912"
 		date = "2024-12-02"
 		modified = "2024-12-02"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/NitrogenLoader.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "3c7ffd8b95032cffecff7fa7e5f5f561cce13e1109f6a9b30bc743642b495e45"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/NitrogenLoader.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_3c7ffd8b95032cffecff7fa7e5f5f561cce13e1109f6a9b30bc743642b495e45"
 		score = 75
 		quality = 70
 		tags = ""
@@ -119979,13 +120214,13 @@ rule CAPE_Nitrogenloaderaes
 	meta:
 		description = "NitrogenLoader AES and IV"
 		author = "enzok"
-		id = "c79a00af-52f9-5f07-9c58-e8964e70986f"
+		id = "359f7461-e468-5ef4-98cb-298ac6b7018b"
 		date = "2024-12-02"
 		modified = "2024-12-02"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/NitrogenLoader.yar#L15-L27"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "de8ed0e98948cfadfd579e334fd9ce9f777ddbd988de897529ba71cb5eb2d396"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/NitrogenLoader.yar#L15-L27"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_de8ed0e98948cfadfd579e334fd9ce9f777ddbd988de897529ba71cb5eb2d396"
 		score = 75
 		quality = 70
 		tags = ""
@@ -120004,13 +120239,13 @@ rule CAPE_Nitrogenloaderbypass
 	meta:
 		description = "Nitrogen Loader Exit Bypass"
 		author = "enzok"
-		id = "397b0b79-d569-5a71-bcac-ce0d64f706e6"
+		id = "6a089a05-cf15-5b7e-8af8-9ec6faca49b7"
 		date = "2024-12-02"
 		modified = "2024-12-02"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/NitrogenLoader.yar#L29-L41"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "3a034d3ddd18723ea1f91814c8c2a2c47a749dfd1496a5d4777d8ff8bfab3457"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/NitrogenLoader.yar#L29-L41"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_3a034d3ddd18723ea1f91814c8c2a2c47a749dfd1496a5d4777d8ff8bfab3457"
 		score = 75
 		quality = 70
 		tags = ""
@@ -120029,13 +120264,13 @@ rule CAPE_Nitrogenloaderconfig
 	meta:
 		description = "NitrogenLoader Config Extraction"
 		author = "enzok"
-		id = "a23d7012-b7b2-5313-9974-d65c1364c630"
+		id = "b8bd4624-f50e-5657-bfe4-b6586dc5f9d2"
 		date = "2024-12-02"
 		modified = "2024-12-02"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/NitrogenLoader.yar#L43-L54"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "a1f9e95b8039b16e3926b7288c036e81cf72b2dbb91ab9e69125f18d89fa1a03"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/NitrogenLoader.yar#L43-L54"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_a1f9e95b8039b16e3926b7288c036e81cf72b2dbb91ab9e69125f18d89fa1a03"
 		score = 75
 		quality = 70
 		tags = ""
@@ -120053,13 +120288,13 @@ rule CAPE_Lumma_1 : FILE
 	meta:
 		description = "Lumma config extraction"
 		author = "kevoreilly"
-		id = "b2166620-3070-5727-b189-e6959cc5b698"
+		id = "07d5bdbc-4c50-5208-89a9-486d88868264"
 		date = "2024-05-09"
 		modified = "2024-05-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Lumma.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "a8f9212b619796f91f14c4164e4d2f30c66b51118f22f3d6c310841b6707b7b0"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Lumma.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_a8f9212b619796f91f14c4164e4d2f30c66b51118f22f3d6c310841b6707b7b0"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -120072,20 +120307,20 @@ rule CAPE_Lumma_1 : FILE
 		$patch = {66 C7 0? 00 00 8B 46 1? C6 00 01 8B}
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
 rule CAPE_Lummaremap
 {
 	meta:
 		description = "Lumma ntdll-remap bypass"
 		author = "kevoreilly"
-		id = "93ae37d1-a38a-5f96-8bb3-cc648a49b588"
+		id = "54393835-eef6-52ca-b292-89da953cff80"
 		date = "2024-05-09"
 		modified = "2024-05-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/Lumma.yar#L16-L27"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "51093379fbd041f75bdfe161bc9dfcc7d782c23ce16d625ca558bb58d8d57713"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/Lumma.yar#L16-L27"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_51093379fbd041f75bdfe161bc9dfcc7d782c23ce16d625ca558bb58d8d57713"
 		score = 75
 		quality = 70
 		tags = ""
@@ -120103,13 +120338,13 @@ rule CAPE_Slowloader
 	meta:
 		description = "SlowLoader detonation aide for slow cpus (thread race)"
 		author = "kevoreilly"
-		id = "05724bf4-b767-542d-a2dd-a9ae3e5ea5cc"
+		id = "cc9d7f48-4e78-5752-bf85-0fddba3a6740"
 		date = "2024-09-23"
 		modified = "2024-09-23"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/SlowLoader.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "f07528c646ebd980a5e843caa4a4715e31b22c3cd091576600e9fe45d7fc2fe4"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/SlowLoader.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_f07528c646ebd980a5e843caa4a4715e31b22c3cd091576600e9fe45d7fc2fe4"
 		score = 75
 		quality = 70
 		tags = ""
@@ -120127,13 +120362,13 @@ rule CAPE_Dridexloader_1 : FILE
 	meta:
 		description = "DridexLoader API Spam Bypass"
 		author = "kevoreilly"
-		id = "a8b62f64-87a0-58d3-8876-9b0f6a7deb97"
+		id = "3f8955e9-f9bb-5930-be9d-a7402ac3fc48"
 		date = "2021-03-09"
 		modified = "2021-03-09"
 		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/analyzer/windows/data/yara/DridexLoader.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/ca46353c771fd52356f83576df5b5c783af00d48/LICENSE"
-		logic_hash = "00a3e4e80a2558ee52035f091e2339fa2dad6f6515b9dc099f2f3800e4c70bce"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/analyzer/windows/data/yara/DridexLoader.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/7aae5b71ad4a1bbb4912792a8a857b33e1ab3f43/LICENSE"
+		logic_hash = "v1_sha256_00a3e4e80a2558ee52035f091e2339fa2dad6f6515b9dc099f2f3800e4c70bce"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -120143,13 +120378,13 @@ rule CAPE_Dridexloader_1 : FILE
 		$trap = {6A 50 6A 14 6A 03 5A 8D 4C 24 ?? E8 [4] 68 [4] 68 [4] E8 [4] 85 C0 74 05}
 
 	condition:
-		uint16(0)==0x5A4D and $trap
+		uint16( 0 ) == 0x5A4D and $trap
 }
 /*
  * YARA Rule Set
  * Repository Name: BinaryAlert
  * Repository: https://github.com/airbnb/binaryalert/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: a9c0f06affc35e1f8e45bb77f835b92350c68a0b
  * Number of Rules: 78
  * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -120365,32 +120600,32 @@ private rule BINARYALERT_Macho_PRIVATE : FILE
 	meta:
 		description = "Mach-O binaries"
 		author = "Airbnb"
-		id = "04e14811-38be-54eb-8ec0-649d5469078a"
+		id = "40526d0e-dede-5001-996c-b12f668a7f53"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/airbnb/binaryalert/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/MachO.yara#L1-L7"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "2e992eb7d4ea47c9f61f3a7d8b0b6e37d0423fb08a626eaf2ddea51bfd928dfc"
+		logic_hash = "v1_sha256_2e992eb7d4ea47c9f61f3a7d8b0b6e37d0423fb08a626eaf2ddea51bfd928dfc"
 		score = 75
 		quality = 80
 		tags = "FILE"
 
 	condition:
-		uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xcafebabe or uint32(0)==0xbebafeca
+		uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xcefaedfe or uint32( 0 ) == 0xfeedfacf or uint32( 0 ) == 0xcffaedfe or uint32( 0 ) == 0xcafebabe or uint32( 0 ) == 0xbebafeca
 }
 rule BINARYALERT_Eicar_Av_Test
 {
 	meta:
 		description = "This is a standard AV test, intended to verify that BinaryAlert is working correctly."
 		author = "Austin Byers | Airbnb CSIRT"
-		id = "4dbb9d9d-9a8b-56f0-878a-a4a362a2c4f8"
+		id = "74ff23ad-17f4-5a5f-bdd8-45fb756bcb90"
 		date = "2018-04-17"
 		modified = "2018-04-17"
 		reference = "http://www.eicar.org/86-0-Intended-use.html"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/eicar.yara#L1-L18"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "870db233ca083fae19a88a109e13d086c76df2340b709eb2da565c08574a42bd"
+		logic_hash = "v1_sha256_870db233ca083fae19a88a109e13d086c76df2340b709eb2da565c08574a42bd"
 		score = 50
 		quality = 80
 		tags = ""
@@ -120406,13 +120641,13 @@ rule BINARYALERT_Eicar_Substring_Test
 	meta:
 		description = "Standard AV test, checking for an EICAR substring"
 		author = "Austin Byers | Airbnb CSIRT"
-		id = "43af8d40-16be-5948-839e-b58cb36c4155"
+		id = "4fab4178-a047-5700-9d31-5a8a8bdafb59"
 		date = "2018-04-17"
 		modified = "2018-04-17"
 		reference = "https://github.com/airbnb/binaryalert/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/eicar.yara#L20-L34"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "9dc46b273d12d4431b833d4380235b387de4b3aab1f6211b868ada1d1339383a"
+		logic_hash = "v1_sha256_9dc46b273d12d4431b833d4380235b387de4b3aab1f6211b868ada1d1339383a"
 		score = 50
 		quality = 40
 		tags = ""
@@ -120428,14 +120663,14 @@ rule BINARYALERT_Malware_Macos_Proton_Rat_Generic
 	meta:
 		description = "No description has been set in the source file - BinaryAlert"
 		author = "@mimeframe"
-		id = "75cfaaff-e8d7-5cd4-953b-7d2011139725"
+		id = "be649af5-398a-53ab-9379-9482a8f20bae"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://objective-see.com/blog/blog_0x1D.html"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_proton_rat_generic.yara#L3-L21"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "6a2d0c8b20efc3fa283176a4bc76d6fd"
-		logic_hash = "b7d8660320564cba1d8e2d53d1fdc75509140c7e87a572b27931c62201df2d22"
+		logic_hash = "v1_sha256_b7d8660320564cba1d8e2d53d1fdc75509140c7e87a572b27931c62201df2d22"
 		score = 75
 		quality = 64
 		tags = ""
@@ -120449,20 +120684,20 @@ rule BINARYALERT_Malware_Macos_Proton_Rat_Generic
 		$b4 = "Entering interactive session." nocase wide ascii
 
 	condition:
-		BINARYALERT_Macho_PRIVATE and any of ($a*) and any of ($b*)
+		BINARYALERT_Macho_PRIVATE and any of ( $a* ) and any of ( $b* )
 }
 rule BINARYALERT_Malware_Macos_Bella
 {
 	meta:
 		description = "Bella is a pure python post-exploitation data mining tool & remote administration tool for macOS."
 		author = "@mimeframe"
-		id = "ca4ab508-8c97-5307-9aaf-db10cfd6ab35"
+		id = "818dfc39-5f64-501d-82a6-aad09f81e0b6"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/Trietptm-on-Security/Bella"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_bella.yara#L1-L22"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "b9c063b5ec8604958d3417ec8640da4314ebcf60ee55413a2f6fa8d138311614"
+		logic_hash = "v1_sha256_b9c063b5ec8604958d3417ec8640da4314ebcf60ee55413a2f6fa8d138311614"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120479,21 +120714,21 @@ rule BINARYALERT_Malware_Macos_Bella
 		$c2 = "What port should Bella connect on [Default is 4545]:" wide ascii
 
 	condition:
-		any of ($a*) or all of ($b*) or all of ($c*)
+		any of ( $a* ) or all of ( $b* ) or all of ( $c* )
 }
 rule BINARYALERT_Malware_Macos_Apt_Sofacy_Xagent
 {
 	meta:
 		description = "sofacy xagent for macOS"
 		author = "@mimeframe"
-		id = "91bef771-2ef1-58f6-ae01-3bdde4cc003c"
+		id = "acacca78-bd3a-53d3-8b91-ab9e8e6eb855"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://blog.malwarebytes.com/cybercrime/2017/03/two-new-mac-backdoors-discovered/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_apt_sofacy_xagent.yara#L3-L62"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "4fe4b9560e99e33dabca553e2eeee510"
-		logic_hash = "d4b1096e4aeb8382e5abf93d3ecf71cd6ae2ed7afbc9a38549a2fc2739539674"
+		logic_hash = "v1_sha256_d4b1096e4aeb8382e5abf93d3ecf71cd6ae2ed7afbc9a38549a2fc2739539674"
 		score = 75
 		quality = 55
 		tags = ""
@@ -120544,20 +120779,20 @@ rule BINARYALERT_Malware_Macos_Apt_Sofacy_Xagent
 		$e10 = "channel=" fullword ascii wide
 
 	condition:
-		BINARYALERT_Macho_PRIVATE and (5 of ($a*) or any of ($b*) or any of ($c*) or 4 of ($d*) or 5 of ($e*))
+		BINARYALERT_Macho_PRIVATE and ( 5 of ( $a* ) or any of ( $b* ) or any of ( $c* ) or 4 of ( $d* ) or 5 of ( $e* ) )
 }
 rule BINARYALERT_Malware_Macos_Neoneggplant_Eggshell
 {
 	meta:
 		description = "EggShell is an iOS and macOS post exploitation surveillance pentest tool written in Python."
 		author = "@mimeframe"
-		id = "274a34cc-9403-50e6-aa64-683a41bc30e6"
+		id = "a82fea1e-85c8-53b1-bfe5-3b42ebb555b4"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/neoneggplant/EggShell"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_neoneggplant_eggshell.yara#L1-L24"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "34906db9398313ccb84e67bd98e94324c628aefe3efa6ba3cca2df042b42cbe7"
+		logic_hash = "v1_sha256_34906db9398313ccb84e67bd98e94324c628aefe3efa6ba3cca2df042b42cbe7"
 		score = 50
 		quality = 80
 		tags = ""
@@ -120576,23 +120811,21 @@ rule BINARYALERT_Malware_Macos_Neoneggplant_Eggshell
 		$c4 = "rmpersistence" wide ascii
 
 	condition:
-		all of ($a*) or 3 of ($b*) or 3 of ($c*)
+		all of ( $a* ) or 3 of ( $b* ) or 3 of ( $c* )
 }
-import "pe"
-
 rule BINARYALERT_Malware_Macos_Macspy : FILE
 {
 	meta:
 		description = "macSpy is a malware-as-a-service (MaaS) product advertised as the most sophisticated Mac spyware ever"
 		author = "AlienVault Labs"
-		id = "5f9a5ed5-a982-552c-a6df-326228eaf459"
+		id = "0ec647b9-6a78-5cb8-ba29-a2571679ebfd"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_macspy.yara#L3-L17"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "6c03e4a9bcb9afaedb7451a33c214ae4"
-		logic_hash = "f04648860c9602e43516113000908008847dacfbe189d79e13737bcd034b68a0"
+		logic_hash = "v1_sha256_f04648860c9602e43516113000908008847dacfbe189d79e13737bcd034b68a0"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -120604,20 +120837,20 @@ rule BINARYALERT_Malware_Macos_Macspy : FILE
 		$c1 = { 76 31 09 00 76 32 09 00 76 33 09 00 69 31 09 00 69 32 09 00 69 33 09 00 69 34 09 00 66 31 09 00 66 32 09 00 66 33 09 00 66 34 09 00 74 63 3A 00 }
 
 	condition:
-		($header0 at 0 or $header1 at 0 or $header2 at 0) and $c1
+		($header0 at 0 or $header1 at 0 or $header2 at 0 ) and $c1
 }
 rule BINARYALERT_Malware_Macos_Marten4N6_Evilosx
 {
 	meta:
 		description = "EvilOSX is a pure python, post-exploitation, RAT (Remote Administration Tool) for macOS / OSX."
 		author = "@mimeframe"
-		id = "2b2e62ca-f95c-55c5-aaf6-985aab49dfbb"
+		id = "91459c8f-4829-54bb-adb5-9814e655ba09"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/Marten4n6/EvilOSX"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_marten4n6_evilosx.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "3402ebf34fd507d0c317416bf77bb3d51b67c8b0f099ce68d15ade6a6a2e302a"
+		logic_hash = "v1_sha256_3402ebf34fd507d0c317416bf77bb3d51b67c8b0f099ce68d15ade6a6a2e302a"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120630,20 +120863,20 @@ rule BINARYALERT_Malware_Macos_Marten4N6_Evilosx
 		$a5 = "Starting EvilOSX..." wide ascii
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule BINARYALERT_Malware_Multi_Vesche_Basicrat
 {
 	meta:
 		description = "cross-platform Python 2.x Remote Access Trojan (RAT)"
 		author = "@mimeframe"
-		id = "e07a684c-3a3d-5dd3-a540-2cc9a5a170dd"
+		id = "82792b2c-96c1-5216-a26f-3988ee8f7193"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/vesche/basicRAT"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/multi/malware_multi_vesche_basicrat.yara#L1-L15"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "1503ce9de4e721903058c77b305ba057052d654ff1875ea880f4319c3e525a29"
+		logic_hash = "v1_sha256_1503ce9de4e721903058c77b305ba057052d654ff1875ea880f4319c3e525a29"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120656,20 +120889,20 @@ rule BINARYALERT_Malware_Multi_Vesche_Basicrat
 		$a5 = "Persistence unsuccessful," wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Malware_Multi_Pupy_Rat
 {
 	meta:
 		description = "pupy - opensource cross platform rat and post-exploitation tool"
 		author = "@mimeframe"
-		id = "b26deb19-85b2-5d39-9ff2-0ab9017f3263"
+		id = "5878190c-36dd-5060-816b-c9316500b8e8"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/n1nj4sec/pupy"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/multi/malware_multi_pupy_rat.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "bb5d1e7f2aea94dc41efe75690ae31409e8f6305aa6c4ec0cd46922ee8fb7241"
+		logic_hash = "v1_sha256_bb5d1e7f2aea94dc41efe75690ae31409e8f6305aa6c4ec0cd46922ee8fb7241"
 		score = 75
 		quality = 74
 		tags = ""
@@ -120683,21 +120916,21 @@ rule BINARYALERT_Malware_Multi_Pupy_Rat
 		$a6 = "-PUPY_CONFIG_COMES_HERE-" wide ascii
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_1
 {
 	meta:
 		description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
 		author = "@fusionrace"
-		id = "6b5709fd-a923-56b6-98ab-ae036f9d04c3"
+		id = "3e59cac6-43ae-517d-b4d0-d9e85e31f7b3"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://securelist.com/introducing-whitebear/81638/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_whitebear_binary_loader_1.yara#L1-L22"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "b099b82acb860d9a9a571515024b35f0"
-		logic_hash = "f6706c66a378b80d3cedf118a812d8add60e12b44402a30d941d08ff30c7ab1c"
+		logic_hash = "v1_sha256_f6706c66a378b80d3cedf118a812d8add60e12b44402a30d941d08ff30c7ab1c"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120715,21 +120948,21 @@ rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_1
 		$a10 = "### LOCAL TRANSPORT MANAGER ###" wide ascii
 
 	condition:
-		6 of ($a*)
+		6 of ( $a* )
 }
 rule BINARYALERT_Malware_Windows_Remcos_Rat
 {
 	meta:
 		description = "No description has been set in the source file - BinaryAlert"
 		author = "@mimeframe"
-		id = "420c135f-3150-5cb9-9c1c-105cd260d713"
+		id = "d471a7f8-b7b3-531b-9ef2-5aeda6b9e875"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://breaking-security.net/remcos/remcos-changelog/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_remcos_rat.yara#L1-L20"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "c8dafe143fe1d81ae6a3c0cd4724b272"
-		logic_hash = "ec1ec69f628111235bafad8177482256ed571c064a81f01b6ec2643dccc926ad"
+		logic_hash = "v1_sha256_ec1ec69f628111235bafad8177482256ed571c064a81f01b6ec2643dccc926ad"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120746,20 +120979,20 @@ rule BINARYALERT_Malware_Windows_Remcos_Rat
 		$c2 = "REMCOS v" wide ascii
 
 	condition:
-		any of ($a*) or 3 of ($b*) or all of ($c*)
+		any of ( $a* ) or 3 of ( $b* ) or all of ( $c* )
 }
 rule BINARYALERT_Ccleaner_Backdoor
 {
 	meta:
 		description = "Ccleaner 5.33 backdoor with a possible APT17/Group72 connection."
 		author = "@fusionrace"
-		id = "769e4fcb-9638-5a5b-8b73-a1cda3bc286a"
+		id = "4a5ad694-0367-5957-857e-70456adaf6b5"
 		date = "2017-12-14"
 		modified = "2017-12-14"
 		reference = "http://blog.talosintelligence.com/2017/09/ccleaner-c2-concern.html"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_ccleaner_backdoor.yara#L1-L15"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "ce3fc54d58e337ab17e6f1ba7745c593210483c02ed3969059a8fe6682d87218"
+		logic_hash = "v1_sha256_ce3fc54d58e337ab17e6f1ba7745c593210483c02ed3969059a8fe6682d87218"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120774,21 +121007,19 @@ rule BINARYALERT_Ccleaner_Backdoor
 	condition:
 		$s1
 }
-import "pe"
-
 rule BINARYALERT_Malware_Windows_Moonlightmaze_Wipe : FILE
 {
 	meta:
 		description = "Rule to detect log cleaner based on wipe.c"
 		author = "Kaspersky Lab"
-		id = "35060c3d-b805-54a6-a241-eb6e99168fa8"
+		id = "cfa2cd74-bf28-508f-99ed-782e893802bc"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "http://www.afn.org/~afn28925/wipe.c"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_wipe.yara#L3-L18"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "e69efc504934551c6a77b525d5343241"
-		logic_hash = "0241d1ca9f5a4d066f7ed2e80bc18ebae3723c6a2364422e31909e8f0e576675"
+		logic_hash = "v1_sha256_0241d1ca9f5a4d066f7ed2e80bc18ebae3723c6a2364422e31909e8f0e576675"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -120800,20 +121031,20 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_Wipe : FILE
 		$a4 = "Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"
 
 	condition:
-		( uint32(0)==0x464c457f) and (2 of them )
+		( uint32( 0 ) == 0x464c457f ) and ( 2 of them )
 }
 rule BINARYALERT_Malware_Windows_Moonlightmaze_De_Tool
 {
 	meta:
 		description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
 		author = "Kaspersky Lab"
-		id = "8b943c21-eac7-521d-8dc6-90d611aa4d92"
+		id = "58ac43de-2205-5b5b-91a2-0982a87e2dbf"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_de_tool.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "836331856200fde9792d3bf97d3a18b7f4497ceaae1cfceb0de7c2949e315b9c"
+		logic_hash = "v1_sha256_836331856200fde9792d3bf97d3a18b7f4497ceaae1cfceb0de7c2949e315b9c"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120826,22 +121057,20 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_De_Tool
 		$a3 = {25 73 0A 25 73 0A 25 73 0A 25 73 0A}
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
-import "pe"
-
 rule BINARYALERT_Malware_Windows_Moonlightmaze_IRIX_Exploit_GEN : FILE
 {
 	meta:
 		description = "Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers"
 		author = "Kaspersky Lab"
-		id = "4f9ab7b0-4fb9-5311-ae23-01d0a9e2e104"
+		id = "84e347ea-ce69-5197-a4bd-456b839d0c8d"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://www.exploit-db.com/exploits/19274/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_IRIX_exploit_GEN.yara#L3-L20"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "9d55d780c84f2aa4e64c19842b2055ef4bf7c8844ebe622c3942445b06ab8344"
+		logic_hash = "v1_sha256_9d55d780c84f2aa4e64c19842b2055ef4bf7c8844ebe622c3942445b06ab8344"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -120856,21 +121085,21 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_IRIX_Exploit_GEN : FILE
 		$a2 = "execl failed"
 
 	condition:
-		( uint32(0)==0x464c457f) and ( all of them )
+		( uint32( 0 ) == 0x464c457f ) and ( all of them )
 }
 rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_2
 {
 	meta:
 		description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
 		author = "@fusionrace"
-		id = "d97b7fe1-7ff3-5cc0-9085-140ed523421f"
+		id = "9cd5a7d9-16aa-5969-a5b5-ee71fafb2d28"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://securelist.com/introducing-whitebear/81638/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_whitebear_binary_loader_2.yara#L1-L17"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "06bd89448a10aa5c2f4ca46b4709a879"
-		logic_hash = "9bb7fc3b3bf7f91efbba128895bb61b5a1bbdb6625d84836956de5e884ae3fe1"
+		logic_hash = "v1_sha256_9bb7fc3b3bf7f91efbba128895bb61b5a1bbdb6625d84836956de5e884ae3fe1"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120883,21 +121112,21 @@ rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_2
 		$b5 = "CMessageProcessingSystem::Receive_TAKE_CAN_NOT_WORK" wide ascii
 
 	condition:
-		3 of ($b*)
+		3 of ( $b* )
 }
 rule BINARYALERT_Malware_Windows_Apt_Red_Leaves_Generic
 {
 	meta:
 		description = "Red Leaves malware, related to APT10"
 		author = "David Cannings"
-		id = "e0067b05-eb4a-52ec-8f35-9336a631f03b"
+		id = "9db152ef-db42-5546-9c6c-7d69343beee0"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/nccgroup/Cyber-Defence/blob/master/Technical%20Notes/Red%20Leaves/Source/Red%20Leaves%20technical%20note%20v1.0.md"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_red_leaves_generic.yara#L1-L27"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "81df89d6fa0b26cadd4e50ef5350f341"
-		logic_hash = "be03bba9d01e6584b5849514656fd7de866c478f343c0bc618d7dbeda1771696"
+		logic_hash = "v1_sha256_be03bba9d01e6584b5849514656fd7de866c478f343c0bc618d7dbeda1771696"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120920,20 +121149,20 @@ rule BINARYALERT_Malware_Windows_Apt_Red_Leaves_Generic
 		$a15 = "__msgid" wide
 
 	condition:
-		7 of ($a*)
+		7 of ( $a* )
 }
 rule BINARYALERT_Malware_Windows_Moonlightmaze_Xk_Keylogger
 {
 	meta:
 		description = "Rule to detect Moonlight Maze 'xk' keylogger"
 		author = "Kaspersky Lab"
-		id = "5623021d-0d70-59b3-ae30-522e81552da0"
+		id = "72b453e3-7dfa-5f6d-beae-a828ef1f8872"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_xk_keylogger.yara#L1-L22"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "430027b41aeda9a11dadec2e4d3dd2474852ff3a7656ed7128711a1574e66b8f"
+		logic_hash = "v1_sha256_430027b41aeda9a11dadec2e4d3dd2474852ff3a7656ed7128711a1574e66b8f"
 		score = 75
 		quality = 30
 		tags = ""
@@ -120953,20 +121182,20 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_Xk_Keylogger
 		$a12 = "mygid=-%d-" fullword
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule BINARYALERT_Malware_Windows_Moonlightmaze_Encrypted_Keyloger
 {
 	meta:
 		description = "Rule to detect Moonlight Maze encrypted keylogger logs"
 		author = "Kaspersky Lab"
-		id = "4f290d77-5cb5-5f07-98fd-1829e2f00e63"
+		id = "35232b40-ea5f-51ae-acc9-41bc4cedaf85"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_encrypted_keyloger.yara#L1-L11"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "cdcbe112ae394ce0922647904f70cfae626d413d1770b0e20d2ba49e1f4e2d2d"
+		logic_hash = "v1_sha256_cdcbe112ae394ce0922647904f70cfae626d413d1770b0e20d2ba49e1f4e2d2d"
 		score = 75
 		quality = 80
 		tags = ""
@@ -120975,20 +121204,20 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_Encrypted_Keyloger
 		$a1 = {47 01 22 2A 6D 3E 39 2C}
 
 	condition:
-		($a1 at 0)
+		($a1 at 0 )
 }
 rule BINARYALERT_Malware_Windows_Moonlightmaze_Custom_Sniffer
 {
 	meta:
 		description = "Rule to detect Moonlight Maze sniffer tools"
 		author = "Kaspersky Lab"
-		id = "a9f005e0-8d73-58ff-b010-d3ce08ffdb64"
+		id = "5a120f8a-3845-52b7-a55d-404d5ec867dd"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_custom_sniffer.yara#L1-L20"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "466be027f567fe0afc88c82d94e4e0171b4b7d8f38d27a4c4a18cec4ca2b8b2f"
+		logic_hash = "v1_sha256_466be027f567fe0afc88c82d94e4e0171b4b7d8f38d27a4c4a18cec4ca2b8b2f"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121004,20 +121233,20 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_Custom_Sniffer
 		$a6 = "mydevname= |%s|" fullword
 
 	condition:
-		any of ($a*)
+		any of ( $a* )
 }
 rule BINARYALERT_Malware_Windows_Moonlightmaze_Loki2Crypto
 {
 	meta:
 		description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
 		author = "Costin Raiu, Kaspersky Lab"
-		id = "eb5fc283-4994-5db5-965d-e90caad95f4c"
+		id = "359943ab-dbc1-54b8-839a-7ea550bc1bf1"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_loki2crypto.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "abb2093844af1b854a9deed5baab3f4d67bd1189a4520f697aa69b7441d9488c"
+		logic_hash = "v1_sha256_abb2093844af1b854a9deed5baab3f4d67bd1189a4520f697aa69b7441d9488c"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121038,14 +121267,14 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_Cle_Tool
 	meta:
 		description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
 		author = "Kaspersky Lab"
-		id = "d875a3cf-cad1-509f-bb9f-27f0a3a9b79d"
+		id = "a42b449d-e167-5805-88da-fc9bd102e52d"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_cle_tool.yara#L1-L17"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "647d7b711f7b4434145ea30d0ef207b0"
-		logic_hash = "8f75df1240b9e5e905492106265a7e1342db4140d715529933af4ba5c8ec6331"
+		logic_hash = "v1_sha256_8f75df1240b9e5e905492106265a7e1342db4140d715529933af4ba5c8ec6331"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121059,20 +121288,20 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_Cle_Tool
 		$a6 = "No good line"
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule BINARYALERT_Malware_Windows_Xrat_Quasarrat
 {
 	meta:
 		description = "xRAT is a derivative of QuasarRAT; this catches both RATs."
 		author = "@mimeframe"
-		id = "f4db2402-3653-5525-a137-de2de29cef28"
+		id = "b876fe20-bf97-5383-a6ac-a3b8c72734b8"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/quasar/QuasarRAT"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_xrat_quasarrat.yara#L1-L31"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "92533157a62ccae5d1bdc9d0bb7511817422c6b5d75d013a15173cd1121d099e"
+		logic_hash = "v1_sha256_92533157a62ccae5d1bdc9d0bb7511817422c6b5d75d013a15173cd1121d099e"
 		score = 75
 		quality = 30
 		tags = ""
@@ -121098,22 +121327,20 @@ rule BINARYALERT_Malware_Windows_Xrat_Quasarrat
 		$c6 = "Process already elevated." wide ascii
 
 	condition:
-		5 of ($a*) or 5 of ($b*) or 5 of ($c*)
+		5 of ( $a* ) or 5 of ( $b* ) or 5 of ( $c* )
 }
-import "pe"
-
 rule BINARYALERT_Malware_Windows_Moonlightmaze_U_Logcleaner : FILE
 {
 	meta:
 		description = "Rule to detect log cleaners based on utclean.c"
 		author = "Kaspersky Lab"
-		id = "2dc1b796-c8fe-5a87-9d6b-3a322f4a43ab"
+		id = "34f7808d-ff4e-562b-b638-1351bc1338cc"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "http://cd.textfiles.com/cuteskunk/Unix-Hacking-Exploits/utclean.c"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_u_logcleaner.yara#L3-L18"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "65fe29075294dfad06f4cca631d5d2f1283c439e9a5913f503fe6e4bb1f5f70a"
+		logic_hash = "v1_sha256_65fe29075294dfad06f4cca631d5d2f1283c439e9a5913f503fe6e4bb1f5f70a"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -121126,21 +121353,21 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_U_Logcleaner : FILE
 		$a3 = "ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"
 
 	condition:
-		( uint32(0)==0x464c457f) and ( any of them )
+		( uint32( 0 ) == 0x464c457f ) and ( any of them )
 }
 rule BINARYALERT_Malware_Windows_Winnti_Loadperf_Dll_Loader
 {
 	meta:
 		description = "Winnti APT group; gzwrite64 imported from loadoerf.ini"
 		author = "@mimeframe"
-		id = "41444dd5-41b9-550c-9124-bc7f41326baa"
+		id = "ec681aca-add9-5f00-a139-3f9df569061f"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_winnti_loadperf_dll_loader.yara#L1-L13"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "879ce99e253e598a3c156258a9e81457"
-		logic_hash = "b1035174edfff2e142026f3482fc53407af59f5215a6030c0d2a85501152c3db"
+		logic_hash = "v1_sha256_b1035174edfff2e142026f3482fc53407af59f5215a6030c0d2a85501152c3db"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121150,20 +121377,20 @@ rule BINARYALERT_Malware_Windows_Winnti_Loadperf_Dll_Loader
 		$s2 = "gzwrite64" fullword ascii wide
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
 rule BINARYALERT_Malware_Windows_T3Ntman_Crunchrat
 {
 	meta:
 		description = "HTTPS-based Remote Administration Tool (RAT)"
 		author = "@mimeframe"
-		id = "c5b0d183-8822-505a-a1ff-7d6f75a3f174"
+		id = "63011719-c97a-5503-b0cc-0cc0978184dd"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/t3ntman/CrunchRAT"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_t3ntman_crunchrat.yara#L1-L19"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "b5216b2b30d22f3d3848e1fb6e4245c558366fb8cd35b70f10fa4e605e211204"
+		logic_hash = "v1_sha256_b5216b2b30d22f3d3848e1fb6e4245c558366fb8cd35b70f10fa4e605e211204"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121180,21 +121407,21 @@ rule BINARYALERT_Malware_Windows_T3Ntman_Crunchrat
 		$a9 = "<action>" wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_3
 {
 	meta:
 		description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
 		author = "@fusionrace"
-		id = "bdcc0c30-3aa7-5c92-8205-9b360d10ac59"
+		id = "4f47a9d1-63a4-5ee2-b516-f4c5c056deaf"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://securelist.com/introducing-whitebear/81638/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_whitebear_binary_loader_3.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "b099b82acb860d9a9a571515024b35f0"
-		logic_hash = "955aad2d72407baa7fb71e04b51557649a6f91633f5bdb1a8792e328a1587d23"
+		logic_hash = "v1_sha256_955aad2d72407baa7fb71e04b51557649a6f91633f5bdb1a8792e328a1587d23"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121206,20 +121433,20 @@ rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_3
 		$c4 = "\\\\.\\pipe\\Winsock2\\CatalogChangeListener-%02x%02x-%01x" wide ascii
 
 	condition:
-		all of ($c*)
+		all of ( $c* )
 }
 rule BINARYALERT_Malware_Windows_Moonlightmaze_Loki
 {
 	meta:
 		description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
 		author = "Kaspersky Lab"
-		id = "06eeb6a4-540f-51eb-86f9-4ab49543f645"
+		id = "32bad2dd-3ea6-5548-b9cf-55cc22f27741"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_loki.yara#L1-L27"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "9a403695ded6ff3626820ba0d4abde7ccd6f3fa6bfd8aa4ceaf0cc009d34c97f"
+		logic_hash = "v1_sha256_9a403695ded6ff3626820ba0d4abde7ccd6f3fa6bfd8aa4ceaf0cc009d34c97f"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121243,21 +121470,21 @@ rule BINARYALERT_Malware_Windows_Moonlightmaze_Loki
 		$a11 = "ork error" ascii fullword
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule BINARYALERT_Malware_Windows_Pony_Stealer
 {
 	meta:
 		description = "Pony stealer malware"
 		author = "@mimeframe"
-		id = "77af81cb-36c7-56a7-bd89-14d79628e5c4"
+		id = "f7fb074b-ad74-50b9-9c26-2e3892c3659c"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://www.knowbe4.com/pony-stealer"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_pony_stealer.yara#L1-L21"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "5e52ce394c3be2a685dbb8f435e2f64f"
-		logic_hash = "4d4e28e0d4d97412a9129a4abfadc130a464a2ababf46ca8f366a2a30b262261"
+		logic_hash = "v1_sha256_4d4e28e0d4d97412a9129a4abfadc130a464a2ababf46ca8f366a2a30b262261"
 		score = 75
 		quality = 50
 		tags = ""
@@ -121275,21 +121502,21 @@ rule BINARYALERT_Malware_Windows_Pony_Stealer
 		$a10 = "CuteFTP" nocase wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Ransomware_Windows_Petya_Variant_1
 {
 	meta:
 		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE"
 		author = "@fusionrace"
-		id = "bf56c0e4-585c-509b-a182-a93c74be7524"
+		id = "ad4c8999-ddfa-5a61-96a7-662909932800"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_1.yara#L1-L18"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "71b6a493388e7d0b40c83ce903bc6b04"
-		logic_hash = "3733834ee2271a483739b09c4222d222aa4899cab48fd8fc558bdbd9a66bf2d6"
+		logic_hash = "v1_sha256_3733834ee2271a483739b09c4222d222aa4899cab48fd8fc558bdbd9a66bf2d6"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121310,14 +121537,14 @@ rule BINARYALERT_Ransomware_Windows_Petya_Variant_3
 	meta:
 		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE"
 		author = "@fusionrace"
-		id = "cbf06e62-abe8-54af-b4f4-624ba9233e4b"
+		id = "7904c9d7-8d39-52b7-9482-db5f305bf057"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_3.yara#L1-L13"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "71b6a493388e7d0b40c83ce903bc6b04"
-		logic_hash = "4f21b394eb2dd0ebf416b018f438934fdc89cb896701d95b593477fc19abfe48"
+		logic_hash = "v1_sha256_4f21b394eb2dd0ebf416b018f438934fdc89cb896701d95b593477fc19abfe48"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121334,14 +121561,14 @@ rule BINARYALERT_Ransomware_Windows_Cryptolocker
 	meta:
 		description = "The CryptoLocker malware propagated via infected email attachments, and via an existing botnet; when activated, the malware encrypts files stored on local and mounted network drives"
 		author = "@fusionrace"
-		id = "be205f4b-d078-5437-bacc-203c816db2fa"
+		id = "0759d912-5c03-59ef-8699-701c659f0dba"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://www.secureworks.com/research/cryptolocker-ransomware"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_cryptolocker.yara#L1-L21"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "012d9088558072bc3103ab5da39ddd54"
-		logic_hash = "317cbc01b4c329befeb5b25478f7827298a26d21b872ae232c519febd9c547fc"
+		logic_hash = "v1_sha256_317cbc01b4c329befeb5b25478f7827298a26d21b872ae232c519febd9c547fc"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121366,14 +121593,14 @@ rule BINARYALERT_Ransomware_Windows_Petya_Variant_2
 	meta:
 		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE"
 		author = "@fusionrace"
-		id = "6401fd7e-5ef7-58b5-b8d3-a63c70e8daa3"
+		id = "ffae8969-c899-5687-9bf7-6b0b89ac8cb8"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_2.yara#L1-L17"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "71b6a493388e7d0b40c83ce903bc6b04"
-		logic_hash = "7e04ffd0423cd1288af5c045bb06930abb732c0ea059e329cafc05faecb4f982"
+		logic_hash = "v1_sha256_7e04ffd0423cd1288af5c045bb06930abb732c0ea059e329cafc05faecb4f982"
 		score = 75
 		quality = 78
 		tags = ""
@@ -121393,14 +121620,14 @@ rule BINARYALERT_Ransomware_Windows_Zcrypt
 	meta:
 		description = "Zcrypt will encrypt data and append the .zcrypt extension to the filenames"
 		author = "@fusionrace"
-		id = "d79cd266-4e77-562c-975c-8bf72efe7242"
+		id = "dca86d99-d23b-524b-957d-8113d016a0c5"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://blog.malwarebytes.com/threat-analysis/2016/06/zcrypt-ransomware/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_zcrypt.yara#L1-L23"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "d1e75b274211a78d9c5d38c8ff2e1778"
-		logic_hash = "df4073363da162e69f29493b5bfb4cb3f3d342357335c13ba6a3ac868607cb25"
+		logic_hash = "v1_sha256_df4073363da162e69f29493b5bfb4cb3f3d342357335c13ba6a3ac868607cb25"
 		score = 75
 		quality = 78
 		tags = ""
@@ -121418,21 +121645,21 @@ rule BINARYALERT_Ransomware_Windows_Zcrypt
 		$g6 = "How to decrypt files.html" fullword ascii wide
 
 	condition:
-		any of ($u*) or all of ($g*)
+		any of ( $u* ) or all of ( $g* )
 }
 rule BINARYALERT_Ransomware_Windows_Petya_Variant_Bitcoin
 {
 	meta:
 		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE: Bitcoin"
 		author = "@fusionrace"
-		id = "82d6ecc5-7c90-5d50-90ff-f54f8d87685d"
+		id = "b0ef902c-38e9-5ba8-a246-1c91e18bcf57"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_bitcoin.yara#L1-L13"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "71b6a493388e7d0b40c83ce903bc6b04"
-		logic_hash = "9a5e183aa8e1387e76d5df4e967943b730ba780b6758af3ef23e21bb9e4ce3a6"
+		logic_hash = "v1_sha256_9a5e183aa8e1387e76d5df4e967943b730ba780b6758af3ef23e21bb9e4ce3a6"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121443,20 +121670,18 @@ rule BINARYALERT_Ransomware_Windows_Petya_Variant_Bitcoin
 	condition:
 		$s1
 }
-import "pe"
-
 rule BINARYALERT_Ransomware_Windows_Lazarus_Wannacry : FILE
 {
 	meta:
 		description = "Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta"
 		author = "Costin G. Raiu, Kaspersky Lab"
-		id = "6335bd03-0625-5856-891c-9a5decd7e00f"
+		id = "7edbb117-42c4-50d1-8b89-ac8c07d020ac"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://twitter.com/neelmehta/status/864164081116225536"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_lazarus_wannacry.yara#L3-L32"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "dddff5f74bf3f11baf1d3853d6cb5e5b1e0c5e75445c421d4d5145f7a496fc4b"
+		logic_hash = "v1_sha256_dddff5f74bf3f11baf1d3853d6cb5e5b1e0c5e75445c421d4d5145f7a496fc4b"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -121483,21 +121708,21 @@ rule BINARYALERT_Ransomware_Windows_Lazarus_Wannacry : FILE
         }
 
 	condition:
-		(( uint16(0)==0x5A4D)) and all of them
+		(( uint16( 0 ) == 0x5A4D ) ) and all of them
 }
 rule BINARYALERT_Ransomware_Windows_Hddcryptora
 {
 	meta:
 		description = "The HDDCryptor ransomware encrypts local harddisks as well as resources in network shares via Server Message Block (SMB)"
 		author = "@fusionrace"
-		id = "56d7f1f5-811d-58c9-9e1d-d2f48c01e167"
+		id = "0abf4448-48ae-573d-8d0a-1d7b9906af70"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/bksod-by-ransomware-hddcryptor-uses-commercial-tools-to-encrypt-network-shares-and-lock-hdds/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_HDDCryptorA.yara#L1-L23"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "498bdcfb93d13fecaf92e96f77063abf"
-		logic_hash = "24c113be31c3df7b544a5789bf055f77471d450c07f0a6729a715e2a82b4d1f0"
+		logic_hash = "v1_sha256_24c113be31c3df7b544a5789bf055f77471d450c07f0a6729a715e2a82b4d1f0"
 		score = 75
 		quality = 78
 		tags = ""
@@ -121515,21 +121740,21 @@ rule BINARYALERT_Ransomware_Windows_Hddcryptora
 		$g6 = "you can only use AES to encrypt the boot partition!" ascii wide
 
 	condition:
-		2 of ($u*) or 4 of ($g*)
+		2 of ( $u* ) or 4 of ( $g* )
 }
 rule BINARYALERT_Ransomware_Windows_Cerber_Evasion
 {
 	meta:
 		description = "Cerber Ransomware: Evades detection by machine learning applications"
 		author = "@fusionrace"
-		id = "6e2f44a9-bc0f-5071-9d80-ddfb778cfe5d"
+		id = "3919c122-b9b0-524f-b0df-d6a19d2e6a6e"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "http://www.darkreading.com/vulnerabilities---threats/cerber-ransomware-now-evades-machine-learning/d/d-id/1328506"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_cerber_evasion.yara#L1-L15"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "bc62b557d48f3501c383f25d014f22df"
-		logic_hash = "43b3b8be5a23b57f6c671abd8491cdc51af1cf3a3fe8a7be308150697cdb92ea"
+		logic_hash = "v1_sha256_43b3b8be5a23b57f6c671abd8491cdc51af1cf3a3fe8a7be308150697cdb92ea"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121547,14 +121772,14 @@ rule BINARYALERT_Ransomware_Windows_Hydracrypt
 	meta:
 		description = "HydraCrypt encrypts a victim’s files and appends the filenames with the extension “hydracrypt_ID_*"
 		author = "@fusionrace"
-		id = "9ebf205e-b6a9-55a3-b0c3-9b088790dc9a"
+		id = "954d9dfd-4f29-5d16-b5d3-70918e2be564"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/hydracrypt-variant-of-ransomware-distributed-by-angler-exploit-kit/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_hydracrypt.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "08b304d01220f9de63244b4666621bba"
-		logic_hash = "3ecb3e6c269f4145e60b0e7bb0e896120ceb2db2123f847bf4bdf5d4490467d5"
+		logic_hash = "v1_sha256_3ecb3e6c269f4145e60b0e7bb0e896120ceb2db2123f847bf4bdf5d4490467d5"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121574,14 +121799,14 @@ rule BINARYALERT_Ransomware_Windows_Wannacry
 	meta:
 		description = "wannacry ransomware for windows"
 		author = "@fusionrace"
-		id = "0269b6f4-a47d-5683-aaaa-2141ca7f04dc"
+		id = "b6cea810-af47-5616-9bcf-7cb7ca36519c"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_wannacry.yara#L1-L23"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "4fef5e34143e646dbf9907c4374276f5"
-		logic_hash = "c01f460c0f5e39cde5f553c966553fe693e5203cb020b8f571eac6fc193fa91b"
+		logic_hash = "v1_sha256_c01f460c0f5e39cde5f553c966553fe693e5203cb020b8f571eac6fc193fa91b"
 		score = 75
 		quality = 50
 		tags = ""
@@ -121597,21 +121822,21 @@ rule BINARYALERT_Ransomware_Windows_Wannacry
 		$b5 = "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94" wide ascii
 
 	condition:
-		all of ($a*) or any of ($b*)
+		all of ( $a* ) or any of ( $b* )
 }
 rule BINARYALERT_Ransomware_Windows_Powerware_Locky
 {
 	meta:
 		description = "PowerWare Ransomware"
 		author = "@fusionrace"
-		id = "8a1a56af-7a9d-54ed-90b9-daf33735ee1e"
+		id = "065b8f4e-2bed-5419-b8db-b84b11e9e0f5"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://researchcenter.paloaltonetworks.com/2016/07/unit42-powerware-ransomware-spoofing-locky-malware-family/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_powerware_locky.yara#L1-L17"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
 		hash = "3433a4da9d8794709630eb06afd2b8c1"
-		logic_hash = "64de34755f706a9fd4c876c473eed4f8922a4450c7ef135b0ab5e49c67363baf"
+		logic_hash = "v1_sha256_64de34755f706a9fd4c876c473eed4f8922a4450c7ef135b0ab5e49c67363baf"
 		score = 75
 		quality = 78
 		tags = ""
@@ -121629,13 +121854,13 @@ rule BINARYALERT_Hacktool_Macos_Manwhoami_Mmetokendecrypt
 	meta:
 		description = "This program decrypts / extracts all authorization tokens on macOS / OS X / OSX."
 		author = "@mimeframe"
-		id = "2dc01ff3-4c4a-548d-b2f0-b36897ad6a5c"
+		id = "8792bf45-9c92-53cf-a288-e38fe2a19642"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/manwhoami/MMeTokenDecrypt"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_manwhoami_mmetokendecrypt.yara#L1-L15"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "ccfedfbff0c6eefe41e80fe488d4cae928a33e7b86019c6ec54d1c9005b35147"
+		logic_hash = "v1_sha256_ccfedfbff0c6eefe41e80fe488d4cae928a33e7b86019c6ec54d1c9005b35147"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121648,20 +121873,20 @@ rule BINARYALERT_Hacktool_Macos_Manwhoami_Mmetokendecrypt
 		$a5 = "Successfully decrypted token plist!" wide ascii
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Keylogger_Skreweverything_Swift
 {
 	meta:
 		description = "It is a simple and easy to use keylogger for macOS written in Swift."
 		author = "@mimeframe"
-		id = "a4918bc3-d3f0-59f4-894f-fd34ee944fac"
+		id = "eed3b9bb-e8e4-53b6-8d17-8aa989d8a2fc"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/SkrewEverything/Swift-Keylogger"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_skreweverything_swift.yara#L1-L15"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f400b8ec392417e7443e82a2c2a9adfc868b9795aa1fb29f91d228f6f94efd13"
+		logic_hash = "v1_sha256_f400b8ec392417e7443e82a2c2a9adfc868b9795aa1fb29f91d228f6f94efd13"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121674,20 +121899,20 @@ rule BINARYALERT_Hacktool_Macos_Keylogger_Skreweverything_Swift
 		$a5 = "LEFTARROW" wide ascii
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Keylogger_Logkext
 {
 	meta:
 		description = "LogKext is an open source keylogger for Mac OS X, a product of FSB software."
 		author = "@mimeframe"
-		id = "2e4ad9d0-5780-5a28-a76d-baac401b0648"
+		id = "849cbd43-288b-55de-b031-09322e49784c"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/SlEePlEs5/logKext"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_logkext.yara#L1-L25"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f0e3a7ea8ec4568c319e44f00d71fb368948b6fe08bdf86de4b33f0d2bafbb44"
+		logic_hash = "v1_sha256_f0e3a7ea8ec4568c319e44f00d71fb368948b6fe08bdf86de4b33f0d2bafbb44"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121706,20 +121931,20 @@ rule BINARYALERT_Hacktool_Macos_Keylogger_Logkext
 		$d3 = "Added notification for keyboard" wide ascii
 
 	condition:
-		3 of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
+		3 of ( $a* ) or all of ( $b* ) or all of ( $c* ) or all of ( $d* )
 }
 rule BINARYALERT_Hacktool_Macos_Keylogger_Eldeveloper_Keystats
 {
 	meta:
 		description = "A simple keylogger for macOS."
 		author = "@mimeframe"
-		id = "7fddb502-ae2d-5e14-95f5-115498fa5926"
+		id = "468bf492-2fab-5658-9744-8967a52457e3"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/ElDeveloper/keystats"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_eldeveloper_keystats.yara#L1-L13"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "c73f5ca2ba0a1bde7c1f9b96173938e40511e12f875c4d850d6d498c63e89385"
+		logic_hash = "v1_sha256_c73f5ca2ba0a1bde7c1f9b96173938e40511e12f875c4d850d6d498c63e89385"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121730,20 +121955,20 @@ rule BINARYALERT_Hacktool_Macos_Keylogger_Eldeveloper_Keystats
 		$a3 = "YVBKeyLoggerPerishedByUserChangeNotification" wide ascii
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Keylogger_Roxlu_Ofxkeylogger
 {
 	meta:
 		description = "ofxKeylogger keylogger."
 		author = "@mimeframe"
-		id = "c0e00b76-9623-5709-b64b-0afe006eba60"
+		id = "622d7da4-25da-56a4-9e60-a225c2eaf0a1"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/roxlu/ofxKeylogger"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_roxlu_ofxkeylogger.yara#L1-L13"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "6e2579a10327cc8f1799848b3bcbcd95733a31098faeb849df6ebf99f1ffe808"
+		logic_hash = "v1_sha256_6e2579a10327cc8f1799848b3bcbcd95733a31098faeb849df6ebf99f1ffe808"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121754,20 +121979,20 @@ rule BINARYALERT_Hacktool_Macos_Keylogger_Roxlu_Ofxkeylogger
 		$a3 = "keylogger_set_callback" wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Exploit_Cve_5889
 {
 	meta:
 		description = "No description has been set in the source file - BinaryAlert"
 		author = "@mimeframe"
-		id = "ea70d31c-1b70-5927-ba8d-e13d2114e74e"
+		id = "fbc2c577-6954-51aa-a79f-974f856faf42"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://www.exploit-db.com/exploits/38371/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_exploit_cve_2015_5889.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "b455759ea369cdcf2f05a2735a38000179ebe644667016cd635dfad9beda4459"
+		logic_hash = "v1_sha256_b455759ea369cdcf2f05a2735a38000179ebe644667016cd635dfad9beda4459"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121781,20 +122006,20 @@ rule BINARYALERT_Hacktool_Macos_Exploit_Cve_5889
 		$a6 = "localhost" fullword wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Manwhoami_Osxchromedecrypt
 {
 	meta:
 		description = "Decrypt Google Chrome / Chromium passwords and credit cards on macOS / OS X."
 		author = "@mimeframe"
-		id = "874cc999-d9c2-5017-83ec-e4be8a659476"
+		id = "1cae37d5-2995-55f6-b821-d89334f11b9a"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/manwhoami/OSXChromeDecrypt"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_manwhoami_osxchromedecrypt.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "0974c6a5e7875e20380df0f58bf22a589b9a5c718e635ec77b42060abcf99473"
+		logic_hash = "v1_sha256_0974c6a5e7875e20380df0f58bf22a589b9a5c718e635ec77b42060abcf99473"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121808,20 +122033,20 @@ rule BINARYALERT_Hacktool_Macos_Manwhoami_Osxchromedecrypt
 		$b2 = "select username_value, password_value, origin_url, submit_element from logins" wide ascii
 
 	condition:
-		3 of ($a*) or all of ($b*)
+		3 of ( $a* ) or all of ( $b* )
 }
 rule BINARYALERT_Hacktool_Macos_Ptoomey3_Keychain_Dumper
 {
 	meta:
 		description = "Keychain dumping utility."
 		author = "@mimeframe"
-		id = "c45abbbe-f5fe-5a87-acd4-dcdb99ceec28"
+		id = "7be4b137-619d-5d19-ac31-5c0148a3a77a"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/ptoomey3/Keychain-Dumper"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_ptoomey3_keychain_dumper.yara#L1-L15"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f2ef979e4682ce617b37f7503ec2ca520e657b4f6d15a75afad59b62191a1a43"
+		logic_hash = "v1_sha256_f2ef979e4682ce617b37f7503ec2ca520e657b4f6d15a75afad59b62191a1a43"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121834,20 +122059,20 @@ rule BINARYALERT_Hacktool_Macos_Ptoomey3_Keychain_Dumper
 		$a5 = "dumpEntitlements" wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Keylogger_Caseyscarborough
 {
 	meta:
 		description = "A simple and easy to use keylogger for macOS."
 		author = "@mimeframe"
-		id = "82d9ff7e-b475-5888-82e1-f65c286a9cde"
+		id = "191efd22-3f9e-57da-992f-3cc2ab6ecdfa"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/caseyscarborough/keylogger"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_caseyscarborough.yara#L1-L14"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "d97fbfefe027a26ec998743b811734e62423e8a5ba4e11d516dcfc9e4831d296"
+		logic_hash = "v1_sha256_d97fbfefe027a26ec998743b811734e62423e8a5ba4e11d516dcfc9e4831d296"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121859,20 +122084,20 @@ rule BINARYALERT_Hacktool_Macos_Keylogger_Caseyscarborough
 		$a4 = "ERROR: Unable to open log file. Ensure that you have the proper permissions." wide ascii
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Manwhoami_Icloudcontacts
 {
 	meta:
 		description = "Pulls iCloud Contacts for an account. No dependencies. No user notification."
 		author = "@mimeframe"
-		id = "b6595540-7f89-5764-b34e-d32c1a377b6c"
+		id = "7c1f218e-c790-50ce-9408-d20747abde2e"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/manwhoami/iCloudContacts"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_manwhoami_icloudcontacts.yara#L1-L14"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "0c5b81454b26de91f5ad126b24f10397e1da5d8561b0bf22c5df128753df0ac2"
+		logic_hash = "v1_sha256_0c5b81454b26de91f5ad126b24f10397e1da5d8561b0bf22c5df128753df0ac2"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121884,20 +122109,20 @@ rule BINARYALERT_Hacktool_Macos_Manwhoami_Icloudcontacts
 		$a4 = "HTTP Error 404: URL not found. Did you enter a username?" wide ascii
 
 	condition:
-		3 of ($a*)
+		3 of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Keylogger_Dannvix
 {
 	meta:
 		description = "A simple keylogger for macOS."
 		author = "@mimeframe"
-		id = "598d6dbc-540d-5f96-8bd1-c15e6194012e"
+		id = "175e0f9f-fd57-5306-807f-911031d7537d"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/dannvix/keylogger-osx"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_dannvix.yara#L1-L13"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "95d0540b1308caf3e7287c70a759954650220192800c0154d225bcb01ed55766"
+		logic_hash = "v1_sha256_95d0540b1308caf3e7287c70a759954650220192800c0154d225bcb01ed55766"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121908,20 +122133,20 @@ rule BINARYALERT_Hacktool_Macos_Keylogger_Dannvix
 		$a3 = "<unknown>" wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Juuso_Keychaindump
 {
 	meta:
 		description = "For reading OS X keychain passwords as root."
 		author = "@mimeframe"
-		id = "10ee6c24-db35-5178-9a40-92f5231948aa"
+		id = "196c6132-b538-5055-a4cb-e2d46723d06e"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/juuso/keychaindump"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_juuso_keychaindump.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "dd2fb6249fe4b7381e734ea3a308158159f7e79b39ba5c970241dcd66436d669"
+		logic_hash = "v1_sha256_dd2fb6249fe4b7381e734ea3a308158159f7e79b39ba5c970241dcd66436d669"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121935,20 +122160,20 @@ rule BINARYALERT_Hacktool_Macos_Juuso_Keychaindump
 		$a6 = "[-] No root privileges, please run with sudo" wide ascii
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_N0Fate_Chainbreaker
 {
 	meta:
 		description = "chainbreaker can extract user credential in a Keychain file with Master Key or user password in forensically sound manner."
 		author = "@mimeframe"
-		id = "565d31c6-8d80-534d-8acc-c01d7af4f8b3"
+		id = "6b04050d-006d-56c0-91b4-8dda1c1ff3fa"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/n0fate/chainbreaker"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_n0fate_chainbreaker.yara#L1-L13"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "7aedf952756ed2375ff171329179f14a8cdc37ada69e1f003def1f1de5bc1691"
+		logic_hash = "v1_sha256_7aedf952756ed2375ff171329179f14a8cdc37ada69e1f003def1f1de5bc1691"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121959,20 +122184,20 @@ rule BINARYALERT_Hacktool_Macos_N0Fate_Chainbreaker
 		$a3 = "[-] Decrypted Private Key" wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Keylogger_B4Rsby_Swiftlog
 {
 	meta:
 		description = "Dirty user level command line keylogger hacked together in Swift."
 		author = "@mimeframe"
-		id = "b1ae8284-04a0-5818-9997-0e31eb51ed2b"
+		id = "7f42e787-a723-5e20-99a3-54e1ffa6ccda"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/b4rsby/SwiftLog"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_b4rsby_swiftlog.yara#L1-L11"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "c66dcab2da0e543198f97ca104c13533c8950d10b6f7cbd3f906348d0f8c45ff"
+		logic_hash = "v1_sha256_c66dcab2da0e543198f97ca104c13533c8950d10b6f7cbd3f906348d0f8c45ff"
 		score = 75
 		quality = 80
 		tags = ""
@@ -121981,20 +122206,20 @@ rule BINARYALERT_Hacktool_Macos_Keylogger_B4Rsby_Swiftlog
 		$a1 = "You need to enable the keylogger in the System Prefrences" wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Exploit_Tpwn
 {
 	meta:
 		description = "tpwn exploits a null pointer dereference in XNU to escalate privileges to root."
 		author = "@mimeframe"
-		id = "b69c4e1c-554e-5553-9b21-6cdf33aff24e"
+		id = "bfd4765a-2358-5de7-91e6-9c2e1b70780f"
 		date = "2017-09-14"
 		modified = "2017-09-14"
 		reference = "https://www.rapid7.com/db/modules/exploit/osx/local/tpwn"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_exploit_tpwn.yara#L1-L14"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f864d8c137746edd50526b1d3d95a7335f776cf1473d2d2ea28856dbc515dd9f"
+		logic_hash = "v1_sha256_f864d8c137746edd50526b1d3d95a7335f776cf1473d2d2ea28856dbc515dd9f"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122006,20 +122231,20 @@ rule BINARYALERT_Hacktool_Macos_Exploit_Tpwn
 		$a4 = "Escalating privileges! -qwertyoruiop" wide ascii
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Keylogger_Giacomolaw
 {
 	meta:
 		description = "A simple keylogger for macOS."
 		author = "@mimeframe"
-		id = "81fcf792-a0a9-5b97-a71c-4c517a7b910c"
+		id = "4a9e4fe6-5f28-5f42-9726-ced687055038"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/GiacomoLaw/Keylogger"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_giacomolaw.yara#L1-L13"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "45ca583c07b8593ed716306ae6f80eef1c3fc5652aed739454fa8007fae929b4"
+		logic_hash = "v1_sha256_45ca583c07b8593ed716306ae6f80eef1c3fc5652aed739454fa8007fae929b4"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122030,20 +122255,20 @@ rule BINARYALERT_Hacktool_Macos_Keylogger_Giacomolaw
 		$a3 = "Keystrokes are now being recorded" wide ascii
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule BINARYALERT_Hacktool_Macos_Macpmem
 {
 	meta:
 		description = "MacPmem enables read/write access to physical memory on macOS. Can be used by CSIRT teams and attackers."
 		author = "@mimeframe"
-		id = "4890598e-936c-5a4d-9004-88ff4fe57c49"
+		id = "26ee217b-a3f3-5742-801e-cdc0684dfd99"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/google/rekall/tree/master/tools/osx/MacPmem"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_macpmem.yara#L3-L22"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "d64b5a5423932211e3b72d949028f3f0ed1f1435e9584cffa947f2bd4846c29b"
+		logic_hash = "v1_sha256_d64b5a5423932211e3b72d949028f3f0ed1f1435e9584cffa947f2bd4846c29b"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122059,20 +122284,20 @@ rule BINARYALERT_Hacktool_Macos_Macpmem
 		$b2 = "MacPmem load tag is" wide ascii
 
 	condition:
-		BINARYALERT_Macho_PRIVATE and 2 of ($a*) or all of ($b*)
+		BINARYALERT_Macho_PRIVATE and 2 of ( $a* ) or all of ( $b* )
 }
 rule BINARYALERT_Hacktool_Multi_Jtesta_Ssh_Mitm
 {
 	meta:
 		description = "intercepts ssh connections to capture credentials"
 		author = "@fusionrace"
-		id = "fa8362e2-83d3-5830-8952-502684ad66f9"
+		id = "c44ca655-71f8-50d6-b0ec-9a85434d780f"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/jtesta/ssh-mitm"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_jtesta_ssh_mitm.yara#L1-L12"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "1d19c83f7d648a0d30074debcd76ff0faf72afa6722251661f8640abdc12a2a9"
+		logic_hash = "v1_sha256_1d19c83f7d648a0d30074debcd76ff0faf72afa6722251661f8640abdc12a2a9"
 		score = 50
 		quality = 80
 		tags = ""
@@ -122082,20 +122307,20 @@ rule BINARYALERT_Hacktool_Multi_Jtesta_Ssh_Mitm
 		$a2 = "more sshbuf problems." wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Hacktool_Multi_Masscan
 {
 	meta:
 		description = "masscan is a performant port scanner, it produces results similar to nmap"
 		author = "@mimeframe"
-		id = "adb2bb07-2a1a-5eb5-8049-b3f8e6cba48a"
+		id = "7eac2470-b3e3-530a-a123-594776eb1c77"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/robertdavidgraham/masscan"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_masscan.yara#L1-L17"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "b35e481f73b1c1722056157f8348e2e06bb109c094b948fc6be2d9a7df070a7f"
+		logic_hash = "v1_sha256_b35e481f73b1c1722056157f8348e2e06bb109c094b948fc6be2d9a7df070a7f"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122110,20 +122335,20 @@ rule BINARYALERT_Hacktool_Multi_Masscan
 		$b4 = "[hint] VMware on Macintosh doesn't support masscan" wide ascii
 
 	condition:
-		all of ($a*) or any of ($b*)
+		all of ( $a* ) or any of ( $b* )
 }
 rule BINARYALERT_Hacktool_Multi_Ncc_ABPTTS
 {
 	meta:
 		description = "Allows for TCP tunneling over HTTP"
 		author = "@mimeframe"
-		id = "dd5f6316-9e51-5cc8-b293-dc33b09cc801"
+		id = "c1efad63-0b43-5314-8cbb-08b8b04a3365"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/nccgroup/ABPTTS"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_ncc_ABPTTS.yara#L1-L19"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "09874b1d997ac193ad1afa0226f6fb22836c8720c0599d773b18072b92a3acc4"
+		logic_hash = "v1_sha256_09874b1d997ac193ad1afa0226f6fb22836c8720c0599d773b18072b92a3acc4"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122144,13 +122369,13 @@ rule BINARYALERT_Hacktool_Multi_Pyrasite_Py
 	meta:
 		description = "A tool for injecting arbitrary code into running Python processes."
 		author = "@fusionrace"
-		id = "0acd0044-a41c-5e9e-bb94-301cd704cf9d"
+		id = "92cef916-5919-562f-ae5a-06a1e79a8197"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/lmacken/pyrasite"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_pyrasite_py.yara#L1-L24"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "7f3f3df5bd5c1bee2d85ff97878ad36223ab743926a5f8f1c079b039f724abc9"
+		logic_hash = "v1_sha256_7f3f3df5bd5c1bee2d85ff97878ad36223ab743926a5f8f1c079b039f724abc9"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122179,13 +122404,13 @@ rule BINARYALERT_Hacktool_Multi_Bloodhound_Owned
 	meta:
 		description = "Bloodhound: Custom queries to document a compromise, find collateral spread of owned nodes, and visualize deltas in privilege gains"
 		author = "@fusionrace"
-		id = "4d458339-6589-5094-8c23-1ad2baee19f1"
+		id = "cffa3b8a-cf55-531b-aa67-ca8a8841bdec"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/porterhau5/BloodHound-Owned/"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_bloodhound_owned.yara#L1-L20"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "01ef15a3cd606c46dacb0f22477fe97f94e212a38af1cd5bdd7eb11efe8144dd"
+		logic_hash = "v1_sha256_01ef15a3cd606c46dacb0f22477fe97f94e212a38af1cd5bdd7eb11efe8144dd"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122210,13 +122435,13 @@ rule BINARYALERT_Hacktool_Multi_Ntlmrelayx
 	meta:
 		description = "No description has been set in the source file - BinaryAlert"
 		author = "@mimeframe"
-		id = "7e0bc28f-9cb7-5c09-aedc-d95af23454aa"
+		id = "e638e9d0-404d-5b48-910c-6b3cd0845b78"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/CoreSecurity/impacket/blob/master/examples/ntlmrelayx.py"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_ntlmrelayx.yara#L1-L15"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "0d5d2d38866eb243e1803c456944e887d9d3920c54b15fd658bf90831fd87bfa"
+		logic_hash = "v1_sha256_0d5d2d38866eb243e1803c456944e887d9d3920c54b15fd658bf90831fd87bfa"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122229,20 +122454,20 @@ rule BINARYALERT_Hacktool_Multi_Ntlmrelayx
 		$a5 = "Domain info dumped into lootdir!" wide ascii
 
 	condition:
-		any of ($a*)
+		any of ( $a* )
 }
 rule BINARYALERT_Hacktool_Multi_Responder_Py
 {
 	meta:
 		description = "Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server"
 		author = "@fusionrace"
-		id = "82699a67-8ba1-5535-9183-3c857e60134c"
+		id = "dbe2f8e0-21fa-55f4-90e1-c6bc2b5403f2"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "http://www.c0d3xpl0it.com/2017/02/compromising-domain-admin-in-internal-pentest.html"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_responder_py.yara#L1-L17"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "a99a806b7c578af1f2163583f957db13fa7269c7426666189d85bec2ac87ad4b"
+		logic_hash = "v1_sha256_a99a806b7c578af1f2163583f957db13fa7269c7426666189d85bec2ac87ad4b"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122264,13 +122489,13 @@ rule BINARYALERT_Hacktool_Windows_Wmi_Implant
 	meta:
 		description = "A PowerShell based tool that is designed to act like a RAT"
 		author = "@fusionrace"
-		id = "cd90ef31-6e15-5518-8278-98e99e379916"
+		id = "b32996b2-1706-5af5-ad81-f73d5899c70c"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_wmi_implant.yara#L1-L21"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "8b02fd265b04b9675a99b9638fdd179c8a86ed3afd7506195f3d3dcb2417d74d"
+		logic_hash = "v1_sha256_8b02fd265b04b9675a99b9638fdd179c8a86ed3afd7506195f3d3dcb2417d74d"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122296,13 +122521,13 @@ rule BINARYALERT_Hacktool_Windows_Mimikatz_Sekurlsa
 	meta:
 		description = "Mimikatz credential dump tool"
 		author = "@fusionrace"
-		id = "08fe62c5-f7a4-5985-a298-1d3c2c1744d4"
+		id = "a7eb069a-1f6f-5e54-9f34-83aa65fa345e"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/gentilkiwi/mimikatz"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_sekurlsa.yara#L1-L18"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "24e958c3cbda8e01dc2d84b3059114ea23f4b38db1676f7b72e5eabfa52b7335"
+		logic_hash = "v1_sha256_24e958c3cbda8e01dc2d84b3059114ea23f4b38db1676f7b72e5eabfa52b7335"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122325,13 +122550,13 @@ rule BINARYALERT_Hacktool_Windows_Rdp_Cmd_Delivery
 	meta:
 		description = "Delivers a text payload via RDP (rubber ducky)"
 		author = "@fusionrace"
-		id = "8d035721-34ee-566f-8851-1c9501de2704"
+		id = "1b00805a-9ea5-5af8-95f8-fd0db0d6cc9f"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/nopernik/mytools/blob/master/rdp-cmd-delivery.sh"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_rdp_cmd_delivery.yara#L1-L14"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "98bc02bb651fba069828b5960ee47542828f0d530e5e280b15abb0573b8e0168"
+		logic_hash = "v1_sha256_98bc02bb651fba069828b5960ee47542828f0d530e5e280b15abb0573b8e0168"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122350,13 +122575,13 @@ rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Postexploitation : FILE
 	meta:
 		description = "Detection of strings in the post-exploitation modules of Cobalt Strike"
 		author = "@javutin, @mimeframe"
-		id = "76c2a5ae-bc7c-50c7-8731-94c75912574f"
+		id = "fc50422a-6362-5604-a7ab-7a5f589a90eb"
 		date = "2017-12-14"
 		modified = "2017-12-14"
 		reference = "https://www.cobaltstrike.com/support"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_postexploitation.yara#L1-L13"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "1a89128a0f5774d1333be440d38128e29cb36f9818fa44e60482ef078078aca8"
+		logic_hash = "v1_sha256_1a89128a0f5774d1333be440d38128e29cb36f9818fa44e60482ef078078aca8"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -122365,20 +122590,20 @@ rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Postexploitation : FILE
 		$s1 = "\\devcenter\\aggressor\\external\\"
 
 	condition:
-		filesize >10KB and filesize <1000KB and all of ($s*)
+		filesize > 10KB and filesize < 1000KB and all of ( $s* )
 }
 rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Powershell : FILE
 {
 	meta:
 		description = "Detection of the PowerShell payloads from Cobalt Strike"
 		author = "@javutin, @joseselvi"
-		id = "155f181a-56cb-5295-a903-744f79012733"
+		id = "20f17dc5-1785-5199-88d8-b166e8ae6ea5"
 		date = "2017-12-14"
 		modified = "2017-12-14"
 		reference = "https://www.cobaltstrike.com/help-payload-generator"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_powershell.yara#L1-L21"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "39dd0aaa84d02aae5766d764c3d371f03f9df33acf5f6ae4ab4a8c73dd827213"
+		logic_hash = "v1_sha256_39dd0aaa84d02aae5766d764c3d371f03f9df33acf5f6ae4ab4a8c73dd827213"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -122394,20 +122619,20 @@ rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Powershell : FILE
 		$ps8 = "var_hthread"
 
 	condition:
-		$ps1 at 0 and filesize <1000KB and all of ($ps*)
+		$ps1 at 0 and filesize < 1000KB and all of ( $ps* )
 }
 rule BINARYALERT_Hacktool_Windows_Mimikatz_Errors
 {
 	meta:
 		description = "Mimikatz credential dump tool: Error messages"
 		author = "@fusionrace"
-		id = "94d50739-fc84-5bfe-821d-5e2851f681e3"
+		id = "5b0c12f0-b182-5c24-bde5-2bb3bc2a5a8f"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/gentilkiwi/mimikatz"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_errors.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "60fb94b9465b19af3b2df1b26490d4ac19a31a39f2f8c52f1059d37843769b36"
+		logic_hash = "v1_sha256_60fb94b9465b19af3b2df1b26490d4ac19a31a39f2f8c52f1059d37843769b36"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122428,13 +122653,13 @@ rule BINARYALERT_Hacktool_Windows_Mimikatz_Copywrite
 	meta:
 		description = "Mimikatz credential dump tool: Author copywrite"
 		author = "@fusionrace"
-		id = "bf7a52b5-c0af-5805-a2da-41ae3842e0c6"
+		id = "6e7ce709-a546-5725-b7c9-4330f97118d0"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/gentilkiwi/mimikatz"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_copywrite.yara#L1-L24"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f0e8a8b0c7398e7af06bd074eec0433265ba0e675bdbff354e59432c246b0b36"
+		logic_hash = "v1_sha256_f0e8a8b0c7398e7af06bd074eec0433265ba0e675bdbff354e59432c246b0b36"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122463,13 +122688,13 @@ rule BINARYALERT_Hacktool_Windows_Hot_Potato
 	meta:
 		description = "No description has been set in the source file - BinaryAlert"
 		author = "@mimeframe"
-		id = "dee13640-b4a9-5a39-af01-338c0197c995"
+		id = "68799fd0-0aac-5c4e-a76c-594d48a5765d"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/foxglovesec/Potato"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_hot_potato.yara#L1-L15"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "1ccee61660b3478294a5a4e1ca2b16c91156f6c877d0f83848cccd18a3f753f7"
+		logic_hash = "v1_sha256_1ccee61660b3478294a5a4e1ca2b16c91156f6c877d0f83848cccd18a3f753f7"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122482,20 +122707,20 @@ rule BINARYALERT_Hacktool_Windows_Hot_Potato
 		$a5 = "Usage: potato.exe -ip" wide ascii
 
 	condition:
-		any of ($a*)
+		any of ( $a* )
 }
 rule BINARYALERT_Hacktool_Windows_Mimikatz_Files
 {
 	meta:
 		description = "Mimikatz credential dump tool: Files"
 		author = "@fusionrace"
-		id = "ea4fd443-64dd-5466-8525-40c3a023e229"
+		id = "0a489eab-0cd3-53e3-a644-4ffb29a51a7b"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/gentilkiwi/mimikatz"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_files.yara#L1-L15"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "50d23cda49ca559da2e504e53b46b58679ea8bc07c501ff7764a3d142598adc8"
+		logic_hash = "v1_sha256_50d23cda49ca559da2e504e53b46b58679ea8bc07c501ff7764a3d142598adc8"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122515,13 +122740,13 @@ rule BINARYALERT_Hacktool_Windows_Moyix_Creddump
 	meta:
 		description = "creddump is a python tool to extract credentials and secrets from Windows registry hives."
 		author = "@mimeframe"
-		id = "46df781a-abab-5593-99f9-1a6b993904cb"
+		id = "b3147c06-a1a5-53f2-b1f8-78d6474f9bbe"
 		date = "2017-09-12"
 		modified = "2017-09-12"
 		reference = "https://github.com/moyix/creddump"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_moyix_creddump.yara#L1-L16"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "3f2f4c5069fcb3d3b1d293a471bcf9489f058f27cd385885ab2bb4f719a3bd9d"
+		logic_hash = "v1_sha256_3f2f4c5069fcb3d3b1d293a471bcf9489f058f27cd385885ab2bb4f719a3bd9d"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122535,20 +122760,20 @@ rule BINARYALERT_Hacktool_Windows_Moyix_Creddump
 		$a6 = "31d6cfe0d16ae931b73c59d7e0c089c0" wide ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule BINARYALERT_Hacktool_Windows_Ncc_Wmicmd
 {
 	meta:
 		description = "Command shell wrapper for WMI"
 		author = "@mimeframe"
-		id = "18bc36f7-b97a-5bce-a68b-c349713e9468"
+		id = "16f616e2-120c-5067-b083-957f49cb0baa"
 		date = "2017-08-11"
 		modified = "2017-08-11"
 		reference = "https://github.com/nccgroup/WMIcmd"
 		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_ncc_wmicmd.yara#L1-L18"
 		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "bef6828a706dcfc3b573523fccd391a5ef3fa505235b1621a82527d64d32aaf0"
+		logic_hash = "v1_sha256_bef6828a706dcfc3b573523fccd391a5ef3fa505235b1621a82527d64d32aaf0"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122564,13 +122789,13 @@ rule BINARYALERT_Hacktool_Windows_Ncc_Wmicmd
 		$b3 = "cimv2" wide ascii
 
 	condition:
-		any of ($a*) or all of ($b*)
+		any of ( $a* ) or all of ( $b* )
 }
 /*
  * YARA Rule Set
  * Repository Name: DeadBits
  * Repository: https://github.com/deadbits/yara-rules/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: d002f7ecee23e09142a3ac3e79c84f71dda3f001
  * Number of Rules: 19
  * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
@@ -122585,13 +122810,13 @@ rule DEADBITS_Dacls_Trojan_Windows : FILE
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "424b2c0d-2373-5a72-9a97-52b4bfc5cdcf"
+		id = "e5902d25-413b-545e-931c-bf3620894fc6"
 		date = "2020-01-07"
 		modified = "2020-01-07"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/Dacls_Windows.yara#L1-L30"
 		license_url = "N/A"
-		logic_hash = "b77df7e3be9c264d6a63d40dbf49c41e9dd55b4e570c063b5710b849c36cc166"
+		logic_hash = "v1_sha256_b77df7e3be9c264d6a63d40dbf49c41e9dd55b4e570c063b5710b849c36cc166"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -122611,20 +122836,20 @@ rule DEADBITS_Dacls_Trojan_Windows : FILE
 		$cls01 = "k_3872.cls" ascii fullword
 
 	condition:
-		( uint16(0)==0x5a4d) and (( all of ($cls*)) or ( all of ($fext*) and all of ($str*)))
+		( uint16( 0 ) == 0x5a4d ) and ( ( all of ( $cls* ) ) or ( all of ( $fext* ) and all of ( $str* ) ) )
 }
 rule DEADBITS_Dacls_Trojan_Linux
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "bb83ba2b-70a3-5a0f-9588-d93b7f07f67f"
+		id = "e72e7759-5815-504f-84df-c0c0756f1ede"
 		date = "2020-01-07"
 		modified = "2020-01-07"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/Dacls_Linux.yara#L1-L32"
 		license_url = "N/A"
-		logic_hash = "752d7daf9178e4fa20f2ce781c6ff70f83758f01479696f0808e1588da9a3d78"
+		logic_hash = "v1_sha256_752d7daf9178e4fa20f2ce781c6ff70f83758f01479696f0808e1588da9a3d78"
 		score = 75
 		quality = 80
 		tags = ""
@@ -122644,20 +122869,20 @@ rule DEADBITS_Dacls_Trojan_Linux
 		$str09 = "session_id" ascii fullword
 
 	condition:
-		uint32be(0x0)==0x7f454c46 and (( all of ($cls*)) or ( all of ($str*)))
+		uint32be( 0x0 ) == 0x7f454c46 and ( ( all of ( $cls* ) ) or ( all of ( $str* ) ) )
 }
 rule DEADBITS_Silenttrinity_Delivery_Document : FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "be8cf8b7-d7f8-587d-b7bd-ad10796cda7c"
+		id = "8230a28d-55b6-5947-a39d-a59c26f2eb41"
 		date = "2019-07-19"
 		modified = "2019-07-19"
 		reference = "https://countercept.com/blog/hunting-for-silenttrinity/"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/SilentTrinity_Delivery.yara#L1-L30"
 		license_url = "N/A"
-		logic_hash = "1efaa317dd250fa127b134ff8e6e6ac48d1056059256f790925d2315a6865033"
+		logic_hash = "v1_sha256_1efaa317dd250fa127b134ff8e6e6ac48d1056059256f790925d2315a6865033"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -122679,20 +122904,20 @@ rule DEADBITS_Silenttrinity_Delivery_Document : FILE
 		$s11 = "2. Da biste pogledali dokument, molimo kliknite \"OMOGU" fullword wide
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <200KB and (8 of ($s*) or all of them )
+		uint16( 0 ) == 0xcfd0 and filesize < 200KB and ( 8 of ( $s* ) or all of them )
 }
 rule DEADBITS_Godlua_Linux : LINUXMALWARE FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "1a05c88a-8199-5c6d-9352-9ef60df40078"
+		id = "614eeb4a-ff2b-552e-b711-d791ed80c75c"
 		date = "2019-07-18"
 		modified = "2019-07-22"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/godlua_linux.yara#L1-L57"
 		license_url = "N/A"
-		logic_hash = "70a8078f261648f050807e82009493e39fa32c0748576b3df76d8aaaa117103e"
+		logic_hash = "v1_sha256_70a8078f261648f050807e82009493e39fa32c0748576b3df76d8aaaa117103e"
 		score = 75
 		quality = 51
 		tags = "LINUXMALWARE, FILE"
@@ -122724,20 +122949,20 @@ rule DEADBITS_Godlua_Linux : LINUXMALWARE FILE
 		$identifier3 = "God 5.1"
 
 	condition:
-		uint16(0)==0x457f and ( all of them or ( any of ($identifier*) and $resolvers and any of ($tmp*) and 4 of ($str*)) or ( any of ($identifier*) and any of ($tmp*) and 4 of ($str*)))
+		uint16( 0 ) == 0x457f and ( all of them or ( any of ( $identifier* ) and $resolvers and any of ( $tmp* ) and 4 of ( $str* ) ) or ( any of ( $identifier* ) and any of ( $tmp* ) and 4 of ( $str* ) ) )
 }
 rule DEADBITS_Jsworm : MALWARE FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "6d452d04-b475-5241-890c-68119a7a8691"
+		id = "35e88f6c-5193-5a2a-b28a-0bd054a5c8a9"
 		date = "2019-09-06"
 		modified = "2019-09-06"
 		reference = "https://github.com/deadbits/yara-rules/"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/JSWorm.yara#L1-L38"
 		license_url = "N/A"
-		logic_hash = "99074e25ec15c5b25fa41bef19203f5ddc227acd51fadca1e2c3ece538b3da01"
+		logic_hash = "v1_sha256_99074e25ec15c5b25fa41bef19203f5ddc227acd51fadca1e2c3ece538b3da01"
 		score = 75
 		quality = 78
 		tags = "MALWARE, FILE"
@@ -122760,20 +122985,20 @@ rule DEADBITS_Jsworm : MALWARE FILE
 		$uniq03 = "<HTA:APPLICATION APPLICATIONNAME=" nocase
 
 	condition:
-		uint16(0)==0x5a4d and (($name00 and 5 of ($str*)) or (5 of ($str*) and 2 of ($uniq*)) or ($name00 and any of ($uniq*)))
+		uint16( 0 ) == 0x5a4d and ( ( $name00 and 5 of ( $str* ) ) or ( 5 of ( $str* ) and 2 of ( $uniq* ) ) or ( $name00 and any of ( $uniq* ) ) )
 }
 rule DEADBITS_Silenttrinity : FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "40f9174c-e9a5-5453-b5fa-6c01c46daffa"
+		id = "ab0b9ec4-b24c-5d6f-8bee-e27928de2928"
 		date = "2019-07-19"
 		modified = "2019-07-19"
 		reference = "https://countercept.com/blog/hunting-for-silenttrinity/"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/SilentTrinity_Payload.yara#L1-L55"
 		license_url = "N/A"
-		logic_hash = "7fd1775aadfccfdf141c0721f557e6c54b058ac17a59a8e4561dd62ab4a1eff3"
+		logic_hash = "v1_sha256_7fd1775aadfccfdf141c0721f557e6c54b058ac17a59a8e4561dd62ab4a1eff3"
 		score = 75
 		quality = 78
 		tags = "FILE"
@@ -122816,20 +123041,20 @@ rule DEADBITS_Silenttrinity : FILE
 		$a10 = "HttpPost" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and ((8 of ($str*) or ( all of ($a*) and $pdb01) or $pdb01))
+		uint16( 0 ) == 0x5a4d and ( ( 8 of ( $str* ) or ( all of ( $a* ) and $pdb01 ) or $pdb01 ) )
 }
 rule DEADBITS_Winnti_Linux : LINUXMALWARE FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "d90dec69-1a8b-547c-a302-d00c612a71ed"
+		id = "07e06cba-d54a-52a5-b721-ee64245773b5"
 		date = "2019-07-18"
 		modified = "2019-07-22"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/winnti_linux.yara#L1-L37"
 		license_url = "N/A"
-		logic_hash = "216c103b4ffceaa0540b8c81645d3fd91a7dab2b32b1cf84ccb85f134c9d23c8"
+		logic_hash = "v1_sha256_216c103b4ffceaa0540b8c81645d3fd91a7dab2b32b1cf84ccb85f134c9d23c8"
 		score = 75
 		quality = 76
 		tags = "LINUXMALWARE, FILE"
@@ -122860,20 +123085,20 @@ rule DEADBITS_Winnti_Linux : LINUXMALWARE FILE
 		$str21 = "/lib/libxselinux" ascii fullword
 
 	condition:
-		uint16(0)==0x457f and 8 of them
+		uint16( 0 ) == 0x457f and 8 of them
 }
 rule DEADBITS_Watchdog_Botnet : BOTNET LINUXMALWARE EXPLOITATION CVE_2019_11581 CVE_2019_10149
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "ae95f934-2a9b-5c65-a11f-ea946d7f1bc6"
+		id = "35288752-f781-5b7b-9d6c-66ff39a44522"
 		date = "2019-07-22"
 		modified = "2019-07-22"
 		reference = "https://twitter.com/polarply/status/1153232987762376704"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/WatchBog_Linux.yara#L1-L100"
 		license_url = "N/A"
-		logic_hash = "aea8afdf118b79f701941ddd4306ee0f1c947ea59de5485ff977beff95e06d35"
+		logic_hash = "v1_sha256_aea8afdf118b79f701941ddd4306ee0f1c947ea59de5485ff977beff95e06d35"
 		score = 75
 		quality = 78
 		tags = "BOTNET, LINUXMALWARE, EXPLOITATION, CVE_2019_11581, CVE_2019_10149"
@@ -122911,20 +123136,20 @@ rule DEADBITS_Watchdog_Botnet : BOTNET LINUXMALWARE EXPLOITATION CVE_2019_11581
 		$jira_id = "JSESSIONID=%s" ascii fullword
 
 	condition:
-		uint32be(0x0)==0x7f454c46 and $py0 and (( all of ($pwn*) and all of ($scan*)) or ($payload and all of ($jira*) and 5 of ($str*)) or ( all of ($str*) and all of ($exploit*)))
+		uint32be( 0x0 ) == 0x7f454c46 and $py0 and ( ( all of ( $pwn* ) and all of ( $scan* ) ) or ( $payload and all of ( $jira* ) and 5 of ( $str* ) ) or ( all of ( $str* ) and all of ( $exploit* ) ) )
 }
 rule DEADBITS_Dnspionage : APT DNSCHANGER FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "9f740645-60dc-5376-94ad-59d8efbf1942"
+		id = "a28a89b5-a405-5402-9ed1-ad0a623f428f"
 		date = "2019-07-18"
 		modified = "2019-07-19"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/DNSpionage.yara#L1-L47"
 		license_url = "N/A"
-		logic_hash = "f20c71d0698d98cc58fa199c708ec7bf5cb0ec62503a20b532e752dab9aab920"
+		logic_hash = "v1_sha256_f20c71d0698d98cc58fa199c708ec7bf5cb0ec62503a20b532e752dab9aab920"
 		score = 75
 		quality = 78
 		tags = "APT, DNSCHANGER, FILE"
@@ -122958,20 +123183,20 @@ rule DEADBITS_Dnspionage : APT DNSCHANGER FILE
 		$str18 = "config file will be changed from server!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ((5 of ($str*)) or ($x00 and (1 of ($hdr*)) and 1 of ($ua*)))
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( ( 5 of ( $str* ) ) or ( $x00 and ( 1 of ( $hdr* ) ) and 1 of ( $ua* ) ) )
 }
 rule DEADBITS_Acbackdoor_ELF : LINUX MALWARE BACKDOOR
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam M. Swanda"
-		id = "82eb41bf-cd1d-5b00-973b-31a79c75cfc0"
-		date = "2019-11-08"
+		id = "a65f0bbd-0088-59ed-a8a0-8d287914ee05"
+		date = "2019-11-15"
 		modified = "2019-12-04"
 		reference = "https://www.intezer.com/blog-acbackdoor-analysis-of-a-new-multiplatform-backdoor/"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/ACBackdoor_Linux.yara#L1-L41"
 		license_url = "N/A"
-		logic_hash = "48d741fba86cdfc8aac779d4b3227d45a17e0e9fba74b19820f1b8308bb93322"
+		logic_hash = "v1_sha256_48d741fba86cdfc8aac779d4b3227d45a17e0e9fba74b19820f1b8308bb93322"
 		score = 75
 		quality = 55
 		tags = "LINUX, MALWARE, BACKDOOR"
@@ -122998,20 +123223,20 @@ rule DEADBITS_Acbackdoor_ELF : LINUX MALWARE BACKDOOR
 		$rcd03 = "/etc/rc5.d/S01update-notifier" ascii fullword
 
 	condition:
-		( uint32be(0x0)==0x7f454c46) and (($ua_str and all of ($header*) and $initd and all of ($rcd*)) or ($ua_str and all of ($header*) and 10 of ($str*)))
+		( uint32be( 0x0 ) == 0x7f454c46 ) and ( ( $ua_str and all of ( $header* ) and $initd and all of ( $rcd* ) ) or ( $ua_str and all of ( $header* ) and 10 of ( $str* ) ) )
 }
 rule DEADBITS_APT32_Ratsnif : APT32 TROJAN WINMALWARE FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "d3664a84-bb53-5715-8b0d-e63f43d62496"
+		id = "bca2fe6d-5fd8-5246-8046-5232e45354a2"
 		date = "2019-07-18"
 		modified = "2019-08-08"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT32_Ratsnif.yara#L1-L65"
 		license_url = "N/A"
-		logic_hash = "a33eb2bb9ffe02f9b3fe706bd6a611457c669adc24c34f12d9014ed29ba1399f"
+		logic_hash = "v1_sha256_a33eb2bb9ffe02f9b3fe706bd6a611457c669adc24c34f12d9014ed29ba1399f"
 		score = 75
 		quality = 55
 		tags = "APT32, TROJAN, WINMALWARE, FILE"
@@ -123064,20 +123289,20 @@ rule DEADBITS_APT32_Ratsnif : APT32 TROJAN WINMALWARE FILE
 		$cnc6 = "/cl_client_logs.php" ascii fullword
 
 	condition:
-		( uint16(0)==0x5a4d) and ((10 of ($str*) and 3 of ($cnc*)) or (3 of ($cnc*) and $pdb0))
+		( uint16( 0 ) == 0x5a4d ) and ( ( 10 of ( $str* ) and 3 of ( $cnc* ) ) or ( 3 of ( $cnc* ) and $pdb0 ) )
 }
 rule DEADBITS_APT34_LONGWATCH : APT34 WINMALWARE KEYLOGGER FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "74a6a408-2f0e-567d-8968-c304d258df81"
+		id = "a4b2fe5a-0f14-5928-8391-ec3210c4c0d6"
 		date = "2019-07-22"
 		modified = "2019-07-22"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_LONGWATCH.yara#L1-L43"
 		license_url = "N/A"
-		logic_hash = "8f9ed228325800baea3a2874c71337709c04d93419d4d56821a791dbce6f4582"
+		logic_hash = "v1_sha256_8f9ed228325800baea3a2874c71337709c04d93419d4d56821a791dbce6f4582"
 		score = 75
 		quality = 78
 		tags = "APT34, WINMALWARE, KEYLOGGER, FILE"
@@ -123109,20 +123334,20 @@ rule DEADBITS_APT34_LONGWATCH : APT34 WINMALWARE KEYLOGGER FILE
 		$logger21 = "[ALT]" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and $log and all of ($func*) and all of ($logger*) and $clipboard
+		uint16( 0 ) == 0x5a4d and $log and all of ( $func* ) and all of ( $logger* ) and $clipboard
 }
 rule DEADBITS_Avemaria_Warzone : AVEMARIA WARZONE WINMALWARE INFOSTEALER FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "1e03927b-d59c-5e1f-bdee-e44dfb172fad"
+		id = "dc26a605-63dd-5ff5-8dcf-9e79cbe28728"
 		date = "2019-07-18"
 		modified = "2019-08-08"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/avemaria_warzone.yara#L1-L32"
 		license_url = "N/A"
-		logic_hash = "1fe55fc8ea80616b11757193c2c74b9cf577ab661ddca4c6c64cfad63a300614"
+		logic_hash = "v1_sha256_1fe55fc8ea80616b11757193c2c74b9cf577ab661ddca4c6c64cfad63a300614"
 		score = 75
 		quality = 80
 		tags = "AVEMARIA, WARZONE, WINMALWARE, INFOSTEALER, FILE"
@@ -123142,20 +123367,20 @@ rule DEADBITS_Avemaria_Warzone : AVEMARIA WARZONE WINMALWARE INFOSTEALER FILE
 		$str17 = "/n:%temp%" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB) and (5 of ($str*) or all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB ) and ( 5 of ( $str* ) or all of them )
 }
 rule DEADBITS_APT34_VALUEVAULT : APT34 INFOSTEALER WINMALWARE FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "11d08fe7-9080-5393-b566-6f01e3eec18b"
+		id = "8db7b3d9-aa31-5511-8138-39c2877c29e2"
 		date = "2020-02-02"
 		modified = "2020-02-02"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_VALUEVAULT.yara#L1-L63"
 		license_url = "N/A"
-		logic_hash = "311eed153920b29b8d9e99651fe62259d685140d12bb073001e0576811a01198"
+		logic_hash = "v1_sha256_311eed153920b29b8d9e99651fe62259d685140d12bb073001e0576811a01198"
 		score = 75
 		quality = 78
 		tags = "APT34, INFOSTEALER, WINMALWARE, FILE"
@@ -123200,20 +123425,20 @@ rule DEADBITS_APT34_VALUEVAULT : APT34 INFOSTEALER WINMALWARE FILE
 		$str30 = "main.init" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and ((10 of ($str*) and 3 of ($gopath*)) or ($fsociety and $powershell and $gobuild) or ($fsociety and 10 of ($str*)))
+		uint16( 0 ) == 0x5a4d and ( ( 10 of ( $str* ) and 3 of ( $gopath* ) ) or ( $fsociety and $powershell and $gobuild ) or ( $fsociety and 10 of ( $str* ) ) )
 }
 rule DEADBITS_Redghost_Linux : POSTEXPLOITATION LINUXMALWARE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "f598e115-f821-5932-aa14-5254bf28092c"
+		id = "52659094-c921-51e2-8320-376dbd0a3e1a"
 		date = "2019-08-07"
 		modified = "2019-08-08"
 		reference = "https://github.com/d4rk007/RedGhost/"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/RedGhost_Linux.yara#L1-L45"
 		license_url = "N/A"
-		logic_hash = "0b12a0eda0a3b65c3da787770afb010eb5cd36426d41c04aca862ae1b01ab770"
+		logic_hash = "v1_sha256_0b12a0eda0a3b65c3da787770afb010eb5cd36426d41c04aca862ae1b01ab770"
 		score = 75
 		quality = 80
 		tags = "POSTEXPLOITATION, LINUXMALWARE"
@@ -123242,20 +123467,20 @@ rule DEADBITS_Redghost_Linux : POSTEXPLOITATION LINUXMALWARE
 		$func8 = "add2sys(){" ascii
 
 	condition:
-		( uint16be(0x0)==0x2321 and for any i in (0..64) : ( uint16be(i)==0x2f62 and uint8(i+2)==0x68)) and ($name or 5 of them )
+		( uint16be( 0x0 ) == 0x2321 and for any i in ( 0 .. 64 ) : ( uint16be( i ) == 0x2f62 and uint8( i + 2 ) == 0x68 ) ) and ( $name or 5 of them )
 }
 rule DEADBITS_APT34_PICKPOCKET : APT APT34 INFOSTEALER WINMALWARE FILE
 {
 	meta:
 		description = "Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018"
 		author = "Adam Swanda"
-		id = "71db5c74-4964-5c5e-a830-242bfd0a2158"
+		id = "fdf72550-4302-5ccf-a57c-320e7bd29c60"
 		date = "2019-07-22"
 		modified = "2019-07-22"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_PICKPOCKET.yara#L1-L30"
 		license_url = "N/A"
-		logic_hash = "7063cff3eb42c4468e01c9b214161cd306f7126f66650d99d43168730d1dc83a"
+		logic_hash = "v1_sha256_7063cff3eb42c4468e01c9b214161cd306f7126f66650d99d43168730d1dc83a"
 		score = 75
 		quality = 80
 		tags = "APT, APT34, INFOSTEALER, WINMALWARE, FILE"
@@ -123279,20 +123504,20 @@ rule DEADBITS_APT34_PICKPOCKET : APT APT34 INFOSTEALER WINMALWARE FILE
 		$s20 = "username_value" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and (8 of them or all of them )
+		uint16( 0 ) == 0x5a4d and ( 8 of them or all of them )
 }
 rule DEADBITS_TA505_Flowerpippi : TA505 FINANCIAL BACKDOOR WINMALWARE FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "1cfcb25e-1de9-53ac-b272-22792844a2d0"
+		id = "6e887c8e-601a-5444-8d4c-8e8fffe6288e"
 		date = "2019-07-18"
 		modified = "2019-07-22"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/TA505_FlowerPippi.yara#L1-L65"
 		license_url = "N/A"
-		logic_hash = "eb709915f67d7225b024da99bc84a21455f3b9d5fb4bc779bbdf6a4d3ab33489"
+		logic_hash = "v1_sha256_eb709915f67d7225b024da99bc84a21455f3b9d5fb4bc779bbdf6a4d3ab33489"
 		score = 75
 		quality = 24
 		tags = "TA505, FINANCIAL, BACKDOOR, WINMALWARE, FILE"
@@ -123340,20 +123565,20 @@ rule DEADBITS_TA505_Flowerpippi : TA505 FINANCIAL BACKDOOR WINMALWARE FILE
 		$api11 = "URLDownloadToFileA" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and ((10 of ($str*) and $pipi) or (10 of ($str*) and $pdb0) or (10 of ($str*) and 5 of ($api*)) or ( all of them ))
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( ( 10 of ( $str* ) and $pipi ) or ( 10 of ( $str* ) and $pdb0 ) or ( 10 of ( $str* ) and 5 of ( $api* ) ) or ( all of them ) )
 }
 rule DEADBITS_Crescentcore_DMG : INSTALLER MACOSMALWARE FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "2bd03287-3f10-50b0-9560-4c88644f5b20"
+		id = "5b2d9d6a-fc0d-56af-98da-6ca52dfa313a"
 		date = "2019-07-18"
 		modified = "2019-07-22"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/crescentcore_dmg.yara#L1-L48"
 		license_url = "N/A"
-		logic_hash = "819f01fdacea1e95f0f4d4f8e59ebae97ff9489a1be2c60e33253580a8f9e418"
+		logic_hash = "v1_sha256_819f01fdacea1e95f0f4d4f8e59ebae97ff9489a1be2c60e33253580a8f9e418"
 		score = 75
 		quality = 51
 		tags = "INSTALLER, MACOSMALWARE, FILE"
@@ -123380,20 +123605,20 @@ rule DEADBITS_Crescentcore_DMG : INSTALLER MACOSMALWARE FILE
 		$str14 = /SearchModel\w\d{2}carrierURL/
 
 	condition:
-		( uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xbebafeca) and $header0 and $header1 and (($path0 and ( any of ($install*))) or (5 of ($str*))) or all of them
+		( uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xcefaedfe or uint32( 0 ) == 0xfeedfacf or uint32( 0 ) == 0xcffaedfe or uint32( 0 ) == 0xbebafeca ) and $header0 and $header1 and ( ( $path0 and ( any of ( $install* ) ) ) or ( 5 of ( $str* ) ) ) or all of them
 }
 rule DEADBITS_KPOT_V2 : WINMALWARE INFOSTEALER FILE
 {
 	meta:
 		description = "No description has been set in the source file - DeadBits"
 		author = "Adam Swanda"
-		id = "19e8d261-c658-5d0d-a95c-43fcaf2942e2"
+		id = "a3af3f0a-d268-573a-9ae4-9b427dc60ed8"
 		date = "2019-08-05"
 		modified = "2019-08-05"
 		reference = "https://github.com/deadbits/yara-rules"
 		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/KPOT_v2.yara#L1-L33"
 		license_url = "N/A"
-		logic_hash = "dc8cce2ae3a427f771b19b4d0e027b653ff03a7bf816303460398987535c5351"
+		logic_hash = "v1_sha256_dc8cce2ae3a427f771b19b4d0e027b653ff03a7bf816303460398987535c5351"
 		score = 75
 		quality = 80
 		tags = "WINMALWARE, INFOSTEALER, FILE"
@@ -123417,14 +123642,14 @@ rule DEADBITS_KPOT_V2 : WINMALWARE INFOSTEALER FILE
 		$conf04 = "%s\\Outlook.txt" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and all of ($str*) and all of ($conf_re*) and all of ($conf0*)
+		uint16( 0 ) == 0x5a4d and all of ( $str* ) and all of ( $conf_re* ) and all of ( $conf0* )
 }
 /*
  * YARA Rule Set
  * Repository Name: DelivrTo
  * Repository: https://github.com/delivr-to/detections
- * Retrieval Date: 2024-12-08
- * Git Commit: 29cddf297f5eaff884b0e1c201bd9b7447022cf8
+ * Retrieval Date: 2024-12-15
+ * Git Commit: 84158c63141cd22c128ff6f016329ffe67112f43
  * Number of Rules: 9
  * Skipped: 0 (age), 2 (quality), 0 (score), 0 (importance)
  *
@@ -123438,13 +123663,13 @@ rule DELIVRTO_SUSP_SVG_Foreignobject_Nov24
 	meta:
 		description = "Presence of foreignObject in SVG file"
 		author = "delivr.to"
-		id = "148ef54a-4389-58c9-be89-c1714ef08371"
+		id = "05ef1f08-4251-56b6-93eb-14b7fd78f75f"
 		date = "2024-11-28"
 		modified = "2024-11-28"
 		reference = "https://github.com/delivr-to/detections"
-		source_url = "https://github.com/delivr-to/detections/blob/29cddf297f5eaff884b0e1c201bd9b7447022cf8/yara-rules/svg_foreignobject.yar#L1-L12"
+		source_url = "https://github.com/delivr-to/detections/blob/84158c63141cd22c128ff6f016329ffe67112f43/yara-rules/svg_foreignobject.yar#L1-L12"
 		license_url = "N/A"
-		logic_hash = "51fdc105e826344b9e516a35178c37b6e4620781ee3a9ae64b9be181a13292e7"
+		logic_hash = "v1_sha256_51fdc105e826344b9e516a35178c37b6e4620781ee3a9ae64b9be181a13292e7"
 		score = 40
 		quality = 51
 		tags = ""
@@ -123461,13 +123686,13 @@ rule DELIVRTO_SUSP_Onenote_Repeated_Filedatareference_Feb23 : FILE
 	meta:
 		description = "Repeated references to files embedded in OneNote file. May indicate multiple copies of file hidden under image, as leveraged by Qakbot et al."
 		author = "delivr.to"
-		id = "2a46d6cc-2800-5645-889c-7ad7d7aa69bd"
+		id = "0a168719-aa00-5649-b38e-441a0c810a5f"
 		date = "2023-02-17"
 		modified = "2023-02-17"
 		reference = "https://github.com/delivr-to/detections"
-		source_url = "https://github.com/delivr-to/detections/blob/29cddf297f5eaff884b0e1c201bd9b7447022cf8/yara-rules/onenote_repeated_files.yar#L1-L23"
+		source_url = "https://github.com/delivr-to/detections/blob/84158c63141cd22c128ff6f016329ffe67112f43/yara-rules/onenote_repeated_files.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "ef74a128de4d3745af856957931eaae0c0ae5a5583eab1a7c58d6dd666e7fd15"
+		logic_hash = "v1_sha256_ef74a128de4d3745af856957931eaae0c0ae5a5583eab1a7c58d6dd666e7fd15"
 		score = 60
 		quality = 80
 		tags = "FILE"
@@ -123478,20 +123703,20 @@ rule DELIVRTO_SUSP_Onenote_Repeated_Filedatareference_Feb23 : FILE
 		$fref = { 3C 00 69 00 66 00 6E 00 64 00 66 00 3E 00 7B 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2D 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2D 00 ?? 00 ?? 00 ?? 00 ?? 00 2D 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? }
 
 	condition:
-		filesize <5MB and ($one at 0) and $fdso and #fref>(#fdso*4)
+		filesize < 5MB and ( $one at 0 ) and $fdso and #fref > ( #fdso * 4 )
 }
 rule DELIVRTO_SUSP_CONCAT_ZIP_Nov24 : FILE
 {
 	meta:
 		description = "Zip archives concatenated together, based on the presence of more than one End of Central Directory record signature"
 		author = "delivr.to"
-		id = "1b865dfb-380a-531d-97cf-c62a1a37f4a9"
+		id = "ebfb6d21-3d61-5d74-96f6-36135bd18904"
 		date = "2024-11-13"
 		modified = "2024-11-13"
 		reference = "https://perception-point.io/blog/evasive-concatenated-zip-trojan-targets-windows-users/"
-		source_url = "https://github.com/delivr-to/detections/blob/29cddf297f5eaff884b0e1c201bd9b7447022cf8/yara-rules/concatenated_zip.yar#L1-L15"
+		source_url = "https://github.com/delivr-to/detections/blob/84158c63141cd22c128ff6f016329ffe67112f43/yara-rules/concatenated_zip.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "7a102d677f06fb01b2a23ec61ec0844147f8789e9f2742928869f209e067805b"
+		logic_hash = "v1_sha256_7a102d677f06fb01b2a23ec61ec0844147f8789e9f2742928869f209e067805b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -123501,20 +123726,20 @@ rule DELIVRTO_SUSP_CONCAT_ZIP_Nov24 : FILE
 		$eocd = { 50 4B 05 06 }
 
 	condition:
-		$fh at 0 and #fh>1 and #eocd==#fh
+		$fh at 0 and #fh > 1 and #eocd == #fh
 }
 rule DELIVRTO_SUSP_Onenote_Win_Script_Encoding_Feb23 : FILE
 {
 	meta:
 		description = "Presence of Windows Script Encoding Header in a OneNote file with embedded files"
 		author = "delivr.to"
-		id = "95cd5ce0-07b3-5503-ad6f-944206bd4fb6"
+		id = "7fa8e0ab-fab9-5ac9-9699-15e3b6b94ccb"
 		date = "2023-02-19"
 		modified = "2023-02-19"
 		reference = "https://github.com/delivr-to/detections"
-		source_url = "https://github.com/delivr-to/detections/blob/29cddf297f5eaff884b0e1c201bd9b7447022cf8/yara-rules/onenote_windows_script_encoding_file.yar#L1-L22"
+		source_url = "https://github.com/delivr-to/detections/blob/84158c63141cd22c128ff6f016329ffe67112f43/yara-rules/onenote_windows_script_encoding_file.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "b7068f551b3665358f461a076c2d46c82db558d7fa4acb7d3c9c5c2afce31253"
+		logic_hash = "v1_sha256_b7068f551b3665358f461a076c2d46c82db558d7fa4acb7d3c9c5c2afce31253"
 		score = 60
 		quality = 78
 		tags = "FILE"
@@ -123525,20 +123750,20 @@ rule DELIVRTO_SUSP_Onenote_Win_Script_Encoding_Feb23 : FILE
 		$wse = { 23 40 7E 5E }
 
 	condition:
-		filesize <5MB and ($one at 0) and $fdso and $wse
+		filesize < 5MB and ( $one at 0 ) and $fdso and $wse
 }
 rule DELIVRTO_SUSP_ZPAQ_Archive_Nov23 : FILE
 {
 	meta:
 		description = "ZPAQ file archive with expected file and block headers"
 		author = "delivr.to"
-		id = "28b6ffbe-be95-5ac8-ad3e-f9713a204d98"
+		id = "e5d69864-244b-5399-800c-a888a4cb4786"
 		date = "2023-11-26"
 		modified = "2023-11-27"
 		reference = "https://www.gdatasoftware.com/blog/2023/11/37822-agent-tesla-zpaq"
-		source_url = "https://github.com/delivr-to/detections/blob/29cddf297f5eaff884b0e1c201bd9b7447022cf8/yara-rules/zpaq_archives.yar#L1-L14"
+		source_url = "https://github.com/delivr-to/detections/blob/84158c63141cd22c128ff6f016329ffe67112f43/yara-rules/zpaq_archives.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "348144ee7137def00b37e074507e8148e51d34c484802a56bcd6e090d4628f18"
+		logic_hash = "v1_sha256_348144ee7137def00b37e074507e8148e51d34c484802a56bcd6e090d4628f18"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -123555,13 +123780,13 @@ rule DELIVRTO_SUSP_PDF_MHT_Activemime_Sept23 : FILE
 	meta:
 		description = "Presence of MHT ActiveMime within PDF for polyglot file"
 		author = "delivr.to"
-		id = "fbac1371-bad4-5751-a5c4-ce6c270fb83e"
+		id = "c8658db3-0794-5e83-bdfd-545da54e0485"
 		date = "2023-09-04"
 		modified = "2023-09-04"
 		reference = "https://blogs.jpcert.or.jp/en/2023/08/maldocinpdf.html"
-		source_url = "https://github.com/delivr-to/detections/blob/29cddf297f5eaff884b0e1c201bd9b7447022cf8/yara-rules/pdf_mht_activemime.yar#L1-L19"
+		source_url = "https://github.com/delivr-to/detections/blob/84158c63141cd22c128ff6f016329ffe67112f43/yara-rules/pdf_mht_activemime.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "af1450f649de6daec242f11e3b3c35305d3127fac4ef719a4ddb4edab3ae3651"
+		logic_hash = "v1_sha256_af1450f649de6daec242f11e3b3c35305d3127fac4ef719a4ddb4edab3ae3651"
 		score = 70
 		quality = 78
 		tags = "FILE"
@@ -123573,20 +123798,20 @@ rule DELIVRTO_SUSP_PDF_MHT_Activemime_Sept23 : FILE
 		$act = "edit-time-data" ascii nocase
 
 	condition:
-		uint32(0)==0x46445025 and all of ($mht*) and $act
+		uint32( 0 ) == 0x46445025 and all of ( $mht* ) and $act
 }
 rule DELIVRTO_SUSP_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
 {
 	meta:
 		description = "MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397"
 		author = "delivr.to"
-		id = "a0ede2d3-7789-5662-9575-5d0a5cf4457c"
+		id = "45950a93-eccb-5677-a6cf-5a5d9f617a4c"
 		date = "2023-03-15"
 		modified = "2023-03-15"
 		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
-		source_url = "https://github.com/delivr-to/detections/blob/29cddf297f5eaff884b0e1c201bd9b7447022cf8/yara-rules/msg_cve_2023_23397.yar#L1-L20"
+		source_url = "https://github.com/delivr-to/detections/blob/84158c63141cd22c128ff6f016329ffe67112f43/yara-rules/msg_cve_2023_23397.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "0476cf7f93c4f6cc48c19933f31360b62fe5e339f6a2a31dee8ad95f83ce67d7"
+		logic_hash = "v1_sha256_0476cf7f93c4f6cc48c19933f31360b62fe5e339f6a2a31dee8ad95f83ce67d7"
 		score = 60
 		quality = 80
 		tags = "CVE-2023-23397, FILE"
@@ -123596,20 +123821,20 @@ rule DELIVRTO_SUSP_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
 		$rfp = { 1F 85 00 00 }
 
 	condition:
-		uint32be(0)==0xD0CF11E0 and uint32be(4)==0xA1B11AE1 and $app and $rfp
+		uint32be( 0 ) == 0xD0CF11E0 and uint32be( 4 ) == 0xA1B11AE1 and $app and $rfp
 }
 rule DELIVRTO_SUSP_Onenote_RTLO_Character_Feb23 : FILE
 {
 	meta:
 		description = "Presence of RTLO Unicode Character in a OneNote file with embedded files"
 		author = "delivr.to"
-		id = "03d86391-1392-5734-af5f-8a2c7b99167a"
+		id = "1ff9f30e-73b0-52fb-a917-79205eb13b78"
 		date = "2023-02-17"
 		modified = "2023-02-17"
 		reference = "https://github.com/delivr-to/detections"
-		source_url = "https://github.com/delivr-to/detections/blob/29cddf297f5eaff884b0e1c201bd9b7447022cf8/yara-rules/onenote_rtlo_filename.yar#L1-L22"
+		source_url = "https://github.com/delivr-to/detections/blob/84158c63141cd22c128ff6f016329ffe67112f43/yara-rules/onenote_rtlo_filename.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "286bc1ab1f5df0d64634f53cc82357187306c40b063b156f36b602e131262c7a"
+		logic_hash = "v1_sha256_286bc1ab1f5df0d64634f53cc82357187306c40b063b156f36b602e131262c7a"
 		score = 60
 		quality = 55
 		tags = "FILE"
@@ -123620,20 +123845,20 @@ rule DELIVRTO_SUSP_Onenote_RTLO_Character_Feb23 : FILE
 		$rtlo = { 00 2E 20 }
 
 	condition:
-		filesize <5MB and ($one at 0) and $fdso and $rtlo
+		filesize < 5MB and ( $one at 0 ) and $fdso and $rtlo
 }
 rule DELIVRTO_SUSP_HTML_WASM_Smuggling
 {
 	meta:
 		description = "Presence of Base64 JavaScript blob loading WASM"
 		author = "delivr.to"
-		id = "fc83bb4f-ba8a-52d2-b9ce-632da5341f77"
+		id = "b107215f-9c15-5fbb-8b35-2e83b35478aa"
 		date = "2024-02-28"
 		modified = "2024-05-24"
 		reference = "https://github.com/delivr-to/detections"
-		source_url = "https://github.com/delivr-to/detections/blob/29cddf297f5eaff884b0e1c201bd9b7447022cf8/yara-rules/html_wasm.yar#L1-L13"
+		source_url = "https://github.com/delivr-to/detections/blob/84158c63141cd22c128ff6f016329ffe67112f43/yara-rules/html_wasm.yar#L1-L13"
 		license_url = "N/A"
-		logic_hash = "4bca88862c28db947c04c40e40fdecc682223d1eb90c98350fbd6c5d8c6c4636"
+		logic_hash = "v1_sha256_4bca88862c28db947c04c40e40fdecc682223d1eb90c98350fbd6c5d8c6c4636"
 		score = 70
 		quality = 80
 		tags = ""
@@ -123650,7 +123875,7 @@ rule DELIVRTO_SUSP_HTML_WASM_Smuggling
  * YARA Rule Set
  * Repository Name: ESET
  * Repository: https://github.com/eset/malware-ioc
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 9431ee8ccf63b1c014bfaa5f1a28dc747772d28d
  * Number of Rules: 103
  * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
@@ -123688,13 +123913,13 @@ private rule ESET_Is_Elf_PRIVATE
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "6389dc72-ac97-5366-83f2-2e9bcf618ae4"
+		id = "e8bc6a11-8980-537a-aebd-226ddc9c3c6a"
 		date = "2016-11-01"
 		modified = "2016-11-01"
 		reference = "https://github.com/eset/malware-ioc"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/moose/linux-moose.yar#L32-L39"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "2a3c9a875852cd3ce86d43b9e4a6ba786ecbae1f18bba73a3bef5b7e8ba67a3b"
+		logic_hash = "v1_sha256_2a3c9a875852cd3ce86d43b9e4a6ba786ecbae1f18bba73a3bef5b7e8ba67a3b"
 		score = 75
 		quality = 80
 		tags = ""
@@ -123712,19 +123937,19 @@ private rule ESET_Not_Ms_PRIVATE
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "7edb96a1-a63a-580e-ac26-66fa14ae97d1"
+		id = "25ebdce5-44fd-59c4-81c9-fee8c60f3865"
 		date = "2018-09-05"
 		modified = "2018-09-05"
 		reference = "https://github.com/eset/malware-ioc"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/turla-outlook.yar#L34-L40"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "71f492eaa80bee5e8cc5bec67b2a7fd6f5f71ee2594d9f531043747533c80443"
+		logic_hash = "v1_sha256_71f492eaa80bee5e8cc5bec67b2a7fd6f5f71ee2594d9f531043747533c80443"
 		score = 75
 		quality = 80
 		tags = ""
 
 	condition:
-		not for any i in (0..pe.number_of_signatures-1) : (pe.signatures[i].issuer contains "Microsoft Corporation")
+		not for any i in ( 0 .. pe.number_of_signatures - 1 ) : ( pe.signatures [ i ] . issuer contains "Microsoft Corporation" )
 }
 import "elf"
 
@@ -123733,14 +123958,14 @@ private rule ESET_Apachemodule_PRIVATE
 	meta:
 		description = "Apache 2.4 module ELF shared library"
 		author = "ESET, spol. s r.o."
-		id = "2082e50e-1726-5540-a962-e0aeca1ebaaf"
+		id = "3aa2dbc7-f11a-5ad2-a75d-1eaf8735e8b7"
 		date = "2024-04-27"
 		modified = "2024-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/windigo/helimod.yar#L3-L30"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
-		logic_hash = "213fe381aa0bf9f148e488f7af74ac63073776c2868e42d2dcca7fdbca55fabb"
+		logic_hash = "v1_sha256_213fe381aa0bf9f148e488f7af74ac63073776c2868e42d2dcca7fdbca55fabb"
 		score = 75
 		quality = 80
 		tags = ""
@@ -123751,22 +123976,20 @@ private rule ESET_Apachemodule_PRIVATE
 		$magic = "42PA"
 
 	condition:
-		for any s in elf.dynsym : (s.type==elf.STT_OBJECT and for any seg in elf.segments : (seg.type==elf.PT_LOAD and s.value>=seg.virtual_address and s.value<(seg.virtual_address+seg.file_size) and $magic at (s.value-seg.virtual_address+seg.offset)+0x28))
+		for any s in elf.dynsym : ( s.type == elf.STT_OBJECT and for any seg in elf.segments : ( seg.type == elf.PT_LOAD and s.value >= seg.virtual_address and s.value < ( seg.virtual_address + seg.file_size ) and $magic at ( s.value - seg.virtual_address + seg.offset ) + 0x28 ) )
 }
-import "pe"
-
 private rule ESET_Invisimole_Blob_PRIVATE
 {
 	meta:
 		description = "Detects InvisiMole blobs by magic values"
 		author = "ESET Research"
-		id = "6a179d91-50f1-5400-b141-0f162efd2431"
+		id = "374dcca3-edb2-5644-b4a0-c02b85f594f5"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/invisimole/invisimole.yar#L34-L52"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "8bddaf874da58fbe6362498f8979b511f39531fe2b98d4be8c099bdafb6d0067"
+		logic_hash = "v1_sha256_8bddaf874da58fbe6362498f8979b511f39531fe2b98d4be8c099bdafb6d0067"
 		score = 75
 		quality = 80
 		tags = ""
@@ -123780,7 +124003,7 @@ private rule ESET_Invisimole_Blob_PRIVATE
 		$magic_new_64 = {64 DA 11 CE}
 
 	condition:
-		($magic_old_32 at 0) or ($magic_old_64 at 0) or ($magic_new_32 at 0) or ($magic_new_64 at 0)
+		($magic_old_32 at 0 ) or ( $magic_old_64 at 0 ) or ( $magic_new_32 at 0 ) or ( $magic_new_64 at 0 )
 }
 import "pe"
 
@@ -123789,13 +124012,13 @@ private rule ESET_IIS_Native_Module_PRIVATE : FILE
 	meta:
 		description = "Signature to match an IIS native module (clean or malicious)"
 		author = "ESET Research"
-		id = "e3bacdc8-fde1-5e83-ac94-79fc345e888d"
+		id = "6e9c8ceb-773e-5168-8f22-e3040fa64eb1"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L34-L92"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "5a388dc3253df606e2648d1f9c018e6dde373bbddce66dba69b7aecdd95bac18"
+		logic_hash = "v1_sha256_5a388dc3253df606e2648d1f9c018e6dde373bbddce66dba69b7aecdd95bac18"
 		score = 75
 		quality = 55
 		tags = "FILE"
@@ -123849,20 +124072,20 @@ private rule ESET_IIS_Native_Module_PRIVATE : FILE
 		$e44 = "CGlobalModule::OnGlobalApplicationPreload"
 
 	condition:
-		uint16(0)==0x5A4D and pe.exports("RegisterModule") and any of ($e*)
+		uint16( 0 ) == 0x5A4D and pe.exports ( "RegisterModule" ) and any of ( $e* )
 }
 private rule ESET_Prikormkaearlyversion_PRIVATE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "f10e6477-c4bb-50be-8827-66de35a9aea8"
+		id = "b21cb5b7-7b20-5c0b-973e-d777bb996595"
 		date = "2019-08-28"
 		modified = "2019-08-28"
 		reference = "https://github.com/eset/malware-ioc"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/groundbait/prikormka.yar#L112-L128"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "681c7fb322953da162c10b76e453aa8ace6673720012383e3cd5528b59b42de3"
+		logic_hash = "v1_sha256_681c7fb322953da162c10b76e453aa8ace6673720012383e3cd5528b59b42de3"
 		score = 75
 		quality = 28
 		tags = ""
@@ -123880,20 +124103,20 @@ private rule ESET_Prikormkaearlyversion_PRIVATE
 		$str08 = "KDLLRUNDRV" wide fullword
 
 	condition:
-		($mz at 0) and (2 of ($str*))
+		($mz at 0 ) and ( 2 of ( $str* ) )
 }
 private rule ESET_Prikormkamodule_PRIVATE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "f99ed5f7-9ccc-5543-9224-6f865578f81e"
+		id = "88d245a7-6d1d-5bc7-8b1f-0e870a10249f"
 		date = "2019-08-28"
 		modified = "2019-08-28"
 		reference = "https://github.com/eset/malware-ioc"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/groundbait/prikormka.yar#L53-L110"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "d5d7f1a46cbf9ff545c0fa840228d19ee7d45307078b4ae0b5a2fdf1c94d2978"
+		logic_hash = "v1_sha256_d5d7f1a46cbf9ff545c0fa840228d19ee7d45307078b4ae0b5a2fdf1c94d2978"
 		score = 75
 		quality = 26
 		tags = ""
@@ -123936,20 +124159,20 @@ private rule ESET_Prikormkamodule_PRIVATE
 		$str33 = "\\TOOLS PZZ\\Bezzahod\\" ascii
 
 	condition:
-		($mz at 0) and ( any of ($str*))
+		($mz at 0 ) and ( any of ( $str* ) )
 }
 private rule ESET_Prikormkadropper_PRIVATE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "d333693d-5386-5c34-a1c1-7a17e5bde849"
+		id = "2fe8d1ac-a012-5cad-9463-15ad1a4f7fa5"
 		date = "2019-08-28"
 		modified = "2019-08-28"
 		reference = "https://github.com/eset/malware-ioc"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/groundbait/prikormka.yar#L33-L51"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "cf524cdf4ffeb5c9280c5c8e7fca524c41e1ce4f9bc46b1fc8cb8b50ea68ec39"
+		logic_hash = "v1_sha256_cf524cdf4ffeb5c9280c5c8e7fca524c41e1ce4f9bc46b1fc8cb8b50ea68ec39"
 		score = 75
 		quality = 28
 		tags = ""
@@ -123967,20 +124190,20 @@ private rule ESET_Prikormkadropper_PRIVATE
 		$inj01 = "?AVCinj2008App@@" ascii
 
 	condition:
-		($mz at 0) and (( any of ($bin*)) or (3 of ($kd*)) or ( all of ($inj*)))
+		($mz at 0 ) and ( ( any of ( $bin* ) ) or ( 3 of ( $kd* ) ) or ( all of ( $inj* ) ) )
 }
 private rule ESET_Potaosecondstage_PRIVATE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "c1baace9-f481-533a-aa85-df5ba14069f2"
+		id = "03c22650-8a38-572b-bfbf-7227b4cfd073"
 		date = "2015-07-30"
 		modified = "2015-07-30"
 		reference = "https://github.com/eset/malware-ioc"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/potao/PotaoNew.yara#L81-L95"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "55f9fc2da09aa9c2e76725985c836f7b8ba5e0b69a9327fb911e8265b340b88c"
+		logic_hash = "v1_sha256_55f9fc2da09aa9c2e76725985c836f7b8ba5e0b69a9327fb911e8265b340b88c"
 		score = 75
 		quality = 28
 		tags = ""
@@ -123994,20 +124217,20 @@ private rule ESET_Potaosecondstage_PRIVATE
 		$str2 = "%.5llx"
 
 	condition:
-		($mz at 0) and any of ($binary*) and any of ($str*)
+		($mz at 0 ) and any of ( $binary* ) and any of ( $str* )
 }
 private rule ESET_Potaousb_PRIVATE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "98fd84cb-d8e8-5aed-a1ac-f1099be5a5db"
+		id = "59c7bea2-d82b-50d8-b5e9-2f25b3cd6f34"
 		date = "2015-07-30"
 		modified = "2015-07-30"
 		reference = "https://github.com/eset/malware-ioc"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/potao/PotaoNew.yara#L71-L80"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "8f72afbf3b123ea3914b3eade267bd21f7435fbf9fbde4049ca2600513bb31d9"
+		logic_hash = "v1_sha256_8f72afbf3b123ea3914b3eade267bd21f7435fbf9fbde4049ca2600513bb31d9"
 		score = 75
 		quality = 28
 		tags = ""
@@ -124018,20 +124241,20 @@ private rule ESET_Potaousb_PRIVATE
 		$binary2 = { 55 8B EC 51 56 C7 45 FC 00 00 00 00 EB 09 8B 45 FC 83 C0 01 89 45 FC 81 7D FC ?? ?? 00 00 7D 3D 8B 4D FC 0F BE 89 ?? ?? ?? 00 8B 45 FC 33 D2 BE 04 00 00 00 F7 F6 B8 03 00 00 00 2B C2 0F BE 90 ?? ?? ?? 00 33 CA 2B 4D FC 83 E9 01 81 E1 FF 00 00 00 8B 45 FC 88 88 ?? ?? ?? 00 EB B1 5E 8B E5 5D C3}
 
 	condition:
-		($mz at 0) and any of ($binary*)
+		($mz at 0 ) and any of ( $binary* )
 }
 private rule ESET_Potaodll_PRIVATE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "a53ff170-ed3a-5ee9-a262-bb2f77aba092"
+		id = "4cc637ae-e1b9-50ad-9742-15cd39c290ba"
 		date = "2015-07-30"
 		modified = "2015-07-30"
 		reference = "https://github.com/eset/malware-ioc"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/potao/PotaoNew.yara#L46-L70"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "1d1154eb10cc70b3252e3ca4a85789e8605f2f3b7044f03ec960fd56ab81886a"
+		logic_hash = "v1_sha256_1d1154eb10cc70b3252e3ca4a85789e8605f2f3b7044f03ec960fd56ab81886a"
 		score = 75
 		quality = 28
 		tags = ""
@@ -124056,20 +124279,20 @@ private rule ESET_Potaodll_PRIVATE
 		$dllname10 = "FilePathStealer.dll"
 
 	condition:
-		($mz at 0) and ( any of ($dllstr*) and any of ($dllname*))
+		($mz at 0 ) and ( any of ( $dllstr* ) and any of ( $dllname* ) )
 }
 private rule ESET_Potaodecoy_PRIVATE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "215f1821-f70d-547e-b261-335dc1300bf2"
+		id = "54ddf4bb-172d-5dac-8c22-05648e18bef0"
 		date = "2015-07-30"
 		modified = "2015-07-30"
 		reference = "https://github.com/eset/malware-ioc"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/potao/PotaoNew.yara#L32-L45"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "93cbe1d1545d1fb85b3218b68619e67a1dda80d5888d2685a04915b861dfce01"
+		logic_hash = "v1_sha256_93cbe1d1545d1fb85b3218b68619e67a1dda80d5888d2685a04915b861dfce01"
 		score = 75
 		quality = 28
 		tags = ""
@@ -124084,20 +124307,20 @@ private rule ESET_Potaodecoy_PRIVATE
 		$old_ver2 = {6F 70 65 6E 00 00 00 00 64 6F 63 00 64 61 66 73 72 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00}
 
 	condition:
-		($mz at 0) and (( all of ($str*)) or any of ($old_ver*) or $wiki_str)
+		($mz at 0 ) and ( ( all of ( $str* ) ) or any of ( $old_ver* ) or $wiki_str )
 }
 rule ESET_Potao
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "9c755cb8-9e3f-5118-a8e0-4ded9a075cbd"
+		id = "09759e4a-0d53-5b67-9158-8a1a59d9cd8d"
 		date = "2015-07-29"
 		modified = "2015-07-30"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/potao/PotaoNew.yara#L96-L108"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "c68addb14f7c22cec0c4d58bfffd373b2e3eb5c53a5b65532c84574e073fcbba"
+		logic_hash = "v1_sha256_c68addb14f7c22cec0c4d58bfffd373b2e3eb5c53a5b65532c84574e073fcbba"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124114,13 +124337,13 @@ rule ESET_Dino
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "77d0a039-f60c-59ea-bad6-5b4b630007bb"
+		id = "41fc9dd7-0580-538f-a6eb-a3b8815dfb6c"
 		date = "2015-07-14"
 		modified = "2015-08-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/animalfarm/animalfarm.yar#L73-L96"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "898e527eb8b05050135dee7cbe974100710a1a3a6a5cb8eb03563ee1c0aca01f"
+		logic_hash = "v1_sha256_898e527eb8b05050135dee7cbe974100710a1a3a6a5cb8eb03563ee1c0aca01f"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124149,7 +124372,7 @@ rule ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023
 	meta:
 		description = "Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12"
 		author = "ESET Research"
-		id = "5c815d14-8a3e-5c6a-9dc3-988e0f31c094"
+		id = "df0ed9b0-243b-5966-9771-6b8acc4c2a18"
 		date = "2023-03-31"
 		modified = "2023-04-19"
 		reference = "https://github.com/eset/malware-ioc"
@@ -124159,26 +124382,26 @@ rule ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023
 		hash = "cad1120d91b812acafef7175f949dd1b09c6c21a"
 		hash = "5b03294b72c0caa5fb20e7817002c600645eb475"
 		hash = "7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec"
-		logic_hash = "f11a1db798bfcc534982bdf6afaae154b095b6a1e0896e75e2791c01e51a1c16"
+		logic_hash = "v1_sha256_f11a1db798bfcc534982bdf6afaae154b095b6a1e0896e75e2791c01e51a1c16"
 		score = 75
 		quality = 80
 		tags = ""
 
 	condition:
-		pe.rich_signature.toolid(259,30818)==9 and pe.rich_signature.toolid(256,31329)==1 and pe.rich_signature.toolid(261,30818)>=30 and pe.rich_signature.toolid(261,30818)<=38 and pe.rich_signature.toolid(261,29395)>=134 and pe.rich_signature.toolid(261,29395)<=164 and pe.rich_signature.toolid(257,29395)>=6 and pe.rich_signature.toolid(257,29395)<=14
+		pe.rich_signature.toolid( 259 , 30818 ) == 9 and pe.rich_signature.toolid ( 256 , 31329 ) == 1 and pe.rich_signature.toolid ( 261 , 30818 ) >= 30 and pe.rich_signature.toolid ( 261 , 30818 ) <= 38 and pe.rich_signature.toolid ( 261 , 29395 ) >= 134 and pe.rich_signature.toolid ( 261 , 29395 ) <= 164 and pe.rich_signature.toolid ( 257 , 29395 ) >= 6 and pe.rich_signature.toolid ( 257 , 29395 ) <= 14
 }
 rule ESET_Prikormka
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "6073aa34-d385-5ae8-b97d-9b3d61015aae"
+		id = "02aab8fa-f296-59f2-a7b2-1177486dc9ae"
 		date = "2016-05-10"
 		modified = "2019-08-28"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/groundbait/prikormka.yar#L130-L141"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "f64195e680fbaefedba248aa15b37ed30ba72f42958cc48963a140165e951bff"
+		logic_hash = "v1_sha256_f64195e680fbaefedba248aa15b37ed30ba72f42958cc48963a140165e951bff"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124195,14 +124418,14 @@ rule ESET_Cw_Windows_Redline_Panel_Tab_Headers : FILE
 	meta:
 		description = "Matches view headers in Redline Panel"
 		author = "ESET Research"
-		id = "44a95845-b0a3-59c1-8188-86d415eff0bf"
+		id = "00b7e7d1-67fd-508d-af9f-40b646a98840"
 		date = "2022-10-11"
 		modified = "2024-11-12"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/redline/redline.yar#L32-L55"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
-		logic_hash = "3198aa9df2814a5f1d5568c6eed5f3189b2f72b3928cc97645f9bf57eebab9ac"
+		logic_hash = "v1_sha256_3198aa9df2814a5f1d5568c6eed5f3189b2f72b3928cc97645f9bf57eebab9ac"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -124220,21 +124443,21 @@ rule ESET_Cw_Windows_Redline_Panel_Tab_Headers : FILE
 		$ = "RedLine | System Info Viewer"
 
 	condition:
-		uint16(0)==0x5A4D and 6 of them
+		uint16( 0 ) == 0x5A4D and 6 of them
 }
 rule ESET_Cw_Windows_Redline_Panel_Distinctive_Strings : FILE
 {
 	meta:
 		description = "Matches rare strings found in Redline panel"
 		author = "ESET Research"
-		id = "d40ccb6b-e777-5c05-b97c-ead910047649"
+		id = "8d60b07a-c5da-5d78-aa0c-79da103e21d4"
 		date = "2022-10-11"
 		modified = "2024-11-12"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/redline/redline.yar#L57-L77"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
-		logic_hash = "7ff0239426c4c3b46a269fad71232295c038c09f276cdc3c7f1142c830260a6d"
+		logic_hash = "v1_sha256_7ff0239426c4c3b46a269fad71232295c038c09f276cdc3c7f1142c830260a6d"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -124248,21 +124471,21 @@ rule ESET_Cw_Windows_Redline_Panel_Distinctive_Strings : FILE
 		$telegram1 = "https://t.me/REDLINESUPPORT"
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule ESET_Cw_Windows_Redline_Panel_Prompts : FILE
 {
 	meta:
 		description = "Matches prompt messages in Redline panel"
 		author = "ESET Research"
-		id = "3481586b-ed4b-5a27-82a0-0bbb3eea279e"
+		id = "20f9268e-92c3-5f6d-ad2e-8211f8e96a22"
 		date = "2022-10-11"
 		modified = "2024-11-12"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/redline/redline.yar#L79-L113"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
-		logic_hash = "0dfab05a9383ba13b3c610f1ab0c81e95804470002f27171ab39706f7723983a"
+		logic_hash = "v1_sha256_0dfab05a9383ba13b3c610f1ab0c81e95804470002f27171ab39706f7723983a"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -124291,21 +124514,21 @@ rule ESET_Cw_Windows_Redline_Panel_Prompts : FILE
 		$ = "Disconnected. Reboot your panel"
 
 	condition:
-		uint16(0)==0x5A4D and 10 of them
+		uint16( 0 ) == 0x5A4D and 10 of them
 }
 rule ESET_Cw_Windows_Redline_Panel_Status_Message_Strings : FILE
 {
 	meta:
 		description = "Matches error/success messages in Redline panel"
 		author = "ESET Research"
-		id = "70bdff10-9c86-57e3-b839-e86173a44855"
+		id = "47fe03ed-7290-5797-aeca-4e03f5c90bdc"
 		date = "2022-10-11"
 		modified = "2024-11-12"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/redline/redline.yar#L115-L142"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
-		logic_hash = "c60fabc81967b083be72ff564af744ab60441de5d563ea6d88d873c0a99bfbdd"
+		logic_hash = "v1_sha256_c60fabc81967b083be72ff564af744ab60441de5d563ea6d88d873c0a99bfbdd"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -124327,21 +124550,21 @@ rule ESET_Cw_Windows_Redline_Panel_Status_Message_Strings : FILE
 		$ = "Files not found"
 
 	condition:
-		uint16(0)==0x5A4D and 8 of them
+		uint16( 0 ) == 0x5A4D and 8 of them
 }
 rule ESET_Cw_Windows_Redline_Panel_Commands : FILE
 {
 	meta:
 		description = "Matches commands and functionalities in Redline panel"
 		author = "ESET Research"
-		id = "b479dc47-53a0-5ead-a4c3-bcdfcaf82ef8"
+		id = "d4c8fb0f-f3c6-5001-8bb4-929a6350200d"
 		date = "2022-10-11"
 		modified = "2024-11-12"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/redline/redline.yar#L144-L172"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
-		logic_hash = "724516101264aa89259e847e4703d4eb993f330f82bd2df2433176b11d0c8974"
+		logic_hash = "v1_sha256_724516101264aa89259e847e4703d4eb993f330f82bd2df2433176b11d0c8974"
 		score = 75
 		quality = 55
 		tags = "FILE"
@@ -124364,7 +124587,7 @@ rule ESET_Cw_Windows_Redline_Panel_Commands : FILE
 		$action7 = "antiDuplicate"
 
 	condition:
-		uint16(0)==0x5A4D and all of ($cmd*) and 4 of ($action*)
+		uint16( 0 ) == 0x5A4D and all of ( $cmd* ) and 4 of ( $action* )
 }
 import "pe"
 
@@ -124373,13 +124596,13 @@ rule ESET_Beds_Plugin
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "7c038e92-1064-503e-9d63-2d2c10f1759e"
+		id = "63e9bb61-9a08-523a-bb74-95615e71e89f"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L34-L51"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "024cb91288f133e4cdf5993ac0477de6de76d38fa06f7affa348c6a28a4600da"
+		logic_hash = "v1_sha256_024cb91288f133e4cdf5993ac0477de6de76d38fa06f7affa348c6a28a4600da"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124389,7 +124612,7 @@ rule ESET_Beds_Plugin
 		License = "BSD 2-Clause"
 
 	condition:
-		pe.exports("CheckDLLStatus") and pe.exports("GetPluginData") and pe.exports("InitializePlugin") and pe.exports("IsReleased") and pe.exports("ReleaseDLL")
+		pe.exports( "CheckDLLStatus" ) and pe.exports ( "GetPluginData" ) and pe.exports ( "InitializePlugin" ) and pe.exports ( "IsReleased" ) and pe.exports ( "ReleaseDLL" )
 }
 import "pe"
 
@@ -124398,13 +124621,13 @@ rule ESET_Beds_Dropper
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "47ccab59-253f-55d4-b38a-4441802626fc"
+		id = "790b0748-5e98-554b-8ba9-39c0aa02cabb"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L53-L67"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "4b5d121e182e3fddd766a7a1227c5de273995e9336156e7a6e8a17faad681bea"
+		logic_hash = "v1_sha256_4b5d121e182e3fddd766a7a1227c5de273995e9336156e7a6e8a17faad681bea"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124414,22 +124637,20 @@ rule ESET_Beds_Dropper
 		License = "BSD 2-Clause"
 
 	condition:
-		pe.imphash()=="a7ead4ef90d9981e25728e824a1ba3ef"
+		pe.imphash( ) == "a7ead4ef90d9981e25728e824a1ba3ef"
 }
-import "pe"
-
 rule ESET_Facebook_Bot : FILE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "643b137f-af79-584c-8266-f2335a79f1ba"
+		id = "c2ea56f7-4741-5834-90d8-d7a0f4f31773"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L69-L100"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "8ea779f90fa6080398403e3e6f9d342360c35e93c756ed43cb699f090106504e"
+		logic_hash = "v1_sha256_8ea779f90fa6080398403e3e6f9d342360c35e93c756ed43cb699f090106504e"
 		score = 75
 		quality = 55
 		tags = "FILE"
@@ -124456,22 +124677,20 @@ rule ESET_Facebook_Bot : FILE
 		$x9 = "profile.login" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($s*) or 3 of ($x*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $s* ) or 3 of ( $x* ) ) ) or ( all of them )
 }
-import "pe"
-
 rule ESET_Pds_Plugins : FILE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "dfa75db5-f21c-5b5e-84ba-3bfdcc3efdcd"
+		id = "f2ca0f8f-1aa7-52cf-bc03-fa25ee595027"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L102-L130"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "26bbd380b72fb45206178639d67c8737b9984b140ba1048432949e159946c847"
+		logic_hash = "v1_sha256_26bbd380b72fb45206178639d67c8737b9984b140ba1048432949e159946c847"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -124496,22 +124715,20 @@ rule ESET_Pds_Plugins : FILE
 		$s13 = "CCookieManager *" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (2 of ($s*)))
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule ESET_Stantinko_Pdb
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "24694e53-b89e-5cd3-ad53-e738bbd7d69d"
+		id = "c5c69747-c27f-5fa8-8752-32b7d218067e"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L132-L148"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "902c0ee086ce1a8def831d2f30c868165198c6c304faac3a93116a524f8e2fbf"
+		logic_hash = "v1_sha256_902c0ee086ce1a8def831d2f30c868165198c6c304faac3a93116a524f8e2fbf"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124526,20 +124743,18 @@ rule ESET_Stantinko_Pdb
 	condition:
 		all of them
 }
-import "pe"
-
 rule ESET_Stantinko_Droppers : FILE
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "fe2e6987-929a-59e3-a9ec-01a9f55fe589"
+		id = "e1bae22e-748a-594d-a287-95ca25bbafa3"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L150-L170"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "c56fc85834a3e1bb1c14da37fb509c7de3009bf81d52800fe0093dc489f6deaa"
+		logic_hash = "v1_sha256_c56fc85834a3e1bb1c14da37fb509c7de3009bf81d52800fe0093dc489f6deaa"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -124553,7 +124768,7 @@ rule ESET_Stantinko_Droppers : FILE
 		$s2 = {7E 5E 7F 8C 08 46 00 00 AB 57 1A BB 91 5C 00 00 FA CC FD 76 90 3A 00 00}
 
 	condition:
-		uint16(0)==0x5A4D and 1 of them
+		uint16( 0 ) == 0x5A4D and 1 of them
 }
 import "pe"
 
@@ -124562,13 +124777,13 @@ rule ESET_Stantinko_D3D
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "6652e55c-96a0-55a7-9941-7f32bbf984e5"
+		id = "d886199c-d8eb-5203-a2fe-79dbf45e3ba6"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L172-L187"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "4e8da3f11df15e4aa469db62961ae390c4c4df2a5335eec0bdab19b14cc8343d"
+		logic_hash = "v1_sha256_4e8da3f11df15e4aa469db62961ae390c4c4df2a5335eec0bdab19b14cc8343d"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124578,22 +124793,20 @@ rule ESET_Stantinko_D3D
 		License = "BSD 2-Clause"
 
 	condition:
-		pe.exports("EntryPoint") and pe.exports("ServiceMain") and pe.imports("WININET.DLL","HttpAddRequestHeadersA")
+		pe.exports( "EntryPoint" ) and pe.exports ( "ServiceMain" ) and pe.imports ( "WININET.DLL" , "HttpAddRequestHeadersA" )
 }
-import "pe"
-
 rule ESET_Stantinko_Ihctrl32
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "e8ab9f78-f438-5d9b-8407-e6c7e241da2c"
+		id = "289c7939-5207-564a-8575-815e50cd1c5b"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L189-L209"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "1829e08fb2289f738d0e75ad9977169e9a94379da764b1766f23fa47e8bc2543"
+		logic_hash = "v1_sha256_1829e08fb2289f738d0e75ad9977169e9a94379da764b1766f23fa47e8bc2543"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124612,20 +124825,18 @@ rule ESET_Stantinko_Ihctrl32
 	condition:
 		2 of them
 }
-import "pe"
-
 rule ESET_Stantinko_Wsaudio
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "623f4ac7-03ec-52df-b7bf-0a2055453c52"
+		id = "77054970-2964-524a-9730-71b0ff3b90f7"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L211-L233"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "45d92f1475f316ba50a9a4a3dd519d1186ed16c68bd2debe326736a1e3154562"
+		logic_hash = "v1_sha256_45d92f1475f316ba50a9a4a3dd519d1186ed16c68bd2debe326736a1e3154562"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124643,20 +124854,18 @@ rule ESET_Stantinko_Wsaudio
 	condition:
 		2 of them
 }
-import "pe"
-
 rule ESET_Stantinko_Ghstore
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "ef9f0c27-35ea-5dd5-925f-09b6e043569d"
+		id = "76da8b52-20ad-51a6-acf3-3e176a9ddb3b"
 		date = "2017-07-17"
 		modified = "2017-07-20"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/stantinko/stantinko.yar#L235-L255"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "e5628d6ffb2d3684264b3a88c4d7b5d2ce8983aa22badf5839ccb8ba2e3ef2d4"
+		logic_hash = "v1_sha256_e5628d6ffb2d3684264b3a88c4d7b5d2ce8983aa22badf5839ccb8ba2e3ef2d4"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124675,20 +124884,18 @@ rule ESET_Stantinko_Ghstore
 	condition:
 		3 of them
 }
-import "pe"
-
 rule ESET_IIS_Group02
 {
 	meta:
 		description = "Detects Group 2 native IIS malware family"
 		author = "ESET Research"
-		id = "945e3748-1072-55f3-abaa-903dfc250294"
+		id = "bfdd1bb1-08e4-55ab-80c5-bc36180e4b57"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L134-L155"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "3fa2b8fed3c580f446b55412a920a5cfed2317b06aa93d059e9f89fdbec8f683"
+		logic_hash = "v1_sha256_3fa2b8fed3c580f446b55412a920a5cfed2317b06aa93d059e9f89fdbec8f683"
 		score = 75
 		quality = 76
 		tags = ""
@@ -124704,22 +124911,20 @@ rule ESET_IIS_Group02
 		$s6 = "AVRSAFunction"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* )
 }
-import "pe"
-
 rule ESET_IIS_Group03
 {
 	meta:
 		description = "Detects Group 3 native IIS malware family"
 		author = "ESET Research"
-		id = "9caf9b3e-611e-5e0e-a7ee-9e7515679022"
+		id = "8d8c5692-56ce-501e-8bf3-c0fa006fdf7a"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L157-L176"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "d811c2ac610780bf968e86e8fd302cffc9434902e547399d06fdeb30d1719f51"
+		logic_hash = "v1_sha256_d811c2ac610780bf968e86e8fd302cffc9434902e547399d06fdeb30d1719f51"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124733,22 +124938,20 @@ rule ESET_IIS_Group03
 		$s4 = "X-Cookie"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* )
 }
-import "pe"
-
 rule ESET_IIS_Group04_Rgdoor
 {
 	meta:
 		description = "Detects Group 4 native IIS malware family (RGDoor)"
 		author = "ESET Research"
-		id = "64a0e664-a4d9-555b-a11b-5f7d9d0678b1"
+		id = "8dedeaf8-640a-551f-b930-a049a77aacee"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L178-L199"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "be615dc0cc8bf0fd52cc5a88a3759c1cb1cd18703de74d16f5cce3eabccf91c6"
+		logic_hash = "v1_sha256_be615dc0cc8bf0fd52cc5a88a3759c1cb1cd18703de74d16f5cce3eabccf91c6"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124763,22 +124966,20 @@ rule ESET_IIS_Group04_Rgdoor
 		$s5 = "cmd.exe"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and ($i1 or all of ($s*))
+		ESET_IIS_Native_Module_PRIVATE and ( $i1 or all of ( $s* ) )
 }
-import "pe"
-
 rule ESET_IIS_Group05_Iistealer
 {
 	meta:
 		description = "Detects Group 5 native IIS malware family (IIStealer)"
 		author = "ESET Research"
-		id = "598ec6b2-0349-5da7-acad-72ef2468b927"
+		id = "f0f5b3ff-0f13-5faa-94dd-19e060656dc5"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L201-L232"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "5dff445121fda59df805d6fcb5db3f8f8e52a6e63e2da2a6875f8c9ad9cafc72"
+		logic_hash = "v1_sha256_5dff445121fda59df805d6fcb5db3f8f8e52a6e63e2da2a6875f8c9ad9cafc72"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124800,22 +125001,20 @@ rule ESET_IIS_Group05_Iistealer
 		$s12 = {C7 ?? AF 2F 00 70 00 C7 ?? B3 72 00 69 00 C7 ?? B7 76 00 61 00 C7 ?? BB 63 00 79 00 C7 ?? BF 2E 00 61 00 C7 ?? C3 73 00 70 00 C7 ?? C7 78 00 00 00}
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* )
 }
-import "pe"
-
 rule ESET_IIS_Group06_ISN
 {
 	meta:
 		description = "Detects Group 6 native IIS malware family (ISN)"
 		author = "ESET Research"
-		id = "1f68fc42-61a3-5a7d-9daa-31ae3b561837"
+		id = "b8cba1c3-9df8-544a-80f3-32d4b3fcb333"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L234-L259"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "2f59034a642a9b92fc88922433cd5923be02332159cba5e16d99d9523ed43205"
+		logic_hash = "v1_sha256_2f59034a642a9b92fc88922433cd5923be02332159cba5e16d99d9523ed43205"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124834,22 +125033,20 @@ rule ESET_IIS_Group06_ISN
 		$s9 = "isn7.dll"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* )
 }
-import "pe"
-
 rule ESET_IIS_Group07_Iispy
 {
 	meta:
 		description = "Detects Group 7 native IIS malware family (IISpy)"
 		author = "ESET Research"
-		id = "64ed0189-a0be-5592-b9c6-1622700a7ed7"
+		id = "17bccdc6-e280-544e-a42e-cdfe48d55000"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L261-L296"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "ec5db5f36d06f9b0bdfe598fc72431da35afc1473dcc29f437a0f48ea9835a03"
+		logic_hash = "v1_sha256_ec5db5f36d06f9b0bdfe598fc72431da35afc1473dcc29f437a0f48ea9835a03"
 		score = 75
 		quality = 80
 		tags = ""
@@ -124874,22 +125071,20 @@ rule ESET_IIS_Group07_Iispy
 		$t6 = {89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52}
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 2 of ($s*) and any of ($t*)
+		ESET_IIS_Native_Module_PRIVATE and 2 of ( $s* ) and any of ( $t* )
 }
-import "pe"
-
 rule ESET_IIS_Group08
 {
 	meta:
 		description = "Detects Group 8 native IIS malware family"
 		author = "ESET Research"
-		id = "d0e9a5ec-b7f0-5d3f-93b4-d048503eb210"
+		id = "ce5e5ac3-99d8-5009-aca9-3e204bbd99e9"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L298-L337"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "d5826d454d25ecbbb5da464da974023a247517d873cf10dc0eafa91e185451da"
+		logic_hash = "v1_sha256_d5826d454d25ecbbb5da464da974023a247517d873cf10dc0eafa91e185451da"
 		score = 75
 		quality = 53
 		tags = ""
@@ -124922,22 +125117,20 @@ rule ESET_IIS_Group08
 		$s20 = "101fb9d9e86d9e6c"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 1 of ($i*) and 3 of ($s*)
+		ESET_IIS_Native_Module_PRIVATE and 1 of ( $i* ) and 3 of ( $s* )
 }
-import "pe"
-
 rule ESET_IIS_Group09
 {
 	meta:
 		description = "Detects Group 9 native IIS malware family"
 		author = "ESET Research"
-		id = "69d176bc-73b1-5c4d-bb7e-463d26e8e6a9"
+		id = "9e31e907-b305-5ccd-8112-4305ff1900a0"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L339-L387"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "5f89f9488221b8db8d493b3c23b7f5edd957c15511148eca890558886c128192"
+		logic_hash = "v1_sha256_5f89f9488221b8db8d493b3c23b7f5edd957c15511148eca890558886c128192"
 		score = 75
 		quality = 76
 		tags = ""
@@ -124978,22 +125171,20 @@ rule ESET_IIS_Group09
 		$s25 = "http://xsc.b1174.c" xor
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and any of ($i*) and 3 of ($s*)
+		ESET_IIS_Native_Module_PRIVATE and any of ( $i* ) and 3 of ( $s* )
 }
-import "pe"
-
 rule ESET_IIS_Group10
 {
 	meta:
 		description = "Detects Group 10 native IIS malware family"
 		author = "ESET Research"
-		id = "31368b38-9128-594d-888d-e97d3edc7a1f"
+		id = "a0cf4e20-ca9c-5421-a080-a8906c1b09e2"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L389-L423"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "48701168d7da726222227ef757f1a4005a49c0bf300123319ce03db09445b3ef"
+		logic_hash = "v1_sha256_48701168d7da726222227ef757f1a4005a49c0bf300123319ce03db09445b3ef"
 		score = 75
 		quality = 80
 		tags = ""
@@ -125021,22 +125212,20 @@ rule ESET_IIS_Group10
 		$e10 = "sm.cn"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 2 of ($e*) and 3 of ($s*)
+		ESET_IIS_Native_Module_PRIVATE and 2 of ( $e* ) and 3 of ( $s* )
 }
-import "pe"
-
 rule ESET_IIS_Group11
 {
 	meta:
 		description = "Detects Group 11 native IIS malware family"
 		author = "ESET Research"
-		id = "e9dac67a-1675-5198-ad26-d555696844f9"
+		id = "d14c7c0b-3c56-588e-8632-33d5c567f99c"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L425-L455"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "a67b6b49b5fc2c7f260c06201c59478f5472de63091c510af82d526c410abb0c"
+		logic_hash = "v1_sha256_a67b6b49b5fc2c7f260c06201c59478f5472de63091c510af82d526c410abb0c"
 		score = 75
 		quality = 80
 		tags = ""
@@ -125053,22 +125242,20 @@ rule ESET_IIS_Group11
 		$s7 = "jvvr<11yyy0cnnuqwnw0eqo130rjrAeofqwv?"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* )
 }
-import "pe"
-
 rule ESET_IIS_Group12
 {
 	meta:
 		description = "Detects Group 12 native IIS malware family"
 		author = "ESET Research"
-		id = "7278f2df-d18a-5d95-9c21-37906629a7f0"
+		id = "125ff157-3a1b-5f77-b08d-5f90a94c73e1"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L457-L495"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "8da03328e3702aff8ea5de77fc220f326030c31972d27c0bd9b5918dca550aba"
+		logic_hash = "v1_sha256_8da03328e3702aff8ea5de77fc220f326030c31972d27c0bd9b5918dca550aba"
 		score = 75
 		quality = 78
 		tags = ""
@@ -125101,20 +125288,18 @@ rule ESET_IIS_Group12
 	condition:
 		ESET_IIS_Native_Module_PRIVATE and 5 of them
 }
-import "pe"
-
 rule ESET_IIS_Group13_Iiserpent
 {
 	meta:
 		description = "Detects Group 13 native IIS malware family (IISerpent)"
 		author = "ESET Research"
-		id = "f22dffb1-466f-5a7b-b9aa-de7ba991db1a"
+		id = "019d33b8-2a11-5184-8cf1-35776c79fd7b"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L497-L523"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "7077b842c53ee1581ad4150cdfaac3502bfc0fbd3b823190ad648e09f36e442d"
+		logic_hash = "v1_sha256_7077b842c53ee1581ad4150cdfaac3502bfc0fbd3b823190ad648e09f36e442d"
 		score = 75
 		quality = 80
 		tags = ""
@@ -125137,20 +125322,18 @@ rule ESET_IIS_Group13_Iiserpent
 	condition:
 		ESET_IIS_Native_Module_PRIVATE and 5 of them
 }
-import "pe"
-
 rule ESET_IIS_Group14
 {
 	meta:
 		description = "Detects Group 14 native IIS malware family"
 		author = "ESET Research"
-		id = "c773b09e-9f24-5e75-ba80-4be69af70b06"
+		id = "7165e279-af54-584e-bc99-b5071100e32f"
 		date = "2021-08-04"
 		modified = "2021-08-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/badiis/badiis.yar#L525-L552"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "ef10a4dfb1a9164533677416a7c9ada715ce10bfc1e5f92b56cf54bd890d4575"
+		logic_hash = "v1_sha256_ef10a4dfb1a9164533677416a7c9ada715ce10bfc1e5f92b56cf54bd890d4575"
 		score = 75
 		quality = 80
 		tags = ""
@@ -125170,22 +125353,20 @@ rule ESET_IIS_Group14
 		$s6 = "HTTP_X_FORWARDED_FOR"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 2 of ($i*) or 5 of them
+		ESET_IIS_Native_Module_PRIVATE and 2 of ( $i* ) or 5 of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Tendyron_Dropper
 {
 	meta:
 		description = "TA410 Tendyron Dropper"
 		author = "ESET Research"
-		id = "8d1e16d9-b5c2-5427-a0b4-7dd00a9df5ec"
+		id = "5ad87699-5e6e-5a3f-8206-ce269d85ae26"
 		date = "2020-12-09"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L34-L53"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "45f7300a4b85624ad3fda5c73a24f53f53cb7990def4d84e04dcd8e5747f4f2e"
+		logic_hash = "v1_sha256_45f7300a4b85624ad3fda5c73a24f53f53cb7990def4d84e04dcd8e5747f4f2e"
 		score = 75
 		quality = 80
 		tags = ""
@@ -125201,22 +125382,20 @@ rule ESET_Apt_Windows_TA410_Tendyron_Dropper
 		$s6 = "ALPC Port" wide
 
 	condition:
-		int16 (0)==0x5A4D and 4 of them
+		int16 ( 0 ) == 0x5A4D and 4 of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Tendyron_Installer
 {
 	meta:
 		description = "TA410 Tendyron Installer"
 		author = "ESET Research"
-		id = "95ccad1c-99fb-5d38-aec0-650db3e06b35"
+		id = "53991487-825b-5e00-8d38-488186ded2c3"
 		date = "2020-12-09"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L55-L73"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "9c3afb924747614f27c31cf2c3d98f4932a9d11597a3ac94263bf93be02801da"
+		logic_hash = "v1_sha256_9c3afb924747614f27c31cf2c3d98f4932a9d11597a3ac94263bf93be02801da"
 		score = 75
 		quality = 80
 		tags = ""
@@ -125231,22 +125410,20 @@ rule ESET_Apt_Windows_TA410_Tendyron_Installer
 		$s5 = "\\RTFExploit\\"
 
 	condition:
-		int16 (0)==0x5A4D and 3 of them
+		int16 ( 0 ) == 0x5A4D and 3 of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Tendyron_Downloader
 {
 	meta:
 		description = "TA410 Tendyron Downloader"
 		author = "ESET Research"
-		id = "afd8a2a7-8d58-5a96-b9e0-6f8b859e83c5"
+		id = "0a0e66fb-368f-5840-8bac-be1ba9986a1a"
 		date = "2020-12-09"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L75-L107"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "16030a78ae9af8783f5913644294ceff861c8264ead8ca99435032be6d7949ef"
+		logic_hash = "v1_sha256_16030a78ae9af8783f5913644294ceff861c8264ead8ca99435032be6d7949ef"
 		score = 75
 		quality = 80
 		tags = ""
@@ -125266,22 +125443,20 @@ rule ESET_Apt_Windows_TA410_Tendyron_Downloader
 		$s1 = "startModule" fullword
 
 	condition:
-		int16 (0)==0x5A4D and all of them
+		int16 ( 0 ) == 0x5A4D and all of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_X4_Strings
 {
 	meta:
 		description = "Matches various strings found in TA410 X4"
 		author = "ESET Research"
-		id = "e6af4516-8b79-5182-8571-7dd530632ddc"
+		id = "7b920fe9-016d-5ba7-8ea7-589d566901a6"
 		date = "2020-10-09"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L109-L125"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "d4b2321a6d0eb0ca8d7c47596af2a45c22b3aef15d1832d64d6588a62cab312a"
+		logic_hash = "v1_sha256_d4b2321a6d0eb0ca8d7c47596af2a45c22b3aef15d1832d64d6588a62cab312a"
 		score = 75
 		quality = 74
 		tags = ""
@@ -125296,20 +125471,18 @@ rule ESET_Apt_Windows_TA410_X4_Strings
 	condition:
 		any of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_X4_Hash_Values : FILE
 {
 	meta:
 		description = "Matches X4 hash function found in TA410 X4"
 		author = "ESET Research"
-		id = "859bb977-82d0-5314-b1a8-fb3bb06a1b28"
+		id = "bac69062-aedf-5a66-84d7-c9165017471a"
 		date = "2020-10-09"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L127-L149"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "bcf3891ff888ca99af9aa0e239b29241ae819022607fb829c5731267add308ea"
+		logic_hash = "v1_sha256_bcf3891ff888ca99af9aa0e239b29241ae819022607fb829c5731267add308ea"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125327,22 +125500,20 @@ rule ESET_Apt_Windows_TA410_X4_Hash_Values : FILE
 		$s8 = {15 60 1E FB F5 03}
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_X4_Hash_Fct : FILE
 {
 	meta:
 		description = "Matches X4 hash function found in TA410 X4"
 		author = "ESET Research"
-		id = "5ca435a4-7c6e-594d-8c4d-d577735884e6"
+		id = "0fe8de40-8fc9-527b-aacb-18eeca8963ea"
 		date = "2020-10-09"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L151-L187"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "3b2d44cb7685a99e9aeb08f886f6876d43ee99d1e52e40705c3fa97ce3bfa9a0"
+		logic_hash = "v1_sha256_3b2d44cb7685a99e9aeb08f886f6876d43ee99d1e52e40705c3fa97ce3bfa9a0"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125362,22 +125533,20 @@ rule ESET_Apt_Windows_TA410_X4_Hash_Fct : FILE
         }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Lookback_Decryption : FILE
 {
 	meta:
 		description = "Matches encryption/decryption function used by LookBack."
 		author = "ESET Research"
-		id = "91947c6b-f357-5cf8-8522-4dcd517d01cb"
+		id = "cde7c0cc-7dbd-5ec5-8245-c319cbde7056"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L189-L254"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "016dca6be654fcd193acc481e6a998efbb77e7ebd09b26614422be1136dd02c0"
+		logic_hash = "v1_sha256_016dca6be654fcd193acc481e6a998efbb77e7ebd09b26614422be1136dd02c0"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125439,22 +125608,20 @@ rule ESET_Apt_Windows_TA410_Lookback_Decryption : FILE
         }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Lookback_Loader : FILE
 {
 	meta:
 		description = "Matches the modified function in LookBack libcurl loader."
 		author = "ESET Research"
-		id = "d0aac4f6-f72f-5adf-8f8f-9251bad70131"
+		id = "13c0bcdd-4704-5e05-bea7-4c778fcb8723"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L256-L309"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "98390dd664227ad747e5572771d12e7ebd2475d26db27e85508347ac6f44f3bf"
+		logic_hash = "v1_sha256_98390dd664227ad747e5572771d12e7ebd2475d26db27e85508347ac6f44f3bf"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125504,7 +125671,7 @@ rule ESET_Apt_Windows_TA410_Lookback_Loader : FILE
         }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 import "pe"
 
@@ -125513,13 +125680,13 @@ rule ESET_Apt_Windows_TA410_Lookback_Strings : FILE
 	meta:
 		description = "Matches multiple strings and export names in TA410 LookBack."
 		author = "ESET Research"
-		id = "b693c468-5abf-579d-bc03-67f67339feb9"
+		id = "95cbbbcf-abf5-5512-bd23-b13dbf5d02b6"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L311-L331"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "d17ed604e3691c20fe489f95197b7b802ec951ed13d538fa6643449485b326b2"
+		logic_hash = "v1_sha256_d17ed604e3691c20fe489f95197b7b802ec951ed13d538fa6643449485b326b2"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125535,22 +125702,20 @@ rule ESET_Apt_Windows_TA410_Lookback_Strings : FILE
 		$s6 = "SodomMainProc" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of them or pe.exports("SodomBodyLoad") or pe.exports("SodomBodyLoadTest"))
+		uint16( 0 ) == 0x5a4d and ( 2 of them or pe.exports ( "SodomBodyLoad" ) or pe.exports ( "SodomBodyLoadTest" ) )
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Lookback_HTTP : FILE
 {
 	meta:
 		description = "Matches LookBack's hardcoded HTTP request"
 		author = "ESET Research"
-		id = "ca4ee437-5ac9-5715-90fb-e0e74a817bb5"
+		id = "d58fec9b-de9f-560f-8055-e6ea3c4b4180"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L333-L349"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "0e777f56136cd11d62abdf4f120410d5fe9cd522cfc06afbf085414a96279bf7"
+		logic_hash = "v1_sha256_0e777f56136cd11d62abdf4f120410d5fe9cd522cfc06afbf085414a96279bf7"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125562,22 +125727,20 @@ rule ESET_Apt_Windows_TA410_Lookback_HTTP : FILE
 		$s2 = "id=1&op=report&status="
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Lookback_Magic : FILE
 {
 	meta:
 		description = "Matches message header creation in LookBack."
 		author = "ESET Research"
-		id = "5a40a307-772b-5600-9e58-f4bc6dfe6711"
+		id = "9cfdb68d-6e9c-5176-a45b-958717c07431"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L351-L377"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "442a08a77fd2db03e507c0d5a32b17ab4e5936a209f7af23ef3c33a4b9f3d0d5"
+		logic_hash = "v1_sha256_442a08a77fd2db03e507c0d5a32b17ab4e5936a209f7af23ef3c33a4b9f3d0d5"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125599,22 +125762,20 @@ rule ESET_Apt_Windows_TA410_Lookback_Magic : FILE
         }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Flowcloud_Loader_Strings : FILE
 {
 	meta:
 		description = "Matches various strings found in TA410 FlowCloud first stage."
 		author = "ESET Research"
-		id = "a3fb894f-8e26-5cbd-a1f2-8a9ab1db0901"
+		id = "012c6333-6e52-5181-b9b1-66f11e576ef9"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L379-L415"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "3c90723e009ffe2603910566ac52a324256676ee3ff128d94427681010e10e8b"
+		logic_hash = "v1_sha256_3c90723e009ffe2603910566ac52a324256676ee3ff128d94427681010e10e8b"
 		score = 75
 		quality = 78
 		tags = "FILE"
@@ -125646,22 +125807,20 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Loader_Strings : FILE
 		$s23 = "invalid encrypto hdr while decrypting"
 
 	condition:
-		uint16(0)==0x5a4d and ($key or $event or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( $key or $event or 5 of ( $s* ) )
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Flowcloud_Header_Decryption : FILE
 {
 	meta:
 		description = "Matches the function used to decrypt resources headers in TA410 FlowCloud"
 		author = "ESET Research"
-		id = "403c1845-bc25-5a49-8553-8a0be18d6970"
-		date = "2024-01-08"
+		id = "dad09e87-9e5b-59b7-8eed-b37c2b9e9b35"
+		date = "2024-01-15"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L417-L496"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "74b6c42bf2de159b2b0a15637e6bd94069367e3000c887714d6e3b50aa3646be"
+		logic_hash = "v1_sha256_74b6c42bf2de159b2b0a15637e6bd94069367e3000c887714d6e3b50aa3646be"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125703,22 +125862,20 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Header_Decryption : FILE
         }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Flowcloud_Dll_Hijacking_Strings : FILE
 {
 	meta:
 		description = "Matches filenames inside TA410 FlowCloud malicious DLL."
 		author = "ESET Research"
-		id = "6636d4d0-0a7f-5971-a7f4-58803042d874"
+		id = "914e3f3d-7aa8-5888-a5c7-d83ffad5e350"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L498-L517"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "e8082d4216364a12ba395f772b5caed94b3068d26a2b3a97ef711d61a82f65b3"
+		logic_hash = "v1_sha256_e8082d4216364a12ba395f772b5caed94b3068d26a2b3a97ef711d61a82f65b3"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125734,22 +125891,20 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Dll_Hijacking_Strings : FILE
 		$dll3 = "setlangloc.dll" wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($dat*) or all of ($dll*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $dat* ) or all of ( $dll* ) )
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Flowcloud_Malicious_Dll_Antianalysis : FILE
 {
 	meta:
 		description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL."
 		author = "ESET Research"
-		id = "b38a1d4d-5053-5a6d-be8c-c00261936417"
+		id = "0ee5cb54-cca6-52dd-a7da-8fbf5bf66478"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L519-L552"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "8f14352118d32a43c17f70bd753acc48bd314965f10ab97818e8a434bbda96d9"
+		logic_hash = "v1_sha256_8f14352118d32a43c17f70bd753acc48bd314965f10ab97818e8a434bbda96d9"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125769,7 +125924,7 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Malicious_Dll_Antianalysis : FILE
         }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 import "pe"
 
@@ -125778,13 +125933,13 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Pdb : FILE
 	meta:
 		description = "Matches PDB paths found in TA410 FlowCloud."
 		author = "ESET Research"
-		id = "8bf25768-941e-55c6-bd21-f6b614c9d75d"
+		id = "a2566a1b-c09a-54f4-b0dd-c2d636b394e7"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L554-L567"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "ff95ab0f8e68efe612a6e0d70cebd8bf815d6b5e3877c098ac0761382dc310d6"
+		logic_hash = "v1_sha256_ff95ab0f8e68efe612a6e0d70cebd8bf815d6b5e3877c098ac0761382dc310d6"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125792,22 +125947,20 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Pdb : FILE
 		version = "1"
 
 	condition:
-		uint16(0)==0x5a4d and (pe.pdb_path contains "\\FlowCloud\\trunk\\" or pe.pdb_path contains "\\flowcloud\\trunk\\")
+		uint16( 0 ) == 0x5a4d and ( pe.pdb_path contains "\\FlowCloud\\trunk\\" or pe.pdb_path contains "\\flowcloud\\trunk\\" )
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Flowcloud_Shellcode_Decryption : FILE
 {
 	meta:
 		description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL"
 		author = "ESET Research"
-		id = "8af7b2fa-be40-5ec8-8413-1c982a463a9a"
+		id = "aa03d3ad-c2ac-5b0d-84a0-2f353684b234"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L569-L615"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "939ffe6a41c957aa5d6c012484b2deab49a5e71a4b7e203a41c180f872803921"
+		logic_hash = "v1_sha256_939ffe6a41c957aa5d6c012484b2deab49a5e71a4b7e203a41c180f872803921"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125833,22 +125986,20 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Shellcode_Decryption : FILE
         }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Flowcloud_Fcclient_Strings : FILE
 {
 	meta:
 		description = "Strings found in fcClient/rescure.dat module."
 		author = "ESET Research"
-		id = "876bae0b-2612-559b-9ead-b633a3789663"
+		id = "6f2dfde7-d8d0-5fc1-8bc0-1cf1a02f7903"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L617-L639"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "c05b7031a5aec1bcf29eca06c010c402edeb24a093a2043dbc21781dff22c7fe"
+		logic_hash = "v1_sha256_c05b7031a5aec1bcf29eca06c010c402edeb24a093a2043dbc21781dff22c7fe"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125866,22 +126017,20 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Fcclient_Strings : FILE
 		$driver2 = "\\drivers\\hidusb.sys" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and ( any of ($s*) or all of ($driver*))
+		uint16( 0 ) == 0x5a4d and ( any of ( $s* ) or all of ( $driver* ) )
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Flowcloud_Fcclientdll_Strings : FILE
 {
 	meta:
 		description = "Strings found in fcClientDll/responsor.dat module."
 		author = "ESET Research"
-		id = "80ecaf51-406f-590c-8f9c-59672683de02"
+		id = "ff02d23f-8957-5f73-94a5-e4d6980f8180"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L641-L669"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "3a93f58cf14b57a96157077ec14aa6fb181e3da80f4ba46c0379a58b67c08a0e"
+		logic_hash = "v1_sha256_3a93f58cf14b57a96157077ec14aa6fb181e3da80f4ba46c0379a58b67c08a0e"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125905,22 +126054,20 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Fcclientdll_Strings : FILE
 		$sql7 = "insert into file_data(file_id, ofs, data, status)"
 
 	condition:
-		uint16(0)==0x5a4d and ( any of ($s*) or #fc_msg>=8 or 4 of ($sql*))
+		uint16( 0 ) == 0x5a4d and ( any of ( $s* ) or #fc_msg >= 8 or 4 of ( $sql* ) )
 }
-import "pe"
-
 rule ESET_Apt_Windows_TA410_Rootkit_Strings : FILE
 {
 	meta:
 		description = "Strings found in TA410's Rootkit"
 		author = "ESET Research"
-		id = "a6a97721-571e-5414-9b00-5789d7bcd078"
+		id = "c6af81b7-76e6-5715-93b7-7ac1db8b2cd3"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L671-L697"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "1d3ad63508c5e4bca32b9a44b738cb4a7384ccfa5704ce329260adb342ea4e60"
+		logic_hash = "v1_sha256_1d3ad63508c5e4bca32b9a44b738cb4a7384ccfa5704ce329260adb342ea4e60"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125942,7 +126089,7 @@ rule ESET_Apt_Windows_TA410_Rootkit_Strings : FILE
 		$s1 = "\\SystemRoot\\System32\\drivers\\hidmouse.sys" wide
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s1,$reg*) and ( all of ($driver*) or all of ($device*))
+		uint16( 0 ) == 0x5a4d and all of ( $s1 , $reg* ) and ( all of ( $driver* ) or all of ( $device* ) )
 }
 import "pe"
 
@@ -125951,13 +126098,13 @@ rule ESET_Apt_Windows_TA410_Flowcloud_V5_Resources : FILE
 	meta:
 		description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 5.0.2"
 		author = "ESET Research"
-		id = "05a233f0-a823-5154-a47d-cede722d4710"
+		id = "56f07f5d-93a7-5c25-b0f1-c3f4d8af1ac8"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L699-L720"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "58f75dda53c6d4b3d88f464c452d855ac6dc88add5f4fba2641f52e7a1ae00ed"
+		logic_hash = "v1_sha256_58f75dda53c6d4b3d88f464c452d855ac6dc88add5f4fba2641f52e7a1ae00ed"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125965,7 +126112,7 @@ rule ESET_Apt_Windows_TA410_Flowcloud_V5_Resources : FILE
 		version = "1"
 
 	condition:
-		uint16(0)==0x5a4d and pe.number_of_resources>=13 and for 12resource in pe.resources : (resource.type==10 and resource.language==1033 and (resource.name_string=="1\x000\x000\x00" or resource.name_string=="1\x000\x000\x000\x00" or resource.name_string=="1\x000\x000\x000\x000\x00" or resource.name_string=="1\x000\x000\x001\x00" or resource.name_string=="1\x000\x001\x00" or resource.name_string=="1\x000\x002\x00" or resource.name_string=="1\x000\x003\x00" or resource.name_string=="1\x000\x004\x00" or resource.name_string=="1\x000\x005\x00" or resource.name_string=="1\x000\x006\x00" or resource.name_string=="1\x000\x007\x00" or resource.name_string=="1\x000\x008\x00" or resource.name_string=="1\x000\x009\x00" or resource.name_string=="1\x001\x000\x00" or resource.name_string=="2\x000\x000\x000\x00" or resource.name_string=="2\x000\x000\x001\x00"))
+		uint16( 0 ) == 0x5a4d and pe.number_of_resources >= 13 and for 12 resource in pe.resources : ( resource.type == 10 and resource.language == 1033 and ( resource.name_string == "1\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x001\x00" or resource.name_string == "1\x000\x001\x00" or resource.name_string == "1\x000\x002\x00" or resource.name_string == "1\x000\x003\x00" or resource.name_string == "1\x000\x004\x00" or resource.name_string == "1\x000\x005\x00" or resource.name_string == "1\x000\x006\x00" or resource.name_string == "1\x000\x007\x00" or resource.name_string == "1\x000\x008\x00" or resource.name_string == "1\x000\x009\x00" or resource.name_string == "1\x001\x000\x00" or resource.name_string == "2\x000\x000\x000\x00" or resource.name_string == "2\x000\x000\x001\x00" ) )
 }
 import "pe"
 
@@ -125974,13 +126121,13 @@ rule ESET_Apt_Windows_TA410_Flowcloud_V4_Resources : FILE
 	meta:
 		description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 4.1.3"
 		author = "ESET Research"
-		id = "57b98823-439f-5a2c-a8cb-ac5e98953b06"
+		id = "08265212-5eec-5f6b-806f-133b75c0c16d"
 		date = "2021-10-12"
 		modified = "2022-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/ta410/ta410.yar#L722-L741"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "7b475cfddb5f995f7e8e3293b8e6ae59a9e36143998bc444499b5dce467f8e9d"
+		logic_hash = "v1_sha256_7b475cfddb5f995f7e8e3293b8e6ae59a9e36143998bc444499b5dce467f8e9d"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -125988,22 +126135,20 @@ rule ESET_Apt_Windows_TA410_Flowcloud_V4_Resources : FILE
 		version = "1"
 
 	condition:
-		uint16(0)==0x5a4d and pe.number_of_resources>=6 and for 5resource in pe.resources : (resource.type==10 and resource.language==1033 and (resource.name_string=="1\x000\x000\x000\x000\x00" or resource.name_string=="1\x000\x000\x000\x001\x00" or resource.name_string=="1\x000\x000\x000\x002\x00" or resource.name_string=="1\x000\x000\x000\x003\x00" or resource.name_string=="1\x000\x000\x000\x004\x00" or resource.name_string=="1\x000\x000\x000\x005\x00" or resource.name_string=="1\x000\x001\x000\x000\x00"))
+		uint16( 0 ) == 0x5a4d and pe.number_of_resources >= 6 and for 5 resource in pe.resources : ( resource.type == 10 and resource.language == 1033 and ( resource.name_string == "1\x000\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x001\x00" or resource.name_string == "1\x000\x000\x000\x002\x00" or resource.name_string == "1\x000\x000\x000\x003\x00" or resource.name_string == "1\x000\x000\x000\x004\x00" or resource.name_string == "1\x000\x000\x000\x005\x00" or resource.name_string == "1\x000\x001\x000\x000\x00" ) )
 }
-import "pe"
-
 rule ESET_Apt_Windows_Invisimole_Logs : FILE
 {
 	meta:
 		description = "Detects log files with collected created by InvisiMole's RC2CL backdoor"
 		author = "ESET Research"
-		id = "151883ad-1f44-55b4-b12a-f0d399527189"
+		id = "1510c337-79f9-5011-ac18-c2eb24429b4e"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/invisimole/invisimole.yar#L54-L77"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "d42423ccc768f1823c76d5cb2aec26434c796fc35bd4e2fbf435fcf7997d3ff0"
+		logic_hash = "v1_sha256_d42423ccc768f1823c76d5cb2aec26434c796fc35bd4e2fbf435fcf7997d3ff0"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -126011,22 +126156,20 @@ rule ESET_Apt_Windows_Invisimole_Logs : FILE
 		version = "1"
 
 	condition:
-		uint32(0)==0x08F1CAA1 or uint32(0)==0x08F1CAA2 or uint32(0)==0x08F1CCC0 or uint32(0)==0x08F2AFC0 or uint32(0)==0x083AE4DF or uint32(0)==0x18F2CBB1 or uint32(0)==0x1900ABBA or uint32(0)==0x24F2CEA1 or uint32(0)==0xDA012193 or uint32(0)==0xDA018993 or uint32(0)==0xDA018995 or uint32(0)==0xDD018991
+		uint32( 0 ) == 0x08F1CAA1 or uint32( 0 ) == 0x08F1CAA2 or uint32( 0 ) == 0x08F1CCC0 or uint32( 0 ) == 0x08F2AFC0 or uint32( 0 ) == 0x083AE4DF or uint32( 0 ) == 0x18F2CBB1 or uint32( 0 ) == 0x1900ABBA or uint32( 0 ) == 0x24F2CEA1 or uint32( 0 ) == 0xDA012193 or uint32( 0 ) == 0xDA018993 or uint32( 0 ) == 0xDA018995 or uint32( 0 ) == 0xDD018991
 }
-import "pe"
-
 rule ESET_Apt_Windows_Invisimole_SFX_Dropper : FILE
 {
 	meta:
 		description = "Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)"
 		author = "ESET Research"
-		id = "08490bcd-3139-5fac-9c6c-5a32acb7217a"
+		id = "8318efe0-aa80-5985-8d54-654af3e46fc4"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/invisimole/invisimole.yar#L79-L95"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "6ca248d42c1e889988e5931d80df071cb20e623fb0c4a208044cabe073f71ce4"
+		logic_hash = "v1_sha256_6ca248d42c1e889988e5931d80df071cb20e623fb0c4a208044cabe073f71ce4"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -126037,22 +126180,20 @@ rule ESET_Apt_Windows_Invisimole_SFX_Dropper : FILE
 		$encrypted_config = {5F 59 4F 58 19 18 04 4E 46 46 2A 5D 59 5A 58 43 44 5E 4C 7D 2A 0F 2A 59 2A 78 2A 4B 2A 58 2A 0E 2A 6F 2A 72 2A 4B 2A 0F 2A 4E 2A 04 2A 0F 2A 4E 2A 76 2A 0F 2A 79 2A 2A 2A 79 42 4F 46 46 6F 52 4F 49 5F 5E 4F 7D 2A 79 42 4F 46 46 19 18 04 4E 46 46 2A 7C 43 58 5E 5F 4B 46 6B 46 46 45 49 2A 66 45 4B 4E 66 43 48 58 4B 58 53 6B}
 
 	condition:
-		uint16(0)==0x5A4D and $encrypted_config
+		uint16( 0 ) == 0x5A4D and $encrypted_config
 }
-import "pe"
-
 rule ESET_Apt_Windows_Invisimole_CPL_Loader : FILE
 {
 	meta:
 		description = "CPL loader"
 		author = "ESET Research"
-		id = "feff8627-6085-5835-ac1b-d4522245f7db"
+		id = "23d9ca52-f274-57ac-83f6-4d3b0a857e29"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/invisimole/invisimole.yar#L97-L118"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "cd5c19e14faa7fd3758b30193ccf2bed3692ad29d8216466523ca25d2abcfe88"
+		logic_hash = "v1_sha256_cd5c19e14faa7fd3758b30193ccf2bed3692ad29d8216466523ca25d2abcfe88"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -126069,7 +126210,7 @@ rule ESET_Apt_Windows_Invisimole_CPL_Loader : FILE
 		$s7 = "wkssvmtx"
 
 	condition:
-		uint16(0)==0x5A4D and (3 of them )
+		uint16( 0 ) == 0x5A4D and ( 3 of them )
 }
 import "pe"
 
@@ -126078,13 +126219,13 @@ rule ESET_Apt_Windows_Invisimole_Wrapper_DLL
 	meta:
 		description = "Detects InvisiMole wrapper DLL with embedded RC2CL and RC2FM backdoors, by export and resource names"
 		author = "ESET Research"
-		id = "b9609b09-3ef5-5793-a3aa-4692cec367d9"
+		id = "5dec4d9a-97bd-5f22-9ae7-9e7d2bc4cd98"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/invisimole/invisimole.yar#L120-L138"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "156bc5bc7b0ed5c77a5a15e7799a3077d40150896476a60935cf21a9afe36856"
+		logic_hash = "v1_sha256_156bc5bc7b0ed5c77a5a15e7799a3077d40150896476a60935cf21a9afe36856"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126092,22 +126233,20 @@ rule ESET_Apt_Windows_Invisimole_Wrapper_DLL
 		version = "1"
 
 	condition:
-		pe.exports("GetDataLength") and for any y in (0..pe.number_of_resources-1) : (pe.resources[y].type==pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string=="R\x00C\x002\x00C\x00L\x00") and for any y in (0..pe.number_of_resources-1) : (pe.resources[y].type==pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string=="R\x00C\x002\x00F\x00M\x00")
+		pe.exports( "GetDataLength" ) and for any y in ( 0 .. pe.number_of_resources - 1 ) : ( pe.resources [ y ] . type == pe.RESOURCE_TYPE_RCDATA and pe.resources [ y ] . name_string == "R\x00C\x002\x00C\x00L\x00" ) and for any y in ( 0 .. pe.number_of_resources - 1 ) : ( pe.resources [ y ] . type == pe.RESOURCE_TYPE_RCDATA and pe.resources [ y ] . name_string == "R\x00C\x002\x00F\x00M\x00" )
 }
-import "pe"
-
 rule ESET_Apt_Windows_Invisimole_DNS_Downloader : FILE
 {
 	meta:
 		description = "InvisiMole DNS downloader"
 		author = "ESET Research"
-		id = "1caa6c8b-3798-556e-835e-885b7f3f4511"
+		id = "73835013-57dc-5668-9472-afdf0f26bce4"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/invisimole/invisimole.yar#L140-L170"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "88d6ed7ec1331153d19afc18473a4be2b214ad8af29fcf7051a2a8e40e088231"
+		logic_hash = "v1_sha256_88d6ed7ec1331153d19afc18473a4be2b214ad8af29fcf7051a2a8e40e088231"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -126131,22 +126270,20 @@ rule ESET_Apt_Windows_Invisimole_DNS_Downloader : FILE
 		$s13 = "rundll32.exe \"%s\",StartUI"
 
 	condition:
-		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and $d and 5 of ($s*)
+		(( uint16( 0 ) == 0x5A4D ) or ESET_Invisimole_Blob_PRIVATE ) and $d and 5 of ( $s* )
 }
-import "pe"
-
 rule ESET_Apt_Windows_Invisimole_RC2CL_Backdoor : FILE
 {
 	meta:
 		description = "InvisiMole RC2CL backdoor"
 		author = "ESET Research"
-		id = "0228b8ee-bf03-504e-8cdf-8a1c9a79d54e"
+		id = "f9b56c6a-bd6b-5290-a06b-d115d3f92d34"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/invisimole/invisimole.yar#L172-L213"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "c38550023515d33eaaf0669cc8b874bcfd09653a07c7edbf72e3344d1cf31541"
+		logic_hash = "v1_sha256_c38550023515d33eaaf0669cc8b874bcfd09653a07c7edbf72e3344d1cf31541"
 		score = 75
 		quality = 78
 		tags = "FILE"
@@ -126178,22 +126315,20 @@ rule ESET_Apt_Windows_Invisimole_RC2CL_Backdoor : FILE
 		$s22 = "SettingsSR2" wide
 
 	condition:
-		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and 5 of ($s*)
+		(( uint16( 0 ) == 0x5A4D ) or ESET_Invisimole_Blob_PRIVATE ) and 5 of ( $s* )
 }
-import "pe"
-
 rule ESET_Apt_Windows_Invisimole : FILE
 {
 	meta:
 		description = "InvisiMole magic values, keys and strings"
 		author = "ESET Research"
-		id = "4d48996b-9792-57ba-a302-349220323712"
+		id = "86e6be27-2a38-5791-9e2d-2be518609c18"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/invisimole/invisimole.yar#L215-L255"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "7a2cff9febe77d718089ba4e1a33f3487594588892e418cec685bf22b156fa2b"
+		logic_hash = "v1_sha256_7a2cff9febe77d718089ba4e1a33f3487594588892e418cec685bf22b156fa2b"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -126212,22 +126347,20 @@ rule ESET_Apt_Windows_Invisimole : FILE
 		$check_magic_new_64 = {81 3? 64 DA 11 CE}
 
 	condition:
-		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and ( any of ($check_magic*)) and (2 of ($s*))
+		(( uint16( 0 ) == 0x5A4D ) or ESET_Invisimole_Blob_PRIVATE ) and ( any of ( $check_magic* ) ) and ( 2 of ( $s* ) )
 }
-import "pe"
-
 rule ESET_Apt_Windows_Invisimole_C2 : FILE
 {
 	meta:
 		description = "InvisiMole C&C servers"
 		author = "ESET Research"
-		id = "9279c8cd-2c16-5f90-a7f5-e668d57c805b"
+		id = "840d849f-c23e-5f56-a078-4647199533a2"
 		date = "2021-05-17"
 		modified = "2021-05-17"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/invisimole/invisimole.yar#L257-L297"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "aff8456ce7a9ebe875c02e51c09b77ee7b1fddfc11d4ad236e12c8c5240a01a8"
+		logic_hash = "v1_sha256_aff8456ce7a9ebe875c02e51c09b77ee7b1fddfc11d4ad236e12c8c5240a01a8"
 		score = 75
 		quality = 78
 		tags = "FILE"
@@ -126262,20 +126395,20 @@ rule ESET_Apt_Windows_Invisimole_C2 : FILE
 		$s25 = "update.xn--6frz82g" ascii wide
 
 	condition:
-		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and $s21 and any of them
+		(( uint16( 0 ) == 0x5A4D ) or ESET_Invisimole_Blob_PRIVATE ) and $s21 and any of them
 }
 rule ESET_Onimiki : LINUX_ONIMIKI
 {
 	meta:
 		description = "Linux/Onimiki malicious DNS server"
 		author = "Olivier Bilodeau <bilodeau@eset.com>"
-		id = "3a99799f-fbb4-5fee-a796-3310acd10e17"
+		id = "c005baad-5bec-5136-ba66-d3344ae2a564"
 		date = "2014-02-06"
 		modified = "2014-04-04"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/windigo/windigo-onimiki.yar#L32-L59"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "eac30f5c9a9606d1d0e14c55e0532c54976fbb0d2e4f5cd2d9f719b77e07161a"
+		logic_hash = "v1_sha256_eac30f5c9a9606d1d0e14c55e0532c54976fbb0d2e4f5cd2d9f719b77e07161a"
 		score = 75
 		quality = 80
 		tags = "LINUX/ONIMIKI"
@@ -126298,21 +126431,19 @@ rule ESET_Onimiki : LINUX_ONIMIKI
 	condition:
 		all of them
 }
-import "elf"
-
 rule ESET_Helimodproxy
 {
 	meta:
 		description = "HelimodProxy malicious Apache module"
 		author = "ESET, spol. s r.o."
-		id = "8c05bd0b-9645-580c-ac80-58e45b2a8884"
+		id = "ebf3f1f6-8790-53ca-bca5-70d7b2075516"
 		date = "2024-04-27"
 		modified = "2024-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/windigo/helimod.yar#L32-L54"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
-		logic_hash = "9e3d57add1042eff41b42f0c8d46ed37af4092d5af4d4b2088b07992a4649bc2"
+		logic_hash = "v1_sha256_9e3d57add1042eff41b42f0c8d46ed37af4092d5af4d4b2088b07992a4649bc2"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126327,23 +126458,21 @@ rule ESET_Helimodproxy
 		$5 = "pmtad"
 
 	condition:
-		ESET_Apachemodule_PRIVATE and ($1 or ($2 and $3) or ($4 and $5))
+		ESET_Apachemodule_PRIVATE and ( $1 or ( $2 and $3 ) or ( $4 and $5 ) )
 }
-import "elf"
-
 rule ESET_Helimodredirect
 {
 	meta:
 		description = "HelimodRedirect malicious Apache module"
 		author = "ESET, spol. s r.o."
-		id = "d8fe674d-8895-5501-b2e3-f74c386e10f0"
+		id = "c19619a0-b541-5ebe-ab92-bc7f07bbf7ac"
 		date = "2024-04-27"
 		modified = "2024-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/windigo/helimod.yar#L56-L79"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
-		logic_hash = "1a85cae7ee354e5d96e88781b4e0a49757016d8b64dfb80c07a13b36bf9091e2"
+		logic_hash = "v1_sha256_1a85cae7ee354e5d96e88781b4e0a49757016d8b64dfb80c07a13b36bf9091e2"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126358,23 +126487,21 @@ rule ESET_Helimodredirect
 		$r2 = "REDIRECT_URL"
 
 	condition:
-		ESET_Apachemodule_PRIVATE and any of ($h*) and any of ($r*)
+		ESET_Apachemodule_PRIVATE and any of ( $h* ) and any of ( $r* )
 }
-import "elf"
-
 rule ESET_Helimodsteal
 {
 	meta:
 		description = "HelimodSteal malicious Apache module"
 		author = "ESET, spol. s r.o."
-		id = "7b080f21-d6e3-5dda-bfd9-fb9d82fbb98e"
+		id = "686daa28-449a-5fe0-8f80-e2345e5f6f65"
 		date = "2024-04-27"
 		modified = "2024-04-27"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/windigo/helimod.yar#L81-L105"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
-		logic_hash = "9c0a5842dc986fec667fc7d7ad9d0c63b89b4a5ec87c9c9b72574ca5b15df928"
+		logic_hash = "v1_sha256_9c0a5842dc986fec667fc7d7ad9d0c63b89b4a5ec87c9c9b72574ca5b15df928"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126390,7 +126517,7 @@ rule ESET_Helimodsteal
 		$s3 = "POST /"
 
 	condition:
-		ESET_Apachemodule_PRIVATE and any of ($h*) and any of ($s*)
+		ESET_Apachemodule_PRIVATE and any of ( $h* ) and any of ( $s* )
 }
 import "elf"
 
@@ -126399,14 +126526,14 @@ rule ESET_Libkeyutils_With_Ctor
 	meta:
 		description = "This rule detects if a libkeyutils.so shared library has a potentially malicious function to be called when loaded, either via a glibc constructor (DT_INIT + .ctors) or an initializer function in DT_INIT_ARRAY."
 		author = "ESET, spol. s r.o."
-		id = "7b466bf7-f895-569d-99b0-eca95a6ebc83"
+		id = "edd3daae-1d1e-5684-8fc7-18a8030728f9"
 		date = "2024-02-01"
 		modified = "2024-04-29"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/windigo/ebury.yar#L3-L54"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "e7debd6e453192ad8376db5bab03ed0d87566591"
-		logic_hash = "c6172aebc67a05fb044b0450aafcc71c7d1fd2831985587d1a9ad53f59e14214"
+		logic_hash = "v1_sha256_c6172aebc67a05fb044b0450aafcc71c7d1fd2831985587d1a9ad53f59e14214"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126417,23 +126544,21 @@ rule ESET_Libkeyutils_With_Ctor
 		$libname = "libkeyutils.so.1"
 
 	condition:
-		for any ptr_size in (4,8) : (((ptr_size==4 and elf.machine==elf.EM_386) or (ptr_size==8 and elf.machine==elf.EM_X86_64)) and for any d in elf.dynamic : (d.type==elf.DT_SONAME and ( for any s in elf.sections : (s.name==".dynstr" and $libname at (s.offset+d.val)) or for any s in elf.dynamic : (s.type==elf.DT_STRTAB and $libname at (s.val+d.val)))) and ( for any s in elf.sections : (s.name==".ctors" and s.size>2*ptr_size) or for any d in elf.dynamic : (d.type==elf.DT_INIT_ARRAYSZ and d.val>ptr_size)))
+		for any ptr_size in ( 4 , 8 ) : ( ( ( ptr_size == 4 and elf.machine == elf.EM_386 ) or ( ptr_size == 8 and elf.machine == elf.EM_X86_64 ) ) and for any d in elf.dynamic : ( d.type == elf.DT_SONAME and ( for any s in elf.sections : ( s.name == ".dynstr" and $libname at ( s.offset + d.val ) ) or for any s in elf.dynamic : ( s.type == elf.DT_STRTAB and $libname at ( s.val + d.val ) ) ) ) and ( for any s in elf.sections : ( s.name == ".ctors" and s.size > 2 * ptr_size ) or for any d in elf.dynamic : ( d.type == elf.DT_INIT_ARRAYSZ and d.val > ptr_size ) ) )
 }
-import "elf"
-
 rule ESET_Ebury_V1_7_Crypto
 {
 	meta:
 		description = "This rule detects the strings decryption routine in Ebury v1.7 and v1.8"
 		author = "ESET, spol. s r.o."
-		id = "93dadf5f-b572-5217-8c82-4957c6d24955"
+		id = "df629161-4051-56cd-9273-3dc669265b7c"
 		date = "2023-08-01"
 		modified = "2024-04-29"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/windigo/ebury.yar#L56-L97"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
 		hash = "e7debd6e453192ad8376db5bab03ed0d87566591"
-		logic_hash = "41908951069a472d7528f2f228f3681f008d16a0436e341d339909efc4933e66"
+		logic_hash = "v1_sha256_41908951069a472d7528f2f228f3681f008d16a0436e341d339909efc4933e66"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126472,13 +126597,13 @@ rule ESET_Mozi_Killswitch : FILE
 	meta:
 		description = "Mozi botnet kill switch"
 		author = "Ivan Besina"
-		id = "e3d34ae0-de06-5ff4-b44b-44d264b6dd29"
+		id = "13bc2685-367c-5176-a71a-db3081cf9d5e"
 		date = "2023-09-29"
 		modified = "2023-10-31"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/mozi/mozi.yar#L32-L51"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "90eaed2f7f5595b145b2678a46ef6179082192215369fa9235024b0ce1574a49"
+		logic_hash = "v1_sha256_90eaed2f7f5595b145b2678a46ef6179082192215369fa9235024b0ce1574a49"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -126492,20 +126617,20 @@ rule ESET_Mozi_Killswitch : FILE
 		$networks = "/usr/networks"
 
 	condition:
-		all of them and filesize <500KB
+		all of them and filesize < 500KB
 }
 rule ESET_Keydnap_Downloader
 {
 	meta:
 		description = "OSX/Keydnap Downloader"
 		author = "Marc-Etienne M.Léveillé"
-		id = "2b21007a-b143-5538-8777-ba35448d00aa"
+		id = "34485838-a8c7-5f84-83dc-3b5fe2962dae"
 		date = "2016-07-06"
 		modified = "2016-07-06"
 		reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/keydnap/keydnap.yar#L33-L49"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "71c8885193a92fa9c71055c37e629a54d50070cf6820b9216a824ecc4db2ce3c"
+		logic_hash = "v1_sha256_71c8885193a92fa9c71055c37e629a54d50070cf6820b9216a824ecc4db2ce3c"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126524,13 +126649,13 @@ rule ESET_Keydnap_Backdoor_Packer
 	meta:
 		description = "OSX/Keydnap packed backdoor"
 		author = "Marc-Etienne M.Léveillé"
-		id = "f29ad5af-bc86-5764-9451-5a8363788c4e"
+		id = "6ea75f11-d2a8-5771-b1b3-5da958746078"
 		date = "2016-07-06"
 		modified = "2016-07-06"
 		reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/keydnap/keydnap.yar#L51-L67"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "b1740bf38376be81d3b42306c2ce81f578c0b5c9db804f063836bf98f57ed147"
+		logic_hash = "v1_sha256_b1740bf38376be81d3b42306c2ce81f578c0b5c9db804f063836bf98f57ed147"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126549,13 +126674,13 @@ rule ESET_Keydnap_Backdoor
 	meta:
 		description = "Unpacked OSX/Keydnap backdoor"
 		author = "Marc-Etienne M.Léveillé"
-		id = "099c1796-6237-5ec1-ba25-cd5feca79865"
+		id = "ca0cb509-24bf-5d45-a9ee-fd5ac5746a9d"
 		date = "2016-07-06"
 		modified = "2016-07-06"
 		reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/keydnap/keydnap.yar#L69-L86"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "fa209577a562ef9088d3ad3df3fbc0edda96f09d19177842f0ddea42c658f530"
+		logic_hash = "v1_sha256_fa209577a562ef9088d3ad3df3fbc0edda96f09d19177842f0ddea42c658f530"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126576,13 +126701,13 @@ rule ESET_Linux_Rakos
 	meta:
 		description = "Linux/Rakos.A executable"
 		author = "Peter Kálnai"
-		id = "3c15401a-22c1-59e2-a979-1f9a6a990ae0"
+		id = "05ccf096-cd01-5d82-8a8a-86ce09677e48"
 		date = "2016-12-13"
 		modified = "2016-12-19"
 		reference = "http://www.welivesecurity.com/2016/12/20/new-linuxrakos-threat-devices-servers-ssh-scan/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/rakos/rakos.yar#L33-L53"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "79a02ada56bf75c5f178b58822eb905977cace3483453ea8cf4dfc32f6b6c30d"
+		logic_hash = "v1_sha256_79a02ada56bf75c5f178b58822eb905977cace3483453ea8cf4dfc32f6b6c30d"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126604,13 +126729,13 @@ rule ESET_Mumblehard_Packer
 	meta:
 		description = "Mumblehard i386 assembly code responsible for decrypting Perl code"
 		author = "Marc-Etienne M.Léveillé"
-		id = "981c18e3-ac28-54f5-97ab-44b1d12a1389"
+		id = "ec3d1200-9e00-5d1b-8135-904eea70ecbc"
 		date = "2015-04-07"
 		modified = "2015-05-01"
 		reference = "http://www.welivesecurity.com"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/mumblehard/mumblehard_packer.yar#L32-L47"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "a04f50a7054c4ce8ad9be4e7f3373ad4f36eb9443e223601974e852c25603f5f"
+		logic_hash = "v1_sha256_a04f50a7054c4ce8ad9be4e7f3373ad4f36eb9443e223601974e852c25603f5f"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126629,13 +126754,13 @@ rule ESET_Kobalos
 	meta:
 		description = "Kobalos malware"
 		author = "Marc-Etienne M.Léveillé"
-		id = "cdffbe3d-c19d-53a8-9051-48affae00c8a"
+		id = "dfc3a318-690f-5ed2-86a1-57b7dc428e32"
 		date = "2020-11-02"
 		modified = "2021-02-01"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/kobalos/kobalos.yar#L32-L56"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "9161d22f9fbb1700dc3121e32104240e34512cb280aaf950aec61513f89061ef"
+		logic_hash = "v1_sha256_9161d22f9fbb1700dc3121e32104240e34512cb280aaf950aec61513f89061ef"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126661,13 +126786,13 @@ rule ESET_Kobalos_Ssh_Credential_Stealer
 	meta:
 		description = "Kobalos SSH credential stealer seen in OpenSSH client"
 		author = "Marc-Etienne M.Léveillé"
-		id = "b1fc5163-de48-57fc-8ae7-1f2be6c64d8a"
+		id = "dd64875b-5ef8-54c6-8b82-c4fad7bf95f0"
 		date = "2020-11-02"
 		modified = "2021-02-01"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/kobalos/kobalos.yar#L58-L73"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "be238f5c2cc976a5638584a8c0fc580f2076735aadfe374e8d4162ba723bce10"
+		logic_hash = "v1_sha256_be238f5c2cc976a5638584a8c0fc580f2076735aadfe374e8d4162ba723bce10"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126680,20 +126805,18 @@ rule ESET_Kobalos_Ssh_Credential_Stealer
 	condition:
 		any of them
 }
-import "pe"
-
 rule ESET_Generic_Carbon : FILE
 {
 	meta:
 		description = "Turla Carbon malware"
 		author = "ESET Research"
-		id = "efdc0d16-a974-5c00-a401-391d60f3081e"
+		id = "d5a31151-84f8-5ad4-b61f-608c185b6c85"
 		date = "2017-03-30"
 		modified = "2017-03-30"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/carbon.yar#L33-L51"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "6481ccafb7c7c78bc52d01881cb96f3aa6209fdd35e090bdc9d5f5105b4e38ea"
+		logic_hash = "v1_sha256_6481ccafb7c7c78bc52d01881cb96f3aa6209fdd35e090bdc9d5f5105b4e38ea"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -126706,7 +126829,7 @@ rule ESET_Generic_Carbon : FILE
 		$t2 = "STOP|KILL"
 
 	condition:
-		( uint16(0)==0x5a4d) and (1 of ($s*)) and (1 of ($t*))
+		( uint16( 0 ) == 0x5a4d ) and ( 1 of ( $s* ) ) and ( 1 of ( $t* ) )
 }
 import "pe"
 
@@ -126715,13 +126838,13 @@ rule ESET_Carbon_Metadata
 	meta:
 		description = "Turla Carbon malware"
 		author = "ESET Research"
-		id = "976b6a7d-00bf-5d0f-baf9-84fc5dbd21a2"
+		id = "fcad3fdb-e0ef-52ca-838c-117abe6e7e41"
 		date = "2017-03-30"
 		modified = "2017-03-30"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/carbon.yar#L53-L69"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "81b59e9566f3b3356acf12dadb80abdcbee28e0b1a9efead66fcb95bf6fc1aa5"
+		logic_hash = "v1_sha256_81b59e9566f3b3356acf12dadb80abdcbee28e0b1a9efead66fcb95bf6fc1aa5"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126729,22 +126852,20 @@ rule ESET_Carbon_Metadata
 		license = "BSD 2-Clause"
 
 	condition:
-		(pe.version_info["InternalName"] contains "SERVICE.EXE" or pe.version_info["InternalName"] contains "MSIMGHLP.DLL" or pe.version_info["InternalName"] contains "MSXIML.DLL") and pe.version_info["CompanyName"] contains "Microsoft Corporation"
+		(pe.version_info [ "InternalName" ] contains "SERVICE.EXE" or pe.version_info [ "InternalName" ] contains "MSIMGHLP.DLL" or pe.version_info [ "InternalName" ] contains "MSXIML.DLL" ) and pe.version_info [ "CompanyName" ] contains "Microsoft Corporation"
 }
-import "pe"
-
 rule ESET_Turla_Outlook_Gen
 {
 	meta:
 		description = "Turla Outlook malware"
 		author = "ESET Research"
-		id = "efef2443-c941-54c2-abfa-bbe29c53d930"
+		id = "f7c7b0e5-e741-535f-93d2-66b5ff1121c2"
 		date = "2018-05-09"
 		modified = "2018-09-05"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/turla-outlook.yar#L42-L74"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "f709e517e9d957775601670c426cc9def1c4104cb1ff647d269800d2af4372c7"
+		logic_hash = "v1_sha256_f709e517e9d957775601670c426cc9def1c4104cb1ff647d269800d2af4372c7"
 		score = 75
 		quality = 78
 		tags = ""
@@ -126776,20 +126897,18 @@ rule ESET_Turla_Outlook_Gen
 	condition:
 		ESET_Not_Ms_PRIVATE and 5 of them
 }
-import "pe"
-
 rule ESET_Turla_Outlook_Filenames
 {
 	meta:
 		description = "Turla Outlook filenames"
 		author = "ESET Research"
-		id = "3a08003d-50d6-5fdf-9f74-222335ebfa3e"
+		id = "66a31c76-aa67-5040-be48-75beb47fbc61"
 		date = "2018-08-22"
 		modified = "2018-09-05"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/turla-outlook.yar#L76-L91"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "3be86c9325de6634c032321beed131fdf1e1952afcb43258fb202d0097610501"
+		logic_hash = "v1_sha256_3be86c9325de6634c032321beed131fdf1e1952afcb43258fb202d0097610501"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126804,20 +126923,18 @@ rule ESET_Turla_Outlook_Filenames
 	condition:
 		any of them
 }
-import "pe"
-
 rule ESET_Turla_Outlook_Log
 {
 	meta:
 		description = "First bytes of the encrypted Turla Outlook logs"
 		author = "ESET Research"
-		id = "b0031c08-8418-5a02-8a2c-daa7236f46f0"
+		id = "8dfa0ef7-59d2-5e28-9bc8-6b17d972ef67"
 		date = "2018-08-22"
 		modified = "2018-09-05"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/turla-outlook.yar#L93-L107"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "e7dc00c33a643c0940aaea2096d099192b27df3c81c518f1dc2b3d45a0a74312"
+		logic_hash = "v1_sha256_e7dc00c33a643c0940aaea2096d099192b27df3c81c518f1dc2b3d45a0a74312"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126837,13 +126954,13 @@ rule ESET_Turla_Outlook_Exports
 	meta:
 		description = "Export names of Turla Outlook Malware"
 		author = "ESET Research"
-		id = "6df4f75e-711a-539d-94bf-9e4e2063ecd4"
+		id = "a45588d9-5280-5194-949a-857aa4467a60"
 		date = "2018-08-22"
 		modified = "2018-09-05"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/turla-outlook.yar#L109-L125"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "a961fdb43ea1e99b308f55b8f5e264b1f3fa817eaf463d512e2ad8b98a18ee99"
+		logic_hash = "v1_sha256_a961fdb43ea1e99b308f55b8f5e264b1f3fa817eaf463d512e2ad8b98a18ee99"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126851,7 +126968,7 @@ rule ESET_Turla_Outlook_Exports
 		license = "BSD 2-Clause"
 
 	condition:
-		(pe.exports("install") or pe.exports("Install")) and pe.exports("TBP_Initialize") and pe.exports("TBP_Finalize") and pe.exports("TBP_GetName") and pe.exports("DllRegisterServer") and pe.exports("DllGetClassObject")
+		(pe.exports ( "install" ) or pe.exports ( "Install" ) ) and pe.exports ( "TBP_Initialize" ) and pe.exports ( "TBP_Finalize" ) and pe.exports ( "TBP_GetName" ) and pe.exports ( "DllRegisterServer" ) and pe.exports ( "DllGetClassObject" )
 }
 import "pe"
 
@@ -126860,13 +126977,13 @@ rule ESET_Gazer_Certificate_Subject
 	meta:
 		description = "Turla Gazer malware"
 		author = "ESET Research"
-		id = "a7719333-b341-538c-a8ed-5c50b653a765"
+		id = "b3bd1c45-c002-5ec6-b238-b2c01602501a"
 		date = "2017-08-30"
 		modified = "2017-08-29"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/gazer.yar#L33-L46"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "6e870c9cdcee33769162de62ea143ff401af50b22a63d2f212c44d06f5771dec"
+		logic_hash = "v1_sha256_6e870c9cdcee33769162de62ea143ff401af50b22a63d2f212c44d06f5771dec"
 		score = 75
 		quality = 80
 		tags = ""
@@ -126874,22 +126991,20 @@ rule ESET_Gazer_Certificate_Subject
 		license = "BSD 2-Clause"
 
 	condition:
-		for any i in (0..pe.number_of_signatures-1) : (pe.signatures[i].subject contains "Solid Loop" or pe.signatures[i].subject contains "Ultimate Computer Support")
+		for any i in ( 0 .. pe.number_of_signatures - 1 ) : ( pe.signatures [ i ] . subject contains "Solid Loop" or pe.signatures [ i ] . subject contains "Ultimate Computer Support" )
 }
-import "pe"
-
 rule ESET_Gazer_Certificate : FILE
 {
 	meta:
 		description = "Turla Gazer malware"
 		author = "ESET Research"
-		id = "e90bbe53-4e7f-59c4-a505-4893150bf824"
+		id = "9f9e4e3c-f495-51f6-b9de-59040fad66af"
 		date = "2017-08-30"
 		modified = "2017-08-29"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/gazer.yar#L48-L65"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "eb3afbaefd23d4fc6ded494d3378dc910a0832b160e733ab79c590128dd74cea"
+		logic_hash = "v1_sha256_eb3afbaefd23d4fc6ded494d3378dc910a0832b160e733ab79c590128dd74cea"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -126901,22 +127016,20 @@ rule ESET_Gazer_Certificate : FILE
 		$certif2 = {12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c}
 
 	condition:
-		( uint16(0)==0x5a4d) and 1 of them and filesize <2MB
+		( uint16( 0 ) == 0x5a4d ) and 1 of them and filesize < 2MB
 }
-import "pe"
-
 rule ESET_Gazer_Logfile_Name : FILE
 {
 	meta:
 		description = "Turla Gazer malware"
 		author = "ESET Research"
-		id = "3e1454e9-dddf-5197-b486-b96d725fdb58"
+		id = "c049ecd5-91ee-5342-83fd-bc6ae022818e"
 		date = "2017-08-30"
 		modified = "2017-08-29"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/turla/gazer.yar#L67-L85"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "b50553f4b4b07f124e5bd390e7dc8ac6b60a8ef185f3bc227894f957d6483478"
+		logic_hash = "v1_sha256_b50553f4b4b07f124e5bd390e7dc8ac6b60a8ef185f3bc227894f957d6483478"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -126929,20 +127042,20 @@ rule ESET_Gazer_Logfile_Name : FILE
 		$s3 = "CVRG38D9.tmp.cvr"
 
 	condition:
-		( uint16(0)==0x5a4d) and 1 of them
+		( uint16( 0 ) == 0x5a4d ) and 1 of them
 }
 rule ESET_Moose_1
 {
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "4d228de6-ddbf-57c0-a330-5840c4d40dfc"
+		id = "3b0dba8a-984c-5c2c-80c7-c285baa45207"
 		date = "2015-04-21"
 		modified = "2016-11-01"
 		reference = "https://github.com/eset/malware-ioc/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/moose/linux-moose.yar#L41-L76"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "8bedac80a1f754ce56294ba9786b62a002aacd074f756724401efc61def127e6"
+		logic_hash = "v1_sha256_8bedac80a1f754ce56294ba9786b62a002aacd074f756724401efc61def127e6"
 		score = 75
 		quality = 30
 		tags = ""
@@ -126981,13 +127094,13 @@ rule ESET_Moose_2
 	meta:
 		description = "No description has been set in the source file - ESET"
 		author = "ESET TI"
-		id = "74372984-dace-5665-a5d0-39b8d1002fa1"
+		id = "827f0e54-94ff-57fd-a5b4-2718197b2169"
 		date = "2016-10-02"
 		modified = "2016-11-01"
 		reference = "http://www.welivesecurity.com/2016/11/02/linuxmoose-still-breathing/"
 		source_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/moose/linux-moose.yar#L78-L110"
 		license_url = "https://github.com/eset/malware-ioc/blob/9431ee8ccf63b1c014bfaa5f1a28dc747772d28d/LICENSE"
-		logic_hash = "3f50d2d81d4c27e44d93804adcf93971017767ed0e020447cdb343931c2fbc43"
+		logic_hash = "v1_sha256_3f50d2d81d4c27e44d93804adcf93971017767ed0e020447cdb343931c2fbc43"
 		score = 75
 		quality = 80
 		tags = ""
@@ -127026,7 +127139,7 @@ rule ESET_Sparklinggoblin_Chacha20Loader_Richheader
 	meta:
 		description = "Rule matching ChaCha20 loaders rich header"
 		author = "ESET Research"
-		id = "e1dac369-f25e-5cb3-aafa-b0c45f05b295"
+		id = "a9e164e9-7295-5ea0-b807-71d4a8d374d2"
 		date = "2021-03-30"
 		modified = "2021-08-26"
 		reference = "https://github.com/eset/malware-ioc/"
@@ -127039,23 +127152,21 @@ rule ESET_Sparklinggoblin_Chacha20Loader_Richheader
 		hash = "4cec7cdc78d95c70555a153963064f216dae8799"
 		hash = "4d4c1a062a0390b20732ba4d65317827f2339b80"
 		hash = "4f6949a4906b834e83ff951e135e0850fe49d5e4"
-		logic_hash = "a5c9595036dec0e0aef0a030c590189752217d15d3f53bf3dc537f5b43fae63e"
+		logic_hash = "v1_sha256_a5c9595036dec0e0aef0a030c590189752217d15d3f53bf3dc537f5b43fae63e"
 		score = 75
 		quality = 80
 		tags = ""
 		license = "BSD 2-Clause"
 
 	condition:
-		pe.rich_signature.length>=104 and pe.rich_signature.length<=112 and pe.rich_signature.toolid(241,40116)>=5 and pe.rich_signature.toolid(241,40116)<=10 and pe.rich_signature.toolid(147,30729)==11 and pe.rich_signature.toolid(264,24215)>=15 and pe.rich_signature.toolid(264,24215)<=16
+		pe.rich_signature.length>= 104 and pe.rich_signature.length <= 112 and pe.rich_signature.toolid ( 241 , 40116 ) >= 5 and pe.rich_signature.toolid ( 241 , 40116 ) <= 10 and pe.rich_signature.toolid ( 147 , 30729 ) == 11 and pe.rich_signature.toolid ( 264 , 24215 ) >= 15 and pe.rich_signature.toolid ( 264 , 24215 ) <= 16
 }
-import "pe"
-
 rule ESET_Sparklinggoblin_Chacha20 : FILE
 {
 	meta:
 		description = "SparklingGoblin ChaCha20 implementations"
 		author = "ESET Research"
-		id = "c0caceca-f685-5786-82f6-3ab7435f8061"
+		id = "ad70c9c3-2b57-53e8-ae7d-913e8f574f6a"
 		date = "2021-05-20"
 		modified = "2021-08-26"
 		reference = "https://github.com/eset/malware-ioc/"
@@ -127068,7 +127179,7 @@ rule ESET_Sparklinggoblin_Chacha20 : FILE
 		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
 		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
 		hash = "91b32e030a1f286e7d502ca17e107d4bfbd7394a"
-		logic_hash = "b742bc22e0ebbce40607cb109b4d6fb03a40c1fb223c8092d93346dd3dd22789"
+		logic_hash = "v1_sha256_b742bc22e0ebbce40607cb109b4d6fb03a40c1fb223c8092d93346dd3dd22789"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -127359,16 +127470,14 @@ rule ESET_Sparklinggoblin_Chacha20 : FILE
         }
 
 	condition:
-		any of them and filesize <450KB
+		any of them and filesize < 450KB
 }
-import "pe"
-
 rule ESET_Sparklinggoblin_Etweventwrite
 {
 	meta:
 		description = "SparklingGoblin EtwEventWrite patching"
 		author = "ESET Research"
-		id = "27b36ee1-a98c-5174-a156-8e0b0d0a58cd"
+		id = "a1c5685a-f41f-5258-82cf-962e446d93ae"
 		date = "2021-05-20"
 		modified = "2021-08-26"
 		reference = "https://github.com/eset/malware-ioc/"
@@ -127380,7 +127489,7 @@ rule ESET_Sparklinggoblin_Etweventwrite
 		hash = "4668302969fe122874fb2447a80378dcb671c86b"
 		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
 		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
-		logic_hash = "45615dcc5302392c18052818071623a9d1a1008c460bdb24a4acfb4300356c6b"
+		logic_hash = "v1_sha256_45615dcc5302392c18052818071623a9d1a1008c460bdb24a4acfb4300356c6b"
 		score = 75
 		quality = 80
 		tags = ""
@@ -127459,14 +127568,12 @@ rule ESET_Sparklinggoblin_Etweventwrite
 	condition:
 		any of them
 }
-import "pe"
-
 rule ESET_Sparklinggoblin_Mutex
 {
 	meta:
 		description = "SparklingGoblin ChaCha20 loaders mutexes"
 		author = "ESET Research"
-		id = "e33d2bc1-29d6-5117-8e0f-31f8bced0979"
+		id = "bf6e1bd3-90c2-5a78-a06f-eefb2a07b333"
 		date = "2021-05-20"
 		modified = "2021-08-26"
 		reference = "https://github.com/eset/malware-ioc/"
@@ -127478,7 +127585,7 @@ rule ESET_Sparklinggoblin_Mutex
 		hash = "4668302969fe122874fb2447a80378dcb671c86b"
 		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
 		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
-		logic_hash = "00fbd514c8e2d6dea3b0f175e857a613e158b64caf1f970e814d62f1ebe9d35c"
+		logic_hash = "v1_sha256_00fbd514c8e2d6dea3b0f175e857a613e158b64caf1f970e814d62f1ebe9d35c"
 		score = 75
 		quality = 80
 		tags = ""
@@ -127495,9 +127602,9 @@ rule ESET_Sparklinggoblin_Mutex
  * YARA Rule Set
  * Repository Name: FireEye-RT
  * Repository: https://github.com/mandiant/red_team_tool_countermeasures/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 3561b71724dbfa3e2bb78106aaa2d7f8b892c43b
- * Number of Rules: 168
+ * Number of Rules: 167
  * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
  *
  *
@@ -127534,14 +127641,14 @@ rule FIREEYE_RT_Hacktool_MSIL_Keefarce_1 : FILE
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeeFarce' project."
 		author = "FireEye"
-		id = "c17add0c-e09f-5ced-a4e1-bf60afad4725"
+		id = "01772245-e359-58b7-9628-e72e56a2d614"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEFARCE/production/yara/HackTool_MSIL_KeeFarce_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "8db86230849137608880dbe448737fc70068d308772e294cc69301b18ae10908"
+		logic_hash = "v1_sha256_8db86230849137608880dbe448737fc70068d308772e294cc69301b18ae10908"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -127551,21 +127658,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Keefarce_1 : FILE
 		$typelibguid0 = "17589ea6-fcc9-44bb-92ad-d5b3eea6af03" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_DTRIM_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'dtrim' project, which is a modified version of SharpSploit."
 		author = "FireEye"
-		id = "9be695a1-6d18-5952-974c-96a30f035e7a"
+		id = "17e3f523-e055-5178-a605-93b34566773e"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DTRIM/production/yara/APT_HackTool_MSIL_DTRIM_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "357c1f76631ec9ee342995cd12369fd9ff18c541bffe6f5464b1e8db45057196"
+		logic_hash = "v1_sha256_357c1f76631ec9ee342995cd12369fd9ff18c541bffe6f5464b1e8db45057196"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -127575,14 +127682,14 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_DTRIM_1 : FILE
 		$typelibguid0 = "7760248f-9247-4206-be42-a6952aa46da2" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_1
 {
 	meta:
 		description = "smbexec"
 		author = "FireEye"
-		id = "992d1132-3136-5e1b-a1ef-dcdf36ebf0f5"
+		id = "77ee7007-3208-587b-b111-8890185af1e1"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -127590,7 +127697,7 @@ rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_1
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/IMPACKETOBF (Smbexec)/production/yara/HackTool_PY_ImpacketObfuscation_1.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "0b1e512afe24c31531d6db6b47bac8ee"
-		logic_hash = "45a4c0426b29b8c8bede9c4e8292131da7e756d48fc3ac4a07d08fd52383d21e"
+		logic_hash = "v1_sha256_45a4c0426b29b8c8bede9c4e8292131da7e756d48fc3ac4a07d08fd52383d21e"
 		score = 75
 		quality = 75
 		tags = ""
@@ -127612,14 +127719,14 @@ rule FIREEYE_RT_Tool_MSIL_Sharpgrep_1 : FILE
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGrep' project."
 		author = "FireEye"
-		id = "c7569d33-f57d-5f9c-aa2a-78866c680b5b"
+		id = "685be367-29e6-5597-8bc5-0596cfccaad2"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPPGREP/production/yara/Tool_MSIL_SharpGrep_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "c22bfc50b3ab3c4082006aad3c3c89684cffe1e429b001b0bb08758856a47d04"
+		logic_hash = "v1_sha256_c22bfc50b3ab3c4082006aad3c3c89684cffe1e429b001b0bb08758856a47d04"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -127629,21 +127736,21 @@ rule FIREEYE_RT_Tool_MSIL_Sharpgrep_1 : FILE
 		$typelibguid0 = "f65d75b5-a2a6-488f-b745-e67fc075f445" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Builder_MSIL_Sharpgenerator_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project."
 		author = "FireEye"
-		id = "ab661cba-f695-59d2-9071-9b9a90233457"
+		id = "848bcf14-f7b8-50e3-aa3b-76bd4550e016"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPGENERATOR/production/yara/Builder_MSIL_SharpGenerator_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "6dc0780e54d33df733aadc8a89077232baa63bf1cbe47c5d164c57ce3185dd71"
+		logic_hash = "v1_sha256_6dc0780e54d33df733aadc8a89077232baa63bf1cbe47c5d164c57ce3185dd71"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -127653,21 +127760,21 @@ rule FIREEYE_RT_Builder_MSIL_Sharpgenerator_1 : FILE
 		$typelibguid0 = "3f450977-d796-4016-bb78-c9e91c6a0f08" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_INVEIGHZERO_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'inveighzero' project."
 		author = "FireEye"
-		id = "f46fe365-ea50-5597-828e-61a7225e4c6e"
+		id = "30d562f5-04a7-5b2e-9900-30c32ce7b5cd"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/INVEIGHZERO/production/yara/HackTool_MSIL_INVEIGHZERO_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "5d10557a83dae9508469fe87f4c0c91beec4d2812856eee461a82d5dbb89aa35"
+		logic_hash = "v1_sha256_5d10557a83dae9508469fe87f4c0c91beec4d2812856eee461a82d5dbb89aa35"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -127677,21 +127784,21 @@ rule FIREEYE_RT_Hacktool_MSIL_INVEIGHZERO_1 : FILE
 		$typelibguid0 = "113ae281-d1e5-42e7-9cc2-12d30757baf1" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Rubeus_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project."
 		author = "FireEye"
-		id = "0ca140ea-2b9f-5904-a4c0-8615229626f0"
+		id = "c769be4d-c991-59a4-9a4a-17c0fb72d7bd"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/RUBEUS/production/yara/HackTool_MSIL_Rubeus_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "66e0681a500c726ed52e5ea9423d2654"
-		logic_hash = "ad954f9922ab564d68cb4515b080f6ee69476a8d87f0038e2ae4c222f0e182d7"
+		logic_hash = "v1_sha256_ad954f9922ab564d68cb4515b080f6ee69476a8d87f0038e2ae4c222f0e182d7"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -127701,21 +127808,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Rubeus_1 : FILE
 		$typelibguid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5A4D and $typelibguid
+		uint16( 0 ) == 0x5A4D and $typelibguid
 }
 rule FIREEYE_RT_APT_Loader_Win_PGF_1 : FILE
 {
 	meta:
 		description = "PDB string used in some PGF DLL samples"
 		author = "FireEye"
-		id = "14e2102c-3572-5314-999c-ff3f6c94de03"
+		id = "b552aaef-216d-5d4e-9864-fada36d5ffd6"
 		date = "2024-03-04"
 		modified = "2024-03-04"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "013c7708f1343d684e3571453261b586"
-		logic_hash = "9dede268d33a38e980026917bd01bc47a72bfe60ba4a999c91eb727a2f377462"
+		logic_hash = "v1_sha256_9dede268d33a38e980026917bd01bc47a72bfe60ba4a999c91eb727a2f377462"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -127727,14 +127834,14 @@ rule FIREEYE_RT_APT_Loader_Win_PGF_1 : FILE
 		$pdb3 = /RSDS[\x00-\xFF]{20}q:\\objchk_win7_amd64\\amd64\\init\.pdb\x00/ nocase
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and filesize <15MB and any of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 15MB and any of them
 }
 rule FIREEYE_RT_APT_Loader_MSIL_PGF_1 : FILE
 {
 	meta:
 		description = "base.cs"
 		author = "FireEye"
-		id = "39d9821f-86e8-528a-a0a9-287dbe325484"
+		id = "8ab84f6f-a356-5328-9bb7-45e955d62542"
 		date = "2020-11-24"
 		date = "2020-11-24"
 		modified = "2020-12-09"
@@ -127742,7 +127849,7 @@ rule FIREEYE_RT_APT_Loader_MSIL_PGF_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_MSIL_PGF_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "a495c6d11ff3f525915345fb762f8047"
-		logic_hash = "4174ed53336f3951d26282dc81b99b2044ac6350d4b4c0074194a9b4acecefee"
+		logic_hash = "v1_sha256_4174ed53336f3951d26282dc81b99b2044ac6350d4b4c0074194a9b4acecefee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127752,14 +127859,14 @@ rule FIREEYE_RT_APT_Loader_MSIL_PGF_1 : FILE
 		$sb1 = { 72 [4] 6F [2] 00 0A 26 [0-16] 0? 6F [2] 00 0A [1-3] 0? 28 [2] 00 0A [0-1] 0? 72 [4-5] 0? 28 [2] 00 0A [0-1] 0? 6F [2] 00 0A 13 ?? 1? 13 ?? 38 [8-16] 91 [3-6] 8E 6? 5D 91 61 D2 9C 11 ?? 1? 58 13 [3-5] 8E 6? 3F }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win64_PGF_1 : FILE
 {
 	meta:
 		description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
 		author = "FireEye"
-		id = "1f2280c0-0fdd-5930-947a-931274bccd6f"
+		id = "b0a37b7e-3375-5859-81fd-7064a72bbbf5"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -127767,7 +127874,7 @@ rule FIREEYE_RT_APT_Loader_Win64_PGF_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_1.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "2b686a8b83f8e1d8b455976ae70dab6e"
-		logic_hash = "2e84d614c34b0b7f93fa70fa3312f22e3ff23f2abd33b2e19c00dd6cba7dcfdc"
+		logic_hash = "v1_sha256_2e84d614c34b0b7f93fa70fa3312f22e3ff23f2abd33b2e19c00dd6cba7dcfdc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127779,21 +127886,21 @@ rule FIREEYE_RT_APT_Loader_Win64_PGF_1 : FILE
 		$sb3 = { 48 89 4C 24 08 [4-64] 48 63 48 3C [0-32] 48 03 C1 [0-64] 0F B7 48 14 [0-64] 48 8D 44 08 18 [8-64] 0F B7 40 06 [2-32] 48 6B C0 28 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win32_PGF_5 : FILE
 {
 	meta:
 		description = "PGF payload, generated rule based on symfunc/a86b004b5005c0bcdbd48177b5bac7b8"
 		author = "FireEye"
-		id = "376875f3-00f2-58d0-ae22-7f52ea566da2"
+		id = "2e1c119b-be25-540c-8d41-0addd949762e"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_5.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "8c91a27bbdbe9fb0877daccd28bd7bb5"
-		logic_hash = "dfff615a1d329cf181294f7b0a32c11a21d66ff8a6aa6b9fcd183c9738369623"
+		logic_hash = "v1_sha256_dfff615a1d329cf181294f7b0a32c11a21d66ff8a6aa6b9fcd183c9738369623"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127806,21 +127913,21 @@ rule FIREEYE_RT_APT_Loader_Win32_PGF_5 : FILE
 		$cond4 = { 8B FF 55 8B EC 81 EC 3? ?1 ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 E0 56 C7 45 F8 ?? ?? ?? ?? C6 85 D8 FE FF FF ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 D9 FE FF FF 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 F4 ?? ?? ?? ?? C6 45 E7 ?? C7 45 E8 ?? ?? ?? ?? C7 45 EC ?? ?? ?? ?? C7 45 FC ?? ?? ?? ?? C7 45 F? ?? ?? ?? ?0 6A ?? 6A ?? 8D 8D D8 FE FF FF 51 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 F8 6A ?? FF ?? ?? ?? ?? ?? 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 ?? ?? 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF ?? ?? ?? ?? EB ?? 8B 85 D4 FE FF FF 83 C? ?1 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D ?? 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB ?? 8B 55 F8 8B 42 08 89 45 FC 6A ?? 68 ?? ?? ?? ?? 8B 4D FC 51 6A ?? FF ?? ?? ?? ?? ?? 89 45 EC 8B 55 FC 52 8B 45 F8 83 ?? ?? 50 8B 4D EC 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 D0 FE FF FF ?? ?? ?? ?? EB ?? 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 ?? 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE ?? ?? ?? ?? F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB ?? 8B 4D EC 89 4D F0 FF ?? ?? 5E 8B 4D E0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and any of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and any of them
 }
 rule FIREEYE_RT_APT_Loader_Win64_PGF_3 : FILE
 {
 	meta:
 		description = "PGF payload, generated rule based on symfunc/8a2f2236fdfaa3583ab89076025c6269. Identifies dllmain_hook x64 payloads."
 		author = "FireEye"
-		id = "340ea6d4-7111-520c-9bd4-0465a43ea235"
+		id = "76735d69-8d71-5fa1-91c6-1f7d6ee5a2b3"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_3.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "3bb34ebd93b8ab5799f4843e8cc829fa"
-		logic_hash = "fd82bdec54a76eed12cc8820ef39899f31ea6df21d905530a0d53770b3d9901b"
+		logic_hash = "v1_sha256_fd82bdec54a76eed12cc8820ef39899f31ea6df21d905530a0d53770b3d9901b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127833,14 +127940,14 @@ rule FIREEYE_RT_APT_Loader_Win64_PGF_3 : FILE
 		$cond4 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 D3 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 65 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 EC FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AF 96 01 00 48 8D 45 AF 48 89 C1 E8 F3 FE 00 00 48 8B 05 78 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6E B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 B5 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 64 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 5A B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 73 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 45 C8 05 00 48 8B 05 B4 8A 06 00 FF D0 48 8D 15 41 C8 05 00 48 89 C1 48 8B 05 A9 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 6C 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 54 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 33 FA FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 DA F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CE 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 3A FC 00 00 48 89 D8 48 89 C1 E8 4F AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9D 9C 01 00 48 89 D8 48 89 C1 E8 32 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and any of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and any of them
 }
 rule FIREEYE_RT_APT_Loader_Win32_PGF_1 : FILE
 {
 	meta:
 		description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
 		author = "FireEye"
-		id = "1af4f2ce-c540-5836-a749-43a0b08609b1"
+		id = "889ec46c-ff14-589a-90e3-9e0b024660e1"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -127848,7 +127955,7 @@ rule FIREEYE_RT_APT_Loader_Win32_PGF_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_1.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "383161e4deaf7eb2ebeda2c5e9c3204c"
-		logic_hash = "d3fb0bd7b678b19ee2e0e846f4e13e4ce7e2629ecda123f34ef52f2af42d2a8e"
+		logic_hash = "v1_sha256_d3fb0bd7b678b19ee2e0e846f4e13e4ce7e2629ecda123f34ef52f2af42d2a8e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127860,14 +127967,14 @@ rule FIREEYE_RT_APT_Loader_Win32_PGF_1 : FILE
 		$sb3 = { 8B ?? 08 03 ?? 3C [2-32] 0F B? ?? 14 [0-32] 8D [2] 18 [2-64] 0F B? ?? 06 [3-64] 6B ?? 28 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win64_PGF_2 : FILE
 {
 	meta:
 		description = "base dlls: /lib/payload/techniques/dllmain/"
 		author = "FireEye"
-		id = "5253cb2a-28fd-57ab-be3d-f11cf2ea24cf"
+		id = "2904f561-3181-52e2-a4da-f5d67bbfbf7c"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -127875,7 +127982,7 @@ rule FIREEYE_RT_APT_Loader_Win64_PGF_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_2.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4326a7e863928ffbb5f6bdf63bb9126e"
-		logic_hash = "074f6d9ad78ecd4dd8e3d0b5c8b0f61a48374f3935b85c4222305b207b447ec7"
+		logic_hash = "v1_sha256_074f6d9ad78ecd4dd8e3d0b5c8b0f61a48374f3935b85c4222305b207b447ec7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127887,14 +127994,14 @@ rule FIREEYE_RT_APT_Loader_Win64_PGF_2 : FILE
 		$sb3 = { 63 ?? 3C [0-16] 03 [1-32] 0F B? ?? 14 [0-16] 8D ?? 18 [0-16] 03 [1-16] 66 ?? 3B ?? 06 7? [1-64] 48 8D 15 [4-32] FF 15 [4-16] 85 C0 [2-32] 41 0F B? ?? 06 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_MSIL_PGF_2 : FILE
 {
 	meta:
 		description = "base.js, ./lib/payload/techniques/jscriptdotnet/jscriptdotnet_payload.py"
 		author = "FireEye"
-		id = "c5f2ec90-cd9b-53ce-893b-e44192fcd507"
+		id = "c66357f8-0508-5f3c-b3cb-ea61d3a378ef"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -127902,7 +128009,7 @@ rule FIREEYE_RT_APT_Loader_MSIL_PGF_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_MSIL_PGF_2.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "7c2a06ceb29cdb25f24c06f2a8892fba"
-		logic_hash = "b962ea30c063009c0383e25edda3a65202bea4496d0d6228549dcea82bba0d03"
+		logic_hash = "v1_sha256_b962ea30c063009c0383e25edda3a65202bea4496d0d6228549dcea82bba0d03"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127915,14 +128022,14 @@ rule FIREEYE_RT_APT_Loader_MSIL_PGF_2 : FILE
 		$ss3 = "\x00Microsoft.JScript\x00"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win32_PGF_2 : FILE
 {
 	meta:
 		description = "base dlls: /lib/payload/techniques/dllmain/"
 		author = "FireEye"
-		id = "e11a626b-ce91-5f6c-a514-9a8a02a29cbd"
+		id = "b727f6b9-6e76-5560-b346-9b033850123a"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -127930,7 +128037,7 @@ rule FIREEYE_RT_APT_Loader_Win32_PGF_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_2.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "04eb45f8546e052fe348fda2425b058c"
-		logic_hash = "d69f3f31c4964fe933295563e08bdbb36abadd6611541b9ffa55b6829ced1d21"
+		logic_hash = "v1_sha256_d69f3f31c4964fe933295563e08bdbb36abadd6611541b9ffa55b6829ced1d21"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127942,21 +128049,21 @@ rule FIREEYE_RT_APT_Loader_Win32_PGF_2 : FILE
 		$sb3 = { 8B ?? 3C [0-16] 03 [1-64] 0F B? ?? 14 [0-32] 83 ?? 18 [0-32] 66 3? ?? 06 [4-32] 68 [4] 5? FF 15 [4-16] 85 C0 [2-32] 83 ?? 28 0F B? ?? 06 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win64_PGF_5 : FILE
 {
 	meta:
 		description = "PGF payload, generated rule based on symfunc/8167a6d94baca72bac554299d7c7f83c"
 		author = "FireEye"
-		id = "4fa4a1d6-cb63-582d-801c-b4c89c44d9ca"
+		id = "bf7dd05c-9a1b-5688-86e7-6b21014e7e85"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_5.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "150224a0ccabce79f963795bf29ec75b"
-		logic_hash = "16495ad1e5ce4d4a79f4067f3d687911a1a0a3bfe4c6409ff9de4d111b1ddca6"
+		logic_hash = "v1_sha256_16495ad1e5ce4d4a79f4067f3d687911a1a0a3bfe4c6409ff9de4d111b1ddca6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127969,21 +128076,21 @@ rule FIREEYE_RT_APT_Loader_Win64_PGF_5 : FILE
 		$cond4 = { 4C 89 44 24 ?? 89 54 24 ?? 48 89 4C 24 ?? 48 83 EC 38 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? 01 74 ?? EB ?? 48 8B 44 24 ?? 48 89 05 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B8 01 00 00 00 48 83 C4 38 C3 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and any of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and any of them
 }
 rule FIREEYE_RT_APT_Loader_Win32_PGF_3 : FILE
 {
 	meta:
 		description = "PGF payload, generated rule based on symfunc/c02594972dbab6d489b46c5dee059e66. Identifies dllmain_hook x86 payloads."
 		author = "FireEye"
-		id = "adf91482-6e04-5d11-bc00-4b1c7a802c49"
+		id = "2cae5aff-fdae-543b-9973-9758212471f5"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_3.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4414953fa397a41156f6fa4f9462d207"
-		logic_hash = "24d2caad1d740ccbff0cf111a05ecad20ed06f311d530d8de86050d916da32ce"
+		logic_hash = "v1_sha256_24d2caad1d740ccbff0cf111a05ecad20ed06f311d530d8de86050d916da32ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -127998,14 +128105,14 @@ rule FIREEYE_RT_APT_Loader_Win32_PGF_3 : FILE
 		$cond6 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? F0 EF D5 63 C7 85 ?? ?? ?? ?? CC FF D5 63 8D 85 ?? ?? ?? ?? 89 28 BA 28 1B D4 63 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 7E 40 D9 63 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 8A 40 D9 63 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 D4 63 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 D4 63 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and any of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and any of them
 }
 rule FIREEYE_RT_APT_Loader_Win32_PGF_4 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "d46d9ae9-cb7d-5a25-9ee2-766097c14af6"
+		id = "4c2eeca2-9535-52a7-9361-dfd336ba35bb"
 		date = "2020-11-26"
 		date = "2020-11-26"
 		modified = "2020-12-09"
@@ -128013,7 +128120,7 @@ rule FIREEYE_RT_APT_Loader_Win32_PGF_4 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_4.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4414953fa397a41156f6fa4f9462d207"
-		logic_hash = "4256bfd3713f330d76cad9d1ddbba91e588dbca2e2b6842e9482525805ddc1e8"
+		logic_hash = "v1_sha256_4256bfd3713f330d76cad9d1ddbba91e588dbca2e2b6842e9482525805ddc1e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128024,21 +128131,21 @@ rule FIREEYE_RT_APT_Loader_Win32_PGF_4 : FILE
 		$sb2 = { C? 45 ?? B8 [0-4] C? 45 ?? 00 [0-64] FF [0-32] E0 [0-32] C7 44 24 08 40 00 00 00 [0-32] C7 44 24 04 07 00 00 00 [0-32] FF [1-64] 89 ?? 0F B? [2-3] 89 ?? 04 0F B? [2] 88 ?? 06 8B ?? 08 8D ?? 01 8B 45 0C }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win_PGF_2 : FILE
 {
 	meta:
 		description = "PE rich header matches PGF backdoor"
 		author = "FireEye"
-		id = "595c9e2a-3d9d-5366-9449-de1bcf333f78"
+		id = "e76f2d7c-5d2b-5d90-8fb5-2fdd24e265de"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_2.yar#L4-L21"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "226b1ac427eb5a4dc2a00cc72c163214"
-		logic_hash = "b8c024c6b4c3ce9915700b62da8a1f12440215b46f3a56078707f5257e575811"
+		logic_hash = "v1_sha256_b8c024c6b4c3ce9915700b62da8a1f12440215b46f3a56078707f5257e575811"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128054,14 +128161,14 @@ rule FIREEYE_RT_APT_Loader_Win_PGF_2 : FILE
 		$rich4 = { 41 36 64 33 05 57 0A 60 05 57 0A 60 05 57 0A 60 73 CA 71 60 01 57 0A 60 0C 2F 9F 60 04 57 0A 60 0C 2F 89 60 3D 57 0A 60 0C 2F 8E 60 0A 57 0A 60 05 57 0B 60 4A 57 0A 60 0C 2F 99 60 06 57 0A 60 73 CA 67 60 04 57 0A 60 0C 2F 98 60 04 57 0A 60 0C 2F 80 60 04 57 0A 60 22 91 74 60 04 57 0A 60 0C 2F 9B 60 04 57 0A 60 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and filesize <15MB and (($rich1 at 128) or ($rich2 at 128) or ($rich3 at 128) or ($rich4 at 128))
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 15MB and ( ( $rich1 at 128 ) or ( $rich2 at 128 ) or ( $rich3 at 128 ) or ( $rich4 at 128 ) )
 }
 rule FIREEYE_RT_APT_Loader_Win64_PGF_4 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "4c93ba76-d3a5-568d-88b8-79a6ebc2edbb"
+		id = "f6fae86c-36ed-5cac-b2a1-a4bdfd411e31"
 		date = "2020-11-26"
 		date = "2020-11-26"
 		modified = "2020-12-09"
@@ -128069,7 +128176,7 @@ rule FIREEYE_RT_APT_Loader_Win64_PGF_4 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_4.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "3bb34ebd93b8ab5799f4843e8cc829fa"
-		logic_hash = "fcc92674e58ec6418d7c709e3f3bc2e1ec859fe0cb444412964a978fb69f5234"
+		logic_hash = "v1_sha256_fcc92674e58ec6418d7c709e3f3bc2e1ec859fe0cb444412964a978fb69f5234"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128080,21 +128187,21 @@ rule FIREEYE_RT_APT_Loader_Win64_PGF_4 : FILE
 		$sb2 = { C? 45 ?? 48 [0-32] B8 [0-64] FF [0-32] E0 [0-32] 41 B8 40 00 00 00 BA 0C 00 00 00 48 8B [2] 48 8B [2-32] FF [1-16] 48 89 10 8B 55 ?? 89 ?? 08 48 8B [2] 48 8D ?? 02 48 8B 45 18 48 89 02 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_SHARPZEROLOGON_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'sharpzerologon' project."
 		author = "FireEye"
-		id = "51f22eee-fb96-55b0-8c02-1a0e9910a93e"
+		id = "82543a6e-1d68-52db-aa4e-58965d891c56"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPZEROLOGON/production/yara/HackTool_MSIL_SHARPZEROLOGON_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "ed6a9bef5c6ee03aff969b8765b284ace517f2e6a1ef114acb04cf094c69cfa5"
+		logic_hash = "v1_sha256_ed6a9bef5c6ee03aff969b8765b284ace517f2e6a1ef114acb04cf094c69cfa5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -128104,14 +128211,14 @@ rule FIREEYE_RT_Hacktool_MSIL_SHARPZEROLOGON_1 : FILE
 		$typelibguid0 = "15ce9a3c-4609-4184-87b2-e29fc5e2b770" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "c2834bd6-efb0-5dac-adcd-a9450090fc28"
+		id = "c8833af3-335c-5af4-9b27-455b74ab68e7"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -128119,7 +128226,7 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "1c71b9641e30c9764f3503e49f8f85472d7e62384c8dd2b420c4fa2b2fccda4f"
+		logic_hash = "v1_sha256_1c71b9641e30c9764f3503e49f8f85472d7e62384c8dd2b420c4fa2b2fccda4f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128131,21 +128238,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_1 : FILE
 		$s4 = "costura"
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_3 : FILE
 {
 	meta:
 		description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
 		author = "FireEye"
-		id = "616333fc-4075-5f04-823a-1164717a2b87"
+		id = "16e13c98-2b09-5323-98ae-f2ba92a0f513"
 		date = "2020-12-10"
 		modified = "2020-12-10"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_3.yar#L4-L31"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "ecf13e47e409efd68b508735a84be6a1627f5b0c0cea6b90434fc9ba5b1d8cf5"
+		logic_hash = "v1_sha256_ecf13e47e409efd68b508735a84be6a1627f5b0c0cea6b90434fc9ba5b1d8cf5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128171,21 +128278,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_3 : FILE
 		$str16 = "Schtask" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
 }
 rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_4 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPivot project."
 		author = "FireEye"
-		id = "c1bd64da-6a54-5bc6-8a89-9c8a93dd965c"
+		id = "d82beb6f-7452-53c4-aabd-0be84516bf7a"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_4.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "7ef883148926d5786861e5e81b1e645aa2e3ca06bd663f2b5f32e04b5852a218"
+		logic_hash = "v1_sha256_7ef883148926d5786861e5e81b1e645aa2e3ca06bd663f2b5f32e04b5852a218"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -128195,21 +128302,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_4 : FILE
 		$typelibguid1 = "44B83A69-349F-4A3E-8328-A45132A70D62" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "8d6d28ce-de3a-5a38-b654-ba1372d47568"
+		id = "c0beeb2e-2ab5-55c2-97de-e26a4e7ae9a6"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_2.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "14e4a29a32e8441a6f7f322e09cd9bb9822ae47eaa1fdf8e09c90998b03658f5"
+		logic_hash = "v1_sha256_14e4a29a32e8441a6f7f322e09cd9bb9822ae47eaa1fdf8e09c90998b03658f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128225,21 +128332,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_2 : FILE
 		$s7 = "poisonhandler" wide
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Loader_MSIL_Wmirunner_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIRunner' project."
 		author = "FireEye"
-		id = "04c6acfc-859f-5e4a-8c59-9adf08f21657"
+		id = "b77239e5-6282-50aa-88cd-2477a2282722"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMIRUNNER/production/yara/Loader_MSIL_WMIRunner_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "49d21756a4f0b29909c4b0fa9f3a98dd0480f9401923032de4b3920814b85f29"
+		logic_hash = "v1_sha256_49d21756a4f0b29909c4b0fa9f3a98dd0480f9401923032de4b3920814b85f29"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -128249,21 +128356,21 @@ rule FIREEYE_RT_Loader_MSIL_Wmirunner_1 : FILE
 		$typelibguid0 = "6cc61995-9fd5-4649-b3cc-6f001d60ceda" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_NOAMCI_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'noamci' project."
 		author = "FireEye"
-		id = "48066258-528f-5a70-81e1-15d6dfd9ff4f"
+		id = "e0c6af71-c6db-53b7-b6f7-24debe7fb5f1"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NOAMCI/production/yara/APT_HackTool_MSIL_NOAMCI_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "6278cfb4e9af20bbe943f4b99227c7fba276315a9f0059575b3ed4ef96a848c4"
+		logic_hash = "v1_sha256_6278cfb4e9af20bbe943f4b99227c7fba276315a9f0059575b3ed4ef96a848c4"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -128274,21 +128381,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_NOAMCI_1 : FILE
 		$typelibguid1 = "ef86214e-54de-41c3-b27f-efc61d0accc3" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Loader_MSIL_Allthethings_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'AllTheThings' project."
 		author = "FireEye"
-		id = "1805b406-2531-56bf-8e08-e63a59ffcc84"
+		id = "2a433ced-5ad5-5fec-b535-3af8cd00ef1d"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ALLTHETHINGS/production/yara/Loader_MSIL_AllTheThings_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "e3058095f2a49f8c0f78cb392024795367609b04c1da80210ab8d72c6613ee71"
+		logic_hash = "v1_sha256_e3058095f2a49f8c0f78cb392024795367609b04c1da80210ab8d72c6613ee71"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -128298,22 +128405,20 @@ rule FIREEYE_RT_Loader_MSIL_Allthethings_1 : FILE
 		$typelibguid0 = "542ccc64-c4c3-4c03-abcd-199a11b26754" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule FIREEYE_RT_APT_Backdoor_PS1_BASICPIPESHELL_1
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "8f85d6cc-fd1e-5bf3-8052-440cbeda0ac9"
+		id = "0d188ec5-1be1-516e-9499-59b72dc15990"
 		date = "2020-12-18"
 		modified = "2020-12-18"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BASICPIPESHELL/production/yara/APT_Backdoor_PS1_BASICPIPESHELL_1.yar#L5-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "7a9f0002055ffe826562cab3d02d8babd14c5fcd6d0b528a2988e2649034279d"
+		logic_hash = "v1_sha256_7a9f0002055ffe826562cab3d02d8babd14c5fcd6d0b528a2988e2649034279d"
 		score = 75
 		quality = 63
 		tags = ""
@@ -128334,14 +128439,14 @@ rule FIREEYE_RT_Loader_MSIL_Sharpy_1 : FILE
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharPy' project."
 		author = "FireEye"
-		id = "7c7bda22-bacc-5901-a650-a30c9cfcdee7"
+		id = "1e0c2742-5548-5216-932b-20879f2f0ba5"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPY/production/yara/Loader_MSIL_SharPy_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "0f73fab3905b4961b8dbeb120d45a34a2383ecdaae0296f38e34f8b7ab4aeee8"
+		logic_hash = "v1_sha256_0f73fab3905b4961b8dbeb120d45a34a2383ecdaae0296f38e34f8b7ab4aeee8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -128351,14 +128456,14 @@ rule FIREEYE_RT_Loader_MSIL_Sharpy_1 : FILE
 		$typelibguid0 = "f6cf1d3b-3e43-4ecf-bb6d-6731610b4866" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Trojan_Linux_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "220302bc-4ed3-5e10-9bd2-a8ed2bdaef73"
+		id = "90ca3ab4-6110-5427-95d7-927208ba0881"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -128366,7 +128471,7 @@ rule FIREEYE_RT_APT_Trojan_Linux_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Linux_REDFLARE_1.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
-		logic_hash = "282f11c4c86d88d05f11e92f5483701d9a54c2dd39f21316cd271aa78a338d0f"
+		logic_hash = "v1_sha256_282f11c4c86d88d05f11e92f5483701d9a54c2dd39f21316cd271aa78a338d0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128380,14 +128485,14 @@ rule FIREEYE_RT_APT_Trojan_Linux_REDFLARE_1 : FILE
 		$s5 = "initialize" fullword
 
 	condition:
-		( uint32(0)==0x464c457f) and all of them
+		( uint32( 0 ) == 0x464c457f ) and all of them
 }
 rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_6 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "5875a9ec-c3ee-57f0-a430-4443db585def"
+		id = "b3616f8d-7f9e-5b6c-9caa-505a68035ac5"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -128395,7 +128500,7 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_6 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Win_REDFLARE_6.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "294b1e229c3b1efce29b162e7b3be0ab, 6902862bd81da402e7ac70856afbe6a2"
-		logic_hash = "1e6f8320e0c0b601fc72fa4d9c61e46adfbcd84638c97da5988ca848e036312a"
+		logic_hash = "v1_sha256_1e6f8320e0c0b601fc72fa4d9c61e46adfbcd84638c97da5988ca848e036312a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128409,14 +128514,14 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_6 : FILE
 		$s5 = "initialize" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Downloader_Win32_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "e8d7ee31-568e-58ac-98ad-49baa2eb37ea"
+		id = "0ef7a449-d215-59ff-9556-f79b3a5d1b61"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128424,7 +128529,7 @@ rule FIREEYE_RT_APT_Downloader_Win32_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Downloader_Win32_REDFLARE_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "05b99d438dac63a5a993cea37c036673"
-		logic_hash = "a340a2a732a9b1aa74ca9d84009a88d1b14b6a03140a859384c0d6e745e4a90a"
+		logic_hash = "v1_sha256_a340a2a732a9b1aa74ca9d84009a88d1b14b6a03140a859384c0d6e745e4a90a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128435,14 +128540,14 @@ rule FIREEYE_RT_APT_Downloader_Win32_REDFLARE_1 : FILE
 		$http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [1-10] 6A 00 8B [1-8] 5? 6A 00 6A 00 6A 00 8B [1-8] 5? 68 [4] 8B [1-8] 5? FF 15 [4-40] 6A 14 E8 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_7 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "f891e477-9ff2-57be-9ca5-dd87d9baee29"
+		id = "3043e608-0ea9-51d3-adf3-81f525bf8939"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -128450,7 +128555,7 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_7 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_7.yar#L4-L21"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e7beece34bdf67cbb8297833c5953669, 8025bcbe3cc81fc19021ad0fbc11cf9b"
-		logic_hash = "6d7822256ac1bef05304d3396df773e2b20a397311ad820d6ec5fe4cb6bdfbbc"
+		logic_hash = "v1_sha256_6d7822256ac1bef05304d3396df773e2b20a397311ad820d6ec5fe4cb6bdfbbc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128465,41 +128570,14 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_7 : FILE
 		$named_pipe = { 88 13 00 00 [1-8] E8 03 00 00 [20-60] 00 00 00 00 [1-8] 00 00 00 00 [1-40] ( 6A 00 6A 00 6A 03 6A 00 6A 00 68 | 00 00 00 00 [1-6] 00 00 00 00 [1-6] 03 00 00 00 45 33 C? 45 33 C? BA ) 00 00 00 C0 [2-10] FF 15 [4-30] FF 15 [4-7] E7 00 00 00 [4-40] FF 15 [4] 85 C0 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
-}
-rule FIREEYE_RT_APT_Builder_PY_REDFLARE_2
-{
-	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "1af407f5-6eb7-5be9-a3d9-cd0f7a5f2503"
-		date = "2020-12-01"
-		date = "2020-12-01"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_2.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4410e95de247d7f1ab649aa640ee86fb"
-		logic_hash = "675390e944a95156ad33ca783c90fdea9610cdc2e8c5c53e0c0fa213149b4714"
-		score = 75
-		quality = 75
-		tags = ""
-		rev = 1
-
-	strings:
-		$1 = "<510sxxII"
-		$2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
-		$3 = "parsePluginOutput"
-
-	condition:
-		all of them and #2==2
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Keylogger_Win32_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "ad14db66-d640-5712-b2c8-a3d42d5a90f3"
+		id = "13f1b0db-6daf-5b15-a940-1ca38f15f353"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -128507,7 +128585,7 @@ rule FIREEYE_RT_APT_Keylogger_Win32_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Keylogger_Win32_REDFLARE_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "d7cfb9fbcf19ce881180f757aeec77dd"
-		logic_hash = "aebbaa050bee3775ffac4214ea4ab58284384e7eb41e66ee4838b9359e72821e"
+		logic_hash = "v1_sha256_aebbaa050bee3775ffac4214ea4ab58284384e7eb41e66ee4838b9359e72821e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128518,14 +128596,14 @@ rule FIREEYE_RT_APT_Keylogger_Win32_REDFLARE_1 : FILE
 		$keys_check = { 6A 14 [0-5] FF [1-5] 6A 10 [0-5] FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A0 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A1 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 74 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_8 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "b090df60-8f4e-51ca-944c-6f9ce2d9c913"
+		id = "ee114b65-4350-59c0-8acb-9bc37c4e1138"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -128533,7 +128611,7 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_8 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_8.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "9c8eb908b8c1cda46e844c24f65d9370, 9e85713d615bda23785faf660c1b872c"
-		logic_hash = "5b8a0402886daebefb995e7df0877d51727c5b8dc58eeb8ff16ceec5e7811a20"
+		logic_hash = "v1_sha256_5b8a0402886daebefb995e7df0877d51727c5b8dc58eeb8ff16ceec5e7811a20"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128549,14 +128627,14 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_8 : FILE
 		$trap = { 03 40 00 80 E8 [4] CC }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "dc162f26-66d3-5359-b1d7-ef2208b359e2"
+		id = "a821344a-1c0a-5a51-9ed9-739eea2c6f94"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128564,7 +128642,7 @@ rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "f20824fa6e5c81e3804419f108445368"
-		logic_hash = "2cae245a6aa36dccc2228cccefdc4ca0eb278901f063e072a369000f67d73a55"
+		logic_hash = "v1_sha256_2cae245a6aa36dccc2228cccefdc4ca0eb278901f063e072a369000f67d73a55"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128575,14 +128653,14 @@ rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_1 : FILE
 		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_4 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "6e8621b0-a0ee-5fc7-a2b8-1973a42d6e37"
+		id = "78f4f2a7-9a11-59f7-a452-d9b37f1c620c"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -128590,7 +128668,7 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_4 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_4.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "a8b5dcfea5e87bf0e95176daa243943d, 9dcb6424662941d746576e62712220aa"
-		logic_hash = "d027e98ad8fa6d03a49ceffd81fba6a621173e2dbabae652bee2f4e8489bb378"
+		logic_hash = "v1_sha256_d027e98ad8fa6d03a49ceffd81fba6a621173e2dbabae652bee2f4e8489bb378"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128603,14 +128681,14 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_4 : FILE
 		$user_logon = { 22 02 00 00 [1-10] 02 02 00 00 [0-4] E8 [4-40] ( 09 00 00 00 [1-10] 03 00 00 00 | 6A 03 6A 09 ) [4-30] FF 15 [4] 85 C0 7? }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Raw64_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "8e937f6a-404f-53bd-9de2-ed63b1cf48b2"
+		id = "ee1beadf-49ab-577e-8155-00e597c2a68e"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128618,7 +128696,7 @@ rule FIREEYE_RT_APT_Loader_Raw64_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Raw64_REDFLARE_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "5e14f77f85fd9a5be46e7f04b8a144f5"
-		logic_hash = "dac122ccece8a6dd35a5fe9d37860a612aa50ab469b79f4375dbe776f60c7b57"
+		logic_hash = "v1_sha256_dac122ccece8a6dd35a5fe9d37860a612aa50ab469b79f4375dbe776f60c7b57"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128628,14 +128706,14 @@ rule FIREEYE_RT_APT_Loader_Raw64_REDFLARE_1 : FILE
 		$load = { EB ?? 58 48 8B 10 4C 8B 48 ?? 48 8B C8 [1-10] 48 83 C1 ?? 48 03 D1 FF }
 
 	condition:
-		( uint16(0)!=0x5A4D) and all of them
+		( uint16( 0 ) != 0x5A4D ) and all of them
 }
 rule FIREEYE_RT_APT_Builder_PY_REDFLARE_1
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "3b5ad25d-ce66-572e-9a91-40a73b8fd447"
+		id = "7135ee51-5d2a-5ecb-b386-b795d1dcddb1"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128643,7 +128721,7 @@ rule FIREEYE_RT_APT_Builder_PY_REDFLARE_1
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_1.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "d0a830403e56ebaa4bfbe87dbfdee44f"
-		logic_hash = "1948cadb7242eb69bffbc222802ce9c1af38d7a846da09b6343b1449fe054e42"
+		logic_hash = "v1_sha256_1948cadb7242eb69bffbc222802ce9c1af38d7a846da09b6343b1449fe054e42"
 		score = 75
 		quality = 75
 		tags = ""
@@ -128659,14 +128737,14 @@ rule FIREEYE_RT_APT_Builder_PY_REDFLARE_1
 		$7 = "_x64.dll"
 
 	condition:
-		all of them and @1[1]<@2[1] and @2[1]<@3[1] and @3[1]<@4[1] and @4[1]<@5[1]
+		all of them and @1 [ 1 ] < @2 [ 1 ] and @2 [ 1 ] < @3 [ 1 ] and @3 [ 1 ] < @4 [ 1 ] and @4 [ 1 ] < @5 [ 1 ]
 }
 rule FIREEYE_RT_APT_Controller_Linux_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "79a69740-7209-5c56-ad6f-eb4d0b29beaf"
+		id = "17728af3-d6a7-587b-aecd-4e45262a0f20"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -128674,7 +128752,7 @@ rule FIREEYE_RT_APT_Controller_Linux_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Controller_Linux_REDFLARE_1.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
-		logic_hash = "d6b0cc5f386da9bff8a8293f2b3857406044ab42f7c1bb23d5096052a3c42ce4"
+		logic_hash = "v1_sha256_d6b0cc5f386da9bff8a8293f2b3857406044ab42f7c1bb23d5096052a3c42ce4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128687,14 +128765,14 @@ rule FIREEYE_RT_APT_Controller_Linux_REDFLARE_1 : FILE
 		$4 = "goratsvr.CommandRequest" fullword
 
 	condition:
-		( uint32(0)==0x464c457f) and all of them
+		( uint32( 0 ) == 0x464c457f ) and all of them
 }
 rule FIREEYE_RT_APT_Keylogger_Win64_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "3c980f5a-c775-5c25-ba28-91a93a1b9a85"
+		id = "d4dde414-69af-5ee4-be5a-52a3d986574e"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -128702,7 +128780,7 @@ rule FIREEYE_RT_APT_Keylogger_Win64_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Keylogger_Win64_REDFLARE_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "fbefb4074f1672a3c29c1a47595ea261"
-		logic_hash = "26fe577ba637c484d9a8ccc2173b5892a76328a90a39a2bebbae6bd2a6329485"
+		logic_hash = "v1_sha256_26fe577ba637c484d9a8ccc2173b5892a76328a90a39a2bebbae6bd2a6329485"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128713,14 +128791,14 @@ rule FIREEYE_RT_APT_Keylogger_Win64_REDFLARE_1 : FILE
 		$keys_check = { B9 14 00 00 00 FF 15 [4-8] B9 10 00 00 00 FF 15 [4] BE 00 80 FF FF 66 85 C6 75 ?? B9 A0 00 00 00 FF 15 [4] 66 85 C6 75 ?? B9 A1 00 00 00 FF 15 [4] 66 85 C6 74 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "b8a2c388-3b27-5075-b0ee-2773ae0c67ad"
+		id = "d1ecdf28-e657-53d2-9ab1-d5daafd1d5e1"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128728,7 +128806,7 @@ rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "01d68343ac46db6065f888a094edfe4f"
-		logic_hash = "f9165aabe4bad215211cf98559099030ddb8a76175fbfcfee3c6f25d7614bdad"
+		logic_hash = "v1_sha256_f9165aabe4bad215211cf98559099030ddb8a76175fbfcfee3c6f25d7614bdad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128739,14 +128817,14 @@ rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_1 : FILE
 		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_5 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "892981d6-f310-5ee8-95b5-dd4bd720a86c"
+		id = "39a75367-cc48-51cf-a28f-232306f3d81f"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -128754,7 +128832,7 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_5 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_5.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dfbb1b988c239ade4c23856e42d4127b, 3322fba40c4de7e3de0fda1123b0bf5d"
-		logic_hash = "ab38e5ebded026829672941709797b40f8e13fb244b6a8ed3545de4358f727b8"
+		logic_hash = "v1_sha256_ab38e5ebded026829672941709797b40f8e13fb244b6a8ed3545de4358f727b8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128768,14 +128846,14 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_5 : FILE
 		$steal_token = { FF 15 [4] 85 C0 [1-40] C7 44 24 ?? 01 00 00 00 [0-20] C7 44 24 ?? 02 00 00 00 [0-20] FF 15 [4] FF [1-5] 85 C0 [4-40] 00 04 00 00 FF 15 [4-5] 85 C0 [2-20] ( BA 0F 00 00 00 | 6A 0F ) [1-4] FF 15 [4] 85 C0 74 [1-20] FF 15 [4] 85 C0 74 [1-20] ( 6A 0B | B9 0B 00 00 00 ) E8 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_3 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "2f6785c4-f4d0-52ff-8c46-da953e2ca92a"
+		id = "9ca62954-2d46-5182-b595-0a36d6977f6f"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -128783,7 +128861,7 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_3 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_3.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "9ccda4d7511009d5572ef2f8597fba4e,ece07daca53dd0a7c23dacabf50f56f1"
-		logic_hash = "ee104bc145686a134e4d6d620dae7d1dacff7645d47f1a8d7a212327352b8e87"
+		logic_hash = "v1_sha256_ee104bc145686a134e4d6d620dae7d1dacff7645d47f1a8d7a212327352b8e87"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128796,14 +128874,14 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_3 : FILE
 		$str3 = "runCommand" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Downloader_Win64_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "15a5e22b-84b0-5b36-8772-1d496ac447b2"
+		id = "11797c6d-ba58-55e2-972d-753d93da1131"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128811,7 +128889,7 @@ rule FIREEYE_RT_APT_Downloader_Win64_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Downloader_Win64_REDFLARE_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "9529c4c9773392893a8a0ab8ce8f8ce1"
-		logic_hash = "1b9bece6083403615841c752eac48fd20095e918d6e175563dd122be2885d875"
+		logic_hash = "v1_sha256_1b9bece6083403615841c752eac48fd20095e918d6e175563dd122be2885d875"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128822,14 +128900,14 @@ rule FIREEYE_RT_APT_Downloader_Win64_REDFLARE_1 : FILE
 		$http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [6-20] 00 00 00 00 [6-20] 00 00 00 00 [2-10] 00 00 00 00 45 33 C9 [4-20] 48 8D 15 [4] 48 8B 0D [4] FF 15 [4-50] B9 14 00 00 00 E8 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "c3054680-9c87-5d90-b78e-b260904340df"
+		id = "fd33d611-b690-5124-abc3-29d0e706e53b"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128837,7 +128915,7 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_1.yar#L4-L21"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "100d73b35f23b2fe84bf7cd37140bf4d,4e7e90c7147ee8aa01275894734f4492"
-		logic_hash = "08ea2151418f7f75a8b138146c393a5ea85647320cc8e9fe1930d75871ab94bb"
+		logic_hash = "v1_sha256_08ea2151418f7f75a8b138146c393a5ea85647320cc8e9fe1930d75871ab94bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128852,14 +128930,14 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_1 : FILE
 		$6 = "WriteProcessMemory" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Raw32_REDFLARE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "8f8ec27f-afac-5da5-b76f-b984e14e0066"
+		id = "a1dc6b80-149e-50f1-8228-fa3d9f2efef3"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128867,7 +128945,7 @@ rule FIREEYE_RT_APT_Loader_Raw32_REDFLARE_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Raw32_REDFLARE_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4022baddfda3858a57c9cbb0d49f6f86"
-		logic_hash = "05ed89bd82600b4d5ef01ece2e0a9bd84e968988fd2bda1bab4ec316a9a9906b"
+		logic_hash = "v1_sha256_05ed89bd82600b4d5ef01ece2e0a9bd84e968988fd2bda1bab4ec316a9a9906b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128877,14 +128955,14 @@ rule FIREEYE_RT_APT_Loader_Raw32_REDFLARE_1 : FILE
 		$load = { EB ?? 58 [0-4] 8B 10 8B 48 [1-3] 8B C8 83 C1 ?? 03 D1 83 E9 [1-3] 83 C1 [1-4] FF D? }
 
 	condition:
-		( uint16(0)!=0x5A4D) and all of them
+		( uint16( 0 ) != 0x5A4D ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "6a585401-bfd3-5aad-b484-09b6a30d9af5"
+		id = "c8e0617d-97a9-568a-8cb6-174c4de52160"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128892,7 +128970,7 @@ rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_2.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4e7e90c7147ee8aa01275894734f4492"
-		logic_hash = "98dfb71adbde4f8965e612c19f0965d8fa95805825569290fdf72eb1d86cfb70"
+		logic_hash = "v1_sha256_98dfb71adbde4f8965e612c19f0965d8fa95805825569290fdf72eb1d86cfb70"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128903,14 +128981,14 @@ rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_2 : FILE
 		$s1 = "ResumeThread"
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "84881e5c-05df-5911-af42-ec82e559588c"
+		id = "055ad13d-d65f-57fd-825f-9961105d586e"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128918,7 +128996,7 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_2.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "9529c4c9773392893a8a0ab8ce8f8ce1,05b99d438dac63a5a993cea37c036673"
-		logic_hash = "1f2e1f644b1932486444dfda30b7dad7f50121f59fa493eb8a1a0528ae46db26"
+		logic_hash = "v1_sha256_1f2e1f644b1932486444dfda30b7dad7f50121f59fa493eb8a1a0528ae46db26"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128932,14 +129010,14 @@ rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_2 : FILE
 		$5 = "Cookie: SID1=%s" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "043f4e29-710d-5e17-a0ed-82cd3a565194"
+		id = "5d42b476-ba68-5907-8952-b6f88fa24b0f"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -128947,7 +129025,7 @@ rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_2.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "100d73b35f23b2fe84bf7cd37140bf4d"
-		logic_hash = "9fad845ed963fae46ac7ddc44407d5f6ed0a061f6a106764b9f912ef718279b4"
+		logic_hash = "v1_sha256_9fad845ed963fae46ac7ddc44407d5f6ed0a061f6a106764b9f912ef718279b4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -128959,21 +129037,21 @@ rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_2 : FILE
 		$s1 = "ResumeThread" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Sharpschtask_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpSchtask' project."
 		author = "FireEye"
-		id = "5c7a5dee-3bc2-54b2-a7e2-be05ba74d4a1"
+		id = "a43eb60a-e9da-5da4-9f6e-6549cdf78e56"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSCHTASK/production/yara/HackTool_MSIL_SharpSchtask_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "7437fde82920f4d015a7f149b58924baf6cb220c6f6857d9509e23795ff0811c"
+		logic_hash = "v1_sha256_7437fde82920f4d015a7f149b58924baf6cb220c6f6857d9509e23795ff0811c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -128983,21 +129061,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharpschtask_1 : FILE
 		$typelibguid0 = "0a64a5f4-bdb6-443c-bdc7-f6f0bf5b5d6c" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Prepshellcode_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'PrepShellcode' project."
 		author = "FireEye"
-		id = "32fb6b1d-e01f-5555-8516-088dca2166cf"
+		id = "6449eba5-ffca-5117-9766-4fca17fb946c"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PREPSHELLCODE/production/yara/HackTool_MSIL_PrepShellcode_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "aedae87d84275f6589c982c04175ddc0aee3e4f3ae959ced4b4e2294675522e6"
+		logic_hash = "v1_sha256_aedae87d84275f6589c982c04175ddc0aee3e4f3ae959ced4b4e2294675522e6"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -129007,21 +129085,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Prepshellcode_1 : FILE
 		$typelibguid0 = "d16ed275-70d5-4ae5-8ce7-d249f967616c" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_WMISPY_2 : FILE
 {
 	meta:
 		description = "wql searches"
 		author = "FireEye"
-		id = "474af878-a657-54bc-a063-04532df928d4"
+		id = "dcbdbb39-e85b-586a-853e-61c7fec636f1"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/APT_HackTool_MSIL_WMISPY_2.yar#L4-L24"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "3651f252d53d2f46040652788499d65a"
-		logic_hash = "553fc1e536482a56b3228a5c9ebac843af9083e8ac864bf65c81b36a39ca5e5e"
+		logic_hash = "v1_sha256_553fc1e536482a56b3228a5c9ebac843af9083e8ac864bf65c81b36a39ca5e5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129040,21 +129118,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_WMISPY_2 : FILE
 		$str9 = "from Win32_Process" wide
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and $MSIL and all of ($str*)
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and $MSIL and all of ( $str* )
 }
 rule FIREEYE_RT_Hacktool_MSIL_Wmispy_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIspy' project."
 		author = "FireEye"
-		id = "ac394751-da40-564b-8e24-8f353326b46a"
+		id = "a269aaf0-a8a5-59dc-a94f-119dcc291c85"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/HackTool_MSIL_WMIspy_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "a5a9f7c7a7bfe474e8b21306ea220b4d476832f3ad4fafdd8967a2250d15a701"
+		logic_hash = "v1_sha256_a5a9f7c7a7bfe474e8b21306ea220b4d476832f3ad4fafdd8967a2250d15a701"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -129064,21 +129142,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Wmispy_1 : FILE
 		$typelibguid0 = "5ee2bca3-01ad-489b-ab1b-bda7962e06bb" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Backdoor_Win_GORAT_1 : FILE
 {
 	meta:
 		description = "This detects if a sample is less than 50KB and has a number of strings found in the Gorat shellcode (stage0 loader). The loader contains an embedded DLL (stage0.dll) that contains a number of unique strings. The 'Cookie' string found in this loader is important as this cookie is needed by the C2 server to download the Gorat implant (stage1 payload)."
 		author = "FireEye"
-		id = "5ac84cf1-49fb-533d-b211-b1a92239063b"
+		id = "20d24576-826d-5a49-89a3-e751cd8c875d"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_1.yar#L4-L23"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "66cdaa156e4d372cfa3dea0137850d20"
-		logic_hash = "f6a0a923f64375e7ffdc080aec41db19a9e162405f1290ed0bbcce5a342bdadb"
+		logic_hash = "v1_sha256_f6a0a923f64375e7ffdc080aec41db19a9e162405f1290ed0bbcce5a342bdadb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129096,21 +129174,21 @@ rule FIREEYE_RT_APT_Backdoor_Win_GORAT_1 : FILE
 		$s9 = "!This program cannot be run in DOS mode." ascii wide
 
 	condition:
-		filesize <50KB and all of them
+		filesize < 50KB and all of them
 }
 rule FIREEYE_RT_APT_Backdoor_Win_Gorat_Memory
 {
 	meta:
 		description = "Identifies GoRat malware in memory based on strings."
 		author = "FireEye"
-		id = "16fb1db7-711c-5d8d-9203-738c94f253fe"
+		id = "c1113e4f-b351-5403-a6a4-0ef45649e0cc"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GoRat_Memory.yar#L4-L27"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "3b926b5762e13ceec7ac3a61e85c93bb"
-		logic_hash = "88272e59325d106f96d6b6f1d57daf968823c1e760067dee0334c66c521ce8c2"
+		logic_hash = "v1_sha256_88272e59325d106f96d6b6f1d57daf968823c1e760067dee0334c66c521ce8c2"
 		score = 75
 		quality = 75
 		tags = ""
@@ -129132,14 +129210,14 @@ rule FIREEYE_RT_APT_Backdoor_Win_Gorat_Memory
 		$winblows = "rat/platforms/win.(*winblows).GetStage" fullword
 
 	condition:
-		$winblows or #murica>10 or 3 of ($rat*)
+		$winblows or #murica > 10 or 3 of ( $rat* )
 }
 rule FIREEYE_RT_APT_Backdoor_Win_GORAT_5 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "73102bd2-7b94-5c7b-b9a4-cfc9cf5e3212"
+		id = "38cae6a5-d7ee-5504-9844-3250ac43d94e"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -129147,7 +129225,7 @@ rule FIREEYE_RT_APT_Backdoor_Win_GORAT_5 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_5.yar#L4-L23"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f"
-		logic_hash = "67f85fb3bedfd18a1226c92318f387be3c7ff9566ca2d554c49cf62389482552"
+		logic_hash = "v1_sha256_67f85fb3bedfd18a1226c92318f387be3c7ff9566ca2d554c49cf62389482552"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129164,21 +129242,21 @@ rule FIREEYE_RT_APT_Backdoor_Win_GORAT_5 : FILE
 		$8 = "/rat/cmd/gorat_shared/dllmain.go" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Trojan_MSIL_GORAT_Plugin_DOTNET_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Plugin - .NET' project."
 		author = "FireEye"
-		id = "faa73d64-4bb1-5c06-a3a5-1f1aa99ea932"
+		id = "7b35c937-f3ff-5654-b3fb-096c8802b0f4"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Plugin_DOTNET_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "e979822273c6d1ccdfebd341c9e2cb1040fe34a04e8b41c024885063fd946ad5"
+		logic_hash = "v1_sha256_e979822273c6d1ccdfebd341c9e2cb1040fe34a04e8b41c024885063fd946ad5"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -129189,21 +129267,21 @@ rule FIREEYE_RT_Trojan_MSIL_GORAT_Plugin_DOTNET_1 : FILE
 		$typelibguid1 = "fc3daedf-1d01-4490-8032-b978079d8c2d" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Backdoor_Win_GORAT_3 : FILE
 {
 	meta:
 		description = "This rule uses the same logic as FE_APT_Trojan_Win_GORAT_1_FEBeta with the addition of one check, to look for strings that are known to be in the Gorat implant when a certain cleaning script is not run against it."
 		author = "FireEye"
-		id = "94c195b5-b8e8-56a7-bc11-dbbe2f969b06"
+		id = "1ed4e6ed-82f0-5b0b-bdb4-54788acbea90"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_3.yar#L4-L39"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "995120b35db9d2f36d7d0ae0bfc9c10d"
-		logic_hash = "592745e9c67f7adf0cd48975ed1497211d8efeff29b52be1e2d082b9a648bb57"
+		logic_hash = "v1_sha256_592745e9c67f7adf0cd48975ed1497211d8efeff29b52be1e2d082b9a648bb57"
 		score = 75
 		quality = 28
 		tags = "FILE"
@@ -129237,21 +129315,21 @@ rule FIREEYE_RT_APT_Backdoor_Win_GORAT_3 : FILE
 		$str11 = "rat.New" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat>1000 and any of ($dirty*)
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10MB and all of ( $go* ) and all of ( $json* ) and all of ( $str* ) and #rat > 1000 and any of ( $dirty* )
 }
 rule FIREEYE_RT_APT_Backdoor_Macos_GORAT_1 : FILE
 {
 	meta:
 		description = "This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT"
 		author = "FireEye"
-		id = "4646eadb-7acf-582f-9ad6-00f012ceed8a"
+		id = "0350efb2-6327-52f8-98aa-ac24958f385b"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_MacOS_GORAT_1.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "68acf11f5e456744262ff31beae58526"
-		logic_hash = "2df5f87d44968670511880d21ad184779d0561c7c426a5d6426bcefd0904a9b7"
+		logic_hash = "v1_sha256_2df5f87d44968670511880d21ad184779d0561c7c426a5d6426bcefd0904a9b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129265,21 +129343,21 @@ rule FIREEYE_RT_APT_Backdoor_Macos_GORAT_1 : FILE
 		$s5 = "Cookie" ascii wide
 
 	condition:
-		(( uint32(0)==0xBEBAFECA) or ( uint32(0)==0xFEEDFACE) or ( uint32(0)==0xFEEDFACF) or ( uint32(0)==0xCEFAEDFE)) and all of them
+		(( uint32( 0 ) == 0xBEBAFECA ) or ( uint32( 0 ) == 0xFEEDFACE ) or ( uint32( 0 ) == 0xFEEDFACF ) or ( uint32( 0 ) == 0xCEFAEDFE ) ) and all of them
 }
 rule FIREEYE_RT_Trojan_MSIL_GORAT_Module_Powershell_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Module - PowerShell' project."
 		author = "FireEye"
-		id = "b0fba130-9cd9-5b7f-a806-9ff8099f5731"
+		id = "e6c7a1e4-2639-5fc4-a60b-05fefb47715e"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Module_PowerShell_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "e596bc0316a4ef85f04c2683ebc7c94bf9b831843232c33e62c84991e4caeb97"
+		logic_hash = "v1_sha256_e596bc0316a4ef85f04c2683ebc7c94bf9b831843232c33e62c84991e4caeb97"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -129290,7 +129368,7 @@ rule FIREEYE_RT_Trojan_MSIL_GORAT_Module_Powershell_1 : FILE
 		$typelibguid1 = "845ee9dc-97c9-4c48-834e-dc31ee007c25" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 import "pe"
 
@@ -129299,14 +129377,14 @@ rule FIREEYE_RT_APT_Backdoor_Win_GORAT_4 : FILE
 	meta:
 		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and exports numerous functions that are known to be exported by the Gorat implant. This is done in an effort to provide detection for packed samples that may not have other strings but will need to replicate exports to maintain functionality."
 		author = "FireEye"
-		id = "fa3bcaad-c210-5b9c-8567-fe85b8e78055"
+		id = "3cb62012-0414-5842-b3aa-889d41b78ae9"
 		date = "2021-03-03"
 		modified = "2021-03-03"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_4.yar#L5-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "f59095f0ab15f26a1ead7eed8cdb4902"
-		logic_hash = "ec201614cb91fae9d7c89febfa22dfd6ba7f353e0eeb0b2fec6c8d887992e79e"
+		logic_hash = "v1_sha256_ec201614cb91fae9d7c89febfa22dfd6ba7f353e0eeb0b2fec6c8d887992e79e"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -129316,21 +129394,21 @@ rule FIREEYE_RT_APT_Backdoor_Win_GORAT_4 : FILE
 		$mz = "MZ"
 
 	condition:
-		$mz at 0 and uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and pe.exports("MemoryCallEntryPoint") and pe.exports("MemoryDefaultAlloc") and pe.exports("MemoryDefaultFree") and pe.exports("MemoryDefaultFreeLibrary") and pe.exports("MemoryDefaultGetProcAddress") and pe.exports("MemoryDefaultLoadLibrary") and pe.exports("MemoryFindResource") and pe.exports("MemoryFindResourceEx") and pe.exports("MemoryFreeLibrary") and pe.exports("MemoryGetProcAddress") and pe.exports("MemoryLoadLibrary") and pe.exports("MemoryLoadLibraryEx") and pe.exports("MemoryLoadResource") and pe.exports("MemoryLoadString") and pe.exports("MemoryLoadStringEx") and pe.exports("MemorySizeofResource") and pe.exports("callback") and pe.exports("crosscall2") and pe.exports("crosscall_386")
+		$mz at 0 and uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10MB and pe.exports ( "MemoryCallEntryPoint" ) and pe.exports ( "MemoryDefaultAlloc" ) and pe.exports ( "MemoryDefaultFree" ) and pe.exports ( "MemoryDefaultFreeLibrary" ) and pe.exports ( "MemoryDefaultGetProcAddress" ) and pe.exports ( "MemoryDefaultLoadLibrary" ) and pe.exports ( "MemoryFindResource" ) and pe.exports ( "MemoryFindResourceEx" ) and pe.exports ( "MemoryFreeLibrary" ) and pe.exports ( "MemoryGetProcAddress" ) and pe.exports ( "MemoryLoadLibrary" ) and pe.exports ( "MemoryLoadLibraryEx" ) and pe.exports ( "MemoryLoadResource" ) and pe.exports ( "MemoryLoadString" ) and pe.exports ( "MemoryLoadStringEx" ) and pe.exports ( "MemorySizeofResource" ) and pe.exports ( "callback" ) and pe.exports ( "crosscall2" ) and pe.exports ( "crosscall_386" )
 }
 rule FIREEYE_RT_APT_Backdoor_Win_GORAT_2 : FILE
 {
 	meta:
 		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and has the Go build ID strings. Then checks for various strings known to be in the Gorat implant including strings used in C2 json, names of methods, and the unique string 'murica' used in C2 comms. A check is done to ensure the string 'rat' appears in the binary over 1000 times as it is the name of the project used by the implant and is present well over 2000 times."
 		author = "FireEye"
-		id = "e2c47711-d088-5cb4-8d21-f8199a865a28"
+		id = "882c743d-dc53-5e80-aa78-f876f73c6833"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_2.yar#L4-L34"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "f59095f0ab15f26a1ead7eed8cdb4902"
-		logic_hash = "8efc904498386d89879766a5021148a250f639bc328df12a34cfc8d620df6f6c"
+		logic_hash = "v1_sha256_8efc904498386d89879766a5021148a250f639bc328df12a34cfc8d620df6f6c"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -129359,14 +129437,14 @@ rule FIREEYE_RT_APT_Backdoor_Win_GORAT_2 : FILE
 		$str11 = "rat.New" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat>1000
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10MB and all of ( $go* ) and all of ( $json* ) and all of ( $str* ) and #rat > 1000
 }
 rule FIREEYE_RT_Trojan_Win64_Generic_23 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "470bfeed-e000-58c6-b115-dfa8aea25bef"
+		id = "7e2fdec7-acb4-59aa-a66c-0ae1fd510bcd"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -129374,7 +129452,7 @@ rule FIREEYE_RT_Trojan_Win64_Generic_23 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_23.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "b66347ef110e60b064474ae746701d4a"
-		logic_hash = "4c1860801b26abbab8c4aea730bf69f388c902083b9945e11e6782af3ab22789"
+		logic_hash = "v1_sha256_4c1860801b26abbab8c4aea730bf69f388c902083b9945e11e6782af3ab22789"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129390,14 +129468,14 @@ rule FIREEYE_RT_Trojan_Win64_Generic_23 : FILE
 		$token = { FF 15 [4] 4C 8D 45 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 75 ?? E9 [4] 48 8D [2-5] 48 89 44 24 28 C7 44 24 20 02 00 00 00 41 B9 02 00 00 00 45 33 C0 BA 0B 00 00 00 48 8B 4D ?? FF 15 [4] 85 C0 75 ?? E9 [4] 4C 8D 8D [4] 45 33 C0 BA 01 00 00 00 33 C9 FF 15 }
 
 	condition:
-		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
+		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
 }
 rule FIREEYE_RT_Trojan_Win64_Generic_22 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "e79661a8-5254-5e8e-b92b-edf1ddb072ff"
+		id = "fde0e6b8-12a5-5afe-97f5-5a8798f668c5"
 		date = "2020-11-26"
 		date = "2020-11-26"
 		modified = "2020-12-09"
@@ -129405,7 +129483,7 @@ rule FIREEYE_RT_Trojan_Win64_Generic_22 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_22.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "f7d9961463b5110a3d70ee2e97842ed3"
-		logic_hash = "52fbe5c0ee7c05df5fcd62c26caaa5498e32352da9c5940e522aa31d6c808028"
+		logic_hash = "v1_sha256_52fbe5c0ee7c05df5fcd62c26caaa5498e32352da9c5940e522aa31d6c808028"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129421,21 +129499,21 @@ rule FIREEYE_RT_Trojan_Win64_Generic_22 : FILE
 		$token = { FF 15 [4] 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 0F 84 [4] 48 8B 4C 24 ?? 48 8D [2-3] 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 [4] 85 C0 0F 84 [4] 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 01 FF 15 }
 
 	condition:
-		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
+		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
 }
 rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_1 : FILE
 {
 	meta:
 		description = "This rule looks for the binary signature of the 'Inject' method found in the main Excavator PE."
 		author = "FireEye"
-		id = "7cabc230-e55b-5096-996a-b6a8c9693bdc"
+		id = "93079007-63ee-5450-99c8-f7c6c9c1c393"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "f7d9961463b5110a3d70ee2e97842ed3"
-		logic_hash = "bf4b776f34a1a9aa5438504f63a63ef452a747363de3b70cec52145d777055bd"
+		logic_hash = "v1_sha256_bf4b776f34a1a9aa5438504f63a63ef452a747363de3b70cec52145d777055bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129448,21 +129526,21 @@ rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_1 : FILE
 		$bytes4 = { 48 89 74 24 ?? 48 89 7C 24 ?? 4C 89 74 24 ?? 55 48 8D 6C 24 ?? 48 81 EC 20 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 45 ?? 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 ?? 48 8D 0D ?? ?? ?? ?? 4C 89 74 24 ?? 0F 11 45 ?? 41 8B FE 4C 89 74 24 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 ?? 48 89 44 24 ?? 66 0F 6F 15 ?? ?? 01 00 48 8D 05 ?? ?? ?? ?? B9 C8 05 00 00 90 F3 0F 6F 40 ?? 48 8D 40 ?? 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? F3 0F 6F 40 ?? 66 0F EF C2 F3 0F 7F 40 ?? 48 83 E9 01 75 ?? FF 15 ?? ?? ?? ?? 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 45 ?? 41 B9 02 00 00 00 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 02 00 00 00 41 8D 51 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B 44 24 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 48 8B C8 41 8D 50 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 ?? 4C 8D 4C 24 ?? 4C 89 74 24 ?? 33 D2 41 B8 00 00 02 00 48 C7 44 24 ?? 08 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 45 ?? 48 89 7D ?? 48 89 44 24 ?? 45 33 C9 4C 89 74 24 ?? 33 D2 4C 89 74 24 ?? C7 44 24 ?? 04 00 08 00 44 89 74 24 ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 8B 5D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA FF FF FF FF 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? B8 01 00 00 00 EB ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 73 ?? 49 8B 7B ?? 4D 8B 73 ?? 49 8B E3 5D C3 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and any of ($bytes*)
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of ( $bytes* )
 }
 rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_2 : FILE
 {
 	meta:
 		description = "This rule looks for the binary signature of the routine that calls PssFreeSnapshot found in the Excavator-Reflector DLL."
 		author = "FireEye"
-		id = "89037b9a-78b0-5a8c-bb60-3d54842d81e1"
+		id = "9aa2b168-c8a0-52fa-9b5e-90a8ee91e907"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_2.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "6a9a114928554c26675884eeb40cc01b"
-		logic_hash = "408e8862f0c470105648fdba00dc5531ffcd739fa544f89acb70f0fa1b105c03"
+		logic_hash = "v1_sha256_408e8862f0c470105648fdba00dc5531ffcd739fa544f89acb70f0fa1b105c03"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129475,14 +129553,14 @@ rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_2 : FILE
 		$bytes4 = { 4C 89 74 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC A0 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? BA 50 00 00 00 C7 05 ?? ?? ?? ?? 43 00 3A 00 66 89 15 ?? ?? 01 00 4C 8D 44 24 ?? 48 8D 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 5C 00 57 00 33 C9 C7 05 ?? ?? ?? ?? 69 00 6E 00 C7 05 ?? ?? ?? ?? 64 00 6F 00 C7 05 ?? ?? ?? ?? 77 00 73 00 C7 05 ?? ?? ?? ?? 5C 00 4D 00 C7 05 ?? ?? ?? ?? 45 00 4D 00 C7 05 ?? ?? ?? ?? 4F 00 52 00 C7 05 ?? ?? ?? ?? 59 00 2E 00 C7 05 ?? ?? ?? ?? 44 00 4D 00 C7 05 ?? ?? ?? ?? 53 00 65 00 C7 05 ?? ?? ?? ?? 44 00 65 00 C7 05 ?? ?? ?? ?? 42 00 75 00 C7 05 ?? ?? ?? ?? 47 00 50 00 C7 05 ?? ?? ?? ?? 72 00 69 00 C7 05 ?? ?? ?? ?? 56 00 69 00 C7 05 ?? ?? ?? ?? 4C 00 45 00 C7 05 ?? ?? ?? ?? 67 00 65 00 C7 05 ?? ?? ?? ?? 6C 73 61 73 C7 05 ?? ?? ?? ?? 73 2E 65 78 C6 05 ?? ?? ?? ?? 65 FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? 01 00 00 00 C7 44 24 ?? 02 00 00 00 FF 15 ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 ?? 41 8D 56 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 44 24 ?? 4C 89 74 24 ?? 45 33 C9 33 D2 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 0F 1F 44 00 ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 41 B9 04 01 00 00 33 D2 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 ?? 48 89 BC 24 ?? ?? ?? ?? BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 4C 89 74 24 ?? C7 44 24 ?? 80 00 00 00 48 8D 0D ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 01 00 00 00 BA 00 00 00 10 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 ?? 41 B9 02 00 00 00 4C 89 74 24 ?? 4C 8B C7 8B D6 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B C8 FF 15 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? CC 48 8B CB FF 15 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 33 C0 48 8B B4 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 48 81 C4 A0 01 00 00 5D C3 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and any of ($bytes*)
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of ( $bytes* )
 }
 rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "e593b589-747d-53c2-a39a-57485e4f7641"
+		id = "b5eed807-5766-5b4a-9616-3d8c9fb6ebac"
 		date = "2020-11-30"
 		date = "2020-11-30"
 		modified = "2020-12-09"
@@ -129490,7 +129568,7 @@ rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_1.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "6a9a114928554c26675884eeb40cc01b"
-		logic_hash = "aa06628ddef0f95c4217b97a3476a0ee12e00d04c4827a512730598f3c80f1f6"
+		logic_hash = "v1_sha256_aa06628ddef0f95c4217b97a3476a0ee12e00d04c4827a512730598f3c80f1f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129503,14 +129581,14 @@ rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_1 : FILE
 		$lsass = { 6C 73 61 73 [6] 73 2E 65 78 [6] 65 }
 
 	condition:
-		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
+		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
 }
 rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "4b7640e8-5621-5cc3-8ac9-84347f23f5eb"
+		id = "41ad92ed-8ab3-5627-bbd9-3567bc147815"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -129518,7 +129596,7 @@ rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_2.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4fd62068e591cbd6f413e1c2b8f75442"
-		logic_hash = "14263c17323cd78df10f7f101bd7a9c74f7818b34a2e42125d45205067399381"
+		logic_hash = "v1_sha256_14263c17323cd78df10f7f101bd7a9c74f7818b34a2e42125d45205067399381"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129531,14 +129609,14 @@ rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_2 : FILE
 		$enable_dbg_pri = { 4C 8D 45 ?? 48 8D 15 [4] 33 C9 FF 15 [4] 85 C0 0F 84 [4] C7 45 ?? 01 00 00 00 B8 0C 00 00 00 48 6B C0 00 48 8B 4D ?? 48 89 4C 05 ?? B8 0C 00 00 00 48 6B C0 00 C7 44 05 ?? 02 00 00 00 FF 15 [4] 4C 8D 45 ?? BA 20 00 00 00 48 8B C8 FF 15 [4] 85 C0 74 ?? 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 45 ?? 33 D2 48 8B 4D ?? FF 15 }
 
 	condition:
-		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
+		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
 }
 rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_2
 {
 	meta:
 		description = "wmiexec"
 		author = "FireEye"
-		id = "f1059f66-eaff-5866-bafb-c94236cf96a0"
+		id = "ee6d458a-a2dc-5de4-80e6-e5ba069e429d"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -129546,7 +129624,7 @@ rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_2
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/IMPACKETOBF (Wmiexec)/production/yara/HackTool_PY_ImpacketObfuscation_2.yar#L4-L21"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "f3dd8aa567a01098a8a610529d892485"
-		logic_hash = "ccbbe507798f16c7acf0780770fdb81b2e7dc333ab8bc51e6216816276c3f14b"
+		logic_hash = "v1_sha256_ccbbe507798f16c7acf0780770fdb81b2e7dc333ab8bc51e6216816276c3f14b"
 		score = 75
 		quality = 75
 		tags = ""
@@ -129567,14 +129645,14 @@ rule FIREEYE_RT_Hacktool_MSIL_GETDOMAINPASSWORDPOLICY_1 : FILE
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the recon utility 'getdomainpasswordpolicy' project."
 		author = "FireEye"
-		id = "69745e99-33cc-5171-ae7a-5c98439a0b6d"
+		id = "4d0aab58-eb94-5396-8b3b-59f05763f413"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/GETDOMAINPASSWORDPOLICY/production/yara/HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "6b2ea3ebfea2c87f16052f4a43b64eb2d595c2dd4a64d45dfce1642668dcf602"
+		logic_hash = "v1_sha256_6b2ea3ebfea2c87f16052f4a43b64eb2d595c2dd4a64d45dfce1642668dcf602"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -129584,14 +129662,14 @@ rule FIREEYE_RT_Hacktool_MSIL_GETDOMAINPASSWORDPOLICY_1 : FILE
 		$typelibguid0 = "a5da1897-29aa-45f4-a924-561804276f08" ascii nocase wide
 
 	condition:
-		filesize <10MB and ( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize < 10MB and ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Loader_MSIL_WILDCHILD_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "b9e0707e-98eb-55da-ad1d-6a84bd113747"
+		id = "4bfdb131-26d3-5ba7-9355-3e94cbc4259b"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -129599,7 +129677,7 @@ rule FIREEYE_RT_APT_Loader_MSIL_WILDCHILD_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/APT_Loader_MSIL_WILDCHILD_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "6f04a93753ae3ae043203437832363c4"
-		logic_hash = "a600c3d127f77dc1f99160e4a242e005970de0abd1798296b6a351b968ca1350"
+		logic_hash = "v1_sha256_a600c3d127f77dc1f99160e4a242e005970de0abd1798296b6a351b968ca1350"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129611,21 +129689,21 @@ rule FIREEYE_RT_APT_Loader_MSIL_WILDCHILD_1 : FILE
 		$sb1 = { 6F [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 13 ?? 28 [2] 00 0A 28 [2] 00 0A 13 ?? 11 ?? 11 ?? 28 [2] 00 0A [0-16] 7B [2] 00 04 1? 20 [4] 28 [2] 00 0A 11 ?? 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 [0-16] 14 7E [2] 00 0A 7E [2] 00 0A 1? 20 04 00 08 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 [0-16] 7B [2] 00 04 7E [2] 00 0A [0-16] 8E ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 [4-120] 28 [2] 00 06 [0-80] 6F [2] 00 0A 6F [2] 00 0A 28 [2] 00 06 13 ?? 11 ?? 11 ?? 7E [2] 00 0A 28 [2] 00 06 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Dropper_HTA_Wildchild_1 : FILE
 {
 	meta:
 		description = "This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder."
 		author = "FireEye"
-		id = "f570baa5-7d58-5a0a-b713-769e62076f76"
+		id = "894b69c6-5bd8-59ae-a059-3b674f659390"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Dropper_HTA_WildChild_1.yar#L4-L24"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "3e61ca5057633459e96897f79970a46d"
-		logic_hash = "60c1d53b8a43b9b7518f3260a4d61c6806641ee894a2a331a3a0a2ea0aff9d99"
+		logic_hash = "v1_sha256_60c1d53b8a43b9b7518f3260a4d61c6806641ee894a2a331a3a0a2ea0aff9d99"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129644,21 +129722,21 @@ rule FIREEYE_RT_Dropper_HTA_Wildchild_1 : FILE
 		$script_header = "<script language=" ascii wide
 
 	condition:
-		$script_header at 0 and all of ($s*)
+		$script_header at 0 and all of ( $s* )
 }
 rule FIREEYE_RT_Loader_MSIL_Wildchild_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the WildChild project."
 		author = "FireEye"
-		id = "350dd658-46c9-573b-b532-07e4b437ba8d"
+		id = "ac56f673-76aa-504f-a5fb-721722f6bc2d"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Loader_MSIL_WildChild_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "7e6bc0ed11c2532b2ae7060327457812"
-		logic_hash = "e4320e33770613542182518ec787e4ccbb32f83c8afca5ec957d4846e6f4eb04"
+		logic_hash = "v1_sha256_e4320e33770613542182518ec787e4ccbb32f83c8afca5ec957d4846e6f4eb04"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -129668,21 +129746,21 @@ rule FIREEYE_RT_Loader_MSIL_Wildchild_1 : FILE
 		$typelibguid1 = "2e71d5ff-ece4-4006-9e98-37bb724a7780" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_Hunting_LNK_Win_Genericlauncher : FILE
 {
 	meta:
 		description = "Signature to detect LNK files or OLE objects with embedded LNK files and generic launcher commands, except powershell which is large enough to have its own gene"
 		author = "FireEye"
-		id = "1a12e475-bb18-55ab-b629-47b711c10e6b"
+		id = "d6892435-a809-5c29-a4f5-ff30bcea5dd1"
 		date = "2018-09-04"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LNKSMASHER/supplemental/yara/Hunting_LNK_Win_GenericLauncher.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "14dd758e8f89f14612c8df9f862c31e4"
-		logic_hash = "a654cd3594e2d09950fb11bf8721a5cdb89f5d5be6e706f12e18c7fcdf7dd0fe"
+		logic_hash = "v1_sha256_a654cd3594e2d09950fb11bf8721a5cdb89f5d5be6e706f12e18c7fcdf7dd0fe"
 		score = 60
 		quality = 53
 		tags = "FILE"
@@ -129698,21 +129776,21 @@ rule FIREEYE_RT_Hunting_LNK_Win_Genericlauncher : FILE
 		$header = { 4C 00 00 00 01 14 02 }
 
 	condition:
-		(($header at 0) or (( uint32(0)==0xE011CFD0) and $header)) and (1 of ($a*))
+		(( $header at 0 ) or ( ( uint32( 0 ) == 0xE011CFD0 ) and $header ) ) and ( 1 of ( $a* ) )
 }
 rule FIREEYE_RT_Dropper_LNK_Lnksmasher_1 : FILE
 {
 	meta:
 		description = "The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID."
 		author = "FireEye"
-		id = "1b93ddf8-9578-5e47-b479-4c9e8a40b4f4"
+		id = "8f6ef575-d02a-5aa2-8cd0-c7fe2cc6d186"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LNKSMASHER/production/yara/Dropper_LNK_LNKSmasher_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "0a86d64c3b25aa45428e94b6e0be3e08"
-		logic_hash = "61d1ac67ac0d332ad842a522cbebe1b9af1482d58a210b50fb45209355c0aeeb"
+		logic_hash = "v1_sha256_61d1ac67ac0d332ad842a522cbebe1b9af1482d58a210b50fb45209355c0aeeb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129732,14 +129810,14 @@ rule FIREEYE_RT_Methodology_OLE_CHARENCODING_2 : FILE
 	meta:
 		description = "Looking for suspicious char encoding"
 		author = "FireEye"
-		id = "7abd1a11-7a55-50ac-aa6b-537e7c59a5ab"
+		id = "ced72149-36f5-5eab-b2b2-54d8de5dee1e"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/supplemental/yara/Methodology_OLE_CHARENCODING_2.yar#L4-L23"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "41b70737fa8dda75d5e95c82699c2e9b"
-		logic_hash = "20843295531dfd88934fe0902a5101c5c0828e82df3289d7f263f16df9c92324"
+		logic_hash = "v1_sha256_20843295531dfd88934fe0902a5101c5c0828e82df3289d7f263f16df9c92324"
 		score = 65
 		quality = 75
 		tags = "FILE"
@@ -129757,21 +129835,21 @@ rule FIREEYE_RT_Methodology_OLE_CHARENCODING_2 : FILE
 		$pk3 = "80x75x3x4x" ascii wide
 
 	condition:
-		( uint32(0)==0xe011cfd0) and filesize <10MB and any of them
+		( uint32( 0 ) == 0xe011cfd0 ) and filesize < 10MB and any of them
 }
 rule FIREEYE_RT_Builder_MSIL_Sinfuloffice_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project."
 		author = "FireEye"
-		id = "cf020fb3-751b-5346-8c0d-dc0a552599a3"
+		id = "27e47bdc-4ef1-51b3-bc29-8cc46ff12171"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/production/yara/Builder_MSIL_SinfulOffice_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "b5d49a8720e4daa21e95ec66299daec42e65906017de886ea91f7bb6bfb04c77"
+		logic_hash = "v1_sha256_b5d49a8720e4daa21e95ec66299daec42e65906017de886ea91f7bb6bfb04c77"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -129781,21 +129859,21 @@ rule FIREEYE_RT_Builder_MSIL_Sinfuloffice_1 : FILE
 		$typelibguid0 = "9940e18f-e3c7-450f-801a-07dd534ccb9a" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Loader_MSIL_Generic_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "f919e3fc-cf76-53af-8f04-24921830666f"
+		id = "c00f45cf-ac73-5a72-967c-1c69f426585c"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_MSIL_Generic_1.yar#L4-L21"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "b8415b4056c10c15da5bba4826a44ffd"
-		logic_hash = "06cddd7e1c1c778348539cfd50f01d55f86689dec86c045d7ce7b9cd71690e07"
+		logic_hash = "v1_sha256_06cddd7e1c1c778348539cfd50f01d55f86689dec86c045d7ce7b9cd71690e07"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129812,14 +129890,14 @@ rule FIREEYE_RT_Loader_MSIL_Generic_1 : FILE
 		$str6 = "QueueUserAPC"
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and $MSIL and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and $MSIL and all of them
 }
 rule FIREEYE_RT_Loader_Win_Generic_19 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "4f4427ee-0f7d-5442-98a6-402d8b797289"
+		id = "d7c3a10c-df14-534f-9f76-dfaae40c5f07"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -129827,7 +129905,7 @@ rule FIREEYE_RT_Loader_Win_Generic_19 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_19.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "3fb9341fb11eca439b50121c6f7c59c7"
-		logic_hash = "6db9696663c19857c1f89339b8cc9b0565e877f34e8d8cf77b89ef22b3f41683"
+		logic_hash = "v1_sha256_6db9696663c19857c1f89339b8cc9b0565e877f34e8d8cf77b89ef22b3f41683"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129840,14 +129918,14 @@ rule FIREEYE_RT_Loader_Win_Generic_19 : FILE
 		$si2 = "malloc" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Loader_Win_Generic_20 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "d1d3eff8-d12e-53f6-8c30-06ecedaf3f49"
+		id = "1b08c0a8-1a05-5fc2-8f30-82b5808134d7"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -129855,7 +129933,7 @@ rule FIREEYE_RT_Loader_Win_Generic_20 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_20.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "5125979110847d35a338caac6bff2aa8"
-		logic_hash = "9611aed2b4e4278d40254cb5c4fe94a458cfa19f10e6fe888bc7ceb166669cc6"
+		logic_hash = "v1_sha256_9611aed2b4e4278d40254cb5c4fe94a458cfa19f10e6fe888bc7ceb166669cc6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129868,21 +129946,21 @@ rule FIREEYE_RT_Loader_Win_Generic_20 : FILE
 		$si2 = "malloc" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_REDTEAMMATERIALS_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'red_team_materials' project."
 		author = "FireEye"
-		id = "272cd3e9-884a-566b-ae90-4a79ee726a8d"
+		id = "dc012c59-eef2-5175-a22b-9119c4ccbe3a"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_REDTEAMMATERIALS_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "ca54a1e8335c4256295fc643f5d31eae2e89f020dc7a9b571c4772edaad08022"
+		logic_hash = "v1_sha256_ca54a1e8335c4256295fc643f5d31eae2e89f020dc7a9b571c4772edaad08022"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -129893,21 +129971,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_REDTEAMMATERIALS_1 : FILE
 		$typelibguid1 = "e06f1411-c7f8-4538-bbb9-46c928732245" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDACL_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdacl' project."
 		author = "FireEye"
-		id = "13f4e3ea-1e36-5fad-9197-66511d6f026a"
+		id = "599b10e5-318b-5c23-8cf7-e19da0da6956"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDACL_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "5f44ec5ddded18fb3a9132b469b2fe7ccbffb3f907325485f0f72fe3d6bbfa23"
+		logic_hash = "v1_sha256_5f44ec5ddded18fb3a9132b469b2fe7ccbffb3f907325485f0f72fe3d6bbfa23"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -129917,21 +129995,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDACL_1 : FILE
 		$typelibguid0 = "b3c17fb5-5d5a-4b14-af3c-87a9aa941457" ascii nocase wide
 
 	condition:
-		filesize <10MB and ( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize < 10MB and ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPWEBCRAWLER_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpwebcrawler' project."
 		author = "FireEye"
-		id = "29b2a410-bcc4-58df-b192-7a413b3db1c0"
+		id = "f9f74cf4-9200-52ca-b257-882d6f17ce94"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPWEBCRAWLER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "8df328663a813ca0a6864ae0503cbc1b03cfdf839215b9b4f2bb7962adf09bf8"
+		logic_hash = "v1_sha256_8df328663a813ca0a6864ae0503cbc1b03cfdf839215b9b4f2bb7962adf09bf8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -129941,21 +130019,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPWEBCRAWLER_1 : FILE
 		$typelibguid0 = "cf27abf4-ef35-46cd-8d0c-756630c686f1" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSQLCLIENT_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsqlclient' project."
 		author = "FireEye"
-		id = "4d526c36-f56f-53cf-9bdf-b7a15619eb41"
+		id = "a8fe10e4-c20e-5925-912d-b89bd38e0104"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPSQLCLIENT_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "bc79f80582f4fadecf54d926abdcf61694224654ba5075203f0d1123cf11afc1"
+		logic_hash = "v1_sha256_bc79f80582f4fadecf54d926abdcf61694224654ba5075203f0d1123cf11afc1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -129965,21 +130043,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSQLCLIENT_1 : FILE
 		$typelibguid0 = "13ed03cd-7430-410d-a069-cf377165fbfd" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNFS_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnfs' project."
 		author = "FireEye"
-		id = "b9d1b4e8-644a-5611-85e8-a124f915b443"
+		id = "6cb20e48-276c-5a13-bc3a-3c794550e367"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNFS_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "e7f9883376b153849970599d9ecc308882eb86a67834cfd8ab06b44539346125"
+		logic_hash = "v1_sha256_e7f9883376b153849970599d9ecc308882eb86a67834cfd8ab06b44539346125"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -129989,21 +130067,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNFS_1 : FILE
 		$typelibguid0 = "9f67ebe3-fc9b-40f2-8a18-5940cfed44cf" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDNS_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdns' project."
 		author = "FireEye"
-		id = "db6b45be-f42f-5d0f-b50a-32e7a2cbfce6"
+		id = "ce7ae7b5-97c7-5f94-9ce4-6cbb0052702f"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDNS_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "bab36f9b1532c3b24c2aea2907006820ed7cf1c90dae7a8138962e14ac9eff55"
+		logic_hash = "v1_sha256_bab36f9b1532c3b24c2aea2907006820ed7cf1c90dae7a8138962e14ac9eff55"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130013,21 +130091,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDNS_1 : FILE
 		$typelibguid0 = "d888cec8-7562-40e9-9c76-2bb9e43bb634" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPPATCHCHECK_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharppatchcheck' project."
 		author = "FireEye"
-		id = "dedc12b9-b9e7-5c13-ad6d-2e286aba2302"
+		id = "8b0a4243-d6a1-51b6-94a6-7200bb97723a"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPPATCHCHECK_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "dec6231b656eed1526d4f70fe1b9a476bfb06246f0a7c25f2687d8c68886d400"
+		logic_hash = "v1_sha256_dec6231b656eed1526d4f70fe1b9a476bfb06246f0a7c25f2687d8c68886d400"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130037,21 +130115,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPPATCHCHECK_1 : FILE
 		$typelibguid0 = "528b8df5-6e5e-4f3b-b617-ac35ed2f8975" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_MODIFIEDSHARPVIEW_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'modifiedsharpview' project."
 		author = "FireEye"
-		id = "e07d3d4b-fba3-5df7-85f4-927bb8cec2d1"
+		id = "acf9e600-04e7-5ab3-ac18-670f07c13698"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "db0eaad52465d5a2b86fdd6a6aa869a5"
-		logic_hash = "a47c48da998243fab92665649fb9d6ecc6ac32e1fd884c2c0d5ccecb05290c10"
+		logic_hash = "v1_sha256_a47c48da998243fab92665649fb9d6ecc6ac32e1fd884c2c0d5ccecb05290c10"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130061,21 +130139,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_MODIFIEDSHARPVIEW_1 : FILE
 		$typelibguid0 = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNATIVEZIPPER_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnativezipper' project."
 		author = "FireEye"
-		id = "c48835a7-06fe-5b30-be4d-086d98dc7a21"
+		id = "f5a07068-b035-5295-9ec7-df626dd6b06c"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNATIVEZIPPER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "fa54375b21abbb613e695f70a15233575fbe6e0536716544bb3b527f5e3ed8c6"
+		logic_hash = "v1_sha256_fa54375b21abbb613e695f70a15233575fbe6e0536716544bb3b527f5e3ed8c6"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130085,21 +130163,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNATIVEZIPPER_1 : FILE
 		$typelibguid0 = "de5536db-9a35-4e06-bc75-128713ea6d27" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_DNSOVERHTTPS_C2_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'DoHC2' External C2 project."
 		author = "FireEye"
-		id = "ee71be6c-e3c8-5365-9f32-157f00066c49"
+		id = "0c23b84a-cef2-508d-b8cb-0fb7e7dae977"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_DNSOVERHTTPS_C2_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "a482161bbd8e249977f28466ff1381d4693495f8b8ccd9183ae4fde1ec1471eb"
+		logic_hash = "v1_sha256_a482161bbd8e249977f28466ff1381d4693495f8b8ccd9183ae4fde1ec1471eb"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -130110,21 +130188,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_DNSOVERHTTPS_C2_1 : FILE
 		$typelibguid1 = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPTEMPLATE_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharptemplate' project."
 		author = "FireEye"
-		id = "0ca9a13c-e0a0-588b-be13-5954b17d95b1"
+		id = "016cacca-a0d5-51f1-94de-85dcd964aaf1"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPTEMPLATE_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "9746c1ab7b945d311c53fbdf95993d255369e06b23a3279c9f2e8a4df73ab63c"
+		logic_hash = "v1_sha256_9746c1ab7b945d311c53fbdf95993d255369e06b23a3279c9f2e8a4df73ab63c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130134,21 +130212,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPTEMPLATE_1 : FILE
 		$typelibguid0 = "e9e452d4-9e58-44ff-ba2d-01b158dda9bb" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Credtheft_MSIL_Credsnatcher_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CredSnatcher' project."
 		author = "FireEye"
-		id = "0d8f7495-4748-577d-8ef2-ccc4829fc165"
+		id = "3e5726f5-b45f-5d74-8e5d-b6720349ff50"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_CredSnatcher_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "2c86be1bcf29bcb2c167f9248dee0ab4a5a5c6740fb1f18784ee2e380176df91"
+		logic_hash = "v1_sha256_2c86be1bcf29bcb2c167f9248dee0ab4a5a5c6740fb1f18784ee2e380176df91"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130158,21 +130236,21 @@ rule FIREEYE_RT_Credtheft_MSIL_Credsnatcher_1 : FILE
 		$typelibguid0 = "370b4d21-09d0-433f-b7e4-4ebdd79948ec" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Credtheft_MSIL_Wcmdump_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WCMDump' project."
 		author = "FireEye"
-		id = "22796ccb-a01e-59d8-8c3a-6cbb62899940"
+		id = "10b38597-8f7f-5806-8005-4ae269513eb6"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_WCMDump_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "9fbf53e551342695b306b10f30a3fe32dff359bd70e84e1fa1f190772f5dcbe3"
+		logic_hash = "v1_sha256_9fbf53e551342695b306b10f30a3fe32dff359bd70e84e1fa1f190772f5dcbe3"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130182,21 +130260,21 @@ rule FIREEYE_RT_Credtheft_MSIL_Wcmdump_1 : FILE
 		$typelibguid0 = "21e322f2-4586-4aeb-b1ed-d240e2a79e19" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPZIPLIBZIPPER_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpziplibzipper' project."
 		author = "FireEye"
-		id = "392a52be-29ae-58e1-b517-1ab34a1e1fb8"
+		id = "1e4b7a6f-183d-5cd4-b170-88547011de5b"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "19354edb91a0d79fdf79437f7247bcf155514db40340af91a3320b556dc2e4c2"
+		logic_hash = "v1_sha256_19354edb91a0d79fdf79437f7247bcf155514db40340af91a3320b556dc2e4c2"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130206,21 +130284,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPZIPLIBZIPPER_1 : FILE
 		$typelibguid0 = "485ba350-59c4-4932-a4c1-c96ffec511ef" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_PRAT_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'prat' project."
 		author = "FireEye"
-		id = "4a876eb0-ed2f-5ef2-a9b3-ba728b07c8c0"
+		id = "fb38ea69-a7e9-54f2-84ca-93e3147c6579"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_PRAT_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "d707f017b56b0a873f1edca085ad40fc70cb24e8c9844f377bc28871a941d0b4"
+		logic_hash = "v1_sha256_d707f017b56b0a873f1edca085ad40fc70cb24e8c9844f377bc28871a941d0b4"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -130233,21 +130311,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_PRAT_1 : FILE
 		$typelibguid3 = "dfaa0b7d-6184-4a9a-9eeb-c08622d15801" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPGOPHER_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpgopher' project."
 		author = "FireEye"
-		id = "cc8eb9cd-9a51-5fab-b0a4-247baaa69dd7"
+		id = "75e19faf-b636-5603-8937-7124b74209a8"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPGOPHER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "ac37f77440cb76d7dafa4c9b4130471ca6ca760f6d72691db9ebb8cbaaad0c58"
+		logic_hash = "v1_sha256_ac37f77440cb76d7dafa4c9b4130471ca6ca760f6d72691db9ebb8cbaaad0c58"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130257,21 +130335,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPGOPHER_1 : FILE
 		$typelibguid0 = "83413a89-7f5f-4c3f-805d-f4692bc60173" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Tool_MSIL_Csharputils_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CSharpUtils' project."
 		author = "FireEye"
-		id = "a0e8c45a-759a-5611-aa2a-3113a75fb651"
+		id = "be8917c6-eadc-59a6-8cf2-6bb44c2fab2b"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPUTILS/production/yara/Tool_MSIL_CSharpUtils_1.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "11dfd44fb4ee1e610c2e4a941b3a1e88eafc30a2a2237529150e73bceb2a1324"
+		logic_hash = "v1_sha256_11dfd44fb4ee1e610c2e4a941b3a1e88eafc30a2a2237529150e73bceb2a1324"
 		score = 75
 		quality = 65
 		tags = "FILE"
@@ -130285,21 +130363,21 @@ rule FIREEYE_RT_Tool_MSIL_Csharputils_1 : FILE
 		$typelibguid4 = "ea383a0f-81d5-4fa8-8c57-a950da17e031" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Sharpstomp_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharpStomp project."
 		author = "FireEye"
-		id = "e113c221-fabe-5af4-b763-463c4f86288d"
+		id = "3889e8c2-1b76-50e3-b2a5-3fa8966a6e79"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/HackTool_MSIL_SharpStomp_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "83ed748cd94576700268d35666bf3e01"
-		logic_hash = "fd0a3d046734d48be74d9a74f27570468550d21911c54ca82c81a1d64e9fdd17"
+		logic_hash = "v1_sha256_fd0a3d046734d48be74d9a74f27570468550d21911c54ca82c81a1d64e9fdd17"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130309,14 +130387,14 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharpstomp_1 : FILE
 		$typelibguid1 = "41f35e79-2034-496a-8c82-86443164ada2" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "d1a3477d-55c6-5c33-bd65-5b1e0d65f24b"
+		id = "e164e66a-1e77-5e88-b328-aedbe60c39b7"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -130324,7 +130402,7 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_2.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "83ed748cd94576700268d35666bf3e01"
-		logic_hash = "4ed1553f12c607792d7d4e7026ecb36231cd417a06eba8b2925c2c643436b5fe"
+		logic_hash = "v1_sha256_4ed1553f12c607792d7d4e7026ecb36231cd417a06eba8b2925c2c643436b5fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130340,14 +130418,14 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_2 : FILE
 		$s5 = "SetLastAccessTime" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "4b4a54c8-9717-5fbb-8130-a49162bc6b07"
+		id = "e02d15b8-497d-53ca-888b-1609436b6a4f"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -130355,7 +130433,7 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_1.yar#L4-L24"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "83ed748cd94576700268d35666bf3e01"
-		logic_hash = "af8aa0e87d8b6623a908fde5014f3849cd0ca20d5926c798be82ce4eab2668bb"
+		logic_hash = "v1_sha256_af8aa0e87d8b6623a908fde5014f3849cd0ca20d5926c798be82ce4eab2668bb"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -130373,21 +130451,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_1 : FILE
 		$s8 = "SetLastAccessTime" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Backdoor_Win_Dshell_2 : FILE
 {
 	meta:
 		description = "This rule looks for strings specific to the D programming language in combination with a selection of Windows functions that are present within a DShell payload"
 		author = "FireEye"
-		id = "538e150f-0fb9-5a85-9299-9b4a57f8a606"
+		id = "4dbea9f6-ec01-5d9d-bcb5-14fa81c69fb7"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/supplemental/yara/APT_Backdoor_Win_DShell_2.yar#L4-L132"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e0683f8ee787313cfd2c61cd0995a830"
-		logic_hash = "2b4d33c17cac35153346002c48457d9b46010f1c052df632c647c22c8d96b54c"
+		logic_hash = "v1_sha256_2b4d33c17cac35153346002c48457d9b46010f1c052df632c647c22c8d96b54c"
 		score = 60
 		quality = 20
 		tags = "FILE"
@@ -130514,14 +130592,14 @@ rule FIREEYE_RT_APT_Backdoor_Win_Dshell_2 : FILE
 		$s105 = "lstrlenW"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and filesize >500KB and filesize >700KB and all of ($s*) and 1 of ($dlang*) and not $ign1 and not $ign2
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize > 500KB and filesize > 700KB and all of ( $s* ) and 1 of ( $dlang* ) and not $ign1 and not $ign2
 }
 rule FIREEYE_RT_APT_Loader_Win32_Dshell_3 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "6b6fccef-ac93-5f1b-b9b6-c2d3ee4d8da7"
+		id = "385b2fd9-a1e0-5296-806e-c55a1846cdb7"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -130529,7 +130607,7 @@ rule FIREEYE_RT_APT_Loader_Win32_Dshell_3 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_3.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "12c3566761495b8353f67298f15b882c"
-		logic_hash = "ec2a8b0abc6cb6d1861199b892fbe84782b42babb08e3ea203d10ab17ff7a20a"
+		logic_hash = "v1_sha256_ec2a8b0abc6cb6d1861199b892fbe84782b42babb08e3ea203d10ab17ff7a20a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130542,14 +130620,14 @@ rule FIREEYE_RT_APT_Loader_Win32_Dshell_3 : FILE
 		$ss3 = "core.sys.windows" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win32_Dshell_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "ae34d547-d979-5ce2-bcf8-a5b4e4567de3"
+		id = "2591120c-c97c-50c6-8db4-fcf8eb577608"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -130557,7 +130635,7 @@ rule FIREEYE_RT_APT_Loader_Win32_Dshell_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_2.yar#L4-L21"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "590d98bb74879b52b97d8a158af912af"
-		logic_hash = "958ff45add46c0a43e839e8007c1d9296ee89ddd8c045b8ec6b031b225207a6c"
+		logic_hash = "v1_sha256_958ff45add46c0a43e839e8007c1d9296ee89ddd8c045b8ec6b031b225207a6c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130572,14 +130650,14 @@ rule FIREEYE_RT_APT_Loader_Win32_Dshell_2 : FILE
 		$ss5 = "Invalid config file" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win32_Dshell_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "dad763bd-0e4a-542a-9920-ece11d23ce24"
+		id = "e2784967-a95d-5758-a917-989eae057db3"
 		date = "2020-11-27"
 		date = "2020-11-27"
 		modified = "2020-12-09"
@@ -130587,7 +130665,7 @@ rule FIREEYE_RT_APT_Loader_Win32_Dshell_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_1.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "12c3566761495b8353f67298f15b882c"
-		logic_hash = "79643f9c252765647d80f6fe1ee7bb698fbc6a6c3a0ff1fd819a09bff031907c"
+		logic_hash = "v1_sha256_79643f9c252765647d80f6fe1ee7bb698fbc6a6c3a0ff1fd819a09bff031907c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130601,14 +130679,14 @@ rule FIREEYE_RT_APT_Loader_Win32_Dshell_1 : FILE
 		$ss3 = "core.sys.windows" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "ce39710e-7649-5f7d-bbbe-65dc30f678e8"
+		id = "e2b7ad62-5ae3-5532-9727-2fa8a2f21db3"
 		date = "2020-12-04"
 		date = "2020-12-04"
 		modified = "2020-12-09"
@@ -130616,7 +130694,7 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_2.yar#L4-L21"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "11b5aceb428c3e8c61ed24a8ca50553e"
-		logic_hash = "872ab717668375a49d6c7b1927a680747b405c0198fe4fc6f43ccc562870eb37"
+		logic_hash = "v1_sha256_872ab717668375a49d6c7b1927a680747b405c0198fe4fc6f43ccc562870eb37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130631,14 +130709,14 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_2 : FILE
 		$s6 = "\x00Fluffy.Commands\x00"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "6593202d-9b30-59ed-98c0-3e730fb5ceb7"
+		id = "d35d3cf9-e208-5ce1-9d6e-2ae75457d5fb"
 		date = "2020-12-04"
 		date = "2020-12-04"
 		modified = "2020-12-09"
@@ -130646,7 +130724,7 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "11b5aceb428c3e8c61ed24a8ca50553e"
-		logic_hash = "4d91c96ab7b628e88f79ee193612acc959448fe2220ef54371f5f5c6e7305d86"
+		logic_hash = "v1_sha256_4d91c96ab7b628e88f79ee193612acc959448fe2220ef54371f5f5c6e7305d86"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130658,21 +130736,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_1 : FILE
 		$ss1 = "\x00Fluffy\x00"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_MSIL_Launcher_DUEDLLIGENCE_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'DUEDLLIGENCE' project."
 		author = "FireEye"
-		id = "86f0ebe5-110b-53e2-bba5-676f00c2cddd"
+		id = "91054593-376e-559c-a5a0-995fed98cb1b"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/MSIL_Launcher_DUEDLLIGENCE_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "a91bf61cc18705be2288a0f6f125068f"
-		logic_hash = "bd6abaa909f0c776d81ed1115e875888336661c91df3881f4f3ea5dd27e115f8"
+		logic_hash = "v1_sha256_bd6abaa909f0c776d81ed1115e875888336661c91df3881f4f3ea5dd27e115f8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130682,21 +130760,21 @@ rule FIREEYE_RT_MSIL_Launcher_DUEDLLIGENCE_1 : FILE
 		$typelibguid0 = "73948912-cebd-48ed-85e2-85fcd1d4f560" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_HOLSTER_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the a customized version of the 'DUEDLLIGENCE' project."
 		author = "FireEye"
-		id = "e1e8979e-2dee-5061-a11d-00dcfba476c3"
+		id = "78538dd6-2ce0-55da-af2d-3dda8c09b06c"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/HackTool_MSIL_HOLSTER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "a91bf61cc18705be2288a0f6f125068f"
-		logic_hash = "bc254a1ab71f2a6092f139ce5a85347a7a4976f963603ffbbebb9b0d6ce6573c"
+		logic_hash = "v1_sha256_bc254a1ab71f2a6092f139ce5a85347a7a4976f963603ffbbebb9b0d6ce6573c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130706,22 +130784,20 @@ rule FIREEYE_RT_Hacktool_MSIL_HOLSTER_1 : FILE
 		$typelibguid1 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "b10b476a-0d38-53e4-80cf-559618729268"
+		id = "9a464f4a-0c3e-5ef8-82b5-764e423cacd5"
 		date = "2020-12-18"
 		modified = "2020-12-18"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_2.yar#L5-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "5a2e0559e3b47c1957a42929fbbeba7a53c21619125381b01dcd8453b6ec4802"
+		logic_hash = "v1_sha256_5a2e0559e3b47c1957a42929fbbeba7a53c21619125381b01dcd8453b6ec4802"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130732,22 +130808,20 @@ rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_2 : FILE
 		$iz1 = /_Cor(Exe|Dll)Main/ fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
-import "pe"
-
 rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_3 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "42e4e777-6d51-5733-97df-dc27f13a27b7"
+		id = "d64c1de1-d2a8-5302-8c89-1ccfca46efeb"
 		date = "2020-12-18"
 		modified = "2020-12-18"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_3.yar#L5-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "41cc6a4c7765b1e5e88d12660b69e434c83938ca974b9ccf6545b4dd5dd78378"
+		logic_hash = "v1_sha256_41cc6a4c7765b1e5e88d12660b69e434c83938ca974b9ccf6545b4dd5dd78378"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130759,22 +130833,20 @@ rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_3 : FILE
 		$suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
-import "pe"
-
 rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "d438575f-3cb2-5cff-b5d4-733044f62e61"
+		id = "7ec29155-855e-56e2-9c48-05e1f73f7405"
 		date = "2020-12-18"
 		modified = "2020-12-18"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_1.yar#L5-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "56237d686b954950849adeedc87d5f9fbff2335a0ff033ba8571b3e3b93f587c"
+		logic_hash = "v1_sha256_56237d686b954950849adeedc87d5f9fbff2335a0ff033ba8571b3e3b93f587c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130785,21 +130857,21 @@ rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_1 : FILE
 		$suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Corehound_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CoreHound' project."
 		author = "FireEye"
-		id = "8c914b34-3e3d-53ae-a5e4-9dbfdff45a24"
+		id = "e78cdb17-d4d1-5ed0-8a16-8a24ab478c13"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/COREHOUND/production/yara/HackTool_MSIL_CoreHound_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "b0f759709428d5c9404507a13259bf85cb8c405d38b807539098f7cc871023d8"
+		logic_hash = "v1_sha256_b0f759709428d5c9404507a13259bf85cb8c405d38b807539098f7cc871023d8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130809,14 +130881,14 @@ rule FIREEYE_RT_Hacktool_MSIL_Corehound_1 : FILE
 		$typelibguid0 = "1fff2aee-a540-4613-94ee-4f208b30c599" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Loader_Win_Generic_17 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "4e5bf741-c1e3-54af-9580-02925ba6fc6a"
+		id = "9fc06c64-0498-5606-8616-d6bea2700655"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -130824,7 +130896,7 @@ rule FIREEYE_RT_Loader_Win_Generic_17 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Loader_Win_Generic_17.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "562ecbba043552d59a0f23f61cea0983"
-		logic_hash = "5c20472c3af0c5b8c825671b12763900d6a711695ed04661b33cbf442422348d"
+		logic_hash = "v1_sha256_5c20472c3af0c5b8c825671b12763900d6a711695ed04661b33cbf442422348d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130837,14 +130909,14 @@ rule FIREEYE_RT_Loader_Win_Generic_17 : FILE
 		$si2 = "fwrite" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Trojan_Win_Generic_101 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "0290aaea-d65b-5883-97f9-549d107e3e1f"
+		id = "42e93143-87c1-518f-a09a-021e871a8bbe"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -130852,7 +130924,7 @@ rule FIREEYE_RT_Trojan_Win_Generic_101 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Trojan_Win_Generic_101.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "2e67c62bd0307c04af469ee8dcb220f2"
-		logic_hash = "e530183f3cab01560b1abc91e2111e5d9e5aadc1c8134027ac07d8917f9419a0"
+		logic_hash = "v1_sha256_e530183f3cab01560b1abc91e2111e5d9e5aadc1c8134027ac07d8917f9419a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130866,14 +130938,14 @@ rule FIREEYE_RT_Trojan_Win_Generic_101 : FILE
 		$si2 = "PostThreadMessageA" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and @s0[1]<@s1[1] and @s1[1]<@s2[1] and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and @s0 [ 1 ] < @s1 [ 1 ] and @s1 [ 1 ] < @s2 [ 1 ] and all of them
 }
 rule FIREEYE_RT_Trojan_Raw_Generic_4 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "9092f9bb-cab6-55c0-9452-70a6407db93a"
+		id = "b8ea8a99-aaf6-5109-b1a5-acb5dc76e1c2"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -130881,7 +130953,7 @@ rule FIREEYE_RT_Trojan_Raw_Generic_4 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Trojan_Raw_Generic_4.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "f41074be5b423afb02a74bc74222e35d"
-		logic_hash = "8ffd23631c1a9d1abe6695858ec34d61261b3b3f097be94372f3f34e46e7211e"
+		logic_hash = "v1_sha256_8ffd23631c1a9d1abe6695858ec34d61261b3b3f097be94372f3f34e46e7211e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130892,14 +130964,14 @@ rule FIREEYE_RT_Trojan_Raw_Generic_4 : FILE
 		$s1 = { 0F B? [1-16] 4D 5A [1-32] 3C [16-64] 50 45 [8-32] C3 }
 
 	condition:
-		uint16(0)!=0x5A4D and all of them
+		uint16( 0 ) != 0x5A4D and all of them
 }
 rule FIREEYE_RT_Loader_Win_Generic_18 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "6f44bd64-29bd-50e2-8b61-7ba61bb1f688"
+		id = "e1df0f66-0e93-5855-9813-888f97068a1f"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -130907,7 +130979,7 @@ rule FIREEYE_RT_Loader_Win_Generic_18 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Loader_Win_Generic_18.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "c74ebb6c238bbfaefd5b32d2bf7c7fcc"
-		logic_hash = "28c9497f646fcf3daf7007d7afd37971dd85382062c064173f13049ad419fef1"
+		logic_hash = "v1_sha256_28c9497f646fcf3daf7007d7afd37971dd85382062c064173f13049ad419fef1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130920,21 +130992,21 @@ rule FIREEYE_RT_Loader_Win_Generic_18 : FILE
 		$si2 = "fwrite" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_1 : FILE
 {
 	meta:
 		description = "This rule looks for .NET PE files that have regex and format strings found in the public tool SeatBelt. Due to the nature of the regex and format strings used for detection, this rule should detect custom variants of the SeatBelt project."
 		author = "FireEye"
-		id = "46477f87-2458-5b8e-894a-9aa536a441ad"
+		id = "b249aafc-e1ee-5ab7-b2cc-be9e18a8574b"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_1.yar#L4-L25"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "848837b83865f3854801be1f25cb9f4d"
-		logic_hash = "4248e5561ef60e725c23efc89c899d6fc8be5bf2142f700fb70daecd72c30dd8"
+		logic_hash = "v1_sha256_4248e5561ef60e725c23efc89c899d6fc8be5bf2142f700fb70daecd72c30dd8"
 		score = 75
 		quality = 30
 		tags = "FILE"
@@ -130954,21 +131026,21 @@ rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_1 : FILE
 		$str10 = "{0,-23}" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
 }
 rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_2 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SeatBelt project."
 		author = "FireEye"
-		id = "225b42fe-c73a-59c0-a1f4-1d6dff6e76e1"
+		id = "ad506948-35f2-565d-bf22-be4a0fe5fefd"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_2.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "9f401176a9dd18fa2b5b90b4a2aa1356"
-		logic_hash = "e48474c5025fd88e3c2824e1e943ff56cde0ea05984aad0249ccf73caa6d4a36"
+		logic_hash = "v1_sha256_e48474c5025fd88e3c2824e1e943ff56cde0ea05984aad0249ccf73caa6d4a36"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -130978,21 +131050,21 @@ rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_2 : FILE
 		$typelibguid1 = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_Loader_MSIL_Inmemorycompilation_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'In-MemoryCompilation' project."
 		author = "FireEye"
-		id = "80234352-a449-5292-9f0c-beb7a1d39a6c"
+		id = "14d782eb-a59b-5e4a-83a7-4d3108cec20d"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MEMCOMP/production/yara/Loader_MSIL_InMemoryCompilation_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "a964a186eb02a2792db01727a31ddaa2414fe9df83cda9b1c9db15d94603303a"
+		logic_hash = "v1_sha256_a964a186eb02a2792db01727a31ddaa2414fe9df83cda9b1c9db15d94603303a"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131002,21 +131074,21 @@ rule FIREEYE_RT_Loader_MSIL_Inmemorycompilation_1 : FILE
 		$typelibguid0 = "524d2687-0042-4f93-b695-5579f3865205" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "49d7891e-b97a-52a8-acfd-bbf986732d6c"
+		id = "85f8ae70-5f1e-5e05-a06f-8bb6072756ed"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_2.yar#L4-L23"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "98ecf58d48a3eae43899b45cec0fc6b7"
-		logic_hash = "57387352f8fd08e8b859dffc1164d46370f248b337526c265634160010572a00"
+		logic_hash = "v1_sha256_57387352f8fd08e8b859dffc1164d46370f248b337526c265634160010572a00"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131035,21 +131107,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_2 : FILE
 		$pdb2 = "\\SharPersist.pdb"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ((@pdb2[1]<@pdb1[1]+50) or (1 of ($a*) and 2 of ($b*)))
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( ( @pdb2 [ 1 ] < @pdb1 [ 1 ] + 50 ) or ( 1 of ( $a* ) and 2 of ( $b* ) ) )
 }
 rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPersist project."
 		author = "FireEye"
-		id = "586e6c91-6970-57d1-8d8c-05ae9eb6117a"
+		id = "9a2fb205-2f1e-5a99-bc51-2e03518a15a9"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "98ecf58d48a3eae43899b45cec0fc6b7"
-		logic_hash = "cf480026c31b522850e25ba2d7986773d9c664242a2667ecd33151621c98c91e"
+		logic_hash = "v1_sha256_cf480026c31b522850e25ba2d7986773d9c664242a2667ecd33151621c98c91e"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131059,21 +131131,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_1 : FILE
 		$typelibguid1 = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_Loader_MSIL_Csharpsectioninjection_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'C_Sharp_SectionInjection' project."
 		author = "FireEye"
-		id = "ca5bf5cd-1950-53ed-8984-e880a15e658e"
+		id = "c0d32b27-050c-5f1c-a145-db627ade6ed1"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSECTIONINJECTION/production/yara/Loader_MSIL_CSharpSectionInjection_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "011cf4dffe6ef90a79cdfabb0e297152c00b0404b1801f56fd7e703ab90b1692"
+		logic_hash = "v1_sha256_011cf4dffe6ef90a79cdfabb0e297152c00b0404b1801f56fd7e703ab90b1692"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131083,14 +131155,14 @@ rule FIREEYE_RT_Loader_MSIL_Csharpsectioninjection_1 : FILE
 		$typelibguid0 = "d77135da-0496-4b5c-9afe-e1590a4c136a" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_Win32_Andrewspecial_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "69e27e92-d68e-5543-bada-170e32733dbb"
+		id = "45309439-9b67-5a21-b6a1-bd0c255485d9"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -131098,7 +131170,7 @@ rule FIREEYE_RT_Hacktool_Win32_Andrewspecial_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/HackTool_Win32_AndrewSpecial_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e89efa88e3fda86be48c0cc8f2ef7230"
-		logic_hash = "529a49fb21250069111d03a174901dc2e1623ee2a1f446aae1bdb1579a227dd3"
+		logic_hash = "v1_sha256_529a49fb21250069111d03a174901dc2e1623ee2a1f446aae1bdb1579a227dd3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131110,21 +131182,21 @@ rule FIREEYE_RT_Hacktool_Win32_Andrewspecial_1 : FILE
 		$shellcode_x86_inline = { C6 45 ?? B8 C6 45 ?? 3C C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 33 C6 45 ?? C9 C6 45 ?? 8D C6 45 ?? 54 C6 45 ?? 24 C6 45 ?? 04 C6 45 ?? 64 C6 45 ?? FF C6 45 ?? 15 C6 45 ?? C0 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 83 C6 45 ?? C4 C6 45 ?? 04 C6 45 ?? C2 C6 45 ?? 14 C6 45 ?? 00 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and $dump and any of ($shellcode*)
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and $dump and any of ( $shellcode* )
 }
 rule FIREEYE_RT_Credtheft_MSIL_Titospecial_2 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the TitoSpecial project. There are 2 GUIDs in this rule as the x86 and x64 versions of this tool use a different ProjectGuid."
 		author = "FireEye"
-		id = "0262c720-e6b8-5bf2-a242-19a7f044973f"
+		id = "5d091e1e-204f-5c97-9c99-9ec005b1560b"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_2.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4bf96a7040a683bd34c618431e571e26"
-		logic_hash = "2f621f8de2a4679e6cbce7f41859eaa3095ca54090c8bfccd3b767590ac91f2c"
+		logic_hash = "v1_sha256_2f621f8de2a4679e6cbce7f41859eaa3095ca54090c8bfccd3b767590ac91f2c"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -131135,21 +131207,21 @@ rule FIREEYE_RT_Credtheft_MSIL_Titospecial_2 : FILE
 		$typelibguid2 = "3b5320cf-74c1-494e-b2c8-a94a24380e60" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ($typelibguid1 or $typelibguid2)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( $typelibguid1 or $typelibguid2 )
 }
 rule FIREEYE_RT_Credtheft_MSIL_Titospecial_1 : FILE
 {
 	meta:
 		description = "This rule looks for .NET PE files that have the strings of various method names in the TitoSpecial code."
 		author = "FireEye"
-		id = "932bb013-03de-5cf7-89e9-b3232151d303"
+		id = "6cc98531-bcf1-5ead-a5b5-b8da6520076c"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_1.yar#L4-L27"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4bf96a7040a683bd34c618431e571e26"
-		logic_hash = "4ac9a5ede4aea5d73545b459eb635f87ce08ba521afa48b76d2cfa94f1379226"
+		logic_hash = "v1_sha256_4ac9a5ede4aea5d73545b459eb635f87ce08ba521afa48b76d2cfa94f1379226"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131171,14 +131243,14 @@ rule FIREEYE_RT_Credtheft_MSIL_Titospecial_1 : FILE
 		$str13 = "GetProcAddress" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of ($str*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $str* )
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_TITOSPECIAL_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "b12490ba-41f6-5469-bcbb-0d2e0055c193"
+		id = "dd2992ec-d99b-5cf0-8b1e-d199c61569a2"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -131186,7 +131258,7 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_TITOSPECIAL_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/APT_HackTool_MSIL_TITOSPECIAL_1.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4bf96a7040a683bd34c618431e571e26"
-		logic_hash = "6def0c667d38c1bad9233628e509bdcaed322e75be4ff3823b0f788c391e090c"
+		logic_hash = "v1_sha256_6def0c667d38c1bad9233628e509bdcaed322e75be4ff3823b0f788c391e090c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131200,14 +131272,14 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_TITOSPECIAL_1 : FILE
 		$shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of ($ind*) and any of ($shellcode*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $ind* ) and any of ( $shellcode* )
 }
 rule FIREEYE_RT_Hacktool_Win64_Andrewspecial_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "20ce4902-4eb3-5ecf-aa8c-0515965dde57"
+		id = "2b12f9f3-4e8c-559f-9b7e-e4c6e547da8c"
 		date = "2020-11-25"
 		date = "2020-11-25"
 		modified = "2020-12-09"
@@ -131215,7 +131287,7 @@ rule FIREEYE_RT_Hacktool_Win64_Andrewspecial_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/HackTool_Win64_AndrewSpecial_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "4456e52f6f8543c3ba76cb25ea3e9bd2"
-		logic_hash = "96f06c46dfec795fcfd08c188853d0a3f781003ae118833719a175eb59049c0d"
+		logic_hash = "v1_sha256_96f06c46dfec795fcfd08c188853d0a3f781003ae118833719a175eb59049c0d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131227,21 +131299,21 @@ rule FIREEYE_RT_Hacktool_Win64_Andrewspecial_1 : FILE
 		$shellcode_x64_inline = { C6 44 24 ?? 4C C6 44 24 ?? 8B C6 44 24 ?? D1 C6 44 24 ?? B8 C6 44 24 ?? 3C C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 0F C6 44 24 ?? 05 C6 44 24 ?? C3 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and $dump and any of ($shellcode*)
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and $dump and any of ( $shellcode* )
 }
 rule FIREEYE_RT_Loader_MSIL_Netassemblyinject_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NET-Assembly-Inject' project."
 		author = "FireEye"
-		id = "62a7dc4c-678b-5f13-9661-4679eafe1c72"
+		id = "15ac2d3d-feb4-5ef9-ae3e-3c1414c131f1"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NETASSEMBLYINJECT/production/yara/Loader_MSIL_NETAssemblyInject_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "9a43df9ee26a44f4db5c2d22fbc1a6c86c5af0c9d44a79c6627a4cc8cf31bb8d"
+		logic_hash = "v1_sha256_9a43df9ee26a44f4db5c2d22fbc1a6c86c5af0c9d44a79c6627a4cc8cf31bb8d"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -131253,22 +131325,20 @@ rule FIREEYE_RT_Loader_MSIL_Netassemblyinject_1 : FILE
 		$typelibguid2 = "e8fa7329-8074-4675-9588-d73f88a8b5b6" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule FIREEYE_RT_FE_APT_Loader_MSIL_REVOLVER_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "d99620e0-39ed-58db-acce-0d885a9e0bf7"
+		id = "1303f53e-74d5-5e12-82b6-99b484b6b222"
 		date = "2020-12-18"
 		modified = "2020-12-18"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REVOLVER/production/yara/APT_Loader_MSIL_REVOLVER_1.yar#L5-L14"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "1231f4c961dec122ebcb142052c2c7c03acf9b556cdb71a3efabde6bcf50a939"
+		logic_hash = "v1_sha256_1231f4c961dec122ebcb142052c2c7c03acf9b556cdb71a3efabde6bcf50a939"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131278,21 +131348,21 @@ rule FIREEYE_RT_FE_APT_Loader_MSIL_REVOLVER_1 : FILE
 		$iz1 = /_Cor(Exe|Dll)Main/ fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_REVOLVER_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'revolver' project."
 		author = "FireEye"
-		id = "8fa5adb7-dc66-51bc-9f60-2308515f33a8"
+		id = "7946b3d8-ddbb-5b96-a546-1a9de85526cc"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REVOLVER/production/yara/APT_HackTool_MSIL_REVOLVER_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "8df8a56ed55b7857adb95daa643d544a49eb5f1952b4ad3ef757c34dad2ce317"
+		logic_hash = "v1_sha256_8df8a56ed55b7857adb95daa643d544a49eb5f1952b4ad3ef757c34dad2ce317"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -131303,21 +131373,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_REVOLVER_1 : FILE
 		$typelibguid1 = "b214d962-7595-440b-abef-f83ecdb999d2" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_PXELOOT_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the PXE And Loot project."
 		author = "FireEye"
-		id = "5a72a6ff-bae4-57f5-a19b-a4595ac57293"
+		id = "bf6a1eba-c96d-591f-b527-dd9060ba71d4"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PXELOOT/production/yara/HackTool_MSIL_PXELOOT_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "82e33011ac34adfcced6cddc8ea56a81"
-		logic_hash = "c9892adcb9ff5471235e45988f6662d3b8f984fdafca7024a5781eed50f6c0b3"
+		logic_hash = "v1_sha256_c9892adcb9ff5471235e45988f6662d3b8f984fdafca7024a5781eed50f6c0b3"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131327,14 +131397,14 @@ rule FIREEYE_RT_Hacktool_MSIL_PXELOOT_1 : FILE
 		$typelibguid1 = "78B2197B-2E56-425A-9585-56EDC2C797D6" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "1a3f4247-25f4-51ca-b881-209c0753b915"
+		id = "634c4bcb-3624-50f7-b933-cd7664c83ca5"
 		date = "2020-12-03"
 		date = "2020-12-03"
 		modified = "2020-12-09"
@@ -131342,7 +131412,7 @@ rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_1.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
-		logic_hash = "f020efff58c8b7761d700c662c422a9e1ffdf8fe5f6648e421b7c257e3b8d078"
+		logic_hash = "v1_sha256_f020efff58c8b7761d700c662c422a9e1ffdf8fe5f6648e421b7c257e3b8d078"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131358,21 +131428,21 @@ rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_1 : FILE
 		$tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and (@sb1[1]<@sb2[1]) and ( all of ($ss*)) and ( all of ($tb*))
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( @sb1 [ 1 ] < @sb2 [ 1 ] ) and ( all of ( $ss* ) ) and ( all of ( $tb* ) )
 }
 rule FIREEYE_RT_Loader_MSIL_Ruralbishop_3 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public RuralBishop project."
 		author = "FireEye"
-		id = "55a060ef-74e2-50d9-9090-558aaa04d97d"
+		id = "9056d9c0-ffb4-5636-bbce-51a1ac6a51df"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/Loader_MSIL_RuralBishop_3.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "09bdbad8358b04994e2c04bb26a160ef"
-		logic_hash = "a4c55dede432c249e36e96ca09555448b0343969d389bfdb4bd459fe34e05ea1"
+		logic_hash = "v1_sha256_a4c55dede432c249e36e96ca09555448b0343969d389bfdb4bd459fe34e05ea1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131382,14 +131452,14 @@ rule FIREEYE_RT_Loader_MSIL_Ruralbishop_3 : FILE
 		$typelibguid1 = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "90ee2569-2e68-517b-b2d7-8c4015d92683"
+		id = "28fd8856-8579-5236-a7f5-b0a301d50f6c"
 		date = "2020-12-03"
 		date = "2020-12-03"
 		modified = "2020-12-09"
@@ -131397,7 +131467,7 @@ rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_2.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "c0598321d4ad4cf1219cc4f84bad4094"
-		logic_hash = "4cccfca0c06954105f762066741b6c35599a6c28df8b7c255a2659059169578f"
+		logic_hash = "v1_sha256_4cccfca0c06954105f762066741b6c35599a6c28df8b7c255a2659059169578f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131413,21 +131483,21 @@ rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_2 : FILE
 		$tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Loader_MSIL_Trimbishop_1 : FILE
 {
 	meta:
 		description = "This rule looks for .NET PE files that have the string 'msg' more than 60 times as well as numerous function names unique to or used by the TrimBishop tool. All strings found in RuralBishop are reversed in TrimBishop and stored in a variable with the format 'msg##'. With the exception of 'msg', 'DTrim', and 'ReverseString' the other strings referenced in this rule may be shared with RuralBishop."
 		author = "FireEye"
-		id = "4d58f0a2-bf16-584c-8e92-c8ef54427767"
+		id = "f41e4fa7-318f-5a0c-bb18-662c1298a308"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/Loader_MSIL_TrimBishop_1.yar#L4-L26"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "09bdbad8358b04994e2c04bb26a160ef"
-		logic_hash = "018e87542301db22c384fda2709e8d49711c0fa041d1ef591f98ee7a70dbb677"
+		logic_hash = "v1_sha256_018e87542301db22c384fda2709e8d49711c0fa041d1ef591f98ee7a70dbb677"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -131448,14 +131518,14 @@ rule FIREEYE_RT_Loader_MSIL_Trimbishop_1 : FILE
 		$str10 = "NtQueryInformationThread" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and #msg>60 and all of ($str*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and #msg > 60 and all of ( $str* )
 }
 rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "1b5f1f39-9fa2-5940-8da3-03808e4b7a5d"
+		id = "30be2169-83e5-5c66-8dbc-04e422803d31"
 		date = "2020-12-03"
 		date = "2020-12-03"
 		modified = "2020-12-09"
@@ -131463,7 +131533,7 @@ rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_1.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
-		logic_hash = "f2244c6761639c1162a77a5e82296903c3cc21fbf46d262c779c5e4d6a2ef937"
+		logic_hash = "v1_sha256_f2244c6761639c1162a77a5e82296903c3cc21fbf46d262c779c5e4d6a2ef937"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131479,14 +131549,14 @@ rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_1 : FILE
 		$tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and (@sb1[1]<@sb2[1]) and ( all of ($ss*)) and ( all of ($tb*))
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( @sb1 [ 1 ] < @sb2 [ 1 ] ) and ( all of ( $ss* ) ) and ( all of ( $tb* ) )
 }
 rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "3befb3f2-81d1-5db2-84d9-773158b9837c"
+		id = "f449e36c-48bb-5ddc-a209-0d2bebb04c08"
 		date = "2020-12-03"
 		date = "2020-12-03"
 		modified = "2020-12-09"
@@ -131494,7 +131564,7 @@ rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_2.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
-		logic_hash = "0467532d643cf0200c6561b0724c884230892bf59db163c311b7d4f8acbb63d6"
+		logic_hash = "v1_sha256_0467532d643cf0200c6561b0724c884230892bf59db163c311b7d4f8acbb63d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131510,21 +131580,21 @@ rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_2 : FILE
 		$tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_GPOHUNT_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'gpohunt' project."
 		author = "FireEye"
-		id = "e4325f11-103c-5893-8978-9a72f7ca6105"
+		id = "0f15c2c4-6ba2-5418-9a10-cbf857a03dd3"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/GPOHUNT/production/yara/APT_HackTool_MSIL_GPOHUNT_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "4b1f175dac123a6340494e2730d66c718478fb7618dc5611315992ed33e0f6c7"
+		logic_hash = "v1_sha256_4b1f175dac123a6340494e2730d66c718478fb7618dc5611315992ed33e0f6c7"
 		score = 50
 		quality = 73
 		tags = "FILE"
@@ -131534,20 +131604,20 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_GPOHUNT_1 : FILE
 		$typelibguid0 = "751a9270-2de0-4c81-9e29-872cd6378303" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "f2826dbb-f0a4-5361-94d1-8509c60c4131"
+		id = "b1edf3ed-a0bf-5d9e-bddd-f6804692f27d"
 		date = "2020-12-18"
 		modified = "2020-12-18"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_2.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "700927768669eda6976071306e991bfaae136279f4265980521597c699fbed88"
+		logic_hash = "v1_sha256_700927768669eda6976071306e991bfaae136279f4265980521597c699fbed88"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131563,20 +131633,20 @@ rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_2 : FILE
 		$ss8 = "\x00VirtualProtect\x00"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "970a869e-bd69-5609-bb8d-77bfa78b0630"
+		id = "25374fb5-62ac-5b72-a2a4-5fb8d702f92e"
 		date = "2020-12-18"
 		modified = "2020-12-18"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "2d73d434ac39ebde990aca817a54208cd04bfbce33f1bcadcf48a50d9389658c"
+		logic_hash = "v1_sha256_2d73d434ac39ebde990aca817a54208cd04bfbce33f1bcadcf48a50d9389658c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131590,21 +131660,21 @@ rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_1 : FILE
 		$ss5 = "1F 8B 08 00 00 00 00 00" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_LUALOADER_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'lualoader' project."
 		author = "FireEye"
-		id = "e8480cf8-1852-5572-8e92-c0ae676b7507"
+		id = "d3f1cce8-21f0-53fb-9eb7-a0f84c72762e"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_HackTool_MSIL_LUALOADER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "7e9f9836ec91aa66c8779588cfceff718487f0cb5048d17538c947aba687a4cf"
+		logic_hash = "v1_sha256_7e9f9836ec91aa66c8779588cfceff718487f0cb5048d17538c947aba687a4cf"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131614,21 +131684,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_LUALOADER_1 : FILE
 		$typelibguid0 = "8b546b49-2b2c-4577-a323-76dc713fe2ea" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Loader_MSIL_Netshshellcoderunner_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NetshShellCodeRunner' project."
 		author = "FireEye"
-		id = "b3521812-7ea3-5f80-89bd-3bdd71b687f2"
+		id = "714fda48-c2d7-5551-b1fe-47489b271028"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NETSHSHELLCODERUNNER/production/yara/Loader_MSIL_NetshShellCodeRunner_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "97f6475a9d42697f633e06a9b04a85021ca4920145eb4af257d71b431448f0e9"
+		logic_hash = "v1_sha256_97f6475a9d42697f633e06a9b04a85021ca4920145eb4af257d71b431448f0e9"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131638,21 +131708,21 @@ rule FIREEYE_RT_Loader_MSIL_Netshshellcoderunner_1 : FILE
 		$typelibguid0 = "49c045bc-59bb-4a00-85c3-4beb59b2ee12" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Wmisharp_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMISharp' project."
 		author = "FireEye"
-		id = "97b9d057-30d3-5af7-bac6-4dd53f47650f"
+		id = "a577ee06-dce7-56e6-b7d6-eefc70d63fce"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISHARP/production/yara/HackTool_MSIL_WMISharp_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "d119d52c1410291d582696d5c4c1de3db9008db963c76a9e344959d869c3acc0"
+		logic_hash = "v1_sha256_d119d52c1410291d582696d5c4c1de3db9008db963c76a9e344959d869c3acc0"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131662,21 +131732,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Wmisharp_1 : FILE
 		$typelibguid0 = "3a2421d9-c1aa-4fff-ad76-7fcb48ed4bff" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_SAFETYKATZ_4 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project."
 		author = "FireEye"
-		id = "e160b75d-cc39-5e16-86e1-cba9fe64a6b6"
+		id = "3fa4e007-6e81-56e0-ad0a-c30c80d0291b"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SAFETYKATZ/production/yara/HackTool_MSIL_SAFETYKATZ_4.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "45736deb14f3a68e88b038183c23e597"
-		logic_hash = "a02b4acea691d485f427ed26487f2f601065901324a8dcd6cd8de9502d8cd897"
+		logic_hash = "v1_sha256_a02b4acea691d485f427ed26487f2f601065901324a8dcd6cd8de9502d8cd897"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131686,14 +131756,14 @@ rule FIREEYE_RT_Hacktool_MSIL_SAFETYKATZ_4 : FILE
 		$typelibguid1 = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_Trojan_Macro_RESUMEPLEASE_1
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "068662f6-28b8-5538-8bc3-6506565305ae"
+		id = "5accaacf-8629-532c-aa6e-0c368a17e142"
 		date = "2020-12-01"
 		date = "2020-12-01"
 		modified = "2020-12-09"
@@ -131701,7 +131771,7 @@ rule FIREEYE_RT_Trojan_Macro_RESUMEPLEASE_1
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/RESUMEPLEASE/production/yara/Trojan_Macro_RESUMEPLEASE_1.yar#L4-L21"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "d5d3d23c8573d999f1c48d3e211b1066"
-		logic_hash = "040457bc446e496431129ff4623ddda5d9c2ce339ba65a7fbe42114626f36c60"
+		logic_hash = "v1_sha256_040457bc446e496431129ff4623ddda5d9c2ce339ba65a7fbe42114626f36c60"
 		score = 75
 		quality = 75
 		tags = ""
@@ -131723,14 +131793,14 @@ rule FIREEYE_RT_Hacktool_MSIL_Keepersist_1 : FILE
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeePersist' project."
 		author = "FireEye"
-		id = "950a4744-2696-5eb7-8524-7f689cb5dbb0"
+		id = "f13ad998-f00d-51d1-bac1-cf6082492d02"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEPERSIST/production/yara/HackTool_MSIL_KeePersist_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "eae67c77a64ca07f9ef59a356bb2c3f3131f14e7f17c898ef8857a21090ace0e"
+		logic_hash = "v1_sha256_eae67c77a64ca07f9ef59a356bb2c3f3131f14e7f17c898ef8857a21090ace0e"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -131740,14 +131810,14 @@ rule FIREEYE_RT_Hacktool_MSIL_Keepersist_1 : FILE
 		$typelibguid0 = "1df47db2-7bb8-47c2-9d85-5f8d3f04a884" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "736b5300-215b-5314-9234-69ff0050b73e"
+		id = "82e5e1ff-54da-5bca-a5c1-6d465f974bf7"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -131755,7 +131825,7 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "63135c81c1a6b967cb26cced628afc0e7ef485923e6a7fd70a4d4672118d6a8c"
+		logic_hash = "v1_sha256_63135c81c1a6b967cb26cced628afc0e7ef485923e6a7fd70a4d4672118d6a8c"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -131766,21 +131836,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_1 : FILE
 		$sb2 = { 02 1? 8D [2] 00 01 [0-32] 1? 1F 2E 9D 6F [2] 00 0A 72 [4] 0A 0B 1? 0? 2B 2E 0? 0? 9A 0? 0? 72 [4] 6F [2] 00 0A 2D ?? 06 72 [4] 28 [2] 00 0A 0A 06 72 [4] 0? 28 [2] 00 0A 0A 0? 1? 58 0? 0? 0? 8E 69 32 CC 06 2A }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Credtheft_MSIL_Adpasshunt_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "b6103e23-8d1c-5d01-b283-f4545ccb924e"
+		id = "d5201505-e006-5ea5-a176-7c331d5d9807"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_2.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "e7282905a8baeaeb8ec156171fbf2bc4ac811facb80959a88394f4938a145cc1"
+		logic_hash = "v1_sha256_e7282905a8baeaeb8ec156171fbf2bc4ac811facb80959a88394f4938a145cc1"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -131795,21 +131865,21 @@ rule FIREEYE_RT_Credtheft_MSIL_Adpasshunt_2 : FILE
 		$s4 = "[GPP] Searching for passwords now"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ((@pdb2[1]<@pdb1[1]+50) or 2 of ($s*))
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( ( @pdb2 [ 1 ] < @pdb1 [ 1 ] + 50 ) or 2 of ( $s* ) )
 }
 rule FIREEYE_RT_Credtheft_MSIL_Adpasshunt_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public ADPassHunt project."
 		author = "FireEye"
-		id = "35fb8032-c73a-549f-9bd9-409f7050bdb0"
+		id = "632f452b-1204-5a1a-a1cc-fb9f5a7c34d1"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "85c7c147d6bf5b7cb417ff2910a3e7ab3be5e8a3651758c07f8f0ed42b5964d8"
+		logic_hash = "v1_sha256_85c7c147d6bf5b7cb417ff2910a3e7ab3be5e8a3651758c07f8f0ed42b5964d8"
 		score = 50
 		quality = 73
 		tags = "FILE"
@@ -131819,14 +131889,14 @@ rule FIREEYE_RT_Credtheft_MSIL_Adpasshunt_1 : FILE
 		$typelibguid = "15745B9E-A059-4AF1-A0D8-863E349CD85D" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5A4D and $typelibguid
+		uint16( 0 ) == 0x5A4D and $typelibguid
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "a3b12fd7-e82d-5ef0-9125-7c069cd9bec4"
+		id = "3400e351-c895-5e08-b269-2c936d3b7532"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -131834,7 +131904,7 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_2.yar#L4-L23"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "e2dc7db1860eef04a569f007c32abd507dd588d1392613efbb31f42ca66ff735"
+		logic_hash = "v1_sha256_e2dc7db1860eef04a569f007c32abd507dd588d1392613efbb31f42ca66ff735"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -131851,14 +131921,14 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_2 : FILE
 		$s8 = "\x00DirectoryInfo\x00"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Dropper_Win_MATRYOSHKA_1 : FILE
 {
 	meta:
 		description = "matryoshka_dropper.rs"
 		author = "FireEye"
-		id = "7fd305c7-0b1b-5d91-b968-7f1fb0a8ae47"
+		id = "b8e0fa03-8dd7-5521-89f3-e6dd9ea85d03"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -131866,7 +131936,7 @@ rule FIREEYE_RT_APT_Dropper_Win_MATRYOSHKA_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Dropper_Win_MATRYOSHKA_1.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "edcd58ba5b1b87705e95089002312281"
-		logic_hash = "a7bf7599ec9b4b1d09a8c90b70ae565a9396fb31d449da3c1492d6fa336d9c5e"
+		logic_hash = "v1_sha256_a7bf7599ec9b4b1d09a8c90b70ae565a9396fb31d449da3c1492d6fa336d9c5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131879,14 +131949,14 @@ rule FIREEYE_RT_APT_Dropper_Win_MATRYOSHKA_1 : FILE
 		$s4 = "\x00.execmdstart/Cfailed to execute process\x00"
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_APT_Builder_Win64_MATRYOSHKA_1 : FILE
 {
 	meta:
 		description = "matryoshka_pe_to_shellcode.rs"
 		author = "FireEye"
-		id = "0afcf13e-5cd3-5c1c-897e-b6d0c283ab0f"
+		id = "36470e90-a9ae-541e-8b91-e4289571d4dd"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -131894,7 +131964,7 @@ rule FIREEYE_RT_APT_Builder_Win64_MATRYOSHKA_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Builder_Win64_MATRYOSHKA_1.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "8d949c34def898f0f32544e43117c057"
-		logic_hash = "b370d7dea44bccc92fc8dbd4ea0ee9bec523820108bf8bc67acb17ebf9835f74"
+		logic_hash = "v1_sha256_b370d7dea44bccc92fc8dbd4ea0ee9bec523820108bf8bc67acb17ebf9835f74"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131907,14 +131977,14 @@ rule FIREEYE_RT_APT_Builder_Win64_MATRYOSHKA_1 : FILE
 		$ss3 = "\x00[+] Writing out to file"
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_APT_Dropper_Win64_MATRYOSHKA_1 : FILE
 {
 	meta:
 		description = "matryoshka_dropper.rs"
 		author = "FireEye"
-		id = "1406aafd-6217-51ef-b3af-107ee88f9c99"
+		id = "e4a222f0-c203-594d-9392-4511153a13df"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -131922,7 +131992,7 @@ rule FIREEYE_RT_APT_Dropper_Win64_MATRYOSHKA_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Dropper_Win64_MATRYOSHKA_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "edcd58ba5b1b87705e95089002312281"
-		logic_hash = "23f811f8e9387ca6a1257a31af66de9739733e4728adba0a3e3f74b5e5c0a556"
+		logic_hash = "v1_sha256_23f811f8e9387ca6a1257a31af66de9739733e4728adba0a3e3f74b5e5c0a556"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131933,14 +132003,14 @@ rule FIREEYE_RT_APT_Dropper_Win64_MATRYOSHKA_1 : FILE
 		$sb2 = { 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 68 00 00 00 48 8B [2] 48 8D [2] 48 89 [3] 48 89 [3] 0F 11 44 24 ?? C7 44 24 ?? 08 00 00 0C C7 44 24 ?? 00 00 00 00 31 ?? 48 89 ?? 31 ?? 45 31 ?? 45 31 ?? E8 [4] 83 F8 01 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_APT_Builder_PY_MATRYOSHKA_1
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "0135f3bb-28b3-5fc4-85a2-b12c46c8bc45"
+		id = "779574c8-6a26-5aa4-a196-a633651de846"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -131948,7 +132018,7 @@ rule FIREEYE_RT_APT_Builder_PY_MATRYOSHKA_1
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Builder_PY_MATRYOSHKA_1.yar#L4-L22"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "25a97f6dba87ef9906a62c1a305ee1dd"
-		logic_hash = "71b26f4b319429ac356b55d22bccd1da85894d61f8c96452422de78d2d893420"
+		logic_hash = "v1_sha256_71b26f4b319429ac356b55d22bccd1da85894d61f8c96452422de78d2d893420"
 		score = 75
 		quality = 75
 		tags = ""
@@ -131971,7 +132041,7 @@ rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_2 : FILE
 	meta:
 		description = "matryoshka.rs"
 		author = "FireEye"
-		id = "25f916bc-6ee1-5175-903c-4266b0a086e1"
+		id = "dfd4f3ef-206b-5b13-8715-56be78c61bc5"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -131979,7 +132049,7 @@ rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_2 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_2.yar#L4-L20"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "7f8102b789303b7861a03290c79feba0"
-		logic_hash = "daa6f6d526bf959c268b2c5a4cae33307cfec5e9ca51283131bbfa66a582b505"
+		logic_hash = "v1_sha256_daa6f6d526bf959c268b2c5a4cae33307cfec5e9ca51283131bbfa66a582b505"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131992,14 +132062,14 @@ rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_2 : FILE
 		$si2 = "Process32Next" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_1 : FILE
 {
 	meta:
 		description = "matryoshka_process_hollow.rs"
 		author = "FireEye"
-		id = "69919a80-8ed1-5b8c-911a-ceb75570f11f"
+		id = "eedb5645-ff4e-5e7f-a03b-bb611a320d6d"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -132007,7 +132077,7 @@ rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_1.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "44887551a47ae272d7873a354d24042d"
-		logic_hash = "46e5480dc95ce8b9d8385c2e44a50b21629301535b93833c13cc3db319ac15dd"
+		logic_hash = "v1_sha256_46e5480dc95ce8b9d8385c2e44a50b21629301535b93833c13cc3db319ac15dd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132019,14 +132089,14 @@ rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_1 : FILE
 		$sb3 = { 66 C7 45 ?? 48 B8 48 C7 45 ?? 00 00 00 00 66 C7 45 ?? FF E0 [0-64] 41 B9 40 00 00 00 [0-32] E8 [4] 83 F8 01 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_APT_Loader_Win_MATRYOSHKA_1 : FILE
 {
 	meta:
 		description = "matryoshka_process_hollow.rs"
 		author = "FireEye"
-		id = "c07fb67e-ded5-593d-b5dc-d0e2c3b5a352"
+		id = "03ef8dfb-3d81-5982-b847-915b029bebbb"
 		date = "2020-12-02"
 		date = "2020-12-02"
 		modified = "2020-12-09"
@@ -132034,7 +132104,7 @@ rule FIREEYE_RT_APT_Loader_Win_MATRYOSHKA_1 : FILE
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win_MATRYOSHKA_1.yar#L4-L24"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "44887551a47ae272d7873a354d24042d"
-		logic_hash = "8f762684ffd3984630bf41ededa78b8993b53b22591a59912cabfe635775de53"
+		logic_hash = "v1_sha256_8f762684ffd3984630bf41ededa78b8993b53b22591a59912cabfe635775de53"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132051,21 +132121,21 @@ rule FIREEYE_RT_APT_Loader_Win_MATRYOSHKA_1 : FILE
 		$s8 = "\x00Error while erasing pe header. NTStatus: "
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Puppyhound_1 : FILE
 {
 	meta:
 		description = "This is a modification of an existing FireEye detection for SharpHound. However, it looks for the string 'PuppyHound' instead of 'SharpHound' as this is all that was needed to detect the PuppyHound variant of SharpHound."
 		author = "FireEye"
-		id = "1155f959-c8bc-597a-8a80-abee8d95b6ec"
+		id = "d888ffc0-28fb-5dd0-953b-bcffa63262f5"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PUPPYHOUND/production/yara/HackTool_MSIL_PuppyHound_1.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "eeedc09570324767a3de8205f66a5295"
-		logic_hash = "39073bbfef15ecd28c1772e5d01e54c3d5774ecb4c90f0076bda5dc400abacba"
+		logic_hash = "v1_sha256_39073bbfef15ecd28c1772e5d01e54c3d5774ecb4c90f0076bda5dc400abacba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132079,21 +132149,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Puppyhound_1 : FILE
 		$msil = /\x00_Cor(Exe|Dll)Main\x00/
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule FIREEYE_RT_Hacktool_MSIL_Sharphound_3 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project."
 		author = "FireEye"
-		id = "456b3208-1e8d-5eb7-81ee-39f1c886c5a7"
+		id = "2b135b38-4c84-5db3-8344-45b5b9839bf5"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PUPPYHOUND/production/yara/HackTool_MSIL_SharpHound_3.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "eeedc09570324767a3de8205f66a5295"
-		logic_hash = "baeea6cae42c755ee389378229b2b206c82f60f75a5ce5f9cfa06871fc9507d1"
+		logic_hash = "v1_sha256_baeea6cae42c755ee389378229b2b206c82f60f75a5ce5f9cfa06871fc9507d1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -132103,21 +132173,21 @@ rule FIREEYE_RT_Hacktool_MSIL_Sharphound_3 : FILE
 		$typelibguid1 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSACK_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsack' project."
 		author = "FireEye"
-		id = "8e344acb-73c4-5509-be9d-85cf6fe94445"
+		id = "5624e821-23df-5acd-aead-0168d1dd96ac"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSACK/production/yara/APT_HackTool_MSIL_SHARPSACK_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "ecc3250e65e34595b4b827add3eb3062edad6a3373930048bfd6225d4a229e93"
+		logic_hash = "v1_sha256_ecc3250e65e34595b4b827add3eb3062edad6a3373930048bfd6225d4a229e93"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -132127,21 +132197,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSACK_1 : FILE
 		$typelibguid0 = "1946808a-1a01-40c5-947b-8b4c3377f742" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_APT_Hacktool_MSIL_JUSTASK_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'justask' project."
 		author = "FireEye"
-		id = "06a03d82-db69-5b5a-a578-a8053814e917"
+		id = "a7a4dd2c-0fcd-5078-860e-b676a0e4f7c5"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/JUSTASK/production/yara/APT_HackTool_MSIL_JUSTASK_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "24d2f8e3838c4f02cd80644a396ce7cf105761d2feba54e39973564ca5e97571"
+		logic_hash = "v1_sha256_24d2f8e3838c4f02cd80644a396ce7cf105761d2feba54e39973564ca5e97571"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -132151,21 +132221,21 @@ rule FIREEYE_RT_APT_Hacktool_MSIL_JUSTASK_1 : FILE
 		$typelibguid0 = "aa59be52-7845-4fed-9ea5-1ea49085d67a" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule FIREEYE_RT_Builder_MSIL_G2JS_1 : FILE
 {
 	meta:
 		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project."
 		author = "FireEye"
-		id = "484202c2-ac7d-5e6c-8bf1-3452a357c668"
+		id = "868392e4-af14-58bc-ad73-bf3aec1f2ab3"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Builder_MSIL_G2JS_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "fa255fdc88ab656ad9bc383f9b322a76"
-		logic_hash = "487d8e8deef218412f241d99ce32b63bfeb3568d23048b9dd4afff8f401bfea5"
+		logic_hash = "v1_sha256_487d8e8deef218412f241d99ce32b63bfeb3568d23048b9dd4afff8f401bfea5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -132175,21 +132245,21 @@ rule FIREEYE_RT_Builder_MSIL_G2JS_1 : FILE
 		$typelibguid1 = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
 }
 rule FIREEYE_RT_Hunting_B64Engine_Dotnettojscript_Dos
 {
 	meta:
 		description = "This file may enclude a Base64 encoded .NET executable. This technique is used by the project DotNetToJScript which is used by many malware families including GadgetToJScript."
 		author = "FireEye"
-		id = "24c9c259-9bb9-5f46-9278-4fa20eb3c8c4"
+		id = "f5c6bcb9-73c1-50b4-a3f1-005347cae837"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Hunting_B64Engine_DotNetToJScript_Dos.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "7af24305a409a2b8f83ece27bb0f7900"
-		logic_hash = "e2afb43af469f8ae02f6fd21db6dbd45c997fb003e3aeeaa0d4ff3e85c64159a"
+		logic_hash = "v1_sha256_e2afb43af469f8ae02f6fd21db6dbd45c997fb003e3aeeaa0d4ff3e85c64159a"
 		score = 50
 		quality = 75
 		tags = ""
@@ -132206,14 +132276,14 @@ rule FIREEYE_RT_Hunting_Gadgettojscript_1
 	meta:
 		description = "This rule is looking for B64 offsets of LazyNetToJscriptLoader which is a namespace specific to the internal version of the GadgetToJScript tooling."
 		author = "FireEye"
-		id = "76c932e0-55b3-56ef-bab6-eb6997b51ee7"
+		id = "a6b65227-6a90-5c30-9cf1-d092a40cbf17"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
 		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Hunting_GadgetToJScript_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "7af24305a409a2b8f83ece27bb0f7900"
-		logic_hash = "a880c20e61376dacd4e3a04f2cf065f19067c29371180b1dec186172cadf9564"
+		logic_hash = "v1_sha256_a880c20e61376dacd4e3a04f2cf065f19067c29371180b1dec186172cadf9564"
 		score = 50
 		quality = 75
 		tags = ""
@@ -132231,7 +132301,7 @@ rule FIREEYE_RT_Hunting_Gadgettojscript_1
  * YARA Rule Set
  * Repository Name: GCTI
  * Repository: https://github.com/chronicle/GCTI
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 1c5fd42b1895098527fde00c2d9757edf6b303bb
  * Number of Rules: 90
  * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -132448,14 +132518,14 @@ rule GCTI_Cobaltstrike_Resources_Bypassuac_X64_Dll_V3_3_To_V3_14_And_Sleeve_Bypa
 	meta:
 		description = "Cobalt Strike's resources/bypassuac-x64.dll from v3.3 to v3.14 (64-bit version) and sleeve/bypassuac.x64.dll from v4.0 to at least v4.4"
 		author = "gssincla@google.com"
-		id = "eef83901-63d9-55a3-b115-03f420416177"
+		id = "8a86bc07-71b3-54cc-b549-2240a397d297"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_x64_Dll_v3_3_to_v3_14_and_Sleeve_Bypassuac_x64_Dll_v4_0_and_v4_x.yara#L17-L86"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "9ecf56e9099811c461d592c325c65c4f9f27d947cbdf3b8ef8a98a43e583aecb"
-		logic_hash = "d76e3601f61ae164a8df9048d59d15cd6913e64adb93132244e83f40bf67d86a"
+		logic_hash = "v1_sha256_d76e3601f61ae164a8df9048d59d15cd6913e64adb93132244e83f40bf67d86a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132496,14 +132566,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X86_O_V4_3_V4_4_V4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/BeaconLoader.HA.x86.o (HeapAlloc) Versions 4.3 through at least 4.6"
 		author = "gssincla@google.com"
-		id = "0ee3fa6f-367c-596f-a3bc-3bcfa61b97aa"
+		id = "3d93c55d-bb2a-5add-9e01-a08bf67f13dc"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L17-L59"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "8e4a1862aa3693f0e9011ade23ad3ba036c76ae8ccfb6585dc19ceb101507dcd"
-		logic_hash = "d02257bc556d0b1675997ab6af1b28cf5f498855d6254e3c1cd7eb4a0c4d2715"
+		logic_hash = "v1_sha256_d02257bc556d0b1675997ab6af1b28cf5f498855d6254e3c1cd7eb4a0c4d2715"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132530,14 +132600,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X86_O_V4_3_V4_4_V4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x86.o (MapViewOfFile) Versions 4.3 through at least 4.6"
 		author = "gssincla@google.com"
-		id = "3f7c0553-989e-53e7-87a9-3fa1c47f4b62"
+		id = "5d69e555-8888-5999-9646-55c3d1c191ae"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L61-L111"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "cded3791caffbb921e2afa2de4c04546067c3148c187780066e8757e67841b44"
-		logic_hash = "dd831fb01a403213c06e3d07daf3da5f56655619a686149f9d4beec2331fe6ca"
+		logic_hash = "v1_sha256_dd831fb01a403213c06e3d07daf3da5f56655619a686149f9d4beec2331fe6ca"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132568,14 +132638,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X86_O_V4_3_V4_4_V4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/BeaconLoader.VA.x86.o (VirtualAlloc) Versions 4.3 through at least 4.6"
 		author = "gssincla@google.com"
-		id = "5f89c4be-f4c5-54d3-b923-d125de53902f"
+		id = "625c360c-945c-552c-aaf4-4ffe8b0b491e"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L114-L194"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
-		logic_hash = "19b2297986bd72204fb117560cddcfb512f5db6c157d9730b5802bf9f968eef4"
+		logic_hash = "v1_sha256_19b2297986bd72204fb117560cddcfb512f5db6c157d9730b5802bf9f968eef4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132622,14 +132692,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beaconloader_X86_O_V4_3_V4_4_V4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/BeaconLoader.x86.o Versions 4.3 through at least 4.6"
 		author = "gssincla@google.com"
-		id = "32a47966-f3bb-52c3-a977-82a1b09ddf2c"
+		id = "9744f011-42e3-5832-8c42-161753ec7cdc"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L196-L276"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
-		logic_hash = "cab5441ce7d919101fc04aa469e77b71a4c444443e44c752f18cbbc5b17ed5c2"
+		logic_hash = "v1_sha256_cab5441ce7d919101fc04aa469e77b71a4c444443e44c752f18cbbc5b17ed5c2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132676,14 +132746,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X64_O_V4_3_V4_4_V4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/BeaconLoader.HA.x64.o (HeapAlloc) Versions 4.3 through at least 4.6"
 		author = "gssincla@google.com"
-		id = "9b16ff13-2d8e-51dc-9f99-6c45eff76feb"
+		id = "f2a3ecb0-4cad-5174-9609-6a3e07a547da"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L281-L323"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "d64f10d5a486f0f2215774e8ab56087f32bef19ac666e96c5627c70d345a354d"
-		logic_hash = "b712a0c218e473f6c64fdead22b291d7fb0bac8ba614adcf1ba6431e854a5e65"
+		logic_hash = "v1_sha256_b712a0c218e473f6c64fdead22b291d7fb0bac8ba614adcf1ba6431e854a5e65"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132710,14 +132780,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X64_O_V4_3_V4_4_V4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x64.o (MapViewOfFile) Versions 4.3 through at least 4.6"
 		author = "gssincla@google.com"
-		id = "38e063db-3d76-5a94-812a-945fcf46a232"
+		id = "a95d0058-ce63-58f5-a9b2-bece542ab702"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L326-L374"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "9d5b6ccd0d468da389657309b2dc325851720390f9a5f3d3187aff7d2cd36594"
-		logic_hash = "6224000342d87041fd3336656897479c644e94ea36fc061c27fcd64233047c2c"
+		logic_hash = "v1_sha256_6224000342d87041fd3336656897479c644e94ea36fc061c27fcd64233047c2c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132747,14 +132817,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X64_O_V4_3_V4_4_V4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/BeaconLoader.VA.x64.o (VirtualAlloc) Versions 4.3 through at least 4.6"
 		author = "gssincla@google.com"
-		id = "8ca04f82-a8a8-5162-8b0c-8a7bce678a85"
+		id = "36f5e2e3-1751-56c6-8baa-c742773dc2d8"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L376-L456"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
-		logic_hash = "17402e952d71d02274a9b2814512b28a402e8d11a6c2a2375844fe24719f87a6"
+		logic_hash = "v1_sha256_17402e952d71d02274a9b2814512b28a402e8d11a6c2a2375844fe24719f87a6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132800,14 +132870,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beaconloader_X64_O_V4_3_V4_4_V4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/BeaconLoader.x64.o (Base) Versions 4.3 through at least 4.6"
 		author = "gssincla@google.com"
-		id = "07f751e4-f001-5b95-b229-31fbaa867cea"
+		id = "f87a112f-fa5b-5aff-83a1-910406726914"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L458-L555"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
-		logic_hash = "50d9da466e2c074b3fb634203c8840d45da8f8e3094790d7c4354a5703b583ef"
+		logic_hash = "v1_sha256_50d9da466e2c074b3fb634203c8840d45da8f8e3094790d7c4354a5703b583ef"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132862,14 +132932,14 @@ rule GCTI_Cobaltstrike_Resources__Template_Vbs_V3_3_To_V4_X
 	meta:
 		description = "Cobalt Strike's resources/btemplate.vbs signature for versions v3.3 to v4.x"
 		author = "gssincla@google.com"
-		id = "62f35d02-1e4e-5651-b575-888ce06b8bdd"
+		id = "9204f6ed-97d8-5093-a88f-90b76724edef"
 		date = "2022-11-18"
 		modified = "2022-11-22"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Vbs_v3_3_to_v4_x.yara#L17-L41"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "e0683f953062e63b2aabad7bc6d76a78748504b114329ef8e2ece808b3294135"
-		logic_hash = "c9df0e287eb0eacf7c6cfcf3f6d1043ae6f2fdacd3b22bd42ac71f4b0d7226ff"
+		logic_hash = "v1_sha256_c9df0e287eb0eacf7c6cfcf3f6d1043ae6f2fdacd3b22bd42ac71f4b0d7226ff"
 		score = 75
 		quality = 83
 		tags = ""
@@ -132894,14 +132964,14 @@ rule GCTI_Cobaltstrike_Resources_Template__X32_X64_Ps1_V1_45_To_V2_5_And_V3_11_T
 	meta:
 		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.x32 from v3.11 to v3.14 and resources/template.ps1 from v1.45 to v2.5 "
 		author = "gssincla@google.com"
-		id = "c9fa6a39-0098-5dde-9762-94bc6b2df299"
+		id = "1e5fa79e-1d6f-5328-bd0f-6e0498824146"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template__x32_x64_Ps1_v1_45_to_v2_5_and_v3_11_to_v3_14.yara#L17-L43"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
-		logic_hash = "5196f111f257239d2e7e4ca342e7fc8bac1687743bc8c7ff23addf1f094b2e93"
+		logic_hash = "v1_sha256_5196f111f257239d2e7e4ca342e7fc8bac1687743bc8c7ff23addf1f094b2e93"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132924,14 +132994,14 @@ rule GCTI_Cobaltstrike_Resources_Elevate_X64_Dll_V3_0_To_V3_14_And_Sleeve_Elevat
 	meta:
 		description = "Cobalt Strike's resources/elevate.x64.dll signature for v3.0 to v3.14 and sleeve/elevate.x64.dll for v4.x"
 		author = "gssincla@google.com"
-		id = "91d5c343-1084-5cfc-9dfa-46f530eb9625"
+		id = "91062285-e181-5997-94eb-79a40cd940a1"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_X64_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_X64_Dll_v4_x.yara#L17-L71"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "c3ee8a9181fed39cec3bd645b32b611ce98d2e84c5a9eff31a8acfd9c26410ec"
-		logic_hash = "6f23bcf6a0c360d2f83140ce633440b13d8b691e75c5560c65656cf8a6114224"
+		logic_hash = "v1_sha256_6f23bcf6a0c360d2f83140ce633440b13d8b691e75c5560c65656cf8a6114224"
 		score = 75
 		quality = 85
 		tags = ""
@@ -132966,14 +133036,14 @@ rule GCTI_Cobaltstrike__Resources_Browserpivot_Bin_V1_48_To_V3_14_And_Sleeve_Bro
 	meta:
 		description = "Cobalt Strike's resources/browserpivot.bin from v1.48 to v3.14 and sleeve/browserpivot.dll from v4.0 to at least v4.4"
 		author = "gssincla@google.com"
-		id = "55086544-6684-526b-914f-505a562be458"
+		id = "bb057b90-f292-5e33-8e92-6ee025df6508"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_Dll_v4_0_to_v4_x.yara#L17-L60"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "12af9f5a7e9bfc49c82a33d38437e2f3f601639afbcdc9be264d3a8d84fd5539"
-		logic_hash = "416554d31c105fd96aeaef508847efe2889590909c8d0025e3862e5b24078131"
+		logic_hash = "v1_sha256_416554d31c105fd96aeaef508847efe2889590909c8d0025e3862e5b24078131"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133002,14 +133072,14 @@ rule GCTI_Cobaltstrike_Resources_Httpstager64_Bin_V3_2_Through_V4_X
 	meta:
 		description = "Cobalt Strike's resources/httpstager64.bin signature for versions v3.2 to v4.x"
 		author = "gssincla@google.com"
-		id = "5530dce8-e5a1-5133-9b05-464e3397084a"
+		id = "bad3b597-7643-510b-b8e0-ee63788ba639"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager64_Bin_v3_2_through_v4_x.yara#L17-L85"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "ad93d1ee561bc25be4a96652942f698eac9b133d8b35ab7e7d3489a25f1d1e76"
-		logic_hash = "23666169565c6b3e5fa71767dc31096e7a25be049eeab16b074053d76c97c70b"
+		logic_hash = "v1_sha256_23666169565c6b3e5fa71767dc31096e7a25be049eeab16b074053d76c97c70b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133048,14 +133118,14 @@ rule GCTI_Cobaltstrike_Resources_Bypassuactoken_X64_Dll_V3_11_To_V3_14
 	meta:
 		description = "Cobalt Strike's resources/bypassuactoken.x64.dll from v3.11 to v3.14 (64-bit version)"
 		author = "gssincla@google.com"
-		id = "c89befcd-a622-5947-9ce3-a6031901a45a"
+		id = "6d7354d3-f158-509b-9d06-6167c756b78c"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14.yara#L17-L118"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "853068822bbc6b1305b2a9780cf1034f5d9d7127001351a6917f9dbb42f30d67"
-		logic_hash = "adfd212f2e470f666ab8a2168e976c11d3032c31dab7cf56963dae5fc0f6c5f9"
+		logic_hash = "v1_sha256_adfd212f2e470f666ab8a2168e976c11d3032c31dab7cf56963dae5fc0f6c5f9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133112,14 +133182,14 @@ rule GCTI_Cobaltstrike_Resources_Httpstager_Bin_V2_5_Through_V4_X
 	meta:
 		description = "Cobalt Strike's resources/httpstager.bin signature for versions 2.5 to 4.x"
 		author = "gssincla@google.com"
-		id = "86109485-c26c-5c51-8d04-dd1add9a8c57"
+		id = "91eb82bb-93de-5a2c-97ca-874f4c91cb23"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager_Bin_v2_5_through_v4_x.yara#L17-L93"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "a47569af239af092880751d5e7b68d0d8636d9f678f749056e702c9b063df256"
-		logic_hash = "3baab08b0118e00432f1869ba5daa4fc6383bfc020119bfbb3047a008c33fe72"
+		logic_hash = "v1_sha256_3baab08b0118e00432f1869ba5daa4fc6383bfc020119bfbb3047a008c33fe72"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133163,14 +133233,14 @@ rule GCTI_Cobaltstrike_Resources_Httpsstager_Bin_V2_5_Through_V4_X
 	meta:
 		description = "Cobalt Strike's resources/httpsstager.bin signature for versions 2.5 to 4.x"
 		author = "gssincla@google.com"
-		id = "f45aa40a-3936-50f9-a60e-de7181862d19"
+		id = "6ff55324-759b-52c0-8ad2-49ba1d625ead"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager_Bin_v2_5_through_v4_x.yara#L17-L95"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "5ebe813a4c899b037ac0ee0962a439833964a7459b7a70f275ac73ea475705b3"
-		logic_hash = "d2f722809a59faf8ecd85e46eadf58bf23ba5f515ad9c949843f1e6bfeec1fbf"
+		logic_hash = "v1_sha256_d2f722809a59faf8ecd85e46eadf58bf23ba5f515ad9c949843f1e6bfeec1fbf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133215,14 +133285,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_44
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Version 1.44"
 		author = "gssincla@google.com"
-		id = "935ee27f-ce1b-5491-b4a3-cb78f199ab1b"
+		id = "116817ac-fa23-50c5-b155-0c30e9b2efe7"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L17-L49"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "75102e8041c58768477f5f982500da7e03498643b6ece86194f4b3396215f9c2"
-		logic_hash = "ebed8b6dc0b929164b1aa25b491b9d2fbb61d380a8b1268df7d424afe90f613d"
+		logic_hash = "v1_sha256_ebed8b6dc0b929164b1aa25b491b9d2fbb61d380a8b1268df7d424afe90f613d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133239,14 +133309,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_45
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Version 1.45"
 		author = "gssincla@google.com"
-		id = "04d4d0ee-f1ee-5888-8108-ca55243c770a"
+		id = "c73a6bf4-5443-5503-9d8b-080c98dac372"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L51-L84"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "1a92b2024320f581232f2ba1e9a11bef082d5e9723429b3e4febb149458d1bb1"
-		logic_hash = "b1472907e0fe0cb26219c268f23483681cc076dab96c1b0f2f0ee472ad319b4f"
+		logic_hash = "v1_sha256_b1472907e0fe0cb26219c268f23483681cc076dab96c1b0f2f0ee472ad319b4f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133263,14 +133333,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_46
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Version 1.46"
 		author = "gssincla@google.com"
-		id = "79715042-1963-5e48-8b64-7d915da58d84"
+		id = "b05adb4b-9b67-58ad-b82e-d42463141384"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L86-L115"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "44e34f4024878024d4804246f57a2b819020c88ba7de160415be38cd6b5e2f76"
-		logic_hash = "1a5c63c8b5527c0442830a73ded8458cf82a9d8ecb9b31e9a02c10b27ed6195e"
+		logic_hash = "v1_sha256_1a5c63c8b5527c0442830a73ded8458cf82a9d8ecb9b31e9a02c10b27ed6195e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133287,14 +133357,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_47
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Version 1.47"
 		author = "gssincla@google.com"
-		id = "ac2249a9-210c-581f-8dd1-7619356dca7d"
+		id = "4ba49ade-6da4-5413-835a-b9b0b3258154"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L117-L144"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "8ff6dc80581804391183303bb39fca2a5aba5fe13d81886ab21dbd183d536c8d"
-		logic_hash = "8c463d3122f3f79ff5d9b88e3d4f5ed14e6c581edfdfafba8a0c596c494ac1b1"
+		logic_hash = "v1_sha256_8c463d3122f3f79ff5d9b88e3d4f5ed14e6c581edfdfafba8a0c596c494ac1b1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133311,14 +133381,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_48
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Version 1.48"
 		author = "gssincla@google.com"
-		id = "dd15099f-ad19-58df-9ed4-ce66d7ee8540"
+		id = "aa3b02db-6d59-5471-ad4c-b10f160b96a9"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L146-L178"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "dd4e445572cd5e32d7e9cc121e8de337e6f19ff07547e3f2c6b7fce7eafd15e4"
-		logic_hash = "3f789eaf334c9bb3236d2834f38156aa92b22a5b674450977086378d195dd216"
+		logic_hash = "v1_sha256_3f789eaf334c9bb3236d2834f38156aa92b22a5b674450977086378d195dd216"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133335,14 +133405,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_49
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Version 1.49"
 		author = "gssincla@google.com"
-		id = "871e28c9-b580-5a32-8529-2290ded1a1b6"
+		id = "50656a60-84df-5265-9801-68221c099195"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L180-L211"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "52b4bd87e21ee0cbaaa0fc007fd3f894c5fc2c4bae5cbc2a37188de3c2c465fe"
-		logic_hash = "935232d5ddccdc0401b4d911cdc73a48305347b495219c8c893615fe918f32f1"
+		logic_hash = "v1_sha256_935232d5ddccdc0401b4d911cdc73a48305347b495219c8c893615fe918f32f1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133359,14 +133429,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_0_49
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Version 2.0.49"
 		author = "gssincla@google.com"
-		id = "087c584a-5ceb-536a-8842-53fbd668df54"
+		id = "61809a33-84bb-5a88-a2b9-63758b7f7165"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L213-L243"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "ed08c1a21906e313f619adaa0a6e5eb8120cddd17d0084a30ada306f2aca3a4e"
-		logic_hash = "3616579dabcfd0ba413d17b4fbd0da5313b9beca94f7bf8e41f05d6679b4a215"
+		logic_hash = "v1_sha256_3616579dabcfd0ba413d17b4fbd0da5313b9beca94f7bf8e41f05d6679b4a215"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133383,14 +133453,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_1_And_V2_2
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 2.1 and 2.2"
 		author = "gssincla@google.com"
-		id = "384fb247-aae7-52e1-a45d-6bda0f80a04e"
+		id = "fa2ba694-f882-5bd3-a318-9afffe41422a"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L245-L276"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "ae7a1d12e98b8c9090abe19bcaddbde8db7b119c73f7b40e76cdebb2610afdc2"
-		logic_hash = "eee3702d6fde08b8e9f5533f903fa33fb3da808a3b76ca43e4d5029f9ce91ad0"
+		logic_hash = "v1_sha256_eee3702d6fde08b8e9f5533f903fa33fb3da808a3b76ca43e4d5029f9ce91ad0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133407,14 +133477,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_3
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 2.3"
 		author = "gssincla@google.com"
-		id = "aed092f1-fbb1-5efe-be8d-fb7c5aba1cde"
+		id = "ec68a71a-5566-53b3-9ced-63b3b003ba81"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L278-L308"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "00dd982cb9b37f6effb1a5a057b6571e533aac5e9e9ee39a399bb3637775ff83"
-		logic_hash = "286d7ffa83634b82160788abaf1c5b319a09c4a1243af2401799f327be76ad75"
+		logic_hash = "v1_sha256_286d7ffa83634b82160788abaf1c5b319a09c4a1243af2401799f327be76ad75"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133431,14 +133501,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_4
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 2.4"
 		author = "gssincla@google.com"
-		id = "347a6b06-84a8-53ff-80a1-05fa1a48a412"
+		id = "7152a59d-4216-5b89-b104-c72a37e6dd8b"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L310-L340"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "78c6f3f2b80e6140c4038e9c2bcd523a1b205d27187e37dc039ede4cf560beed"
-		logic_hash = "087ec6f585e90b84c00e746beb37cb8365cb7b4d07ebd0c48e3ba3d5df94dba2"
+		logic_hash = "v1_sha256_087ec6f585e90b84c00e746beb37cb8365cb7b4d07ebd0c48e3ba3d5df94dba2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133455,14 +133525,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_5
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 2.5"
 		author = "gssincla@google.com"
-		id = "a89f9239-099c-5b97-b1df-e8ce2b95ea52"
+		id = "d33bd450-af71-5164-b663-1292196e4d5d"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L342-L372"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "d99693e3e521f42d19824955bef0cefb79b3a9dbf30f0d832180577674ee2b58"
-		logic_hash = "f2d0ca1414a60bf855543d99777ae5e83c451db41aba5e255e4c10b1e0bb7b47"
+		logic_hash = "v1_sha256_f2d0ca1414a60bf855543d99777ae5e83c451db41aba5e255e4c10b1e0bb7b47"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133479,14 +133549,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_0
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.0"
 		author = "gssincla@google.com"
-		id = "132a1be8-f529-5141-ba03-fdf6df3d55d4"
+		id = "299dc825-53ae-5f42-b210-c9a3ad1b54c6"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L374-L404"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "30251f22df7f1be8bc75390a2f208b7514647835f07593f25e470342fd2e3f52"
-		logic_hash = "951f1b52c14010261022f9f920d53d3c1e88f41461798a23e72083c981f9de76"
+		logic_hash = "v1_sha256_951f1b52c14010261022f9f920d53d3c1e88f41461798a23e72083c981f9de76"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133503,14 +133573,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_1
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.1"
 		author = "gssincla@google.com"
-		id = "aa511dee-69ea-53bd-be90-d2d03d08c550"
+		id = "e209454d-0b22-5f31-a68d-047b98680f73"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L406-L461"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "4de723e784ef4e1633bbbd65e7665adcfb03dd75505b2f17d358d5a40b7f35cf"
-		logic_hash = "2d91add3aefe69b4525f93f7ea9f2fcbd7a6c506a224997ff73a2eeef63a8cd4"
+		logic_hash = "v1_sha256_2d91add3aefe69b4525f93f7ea9f2fcbd7a6c506a224997ff73a2eeef63a8cd4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133527,14 +133597,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_2
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.2"
 		author = "gssincla@google.com"
-		id = "3ccbc0f2-241c-5c10-8930-4a3d264d3b57"
+		id = "1fd0b19f-62a6-53af-a632-2b141515e506"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L463-L528"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "b490eeb95d150530b8e155da5d7ef778543836a03cb5c27767f1ae4265449a8d"
-		logic_hash = "e1fe0d58d86ad8c845d65608314007ce08e3e524fb92cdb33ddae860c640e3e9"
+		logic_hash = "v1_sha256_e1fe0d58d86ad8c845d65608314007ce08e3e524fb92cdb33ddae860c640e3e9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133553,14 +133623,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_3
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.3"
 		author = "gssincla@google.com"
-		id = "7cce26c9-1403-535f-bd9d-19667c7e313c"
+		id = "cd976880-9d4c-5dd3-95ca-96ba8914a99f"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L530-L560"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "158dba14099f847816e2fc22f254c60e09ac999b6c6e2ba6f90c6dd6d937bc42"
-		logic_hash = "f9b9b669aacc156a4e07eab0c6a638f9b9d828e018d1db89e9e2c922641744ac"
+		logic_hash = "v1_sha256_f9b9b669aacc156a4e07eab0c6a638f9b9d828e018d1db89e9e2c922641744ac"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133577,14 +133647,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_4
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.4"
 		author = "gssincla@google.com"
-		id = "58a34ab6-c061-59a2-b929-8519d3d844e7"
+		id = "297a7d98-68f4-58a2-9401-4ad290cb8b81"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L562-L592"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "5c40bfa04a957d68a095dd33431df883e3a075f5b7dea3e0be9834ce6d92daa3"
-		logic_hash = "f3372bc538092e30c62d9599f76f2115dc73faf7a5fd6f86c8d4cfaa35473810"
+		logic_hash = "v1_sha256_f3372bc538092e30c62d9599f76f2115dc73faf7a5fd6f86c8d4cfaa35473810"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133601,14 +133671,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_5_Hf1_And_3_5_1
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.5-hf1 and 3.5.1 (3.5.x)"
 		author = "gssincla@google.com"
-		id = "1532596e-be0e-58c2-8d3b-5120c793d677"
+		id = "39637bc3-8bd9-5936-86e1-276e80d91758"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L594-L625"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "c78e70cd74f4acda7d1d0bd85854ccacec79983565425e98c16a9871f1950525"
-		logic_hash = "c2e975678815638803b04261d46bca216bc0b2f894a1f72fd0d5b949493401d1"
+		logic_hash = "v1_sha256_c2e975678815638803b04261d46bca216bc0b2f894a1f72fd0d5b949493401d1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133625,14 +133695,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_6
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.6"
 		author = "gssincla@google.com"
-		id = "7e7b5c22-82b3-5298-b794-b06d94a668d5"
+		id = "43060c91-4001-576b-8c39-4449a43d01e7"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L627-L657"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "495a744d0a0b5f08479c53739d08bfbd1f3b9818d8a9cbc75e71fcda6c30207d"
-		logic_hash = "3bd3f0b8625e131726fa92d68de041dae6c3d5642cbf22ac596d1d82da1d4a07"
+		logic_hash = "v1_sha256_3bd3f0b8625e131726fa92d68de041dae6c3d5642cbf22ac596d1d82da1d4a07"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133649,14 +133719,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_7
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.7"
 		author = "gssincla@google.com"
-		id = "6352a31c-34b8-5886-8e34-ef9221c22e6e"
+		id = "58980042-c86e-50f2-a68f-c1c20fb1e0f5"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L659-L689"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "f18029e6b12158fb3993f4951dab2dc6e645bb805ae515d205a53a1ef41ca9b2"
-		logic_hash = "6ceb2cec8402a4679bad42d367156c74e897af4188442fdebc70d6ce2dd78bd6"
+		logic_hash = "v1_sha256_6ceb2cec8402a4679bad42d367156c74e897af4188442fdebc70d6ce2dd78bd6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133673,14 +133743,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_8
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.8"
 		author = "gssincla@google.com"
-		id = "f76712a4-df1c-5e6b-b5ac-9c74f2e202fc"
+		id = "03e215ab-072b-55f5-8a68-010a491ab8a6"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L691-L731"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603"
-		logic_hash = "a0c78dd7cda055bc76a8661b0416a302d7b05d03eeea483d2d1695093cd6dc90"
+		logic_hash = "v1_sha256_a0c78dd7cda055bc76a8661b0416a302d7b05d03eeea483d2d1695093cd6dc90"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133694,21 +133764,21 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_8
 		$c2_3 = "ns9.softline.top" xor
 
 	condition:
-		$version_sig and $decoder and not (2 of ($c2_*) or $xmrig_srcpath)
+		$version_sig and $decoder and not ( 2 of ( $c2_* ) or $xmrig_srcpath )
 }
 rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_11
 {
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.11"
 		author = "gssincla@google.com"
-		id = "00e42396-db81-5d43-90ee-5a97b379019e"
+		id = "583f15b6-380f-5285-9ece-f5d674bdcbdf"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L739-L770"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "2428b93464585229fd234677627431cae09cfaeb1362fe4f648b8bee59d68f29"
-		logic_hash = "24ca0a9c2249d1872a53dc228234bdc6803bdfe9e80847995e0951184a8d935c"
+		logic_hash = "v1_sha256_24ca0a9c2249d1872a53dc228234bdc6803bdfe9e80847995e0951184a8d935c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133725,14 +133795,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_11_Bugfix_And_V3_12
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.11-bugfix and 3.12"
 		author = "gssincla@google.com"
-		id = "08ff2a2f-97bd-5839-b414-d67fbf2cdb0f"
+		id = "33c1a25c-a88f-522c-a213-e7ca9047a1c5"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L772-L804"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "5912c96fffeabb2c5c5cdd4387cfbfafad5f2e995f310ace76ca3643b866e3aa"
-		logic_hash = "566eb14f918ad422d5a273390263e63ac37b00cd10ac3561e038fb1a27f85d80"
+		logic_hash = "v1_sha256_566eb14f918ad422d5a273390263e63ac37b00cd10ac3561e038fb1a27f85d80"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133750,14 +133820,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_13
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.13"
 		author = "gssincla@google.com"
-		id = "98dd32e6-9bb5-57b2-a5e5-1c74a0d1e6d3"
+		id = "e8e03fa0-e075-5925-8506-4f650ee144a0"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L806-L836"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "362119e3bce42e91cba662ea80f1a7957a5c2b1e92075a28352542f31ac46a0c"
-		logic_hash = "adafac8692ad676b0168b3e829bc7948db72953b95c79d483ae1a05f1d4f9b2b"
+		logic_hash = "v1_sha256_adafac8692ad676b0168b3e829bc7948db72953b95c79d483ae1a05f1d4f9b2b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133774,14 +133844,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_14
 	meta:
 		description = "Cobalt Strike's resources/beacon.dll Versions 3.14"
 		author = "gssincla@google.com"
-		id = "00edfc72-c7b8-5100-8275-ae3548b96e49"
+		id = "55e188cd-22b7-5b4b-9882-cb5edace174c"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L838-L866"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "254c68a92a7108e8c411c7b5b87a2f14654cd9f1324b344f036f6d3b6c7accda"
-		logic_hash = "6faed2b69647b87d86d46ae73ad92cfe7b2746c306cd7480dc9f0c484c8882e2"
+		logic_hash = "v1_sha256_6faed2b69647b87d86d46ae73ad92cfe7b2746c306cd7480dc9f0c484c8882e2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133799,14 +133869,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_0_Suspected
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.0 (suspected, not confirmed)"
 		author = "gssincla@google.com"
-		id = "50ff6e44-ebc0-5000-a816-b385a6675768"
+		id = "58643098-bdce-5c0a-bcd3-81e3154d0d3c"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L868-L901"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "e2b2b72454776531bbc6a4a5dd579404250901557f887a6bccaee287ac71b248"
-		logic_hash = "6875099bc6df26f829f9f64e70bd7fdac6ac7b83a5596fc9359c127fef4e6db5"
+		logic_hash = "v1_sha256_6875099bc6df26f829f9f64e70bd7fdac6ac7b83a5596fc9359c127fef4e6db5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133823,14 +133893,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_1_And_V4_2
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.1 and 4.2"
 		author = "gssincla@google.com"
-		id = "793df916-bdf7-5743-b008-0113caf38bae"
+		id = "4c124251-7c0f-51a8-b82a-ff7e6abdb8da"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L903-L934"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "daa42f4380cccf8729129768f3588bb98e4833b0c40ad0620bb575b5674d5fc3"
-		logic_hash = "7280a5c3f478ea40b6b72fb4669d5b8c21603e7fbfbc3815a83bc462ee19c0f5"
+		logic_hash = "v1_sha256_7280a5c3f478ea40b6b72fb4669d5b8c21603e7fbfbc3815a83bc462ee19c0f5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133848,14 +133918,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_3_V4_4_V4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.3 and 4.4"
 		author = "gssincla@google.com"
-		id = "976e087c-f371-5fc6-85f8-9c803a91f549"
+		id = "a87eac51-ad8f-5103-812a-df7ecadf53fc"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L936-L967"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "51490c01c72c821f476727c26fbbc85bdbc41464f95b28cdc577e5701790845f"
-		logic_hash = "6608a84c4fd3bf77fd5b426da8be250d8b99878bd746fa23789f4791a164ce33"
+		logic_hash = "v1_sha256_6608a84c4fd3bf77fd5b426da8be250d8b99878bd746fa23789f4791a164ce33"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133873,14 +133943,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_7_Suspected
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.7 (suspected, not confirmed)"
 		author = "gssincla@google.com"
-		id = "4b6f90dd-69f3-5555-9195-6a0aed0fff58"
+		id = "6ad36e38-48b8-51a5-9fc3-d867ce12cdad"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L969-L1002"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "da9e91b3d8df3d53425dd298778782be3bdcda40037bd5c92928395153160549"
-		logic_hash = "297ff7c3acfe6f9676dc6c265c548f017f39ccc5217617344e3bccc704ac4c78"
+		logic_hash = "v1_sha256_297ff7c3acfe6f9676dc6c265c548f017f39ccc5217617344e3bccc704ac4c78"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133897,14 +133967,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_2
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.2"
 		author = "gssincla@google.com"
-		id = "61188243-0b90-5bff-bcc8-50f10ed941f6"
+		id = "3ccb1e97-c457-50fc-95aa-91eec1be49cc"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1029-L1068"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "5993a027f301f37f3236551e6ded520e96872723a91042bfc54775dcb34c94a1"
-		logic_hash = "3803aaac537aec0b188870177e510a3789a71c19be576569b59aa146b2ba62c5"
+		logic_hash = "v1_sha256_3803aaac537aec0b188870177e510a3789a71c19be576569b59aa146b2ba62c5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133923,14 +133993,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_3
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.3"
 		author = "gssincla@google.com"
-		id = "fb96ecff-809e-5704-974e-a2d8ef022daa"
+		id = "2df2980a-ed67-58fe-839b-4cdcba6c5006"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1070-L1109"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "7b00721efeff6ed94ab108477d57b03022692e288cc5814feb5e9d83e3788580"
-		logic_hash = "514d491b8066ed7127ebb152a27efbe65e1121da3b5460afe6987920a91f2863"
+		logic_hash = "v1_sha256_514d491b8066ed7127ebb152a27efbe65e1121da3b5460afe6987920a91f2863"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133949,14 +134019,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_4
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.4"
 		author = "gssincla@google.com"
-		id = "97ef152c-86c7-513c-a881-e7d594d38dcf"
+		id = "f7952efd-e6a8-5f94-8da3-c17d8e27a172"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1111-L1148"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "5a4d48c2eda8cda79dc130f8306699c8203e026533ce5691bf90363473733bf0"
-		logic_hash = "65aa42265133038f6f568c021c0228440e84e236829af50796a73f6923f46395"
+		logic_hash = "v1_sha256_65aa42265133038f6f568c021c0228440e84e236829af50796a73f6923f46395"
 		score = 75
 		quality = 85
 		tags = ""
@@ -133975,14 +134045,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_5_Hf1_And_V3_5_1
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.5-hf1 and 3.5.1"
 		author = "gssincla@google.com"
-		id = "0c0e87d3-e0e2-5ddc-9d89-5e56443da4b8"
+		id = "71bf6f95-173c-5a9b-8c74-3d4809f413b4"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1150-L1189"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "934134ab0ee65ec76ae98a9bb9ad0e9571d80f4bf1eb3491d58bacf06d42dc8d"
-		logic_hash = "5cd69554edb91956f4ec4c3c5e55f4cd9c3665656c318220ba3a270c0bb0a690"
+		logic_hash = "v1_sha256_5cd69554edb91956f4ec4c3c5e55f4cd9c3665656c318220ba3a270c0bb0a690"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134001,14 +134071,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_6
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.6"
 		author = "gssincla@google.com"
-		id = "9651a1ca-d8ea-5b0b-bcba-a850c2e07791"
+		id = "c20ea571-0959-5d87-a8e1-51ee51d3b3c0"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1191-L1233"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "92b0a4aec6a493bcb1b72ce04dd477fd1af5effa0b88a9d8283f26266bb019a1"
-		logic_hash = "d6aff186a01386992f004cb775d280f9b6e7e16d7ecee662d61e3485b0bc088b"
+		logic_hash = "v1_sha256_d6aff186a01386992f004cb775d280f9b6e7e16d7ecee662d61e3485b0bc088b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134028,14 +134098,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_7
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.7"
 		author = "gssincla@google.com"
-		id = "27fad98a-2882-5c52-af6e-c7dcf5559624"
+		id = "9cd2b623-f6b9-503e-b201-c2f743baf87d"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1235-L1274"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "81296a65a24c0f6f22208b0d29e7bb803569746ce562e2fa0d623183a8bcca60"
-		logic_hash = "89499e01acd607b2fbcdd134c74ca4a901c00c7c9cf70dd241cc538c1c0d083a"
+		logic_hash = "v1_sha256_89499e01acd607b2fbcdd134c74ca4a901c00c7c9cf70dd241cc538c1c0d083a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134054,14 +134124,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_8
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.8"
 		author = "gssincla@google.com"
-		id = "89809d81-9a8b-5cf3-a251-689bf52e98e0"
+		id = "f756ca5d-99ec-5717-8fa8-d37e6db75fe6"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1276-L1310"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "547d44669dba97a32cb9e95cfb8d3cd278e00599e6a11080df1a9d09226f33ae"
-		logic_hash = "8845b71ce4401fd194eb88f04dbf1f313af8b4853da004e63261ca3158fcb1d4"
+		logic_hash = "v1_sha256_8845b71ce4401fd194eb88f04dbf1f313af8b4853da004e63261ca3158fcb1d4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134079,14 +134149,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_11
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.11 (two subversions)"
 		author = "gssincla@google.com"
-		id = "bf0c7661-2583-5fca-beb5-abb2b50c860d"
+		id = "7b2e7c9b-406e-5de4-bfb2-7093ff2e85e7"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1312-L1366"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "64007e104dddb6b5d5153399d850f1e1f1720d222bed19a26d0b1c500a675b1a"
-		logic_hash = "9c34b23b659463a0ab92949031a9b3246aa95256d1548b2f0ad53fe3d379997d"
+		logic_hash = "v1_sha256_9c34b23b659463a0ab92949031a9b3246aa95256d1548b2f0ad53fe3d379997d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134113,14 +134183,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_12
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.12"
 		author = "gssincla@google.com"
-		id = "6eeae9f4-96e0-5a98-a8dc-779c916cd968"
+		id = "67486dcf-adc3-5d59-8ada-589f1e2c36a8"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1368-L1404"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "8a28b7a7e32ace2c52c582d0076939d4f10f41f4e5fa82551e7cc8bdbcd77ebc"
-		logic_hash = "7457b20f2a7dc7e8c3317cedbcfccae30ecc8dc164188c0321f9485fdfab0f6e"
+		logic_hash = "v1_sha256_7457b20f2a7dc7e8c3317cedbcfccae30ecc8dc164188c0321f9485fdfab0f6e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134138,14 +134208,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_13
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.13"
 		author = "gssincla@google.com"
-		id = "202eb8ea-7afb-515b-9306-67514abf5e55"
+		id = "56485d8c-8e09-5ff0-a944-496725cd8eda"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1407-L1440"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "945e10dcd57ba23763481981c6035e0d0427f1d3ba71e75decd94b93f050538e"
-		logic_hash = "81571a6c30802430d0df9980e005736d58464bde98c0889b48bf8d0c7e88d247"
+		logic_hash = "v1_sha256_81571a6c30802430d0df9980e005736d58464bde98c0889b48bf8d0c7e88d247"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134163,14 +134233,14 @@ rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_14
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.14"
 		author = "gssincla@google.com"
-		id = "d69171e3-86f4-5187-8874-5eee2045f746"
+		id = "6f58f850-2ff1-5370-ab92-020232f409c9"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1442-L1477"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "297a8658aaa4a76599a7b79cb0da5b8aa573dd26c9e2c8f071e591200cf30c93"
-		logic_hash = "87cf465154d4294eeda9cf99c6c160da80cfa8a65244bc083737c0c87163431d"
+		logic_hash = "v1_sha256_87cf465154d4294eeda9cf99c6c160da80cfa8a65244bc083737c0c87163431d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134189,14 +134259,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_X86_V4_0_Suspected
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.0 (suspected, not confirmed)"
 		author = "gssincla@google.com"
-		id = "28a735c4-87d1-5e14-9379-46a6fd0cdd2a"
+		id = "13469495-6972-5d9e-87d3-7c0ccb7bb058"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1480-L1515"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "55aa2b534fcedc92bb3da54827d0daaa23ece0f02a10eb08f5b5247caaa63a73"
-		logic_hash = "0dbf6a75dc74f4c2a7604072a01e2dbaaee15f5e57c765f24138d85c248fb305"
+		logic_hash = "v1_sha256_0dbf6a75dc74f4c2a7604072a01e2dbaaee15f5e57c765f24138d85c248fb305"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134215,14 +134285,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_1_And_V_4_2
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.1 and 4.2"
 		author = "gssincla@google.com"
-		id = "dc320d17-98fc-5df3-ba05-4d134129317e"
+		id = "e3320fbf-c715-54db-a47f-7c399e66827a"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1517-L1553"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "29ec171300e8d2dad2e1ca2b77912caf0d5f9d1b633a81bb6534acb20a1574b2"
-		logic_hash = "9b262ec18f79ab5ae63ad26d3685af088b5feb2d66de6ad3ba584cafbe2ee221"
+		logic_hash = "v1_sha256_9b262ec18f79ab5ae63ad26d3685af088b5feb2d66de6ad3ba584cafbe2ee221"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134241,14 +134311,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_3
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Version 4.3"
 		author = "gssincla@google.com"
-		id = "572616c7-d1ec-5aa1-b142-4f2edf73737f"
+		id = "3d84b95d-5853-5200-8da2-8a7aaf23a8f1"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1555-L1590"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "3ac9c3525caa29981775bddec43d686c0e855271f23731c376ba48761c27fa3d"
-		logic_hash = "0c8934e997583339145749a3167ac010d8c77b2ed878d2c999de68ec2a98101d"
+		logic_hash = "v1_sha256_0c8934e997583339145749a3167ac010d8c77b2ed878d2c999de68ec2a98101d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134266,14 +134336,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_4_V_4_5_And_V4_6
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.4 through at least 4.6"
 		author = "gssincla@google.com"
-		id = "79b6bfd4-1e45-5bd9-ac5c-19eb176ce698"
+		id = "fad5cf41-e4b0-51ee-affe-7fe656342bc9"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1593-L1628"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "3280fec57b7ca94fd2bdb5a4ea1c7e648f565ac077152c5a81469030ccf6ab44"
-		logic_hash = "be0bbf58a176f8089924b3ce58268d906f49dde51d863524971e46f4bada43a3"
+		logic_hash = "v1_sha256_be0bbf58a176f8089924b3ce58268d906f49dde51d863524971e46f4bada43a3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134291,14 +134361,14 @@ rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_5_Variant
 	meta:
 		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.5 (variant)"
 		author = "gssincla@google.com"
-		id = "45715da9-8f16-5304-b216-1ca36c508c77"
+		id = "7f2b08a8-f5ec-529b-a892-0543b4b146c0"
 		date = "2022-11-18"
 		modified = "2023-12-04"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1630-L1665"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "8f0da7a45945b630cd0dfb5661036e365dcdccd085bc6cff2abeec6f4c9f1035"
-		logic_hash = "31a108168489a24d1bc297d722741f3fd19abd1bed4c76d54967c73986d18123"
+		logic_hash = "v1_sha256_31a108168489a24d1bc297d722741f3fd19abd1bed4c76d54967c73986d18123"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134316,14 +134386,14 @@ rule GCTI_Cobaltstrike_Resources_Browserpivot_X64_Bin_V1_48_To_V3_14_And_Sleeve_
 	meta:
 		description = "Cobalt Strike's resources/browserpivot.x64.bin from v1.48 to v3.14 and sleeve/browserpivot.x64.dll from v4.0 to at least v4.4"
 		author = "gssincla@google.com"
-		id = "a5dfae85-ff9c-5ca5-9ac0-041c6108a6ed"
+		id = "ed405ef7-8a32-59fa-8970-2d73a9f8937b"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_x64_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_x64_Dll_v4_0_to_v4_x.yara#L17-L64"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "0ad32bc4fbf3189e897805cec0acd68326d9c6f714c543bafb9bc40f7ac63f55"
-		logic_hash = "a59f19b6e258b724ed88b4255717d066319ba5fb0838d6c6ed11355e9d9b1c22"
+		logic_hash = "v1_sha256_a59f19b6e258b724ed88b4255717d066319ba5fb0838d6c6ed11355e9d9b1c22"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134354,14 +134424,14 @@ rule GCTI_Cobaltstrike_Resources_Dnsstager_Bin_V1_47_Through_V4_X
 	meta:
 		description = "Cobalt Strike's resources/dnsstager.bin signature for versions 1.47 to 4.x"
 		author = "gssincla@google.com"
-		id = "e1b0e368-9bcf-5d9b-b2b3-8414742f213e"
+		id = "0c575b3c-f450-550d-b5d0-bc8c0f38684e"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Dnsstager_Bin_v1_47_through_v4_x.yara#L17-L78"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "10f946b88486b690305b87c14c244d7bc741015c3fef1c4625fa7f64917897f1"
-		logic_hash = "d4500d8a83a821e1df9e808b17a87c1207d78ea0e03886544a632176fe93ccd0"
+		logic_hash = "v1_sha256_d4500d8a83a821e1df9e808b17a87c1207d78ea0e03886544a632176fe93ccd0"
 		score = 75
 		quality = 83
 		tags = ""
@@ -134399,14 +134469,14 @@ rule GCTI_Cobaltstrike_Resources_Xor_Bin__64Bit_V3_12_To_V4_X
 	meta:
 		description = "Cobalt Strike's resource/xor64.bin signature for version 3.12 through 4.x"
 		author = "gssincla@google.com"
-		id = "5bb465ee-3bbd-5bfe-8b63-1f243de217bc"
+		id = "8885f04b-2629-55fa-aa16-80a1abf1f527"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__64bit_v3_12_to_4_x.yara#L17-L38"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "01dba8783768093b9a34a1ea2a20f72f29fd9f43183f3719873df5827a04b744"
-		logic_hash = "aabaad09408ae292a0bbc678c334f9f54364b4f6b882846072c303bf826fc2da"
+		logic_hash = "v1_sha256_aabaad09408ae292a0bbc678c334f9f54364b4f6b882846072c303bf826fc2da"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134424,14 +134494,14 @@ rule GCTI_Cobaltstrike_Resources_Bypassuactoken_Dll_V3_11_To_V3_14
 	meta:
 		description = "Cobalt Strike's resources/bypassuactoken.dll from v3.11 to v3.14 (32-bit version)"
 		author = "gssincla@google.com"
-		id = "b9f25fa5-bd1d-5ba0-9b1d-bb97e1dbf76b"
+		id = "50dde2ce-a8b4-562c-9cc5-73837008965c"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_Dll_v3_11_to_v3_14.yara#L17-L151"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "df1c7256dfd78506e38c64c54c0645b6a56fc56b2ffad8c553b0f770c5683070"
-		logic_hash = "fe0780b7f4c16b55cfa00ea7de4da8ce349ec8a72de763b72e816ebc8e934b6d"
+		logic_hash = "v1_sha256_fe0780b7f4c16b55cfa00ea7de4da8ce349ec8a72de763b72e816ebc8e934b6d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134505,14 +134575,14 @@ rule GCTI_Cobaltstrike_Resources_Artifact32Svc_Exe_V3_1_V3_2_V3_14_And_V4_X
 	meta:
 		description = "Cobalt Strike's resources/artifact32svc(big).exe signature for versions 3.1 and 3.2 (with overlap with v3.14 through v4.x)"
 		author = "gssincla@google.com"
-		id = "732169be-e334-5774-b0ac-54b217a8b681"
+		id = "59632661-4f93-5101-8ed2-9498cbd74665"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32svc_Exe_v1_49_to_v4_x.yara#L53-L77"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "871390255156ce35221478c7837c52d926dfd581173818620b738b4b029e6fd9"
-		logic_hash = "b55211fc2dbe100edb19c3f3a000be513144e3556c4bce8a29a3c0b77451ba96"
+		logic_hash = "v1_sha256_b55211fc2dbe100edb19c3f3a000be513144e3556c4bce8a29a3c0b77451ba96"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134528,14 +134598,14 @@ rule GCTI_Cobaltstrike_Resources_Covertvpn_Dll_V2_1_To_V4_X
 	meta:
 		description = "Cobalt Strike's resources/covertvpn.dll signature for version v2.2 to v4.4"
 		author = "gssincla@google.com"
-		id = "a65b855c-5703-5b9f-bb57-da8ebf898f9b"
+		id = "3372c79d-98f5-5267-a738-bc22a0db8d70"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_Dll_v2_1_to_v4_x.yara#L17-L120"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "0a452a94d53e54b1df6ba02bc2f02e06d57153aad111171a94ec65c910d22dcf"
-		logic_hash = "1f6e4254fdfd4f9b13c2000333aabbb7da90d2df7ee1b12faa6ea3c066351468"
+		logic_hash = "v1_sha256_1f6e4254fdfd4f9b13c2000333aabbb7da90d2df7ee1b12faa6ea3c066351468"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134594,14 +134664,14 @@ rule GCTI_Cobaltstrike_Resources_Artifact64_V1_49_V2_X_V3_0_V3_3_Thru_V3_14
 	meta:
 		description = "Cobalt Strike's resources/artifact64{.dll,.exe,big.exe,big.dll,bigsvc.exe,big.x64.dll} and resources/rtifactuac(alt)64.dll signature for versions v1.49, v2.x, v3.0, and v3.3 through v3.14"
 		author = "gssincla@google.com"
-		id = "67902782-500e-5a89-8b2a-59ee21bcba3e"
+		id = "0a46ffe7-adcd-5daf-88fa-4919d41197ad"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L17-L54"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "9ec57d306764517b5956b49d34a3a87d4a6b26a2bb3d0fdb993d055e0cc9920d"
-		logic_hash = "289950e89fc743ff4a1b7dcb91c561c7d829cfe3ade1c2f1a09f2e9701cce461"
+		logic_hash = "v1_sha256_289950e89fc743ff4a1b7dcb91c561c7d829cfe3ade1c2f1a09f2e9701cce461"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134617,14 +134687,14 @@ rule GCTI_Cobaltstrike_Resources_Artifact64_V3_1_V3_2_V3_14_And_V4_0
 	meta:
 		description = "Cobalt Strike's resources/artifact64{svcbig.exe,.dll,big.dll,svc.exe} and resources/artifactuac(big)64.dll signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x"
 		author = "gssincla@google.com"
-		id = "c9e9b8e0-16fe-5abc-b1fe-0e3e586f6db6"
+		id = "b4a5bd03-e18e-518d-92c9-27dbb3dc7b84"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L56-L84"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "2e7a39bd6ac270f8f548855b97c4cef2c2ce7f54c54dd4d1aa0efabeecf3ba90"
-		logic_hash = "e5af04baa1d18d5a2a2c005b40bf93fe6a7b2d7116dfcf3c5b3fa36657448eb9"
+		logic_hash = "v1_sha256_e5af04baa1d18d5a2a2c005b40bf93fe6a7b2d7116dfcf3c5b3fa36657448eb9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134640,14 +134710,14 @@ rule GCTI_Cobaltstrike_Resources_Artifact64_V3_14_To_V4_X
 	meta:
 		description = "Cobalt Strike's resources/artifact64{.exe,.dll,svc.exe,svcbig.exe,big.exe,big.dll,.x64.dll,big.x64.dll} and resource/artifactuac(alt)64.exe signature for versions v3.14 through v4.x"
 		author = "gssincla@google.com"
-		id = "1c7731d3-429b-57aa-9c17-8de7d0841b1e"
+		id = "9c810ee4-c04b-5ff2-a2c6-d415a0ce4692"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L86-L128"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "decfcca0018f2cec4a200ea057c804bb357300a67c6393b097d52881527b1c44"
-		logic_hash = "af8ba6ba62bf1179510b0940e60f893f61b3ba10c81001dd90fe4c3521e56a37"
+		logic_hash = "v1_sha256_af8ba6ba62bf1179510b0940e60f893f61b3ba10c81001dd90fe4c3521e56a37"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134676,14 +134746,14 @@ rule GCTI_Cobaltstrike_Resources_Template_X64_Ps1_V3_0_To_V4_X_Excluding_3_12_3_
 	meta:
 		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13"
 		author = "gssincla@google.com"
-		id = "5a808113-aacb-56ca-b3ec-166c73c54b85"
+		id = "3626bf40-c6ce-5040-869d-11b899b87653"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13.yara#L17-L37"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
-		logic_hash = "80823b8590004686ebd83958cad16094ea2f6958a837d87934507531a00df77a"
+		logic_hash = "v1_sha256_80823b8590004686ebd83958cad16094ea2f6958a837d87934507531a00df77a"
 		score = 75
 		quality = 81
 		tags = ""
@@ -134705,14 +134775,14 @@ rule GCTI_Cobaltstrike_Resources_Bind64_Bin_V2_5_Through_V4_X
 	meta:
 		description = "Cobalt Strike's resources/bind64.bin signature for versions v2.5 to v4.x"
 		author = "gssincla@google.com"
-		id = "a01e7bc3-40e9-5f87-8fd6-926972be273b"
+		id = "9ceccb62-eba8-5c59-8b6d-63cb8be6478c"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bind64_Bin_v2_5_through_v4_x.yara#L17-L109"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "5dd136f5674f66363ea6463fd315e06690d6cb10e3cc516f2d378df63382955d"
-		logic_hash = "ba79abc5cfeaccb94699c0d85c16b2ddf6820bc148c0fd1c9b33c07222e36cb6"
+		logic_hash = "v1_sha256_ba79abc5cfeaccb94699c0d85c16b2ddf6820bc148c0fd1c9b33c07222e36cb6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134762,14 +134832,14 @@ rule GCTI_Cobaltstrike_Resources_Covertvpn_Injector_Exe_V1_44_To_V2_0_49
 	meta:
 		description = "Cobalt Strike's resources/covertvpn-injector.exe signature for version v1.44 to v2.0.49"
 		author = "gssincla@google.com"
-		id = "48485ae2-1d99-5fa8-b8e8-0047e92ef447"
+		id = "91cc4182-3201-5799-a5a9-5da75a11f563"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49.yara#L17-L116"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "d741751520f46602f5a57d1ed49feaa5789115aeeba7fa4fc7cbb534ee335462"
-		logic_hash = "119602efe6243d8c0dc7b8f4468eb9b3be292620920f69dc8a560f900ac7f622"
+		logic_hash = "v1_sha256_119602efe6243d8c0dc7b8f4468eb9b3be292620920f69dc8a560f900ac7f622"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134826,14 +134896,14 @@ rule GCTI_Cobaltstrike_Resources_Reverse_Bin_V2_5_Through_V4_X
 	meta:
 		description = "Cobalt Strike's resources/reverse.bin signature for versions 2.5 to 4.x"
 		author = "gssincla@google.com"
-		id = "182dbcd0-1180-5516-abe3-cf2eebbd0e39"
+		id = "ee4072c6-518c-51b0-b3d6-2faed6bf10bc"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Reverse_Bin_v2_5_through_v4_x.yara#L17-L104"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "887f666d6473058e1641c3ce1dd96e47189a59c3b0b85c8b8fccdd41b84000c7"
-		logic_hash = "c6c4fc477c7654ec07eb6ef4c6d53805a9b4881ba288754e1f50b3e4b134333c"
+		logic_hash = "v1_sha256_c6c4fc477c7654ec07eb6ef4c6d53805a9b4881ba288754e1f50b3e4b134333c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134881,14 +134951,14 @@ rule GCTI_Cobaltstrike_Resources_Reverse64_Bin_V2_5_Through_V4_X
 	meta:
 		description = "Cobalt Strike's resources/reverse64.bin signature for versions v2.5 to v4.x"
 		author = "gssincla@google.com"
-		id = "966e6e4c-85e2-5c94-8245-25367802b7d2"
+		id = "3c46bd39-f4da-5506-9cb5-8c916aa941af"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Reverse64_Bin_v2_5_through_v4_x.yara#L17-L99"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "d2958138c1b7ef681a63865ec4a57b0c75cc76896bf87b21c415b7ec860397e8"
-		logic_hash = "c657234156293b9ac363b677490739ab0b5cc2ef149c9d9c37332dab9bb012f6"
+		logic_hash = "v1_sha256_c657234156293b9ac363b677490739ab0b5cc2ef149c9d9c37332dab9bb012f6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134934,14 +135004,14 @@ rule GCTI_Cobaltstrike_Resources_Smbstager_Bin_V2_5_Through_V4_X
 	meta:
 		description = "Cobalt Strike's resources/smbstager.bin signature for versions 2.5 to 4.x"
 		author = "gssincla@google.com"
-		id = "074b7d83-e3d8-541c-804b-2417c21f54d5"
+		id = "88928947-6091-56f3-9442-aa9c73fc31bd"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Smbstager_Bin_v2_5_through_v4_x.yara#L17-L95"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "946af5a23e5403ea1caccb2e0988ec1526b375a3e919189f16491eeabc3e7d8c"
-		logic_hash = "b0f6535069df16a64de44ca0638ec060c1ff264a7820c94710d61ca7e8474450"
+		logic_hash = "v1_sha256_b0f6535069df16a64de44ca0638ec060c1ff264a7820c94710d61ca7e8474450"
 		score = 75
 		quality = 85
 		tags = ""
@@ -134986,14 +135056,14 @@ rule GCTI_Cobaltstrike_Resources_Artifact32_And_Resources_Dropper_V1_49_To_V3_14
 	meta:
 		description = "Cobalt Strike's resources/artifact32{.exe,.dll,big.exe,big.dll} and resources/dropper.exe signature for versions 1.49 to 3.14"
 		author = "gssincla@google.com"
-		id = "243e3761-cbea-561c-97da-f6ba12ebc7ee"
+		id = "5c2a2c02-8b74-588a-ab49-bb82736ef6f7"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L17-L32"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "40fc605a8b95bbd79a3bd7d9af73fbeebe3fada577c99e7a111f6168f6a0d37a"
-		logic_hash = "437706c808bca28384a6e8e24fa3ae120a4ebe4166fa4ca3564c58b881fb23a8"
+		logic_hash = "v1_sha256_437706c808bca28384a6e8e24fa3ae120a4ebe4166fa4ca3564c58b881fb23a8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135009,14 +135079,14 @@ rule GCTI_Cobaltstrike_Resources_Artifact32_V3_1_And_V3_2
 	meta:
 		description = "Cobalt Strike's resources/artifact32{.dll,.exe,svc.exe,big.exe,big.dll,bigsvc.exe} and resources/artifact32uac(alt).dll signature for versions 3.1 and 3.2"
 		author = "gssincla@google.com"
-		id = "4fff7f42-9f50-5945-8ec0-2438ac5c7000"
+		id = "864e85b7-0bca-5a88-8aba-c20f07f3fa16"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L34-L60"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "4f14bcd7803a8e22e81e74d6061d0df9e8bac7f96f1213d062a29a8523ae4624"
-		logic_hash = "7a0d33d0260c762b4aa67e4084d7474338c60aa684fd3e622614745d90350da8"
+		logic_hash = "v1_sha256_7a0d33d0260c762b4aa67e4084d7474338c60aa684fd3e622614745d90350da8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135032,14 +135102,14 @@ rule GCTI_Cobaltstrike_Resources_Artifact32_V3_14_To_V4_X
 	meta:
 		description = "Cobalt Strike's resources/artifact32{.dll,.exe,big.exe,big.dll,bigsvc.exe} signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x and resources/artifact32uac.dll for v3.14 and v4.0"
 		author = "gssincla@google.com"
-		id = "8a010305-dce5-55f4-b2dd-a736721efe22"
+		id = "4c1ed311-3a9e-54be-85b8-c65fff352737"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L62-L89"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "888bae8d89c03c1d529b04f9e4a051140ce3d7b39bc9ea021ad9fc7c9f467719"
-		logic_hash = "fc5c353c568e33df80fa5bab14d11112ca211e269043b83dba8b7d1a6a008a7b"
+		logic_hash = "v1_sha256_fc5c353c568e33df80fa5bab14d11112ca211e269043b83dba8b7d1a6a008a7b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135056,14 +135126,14 @@ rule GCTI_Cobaltstrike_Resources_Bind_Bin_V2_5_Through_V4_X
 	meta:
 		description = "Cobalt Strike's resources/bind.bin signature for versions 2.5 to 4.x"
 		author = "gssincla@google.com"
-		id = "32f129c1-9845-5843-9e16-7d9af217b8e2"
+		id = "c4c1cd7a-2bff-5b7e-bf58-91022ddb4471"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bind_Bin_v2_5_through_v4_x.yara#L17-L111"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "3727542c0e3c2bf35cacc9e023d1b2d4a1e9e86ee5c62ee5b66184f46ca126d1"
-		logic_hash = "cf04e257590cf0673059348f5c15926918eb8aee40e864ae65979360aca80013"
+		logic_hash = "v1_sha256_cf04e257590cf0673059348f5c15926918eb8aee40e864ae65979360aca80013"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135115,14 +135185,14 @@ rule GCTI_Cobaltstrike_Resources_Xor_Bin_V2_X_To_V4_X
 	meta:
 		description = "Cobalt Strike's resource/xor.bin signature for version 2.x through 4.x"
 		author = "gssincla@google.com"
-		id = "1754746c-3a42-5f7d-808a-ba2e1c0a270e"
+		id = "ddacf656-95cb-514c-909c-96bf276cf041"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__32bit_v2_x_to_4_x.yara#L17-L36"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "211ccc5d28b480760ec997ed88ab2fbc5c19420a3d34c1df7991e65642638a6f"
-		logic_hash = "ad662a263ede6c3ba964baf8abe4848ed1e994f2c236d4315cb60c1d51442620"
+		logic_hash = "v1_sha256_ad662a263ede6c3ba964baf8abe4848ed1e994f2c236d4315cb60c1d51442620"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135139,14 +135209,14 @@ rule GCTI_Cobaltstrike_Resources_Command_Ps1_V2_5_To_V3_7_And_Resources_Compress
 	meta:
 		description = "Cobalt Strike's resources/command.ps1 for versions 2.5 to v3.7 and resources/compress.ps1 from v3.8 to v4.x"
 		author = "gssincla@google.com"
-		id = "c0b81deb-ed20-5f7e-8e15-e6a9e9362594"
+		id = "3a7d3f5f-4c04-5a4b-91c6-0aea915151ad"
 		date = "2022-11-18"
 		modified = "2022-11-22"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Command_Ps1_v2_5_to_v3_7_and_Resources_Compress_Ps1_v3_8_to_v4_x.yara#L17-L33"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "932dec24b3863584b43caf9bb5d0cfbd7ed1969767d3061a7abdc05d3239ed62"
-		logic_hash = "31cf47060757b086d325cd205724a7be8931bbbc6ff2f4be67a6179ee99c42ca"
+		logic_hash = "v1_sha256_31cf47060757b086d325cd205724a7be8931bbbc6ff2f4be67a6179ee99c42ca"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135163,14 +135233,14 @@ rule GCTI_Cobaltstrike_Resources_Template_Sct_V3_3_To_V4_X
 	meta:
 		description = "Cobalt Strike's resources/template.sct signature for versions v3.3 to v4.x"
 		author = "gssincla@google.com"
-		id = "9d2b1dfa-5f76-503f-9198-6ed0d039e0cb"
+		id = "b1d0f969-7cc5-591e-90f7-0355388816f1"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Sct_v3_3_to_v4_x.yara#L17-L38"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
-		logic_hash = "8868445ced4945c469764b7f311d6cb11c99cf0f2d770113e5e617e0187a962c"
+		logic_hash = "v1_sha256_8868445ced4945c469764b7f311d6cb11c99cf0f2d770113e5e617e0187a962c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135186,21 +135256,21 @@ rule GCTI_Cobaltstrike_Resources_Template_Sct_V3_3_To_V4_X
 		$scriptletend = "</scriptlet>"
 
 	condition:
-		all of them and @scriptletstart[1]<@registration[1] and @registration[1]<@classid[1] and @classid[1]<@scriptlang[1] and @scriptlang[1]<@cdata[1]
+		all of them and @scriptletstart [ 1 ] < @registration [ 1 ] and @registration [ 1 ] < @classid [ 1 ] and @classid [ 1 ] < @scriptlang [ 1 ] and @scriptlang [ 1 ] < @cdata [ 1 ]
 }
 rule GCTI_Cobaltstrike_Resources_Httpsstager64_Bin_V3_2_Through_V4_X
 {
 	meta:
 		description = "Cobalt Strike's resources/httpsstager64.bin signature for versions v3.2 to v4.x"
 		author = "gssincla@google.com"
-		id = "c16e73fc-484a-5f7e-8127-d85a0254d842"
+		id = "aa8d003b-b1a5-51ce-a50a-624a53a25d31"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager64_Bin_v3_2_through_v4_x.yara#L17-L90"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "109b8c55816ddc0defff360c93e8a07019ac812dd1a42209ea7e95ba79b5a573"
-		logic_hash = "4889a23c1f2780044b9fb2a0207676d57e82e6c1275614b684a5a9cbe984b761"
+		logic_hash = "v1_sha256_4889a23c1f2780044b9fb2a0207676d57e82e6c1275614b684a5a9cbe984b761"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135242,14 +135312,14 @@ rule GCTI_Cobaltstrike_Resources_Template_Py_V3_3_To_V4_X
 	meta:
 		description = "Cobalt Strike's resources/template.py signature for versions v3.3 to v4.x"
 		author = "gssincla@google.com"
-		id = "16aef9a9-b217-5462-93dc-f6273c99ddd0"
+		id = "ea7f611c-670d-58dd-b2a1-3c106fcbb681"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Py_v3_3_to_v4_x.yara#L17-L36"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "d5cb406bee013f51d876da44378c0a89b7b3b800d018527334ea0c5793ea4006"
-		logic_hash = "3c26cea4b8f2b200bf58e939ae9ead7a7339d4ec0de8c72b3d9c7da897600081"
+		logic_hash = "v1_sha256_3c26cea4b8f2b200bf58e939ae9ead7a7339d4ec0de8c72b3d9c7da897600081"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135270,14 +135340,14 @@ rule GCTI_Cobaltstrike_Resources_Elevate_Dll_V3_0_To_V3_14_And_Sleeve_Elevate_Dl
 	meta:
 		description = "Cobalt Strike's resources/elevate.dll signature for v3.0 to v3.14 and sleeve/elevate.dll for v4.x"
 		author = "gssincla@google.com"
-		id = "170f62a2-ba4f-5be8-9ec5-402eb7bbde4e"
+		id = "c402bcd9-f842-53a5-9fbd-64b92b1bf01e"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_Dll_v4_x.yara#L17-L68"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "6deeb2cafe9eeefe5fc5077e63cc08310f895e9d5d492c88c4e567323077aa2f"
-		logic_hash = "766a0a390ed8cefe43d82a054a9b2cfec7eced75e0d7ee10231215043577b75e"
+		logic_hash = "v1_sha256_766a0a390ed8cefe43d82a054a9b2cfec7eced75e0d7ee10231215043577b75e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135310,14 +135380,14 @@ rule GCTI_Cobaltstrike_Resources_Template_X86_Vba_V3_8_To_V4_X
 	meta:
 		description = "Cobalt Strike's resources/template.x86.vba signature for versions v3.8 to v4.x"
 		author = "gssincla@google.com"
-		id = "11c7758e-93b2-5fe3-873d-b98de579d2b4"
+		id = "288e243e-37e3-5463-9e97-caf69c7a74df"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_x86_Vba_v3_8_to_v4_x.yara#L17-L37"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
-		logic_hash = "7114515477d82651806eccef34f599f6ffd4614f987dee29417ac6ef7a1a1c38"
+		logic_hash = "v1_sha256_7114515477d82651806eccef34f599f6ffd4614f987dee29417ac6ef7a1a1c38"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135332,21 +135402,21 @@ rule GCTI_Cobaltstrike_Resources_Template_X86_Vba_V3_8_To_V4_X
 		$rwxpage = "AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)"
 
 	condition:
-		all of them and @vars[1]<@res[1] and @allocstuff[1]<@rwxpage[1]
+		all of them and @vars [ 1 ] < @res [ 1 ] and @allocstuff [ 1 ] < @rwxpage [ 1 ]
 }
 rule GCTI_Cobaltstrike_Resources_Bypassuac_Dll_V1_49_To_V3_14_And_Sleeve_Bypassuac_Dll_V4_0_To_V4_X
 {
 	meta:
 		description = "Cobalt Strike's resources/bypassuac(-x86).dll from v1.49 to v3.14 (32-bit version) and sleeve/bypassuac.dll from v4.0 to at least v4.4"
 		author = "gssincla@google.com"
-		id = "614046b5-cf81-56a5-8824-b3a7e14a8ed5"
+		id = "3fc12270-5a0e-5b84-a2dc-ce599ed0a203"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_Dll_v1_49_to_v3_14_and_Sleeve_Bypassuac_Dll_v4_0_to_v4_x.yara#L17-L94"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "91d12e1d09a642feedee5da966e1c15a2c5aea90c79ac796e267053e466df365"
-		logic_hash = "7d59c0286f1936e386519a919472d01581b68a8167c89bd3cd3108d45251119a"
+		logic_hash = "v1_sha256_7d59c0286f1936e386519a919472d01581b68a8167c89bd3cd3108d45251119a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135391,14 +135461,14 @@ rule GCTI_Sliver_Implant_64Bit
 	meta:
 		description = "Sliver 64-bit implant (with and without --debug flag at compile)"
 		author = "gssincla@google.com"
-		id = "b84db933-0e11-5871-821d-43697c015665"
+		id = "dec5c958-31fb-57ed-b381-5207b14b5cef"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/Sliver/Sliver__Implant_64bit.yara#L17-L84"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87"
-		logic_hash = "ad4ceef08a732174c8ccbcacf0370b26acb9e5ec0784d8827c8104618e018a26"
+		logic_hash = "v1_sha256_ad4ceef08a732174c8ccbcacf0370b26acb9e5ec0784d8827c8104618e018a26"
 		score = 75
 		quality = 85
 		tags = ""
@@ -135413,21 +135483,21 @@ rule GCTI_Sliver_Implant_64Bit
 		$fp1 = "cloudfoundry" ascii fullword
 
 	condition:
-		5 of ($s*) and not 1 of ($fp*)
+		5 of ( $s* ) and not 1 of ( $fp* )
 }
 rule GCTI_Sliver_Implant_32Bit
 {
 	meta:
 		description = "Sliver 32-bit implant (with and without --debug flag at compile)"
 		author = "gssincla@google.com"
-		id = "6bc4d7d1-64cf-5920-8f07-54a8a7a94f26"
+		id = "54ad2237-5440-50f1-bef3-e4daf8de1367"
 		date = "2022-11-18"
 		modified = "2022-11-19"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
 		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/Sliver/Sliver__Implant_32bit.yara#L17-L81"
 		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
 		hash = "911f4106350871ddb1396410d36f2d2eadac1166397e28a553b28678543a9357"
-		logic_hash = "5b394a198f691b6777438a69d20a423798525daa84a09a0ce346eca5bb66f850"
+		logic_hash = "v1_sha256_5b394a198f691b6777438a69d20a423798525daa84a09a0ce346eca5bb66f850"
 		score = 60
 		quality = 35
 		tags = ""
@@ -135442,13 +135512,13 @@ rule GCTI_Sliver_Implant_32Bit
 		$fp1 = "cloudfoundry" ascii fullword
 
 	condition:
-		4 of ($s*) and not 1 of ($fp*)
+		4 of ( $s* ) and not 1 of ( $fp* )
 }
 /*
  * YARA Rule Set
  * Repository Name: Malpedia
  * Repository: https://github.com/malpedia/signator-rules/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 6558c417dcf07146b1309b6acde6be0aa96dea10
  * Number of Rules: 1469
  * Skipped: 0 (age), 15 (quality), 0 (score), 0 (importance)
@@ -135463,13 +135533,13 @@ rule MALPEDIA_Win_Rook_Auto : FILE
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f7d50ee5-0cf7-58f1-9491-c0b1413c9c03"
+		id = "4c91e458-1502-57ec-8022-46dc872c8890"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rook"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rook_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "8ce4aaa97754380ef7f8444fbf7c6b6bdd739dd7cb13bc80ec0f235cec755f83"
+		logic_hash = "v1_sha256_8ce4aaa97754380ef7f8444fbf7c6b6bdd739dd7cb13bc80ec0f235cec755f83"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135495,20 +135565,20 @@ rule MALPEDIA_Win_Rook_Auto : FILE
 		$sequence_9 = { 440f47e8 44896c2448 418d45ff 0fb68c82e2220400 0fb6b482e3220400 8bd9 8bf8 }
 
 	condition:
-		7 of them and filesize <843776
+		7 of them and filesize < 843776
 }
 rule MALPEDIA_Win_Roseam_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5720401d-650c-5ffa-937c-009deb00b79f"
+		id = "fe65241a-3751-5bd3-9a37-0239dcb9ff3b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roseam"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.roseam_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "6405b276e56fbb6391489a72f41f1ba4fb7da1db3c06ee822f393f99823911b5"
+		logic_hash = "v1_sha256_6405b276e56fbb6391489a72f41f1ba4fb7da1db3c06ee822f393f99823911b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135534,20 +135604,20 @@ rule MALPEDIA_Win_Roseam_Auto : FILE
 		$sequence_9 = { 668901 0fbe560c 89550c 68???????? }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize < 221184
 }
 rule MALPEDIA_Win_Qaccel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1024ae4a-8ecf-5647-a954-71832685cf06"
+		id = "3686b107-6e11-5934-95f7-d405cc141c29"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qaccel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.qaccel_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "5f2f18c31debd22ba8cc6fab103208438701251a4ea3f2ead7d07424fdf86ff4"
+		logic_hash = "v1_sha256_5f2f18c31debd22ba8cc6fab103208438701251a4ea3f2ead7d07424fdf86ff4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135573,20 +135643,20 @@ rule MALPEDIA_Win_Qaccel_Auto : FILE
 		$sequence_9 = { f3a4 668b4df8 668903 66894b02 ff15???????? }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Bedep_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "50676d12-901b-5467-9cc0-ebfacf6cdb1b"
+		id = "d2c9080c-de0e-5165-b6d1-664456bc54d8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bedep"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bedep_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "3972e680d8fcfe1f525b24f026ad26b3e506bdc906b9b363e15bad8bf5e7bda8"
+		logic_hash = "v1_sha256_3972e680d8fcfe1f525b24f026ad26b3e506bdc906b9b363e15bad8bf5e7bda8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135612,20 +135682,20 @@ rule MALPEDIA_Win_Bedep_Auto : FILE
 		$sequence_9 = { 51 56 8b35???????? 85f6 0f8d9b000000 6a05 b004 }
 
 	condition:
-		7 of them and filesize <557056
+		7 of them and filesize < 557056
 }
 rule MALPEDIA_Win_Liteduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0d5b03ab-c51a-5be5-8e11-3fd3c042290f"
+		id = "6448d454-0572-5249-b1ba-1a5edacf26ce"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.liteduke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.liteduke_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "7fa217ead580adfe5b357dd72935fa5df636ba1480b849cad849e2ead7958d39"
+		logic_hash = "v1_sha256_7fa217ead580adfe5b357dd72935fa5df636ba1480b849cad849e2ead7958d39"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135651,20 +135721,20 @@ rule MALPEDIA_Win_Liteduke_Auto : FILE
 		$sequence_9 = { 5a 31c0 8a02 52 50 6a03 e8???????? }
 
 	condition:
-		7 of them and filesize <1171456
+		7 of them and filesize < 1171456
 }
 rule MALPEDIA_Win_Lokipws_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5db76a16-385c-53b6-855b-1bbc58a2e30f"
+		id = "23a8980f-bee8-57b8-b204-996ba8081d92"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lokipws_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "f7396cac0e0e8581cb9065a2315499eb607a41e3e7300cb035a34c55b22b36af"
+		logic_hash = "v1_sha256_f7396cac0e0e8581cb9065a2315499eb607a41e3e7300cb035a34c55b22b36af"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135690,20 +135760,20 @@ rule MALPEDIA_Win_Lokipws_Auto : FILE
 		$sequence_9 = { 8bec 83ec0c 56 6a04 e8???????? 8bf0 }
 
 	condition:
-		7 of them and filesize <1327104
+		7 of them and filesize < 1327104
 }
 rule MALPEDIA_Win_Freenki_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "90a961ff-4b9f-5590-858d-04fe0571f818"
+		id = "ecd448bd-e2ef-558d-a481-7910dd9ca6bb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.freenki"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.freenki_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "2dca0dd103141182e01ae8912e5d010c4bde1802bf1b8f905ac7a8ec2594845a"
+		logic_hash = "v1_sha256_2dca0dd103141182e01ae8912e5d010c4bde1802bf1b8f905ac7a8ec2594845a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135729,20 +135799,20 @@ rule MALPEDIA_Win_Freenki_Auto : FILE
 		$sequence_9 = { 8bd7 c1fa06 8bc7 83e03f 6bc830 8b049578394200 f644082801 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Cryptoshuffler_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f4c7e6b7-7f12-5acd-8436-2c3134e8001d"
+		id = "9945ca59-a572-505f-b2a6-9b49e3b33fad"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshuffler"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cryptoshuffler_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "4b559d81f694922613ae9b35eca370b9546b803a67169819f510f86751d1ed9d"
+		logic_hash = "v1_sha256_4b559d81f694922613ae9b35eca370b9546b803a67169819f510f86751d1ed9d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135768,20 +135838,20 @@ rule MALPEDIA_Win_Cryptoshuffler_Auto : FILE
 		$sequence_9 = { 0f82a5040000 8b4c2410 40 3d00100000 722a f6c11f 0f8562050000 }
 
 	condition:
-		7 of them and filesize <425984
+		7 of them and filesize < 425984
 }
 rule MALPEDIA_Win_Isspace_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b06e0b56-5b2e-5927-89d7-5a1fa4e89bfc"
+		id = "bf6e9a6f-b149-5d98-b62f-13f21c218d71"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isspace"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.isspace_auto.yar#L1-L99"
 		license_url = "N/A"
-		logic_hash = "f9cfbe43c7bd218df762aeca13b65476ac7bccb2b29d82571f83ea3511bd9d7b"
+		logic_hash = "v1_sha256_f9cfbe43c7bd218df762aeca13b65476ac7bccb2b29d82571f83ea3511bd9d7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135805,20 +135875,20 @@ rule MALPEDIA_Win_Isspace_Auto : FILE
 		$sequence_7 = { 50 8d45f0 64a300000000 8965e8 c745fc00000000 ff15???????? 3d04080000 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize < 434176
 }
 rule MALPEDIA_Win_Karius_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bdd5efaf-1311-50f9-afba-26e352ee7308"
+		id = "fd737c86-3a17-5fb2-a12c-958f9bcf83f8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karius"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.karius_auto.yar#L1-L247"
 		license_url = "N/A"
-		logic_hash = "c2392952453e4a9f29da2ad06ae05ba8bdd1282ea8bcab3057e95c6647f70010"
+		logic_hash = "v1_sha256_c2392952453e4a9f29da2ad06ae05ba8bdd1282ea8bcab3057e95c6647f70010"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -135860,20 +135930,20 @@ rule MALPEDIA_Win_Karius_Auto : FILE
 		$sequence_25 = { 41b900300000 448bc0 33d2 488bce ff15???????? 4c8bf0 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize < 434176
 }
 rule MALPEDIA_Win_Winsloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a9fc14a-5291-5130-a2b1-9b0355619f7f"
+		id = "136f6691-2fe7-593d-b667-4ca49f3d0bec"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winsloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.winsloader_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "55e07c31479b98d0a2305c5dcdb238979b21006495ecfde106eb27274a497408"
+		logic_hash = "v1_sha256_55e07c31479b98d0a2305c5dcdb238979b21006495ecfde106eb27274a497408"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135905,20 +135975,20 @@ rule MALPEDIA_Win_Winsloader_Auto : FILE
 		$sequence_15 = { 83e03f c1ff06 6bd830 8b04bdc0c00110 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize < 270336
 }
 rule MALPEDIA_Win_Risepro_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dda5214f-af54-5ca2-a7cc-1bcc410f868f"
+		id = "909db302-30da-59c5-8039-025eac3151dc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.risepro_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "d29313e60d544119ebfa72aa2a82b5ab903014cb2fa565cd9721952588d526d1"
+		logic_hash = "v1_sha256_d29313e60d544119ebfa72aa2a82b5ab903014cb2fa565cd9721952588d526d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135944,20 +136014,20 @@ rule MALPEDIA_Win_Risepro_Auto : FILE
 		$sequence_9 = { 8945dc 8b4d08 e8???????? 8bd0 8d4de7 e8???????? }
 
 	condition:
-		7 of them and filesize <280576
+		7 of them and filesize < 280576
 }
 rule MALPEDIA_Win_Rockloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96a7a61e-00d6-5fd3-8dcd-0a299f4f2b93"
+		id = "5ab585fc-2d51-59bc-983d-2f5fa3f435c7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rockloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rockloader_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "7138f3c287966f118168a5a68bdeb5d70100d456e15e650d1baf5a7a96ef38bb"
+		logic_hash = "v1_sha256_7138f3c287966f118168a5a68bdeb5d70100d456e15e650d1baf5a7a96ef38bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135983,20 +136053,20 @@ rule MALPEDIA_Win_Rockloader_Auto : FILE
 		$sequence_9 = { ff15???????? 8bf3 85db 75b5 5f 5b 5e }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Bee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "db73c98e-464c-5a10-86d4-5be67acb42ee"
+		id = "fea1f24b-56c5-5c8f-bb06-3c77a6cf8b2f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bee"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bee_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "5ff9293be730d91df0bdf17c2150532b12e666a23f61e90864080eb355a44306"
+		logic_hash = "v1_sha256_5ff9293be730d91df0bdf17c2150532b12e666a23f61e90864080eb355a44306"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136022,20 +136092,20 @@ rule MALPEDIA_Win_Bee_Auto : FILE
 		$sequence_9 = { 8bf8 eb02 33ff c744242cffffffff 897c2414 85ff }
 
 	condition:
-		7 of them and filesize <394240
+		7 of them and filesize < 394240
 }
 rule MALPEDIA_Win_Red_Gambler_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "48807a37-e904-5314-8d0b-afd101b942b7"
+		id = "b421c228-0479-5792-80f9-c7ef45206c48"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.red_gambler"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.red_gambler_auto.yar#L1-L307"
 		license_url = "N/A"
-		logic_hash = "5df98b37982fcd6fe80d2e1e665e4de08feffa39ad75db51ff52df159597061f"
+		logic_hash = "v1_sha256_5df98b37982fcd6fe80d2e1e665e4de08feffa39ad75db51ff52df159597061f"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -136083,20 +136153,20 @@ rule MALPEDIA_Win_Red_Gambler_Auto : FILE
 		$sequence_31 = { 8bd8 ffd7 8b3d???????? 6aff ffd7 ffd3 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Elise_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "11ed4b5e-b7d9-57f1-b779-a93a47cbf173"
+		id = "5e10e65b-6e45-59fb-8349-224e4be08804"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.elise"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.elise_auto.yar#L1-L209"
 		license_url = "N/A"
-		logic_hash = "09615a6853721651624e029a2091d82fab132dd6d80506edb16bc08b652a8438"
+		logic_hash = "v1_sha256_09615a6853721651624e029a2091d82fab132dd6d80506edb16bc08b652a8438"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -136133,20 +136203,20 @@ rule MALPEDIA_Win_Elise_Auto : FILE
 		$sequence_20 = { 59 8b45f0 8b55f4 5f 5e 5b c9 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Ahtapot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "205853ed-0c62-5497-8ae7-152aba719174"
+		id = "b58846a8-6e6a-5b5a-9600-3965ec9abd01"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ahtapot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ahtapot_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "392656dae04b266a3580579c812b8abd790d9485771e5a66abe1a48d413d41a8"
+		logic_hash = "v1_sha256_392656dae04b266a3580579c812b8abd790d9485771e5a66abe1a48d413d41a8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136172,20 +136242,20 @@ rule MALPEDIA_Win_Ahtapot_Auto : FILE
 		$sequence_9 = { 8bec 6aff 68???????? 64a100000000 50 81ecb00a0000 a1???????? }
 
 	condition:
-		7 of them and filesize <430080
+		7 of them and filesize < 430080
 }
 rule MALPEDIA_Win_Eternal_Petya_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5412d86d-0c91-551e-8b1c-043b9779137a"
+		id = "f673e817-0117-59ef-88ce-75ec50cad455"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.eternal_petya_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "3d823703098c3ea98ac24fd4bb7c283e7fba6eebd623c0da8c21f46950e9dc6a"
+		logic_hash = "v1_sha256_3d823703098c3ea98ac24fd4bb7c283e7fba6eebd623c0da8c21f46950e9dc6a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136217,20 +136287,20 @@ rule MALPEDIA_Win_Eternal_Petya_Auto : FILE
 		$sequence_15 = { 8bc6 c1f805 57 83e61f 8d3c8500cc4400 }
 
 	condition:
-		7 of them and filesize <851968
+		7 of them and filesize < 851968
 }
 rule MALPEDIA_Win_Micrass_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d96a8185-8065-503d-97cd-f54a64309e1a"
+		id = "d71bb5b5-d4d4-5e0a-ab90-1d193fd2211d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.micrass"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.micrass_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "faa5276115d7780fcc63dd8ad050c766a7977fec6ea03be4a57f43d14c048567"
+		logic_hash = "v1_sha256_faa5276115d7780fcc63dd8ad050c766a7977fec6ea03be4a57f43d14c048567"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136256,20 +136326,20 @@ rule MALPEDIA_Win_Micrass_Auto : FILE
 		$sequence_9 = { 8bcb e8???????? 59 837e4400 57 bf???????? }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Sedll_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ecd5bad1-bc54-5597-9a03-6b9de2dff623"
+		id = "b9ad94e3-8478-5b98-b9be-481fb978e0b3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sedll"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sedll_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "fc4557f56af955238bdd97487f20282917cc4ee0a9fe525b8866f2a10d37bfda"
+		logic_hash = "v1_sha256_fc4557f56af955238bdd97487f20282917cc4ee0a9fe525b8866f2a10d37bfda"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136295,20 +136365,20 @@ rule MALPEDIA_Win_Sedll_Auto : FILE
 		$sequence_9 = { a1???????? 50 8b08 ff5104 33c0 5e 8be5 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Nabucur_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "af73c704-0513-5e82-a77f-ce8e36675074"
+		id = "dbc3096a-3c46-5e8d-9b05-ae73996e4f75"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nabucur"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nabucur_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "ff7129cae3af06c4bcbd1090aa15a0e8967082d3699d9e4f74992cad1754f8c1"
+		logic_hash = "v1_sha256_ff7129cae3af06c4bcbd1090aa15a0e8967082d3699d9e4f74992cad1754f8c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136340,20 +136410,20 @@ rule MALPEDIA_Win_Nabucur_Auto : FILE
 		$sequence_15 = { 49 bbe19321fa e9???????? ba3665c4ff 3006 ebeb }
 
 	condition:
-		7 of them and filesize <1949696
+		7 of them and filesize < 1949696
 }
 rule MALPEDIA_Win_Predator_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b266341-4566-5b09-970f-78abdb005204"
+		id = "8cf0766b-3a94-5a44-bb6a-c2c4752fb221"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.predator"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.predator_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "3bb19506092c3990d39445359bc46f20b598a2af4c01b1d17206710e9f68b421"
+		logic_hash = "v1_sha256_3bb19506092c3990d39445359bc46f20b598a2af4c01b1d17206710e9f68b421"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136379,20 +136449,20 @@ rule MALPEDIA_Win_Predator_Auto : FILE
 		$sequence_9 = { 8811 85c0 75f2 51 8d45fd 50 51 }
 
 	condition:
-		7 of them and filesize <2211840
+		7 of them and filesize < 2211840
 }
 rule MALPEDIA_Win_Odinaff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "91e538b8-49fb-59bb-b141-8774c9ea7c3a"
+		id = "8ea1c23c-adfc-5d9a-aaf1-297c5253c44d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.odinaff"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.odinaff_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "30f018bdaf01e341e417353febba3580b7f1e98a76ca0b650eefbf84ad5901ef"
+		logic_hash = "v1_sha256_30f018bdaf01e341e417353febba3580b7f1e98a76ca0b650eefbf84ad5901ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136418,20 +136488,20 @@ rule MALPEDIA_Win_Odinaff_Auto : FILE
 		$sequence_9 = { 8b1d???????? 50 ffd3 8b4d10 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Chairsmack_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2de2e9d5-c2ea-5429-bfd2-5525076f44e7"
+		id = "cd8f23e0-c9d8-5ba1-a188-0153432284ff"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chairsmack"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chairsmack_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "97781ffb695d6aa345e6e0e1fc6bc5189db5a22419050af0ce259dc4d2e28203"
+		logic_hash = "v1_sha256_97781ffb695d6aa345e6e0e1fc6bc5189db5a22419050af0ce259dc4d2e28203"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136457,20 +136527,20 @@ rule MALPEDIA_Win_Chairsmack_Auto : FILE
 		$sequence_9 = { 68???????? e8???????? 83ec1c c68424b803000062 8bcc 8964244c }
 
 	condition:
-		7 of them and filesize <1974272
+		7 of them and filesize < 1974272
 }
 rule MALPEDIA_Win_Bankshot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86c817d0-2034-5c81-834f-97c8e0010057"
+		id = "a6e78fa0-b555-5ee2-83ff-716222be9f75"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bankshot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bankshot_auto.yar#L1-L425"
 		license_url = "N/A"
-		logic_hash = "c44d83d86e3231c57414d81c161d108153b74cf74b3e3cc50eaea1f55952d16d"
+		logic_hash = "v1_sha256_c44d83d86e3231c57414d81c161d108153b74cf74b3e3cc50eaea1f55952d16d"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -136531,20 +136601,20 @@ rule MALPEDIA_Win_Bankshot_Auto : FILE
 		$sequence_44 = { ff15???????? 488bf8 4885c0 0f84b5000000 }
 
 	condition:
-		7 of them and filesize <860160
+		7 of them and filesize < 860160
 }
 rule MALPEDIA_Win_Wininetloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7ea47534-c96c-52ac-bf22-909791f16181"
+		id = "9de52feb-db3b-5bf2-a7a8-8a392a00058d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wininetloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wininetloader_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "b330f726e24dbb98ed7560a78537474ae8441347d679ef8681cdcfe81bca90ca"
+		logic_hash = "v1_sha256_b330f726e24dbb98ed7560a78537474ae8441347d679ef8681cdcfe81bca90ca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136570,20 +136640,20 @@ rule MALPEDIA_Win_Wininetloader_Auto : FILE
 		$sequence_9 = { eb03 498bff 4c8bc6 488bd7 eb55 488b3d???????? 4885ff }
 
 	condition:
-		7 of them and filesize <2659328
+		7 of them and filesize < 2659328
 }
 rule MALPEDIA_Win_Slothfulmedia_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2e039255-65fc-54b3-b80d-fbd83d62f398"
+		id = "f42f05c9-bb7c-5c30-879b-2f78bb33bfe4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slothfulmedia"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.slothfulmedia_auto.yar#L1-L177"
 		license_url = "N/A"
-		logic_hash = "4478c19c5b75da4be13e2a5e0ada629ab254eb002384f45d3b79eb582f1a6eaf"
+		logic_hash = "v1_sha256_4478c19c5b75da4be13e2a5e0ada629ab254eb002384f45d3b79eb582f1a6eaf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136615,20 +136685,20 @@ rule MALPEDIA_Win_Slothfulmedia_Auto : FILE
 		$sequence_15 = { 6689442414 e8???????? 83c40c 6a00 ff15???????? 8b35???????? }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Banatrix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "702dab13-4bb6-5a8c-a445-48baade0f697"
+		id = "aabea560-ce0a-5c60-9d70-5fd56dc7a038"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banatrix"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.banatrix_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b32ec448caee97c1e074a70cc1c0b66b914a64f46a4b1bc215e4633ee2c8f80d"
+		logic_hash = "v1_sha256_b32ec448caee97c1e074a70cc1c0b66b914a64f46a4b1bc215e4633ee2c8f80d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136654,20 +136724,20 @@ rule MALPEDIA_Win_Banatrix_Auto : FILE
 		$sequence_9 = { 8b450c 5d 8b4004 c3 55 89e5 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Lockergoga_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "098a7a92-b383-59d8-91b6-0fe20ed4e757"
+		id = "4ebba3c8-33d7-523f-89d9-7d3075743a89"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lockergoga_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c582e783be4f8c1eccf17c3665e883eb649b80d6c64ac8df726791d94d7fb2de"
+		logic_hash = "v1_sha256_c582e783be4f8c1eccf17c3665e883eb649b80d6c64ac8df726791d94d7fb2de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136693,20 +136763,20 @@ rule MALPEDIA_Win_Lockergoga_Auto : FILE
 		$sequence_9 = { e8???????? 8d4dbc e8???????? 8d8d2cffffff e8???????? 8b4df4 64890d00000000 }
 
 	condition:
-		7 of them and filesize <2588672
+		7 of them and filesize < 2588672
 }
 rule MALPEDIA_Win_Tuoni_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "04148cf8-207a-5f06-9dd5-362667335e9a"
+		id = "a88e6fe8-501b-599b-abec-2019edaa94d2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tuoni"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tuoni_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "21517c25b667838bd9ce6eb05310b526a84de45e68772e4427c4bd14266f2821"
+		logic_hash = "v1_sha256_21517c25b667838bd9ce6eb05310b526a84de45e68772e4427c4bd14266f2821"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136732,20 +136802,20 @@ rule MALPEDIA_Win_Tuoni_Auto : FILE
 		$sequence_9 = { 68???????? e8???????? 83c40c 8d4dd8 e8???????? 8d8594fbffff 50 }
 
 	condition:
-		7 of them and filesize <734208
+		7 of them and filesize < 734208
 }
 rule MALPEDIA_Win_Revil_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "45dad52d-586b-5209-8ce9-2a48da5b7435"
+		id = "1998ed2a-3df3-5090-a5d0-8f0c1baef56f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.revil_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "120e5cbd30d90d4dc063fdbdb97cb211c1d8a67c5a1d2649d0974884fd7ebfbf"
+		logic_hash = "v1_sha256_120e5cbd30d90d4dc063fdbdb97cb211c1d8a67c5a1d2649d0974884fd7ebfbf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136771,20 +136841,20 @@ rule MALPEDIA_Win_Revil_Auto : FILE
 		$sequence_9 = { 55 8bec 837d0c20 7605 83c8ff }
 
 	condition:
-		7 of them and filesize <155794432
+		7 of them and filesize < 155794432
 }
 rule MALPEDIA_Win_Hotcroissant_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "041c170b-cb82-5079-a120-00d45f6cb95f"
+		id = "d3a7c73e-4d05-5879-82e5-b6563c6e1a58"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hotcroissant"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hotcroissant_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "9f9dd22a171d10237a5cfe7e750b40557b2e5ee36c0e5da30f363ab0cd99d478"
+		logic_hash = "v1_sha256_9f9dd22a171d10237a5cfe7e750b40557b2e5ee36c0e5da30f363ab0cd99d478"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136810,20 +136880,20 @@ rule MALPEDIA_Win_Hotcroissant_Auto : FILE
 		$sequence_9 = { a3???????? a3???????? a3???????? ffd6 a1???????? 50 }
 
 	condition:
-		7 of them and filesize <591872
+		7 of them and filesize < 591872
 }
 rule MALPEDIA_Win_Former_First_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1272d8c-4064-59bd-8cdc-a01b1d547c30"
+		id = "ee58f962-2a6c-5e83-9931-f6b1319373e2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.former_first_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.former_first_rat_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "ce211a46152dbbb02c8c895324876bff740383a9e542511dce112b8640015613"
+		logic_hash = "v1_sha256_ce211a46152dbbb02c8c895324876bff740383a9e542511dce112b8640015613"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136855,20 +136925,20 @@ rule MALPEDIA_Win_Former_First_Rat_Auto : FILE
 		$sequence_15 = { 4c89b424c0000000 4c89b424c8000000 488b8c24a0000000 e8???????? 90 }
 
 	condition:
-		7 of them and filesize <626688
+		7 of them and filesize < 626688
 }
 rule MALPEDIA_Win_Dadstache_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "83ac24de-2d4c-56ca-a52b-b61e76854726"
+		id = "8c6c241a-31b4-5759-b9ab-ff72e3963a8b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dadstache"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dadstache_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "25ccaa507f10be35b704008ec9887b279a6b66e6fbc6fcb0d9200b947fa69258"
+		logic_hash = "v1_sha256_25ccaa507f10be35b704008ec9887b279a6b66e6fbc6fcb0d9200b947fa69258"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136900,20 +136970,20 @@ rule MALPEDIA_Win_Dadstache_Auto : FILE
 		$sequence_15 = { 74d5 ff7654 8b55e8 8bcf e8???????? 8b4dfc }
 
 	condition:
-		7 of them and filesize <580608
+		7 of them and filesize < 580608
 }
 rule MALPEDIA_Win_Broler_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e5ddbcf2-267f-50c4-9a07-ee97c0a66c40"
+		id = "fd688eae-eb69-5561-bf9c-1646cded5a61"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.broler"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.broler_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "a1c6e2e8a7e6cd7262212833aaeef2ea07ebc3af38a6241bbd7582277c8df1b7"
+		logic_hash = "v1_sha256_a1c6e2e8a7e6cd7262212833aaeef2ea07ebc3af38a6241bbd7582277c8df1b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136939,20 +137009,20 @@ rule MALPEDIA_Win_Broler_Auto : FILE
 		$sequence_9 = { 03d8 3bd9 7624 83fa10 7204 8b06 }
 
 	condition:
-		7 of them and filesize <275456
+		7 of them and filesize < 275456
 }
 rule MALPEDIA_Win_No_Justice_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9c76a62e-45df-5e55-95c7-3fd18c7cd11d"
+		id = "e8a9a586-9436-5ac6-a4b2-ffd7630add7e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.no_justice"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.no_justice_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "27fb4d87fb503a879f5ac0f508a221856b21d7d81edc4c17f436773a20141500"
+		logic_hash = "v1_sha256_27fb4d87fb503a879f5ac0f508a221856b21d7d81edc4c17f436773a20141500"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136978,20 +137048,20 @@ rule MALPEDIA_Win_No_Justice_Auto : FILE
 		$sequence_9 = { 8b049d70be4100 f644072801 7444 837c0718ff 743d e8???????? }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Floki_Bot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "25c81d04-9abf-5940-8e55-7e5abeb99153"
+		id = "2d516c12-8322-5222-9f0d-2e4f0b9fa702"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.floki_bot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.floki_bot_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "e2f9df61c4df036b71f6882cf4c35419384506db07aa4de7d79fcad14d6710ad"
+		logic_hash = "v1_sha256_e2f9df61c4df036b71f6882cf4c35419384506db07aa4de7d79fcad14d6710ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137017,20 +137087,20 @@ rule MALPEDIA_Win_Floki_Bot_Auto : FILE
 		$sequence_9 = { 84c0 744b 8b45f8 85c0 7414 ff75ec e8???????? }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Mystic_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2aee59e1-5390-5b6c-ba5d-d62a358c2fe1"
+		id = "263d8a2b-1554-5020-90d2-11f29f6c1a30"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mystic_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mystic_stealer_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "5074dde9add0d24e82d880c50882d8de92cc1c57bceb2be1475c662a7640d829"
+		logic_hash = "v1_sha256_5074dde9add0d24e82d880c50882d8de92cc1c57bceb2be1475c662a7640d829"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137056,20 +137126,20 @@ rule MALPEDIA_Win_Mystic_Stealer_Auto : FILE
 		$sequence_9 = { 8b4f6c 8b472c 2bce 2d06010000 }
 
 	condition:
-		7 of them and filesize <512000
+		7 of them and filesize < 512000
 }
 rule MALPEDIA_Win_Cloudwizard_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fa68961f-75e7-584f-a390-9baec9fbd3c5"
+		id = "2c785f61-26aa-5ef1-a281-8aef7f215619"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudwizard"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cloudwizard_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b90f140d158cbf9ceed90cefa4231cadc7a59a82c187cabca82f362a5d65baf4"
+		logic_hash = "v1_sha256_b90f140d158cbf9ceed90cefa4231cadc7a59a82c187cabca82f362a5d65baf4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137095,20 +137165,20 @@ rule MALPEDIA_Win_Cloudwizard_Auto : FILE
 		$sequence_9 = { 6685db 75f6 03c0 50 2bca 8d4560 }
 
 	condition:
-		7 of them and filesize <134144
+		7 of them and filesize < 134144
 }
 rule MALPEDIA_Win_Gozi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aac9b6f0-8c81-5a6b-8a62-7eb8449e0397"
+		id = "0f4f3e90-2d85-5f2f-b6c4-a965ab1e2ee2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gozi_auto.yar#L1-L301"
 		license_url = "N/A"
-		logic_hash = "6d080496b0bc709b18cae762326b65ba3fe68298a3c52833320cbdca2a2db665"
+		logic_hash = "v1_sha256_6d080496b0bc709b18cae762326b65ba3fe68298a3c52833320cbdca2a2db665"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -137156,20 +137226,20 @@ rule MALPEDIA_Win_Gozi_Auto : FILE
 		$sequence_31 = { 53 c705????????00000000 68???????? 6a01 }
 
 	condition:
-		7 of them and filesize <568320
+		7 of them and filesize < 568320
 }
 rule MALPEDIA_Win_Crosswalk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1fb3b2b-1a2f-578d-9401-68574e21a388"
+		id = "753937ec-aed8-5b9c-8607-aee41ca0b742"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crosswalk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crosswalk_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "84206cda2a660daf3146c7ad3e0c02d63ad7f2eb5361ae4afeb3936cb61d00b4"
+		logic_hash = "v1_sha256_84206cda2a660daf3146c7ad3e0c02d63ad7f2eb5361ae4afeb3936cb61d00b4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137201,20 +137271,20 @@ rule MALPEDIA_Win_Crosswalk_Auto : FILE
 		$sequence_15 = { 83feff 0f8483000000 eb7d 8b1c9d00124100 6800080000 6a00 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Fickerstealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f6a3748-f0ba-5d54-bc6b-9a386da9e8f6"
+		id = "74332adf-e030-52e9-bdf5-0813256e3985"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fickerstealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fickerstealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0126c62412dad879a43e44f06017fe0625a540d4c54a2a3f5410236702fb1a45"
+		logic_hash = "v1_sha256_0126c62412dad879a43e44f06017fe0625a540d4c54a2a3f5410236702fb1a45"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137240,20 +137310,20 @@ rule MALPEDIA_Win_Fickerstealer_Auto : FILE
 		$sequence_9 = { c1e00f 09f8 c1e107 0fb6f9 8b4de8 09f8 89df }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize < 598016
 }
 rule MALPEDIA_Win_Spyder_Patchwork_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "79eb8f27-1301-5204-b70a-f074d773e2a2"
+		id = "e146b050-a506-5819-9c4e-7aa422df1338"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyder_patchwork"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spyder_patchwork_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "88e656ab24018abde08f518b393d747f56ac10af0939df2743e80e35c10ea588"
+		logic_hash = "v1_sha256_88e656ab24018abde08f518b393d747f56ac10af0939df2743e80e35c10ea588"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137279,20 +137349,20 @@ rule MALPEDIA_Win_Spyder_Patchwork_Auto : FILE
 		$sequence_9 = { 0f84c4000000 66837c240c01 0f85b8000000 57 8b7c2408 83c708 f644241401 }
 
 	condition:
-		7 of them and filesize <2260992
+		7 of them and filesize < 2260992
 }
 rule MALPEDIA_Win_Moontag_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "252dd0ca-7f51-52f0-be53-827b6e26bc25"
+		id = "27ef2c4f-4d3a-5d31-963a-125ffdac03be"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moontag"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.moontag_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "370fc05010b7ffbaa6352b0066ee43dee7ad1117e24576294ef38cbd09f73c67"
+		logic_hash = "v1_sha256_370fc05010b7ffbaa6352b0066ee43dee7ad1117e24576294ef38cbd09f73c67"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137318,20 +137388,20 @@ rule MALPEDIA_Win_Moontag_Auto : FILE
 		$sequence_9 = { 4885db 0f8487000000 488d4580 4883fe10 480f43c7 4883fb01 7518 }
 
 	condition:
-		7 of them and filesize <140288
+		7 of them and filesize < 140288
 }
 rule MALPEDIA_Win_Unidentified_063_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d22cba4e-b95b-5578-ac95-09534bd7dc14"
+		id = "4b61b56d-d400-5439-a91e-b4970eb6f8ba"
 		date = "2022-11-21"
 		modified = "2022-11-25"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_063"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_063_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "14c180eecdf0e6fbf2b936d6c444ad58c2e649e1fa770106e8719057ee1aefbd"
+		logic_hash = "v1_sha256_14c180eecdf0e6fbf2b936d6c444ad58c2e649e1fa770106e8719057ee1aefbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137357,20 +137427,20 @@ rule MALPEDIA_Win_Unidentified_063_Auto : FILE
 		$sequence_9 = { 488d158a5a0200 488bcb e8???????? 85c0 7499 488d157f5a0200 488bcb }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize < 475136
 }
 rule MALPEDIA_Win_Unidentified_013_Korean_Malware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9565c5c7-2061-57e3-9feb-b946c3a86959"
+		id = "b18c8de4-0b60-5cfa-8ade-2f1961e54cd5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_013_korean_malware"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_013_korean_malware_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "821fb0825aa17f5a4d3c05e9768273454f282d58ecf369f512d9a619a9aa5b99"
+		logic_hash = "v1_sha256_821fb0825aa17f5a4d3c05e9768273454f282d58ecf369f512d9a619a9aa5b99"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137396,20 +137466,20 @@ rule MALPEDIA_Win_Unidentified_013_Korean_Malware_Auto : FILE
 		$sequence_9 = { e8???????? 83c40c 33ff 8d9b00000000 8a543c14 8d5c2410 88542410 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Lyposit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a1182ef-14f9-5ae8-9cfb-f5f8b2d96cab"
+		id = "31cc476d-5e66-54b9-b177-f7b3e6b104ae"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lyposit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lyposit_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "249026f12880d5f66834071d41f0c2254bacd8b35bc56d04ae3c23c7c93561c7"
+		logic_hash = "v1_sha256_249026f12880d5f66834071d41f0c2254bacd8b35bc56d04ae3c23c7c93561c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137435,20 +137505,20 @@ rule MALPEDIA_Win_Lyposit_Auto : FILE
 		$sequence_9 = { 59 e8???????? e2f9 59 43 83e903 }
 
 	condition:
-		7 of them and filesize <466944
+		7 of them and filesize < 466944
 }
 rule MALPEDIA_Win_Http_Troy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ce73b438-aadd-590a-8f29-6294af71df05"
+		id = "4990d435-313c-5509-8c4a-0287e91f4a8b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.http_troy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.http_troy_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0940e5bc37e1b157bd6ecfd92ed3054d2dd55689c30354c0593d0b04427adfc7"
+		logic_hash = "v1_sha256_0940e5bc37e1b157bd6ecfd92ed3054d2dd55689c30354c0593d0b04427adfc7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137474,20 +137544,20 @@ rule MALPEDIA_Win_Http_Troy_Auto : FILE
 		$sequence_9 = { 83e103 68???????? f3a4 e8???????? 83c404 8d942488000000 8d9b00000000 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize < 475136
 }
 rule MALPEDIA_Win_Wastedloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c9b391e1-a439-5c84-8bc6-d01e7837fa3f"
+		id = "479045f4-019a-5b37-849c-fa2a7ac6ddf4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wastedloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wastedloader_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "f52a5046711dc64fff342d42959b67fac6d384f1f957f74196d547273f13eb4f"
+		logic_hash = "v1_sha256_f52a5046711dc64fff342d42959b67fac6d384f1f957f74196d547273f13eb4f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137513,20 +137583,20 @@ rule MALPEDIA_Win_Wastedloader_Auto : FILE
 		$sequence_9 = { 8b55f8 0fb7421e 83e854 8b4df8 6689411e ba86000000 }
 
 	condition:
-		7 of them and filesize <2677760
+		7 of them and filesize < 2677760
 }
 rule MALPEDIA_Win_Alureon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a73dc24e-01b5-5374-84bf-44615f6f8c40"
+		id = "729295b8-efd1-53ff-babc-c7ca65f466ac"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alureon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.alureon_auto.yar#L1-L177"
 		license_url = "N/A"
-		logic_hash = "3ffa46b9256035a0465adbbc3bd0212addd530491396c5f57b5bebbc944d0354"
+		logic_hash = "v1_sha256_3ffa46b9256035a0465adbbc3bd0212addd530491396c5f57b5bebbc944d0354"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137558,20 +137628,20 @@ rule MALPEDIA_Win_Alureon_Auto : FILE
 		$sequence_15 = { 85c0 0f84f2020000 53 53 6a03 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Kimsuky_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f4610f8d-61c2-57de-821a-2002989958af"
+		id = "064f4716-b747-5d89-bd34-556d692d0311"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kimsuky"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kimsuky_auto.yar#L1-L287"
 		license_url = "N/A"
-		logic_hash = "838ee4b29f510aa7418362f03ac18e28c0399175424b76481d712ac3c06c7bee"
+		logic_hash = "v1_sha256_838ee4b29f510aa7418362f03ac18e28c0399175424b76481d712ac3c06c7bee"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -137618,20 +137688,20 @@ rule MALPEDIA_Win_Kimsuky_Auto : FILE
 		$sequence_30 = { 6690 49ffc0 6642392c42 75f6 }
 
 	condition:
-		7 of them and filesize <1021952
+		7 of them and filesize < 1021952
 }
 rule MALPEDIA_Win_Data_Exfiltrator_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c3e80a4-d035-5215-adaa-66329eac9671"
+		id = "28e76e03-080b-5522-9952-9e6cfa908324"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.data_exfiltrator"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.data_exfiltrator_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "6297c1d8a56d8255bac738410a860d5a8da8f6a36d36d069cc390dc91a10d95e"
+		logic_hash = "v1_sha256_6297c1d8a56d8255bac738410a860d5a8da8f6a36d36d069cc390dc91a10d95e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137657,20 +137727,20 @@ rule MALPEDIA_Win_Data_Exfiltrator_Auto : FILE
 		$sequence_9 = { 4889542410 48894c2408 4883ec48 ff15???????? 41b8ffff0000 ba08000000 488bc8 }
 
 	condition:
-		7 of them and filesize <107520
+		7 of them and filesize < 107520
 }
 rule MALPEDIA_Win_Asruex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "899abd0f-c835-5f70-819c-92570cc9b462"
+		id = "3d0d81e2-9636-5a4f-9f77-f2e171a7f6fb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.asruex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.asruex_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "a14db0e4e44f1156fe16afe843345aa29b9b1f1eb3cc060b10e0bcdf06eb97d4"
+		logic_hash = "v1_sha256_a14db0e4e44f1156fe16afe843345aa29b9b1f1eb3cc060b10e0bcdf06eb97d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137696,20 +137766,20 @@ rule MALPEDIA_Win_Asruex_Auto : FILE
 		$sequence_9 = { 3c0d 7404 3c0a 7516 }
 
 	condition:
-		7 of them and filesize <1564672
+		7 of them and filesize < 1564672
 }
 rule MALPEDIA_Win_Pitou_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d3bdfc17-2f62-5214-be4f-5a36d3b3ac21"
+		id = "8215809f-11de-57a3-8a72-68016a5ad06c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pitou"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pitou_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "7616b15e54bbcbd8174c3b9ed1b89eebeb0789927a8a07e3c44e1d6842f140f7"
+		logic_hash = "v1_sha256_7616b15e54bbcbd8174c3b9ed1b89eebeb0789927a8a07e3c44e1d6842f140f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137735,20 +137805,20 @@ rule MALPEDIA_Win_Pitou_Auto : FILE
 		$sequence_9 = { 8acc 80e103 8aec c0ed03 }
 
 	condition:
-		7 of them and filesize <1106944
+		7 of them and filesize < 1106944
 }
 rule MALPEDIA_Win_Smanager_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0adcac8e-452d-57ad-977c-a9125f7183b0"
+		id = "9173831f-7d13-5bec-841f-fc80e44bac7d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.smanager_auto.yar#L1-L223"
 		license_url = "N/A"
-		logic_hash = "3f482517aa3a2ee02c64524a13e643b42a87540d5888bda3f974015b63620502"
+		logic_hash = "v1_sha256_3f482517aa3a2ee02c64524a13e643b42a87540d5888bda3f974015b63620502"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -137788,20 +137858,20 @@ rule MALPEDIA_Win_Smanager_Auto : FILE
 		$sequence_23 = { 0000 0c0c 0c0c 0c0c 0c0c 0c0c 0102 }
 
 	condition:
-		7 of them and filesize <10013696
+		7 of them and filesize < 10013696
 }
 rule MALPEDIA_Win_Suncrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c1bd9658-a178-589d-b259-6cb82442d52c"
+		id = "57185f8e-0d35-5507-b50e-6414f7b31221"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.suncrypt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.suncrypt_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "49201b307b7d384a9877d33cd9429c04ac8ef7ebb302c664ae5e0393ef621a39"
+		logic_hash = "v1_sha256_49201b307b7d384a9877d33cd9429c04ac8ef7ebb302c664ae5e0393ef621a39"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137827,20 +137897,20 @@ rule MALPEDIA_Win_Suncrypt_Auto : FILE
 		$sequence_9 = { 41 83f810 72ef 5f }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize < 172032
 }
 rule MALPEDIA_Win_Swen_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d8e32210-7f2c-5375-83fe-4881f384b16a"
+		id = "45228c93-3b93-576d-991b-4ca00aa634c6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.swen"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.swen_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "ac8d371caed7f28c7b47b5b751d92511f3b33ed896fd2d2cdf37fc7b9a540873"
+		logic_hash = "v1_sha256_ac8d371caed7f28c7b47b5b751d92511f3b33ed896fd2d2cdf37fc7b9a540873"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137866,20 +137936,20 @@ rule MALPEDIA_Win_Swen_Auto : FILE
 		$sequence_9 = { ff7508 ff75e4 8d85d8feffff 50 e8???????? 83c40c }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Ketrum_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d00476b6-2e4b-5fca-a576-2efa8a16d1f4"
+		id = "d2682ba4-6f99-543a-8980-d98cb53da966"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ketrum"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ketrum_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "f6a51a224da39f596220ff41861daa2df80eaaa43f4fe6e9b132d503abfda3ac"
+		logic_hash = "v1_sha256_f6a51a224da39f596220ff41861daa2df80eaaa43f4fe6e9b132d503abfda3ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137911,20 +137981,20 @@ rule MALPEDIA_Win_Ketrum_Auto : FILE
 		$sequence_15 = { 39b8c0f94100 0f8491000000 ff45e4 83c030 3df0000000 }
 
 	condition:
-		7 of them and filesize <4599808
+		7 of them and filesize < 4599808
 }
 rule MALPEDIA_Win_Ngioweb_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e5c8d819-248e-5981-b002-cb1c74e63a09"
+		id = "449dac3f-a6b3-50e0-9f2f-d3c5741c6937"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ngioweb"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ngioweb_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "f7e87273e17bbe0f3332951c955e0d14e92adbe20014736bed11afb8541960a1"
+		logic_hash = "v1_sha256_f7e87273e17bbe0f3332951c955e0d14e92adbe20014736bed11afb8541960a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137950,20 +138020,20 @@ rule MALPEDIA_Win_Ngioweb_Auto : FILE
 		$sequence_9 = { 8b4544 3bc6 7406 8b08 50 ff5108 8b4550 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Terminator_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e470c3b5-74cd-53c3-b4cc-acdce03aa8dd"
+		id = "770de3c6-fc4b-5c78-956c-6be90e1a83d5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.terminator_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.terminator_rat_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "0c5a38ab087b1b21acdc43ba4e7c8b1be9b6d593b69dd3e7b8053959b3c291c4"
+		logic_hash = "v1_sha256_0c5a38ab087b1b21acdc43ba4e7c8b1be9b6d593b69dd3e7b8053959b3c291c4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137989,20 +138059,20 @@ rule MALPEDIA_Win_Terminator_Rat_Auto : FILE
 		$sequence_9 = { 8bfc 83ec0c 53 56 8b7708 ff77fc ffb51d010000 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Havoc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e49338ce-e5b7-5533-8149-1afd3e757884"
+		id = "fa7755c6-bd1d-509d-8c0b-5ba951b2ef95"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havoc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.havoc_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "b1a82d03442de3dfd518e07ebf86436482be6a35139d23b15b46564ec29f5896"
+		logic_hash = "v1_sha256_b1a82d03442de3dfd518e07ebf86436482be6a35139d23b15b46564ec29f5896"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138028,20 +138098,20 @@ rule MALPEDIA_Win_Havoc_Auto : FILE
 		$sequence_9 = { 85c0 7856 488b842488000000 488bb42488000000 4531c9 4531c0 488b8c24a0000000 }
 
 	condition:
-		7 of them and filesize <164864
+		7 of them and filesize < 164864
 }
 rule MALPEDIA_Win_Clambling_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e480c0cb-e19c-5e93-97bb-00caac1a9f2e"
+		id = "2783c042-267f-5c8f-bb46-2e3ef9f791b5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clambling"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.clambling_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "f3f0a4943735cbe1e2ffa9646f9d73cc0975851d00f58a2bf60f2536a8d04784"
+		logic_hash = "v1_sha256_f3f0a4943735cbe1e2ffa9646f9d73cc0975851d00f58a2bf60f2536a8d04784"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138067,20 +138137,20 @@ rule MALPEDIA_Win_Clambling_Auto : FILE
 		$sequence_9 = { 8bf1 894c2438 6683c303 6681e3fcff }
 
 	condition:
-		7 of them and filesize <412672
+		7 of them and filesize < 412672
 }
 rule MALPEDIA_Win_Regin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1cb1e4e-ea57-57da-8035-cea9e62b8eb8"
+		id = "fdf865a9-833d-5728-8211-36ba4be51969"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regin"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.regin_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "091fb04af94706b8fbe2a391afd54e9835ec0bf475e2ed1c52d68af6529e0a7e"
+		logic_hash = "v1_sha256_091fb04af94706b8fbe2a391afd54e9835ec0bf475e2ed1c52d68af6529e0a7e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138106,20 +138176,20 @@ rule MALPEDIA_Win_Regin_Auto : FILE
 		$sequence_9 = { 750d 48 8d0dff000000 ff15???????? 48 8d152a030000 48 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Darkme_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "48faa238-7c8d-58c0-88b3-9aef8ec2075d"
+		id = "60e56bbf-b8dd-55bd-b7ab-fcdc178e8ad1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkme"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkme_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "3cf45d3e46e2f9013414d4d68a45acd13e79993e633a174a46aa5a37d07153ec"
+		logic_hash = "v1_sha256_3cf45d3e46e2f9013414d4d68a45acd13e79993e633a174a46aa5a37d07153ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138145,20 +138215,20 @@ rule MALPEDIA_Win_Darkme_Auto : FILE
 		$sequence_9 = { 8d55b0 52 8d4590 50 ffd6 50 8d8d10ffffff }
 
 	condition:
-		7 of them and filesize <1515520
+		7 of them and filesize < 1515520
 }
 rule MALPEDIA_Win_Rhadamanthys_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a80a8ef9-ea3f-56c2-85d5-70398e8fed62"
+		id = "aa514acf-bc77-5233-bba9-b59344d72791"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rhadamanthys_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "33afe88ed91c55c9115df6fb51e8b7670279afd4e605824b7c9b26fba3c0f08d"
+		logic_hash = "v1_sha256_33afe88ed91c55c9115df6fb51e8b7670279afd4e605824b7c9b26fba3c0f08d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138184,20 +138254,20 @@ rule MALPEDIA_Win_Rhadamanthys_Auto : FILE
 		$sequence_9 = { c7842418020000383f0403 c784241c020000c46c0403 c7842420020000449a0403 c784242402000034ca0403 c7842428020000fcf90403 c784242c020000182b0503 }
 
 	condition:
-		7 of them and filesize <1111040
+		7 of them and filesize < 1111040
 }
 rule MALPEDIA_Win_Prikormka_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2164d528-1794-5deb-b46c-b3d81c69fad8"
+		id = "8cb7af4e-394a-5051-9323-1e396b6abced"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prikormka"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.prikormka_auto.yar#L1-L416"
 		license_url = "N/A"
-		logic_hash = "6a6b4101990a4a459b0787e75e4b68bca1a92474214a272dc57d00cd454ce776"
+		logic_hash = "v1_sha256_6a6b4101990a4a459b0787e75e4b68bca1a92474214a272dc57d00cd454ce776"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -138259,20 +138329,20 @@ rule MALPEDIA_Win_Prikormka_Auto : FILE
 		$sequence_45 = { c1e606 03348520100210 c745e401000000 33db 395e08 7536 }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize < 401408
 }
 rule MALPEDIA_Win_Snowflake_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bc09d07d-0ef6-59f5-8fc9-74662cfa791b"
+		id = "2161e05d-98fd-5407-9c6d-88aa4139de7b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snowflake_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.snowflake_stealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "9c9e75fd4eed4eb18eb308bb8329401876776f47e6918bf3c298e3ce6d294888"
+		logic_hash = "v1_sha256_9c9e75fd4eed4eb18eb308bb8329401876776f47e6918bf3c298e3ce6d294888"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138298,20 +138368,20 @@ rule MALPEDIA_Win_Snowflake_Stealer_Auto : FILE
 		$sequence_9 = { ff4f3c 837e0801 7509 396e0c 7504 834f1cff 3906 }
 
 	condition:
-		7 of them and filesize <6196224
+		7 of them and filesize < 6196224
 }
 rule MALPEDIA_Win_Astralocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "44156298-552d-5dee-871e-065e8177c7e9"
+		id = "588e9540-2e62-5844-a3b0-e31cb6467e95"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.astralocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.astralocker_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "a5647fc347475c8a37d856421ffd217ff32a1a45599157161a2296f0a4c958b5"
+		logic_hash = "v1_sha256_a5647fc347475c8a37d856421ffd217ff32a1a45599157161a2296f0a4c958b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138337,20 +138407,20 @@ rule MALPEDIA_Win_Astralocker_Auto : FILE
 		$sequence_9 = { b808000000 6bc80a 8b5508 33c0 33f6 }
 
 	condition:
-		7 of them and filesize <191488
+		7 of them and filesize < 191488
 }
 rule MALPEDIA_Win_Scanline_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "13552250-a8d4-5ee7-b407-74524f6111b2"
+		id = "b4a059de-ab3f-5291-9022-b16d28bb10d9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scanline"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.scanline_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "2bc008243e0f7161ac1c675c6c0b345104d3837ab2d3042dba054ab6d07a500d"
+		logic_hash = "v1_sha256_2bc008243e0f7161ac1c675c6c0b345104d3837ab2d3042dba054ab6d07a500d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138376,20 +138446,20 @@ rule MALPEDIA_Win_Scanline_Auto : FILE
 		$sequence_9 = { 7510 80a11703000000 c6811603000008 eb15 807c24040d 750e c681160300000d }
 
 	condition:
-		7 of them and filesize <151552
+		7 of them and filesize < 151552
 }
 rule MALPEDIA_Elf_Bashlite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4d68ff86-b62a-56f4-900d-a8e2f982b0ab"
+		id = "b17da16f-4418-5572-9d9a-7dc49af4263d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/elf.bashlite_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "46d8bef4c939db6a89af35372d5c8a74e31ae90669b6477bbd5c0d09039a9b9b"
+		logic_hash = "v1_sha256_46d8bef4c939db6a89af35372d5c8a74e31ae90669b6477bbd5c0d09039a9b9b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138415,20 +138485,20 @@ rule MALPEDIA_Elf_Bashlite_Auto : FILE
 		$sequence_9 = { c785ecefffff01000000 eb0a c785ecefffff00000000 8b85ecefffff c9 }
 
 	condition:
-		7 of them and filesize <2310144
+		7 of them and filesize < 2310144
 }
 rule MALPEDIA_Win_Industrial_Spy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7da79c63-fa14-572c-88ac-b76f6cdc6221"
+		id = "486efaaf-b71c-57eb-a324-592ada83d910"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industrial_spy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.industrial_spy_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "7a3233469624bdad85e090a4dc1c96ea6796ab995a15b629b5d495e015c5b4df"
+		logic_hash = "v1_sha256_7a3233469624bdad85e090a4dc1c96ea6796ab995a15b629b5d495e015c5b4df"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138454,20 +138524,20 @@ rule MALPEDIA_Win_Industrial_Spy_Auto : FILE
 		$sequence_9 = { 448bd2 418bc3 23c2 41f7d2 0bc8 034dc8 }
 
 	condition:
-		7 of them and filesize <339968
+		7 of them and filesize < 339968
 }
 rule MALPEDIA_Win_Httpdropper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fe74c397-b0b6-56ba-ab68-0472f7992b43"
+		id = "f0ac20f2-4680-5e00-b7a1-15fe1b2ae911"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpdropper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.httpdropper_auto.yar#L1-L157"
 		license_url = "N/A"
-		logic_hash = "1f304e411e6e19a3397e572e7a13609bae133af12f0a3672cddde2eef3a5cdf3"
+		logic_hash = "v1_sha256_1f304e411e6e19a3397e572e7a13609bae133af12f0a3672cddde2eef3a5cdf3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138499,20 +138569,20 @@ rule MALPEDIA_Win_Httpdropper_Auto : FILE
 		$sequence_15 = { 448b442440 41ffc0 33d2 488bc8 e8???????? 41b801000000 }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize < 524288
 }
 rule MALPEDIA_Win_Yahoyah_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7d580a73-e71e-51e5-b9b2-111f677f9e42"
+		id = "1ddf466c-062b-5333-97ec-a05d5b03e7e5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yahoyah"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.yahoyah_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "3c235d0922e2b2ae3e259f93f1da8403405399a9b438615162581b244056f37a"
+		logic_hash = "v1_sha256_3c235d0922e2b2ae3e259f93f1da8403405399a9b438615162581b244056f37a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138543,20 +138613,20 @@ rule MALPEDIA_Win_Yahoyah_Auto : FILE
 		$sequence_14 = { 90 90 90 90 90 68add13441 ffb53ffbffff }
 
 	condition:
-		7 of them and filesize <483328
+		7 of them and filesize < 483328
 }
 rule MALPEDIA_Win_Urausy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d79fe72f-f8e2-58e2-a433-7994c2651777"
+		id = "cd52fe5f-53dc-555a-9f14-f9de69205d1e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.urausy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.urausy_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "4006e3f78a3f573ba923955b3cfcab3f192d2740ed20a89eb62b4be1b215c9a4"
+		logic_hash = "v1_sha256_4006e3f78a3f573ba923955b3cfcab3f192d2740ed20a89eb62b4be1b215c9a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138582,20 +138652,20 @@ rule MALPEDIA_Win_Urausy_Auto : FILE
 		$sequence_9 = { eb1b 3d57000780 7502 eb12 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Fatal_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a3ab53f5-ddae-5778-83ad-a5bc6a6b2154"
+		id = "629b0cc1-4a16-5e0a-8396-0b0f5420830d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fatal_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fatal_rat_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "18acd6224a0284d907688395a284887997a86c92f189b4ab24835c18aeeace4b"
+		logic_hash = "v1_sha256_18acd6224a0284d907688395a284887997a86c92f189b4ab24835c18aeeace4b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138621,20 +138691,20 @@ rule MALPEDIA_Win_Fatal_Rat_Auto : FILE
 		$sequence_9 = { c645ee68 c645ef70 885df0 ff15???????? 8bf8 3bfb 897df8 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize < 344064
 }
 rule MALPEDIA_Win_Atomsilo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3435600a-ea5a-5a3a-a6f8-26d97e3c0136"
+		id = "c4dd27a9-92b2-5bb4-9eeb-84182738842c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atomsilo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.atomsilo_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "e09362cc7b2f3a6215eeee28b5549da2887bc59c3f8b5fb41ad869fd5e8818fd"
+		logic_hash = "v1_sha256_e09362cc7b2f3a6215eeee28b5549da2887bc59c3f8b5fb41ad869fd5e8818fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138660,20 +138730,20 @@ rule MALPEDIA_Win_Atomsilo_Auto : FILE
 		$sequence_9 = { 48895608 488b5c2470 4883c430 415f 415e 415c 5f }
 
 	condition:
-		7 of them and filesize <1785856
+		7 of them and filesize < 1785856
 }
 rule MALPEDIA_Win_Blister_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "75a4d5c1-fad1-5de9-baeb-706545e990e7"
+		id = "2ac255cc-7d5a-5d1a-929c-2bf17f55a609"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blister"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blister_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "cf8a8615a4d489a259d535fb620f06fe5362163915633c0aacc9d77eb620d2b5"
+		logic_hash = "v1_sha256_cf8a8615a4d489a259d535fb620f06fe5362163915633c0aacc9d77eb620d2b5"
 		score = 60
 		quality = 25
 		tags = "FILE"
@@ -138699,20 +138769,20 @@ rule MALPEDIA_Win_Blister_Auto : FILE
 		$sequence_9 = { 59 894604 85c0 7503 895dfc 33ff 397dfc }
 
 	condition:
-		7 of them and filesize <1822720
+		7 of them and filesize < 1822720
 }
 rule MALPEDIA_Win_Taintedscribe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f1cc2e00-4207-5694-9f4b-262fcd7729da"
+		id = "06fe48c4-6a7b-5b77-8186-8b26d6256db5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taintedscribe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.taintedscribe_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "5d981495a3922cbb61b73e09b9b5becae7637fb3153cbba90f67db62eec8bfc1"
+		logic_hash = "v1_sha256_5d981495a3922cbb61b73e09b9b5becae7637fb3153cbba90f67db62eec8bfc1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138738,20 +138808,20 @@ rule MALPEDIA_Win_Taintedscribe_Auto : FILE
 		$sequence_9 = { bb01000000 d3e3 33c0 85db 7e1e 8d4900 }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize < 524288
 }
 rule MALPEDIA_Win_Vapor_Rage_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "557acb15-65a4-5ee1-85fd-aeddfe817272"
+		id = "2030256f-03d6-5d21-933c-e503b719ef2f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vapor_rage"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vapor_rage_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "f25f99fbbd5c20118e31285e56e8f0280cb5b6b08bdd8f0f37cb8cec6e554ab7"
+		logic_hash = "v1_sha256_f25f99fbbd5c20118e31285e56e8f0280cb5b6b08bdd8f0f37cb8cec6e554ab7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138777,20 +138847,20 @@ rule MALPEDIA_Win_Vapor_Rage_Auto : FILE
 		$sequence_9 = { 32db 885de7 c745fcfeffffff e8???????? 84db 0f8564ffffff e8???????? }
 
 	condition:
-		7 of them and filesize <296960
+		7 of them and filesize < 296960
 }
 rule MALPEDIA_Win_Wndtest_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4e765db5-5f4c-5512-83db-9314a470b113"
+		id = "8ae54a31-8453-56e9-bd32-c3f514126976"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wndtest"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wndtest_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "6715ba88802d5ba703391f2c7044c94873e31517f5f99099b0c4158e2dd1a5c1"
+		logic_hash = "v1_sha256_6715ba88802d5ba703391f2c7044c94873e31517f5f99099b0c4158e2dd1a5c1"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -138816,20 +138886,20 @@ rule MALPEDIA_Win_Wndtest_Auto : FILE
 		$sequence_9 = { 75ea 8bcb 0fb6d2 c1e918 33ca }
 
 	condition:
-		7 of them and filesize <901120
+		7 of them and filesize < 901120
 }
 rule MALPEDIA_Win_Xpan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6b6d87b0-cd4f-5f1f-ad41-a91b081050bf"
+		id = "af623a92-6f8d-5454-a525-45f171c93c7d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xpan_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "53afdb60ad3d527db39db546f8bfd19e69fe202e95aaa870b577cf5bc58b7794"
+		logic_hash = "v1_sha256_53afdb60ad3d527db39db546f8bfd19e69fe202e95aaa870b577cf5bc58b7794"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138855,20 +138925,20 @@ rule MALPEDIA_Win_Xpan_Auto : FILE
 		$sequence_9 = { 757d 85f6 0f84d8000000 f744245400180000 0f84ca000000 c6450000 84d2 }
 
 	condition:
-		7 of them and filesize <3235840
+		7 of them and filesize < 3235840
 }
 rule MALPEDIA_Win_Oatboat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c48265c6-7a9b-56ea-94f6-25b8465cba6b"
+		id = "1c3c6c3f-0eb6-5f22-8c96-53c41b0a0cf0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oatboat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.oatboat_auto.yar#L1-L109"
 		license_url = "N/A"
-		logic_hash = "56315385a1ed981e34ba70026cf854697ce902e66d4a4a661e8df69530ad3228"
+		logic_hash = "v1_sha256_56315385a1ed981e34ba70026cf854697ce902e66d4a4a661e8df69530ad3228"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138892,20 +138962,20 @@ rule MALPEDIA_Win_Oatboat_Auto : FILE
 		$sequence_7 = { 0f84a3000000 4d8b5210 4d85d2 0f8496000000 4d397a30 0f848c000000 498b5a60 }
 
 	condition:
-		7 of them and filesize <58368
+		7 of them and filesize < 58368
 }
 rule MALPEDIA_Win_Atlantida_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "869bb208-99fc-58cc-b6f3-123be4e2dd14"
+		id = "1de71b06-23cc-59da-8280-9749ba7dd46d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atlantida"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.atlantida_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "de93365ad64d88523ed488fd5b5635b3ae5e4c0d8a34a9201e696d8414f63e31"
+		logic_hash = "v1_sha256_de93365ad64d88523ed488fd5b5635b3ae5e4c0d8a34a9201e696d8414f63e31"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138931,20 +139001,20 @@ rule MALPEDIA_Win_Atlantida_Auto : FILE
 		$sequence_9 = { e8???????? 8b13 41 be35e00fe4 41 0fb7ce 6644 }
 
 	condition:
-		7 of them and filesize <13793280
+		7 of them and filesize < 13793280
 }
 rule MALPEDIA_Win_Lockbit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6f3385a8-2122-56da-ae67-c32b266b8bf0"
+		id = "3a12ea9d-4d1f-5195-8b6e-fa72ce3d5421"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockbit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lockbit_auto.yar#L1-L209"
 		license_url = "N/A"
-		logic_hash = "f9cfb53a3d4bcd6fa0ccd32df2c087610c559fdf32ede817bcfaa297f48ef893"
+		logic_hash = "v1_sha256_f9cfb53a3d4bcd6fa0ccd32df2c087610c559fdf32ede817bcfaa297f48ef893"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138980,20 +139050,20 @@ rule MALPEDIA_Win_Lockbit_Auto : FILE
 		$sequence_19 = { 234df0 094ddc 0155dc 8b55f4 8bf2 c1ce0b 8bca }
 
 	condition:
-		7 of them and filesize <2049024
+		7 of them and filesize < 2049024
 }
 rule MALPEDIA_Win_Mim221_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73f86bbf-82d0-5204-a2d1-b26dcb4711e9"
+		id = "53aac4d3-a514-57ff-8000-644ecadae218"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mim221"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mim221_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "bd2938d5a81d44d76221abdf1ea92c7bf7be6210ea127474e453ccedb94f51d9"
+		logic_hash = "v1_sha256_bd2938d5a81d44d76221abdf1ea92c7bf7be6210ea127474e453ccedb94f51d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139019,20 +139089,20 @@ rule MALPEDIA_Win_Mim221_Auto : FILE
 		$sequence_9 = { 488bf8 483bc3 7504 33c0 eb58 498d5708 895c2430 }
 
 	condition:
-		7 of them and filesize <471040
+		7 of them and filesize < 471040
 }
 rule MALPEDIA_Win_Zumanek_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "87aee693-fd24-5045-ad68-bbf967fca577"
+		id = "1093a058-bb69-54d8-a9a5-74aa119d09c7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zumanek"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zumanek_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "692948458546aa7f1172f720f7a047815fbd39df276c694923c84a71f1135e40"
+		logic_hash = "v1_sha256_692948458546aa7f1172f720f7a047815fbd39df276c694923c84a71f1135e40"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139058,20 +139128,20 @@ rule MALPEDIA_Win_Zumanek_Auto : FILE
 		$sequence_9 = { 5a c59cd53a93a658 98 9f f5 6b80e7fa856bb2 55 }
 
 	condition:
-		7 of them and filesize <58867712
+		7 of them and filesize < 58867712
 }
 rule MALPEDIA_Win_Cmsbrute_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "da0817c1-f424-5734-8385-f31d5907ea91"
+		id = "33f1843a-dd10-5a5d-b57b-0fd78c796395"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cmsbrute"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cmsbrute_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d6f710add367d46059e77fa037926a5f1978933090d5b5fe00daae5ae1015f3d"
+		logic_hash = "v1_sha256_d6f710add367d46059e77fa037926a5f1978933090d5b5fe00daae5ae1015f3d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139097,20 +139167,20 @@ rule MALPEDIA_Win_Cmsbrute_Auto : FILE
 		$sequence_9 = { e9???????? f7870001000000000020 740a e8???????? e9???????? 6a32 6a02 }
 
 	condition:
-		7 of them and filesize <5275648
+		7 of them and filesize < 5275648
 }
 rule MALPEDIA_Win_M0Yv_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8b6ddfd9-e72e-5c1f-8455-077da1ba000c"
+		id = "0ea203ee-f923-5212-becf-4b3406f562e7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.m0yv"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.m0yv_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "7fb594619e0043ac0fe0e642705f4afbb65953751fccf49008dc2c100af6a96a"
+		logic_hash = "v1_sha256_7fb594619e0043ac0fe0e642705f4afbb65953751fccf49008dc2c100af6a96a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139136,20 +139206,20 @@ rule MALPEDIA_Win_M0Yv_Auto : FILE
 		$sequence_9 = { 8b7c2404 4431d7 897904 8b7c2408 4431df 897908 8b7c241c }
 
 	condition:
-		7 of them and filesize <779264
+		7 of them and filesize < 779264
 }
 rule MALPEDIA_Win_Remcos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a82de676-3cc8-5fb4-a200-4d5a92641294"
+		id = "bd26bc44-82d4-5f4e-b989-fcdaf98a6d37"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.remcos_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "a7cd1a6ac531bf59ce4eeb2a4df184c30ea794355d77ce56d9d521351da0d837"
+		logic_hash = "v1_sha256_a7cd1a6ac531bf59ce4eeb2a4df184c30ea794355d77ce56d9d521351da0d837"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139175,20 +139245,20 @@ rule MALPEDIA_Win_Remcos_Auto : FILE
 		$sequence_9 = { 50 6a28 ff15???????? 50 ff15???????? 8d45f0 33f6 }
 
 	condition:
-		7 of them and filesize <1054720
+		7 of them and filesize < 1054720
 }
 rule MALPEDIA_Win_Moonwind_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c3fad56f-d87f-5c82-8de0-ae938da1f3ea"
+		id = "5cf5cc1c-074e-57f2-a890-2cd366175da7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonwind"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.moonwind_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "e8ac75896a4e3b1235e6b43c3207bc2e4011dd5892e4b54601195386441510bf"
+		logic_hash = "v1_sha256_e8ac75896a4e3b1235e6b43c3207bc2e4011dd5892e4b54601195386441510bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139214,20 +139284,20 @@ rule MALPEDIA_Win_Moonwind_Auto : FILE
 		$sequence_9 = { f3a5 8b45f0 40 c1e002 83c008 50 ff75f4 }
 
 	condition:
-		7 of them and filesize <1417216
+		7 of them and filesize < 1417216
 }
 rule MALPEDIA_Win_Beatdrop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff3c4e57-abd7-50b6-b4a8-35e3251008c1"
+		id = "0dffa0eb-ec15-5cd4-930a-5ef9e22ca0fa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beatdrop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.beatdrop_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "fb95caaadd3d9eb43e82310b2c0d02a31a3bc14c45800fa5e72d0081477812d0"
+		logic_hash = "v1_sha256_fb95caaadd3d9eb43e82310b2c0d02a31a3bc14c45800fa5e72d0081477812d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139253,20 +139323,20 @@ rule MALPEDIA_Win_Beatdrop_Auto : FILE
 		$sequence_9 = { 4c89e9 e8???????? 4c89e0 4883c450 5b }
 
 	condition:
-		7 of them and filesize <584704
+		7 of them and filesize < 584704
 }
 rule MALPEDIA_Win_Cradlecore_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c02dd3cc-a2fa-5db2-b15e-6536b0232a3b"
+		id = "9658cdf1-2399-5b0a-a082-04c961c98d69"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cradlecore"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cradlecore_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "e4b2ddac2d160e24e50f2cbbb671c4c77a767dbac5be4d1bf9ebefaf8002be13"
+		logic_hash = "v1_sha256_e4b2ddac2d160e24e50f2cbbb671c4c77a767dbac5be4d1bf9ebefaf8002be13"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139292,20 +139362,20 @@ rule MALPEDIA_Win_Cradlecore_Auto : FILE
 		$sequence_9 = { 894108 8d4d90 c645fc05 e8???????? 6a00 ff7508 8d8d24feffff }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize < 450560
 }
 rule MALPEDIA_Win_Vendetta_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "966ae160-05eb-53d3-b86d-ed42268f2f0c"
+		id = "e3036780-bcab-5cb6-8ac8-9f1dac374de8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vendetta"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vendetta_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "4fce9b15fe513b7322e530a7cc2cb9b1afb7d5162c1238338f15db6a45fbd5fd"
+		logic_hash = "v1_sha256_4fce9b15fe513b7322e530a7cc2cb9b1afb7d5162c1238338f15db6a45fbd5fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139331,20 +139401,20 @@ rule MALPEDIA_Win_Vendetta_Auto : FILE
 		$sequence_9 = { 53 8d85f0f7ffff 50 56 }
 
 	condition:
-		7 of them and filesize <296960
+		7 of them and filesize < 296960
 }
 rule MALPEDIA_Win_Pipemon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4aaf45d7-d465-5241-bf1c-8e05e9105546"
+		id = "1e74a93d-d489-5c95-9ed5-c1fc9e9f7e9f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipemon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pipemon_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "81e25c1dde542bb643a4ac77dae07f1869016dd02282de1f135701fd67f912a5"
+		logic_hash = "v1_sha256_81e25c1dde542bb643a4ac77dae07f1869016dd02282de1f135701fd67f912a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139370,20 +139440,20 @@ rule MALPEDIA_Win_Pipemon_Auto : FILE
 		$sequence_9 = { 72c3 4c8b842490000000 ba01000000 498bcc ffd3 488b7c2460 488bc3 }
 
 	condition:
-		7 of them and filesize <389120
+		7 of them and filesize < 389120
 }
 rule MALPEDIA_Win_Get2_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3d0e8698-7ca7-5de8-bc9d-fbf1a289749b"
+		id = "44d7289f-e31f-582f-9b67-150267cc4809"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.get2"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.get2_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "3e4ed8755efbe8103bdeb8a3d5374ebaab1badd22c715ede9aefa416798b3d3f"
+		logic_hash = "v1_sha256_3e4ed8755efbe8103bdeb8a3d5374ebaab1badd22c715ede9aefa416798b3d3f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139415,20 +139485,20 @@ rule MALPEDIA_Win_Get2_Auto : FILE
 		$sequence_15 = { 56 57 488d6c24a0 4881ec60010000 48c7442428feffffff }
 
 	condition:
-		7 of them and filesize <720896
+		7 of them and filesize < 720896
 }
 rule MALPEDIA_Win_Atmii_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "07359bf0-199f-5425-bfa3-1b99e24213c7"
+		id = "5caf0692-69cb-5a87-930c-8fee3f96d453"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmii"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.atmii_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "0000b9c68134784a20204e48d35d09ba08981bd4ad498b87f530c8bc9d180475"
+		logic_hash = "v1_sha256_0000b9c68134784a20204e48d35d09ba08981bd4ad498b87f530c8bc9d180475"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139460,20 +139530,20 @@ rule MALPEDIA_Win_Atmii_Auto : FILE
 		$sequence_15 = { 68???????? 8d95f8feffff 52 ffd6 0fb74306 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Medusalocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c7b2a72f-78dd-502c-b029-e85b0ed2945e"
+		id = "2b9b5304-5a09-55b9-8fac-82361fe774c7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.medusalocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.medusalocker_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "7df5844b357690737586e0cd4cc89af865edb4da022c679b11e7f73e8fc7409a"
+		logic_hash = "v1_sha256_7df5844b357690737586e0cd4cc89af865edb4da022c679b11e7f73e8fc7409a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139499,20 +139569,20 @@ rule MALPEDIA_Win_Medusalocker_Auto : FILE
 		$sequence_9 = { 8945ec eb07 c745ec00000000 8b55ec 8955e8 c745fcffffffff 8b4de8 }
 
 	condition:
-		7 of them and filesize <1433600
+		7 of them and filesize < 1433600
 }
 rule MALPEDIA_Win_Squidloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e1ae0a2d-727c-526d-ba6d-df7206fb7292"
+		id = "7d595190-9f06-59bd-b11c-b635ba932baf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.squidloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.squidloader_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "457a1f3d7d17509f684b88b8b92c880d3534d76469a8f93e7dd90a9494a02ca3"
+		logic_hash = "v1_sha256_457a1f3d7d17509f684b88b8b92c880d3534d76469a8f93e7dd90a9494a02ca3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139540,20 +139610,20 @@ rule MALPEDIA_Win_Squidloader_Auto : FILE
 		$sequence_11 = { 7403 48ffcd 488bfd 48c1e705 }
 
 	condition:
-		7 of them and filesize <18701312
+		7 of them and filesize < 18701312
 }
 rule MALPEDIA_Win_Netsupportmanager_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "65413a95-8602-50e7-8fc9-1bdaa9aea637"
+		id = "c9307d02-3fd8-5d5d-a221-a8013979b300"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.netsupportmanager_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0f21dd65c8f16f53e4a346f9dcfa8568aaa15104451879c8529729394d81f81d"
+		logic_hash = "v1_sha256_0f21dd65c8f16f53e4a346f9dcfa8568aaa15104451879c8529729394d81f81d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139579,20 +139649,20 @@ rule MALPEDIA_Win_Netsupportmanager_Rat_Auto : FILE
 		$sequence_9 = { f3a5 8bc8 83e103 f3a4 81fa03000d00 750d 8d55c4 }
 
 	condition:
-		7 of them and filesize <4734976
+		7 of them and filesize < 4734976
 }
 rule MALPEDIA_Win_Grimplant_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00b5fa06-fa9c-594f-a510-4c191fcf8f32"
+		id = "cbcc1324-d1a3-51a6-8cc1-ff8f4505b58a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grimplant"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.grimplant_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "cbccd823b10050710a9d07b6e6e07157320e71de997cbe30ef0383cab26da835"
+		logic_hash = "v1_sha256_cbccd823b10050710a9d07b6e6e07157320e71de997cbe30ef0383cab26da835"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139618,20 +139688,20 @@ rule MALPEDIA_Win_Grimplant_Auto : FILE
 		$sequence_9 = { eb23 4889c1 48c1e004 488d15882e9000 48c7040200000000 48c744020800000000 488d4101 }
 
 	condition:
-		7 of them and filesize <19940352
+		7 of them and filesize < 19940352
 }
 rule MALPEDIA_Win_Artfulpie_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "196adf33-8b22-5c74-a62b-042eb2b3d59f"
+		id = "dc9c8954-db1c-5d3d-ac7d-a08f285a6a2e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artfulpie"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.artfulpie_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "bdd4f2999d6ecf7d7a96f23629ce24760f5dc31c13fa4dc261ca04838f018c57"
+		logic_hash = "v1_sha256_bdd4f2999d6ecf7d7a96f23629ce24760f5dc31c13fa4dc261ca04838f018c57"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139657,20 +139727,20 @@ rule MALPEDIA_Win_Artfulpie_Auto : FILE
 		$sequence_9 = { 33c9 8bc1 3914c598294100 7408 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Attor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "28ef2855-ea16-5908-a1e2-a1862e0a74d3"
+		id = "91c4903c-c243-5ef4-8e00-ff32ce68f87b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.attor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.attor_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "de7f5a512e50826529d9df83eea4ee3f508c57e991d51c9dd6e574d86869905a"
+		logic_hash = "v1_sha256_de7f5a512e50826529d9df83eea4ee3f508c57e991d51c9dd6e574d86869905a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139702,20 +139772,20 @@ rule MALPEDIA_Win_Attor_Auto : FILE
 		$sequence_15 = { c1e902 f3ab 8bca 83c404 83e103 f3aa 8b44241c }
 
 	condition:
-		7 of them and filesize <2023424
+		7 of them and filesize < 2023424
 }
 rule MALPEDIA_Win_Kuaibu8_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "feff23df-fba9-50da-bdd6-d56c077ee020"
+		id = "2310a054-f702-5b75-b47f-dcea1fb33810"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kuaibu8"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kuaibu8_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "1c5187ee4041920ae10034915fbc8c0e2946de36b7825290c30788ee24d4d482"
+		logic_hash = "v1_sha256_1c5187ee4041920ae10034915fbc8c0e2946de36b7825290c30788ee24d4d482"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139741,20 +139811,20 @@ rule MALPEDIA_Win_Kuaibu8_Auto : FILE
 		$sequence_9 = { 8b5dec e8???????? 33c9 50 8d45f4 8bd8 58 }
 
 	condition:
-		7 of them and filesize <737280
+		7 of them and filesize < 737280
 }
 rule MALPEDIA_Win_Gh0Sttimes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "45c172b9-1490-520d-9674-c2fea272cf58"
+		id = "8d52836b-ad28-594a-aeac-d041fdad3fea"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gh0sttimes"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gh0sttimes_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "b365988442ea76655e7c2dc8b1db33d5df97fce16bdb0e3992e0bc9191760298"
+		logic_hash = "v1_sha256_b365988442ea76655e7c2dc8b1db33d5df97fce16bdb0e3992e0bc9191760298"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139786,20 +139856,20 @@ rule MALPEDIA_Win_Gh0Sttimes_Auto : FILE
 		$sequence_15 = { 488b4c2430 83490c08 a808 7409 488b442430 83480c04 }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize < 548864
 }
 rule MALPEDIA_Win_Cryptoshield_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d469a41b-f805-5bc0-8014-b5aff846fede"
+		id = "b974459f-7dd7-5dbe-a529-b52117562980"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshield"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cryptoshield_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "51b27f3518a9a59f8c494e0c229ea4ed8eee50ea1c264f413a97b5fd3e98710d"
+		logic_hash = "v1_sha256_51b27f3518a9a59f8c494e0c229ea4ed8eee50ea1c264f413a97b5fd3e98710d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139825,20 +139895,20 @@ rule MALPEDIA_Win_Cryptoshield_Auto : FILE
 		$sequence_9 = { ff33 ffd6 ff75fc ff15???????? ff75f8 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Dorkbot_Ngrbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "59e43108-0eea-5a85-94be-e4f2f553739a"
+		id = "d9d0818b-bd0f-562b-aefa-5bbee0b7e81e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dorkbot_ngrbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dorkbot_ngrbot_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "e7e0ed048f71ac1a9fd0b9da304618de36953790efcba8c3991a4e9c9121ea29"
+		logic_hash = "v1_sha256_e7e0ed048f71ac1a9fd0b9da304618de36953790efcba8c3991a4e9c9121ea29"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139864,20 +139934,20 @@ rule MALPEDIA_Win_Dorkbot_Ngrbot_Auto : FILE
 		$sequence_9 = { 50 e8???????? 83c404 85c0 7e14 8b4cbe10 51 }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize < 638976
 }
 rule MALPEDIA_Win_Unidentified_116_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dcbb6fc8-8b09-5285-9468-49ab6b078756"
+		id = "25e0e046-d3fd-57ed-89e6-7bc281e76313"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_116"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_116_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "cbb333fd9c34e1cf4f6b4bb87d2c0b2963e42381083d5b2c6bc817e5ca64d87b"
+		logic_hash = "v1_sha256_cbb333fd9c34e1cf4f6b4bb87d2c0b2963e42381083d5b2c6bc817e5ca64d87b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139903,20 +139973,20 @@ rule MALPEDIA_Win_Unidentified_116_Auto : FILE
 		$sequence_9 = { ff4808 834a5802 48 8b4218 48 85c0 7405 }
 
 	condition:
-		7 of them and filesize <1040384
+		7 of them and filesize < 1040384
 }
 rule MALPEDIA_Win_Reactorbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a4f3c70a-5bf3-5f9e-9dd8-eacb62aa112d"
+		id = "745913b4-11b3-5cb3-9137-2451c250eccb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.reactorbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.reactorbot_auto.yar#L1-L155"
 		license_url = "N/A"
-		logic_hash = "577d7a26f158c3905b8b827065bc6c12a25adcae231dbaf0bdeb91e6773e1cc2"
+		logic_hash = "v1_sha256_577d7a26f158c3905b8b827065bc6c12a25adcae231dbaf0bdeb91e6773e1cc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139948,20 +140018,20 @@ rule MALPEDIA_Win_Reactorbot_Auto : FILE
 		$sequence_15 = { 488b442468 813850450000 0f859f030000 488b442468 4883c018 }
 
 	condition:
-		7 of them and filesize <1032192
+		7 of them and filesize < 1032192
 }
 rule MALPEDIA_Win_Diztakun_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b37620d3-10d5-5e3b-870d-9fcc520704b1"
+		id = "3f86c50c-6846-5b55-a6dc-ac3684e55ed7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diztakun"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.diztakun_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "a3712f3787a19a9586caeb79806d7a5b14b9c57af185546c9c7b23f90c084141"
+		logic_hash = "v1_sha256_a3712f3787a19a9586caeb79806d7a5b14b9c57af185546c9c7b23f90c084141"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139987,20 +140057,20 @@ rule MALPEDIA_Win_Diztakun_Auto : FILE
 		$sequence_9 = { 8b1f 6a00 8dafa8000000 6a03 c7450000000000 e8???????? 8b5354 }
 
 	condition:
-		7 of them and filesize <688128
+		7 of them and filesize < 688128
 }
 rule MALPEDIA_Win_Mofksys_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5b460e3c-29c6-5db2-a32f-e1a99c684da5"
+		id = "c0e7e9fe-e4c6-563c-84f4-6aff125e4b8d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mofksys"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mofksys_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "8c9a7d93274bbf5d514b6dd91aa6e0270b7fa1be2a34ea8caa7a062178ba1dc3"
+		logic_hash = "v1_sha256_8c9a7d93274bbf5d514b6dd91aa6e0270b7fa1be2a34ea8caa7a062178ba1dc3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140026,20 +140096,20 @@ rule MALPEDIA_Win_Mofksys_Auto : FILE
 		$sequence_9 = { 8b5508 8b02 eb3a 8b4dd0 85c9 7424 66833901 }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize < 401408
 }
 rule MALPEDIA_Win_Mailto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e0688f37-3d60-5119-a0ac-dc5f19aa3f15"
+		id = "49766494-de36-5802-b008-5a4b1b5b0396"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mailto_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "4dc12b92c2c7f2a09f935b0b6cb8c34c3ae7e4e45623def262729c72d8213e08"
+		logic_hash = "v1_sha256_4dc12b92c2c7f2a09f935b0b6cb8c34c3ae7e4e45623def262729c72d8213e08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140065,20 +140135,20 @@ rule MALPEDIA_Win_Mailto_Auto : FILE
 		$sequence_9 = { 53 8b2cb0 e8???????? 50 53 ff7504 e8???????? }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Exaramel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "35622950-7b6c-5e19-8133-d0f2264aa9e8"
+		id = "ac538952-246d-5fa0-8c22-5afd691bfcaf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.exaramel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.exaramel_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "18c202b1bcb977a24c7c95e5ee5eaa9ad9563136df2ac39652d73a4b9f53b5e1"
+		logic_hash = "v1_sha256_18c202b1bcb977a24c7c95e5ee5eaa9ad9563136df2ac39652d73a4b9f53b5e1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140104,20 +140174,20 @@ rule MALPEDIA_Win_Exaramel_Auto : FILE
 		$sequence_9 = { ffb5f0fdffff ff15???????? 50 e8???????? 68???????? 8d85f4fdffff 50 }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize < 294912
 }
 rule MALPEDIA_Win_Xbot_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a6bf949-203e-5838-9302-120351d13e42"
+		id = "2cd4c943-8352-5255-b7b9-c09d87b33b51"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xbot_pos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xbot_pos_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "64b7d710b96434b08fc5c38afe005807adccf502aa66b286ce03ea7fb875f890"
+		logic_hash = "v1_sha256_64b7d710b96434b08fc5c38afe005807adccf502aa66b286ce03ea7fb875f890"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140143,20 +140213,20 @@ rule MALPEDIA_Win_Xbot_Pos_Auto : FILE
 		$sequence_9 = { 00a58d49000e 8a4900 268b4900 52 8c4900 7e8d 49 }
 
 	condition:
-		7 of them and filesize <3031040
+		7 of them and filesize < 3031040
 }
 rule MALPEDIA_Win_9002_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9aa2661d-b448-5e86-992b-d0dd1273bcc5"
+		id = "041a8568-9b03-5f7e-9ee1-ddf7eea1932c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.9002"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.9002_auto.yar#L1-L343"
 		license_url = "N/A"
-		logic_hash = "a9799983d6a402fa0d92d4f2eccaf317bd81e0e8019f92bfd3f7e50ba619a3a3"
+		logic_hash = "v1_sha256_a9799983d6a402fa0d92d4f2eccaf317bd81e0e8019f92bfd3f7e50ba619a3a3"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -140210,20 +140280,20 @@ rule MALPEDIA_Win_9002_Auto : FILE
 		$sequence_37 = { 7548 8b4e0c 394f0c 7540 8b5748 807f040a }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Dlrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c5494bd6-4fc0-5b83-8b92-b9ca3f87216d"
+		id = "0b17e691-e2a7-5de6-8f0c-05c251ae3213"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dlrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dlrat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "fad702107ce086ed634b62a81fd30395fc9fa896e743ae2abff0224916d86383"
+		logic_hash = "v1_sha256_fad702107ce086ed634b62a81fd30395fc9fa896e743ae2abff0224916d86383"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140249,20 +140319,20 @@ rule MALPEDIA_Win_Dlrat_Auto : FILE
 		$sequence_9 = { 488955b8 48c745b008000000 4c8d45b0 488d1d6f741000 48895dc8 48c745c011000000 488d55c0 }
 
 	condition:
-		7 of them and filesize <4121600
+		7 of them and filesize < 4121600
 }
 rule MALPEDIA_Win_Yty_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9e49fc42-83f5-52d0-90c6-9df681f170fe"
+		id = "5d3aaf94-b207-5600-89b8-7117a2f924a2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yty"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.yty_auto.yar#L1-L512"
 		license_url = "N/A"
-		logic_hash = "24d2496487d3e8a74d1838cfbb75ce014466580ad0212ac1fc21d0ad856e5f75"
+		logic_hash = "v1_sha256_24d2496487d3e8a74d1838cfbb75ce014466580ad0212ac1fc21d0ad856e5f75"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -140333,20 +140403,20 @@ rule MALPEDIA_Win_Yty_Auto : FILE
 		$sequence_54 = { 890424 e8???????? 8945dc 817ddce0070000 0f8ece030000 c70424???????? e8???????? }
 
 	condition:
-		7 of them and filesize <1097728
+		7 of them and filesize < 1097728
 }
 rule MALPEDIA_Win_Rombertik_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0947e6c1-9998-521a-99a5-cdd6a4e22a09"
+		id = "ad2419fc-770c-5705-8657-278d8fdd6b61"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rombertik"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rombertik_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "353c590302f7523faeb3c60893558a9f0763683879e3f9985cd798caf9881314"
+		logic_hash = "v1_sha256_353c590302f7523faeb3c60893558a9f0763683879e3f9985cd798caf9881314"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140372,20 +140442,20 @@ rule MALPEDIA_Win_Rombertik_Auto : FILE
 		$sequence_9 = { 3bc3 0f8486010000 53 6a01 8d4dfd }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Portdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f90b2eef-c6a0-58b2-8785-46346ca37f1b"
+		id = "bc8b8bbb-a447-5378-b5a0-28de13e4d774"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.portdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.portdoor_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "979d5d744cc74395bacd5f81861791359824c98484ee261c7c39edba432e34ef"
+		logic_hash = "v1_sha256_979d5d744cc74395bacd5f81861791359824c98484ee261c7c39edba432e34ef"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -140411,20 +140481,20 @@ rule MALPEDIA_Win_Portdoor_Auto : FILE
 		$sequence_9 = { eb41 8b4dec e8???????? 8945f0 eb34 8b4dec }
 
 	condition:
-		7 of them and filesize <297984
+		7 of them and filesize < 297984
 }
 rule MALPEDIA_Win_Doppeldridex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7bc1de9c-56ca-5544-aabb-578c6d2a6765"
+		id = "3c07b60c-2436-5c12-aae8-60ab7cc84321"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppeldridex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.doppeldridex_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "f94875582e8b5aa2ebc993fa0b95159a94408b6d25288caadf3c8433582dd0a1"
+		logic_hash = "v1_sha256_f94875582e8b5aa2ebc993fa0b95159a94408b6d25288caadf3c8433582dd0a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140456,20 +140526,20 @@ rule MALPEDIA_Win_Doppeldridex_Auto : FILE
 		$sequence_15 = { 83fa20 0f92c4 8a6db3 20cd 20e5 f6c501 8955b4 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Whiskerspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1f71cc7d-dee3-58c1-b7e7-0db4f27f7b73"
+		id = "79e4518d-ffd8-50c8-8292-6b923d170327"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whiskerspy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.whiskerspy_auto.yar#L1-L152"
 		license_url = "N/A"
-		logic_hash = "42f604644f01d6d1eab2ff27df4abe182b18b8311684ef0837061e88ea8bd127"
+		logic_hash = "v1_sha256_42f604644f01d6d1eab2ff27df4abe182b18b8311684ef0837061e88ea8bd127"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140500,20 +140570,20 @@ rule MALPEDIA_Win_Whiskerspy_Auto : FILE
 		$sequence_14 = { 8b00 8d8d38fcffff 51 50 e8???????? }
 
 	condition:
-		7 of them and filesize <591872
+		7 of them and filesize < 591872
 }
 rule MALPEDIA_Win_Webc2_Adspace_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "31690ec3-53d2-516a-a2ac-2daa7b554ffe"
+		id = "4779271c-bc6a-551e-bd05-d59516dc6470"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_adspace"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_adspace_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "7852a8a7e96f78b645860237edf52acf830636cf13e5faeed5b1eb81bda4c09a"
+		logic_hash = "v1_sha256_7852a8a7e96f78b645860237edf52acf830636cf13e5faeed5b1eb81bda4c09a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140539,20 +140609,20 @@ rule MALPEDIA_Win_Webc2_Adspace_Auto : FILE
 		$sequence_9 = { a1???????? 40 50 57 56 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Stealhook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "519c47bf-6262-59f6-ba96-b268e3554c31"
+		id = "8914340f-9cfd-5464-8c0a-16ef5a21afb7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealhook"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stealhook_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "34472d9d45445d7f0701c527e6f0fa4bcdf4882e35f9c62ec30365acd8243253"
+		logic_hash = "v1_sha256_34472d9d45445d7f0701c527e6f0fa4bcdf4882e35f9c62ec30365acd8243253"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140578,20 +140648,20 @@ rule MALPEDIA_Win_Stealhook_Auto : FILE
 		$sequence_9 = { 450fb706 4885db 744c 488b4340 48833800 741f }
 
 	condition:
-		7 of them and filesize <1129472
+		7 of them and filesize < 1129472
 }
 rule MALPEDIA_Win_Sisfader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ac94263f-1708-5e52-9df6-f609af38fa64"
+		id = "346b3f07-25fe-5dda-a7a0-ca2008e53f1d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sisfader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sisfader_auto.yar#L1-L276"
 		license_url = "N/A"
-		logic_hash = "5ae29b623b53b54fbc47f6ef4a5785e5e7b4cfe669d9c31d6f6094ced51ab6b7"
+		logic_hash = "v1_sha256_5ae29b623b53b54fbc47f6ef4a5785e5e7b4cfe669d9c31d6f6094ced51ab6b7"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -140637,20 +140707,20 @@ rule MALPEDIA_Win_Sisfader_Auto : FILE
 		$sequence_29 = { 894708 817908020f0000 0f8573010000 83790410 c7442470dcff0000 740d }
 
 	condition:
-		7 of them and filesize <417792
+		7 of them and filesize < 417792
 }
 rule MALPEDIA_Win_Woolger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3c730e5d-f238-51dc-9ad2-e2cb34cd5f3e"
+		id = "22368fe9-389d-53b1-9ecc-06256670ca8a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woolger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.woolger_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "a6736c829d032e2c9f6601605bc9a8797d9883ec84504553869cd4b3046fa27f"
+		logic_hash = "v1_sha256_a6736c829d032e2c9f6601605bc9a8797d9883ec84504553869cd4b3046fa27f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140676,20 +140746,20 @@ rule MALPEDIA_Win_Woolger_Auto : FILE
 		$sequence_9 = { 668945d4 8945d6 8945da 8945de 8945e2 8945e6 8945ea }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize < 196608
 }
 rule MALPEDIA_Win_Tellyouthepass_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b0d976f4-0236-5ffd-9bc3-701324f1d00b"
+		id = "90d01636-97e5-57aa-9632-94fffe89e719"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tellyouthepass"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tellyouthepass_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ecb0bbbbbf71d6e52cc61fe6d246b41bf4e7a6e9ebef1f549c3bac2b8ab00a58"
+		logic_hash = "v1_sha256_ecb0bbbbbf71d6e52cc61fe6d246b41bf4e7a6e9ebef1f549c3bac2b8ab00a58"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140715,20 +140785,20 @@ rule MALPEDIA_Win_Tellyouthepass_Auto : FILE
 		$sequence_9 = { bb17000000 e8???????? 488b442428 e8???????? 488d05ee551900 bb0a000000 e8???????? }
 
 	condition:
-		7 of them and filesize <7152640
+		7 of them and filesize < 7152640
 }
 rule MALPEDIA_Win_Thanatos_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ab4a7e75-8b1e-5a05-9767-529b8f947adc"
+		id = "38718466-1870-5000-b370-ed426d9dd275"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos_ransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.thanatos_ransom_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "92f92876fe7a3f7974d946f7e2104d595ba94070884727a043f8a6a9bbc163b3"
+		logic_hash = "v1_sha256_92f92876fe7a3f7974d946f7e2104d595ba94070884727a043f8a6a9bbc163b3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140754,20 +140824,20 @@ rule MALPEDIA_Win_Thanatos_Ransom_Auto : FILE
 		$sequence_9 = { 6af6 ff15???????? 8b04bde0774300 834c0318ff 33c0 }
 
 	condition:
-		7 of them and filesize <516096
+		7 of them and filesize < 516096
 }
 rule MALPEDIA_Win_Suppobox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "177ef819-f180-537c-8a5b-50145cc2ea86"
+		id = "9334dcc1-5629-513d-9209-270cb5a9538c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.suppobox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.suppobox_auto.yar#L1-L191"
 		license_url = "N/A"
-		logic_hash = "a5e7699d7d2692f12be7c31662694dcf4bf84741bea11b2882b9a09666e09210"
+		logic_hash = "v1_sha256_a5e7699d7d2692f12be7c31662694dcf4bf84741bea11b2882b9a09666e09210"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -140805,20 +140875,20 @@ rule MALPEDIA_Win_Suppobox_Auto : FILE
 		$sequence_21 = { 019dacf7ffff 83c40c 299dc4f7ffff e9???????? }
 
 	condition:
-		7 of them and filesize <1875968
+		7 of them and filesize < 1875968
 }
 rule MALPEDIA_Win_Asprox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0520b3a3-9483-5d2a-9f24-050358cf9005"
+		id = "c777123e-59d0-5b5a-96a5-66cd34d63034"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.asprox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.asprox_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "45002ecaaab3dadffe3aed1cfa4261799259027c0d201b2024f1681cd43bb771"
+		logic_hash = "v1_sha256_45002ecaaab3dadffe3aed1cfa4261799259027c0d201b2024f1681cd43bb771"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140844,20 +140914,20 @@ rule MALPEDIA_Win_Asprox_Auto : FILE
 		$sequence_9 = { 52 8b85e8fbffff 50 e8???????? 83c40c 6a00 6a00 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Satana_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ed6576e9-0bbc-54e1-95d8-b27f8b1348bf"
+		id = "6bb02351-1e08-5ef8-b53b-7a5fc366f645"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satana"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.satana_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "b7981beec1674ab80a9c4719e1b8a6cb3eebb0c2a5e13afc377fa72d8a4a6216"
+		logic_hash = "v1_sha256_b7981beec1674ab80a9c4719e1b8a6cb3eebb0c2a5e13afc377fa72d8a4a6216"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140883,20 +140953,20 @@ rule MALPEDIA_Win_Satana_Auto : FILE
 		$sequence_9 = { 68???????? 57 8945e4 ffd3 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize < 221184
 }
 rule MALPEDIA_Win_Unidentified_107_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "81c12c66-8304-5991-b574-5a315c388de3"
+		id = "bd31913c-3d73-55d4-903a-9f34941a120e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_107"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_107_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "c653c14e4c7ef56015dec3b1522bf0d3fe051f290ecd82f4142246fe6c534c52"
+		logic_hash = "v1_sha256_c653c14e4c7ef56015dec3b1522bf0d3fe051f290ecd82f4142246fe6c534c52"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140922,20 +140992,20 @@ rule MALPEDIA_Win_Unidentified_107_Auto : FILE
 		$sequence_9 = { 8938 48897008 4c89e1 ff15???????? 488b05???????? }
 
 	condition:
-		7 of them and filesize <254976
+		7 of them and filesize < 254976
 }
 rule MALPEDIA_Win_Andromeda_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1eaf3713-eaf3-56ba-93e1-406275c53353"
+		id = "6b7be653-c44b-5212-bec2-eee1b1c6892a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromeda"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.andromeda_auto.yar#L1-L304"
 		license_url = "N/A"
-		logic_hash = "9e39961b4372e3bc922b40be7e1f53c18cfcecc85e79e89fe6975047795ee278"
+		logic_hash = "v1_sha256_9e39961b4372e3bc922b40be7e1f53c18cfcecc85e79e89fe6975047795ee278"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -140983,20 +141053,20 @@ rule MALPEDIA_Win_Andromeda_Auto : FILE
 		$sequence_31 = { 8b456c 8b4018 894560 81c3b6dd7f19 ff5634 0faff8 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Koobface_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c6a2ece4-bdc3-570c-90b1-bf28a4d5b166"
+		id = "2148d451-4209-5fe0-8ef2-436a6d9e94d3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koobface"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.koobface_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "c65c2ad17a47311f43f81d1b6ae6bd5717f8484a20158d9b796e403e5d9ce6a0"
+		logic_hash = "v1_sha256_c65c2ad17a47311f43f81d1b6ae6bd5717f8484a20158d9b796e403e5d9ce6a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141022,20 +141092,20 @@ rule MALPEDIA_Win_Koobface_Auto : FILE
 		$sequence_9 = { 33cd fec0 5e e8???????? c9 c3 55 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Nullmixer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b38b3d85-051a-5533-80ac-2c20e10e6e40"
+		id = "1eef6597-4638-503e-bc1d-185384cce661"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nullmixer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nullmixer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "bed10b9aa89a73eeb2144099fe0c5f1e459e50018915c4280b459d1a0374a95d"
+		logic_hash = "v1_sha256_bed10b9aa89a73eeb2144099fe0c5f1e459e50018915c4280b459d1a0374a95d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141061,20 +141131,20 @@ rule MALPEDIA_Win_Nullmixer_Auto : FILE
 		$sequence_9 = { e8???????? 89c3 893424 89d9 e8???????? 83ec04 8d45e0 }
 
 	condition:
-		7 of them and filesize <2351104
+		7 of them and filesize < 2351104
 }
 rule MALPEDIA_Win_Wscspl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d7761c27-1c76-50ce-a49d-adbb7174eed5"
+		id = "3d3f03df-6cc4-5053-b4a7-59adb4fc8599"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wscspl"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wscspl_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "1b757c1efc9452507637d1df12d4e19d7f55d5ea9e93d3fda8eef85d6e83088d"
+		logic_hash = "v1_sha256_1b757c1efc9452507637d1df12d4e19d7f55d5ea9e93d3fda8eef85d6e83088d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141100,20 +141170,20 @@ rule MALPEDIA_Win_Wscspl_Auto : FILE
 		$sequence_9 = { 687c230000 8d44240c 6a01 50 ff15???????? 687c230000 68c10b0000 }
 
 	condition:
-		7 of them and filesize <901120
+		7 of them and filesize < 901120
 }
 rule MALPEDIA_Win_Unidentified_112_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bca61e0b-9af5-5227-9c81-6d76a750fd95"
+		id = "9a19c8eb-4db8-59e3-a7e5-65b25d2a5ebb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_112"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_112_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "bc9d9c0da4edb02fe1e586c7d9968e528daf3c2c022493f4878a3ccbbc90f116"
+		logic_hash = "v1_sha256_bc9d9c0da4edb02fe1e586c7d9968e528daf3c2c022493f4878a3ccbbc90f116"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141139,20 +141209,20 @@ rule MALPEDIA_Win_Unidentified_112_Auto : FILE
 		$sequence_9 = { eb56 0f10b708050000 488b9f08050000 48c7870805000003000000 4883fb03 0f8493000000 488d4da0 }
 
 	condition:
-		7 of them and filesize <7317504
+		7 of them and filesize < 7317504
 }
 rule MALPEDIA_Win_Hoplight_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2aa7245-0542-5f03-ac64-64c8e4dfd14a"
+		id = "7e9c577d-b1a3-5285-8e45-8842120811e3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hoplight"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hoplight_auto.yar#L1-L106"
 		license_url = "N/A"
-		logic_hash = "00943ab9210fcdddaf459f640db07e69da7180851bcc89590390e262f5274de2"
+		logic_hash = "v1_sha256_00943ab9210fcdddaf459f640db07e69da7180851bcc89590390e262f5274de2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141176,20 +141246,20 @@ rule MALPEDIA_Win_Hoplight_Auto : FILE
 		$sequence_7 = { 81e1ff000000 8bc9 488d15966d0200 33048a 8b4c2428 c1e918 }
 
 	condition:
-		7 of them and filesize <765952
+		7 of them and filesize < 765952
 }
 rule MALPEDIA_Win_Nevada_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0fb24068-87ce-54a0-ba82-bfdd95f811de"
+		id = "85459fa7-7cbb-5f51-9a63-10df2635c9e2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nevada"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nevada_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "e8b202252b082c203b7b36b32325aea4ef97f49142f8ff76e8fa7afc9a175f74"
+		logic_hash = "v1_sha256_e8b202252b082c203b7b36b32325aea4ef97f49142f8ff76e8fa7afc9a175f74"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141215,20 +141285,20 @@ rule MALPEDIA_Win_Nevada_Auto : FILE
 		$sequence_9 = { 84db 780a 4983c101 31c0 89de }
 
 	condition:
-		7 of them and filesize <1063936
+		7 of them and filesize < 1063936
 }
 rule MALPEDIA_Win_Iconic_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "380edff9-b58c-56a7-886b-9f1f08a2730a"
+		id = "3981302b-cd82-58a0-99ee-ab4e4bd1925a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iconic_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.iconic_stealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "79bfb58f74bc25ff74aa194b90c6f55ae1a1814931feba358207424fda4b9135"
+		logic_hash = "v1_sha256_79bfb58f74bc25ff74aa194b90c6f55ae1a1814931feba358207424fda4b9135"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141254,20 +141324,20 @@ rule MALPEDIA_Win_Iconic_Stealer_Auto : FILE
 		$sequence_9 = { 7d0f 488b4208 488d0c49 0fb654c80c eb02 b244 0fbeda }
 
 	condition:
-		7 of them and filesize <2401280
+		7 of them and filesize < 2401280
 }
 rule MALPEDIA_Win_Ccleaner_Backdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d39b3ad8-e53b-51c7-9c43-1241d438c62d"
+		id = "2bbec010-d115-54e8-a276-7f50d25354d7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ccleaner_backdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ccleaner_backdoor_auto.yar#L1-L273"
 		license_url = "N/A"
-		logic_hash = "7e02daa93489db738904f39e35741a7860a222dd47acd23737d3bf7b398eab73"
+		logic_hash = "v1_sha256_7e02daa93489db738904f39e35741a7860a222dd47acd23737d3bf7b398eab73"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -141313,20 +141383,20 @@ rule MALPEDIA_Win_Ccleaner_Backdoor_Auto : FILE
 		$sequence_29 = { c70309000000 c746183cb40210 ebc9 8b450c 894720 }
 
 	condition:
-		7 of them and filesize <377856
+		7 of them and filesize < 377856
 }
 rule MALPEDIA_Win_Nimrev_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "20b95ee4-71e8-5d91-8f08-c93eb8ecb6e9"
+		id = "7299dc70-d966-5faa-b705-ec15dfe82948"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimrev"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nimrev_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "c34627db4cecbf30356b0f5270911b9f9949d87d96e11dd97e4475658561ec16"
+		logic_hash = "v1_sha256_c34627db4cecbf30356b0f5270911b9f9949d87d96e11dd97e4475658561ec16"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141352,20 +141422,20 @@ rule MALPEDIA_Win_Nimrev_Auto : FILE
 		$sequence_9 = { 83f001 84c0 7408 90 }
 
 	condition:
-		7 of them and filesize <1141760
+		7 of them and filesize < 1141760
 }
 rule MALPEDIA_Win_Dinodas_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3767f57e-77fd-50ff-a070-72ae08d30433"
+		id = "78780122-9a1c-553a-847d-9b1d2225a2a1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dinodas_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dinodas_rat_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "d711c805d5ef765c5b6b2b0b58b4e9853b9a582e9b5d986c36d846c104a514b8"
+		logic_hash = "v1_sha256_d711c805d5ef765c5b6b2b0b58b4e9853b9a582e9b5d986c36d846c104a514b8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141391,20 +141461,20 @@ rule MALPEDIA_Win_Dinodas_Rat_Auto : FILE
 		$sequence_9 = { 89442428 8d4c2420 51 8d542414 68???????? 52 c644247402 }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize < 638976
 }
 rule MALPEDIA_Win_Proto8_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "083740c0-add4-5086-9bb3-129b00384856"
+		id = "e88dfe00-d828-5298-be94-a1b6ae944a17"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.proto8_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.proto8_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f52122f494b07ec03552d51c6b0687cd994e16514778e5ef2160e099630dd732"
+		logic_hash = "v1_sha256_f52122f494b07ec03552d51c6b0687cd994e16514778e5ef2160e099630dd732"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141430,20 +141500,20 @@ rule MALPEDIA_Win_Proto8_Rat_Auto : FILE
 		$sequence_9 = { 48c744243800000000 4c8bc8 48894c2430 4c8bc7 488d4c2460 48894c2428 33c9 }
 
 	condition:
-		7 of them and filesize <2537472
+		7 of them and filesize < 2537472
 }
 rule MALPEDIA_Win_Paladin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "13b994af-533a-5dbe-b8e1-24beb3442212"
+		id = "4cdeec2f-bbc5-5f32-a557-0ac7c6929f3a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.paladin"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.paladin_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "686a1e9450a5c31100baeb4f1e4232469278fd6c7cba4e878a1957caee81dcdc"
+		logic_hash = "v1_sha256_686a1e9450a5c31100baeb4f1e4232469278fd6c7cba4e878a1957caee81dcdc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141469,20 +141539,20 @@ rule MALPEDIA_Win_Paladin_Auto : FILE
 		$sequence_9 = { 85f6 897c2428 0f8490000000 85ff 0f8488000000 55 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Contopee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2c889060-56d8-5d54-aa2d-c629c52f97ce"
+		id = "f978fc92-1dc9-5dcc-949a-541edeaec786"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.contopee"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.contopee_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "5a1991aadc5915c8d606191fa7b0860d33c2887b1b0f8a8e7eb2cdfcb613029d"
+		logic_hash = "v1_sha256_5a1991aadc5915c8d606191fa7b0860d33c2887b1b0f8a8e7eb2cdfcb613029d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141508,20 +141578,20 @@ rule MALPEDIA_Win_Contopee_Auto : FILE
 		$sequence_9 = { 8bf7 8bfa 8d5568 c1e902 f3a5 8bc8 33c0 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Bleachgap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0b3bd641-91e1-5a44-a4c8-6d070b78b23b"
+		id = "b5cf03f9-45a0-5717-a806-a301afc2c22c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bleachgap"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bleachgap_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "3130a827d52ec3314a8f25fbc828dbf76548d8c3f7d1048f0043a6b2ade8d5de"
+		logic_hash = "v1_sha256_3130a827d52ec3314a8f25fbc828dbf76548d8c3f7d1048f0043a6b2ade8d5de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141547,20 +141617,20 @@ rule MALPEDIA_Win_Bleachgap_Auto : FILE
 		$sequence_9 = { ff7650 e8???????? 83cdff 8d4e10 83c404 896c2420 837e7800 }
 
 	condition:
-		7 of them and filesize <4538368
+		7 of them and filesize < 4538368
 }
 rule MALPEDIA_Win_Ice_Ix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3971da01-8501-5ba0-8d5a-dc36a272dee6"
+		id = "9a1a29da-9a77-552d-ab49-60e56fe55998"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ice_ix"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ice_ix_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "297f8752913927ba432b9de91965d7e2bc2305cd2fc61a756292f8224e68d59e"
+		logic_hash = "v1_sha256_297f8752913927ba432b9de91965d7e2bc2305cd2fc61a756292f8224e68d59e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141586,20 +141656,20 @@ rule MALPEDIA_Win_Ice_Ix_Auto : FILE
 		$sequence_9 = { eb04 897c241c 6a77 8d742454 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Cinobi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "50908ef8-eb52-5007-8c2a-256211d7237f"
+		id = "60dd9dbf-5a6a-5755-898e-4b9fcb354305"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cinobi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cinobi_auto.yar#L1-L156"
 		license_url = "N/A"
-		logic_hash = "1ae8fc64307c077f4211ff04fa6a49a6ca1181e14e0c37993b50c43b3f285591"
+		logic_hash = "v1_sha256_1ae8fc64307c077f4211ff04fa6a49a6ca1181e14e0c37993b50c43b3f285591"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141630,20 +141700,20 @@ rule MALPEDIA_Win_Cinobi_Auto : FILE
 		$sequence_14 = { ffb683000000 57 e8???????? ff765f 898683000000 }
 
 	condition:
-		7 of them and filesize <32768
+		7 of them and filesize < 32768
 }
 rule MALPEDIA_Win_Mistcloak_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bcb29aaa-c37e-5c55-be1e-5d06aa41cabd"
+		id = "e73cfb01-d0f1-55b3-ac90-d55853c1abdc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mistcloak"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mistcloak_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "6962ced189f702e03fc18d236cee46a2a0844476537e8c819ea6f1c43f9c0922"
+		logic_hash = "v1_sha256_6962ced189f702e03fc18d236cee46a2a0844476537e8c819ea6f1c43f9c0922"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141669,20 +141739,20 @@ rule MALPEDIA_Win_Mistcloak_Auto : FILE
 		$sequence_9 = { 8b45b4 8b0c8590500110 8a043b 03ce 8b75dc 03cb 43 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize < 196608
 }
 rule MALPEDIA_Win_Redshawl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d449834a-6ec8-5065-8b96-a5a49ffb3034"
+		id = "797d8e55-a82b-5e57-8de5-80f9f4633a60"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redshawl"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.redshawl_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "b20acd5fb5af80ab78c14cd6c74a0396c69511a94b51759668c7b067e28aed11"
+		logic_hash = "v1_sha256_b20acd5fb5af80ab78c14cd6c74a0396c69511a94b51759668c7b067e28aed11"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141708,20 +141778,20 @@ rule MALPEDIA_Win_Redshawl_Auto : FILE
 		$sequence_9 = { 0f8584010000 8a0b 33c0 80f90a 0f94c0 8944244c 488d0502860000 }
 
 	condition:
-		7 of them and filesize <174080
+		7 of them and filesize < 174080
 }
 rule MALPEDIA_Win_Ghostemperor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f7621211-4b28-566a-b3ea-8ff428be0537"
+		id = "16713637-aec8-5602-8356-b8ef28e75e33"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostemperor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ghostemperor_auto.yar#L1-L213"
 		license_url = "N/A"
-		logic_hash = "52e1433fc52738b98f2cb3208f8e4210fe3ef53162cc193cfeb7b527c13f1b16"
+		logic_hash = "v1_sha256_52e1433fc52738b98f2cb3208f8e4210fe3ef53162cc193cfeb7b527c13f1b16"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -141760,20 +141830,20 @@ rule MALPEDIA_Win_Ghostemperor_Auto : FILE
 		$sequence_22 = { 052797fa04 351337a665 8945f4 488b4510 }
 
 	condition:
-		7 of them and filesize <1115136
+		7 of them and filesize < 1115136
 }
 rule MALPEDIA_Win_Lockfile_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "06969e31-f5a2-5625-9b28-348da0894916"
+		id = "4a4174e5-717b-5e92-a93f-163eb015a449"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockfile"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lockfile_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ccc239fdec0009df6e27636b6ceb3da4ca587bf03dbd6e51ebddd7a3a56ef524"
+		logic_hash = "v1_sha256_ccc239fdec0009df6e27636b6ceb3da4ca587bf03dbd6e51ebddd7a3a56ef524"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141799,20 +141869,20 @@ rule MALPEDIA_Win_Lockfile_Auto : FILE
 		$sequence_9 = { 4833c4 48898590010000 4c8bad08020000 0f57c0 0f1185b0000000 0f1185c0000000 0f1185d0000000 }
 
 	condition:
-		7 of them and filesize <1163264
+		7 of them and filesize < 1163264
 }
 rule MALPEDIA_Win_Pittytiger_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff8da921-664f-5df1-a82d-04fd7f26f2bd"
+		id = "a9de98fb-b9c0-57da-913c-3bff6364e4ff"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pittytiger_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pittytiger_rat_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "8acc632550999ec997897892dc652dc9572154a1b019a4992ae2e09d0384f83b"
+		logic_hash = "v1_sha256_8acc632550999ec997897892dc652dc9572154a1b019a4992ae2e09d0384f83b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141838,20 +141908,20 @@ rule MALPEDIA_Win_Pittytiger_Rat_Auto : FILE
 		$sequence_9 = { 8945f0 33ff 397df0 743c 397df8 }
 
 	condition:
-		7 of them and filesize <2162688
+		7 of them and filesize < 2162688
 }
 rule MALPEDIA_Win_Unidentified_053_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "44778796-93f3-5879-994d-5e3e2324b3e0"
+		id = "71e33504-63fd-5643-92db-7fd89acf8170"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_053"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_053_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "0ba9fcbf3221aa7fe9aa16ac81cd13a3c2e0b0b30a12bf9f5e09619187f5d921"
+		logic_hash = "v1_sha256_0ba9fcbf3221aa7fe9aa16ac81cd13a3c2e0b0b30a12bf9f5e09619187f5d921"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141877,20 +141947,20 @@ rule MALPEDIA_Win_Unidentified_053_Auto : FILE
 		$sequence_9 = { 8b048588814100 234508 8b4e14 8d04c1 0fb64801 8b5004 83fa10 }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize < 294912
 }
 rule MALPEDIA_Win_Leouncia_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "32ec41a2-2da2-577f-8d90-05e26877f66a"
+		id = "0a3408d9-3c1c-51aa-b01a-99d4854f7776"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.leouncia"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.leouncia_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "f4b700de9db33424264876c9622563c2f372a2b66a216a2beabd8c8a0520c076"
+		logic_hash = "v1_sha256_f4b700de9db33424264876c9622563c2f372a2b66a216a2beabd8c8a0520c076"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141916,20 +141986,20 @@ rule MALPEDIA_Win_Leouncia_Auto : FILE
 		$sequence_9 = { e8???????? 8d542448 8bf0 52 e8???????? 83c424 81fec8000000 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Fast_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5897ada5-fa61-53c9-92cd-a8ff361bb8f1"
+		id = "a5a85db4-e9a4-5b6a-b56d-ca00ed273aa6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fast_pos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fast_pos_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "ad79c209e4e736c9fd75da8ae33e4c5c82b2aa09007c974afa8089a55c049530"
+		logic_hash = "v1_sha256_ad79c209e4e736c9fd75da8ae33e4c5c82b2aa09007c974afa8089a55c049530"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141955,20 +142025,20 @@ rule MALPEDIA_Win_Fast_Pos_Auto : FILE
 		$sequence_9 = { 6a64 8d4580 c745fc00000000 50 89b578ffffff c7857cffffff00000000 ff15???????? }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Azov_Wiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3b7f586d-ba57-5a04-8f68-255a064cb459"
+		id = "871674c5-e22c-5325-9280-7d0355266cec"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azov_wiper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.azov_wiper_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "011364438eb01e088c781e3c84797626beea4dfb11a3cc9222e67a61e76881e5"
+		logic_hash = "v1_sha256_011364438eb01e088c781e3c84797626beea4dfb11a3cc9222e67a61e76881e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141994,20 +142064,20 @@ rule MALPEDIA_Win_Azov_Wiper_Auto : FILE
 		$sequence_9 = { 488d05acf3ffff 4883ec08 48890c24 48c7c1619afeff }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Wormhole_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e1610a26-8f6a-525e-a150-ab4ce6e346e4"
+		id = "b73e0f79-3a43-5eeb-89a8-97c7596be875"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wormhole"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wormhole_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "98b6efb48ef674cd1e4efeda549804876add0f8847a14dfa9ff2b839bd666e8b"
+		logic_hash = "v1_sha256_98b6efb48ef674cd1e4efeda549804876add0f8847a14dfa9ff2b839bd666e8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142033,20 +142103,20 @@ rule MALPEDIA_Win_Wormhole_Auto : FILE
 		$sequence_9 = { 6a00 51 6a02 89442424 ffd3 }
 
 	condition:
-		7 of them and filesize <99576
+		7 of them and filesize < 99576
 }
 rule MALPEDIA_Win_Zeus_Mailsniffer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cfc6ae1c-00c8-513e-86f0-d4e28caf1338"
+		id = "45a3877b-72a7-596c-b794-745f8c90203e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_mailsniffer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zeus_mailsniffer_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "fa3a7d3b021e61998435bd86dd4adccaaab84e20b590af9e4f54303f32d0d67f"
+		logic_hash = "v1_sha256_fa3a7d3b021e61998435bd86dd4adccaaab84e20b590af9e4f54303f32d0d67f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142072,20 +142142,20 @@ rule MALPEDIA_Win_Zeus_Mailsniffer_Auto : FILE
 		$sequence_9 = { ffd7 85c0 7570 8bc6 50 8d84249c030000 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Lowball_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "94fba641-8dbf-5316-b4e6-0a547aece5a2"
+		id = "bcdb31fe-627b-5bd2-ad66-8b9373ee17bb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowball"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lowball_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "75931b935ec88e9d9d484d9216c8a6d089fe4ea50136062678650dec871b0d9d"
+		logic_hash = "v1_sha256_75931b935ec88e9d9d484d9216c8a6d089fe4ea50136062678650dec871b0d9d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142111,20 +142181,20 @@ rule MALPEDIA_Win_Lowball_Auto : FILE
 		$sequence_9 = { 6a00 6a00 6a00 8d442428 6a00 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Stinger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "03e2d1ca-b846-5787-b683-28feb74dae3e"
+		id = "b42eea05-2d91-51ec-a1b7-a7e3b5cbafba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stinger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stinger_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "64d2d0bb18e9f4889ac80d1e49c5ab473a950fa26645e6f561f71db4e8eb08f3"
+		logic_hash = "v1_sha256_64d2d0bb18e9f4889ac80d1e49c5ab473a950fa26645e6f561f71db4e8eb08f3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142150,20 +142220,20 @@ rule MALPEDIA_Win_Stinger_Auto : FILE
 		$sequence_9 = { 8b5d08 ff33 b902000000 e8???????? 83c408 8945f0 ff750c }
 
 	condition:
-		7 of them and filesize <197096
+		7 of them and filesize < 197096
 }
 rule MALPEDIA_Win_Shakti_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5b5fdc29-c870-550c-b3e7-47224f030c24"
+		id = "73cd602a-d787-5ad7-b0bd-3b2682c06bca"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shakti"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shakti_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "f9488b8a8445549b2d17849193cda20ba79220110ad09656a16f1b56d9644dea"
+		logic_hash = "v1_sha256_f9488b8a8445549b2d17849193cda20ba79220110ad09656a16f1b56d9644dea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142195,20 +142265,20 @@ rule MALPEDIA_Win_Shakti_Auto : FILE
 		$sequence_15 = { 888820a64000 40 ebe9 33c0 8945e4 }
 
 	condition:
-		7 of them and filesize <191488
+		7 of them and filesize < 191488
 }
 rule MALPEDIA_Win_Maudi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3e4205bc-621f-57ac-9783-0d7a80e63274"
+		id = "9585da38-7bc7-522c-abc7-488f556dbca6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maudi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.maudi_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "ae4372c99a5ab8731cfa27286c0755a13272fa053f753c6557e155320ea94c91"
+		logic_hash = "v1_sha256_ae4372c99a5ab8731cfa27286c0755a13272fa053f753c6557e155320ea94c91"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142234,20 +142304,20 @@ rule MALPEDIA_Win_Maudi_Auto : FILE
 		$sequence_9 = { 5d b986180000 55 89e5 5d be???????? }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Poison_Ivy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ec8c2f98-412f-543c-9758-b1aacde91b4e"
+		id = "e1e1230c-345c-5889-b8b6-b4d0feb3826c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_ivy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.poison_ivy_auto.yar#L1-L91"
 		license_url = "N/A"
-		logic_hash = "431acfd8496c54390529508a28488eb12118d11f97e2de9a76cce0e819bacb59"
+		logic_hash = "v1_sha256_431acfd8496c54390529508a28488eb12118d11f97e2de9a76cce0e819bacb59"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142270,20 +142340,20 @@ rule MALPEDIA_Win_Poison_Ivy_Auto : FILE
 		$sequence_6 = { 8d86120e0000 50 ff75fc ff563d ff75fc ff5631 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Vsingle_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cc9fe25a-3024-59d5-8bbd-cc483f35b4a0"
+		id = "6a445c31-4561-5c68-886f-692f74ff5034"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vsingle"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vsingle_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "ea6b709a9def94eb8d7fd51d94ddf5ae4235a8cf02f9fd365b88bc3b6358449b"
+		logic_hash = "v1_sha256_ea6b709a9def94eb8d7fd51d94ddf5ae4235a8cf02f9fd365b88bc3b6358449b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142315,20 +142385,20 @@ rule MALPEDIA_Win_Vsingle_Auto : FILE
 		$sequence_15 = { 81c3af0f8c7e e9???????? 81c3ea117171 81c36738f462 81c315173337 81c3beb17872 81eb4b94fb51 }
 
 	condition:
-		7 of them and filesize <940032
+		7 of them and filesize < 940032
 }
 rule MALPEDIA_Win_Sodamaster_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d1f7db4a-f731-535e-9ec7-0f94492b7206"
+		id = "b8da3aff-d4bc-582c-ac23-ed04f0c90bc7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sodamaster"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sodamaster_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "fa1144cbcb2ad99084cc1ee6d93d89428028e0238c89b4c179e1b18530e08c7f"
+		logic_hash = "v1_sha256_fa1144cbcb2ad99084cc1ee6d93d89428028e0238c89b4c179e1b18530e08c7f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142354,20 +142424,20 @@ rule MALPEDIA_Win_Sodamaster_Auto : FILE
 		$sequence_9 = { ff15???????? eb10 c745da64006c00 b96c000000 66894dde }
 
 	condition:
-		7 of them and filesize <134144
+		7 of them and filesize < 134144
 }
 rule MALPEDIA_Win_Mylobot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "10f8483b-f798-51f2-8a0d-4ad60f69bcdb"
+		id = "9ec36786-e338-557a-9ca9-41c2f20515d8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mylobot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mylobot_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "a859373208876596e4d4c654a67f12e66a950382de85503fc39b74c533ee7259"
+		logic_hash = "v1_sha256_a859373208876596e4d4c654a67f12e66a950382de85503fc39b74c533ee7259"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142399,20 +142469,20 @@ rule MALPEDIA_Win_Mylobot_Auto : FILE
 		$sequence_15 = { 51 57 ff15???????? 8b35???????? 8d642400 8b5508 }
 
 	condition:
-		7 of them and filesize <8028160
+		7 of them and filesize < 8028160
 }
 rule MALPEDIA_Win_Backconfig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18fd149c-ad9b-5433-8651-ac1dcd92de05"
+		id = "763c364a-5b83-5429-b30b-25fe38b5c650"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backconfig"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.backconfig_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "dc29e43fa81d60d5f53e6f4d5e158937c417e8f12650929b20d71338a8cb5ead"
+		logic_hash = "v1_sha256_dc29e43fa81d60d5f53e6f4d5e158937c417e8f12650929b20d71338a8cb5ead"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142438,20 +142508,20 @@ rule MALPEDIA_Win_Backconfig_Auto : FILE
 		$sequence_9 = { 8bec 8b4508 56 8d34c550224100 833e00 7513 }
 
 	condition:
-		7 of them and filesize <217088
+		7 of them and filesize < 217088
 }
 rule MALPEDIA_Win_Broomstick_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ac676bf4-a9fb-5087-a5ff-f584bac2c26e"
+		id = "bd129123-fee8-53d9-89a1-3ea7c1a6acdf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.broomstick"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.broomstick_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "f03767b95c94bb52a9880746cdaa45b8005de1fc3a428f79c36aad1a9accc086"
+		logic_hash = "v1_sha256_f03767b95c94bb52a9880746cdaa45b8005de1fc3a428f79c36aad1a9accc086"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142477,20 +142547,20 @@ rule MALPEDIA_Win_Broomstick_Auto : FILE
 		$sequence_9 = { 85c0 7425 8d3c40 03ff 83ef06 8bd3 }
 
 	condition:
-		7 of them and filesize <1016832
+		7 of them and filesize < 1016832
 }
 rule MALPEDIA_Win_Akira_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "15bec9b6-593f-5024-bdc9-f9c22915c4b9"
+		id = "ca8c2e0c-b8a1-5e98-9af3-19a44f3ca576"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.akira"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.akira_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "df165485c04575afe03a18bf0b6e5a6197bfd9f8e4bf586c974ab0f67dd9d7c7"
+		logic_hash = "v1_sha256_df165485c04575afe03a18bf0b6e5a6197bfd9f8e4bf586c974ab0f67dd9d7c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142516,20 +142586,20 @@ rule MALPEDIA_Win_Akira_Auto : FILE
 		$sequence_9 = { 7508 c60330 48ffcb ebdf fec1 880b 483bde }
 
 	condition:
-		7 of them and filesize <1286144
+		7 of them and filesize < 1286144
 }
 rule MALPEDIA_Win_Flawedammyy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "869ded56-7b9a-5ec5-b348-fd92c863b7a6"
+		id = "37d06f4a-f334-5d02-9560-4b2dd2d2a5c6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedammyy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.flawedammyy_auto.yar#L1-L306"
 		license_url = "N/A"
-		logic_hash = "1cd6d61d60d4c415e6c8e37367c9ce0c64744bcdc60e8edfc1af0f4b4c964dec"
+		logic_hash = "v1_sha256_1cd6d61d60d4c415e6c8e37367c9ce0c64744bcdc60e8edfc1af0f4b4c964dec"
 		score = 75
 		quality = 33
 		tags = "FILE"
@@ -142577,20 +142647,20 @@ rule MALPEDIA_Win_Flawedammyy_Auto : FILE
 		$sequence_31 = { 8bdf 8b06 83661c00 83f807 0f87c9000000 ff248580233400 }
 
 	condition:
-		7 of them and filesize <1350656
+		7 of them and filesize < 1350656
 }
 rule MALPEDIA_Win_Vyveva_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "609ee890-2ca7-5a62-be35-cd1b7bd5751c"
+		id = "16abf643-74f3-5f62-8fbd-180ea44ef435"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vyveva"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vyveva_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "0673ae4749420e7fc0134b23031a9015b50b7275847c92099461dcf3a81aa83d"
+		logic_hash = "v1_sha256_0673ae4749420e7fc0134b23031a9015b50b7275847c92099461dcf3a81aa83d"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -142616,20 +142686,20 @@ rule MALPEDIA_Win_Vyveva_Auto : FILE
 		$sequence_9 = { 8bce e8???????? 8b942430020000 8d44240c 6a04 50 56 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Victorygate_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "967fc783-d9bc-5b76-9b75-3a087d6a66b4"
+		id = "419c6932-6089-5f4d-be3f-2c30bf9fb586"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.victorygate"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.victorygate_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "427b2d98b9c3c2aa99b815ff597c75e43d477300e8035fd3554b7df3486b4eb0"
+		logic_hash = "v1_sha256_427b2d98b9c3c2aa99b815ff597c75e43d477300e8035fd3554b7df3486b4eb0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142655,20 +142725,20 @@ rule MALPEDIA_Win_Victorygate_Auto : FILE
 		$sequence_9 = { ff15???????? 85c0 0f852b010000 ff75f8 8d8688020000 6a5b 50 }
 
 	condition:
-		7 of them and filesize <1209344
+		7 of them and filesize < 1209344
 }
 rule MALPEDIA_Win_Lumar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7f6eed55-2de5-5fd1-92bb-28b323fbad6c"
+		id = "767e23d9-c345-5e7b-a99d-444c3884439a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumar"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lumar_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "4c7ebe5b3b93aaa9cf6694e15922d9cba2c0b75a9c7cd0df2741c632bee6f36c"
+		logic_hash = "v1_sha256_4c7ebe5b3b93aaa9cf6694e15922d9cba2c0b75a9c7cd0df2741c632bee6f36c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142694,20 +142764,20 @@ rule MALPEDIA_Win_Lumar_Auto : FILE
 		$sequence_9 = { c60430c3 8d45fc 895dfc 50 ff15???????? 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Blackbyte_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "452fd00b-5b18-59a5-8a83-8658b17c13ef"
+		id = "8434c6e4-6a34-5f0d-87c4-6508ac542b35"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbyte"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blackbyte_auto.yar#L1-L156"
 		license_url = "N/A"
-		logic_hash = "3e97ee9c8cf8b212a848f172ac3c7f3f16e8569d16a1ada661dd50af9fb2d432"
+		logic_hash = "v1_sha256_3e97ee9c8cf8b212a848f172ac3c7f3f16e8569d16a1ada661dd50af9fb2d432"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142739,20 +142809,20 @@ rule MALPEDIA_Win_Blackbyte_Auto : FILE
 		$sequence_15 = { 0f29442440 e8???????? 85c0 0f85d7000000 }
 
 	condition:
-		7 of them and filesize <9435136
+		7 of them and filesize < 9435136
 }
 rule MALPEDIA_Win_Dispcashbr_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "70fd1e85-83ca-549b-b752-3572dac97120"
+		id = "b58023e4-0972-5577-a1b2-8505a5639a1f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dispcashbr"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dispcashbr_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "1d5a00b182201f928fd4d6b3f1036a475f5957d210fb4c8d3527862a6527bc4d"
+		logic_hash = "v1_sha256_1d5a00b182201f928fd4d6b3f1036a475f5957d210fb4c8d3527862a6527bc4d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142778,20 +142848,20 @@ rule MALPEDIA_Win_Dispcashbr_Auto : FILE
 		$sequence_9 = { e8???????? 83ec08 c7442408ccffffff c7442404???????? }
 
 	condition:
-		7 of them and filesize <123904
+		7 of them and filesize < 123904
 }
 rule MALPEDIA_Win_Mortalkombat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5eb05f16-7725-598c-b79d-b9528e7759ee"
+		id = "07f2783e-4bcc-5cff-84ef-9f4268864f5f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mortalkombat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mortalkombat_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "44f11e1302873d7b8732182da9f21833a01d02537c804d5a52bde5d4fbe797c8"
+		logic_hash = "v1_sha256_44f11e1302873d7b8732182da9f21833a01d02537c804d5a52bde5d4fbe797c8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142817,20 +142887,20 @@ rule MALPEDIA_Win_Mortalkombat_Auto : FILE
 		$sequence_9 = { 6640 00684d 214000 e8???????? }
 
 	condition:
-		7 of them and filesize <1224704
+		7 of them and filesize < 1224704
 }
 rule MALPEDIA_Win_Salgorea_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e83328a9-575c-5760-8b43-23537ecb114c"
+		id = "fe67924e-b4c1-5152-8fa6-9cc73b1b8dd9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.salgorea"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.salgorea_auto.yar#L1-L157"
 		license_url = "N/A"
-		logic_hash = "84460b5404731160a6417d2e0703563ce9ec3d697d914eab182f90119819d293"
+		logic_hash = "v1_sha256_84460b5404731160a6417d2e0703563ce9ec3d697d914eab182f90119819d293"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142862,20 +142932,20 @@ rule MALPEDIA_Win_Salgorea_Auto : FILE
 		$sequence_15 = { 8d8c399979825a 8bfe 337df0 8bd1 }
 
 	condition:
-		7 of them and filesize <2007040
+		7 of them and filesize < 2007040
 }
 rule MALPEDIA_Win_Gameover_P2P_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f5c0a78b-346b-519f-ad74-638351724851"
+		id = "5ba52587-7045-51d8-85f5-83abe71e1470"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gameover_p2p_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "6bb48450821c79bc0f52b1eda3804ae910335d753ba80db1932c028cecce35a3"
+		logic_hash = "v1_sha256_6bb48450821c79bc0f52b1eda3804ae910335d753ba80db1932c028cecce35a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142901,20 +142971,20 @@ rule MALPEDIA_Win_Gameover_P2P_Auto : FILE
 		$sequence_9 = { 0f8481000000 57 ff75fc bf04010000 68???????? 53 8d85f0fdffff }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize < 598016
 }
 rule MALPEDIA_Win_Gazer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c74a4922-e38b-5cfc-86b0-8679816aca6f"
+		id = "fba94e00-6015-51fe-829f-d33596e00303"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gazer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gazer_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "168f0b268a65ddb10248870588fd54b58308fd12a6c3f9d75de33b31a206d1b2"
+		logic_hash = "v1_sha256_168f0b268a65ddb10248870588fd54b58308fd12a6c3f9d75de33b31a206d1b2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142940,20 +143010,20 @@ rule MALPEDIA_Win_Gazer_Auto : FILE
 		$sequence_9 = { 0fb6420e 894c2408 0fb64a0f c1e108 0bc8 0fb6420d c1e108 }
 
 	condition:
-		7 of them and filesize <950272
+		7 of them and filesize < 950272
 }
 rule MALPEDIA_Win_Donex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8482aba2-5d7c-5acf-8ac0-6f701bcd4c3c"
+		id = "c6b68e3e-b431-5ff8-8cb1-81e6cc8e30d3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.donex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.donex_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "791a2daeadd431298c15aca6e723243f3ba034df68a0c21a097c95582d44c9bb"
+		logic_hash = "v1_sha256_791a2daeadd431298c15aca6e723243f3ba034df68a0c21a097c95582d44c9bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142979,20 +143049,20 @@ rule MALPEDIA_Win_Donex_Auto : FILE
 		$sequence_9 = { 83c408 85db 7529 57 ff7508 e8???????? 8bd8 }
 
 	condition:
-		7 of them and filesize <505856
+		7 of them and filesize < 505856
 }
 rule MALPEDIA_Win_Mewsei_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "584cb11c-0c0a-56b4-a94f-bac12775ad8c"
+		id = "14645e7d-8651-5a36-a0a0-5b4fb8650482"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mewsei"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mewsei_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "ee5e42e21ccf04345d72bb9f3d49fdb8dd733d6140538e230075cf58e7ebb4a5"
+		logic_hash = "v1_sha256_ee5e42e21ccf04345d72bb9f3d49fdb8dd733d6140538e230075cf58e7ebb4a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143018,20 +143088,20 @@ rule MALPEDIA_Win_Mewsei_Auto : FILE
 		$sequence_9 = { 8bf8 897df8 c70300000000 8d7701 8d4900 56 e8???????? }
 
 	condition:
-		7 of them and filesize <504832
+		7 of them and filesize < 504832
 }
 rule MALPEDIA_Win_Unidentified_101_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1e5a977c-e7e9-5732-97b6-6aadc4f691fc"
+		id = "2d7dad6f-4cc0-5e95-b48e-473d8e8353f4"
 		date = "2023-03-28"
 		modified = "2023-04-07"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_101"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_101_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "71f0751fbd77a928634515b558d06922b4bf4a312042d6abbd6ba70171c64843"
+		logic_hash = "v1_sha256_71f0751fbd77a928634515b558d06922b4bf4a312042d6abbd6ba70171c64843"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143057,20 +143127,20 @@ rule MALPEDIA_Win_Unidentified_101_Auto : FILE
 		$sequence_9 = { 7528 48833d????????00 741e 488d0dd8450100 e8???????? 85c0 740e }
 
 	condition:
-		7 of them and filesize <402432
+		7 of them and filesize < 402432
 }
 rule MALPEDIA_Win_Acehash_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c02dd1c8-b3e7-50ce-a7de-221cfd645c47"
+		id = "2f798c01-99e3-54f8-9ec5-8142eecd1e16"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acehash"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.acehash_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "000cf5b63c50e8cdae527d807554d2033db615c3997c132b3125d4523298d8fb"
+		logic_hash = "v1_sha256_000cf5b63c50e8cdae527d807554d2033db615c3997c132b3125d4523298d8fb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143096,20 +143166,20 @@ rule MALPEDIA_Win_Acehash_Auto : FILE
 		$sequence_9 = { c3 4053 4883ec20 488bd9 488d4c2430 ba02000000 e8???????? }
 
 	condition:
-		7 of them and filesize <2318336
+		7 of them and filesize < 2318336
 }
 rule MALPEDIA_Win_Underminer_Ek_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f11b78f3-676c-503e-af81-133bd7b27942"
+		id = "1e581e3a-4ce5-5e17-b147-fb1bd9e1c677"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.underminer_ek"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.underminer_ek_auto.yar#L1-L176"
 		license_url = "N/A"
-		logic_hash = "2f91a4d4f297062b3d3b07b58a9c1bfef73e9c0060b6e1680dc04cf736854cd4"
+		logic_hash = "v1_sha256_2f91a4d4f297062b3d3b07b58a9c1bfef73e9c0060b6e1680dc04cf736854cd4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143141,20 +143211,20 @@ rule MALPEDIA_Win_Underminer_Ek_Auto : FILE
 		$sequence_15 = { 0f42c1 a3???????? 8b8584feffff 83f806 7545 }
 
 	condition:
-		7 of them and filesize <466944
+		7 of them and filesize < 466944
 }
 rule MALPEDIA_Win_Nim_Blackout_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff725f8e-78d8-573e-b72f-f808485072b3"
+		id = "08ccea82-53b6-5e1a-b132-9b350539c760"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nim_blackout"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nim_blackout_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "8bcac4d517a5c0195b2a1f86c54202d4da8e70268566b060cf8dd1e9526230c9"
+		logic_hash = "v1_sha256_8bcac4d517a5c0195b2a1f86c54202d4da8e70268566b060cf8dd1e9526230c9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143180,20 +143250,20 @@ rule MALPEDIA_Win_Nim_Blackout_Auto : FILE
 		$sequence_9 = { 7410 488b85a0000000 488b4038 488b00 eb05 b800000000 488b95a0000000 }
 
 	condition:
-		7 of them and filesize <1068032
+		7 of them and filesize < 1068032
 }
 rule MALPEDIA_Win_Xbtl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cc674cdb-617d-59f2-a495-aa1cae2d983f"
+		id = "306baa3e-4dd4-50ad-a748-be50f2e2c4e2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xbtl"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xbtl_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "f0bc6d62656eb26327c6c65c34f325364618e94666f302ef6065ecc9e58e240b"
+		logic_hash = "v1_sha256_f0bc6d62656eb26327c6c65c34f325364618e94666f302ef6065ecc9e58e240b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143219,20 +143289,20 @@ rule MALPEDIA_Win_Xbtl_Auto : FILE
 		$sequence_9 = { 7411 8b45f8 57 50 }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize < 401408
 }
 rule MALPEDIA_Win_Phobos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "50012a05-a115-568a-af1b-c38bab4b83db"
+		id = "22bf527f-03f9-57e5-a4a9-73bac54fe75c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.phobos_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "c0587de91f9b07bd28460653ab9d55aeeffabbc31465d7d7ac9b9413a4a57c0d"
+		logic_hash = "v1_sha256_c0587de91f9b07bd28460653ab9d55aeeffabbc31465d7d7ac9b9413a4a57c0d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143258,20 +143328,20 @@ rule MALPEDIA_Win_Phobos_Auto : FILE
 		$sequence_9 = { 2bfa 53 0fb716 0fb71c37 663bd3 770a 720d }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Gamotrol_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6d872926-0049-5e26-8ed8-52fa5b44bb44"
+		id = "d31b4af3-7070-5392-9920-f34a603c4507"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gamotrol"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gamotrol_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "41c3f31b322da6e7305bb8343f876e03d328f1fa9fbb5d6f4dcd6733da8fcf8b"
+		logic_hash = "v1_sha256_41c3f31b322da6e7305bb8343f876e03d328f1fa9fbb5d6f4dcd6733da8fcf8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143297,20 +143367,20 @@ rule MALPEDIA_Win_Gamotrol_Auto : FILE
 		$sequence_9 = { 830d????????ff 33c0 68???????? c705????????e4dd2e00 c705????????54dd2e00 }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize < 376832
 }
 rule MALPEDIA_Win_Unidentified_105_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eddc8e7d-c7d8-56a8-9cd5-0e8cda2282d2"
+		id = "a44dd9aa-1b70-5914-af4d-a775b0e02cfd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_105"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_105_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "4e03e917de401318ff8b0ae85a40744aaa875bb14cd2721a1a9fd7b49998e501"
+		logic_hash = "v1_sha256_4e03e917de401318ff8b0ae85a40744aaa875bb14cd2721a1a9fd7b49998e501"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143336,20 +143406,20 @@ rule MALPEDIA_Win_Unidentified_105_Auto : FILE
 		$sequence_9 = { 56 8d95f8efffff 52 8d041f 50 e8???????? 8b85f4efffff }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Heloag_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b40ebeb0-65d9-5544-943f-e43dc7de3667"
+		id = "ecc57929-11a6-500d-95dc-b2f7a7e93cde"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heloag"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.heloag_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "3cbec035b3658dcc2108c96dd5a7b448e19c5bb5b801b5096a103c1055c563fa"
+		logic_hash = "v1_sha256_3cbec035b3658dcc2108c96dd5a7b448e19c5bb5b801b5096a103c1055c563fa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143381,20 +143451,20 @@ rule MALPEDIA_Win_Heloag_Auto : FILE
 		$sequence_15 = { 3bcd 8b07 89442410 7464 }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize < 401408
 }
 rule MALPEDIA_Win_Govrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff29bbeb-8470-59b6-8c8d-ff2db3e011bb"
+		id = "c8d64311-791e-5c61-a29c-1121b35e5733"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.govrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.govrat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c76f210fc8b3b328515ee8d578bc776ba7dc3be5b77e3088a18f7d949286c3a2"
+		logic_hash = "v1_sha256_c76f210fc8b3b328515ee8d578bc776ba7dc3be5b77e3088a18f7d949286c3a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143420,20 +143490,20 @@ rule MALPEDIA_Win_Govrat_Auto : FILE
 		$sequence_9 = { 0345f8 8b4d14 8904b1 46 3b7510 72e4 5e }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize < 761856
 }
 rule MALPEDIA_Win_Gpcode_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e33e0b1f-76e7-5d87-9046-4de404cd3f75"
+		id = "cdadfd29-c5dc-5a82-a1eb-75e3eb83c669"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gpcode"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gpcode_auto.yar#L1-L198"
 		license_url = "N/A"
-		logic_hash = "8f09c23237c11f87162aa59c119a2d6f06242220cf4c97226be012f001eb9b62"
+		logic_hash = "v1_sha256_8f09c23237c11f87162aa59c119a2d6f06242220cf4c97226be012f001eb9b62"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143469,20 +143539,20 @@ rule MALPEDIA_Win_Gpcode_Auto : FILE
 		$sequence_19 = { 0144240c 85f6 7fdd 33c0 }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize < 761856
 }
 rule MALPEDIA_Win_Ketrican_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "439971d8-746c-55ae-9bfc-c8ec84b9bdc0"
+		id = "9cf7bcc1-4d94-5d56-ac68-712675cf3be7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ketrican"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ketrican_auto.yar#L1-L232"
 		license_url = "N/A"
-		logic_hash = "bd65d425e881a2f25fb5439fad465d4c0696f8064b1ba4643c58eae4b61b8ee6"
+		logic_hash = "v1_sha256_bd65d425e881a2f25fb5439fad465d4c0696f8064b1ba4643c58eae4b61b8ee6"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -143521,20 +143591,20 @@ rule MALPEDIA_Win_Ketrican_Auto : FILE
 		$sequence_22 = { e9???????? 8b4508 e9???????? 8b45ec }
 
 	condition:
-		7 of them and filesize <1449984
+		7 of them and filesize < 1449984
 }
 rule MALPEDIA_Win_Rtpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "959dc55e-8b27-5e8d-9c83-fdb4eeace02c"
+		id = "e21c5de7-106d-5f97-9004-21ddae8d8545"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rtpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rtpos_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "e4e59ac435d46c5a64df569379669b4dd97e2cfaff34fac6f768e0380b69204e"
+		logic_hash = "v1_sha256_e4e59ac435d46c5a64df569379669b4dd97e2cfaff34fac6f768e0380b69204e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143560,20 +143630,20 @@ rule MALPEDIA_Win_Rtpos_Auto : FILE
 		$sequence_9 = { c745a000000000 e9???????? 8b4508 83c001 894508 8b4d0c }
 
 	condition:
-		7 of them and filesize <507904
+		7 of them and filesize < 507904
 }
 rule MALPEDIA_Win_Poscardstealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5940fce6-5171-52a7-adbd-1bfc9feaf26a"
+		id = "e5c45d24-0f74-5252-a2b0-35be003a378c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poscardstealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.poscardstealer_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "45ecc712be3203f41628cc2ab4db40cb265e98700000888fd4a766a5ab62d728"
+		logic_hash = "v1_sha256_45ecc712be3203f41628cc2ab4db40cb265e98700000888fd4a766a5ab62d728"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143599,20 +143669,20 @@ rule MALPEDIA_Win_Poscardstealer_Auto : FILE
 		$sequence_9 = { e8???????? 6a01 53 68???????? 8d4d9c c645fc03 e8???????? }
 
 	condition:
-		7 of them and filesize <362496
+		7 of them and filesize < 362496
 }
 rule MALPEDIA_Win_Grok_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ccf14bb2-6a3c-5675-9d8f-13b9833157ee"
+		id = "e2c8d541-a019-50ec-a800-1ff880518519"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grok"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.grok_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "2243923e42742fbe3a7e4306a1c12f85ff68d294ee642e4a1bb4afaaacaacbf5"
+		logic_hash = "v1_sha256_2243923e42742fbe3a7e4306a1c12f85ff68d294ee642e4a1bb4afaaacaacbf5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143638,20 +143708,20 @@ rule MALPEDIA_Win_Grok_Auto : FILE
 		$sequence_9 = { 53 ff30 ffd6 893d???????? 33c0 5e 5f }
 
 	condition:
-		7 of them and filesize <84992
+		7 of them and filesize < 84992
 }
 rule MALPEDIA_Win_Abaddon_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "be050b96-89fd-5c20-8efb-0926890fbf17"
+		id = "e9d0ac3f-dfc3-52d8-a5ad-4b87cffdd770"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.abaddon_pos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.abaddon_pos_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "1a83ebbcd5f12576760f9d6a9d7b6611b9e3fe508d3c27448de58b24db2266af"
+		logic_hash = "v1_sha256_1a83ebbcd5f12576760f9d6a9d7b6611b9e3fe508d3c27448de58b24db2266af"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143682,20 +143752,20 @@ rule MALPEDIA_Win_Abaddon_Pos_Auto : FILE
 		$sequence_14 = { 750d c6013d c786b401000002000000 eb13 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Cutwail_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "74edd1da-0a31-5dc7-9e3f-137bbcc67ffb"
+		id = "a42628b8-e458-512c-b6e7-981f4808dc5c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cutwail"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cutwail_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "19ab3f1dd76c95a9fd39a987b454b861d51946958edf6894a04ce0a4e884e4fd"
+		logic_hash = "v1_sha256_19ab3f1dd76c95a9fd39a987b454b861d51946958edf6894a04ce0a4e884e4fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143727,20 +143797,20 @@ rule MALPEDIA_Win_Cutwail_Auto : FILE
 		$sequence_15 = { 03fb 8b5df0 83c40c ff4df4 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Smarteyes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8c7fb874-a11f-5f55-9cef-395ee0219165"
+		id = "261d0ff2-5fd3-56b3-b8c3-b6289d7482a1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smarteyes"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.smarteyes_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "c5287c273b80d8410483f16228152973a803d8ac51015792b4ca7695eb66f818"
+		logic_hash = "v1_sha256_c5287c273b80d8410483f16228152973a803d8ac51015792b4ca7695eb66f818"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143766,20 +143836,20 @@ rule MALPEDIA_Win_Smarteyes_Auto : FILE
 		$sequence_9 = { c6041800 8b45f0 eb02 33c0 5e c9 c3 }
 
 	condition:
-		7 of them and filesize <429056
+		7 of them and filesize < 429056
 }
 rule MALPEDIA_Win_Ruckguv_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8f499e75-91f2-52c8-a94a-c83686f92c36"
+		id = "1fba5b85-f3ec-537a-b32d-511ee0f4b217"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ruckguv"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ruckguv_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "6d10b38eb1f1d62aeb4e76b727620952b9c0cf6c443b89f37ac94de3a6d9e6ee"
+		logic_hash = "v1_sha256_6d10b38eb1f1d62aeb4e76b727620952b9c0cf6c443b89f37ac94de3a6d9e6ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143805,20 +143875,20 @@ rule MALPEDIA_Win_Ruckguv_Auto : FILE
 		$sequence_9 = { 53 33d2 56 57 8855ff 8855fe 889100010000 }
 
 	condition:
-		7 of them and filesize <41024
+		7 of them and filesize < 41024
 }
 rule MALPEDIA_Win_Hacksfase_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e8964081-a2ab-5f17-84d6-f60be8a25bb6"
+		id = "1e9d7c59-4c96-5cdc-a517-691673a18d8e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hacksfase"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hacksfase_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "e471c3c94524d0ea367845eb4bddab6e1e071bddbe6451c868738ead26f24319"
+		logic_hash = "v1_sha256_e471c3c94524d0ea367845eb4bddab6e1e071bddbe6451c868738ead26f24319"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143844,20 +143914,20 @@ rule MALPEDIA_Win_Hacksfase_Auto : FILE
 		$sequence_9 = { 5e 5b 5d c20c00 ff25???????? ff25???????? 56 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Stegoloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9b5ddd81-f495-5df3-b903-3b034270cab3"
+		id = "edd62bdb-6f36-59e2-b96d-c1f4c3014611"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stegoloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stegoloader_auto.yar#L1-L175"
 		license_url = "N/A"
-		logic_hash = "94caf24cac0989b6c0d5f1d1f91d703a3bc60fcd01d5e92e33c9c96d7f83e047"
+		logic_hash = "v1_sha256_94caf24cac0989b6c0d5f1d1f91d703a3bc60fcd01d5e92e33c9c96d7f83e047"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143889,20 +143959,20 @@ rule MALPEDIA_Win_Stegoloader_Auto : FILE
 		$sequence_15 = { 72ef 8b06 8d4df8 51 8bce }
 
 	condition:
-		7 of them and filesize <802816
+		7 of them and filesize < 802816
 }
 rule MALPEDIA_Win_Kapeka_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e9faddcc-105b-5a04-b8c8-ec1325abdf07"
+		id = "26967ccd-492c-5358-bf19-4b808875cc6a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kapeka"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kapeka_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "f9f8a4abde4cdfc67b53dadf6bbb3bb8155ff6c1c3c5e817a852cd16859c5b00"
+		logic_hash = "v1_sha256_f9f8a4abde4cdfc67b53dadf6bbb3bb8155ff6c1c3c5e817a852cd16859c5b00"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143928,20 +143998,20 @@ rule MALPEDIA_Win_Kapeka_Auto : FILE
 		$sequence_9 = { 41b802000000 488d95b0010000 488d8d00010000 e8???????? 488d8d28010000 e8???????? 488d0dc0650100 }
 
 	condition:
-		7 of them and filesize <377856
+		7 of them and filesize < 377856
 }
 rule MALPEDIA_Win_Crutch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "36959a18-dba5-5b13-9b8a-5318a7ab018e"
+		id = "1b9bebca-6dfc-5346-9493-3e6ae8046e1d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crutch"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crutch_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "6e39432bedc9454e05a5557719c4ba13f7f6afdacb986523a0105dea7f4efdfa"
+		logic_hash = "v1_sha256_6e39432bedc9454e05a5557719c4ba13f7f6afdacb986523a0105dea7f4efdfa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143967,20 +144037,20 @@ rule MALPEDIA_Win_Crutch_Auto : FILE
 		$sequence_9 = { 5d c3 6a6c b8???????? e8???????? 8bf9 83ec18 }
 
 	condition:
-		7 of them and filesize <1067008
+		7 of them and filesize < 1067008
 }
 rule MALPEDIA_Win_Valley_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5dc86c73-fc1a-55cb-84b1-f3d8a7354032"
+		id = "4f9089f3-7fb8-57c7-873e-14ab00bc2dae"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.valley_rat_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "cd2ba628443a3060bd3912a9438622a07d0947ed73efff5cb92a491d2061eff0"
+		logic_hash = "v1_sha256_cd2ba628443a3060bd3912a9438622a07d0947ed73efff5cb92a491d2061eff0"
 		score = 60
 		quality = 45
 		tags = "FILE"
@@ -144006,20 +144076,20 @@ rule MALPEDIA_Win_Valley_Rat_Auto : FILE
 		$sequence_9 = { 8d45e4 bb03000000 50 8d4dc4 e8???????? 50 8d45d4 }
 
 	condition:
-		7 of them and filesize <2256896
+		7 of them and filesize < 2256896
 }
 rule MALPEDIA_Win_Mount_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ef861fc-00f6-570d-889b-9134868ef5a0"
+		id = "fecac4c2-aa8f-5e2e-8d6a-99ee4592b1ca"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mount_locker_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "7b77b6c0c433631050c62ceb54745fc365be8fc933570e0c4c919105bbc01b03"
+		logic_hash = "v1_sha256_7b77b6c0c433631050c62ceb54745fc365be8fc933570e0c4c919105bbc01b03"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144051,20 +144121,20 @@ rule MALPEDIA_Win_Mount_Locker_Auto : FILE
 		$sequence_15 = { 68???????? 6a01 e8???????? 83c40c 5e c3 56 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Quickmute_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9346c7aa-034b-5306-98dc-f15f081cecb5"
+		id = "dab191d5-511b-5e96-ae69-220a734293ba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quickmute"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.quickmute_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "d5f635b1bfde0d275999edc49a14531f110db04930e1d0cd71d09b7e6594ac87"
+		logic_hash = "v1_sha256_d5f635b1bfde0d275999edc49a14531f110db04930e1d0cd71d09b7e6594ac87"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144090,20 +144160,20 @@ rule MALPEDIA_Win_Quickmute_Auto : FILE
 		$sequence_9 = { c78542ffffff63746f72 66c78546ffffff7957 c68548ffffff00 750f }
 
 	condition:
-		7 of them and filesize <146432
+		7 of them and filesize < 146432
 }
 rule MALPEDIA_Win_Rerdom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fe806d9a-6a04-5e79-b88b-ee8b8a204978"
+		id = "2aebdde9-806d-55ff-91ea-ec1c0569ba09"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rerdom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rerdom_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "a2ea86fac59908c343fcb877dddd42001d84b6d42ea05066c82f8a9e14242c06"
+		logic_hash = "v1_sha256_a2ea86fac59908c343fcb877dddd42001d84b6d42ea05066c82f8a9e14242c06"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144129,20 +144199,20 @@ rule MALPEDIA_Win_Rerdom_Auto : FILE
 		$sequence_9 = { ffd7 53 ffd6 8325????????00 ff74241c ffd7 ff74241c }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize < 352256
 }
 rule MALPEDIA_Win_Socelars_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "392a881e-8204-5538-905a-79f8339a81a4"
+		id = "61ef1ab7-42e0-54a5-986c-e1311bd1cf35"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socelars"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.socelars_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "b8094e8a90fbd4b228aeee4fe07a815ac53358ef07b587d100a6e2f0f5e01dbf"
+		logic_hash = "v1_sha256_b8094e8a90fbd4b228aeee4fe07a815ac53358ef07b587d100a6e2f0f5e01dbf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144168,20 +144238,20 @@ rule MALPEDIA_Win_Socelars_Auto : FILE
 		$sequence_9 = { 8bcb e8???????? 8bf0 83fe11 0f85cf000000 8b7c241c e9???????? }
 
 	condition:
-		7 of them and filesize <2151424
+		7 of them and filesize < 2151424
 }
 rule MALPEDIA_Win_Rokku_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "715ad7bc-d28a-5156-87eb-1255d9ce2084"
+		id = "e1d7627b-21f1-5681-bc91-eb95fd36d705"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rokku"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rokku_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "1d23d8f4257081bb086c98f92ac75f2d433e54c9fb6c0c1b7b21d511b54ccc0a"
+		logic_hash = "v1_sha256_1d23d8f4257081bb086c98f92ac75f2d433e54c9fb6c0c1b7b21d511b54ccc0a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144207,20 +144277,20 @@ rule MALPEDIA_Win_Rokku_Auto : FILE
 		$sequence_9 = { e8???????? b935010000 b8???????? 03c1 51 50 e8???????? }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize < 548864
 }
 rule MALPEDIA_Win_Feodo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8c5efd3c-e45d-5795-9ce3-096920bca9de"
+		id = "f3900884-3f77-518e-915a-c925e3e96973"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.feodo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.feodo_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "4783bf3b64d586d0a2a41312eeb5a0cc464046d24e2955ae05259fe1fa6e0781"
+		logic_hash = "v1_sha256_4783bf3b64d586d0a2a41312eeb5a0cc464046d24e2955ae05259fe1fa6e0781"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144252,20 +144322,20 @@ rule MALPEDIA_Win_Feodo_Auto : FILE
 		$sequence_15 = { 2ee83e207468 60 238b0d03c783 782e 1463 ab }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize < 270336
 }
 rule MALPEDIA_Win_Bit_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e331727c-f0b9-570e-98b3-15c7435a6eef"
+		id = "b535955c-2a89-5b34-85bb-29d3699c1d05"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bit_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bit_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7643b584b9c6d670261c45703563f4fa44b2a6b3543e3f79d5e148454f73feea"
+		logic_hash = "v1_sha256_7643b584b9c6d670261c45703563f4fa44b2a6b3543e3f79d5e148454f73feea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144291,20 +144361,20 @@ rule MALPEDIA_Win_Bit_Rat_Auto : FILE
 		$sequence_9 = { 8bd7 8d4201 8945f0 8a02 42 84c0 75f9 }
 
 	condition:
-		7 of them and filesize <19405824
+		7 of them and filesize < 19405824
 }
 rule MALPEDIA_Win_Jimmy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e00c47ff-70b5-5db3-a3df-5549a310a9aa"
+		id = "bd14235f-798c-5d53-99b5-1c55d04a484e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jimmy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jimmy_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "1b3730a9d32503c4a70a6daa21a4c8b83fd1ef93162a202906ad5585e6f013b5"
+		logic_hash = "v1_sha256_1b3730a9d32503c4a70a6daa21a4c8b83fd1ef93162a202906ad5585e6f013b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144330,20 +144400,20 @@ rule MALPEDIA_Win_Jimmy_Auto : FILE
 		$sequence_9 = { 7406 837df400 7507 32c0 e9???????? 8b45f0 05f8000000 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Skipper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "64a2fa4c-6691-570a-b99c-c64694f81fbb"
+		id = "58d022f3-1c49-5dc5-b6d4-58497d9610d6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skipper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.skipper_auto.yar#L1-L436"
 		license_url = "N/A"
-		logic_hash = "a0d077545acb481645aa7b1b148ae369d0e9c4615de07cc8af0856e7c8c6f15a"
+		logic_hash = "v1_sha256_a0d077545acb481645aa7b1b148ae369d0e9c4615de07cc8af0856e7c8c6f15a"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -144405,20 +144475,20 @@ rule MALPEDIA_Win_Skipper_Auto : FILE
 		$sequence_45 = { 8b5c2444 e9???????? 488d05dfa90000 4a8b0ce8 41f6440c0880 0f84cb020000 33db }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Lightlesscan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2e37f7e0-e58a-5e11-9705-46b3e404ff4c"
+		id = "e72cc578-4cf0-5743-aec3-e162c728f671"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightlesscan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lightlesscan_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "065574078c0aa4243fb06e1821f47ea5dd0c55644c6efc29c5c042e930dc4c7f"
+		logic_hash = "v1_sha256_065574078c0aa4243fb06e1821f47ea5dd0c55644c6efc29c5c042e930dc4c7f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144444,20 +144514,20 @@ rule MALPEDIA_Win_Lightlesscan_Auto : FILE
 		$sequence_9 = { 488b4c2468 488b01 ff5010 e9???????? 488b4c2458 488b01 4533c0 }
 
 	condition:
-		7 of them and filesize <1399808
+		7 of them and filesize < 1399808
 }
 rule MALPEDIA_Win_Webc2_Greencat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a0848a27-48e1-5e07-b0d1-bb056774f373"
+		id = "feaa9948-79d0-5b16-9375-f1d650f0f672"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_greencat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_greencat_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "b537e733fea445e18ae7f3686bce35348807c75f49bc5b86c1bc51245964fe49"
+		logic_hash = "v1_sha256_b537e733fea445e18ae7f3686bce35348807c75f49bc5b86c1bc51245964fe49"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144483,20 +144553,20 @@ rule MALPEDIA_Win_Webc2_Greencat_Auto : FILE
 		$sequence_9 = { 50 ff15???????? 3bc7 59 7405 a3???????? 8a45ff }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Dexter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5d3d372c-0686-511d-bba6-815685b0b441"
+		id = "cbc66d7e-ebe0-5776-a4f9-abc86323f52b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dexter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dexter_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "537f3a05b932c01193b62b9eef1199d3fcfbbcfba0cd35a2f7ef69253c025c83"
+		logic_hash = "v1_sha256_537f3a05b932c01193b62b9eef1199d3fcfbbcfba0cd35a2f7ef69253c025c83"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144522,20 +144592,20 @@ rule MALPEDIA_Win_Dexter_Auto : FILE
 		$sequence_9 = { a3???????? 833d????????00 0f85bc000000 e8???????? a3???????? 6808020000 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Sakula_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86323bfd-db14-578a-8cfe-f67cc00a757a"
+		id = "59979515-1a9f-52f0-8da9-b4de88e626e3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sakula_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sakula_rat_auto.yar#L1-L230"
 		license_url = "N/A"
-		logic_hash = "19fb36915bb248bef0dadfadf28e10045720b8ee2d6f5e400ec2d27910f47a25"
+		logic_hash = "v1_sha256_19fb36915bb248bef0dadfadf28e10045720b8ee2d6f5e400ec2d27910f47a25"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -144574,20 +144644,20 @@ rule MALPEDIA_Win_Sakula_Rat_Auto : FILE
 		$sequence_22 = { 83fa00 7404 49 4a ebeb }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_Ddkong_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b5952305-5353-5501-a1a7-08eb6dbe1f60"
+		id = "169b4d19-19b7-54e7-a53f-b96512ffd7c6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkong"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ddkong_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "63fd2294d146377f9037ca4f08ce95fd06d019686efc226016c406199e6b874d"
+		logic_hash = "v1_sha256_63fd2294d146377f9037ca4f08ce95fd06d019686efc226016c406199e6b874d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144613,20 +144683,20 @@ rule MALPEDIA_Win_Ddkong_Auto : FILE
 		$sequence_9 = { 72f6 ff7604 57 ff742418 e8???????? 83c40c 395e1c }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Finfisher_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b4569af7-ca7f-5273-a891-62c4b9307c04"
+		id = "41870e8b-b9d9-557f-a025-cbc9b5680242"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.finfisher_auto.yar#L1-L148"
 		license_url = "N/A"
-		logic_hash = "d86e06755c4d193ae8f6772e0ecac909342d4c797dca10b9ca38c301b921ec55"
+		logic_hash = "v1_sha256_d86e06755c4d193ae8f6772e0ecac909342d4c797dca10b9ca38c301b921ec55"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144656,20 +144726,20 @@ rule MALPEDIA_Win_Finfisher_Auto : FILE
 		$sequence_13 = { 50 e8???????? 83c41c c745fc04000000 6850020000 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Zeroaccess_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89374e4f-79aa-58be-a3f5-45921879c769"
+		id = "b2608ab9-d28e-5303-b318-2037ed3e7455"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeroaccess"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zeroaccess_auto.yar#L1-L147"
 		license_url = "N/A"
-		logic_hash = "b8098d3dcd80de1c46676c7e1dd2cdf56db87599f68b360b87ffc70001011948"
+		logic_hash = "v1_sha256_b8098d3dcd80de1c46676c7e1dd2cdf56db87599f68b360b87ffc70001011948"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144699,20 +144769,20 @@ rule MALPEDIA_Win_Zeroaccess_Auto : FILE
 		$sequence_13 = { 3b05???????? 7316 48 8d0d56560000 48 8bd3 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize < 172032
 }
 rule MALPEDIA_Win_Kimjongrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6fc69770-2665-5839-9d6a-97fd73d156df"
+		id = "3ce6af32-8a39-5c51-b3ad-dc1084c1959e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kimjongrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kimjongrat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "edaec54e18eb1d3289f1a7f5442afe5f1403cb37fea612fda6550402130dfa44"
+		logic_hash = "v1_sha256_edaec54e18eb1d3289f1a7f5442afe5f1403cb37fea612fda6550402130dfa44"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144738,20 +144808,20 @@ rule MALPEDIA_Win_Kimjongrat_Auto : FILE
 		$sequence_9 = { e8???????? 668b4608 663345c4 b9007e0000 6623c1 83c40c 663145c4 }
 
 	condition:
-		7 of them and filesize <1572864
+		7 of them and filesize < 1572864
 }
 rule MALPEDIA_Win_Powerloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8055861-0eb8-5c59-854d-6c838621a56f"
+		id = "c56ab2fd-5c88-5ca9-938e-4d6cb3f80507"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.powerloader_auto.yar#L1-L106"
 		license_url = "N/A"
-		logic_hash = "49acbf4818653ec3c37c64918d36c8fbd597bf611facefb0fe7af9324dfdd104"
+		logic_hash = "v1_sha256_49acbf4818653ec3c37c64918d36c8fbd597bf611facefb0fe7af9324dfdd104"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144777,20 +144847,20 @@ rule MALPEDIA_Win_Powerloader_Auto : FILE
 		$sequence_9 = { 33d2 c605????????00 e8???????? 0fb6c3 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Lightwork_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5b31d092-dcc8-5a1c-ab90-287cfb331c0c"
+		id = "f8b11044-331f-5ccb-b67b-c35c0a949e59"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightwork"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lightwork_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "27c40b18d2800b0d83c68dd39a56494e6158b954f55a7dafaeb8933b3fe805f1"
+		logic_hash = "v1_sha256_27c40b18d2800b0d83c68dd39a56494e6158b954f55a7dafaeb8933b3fe805f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144816,20 +144886,20 @@ rule MALPEDIA_Win_Lightwork_Auto : FILE
 		$sequence_9 = { 8065fffc 8b450c 0045ff 8b4508 0fb655ff 8810 }
 
 	condition:
-		7 of them and filesize <1132544
+		7 of them and filesize < 1132544
 }
 rule MALPEDIA_Win_Compfun_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3d58a754-0068-5ddf-8df3-41773f9f7343"
+		id = "db36b487-02a3-5045-8add-828f0c56c24b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.compfun"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.compfun_auto.yar#L1-L155"
 		license_url = "N/A"
-		logic_hash = "f91830d32accaa1a970b31fd97ff26cbec286fc3877ecca166a49e3ceef0861e"
+		logic_hash = "v1_sha256_f91830d32accaa1a970b31fd97ff26cbec286fc3877ecca166a49e3ceef0861e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144861,20 +144931,20 @@ rule MALPEDIA_Win_Compfun_Auto : FILE
 		$sequence_15 = { 034c242c 488b442470 894820 488d542440 }
 
 	condition:
-		7 of them and filesize <402432
+		7 of them and filesize < 402432
 }
 rule MALPEDIA_Win_Byeby_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9611b4e7-8337-551b-9691-e65f61744e7f"
+		id = "08d46b36-e57a-5f89-8828-8645c52a6729"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.byeby"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.byeby_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "50a28d5ba51c4cf2da918fb2e13d81e48eb5727c5e9589337c757040c753f599"
+		logic_hash = "v1_sha256_50a28d5ba51c4cf2da918fb2e13d81e48eb5727c5e9589337c757040c753f599"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144900,20 +144970,20 @@ rule MALPEDIA_Win_Byeby_Auto : FILE
 		$sequence_9 = { 57 ff15???????? 85c0 0f84f6010000 8b542418 03542414 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Aveo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2f9547a9-d06a-5a97-a838-f674793ec8c9"
+		id = "6fbffd98-68db-5ae0-9400-852fb7fdc7eb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aveo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.aveo_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "b370a3150ecdba2fa7b9c1b3f8a88674c2ef9b3deea9a9096a8ec474751f8a90"
+		logic_hash = "v1_sha256_b370a3150ecdba2fa7b9c1b3f8a88674c2ef9b3deea9a9096a8ec474751f8a90"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144939,20 +145009,20 @@ rule MALPEDIA_Win_Aveo_Auto : FILE
 		$sequence_9 = { c7430801000000 e8???????? 6a06 89430c 8d4310 8d89d41a4100 5a }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Satan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "30dbe56c-8c73-5146-b780-34e6bf716dbf"
+		id = "ccb3da2e-5da5-5317-9db2-f14a3ea21275"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.satan_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "684fd8d03725a857adc2201582faa570633fcd21041d464e35a18c1f078d9ea5"
+		logic_hash = "v1_sha256_684fd8d03725a857adc2201582faa570633fcd21041d464e35a18c1f078d9ea5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144978,20 +145048,20 @@ rule MALPEDIA_Win_Satan_Auto : FILE
 		$sequence_9 = { e8???????? 8d45b8 c745fc10000000 50 8d45e4 b9???????? 50 }
 
 	condition:
-		7 of them and filesize <1163264
+		7 of them and filesize < 1163264
 }
 rule MALPEDIA_Win_Cohhoc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "79f1d359-2e68-5ef2-92e4-7c353f021a83"
+		id = "c1527ca5-07f2-523d-aade-6ae246f7aa30"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cohhoc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cohhoc_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "408be9b45dccb2589014666e6c29650297e9a497c2f3518d6cebc0080adee530"
+		logic_hash = "v1_sha256_408be9b45dccb2589014666e6c29650297e9a497c2f3518d6cebc0080adee530"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145017,20 +145087,20 @@ rule MALPEDIA_Win_Cohhoc_Auto : FILE
 		$sequence_9 = { 33c0 eb05 1bc0 83d8ff 85c0 0f84ba000000 8b4308 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Screencap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c09ded30-7ed9-5627-bd4b-b5b9719d1b79"
+		id = "f1642ae8-7b12-500c-adaa-5f5c91028963"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.screencap"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.screencap_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "fe7ef238cffaf8f0702b709313aa3e525535b37ee9076ff1908a7fc171fcfe6f"
+		logic_hash = "v1_sha256_fe7ef238cffaf8f0702b709313aa3e525535b37ee9076ff1908a7fc171fcfe6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145056,20 +145126,20 @@ rule MALPEDIA_Win_Screencap_Auto : FILE
 		$sequence_9 = { 50 8b442438 4850 e8???????? 50 }
 
 	condition:
-		7 of them and filesize <1391616
+		7 of them and filesize < 1391616
 }
 rule MALPEDIA_Win_Jinxloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cb454fe4-e9ad-5069-aba0-8fdb369e6db4"
+		id = "31c5f8da-e0ad-55d5-b95a-76f6e5c745dd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jinxloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jinxloader_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c58b02af334fd67d7a0c2822fadcfa6594a39ce2fb1e10101df77761efab8668"
+		logic_hash = "v1_sha256_c58b02af334fd67d7a0c2822fadcfa6594a39ce2fb1e10101df77761efab8668"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145095,20 +145165,20 @@ rule MALPEDIA_Win_Jinxloader_Auto : FILE
 		$sequence_9 = { e8???????? 4883c418 5d c3 4889442428 488d0582005500 6690 }
 
 	condition:
-		7 of them and filesize <20364288
+		7 of them and filesize < 20364288
 }
 rule MALPEDIA_Win_Hellokitty_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "85d82fef-e1ef-5538-a8ca-f2e16ab22789"
+		id = "fedc7078-2c8e-55ce-95ca-2e66efb7c17e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hellokitty"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hellokitty_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "fc4ce366fe91b18117b1ec99ae5affdf6560b9a7558856d80c31c8511e65fec9"
+		logic_hash = "v1_sha256_fc4ce366fe91b18117b1ec99ae5affdf6560b9a7558856d80c31c8511e65fec9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145134,20 +145204,20 @@ rule MALPEDIA_Win_Hellokitty_Auto : FILE
 		$sequence_9 = { 33d2 6689544802 eb11 6a28 c645fc00 ff75fc }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize < 319488
 }
 rule MALPEDIA_Win_Ransomlock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "42563703-564f-5a14-8829-64d9a4cd308b"
+		id = "57e171f4-474e-5661-9cce-ab4c4df2d602"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomlock"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ransomlock_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "9226a9c11140386a0aeef708faad6314d93055d8b25dc4f728e9575057eabf60"
+		logic_hash = "v1_sha256_9226a9c11140386a0aeef708faad6314d93055d8b25dc4f728e9575057eabf60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145173,20 +145243,20 @@ rule MALPEDIA_Win_Ransomlock_Auto : FILE
 		$sequence_9 = { 5d c22400 b801000000 5d c22400 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Cova_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fa07deb6-c177-5206-9d19-f63251440ec2"
+		id = "2a8e7311-5979-5810-a13b-1bfb80679853"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cova"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cova_auto.yar#L1-L110"
 		license_url = "N/A"
-		logic_hash = "d5e67f28620dc0f740b402e9f8384fb0d05494020e9e1fdf2531ffdb1df92592"
+		logic_hash = "v1_sha256_d5e67f28620dc0f740b402e9f8384fb0d05494020e9e1fdf2531ffdb1df92592"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145212,20 +145282,20 @@ rule MALPEDIA_Win_Cova_Auto : FILE
 		$sequence_9 = { 8b0a 4803cf 33c0 eb0c }
 
 	condition:
-		7 of them and filesize <123904
+		7 of them and filesize < 123904
 }
 rule MALPEDIA_Win_Malumpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8c530445-714c-5545-b19e-0b83bc49baf4"
+		id = "a9a28d86-a2d6-5de6-9fbf-b075d5308600"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.malumpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.malumpos_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "3114be15227a95c744ccca089995ccddd28287774a7cad476fe879d040c5b1ad"
+		logic_hash = "v1_sha256_3114be15227a95c744ccca089995ccddd28287774a7cad476fe879d040c5b1ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145251,20 +145321,20 @@ rule MALPEDIA_Win_Malumpos_Auto : FILE
 		$sequence_9 = { 66a94a47 83c000 56 7e04 57 85c9 }
 
 	condition:
-		7 of them and filesize <542720
+		7 of them and filesize < 542720
 }
 rule MALPEDIA_Win_Whiteblackcrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "39243d42-8305-573c-a47b-e4b6dd139aef"
+		id = "fb0579e7-9a13-5207-9c7e-f92f2618d7b6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whiteblackcrypt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.whiteblackcrypt_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "660907780e4078f0416bec5591629e01f78308bd70eb5a7d32026bca72fd8322"
+		logic_hash = "v1_sha256_660907780e4078f0416bec5591629e01f78308bd70eb5a7d32026bca72fd8322"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145290,20 +145360,20 @@ rule MALPEDIA_Win_Whiteblackcrypt_Auto : FILE
 		$sequence_9 = { 410f94c2 4409d0 4109cb 753a 84c0 }
 
 	condition:
-		7 of them and filesize <99328
+		7 of them and filesize < 99328
 }
 rule MALPEDIA_Win_Spybot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a4cba476-a2c7-50aa-a7bf-4af17da5b6df"
+		id = "835dee45-86f6-55eb-9b9e-358257903ce8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spybot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spybot_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "d537b785313261fc15df85466bf871fb981ce27e93c3d7cf670a5bb54b105b2b"
+		logic_hash = "v1_sha256_d537b785313261fc15df85466bf871fb981ce27e93c3d7cf670a5bb54b105b2b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145329,20 +145399,20 @@ rule MALPEDIA_Win_Spybot_Auto : FILE
 		$sequence_9 = { ff742414 56 ff742418 ff742418 e8???????? 83c414 56 }
 
 	condition:
-		7 of them and filesize <2367488
+		7 of them and filesize < 2367488
 }
 rule MALPEDIA_Win_Tinytyphon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5b03e241-fb6f-559b-bde6-deb493402fa5"
+		id = "e5a63871-4352-5eed-b5ad-44bcc3178f2e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinytyphon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tinytyphon_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "f9788ed24c5ff9be6cbd5ec91e29693ea290ace26342cc375a5a9e76cbe49f63"
+		logic_hash = "v1_sha256_f9788ed24c5ff9be6cbd5ec91e29693ea290ace26342cc375a5a9e76cbe49f63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145368,20 +145438,20 @@ rule MALPEDIA_Win_Tinytyphon_Auto : FILE
 		$sequence_9 = { 8b4de4 c1e116 8b55e4 c1ea0a 0bca 894de4 8b45e4 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Stresspaint_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c5fe12e-e2db-536e-9708-f093f3acd070"
+		id = "b80d62fa-861d-550f-8ac5-b0ccce676422"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stresspaint"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stresspaint_auto.yar#L1-L157"
 		license_url = "N/A"
-		logic_hash = "d6c444a9c27d97e7ed3d7b7007c87aa66e22a92b316794a07d87a908d3a44119"
+		logic_hash = "v1_sha256_d6c444a9c27d97e7ed3d7b7007c87aa66e22a92b316794a07d87a908d3a44119"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145413,20 +145483,20 @@ rule MALPEDIA_Win_Stresspaint_Auto : FILE
 		$sequence_15 = { 8d54241c 52 56 ff5718 56 53 }
 
 	condition:
-		7 of them and filesize <1155072
+		7 of them and filesize < 1155072
 }
 rule MALPEDIA_Win_Loup_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2089eb01-8adc-5d71-ab0c-e9de7e386d03"
+		id = "748719a6-4f58-5ced-a02b-b941281d3dba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.loup"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.loup_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "ecdd5b2ea3515331e17a7116f826dcace78b7e88cf24fcea19298195170a6a4f"
+		logic_hash = "v1_sha256_ecdd5b2ea3515331e17a7116f826dcace78b7e88cf24fcea19298195170a6a4f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145452,20 +145522,20 @@ rule MALPEDIA_Win_Loup_Auto : FILE
 		$sequence_9 = { 8915???????? c705????????01000000 a1???????? 83c802 a3???????? b904000000 c1e100 }
 
 	condition:
-		7 of them and filesize <257024
+		7 of them and filesize < 257024
 }
 rule MALPEDIA_Win_Lightrail_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2a74e32-804b-5428-a5eb-18775f1f39d2"
+		id = "6eae4f56-4645-540b-85b8-fea993016166"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightrail"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lightrail_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "ac0b981cc1c6ed97eba28af6c8430a26e5eab1fbb0f4ef4ac4d4556d0f8dc830"
+		logic_hash = "v1_sha256_ac0b981cc1c6ed97eba28af6c8430a26e5eab1fbb0f4ef4ac4d4556d0f8dc830"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145491,20 +145561,20 @@ rule MALPEDIA_Win_Lightrail_Auto : FILE
 		$sequence_9 = { ff9660020000 e9???????? 4883f902 0f85a1feffff }
 
 	condition:
-		7 of them and filesize <249856
+		7 of them and filesize < 249856
 }
 rule MALPEDIA_Win_Heyoka_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f0f9fc3a-3361-5bee-bcdd-e0c602dd58ea"
+		id = "7a1f96f3-2cba-5d8c-b192-0248f550971d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heyoka"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.heyoka_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "175329e4bd3a0dd34afbec31b74492ffb1225426c5eb776fbf2c975880999184"
+		logic_hash = "v1_sha256_175329e4bd3a0dd34afbec31b74492ffb1225426c5eb776fbf2c975880999184"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145530,20 +145600,20 @@ rule MALPEDIA_Win_Heyoka_Auto : FILE
 		$sequence_9 = { 8b4d08 894dfc 8b55fc 83c20c 8955f4 c645e400 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize < 270336
 }
 rule MALPEDIA_Win_Powershellrunner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "46b69b90-7940-5db2-80f3-f8192ab438b0"
+		id = "4fb10186-cca8-5cd5-b0bc-b80fc1a75fd5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powershellrunner"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.powershellrunner_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "b42437163f86140159e67a0a5b01330144313dc98950bc6641d4e09d38867635"
+		logic_hash = "v1_sha256_b42437163f86140159e67a0a5b01330144313dc98950bc6641d4e09d38867635"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145569,20 +145639,20 @@ rule MALPEDIA_Win_Powershellrunner_Auto : FILE
 		$sequence_9 = { 4533c0 488b542458 33c9 ff15???????? 85c0 7529 488b4c2458 }
 
 	condition:
-		7 of them and filesize <458752
+		7 of them and filesize < 458752
 }
 rule MALPEDIA_Win_Op_Blockbuster_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "54037fb5-02e6-50fe-b72a-3b42b6ceaa52"
+		id = "aefd8bd4-a81a-57af-b03f-01b86337074d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.op_blockbuster"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.op_blockbuster_auto.yar#L1-L326"
 		license_url = "N/A"
-		logic_hash = "4209e51c2985f19271abc0c98d2263ec2c893b90a69757edcf9738231e4cef57"
+		logic_hash = "v1_sha256_4209e51c2985f19271abc0c98d2263ec2c893b90a69757edcf9738231e4cef57"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -145632,20 +145702,20 @@ rule MALPEDIA_Win_Op_Blockbuster_Auto : FILE
 		$sequence_33 = { ff5108 6a01 5e ff15???????? 8bc6 5f }
 
 	condition:
-		7 of them and filesize <74309632
+		7 of them and filesize < 74309632
 }
 rule MALPEDIA_Win_Radrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "94a4381e-af30-56d4-9d5d-0552148c1f7c"
+		id = "07d0ca48-f958-5448-a9fd-087738ff2201"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.radrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.radrat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "67ebe4ff9f98e9eca0e16834a563e516c10727efd1f7a1ab36f600d08a7aa26c"
+		logic_hash = "v1_sha256_67ebe4ff9f98e9eca0e16834a563e516c10727efd1f7a1ab36f600d08a7aa26c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145671,20 +145741,20 @@ rule MALPEDIA_Win_Radrat_Auto : FILE
 		$sequence_9 = { 8d8d18d7ffff e8???????? c645fc02 8d8df0d6ffff e8???????? c645fc01 8d8d58ffffff }
 
 	condition:
-		7 of them and filesize <2080768
+		7 of them and filesize < 2080768
 }
 rule MALPEDIA_Win_Flagpro_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "de33fb8c-8ab6-5256-a88a-80e461ec2d83"
+		id = "59c5e63f-2c46-56c4-ac13-4c7a93f21197"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flagpro"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.flagpro_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "654c55cf6ed0a2b532ad215de02e3b03b4d1dd22a33c5bbcc5cdd9807575a5d9"
+		logic_hash = "v1_sha256_654c55cf6ed0a2b532ad215de02e3b03b4d1dd22a33c5bbcc5cdd9807575a5d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145710,20 +145780,20 @@ rule MALPEDIA_Win_Flagpro_Auto : FILE
 		$sequence_9 = { 83c404 51 e8???????? 83ec18 }
 
 	condition:
-		7 of them and filesize <1411072
+		7 of them and filesize < 1411072
 }
 rule MALPEDIA_Win_Babyshark_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bba62dea-b8fb-5177-af59-ee7484609223"
+		id = "03250fe3-bb44-5ef5-a807-0d913166bd45"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babyshark"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.babyshark_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "170a55c792dd841a430b5276e4b7ea8cd0c0e2d28c406b503a22728951bd6c1d"
+		logic_hash = "v1_sha256_170a55c792dd841a430b5276e4b7ea8cd0c0e2d28c406b503a22728951bd6c1d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145749,20 +145819,20 @@ rule MALPEDIA_Win_Babyshark_Auto : FILE
 		$sequence_9 = { ff15???????? 8bf0 68???????? 8d442408 68???????? 50 }
 
 	condition:
-		7 of them and filesize <65272
+		7 of them and filesize < 65272
 }
 rule MALPEDIA_Win_Sierras_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "70c5a6f9-c2e5-57b1-90d8-8b9060fdf637"
+		id = "f3be1ddb-8bda-512e-abbc-a6a663289c1b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sierras"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sierras_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "c05b0e9c28fed253d00c96c986fab4dbaf0e644651c700ec0227f1b00097c981"
+		logic_hash = "v1_sha256_c05b0e9c28fed253d00c96c986fab4dbaf0e644651c700ec0227f1b00097c981"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145794,20 +145864,20 @@ rule MALPEDIA_Win_Sierras_Auto : FILE
 		$sequence_15 = { 837d0803 0f8fb0000000 397d10 897df0 0f86a4000000 8b7d14 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Chrgetpdsi_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "12254ac4-43e6-5705-9880-6efd82324f77"
+		id = "c599ccb6-5fce-5f70-a116-1fc4c32fc404"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chrgetpdsi_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chrgetpdsi_stealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f510ed1d9dd9ee7e68c40131d1a59b2b1ef7a35fe613361e1f3e48c7e065108c"
+		logic_hash = "v1_sha256_f510ed1d9dd9ee7e68c40131d1a59b2b1ef7a35fe613361e1f3e48c7e065108c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145833,20 +145903,20 @@ rule MALPEDIA_Win_Chrgetpdsi_Stealer_Auto : FILE
 		$sequence_9 = { 833d????????00 7509 488905???????? eb0c 488d3dbeda3b00 e8???????? 488b0d???????? }
 
 	condition:
-		7 of them and filesize <10027008
+		7 of them and filesize < 10027008
 }
 rule MALPEDIA_Win_Tonedeaf_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "15deba33-5fb4-592a-90c3-bca364871ec1"
+		id = "a420ead1-113b-58d3-a680-f0c49495d775"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tonedeaf"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tonedeaf_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "7f00488f24cf89d345c0d8aa4f5fd46f86ca2b90c3b462b66a07f10b957268c4"
+		logic_hash = "v1_sha256_7f00488f24cf89d345c0d8aa4f5fd46f86ca2b90c3b462b66a07f10b957268c4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145872,20 +145942,20 @@ rule MALPEDIA_Win_Tonedeaf_Auto : FILE
 		$sequence_9 = { 2bc6 83f801 732f 8b0f 8bc1 2bc6 48 }
 
 	condition:
-		7 of them and filesize <851968
+		7 of them and filesize < 851968
 }
 rule MALPEDIA_Win_Skinnyboy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fad10de8-1dee-57f5-9740-77610ecb50ba"
+		id = "14b998a2-82da-5a12-a683-dd4d889380f1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skinnyboy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.skinnyboy_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "c9afcf0da0b1a37ea370d6affaf9ae89cf13a4478cab0becac117427110aff91"
+		logic_hash = "v1_sha256_c9afcf0da0b1a37ea370d6affaf9ae89cf13a4478cab0becac117427110aff91"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145911,20 +145981,20 @@ rule MALPEDIA_Win_Skinnyboy_Auto : FILE
 		$sequence_9 = { 8d45f4 50 ff7308 ff15???????? 8b15???????? 85c0 }
 
 	condition:
-		7 of them and filesize <176128
+		7 of them and filesize < 176128
 }
 rule MALPEDIA_Win_Session_Manager_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c7a55698-35d0-50fe-9be2-ce1d92ad4335"
+		id = "50066e8e-a4ba-58ae-83e0-70f3c03b0acc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.session_manager"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.session_manager_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "d5175a76f3322d7804a37437b75d91825889aed645aa1d99d4aedae744a409da"
+		logic_hash = "v1_sha256_d5175a76f3322d7804a37437b75d91825889aed645aa1d99d4aedae744a409da"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145950,20 +146020,20 @@ rule MALPEDIA_Win_Session_Manager_Auto : FILE
 		$sequence_9 = { 4c89b8781d0000 4c89b8801d0000 4c89b8881d0000 4c89b8901d0000 4c89b8981d0000 }
 
 	condition:
-		7 of them and filesize <372736
+		7 of them and filesize < 372736
 }
 rule MALPEDIA_Win_Sappycache_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5cde3466-1a40-5c62-84c0-18f8fb0eb5bd"
+		id = "a0d6914c-c9a6-54b7-b11e-d2b5f62527e2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sappycache_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "accd6826861cb14b3264b0a3eac9debd4934e0de6f313d816d6bcd533efab795"
+		logic_hash = "v1_sha256_accd6826861cb14b3264b0a3eac9debd4934e0de6f313d816d6bcd533efab795"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145989,20 +146059,20 @@ rule MALPEDIA_Win_Sappycache_Auto : FILE
 		$sequence_9 = { 488d05133c0100 ffcb 488d0c9b 488d0cc8 ff15???????? ff0d???????? 85db }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_7Ev3N_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2a11178-3257-5261-9f41-b916299315d7"
+		id = "3720d7d9-e38c-5e3d-9522-9f232f468e0e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.7ev3n"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.7ev3n_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "df56762186f095df1883a52e337f3ee36e53ef81834d91aa6fccabc217e84eca"
+		logic_hash = "v1_sha256_df56762186f095df1883a52e337f3ee36e53ef81834d91aa6fccabc217e84eca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146028,20 +146098,20 @@ rule MALPEDIA_Win_7Ev3N_Auto : FILE
 		$sequence_9 = { 83c702 6685c0 75f5 2bf9 d1ff 6a00 8d85d8e1ffff }
 
 	condition:
-		7 of them and filesize <803840
+		7 of them and filesize < 803840
 }
 rule MALPEDIA_Win_Hemigate_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0161e2c6-92a2-598c-bebd-ec068752da7a"
+		id = "59fb8ad5-c980-5464-adf2-7b11e9830547"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hemigate"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hemigate_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "e109cb20ab0eaf9ed1c42d9088faaba592aaa23fc85ca45654d9c255b46038b9"
+		logic_hash = "v1_sha256_e109cb20ab0eaf9ed1c42d9088faaba592aaa23fc85ca45654d9c255b46038b9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146067,20 +146137,20 @@ rule MALPEDIA_Win_Hemigate_Auto : FILE
 		$sequence_9 = { c3 ff75f8 ff15???????? 83c404 5f 5e b80d000000 }
 
 	condition:
-		7 of them and filesize <991232
+		7 of them and filesize < 991232
 }
 rule MALPEDIA_Win_Bitsran_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "704b65b3-af59-52e9-9dfb-e042a4dda0d0"
+		id = "d42773dd-2647-56d1-a3e5-91bfac287d92"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitsran"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bitsran_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "e79bcb054b07fb9e07c55e5ca091a76d8b3025c95f8242bfc1e649f657a93d3b"
+		logic_hash = "v1_sha256_e79bcb054b07fb9e07c55e5ca091a76d8b3025c95f8242bfc1e649f657a93d3b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146106,20 +146176,20 @@ rule MALPEDIA_Win_Bitsran_Auto : FILE
 		$sequence_9 = { 3b7804 0f8daa050000 837e04ff 7409 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize < 344064
 }
 rule MALPEDIA_Win_Abcsync_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d5810457-8b12-50ce-8030-bdbd5a136267"
+		id = "43fbb86c-a69f-5c63-b400-d3924c915363"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.abcsync"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.abcsync_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "02ae937251ee063be53e02e33e98dc9b276f9fd2074f9431e5bc0ede2973fadf"
+		logic_hash = "v1_sha256_02ae937251ee063be53e02e33e98dc9b276f9fd2074f9431e5bc0ede2973fadf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146145,20 +146215,20 @@ rule MALPEDIA_Win_Abcsync_Auto : FILE
 		$sequence_9 = { 8bc2 c1e81f 03d0 6bc232 2bc8 8d411c 410fb64c1afc }
 
 	condition:
-		7 of them and filesize <348160
+		7 of them and filesize < 348160
 }
 rule MALPEDIA_Win_Ismdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "83a6746f-b3b5-5b57-a445-904bcf5ea3d8"
+		id = "4036ec6b-f5fe-529f-b9b7-d616bb567975"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ismdoor_auto.yar#L1-L152"
 		license_url = "N/A"
-		logic_hash = "b2a8beb2bbf9a7e436997cbc54636f7d3af94cae5a6618f143e6a6f5f28950e2"
+		logic_hash = "v1_sha256_b2a8beb2bbf9a7e436997cbc54636f7d3af94cae5a6618f143e6a6f5f28950e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146189,20 +146259,20 @@ rule MALPEDIA_Win_Ismdoor_Auto : FILE
 		$sequence_14 = { c785a8feffff00000000 c68598feffff00 83bd3cffffff10 720e ffb528ffffff e8???????? }
 
 	condition:
-		7 of them and filesize <1933312
+		7 of them and filesize < 1933312
 }
 rule MALPEDIA_Win_Globeimposter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9dd6e8ba-63ad-5aaa-964a-871b7e1e06e1"
+		id = "80bf31e9-67f0-5eb5-b9e0-4dfcf990ea3a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.globeimposter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.globeimposter_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "f943f3ca79204de3fa7ffd520d4eead395fff4b80988c5a103deba289f7c4696"
+		logic_hash = "v1_sha256_f943f3ca79204de3fa7ffd520d4eead395fff4b80988c5a103deba289f7c4696"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146228,20 +146298,20 @@ rule MALPEDIA_Win_Globeimposter_Auto : FILE
 		$sequence_9 = { ff742440 e8???????? 83c40c 8bc5 eb03 6ac4 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Alphanc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ebf0ef1c-787d-588a-9f36-5c61e5121c6c"
+		id = "2012a665-33f2-5667-82f6-b7338b17d78c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alphanc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.alphanc_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "c1872178a4528cd6c6c1bbe8c32caefd5306a7f5c047a004c099269a20f7813d"
+		logic_hash = "v1_sha256_c1872178a4528cd6c6c1bbe8c32caefd5306a7f5c047a004c099269a20f7813d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146267,20 +146337,20 @@ rule MALPEDIA_Win_Alphanc_Auto : FILE
 		$sequence_9 = { c1e205 6a08 8d8a20074e00 51 53 53 }
 
 	condition:
-		7 of them and filesize <2015232
+		7 of them and filesize < 2015232
 }
 rule MALPEDIA_Win_Joao_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c5eae5c-6b71-5c2d-8653-d15d55163143"
+		id = "18a5b088-839d-5300-88d9-abcd57de6914"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.joao"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.joao_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "a16bd14cef032c190157889a218a60983ef70bb2ccc40760ffd00615dd49093e"
+		logic_hash = "v1_sha256_a16bd14cef032c190157889a218a60983ef70bb2ccc40760ffd00615dd49093e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146306,20 +146376,20 @@ rule MALPEDIA_Win_Joao_Auto : FILE
 		$sequence_9 = { 52 8bce c745f802000000 897dfc e8???????? }
 
 	condition:
-		7 of them and filesize <2867200
+		7 of them and filesize < 2867200
 }
 rule MALPEDIA_Win_Remsec_Strider_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8ffafd3c-1118-56d9-b912-84b2d6b6409b"
+		id = "bee82a3e-1820-57f1-873c-7d01d6ecbf2c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remsec_strider"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.remsec_strider_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "5867115fb4def3b071a615d256fa1eed563d65b07c2fc4fbbe85633ada999202"
+		logic_hash = "v1_sha256_5867115fb4def3b071a615d256fa1eed563d65b07c2fc4fbbe85633ada999202"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146345,20 +146415,20 @@ rule MALPEDIA_Win_Remsec_Strider_Auto : FILE
 		$sequence_9 = { c20400 56 8bf1 6808040000 8d4614 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize < 344064
 }
 rule MALPEDIA_Elf_Satori_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7bafa756-820c-5aa5-a514-aecea3797f7c"
+		id = "dc86f72f-bc31-54f6-b2cd-26892a51a8d7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.satori"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/elf.satori_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "971903fb2922c6e0d29023431fedc1f613a69ac9544f2c3e1cb57d7bab55e6a5"
+		logic_hash = "v1_sha256_971903fb2922c6e0d29023431fedc1f613a69ac9544f2c3e1cb57d7bab55e6a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146384,20 +146454,20 @@ rule MALPEDIA_Elf_Satori_Auto : FILE
 		$sequence_9 = { 8884242e220000 8a84242d220000 c684242d22000030 8884242f220000 83ec0c 6a03 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Anchor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3aabb030-7441-5b84-a113-08295754555e"
+		id = "d298409b-33db-584d-8259-a19153aedd74"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.anchor_auto.yar#L1-L208"
 		license_url = "N/A"
-		logic_hash = "3a0df58657b834f57e58b8e626451593809f6f92127cc7c303935ce966927900"
+		logic_hash = "v1_sha256_3a0df58657b834f57e58b8e626451593809f6f92127cc7c303935ce966927900"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -146435,20 +146505,20 @@ rule MALPEDIA_Win_Anchor_Auto : FILE
 		$sequence_21 = { 488d0d5a870200 e8???????? 90 488b8500010000 }
 
 	condition:
-		7 of them and filesize <778240
+		7 of them and filesize < 778240
 }
 rule MALPEDIA_Win_Daolpu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3b934422-e9dc-512e-b748-acfa3a6df0b8"
+		id = "d2a06a7e-0823-599c-a1ad-a477f93debf3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daolpu"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.daolpu_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "75ecbdb2c7e8916d3ac65192115d743be9db42508dfb2c41a685a14b393ff7b1"
+		logic_hash = "v1_sha256_75ecbdb2c7e8916d3ac65192115d743be9db42508dfb2c41a685a14b393ff7b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146474,20 +146544,20 @@ rule MALPEDIA_Win_Daolpu_Auto : FILE
 		$sequence_9 = { 488d8c24a8000000 e8???????? 83781000 740a b8ffff0000 e9???????? 488d8c24a8000000 }
 
 	condition:
-		7 of them and filesize <2877440
+		7 of them and filesize < 2877440
 }
 rule MALPEDIA_Win_Taurus_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5276d323-6b6a-5024-a34e-199bec8325fa"
+		id = "b24c6ef7-06d0-52a0-9f9b-989d8bf49b04"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taurus_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.taurus_stealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "97e3f8c58ab1394f8abf2308bd9b8032a5e1fd7c003ba327319dfca1b156cb9c"
+		logic_hash = "v1_sha256_97e3f8c58ab1394f8abf2308bd9b8032a5e1fd7c003ba327319dfca1b156cb9c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146513,20 +146583,20 @@ rule MALPEDIA_Win_Taurus_Stealer_Auto : FILE
 		$sequence_9 = { 8986c8020000 e8???????? ff7510 8bcb e8???????? 5f 8bc6 }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize < 524288
 }
 rule MALPEDIA_Win_Tempedreve_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9e025c63-22da-56b2-8f0f-12b35d9ea5db"
+		id = "949fdf36-689f-5f9e-9a59-bef8d67f42b6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tempedreve"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tempedreve_auto.yar#L1-L156"
 		license_url = "N/A"
-		logic_hash = "ff28ad4e45522fd6ad775c186581b049a8c3b1257f6ade7f519c8365bdcce952"
+		logic_hash = "v1_sha256_ff28ad4e45522fd6ad775c186581b049a8c3b1257f6ade7f519c8365bdcce952"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146558,20 +146628,20 @@ rule MALPEDIA_Win_Tempedreve_Auto : FILE
 		$sequence_15 = { 57 0fb6b90030cb00 d1c0 33c7 0fb6b90130cb00 d1c0 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Typeframe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "54b5c61d-baac-5ee7-bf22-feb7211e94de"
+		id = "a8b9d33e-2e86-5732-ba20-f54dd191e7e4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.typeframe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.typeframe_auto.yar#L1-L148"
 		license_url = "N/A"
-		logic_hash = "80d5f324e45f06373a108fe4a18abca87604cdaaeb894c2ac4120a591e037164"
+		logic_hash = "v1_sha256_80d5f324e45f06373a108fe4a18abca87604cdaaeb894c2ac4120a591e037164"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146603,20 +146673,20 @@ rule MALPEDIA_Win_Typeframe_Auto : FILE
 		$sequence_15 = { 014424fc 83ec04 2bc2 58 720c }
 
 	condition:
-		7 of them and filesize <2125824
+		7 of them and filesize < 2125824
 }
 rule MALPEDIA_Win_Mokes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c2ac2973-931f-5609-90a2-11e20fcc17b8"
+		id = "a79d430e-beab-5fce-9328-3383f93c3b5e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mokes"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mokes_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "4e4c9d74cc0d3144676404e81ee560de6bc14d4b048ed928b0226c3699c7f157"
+		logic_hash = "v1_sha256_4e4c9d74cc0d3144676404e81ee560de6bc14d4b048ed928b0226c3699c7f157"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146642,20 +146712,20 @@ rule MALPEDIA_Win_Mokes_Auto : FILE
 		$sequence_9 = { ff5274 85c0 741b 807c241800 b820000000 b910000000 0f45c1 }
 
 	condition:
-		7 of them and filesize <18505728
+		7 of them and filesize < 18505728
 }
 rule MALPEDIA_Win_Tidepool_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c47d0b4d-1c2a-583a-a083-2239d9e6be2a"
+		id = "41c81638-da0a-5423-b60e-033d305b4f06"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tidepool"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tidepool_auto.yar#L1-L265"
 		license_url = "N/A"
-		logic_hash = "81ef950afde11d443ee135cd0277277468eb293508aa726a79916bd48024f136"
+		logic_hash = "v1_sha256_81ef950afde11d443ee135cd0277277468eb293508aa726a79916bd48024f136"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -146699,20 +146769,20 @@ rule MALPEDIA_Win_Tidepool_Auto : FILE
 		$sequence_27 = { 8d043e 50 e8???????? 037dfc 8d45d8 }
 
 	condition:
-		7 of them and filesize <1998848
+		7 of them and filesize < 1998848
 }
 rule MALPEDIA_Win_Socksbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b5f93aff-75da-58af-bf18-de683a7c9eb8"
+		id = "3aaf471b-86a9-5b73-9759-377e9196214c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socksbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.socksbot_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "be6f7343dfb40a0e2f1dec96db93036928644c868cacce36ad5e92217ff2c80d"
+		logic_hash = "v1_sha256_be6f7343dfb40a0e2f1dec96db93036928644c868cacce36ad5e92217ff2c80d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146738,20 +146808,20 @@ rule MALPEDIA_Win_Socksbot_Auto : FILE
 		$sequence_9 = { 8d4609 50 8d4508 50 e8???????? 83c40c 8b7dfc }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Miuref_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4c12abfd-56eb-5794-a878-e360bcdd710f"
+		id = "498b85e4-54b1-5e1c-905a-32296824e668"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miuref"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.miuref_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "5ba2d5449e6730857e7b4a98904adc38cf054939f52a1a5bc78d4b800b88b99f"
+		logic_hash = "v1_sha256_5ba2d5449e6730857e7b4a98904adc38cf054939f52a1a5bc78d4b800b88b99f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146777,20 +146847,20 @@ rule MALPEDIA_Win_Miuref_Auto : FILE
 		$sequence_9 = { 59 85c0 7512 3bdd 7e03 4b eb03 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Teleport_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "27108ab3-6cb2-5111-9364-d7f24d03816a"
+		id = "70b7281f-78ff-575c-a4ef-76f09ebbc848"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.teleport"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.teleport_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "833087ce8b406b0ed8db8d58a090084d0531be2127d4429df6d3e776d65bddb6"
+		logic_hash = "v1_sha256_833087ce8b406b0ed8db8d58a090084d0531be2127d4429df6d3e776d65bddb6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146816,20 +146886,20 @@ rule MALPEDIA_Win_Teleport_Auto : FILE
 		$sequence_9 = { 52 8b01 8b4010 ffd0 84c0 747e 68???????? }
 
 	condition:
-		7 of them and filesize <458752
+		7 of them and filesize < 458752
 }
 rule MALPEDIA_Win_Glooxmail_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c8b40bc0-2701-5e85-b527-dfec9c8227da"
+		id = "4277b9d1-06a3-5149-9f7f-f7159ed5789d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glooxmail"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.glooxmail_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "0702baea6e45ee40dbbd470cae1ae641eba3358089995e7fe66a20e43c2df933"
+		logic_hash = "v1_sha256_0702baea6e45ee40dbbd470cae1ae641eba3358089995e7fe66a20e43c2df933"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146855,20 +146925,20 @@ rule MALPEDIA_Win_Glooxmail_Auto : FILE
 		$sequence_9 = { e8???????? 807def00 740f c783a000000002000000 e9???????? 68???????? 8d4da4 }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize < 761856
 }
 rule MALPEDIA_Win_Azorult_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "78ceafa4-342d-5f15-9b14-b1abd4927873"
+		id = "47bb3a07-3300-5c3a-be9f-7eb231dc2b81"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.azorult_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "41a9a9a645aa649d01575fa1735f856598b52bd5cebd3453810c05cbd7a89f47"
+		logic_hash = "v1_sha256_41a9a9a645aa649d01575fa1735f856598b52bd5cebd3453810c05cbd7a89f47"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146900,20 +146970,20 @@ rule MALPEDIA_Win_Azorult_Auto : FILE
 		$sequence_15 = { 014110 5f 5e 5b }
 
 	condition:
-		7 of them and filesize <1753088
+		7 of them and filesize < 1753088
 }
 rule MALPEDIA_Win_Gsecdump_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ce480a68-e8bd-5d8c-86f5-be48ddeea1ee"
+		id = "d411f208-fe8c-5bba-b9ca-aed5a818ebac"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gsecdump"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gsecdump_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "a72a04a740244a6cb1848f1152ab924ea33c81fae0f1332c81f641d1b7e5f823"
+		logic_hash = "v1_sha256_a72a04a740244a6cb1848f1152ab924ea33c81fae0f1332c81f641d1b7e5f823"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146939,20 +147009,20 @@ rule MALPEDIA_Win_Gsecdump_Auto : FILE
 		$sequence_9 = { e8???????? 8b4604 03c5 50 8d44241c 50 e8???????? }
 
 	condition:
-		7 of them and filesize <630784
+		7 of them and filesize < 630784
 }
 rule MALPEDIA_Win_Navrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c873f75a-bac6-59c1-887a-5d663acd72dd"
+		id = "dab4fe33-4958-57c2-bce9-1afc87689ca4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.navrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.navrat_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "c07b699c6f0dfc54b32e135d358bdfb08bd5b26e1aa027b1f4dd7fec4dc44720"
+		logic_hash = "v1_sha256_c07b699c6f0dfc54b32e135d358bdfb08bd5b26e1aa027b1f4dd7fec4dc44720"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146978,20 +147048,20 @@ rule MALPEDIA_Win_Navrat_Auto : FILE
 		$sequence_9 = { 8d48bf 80f919 7707 0fbec0 83e841 c3 }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize < 352256
 }
 rule MALPEDIA_Win_Emdivi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "04ac374c-dabe-58e4-92b7-b141ee96d84c"
+		id = "2d380665-2301-5770-a240-0525d22cf6a4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emdivi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.emdivi_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "17250ab484761cd3c4abb0e5e481a1578bae8e41059cc5bbab60b36acc5f6199"
+		logic_hash = "v1_sha256_17250ab484761cd3c4abb0e5e481a1578bae8e41059cc5bbab60b36acc5f6199"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147017,20 +147087,20 @@ rule MALPEDIA_Win_Emdivi_Auto : FILE
 		$sequence_9 = { ff75b8 8d45bc 6a40 6a01 50 e8???????? }
 
 	condition:
-		7 of them and filesize <581632
+		7 of them and filesize < 581632
 }
 rule MALPEDIA_Win_Vflooder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "76477b84-f3c3-5da1-86fd-c61daea161aa"
+		id = "43fdb812-f49d-5121-9492-69743bff8e58"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vflooder"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vflooder_auto.yar#L1-L106"
 		license_url = "N/A"
-		logic_hash = "d33638034753d47f1d3c882a126dc14f7048d70033f800573b6ecd2c27103b12"
+		logic_hash = "v1_sha256_d33638034753d47f1d3c882a126dc14f7048d70033f800573b6ecd2c27103b12"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147056,20 +147126,20 @@ rule MALPEDIA_Win_Vflooder_Auto : FILE
 		$sequence_9 = { 9c f2ae 9c 9c }
 
 	condition:
-		7 of them and filesize <860160
+		7 of them and filesize < 860160
 }
 rule MALPEDIA_Win_Atmosphere_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b490d7b3-3c9f-56a0-8e37-e6b8aeb02255"
+		id = "c519d676-e755-5e4c-a9fb-aaade788dfcd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmosphere"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.atmosphere_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "09ff5db5949a2315ec4eb307f77f435859e4dd2533efb70945aee06235bab5f1"
+		logic_hash = "v1_sha256_09ff5db5949a2315ec4eb307f77f435859e4dd2533efb70945aee06235bab5f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147095,20 +147165,20 @@ rule MALPEDIA_Win_Atmosphere_Auto : FILE
 		$sequence_9 = { 56 57 8bf9 6a2e e8???????? 8bf0 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Photoloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a08024a5-b726-5fe7-bae6-d20cf144169e"
+		id = "3c6b83cb-1b9a-504a-99e7-9b0fc2b9e3d8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photoloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.photoloader_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "23120e8333171e7b242a43c78525c83b36a92ed0c9ad8db34350941d5629fd06"
+		logic_hash = "v1_sha256_23120e8333171e7b242a43c78525c83b36a92ed0c9ad8db34350941d5629fd06"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147140,20 +147210,20 @@ rule MALPEDIA_Win_Photoloader_Auto : FILE
 		$sequence_15 = { e8???????? 03f8 8d0c7b e8???????? 8bc3 }
 
 	condition:
-		7 of them and filesize <107520
+		7 of them and filesize < 107520
 }
 rule MALPEDIA_Win_Atmitch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "72b8ffe7-fc9a-5d92-9de1-9193b095fc04"
+		id = "d48b8ecf-0351-5ee8-a914-74ddb5f23d23"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmitch"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.atmitch_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "e051c844a76319030fd5ab69ee7c6a522b22df21eb94d4b042bb698655f157ac"
+		logic_hash = "v1_sha256_e051c844a76319030fd5ab69ee7c6a522b22df21eb94d4b042bb698655f157ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147179,20 +147249,20 @@ rule MALPEDIA_Win_Atmitch_Auto : FILE
 		$sequence_9 = { 83c404 50 ff15???????? 50 51 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Htran_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "791ab88f-729e-59ed-af49-9775d8f95bf2"
+		id = "f9718339-bb60-5788-b05c-b833f02af94b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htran"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.htran_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "644467af100df6d78907af875b29f835634dff017ff5ecb28fa828ec75819c6e"
+		logic_hash = "v1_sha256_644467af100df6d78907af875b29f835634dff017ff5ecb28fa828ec75819c6e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147218,20 +147288,20 @@ rule MALPEDIA_Win_Htran_Auto : FILE
 		$sequence_9 = { 899424e8010000 89b424e8000000 899424e4000000 33c0 8d8c24e8000000 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Spora_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5d94c115-8898-5fd2-9400-bd1b65702971"
+		id = "77d97716-69e7-59b6-b779-3a62bb5cbb90"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spora_ransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spora_ransom_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "8cb28aa2ca756a794bdd2f8c19a9ebbdf2da0e5ca39f0f44ec247ce30af41008"
+		logic_hash = "v1_sha256_8cb28aa2ca756a794bdd2f8c19a9ebbdf2da0e5ca39f0f44ec247ce30af41008"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147257,20 +147327,20 @@ rule MALPEDIA_Win_Spora_Ransom_Auto : FILE
 		$sequence_9 = { 8bf8 85ff 7416 ff36 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Yarat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "26d63431-4d21-54e8-9725-9df9b9ea5db9"
+		id = "59a1d27e-be3a-5c95-a973-ab970b6db6d9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yarat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.yarat_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "48d9368820ba368c523115d54deddffc1bdeeafa57938343dae7eabda399b87d"
+		logic_hash = "v1_sha256_48d9368820ba368c523115d54deddffc1bdeeafa57938343dae7eabda399b87d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147296,20 +147366,20 @@ rule MALPEDIA_Win_Yarat_Auto : FILE
 		$sequence_9 = { 8d4510 c7451000000000 50 56 e8???????? 83c40c 397d10 }
 
 	condition:
-		7 of them and filesize <8692736
+		7 of them and filesize < 8692736
 }
 rule MALPEDIA_Win_5T_Downloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5362fc02-7c1d-5a3b-a300-446438d04597"
+		id = "0c4b3776-51ea-58ea-919a-36d4e5c3b1c7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.5t_downloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.5t_downloader_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "89d6b68b4695f52c4102e727ccfceba9dea8c1d372d4dac3b5353663c79c51c0"
+		logic_hash = "v1_sha256_89d6b68b4695f52c4102e727ccfceba9dea8c1d372d4dac3b5353663c79c51c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147335,20 +147405,20 @@ rule MALPEDIA_Win_5T_Downloader_Auto : FILE
 		$sequence_9 = { 7409 83781800 7403 5d }
 
 	condition:
-		7 of them and filesize <539648
+		7 of them and filesize < 539648
 }
 rule MALPEDIA_Win_Httpbrowser_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "adff80ab-eb6c-5a3c-b157-43b2baed9ae7"
+		id = "389c63c8-c428-503c-9081-f3df3016471d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpbrowser"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.httpbrowser_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "00c38478a4fbc51d8b9ca5fb24e8846e76e8f61512ecf76046dde9dd700684fd"
+		logic_hash = "v1_sha256_00c38478a4fbc51d8b9ca5fb24e8846e76e8f61512ecf76046dde9dd700684fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147380,20 +147450,20 @@ rule MALPEDIA_Win_Httpbrowser_Auto : FILE
 		$sequence_15 = { 57 83f9ff 7414 8bf9 c1ff05 83e11f 8b3cbd00644100 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Regretlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a9ec355a-0ebd-5eae-9855-3c394e286080"
+		id = "7ff95a38-d8aa-553c-b49a-099a488d3ca1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regretlocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.regretlocker_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "f3fb26e7f48e7fc6e56408b23120104bca26438c533527ef9b1632b5882b6ef9"
+		logic_hash = "v1_sha256_f3fb26e7f48e7fc6e56408b23120104bca26438c533527ef9b1632b5882b6ef9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147419,20 +147489,20 @@ rule MALPEDIA_Win_Regretlocker_Auto : FILE
 		$sequence_9 = { 8b5508 56 8bf1 8b02 894610 8b4224 894614 }
 
 	condition:
-		7 of them and filesize <1021952
+		7 of them and filesize < 1021952
 }
 rule MALPEDIA_Win_Tclient_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3639f84f-4aec-569c-9a4b-faa8f23f8b5c"
+		id = "7d5205af-befc-5ffa-ad18-6cd0c32427e2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tclient"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tclient_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "27c191c2603bf7d7ea682fd55fb7f07be28d5958dc675e32b4f634f07d524410"
+		logic_hash = "v1_sha256_27c191c2603bf7d7ea682fd55fb7f07be28d5958dc675e32b4f634f07d524410"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147458,20 +147528,20 @@ rule MALPEDIA_Win_Tclient_Auto : FILE
 		$sequence_9 = { 56 e8???????? 59 59 c70602000000 eb14 83660800 }
 
 	condition:
-		7 of them and filesize <1063936
+		7 of them and filesize < 1063936
 }
 rule MALPEDIA_Win_Phorpiex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "93126ddf-7d23-57a9-b11d-b555411adf12"
+		id = "96630fec-df6b-5713-817d-5748e735db55"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.phorpiex_auto.yar#L1-L281"
 		license_url = "N/A"
-		logic_hash = "ecdba64c76b9c6ee0e76612106be4a9e4db8b2914c6804e0ef9feb32643b1afb"
+		logic_hash = "v1_sha256_ecdba64c76b9c6ee0e76612106be4a9e4db8b2914c6804e0ef9feb32643b1afb"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -147517,20 +147587,20 @@ rule MALPEDIA_Win_Phorpiex_Auto : FILE
 		$sequence_29 = { 8d45f8 50 8d45e4 50 6805000020 }
 
 	condition:
-		7 of them and filesize <2490368
+		7 of them and filesize < 2490368
 }
 rule MALPEDIA_Win_Neutrino_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9a95af10-a741-56c4-8bb8-54cc2e65dd52"
+		id = "746d0447-6d3c-5ee0-8906-e1871b461e16"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neutrino"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.neutrino_auto.yar#L1-L330"
 		license_url = "N/A"
-		logic_hash = "326fe9ea9352871202c596bbb0d54c8449971285bd5a9b495a305700faaa6e71"
+		logic_hash = "v1_sha256_326fe9ea9352871202c596bbb0d54c8449971285bd5a9b495a305700faaa6e71"
 		score = 60
 		quality = 43
 		tags = "FILE"
@@ -147580,20 +147650,20 @@ rule MALPEDIA_Win_Neutrino_Auto : FILE
 		$sequence_33 = { ff15???????? 6a64 e8???????? 59 }
 
 	condition:
-		7 of them and filesize <507904
+		7 of them and filesize < 507904
 }
 rule MALPEDIA_Win_Korlia_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f4183d87-ea91-5bb4-a600-f9953387c71f"
+		id = "7b00fcdb-1c05-5e04-b35d-00fa11611f59"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.korlia"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.korlia_auto.yar#L1-L479"
 		license_url = "N/A"
-		logic_hash = "05ee31919c5d4bc6056f376629b9d7ad98c63e5082d49653926cef5a9130bcaf"
+		logic_hash = "v1_sha256_05ee31919c5d4bc6056f376629b9d7ad98c63e5082d49653926cef5a9130bcaf"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -147661,20 +147731,20 @@ rule MALPEDIA_Win_Korlia_Auto : FILE
 		$sequence_51 = { 8d4510 6a04 50 8b4608 6a1f 53 ffd0 }
 
 	condition:
-		7 of them and filesize <263168
+		7 of them and filesize < 263168
 }
 rule MALPEDIA_Win_Kutaki_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3c87fe1d-05a9-5edb-bd70-90267ed2d35f"
+		id = "c695176c-0715-528c-a08a-6aa7590e2362"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kutaki"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kutaki_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "f474749c1cd094eae743101c28ca84cb1920c476698848136df3aa022b49d368"
+		logic_hash = "v1_sha256_f474749c1cd094eae743101c28ca84cb1920c476698848136df3aa022b49d368"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147700,20 +147770,20 @@ rule MALPEDIA_Win_Kutaki_Auto : FILE
 		$sequence_9 = { 8d9578ffffff 52 ff15???????? 83c420 50 8d8568ffffff }
 
 	condition:
-		7 of them and filesize <1335296
+		7 of them and filesize < 1335296
 }
 rule MALPEDIA_Win_Snojan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f201807-eca2-5671-8fb1-4c54ce96e5b1"
+		id = "6de97aba-1369-529d-ad06-40ab7993fb55"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snojan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.snojan_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "1d25311cfd419aa863c883b495c4bbb0986a7541ebe6286749992456a12c9723"
+		logic_hash = "v1_sha256_1d25311cfd419aa863c883b495c4bbb0986a7541ebe6286749992456a12c9723"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147739,20 +147809,20 @@ rule MALPEDIA_Win_Snojan_Auto : FILE
 		$sequence_9 = { b8???????? e8???????? 85c0 74e9 a1???????? 8b988000986d }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Makop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "55bb2009-0773-50d3-bf67-d639c1dcecf4"
+		id = "9c56efb6-5379-553d-a390-75b3b16a7501"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.makop_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "15bd73a7e0423413ca2025ecc2d41d366425fcba5c6c678e6bdd7d61fffbeff6"
+		logic_hash = "v1_sha256_15bd73a7e0423413ca2025ecc2d41d366425fcba5c6c678e6bdd7d61fffbeff6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147778,20 +147848,20 @@ rule MALPEDIA_Win_Makop_Auto : FILE
 		$sequence_9 = { bf0d000000 be0a000000 668944241e 6689442430 6689442438 6689442446 }
 
 	condition:
-		7 of them and filesize <107520
+		7 of them and filesize < 107520
 }
 rule MALPEDIA_Win_Reaver_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3d8bacff-8149-5ea1-b108-9a71e294cb35"
+		id = "86c6dd24-ac1b-542b-9c5c-f9b080e5f2d1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.reaver"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.reaver_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "48c5b411e85068c0dc8fd141ff59dabcc3c0e5a62fed45c81149c84c9623f348"
+		logic_hash = "v1_sha256_48c5b411e85068c0dc8fd141ff59dabcc3c0e5a62fed45c81149c84c9623f348"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147817,20 +147887,20 @@ rule MALPEDIA_Win_Reaver_Auto : FILE
 		$sequence_9 = { 6a00 ff15???????? 85c0 7440 8b45f4 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Spyder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e1aebf0-6155-5533-b005-6b02cbbc8082"
+		id = "3ccb3e2e-e879-5e46-bc2b-10825dd2c91f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyder"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spyder_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "0a4823dcbe7cde22c22d2c4c8ece9fed1a6046b4847d90f2e0d8e717ed405fab"
+		logic_hash = "v1_sha256_0a4823dcbe7cde22c22d2c4c8ece9fed1a6046b4847d90f2e0d8e717ed405fab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147862,20 +147932,20 @@ rule MALPEDIA_Win_Spyder_Auto : FILE
 		$sequence_15 = { 8bc3 c1f805 8d3c85204b0910 8bc3 83e01f }
 
 	condition:
-		7 of them and filesize <1458176
+		7 of them and filesize < 1458176
 }
 rule MALPEDIA_Win_Lightneuron_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4c2cf7c9-a6e0-519d-9025-fdcf709d68d0"
+		id = "d15a0f84-cdc2-5a4f-be26-fbaa6fc8a842"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightneuron"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lightneuron_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5722f811a0c9c408e5a8640f3b100c752da3b058e0e2eee886d08d397042326e"
+		logic_hash = "v1_sha256_5722f811a0c9c408e5a8640f3b100c752da3b058e0e2eee886d08d397042326e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147901,20 +147971,20 @@ rule MALPEDIA_Win_Lightneuron_Auto : FILE
 		$sequence_9 = { ffe1 488b4318 488d942480000000 41b802000000 0fb74808 888c2480000000 66c1e908 }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize < 573440
 }
 rule MALPEDIA_Win_Soul_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e9dd6236-3340-50b4-b5d0-39eff17887cc"
+		id = "b40796a0-c091-5ac4-a3c1-a61762694868"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soul"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.soul_auto.yar#L1-L235"
 		license_url = "N/A"
-		logic_hash = "006ca2db66b727a223c7e1c69f1643e1ec1c7be66a86b7b95f1d15a0130986f8"
+		logic_hash = "v1_sha256_006ca2db66b727a223c7e1c69f1643e1ec1c7be66a86b7b95f1d15a0130986f8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -147953,20 +148023,20 @@ rule MALPEDIA_Win_Soul_Auto : FILE
 		$sequence_22 = { 488d1dc7850000 488d3de0850000 eb0e 488b03 4885c0 7402 }
 
 	condition:
-		7 of them and filesize <1400832
+		7 of them and filesize < 1400832
 }
 rule MALPEDIA_Win_Webc2_Kt3_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "93781915-1cb2-5abd-9774-3e668f8666c9"
+		id = "70f5cf9f-8081-5bbd-9801-53020f901207"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_kt3"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_kt3_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "44b6f2b326248f3f927f1e4016d6365a022a7c825a43b779fc8768d5c422e7ad"
+		logic_hash = "v1_sha256_44b6f2b326248f3f927f1e4016d6365a022a7c825a43b779fc8768d5c422e7ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147992,20 +148062,20 @@ rule MALPEDIA_Win_Webc2_Kt3_Auto : FILE
 		$sequence_9 = { 8985f0fbffff 0f8408000000 0f8502000000 ebe9 68???????? }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Webc2_Bolid_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dd418f60-6f65-5186-bdc9-d3ec62c1747f"
+		id = "3314ae20-692b-5078-b98e-94b105d135a7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_bolid"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_bolid_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "d5bb74d5c966a3742a98e85309bd13720d314db10e6aa05f8d544024f31adb6b"
+		logic_hash = "v1_sha256_d5bb74d5c966a3742a98e85309bd13720d314db10e6aa05f8d544024f31adb6b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148031,20 +148101,20 @@ rule MALPEDIA_Win_Webc2_Bolid_Auto : FILE
 		$sequence_9 = { c68424240200000d e8???????? 83ec10 8d9424a0000000 8bcc 89a424c4000000 52 }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Nexster_Bot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f3849f7f-92fa-5a27-8fce-5cf70a6092f1"
+		id = "666b4883-a7ba-5fa1-90f5-47983a441b20"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nexster_bot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nexster_bot_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "68d99297d7676950ef20645c2f54f180e697aada925cf75041287d48b2b4b344"
+		logic_hash = "v1_sha256_68d99297d7676950ef20645c2f54f180e697aada925cf75041287d48b2b4b344"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148070,20 +148140,20 @@ rule MALPEDIA_Win_Nexster_Bot_Auto : FILE
 		$sequence_9 = { 8a08 40 84c9 75f9 8dbdbc150000 2bc6 4f }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize < 245760
 }
 rule MALPEDIA_Win_Bagle_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1b117c6-ef70-5a17-abcf-06072ab81225"
+		id = "b3ce2038-7c96-5cae-ad9f-9739e07898eb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bagle"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bagle_auto.yar#L1-L102"
 		license_url = "N/A"
-		logic_hash = "78371b093ac9a1cbad80f2768798d5c43910e03f8eb339710028eb9343ade350"
+		logic_hash = "v1_sha256_78371b093ac9a1cbad80f2768798d5c43910e03f8eb339710028eb9343ade350"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148107,20 +148177,20 @@ rule MALPEDIA_Win_Bagle_Auto : FILE
 		$sequence_7 = { 6880000000 68???????? e8???????? 6a00 6a00 6a00 68???????? }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize < 245760
 }
 rule MALPEDIA_Win_Threebyte_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "db751837-d9fe-5bbc-8e37-81fa1047a177"
+		id = "6bc2b4e0-c8b3-578b-84c5-d3b4a8cc8af9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.threebyte"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.threebyte_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "b532d976fb568c958de01f6c83348e2db5990a266537c8833f6f4b97f2236efc"
+		logic_hash = "v1_sha256_b532d976fb568c958de01f6c83348e2db5990a266537c8833f6f4b97f2236efc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148146,20 +148216,20 @@ rule MALPEDIA_Win_Threebyte_Auto : FILE
 		$sequence_9 = { c68515feffff75 c68516feffff6e c68517feffff20 c68518feffff00 c68524feffff73 c68525feffff6c c68526feffff65 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Chinotto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0573d972-e907-5e4b-a894-f42d60689ebb"
+		id = "0169454b-d842-5e4c-b1f0-81822c57a20d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinotto"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chinotto_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "7b0ad7ae03649166d50ba1fc6b2d39b3f99f903efd2a6958d5ba06fcea9fb997"
+		logic_hash = "v1_sha256_7b0ad7ae03649166d50ba1fc6b2d39b3f99f903efd2a6958d5ba06fcea9fb997"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148185,20 +148255,20 @@ rule MALPEDIA_Win_Chinotto_Auto : FILE
 		$sequence_9 = { 56 52 50 8b4508 8b4834 8b5030 }
 
 	condition:
-		7 of them and filesize <300032
+		7 of them and filesize < 300032
 }
 rule MALPEDIA_Win_Grabbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6b177866-b328-5532-b1df-c68c15ec705b"
+		id = "6e9cd0d9-adb9-558a-85e6-e393bbb88cba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grabbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.grabbot_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "c94d3ff4eb131743923dc6cd096207359254fdb038801b45a5051cbbd0d7bf96"
+		logic_hash = "v1_sha256_c94d3ff4eb131743923dc6cd096207359254fdb038801b45a5051cbbd0d7bf96"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148230,20 +148300,20 @@ rule MALPEDIA_Win_Grabbot_Auto : FILE
 		$sequence_15 = { 741e 57 56 6aff }
 
 	condition:
-		7 of them and filesize <1335296
+		7 of them and filesize < 1335296
 }
 rule MALPEDIA_Win_Jupiter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d73fbb35-6ded-5d84-b301-32a821a6ff22"
+		id = "7ac98490-953b-5a75-9cc2-084e4548f7f2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jupiter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jupiter_auto.yar#L1-L110"
 		license_url = "N/A"
-		logic_hash = "1e4ba4252b0bc544e9c72fa0e946f1d0b7c34c44b8125a03ca9d26d89c2795b2"
+		logic_hash = "v1_sha256_1e4ba4252b0bc544e9c72fa0e946f1d0b7c34c44b8125a03ca9d26d89c2795b2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148269,20 +148339,20 @@ rule MALPEDIA_Win_Jupiter_Auto : FILE
 		$sequence_9 = { c605????????01 c605????????01 66c705????????0101 c605????????01 }
 
 	condition:
-		7 of them and filesize <224112
+		7 of them and filesize < 224112
 }
 rule MALPEDIA_Win_Taidoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ba437ab9-6c90-576a-83d2-5801ebb87e42"
+		id = "b1e40cb7-e7f3-5eef-94d8-38b31642282e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taidoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.taidoor_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "7b8ed6f15654e580fefed39d2d4fea0473e69a1fd6a98339a075f2fbcf4be749"
+		logic_hash = "v1_sha256_7b8ed6f15654e580fefed39d2d4fea0473e69a1fd6a98339a075f2fbcf4be749"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148308,20 +148378,20 @@ rule MALPEDIA_Win_Taidoor_Auto : FILE
 		$sequence_9 = { 53 50 53 c7458844000000 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Polyglot_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0ac13ffc-60b5-57b4-bdac-0ba216f69178"
+		id = "f633df67-0284-5c2f-83b9-ce3651dd32f0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglot_ransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.polyglot_ransom_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "207fa5f26622dfd1aef2c3f100c53d4dd46542c0aab03454309445c1893ebb78"
+		logic_hash = "v1_sha256_207fa5f26622dfd1aef2c3f100c53d4dd46542c0aab03454309445c1893ebb78"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -148347,20 +148417,20 @@ rule MALPEDIA_Win_Polyglot_Ransom_Auto : FILE
 		$sequence_9 = { 8bec 83ec20 56 ff7514 8d45e0 50 8bf1 }
 
 	condition:
-		7 of them and filesize <1392640
+		7 of them and filesize < 1392640
 }
 rule MALPEDIA_Win_Gooseegg_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b01e34b-c4f4-52eb-8cca-5f132c510659"
+		id = "85f84ff3-a343-5bfc-8c0a-fc91ca53edda"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gooseegg"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gooseegg_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "40532f14598b07ba3f10571e0b95a9ef51b8ec16ffc21df237328572ddb56a5f"
+		logic_hash = "v1_sha256_40532f14598b07ba3f10571e0b95a9ef51b8ec16ffc21df237328572ddb56a5f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148386,20 +148456,20 @@ rule MALPEDIA_Win_Gooseegg_Auto : FILE
 		$sequence_9 = { 83c8ff f00fc101 83f801 751c 488b4530 488b8888000000 488d05b6000100 }
 
 	condition:
-		7 of them and filesize <217088
+		7 of them and filesize < 217088
 }
 rule MALPEDIA_Win_Manjusaka_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e3ef2c8a-601e-5fad-bcaf-45a15d46a182"
+		id = "7a6480f0-057a-59ae-b632-224d7f21dd50"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.manjusaka"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.manjusaka_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "b609fc5a0f646080989595e70a17261ca84aa420275082a0a377fc146648363a"
+		logic_hash = "v1_sha256_b609fc5a0f646080989595e70a17261ca84aa420275082a0a377fc146648363a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148425,20 +148495,20 @@ rule MALPEDIA_Win_Manjusaka_Auto : FILE
 		$sequence_9 = { e9???????? 6641baaecc e9???????? 6641bafefe e9???????? 6641bafffe e9???????? }
 
 	condition:
-		7 of them and filesize <4772864
+		7 of them and filesize < 4772864
 }
 rule MALPEDIA_Win_Tinba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8dfb27e2-54cb-58f0-8a40-15de14b5671d"
+		id = "af546549-7dc5-59d8-9e36-f1d5d46af16d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tinba_auto.yar#L1-L138"
 		license_url = "N/A"
-		logic_hash = "12776db9a2ca5e4e1bee242492b810213115a7f9fd4fce223ca3d2d59532f5e7"
+		logic_hash = "v1_sha256_12776db9a2ca5e4e1bee242492b810213115a7f9fd4fce223ca3d2d59532f5e7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148467,20 +148537,20 @@ rule MALPEDIA_Win_Tinba_Auto : FILE
 		$sequence_12 = { 66894208 66894a0a ac 88c1 80e1fe 80f9c4 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Hive_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "648fda14-26aa-5cb6-b0b0-33ac82fa76a4"
+		id = "9b522ceb-8b28-533d-83e1-7f384e6d6f02"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hive"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hive_auto.yar#L1-L193"
 		license_url = "N/A"
-		logic_hash = "b786ded85189e10c8f992d72b9f33dda53290c7d2488c59423c5787b80ba3c77"
+		logic_hash = "v1_sha256_b786ded85189e10c8f992d72b9f33dda53290c7d2488c59423c5787b80ba3c77"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -148517,20 +148587,20 @@ rule MALPEDIA_Win_Hive_Auto : FILE
 		$sequence_20 = { 898c2488000000 8984248c000000 83c478 c3 85db 7609 }
 
 	condition:
-		7 of them and filesize <7946240
+		7 of them and filesize < 7946240
 }
 rule MALPEDIA_Win_Darkbit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "17d9f575-1833-580e-9f9a-26ac57d772c0"
+		id = "fea2e91e-7962-57c8-9a2f-0a9a437feeca"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkbit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkbit_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a8284822bcb0339f6639d77d907a6e073020f408fd2caaa614e40aa5d0446833"
+		logic_hash = "v1_sha256_a8284822bcb0339f6639d77d907a6e073020f408fd2caaa614e40aa5d0446833"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148556,20 +148626,20 @@ rule MALPEDIA_Win_Darkbit_Auto : FILE
 		$sequence_9 = { 90 c744245b44588096 c644245fcd c74424562c14e1d8 c644245a6c 31c0 e9???????? }
 
 	condition:
-		7 of them and filesize <11612160
+		7 of them and filesize < 11612160
 }
 rule MALPEDIA_Win_Megumin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "37ab0bcc-cdac-5d31-a456-2de10ec33215"
+		id = "93179f80-435d-5232-9dc3-d373e03b14ae"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.megumin"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.megumin_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "a365528e95f0493decec29de859395bb6581a0dddcbbf2af0b80b92938590fb4"
+		logic_hash = "v1_sha256_a365528e95f0493decec29de859395bb6581a0dddcbbf2af0b80b92938590fb4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148595,20 +148665,20 @@ rule MALPEDIA_Win_Megumin_Auto : FILE
 		$sequence_9 = { 6a00 ff15???????? 8d8df8f8ffff e8???????? 83781410 7202 8b00 }
 
 	condition:
-		7 of them and filesize <1007616
+		7 of them and filesize < 1007616
 }
 rule MALPEDIA_Win_Matsnu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0f71c5ab-0c82-5153-bcd8-045c162f2f63"
+		id = "2e7543f7-a3c3-50f1-bc86-910a59e983ab"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matsnu"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.matsnu_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "95216433634cb314b9cc2cf8428b6a5d974607cd960d3ec0665086600fff0829"
+		logic_hash = "v1_sha256_95216433634cb314b9cc2cf8428b6a5d974607cd960d3ec0665086600fff0829"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148634,20 +148704,20 @@ rule MALPEDIA_Win_Matsnu_Auto : FILE
 		$sequence_9 = { 55 89e5 81ec10020000 c785f0fdffff00000000 }
 
 	condition:
-		7 of them and filesize <606992
+		7 of them and filesize < 606992
 }
 rule MALPEDIA_Win_Slub_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "94a02bf2-7103-5d7e-aa8d-633d7fba4826"
+		id = "7187e274-d9ca-51e9-ad7b-390e7a93f115"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slub"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.slub_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "aee363d67e6a37d8547028a75375273379b56a2505a09b01f68a1ed9e200ef20"
+		logic_hash = "v1_sha256_aee363d67e6a37d8547028a75375273379b56a2505a09b01f68a1ed9e200ef20"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148673,20 +148743,20 @@ rule MALPEDIA_Win_Slub_Auto : FILE
 		$sequence_9 = { 0f45c8 8d4530 2bc8 83f916 7349 8b55dc c645f301 }
 
 	condition:
-		7 of them and filesize <1785856
+		7 of them and filesize < 1785856
 }
 rule MALPEDIA_Win_Brutpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb6abccd-59b3-5a30-9e67-ccbe498737a5"
+		id = "afec37c8-1f13-5db9-a13e-d0840174d51a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brutpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.brutpos_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "89d0bc6a7e52ba9f63dface96ebbf483b03be0cbf8144ed32f3b88bf360b4eda"
+		logic_hash = "v1_sha256_89d0bc6a7e52ba9f63dface96ebbf483b03be0cbf8144ed32f3b88bf360b4eda"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148712,20 +148782,20 @@ rule MALPEDIA_Win_Brutpos_Auto : FILE
 		$sequence_9 = { 8b5508 8b4204 0fb70a 50 51 807401ff97 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Warhawk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d92d335d-f362-53f6-93fa-a01200e00bae"
+		id = "0ebb0da9-c667-54f4-b2c8-3db66f24538c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.warhawk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.warhawk_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "d9e9a0b8b1caa43bf9cbeab42b90b2f052f6c3a1e02d41041e6ffa8282518c4f"
+		logic_hash = "v1_sha256_d9e9a0b8b1caa43bf9cbeab42b90b2f052f6c3a1e02d41041e6ffa8282518c4f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148751,20 +148821,20 @@ rule MALPEDIA_Win_Warhawk_Auto : FILE
 		$sequence_9 = { eb49 b9???????? 8bc2 8a18 3a19 885dfb bb00000000 }
 
 	condition:
-		7 of them and filesize <2345984
+		7 of them and filesize < 2345984
 }
 rule MALPEDIA_Win_Nightsky_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4a533df6-d2c4-5b9b-962a-f564ffc19b28"
+		id = "7b7f44d7-d36d-5641-9a52-615f60737c19"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightsky"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nightsky_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "8ca19ad5375675bc771b33a25611cc75796ee0768ba76a94df6cf267eb73de25"
+		logic_hash = "v1_sha256_8ca19ad5375675bc771b33a25611cc75796ee0768ba76a94df6cf267eb73de25"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148790,20 +148860,20 @@ rule MALPEDIA_Win_Nightsky_Auto : FILE
 		$sequence_9 = { 418bca 48c1e910 83e13f 4533848ea0700400 418bca 48c1e908 4183e23f }
 
 	condition:
-		7 of them and filesize <19536896
+		7 of them and filesize < 19536896
 }
 rule MALPEDIA_Win_Unidentified_087_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb2770ef-ba3c-5373-be21-3fb31c73a40c"
+		id = "61f2a49b-fb0c-5ace-abf0-db6f11b92f9f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_087"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_087_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "10f141206749e7e53bb829c93df64c19732ef1dad0c95b847ac5042b772c3c95"
+		logic_hash = "v1_sha256_10f141206749e7e53bb829c93df64c19732ef1dad0c95b847ac5042b772c3c95"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148835,20 +148905,20 @@ rule MALPEDIA_Win_Unidentified_087_Auto : FILE
 		$sequence_15 = { 0fb685e6feffff 0fb68de5feffff 52 0fb695e4feffff 50 }
 
 	condition:
-		7 of them and filesize <462848
+		7 of them and filesize < 462848
 }
 rule MALPEDIA_Win_Silon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "79ca4e66-80c4-54d1-ad2d-bb8c124436f4"
+		id = "f7b7af5d-47db-5e40-a65a-e4e1d2b64721"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.silon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.silon_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "874421a098d05c259305f60b2d95c6c3b7ec16195697a960df4680d8169470c0"
+		logic_hash = "v1_sha256_874421a098d05c259305f60b2d95c6c3b7ec16195697a960df4680d8169470c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148874,20 +148944,20 @@ rule MALPEDIA_Win_Silon_Auto : FILE
 		$sequence_9 = { 8b4dfc 8b9058080000 2b915c080000 8b450c 395018 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Aytoke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b5ab25e2-4341-5ae9-b651-f00d8ee54d3c"
+		id = "c76f72f2-92af-5530-9087-b7c78cf6d19e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aytoke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.aytoke_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "fd830f88f9db36bca6c8ff77c03edf20db894b0cd51609c00e9abcdd21defeac"
+		logic_hash = "v1_sha256_fd830f88f9db36bca6c8ff77c03edf20db894b0cd51609c00e9abcdd21defeac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148913,20 +148983,20 @@ rule MALPEDIA_Win_Aytoke_Auto : FILE
 		$sequence_9 = { 46 eb18 b801000000 3bc8 7c0f 3b1485989c4100 7501 }
 
 	condition:
-		7 of them and filesize <425984
+		7 of them and filesize < 425984
 }
 rule MALPEDIA_Win_Cobint_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dd3cfa53-3afd-5f13-9cc9-77e829d3a136"
+		id = "6458d531-aa75-5422-b324-1c12226f26c0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobint"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cobint_auto.yar#L1-L242"
 		license_url = "N/A"
-		logic_hash = "20f11bf7d864567f810adcdb08276a34acb4cfe1ecb4d7216907f33469c0f11b"
+		logic_hash = "v1_sha256_20f11bf7d864567f810adcdb08276a34acb4cfe1ecb4d7216907f33469c0f11b"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -148966,20 +149036,20 @@ rule MALPEDIA_Win_Cobint_Auto : FILE
 		$sequence_23 = { bffc807c28 1a807c170e81 7cd7 9b 807c909090 90 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Netwire_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2c3233b5-61d2-5539-be18-0c5c0b8c6392"
+		id = "57957c09-a49a-56ce-ac61-f4310bba33a6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netwire"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.netwire_auto.yar#L1-L110"
 		license_url = "N/A"
-		logic_hash = "0b138a1b5ce5fce5b2fe27d94e6291c8b6ec4ddfb907147d54fe206b7b73d328"
+		logic_hash = "v1_sha256_0b138a1b5ce5fce5b2fe27d94e6291c8b6ec4ddfb907147d54fe206b7b73d328"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149005,20 +149075,20 @@ rule MALPEDIA_Win_Netwire_Auto : FILE
 		$sequence_9 = { a3???????? e9???????? c705????????00000000 e9???????? c7042410020000 }
 
 	condition:
-		7 of them and filesize <416768
+		7 of them and filesize < 416768
 }
 rule MALPEDIA_Win_Highnote_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "42430ae0-711a-5af0-8cf0-021ee7268750"
+		id = "32e61eeb-a6b9-5d0d-b2a1-1023ecead382"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.highnote"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.highnote_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "9c56af2f565860a63358a81454cb924c53c1536bda24fa1a3a598c536c013797"
+		logic_hash = "v1_sha256_9c56af2f565860a63358a81454cb924c53c1536bda24fa1a3a598c536c013797"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149044,20 +149114,20 @@ rule MALPEDIA_Win_Highnote_Auto : FILE
 		$sequence_9 = { 3cff 145d 853e 235ee7 }
 
 	condition:
-		7 of them and filesize <321536
+		7 of them and filesize < 321536
 }
 rule MALPEDIA_Win_Cerber_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8ad318b2-fd4e-5d92-a12e-9e1971af4667"
+		id = "86800e0d-80e9-5d62-823b-23a665fb3da5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cerber"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cerber_auto.yar#L1-L103"
 		license_url = "N/A"
-		logic_hash = "ae8e4dedfae2653bfc99d378ae78948f80a8248c771063fd5aaf09788296968e"
+		logic_hash = "v1_sha256_ae8e4dedfae2653bfc99d378ae78948f80a8248c771063fd5aaf09788296968e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149081,20 +149151,20 @@ rule MALPEDIA_Win_Cerber_Auto : FILE
 		$sequence_7 = { 8b5d08 8bc3 c1e002 50 ff750c e8???????? }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize < 573440
 }
 rule MALPEDIA_Win_Zeus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4fe3f9dd-2485-552f-9a89-ff72673ef49c"
+		id = "60ee791a-83bf-5453-a098-f33879806498"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zeus_auto.yar#L1-L222"
 		license_url = "N/A"
-		logic_hash = "5c96f3aec91f480609a26c2c5106b944c5143184de972e1c667aa8b1ec8b4815"
+		logic_hash = "v1_sha256_5c96f3aec91f480609a26c2c5106b944c5143184de972e1c667aa8b1ec8b4815"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -149133,20 +149203,20 @@ rule MALPEDIA_Win_Zeus_Auto : FILE
 		$sequence_22 = { b809080002 3945f4 7713 807d0801 0f8598000000 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize < 319488
 }
 rule MALPEDIA_Win_Megacortex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ada38623-7613-5dfe-bdcd-0251e4cadd44"
+		id = "bc2d4c61-efe6-547c-84bb-99a81fc19a0d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.megacortex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.megacortex_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "708d38e954539c490225999d6efcff9513f99a24765329194cd39e598c2360c1"
+		logic_hash = "v1_sha256_708d38e954539c490225999d6efcff9513f99a24765329194cd39e598c2360c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149172,20 +149242,20 @@ rule MALPEDIA_Win_Megacortex_Auto : FILE
 		$sequence_9 = { e8???????? 8d4598 c645fc05 50 8d45d8 83cb0a 50 }
 
 	condition:
-		7 of them and filesize <1556480
+		7 of them and filesize < 1556480
 }
 rule MALPEDIA_Win_Oddjob_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "32aa97fe-459e-54bb-b312-8c16abdd023e"
+		id = "3d7aba48-e344-588c-8be1-07f3a125e99e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oddjob"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.oddjob_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "c90a8570c9226524a00ad8a64dc22040d6bcfc4b7b8994bff5525418a1842496"
+		logic_hash = "v1_sha256_c90a8570c9226524a00ad8a64dc22040d6bcfc4b7b8994bff5525418a1842496"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149211,20 +149281,20 @@ rule MALPEDIA_Win_Oddjob_Auto : FILE
 		$sequence_9 = { e8???????? ff75f0 d1eb 53 57 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize < 221184
 }
 rule MALPEDIA_Win_Classfon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a25f42c4-4355-51f7-b6ab-00b467c76376"
+		id = "69a2fdb6-528d-5155-a586-b6aa5d8d8f9a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.classfon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.classfon_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "66ac3b2c234be6c5adfcd77cebd772d5254febc41066bba0a145357a351f1537"
+		logic_hash = "v1_sha256_66ac3b2c234be6c5adfcd77cebd772d5254febc41066bba0a145357a351f1537"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149250,20 +149320,20 @@ rule MALPEDIA_Win_Classfon_Auto : FILE
 		$sequence_9 = { 5f 5e 5b 81c418020000 c3 5f }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Newcore_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1da70a7f-a318-54ce-916c-cf7245c92f4f"
+		id = "59013bac-5647-55c7-aa35-6bbf37a758e8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newcore_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.newcore_rat_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "4e9038b9cb3dfc5a1f725a1c7c7f2099a8bbce01f729092f2f2495b7d4912fe0"
+		logic_hash = "v1_sha256_4e9038b9cb3dfc5a1f725a1c7c7f2099a8bbce01f729092f2f2495b7d4912fe0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149289,20 +149359,20 @@ rule MALPEDIA_Win_Newcore_Rat_Auto : FILE
 		$sequence_9 = { 8bb42450020000 8bd8 8b442418 50 6a32 8d7b34 b904010000 }
 
 	condition:
-		7 of them and filesize <581632
+		7 of them and filesize < 581632
 }
 rule MALPEDIA_Win_Maggie_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0ba792f1-dd78-5b98-8593-543560b6dc1a"
+		id = "c9881719-23b8-5ad3-8e01-0833c99e7def"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maggie"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.maggie_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "f79cbc6ae2d70c9e6484e5066353afb6506cea51f8ea75e10ee4458493abfd34"
+		logic_hash = "v1_sha256_f79cbc6ae2d70c9e6484e5066353afb6506cea51f8ea75e10ee4458493abfd34"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149328,20 +149398,20 @@ rule MALPEDIA_Win_Maggie_Auto : FILE
 		$sequence_9 = { b8ff000000 663b05???????? 7505 e8???????? e8???????? }
 
 	condition:
-		7 of them and filesize <611328
+		7 of them and filesize < 611328
 }
 rule MALPEDIA_Win_Godzilla_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9353009a-9ab6-50d2-b27c-912bbfae24ce"
+		id = "41da1397-135b-5a47-a2ce-811200f05191"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.godzilla_loader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.godzilla_loader_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "15db96ce18a2f3fdeaf72974bdf0f4fdfaa545b5ea238cf268df493277052de4"
+		logic_hash = "v1_sha256_15db96ce18a2f3fdeaf72974bdf0f4fdfaa545b5ea238cf268df493277052de4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149367,20 +149437,20 @@ rule MALPEDIA_Win_Godzilla_Loader_Auto : FILE
 		$sequence_9 = { 50 57 6a01 56 ff7508 8975fc ff15???????? }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Blackcat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96a105c9-de9b-58fc-9332-46741d0ee4b6"
+		id = "dd12af1b-62b9-57dd-97cf-b509aff96cf3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blackcat_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "ca17c8ec53cce7ae9541a2b17fcd5b20eeda404acb33b9d6489549a59a5a4868"
+		logic_hash = "v1_sha256_ca17c8ec53cce7ae9541a2b17fcd5b20eeda404acb33b9d6489549a59a5a4868"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149406,20 +149476,20 @@ rule MALPEDIA_Win_Blackcat_Auto : FILE
 		$sequence_9 = { 56 83ec10 89ce 8b4a04 }
 
 	condition:
-		7 of them and filesize <29981696
+		7 of them and filesize < 29981696
 }
 rule MALPEDIA_Win_Httpsuploader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "be17d448-1d90-5f75-8f13-d63b39944dc3"
+		id = "cb1020cc-79ed-521b-bda1-bce5aab10d78"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpsuploader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.httpsuploader_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "5be7e6e5938fcb4fa9787510fb0867a1f442345e4d8453db75c177a24413afa4"
+		logic_hash = "v1_sha256_5be7e6e5938fcb4fa9787510fb0867a1f442345e4d8453db75c177a24413afa4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149445,20 +149515,20 @@ rule MALPEDIA_Win_Httpsuploader_Auto : FILE
 		$sequence_9 = { 745e 6666660f1f840000000000 488b0d???????? 488d542440 4533c9 4533c0 ff15???????? }
 
 	condition:
-		7 of them and filesize <190464
+		7 of them and filesize < 190464
 }
 rule MALPEDIA_Win_Corebot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3997db80-c772-5b73-a963-36ab17758ace"
+		id = "5227a3de-c7f7-5dd6-8576-1aa6a2e3e765"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.corebot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.corebot_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "39cc93a6c914fbc005d1108deabcbfdb71a7ef825d8251a576b5ab326c580118"
+		logic_hash = "v1_sha256_39cc93a6c914fbc005d1108deabcbfdb71a7ef825d8251a576b5ab326c580118"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149490,20 +149560,20 @@ rule MALPEDIA_Win_Corebot_Auto : FILE
 		$sequence_15 = { 85c0 7515 8b4624 3b4620 }
 
 	condition:
-		7 of them and filesize <1302528
+		7 of them and filesize < 1302528
 }
 rule MALPEDIA_Win_Stop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "de89cbb5-1ad4-59ee-8eda-db1d3b1226e9"
+		id = "6e712ff8-9881-5ab0-bd2e-92b36a2402f1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stop_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "1680007e54c6e417cda892af6931e2e17f934d49d2fb7326d537897be6e026a2"
+		logic_hash = "v1_sha256_1680007e54c6e417cda892af6931e2e17f934d49d2fb7326d537897be6e026a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149529,20 +149599,20 @@ rule MALPEDIA_Win_Stop_Auto : FILE
 		$sequence_9 = { 75e8 6a0a ff7304 ff15???????? 3d02010000 74c4 }
 
 	condition:
-		7 of them and filesize <6029312
+		7 of them and filesize < 6029312
 }
 rule MALPEDIA_Win_Ntospy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b4a63087-adf5-553a-badd-9c3b2b74fa54"
+		id = "71b76504-eafe-50cf-8f52-21b6495d196f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ntospy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ntospy_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "cce1d343f3ff134391791227274b4a5b285b13f3052430b7eb6796387898d86b"
+		logic_hash = "v1_sha256_cce1d343f3ff134391791227274b4a5b285b13f3052430b7eb6796387898d86b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149568,20 +149638,20 @@ rule MALPEDIA_Win_Ntospy_Auto : FILE
 		$sequence_9 = { 4c8d2dcaf80000 448bf3 498bc5 8d6b01 3938 }
 
 	condition:
-		7 of them and filesize <208896
+		7 of them and filesize < 208896
 }
 rule MALPEDIA_Win_Innaput_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8696fe6d-5c5e-50d1-8126-e510e7272553"
+		id = "751ac78f-e4a8-51b8-ac5e-190c36a0784d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.innaput_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.innaput_rat_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "9fc4a0f22b0936282c888c32e9151fce9421447e6433604a7df7c0949331d6ed"
+		logic_hash = "v1_sha256_9fc4a0f22b0936282c888c32e9151fce9421447e6433604a7df7c0949331d6ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149607,20 +149677,20 @@ rule MALPEDIA_Win_Innaput_Rat_Auto : FILE
 		$sequence_9 = { 391e 75fa 6a0c ff5704 59 8906 3bc3 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Hunter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "114c619e-d3db-54d7-bef7-7645d901bc94"
+		id = "2aac78f8-645c-5712-a8b3-30997e5e96ea"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hunter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hunter_auto.yar#L1-L90"
 		license_url = "N/A"
-		logic_hash = "776a5d8eb049aeb15b1138e40f903b0e7294cf0475240df008d707aa37c36610"
+		logic_hash = "v1_sha256_776a5d8eb049aeb15b1138e40f903b0e7294cf0475240df008d707aa37c36610"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149644,20 +149714,20 @@ rule MALPEDIA_Win_Hunter_Auto : FILE
 		$sequence_7 = { 00443907 8a043a 88043b 8a443a01 }
 
 	condition:
-		7 of them and filesize <1056768
+		7 of them and filesize < 1056768
 }
 rule MALPEDIA_Win_Gophe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ec866cdd-740c-530f-890b-7218c8279731"
+		id = "d41d4706-0fd5-5f02-8360-c600b11108df"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gophe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gophe_auto.yar#L1-L160"
 		license_url = "N/A"
-		logic_hash = "040add08167375d6afc19889da745c342bfdae4cd932188be1ff896b4e36f3aa"
+		logic_hash = "v1_sha256_040add08167375d6afc19889da745c342bfdae4cd932188be1ff896b4e36f3aa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149689,20 +149759,20 @@ rule MALPEDIA_Win_Gophe_Auto : FILE
 		$sequence_15 = { c7000300150c 488b4210 c7400801000000 488b4210 }
 
 	condition:
-		7 of them and filesize <1582080
+		7 of them and filesize < 1582080
 }
 rule MALPEDIA_Win_Caddywiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a5109c69-dce6-5bdc-a837-95fd9e608c27"
+		id = "74642776-d252-5710-bdd3-1b19b140a83d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.caddywiper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.caddywiper_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "e3d56965e8598d86c97b50c37aebd90c5841d385e5b67b4fcd4ffac110956cd1"
+		logic_hash = "v1_sha256_e3d56965e8598d86c97b50c37aebd90c5841d385e5b67b4fcd4ffac110956cd1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149728,20 +149798,20 @@ rule MALPEDIA_Win_Caddywiper_Auto : FILE
 		$sequence_9 = { c645eb00 c645ec65 c645ed00 c645ee6c }
 
 	condition:
-		7 of them and filesize <33792
+		7 of them and filesize < 33792
 }
 rule MALPEDIA_Win_Spaceship_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cf82a1e6-2655-5412-8f93-024883bc5cc4"
+		id = "e5f9c3e6-d34a-549a-815c-65d822e8f30f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spaceship"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spaceship_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "c325451a252fdb438f6f512d14d550b1461b33c1e3170612d6dfec64ac9a2b26"
+		logic_hash = "v1_sha256_c325451a252fdb438f6f512d14d550b1461b33c1e3170612d6dfec64ac9a2b26"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149767,20 +149837,20 @@ rule MALPEDIA_Win_Spaceship_Auto : FILE
 		$sequence_9 = { f2ae f7d1 2bf9 8bc1 8bf7 8bfa 8b942470060000 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Backbend_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a22a893e-f0d0-5f47-b17e-12aba9db7e5e"
+		id = "e4ee50b8-62ce-58b4-9ba0-5fd0ca77fbb9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backbend"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.backbend_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "917ffc9b273790f466925eaea42d05e106cbb5d93ffca6efcba917e5ff6beb38"
+		logic_hash = "v1_sha256_917ffc9b273790f466925eaea42d05e106cbb5d93ffca6efcba917e5ff6beb38"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149806,20 +149876,20 @@ rule MALPEDIA_Win_Backbend_Auto : FILE
 		$sequence_9 = { 57 e8???????? 83c410 6860ea0000 ffd6 33c0 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Shifu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "48f59764-98d3-5e1f-a9c7-a0c8becc007a"
+		id = "4e2848b2-64a0-522b-bddf-400f5c4637f2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shifu"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shifu_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "6ab041a16a39f77276573be25c06c5ab679b44b2bef49091360ddb3582fc5f89"
+		logic_hash = "v1_sha256_6ab041a16a39f77276573be25c06c5ab679b44b2bef49091360ddb3582fc5f89"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149845,20 +149915,20 @@ rule MALPEDIA_Win_Shifu_Auto : FILE
 		$sequence_9 = { d1e8 8bf0 eb05 85db 7401 4b 83fb01 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize < 344064
 }
 rule MALPEDIA_Win_Alpc_Lpe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2d2adcb6-f098-569a-bf85-49ff70d8e48c"
+		id = "60cd2da1-59d0-520e-a38e-76f948e75225"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alpc_lpe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.alpc_lpe_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "f41b95cac61aef76c7f2f31b4e9f327d93351cd15a34ca1f25e406b880001510"
+		logic_hash = "v1_sha256_f41b95cac61aef76c7f2f31b4e9f327d93351cd15a34ca1f25e406b880001510"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149884,20 +149954,20 @@ rule MALPEDIA_Win_Alpc_Lpe_Auto : FILE
 		$sequence_9 = { 4c8d4dbf 33d2 4c8d05cc7e0000 488bcf ffd3 85c0 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Pgift_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5134e180-c701-504d-b27b-1f2a37782304"
+		id = "331425ac-3ef4-54a9-ad92-e2de966c6eb9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pgift"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pgift_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "86543d2a9c2965bb35bf9078bd182bce16bae717918e12d47f187ce1755d9b8f"
+		logic_hash = "v1_sha256_86543d2a9c2965bb35bf9078bd182bce16bae717918e12d47f187ce1755d9b8f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149923,20 +149993,20 @@ rule MALPEDIA_Win_Pgift_Auto : FILE
 		$sequence_9 = { e8???????? ff75e8 ff15???????? eb53 8b45ec 3958f8 742f }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Fk_Undead_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "09ebce3e-04fb-58d5-b09d-0377a5f5743c"
+		id = "63b7b953-7efc-57e4-aa47-1f579e883217"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fk_undead"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fk_undead_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "abdf12f66e02014f48d8c0536c0de5b8efd3d3aad1408262170db0f8bbb09349"
+		logic_hash = "v1_sha256_abdf12f66e02014f48d8c0536c0de5b8efd3d3aad1408262170db0f8bbb09349"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149962,20 +150032,20 @@ rule MALPEDIA_Win_Fk_Undead_Auto : FILE
 		$sequence_9 = { 7414 8bd1 c1f805 83e21f c1e206 031485e0650a10 eb02 }
 
 	condition:
-		7 of them and filesize <1418240
+		7 of them and filesize < 1418240
 }
 rule MALPEDIA_Win_Ninerat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "56fcbf79-427d-50d3-bca3-31de15eac399"
+		id = "8d0c1425-f81c-55ad-b5ef-c23bb1f341da"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ninerat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ninerat_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "7c80943a7e234598d055453bf04aeb26119fa41707d1bc3f20d9f334282eb72d"
+		logic_hash = "v1_sha256_7c80943a7e234598d055453bf04aeb26119fa41707d1bc3f20d9f334282eb72d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150007,20 +150077,20 @@ rule MALPEDIA_Win_Ninerat_Auto : FILE
 		$sequence_15 = { e8???????? 4c896c2450 488b442450 4889842430010000 }
 
 	condition:
-		7 of them and filesize <7709696
+		7 of them and filesize < 7709696
 }
 rule MALPEDIA_Win_Portstarter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "87b6322a-7ef6-5bd0-bab4-2d7f3526e302"
+		id = "1ddfbb80-0e58-59f3-a2ac-4adf84c56f9b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.portstarter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.portstarter_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "370c6c0b9e8b4d5e29811c239d93b7467412e95f00ce8f657934e0617f7c9264"
+		logic_hash = "v1_sha256_370c6c0b9e8b4d5e29811c239d93b7467412e95f00ce8f657934e0617f7c9264"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150046,20 +150116,20 @@ rule MALPEDIA_Win_Portstarter_Auto : FILE
 		$sequence_9 = { bb00001000 e8???????? 4c89c0 4889d9 e8???????? 4889da bb00001000 }
 
 	condition:
-		7 of them and filesize <14144512
+		7 of them and filesize < 14144512
 }
 rule MALPEDIA_Win_Aperetif_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "795b83b3-4cb3-590f-beec-45294ced14b3"
+		id = "838286a7-89f9-59c1-b04e-2fbaa1c6b646"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aperetif"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.aperetif_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "9b2b21b13b2a3f0effe3ce03cc46e7cfe39d710a1bc6f103bbb173ad06ff9edf"
+		logic_hash = "v1_sha256_9b2b21b13b2a3f0effe3ce03cc46e7cfe39d710a1bc6f103bbb173ad06ff9edf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150085,20 +150155,20 @@ rule MALPEDIA_Win_Aperetif_Auto : FILE
 		$sequence_9 = { ff742448 ff742424 ff742448 53 e8???????? 83c414 85c0 }
 
 	condition:
-		7 of them and filesize <10500096
+		7 of them and filesize < 10500096
 }
 rule MALPEDIA_Win_Outlook_Backdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02559762-15b6-5207-804c-a16ddeee8406"
+		id = "cf68a4e7-3dfe-5664-a150-9f8d4c382ad2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.outlook_backdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.outlook_backdoor_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "3a281d78de1c71eb339e38944e06a51b382bc71a750ef84181f02e7a83ac1311"
+		logic_hash = "v1_sha256_3a281d78de1c71eb339e38944e06a51b382bc71a750ef84181f02e7a83ac1311"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150124,20 +150194,20 @@ rule MALPEDIA_Win_Outlook_Backdoor_Auto : FILE
 		$sequence_9 = { 57 8b7d10 8945e8 8b4518 895de0 897de4 8945ec }
 
 	condition:
-		7 of them and filesize <2912256
+		7 of them and filesize < 2912256
 }
 rule MALPEDIA_Win_Invisimole_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "55a375db-e677-582e-bce8-b3a68908eaf5"
+		id = "67a0d721-1b35-5937-8292-464488152692"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.invisimole"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.invisimole_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "8f39140cf09da2962c64c906a5e356fe5a001c88884a167cc322923fa7d9bdf4"
+		logic_hash = "v1_sha256_8f39140cf09da2962c64c906a5e356fe5a001c88884a167cc322923fa7d9bdf4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150163,20 +150233,20 @@ rule MALPEDIA_Win_Invisimole_Auto : FILE
 		$sequence_9 = { ff15???????? 8b4c2414 668944cf04 8b44241c 41 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Rumish_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "39ff2947-af25-5616-8af4-3255d7aff8f4"
+		id = "060bb356-a9fc-54be-887f-b4b56f40d269"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rumish"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rumish_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "a573540e20ab8e039d32cb674dc87b90cf57e8c3eeb462c1c864991bf4880267"
+		logic_hash = "v1_sha256_a573540e20ab8e039d32cb674dc87b90cf57e8c3eeb462c1c864991bf4880267"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150202,20 +150272,20 @@ rule MALPEDIA_Win_Rumish_Auto : FILE
 		$sequence_9 = { d918 8b8dc4feffff d901 dc1d???????? dfe0 f6c444 7b11 }
 
 	condition:
-		7 of them and filesize <770048
+		7 of them and filesize < 770048
 }
 rule MALPEDIA_Win_Grateful_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9ee923d9-386a-5d32-9440-a8b85e81712d"
+		id = "0be6344b-1f63-5544-a45c-1cd89d6ba2a3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grateful_pos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.grateful_pos_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "ee462fd47d72681e88085a94b5322cb383fccf63de7910d0f50a42105a7d61e3"
+		logic_hash = "v1_sha256_ee462fd47d72681e88085a94b5322cb383fccf63de7910d0f50a42105a7d61e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150247,20 +150317,20 @@ rule MALPEDIA_Win_Grateful_Pos_Auto : FILE
 		$sequence_15 = { 03d0 69d290010000 3bca 7414 488d3db7b5feff 4963e9 448b94af14690300 }
 
 	condition:
-		7 of them and filesize <3964928
+		7 of them and filesize < 3964928
 }
 rule MALPEDIA_Win_Kwampirs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c831c38-f3af-5c4b-940a-effdace44ac1"
+		id = "d70d2ab2-210f-5a0d-aea8-f77c96b878de"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kwampirs"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kwampirs_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "05da0209b4ac4234af04c94a25b568ea854e2af3b982527383637ef20b197483"
+		logic_hash = "v1_sha256_05da0209b4ac4234af04c94a25b568ea854e2af3b982527383637ef20b197483"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150286,20 +150356,20 @@ rule MALPEDIA_Win_Kwampirs_Auto : FILE
 		$sequence_9 = { 56 8b0f 51 e8???????? 83c418 85c0 }
 
 	condition:
-		7 of them and filesize <2695168
+		7 of them and filesize < 2695168
 }
 rule MALPEDIA_Win_Purplefox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e0153672-5fee-5a98-93dd-cdb37613f00c"
+		id = "aaae760e-0e97-5c3d-8bdf-4e41de524280"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplefox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.purplefox_auto.yar#L1-L389"
 		license_url = "N/A"
-		logic_hash = "bc347e2a2c2675d6f613a457b6f24810b2ee549a3110e9ad4ab849ea2adb4170"
+		logic_hash = "v1_sha256_bc347e2a2c2675d6f613a457b6f24810b2ee549a3110e9ad4ab849ea2adb4170"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -150355,20 +150425,20 @@ rule MALPEDIA_Win_Purplefox_Auto : FILE
 		$sequence_39 = { 48895c2418 55 56 57 4883ec30 488d3da9b40000 33ed }
 
 	condition:
-		7 of them and filesize <1983488
+		7 of them and filesize < 1983488
 }
 rule MALPEDIA_Win_Explosive_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7b0d5ce8-6828-5e32-af59-28d083ff4edd"
+		id = "9bf65318-914b-5762-b7d7-0e9a514c476c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.explosive_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.explosive_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "40a44221da76d27c5ed05de925a337ead09b51104536f440f38ebfb4960fa91d"
+		logic_hash = "v1_sha256_40a44221da76d27c5ed05de925a337ead09b51104536f440f38ebfb4960fa91d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150394,20 +150464,20 @@ rule MALPEDIA_Win_Explosive_Rat_Auto : FILE
 		$sequence_9 = { 52 e8???????? 83c40c 85c0 745d 8bc8 57 }
 
 	condition:
-		7 of them and filesize <855040
+		7 of them and filesize < 855040
 }
 rule MALPEDIA_Win_Roopy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9d1cd38d-a1c4-5021-82c4-ab42553b0148"
+		id = "c94f76d0-8c84-5e1b-bee4-b0bee9e665f2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roopy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.roopy_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "635b23691aea648c5b01623163933331eba5c241a10085695aa02ee95522aae1"
+		logic_hash = "v1_sha256_635b23691aea648c5b01623163933331eba5c241a10085695aa02ee95522aae1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150433,20 +150503,20 @@ rule MALPEDIA_Win_Roopy_Auto : FILE
 		$sequence_9 = { 8d858cfcffff 30c9 6631d2 e8???????? 0fb785a4fcffff 68ff000000 8d8d70fbffff }
 
 	condition:
-		7 of them and filesize <739328
+		7 of them and filesize < 739328
 }
 rule MALPEDIA_Win_Buhtrap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "05dfe1b7-7658-5a73-95c7-d9332b18397d"
+		id = "5b4b10ee-def2-5989-b13d-0f364333b76d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buhtrap"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.buhtrap_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "93883b1f6de8bbb29347fc147d93effe74e75beef64981374094d11349e65af7"
+		logic_hash = "v1_sha256_93883b1f6de8bbb29347fc147d93effe74e75beef64981374094d11349e65af7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150477,20 +150547,20 @@ rule MALPEDIA_Win_Buhtrap_Auto : FILE
 		$sequence_14 = { 59 84c0 0f84a3000000 6a10 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Stabuniq_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aceb592e-d7b5-5f4a-8a9e-1d7eba65be7f"
+		id = "490297b0-e3ca-5b8e-b0fd-c03252e9f514"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stabuniq"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stabuniq_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "8abe8b1e5433d79ecca06d79534ec6148ee9460e9d28a8041508dc1cd6d954c1"
+		logic_hash = "v1_sha256_8abe8b1e5433d79ecca06d79534ec6148ee9460e9d28a8041508dc1cd6d954c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150516,20 +150586,20 @@ rule MALPEDIA_Win_Stabuniq_Auto : FILE
 		$sequence_9 = { ff9098010000 8b4d20 83790800 7513 8b5520 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Powerpool_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4c6bacc6-3c31-5308-8644-c77bb5f04b3b"
+		id = "6b03195a-f2c0-54c1-a01d-d020e615fb7d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerpool"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.powerpool_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "fc225d3ab668ac0553c91764abb5591ff765822f57f79bb166f528bf2dc805b8"
+		logic_hash = "v1_sha256_fc225d3ab668ac0553c91764abb5591ff765822f57f79bb166f528bf2dc805b8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150561,20 +150631,20 @@ rule MALPEDIA_Win_Powerpool_Auto : FILE
 		$sequence_15 = { 005311 40 005d11 40 006711 }
 
 	condition:
-		7 of them and filesize <819200
+		7 of them and filesize < 819200
 }
 rule MALPEDIA_Win_Waterspout_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "312b289d-c89a-504c-8e5c-23fd2356f776"
+		id = "6e9dd747-7499-596a-84d9-0616cf5d92d1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.waterspout"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.waterspout_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "ca34650795bef65f517e7b6e56e86508cb7b6332fa50178472230b7d745dfa16"
+		logic_hash = "v1_sha256_ca34650795bef65f517e7b6e56e86508cb7b6332fa50178472230b7d745dfa16"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150600,20 +150670,20 @@ rule MALPEDIA_Win_Waterspout_Auto : FILE
 		$sequence_9 = { 8d7c241c 6804010000 f3ab b9fc070000 8dbc24a0230000 f3ab }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Roll_Sling_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b7e33442-8180-54e6-9eaf-af122cb4c9a7"
+		id = "4c3bae15-ac91-528d-8337-6d63f83ab01e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roll_sling"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.roll_sling_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "9fbb0c1a994cbf47daa8ad072c8bc3b15bcfbdc43d87e63c5668a5130ba7c10c"
+		logic_hash = "v1_sha256_9fbb0c1a994cbf47daa8ad072c8bc3b15bcfbdc43d87e63c5668a5130ba7c10c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150639,20 +150709,20 @@ rule MALPEDIA_Win_Roll_Sling_Auto : FILE
 		$sequence_9 = { 4d0bf0 458b4550 418bf8 f7df 4923fe }
 
 	condition:
-		7 of them and filesize <299008
+		7 of them and filesize < 299008
 }
 rule MALPEDIA_Win_Upas_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff6fa077-a4cc-5245-b43e-d462dbb909cf"
+		id = "60d61bbc-751e-57de-be13-c7613d0d7314"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.upas"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.upas_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "2dbc02d44bc44069a95867e1264648df697162b7220114880dd132223d4a0c26"
+		logic_hash = "v1_sha256_2dbc02d44bc44069a95867e1264648df697162b7220114880dd132223d4a0c26"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150678,20 +150748,20 @@ rule MALPEDIA_Win_Upas_Auto : FILE
 		$sequence_9 = { 897dfc e8???????? 59 8bc8 8945ec }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Cameleon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "806efc2e-ee4f-5af0-8004-774edaa0c90c"
+		id = "0d8cec30-8baa-5b96-9dff-f09e5e732875"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cameleon_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "98c6fbda2b8586d2f1ae140ba5c66b5e26a402ce2bed7b89a93ce40a7f3c9c1d"
+		logic_hash = "v1_sha256_98c6fbda2b8586d2f1ae140ba5c66b5e26a402ce2bed7b89a93ce40a7f3c9c1d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150717,20 +150787,20 @@ rule MALPEDIA_Win_Cameleon_Auto : FILE
 		$sequence_9 = { c645fc19 ba02000000 e9???????? 68???????? }
 
 	condition:
-		7 of them and filesize <824320
+		7 of them and filesize < 824320
 }
 rule MALPEDIA_Win_Unidentified_069_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e6d12ecf-2105-5a78-ac5d-ef3697e64524"
+		id = "c74a5bfb-c56e-58d1-b442-eda87175edce"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_069"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_069_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "ca9594399e09dcc31b85088d5c725560cc890838ff6242191d21562960d61f9b"
+		logic_hash = "v1_sha256_ca9594399e09dcc31b85088d5c725560cc890838ff6242191d21562960d61f9b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150756,20 +150826,20 @@ rule MALPEDIA_Win_Unidentified_069_Auto : FILE
 		$sequence_9 = { 8d856cfeffff 50 e8???????? 8bcf 899de0fdffff }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize < 434176
 }
 rule MALPEDIA_Win_Saint_Bot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "92ea573f-6995-5968-986f-4f6e838a873b"
+		id = "ef27ab33-fc34-54b5-9452-abef87b90a60"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.saint_bot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.saint_bot_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "8fc12017b3bbd916bf7702bbd87ca92c11f29e697b9a76fb35dc7516e7e5512c"
+		logic_hash = "v1_sha256_8fc12017b3bbd916bf7702bbd87ca92c11f29e697b9a76fb35dc7516e7e5512c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150795,20 +150865,20 @@ rule MALPEDIA_Win_Saint_Bot_Auto : FILE
 		$sequence_9 = { 59 59 85c0 7515 ff75f0 8d8544f0ffff }
 
 	condition:
-		7 of them and filesize <93184
+		7 of them and filesize < 93184
 }
 rule MALPEDIA_Win_Shadowhammer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b57d4c23-f9b4-522a-89ba-c4ac79dc31ec"
+		id = "43be02f3-4284-54bc-b509-d36f6f2574f6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowhammer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shadowhammer_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "9c0187702056fafb079efbd5dab5b93b10eb6c78f6f641de1a14fc5c3fa972f5"
+		logic_hash = "v1_sha256_9c0187702056fafb079efbd5dab5b93b10eb6c78f6f641de1a14fc5c3fa972f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150834,20 +150904,20 @@ rule MALPEDIA_Win_Shadowhammer_Auto : FILE
 		$sequence_9 = { 8955a0 c745a409da9df3 c745a8a050afad c745ac0df0ef96 c745b03b41b6e2 33c0 8d7db4 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Computrace_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7d3f36b5-1638-54d3-9aa2-d37f8e7401b6"
+		id = "3ab10cbc-15c9-5fe4-aca4-7c8225add349"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.computrace"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.computrace_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "b73f0b7c109f121cef0d44673877d18ab031d29ad8713526e9f7233d01c0d2e0"
+		logic_hash = "v1_sha256_b73f0b7c109f121cef0d44673877d18ab031d29ad8713526e9f7233d01c0d2e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150873,20 +150943,20 @@ rule MALPEDIA_Win_Computrace_Auto : FILE
 		$sequence_9 = { 837dfc00 74bb 53 e8???????? 8945f8 ff75fc }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Wannacryptor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "64c0c24a-16a6-55da-a692-97069f01b9dc"
+		id = "bb3b423e-7eb9-5942-b518-b3fadcc0f53a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wannacryptor_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "afdf6a6730d9f47a6baac4eceac9faa53fb74580c5a732dc9532925b43ed27e8"
+		logic_hash = "v1_sha256_afdf6a6730d9f47a6baac4eceac9faa53fb74580c5a732dc9532925b43ed27e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150912,20 +150982,20 @@ rule MALPEDIA_Win_Wannacryptor_Auto : FILE
 		$sequence_9 = { 8a1401 8d4c2460 8854243c 8b44243c }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Thanatos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a5721dfd-b447-5b95-8938-1157e68dfcc1"
+		id = "4fd57bca-e9ee-55ff-912d-d777ceb28ac1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.thanatos_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "53b5f2fa82e8c7501726e7b2943f1eca40b261bf73b7a493f709f61c94b8f1bb"
+		logic_hash = "v1_sha256_53b5f2fa82e8c7501726e7b2943f1eca40b261bf73b7a493f709f61c94b8f1bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150951,20 +151021,20 @@ rule MALPEDIA_Win_Thanatos_Auto : FILE
 		$sequence_9 = { 50 c745f45c400110 e8???????? cc 55 8bec }
 
 	condition:
-		7 of them and filesize <1810432
+		7 of them and filesize < 1810432
 }
 rule MALPEDIA_Win_Keyboy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e3c6834d-0c67-5748-994c-227d3722e6aa"
+		id = "e2f085d2-ee09-5b23-9e05-230c50dbc159"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keyboy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.keyboy_auto.yar#L1-L236"
 		license_url = "N/A"
-		logic_hash = "b020d013796e2ff9bcbc5f453861ded4cb6f63e612a44995496ca47a3bf65fc0"
+		logic_hash = "v1_sha256_b020d013796e2ff9bcbc5f453861ded4cb6f63e612a44995496ca47a3bf65fc0"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -151005,20 +151075,20 @@ rule MALPEDIA_Win_Keyboy_Auto : FILE
 		$sequence_24 = { 41 8a043e 0fbe4c8de0 3401 0fbec0 0fafc8 80f185 }
 
 	condition:
-		7 of them and filesize <2170880
+		7 of them and filesize < 2170880
 }
 rule MALPEDIA_Win_H1N1_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4f9432ad-24eb-5be0-8c5c-f54b004537b1"
+		id = "f5acab44-b273-5068-80b7-813fee699829"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.h1n1"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.h1n1_auto.yar#L1-L177"
 		license_url = "N/A"
-		logic_hash = "e395b19b788b5872e8b41a06c72576193d2b704eacffdfa539ea6dd0de9a681c"
+		logic_hash = "v1_sha256_e395b19b788b5872e8b41a06c72576193d2b704eacffdfa539ea6dd0de9a681c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151050,20 +151120,20 @@ rule MALPEDIA_Win_H1N1_Auto : FILE
 		$sequence_15 = { 8d85f0fdffff 68dc600010 6804010000 50 e8???????? 83c414 8d45fc }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize < 172032
 }
 rule MALPEDIA_Win_Remcom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef2d4f9d-a666-5fde-8a7c-ad9caf209507"
+		id = "71b609fc-a9a4-5ea4-9b67-569874f4adfb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.remcom_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "da940079f0fa67fd9b07a963cb1c1d587eae7e882a70fa0b1512503623264f37"
+		logic_hash = "v1_sha256_da940079f0fa67fd9b07a963cb1c1d587eae7e882a70fa0b1512503623264f37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151089,20 +151159,20 @@ rule MALPEDIA_Win_Remcom_Auto : FILE
 		$sequence_9 = { e8???????? 83c414 8b45fc ff34c52ce44000 53 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Pseudo_Manuscrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "42bd2b8b-9456-5653-89f8-7f91defd35ef"
+		id = "c09f21a5-d50f-55b6-984c-71afa2e51e22"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pseudo_manuscrypt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pseudo_manuscrypt_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "cbfecfd1106bc0d6ac7282a9292b2494a3e1d213712be19f881b75451b2a5e68"
+		logic_hash = "v1_sha256_cbfecfd1106bc0d6ac7282a9292b2494a3e1d213712be19f881b75451b2a5e68"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151128,20 +151198,20 @@ rule MALPEDIA_Win_Pseudo_Manuscrypt_Auto : FILE
 		$sequence_9 = { 6a06 6a01 50 ff15???????? 8bc8 894e1c 83f9ff }
 
 	condition:
-		7 of them and filesize <753664
+		7 of them and filesize < 753664
 }
 rule MALPEDIA_Win_Cadelspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "860c18ff-53ed-5d9c-b2bc-98b95f4d188d"
+		id = "6f45cd6e-2c7b-596f-8316-07ff8f4e87f3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cadelspy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cadelspy_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "b3c44a014ad2fbee54fda667170619e7a6ae94d19236eba6a66ccc77fd775cd1"
+		logic_hash = "v1_sha256_b3c44a014ad2fbee54fda667170619e7a6ae94d19236eba6a66ccc77fd775cd1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151167,20 +151237,20 @@ rule MALPEDIA_Win_Cadelspy_Auto : FILE
 		$sequence_9 = { 59 56 57 ff15???????? 68???????? e8???????? 68???????? }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Rorschach_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "11b24b2d-bfea-5a8c-988f-bea7ea32170c"
+		id = "c7f86b72-1f3e-5d2a-88ed-def8713577a5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rorschach"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rorschach_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "3819d2826273a95ad95ce552fb76b197f4eb30ddd0b4d089208f0442591f4b17"
+		logic_hash = "v1_sha256_3819d2826273a95ad95ce552fb76b197f4eb30ddd0b4d089208f0442591f4b17"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151206,20 +151276,20 @@ rule MALPEDIA_Win_Rorschach_Auto : FILE
 		$sequence_9 = { 8885f60b0000 b23c 488d8d300b0000 e8???????? 8885f70b0000 33d2 488d8d300b0000 }
 
 	condition:
-		7 of them and filesize <3921930
+		7 of them and filesize < 3921930
 }
 rule MALPEDIA_Win_Daserf_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a6f15599-4f13-54ba-bcec-a3b5030d8753"
+		id = "330cdca3-8a2a-5522-b7a5-32b48eb0dc54"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daserf"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.daserf_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "1bad6c4b5752fd8c6fe15d5fabea81e1efa1678a4e2b8ef0d9b688e6637ca84b"
+		logic_hash = "v1_sha256_1bad6c4b5752fd8c6fe15d5fabea81e1efa1678a4e2b8ef0d9b688e6637ca84b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151251,20 +151321,20 @@ rule MALPEDIA_Win_Daserf_Auto : FILE
 		$sequence_15 = { 81eb31750679 8d36 81c30378b463 f7d6 f7d6 }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize < 245760
 }
 rule MALPEDIA_Win_Rhysida_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b37d7cef-6bec-51b1-8798-0b8311f7db61"
+		id = "6677c27d-f1dd-561e-a49b-94709f2613b4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rhysida_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "25239cc1b2d1119e4ce01e339bf005e03f9d77aa5443040b6232d8bc07fad544"
+		logic_hash = "v1_sha256_25239cc1b2d1119e4ce01e339bf005e03f9d77aa5443040b6232d8bc07fad544"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151290,20 +151360,20 @@ rule MALPEDIA_Win_Rhysida_Auto : FILE
 		$sequence_9 = { 85c0 75ca 4889ea 4889d9 e8???????? 83c001 7448 }
 
 	condition:
-		7 of them and filesize <2369536
+		7 of them and filesize < 2369536
 }
 rule MALPEDIA_Win_Donot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0d8c8de4-b5bc-5e41-9f0a-3ce84556a33b"
+		id = "20729286-78a5-5fc0-83b9-bc39d4e7fc50"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.donot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.donot_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "c988e567c68890dfe0605ba69d12ded06e141c854ed633d34ee6899ee2b466e8"
+		logic_hash = "v1_sha256_c988e567c68890dfe0605ba69d12ded06e141c854ed633d34ee6899ee2b466e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151329,20 +151399,20 @@ rule MALPEDIA_Win_Donot_Auto : FILE
 		$sequence_9 = { 50 8d45f4 64a300000000 8b01 8d7968 8b4004 c744389878210410 }
 
 	condition:
-		7 of them and filesize <626688
+		7 of them and filesize < 626688
 }
 rule MALPEDIA_Win_Ratankba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5b767439-8a52-5082-a849-b72a22dc7deb"
+		id = "84cb08e1-023d-54d5-a8ae-db0e4f32bcb9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratankba"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ratankba_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "28a3493a9c6143ba99ec99eb8912043c44e1319e93a131fe32deda9f1f93952d"
+		logic_hash = "v1_sha256_28a3493a9c6143ba99ec99eb8912043c44e1319e93a131fe32deda9f1f93952d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151368,20 +151438,20 @@ rule MALPEDIA_Win_Ratankba_Auto : FILE
 		$sequence_9 = { 899ef4000000 66898ee4000000 8d8e00010000 c645fc07 33d2 }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize < 303104
 }
 rule MALPEDIA_Win_Unidentified_103_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "887a2a34-16c4-5940-84aa-60b8d12f0d1d"
+		id = "641ae62a-d72b-5dd5-bf2f-4574b656ad16"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_103"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_103_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "e05c648365bd2898e5f79fec6ee4b7da15c9961641307154c17359b01f91ade3"
+		logic_hash = "v1_sha256_e05c648365bd2898e5f79fec6ee4b7da15c9961641307154c17359b01f91ade3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151407,20 +151477,20 @@ rule MALPEDIA_Win_Unidentified_103_Auto : FILE
 		$sequence_9 = { 31c0 803a00 7415 90 8d742600 83c001 803c0200 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Dridex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82474897-84ac-57c0-bc01-9735ab6cae7c"
+		id = "785ce937-2de0-58b0-9e32-3a2328977cf3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dridex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dridex_auto.yar#L1-L1014"
 		license_url = "N/A"
-		logic_hash = "1b034dcf6182675bbb8a5eb0a34d263edee95de935cc41e9152b6cc845885549"
+		logic_hash = "v1_sha256_1b034dcf6182675bbb8a5eb0a34d263edee95de935cc41e9152b6cc845885549"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -151561,20 +151631,20 @@ rule MALPEDIA_Win_Dridex_Auto : FILE
 		$sequence_124 = { 890c24 c744240400000000 8955e8 e8???????? 8d0dbc308400 }
 
 	condition:
-		7 of them and filesize <1040384
+		7 of them and filesize < 1040384
 }
 rule MALPEDIA_Win_Cotx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "618247d4-de94-5a5b-8702-f02eb35ee904"
+		id = "249eac10-6f5c-5279-ada0-837791cbeec0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cotx"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cotx_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "3b8fe5510fd419b8c1ff3124a08904512765ac561abd89e88faa984449f17fc2"
+		logic_hash = "v1_sha256_3b8fe5510fd419b8c1ff3124a08904512765ac561abd89e88faa984449f17fc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151600,20 +151670,20 @@ rule MALPEDIA_Win_Cotx_Auto : FILE
 		$sequence_9 = { 6800040000 8d8598f6ffff 6a00 50 e8???????? 83c40c 8d8598feffff }
 
 	condition:
-		7 of them and filesize <1171456
+		7 of them and filesize < 1171456
 }
 rule MALPEDIA_Win_Bluenoroff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "87ca0fae-dc2d-5a54-9ef5-56b7a04644cb"
+		id = "9827c15a-1428-57e7-891d-e6fa67df00b6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluenoroff"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bluenoroff_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "02d8b21ae6c3a55707ae999f347bdd0e2eb71f8cb543624eb25090baef53d3be"
+		logic_hash = "v1_sha256_02d8b21ae6c3a55707ae999f347bdd0e2eb71f8cb543624eb25090baef53d3be"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151639,20 +151709,20 @@ rule MALPEDIA_Win_Bluenoroff_Auto : FILE
 		$sequence_9 = { 83c709 57 894e04 e8???????? 83c40c }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize < 303104
 }
 rule MALPEDIA_Win_Sinowal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00c85bb6-b85e-5ec4-8327-f739c9d5f422"
+		id = "4a001a4e-e1a1-526c-9f6d-02addcefc995"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sinowal"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sinowal_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "ad21744a631baee0751cfa9148a29030265ec00175eb1018f5bd88e3be28754b"
+		logic_hash = "v1_sha256_ad21744a631baee0751cfa9148a29030265ec00175eb1018f5bd88e3be28754b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151678,20 +151748,20 @@ rule MALPEDIA_Win_Sinowal_Auto : FILE
 		$sequence_9 = { 7418 8b55e8 3b55f8 7510 8b45ec 3b45fc 7508 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Arik_Keylogger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7cfe77b9-498e-52b0-a1e5-e481078fb2b8"
+		id = "0323a15b-7005-5558-a8c3-1a63b41462b3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arik_keylogger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.arik_keylogger_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "efa31a5efe80de4c661e6c1fa566389f67f3059a66f1ad3d5cfcbb40b493c756"
+		logic_hash = "v1_sha256_efa31a5efe80de4c661e6c1fa566389f67f3059a66f1ad3d5cfcbb40b493c756"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151717,20 +151787,20 @@ rule MALPEDIA_Win_Arik_Keylogger_Auto : FILE
 		$sequence_9 = { eb60 8b45fc 8b40fc 8b4060 ff30 8b45fc 8b40fc }
 
 	condition:
-		7 of them and filesize <4947968
+		7 of them and filesize < 4947968
 }
 rule MALPEDIA_Win_Dnespy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dd2f9ed7-2d6f-5933-9493-a41c942bf03f"
+		id = "5c371d46-d668-57dc-b314-2f4528c6959f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnespy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dnespy_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "eee42a6a521e66ad81f34fb24c5fab011a7b4af2844dffcdf7998746a9a87ff5"
+		logic_hash = "v1_sha256_eee42a6a521e66ad81f34fb24c5fab011a7b4af2844dffcdf7998746a9a87ff5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151756,20 +151826,20 @@ rule MALPEDIA_Win_Dnespy_Auto : FILE
 		$sequence_9 = { e8???????? c645fc01 8b55b4 8bc2 8b4db0 2bc1 83f801 }
 
 	condition:
-		7 of them and filesize <794624
+		7 of them and filesize < 794624
 }
 rule MALPEDIA_Win_Badflick_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d5d1b93f-b8ef-5919-881c-41cd371c0e33"
+		id = "d350566f-7970-56bc-a420-0099831c8cd4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badflick"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.badflick_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "254e8105548798f084c01ec737c733ae7316a19998160441541107c24531856e"
+		logic_hash = "v1_sha256_254e8105548798f084c01ec737c733ae7316a19998160441541107c24531856e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151795,20 +151865,20 @@ rule MALPEDIA_Win_Badflick_Auto : FILE
 		$sequence_9 = { ff15???????? 32c0 eb3e ff7510 e8???????? 8bf0 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Cmstar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "573d55cd-4176-58c6-b881-46544636e3cc"
+		id = "dde9f655-3c07-5f18-9ad9-d1fce5113c4e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cmstar"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cmstar_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "a019849b15c13075d7ee37f6ab493df0eaba09a0dd6bc46a1e79b4c730b7a0f1"
+		logic_hash = "v1_sha256_a019849b15c13075d7ee37f6ab493df0eaba09a0dd6bc46a1e79b4c730b7a0f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151840,20 +151910,20 @@ rule MALPEDIA_Win_Cmstar_Auto : FILE
 		$sequence_15 = { f7d1 49 741e 8a441420 bf???????? 8882a8430010 }
 
 	condition:
-		7 of them and filesize <4268032
+		7 of them and filesize < 4268032
 }
 rule MALPEDIA_Win_Domino_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5d360219-88f3-51b6-b0a7-8c0e8e115450"
+		id = "671ecd56-ff8e-5805-905d-4e2ed6134392"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.domino"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.domino_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "0494b0021734ccd5b5bbf5e2e5a90aaa191fbeb0b0a8f17de8e34620de4c33b7"
+		logic_hash = "v1_sha256_0494b0021734ccd5b5bbf5e2e5a90aaa191fbeb0b0a8f17de8e34620de4c33b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151879,20 +151949,20 @@ rule MALPEDIA_Win_Domino_Auto : FILE
 		$sequence_9 = { 4c89742420 89757f ff15???????? f7d8 1bdb 235d7f }
 
 	condition:
-		7 of them and filesize <50176
+		7 of them and filesize < 50176
 }
 rule MALPEDIA_Win_Unidentified_031_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a72a563f-a4f8-5666-a877-ef8f429f5482"
+		id = "e7a5e430-774e-521d-be84-8683951f52ef"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_031"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_031_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "433c3a1b1a13dcc2934f251d10014182069dee4462cd06fa5b97124ebfc25ecc"
+		logic_hash = "v1_sha256_433c3a1b1a13dcc2934f251d10014182069dee4462cd06fa5b97124ebfc25ecc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151918,20 +151988,20 @@ rule MALPEDIA_Win_Unidentified_031_Auto : FILE
 		$sequence_9 = { 74a3 837dd400 755d ff75d0 8b45cc 8b4de4 ff75d8 }
 
 	condition:
-		7 of them and filesize <1998848
+		7 of them and filesize < 1998848
 }
 rule MALPEDIA_Win_Badcall_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6dc89352-23be-508c-aee9-54c70773ba33"
+		id = "c0af4c21-6129-5b8a-97ea-314889c51d00"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badcall"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.badcall_auto.yar#L1-L232"
 		license_url = "N/A"
-		logic_hash = "f469c22ea661fc33aaf4e709b2c352b5b8bb3d75d2b5706e6fcd20955f630b93"
+		logic_hash = "v1_sha256_f469c22ea661fc33aaf4e709b2c352b5b8bb3d75d2b5706e6fcd20955f630b93"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -151971,20 +152041,20 @@ rule MALPEDIA_Win_Badcall_Auto : FILE
 		$sequence_23 = { 83e01f c1f905 8d34c0 8b048de0ad0110 }
 
 	condition:
-		7 of them and filesize <483328
+		7 of them and filesize < 483328
 }
 rule MALPEDIA_Win_Webc2_Ugx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c23cedb-b71d-5193-aa31-e8153ab4c4b4"
+		id = "8a4f0126-f18b-5943-91bb-7a957129e438"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ugx"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_ugx_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "7d4c482dc506453890fdde88d716a3ceb2e3f8b35a1cb1eec11dbba57393fe56"
+		logic_hash = "v1_sha256_7d4c482dc506453890fdde88d716a3ceb2e3f8b35a1cb1eec11dbba57393fe56"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152010,20 +152080,20 @@ rule MALPEDIA_Win_Webc2_Ugx_Auto : FILE
 		$sequence_9 = { e9???????? 8d86ae090000 50 57 ff969c060000 3bc3 8945c0 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Findpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0a568c8d-936e-5180-b48c-3459a7de3f2c"
+		id = "c3bd0109-5fcf-5c98-9a30-9313f7a8efbc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.findpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.findpos_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "16968f111dc679e93555d1d3b7ae27dea3f4769dc763c7bf583a162ef6a1f34f"
+		logic_hash = "v1_sha256_16968f111dc679e93555d1d3b7ae27dea3f4769dc763c7bf583a162ef6a1f34f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152049,20 +152119,20 @@ rule MALPEDIA_Win_Findpos_Auto : FILE
 		$sequence_9 = { 85c0 7429 8bbdf4efffff 33f6 c1ef02 85ff 741a }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Lolsnif_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0289e06c-9994-5dbb-86c9-fe5c529484d1"
+		id = "672cbbd8-c358-5c31-8e92-e8026af45b3b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lolsnif"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lolsnif_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "722f048f7ac9bac7fbc30da76accd223a5f740835920efce86d99d762f17104c"
+		logic_hash = "v1_sha256_722f048f7ac9bac7fbc30da76accd223a5f740835920efce86d99d762f17104c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152088,20 +152158,20 @@ rule MALPEDIA_Win_Lolsnif_Auto : FILE
 		$sequence_9 = { 53 57 8b3d???????? 56 ffd7 83c414 ff7510 }
 
 	condition:
-		7 of them and filesize <425984
+		7 of them and filesize < 425984
 }
 rule MALPEDIA_Win_Rad_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cf7df94d-6d22-5657-82bf-7d35a5482def"
+		id = "ec71653f-5373-518c-b9ce-f9314e6322f8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rad"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rad_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "1eec20ddabb813a5b7c10180af0c0f122f744f026c6b5d60bcc21414af7a0dac"
+		logic_hash = "v1_sha256_1eec20ddabb813a5b7c10180af0c0f122f744f026c6b5d60bcc21414af7a0dac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152127,20 +152197,20 @@ rule MALPEDIA_Win_Rad_Auto : FILE
 		$sequence_9 = { 8b8d00ffffff 8b5104 8d8550ffffff 898510fdffff c7841500ffffffa4e64000 8d8504ffffff }
 
 	condition:
-		7 of them and filesize <207872
+		7 of them and filesize < 207872
 }
 rule MALPEDIA_Win_Decaf_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "67190af4-1ce0-57cf-b346-2c883278a90f"
+		id = "443699c8-ac99-50e2-a581-2f2c1ce79a88"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.decaf"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.decaf_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7a70ed6fa2a0ce3cf4802d2d0ae4afe2a54da0a94bb0916dbc97593071b29978"
+		logic_hash = "v1_sha256_7a70ed6fa2a0ce3cf4802d2d0ae4afe2a54da0a94bb0916dbc97593071b29978"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152166,20 +152236,20 @@ rule MALPEDIA_Win_Decaf_Auto : FILE
 		$sequence_9 = { eb14 488d7818 488b8c2470220000 0f1f00 e8???????? 488b8c24a8030000 48894808 }
 
 	condition:
-		7 of them and filesize <7193600
+		7 of them and filesize < 7193600
 }
 rule MALPEDIA_Win_Metadatabin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d06dd743-35cf-5bb7-aeb8-d54914ce18a9"
+		id = "14502636-a1a7-5eaf-80bd-9a4cfc6f1c4f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.metadatabin"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.metadatabin_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "6937a202ef9f0a455ba922507557ae6df15b8a9ec19545fd7cb48a075af80798"
+		logic_hash = "v1_sha256_6937a202ef9f0a455ba922507557ae6df15b8a9ec19545fd7cb48a075af80798"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152205,20 +152275,20 @@ rule MALPEDIA_Win_Metadatabin_Auto : FILE
 		$sequence_9 = { f00fc106 83e0c0 83f840 750e 8b4614 56 89d7 }
 
 	condition:
-		7 of them and filesize <1263616
+		7 of them and filesize < 1263616
 }
 rule MALPEDIA_Win_Warezov_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "daf7c87f-56d6-5ca2-a05f-f2106f7af4ec"
+		id = "ec4ef575-df18-595a-9f3a-855f46e92644"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.warezov"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.warezov_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "76ba225e2c2800078c3a09fe679ba4718fd1f03fa3d573bef216fead7a711c12"
+		logic_hash = "v1_sha256_76ba225e2c2800078c3a09fe679ba4718fd1f03fa3d573bef216fead7a711c12"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152244,20 +152314,20 @@ rule MALPEDIA_Win_Warezov_Auto : FILE
 		$sequence_9 = { 898c2404010000 89942408010000 8b54246c 8d8c2498010000 898c240c010000 8b4c247c 89942410010000 }
 
 	condition:
-		7 of them and filesize <827392
+		7 of them and filesize < 827392
 }
 rule MALPEDIA_Win_Atmspitter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a7fa682f-eefe-55e1-939b-4455645ebe46"
+		id = "041b44ee-0e32-5ca5-9fb9-9f5bf4b65baf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmspitter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.atmspitter_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "0ed0ab3302f4e8054faec9b20c1025a14f4da75cd75a5c59684b771cac871b40"
+		logic_hash = "v1_sha256_0ed0ab3302f4e8054faec9b20c1025a14f4da75cd75a5c59684b771cac871b40"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152283,20 +152353,20 @@ rule MALPEDIA_Win_Atmspitter_Auto : FILE
 		$sequence_9 = { e8???????? 83c404 8d442420 50 895c2424 c744242857000000 ff15???????? }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Colony_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "742a0cb8-c4dd-5eda-a40e-a63b7bd8505f"
+		id = "79f37368-7aae-5f9a-8d81-93221db62781"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colony"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.colony_auto.yar#L1-L235"
 		license_url = "N/A"
-		logic_hash = "3b9749137439fa6695b6427d299f35f295a8c9c596ab6c8986a3096d5875940b"
+		logic_hash = "v1_sha256_3b9749137439fa6695b6427d299f35f295a8c9c596ab6c8986a3096d5875940b"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -152336,20 +152406,20 @@ rule MALPEDIA_Win_Colony_Auto : FILE
 		$sequence_23 = { c70009000000 e8???????? 4883c8ff 4883c428 c3 4863d1 4c8d0546cc0000 }
 
 	condition:
-		7 of them and filesize <7599104
+		7 of them and filesize < 7599104
 }
 rule MALPEDIA_Win_Forest_Tiger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c5055f82-5e25-5cec-b6f9-75913bef33b5"
+		id = "23f62365-cc91-570b-bd97-10fa1fe64ab9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.forest_tiger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.forest_tiger_auto.yar#L1-L149"
 		license_url = "N/A"
-		logic_hash = "398de9d2907c8260eaacbe3112d8affc7b628942665baa833cce575671a0ed06"
+		logic_hash = "v1_sha256_398de9d2907c8260eaacbe3112d8affc7b628942665baa833cce575671a0ed06"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152380,20 +152450,20 @@ rule MALPEDIA_Win_Forest_Tiger_Auto : FILE
 		$sequence_14 = { 4c2be7 4c8b4340 48b90000000000000080 0fb7d0 }
 
 	condition:
-		7 of them and filesize <709632
+		7 of them and filesize < 709632
 }
 rule MALPEDIA_Win_Ghostsocks_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a81e901b-dc82-5aba-9b0a-b793b5feee2d"
+		id = "7bc7fb62-e5b8-5761-91aa-1c8a4b99f8a3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostsocks"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ghostsocks_auto.yar#L1-L148"
 		license_url = "N/A"
-		logic_hash = "bfb13a4898f7d810671a9ba5dbd8796a5c6a94275321bb29cfaca043cafc81f2"
+		logic_hash = "v1_sha256_bfb13a4898f7d810671a9ba5dbd8796a5c6a94275321bb29cfaca043cafc81f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152425,20 +152495,20 @@ rule MALPEDIA_Win_Ghostsocks_Auto : FILE
 		$sequence_15 = { e8???????? 89856077feff 89956477feff 8b8d647ffeff }
 
 	condition:
-		7 of them and filesize <25016320
+		7 of them and filesize < 25016320
 }
 rule MALPEDIA_Win_Cloudeye_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "44608db0-2b3b-55a4-82c4-1c5317afcfea"
+		id = "5ac49c68-1cb2-59ea-a5df-be4ba04598ca"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cloudeye_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "54d2e3ccac7509c285f63d14127016b59266a9af9b4d7112de2a7058fc6a0ca1"
+		logic_hash = "v1_sha256_54d2e3ccac7509c285f63d14127016b59266a9af9b4d7112de2a7058fc6a0ca1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152464,20 +152534,20 @@ rule MALPEDIA_Win_Cloudeye_Auto : FILE
 		$sequence_9 = { 85db 837d7401 750a e8???????? 83f801 7405 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Scranos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3bc50a28-b6e6-5463-a597-05290715703b"
+		id = "34bc89f1-0df4-5c42-b990-c9ad30fb4dd6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scranos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.scranos_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "55c9e24c122b178b35286bb9d84ccadcfb35aee7a1a2177725fac28566a869c1"
+		logic_hash = "v1_sha256_55c9e24c122b178b35286bb9d84ccadcfb35aee7a1a2177725fac28566a869c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152503,20 +152573,20 @@ rule MALPEDIA_Win_Scranos_Auto : FILE
 		$sequence_9 = { 8bd3 8b32 3b31 7512 83e804 83c104 83c204 }
 
 	condition:
-		7 of them and filesize <2859008
+		7 of them and filesize < 2859008
 }
 rule MALPEDIA_Win_Tiger_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "67f423d7-2fad-5807-a6c5-0c99b540e781"
+		id = "9c207ce9-9738-5e40-b34b-fe092bd0a77c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiger_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tiger_rat_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "6751f9ead0a49726ec5dc792ec4931ab1c6ffa2fe50674026329e51b931ea082"
+		logic_hash = "v1_sha256_6751f9ead0a49726ec5dc792ec4931ab1c6ffa2fe50674026329e51b931ea082"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152548,20 +152618,20 @@ rule MALPEDIA_Win_Tiger_Rat_Auto : FILE
 		$sequence_15 = { 0f1f4000 0fb6440d07 48ffc1 324415f7 4883f90f 490f44ce }
 
 	condition:
-		7 of them and filesize <557056
+		7 of them and filesize < 557056
 }
 rule MALPEDIA_Win_Hzrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a3d57e55-1483-5768-a078-1e6af35b2fc8"
+		id = "f700530a-7b62-530a-aec4-b24952bea630"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hzrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hzrat_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "caebe3b063bb24ee2db19144295d7a39f41baf69a2ce331f663ee48cf20d8acf"
+		logic_hash = "v1_sha256_caebe3b063bb24ee2db19144295d7a39f41baf69a2ce331f663ee48cf20d8acf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152587,20 +152657,20 @@ rule MALPEDIA_Win_Hzrat_Auto : FILE
 		$sequence_9 = { 884c382b 83fa03 7511 8b45fc 8a0e 46 8b048510fa4200 }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize < 409600
 }
 rule MALPEDIA_Win_Nautilus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5820a14f-f3d2-5304-9417-3caef70672d9"
+		id = "b7981457-9f20-5572-93ae-ed4c2a0504b0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nautilus_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "3519ef9bb4f52e1cd4586752506ba79e61c0e796a4c0e30324274e519044d1d2"
+		logic_hash = "v1_sha256_3519ef9bb4f52e1cd4586752506ba79e61c0e796a4c0e30324274e519044d1d2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152626,20 +152696,20 @@ rule MALPEDIA_Win_Nautilus_Auto : FILE
 		$sequence_9 = { ff15???????? 8bd8 85c0 74a8 83f826 0f8521010000 448b442450 }
 
 	condition:
-		7 of them and filesize <1302528
+		7 of them and filesize < 1302528
 }
 rule MALPEDIA_Win_Mykings_Spreader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96a12e80-b15f-580e-920d-d6c0d35464b0"
+		id = "428ad789-5d7e-56b8-bd6d-516794a9d4c1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mykings_spreader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mykings_spreader_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "1bcd674173fea4b83a2f4219e8f61306a972490f94a89cfaf5e1f466fdec8eff"
+		logic_hash = "v1_sha256_1bcd674173fea4b83a2f4219e8f61306a972490f94a89cfaf5e1f466fdec8eff"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152665,20 +152735,20 @@ rule MALPEDIA_Win_Mykings_Spreader_Auto : FILE
 		$sequence_9 = { 8b7508 8b36 8975c8 8b7d08 8b7f04 }
 
 	condition:
-		7 of them and filesize <1581056
+		7 of them and filesize < 1581056
 }
 rule MALPEDIA_Win_Ghole_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6e862057-2c23-515e-8722-3cd2a9153bb9"
+		id = "1b445ad4-8796-5a52-9ac6-529cee130be9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghole"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ghole_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "7b940f8a5e148214fddbb5db105fb5b0301dfcf2c7e2cf8b7ad48df7aac652b0"
+		logic_hash = "v1_sha256_7b940f8a5e148214fddbb5db105fb5b0301dfcf2c7e2cf8b7ad48df7aac652b0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152704,20 +152774,20 @@ rule MALPEDIA_Win_Ghole_Auto : FILE
 		$sequence_9 = { 897de8 48 8975e0 8955dc 48 894dd0 4c }
 
 	condition:
-		7 of them and filesize <622592
+		7 of them and filesize < 622592
 }
 rule MALPEDIA_Win_Gcman_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e71f2c5a-eff6-5ad7-8a03-8a2026572314"
+		id = "3e5a7f0d-1406-577c-aea2-263ba4812547"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gcman"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gcman_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "0044f6cfe83ca73eacc555f31b65cfd944699d03aa8981a24b8fc516dccbcc72"
+		logic_hash = "v1_sha256_0044f6cfe83ca73eacc555f31b65cfd944699d03aa8981a24b8fc516dccbcc72"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152743,20 +152813,20 @@ rule MALPEDIA_Win_Gcman_Auto : FILE
 		$sequence_9 = { 40 890424 e8???????? 8945fc 8b45fc 89442408 8b450c }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Pushdo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b6d886fe-4960-5326-a389-c445ba8e11b5"
+		id = "17d9acf1-c817-57a7-96f2-7d39ac1d3409"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pushdo_auto.yar#L1-L204"
 		license_url = "N/A"
-		logic_hash = "31b4c4806bd17184721cedae96bf0c20e18e459a29e411d56b72098b9cc5e475"
+		logic_hash = "v1_sha256_31b4c4806bd17184721cedae96bf0c20e18e459a29e411d56b72098b9cc5e475"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -152793,20 +152863,20 @@ rule MALPEDIA_Win_Pushdo_Auto : FILE
 		$sequence_20 = { 2b45fc 83f805 7307 33c0 e9???????? }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Silence_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d33ad52-7f8b-5849-8776-4b47a03b0b3b"
+		id = "d50126df-47c0-5221-877e-2f2b7d71bea8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.silence"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.silence_auto.yar#L1-L413"
 		license_url = "N/A"
-		logic_hash = "20bb026c801a434e63744ede6d8b88ca9db1780c69681a4497ad49040c78c67b"
+		logic_hash = "v1_sha256_20bb026c801a434e63744ede6d8b88ca9db1780c69681a4497ad49040c78c67b"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -152869,20 +152939,20 @@ rule MALPEDIA_Win_Silence_Auto : FILE
 		$sequence_46 = { 03048db0354200 eb02 8bc6 80782900 }
 
 	condition:
-		7 of them and filesize <70128640
+		7 of them and filesize < 70128640
 }
 rule MALPEDIA_Win_Electricfish_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "54f0ee66-bee9-5fd6-90c5-67fcbb00bae7"
+		id = "6aeb7441-25c8-5c13-8801-7c73cfd04c30"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electricfish"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.electricfish_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "570c92a12a35054e6d1b5030b781194881d1880fcbe3006781ca116a918ce32a"
+		logic_hash = "v1_sha256_570c92a12a35054e6d1b5030b781194881d1880fcbe3006781ca116a918ce32a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152908,20 +152978,20 @@ rule MALPEDIA_Win_Electricfish_Auto : FILE
 		$sequence_9 = { c3 8b8424a8000000 6a01 50 e8???????? 83c408 5b }
 
 	condition:
-		7 of them and filesize <3162112
+		7 of them and filesize < 3162112
 }
 rule MALPEDIA_Win_Scarecrow_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7b0ea4aa-06b5-57ee-9a11-48d883c1ac9c"
+		id = "627b1aea-4d5c-5b23-869f-f6c0037c9e92"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scarecrow"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.scarecrow_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "e0a208d3de2959898d45be13d981ab096036ca0d633a326493a23160fdc8d314"
+		logic_hash = "v1_sha256_e0a208d3de2959898d45be13d981ab096036ca0d633a326493a23160fdc8d314"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152947,20 +153017,20 @@ rule MALPEDIA_Win_Scarecrow_Auto : FILE
 		$sequence_9 = { c685a2f9ffff76 8a8595f9ffff 80bd94f9ffff00 7530 33f6 0f1f4000 }
 
 	condition:
-		7 of them and filesize <501760
+		7 of them and filesize < 501760
 }
 rule MALPEDIA_Elf_Persirai_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "996dcf89-95a6-5052-ad1f-80d616d26c39"
+		id = "5e05f6b8-5238-5355-977c-6fe779f0e659"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.persirai"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/elf.persirai_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "c89a0c1c6fb24b2cd2b602725441f1c71ea63a845e8a02036d6cfd2667993400"
+		logic_hash = "v1_sha256_c89a0c1c6fb24b2cd2b602725441f1c71ea63a845e8a02036d6cfd2667993400"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152986,20 +153056,20 @@ rule MALPEDIA_Elf_Persirai_Auto : FILE
 		$sequence_9 = { 8d41be 3c16 770c 25ff000000 ff248560790508 0fbed2 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_Purelocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "53ddd96f-5e42-581c-bfdc-76e557b9eeb0"
+		id = "681535d3-2585-589a-b0c1-cd49838676e6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purelocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.purelocker_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "cefb5bbad76b31deb583172c70f982572bba50fe45f5283eaffece3891fb88ee"
+		logic_hash = "v1_sha256_cefb5bbad76b31deb583172c70f982572bba50fe45f5283eaffece3891fb88ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153025,20 +153095,20 @@ rule MALPEDIA_Win_Purelocker_Auto : FILE
 		$sequence_9 = { 33c1 894f10 8b4f08 894714 33c8 8bc3 894f18 }
 
 	condition:
-		7 of them and filesize <193536
+		7 of them and filesize < 193536
 }
 rule MALPEDIA_Win_Cryptowall_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0b206dc1-5d58-50e7-8b0b-4a1659e8c327"
+		id = "49afbf27-c16f-5afa-8e03-7a37d5f58857"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptowall"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cryptowall_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "ce5a2f67f32819e2223821b9858e69dbea24618850279ae1bc1fe9c840f1999e"
+		logic_hash = "v1_sha256_ce5a2f67f32819e2223821b9858e69dbea24618850279ae1bc1fe9c840f1999e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153064,20 +153134,20 @@ rule MALPEDIA_Win_Cryptowall_Auto : FILE
 		$sequence_9 = { e8???????? 83c404 8b5508 8b4204 50 8b4d08 8b5108 }
 
 	condition:
-		7 of them and filesize <417792
+		7 of them and filesize < 417792
 }
 rule MALPEDIA_Win_Lunchmoney_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8ab5f04-a830-5276-852a-dc32304e8dce"
+		id = "2d48e97c-2a52-5cc3-be2d-ea0b9a7a134c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lunchmoney"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lunchmoney_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "6507a60182b28ed10fdd4ed1c7e21ccd1e2f0dc103e23e1d246a1843603fe4d9"
+		logic_hash = "v1_sha256_6507a60182b28ed10fdd4ed1c7e21ccd1e2f0dc103e23e1d246a1843603fe4d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153103,20 +153173,20 @@ rule MALPEDIA_Win_Lunchmoney_Auto : FILE
 		$sequence_9 = { 8d86f8000000 83c124 3bc8 740a 6aff 6a00 50 }
 
 	condition:
-		7 of them and filesize <373760
+		7 of them and filesize < 373760
 }
 rule MALPEDIA_Win_Webc2_Div_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c6b6bbf1-febf-5755-a6ac-7cf5cb612b94"
+		id = "99e07ab9-7c38-5486-8d69-e88bd86930af"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_div"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_div_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "45af776ac19cdd47801cee033d12281de26b6a70cf2be832cbeda5a468ce01ab"
+		logic_hash = "v1_sha256_45af776ac19cdd47801cee033d12281de26b6a70cf2be832cbeda5a468ce01ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153142,20 +153212,20 @@ rule MALPEDIA_Win_Webc2_Div_Auto : FILE
 		$sequence_9 = { 8b048e 8d1c9510114000 8b17 2bc2 99 }
 
 	condition:
-		7 of them and filesize <32768
+		7 of them and filesize < 32768
 }
 rule MALPEDIA_Win_Dyre_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dfd82ad1-18fa-5929-a163-6bbf986e9f0e"
+		id = "98dc9ece-d4cf-5408-b98a-4675703464bd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyre"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dyre_auto.yar#L1-L226"
 		license_url = "N/A"
-		logic_hash = "0632ac932a1fda05bb4d709a552a76b91b864a446705dbf518e55fdb6e3d3885"
+		logic_hash = "v1_sha256_0632ac932a1fda05bb4d709a552a76b91b864a446705dbf518e55fdb6e3d3885"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -153194,20 +153264,20 @@ rule MALPEDIA_Win_Dyre_Auto : FILE
 		$sequence_22 = { 57 8bfa 2bfe 90 ff15???????? }
 
 	condition:
-		7 of them and filesize <590848
+		7 of them and filesize < 590848
 }
 rule MALPEDIA_Win_Sharpknot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e73f10d7-589d-5303-bfd9-088b7ddd5e13"
+		id = "88e74d41-35da-597f-b814-20e54cee12c7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sharpknot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sharpknot_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "56a2b51a444e0193080b0e96d12a6b29053b987612719c6a66e8111156406cdd"
+		logic_hash = "v1_sha256_56a2b51a444e0193080b0e96d12a6b29053b987612719c6a66e8111156406cdd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153233,20 +153303,20 @@ rule MALPEDIA_Win_Sharpknot_Auto : FILE
 		$sequence_9 = { c1f805 59 8a4dff 8d3c8540e64400 }
 
 	condition:
-		7 of them and filesize <1032192
+		7 of them and filesize < 1032192
 }
 rule MALPEDIA_Win_Darkrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d801447e-13d8-558d-ac93-3bc625f7fc26"
+		id = "b86605e7-b4a9-5d86-ab18-20dac2210800"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkrat_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "e8461586b168e71b04b888d3fef9b643bcbbe5ebaeef3515951b1dcd9d78d8ef"
+		logic_hash = "v1_sha256_e8461586b168e71b04b888d3fef9b643bcbbe5ebaeef3515951b1dcd9d78d8ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153272,20 +153342,20 @@ rule MALPEDIA_Win_Darkrat_Auto : FILE
 		$sequence_9 = { 8b8d68ffffff 8bc2 2bc1 57 3bf8 7731 8d040f }
 
 	condition:
-		7 of them and filesize <884736
+		7 of them and filesize < 884736
 }
 rule MALPEDIA_Win_Woodyrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "55420983-c976-5f63-817e-19c52006bc78"
+		id = "53793c11-887d-57a1-9da7-ab8fc4311dc7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woodyrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.woodyrat_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "6c11e1a243653fb86d63eb1e0cef34e9f23e5fe6ae8acbf4e40cedaa8f4a73ea"
+		logic_hash = "v1_sha256_6c11e1a243653fb86d63eb1e0cef34e9f23e5fe6ae8acbf4e40cedaa8f4a73ea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153311,20 +153381,20 @@ rule MALPEDIA_Win_Woodyrat_Auto : FILE
 		$sequence_9 = { 8d047d02000000 50 ffb5acfeffff 51 e8???????? 8b8db0feffff 83c40c }
 
 	condition:
-		7 of them and filesize <785408
+		7 of them and filesize < 785408
 }
 rule MALPEDIA_Win_T34Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "284a2fef-7ae8-56b0-9c93-6269ff81a414"
+		id = "09410b31-5c52-5c7c-a8ca-d3d21fa56757"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.t34loader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.t34loader_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "f0b1763253e4022aabc3df13d81fa3a04dd6aace513ad41ab61bf012fd6fd102"
+		logic_hash = "v1_sha256_f0b1763253e4022aabc3df13d81fa3a04dd6aace513ad41ab61bf012fd6fd102"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153350,20 +153420,20 @@ rule MALPEDIA_Win_T34Loader_Auto : FILE
 		$sequence_9 = { 4533c0 4889442420 ff15???????? 488d542450 488d4c2430 e8???????? 488d9580070000 }
 
 	condition:
-		7 of them and filesize <1212416
+		7 of them and filesize < 1212416
 }
 rule MALPEDIA_Win_Amadey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b3fa836d-4682-51f6-8e5a-a32138bd7f60"
+		id = "5bf2298d-4d18-5fb7-86f6-f51d946500a9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.amadey_auto.yar#L1-L207"
 		license_url = "N/A"
-		logic_hash = "47b9b6106a12c197931c79a9b3b33bf3efcee93c9479f6b1617cd096d3785a21"
+		logic_hash = "v1_sha256_47b9b6106a12c197931c79a9b3b33bf3efcee93c9479f6b1617cd096d3785a21"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -153400,20 +153470,20 @@ rule MALPEDIA_Win_Amadey_Auto : FILE
 		$sequence_20 = { 51 e8???????? 83c408 8b9514feffff }
 
 	condition:
-		7 of them and filesize <908288
+		7 of them and filesize < 908288
 }
 rule MALPEDIA_Win_Arkei_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1a0abd06-565e-5d05-9c7f-92841d5839a1"
+		id = "65ffafe7-46bb-563a-8c75-640941f43bdc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.arkei_stealer_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "fe6b8a6d2dda0769d1bf75ba6fd29670ffe1d15e24be98e7feb6639e87efec8a"
+		logic_hash = "v1_sha256_fe6b8a6d2dda0769d1bf75ba6fd29670ffe1d15e24be98e7feb6639e87efec8a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153439,20 +153509,20 @@ rule MALPEDIA_Win_Arkei_Stealer_Auto : FILE
 		$sequence_9 = { 51 ff15???????? 85c0 0f84c4feffff 57 6880000000 }
 
 	condition:
-		7 of them and filesize <1744896
+		7 of them and filesize < 1744896
 }
 rule MALPEDIA_Win_Stealbit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "64063c47-cdf5-5614-a83c-80647057336b"
+		id = "199f57bb-017b-5d5a-9504-212348a77af6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealbit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stealbit_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "744b036a3f78a167f444b112707f7176ea1e1a362d653a3e610f6fa57bd7d98b"
+		logic_hash = "v1_sha256_744b036a3f78a167f444b112707f7176ea1e1a362d653a3e610f6fa57bd7d98b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153478,20 +153548,20 @@ rule MALPEDIA_Win_Stealbit_Auto : FILE
 		$sequence_9 = { e8???????? 33c0 59 40 eb07 e8???????? 33c0 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Mimic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b7917b34-b106-57a3-b31d-217974d73754"
+		id = "d45027db-9941-502f-8d7e-022537c2ecaf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mimic"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mimic_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "ea5e4099bfde229f604346a64d8a2d013028ba263c49de05a138be9fade4fcfb"
+		logic_hash = "v1_sha256_ea5e4099bfde229f604346a64d8a2d013028ba263c49de05a138be9fade4fcfb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153517,20 +153587,20 @@ rule MALPEDIA_Win_Mimic_Auto : FILE
 		$sequence_9 = { c785e0fefffff3dd6046 50 68060000c8 56 c785e4feffff8ee976e5 c785e8feffff8c74063e ff15???????? }
 
 	condition:
-		7 of them and filesize <4204544
+		7 of them and filesize < 4204544
 }
 rule MALPEDIA_Win_Radamant_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "095ef047-a04b-56b2-b6e4-91844a8ad08b"
+		id = "0d606c00-d792-5c88-b887-544513f50edf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.radamant"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.radamant_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "13bfcc591423cf31741a962660c228f2fa259842a594b9b818753a98c248ff00"
+		logic_hash = "v1_sha256_13bfcc591423cf31741a962660c228f2fa259842a594b9b818753a98c248ff00"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153556,20 +153626,20 @@ rule MALPEDIA_Win_Radamant_Auto : FILE
 		$sequence_9 = { e9???????? c745f800000000 837df806 0f8f8d010000 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Misfox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4f561487-7df3-5819-8af4-11354d9ab382"
+		id = "fac0bf18-7c70-5086-bc7e-92b0681ee10f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.misfox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.misfox_auto.yar#L1-L178"
 		license_url = "N/A"
-		logic_hash = "edbf452d1e5320fd7ba0f107fb137baa64797e4d5896d9322787053f0ee80ff3"
+		logic_hash = "v1_sha256_edbf452d1e5320fd7ba0f107fb137baa64797e4d5896d9322787053f0ee80ff3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153601,20 +153671,20 @@ rule MALPEDIA_Win_Misfox_Auto : FILE
 		$sequence_15 = { 1bc0 4123c4 ffc8 443875f8 740b 488b4df0 83a1c8000000fd }
 
 	condition:
-		7 of them and filesize <266240
+		7 of them and filesize < 266240
 }
 rule MALPEDIA_Win_Unidentified_068_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1ce41a1d-9111-5664-971b-18b33f290c67"
+		id = "425f1c59-cf82-5d0b-bf2e-542efda59688"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_068"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_068_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "cf7d5521a90e4f10a4d7ed99e1e2829b2e957d2aba56d598bf0190ab6bc75eb5"
+		logic_hash = "v1_sha256_cf7d5521a90e4f10a4d7ed99e1e2829b2e957d2aba56d598bf0190ab6bc75eb5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153640,20 +153710,20 @@ rule MALPEDIA_Win_Unidentified_068_Auto : FILE
 		$sequence_9 = { c70485????????58fe4400 40 a3???????? c3 b9???????? e8???????? 68???????? }
 
 	condition:
-		7 of them and filesize <862208
+		7 of them and filesize < 862208
 }
 rule MALPEDIA_Elf_Nosedive_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "455c512f-a4d2-5592-873b-6a0f8d7aa60b"
+		id = "7820db23-0530-5ad5-a976-7b30f47e3a86"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.nosedive"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/elf.nosedive_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "437edcb731a71f57346014b7f168c5a7e19b62836d7ab5266e2b058730d6e731"
+		logic_hash = "v1_sha256_437edcb731a71f57346014b7f168c5a7e19b62836d7ab5266e2b058730d6e731"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153679,20 +153749,20 @@ rule MALPEDIA_Elf_Nosedive_Auto : FILE
 		$sequence_9 = { b902160000 e9???????? 4c8d052df80e00 b9f7150000 be01000000 488d156cf30e00 e8???????? }
 
 	condition:
-		7 of them and filesize <3268608
+		7 of them and filesize < 3268608
 }
 rule MALPEDIA_Win_Orcarat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66428b7d-391a-549a-8224-a32cd382ad2d"
+		id = "12107530-be05-5aeb-844e-f22bfe47c29d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orcarat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.orcarat_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "5f94f67164edef88389c383016b172885e074830b2ead0db2794d29f7191cd25"
+		logic_hash = "v1_sha256_5f94f67164edef88389c383016b172885e074830b2ead0db2794d29f7191cd25"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153718,20 +153788,20 @@ rule MALPEDIA_Win_Orcarat_Auto : FILE
 		$sequence_9 = { 740b 83f801 75dd 396c2410 75d7 bf???????? 83c9ff }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Mindware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "47e4869b-800b-5557-a4d9-867ae32fc71e"
+		id = "15842d1c-3431-5676-8587-0500114a22ff"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mindware"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mindware_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "cdf7a7da50c91df9825bab58a751a2b3b443f392a26a7c4ddad4a0902a0837ae"
+		logic_hash = "v1_sha256_cdf7a7da50c91df9825bab58a751a2b3b443f392a26a7c4ddad4a0902a0837ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153757,20 +153827,20 @@ rule MALPEDIA_Win_Mindware_Auto : FILE
 		$sequence_9 = { 8945fc c745f001000000 837dfc00 7541 c745ec00000000 c745f800000000 8b4d08 }
 
 	condition:
-		7 of them and filesize <661504
+		7 of them and filesize < 661504
 }
 rule MALPEDIA_Win_Ssload_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f6ceb229-a7e1-5841-bcaa-d6789358d285"
+		id = "9f3eff03-375e-55fb-85c7-3709b25fddf9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ssload"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ssload_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "816793f1c924d2fa45e62fdcb0930a6aeafd4fdc18acca20a05a5227b74cb23d"
+		logic_hash = "v1_sha256_816793f1c924d2fa45e62fdcb0930a6aeafd4fdc18acca20a05a5227b74cb23d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153802,20 +153872,20 @@ rule MALPEDIA_Win_Ssload_Auto : FILE
 		$sequence_15 = { 03420c 50 ff15???????? 8945f8 837df800 }
 
 	condition:
-		7 of them and filesize <4950016
+		7 of them and filesize < 4950016
 }
 rule MALPEDIA_Win_Unidentified_077_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c7f9be79-20b6-5aa4-9bbd-94e7c4c6bef7"
+		id = "38bb5c26-1944-5c86-aca3-8b15cab69259"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_077"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_077_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "90028d042242a66c9237db24c75f8aa2228010ebd44b2069db8290680e688e20"
+		logic_hash = "v1_sha256_90028d042242a66c9237db24c75f8aa2228010ebd44b2069db8290680e688e20"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153841,20 +153911,20 @@ rule MALPEDIA_Win_Unidentified_077_Auto : FILE
 		$sequence_9 = { 8bc2 f30f6f0418 660fefc1 f30f7f0418 8d4210 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize < 270336
 }
 rule MALPEDIA_Win_Bandook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e41ee65d-d778-576e-8219-d5b7551a8280"
+		id = "18b8ca95-c93e-549c-94d2-d78db6ef9e35"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bandook"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bandook_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "3158dd6369626bf2143d645ab9a0e41f6f517c0e8f9383586a9041884da647b4"
+		logic_hash = "v1_sha256_3158dd6369626bf2143d645ab9a0e41f6f517c0e8f9383586a9041884da647b4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153880,20 +153950,20 @@ rule MALPEDIA_Win_Bandook_Auto : FILE
 		$sequence_9 = { c60000 0f57c0 660fd64704 8d45a4 c645fc03 50 8d4f10 }
 
 	condition:
-		7 of them and filesize <23088128
+		7 of them and filesize < 23088128
 }
 rule MALPEDIA_Win_Ironwind_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b7b3278a-33a9-59fb-98d9-d012cae38570"
+		id = "167573c1-1f4b-5f81-89c5-0a6f86bf904e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ironwind"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ironwind_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "df52b853e06a9bac2fed032f09d4a195b27f234efb72e316b71f02accfc6c4ed"
+		logic_hash = "v1_sha256_df52b853e06a9bac2fed032f09d4a195b27f234efb72e316b71f02accfc6c4ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153919,20 +153989,20 @@ rule MALPEDIA_Win_Ironwind_Auto : FILE
 		$sequence_9 = { 410f94c7 4489bde0000000 4d8b4cc1f8 e8???????? 8bf8 85c0 0f85fffeffff }
 
 	condition:
-		7 of them and filesize <995328
+		7 of them and filesize < 995328
 }
 rule MALPEDIA_Win_Artra_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff75386e-794e-5ca3-b572-9b037a957102"
+		id = "591aa1f8-19f1-57d1-82ea-83a04118de0b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artra"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.artra_auto.yar#L1-L262"
 		license_url = "N/A"
-		logic_hash = "0d6b75a232d52a887969f43b5d876701bc36067b1aa62db809423e4fc76fc56c"
+		logic_hash = "v1_sha256_0d6b75a232d52a887969f43b5d876701bc36067b1aa62db809423e4fc76fc56c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -153974,20 +154044,20 @@ rule MALPEDIA_Win_Artra_Auto : FILE
 		$sequence_25 = { 6a00 6a00 68???????? 6801000080 ff15???????? 8d4c2428 51 }
 
 	condition:
-		7 of them and filesize <811008
+		7 of them and filesize < 811008
 }
 rule MALPEDIA_Win_Downeks_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "30c812bc-f8ec-5caf-b497-f38e34394a41"
+		id = "1ac8a3f9-286e-5134-b276-d2e998bff98d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.downeks"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.downeks_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d7bf58e8bb3246f569b98be2a709ed5695e812ca867b1dab085a6c76aff4235d"
+		logic_hash = "v1_sha256_d7bf58e8bb3246f569b98be2a709ed5695e812ca867b1dab085a6c76aff4235d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154013,20 +154083,20 @@ rule MALPEDIA_Win_Downeks_Auto : FILE
 		$sequence_9 = { e9???????? 8d7dc4 e9???????? 8d7dc0 e9???????? 8d7dc4 e9???????? }
 
 	condition:
-		7 of them and filesize <1318912
+		7 of them and filesize < 1318912
 }
 rule MALPEDIA_Win_Cuegoe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f801c54c-d3a8-51b1-91c4-e3ef8af3f7f9"
+		id = "81fc0173-e89a-5fb7-a8fd-a3421bc4c478"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cuegoe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cuegoe_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "d0e6e6925a0e42ac5470513773688ead9a134439bb7102ccc5d0a7edc70c0169"
+		logic_hash = "v1_sha256_d0e6e6925a0e42ac5470513773688ead9a134439bb7102ccc5d0a7edc70c0169"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154052,20 +154122,20 @@ rule MALPEDIA_Win_Cuegoe_Auto : FILE
 		$sequence_9 = { ff7004 ff30 8d45d4 50 8bc6 e8???????? 8bc6 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Unidentified_092_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a832d924-1526-5b98-85cb-a6a677c2763a"
+		id = "618087a8-2d44-5307-9aa3-0ccc66f294a0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_092"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_092_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "652402e87963cd0c6ff5366fe9ef518c3ad3cc147775da4e4b2ee294d04144ab"
+		logic_hash = "v1_sha256_652402e87963cd0c6ff5366fe9ef518c3ad3cc147775da4e4b2ee294d04144ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154091,20 +154161,20 @@ rule MALPEDIA_Win_Unidentified_092_Auto : FILE
 		$sequence_9 = { c745cc00000000 c645bc00 e8???????? c645fc01 81ff00040000 7d21 be00040000 }
 
 	condition:
-		7 of them and filesize <10202112
+		7 of them and filesize < 10202112
 }
 rule MALPEDIA_Win_Dorshel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "550d8628-f52a-56de-91a7-ece0c38b96fb"
+		id = "7bc63644-9263-5cef-870a-6ecdd6fecb6f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dorshel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dorshel_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "364203df24c6a83e17731caab6caa244bb9a531055fdc65fef6d763de8c4fb40"
+		logic_hash = "v1_sha256_364203df24c6a83e17731caab6caa244bb9a531055fdc65fef6d763de8c4fb40"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154130,20 +154200,20 @@ rule MALPEDIA_Win_Dorshel_Auto : FILE
 		$sequence_9 = { 5f 8b4704 33c3 83c104 99 }
 
 	condition:
-		7 of them and filesize <24576
+		7 of them and filesize < 24576
 }
 rule MALPEDIA_Win_Unidentified_001_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b4764d2-9d12-5e82-8bd8-6d5008485440"
+		id = "c959ad45-f3b8-55a4-93c4-ba74f31b98d9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_001"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_001_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "81eac2ebab9009f83937098bc70d4667382c46b0593ed411973170676729479d"
+		logic_hash = "v1_sha256_81eac2ebab9009f83937098bc70d4667382c46b0593ed411973170676729479d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154169,20 +154239,20 @@ rule MALPEDIA_Win_Unidentified_001_Auto : FILE
 		$sequence_9 = { 3bc1 7767 74d3 2d434d5200 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Minibus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1ad5e3c7-76e6-5ca8-ae27-272222a9f62c"
+		id = "e6f0e6d1-3da7-5366-b89f-4cff334a42f7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minibus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.minibus_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "f2e35e1c340980cefeddf2362242a94c8425d63f412b36fb6c1988b6b9f9c6f1"
+		logic_hash = "v1_sha256_f2e35e1c340980cefeddf2362242a94c8425d63f412b36fb6c1988b6b9f9c6f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154208,20 +154278,20 @@ rule MALPEDIA_Win_Minibus_Auto : FILE
 		$sequence_9 = { 0f87b1000000 c747140f000000 83fb10 7319 6a10 }
 
 	condition:
-		7 of them and filesize <324608
+		7 of them and filesize < 324608
 }
 rule MALPEDIA_Win_Snifula_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7eb0b095-555b-5c46-a556-09b78e129a51"
+		id = "8c5cef86-fd96-514d-898a-c7e74fdfae7c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snifula"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.snifula_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "8cd858ad508ccf0d5980ca44f29c7ac0d1ef182e09e60747d07a1ef2744ff82a"
+		logic_hash = "v1_sha256_8cd858ad508ccf0d5980ca44f29c7ac0d1ef182e09e60747d07a1ef2744ff82a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154247,20 +154317,20 @@ rule MALPEDIA_Win_Snifula_Auto : FILE
 		$sequence_9 = { ff35???????? ff35???????? 68???????? ff75f4 ffd7 83c42c ff36 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Syscon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62914e2c-226d-5cbb-90b0-89a5b7c1ce63"
+		id = "c39a2603-e856-5e78-bdc3-81020fbbd264"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.syscon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.syscon_auto.yar#L1-L179"
 		license_url = "N/A"
-		logic_hash = "302ef373551197e8ed957c8603c0bcf0757f29f0db7a8e8349d7ddb01c77aa30"
+		logic_hash = "v1_sha256_302ef373551197e8ed957c8603c0bcf0757f29f0db7a8e8349d7ddb01c77aa30"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154292,20 +154362,20 @@ rule MALPEDIA_Win_Syscon_Auto : FILE
 		$sequence_15 = { 488d8d10020000 ff15???????? 488d4d90 448bc3 33d2 }
 
 	condition:
-		7 of them and filesize <120832
+		7 of them and filesize < 120832
 }
 rule MALPEDIA_Win_Beepservice_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "600fce17-5c83-5bc3-9824-37a0fdef0a67"
+		id = "b2069396-d965-57ca-8256-1b1f59c4fc62"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beepservice"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.beepservice_auto.yar#L1-L268"
 		license_url = "N/A"
-		logic_hash = "e9b2216bc0e3755a16cf68b15ef3152aac9ea65a9d59c9db364017acc5ba848e"
+		logic_hash = "v1_sha256_e9b2216bc0e3755a16cf68b15ef3152aac9ea65a9d59c9db364017acc5ba848e"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -154348,20 +154418,20 @@ rule MALPEDIA_Win_Beepservice_Auto : FILE
 		$sequence_26 = { ff248548144000 6888130000 6a01 6a00 6a00 6a03 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Unidentified_115_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "be30f947-2ea3-5dbe-8a22-d2eff226f388"
+		id = "f5becd2c-0d19-5574-b46d-2b6d47f60521"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_115"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_115_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "0dce5979f7403c0c98c10384045967ec938948f605faa1b9ed353ecbedbd1370"
+		logic_hash = "v1_sha256_0dce5979f7403c0c98c10384045967ec938948f605faa1b9ed353ecbedbd1370"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154387,20 +154457,20 @@ rule MALPEDIA_Win_Unidentified_115_Auto : FILE
 		$sequence_9 = { 4155 4154 57 56 53 4883ec28 31ff }
 
 	condition:
-		7 of them and filesize <648192
+		7 of them and filesize < 648192
 }
 rule MALPEDIA_Win_Orchard_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "17f17024-3843-5eab-9d60-b1508d38046a"
+		id = "b202d060-af79-5a4a-b5f8-97050be85991"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orchard"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.orchard_auto.yar#L1-L153"
 		license_url = "N/A"
-		logic_hash = "138080fd95f8adafa6f2759bdbd81f59c5234a21d6fcbf8907de2c121b106fe9"
+		logic_hash = "v1_sha256_138080fd95f8adafa6f2759bdbd81f59c5234a21d6fcbf8907de2c121b106fe9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154432,20 +154502,20 @@ rule MALPEDIA_Win_Orchard_Auto : FILE
 		$sequence_15 = { 8bc8 83ec1c c645fc3c 8d8500ffffff }
 
 	condition:
-		7 of them and filesize <4716352
+		7 of them and filesize < 4716352
 }
 rule MALPEDIA_Win_Glasses_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f78200de-17f0-543a-b1bc-b07d12f718a7"
+		id = "e579822d-2b95-511e-91a7-3526070be5b5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glasses"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.glasses_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f33966ab45324eba7508399d9cadcd3a853fcf3a139e1b51ccdad3cd57192d5a"
+		logic_hash = "v1_sha256_f33966ab45324eba7508399d9cadcd3a853fcf3a139e1b51ccdad3cd57192d5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154471,20 +154541,20 @@ rule MALPEDIA_Win_Glasses_Auto : FILE
 		$sequence_9 = { eb07 e8???????? 8bf8 33f6 85ff 7e2b 8bff }
 
 	condition:
-		7 of them and filesize <4177920
+		7 of them and filesize < 4177920
 }
 rule MALPEDIA_Win_Torrentlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "78a2f41d-b3cc-50c3-94fa-009892ee7a43"
+		id = "4256340d-76b1-5bd8-b911-dea709feb21f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.torrentlocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.torrentlocker_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "3dd062623227a3c969fbf6874bc33a690192fa1b5ef820c50984975d7d603139"
+		logic_hash = "v1_sha256_3dd062623227a3c969fbf6874bc33a690192fa1b5ef820c50984975d7d603139"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154516,20 +154586,20 @@ rule MALPEDIA_Win_Torrentlocker_Auto : FILE
 		$sequence_15 = { 6a78 50 68???????? e8???????? }
 
 	condition:
-		7 of them and filesize <933888
+		7 of them and filesize < 933888
 }
 rule MALPEDIA_Win_Dreambot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca125658-e0a0-53ce-a980-872204f0b2dd"
+		id = "fdc946e9-c514-55bf-948a-b42411e40712"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dreambot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dreambot_auto.yar#L1-L1010"
 		license_url = "N/A"
-		logic_hash = "376288f0c1af3049ba5a8f21b0bc3eb4e04085f83d0b86e461c7b5d308181cec"
+		logic_hash = "v1_sha256_376288f0c1af3049ba5a8f21b0bc3eb4e04085f83d0b86e461c7b5d308181cec"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -154664,20 +154734,20 @@ rule MALPEDIA_Win_Dreambot_Auto : FILE
 		$sequence_118 = { 7420 56 ff7508 8d45e8 }
 
 	condition:
-		7 of them and filesize <802816
+		7 of them and filesize < 802816
 }
 rule MALPEDIA_Win_Unidentified_074_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18d2173e-134a-5069-ab8f-b9abd19f1bd3"
+		id = "ada9f9d3-0429-5b23-82e0-3c84e2ccdba7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_074"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_074_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "6dab9e5ae43cc86eae4e300f173218fa8732c7df5d913a5bb2fedc84e5de19c3"
+		logic_hash = "v1_sha256_6dab9e5ae43cc86eae4e300f173218fa8732c7df5d913a5bb2fedc84e5de19c3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154703,20 +154773,20 @@ rule MALPEDIA_Win_Unidentified_074_Auto : FILE
 		$sequence_9 = { e8???????? c743140f000000 c7431000000000 c60300 8b9584e7ffff 83fa10 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize < 335872
 }
 rule MALPEDIA_Win_Smominru_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c1a10c0a-1a81-5633-ba39-5fbcedc45f65"
+		id = "491e11c1-7290-510a-9080-b4d2882ba05d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smominru"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.smominru_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "e46f6fcc506b8533ee7578778771fd23a12eff0b58e9a48260ec14f4febd7c2f"
+		logic_hash = "v1_sha256_e46f6fcc506b8533ee7578778771fd23a12eff0b58e9a48260ec14f4febd7c2f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154742,20 +154812,20 @@ rule MALPEDIA_Win_Smominru_Auto : FILE
 		$sequence_9 = { 85f6 0f84173ea97b 6a00 56 e8???????? 85c0 0f8412b5ac7b }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Yayih_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6b0b123b-a2d0-5239-b990-6d6c98b897d2"
+		id = "1c1201ed-f54e-5604-8884-509fdc809780"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yayih"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.yayih_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "2fc47407627eaa9d0405e17fbf6ef6d14584c29b56705d065c0a11f1cb55f981"
+		logic_hash = "v1_sha256_2fc47407627eaa9d0405e17fbf6ef6d14584c29b56705d065c0a11f1cb55f981"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154781,20 +154851,20 @@ rule MALPEDIA_Win_Yayih_Auto : FILE
 		$sequence_9 = { 59 59 50 57 ffd6 a3???????? eb54 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Mapiget_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b7a42e52-aa49-5fa2-9228-6b144ce76bdc"
+		id = "563da301-9906-518c-bdaf-2f5d65fd03b4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mapiget"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mapiget_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "9a5d011e54dd8be32162fd28789dfb313e466b4c449ca547e52393f68f4438eb"
+		logic_hash = "v1_sha256_9a5d011e54dd8be32162fd28789dfb313e466b4c449ca547e52393f68f4438eb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154820,20 +154890,20 @@ rule MALPEDIA_Win_Mapiget_Auto : FILE
 		$sequence_9 = { c3 660dffff c3 56 8bf1 e8???????? }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Molerat_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bbb2773d-16c5-5ea1-96c6-2ff80ea4ab38"
+		id = "dfc808ff-c4b6-5977-8bd3-a9b09015159c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.molerat_loader_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "f7f702f0dc9bfb0fb7a2fb852c5b313a67822e64049d201a13fd2318ed509e52"
+		logic_hash = "v1_sha256_f7f702f0dc9bfb0fb7a2fb852c5b313a67822e64049d201a13fd2318ed509e52"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154859,20 +154929,20 @@ rule MALPEDIA_Win_Molerat_Loader_Auto : FILE
 		$sequence_9 = { e8???????? 83c40c 83bd74ffffff00 7f05 e8???????? 8b9d70ffffff e8???????? }
 
 	condition:
-		7 of them and filesize <688128
+		7 of them and filesize < 688128
 }
 rule MALPEDIA_Win_New_Ct_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f53de876-cc73-580f-b656-21e621d4769e"
+		id = "4f5e91a2-58c1-5215-bcbc-3fb78fe4139b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.new_ct"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.new_ct_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "a95efc922552cce6ba568c288715d7230a5249b577e6fe1c26585a82d20cee63"
+		logic_hash = "v1_sha256_a95efc922552cce6ba568c288715d7230a5249b577e6fe1c26585a82d20cee63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154898,20 +154968,20 @@ rule MALPEDIA_Win_New_Ct_Auto : FILE
 		$sequence_9 = { 33c0 83c40c f2ae f7d1 49 6800000020 8d84247c070000 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Getmail_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4780e834-4739-57cb-8526-1265945d26d9"
+		id = "41c0883f-6235-59e1-93ce-6be58ea5f374"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.getmail"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.getmail_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "f392c7d302de7668ac9b3700c0372997d2f7bd630f275b38a7b8618bbfecba8b"
+		logic_hash = "v1_sha256_f392c7d302de7668ac9b3700c0372997d2f7bd630f275b38a7b8618bbfecba8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154937,20 +155007,20 @@ rule MALPEDIA_Win_Getmail_Auto : FILE
 		$sequence_9 = { 8b10 50 ff5208 eb52 8b08 8d542414 52 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Comebacker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "19b11e1a-a1ff-5098-8869-502d6ab34aa7"
+		id = "06e47e48-7174-5e4c-bf77-2d389855c1d0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.comebacker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.comebacker_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "e448a9fe85529eabd811145723dc68a4c09b7b0e6109ed9890120aa2245173a6"
+		logic_hash = "v1_sha256_e448a9fe85529eabd811145723dc68a4c09b7b0e6109ed9890120aa2245173a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154981,20 +155051,20 @@ rule MALPEDIA_Win_Comebacker_Auto : FILE
 		$sequence_14 = { 8d95fcf7ffff 68???????? 52 ffd7 8d85fcf7ffff 83c408 8d5002 }
 
 	condition:
-		7 of them and filesize <1429504
+		7 of them and filesize < 1429504
 }
 rule MALPEDIA_Win_Lambload_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8b136788-015d-54fc-bdcb-34985ee91d28"
+		id = "06af1674-69ea-53d3-92d6-29f089b02b18"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lambload"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lambload_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "360d04776b8fecec7b17892571b2e470304fba03fb5a7a2f8f66e392936ecb21"
+		logic_hash = "v1_sha256_360d04776b8fecec7b17892571b2e470304fba03fb5a7a2f8f66e392936ecb21"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155020,20 +155090,20 @@ rule MALPEDIA_Win_Lambload_Auto : FILE
 		$sequence_9 = { c1e106 030c9500490710 eb05 b9???????? f641247f 75a2 83f8ff }
 
 	condition:
-		7 of them and filesize <1039360
+		7 of them and filesize < 1039360
 }
 rule MALPEDIA_Win_Lookback_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7580e9e2-80f6-511a-b25c-1dcedd746da6"
+		id = "6609e2c0-f23b-54b4-8d79-f0a645ffbb1d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lookback"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lookback_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "23f3d5d64aa0691d5c11d11eeaa6c946ceb564753a29d81b27fd2ba0df02b692"
+		logic_hash = "v1_sha256_23f3d5d64aa0691d5c11d11eeaa6c946ceb564753a29d81b27fd2ba0df02b692"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155059,20 +155129,20 @@ rule MALPEDIA_Win_Lookback_Auto : FILE
 		$sequence_9 = { 56 57 6880020000 8901 c744241480020000 66894104 e8???????? }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Etumbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7578b31c-0ed7-55b3-8074-02b9b6496821"
+		id = "f2deb39a-f623-532e-8deb-a6fd8054fe3a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.etumbot_auto.yar#L1-L321"
 		license_url = "N/A"
-		logic_hash = "619819745936f9a40c560bb9c0dbcb5d200dd2306f9f732e72d34a6b9dc82070"
+		logic_hash = "v1_sha256_619819745936f9a40c560bb9c0dbcb5d200dd2306f9f732e72d34a6b9dc82070"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -155125,20 +155195,20 @@ rule MALPEDIA_Win_Etumbot_Auto : FILE
 		$sequence_36 = { c68511feffff34 c68512feffff33 c68513feffff72 c68514feffff74 c68515feffff7e }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize < 450560
 }
 rule MALPEDIA_Win_Cryptbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8c726cc-365c-50aa-acf5-f55e8b642760"
+		id = "fde3a9fe-e1c5-5c34-a250-fe42f67d01e7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cryptbot_auto.yar#L1-L208"
 		license_url = "N/A"
-		logic_hash = "47b1a044cb1a45373d0f5744b4acc6b2f29c9cc05af6ad96b3c4efc10032c638"
+		logic_hash = "v1_sha256_47b1a044cb1a45373d0f5744b4acc6b2f29c9cc05af6ad96b3c4efc10032c638"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -155177,20 +155247,20 @@ rule MALPEDIA_Win_Cryptbot_Auto : FILE
 		$sequence_22 = { 8b4d0c 8b09 01f0 11fa }
 
 	condition:
-		7 of them and filesize <17138688
+		7 of them and filesize < 17138688
 }
 rule MALPEDIA_Win_Vohuk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3b59df29-d94c-5e14-b293-d94b874e6f12"
+		id = "2330c8b4-f795-567d-89e5-d568d1cf860f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vohuk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vohuk_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "a782dfb427f32a7fe3f5e7a12676df6b8f0aca1f4f78c54f0e9a25741f4d58aa"
+		logic_hash = "v1_sha256_a782dfb427f32a7fe3f5e7a12676df6b8f0aca1f4f78c54f0e9a25741f4d58aa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155216,20 +155286,20 @@ rule MALPEDIA_Win_Vohuk_Auto : FILE
 		$sequence_9 = { 8bec 81ec5c080000 8d45a8 ba44000000 56 8bf1 c60000 }
 
 	condition:
-		7 of them and filesize <260096
+		7 of them and filesize < 260096
 }
 rule MALPEDIA_Win_Dyepack_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3c6c274a-3d73-5c98-98aa-7fd5f4c3842b"
+		id = "9d0e566e-5899-5b38-9fa1-94e0c198e4fa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyepack"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dyepack_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "b32504dab3948f7d9f4359ced9850f6b13ecbdf66af15ac79005f7fe62b0a577"
+		logic_hash = "v1_sha256_b32504dab3948f7d9f4359ced9850f6b13ecbdf66af15ac79005f7fe62b0a577"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155255,20 +155325,20 @@ rule MALPEDIA_Win_Dyepack_Auto : FILE
 		$sequence_9 = { ff15???????? 56 ff15???????? 8d442410 895c2410 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Karma_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dbba8d60-5e3c-5b62-b524-df57562af200"
+		id = "9afbadeb-c6e3-54f1-a046-32813fb04adf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karma"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.karma_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "3819fc1d726604395f257c41732abcfd39c86d6c5f38e2d6dd6e88cb0f6eea5a"
+		logic_hash = "v1_sha256_3819fc1d726604395f257c41732abcfd39c86d6c5f38e2d6dd6e88cb0f6eea5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155294,20 +155364,20 @@ rule MALPEDIA_Win_Karma_Auto : FILE
 		$sequence_9 = { 7f0c 8b442418 3bf8 0f8224ffffff 8b7c2410 ff742434 6a00 }
 
 	condition:
-		7 of them and filesize <49208
+		7 of them and filesize < 49208
 }
 rule MALPEDIA_Win_Webc2_Yahoo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4eedce59-ab20-52b2-90a4-b849754d3956"
+		id = "06d555ef-2c39-55a5-8ac2-48c3896741aa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_yahoo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_yahoo_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "3d2dd09691f298cf3eef54b62db7cef2339bebabc7bbad3cbeaa6cf7557fae03"
+		logic_hash = "v1_sha256_3d2dd09691f298cf3eef54b62db7cef2339bebabc7bbad3cbeaa6cf7557fae03"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155333,20 +155403,20 @@ rule MALPEDIA_Win_Webc2_Yahoo_Auto : FILE
 		$sequence_9 = { 8d85fcd7ffff 57 50 ebb4 6a64 5b }
 
 	condition:
-		7 of them and filesize <8060928
+		7 of them and filesize < 8060928
 }
 rule MALPEDIA_Win_Bachosens_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fad5470b-a756-574b-813e-1cdf42efa6b2"
+		id = "bb4532a2-7b2f-50a0-9fa1-d1dedba3fd6b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bachosens"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bachosens_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "0a45763c922e1378fcd981d3ff76c84b7a49bb1ac5b3430f86089ebe86f29abf"
+		logic_hash = "v1_sha256_0a45763c922e1378fcd981d3ff76c84b7a49bb1ac5b3430f86089ebe86f29abf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155372,20 +155442,20 @@ rule MALPEDIA_Win_Bachosens_Auto : FILE
 		$sequence_9 = { 4c03d1 458b7220 418b521c 4c03f1 458b7a24 4803d1 }
 
 	condition:
-		7 of them and filesize <643072
+		7 of them and filesize < 643072
 }
 rule MALPEDIA_Win_Bangat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e21234e1-ab1b-5ed7-845e-28d0f46bef68"
+		id = "3c9e6590-cd21-5d9f-9334-4e159636e66d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bangat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bangat_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "527e6766d19f3aa2fef4247d1ea1a8fda60b88b70c01d8ada16ce4d5757a0e35"
+		logic_hash = "v1_sha256_527e6766d19f3aa2fef4247d1ea1a8fda60b88b70c01d8ada16ce4d5757a0e35"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155411,20 +155481,20 @@ rule MALPEDIA_Win_Bangat_Auto : FILE
 		$sequence_9 = { 53 53 6a01 53 8d8588feffff 53 50 }
 
 	condition:
-		7 of them and filesize <1228800
+		7 of them and filesize < 1228800
 }
 rule MALPEDIA_Win_Hermes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5ac17fa7-a096-5e04-8e0d-a201ab441e04"
+		id = "2b2602de-8aea-500c-af8a-3951c8e66df9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hermes_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "43e558aafd9a673bf17e8773d823614dc4de0d10e8aa93baebe8c03b07e12d71"
+		logic_hash = "v1_sha256_43e558aafd9a673bf17e8773d823614dc4de0d10e8aa93baebe8c03b07e12d71"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155450,20 +155520,20 @@ rule MALPEDIA_Win_Hermes_Auto : FILE
 		$sequence_9 = { 50 6a01 6810660000 ff75fc ff15???????? 85c0 }
 
 	condition:
-		7 of them and filesize <7192576
+		7 of them and filesize < 7192576
 }
 rule MALPEDIA_Elf_Mirai_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49bbb193-8df3-5413-98b4-2dd8215ff30b"
+		id = "038ba5f0-6787-5fdf-a844-5a1f7d0b8ffe"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/elf.mirai_auto.yar#L1-L108"
 		license_url = "N/A"
-		logic_hash = "73e144a4e19cc6b3055073cf3ad82cd5b793db0175f18a71bb7c0cd3632a6c7c"
+		logic_hash = "v1_sha256_73e144a4e19cc6b3055073cf3ad82cd5b793db0175f18a71bb7c0cd3632a6c7c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155489,20 +155559,20 @@ rule MALPEDIA_Elf_Mirai_Auto : FILE
 		$sequence_9 = { 66c1e808 d0e8 8d04c0 28c2 }
 
 	condition:
-		7 of them and filesize <2228224
+		7 of them and filesize < 2228224
 }
 rule MALPEDIA_Win_Nimplant_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ab9ad292-a36d-5023-b871-7d5dcf59a376"
+		id = "4cfd3fd5-9909-5b4a-9c38-b12ab937da5d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimplant"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nimplant_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "78100de3c1ed8ac731d4871e0295c4754b22f71e68f7be54c12e992f0adcf829"
+		logic_hash = "v1_sha256_78100de3c1ed8ac731d4871e0295c4754b22f71e68f7be54c12e992f0adcf829"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155528,20 +155598,20 @@ rule MALPEDIA_Win_Nimplant_Auto : FILE
 		$sequence_9 = { 4c89f9 4c894c2420 e8???????? 803b00 4c8b4c2420 0f85bd010000 f30f6f15???????? }
 
 	condition:
-		7 of them and filesize <1811456
+		7 of them and filesize < 1811456
 }
 rule MALPEDIA_Win_Torisma_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c8b0e1d-5ff0-52a0-901d-e5a98754d385"
+		id = "9896cf1a-a0b3-5748-a878-30d5e847d631"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.torisma"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.torisma_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "5f2db125f988ab78c395c9bd2de9be120817934423d4d9849c1bfeec7d230b1e"
+		logic_hash = "v1_sha256_5f2db125f988ab78c395c9bd2de9be120817934423d4d9849c1bfeec7d230b1e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155570,20 +155640,20 @@ rule MALPEDIA_Win_Torisma_Auto : FILE
 		$sequence_12 = { 48894c2408 57 4881ecb0000000 48c7842488000000feffffff }
 
 	condition:
-		7 of them and filesize <322560
+		7 of them and filesize < 322560
 }
 rule MALPEDIA_Elf_Gobrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9cb05d8e-88df-5069-9152-096fc77aac24"
+		id = "eb6bec73-5256-53a4-bece-21473236e5cc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gobrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/elf.gobrat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "29d6047280b8adce38a5f6a7e3d8112ab4747228198bdfc531ab746feecbff32"
+		logic_hash = "v1_sha256_29d6047280b8adce38a5f6a7e3d8112ab4747228198bdfc531ab746feecbff32"
 		score = 60
 		quality = 35
 		tags = "FILE"
@@ -155609,20 +155679,20 @@ rule MALPEDIA_Elf_Gobrat_Auto : FILE
 		$sequence_9 = { e8???????? 488b6d00 488d05225c0500 488d4c2470 e8???????? 31c0 eb28 }
 
 	condition:
-		7 of them and filesize <12853248
+		7 of them and filesize < 12853248
 }
 rule MALPEDIA_Win_Netspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d080908e-0a12-5fdc-839c-5d0458a92f12"
+		id = "98b825f0-315b-514d-8860-505064c356fb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netspy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.netspy_auto.yar#L1-L100"
 		license_url = "N/A"
-		logic_hash = "66a516dd000926156bcdfd45ff83678e3971de0f2826970552469344651d0e0a"
+		logic_hash = "v1_sha256_66a516dd000926156bcdfd45ff83678e3971de0f2826970552469344651d0e0a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155646,20 +155716,20 @@ rule MALPEDIA_Win_Netspy_Auto : FILE
 		$sequence_7 = { c70163382994 e8???????? 4829c4 4889e0 488985e05e0000 e9???????? }
 
 	condition:
-		7 of them and filesize <12033024
+		7 of them and filesize < 12033024
 }
 rule MALPEDIA_Win_Makop_Ransomware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cd34e745-9497-5ffc-bd73-ecb5996e2067"
+		id = "631cc0ef-be14-583c-bc7f-f76054f5dc84"
 		date = "2023-07-11"
 		modified = "2023-07-15"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makop_ransomware"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.makop_ransomware_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "3c7cc3419f322a8e9eb8473ecaf54fc5da0725e8a0f35ff3f90245e28389848b"
+		logic_hash = "v1_sha256_3c7cc3419f322a8e9eb8473ecaf54fc5da0725e8a0f35ff3f90245e28389848b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155685,20 +155755,20 @@ rule MALPEDIA_Win_Makop_Ransomware_Auto : FILE
 		$sequence_9 = { 742f 33c0 3906 763d 8d4c2448 }
 
 	condition:
-		7 of them and filesize <107520
+		7 of them and filesize < 107520
 }
 rule MALPEDIA_Win_Hyperbro_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "928fd5bd-5df8-568b-aeb6-54067fcb6b3c"
+		id = "29be42e5-d27b-5ae6-bfa8-40b725f3597e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperbro"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hyperbro_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "8b88d94d4bfcc0d3fb17142bb489e5f64650c522e571881733fdf16c084eb88b"
+		logic_hash = "v1_sha256_8b88d94d4bfcc0d3fb17142bb489e5f64650c522e571881733fdf16c084eb88b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155724,20 +155794,20 @@ rule MALPEDIA_Win_Hyperbro_Auto : FILE
 		$sequence_9 = { e8???????? 8b4724 50 e8???????? 8b4f20 51 e8???????? }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize < 352256
 }
 rule MALPEDIA_Win_Ironhalo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b2edd4d8-243a-5455-b301-d36fe2c3ed3d"
+		id = "91c88c4b-8048-54a2-81b2-c4204ef5a9f3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ironhalo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ironhalo_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "3a1ed5f7cc69a5a02f4dcd285f3d5642f43e5c8d6d88cc34ecaa1d07c458876f"
+		logic_hash = "v1_sha256_3a1ed5f7cc69a5a02f4dcd285f3d5642f43e5c8d6d88cc34ecaa1d07c458876f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155763,20 +155833,20 @@ rule MALPEDIA_Win_Ironhalo_Auto : FILE
 		$sequence_9 = { c744246801010000 ff15???????? 8b442408 8b35???????? }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Blackshades_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "be0044cc-ffdd-5ce8-9261-6f20deb49ec5"
+		id = "e4f60ab6-31a0-5e48-9596-08c0c8696a4d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackshades"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blackshades_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "5be1fd8de19e4a88da957f4843427153e72a697b528878c27f4d0e3032429536"
+		logic_hash = "v1_sha256_5be1fd8de19e4a88da957f4843427153e72a697b528878c27f4d0e3032429536"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155802,20 +155872,20 @@ rule MALPEDIA_Win_Blackshades_Auto : FILE
 		$sequence_9 = { ff1b 0d002a460c fff5 0200 0000 6c }
 
 	condition:
-		7 of them and filesize <999424
+		7 of them and filesize < 999424
 }
 rule MALPEDIA_Win_Bluelight_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9ab2727d-5272-5ca8-92a4-f15ef9dc3660"
+		id = "90aa3877-a95b-52d7-bc86-d1983c051ddd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluelight"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bluelight_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "807d4d695fef666ac0d7be4d86c77f03bfb065bf15881d360fd3af2db66d4f22"
+		logic_hash = "v1_sha256_807d4d695fef666ac0d7be4d86c77f03bfb065bf15881d360fd3af2db66d4f22"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155841,20 +155911,20 @@ rule MALPEDIA_Win_Bluelight_Auto : FILE
 		$sequence_9 = { eb26 f7462400400000 7421 8b4620 85c0 741a 8b5010 }
 
 	condition:
-		7 of them and filesize <2191360
+		7 of them and filesize < 2191360
 }
 rule MALPEDIA_Win_Moriya_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "45383b38-ad7d-58f1-bbb1-9d0f7680c4d8"
+		id = "1c459566-c39b-5491-8a40-26f1ee14a154"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriya"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.moriya_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "1ab9803873e98ee1cb5c5f8b1cc931b7d333aed621e9979986cfb9846e4dee1c"
+		logic_hash = "v1_sha256_1ab9803873e98ee1cb5c5f8b1cc931b7d333aed621e9979986cfb9846e4dee1c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155880,20 +155950,20 @@ rule MALPEDIA_Win_Moriya_Auto : FILE
 		$sequence_9 = { 7831 488b0d???????? 488b81e0000000 488905???????? }
 
 	condition:
-		7 of them and filesize <58368
+		7 of them and filesize < 58368
 }
 rule MALPEDIA_Win_Quarterrig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "768adc6e-04ee-5553-a73f-cf738ca33079"
+		id = "4352b939-cb90-567a-a53b-06d3539406d2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quarterrig"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.quarterrig_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "b7e9c1f7a0f9288f7f968855b7e176a67e0d0fef09a3da04bc264465377e4dae"
+		logic_hash = "v1_sha256_b7e9c1f7a0f9288f7f968855b7e176a67e0d0fef09a3da04bc264465377e4dae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155919,20 +155989,20 @@ rule MALPEDIA_Win_Quarterrig_Auto : FILE
 		$sequence_9 = { 4c8d2518470300 895c2420 81fb80000000 0f8dd7000000 4863fb 498b34fc 4885f6 }
 
 	condition:
-		7 of them and filesize <971776
+		7 of them and filesize < 971776
 }
 rule MALPEDIA_Win_Netkey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a13a2f78-42fb-5eb6-88d7-3a64826b180e"
+		id = "149640d5-fb5a-5d2a-9395-f4f21d9a6b1a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netkey"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.netkey_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "11cc566a64ecf8a198c36c98aeaff38f948208170139e520619905a90909c22c"
+		logic_hash = "v1_sha256_11cc566a64ecf8a198c36c98aeaff38f948208170139e520619905a90909c22c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155958,20 +156028,20 @@ rule MALPEDIA_Win_Netkey_Auto : FILE
 		$sequence_9 = { e8???????? 83c404 8d85f0efffff 50 6800040000 }
 
 	condition:
-		7 of them and filesize <606208
+		7 of them and filesize < 606208
 }
 rule MALPEDIA_Win_Miancha_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0fca04e0-92f2-5b94-88d0-1960dbccd943"
+		id = "e61236da-6989-5e55-aa0d-972a25ac29ba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miancha"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.miancha_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "265db074bcd13da1887f66f32f80a00bfe9fccbd1f685bc2e9a0d53a7fe9cd80"
+		logic_hash = "v1_sha256_265db074bcd13da1887f66f32f80a00bfe9fccbd1f685bc2e9a0d53a7fe9cd80"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155997,20 +156067,20 @@ rule MALPEDIA_Win_Miancha_Auto : FILE
 		$sequence_9 = { 7412 8d542418 52 ff15???????? 50 ffd6 }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize < 376832
 }
 rule MALPEDIA_Win_Dented_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3499a500-5e01-578b-aa3c-ab625e855061"
+		id = "1f004cb1-ea85-5c8f-800e-217b31d3da62"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dented"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dented_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "2522b2401dbe103d35106dff38664664351f596847e13ae16367587c7b9e72e4"
+		logic_hash = "v1_sha256_2522b2401dbe103d35106dff38664664351f596847e13ae16367587c7b9e72e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156036,20 +156106,20 @@ rule MALPEDIA_Win_Dented_Auto : FILE
 		$sequence_9 = { 59 8bf0 8bcf 33c0 89b5e8f7ffff 2185f0f7ffff }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize < 450560
 }
 rule MALPEDIA_Win_Eyservice_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "589ff6f4-47d8-50d3-88a8-cdfa19ccb778"
+		id = "ada94cec-b0d7-53b1-bf19-f66cc7283897"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eyservice"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.eyservice_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "9d569b1b4aa245beb2c0397a0750c9c20deb66d33a0ec235ace59e3da184607d"
+		logic_hash = "v1_sha256_9d569b1b4aa245beb2c0397a0750c9c20deb66d33a0ec235ace59e3da184607d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156075,20 +156145,20 @@ rule MALPEDIA_Win_Eyservice_Auto : FILE
 		$sequence_9 = { 8b7704 2bf0 7424 3bf1 7602 8bf1 }
 
 	condition:
-		7 of them and filesize <452608
+		7 of them and filesize < 452608
 }
 rule MALPEDIA_Win_Murofet_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ee51841-1931-5e92-8698-30f3c51730b7"
+		id = "13b4e2ad-bb0b-5f4d-80d4-c72f68507e34"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.murofet"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.murofet_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "9298e47cf759c52371e794c7e892c3c0542296ba15da499ce2f22bd9f2d8e48e"
+		logic_hash = "v1_sha256_9298e47cf759c52371e794c7e892c3c0542296ba15da499ce2f22bd9f2d8e48e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156114,20 +156184,20 @@ rule MALPEDIA_Win_Murofet_Auto : FILE
 		$sequence_9 = { 8d4624 55 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <622592
+		7 of them and filesize < 622592
 }
 rule MALPEDIA_Win_Pirpi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "87b6b6f2-e4ed-52ab-9d18-a97a5c488a2f"
+		id = "7af51a56-8856-58a9-8626-fd53a7930ff0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pirpi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pirpi_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "ac2a9b729be997048deec428ae0fd8035f83f34266d3bcf665ee32e11696cc21"
+		logic_hash = "v1_sha256_ac2a9b729be997048deec428ae0fd8035f83f34266d3bcf665ee32e11696cc21"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156153,20 +156223,20 @@ rule MALPEDIA_Win_Pirpi_Auto : FILE
 		$sequence_9 = { 55 50 8bce e8???????? 85c0 0f84ad000000 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Recordbreaker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9dc0ca6e-db62-51b1-9019-1c46d30aeec8"
+		id = "bd131d19-f7c9-58e8-9cd2-2fb41ea4cbe4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.recordbreaker_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "a0221e50197a38d94db3feaa17095d8a8348850bd5ac357aa5c929b1c8bf609a"
+		logic_hash = "v1_sha256_a0221e50197a38d94db3feaa17095d8a8348850bd5ac357aa5c929b1c8bf609a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156192,20 +156262,20 @@ rule MALPEDIA_Win_Recordbreaker_Auto : FILE
 		$sequence_9 = { ff7510 ff750c 56 e8???????? 83c414 56 ff15???????? }
 
 	condition:
-		7 of them and filesize <232312
+		7 of them and filesize < 232312
 }
 rule MALPEDIA_Win_Fudmodule_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bbb969f6-fc21-5df2-98a0-24465f1a52fb"
+		id = "012c0e90-ad75-5a40-87a7-7fa2ccebdd96"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fudmodule"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fudmodule_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "3c836db347337427da5b8480cbffb4c9a34ff35d9d7cf56625d940236b49e08c"
+		logic_hash = "v1_sha256_3c836db347337427da5b8480cbffb4c9a34ff35d9d7cf56625d940236b49e08c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156237,20 +156307,20 @@ rule MALPEDIA_Win_Fudmodule_Auto : FILE
 		$sequence_15 = { 4829fb 66ffc7 d2f8 66ffcf f8 4801e3 660fadd7 }
 
 	condition:
-		7 of them and filesize <795648
+		7 of them and filesize < 795648
 }
 rule MALPEDIA_Win_Client_Maximus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7644986b-8879-5e3c-bd1e-48cdc3ff2e40"
+		id = "a2b0cb8a-5f2c-5ac4-9103-a52b29d63c77"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.client_maximus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.client_maximus_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "2b5d2ecf5b1f20897666cf19bda4b06d4863b096982d3499177f71ebee7c8979"
+		logic_hash = "v1_sha256_2b5d2ecf5b1f20897666cf19bda4b06d4863b096982d3499177f71ebee7c8979"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156276,20 +156346,20 @@ rule MALPEDIA_Win_Client_Maximus_Auto : FILE
 		$sequence_9 = { 85d2 7511 8b5034 85d2 740a 8b4018 85c0 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Jaff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dbcef186-9c65-5f08-b104-968bef8d25a5"
+		id = "8f900f3d-624c-5752-a34e-76a3e132e300"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaff"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jaff_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "9a989bf52696173e65a2ed9949d803cbd331438ebfe4f480f702f5669476fb7a"
+		logic_hash = "v1_sha256_9a989bf52696173e65a2ed9949d803cbd331438ebfe4f480f702f5669476fb7a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156315,20 +156385,20 @@ rule MALPEDIA_Win_Jaff_Auto : FILE
 		$sequence_9 = { 6a08 c745e000000000 c745e40a000000 c645e801 ffd3 50 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Apocalypse_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b5ccf1f6-f470-5408-b195-08329344ed8e"
+		id = "1d351fa6-bae9-5952-a3f6-44d8d5d41c8f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalypse_ransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.apocalypse_ransom_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "18df20f7eebe1c78a082ce30f5a4491f9ac67772b997a33222fc4d85121626f7"
+		logic_hash = "v1_sha256_18df20f7eebe1c78a082ce30f5a4491f9ac67772b997a33222fc4d85121626f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156354,20 +156424,20 @@ rule MALPEDIA_Win_Apocalypse_Ransom_Auto : FILE
 		$sequence_9 = { 6a01 6800000080 8d4c2440 51 ffd6 8bf8 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Ramsay_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca34f65f-e875-5b7a-bc28-21fb62ed4b88"
+		id = "84514f24-fd77-5c3b-a098-71f64c8d29f5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramsay"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ramsay_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "9a41eaab55357b928cd2c1b68d94938a51a46b8558bc541d5b896032a4300700"
+		logic_hash = "v1_sha256_9a41eaab55357b928cd2c1b68d94938a51a46b8558bc541d5b896032a4300700"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156399,20 +156469,20 @@ rule MALPEDIA_Win_Ramsay_Auto : FILE
 		$sequence_15 = { e9???????? 41b908000000 4c8d05929b0200 8b542420 }
 
 	condition:
-		7 of them and filesize <2031616
+		7 of them and filesize < 2031616
 }
 rule MALPEDIA_Win_Crylocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b5ef66c-1ec0-5c10-8396-507384c0e395"
+		id = "adaf89d9-4938-5a60-a816-f8e038f10748"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crylocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crylocker_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "d90969734d25e11d990569603034674764175d320f05923dcd1a4fc7e127f4a1"
+		logic_hash = "v1_sha256_d90969734d25e11d990569603034674764175d320f05923dcd1a4fc7e127f4a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156438,20 +156508,20 @@ rule MALPEDIA_Win_Crylocker_Auto : FILE
 		$sequence_9 = { ffd5 66833c467c 0f8487000000 66833f21 752a 57 ffd5 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Elirks_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2f83629f-d917-5544-9557-f1c734a140a5"
+		id = "282ef60d-7d1d-562d-82ea-eaeabd29d78e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.elirks"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.elirks_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "23afc2f901e3fd2aa39a45f20d3907f7b1b87b547d67ae2e0da6482231d3ff66"
+		logic_hash = "v1_sha256_23afc2f901e3fd2aa39a45f20d3907f7b1b87b547d67ae2e0da6482231d3ff66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156477,20 +156547,20 @@ rule MALPEDIA_Win_Elirks_Auto : FILE
 		$sequence_9 = { 0f8423ffffff 8b8604600000 50 ffd5 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Milkmaid_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5948a1f6-8eaf-5535-ac9f-e8e1c89ea107"
+		id = "4ffd42f4-958e-526f-806b-4327e9ba064f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.milkmaid"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.milkmaid_auto.yar#L1-L98"
 		license_url = "N/A"
-		logic_hash = "b839dfa6db2fa7bf81ab8ee61b0a1d4a011d7a0ef5b792c9852059c0fc803283"
+		logic_hash = "v1_sha256_b839dfa6db2fa7bf81ab8ee61b0a1d4a011d7a0ef5b792c9852059c0fc803283"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156514,20 +156584,20 @@ rule MALPEDIA_Win_Milkmaid_Auto : FILE
 		$sequence_7 = { c744240c00000000 e8???????? 6800010000 8d4c2408 c744241801000000 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Thunker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a7578c2-9954-5c27-9789-75ce33a8978d"
+		id = "748dec3d-0cc4-58b4-8555-00158b54f582"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thunker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.thunker_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "324dbb01ab87806e82adbcf168652688ad932f1c3e2806c75596e6aeba36cca3"
+		logic_hash = "v1_sha256_324dbb01ab87806e82adbcf168652688ad932f1c3e2806c75596e6aeba36cca3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156553,20 +156623,20 @@ rule MALPEDIA_Win_Thunker_Auto : FILE
 		$sequence_9 = { 89df 31c0 f9 19c9 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Htprat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6c918b98-1bd6-5c2a-a08e-afe038715c4f"
+		id = "2ea3cfad-7b4f-54cb-9159-13e3337ec376"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htprat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.htprat_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "3d036a590536bfddf1556e3ceddf3bf5bcdba928f7034561835a6a007a09cb31"
+		logic_hash = "v1_sha256_3d036a590536bfddf1556e3ceddf3bf5bcdba928f7034561835a6a007a09cb31"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156592,20 +156662,20 @@ rule MALPEDIA_Win_Htprat_Auto : FILE
 		$sequence_9 = { e8???????? 84c0 742c 837e1408 8b4e10 7204 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Scanpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68b120db-1dba-5584-bc59-126fea6e111e"
+		id = "ee53f97e-2075-5800-a5b7-94c046722429"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scanpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.scanpos_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "a62211e1eb96c58c9bf699a15d117ca283e56d459f8aea50975f3891740e6968"
+		logic_hash = "v1_sha256_a62211e1eb96c58c9bf699a15d117ca283e56d459f8aea50975f3891740e6968"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156631,20 +156701,20 @@ rule MALPEDIA_Win_Scanpos_Auto : FILE
 		$sequence_9 = { 83c004 57 e8???????? a1???????? 50 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_Deltas_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "25a7191c-2842-5745-a11d-ea324cb5fa9f"
+		id = "444bd17c-f51e-5797-bdfc-594bf0f154e8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deltas"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.deltas_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "c404323fb1d2a8c3fdb1b29caf32d56e1cbc5b9f3900009b6282344552f18e72"
+		logic_hash = "v1_sha256_c404323fb1d2a8c3fdb1b29caf32d56e1cbc5b9f3900009b6282344552f18e72"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156670,20 +156740,20 @@ rule MALPEDIA_Win_Deltas_Auto : FILE
 		$sequence_9 = { 55 56 8be9 57 b940000000 33c0 8dbc242d010000 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Diceloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "593cd06d-f8dd-5a0b-859e-ad7b04c5325f"
+		id = "505eb238-d8a5-53d1-81c7-57cffabe8b76"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diceloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.diceloader_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "e070fb94fcf5f24a6795b4dab69a3a87130002e18415d4a25f346061fa315110"
+		logic_hash = "v1_sha256_e070fb94fcf5f24a6795b4dab69a3a87130002e18415d4a25f346061fa315110"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156709,20 +156779,20 @@ rule MALPEDIA_Win_Diceloader_Auto : FILE
 		$sequence_9 = { 4983c602 4c03f7 498bd6 ffd5 }
 
 	condition:
-		7 of them and filesize <41984
+		7 of them and filesize < 41984
 }
 rule MALPEDIA_Win_Stowaway_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6f8ce329-6af5-534d-8e65-b76b0e9206b8"
+		id = "daf5703b-c62f-5ac3-beaa-486132784e5f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stowaway"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stowaway_auto.yar#L1-L182"
 		license_url = "N/A"
-		logic_hash = "3f7831026b9a760683489b7cb3923fc1a6ee7aeca5e5576ea427cb584360b368"
+		logic_hash = "v1_sha256_3f7831026b9a760683489b7cb3923fc1a6ee7aeca5e5576ea427cb584360b368"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156757,20 +156827,20 @@ rule MALPEDIA_Win_Stowaway_Auto : FILE
 		$sequence_18 = { 7783 7786 7787 7788 }
 
 	condition:
-		7 of them and filesize <8003584
+		7 of them and filesize < 8003584
 }
 rule MALPEDIA_Win_Crat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02c75bda-cef6-5d61-9783-dd39d3c8cee4"
+		id = "6acd2928-fb11-5292-98a6-da75591e7cc2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crat_auto.yar#L1-L181"
 		license_url = "N/A"
-		logic_hash = "723ada0a4601efb2490dd7b222473b1f376d5e93aa2040691bdff635e0b77048"
+		logic_hash = "v1_sha256_723ada0a4601efb2490dd7b222473b1f376d5e93aa2040691bdff635e0b77048"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156804,20 +156874,20 @@ rule MALPEDIA_Win_Crat_Auto : FILE
 		$sequence_17 = { 8b30 8955d8 8955e4 46 c745fc00000000 8bdf 8975e0 }
 
 	condition:
-		7 of them and filesize <4161536
+		7 of them and filesize < 4161536
 }
 rule MALPEDIA_Win_Sunorcal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8968f16-8557-51ad-9926-5303f4012f89"
+		id = "37b763eb-e42a-5850-a825-6b4c719e44fe"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sunorcal"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sunorcal_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "7356cfcbffaef559e7c55d9c230d0091548077f346f07c94d1eede7494054ef4"
+		logic_hash = "v1_sha256_7356cfcbffaef559e7c55d9c230d0091548077f346f07c94d1eede7494054ef4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156843,20 +156913,20 @@ rule MALPEDIA_Win_Sunorcal_Auto : FILE
 		$sequence_9 = { c21000 8b442404 8b00 813863736de0 752a 83781003 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize < 172032
 }
 rule MALPEDIA_Win_Zerocleare_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "433422a9-8155-5253-967a-d468274de85b"
+		id = "31edd6d2-d158-5351-8d68-2c34a14fdde9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerocleare"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zerocleare_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "27ba0960de329e73790bd0fb19cb3129bd1f124ee5eb512b9aca888dc53e16b5"
+		logic_hash = "v1_sha256_27ba0960de329e73790bd0fb19cb3129bd1f124ee5eb512b9aca888dc53e16b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156882,20 +156952,20 @@ rule MALPEDIA_Win_Zerocleare_Auto : FILE
 		$sequence_9 = { e8???????? 83c40c 85c0 744a 6a00 }
 
 	condition:
-		7 of them and filesize <42670080
+		7 of them and filesize < 42670080
 }
 rule MALPEDIA_Win_Minibike_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "64fb33a7-6775-549a-bd66-e303dd414aa4"
+		id = "4b1c7582-32fb-5bb1-8484-2c0d94b019d0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minibike"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.minibike_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "bd38364b90ab98904e008cf661267157cc33bb2a7b72870b77767ef9d697acf9"
+		logic_hash = "v1_sha256_bd38364b90ab98904e008cf661267157cc33bb2a7b72870b77767ef9d697acf9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156921,20 +156991,20 @@ rule MALPEDIA_Win_Minibike_Auto : FILE
 		$sequence_9 = { e8???????? 8bce e8???????? 8bf0 e9???????? 6a02 33c0 }
 
 	condition:
-		7 of them and filesize <574464
+		7 of them and filesize < 574464
 }
 rule MALPEDIA_Win_Tandfuy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "98faff68-6444-5057-abe1-4d454646340b"
+		id = "0926a8e9-376e-530e-8c2c-e92ec11a82ba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tandfuy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tandfuy_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "0d29f36f5ce30fba44a6664f50cc897adc5bd707aa4ee8b0311232ce455481f7"
+		logic_hash = "v1_sha256_0d29f36f5ce30fba44a6664f50cc897adc5bd707aa4ee8b0311232ce455481f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156960,20 +157030,20 @@ rule MALPEDIA_Win_Tandfuy_Auto : FILE
 		$sequence_9 = { 85c0 0f84ea000000 8d4c2424 51 68???????? 53 ff15???????? }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Zitmo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d2638537-3a4e-5c8e-ade0-4e7713d00050"
+		id = "48662fa9-abd1-5b53-894e-d4b5a4b1fb5a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zitmo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zitmo_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "0686a29e962228ecc50738c63dd8a09a1caddb201f651468d74323cba829436b"
+		logic_hash = "v1_sha256_0686a29e962228ecc50738c63dd8a09a1caddb201f651468d74323cba829436b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156999,20 +157069,20 @@ rule MALPEDIA_Win_Zitmo_Auto : FILE
 		$sequence_9 = { e8???????? c9 c20800 55 8bec 81c478ffffff ff4dc0 }
 
 	condition:
-		7 of them and filesize <843776
+		7 of them and filesize < 843776
 }
 rule MALPEDIA_Win_Fakeword_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7169860f-e999-5507-9589-e70286203456"
+		id = "f45499ff-df39-512f-bcd8-9574bf1070ef"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fakeword"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fakeword_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "76d399ff443db77ecdb848e572804a47dc4d5691a8ae699933905dad0bc0467f"
+		logic_hash = "v1_sha256_76d399ff443db77ecdb848e572804a47dc4d5691a8ae699933905dad0bc0467f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157038,20 +157108,20 @@ rule MALPEDIA_Win_Fakeword_Auto : FILE
 		$sequence_9 = { ffd6 8d8c2418010000 68???????? 51 ffd6 893d???????? 8b03 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Bernhardpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e53bca0c-e390-5052-8af3-50fac1bc5855"
+		id = "dbb86fb6-1c3c-50bd-8716-d819d9427823"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bernhardpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bernhardpos_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "1e1ede6b562cb821e225ab092cfdf0abf71f1c6115a9127ed5d67b3e3afac78f"
+		logic_hash = "v1_sha256_1e1ede6b562cb821e225ab092cfdf0abf71f1c6115a9127ed5d67b3e3afac78f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157077,20 +157147,20 @@ rule MALPEDIA_Win_Bernhardpos_Auto : FILE
 		$sequence_9 = { e8???????? 83c404 6a01 8d85d0feffff 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Rdat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c05f84d4-de9e-5fb2-ae60-330892f73174"
+		id = "65f19b38-5794-5985-99d1-b86b08e58bb9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rdat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rdat_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "2e9377d4369bfead5bccbe7fe48c6c763a624a3a6df0438cb4949c8e1a10afb4"
+		logic_hash = "v1_sha256_2e9377d4369bfead5bccbe7fe48c6c763a624a3a6df0438cb4949c8e1a10afb4"
 		score = 60
 		quality = 45
 		tags = "FILE"
@@ -157122,20 +157192,20 @@ rule MALPEDIA_Win_Rdat_Auto : FILE
 		$sequence_15 = { 488d95e8010000 488d8d68010000 e8???????? 90 488d9568010000 4883bd8001000010 }
 
 	condition:
-		7 of them and filesize <1573888
+		7 of them and filesize < 1573888
 }
 rule MALPEDIA_Win_Unidentified_094_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f5bdd8f3-d974-5222-9555-3631072a29c0"
+		id = "ee055037-656b-5257-a169-88743ad9f2dd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_094"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_094_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "f3d0ed91e99c9ab03a6ddd24a2a28007a40b7e677077c8b725a5a67f32cc52a7"
+		logic_hash = "v1_sha256_f3d0ed91e99c9ab03a6ddd24a2a28007a40b7e677077c8b725a5a67f32cc52a7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157161,20 +157231,20 @@ rule MALPEDIA_Win_Unidentified_094_Auto : FILE
 		$sequence_9 = { 890d???????? 57 8915???????? a3???????? }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize < 524288
 }
 rule MALPEDIA_Win_Silentgh0St_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4a960624-dc10-5985-85b4-1cf5514d3775"
+		id = "908889b6-ce71-5631-89ac-1f81f975e382"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.silentgh0st"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.silentgh0st_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a3ef882d6032b75964ce0bbd68389a460d9ac4c6db1e56db70620c83eabc0109"
+		logic_hash = "v1_sha256_a3ef882d6032b75964ce0bbd68389a460d9ac4c6db1e56db70620c83eabc0109"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157200,20 +157270,20 @@ rule MALPEDIA_Win_Silentgh0St_Auto : FILE
 		$sequence_9 = { 7ccc 8b5c2408 85db 7409 56 57 6a03 }
 
 	condition:
-		7 of them and filesize <2065408
+		7 of them and filesize < 2065408
 }
 rule MALPEDIA_Win_Ghost_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e442a566-13fc-5122-ba83-74fd22421a05"
+		id = "c9b5ee7f-f861-5b03-81a9-9aee37152852"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ghost_rat_auto.yar#L1-L316"
 		license_url = "N/A"
-		logic_hash = "ec6224b8ae12982eada904cedab10d4c1635a00f1f82b5bceec6389113a6ffb4"
+		logic_hash = "v1_sha256_ec6224b8ae12982eada904cedab10d4c1635a00f1f82b5bceec6389113a6ffb4"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -157262,20 +157332,20 @@ rule MALPEDIA_Win_Ghost_Rat_Auto : FILE
 		$sequence_32 = { 898570ffffff e8???????? 6a40 6800100000 8b45d0 }
 
 	condition:
-		7 of them and filesize <357376
+		7 of them and filesize < 357376
 }
 rule MALPEDIA_Win_Bruh_Wiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8004678f-c7f1-56db-b368-30e9334ba4b0"
+		id = "3dfb3381-f584-5019-8d30-457301dcd554"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bruh_wiper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bruh_wiper_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "26b32a2c0d923fc99fb91e4beb18e36e72d9c523fef8bdb0bb63ddd5fd11ff5a"
+		logic_hash = "v1_sha256_26b32a2c0d923fc99fb91e4beb18e36e72d9c523fef8bdb0bb63ddd5fd11ff5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157301,20 +157371,20 @@ rule MALPEDIA_Win_Bruh_Wiper_Auto : FILE
 		$sequence_9 = { 50 ffd6 68???????? 68???????? 8bf8 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Retro_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "137253c4-c80f-5441-8b2d-57b863c1f908"
+		id = "065cd0cd-b996-5b14-b0fd-286d7af35d12"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retro"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.retro_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "603d0a826a833e930e158367f2340675f42fda3d145846edecb7422d26e8a466"
+		logic_hash = "v1_sha256_603d0a826a833e930e158367f2340675f42fda3d145846edecb7422d26e8a466"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157340,20 +157410,20 @@ rule MALPEDIA_Win_Retro_Auto : FILE
 		$sequence_9 = { 8b4638 85c0 7fc5 48634658 488d0c40 48634664 4803c8 }
 
 	condition:
-		7 of them and filesize <1409024
+		7 of them and filesize < 1409024
 }
 rule MALPEDIA_Win_Atharvan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3c02a0c3-381c-58dd-b6d4-bea79ed0706c"
+		id = "17036e60-4897-50ff-87ec-d1da3a1ce294"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atharvan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.atharvan_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "0acd4bed1957d388586b468893d24540b89fb41ef5b3efe72287a455a5c18d66"
+		logic_hash = "v1_sha256_0acd4bed1957d388586b468893d24540b89fb41ef5b3efe72287a455a5c18d66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157379,20 +157449,20 @@ rule MALPEDIA_Win_Atharvan_Auto : FILE
 		$sequence_9 = { 488945ff 488d05a0b60000 4889450f 488d05a5b60000 48895507 }
 
 	condition:
-		7 of them and filesize <348160
+		7 of them and filesize < 348160
 }
 rule MALPEDIA_Win_Dircrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6dfaa124-348a-5731-9f6e-b3677fe125b4"
+		id = "9ecff248-877d-5e8c-b84d-c78d67df2154"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dircrypt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dircrypt_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "62b8e91a741487003e5f68773b4563818c6ceb487f0acf4f30c08c003042c088"
+		logic_hash = "v1_sha256_62b8e91a741487003e5f68773b4563818c6ceb487f0acf4f30c08c003042c088"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157418,20 +157488,20 @@ rule MALPEDIA_Win_Dircrypt_Auto : FILE
 		$sequence_9 = { 6a01 6a06 8d45dc 50 }
 
 	condition:
-		7 of them and filesize <671744
+		7 of them and filesize < 671744
 }
 rule MALPEDIA_Elf_Blackcat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1fea123-6f91-5435-8619-28347a7f06ff"
+		id = "409c3abf-2440-55a7-b1bd-946b2ec9d48d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackcat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/elf.blackcat_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "630d3dc7c9122b8f92125090dcb7617ef29586df7b1f7e85bb11a06ca666eb4d"
+		logic_hash = "v1_sha256_630d3dc7c9122b8f92125090dcb7617ef29586df7b1f7e85bb11a06ca666eb4d"
 		score = 60
 		quality = 45
 		tags = "FILE"
@@ -157457,20 +157527,20 @@ rule MALPEDIA_Elf_Blackcat_Auto : FILE
 		$sequence_9 = { 0fb6c8 8d1489 8d0cd1 c1e90c 6bd164 28d0 }
 
 	condition:
-		7 of them and filesize <8011776
+		7 of them and filesize < 8011776
 }
 rule MALPEDIA_Win_Greetingghoul_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "881721a5-e164-51b8-a287-1242b24b8d86"
+		id = "36a0925e-eb3d-55e7-bb34-808ef1445086"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.greetingghoul"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.greetingghoul_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "21010fe53cfb0bf5a0ef36b612c93204fe24237a4c71d13df9cbc88f88795750"
+		logic_hash = "v1_sha256_21010fe53cfb0bf5a0ef36b612c93204fe24237a4c71d13df9cbc88f88795750"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157496,20 +157566,20 @@ rule MALPEDIA_Win_Greetingghoul_Auto : FILE
 		$sequence_9 = { 8a08 3acb 750c 40 84c9 }
 
 	condition:
-		7 of them and filesize <696320
+		7 of them and filesize < 696320
 }
 rule MALPEDIA_Win_Vermilion_Strike_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0cca6268-ed67-5b5d-8d1e-c4b1c4763f8b"
+		id = "a5d7e547-7144-5fe6-a301-9699ffe89d28"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vermilion_strike"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vermilion_strike_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "ffc8a6cd25f24a5bbb4ecf81a74aa2be97f9696d5656c7bc8cb3391d29c69c5d"
+		logic_hash = "v1_sha256_ffc8a6cd25f24a5bbb4ecf81a74aa2be97f9696d5656c7bc8cb3391d29c69c5d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157535,20 +157605,20 @@ rule MALPEDIA_Win_Vermilion_Strike_Auto : FILE
 		$sequence_9 = { 750c c705????????01000000 eba9 83f808 75a4 c705????????04000000 eb98 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Shady_Hammock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "36740afa-cc52-5013-823b-4d67eb5edc24"
+		id = "0ef81bd7-bed2-5fc7-aa7d-8a5e30c4d797"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shady_hammock"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shady_hammock_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "fa878708757191f1b63841f4404f6fa30ea9e29c95ad0fe726f8dc83ae6686cd"
+		logic_hash = "v1_sha256_fa878708757191f1b63841f4404f6fa30ea9e29c95ad0fe726f8dc83ae6686cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157574,20 +157644,20 @@ rule MALPEDIA_Win_Shady_Hammock_Auto : FILE
 		$sequence_9 = { 66ffc6 663b7706 72cf 488bd7 }
 
 	condition:
-		7 of them and filesize <635904
+		7 of them and filesize < 635904
 }
 rule MALPEDIA_Win_Photolite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b838fe06-7cef-5999-9706-bfe3b9dcfde8"
+		id = "5b63f155-b41f-5869-ae36-204f39a48989"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photolite"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.photolite_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "5ed47a87d33839515eff080f5efa80e00a8db9b392140f3655d5bd0ad6753f13"
+		logic_hash = "v1_sha256_5ed47a87d33839515eff080f5efa80e00a8db9b392140f3655d5bd0ad6753f13"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157619,20 +157689,20 @@ rule MALPEDIA_Win_Photolite_Auto : FILE
 		$sequence_15 = { 4c897da0 448965d8 4c8965d0 e8???????? 3dc8000000 0f849d000000 488b5d28 }
 
 	condition:
-		7 of them and filesize <99328
+		7 of them and filesize < 99328
 }
 rule MALPEDIA_Win_Glassrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "42f75008-33b0-5628-aa20-35cf904b2cc2"
+		id = "12150720-7431-5841-99c7-8c1b3fc2b9d0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glassrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.glassrat_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "4ee9c1e6fb6f5290f1ce6d0e335f981f784c2b61e1aa9e3c4c33ebb2644983ee"
+		logic_hash = "v1_sha256_4ee9c1e6fb6f5290f1ce6d0e335f981f784c2b61e1aa9e3c4c33ebb2644983ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157658,20 +157728,20 @@ rule MALPEDIA_Win_Glassrat_Auto : FILE
 		$sequence_9 = { 6a00 ff15???????? a1???????? 8b15???????? 8b0d???????? 89442408 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Bunnyloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ece611ac-2894-5ce7-8657-b8f35c78c42b"
+		id = "9ef1725a-7574-5390-9d8f-5468a6213572"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bunnyloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bunnyloader_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "129a4ff66c7e006295a1adc8f4f2d85689837626bb7a785d4d174a96334a4fa5"
+		logic_hash = "v1_sha256_129a4ff66c7e006295a1adc8f4f2d85689837626bb7a785d4d174a96334a4fa5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157697,20 +157767,20 @@ rule MALPEDIA_Win_Bunnyloader_Auto : FILE
 		$sequence_9 = { ff75e8 e8???????? ff75e8 8bf0 e8???????? 33c0 83c40c }
 
 	condition:
-		7 of them and filesize <2998272
+		7 of them and filesize < 2998272
 }
 rule MALPEDIA_Win_Expiro_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "537fff19-bacc-5fad-8e62-d15e873151bb"
+		id = "fe986843-314b-59a9-a933-b857b5ee2f9e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.expiro"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.expiro_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "9d4a4b6071f8efe24f30549b3b2d217f52995878f6039fe924a8169a6f93625b"
+		logic_hash = "v1_sha256_9d4a4b6071f8efe24f30549b3b2d217f52995878f6039fe924a8169a6f93625b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157736,20 +157806,20 @@ rule MALPEDIA_Win_Expiro_Auto : FILE
 		$sequence_9 = { 83c404 33c0 668944244c 6a04 897c2464 895c2460 e8???????? }
 
 	condition:
-		7 of them and filesize <3776512
+		7 of them and filesize < 3776512
 }
 rule MALPEDIA_Win_Tonerjam_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82fd263f-2277-5710-bde1-c5f381e7b3bb"
+		id = "c5b5112b-71de-5313-88bb-929e375547a1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tonerjam"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tonerjam_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "099b04145c5c37971e7ea839a0239f9aa67c9ef01dc57a28edbabde3d3d1e624"
+		logic_hash = "v1_sha256_099b04145c5c37971e7ea839a0239f9aa67c9ef01dc57a28edbabde3d3d1e624"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157775,20 +157845,20 @@ rule MALPEDIA_Win_Tonerjam_Auto : FILE
 		$sequence_9 = { 85c9 7858 3b15???????? 7350 488bca 4c8d05d9de0000 83e13f }
 
 	condition:
-		7 of them and filesize <315392
+		7 of them and filesize < 315392
 }
 rule MALPEDIA_Win_Trickbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b628fd83-f3fd-51c9-94aa-b13e26229dea"
+		id = "16262160-f49b-52a1-beaa-88cab82c5e8b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.trickbot_auto.yar#L1-L652"
 		license_url = "N/A"
-		logic_hash = "c6087fe2aa4e485109cf9851f9f0a342724e7430c1979121c1548b3fca1551c6"
+		logic_hash = "v1_sha256_c6087fe2aa4e485109cf9851f9f0a342724e7430c1979121c1548b3fca1551c6"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -157883,20 +157953,20 @@ rule MALPEDIA_Win_Trickbot_Auto : FILE
 		$sequence_78 = { 7502 eb0c 8d55dc 52 ff15???????? ebcc c745f800000000 }
 
 	condition:
-		7 of them and filesize <712704
+		7 of them and filesize < 712704
 }
 rule MALPEDIA_Win_Phandoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0e2d27b4-00ed-575d-8906-80ec3438892e"
+		id = "d09b0e82-8e5f-5db2-8b05-4af196364870"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phandoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.phandoor_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "672e69f8a19e82fd9345f6016aa6bea0d13d3c04e81e3fb7b10e21c796057271"
+		logic_hash = "v1_sha256_672e69f8a19e82fd9345f6016aa6bea0d13d3c04e81e3fb7b10e21c796057271"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157928,20 +157998,20 @@ rule MALPEDIA_Win_Phandoor_Auto : FILE
 		$sequence_15 = { 56 8b7308 85f6 7420 57 }
 
 	condition:
-		7 of them and filesize <2124800
+		7 of them and filesize < 2124800
 }
 rule MALPEDIA_Win_Nighthawk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "031218c2-08fe-51c2-a9be-67ba73d1aae5"
+		id = "58d08abf-c440-5ee3-875c-90fc1b4d34b1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nighthawk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nighthawk_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "477ee6b7607005d8498fab8a4f21f58e1d0451668a3652d5802801764720896d"
+		logic_hash = "v1_sha256_477ee6b7607005d8498fab8a4f21f58e1d0451668a3652d5802801764720896d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157967,20 +158037,20 @@ rule MALPEDIA_Win_Nighthawk_Auto : FILE
 		$sequence_9 = { 755b 488365df00 488365ef00 48c745f70f000000 458d4610 488d1577010600 }
 
 	condition:
-		7 of them and filesize <1949696
+		7 of them and filesize < 1949696
 }
 rule MALPEDIA_Win_Excalibur_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2243999a-f912-5283-8db6-7a7e597c07e9"
+		id = "2dbd052a-04f4-5dbd-8ea6-13cd84cfdea5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.excalibur"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.excalibur_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "58bc3d918cc2c57a1f8a313886d8855731ce5abe92983e974335457efdd3438d"
+		logic_hash = "v1_sha256_58bc3d918cc2c57a1f8a313886d8855731ce5abe92983e974335457efdd3438d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158006,20 +158076,20 @@ rule MALPEDIA_Win_Excalibur_Auto : FILE
 		$sequence_9 = { 8d8d2cffffff c645fc08 e8???????? 57 8bd0 8d8d14ffffff }
 
 	condition:
-		7 of them and filesize <1253376
+		7 of them and filesize < 1253376
 }
 rule MALPEDIA_Win_Hermeticwizard_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d95bc7c2-314b-5852-896f-2ab463620583"
+		id = "b250eb67-ca43-5e90-bfb3-dabc14e566e8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwizard"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hermeticwizard_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "a04b957d824c192d4445e19ff2c64beb34502a356441d2497a3f568d12cc4736"
+		logic_hash = "v1_sha256_a04b957d824c192d4445e19ff2c64beb34502a356441d2497a3f568d12cc4736"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158045,20 +158115,20 @@ rule MALPEDIA_Win_Hermeticwizard_Auto : FILE
 		$sequence_9 = { 50 8d4dac e8???????? 8b4dc4 }
 
 	condition:
-		7 of them and filesize <263168
+		7 of them and filesize < 263168
 }
 rule MALPEDIA_Win_Nitrogen_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3b860399-f17f-5be6-a7fa-0d462134408c"
+		id = "d8a09283-e69a-54c7-a36b-969877b2407b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitrogen"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nitrogen_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7fc10887629eb8cbe7591a0bc8e19e89881d6b530c9068ab47e88598472a7314"
+		logic_hash = "v1_sha256_7fc10887629eb8cbe7591a0bc8e19e89881d6b530c9068ab47e88598472a7314"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158084,20 +158154,20 @@ rule MALPEDIA_Win_Nitrogen_Auto : FILE
 		$sequence_9 = { e8???????? 898424f8020000 0fbe442441 b904000000 4869c98f020000 488d157f9e3b00 89040a }
 
 	condition:
-		7 of them and filesize <65433600
+		7 of them and filesize < 65433600
 }
 rule MALPEDIA_Win_Urlzone_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66cd5cda-0cf5-5934-9baf-6b5f820d2f06"
+		id = "c54a2943-2739-5726-91ee-b6260dcf5787"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.urlzone"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.urlzone_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "7c1a2ac73460b5e428df7b91964316f5979631407a0a74f2db057df15dd1651b"
+		logic_hash = "v1_sha256_7c1a2ac73460b5e428df7b91964316f5979631407a0a74f2db057df15dd1651b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158123,20 +158193,20 @@ rule MALPEDIA_Win_Urlzone_Auto : FILE
 		$sequence_9 = { 7c63 80fc39 7f05 80ec30 eb22 80fc41 7c54 }
 
 	condition:
-		7 of them and filesize <704512
+		7 of them and filesize < 704512
 }
 rule MALPEDIA_Win_Mangzamel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b83ef951-bd5b-5678-b2df-639cf3b41b3c"
+		id = "03d21ea2-a38c-5936-9b9b-b83c0b0f2bc2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mangzamel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mangzamel_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "f6c1e5305bfe68c66a3ef4b49c38bfc3eb7f92ef914438435cd55d230265d8d5"
+		logic_hash = "v1_sha256_f6c1e5305bfe68c66a3ef4b49c38bfc3eb7f92ef914438435cd55d230265d8d5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158162,20 +158232,20 @@ rule MALPEDIA_Win_Mangzamel_Auto : FILE
 		$sequence_9 = { e8???????? 51 56 57 8b7d08 85ff }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Tabmsgsql_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "46efd2fa-703e-5a59-aba6-3e76ded2c28a"
+		id = "ccf25bc9-85af-5cad-9bb8-f81b491f4115"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tabmsgsql"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tabmsgsql_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "b7af53703ea2c2d22f99bfde61f6f08676ed98de77314180af9bbcb3621e1f8d"
+		logic_hash = "v1_sha256_b7af53703ea2c2d22f99bfde61f6f08676ed98de77314180af9bbcb3621e1f8d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158201,20 +158271,20 @@ rule MALPEDIA_Win_Tabmsgsql_Auto : FILE
 		$sequence_9 = { 5e 5d 5b 7421 8b8424f8f40100 8d4c2400 50 }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Industroyer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4666d9b8-e696-5bb0-aac9-aa0f0ad9f1b7"
+		id = "7e10bfba-e95c-5232-a609-7cabac7abc64"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.industroyer_auto.yar#L1-L376"
 		license_url = "N/A"
-		logic_hash = "6dea509664f187f90fcd96f2db4ab697e4dc6a135630fab4d4323ee78e00c0a5"
+		logic_hash = "v1_sha256_6dea509664f187f90fcd96f2db4ab697e4dc6a135630fab4d4323ee78e00c0a5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -158270,20 +158340,20 @@ rule MALPEDIA_Win_Industroyer_Auto : FILE
 		$sequence_39 = { 8d8424cc000000 50 57 e8???????? 6a30 }
 
 	condition:
-		7 of them and filesize <983040
+		7 of them and filesize < 983040
 }
 rule MALPEDIA_Win_Unidentified_110_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "de50c299-8c19-5206-82ae-12d89e1364a2"
+		id = "e383d071-3d7f-5d17-b729-08cdc57acdaa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_110"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_110_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7703e37b095cb10c8692d1e0e6db116fd89428e35c2b0f841b802fc9c40d7edf"
+		logic_hash = "v1_sha256_7703e37b095cb10c8692d1e0e6db116fd89428e35c2b0f841b802fc9c40d7edf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158309,20 +158379,20 @@ rule MALPEDIA_Win_Unidentified_110_Auto : FILE
 		$sequence_9 = { ba04000000 e8???????? 832000 66c740040200 6644897806 896808 4883600c00 }
 
 	condition:
-		7 of them and filesize <3217408
+		7 of them and filesize < 3217408
 }
 rule MALPEDIA_Win_Observer_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "24de6ab1-f92f-5eeb-9448-e6d3e6bd0612"
+		id = "03646501-baeb-5686-b93d-368b3cd4a584"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.observer_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.observer_stealer_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "408c29e400138ccd9118763d2259592c2d4bc7c8429c89ee21feadbbd649bc7c"
+		logic_hash = "v1_sha256_408c29e400138ccd9118763d2259592c2d4bc7c8429c89ee21feadbbd649bc7c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158348,20 +158418,20 @@ rule MALPEDIA_Win_Observer_Stealer_Auto : FILE
 		$sequence_9 = { 50 8d4c241c e8???????? 8d8c24e0000000 8b00 03c5 50 }
 
 	condition:
-		7 of them and filesize <614400
+		7 of them and filesize < 614400
 }
 rule MALPEDIA_Win_Voidoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "92ea84a1-8606-53ec-b061-29e92893f1a1"
+		id = "a274838c-9bb5-5c9b-9bd6-410d4d83e5a7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.voidoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.voidoor_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c7810f3b0438aab57f906bea825e4f8545638ef9f814f76d8e4defd0ecb553e3"
+		logic_hash = "v1_sha256_c7810f3b0438aab57f906bea825e4f8545638ef9f814f76d8e4defd0ecb553e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158387,20 +158457,20 @@ rule MALPEDIA_Win_Voidoor_Auto : FILE
 		$sequence_9 = { e8???????? 6a00 32d2 8d4db4 c645fc08 e8???????? 83c434 }
 
 	condition:
-		7 of them and filesize <1744896
+		7 of them and filesize < 1744896
 }
 rule MALPEDIA_Win_Wslink_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fab4adfe-31ab-528e-91bb-69ff368202dc"
+		id = "1bb9bfd9-05f7-56f5-b41c-4992c9bcfbdf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wslink"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wslink_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "043911efcdbe30576afee29cea013b6adde98869fbb9875f474aa30d6ea1369e"
+		logic_hash = "v1_sha256_043911efcdbe30576afee29cea013b6adde98869fbb9875f474aa30d6ea1369e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158426,20 +158496,20 @@ rule MALPEDIA_Win_Wslink_Auto : FILE
 		$sequence_9 = { ff4f30 488bcb e8???????? 488b7c2460 488bc3 488b5c2470 4883c468 }
 
 	condition:
-		7 of them and filesize <2007040
+		7 of them and filesize < 2007040
 }
 rule MALPEDIA_Win_Raccoon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1c26303-9125-5fd7-aa51-ad1eac6fcf97"
+		id = "eed3aab4-aa50-5fdf-a7d7-edf60fe41be2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.raccoon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.raccoon_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "490a547d291c29560eb0a750de21265ccd9b82463cd0d04b08babd8cc5f3ca9a"
+		logic_hash = "v1_sha256_490a547d291c29560eb0a750de21265ccd9b82463cd0d04b08babd8cc5f3ca9a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158465,20 +158535,20 @@ rule MALPEDIA_Win_Raccoon_Auto : FILE
 		$sequence_9 = { 8bcf e8???????? 59 59 8d7301 56 ff15???????? }
 
 	condition:
-		7 of them and filesize <1212416
+		7 of them and filesize < 1212416
 }
 rule MALPEDIA_Win_Wmighost_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4ae59171-3faf-5182-8f52-dee99c964f8d"
+		id = "150f42df-d28c-5edd-8a19-218c510e14e5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wmighost"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wmighost_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "e0508af85bc342ca28af7aa1d71f7f0ca199aee7b1652eae79524bd3a3802f63"
+		logic_hash = "v1_sha256_e0508af85bc342ca28af7aa1d71f7f0ca199aee7b1652eae79524bd3a3802f63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158504,20 +158574,20 @@ rule MALPEDIA_Win_Wmighost_Auto : FILE
 		$sequence_9 = { 8b45b4 8945b0 c645fc04 8d4de8 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Miragefox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8bf05d8f-c582-5717-9f26-33fdbc027523"
+		id = "ea851d9c-b896-5424-a254-13a94022839e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miragefox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.miragefox_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "fae00ba596fafa75e5c73049938b7e9042d943cf7a2a8e03f73ab30fb5fff604"
+		logic_hash = "v1_sha256_fae00ba596fafa75e5c73049938b7e9042d943cf7a2a8e03f73ab30fb5fff604"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158543,20 +158613,20 @@ rule MALPEDIA_Win_Miragefox_Auto : FILE
 		$sequence_9 = { 2900 55 8bec 81ec48030000 53 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Nosu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fdc65506-7690-528c-80ea-bfae31870e43"
+		id = "1adb740e-c3e2-5297-98ca-d3b0aaf7a3c6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nosu"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nosu_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "63b3125b2fa7b440ce66614e4988544ad3a96e52c6fcd77e2718549a9b26e496"
+		logic_hash = "v1_sha256_63b3125b2fa7b440ce66614e4988544ad3a96e52c6fcd77e2718549a9b26e496"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158582,20 +158652,20 @@ rule MALPEDIA_Win_Nosu_Auto : FILE
 		$sequence_9 = { 50 56 ff15???????? 8bd0 8bce e8???????? 59 }
 
 	condition:
-		7 of them and filesize <513024
+		7 of them and filesize < 513024
 }
 rule MALPEDIA_Win_Termite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee31374f-70c6-5ab3-95b3-0fe1e417c08c"
+		id = "30258368-19cb-5e46-88cc-6c59ab391b7e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.termite"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.termite_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "f0f791f686acda15650442706f1dd42f13979090335dd24cb4b6c5332386c748"
+		logic_hash = "v1_sha256_f0f791f686acda15650442706f1dd42f13979090335dd24cb4b6c5332386c748"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158621,20 +158691,20 @@ rule MALPEDIA_Win_Termite_Auto : FILE
 		$sequence_9 = { 8b45f0 89442404 8b4508 890424 e8???????? 8945e8 8b450c }
 
 	condition:
-		7 of them and filesize <312320
+		7 of them and filesize < 312320
 }
 rule MALPEDIA_Win_Madmax_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9d1cbce1-ade8-5d76-a04c-20b098c8480b"
+		id = "e517bcc4-e3b3-5d69-a734-6d121989d027"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.madmax"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.madmax_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ad33eff006b5d6cb56b22d8686bde1b21a59becc38b8876b1c999d0a4976f07a"
+		logic_hash = "v1_sha256_ad33eff006b5d6cb56b22d8686bde1b21a59becc38b8876b1c999d0a4976f07a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158660,20 +158730,20 @@ rule MALPEDIA_Win_Madmax_Auto : FILE
 		$sequence_9 = { e652 45 23a7cb3626db a9886e48e3 3407 d120 c1f37d }
 
 	condition:
-		7 of them and filesize <3227648
+		7 of them and filesize < 3227648
 }
 rule MALPEDIA_Win_Sys10_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8102506f-afd2-556d-bce7-166bae2224bf"
+		id = "e58fc9eb-1f13-5170-b0b6-1ab1ab282203"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sys10"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sys10_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "55e8ffe5ea66b378dbdb046d53bca4c06889e1977a823bfc6a76defa2eb61357"
+		logic_hash = "v1_sha256_55e8ffe5ea66b378dbdb046d53bca4c06889e1977a823bfc6a76defa2eb61357"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158699,20 +158769,20 @@ rule MALPEDIA_Win_Sys10_Auto : FILE
 		$sequence_9 = { 6810270000 ff15???????? 33c0 59 c20c00 8b442410 c70044020000 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Deltastealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ae1ce1b2-5800-51da-891a-7d0ee714cc8c"
+		id = "91b58700-659b-5b32-b63b-232ef11dcb11"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deltastealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.deltastealer_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "7a995bc7de4a09d620f7c56a219adce0b4fee73dcf5dde633c44a4fcc3f98e63"
+		logic_hash = "v1_sha256_7a995bc7de4a09d620f7c56a219adce0b4fee73dcf5dde633c44a4fcc3f98e63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158738,20 +158808,20 @@ rule MALPEDIA_Win_Deltastealer_Auto : FILE
 		$sequence_9 = { 4885c0 748a 8a1406 8a1c01 881c06 881401 48ffc0 }
 
 	condition:
-		7 of them and filesize <3532800
+		7 of them and filesize < 3532800
 }
 rule MALPEDIA_Win_Unidentified_108_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "91d0ee32-15d3-5f4b-b0c7-e219a3fb056f"
+		id = "9ccb690f-0a4f-5016-b1a6-2add293ce2f9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_108"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_108_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "bc8d7e8276cd214c62a44b786052de8d0d6c82c70c52e7e29cb797627cab2825"
+		logic_hash = "v1_sha256_bc8d7e8276cd214c62a44b786052de8d0d6c82c70c52e7e29cb797627cab2825"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158777,20 +158847,20 @@ rule MALPEDIA_Win_Unidentified_108_Auto : FILE
 		$sequence_9 = { 7350 488bca 4c8d051d310100 83e13f 488bc2 48c1f806 }
 
 	condition:
-		7 of them and filesize <307200
+		7 of them and filesize < 307200
 }
 rule MALPEDIA_Win_Locky_Decryptor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "efee58a7-3550-5808-a11a-aa56167214d6"
+		id = "860b1823-05e4-5b32-9d07-562b644a1808"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.locky_decryptor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.locky_decryptor_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b6828e87e6bd376fe16778fc8bf9496b415a17dfa2572d88c3351b8ea18cb0b2"
+		logic_hash = "v1_sha256_b6828e87e6bd376fe16778fc8bf9496b415a17dfa2572d88c3351b8ea18cb0b2"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -158816,20 +158886,20 @@ rule MALPEDIA_Win_Locky_Decryptor_Auto : FILE
 		$sequence_9 = { c745c007000000 668945ac e8???????? ff75e4 8365fc00 8d45c8 e8???????? }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Kardonloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1fc9d8e7-57f1-59f6-8755-7f22512ea4b8"
+		id = "ce07fa68-3e88-5159-a57d-a960021ea375"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kardonloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kardonloader_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "af6ba3e21c382f2fd654060dcfde8b3eb16b50330472c81358760501218ffed8"
+		logic_hash = "v1_sha256_af6ba3e21c382f2fd654060dcfde8b3eb16b50330472c81358760501218ffed8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158855,20 +158925,20 @@ rule MALPEDIA_Win_Kardonloader_Auto : FILE
 		$sequence_9 = { 40 8945fc 894d08 8a01 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Play_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4738940b-7da5-50c4-88b2-14247a6e9490"
+		id = "ece5df03-47d2-5686-830a-40d4d02e3312"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.play"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.play_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "5818fd91a2bec1f70682fe35fe8b96ef11658990dd8b01971531f81d25cdc716"
+		logic_hash = "v1_sha256_5818fd91a2bec1f70682fe35fe8b96ef11658990dd8b01971531f81d25cdc716"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158894,20 +158964,20 @@ rule MALPEDIA_Win_Play_Auto : FILE
 		$sequence_9 = { 8b85a8fdffff 6603fb 6640 6689bd04feffff 8985a8fdffff 41 66898588fdffff }
 
 	condition:
-		7 of them and filesize <389120
+		7 of them and filesize < 389120
 }
 rule MALPEDIA_Win_Gameover_Dga_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bc53f1bb-3d03-5486-b6a3-f98ff0c8f6cd"
+		id = "72f31668-51c8-5a8f-9321-bd2ccb2eb19d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_dga"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gameover_dga_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a8d5697f9821aacef2a257fe69d3238c984983b11a8fa8e5567f601d47382d80"
+		logic_hash = "v1_sha256_a8d5697f9821aacef2a257fe69d3238c984983b11a8fa8e5567f601d47382d80"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158933,20 +159003,20 @@ rule MALPEDIA_Win_Gameover_Dga_Auto : FILE
 		$sequence_9 = { 56 8bd9 57 8bf3 895c2414 6a00 83e601 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Floxif_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "41f034c6-3e3f-5292-917b-f675df5b6d2a"
+		id = "82426cdc-81df-52ed-8e0f-64fb16a3f8fd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.floxif"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.floxif_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "f5031af55712b6d9a11fdedff6451f65aebc55a1ba940596ca5431dc225391dd"
+		logic_hash = "v1_sha256_f5031af55712b6d9a11fdedff6451f65aebc55a1ba940596ca5431dc225391dd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158972,20 +159042,20 @@ rule MALPEDIA_Win_Floxif_Auto : FILE
 		$sequence_9 = { e9???????? 33d2 8a15???????? 83fa01 7514 c6458801 8d4df0 }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize < 352256
 }
 rule MALPEDIA_Win_Tapaoux_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bce56a96-656f-5b7c-a7ef-d9facfa97150"
+		id = "adc6039d-41d5-5b12-9928-9b8b413a8855"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tapaoux"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tapaoux_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "6c80ff6e5416b0acf89a64b88900eb504acb14643be57ceb13e02da18a2fedde"
+		logic_hash = "v1_sha256_6c80ff6e5416b0acf89a64b88900eb504acb14643be57ceb13e02da18a2fedde"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159011,20 +159081,20 @@ rule MALPEDIA_Win_Tapaoux_Auto : FILE
 		$sequence_9 = { 74c5 3bf7 7ccf 5f 5e 5d }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize < 294912
 }
 rule MALPEDIA_Win_Metastealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "03175067-a9b5-54bf-936c-98a9cdf892a4"
+		id = "af795cbe-b27f-576b-8b6c-69c3385c8a0e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.metastealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.metastealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "88c2cf894d34c5f1940f86cdfe567315a89acface2e055dfbbf9e01110d9ea97"
+		logic_hash = "v1_sha256_88c2cf894d34c5f1940f86cdfe567315a89acface2e055dfbbf9e01110d9ea97"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159050,20 +159120,20 @@ rule MALPEDIA_Win_Metastealer_Auto : FILE
 		$sequence_9 = { f7472800008000 744e 8d8f88000000 85db 7506 46 8975fc }
 
 	condition:
-		7 of them and filesize <26230784
+		7 of them and filesize < 26230784
 }
 rule MALPEDIA_Win_Ryuk_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "28c4a97d-0c23-5f05-a50b-7fc331a8ef51"
+		id = "5ca825c3-ea46-5d76-8a75-afdbccab5cf1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ryuk_stealer_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "f104c51f76af6a34fecb95d90a97bc0fef4b38e853341fac8b68ac59b1274295"
+		logic_hash = "v1_sha256_f104c51f76af6a34fecb95d90a97bc0fef4b38e853341fac8b68ac59b1274295"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159089,20 +159159,20 @@ rule MALPEDIA_Win_Ryuk_Stealer_Auto : FILE
 		$sequence_9 = { 8d45e0 50 8d85b4fdffff 50 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Lodeinfo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fef4135b-c37b-592e-9b9c-4313e3ff89af"
+		id = "289474f2-43a6-5339-9b3e-bf1a24673520"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lodeinfo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lodeinfo_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "e42d005c217ef3b217f52a6115c139a42c70e499d47cac23508862c48ef328f6"
+		logic_hash = "v1_sha256_e42d005c217ef3b217f52a6115c139a42c70e499d47cac23508862c48ef328f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159128,20 +159198,20 @@ rule MALPEDIA_Win_Lodeinfo_Auto : FILE
 		$sequence_9 = { e8???????? ff75bc e8???????? ff75c0 e8???????? ff75cc }
 
 	condition:
-		7 of them and filesize <712704
+		7 of them and filesize < 712704
 }
 rule MALPEDIA_Win_Icexloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f39d0ab5-8213-59e6-b937-084e69d35431"
+		id = "8320fc6a-994c-5710-a231-0274ac5ab1ed"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icexloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.icexloader_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ebc5d7149c8501657e5a8c66abb5a20df9b61fa7b96a5f5c2d43922a15f6b368"
+		logic_hash = "v1_sha256_ebc5d7149c8501657e5a8c66abb5a20df9b61fa7b96a5f5c2d43922a15f6b368"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159167,20 +159237,20 @@ rule MALPEDIA_Win_Icexloader_Auto : FILE
 		$sequence_9 = { 8b45dc 8b55d8 29d0 89c3 8b4508 8b5010 8b450c }
 
 	condition:
-		7 of them and filesize <656384
+		7 of them and filesize < 656384
 }
 rule MALPEDIA_Win_Avcrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00cf27fe-b3f2-52f3-b9ce-ac448ef85802"
+		id = "aa6de4e3-58b0-5528-ba50-45c2564cab2c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avcrypt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.avcrypt_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "ff0922ac16f60a78ce69b391d1f6f13ac39e840f62a7ba24855ffe003dee4073"
+		logic_hash = "v1_sha256_ff0922ac16f60a78ce69b391d1f6f13ac39e840f62a7ba24855ffe003dee4073"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159206,20 +159276,20 @@ rule MALPEDIA_Win_Avcrypt_Auto : FILE
 		$sequence_9 = { 8bc6 e8???????? c20400 8b11 83c9ff 83ea10 8d420c }
 
 	condition:
-		7 of them and filesize <6160384
+		7 of them and filesize < 6160384
 }
 rule MALPEDIA_Win_Soraya_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c1b5e4fb-ecf1-56e9-b7ee-f112f17e5f08"
+		id = "38dac795-51e9-54dc-a510-940f48b3a8b8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soraya"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.soraya_auto.yar#L1-L234"
 		license_url = "N/A"
-		logic_hash = "9c021471b4a00823554f7973fdcdc5043a2447611e50ed019058643f5ab74f68"
+		logic_hash = "v1_sha256_9c021471b4a00823554f7973fdcdc5043a2447611e50ed019058643f5ab74f68"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -159258,20 +159328,20 @@ rule MALPEDIA_Win_Soraya_Auto : FILE
 		$sequence_22 = { 8d0c8b 66397102 7537 0fb709 bf1f600000 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Pandora_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "29457312-58e8-5036-91e5-0a52a49209e8"
+		id = "548192a9-97d6-5e2c-8741-8b68aef14350"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandora"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pandora_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "22cda535b77940d9842b4e203432bc4f86a63cc5bae293ffa14fa51707bd5eff"
+		logic_hash = "v1_sha256_22cda535b77940d9842b4e203432bc4f86a63cc5bae293ffa14fa51707bd5eff"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159297,20 +159367,20 @@ rule MALPEDIA_Win_Pandora_Auto : FILE
 		$sequence_9 = { 0f84f7010000 833801 752d 0f1001 498d4b18 660f73d808 66490f7ec0 }
 
 	condition:
-		7 of them and filesize <1032192
+		7 of them and filesize < 1032192
 }
 rule MALPEDIA_Win_Playwork_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "04893cf6-e630-529b-badc-29b196733e23"
+		id = "91fefd00-b1a4-554d-856a-de83bd3b1599"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.playwork"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.playwork_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "7105c3ff4bb7347e4c96600c56543cdd3a8eee25d86105d64120af9ee3e9d2c3"
+		logic_hash = "v1_sha256_7105c3ff4bb7347e4c96600c56543cdd3a8eee25d86105d64120af9ee3e9d2c3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159336,20 +159406,20 @@ rule MALPEDIA_Win_Playwork_Auto : FILE
 		$sequence_9 = { 81c41c640000 c3 55 8bec 81ecb8030000 53 56 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Sepsys_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ae60c103-173f-5306-92ac-d702be74a065"
+		id = "779e3da6-2d90-5a0b-9e59-afac54253330"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sepsys"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sepsys_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "652d59df346d9da22c7542823cefcfc7111985f5ad38199ac4913217f1dfac22"
+		logic_hash = "v1_sha256_652d59df346d9da22c7542823cefcfc7111985f5ad38199ac4913217f1dfac22"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159375,20 +159445,20 @@ rule MALPEDIA_Win_Sepsys_Auto : FILE
 		$sequence_9 = { c685b600000000 c685b400000000 e9???????? c685b400000000 488b4d28 488b5530 e8???????? }
 
 	condition:
-		7 of them and filesize <4538368
+		7 of them and filesize < 4538368
 }
 rule MALPEDIA_Win_Meterpreter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "33d2907b-ab63-5a72-98c0-3e3546cda7ba"
+		id = "a22bd661-90d6-5733-9e49-0b695c40f1a4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meterpreter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.meterpreter_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "1631dc247baef420a5deaf156c823d0d4f3e3c68f2c5cd0e3fcbf8155c8e3d6f"
+		logic_hash = "v1_sha256_1631dc247baef420a5deaf156c823d0d4f3e3c68f2c5cd0e3fcbf8155c8e3d6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159414,20 +159484,20 @@ rule MALPEDIA_Win_Meterpreter_Auto : FILE
 		$sequence_9 = { 7562 8b4c2418 8b441e09 01d2 f7f1 8bd8 68442410f7 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Noxplayer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fab5d56f-e9c6-515a-ae0f-470960c542fb"
+		id = "502c063b-386c-53c5-be0d-38574c754131"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.noxplayer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.noxplayer_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "77744292ebf109ed57f41d00cb6e30b7a306c1c6c824a437b236cefc116466ee"
+		logic_hash = "v1_sha256_77744292ebf109ed57f41d00cb6e30b7a306c1c6c824a437b236cefc116466ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159453,20 +159523,20 @@ rule MALPEDIA_Win_Noxplayer_Auto : FILE
 		$sequence_9 = { 413bc9 7e04 ffc7 03c1 4883c204 49ffc8 75e7 }
 
 	condition:
-		7 of them and filesize <742400
+		7 of them and filesize < 742400
 }
 rule MALPEDIA_Win_Onionduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "938d9d3c-e9aa-58a2-a276-ad33d72e5ddf"
+		id = "ccc73ba5-cd16-562a-8d73-65f4fa1f2253"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onionduke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.onionduke_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "68b93f2d8ab375a631a7b5d240fe20b360c3a52f2b84ec1bedaa31bed5aee8b0"
+		logic_hash = "v1_sha256_68b93f2d8ab375a631a7b5d240fe20b360c3a52f2b84ec1bedaa31bed5aee8b0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159492,20 +159562,20 @@ rule MALPEDIA_Win_Onionduke_Auto : FILE
 		$sequence_9 = { 50 8d45e0 50 e8???????? 837df408 8b45e0 7303 }
 
 	condition:
-		7 of them and filesize <671744
+		7 of them and filesize < 671744
 }
 rule MALPEDIA_Win_Lcpdot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "722ca0df-2e50-52e0-943d-1427766ffd0e"
+		id = "f80a98b4-16da-5b9f-bbae-b99cfd4d29d3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lcpdot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lcpdot_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "4f9e99ce8bcf6813bbe31f126896fdedd8b3b4250e6a5e72eec4968c5a5d08a6"
+		logic_hash = "v1_sha256_4f9e99ce8bcf6813bbe31f126896fdedd8b3b4250e6a5e72eec4968c5a5d08a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159536,20 +159606,20 @@ rule MALPEDIA_Win_Lcpdot_Auto : FILE
 		$sequence_14 = { 4533c9 48c744243000000000 458d4103 ba00000040 c744242880000000 48896c2468 }
 
 	condition:
-		7 of them and filesize <257024
+		7 of them and filesize < 257024
 }
 rule MALPEDIA_Win_Vmzeus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66c6a017-6d01-5f54-977c-810778bd36c9"
+		id = "7bf1c14e-fc48-5cf0-adb7-36a4caacf6fd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vmzeus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vmzeus_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "21af12598bbe8c129f701b1173aa31044d5a02d195bccea2272138762380a86c"
+		logic_hash = "v1_sha256_21af12598bbe8c129f701b1173aa31044d5a02d195bccea2272138762380a86c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159575,20 +159645,20 @@ rule MALPEDIA_Win_Vmzeus_Auto : FILE
 		$sequence_9 = { 6a04 58 e9???????? 32c0 6a4c 8d7c242c 59 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize < 475136
 }
 rule MALPEDIA_Win_Appleseed_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2cab059a-3093-5ea8-b4c6-461dc05f5c9c"
+		id = "66385188-1f6c-58d4-8bb7-d1e314a52615"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.appleseed"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.appleseed_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "7ca6e2559d781302d777182a28464c5fa026ffa48945f1841212525a74a1af82"
+		logic_hash = "v1_sha256_7ca6e2559d781302d777182a28464c5fa026ffa48945f1841212525a74a1af82"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159614,20 +159684,20 @@ rule MALPEDIA_Win_Appleseed_Auto : FILE
 		$sequence_9 = { 488d4b04 4c8d05df770000 418d5216 e8???????? 85c0 0f8544090000 }
 
 	condition:
-		7 of them and filesize <497664
+		7 of them and filesize < 497664
 }
 rule MALPEDIA_Win_Jaku_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0112e8e2-bdef-5365-8ac6-db0d7a5331a7"
+		id = "f38e7c1f-6c85-5731-be20-f17b5e523e35"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaku"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jaku_auto.yar#L1-L267"
 		license_url = "N/A"
-		logic_hash = "48ece9688342db3652fd3070c7f85ee33a0b73ea4b91e59fc03cc271dad9fdd8"
+		logic_hash = "v1_sha256_48ece9688342db3652fd3070c7f85ee33a0b73ea4b91e59fc03cc271dad9fdd8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -159672,20 +159742,20 @@ rule MALPEDIA_Win_Jaku_Auto : FILE
 		$sequence_28 = { 6a00 57 e8???????? 8945fc }
 
 	condition:
-		7 of them and filesize <2220032
+		7 of them and filesize < 2220032
 }
 rule MALPEDIA_Win_Icedid_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68e0204c-83cb-5a2b-b638-0e50311a0431"
+		id = "0faf794c-70e2-5d2a-8d5a-8d8122f80197"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.icedid_auto.yar#L1-L292"
 		license_url = "N/A"
-		logic_hash = "e8c9e17a917aa63cbf96d9c82905a16b279179aa1e4dde7e0caa78f60904db7b"
+		logic_hash = "v1_sha256_e8c9e17a917aa63cbf96d9c82905a16b279179aa1e4dde7e0caa78f60904db7b"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -159733,20 +159803,20 @@ rule MALPEDIA_Win_Icedid_Auto : FILE
 		$sequence_31 = { 4883ec40 33ff 4d8bf0 482178d8 4c8bfa }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize < 303104
 }
 rule MALPEDIA_Win_Coreshell_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "27d46fdb-7250-5f28-b02a-5095dbf27fe3"
+		id = "e562c28a-d37f-55c3-952f-c38c65ce72a2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coreshell"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.coreshell_auto.yar#L1-L449"
 		license_url = "N/A"
-		logic_hash = "038145c7338b3ef0cec3ae46e0288d3925695dd56d293f3ab89cfa76d758deaa"
+		logic_hash = "v1_sha256_038145c7338b3ef0cec3ae46e0288d3925695dd56d293f3ab89cfa76d758deaa"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -159814,20 +159884,20 @@ rule MALPEDIA_Win_Coreshell_Auto : FILE
 		$sequence_51 = { 57 8b3d???????? 68???????? ffd7 8b35???????? 68???????? }
 
 	condition:
-		7 of them and filesize <303100
+		7 of them and filesize < 303100
 }
 rule MALPEDIA_Win_Zeus_Openssl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "550619dc-6f15-5f3b-ac49-6d6bb9526626"
+		id = "6b3b4b51-2e0f-595b-b697-7065e0dc605a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_openssl"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zeus_openssl_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "ad90787c109d806e4177874e3ce46219d993226aadc9cde55e3f2e9866998d97"
+		logic_hash = "v1_sha256_ad90787c109d806e4177874e3ce46219d993226aadc9cde55e3f2e9866998d97"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159853,20 +159923,20 @@ rule MALPEDIA_Win_Zeus_Openssl_Auto : FILE
 		$sequence_9 = { 8b4708 894710 8b06 83781000 0f849c010000 8b5dfc 8b7e5c }
 
 	condition:
-		7 of them and filesize <4546560
+		7 of them and filesize < 4546560
 }
 rule MALPEDIA_Win_Mrac_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6bcb64df-21fc-5709-b420-056c81f6920b"
+		id = "2c2fc927-e794-52e8-997d-bda14a34c25a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mrac"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mrac_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "ba522542908668fac0a08420f8f0d725096dd1b2d5fd44a72d657a9aa822b86c"
+		logic_hash = "v1_sha256_ba522542908668fac0a08420f8f0d725096dd1b2d5fd44a72d657a9aa822b86c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159892,20 +159962,20 @@ rule MALPEDIA_Win_Mrac_Auto : FILE
 		$sequence_9 = { 888424fa130000 e8???????? 0420 8d8c24f4130000 6a7d 888424fb130000 e8???????? }
 
 	condition:
-		7 of them and filesize <745472
+		7 of them and filesize < 745472
 }
 rule MALPEDIA_Win_Mozart_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "658c5c82-39a0-5f12-babc-c6dbc8b0b70f"
+		id = "6ec740b8-e9e8-561a-96ac-3f6a33d14e1f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mozart"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mozart_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "ebee3e9c74f8823fb3c803b1df028db4b37d86893944724b3d21b6503c5bed66"
+		logic_hash = "v1_sha256_ebee3e9c74f8823fb3c803b1df028db4b37d86893944724b3d21b6503c5bed66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159931,20 +160001,20 @@ rule MALPEDIA_Win_Mozart_Auto : FILE
 		$sequence_9 = { 5f 5e 5d 5b 8bc2 f7d8 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Bamital_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9e41d3b4-c83b-5900-9fce-309a5ed93679"
+		id = "6d4733b0-6321-58fc-b5f2-89e10dfdf939"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bamital"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bamital_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "5e66490a96474a739f708c54bb1198a62bba1cb62437d954f80417ba9cecdcf4"
+		logic_hash = "v1_sha256_5e66490a96474a739f708c54bb1198a62bba1cb62437d954f80417ba9cecdcf4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159970,20 +160040,20 @@ rule MALPEDIA_Win_Bamital_Auto : FILE
 		$sequence_9 = { 83f901 7504 8bd0 eb0a 83f904 7505 c60000 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Magala_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dd5a4c9f-df80-534d-9f59-9c3cdf877b1e"
+		id = "b34a5a8a-977f-5d1e-ac98-a1bd5b23724e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magala"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.magala_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "e8f124f03a02dce9fd7ad1355c64c37bef0ae56bc832afec7217c51b4b91da06"
+		logic_hash = "v1_sha256_e8f124f03a02dce9fd7ad1355c64c37bef0ae56bc832afec7217c51b4b91da06"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160009,20 +160079,20 @@ rule MALPEDIA_Win_Magala_Auto : FILE
 		$sequence_9 = { 8955fc 7202 8b00 837f1410 7204 8b0f eb02 }
 
 	condition:
-		7 of them and filesize <589824
+		7 of them and filesize < 589824
 }
 rule MALPEDIA_Win_Mediapi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aef2b227-dc8a-5a2e-a50c-294091b1c8ca"
+		id = "c6e6a739-91ed-53ee-b1c9-34cd79bad2e9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mediapi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mediapi_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "05b9f202f6ca93b9b901cbe156248c6d5653f1e57951835cd81ee0a4bf1d3fbf"
+		logic_hash = "v1_sha256_05b9f202f6ca93b9b901cbe156248c6d5653f1e57951835cd81ee0a4bf1d3fbf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160048,20 +160118,20 @@ rule MALPEDIA_Win_Mediapi_Auto : FILE
 		$sequence_9 = { 0fb6c0 89c1 e8???????? 0fb645fb 89c1 e8???????? 0fb6c0 }
 
 	condition:
-		7 of them and filesize <246784
+		7 of them and filesize < 246784
 }
 rule MALPEDIA_Win_Fengine_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86d29f99-f72a-503a-9d9e-5f6528fd35ad"
+		id = "97897bb2-ed08-565b-be38-3a59978f984a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fengine"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fengine_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "478947e69dab969c41feba1f394b054f84256d37e12b1c78c512e724084a67ab"
+		logic_hash = "v1_sha256_478947e69dab969c41feba1f394b054f84256d37e12b1c78c512e724084a67ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160087,20 +160157,20 @@ rule MALPEDIA_Win_Fengine_Auto : FILE
 		$sequence_9 = { 8b5e24 c1e003 50 03fa 03da e8???????? }
 
 	condition:
-		7 of them and filesize <210944
+		7 of them and filesize < 210944
 }
 rule MALPEDIA_Win_Deathransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a114591a-b780-5a40-a9ea-b0c6b9cb905d"
+		id = "2f7a8c4a-5bf2-5065-965d-b978d39b54cb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deathransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.deathransom_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "51420be8374b7a80642a50bf14b9acdb6936ed5b62767040db7c66a1d7ee7900"
+		logic_hash = "v1_sha256_51420be8374b7a80642a50bf14b9acdb6936ed5b62767040db7c66a1d7ee7900"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160126,20 +160196,20 @@ rule MALPEDIA_Win_Deathransom_Auto : FILE
 		$sequence_9 = { 0fafc3 2bf8 8d87ffff0000 8945fc 3bc1 720a }
 
 	condition:
-		7 of them and filesize <133120
+		7 of them and filesize < 133120
 }
 rule MALPEDIA_Win_Equationdrug_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3c043b62-e6cf-528c-b34b-4fab7307ccc3"
+		id = "e4234c11-3e7d-5375-a9df-39a7630d38de"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.equationdrug"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.equationdrug_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "bfe71e1dede0b483002d6bdc1803bedc3b70169ecaeef47717be14607c4ca6a2"
+		logic_hash = "v1_sha256_bfe71e1dede0b483002d6bdc1803bedc3b70169ecaeef47717be14607c4ca6a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160165,20 +160235,20 @@ rule MALPEDIA_Win_Equationdrug_Auto : FILE
 		$sequence_9 = { ff502c 85c0 750d 5f b800090000 5e 83c410 }
 
 	condition:
-		7 of them and filesize <449536
+		7 of them and filesize < 449536
 }
 rule MALPEDIA_Win_Glupteba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d40588ac-e7a2-58c9-9ca8-ed52b13d9b71"
+		id = "eb21d676-302f-532b-8d46-e553391c54da"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.glupteba_auto.yar#L1-L160"
 		license_url = "N/A"
-		logic_hash = "aabdfe0b9a7f1b7f6f6d9d5fd0bc40fb64823f7ef8d103971b20ab4de2b081ab"
+		logic_hash = "v1_sha256_aabdfe0b9a7f1b7f6f6d9d5fd0bc40fb64823f7ef8d103971b20ab4de2b081ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160210,20 +160280,20 @@ rule MALPEDIA_Win_Glupteba_Auto : FILE
 		$sequence_15 = { 00f1 3d46005e3e 46 00cd }
 
 	condition:
-		7 of them and filesize <1417216
+		7 of them and filesize < 1417216
 }
 rule MALPEDIA_Win_Ayegent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86255cdd-1f1d-55c6-b402-dbeb5a16b330"
+		id = "2dcb4e0a-21ec-54fb-9a59-dfee9d6444e3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ayegent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ayegent_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "3b986bb07fdbef1927d912b3187f0b83148fd82afd809d6a4ef770e3327faaed"
+		logic_hash = "v1_sha256_3b986bb07fdbef1927d912b3187f0b83148fd82afd809d6a4ef770e3327faaed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160249,20 +160319,20 @@ rule MALPEDIA_Win_Ayegent_Auto : FILE
 		$sequence_9 = { 57 8b3d???????? 56 ffd7 83f807 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Rustock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ee0956c-f0f1-5810-b10e-703861aef3b0"
+		id = "09ad8688-b69a-5e12-a0af-7ad03a803eec"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rustock"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rustock_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "3641dcae675b230edb174a50f5ec564e4adb4fc1e74afa68371b58ccaf9cdb5a"
+		logic_hash = "v1_sha256_3641dcae675b230edb174a50f5ec564e4adb4fc1e74afa68371b58ccaf9cdb5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160288,20 +160358,20 @@ rule MALPEDIA_Win_Rustock_Auto : FILE
 		$sequence_9 = { 8975c0 85f6 0f848b000000 8365fc00 83c003 83e0fc e8???????? }
 
 	condition:
-		7 of them and filesize <565248
+		7 of them and filesize < 565248
 }
 rule MALPEDIA_Win_Plugx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3f86c5a3-fd23-59bc-bcb0-3d1decf01c2c"
+		id = "a1aacd93-52f1-5ab9-977d-111071ad24e9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.plugx_auto.yar#L1-L291"
 		license_url = "N/A"
-		logic_hash = "15190bb8aae3c81242a3f62c3118fe86de191513b0096b3d3022dcd142f4bd88"
+		logic_hash = "v1_sha256_15190bb8aae3c81242a3f62c3118fe86de191513b0096b3d3022dcd142f4bd88"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -160350,20 +160420,20 @@ rule MALPEDIA_Win_Plugx_Auto : FILE
 		$sequence_32 = { 5e 5f 5b 5d c20400 50 64a118000000 }
 
 	condition:
-		7 of them and filesize <1284096
+		7 of them and filesize < 1284096
 }
 rule MALPEDIA_Win_Hamweq_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "472b9f91-ae73-5b23-84d5-48c0a12f0ce8"
+		id = "69cf0294-cc3a-585c-91fa-49fc3ea90084"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hamweq"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hamweq_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "97fb94f14abe15a4280f753f2ae96a2750195cd748cddbf78c3df32e07994a82"
+		logic_hash = "v1_sha256_97fb94f14abe15a4280f753f2ae96a2750195cd748cddbf78c3df32e07994a82"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160389,20 +160459,20 @@ rule MALPEDIA_Win_Hamweq_Auto : FILE
 		$sequence_9 = { ff75f8 ffd6 ff35???????? 898534ffffff ff75f8 ffd6 ff35???????? }
 
 	condition:
-		7 of them and filesize <24576
+		7 of them and filesize < 24576
 }
 rule MALPEDIA_Win_Cobra_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b7889e85-8a86-5887-854a-7a6437d9a16b"
+		id = "8fbe42a2-da2b-5f55-8f9d-650521dabd6c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobra"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cobra_auto.yar#L1-L476"
 		license_url = "N/A"
-		logic_hash = "652efe51bbd71c6c383988a4a5e7893f0deae6bcb5db842e07957bb56af5eae8"
+		logic_hash = "v1_sha256_652efe51bbd71c6c383988a4a5e7893f0deae6bcb5db842e07957bb56af5eae8"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -160474,20 +160544,20 @@ rule MALPEDIA_Win_Cobra_Auto : FILE
 		$sequence_55 = { c745c000000000 8d4dcc 51 8b55c8 }
 
 	condition:
-		7 of them and filesize <1368064
+		7 of them and filesize < 1368064
 }
 rule MALPEDIA_Win_Kegotip_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "600762c6-ac4d-5eb5-bbbf-0bef37409a30"
+		id = "b1141879-3d3d-542a-be12-905442037661"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kegotip"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kegotip_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "6330aef57e16076515b4a4781ca5f76d2c7b12c38d9df7aca1927a38f8ab1a7a"
+		logic_hash = "v1_sha256_6330aef57e16076515b4a4781ca5f76d2c7b12c38d9df7aca1927a38f8ab1a7a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160513,20 +160583,20 @@ rule MALPEDIA_Win_Kegotip_Auto : FILE
 		$sequence_9 = { c745f400000000 6a00 8d55f4 52 6a00 6a00 6a01 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Spider_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a31996a5-e3ca-592f-95bc-8fa380f84c48"
+		id = "e7dff4ac-07c7-582d-8798-5eb51f6ade4f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spider_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spider_rat_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "a5e11d471849c9a1ee46ff091a234f4718c14598ff1efe77b39f8fba97b05619"
+		logic_hash = "v1_sha256_a5e11d471849c9a1ee46ff091a234f4718c14598ff1efe77b39f8fba97b05619"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160552,20 +160622,20 @@ rule MALPEDIA_Win_Spider_Rat_Auto : FILE
 		$sequence_9 = { 740d 4183e5fd 488bcb ff15???????? 4084ed 0f85da000000 488b8c24a8000000 }
 
 	condition:
-		7 of them and filesize <1107968
+		7 of them and filesize < 1107968
 }
 rule MALPEDIA_Win_Roadsweep_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02905efb-d1f3-5f29-9698-5892918b9e96"
+		id = "b67775e3-5213-5c6e-a003-9ece02a40651"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roadsweep"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.roadsweep_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "10ecfffb9395be461cfda7fab93323fb263ae9a44a4ace806928ac7c12ed7628"
+		logic_hash = "v1_sha256_10ecfffb9395be461cfda7fab93323fb263ae9a44a4ace806928ac7c12ed7628"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160591,20 +160661,20 @@ rule MALPEDIA_Win_Roadsweep_Auto : FILE
 		$sequence_9 = { 89542408 891c24 e8???????? 893424 e8???????? 8b4510 }
 
 	condition:
-		7 of them and filesize <160768
+		7 of them and filesize < 160768
 }
 rule MALPEDIA_Win_Spedear_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a2db92d-f6f5-5c96-a401-91440ad20972"
+		id = "01006849-6746-5161-ae71-06d1bb95b43f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spedear"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spedear_auto.yar#L1-L261"
 		license_url = "N/A"
-		logic_hash = "124ef5d3fdd777d79cde8845a98f346f93848e564de2656d201aff5229611681"
+		logic_hash = "v1_sha256_124ef5d3fdd777d79cde8845a98f346f93848e564de2656d201aff5229611681"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -160647,20 +160717,20 @@ rule MALPEDIA_Win_Spedear_Auto : FILE
 		$sequence_26 = { e8???????? 488be8 4885c0 740d 488d0541be0000 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Koiloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee5d9fec-2843-5af7-aeb3-cee6becb76b4"
+		id = "4602880b-e77b-5b80-bf1d-b7bc754c9e65"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koiloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.koiloader_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "4094e110b8bc0bb992d288f6dc9a43aa3cc0b1cd494d242faeb097d68b45bf0d"
+		logic_hash = "v1_sha256_4094e110b8bc0bb992d288f6dc9a43aa3cc0b1cd494d242faeb097d68b45bf0d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160686,20 +160756,20 @@ rule MALPEDIA_Win_Koiloader_Auto : FILE
 		$sequence_9 = { 41 3bca 72ef 8d45f8 c745f800000000 50 8d043a }
 
 	condition:
-		7 of them and filesize <101376
+		7 of them and filesize < 101376
 }
 rule MALPEDIA_Win_Catb_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7782ecd0-01e3-5ca1-93ff-bd4a61ae70c3"
+		id = "af30f5c9-c5e5-5476-b3be-839fc150713c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catb"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.catb_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "49ea54be47b78595def43aa15eb04fc0e876132d1319a21babeae83d5fcf1c52"
+		logic_hash = "v1_sha256_49ea54be47b78595def43aa15eb04fc0e876132d1319a21babeae83d5fcf1c52"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160725,20 +160795,20 @@ rule MALPEDIA_Win_Catb_Auto : FILE
 		$sequence_9 = { 44895c2448 81fae9fd0000 0f8570010000 4c8d3d23aaffff 418bd3 }
 
 	condition:
-		7 of them and filesize <593920
+		7 of them and filesize < 593920
 }
 rule MALPEDIA_Win_Moonwalk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fd39fa26-9d1a-515b-b730-f6f9e30e5941"
+		id = "ffcfaacf-f2c6-555e-8256-dc0b880905be"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonwalk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.moonwalk_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "1c19a679d272620c40c7a55b8a8c2eabaee5ff1d6dffe1b79863d345d92546d6"
+		logic_hash = "v1_sha256_1c19a679d272620c40c7a55b8a8c2eabaee5ff1d6dffe1b79863d345d92546d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160764,20 +160834,20 @@ rule MALPEDIA_Win_Moonwalk_Auto : FILE
 		$sequence_9 = { c3 48895c2408 4889742410 57 4881ec90000000 488b4210 488bd9 }
 
 	condition:
-		7 of them and filesize <179200
+		7 of them and filesize < 179200
 }
 rule MALPEDIA_Win_Acronym_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c38cb44e-5275-529c-849b-aac482405c26"
+		id = "d4c0b1b3-6320-5c33-8bdc-1a9f03f5cfb4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acronym"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.acronym_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "62c9feab89deca514303e2d96ba97df762d7107dad9f170f73597a4727ca0781"
+		logic_hash = "v1_sha256_62c9feab89deca514303e2d96ba97df762d7107dad9f170f73597a4727ca0781"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160803,20 +160873,20 @@ rule MALPEDIA_Win_Acronym_Auto : FILE
 		$sequence_9 = { 50 8b4d08 83c108 51 8b0d???????? e8???????? 8b08 }
 
 	condition:
-		7 of them and filesize <466944
+		7 of them and filesize < 466944
 }
 rule MALPEDIA_Win_Latentbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a00a894-4935-5534-b5e9-c8d6ecaeaacd"
+		id = "5791dec0-ae4b-562d-a2c8-b70720affdb3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.latentbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.latentbot_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "0b0eb24e4417089c175072116bffcac1a7119a8a9d763a31cda53b89f6d3beef"
+		logic_hash = "v1_sha256_0b0eb24e4417089c175072116bffcac1a7119a8a9d763a31cda53b89f6d3beef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160842,20 +160912,20 @@ rule MALPEDIA_Win_Latentbot_Auto : FILE
 		$sequence_9 = { 57 53 894da8 ffd6 8bf0 83fe01 7569 }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize < 401408
 }
 rule MALPEDIA_Win_Gaudox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "15dc0059-f613-5f22-9f93-85ef1cdd6f7e"
+		id = "20c8bd94-2344-545e-85f8-38a881f191fc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gaudox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gaudox_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "cb1127199cac9fdec74f4f176c228a4ea35dac692422428d5b8a3d96735f1430"
+		logic_hash = "v1_sha256_cb1127199cac9fdec74f4f176c228a4ea35dac692422428d5b8a3d96735f1430"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160881,20 +160951,20 @@ rule MALPEDIA_Win_Gaudox_Auto : FILE
 		$sequence_9 = { 83fa6c 751f 83f902 7212 6639544702 750b 810e00040000 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Nitol_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "564f8c6d-172d-53bc-8a35-617f93dc2b3b"
+		id = "32abd733-c5ca-5811-b12b-7bc0d55f2ccc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nitol_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "f965a0fe296415280cef677cfeda82c56822d9b36e24511179288d488384a005"
+		logic_hash = "v1_sha256_f965a0fe296415280cef677cfeda82c56822d9b36e24511179288d488384a005"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160920,20 +160990,20 @@ rule MALPEDIA_Win_Nitol_Auto : FILE
 		$sequence_9 = { ffd6 668945d6 8d45cc 6a0c 50 8d8540ffffff }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Catchamas_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "169e4746-2f72-5821-b507-b8a47f5cbc09"
+		id = "4100a4db-fe01-520f-844c-f3919032a8a3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catchamas"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.catchamas_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "23c971887be94861d8baba1aeb0cd2edf205b86ca05876ee11e3ee91d8d84d51"
+		logic_hash = "v1_sha256_23c971887be94861d8baba1aeb0cd2edf205b86ca05876ee11e3ee91d8d84d51"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160959,20 +161029,20 @@ rule MALPEDIA_Win_Catchamas_Auto : FILE
 		$sequence_9 = { e8???????? 8b35???????? 8b4c2418 833900 0f855d050000 8bd1 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Gacrux_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "74bca4e5-6c17-575a-bd9e-7779af62a65b"
+		id = "58a69f4e-5b8f-5444-b136-8c50ec46fcf5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gacrux"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gacrux_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "4b479a315235bf10794aaaf7db4a148e9833fd69e020e24b4a290812be385016"
+		logic_hash = "v1_sha256_4b479a315235bf10794aaaf7db4a148e9833fd69e020e24b4a290812be385016"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160998,20 +161068,20 @@ rule MALPEDIA_Win_Gacrux_Auto : FILE
 		$sequence_9 = { 41 8bd4 e8???????? 48 8d4c2430 45 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Cobalt_Strike_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1adbbac8-6bfc-5d06-9cad-1cba809f72a0"
+		id = "0230f861-fa9c-59c7-aff4-646e791b4b90"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cobalt_strike_auto.yar#L1-L236"
 		license_url = "N/A"
-		logic_hash = "516cb9bee5b249c5388cc4f59266e6454e546903dcdda98af8bfbaa75e737812"
+		logic_hash = "v1_sha256_516cb9bee5b249c5388cc4f59266e6454e546903dcdda98af8bfbaa75e737812"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -161051,20 +161121,20 @@ rule MALPEDIA_Win_Cobalt_Strike_Auto : FILE
 		$sequence_23 = { 488b1424 0fb712 6623d1 0fb7ca 0fb7c9 488b542408 }
 
 	condition:
-		7 of them and filesize <1015808
+		7 of them and filesize < 1015808
 }
 rule MALPEDIA_Win_Ati_Agent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "63f89f4a-1d36-5323-b29e-727f0aaf8a03"
+		id = "b34d8d72-ff5b-5245-b73b-75c490ae0b5b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ati_agent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ati_agent_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "7c411e9ca433461f4c960c7a6933d449b1b0c508c2b59dbdab9cb50ad78bd018"
+		logic_hash = "v1_sha256_7c411e9ca433461f4c960c7a6933d449b1b0c508c2b59dbdab9cb50ad78bd018"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161090,20 +161160,20 @@ rule MALPEDIA_Win_Ati_Agent_Auto : FILE
 		$sequence_9 = { 488d05247f0000 483bd8 7732 488bd3 48b8abaaaaaaaaaaaa2a }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize < 172032
 }
 rule MALPEDIA_Win_Klrd_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f2ac53cd-82a8-55ea-badd-f6f1aae58f93"
+		id = "ba96c6ce-9747-58c6-984d-bf9ed1d60d07"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.klrd"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.klrd_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "0fc6f030ea4bb49d87359f96c6eceeeaeffbdd94bdee42030f76f2d7ec66a19a"
+		logic_hash = "v1_sha256_0fc6f030ea4bb49d87359f96c6eceeeaeffbdd94bdee42030f76f2d7ec66a19a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161129,20 +161199,20 @@ rule MALPEDIA_Win_Klrd_Auto : FILE
 		$sequence_9 = { ffb5b0fcffff ff15???????? 8985c8feffff 83bdc8feffff00 7515 ff15???????? }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Boaxxe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1250eef8-010c-5e96-be9a-abfd5ef5d010"
+		id = "4b9548a9-2942-5eba-8384-969de0bd10e5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boaxxe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.boaxxe_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "8a3a4e3c549e35ded84e2465f19cea84a5ad121ff4106ae44ae1865048bfef1a"
+		logic_hash = "v1_sha256_8a3a4e3c549e35ded84e2465f19cea84a5ad121ff4106ae44ae1865048bfef1a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161168,20 +161238,20 @@ rule MALPEDIA_Win_Boaxxe_Auto : FILE
 		$sequence_9 = { c745fc20000000 8d45a0 8b55f0 e8???????? 8b45a0 33c9 8b55f4 }
 
 	condition:
-		7 of them and filesize <1146880
+		7 of them and filesize < 1146880
 }
 rule MALPEDIA_Win_Royal_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a9b95381-6997-59af-bb2e-993bae34608b"
+		id = "8b4fc490-a1ae-5b9e-bc01-0483e2a68a93"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_ransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.royal_ransom_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "05ad7a29faf1ca692a5b6df2d422be2fdcf12c3fc6c9f7021ff0ef0bb4b8bcb3"
+		logic_hash = "v1_sha256_05ad7a29faf1ca692a5b6df2d422be2fdcf12c3fc6c9f7021ff0ef0bb4b8bcb3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161207,20 +161277,20 @@ rule MALPEDIA_Win_Royal_Ransom_Auto : FILE
 		$sequence_9 = { e8???????? 4c8d05cb5a0f00 baab010000 488d0d2f5a0f00 e8???????? 4533c0 418d4e06 }
 
 	condition:
-		7 of them and filesize <6235136
+		7 of them and filesize < 6235136
 }
 rule MALPEDIA_Win_Cookiebag_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ac3bf6d4-71cf-5c5b-be8e-0bd3c3ef57c9"
+		id = "3b672328-9300-57a2-9671-01e310134d63"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cookiebag"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cookiebag_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "679ac50c0d3fc2601e0f2f772686754e8efa393c4c8cfd8d8fb7af71ce9952bb"
+		logic_hash = "v1_sha256_679ac50c0d3fc2601e0f2f772686754e8efa393c4c8cfd8d8fb7af71ce9952bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161246,20 +161316,20 @@ rule MALPEDIA_Win_Cookiebag_Auto : FILE
 		$sequence_9 = { eb0c 83c1fe 51 e8???????? 83c404 895e40 895e44 }
 
 	condition:
-		7 of them and filesize <311296
+		7 of them and filesize < 311296
 }
 rule MALPEDIA_Win_Deputydog_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3df82804-d079-5fb4-95b9-354c74dddd14"
+		id = "cd25dd4b-3cc0-55a6-a832-41812d710d3d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deputydog"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.deputydog_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "d4b2e1db63035282e2b2efcdd04dae6225d4a7dc6ab7fb9164349c69dbcffada"
+		logic_hash = "v1_sha256_d4b2e1db63035282e2b2efcdd04dae6225d4a7dc6ab7fb9164349c69dbcffada"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161285,20 +161355,20 @@ rule MALPEDIA_Win_Deputydog_Auto : FILE
 		$sequence_9 = { 5f 0f84e9000000 8b7108 2bf0 3bf7 0f85a0000000 3810 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Lpeclient_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6292aca0-d7ac-5cd7-a6d4-3438fdd1076c"
+		id = "5d1b6e45-5bb1-5212-ad10-23d043c1691b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lpeclient"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lpeclient_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "fa5662e58821dbe4e01d6876bcd73f389c9fb3b6d70b4d7afea75bf844e373c6"
+		logic_hash = "v1_sha256_fa5662e58821dbe4e01d6876bcd73f389c9fb3b6d70b4d7afea75bf844e373c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161324,20 +161394,20 @@ rule MALPEDIA_Win_Lpeclient_Auto : FILE
 		$sequence_9 = { 85c0 0f8e87140000 48895c2470 48896c2450 4d8d6208 4c89742438 4c8d5702 }
 
 	condition:
-		7 of them and filesize <289792
+		7 of them and filesize < 289792
 }
 rule MALPEDIA_Win_Diavol_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ced056a0-d7eb-5608-bc7f-4327dfcdc8b3"
+		id = "8ab1eda6-e7a2-57c2-9498-8fe51d4187f1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diavol"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.diavol_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "3e39473296ffc516b0ed9d4653cc00f465f30bb27ef43ae2429115fd3af11eb5"
+		logic_hash = "v1_sha256_3e39473296ffc516b0ed9d4653cc00f465f30bb27ef43ae2429115fd3af11eb5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161363,20 +161433,20 @@ rule MALPEDIA_Win_Diavol_Auto : FILE
 		$sequence_9 = { 8945fc 6880000000 8d8578ffffff 6a00 50 }
 
 	condition:
-		7 of them and filesize <191488
+		7 of them and filesize < 191488
 }
 rule MALPEDIA_Win_Sparrow_Door_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a622c79-b97a-50d2-8520-df68de9886c5"
+		id = "279757cd-9302-534f-b947-e5f5a801364d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sparrow_door"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sparrow_door_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "9af3d65106033b3806f02bea374bf6db582af3aecda2d52e70b68fd5a5b6e2c8"
+		logic_hash = "v1_sha256_9af3d65106033b3806f02bea374bf6db582af3aecda2d52e70b68fd5a5b6e2c8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161402,20 +161472,20 @@ rule MALPEDIA_Win_Sparrow_Door_Auto : FILE
 		$sequence_9 = { 896c2464 e8???????? 83c43c 85c0 752e 837c242464 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Warmcookie_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c556795a-a9b2-5224-af08-851a57d361f5"
+		id = "92fdc956-3faa-577f-a590-38bdf0d32664"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.warmcookie"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.warmcookie_auto.yar#L1-L195"
 		license_url = "N/A"
-		logic_hash = "205c15eced2ed79efcc622047f0495a7c9e5251bb4fd9a4d1e0ae8a704e7e82e"
+		logic_hash = "v1_sha256_205c15eced2ed79efcc622047f0495a7c9e5251bb4fd9a4d1e0ae8a704e7e82e"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -161452,20 +161522,20 @@ rule MALPEDIA_Win_Warmcookie_Auto : FILE
 		$sequence_20 = { 488b4da7 ff15???????? 488bc3 488b4d37 4833cc e8???????? 488b9c2418010000 }
 
 	condition:
-		7 of them and filesize <331776
+		7 of them and filesize < 331776
 }
 rule MALPEDIA_Win_Isaacwiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49055172-29cc-5c36-b567-edf9c776fb50"
+		id = "963e0428-30cd-585a-bef4-56ba4d662071"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isaacwiper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.isaacwiper_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "9dc7297f4b8c766d788d99fcb182487835c35f1c6c8fa9d0d296f8378105b942"
+		logic_hash = "v1_sha256_9dc7297f4b8c766d788d99fcb182487835c35f1c6c8fa9d0d296f8378105b942"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161491,20 +161561,20 @@ rule MALPEDIA_Win_Isaacwiper_Auto : FILE
 		$sequence_9 = { 8b4804 8d41f8 89443194 8b4688 8b4004 c744308898270310 8b4688 }
 
 	condition:
-		7 of them and filesize <467968
+		7 of them and filesize < 467968
 }
 rule MALPEDIA_Win_Bubblewrap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0adb22b2-c291-5da7-a49f-6252c3b1a007"
+		id = "f2487da3-9ad9-5b23-aa21-f1aa7fb8a76b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bubblewrap"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bubblewrap_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "0ab9a85f4803bb9809d1835ce4819efcd3e97bce18ea2653e803520f80f6784f"
+		logic_hash = "v1_sha256_0ab9a85f4803bb9809d1835ce4819efcd3e97bce18ea2653e803520f80f6784f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161530,20 +161600,20 @@ rule MALPEDIA_Win_Bubblewrap_Auto : FILE
 		$sequence_9 = { 33d2 89742414 8d6ced00 89542418 }
 
 	condition:
-		7 of them and filesize <57136
+		7 of them and filesize < 57136
 }
 rule MALPEDIA_Win_Teslacrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b4c671eb-91dc-5665-a0e1-4c4ec53aea8a"
+		id = "6065cbf8-486e-503e-8097-21a3ad6c8417"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.teslacrypt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.teslacrypt_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "028a2cbfed6bdff0ce2536414ae610c52e3d43ebb868ac2645461114e681877e"
+		logic_hash = "v1_sha256_028a2cbfed6bdff0ce2536414ae610c52e3d43ebb868ac2645461114e681877e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161575,20 +161645,20 @@ rule MALPEDIA_Win_Teslacrypt_Auto : FILE
 		$sequence_15 = { 895c246c 89542468 89742464 897c2460 ffd6 83ec10 31c9 }
 
 	condition:
-		7 of them and filesize <1187840
+		7 of them and filesize < 1187840
 }
 rule MALPEDIA_Win_Unidentified_109_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d4a6c411-a7e9-5954-916e-935ded59522f"
+		id = "95449ebc-044a-5682-94c5-8bf4709c8425"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_109"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_109_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "758f313f75d70626faf4a10de9d767fa1ab2c47be3c297f5f181d9298dc68601"
+		logic_hash = "v1_sha256_758f313f75d70626faf4a10de9d767fa1ab2c47be3c297f5f181d9298dc68601"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161614,20 +161684,20 @@ rule MALPEDIA_Win_Unidentified_109_Auto : FILE
 		$sequence_9 = { 80b97502000001 7304 3cfe 7517 488b8950090000 488d542430 }
 
 	condition:
-		7 of them and filesize <723968
+		7 of them and filesize < 723968
 }
 rule MALPEDIA_Win_Qadars_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0a2bf787-2e79-532d-b549-325462dde16c"
+		id = "d6de220c-8540-56de-bf45-8e916ad88aca"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qadars"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.qadars_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "1b2a593b94764cfdb9793ab67d53c7287007841a19e7fe336bf33e3d401fbe52"
+		logic_hash = "v1_sha256_1b2a593b94764cfdb9793ab67d53c7287007841a19e7fe336bf33e3d401fbe52"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161659,20 +161729,20 @@ rule MALPEDIA_Win_Qadars_Auto : FILE
 		$sequence_15 = { 83c408 83c8ff e9???????? eb1d 8b4d10 }
 
 	condition:
-		7 of them and filesize <630784
+		7 of them and filesize < 630784
 }
 rule MALPEDIA_Win_Cloudburst_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b338a4c1-8ad1-5066-b3d2-7c247a054c09"
+		id = "57c4947a-7f76-50d7-9034-45e370b4bcd6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudburst"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cloudburst_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "68d67b600a1326ab834c6a6b6204bba9f511b6494e369c94d17eaf52125b8157"
+		logic_hash = "v1_sha256_68d67b600a1326ab834c6a6b6204bba9f511b6494e369c94d17eaf52125b8157"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161698,20 +161768,20 @@ rule MALPEDIA_Win_Cloudburst_Auto : FILE
 		$sequence_9 = { 8bc6 c1ee10 c1e808 c1e208 }
 
 	condition:
-		7 of them and filesize <2363392
+		7 of them and filesize < 2363392
 }
 rule MALPEDIA_Win_Gold_Dragon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "991ba939-2d9f-52cd-813d-6925dfb8d9c9"
+		id = "ffca35a3-68f9-5506-95c2-84de569edb40"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gold_dragon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gold_dragon_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "1d3ddf008eb509566d50c074a1778063d25aa540d5f914350cb60f472b9c159b"
+		logic_hash = "v1_sha256_1d3ddf008eb509566d50c074a1778063d25aa540d5f914350cb60f472b9c159b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161737,20 +161807,20 @@ rule MALPEDIA_Win_Gold_Dragon_Auto : FILE
 		$sequence_9 = { 68???????? 50 ffd6 85c0 a3???????? 0f84d8050000 8b0d???????? }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Lazarloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4eef2499-48c5-5b94-8dd0-29267a0265f8"
+		id = "99b8324b-aa7d-5442-9a84-7ea265a339f2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazarloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lazarloader_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "176d7f7f65178334e7677ff59a660edd6b016ed103feffa239e5ccc53e031e90"
+		logic_hash = "v1_sha256_176d7f7f65178334e7677ff59a660edd6b016ed103feffa239e5ccc53e031e90"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161776,20 +161846,20 @@ rule MALPEDIA_Win_Lazarloader_Auto : FILE
 		$sequence_9 = { 85c0 750d 488bcb e8???????? e9???????? 4c8d2557230100 }
 
 	condition:
-		7 of them and filesize <364544
+		7 of them and filesize < 364544
 }
 rule MALPEDIA_Win_Orpcbackdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "315509a3-d1f8-5dc1-9f12-edd6db041fca"
+		id = "ab5ac9a3-9608-575d-8bc9-a8bb91049f60"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orpcbackdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.orpcbackdoor_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "89d46489afd17625d89dcf271ed3d1e11fa0fe1e28ec9d95da8becb11eb31f60"
+		logic_hash = "v1_sha256_89d46489afd17625d89dcf271ed3d1e11fa0fe1e28ec9d95da8becb11eb31f60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161815,20 +161885,20 @@ rule MALPEDIA_Win_Orpcbackdoor_Auto : FILE
 		$sequence_9 = { e8???????? 59 8b45fc 8b4010 40 50 ff75f8 }
 
 	condition:
-		7 of them and filesize <918528
+		7 of them and filesize < 918528
 }
 rule MALPEDIA_Win_Starcruft_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "44a05616-8be0-5d16-896e-a5310b288a10"
+		id = "f6cd34e8-696c-51c0-b7b4-1a543222502d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.starcruft"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.starcruft_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "8a7d60fd25a814377ba2a7789857a75b6ee211239e9e01336654dc519259df0c"
+		logic_hash = "v1_sha256_8a7d60fd25a814377ba2a7789857a75b6ee211239e9e01336654dc519259df0c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161854,20 +161924,20 @@ rule MALPEDIA_Win_Starcruft_Auto : FILE
 		$sequence_9 = { 52 8b85b4fcffff 50 e8???????? 83c414 }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize < 294912
 }
 rule MALPEDIA_Win_Furtim_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "13c151d6-8fd6-5f90-84f5-0ee50200b32d"
+		id = "7266a9bc-6574-5373-b93b-9f73fc4d5177"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.furtim"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.furtim_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "fe578793812b3cd44b1ebd86df72331630f9c46ef93b0c93a291bf5ca64790a1"
+		logic_hash = "v1_sha256_fe578793812b3cd44b1ebd86df72331630f9c46ef93b0c93a291bf5ca64790a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161893,20 +161963,20 @@ rule MALPEDIA_Win_Furtim_Auto : FILE
 		$sequence_9 = { ff9618050000 5f 5e 5b c9 c20c00 ff7508 }
 
 	condition:
-		7 of them and filesize <622592
+		7 of them and filesize < 622592
 }
 rule MALPEDIA_Win_Powerduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "658a1cda-5f77-56de-9f18-f831b8e1b259"
+		id = "243484cb-a44b-5815-966b-05d00d528264"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerduke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.powerduke_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "d2182db867ff6a53a7d17e85e856d89d6c3d1d584f315f5e805e29753b64695e"
+		logic_hash = "v1_sha256_d2182db867ff6a53a7d17e85e856d89d6c3d1d584f315f5e805e29753b64695e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161932,20 +162002,20 @@ rule MALPEDIA_Win_Powerduke_Auto : FILE
 		$sequence_9 = { 8f05???????? c705????????03000000 c745f803000000 ff75dc 8f45f0 ff75e0 8f45f4 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Anatova_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e12c2517-7ef6-5ecc-b756-da754e1b9232"
+		id = "7ef6758f-4def-561b-ad40-64733431ed34"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anatova_ransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.anatova_ransom_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "48354275540a19e149a3ec749fb4eeaa508568399fc971259b74ddc21d53a5fe"
+		logic_hash = "v1_sha256_48354275540a19e149a3ec749fb4eeaa508568399fc971259b74ddc21d53a5fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161971,20 +162041,20 @@ rule MALPEDIA_Win_Anatova_Ransom_Auto : FILE
 		$sequence_9 = { 488d05d6390000 488985f8feffff 488d05d5390000 48898500ffffff 488d05d3390000 48898508ffffff }
 
 	condition:
-		7 of them and filesize <671744
+		7 of them and filesize < 671744
 }
 rule MALPEDIA_Win_Sphijacker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "209b4753-8fba-5f0f-8267-5050665ba5bc"
+		id = "1d9fa1de-fae8-5629-914f-5f847d79f437"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sphijacker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sphijacker_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "a99b1a8ce4f2ca018676a9e46f28df0afb5f7a80b3caa10c6423eb9f11e6c670"
+		logic_hash = "v1_sha256_a99b1a8ce4f2ca018676a9e46f28df0afb5f7a80b3caa10c6423eb9f11e6c670"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162010,20 +162080,20 @@ rule MALPEDIA_Win_Sphijacker_Auto : FILE
 		$sequence_9 = { 660feb15???????? 660feb0d???????? 4c8d0dd4ac0000 f20f5cca f2410f590cc1 660f28d1 660f28c1 }
 
 	condition:
-		7 of them and filesize <808960
+		7 of them and filesize < 808960
 }
 rule MALPEDIA_Win_Hdmr_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "85c97022-d8c5-5e21-a936-553f640fe4f6"
+		id = "307a1086-3781-58d7-baa5-6caab9731e40"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hdmr"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hdmr_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "9a001b5acc5aa25620fae4ae86be71364f80188dbdc0b08b5c1ad9fa793fd746"
+		logic_hash = "v1_sha256_9a001b5acc5aa25620fae4ae86be71364f80188dbdc0b08b5c1ad9fa793fd746"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162049,20 +162119,20 @@ rule MALPEDIA_Win_Hdmr_Auto : FILE
 		$sequence_9 = { 33c0 68fe070000 50 8d8c2472020000 51 8974241c 6689842474020000 }
 
 	condition:
-		7 of them and filesize <284672
+		7 of them and filesize < 284672
 }
 rule MALPEDIA_Win_Tor_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "97401572-684c-58d7-8ba8-1e13d7e2a1eb"
+		id = "b8b8c482-241b-5af7-99d2-b1614f65fd0c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tor_loader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tor_loader_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "67a7f7312503fc884654411fbd541d429d107c00f30e61663f00f8de9ff4e54f"
+		logic_hash = "v1_sha256_67a7f7312503fc884654411fbd541d429d107c00f30e61663f00f8de9ff4e54f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162088,20 +162158,20 @@ rule MALPEDIA_Win_Tor_Loader_Auto : FILE
 		$sequence_9 = { e8???????? 90 8b9424c0000000 83fa7f 7746 49ffc0 4c39c1 }
 
 	condition:
-		7 of them and filesize <13050880
+		7 of them and filesize < 13050880
 }
 rule MALPEDIA_Win_Usbferry_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7bb46c52-bfd6-5303-a607-4235821612d8"
+		id = "3f8a361c-e691-5e51-9749-00ec97a6db10"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.usbferry"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.usbferry_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "246be59259afe1548e2a4d266237ef3554d233c2ef89881c3d19b399601a13ef"
+		logic_hash = "v1_sha256_246be59259afe1548e2a4d266237ef3554d233c2ef89881c3d19b399601a13ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162133,20 +162203,20 @@ rule MALPEDIA_Win_Usbferry_Auto : FILE
 		$sequence_15 = { 8a02 8845df 8345d801 807ddf00 75ee 8b4dd8 }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize < 638976
 }
 rule MALPEDIA_Win_Locky_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9434ac8a-f19d-5097-9718-4e0bcd7c3bb7"
+		id = "3a58672d-08bd-5585-85be-2c9e9fa0e291"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.locky"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.locky_auto.yar#L1-L181"
 		license_url = "N/A"
-		logic_hash = "cfd0780ce81a27b30c6ff7ba29e871c926663b6bd8e9b266836319c43aec3bb1"
+		logic_hash = "v1_sha256_cfd0780ce81a27b30c6ff7ba29e871c926663b6bd8e9b266836319c43aec3bb1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162179,20 +162249,20 @@ rule MALPEDIA_Win_Locky_Auto : FILE
 		$sequence_16 = { 66ab 90 e9???????? 8d00 }
 
 	condition:
-		7 of them and filesize <1122304
+		7 of them and filesize < 1122304
 }
 rule MALPEDIA_Win_Lurk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d33e5d41-4c33-52cb-9d86-097c6e297a69"
+		id = "b72c3e40-9917-57f0-8c87-5ac5fc4f6f20"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lurk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lurk_auto.yar#L1-L176"
 		license_url = "N/A"
-		logic_hash = "49386f4cf56b83db74fc2cce7fdb3bbe57cfb7600cc336d7243ab2a9983dbda5"
+		logic_hash = "v1_sha256_49386f4cf56b83db74fc2cce7fdb3bbe57cfb7600cc336d7243ab2a9983dbda5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162224,20 +162294,20 @@ rule MALPEDIA_Win_Lurk_Auto : FILE
 		$sequence_15 = { 8bec 83ec0c 53 56 8b7508 0fb606 }
 
 	condition:
-		7 of them and filesize <5316608
+		7 of them and filesize < 5316608
 }
 rule MALPEDIA_Win_Harnig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2adef0b1-84b8-5d38-81de-8e96334fdf2c"
+		id = "4f728fac-f478-5cea-84ae-29e0f1cdbba9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.harnig"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.harnig_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "6b0da0575293c2afced8a49894e42bab87f6771cbe3d56035db53ed07d7267fe"
+		logic_hash = "v1_sha256_6b0da0575293c2afced8a49894e42bab87f6771cbe3d56035db53ed07d7267fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162263,20 +162333,20 @@ rule MALPEDIA_Win_Harnig_Auto : FILE
 		$sequence_9 = { 6a04 c745c03c000000 897dc8 c745cc6c104000 8945d4 897dd8 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Hardrain_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1a6618b8-7c70-57f8-b6a6-f8de7a4fa76c"
+		id = "826f0057-2189-5e30-b5f1-3542bee48fb9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hardrain"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hardrain_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "04e06a92a16a529e591abeaa4beba2487be2e1ac947f5b4db02fe0ee80e8f06b"
+		logic_hash = "v1_sha256_04e06a92a16a529e591abeaa4beba2487be2e1ac947f5b4db02fe0ee80e8f06b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162302,20 +162372,20 @@ rule MALPEDIA_Win_Hardrain_Auto : FILE
 		$sequence_9 = { ff15???????? 8bf0 83feff 0f8493000000 8d442408 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Jripbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d8a957a2-00cf-53c5-96bc-d79d0345ba47"
+		id = "cf43bbf6-fe3f-5705-b4f4-deca9dafd61a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jripbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jripbot_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "fc945105d57ad1b4469be79b8a34ff87923dbb08f76d1d337925be7cac82b3ca"
+		logic_hash = "v1_sha256_fc945105d57ad1b4469be79b8a34ff87923dbb08f76d1d337925be7cac82b3ca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162341,20 +162411,20 @@ rule MALPEDIA_Win_Jripbot_Auto : FILE
 		$sequence_9 = { 8bf8 85ff 7410 ff7508 56 57 }
 
 	condition:
-		7 of them and filesize <507904
+		7 of them and filesize < 507904
 }
 rule MALPEDIA_Win_Ksl0T_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a3ab9e8a-b9b1-5fdf-a960-56956519148f"
+		id = "86099738-560c-59c5-9450-4d5c588d28d1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ksl0t"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ksl0t_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "e91b3156f2e9e5f9c8a906372d50f3aa236f543969f133a16425c0f118830109"
+		logic_hash = "v1_sha256_e91b3156f2e9e5f9c8a906372d50f3aa236f543969f133a16425c0f118830109"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162386,20 +162456,20 @@ rule MALPEDIA_Win_Ksl0T_Auto : FILE
 		$sequence_15 = { c684249201000030 c68424930100003b c684249401000018 c684249501000020 c684249601000021 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize < 196608
 }
 rule MALPEDIA_Win_Safenet_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "44c128f1-e37d-585a-b061-6d17f8062460"
+		id = "8c5a4f20-8fc4-5787-a83d-e82a15bd01ba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.safenet"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.safenet_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "6d1c99e82abc5d35c1a893047f41638ddfbde9bad49f347bcf5718bfe865543c"
+		logic_hash = "v1_sha256_6d1c99e82abc5d35c1a893047f41638ddfbde9bad49f347bcf5718bfe865543c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162425,20 +162495,20 @@ rule MALPEDIA_Win_Safenet_Auto : FILE
 		$sequence_9 = { 8dbd7cffffff 59 f3ab 8b462c 33ff 3bc7 c7857cffffff24000000 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Dexbia_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d4032cc9-0c2b-5612-9b25-c1c6f50e458e"
+		id = "17d43ab5-3946-5528-a8e9-9430c1f9cdf7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dexbia"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dexbia_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "1dcaac0ec64ac5a8c76c0fa411e7e39bdabd41113089ec01c21fddb197f9dd6c"
+		logic_hash = "v1_sha256_1dcaac0ec64ac5a8c76c0fa411e7e39bdabd41113089ec01c21fddb197f9dd6c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162464,20 +162534,20 @@ rule MALPEDIA_Win_Dexbia_Auto : FILE
 		$sequence_9 = { f3ab 66ab aa 8b442410 b908000000 8dbc249c120000 6800140000 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Croxloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5f8b8916-f9ec-55d4-b465-31935c48c0ee"
+		id = "0f56bd95-5f73-5a15-8785-ae87c7d35420"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.croxloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.croxloader_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "040078157977ad881b28f3c9384cda36c377a63a849b31c6b1d6ac06966284a5"
+		logic_hash = "v1_sha256_040078157977ad881b28f3c9384cda36c377a63a849b31c6b1d6ac06966284a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162503,20 +162573,20 @@ rule MALPEDIA_Win_Croxloader_Auto : FILE
 		$sequence_9 = { 488d151eecffff 483bc2 7423 65488b042530000000 488b8998000000 483b4810 7206 }
 
 	condition:
-		7 of them and filesize <241664
+		7 of them and filesize < 241664
 }
 rule MALPEDIA_Win_Auriga_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b04a7a23-d5dd-51a9-9bcd-b8623a771f3d"
+		id = "19fb43d1-d990-51e8-ad9f-78d48389a59b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.auriga"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.auriga_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "ba5e317ff80a4f54d11462b8caf5c19d9418687fbcd32874c6803873b6103354"
+		logic_hash = "v1_sha256_ba5e317ff80a4f54d11462b8caf5c19d9418687fbcd32874c6803873b6103354"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162542,20 +162612,20 @@ rule MALPEDIA_Win_Auriga_Auto : FILE
 		$sequence_9 = { 33c0 8945e4 8945f0 8945f4 8d45e0 }
 
 	condition:
-		7 of them and filesize <75776
+		7 of them and filesize < 75776
 }
 rule MALPEDIA_Win_Parallax_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f999aded-327c-50dd-9dd2-6822fe568c2e"
+		id = "933906c9-772b-5750-83c8-62efccf41a3d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parallax"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.parallax_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "598728667b89c1a79c35abfecdd8c0a41fda3612c3bf2021240a756e9bc3373e"
+		logic_hash = "v1_sha256_598728667b89c1a79c35abfecdd8c0a41fda3612c3bf2021240a756e9bc3373e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162581,20 +162651,20 @@ rule MALPEDIA_Win_Parallax_Auto : FILE
 		$sequence_9 = { c7421c00000000 6a06 ff750c e8???????? }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize < 352256
 }
 rule MALPEDIA_Win_Felismus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82db284d-423c-5d27-9839-6fb28439fb0e"
+		id = "2b664708-a6fc-5180-bfa8-df389195d7bb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.felismus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.felismus_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "4546b8db4538dafe5bc8d041a61c766239a1afc6f98e209750b1eab9012fff52"
+		logic_hash = "v1_sha256_4546b8db4538dafe5bc8d041a61c766239a1afc6f98e209750b1eab9012fff52"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162620,20 +162690,20 @@ rule MALPEDIA_Win_Felismus_Auto : FILE
 		$sequence_9 = { 33ff 85db 7e7f ff15???????? 99 b91a000000 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Moure_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d5ea53f7-d6a1-5284-9152-98034607f388"
+		id = "461082aa-343b-57eb-b7b1-06d9634ba1a8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moure"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.moure_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "e394b210e6ac1eaa6569608ddb349d4dd1ae50231f20d0924074c460f1fa6782"
+		logic_hash = "v1_sha256_e394b210e6ac1eaa6569608ddb349d4dd1ae50231f20d0924074c460f1fa6782"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162659,20 +162729,20 @@ rule MALPEDIA_Win_Moure_Auto : FILE
 		$sequence_9 = { 42 c3 874226 c58035b4fe70 5e }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Systembc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "78762f50-0312-5144-8487-9132a843d75d"
+		id = "102ffd94-56e8-5644-ab1c-200f202e0551"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.systembc_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "0c55a2c050a3bb97541957e7a554780d9460670263a6f5688965634c91b9bb06"
+		logic_hash = "v1_sha256_0c55a2c050a3bb97541957e7a554780d9460670263a6f5688965634c91b9bb06"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162698,20 +162768,20 @@ rule MALPEDIA_Win_Systembc_Auto : FILE
 		$sequence_9 = { 8b450c ab 8b4514 ab }
 
 	condition:
-		7 of them and filesize <75776
+		7 of them and filesize < 75776
 }
 rule MALPEDIA_Win_Nemim_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "23401018-c6d9-5370-9496-23a34b1b2310"
+		id = "fba2f6ee-3c72-5cab-b7e9-3b7b5fff6ce6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nemim"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nemim_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "a74c5cc417011139586470805b653eee06eb07d9c80d556280876db9d2f1564f"
+		logic_hash = "v1_sha256_a74c5cc417011139586470805b653eee06eb07d9c80d556280876db9d2f1564f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162737,20 +162807,20 @@ rule MALPEDIA_Win_Nemim_Auto : FILE
 		$sequence_9 = { 68???????? 53 ff15???????? 6a5c 68???????? }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize < 499712
 }
 rule MALPEDIA_Win_Sysget_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6dbd418c-6815-50a8-abcf-151d7391ffca"
+		id = "8593e890-bd08-5900-91f0-2f37a1263b28"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysget"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sysget_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "902f9069de33837221babbb397abede3730b90e4c77213918173008758853f78"
+		logic_hash = "v1_sha256_902f9069de33837221babbb397abede3730b90e4c77213918173008758853f78"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162776,20 +162846,20 @@ rule MALPEDIA_Win_Sysget_Auto : FILE
 		$sequence_9 = { 53 ff75f8 ff15???????? 5f 5e 33c0 }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize < 352256
 }
 rule MALPEDIA_Win_Zardoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0edcabb6-39f3-5cd6-ada5-74eb513ae7ba"
+		id = "77d8be3e-6721-5f79-92b8-ee79dc5cef7c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zardoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zardoor_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "dcbde80565a6988222a931ad27e9d322a3f8d97571d82cdb176504031bc2daa5"
+		logic_hash = "v1_sha256_dcbde80565a6988222a931ad27e9d322a3f8d97571d82cdb176504031bc2daa5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162815,20 +162885,20 @@ rule MALPEDIA_Win_Zardoor_Auto : FILE
 		$sequence_9 = { 488d4904 488d14c8 488b83a8000000 488990e0020000 488b83a8000000 488b8b88040000 488b80e0020000 }
 
 	condition:
-		7 of them and filesize <4376576
+		7 of them and filesize < 4376576
 }
 rule MALPEDIA_Win_Maoloa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7a2b1982-b20a-5388-b0ef-52864066a031"
+		id = "e6c9a16d-9a9c-51fd-b341-bb35d62ce163"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maoloa"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.maoloa_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "db1d30099f88e9731a955a855e8ff6fe8bdddafcf359d763b17d4e94ad2fc492"
+		logic_hash = "v1_sha256_db1d30099f88e9731a955a855e8ff6fe8bdddafcf359d763b17d4e94ad2fc492"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162854,20 +162924,20 @@ rule MALPEDIA_Win_Maoloa_Auto : FILE
 		$sequence_9 = { 3bc1 0f47c1 a3???????? c705????????000000c0 c705????????000000c0 c705????????80000088 8d8594e3ffff }
 
 	condition:
-		7 of them and filesize <586752
+		7 of them and filesize < 586752
 }
 rule MALPEDIA_Win_Allaple_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c8febfcb-b725-537f-8f54-423e8f8493e3"
+		id = "3db268c8-a0e1-5485-9b5d-a6ec43caf75b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.allaple"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.allaple_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "f37966362a7b1531336f0a212f7c22ad8f69248a7c762c12dc2134fd4316ec00"
+		logic_hash = "v1_sha256_f37966362a7b1531336f0a212f7c22ad8f69248a7c762c12dc2134fd4316ec00"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162893,20 +162963,20 @@ rule MALPEDIA_Win_Allaple_Auto : FILE
 		$sequence_9 = { 8b4208 33852cffffff 3345cc 8945e4 8b4d08 8b510c }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Emotet_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "85da1a2d-a5c5-5b7b-9770-0decc7a1a09c"
+		id = "c8fee857-3561-5b76-b297-7d288611243c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.emotet_auto.yar#L1-L629"
 		license_url = "N/A"
-		logic_hash = "833ebe5d59874650225701086c74088b08c5f926b449dc8bc3e0d02e1708d1c4"
+		logic_hash = "v1_sha256_833ebe5d59874650225701086c74088b08c5f926b449dc8bc3e0d02e1708d1c4"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -162998,20 +163068,20 @@ rule MALPEDIA_Win_Emotet_Auto : FILE
 		$sequence_75 = { 0f84c0000000 488d542430 488bc8 4889742470 e8???????? 488bf0 }
 
 	condition:
-		7 of them and filesize <733184
+		7 of them and filesize < 733184
 }
 rule MALPEDIA_Win_Konni_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b496c86d-77c9-50ca-bd29-c6ba6090731f"
+		id = "23763a87-5654-5bc2-ab14-7d12686d3c11"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.konni"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.konni_auto.yar#L1-L487"
 		license_url = "N/A"
-		logic_hash = "4a537b4460e51cec9389cef999baf5dfc7c64c03085bd38519060ea921833d74"
+		logic_hash = "v1_sha256_4a537b4460e51cec9389cef999baf5dfc7c64c03085bd38519060ea921833d74"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -163080,20 +163150,20 @@ rule MALPEDIA_Win_Konni_Auto : FILE
 		$sequence_52 = { 41f7d1 488d3d99550100 4983f808 0f82ec000000 48895c2410 498bd8 }
 
 	condition:
-		7 of them and filesize <2361344
+		7 of them and filesize < 2361344
 }
 rule MALPEDIA_Win_Meow_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7bfddd3d-be4f-534c-b012-013271dcd1ec"
+		id = "43bdc1a7-1948-514a-9f35-efe5b15eed37"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meow"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.meow_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "3492cd8205784aeb9b05674679a1cd09e5a722fe3928b65cba6a5afbb0a0fecc"
+		logic_hash = "v1_sha256_3492cd8205784aeb9b05674679a1cd09e5a722fe3928b65cba6a5afbb0a0fecc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163119,20 +163189,20 @@ rule MALPEDIA_Win_Meow_Auto : FILE
 		$sequence_9 = { 0f845489ffff e9???????? e9???????? 55 8bec ff7508 }
 
 	condition:
-		7 of them and filesize <492544
+		7 of them and filesize < 492544
 }
 rule MALPEDIA_Win_Lilith_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82364ac2-deb7-51b6-ba0e-2be91de6e553"
+		id = "108de4b7-72ff-5b98-9821-c916919c37c6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lilith"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lilith_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "e60f46a761d89df2badd5fa4f4597b68f40a30e0a662e1d347c30e5849d899e2"
+		logic_hash = "v1_sha256_e60f46a761d89df2badd5fa4f4597b68f40a30e0a662e1d347c30e5849d899e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163158,20 +163228,20 @@ rule MALPEDIA_Win_Lilith_Auto : FILE
 		$sequence_9 = { 56 57 ff7520 8bf1 e8???????? }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize < 499712
 }
 rule MALPEDIA_Win_Nimbo_C2_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3fbf9b9f-3200-52f3-a15f-1eaff92b5ed0"
+		id = "b5a21f90-5664-5b03-a4c5-45d79b5ab827"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimbo_c2"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nimbo_c2_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "8589aa9b6f63efad7fde0dd033ffc7aedc0446802bcc3cc8f7fcdbf116768199"
+		logic_hash = "v1_sha256_8589aa9b6f63efad7fde0dd033ffc7aedc0446802bcc3cc8f7fcdbf116768199"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163197,20 +163267,20 @@ rule MALPEDIA_Win_Nimbo_C2_Auto : FILE
 		$sequence_9 = { b907000000 4c8b8424c0000000 ba03000000 4d89ce e8???????? ba03000000 b906000000 }
 
 	condition:
-		7 of them and filesize <1141760
+		7 of them and filesize < 1141760
 }
 rule MALPEDIA_Win_Ismagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "24afa0f1-f712-53a2-912d-b18acc3ca8ea"
+		id = "775a30eb-9694-503e-b962-b31a47507d84"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismagent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ismagent_auto.yar#L1-L100"
 		license_url = "N/A"
-		logic_hash = "9ef409a40f890c9792a656e6f1a7b3222e5613b22517076da29bfdc0316f39e4"
+		logic_hash = "v1_sha256_9ef409a40f890c9792a656e6f1a7b3222e5613b22517076da29bfdc0316f39e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163234,20 +163304,20 @@ rule MALPEDIA_Win_Ismagent_Auto : FILE
 		$sequence_7 = { 8d8424580b0000 50 e8???????? 83c40c 8d842418030000 68e8030000 50 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Yanluowang_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "80b6830b-5b54-5c8d-ad9b-1e91ef44f5d3"
+		id = "f23a6412-14a3-5202-881e-967d9eefa634"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yanluowang"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.yanluowang_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "6212a7300d814763a89ad52de44e628c3e76a732777f6c6e8d98550e60e1baf9"
+		logic_hash = "v1_sha256_6212a7300d814763a89ad52de44e628c3e76a732777f6c6e8d98550e60e1baf9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163273,20 +163343,20 @@ rule MALPEDIA_Win_Yanluowang_Auto : FILE
 		$sequence_9 = { 8b4f50 8bf1 8b55ac 8b4754 8b7f58 8b525c 0bca }
 
 	condition:
-		7 of them and filesize <834560
+		7 of them and filesize < 834560
 }
 rule MALPEDIA_Win_Buzus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f2c6c20b-b508-5a77-9b4a-9c4e0b2d073d"
+		id = "c6d0c027-cf40-5628-a424-35e9d29c4948"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buzus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.buzus_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "8e43adb8c81d9beeeff3e46894b189cae5a523720c80cbd55f0f1970ef5f7600"
+		logic_hash = "v1_sha256_8e43adb8c81d9beeeff3e46894b189cae5a523720c80cbd55f0f1970ef5f7600"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163312,20 +163382,20 @@ rule MALPEDIA_Win_Buzus_Auto : FILE
 		$sequence_9 = { 83c418 33db 8d85d8faffff 53 53 53 53 }
 
 	condition:
-		7 of them and filesize <679936
+		7 of them and filesize < 679936
 }
 rule MALPEDIA_Win_Ddkeylogger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3fb8455b-5bc3-5fd3-8427-a0f169965730"
+		id = "5c0e58b1-127f-571e-98b1-ebde366bf43b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkeylogger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ddkeylogger_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "fadbff39943f10b1213064afba0274f50487808fd2b1956572db1fecae4dc6f6"
+		logic_hash = "v1_sha256_fadbff39943f10b1213064afba0274f50487808fd2b1956572db1fecae4dc6f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163351,20 +163421,20 @@ rule MALPEDIA_Win_Ddkeylogger_Auto : FILE
 		$sequence_9 = { c1eb06 03de 0fb61493 885102 0fb65002 83e23f 0fb61432 }
 
 	condition:
-		7 of them and filesize <808960
+		7 of them and filesize < 808960
 }
 rule MALPEDIA_Win_Grillmark_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f964c2f0-0000-5336-8c75-c1988fed5207"
+		id = "a6eb7de8-f6e8-5bbf-bb79-7dff28122bee"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grillmark"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.grillmark_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "3b34499d4c29c52da57dd97a7dde84f3954319d72fae7b0456cb1c1378f5429f"
+		logic_hash = "v1_sha256_3b34499d4c29c52da57dd97a7dde84f3954319d72fae7b0456cb1c1378f5429f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163390,20 +163460,20 @@ rule MALPEDIA_Win_Grillmark_Auto : FILE
 		$sequence_9 = { 802600 5f 8908 8b45f8 5e }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Goldenspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e7dd5e3-178b-5910-8098-c42b951969b2"
+		id = "389cd896-9df6-5cf6-80b8-4b8fd038e886"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goldenspy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.goldenspy_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "b60928ded54ec1e6882e1e84d68fbc49ae085baf6e4863bae7fd0036613f3bf4"
+		logic_hash = "v1_sha256_b60928ded54ec1e6882e1e84d68fbc49ae085baf6e4863bae7fd0036613f3bf4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163429,20 +163499,20 @@ rule MALPEDIA_Win_Goldenspy_Auto : FILE
 		$sequence_9 = { 8b01 8b400c ffd0 8945e0 8d45e0 c645fc2c 50 }
 
 	condition:
-		7 of them and filesize <1081344
+		7 of them and filesize < 1081344
 }
 rule MALPEDIA_Win_Eagerbee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2914e030-5e45-5c35-a3c7-d9acb5cc0ce1"
+		id = "c62283d0-7a01-58c9-9581-1c338170a92d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eagerbee"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.eagerbee_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "3bba3fefff572c4fd61435a0b0fa92dfc257235bdf724d5d11ca53b01740914f"
+		logic_hash = "v1_sha256_3bba3fefff572c4fd61435a0b0fa92dfc257235bdf724d5d11ca53b01740914f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163468,20 +163538,20 @@ rule MALPEDIA_Win_Eagerbee_Auto : FILE
 		$sequence_9 = { 8b8c3888000000 41b801000000 488bd7 e8???????? 8bf0 837c3e1800 }
 
 	condition:
-		7 of them and filesize <422912
+		7 of them and filesize < 422912
 }
 rule MALPEDIA_Win_Rhino_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d85fe477-4e99-588f-91e6-0f1b3f138c82"
+		id = "3e106be9-dec1-5445-8ebf-5071398172c2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhino"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rhino_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "00639a2283c7cb43c3dac639e40d4b9a0594ea339862d60e983925c4aeea1ea1"
+		logic_hash = "v1_sha256_00639a2283c7cb43c3dac639e40d4b9a0594ea339862d60e983925c4aeea1ea1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163507,20 +163577,20 @@ rule MALPEDIA_Win_Rhino_Auto : FILE
 		$sequence_9 = { 8bc7 c1c802 33c8 03d9 837c241000 895c2414 743c }
 
 	condition:
-		7 of them and filesize <1288192
+		7 of them and filesize < 1288192
 }
 rule MALPEDIA_Win_Doppelpaymer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fb3d1d6a-8d0f-5691-b315-4261f48416f9"
+		id = "7ce154ab-a0d9-59d3-887c-51799d1f2635"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.doppelpaymer_auto.yar#L1-L187"
 		license_url = "N/A"
-		logic_hash = "5a0db62aabb073b4fe7086dc27996528fad3daef4ecf82aaa9e666c8187cc6f8"
+		logic_hash = "v1_sha256_5a0db62aabb073b4fe7086dc27996528fad3daef4ecf82aaa9e666c8187cc6f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163554,20 +163624,20 @@ rule MALPEDIA_Win_Doppelpaymer_Auto : FILE
 		$sequence_17 = { 8b7e50 897db8 8b7e3c 897dbc 8b7e10 897dc0 8b7e18 }
 
 	condition:
-		7 of them and filesize <7266304
+		7 of them and filesize < 7266304
 }
 rule MALPEDIA_Win_Nachocheese_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "119ab577-2997-5077-8fbd-28bff11c20d6"
+		id = "075bca15-eca8-5165-b2c5-8966598a1271"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nachocheese"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nachocheese_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "cadb77319f92fe40994b6aeeeca327d5d465905297aa3f5228d474dfd2f50f6d"
+		logic_hash = "v1_sha256_cadb77319f92fe40994b6aeeeca327d5d465905297aa3f5228d474dfd2f50f6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163599,20 +163669,20 @@ rule MALPEDIA_Win_Nachocheese_Auto : FILE
 		$sequence_15 = { 7305 83c302 eb29 81fb00010000 7305 83c303 }
 
 	condition:
-		7 of them and filesize <1064960
+		7 of them and filesize < 1064960
 }
 rule MALPEDIA_Win_Collectorgoomba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5bb538af-60a7-5a3c-af65-3701cf208563"
+		id = "473d036f-8770-56bc-ae8e-5762604ba0be"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.collectorgoomba"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.collectorgoomba_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ad69a85577b2886d7cccd50f51e68db7322b59aae6c81464fad54090e92dc915"
+		logic_hash = "v1_sha256_ad69a85577b2886d7cccd50f51e68db7322b59aae6c81464fad54090e92dc915"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163638,20 +163708,20 @@ rule MALPEDIA_Win_Collectorgoomba_Auto : FILE
 		$sequence_9 = { ff7040 e8???????? 83c410 8945f8 837df800 7405 e9???????? }
 
 	condition:
-		7 of them and filesize <1400832
+		7 of them and filesize < 1400832
 }
 rule MALPEDIA_Win_Lumma_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1dee4d5d-9b7b-5ecd-98af-fd03e9ff26e5"
+		id = "e5b199ea-61b6-5de1-9c98-594e4ee3c2da"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lumma_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "3a8b83c4e573eb9f46c2ea015108cf5619d754c9ccdb93831085f7f3bab02530"
+		logic_hash = "v1_sha256_3a8b83c4e573eb9f46c2ea015108cf5619d754c9ccdb93831085f7f3bab02530"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -163685,20 +163755,20 @@ rule MALPEDIA_Win_Lumma_Auto : FILE
 		$sequence_17 = { e8???????? 83c40c 019e8c000000 39ef }
 
 	condition:
-		7 of them and filesize <1115136
+		7 of them and filesize < 1115136
 }
 rule MALPEDIA_Win_Fobber_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c71dc66-f917-5ba2-9fb8-1fb21c7a75f0"
+		id = "73bc7618-be72-5cd4-a8c2-dd1e26715899"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fobber"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fobber_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "61538df65ce7e18f8d160f3c894437f915290dca7e112a40d32b84ca774989b9"
+		logic_hash = "v1_sha256_61538df65ce7e18f8d160f3c894437f915290dca7e112a40d32b84ca774989b9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163730,20 +163800,20 @@ rule MALPEDIA_Win_Fobber_Auto : FILE
 		$sequence_15 = { 8d46ff 0f85196e0100 807dfc00 7407 8b4df8 836170fd 5e }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Miniblindingcan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7798fac4-4e5d-566f-a335-bf730671b981"
+		id = "84563a1d-37e7-50a1-800b-850f3d6a2d17"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniblindingcan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.miniblindingcan_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "58b505c72082d28e67c192bf52fda135efb347b75fec700d41c24b4ca9aa0285"
+		logic_hash = "v1_sha256_58b505c72082d28e67c192bf52fda135efb347b75fec700d41c24b4ca9aa0285"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163769,20 +163839,20 @@ rule MALPEDIA_Win_Miniblindingcan_Auto : FILE
 		$sequence_9 = { 4c8bc6 48ffc6 418838 e9???????? 49ffc4 498b0c24 490fafc8 }
 
 	condition:
-		7 of them and filesize <453632
+		7 of them and filesize < 453632
 }
 rule MALPEDIA_Win_Avos_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9aee42e1-3c32-52f2-9afa-ee2f50391d41"
+		id = "9d03ba9d-4af2-5922-981d-b8bc9f61602a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.avos_locker_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a821f2b32080b52bc69d3070def6e8f696a536519430ac8aacf9142d4b2280c1"
+		logic_hash = "v1_sha256_a821f2b32080b52bc69d3070def6e8f696a536519430ac8aacf9142d4b2280c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163808,20 +163878,20 @@ rule MALPEDIA_Win_Avos_Locker_Auto : FILE
 		$sequence_9 = { 894e30 c645fc02 8d4dbc e8???????? c745fcffffffff 8bc6 8b4df4 }
 
 	condition:
-		7 of them and filesize <1701888
+		7 of them and filesize < 1701888
 }
 rule MALPEDIA_Win_Krdownloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "10ef2ce3-6275-5734-8773-8e4b907d8dbf"
+		id = "53080e69-d6de-59fa-ac5f-b383c536345e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.krdownloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.krdownloader_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "5c0e3ed0b3f2de4235868995565358a807a3f9a7ed056ed4108e22469b818ef9"
+		logic_hash = "v1_sha256_5c0e3ed0b3f2de4235868995565358a807a3f9a7ed056ed4108e22469b818ef9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163847,20 +163917,20 @@ rule MALPEDIA_Win_Krdownloader_Auto : FILE
 		$sequence_9 = { 51 6a00 8b4d10 e8???????? 894590 8b5590 89558c }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize < 352256
 }
 rule MALPEDIA_Win_Flame_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b53c0a2c-8618-5e74-aa3e-ccb8cf016906"
+		id = "9b122e43-3e5c-560a-82c6-2c503ddca7bc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flame"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.flame_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "0f55b9dade05164e67ff141163e2392fbdf01e6db384f40da8132a7d5263b81a"
+		logic_hash = "v1_sha256_0f55b9dade05164e67ff141163e2392fbdf01e6db384f40da8132a7d5263b81a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163891,20 +163961,20 @@ rule MALPEDIA_Win_Flame_Auto : FILE
 		$sequence_14 = { 7424 488b4b08 8b45d0 482b0b }
 
 	condition:
-		7 of them and filesize <1676288
+		7 of them and filesize < 1676288
 }
 rule MALPEDIA_Win_Chewbacca_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "390231b1-3e2b-54db-9803-32024f965f10"
+		id = "165a59b9-fadd-5c0c-ba01-43d37d8353e1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chewbacca"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chewbacca_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "e7a38996a98134785fc7654ab24d9b2f764c6a77f5e2b53f68cf035bd47e7345"
+		logic_hash = "v1_sha256_e7a38996a98134785fc7654ab24d9b2f764c6a77f5e2b53f68cf035bd47e7345"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163930,20 +164000,20 @@ rule MALPEDIA_Win_Chewbacca_Auto : FILE
 		$sequence_9 = { e8???????? 8b4308 8b10 8b4004 f7d0 f7da 83d8ff }
 
 	condition:
-		7 of them and filesize <9764864
+		7 of them and filesize < 9764864
 }
 rule MALPEDIA_Win_Pss_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5d7a2f66-332a-5d9c-b5c1-576c5e994461"
+		id = "e10cce7b-1591-549d-b232-8d0976d555f3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pss"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pss_auto.yar#L1-L139"
 		license_url = "N/A"
-		logic_hash = "51611bab605bb2ace0ab1fa2af33625cc29dd81f64a8b665b3e9018994b265fd"
+		logic_hash = "v1_sha256_51611bab605bb2ace0ab1fa2af33625cc29dd81f64a8b665b3e9018994b265fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163972,20 +164042,20 @@ rule MALPEDIA_Win_Pss_Auto : FILE
 		$sequence_12 = { 488bcd 895c2470 e8???????? 48634c2470 4803c9 }
 
 	condition:
-		7 of them and filesize <421888
+		7 of them and filesize < 421888
 }
 rule MALPEDIA_Win_Badhatch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "129c68ce-5b2e-52de-a1c8-87ec196923a8"
+		id = "1cdd5620-62a5-57d6-9a39-a4e158499da1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badhatch"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.badhatch_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "d1799db66ba63d047ab24cbcf38644792982827a0f2e3a856828a5d589d13430"
+		logic_hash = "v1_sha256_d1799db66ba63d047ab24cbcf38644792982827a0f2e3a856828a5d589d13430"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164011,20 +164081,20 @@ rule MALPEDIA_Win_Badhatch_Auto : FILE
 		$sequence_9 = { 6a01 8b7d08 8bc7 e8???????? 59 8945e4 85c0 }
 
 	condition:
-		7 of them and filesize <156672
+		7 of them and filesize < 156672
 }
 rule MALPEDIA_Win_Defray_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "23c37ae2-467d-5f29-b754-9bdc94cdef46"
+		id = "eddd5742-e4d2-5454-9d5c-d1807b3c3b9f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.defray"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.defray_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "d9d1b63e76728813771527a0e75abb334c604ad0cc64db1ac03a90b90d9454be"
+		logic_hash = "v1_sha256_d9d1b63e76728813771527a0e75abb334c604ad0cc64db1ac03a90b90d9454be"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164050,20 +164120,20 @@ rule MALPEDIA_Win_Defray_Auto : FILE
 		$sequence_9 = { ba05000000 8d0da0564700 e9???????? a90000f07f 752c a9ffff0f00 7525 }
 
 	condition:
-		7 of them and filesize <1253376
+		7 of them and filesize < 1253376
 }
 rule MALPEDIA_Win_Fatduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62118afa-94f3-55fc-9df2-3b95dac75d0a"
+		id = "f499c16c-09cd-5c36-9a65-b65ff66c55c7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fatduke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fatduke_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "2b9fcfe8a4ef7a6057f27cf4a92527f05cca75754ce0db88d74fae66934b4810"
+		logic_hash = "v1_sha256_2b9fcfe8a4ef7a6057f27cf4a92527f05cca75754ce0db88d74fae66934b4810"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164089,20 +164159,20 @@ rule MALPEDIA_Win_Fatduke_Auto : FILE
 		$sequence_9 = { ff7728 e8???????? 83c404 c7473c0f000000 c7473800000000 c6472800 c645fc00 }
 
 	condition:
-		7 of them and filesize <9012224
+		7 of them and filesize < 9012224
 }
 rule MALPEDIA_Win_R77_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82a35666-90fe-5251-926e-d8ec55b813d1"
+		id = "980cabfe-5418-5025-9b5e-aad0da931ac7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.r77"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.r77_auto.yar#L1-L155"
 		license_url = "N/A"
-		logic_hash = "a6240af5ccc4c53bc37ef2e7a551ebc739733179f6b77ecd5d71bb872b7b54ae"
+		logic_hash = "v1_sha256_a6240af5ccc4c53bc37ef2e7a551ebc739733179f6b77ecd5d71bb872b7b54ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164132,20 +164202,20 @@ rule MALPEDIA_Win_R77_Auto : FILE
 		$sequence_13 = { 488b55c8 4c8d054efd0000 85c0 0f8417010000 }
 
 	condition:
-		7 of them and filesize <350208
+		7 of them and filesize < 350208
 }
 rule MALPEDIA_Win_Quickheal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7d4dca96-7d89-573a-86d8-cd5cf725e16a"
+		id = "f221228b-f593-5ca4-b566-4d6459f09c2d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quickheal"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.quickheal_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "a577fc33ace43aa6e0de60cf56eae847992f0d2ae90d4e16ade87fbe86c88038"
+		logic_hash = "v1_sha256_a577fc33ace43aa6e0de60cf56eae847992f0d2ae90d4e16ade87fbe86c88038"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164171,20 +164241,20 @@ rule MALPEDIA_Win_Quickheal_Auto : FILE
 		$sequence_9 = { 52 ffd7 85c0 7418 8b442410 c744241404010000 50 }
 
 	condition:
-		7 of them and filesize <553984
+		7 of them and filesize < 553984
 }
 rule MALPEDIA_Win_Bumblebee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb13bacf-dfd1-5f67-a954-b108745cbd18"
+		id = "b0c8c8f1-d2cb-5eb3-80ca-7c6a8a8fa6ea"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bumblebee_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "1740917da778479acf746acdc75f2beb6821c321be8f136bbd653a625bc1c0f8"
+		logic_hash = "v1_sha256_1740917da778479acf746acdc75f2beb6821c321be8f136bbd653a625bc1c0f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164210,20 +164280,20 @@ rule MALPEDIA_Win_Bumblebee_Auto : FILE
 		$sequence_9 = { 33db 4d8bf0 4c8bea 48895d48 8bf1 48895dc8 33d2 }
 
 	condition:
-		7 of them and filesize <4825088
+		7 of them and filesize < 4825088
 }
 rule MALPEDIA_Win_Crypt0L0Cker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e6b39d07-e23b-5484-8b7e-294315d68726"
+		id = "6e3427e9-9d33-5037-b41d-d4230f3a9bca"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypt0l0cker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crypt0l0cker_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "11804f6d364478c710393f9e456002818242d521693fa2a4f73173b108217067"
+		logic_hash = "v1_sha256_11804f6d364478c710393f9e456002818242d521693fa2a4f73173b108217067"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164249,20 +164319,20 @@ rule MALPEDIA_Win_Crypt0L0Cker_Auto : FILE
 		$sequence_9 = { 8b7c2418 85c0 0f84a0000000 8d4c2420 51 50 6a00 }
 
 	condition:
-		7 of them and filesize <917504
+		7 of them and filesize < 917504
 }
 rule MALPEDIA_Win_Parasite_Http_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b5a52ac1-7407-5488-8891-0827582e53ff"
+		id = "2cbcc8ac-76c6-5517-b01f-422448bf18a9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parasite_http"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.parasite_http_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "b1b7675b20fef7b5b4abd1833972b96c480194b45d3d066a629b96c3dbbd6baa"
+		logic_hash = "v1_sha256_b1b7675b20fef7b5b4abd1833972b96c480194b45d3d066a629b96c3dbbd6baa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164288,20 +164358,20 @@ rule MALPEDIA_Win_Parasite_Http_Auto : FILE
 		$sequence_9 = { ffd0 5f 5e 5b 5d c20c00 53 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Zerot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca921115-39c5-5d82-8694-1a7256cdc82c"
+		id = "f30bb7fd-eb03-583e-993e-be5ccc198bba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zerot_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "85e45f7b3fe13ccc106bda70bf9add1f5b39cb8a82aaafbc3111d2a319c8d43b"
+		logic_hash = "v1_sha256_85e45f7b3fe13ccc106bda70bf9add1f5b39cb8a82aaafbc3111d2a319c8d43b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164327,20 +164397,20 @@ rule MALPEDIA_Win_Zerot_Auto : FILE
 		$sequence_9 = { 0f1f440000 8b460c 8a44082a 2401 88040a }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize < 303104
 }
 rule MALPEDIA_Win_Roopirs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "57676d4c-d0d7-5b4f-80a4-819b4d474425"
+		id = "28936f79-684c-5670-af33-515afae53ecb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roopirs"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.roopirs_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "d4e144778ab9b98b475c3cbfeb400528a9373556893774f62bba1f2eb8f36265"
+		logic_hash = "v1_sha256_d4e144778ab9b98b475c3cbfeb400528a9373556893774f62bba1f2eb8f36265"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164366,20 +164436,20 @@ rule MALPEDIA_Win_Roopirs_Auto : FILE
 		$sequence_9 = { 8d4dc8 ff15???????? c745fc07000000 8b4dd8 51 68???????? }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize < 344064
 }
 rule MALPEDIA_Win_Sidewinder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "392688fd-d092-5405-9184-eda077762341"
+		id = "88271a0b-3c8a-5e3a-9c94-3dd9aba4bb4b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewinder"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sidewinder_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "ed076ae71f5673b9d5b7573a79292b3a5ca9ffc23926551c4a3dd71dd3fac1f3"
+		logic_hash = "v1_sha256_ed076ae71f5673b9d5b7573a79292b3a5ca9ffc23926551c4a3dd71dd3fac1f3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164405,20 +164475,20 @@ rule MALPEDIA_Win_Sidewinder_Auto : FILE
 		$sequence_9 = { e8???????? 68???????? 8d4ddc e8???????? 8d4dd8 e8???????? c3 }
 
 	condition:
-		7 of them and filesize <679936
+		7 of them and filesize < 679936
 }
 rule MALPEDIA_Win_Ragnarok_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e51b7730-611b-519c-90af-8c932bd35b31"
+		id = "98747133-577b-5e5e-afd2-f5dda6d3991f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarok"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ragnarok_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "ed2a7ae77b63d671045bd4aedbd475a1c70e0fa7ad07494ab8d71c8f930faf2f"
+		logic_hash = "v1_sha256_ed2a7ae77b63d671045bd4aedbd475a1c70e0fa7ad07494ab8d71c8f930faf2f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164444,20 +164514,20 @@ rule MALPEDIA_Win_Ragnarok_Auto : FILE
 		$sequence_9 = { 0f87a9000000 ff24858d6e4100 ff7510 ff750c }
 
 	condition:
-		7 of them and filesize <483328
+		7 of them and filesize < 483328
 }
 rule MALPEDIA_Win_Ceeloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c4d991a8-4075-5bcb-8916-cb7ba3e3bc9e"
+		id = "84aab88e-f4e7-5b66-bf15-3afe5492549b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ceeloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ceeloader_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a2c60d828b1d749bfbc654154ea7639eec54d50fcdb5e7a81ec6415d729400d3"
+		logic_hash = "v1_sha256_a2c60d828b1d749bfbc654154ea7639eec54d50fcdb5e7a81ec6415d729400d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164483,20 +164553,20 @@ rule MALPEDIA_Win_Ceeloader_Auto : FILE
 		$sequence_9 = { 0315???????? 8915???????? 8b15???????? 448b05???????? 4189d2 4531c2 4431d2 }
 
 	condition:
-		7 of them and filesize <2321408
+		7 of them and filesize < 2321408
 }
 rule MALPEDIA_Win_Aukill_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "db9d4a1a-ed53-5fea-bff5-185747bfbb51"
+		id = "d772bfb2-006d-5089-a953-2abca0293f15"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aukill"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.aukill_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "cf5c7585c61eda7d5c6a56885b3d8ed6928646fd3abef78ed34135b918e268f8"
+		logic_hash = "v1_sha256_cf5c7585c61eda7d5c6a56885b3d8ed6928646fd3abef78ed34135b918e268f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164522,20 +164592,20 @@ rule MALPEDIA_Win_Aukill_Auto : FILE
 		$sequence_9 = { 48894c2420 448d4920 48894c2450 488b0d???????? }
 
 	condition:
-		7 of them and filesize <446464
+		7 of them and filesize < 446464
 }
 rule MALPEDIA_Win_Gtpdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4153c400-4ed4-5abe-992b-68d9e6f8d150"
+		id = "95ce0f83-f9ba-5a70-9b0d-e1b7959c6388"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gtpdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gtpdoor_auto.yar#L1-L153"
 		license_url = "N/A"
-		logic_hash = "423cce46146e2125cb44be14d40c52df5a3a2bf5fc0d9812eac79f63ac677cea"
+		logic_hash = "v1_sha256_423cce46146e2125cb44be14d40c52df5a3a2bf5fc0d9812eac79f63ac677cea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164565,20 +164635,20 @@ rule MALPEDIA_Win_Gtpdoor_Auto : FILE
 		$sequence_13 = { 4889c2 480355e0 0fb645ff 8802 }
 
 	condition:
-		7 of them and filesize <4210688
+		7 of them and filesize < 4210688
 }
 rule MALPEDIA_Win_Darktequila_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "269a3731-3e60-523d-8f8e-b11db5f03d72"
+		id = "2747d283-23e3-5d24-9077-55bedbebfcbc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darktequila"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darktequila_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "7a615b9f83311311d3befdcf3fa9a13c4c4dc7e52e3af67816a4aeaa810facc1"
+		logic_hash = "v1_sha256_7a615b9f83311311d3befdcf3fa9a13c4c4dc7e52e3af67816a4aeaa810facc1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164604,20 +164674,20 @@ rule MALPEDIA_Win_Darktequila_Auto : FILE
 		$sequence_9 = { 85db 0f84c2000000 56 57 8d4102 e8???????? }
 
 	condition:
-		7 of them and filesize <1827840
+		7 of them and filesize < 1827840
 }
 rule MALPEDIA_Win_Transbox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "974af1a4-da2b-5193-ac3c-32d4a6cfff60"
+		id = "0c907ad6-f54b-5297-ac2a-d95797398be3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.transbox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.transbox_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "e0417344b856e4de18adbd11a563963b1ed47459f0027440ad36de04e1848468"
+		logic_hash = "v1_sha256_e0417344b856e4de18adbd11a563963b1ed47459f0027440ad36de04e1848468"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164643,20 +164713,20 @@ rule MALPEDIA_Win_Transbox_Auto : FILE
 		$sequence_9 = { 740c 6a04 56 50 e8???????? 83c40c 8325????????00 }
 
 	condition:
-		7 of them and filesize <288768
+		7 of them and filesize < 288768
 }
 rule MALPEDIA_Win_Mongall_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1879a42c-8126-5974-b63b-7f69fc5f6e38"
+		id = "5810d81c-06f0-55ea-bac2-27012e93857b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mongall"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mongall_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "36dcbe2d37d6f65dbb3669c0b2ac6fd765ed6dc11c02d84fddc280c31d04ea56"
+		logic_hash = "v1_sha256_36dcbe2d37d6f65dbb3669c0b2ac6fd765ed6dc11c02d84fddc280c31d04ea56"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164682,20 +164752,20 @@ rule MALPEDIA_Win_Mongall_Auto : FILE
 		$sequence_9 = { 8975f8 ff15???????? 8b5d08 85db 740a 57 }
 
 	condition:
-		7 of them and filesize <199680
+		7 of them and filesize < 199680
 }
 rule MALPEDIA_Win_Solarbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49174231-2a30-5980-bda7-c8f930d0210d"
+		id = "5586d1b0-5cb8-5011-bd5d-8ab245062510"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.solarbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.solarbot_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "78704c2bda81ce32f769ec7e509f90cf94c947eb12d602603a0979d813473a0e"
+		logic_hash = "v1_sha256_78704c2bda81ce32f769ec7e509f90cf94c947eb12d602603a0979d813473a0e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164721,20 +164791,20 @@ rule MALPEDIA_Win_Solarbot_Auto : FILE
 		$sequence_9 = { 89f0 c1e002 038550feffff 8b955cfeffff 8910 81fefa000000 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Ragnarlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ac8a2eb-b248-5587-8704-788c5b75f23d"
+		id = "92d73416-b931-5032-9cfa-8d28ae8c0aec"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarlocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ragnarlocker_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "a0b16ae3dec166e9354e89e87f8c27a6b4e207c9c50c554aa69c08f1891c036a"
+		logic_hash = "v1_sha256_a0b16ae3dec166e9354e89e87f8c27a6b4e207c9c50c554aa69c08f1891c036a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164760,20 +164830,20 @@ rule MALPEDIA_Win_Ragnarlocker_Auto : FILE
 		$sequence_9 = { 0fa4ca1e c1ef02 8975e8 33f6 0bf2 c1e11e 3175f4 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Typehash_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "edf296ed-fbc4-5bd8-b180-ef55e989c944"
+		id = "f93d4b23-1594-53d2-9f9d-3e79f2ab52f1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.typehash"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.typehash_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "9451e6a97a0b537ea280e22049617c90fd5aa93257a4b129bfda6427a2eb4eeb"
+		logic_hash = "v1_sha256_9451e6a97a0b537ea280e22049617c90fd5aa93257a4b129bfda6427a2eb4eeb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164799,20 +164869,20 @@ rule MALPEDIA_Win_Typehash_Auto : FILE
 		$sequence_9 = { e8???????? 68???????? 8d45c8 c745c8e4e74000 50 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Nymaim2_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b34e9293-8593-5a44-9c75-a60856a38adc"
+		id = "fc3bef13-2a2e-5f15-a457-47fa27e067c3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim2"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nymaim2_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "1e69e778cd0db9f8366da07218fbdcf365b60086ad2357e3134734801ed5db37"
+		logic_hash = "v1_sha256_1e69e778cd0db9f8366da07218fbdcf365b60086ad2357e3134734801ed5db37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164838,20 +164908,20 @@ rule MALPEDIA_Win_Nymaim2_Auto : FILE
 		$sequence_9 = { c645fc02 e8???????? 8b00 8bcf 8945e8 8d45e4 50 }
 
 	condition:
-		7 of them and filesize <753664
+		7 of them and filesize < 753664
 }
 rule MALPEDIA_Win_Ratankbapos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d1e7d1d4-363b-5b45-848f-d4cc89843f97"
+		id = "ec81c17b-414f-5b76-aa6b-a7a4756dabe1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratankbapos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ratankbapos_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "17591f183be92d031983360942e373f37d5a48aae82c019ca5afd1168616aff1"
+		logic_hash = "v1_sha256_17591f183be92d031983360942e373f37d5a48aae82c019ca5afd1168616aff1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164877,20 +164947,20 @@ rule MALPEDIA_Win_Ratankbapos_Auto : FILE
 		$sequence_9 = { 8bc1 8da42400000000 8a10 3a11 751a 84d2 7412 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Koadic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cf49fa85-eb15-5b40-90ec-91247303052e"
+		id = "8793f8e1-af7c-5829-834e-eaefd3994090"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koadic"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.koadic_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "045758b315b8841fdc586ed89736311e4ca424527e393ec057e76ad188d18c25"
+		logic_hash = "v1_sha256_045758b315b8841fdc586ed89736311e4ca424527e393ec057e76ad188d18c25"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164916,20 +164986,20 @@ rule MALPEDIA_Win_Koadic_Auto : FILE
 		$sequence_9 = { ff15???????? 8bf8 8d5f01 53 6a00 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Webc2_Rave_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "df6c143a-04c8-53dd-b585-7785e6f7c9b7"
+		id = "a5c94be8-c420-5089-bc3b-142963811866"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_rave"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_rave_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "d35d8eb6aefe7cc5c299f90e5678dfb9d7a049e0361b4bce0487fde286aa34fe"
+		logic_hash = "v1_sha256_d35d8eb6aefe7cc5c299f90e5678dfb9d7a049e0361b4bce0487fde286aa34fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164955,20 +165025,20 @@ rule MALPEDIA_Win_Webc2_Rave_Auto : FILE
 		$sequence_9 = { 50 ffd5 83c408 e9???????? 8b4e10 6aff 8d542438 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Mail_O_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "22d6b28e-4151-5e9b-9587-80b5734c06d0"
+		id = "1c2d276e-974b-509b-90e1-4d436a565de3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mail_o"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mail_o_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "dcb8e5253869e623d55ce118499ad5275559d95782fd4c320c46ce5ddc9c4fdf"
+		logic_hash = "v1_sha256_dcb8e5253869e623d55ce118499ad5275559d95782fd4c320c46ce5ddc9c4fdf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164994,20 +165064,20 @@ rule MALPEDIA_Win_Mail_O_Auto : FILE
 		$sequence_9 = { 7442 488bce 4c8d2defdb0b00 0f1f4000 6666660f1f840000000000 410fb61408 48ffc1 }
 
 	condition:
-		7 of them and filesize <5985280
+		7 of them and filesize < 5985280
 }
 rule MALPEDIA_Win_Pwnpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89590cbe-393e-53e8-874f-1579725c5e19"
+		id = "0ae6c29b-bade-5759-8973-b2a45107aaac"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pwnpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pwnpos_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "99cca90c63c7d894b30f59c47917d71bb5281e2d807f6e3da388b67f1d509c2d"
+		logic_hash = "v1_sha256_99cca90c63c7d894b30f59c47917d71bb5281e2d807f6e3da388b67f1d509c2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165033,20 +165103,20 @@ rule MALPEDIA_Win_Pwnpos_Auto : FILE
 		$sequence_9 = { e8???????? 8d4c2408 51 8d4c2410 8bf8 c744240ce0ea4300 }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize < 638976
 }
 rule MALPEDIA_Win_Mikoponi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4800c6d3-16db-53d7-bb1f-1cb0040fb556"
+		id = "88a99a2b-a639-593b-b89b-2cf5dbff209d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mikoponi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mikoponi_auto.yar#L1-L109"
 		license_url = "N/A"
-		logic_hash = "6fec244d34dfdfffb8f190bd531090181ff56cb0a8f461ac3c66e10426835858"
+		logic_hash = "v1_sha256_6fec244d34dfdfffb8f190bd531090181ff56cb0a8f461ac3c66e10426835858"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165070,20 +165140,20 @@ rule MALPEDIA_Win_Mikoponi_Auto : FILE
 		$sequence_7 = { 56 68???????? e8???????? 83c408 5e 8bc3 5b }
 
 	condition:
-		7 of them and filesize <330752
+		7 of them and filesize < 330752
 }
 rule MALPEDIA_Win_Zeus_Sphinx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2404684e-f88f-5795-bbdc-963d4ddd15f4"
+		id = "e6931352-d33e-575b-9a91-af2dcf7b9db1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_sphinx"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zeus_sphinx_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "f8ae31764c1b32c59de8e620b679e44d219bf08111b95222bfeb2c4359a4f338"
+		logic_hash = "v1_sha256_f8ae31764c1b32c59de8e620b679e44d219bf08111b95222bfeb2c4359a4f338"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165115,20 +165185,20 @@ rule MALPEDIA_Win_Zeus_Sphinx_Auto : FILE
 		$sequence_15 = { 0008 d7 9f b2d3 }
 
 	condition:
-		7 of them and filesize <3268608
+		7 of them and filesize < 3268608
 }
 rule MALPEDIA_Win_Evilbunny_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3746f242-5ef7-565f-99d0-aeeb4c27d515"
+		id = "256122b5-52ea-5b16-a502-c2c0bca82652"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilbunny"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.evilbunny_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "1534b24ff80468ad553b2eed5ffad4b00ea68305fd3769acbc60a82e33460626"
+		logic_hash = "v1_sha256_1534b24ff80468ad553b2eed5ffad4b00ea68305fd3769acbc60a82e33460626"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165154,20 +165224,20 @@ rule MALPEDIA_Win_Evilbunny_Auto : FILE
 		$sequence_9 = { c745fccccccccc 894dfc 68eeeac01f 68???????? 8b4dfc e8???????? 8945f8 }
 
 	condition:
-		7 of them and filesize <1695744
+		7 of them and filesize < 1695744
 }
 rule MALPEDIA_Win_Rhttpctrl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb8327a4-6882-545f-b20a-98b7f136eb51"
+		id = "3ce458ed-e798-526d-b103-9a0a196105e1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhttpctrl"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rhttpctrl_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "a8b0cf895e0bd3f2af68f83e9a4ca3cd7018abded67cb45f683d7384d581104e"
+		logic_hash = "v1_sha256_a8b0cf895e0bd3f2af68f83e9a4ca3cd7018abded67cb45f683d7384d581104e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165193,20 +165263,20 @@ rule MALPEDIA_Win_Rhttpctrl_Auto : FILE
 		$sequence_9 = { ffb5e4d7ffff ffb5e0d7ffff 50 ff15???????? 8bc8 898dd8d7ffff 85c9 }
 
 	condition:
-		7 of them and filesize <339968
+		7 of them and filesize < 339968
 }
 rule MALPEDIA_Win_Biscuit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66751c6c-b859-5182-9d1d-e9646223d6c4"
+		id = "49f0e4a8-c5ce-592b-bda3-6a3ea3181d66"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.biscuit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.biscuit_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "84aba44ada1e956d4a74e202350a88ae7df3ab1612a23de6af2ad0ed5a1e2805"
+		logic_hash = "v1_sha256_84aba44ada1e956d4a74e202350a88ae7df3ab1612a23de6af2ad0ed5a1e2805"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165232,20 +165302,20 @@ rule MALPEDIA_Win_Biscuit_Auto : FILE
 		$sequence_9 = { a1???????? 50 6a00 8b8d30b8ffff 51 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Duuzer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b9aa8686-ae5c-522f-84d5-1ffe739b66d7"
+		id = "cfac1768-d14c-5ee5-9978-38623a5c364c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duuzer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.duuzer_auto.yar#L1-L148"
 		license_url = "N/A"
-		logic_hash = "0a972badbc054d0ce47d3497dce1a043373ba372ad2c5fee4eff7c656c3de915"
+		logic_hash = "v1_sha256_0a972badbc054d0ce47d3497dce1a043373ba372ad2c5fee4eff7c656c3de915"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165276,20 +165346,20 @@ rule MALPEDIA_Win_Duuzer_Auto : FILE
 		$sequence_14 = { 48895c2468 498bd4 4c897c2420 48397e20 7408 }
 
 	condition:
-		7 of them and filesize <491520
+		7 of them and filesize < 491520
 }
 rule MALPEDIA_Win_Bitsloth_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a3d0de3b-9639-54f3-9dde-5c53759da2ed"
+		id = "4a723916-6101-52d6-a4d4-d1ec3b5f010d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitsloth"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bitsloth_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "c4f0991c5eb2b348c1fcbe6db2b4d14bd7d82664775a39a42f7ea0ad4a8658a0"
+		logic_hash = "v1_sha256_c4f0991c5eb2b348c1fcbe6db2b4d14bd7d82664775a39a42f7ea0ad4a8658a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165315,20 +165385,20 @@ rule MALPEDIA_Win_Bitsloth_Auto : FILE
 		$sequence_9 = { 3b8568ffffff 721d 6a00 6a00 681f520000 e8???????? 83c40c }
 
 	condition:
-		7 of them and filesize <677888
+		7 of them and filesize < 677888
 }
 rule MALPEDIA_Win_Slickshoes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d2f3560b-3237-526b-973c-5a49467a861c"
+		id = "8fead080-bb6b-5ddd-867b-e006c200718a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slickshoes"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.slickshoes_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "97b262a4dee8ee1b76d2a0a337ee7fc4558fd80e3330d7f7994e897a96aa6369"
+		logic_hash = "v1_sha256_97b262a4dee8ee1b76d2a0a337ee7fc4558fd80e3330d7f7994e897a96aa6369"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165354,20 +165424,20 @@ rule MALPEDIA_Win_Slickshoes_Auto : FILE
 		$sequence_9 = { e9???????? 313c24 333c24 e9???????? 870c24 8b2424 e9???????? }
 
 	condition:
-		7 of them and filesize <11198464
+		7 of them and filesize < 11198464
 }
 rule MALPEDIA_Win_Varenyky_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ab8f8dd3-9c68-536a-86ec-5c7d9a6bae52"
+		id = "7ff4a8e6-0344-58b8-aee7-b8b2e3029153"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.varenyky"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.varenyky_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "c5bb03c58d8d0a3e4056574270047301338558839b61ccfc4ab3bac90d9c50ac"
+		logic_hash = "v1_sha256_c5bb03c58d8d0a3e4056574270047301338558839b61ccfc4ab3bac90d9c50ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165393,20 +165463,20 @@ rule MALPEDIA_Win_Varenyky_Auto : FILE
 		$sequence_9 = { 8db760fc4000 ff36 e8???????? 83c704 59 8906 83ff28 }
 
 	condition:
-		7 of them and filesize <24846336
+		7 of them and filesize < 24846336
 }
 rule MALPEDIA_Win_Hancitor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1eb6df2e-159b-5f28-b4bd-8814d0819600"
+		id = "9c3fc1a8-194d-56e2-8f2f-ca62a3eb543f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hancitor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hancitor_auto.yar#L1-L262"
 		license_url = "N/A"
-		logic_hash = "065eca202c5de0c3aac505b9a1e3b15150d867b922d1e944cb9db0f3b78d775f"
+		logic_hash = "v1_sha256_065eca202c5de0c3aac505b9a1e3b15150d867b922d1e944cb9db0f3b78d775f"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -165449,20 +165519,20 @@ rule MALPEDIA_Win_Hancitor_Auto : FILE
 		$sequence_26 = { 55 8bec 83ec78 a1???????? a3???????? c745c488b24000 a1???????? }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Avzhan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c13a7c9b-4cee-5226-bade-6ae0e888daa7"
+		id = "84489015-fbc4-58bb-a556-d9fc5aea9f79"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avzhan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.avzhan_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "71cd3a78708c6b20dbe933c0b73634c73ab7a935896c5127cd1ee325ea10e744"
+		logic_hash = "v1_sha256_71cd3a78708c6b20dbe933c0b73634c73ab7a935896c5127cd1ee325ea10e744"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165488,20 +165558,20 @@ rule MALPEDIA_Win_Avzhan_Auto : FILE
 		$sequence_9 = { 33c0 8d7c243c c744243844000000 f3ab 8b442464 8b3d???????? 83c418 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Redalpha_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a45e264-f0cb-55d8-8d41-9c16d8d716f7"
+		id = "644d6bb2-04f2-5d09-8213-865b208aaed9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redalpha"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.redalpha_auto.yar#L1-L230"
 		license_url = "N/A"
-		logic_hash = "cbf7a84b857c49ee3d81dd7f006e794089e9ad6271126e24c962dedf553b5fc2"
+		logic_hash = "v1_sha256_cbf7a84b857c49ee3d81dd7f006e794089e9ad6271126e24c962dedf553b5fc2"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -165541,20 +165611,20 @@ rule MALPEDIA_Win_Redalpha_Auto : FILE
 		$sequence_23 = { ff75f8 ff15???????? 837de404 7412 8d45e0 }
 
 	condition:
-		7 of them and filesize <606208
+		7 of them and filesize < 606208
 }
 rule MALPEDIA_Win_Woody_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1d402bd-2e1b-5cc3-9efe-bee43a3f6f70"
+		id = "bf7b5d0b-dc9f-5ddf-aca5-3447cf94d622"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woody"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.woody_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "9fa53ff2aea1026050fd9bf490e4459858b6e425e2d1081bd2beeba1427b1834"
+		logic_hash = "v1_sha256_9fa53ff2aea1026050fd9bf490e4459858b6e425e2d1081bd2beeba1427b1834"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165580,20 +165650,20 @@ rule MALPEDIA_Win_Woody_Auto : FILE
 		$sequence_9 = { 83c408 85c0 7505 bf01000000 85f6 7404 85ff }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize < 409600
 }
 rule MALPEDIA_Win_Kerrdown_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68770a3e-6717-5ac7-9970-7a5d2e8be7ee"
+		id = "a21eea1c-c792-5b51-b2d8-b094aa1c6429"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kerrdown"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kerrdown_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "5c1e70ce1c83c058010acdca1cced0163370ed7a63b1ae0a7c0e9df6e4e225f4"
+		logic_hash = "v1_sha256_5c1e70ce1c83c058010acdca1cced0163370ed7a63b1ae0a7c0e9df6e4e225f4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165619,20 +165689,20 @@ rule MALPEDIA_Win_Kerrdown_Auto : FILE
 		$sequence_9 = { c745f800000000 83feff 7438 6a00 8d45f8 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Virlock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f47c27a-c9f5-5a88-9d0b-7ae966c8318a"
+		id = "a8acf84d-4876-5e96-b399-7f2cc4dda0fb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virlock"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.virlock_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "57885374cad55b220d8ca1f9432224bf7f5758a9b4619824c3d2cad7d03a8a3d"
+		logic_hash = "v1_sha256_57885374cad55b220d8ca1f9432224bf7f5758a9b4619824c3d2cad7d03a8a3d"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -165658,20 +165728,20 @@ rule MALPEDIA_Win_Virlock_Auto : FILE
 		$sequence_9 = { 36a25c6a5eac 42 775c 44 e4f2 2b470c d04ba2 }
 
 	condition:
-		7 of them and filesize <4202496
+		7 of them and filesize < 4202496
 }
 rule MALPEDIA_Win_Splitloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "134d8226-eb7c-5031-8a1c-a24d18923a11"
+		id = "cbd65e56-a211-5424-8c79-2ee55a9366e8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.splitloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.splitloader_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "61ea1a460bed6edfbafde374a204cb805d347ddcc6924015d5eb07560b9fca84"
+		logic_hash = "v1_sha256_61ea1a460bed6edfbafde374a204cb805d347ddcc6924015d5eb07560b9fca84"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165697,20 +165767,20 @@ rule MALPEDIA_Win_Splitloader_Auto : FILE
 		$sequence_9 = { 4c8d0513700000 41b903000000 488d4c45bc 488bc1 492bc5 48d1f8 }
 
 	condition:
-		7 of them and filesize <174080
+		7 of them and filesize < 174080
 }
 rule MALPEDIA_Win_Nefilim_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1a64ad05-cdf4-50b0-b5d5-12b823b566f1"
+		id = "7bb9e139-d617-5431-8c93-bd7ba1e2f9cd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nefilim"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nefilim_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "437ef32e0bcb845260c527798fe2225eeb3cd5a3921b5194205f4e5468ee3dde"
+		logic_hash = "v1_sha256_437ef32e0bcb845260c527798fe2225eeb3cd5a3921b5194205f4e5468ee3dde"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165736,20 +165806,20 @@ rule MALPEDIA_Win_Nefilim_Auto : FILE
 		$sequence_9 = { 2bc8 83f901 770a 68???????? e8???????? 8d5801 6a00 }
 
 	condition:
-		7 of them and filesize <142336
+		7 of them and filesize < 142336
 }
 rule MALPEDIA_Win_Mars_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89d493f9-e4b1-533f-82c2-eb346efb826d"
+		id = "4e7c9896-5277-59bc-923d-9c685d346945"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mars_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mars_stealer_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "fa77ecd9a121fc69a9c627c8a10e5db8b46b11ecb902d48795d692c6a136b780"
+		logic_hash = "v1_sha256_fa77ecd9a121fc69a9c627c8a10e5db8b46b11ecb902d48795d692c6a136b780"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165775,20 +165845,20 @@ rule MALPEDIA_Win_Mars_Stealer_Auto : FILE
 		$sequence_9 = { 8bec b8c81f0000 e8???????? c745f0a01f0000 c745ec00000000 c78544e0ffff9e304100 }
 
 	condition:
-		7 of them and filesize <219136
+		7 of them and filesize < 219136
 }
 rule MALPEDIA_Win_Keylogger_Apt3_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "871f2218-1f0d-5644-a123-b9ca7ac01c6c"
+		id = "8a443fc6-c3e2-5364-980b-976382c128f8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keylogger_apt3"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.keylogger_apt3_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "23fd7cba40859fc906b768d58d83d5a417832be7f192d8e12b9ebc03b321149b"
+		logic_hash = "v1_sha256_23fd7cba40859fc906b768d58d83d5a417832be7f192d8e12b9ebc03b321149b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165814,20 +165884,20 @@ rule MALPEDIA_Win_Keylogger_Apt3_Auto : FILE
 		$sequence_9 = { 56 8b74240c 57 85f6 742f }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize < 761856
 }
 rule MALPEDIA_Win_Whispergate_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "268f4f00-7468-54d8-b348-346d201993cc"
+		id = "9d960675-85a0-5e3a-a3c1-e0325f1729b2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whispergate"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.whispergate_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "a494914334df13264ae7aa19a2f5e165c28339f35ad7afc6f2c9baf4d999ad12"
+		logic_hash = "v1_sha256_a494914334df13264ae7aa19a2f5e165c28339f35ad7afc6f2c9baf4d999ad12"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165853,20 +165923,20 @@ rule MALPEDIA_Win_Whispergate_Auto : FILE
 		$sequence_9 = { 89de 8d44240c 89c7 8945c8 0fb603 3c7f 7428 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Anel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "953c8e23-a017-5b2f-ada2-2a862edfbe44"
+		id = "69dac6e9-6dfb-5fc8-812f-53c6203b5c30"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.anel_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "3d1ba89860b52bc0dc01f6c2b2044c292ec3a194dda9499e849b870d6aa20608"
+		logic_hash = "v1_sha256_3d1ba89860b52bc0dc01f6c2b2044c292ec3a194dda9499e849b870d6aa20608"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165892,20 +165962,20 @@ rule MALPEDIA_Win_Anel_Auto : FILE
 		$sequence_9 = { 0f8e89000000 8b7510 85f6 7e62 ff7514 8d45f8 57 }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize < 376832
 }
 rule MALPEDIA_Win_Coredn_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "56ae3d0f-275e-5068-a1a8-add140ea339b"
+		id = "d19286a0-3699-5652-bb32-474ac3d71b00"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coredn"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.coredn_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "3e99d32cb9f6585a539057b215782ae24308a0cdeed56e6718c13cdaa1226877"
+		logic_hash = "v1_sha256_3e99d32cb9f6585a539057b215782ae24308a0cdeed56e6718c13cdaa1226877"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165936,20 +166006,20 @@ rule MALPEDIA_Win_Coredn_Auto : FILE
 		$sequence_14 = { 83c40c 6b45e430 8945e0 8d80a8304100 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize < 270336
 }
 rule MALPEDIA_Win_Dnschanger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "375505d5-891d-554a-a42f-9e6f0fae0b87"
+		id = "96ae906b-38ff-57ff-b6eb-4042d6071644"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnschanger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dnschanger_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "f68b87e486e08337bbca4e5fa0e18e836c7279b07c38cbb25db798c12b62c8c3"
+		logic_hash = "v1_sha256_f68b87e486e08337bbca4e5fa0e18e836c7279b07c38cbb25db798c12b62c8c3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165975,20 +166045,20 @@ rule MALPEDIA_Win_Dnschanger_Auto : FILE
 		$sequence_9 = { ff15???????? 8d542408 52 e8???????? 85c0 5f 5e }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Stuxnet_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9c448caf-a5e3-53e6-be9a-4aa45334f7d3"
+		id = "c77f2598-d33a-5146-bad4-31f7457b08d6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stuxnet"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stuxnet_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "2029a68bba02441740da4f3ef9a391375e59b29e674666cb41a7f24fda7b29c9"
+		logic_hash = "v1_sha256_2029a68bba02441740da4f3ef9a391375e59b29e674666cb41a7f24fda7b29c9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166014,20 +166084,20 @@ rule MALPEDIA_Win_Stuxnet_Auto : FILE
 		$sequence_9 = { 8d55d8 52 ff7510 ff750c ff7508 51 50 }
 
 	condition:
-		7 of them and filesize <2495488
+		7 of them and filesize < 2495488
 }
 rule MALPEDIA_Win_Zloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "178c70de-c326-5e7a-939c-09ed0c73d1dc"
+		id = "3ac4b1a4-b79d-5f30-84ae-5b8375fd9744"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zloader_auto.yar#L1-L424"
 		license_url = "N/A"
-		logic_hash = "f3602cbba95531e02ba22e89ac5b5e6174a07dbda34c6d28cb18aded5d257e41"
+		logic_hash = "v1_sha256_f3602cbba95531e02ba22e89ac5b5e6174a07dbda34c6d28cb18aded5d257e41"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -166090,20 +166160,20 @@ rule MALPEDIA_Win_Zloader_Auto : FILE
 		$sequence_46 = { 894c2424 890b 56 8944241c }
 
 	condition:
-		7 of them and filesize <5360640
+		7 of them and filesize < 5360640
 }
 rule MALPEDIA_Win_Kuluoz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "23b3e89b-1b7f-51fe-9c49-dededa4af110"
+		id = "d34a168e-393c-56fd-84a2-ef3057cdc843"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kuluoz"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kuluoz_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "e3270208208f4df1bb5bfe1d5ec8560fd50de417e7279c3823b68456c3f49c76"
+		logic_hash = "v1_sha256_e3270208208f4df1bb5bfe1d5ec8560fd50de417e7279c3823b68456c3f49c76"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166129,20 +166199,20 @@ rule MALPEDIA_Win_Kuluoz_Auto : FILE
 		$sequence_9 = { b900100000 f7f1 8b45fc 2bc2 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Kikothac_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d385826e-58d3-5814-919d-ec257a5aa756"
+		id = "db4d3550-06ce-576a-91d1-a750bbf20451"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kikothac"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kikothac_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "44c91c13eb1dd4a6656263ce0b69b86cf3ff2448fb7726df446bdef3b4382332"
+		logic_hash = "v1_sha256_44c91c13eb1dd4a6656263ce0b69b86cf3ff2448fb7726df446bdef3b4382332"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166168,20 +166238,20 @@ rule MALPEDIA_Win_Kikothac_Auto : FILE
 		$sequence_9 = { 85c0 7644 3d00040000 760d b800040000 8d4df4 }
 
 	condition:
-		7 of them and filesize <581632
+		7 of them and filesize < 581632
 }
 rule MALPEDIA_Win_Zxxz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7dd263db-5dc9-5446-993f-e84614693a03"
+		id = "f4e9ec73-62e5-5488-a023-06f7da45b3d3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zxxz"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zxxz_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "7a7e7dba53ef8e0486a9f712bcc36135ae7e5d2a4697169aaecab71dcaa9f879"
+		logic_hash = "v1_sha256_7a7e7dba53ef8e0486a9f712bcc36135ae7e5d2a4697169aaecab71dcaa9f879"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166207,20 +166277,20 @@ rule MALPEDIA_Win_Zxxz_Auto : FILE
 		$sequence_9 = { 83c408 85c0 752f 8d442408 }
 
 	condition:
-		7 of them and filesize <4142080
+		7 of them and filesize < 4142080
 }
 rule MALPEDIA_Win_Darkshell_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d4fc21ee-58fa-538c-be7f-a8cab0c5cdbd"
+		id = "03b2fd8b-4a54-5ca3-bb84-260f540e759b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkshell"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkshell_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "3ad6f3f944b2f63e5ca49ebc403baac1fe005ab1933d4836c8ac4d2304e8086f"
+		logic_hash = "v1_sha256_3ad6f3f944b2f63e5ca49ebc403baac1fe005ab1933d4836c8ac4d2304e8086f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166246,20 +166316,20 @@ rule MALPEDIA_Win_Darkshell_Auto : FILE
 		$sequence_9 = { 8b5008 33c0 8bfa f2ae }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize < 344064
 }
 rule MALPEDIA_Win_Unidentified_020_Cia_Vault7_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "29c37aae-f59e-5de0-b472-49827a85b93b"
+		id = "5ab86142-9c4f-5589-814f-4f3eba7216bc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_020_cia_vault7"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_020_cia_vault7_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "e7a70ab9b6a509f80d931123c1a82d7625f8b02d536427c2ae108e65b04e2ebe"
+		logic_hash = "v1_sha256_e7a70ab9b6a509f80d931123c1a82d7625f8b02d536427c2ae108e65b04e2ebe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166285,20 +166355,20 @@ rule MALPEDIA_Win_Unidentified_020_Cia_Vault7_Auto : FILE
 		$sequence_9 = { 5e 5d c20400 57 be02000000 e8???????? }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Ranbyus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4a2a0ab8-1d46-5117-bb36-6bc4aa1f9933"
+		id = "a0266767-b59b-5850-8ae9-17719fc64eaf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ranbyus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ranbyus_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "330e6be70ed45bf6b2dbed5046fb65bb22576b8352f6395b54bf453a6f591094"
+		logic_hash = "v1_sha256_330e6be70ed45bf6b2dbed5046fb65bb22576b8352f6395b54bf453a6f591094"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166324,20 +166394,20 @@ rule MALPEDIA_Win_Ranbyus_Auto : FILE
 		$sequence_9 = { 5f 5e 5b 5d c21000 57 ff760c }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize < 638976
 }
 rule MALPEDIA_Win_Netrepser_Keylogger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7f57cd5d-92d6-5b8d-9329-1faf79bf30fb"
+		id = "03fbf060-907b-57fd-ab7e-6af145b8ccd8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netrepser_keylogger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.netrepser_keylogger_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "301814f110ed56d36474cf3f699ac02f8540c1721eebd9fd906c701050fc9a5d"
+		logic_hash = "v1_sha256_301814f110ed56d36474cf3f699ac02f8540c1721eebd9fd906c701050fc9a5d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166369,20 +166439,20 @@ rule MALPEDIA_Win_Netrepser_Keylogger_Auto : FILE
 		$sequence_15 = { 50 83ec2c a1???????? 3145f8 33c5 894560 53 }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize < 303104
 }
 rule MALPEDIA_Win_Yoddos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "773dcd86-3687-5c26-8a61-390a3a45554b"
+		id = "d945bd83-4bd0-53b8-add6-edb020bdfdc2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yoddos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.yoddos_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "8286010b7da9f1df882192411526cd0a211d255dea4daeff1ec9797cedceaf98"
+		logic_hash = "v1_sha256_8286010b7da9f1df882192411526cd0a211d255dea4daeff1ec9797cedceaf98"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166408,20 +166478,20 @@ rule MALPEDIA_Win_Yoddos_Auto : FILE
 		$sequence_9 = { e8???????? 83c410 8d85d4fbffff 53 50 }
 
 	condition:
-		7 of them and filesize <557056
+		7 of them and filesize < 557056
 }
 rule MALPEDIA_Win_Covid22_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "99a02a74-d0a3-533c-b448-35480cff51fc"
+		id = "fa24344f-ad0f-50dd-8844-1297e21e189a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.covid22"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.covid22_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "968cf98e2e8c36cdb3ce45b1a5e5186c5425f3f25bc15cd333cdcc77eeba73ef"
+		logic_hash = "v1_sha256_968cf98e2e8c36cdb3ce45b1a5e5186c5425f3f25bc15cd333cdcc77eeba73ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166447,20 +166517,20 @@ rule MALPEDIA_Win_Covid22_Auto : FILE
 		$sequence_9 = { ba???????? 8d0d10b24000 e8???????? ba???????? 8d0d14b24000 }
 
 	condition:
-		7 of them and filesize <1955840
+		7 of them and filesize < 1955840
 }
 rule MALPEDIA_Win_Graphdrop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "24fb95a1-20eb-59d2-a21c-2ae5bcca80f7"
+		id = "4b37d826-7c91-5953-b98a-aa4052a2b24c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphdrop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.graphdrop_auto.yar#L1-L108"
 		license_url = "N/A"
-		logic_hash = "7950fd3d879183156c1cd9194f7d7f790283d1f02a5c57bd2f302dbba8044501"
+		logic_hash = "v1_sha256_7950fd3d879183156c1cd9194f7d7f790283d1f02a5c57bd2f302dbba8044501"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -166486,20 +166556,20 @@ rule MALPEDIA_Win_Graphdrop_Auto : FILE
 		$sequence_9 = { 50 90 53 0f77 }
 
 	condition:
-		7 of them and filesize <4186112
+		7 of them and filesize < 4186112
 }
 rule MALPEDIA_Win_Taleret_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6be6a0df-09b4-53be-b501-12f03fd91cf1"
+		id = "6fcad306-6257-554e-9055-0aa86ae2dc78"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taleret"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.taleret_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "544f42faf26ff7a7e8e3048971242e57a62e785dd2bacb3cb794d982726af564"
+		logic_hash = "v1_sha256_544f42faf26ff7a7e8e3048971242e57a62e785dd2bacb3cb794d982726af564"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166525,20 +166595,20 @@ rule MALPEDIA_Win_Taleret_Auto : FILE
 		$sequence_9 = { 8b6c2418 8b4c242c 3bcd 0f8df5000000 2be9 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Newbounce_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bdf56a77-5d9e-573d-af2b-c0319e364db4"
+		id = "25bfe856-3a37-5b30-a0ab-94b3cd2ec1f7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newbounce"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.newbounce_auto.yar#L1-L145"
 		license_url = "N/A"
-		logic_hash = "1757d742189e1562595d26ebbaf5e74bc5236d74e3305389104993dc5b138ecf"
+		logic_hash = "v1_sha256_1757d742189e1562595d26ebbaf5e74bc5236d74e3305389104993dc5b138ecf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166569,20 +166639,20 @@ rule MALPEDIA_Win_Newbounce_Auto : FILE
 		$sequence_14 = { 81e6ff000000 8b34b548536300 81e7ff000000 8b3cbd48576300 }
 
 	condition:
-		7 of them and filesize <8637440
+		7 of them and filesize < 8637440
 }
 rule MALPEDIA_Win_Zenar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "911998a5-168a-5bc2-9a82-e2c3fffdd44c"
+		id = "39afc087-e827-5131-b85f-e2adabc83949"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zenar"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zenar_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "e884fb88ff5222c3dce5f2029617037692e70cee36f52d500814f26a83ec50e0"
+		logic_hash = "v1_sha256_e884fb88ff5222c3dce5f2029617037692e70cee36f52d500814f26a83ec50e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166608,20 +166678,20 @@ rule MALPEDIA_Win_Zenar_Auto : FILE
 		$sequence_9 = { 8b4de0 8845f3 85c9 7411 8b01 ff5008 }
 
 	condition:
-		7 of them and filesize <519168
+		7 of them and filesize < 519168
 }
 rule MALPEDIA_Win_Havex_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62ba2091-3094-511c-928f-d8587303cab0"
+		id = "47afbd1e-2781-5c3b-a5ac-2b04c322071b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havex_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.havex_rat_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "051d7a160bda27ce92537b0acc638ab1e006b209a8b64890cf910d9cca719a54"
+		logic_hash = "v1_sha256_051d7a160bda27ce92537b0acc638ab1e006b209a8b64890cf910d9cca719a54"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166647,20 +166717,20 @@ rule MALPEDIA_Win_Havex_Rat_Auto : FILE
 		$sequence_9 = { ffd6 83f801 74f3 6a01 ffd5 53 }
 
 	condition:
-		7 of them and filesize <892928
+		7 of them and filesize < 892928
 }
 rule MALPEDIA_Win_Gearshift_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00cf566b-9374-5def-8d2f-a72e86672548"
+		id = "d97dde53-3a80-55ff-9b12-b67fd1dfc9aa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gearshift"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gearshift_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "917aa162d8155114b467928aa78b546e741372aa2ec73d46169e5f3309d74a6b"
+		logic_hash = "v1_sha256_917aa162d8155114b467928aa78b546e741372aa2ec73d46169e5f3309d74a6b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166686,20 +166756,20 @@ rule MALPEDIA_Win_Gearshift_Auto : FILE
 		$sequence_9 = { 488bc8 ff15???????? 4885c0 7449 488d4df7 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Acbackdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4a823252-73f2-58f2-b3ba-b547632b74fc"
+		id = "7e5b331c-0e65-52e3-b933-23da6d1defd0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acbackdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.acbackdoor_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0d2e2199924ba6f861c1f4e0ce544d152ae66498c3d6f8abd97960e9524ddf95"
+		logic_hash = "v1_sha256_0d2e2199924ba6f861c1f4e0ce544d152ae66498c3d6f8abd97960e9524ddf95"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166725,20 +166795,20 @@ rule MALPEDIA_Win_Acbackdoor_Auto : FILE
 		$sequence_9 = { 8b442424 39d8 0f8784080000 8d7e04 29c3 39fb 0f8277080000 }
 
 	condition:
-		7 of them and filesize <1704960
+		7 of them and filesize < 1704960
 }
 rule MALPEDIA_Win_Plurox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00819bcc-51e2-53a8-9308-9b7887ed6069"
+		id = "e980593d-7264-5be3-8487-d96780f1a174"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plurox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.plurox_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "fa579257df25509063a4df447932e0b25e6ea4c45a2af23b4dfc95998427a19a"
+		logic_hash = "v1_sha256_fa579257df25509063a4df447932e0b25e6ea4c45a2af23b4dfc95998427a19a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166764,20 +166834,20 @@ rule MALPEDIA_Win_Plurox_Auto : FILE
 		$sequence_9 = { 0d04b8ca08 6af3 dac9 0000 00ee }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize < 475136
 }
 rule MALPEDIA_Win_Calmthorn_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bcd75189-0c11-5940-85d3-d76aaafb784a"
+		id = "23968e26-c75a-5807-9471-7b8905d79be4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.calmthorn"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.calmthorn_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "b3539324ecfb8790060aa38a018df9861445823951558eb7601785d0fde93a58"
+		logic_hash = "v1_sha256_b3539324ecfb8790060aa38a018df9861445823951558eb7601785d0fde93a58"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166803,20 +166873,20 @@ rule MALPEDIA_Win_Calmthorn_Auto : FILE
 		$sequence_9 = { ebbb 0fb68d73fdffff 83f901 7552 c785cce7ffff00000000 eb0f 8b95cce7ffff }
 
 	condition:
-		7 of them and filesize <2322432
+		7 of them and filesize < 2322432
 }
 rule MALPEDIA_Win_Telb_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2c2db826-44da-51b3-a002-12e7b8aba209"
+		id = "7d37ca4c-05c9-5844-b244-99cbf47c3074"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.telb"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.telb_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "0475afe77557694f44f95a279ca9003eacdaca59e84d15417e917ac04b83cab7"
+		logic_hash = "v1_sha256_0475afe77557694f44f95a279ca9003eacdaca59e84d15417e917ac04b83cab7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166842,20 +166912,20 @@ rule MALPEDIA_Win_Telb_Auto : FILE
 		$sequence_9 = { 6689442438 e8???????? 8d4c2430 e8???????? 8d4c2430 e8???????? }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Narilam_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "da9d4048-8edf-5bad-820f-4e60bf8a1167"
+		id = "e43cd3da-a59a-58d8-bdf9-ee8c9804449e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.narilam"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.narilam_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "9c97c97f1983ca4888bd0ceffb3db6cc9301c52fb6e7adafbcc7af03cf7073fe"
+		logic_hash = "v1_sha256_9c97c97f1983ca4888bd0ceffb3db6cc9301c52fb6e7adafbcc7af03cf7073fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166881,20 +166951,20 @@ rule MALPEDIA_Win_Narilam_Auto : FILE
 		$sequence_9 = { 8d8580feffff e8???????? ff854cfeffff 8d9580feffff 8d45fc e8???????? ff8d4cfeffff }
 
 	condition:
-		7 of them and filesize <3325952
+		7 of them and filesize < 3325952
 }
 rule MALPEDIA_Win_Windealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "87b31818-e67b-5c82-9927-08d581ce1fca"
+		id = "83dbfd34-eb5f-53b6-bc2c-5f42da41166f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.windealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.windealer_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "cda4114916f5f955b9ea27c4701626023386bb93ae37a566cf799b5d0e98aca8"
+		logic_hash = "v1_sha256_cda4114916f5f955b9ea27c4701626023386bb93ae37a566cf799b5d0e98aca8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166920,20 +166990,20 @@ rule MALPEDIA_Win_Windealer_Auto : FILE
 		$sequence_9 = { 8b4d08 668b91d2070000 8a89d0070000 52 }
 
 	condition:
-		7 of them and filesize <770048
+		7 of them and filesize < 770048
 }
 rule MALPEDIA_Win_Qakbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "420c4e6b-5192-5ecb-8603-21219ca27f7b"
+		id = "d10ce517-1bd3-59a0-9ea9-555d4f127332"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.qakbot_auto.yar#L1-L545"
 		license_url = "N/A"
-		logic_hash = "3dc61bc81008dc8bd15332e5573d386c22408e9f81e4f285b87a6fbf5a5bafcc"
+		logic_hash = "v1_sha256_3dc61bc81008dc8bd15332e5573d386c22408e9f81e4f285b87a6fbf5a5bafcc"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -167013,20 +167083,20 @@ rule MALPEDIA_Win_Qakbot_Auto : FILE
 		$sequence_63 = { 8b442418 8b4c2450 8a1401 8a74243b 80cefa }
 
 	condition:
-		7 of them and filesize <4883456
+		7 of them and filesize < 4883456
 }
 rule MALPEDIA_Win_Hopscotch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4ccf5f3f-fc4d-50c4-9d15-78cb98c3a462"
+		id = "9bd1188e-49ea-507b-972a-17ec5591bae7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hopscotch"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hopscotch_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "87c8060052c7a27df707d3c608dced07179361cdfbcc1ac24fe99b2c3ce14a55"
+		logic_hash = "v1_sha256_87c8060052c7a27df707d3c608dced07179361cdfbcc1ac24fe99b2c3ce14a55"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167052,20 +167122,20 @@ rule MALPEDIA_Win_Hopscotch_Auto : FILE
 		$sequence_9 = { 6a3f eb0b a1???????? 83c020 50 }
 
 	condition:
-		7 of them and filesize <1143808
+		7 of them and filesize < 1143808
 }
 rule MALPEDIA_Win_Devopt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb55bee8-7a67-5968-98f9-09a9025ff6ad"
+		id = "072691b1-8a25-5650-8fcc-ce76eb881e94"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.devopt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.devopt_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "9b91ff04212580b4783bd5bcbd1899160fd4dd5cabce6d4170850a448d54a587"
+		logic_hash = "v1_sha256_9b91ff04212580b4783bd5bcbd1899160fd4dd5cabce6d4170850a448d54a587"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167091,20 +167161,20 @@ rule MALPEDIA_Win_Devopt_Auto : FILE
 		$sequence_9 = { ff537c 8b45f0 85c0 7403 8b40fc 8945f4 8b45fc }
 
 	condition:
-		7 of them and filesize <4645888
+		7 of them and filesize < 4645888
 }
 rule MALPEDIA_Win_Boxcaon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a730ae2b-b623-5088-86a7-4d1a4eb89ea5"
+		id = "cd3879a3-9a1d-53a1-a7ca-45d56b0aa555"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boxcaon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.boxcaon_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "5b71da83cc61472fd3b6239fea0178674ab4b3cf9a9678dbeeda07cdd88e683a"
+		logic_hash = "v1_sha256_5b71da83cc61472fd3b6239fea0178674ab4b3cf9a9678dbeeda07cdd88e683a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167130,20 +167200,20 @@ rule MALPEDIA_Win_Boxcaon_Auto : FILE
 		$sequence_9 = { 33c0 c7461407000000 668906 8b4508 8b5810 57 }
 
 	condition:
-		7 of them and filesize <256000
+		7 of them and filesize < 256000
 }
 rule MALPEDIA_Win_Komprogo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c9a48c86-1d10-5914-97e5-45787475f04f"
+		id = "722a3bdf-492a-5721-a315-665d0c6a35be"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.komprogo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.komprogo_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "a0932a9f38d23a8c7cc40d2bb7fb17066e556ed1703c6642f0b68427cdf44c0d"
+		logic_hash = "v1_sha256_a0932a9f38d23a8c7cc40d2bb7fb17066e556ed1703c6642f0b68427cdf44c0d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167169,20 +167239,20 @@ rule MALPEDIA_Win_Komprogo_Auto : FILE
 		$sequence_9 = { 898e9c160100 89bec8c20000 8d8e02960300 898ee2c20000 898659c30000 8d8ee15c0300 898e86c30000 }
 
 	condition:
-		7 of them and filesize <1045504
+		7 of them and filesize < 1045504
 }
 rule MALPEDIA_Win_Himera_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "115dcecd-6236-578c-9832-50f71f100115"
+		id = "acfa54b6-1df8-523b-92c1-e0f7e9b24939"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.himera_loader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.himera_loader_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "4b810ce6519155c850bedb77ed28ec3affe4b473b14342db1fd6830f8663ee07"
+		logic_hash = "v1_sha256_4b810ce6519155c850bedb77ed28ec3affe4b473b14342db1fd6830f8663ee07"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167208,20 +167278,20 @@ rule MALPEDIA_Win_Himera_Loader_Auto : FILE
 		$sequence_9 = { 8b45fc 83c001 8945fc 837dfc12 7318 8b4d08 }
 
 	condition:
-		7 of them and filesize <385024
+		7 of them and filesize < 385024
 }
 rule MALPEDIA_Win_Bandit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "381568fe-b706-59c8-a395-3dcbe088e7b0"
+		id = "df99e6f5-725b-5334-9522-eee8dd37f5a8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bandit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bandit_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d56d1fb9d0bb1a835a79b856616244ad303b75dee12b9e7ce8956718588a906b"
+		logic_hash = "v1_sha256_d56d1fb9d0bb1a835a79b856616244ad303b75dee12b9e7ce8956718588a906b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167247,20 +167317,20 @@ rule MALPEDIA_Win_Bandit_Auto : FILE
 		$sequence_9 = { 7404 488b4008 e8???????? 90 e8???????? 8b44242c 488b6c2458 }
 
 	condition:
-		7 of them and filesize <29914112
+		7 of them and filesize < 29914112
 }
 rule MALPEDIA_Win_Pcshare_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "41819f37-8279-594b-8188-e1afa20f2f95"
+		id = "ca682f75-ad60-5305-a8f5-7f7bbeb6c3da"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pcshare"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pcshare_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "b635afb96c2581863fb56aba8aaab8da9fbce00f8a052e881f8a8f014820c9d4"
+		logic_hash = "v1_sha256_b635afb96c2581863fb56aba8aaab8da9fbce00f8a052e881f8a8f014820c9d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167286,20 +167356,20 @@ rule MALPEDIA_Win_Pcshare_Auto : FILE
 		$sequence_9 = { 8b4c2410 8d0431 50 e8???????? 8b4c2414 83c404 03c8 }
 
 	condition:
-		7 of them and filesize <893708
+		7 of them and filesize < 893708
 }
 rule MALPEDIA_Win_Fancyfilter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0361fd07-d305-5b73-bb16-8f25d1edd877"
+		id = "2a1c0ccd-c549-5273-8978-c0a04c1764ee"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fancyfilter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fancyfilter_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "476e24d851dbd343335f49ac83fe24b993db2eb5e282eab0e77caa734f27e50a"
+		logic_hash = "v1_sha256_476e24d851dbd343335f49ac83fe24b993db2eb5e282eab0e77caa734f27e50a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167325,20 +167395,20 @@ rule MALPEDIA_Win_Fancyfilter_Auto : FILE
 		$sequence_9 = { 85c0 750d 8b472c a801 7406 }
 
 	condition:
-		7 of them and filesize <169984
+		7 of them and filesize < 169984
 }
 rule MALPEDIA_Win_Chinoxy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "42e4e8ac-898e-5ba1-b0d0-68925d7ec424"
+		id = "09706ebd-a2df-5630-b2ca-b10996ce989d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinoxy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chinoxy_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "1545d921096fb73521705c66429b51a5fc0ae5b2cfe48972524e78dbe1d3ae8e"
+		logic_hash = "v1_sha256_1545d921096fb73521705c66429b51a5fc0ae5b2cfe48972524e78dbe1d3ae8e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167364,20 +167434,20 @@ rule MALPEDIA_Win_Chinoxy_Auto : FILE
 		$sequence_9 = { 6aff 6a00 6a00 6a00 6a00 6a00 6a00 }
 
 	condition:
-		7 of them and filesize <1138688
+		7 of them and filesize < 1138688
 }
 rule MALPEDIA_Win_Rover_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eae2ea54-1e52-5b6a-97b9-e0561a756b46"
+		id = "a12371ff-d6c0-5fa3-afaa-bbd7cf17f6f9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rover"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rover_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "57f684b21a109064243739f52fd53044ef32fd5681c182556fe356fe4b7b3140"
+		logic_hash = "v1_sha256_57f684b21a109064243739f52fd53044ef32fd5681c182556fe356fe4b7b3140"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167403,20 +167473,20 @@ rule MALPEDIA_Win_Rover_Auto : FILE
 		$sequence_9 = { 8be8 83c408 85ed 743d 45 6a3a 55 }
 
 	condition:
-		7 of them and filesize <704512
+		7 of them and filesize < 704512
 }
 rule MALPEDIA_Win_Jolob_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef72678c-e4af-5ecd-a17f-38938f34b802"
+		id = "52e33119-b581-5265-b353-b4ce13f3d1d9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jolob"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jolob_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "6d14d1852edd7575113d6514e73e7231e52f26da3a40217ee521425b76e2e32f"
+		logic_hash = "v1_sha256_6d14d1852edd7575113d6514e73e7231e52f26da3a40217ee521425b76e2e32f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167442,20 +167512,20 @@ rule MALPEDIA_Win_Jolob_Auto : FILE
 		$sequence_9 = { 8a5415e4 885405f4 40 46 3bc3 7ceb ff4d08 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize < 196608
 }
 rule MALPEDIA_Win_Winnti_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8877d2db-c061-5f0c-9030-9148176d6e19"
+		id = "46f964f4-8d6d-5b66-bc45-ce61b9ac12bc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.winnti_auto.yar#L1-L239"
 		license_url = "N/A"
-		logic_hash = "17da510395f95f1363bc518ade4bb0caf94e359f90bb002c059a140da569d4ec"
+		logic_hash = "v1_sha256_17da510395f95f1363bc518ade4bb0caf94e359f90bb002c059a140da569d4ec"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -167495,20 +167565,20 @@ rule MALPEDIA_Win_Winnti_Auto : FILE
 		$sequence_23 = { 488bb5c8030000 448bc0 4585c0 0f84ca000000 }
 
 	condition:
-		7 of them and filesize <1581056
+		7 of them and filesize < 1581056
 }
 rule MALPEDIA_Win_Isfb_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ad10a285-c85e-5394-87a5-a8221885f0c5"
+		id = "0eb9d329-d93e-5e5a-8803-881827f2e40c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.isfb_auto.yar#L1-L1627"
 		license_url = "N/A"
-		logic_hash = "98d556ee27067e40eff884830538b87541d671166c2ebdd8799d4e04e5a64591"
+		logic_hash = "v1_sha256_98d556ee27067e40eff884830538b87541d671166c2ebdd8799d4e04e5a64591"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -167715,20 +167785,20 @@ rule MALPEDIA_Win_Isfb_Auto : FILE
 		$sequence_190 = { 83e603 750c 8b5d10 6601da }
 
 	condition:
-		7 of them and filesize <2940928
+		7 of them and filesize < 2940928
 }
 rule MALPEDIA_Win_Blackbasta_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "056c2725-7fc6-5492-9e95-8858f5743ba4"
+		id = "61e5703f-793d-5ce1-8be1-58f35beb83a6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blackbasta_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "5917351a58e2c45d71cb940556c45aaf794c00ea6a4cfbb1a7458b7fa470cb76"
+		logic_hash = "v1_sha256_5917351a58e2c45d71cb940556c45aaf794c00ea6a4cfbb1a7458b7fa470cb76"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167754,20 +167824,20 @@ rule MALPEDIA_Win_Blackbasta_Auto : FILE
 		$sequence_9 = { 8975f0 c706???????? c74604???????? c74608???????? c7462060ed0910 c745fcffffffff e8???????? }
 
 	condition:
-		7 of them and filesize <1758208
+		7 of them and filesize < 1758208
 }
 rule MALPEDIA_Win_Newposthings_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "38b154f6-846a-5678-b350-8d87b17b6222"
+		id = "10e3aec2-e9f1-5710-a67c-82b6d6361ae2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newposthings"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.newposthings_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "fee15bf490538f6a36053584f37721547efa8e7cc1e683e754b3484ec8de6c80"
+		logic_hash = "v1_sha256_fee15bf490538f6a36053584f37721547efa8e7cc1e683e754b3484ec8de6c80"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167793,20 +167863,20 @@ rule MALPEDIA_Win_Newposthings_Auto : FILE
 		$sequence_9 = { c78500ffffff0f000000 c785fcfeffff00000000 c685ecfeffff00 c645fc0e 837d9810 }
 
 	condition:
-		7 of them and filesize <827392
+		7 of them and filesize < 827392
 }
 rule MALPEDIA_Win_Doubleback_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c1c6eec3-17ca-5077-8f4d-8926ef885c3f"
+		id = "e311fbbf-4341-5d1e-b691-70568a06c372"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doubleback"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.doubleback_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "a12a729d1e3eac6cc5269daa7ad2d63c829a0d3d51d586ba012dff78e07be60d"
+		logic_hash = "v1_sha256_a12a729d1e3eac6cc5269daa7ad2d63c829a0d3d51d586ba012dff78e07be60d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167832,20 +167902,20 @@ rule MALPEDIA_Win_Doubleback_Auto : FILE
 		$sequence_9 = { 741c 3dd73a0000 740e 3dab3f0000 755e }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Xagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3dbdacb7-861e-58ce-911f-f56ad1729d00"
+		id = "cb2434b7-aa0d-56ce-a0d0-6ffb8894def9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xagent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xagent_auto.yar#L1-L239"
 		license_url = "N/A"
-		logic_hash = "9db965af9a413dbcee60d3c1d7c4b3b1216a3333272ef760fe1fa17d4a9ca01b"
+		logic_hash = "v1_sha256_9db965af9a413dbcee60d3c1d7c4b3b1216a3333272ef760fe1fa17d4a9ca01b"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -167887,20 +167957,20 @@ rule MALPEDIA_Win_Xagent_Auto : FILE
 		$sequence_25 = { 75f8 482bc8 448bc1 488bd0 }
 
 	condition:
-		7 of them and filesize <729088
+		7 of them and filesize < 729088
 }
 rule MALPEDIA_Win_Scarabey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6e60c4db-c5cb-54f4-b442-438a01df9af6"
+		id = "23662b08-f642-5ed0-b2d7-35f04fc2f943"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scarabey"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.scarabey_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "5ddb90a30fda6ca95ac7c6c807a159ecb2fde4cde650e7522ca27b96c3f88797"
+		logic_hash = "v1_sha256_5ddb90a30fda6ca95ac7c6c807a159ecb2fde4cde650e7522ca27b96c3f88797"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167926,20 +167996,20 @@ rule MALPEDIA_Win_Scarabey_Auto : FILE
 		$sequence_9 = { e8???????? 834dfcff 8d4dd4 c745d480185300 e8???????? e8???????? c3 }
 
 	condition:
-		7 of them and filesize <3580928
+		7 of them and filesize < 3580928
 }
 rule MALPEDIA_Win_Webc2_Qbp_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fee8b4c8-beb4-5f15-8081-5f10952e51d6"
+		id = "5ae0a964-e21f-5192-82b3-67e7f32bfff3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_qbp"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_qbp_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "257413d68538251f3adda377abdcb2ea5b8000f62907fcc22ea1c060ea83ae47"
+		logic_hash = "v1_sha256_257413d68538251f3adda377abdcb2ea5b8000f62907fcc22ea1c060ea83ae47"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167965,20 +168035,20 @@ rule MALPEDIA_Win_Webc2_Qbp_Auto : FILE
 		$sequence_9 = { 8b95e8fdffff 52 e8???????? 83c404 8985f0feffff c745fc00000000 c685f8feffff00 }
 
 	condition:
-		7 of them and filesize <630784
+		7 of them and filesize < 630784
 }
 rule MALPEDIA_Win_Open_Carrot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f072a642-4447-5973-9ead-dc9232cd5b85"
+		id = "9c45c20d-1b18-5ef9-b8aa-c998629b2460"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.open_carrot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.open_carrot_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "28ad822413b17834bf69734ab09ffa4d02ddba5c7af7590650f7bb3e1133ed6c"
+		logic_hash = "v1_sha256_28ad822413b17834bf69734ab09ffa4d02ddba5c7af7590650f7bb3e1133ed6c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168004,20 +168074,20 @@ rule MALPEDIA_Win_Open_Carrot_Auto : FILE
 		$sequence_9 = { e8???????? 85c0 0f8551010000 488d4db3 e8???????? 85c0 0f852b010000 }
 
 	condition:
-		7 of them and filesize <8377344
+		7 of them and filesize < 8377344
 }
 rule MALPEDIA_Win_Skyplex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7314bd82-1aa5-5733-8a6b-d66b1f4ce931"
+		id = "ded9cfb6-bbdf-5451-88eb-77a737c4d58e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skyplex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.skyplex_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "192b51867743844243ec787078ffba7934aed43d773432d484ad42af9f8ba5ed"
+		logic_hash = "v1_sha256_192b51867743844243ec787078ffba7934aed43d773432d484ad42af9f8ba5ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168043,20 +168113,20 @@ rule MALPEDIA_Win_Skyplex_Auto : FILE
 		$sequence_9 = { 6a01 ff15???????? c78544f6ffff01000000 eb0f 8b8d44f6ffff 83c101 898d44f6ffff }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Flusihoc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8d409317-c933-58d0-aa63-14cb54e47b7c"
+		id = "dd366d70-baad-5b2e-bbd4-d782fa0b2950"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flusihoc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.flusihoc_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "410a07cce1b358109f5858d6a241fb0d56be6d17f2ab80d7283dacba4edb86ad"
+		logic_hash = "v1_sha256_410a07cce1b358109f5858d6a241fb0d56be6d17f2ab80d7283dacba4edb86ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168088,20 +168158,20 @@ rule MALPEDIA_Win_Flusihoc_Auto : FILE
 		$sequence_15 = { 85c0 752f 8b8df4feffff 6804010000 8d85f8feffff 50 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize < 319488
 }
 rule MALPEDIA_Win_Alice_Atm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "501a026b-dba7-501a-810b-0b737ec59325"
+		id = "467c1160-3a44-5ad5-9362-638646b0dbe3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alice_atm"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.alice_atm_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "d552c74f415e09d46d22c314024829e6b9aa2356b6f2a8ec27602ddc27a1083f"
+		logic_hash = "v1_sha256_d552c74f415e09d46d22c314024829e6b9aa2356b6f2a8ec27602ddc27a1083f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168127,20 +168197,20 @@ rule MALPEDIA_Win_Alice_Atm_Auto : FILE
 		$sequence_9 = { 817e0c20202000 0f8480000000 ff36 68???????? 8d45f8 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Infy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1542bed5-33fb-5d90-921f-7b98aeb36304"
+		id = "50b05a22-9b35-53df-840d-824719b55bdf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.infy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.infy_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "351bd4b7525a7ff94f0f3657e8ee347d6c2c31664e11c42093ff09157f2eb43d"
+		logic_hash = "v1_sha256_351bd4b7525a7ff94f0f3657e8ee347d6c2c31664e11c42093ff09157f2eb43d"
 		score = 60
 		quality = 45
 		tags = "FILE"
@@ -168166,20 +168236,20 @@ rule MALPEDIA_Win_Infy_Auto : FILE
 		$sequence_9 = { 6a00 66837ef602 7418 89cf 89f0 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Buer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a04d6e0-cd7f-5093-9f8c-3d9d8b9d18a4"
+		id = "d613d705-640e-522d-9e3a-d9bc4946a6ef"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.buer_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "deb76d78e5600ee9ef4e7b63e09f28c10c8fc78def9e4354c583490d6447dafb"
+		logic_hash = "v1_sha256_deb76d78e5600ee9ef4e7b63e09f28c10c8fc78def9e4354c583490d6447dafb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168211,20 +168281,20 @@ rule MALPEDIA_Win_Buer_Auto : FILE
 		$sequence_15 = { 0f84d7010000 8b442418 8b5c2404 8b54242c 894c2408 01c8 }
 
 	condition:
-		7 of them and filesize <3031040
+		7 of them and filesize < 3031040
 }
 rule MALPEDIA_Win_Mespinoza_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "33c5af28-80c3-5a94-a560-73cae0098842"
+		id = "34041723-3274-5c60-8034-266c2a0e8abb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mespinoza"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mespinoza_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "f5999e99c1ade61277d31280c07cf2a046437f8e201d1bf42efd1294376814d0"
+		logic_hash = "v1_sha256_f5999e99c1ade61277d31280c07cf2a046437f8e201d1bf42efd1294376814d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168250,20 +168320,20 @@ rule MALPEDIA_Win_Mespinoza_Auto : FILE
 		$sequence_9 = { 8bcf c645fc01 e8???????? 8b03 }
 
 	condition:
-		7 of them and filesize <1091584
+		7 of them and filesize < 1091584
 }
 rule MALPEDIA_Win_Pickpocket_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7a83df77-97f7-5782-8335-b4e0f4f4d0cb"
+		id = "22c29901-2649-556d-816c-0aa496bce93f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pickpocket"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pickpocket_auto.yar#L1-L110"
 		license_url = "N/A"
-		logic_hash = "b44df7bc5acbc6d7badbaaac3695700d24536089857d9464cd11f3048d47faf5"
+		logic_hash = "v1_sha256_b44df7bc5acbc6d7badbaaac3695700d24536089857d9464cd11f3048d47faf5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168289,20 +168359,20 @@ rule MALPEDIA_Win_Pickpocket_Auto : FILE
 		$sequence_9 = { 3bc7 760a b988d30000 e9???????? }
 
 	condition:
-		7 of them and filesize <1458176
+		7 of them and filesize < 1458176
 }
 rule MALPEDIA_Win_Troldesh_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dfc58f44-005d-550d-86a0-6e27d1dbdd91"
+		id = "428ff88e-7696-5f5b-b7fd-eb3da31b1807"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.troldesh"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.troldesh_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "6931e846879cddb9876cefe6a37d24256d508a47e814ed459478812a95ed70dc"
+		logic_hash = "v1_sha256_6931e846879cddb9876cefe6a37d24256d508a47e814ed459478812a95ed70dc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168328,20 +168398,20 @@ rule MALPEDIA_Win_Troldesh_Auto : FILE
 		$sequence_9 = { e8???????? 85ed 751e 68???????? 56 686d030000 e8???????? }
 
 	condition:
-		7 of them and filesize <3915776
+		7 of them and filesize < 3915776
 }
 rule MALPEDIA_Win_Funny_Dream_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5f51b37f-d046-5620-bc19-e2253f913b87"
+		id = "d9cd674b-0c35-5437-aa4e-0f64a963aabd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.funny_dream"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.funny_dream_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "cb215be87db33b154ffd783569bce8db609ba8b5cdc9d518db32c5fd6b7cb19c"
+		logic_hash = "v1_sha256_cb215be87db33b154ffd783569bce8db609ba8b5cdc9d518db32c5fd6b7cb19c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168367,20 +168437,20 @@ rule MALPEDIA_Win_Funny_Dream_Auto : FILE
 		$sequence_9 = { 8b85c4fdffff 89441f05 8b85b8fdffff 89441f09 8b85bcfdffff 89441f0d 83c711 }
 
 	condition:
-		7 of them and filesize <393216
+		7 of them and filesize < 393216
 }
 rule MALPEDIA_Win_Sality_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3651e4ed-4a90-502c-84b3-3270a294a585"
+		id = "bf6dfbe9-7780-51e7-857e-ddaf15f78ea3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sality"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sality_auto.yar#L1-L222"
 		license_url = "N/A"
-		logic_hash = "9a7f5bbeaaf4328c45f3811719f9d62671822ec18ed1403a4d8c0d44848d8fbb"
+		logic_hash = "v1_sha256_9a7f5bbeaaf4328c45f3811719f9d62671822ec18ed1403a4d8c0d44848d8fbb"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -168420,20 +168490,20 @@ rule MALPEDIA_Win_Sality_Auto : FILE
 		$sequence_23 = { 58 ff30 e8???????? 68???????? e8???????? 0fb745d1 }
 
 	condition:
-		7 of them and filesize <1523712
+		7 of them and filesize < 1523712
 }
 rule MALPEDIA_Win_Cactus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7aadb4fa-1562-5d38-a064-9b891a040980"
+		id = "7a2a740a-ebc7-57cc-90b5-e2901ff4ea76"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cactus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cactus_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "4cf0fe68934e99fc9c68b61a4ebb1a3c34839913d17fce2a657defa1e18dd776"
+		logic_hash = "v1_sha256_4cf0fe68934e99fc9c68b61a4ebb1a3c34839913d17fce2a657defa1e18dd776"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168459,20 +168529,20 @@ rule MALPEDIA_Win_Cactus_Auto : FILE
 		$sequence_9 = { e8???????? 4889c3 4885c0 0f84ba000000 b801000000 874310 e8???????? }
 
 	condition:
-		7 of them and filesize <13587456
+		7 of them and filesize < 13587456
 }
 rule MALPEDIA_Win_Colibri_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8da162c4-201b-5524-b753-fac10e260355"
+		id = "f9905635-8b8a-5518-93a7-cbb2c850de60"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.colibri_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "4b78974320f8236aa3537bed6c446de746d50c1762246c89daad71b2e8c53347"
+		logic_hash = "v1_sha256_4b78974320f8236aa3537bed6c446de746d50c1762246c89daad71b2e8c53347"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168498,20 +168568,20 @@ rule MALPEDIA_Win_Colibri_Auto : FILE
 		$sequence_9 = { 6a02 59 e8???????? ba724e4352 8bc8 e8???????? ffd0 }
 
 	condition:
-		7 of them and filesize <51200
+		7 of them and filesize < 51200
 }
 rule MALPEDIA_Win_Cabart_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18a4d4f1-27f1-5b62-ac02-f2e216d2cf4e"
+		id = "5c827306-1c7b-5b2e-9cc4-98820e0598a7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cabart"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cabart_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "4c41cdb81a5db228073171586c9e5e6d6ecfd715a748c36291a1859ea7ac8fe5"
+		logic_hash = "v1_sha256_4c41cdb81a5db228073171586c9e5e6d6ecfd715a748c36291a1859ea7ac8fe5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -168537,20 +168607,20 @@ rule MALPEDIA_Win_Cabart_Auto : FILE
 		$sequence_9 = { 68bb0b0000 ebe2 85ff 7507 68bc0b0000 ebd7 }
 
 	condition:
-		7 of them and filesize <32768
+		7 of them and filesize < 32768
 }
 rule MALPEDIA_Win_Whitebird_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e4f95047-ddcd-5a63-a3ce-8b63fa9928fc"
+		id = "f192ecdb-ee59-5abe-be0c-4673d85ca279"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whitebird"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.whitebird_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "f6f1864635810fc12da43aba0178bc81fe845d55a2fe60f4512e4d032da48db4"
+		logic_hash = "v1_sha256_f6f1864635810fc12da43aba0178bc81fe845d55a2fe60f4512e4d032da48db4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168581,20 +168651,20 @@ rule MALPEDIA_Win_Whitebird_Auto : FILE
 		$sequence_14 = { 888c05e8fdffff 40 33f6 85c9 761e 8dbc05e8fdffff 81feff000000 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Tigerlite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2f8f693e-a8e1-5528-af21-1e49257d2d13"
+		id = "b1ba0bda-812e-56bf-8a09-8ac5f9e4b00c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tigerlite"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tigerlite_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "97a4326cdfea07521b42c0aaec8304cc4bf3187afbba14d3d8ecb63bd75d0ec6"
+		logic_hash = "v1_sha256_97a4326cdfea07521b42c0aaec8304cc4bf3187afbba14d3d8ecb63bd75d0ec6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168626,20 +168696,20 @@ rule MALPEDIA_Win_Tigerlite_Auto : FILE
 		$sequence_15 = { 4863c2 4863c9 488d14c8 420fbe940ab0730100 }
 
 	condition:
-		7 of them and filesize <349184
+		7 of them and filesize < 349184
 }
 rule MALPEDIA_Win_Icefog_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0a48d625-5699-565a-9775-5f80c9e1ec87"
+		id = "c1b339c2-f2f9-57f8-9079-1593d5aaf54c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icefog"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.icefog_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "487424ea94183e95a7a3963011eba4b3e92a928a4a25ab7f953a01dda9030416"
+		logic_hash = "v1_sha256_487424ea94183e95a7a3963011eba4b3e92a928a4a25ab7f953a01dda9030416"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168665,20 +168735,20 @@ rule MALPEDIA_Win_Icefog_Auto : FILE
 		$sequence_9 = { 50 68???????? 56 e8???????? 8bd8 83c420 85db }
 
 	condition:
-		7 of them and filesize <1187840
+		7 of them and filesize < 1187840
 }
 rule MALPEDIA_Win_Puzzlemaker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cb0c66df-41c4-52ac-ac22-d6d2f5a2308d"
+		id = "148b12d9-dc6e-5a79-a0cf-c1ece67f5aee"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.puzzlemaker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.puzzlemaker_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "59c32899b883bfb9bd7e74e09947139de6a13e19aa30e115675dc0025c3e011c"
+		logic_hash = "v1_sha256_59c32899b883bfb9bd7e74e09947139de6a13e19aa30e115675dc0025c3e011c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168704,20 +168774,20 @@ rule MALPEDIA_Win_Puzzlemaker_Auto : FILE
 		$sequence_9 = { 4181f804010000 72e1 448bc0 4c8d0d1f0e0200 }
 
 	condition:
-		7 of them and filesize <331776
+		7 of them and filesize < 331776
 }
 rule MALPEDIA_Win_Sysraw_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a136ac6f-472d-54c5-b881-5ee87f9b3845"
+		id = "876e800d-3ecb-5699-8850-d3902af22ac4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysraw_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sysraw_stealer_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "a39e6a22fe8b2e74d45c7a3cdbaed2c5766660fde9e3c6d0bcfa65b1acb00f24"
+		logic_hash = "v1_sha256_a39e6a22fe8b2e74d45c7a3cdbaed2c5766660fde9e3c6d0bcfa65b1acb00f24"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168743,20 +168813,20 @@ rule MALPEDIA_Win_Sysraw_Stealer_Auto : FILE
 		$sequence_9 = { ff15???????? 0faff7 0375cc 81e60f000080 }
 
 	condition:
-		7 of them and filesize <1540096
+		7 of them and filesize < 1540096
 }
 rule MALPEDIA_Win_Pteranodon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "80ff2986-5474-5ad7-b810-831fbf1d4342"
+		id = "a11e776c-fe1b-57bd-a6c1-7e14dc220850"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pteranodon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pteranodon_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "cb9eee2c2b40d73ca9d2882bf4c44ed595c9eb29005a317bb6423459f15ea4d1"
+		logic_hash = "v1_sha256_cb9eee2c2b40d73ca9d2882bf4c44ed595c9eb29005a317bb6423459f15ea4d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168788,20 +168858,20 @@ rule MALPEDIA_Win_Pteranodon_Auto : FILE
 		$sequence_15 = { f6c201 742b 8d55e8 2bd6 881c32 8d7601 }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize < 499712
 }
 rule MALPEDIA_Win_Grease_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "afd291db-bac5-5fe7-9f54-1a39c18ec08a"
+		id = "237135a9-feaa-5cdb-99c9-f66939d4ae1b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grease"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.grease_auto.yar#L1-L226"
 		license_url = "N/A"
-		logic_hash = "a7bbee8fe2b545d42dcf93b28bc05e2b116dcf88de40c793a23d0b5cc4cea918"
+		logic_hash = "v1_sha256_a7bbee8fe2b545d42dcf93b28bc05e2b116dcf88de40c793a23d0b5cc4cea918"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -168840,20 +168910,20 @@ rule MALPEDIA_Win_Grease_Auto : FILE
 		$sequence_22 = { ff15???????? 85c0 7529 8b4c2410 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Synflooder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a5f633b9-dcb2-5076-bf0d-bd81d1f23849"
+		id = "8b982366-cc99-5f3e-8483-164ac0693789"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.synflooder"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.synflooder_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "f7c8ec3c0f9f10642bd0b77ad1f3921e90b05a4859f114057bd9d1a11d0bddfc"
+		logic_hash = "v1_sha256_f7c8ec3c0f9f10642bd0b77ad1f3921e90b05a4859f114057bd9d1a11d0bddfc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168879,20 +168949,20 @@ rule MALPEDIA_Win_Synflooder_Auto : FILE
 		$sequence_9 = { 7432 8d7304 66837efc01 751d }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Goopic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "46e7b93a-a824-528f-bd94-0b2f369fa2ff"
+		id = "70cb8392-0246-5ec2-9e6a-013a0fa0816c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goopic"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.goopic_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "84ac631e9a300a568150cf088c579ef5611f1aa361740898f3a2d1d9e24582a8"
+		logic_hash = "v1_sha256_84ac631e9a300a568150cf088c579ef5611f1aa361740898f3a2d1d9e24582a8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168918,20 +168988,20 @@ rule MALPEDIA_Win_Goopic_Auto : FILE
 		$sequence_9 = { a3???????? 85c0 750a ff742424 ff15???????? }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Derusbi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c096fedf-ff02-5515-aa84-dda61fd1b242"
+		id = "9f1e81f1-6ba7-521f-ac51-2a88c1d69960"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.derusbi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.derusbi_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "caf9d1cd989612f714b35d25a26a8b4ab8e67beec50b5a767b0d4e5f975c75e0"
+		logic_hash = "v1_sha256_caf9d1cd989612f714b35d25a26a8b4ab8e67beec50b5a767b0d4e5f975c75e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168957,20 +169027,20 @@ rule MALPEDIA_Win_Derusbi_Auto : FILE
 		$sequence_9 = { 50 ff15???????? c70424???????? 33f6 56 6801001f00 ff15???????? }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Dma_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e2af925-42e5-5846-8ffd-3d54f6df360b"
+		id = "41b6b4c7-3a86-5d20-9df0-b1a9f226f254"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dma_locker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dma_locker_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "3ae5bccd6371af15118f93027d88904afa2d354f640add9013354700a19edfc8"
+		logic_hash = "v1_sha256_3ae5bccd6371af15118f93027d88904afa2d354f640add9013354700a19edfc8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168996,20 +169066,20 @@ rule MALPEDIA_Win_Dma_Locker_Auto : FILE
 		$sequence_9 = { 6a00 6a01 6a00 68???????? 8d5f14 53 893d???????? }
 
 	condition:
-		7 of them and filesize <532480
+		7 of them and filesize < 532480
 }
 rule MALPEDIA_Win_Dmsniff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3835a0ad-5401-5196-a04a-4e4d20ae32c6"
+		id = "94e0b16c-e7fb-5f5c-ac58-11ab008439ce"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dmsniff"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dmsniff_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "9e4ba2c64d589b228eae63b3a713959af97846eab54c3823ca80a7bfedbc8089"
+		logic_hash = "v1_sha256_9e4ba2c64d589b228eae63b3a713959af97846eab54c3823ca80a7bfedbc8089"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169035,20 +169105,20 @@ rule MALPEDIA_Win_Dmsniff_Auto : FILE
 		$sequence_9 = { 6a00 68???????? e8???????? 89c7 09ff }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Lethic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ecf699d4-037c-58b3-a572-a126b8291661"
+		id = "6363ec33-1771-5e5f-a4f8-4749c7e0e6ad"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lethic"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lethic_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "0a37e4703a880069257b89a7948a47634d1bc51105338bac97b952539891efa4"
+		logic_hash = "v1_sha256_0a37e4703a880069257b89a7948a47634d1bc51105338bac97b952539891efa4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169074,20 +169144,20 @@ rule MALPEDIA_Win_Lethic_Auto : FILE
 		$sequence_9 = { 837df800 7418 8b45f8 50 8b4dfc 51 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Moker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ec63b288-3da6-5af3-8f29-c765a5000a5d"
+		id = "8ea30900-fc4e-5340-a7a6-4ca2deb71250"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.moker_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "556dd24334d18ecb022efe59f4ae9c093932948c0fb590b7b2557d6f9fb4e7d8"
+		logic_hash = "v1_sha256_556dd24334d18ecb022efe59f4ae9c093932948c0fb590b7b2557d6f9fb4e7d8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169119,20 +169189,20 @@ rule MALPEDIA_Win_Moker_Auto : FILE
 		$sequence_15 = { 83ec0c 51 52 8b450c 85c0 7451 }
 
 	condition:
-		7 of them and filesize <1761280
+		7 of them and filesize < 1761280
 }
 rule MALPEDIA_Win_Dustman_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f9958a70-82e7-51bb-b66a-8dad70813bed"
+		id = "f0e024d3-027b-5cf6-b7c0-c39fe79b7bbc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dustman"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dustman_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "56d31c5fdf78a9c7870d8fbabe0b3ca7863397ea82e2f5ab171dff121b78c1f1"
+		logic_hash = "v1_sha256_56d31c5fdf78a9c7870d8fbabe0b3ca7863397ea82e2f5ab171dff121b78c1f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169158,20 +169228,20 @@ rule MALPEDIA_Win_Dustman_Auto : FILE
 		$sequence_9 = { 48894d78 488bca 492bca 4c8d9dd0010000 4903cb }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Royal_Dns_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5169d1d0-659d-5d51-8aba-541d3872a32b"
+		id = "8dcbd982-3f6d-5a65-a215-285637d0462f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_dns"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.royal_dns_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "4810e30179da8cf300ac6b9d2a5829b8b65ed7f8312156b3af4aea162299d11c"
+		logic_hash = "v1_sha256_4810e30179da8cf300ac6b9d2a5829b8b65ed7f8312156b3af4aea162299d11c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169197,20 +169267,20 @@ rule MALPEDIA_Win_Royal_Dns_Auto : FILE
 		$sequence_9 = { be50000000 56 51 8d95d9feffff 52 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Ransomexx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2fe059c2-8452-5b3e-8480-0e870f1f94ef"
+		id = "61c48670-9d35-5b2f-ae81-c025aee5494d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomexx"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ransomexx_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "f81d34b7c74a7d97ad1f03442803ea61bc2884bb95c0d382a5757d938c26aeda"
+		logic_hash = "v1_sha256_f81d34b7c74a7d97ad1f03442803ea61bc2884bb95c0d382a5757d938c26aeda"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169236,20 +169306,20 @@ rule MALPEDIA_Win_Ransomexx_Auto : FILE
 		$sequence_9 = { 8975dc 3338 8bda 897dec 8bfe c1ef10 81e7ff000000 }
 
 	condition:
-		7 of them and filesize <372736
+		7 of them and filesize < 372736
 }
 rule MALPEDIA_Win_Lambert_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "810c5e09-e6d0-5a3a-ba2c-2c930c946f07"
+		id = "88805d3b-6ee9-5159-b38d-10d9935a2180"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lambert"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lambert_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "a8d478aa8e5424a909999540bcd026478246ccf020747d754ccdbccaf24eff93"
+		logic_hash = "v1_sha256_a8d478aa8e5424a909999540bcd026478246ccf020747d754ccdbccaf24eff93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169281,20 +169351,20 @@ rule MALPEDIA_Win_Lambert_Auto : FILE
 		$sequence_15 = { 0fb70c50 894df0 eb02 ebb8 }
 
 	condition:
-		7 of them and filesize <1212416
+		7 of them and filesize < 1212416
 }
 rule MALPEDIA_Win_Turian_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "762c542d-5fa6-5b48-a3af-f444b4ed2d2f"
+		id = "660c300e-8624-5c6a-b08b-79682e96d701"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turian"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.turian_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "64a5758bdf29fcbe94dd0cd69166b022a26376fc8e3a37014e6d93a76d08b3ce"
+		logic_hash = "v1_sha256_64a5758bdf29fcbe94dd0cd69166b022a26376fc8e3a37014e6d93a76d08b3ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169320,20 +169390,20 @@ rule MALPEDIA_Win_Turian_Auto : FILE
 		$sequence_9 = { 52 49 baff000000 68???????? 2bd1 }
 
 	condition:
-		7 of them and filesize <645120
+		7 of them and filesize < 645120
 }
 rule MALPEDIA_Win_Kagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5f4150a2-2cfd-5b67-9d04-7b313480e620"
+		id = "3e402ead-f0d3-54f4-bc68-12a69944ee28"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kagent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kagent_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "c73f32fc029a7be975356173769505731b12b0db3312b7f6e0626dcf79b9cedc"
+		logic_hash = "v1_sha256_c73f32fc029a7be975356173769505731b12b0db3312b7f6e0626dcf79b9cedc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169359,20 +169429,20 @@ rule MALPEDIA_Win_Kagent_Auto : FILE
 		$sequence_9 = { 8b45f0 83e3fd 85c0 7409 50 e8???????? 83c404 }
 
 	condition:
-		7 of them and filesize <4972544
+		7 of them and filesize < 4972544
 }
 rule MALPEDIA_Win_Isr_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f92134ff-d8ee-58cb-8cb8-468d7205306f"
+		id = "8162f485-5b1f-5e6b-a399-669e96316c6f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isr_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.isr_stealer_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "75691989209029cb7a637cf5df87a857ef3ef18b6fe3194f56cba1ecab86658c"
+		logic_hash = "v1_sha256_75691989209029cb7a637cf5df87a857ef3ef18b6fe3194f56cba1ecab86658c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169398,20 +169468,20 @@ rule MALPEDIA_Win_Isr_Stealer_Auto : FILE
 		$sequence_9 = { e8???????? 07 fb b05e 2bc1 e8???????? 661e }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Rokrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a9d530d2-3818-5ce9-961b-9b84701cc153"
+		id = "26e3c155-b4f0-5d58-9a26-bb1725790827"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rokrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rokrat_auto.yar#L1-L156"
 		license_url = "N/A"
-		logic_hash = "34b666dd9c341c0b6a658755dae5641a6ccdd1f0414b3f92f59cfa0e0e0a459a"
+		logic_hash = "v1_sha256_34b666dd9c341c0b6a658755dae5641a6ccdd1f0414b3f92f59cfa0e0e0a459a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169443,20 +169513,20 @@ rule MALPEDIA_Win_Rokrat_Auto : FILE
 		$sequence_15 = { c1e004 8d0c10 51 e8???????? }
 
 	condition:
-		7 of them and filesize <2932736
+		7 of them and filesize < 2932736
 }
 rule MALPEDIA_Win_Huskloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b71c66f-6603-595c-99bb-89c942583260"
+		id = "2eee9dbf-867d-5c1d-8f0f-bfbdaefdb107"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.huskloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.huskloader_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "0b5c5ed5027920c73090f364afb1f0be41c97145cf9de72e357bac2712d50fca"
+		logic_hash = "v1_sha256_0b5c5ed5027920c73090f364afb1f0be41c97145cf9de72e357bac2712d50fca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169482,20 +169552,20 @@ rule MALPEDIA_Win_Huskloader_Auto : FILE
 		$sequence_9 = { 0fb704850c3b0110 8d048508320110 50 8d8590faffff 03c7 50 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_Pubload_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "741d7af0-0900-5fc5-83bc-80e761b9b4ce"
+		id = "c1905681-a35e-50ac-8b73-88bda980c49f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pubload"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pubload_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "5f25f978a9edba85952ac66b5108bbd65875055e22860f7df1e90762255be210"
+		logic_hash = "v1_sha256_5f25f978a9edba85952ac66b5108bbd65875055e22860f7df1e90762255be210"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169521,20 +169591,20 @@ rule MALPEDIA_Win_Pubload_Auto : FILE
 		$sequence_9 = { 6a00 6a00 6a00 ff15???????? c3 }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize < 524288
 }
 rule MALPEDIA_Win_Poldat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a4b71e9b-caa3-5e09-abcb-8fc111c1e88a"
+		id = "68452a99-5d3c-57c4-a43c-e57a6d4a43fe"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poldat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.poldat_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "eec21397be824c40480269ad179cee66cff4f29ddc631fb679aa6de7be434481"
+		logic_hash = "v1_sha256_eec21397be824c40480269ad179cee66cff4f29ddc631fb679aa6de7be434481"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169560,20 +169630,20 @@ rule MALPEDIA_Win_Poldat_Auto : FILE
 		$sequence_9 = { f7f9 8bfa ffd6 50 }
 
 	condition:
-		7 of them and filesize <247808
+		7 of them and filesize < 247808
 }
 rule MALPEDIA_Win_Sedreco_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "79578107-84f9-5f01-8bf1-070f071e75ff"
+		id = "ac073064-0253-5023-b2a2-3b9ebfc42266"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sedreco"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sedreco_auto.yar#L1-L450"
 		license_url = "N/A"
-		logic_hash = "79e378080daf9957ad7b702ae6910bfba39dd77a995aedb850c5514668bb56cb"
+		logic_hash = "v1_sha256_79e378080daf9957ad7b702ae6910bfba39dd77a995aedb850c5514668bb56cb"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -169640,20 +169710,20 @@ rule MALPEDIA_Win_Sedreco_Auto : FILE
 		$sequence_50 = { 8915???????? 83fbfd 8935???????? 763b ff15???????? }
 
 	condition:
-		7 of them and filesize <1586176
+		7 of them and filesize < 1586176
 }
 rule MALPEDIA_Win_Virut_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c8349287-bd2e-52b4-9752-e7bc4edd95a7"
+		id = "b59ddaba-446a-55ac-92fd-2b9d358fb8e3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virut"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.virut_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "a48ac1b971086542095b7fb3caa9f795a6530b3c7c59d9de9bb3d487eade9d56"
+		logic_hash = "v1_sha256_a48ac1b971086542095b7fb3caa9f795a6530b3c7c59d9de9bb3d487eade9d56"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169685,20 +169755,20 @@ rule MALPEDIA_Win_Virut_Auto : FILE
 		$sequence_15 = { 803f4d 0f85f9000000 807f015a 0f85ef000000 885c2420 885c2421 885c2422 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Udpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "98223189-2bfc-52a6-a611-fcd1eca88452"
+		id = "e9fda8da-8915-5144-aabf-c2886fa6263f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.udpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.udpos_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "7c58f61902609cad456fdc9a279fa1453c4c938ca02ac1221afcfb1b15fb3e59"
+		logic_hash = "v1_sha256_7c58f61902609cad456fdc9a279fa1453c4c938ca02ac1221afcfb1b15fb3e59"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169724,20 +169794,20 @@ rule MALPEDIA_Win_Udpos_Auto : FILE
 		$sequence_9 = { 83e60f 0fb65c35e8 0fb671fd 8858fd }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Greenshaitan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8f14a34e-de7f-5ea7-9fdc-322bcde7a341"
+		id = "930d2c8a-21bb-54cb-9086-895423af80cf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.greenshaitan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.greenshaitan_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "3cbeaa8f8745b6f3b0557ef1727b77581513ec936eac8ffdebb5493281224370"
+		logic_hash = "v1_sha256_3cbeaa8f8745b6f3b0557ef1727b77581513ec936eac8ffdebb5493281224370"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169763,20 +169833,20 @@ rule MALPEDIA_Win_Greenshaitan_Auto : FILE
 		$sequence_9 = { 0f84d1000000 57 8bcb 8d542418 e8???????? }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Chaperone_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a1a2e24-f819-52e0-8b1d-cbec80d9780c"
+		id = "371e6d0d-9d12-5ae6-8ead-7f9b9ce66cfe"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chaperone"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chaperone_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "fb6f1141a2ad1ef091e8554a5e8c7b2e545fcb51cdc5087174343f9767f17bba"
+		logic_hash = "v1_sha256_fb6f1141a2ad1ef091e8554a5e8c7b2e545fcb51cdc5087174343f9767f17bba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169802,20 +169872,20 @@ rule MALPEDIA_Win_Chaperone_Auto : FILE
 		$sequence_9 = { c3 48895c2408 57 4883ec20 488d1da3940100 bf0a000000 }
 
 	condition:
-		7 of them and filesize <373760
+		7 of them and filesize < 373760
 }
 rule MALPEDIA_Win_Shylock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "357a8098-efc5-5a49-a18b-d4d668276421"
+		id = "068ffbb4-037b-5d93-a53d-1212f5c8042e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shylock"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shylock_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "34460d345c77d949d300b4c007098ec528b095570601731f99128cb864a10989"
+		logic_hash = "v1_sha256_34460d345c77d949d300b4c007098ec528b095570601731f99128cb864a10989"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169841,20 +169911,20 @@ rule MALPEDIA_Win_Shylock_Auto : FILE
 		$sequence_9 = { 750a 6a01 8b7d88 e8???????? 0fb645e4 83f801 750a }
 
 	condition:
-		7 of them and filesize <630784
+		7 of them and filesize < 630784
 }
 rule MALPEDIA_Win_Petrwrap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5211c1ab-7958-5b82-8edd-8be8e9b0a5eb"
+		id = "dd67243f-6a90-5ec4-af86-4b4d3298732f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.petrwrap"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.petrwrap_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "e84b96f3a3ec1cc8c24cef6cd623aa7e9ff5aec503f26b4080d6b5046ccfe346"
+		logic_hash = "v1_sha256_e84b96f3a3ec1cc8c24cef6cd623aa7e9ff5aec503f26b4080d6b5046ccfe346"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169880,20 +169950,20 @@ rule MALPEDIA_Win_Petrwrap_Auto : FILE
 		$sequence_9 = { 687f010000 68???????? 8d0480 03c0 6a12 6a09 89442458 }
 
 	condition:
-		7 of them and filesize <1024000
+		7 of them and filesize < 1024000
 }
 rule MALPEDIA_Win_Comlook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2593fda3-f25f-5e4e-aea3-f7267ae6a193"
+		id = "bed4a800-0e11-5400-9009-7f1e21c533e1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.comlook"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.comlook_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f2d9544219cd4dfd907ec20f4f40e3ff7dc0abab6b393777aed6489d1acbc463"
+		logic_hash = "v1_sha256_f2d9544219cd4dfd907ec20f4f40e3ff7dc0abab6b393777aed6489d1acbc463"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169919,20 +169989,20 @@ rule MALPEDIA_Win_Comlook_Auto : FILE
 		$sequence_9 = { eb0c 8b4d0c 8b510c 899558ffffff 8b4510 8b8d58ffffff 894808 }
 
 	condition:
-		7 of them and filesize <4553728
+		7 of them and filesize < 4553728
 }
 rule MALPEDIA_Win_Dramnudge_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16a885b0-9bee-5a69-bfc1-f44df8ee4d9a"
+		id = "7e3b4375-35ad-5da9-bc82-16632bfb2451"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dramnudge"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dramnudge_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "1c6ef479d0cf6562ae3d91df027da2da66ff27de574cb4249d01e23b1b7fe9ee"
+		logic_hash = "v1_sha256_1c6ef479d0cf6562ae3d91df027da2da66ff27de574cb4249d01e23b1b7fe9ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169958,20 +170028,20 @@ rule MALPEDIA_Win_Dramnudge_Auto : FILE
 		$sequence_9 = { 7409 57 ff5334 59 8bf0 eb09 }
 
 	condition:
-		7 of them and filesize <1294336
+		7 of them and filesize < 1294336
 }
 rule MALPEDIA_Win_Darkvnc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1f59578f-2ca5-52a8-837e-fa2b82f60870"
+		id = "b768fff5-6b50-5b6c-bad7-de65a0398c78"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkvnc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkvnc_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "059ffb48bc28e567c2e6dc5e6789fbdcb5b40c4bf8dddefcf2a4e68738b127e3"
+		logic_hash = "v1_sha256_059ffb48bc28e567c2e6dc5e6789fbdcb5b40c4bf8dddefcf2a4e68738b127e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169997,20 +170067,20 @@ rule MALPEDIA_Win_Darkvnc_Auto : FILE
 		$sequence_9 = { 4883c020 4889442430 488b442430 83780400 0f849f000000 488b542440 488b442430 }
 
 	condition:
-		7 of them and filesize <606208
+		7 of them and filesize < 606208
 }
 rule MALPEDIA_Win_Downdelph_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "077f28c1-b20c-5259-b0d0-bf4a01a0c8a9"
+		id = "e77eea6d-e6fd-56b7-8064-85bc79158c44"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.downdelph"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.downdelph_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "2ab9cad8274dc5f2dae30f8b9a16e2eba342d8e6c2d2e4a6e6e80698c2dff674"
+		logic_hash = "v1_sha256_2ab9cad8274dc5f2dae30f8b9a16e2eba342d8e6c2d2e4a6e6e80698c2dff674"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170036,20 +170106,20 @@ rule MALPEDIA_Win_Downdelph_Auto : FILE
 		$sequence_9 = { ba???????? e8???????? 0f8408030000 8d55e0 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize < 172032
 }
 rule MALPEDIA_Win_Polpo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3ada2ef2-9c7f-50f6-a216-72665dfc2af3"
+		id = "819d7d2d-b769-5429-91b0-9d4a450f9a92"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polpo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.polpo_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "72d335a1b2528c04f03bf454be2a2837ab466ed1973103cf7af4c8dafa43e467"
+		logic_hash = "v1_sha256_72d335a1b2528c04f03bf454be2a2837ab466ed1973103cf7af4c8dafa43e467"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170075,20 +170145,20 @@ rule MALPEDIA_Win_Polpo_Auto : FILE
 		$sequence_9 = { 50 8d4ddc 51 8d954cffffff 52 8bce }
 
 	condition:
-		7 of them and filesize <250880
+		7 of them and filesize < 250880
 }
 rule MALPEDIA_Win_Poohmilk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9a12885d-67d3-50cd-a04d-3dc337c01cc8"
+		id = "e52e0556-71e4-55c5-bb51-db96473c63fd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poohmilk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.poohmilk_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "f0431f01a34a1352435470a98d80c3656cef1cd2a7cc3eb4ac4c25c7f03235a9"
+		logic_hash = "v1_sha256_f0431f01a34a1352435470a98d80c3656cef1cd2a7cc3eb4ac4c25c7f03235a9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170114,20 +170184,20 @@ rule MALPEDIA_Win_Poohmilk_Auto : FILE
 		$sequence_9 = { ffd3 6a00 8d85ecfdffff 50 }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize < 245760
 }
 rule MALPEDIA_Win_Interception_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f1a298d5-70e2-5f27-b6ee-691574cd9abf"
+		id = "b4c73f6e-3836-5658-a688-b82628c21909"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.interception"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.interception_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "3520af3329a4b24d818d777e1e8f70b92d9cafa69a1f58bf6db64da9ed00530f"
+		logic_hash = "v1_sha256_3520af3329a4b24d818d777e1e8f70b92d9cafa69a1f58bf6db64da9ed00530f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170153,20 +170223,20 @@ rule MALPEDIA_Win_Interception_Auto : FILE
 		$sequence_9 = { 731c 8bc8 83e01f c1f905 8b0c8d20ae0010 f644c10401 8d04c1 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Pony_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "24263a04-20d7-5949-957f-cf3a5af796d6"
+		id = "1d3d5bbd-b407-5f4b-aaeb-839a6c2973a4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pony"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pony_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "f326d7c326c50f16cd34726bcea70a2ea74ad41815b2b6e851f1de5995c35b2f"
+		logic_hash = "v1_sha256_f326d7c326c50f16cd34726bcea70a2ea74ad41815b2b6e851f1de5995c35b2f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170192,20 +170262,20 @@ rule MALPEDIA_Win_Pony_Auto : FILE
 		$sequence_9 = { c9 c20400 55 8bec 83c4f4 57 8b4514 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Shadowpad_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c39d05c-4c59-5f9b-9da5-72e531a1a600"
+		id = "be04a7c6-7609-5139-9b6b-5f0b639fc7e0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowpad"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shadowpad_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "a48ed110f457b6e73e53b15a8712b4e6c99fbab0e15de593c3c355b2a563bc5f"
+		logic_hash = "v1_sha256_a48ed110f457b6e73e53b15a8712b4e6c99fbab0e15de593c3c355b2a563bc5f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170231,20 +170301,20 @@ rule MALPEDIA_Win_Shadowpad_Auto : FILE
 		$sequence_9 = { 0fb639 c1ce08 83cf20 03f7 83c102 81f6a3d9357c 663919 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Unidentified_045_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "76acbb90-4df7-541d-89b1-1533f977dd70"
+		id = "45811f05-6406-5224-8309-47be3f3f8f1d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_045"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_045_auto.yar#L1-L101"
 		license_url = "N/A"
-		logic_hash = "85ab00021027191936abb42742c680d628a952bd176522618ad1f59b85811c84"
+		logic_hash = "v1_sha256_85ab00021027191936abb42742c680d628a952bd176522618ad1f59b85811c84"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170268,20 +170338,20 @@ rule MALPEDIA_Win_Unidentified_045_Auto : FILE
 		$sequence_7 = { c70083c404e9 8b45fc c740046f92feff 8b45d8 8b400c }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Strongpity_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9dea39af-3982-5a58-a948-3e1c67dd03f0"
+		id = "fc83431b-4fee-5458-aa1a-8ac645c98082"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strongpity"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.strongpity_auto.yar#L1-L178"
 		license_url = "N/A"
-		logic_hash = "8a0d5e9b999ff0f85c5dc06bfd5cfa7c4f64f5270847839a9eee14c1a7cc3626"
+		logic_hash = "v1_sha256_8a0d5e9b999ff0f85c5dc06bfd5cfa7c4f64f5270847839a9eee14c1a7cc3626"
 		score = 60
 		quality = 45
 		tags = "FILE"
@@ -170313,20 +170383,20 @@ rule MALPEDIA_Win_Strongpity_Auto : FILE
 		$sequence_15 = { 5e 5d 8bc3 5b 83c410 c3 8b464c }
 
 	condition:
-		7 of them and filesize <999424
+		7 of them and filesize < 999424
 }
 rule MALPEDIA_Win_Oderoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8af6addc-ebdd-5e5f-9273-b365bc983ffd"
+		id = "ce4dc58f-c086-5654-8a98-df91ea0de439"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oderoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.oderoor_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "705d5b4a266b0c2f312f72fd5cb1e86ab39ec049fd53173701ccf137ec51b933"
+		logic_hash = "v1_sha256_705d5b4a266b0c2f312f72fd5cb1e86ab39ec049fd53173701ccf137ec51b933"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170352,20 +170422,20 @@ rule MALPEDIA_Win_Oderoor_Auto : FILE
 		$sequence_9 = { f1 6c aa 620b e3ed e28f 1a00 }
 
 	condition:
-		7 of them and filesize <13688832
+		7 of them and filesize < 13688832
 }
 rule MALPEDIA_Win_Pwndlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "276b9929-07b6-5961-91ba-ea8cd06bb086"
+		id = "7bb55e64-eaa5-52ae-8632-4f126eabed46"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pwndlocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pwndlocker_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "32e46025ac999bee5e5546895b079eecc269f28102bbbcf16da2fe4d978f576c"
+		logic_hash = "v1_sha256_32e46025ac999bee5e5546895b079eecc269f28102bbbcf16da2fe4d978f576c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170391,20 +170461,20 @@ rule MALPEDIA_Win_Pwndlocker_Auto : FILE
 		$sequence_9 = { 8b7224 01de 31c0 668b044e }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Zeoticus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9de59c35-1f7d-51f9-8134-b24208326bd1"
+		id = "e987f5a1-3785-5d22-a342-411e4f75ec50"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeoticus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zeoticus_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "3f9c97113f0506e69ec31e3ee70b01bb1f52832387d7caa17b96ec4c6d0f2f8c"
+		logic_hash = "v1_sha256_3f9c97113f0506e69ec31e3ee70b01bb1f52832387d7caa17b96ec4c6d0f2f8c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170430,20 +170500,20 @@ rule MALPEDIA_Win_Zeoticus_Auto : FILE
 		$sequence_9 = { 2b9d78ffffff 2bbd7cffffff 2b7580 2b5584 898524ffffff 8b8534ffffff 8945b4 }
 
 	condition:
-		7 of them and filesize <468992
+		7 of them and filesize < 468992
 }
 rule MALPEDIA_Win_Morto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9daa15ad-04bd-517d-96ea-e01678db73e5"
+		id = "96bfbbbc-d4cc-5f71-b3d7-0d030e98cc40"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.morto"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.morto_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "6193315806789c46deee4d81d57339bc016356ef937c67c10ba9195e0e60ffaf"
+		logic_hash = "v1_sha256_6193315806789c46deee4d81d57339bc016356ef937c67c10ba9195e0e60ffaf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170469,20 +170539,20 @@ rule MALPEDIA_Win_Morto_Auto : FILE
 		$sequence_9 = { eb0a 33d2 8a1419 41 8d441201 8bd0 c1ea08 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Danabot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "88731f6d-edda-5181-ab28-b879b1e82348"
+		id = "68397af0-7fa1-5d49-8c88-e7262890d15d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.danabot_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "0aacaade997adfab10265dc65b353035ffe85eb407c689ce61c2eca9a9f37b60"
+		logic_hash = "v1_sha256_0aacaade997adfab10265dc65b353035ffe85eb407c689ce61c2eca9a9f37b60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170508,20 +170578,20 @@ rule MALPEDIA_Win_Danabot_Auto : FILE
 		$sequence_9 = { 8b0424 8b00 8903 8b0424 8b4004 }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize < 237568
 }
 rule MALPEDIA_Win_Badnews_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cbdbb9b6-fd8f-59db-ab40-2a7ebd7420e8"
+		id = "a4190608-305b-5dd7-8a8c-dd8cc86cd9b7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badnews"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.badnews_auto.yar#L1-L206"
 		license_url = "N/A"
-		logic_hash = "615a11c7b728bb1d1522af864993baf4e6b235251c7ea78cc85debae2cde79de"
+		logic_hash = "v1_sha256_615a11c7b728bb1d1522af864993baf4e6b235251c7ea78cc85debae2cde79de"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -170558,20 +170628,20 @@ rule MALPEDIA_Win_Badnews_Auto : FILE
 		$sequence_20 = { 84c0 75f7 8da42400000000 ffb554fbffff }
 
 	condition:
-		7 of them and filesize <612352
+		7 of them and filesize < 612352
 }
 rule MALPEDIA_Win_Tmanger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "90de765e-dcad-555e-a3e2-21f3e814ffeb"
+		id = "5e3f5e3b-a890-5846-aa73-c6e5698c0d5c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tmanger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tmanger_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "a7986e1f1ff68dbdf6cb715e7bd380c31c6c5e7bcad1efb5e3857ab5edff19ad"
+		logic_hash = "v1_sha256_a7986e1f1ff68dbdf6cb715e7bd380c31c6c5e7bcad1efb5e3857ab5edff19ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170597,20 +170667,20 @@ rule MALPEDIA_Win_Tmanger_Auto : FILE
 		$sequence_9 = { c7412066b8276e c7412425d933d1 c7412861fdc72a c7412cdf9134d2 }
 
 	condition:
-		7 of them and filesize <8252416
+		7 of them and filesize < 8252416
 }
 rule MALPEDIA_Win_Opachki_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "291586d9-b070-57a5-aa2e-28c307c908af"
+		id = "ec1fab7e-9224-576c-946f-c870468e3341"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.opachki"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.opachki_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "d90c4672bb521b58f2551b67ed4270be91d6ae941a1e85079915797925d00bdb"
+		logic_hash = "v1_sha256_d90c4672bb521b58f2551b67ed4270be91d6ae941a1e85079915797925d00bdb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170641,20 +170711,20 @@ rule MALPEDIA_Win_Opachki_Auto : FILE
 		$sequence_14 = { 3cf2 7505 884701 ebf2 3cf0 7505 884702 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Dharma_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a46a081b-90b3-5009-83f4-4508f1cf18af"
+		id = "979b80e0-bccb-5e01-bde1-fe3ac2de35b7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dharma"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dharma_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "ffbccfb89aae24b9d0cb0290ebb9e2adf2ba122649057e830bafd37778b3a0cb"
+		logic_hash = "v1_sha256_ffbccfb89aae24b9d0cb0290ebb9e2adf2ba122649057e830bafd37778b3a0cb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170680,20 +170750,20 @@ rule MALPEDIA_Win_Dharma_Auto : FILE
 		$sequence_9 = { 52 8b4510 50 e8???????? 83c408 85c0 7409 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Minitypeframe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "40e88a96-d1cd-5006-9a0d-53fcc15d287e"
+		id = "8b73d3ed-0268-5c98-835b-4128c6375879"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minitypeframe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.minitypeframe_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "8864a5220eda366ec3f0b791c455ecd5bc17a2ac1068453ffa5046f89df1e064"
+		logic_hash = "v1_sha256_8864a5220eda366ec3f0b791c455ecd5bc17a2ac1068453ffa5046f89df1e064"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170719,20 +170789,20 @@ rule MALPEDIA_Win_Minitypeframe_Auto : FILE
 		$sequence_9 = { 8d8c24c8000000 85c9 7421 8d9424c8000000 55 52 e8???????? }
 
 	condition:
-		7 of them and filesize <1589248
+		7 of them and filesize < 1589248
 }
 rule MALPEDIA_Win_Polyvice_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2290fade-1786-50c9-a103-500f2794f68d"
+		id = "69d59432-092d-5f29-bd5f-cf0c959bab8d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyvice"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.polyvice_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "099fd1583428c4dcd9d4587ff6b2523b274374d689fdabd70b857d716538d61f"
+		logic_hash = "v1_sha256_099fd1583428c4dcd9d4587ff6b2523b274374d689fdabd70b857d716538d61f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170758,20 +170828,20 @@ rule MALPEDIA_Win_Polyvice_Auto : FILE
 		$sequence_9 = { 41c1cc02 c1c705 4101ff 8b7c2410 31c7 31cf d1c7 }
 
 	condition:
-		7 of them and filesize <369664
+		7 of them and filesize < 369664
 }
 rule MALPEDIA_Win_Dubrute_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68b59ace-0878-598c-a753-f65c82412bdf"
+		id = "0557f112-0bd7-5503-9eb6-98f09ecce0e1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dubrute"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dubrute_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "17213bc1a7d95fe150fe5455d2618ba3abfef4592455b4788ecd90ee42a9b6b1"
+		logic_hash = "v1_sha256_17213bc1a7d95fe150fe5455d2618ba3abfef4592455b4788ecd90ee42a9b6b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170797,20 +170867,20 @@ rule MALPEDIA_Win_Dubrute_Auto : FILE
 		$sequence_9 = { eb09 8b4304 89450c 8d450c 8b08 8b4508 5f }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize < 598016
 }
 rule MALPEDIA_Win_Revenant_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89f91ed8-a64f-59de-9aac-43302ffc4c4f"
+		id = "76103019-cf86-5044-b0f7-b7afdf143f02"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revenant"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.revenant_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "3200938fd857c1394fb14151a6f831277638c7dab5ca1a4886284fcf19cad884"
+		logic_hash = "v1_sha256_3200938fd857c1394fb14151a6f831277638c7dab5ca1a4886284fcf19cad884"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170836,20 +170906,20 @@ rule MALPEDIA_Win_Revenant_Auto : FILE
 		$sequence_9 = { 448b442428 4889f1 488b542420 488d3d40370000 488d2d08370000 4c8d2520370000 }
 
 	condition:
-		7 of them and filesize <99328
+		7 of them and filesize < 99328
 }
 rule MALPEDIA_Win_Darkmegi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a0e854e1-d6b5-5413-b2d6-b8294aeb1c03"
+		id = "71c93608-ce02-5ad8-807a-81149bed890d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmegi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkmegi_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "cbefd542cb2be5b91d54762f56be197fb7c2a5e2f979e1fe8e05b6ab3d5c06b3"
+		logic_hash = "v1_sha256_cbefd542cb2be5b91d54762f56be197fb7c2a5e2f979e1fe8e05b6ab3d5c06b3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170875,20 +170945,20 @@ rule MALPEDIA_Win_Darkmegi_Auto : FILE
 		$sequence_9 = { c3 e8???????? 8b0cf59c8cb402 5e }
 
 	condition:
-		7 of them and filesize <90304
+		7 of them and filesize < 90304
 }
 rule MALPEDIA_Win_Uacme_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff7de611-297b-5087-b1a6-103aa95a4d6a"
+		id = "e5dd36d1-792d-5d3f-b94b-084d3eae753e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.uacme"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.uacme_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "07027ccb25725e405fe664bc8c5892aae7b19e4bf0683cd3f46495797cb60d93"
+		logic_hash = "v1_sha256_07027ccb25725e405fe664bc8c5892aae7b19e4bf0683cd3f46495797cb60d93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170914,20 +170984,20 @@ rule MALPEDIA_Win_Uacme_Auto : FILE
 		$sequence_9 = { 75f7 8b4dfc ba???????? 8d4930 e8???????? 8b4dfc ba???????? }
 
 	condition:
-		7 of them and filesize <565248
+		7 of them and filesize < 565248
 }
 rule MALPEDIA_Win_Doorme_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef34215c-21dc-5b70-9e46-024fa7a7faa3"
+		id = "0a9ca72e-707b-56db-967a-f4250af7d12b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doorme"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.doorme_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "7a262e46ac547aa0a1d170d6c95f7394f8a304e152ade6a1fdc4d6407588a287"
+		logic_hash = "v1_sha256_7a262e46ac547aa0a1d170d6c95f7394f8a304e152ade6a1fdc4d6407588a287"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170953,20 +171023,20 @@ rule MALPEDIA_Win_Doorme_Auto : FILE
 		$sequence_9 = { 4883c510 4c8d15f06b0300 48836c243001 0f8564feffff 4c8bc6 448d4a04 4c8d15d66b0300 }
 
 	condition:
-		7 of them and filesize <580608
+		7 of them and filesize < 580608
 }
 rule MALPEDIA_Win_Turla_Rpc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66c1d7fa-741a-51ae-994f-511185fa9310"
+		id = "cae857f5-a45e-5927-9177-349e2d595226"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_rpc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.turla_rpc_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "47df29c03096bb465616e91b5c4f41a104d4cb12e1b0226d75d72ad4e8590fd9"
+		logic_hash = "v1_sha256_47df29c03096bb465616e91b5c4f41a104d4cb12e1b0226d75d72ad4e8590fd9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170998,20 +171068,20 @@ rule MALPEDIA_Win_Turla_Rpc_Auto : FILE
 		$sequence_15 = { 6a00 8d45f8 50 ff750c ff37 56 }
 
 	condition:
-		7 of them and filesize <311296
+		7 of them and filesize < 311296
 }
 rule MALPEDIA_Win_Meltingclaw_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3b6f1fa7-265c-5ffe-9d34-c9502295b009"
+		id = "804d5296-c4a0-5484-8a71-98285684edb0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meltingclaw"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.meltingclaw_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "379103784a97b527734f31e44cda4d460b2bdbd8572feff4730fa002535654cf"
+		logic_hash = "v1_sha256_379103784a97b527734f31e44cda4d460b2bdbd8572feff4730fa002535654cf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171037,20 +171107,20 @@ rule MALPEDIA_Win_Meltingclaw_Auto : FILE
 		$sequence_9 = { d3e8 4d894708 41894718 410fb608 83e10f 480fbe841140960100 }
 
 	condition:
-		7 of them and filesize <348160
+		7 of them and filesize < 348160
 }
 rule MALPEDIA_Win_Xxmm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16a9d672-e06b-5e77-adaf-431f4123e535"
+		id = "6d357438-82f1-55d0-8c65-567776ed8a6a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xxmm"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xxmm_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "c8c4a142f2bfee52addd60a0f4c2035a9a8040f793cfe3829a4504cc749982c2"
+		logic_hash = "v1_sha256_c8c4a142f2bfee52addd60a0f4c2035a9a8040f793cfe3829a4504cc749982c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171076,20 +171146,20 @@ rule MALPEDIA_Win_Xxmm_Auto : FILE
 		$sequence_9 = { 47 8d040f 0fb610 035510 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Pngdowner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "44303c5d-967e-534a-8e83-5300065e2ae0"
+		id = "ce26b60b-c5a3-5c7f-8619-9d5ee770c9b1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pngdowner"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pngdowner_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "de22eb663da7ff55693bb983ea5d4c7de5d0a56ea6d44ddf300552a98f59e1cb"
+		logic_hash = "v1_sha256_de22eb663da7ff55693bb983ea5d4c7de5d0a56ea6d44ddf300552a98f59e1cb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171115,20 +171185,20 @@ rule MALPEDIA_Win_Pngdowner_Auto : FILE
 		$sequence_9 = { 83651003 8bf0 750b c1e602 8b8640dc4000 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Keyhole_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1776d34a-8ed1-5870-82db-2a2698f47369"
+		id = "68010693-0a92-56b2-a3ae-da536f2276ae"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keyhole"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.keyhole_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "64c3a1f6c6135646d67c8ef7bc09175e7e75133412ea28a0c20d12643fea552c"
+		logic_hash = "v1_sha256_64c3a1f6c6135646d67c8ef7bc09175e7e75133412ea28a0c20d12643fea552c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171154,20 +171224,20 @@ rule MALPEDIA_Win_Keyhole_Auto : FILE
 		$sequence_9 = { c1eb10 8b442410 c1e208 0fb6c0 0bd0 0fb6c3 }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize < 303104
 }
 rule MALPEDIA_Win_Neconyd_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2815a16-95e0-5db4-9058-3189995786c2"
+		id = "6a833c53-20fc-5132-b29a-4fcafdcda2f0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neconyd"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.neconyd_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "e1fd880f0f7b560832efc4f24d502d458a46d62299fa6f4e05fae094662862d2"
+		logic_hash = "v1_sha256_e1fd880f0f7b560832efc4f24d502d458a46d62299fa6f4e05fae094662862d2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171193,20 +171263,20 @@ rule MALPEDIA_Win_Neconyd_Auto : FILE
 		$sequence_9 = { e8???????? 59 8d4594 50 ba???????? e8???????? }
 
 	condition:
-		7 of them and filesize <326182
+		7 of them and filesize < 326182
 }
 rule MALPEDIA_Win_Lowzero_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2e1f2236-1021-58b7-bec6-2914502da5b8"
+		id = "a80672f7-0e2c-508f-aeb7-a6c492770add"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowzero"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lowzero_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "8a0cc8f946fea76f2b3b346672d13b547cb8ca0c916aea88c757b9309e0ee850"
+		logic_hash = "v1_sha256_8a0cc8f946fea76f2b3b346672d13b547cb8ca0c916aea88c757b9309e0ee850"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171232,20 +171302,20 @@ rule MALPEDIA_Win_Lowzero_Auto : FILE
 		$sequence_9 = { 6a01 53 ffd0 85c0 750a 685a040000 }
 
 	condition:
-		7 of them and filesize <433152
+		7 of them and filesize < 433152
 }
 rule MALPEDIA_Win_Flowershop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c1734b8-36d9-5030-b687-4c9005cd52ad"
+		id = "0485700a-1ead-5b01-99ea-65b52ab95dcf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flowershop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.flowershop_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "fe80fc55a0148eaee88f1cb7adb18edcd9b995b61e3ef0f900df914eb5adb176"
+		logic_hash = "v1_sha256_fe80fc55a0148eaee88f1cb7adb18edcd9b995b61e3ef0f900df914eb5adb176"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171271,20 +171341,20 @@ rule MALPEDIA_Win_Flowershop_Auto : FILE
 		$sequence_9 = { 75ea ff749e04 43 ff7510 ff550c 59 85c0 }
 
 	condition:
-		7 of them and filesize <829440
+		7 of them and filesize < 829440
 }
 rule MALPEDIA_Win_Pslogger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ec7a19b3-c3a5-5a75-ac86-d0beb1e4cdd5"
+		id = "8c0137b2-1368-5dd3-a271-9de195e83077"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pslogger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pslogger_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "746d33059662814e87cdaa4caa4e5b548a478a0041425137f661e51552f006fa"
+		logic_hash = "v1_sha256_746d33059662814e87cdaa4caa4e5b548a478a0041425137f661e51552f006fa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171316,20 +171386,20 @@ rule MALPEDIA_Win_Pslogger_Auto : FILE
 		$sequence_15 = { 6bd830 56 8b048d88b14200 57 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize < 475136
 }
 rule MALPEDIA_Win_Unidentified_044_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b06c2db5-4f74-514b-a6ac-3ca802bc63db"
+		id = "10c13c71-1de4-5194-838e-572776c82567"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_044"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_044_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "bba754b0708d8dcd8392b060bb16bcb2ec72e2dcb75dae26c5459c6dda294679"
+		logic_hash = "v1_sha256_bba754b0708d8dcd8392b060bb16bcb2ec72e2dcb75dae26c5459c6dda294679"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171355,20 +171425,20 @@ rule MALPEDIA_Win_Unidentified_044_Auto : FILE
 		$sequence_9 = { 7505 b8???????? e8???????? a1???????? 56 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Wastedlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8ef8d9a2-2e74-56fa-b8ce-a112e80f0d26"
+		id = "88233bea-1c24-54c3-8d18-ab293a820090"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wastedlocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wastedlocker_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "48bd61023921acb8234a4ca4342276a30ad18fb5b65266be5de19c7db798e757"
+		logic_hash = "v1_sha256_48bd61023921acb8234a4ca4342276a30ad18fb5b65266be5de19c7db798e757"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171394,20 +171464,20 @@ rule MALPEDIA_Win_Wastedlocker_Auto : FILE
 		$sequence_9 = { ff750c 8b4518 ff7508 e8???????? 6800020000 8bf0 8d85f8fdffff }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Unidentified_037_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "12311ab5-e4c5-520c-9e45-de0627bcb40b"
+		id = "169e6c48-fc1c-51ac-950f-fe81ac1dcfa7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_037"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_037_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "1d2de4db39b1900c0def6a2d43ab52baecc925bfad5faca5ff76425cebd9b30d"
+		logic_hash = "v1_sha256_1d2de4db39b1900c0def6a2d43ab52baecc925bfad5faca5ff76425cebd9b30d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171433,20 +171503,20 @@ rule MALPEDIA_Win_Unidentified_037_Auto : FILE
 		$sequence_9 = { 8801 eb09 51 e8???????? 83c404 8b4c240c 895e04 }
 
 	condition:
-		7 of them and filesize <167936
+		7 of them and filesize < 167936
 }
 rule MALPEDIA_Win_Sage_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0cfc4781-9310-56a6-9786-dd48a9782a50"
+		id = "6291c768-e2d6-514f-8cc2-e12ede93e30c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sage_ransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sage_ransom_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "aa9c344ed40cd82065b24d270c712730728bf75ebcabdbfdec5a88ea8d283ad2"
+		logic_hash = "v1_sha256_aa9c344ed40cd82065b24d270c712730728bf75ebcabdbfdec5a88ea8d283ad2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171478,20 +171548,20 @@ rule MALPEDIA_Win_Sage_Ransom_Auto : FILE
 		$sequence_15 = { 0119 117104 83c110 83c210 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize < 335872
 }
 rule MALPEDIA_Win_Darkpulsar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3c0e62f1-e08c-54de-80e8-3035c44da66d"
+		id = "dab4c101-566e-59aa-bc8e-a7c40ca2a05f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkpulsar"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkpulsar_auto.yar#L1-L471"
 		license_url = "N/A"
-		logic_hash = "a16686b6fd6dac730451b9eb62e01c34a4e8ab3b1c781a91de53e419e5302dea"
+		logic_hash = "v1_sha256_a16686b6fd6dac730451b9eb62e01c34a4e8ab3b1c781a91de53e419e5302dea"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -171558,20 +171628,20 @@ rule MALPEDIA_Win_Darkpulsar_Auto : FILE
 		$sequence_50 = { 51 d91c24 e8???????? 50 e8???????? d905???????? }
 
 	condition:
-		7 of them and filesize <491520
+		7 of them and filesize < 491520
 }
 rule MALPEDIA_Win_Cruloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "af447408-0b7c-5bac-a78b-97c116da2002"
+		id = "8b8ec50e-1e31-50b1-a2d6-e55be6b7f5e8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cruloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cruloader_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "59193418b12a936adb7da239534987c20e49170078a9b714faec730fae8ac983"
+		logic_hash = "v1_sha256_59193418b12a936adb7da239534987c20e49170078a9b714faec730fae8ac983"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171597,20 +171667,20 @@ rule MALPEDIA_Win_Cruloader_Auto : FILE
 		$sequence_9 = { 8dbd9cfdffff 2bd6 83c7fe 0f1f4000 668b4702 83c702 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize < 196608
 }
 rule MALPEDIA_Win_Advisorsbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d26aaef7-489b-5eb4-8cea-1ab552de40d6"
+		id = "f50608b1-ed9c-537f-87f8-ab651e2c24e1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.advisorsbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.advisorsbot_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "b714abe1aa8dcb7f6377853b7e4c0df837d586795e3163f35470e362238d5477"
+		logic_hash = "v1_sha256_b714abe1aa8dcb7f6377853b7e4c0df837d586795e3163f35470e362238d5477"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171644,20 +171714,20 @@ rule MALPEDIA_Win_Advisorsbot_Auto : FILE
 		$sequence_17 = { 668b442410 5f 5e 5d 0fb7c0 5b }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize < 434176
 }
 rule MALPEDIA_Win_Bistromath_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e2ace9ec-fb28-5f7e-b65b-e020bfa94a6f"
+		id = "2363fd40-23d1-555f-803b-240a2e8dcb1a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bistromath"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bistromath_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "8b0190b62dedacf36599f0042a8bd29edc86ceda9086cf91a756283776411b62"
+		logic_hash = "v1_sha256_8b0190b62dedacf36599f0042a8bd29edc86ceda9086cf91a756283776411b62"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171683,20 +171753,20 @@ rule MALPEDIA_Win_Bistromath_Auto : FILE
 		$sequence_9 = { c7421000000000 e8???????? 85f6 746d 83bb0002000000 7435 3bb30c010000 }
 
 	condition:
-		7 of them and filesize <33816576
+		7 of them and filesize < 33816576
 }
 rule MALPEDIA_Win_Enfal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "01bf52c7-5562-58b0-bd6b-f99194c0bb2b"
+		id = "292e4f49-98c7-5650-9abe-df6d15c51fcc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.enfal_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "c231b8446e9ed78bdd8a9cb59296768a0836b06ecc839e3d3e3a25695d5dfcf0"
+		logic_hash = "v1_sha256_c231b8446e9ed78bdd8a9cb59296768a0836b06ecc839e3d3e3a25695d5dfcf0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171722,20 +171792,20 @@ rule MALPEDIA_Win_Enfal_Auto : FILE
 		$sequence_9 = { e8???????? 83c444 8d45f0 53 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Zeus_Action_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d8b9574e-a0e7-5ba7-a640-3d17643b0cca"
+		id = "52985884-6b7d-58d0-bab1-3553f723e82c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_action"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zeus_action_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "3c34c6384d3102dcf930744109cb986bdc2576d8925ca3fbe6fecc099028fdf3"
+		logic_hash = "v1_sha256_3c34c6384d3102dcf930744109cb986bdc2576d8925ca3fbe6fecc099028fdf3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171761,20 +171831,20 @@ rule MALPEDIA_Win_Zeus_Action_Auto : FILE
 		$sequence_9 = { 53 56 8b35???????? 57 68???????? ff7508 8d85a4fbffff }
 
 	condition:
-		7 of them and filesize <827392
+		7 of them and filesize < 827392
 }
 rule MALPEDIA_Win_Bluehaze_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5c7b5561-ee2d-5a06-a96a-4cc26ae71cec"
+		id = "7526fd00-ea1d-59ce-94aa-5926d37b3643"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluehaze"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bluehaze_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "108c6f0ac1c0898d4930ded73b9aadddbebc2ff25c5a1de920dfb159113df607"
+		logic_hash = "v1_sha256_108c6f0ac1c0898d4930ded73b9aadddbebc2ff25c5a1de920dfb159113df607"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171800,20 +171870,20 @@ rule MALPEDIA_Win_Bluehaze_Auto : FILE
 		$sequence_9 = { e9???????? 8d8d78fbffff e9???????? 8b542408 8d420c 8b8a04faffff 33c8 }
 
 	condition:
-		7 of them and filesize <424960
+		7 of them and filesize < 424960
 }
 rule MALPEDIA_Win_Blackmatter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7e457194-4a19-57a3-89ac-b5153afc0744"
+		id = "fa459a31-c531-55f0-9af4-41b59972eda7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackmatter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blackmatter_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "c5598bfcc346f3d5f3d24c66f49b6d8b4e14cf3a3802140e28639e017dd52693"
+		logic_hash = "v1_sha256_c5598bfcc346f3d5f3d24c66f49b6d8b4e14cf3a3802140e28639e017dd52693"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171839,20 +171909,20 @@ rule MALPEDIA_Win_Blackmatter_Auto : FILE
 		$sequence_9 = { f7f1 92 3b4508 720b 3b450c }
 
 	condition:
-		7 of them and filesize <194560
+		7 of them and filesize < 194560
 }
 rule MALPEDIA_Win_Crenufs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "afe43d9c-690f-5ee9-b954-c5b702959ff3"
+		id = "1ad21d67-08e7-5def-9b7c-b4637990d440"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crenufs"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crenufs_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "3c7a04525acb3eb4c11e5514f2c9651e3b51e0f4081d21b17236ba959340440d"
+		logic_hash = "v1_sha256_3c7a04525acb3eb4c11e5514f2c9651e3b51e0f4081d21b17236ba959340440d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171878,20 +171948,20 @@ rule MALPEDIA_Win_Crenufs_Auto : FILE
 		$sequence_9 = { 52 50 ffd5 8b4338 85c0 7505 897338 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Unidentified_073_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0ba61f73-e46a-5f54-853f-f1f3b502ee26"
+		id = "2a129658-5e5c-5494-ab10-f258fc0dc0cc"
 		date = "2022-08-05"
 		modified = "2022-08-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_073"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_073_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "8100472ca712d569bbcdb570af72e3f13986092b4d8ee8e3873da55bef76232d"
+		logic_hash = "v1_sha256_8100472ca712d569bbcdb570af72e3f13986092b4d8ee8e3873da55bef76232d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171917,20 +171987,20 @@ rule MALPEDIA_Win_Unidentified_073_Auto : FILE
 		$sequence_9 = { 57 6aff 68???????? 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <1974272
+		7 of them and filesize < 1974272
 }
 rule MALPEDIA_Win_Combos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "83be0118-da53-5a8d-831d-9e770a5f717d"
+		id = "deff2c45-497c-5752-bdd1-2b16610887cb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.combos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.combos_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "f3e6fe545b99111283539f520a90d4bf3b968444eac10c20521004e7b16afe6f"
+		logic_hash = "v1_sha256_f3e6fe545b99111283539f520a90d4bf3b968444eac10c20521004e7b16afe6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171956,20 +172026,20 @@ rule MALPEDIA_Win_Combos_Auto : FILE
 		$sequence_9 = { 8bd0 2be8 89542414 eb04 8b542414 33c0 }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Jssloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "90fc04b9-9652-536e-8f60-72fc9a34063b"
+		id = "83c064c5-a021-5dc2-a692-d1c3e213215a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jssloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jssloader_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "97165a1c6774cf73430e22299a3df7b55ab3c7ba699c480d4641c6a6e116c33b"
+		logic_hash = "v1_sha256_97165a1c6774cf73430e22299a3df7b55ab3c7ba699c480d4641c6a6e116c33b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171995,20 +172065,20 @@ rule MALPEDIA_Win_Jssloader_Auto : FILE
 		$sequence_9 = { 8bd6 7202 8b16 ff7610 8bc8 }
 
 	condition:
-		7 of them and filesize <581632
+		7 of them and filesize < 581632
 }
 rule MALPEDIA_Win_Neteagle_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "552fea63-ea2d-5d68-acbe-acbcf4f3fc62"
+		id = "91dacae0-8fcc-5ad5-9c35-fa1a2a0c9a38"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neteagle"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.neteagle_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "d61d147c710715632ec1c821209ba30c6e6f1ac5fd2be9819dd093a236f5d3aa"
+		logic_hash = "v1_sha256_d61d147c710715632ec1c821209ba30c6e6f1ac5fd2be9819dd093a236f5d3aa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172034,20 +172104,20 @@ rule MALPEDIA_Win_Neteagle_Auto : FILE
 		$sequence_9 = { 8964242c 51 8d4c2434 e8???????? 8d542428 8bce 52 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Danbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "da55061d-0704-5ad4-a81b-0f3aa0376e8a"
+		id = "3c1054a8-4a81-533a-8f84-3dc7a2459261"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.danbot_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "5da6053f066e9d13d04800876e4e18c27ca9158fbdceb66408c8360c250a0789"
+		logic_hash = "v1_sha256_5da6053f066e9d13d04800876e4e18c27ca9158fbdceb66408c8360c250a0789"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172073,20 +172143,20 @@ rule MALPEDIA_Win_Danbot_Auto : FILE
 		$sequence_9 = { 90 e9???????? 84c9 0f8453020000 8b442430 85c0 7408 }
 
 	condition:
-		7 of them and filesize <1492992
+		7 of them and filesize < 1492992
 }
 rule MALPEDIA_Win_Farseer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a67d1eb-3f83-53bd-8009-08fd90d91a72"
+		id = "5838e7ff-c664-55c3-8669-c8faa9b890d1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.farseer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.farseer_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "c4f58eaf1a171a6ef6927bdc0d75281407b1ff19c17d7d3cb4db395f2514c097"
+		logic_hash = "v1_sha256_c4f58eaf1a171a6ef6927bdc0d75281407b1ff19c17d7d3cb4db395f2514c097"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172112,20 +172182,20 @@ rule MALPEDIA_Win_Farseer_Auto : FILE
 		$sequence_9 = { 3bc1 0f87ad090000 ff24851d094100 838de8fdffffff 89b590fdffff }
 
 	condition:
-		7 of them and filesize <347328
+		7 of them and filesize < 347328
 }
 rule MALPEDIA_Win_Linseningsvr_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9dcd591f-d0ec-5190-8dad-c6b3b9eab825"
+		id = "7b497987-7ed6-5ec3-be3e-4db39ca859ff"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.linseningsvr"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.linseningsvr_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "0cfff1e97d9fd891165604e0b9cd757922199a1abb3f822338fa50a684f756d6"
+		logic_hash = "v1_sha256_0cfff1e97d9fd891165604e0b9cd757922199a1abb3f822338fa50a684f756d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172151,20 +172221,20 @@ rule MALPEDIA_Win_Linseningsvr_Auto : FILE
 		$sequence_9 = { 8ac8 80c120 8888808b4000 eb1f 83f861 7213 83f87a }
 
 	condition:
-		7 of them and filesize <81360
+		7 of them and filesize < 81360
 }
 rule MALPEDIA_Win_Shipshape_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aa7aa2cd-5e40-579e-a131-11724b603c86"
+		id = "362d469d-6165-5da1-ab65-3a95f06cdfd2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shipshape"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shipshape_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b3e2abc875f7ba78a51d88975fa6d3eb42407a4e92394786033a7e1704215a48"
+		logic_hash = "v1_sha256_b3e2abc875f7ba78a51d88975fa6d3eb42407a4e92394786033a7e1704215a48"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172190,20 +172260,20 @@ rule MALPEDIA_Win_Shipshape_Auto : FILE
 		$sequence_9 = { 52 ff15???????? 8d8424b4000000 50 ff15???????? 0c06 }
 
 	condition:
-		7 of them and filesize <338386
+		7 of them and filesize < 338386
 }
 rule MALPEDIA_Win_Oski_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00507fe9-9209-5e5a-8102-b7f791efd242"
+		id = "0bd7a610-f590-5105-b2fc-093f0f68a060"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oski"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.oski_auto.yar#L1-L180"
 		license_url = "N/A"
-		logic_hash = "35c4af68aedcbb90eed8cfba69202373adfb8560464fdea190e8d4d9190a864c"
+		logic_hash = "v1_sha256_35c4af68aedcbb90eed8cfba69202373adfb8560464fdea190e8d4d9190a864c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172236,20 +172306,20 @@ rule MALPEDIA_Win_Oski_Auto : FILE
 		$sequence_16 = { 8d55f4 52 6a00 68???????? ff15???????? 8945f0 837df000 }
 
 	condition:
-		7 of them and filesize <423936
+		7 of them and filesize < 423936
 }
 rule MALPEDIA_Win_Redcurl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fbb544b7-c5e6-54a1-8421-fdb6aeb04e0b"
+		id = "15d5c921-2b20-50b4-9268-26b3a710fe0a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redcurl"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.redcurl_auto.yar#L1-L212"
 		license_url = "N/A"
-		logic_hash = "69ca0c8cf976224bed2624627972f08d1882150471e8a73b5314d8faac0d77d8"
+		logic_hash = "v1_sha256_69ca0c8cf976224bed2624627972f08d1882150471e8a73b5314d8faac0d77d8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -172286,20 +172356,20 @@ rule MALPEDIA_Win_Redcurl_Auto : FILE
 		$sequence_20 = { 0f8583f7ffff 8b4004 85c0 75e3 8b8310010000 8d5608 89442424 }
 
 	condition:
-		7 of them and filesize <487424
+		7 of them and filesize < 487424
 }
 rule MALPEDIA_Win_Darkdew_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "72766643-15c8-5d73-9055-fc2b6509a42d"
+		id = "7ec22b61-fca6-568b-8dd6-57c988ee4e7c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkdew"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkdew_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "b05f670c23077615e6a702bdb8387206cc612d9856e8283c4dc5f994c8c7e0fc"
+		logic_hash = "v1_sha256_b05f670c23077615e6a702bdb8387206cc612d9856e8283c4dc5f994c8c7e0fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172325,20 +172395,20 @@ rule MALPEDIA_Win_Darkdew_Auto : FILE
 		$sequence_9 = { f3a5 8b4de8 894dfc eb03 8b45f4 }
 
 	condition:
-		7 of them and filesize <279552
+		7 of them and filesize < 279552
 }
 rule MALPEDIA_Win_Wonknu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c22ecc6-5e07-568e-a954-bd5d4c46a783"
+		id = "4a93b80a-e9dc-5a89-bea2-b0d28cbcfec0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wonknu"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wonknu_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "d8729848e6f29de29baa83d3d1b7a400fd076f81fa4553c7cf2ef20e4ee0bd77"
+		logic_hash = "v1_sha256_d8729848e6f29de29baa83d3d1b7a400fd076f81fa4553c7cf2ef20e4ee0bd77"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172364,20 +172434,20 @@ rule MALPEDIA_Win_Wonknu_Auto : FILE
 		$sequence_9 = { e8???????? 8bfc b901050000 f3a5 8bcb e8???????? }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Herpes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fedf32f5-9ae5-5123-9361-9a81a141f76e"
+		id = "c666da07-10f7-5210-a368-bde828d5e21c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.herpes"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.herpes_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "769ea4914adc8e6bb491030ee0781ca8f47cafb6846f9263dbbc09dc62dc70a2"
+		logic_hash = "v1_sha256_769ea4914adc8e6bb491030ee0781ca8f47cafb6846f9263dbbc09dc62dc70a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172403,20 +172473,20 @@ rule MALPEDIA_Win_Herpes_Auto : FILE
 		$sequence_9 = { 83c404 ff15???????? 85c0 7418 6804010000 8d8c24e00a0000 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize < 319488
 }
 rule MALPEDIA_Win_Nocturnalstealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b2ebf655-b369-5222-91b5-1580e525a57e"
+		id = "3b6ce67a-1bae-5639-8542-59eb87298b24"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nocturnalstealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nocturnalstealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "2c6b243d35f29c591c5668acf471c8a2107f8e8d4171dce50c484f231af2f2ed"
+		logic_hash = "v1_sha256_2c6b243d35f29c591c5668acf471c8a2107f8e8d4171dce50c484f231af2f2ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172442,20 +172512,20 @@ rule MALPEDIA_Win_Nocturnalstealer_Auto : FILE
 		$sequence_9 = { e9???????? 59 52 89f2 89d0 5a e9???????? }
 
 	condition:
-		7 of them and filesize <10739712
+		7 of them and filesize < 10739712
 }
 rule MALPEDIA_Elf_Babuk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8eba83d0-6c95-5d1f-85db-3750f26fdff6"
+		id = "017d9694-86e8-55e6-bc14-40c8b39e6f9b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.babuk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/elf.babuk_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "a4e1d4252d61243f852bbd89e2ebf51566a3485791e9905d978089b8c49c4cb9"
+		logic_hash = "v1_sha256_a4e1d4252d61243f852bbd89e2ebf51566a3485791e9905d978089b8c49c4cb9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172481,20 +172551,20 @@ rule MALPEDIA_Elf_Babuk_Auto : FILE
 		$sequence_9 = { 8b4c2424 01ca 89942444050000 8b8c2490050000 c1e11a 898c2420050000 }
 
 	condition:
-		7 of them and filesize <4186112
+		7 of them and filesize < 4186112
 }
 rule MALPEDIA_Win_Murkytop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "09c2c9ad-2fc4-523f-99a2-d7f06ef6936d"
+		id = "06a01239-255d-5c95-8e92-b0a07e37fcb9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.murkytop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.murkytop_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "e4a555eba2d93ac52653d0ddd1b98a4be2b8b9fd7f1c8d48fbca611f1976d1c2"
+		logic_hash = "v1_sha256_e4a555eba2d93ac52653d0ddd1b98a4be2b8b9fd7f1c8d48fbca611f1976d1c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172520,20 +172590,20 @@ rule MALPEDIA_Win_Murkytop_Auto : FILE
 		$sequence_9 = { 33f6 8b4dfc 8b511c 52 }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize < 294912
 }
 rule MALPEDIA_Win_Brambul_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ab481228-bdce-550e-a6f6-2d8dfaa70a2b"
+		id = "ec7216b6-381f-5602-9834-acf8b96f91ac"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brambul"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.brambul_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "4ef5f993f2727cb74a42049fbc80622dc3543c88c7bb52088b1f5b1131ebc4b4"
+		logic_hash = "v1_sha256_4ef5f993f2727cb74a42049fbc80622dc3543c88c7bb52088b1f5b1131ebc4b4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172565,20 +172635,20 @@ rule MALPEDIA_Win_Brambul_Auto : FILE
 		$sequence_15 = { f3a5 6a00 ff15???????? 83c41c 50 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Shareip_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c1bb89d1-f372-58e3-b942-2bef06089e9d"
+		id = "08d20d9d-595a-5e5f-b819-2151a3f9aa7a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shareip"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shareip_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "22f8defa170ad6011dfacc6043f0faf754eb6e381cb168ecc5d5e1f970ca56dc"
+		logic_hash = "v1_sha256_22f8defa170ad6011dfacc6043f0faf754eb6e381cb168ecc5d5e1f970ca56dc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172604,20 +172674,20 @@ rule MALPEDIA_Win_Shareip_Auto : FILE
 		$sequence_9 = { 51 53 56 8bcd e8???????? 8bce 53 }
 
 	condition:
-		7 of them and filesize <811008
+		7 of them and filesize < 811008
 }
 rule MALPEDIA_Win_Mm_Core_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bf93218a-8d8c-58ea-bf30-76f3ba39addc"
+		id = "2449d3df-0aed-51b5-b58d-fca782053963"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mm_core"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mm_core_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "29ec3357b82a9f4eff6706385f45e4b797a4fc7c02bf49f9f64641ab1015abf0"
+		logic_hash = "v1_sha256_29ec3357b82a9f4eff6706385f45e4b797a4fc7c02bf49f9f64641ab1015abf0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172643,20 +172713,20 @@ rule MALPEDIA_Win_Mm_Core_Auto : FILE
 		$sequence_9 = { 68???????? e8???????? b8???????? 83c430 8d5002 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize < 319488
 }
 rule MALPEDIA_Win_Unidentified_095_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2cdecaec-fb60-5714-949a-43017e2a9367"
+		id = "8ec9b0e6-60ef-5502-9ae2-33f1ed8dd615"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_095"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_095_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "26f94ce2105de641743f6ff5fce894a28fc2893a963b3d77519d919e034fdf59"
+		logic_hash = "v1_sha256_26f94ce2105de641743f6ff5fce894a28fc2893a963b3d77519d919e034fdf59"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172682,20 +172752,20 @@ rule MALPEDIA_Win_Unidentified_095_Auto : FILE
 		$sequence_9 = { 48894c2428 4885f6 0f848b000000 4533c0 488bd6 488bcb e8???????? }
 
 	condition:
-		7 of them and filesize <339968
+		7 of them and filesize < 339968
 }
 rule MALPEDIA_Win_Ground_Peony_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a6ba3822-837c-5f9f-87da-bacc2e30de24"
+		id = "5c5bd4a7-4573-52fa-aa83-ed5044af064b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ground_peony"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ground_peony_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "e78f90db6174b77e8191ffdbebceb8195c536d4827a66bc4c3081db996009605"
+		logic_hash = "v1_sha256_e78f90db6174b77e8191ffdbebceb8195c536d4827a66bc4c3081db996009605"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172721,20 +172791,20 @@ rule MALPEDIA_Win_Ground_Peony_Auto : FILE
 		$sequence_9 = { 488b5c2430 4883c420 5f c3 48897c2408 488d3da0f60000 }
 
 	condition:
-		7 of them and filesize <217088
+		7 of them and filesize < 217088
 }
 rule MALPEDIA_Win_Sepulcher_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "226eeb17-2cf9-5d07-9607-4486b199b293"
+		id = "db9269cb-492c-541c-8137-6a9c14c471da"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sepulcher"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sepulcher_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "e1aaa31878ffe75af7745e7155d1b8f026b2d8b5dc07360be87f7b721a2b24ec"
+		logic_hash = "v1_sha256_e1aaa31878ffe75af7745e7155d1b8f026b2d8b5dc07360be87f7b721a2b24ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172760,20 +172830,20 @@ rule MALPEDIA_Win_Sepulcher_Auto : FILE
 		$sequence_9 = { d1e8 894234 8b4a38 0faf4a34 8b4214 }
 
 	condition:
-		7 of them and filesize <279552
+		7 of them and filesize < 279552
 }
 rule MALPEDIA_Win_Unidentified_003_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68c73429-01e2-51c8-be95-38ace5fc7e1c"
+		id = "f94ededd-7059-57e3-953d-61b46ccea4c4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_003"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_003_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "1280401acbb116bbb5b04fa4063fd1d8d80a530174292f633236a0a89b7df590"
+		logic_hash = "v1_sha256_1280401acbb116bbb5b04fa4063fd1d8d80a530174292f633236a0a89b7df590"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172799,20 +172869,20 @@ rule MALPEDIA_Win_Unidentified_003_Auto : FILE
 		$sequence_9 = { 55 8bec 81ecb4000000 53 56 57 33f6 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Blackpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89c6782b-ce89-5ae6-b33e-9ad6b6b135a4"
+		id = "222a109b-feab-5e6b-beb3-a5bab0708aac"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blackpos_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "7d2d90e306d11c41271f7c0e9630f3392beaf89b6698e039f543a5fdf586b172"
+		logic_hash = "v1_sha256_7d2d90e306d11c41271f7c0e9630f3392beaf89b6698e039f543a5fdf586b172"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172838,20 +172908,20 @@ rule MALPEDIA_Win_Blackpos_Auto : FILE
 		$sequence_9 = { 7e33 89b5b4f4ffff 6a14 8d45bc 50 }
 
 	condition:
-		7 of them and filesize <3293184
+		7 of them and filesize < 3293184
 }
 rule MALPEDIA_Win_Crytox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cfd8bc3e-6e83-548e-8e5a-491fd708c53c"
+		id = "5a4f32f1-756a-5d8c-818a-b860471eca2a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crytox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crytox_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0d608432c61d44fbe73904a491bbca98a3f6f38166b8de3be56cb8c75f376d55"
+		logic_hash = "v1_sha256_0d608432c61d44fbe73904a491bbca98a3f6f38166b8de3be56cb8c75f376d55"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172877,20 +172947,20 @@ rule MALPEDIA_Win_Crytox_Auto : FILE
 		$sequence_9 = { e9???????? 8b4508 8b4044 8b55c8 c1e202 01d0 8b00 }
 
 	condition:
-		7 of them and filesize <6156288
+		7 of them and filesize < 6156288
 }
 rule MALPEDIA_Win_Boldmove_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c0ee40b4-e9c4-5f65-956d-3ab91a0741b7"
+		id = "799f669d-1508-5d75-be35-8b284109a180"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boldmove"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.boldmove_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "80c35171aa5675e2bb96034cca19e4fa2358df102e187fd20681a49dd8be92d9"
+		logic_hash = "v1_sha256_80c35171aa5675e2bb96034cca19e4fa2358df102e187fd20681a49dd8be92d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172916,20 +172986,20 @@ rule MALPEDIA_Win_Boldmove_Auto : FILE
 		$sequence_9 = { 85c0 7408 890424 e8???????? 43 81fb00010000 75e4 }
 
 	condition:
-		7 of them and filesize <242688
+		7 of them and filesize < 242688
 }
 rule MALPEDIA_Win_Webc2_Cson_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "13b28ac1-90a8-569b-9437-56c16ba607cd"
+		id = "1cdc4710-f8bd-5ca5-bdad-4129f476d4f0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_cson"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_cson_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "9a18d875b3b14f91d30d03a0640ea0a5b789b8ad5cdc4c9d1d8ddab08372dfdc"
+		logic_hash = "v1_sha256_9a18d875b3b14f91d30d03a0640ea0a5b789b8ad5cdc4c9d1d8ddab08372dfdc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172955,20 +173025,20 @@ rule MALPEDIA_Win_Webc2_Cson_Auto : FILE
 		$sequence_9 = { 8bc7 5f 5e c3 ff15???????? 6a09 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Seasalt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e8758fcf-84ae-529e-8419-cd8aeff0784f"
+		id = "1a44cd72-c06f-5e83-b623-edb3985dfcf9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.seasalt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.seasalt_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "5df2d6a2f6a4936e4945854f6bc4e70b294eb2b72f1c3ef6c84a2efa72215e6e"
+		logic_hash = "v1_sha256_5df2d6a2f6a4936e4945854f6bc4e70b294eb2b72f1c3ef6c84a2efa72215e6e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172994,20 +173064,20 @@ rule MALPEDIA_Win_Seasalt_Auto : FILE
 		$sequence_9 = { 7765 ff2485f4130010 8b0d???????? 68???????? }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Turnedup_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9cef3df1-e6dd-5dcd-8eeb-7fa8aae510b3"
+		id = "3ee1935a-3791-52d7-8601-bd35eb95164a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turnedup"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.turnedup_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "f114ccc267f7ff6c1934261ef01804f10c4ed0bd6285f48c3f30e4d8aac2153d"
+		logic_hash = "v1_sha256_f114ccc267f7ff6c1934261ef01804f10c4ed0bd6285f48c3f30e4d8aac2153d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173033,20 +173103,20 @@ rule MALPEDIA_Win_Turnedup_Auto : FILE
 		$sequence_9 = { 8b5f10 85db 7438 8b4f14 83f910 }
 
 	condition:
-		7 of them and filesize <892928
+		7 of them and filesize < 892928
 }
 rule MALPEDIA_Win_Mirai_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "009ec30f-f4c4-5af9-afbc-ec79b59a007e"
+		id = "b81876c5-90ba-5d0c-a126-730bea47d8b7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirai"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mirai_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "4b520e473aaa65894d4224b9e87eda17dce7091dc19025c78727d13bc484a535"
+		logic_hash = "v1_sha256_4b520e473aaa65894d4224b9e87eda17dce7091dc19025c78727d13bc484a535"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173072,20 +173142,20 @@ rule MALPEDIA_Win_Mirai_Auto : FILE
 		$sequence_9 = { 8bf0 85f6 7511 6829010000 68???????? 6a41 e9???????? }
 
 	condition:
-		7 of them and filesize <7086080
+		7 of them and filesize < 7086080
 }
 rule MALPEDIA_Win_Zebrocy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3e5f6c21-b107-5927-ab15-3b5f7930bd9f"
+		id = "6bc15217-31a0-5035-a1f4-47291eeef52a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zebrocy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zebrocy_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "441b6c0eb1e7ad657ed1ddd776f40e36e6f7013a1b8efb6494c5b91191385474"
+		logic_hash = "v1_sha256_441b6c0eb1e7ad657ed1ddd776f40e36e6f7013a1b8efb6494c5b91191385474"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173117,20 +173187,20 @@ rule MALPEDIA_Win_Zebrocy_Auto : FILE
 		$sequence_15 = { eb50 31d2 89d9 e8???????? }
 
 	condition:
-		7 of them and filesize <393216
+		7 of them and filesize < 393216
 }
 rule MALPEDIA_Win_Rovnix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "75582b32-2396-52b5-ad83-7563a2940a52"
+		id = "b410fc13-1ebf-587d-940e-cb551bd26929"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rovnix"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rovnix_auto.yar#L1-L331"
 		license_url = "N/A"
-		logic_hash = "ed6329dc4f284f83c7abc03edae1041f365607dbb53bb190660ed33f6a939524"
+		logic_hash = "v1_sha256_ed6329dc4f284f83c7abc03edae1041f365607dbb53bb190660ed33f6a939524"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -173182,20 +173252,20 @@ rule MALPEDIA_Win_Rovnix_Auto : FILE
 		$sequence_35 = { 488b03 488905???????? 488b4308 488905???????? 8b4310 8905???????? 488b4b20 }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize < 548864
 }
 rule MALPEDIA_Win_Arefty_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1bbf58c-af9c-5d64-b893-96f60da58ce9"
+		id = "d5d41d46-9645-5414-9978-b4af8ed81f3e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arefty"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.arefty_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "fde5f4282a78a6517cf5f33df8600bda217d95924465f99b86aed788930f75c3"
+		logic_hash = "v1_sha256_fde5f4282a78a6517cf5f33df8600bda217d95924465f99b86aed788930f75c3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173221,20 +173291,20 @@ rule MALPEDIA_Win_Arefty_Auto : FILE
 		$sequence_9 = { 680000a000 57 53 ff15???????? }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize < 237568
 }
 rule MALPEDIA_Win_Erbium_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3a53e6ef-1078-5435-9f60-4f8ff6596d6b"
+		id = "4b79fc65-795d-5d7b-9065-3570c6510074"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.erbium_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.erbium_stealer_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "bccad5f3f8af9dfd7831cb14cdc529eb8f240bee1d54dd0908880ec160a26124"
+		logic_hash = "v1_sha256_bccad5f3f8af9dfd7831cb14cdc529eb8f240bee1d54dd0908880ec160a26124"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173260,20 +173330,20 @@ rule MALPEDIA_Win_Erbium_Stealer_Auto : FILE
 		$sequence_9 = { 85c0 753d 6800800000 6a00 8b55f8 52 8b4508 }
 
 	condition:
-		7 of them and filesize <33792
+		7 of them and filesize < 33792
 }
 rule MALPEDIA_Win_Nymaim_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e0a12b6e-526a-5a8b-aed4-baed5127be87"
+		id = "8adbf244-1ae7-59a9-9bbc-a34e1390d9e1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nymaim_auto.yar#L1-L222"
 		license_url = "N/A"
-		logic_hash = "f3d2f3296acd118f28135509a78d3821be2bc056e67d24571caf444a5d1f55ba"
+		logic_hash = "v1_sha256_f3d2f3296acd118f28135509a78d3821be2bc056e67d24571caf444a5d1f55ba"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -173313,20 +173383,20 @@ rule MALPEDIA_Win_Nymaim_Auto : FILE
 		$sequence_23 = { 890424 894c2404 e8???????? 8d0d3430d201 }
 
 	condition:
-		1 of them and filesize <2375680
+		1 of them and filesize < 2375680
 }
 rule MALPEDIA_Win_Plaintee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d95cbeb4-c06c-51b3-a2cb-8f8e5a1bfe81"
+		id = "bc5fe8e3-1fe4-5207-be25-107c5aa3f970"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plaintee"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.plaintee_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "0e73f73019071a1fc77ee2e72d1d76e92ad8df711ace3b0abcab294f32362d30"
+		logic_hash = "v1_sha256_0e73f73019071a1fc77ee2e72d1d76e92ad8df711ace3b0abcab294f32362d30"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173352,20 +173422,20 @@ rule MALPEDIA_Win_Plaintee_Auto : FILE
 		$sequence_9 = { 66ab aa b916000000 33c0 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Remexi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "19c1296a-4241-5074-a9c8-857410d4cc23"
+		id = "8f052e02-63b5-5b40-bc87-8aa5e3aee823"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remexi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.remexi_auto.yar#L1-L280"
 		license_url = "N/A"
-		logic_hash = "d7fd541a35f3fa538905c0988ed0ed78176c1f70ba37c8e34ed3bd3151c3e3a8"
+		logic_hash = "v1_sha256_d7fd541a35f3fa538905c0988ed0ed78176c1f70ba37c8e34ed3bd3151c3e3a8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -173412,20 +173482,20 @@ rule MALPEDIA_Win_Remexi_Auto : FILE
 		$sequence_30 = { 016b04 83c41c 5b 5e }
 
 	condition:
-		7 of them and filesize <614400
+		7 of them and filesize < 614400
 }
 rule MALPEDIA_Win_Necurs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a74d2a0-5b63-50c2-96d3-f0fbeed1b3d4"
+		id = "cfa209b3-a6ad-5890-a03a-94d2a7ae1600"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.necurs"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.necurs_auto.yar#L1-L154"
 		license_url = "N/A"
-		logic_hash = "1a877e35a35cc5b42dec49f688cab91a0513382e31843c1efea0701ab2d894e0"
+		logic_hash = "v1_sha256_1a877e35a35cc5b42dec49f688cab91a0513382e31843c1efea0701ab2d894e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173456,20 +173526,20 @@ rule MALPEDIA_Win_Necurs_Auto : FILE
 		$sequence_14 = { e9???????? 83caff 8bc2 e9???????? }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize < 475136
 }
 rule MALPEDIA_Win_Headertip_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "106ff000-576d-5d0d-a598-b9503a4cb801"
+		id = "b5b84ec6-e768-5a01-8d1f-e374c351e4ef"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.headertip"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.headertip_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "07b109a1a0d2271a95946a2e4133eb05992095f34ecb947954db0f3a5bf49d0e"
+		logic_hash = "v1_sha256_07b109a1a0d2271a95946a2e4133eb05992095f34ecb947954db0f3a5bf49d0e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173495,20 +173565,20 @@ rule MALPEDIA_Win_Headertip_Auto : FILE
 		$sequence_9 = { 8b4114 2b410c 03c6 ebea 56 }
 
 	condition:
-		7 of them and filesize <174080
+		7 of them and filesize < 174080
 }
 rule MALPEDIA_Win_Chir_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "93c47970-4fc6-58a0-955d-3bbd03cb7c7f"
+		id = "68722a90-4680-53e2-b9ed-f0bba27d6285"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chir"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chir_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "5c119df17edac6114f59bfe70ffc894c68fbc3a6604aa7943345ac49df6c4fce"
+		logic_hash = "v1_sha256_5c119df17edac6114f59bfe70ffc894c68fbc3a6604aa7943345ac49df6c4fce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173534,20 +173604,20 @@ rule MALPEDIA_Win_Chir_Auto : FILE
 		$sequence_9 = { 8d45f8 50 c745f840214125 c745fc32212400 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Nettraveler_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96950378-de52-56f3-b780-3b44898a07bb"
+		id = "2c62b6cc-3158-559b-8e3d-eb84c47d2000"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nettraveler"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nettraveler_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "874696e02901d10cd4804b0fe2c66596a287514a0c9a118564d29a023c32f51c"
+		logic_hash = "v1_sha256_874696e02901d10cd4804b0fe2c66596a287514a0c9a118564d29a023c32f51c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173573,20 +173643,20 @@ rule MALPEDIA_Win_Nettraveler_Auto : FILE
 		$sequence_9 = { 59 50 8d8580f1ffff 50 ff750c ff15???????? 8945fc }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Brbbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "90f3eca3-a8ac-5396-b696-f6c36e242527"
+		id = "e8857df8-d9ca-5caa-ae9b-b6e97ca7f4a1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brbbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.brbbot_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "01b7f091ad5c5584725e6a754a08338f9a2c33e3759aac15777f95b901cf8ec0"
+		logic_hash = "v1_sha256_01b7f091ad5c5584725e6a754a08338f9a2c33e3759aac15777f95b901cf8ec0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173612,20 +173682,20 @@ rule MALPEDIA_Win_Brbbot_Auto : FILE
 		$sequence_9 = { 33d2 897c2420 488be8 488906 ff15???????? 85c0 7506 }
 
 	condition:
-		7 of them and filesize <198656
+		7 of them and filesize < 198656
 }
 rule MALPEDIA_Win_Luca_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "719beb67-5539-58f6-b79d-9238d1f007ac"
+		id = "574ab628-1e50-57fd-8e94-6c02bc91fcfa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.luca_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.luca_stealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "2b38c28929c2cf366b6c27d4893332041148ce4dfc12e9c48178a2f3e634135c"
+		logic_hash = "v1_sha256_2b38c28929c2cf366b6c27d4893332041148ce4dfc12e9c48178a2f3e634135c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173651,20 +173721,20 @@ rule MALPEDIA_Win_Luca_Stealer_Auto : FILE
 		$sequence_9 = { eb02 31c0 4883c428 c3 488b01 488b4808 8b4010 }
 
 	condition:
-		7 of them and filesize <9285632
+		7 of them and filesize < 9285632
 }
 rule MALPEDIA_Win_Bundestrojaner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "22b55f6b-e040-5c18-ad23-824cbb63f192"
+		id = "d466bd32-ebf3-5cd4-b949-c7c40f96d83a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bundestrojaner"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bundestrojaner_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "4726f6c288ba39b565a7c1ba35f099303564bb770df1743f44ad4cd587b35c16"
+		logic_hash = "v1_sha256_4726f6c288ba39b565a7c1ba35f099303564bb770df1743f44ad4cd587b35c16"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173690,20 +173760,20 @@ rule MALPEDIA_Win_Bundestrojaner_Auto : FILE
 		$sequence_9 = { 8b56f8 33c3 8b1c8d187b0410 33c3 33c9 33c2 33d2 }
 
 	condition:
-		7 of them and filesize <729088
+		7 of them and filesize < 729088
 }
 rule MALPEDIA_Win_Avast_Disabler_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a09cca4-7cb6-5c97-b15b-4f7311a6621b"
+		id = "4666f3a0-be09-5f6f-8cc5-894e837283c4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avast_disabler"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.avast_disabler_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "19754a7bc503b1b28bdfc059b6eb230f6f3e29b2e990d8ace51bd954a83ec439"
+		logic_hash = "v1_sha256_19754a7bc503b1b28bdfc059b6eb230f6f3e29b2e990d8ace51bd954a83ec439"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173729,20 +173799,20 @@ rule MALPEDIA_Win_Avast_Disabler_Auto : FILE
 		$sequence_9 = { 5f 5e 5b 8be5 5d c20c00 3b0d???????? }
 
 	condition:
-		7 of them and filesize <41984
+		7 of them and filesize < 41984
 }
 rule MALPEDIA_Win_Unidentified_023_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f77c5286-0b1f-561f-8f58-a27a0408436a"
+		id = "0130a4e8-72dc-59f2-90e4-82b4b4922dfc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_023"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_023_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "1eec10f2afa6bd7e6a1d69558f2f25a771bedb385bd839fc0b4d5b578eec4086"
+		logic_hash = "v1_sha256_1eec10f2afa6bd7e6a1d69558f2f25a771bedb385bd839fc0b4d5b578eec4086"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173768,20 +173838,20 @@ rule MALPEDIA_Win_Unidentified_023_Auto : FILE
 		$sequence_9 = { 7514 8bf4 68???????? ff15???????? 3bf4 e8???????? b801000000 }
 
 	condition:
-		7 of them and filesize <1433600
+		7 of them and filesize < 1433600
 }
 rule MALPEDIA_Win_Neutrino_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7a087fc7-82b2-5ab1-84ba-f1736b808b97"
+		id = "c1cadfdf-5380-5aad-94eb-ce47c85a26bb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neutrino_pos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.neutrino_pos_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "018a5236bd48798fd0b76750c3d5d4efe90b9a49b4a1a51163482fa226bfcefe"
+		logic_hash = "v1_sha256_018a5236bd48798fd0b76750c3d5d4efe90b9a49b4a1a51163482fa226bfcefe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173807,20 +173877,20 @@ rule MALPEDIA_Win_Neutrino_Pos_Auto : FILE
 		$sequence_9 = { 6a72 668945a0 58 6a07 668945a2 58 66894d9a }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Virdetdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6e6bed26-b841-5f32-a122-ab8bbf6a241f"
+		id = "5586efae-7c0d-5c96-ba6a-f269c4d3b17d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virdetdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.virdetdoor_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "1295e76b0307a288c9ca8e40bd8de47b87983bee24b0a3d67ad5ac1b80c8e6e1"
+		logic_hash = "v1_sha256_1295e76b0307a288c9ca8e40bd8de47b87983bee24b0a3d67ad5ac1b80c8e6e1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173846,20 +173916,20 @@ rule MALPEDIA_Win_Virdetdoor_Auto : FILE
 		$sequence_9 = { 7524 390b 7720 3903 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Matryoshka_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b422383a-3b69-5e32-94a3-431dbc17291c"
+		id = "89059be5-531d-5672-bedd-b8c9fa746017"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matryoshka_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.matryoshka_rat_auto.yar#L1-L135"
 		license_url = "N/A"
-		logic_hash = "e0e5d3a7b6eaf0039b9fbb2e4baba63862f57599449a2c9f7b8481e16636b102"
+		logic_hash = "v1_sha256_e0e5d3a7b6eaf0039b9fbb2e4baba63862f57599449a2c9f7b8481e16636b102"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173889,20 +173959,20 @@ rule MALPEDIA_Win_Matryoshka_Rat_Auto : FILE
 		$sequence_13 = { 747d 83bc249000000000 7473 4c8d15d68ffdff }
 
 	condition:
-		7 of them and filesize <843776
+		7 of them and filesize < 843776
 }
 rule MALPEDIA_Win_Acr_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "27adbb62-681d-5315-be14-68aa5c14abca"
+		id = "8fa6da6e-80d5-5a5f-8094-c42521ae91e1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acr_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.acr_stealer_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "885dd5a2520c2a460bba6eeb3147670a114466803568b2f029aa5eef95499efd"
+		logic_hash = "v1_sha256_885dd5a2520c2a460bba6eeb3147670a114466803568b2f029aa5eef95499efd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173928,20 +173998,20 @@ rule MALPEDIA_Win_Acr_Stealer_Auto : FILE
 		$sequence_9 = { 79e9 8b55f8 41 03c1 2bf9 }
 
 	condition:
-		7 of them and filesize <1246208
+		7 of them and filesize < 1246208
 }
 rule MALPEDIA_Win_Cycbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0739459b-9989-5273-9ccc-a0e809393001"
+		id = "f50ec979-8f6a-5740-8114-427b01b36076"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cycbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cycbot_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5d47f4f5e3abd3b5df89c0d09b456bd0060fa6da83993d889b58fda1585abda3"
+		logic_hash = "v1_sha256_5d47f4f5e3abd3b5df89c0d09b456bd0060fa6da83993d889b58fda1585abda3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173967,20 +174037,20 @@ rule MALPEDIA_Win_Cycbot_Auto : FILE
 		$sequence_9 = { e8???????? ffb57cdeffff 8bf0 e8???????? 59 89b57cdeffff 8b9584deffff }
 
 	condition:
-		7 of them and filesize <1163264
+		7 of them and filesize < 1163264
 }
 rule MALPEDIA_Win_Evilpony_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c9372a6e-35c7-52f6-9c3d-299228c095b1"
+		id = "3d70ac01-f622-5677-82c3-ad6e6e544501"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilpony"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.evilpony_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "ffd9f8ba97fbd907290551898893cb44ef48c12bf2cd21edd5aa01ba36ae5a3e"
+		logic_hash = "v1_sha256_ffd9f8ba97fbd907290551898893cb44ef48c12bf2cd21edd5aa01ba36ae5a3e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174006,20 +174076,20 @@ rule MALPEDIA_Win_Evilpony_Auto : FILE
 		$sequence_9 = { 8b55b0 3345d8 2355ac 3345c4 894da8 d1c0 8945e4 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Doublefantasy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5fe3121c-5496-55ab-9366-675d7b098073"
+		id = "fe8520aa-91be-5590-82e3-121dd5650d27"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefantasy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.doublefantasy_auto.yar#L1-L176"
 		license_url = "N/A"
-		logic_hash = "a1a10ee4973cf324c6bb6108700a68b5d1131343a7e5a1c18b7924dc06048831"
+		logic_hash = "v1_sha256_a1a10ee4973cf324c6bb6108700a68b5d1131343a7e5a1c18b7924dc06048831"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174051,20 +174121,20 @@ rule MALPEDIA_Win_Doublefantasy_Auto : FILE
 		$sequence_15 = { 837df804 59 7426 6800002000 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize < 172032
 }
 rule MALPEDIA_Win_Alma_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aee3e7b2-c800-5626-b16d-a97379fcdea3"
+		id = "9ba44ee2-fb64-52b1-a486-abc3c20cb352"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_locker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.alma_locker_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "d029bcdb50f2458857c09101718554ffd09ec8e36a279b20a435629ea205a537"
+		logic_hash = "v1_sha256_d029bcdb50f2458857c09101718554ffd09ec8e36a279b20a435629ea205a537"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174090,20 +174160,20 @@ rule MALPEDIA_Win_Alma_Locker_Auto : FILE
 		$sequence_9 = { 8d4d08 e9???????? 8d8de8fbffff e9???????? 8d8dd0fbffff e9???????? }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize < 335872
 }
 rule MALPEDIA_Win_Darkpink_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b675ae58-304b-51cc-82c9-2d05a952daf3"
+		id = "5ddeb029-d9b9-5246-b24b-3918b253f590"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkpink"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkpink_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "ae61fd7de2751bb38bc52ea4bef7ef6d5cc9562894ba78123146d52f1f8217ba"
+		logic_hash = "v1_sha256_ae61fd7de2751bb38bc52ea4bef7ef6d5cc9562894ba78123146d52f1f8217ba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174129,20 +174199,20 @@ rule MALPEDIA_Win_Darkpink_Auto : FILE
 		$sequence_9 = { 8bcf 83e03f c1f906 6bd038 8b45fc 03148df09d4100 }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize < 237568
 }
 rule MALPEDIA_Elf_Hideandseek_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "98de3f6a-a564-55ea-8fed-c2f9d5e8c7a4"
+		id = "02b44a03-f9d7-5138-9475-44b755cfcd61"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hideandseek"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/elf.hideandseek_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "831bf70ed51337c7cfb50b54eee15779cbace8e90d2493dbccfcb114f36dd2a6"
+		logic_hash = "v1_sha256_831bf70ed51337c7cfb50b54eee15779cbace8e90d2493dbccfcb114f36dd2a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174168,20 +174238,20 @@ rule MALPEDIA_Elf_Hideandseek_Auto : FILE
 		$sequence_9 = { 83c410 e9???????? c7460c00000000 e9???????? 50 50 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize < 196608
 }
 rule MALPEDIA_Win_Meduza_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "53f96cd6-21f2-53a2-bbb8-b71563537ed2"
+		id = "8ca649a5-6060-5034-8da6-c369b84a6f26"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meduza"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.meduza_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "14b88dc41a5c318d90c279963aa5ad461ee65cb9acf5c901876d99dfeb325a5a"
+		logic_hash = "v1_sha256_14b88dc41a5c318d90c279963aa5ad461ee65cb9acf5c901876d99dfeb325a5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174207,20 +174277,20 @@ rule MALPEDIA_Win_Meduza_Auto : FILE
 		$sequence_9 = { 8b4dec c745e8d6352f2b 898590feffff 898d94feffff c745ec4a55cf55 8b45e8 8b4dec }
 
 	condition:
-		7 of them and filesize <1433600
+		7 of them and filesize < 1433600
 }
 rule MALPEDIA_Win_Cerbu_Miner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77652d6a-745f-5552-8901-83bf555706f4"
+		id = "c28c707f-3cfa-5946-867d-0356f5f1165b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cerbu_miner"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cerbu_miner_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "e4927a587588bc11053fcbade5bb9500364c9a656d383eb318cc8486464f3cce"
+		logic_hash = "v1_sha256_e4927a587588bc11053fcbade5bb9500364c9a656d383eb318cc8486464f3cce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174246,20 +174316,20 @@ rule MALPEDIA_Win_Cerbu_Miner_Auto : FILE
 		$sequence_9 = { 44 2bc0 44 8903 33c0 48 8b5c2438 }
 
 	condition:
-		7 of them and filesize <1040384
+		7 of them and filesize < 1040384
 }
 rule MALPEDIA_Win_Banpolmex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e5629b9-1e18-5205-b631-ad03c2ae43f0"
+		id = "84daa397-80c9-5b21-99af-ef22f5a63ea4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banpolmex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.banpolmex_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "e119b8f9656fb74b42241f31ba7dcd3e79fbd082cb37077b0109e5a58aed6af5"
+		logic_hash = "v1_sha256_e119b8f9656fb74b42241f31ba7dcd3e79fbd082cb37077b0109e5a58aed6af5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174285,20 +174355,20 @@ rule MALPEDIA_Win_Banpolmex_Auto : FILE
 		$sequence_9 = { 89442420 e8???????? 8bd8 33ff 85db 740f 488d15f8f40100 }
 
 	condition:
-		7 of them and filesize <1555456
+		7 of them and filesize < 1555456
 }
 rule MALPEDIA_Win_Maktub_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "10d37b97-d01f-5921-a99f-ff7dd2fcd55b"
+		id = "15107a3c-d308-5bdb-ae41-9cd65780bfc2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maktub"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.maktub_auto.yar#L1-L207"
 		license_url = "N/A"
-		logic_hash = "3c5d956147e4a1bdb902ea8258e01af6a03648debc316e3eed6aa86b46300c73"
+		logic_hash = "v1_sha256_3c5d956147e4a1bdb902ea8258e01af6a03648debc316e3eed6aa86b46300c73"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -174336,20 +174406,20 @@ rule MALPEDIA_Win_Maktub_Auto : FILE
 		$sequence_21 = { 8d4e50 e8???????? 8d4df0 e8???????? }
 
 	condition:
-		7 of them and filesize <3063808
+		7 of them and filesize < 3063808
 }
 rule MALPEDIA_Win_Mpkbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8f074133-bfc7-504a-bda1-097418743139"
+		id = "ba86ee30-db4b-5b88-b621-782cf7214138"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mpkbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mpkbot_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "011afed12d8733a7391f09eb1750e489d4da026e534c4eca601c4698788ee6ad"
+		logic_hash = "v1_sha256_011afed12d8733a7391f09eb1750e489d4da026e534c4eca601c4698788ee6ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174375,20 +174445,20 @@ rule MALPEDIA_Win_Mpkbot_Auto : FILE
 		$sequence_9 = { 8bf0 0fb7450c 50 0fb74508 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Xdspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e9ae860f-a2c7-565f-9217-a440882548d6"
+		id = "8666f60c-55a8-5e78-8824-b6a0f3f5bd48"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xdspy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xdspy_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "1f709444cf724d3961e54f18b66ae4023548e4088934cac26da730f0bde271d9"
+		logic_hash = "v1_sha256_1f709444cf724d3961e54f18b66ae4023548e4088934cac26da730f0bde271d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174420,20 +174490,20 @@ rule MALPEDIA_Win_Xdspy_Auto : FILE
 		$sequence_15 = { 33c9 660f1f440000 420fb6843968a21700 88840dc0280000 488d4901 84c0 }
 
 	condition:
-		7 of them and filesize <3244032
+		7 of them and filesize < 3244032
 }
 rule MALPEDIA_Win_Bart_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "47f2dba4-1ef6-5808-90b4-0ef4438e03a3"
+		id = "1da18ccf-6e47-5a71-b8a5-aa99f4a0666b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bart"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bart_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "b12024871014a9e86ab993e82383bdd8cbf27e2df488611e968a0202264b8904"
+		logic_hash = "v1_sha256_b12024871014a9e86ab993e82383bdd8cbf27e2df488611e968a0202264b8904"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174459,20 +174529,20 @@ rule MALPEDIA_Win_Bart_Auto : FILE
 		$sequence_9 = { 83f819 0f84ae000000 83ff23 0f84a5000000 83fe23 0f849c000000 83f823 }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize < 163840
 }
 rule MALPEDIA_Win_Quantloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "432b5f56-9f20-5011-836d-a160f44f614d"
+		id = "c0914381-4d6e-5ff8-bc04-cb7e563a6a38"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quantloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.quantloader_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "35c517bd3ba01671a26eeca12557e31f89943cd497a56be614b2b507cc9bda11"
+		logic_hash = "v1_sha256_35c517bd3ba01671a26eeca12557e31f89943cd497a56be614b2b507cc9bda11"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174504,20 +174574,20 @@ rule MALPEDIA_Win_Quantloader_Auto : FILE
 		$sequence_15 = { 39411c 74f7 ff711c 8f4550 e8???????? 8f411c }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Fishmaster_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c7f73382-0b3e-516e-ada8-2592a288859c"
+		id = "a656b04b-506b-56f2-9a00-395657f63e64"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fishmaster"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fishmaster_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "2d3700642fa743154e0272490d462793baad4e202db4b6b6f02f2c7c184ce851"
+		logic_hash = "v1_sha256_2d3700642fa743154e0272490d462793baad4e202db4b6b6f02f2c7c184ce851"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174543,20 +174613,20 @@ rule MALPEDIA_Win_Fishmaster_Auto : FILE
 		$sequence_9 = { 4883f801 721c 488d4101 48894310 4883fa10 488bc3 7203 }
 
 	condition:
-		7 of them and filesize <812032
+		7 of them and filesize < 812032
 }
 rule MALPEDIA_Win_Formbook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "241ced8d-1693-5841-a374-2686d8f6dbd5"
+		id = "06801701-a49f-562c-a2e3-0f8db9f9eb5c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.formbook_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "3380fbe26c3100d3b724659437582cb2b4b97057755a8459118372ab9a826cc2"
+		logic_hash = "v1_sha256_3380fbe26c3100d3b724659437582cb2b4b97057755a8459118372ab9a826cc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174582,20 +174652,20 @@ rule MALPEDIA_Win_Formbook_Auto : FILE
 		$sequence_9 = { 8b07 83c414 0345f8 5f 5e 5b }
 
 	condition:
-		7 of them and filesize <371712
+		7 of them and filesize < 371712
 }
 rule MALPEDIA_Win_Ncctrojan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73693e19-d3ac-5418-9f8a-95e68a6f57fb"
+		id = "6932aab6-96e5-5fdc-bd10-907a0d52afbe"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ncctrojan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ncctrojan_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "27c3caf8c915c86b411337145e185c50823300943eb40fbabcf07830267e1942"
+		logic_hash = "v1_sha256_27c3caf8c915c86b411337145e185c50823300943eb40fbabcf07830267e1942"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174627,20 +174697,20 @@ rule MALPEDIA_Win_Ncctrojan_Auto : FILE
 		$sequence_15 = { 50 e8???????? 6aff 8d4601 c645fc03 50 8d8518ffffff }
 
 	condition:
-		7 of them and filesize <1160192
+		7 of them and filesize < 1160192
 }
 rule MALPEDIA_Win_Pipcreat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8419290f-1015-5dec-8abc-87fb98932602"
+		id = "3b7f8697-8664-5075-bb27-523dd91f5ef3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipcreat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pipcreat_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "bfd77063c9003804a72d5e23f231f6f0ede323cbb3ca337d538e8165945eb11a"
+		logic_hash = "v1_sha256_bfd77063c9003804a72d5e23f231f6f0ede323cbb3ca337d538e8165945eb11a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174666,20 +174736,20 @@ rule MALPEDIA_Win_Pipcreat_Auto : FILE
 		$sequence_9 = { 6a00 8b0d???????? 6a00 8d442420 6a00 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Halfrig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62b21a07-3d27-5219-adbb-784980e8887e"
+		id = "f8e0ccfe-6958-5e3a-9b8f-9f0dc368c681"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.halfrig"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.halfrig_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "40d5c53e96f42e606a7012f83f1c1231408111cee8ecb6b2b8598f974593fa4a"
+		logic_hash = "v1_sha256_40d5c53e96f42e606a7012f83f1c1231408111cee8ecb6b2b8598f974593fa4a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174705,20 +174775,20 @@ rule MALPEDIA_Win_Halfrig_Auto : FILE
 		$sequence_9 = { 40883d???????? 4c893d???????? 488d8d30030000 488d059c5a0200 488bd6 660f1f840000000000 488d8980000000 }
 
 	condition:
-		7 of them and filesize <1369088
+		7 of them and filesize < 1369088
 }
 rule MALPEDIA_Win_Redsalt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5db28da0-c495-5a5e-81dd-226433bd91b1"
+		id = "7f41965c-76f5-52c6-8d11-70de0c5ca1ba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redsalt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.redsalt_auto.yar#L1-L223"
 		license_url = "N/A"
-		logic_hash = "5cb648a823e719ff50550ad2518a39d179f56511a84a79bfd6218be12b96b8b0"
+		logic_hash = "v1_sha256_5cb648a823e719ff50550ad2518a39d179f56511a84a79bfd6218be12b96b8b0"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -174759,20 +174829,20 @@ rule MALPEDIA_Win_Redsalt_Auto : FILE
 		$sequence_24 = { e8???????? 89442428 e9???????? 8b4c2420 8b442428 01c8 }
 
 	condition:
-		7 of them and filesize <2957312
+		7 of them and filesize < 2957312
 }
 rule MALPEDIA_Win_Tarsip_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee7f1e65-623e-5bf6-9501-f2cb0191dbfa"
+		id = "1ccf1990-5f9c-5a9f-be5e-7adc4bf29f61"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tarsip"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tarsip_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "250b7ade9271df7a85ec6b855f6cf5a10251a0f1952bae0fcefa6519af030f1e"
+		logic_hash = "v1_sha256_250b7ade9271df7a85ec6b855f6cf5a10251a0f1952bae0fcefa6519af030f1e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174798,20 +174868,20 @@ rule MALPEDIA_Win_Tarsip_Auto : FILE
 		$sequence_9 = { 52 e8???????? 83c414 eb10 6a0a 8d542404 52 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Sneepy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5ef3150e-2bf6-5a09-ba39-87be2aca4160"
+		id = "6d8e257d-a972-5c50-967e-fd0854f0ed09"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sneepy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sneepy_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "93bb250be962b8e39c384decdfc047f665d0471aa8b95be7ae603f090eace95c"
+		logic_hash = "v1_sha256_93bb250be962b8e39c384decdfc047f665d0471aa8b95be7ae603f090eace95c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174837,20 +174907,20 @@ rule MALPEDIA_Win_Sneepy_Auto : FILE
 		$sequence_9 = { 75f6 33c0 68???????? 8945cc 8845d0 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Hlux_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d5f33612-2e58-5a58-b025-51b8c84d8ab0"
+		id = "f82194b7-d11d-57e5-ba4e-75b05e390b3b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hlux"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hlux_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "6289602931f864ef390f887bdc3596feba8613d121e8e169b915693bee14e183"
+		logic_hash = "v1_sha256_6289602931f864ef390f887bdc3596feba8613d121e8e169b915693bee14e183"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174882,20 +174952,20 @@ rule MALPEDIA_Win_Hlux_Auto : FILE
 		$sequence_15 = { 0104b9 33c9 83c408 85c0 }
 
 	condition:
-		7 of them and filesize <3147776
+		7 of them and filesize < 3147776
 }
 rule MALPEDIA_Win_Fireball_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "56483242-91cf-583e-a311-f81ca06ce35e"
+		id = "042a5827-7947-57ff-813f-f39323f2a4e5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fireball"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fireball_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "c7846c89fcbe1ab5b4465cca84b35feb748c18b2402533bbb31c4b86c78dbc99"
+		logic_hash = "v1_sha256_c7846c89fcbe1ab5b4465cca84b35feb748c18b2402533bbb31c4b86c78dbc99"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174921,20 +174991,20 @@ rule MALPEDIA_Win_Fireball_Auto : FILE
 		$sequence_9 = { 0f94c0 5d c3 56 33f6 ffb6c8f62400 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize < 335872
 }
 rule MALPEDIA_Win_Vobfus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0a46ea97-451e-5b39-90ae-66d0e7a88052"
+		id = "adaa9240-c3b2-59e5-9aa7-9fd35e7c4d6f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vobfus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vobfus_auto.yar#L1-L223"
 		license_url = "N/A"
-		logic_hash = "cd307f59d811d28b88e7eec0e8a6b94fb0cf2bc6703d3faae8f6ec5a004bc423"
+		logic_hash = "v1_sha256_cd307f59d811d28b88e7eec0e8a6b94fb0cf2bc6703d3faae8f6ec5a004bc423"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -174974,20 +175044,20 @@ rule MALPEDIA_Win_Vobfus_Auto : FILE
 		$sequence_23 = { 00cf c0b200d1c3b600 e6d3 a1???????? 00ec }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize < 409600
 }
 rule MALPEDIA_Win_Grey_Energy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2194ec68-6952-5855-89b8-1a483c36ceb6"
+		id = "f8e6bfe7-0068-52bb-af70-f706e4d34f2d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grey_energy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.grey_energy_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "6dd36b9cf8b9672a3513055fe48f5d646f4ed637cb72460d1965a0ebc0972231"
+		logic_hash = "v1_sha256_6dd36b9cf8b9672a3513055fe48f5d646f4ed637cb72460d1965a0ebc0972231"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175019,20 +175089,20 @@ rule MALPEDIA_Win_Grey_Energy_Auto : FILE
 		$sequence_15 = { 57 ff75e8 ff75f0 ffd6 85c0 0f84b8000000 ff75fc }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize < 303104
 }
 rule MALPEDIA_Win_Conti_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0b096496-c6ee-577a-814c-51565da6533c"
+		id = "635e5e1e-01f2-56af-b388-a210b20025bb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.conti"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.conti_auto.yar#L1-L249"
 		license_url = "N/A"
-		logic_hash = "dcbcb23c478cd81647ea44a976b8893f9822f8475b35052b849cd9e3172bedaa"
+		logic_hash = "v1_sha256_dcbcb23c478cd81647ea44a976b8893f9822f8475b35052b849cd9e3172bedaa"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -175076,20 +175146,20 @@ rule MALPEDIA_Win_Conti_Auto : FILE
 		$sequence_27 = { 2bc8 884c3c21 48ffc7 4883ff04 }
 
 	condition:
-		7 of them and filesize <520192
+		7 of them and filesize < 520192
 }
 rule MALPEDIA_Win_Graphite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "22d6771d-6e02-5bad-92aa-7abf2f0540bc"
+		id = "ae960bce-c601-53a8-8f63-97be6a4c3a08"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphite"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.graphite_auto.yar#L1-L109"
 		license_url = "N/A"
-		logic_hash = "fac8314c02add0a1a3fcfc7bc6cd359f12eb58a8246911250bf475b51a803e3f"
+		logic_hash = "v1_sha256_fac8314c02add0a1a3fcfc7bc6cd359f12eb58a8246911250bf475b51a803e3f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175115,20 +175185,20 @@ rule MALPEDIA_Win_Graphite_Auto : FILE
 		$sequence_9 = { 81e2ff030000 81e1bf030000 83c940 c1e10a 0bca }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Lock_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66d7719a-09f7-5449-96c8-7a2badb35721"
+		id = "395de6c4-e666-5951-9bcc-efdf233b170c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lock_pos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lock_pos_auto.yar#L1-L147"
 		license_url = "N/A"
-		logic_hash = "68264cf97fe11e22f20de5aa9fd8236aae89e24686e8c6b06c621f87466b5d04"
+		logic_hash = "v1_sha256_68264cf97fe11e22f20de5aa9fd8236aae89e24686e8c6b06c621f87466b5d04"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175157,20 +175227,20 @@ rule MALPEDIA_Win_Lock_Pos_Auto : FILE
 		$sequence_12 = { 8b45dc 83e801 8945dc 85d2 0f843a010000 8b4df4 668b11 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize < 319488
 }
 rule MALPEDIA_Win_Pandabanker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "751a691a-c53d-5542-8dd0-6d6e61efc66b"
+		id = "efc7083e-687f-59d5-ab5b-a5bf91881fe9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandabanker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pandabanker_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "af183af405489953bbbd5be29d963fc77205c0eef74bef65d65833acc7e1921c"
+		logic_hash = "v1_sha256_af183af405489953bbbd5be29d963fc77205c0eef74bef65d65833acc7e1921c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175196,20 +175266,20 @@ rule MALPEDIA_Win_Pandabanker_Auto : FILE
 		$sequence_9 = { 88542412 80e380 88542411 8ae2 }
 
 	condition:
-		7 of them and filesize <417792
+		7 of them and filesize < 417792
 }
 rule MALPEDIA_Win_Dairy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "133b9699-4dcc-594b-b21a-95c3efab14f3"
+		id = "09dc291f-20d4-5d01-a428-4e35d201d297"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dairy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dairy_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "1c31903f94f05665f06e9add90cd1dfd10d14af78de58f211ffc3b43b0fd9163"
+		logic_hash = "v1_sha256_1c31903f94f05665f06e9add90cd1dfd10d14af78de58f211ffc3b43b0fd9163"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175235,20 +175305,20 @@ rule MALPEDIA_Win_Dairy_Auto : FILE
 		$sequence_9 = { 7437 8b442448 6a40 50 ffd6 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Mirage_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f68fe58b-43a1-51bc-9791-76dd178418d5"
+		id = "71c95716-ce27-525f-a561-5472ff8b2c6b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirage"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mirage_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "4d8628bd678dab095b081b63d7dce2fda51131fe49ad45959de9c07d1338533f"
+		logic_hash = "v1_sha256_4d8628bd678dab095b081b63d7dce2fda51131fe49ad45959de9c07d1338533f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175280,20 +175350,20 @@ rule MALPEDIA_Win_Mirage_Auto : FILE
 		$sequence_15 = { 7405 83f847 7517 8d860c010000 }
 
 	condition:
-		7 of them and filesize <1695744
+		7 of them and filesize < 1695744
 }
 rule MALPEDIA_Win_Hermeticwiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8b44d155-0791-5e5b-b54e-af128b883341"
+		id = "1fd9b098-460d-501c-9587-b2e0d7b4cdef"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwiper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hermeticwiper_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "17096a8aa2a5af71cd29251b2c3f7e9bb82649586a87a38d8e44cf9b2d8d68bd"
+		logic_hash = "v1_sha256_17096a8aa2a5af71cd29251b2c3f7e9bb82649586a87a38d8e44cf9b2d8d68bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175319,20 +175389,20 @@ rule MALPEDIA_Win_Hermeticwiper_Auto : FILE
 		$sequence_9 = { 8b542418 837b3400 7406 895340 }
 
 	condition:
-		7 of them and filesize <247808
+		7 of them and filesize < 247808
 }
 rule MALPEDIA_Win_Unidentified_042_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b7505cdf-3b67-54d1-b86a-09699ebba78c"
+		id = "027df964-4154-5d35-a8cf-dd8a3c6fc8d8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_042"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_042_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "e1a66a5b2b9486f9685ec5c1def3b62ee2d1680cb3c8b0c5674fcab890803964"
+		logic_hash = "v1_sha256_e1a66a5b2b9486f9685ec5c1def3b62ee2d1680cb3c8b0c5674fcab890803964"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175358,20 +175428,20 @@ rule MALPEDIA_Win_Unidentified_042_Auto : FILE
 		$sequence_9 = { 6824a4e360 681c781e53 6890000000 6a01 6a02 e8???????? 8b4df8 }
 
 	condition:
-		7 of them and filesize <516096
+		7 of them and filesize < 516096
 }
 rule MALPEDIA_Win_Carbanak_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "34d24f6c-b1d1-51ed-9905-23e69a560a3f"
+		id = "67956756-2b32-57d0-9b44-baa278e29e75"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carbanak"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.carbanak_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "fa6cd9a85a7bf81411d9c274df92be474253e26394edfb9f41f2cdb268401124"
+		logic_hash = "v1_sha256_fa6cd9a85a7bf81411d9c274df92be474253e26394edfb9f41f2cdb268401124"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175398,20 +175468,20 @@ rule MALPEDIA_Win_Carbanak_Auto : FILE
 		$sequence_10 = { 56 8b7510 8bc6 83e001 83e602 57 }
 
 	condition:
-		7 of them and filesize <658432
+		7 of them and filesize < 658432
 }
 rule MALPEDIA_Win_Sfile_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "75155690-b8c4-56cb-a521-79ec01661bb7"
+		id = "c44a9bc0-6e11-5171-86e9-267488bd0e57"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sfile"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sfile_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "f10b431d07234874e195b1e87ba788840300f4cb0ead711972642011468c2ef8"
+		logic_hash = "v1_sha256_f10b431d07234874e195b1e87ba788840300f4cb0ead711972642011468c2ef8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175437,20 +175507,20 @@ rule MALPEDIA_Win_Sfile_Auto : FILE
 		$sequence_9 = { 8b4204 ffd0 8b4df8 c7412000000000 833d????????ff }
 
 	condition:
-		7 of them and filesize <588800
+		7 of them and filesize < 588800
 }
 rule MALPEDIA_Win_Dripion_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b0867d7f-74aa-587d-b520-fed580730ed1"
+		id = "29a2363b-47e1-5081-8dcf-e9b29dc3038c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dripion"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dripion_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "b54fd3ad608c7c63f9361c36ed20fa92f663e8b7a12233b0f074e7ff124b365a"
+		logic_hash = "v1_sha256_b54fd3ad608c7c63f9361c36ed20fa92f663e8b7a12233b0f074e7ff124b365a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175476,20 +175546,20 @@ rule MALPEDIA_Win_Dripion_Auto : FILE
 		$sequence_9 = { 8bf8 ffd6 0faff8 ffd6 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Tiny_Turla_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cbc30228-0e4c-5d86-b8e7-6b44a66c67bf"
+		id = "6b03753b-dc7e-5e81-a795-bccaf0fe1f35"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiny_turla"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tiny_turla_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "b2b8f5dd8c24eb98beaa2120ec3707c14594804ade8ee0e436beafc526cfc343"
+		logic_hash = "v1_sha256_b2b8f5dd8c24eb98beaa2120ec3707c14594804ade8ee0e436beafc526cfc343"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175515,20 +175585,20 @@ rule MALPEDIA_Win_Tiny_Turla_Auto : FILE
 		$sequence_9 = { 488d5e10 488bcb e8???????? 4c8933 32db e9???????? 488bcf }
 
 	condition:
-		7 of them and filesize <51200
+		7 of them and filesize < 51200
 }
 rule MALPEDIA_Win_Mortis_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "795aebf5-a47f-5442-8167-7bfad8d933e5"
+		id = "9ec696bc-184a-5a6f-b0bd-8259fad51a32"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mortis"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mortis_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "aab52de125cd03f4e28839f7c33e3b05d109e77cc3c335759a1d782c52454873"
+		logic_hash = "v1_sha256_aab52de125cd03f4e28839f7c33e3b05d109e77cc3c335759a1d782c52454873"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175554,20 +175624,20 @@ rule MALPEDIA_Win_Mortis_Auto : FILE
 		$sequence_9 = { eb34 b916000000 3bf1 0f42f1 8d4e01 }
 
 	condition:
-		7 of them and filesize <577536
+		7 of them and filesize < 577536
 }
 rule MALPEDIA_Win_Dadjoke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7e6ed0b6-d7e2-510d-b9a1-64b59097a88b"
+		id = "4edfb348-18e2-5aa7-9ff9-6eda282ec51e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dadjoke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dadjoke_auto.yar#L1-L236"
 		license_url = "N/A"
-		logic_hash = "012b91fdf9c20cf8af04f39b868e60895f8a732788d300f19ff99d8e0ff61772"
+		logic_hash = "v1_sha256_012b91fdf9c20cf8af04f39b868e60895f8a732788d300f19ff99d8e0ff61772"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -175606,20 +175676,20 @@ rule MALPEDIA_Win_Dadjoke_Auto : FILE
 		$sequence_22 = { 833d????????00 0f857c0e0000 8d0da0c37400 ba1b000000 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize < 344064
 }
 rule MALPEDIA_Win_Gibberish_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "865bad8c-5684-533c-98cd-44918d4d88e8"
+		id = "f311f24d-f72c-5d62-a55d-f5cb6ee3766d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gibberish"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gibberish_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "c8df032f5625050a647f354eb2ac9a0b117355c598425d253e17209609dc1370"
+		logic_hash = "v1_sha256_c8df032f5625050a647f354eb2ac9a0b117355c598425d253e17209609dc1370"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175645,20 +175715,20 @@ rule MALPEDIA_Win_Gibberish_Auto : FILE
 		$sequence_9 = { 25ff000000 83c001 25fe010000 f20f593c85e0dc4500 660f122c85e0dc4500 03c0 }
 
 	condition:
-		7 of them and filesize <1068032
+		7 of them and filesize < 1068032
 }
 rule MALPEDIA_Win_Carberp_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0a8c5eae-e871-515f-938c-f71747cf4ace"
+		id = "0ae31eea-0e8a-561c-a29f-69a0edfd31ea"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carberp"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.carberp_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "7591c0ae0d97018ab7f451ed94881b2aa3238758f2aeec163b32e54490fa5153"
+		logic_hash = "v1_sha256_7591c0ae0d97018ab7f451ed94881b2aa3238758f2aeec163b32e54490fa5153"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175684,20 +175754,20 @@ rule MALPEDIA_Win_Carberp_Auto : FILE
 		$sequence_9 = { ff75fc e8???????? 59 385d0f 0f843c010000 e8???????? 84c0 }
 
 	condition:
-		7 of them and filesize <491520
+		7 of them and filesize < 491520
 }
 rule MALPEDIA_Win_Orangeade_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a790e493-320f-57de-9b62-d13796c94676"
+		id = "c49be8e7-6dae-5bee-8067-e7a23d224870"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orangeade"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.orangeade_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "bc9cfd6680cc4f32cd41e9edf43afa43b54975c598906df96ea95e31fa6c1612"
+		logic_hash = "v1_sha256_bc9cfd6680cc4f32cd41e9edf43afa43b54975c598906df96ea95e31fa6c1612"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175723,20 +175793,20 @@ rule MALPEDIA_Win_Orangeade_Auto : FILE
 		$sequence_9 = { 50 8d4c2410 c684248400000001 e8???????? }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Chiser_Client_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f565e008-ef7c-5843-a15a-c3b17611be9c"
+		id = "2d6638f7-176b-58d9-80f3-623f25aa8741"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chiser_client"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chiser_client_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "4cf569331733e568f50794a1dc9bdd96595cb2c255defe55202f75e9deeee12b"
+		logic_hash = "v1_sha256_4cf569331733e568f50794a1dc9bdd96595cb2c255defe55202f75e9deeee12b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175762,20 +175832,20 @@ rule MALPEDIA_Win_Chiser_Client_Auto : FILE
 		$sequence_9 = { 4883ec20 488bd9 488bc2 488d0dd9150200 48890b 488d5308 33c9 }
 
 	condition:
-		7 of them and filesize <714752
+		7 of them and filesize < 714752
 }
 rule MALPEDIA_Win_Simplefilemover_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "14bdd8f8-6142-5a38-9205-708716e93989"
+		id = "29a8a8b2-0e5e-5ea0-aad0-87c3d1f70421"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.simplefilemover"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.simplefilemover_auto.yar#L1-L222"
 		license_url = "N/A"
-		logic_hash = "6035737199462cdcfa6d56d9e4b447822bb430a938cb907f7ba0f0edbb7456df"
+		logic_hash = "v1_sha256_6035737199462cdcfa6d56d9e4b447822bb430a938cb907f7ba0f0edbb7456df"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -175813,20 +175883,20 @@ rule MALPEDIA_Win_Simplefilemover_Auto : FILE
 		$sequence_21 = { 42 6685c0 75ea 85f6 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Oceansalt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "191b2018-8ac3-5133-a29f-db070c527bb4"
+		id = "384e04ac-7381-5d4d-ad86-225fbde7de3f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oceansalt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.oceansalt_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "618191320109f3ef06ff0a1fecf4d89247c2a03c9ed872381bb347fb4c387d8b"
+		logic_hash = "v1_sha256_618191320109f3ef06ff0a1fecf4d89247c2a03c9ed872381bb347fb4c387d8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175858,20 +175928,20 @@ rule MALPEDIA_Win_Oceansalt_Auto : FILE
 		$sequence_15 = { 7d1a 4863cf 8a84191d010000 42888401202e0100 ffc7 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Mbrlock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cc094c21-b137-5d7e-ad7a-b11c96748bb2"
+		id = "f69857b1-0b65-5508-858d-3e7a45ffc760"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mbrlock"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mbrlock_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "491b9f4fb168bceb19b5cf7b6c98ee71ee5564cadbcb31d189925e8a478d4bf3"
+		logic_hash = "v1_sha256_491b9f4fb168bceb19b5cf7b6c98ee71ee5564cadbcb31d189925e8a478d4bf3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175897,20 +175967,20 @@ rule MALPEDIA_Win_Mbrlock_Auto : FILE
 		$sequence_9 = { c1e602 8932 5e b801000000 5b c21800 33c9 }
 
 	condition:
-		7 of them and filesize <2031616
+		7 of them and filesize < 2031616
 }
 rule MALPEDIA_Win_Getmypass_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ef24a38-2dcf-5e36-ba94-2bb1b309bc31"
+		id = "6f5f66e5-9556-5c37-b6a1-f3232e7818ba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.getmypass"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.getmypass_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "942b395c1b2d446c948aa0d6582010011bc502a4c907e5ca48324090ba079bd9"
+		logic_hash = "v1_sha256_942b395c1b2d446c948aa0d6582010011bc502a4c907e5ca48324090ba079bd9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175936,20 +176006,20 @@ rule MALPEDIA_Win_Getmypass_Auto : FILE
 		$sequence_9 = { 80c201 8b85f4feffff 889405f8feffff ebb4 c745fc00000000 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Erebus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb1eb465-4db1-53de-8a86-97595b0c4304"
+		id = "ce985cf2-72b0-574d-b67e-45813c5238cd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.erebus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.erebus_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "f2c3fac68e77b34a8cb144aa7557b3180cfb2d2c5f88070b47f30c977edf0360"
+		logic_hash = "v1_sha256_f2c3fac68e77b34a8cb144aa7557b3180cfb2d2c5f88070b47f30c977edf0360"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175975,20 +176045,20 @@ rule MALPEDIA_Win_Erebus_Auto : FILE
 		$sequence_9 = { 7405 2bea 896b10 8b4c2440 64890d00000000 59 }
 
 	condition:
-		7 of them and filesize <2564096
+		7 of them and filesize < 2564096
 }
 rule MALPEDIA_Win_Applejeus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a96317b4-bd12-5fff-be15-1f3be0768b07"
+		id = "479adaa5-9fcf-5ddc-b0e2-42f413cbdb83"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.applejeus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.applejeus_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "c4add26ff07d848a7e42bd144b883577737cbad9e67d1f7f5e019bb64cfa0808"
+		logic_hash = "v1_sha256_c4add26ff07d848a7e42bd144b883577737cbad9e67d1f7f5e019bb64cfa0808"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176014,20 +176084,20 @@ rule MALPEDIA_Win_Applejeus_Auto : FILE
 		$sequence_9 = { 8885c9f6ffff 8b8560f6ffff 0466 83f053 8885caf6ffff 8b8560f6ffff 0467 }
 
 	condition:
-		7 of them and filesize <1245184
+		7 of them and filesize < 1245184
 }
 rule MALPEDIA_Win_Gandcrab_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b13655d9-7544-5839-87c5-fd4e5e753f37"
+		id = "48f66ebe-edff-5699-8cd5-6ab32fe62c37"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gandcrab"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gandcrab_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "cdc40f7d17830a090b941b5f5b366bcc6036a417302630b2621031aa8f4178c1"
+		logic_hash = "v1_sha256_cdc40f7d17830a090b941b5f5b366bcc6036a417302630b2621031aa8f4178c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176053,20 +176123,20 @@ rule MALPEDIA_Win_Gandcrab_Auto : FILE
 		$sequence_9 = { 837f3c00 741b ff7744 ff15???????? ff7740 8bf0 ff15???????? }
 
 	condition:
-		7 of them and filesize <1024000
+		7 of them and filesize < 1024000
 }
 rule MALPEDIA_Win_Svcready_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9d907139-c144-5614-a62a-7c32470debfc"
+		id = "ec97dd40-8d53-5a18-920b-334bcb64cc4f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.svcready"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.svcready_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "d564083fd80540ab82e35300283080c4f0bdfd997ccd9dbb29372661ffd56646"
+		logic_hash = "v1_sha256_d564083fd80540ab82e35300283080c4f0bdfd997ccd9dbb29372661ffd56646"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176092,20 +176162,20 @@ rule MALPEDIA_Win_Svcready_Auto : FILE
 		$sequence_9 = { 50 ff760c ff15???????? 6a06 8d4c2424 51 }
 
 	condition:
-		7 of them and filesize <1187840
+		7 of them and filesize < 1187840
 }
 rule MALPEDIA_Win_Blackcoffee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4f36c9cd-a889-561b-ae61-a577c98570f5"
+		id = "754067c0-582c-5910-adbb-5a90ef6e3550"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcoffee"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blackcoffee_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "0bd95226ab3597279ec9c63042069446fb610a5d850507e2f23654627aa44494"
+		logic_hash = "v1_sha256_0bd95226ab3597279ec9c63042069446fb610a5d850507e2f23654627aa44494"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176131,20 +176201,20 @@ rule MALPEDIA_Win_Blackcoffee_Auto : FILE
 		$sequence_9 = { 8365fc00 83c010 6a04 50 8d45fc 50 }
 
 	condition:
-		7 of them and filesize <118784
+		7 of them and filesize < 118784
 }
 rule MALPEDIA_Win_Firechili_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "559e09c8-5cc7-5636-8b29-09d353ae6b28"
+		id = "58cb718c-1874-56bc-802f-2b048af5efec"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.firechili"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.firechili_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "c22cf39b407e9812d354a7c986ef996dc279b9f043abb338a1580b523e11c3e8"
+		logic_hash = "v1_sha256_c22cf39b407e9812d354a7c986ef996dc279b9f043abb338a1580b523e11c3e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176170,20 +176240,20 @@ rule MALPEDIA_Win_Firechili_Auto : FILE
 		$sequence_9 = { 488d0d7d490000 ff15???????? 488b7c2430 33c0 48894308 }
 
 	condition:
-		7 of them and filesize <91136
+		7 of them and filesize < 91136
 }
 rule MALPEDIA_Win_Laturo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "81276e33-698e-507e-b345-8c9c243babc3"
+		id = "b42f6147-f901-582c-ac21-e1f314ab0dbf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laturo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.laturo_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "3a95665a0f62c0e6d122fab4ca77fec299db1ff67fd03f39a710232d9c73dd0f"
+		logic_hash = "v1_sha256_3a95665a0f62c0e6d122fab4ca77fec299db1ff67fd03f39a710232d9c73dd0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176215,20 +176285,20 @@ rule MALPEDIA_Win_Laturo_Auto : FILE
 		$sequence_15 = { 56 57 ff15???????? 894514 85c0 784d 83ff05 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Kasperagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "340f4639-6fe5-58b0-bb8f-f62f0676eeb4"
+		id = "6066f019-78f6-5dde-9e11-360fd5cd65b0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kasperagent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kasperagent_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "64254218e6067b681b9ff76df50b8965f4daccd1f710c2911946f314fae43e64"
+		logic_hash = "v1_sha256_64254218e6067b681b9ff76df50b8965f4daccd1f710c2911946f314fae43e64"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176254,20 +176324,20 @@ rule MALPEDIA_Win_Kasperagent_Auto : FILE
 		$sequence_9 = { 2bc1 33d2 d1f8 2bf0 668911 8bce 781a }
 
 	condition:
-		7 of them and filesize <1605632
+		7 of them and filesize < 1605632
 }
 rule MALPEDIA_Win_Naikon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9a0d1ff4-6123-5ada-8c4c-3a20072403a8"
+		id = "79fc8087-cefa-5a6e-b5f7-b595e73590f1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.naikon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.naikon_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "482df4e8a690a40d5dd089da89ade7d874a9359b42eeeb91d9707824c08e20e9"
+		logic_hash = "v1_sha256_482df4e8a690a40d5dd089da89ade7d874a9359b42eeeb91d9707824c08e20e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176293,20 +176363,20 @@ rule MALPEDIA_Win_Naikon_Auto : FILE
 		$sequence_9 = { 8b85a8fcffff 83e010 3c10 7503 6a01 5e }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Unidentified_098_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77dc1ff9-dd3d-5bc9-85b5-203dd4f53718"
+		id = "b8a123c2-35eb-5690-a285-d8b14f715c4b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_098"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_098_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0219ee65046a1130cad6fddadbb5a6a530711c105dcd628abbc82d2c03f62f83"
+		logic_hash = "v1_sha256_0219ee65046a1130cad6fddadbb5a6a530711c105dcd628abbc82d2c03f62f83"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176332,20 +176402,20 @@ rule MALPEDIA_Win_Unidentified_098_Auto : FILE
 		$sequence_9 = { bd01000000 e9???????? 4889c1 e8???????? 498b06 4c89f1 ff5008 }
 
 	condition:
-		7 of them and filesize <3345408
+		7 of them and filesize < 3345408
 }
 rule MALPEDIA_Win_Pillowmint_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c0d8452f-d73d-5e3b-840b-1f0850b1a270"
+		id = "3e09c794-1f8d-5d8b-bc07-5fa8691d8cf6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pillowmint"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pillowmint_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "ae66a0e7e95b7c87f1f3ab1ab6c5145cf23dd8e31b81c9730156e18b839d9281"
+		logic_hash = "v1_sha256_ae66a0e7e95b7c87f1f3ab1ab6c5145cf23dd8e31b81c9730156e18b839d9281"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176371,20 +176441,20 @@ rule MALPEDIA_Win_Pillowmint_Auto : FILE
 		$sequence_9 = { 488b0d???????? 488bc3 48894908 488b0d???????? 488909 488b0d???????? 48894910 }
 
 	condition:
-		7 of them and filesize <4667392
+		7 of them and filesize < 4667392
 }
 rule MALPEDIA_Win_Krbanker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9a0cf891-270c-5b18-9c0c-11605a809801"
+		id = "524a4d15-c73b-5901-b364-39d2d0c75563"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.krbanker_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "3f68b288c9b94489462004d900c99f82c6cc93e611f88ed341834ce27199e0a6"
+		logic_hash = "v1_sha256_3f68b288c9b94489462004d900c99f82c6cc93e611f88ed341834ce27199e0a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176410,20 +176480,20 @@ rule MALPEDIA_Win_Krbanker_Auto : FILE
 		$sequence_9 = { 6801010080 6a00 6870000000 6801000000 bb40010000 }
 
 	condition:
-		7 of them and filesize <1826816
+		7 of them and filesize < 1826816
 }
 rule MALPEDIA_Win_Zhcat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "632a3d5c-2d89-5179-ac16-c2aceba5bbfa"
+		id = "c2bc1fff-421e-5047-b02c-5f5359c3dd4c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zhcat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zhcat_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "1660d8f51e51dd71d6a1d9261fb6addc44fa7696401b7d8f6127a7c99ca1c719"
+		logic_hash = "v1_sha256_1660d8f51e51dd71d6a1d9261fb6addc44fa7696401b7d8f6127a7c99ca1c719"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176449,20 +176519,20 @@ rule MALPEDIA_Win_Zhcat_Auto : FILE
 		$sequence_9 = { 8bfb f3a5 66a5 7424 }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize < 376832
 }
 rule MALPEDIA_Win_Lemonduck_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "79120d9c-8a0d-5155-9a06-2a2421d4dbd2"
+		id = "8f75d9c6-9c63-50d2-8bfb-814ce9f41abb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lemonduck"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lemonduck_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "54774a4a200c3b8a4ce7eb935c4745902b9f773eeb8d215043530b937c7a7753"
+		logic_hash = "v1_sha256_54774a4a200c3b8a4ce7eb935c4745902b9f773eeb8d215043530b937c7a7753"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176488,20 +176558,20 @@ rule MALPEDIA_Win_Lemonduck_Auto : FILE
 		$sequence_9 = { eb22 488d1d912c1400 eb19 488d1d702c1400 eb10 488d1d9f2c1400 eb07 }
 
 	condition:
-		7 of them and filesize <10011648
+		7 of them and filesize < 10011648
 }
 rule MALPEDIA_Win_Bhunt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "29e82532-7a8f-57df-9bb4-9a79fe2adcb0"
+		id = "4e8fc656-5465-56b2-a007-108f7040a5b2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bhunt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bhunt_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "a7325d2f342b2d438ae4157b93fee930a25dcbfe35ec458ac01a26d195b6e98d"
+		logic_hash = "v1_sha256_a7325d2f342b2d438ae4157b93fee930a25dcbfe35ec458ac01a26d195b6e98d"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -176527,20 +176597,20 @@ rule MALPEDIA_Win_Bhunt_Auto : FILE
 		$sequence_9 = { c1e21c 33db c1ef04 0bd8 8b04cd68fa4400 0bd7 8bfa }
 
 	condition:
-		7 of them and filesize <19161088
+		7 of them and filesize < 19161088
 }
 rule MALPEDIA_Win_Cherry_Picker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "85645a18-926d-5b0e-9fa0-dbb70398619f"
+		id = "fc0588f9-96be-590a-b523-b9444fee3ae8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cherry_picker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cherry_picker_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "d063fae0bccc43dbf0d60b6c18c60c6de12439bcf31003957c363036cbe5a98f"
+		logic_hash = "v1_sha256_d063fae0bccc43dbf0d60b6c18c60c6de12439bcf31003957c363036cbe5a98f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176566,20 +176636,20 @@ rule MALPEDIA_Win_Cherry_Picker_Auto : FILE
 		$sequence_9 = { 6aff 50 ffd3 6a00 6a00 }
 
 	condition:
-		7 of them and filesize <712704
+		7 of them and filesize < 712704
 }
 rule MALPEDIA_Win_Unidentified_096_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ffd5cfa4-f468-5327-a209-b875a1aa7db9"
+		id = "3fa4d580-a450-52ac-b23a-38c6609ee495"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_096"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_096_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "d9d15c86fa946b0e45aa738b5898be2be607aa89def00775e64a1c8735fb15f8"
+		logic_hash = "v1_sha256_d9d15c86fa946b0e45aa738b5898be2be607aa89def00775e64a1c8735fb15f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176605,20 +176675,20 @@ rule MALPEDIA_Win_Unidentified_096_Auto : FILE
 		$sequence_9 = { f644240c01 7409 8ac1 2c30 a2???????? 6683f96a 723b }
 
 	condition:
-		7 of them and filesize <25648
+		7 of them and filesize < 25648
 }
 rule MALPEDIA_Win_Postnaptea_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bae1adbd-4c25-5db5-ad59-5851d74e85fc"
+		id = "a2e71d97-d932-58eb-b54b-bf6affe63f36"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.postnaptea"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.postnaptea_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "67d33b8cfdd7ab58e5e7ea5ee0e718fa9e407a5184249ea4dfd2464e78e03ab8"
+		logic_hash = "v1_sha256_67d33b8cfdd7ab58e5e7ea5ee0e718fa9e407a5184249ea4dfd2464e78e03ab8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176644,20 +176714,20 @@ rule MALPEDIA_Win_Postnaptea_Auto : FILE
 		$sequence_9 = { c745a401000000 c74424300af51ff5 c744243409f50af5 c744243814f51df5 c744243c1af53ff5 c74424402ff523f5 c74424442ef521f5 }
 
 	condition:
-		7 of them and filesize <2457600
+		7 of them and filesize < 2457600
 }
 rule MALPEDIA_Win_Duqu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "424302fc-6577-56a8-8823-f2003c48bc5c"
+		id = "812e8f17-c8e5-549a-a592-f34edea3c2ed"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duqu"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.duqu_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "c898aec26da15be1184cad51dbcbbea7d5de6c2fe0a6afa2af1a2af031fa3007"
+		logic_hash = "v1_sha256_c898aec26da15be1184cad51dbcbbea7d5de6c2fe0a6afa2af1a2af031fa3007"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176689,20 +176759,20 @@ rule MALPEDIA_Win_Duqu_Auto : FILE
 		$sequence_15 = { 8bec 51 56 57 894dfc 8bfa b22e }
 
 	condition:
-		7 of them and filesize <18759680
+		7 of them and filesize < 18759680
 }
 rule MALPEDIA_Win_Unidentified_081_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4bef4e35-3450-5f50-98ad-424279417112"
+		id = "6a228783-8925-57e5-ad27-ceedd6726af5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_081"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_081_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "0bf113d92abe743278ae5a94b3d8f7a48f5ba7f91d2e79f1d3ac361b6c786f4e"
+		logic_hash = "v1_sha256_0bf113d92abe743278ae5a94b3d8f7a48f5ba7f91d2e79f1d3ac361b6c786f4e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176728,20 +176798,20 @@ rule MALPEDIA_Win_Unidentified_081_Auto : FILE
 		$sequence_9 = { ff15???????? 837c241001 7507 b101 e8???????? 8b35???????? }
 
 	condition:
-		7 of them and filesize <273408
+		7 of them and filesize < 273408
 }
 rule MALPEDIA_Win_Squirrelwaffle_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c61157f1-60e2-5b06-a116-a20987079807"
+		id = "258eaeba-d5fa-5b93-b719-0e1dee290aa8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.squirrelwaffle"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.squirrelwaffle_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "9eaea34205659a464bf5b301bb94e11eb962293c24be78788f1b35d437de22a1"
+		logic_hash = "v1_sha256_9eaea34205659a464bf5b301bb94e11eb962293c24be78788f1b35d437de22a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176767,20 +176837,20 @@ rule MALPEDIA_Win_Squirrelwaffle_Auto : FILE
 		$sequence_9 = { c645cc00 8d4dd8 ff75cc 6a08 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Mimikatz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7f63ff96-1e0a-5197-8a45-285738861f05"
+		id = "87e55939-0147-5ea3-8078-ba71cea41190"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mimikatz"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mimikatz_auto.yar#L1-L204"
 		license_url = "N/A"
-		logic_hash = "55557ae737b34b617581092058134efff316e946e4bd0657345c0e9223ab37a5"
+		logic_hash = "v1_sha256_55557ae737b34b617581092058134efff316e946e4bd0657345c0e9223ab37a5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -176818,20 +176888,20 @@ rule MALPEDIA_Win_Mimikatz_Auto : FILE
 		$sequence_21 = { 0fb6c8 51 e8???????? 83c404 85c0 7510 }
 
 	condition:
-		7 of them and filesize <1642496
+		7 of them and filesize < 1642496
 }
 rule MALPEDIA_Win_Backspace_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "74f06e56-cb1b-558b-a9a6-675b90898d32"
+		id = "96cf2188-d07c-593b-8e9a-b3c23d8f191a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backspace"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.backspace_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "1f557e82713be82d4effefb67945984b55368207555daca9d42390f29b2b045a"
+		logic_hash = "v1_sha256_1f557e82713be82d4effefb67945984b55368207555daca9d42390f29b2b045a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176857,20 +176927,20 @@ rule MALPEDIA_Win_Backspace_Auto : FILE
 		$sequence_9 = { 85c0 742b 53 ff15???????? 50 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Hodur_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1836cfc6-54d1-596d-bd26-13def8f48ebb"
+		id = "a0f504a5-6b25-5d8d-b2a6-c203af8ae5fa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hodur"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hodur_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "10960e958b4b7c8c59844799eda78e681e350f46bd3cc75a9f3f73ad5cb0c26d"
+		logic_hash = "v1_sha256_10960e958b4b7c8c59844799eda78e681e350f46bd3cc75a9f3f73ad5cb0c26d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176896,20 +176966,20 @@ rule MALPEDIA_Win_Hodur_Auto : FILE
 		$sequence_9 = { 81ec30010000 b8f4ffffff c7442406b792a0b4 c744240ab4a1a6a4 c744240e8eb49a00 c7042400000000 c74424141c010000 }
 
 	condition:
-		7 of them and filesize <1067008
+		7 of them and filesize < 1067008
 }
 rule MALPEDIA_Win_Turla_Silentmoon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3bd3f75c-66e7-530a-b900-053594c9b821"
+		id = "800b04cb-416f-5226-9597-f5d2ecb151ed"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_silentmoon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.turla_silentmoon_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "1fa09fbf5696dc9d66cc7dcda76511a0b5324dc46891c26079664b06f37ad447"
+		logic_hash = "v1_sha256_1fa09fbf5696dc9d66cc7dcda76511a0b5324dc46891c26079664b06f37ad447"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176935,20 +177005,20 @@ rule MALPEDIA_Win_Turla_Silentmoon_Auto : FILE
 		$sequence_9 = { 8b4510 8d7c50fc 33c0 66894704 8b450c 0fb60410 c1f908 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Agent_Btz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16f92e8e-8ed3-5d53-b4f6-23ff2aafa84a"
+		id = "53459619-19e0-562d-868a-b7a43e291261"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.agent_btz_auto.yar#L1-L501"
 		license_url = "N/A"
-		logic_hash = "267846e6f96c5156f52d43399a19aa0f1974b0f38d3edac082778780cdba135e"
+		logic_hash = "v1_sha256_267846e6f96c5156f52d43399a19aa0f1974b0f38d3edac082778780cdba135e"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -177023,20 +177093,20 @@ rule MALPEDIA_Win_Agent_Btz_Auto : FILE
 		$sequence_58 = { 013d???????? 8b04b5100b4200 0500080000 3bc8 }
 
 	condition:
-		7 of them and filesize <5577728
+		7 of them and filesize < 5577728
 }
 rule MALPEDIA_Win_Sanny_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "71ee291c-39d8-5317-9103-639480e4514a"
+		id = "5eb662b8-db29-52bd-8162-2b020ac4b7d4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sanny"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sanny_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "ae770490b83cd065ad50cf06c242577c788775793cde0b9ec9f8ad204369466f"
+		logic_hash = "v1_sha256_ae770490b83cd065ad50cf06c242577c788775793cde0b9ec9f8ad204369466f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177062,20 +177132,20 @@ rule MALPEDIA_Win_Sanny_Auto : FILE
 		$sequence_9 = { 890d???????? 8b0d???????? 68???????? a3???????? 68???????? 8d420c }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Tokyox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "57574695-5c21-57dd-9f3e-5c009f7654f6"
+		id = "e9b7c8a2-5aeb-5a70-a1c8-588e34807679"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tokyox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tokyox_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "e5ebbfb35065dbc14f8f4e75c7bbc71cffc1206aa4b5e3c10e8410f8c2a12bf7"
+		logic_hash = "v1_sha256_e5ebbfb35065dbc14f8f4e75c7bbc71cffc1206aa4b5e3c10e8410f8c2a12bf7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177101,20 +177171,20 @@ rule MALPEDIA_Win_Tokyox_Auto : FILE
 		$sequence_9 = { 56 6a00 6a01 ff15???????? 8bcb 8d5102 90 }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize < 237568
 }
 rule MALPEDIA_Win_Mutabaha_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0b7c3233-e337-53ad-9db2-68c9d4c66563"
+		id = "514215d2-ab08-5b01-bd8c-6ce5e7e08a90"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mutabaha"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mutabaha_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "927984049f5ae8f206bee3f98c76bb65fa49de69b36e329af5d25dd2060b803c"
+		logic_hash = "v1_sha256_927984049f5ae8f206bee3f98c76bb65fa49de69b36e329af5d25dd2060b803c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177140,20 +177210,20 @@ rule MALPEDIA_Win_Mutabaha_Auto : FILE
 		$sequence_9 = { 762a 33c0 8a4e04 8bdf 895df0 84c9 745a }
 
 	condition:
-		7 of them and filesize <1220608
+		7 of them and filesize < 1220608
 }
 rule MALPEDIA_Win_Rc2Fm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e03b7b3c-48a1-54e0-8e6b-e042d3ac2eec"
+		id = "d337685c-bde0-5604-b03b-0d83ab687a4b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rc2fm"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rc2fm_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "fde85b529d09d7ff1cf9ced9923a8b91413b0ceeff762a4b8cd7ea6f3c6fcfbf"
+		logic_hash = "v1_sha256_fde85b529d09d7ff1cf9ced9923a8b91413b0ceeff762a4b8cd7ea6f3c6fcfbf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177179,20 +177249,20 @@ rule MALPEDIA_Win_Rc2Fm_Auto : FILE
 		$sequence_9 = { ff15???????? 488bd8 4883f8ff 742d 33d2 488bc8 ff15???????? }
 
 	condition:
-		7 of them and filesize <410624
+		7 of them and filesize < 410624
 }
 rule MALPEDIA_Win_Nemty_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ed44110a-96dc-5598-9b44-575420ef007c"
+		id = "5f1635e1-5628-54e5-b654-d43fc5296842"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nemty"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nemty_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "f4748253b478a30babc01e1a18cefa28bd614751ff42e5c92d122e8c6c1d7fc7"
+		logic_hash = "v1_sha256_f4748253b478a30babc01e1a18cefa28bd614751ff42e5c92d122e8c6c1d7fc7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177218,20 +177288,20 @@ rule MALPEDIA_Win_Nemty_Auto : FILE
 		$sequence_9 = { 68???????? 8d8424a8000000 e8???????? 6a07 5f 33c0 83ec1c }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Leash_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0278e751-33b7-524f-8591-2e0be840b450"
+		id = "b80eccf5-5849-57da-b4ca-9ccc4a5d2eec"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.leash"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.leash_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "ed40f6249299f75f35aea5ea7ac83b742dd2beb0bf7f39fe8ae59cad9cdb437c"
+		logic_hash = "v1_sha256_ed40f6249299f75f35aea5ea7ac83b742dd2beb0bf7f39fe8ae59cad9cdb437c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177257,20 +177327,20 @@ rule MALPEDIA_Win_Leash_Auto : FILE
 		$sequence_9 = { aa b9ff000000 33c0 8dbd5df5ffff 889d5cf5ffff f3ab }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize < 761856
 }
 rule MALPEDIA_Win_Purplewave_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8fab1de-de14-5b36-888a-a891d75c38a4"
+		id = "09e17f95-db28-54a5-93d9-400890eae3cf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplewave"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.purplewave_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "ec1dbe620cafbb0b6c5ed6f89052ebc62f770f57ab87864e785a226f41ace5e3"
+		logic_hash = "v1_sha256_ec1dbe620cafbb0b6c5ed6f89052ebc62f770f57ab87864e785a226f41ace5e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177296,20 +177366,20 @@ rule MALPEDIA_Win_Purplewave_Auto : FILE
 		$sequence_9 = { 8bc3 e8???????? c20c00 807f4900 740d 8d4f10 51 }
 
 	condition:
-		7 of them and filesize <1400832
+		7 of them and filesize < 1400832
 }
 rule MALPEDIA_Win_Final1Stspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "06e7f902-9031-5e75-88f0-dd09807b7f4e"
+		id = "5461f1a5-f4e4-54bf-a541-796b2ea1b433"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.final1stspy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.final1stspy_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "2aee3f29893f78ed34587724b374d747687bfd3ae50997bd5da3ecf9af5640fd"
+		logic_hash = "v1_sha256_2aee3f29893f78ed34587724b374d747687bfd3ae50997bd5da3ecf9af5640fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177335,20 +177405,20 @@ rule MALPEDIA_Win_Final1Stspy_Auto : FILE
 		$sequence_9 = { 7d11 8a1439 80c27a 80f219 881439 41 }
 
 	condition:
-		7 of them and filesize <557056
+		7 of them and filesize < 557056
 }
 rule MALPEDIA_Win_Iisniff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6c640864-5993-563c-afe7-e26ca8c22f49"
+		id = "3c21a730-78d0-5dc2-8f14-bf6d0fb75fe4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iisniff"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.iisniff_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "110e5f48ca56611bc57ccb877448c194f26647c840b794b9ff7133caff38a207"
+		logic_hash = "v1_sha256_110e5f48ca56611bc57ccb877448c194f26647c840b794b9ff7133caff38a207"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177379,20 +177449,20 @@ rule MALPEDIA_Win_Iisniff_Auto : FILE
 		$sequence_14 = { 51 8d842434010000 50 894c2418 }
 
 	condition:
-		7 of them and filesize <1441792
+		7 of them and filesize < 1441792
 }
 rule MALPEDIA_Win_Unidentified_041_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b9d7c571-d170-593a-8f70-0469676cb185"
+		id = "f7f88396-0d54-5a49-a932-d722556ffa02"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_041"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_041_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "f4d0787e07f3ceed2cd8cf3663fb1191bdc709f813ee4ffdf4c24d0d1a2d3c75"
+		logic_hash = "v1_sha256_f4d0787e07f3ceed2cd8cf3663fb1191bdc709f813ee4ffdf4c24d0d1a2d3c75"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177418,20 +177488,20 @@ rule MALPEDIA_Win_Unidentified_041_Auto : FILE
 		$sequence_9 = { 3905???????? 7f2a 3d00010000 7d23 8b5218 85d2 0f849f000000 }
 
 	condition:
-		7 of them and filesize <1097728
+		7 of them and filesize < 1097728
 }
 rule MALPEDIA_Win_Breakthrough_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0193d887-590b-5255-aefc-27c1cd144cae"
+		id = "97e45ecc-adda-5f85-b330-373c3572ff7b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.breakthrough_loader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.breakthrough_loader_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "ea01661f3f714348cfd1bd7d048f5208e62d40484683d30237ed92dc307f011d"
+		logic_hash = "v1_sha256_ea01661f3f714348cfd1bd7d048f5208e62d40484683d30237ed92dc307f011d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177457,20 +177527,20 @@ rule MALPEDIA_Win_Breakthrough_Loader_Auto : FILE
 		$sequence_9 = { 83e03f c1f906 6bf030 03348d40354500 837e18ff 740c 837e18fe }
 
 	condition:
-		7 of them and filesize <753664
+		7 of them and filesize < 753664
 }
 rule MALPEDIA_Win_Onliner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c0a25174-badc-5a1b-a67c-48cbb1aef2be"
+		id = "d195cc9e-0145-5d4b-bcf9-2203cd6ede17"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onliner"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.onliner_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "6df36365f1b8dbe7cdb1d0b03d64f7da847c99d2518d7b5ebc1610f68ca3a069"
+		logic_hash = "v1_sha256_6df36365f1b8dbe7cdb1d0b03d64f7da847c99d2518d7b5ebc1610f68ca3a069"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177496,20 +177566,20 @@ rule MALPEDIA_Win_Onliner_Auto : FILE
 		$sequence_9 = { 8b45fc 8b88d0010000 ba02000000 8b45fc 8b18 ff534c ff75e4 }
 
 	condition:
-		7 of them and filesize <1736704
+		7 of them and filesize < 1736704
 }
 rule MALPEDIA_Win_Andromut_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "01d6866f-94d6-5040-b42e-5414ac7b6d42"
+		id = "c5ad1cc6-75e4-59cb-8e86-70aca01076e4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromut"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.andromut_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "439db6ddaec21c0c7cf9cb5dec8606d00b8cbca3475fe9c3377e8acfff026f82"
+		logic_hash = "v1_sha256_439db6ddaec21c0c7cf9cb5dec8606d00b8cbca3475fe9c3377e8acfff026f82"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177535,20 +177605,20 @@ rule MALPEDIA_Win_Andromut_Auto : FILE
 		$sequence_9 = { b9daf68a50 ab 66ab e8???????? 56 6880000000 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Mosquito_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "71ca1f1d-a29d-5919-908a-8739132906e6"
+		id = "54912545-fa56-57d9-a73f-02a7711d8906"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mosquito"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mosquito_auto.yar#L1-L196"
 		license_url = "N/A"
-		logic_hash = "69b344d7d3f2add25a4f6f1220ea429e517503872e1e485621e80a5c5693cfe3"
+		logic_hash = "v1_sha256_69b344d7d3f2add25a4f6f1220ea429e517503872e1e485621e80a5c5693cfe3"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -177585,20 +177655,20 @@ rule MALPEDIA_Win_Mosquito_Auto : FILE
 		$sequence_20 = { 6f 00e8 108d8b060400 8b4589 45 8b54000b 0002 }
 
 	condition:
-		7 of them and filesize <1015808
+		7 of them and filesize < 1015808
 }
 rule MALPEDIA_Win_Brute_Ratel_C4_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2e0925bc-6929-57fd-a204-d14352ab043b"
+		id = "40480583-1104-5138-87fa-cc7ade1c7a08"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.brute_ratel_c4_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "494c4fae1039f425b8c7198dfaa8d777cff4b0b0868ed2b5b99463571dc5c16b"
+		logic_hash = "v1_sha256_494c4fae1039f425b8c7198dfaa8d777cff4b0b0868ed2b5b99463571dc5c16b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177630,20 +177700,20 @@ rule MALPEDIA_Win_Brute_Ratel_C4_Auto : FILE
 		$sequence_15 = { 83782000 7465 488b442430 488b00 8b4028 488b4c2440 }
 
 	condition:
-		7 of them and filesize <607232
+		7 of them and filesize < 607232
 }
 rule MALPEDIA_Win_Clipog_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "22c07191-4d84-5a13-93be-3e166d55b017"
+		id = "f8b223a5-c810-5db2-97d3-fd0ae6e47a89"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clipog"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.clipog_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "5f63443ad5edf1c4dcbd4a8d4fd0cdcfd536873049176b0dcfc08c2019029b24"
+		logic_hash = "v1_sha256_5f63443ad5edf1c4dcbd4a8d4fd0cdcfd536873049176b0dcfc08c2019029b24"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177669,20 +177739,20 @@ rule MALPEDIA_Win_Clipog_Auto : FILE
 		$sequence_9 = { 7457 48837b1808 48897310 7243 488b0b eb41 4883ff08 }
 
 	condition:
-		7 of them and filesize <372736
+		7 of them and filesize < 372736
 }
 rule MALPEDIA_Win_Hawkball_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5f75e692-110c-55bd-97fc-1bd1a739617b"
+		id = "b1f652f2-d5a8-5817-b258-3528c691b84b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hawkball"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hawkball_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "ff667bedec18f0ed00ed5af46ab0b00bb4fbcb93b0094e0e12e6710929fc2634"
+		logic_hash = "v1_sha256_ff667bedec18f0ed00ed5af46ab0b00bb4fbcb93b0094e0e12e6710929fc2634"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177708,20 +177778,20 @@ rule MALPEDIA_Win_Hawkball_Auto : FILE
 		$sequence_9 = { 6a08 ffd3 50 ff15???????? 8bf0 8d8578ffffff 50 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_Lobshot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "85b1eb24-9f05-55a3-8f6f-6e4c63293758"
+		id = "4cf67973-db5c-594d-9ea1-99e81ada3b1f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lobshot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lobshot_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "18b4e7449b3d62631766d70c0d11905d5078e9b18e0b08eccb6d10a0123c3b2d"
+		logic_hash = "v1_sha256_18b4e7449b3d62631766d70c0d11905d5078e9b18e0b08eccb6d10a0123c3b2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177747,20 +177817,20 @@ rule MALPEDIA_Win_Lobshot_Auto : FILE
 		$sequence_9 = { 7405 48 85c0 7fe9 6683bc44bc0200002e 750a 33c9 }
 
 	condition:
-		7 of them and filesize <247808
+		7 of them and filesize < 247808
 }
 rule MALPEDIA_Win_Xiaoba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8a2d4ebc-9dbe-5e06-9ffb-a1e3c148bd49"
+		id = "1e26bd46-56dc-5e58-9934-65ab53d84fc4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xiaoba"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xiaoba_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "1a83b2fe247a6302b4c8d96b4dc9a08c1e85c028cd9a733963d489679c8b5b8d"
+		logic_hash = "v1_sha256_1a83b2fe247a6302b4c8d96b4dc9a08c1e85c028cd9a733963d489679c8b5b8d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177786,20 +177856,20 @@ rule MALPEDIA_Win_Xiaoba_Auto : FILE
 		$sequence_9 = { 8b942488000000 6a00 50 8b842480000000 53 56 50 }
 
 	condition:
-		7 of them and filesize <5177344
+		7 of them and filesize < 5177344
 }
 rule MALPEDIA_Win_Bbsrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0025d705-e6c3-5443-a840-3f0b2380c373"
+		id = "1c212589-b405-5cf9-808c-a68b31b81125"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bbsrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bbsrat_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "41e9d1288a6b47bf01a3af69d556bf8b74b048345c44a671654c850d84e7f7a3"
+		logic_hash = "v1_sha256_41e9d1288a6b47bf01a3af69d556bf8b74b048345c44a671654c850d84e7f7a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177825,20 +177895,20 @@ rule MALPEDIA_Win_Bbsrat_Auto : FILE
 		$sequence_9 = { 0f8415010000 397c2418 0f860b010000 8d642400 8b442414 8b34b8 837e0401 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize < 434176
 }
 rule MALPEDIA_Win_Lorenz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f6bc353c-58c5-5213-8fe7-6cfcca7b0b8a"
+		id = "05aa7e00-93a2-554a-9f49-3c9ed5831846"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lorenz"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lorenz_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "1368912ce9218bae6e0caed5bc87ab7c2ec45745a55c8f3691e41777e1860427"
+		logic_hash = "v1_sha256_1368912ce9218bae6e0caed5bc87ab7c2ec45745a55c8f3691e41777e1860427"
 		score = 60
 		quality = 45
 		tags = "FILE"
@@ -177864,20 +177934,20 @@ rule MALPEDIA_Win_Lorenz_Auto : FILE
 		$sequence_9 = { 8bec 83ec08 894df8 837d0800 7414 8b4508 833800 }
 
 	condition:
-		7 of them and filesize <2254848
+		7 of them and filesize < 2254848
 }
 rule MALPEDIA_Win_Unidentified_106_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8675f46d-f715-517e-bc85-af94d8443ca1"
+		id = "480ef32f-30e5-5694-bca1-f121da75440d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_106"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_106_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "8b889ebf850fd39b916ba5548e2ee462a29668a970da164f9df6605604203541"
+		logic_hash = "v1_sha256_8b889ebf850fd39b916ba5548e2ee462a29668a970da164f9df6605604203541"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177903,20 +177973,20 @@ rule MALPEDIA_Win_Unidentified_106_Auto : FILE
 		$sequence_9 = { e8???????? 488b9ed8000000 49c7c4ffffffff 44897d48 4c8be8 44897d50 4d8bf4 }
 
 	condition:
-		7 of them and filesize <27402240
+		7 of them and filesize < 27402240
 }
 rule MALPEDIA_Win_Vawtrak_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2112bb64-22b3-5c03-b2f8-c6e0d0b0c10f"
+		id = "c9e48f06-51db-55e3-a3f9-99d85a1feec7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vawtrak"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vawtrak_auto.yar#L1-L216"
 		license_url = "N/A"
-		logic_hash = "60253f607ddfb6f5514a6ed220e9ab8f7a24d3f7658f13c97c0cead0093a08d3"
+		logic_hash = "v1_sha256_60253f607ddfb6f5514a6ed220e9ab8f7a24d3f7658f13c97c0cead0093a08d3"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -177955,20 +178025,20 @@ rule MALPEDIA_Win_Vawtrak_Auto : FILE
 		$sequence_22 = { 3b4308 7748 85f6 742a }
 
 	condition:
-		7 of them and filesize <1027072
+		7 of them and filesize < 1027072
 }
 rule MALPEDIA_Win_Electric_Powder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1eede688-bf8f-5498-af13-fe892853a3bd"
+		id = "7dcfed50-abd1-57b5-ba21-62ce616bdf30"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electric_powder"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.electric_powder_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "fd0dece583cd040033ee5a2fac814b92bb57f2cacae42d60f0a3caee41692c62"
+		logic_hash = "v1_sha256_fd0dece583cd040033ee5a2fac814b92bb57f2cacae42d60f0a3caee41692c62"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177994,20 +178064,20 @@ rule MALPEDIA_Win_Electric_Powder_Auto : FILE
 		$sequence_9 = { 8d3400 8945e8 56 51 8d45d8 50 e8???????? }
 
 	condition:
-		7 of them and filesize <565248
+		7 of them and filesize < 565248
 }
 rule MALPEDIA_Win_Upatre_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73539601-8658-55a3-ad49-65acd97f978e"
+		id = "72a4a846-07cf-5fa8-9fa7-6e1f6504da03"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.upatre"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.upatre_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "8c959d494139a03c01baced655928fcf1bda3e51a3d094a6d0ce455b32426f5d"
+		logic_hash = "v1_sha256_8c959d494139a03c01baced655928fcf1bda3e51a3d094a6d0ce455b32426f5d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178039,20 +178109,20 @@ rule MALPEDIA_Win_Upatre_Auto : FILE
 		$sequence_15 = { eb58 8b4df4 8b510c 52 e8???????? 83c404 0fb7c0 }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize < 294912
 }
 rule MALPEDIA_Win_Cryptoluck_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c54fc8ef-3602-58f8-83b4-8208d9ae15d7"
+		id = "64137198-231a-5f50-85b4-f226c8bf4589"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoluck"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cryptoluck_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "0975548068cce5a595ab873e8bd23c5fffef61084104837a0ebc0f80661af758"
+		logic_hash = "v1_sha256_0975548068cce5a595ab873e8bd23c5fffef61084104837a0ebc0f80661af758"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178078,20 +178148,20 @@ rule MALPEDIA_Win_Cryptoluck_Auto : FILE
 		$sequence_9 = { 8bec 83ec3c 8b4508 a3???????? 8b4d0c }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_Sendsafe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca9919a1-41ee-51c0-9d8a-dc97d5d2356c"
+		id = "dc183653-bf74-5a11-9d42-610ff7143d82"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sendsafe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sendsafe_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0b34fbaea5b0ab525d5bd2b630928ff7f548afb642b0c0217e296f895cb417fc"
+		logic_hash = "v1_sha256_0b34fbaea5b0ab525d5bd2b630928ff7f548afb642b0c0217e296f895cb417fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178117,20 +178187,20 @@ rule MALPEDIA_Win_Sendsafe_Auto : FILE
 		$sequence_9 = { 8b8de4fbffff 8b95ecfbffff 031481 8995ecfbffff e9???????? eb54 8b85e8fbffff }
 
 	condition:
-		7 of them and filesize <3743744
+		7 of them and filesize < 3743744
 }
 rule MALPEDIA_Win_Chches_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d15a52b4-77ce-52c4-a76e-32aad2b4034d"
+		id = "37a7363f-56ad-5023-bbe8-7aa83daf6842"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chches"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chches_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "826aac443fa892955ee21ee159179cf79234b9fe8bb8add3f0a9151151666203"
+		logic_hash = "v1_sha256_826aac443fa892955ee21ee159179cf79234b9fe8bb8add3f0a9151151666203"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178156,20 +178226,20 @@ rule MALPEDIA_Win_Chches_Auto : FILE
 		$sequence_9 = { 8b45bc 8b7de8 83c408 c745fc01000000 8b9680000000 50 ffd2 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Bootwreck_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e46a87d8-ca64-51d8-8465-fa91fe773b67"
+		id = "df443d3e-fde3-5b16-93c3-ac18f73e7c27"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bootwreck"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bootwreck_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7dd89e2ad6a7e4ec6bd403b4a60d8d35c2c5a80bbaddf577283e953056078258"
+		logic_hash = "v1_sha256_7dd89e2ad6a7e4ec6bd403b4a60d8d35c2c5a80bbaddf577283e953056078258"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178195,20 +178265,20 @@ rule MALPEDIA_Win_Bootwreck_Auto : FILE
 		$sequence_9 = { 70af 9c 236202 3376ad 9add1461e82b4a 97 1e }
 
 	condition:
-		7 of them and filesize <10821632
+		7 of them and filesize < 10821632
 }
 rule MALPEDIA_Win_Andardoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "81ba1768-aed9-5f8c-98e2-be1a91393599"
+		id = "51b818d6-99f9-5a46-81f5-8985ef8011bb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andardoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.andardoor_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "f5bb44cfeb5e0f7e950fe93babcfa1fb8b5f0313142a54c4e5fa92021682222b"
+		logic_hash = "v1_sha256_f5bb44cfeb5e0f7e950fe93babcfa1fb8b5f0313142a54c4e5fa92021682222b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178234,20 +178304,20 @@ rule MALPEDIA_Win_Andardoor_Auto : FILE
 		$sequence_9 = { 4883c002 4883f80a 75d6 e8???????? 488b4b08 4885c9 7405 }
 
 	condition:
-		7 of them and filesize <339968
+		7 of them and filesize < 339968
 }
 rule MALPEDIA_Win_Mgbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dd03dc94-bb3a-5cad-8f13-4bbe4b7f90a6"
+		id = "7a402439-813c-5a8e-b06c-c2770efabd86"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mgbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mgbot_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "7310ce51cc81391fc78e9881bf8f490b2a783d4789728f7661df3e6bdca512d7"
+		logic_hash = "v1_sha256_7310ce51cc81391fc78e9881bf8f490b2a783d4789728f7661df3e6bdca512d7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178273,20 +178343,20 @@ rule MALPEDIA_Win_Mgbot_Auto : FILE
 		$sequence_9 = { 6808020000 e8???????? 6804010000 8bf0 6a00 56 e8???????? }
 
 	condition:
-		7 of them and filesize <1677312
+		7 of them and filesize < 1677312
 }
 rule MALPEDIA_Win_Poweliks_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1e577d24-5a33-56a2-89ea-12d263fea556"
+		id = "0399ecc4-cd21-58b9-97d2-516486766c10"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poweliks"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.poweliks_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "25339dff3576021bbd48649b55b3a0a905a70a087edb57140d53477b59a39b79"
+		logic_hash = "v1_sha256_25339dff3576021bbd48649b55b3a0a905a70a087edb57140d53477b59a39b79"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178312,20 +178382,20 @@ rule MALPEDIA_Win_Poweliks_Auto : FILE
 		$sequence_9 = { 8b5df4 03d8 8a4405d0 3a441dd0 7509 }
 
 	condition:
-		7 of them and filesize <115712
+		7 of them and filesize < 115712
 }
 rule MALPEDIA_Win_Yakuza_Ransomware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73df97f0-7e35-550b-9535-694c3981ecc9"
+		id = "8d6d0993-9c25-5765-bfb7-491b98329a0e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yakuza_ransomware"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.yakuza_ransomware_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "877a27b3e7b369865a3e2e4c6ef5b4324a9318b7d81e28cbd514c89eb464d3c0"
+		logic_hash = "v1_sha256_877a27b3e7b369865a3e2e4c6ef5b4324a9318b7d81e28cbd514c89eb464d3c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178351,20 +178421,20 @@ rule MALPEDIA_Win_Yakuza_Ransomware_Auto : FILE
 		$sequence_9 = { f00fc14120 7523 8bb55cffffff 0f1f4000 85f6 7415 8bce }
 
 	condition:
-		7 of them and filesize <2811904
+		7 of them and filesize < 2811904
 }
 rule MALPEDIA_Win_Plead_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6ebeecb3-22ba-51cf-8f7b-acfcb3488d30"
+		id = "715043e8-4c8d-57dc-87ee-cba8585557b9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plead"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.plead_auto.yar#L1-L236"
 		license_url = "N/A"
-		logic_hash = "3927d6d1b5e82a17fd417b0071c76ba719237a780a5f2d36d13d9a1ea487844d"
+		logic_hash = "v1_sha256_3927d6d1b5e82a17fd417b0071c76ba719237a780a5f2d36d13d9a1ea487844d"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -178404,20 +178474,20 @@ rule MALPEDIA_Win_Plead_Auto : FILE
 		$sequence_23 = { 6a00 ff75f8 ff5648 eb0d }
 
 	condition:
-		7 of them and filesize <8224768
+		7 of them and filesize < 8224768
 }
 rule MALPEDIA_Win_Agendacrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dc53611f-1b74-52ad-9b55-d5a83620a37c"
+		id = "ff35fba4-cda2-5493-9758-ccefdc68bde3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agendacrypt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.agendacrypt_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d7e38346c9af348b4c2d13bd6ea77d0011438992fc08a00180dea033b3826496"
+		logic_hash = "v1_sha256_d7e38346c9af348b4c2d13bd6ea77d0011438992fc08a00180dea033b3826496"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178443,20 +178513,20 @@ rule MALPEDIA_Win_Agendacrypt_Auto : FILE
 		$sequence_9 = { e9???????? 8b55e8 0f1f8000000000 837dcc00 741f 6a02 68???????? }
 
 	condition:
-		7 of them and filesize <3340288
+		7 of them and filesize < 3340288
 }
 rule MALPEDIA_Win_Owlproxy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "638fb361-2ad3-53d0-8e4f-9ad0b735dcdb"
+		id = "fd2a8c94-b595-5c5c-94dd-18a3d373107d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.owlproxy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.owlproxy_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "b8fac1ab1f13b504661c8bdcc9beeb57fc5ec6f3de1faa47de004dfa99391115"
+		logic_hash = "v1_sha256_b8fac1ab1f13b504661c8bdcc9beeb57fc5ec6f3de1faa47de004dfa99391115"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178482,20 +178552,20 @@ rule MALPEDIA_Win_Owlproxy_Auto : FILE
 		$sequence_9 = { 480f42d1 488d4c2428 e8???????? 488b4c2430 4c8b4c2428 4a8d040f 4885c9 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize < 475136
 }
 rule MALPEDIA_Win_Tinynuke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e047ea51-f3c4-5f88-b573-b37c1953b9b2"
+		id = "c5d6d203-e9cc-58a1-b59b-9f5851d6a904"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinynuke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tinynuke_auto.yar#L1-L291"
 		license_url = "N/A"
-		logic_hash = "6f2eccbfe290f185e4b6b9493a76e1eee7c900297614878527a2340fef27067f"
+		logic_hash = "v1_sha256_6f2eccbfe290f185e4b6b9493a76e1eee7c900297614878527a2340fef27067f"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -178543,20 +178613,20 @@ rule MALPEDIA_Win_Tinynuke_Auto : FILE
 		$sequence_31 = { e8???????? 83ec04 3c0c 7421 ffd3 }
 
 	condition:
-		7 of them and filesize <1196032
+		7 of them and filesize < 1196032
 }
 rule MALPEDIA_Win_Unidentified_082_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7772581c-e8cf-5615-a758-46ef9c1fc0b0"
+		id = "d7668f1f-9729-56d6-b5f3-cf5b4a72bf86"
 		date = "2021-10-07"
 		modified = "2021-10-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_082"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_082_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "fdfe1ddce9f77ac8b465b0ddebe868c5e77078cf2b2457573a5b3810682f45ee"
+		logic_hash = "v1_sha256_fdfe1ddce9f77ac8b465b0ddebe868c5e77078cf2b2457573a5b3810682f45ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178582,20 +178652,20 @@ rule MALPEDIA_Win_Unidentified_082_Auto : FILE
 		$sequence_9 = { 48894598 eb03 4533f6 488b05???????? 80782e00 740a 80782000 }
 
 	condition:
-		7 of them and filesize <414720
+		7 of them and filesize < 414720
 }
 rule MALPEDIA_Win_Newsreels_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "596de4f5-9368-5129-8f10-46a814b9edc2"
+		id = "a8cbd7f6-7bde-5500-bff7-be4abd368189"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newsreels"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.newsreels_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "31294f0bc1fd72fff816bb0c2c17d33dbab780b957e5c41520b825232208a7ae"
+		logic_hash = "v1_sha256_31294f0bc1fd72fff816bb0c2c17d33dbab780b957e5c41520b825232208a7ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178621,20 +178691,20 @@ rule MALPEDIA_Win_Newsreels_Auto : FILE
 		$sequence_9 = { 56 8bf1 8b4e18 8b5614 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Cryptolocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ad9b18af-235b-525a-af62-054a0222583c"
+		id = "ccc370fb-f03e-5622-b6a7-0ba422caeb5b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptolocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cryptolocker_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "75564b552b8c35eb8b1fab229d91abfa4288be2b05e1664b616963e88f02714a"
+		logic_hash = "v1_sha256_75564b552b8c35eb8b1fab229d91abfa4288be2b05e1664b616963e88f02714a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178660,20 +178730,20 @@ rule MALPEDIA_Win_Cryptolocker_Auto : FILE
 		$sequence_9 = { 85c0 7509 83c640 3b37 72d5 }
 
 	condition:
-		7 of them and filesize <778240
+		7 of them and filesize < 778240
 }
 rule MALPEDIA_Win_Stealer_0X3401_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1ccbeb2b-8652-556b-a78e-87a19479b4d7"
+		id = "4135f304-d89c-5842-9264-f0d96d3e236b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealer_0x3401"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stealer_0x3401_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "00bd8b2b3e3b3733d5bcbc0fb6b2848b3225fb02bf487f9ea61c20713054d985"
+		logic_hash = "v1_sha256_00bd8b2b3e3b3733d5bcbc0fb6b2848b3225fb02bf487f9ea61c20713054d985"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178699,20 +178769,20 @@ rule MALPEDIA_Win_Stealer_0X3401_Auto : FILE
 		$sequence_9 = { f30f59c1 f30f110424 e8???????? f30f100d???????? 8b559c f20f5ac0 51 }
 
 	condition:
-		7 of them and filesize <357376
+		7 of them and filesize < 357376
 }
 rule MALPEDIA_Win_Glitch_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "167489a1-806c-57ac-870b-1a5711737bf5"
+		id = "e78fdca4-da07-55dd-8cb6-9c9e4dea4d8a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glitch_pos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.glitch_pos_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "8974caf746bb63b369da7b75c4e0e1a2b35b653a94e981b459531b393a112a37"
+		logic_hash = "v1_sha256_8974caf746bb63b369da7b75c4e0e1a2b35b653a94e981b459531b393a112a37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178738,20 +178808,20 @@ rule MALPEDIA_Win_Glitch_Pos_Auto : FILE
 		$sequence_9 = { ff75d8 e8???????? dc9d68ffffff dfe0 }
 
 	condition:
-		7 of them and filesize <1024000
+		7 of them and filesize < 1024000
 }
 rule MALPEDIA_Win_Unidentified_071_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "518d209c-e627-5ef3-9eb6-1a7ee7d67ffa"
+		id = "3ff4d0d8-c3b0-581a-92ab-c50d405bfe36"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_071"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_071_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "10aa474e67246e989615e8f1a539e8beccbe5f2115f19e32be1e24db8d548303"
+		logic_hash = "v1_sha256_10aa474e67246e989615e8f1a539e8beccbe5f2115f19e32be1e24db8d548303"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178777,20 +178847,20 @@ rule MALPEDIA_Win_Unidentified_071_Auto : FILE
 		$sequence_9 = { 2bc1 894c2404 3bc2 0f82a9000000 8b4314 55 }
 
 	condition:
-		7 of them and filesize <1220608
+		7 of them and filesize < 1220608
 }
 rule MALPEDIA_Win_Pay2Key_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f2fcc621-8979-5801-a21d-ea66a00d4417"
+		id = "d56a8caa-de27-5bf4-a4bc-400285687b66"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pay2key"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pay2key_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "c5c5a0569f9a48f47100e890ff1d1fd3e4fd615600ef7e4d45ae1b0c294b9a08"
+		logic_hash = "v1_sha256_c5c5a0569f9a48f47100e890ff1d1fd3e4fd615600ef7e4d45ae1b0c294b9a08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178816,20 +178886,20 @@ rule MALPEDIA_Win_Pay2Key_Auto : FILE
 		$sequence_9 = { d1e8 03c2 3bc1 0f43c8 894df8 8d048d04000000 50 }
 
 	condition:
-		7 of them and filesize <2252800
+		7 of them and filesize < 2252800
 }
 rule MALPEDIA_Win_Onhat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4885dade-4fce-5e20-9ffa-fd32e752e39c"
+		id = "ed7a30dd-b5d7-5a3a-92c9-e18e82bf311e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onhat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.onhat_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "3d8264647f2b4bfebfbb64b6330e4d7098e25f3b002acba0b19c8992974ae5d6"
+		logic_hash = "v1_sha256_3d8264647f2b4bfebfbb64b6330e4d7098e25f3b002acba0b19c8992974ae5d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178855,20 +178925,20 @@ rule MALPEDIA_Win_Onhat_Auto : FILE
 		$sequence_9 = { 8b542440 52 8b542428 50 8b442464 50 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Prilex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ee73f8b-e8a7-530a-919c-0e8a3ae2ae98"
+		id = "164dec24-4174-53d8-8ae5-abc29c20a45b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prilex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.prilex_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "6de539b63b8562d1b8bdbaceab1132bb64a8bf2aa0cf4524ffc6127b96beab6c"
+		logic_hash = "v1_sha256_6de539b63b8562d1b8bdbaceab1132bb64a8bf2aa0cf4524ffc6127b96beab6c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178894,20 +178964,20 @@ rule MALPEDIA_Win_Prilex_Auto : FILE
 		$sequence_9 = { ff15???????? 8b4d08 8b35???????? b808000000 }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize < 450560
 }
 rule MALPEDIA_Win_Xsplus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2c89d099-29a9-55d4-a949-65dd1bdfe6eb"
+		id = "c904e008-9a83-5e73-afce-3bd37c092f21"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xsplus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xsplus_auto.yar#L1-L179"
 		license_url = "N/A"
-		logic_hash = "e49d0b0e4b6b18be179499d3f98b92cb7a2ea53651dc18e80a64f9c221a6561b"
+		logic_hash = "v1_sha256_e49d0b0e4b6b18be179499d3f98b92cb7a2ea53651dc18e80a64f9c221a6561b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178940,20 +179010,20 @@ rule MALPEDIA_Win_Xsplus_Auto : FILE
 		$sequence_16 = { 8b8d90feffff 51 e8???????? 83c404 b801000000 eb02 }
 
 	condition:
-		7 of them and filesize <597872
+		7 of them and filesize < 597872
 }
 rule MALPEDIA_Win_Petya_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96d15d70-0cad-5ba8-b732-d7e2c6c8a3c4"
+		id = "541a8aa2-cb42-5218-bab5-a07eb1a06564"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.petya"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.petya_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "126f559636a52e8bbed5a94164c0b2da83f722a29115c2b51cd7bbb82a77ed47"
+		logic_hash = "v1_sha256_126f559636a52e8bbed5a94164c0b2da83f722a29115c2b51cd7bbb82a77ed47"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178979,20 +179049,20 @@ rule MALPEDIA_Win_Petya_Auto : FILE
 		$sequence_9 = { 6a00 50 e8???????? ff7618 8d857cfeffff }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_Disk_Knight_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1b68d176-e621-572e-a02b-4eff18ee7835"
+		id = "5776c9f6-1544-5dc5-87f1-0a1c565b30f2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disk_knight"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.disk_knight_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "09ce3baeb29e85d6695478868b4b5a99498537909676146b33cec4463b3e4ba4"
+		logic_hash = "v1_sha256_09ce3baeb29e85d6695478868b4b5a99498537909676146b33cec4463b3e4ba4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179018,20 +179088,20 @@ rule MALPEDIA_Win_Disk_Knight_Auto : FILE
 		$sequence_9 = { 7d0e 68d8000000 68???????? 56 50 ffd3 8b0e }
 
 	condition:
-		7 of them and filesize <868352
+		7 of them and filesize < 868352
 }
 rule MALPEDIA_Win_Royalcli_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff77d805-91a0-5315-ba44-9b60dd6ef815"
+		id = "171fc0d2-14e8-5e05-b9e9-dc023fcab413"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royalcli"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.royalcli_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "3f942fc64e71d9989fa602e154f4016ccbdc8b8d4e7f9551bd6f613b1bb3b100"
+		logic_hash = "v1_sha256_3f942fc64e71d9989fa602e154f4016ccbdc8b8d4e7f9551bd6f613b1bb3b100"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179057,20 +179127,20 @@ rule MALPEDIA_Win_Royalcli_Auto : FILE
 		$sequence_9 = { 8b4508 53 56 68???????? 50 8bf1 e8???????? }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Ployx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "88ff8b0e-42c8-531a-aa7c-e4d988bc3583"
+		id = "06748674-1fd4-5efb-81c6-616be4f8c36c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ployx"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ployx_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "6c51c47290988f53993f59d945fc1bce237ebb223534fe936a15d347d9e6950c"
+		logic_hash = "v1_sha256_6c51c47290988f53993f59d945fc1bce237ebb223534fe936a15d347d9e6950c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179096,20 +179166,20 @@ rule MALPEDIA_Win_Ployx_Auto : FILE
 		$sequence_9 = { 5b c3 56 68???????? 6804010000 ff15???????? 33f6 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_Betabot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "76d74828-4d3c-5b24-a19d-5dd4164ed17c"
+		id = "748401bf-d563-5e44-a386-4bc3df30690a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.betabot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.betabot_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "07dd0ba00e2d3513e1cad1cf2b7d11e94e25b4a1985b335a6dca6b1199e5355b"
+		logic_hash = "v1_sha256_07dd0ba00e2d3513e1cad1cf2b7d11e94e25b4a1985b335a6dca6b1199e5355b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179135,20 +179205,20 @@ rule MALPEDIA_Win_Betabot_Auto : FILE
 		$sequence_9 = { e8???????? eb12 a1???????? 85c0 740b 8d4dfc }
 
 	condition:
-		7 of them and filesize <835584
+		7 of them and filesize < 835584
 }
 rule MALPEDIA_Win_Waterminer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "015d17f9-270a-5ff3-ae6a-8c2f19540faa"
+		id = "3375f5c8-235f-5747-949d-71b00922c6ea"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.waterminer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.waterminer_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "fee2af94ed2d9b29403d90ebf96331b0858215bab4f3b7310fc1b1dc42373d50"
+		logic_hash = "v1_sha256_fee2af94ed2d9b29403d90ebf96331b0858215bab4f3b7310fc1b1dc42373d50"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179180,20 +179250,20 @@ rule MALPEDIA_Win_Waterminer_Auto : FILE
 		$sequence_15 = { 0344240c 4403d0 488d051a560500 418b0400 }
 
 	condition:
-		7 of them and filesize <1556480
+		7 of them and filesize < 1556480
 }
 rule MALPEDIA_Win_Poslurp_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6bf5ef0a-8f8e-5e13-a7d2-227d9ddd0565"
+		id = "f844ec06-e892-5e50-8afa-12ac8736d268"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poslurp"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.poslurp_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "bbd4232b1e9147e9ff5af0c6efd52975564af5c8f6efe7b5267fa51aa60fdd3c"
+		logic_hash = "v1_sha256_bbd4232b1e9147e9ff5af0c6efd52975564af5c8f6efe7b5267fa51aa60fdd3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179219,20 +179289,20 @@ rule MALPEDIA_Win_Poslurp_Auto : FILE
 		$sequence_9 = { 498b34c6 33c0 418bdc 488bfe 458bc4 498bd4 }
 
 	condition:
-		7 of them and filesize <50176
+		7 of them and filesize < 50176
 }
 rule MALPEDIA_Win_Bughatch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c76d5fd-0852-57e8-98d3-2429c0a26bc6"
+		id = "88052b0e-646c-5e56-8ad1-4ed8dda2800b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bughatch"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bughatch_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "ce23ebcae0b6af11021010314345b92d6fc792734955c495c1529b11609de8c0"
+		logic_hash = "v1_sha256_ce23ebcae0b6af11021010314345b92d6fc792734955c495c1529b11609de8c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179258,20 +179328,20 @@ rule MALPEDIA_Win_Bughatch_Auto : FILE
 		$sequence_9 = { ff15???????? 8b55f8 0355f4 8955f8 b801000000 6bc800 }
 
 	condition:
-		7 of them and filesize <75776
+		7 of them and filesize < 75776
 }
 rule MALPEDIA_Win_Sykipot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7dfa6014-8de4-5034-9d3e-e952369ddc5e"
+		id = "0c4eed21-1d92-567f-a089-b1ed6a022032"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sykipot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sykipot_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "6b98694b9b7bab0c760215e0200ed7148a92e1d0f8160cc9d832d1342f3407bf"
+		logic_hash = "v1_sha256_6b98694b9b7bab0c760215e0200ed7148a92e1d0f8160cc9d832d1342f3407bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179297,20 +179367,20 @@ rule MALPEDIA_Win_Sykipot_Auto : FILE
 		$sequence_9 = { 6a00 8d842414020000 6a1a 50 6a00 ff15???????? }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Knight_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a5e09115-4011-54e1-a2ba-c2bbb8ab355a"
+		id = "629e380f-1922-5e9f-a9f6-2c0654f0004e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.knight"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.knight_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d7c3e295d686febfc6f312c8c39590a584a2b1ffbd1bc0f76a009284be0570bc"
+		logic_hash = "v1_sha256_d7c3e295d686febfc6f312c8c39590a584a2b1ffbd1bc0f76a009284be0570bc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179336,20 +179406,20 @@ rule MALPEDIA_Win_Knight_Auto : FILE
 		$sequence_9 = { e8???????? 488d0542873200 bb14000000 6690 e8???????? 31c0 4889c1 }
 
 	condition:
-		7 of them and filesize <12149760
+		7 of them and filesize < 12149760
 }
 rule MALPEDIA_Win_Balkan_Door_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "870a99c0-e95d-56d4-9ce7-fd5381768dbe"
+		id = "82cf4e48-a612-56ab-82d9-68b0e0b1d38a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.balkan_door"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.balkan_door_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "1cfcbe46433533ae63497a1399949fc7dd10f1e5a4dc1daebcdead984fa82911"
+		logic_hash = "v1_sha256_1cfcbe46433533ae63497a1399949fc7dd10f1e5a4dc1daebcdead984fa82911"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179375,20 +179445,20 @@ rule MALPEDIA_Win_Balkan_Door_Auto : FILE
 		$sequence_9 = { 52 50 ff15???????? 8bf8 89bd3cefffff 85ff }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize < 352256
 }
 rule MALPEDIA_Win_Runningrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "297d1859-ca3a-5430-a307-3e48917944b6"
+		id = "df7af0c4-2d7d-5bd2-85ce-286ead530e38"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.runningrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.runningrat_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "cc8e1228550694df797c7f86352429950a0d9bf3c450fac5ae045f777304a562"
+		logic_hash = "v1_sha256_cc8e1228550694df797c7f86352429950a0d9bf3c450fac5ae045f777304a562"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179419,20 +179489,20 @@ rule MALPEDIA_Win_Runningrat_Auto : FILE
 		$sequence_14 = { 890f c70005000000 8b4704 85c0 0f846fffffff 8b0f }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Snatch_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d74b7542-a17c-5e73-9f4b-d6fcbd7ec77a"
+		id = "1113afab-e602-5122-b36a-0f88666df814"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snatch_loader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.snatch_loader_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "58c7bbc8e69216b73bd02826084d61ba1cc9680e841df4cda286961c3330efac"
+		logic_hash = "v1_sha256_58c7bbc8e69216b73bd02826084d61ba1cc9680e841df4cda286961c3330efac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179464,20 +179534,20 @@ rule MALPEDIA_Win_Snatch_Loader_Auto : FILE
 		$sequence_15 = { 33c9 8a0431 0ac0 741f }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Powersniff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96668c35-22ff-5b9e-ae57-ee3a83835c94"
+		id = "4fa21806-ba73-5f2a-aefa-fb0ebd6f0fb9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powersniff"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.powersniff_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "61f4abb0e5c4aeea392fa5c634ad49408a74795c9a7a1a686ae66d78616fe1f2"
+		logic_hash = "v1_sha256_61f4abb0e5c4aeea392fa5c634ad49408a74795c9a7a1a686ae66d78616fe1f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179503,20 +179573,20 @@ rule MALPEDIA_Win_Powersniff_Auto : FILE
 		$sequence_9 = { ffd6 85c0 752e 68???????? }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Tinymet_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3b877ab0-4cfd-5a16-b545-cbd2432f7e3a"
+		id = "fc736571-7da1-5f89-9eb3-4af0c48a5500"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinymet"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tinymet_auto.yar#L1-L102"
 		license_url = "N/A"
-		logic_hash = "18fdd73d173a567cb669dcb2f204fa6a5132161bf80e753f323b92b81adc0ad1"
+		logic_hash = "v1_sha256_18fdd73d173a567cb669dcb2f204fa6a5132161bf80e753f323b92b81adc0ad1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179540,20 +179610,20 @@ rule MALPEDIA_Win_Tinymet_Auto : FILE
 		$sequence_7 = { 85f6 7509 a1???????? 8b30 eb03 83c602 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Rekoobew_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "87c5607a-8a90-598c-943e-607b112d1594"
+		id = "f9ae9e2d-3af3-5876-a7b5-51f5d3889afb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rekoobew"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rekoobew_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "aef627dbf43f3f433f140924ae4bed9b7cb42ca10d8749c65899eb3d41030244"
+		logic_hash = "v1_sha256_aef627dbf43f3f433f140924ae4bed9b7cb42ca10d8749c65899eb3d41030244"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179579,20 +179649,20 @@ rule MALPEDIA_Win_Rekoobew_Auto : FILE
 		$sequence_9 = { 89d6 8b55e8 3314b5e08c4000 8955e0 }
 
 	condition:
-		7 of them and filesize <248832
+		7 of them and filesize < 248832
 }
 rule MALPEDIA_Win_Milum_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8311a048-c504-508b-a4e8-52a8a481b8b1"
+		id = "21fa9f00-bd95-55bd-9b3d-49a5f42a0adf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.milum"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.milum_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "6c7c97a327f6ef555ead1a0969df80007fb8d016e702f68476c0459b28700b82"
+		logic_hash = "v1_sha256_6c7c97a327f6ef555ead1a0969df80007fb8d016e702f68476c0459b28700b82"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179618,20 +179688,20 @@ rule MALPEDIA_Win_Milum_Auto : FILE
 		$sequence_9 = { 7446 83ec1c 8bfc 89a5ecfdffff 83ec1c 8bcc 89a5e8fdffff }
 
 	condition:
-		7 of them and filesize <1076224
+		7 of them and filesize < 1076224
 }
 rule MALPEDIA_Win_Bottomloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b80f27db-a9fe-5886-83a1-b7800bdc0933"
+		id = "d3f2a1e9-c484-582c-8722-a5ae80bd413a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bottomloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bottomloader_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "e605cbf05da14cecd741717af69ae46ce70b645051ad1189e53cd9ddfd6b5a03"
+		logic_hash = "v1_sha256_e605cbf05da14cecd741717af69ae46ce70b645051ad1189e53cd9ddfd6b5a03"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179657,20 +179727,20 @@ rule MALPEDIA_Win_Bottomloader_Auto : FILE
 		$sequence_9 = { e8???????? 4c8d0dee830700 4c898d78fcffff 48c78570fcffff0e000000 488d8d70fcffff e8???????? 488d05c9830700 }
 
 	condition:
-		7 of them and filesize <1955840
+		7 of them and filesize < 1955840
 }
 rule MALPEDIA_Win_Mariposa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a3a2192-1985-5afb-a3c8-457f3f4c729c"
+		id = "9e9ac85b-cc58-5a5f-98f1-6e973069c454"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mariposa"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mariposa_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "343ac33f57cd9cc9bfc1841bf1bd211734de245f417ee554220587a46ed4086f"
+		logic_hash = "v1_sha256_343ac33f57cd9cc9bfc1841bf1bd211734de245f417ee554220587a46ed4086f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179696,20 +179766,20 @@ rule MALPEDIA_Win_Mariposa_Auto : FILE
 		$sequence_9 = { 03da 4b 54 ffd3 33c0 }
 
 	condition:
-		7 of them and filesize <311296
+		7 of them and filesize < 311296
 }
 rule MALPEDIA_Win_Zlob_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a970d088-9ed2-5a54-a209-a213c278b939"
+		id = "ec67e5ca-65d4-5cd9-b0f6-40c79302c29f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zlob"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zlob_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "7be20af316e82ae77a28c9d29b76181384335b1dbce3a98db4ea9d8cea904efb"
+		logic_hash = "v1_sha256_7be20af316e82ae77a28c9d29b76181384335b1dbce3a98db4ea9d8cea904efb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179735,20 +179805,20 @@ rule MALPEDIA_Win_Zlob_Auto : FILE
 		$sequence_9 = { 8b4c2418 ff742428 ff7118 ff7114 52 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Unidentified_104_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d500f181-7347-5b56-b769-5ef7ee00cd2b"
+		id = "0c1da46b-92f5-5929-908a-7ee612b9b602"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_104"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_104_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "4ebfb796f6d86b2c125f5dfb97b85200528b313a6e20e5b2b0501c20db7c82f7"
+		logic_hash = "v1_sha256_4ebfb796f6d86b2c125f5dfb97b85200528b313a6e20e5b2b0501c20db7c82f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179774,20 +179844,20 @@ rule MALPEDIA_Win_Unidentified_104_Auto : FILE
 		$sequence_9 = { 488d5304 448bc6 488bcf e8???????? 488d5308 448bc6 488bcf }
 
 	condition:
-		7 of them and filesize <263168
+		7 of them and filesize < 263168
 }
 rule MALPEDIA_Win_Stealc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a9a3385f-b9f5-5cec-b139-7fd9ab3e38ee"
+		id = "ef4355da-db20-570f-97a1-ae0825496a46"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stealc_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "1bbc82a373b409e3dad4afed525c9d3527cdf24f15e799642d4692134ce52442"
+		logic_hash = "v1_sha256_1bbc82a373b409e3dad4afed525c9d3527cdf24f15e799642d4692134ce52442"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179813,20 +179883,20 @@ rule MALPEDIA_Win_Stealc_Auto : FILE
 		$sequence_9 = { 8d75f4 e8???????? 8b45d0 e8???????? 8d7de8 8d75d0 }
 
 	condition:
-		7 of them and filesize <4891648
+		7 of them and filesize < 4891648
 }
 rule MALPEDIA_Win_Darkloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c6586d19-c9dc-5391-af52-9dc3a3375338"
+		id = "c523ae60-830c-58c5-a128-bb0bb4d242b9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkloader_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "80ad8615edb3b8dd04cf4b30a3f3c46ec7df78cf02d75573629255acdb077233"
+		logic_hash = "v1_sha256_80ad8615edb3b8dd04cf4b30a3f3c46ec7df78cf02d75573629255acdb077233"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179852,20 +179922,20 @@ rule MALPEDIA_Win_Darkloader_Auto : FILE
 		$sequence_9 = { a3???????? 5e c3 55 8bec 81ec04040000 33c9 }
 
 	condition:
-		7 of them and filesize <124928
+		7 of them and filesize < 124928
 }
 rule MALPEDIA_Win_Xfsadm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6cee945a-b699-5b54-a37c-80744e975247"
+		id = "72baac75-6d9d-5ca6-aa18-51e7f571283f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfsadm"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xfsadm_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "f4eb82f59dbe07c8f1ee2d03c53cd893a45918aeff41d261754b918f12bf1430"
+		logic_hash = "v1_sha256_f4eb82f59dbe07c8f1ee2d03c53cd893a45918aeff41d261754b918f12bf1430"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179891,20 +179961,20 @@ rule MALPEDIA_Win_Xfsadm_Auto : FILE
 		$sequence_9 = { b904000000 6a08 6a00 68e8030000 c7400201000000 a1???????? 6a00 }
 
 	condition:
-		7 of them and filesize <566272
+		7 of them and filesize < 566272
 }
 rule MALPEDIA_Win_Bredolab_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c6a2080f-c1fa-51ce-a641-734a6742f158"
+		id = "16e31b97-781b-5c45-918e-0a303f4c1a9f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bredolab"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bredolab_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "2bd111cf3554a8f40745e475f3dd7434ed1da715b8da17d69e83265e9fb05367"
+		logic_hash = "v1_sha256_2bd111cf3554a8f40745e475f3dd7434ed1da715b8da17d69e83265e9fb05367"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179930,20 +180000,20 @@ rule MALPEDIA_Win_Bredolab_Auto : FILE
 		$sequence_9 = { 85c0 0f88ad000000 c7442410e0710010 c744240c40640010 c744240804000000 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Thunderx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1bae1fb1-24b0-5f06-bb80-f0ccbc902def"
+		id = "d07452cf-c9f1-5649-aa1d-e18f25e137d7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thunderx"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.thunderx_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "5011033895d94d0840d4177429f3e9775d789a180c5872dc899a5e5b8dd320c7"
+		logic_hash = "v1_sha256_5011033895d94d0840d4177429f3e9775d789a180c5872dc899a5e5b8dd320c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179969,20 +180039,20 @@ rule MALPEDIA_Win_Thunderx_Auto : FILE
 		$sequence_9 = { 57 8955fc 8b7a14 8bc7 8b7210 2bc6 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize < 319488
 }
 rule MALPEDIA_Win_Absentloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4910d41c-fd9d-58f5-8e0b-80462a82048c"
+		id = "4ccd08d4-ebc9-5028-936b-76556ce0e716"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.absentloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.absentloader_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "247d6cfb768e4552d66056adfd67fbf6ee95131ccc4d55998852773c9971750b"
+		logic_hash = "v1_sha256_247d6cfb768e4552d66056adfd67fbf6ee95131ccc4d55998852773c9971750b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180008,20 +180078,20 @@ rule MALPEDIA_Win_Absentloader_Auto : FILE
 		$sequence_9 = { 8b0c8de8a006fd 804c112802 5b 2bf7 83e6fe 5f 8bc6 }
 
 	condition:
-		7 of them and filesize <794624
+		7 of them and filesize < 794624
 }
 rule MALPEDIA_Win_Sienna_Purple_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bf81e591-f4a8-52d6-a4ec-5bf5ebf65e21"
+		id = "b8bf02e6-4b85-5e89-bf1c-6bc4fccef2f9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sienna_purple"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sienna_purple_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7480d66d62837df5528ba634142a2c05768c45916ca5058033314d20ebc94573"
+		logic_hash = "v1_sha256_7480d66d62837df5528ba634142a2c05768c45916ca5058033314d20ebc94573"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180047,20 +180117,20 @@ rule MALPEDIA_Win_Sienna_Purple_Auto : FILE
 		$sequence_9 = { 8bec 57 8b7d08 8b4708 85c0 7503 5f }
 
 	condition:
-		7 of them and filesize <2930688
+		7 of them and filesize < 2930688
 }
 rule MALPEDIA_Win_Himan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "43abb682-bd1a-5c0e-aa2b-b956d3c70fcc"
+		id = "481129d1-c07e-5d63-afc7-9e9810acbf84"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.himan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.himan_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "30040eb81b0c6b577d494b8638c7a8a804b8dda803c9d87443634bca63af8301"
+		logic_hash = "v1_sha256_30040eb81b0c6b577d494b8638c7a8a804b8dda803c9d87443634bca63af8301"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180086,20 +180156,20 @@ rule MALPEDIA_Win_Himan_Auto : FILE
 		$sequence_9 = { c21800 8b4514 50 ff15???????? 33c0 8da5b0f3ffff }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Snatchcrypto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a0e595f3-b394-5bbb-9fbf-3f77b7a2ff1c"
+		id = "62150707-1402-5f9e-b227-89f926777745"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snatchcrypto"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.snatchcrypto_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "df174efff90118ed4513d3543230102fa070bff240e3fca742525b945490dabd"
+		logic_hash = "v1_sha256_df174efff90118ed4513d3543230102fa070bff240e3fca742525b945490dabd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180125,20 +180195,20 @@ rule MALPEDIA_Win_Snatchcrypto_Auto : FILE
 		$sequence_9 = { 488bd9 4883c108 33f6 e8???????? 85c0 7413 817b3463feffff }
 
 	condition:
-		7 of them and filesize <1400832
+		7 of them and filesize < 1400832
 }
 rule MALPEDIA_Win_Saigon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "67d61467-37a6-5772-94ec-e928f4e39175"
+		id = "6b8a29b1-2d0c-54f2-9acd-798da081d4e6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.saigon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.saigon_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "c3b4f453a06699b81b34d66487fc346a283825480563ae11e28741d2bf0a0cba"
+		logic_hash = "v1_sha256_c3b4f453a06699b81b34d66487fc346a283825480563ae11e28741d2bf0a0cba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180164,20 +180234,20 @@ rule MALPEDIA_Win_Saigon_Auto : FILE
 		$sequence_9 = { 4183cfff 483bce 7439 33d2 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Hackbrowserdata_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d3aae9ed-192f-5ff5-b564-ee9df4ce3245"
+		id = "31ad04ca-ece9-5448-8622-ee57fb8d8f64"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hackbrowserdata"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hackbrowserdata_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "2b6a9208dc476df90c318e1825117cca44974a3b5522e1f9f1cb79fdbda237c3"
+		logic_hash = "v1_sha256_2b6a9208dc476df90c318e1825117cca44974a3b5522e1f9f1cb79fdbda237c3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180203,20 +180273,20 @@ rule MALPEDIA_Win_Hackbrowserdata_Auto : FILE
 		$sequence_9 = { e8???????? 0f1f440000 83f803 750d 8b9424c0000000 85d2 7509 }
 
 	condition:
-		7 of them and filesize <42451968
+		7 of them and filesize < 42451968
 }
 rule MALPEDIA_Win_Rarstar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18a386a5-5130-5703-978a-5323644a8d5c"
+		id = "23419d0d-065d-5953-8b12-1bd11e444722"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rarstar"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rarstar_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "731c9230a2c0993fe7a5be5efd272fc408168bba25b13288ff7847590ce53fc3"
+		logic_hash = "v1_sha256_731c9230a2c0993fe7a5be5efd272fc408168bba25b13288ff7847590ce53fc3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180242,20 +180312,20 @@ rule MALPEDIA_Win_Rarstar_Auto : FILE
 		$sequence_9 = { 52 50 68???????? 57 895c241c c744243802000000 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Feed_Load_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e5e8de31-96f1-50f3-b126-f68009a95e5b"
+		id = "9eb9483d-3aab-5916-9cee-b3be2aa7d193"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.feed_load"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.feed_load_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "46de679564e79b2a5c0b197690c16d63fc18a06e57dcb85568ec77e2699570e3"
+		logic_hash = "v1_sha256_46de679564e79b2a5c0b197690c16d63fc18a06e57dcb85568ec77e2699570e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180281,20 +180351,20 @@ rule MALPEDIA_Win_Feed_Load_Auto : FILE
 		$sequence_9 = { 488d45e0 4533c9 4889442428 33d2 448975e0 48897c2420 458d4101 }
 
 	condition:
-		7 of them and filesize <512000
+		7 of them and filesize < 512000
 }
 rule MALPEDIA_Win_Tinyfluff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7516ef27-cc3c-50fb-887e-45b6927b546c"
+		id = "7dd181d2-8e40-52ef-b389-c80291cf645e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyfluff"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tinyfluff_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "e68e7d6c227d4701d78eb91cd8fa16d542e11d322177ea0064fd63e81ec16ac3"
+		logic_hash = "v1_sha256_e68e7d6c227d4701d78eb91cd8fa16d542e11d322177ea0064fd63e81ec16ac3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180320,20 +180390,20 @@ rule MALPEDIA_Win_Tinyfluff_Auto : FILE
 		$sequence_9 = { 8b4c2468 8d145502000000 8bc1 81fa00100000 7214 8b49fc }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize < 245760
 }
 rule MALPEDIA_Win_Laziok_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "37e29cbd-65ea-5cba-b131-e7a5cbb3dccc"
+		id = "b1e45ef6-824c-5f9c-a160-78f82a125d8c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laziok"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.laziok_auto.yar#L1-L97"
 		license_url = "N/A"
-		logic_hash = "c9f66361581dd6b09edf0f02e114cd674601a3020169deaf28372627acd9b101"
+		logic_hash = "v1_sha256_c9f66361581dd6b09edf0f02e114cd674601a3020169deaf28372627acd9b101"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180357,20 +180427,20 @@ rule MALPEDIA_Win_Laziok_Auto : FILE
 		$sequence_7 = { 7404 8b00 eb03 8b4610 }
 
 	condition:
-		7 of them and filesize <688128
+		7 of them and filesize < 688128
 }
 rule MALPEDIA_Win_Younglotus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "511ee3c4-3a8d-5982-a129-c4f520bbe10e"
+		id = "2eae60ac-745d-51c7-87bf-7118e990e183"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.younglotus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.younglotus_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "22c4cfdc7fd425b818daae07117ab2b0a1f6250b75eb7983096dfb11564bd4bb"
+		logic_hash = "v1_sha256_22c4cfdc7fd425b818daae07117ab2b0a1f6250b75eb7983096dfb11564bd4bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180402,20 +180472,20 @@ rule MALPEDIA_Win_Younglotus_Auto : FILE
 		$sequence_15 = { ff742404 ff15???????? 83f8ff 750e ff15???????? 83f802 7503 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Flash_Develop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4688ecaa-1305-56f1-b990-d34d1967b3cd"
+		id = "fcb1b12b-7bf0-515e-b018-969caffde539"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flash_develop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.flash_develop_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "1b0b49a0bdf8cbe355d0f549d184abf36cc5a8a27ac3e4b70ddcdc76ec6e38f0"
+		logic_hash = "v1_sha256_1b0b49a0bdf8cbe355d0f549d184abf36cc5a8a27ac3e4b70ddcdc76ec6e38f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180441,20 +180511,20 @@ rule MALPEDIA_Win_Flash_Develop_Auto : FILE
 		$sequence_9 = { 893ccd44404800 83c104 81f900010000 0f8c39f8ffff 5f 5e 5d }
 
 	condition:
-		7 of them and filesize <1111040
+		7 of them and filesize < 1111040
 }
 rule MALPEDIA_Win_Bohmini_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c8923e09-0cd1-5865-924f-18639308d13e"
+		id = "f6a79169-fa28-50ba-9ab5-8009311974b0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bohmini"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bohmini_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "d63dab417a618811791980b051ba5149b8c4dca6bd7568c5aa5894be2ba1d4b9"
+		logic_hash = "v1_sha256_d63dab417a618811791980b051ba5149b8c4dca6bd7568c5aa5894be2ba1d4b9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180480,20 +180550,20 @@ rule MALPEDIA_Win_Bohmini_Auto : FILE
 		$sequence_9 = { 8b8c2458020000 8d54244c 51 52 e8???????? 83c408 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Strelastealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f02f870-18a6-5958-8b48-817eb9eee346"
+		id = "7f2739f4-80f3-5eba-ae9e-65c67781fba3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strelastealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.strelastealer_auto.yar#L1-L179"
 		license_url = "N/A"
-		logic_hash = "90e62167509dc36976a411c59d204669c9f40c335a7d35fe2d5657e279efa4d6"
+		logic_hash = "v1_sha256_90e62167509dc36976a411c59d204669c9f40c335a7d35fe2d5657e279efa4d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180525,20 +180595,20 @@ rule MALPEDIA_Win_Strelastealer_Auto : FILE
 		$sequence_15 = { 33d2 488d8de0030000 41b804010000 e8???????? 33d2 488d8dc0010000 41b804010000 }
 
 	condition:
-		7 of them and filesize <266240
+		7 of them and filesize < 266240
 }
 rule MALPEDIA_Win_Flashflood_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8a274825-f4c9-5f62-b907-dfc89a45069c"
+		id = "d035ad73-f8a4-5612-becd-d3ad16a2fb4f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flashflood"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.flashflood_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "683f799d9771d2f1f092dca2666088c76c32113ac36ef3235bcc1b22e7e80191"
+		logic_hash = "v1_sha256_683f799d9771d2f1f092dca2666088c76c32113ac36ef3235bcc1b22e7e80191"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180564,20 +180634,20 @@ rule MALPEDIA_Win_Flashflood_Auto : FILE
 		$sequence_9 = { 50 8d8518ffffff 6880000000 50 53 ff15???????? }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Polyglotduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9c18a5b0-9646-54de-84d3-631d8bf608b5"
+		id = "341e69b9-cdd6-5908-90b0-808dbffe4621"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglotduke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.polyglotduke_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "6e964f854be862afb1ae59446d85c2642af462845dbac22a50b518391d708853"
+		logic_hash = "v1_sha256_6e964f854be862afb1ae59446d85c2642af462845dbac22a50b518391d708853"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180603,20 +180673,20 @@ rule MALPEDIA_Win_Polyglotduke_Auto : FILE
 		$sequence_9 = { 4889742410 57 4881ec10010000 488b05???????? 4833c4 }
 
 	condition:
-		7 of them and filesize <222784
+		7 of them and filesize < 222784
 }
 rule MALPEDIA_Win_Putabmow_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7af0c993-b539-52ac-a45e-8054f116f777"
+		id = "05b4a24c-f52f-54b0-acf2-965831f98f55"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.putabmow"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.putabmow_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "fefc0574406d648a12b534d0b553ded64a93f4ffe228447991ac5fd25e755fac"
+		logic_hash = "v1_sha256_fefc0574406d648a12b534d0b553ded64a93f4ffe228447991ac5fd25e755fac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180642,20 +180712,20 @@ rule MALPEDIA_Win_Putabmow_Auto : FILE
 		$sequence_9 = { eb02 8bc6 8a0458 43 8ac8 }
 
 	condition:
-		7 of them and filesize <704512
+		7 of them and filesize < 704512
 }
 rule MALPEDIA_Win_Pikabot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca491d89-20a6-5b52-8d28-6fe7d217ba54"
+		id = "66f4da7f-10b4-5ce8-b5b2-889b36e7a168"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pikabot_auto.yar#L1-L270"
 		license_url = "N/A"
-		logic_hash = "c58243245af92019919e67e8e639db22bdc3515d5ca76925cfc701e773724623"
+		logic_hash = "v1_sha256_c58243245af92019919e67e8e639db22bdc3515d5ca76925cfc701e773724623"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -180700,20 +180770,20 @@ rule MALPEDIA_Win_Pikabot_Auto : FILE
 		$sequence_28 = { 89442408 31c0 89442404 890424 }
 
 	condition:
-		7 of them and filesize <1717248
+		7 of them and filesize < 1717248
 }
 rule MALPEDIA_Win_Ave_Maria_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8ff9385-aecd-5e0a-9dbf-bb5ae67ce3ce"
+		id = "488c49e4-9fd3-5c5c-83e3-e9d7658fffbe"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ave_maria"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ave_maria_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "059225085d94bd881b5977004829f436c6d9d9c9b3e6a06c534e4dec388c260c"
+		logic_hash = "v1_sha256_059225085d94bd881b5977004829f436c6d9d9c9b3e6a06c534e4dec388c260c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180739,20 +180809,20 @@ rule MALPEDIA_Win_Ave_Maria_Auto : FILE
 		$sequence_9 = { 83ec18 53 8b5d08 56 57 8bf9 53 }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize < 237568
 }
 rule MALPEDIA_Win_Acidbox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef6a2660-06bc-58c1-866c-71c4f81cb840"
+		id = "20664396-7399-53df-ac21-b6102fdb8792"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acidbox"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.acidbox_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "41839e3e93fea6da491d6960f541c70a4bfe5cfb4dca07d8fcde4687922f61de"
+		logic_hash = "v1_sha256_41839e3e93fea6da491d6960f541c70a4bfe5cfb4dca07d8fcde4687922f61de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180778,20 +180848,20 @@ rule MALPEDIA_Win_Acidbox_Auto : FILE
 		$sequence_9 = { 8bf7 49897ba0 448bff 49897bb0 }
 
 	condition:
-		7 of them and filesize <589824
+		7 of them and filesize < 589824
 }
 rule MALPEDIA_Win_Dusttrap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "94c0bae7-72b6-5bce-b0c6-34a621d70e05"
+		id = "04862092-8949-5da1-a62a-dabc69e24a74"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dusttrap"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dusttrap_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "f4b4f45042cbce5a99225f86a255feaeb3d8c391ba31ee586efa9930ba8ea747"
+		logic_hash = "v1_sha256_f4b4f45042cbce5a99225f86a255feaeb3d8c391ba31ee586efa9930ba8ea747"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180817,20 +180887,20 @@ rule MALPEDIA_Win_Dusttrap_Auto : FILE
 		$sequence_9 = { 4c89642430 4c89642428 4c89642420 0f1145b0 e8???????? 3d03010000 7534 }
 
 	condition:
-		7 of them and filesize <421888
+		7 of them and filesize < 421888
 }
 rule MALPEDIA_Win_Rctrl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7ff215c3-2671-5b0b-ba24-88d7d36afa71"
+		id = "f68ad5cd-6f8e-54b1-9885-f9a91c704088"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rctrl"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rctrl_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "b0421815065d5d9f7baf76708ca03a7d751899f6c6932dc7218ef3afe98a981a"
+		logic_hash = "v1_sha256_b0421815065d5d9f7baf76708ca03a7d751899f6c6932dc7218ef3afe98a981a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180856,20 +180926,20 @@ rule MALPEDIA_Win_Rctrl_Auto : FILE
 		$sequence_9 = { 50 8d4dc8 e8???????? 85c0 0f84c5070000 895dac c745a870535700 }
 
 	condition:
-		7 of them and filesize <4315136
+		7 of them and filesize < 4315136
 }
 rule MALPEDIA_Win_Medusa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e5ced166-c5f3-50c0-9e84-e449f6bff889"
+		id = "083d83f0-0fa1-5d09-9718-81c5829bc0f2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.medusa"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.medusa_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "b88f5d47ff30b39fc78331a46c037d026177b73d253964f40555a9ce1312bb08"
+		logic_hash = "v1_sha256_b88f5d47ff30b39fc78331a46c037d026177b73d253964f40555a9ce1312bb08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180901,20 +180971,20 @@ rule MALPEDIA_Win_Medusa_Auto : FILE
 		$sequence_15 = { 813bf80937dc 8b4c6386 8608 5f }
 
 	condition:
-		7 of them and filesize <1720320
+		7 of them and filesize < 1720320
 }
 rule MALPEDIA_Win_Mocton_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0eb53608-52dd-5157-b27a-400060a227c2"
+		id = "befd0700-4bdd-5ed5-b8ce-79d1a5a6840d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mocton"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mocton_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "ab360491efcec62323f6bd101f123d7a2664b6f36f37ac6acc5b7e8f64a1cf18"
+		logic_hash = "v1_sha256_ab360491efcec62323f6bd101f123d7a2664b6f36f37ac6acc5b7e8f64a1cf18"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180940,20 +181010,20 @@ rule MALPEDIA_Win_Mocton_Auto : FILE
 		$sequence_9 = { 0f9dc1 81e1b0c00d60 740c 8b55f0 81e2803636b3 8955f0 eb1d }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize < 573440
 }
 rule MALPEDIA_Win_Sslmm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4fb6315d-623b-56fe-a1a9-1366cd8ee4e8"
+		id = "4d79f66e-91ba-500b-950a-e1f9eebcd2ae"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sslmm"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sslmm_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "e05d1383c6fd4195ee348036204c560e38cfb3624a913866f02778d6ae43e5d9"
+		logic_hash = "v1_sha256_e05d1383c6fd4195ee348036204c560e38cfb3624a913866f02778d6ae43e5d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180979,20 +181049,20 @@ rule MALPEDIA_Win_Sslmm_Auto : FILE
 		$sequence_9 = { ff15???????? 6a00 6a00 8d542418 6a00 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Datper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "48b52ade-f95f-5b7e-bf6c-1ada03264771"
+		id = "af8d85cf-112d-5b38-881a-1d88611b341a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.datper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.datper_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "34ec1eabfa283c917df6f57bb7cf677574c84996d2deb9b676fabcef09eea21f"
+		logic_hash = "v1_sha256_34ec1eabfa283c917df6f57bb7cf677574c84996d2deb9b676fabcef09eea21f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181018,20 +181088,20 @@ rule MALPEDIA_Win_Datper_Auto : FILE
 		$sequence_9 = { 8bd6 8bc6 e8???????? 33ff c745f400004000 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Rofin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0195ab71-caac-5cd0-8cdc-a4640763982a"
+		id = "638254eb-3946-550d-b88b-1dfb37c8353b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rofin"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rofin_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "1fdbbf0f641674931110c0fd75e6ced74603c00b71d8e67aaa8404e587da89df"
+		logic_hash = "v1_sha256_1fdbbf0f641674931110c0fd75e6ced74603c00b71d8e67aaa8404e587da89df"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181057,20 +181127,20 @@ rule MALPEDIA_Win_Rofin_Auto : FILE
 		$sequence_9 = { 83c604 83c410 83c714 81fe???????? 7cdf 8bcd e8???????? }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize < 409600
 }
 rule MALPEDIA_Win_Hermes_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "88136c82-87ab-5f89-8963-9afb9534a540"
+		id = "af5fe316-0525-520e-81fd-fd8f505dbe6d"
 		date = "2021-10-07"
 		modified = "2021-10-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes_ransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hermes_ransom_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "2bb9637b7e3ee9fcdd4e957eade001e8c8132e1b7c987ea6727ab44eda025915"
+		logic_hash = "v1_sha256_2bb9637b7e3ee9fcdd4e957eade001e8c8132e1b7c987ea6727ab44eda025915"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181096,20 +181166,20 @@ rule MALPEDIA_Win_Hermes_Ransom_Auto : FILE
 		$sequence_9 = { 83e002 7415 ff750c ff75fc e8???????? 59 }
 
 	condition:
-		7 of them and filesize <7192576
+		7 of them and filesize < 7192576
 }
 rule MALPEDIA_Win_Remy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9e3d091c-9c3e-5358-821c-2201f723e147"
+		id = "855da8af-46c4-5e56-b91f-937c463aa92f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.remy_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "75f06668797d3499803b9fa9b8dc61118625be3fbfdaf403e38706d03959bd0b"
+		logic_hash = "v1_sha256_75f06668797d3499803b9fa9b8dc61118625be3fbfdaf403e38706d03959bd0b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181135,20 +181205,20 @@ rule MALPEDIA_Win_Remy_Auto : FILE
 		$sequence_9 = { 8b4210 83c7f0 89642448 89642448 ffd0 395f0c 8d4f0c }
 
 	condition:
-		7 of them and filesize <507904
+		7 of them and filesize < 507904
 }
 rule MALPEDIA_Win_Nokki_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "608277dd-14a1-5c03-9518-935e0938d8bc"
+		id = "92ae503b-757e-589f-9e96-fac217cb216d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nokki"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nokki_auto.yar#L1-L154"
 		license_url = "N/A"
-		logic_hash = "f2978451176a73f0cc8bbc4000d4256ca994dc4b0d13d500f33621551196e998"
+		logic_hash = "v1_sha256_f2978451176a73f0cc8bbc4000d4256ca994dc4b0d13d500f33621551196e998"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181178,20 +181248,20 @@ rule MALPEDIA_Win_Nokki_Auto : FILE
 		$sequence_13 = { 741b 8b06 8bc8 c1f905 83e01f c1e006 8b0c8d80054100 }
 
 	condition:
-		7 of them and filesize <454656
+		7 of them and filesize < 454656
 }
 rule MALPEDIA_Win_Wipbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "285c0b10-9c1f-573b-962d-50c3932d3768"
+		id = "b066e001-ab46-5ee7-b2cc-0c8b8caa3ccd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wipbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wipbot_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "194fd4449423e13c04280571bb64d77c07b6c4746542edc34cc7c2636335ecb2"
+		logic_hash = "v1_sha256_194fd4449423e13c04280571bb64d77c07b6c4746542edc34cc7c2636335ecb2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181217,20 +181287,20 @@ rule MALPEDIA_Win_Wipbot_Auto : FILE
 		$sequence_9 = { 81ce00009f00 e9???????? 8b44bdc8 e8???????? }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_8Base_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "75838edc-73a2-5e39-b8ec-96e50d44170a"
+		id = "c7e9b297-f8a2-5b07-a15c-2ff3537671e4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.8base"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.8base_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "928a212ebdb041c9575d16d9def4153d3085b06453acab4557e4b175f3e06eda"
+		logic_hash = "v1_sha256_928a212ebdb041c9575d16d9def4153d3085b06453acab4557e4b175f3e06eda"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181256,20 +181326,20 @@ rule MALPEDIA_Win_8Base_Auto : FILE
 		$sequence_9 = { 899c24ac000000 3bfb 7449 8b8424b8000000 56 8d742418 }
 
 	condition:
-		7 of them and filesize <10838016
+		7 of them and filesize < 10838016
 }
 rule MALPEDIA_Win_Rcs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5cb7f68d-21c9-5599-a702-4f54a0b6f0b5"
+		id = "597683b8-5f1c-5493-8584-b33c280dba5e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rcs"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rcs_auto.yar#L1-L180"
 		license_url = "N/A"
-		logic_hash = "bb528f6bd9f82e58eb70b918c0975f8fb2e7c478b0eed2addcdb6f608a2b172e"
+		logic_hash = "v1_sha256_bb528f6bd9f82e58eb70b918c0975f8fb2e7c478b0eed2addcdb6f608a2b172e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181303,20 +181373,20 @@ rule MALPEDIA_Win_Rcs_Auto : FILE
 		$sequence_17 = { 83fb01 750e 8b463c 8d5640 }
 
 	condition:
-		7 of them and filesize <11501568
+		7 of them and filesize < 11501568
 }
 rule MALPEDIA_Win_Vhd_Ransomware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fa5e5a99-c535-5a94-a209-b7a09fa24c2a"
+		id = "8bef782b-ecc1-5132-a259-5d65940901ce"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vhd_ransomware"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vhd_ransomware_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "084f45fac9b312e6724b7901489af4dd8f07289f6b7a3bdcfaaadbb0b1238055"
+		logic_hash = "v1_sha256_084f45fac9b312e6724b7901489af4dd8f07289f6b7a3bdcfaaadbb0b1238055"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181342,20 +181412,20 @@ rule MALPEDIA_Win_Vhd_Ransomware_Auto : FILE
 		$sequence_9 = { d9bd1ee6ffff 0fb7851ee6ffff 0d000c0000 898518e6ffff 43 d9ad18e6ffff db9d18e6ffff }
 
 	condition:
-		7 of them and filesize <275456
+		7 of them and filesize < 275456
 }
 rule MALPEDIA_Win_Crypto_Fortress_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b81b861a-e59d-5e35-89f8-b48e5d1e64a8"
+		id = "425e304a-f82a-52f3-a4ea-ee014aa600eb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypto_fortress"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crypto_fortress_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "7ca8cfbcda8442ad971ad2acb852f7382cff13447a653716ebcb2d4ba6db0aed"
+		logic_hash = "v1_sha256_7ca8cfbcda8442ad971ad2acb852f7382cff13447a653716ebcb2d4ba6db0aed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181381,20 +181451,20 @@ rule MALPEDIA_Win_Crypto_Fortress_Auto : FILE
 		$sequence_9 = { 68???????? ff35???????? e8???????? 85c0 0f842b010000 a3???????? }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Agfspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "10a5651b-99ec-562f-82a5-e11489c17110"
+		id = "a7e154ed-9f25-517f-8587-d7a692ab503a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agfspy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.agfspy_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "2e86502162b077190fa9b6bc0039b0226221ca91b45f721fc1b45981eaf2202d"
+		logic_hash = "v1_sha256_2e86502162b077190fa9b6bc0039b0226221ca91b45f721fc1b45981eaf2202d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181420,20 +181490,20 @@ rule MALPEDIA_Win_Agfspy_Auto : FILE
 		$sequence_9 = { 75ed eb7c 83f85c 7403 50 eb6d 3bf9 }
 
 	condition:
-		7 of them and filesize <1482752
+		7 of them and filesize < 1482752
 }
 rule MALPEDIA_Win_Latrodectus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02322cd8-96f0-5b56-94f1-88df3945f27c"
+		id = "c4317e45-c83e-5cd6-b899-99d906256c10"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.latrodectus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.latrodectus_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "91b2f62d96756249c5bc2116ba49c8b0c1df538f3c82f3888f308bd5e8fea475"
+		logic_hash = "v1_sha256_91b2f62d96756249c5bc2116ba49c8b0c1df538f3c82f3888f308bd5e8fea475"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181459,20 +181529,20 @@ rule MALPEDIA_Win_Latrodectus_Auto : FILE
 		$sequence_9 = { 8b442428 390424 732f 8b442408 c1e808 8b0c24 488b542420 }
 
 	condition:
-		7 of them and filesize <173056
+		7 of them and filesize < 173056
 }
 rule MALPEDIA_Win_Btcware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0a15c264-44c4-5125-8666-5205c4d8e175"
+		id = "994a0fb0-798e-5b7f-ad36-7eaa56a1a179"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.btcware"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.btcware_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "f2d147920cfa04deca980bc5278a317aec1f05504da7229422f4351e420db59d"
+		logic_hash = "v1_sha256_f2d147920cfa04deca980bc5278a317aec1f05504da7229422f4351e420db59d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181498,20 +181568,20 @@ rule MALPEDIA_Win_Btcware_Auto : FILE
 		$sequence_9 = { 833d????????10 bba0fc8101 a1???????? 0f431d???????? 8a4c3df0 85c0 7416 }
 
 	condition:
-		7 of them and filesize <458752
+		7 of them and filesize < 458752
 }
 rule MALPEDIA_Win_Zupdax_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d7482dbc-f70b-5a30-84dd-76b8876bc623"
+		id = "75db184c-bc65-5160-873d-9cbd5659ade2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zupdax"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zupdax_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "c678dda4eb233d445c52eec76463d1638934195de484c67d217556190a9036d4"
+		logic_hash = "v1_sha256_c678dda4eb233d445c52eec76463d1638934195de484c67d217556190a9036d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181537,20 +181607,20 @@ rule MALPEDIA_Win_Zupdax_Auto : FILE
 		$sequence_9 = { ff15???????? 8d442444 83c0fe 668b4802 83c002 }
 
 	condition:
-		7 of them and filesize <1032192
+		7 of them and filesize < 1032192
 }
 rule MALPEDIA_Win_Tflower_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "656aa3e8-bdba-5aaa-91e7-d2cae80667fc"
+		id = "64690192-34a4-5849-9f69-c1b01732aa38"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tflower"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tflower_auto.yar#L1-L155"
 		license_url = "N/A"
-		logic_hash = "5567cb36102c74631716b6bc2ab76355b3e5f81ea5dbfa12803ccef6f940b1df"
+		logic_hash = "v1_sha256_5567cb36102c74631716b6bc2ab76355b3e5f81ea5dbfa12803ccef6f940b1df"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181582,20 +181652,20 @@ rule MALPEDIA_Win_Tflower_Auto : FILE
 		$sequence_15 = { 000b 8605???????? 007885 0500788605 }
 
 	condition:
-		7 of them and filesize <6578176
+		7 of them and filesize < 6578176
 }
 rule MALPEDIA_Win_Babylon_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f7a1796-9db6-5951-ad0f-bee6b4401843"
+		id = "89c230d9-121c-5e8f-a132-1df6f1666609"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babylon_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.babylon_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "21f4c795c3602b5a17bf075d20095868b597667dfa16017802f014398ad09283"
+		logic_hash = "v1_sha256_21f4c795c3602b5a17bf075d20095868b597667dfa16017802f014398ad09283"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181621,20 +181691,20 @@ rule MALPEDIA_Win_Babylon_Rat_Auto : FILE
 		$sequence_9 = { eb75 0fbf4320 3bc8 7514 8b45b8 6a00 03c1 }
 
 	condition:
-		7 of them and filesize <1604608
+		7 of them and filesize < 1604608
 }
 rule MALPEDIA_Win_Hikit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3cdc5f2c-e59e-5de2-a448-8a8d65bcfa6a"
+		id = "7e652416-6ec0-5a58-84cb-3a86042b2002"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hikit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hikit_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "0bc449cc629b4fb561ad191213636c79bd60e251037b5d8cd78af6bf7f1045a2"
+		logic_hash = "v1_sha256_0bc449cc629b4fb561ad191213636c79bd60e251037b5d8cd78af6bf7f1045a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181660,20 +181730,20 @@ rule MALPEDIA_Win_Hikit_Auto : FILE
 		$sequence_9 = { e9???????? 48 8b842468010000 0fb600 240f 0fb6c0 c1e002 }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize < 573440
 }
 rule MALPEDIA_Win_Rawdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4d5ade47-14c0-5e98-bb49-10b170788d30"
+		id = "37d6e979-4ed0-5f75-ae0c-ab48a5b661bb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rawdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rawdoor_auto.yar#L1-L155"
 		license_url = "N/A"
-		logic_hash = "271dc4d0258aafb48e5ea172443314b54c134d84f01d29ab84a2d16da5831287"
+		logic_hash = "v1_sha256_271dc4d0258aafb48e5ea172443314b54c134d84f01d29ab84a2d16da5831287"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181704,20 +181774,20 @@ rule MALPEDIA_Win_Rawdoor_Auto : FILE
 		$sequence_14 = { 030c8540150310 eb02 8bce f6412480 }
 
 	condition:
-		7 of them and filesize <445440
+		7 of them and filesize < 445440
 }
 rule MALPEDIA_Win_Cryptic_Convo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee0bcadb-9b51-5f84-8a43-144a3ffa84ad"
+		id = "512cbdbd-ef8b-5a3d-876b-9016634a0d86"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptic_convo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cryptic_convo_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "ba224512d1d5c20e7f8dff36dcd163b0f00725bbb0cb250e1837ecee50522cf5"
+		logic_hash = "v1_sha256_ba224512d1d5c20e7f8dff36dcd163b0f00725bbb0cb250e1837ecee50522cf5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181743,20 +181813,20 @@ rule MALPEDIA_Win_Cryptic_Convo_Auto : FILE
 		$sequence_9 = { 75f8 be???????? a5 a5 8d85c0fdffff 50 66a5 }
 
 	condition:
-		7 of them and filesize <97280
+		7 of them and filesize < 97280
 }
 rule MALPEDIA_Win_Nvisospit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f5c60665-a01a-5768-8a20-3005a0276675"
+		id = "22ddd34a-63ad-5d4d-a1dc-79110ef0c255"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nvisospit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nvisospit_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "bbf068c3d3b2f73248f6b6d32c9808daec6187590ab8231b3d2dc1fe1f513715"
+		logic_hash = "v1_sha256_bbf068c3d3b2f73248f6b6d32c9808daec6187590ab8231b3d2dc1fe1f513715"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181782,20 +181852,20 @@ rule MALPEDIA_Win_Nvisospit_Auto : FILE
 		$sequence_9 = { 8b442428 8d50fc 83e2fb 7408 83e840 }
 
 	condition:
-		7 of them and filesize <66560
+		7 of them and filesize < 66560
 }
 rule MALPEDIA_Win_Kins_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d3620de7-0502-5d17-b47d-c76d16c08a91"
+		id = "b2110a48-d69b-5157-a996-87ea958f6af2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kins"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kins_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "f2c2bfcf5e7ce9dcb0b01d359d338a97b9128c8cf189b0c6d157b8680e4a55a3"
+		logic_hash = "v1_sha256_f2c2bfcf5e7ce9dcb0b01d359d338a97b9128c8cf189b0c6d157b8680e4a55a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181821,20 +181891,20 @@ rule MALPEDIA_Win_Kins_Auto : FILE
 		$sequence_9 = { e8???????? 8d742448 e8???????? 33ff 85ff }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize < 548864
 }
 rule MALPEDIA_Win_Fonix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "13e11a44-10a3-5017-894b-01b6a1809d38"
+		id = "e8d57c2e-1ae3-52aa-af59-731c1232b43f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fonix"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fonix_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "4ee726385c93cbef83aaf363fadcc91c1116e9967604b802fb868026ddede36e"
+		logic_hash = "v1_sha256_4ee726385c93cbef83aaf363fadcc91c1116e9967604b802fb868026ddede36e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181860,20 +181930,20 @@ rule MALPEDIA_Win_Fonix_Auto : FILE
 		$sequence_9 = { 50 e8???????? 83c408 50 68???????? 8d4d5c e8???????? }
 
 	condition:
-		7 of them and filesize <2226176
+		7 of them and filesize < 2226176
 }
 rule MALPEDIA_Win_Goggles_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a06c6e9-c0df-5eb2-9be8-0912ecacc960"
+		id = "c9e58408-8287-5e33-8fc1-06399ee5f72a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goggles"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.goggles_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "6adf86a94e27e4da9bbef6eb899bde95be7c68b8b1a213561e769f61dd93d169"
+		logic_hash = "v1_sha256_6adf86a94e27e4da9bbef6eb899bde95be7c68b8b1a213561e769f61dd93d169"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181899,20 +181969,20 @@ rule MALPEDIA_Win_Goggles_Auto : FILE
 		$sequence_9 = { a0???????? 55 57 88442410 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Ziyangrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "201f34db-38cb-5eda-937b-85ae79e54374"
+		id = "e6d0a5c5-722a-5efa-835d-b333b71254d8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ziyangrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ziyangrat_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "f833bf74199bebd7dff936e145830c4820d190515f18da15b78535e3254684ab"
+		logic_hash = "v1_sha256_f833bf74199bebd7dff936e145830c4820d190515f18da15b78535e3254684ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181938,20 +182008,20 @@ rule MALPEDIA_Win_Ziyangrat_Auto : FILE
 		$sequence_9 = { 85c0 0f84dd000000 8b44241c 3bc3 7634 8d4c241c }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Romeos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb3171da-1b84-5cda-93f9-c750b4ebf760"
+		id = "e14ca3d1-c086-513c-8900-fa37d340463c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.romeos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.romeos_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "bf8e366219ae553a8681194274b3fe54bbd7c5cf107fd9635cc89862e4d3fd87"
+		logic_hash = "v1_sha256_bf8e366219ae553a8681194274b3fe54bbd7c5cf107fd9635cc89862e4d3fd87"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -181983,20 +182053,20 @@ rule MALPEDIA_Win_Romeos_Auto : FILE
 		$sequence_15 = { 6a01 51 c744242c0c000000 89742430 895c2434 }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize < 294912
 }
 rule MALPEDIA_Win_Temp_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b48048b-b096-5784-980a-c1580b4dfd03"
+		id = "739e794a-46e7-5fbd-adfb-9a77d584846e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.temp_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.temp_stealer_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "2fe51b5c6906bc550bb0cdd93c915effb0d85e2b560daf9bcb0132c66585b9e7"
+		logic_hash = "v1_sha256_2fe51b5c6906bc550bb0cdd93c915effb0d85e2b560daf9bcb0132c66585b9e7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182022,20 +182092,20 @@ rule MALPEDIA_Win_Temp_Stealer_Auto : FILE
 		$sequence_9 = { 8d58b0 498bce 448bc3 488d15f8280100 e8???????? 85c0 7429 }
 
 	condition:
-		7 of them and filesize <652288
+		7 of them and filesize < 652288
 }
 rule MALPEDIA_Win_Rifdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "499aaa99-f413-5777-add2-b3ffc4ab58b2"
+		id = "64972f5b-5c7f-5949-a690-1cce4e1ecd0b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rifdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rifdoor_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "238633b85866a846f2bb6c165a492790b5a2e2a57ade12fcf4d261ecd5fc10cd"
+		logic_hash = "v1_sha256_238633b85866a846f2bb6c165a492790b5a2e2a57ade12fcf4d261ecd5fc10cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182067,20 +182137,20 @@ rule MALPEDIA_Win_Rifdoor_Auto : FILE
 		$sequence_15 = { 53 57 8d858cf8ffff 50 8d8d24ffffff }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Hui_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "175084ea-2a45-5f42-bda4-3cc233036dd9"
+		id = "fece07b3-5053-5293-b344-2762557ff467"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hui_loader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hui_loader_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "96ca3a225904ad2e70a598c1b3c7fa88d26822a60a6742e1663517bed35c0526"
+		logic_hash = "v1_sha256_96ca3a225904ad2e70a598c1b3c7fa88d26822a60a6742e1663517bed35c0526"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182106,20 +182176,20 @@ rule MALPEDIA_Win_Hui_Loader_Auto : FILE
 		$sequence_9 = { 7e0f 8b4efc 8b5401fc 031401 8b0e 891401 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Listrix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f00b612a-8ee6-5314-b10b-7290e9e1e604"
+		id = "8bc03eff-44af-50c7-973c-79c467277f89"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.listrix"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.listrix_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "2287c5f695d49f8318bd5f0c78a77cdf4d2c441f03bbfda75594fd76fd20827f"
+		logic_hash = "v1_sha256_2287c5f695d49f8318bd5f0c78a77cdf4d2c441f03bbfda75594fd76fd20827f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182145,20 +182215,20 @@ rule MALPEDIA_Win_Listrix_Auto : FILE
 		$sequence_9 = { 6a00 8d95e4f9ffff 52 ff15???????? 85c0 0f84bb000000 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Virtualgate_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "532683a6-8cc0-5db0-a44c-3ae7cc350778"
+		id = "4df816d0-4602-55b2-a0f5-50a21bc3dd6f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virtualgate"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.virtualgate_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "88ee3ecdf07b44d4f393563ecf7e06ea2c4377ec1fc56b55a448fb7ea043998d"
+		logic_hash = "v1_sha256_88ee3ecdf07b44d4f393563ecf7e06ea2c4377ec1fc56b55a448fb7ea043998d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182184,20 +182254,20 @@ rule MALPEDIA_Win_Virtualgate_Auto : FILE
 		$sequence_9 = { e8???????? 44386dcf 7409 488b4db7 e8???????? 44386dff 7409 }
 
 	condition:
-		7 of them and filesize <323584
+		7 of them and filesize < 323584
 }
 rule MALPEDIA_Win_3Cx_Backdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2feaa4e-af6b-5757-88c5-19fa5e0f7c9e"
+		id = "a71b9ffb-252c-5d2b-9b9d-919c271f01f0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.3cx_backdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.3cx_backdoor_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "92678e8f023e2e18a272c55dabf9fa5b49a39a58d01ec45cd8edb3c746fea107"
+		logic_hash = "v1_sha256_92678e8f023e2e18a272c55dabf9fa5b49a39a58d01ec45cd8edb3c746fea107"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182223,20 +182293,20 @@ rule MALPEDIA_Win_3Cx_Backdoor_Auto : FILE
 		$sequence_9 = { e8???????? 90 e8???????? 90 488bd3 488d8d80000000 e8???????? }
 
 	condition:
-		7 of them and filesize <585728
+		7 of them and filesize < 585728
 }
 rule MALPEDIA_Win_Apocalipto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "58f415e5-91b6-56af-81ea-f9ae50f28789"
+		id = "e1ae6845-111c-51af-8cb3-ea1c6a6e3bad"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalipto"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.apocalipto_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "48ade2c833b72b6d2d3dc07dbbdbc3c6fed84013a5bea316066eb8c372c170b2"
+		logic_hash = "v1_sha256_48ade2c833b72b6d2d3dc07dbbdbc3c6fed84013a5bea316066eb8c372c170b2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182262,20 +182332,20 @@ rule MALPEDIA_Win_Apocalipto_Auto : FILE
 		$sequence_9 = { 83ec08 a3???????? 85c0 0f843b0b0000 c7442404???????? 891c24 ff15???????? }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Gcleaner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f3bfcb33-d9d5-58c8-b732-fae47caf5ec8"
+		id = "65fbdfae-2097-5f12-989e-05c108d6688b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gcleaner_auto.yar#L1-L110"
 		license_url = "N/A"
-		logic_hash = "46f1f4e86df7721d1ed8e6509c63180bfe445457c94a26b5c8b0a0ee89dd2952"
+		logic_hash = "v1_sha256_46f1f4e86df7721d1ed8e6509c63180bfe445457c94a26b5c8b0a0ee89dd2952"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182301,20 +182371,20 @@ rule MALPEDIA_Win_Gcleaner_Auto : FILE
 		$sequence_9 = { 8d8d60ffffff e8???????? 6a00 6a00 8d4dd8 e8???????? 50 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize < 540672
 }
 rule MALPEDIA_Win_Unidentified_076_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c83626b-47ce-55ce-a381-007bcb7e73d5"
+		id = "f253b641-2e93-5db9-86a6-11647cf9917d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_076"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_076_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "92802d8a51aa29b7bc92df361f52f4a28a9ddff1846405226196ebfa4afe53d1"
+		logic_hash = "v1_sha256_92802d8a51aa29b7bc92df361f52f4a28a9ddff1846405226196ebfa4afe53d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182340,20 +182410,20 @@ rule MALPEDIA_Win_Unidentified_076_Auto : FILE
 		$sequence_9 = { 4885c9 7415 488b8308010000 33d2 41b800800000 ff9000010000 4889bbe0000000 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Microcin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e3018704-b085-5615-9047-7419a64c6b42"
+		id = "239b2b00-32b8-56bb-afd2-a188f5b7d1d6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.microcin"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.microcin_auto.yar#L1-L451"
 		license_url = "N/A"
-		logic_hash = "ce937d5b0febb8a0ef0b69b389b9ac6e2a402988a44ce06e021321112f9c236c"
+		logic_hash = "v1_sha256_ce937d5b0febb8a0ef0b69b389b9ac6e2a402988a44ce06e021321112f9c236c"
 		score = 75
 		quality = 44
 		tags = "FILE"
@@ -182419,20 +182489,20 @@ rule MALPEDIA_Win_Microcin_Auto : FILE
 		$sequence_49 = { 8b5664 8d4c1105 8908 68ebeeebee ff7658 e8???????? }
 
 	condition:
-		7 of them and filesize <417792
+		7 of them and filesize < 417792
 }
 rule MALPEDIA_Win_Ratel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7eb1cf1a-9399-50f9-a3fb-9725ac6a1e01"
+		id = "6483c8e4-3b9f-5002-a4c5-fec54c46fb0e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ratel_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "d4d80b213dd2387d65ee9b24a5f750334253f3a710c3a54d1bb71b146d82d823"
+		logic_hash = "v1_sha256_d4d80b213dd2387d65ee9b24a5f750334253f3a710c3a54d1bb71b146d82d823"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182458,20 +182528,20 @@ rule MALPEDIA_Win_Ratel_Auto : FILE
 		$sequence_9 = { 8b4524 8b55b8 83ec08 8b4db4 8955a0 8b00 3b4da4 }
 
 	condition:
-		7 of them and filesize <2174976
+		7 of them and filesize < 2174976
 }
 rule MALPEDIA_Win_Imprudentcook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e705cf05-f0e2-52d1-a85e-1511f7ba8697"
+		id = "e1102ea0-66b8-5b2e-87f9-92c648e53e1c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.imprudentcook"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.imprudentcook_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7d085ab823410a63e41a516b8f50c0d9f8600ba4763b5093b512309c5b8e436e"
+		logic_hash = "v1_sha256_7d085ab823410a63e41a516b8f50c0d9f8600ba4763b5093b512309c5b8e436e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182497,20 +182567,20 @@ rule MALPEDIA_Win_Imprudentcook_Auto : FILE
 		$sequence_9 = { 84c0 7506 4883eb08 75ed 48ffc3 488bcb 48d3ea }
 
 	condition:
-		7 of them and filesize <864256
+		7 of them and filesize < 864256
 }
 rule MALPEDIA_Win_Magniber_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7fac4144-b4d1-566a-b639-19fbbfbfa437"
+		id = "0645f536-caaa-56d2-84ae-f609b9ba22df"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magniber"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.magniber_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "f96a42bc667d201d8cee5f819105f9eb43cfe17ca799b1fa9b8dd76d6755feb0"
+		logic_hash = "v1_sha256_f96a42bc667d201d8cee5f819105f9eb43cfe17ca799b1fa9b8dd76d6755feb0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182542,20 +182612,20 @@ rule MALPEDIA_Win_Magniber_Auto : FILE
 		$sequence_15 = { e8???????? 32cb 5a b3b1 }
 
 	condition:
-		7 of them and filesize <117760
+		7 of them and filesize < 117760
 }
 rule MALPEDIA_Win_Clop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d1ccc182-0c15-5d56-97cc-8d7a704e7207"
+		id = "793c321a-ea21-5e71-9da0-ecf9970dbd1c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.clop_auto.yar#L1-L193"
 		license_url = "N/A"
-		logic_hash = "3750789377624c88727401f0639208a90e22f423fdcc34c5c702f455dce2beef"
+		logic_hash = "v1_sha256_3750789377624c88727401f0639208a90e22f423fdcc34c5c702f455dce2beef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182591,20 +182661,20 @@ rule MALPEDIA_Win_Clop_Auto : FILE
 		$sequence_19 = { 6a00 56 ffd7 8b35???????? 6800800000 }
 
 	condition:
-		7 of them and filesize <796672
+		7 of them and filesize < 796672
 }
 rule MALPEDIA_Win_Moriagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8ea17c80-9deb-5afe-98a3-751e4ae48a8a"
+		id = "e85c44f0-f2fb-5530-809a-ece429461e02"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriagent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.moriagent_auto.yar#L1-L152"
 		license_url = "N/A"
-		logic_hash = "b07e11158ac51efd9de0395dc805b23dd409bb1c9d15248d2eea5cac8417e1fb"
+		logic_hash = "v1_sha256_b07e11158ac51efd9de0395dc805b23dd409bb1c9d15248d2eea5cac8417e1fb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182635,20 +182705,20 @@ rule MALPEDIA_Win_Moriagent_Auto : FILE
 		$sequence_14 = { e8???????? 488bd8 488d15caad0600 488bcf }
 
 	condition:
-		7 of them and filesize <1347904
+		7 of them and filesize < 1347904
 }
 rule MALPEDIA_Win_W32Times_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7f8cab1b-98aa-5ea0-a38a-8a88f0f95260"
+		id = "3a889528-c1c9-5987-b5f8-082ec24ef114"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.w32times"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.w32times_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "9e441675ff42eb62c793bece475e1238e60eea81c292e3ab2a330e03a3660487"
+		logic_hash = "v1_sha256_9e441675ff42eb62c793bece475e1238e60eea81c292e3ab2a330e03a3660487"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182674,20 +182744,20 @@ rule MALPEDIA_Win_W32Times_Auto : FILE
 		$sequence_9 = { 83c40c 85c0 0f85e00c0000 8b4b04 6a04 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Dratzarus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9c3af3dd-4032-5af8-b2c4-ec6909e4538c"
+		id = "c913dab2-e77a-585c-b783-94e2e9f0be45"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dratzarus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dratzarus_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "2840756e9ce2aef8d569e9bd5574fc7ae7c62b15ae58ef485173a9e6c40f95ff"
+		logic_hash = "v1_sha256_2840756e9ce2aef8d569e9bd5574fc7ae7c62b15ae58ef485173a9e6c40f95ff"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182713,20 +182783,20 @@ rule MALPEDIA_Win_Dratzarus_Auto : FILE
 		$sequence_9 = { 488b05???????? 4889470e 8b05???????? 894716 33c0 }
 
 	condition:
-		7 of them and filesize <1606656
+		7 of them and filesize < 1606656
 }
 rule MALPEDIA_Win_Blackmagic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "df0b2b99-699a-561e-81a2-262819321991"
+		id = "91b4a857-5a5f-5af4-b7a0-fe8d0d847bad"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackmagic"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blackmagic_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "8896e03618f3636d9e8021773bcbae5a5f1f7f57b30da18d455d4ffaf6317ffa"
+		logic_hash = "v1_sha256_8896e03618f3636d9e8021773bcbae5a5f1f7f57b30da18d455d4ffaf6317ffa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182752,20 +182822,20 @@ rule MALPEDIA_Win_Blackmagic_Auto : FILE
 		$sequence_9 = { 4533c0 e8???????? 90 488d0535330300 488903 488bc3 4883c430 }
 
 	condition:
-		7 of them and filesize <1416192
+		7 of them and filesize < 1416192
 }
 rule MALPEDIA_Win_Protonbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8cdc823c-c8c1-58ea-8d03-57dbf9ef2cfb"
+		id = "3f1b8630-b0a7-59b2-bd2e-92317c7966de"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.protonbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.protonbot_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "1da2c73b33dd64c5d5bd2696d510d134f1603c96fce2824c4a93e6a826735bf1"
+		logic_hash = "v1_sha256_1da2c73b33dd64c5d5bd2696d510d134f1603c96fce2824c4a93e6a826735bf1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182791,20 +182861,20 @@ rule MALPEDIA_Win_Protonbot_Auto : FILE
 		$sequence_9 = { 56 8b35???????? ffd6 ffb5c0f7ffff ffd6 }
 
 	condition:
-		7 of them and filesize <1073152
+		7 of them and filesize < 1073152
 }
 rule MALPEDIA_Win_Rarog_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6993ce44-e3a7-570d-bdd2-f949ea883388"
+		id = "fdb31ada-dd22-53ef-8657-3de4d3b45525"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rarog"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rarog_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "dcc275a3610670298392baeef430ff6a6f46366e16201b4054f65002692c15e6"
+		logic_hash = "v1_sha256_dcc275a3610670298392baeef430ff6a6f46366e16201b4054f65002692c15e6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182830,20 +182900,20 @@ rule MALPEDIA_Win_Rarog_Auto : FILE
 		$sequence_9 = { 53 56 8d8d2cfdffff e8???????? 53 56 8d8df4fcffff }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize < 598016
 }
 rule MALPEDIA_Win_Hesperbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb461f42-9b9a-5e68-bbce-8f8a48953354"
+		id = "25a41448-2af7-5b94-801f-e82fa5b48c6a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hesperbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hesperbot_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5b0325f4989a837a39c4052bc59652c8fb0f8c04335eefffdde925a80c93ba45"
+		logic_hash = "v1_sha256_5b0325f4989a837a39c4052bc59652c8fb0f8c04335eefffdde925a80c93ba45"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182869,20 +182939,20 @@ rule MALPEDIA_Win_Hesperbot_Auto : FILE
 		$sequence_9 = { 8902 894104 5f 33c0 40 5e c3 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Sobig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1db89ea4-c7b4-580a-8658-7872983b45bd"
+		id = "cf7a5149-cdad-56e1-9b13-b44049498681"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sobig"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sobig_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "703647dd78e5c80dff25867b8b892bf4ae4d1517eb9d703a33dee66b43a14d30"
+		logic_hash = "v1_sha256_703647dd78e5c80dff25867b8b892bf4ae4d1517eb9d703a33dee66b43a14d30"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -182908,20 +182978,20 @@ rule MALPEDIA_Win_Sobig_Auto : FILE
 		$sequence_9 = { 8a1f 47 83f80b 0f8777020000 ff2485563b4100 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Nspx30_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "47a5f87a-bd45-5a39-bf1f-2280475ca3dc"
+		id = "0b6a06d0-d600-5d08-9e9b-239eb2b7623d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nspx30"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nspx30_auto.yar#L1-L307"
 		license_url = "N/A"
-		logic_hash = "60a2afbb46ed2d066c5213f1fddc7a9e909463149f91997e5d932b09b46a1178"
+		logic_hash = "v1_sha256_60a2afbb46ed2d066c5213f1fddc7a9e909463149f91997e5d932b09b46a1178"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -182968,20 +183038,20 @@ rule MALPEDIA_Win_Nspx30_Auto : FILE
 		$sequence_30 = { 8d7c240c 83c9ff 33c0 c644240c57 c644240d69 }
 
 	condition:
-		7 of them and filesize <3789824
+		7 of them and filesize < 3789824
 }
 rule MALPEDIA_Win_Doublepulsar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f29ce0a7-5938-5b7b-b2a5-1e58b48324b4"
+		id = "efb60609-e682-5e94-a80a-b427179c9847"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublepulsar"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.doublepulsar_auto.yar#L1-L178"
 		license_url = "N/A"
-		logic_hash = "2279c234c2a28c8a309faafd6821b4cb1af9e5365add72a62e549a791ef8e967"
+		logic_hash = "v1_sha256_2279c234c2a28c8a309faafd6821b4cb1af9e5365add72a62e549a791ef8e967"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183013,20 +183083,20 @@ rule MALPEDIA_Win_Doublepulsar_Auto : FILE
 		$sequence_15 = { ffd5 83c408 85c0 7562 8b16 c744242401000000 }
 
 	condition:
-		7 of them and filesize <140288
+		7 of them and filesize < 140288
 }
 rule MALPEDIA_Win_Vshell_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4d7f1293-ffbb-5626-82e1-c6ee180846fc"
+		id = "2787018e-7677-5da9-96cb-b7cf46d458d2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vshell_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0b9171ca5e9865b14566a3ce59438d8b7cb591eb5aa3cd70720ec9582e22ec53"
+		logic_hash = "v1_sha256_0b9171ca5e9865b14566a3ce59438d8b7cb591eb5aa3cd70720ec9582e22ec53"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183052,20 +183122,20 @@ rule MALPEDIA_Win_Vshell_Auto : FILE
 		$sequence_9 = { 7667 4881fa00100000 be00100000 4189d0 4c0f4fc6 90 4981f800100000 }
 
 	condition:
-		7 of them and filesize <39452672
+		7 of them and filesize < 39452672
 }
 rule MALPEDIA_Win_Shimrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "55457a06-1988-5269-89a3-7d42c80efbb3"
+		id = "6e0cdeb1-7563-5b40-b790-17ef2fc29cf4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shimrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shimrat_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "9a44a689bc8afe661c9129a62baf593cebe3f41d9c0399451d80b6ae3b28e636"
+		logic_hash = "v1_sha256_9a44a689bc8afe661c9129a62baf593cebe3f41d9c0399451d80b6ae3b28e636"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183091,20 +183161,20 @@ rule MALPEDIA_Win_Shimrat_Auto : FILE
 		$sequence_9 = { ff7560 ffd6 e9???????? 53 ebd0 8d4d28 e8???????? }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Bazarbackdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a043fe1e-731d-5a9e-9fb9-7f9cee445985"
+		id = "5daf3e69-85e1-55f2-a462-11f0795cf0b7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bazarbackdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bazarbackdoor_auto.yar#L1-L596"
 		license_url = "N/A"
-		logic_hash = "fa8de6b24d77371b268d10b4378b94df76c1989be3511c0a0f6cfa11ec9c195b"
+		logic_hash = "v1_sha256_fa8de6b24d77371b268d10b4378b94df76c1989be3511c0a0f6cfa11ec9c195b"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -183192,20 +183262,20 @@ rule MALPEDIA_Win_Bazarbackdoor_Auto : FILE
 		$sequence_71 = { 488d0de3380200 4803c8 488bc1 48634c2434 488d04c8 48634c2438 8b0488 }
 
 	condition:
-		7 of them and filesize <2088960
+		7 of them and filesize < 2088960
 }
 rule MALPEDIA_Win_Voldemort_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "115d33d2-50af-5fac-a879-fb480a2fd38a"
+		id = "218ff0f4-bfd0-5cd0-9919-6ba18078c586"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.voldemort"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.voldemort_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "f8d7f88b5cd57c32e85ea5f0ae8c31ab594e2a2acc618e6a4574791256fd098d"
+		logic_hash = "v1_sha256_f8d7f88b5cd57c32e85ea5f0ae8c31ab594e2a2acc618e6a4574791256fd098d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183231,20 +183301,20 @@ rule MALPEDIA_Win_Voldemort_Auto : FILE
 		$sequence_9 = { 488bc8 e8???????? 488bd8 4885c0 7517 488d0dde400300 e8???????? }
 
 	condition:
-		7 of them and filesize <561152
+		7 of them and filesize < 561152
 }
 rule MALPEDIA_Win_Flying_Dutchman_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "886d0773-9268-59b5-bd3b-294bdb3b9350"
+		id = "4d513e0d-e024-52cd-8724-5ee45afafd29"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flying_dutchman"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.flying_dutchman_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "db7ff3ab0ec7e2a2a2d94a46706f998e00b81b5002023e59f4f386401742ebb6"
+		logic_hash = "v1_sha256_db7ff3ab0ec7e2a2a2d94a46706f998e00b81b5002023e59f4f386401742ebb6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183270,20 +183340,20 @@ rule MALPEDIA_Win_Flying_Dutchman_Auto : FILE
 		$sequence_9 = { 8d442410 89742408 8d4802 668b10 83c002 6685d2 75f5 }
 
 	condition:
-		7 of them and filesize <276480
+		7 of them and filesize < 276480
 }
 rule MALPEDIA_Win_Friedex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2136bda7-6880-57af-8169-a2ba9b9744fa"
+		id = "d4ecab61-96b1-5bc4-8396-022f559d65eb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.friedex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.friedex_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "3133b9fe228e62a956c776f3b2c9ea0b2f6b9e5dde15151f1885bdca3ce807d5"
+		logic_hash = "v1_sha256_3133b9fe228e62a956c776f3b2c9ea0b2f6b9e5dde15151f1885bdca3ce807d5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183315,20 +183385,20 @@ rule MALPEDIA_Win_Friedex_Auto : FILE
 		$sequence_15 = { e8???????? 8d0d4430a500 31d2 8b75f8 89460c 890c24 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Iispy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f477a1c5-e3be-5ef8-b32e-8b426be4a34a"
+		id = "8be51c27-e65b-546a-8b01-5961d7dd39f7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iispy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.iispy_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "a63d1814fb9729f25b3d33b430e70a4df7089bb73b4fd099189f97e6642fe502"
+		logic_hash = "v1_sha256_a63d1814fb9729f25b3d33b430e70a4df7089bb73b4fd099189f97e6642fe502"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183354,20 +183424,20 @@ rule MALPEDIA_Win_Iispy_Auto : FILE
 		$sequence_9 = { 743a 56 ff75c4 8d4dc8 e8???????? 8b7de0 85ff }
 
 	condition:
-		7 of them and filesize <397312
+		7 of them and filesize < 397312
 }
 rule MALPEDIA_Win_Green_Dispenser_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "84ada711-0fc6-5325-8121-c6b1b7bed827"
+		id = "74282c15-7f93-5e80-b240-1843de0da5fb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.green_dispenser"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.green_dispenser_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "871957685fdf3c7f3a313c97f44c2b4e50a7c0cccb8e8255b3b477d16c388ef7"
+		logic_hash = "v1_sha256_871957685fdf3c7f3a313c97f44c2b4e50a7c0cccb8e8255b3b477d16c388ef7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183393,20 +183463,20 @@ rule MALPEDIA_Win_Green_Dispenser_Auto : FILE
 		$sequence_9 = { 894c240c 84c0 7404 660f57c4 8b7c2414 c644242025 }
 
 	condition:
-		7 of them and filesize <838656
+		7 of them and filesize < 838656
 }
 rule MALPEDIA_Win_C0D0So0_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb44345c-7e5d-55a8-a363-6f4dd49ac691"
+		id = "d8d05f75-6777-5557-a3ec-144ad82dae84"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.c0d0so0"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.c0d0so0_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "268a1640f52d336fbac005894a892b3cb4160d26716dda753325e6e4796f541a"
+		logic_hash = "v1_sha256_268a1640f52d336fbac005894a892b3cb4160d26716dda753325e6e4796f541a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183432,20 +183502,20 @@ rule MALPEDIA_Win_C0D0So0_Auto : FILE
 		$sequence_9 = { eb07 8a4901 eb02 8a09 57 }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize < 450560
 }
 rule MALPEDIA_Win_Batchwiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8e0f816b-f334-5f53-bde8-8c13e5a1573a"
+		id = "da6bca3a-81d7-52d9-b24f-366c3dc7ed01"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.batchwiper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.batchwiper_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "7b7cda4dab9bb8ec218294d77768f35a5d54eba78e3d583128b9f7cf9e6690f0"
+		logic_hash = "v1_sha256_7b7cda4dab9bb8ec218294d77768f35a5d54eba78e3d583128b9f7cf9e6690f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183471,20 +183541,20 @@ rule MALPEDIA_Win_Batchwiper_Auto : FILE
 		$sequence_9 = { 46 46 53 686d490100 57 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize < 270336
 }
 rule MALPEDIA_Win_Alreay_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "01f61c78-bfa8-5f5f-a6a2-e7995cbc405d"
+		id = "6ae13bf3-b25a-5f41-b361-9dedbda5497c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alreay"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.alreay_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "bcfb6d409e0586aac8c1117f30af44579c0e0ed1018da12aba1f4024fa72bbe6"
+		logic_hash = "v1_sha256_bcfb6d409e0586aac8c1117f30af44579c0e0ed1018da12aba1f4024fa72bbe6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183510,20 +183580,20 @@ rule MALPEDIA_Win_Alreay_Auto : FILE
 		$sequence_9 = { 3d2c010000 7d1f 8d8664860000 50 e8???????? 8bd8 83c404 }
 
 	condition:
-		7 of them and filesize <1867776
+		7 of them and filesize < 1867776
 }
 rule MALPEDIA_Win_Dispenserxfs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49bf9fde-27a7-5a52-b363-6d4c360f5198"
+		id = "00ff9cb0-f21d-5dee-9337-73a408d82a89"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dispenserxfs"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dispenserxfs_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "0ae97d732c7fee9f1fd4b6377f2a916fed962748494ab51169af7ce6e36e4229"
+		logic_hash = "v1_sha256_0ae97d732c7fee9f1fd4b6377f2a916fed962748494ab51169af7ce6e36e4229"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183549,20 +183619,20 @@ rule MALPEDIA_Win_Dispenserxfs_Auto : FILE
 		$sequence_9 = { 8d55c4 83c414 8bf2 8a02 42 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Touchmove_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a88e9c25-4116-5e49-8a2c-fef3336f0802"
+		id = "fab3efd7-7f83-59fd-96df-3f0fd93789ad"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.touchmove"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.touchmove_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "519a7e3bd048a6a0769391087a62b1ec389f7202cc576a740e9eb0fb3d43844d"
+		logic_hash = "v1_sha256_519a7e3bd048a6a0769391087a62b1ec389f7202cc576a740e9eb0fb3d43844d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183588,20 +183658,20 @@ rule MALPEDIA_Win_Touchmove_Auto : FILE
 		$sequence_9 = { 8bc8 e8???????? ebc9 488bcb 488bc3 488d1597e40000 48c1f805 }
 
 	condition:
-		7 of them and filesize <224256
+		7 of them and filesize < 224256
 }
 rule MALPEDIA_Win_Skip20_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "15b7373a-f84f-57db-8d95-802539d58928"
+		id = "1715a1ef-e508-50be-8546-83e0deb15af3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skip20"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.skip20_auto.yar#L1-L102"
 		license_url = "N/A"
-		logic_hash = "9f59196702302927edbd3dc2784c10dacebf31e2e8430b74641bf84000e5924e"
+		logic_hash = "v1_sha256_9f59196702302927edbd3dc2784c10dacebf31e2e8430b74641bf84000e5924e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183625,20 +183695,20 @@ rule MALPEDIA_Win_Skip20_Auto : FILE
 		$sequence_7 = { 8b0d???????? 488bd8 ff15???????? 4883fb01 7466 }
 
 	condition:
-		7 of them and filesize <794624
+		7 of them and filesize < 794624
 }
 rule MALPEDIA_Win_Lechiket_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3c392c3e-349a-5ca1-96fd-f1ca584c8f71"
+		id = "e7c5cf43-046d-5bbd-be32-e8e5276d5c87"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lechiket"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lechiket_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "e5f8571d03794447ef51373bbf17c3e068216c3a3171d9d6c8a00d68358f6b61"
+		logic_hash = "v1_sha256_e5f8571d03794447ef51373bbf17c3e068216c3a3171d9d6c8a00d68358f6b61"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183664,20 +183734,20 @@ rule MALPEDIA_Win_Lechiket_Auto : FILE
 		$sequence_9 = { ff34bd68830100 e8???????? a1???????? 47 83c504 3bf8 72bb }
 
 	condition:
-		7 of them and filesize <331776
+		7 of them and filesize < 331776
 }
 rule MALPEDIA_Win_Pkybot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9566564a-6687-550f-9183-0e62d1076054"
+		id = "879a99ec-2c32-5bdd-b06c-6ecb23668226"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pkybot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pkybot_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "a42386b2108c9d1af3a399f3ab6d599f676b5aeb865fae8577e3f6311e115c33"
+		logic_hash = "v1_sha256_a42386b2108c9d1af3a399f3ab6d599f676b5aeb865fae8577e3f6311e115c33"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183703,20 +183773,20 @@ rule MALPEDIA_Win_Pkybot_Auto : FILE
 		$sequence_9 = { ff7510 ff750c 57 ff7508 e8???????? 57 8bd8 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Logtu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "94e45298-e780-5ad6-8cab-2da098818af3"
+		id = "29eac636-77f4-5fd8-87fd-1f754cc65b8a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.logtu"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.logtu_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "b14516261bf7c410bd1f687a208584a9b7a9e03096d2ecbcc28b896d23b0142d"
+		logic_hash = "v1_sha256_b14516261bf7c410bd1f687a208584a9b7a9e03096d2ecbcc28b896d23b0142d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183742,20 +183812,20 @@ rule MALPEDIA_Win_Logtu_Auto : FILE
 		$sequence_9 = { 50 ff15???????? 6a01 8bf0 8d85a4fdffff 68???????? 50 }
 
 	condition:
-		7 of them and filesize <924672
+		7 of them and filesize < 924672
 }
 rule MALPEDIA_Win_Banjori_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0fe922ef-f1d7-5df7-a358-1fecc2c2b8e9"
+		id = "bb7d0aef-483d-5898-8fb9-aac24e307db9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banjori"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.banjori_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "0ea88ecfce727aae78a4405fc075f0c940df492b8f26cbc0ee71a3d10d4f39b8"
+		logic_hash = "v1_sha256_0ea88ecfce727aae78a4405fc075f0c940df492b8f26cbc0ee71a3d10d4f39b8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -183781,20 +183851,20 @@ rule MALPEDIA_Win_Banjori_Auto : FILE
 		$sequence_9 = { 57 e8???????? 395dc8 0f843a010000 ff75e4 57 ff15???????? }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Bka_Trojaner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "74ec4af9-e2de-59bf-b310-d52e9a27c28c"
+		id = "628f4067-c3c9-5578-9fab-860463cf9a39"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bka_trojaner"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bka_trojaner_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "b667f447169e58d5bdd1a72921cf0718ce5c118c508bba9ba523771b59233c38"
+		logic_hash = "v1_sha256_b667f447169e58d5bdd1a72921cf0718ce5c118c508bba9ba523771b59233c38"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183820,20 +183890,20 @@ rule MALPEDIA_Win_Bka_Trojaner_Auto : FILE
 		$sequence_9 = { 8b542448 894104 8b44244c 895108 8b542464 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize < 221184
 }
 rule MALPEDIA_Win_Crackedcantil_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "52d95e2e-99ba-5a33-908a-7559ea7385c4"
+		id = "62682a36-713f-5a6b-a005-b745846ed781"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crackedcantil"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crackedcantil_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "17b1a73eb9ece6311db723bfa77f75998ebf06320351a537998796263eeb6f3a"
+		logic_hash = "v1_sha256_17b1a73eb9ece6311db723bfa77f75998ebf06320351a537998796263eeb6f3a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183859,20 +183929,20 @@ rule MALPEDIA_Win_Crackedcantil_Auto : FILE
 		$sequence_9 = { f3aa 488d05e9923200 4889842450040000 488b842450040000 488bc8 e8???????? 488d05ca923200 }
 
 	condition:
-		7 of them and filesize <37863424
+		7 of them and filesize < 37863424
 }
 rule MALPEDIA_Win_Bookcodesrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "99ba8457-466c-5891-8a8f-fdeb5f482f06"
+		id = "4a7ac24e-e1ac-55f8-9d12-c73d0b1a28bb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bookcodesrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bookcodesrat_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "97a726b41418f1d2b06b45e6dc5e4910d38bdcc7f5f296e48cad978114a25824"
+		logic_hash = "v1_sha256_97a726b41418f1d2b06b45e6dc5e4910d38bdcc7f5f296e48cad978114a25824"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183898,20 +183968,20 @@ rule MALPEDIA_Win_Bookcodesrat_Auto : FILE
 		$sequence_9 = { 48ffc6 4883c310 493bf4 b900000000 7c8e 4c8b6580 4c8b6c2478 }
 
 	condition:
-		7 of them and filesize <544768
+		7 of them and filesize < 544768
 }
 rule MALPEDIA_Win_Shujin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a43000e-7971-5f56-a789-53c0781b645d"
+		id = "14a1bc2b-8e00-5fa5-9f52-8b4d554c16aa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shujin"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shujin_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "9e7c36d5a8e7a7e0db70030a2edbd679a6e8a68faaf57024a99c72983d6e53eb"
+		logic_hash = "v1_sha256_9e7c36d5a8e7a7e0db70030a2edbd679a6e8a68faaf57024a99c72983d6e53eb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183937,20 +184007,20 @@ rule MALPEDIA_Win_Shujin_Auto : FILE
 		$sequence_9 = { 56 8d45dc e8???????? 8d45ec 50 ff7620 ff15???????? }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize < 172032
 }
 rule MALPEDIA_Win_Matrix_Banker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fbbbed54-1d1e-54ca-b972-776370388fdc"
+		id = "82530052-9446-58ea-b99c-54f9b2187f1a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matrix_banker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.matrix_banker_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "418333eb6355aa1c00334bbe82cc7f9927e2216ee2cd2f63bf5855e96db3a4a8"
+		logic_hash = "v1_sha256_418333eb6355aa1c00334bbe82cc7f9927e2216ee2cd2f63bf5855e96db3a4a8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -183976,20 +184046,20 @@ rule MALPEDIA_Win_Matrix_Banker_Auto : FILE
 		$sequence_9 = { 8d4a9f 80f905 7705 80c2a9 eb0b 8d4abf }
 
 	condition:
-		7 of them and filesize <422912
+		7 of them and filesize < 422912
 }
 rule MALPEDIA_Win_Pebbledash_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "32b0f21d-5afa-53d6-93e7-29fbd519196d"
+		id = "ec1c2044-2e5a-5b22-a09b-fde77faa202d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pebbledash"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pebbledash_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "9344c4ac60887a4e00c22de66e7202e2f1a072e514ea3fdd68e29205e525a98f"
+		logic_hash = "v1_sha256_9344c4ac60887a4e00c22de66e7202e2f1a072e514ea3fdd68e29205e525a98f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184021,20 +184091,20 @@ rule MALPEDIA_Win_Pebbledash_Auto : FILE
 		$sequence_15 = { 41c1e008 8905???????? 0fb64201 440bc0 }
 
 	condition:
-		7 of them and filesize <677888
+		7 of them and filesize < 677888
 }
 rule MALPEDIA_Win_Rising_Sun_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e7041472-db64-5ca5-926c-a3eb0b3a9cad"
+		id = "6e46e97c-f421-5fcb-8918-da4d9630b4e5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rising_sun"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rising_sun_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "7e3e464c1a03d1cb6ef88adda73a2c17dabfe5f93751654747dc236b8a8e7509"
+		logic_hash = "v1_sha256_7e3e464c1a03d1cb6ef88adda73a2c17dabfe5f93751654747dc236b8a8e7509"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184060,20 +184130,20 @@ rule MALPEDIA_Win_Rising_Sun_Auto : FILE
 		$sequence_9 = { c744246c3ffbe9ea c7442470f94bc72d c7442474d9ec5e31 c7442478b1fab2fb c744247c3ecc0cc2 c74580af6c9d01 c74584614a63ca }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize < 409600
 }
 rule MALPEDIA_Win_Collection_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1b2d65a3-063f-5da2-afcb-bd2cf7ccde3f"
+		id = "7b5d3e75-cdaf-5732-b612-6e446f3f3b76"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.collection_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.collection_rat_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "a7a889a1cf63b732a0e6294d85395ab72d5994c8a4737c39e94d8d81761fea64"
+		logic_hash = "v1_sha256_a7a889a1cf63b732a0e6294d85395ab72d5994c8a4737c39e94d8d81761fea64"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184099,20 +184169,20 @@ rule MALPEDIA_Win_Collection_Rat_Auto : FILE
 		$sequence_9 = { 488bc8 bac8000000 e8???????? 488bd0 41b810000000 488bcb 4883c420 }
 
 	condition:
-		7 of them and filesize <397312
+		7 of them and filesize < 397312
 }
 rule MALPEDIA_Win_Penco_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a328cbb1-7204-553d-a05a-a09a312a6db7"
+		id = "9c88b8b0-20b2-5246-b556-95842ae2e144"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.penco"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.penco_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "e33ab85787ce312a011f9fd963d9c309cc71808ca3fa13b59754045a420c6308"
+		logic_hash = "v1_sha256_e33ab85787ce312a011f9fd963d9c309cc71808ca3fa13b59754045a420c6308"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184138,20 +184208,20 @@ rule MALPEDIA_Win_Penco_Auto : FILE
 		$sequence_9 = { 83c40c 8b8554beffff 69c0c4020000 c784059c96ffff4d000000 e9???????? c7851c94ffff00000000 b901000000 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize < 319488
 }
 rule MALPEDIA_Win_Webc2_Table_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f2e05018-a2cd-5f74-9326-c8e1d8ecd04d"
+		id = "96c78171-830e-59dc-9037-39ad0ba1fe2d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_table"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_table_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "7af577baa9db86d99239cfd53a2d34bbabd6fc2e47d46dae6b2b1756d43598d7"
+		logic_hash = "v1_sha256_7af577baa9db86d99239cfd53a2d34bbabd6fc2e47d46dae6b2b1756d43598d7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184177,20 +184247,20 @@ rule MALPEDIA_Win_Webc2_Table_Auto : FILE
 		$sequence_9 = { 8b55f0 8bcf 2bd7 8975f8 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Tofsee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77c418f3-cea7-5bdf-bba1-bed4438fce6c"
+		id = "162bf417-4496-522d-bfe8-cb9045019db7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tofsee_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "072fc19fe47ee3a53dbd73b9def787fe701419f7ff08ef93e84b3d80d7a1f117"
+		logic_hash = "v1_sha256_072fc19fe47ee3a53dbd73b9def787fe701419f7ff08ef93e84b3d80d7a1f117"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184216,20 +184286,20 @@ rule MALPEDIA_Win_Tofsee_Auto : FILE
 		$sequence_9 = { 8b7508 83c608 8bc6 8d4801 8a10 40 3ad3 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Ariabody_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "09c48148-a35c-5dbf-9884-3f4ca9e8942d"
+		id = "2b050b59-cd5c-5d65-9525-f3541b7616e6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ariabody"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ariabody_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "d2889556cedcf38c4ea9e1f0b840f1fda159a165dc69125aae39d5a13e01fecd"
+		logic_hash = "v1_sha256_d2889556cedcf38c4ea9e1f0b840f1fda159a165dc69125aae39d5a13e01fecd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184261,20 +184331,20 @@ rule MALPEDIA_Win_Ariabody_Auto : FILE
 		$sequence_15 = { 488d942492020000 ff96b8010000 4889e9 488d942420020000 ff96b8010000 4889e9 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Obscene_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d248edfb-cd2d-59a2-b789-bf38244829c1"
+		id = "5af39186-6670-537b-9b07-078b7d86bd56"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.obscene"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.obscene_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "39a0d4041b2cc668b4ace8ad4daf4cef6d2ee34b044053350de4964082b18c2d"
+		logic_hash = "v1_sha256_39a0d4041b2cc668b4ace8ad4daf4cef6d2ee34b044053350de4964082b18c2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184300,20 +184370,20 @@ rule MALPEDIA_Win_Obscene_Auto : FILE
 		$sequence_9 = { 51 51 8d45f8 50 6a06 68???????? ff35???????? }
 
 	condition:
-		7 of them and filesize <2170880
+		7 of them and filesize < 2170880
 }
 rule MALPEDIA_Win_Winordll64_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "08e3713d-71e0-5b8a-9ceb-d90daa753676"
+		id = "81feb80a-10c5-5a16-973c-b18aa9947262"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winordll64"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.winordll64_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "a4a004425dba88268c2d3d715c259f2863978c42cd46c83d869be58ecc44a5d1"
+		logic_hash = "v1_sha256_a4a004425dba88268c2d3d715c259f2863978c42cd46c83d869be58ecc44a5d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184339,20 +184409,20 @@ rule MALPEDIA_Win_Winordll64_Auto : FILE
 		$sequence_9 = { 488bc1 48ffc0 ffc3 803800 75f6 4533c9 4533c0 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Prestige_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e0029ece-b029-5766-af56-54e290d25cc7"
+		id = "4c6fafda-cacb-5431-9b5f-9544165d5674"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prestige"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.prestige_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "bf3e8d9d4daef418b3a3a7f61bd3283d0f9369ffef531d651e87452e24457972"
+		logic_hash = "v1_sha256_bf3e8d9d4daef418b3a3a7f61bd3283d0f9369ffef531d651e87452e24457972"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184378,20 +184448,20 @@ rule MALPEDIA_Win_Prestige_Auto : FILE
 		$sequence_9 = { e9???????? 8b4d08 8d45f0 50 c745f054334700 c745f40e000000 }
 
 	condition:
-		7 of them and filesize <1518592
+		7 of them and filesize < 1518592
 }
 rule MALPEDIA_Win_Mole_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6fb57925-5672-50fa-ac3a-bb409269cd91"
+		id = "988eb0cf-3c01-5192-ad66-2b69efb93e6b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mole"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mole_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "d2300b61acf948bdcbf42bf1210c281241845787d88efeb1407824c182f5bb45"
+		logic_hash = "v1_sha256_d2300b61acf948bdcbf42bf1210c281241845787d88efeb1407824c182f5bb45"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184417,20 +184487,20 @@ rule MALPEDIA_Win_Mole_Auto : FILE
 		$sequence_9 = { ff15???????? 85c0 7507 33c0 e9???????? 8d55fc }
 
 	condition:
-		7 of them and filesize <297984
+		7 of them and filesize < 297984
 }
 rule MALPEDIA_Win_Ehdevel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7db917ef-bc83-5744-b6c0-6eb0a0f20aea"
+		id = "28f8648f-2af2-5e09-8142-aa3f30cb8dec"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ehdevel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ehdevel_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "9b05c9bc40d7442213206fba6f4d684a37ffe66d5cd633b4545ba4a54fb64f27"
+		logic_hash = "v1_sha256_9b05c9bc40d7442213206fba6f4d684a37ffe66d5cd633b4545ba4a54fb64f27"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184456,20 +184526,20 @@ rule MALPEDIA_Win_Ehdevel_Auto : FILE
 		$sequence_9 = { 7514 68???????? 6800040000 8d842408080000 50 eb28 68???????? }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize < 524288
 }
 rule MALPEDIA_Win_Gootkit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a3a6e6c9-1219-5f09-a9d1-18bdb3a0aef0"
+		id = "82addef4-1fdd-524a-86fc-9cd0dd45bb4c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gootkit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gootkit_auto.yar#L1-L333"
 		license_url = "N/A"
-		logic_hash = "07bd7f30e8bca19c8b0b8ce140e27e4d72a01335eb0ac2905d18ed037638c9b8"
+		logic_hash = "v1_sha256_07bd7f30e8bca19c8b0b8ce140e27e4d72a01335eb0ac2905d18ed037638c9b8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -184522,20 +184592,20 @@ rule MALPEDIA_Win_Gootkit_Auto : FILE
 		$sequence_36 = { 7323 8b33 eb19 3ce9 7508 8b4601 83c605 }
 
 	condition:
-		7 of them and filesize <516096
+		7 of them and filesize < 516096
 }
 rule MALPEDIA_Win_Bid_Ransomware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e2459c49-87ff-58be-b5d8-513cfe01796f"
+		id = "054e4a87-bad2-5fac-8627-ef5318139f5f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bid_ransomware"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bid_ransomware_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "932fef61c31980fb36a4d7c0896110af89987a449be43ee55891fe684dd7e3ac"
+		logic_hash = "v1_sha256_932fef61c31980fb36a4d7c0896110af89987a449be43ee55891fe684dd7e3ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184561,20 +184631,20 @@ rule MALPEDIA_Win_Bid_Ransomware_Auto : FILE
 		$sequence_9 = { bb01000000 d3e3 23d8 7421 50 51 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Montysthree_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0d03b577-0149-576c-bee9-a21123040e4f"
+		id = "f8c55eb9-4c68-5793-994a-a7c7805ab15a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.montysthree"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.montysthree_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "bf3d99d0efe6d2be58b918ad67e35573b0208282c240cbcabb922d766da8ba39"
+		logic_hash = "v1_sha256_bf3d99d0efe6d2be58b918ad67e35573b0208282c240cbcabb922d766da8ba39"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184600,20 +184670,20 @@ rule MALPEDIA_Win_Montysthree_Auto : FILE
 		$sequence_9 = { 53 57 53 6aff 53 8d4de8 }
 
 	condition:
-		7 of them and filesize <458752
+		7 of them and filesize < 458752
 }
 rule MALPEDIA_Win_Unidentified_078_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "64f36470-7870-5fa2-9ea9-c0ec36ad9821"
+		id = "b986c32c-776a-5e76-8dc3-f87d1a1d80f9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_078"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_078_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "b2ccb25b85c44f5791ffc176375cf264c69c00ab695680a03b0c62f11e1990f7"
+		logic_hash = "v1_sha256_b2ccb25b85c44f5791ffc176375cf264c69c00ab695680a03b0c62f11e1990f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184639,20 +184709,20 @@ rule MALPEDIA_Win_Unidentified_078_Auto : FILE
 		$sequence_9 = { 7437 89da 83e2fd 83fa10 }
 
 	condition:
-		7 of them and filesize <688128
+		7 of them and filesize < 688128
 }
 rule MALPEDIA_Win_Graphican_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82332df7-f8b2-5311-821b-79a046dc5e4d"
+		id = "ea6abbfb-9a73-5381-ba2b-1bfa57a1f1c0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphican"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.graphican_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "e01b6a4a7e17b3788b0929c107b93003400ca0366bc88f55631d49ec789512b2"
+		logic_hash = "v1_sha256_e01b6a4a7e17b3788b0929c107b93003400ca0366bc88f55631d49ec789512b2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184678,20 +184748,20 @@ rule MALPEDIA_Win_Graphican_Auto : FILE
 		$sequence_9 = { ddd8 897dc0 8b450c 8b55c4 8938 895004 }
 
 	condition:
-		7 of them and filesize <362496
+		7 of them and filesize < 362496
 }
 rule MALPEDIA_Win_Merdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef7053a5-476a-59b5-8ddd-5293675500e6"
+		id = "d1883481-1720-5236-ba2f-ced81c630435"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.merdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.merdoor_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "33a0b0b418ee0e7fb6e555149df68449fe325aead89e3fe3bc9a1904f1b68daf"
+		logic_hash = "v1_sha256_33a0b0b418ee0e7fb6e555149df68449fe325aead89e3fe3bc9a1904f1b68daf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184717,20 +184787,20 @@ rule MALPEDIA_Win_Merdoor_Auto : FILE
 		$sequence_9 = { b010 2ac1 f6d0 fec1 3084156cfcffff 42 80f910 }
 
 	condition:
-		7 of them and filesize <307200
+		7 of them and filesize < 307200
 }
 rule MALPEDIA_Win_Conficker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f0b1468f-9383-5532-bcfb-56c04dc4f4a8"
+		id = "35b29bb7-152c-54c7-8972-802e0a0bc2b3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.conficker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.conficker_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "0479575ad4678a4af7a680c76d33baa6776a5c8edf9a46b4e7378756f89a04a2"
+		logic_hash = "v1_sha256_0479575ad4678a4af7a680c76d33baa6776a5c8edf9a46b4e7378756f89a04a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184756,20 +184826,20 @@ rule MALPEDIA_Win_Conficker_Auto : FILE
 		$sequence_9 = { 8954241c 61 c3 ac }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize < 335872
 }
 rule MALPEDIA_Win_Geminiduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02859369-3674-5db5-af28-f984437e92a6"
+		id = "5adc8a9e-e6e4-5142-90b5-74400edf723e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.geminiduke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.geminiduke_auto.yar#L1-L149"
 		license_url = "N/A"
-		logic_hash = "43a7a4a4b6211d31a7f1edbc5b1056c5050268b2a916bbe7f7b62319abe9e067"
+		logic_hash = "v1_sha256_43a7a4a4b6211d31a7f1edbc5b1056c5050268b2a916bbe7f7b62319abe9e067"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184799,20 +184869,20 @@ rule MALPEDIA_Win_Geminiduke_Auto : FILE
 		$sequence_13 = { 66894704 8bc2 c1e010 668b4602 33d2 f7f3 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Bitter_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b3eda11e-9841-5a64-a760-3d15b12e8c6a"
+		id = "ad4ea967-75c0-5997-99c6-e24100138007"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitter_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bitter_rat_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "0cafad6913e5947920a6576295487b4fcd67fc675f1ae39a216d82d179786bf2"
+		logic_hash = "v1_sha256_0cafad6913e5947920a6576295487b4fcd67fc675f1ae39a216d82d179786bf2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184838,20 +184908,20 @@ rule MALPEDIA_Win_Bitter_Rat_Auto : FILE
 		$sequence_9 = { 53 56 57 8dbd94dbffff b91b090000 b8cccccccc }
 
 	condition:
-		7 of them and filesize <1130496
+		7 of them and filesize < 1130496
 }
 rule MALPEDIA_Win_Credraptor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e8ed5662-d50d-5276-970c-7ae5bc800549"
+		id = "d2ae423d-d5b9-5bfd-9465-0ff695beb800"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.credraptor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.credraptor_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "a2be5c2e7aba128bc464089768bae22c73dd588e7ba2a1d837a215f744aa4638"
+		logic_hash = "v1_sha256_a2be5c2e7aba128bc464089768bae22c73dd588e7ba2a1d837a215f744aa4638"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184877,20 +184947,20 @@ rule MALPEDIA_Win_Credraptor_Auto : FILE
 		$sequence_9 = { e8???????? 8b9510ffffff 8bbd00ffffff 0fb6c0 018524ffffff 8d3c17 8bcb }
 
 	condition:
-		7 of them and filesize <1728512
+		7 of them and filesize < 1728512
 }
 rule MALPEDIA_Win_Unidentified_006_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d29f273-95a4-58bd-87cd-6ac677036b5c"
+		id = "484802e1-8718-58d8-ba4a-a9ac5e1bc067"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_006"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_006_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "dd723dd2c53afa22a9c28d9c9c06ec724a63cc0cfcf78b59a425b4cdf0fd8bc1"
+		logic_hash = "v1_sha256_dd723dd2c53afa22a9c28d9c9c06ec724a63cc0cfcf78b59a425b4cdf0fd8bc1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184916,20 +184986,20 @@ rule MALPEDIA_Win_Unidentified_006_Auto : FILE
 		$sequence_9 = { 57 6a40 8bc2 33ff 6800300000 50 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Punkey_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4e1fe79b-2125-523a-abd5-f08f284bf027"
+		id = "a6aba704-6d45-5377-a08b-a2889942e53f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.punkey_pos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.punkey_pos_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "be3234349330303fdbacc67e779ee45aced60b2ad5880e7a508a6b6e58a3eaf4"
+		logic_hash = "v1_sha256_be3234349330303fdbacc67e779ee45aced60b2ad5880e7a508a6b6e58a3eaf4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184955,20 +185025,20 @@ rule MALPEDIA_Win_Punkey_Pos_Auto : FILE
 		$sequence_9 = { 5d c20c00 75e5 56 8b7510 }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize < 499712
 }
 rule MALPEDIA_Win_Faketc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c5dc084d-e278-57fb-9514-ebf606045902"
+		id = "bb52fb4d-1976-5b80-ab7d-f41a592701b4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.faketc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.faketc_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d4858f4d36b9ea8cb8d8cc99b63821ae69695a27a1935e91bfea486ad5660c7d"
+		logic_hash = "v1_sha256_d4858f4d36b9ea8cb8d8cc99b63821ae69695a27a1935e91bfea486ad5660c7d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -184994,20 +185064,20 @@ rule MALPEDIA_Win_Faketc_Auto : FILE
 		$sequence_9 = { e8???????? 83c408 83bdd8fdffff00 7516 8b85d4fdffff 50 e8???????? }
 
 	condition:
-		7 of them and filesize <6864896
+		7 of them and filesize < 6864896
 }
 rule MALPEDIA_Win_Nagini_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "36bcfb0a-2346-546a-ae2c-0b00cc2618a0"
+		id = "29b7c8bf-8278-5962-b6b9-b9bdd716cffb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nagini"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nagini_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "0c83f5c5996fc3fecace2eca42d157da471f759617384a5504d89fe38e4a9faf"
+		logic_hash = "v1_sha256_0c83f5c5996fc3fecace2eca42d157da471f759617384a5504d89fe38e4a9faf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185033,20 +185103,20 @@ rule MALPEDIA_Win_Nagini_Auto : FILE
 		$sequence_9 = { 83f85b 741d 83f85c 7418 }
 
 	condition:
-		7 of them and filesize <12820480
+		7 of them and filesize < 12820480
 }
 rule MALPEDIA_Win_Xiangoop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6e84a1ce-b3cc-5c7d-80b5-2c2f7136b8d8"
+		id = "1aff2e52-2364-58f0-9897-39209099fe0b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xiangoop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xiangoop_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "3a1a5f28cac0124e198da0edd11ac88ef86aa9a350a33831b6bb7ce30756bca1"
+		logic_hash = "v1_sha256_3a1a5f28cac0124e198da0edd11ac88ef86aa9a350a33831b6bb7ce30756bca1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185072,20 +185142,20 @@ rule MALPEDIA_Win_Xiangoop_Auto : FILE
 		$sequence_9 = { 0bc1 ba01000000 d1e2 8b4df4 0fb6541110 81e2ff000000 c1e208 }
 
 	condition:
-		7 of them and filesize <246784
+		7 of them and filesize < 246784
 }
 rule MALPEDIA_Win_Unidentified_075_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "147c0d53-aecb-5cae-ac7f-14d52d3c203f"
+		id = "559cb477-2c95-51d3-b1c6-beb70eb18b13"
 		date = "2023-07-11"
 		modified = "2023-07-15"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_075"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_075_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "10617fdfd534147bc5e0f7e922724e69d45c37af66d21f98c629fa1bac685120"
+		logic_hash = "v1_sha256_10617fdfd534147bc5e0f7e922724e69d45c37af66d21f98c629fa1bac685120"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185111,20 +185181,20 @@ rule MALPEDIA_Win_Unidentified_075_Auto : FILE
 		$sequence_9 = { 81eca4000000 894dfc c745f400000000 c745f800000000 }
 
 	condition:
-		7 of them and filesize <393216
+		7 of them and filesize < 393216
 }
 rule MALPEDIA_Win_Juicy_Potato_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8d631ed2-d4c1-50a7-a41e-e61bbdbf9578"
+		id = "e6c66d4f-0616-554f-a10f-e26bce509ccf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.juicy_potato"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.juicy_potato_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "95a9bfa286d63983a17370c06426811d86dabf6e0c8c9f41f87914697070c991"
+		logic_hash = "v1_sha256_95a9bfa286d63983a17370c06426811d86dabf6e0c8c9f41f87914697070c991"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185150,20 +185220,20 @@ rule MALPEDIA_Win_Juicy_Potato_Auto : FILE
 		$sequence_9 = { 488d8d24030000 898520030000 e8???????? 488d0dc1c0feff 48c1e602 0fb784b950fc0300 488d9140f30300 }
 
 	condition:
-		7 of them and filesize <736256
+		7 of them and filesize < 736256
 }
 rule MALPEDIA_Win_Oni_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5b8ed8df-ac04-55ed-9aa1-c25508ccaf69"
+		id = "28dd5dfe-b54e-508b-884f-ac74fc3e72ab"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oni"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.oni_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "a1166454b136e06548b4b89fd8ff394c058729ff7d3b6449cb76520548366b87"
+		logic_hash = "v1_sha256_a1166454b136e06548b4b89fd8ff394c058729ff7d3b6449cb76520548366b87"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185189,20 +185259,20 @@ rule MALPEDIA_Win_Oni_Auto : FILE
 		$sequence_9 = { 83f810 7241 8b8d98fdffff 40 3d00100000 722a }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize < 499712
 }
 rule MALPEDIA_Win_Romcom_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ac368bf9-8ebe-5cf1-b296-f1d215e57efb"
+		id = "df6e5f41-0010-59c1-ae87-6755bc9bfeac"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.romcom_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.romcom_rat_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "4c8cc2f6b48e17e29a12ff93bdda011d4ae8c63471090287633ffb79d5adb21a"
+		logic_hash = "v1_sha256_4c8cc2f6b48e17e29a12ff93bdda011d4ae8c63471090287633ffb79d5adb21a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185228,20 +185298,20 @@ rule MALPEDIA_Win_Romcom_Rat_Auto : FILE
 		$sequence_9 = { 498bd4 488bcf e8???????? 33db 84c0 758b 448bfe }
 
 	condition:
-		7 of them and filesize <1211392
+		7 of them and filesize < 1211392
 }
 rule MALPEDIA_Win_Curator_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fa7637d1-ef72-55c1-9cd8-4047e79769b0"
+		id = "45bf79c2-80f6-5ff4-adae-19a31e358a51"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.curator"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.curator_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "385564603afac75ab1aef52e96073e79dd684407e092688731815c7fd2379a64"
+		logic_hash = "v1_sha256_385564603afac75ab1aef52e96073e79dd684407e092688731815c7fd2379a64"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185267,20 +185337,20 @@ rule MALPEDIA_Win_Curator_Auto : FILE
 		$sequence_9 = { 0f86cf000000 4183ccff 418bcb 48c1e106 4c89741130 4439741124 0f86a7000000 }
 
 	condition:
-		7 of them and filesize <1265664
+		7 of them and filesize < 1265664
 }
 rule MALPEDIA_Win_Chthonic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "88bbe6d9-2022-5fe0-b1f7-f4f3c2df3385"
+		id = "9aad3357-eb58-586c-ae7c-8be3a6a369f8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chthonic"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chthonic_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "da867e1af67cf97ccf35b53e1588f870d915e4ed4b4f2f84ed6de90f903a9195"
+		logic_hash = "v1_sha256_da867e1af67cf97ccf35b53e1588f870d915e4ed4b4f2f84ed6de90f903a9195"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185306,20 +185376,20 @@ rule MALPEDIA_Win_Chthonic_Auto : FILE
 		$sequence_9 = { c1c108 81e1ff00ff00 0bc1 89470c }
 
 	condition:
-		7 of them and filesize <425984
+		7 of them and filesize < 425984
 }
 rule MALPEDIA_Win_Gspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5725a0eb-387e-5f55-9c61-97bda1555361"
+		id = "657ee87a-9e1e-5f08-9666-5ecf06a496f0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gspy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gspy_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "c2942f87aa0e0d3cd7efb2debc57b53c46a950e05b62dce63b5340d2d7cb5666"
+		logic_hash = "v1_sha256_c2942f87aa0e0d3cd7efb2debc57b53c46a950e05b62dce63b5340d2d7cb5666"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185345,20 +185415,20 @@ rule MALPEDIA_Win_Gspy_Auto : FILE
 		$sequence_9 = { ffd5 3d02010000 750d 803d????????00 0f85fbfeffff 5f 5e }
 
 	condition:
-		7 of them and filesize <421888
+		7 of them and filesize < 421888
 }
 rule MALPEDIA_Win_Unidentified_099_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d97436b2-5a7b-573d-8a35-42ed42551daa"
+		id = "5cc151fc-5a8d-5475-9f22-0fb348ad86bf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_099"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_099_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "05815599a06afec044356539b7fb022948a8fa88c4aa5bb33d6e484e946176ef"
+		logic_hash = "v1_sha256_05815599a06afec044356539b7fb022948a8fa88c4aa5bb33d6e484e946176ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185384,20 +185454,20 @@ rule MALPEDIA_Win_Unidentified_099_Auto : FILE
 		$sequence_9 = { c7442470fedcba98 c744247476543210 660f1f440000 49ffc0 42803c0000 75f6 488d55d0 }
 
 	condition:
-		7 of them and filesize <314368
+		7 of them and filesize < 314368
 }
 rule MALPEDIA_Win_Adylkuzz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "265860c5-c195-5ef7-81e8-066fa261eab1"
+		id = "b598f436-2f28-5fae-97c8-ba6d351d7a6a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adylkuzz"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.adylkuzz_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a5ced23a2b6a73ae95a9a6a65000eaf7907a66a0c142cf3646367ed2ee46dd3d"
+		logic_hash = "v1_sha256_a5ced23a2b6a73ae95a9a6a65000eaf7907a66a0c142cf3646367ed2ee46dd3d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185423,20 +185493,20 @@ rule MALPEDIA_Win_Adylkuzz_Auto : FILE
 		$sequence_9 = { eb24 8d4aff 31c0 85d1 751b c6437523 0fbdd2 }
 
 	condition:
-		7 of them and filesize <6438912
+		7 of them and filesize < 6438912
 }
 rule MALPEDIA_Win_Unidentified_088_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b2c85c30-7ba6-55a0-9cd5-72dd624b0463"
+		id = "753f157c-6e01-561f-8e51-3aa4325ed3c1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_088"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_088_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "43e33104a2b3e4b5653d5103e68195a062333638b6afc520c108067d1cded5c7"
+		logic_hash = "v1_sha256_43e33104a2b3e4b5653d5103e68195a062333638b6afc520c108067d1cded5c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185462,20 +185532,20 @@ rule MALPEDIA_Win_Unidentified_088_Auto : FILE
 		$sequence_9 = { 720d 48 891c24 89442404 e8???????? 8b470c 8b55d4 }
 
 	condition:
-		7 of them and filesize <919552
+		7 of them and filesize < 919552
 }
 rule MALPEDIA_Win_Dtrack_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d8f3c989-b720-5ce0-af93-3bde59a2fdab"
+		id = "5e4ea24b-8bce-5d33-9700-7ac86db38eb5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dtrack"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dtrack_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "245b50e28635461a6214109a0274cb2a754a0f5b0ed2d19ab52e688b26ae3fdb"
+		logic_hash = "v1_sha256_245b50e28635461a6214109a0274cb2a754a0f5b0ed2d19ab52e688b26ae3fdb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185506,20 +185576,20 @@ rule MALPEDIA_Win_Dtrack_Auto : FILE
 		$sequence_14 = { 8b4d0c 034df0 8801 0fb655f7 2355fc }
 
 	condition:
-		7 of them and filesize <1736704
+		7 of them and filesize < 1736704
 }
 rule MALPEDIA_Win_Smokeloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f23556ba-5c41-5731-b926-98b3ff953aa7"
+		id = "53eafc80-00c3-5d9c-b357-9dd16ec61cb3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.smokeloader_auto.yar#L1-L557"
 		license_url = "N/A"
-		logic_hash = "14e5b0cfca13af7489c48288e9aa993c0a3271acbd4222a869c5d82af431f76e"
+		logic_hash = "v1_sha256_14e5b0cfca13af7489c48288e9aa993c0a3271acbd4222a869c5d82af431f76e"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -185600,20 +185670,20 @@ rule MALPEDIA_Win_Smokeloader_Auto : FILE
 		$sequence_64 = { a2???????? ed d6 104ddc 9c }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize < 245760
 }
 rule MALPEDIA_Win_Darkside_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "78d056bd-691e-5837-8a3e-d494c36948d5"
+		id = "9c141b26-e629-5dac-83c9-4bba7b5b295d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkside"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkside_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "6b8e9b7a9d216743f758468d2821e935f995800b913ca32663480c8ad049b99d"
+		logic_hash = "v1_sha256_6b8e9b7a9d216743f758468d2821e935f995800b913ca32663480c8ad049b99d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185639,20 +185709,20 @@ rule MALPEDIA_Win_Darkside_Auto : FILE
 		$sequence_9 = { 893c0e 81ea10101010 2d10101010 81eb10101010 81ef10101010 83e910 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Mbrlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a472526-8a03-5ccc-a5eb-10b46b34c6da"
+		id = "ae53ea8b-56a3-57c4-9827-24627a047b29"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mbrlocker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mbrlocker_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "2abe677d378843746aa6479444a4219927906b009fff2766ade4f081783dbae6"
+		logic_hash = "v1_sha256_2abe677d378843746aa6479444a4219927906b009fff2766ade4f081783dbae6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185678,20 +185748,20 @@ rule MALPEDIA_Win_Mbrlocker_Auto : FILE
 		$sequence_9 = { 31c8 e8???????? 68ac000000 68???????? }
 
 	condition:
-		7 of them and filesize <43008
+		7 of them and filesize < 43008
 }
 rule MALPEDIA_Win_Khrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6db105ed-fa5f-5732-ac42-40d20165099d"
+		id = "b2028b0e-21a5-5398-95e7-5c9b435e4db4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.khrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.khrat_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "d3a598db6b81f9cdf5c2df41f102b4f7efaa91eac99a2097cd83dc35f1bc7100"
+		logic_hash = "v1_sha256_d3a598db6b81f9cdf5c2df41f102b4f7efaa91eac99a2097cd83dc35f1bc7100"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185717,20 +185787,20 @@ rule MALPEDIA_Win_Khrat_Auto : FILE
 		$sequence_9 = { 56 50 e8???????? eb0f 807b06ff 7509 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Retefe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "db079941-ad88-585f-9381-dc621d03f57c"
+		id = "7bef3c44-8532-5a68-bc93-835da00a6cbf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retefe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.retefe_auto.yar#L1-L261"
 		license_url = "N/A"
-		logic_hash = "10f5fe00ae8dec2b9fe4c64e3188b2157517c220142d93e2bb2a9654bee449af"
+		logic_hash = "v1_sha256_10f5fe00ae8dec2b9fe4c64e3188b2157517c220142d93e2bb2a9654bee449af"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -185775,20 +185845,20 @@ rule MALPEDIA_Win_Retefe_Auto : FILE
 		$sequence_28 = { 6a2c 8d44244c 56 50 }
 
 	condition:
-		7 of them and filesize <843776
+		7 of them and filesize < 843776
 }
 rule MALPEDIA_Win_Longwatch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b41781a5-fa9e-5caa-89a9-6b017c4409b3"
+		id = "f3455b1d-485c-5e60-a283-e6fea42590d9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.longwatch"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.longwatch_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "7e9f24cefc29fec880f531c16b44bc6a332c0d308ff5c0a0db91cf7bbb28f078"
+		logic_hash = "v1_sha256_7e9f24cefc29fec880f531c16b44bc6a332c0d308ff5c0a0db91cf7bbb28f078"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185814,20 +185884,20 @@ rule MALPEDIA_Win_Longwatch_Auto : FILE
 		$sequence_9 = { 8975f0 c745f4dc804200 8b7485bc 8d4601 8945b8 }
 
 	condition:
-		7 of them and filesize <647168
+		7 of them and filesize < 647168
 }
 rule MALPEDIA_Win_Bs2005_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d7ab1e13-ba2d-5cc6-b498-29127d7b94b4"
+		id = "47655830-f7b8-55a6-8c21-19792c9b2933"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bs2005"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bs2005_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "9437688f1e9a849259370cda11e68d8a858bd8cd17b5169c95f49dad03ad5566"
+		logic_hash = "v1_sha256_9437688f1e9a849259370cda11e68d8a858bd8cd17b5169c95f49dad03ad5566"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185853,20 +185923,20 @@ rule MALPEDIA_Win_Bs2005_Auto : FILE
 		$sequence_9 = { ffd3 8b7df0 8b4dfc 83c410 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Ghost_Secret_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aa96bf29-3993-5fcb-89d9-e0ea92c3a3df"
+		id = "2fa4f349-f3eb-502f-8a56-a22a44c221a8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_secret"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ghost_secret_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "c0493088659adfee49574a5acb9764a23e419d0406508dff35abe1e75e13521d"
+		logic_hash = "v1_sha256_c0493088659adfee49574a5acb9764a23e419d0406508dff35abe1e75e13521d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185892,20 +185962,20 @@ rule MALPEDIA_Win_Ghost_Secret_Auto : FILE
 		$sequence_9 = { c644245d25 c644245e60 c644245f55 c6442460d5 c64424615a c644246232 884c2467 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Sword_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d4f1eb68-153e-5ccd-81d3-89b6b9da3f3a"
+		id = "81ef6442-c114-5c12-a5a8-b6e65f70e9d6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sword"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sword_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "065f81feabb14c35e08637eea61a6954f973d06eb84d7a6351d2f07f555efbd2"
+		logic_hash = "v1_sha256_065f81feabb14c35e08637eea61a6954f973d06eb84d7a6351d2f07f555efbd2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185931,20 +186001,20 @@ rule MALPEDIA_Win_Sword_Auto : FILE
 		$sequence_9 = { f7d1 49 83f903 77c8 bf???????? }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Coinminer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e53c74f5-8d04-54ad-a733-6c3d22f8d0e4"
+		id = "676e54d4-8ee0-5c9d-a3ca-5befc38988e7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coinminer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.coinminer_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "06dcc1977408b543966283c5e3d6aefe14c67fca3216b7316faa289a6df0dd9d"
+		logic_hash = "v1_sha256_06dcc1977408b543966283c5e3d6aefe14c67fca3216b7316faa289a6df0dd9d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -185970,20 +186040,20 @@ rule MALPEDIA_Win_Coinminer_Auto : FILE
 		$sequence_9 = { 55 8bec a1???????? 81ec9c010000 }
 
 	condition:
-		7 of them and filesize <1523712
+		7 of them and filesize < 1523712
 }
 rule MALPEDIA_Win_Stormwind_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "80614d8b-8924-5b45-b8c5-f7daeb22acc2"
+		id = "a257286e-bb6e-5ba3-9523-d4aa251684e5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stormwind"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stormwind_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "1831a86c13bffd90b9334f0a5afcc717f00e9aac3ae8337459965aab192d5d98"
+		logic_hash = "v1_sha256_1831a86c13bffd90b9334f0a5afcc717f00e9aac3ae8337459965aab192d5d98"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186009,20 +186079,20 @@ rule MALPEDIA_Win_Stormwind_Auto : FILE
 		$sequence_9 = { 8d45f4 64a300000000 8bf9 8d4dec c745e400000000 e8???????? c745fc00000000 }
 
 	condition:
-		7 of them and filesize <741376
+		7 of them and filesize < 741376
 }
 rule MALPEDIA_Win_Lightbunny_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86c71225-3e49-57f7-8a14-1d446e18ff78"
+		id = "7d4428df-cdf6-53c5-8a2c-4c7ee5e6ab06"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightbunny"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lightbunny_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "33cbdcbf0c5d4d510f8f905bf01b71c8a0fd5566bc7f248daf644c66992c59c1"
+		logic_hash = "v1_sha256_33cbdcbf0c5d4d510f8f905bf01b71c8a0fd5566bc7f248daf644c66992c59c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186048,20 +186118,20 @@ rule MALPEDIA_Win_Lightbunny_Auto : FILE
 		$sequence_9 = { 8bf0 b902000000 83feff 0f85f7feffff 68???????? e8???????? }
 
 	condition:
-		7 of them and filesize <2376704
+		7 of them and filesize < 2376704
 }
 rule MALPEDIA_Win_Gemcutter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f2a59f86-1075-5464-b91b-cb447c183566"
+		id = "5916d14f-56bd-5d43-afca-e992fe7164f3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gemcutter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gemcutter_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "9745c8061ab88116351043d55251d3e8c32737ca442027c8a6620480abc8c8bf"
+		logic_hash = "v1_sha256_9745c8061ab88116351043d55251d3e8c32737ca442027c8a6620480abc8c8bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186087,20 +186157,20 @@ rule MALPEDIA_Win_Gemcutter_Auto : FILE
 		$sequence_9 = { 6a00 6801001f00 ff15???????? 85c0 7517 68e8030000 ff15???????? }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Synccrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c0acfe97-1049-5df6-8be2-e1920c7563c7"
+		id = "6964b1be-7800-5312-8524-d3d99cd9710c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.synccrypt"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.synccrypt_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "36fed86930a547a043d213272378804045281c22493a08490f720ea6d556929c"
+		logic_hash = "v1_sha256_36fed86930a547a043d213272378804045281c22493a08490f720ea6d556929c"
 		score = 75
 		quality = 45
 		tags = "FILE"
@@ -186126,20 +186196,20 @@ rule MALPEDIA_Win_Synccrypt_Auto : FILE
 		$sequence_9 = { e8???????? 8b442434 c744240400000000 890424 e8???????? 8b842494000000 893424 }
 
 	condition:
-		7 of them and filesize <4489216
+		7 of them and filesize < 4489216
 }
 rule MALPEDIA_Win_Makadocs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d7e05dca-32b3-50ff-8846-a9085f7d1f77"
+		id = "25d2f762-77ba-5eff-a25e-8e606dee3ef7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makadocs"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.makadocs_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "d5f25f8d17e486ca7957ad641a672887ad1c923171b871947c68e6256fe8b85d"
+		logic_hash = "v1_sha256_d5f25f8d17e486ca7957ad641a672887ad1c923171b871947c68e6256fe8b85d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186165,20 +186235,20 @@ rule MALPEDIA_Win_Makadocs_Auto : FILE
 		$sequence_9 = { e8???????? 83c40c 8d757c 85c0 7504 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize < 344064
 }
 rule MALPEDIA_Win_Neddnloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e15402b8-b469-5172-91e2-075f5a9b23c1"
+		id = "c8725a0c-0d18-5bd5-9d43-52a6793ea4d9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neddnloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.neddnloader_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "77a49dc1eddd877e4d25ede9f8b3d2e84b63610bcd03fbfc5a12361b574a00c2"
+		logic_hash = "v1_sha256_77a49dc1eddd877e4d25ede9f8b3d2e84b63610bcd03fbfc5a12361b574a00c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186210,20 +186280,20 @@ rule MALPEDIA_Win_Neddnloader_Auto : FILE
 		$sequence_15 = { 418bcd 41b981808080 4c8bde 412bcf 418bc1 4889742438 }
 
 	condition:
-		7 of them and filesize <3438592
+		7 of them and filesize < 3438592
 }
 rule MALPEDIA_Win_Entryshell_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f7004160-2921-54d6-8486-e3c529e5d739"
+		id = "68482f04-5aee-5019-9f0d-b2c39960c056"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.entryshell"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.entryshell_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "99234173465f72334050322378ee4ca31b5cc7ed20c04f0fbc21ed7db2e5d8fb"
+		logic_hash = "v1_sha256_99234173465f72334050322378ee4ca31b5cc7ed20c04f0fbc21ed7db2e5d8fb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186249,20 +186319,20 @@ rule MALPEDIA_Win_Entryshell_Auto : FILE
 		$sequence_9 = { 844415dc 750a 8bfe 8a07 84c0 75e1 eb05 }
 
 	condition:
-		7 of them and filesize <663552
+		7 of them and filesize < 663552
 }
 rule MALPEDIA_Win_Racket_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fdbc67f2-dd9c-564f-803b-5a571eceba53"
+		id = "7787c762-cfc3-513f-820a-6e3394afc723"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.racket"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.racket_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "8c447bff92b42700b626fab2f15edaccf604f14572851cce781a5a45ae5fbde2"
+		logic_hash = "v1_sha256_8c447bff92b42700b626fab2f15edaccf604f14572851cce781a5a45ae5fbde2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186288,20 +186358,20 @@ rule MALPEDIA_Win_Racket_Auto : FILE
 		$sequence_9 = { 8bd0 8b37 2bd6 8b4d0c 8945e0 b8ffa16f6b f7ea }
 
 	condition:
-		7 of them and filesize <985088
+		7 of them and filesize < 985088
 }
 rule MALPEDIA_Win_Rapid_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c76663f4-5d9b-5e27-96de-31f5287939c0"
+		id = "93d8945f-4088-5006-b566-9c17e317557c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rapid_ransom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rapid_ransom_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "420102af1054256a36b0f8f07d0daf89ae38632ab058ebfe54352c8eea1f1c3e"
+		logic_hash = "v1_sha256_420102af1054256a36b0f8f07d0daf89ae38632ab058ebfe54352c8eea1f1c3e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186332,20 +186402,20 @@ rule MALPEDIA_Win_Rapid_Ransom_Auto : FILE
 		$sequence_14 = { 58 6bc000 c78034c9410002000000 6a04 58 6bc000 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Hi_Zor_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "24f4aee1-0c12-5135-acc3-79b59762efbf"
+		id = "a7955272-a512-52a2-a7d3-e5fcc7c891b3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hi_zor_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hi_zor_rat_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "8af52d284dd3ab5b7dd25e47f9e41f3a65d45bdcdc9d0dd1ec6d75ccfe311424"
+		logic_hash = "v1_sha256_8af52d284dd3ab5b7dd25e47f9e41f3a65d45bdcdc9d0dd1ec6d75ccfe311424"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186371,20 +186441,20 @@ rule MALPEDIA_Win_Hi_Zor_Rat_Auto : FILE
 		$sequence_9 = { c7458424003300 c7458838002200 c7458c00003300 c7459024002500 c745943f003900 c7459838000a00 c7459c04002300 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize < 73728
 }
 rule MALPEDIA_Win_Kronos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a0b4b62f-a866-556e-9f95-bc6e89d12770"
+		id = "a4f510de-a937-53a9-ab98-1553996087e1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kronos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kronos_auto.yar#L1-L101"
 		license_url = "N/A"
-		logic_hash = "47204f1b85469eed91b1a8f9ff5dd1693684b7472dfd0cf1125143da1fd8fdea"
+		logic_hash = "v1_sha256_47204f1b85469eed91b1a8f9ff5dd1693684b7472dfd0cf1125143da1fd8fdea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186408,20 +186478,20 @@ rule MALPEDIA_Win_Kronos_Auto : FILE
 		$sequence_7 = { 50 8d85d8fdffff 6803010000 50 e8???????? 83c418 }
 
 	condition:
-		7 of them and filesize <1302528
+		7 of them and filesize < 1302528
 }
 rule MALPEDIA_Win_Mqsttang_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5c891dae-4eed-590b-b193-46c6fc31d649"
+		id = "e7b95ad0-9534-5076-91f3-11870ce8ddfe"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mqsttang"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mqsttang_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "730db72c4ecde718fd98b702027c89d493008b2e112f78653e06311a808dd020"
+		logic_hash = "v1_sha256_730db72c4ecde718fd98b702027c89d493008b2e112f78653e06311a808dd020"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186447,20 +186517,20 @@ rule MALPEDIA_Win_Mqsttang_Auto : FILE
 		$sequence_9 = { e8???????? 891c24 89c1 a3???????? e8???????? 83ec04 83c418 }
 
 	condition:
-		7 of them and filesize <12651520
+		7 of them and filesize < 12651520
 }
 rule MALPEDIA_Win_Qhost_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b665b26d-0cb0-522b-ad4c-ae26d70948e9"
+		id = "30419395-1ef2-5d00-a76a-aaba8233294e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qhost"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.qhost_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "9e1768d558cd3150b7b786a97888fc646ca0ae377a338c2bb336a3ca12cb703a"
+		logic_hash = "v1_sha256_9e1768d558cd3150b7b786a97888fc646ca0ae377a338c2bb336a3ca12cb703a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186486,20 +186556,20 @@ rule MALPEDIA_Win_Qhost_Auto : FILE
 		$sequence_9 = { 7407 c745fcffffffff 8b45fc 8be5 5d }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Redpepper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fe9a2c74-3bcd-57d2-a4a6-d3f35fe0f1be"
+		id = "890227d3-c211-585f-8a7a-ae018719db3b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redpepper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.redpepper_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "c4da24b7951d6f6fb7e27212edbac20ef8484913731cd43af2131db52962e64a"
+		logic_hash = "v1_sha256_c4da24b7951d6f6fb7e27212edbac20ef8484913731cd43af2131db52962e64a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186525,20 +186595,20 @@ rule MALPEDIA_Win_Redpepper_Auto : FILE
 		$sequence_9 = { 56 56 c705????????01000000 ff15???????? 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <2482176
+		7 of them and filesize < 2482176
 }
 rule MALPEDIA_Win_Bunitu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b836f62d-ccb0-5139-8fb4-d5cfc207aba0"
+		id = "184c7ca9-def7-5a54-990c-e16424076805"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bunitu"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bunitu_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "1cf3d7359d010e00d7ff20ba5e701d6257e9f7229ca17c7a247d649a01d8b461"
+		logic_hash = "v1_sha256_1cf3d7359d010e00d7ff20ba5e701d6257e9f7229ca17c7a247d649a01d8b461"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186564,20 +186634,20 @@ rule MALPEDIA_Win_Bunitu_Auto : FILE
 		$sequence_9 = { 2bfa 87fa 5f 8bc2 48 40 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize < 221184
 }
 rule MALPEDIA_Win_Unidentified_061_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "59888b60-a3e6-5e9f-a441-429646fe0731"
+		id = "f740743b-47d8-5c48-a1bf-29f2a51f7231"
 		date = "2023-07-11"
 		modified = "2023-07-15"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_061"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_061_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "ee3ce5b6c77f09c690f7a934c26be09c58c4fcdee70275b61c00e527d8aa097d"
+		logic_hash = "v1_sha256_ee3ce5b6c77f09c690f7a934c26be09c58c4fcdee70275b61c00e527d8aa097d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186603,20 +186673,20 @@ rule MALPEDIA_Win_Unidentified_061_Auto : FILE
 		$sequence_9 = { eb04 c645fb3d 6a05 8d45f8 50 ff750c c645fc00 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Webbytea_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "289bbfb0-4c87-5ec8-bb1c-f221332bf4ea"
+		id = "d83f58db-d5bf-54d3-b4e8-d74ea89dd12f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webbytea"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webbytea_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "5634a8f7fcf9d0a5da9524118130e9bacc28a4059c716e709153bee5aa0b255e"
+		logic_hash = "v1_sha256_5634a8f7fcf9d0a5da9524118130e9bacc28a4059c716e709153bee5aa0b255e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186642,20 +186712,20 @@ rule MALPEDIA_Win_Webbytea_Auto : FILE
 		$sequence_9 = { ffc0 890424 8b442438 390424 }
 
 	condition:
-		7 of them and filesize <552960
+		7 of them and filesize < 552960
 }
 rule MALPEDIA_Win_Backswap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6e17f855-5952-50ed-bf6a-366f7e607462"
+		id = "2c42d2f7-d243-525b-9dde-fb2bc411c9df"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backswap"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.backswap_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "bb4d774b5a39969b7683aade4505aad39c80dbe023defeb6c0c050fb546e7038"
+		logic_hash = "v1_sha256_bb4d774b5a39969b7683aade4505aad39c80dbe023defeb6c0c050fb546e7038"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186681,20 +186751,20 @@ rule MALPEDIA_Win_Backswap_Auto : FILE
 		$sequence_9 = { ff4508 8bfb 3bd3 0f8572ffffff 33c9 e9???????? }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize < 122880
 }
 rule MALPEDIA_Win_Anchormtea_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "75878680-af6e-531f-abbe-374c7f6b18e7"
+		id = "2daee2cd-4f8e-590f-8619-4d21a4644c01"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchormtea"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.anchormtea_auto.yar#L1-L152"
 		license_url = "N/A"
-		logic_hash = "b646f5ea9da3552482b100437224e4af5475bebe8d62d4511d1baeeadc61942b"
+		logic_hash = "v1_sha256_b646f5ea9da3552482b100437224e4af5475bebe8d62d4511d1baeeadc61942b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186725,20 +186795,20 @@ rule MALPEDIA_Win_Anchormtea_Auto : FILE
 		$sequence_14 = { 898534ffffff 7202 8b12 8bc2 8d7002 660f1f440000 }
 
 	condition:
-		7 of them and filesize <839680
+		7 of them and filesize < 839680
 }
 rule MALPEDIA_Win_Hookinjex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "71399701-93a4-54b6-a1f8-3cb7f4c94c21"
+		id = "e6a37ce0-5c06-58dd-acba-8994981775bd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hookinjex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hookinjex_auto.yar#L1-L157"
 		license_url = "N/A"
-		logic_hash = "8fbd3eb9a9d2410863924e40f8ff07b371959d0645dbb4e7cd7484e6ff1ff474"
+		logic_hash = "v1_sha256_8fbd3eb9a9d2410863924e40f8ff07b371959d0645dbb4e7cd7484e6ff1ff474"
 		score = 60
 		quality = 25
 		tags = "FILE"
@@ -186770,20 +186840,20 @@ rule MALPEDIA_Win_Hookinjex_Auto : FILE
 		$sequence_15 = { 25c0000000 83f840 750d c78424dc01000001000000 }
 
 	condition:
-		7 of them and filesize <6545408
+		7 of them and filesize < 6545408
 }
 rule MALPEDIA_Win_Starsypound_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "70e37162-3a73-596a-8d7d-42b9d85b78f7"
+		id = "c9f7204f-f1f8-5357-a5b3-fe5f39a05290"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.starsypound"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.starsypound_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "abf4ae91c4287e1227ba24bd55f61dc3c1250c1b8b21f760166157e29806933f"
+		logic_hash = "v1_sha256_abf4ae91c4287e1227ba24bd55f61dc3c1250c1b8b21f760166157e29806933f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186809,20 +186879,20 @@ rule MALPEDIA_Win_Starsypound_Auto : FILE
 		$sequence_9 = { e8???????? 68c0270900 ff15???????? e8???????? 5f }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Fct_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "abc15496-5280-5df8-8374-6c73912930cc"
+		id = "4c02ee9b-08c4-554b-b69c-8872d139b85c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fct"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fct_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "459978803baa25140106f0b9d6fb1e3d43d379e92c63a80a39a4b43b54ebb800"
+		logic_hash = "v1_sha256_459978803baa25140106f0b9d6fb1e3d43d379e92c63a80a39a4b43b54ebb800"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186848,20 +186918,20 @@ rule MALPEDIA_Win_Fct_Auto : FILE
 		$sequence_9 = { 8d8d34fdffff ffb514fdffff 50 e8???????? }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize < 204800
 }
 rule MALPEDIA_Win_Icedid_Downloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a6a24661-a781-5517-9bde-5f4ae21f58dc"
+		id = "1122b489-83ca-56ae-be26-fa732a8b7df3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid_downloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.icedid_downloader_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "8833f99bb1bd77711eb78fc1bd4033ed964a1a4a33594d443cf638144662738b"
+		logic_hash = "v1_sha256_8833f99bb1bd77711eb78fc1bd4033ed964a1a4a33594d443cf638144662738b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186887,20 +186957,20 @@ rule MALPEDIA_Win_Icedid_Downloader_Auto : FILE
 		$sequence_9 = { 50 8d45d4 66895d04 50 57 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Unidentified_113_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fca9d6d2-018c-5238-a2c5-d26ca95c2862"
+		id = "bf9c3e9e-3741-5d94-9096-6608a4eb1b53"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_113"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_113_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "55ef739d0acd0e849dcf600673496f5aa2583f128c784d3cf7a14a872f001ae1"
+		logic_hash = "v1_sha256_55ef739d0acd0e849dcf600673496f5aa2583f128c784d3cf7a14a872f001ae1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186926,20 +186996,20 @@ rule MALPEDIA_Win_Unidentified_113_Auto : FILE
 		$sequence_9 = { ff7608 ff15???????? 894628 85c0 752d ff15???????? 6860c00000 }
 
 	condition:
-		7 of them and filesize <4707328
+		7 of them and filesize < 4707328
 }
 rule MALPEDIA_Win_Hazy_Load_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fbfa1e78-dff1-53dc-80af-71732a4c81b4"
+		id = "77f8a76f-dbb9-5580-b8e5-db52e4bb2ef2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hazy_load"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hazy_load_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "fd77b624c32a8e3f12aae94d42471fe8468beed29de311ba6e72f1538f11b350"
+		logic_hash = "v1_sha256_fd77b624c32a8e3f12aae94d42471fe8468beed29de311ba6e72f1538f11b350"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -186965,20 +187035,20 @@ rule MALPEDIA_Win_Hazy_Load_Auto : FILE
 		$sequence_9 = { eb12 488d0d46fe0000 c7435006000000 48894b48 c6435400 }
 
 	condition:
-		7 of them and filesize <315392
+		7 of them and filesize < 315392
 }
 rule MALPEDIA_Win_Stration_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a114ca5f-e8f5-5b6c-8d4b-c8b226c24232"
+		id = "07b0fb94-14eb-5a5f-8358-84f427a58051"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stration"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.stration_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "810e080388d75ad01155fee822907ac9d5b404fa94d6259fc807c41db11a9cc8"
+		logic_hash = "v1_sha256_810e080388d75ad01155fee822907ac9d5b404fa94d6259fc807c41db11a9cc8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187004,20 +187074,20 @@ rule MALPEDIA_Win_Stration_Auto : FILE
 		$sequence_9 = { 83f825 7cec 8b3d???????? 68???????? }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Xfscashncr_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aa68c3d3-6057-5726-9c6a-29c3062e0a39"
+		id = "208a50dc-9c2f-524d-902c-8f742a45a74f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfscashncr"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xfscashncr_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "8cc1f9194ac942ef01eaad15d7e35adea44a498eaca746d03287f1cf0f22bf7b"
+		logic_hash = "v1_sha256_8cc1f9194ac942ef01eaad15d7e35adea44a498eaca746d03287f1cf0f22bf7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187043,20 +187113,20 @@ rule MALPEDIA_Win_Xfscashncr_Auto : FILE
 		$sequence_9 = { 51 e8???????? 83c408 dd5d94 dd4594 d9ee dae9 }
 
 	condition:
-		7 of them and filesize <3126272
+		7 of them and filesize < 3126272
 }
 rule MALPEDIA_Win_Manitsme_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "db884f68-52e3-535c-a75f-a98978605003"
+		id = "c3590be2-2bdd-5690-89ba-b9f692cf88ae"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.manitsme"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.manitsme_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "272de9774cf5a8eb5198458ddf07f5bca3359e27fa527484a54e8b750a92c4ea"
+		logic_hash = "v1_sha256_272de9774cf5a8eb5198458ddf07f5bca3359e27fa527484a54e8b750a92c4ea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187082,20 +187152,20 @@ rule MALPEDIA_Win_Manitsme_Auto : FILE
 		$sequence_9 = { 896c2440 897c2444 897c2448 897c244c 895c2450 ffd6 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Graphical_Neutrino_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "709b8c7e-3b27-57db-a7ca-ec92842eb964"
+		id = "dc470237-e69f-5d3f-8810-bff9b21984e4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphical_neutrino"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.graphical_neutrino_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "20fe129c0f852597f7609ecc786913a363ba634ff126dc42ff1c434f04b54173"
+		logic_hash = "v1_sha256_20fe129c0f852597f7609ecc786913a363ba634ff126dc42ff1c434f04b54173"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187121,20 +187191,20 @@ rule MALPEDIA_Win_Graphical_Neutrino_Auto : FILE
 		$sequence_9 = { 4c8da424c0000000 48c78424c800000002000000 48898424a0000000 4c89e2 48898424c0000000 488d8424e8040000 4889c1 }
 
 	condition:
-		7 of them and filesize <674816
+		7 of them and filesize < 674816
 }
 rule MALPEDIA_Win_Cueisfry_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3f94f63a-bd01-5ab8-af5f-ba8550248461"
+		id = "ba2e7472-6d6e-5e78-ad9d-57453ce04e52"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cueisfry"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cueisfry_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "fe662cbb30073bd6bd4ed92effaa065add48a5ad78c3a6b1fdab8c2e82a82aba"
+		logic_hash = "v1_sha256_fe662cbb30073bd6bd4ed92effaa065add48a5ad78c3a6b1fdab8c2e82a82aba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187160,20 +187230,20 @@ rule MALPEDIA_Win_Cueisfry_Auto : FILE
 		$sequence_9 = { 83c40c 53 ff15???????? 68???????? e8???????? 83c404 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Carrotbat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1f5a4e61-8efd-5abd-b8fb-2f87b63c93c7"
+		id = "1c11946d-76f4-56ff-ba76-bff1c12160b9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotbat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.carrotbat_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "e53146cb3545ca99ae66e1a10fcb74cff088286f73e969b286c25b4fb9383fdf"
+		logic_hash = "v1_sha256_e53146cb3545ca99ae66e1a10fcb74cff088286f73e969b286c25b4fb9383fdf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187199,20 +187269,20 @@ rule MALPEDIA_Win_Carrotbat_Auto : FILE
 		$sequence_9 = { 897de4 8bc7 c1f805 8bcf 83e11f c1e106 8b048520ee4000 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Concealment_Troy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f25da06b-e34f-5ec3-afca-981eed54a3f2"
+		id = "12d93ed1-7f54-5923-b343-ef4a37a7e440"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.concealment_troy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.concealment_troy_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "5ef8bd4e1cd35f7f8cc8bada75a137689ed8949f72f34f8e30aca42d1738a1ce"
+		logic_hash = "v1_sha256_5ef8bd4e1cd35f7f8cc8bada75a137689ed8949f72f34f8e30aca42d1738a1ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187238,20 +187308,20 @@ rule MALPEDIA_Win_Concealment_Troy_Auto : FILE
 		$sequence_9 = { 57 ff15???????? 5d 5f 33c0 5e 8b8c2420010000 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_8T_Dropper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "485513e6-6a30-5542-9db5-771c168cddae"
+		id = "be9cd56d-c38e-56cb-8643-c90f28d181ab"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.8t_dropper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.8t_dropper_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "ce9c22a4da7356dd0a0bfe7a1e7d1abeadd8c256121840ed85ba440a85beb469"
+		logic_hash = "v1_sha256_ce9c22a4da7356dd0a0bfe7a1e7d1abeadd8c256121840ed85ba440a85beb469"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187277,20 +187347,20 @@ rule MALPEDIA_Win_8T_Dropper_Auto : FILE
 		$sequence_9 = { 7559 8b4c2408 51 ff15???????? 8d942410010000 6804010000 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize < 147456
 }
 rule MALPEDIA_Win_Thumbthief_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c07df13f-4d93-5b5e-9219-11a7b6751d3c"
+		id = "5c65374e-0507-51a3-9bde-3c39195e9b2e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thumbthief"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.thumbthief_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "48fc10818492752c11b968a2d68b30a1043a5a183785607a78ccc035f88fcdc3"
+		logic_hash = "v1_sha256_48fc10818492752c11b968a2d68b30a1043a5a183785607a78ccc035f88fcdc3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187316,20 +187386,20 @@ rule MALPEDIA_Win_Thumbthief_Auto : FILE
 		$sequence_9 = { 8d8c24f8000000 6a0d e8???????? 68???????? 8d8424f4000000 e9???????? 8d8424c8000000 }
 
 	condition:
-		7 of them and filesize <4235264
+		7 of them and filesize < 4235264
 }
 rule MALPEDIA_Win_Logpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "35b4ad0a-906a-5aa4-a185-d299d314c772"
+		id = "c535eb50-52a8-5c60-86ff-46c8cb1529dd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.logpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.logpos_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "1f09c571a98b8191fefaf5488e1ffd2ed1ffe04d05c499ee0ffd2f1f5274e533"
+		logic_hash = "v1_sha256_1f09c571a98b8191fefaf5488e1ffd2ed1ffe04d05c499ee0ffd2f1f5274e533"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187355,20 +187425,20 @@ rule MALPEDIA_Win_Logpos_Auto : FILE
 		$sequence_9 = { e8???????? 83c404 83f800 0f8537000000 833d????????00 0f852a000000 837d1400 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Ripper_Atm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e53a9e99-401d-50a0-8b9f-eabc46d865fe"
+		id = "402f4c15-e2ea-5805-ac6d-5b3993f083e5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ripper_atm"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ripper_atm_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "d8b90900e28d85311ea385a629a5f77668a5882f0cccbfa3d22ef622cc722131"
+		logic_hash = "v1_sha256_d8b90900e28d85311ea385a629a5f77668a5882f0cccbfa3d22ef622cc722131"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187394,20 +187464,20 @@ rule MALPEDIA_Win_Ripper_Atm_Auto : FILE
 		$sequence_9 = { 56 33f6 ffb6b0784300 ff15???????? 8986b0784300 83c604 83fe28 }
 
 	condition:
-		7 of them and filesize <724992
+		7 of them and filesize < 724992
 }
 rule MALPEDIA_Win_Seduploader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "abd18501-c80d-5d3c-830d-4070c5a4c096"
+		id = "2815992d-8cef-5f94-a492-0627529870d8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.seduploader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.seduploader_auto.yar#L1-L109"
 		license_url = "N/A"
-		logic_hash = "ad39ca6734688a1ba0a401112f23db476ff01fef94039db8596308ec3fce36d4"
+		logic_hash = "v1_sha256_ad39ca6734688a1ba0a401112f23db476ff01fef94039db8596308ec3fce36d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187433,20 +187503,20 @@ rule MALPEDIA_Win_Seduploader_Auto : FILE
 		$sequence_9 = { e8???????? 8b4510 83c6fe 8930 8d4601 }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize < 401408
 }
 rule MALPEDIA_Win_Casper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e6e721c8-dd07-5896-b009-f293b597cc79"
+		id = "71585731-4b56-553b-9979-f468653e66c1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.casper"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.casper_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "44b510f3119535b0c0c8064d1c39533cfa6df7cf823ef2fa1ba3402aaa98bcc5"
+		logic_hash = "v1_sha256_44b510f3119535b0c0c8064d1c39533cfa6df7cf823ef2fa1ba3402aaa98bcc5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187472,20 +187542,20 @@ rule MALPEDIA_Win_Casper_Auto : FILE
 		$sequence_9 = { 6a28 c6431001 e8???????? 8bf8 33c0 59 3bf8 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize < 434176
 }
 rule MALPEDIA_Win_Payloadbin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b954a512-78f3-562b-9197-a6a1e74a513b"
+		id = "b008c33a-b6ac-5d89-af9d-de68c53afb2b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.payloadbin"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.payloadbin_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "800c1bff3826d8d61dac146dc7e96bbf271b1fb2a9cc74c55e98e32d0540be8c"
+		logic_hash = "v1_sha256_800c1bff3826d8d61dac146dc7e96bbf271b1fb2a9cc74c55e98e32d0540be8c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187511,20 +187581,20 @@ rule MALPEDIA_Win_Payloadbin_Auto : FILE
 		$sequence_9 = { 4180fd52 4983c004 3bc8 e9???????? 0f860a000000 b801000000 e9???????? }
 
 	condition:
-		7 of them and filesize <3761152
+		7 of them and filesize < 3761152
 }
 rule MALPEDIA_Win_Albaniiutas_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ed214e5c-6897-5f8e-bd2b-0bb8f51690d9"
+		id = "9b14d3be-8890-57c8-8385-b1d83270d72a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.albaniiutas"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.albaniiutas_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "4a292a9bd7e73dd3f8f38b0c5f35ad3036161e113ab281f4d09533b41c3cbb43"
+		logic_hash = "v1_sha256_4a292a9bd7e73dd3f8f38b0c5f35ad3036161e113ab281f4d09533b41c3cbb43"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187550,20 +187620,20 @@ rule MALPEDIA_Win_Albaniiutas_Auto : FILE
 		$sequence_9 = { 331c85c0280110 335e08 8bcb 8bc3 }
 
 	condition:
-		7 of them and filesize <566272
+		7 of them and filesize < 566272
 }
 rule MALPEDIA_Win_Buterat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "25ad2a50-49be-5d4a-bf97-43396868ed49"
+		id = "d69fc413-0634-5517-98f4-3dfab3ae27bc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buterat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.buterat_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b70d6ce44ee783afa32cbecdbe7cf8ccdf3b06b682102fb9a600b816f864c117"
+		logic_hash = "v1_sha256_b70d6ce44ee783afa32cbecdbe7cf8ccdf3b06b682102fb9a600b816f864c117"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187589,20 +187659,20 @@ rule MALPEDIA_Win_Buterat_Auto : FILE
 		$sequence_9 = { 53 53 a3???????? 895c2420 895c2424 895c241c 53 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize < 278528
 }
 rule MALPEDIA_Win_Spectre_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "97f71f8a-8fe2-5a94-98b9-e19f44e57e9b"
+		id = "365d1622-4de3-5d3e-92d3-362946419ea1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spectre"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spectre_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "fb8efa47f6cbb2730748ec520c0057da98d0d3b4bb855873b3521ccc59bde3f2"
+		logic_hash = "v1_sha256_fb8efa47f6cbb2730748ec520c0057da98d0d3b4bb855873b3521ccc59bde3f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187628,20 +187698,20 @@ rule MALPEDIA_Win_Spectre_Auto : FILE
 		$sequence_9 = { 3dffffff3f 7479 40 57 50 89442414 e8???????? }
 
 	condition:
-		7 of them and filesize <990208
+		7 of them and filesize < 990208
 }
 rule MALPEDIA_Win_Adhubllka_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "60da8c7f-6dd6-527d-a4d7-5811a92e6c32"
+		id = "c7f6af49-39ff-5939-a2e5-5108f78c49fe"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adhubllka"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.adhubllka_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "f31f80e2e1b5812b9eab30806e14c5a9a3d65252ed9a183d7a41e8edbf56db58"
+		logic_hash = "v1_sha256_f31f80e2e1b5812b9eab30806e14c5a9a3d65252ed9a183d7a41e8edbf56db58"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187667,20 +187737,20 @@ rule MALPEDIA_Win_Adhubllka_Auto : FILE
 		$sequence_9 = { 0f28a570feffff 0f1000 8b45f0 660ffea530ffffff 660fefc8 8345f010 0f28d4 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Magic_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "294a613b-706a-59cd-8861-ad8f327481f6"
+		id = "c7d8f92a-26ce-5a68-909b-e18488bef1ad"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magic_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.magic_rat_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "6b25c43e846cdbf4276d18349be54a1db9c0a30e7cc0f465fa60ef70531174db"
+		logic_hash = "v1_sha256_6b25c43e846cdbf4276d18349be54a1db9c0a30e7cc0f465fa60ef70531174db"
 		score = 60
 		quality = 45
 		tags = "FILE"
@@ -187706,20 +187776,20 @@ rule MALPEDIA_Win_Magic_Rat_Auto : FILE
 		$sequence_9 = { 660f28c8 f20f5c0d???????? f20f2cd1 660fefc9 f20f2aca f20f5cc1 }
 
 	condition:
-		7 of them and filesize <41843712
+		7 of them and filesize < 41843712
 }
 rule MALPEDIA_Win_Scieron_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1a215415-1cbd-5509-a833-0e80720c59be"
+		id = "9db62fd9-c947-5520-b7e7-6576f879c817"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scieron"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.scieron_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "f3ffce1ac52929398289b6099b241833a19e91e706a019cc700fc14e11b03b2d"
+		logic_hash = "v1_sha256_f3ffce1ac52929398289b6099b241833a19e91e706a019cc700fc14e11b03b2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187745,20 +187815,20 @@ rule MALPEDIA_Win_Scieron_Auto : FILE
 		$sequence_9 = { ff15???????? 50 ff15???????? ffd0 83c61c }
 
 	condition:
-		7 of them and filesize <100352
+		7 of them and filesize < 100352
 }
 rule MALPEDIA_Win_Unidentified_089_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f61e4a77-808b-5e07-801b-03e57ce838b5"
+		id = "43a089a4-59cb-5112-a089-beed32bea66d"
 		date = "2023-07-11"
 		modified = "2023-07-15"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_089"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_089_auto.yar#L1-L98"
 		license_url = "N/A"
-		logic_hash = "f9666eb88fbd91e0eb2e4b4c8812230b36d73d66192fed407aecfaa8f0ed362a"
+		logic_hash = "v1_sha256_f9666eb88fbd91e0eb2e4b4c8812230b36d73d66192fed407aecfaa8f0ed362a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187782,20 +187852,20 @@ rule MALPEDIA_Win_Unidentified_089_Auto : FILE
 		$sequence_7 = { 56 6a01 8d4dec 8975d8 }
 
 	condition:
-		7 of them and filesize <389120
+		7 of them and filesize < 389120
 }
 rule MALPEDIA_Win_Hotwax_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d6f02e96-b0de-561a-b1c4-f7fa097556ab"
+		id = "f750468e-b4bd-5a3a-b7bf-4b56190fd65a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hotwax"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hotwax_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "fe64f11364e8e368736d318c239a3692d708ee4c24b150c29655e2d18f1cd86c"
+		logic_hash = "v1_sha256_fe64f11364e8e368736d318c239a3692d708ee4c24b150c29655e2d18f1cd86c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187821,20 +187891,20 @@ rule MALPEDIA_Win_Hotwax_Auto : FILE
 		$sequence_9 = { 4c8d0dac7fffff 4c8bd8 4b8b84f9a04b0100 4c895c3040 4b8b84f9a04b0100 498bd6 }
 
 	condition:
-		7 of them and filesize <198656
+		7 of them and filesize < 198656
 }
 rule MALPEDIA_Win_Common_Magic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "01685495-e500-52ed-8d28-52ffda64d4ce"
+		id = "83c7a872-a7b8-5420-b056-d076e2e16f19"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.common_magic"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.common_magic_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "f088c9c6d83029098f6560147761ea146208530ef1a48657d7b10a76113354f7"
+		logic_hash = "v1_sha256_f088c9c6d83029098f6560147761ea146208530ef1a48657d7b10a76113354f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187860,20 +187930,20 @@ rule MALPEDIA_Win_Common_Magic_Auto : FILE
 		$sequence_9 = { 8d45b4 c745b45368656c 50 56 c745b86c457865 c745bc63757465 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Gopuram_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8d1cf207-19a7-572a-8ca5-3e711cdc3ad9"
+		id = "4f0505d4-dbeb-5477-b37f-78029d4b3058"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gopuram"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gopuram_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "9c847639dd3b37832d4dad79157d5016a8deee4fa6901036c6568baf2f1743d6"
+		logic_hash = "v1_sha256_9c847639dd3b37832d4dad79157d5016a8deee4fa6901036c6568baf2f1743d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187899,20 +187969,20 @@ rule MALPEDIA_Win_Gopuram_Auto : FILE
 		$sequence_9 = { 85ed 0f89b1010000 0f1005???????? 4c8b05???????? 488d542460 41b902000000 b907010000 }
 
 	condition:
-		7 of them and filesize <1591296
+		7 of them and filesize < 1591296
 }
 rule MALPEDIA_Win_Jasus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e40f0cf2-c464-539f-a5ee-e734bdbeed88"
+		id = "1aa70aa5-4be7-537f-adac-34fac34652c5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jasus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jasus_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "2c691c8874b1ab7be876ba59aead20405103b0885bc9bec7a0a38d9442642c23"
+		logic_hash = "v1_sha256_2c691c8874b1ab7be876ba59aead20405103b0885bc9bec7a0a38d9442642c23"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -187938,20 +188008,20 @@ rule MALPEDIA_Win_Jasus_Auto : FILE
 		$sequence_9 = { 833d????????00 0fb75708 8b4f04 8b07 66899568feffff 0fb715???????? 898d64feffff }
 
 	condition:
-		7 of them and filesize <507904
+		7 of them and filesize < 507904
 }
 rule MALPEDIA_Win_Rm3_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b9c899fd-24b6-544d-a199-56585ec67459"
+		id = "189a1f48-4ac9-5896-ba0a-9420078e342e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rm3"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rm3_auto.yar#L1-L368"
 		license_url = "N/A"
-		logic_hash = "1f5fb30680a7291833cb3efcb87bc5516507b42236b00016cdde1fb7cc527979"
+		logic_hash = "v1_sha256_1f5fb30680a7291833cb3efcb87bc5516507b42236b00016cdde1fb7cc527979"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -188007,20 +188077,20 @@ rule MALPEDIA_Win_Rm3_Auto : FILE
 		$sequence_39 = { 8b4870 894de0 8b4874 894de4 8b4868 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize < 221184
 }
 rule MALPEDIA_Win_Prometei_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73d3f76f-d3b0-5e4d-8b8d-e04a2bcf37d7"
+		id = "8fd26b9d-6a0e-570e-a510-4a12c199d5da"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prometei"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.prometei_auto.yar#L1-L160"
 		license_url = "N/A"
-		logic_hash = "72d6c26be48c032cc1c8fed3d3613c60659d58796a856f7285dd7faf58b4fc32"
+		logic_hash = "v1_sha256_72d6c26be48c032cc1c8fed3d3613c60659d58796a856f7285dd7faf58b4fc32"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188052,20 +188122,20 @@ rule MALPEDIA_Win_Prometei_Auto : FILE
 		$sequence_15 = { a3???????? c605????????00 c745e82e646c6c 8b45e8 }
 
 	condition:
-		7 of them and filesize <51014656
+		7 of them and filesize < 51014656
 }
 rule MALPEDIA_Win_Project_Wood_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eadfb598-e06d-536a-8983-e068733d6495"
+		id = "ea117b05-45d3-56d3-8a29-52298769e280"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.project_wood"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.project_wood_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "92c5f7de9849db3abd82c6a5e3e8ba38f7353d944f46cacae8fc567f574f0ddc"
+		logic_hash = "v1_sha256_92c5f7de9849db3abd82c6a5e3e8ba38f7353d944f46cacae8fc567f574f0ddc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188091,20 +188161,20 @@ rule MALPEDIA_Win_Project_Wood_Auto : FILE
 		$sequence_9 = { 56 e8???????? 83c448 8d45e4 6a14 53 50 }
 
 	condition:
-		7 of them and filesize <31137792
+		7 of them and filesize < 31137792
 }
 rule MALPEDIA_Win_Amtsol_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d1d86fa3-9623-55ab-a209-71141f53945c"
+		id = "cdd59013-aa28-5727-9e6f-4385efb605c4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amtsol"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.amtsol_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "0a770dc5a932b1002072b79c5d73e29f3137e050ecc56387df95b6b6024c1535"
+		logic_hash = "v1_sha256_0a770dc5a932b1002072b79c5d73e29f3137e050ecc56387df95b6b6024c1535"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188130,20 +188200,20 @@ rule MALPEDIA_Win_Amtsol_Auto : FILE
 		$sequence_9 = { 85c0 7428 837dfc00 7413 0fb745f8 50 ff75fc }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize < 335872
 }
 rule MALPEDIA_Win_Bolek_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "15e34de8-623e-5f2f-9d4c-c44b8f35819d"
+		id = "3cd56c77-bd65-568b-bd1f-99ae2b64a2a9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bolek"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bolek_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "403a7b71c7f1728fba717836e961ac65b351f821c9556b0d1663304cb6494bb7"
+		logic_hash = "v1_sha256_403a7b71c7f1728fba717836e961ac65b351f821c9556b0d1663304cb6494bb7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188169,20 +188239,20 @@ rule MALPEDIA_Win_Bolek_Auto : FILE
 		$sequence_9 = { ff742428 6810270000 57 55 53 e8???????? 8bd0 }
 
 	condition:
-		7 of them and filesize <892928
+		7 of them and filesize < 892928
 }
 rule MALPEDIA_Win_Quiterat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77d947fb-1cf9-5915-bdff-e8a9015c7494"
+		id = "96df8f83-72b5-50f6-8a55-c62e097755ba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quiterat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.quiterat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a310f4ac3c641f7313b25e7928a0fd6d50c428f9dd3945e05d910454f6c56057"
+		logic_hash = "v1_sha256_a310f4ac3c641f7313b25e7928a0fd6d50c428f9dd3945e05d910454f6c56057"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188208,20 +188278,20 @@ rule MALPEDIA_Win_Quiterat_Auto : FILE
 		$sequence_9 = { 8b06 85c0 7415 83f8ff 7435 8bc7 f00fc106 }
 
 	condition:
-		7 of them and filesize <5892096
+		7 of them and filesize < 5892096
 }
 rule MALPEDIA_Win_Homefry_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7df805f2-9572-5d41-ae6a-f57f653d9d31"
+		id = "2e93dfbe-8aec-5107-bb62-cd54b090fadd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.homefry"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.homefry_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "7ca7431c5f68652158a7da10d411e05a72b05761bc09d487931a01e83f98c509"
+		logic_hash = "v1_sha256_7ca7431c5f68652158a7da10d411e05a72b05761bc09d487931a01e83f98c509"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188247,20 +188317,20 @@ rule MALPEDIA_Win_Homefry_Auto : FILE
 		$sequence_9 = { 483bdd 72d0 488bcf ff15???????? 33c0 488b5c2430 488b6c2438 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize < 65536
 }
 rule MALPEDIA_Win_Darkmoon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5d3b6757-7119-5541-a7be-7724ca1cd5bf"
+		id = "114909f6-af97-5d24-99e6-bf922322ced6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmoon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkmoon_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "d37414a84f00a17b4ccc08379aad2daedc420510e1678b61639cea473c36abeb"
+		logic_hash = "v1_sha256_d37414a84f00a17b4ccc08379aad2daedc420510e1678b61639cea473c36abeb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188286,20 +188356,20 @@ rule MALPEDIA_Win_Darkmoon_Auto : FILE
 		$sequence_9 = { 8d86120e0000 8945cc 8d45dc 50 6a01 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Ascentloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "52e48a17-f763-5fcc-946a-031eef291a19"
+		id = "33f42512-1799-5b50-beb6-56d854c9865b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ascentloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ascentloader_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "47183e13937994500473836e864be558b3709bce2edd5ef734fa1f084094231f"
+		logic_hash = "v1_sha256_47183e13937994500473836e864be558b3709bce2edd5ef734fa1f084094231f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188325,20 +188395,20 @@ rule MALPEDIA_Win_Ascentloader_Auto : FILE
 		$sequence_9 = { 56 8b5004 8b00 57 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize < 253952
 }
 rule MALPEDIA_Win_Unidentified_111_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "761c3c1a-627b-5adf-b1c2-f96f11c05a94"
+		id = "269f1c79-fb43-5149-b040-35fc43355c1e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_111"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_111_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "8a86a6eb9509e0a5b4e912cde53abfcabb23f3644fc565d69ca8396c5dc5d7c9"
+		logic_hash = "v1_sha256_8a86a6eb9509e0a5b4e912cde53abfcabb23f3644fc565d69ca8396c5dc5d7c9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188364,20 +188434,20 @@ rule MALPEDIA_Win_Unidentified_111_Auto : FILE
 		$sequence_9 = { 4889542410 48894c2408 4883ec78 c744243000000000 c744243400000000 488b942488000000 488d4c2448 }
 
 	condition:
-		7 of them and filesize <148480
+		7 of them and filesize < 148480
 }
 rule MALPEDIA_Win_Grimagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "382b2b71-faf8-5a36-9cf2-cfc0231fe5c7"
+		id = "50418724-ba70-5897-8382-60bd54f78534"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grimagent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.grimagent_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "cb883960783c6a0a5fc69c20e118ca0de5603c9daad18851a44812dd938995b0"
+		logic_hash = "v1_sha256_cb883960783c6a0a5fc69c20e118ca0de5603c9daad18851a44812dd938995b0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188403,20 +188473,20 @@ rule MALPEDIA_Win_Grimagent_Auto : FILE
 		$sequence_9 = { 8b4d0c 83c101 894d0c ebd0 }
 
 	condition:
-		7 of them and filesize <582656
+		7 of them and filesize < 582656
 }
 rule MALPEDIA_Win_Kurton_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ae340b25-d60e-5936-9704-4ef115d92a62"
+		id = "2ea8517b-5e46-5609-8807-77f1f489fff2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kurton"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kurton_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "98f093531c4285f2e18a4965e5bde7f8dfb22eacc63485687a98c0565a239fa8"
+		logic_hash = "v1_sha256_98f093531c4285f2e18a4965e5bde7f8dfb22eacc63485687a98c0565a239fa8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188442,20 +188512,20 @@ rule MALPEDIA_Win_Kurton_Auto : FILE
 		$sequence_9 = { f7d1 2bf9 8d94245d010000 8bc1 8bf7 8bfa c1e902 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize < 344064
 }
 rule MALPEDIA_Win_Ldr4_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e9bf8314-609f-5a98-b31a-45503c13f904"
+		id = "09066572-6f1a-590b-8fe9-239258bd174c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ldr4"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ldr4_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "53ff90205c01818bf39f4f2440172f0cbaed0a0fe830aff04c528ba3bd5f6dab"
+		logic_hash = "v1_sha256_53ff90205c01818bf39f4f2440172f0cbaed0a0fe830aff04c528ba3bd5f6dab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188481,20 +188551,20 @@ rule MALPEDIA_Win_Ldr4_Auto : FILE
 		$sequence_9 = { 50 ff75f8 e8???????? ff75f8 894508 6a00 56 }
 
 	condition:
-		7 of them and filesize <117760
+		7 of them and filesize < 117760
 }
 rule MALPEDIA_Win_Batel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "678ea513-45df-57d6-9805-5abca0dd9fcc"
+		id = "e110d0d7-1565-5060-8723-6a178b9e1c0b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.batel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.batel_auto.yar#L1-L235"
 		license_url = "N/A"
-		logic_hash = "731869ba11fac648e9df7ba8fc3d93220b79591052bdb6d5c0dfe953901a0596"
+		logic_hash = "v1_sha256_731869ba11fac648e9df7ba8fc3d93220b79591052bdb6d5c0dfe953901a0596"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -188533,20 +188603,20 @@ rule MALPEDIA_Win_Batel_Auto : FILE
 		$sequence_22 = { 85c0 7412 ffd0 56 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Vidar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4940e312-352d-5104-84b1-3e1a86d1ecab"
+		id = "a3d0645c-ca85-53d6-81f1-36c0e1265a6a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vidar_auto.yar#L1-L422"
 		license_url = "N/A"
-		logic_hash = "78072c96fd4e60233539f368a83645e6e3c45bf8d23ede4d4f8a97936d6b546c"
+		logic_hash = "v1_sha256_78072c96fd4e60233539f368a83645e6e3c45bf8d23ede4d4f8a97936d6b546c"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -188609,20 +188679,20 @@ rule MALPEDIA_Win_Vidar_Auto : FILE
 		$sequence_46 = { 8bc6 5e c3 8b0a 80790d00 750c }
 
 	condition:
-		7 of them and filesize <4751360
+		7 of them and filesize < 4751360
 }
 rule MALPEDIA_Win_Nitlove_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b0d01298-0d5a-55f1-9d4e-e8ef0815c02e"
+		id = "64810567-bd3a-5fdf-9c94-5fb7abcbf041"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitlove"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nitlove_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "39f2491a6c684fee2e407b59de9df647d75dd52440711335af5e0d5784c94ebd"
+		logic_hash = "v1_sha256_39f2491a6c684fee2e407b59de9df647d75dd52440711335af5e0d5784c94ebd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188648,20 +188718,20 @@ rule MALPEDIA_Win_Nitlove_Auto : FILE
 		$sequence_9 = { 8955fc 8b473c 8b443878 03c7 8b481c 03cf 894dec }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Poortry_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1a56f3e-7edd-5f6c-95ad-6a7e0151c6bc"
+		id = "33a9b841-3df1-5819-9a09-f9dca479fd1c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poortry"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.poortry_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "061aa3c00188d534d84cadb6424381cd58cb3c5879a428a6e59fbe1a6fec0983"
+		logic_hash = "v1_sha256_061aa3c00188d534d84cadb6424381cd58cb3c5879a428a6e59fbe1a6fec0983"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188687,20 +188757,20 @@ rule MALPEDIA_Win_Poortry_Auto : FILE
 		$sequence_9 = { d2ef 660fbae309 453ad5 5b f6c68b 4180fa75 f5 }
 
 	condition:
-		7 of them and filesize <8078336
+		7 of them and filesize < 8078336
 }
 rule MALPEDIA_Win_Microbackdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca439651-8945-55d7-8b43-498ad02227fd"
+		id = "f2af9ecd-90ca-5aa9-a74b-c2ddd2737645"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.microbackdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.microbackdoor_auto.yar#L1-L179"
 		license_url = "N/A"
-		logic_hash = "a9f80afe51613a501aee1e06cfe93241c41ac6752fa256f5ea6aad4ef6ad5201"
+		logic_hash = "v1_sha256_a9f80afe51613a501aee1e06cfe93241c41ac6752fa256f5ea6aad4ef6ad5201"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188732,20 +188802,20 @@ rule MALPEDIA_Win_Microbackdoor_Auto : FILE
 		$sequence_15 = { ebe0 ff15???????? 488d0de93e0000 8bd0 e8???????? ebc8 }
 
 	condition:
-		7 of them and filesize <123904
+		7 of them and filesize < 123904
 }
 rule MALPEDIA_Win_Icondown_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5373046f-833e-5b65-887b-89e409444e78"
+		id = "c3e50f6e-59d8-5fec-8803-936faea0c7c8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icondown"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.icondown_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "bd300aef1bbb9e18b32c6db589be33a644549d928eba04fbddb21d95cf446793"
+		logic_hash = "v1_sha256_bd300aef1bbb9e18b32c6db589be33a644549d928eba04fbddb21d95cf446793"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188771,20 +188841,20 @@ rule MALPEDIA_Win_Icondown_Auto : FILE
 		$sequence_9 = { 8a4e24 f6c101 7409 8b4e1c 85c9 7408 }
 
 	condition:
-		7 of them and filesize <5505024
+		7 of them and filesize < 5505024
 }
 rule MALPEDIA_Win_Industroyer2_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "be2f5050-30a2-53df-a694-0ba33b5871cf"
+		id = "a995db9d-7565-53ee-8aaa-8b38446f517d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer2"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.industroyer2_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "94208b597eddeff9489860d6342fc47049a5b4b079735882fa37a055dd142db4"
+		logic_hash = "v1_sha256_94208b597eddeff9489860d6342fc47049a5b4b079735882fa37a055dd142db4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188810,20 +188880,20 @@ rule MALPEDIA_Win_Industroyer2_Auto : FILE
 		$sequence_9 = { c745ecffffffff eb15 8b450c c6801800010001 }
 
 	condition:
-		7 of them and filesize <100352
+		7 of them and filesize < 100352
 }
 rule MALPEDIA_Win_Xpertrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e49e4f10-4f24-5d5f-a0ba-93859bc43e3e"
+		id = "0d8c57bb-2be3-555a-85b2-89499cb841be"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpertrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.xpertrat_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "0756c58d6846e1ce6d5f3a4d4ce8c4c63505cae3368973abe64928b289231578"
+		logic_hash = "v1_sha256_0756c58d6846e1ce6d5f3a4d4ce8c4c63505cae3368973abe64928b289231578"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188855,20 +188925,20 @@ rule MALPEDIA_Win_Xpertrat_Auto : FILE
 		$sequence_15 = { ff15???????? 6a00 6a00 6a01 6a03 }
 
 	condition:
-		7 of them and filesize <8560640
+		7 of them and filesize < 8560640
 }
 rule MALPEDIA_Win_Satellite_Turla_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "021a1167-58db-5ce8-8597-0f62f23fcc56"
+		id = "899dd1e6-74d2-51e1-8b5a-7a015681e751"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satellite_turla"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.satellite_turla_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "e5dfd974166d3696682fe85d3bf761357a2cf777cf6c86d583494170169c67ee"
+		logic_hash = "v1_sha256_e5dfd974166d3696682fe85d3bf761357a2cf777cf6c86d583494170169c67ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188900,20 +188970,20 @@ rule MALPEDIA_Win_Satellite_Turla_Auto : FILE
 		$sequence_15 = { c645b62b c645b72b e8???????? 83c40c 8d45a8 885db7 50 }
 
 	condition:
-		7 of them and filesize <1040384
+		7 of them and filesize < 1040384
 }
 rule MALPEDIA_Win_Blackenergy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "75f134c5-71b6-5322-a009-b31d954d7d23"
+		id = "056aeab2-2b52-5f45-9b95-8b7cccf97aba"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackenergy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blackenergy_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "1873575f4ba8e3b3e090543b90afdc434ae43dfa997f5bef2241328cdcb2b4cc"
+		logic_hash = "v1_sha256_1873575f4ba8e3b3e090543b90afdc434ae43dfa997f5bef2241328cdcb2b4cc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188939,20 +189009,20 @@ rule MALPEDIA_Win_Blackenergy_Auto : FILE
 		$sequence_9 = { 83ec48 6a04 8d45fc 50 8d45e8 50 8d45b8 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Slave_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b045c957-b6f9-5c69-b89f-41a2fc8766bd"
+		id = "27dfa500-2a9b-5c30-bdfe-251c73cfca34"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slave"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.slave_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "32dc8f0602dd0c995ffd6f35edd82eaee41a96ee44816d90c15c92afe3d59d57"
+		logic_hash = "v1_sha256_32dc8f0602dd0c995ffd6f35edd82eaee41a96ee44816d90c15c92afe3d59d57"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -188978,20 +189048,20 @@ rule MALPEDIA_Win_Slave_Auto : FILE
 		$sequence_9 = { 810e80000100 f70600400000 8b550c 743c 0fb68707030000 808f0603000002 c1e804 }
 
 	condition:
-		7 of them and filesize <532480
+		7 of them and filesize < 532480
 }
 rule MALPEDIA_Win_Sombrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c91fe38-2a08-5223-9951-dfa72ae3e5ad"
+		id = "ad330d10-e7e2-55fe-914a-b2de2a0651e2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sombrat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sombrat_auto.yar#L1-L152"
 		license_url = "N/A"
-		logic_hash = "cbad5e11330408439cf135255bf75438d03367a5c47a9504ff97a59c98c52d54"
+		logic_hash = "v1_sha256_cbad5e11330408439cf135255bf75438d03367a5c47a9504ff97a59c98c52d54"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189023,20 +189093,20 @@ rule MALPEDIA_Win_Sombrat_Auto : FILE
 		$sequence_15 = { 014648 d3eb 018ec81b0000 c746044c3f0000 837df000 0f8461020000 }
 
 	condition:
-		7 of them and filesize <1466368
+		7 of them and filesize < 1466368
 }
 rule MALPEDIA_Win_Afrodita_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "abc25194-e40d-5d3d-8aa7-1b131b3ce317"
+		id = "50bbda74-4970-59d2-ba5b-9a080ce5e1f6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.afrodita"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.afrodita_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "5cdb28e0e0c0d2fc18f90f498d1e0e06f36fb26b48f78ae36bd548bd118d94b5"
+		logic_hash = "v1_sha256_5cdb28e0e0c0d2fc18f90f498d1e0e06f36fb26b48f78ae36bd548bd118d94b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189062,20 +189132,20 @@ rule MALPEDIA_Win_Afrodita_Auto : FILE
 		$sequence_9 = { c645fc0d 33c0 56 8b11 8bca f3ab 85d2 }
 
 	condition:
-		7 of them and filesize <2334720
+		7 of them and filesize < 2334720
 }
 rule MALPEDIA_Win_Rtm_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0ddce877-c810-52c5-9bdb-6bdd5bdc33c5"
+		id = "9f6cfa9c-e4e4-5e3c-9008-3110283a314c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rtm_locker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rtm_locker_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "368fcfca2d19a0bfd2fafa00b39d1c6b06c40ca85cdf8b686f8ad87f29bc5ebf"
+		logic_hash = "v1_sha256_368fcfca2d19a0bfd2fafa00b39d1c6b06c40ca85cdf8b686f8ad87f29bc5ebf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189101,20 +189171,20 @@ rule MALPEDIA_Win_Rtm_Locker_Auto : FILE
 		$sequence_9 = { 0f108570feffff 0f118508ffffff e8???????? 8d8d30feffff e8???????? 8d8d30feffff e8???????? }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize < 598016
 }
 rule MALPEDIA_Win_Doplugs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "25bc6674-e80a-5978-bdcd-775785ac724e"
+		id = "393981cf-0bff-5c31-9696-2e8b2b7d7d2f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doplugs"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.doplugs_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f953831840b57858258557fc6d861ade3d3cd53d14e6b5f923d0ab7ef61db359"
+		logic_hash = "v1_sha256_f953831840b57858258557fc6d861ade3d3cd53d14e6b5f923d0ab7ef61db359"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189140,20 +189210,20 @@ rule MALPEDIA_Win_Doplugs_Auto : FILE
 		$sequence_9 = { f7d2 21da 09d0 8b542414 31c8 668902 8b0424 }
 
 	condition:
-		7 of them and filesize <1355776
+		7 of them and filesize < 1355776
 }
 rule MALPEDIA_Win_Webc2_Ausov_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f988a94d-ce66-5749-aa7b-8d72d93ac6d8"
+		id = "4ed6242f-f867-5092-868f-0a95e1c1e226"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ausov"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_ausov_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "1e4b39bc03f6a1c14963eaf8f0b58843065ae625a870f162ccaf462590958318"
+		logic_hash = "v1_sha256_1e4b39bc03f6a1c14963eaf8f0b58843065ae625a870f162ccaf462590958318"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189179,20 +189249,20 @@ rule MALPEDIA_Win_Webc2_Ausov_Auto : FILE
 		$sequence_9 = { b90d000000 33c0 8dbdc9fdffff f3ab }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Qtbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b6cd7830-06d4-528e-badc-1164fe765257"
+		id = "02147cc9-5ccd-51b1-a9c3-378e62b53ef8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qtbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.qtbot_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "b0461cc5472670ef13bed91b802682965df84a278581734494bb0db4dd3456a2"
+		logic_hash = "v1_sha256_b0461cc5472670ef13bed91b802682965df84a278581734494bb0db4dd3456a2"
 		score = 60
 		quality = 25
 		tags = "FILE"
@@ -189224,20 +189294,20 @@ rule MALPEDIA_Win_Qtbot_Auto : FILE
 		$sequence_15 = { 0fb6805a210010 ff2485f6200010 8b8614080000 3b45f4 7e03 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Redyms_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "caf709b7-19ee-5a38-9403-a27d78973c28"
+		id = "5295db8d-9e5e-5f51-8944-e999ed7fd57e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redyms"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.redyms_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "b27b96ec2fba623283604654291a288582fbe387215c7c411815fe1fd821aa0e"
+		logic_hash = "v1_sha256_b27b96ec2fba623283604654291a288582fbe387215c7c411815fe1fd821aa0e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189263,20 +189333,20 @@ rule MALPEDIA_Win_Redyms_Auto : FILE
 		$sequence_9 = { 0f84b2000000 8d7ddc b825000000 e8???????? 8b4dd0 8b55d4 a1???????? }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize < 98304
 }
 rule MALPEDIA_Win_Maui_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fae207f4-bee0-581e-92b7-618fcd87980f"
+		id = "52e99a9b-f6e5-5ff9-924a-b55e3c87df12"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maui"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.maui_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "c832f22e1bbb1398fc1d6a8199e3732cb12b403d9a2eb2103c84e67dba24e6f9"
+		logic_hash = "v1_sha256_c832f22e1bbb1398fc1d6a8199e3732cb12b403d9a2eb2103c84e67dba24e6f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189302,20 +189372,20 @@ rule MALPEDIA_Win_Maui_Auto : FILE
 		$sequence_9 = { 755a 6852010000 68???????? 6a20 6a69 6a21 e8???????? }
 
 	condition:
-		7 of them and filesize <1616896
+		7 of them and filesize < 1616896
 }
 rule MALPEDIA_Win_Kazuar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e7b5f37c-6bd5-5a21-b802-031d3d305256"
+		id = "a96dc519-b606-51c7-918b-20e218b6827c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kazuar"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kazuar_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "02ddda00d237d685622ba3fe593a517532f67079f8df3124667eb63da629b240"
+		logic_hash = "v1_sha256_02ddda00d237d685622ba3fe593a517532f67079f8df3124667eb63da629b240"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189341,20 +189411,20 @@ rule MALPEDIA_Win_Kazuar_Auto : FILE
 		$sequence_9 = { 4889c1 4989c0 e8???????? 4c8d4c2428 31d2 31c9 01c0 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Shapeshift_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cabcac9b-3338-5cbf-966e-320365499be9"
+		id = "ed4e389b-5048-5150-8450-6059086895e5"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shapeshift"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shapeshift_auto.yar#L1-L95"
 		license_url = "N/A"
-		logic_hash = "4f13648d24cba1b4262131ef571d4233f5b7db53468eba6e1303bec367f02718"
+		logic_hash = "v1_sha256_4f13648d24cba1b4262131ef571d4233f5b7db53468eba6e1303bec367f02718"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189378,20 +189448,20 @@ rule MALPEDIA_Win_Shapeshift_Auto : FILE
 		$sequence_7 = { ff15???????? 68???????? 6a00 ff15???????? 8bf0 ff15???????? }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize < 303104
 }
 rule MALPEDIA_Win_Unidentified_070_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2ac6d19-ae7e-5108-ae59-9789ab0e339d"
+		id = "d71c7670-2292-502f-b07e-d8316f411c9c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_070"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_070_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "45a52b7bdbd7641f0d504c35a74291eb016539e938091cf460316e51b8b9d79b"
+		logic_hash = "v1_sha256_45a52b7bdbd7641f0d504c35a74291eb016539e938091cf460316e51b8b9d79b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189417,20 +189487,20 @@ rule MALPEDIA_Win_Unidentified_070_Auto : FILE
 		$sequence_9 = { 6808020000 8d8424d4020000 6a00 50 e8???????? }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize < 90112
 }
 rule MALPEDIA_Win_Sidewalk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "50903c03-c7b5-5314-a551-e4e23fcd9efd"
+		id = "ad1e2558-1a30-5d44-b5d8-8e2d25995075"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewalk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sidewalk_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "e6737ed096fc4d4ecc8ea3c0d1ac3b4b3bce3ee6030ce0fc8630ca3477945c10"
+		logic_hash = "v1_sha256_e6737ed096fc4d4ecc8ea3c0d1ac3b4b3bce3ee6030ce0fc8630ca3477945c10"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189462,20 +189532,20 @@ rule MALPEDIA_Win_Sidewalk_Auto : FILE
 		$sequence_15 = { 4133f8 c1c610 4433f2 c1c710 4403df }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize < 237568
 }
 rule MALPEDIA_Win_Makloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0f3149c9-1ed5-5172-a5f9-8fb09f83bab4"
+		id = "7d19eefd-dcd8-5b76-9bf3-05633e7ca934"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.makloader_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "d48950dd774d94fc31c8ea99b96c15449f45f0477bbb34828e1e9167b3ed582c"
+		logic_hash = "v1_sha256_d48950dd774d94fc31c8ea99b96c15449f45f0477bbb34828e1e9167b3ed582c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189501,20 +189571,20 @@ rule MALPEDIA_Win_Makloader_Auto : FILE
 		$sequence_9 = { 8b4dfc 884114 ba01000000 6bc214 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize < 335872
 }
 rule MALPEDIA_Win_Badencript_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ddb7f1a7-8259-5ec8-9b35-e98fb67b2310"
+		id = "78e3aa76-c9af-5720-8b52-5f9ca7a1af39"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badencript"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.badencript_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "4aaa48768d97770f6e85ee594f356b88c6dabd160111a6a927596e69e9ca03f4"
+		logic_hash = "v1_sha256_4aaa48768d97770f6e85ee594f356b88c6dabd160111a6a927596e69e9ca03f4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189540,20 +189610,20 @@ rule MALPEDIA_Win_Badencript_Auto : FILE
 		$sequence_9 = { 7313 8a8750304100 08441619 42 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize < 335872
 }
 rule MALPEDIA_Win_Sysjoker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c6b88483-c0cd-564a-a7b0-6f38f31ef535"
+		id = "7ec8c491-5554-5e5e-a52c-12d412178be7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysjoker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sysjoker_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "d98bfbb9945f0ec0fc3cad0efe9bd86fca6a269db3916cb189ae165a81048301"
+		logic_hash = "v1_sha256_d98bfbb9945f0ec0fc3cad0efe9bd86fca6a269db3916cb189ae165a81048301"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189579,20 +189649,20 @@ rule MALPEDIA_Win_Sysjoker_Auto : FILE
 		$sequence_9 = { c645fc1c e9???????? 52 51 e8???????? 83c408 e9???????? }
 
 	condition:
-		7 of them and filesize <832512
+		7 of them and filesize < 832512
 }
 rule MALPEDIA_Win_Dnspionage_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c7c60f8b-ffeb-567c-be45-7a70df2627af"
+		id = "a41da805-eca8-5b56-9bbf-eb5c6f020721"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnspionage"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dnspionage_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "9f5e6f058799877afad32a21b9b0391ec6d411b2fe63c92bd1ec8e1ea4cf6242"
+		logic_hash = "v1_sha256_9f5e6f058799877afad32a21b9b0391ec6d411b2fe63c92bd1ec8e1ea4cf6242"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189618,20 +189688,20 @@ rule MALPEDIA_Win_Dnspionage_Auto : FILE
 		$sequence_9 = { 8b4ddc 85db 0f8563ffffff 8975f0 85f6 0f84a0000000 8bc6 }
 
 	condition:
-		7 of them and filesize <786432
+		7 of them and filesize < 786432
 }
 rule MALPEDIA_Win_Bravonc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "46ca6b44-3777-5a69-8397-e443ebcbbb5c"
+		id = "c64189c0-6773-5bd2-8ffe-9e4399cdc0b2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bravonc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bravonc_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "c173b555e387356384c480cbe1258c67f0fa737efd2cf0efcccd2c272e1e677f"
+		logic_hash = "v1_sha256_c173b555e387356384c480cbe1258c67f0fa737efd2cf0efcccd2c272e1e677f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189657,20 +189727,20 @@ rule MALPEDIA_Win_Bravonc_Auto : FILE
 		$sequence_9 = { 59 8d7db0 6a10 c745ac44000000 59 895df0 f3ab }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Htbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b8c0c702-9e98-5ca8-9fa2-097b95e54dc8"
+		id = "66e75ada-6203-5681-92dc-5534cf9c7c0c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.htbot_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "39353b8760f6514deb000f072c90c3958c292efa21f940225f19c2a80bdd3000"
+		logic_hash = "v1_sha256_39353b8760f6514deb000f072c90c3958c292efa21f940225f19c2a80bdd3000"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189696,20 +189766,20 @@ rule MALPEDIA_Win_Htbot_Auto : FILE
 		$sequence_9 = { 33c4 50 8d442420 64a300000000 33db 895c241c 895c2418 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize < 196608
 }
 rule MALPEDIA_Win_Blacklotus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "84ef9a0b-6544-5450-8b66-292ec2ba5dbd"
+		id = "dfbff8f4-8af2-558c-8264-6a61f6d72c3d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blacklotus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blacklotus_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "94ccc2d7ff61cb6463b78893aadb2549c584433629bcbab33ca8298790f40cde"
+		logic_hash = "v1_sha256_94ccc2d7ff61cb6463b78893aadb2549c584433629bcbab33ca8298790f40cde"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189735,20 +189805,20 @@ rule MALPEDIA_Win_Blacklotus_Auto : FILE
 		$sequence_9 = { 48897010 48897818 4c897020 55 488d68c8 4881ec30010000 4c8bd1 }
 
 	condition:
-		7 of them and filesize <181248
+		7 of them and filesize < 181248
 }
 rule MALPEDIA_Win_Socks5_Systemz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1b9e49c1-7943-57d2-ba80-481fd6bd4c4f"
+		id = "95a0810a-1193-5443-82ec-e1b64e66b983"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socks5_systemz"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.socks5_systemz_auto.yar#L1-L110"
 		license_url = "N/A"
-		logic_hash = "9753a87ae203dc0ffbfcfb14c7d357f4f852fcb6d79c68c3fdb61fe8b2c4fc73"
+		logic_hash = "v1_sha256_9753a87ae203dc0ffbfcfb14c7d357f4f852fcb6d79c68c3fdb61fe8b2c4fc73"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189772,20 +189842,20 @@ rule MALPEDIA_Win_Socks5_Systemz_Auto : FILE
 		$sequence_7 = { e8???????? c706???????? 8d4e14 8b470c 89460c 8b4710 894610 }
 
 	condition:
-		7 of them and filesize <1417216
+		7 of them and filesize < 1417216
 }
 rule MALPEDIA_Win_Selfmake_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "15836b07-3544-5bf9-b844-02538b3af65c"
+		id = "c163d87b-dddb-52c0-8b73-28fbb9c336e3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.selfmake"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.selfmake_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "93ed4fceea8c314a1c4a918011ab44630046aab19d1594880ab759bf63042ba9"
+		logic_hash = "v1_sha256_93ed4fceea8c314a1c4a918011ab44630046aab19d1594880ab759bf63042ba9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189811,20 +189881,20 @@ rule MALPEDIA_Win_Selfmake_Auto : FILE
 		$sequence_9 = { 51 50 e8???????? 8bf8 8a4500 }
 
 	condition:
-		7 of them and filesize <932864
+		7 of them and filesize < 932864
 }
 rule MALPEDIA_Win_Photofork_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ceb1cb1f-8247-52bb-81a3-fc6627c948bc"
+		id = "9daea32b-1e77-5c00-82de-59d255e1f808"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photofork"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.photofork_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "55c8708d569da20398deafe5dc1cb0108f4fd9e562f2f0448ff6d194ec946bbd"
+		logic_hash = "v1_sha256_55c8708d569da20398deafe5dc1cb0108f4fd9e562f2f0448ff6d194ec946bbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189850,20 +189920,20 @@ rule MALPEDIA_Win_Photofork_Auto : FILE
 		$sequence_9 = { 4d8b00 488b09 4889442420 e8???????? 488b9c24b8000000 3dc8000000 }
 
 	condition:
-		7 of them and filesize <99328
+		7 of them and filesize < 99328
 }
 rule MALPEDIA_Win_Rincux_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8d755739-a59d-591b-8d5d-874be1eebc41"
+		id = "0c9336cd-522f-5761-947f-c6f9d584ab4f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rincux"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rincux_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "7c862e7ddc61d94d5055385764a3b34165e25fd304c6c127ff548146450f782d"
+		logic_hash = "v1_sha256_7c862e7ddc61d94d5055385764a3b34165e25fd304c6c127ff548146450f782d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189889,20 +189959,20 @@ rule MALPEDIA_Win_Rincux_Auto : FILE
 		$sequence_9 = { ffd7 8d84246c030000 6804010000 50 ffd3 8d8c246c030000 68???????? }
 
 	condition:
-		7 of them and filesize <392192
+		7 of them and filesize < 392192
 }
 rule MALPEDIA_Win_Poison_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3901c97f-e38d-5819-991e-493be520fc51"
+		id = "3a817401-92ef-5f11-82da-3c11a9fe9ec2"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.poison_rat_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "b960cb72b2615d9b184a9e25264d3c87f1ec796c5d1b6fa8620d3a64be9786ae"
+		logic_hash = "v1_sha256_b960cb72b2615d9b184a9e25264d3c87f1ec796c5d1b6fa8620d3a64be9786ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189928,20 +189998,20 @@ rule MALPEDIA_Win_Poison_Rat_Auto : FILE
 		$sequence_9 = { 8bf1 c1f805 83e61f 8d3c8580c54000 c1e603 8b07 }
 
 	condition:
-		7 of them and filesize <101688
+		7 of them and filesize < 101688
 }
 rule MALPEDIA_Win_Startpage_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "32039b80-5611-5dab-bcba-b3de61ca7c44"
+		id = "9572203f-0493-54fe-9f69-12af3eebe49b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.startpage"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.startpage_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "264fe8c064e54c165fc131dc307fd06ea57035a4276b77eac419d3cf78ed64b4"
+		logic_hash = "v1_sha256_264fe8c064e54c165fc131dc307fd06ea57035a4276b77eac419d3cf78ed64b4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -189967,20 +190037,20 @@ rule MALPEDIA_Win_Startpage_Auto : FILE
 		$sequence_9 = { 5b 8be5 5d c3 ff15???????? 0fb7c8 81c900000780 }
 
 	condition:
-		7 of them and filesize <2277376
+		7 of them and filesize < 2277376
 }
 rule MALPEDIA_Win_Fanny_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "636b5d30-80f3-5732-bf96-9c4782cd973d"
+		id = "8c48aad5-1c69-54d1-9bde-4fd80660b0da"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fanny"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fanny_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "194cb9aecc835fe3bc3c50607cb7b5a60a928574c0136642094275d35cd55914"
+		logic_hash = "v1_sha256_194cb9aecc835fe3bc3c50607cb7b5a60a928574c0136642094275d35cd55914"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190012,20 +190082,20 @@ rule MALPEDIA_Win_Fanny_Auto : FILE
 		$sequence_15 = { ff33 ff15???????? 832300 59 8b45fc 5f 5e }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Heriplor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d711b4d9-3914-58b9-9b88-9214444e3dee"
+		id = "336c4225-c921-51d1-9cf3-193fe4246b6f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heriplor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.heriplor_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "bf5971e2bb98e2180b60da71db38d7f4898a68723f2588a48c70334b337b7d93"
+		logic_hash = "v1_sha256_bf5971e2bb98e2180b60da71db38d7f4898a68723f2588a48c70334b337b7d93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190051,20 +190121,20 @@ rule MALPEDIA_Win_Heriplor_Auto : FILE
 		$sequence_9 = { 01f9 01fa 01fb 8b32 01fe 6a01 ff750c }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize < 49152
 }
 rule MALPEDIA_Win_Vskimmer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "60bc81a1-a857-5ddb-833d-12c04ee64d84"
+		id = "cdeb75e4-bab3-5c9c-a5fe-6049f9c65c8c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vskimmer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vskimmer_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "3a5deb80227e8fbb07640a24d78b7397cb1bc684cae3032e29532961361bc773"
+		logic_hash = "v1_sha256_3a5deb80227e8fbb07640a24d78b7397cb1bc684cae3032e29532961361bc773"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190090,20 +190160,20 @@ rule MALPEDIA_Win_Vskimmer_Auto : FILE
 		$sequence_9 = { 8d858cf7ffff 8bcc 89a5c0f6ffff 50 e8???????? }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize < 376832
 }
 rule MALPEDIA_Win_Babuk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8c7b928c-487d-526b-ac59-7d8bfd4e45d6"
+		id = "edbfcea2-b3f2-5951-9aa3-bc6a69ebef80"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.babuk_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "354e556bcaba9e4e8ba4670f917c2bf0c9f534ada32a0a701e4d296506ec2560"
+		logic_hash = "v1_sha256_354e556bcaba9e4e8ba4670f917c2bf0c9f534ada32a0a701e4d296506ec2560"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190135,20 +190205,20 @@ rule MALPEDIA_Win_Babuk_Auto : FILE
 		$sequence_15 = { 6bf100 8b45ec 8b55f0 b11a e8???????? }
 
 	condition:
-		7 of them and filesize <183296
+		7 of them and filesize < 183296
 }
 rule MALPEDIA_Win_Unidentified_091_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62d0217c-caa8-5a24-836c-be321aa72ae6"
+		id = "39372311-1476-534d-a69c-b0e5ff24ec06"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_091"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_091_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5a53bb358b4bf07b18385bcb86f5c0c27f228bb0e297f7cd9c02060943441d31"
+		logic_hash = "v1_sha256_5a53bb358b4bf07b18385bcb86f5c0c27f228bb0e297f7cd9c02060943441d31"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190174,20 +190244,20 @@ rule MALPEDIA_Win_Unidentified_091_Auto : FILE
 		$sequence_9 = { 83f8ff 7407 4803c0 8954c608 89540d9f 488b75cf 4c8b6dd7 }
 
 	condition:
-		7 of them and filesize <5777408
+		7 of them and filesize < 5777408
 }
 rule MALPEDIA_Win_Mrdec_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9c58a6c5-fccf-57f8-a955-f9f71c01cd0e"
+		id = "3600b943-5cd2-5b65-9cf0-236fbe839f52"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mrdec"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mrdec_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "3ee02aa9dfb3f27619d5f97eac66eb46db9b305219d25b4c3e7969b99a315a5e"
+		logic_hash = "v1_sha256_3ee02aa9dfb3f27619d5f97eac66eb46db9b305219d25b4c3e7969b99a315a5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190213,20 +190283,20 @@ rule MALPEDIA_Win_Mrdec_Auto : FILE
 		$sequence_9 = { 6a00 6a02 e8???????? 0bc0 0f8530010000 c745f000400000 }
 
 	condition:
-		7 of them and filesize <44864
+		7 of them and filesize < 44864
 }
 rule MALPEDIA_Win_Tinyloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "895ccf2b-2f25-5f72-b650-0acb543eef11"
+		id = "df5961cf-893f-55ab-a3c1-589ea8f49225"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tinyloader_auto.yar#L1-L218"
 		license_url = "N/A"
-		logic_hash = "b908cedbddd27a2a95532a03db9c626e01fc12979ac66acd61b30dfbfa8e2199"
+		logic_hash = "v1_sha256_b908cedbddd27a2a95532a03db9c626e01fc12979ac66acd61b30dfbfa8e2199"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -190264,20 +190334,20 @@ rule MALPEDIA_Win_Tinyloader_Auto : FILE
 		$sequence_21 = { 90 8bbb97114000 90 8938 90 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Nightdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d930ef7f-f999-550e-bc75-97e1e8c7627b"
+		id = "8c734875-a36f-5a52-bb87-976820855059"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nightdoor_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "b8f0be07bb7b1289cbb83b32643a32575a68c3484dc281ff533188505409d208"
+		logic_hash = "v1_sha256_b8f0be07bb7b1289cbb83b32643a32575a68c3484dc281ff533188505409d208"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190303,20 +190373,20 @@ rule MALPEDIA_Win_Nightdoor_Auto : FILE
 		$sequence_9 = { 8d55b8 52 e8???????? 898538ffffff 8b8d3cffffff e8???????? 8d8d4cffffff }
 
 	condition:
-		7 of them and filesize <1124352
+		7 of them and filesize < 1124352
 }
 rule MALPEDIA_Win_Jessiecontea_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "435a6af2-0956-5ced-bef4-bdde8bb54520"
+		id = "de151b6f-81b3-53f0-bc0d-57e3b4dd3bb3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jessiecontea"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jessiecontea_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "901d415627c4e09bca131d66822cb1b54da6638557cfa44cdd1fbdb71a4f0951"
+		logic_hash = "v1_sha256_901d415627c4e09bca131d66822cb1b54da6638557cfa44cdd1fbdb71a4f0951"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190348,20 +190418,20 @@ rule MALPEDIA_Win_Jessiecontea_Auto : FILE
 		$sequence_15 = { 33c1 6689442476 8b442450 6683c012 }
 
 	condition:
-		7 of them and filesize <413696
+		7 of them and filesize < 413696
 }
 rule MALPEDIA_Win_Killdisk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d7be3786-7785-5fb7-a02c-f300fdd3ab5d"
+		id = "4835c803-995a-5bdb-abb9-e77d8a0759ac"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.killdisk_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "86f639bc00ee029db28c18aca620f57e9d7c8d6a5978a5c4489b1ba8c9e4159d"
+		logic_hash = "v1_sha256_86f639bc00ee029db28c18aca620f57e9d7c8d6a5978a5c4489b1ba8c9e4159d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190393,20 +190463,20 @@ rule MALPEDIA_Win_Killdisk_Auto : FILE
 		$sequence_15 = { 33c0 89442404 89442408 8944240c 8d442408 }
 
 	condition:
-		7 of them and filesize <10817536
+		7 of them and filesize < 10817536
 }
 rule MALPEDIA_Win_Mmon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b18c07bb-08ed-5694-944e-153520890ae8"
+		id = "3fbdbfd9-09a7-55c9-bc81-e8c3febe696f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mmon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mmon_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "0a47221b764bce60b9ce9e11d4cf6ad81a3b7814241076d22b6772dafdc7fe22"
+		logic_hash = "v1_sha256_0a47221b764bce60b9ce9e11d4cf6ad81a3b7814241076d22b6772dafdc7fe22"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190432,20 +190502,20 @@ rule MALPEDIA_Win_Mmon_Auto : FILE
 		$sequence_9 = { 8b0d???????? 8bd6 2bd0 52 51 50 53 }
 
 	condition:
-		7 of them and filesize <356352
+		7 of them and filesize < 356352
 }
 rule MALPEDIA_Win_Phoreal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9354abd9-a851-5d8e-a424-1be008c5ab6c"
+		id = "3590b025-26bf-5c26-8a00-7c1cdc7c0f39"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phoreal"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.phoreal_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "904dd636d7db526ab8a0410c75a52ee0fac4292f0f4ce7ff0cd1d42961fa831e"
+		logic_hash = "v1_sha256_904dd636d7db526ab8a0410c75a52ee0fac4292f0f4ce7ff0cd1d42961fa831e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190471,20 +190541,20 @@ rule MALPEDIA_Win_Phoreal_Auto : FILE
 		$sequence_9 = { 85c0 7422 8b17 8910 8b4f04 894804 8b5708 }
 
 	condition:
-		7 of them and filesize <622592
+		7 of them and filesize < 622592
 }
 rule MALPEDIA_Win_Cuba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3602e8da-452a-5ed9-9344-c7f4379dda1d"
+		id = "0bdd1bbc-3857-518e-b93e-671e4f9f4e06"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cuba"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cuba_auto.yar#L1-L160"
 		license_url = "N/A"
-		logic_hash = "7c1547f930142355cbe84e5424404f219fb1f83bf4df86f3c7d2bdf36e965b58"
+		logic_hash = "v1_sha256_7c1547f930142355cbe84e5424404f219fb1f83bf4df86f3c7d2bdf36e965b58"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190516,20 +190586,20 @@ rule MALPEDIA_Win_Cuba_Auto : FILE
 		$sequence_15 = { 000446 41 00d1 45 }
 
 	condition:
-		7 of them and filesize <1094656
+		7 of them and filesize < 1094656
 }
 rule MALPEDIA_Win_Divergent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "11ec65d7-b0ac-595b-ba44-5bae97099c0e"
+		id = "92da408d-d135-5f7d-8a84-c03c66f7364e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.divergent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.divergent_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "ce2ba9c31c93d1d30382978d9975d2fc77a1697c44fa31feb01e0ffcff44bfb5"
+		logic_hash = "v1_sha256_ce2ba9c31c93d1d30382978d9975d2fc77a1697c44fa31feb01e0ffcff44bfb5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190555,20 +190625,20 @@ rule MALPEDIA_Win_Divergent_Auto : FILE
 		$sequence_9 = { 833fff 7437 8d4628 50 ff37 e8???????? 59 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Cryptomix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee7d4b5d-fd38-5125-ac96-e606d0aa2a74"
+		id = "29bfa88d-309a-56ef-ad62-57c5fbecc250"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptomix"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cryptomix_auto.yar#L1-L176"
 		license_url = "N/A"
-		logic_hash = "47824f768326cefd215579730913e815a8ef928dff6d4693ae0d6a1bbfe5f79b"
+		logic_hash = "v1_sha256_47824f768326cefd215579730913e815a8ef928dff6d4693ae0d6a1bbfe5f79b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190600,20 +190670,20 @@ rule MALPEDIA_Win_Cryptomix_Auto : FILE
 		$sequence_15 = { e8???????? 59 59 ff742404 ffd0 c3 68c1ea9d27 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Mydoom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68282348-e634-5e24-a89b-07582d0aeab6"
+		id = "df03700d-ebf8-53f6-a06b-417fbc932ecf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mydoom_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "26adeacf80adc41cd09ac09890246c8c37a7ca914ae80276202f0defea3500e4"
+		logic_hash = "v1_sha256_26adeacf80adc41cd09ac09890246c8c37a7ca914ae80276202f0defea3500e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190639,20 +190709,20 @@ rule MALPEDIA_Win_Mydoom_Auto : FILE
 		$sequence_9 = { 83ec04 b800000000 eb21 8b85d8feffff 890424 e8???????? }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Soundbite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "70cdb19a-d0a2-5f5f-a69b-31680210f3d2"
+		id = "e413b4ae-6f14-5cb2-a85b-1ad850e72f4b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soundbite"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.soundbite_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "d07ea48c839908887a0a5f9ab78be91fc08852ce51b809ff0c620d5b56719109"
+		logic_hash = "v1_sha256_d07ea48c839908887a0a5f9ab78be91fc08852ce51b809ff0c620d5b56719109"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190678,20 +190748,20 @@ rule MALPEDIA_Win_Soundbite_Auto : FILE
 		$sequence_9 = { e9???????? b830750000 85db 7e09 57 e8???????? 83c404 }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize < 409600
 }
 rule MALPEDIA_Win_R980_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "624a6ffd-b1f3-59a0-9a56-7f82cf4ce201"
+		id = "7c55102b-2e5f-5aed-85c9-2644dee6f278"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.r980"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.r980_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ef4f026b46d8c7c29b2c5642311344a13e41f9d1ab13a98be1b516e844609533"
+		logic_hash = "v1_sha256_ef4f026b46d8c7c29b2c5642311344a13e41f9d1ab13a98be1b516e844609533"
 		score = 75
 		quality = 45
 		tags = "FILE"
@@ -190717,20 +190787,20 @@ rule MALPEDIA_Win_R980_Auto : FILE
 		$sequence_9 = { 8b4634 3b4630 75a5 e9???????? 2b5e10 b801000000 5f }
 
 	condition:
-		7 of them and filesize <3178496
+		7 of them and filesize < 3178496
 }
 rule MALPEDIA_Win_Kivars_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d7f4c524-5721-516a-9cef-d2a6a4c9899f"
+		id = "077f1a46-54d7-5496-a5c5-5b2fe43d66e4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kivars"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kivars_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "0b4c416b9816d7bbf517a345e2ad0668f53e6096c3605ae9037473d6b0f26452"
+		logic_hash = "v1_sha256_0b4c416b9816d7bbf517a345e2ad0668f53e6096c3605ae9037473d6b0f26452"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190762,20 +190832,20 @@ rule MALPEDIA_Win_Kivars_Auto : FILE
 		$sequence_15 = { 488d8424a0010000 ba10000000 488bc8 e8???????? b801000000 488b8c24e8010000 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize < 196608
 }
 rule MALPEDIA_Win_Kdcsponge_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "93fd80a3-a643-5f56-b47f-f9e7f12c352c"
+		id = "40c0a277-13fb-5568-adb9-63ef7afaf3e1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kdcsponge"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kdcsponge_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "4a397cc9ed7623d7a2a288b58acb6ea4c1ff2bde7c30c2fd6b35d7ed37df75f7"
+		logic_hash = "v1_sha256_4a397cc9ed7623d7a2a288b58acb6ea4c1ff2bde7c30c2fd6b35d7ed37df75f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190801,20 +190871,20 @@ rule MALPEDIA_Win_Kdcsponge_Auto : FILE
 		$sequence_9 = { c7416000000100 48c7812801000000000200 48c7815801000001000000 48c7816001000001000000 c7813001000040000000 c3 33c0 }
 
 	condition:
-		7 of them and filesize <720896
+		7 of them and filesize < 720896
 }
 rule MALPEDIA_Win_Unidentified_102_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68f5ede2-e772-5b9c-86c7-72da7d6ddaff"
+		id = "2fadd4ae-e0fa-5867-8950-5b86702ba582"
 		date = "2023-07-11"
 		modified = "2023-07-15"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_102"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_102_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "7cf959abf8b06a75a101a66334f27ae5601df812c1ddb140fd9298ef735bb0dc"
+		logic_hash = "v1_sha256_7cf959abf8b06a75a101a66334f27ae5601df812c1ddb140fd9298ef735bb0dc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190840,20 +190910,20 @@ rule MALPEDIA_Win_Unidentified_102_Auto : FILE
 		$sequence_9 = { 8d45f4 64a300000000 8965f0 8b4510 8b4d18 8b5d0c }
 
 	condition:
-		7 of them and filesize <626688
+		7 of them and filesize < 626688
 }
 rule MALPEDIA_Win_Mirrorkey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "63ba5dc8-af1b-5114-b682-e36b4410bbde"
+		id = "d5254159-c9b7-5e53-873f-29de249aa2d3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirrorkey"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mirrorkey_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "45136c9373865a91139e9dff7c71e7f62a2de8b30b90c9e3be875470ec9069c0"
+		logic_hash = "v1_sha256_45136c9373865a91139e9dff7c71e7f62a2de8b30b90c9e3be875470ec9069c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190879,20 +190949,20 @@ rule MALPEDIA_Win_Mirrorkey_Auto : FILE
 		$sequence_9 = { 03c7 8945ec 8b441724 03c7 8945f8 }
 
 	condition:
-		7 of them and filesize <117760
+		7 of them and filesize < 117760
 }
 rule MALPEDIA_Win_Cheesetray_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0e764866-65b7-5e4b-a972-c9b6a1308865"
+		id = "645cade1-33a2-5218-abae-0d005eb6f3f9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cheesetray"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cheesetray_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "c2cc89a9aac3f1f1be62615be1486f58a410f3fcbd107e350beb164393db52f7"
+		logic_hash = "v1_sha256_c2cc89a9aac3f1f1be62615be1486f58a410f3fcbd107e350beb164393db52f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190918,20 +190988,20 @@ rule MALPEDIA_Win_Cheesetray_Auto : FILE
 		$sequence_9 = { a1???????? 8b0f 83c40c 50 6a3b 51 }
 
 	condition:
-		7 of them and filesize <8626176
+		7 of them and filesize < 8626176
 }
 rule MALPEDIA_Win_Bouncer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5fe05fe3-5ba6-5402-bae1-03809aced05d"
+		id = "6edb5a3d-ef88-5469-9deb-1ff32847038b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bouncer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.bouncer_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "ffbe1b49339388f6599ff4eb536b18862d27897734fc35260ae1ce6cc8930ed7"
+		logic_hash = "v1_sha256_ffbe1b49339388f6599ff4eb536b18862d27897734fc35260ae1ce6cc8930ed7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190957,20 +191027,20 @@ rule MALPEDIA_Win_Bouncer_Auto : FILE
 		$sequence_9 = { 8b8485a064ffff 3b45cc 0f8cbe090000 40 8945cc e9???????? 80f902 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize < 335872
 }
 rule MALPEDIA_Win_Karagany_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "98602626-f80c-53db-88a5-fef596efc6b3"
+		id = "519e019e-d5d1-5c4b-a03d-b77db61a6b8e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karagany"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.karagany_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "e11ee77bbad2aed0526f0917e5fec6612f23198efabc3eebf7b6abb2227dd310"
+		logic_hash = "v1_sha256_e11ee77bbad2aed0526f0917e5fec6612f23198efabc3eebf7b6abb2227dd310"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -190996,20 +191066,20 @@ rule MALPEDIA_Win_Karagany_Auto : FILE
 		$sequence_9 = { 8945d8 8945e0 8945e8 8945ec 8945f4 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule MALPEDIA_Win_Fuxsocy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9b163b74-81fa-5d1f-8fcc-0d3d39882b0f"
+		id = "224f6b78-5e53-53e1-890b-c5b455413603"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fuxsocy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fuxsocy_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "7f8e495acd118755a8b2612e1d92bc28ab4a40bb2e7047fd4133b89e103973ef"
+		logic_hash = "v1_sha256_7f8e495acd118755a8b2612e1d92bc28ab4a40bb2e7047fd4133b89e103973ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191035,20 +191105,20 @@ rule MALPEDIA_Win_Fuxsocy_Auto : FILE
 		$sequence_9 = { c20400 83ec18 56 89542414 66894c2406 e8???????? 8bf0 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize < 131072
 }
 rule MALPEDIA_Win_Kgh_Spy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2adff718-5ead-5f74-948f-adeec6ff4a99"
+		id = "30737985-1215-5fe6-a154-a6dd4e94ef19"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kgh_spy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kgh_spy_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "16434283b98a9ec3028553199436a1655677ca0b41828e5ff9ba53861a24c40d"
+		logic_hash = "v1_sha256_16434283b98a9ec3028553199436a1655677ca0b41828e5ff9ba53861a24c40d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191074,20 +191144,20 @@ rule MALPEDIA_Win_Kgh_Spy_Auto : FILE
 		$sequence_9 = { 4c8d351a920000 488bfb 83e31f 48c1ff05 }
 
 	condition:
-		7 of them and filesize <207872
+		7 of them and filesize < 207872
 }
 rule MALPEDIA_Win_Carrotball_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8d1dffb9-f801-5b51-998b-8e4431af5d29"
+		id = "37547477-8d9f-59a2-966b-3d7e70af1111"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotball"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.carrotball_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "8cb2e3b01c31931d0c5f23b61551aa799de8dd787a3493373f0ac01ba6f109d9"
+		logic_hash = "v1_sha256_8cb2e3b01c31931d0c5f23b61551aa799de8dd787a3493373f0ac01ba6f109d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191113,20 +191183,20 @@ rule MALPEDIA_Win_Carrotball_Auto : FILE
 		$sequence_9 = { 6bc000 c7807430001002000000 6a04 58 6bc000 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize < 40960
 }
 rule MALPEDIA_Win_Dimnie_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a82e9816-e911-5906-b4fb-5ab4ee56af42"
+		id = "3e17e74c-694a-58d6-8678-8d7981764c94"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dimnie"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dimnie_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "4f084852c71be42252e84f78f5c5fbeea9af651580f68857653ee5cb5f11e6f5"
+		logic_hash = "v1_sha256_4f084852c71be42252e84f78f5c5fbeea9af651580f68857653ee5cb5f11e6f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191152,20 +191222,20 @@ rule MALPEDIA_Win_Dimnie_Auto : FILE
 		$sequence_9 = { 83c101 8b45f4 33d2 f7f1 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Lazarus_Killdisk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0195fc4c-73fa-5c09-bf2a-89a4d303bb67"
+		id = "1d91085a-eb55-5670-b964-9a774d1d9ef1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazarus_killdisk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lazarus_killdisk_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "b26134f5ee9a86ea9f8f0c2251fd193e47e701ab49921be548b684d8807f003c"
+		logic_hash = "v1_sha256_b26134f5ee9a86ea9f8f0c2251fd193e47e701ab49921be548b684d8807f003c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191191,20 +191261,20 @@ rule MALPEDIA_Win_Lazarus_Killdisk_Auto : FILE
 		$sequence_9 = { 8945fc 53 56 57 6824010000 8d85c4feffff 6a00 }
 
 	condition:
-		7 of them and filesize <209920
+		7 of them and filesize < 209920
 }
 rule MALPEDIA_Win_Ramdo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "08b789f2-d7a2-5fbb-860d-c8f55dcc2345"
+		id = "350be0b1-7135-53d5-9161-94bd4868e3ff"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramdo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ramdo_auto.yar#L1-L107"
 		license_url = "N/A"
-		logic_hash = "276f369c53a1fdcd50e18eb96f6dc8769ce2d1ebf68a37e2dea30ad2afbcd8fa"
+		logic_hash = "v1_sha256_276f369c53a1fdcd50e18eb96f6dc8769ce2d1ebf68a37e2dea30ad2afbcd8fa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191230,20 +191300,20 @@ rule MALPEDIA_Win_Ramdo_Auto : FILE
 		$sequence_9 = { 689aa93f35 6a05 6a00 e8???????? }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize < 548864
 }
 rule MALPEDIA_Win_Cargobay_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "19cc2286-1645-5f7d-a2c4-3ef65d16d1bb"
+		id = "7050b450-c3b1-5bc2-b05a-b2a060e0fbe6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cargobay"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cargobay_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "2ae360967276d2625b03685b127c94c75664c2e3f32ade543c32daba4148b1b4"
+		logic_hash = "v1_sha256_2ae360967276d2625b03685b127c94c75664c2e3f32ade543c32daba4148b1b4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191269,20 +191339,20 @@ rule MALPEDIA_Win_Cargobay_Auto : FILE
 		$sequence_9 = { eb0c 488d542440 48c70205000000 4889f9 e8???????? e9???????? 4c8d05fb400e00 }
 
 	condition:
-		7 of them and filesize <3432448
+		7 of them and filesize < 3432448
 }
 rule MALPEDIA_Win_Multigrain_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "72a7f3f7-5585-5b52-9f6b-6aafeee8dfc7"
+		id = "833f7bb8-3aee-533d-9ef7-9fcfcfd23bfa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.multigrain_pos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.multigrain_pos_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "20f055bfbc8013c86389227ab88ba0d8272e12b77bffca2ef889258bc8b1eb3c"
+		logic_hash = "v1_sha256_20f055bfbc8013c86389227ab88ba0d8272e12b77bffca2ef889258bc8b1eb3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191308,20 +191378,20 @@ rule MALPEDIA_Win_Multigrain_Pos_Auto : FILE
 		$sequence_9 = { c7461000000000 c7461400000000 e8???????? 894610 6800040000 8d4618 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize < 286720
 }
 rule MALPEDIA_Win_Holerun_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8b68b52e-fb5a-5ecc-88ef-a3ed80a6122b"
+		id = "8a3b5f8e-ce58-51a8-a518-5a71f8e1a1ea"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.holerun"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.holerun_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "f543cc584969255e8ee0247544f45390194f0e1121bcb76269aa2fe3a672745b"
+		logic_hash = "v1_sha256_f543cc584969255e8ee0247544f45390194f0e1121bcb76269aa2fe3a672745b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191347,20 +191417,20 @@ rule MALPEDIA_Win_Holerun_Auto : FILE
 		$sequence_9 = { 488d15c1400000 4889c1 e8???????? e9???????? }
 
 	condition:
-		7 of them and filesize <156672
+		7 of them and filesize < 156672
 }
 rule MALPEDIA_Win_Spica_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b6a1a6a9-846d-5070-af66-e8c23c4a6b50"
+		id = "9a2d03aa-18a8-5e10-9f9c-000d5edd49b8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spica"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spica_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a88bf3ca9882c583346cf58a04e5a1e9985797df2dfd737cf0e029b406925de0"
+		logic_hash = "v1_sha256_a88bf3ca9882c583346cf58a04e5a1e9985797df2dfd737cf0e029b406925de0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191386,20 +191456,20 @@ rule MALPEDIA_Win_Spica_Auto : FILE
 		$sequence_9 = { e9???????? 4983c303 eb3e b80e000000 e9???????? 4983c304 eb2e }
 
 	condition:
-		7 of them and filesize <14034944
+		7 of them and filesize < 14034944
 }
 rule MALPEDIA_Win_Graphsteel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee773efd-abc9-59ea-a8a9-5d1bcd00ab52"
+		id = "60c19612-026c-5461-ab9a-7b2ebb6548ee"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.graphsteel_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c16b3aee4470d6b80d6571382358ae60606e1bc85c16a98c39f469be44f26ba8"
+		logic_hash = "v1_sha256_c16b3aee4470d6b80d6571382358ae60606e1bc85c16a98c39f469be44f26ba8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191425,20 +191495,20 @@ rule MALPEDIA_Win_Graphsteel_Auto : FILE
 		$sequence_9 = { bf01000000 4889d6 e8???????? 488b4c2470 488b742450 488b542448 eb39 }
 
 	condition:
-		7 of them and filesize <19812352
+		7 of them and filesize < 19812352
 }
 rule MALPEDIA_Win_Lowkey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0a67007e-1a9c-5f31-b37c-8c32fdff3311"
+		id = "b299f53c-ce54-50f9-b5c9-316170407b6e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowkey"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lowkey_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "9d3c45875e4ddd32bb18b8cb6ded5fb4838ad62f27365a87e2390b683b239917"
+		logic_hash = "v1_sha256_9d3c45875e4ddd32bb18b8cb6ded5fb4838ad62f27365a87e2390b683b239917"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191464,20 +191534,20 @@ rule MALPEDIA_Win_Lowkey_Auto : FILE
 		$sequence_9 = { 4c8d0dd8d70300 418d4002 83f801 7617 498bd0 498bc0 83e23f }
 
 	condition:
-		7 of them and filesize <643072
+		7 of them and filesize < 643072
 }
 rule MALPEDIA_Win_Sdbbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b16da93b-bcb6-5a59-8ee7-f2b1db92f76a"
+		id = "a84dfd1b-12bf-54c9-837e-8b1515aa9215"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sdbbot_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "869a5323254bb19be34889ba3dd9fff300dc452318f40f9c34e9c0c7014796e1"
+		logic_hash = "v1_sha256_869a5323254bb19be34889ba3dd9fff300dc452318f40f9c34e9c0c7014796e1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191510,20 +191580,20 @@ rule MALPEDIA_Win_Sdbbot_Auto : FILE
 		$sequence_16 = { 4885d2 7417 4d8bc6 4d2bc5 0fb601 41880408 488d4901 }
 
 	condition:
-		7 of them and filesize <1015808
+		7 of them and filesize < 1015808
 }
 rule MALPEDIA_Win_Dropshot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8c0e25df-1d9c-5bb9-85ce-2d5bc4ccd180"
+		id = "c619a101-106e-5ba8-adb3-434f45e1cfa9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dropshot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dropshot_auto.yar#L1-L100"
 		license_url = "N/A"
-		logic_hash = "3f5f25fe800a01f710cc89be583f98653a26f14448d6ba599306a1d4d7c2a368"
+		logic_hash = "v1_sha256_3f5f25fe800a01f710cc89be583f98653a26f14448d6ba599306a1d4d7c2a368"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191547,20 +191617,20 @@ rule MALPEDIA_Win_Dropshot_Auto : FILE
 		$sequence_7 = { 6a00 6a00 ff15???????? 6a00 6a00 68???????? }
 
 	condition:
-		7 of them and filesize <483328
+		7 of them and filesize < 483328
 }
 rule MALPEDIA_Win_Nokoyawa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "41b1b168-b0ea-5f04-84cd-fd90bfa48e03"
+		id = "0f5ed07e-5567-5e84-8e0a-cee92de10772"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nokoyawa"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nokoyawa_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "a5e2c231f7d7eec8e19a418805bfeaea862c56b36ec030240db4e6a8dee84747"
+		logic_hash = "v1_sha256_a5e2c231f7d7eec8e19a418805bfeaea862c56b36ec030240db4e6a8dee84747"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191586,20 +191656,20 @@ rule MALPEDIA_Win_Nokoyawa_Auto : FILE
 		$sequence_9 = { e9???????? 0fb6442421 85c0 7419 8b442424 33c9 488b542438 }
 
 	condition:
-		7 of them and filesize <92160
+		7 of them and filesize < 92160
 }
 rule MALPEDIA_Win_Daxin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eb9db3c6-59a2-55fc-ab29-402a0b79069e"
+		id = "679eacb4-6ea6-5534-858f-917428dc8070"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daxin"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.daxin_auto.yar#L1-L145"
 		license_url = "N/A"
-		logic_hash = "9f52c4014d6014a5dd41f71fe4bb65b03575c870c6d23007d187323e250b54a3"
+		logic_hash = "v1_sha256_9f52c4014d6014a5dd41f71fe4bb65b03575c870c6d23007d187323e250b54a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191630,20 +191700,20 @@ rule MALPEDIA_Win_Daxin_Auto : FILE
 		$sequence_14 = { 88502a 8bda 8b4ca814 2bca }
 
 	condition:
-		7 of them and filesize <3475456
+		7 of them and filesize < 3475456
 }
 rule MALPEDIA_Win_Webmonitor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a4fb11db-5000-556c-8a5e-92fa710a7bf2"
+		id = "fb0fd59f-8092-5654-b6a2-5a92c90b25b3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webmonitor_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "dae97ec3da1552d8829942df4314bf12da735041179d90d1884bc5549bf4d3f9"
+		logic_hash = "v1_sha256_dae97ec3da1552d8829942df4314bf12da735041179d90d1884bc5549bf4d3f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191675,20 +191745,20 @@ rule MALPEDIA_Win_Webmonitor_Auto : FILE
 		$sequence_15 = { 00856948008b ff558b ec 83ec0c }
 
 	condition:
-		7 of them and filesize <1867776
+		7 of them and filesize < 1867776
 }
 rule MALPEDIA_Win_Nestegg_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "315a7796-8683-5d7a-8cf2-784c6dd94f9d"
+		id = "2532dd69-9d75-5e00-8baf-4b0303a1147e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nestegg"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nestegg_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "4273a1509259a06eece460649eb821123ed1b442866d55968fb9b1f2cfa0fb16"
+		logic_hash = "v1_sha256_4273a1509259a06eece460649eb821123ed1b442866d55968fb9b1f2cfa0fb16"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191714,20 +191784,20 @@ rule MALPEDIA_Win_Nestegg_Auto : FILE
 		$sequence_9 = { 64a100000000 6aff 68???????? 50 b820410000 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize < 221184
 }
 rule MALPEDIA_Win_Avaddon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a92a672c-0df0-579b-b5cc-abf6eb5f22bf"
+		id = "c32e0dc9-9987-5e9f-8857-b88ea72307f4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avaddon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.avaddon_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "9da4ad197260f3ad47fcf04fe9c86aafe2cfaae8d70042fb37f0ac71730ef837"
+		logic_hash = "v1_sha256_9da4ad197260f3ad47fcf04fe9c86aafe2cfaae8d70042fb37f0ac71730ef837"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191753,20 +191823,20 @@ rule MALPEDIA_Win_Avaddon_Auto : FILE
 		$sequence_9 = { ff10 8b45e4 83f808 7213 8d044502000000 50 ff75d0 }
 
 	condition:
-		7 of them and filesize <2343936
+		7 of them and filesize < 2343936
 }
 rule MALPEDIA_Win_Dustpan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c9c878b8-cad8-5a19-8f4e-78ad38029b7f"
+		id = "48cfb882-ca3a-5de9-910d-09200a86a5a4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dustpan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dustpan_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "5224f428476ca9b9e044abefc44ce9a53e06974708bc3448eb44f67994867ab4"
+		logic_hash = "v1_sha256_5224f428476ca9b9e044abefc44ce9a53e06974708bc3448eb44f67994867ab4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191792,20 +191862,20 @@ rule MALPEDIA_Win_Dustpan_Auto : FILE
 		$sequence_9 = { 894704 e9???????? 488d0d351f0100 48394c2458 7427 }
 
 	condition:
-		7 of them and filesize <282624
+		7 of them and filesize < 282624
 }
 rule MALPEDIA_Win_Rgdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c131d66d-fa54-5330-a7a6-924c788ac07b"
+		id = "d7f80515-2149-5bf9-bdd3-4eea3eab0abf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rgdoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rgdoor_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "e436d1f0b319cc823655f3b279c99c1561f88f885f295d5e38aafb91490652b3"
+		logic_hash = "v1_sha256_e436d1f0b319cc823655f3b279c99c1561f88f885f295d5e38aafb91490652b3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191831,20 +191901,20 @@ rule MALPEDIA_Win_Rgdoor_Auto : FILE
 		$sequence_9 = { 41b803010000 488bd6 e8???????? 4889842490000000 4885c0 0f8435010000 381e }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize < 475136
 }
 rule MALPEDIA_Win_Deadwood_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e299ec52-8e21-507f-ba5a-e3a893abbf1e"
+		id = "0622c606-e868-5f12-88fb-edde18a219fe"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deadwood"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.deadwood_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "27f6d744e976a1cbd8fe2392486788cf865733377db2356449d61f5e2be3b703"
+		logic_hash = "v1_sha256_27f6d744e976a1cbd8fe2392486788cf865733377db2356449d61f5e2be3b703"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191870,20 +191940,20 @@ rule MALPEDIA_Win_Deadwood_Auto : FILE
 		$sequence_9 = { c7411407000000 c7411000000000 89a5d8feffff 668911 8d7802 668b10 83c002 }
 
 	condition:
-		7 of them and filesize <1055744
+		7 of them and filesize < 1055744
 }
 rule MALPEDIA_Win_Unidentified_100_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e8675cb6-73bb-59b5-91a8-02c6f92da222"
+		id = "f1b58dde-d3dd-5965-bab2-9a1c9f240633"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_100"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_100_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "a4a5162870b4493fc5243e7bd2eeeb85f162da808d7efca293e2e60ad15e324b"
+		logic_hash = "v1_sha256_a4a5162870b4493fc5243e7bd2eeeb85f162da808d7efca293e2e60ad15e324b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191909,20 +191979,20 @@ rule MALPEDIA_Win_Unidentified_100_Auto : FILE
 		$sequence_9 = { e8???????? 488b8c2430010000 e8???????? 89442448 4883bc243001000000 740d }
 
 	condition:
-		7 of them and filesize <372736
+		7 of them and filesize < 372736
 }
 rule MALPEDIA_Win_Rambo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f18152a-df9c-5933-beb1-7d48427107b5"
+		id = "ba07a542-67a7-54de-97be-08b7bb19aaf4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rambo"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rambo_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "43a3f5e58cc73b887b9d9425ae48fd61511eb3413bc03e0babb322fa4b593a9b"
+		logic_hash = "v1_sha256_43a3f5e58cc73b887b9d9425ae48fd61511eb3413bc03e0babb322fa4b593a9b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -191954,20 +192024,20 @@ rule MALPEDIA_Win_Rambo_Auto : FILE
 		$sequence_15 = { aa ff15???????? 8b4c2408 8d54240c 50 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Aresloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "72768534-8c41-5891-8d86-5b5baf0231f5"
+		id = "b2c2bdc4-b8b1-55a5-abfb-db0cdbcbb9fd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aresloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.aresloader_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "01346a5099a8423ed0407177afbd014d15a423ebfced07e8fa01ead0f1c12c68"
+		logic_hash = "v1_sha256_01346a5099a8423ed0407177afbd014d15a423ebfced07e8fa01ead0f1c12c68"
 		score = 60
 		quality = 25
 		tags = "FILE"
@@ -191993,20 +192063,20 @@ rule MALPEDIA_Win_Aresloader_Auto : FILE
 		$sequence_9 = { 741d 896c243c 897c2438 89742434 895c2430 }
 
 	condition:
-		7 of them and filesize <2657280
+		7 of them and filesize < 2657280
 }
 rule MALPEDIA_Win_Misha_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ae44f4ed-6b62-5739-afcc-3910b944ad53"
+		id = "64fc551e-db0c-5d76-962f-29c538e5d20e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.misha"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.misha_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "6808e3992c1a57c6f785e40da9dc7940883a56816b3304928fa690c0fc154801"
+		logic_hash = "v1_sha256_6808e3992c1a57c6f785e40da9dc7940883a56816b3304928fa690c0fc154801"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192032,20 +192102,20 @@ rule MALPEDIA_Win_Misha_Auto : FILE
 		$sequence_9 = { ff75dc 6a08 59 e8???????? 83c420 0fb6c0 85c0 }
 
 	condition:
-		7 of them and filesize <710656
+		7 of them and filesize < 710656
 }
 rule MALPEDIA_Win_Spyeye_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d7c62579-def8-5f0a-826a-88762a729bf5"
+		id = "a70de952-df8d-567a-be57-97667c33dc33"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyeye"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.spyeye_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "f4149a2d0558cdca789e55a3da096c9eb02a06e0cbb6c5f6412ffac38db590ec"
+		logic_hash = "v1_sha256_f4149a2d0558cdca789e55a3da096c9eb02a06e0cbb6c5f6412ffac38db590ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192071,20 +192141,20 @@ rule MALPEDIA_Win_Spyeye_Auto : FILE
 		$sequence_9 = { 55 8bec 51 68b787554d }
 
 	condition:
-		7 of them and filesize <741376
+		7 of them and filesize < 741376
 }
 rule MALPEDIA_Win_Avrecon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e9aaaaa7-af2e-5870-9eba-7f7fa77b0103"
+		id = "7ed48c56-9d0f-589d-9c98-4d7fe2970c7b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avrecon"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.avrecon_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "e59963ec079d8f4d8ec354feb72326171934afc46817d03eebe4cd3c6c4dfb16"
+		logic_hash = "v1_sha256_e59963ec079d8f4d8ec354feb72326171934afc46817d03eebe4cd3c6c4dfb16"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192110,20 +192180,20 @@ rule MALPEDIA_Win_Avrecon_Auto : FILE
 		$sequence_9 = { 50 6a01 50 50 ff31 8975c0 50 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize < 360448
 }
 rule MALPEDIA_Win_Cloud_Duke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "faff812c-4777-587b-9604-c74c7f7c8370"
+		id = "f467934a-b671-5728-aa67-b6b5efabf525"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloud_duke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cloud_duke_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "c237687bdb3916be1afbb15c7aa4edc82ffc9e06f6334b5efe36ab376ab13130"
+		logic_hash = "v1_sha256_c237687bdb3916be1afbb15c7aa4edc82ffc9e06f6334b5efe36ab376ab13130"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192149,20 +192219,20 @@ rule MALPEDIA_Win_Cloud_Duke_Auto : FILE
 		$sequence_9 = { c7868c00000000000000 7711 c786f800000003000000 32c0 e9???????? 33c9 c78424d000000007000000 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize < 368640
 }
 rule MALPEDIA_Win_Webc2_Head_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b0489fed-bd6b-5cdc-bfab-bd5427505aa6"
+		id = "5ec9eeb9-be89-53e7-b6cd-22e4564e3395"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_head"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.webc2_head_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "0f0d261fc67cb4837b13f2fc98dacb6b1c0e0f0d77dda88fbe5b4ef793a0acb0"
+		logic_hash = "v1_sha256_0f0d261fc67cb4837b13f2fc98dacb6b1c0e0f0d77dda88fbe5b4ef793a0acb0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192188,20 +192258,20 @@ rule MALPEDIA_Win_Webc2_Head_Auto : FILE
 		$sequence_9 = { 6a1f 55 ff15???????? 8b3d???????? 6a04 81cf00330000 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Nightclub_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16a1e3cd-d9e1-5de2-a066-97eb2bedde4e"
+		id = "932bfac9-c563-5c53-b3e5-4e30b7421aa9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightclub"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nightclub_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c6e72bd1072251138d02bae0378aff5596a4fe234144ae53f2fd722485213a6d"
+		logic_hash = "v1_sha256_c6e72bd1072251138d02bae0378aff5596a4fe234144ae53f2fd722485213a6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192227,20 +192297,20 @@ rule MALPEDIA_Win_Nightclub_Auto : FILE
 		$sequence_9 = { 72e6 b892010000 5f 5e 8b4df8 33cd e8???????? }
 
 	condition:
-		7 of them and filesize <247808
+		7 of them and filesize < 247808
 }
 rule MALPEDIA_Win_Aurora_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "db71bfec-d16f-5b65-a2de-3646c8fc9579"
+		id = "acb096ff-95a2-5a57-b090-bbad12577dfc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.aurora_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "59e6b8275e1925f874147250deaf1189e73e34e27743f50bcfcc60f5d60b4760"
+		logic_hash = "v1_sha256_59e6b8275e1925f874147250deaf1189e73e34e27743f50bcfcc60f5d60b4760"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192266,20 +192336,20 @@ rule MALPEDIA_Win_Aurora_Auto : FILE
 		$sequence_9 = { 8b06 8b4804 8b44310c 85c0 0f9445f0 c745fc01000000 a806 }
 
 	condition:
-		7 of them and filesize <827392
+		7 of them and filesize < 827392
 }
 rule MALPEDIA_Win_Ufrstealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "363b32bd-9a61-5367-b5d5-54daf961a4ad"
+		id = "07346c4f-8b2f-5d63-8a1f-d4de982d8290"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ufrstealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ufrstealer_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "df31fc542afebf5a6b78b056f78a762c74ccc9e30af24ef9561e9985cdd6d298"
+		logic_hash = "v1_sha256_df31fc542afebf5a6b78b056f78a762c74ccc9e30af24ef9561e9985cdd6d298"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192305,20 +192375,20 @@ rule MALPEDIA_Win_Ufrstealer_Auto : FILE
 		$sequence_9 = { 33c0 c9 c20400 55 8bec 68???????? ff15???????? }
 
 	condition:
-		7 of them and filesize <770048
+		7 of them and filesize < 770048
 }
 rule MALPEDIA_Win_Trochilus_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff7e3b17-5233-56c0-8cf9-b500183b9183"
+		id = "0074a25c-93a1-51b3-bacb-85136e093a81"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trochilus_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.trochilus_rat_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "28ef93658f73bc964eedcf05592130cfb5b477accac6e59366138836c637cdc2"
+		logic_hash = "v1_sha256_28ef93658f73bc964eedcf05592130cfb5b477accac6e59366138836c637cdc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192344,20 +192414,20 @@ rule MALPEDIA_Win_Trochilus_Rat_Auto : FILE
 		$sequence_9 = { 8d8534ffffff 50 8d8d7cffffff e8???????? 397df0 764d 837df408 }
 
 	condition:
-		7 of them and filesize <630784
+		7 of them and filesize < 630784
 }
 rule MALPEDIA_Win_Marap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2cc3d8fa-aa39-5bef-af3b-a091606785c2"
+		id = "7a9b6dcb-632a-52f9-972a-641b2eb89319"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.marap"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.marap_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "981ff96ccf9321bc9cf0b93466d635ede7fbc6c0341e04e670ea58028783ac37"
+		logic_hash = "v1_sha256_981ff96ccf9321bc9cf0b93466d635ede7fbc6c0341e04e670ea58028783ac37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192383,20 +192453,20 @@ rule MALPEDIA_Win_Marap_Auto : FILE
 		$sequence_9 = { 80f901 0f8487000000 6683fa06 7519 84c0 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize < 188416
 }
 rule MALPEDIA_Win_Pykspa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f69b7ae8-9844-5edd-af39-3a24a60736b3"
+		id = "4b5c6105-1ff1-559d-b2c7-e67fe14fe881"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pykspa"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pykspa_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "debf44a0a6bbb12f51a3423f6d02332e02447168503a68de6d1e19702f8f8b56"
+		logic_hash = "v1_sha256_debf44a0a6bbb12f51a3423f6d02332e02447168503a68de6d1e19702f8f8b56"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192422,20 +192492,20 @@ rule MALPEDIA_Win_Pykspa_Auto : FILE
 		$sequence_9 = { 59 8d7dbd 8845bc f3ab 7777 83fe05 7272 }
 
 	condition:
-		7 of them and filesize <835584
+		7 of them and filesize < 835584
 }
 rule MALPEDIA_Win_Miniasp_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f347c9b8-8bc2-5051-8759-9c4a71c6ee76"
+		id = "84e742d7-c2f5-5f76-af4f-8224d9b80f18"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniasp"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.miniasp_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "dc054826603e4c65732efe9c4e870d0e5d57b1e034ff76fb6ca9b268c587f33f"
+		logic_hash = "v1_sha256_dc054826603e4c65732efe9c4e870d0e5d57b1e034ff76fb6ca9b268c587f33f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192461,20 +192531,20 @@ rule MALPEDIA_Win_Miniasp_Auto : FILE
 		$sequence_9 = { 6804010000 e8???????? 59 8945d4 8b45d4 8945ec }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize < 139264
 }
 rule MALPEDIA_Win_Knot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ea865775-0235-55b7-9748-11331945e645"
+		id = "ddbed42c-26c0-5d13-9821-5f16a52c2451"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.knot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.knot_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "735c3c37008eab248d62841c5d72cf7bb3dbc84598bc674db47efd96b8fa6a3a"
+		logic_hash = "v1_sha256_735c3c37008eab248d62841c5d72cf7bb3dbc84598bc674db47efd96b8fa6a3a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192500,20 +192570,20 @@ rule MALPEDIA_Win_Knot_Auto : FILE
 		$sequence_9 = { 6880000000 6a02 6a00 6a00 6800000040 8d95e0fdffff 52 }
 
 	condition:
-		7 of them and filesize <59392
+		7 of them and filesize < 59392
 }
 rule MALPEDIA_Win_Smac_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6cf7aa8f-47b5-541a-9ef7-59898eb272ee"
+		id = "6d2b8262-c75b-5abe-aa11-997765830c6d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smac"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.smac_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "2551ca62dde47575d33bf5dda5cc9135e813c4132339b49d1f3c1a2ad36da540"
+		logic_hash = "v1_sha256_2551ca62dde47575d33bf5dda5cc9135e813c4132339b49d1f3c1a2ad36da540"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192539,20 +192609,20 @@ rule MALPEDIA_Win_Smac_Auto : FILE
 		$sequence_9 = { 8be5 5d c3 55 8bec 83e4f8 81eccc060000 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Kleptoparasite_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2de3c422-45bc-58ea-9b58-c5be8e18f59a"
+		id = "a6abe095-c859-5f67-b070-2805c09a7dcf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kleptoparasite_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kleptoparasite_stealer_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "7be717d94b9f90fe9083718b4b3c9a144ee692fe8b9cfc6de9546fc76b8ff287"
+		logic_hash = "v1_sha256_7be717d94b9f90fe9083718b4b3c9a144ee692fe8b9cfc6de9546fc76b8ff287"
 		score = 60
 		quality = 35
 		tags = "FILE"
@@ -192578,20 +192648,20 @@ rule MALPEDIA_Win_Kleptoparasite_Stealer_Auto : FILE
 		$sequence_9 = { 8901 895104 8be5 5d c3 3b0d???????? }
 
 	condition:
-		7 of them and filesize <3006464
+		7 of them and filesize < 3006464
 }
 rule MALPEDIA_Win_Breach_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a5b42a75-e77a-5ca6-b3c1-cb4ca403dd4b"
+		id = "bdd0d8f1-5066-5f4f-9875-ee1aa82c8d72"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.breach_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.breach_rat_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "6d11bf02b16d797b6e97c762d9594bbc3acc80831e5eb5fa56307a891b9803ec"
+		logic_hash = "v1_sha256_6d11bf02b16d797b6e97c762d9594bbc3acc80831e5eb5fa56307a891b9803ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192617,20 +192687,20 @@ rule MALPEDIA_Win_Breach_Rat_Auto : FILE
 		$sequence_9 = { 7408 83c002 49 75f5 33c0 85c0 7453 }
 
 	condition:
-		7 of them and filesize <645120
+		7 of them and filesize < 645120
 }
 rule MALPEDIA_Win_Tiop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a354c9f-7033-5930-8cdf-ccc9b036cb6a"
+		id = "49f3cfc8-5cc4-53b6-ac79-e6c1fc207c2a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiop"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tiop_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "8dde382911bda80f4443cb56d55614794d75f26151cbf4838080e27ec3645e3d"
+		logic_hash = "v1_sha256_8dde382911bda80f4443cb56d55614794d75f26151cbf4838080e27ec3645e3d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192656,20 +192726,20 @@ rule MALPEDIA_Win_Tiop_Auto : FILE
 		$sequence_9 = { 85c0 7502 5e c3 b9???????? e8???????? }
 
 	condition:
-		7 of them and filesize <712704
+		7 of them and filesize < 712704
 }
 rule MALPEDIA_Win_Keymarble_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d1987e31-8cfb-500b-b69a-7c2a019e7ea8"
+		id = "74935cb3-9c50-5522-a924-d24caea6a970"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keymarble"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.keymarble_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "04e65eb3ae3b01821122573e8815ad5d48f3cdd5d412f7107b80ce95c7695b7b"
+		logic_hash = "v1_sha256_04e65eb3ae3b01821122573e8815ad5d48f3cdd5d412f7107b80ce95c7695b7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192695,20 +192765,20 @@ rule MALPEDIA_Win_Keymarble_Auto : FILE
 		$sequence_9 = { 56 e8???????? 68???????? ff15???????? 8bf0 85f6 }
 
 	condition:
-		7 of them and filesize <1146880
+		7 of them and filesize < 1146880
 }
 rule MALPEDIA_Win_Campoloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00b62c88-0d38-56b9-90a5-7c85290ffbe9"
+		id = "766921c9-1a8f-5f51-a371-3713a1d58bf4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.campoloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.campoloader_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "dae472a7090c99e8a9ce136356f9bc867c42c508ecb59c9f6aa0187832a15e3c"
+		logic_hash = "v1_sha256_dae472a7090c99e8a9ce136356f9bc867c42c508ecb59c9f6aa0187832a15e3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192734,20 +192804,20 @@ rule MALPEDIA_Win_Campoloader_Auto : FILE
 		$sequence_9 = { 8b8d70efffff 51 8b9584efffff 52 ff15???????? }
 
 	condition:
-		7 of them and filesize <66560
+		7 of them and filesize < 66560
 }
 rule MALPEDIA_Win_Privateloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d996c731-cbb3-50a4-93a5-b71789f95831"
+		id = "970e34e9-6dad-550f-8cf9-d47fe313a7f3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.privateloader_auto.yar#L1-L184"
 		license_url = "N/A"
-		logic_hash = "b3bd260ff9676412911b82f7ca10842c721430b21d232272a50e615d0d279a78"
+		logic_hash = "v1_sha256_b3bd260ff9676412911b82f7ca10842c721430b21d232272a50e615d0d279a78"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192782,20 +192852,20 @@ rule MALPEDIA_Win_Privateloader_Auto : FILE
 		$sequence_18 = { 8bf0 e8???????? 8bc8 8bfa 8bc6 }
 
 	condition:
-		7 of them and filesize <3670016
+		7 of them and filesize < 3670016
 }
 rule MALPEDIA_Win_Matanbuchus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a3fb7262-831d-5cfb-8abc-cea45bc828f6"
+		id = "90d62426-5cef-5bbd-bc1a-d6a2d3e94cc7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matanbuchus"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.matanbuchus_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "4f8fe54f712fa0006512f2c2876f2933c4c245339d29133362ca02de9b0dcb22"
+		logic_hash = "v1_sha256_4f8fe54f712fa0006512f2c2876f2933c4c245339d29133362ca02de9b0dcb22"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192821,20 +192891,20 @@ rule MALPEDIA_Win_Matanbuchus_Auto : FILE
 		$sequence_9 = { 894dec 8b55ec 813a50450000 7407 }
 
 	condition:
-		7 of them and filesize <13077504
+		7 of them and filesize < 13077504
 }
 rule MALPEDIA_Win_Sathurbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "55b56bcd-97b3-557a-80fc-a30a2a5d5f93"
+		id = "088fac37-512c-5069-909b-079d79386f7a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sathurbot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sathurbot_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "516fbdaf796971a35966077b409dae2049cf7a15611af7b3fda85f6cf94f88db"
+		logic_hash = "v1_sha256_516fbdaf796971a35966077b409dae2049cf7a15611af7b3fda85f6cf94f88db"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192860,20 +192930,20 @@ rule MALPEDIA_Win_Sathurbot_Auto : FILE
 		$sequence_9 = { e9???????? 81fe4cc3b5b8 89f3 0f852cfeffff 8b5c240c e9???????? 81fe45dc43a2 }
 
 	condition:
-		7 of them and filesize <2727936
+		7 of them and filesize < 2727936
 }
 rule MALPEDIA_Win_Sasfis_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c173d20c-b6af-5642-9dac-436a162fb4a4"
+		id = "838b26ab-e9de-51a4-a8a0-1bf2baf7e7cf"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sasfis"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sasfis_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "7c5f9810c1f84570570dc00d72da471119d3938e3544c5969df4af5e973862b8"
+		logic_hash = "v1_sha256_7c5f9810c1f84570570dc00d72da471119d3938e3544c5969df4af5e973862b8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192899,20 +192969,20 @@ rule MALPEDIA_Win_Sasfis_Auto : FILE
 		$sequence_9 = { 3d0d351d11 0531250968 b3af 7c00 e8???????? }
 
 	condition:
-		7 of them and filesize <8060928
+		7 of them and filesize < 8060928
 }
 rule MALPEDIA_Win_Mulcom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4a9d49d8-b0ca-5241-8b60-6dc35ab732b6"
+		id = "bbda05bb-b2ed-563a-9c4c-9a592fbd20d1"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mulcom"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mulcom_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "372ee2b3e45726bdecfcc73339ca35421a12f3ab3e84538dcc5c7a553f146e2b"
+		logic_hash = "v1_sha256_372ee2b3e45726bdecfcc73339ca35421a12f3ab3e84538dcc5c7a553f146e2b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192938,20 +193008,20 @@ rule MALPEDIA_Win_Mulcom_Auto : FILE
 		$sequence_9 = { 49baa1a0a0a0a0a0a0a0 4c8bf1 498bc2 488b4908 498be8 49f7e9 }
 
 	condition:
-		7 of them and filesize <867328
+		7 of them and filesize < 867328
 }
 rule MALPEDIA_Win_Unidentified_080_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2fada674-370f-5bc5-84a9-2e5ff9925df1"
+		id = "0bcb1aa4-d619-5d60-86bf-fcc823647d95"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_080"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_080_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "f4698b30ea4cfaea5b3dd4c3d2fb3772007307dc7944cfe2e7ccc981a278d898"
+		logic_hash = "v1_sha256_f4698b30ea4cfaea5b3dd4c3d2fb3772007307dc7944cfe2e7ccc981a278d898"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -192977,20 +193047,20 @@ rule MALPEDIA_Win_Unidentified_080_Auto : FILE
 		$sequence_9 = { 85c0 7456 8dbda4fdffff e8???????? 8bc7 50 b8???????? }
 
 	condition:
-		7 of them and filesize <392192
+		7 of them and filesize < 392192
 }
 rule MALPEDIA_Win_Targetcompany_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f1b7a89e-2688-52a1-8c7d-13cb0d455b2e"
+		id = "f900c3aa-f605-5fb3-886e-92af379541d9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.targetcompany"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.targetcompany_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "7d65ff06dda40a31d2e8e57267ae5018fe6d616cb14d7c02506f36589aa887d7"
+		logic_hash = "v1_sha256_7d65ff06dda40a31d2e8e57267ae5018fe6d616cb14d7c02506f36589aa887d7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193016,20 +193086,20 @@ rule MALPEDIA_Win_Targetcompany_Auto : FILE
 		$sequence_9 = { 25ffff7f00 c1e108 33d2 0bc8 0bda 8bc1 8b4df8 }
 
 	condition:
-		7 of them and filesize <328704
+		7 of them and filesize < 328704
 }
 rule MALPEDIA_Win_Wannahusky_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b2ad3b67-4e34-5409-83f1-3168450902fa"
+		id = "487ddf94-8c40-56a6-9ec8-4ae95eaa2662"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wannahusky"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wannahusky_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "77e82dda4e107ad0b0d473cd2e43d110eacdad7445bdb06e12858f482aa9bc9d"
+		logic_hash = "v1_sha256_77e82dda4e107ad0b0d473cd2e43d110eacdad7445bdb06e12858f482aa9bc9d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193055,20 +193125,20 @@ rule MALPEDIA_Win_Wannahusky_Auto : FILE
 		$sequence_9 = { c705????????14000000 c705????????00484200 c705????????b41d4100 c705????????30b54100 c705????????00000000 c705????????04000000 }
 
 	condition:
-		7 of them and filesize <862208
+		7 of them and filesize < 862208
 }
 rule MALPEDIA_Win_Ransomhub_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16824eb2-4ba0-577a-a551-4908aad55778"
+		id = "936aa0e9-350a-51b8-9878-c75bbca523a6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomhub"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ransomhub_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f4a09a2e3b131a855ce4ab14c5a239317d5e0fe3c9ee416c213d5fc3f65e7c00"
+		logic_hash = "v1_sha256_f4a09a2e3b131a855ce4ab14c5a239317d5e0fe3c9ee416c213d5fc3f65e7c00"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193094,20 +193164,20 @@ rule MALPEDIA_Win_Ransomhub_Auto : FILE
 		$sequence_9 = { 4c0f4ce7 4d39e3 7dc4 4c8b7828 4d29fa 4c8b7818 4d0fafd7 }
 
 	condition:
-		7 of them and filesize <12821504
+		7 of them and filesize < 12821504
 }
 rule MALPEDIA_Win_Mechanical_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f58702e9-e83b-59f3-ba4d-4c871c835d79"
+		id = "56c24964-a77a-5e47-923f-b908ca4f1644"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mechanical"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mechanical_auto.yar#L1-L154"
 		license_url = "N/A"
-		logic_hash = "94b14ca845d1ee4d0c436cd1fe538aa0afa038eac7ee0713fa70a64141fc5c86"
+		logic_hash = "v1_sha256_94b14ca845d1ee4d0c436cd1fe538aa0afa038eac7ee0713fa70a64141fc5c86"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193139,20 +193209,20 @@ rule MALPEDIA_Win_Mechanical_Auto : FILE
 		$sequence_15 = { 033485c0e54200 c745e401000000 33db 395e08 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize < 434176
 }
 rule MALPEDIA_Win_Monero_Miner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9a367978-bd77-51cd-8e56-86e861b9daa1"
+		id = "0bdb3097-4cdf-5b78-9732-0f0157320b0e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.monero_miner"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.monero_miner_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "4ac9d0cde3be6117a7ffb436bafb97493b6772afb7402a8076aa8c3226e1ef83"
+		logic_hash = "v1_sha256_4ac9d0cde3be6117a7ffb436bafb97493b6772afb7402a8076aa8c3226e1ef83"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193178,20 +193248,20 @@ rule MALPEDIA_Win_Monero_Miner_Auto : FILE
 		$sequence_9 = { c1eb18 09d9 8b74240c 31ca 8b4c2414 c1e510 c1e618 }
 
 	condition:
-		7 of them and filesize <1425408
+		7 of them and filesize < 1425408
 }
 rule MALPEDIA_Win_Olympic_Destroyer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b177466d-4016-5e9b-b3ba-a9107347cf6f"
+		id = "da3dbe83-c0e4-5243-8f77-fe29700c53fa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.olympic_destroyer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.olympic_destroyer_auto.yar#L1-L234"
 		license_url = "N/A"
-		logic_hash = "fa50bc2589388652e3cccf0c3f51fa7fe6dd4219d5101d2a0cb0322727b90903"
+		logic_hash = "v1_sha256_fa50bc2589388652e3cccf0c3f51fa7fe6dd4219d5101d2a0cb0322727b90903"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -193230,20 +193300,20 @@ rule MALPEDIA_Win_Olympic_Destroyer_Auto : FILE
 		$sequence_22 = { 50 6a04 e8???????? 8b45fc 33d2 }
 
 	condition:
-		7 of them and filesize <1392640
+		7 of them and filesize < 1392640
 }
 rule MALPEDIA_Win_Troll_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b3bc43a0-20cb-5f37-a32c-9a34ea4e289e"
+		id = "028addb0-ebf7-503b-bf81-b674eeef1f8c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.troll_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.troll_stealer_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "1fcbf79446deea8c1ec8b5953d0db65f84994139955c1cee9bca8fc3f0d1ce3f"
+		logic_hash = "v1_sha256_1fcbf79446deea8c1ec8b5953d0db65f84994139955c1cee9bca8fc3f0d1ce3f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193269,20 +193339,20 @@ rule MALPEDIA_Win_Troll_Stealer_Auto : FILE
 		$sequence_9 = { 66410fbaf9e4 410fb3d9 488b6c25f8 41d2c9 4d1bc3 4889442500 4c8bcd }
 
 	condition:
-		7 of them and filesize <45868032
+		7 of them and filesize < 45868032
 }
 rule MALPEDIA_Win_Tinyturla_Ng_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0e7d5cbc-4d8e-5d08-97c6-9c50d3154da3"
+		id = "2522f5f8-20db-52fc-8efc-f43fa3577f07"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyturla_ng"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tinyturla_ng_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "c4bc20a25d7b1bca8938e309f5cad122284666710845f9d27ecb23d7dbbc9d43"
+		logic_hash = "v1_sha256_c4bc20a25d7b1bca8938e309f5cad122284666710845f9d27ecb23d7dbbc9d43"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193308,20 +193378,20 @@ rule MALPEDIA_Win_Tinyturla_Ng_Auto : FILE
 		$sequence_9 = { 7734 498bc8 e8???????? 4c8933 48c1e605 4903f6 }
 
 	condition:
-		7 of them and filesize <635904
+		7 of them and filesize < 635904
 }
 rule MALPEDIA_Win_Disttrack_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e31a7534-93aa-5c3a-8d1c-4db6a4e10208"
+		id = "de52ac14-abfd-57b1-8b03-a0b79eff25dc"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.disttrack_auto.yar#L1-L275"
 		license_url = "N/A"
-		logic_hash = "f3a6eab6984225695ff1eabbd0fc23dd3ab520ffce08e75f88d4a97c81e66461"
+		logic_hash = "v1_sha256_f3a6eab6984225695ff1eabbd0fc23dd3ab520ffce08e75f88d4a97c81e66461"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -193364,20 +193434,20 @@ rule MALPEDIA_Win_Disttrack_Auto : FILE
 		$sequence_26 = { c744243c702a4200 c784249c0000007c2a4200 8d542444 52 8d442430 89bc245c060000 }
 
 	condition:
-		7 of them and filesize <1112064
+		7 of them and filesize < 1112064
 }
 rule MALPEDIA_Win_Action_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c57309a-67d2-511f-b446-07a8dac55b8c"
+		id = "b22152e1-4866-5e90-8366-82b6eb9d3cfb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.action_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.action_rat_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "804b12281cf1f625ad4f62982be2e6f06ae13a4b27a9fb038471c045c4dd26b6"
+		logic_hash = "v1_sha256_804b12281cf1f625ad4f62982be2e6f06ae13a4b27a9fb038471c045c4dd26b6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193403,20 +193473,20 @@ rule MALPEDIA_Win_Action_Rat_Auto : FILE
 		$sequence_9 = { 8d8d4cffffff e8???????? 8d4dc0 e8???????? 50 8d4dc0 e8???????? }
 
 	condition:
-		7 of them and filesize <480256
+		7 of them and filesize < 480256
 }
 rule MALPEDIA_Win_Ondritols_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4bdd5e11-901a-5fdb-be76-3d7bad7b15da"
+		id = "b0709936-ec92-5aab-8a96-54ef22012f8a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ondritols"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ondritols_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "31bdba3ae2c3b90f1c45acd89ae6f07099ae537657a6493ddb8dcbc12190c75b"
+		logic_hash = "v1_sha256_31bdba3ae2c3b90f1c45acd89ae6f07099ae537657a6493ddb8dcbc12190c75b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193442,20 +193512,20 @@ rule MALPEDIA_Win_Ondritols_Auto : FILE
 		$sequence_9 = { 8d8d1fffffff 51 8b4d08 e8???????? 50 8b4de8 e8???????? }
 
 	condition:
-		7 of them and filesize <964608
+		7 of them and filesize < 964608
 }
 rule MALPEDIA_Win_Fakerean_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "34f4a458-02de-570d-b3a3-0e20f22e1220"
+		id = "a1c3a962-255d-560a-85fc-62a376b991e0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fakerean"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fakerean_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "ff26cea37ee30849e01ae5f84110a8c6d04e7d37a0c5e0d9f3ae27ca67cdd4d9"
+		logic_hash = "v1_sha256_ff26cea37ee30849e01ae5f84110a8c6d04e7d37a0c5e0d9f3ae27ca67cdd4d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193481,20 +193551,20 @@ rule MALPEDIA_Win_Fakerean_Auto : FILE
 		$sequence_9 = { ff33 ff15???????? 56 ff33 ff15???????? 897df8 8b45f0 }
 
 	condition:
-		7 of them and filesize <4071424
+		7 of them and filesize < 4071424
 }
 rule MALPEDIA_Win_Alma_Communicator_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d8b295a7-7b28-5e6b-b5af-98c76d267598"
+		id = "9b9c2682-3dce-523a-b302-a717dcac7f8d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_communicator"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.alma_communicator_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "904bfc03a43918532b57223d9b7b36661a7e5069ea789e70ed097e9455614910"
+		logic_hash = "v1_sha256_904bfc03a43918532b57223d9b7b36661a7e5069ea789e70ed097e9455614910"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193520,20 +193590,20 @@ rule MALPEDIA_Win_Alma_Communicator_Auto : FILE
 		$sequence_9 = { 53 56 33f6 8955f8 8bd9 57 }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize < 245760
 }
 rule MALPEDIA_Win_Rikamanu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "308aa7df-176c-53f5-8487-211055f7d5b3"
+		id = "013f139a-257f-5c4c-8509-7bedc9e8eade"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rikamanu"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rikamanu_auto.yar#L1-L282"
 		license_url = "N/A"
-		logic_hash = "d4697a7a9a9db5141a7716ea23027d53a2dc30b33c7526980666f737aa001510"
+		logic_hash = "v1_sha256_d4697a7a9a9db5141a7716ea23027d53a2dc30b33c7526980666f737aa001510"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -193579,20 +193649,20 @@ rule MALPEDIA_Win_Rikamanu_Auto : FILE
 		$sequence_29 = { 8d8914982400 5a 668b31 668930 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize < 212992
 }
 rule MALPEDIA_Win_Mebromi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3d64e85a-906f-5ddb-9f75-04eb426f7ebc"
+		id = "a87268f7-353c-5b95-a0e1-c1d1681cd5ad"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mebromi"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mebromi_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "051f5b8119e90ef14be758def00ef62b697ce727969ed9523ac57414d0773faf"
+		logic_hash = "v1_sha256_051f5b8119e90ef14be758def00ef62b697ce727969ed9523ac57414d0773faf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193618,20 +193688,20 @@ rule MALPEDIA_Win_Mebromi_Auto : FILE
 		$sequence_9 = { ff742410 ff15???????? 8bf0 85f6 7416 57 56 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize < 106496
 }
 rule MALPEDIA_Win_Treasurehunter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "742c7bf5-d2b7-520e-a089-1fe564ad2be1"
+		id = "b9baa99c-c2d5-555b-be24-6acd0a84945b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.treasurehunter"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.treasurehunter_auto.yar#L1-L104"
 		license_url = "N/A"
-		logic_hash = "9cfdb80d896aafedd2a1ceb8f4988ae951779a5109bafb233ecba9d043eab6e8"
+		logic_hash = "v1_sha256_9cfdb80d896aafedd2a1ceb8f4988ae951779a5109bafb233ecba9d043eab6e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193655,20 +193725,20 @@ rule MALPEDIA_Win_Treasurehunter_Auto : FILE
 		$sequence_7 = { 0f47c7 50 56 53 8945fc ff15???????? }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize < 229376
 }
 rule MALPEDIA_Win_Moonbounce_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2da98614-65a4-5227-bf42-e140c3206599"
+		id = "f0c6fbd1-78af-51f4-815a-ad77869507e8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonbounce"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.moonbounce_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "c88f40d1d857bf1c76177c0c7eb43f16650b71d1b80bdf0f0745bd71c4b7c892"
+		logic_hash = "v1_sha256_c88f40d1d857bf1c76177c0c7eb43f16650b71d1b80bdf0f0745bd71c4b7c892"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193694,20 +193764,20 @@ rule MALPEDIA_Win_Moonbounce_Auto : FILE
 		$sequence_9 = { c745f4d2070100 895dec ff15???????? 53 6a01 53 }
 
 	condition:
-		7 of them and filesize <70912
+		7 of them and filesize < 70912
 }
 rule MALPEDIA_Win_Citadel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b395dca4-452f-5377-80bb-408553de53db"
+		id = "c00de5c8-708b-5aa3-a1a9-16bc9a6c9049"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.citadel"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.citadel_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "19150147fccb12d09c7c4bd60b0305f74a8937d98e638616a5c6d14e1a34b56b"
+		logic_hash = "v1_sha256_19150147fccb12d09c7c4bd60b0305f74a8937d98e638616a5c6d14e1a34b56b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193739,20 +193809,20 @@ rule MALPEDIA_Win_Citadel_Auto : FILE
 		$sequence_15 = { e9???????? d0e9 3aca 73fa 0fb6c9 8b04c8 }
 
 	condition:
-		7 of them and filesize <1236992
+		7 of them and filesize < 1236992
 }
 rule MALPEDIA_Win_Sagerunex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a425b22d-b4f2-5d55-8ad8-71f79a62d46d"
+		id = "d1d14dc3-195e-5b23-840f-85dbd19bc87c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sagerunex"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sagerunex_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "dff18f54b10b1df23611f9090ec75c66093dde952c82cc96492b8dbdbdc0e627"
+		logic_hash = "v1_sha256_dff18f54b10b1df23611f9090ec75c66093dde952c82cc96492b8dbdbdc0e627"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193778,20 +193848,20 @@ rule MALPEDIA_Win_Sagerunex_Auto : FILE
 		$sequence_9 = { 488d542470 4c8bc0 458bcf ff15???????? 85c0 0f84a3000000 0fb7c6 }
 
 	condition:
-		7 of them and filesize <619520
+		7 of them and filesize < 619520
 }
 rule MALPEDIA_Win_Crypmic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a619fa41-ae29-5844-bc2f-097bc7d852ef"
+		id = "6ee41d1d-d2b2-5b07-b7eb-5f6f5a1dad81"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypmic"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.crypmic_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "bac6071bafa0b8d2c9908dd1914b7cdff1ecb7962c586174feb22c09b0eeeac5"
+		logic_hash = "v1_sha256_bac6071bafa0b8d2c9908dd1914b7cdff1ecb7962c586174feb22c09b0eeeac5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193817,20 +193887,20 @@ rule MALPEDIA_Win_Crypmic_Auto : FILE
 		$sequence_9 = { 57 ffd1 8bc3 5f 5e 5b }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize < 81920
 }
 rule MALPEDIA_Win_Zedhou_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b7edbb31-b801-517b-bc19-dc86b8702084"
+		id = "864fb8a1-41b9-5bc3-b1ce-acc004e9155e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zedhou"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.zedhou_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "6241dd23f931d49343383f9ed85b9fc9d0b5c6b6eca9f5ed0e96f38f7152c02e"
+		logic_hash = "v1_sha256_6241dd23f931d49343383f9ed85b9fc9d0b5c6b6eca9f5ed0e96f38f7152c02e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193856,20 +193926,20 @@ rule MALPEDIA_Win_Zedhou_Auto : FILE
 		$sequence_9 = { 8b01 ff502c 8dbedc000000 895dfc 8bcf e8???????? 6685c0 }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize < 499712
 }
 rule MALPEDIA_Win_Helminth_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "379c192f-5a15-5f3b-ad5b-fc2b330bc750"
+		id = "25df8796-52a3-5254-8dd4-fb55cddeb23c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.helminth"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.helminth_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "274e3eea90d2e30111a5a8cd56771457195fff91f933a3b2952878df64a83186"
+		logic_hash = "v1_sha256_274e3eea90d2e30111a5a8cd56771457195fff91f933a3b2952878df64a83186"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193900,20 +193970,20 @@ rule MALPEDIA_Win_Helminth_Auto : FILE
 		$sequence_14 = { 03c9 51 53 56 8934bd20f04100 }
 
 	condition:
-		7 of them and filesize <479232
+		7 of them and filesize < 479232
 }
 rule MALPEDIA_Win_Rawpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f6a04448-ba2c-50f7-b9f8-5b14dc2eb099"
+		id = "e80c11a9-9af9-5065-945e-6d1e580a6d7e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rawpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.rawpos_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "56a2b8fbb4e25a898a4bc87c65b7d85dae5bb8a6be93f75773ea8a26525a9a96"
+		logic_hash = "v1_sha256_56a2b8fbb4e25a898a4bc87c65b7d85dae5bb8a6be93f75773ea8a26525a9a96"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -193939,20 +194009,20 @@ rule MALPEDIA_Win_Rawpos_Auto : FILE
 		$sequence_9 = { 8bd0 83e207 8911 8816 }
 
 	condition:
-		7 of them and filesize <466944
+		7 of them and filesize < 466944
 }
 rule MALPEDIA_Win_Ramnit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2d07274e-4e7e-51f1-9043-6e669a2900ab"
+		id = "25f3bc76-e594-5cc7-bd9e-254deb6130ce"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ramnit_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "ac5af9c4c79d490a7e08824dfdc4e94d8423d8a8e8b47eb3783c3aa2be0c55ae"
+		logic_hash = "v1_sha256_ac5af9c4c79d490a7e08824dfdc4e94d8423d8a8e8b47eb3783c3aa2be0c55ae"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -193978,20 +194048,20 @@ rule MALPEDIA_Win_Ramnit_Auto : FILE
 		$sequence_9 = { 7512 47 46 e2f6 b801000000 59 }
 
 	condition:
-		7 of them and filesize <470016
+		7 of them and filesize < 470016
 }
 rule MALPEDIA_Win_Sidetwist_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "234f5e67-21ea-563f-a765-16d670746925"
+		id = "8a3c93db-52b7-5a9e-a7d4-e3013f607657"
 		date = "2023-12-06"
 		modified = "2023-12-08"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidetwist"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sidetwist_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5b593ac062a3ee588643c8e2045ef28da674c3f54189c5d0eebe42dcfcc6f71f"
+		logic_hash = "v1_sha256_5b593ac062a3ee588643c8e2045ef28da674c3f54189c5d0eebe42dcfcc6f71f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194017,20 +194087,20 @@ rule MALPEDIA_Win_Sidetwist_Auto : FILE
 		$sequence_9 = { 6690 4885d2 7521 448b1e 4585db 0f8524020000 8b05???????? }
 
 	condition:
-		7 of them and filesize <2002944
+		7 of them and filesize < 2002944
 }
 rule MALPEDIA_Win_Wpbrutebot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "898c87b0-2add-591b-b052-5ab6d1f02713"
+		id = "e1a6ace5-98ab-56a3-a793-290da199be91"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wpbrutebot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.wpbrutebot_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "4440d9063c782ae6ab73b1ab2283579374719f22f3d62d05493ede3029f224d5"
+		logic_hash = "v1_sha256_4440d9063c782ae6ab73b1ab2283579374719f22f3d62d05493ede3029f224d5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194056,20 +194126,20 @@ rule MALPEDIA_Win_Wpbrutebot_Auto : FILE
 		$sequence_9 = { e8???????? 83c404 85c0 0f85c3020000 80fb2e 0f8572f9ffff e9???????? }
 
 	condition:
-		7 of them and filesize <5134336
+		7 of them and filesize < 5134336
 }
 rule MALPEDIA_Win_Killav_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6ea8eddf-089b-50a4-8f27-4f9ec3d8cbec"
+		id = "71a9f13f-be37-5849-bb16-ed39f0c68000"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killav"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.killav_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "ff0be756557cba2c394e4d12fd6850def3f48f4054b3fe5a54c94ab0f930267a"
+		logic_hash = "v1_sha256_ff0be756557cba2c394e4d12fd6850def3f48f4054b3fe5a54c94ab0f930267a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194095,20 +194165,20 @@ rule MALPEDIA_Win_Killav_Auto : FILE
 		$sequence_9 = { 8b04bd70ba4300 834c0318ff 33c0 eb16 e8???????? }
 
 	condition:
-		7 of them and filesize <517120
+		7 of them and filesize < 517120
 }
 rule MALPEDIA_Win_Nimgrabber_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3417f107-706b-5ec9-a82e-ecd192636787"
+		id = "a99f8ddf-50c7-581a-992e-06cebbf725e6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimgrabber"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nimgrabber_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d297cfdaadbf9a62a41740c1e9e183f352f7bffa358a9fd4217b0060da18e6ef"
+		logic_hash = "v1_sha256_d297cfdaadbf9a62a41740c1e9e183f352f7bffa358a9fd4217b0060da18e6ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194134,20 +194204,20 @@ rule MALPEDIA_Win_Nimgrabber_Auto : FILE
 		$sequence_9 = { 89442404 8b442424 890424 e8???????? e9???????? 83e801 893424 }
 
 	condition:
-		7 of them and filesize <1238016
+		7 of them and filesize < 1238016
 }
 rule MALPEDIA_Win_Oldbait_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "de1960aa-dffc-50a3-b5af-d60e93de2ed5"
+		id = "6b915c49-6c5a-5439-aa02-f751e4f8b68f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oldbait"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.oldbait_auto.yar#L1-L227"
 		license_url = "N/A"
-		logic_hash = "56d5ee4ed7de5e4bf6d19f067af8af7a888733392a830afd56b63d7b093ebe45"
+		logic_hash = "v1_sha256_56d5ee4ed7de5e4bf6d19f067af8af7a888733392a830afd56b63d7b093ebe45"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -194187,20 +194257,20 @@ rule MALPEDIA_Win_Oldbait_Auto : FILE
 		$sequence_23 = { 56 8b7514 3bc1 57 8945f0 8945f4 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize < 172032
 }
 rule MALPEDIA_Win_Scout_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "badacd81-959a-5316-bd3b-4267a7a059cc"
+		id = "0901175a-35b9-5a11-b91d-473dbba30381"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scout"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.scout_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "45093eb9e440370fa3e5ca64b63b1022aa2768448d9bb6e9d805f1e4a716e0bc"
+		logic_hash = "v1_sha256_45093eb9e440370fa3e5ca64b63b1022aa2768448d9bb6e9d805f1e4a716e0bc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194226,20 +194296,20 @@ rule MALPEDIA_Win_Scout_Auto : FILE
 		$sequence_9 = { e8???????? 48391d???????? 7505 83c8ff eb75 488beb 488d35634f0100 }
 
 	condition:
-		7 of them and filesize <315392
+		7 of them and filesize < 315392
 }
 rule MALPEDIA_Win_Blindingcan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "465029b5-763a-56ed-b1de-dd91c2f1a7ca"
+		id = "bed6e51e-1a44-5066-8d81-f78cca63a359"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blindingcan"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.blindingcan_auto.yar#L1-L176"
 		license_url = "N/A"
-		logic_hash = "74166ac02345e359092c0de07b6503277e6c28815f8b4319943798385b40290d"
+		logic_hash = "v1_sha256_74166ac02345e359092c0de07b6503277e6c28815f8b4319943798385b40290d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194271,20 +194341,20 @@ rule MALPEDIA_Win_Blindingcan_Auto : FILE
 		$sequence_15 = { 8d7c001e 428d0427 3d00000100 7e6c 488b15???????? b918200000 4533c9 }
 
 	condition:
-		7 of them and filesize <363520
+		7 of them and filesize < 363520
 }
 rule MALPEDIA_Win_Enigma_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3133a569-e0c5-5978-8ff0-ff719a8c5fe7"
+		id = "ef08e442-d6aa-52c6-b4e3-4215541299d8"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enigma_loader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.enigma_loader_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "a5243000c2e0d210886f2730559565c47c46e77ae7333cb6bce278e91fb001ee"
+		logic_hash = "v1_sha256_a5243000c2e0d210886f2730559565c47c46e77ae7333cb6bce278e91fb001ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194310,20 +194380,20 @@ rule MALPEDIA_Win_Enigma_Loader_Auto : FILE
 		$sequence_9 = { 48832300 4883c308 488d0514ce0100 483bd8 75d8 b001 4883c420 }
 
 	condition:
-		7 of them and filesize <798720
+		7 of them and filesize < 798720
 }
 rule MALPEDIA_Win_Yorekey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eff8b001-6508-5d1e-8689-b1f2eb9999f7"
+		id = "b214c5de-b6f9-51ec-aaba-1c3cbedd291b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yorekey"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.yorekey_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "abba0a97f92aee372a13d852ed7f2662d19cb8080c2f20b48056340c1204a7ba"
+		logic_hash = "v1_sha256_abba0a97f92aee372a13d852ed7f2662d19cb8080c2f20b48056340c1204a7ba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194354,20 +194424,20 @@ rule MALPEDIA_Win_Yorekey_Auto : FILE
 		$sequence_14 = { eb04 4883c014 8938 e8???????? 488d1d73190100 }
 
 	condition:
-		7 of them and filesize <274432
+		7 of them and filesize < 274432
 }
 rule MALPEDIA_Win_Void_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89398dc6-137f-5ec6-8d95-3834bc4f980c"
+		id = "5a2f89ff-ec50-5ada-aa62-d8bbfa2a039c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.void"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.void_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "9f2df3bf5647831ce19a5214f5a12a4e7816575938889bc15e27938cfd4b8dad"
+		logic_hash = "v1_sha256_9f2df3bf5647831ce19a5214f5a12a4e7816575938889bc15e27938cfd4b8dad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194391,20 +194461,20 @@ rule MALPEDIA_Win_Void_Auto : FILE
 		$sequence_7 = { 50 8d4dc4 e8???????? 8d45dc c645fc01 50 8d4e3c }
 
 	condition:
-		7 of them and filesize <2744320
+		7 of them and filesize < 2744320
 }
 rule MALPEDIA_Win_Hyperssl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "278628e2-0cb8-5fcf-b0b4-758a4cb29c23"
+		id = "f0ef4b18-5000-502f-9529-13db194f572d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperssl"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.hyperssl_auto.yar#L1-L205"
 		license_url = "N/A"
-		logic_hash = "11f6d7199b100b059f11030323327bd2335a327a45ce3c310d198ef4e514bf67"
+		logic_hash = "v1_sha256_11f6d7199b100b059f11030323327bd2335a327a45ce3c310d198ef4e514bf67"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -194443,20 +194513,20 @@ rule MALPEDIA_Win_Hyperssl_Auto : FILE
 		$sequence_22 = { 016b08 897b04 5f 5e }
 
 	condition:
-		7 of them and filesize <835584
+		7 of them and filesize < 835584
 }
 rule MALPEDIA_Win_Helauto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8f4c5f14-ca45-53fe-8db7-58ae81e6cff8"
+		id = "2aa047ae-810b-5cad-a08d-a26c94a1b3fb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.helauto"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.helauto_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "8c0415faca54a4465c0b97b35f2aed1c836ec68c9df037f6186699e53a26046b"
+		logic_hash = "v1_sha256_8c0415faca54a4465c0b97b35f2aed1c836ec68c9df037f6186699e53a26046b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194482,20 +194552,20 @@ rule MALPEDIA_Win_Helauto_Auto : FILE
 		$sequence_9 = { a3???????? 50 ff15???????? e9???????? 8b442408 48 7509 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize < 57344
 }
 rule MALPEDIA_Win_Doublefinger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cf642cb4-badb-524a-b631-15e39cc2daf5"
+		id = "122a830f-af50-540a-826a-5a70894f9e50"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefinger"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.doublefinger_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "3eae491d263429c9200953e488faaa30692919588c48a865c32492ea2fca792f"
+		logic_hash = "v1_sha256_3eae491d263429c9200953e488faaa30692919588c48a865c32492ea2fca792f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194521,20 +194591,20 @@ rule MALPEDIA_Win_Doublefinger_Auto : FILE
 		$sequence_9 = { ff9424c0000000 4889842480010000 b875000000 6689842400010000 b872000000 }
 
 	condition:
-		7 of them and filesize <115712
+		7 of them and filesize < 115712
 }
 rule MALPEDIA_Win_Strifewater_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "93638997-4b39-56df-8c2c-e15416c268e2"
+		id = "6e5fe625-189f-56c9-aeec-da53ee757b9b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strifewater_rat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.strifewater_rat_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "c4c860d44d36734eadf7062d94acf85100c901ee56a2bc935f573163c784a260"
+		logic_hash = "v1_sha256_c4c860d44d36734eadf7062d94acf85100c901ee56a2bc935f573163c784a260"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194560,20 +194630,20 @@ rule MALPEDIA_Win_Strifewater_Rat_Auto : FILE
 		$sequence_9 = { 90 be01000000 89b424b0000000 83630800 488d0d10400500 48890b }
 
 	condition:
-		7 of them and filesize <1552384
+		7 of them and filesize < 1552384
 }
 rule MALPEDIA_Win_Redleaves_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f7b8b12-c503-5485-9c53-56cd6e66e380"
+		id = "ad3d8224-993c-5289-a75f-105d784c4f75"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redleaves"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.redleaves_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "3dce4e217425a30687e485e0f532b16bc2ee15eb23b5abe81e3322015aee4687"
+		logic_hash = "v1_sha256_3dce4e217425a30687e485e0f532b16bc2ee15eb23b5abe81e3322015aee4687"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -194607,20 +194677,20 @@ rule MALPEDIA_Win_Redleaves_Auto : FILE
 		$sequence_17 = { e8???????? 895500 9c e8???????? }
 
 	condition:
-		7 of them and filesize <1679360
+		7 of them and filesize < 1679360
 }
 rule MALPEDIA_Win_Billgates_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ce6a49fc-09dc-5429-91ef-444e27e6a6e2"
+		id = "2d321b54-57a7-5dcd-ba68-2ea52cf2f311"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.billgates"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.billgates_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "7ac006802cc67c455b1cfb751cff616e1942e0354815f2ae842e0537d44fc0dd"
+		logic_hash = "v1_sha256_7ac006802cc67c455b1cfb751cff616e1942e0354815f2ae842e0537d44fc0dd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194646,20 +194716,20 @@ rule MALPEDIA_Win_Billgates_Auto : FILE
 		$sequence_9 = { 7408 3c23 7404 3c24 }
 
 	condition:
-		7 of them and filesize <801792
+		7 of them and filesize < 801792
 }
 rule MALPEDIA_Win_Pinchduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0794d793-2c22-5bd4-a61c-badc5e0c2c07"
+		id = "404d94e2-b126-567b-acbf-a7b10274261d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pinchduke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pinchduke_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "59fabedb52194937fd24b19da68caeec236a55861258ee349d09c23df6cfa041"
+		logic_hash = "v1_sha256_59fabedb52194937fd24b19da68caeec236a55861258ee349d09c23df6cfa041"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194685,20 +194755,20 @@ rule MALPEDIA_Win_Pinchduke_Auto : FILE
 		$sequence_9 = { e8???????? 8d4dcc e8???????? 8d45f0 50 68???????? 6802000080 }
 
 	condition:
-		7 of them and filesize <223680
+		7 of them and filesize < 223680
 }
 rule MALPEDIA_Win_Sarhust_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "52e2651a-2a6e-5230-b7b1-6048b76df517"
+		id = "a8da62cc-2f51-5e18-94b5-92cd8b3e39e9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sarhust"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.sarhust_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "714fe7fd57f34b3db5ebbf318cfb9e33c9b49986cf0bcf43914f2398aec0102c"
+		logic_hash = "v1_sha256_714fe7fd57f34b3db5ebbf318cfb9e33c9b49986cf0bcf43914f2398aec0102c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194724,20 +194794,20 @@ rule MALPEDIA_Win_Sarhust_Auto : FILE
 		$sequence_9 = { e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize < 114688
 }
 rule MALPEDIA_Win_Fusiondrive_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6b24ebb4-bf8c-5059-8d46-133c8671d36b"
+		id = "abc8f59b-edc3-5780-a983-496eb82970af"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fusiondrive"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fusiondrive_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "21ef3d5712d10364f2b0ca6cdaf9dc2adad20cae2472f23d5b6b628fa15a50bd"
+		logic_hash = "v1_sha256_21ef3d5712d10364f2b0ca6cdaf9dc2adad20cae2472f23d5b6b628fa15a50bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194763,20 +194833,20 @@ rule MALPEDIA_Win_Fusiondrive_Auto : FILE
 		$sequence_9 = { 498784f7e8d90100 4883c504 493bec e9???????? 488bc3 4c8d3d2792ffff 498784f7e8d90100 }
 
 	condition:
-		7 of them and filesize <290816
+		7 of them and filesize < 290816
 }
 rule MALPEDIA_Win_Unidentified_039_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff352829-d1d0-5849-83ea-58866912f4d1"
+		id = "a7b2792e-dbec-55ad-b036-7bd0d8a34527"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_039"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.unidentified_039_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "d0fe8cc6956cba73b2a7ff7165daeebd2de9ab47240a59740a19b016e98dc584"
+		logic_hash = "v1_sha256_d0fe8cc6956cba73b2a7ff7165daeebd2de9ab47240a59740a19b016e98dc584"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194802,20 +194872,20 @@ rule MALPEDIA_Win_Unidentified_039_Auto : FILE
 		$sequence_9 = { 8b4528 05cf7b0000 33c8 894d2c 8b4530 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize < 262144
 }
 rule MALPEDIA_Win_Volgmer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee14de89-49ac-54c0-9028-7fc3ec1ece55"
+		id = "96be8489-fdf2-51c9-9667-7175cb094055"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.volgmer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.volgmer_auto.yar#L1-L404"
 		license_url = "N/A"
-		logic_hash = "e0462e79ef6280b8a6003ef7a899cec3de3d795edb85c7c6f37d83222de71a6b"
+		logic_hash = "v1_sha256_e0462e79ef6280b8a6003ef7a899cec3de3d795edb85c7c6f37d83222de71a6b"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -194875,20 +194945,20 @@ rule MALPEDIA_Win_Volgmer_Auto : FILE
 		$sequence_43 = { e8???????? 4881c450010000 415d 5b }
 
 	condition:
-		7 of them and filesize <393216
+		7 of them and filesize < 393216
 }
 rule MALPEDIA_Win_Kingminer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d7cd7a0a-31ee-53e1-af0c-e4bec9eb4a6f"
+		id = "715da54a-1d63-58ac-9ebc-c0777d6811fd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kingminer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kingminer_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "a1f2a6dac0d3d841d4f21da5b45b97f1a4e688102fb3e94636b9a33bdb699efe"
+		logic_hash = "v1_sha256_a1f2a6dac0d3d841d4f21da5b45b97f1a4e688102fb3e94636b9a33bdb699efe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194914,20 +194984,20 @@ rule MALPEDIA_Win_Kingminer_Auto : FILE
 		$sequence_9 = { 8b95d0feffff 2b4234 7419 83b9a000000000 7466 50 }
 
 	condition:
-		7 of them and filesize <165888
+		7 of them and filesize < 165888
 }
 rule MALPEDIA_Win_Nozelesn_Decryptor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a50249a6-41ed-5afd-a344-f1c46141fa9b"
+		id = "1c4ddae3-eb7d-5e2d-a964-58a0dc7e791d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nozelesn_decryptor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.nozelesn_decryptor_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "4edccdad4171a3a8dbbdabb59b2b49ff95bfdb30e97dda2b954d7aea22da3283"
+		logic_hash = "v1_sha256_4edccdad4171a3a8dbbdabb59b2b49ff95bfdb30e97dda2b954d7aea22da3283"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194953,20 +195023,20 @@ rule MALPEDIA_Win_Nozelesn_Decryptor_Auto : FILE
 		$sequence_9 = { 8d8d18fdffff e8???????? 8d8d78fdffff e8???????? c745fcffffffff 8b95dcfdffff 83fa08 }
 
 	condition:
-		7 of them and filesize <1122304
+		7 of them and filesize < 1122304
 }
 rule MALPEDIA_Win_Joanap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e1b53cb-7deb-5667-8a28-f48e8944278b"
+		id = "dc1a1f0e-78f3-5e0c-9803-d1cbf83ac27a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.joanap"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.joanap_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "6fdacc4c6daa9a4be9b126a90beb146cca04ff56d03b259a90c3b1977b1b6f5e"
+		logic_hash = "v1_sha256_6fdacc4c6daa9a4be9b126a90beb146cca04ff56d03b259a90c3b1977b1b6f5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -194992,20 +195062,20 @@ rule MALPEDIA_Win_Joanap_Auto : FILE
 		$sequence_9 = { 8d842494000000 6880000000 50 6800040000 68???????? 6a02 e8???????? }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize < 270336
 }
 rule MALPEDIA_Win_Babar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4c6a7dce-047d-5f59-9e3d-d3334c41d05a"
+		id = "601f78bd-dd16-5608-b765-30d2fb222f84"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babar"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.babar_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "f26db48f4ddda7baab96557200e3865f1c9bdc6e10a7518d2cd23d9a8273c7f2"
+		logic_hash = "v1_sha256_f26db48f4ddda7baab96557200e3865f1c9bdc6e10a7518d2cd23d9a8273c7f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195037,20 +195107,20 @@ rule MALPEDIA_Win_Babar_Auto : FILE
 		$sequence_15 = { e8???????? 8b8c2418010000 83c40c 5f }
 
 	condition:
-		7 of them and filesize <1294336
+		7 of them and filesize < 1294336
 }
 rule MALPEDIA_Win_Pvzout_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7f4c2c6d-072f-520f-bffa-7c86816c46e1"
+		id = "74cd2b7f-d4e8-54cf-9f51-0e228c0b9c9b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pvzout"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pvzout_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "ba6cffc93be56b2981aa18b2dfb2d12dcc79b5b9f031aee7308eec09fd3e12bc"
+		logic_hash = "v1_sha256_ba6cffc93be56b2981aa18b2dfb2d12dcc79b5b9f031aee7308eec09fd3e12bc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195076,20 +195146,20 @@ rule MALPEDIA_Win_Pvzout_Auto : FILE
 		$sequence_9 = { b3d7 5a bf95f6810e 75a8 43 1dea50873a }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize < 573440
 }
 rule MALPEDIA_Win_Darkcloud_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e059e862-be86-52e7-8da9-3408fec87995"
+		id = "2536a255-0d04-579d-afc9-1647529bcb2a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.darkcloud_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "dc797d71bdd72f9d3e0bc969cd3f0b1296fdab9f38aa0a923dd640404b9f8c9b"
+		logic_hash = "v1_sha256_dc797d71bdd72f9d3e0bc969cd3f0b1296fdab9f38aa0a923dd640404b9f8c9b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195115,20 +195185,20 @@ rule MALPEDIA_Win_Darkcloud_Auto : FILE
 		$sequence_9 = { 50 c78558ffffff80514000 899d50ffffff ffd7 8d8d50ffffff 50 8d5580 }
 
 	condition:
-		7 of them and filesize <622592
+		7 of them and filesize < 622592
 }
 rule MALPEDIA_Win_Adkoob_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9d0574c1-9926-5334-bfa7-9cdc9299a5a4"
+		id = "bd78b0e5-457d-5f47-805f-7f00ebc261a3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adkoob"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.adkoob_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "319076565d49e1f1e3a8b65fbc8806c865eb0ef04dd1a893be86dfc9ed47d730"
+		logic_hash = "v1_sha256_319076565d49e1f1e3a8b65fbc8806c865eb0ef04dd1a893be86dfc9ed47d730"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195154,20 +195224,20 @@ rule MALPEDIA_Win_Adkoob_Auto : FILE
 		$sequence_9 = { e8???????? 8bf0 83c40c 85f6 0f85ea000000 8b45dc ff45d8 }
 
 	condition:
-		7 of them and filesize <1867776
+		7 of them and filesize < 1867776
 }
 rule MALPEDIA_Win_Chainshot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e1db7f53-0270-5824-82d9-8aed908ee2be"
+		id = "d2d9a966-35c4-555b-8891-586459b0ac42"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chainshot"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chainshot_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "8440e51f4c64f9f335a379594cb3f694f5050a99bd0f6190db9cf62fbca5d726"
+		logic_hash = "v1_sha256_8440e51f4c64f9f335a379594cb3f694f5050a99bd0f6190db9cf62fbca5d726"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195193,20 +195263,20 @@ rule MALPEDIA_Win_Chainshot_Auto : FILE
 		$sequence_9 = { 75d0 85ff 745d 83ff04 }
 
 	condition:
-		7 of them and filesize <802816
+		7 of them and filesize < 802816
 }
 rule MALPEDIA_Win_Flawedgrace_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b7a2b679-4a09-5cd6-8d45-af761287421f"
+		id = "a19ad360-6634-576b-9251-8c25019f1b92"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedgrace"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.flawedgrace_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "1ff4be291ff6b1a953ca9c7eac4587b5db7acf2526c0381d7b2b4e64ad42f78b"
+		logic_hash = "v1_sha256_1ff4be291ff6b1a953ca9c7eac4587b5db7acf2526c0381d7b2b4e64ad42f78b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195232,20 +195302,20 @@ rule MALPEDIA_Win_Flawedgrace_Auto : FILE
 		$sequence_9 = { 0f84f8000000 8d442450 50 68???????? 8d842460010000 6804010000 50 }
 
 	condition:
-		7 of them and filesize <966656
+		7 of them and filesize < 966656
 }
 rule MALPEDIA_Win_Lazardoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "277a5926-2173-548c-847c-f39b2e42e95f"
+		id = "8a0d9899-1d5d-5c42-af7a-885a2d0aeef7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazardoor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.lazardoor_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "7e853d80ccef3940e80ec411ec3cf1794666e4d443e999ba85c896703eb74aa3"
+		logic_hash = "v1_sha256_7e853d80ccef3940e80ec411ec3cf1794666e4d443e999ba85c896703eb74aa3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195271,20 +195341,20 @@ rule MALPEDIA_Win_Lazardoor_Auto : FILE
 		$sequence_9 = { 8b1d???????? 41bcffff0000 85db 7440 }
 
 	condition:
-		7 of them and filesize <405504
+		7 of them and filesize < 405504
 }
 rule MALPEDIA_Win_Derohe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c13e1a85-a976-55b6-90d6-648c0339f374"
+		id = "ba48625c-b316-5f5d-ae9b-3beabba9d7aa"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.derohe"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.derohe_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "6fba1305105906cd35356cda0d2e36fa76e73b801e4848b11ebc790c439c6d6c"
+		logic_hash = "v1_sha256_6fba1305105906cd35356cda0d2e36fa76e73b801e4848b11ebc790c439c6d6c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195310,20 +195380,20 @@ rule MALPEDIA_Win_Derohe_Auto : FILE
 		$sequence_9 = { ffd0 8b542404 c60424ae 8b02 ffd0 8b542404 c6042416 }
 
 	condition:
-		7 of them and filesize <35788800
+		7 of them and filesize < 35788800
 }
 rule MALPEDIA_Win_Dizzyvoid_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b900bbf0-efba-5979-b901-058422cfe398"
+		id = "5e082fd2-811e-506b-b72a-39c742c2f94f"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dizzyvoid"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.dizzyvoid_auto.yar#L1-L226"
 		license_url = "N/A"
-		logic_hash = "8385659a773378b82a70cc8941b67dcf8ffad28a19525f1f78e990eee9f0fdc1"
+		logic_hash = "v1_sha256_8385659a773378b82a70cc8941b67dcf8ffad28a19525f1f78e990eee9f0fdc1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -195363,20 +195433,20 @@ rule MALPEDIA_Win_Dizzyvoid_Auto : FILE
 		$sequence_23 = { 47 88440e34 8b049d601c4100 c744063801000000 }
 
 	condition:
-		7 of them and filesize <479232
+		7 of them and filesize < 479232
 }
 rule MALPEDIA_Win_Jackpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3dd7bb50-a9ba-5035-bc39-1825f87f4af4"
+		id = "0e459a8f-ad74-5644-82e3-0ebfaebe866b"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jackpos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jackpos_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "e318334295704491926f566878a765af2b4635b235cabb0b05edeaa2585792fc"
+		logic_hash = "v1_sha256_e318334295704491926f566878a765af2b4635b235cabb0b05edeaa2585792fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195402,20 +195472,20 @@ rule MALPEDIA_Win_Jackpos_Auto : FILE
 		$sequence_9 = { 3b7d10 747e 83c704 83f808 7204 8b0f }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize < 319488
 }
 rule MALPEDIA_Win_Gup_Proxy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "83d0d192-73f0-5c37-84a4-96599a03dd8c"
+		id = "3fcbe7aa-7fdb-5a64-9ee0-28b32bf51ae4"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gup_proxy"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gup_proxy_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "cd4745a85ea3e99fe6039df895795db2fbf4a6914277daa87672debc92efc3be"
+		logic_hash = "v1_sha256_cd4745a85ea3e99fe6039df895795db2fbf4a6914277daa87672debc92efc3be"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195441,20 +195511,20 @@ rule MALPEDIA_Win_Gup_Proxy_Auto : FILE
 		$sequence_9 = { 8a4806 8a4007 0fb6f0 c1e608 0fb6c1 03f0 0fb6c2 }
 
 	condition:
-		7 of them and filesize <247808
+		7 of them and filesize < 247808
 }
 rule MALPEDIA_Win_Graftor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c144e9e9-346f-5b6a-9dfe-1d03b0e82296"
+		id = "d5099540-3776-5497-8cef-7f4ee9d7465c"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graftor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.graftor_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "fb4376621aa16704d8aafacb83eec317def5e2f740ec5d73dd897b4e00fd49ae"
+		logic_hash = "v1_sha256_fb4376621aa16704d8aafacb83eec317def5e2f740ec5d73dd897b4e00fd49ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195480,20 +195550,20 @@ rule MALPEDIA_Win_Graftor_Auto : FILE
 		$sequence_9 = { 57 e8???????? 8bc7 e8???????? 84c0 750b 68d8db4c00 }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize < 294912
 }
 rule MALPEDIA_Win_Acridrain_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fcb90d8e-aad2-5dfa-b2aa-c88c9fb392e4"
+		id = "a21af47a-a064-5b41-9436-62fa7fd0427a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acridrain"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.acridrain_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "445c602d5a9107fcce82aaaf7b300d7763f0b08be8d23fd5ad6910688300093b"
+		logic_hash = "v1_sha256_445c602d5a9107fcce82aaaf7b300d7763f0b08be8d23fd5ad6910688300093b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195519,20 +195589,20 @@ rule MALPEDIA_Win_Acridrain_Auto : FILE
 		$sequence_9 = { 8bf8 ff15???????? 83c410 85ff 0f84bb000000 8bc7 5f }
 
 	condition:
-		7 of them and filesize <2244608
+		7 of them and filesize < 2244608
 }
 rule MALPEDIA_Win_Tildeb_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49677524-14e6-56de-966e-12587dbc120c"
+		id = "767102f2-49ab-5b9a-8ec8-3c4e514a8f04"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tildeb"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.tildeb_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "ff05557691123d6857c3cb5d609bf2746dd344811b380372ecacb54f0277a087"
+		logic_hash = "v1_sha256_ff05557691123d6857c3cb5d609bf2746dd344811b380372ecacb54f0277a087"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195558,20 +195628,20 @@ rule MALPEDIA_Win_Tildeb_Auto : FILE
 		$sequence_9 = { bf???????? f3ab 8d85e4f9ffff 50 8b8ddbf5ffff 81e1ff000000 51 }
 
 	condition:
-		7 of them and filesize <8532488
+		7 of them and filesize < 8532488
 }
 rule MALPEDIA_Win_Ryuk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "721acb27-a4a0-50f9-a1d2-cd2f2b4d785d"
+		id = "3a59532e-f093-545e-9ea1-7e4b72b90745"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ryuk_auto.yar#L1-L449"
 		license_url = "N/A"
-		logic_hash = "445b298ca90f42d0360a842e111170d0d02597be6aa1ae9b7c72639822721220"
+		logic_hash = "v1_sha256_445b298ca90f42d0360a842e111170d0d02597be6aa1ae9b7c72639822721220"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -195637,20 +195707,20 @@ rule MALPEDIA_Win_Ryuk_Auto : FILE
 		$sequence_49 = { e8???????? 84c0 746c e8???????? 488d0d63080000 e8???????? e8???????? }
 
 	condition:
-		7 of them and filesize <7450624
+		7 of them and filesize < 7450624
 }
 rule MALPEDIA_Win_Ransoc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c55d5df4-572b-5c0c-9b0c-3a567923b39b"
+		id = "1590179f-8936-5b76-83d6-9e746035e72a"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransoc"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.ransoc_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "9e4916ca4af80e938f133184e5caea93df6c13b83aeab910e5de3e08f2b95d7e"
+		logic_hash = "v1_sha256_9e4916ca4af80e938f133184e5caea93df6c13b83aeab910e5de3e08f2b95d7e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195676,20 +195746,20 @@ rule MALPEDIA_Win_Ransoc_Auto : FILE
 		$sequence_9 = { 895134 8b4834 85c9 7406 8b5030 895130 8b482c }
 
 	condition:
-		7 of them and filesize <958464
+		7 of them and filesize < 958464
 }
 rule MALPEDIA_Win_Mosaic_Regressor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6545d5ce-704c-5c00-a6cd-ec1b5c909576"
+		id = "1e14d17b-c365-52ba-b65f-db2a9893ba74"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mosaic_regressor"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mosaic_regressor_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "73c7fd14f8effd7ac9e0816b586de74eff8d0d21c8391e8e84f2921e57196fdb"
+		logic_hash = "v1_sha256_73c7fd14f8effd7ac9e0816b586de74eff8d0d21c8391e8e84f2921e57196fdb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195715,20 +195785,20 @@ rule MALPEDIA_Win_Mosaic_Regressor_Auto : FILE
 		$sequence_9 = { 6a00 6a00 6a00 8d942498080000 }
 
 	condition:
-		7 of them and filesize <113664
+		7 of them and filesize < 113664
 }
 rule MALPEDIA_Win_Phoenix_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "211c4ada-8c2c-53b1-a8d1-ffd67dfd6fac"
+		id = "20311e94-10bf-5879-9d6b-fb2aa107efc0"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phoenix_locker"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.phoenix_locker_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "fc57928d88a0e4a78b2d227bc29cc732b1edff7e878d1ae0306413cb72bae6ed"
+		logic_hash = "v1_sha256_fc57928d88a0e4a78b2d227bc29cc732b1edff7e878d1ae0306413cb72bae6ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195754,20 +195824,20 @@ rule MALPEDIA_Win_Phoenix_Locker_Auto : FILE
 		$sequence_9 = { e8???????? 4155 4151 9c 49b98059c32d64378851 e8???????? 4c0fbbea }
 
 	condition:
-		7 of them and filesize <3702784
+		7 of them and filesize < 3702784
 }
 rule MALPEDIA_Win_Simda_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d74b8ce3-47a5-51db-a32e-c17b32ae8c86"
+		id = "fdc43536-c715-5487-b593-f5e4619d38cb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.simda"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.simda_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "843d6d6caa38939c108c027a85a80f4565ce68a6213223a9ac5f7b9c75de56e2"
+		logic_hash = "v1_sha256_843d6d6caa38939c108c027a85a80f4565ce68a6213223a9ac5f7b9c75de56e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195793,20 +195863,20 @@ rule MALPEDIA_Win_Simda_Auto : FILE
 		$sequence_9 = { 85c0 75dd 8b4d0c 8bc3 2bc2 }
 
 	condition:
-		7 of them and filesize <1581056
+		7 of them and filesize < 1581056
 }
 rule MALPEDIA_Win_Newpass_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1259b84e-f22e-5be6-af9b-9be76f957f31"
+		id = "2cd6cc95-79fa-5267-9c48-74da78282bce"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newpass"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.newpass_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "348cb83a48a4b33ccc0bbb52d51d9d135a00878f03abb1cd8978354d39a99336"
+		logic_hash = "v1_sha256_348cb83a48a4b33ccc0bbb52d51d9d135a00878f03abb1cd8978354d39a99336"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195832,20 +195902,20 @@ rule MALPEDIA_Win_Newpass_Auto : FILE
 		$sequence_9 = { 498bd5 488bcb e8???????? 84c0 0f84f4feffff eb1e 4c8b6c2438 }
 
 	condition:
-		7 of them and filesize <2654208
+		7 of them and filesize < 2654208
 }
 rule MALPEDIA_Win_Kpot_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e2a580eb-b7e8-5569-b0fb-2a299c9ec4b4"
+		id = "f53a1820-8e1d-5ff2-a867-d053d924c064"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kpot_stealer_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "f623e53c9b602005767465c863e7a8d05ae4b1bf549ad4d0a72142bca2bcb3fc"
+		logic_hash = "v1_sha256_f623e53c9b602005767465c863e7a8d05ae4b1bf549ad4d0a72142bca2bcb3fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195871,20 +195941,20 @@ rule MALPEDIA_Win_Kpot_Stealer_Auto : FILE
 		$sequence_9 = { c1e108 ff7514 0bc1 0fb64f02 ff7510 c1e110 }
 
 	condition:
-		7 of them and filesize <219136
+		7 of them and filesize < 219136
 }
 rule MALPEDIA_Win_Boatlaunch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "17aecbbe-5b2a-5c30-99c2-803688504adb"
+		id = "334c1aa3-75f1-5509-b92e-e1dc581a8663"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boatlaunch"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.boatlaunch_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "1f8a4849474a78f820c262b22058fdfb27def9aa1bc7516915781a893805dbc5"
+		logic_hash = "v1_sha256_1f8a4849474a78f820c262b22058fdfb27def9aa1bc7516915781a893805dbc5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -195916,20 +195986,20 @@ rule MALPEDIA_Win_Boatlaunch_Auto : FILE
 		$sequence_15 = { 48ad 4885c0 740e 488bc8 e8???????? }
 
 	condition:
-		7 of them and filesize <33792
+		7 of them and filesize < 33792
 }
 rule MALPEDIA_Win_Pocodown_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "80a18124-a9b0-5acb-a47f-4f6b0c30bce1"
+		id = "b428fc2b-634f-5388-ad0a-96d31f45cb50"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pocodown"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.pocodown_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0c989d45fa577d150beb78b93b7b2b3b8b608ef00eacc1f315d54d3fff02abed"
+		logic_hash = "v1_sha256_0c989d45fa577d150beb78b93b7b2b3b8b608ef00eacc1f315d54d3fff02abed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195955,20 +196025,20 @@ rule MALPEDIA_Win_Pocodown_Auto : FILE
 		$sequence_9 = { e8???????? 85c0 7505 e9???????? 837c243841 7e05 e9???????? }
 
 	condition:
-		7 of them and filesize <6703104
+		7 of them and filesize < 6703104
 }
 rule MALPEDIA_Win_Gratem_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89f0dee2-28c6-5a10-a3ad-288a448f45ac"
+		id = "85e5b32e-eead-5fbb-831f-5cdd2810dcd6"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gratem"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.gratem_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "b58ab0ade84c3286830362f0f11bfb9519b8733c76dfe4e9cd7ba24746663e50"
+		logic_hash = "v1_sha256_b58ab0ade84c3286830362f0f11bfb9519b8733c76dfe4e9cd7ba24746663e50"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -195994,20 +196064,20 @@ rule MALPEDIA_Win_Gratem_Auto : FILE
 		$sequence_9 = { 56 8d34c5c0b84000 833e00 7513 50 e8???????? }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize < 155648
 }
 rule MALPEDIA_Win_Cur1_Downloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8f21da40-d974-5099-af6e-31cd89e26953"
+		id = "c656942c-adf5-5a4d-9796-771186c25df7"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cur1_downloader"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cur1_downloader_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "1c569e94280f8095f5f07b5abf340e9688b7e484a4ea176f880968651b21cc46"
+		logic_hash = "v1_sha256_1c569e94280f8095f5f07b5abf340e9688b7e484a4ea176f880968651b21cc46"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196033,20 +196103,20 @@ rule MALPEDIA_Win_Cur1_Downloader_Auto : FILE
 		$sequence_9 = { c684245f03000069 c68424600300006f c68424610300006e c684246203000049 c684246303000064 }
 
 	condition:
-		7 of them and filesize <402432
+		7 of them and filesize < 402432
 }
 rule MALPEDIA_Win_Chinad_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "638e582c-33e3-5dc7-b819-6884369859ac"
+		id = "296020e8-c993-5ecc-93ce-2b54de81e453"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinad"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.chinad_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "0909b63bc06cff243e8fe7a8bed04254856f090009be2422d2270c54ce10717f"
+		logic_hash = "v1_sha256_0909b63bc06cff243e8fe7a8bed04254856f090009be2422d2270c54ce10717f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196072,20 +196142,20 @@ rule MALPEDIA_Win_Chinad_Auto : FILE
 		$sequence_9 = { 8b95d8feffff 23fe 0bf8 8bc3 c1c007 89bdd0feffff 018dd0feffff }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize < 598016
 }
 rule MALPEDIA_Win_Vigilant_Cleaner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "95508716-6967-5a7f-8deb-f89ef52d51c8"
+		id = "5c57cf41-cb7f-597e-a740-072449278bbb"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vigilant_cleaner"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.vigilant_cleaner_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "8f3ebf6c4c6a27d564cc935d377873205b5347edbbb627f3304dd27f1d14c8a3"
+		logic_hash = "v1_sha256_8f3ebf6c4c6a27d564cc935d377873205b5347edbbb627f3304dd27f1d14c8a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196111,20 +196181,20 @@ rule MALPEDIA_Win_Vigilant_Cleaner_Auto : FILE
 		$sequence_9 = { b868584d56 bb00000000 b90a000000 ba58560000 ed 5b }
 
 	condition:
-		7 of them and filesize <1181696
+		7 of them and filesize < 1181696
 }
 rule MALPEDIA_Win_Cosmicduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5fb60344-131a-5131-b8e1-4edb7524b3e9"
+		id = "db0c7838-845d-54f2-9658-bd13bcb417ee"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cosmicduke"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.cosmicduke_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "7c78d88a6294fbefeccb9e02496af3e7aa8e7c4fd27d39a3747c54e6c53a3f19"
+		logic_hash = "v1_sha256_7c78d88a6294fbefeccb9e02496af3e7aa8e7c4fd27d39a3747c54e6c53a3f19"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196150,20 +196220,20 @@ rule MALPEDIA_Win_Cosmicduke_Auto : FILE
 		$sequence_9 = { 8b1d???????? 83c40c 8d842490000000 50 8d842414010000 50 ffd3 }
 
 	condition:
-		7 of them and filesize <456704
+		7 of them and filesize < 456704
 }
 rule MALPEDIA_Win_Evilgrab_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2f5e9905-bb83-55a1-ac75-ab30097513bc"
+		id = "373d9cca-1ce0-596d-81f6-16876208eab9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilgrab"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.evilgrab_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "b41ba72c13396de6441cf8d00725c98522c9e1b32d509c53ffe738d9f7f30c83"
+		logic_hash = "v1_sha256_b41ba72c13396de6441cf8d00725c98522c9e1b32d509c53ffe738d9f7f30c83"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196189,20 +196259,20 @@ rule MALPEDIA_Win_Evilgrab_Auto : FILE
 		$sequence_9 = { c685f0efffffd1 68???????? 8d8df1efffff 51 ff15???????? 83c408 8d95f0efffff }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize < 327680
 }
 rule MALPEDIA_Win_Mydogs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9688d839-8d35-5299-b5ae-d8084dbff6c0"
+		id = "a7350145-bffb-5410-a978-17369692fb0e"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydogs"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.mydogs_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "4d3f1e38f0e3ee2bcc850d56898106585e9b5f7ff2ecd490e245883ad04d625f"
+		logic_hash = "v1_sha256_4d3f1e38f0e3ee2bcc850d56898106585e9b5f7ff2ecd490e245883ad04d625f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196228,20 +196298,20 @@ rule MALPEDIA_Win_Mydogs_Auto : FILE
 		$sequence_9 = { ff15???????? 85c0 7518 6860ea0000 ffd6 6a00 8d442428 }
 
 	condition:
-		7 of them and filesize <313344
+		7 of them and filesize < 313344
 }
 rule MALPEDIA_Win_Jlorat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d1cf35b-b348-5281-a39e-6f479f3341d0"
+		id = "8f4c0445-f3bf-5d91-8bbf-46c1c3f52240"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jlorat"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.jlorat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f1e1cc634deaa339c16c9b45b57e58aeaba6eb3b461fa4ec4f4f48da46c3a4c6"
+		logic_hash = "v1_sha256_f1e1cc634deaa339c16c9b45b57e58aeaba6eb3b461fa4ec4f4f48da46c3a4c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196267,20 +196337,20 @@ rule MALPEDIA_Win_Jlorat_Auto : FILE
 		$sequence_9 = { eb00 8b4de0 83c140 c745f002000000 89e0 8908 e8???????? }
 
 	condition:
-		7 of them and filesize <10952704
+		7 of them and filesize < 10952704
 }
 rule MALPEDIA_Win_Atlas_Agent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8963b3c6-9ff3-517b-b17b-5c5871d182de"
+		id = "0d8c56d6-ffc2-5197-a59c-bf6089d78b75"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atlas_agent"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.atlas_agent_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "af8db8f42863f1a21cc132a9027166c584afcbb4de297bb22cf7a2ce6f153562"
+		logic_hash = "v1_sha256_af8db8f42863f1a21cc132a9027166c584afcbb4de297bb22cf7a2ce6f153562"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196310,20 +196380,20 @@ rule MALPEDIA_Win_Atlas_Agent_Auto : FILE
 		$sequence_13 = { 4c8d0516270200 488bc2 83e23f 48c1f806 }
 
 	condition:
-		7 of them and filesize <857088
+		7 of them and filesize < 857088
 }
 rule MALPEDIA_Win_Kelihos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "916af3c3-ae46-5939-bcc1-467f81305f04"
+		id = "f4a12bb6-604b-54b1-a9a1-02f3e05f1cf3"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kelihos"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.kelihos_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "01c4d51fd72ba50cd8794e1b3e4eee55e82df8fc084f2e85675408a95d821aa3"
+		logic_hash = "v1_sha256_01c4d51fd72ba50cd8794e1b3e4eee55e82df8fc084f2e85675408a95d821aa3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196349,20 +196419,20 @@ rule MALPEDIA_Win_Kelihos_Auto : FILE
 		$sequence_9 = { e8???????? ff770c 8d75ec e8???????? ff75f8 8d45ec ff75f4 }
 
 	condition:
-		7 of them and filesize <4702208
+		7 of them and filesize < 4702208
 }
 rule MALPEDIA_Win_Fuwuqidrama_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0fa71a6d-0c80-54bf-8699-93451280ec8a"
+		id = "c1173bac-29b9-53fa-aa35-fb52ebe7e88d"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fuwuqidrama"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.fuwuqidrama_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "01914df1a3041b58ec9ceec9faa5307c8556d20ec25933ac048149432128c635"
+		logic_hash = "v1_sha256_01914df1a3041b58ec9ceec9faa5307c8556d20ec25933ac048149432128c635"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196388,20 +196458,20 @@ rule MALPEDIA_Win_Fuwuqidrama_Auto : FILE
 		$sequence_9 = { 899708140000 898704140000 ff15???????? 8b16 8d4704 6a00 50 }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize < 245760
 }
 rule MALPEDIA_Win_Veiledsignal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6c1343f8-3e47-50b2-a300-f82013ec0933"
+		id = "0b6feca8-f7d7-5c5d-9901-da6a5e5c13b9"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.veiledsignal"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.veiledsignal_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "9a6f92fe1de553c3683182fb5ec18013c09f63a6458b1c64fe2148d2dc0fd4cc"
+		logic_hash = "v1_sha256_9a6f92fe1de553c3683182fb5ec18013c09f63a6458b1c64fe2148d2dc0fd4cc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196427,20 +196497,20 @@ rule MALPEDIA_Win_Veiledsignal_Auto : FILE
 		$sequence_9 = { 428844f13e 4b8b84e010e70400 42804cf03d04 38558f e9???????? ff15???????? 894597 }
 
 	condition:
-		7 of them and filesize <667648
+		7 of them and filesize < 667648
 }
 rule MALPEDIA_Win_Shatteredglass_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b5759aec-876a-5e51-92c3-b5c3cd47ebed"
+		id = "e927c75c-0641-51eb-926b-d76e6708d341"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shatteredglass"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.shatteredglass_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "01b6c47460c5c08264d9ff26f8c68c9d17064a107dafa21abd25815194e46710"
+		logic_hash = "v1_sha256_01b6c47460c5c08264d9ff26f8c68c9d17064a107dafa21abd25815194e46710"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196466,20 +196536,20 @@ rule MALPEDIA_Win_Shatteredglass_Auto : FILE
 		$sequence_9 = { 8d410d 8d642400 8a08 8a5001 8a6802 8a70ff }
 
 	condition:
-		7 of them and filesize <273408
+		7 of them and filesize < 273408
 }
 rule MALPEDIA_Win_Coronavirus_Ransomware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "25a17b3a-8384-5e84-a1b5-2dd73e5ee0cf"
+		id = "720e338b-9ba0-5525-9a4f-08a6c3c444dd"
 		date = "2024-10-31"
 		modified = "2024-11-11"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coronavirus_ransomware"
 		source_url = "https://github.com/malpedia/signator-rules//blob/6558c417dcf07146b1309b6acde6be0aa96dea10/rules/win.coronavirus_ransomware_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "d0b11b2a26c2b9ac5d26c61d4c9566b412c8fa0dfeb2d6ec35815769f67a7b2e"
+		logic_hash = "v1_sha256_d0b11b2a26c2b9ac5d26c61d4c9566b412c8fa0dfeb2d6ec35815769f67a7b2e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -196505,13 +196575,13 @@ rule MALPEDIA_Win_Coronavirus_Ransomware_Auto : FILE
 		$sequence_9 = { 84c0 7426 0fb60d???????? 0fb6c0 0fb68080fa4000 03c1 }
 
 	condition:
-		7 of them and filesize <235520
+		7 of them and filesize < 235520
 }
 /*
  * YARA Rule Set
  * Repository Name: Trellix ARC
  * Repository: https://github.com/advanced-threat-research/Yara-Rules/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: fc51a3fe3b450838614a5a5aa327c6bd8689cbb2
  * Number of Rules: 162
  * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
@@ -196727,7 +196797,7 @@ private rule TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE : RANSOMWARE
 	meta:
 		description = "Detect chunk of Xinof ransomware"
 		author = "Thomas Roccia | McAfee ATR Team"
-		id = "243c39fd-b5f6-5f64-8058-43da182480c0"
+		id = "e49d6c28-c52f-584f-b1ba-67ce29ea0ff5"
 		date = "2020-11-20"
 		date = "2020-11-20"
 		modified = "2020-11-20"
@@ -196735,7 +196805,7 @@ private rule TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE : RANSOMWARE
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_xinof.yar#L1-L51"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "0c1e6299a2392239dbe7fead33ef4146"
-		logic_hash = "f0266962357a7cb26995cdbfcc99749b73fc4ed09c813fa8e2ed0f5143cde554"
+		logic_hash = "v1_sha256_f0266962357a7cb26995cdbfcc99749b73fc4ed09c813fa8e2ed0f5143cde554"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE"
@@ -196786,13 +196856,13 @@ rule TRELLIX_ARC_Shifu : FINANCIAL
 	meta:
 		description = "No description has been set in the source file - Trellix ARC"
 		author = "McAfee Labs"
-		id = "81e9ad25-1df0-5196-be8b-1d1d5d8e4387"
+		id = "51da01a5-5f2a-5275-a68a-d78784c5d8ce"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://blogs.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_Shifu.yar#L1-L24"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "dfa6165f8d2750330c71dedbde293780d2bb27e8eb3635e47ca770ff7b9a9d63"
+		logic_hash = "v1_sha256_dfa6165f8d2750330c71dedbde293780d2bb27e8eb3635e47ca770ff7b9a9d63"
 		score = 75
 		quality = 70
 		tags = "FINANCIAL"
@@ -196816,13 +196886,13 @@ rule TRELLIX_ARC_Rietspoof_Loader : RANSOMWARE FILE
 	meta:
 		description = "Rule to detect the Rietspoof loader"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "f306e381-e2ae-528e-937b-aced72356d77"
+		id = "2578c6bd-ae11-5f25-922c-fd19df5f7bfd"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://blog.avast.com/rietspoof-malware-increases-activity"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_rietspoof_loader.yar#L1-L22"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "d72b58ff452070e03d0b25bc433ef5c677df77dd440adc1ecdb592cee24235fb"
+		logic_hash = "v1_sha256_d72b58ff452070e03d0b25bc433ef5c677df77dd440adc1ecdb592cee24235fb"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -196835,21 +196905,21 @@ rule TRELLIX_ARC_Rietspoof_Loader : RANSOMWARE FILE
 		$x1 = "\\Work\\d2Od7s43\\techloader\\loader" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule TRELLIX_ARC_MALWARE_Blackpos_Pdb : POS FILE
 {
 	meta:
 		description = "BlackPOS PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "f37e1522-49c4-5369-bc2c-33b070e9eae7"
+		id = "c81cc953-4e02-59a3-ad5b-f31d1a07dc8b"
 		date = "2014-01-24"
 		modified = "2020-08-14"
 		reference = "https://en.wikipedia.org/wiki/BlackPOS_Malware"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_blackpos_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "5a963e8aca62f3cf5872c6bff02d6dee0399728554c6ac3f5cb312b2ba7d7dbf"
-		logic_hash = "d8f3fa380ca15f0fae432849b8c16cb8a0a9d1427d3e72fbf89cbbd63b0849c9"
+		logic_hash = "v1_sha256_d8f3fa380ca15f0fae432849b8c16cb8a0a9d1427d3e72fbf89cbbd63b0849c9"
 		score = 75
 		quality = 70
 		tags = "POS, FILE"
@@ -196863,21 +196933,21 @@ rule TRELLIX_ARC_MALWARE_Blackpos_Pdb : POS FILE
 		$pdb = "\\Projects\\Rescator\\MmonNew\\Debug\\mmon.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and any of them
 }
 rule TRELLIX_ARC_Malw_Cutwail_Pdb : BOTNET FILE
 {
 	meta:
 		description = "Rule to detect cutwail based on the PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "62058ff9-acb5-5f71-b6bb-4c64e51442ba"
+		id = "e257d958-70da-517f-bfa6-2831dd99eaa6"
 		date = "2008-04-16"
 		modified = "2020-08-14"
 		reference = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/CUTWAIL"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_cutwail.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "d702f823eefb50d9ea5b336c638f65a40c2342f8eb88278da60aa8a498c75010"
-		logic_hash = "f53626e6085509ddf9268b69e54a138e64cd5d3fbad119e6e9473179decd7927"
+		logic_hash = "v1_sha256_f53626e6085509ddf9268b69e54a138e64cd5d3fbad119e6e9473179decd7927"
 		score = 75
 		quality = 70
 		tags = "BOTNET, FILE"
@@ -196891,20 +196961,20 @@ rule TRELLIX_ARC_Malw_Cutwail_Pdb : BOTNET FILE
 		$pdb = "\\0bulknet\\FLASH\\Release\\flashldr.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <440KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 440KB and any of them
 }
 rule TRELLIX_ARC_Rovnix_Downloader : DOWNLOADER
 {
 	meta:
 		description = "Rovnix downloader with sinkhole checks"
 		author = "Intel Security"
-		id = "d51f8f73-7a3a-5ccf-9122-86061b5399f1"
+		id = "f62ba89a-da9e-53dc-b4fe-a210d6964352"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://blogs.mcafee.com/mcafee-labs/rovnix-downloader-sinkhole-time-checks/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_Rovnix.yar#L1-L38"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "52cde40c95436129b7d48b4bd5e78b66deb84fdc84a76cc9ac72f24e0777e540"
+		logic_hash = "v1_sha256_52cde40c95436129b7d48b4bd5e78b66deb84fdc84a76cc9ac72f24e0777e540"
 		score = 75
 		quality = 43
 		tags = "DOWNLOADER"
@@ -196932,21 +197002,21 @@ rule TRELLIX_ARC_Rovnix_Downloader : DOWNLOADER
 		$mz = { 4D 5A }
 
 	condition:
-		$mz in (0..2) and all of ($sink*) and $boot
+		$mz in ( 0 .. 2 ) and all of ( $sink* ) and $boot
 }
 rule TRELLIX_ARC_Malw_Inabot_Worm : WORM FILE
 {
 	meta:
 		description = "Rule to detect inabot worm based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "b899d2d6-000a-5363-9efe-527dcd0cea17"
+		id = "7fe0bfbd-6a5b-5d82-9a95-73880a472345"
 		date = "2013-04-19"
 		modified = "2020-08-14"
 		reference = "http://verwijderspyware.blogspot.com/2013/04/elimineren-w32inabot-worm-hoe-te.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_inabot_worm_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "c9c010228254aae222e31c669dda639cdd30695729b8ef2b6ece06d899a496aa"
-		logic_hash = "70485de4e071b684faa87484ce2a53a8b2a29d0a2954e785b858c7ff1d908de0"
+		logic_hash = "v1_sha256_70485de4e071b684faa87484ce2a53a8b2a29d0a2954e785b858c7ff1d908de0"
 		score = 75
 		quality = 70
 		tags = "WORM, FILE"
@@ -196961,20 +197031,20 @@ rule TRELLIX_ARC_Malw_Inabot_Worm : WORM FILE
 		$pdb1 = "\\mainstream\\archive.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 180KB and any of them
 }
 rule TRELLIX_ARC_MALW_Liquorbot : MALWARE FILE
 {
 	meta:
 		description = "Rule to detect LiquorBot malware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "73898df8-b5eb-50ac-a2fe-ef9233c251c5"
+		id = "e18edb34-025a-55b5-bf48-c8f5d04d3de1"
 		date = "2020-08-19"
 		modified = "2020-08-19"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_liquorbot.yar#L1-L23"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "2448e3ede809331b2370fe9d42d603ad6508be6531a1a8764e0e0621867b6e89"
+		logic_hash = "v1_sha256_2448e3ede809331b2370fe9d42d603ad6508be6531a1a8764e0e0621867b6e89"
 		score = 75
 		quality = 70
 		tags = "MALWARE, FILE"
@@ -196989,21 +197059,21 @@ rule TRELLIX_ARC_MALW_Liquorbot : MALWARE FILE
 		$pattern = { 7F454C4602010100000000000000000002003E0001000000605A4600000000004000000000000000700200000000000000000000400038000A0040001B00090006000000040000004000000000000000400040000000000040004000000000003002000000000000300200000000000000100000000000000300000004000000E00F000000000000E00F400000000000E00F40000000000020000000000000002000000000000000010000000000000004000000040000007C0F0000000000007C0F4000000000007C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000040FB29000000000040FB2900000000000010000000000000010000000400000000002A000000000000006A000000000000006A0000000000E4492C0000000000E4492C000000000000100000000000000100000006000000005056000000000000509600000000000050960000000000E014040000000000681307000000000000100000000000000200000006000000405156000000000040519600000000004051960000000000300100000000000030010000000000000800000000000000070000000400000000000000000000000000000000000000000000000000000000000000000000000800000000000000080000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A00000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000600000000000000001040000000000000100000000000001FE9290000000000000000000000000010000000000000000000000000000000F000000001000000060000000000000020F969000000000020F929000000000020020000000000000000000000000000100000000000000010000000000000007000000001000000020000000000000000006A000000000000002A0000000000A678110000000000000000000000000020000000000000000000000000000000E0000000040000000200000000000000A8787B0000000000A8783B000000000018000000000000000B0000000000000008000000000000001800000000000000E6000000040000000200000000000000C0787B0000000000C0783B000000000018030000000000000B0000000200000008000000000000001800000000000000F5000000FF }
 
 	condition:
-		uint16(0)==0x457f and all of them
+		uint16( 0 ) == 0x457f and all of them
 }
 rule TRELLIX_ARC_Chikdos_Malware_Pdb : DOS FILE
 {
 	meta:
 		description = "Chikdos PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "0174ff2b-57fc-5578-b45e-c08bf8528ee8"
+		id = "f0b56cec-5c6d-5601-abd7-a115ea616e87"
 		date = "2013-12-02"
 		modified = "2020-08-14"
 		reference = "http://hackermedicine.com/tag/trojan-chickdos/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_chickdos_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "c2a0e9f8e880ac22098d550a74940b1d81bc9fda06cebcf67f74782e55e9d9cc"
-		logic_hash = "150bf809a61aad00df0c49fb6a609b909c84ffb9ca442e143a6c5bf3dfc39314"
+		logic_hash = "v1_sha256_150bf809a61aad00df0c49fb6a609b909c84ffb9ca442e143a6c5bf3dfc39314"
 		score = 75
 		quality = 70
 		tags = "DOS, FILE"
@@ -197017,21 +197087,21 @@ rule TRELLIX_ARC_Chikdos_Malware_Pdb : DOS FILE
 		$pdb = "\\IntergrateCHK\\Release\\IntergrateCHK.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and any of them
 }
 rule TRELLIX_ARC_Backdoor_Kankan_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect kankan PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "6910ecc7-3c31-569b-a7ff-2dcbccff88f9"
+		id = "b93f668f-28c1-5f0e-9859-9c527c7367bf"
 		date = "2013-08-01"
 		modified = "2020-08-14"
 		reference = "https://threatpoint.checkpoint.com/ThreatPortal/threat?threatType=malwarefamily&threatId=650"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_backdoor_kankan_pdb.yar#L1-L27"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "73f9e28d2616ee990762ab8e0a280d513f499a5ab2cae9f8cf467701f810b98a"
-		logic_hash = "3d2e45631dfca0e76e98eee4bb5c4ce1631906f497c052d8c41cc37637cb2760"
+		logic_hash = "v1_sha256_3d2e45631dfca0e76e98eee4bb5c4ce1631906f497c052d8c41cc37637cb2760"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -197047,21 +197117,21 @@ rule TRELLIX_ARC_Backdoor_Kankan_Pdb : BACKDOOR FILE
 		$pdb2 = "\\Projects\\OfficeAddinXJ\\VOCEnhUD\\Release\\VOCEnhUD.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and any of them
 }
 rule TRELLIX_ARC_Malw_Likseput_Backdoor_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect Likseput backdoor based on the PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "2193daf8-016b-5f49-97ec-b821c8da22f6"
+		id = "a9ff02fa-87d5-5d9f-8878-5afc8a3cfbaa"
 		date = "2011-03-26"
 		modified = "2020-08-14"
 		reference = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/bkdr_likseput.e"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_likseput_backdoor_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "993b36370854587f4eef3366562f01ab87bc4f7b88a21f07b44bd5051340386d"
-		logic_hash = "2afc4b7e6a5f0d9fed9a075aebaac8157e843c83c55c3f2255431bb6a03459ec"
+		logic_hash = "v1_sha256_2afc4b7e6a5f0d9fed9a075aebaac8157e843c83c55c3f2255431bb6a03459ec"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -197075,21 +197145,21 @@ rule TRELLIX_ARC_Malw_Likseput_Backdoor_Pdb : BACKDOOR FILE
 		$pdb = "\\work\\code\\2008-7-8muma\\mywork\\winInet_winApplication2009-8-7\\mywork\\aaaaaaa\\Release\\aaaaaaa.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and any of them
 }
 rule TRELLIX_ARC_Vpnfilter : BACKDOOR FILE
 {
 	meta:
 		description = "Filter for 2nd stage malware used in VPNfilter attack"
 		author = "Christiaan Beek @ McAfee Advanced Threat Research"
-		id = "89bd7f94-d73c-5c5c-a3ec-0331f79e61fd"
+		id = "5c02ae4e-b18c-5b81-bef4-77d39b774903"
 		date = "2018-05-23"
 		modified = "2020-08-14"
 		reference = "https://blog.talosintelligence.com/2018/05/VPNFilter.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_VPNfilter.yar#L1-L40"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "9eb6c779dbad1b717caa462d8e040852759436ed79cc2172692339bc62432387"
-		logic_hash = "88f08765dff632f0c08e985181309e5c3ac9cdaa51d05d8485c411fb1a183cca"
+		logic_hash = "v1_sha256_88f08765dff632f0c08e985181309e5c3ac9cdaa51d05d8485c411fb1a183cca"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -197117,21 +197187,21 @@ rule TRELLIX_ARC_Vpnfilter : BACKDOOR FILE
 		$s15 = "Name not unique on network" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <500KB and (8 of them )) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 500KB and ( 8 of them ) ) or ( all of them )
 }
 rule TRELLIX_ARC_Alina_POS_PDB : POS FILE
 {
 	meta:
 		description = "Rule to detect Alina POS"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "9588aa10-d5e4-55f4-998c-a01503a53d3a"
+		id = "53920fc8-b74b-5624-b78a-7f67e8103578"
 		date = "2013-08-08"
 		modified = "2020-08-14"
 		reference = "https://www.pandasecurity.com/mediacenter/pandalabs/alina-pos-malware/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_alina_pos_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "28b0c52c0630c15adcc857d0957b3b8002a4aeda3c7ec40049014ce33c7f67c3"
-		logic_hash = "9bb8260e3a47567e2460dd474fb74e57987e3d79eb30cdbc2a45b88a16ba1ca2"
+		logic_hash = "v1_sha256_9bb8260e3a47567e2460dd474fb74e57987e3d79eb30cdbc2a45b88a16ba1ca2"
 		score = 75
 		quality = 70
 		tags = "POS, FILE"
@@ -197145,21 +197215,21 @@ rule TRELLIX_ARC_Alina_POS_PDB : POS FILE
 		$pdb = "\\Users\\dice\\Desktop\\SRC_adobe\\src\\grab\\Release\\Alina.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and any of them
 }
 rule TRELLIX_ARC_Redline_Payload : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the RedLine payload"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "61c2032f-1e6b-5123-8f99-ff83ae95e8a9"
+		id = "afb3bf8d-4098-53ab-8e97-7bc0fc3982ce"
 		date = "2020-04-16"
 		modified = "2020-08-14"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_redline.yar#L1-L38"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "5df956f08d6ad0559efcdb7b7a59b2f3b95dee9e2aa6b76602c46e2aba855eff"
-		logic_hash = "44df161b7434b9137ca5bb919eb314f8447b216b3f6e1214606a898fb36ee4f4"
+		logic_hash = "v1_sha256_44df161b7434b9137ca5bb919eb314f8447b216b3f6e1214606a898fb36ee4f4"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -197180,21 +197250,21 @@ rule TRELLIX_ARC_Redline_Payload : BACKDOOR FILE
 		$p2 = { 03 00 c6 01 cd 06 13 03 79 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of ($s*) and all of ($op*) or all of ($p*)
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of ( $s* ) and all of ( $op* ) or all of ( $p* )
 }
 rule TRELLIX_ARC_Rtf_Bluetea_Builder : MALDOC FILE
 {
 	meta:
 		description = "Rule to detect the RTF files created to distribute BlueTea trojan"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "20e4f7b2-b36c-5724-a3aa-4216ed6265ab"
+		id = "f8497477-ae84-56fb-9c45-9d188afd7d96"
 		date = "2020-04-21"
 		modified = "2020-08-14"
 		reference = "https://blog.360totalsecurity.com/en/bluetea-action-drive-the-life-trojan-update-email-worm-module-and-spread-through-covid-19-outbreak/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALDOC_rtf_bluetea_builder.yar#L1-L30"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "4a3eeaed22342967a95302a4f087b25f50d61314facc6791f756dcd113d4f277"
-		logic_hash = "6c4007fb7ef4819141db63050215dcbb3d2c17e7cdcdbb6cfb4f4b045bb5736b"
+		logic_hash = "v1_sha256_6c4007fb7ef4819141db63050215dcbb3d2c17e7cdcdbb6cfb4f4b045bb5736b"
 		score = 75
 		quality = 70
 		tags = "MALDOC, FILE"
@@ -197208,21 +197278,21 @@ rule TRELLIX_ARC_Rtf_Bluetea_Builder : MALDOC FILE
 		$sequence = { 7B??72??6631??????65666C616E6731??32??????????69??????????????67????36??75??32??????656666????35????????656666????????73??666462????33??35????????74??68????????68????????36??73??73??66??????68????????36??73??73??6662????5C646566??616E6731??33??5C646566??616E67666532??35????????656D656C616E6731??33??5C74??656D656C616E67666532??35????????656D656C616E6763????7B??666F6E74??62??????6630??????69??????????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????6631??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??5C6633????6662????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??6120????74??3B????0A????6633??5C6662????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6633??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??5C2763????2763????2763????276535????????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??613B????5C6662????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????666C6F6D69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6E6F72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????69????????????31??????????62????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6662????69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??6634??5C6662????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??0A????6631??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C6633??30??????69??????????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????74??20????3B????5C6633??31??????69??????????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????74??20????72??7D??5C6633??33??????69??????????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????74??20????6565??????0D????????33??34??6662????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120????74??20??????3B????5C6633??375C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????74??20????6C74??63??7D??5C6633??38??????69??????????????6D616E5C6663????72??6574??3633??????72??32??43616D62????6120????74??20??5669????????????73??29??7D??5C6634??30??????69??????????????69????????????6172??6574??33??5C6670??71??20????6C69????????????3B????0A????6634??31??????69??????????????69????????????6172??6574??30????6670??71??20????6C69????????????72??7D??5C6634??33??????69??????????????69????????????6172??6574??3631??????72??32??43616C69????????????6565??????7B??6634??34??6662????69??????????69????????????6172??6574??3632??????72??32??43616C69????????????72??7D??5C6634??375C6662????69??????????69????????????6172??6574??38??5C6670??71??20????6C69????????????6C74??63??7D??0A????6634??38??????69??????????????69????????????6172??6574??3633??????72??32??43616C69????????????69????????????73??29??7D??5C6634??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????2763????2763????2763????276535????????74??72??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????72??7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????6565??????7B??66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120??????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????6C74??63??7D??5C66??????616A?? }
 
 	condition:
-		uint16(0)==0x5c7b and filesize <100KB and all of them
+		uint16( 0 ) == 0x5c7b and filesize < 100KB and all of them
 }
 rule TRELLIX_ARC_Malw_Medfos : TROJAN FILE
 {
 	meta:
 		description = "Rule to detect Medfos trojan based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "07ad0227-ca8f-5071-8ef7-8c3e087fcc35"
+		id = "566f66a3-1124-58a9-8296-b95d54292aca"
 		date = "2013-04-19"
 		modified = "2020-08-14"
 		reference = "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=win32%2Fmedfos"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_medfos_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "3582e242f62598445ca297c389cae532613afccf48b16e9c1dcf1bfedaa6e14f"
-		logic_hash = "1726462a806f5cb3f0b80596623cebc51a7a9f866ded0cb59ea1c43034ce2819"
+		logic_hash = "v1_sha256_1726462a806f5cb3f0b80596623cebc51a7a9f866ded0cb59ea1c43034ce2819"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -197236,21 +197306,21 @@ rule TRELLIX_ARC_Malw_Medfos : TROJAN FILE
 		$pdb = "\\som\\bytguqne\\jzexsaf\\gyin.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and any of them
 }
 rule TRELLIX_ARC_Kelihos_Botnet_Pdb : BOTNET FILE
 {
 	meta:
 		description = "Rule to detect Kelihos malware based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "2b6683a1-ba19-586b-8a92-89d4764efa12"
+		id = "27b8d370-d678-5bbb-b71c-f9cc0507cd0d"
 		date = "2013-09-04"
 		modified = "2020-08-14"
 		reference = "https://www.malwaretech.com/2017/04/the-kelihos-botnet.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_kelhios_botnet_pdb.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "f0a6d09b5f6dbe93a4cf02e120a846073da2afb09604b7c9c12b2e162dfe7090"
-		logic_hash = "f60fb85161f86653f390b444d568da24cf07b3be99856230156741e8451e2a3f"
+		logic_hash = "v1_sha256_f60fb85161f86653f390b444d568da24cf07b3be99856230156741e8451e2a3f"
 		score = 75
 		quality = 70
 		tags = "BOTNET, FILE"
@@ -197265,20 +197335,20 @@ rule TRELLIX_ARC_Kelihos_Botnet_Pdb : BOTNET FILE
 		$pdb1 = "\\To\\Access\\Do.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1440KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 1440KB and any of them
 }
 rule TRELLIX_ARC_MALW_Cobaltrike : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect CobaltStrike beacon"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a7dae4c7-672e-58fb-8542-90fa90d991a4"
+		id = "86e59c74-97c1-57b0-89c7-e4ee4e36fe8a"
 		date = "2020-07-19"
 		modified = "2021-08-30"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_cobaltstrike.yar#L1-L38"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "fc91d40c6544c7ab7c60b3cb8fc542bd4a6fac79dbe00cad8f612854f2a6dcd1"
+		logic_hash = "v1_sha256_fc91d40c6544c7ab7c60b3cb8fc542bd4a6fac79dbe00cad8f612854f2a6dcd1"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -197308,21 +197378,21 @@ rule TRELLIX_ARC_MALW_Cobaltrike : BACKDOOR FILE
 		$pattern_15 = { 752c 4c8d45af 488d55af 488d4d27 }
 
 	condition:
-		7 of them and filesize <696320
+		7 of them and filesize < 696320
 }
 rule TRELLIX_ARC_Dropper_Demekaf_Pdb : DROPPER FILE
 {
 	meta:
 		description = "Rule to detect Demekaf dropper based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "b49f42c1-d737-5afa-b547-7268e4cde360"
+		id = "a0e85816-0fcd-5d5d-92e0-c3e9a02b41d6"
 		date = "2011-03-26"
 		modified = "2020-08-14"
 		reference = "https://v.virscan.org/Trojan-Dropper.Win32.Demekaf.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_dropper_demekaf_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "fab320fceb38ba2c5398debdc828a413a41672ce9745afc0d348a0e96c5de56e"
-		logic_hash = "89c0c1da1f8997b12a446c93bbde200e62fac9cab2a9a17147b268d435bdc3b6"
+		logic_hash = "v1_sha256_89c0c1da1f8997b12a446c93bbde200e62fac9cab2a9a17147b268d435bdc3b6"
 		score = 75
 		quality = 70
 		tags = "DROPPER, FILE"
@@ -197336,21 +197406,21 @@ rule TRELLIX_ARC_Dropper_Demekaf_Pdb : DROPPER FILE
 		$pdb = "\\vc\\res\\fake1.19-jpg\\fake\\Release\\fake.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and any of them
 }
 rule TRELLIX_ARC_Downloader_Darkmegi_Pdb : DOWNLOADER FILE
 {
 	meta:
 		description = "Rule to detect DarkMegi downloader based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "3ccc3685-e05b-5620-9198-24733fb1e7eb"
+		id = "fd6b8183-4da3-5d1f-99b7-ca7d0e1d04ed"
 		date = "2013-03-06"
 		modified = "2020-08-14"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmegi"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_downloader_darkmegi.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "bf849b1e8f170142176d2a3b4f0f34b40c16d0870833569824809b5c65b99fc1"
-		logic_hash = "47faf8c5296e651f82726a6e8a7843dfa0f98e7be7257d2c03efcff550f52140"
+		logic_hash = "v1_sha256_47faf8c5296e651f82726a6e8a7843dfa0f98e7be7257d2c03efcff550f52140"
 		score = 75
 		quality = 70
 		tags = "DOWNLOADER, FILE"
@@ -197364,20 +197434,20 @@ rule TRELLIX_ARC_Downloader_Darkmegi_Pdb : DOWNLOADER FILE
 		$pdb = "\\RKTDOW~1\\RKTDRI~1\\RKTDRI~1\\objchk\\i386\\RktDriver.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20000KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize > 20000KB and any of them
 }
 rule TRELLIX_ARC_MALW_Fritzfrog : BOTNET FILE
 {
 	meta:
 		description = "Rule to detect Fritzfrog"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "4c553279-7e0c-5602-944d-ad8a47edf4ea"
+		id = "10abeaa3-f827-50b1-b9b3-7544ccc3fe8a"
 		date = "2020-08-20"
 		modified = "2020-08-20"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_fritzfrog.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "488c807ecf0a9e981b2c1f2f5bb2e3072952d11f7cbf3a354bc85dc8e88b8b09"
+		logic_hash = "v1_sha256_488c807ecf0a9e981b2c1f2f5bb2e3072952d11f7cbf3a354bc85dc8e88b8b09"
 		score = 75
 		quality = 70
 		tags = "BOTNET, FILE"
@@ -197393,21 +197463,21 @@ rule TRELLIX_ARC_MALW_Fritzfrog : BOTNET FILE
 		$pattern = { 7F454C4602010100000000000000000002003E000100000090D34500000000004000000000000000C8010000000000000000000040003800070040000D000300060000000400000040000000000000004000400000000000400040000000000088010000000000008801000000000000001000000000000004000000040000009C0F0000000000009C0F4000000000009C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000083F23E000000000083F23E00000000000010000000000000010000000400000000003F000000000000007F000000000000007F00000000006C834500000000006C834500000000000010000000000000010000000600000000908400000000000090C400000000000090C4000000000060EC0400000000005809070000000000001000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000006000000000000000010400000000000001000000000000083E23E00000000000000000000000000100000000000000000000000000000004100000001000000020000000000000000007F000000000000003F0000000000C0271B0000000000000000000000000020000000000000000000000000000000720000000300000000000000000000000000000000000000C0275A00000000007C000000000000000000000000000000010000000000000000000000000000004900000001000000020000000000000040289A000000000040285A0000000000D83600000000000000000000000000002000000000000000000000000000000053000000010000000200000000000000185F9A0000000000185F5A0000000000380D0000000000000000000000000000080000000000000000000000000000005D000000010000000200000000000000506C9A0000000000506C5A0000000000000000000000000000000000000000000100000000000000000000000000000067000000010000000200000000000000606C9A0000000000606C5A00000000000C172A0000000000000000000000000020000000000000000000000000000000070000000100000003000000000000000090C400000000000090840000000000004B0300000000000000000000000000200000000000000000000000000000001200000001000000030000000000000000DBC7000000000000DB87000000000050A101000000000000000000000000002000000000000000000000000000000018000000080000000300000000000000607CC90000000000607C890000000000D0E80100000000000000000000000000200000000000000000000000000000001D0000000800000003000000000000004065CB000000000040658B00000000001834000000000000000000000000000020000000000000000000000000000000270000000700000002000000000000009C0F4000000000009C0F00000000000064000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
 
 	condition:
-		uint16(0)==0x457f and filesize <26000KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 26000KB and all of them
 }
 rule TRELLIX_ARC_Masslogger_Stealer : STEALER FILE
 {
 	meta:
 		description = "Rule to detect unpacked MassLogger stealer"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "c3a40108-3f0c-5949-9201-95c3c38b352a"
+		id = "47f6b145-a301-5c06-93a7-2b3bb6fef751"
 		date = "2020-07-02"
 		modified = "2020-08-14"
 		reference = "https://urlhaus.abuse.ch/browse/signature/MassLogger/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_masslogger_stealer.yar#L1-L63"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "343873155b6950386f7d9bcd8d2b2e81088521aedf8ff1333d20229426d8145c"
-		logic_hash = "476b3f3a54a4616058a2aef01adbe429a38eacc8ee58881d31bd28e795a27575"
+		logic_hash = "v1_sha256_476b3f3a54a4616058a2aef01adbe429a38eacc8ee58881d31bd28e795a27575"
 		score = 75
 		quality = 66
 		tags = "STEALER, FILE"
@@ -197460,20 +197530,20 @@ rule TRELLIX_ARC_Masslogger_Stealer : STEALER FILE
 		$pattern_39 = { 3400 b687 bc083c00cd 87ce 083400 }
 
 	condition:
-		7 of them and filesize <3834880
+		7 of them and filesize < 3834880
 }
 rule TRELLIX_ARC_Shellcode_Mykins_Botnet : SHELLCODE FILE
 {
 	meta:
 		description = "Rule to detect the shellcode used in the MyKins Botnet"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "9dc80b27-59e2-5925-9bb7-64a54241f52b"
+		id = "1806edc7-8e16-52cf-9beb-61c00912ee9f"
 		date = "2018-01-24"
 		modified = "2020-08-14"
 		reference = "https://blog.netlab.360.com/mykings-the-botnet-behind-multiple-active-spreading-botnets/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_shellcode_mykins_botnet.yar#L1-L27"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "5fa54c41a423d776d05bdac5b171ee685f54372b4e6aa41b57cce769ac2c6976"
+		logic_hash = "v1_sha256_5fa54c41a423d776d05bdac5b171ee685f54372b4e6aa41b57cce769ac2c6976"
 		score = 75
 		quality = 70
 		tags = "SHELLCODE, FILE"
@@ -197488,21 +197558,21 @@ rule TRELLIX_ARC_Shellcode_Mykins_Botnet : SHELLCODE FILE
 		$b = { E800000000582D051040000500104000C3558BEC8B45082D001040005DC20400558BECFF7508E80A0A000033C05DC20400558BEC8B4D1085C9741F0FB6450C69C0010101018BD153578B7D08C1E902F3AB8BCA83E103F3AA5F5B8B45085DC3558BECE899FFFFFF8B4D0881E90010400003C15DC20400558BEC8B4D0833C066390174084066833C410075F85DC20400558BEC8B450866833800568BF0740983C60266833E0075F78B4D0C2BF10FB7116689140E83C1026685D275F15E5DC20800558BEC8B55088B450C2BD00FB70866890C0283C0026685C975F18B45085DC20800558BEC8B55088B450C2BD08A08880C024084C975F68B45085DC20800558BEC8B4508803800568BF0740646803E0075FA8B4D0C2BF18A1188140E4184D275F65E5DC20800558BEC5633F63975107E2D8B45088B4D0C0FB704700FB70C71663BC174148BD08BC18BCA2BC883F92074072BC283F8207506463B75107CD333C03B75105E0F95C05DC20C00558BEC8B450C8B550850894204E8FAFEFFFF03C066890283C002668942025DC20800558BEC51515733C0668945F88D7DFAAB33C966AB5F394D08741A394D0C7415FF75088D45F850E8B3FFFFFF8D45F850FF550C8BC88BC1C9C20800558BEC51518B45086AFF9968F0D8FFFF5250E8730A00008945F88D45F8506A006A008955FCFF550CC9C20800558BEC83EC248B4508568945F48D45F4508D45DC5033F668FFFF1F008D45FC508975FC8975F8C745DC180000008975E0C745E8400200008975E48975EC8975F0FF550C3975FC5E740E6A01FF75FCFF5510FF75FCFF5514C9C21000558BEC83EC0C538D45FC5033DB538D45F8506A05895DF8895DFCFF55108945F88B45FC3BC3750733C0E99E000000565303C05053FF55148BF08D45FC508B45FC03C050566A05897514FF55108945F83BC374095356FF551833C0EB6F8B45FC33D2B9F8000000F7F1578945FC8B7E3C3BFB742E0FB746383B450C7C252B450C992BC28BC8D1F978198B450C992BC2D1F850FF75088D044F50E83BFEFFFF85C0740A8B063BC3740903F0EBC18B7E44EB028BFB8B451C3BC374083BFB74048930EB0753FF7514FF55188BC75F5E5BC9C21800C21400558BEC837D100074178B4D088B450C2BC88A10FF4D1088140140837D100075F15DC20C00558BECE8B3FCFFFF8B4D0881E90010400003C15DC20400558BEC83EC2C538B5D088B433CB90B010000568B750CC745D44D6D4765C745D874537973C745DC74656D52C745E06F757469C745E46E654164C745E86472657366C745EC730066394C18180F858F0000008B44187803C38B501C8B482003D3578B78248B40188955F033D203CB03FB8955FC8945F485C07466EB038B5D088B149183650C0003D3803A0074238D5DD42BDA8BC2895DF8EB038B5DF88A1C0384DB740D38187509FF450C4080380075E98B450C803C10007507807C05D400740E8B55FC428955FC3B55F472B0EB128B45FC0FB704478B4DF08B048103450889065F8B0685C0750883C8FFE9230200005068D0414000E8F0FEFFFF50E831FDFFFFFF3689464868F0414000E8DBFEFFFF50E81CFDFFFFFF3689464C6818424000E8C6FEFFFF50E807FDFFFFFF368946046844424000E8B1FEFFFF50E8F2FCFFFFFF368946086878424000E89CFEFFFF50E8DDFCFFFFFF3689460C68A8424000E887FEFFFF50E8C8FCFFFFFF3689461068CC424000E872FEFFFF50E8B3FCFFFFFF368946146800434000E85DFEFFFF50E89EFCFFFFFF368946186834434000E848FEFFFF50E889FCFFFFFF3689461C686C434000E833FEFFFF50E874FCFFFFFF36894620687C434000E81EFEFFFF50E85FFCFFFFFF36894624689C434000E809FEFFFF50E84AFCFFFFFF3689462868C0434000E8F4FDFFFF50E835FCFFFFFF3689462C68DC434000E8DFFDFFFF50E820FCFFFFFF368946306810444000E8CAFDFFFF50E80BFCFFFFFF36894634684C444000E8B5FDFFFF50E8F6FBFFFFFF368946386874444000E8A0FDFFFF50E8E1FBFFFFFF3689463C68A0444000E88BFDFFFF50E8CCFBFFFFFF3689464068D0444000E876FDFFFF50E8B7FBFFFFFF3689464468EC444000E861FDFFFF50E8A2FBFFFFFF368946506808454000E84CFDFFFF50E88DFBFFFFFF368946546830454000E837FDFFFF50E878FBFFFFFF36894658685C454000E822FDFFFF50E863FBFFFFFF3689465C6870454000E80DFDFFFF50E84EFBFFFFFF368946606890454000E8F8FCFFFF50E839FBFFFFFF3689466468AC454000E8E3FCFFFF50E824FBFFFF89466833C05E5BC9C20800558BEC81EC5C020000535633DB5768030100008D85A5FDFFFF5350895DF8895DE8895DDC895DF4895DFC889DA4FDFFFFE889F9FFFF8B7D0C83C40C8D85A8FEFFFF50C785A8FEFFFF1C010000FF574483BDACFEFFFF05751283BDB0FEFFFF02743983BDB0FEFFFF01EB2E83BDACFEFFFF06750E399DB0FEFFFF7510807DC201751983C8FF5F5E5BC9C20C0083BDB0FEFFFF0175ED807DC20175E78B751056FF7508FF571C391E74D95368000000086A408D45EC508D45C4506A0E8D45E850C745EC47250000895DF0C745C418000000895DC8C745D000020000895DCC895DD4895DD8FF5748395DE875056AFE58EB955368000000086A048D45EC508D45C4506A068D45DCBE0B4C1000508975EC895DF0C745C418000000895DC8C745D000020000895DCC895DD4895DD8FF57488B45108D480451FF30894DE0FF573C6A40536A028D45F850536800200000538D45FC506AFFFF75E8FF574C6A04536A028D45F8505356538D45F4506AFFFF75DC895DF88975EC895DF0FF574C395DFC0F84330200008B75F43BF30F8428020000895E048B85B4FEFFFF8946108B85ACFEFFFF8946088B85B0FEFFFF89460C6A0C5889462C8946308B4510C7060C3C1000C7462830000000C746342C000000C7463818000000C7463CA80100008B401C894618895D0C6840464000E800F8FFFF8BC88B450C8A0C0180F10D888C05A4FDFFFF4089450C3D040100007CD98D8DA4FDFFFF8D46405150E855F8FFFF6844474000E8C9F7FFFF508D464050E85DF8FFFF8B45108B40283BC3742C8B4E1883F902750A8B40200504020000EB0D83F90375158B40200500010000508D860001000050E80BF8FFFFE825F7FFFFB9881C400081E90010400003C189450C33C9EB038B450C8A04088B55FC88040A4181F94825000072EB535353680C3C100056FF572C8BF03BF37460536A0156FF57386A1053536A015356FF57348B75108946203BC37447C680040200004E8B4620C68005020000538B4620C680060200002E8B4620C68007020000658B4620C68008020000788B4620C68009020000658B462088980A020000EB038B75108B46243BC30F8497000000895D083958040F868B000000895D0C8B46248B4D0C8B8401DC0000008D4D105150895D10FF5714395D107455FF7510FF57683B06754B536A3053FF57048945E43BC3743DE833F6FFFF53B91E13400081E90010400003C18B4DFC6A0183C12051535053FF7510FF75E4FF57245353FF75F4FF75E4FF5728FF770C6A01E8C1F7FFFFFF45088B46248B4D0883450C403B48040F8278FFFFFFFF75E0FF574033C0E9CFFCFFFFFF75E0FF57406AFDE92AFDFFFF558BEC81EC0C020000565733F66A688D8540FFFFFF565089B53CFFFFFFE8DAF5FFFF83C40C6A0A5933C06A0A8975A88D7DACF3AB5989B510FFFFFF8DBD14FFFFFFF3AB8D45A8898538FFFFFF8D853CFFFFFF50FF7508C745C401000000C7852CFFFFFF02000000E8BBF8FFFF85C00F8582010000538D85F4FDFFFF50C785F4FDFFFF1C010000FF5580BBEC45400083BDF8FDFFFF05750353EB0568D0454000E86CF8FFFF8D4DCC51FFB54CFFFFFFFFB540FFFFFFFFB544FFFFFF6A1850E856F7FFFFFFB548FFFFFF8BF83BFE750C68D0070000E8B9F6FFFFEBB46888130000E8ADF6FFFF8D45A8508D853CFFFFFF5057E849FBFFFF85C00F85F8000000EB10FFB548FFFFFF68D0070000E882F6FFFF8B45C883781C0175E783BDF8FDFFFF05750E6808464000E8E5F7FFFF6A16EB0C68D0454000E8D7F7FFFF6A18598D9534FFFFFF52FFB54CFFFFFFFFB540FFFFFFFFB544FFFFFF5150E8BCF6FFFF }
 
 	condition:
-		filesize <1KB and any of them
+		filesize < 1KB and any of them
 }
 rule TRELLIX_ARC_Malw_Mangzamel_Trojan : TROJAN FILE
 {
 	meta:
 		description = "Rule to detect Mangzamel  trojan based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "ca77180f-6133-5edb-a36b-78bc6f18d80c"
+		id = "f9d42396-155f-57d1-bc17-f2763769d9c5"
 		date = "2014-06-25"
 		modified = "2020-08-14"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mangzamel"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_mangzamel_trojan_pdb.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "4324580ea162a636b7db1efb3a3ba38ce772b7168b4eb3a149df880a47bd72b7"
-		logic_hash = "bab103c671445e0ea916fae290689d30d45021bdca58a495ebd3d6ca9ca55051"
+		logic_hash = "v1_sha256_bab103c671445e0ea916fae290689d30d45021bdca58a495ebd3d6ca9ca55051"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -197517,20 +197587,20 @@ rule TRELLIX_ARC_Malw_Mangzamel_Trojan : TROJAN FILE
 		$pdb1 = "\\Windows\\i386\\ndisdrv.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <360KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 360KB and any of them
 }
 rule TRELLIX_ARC_Nionspy : FILEINFECTOR FILE
 {
 	meta:
 		description = "Triggers on old and new variants of W32/NionSpy file infector"
 		author = "Trellix ARC Team"
-		id = "86051ef8-a18b-553c-b06c-490f8d6df5cf"
+		id = "b5198288-cc62-510b-9500-b1d75dee84fd"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://blogs.mcafee.com/mcafee-labs/taking-a-close-look-at-data-stealing-nionspy-file-infector"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_NionSpy.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "982ba52f39352aee9e2d2dcadfb0816c439e92d0e5947afa7860630720913742"
+		logic_hash = "v1_sha256_982ba52f39352aee9e2d2dcadfb0816c439e92d0e5947afa7860630720913742"
 		score = 75
 		quality = 70
 		tags = "FILEINFECTOR, FILE"
@@ -197545,21 +197615,21 @@ rule TRELLIX_ARC_Nionspy : FILEINFECTOR FILE
 		$variant2013_string = "%s?cstorage=shell&comp=%s"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 1 of ($variant*)
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and 1 of ( $variant* )
 }
 rule TRELLIX_ARC_Malw_Eicar : EICAR
 {
 	meta:
 		description = "Rule to detect the EICAR pattern"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "16307b03-7fab-5d68-ad3b-0efcea952fcf"
+		id = "34bd1b3f-753d-5a72-9f58-0cb2bc04a804"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://www.eicar.org/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_Eicar.yar#L1-L22"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
-		logic_hash = "564b0592f40582fe71e2dab0c0f25c168462f9297c13e7c9f06ac51b492e4533"
+		logic_hash = "v1_sha256_564b0592f40582fe71e2dab0c0f25c168462f9297c13e7c9f06ac51b492e4533"
 		score = 75
 		quality = 70
 		tags = "EICAR"
@@ -197579,14 +197649,14 @@ rule TRELLIX_ARC_Havex_Backdoor_Pdb : BACKDOOR FILE
 	meta:
 		description = "Rule to detect backdoor Havex based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "a667bb4e-8c38-59a6-8ae0-09c44961a687"
+		id = "19684a5c-a37e-5ba9-a70f-ad4edb9036f2"
 		date = "2012-11-17"
 		modified = "2020-08-14"
 		reference = "https://www.f-secure.com/v-descs/backdoor_w32_havex.shtml"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_backdoor_havex_pdb.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "0f4046be5de15727e8ac786e54ad7230807d26ef86c3e8c0e997ea76ab3de255"
-		logic_hash = "dc50475b1ff2194306a0295f71860e4cc5ae7e126daa5d401b98cd2a0aadf1dd"
+		logic_hash = "v1_sha256_dc50475b1ff2194306a0295f71860e4cc5ae7e126daa5d401b98cd2a0aadf1dd"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -197601,21 +197671,21 @@ rule TRELLIX_ARC_Havex_Backdoor_Pdb : BACKDOOR FILE
 		$pdb1 = "\\Workspace\\PhalangX 3D\\Src\\Build\\Release\\Tmprovider.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and any of them
 }
 rule TRELLIX_ARC_Jatboss : PHISHING FILE
 {
 	meta:
 		description = "Rule to detect PDF files from Jatboss campaign and MSG files that contained those attachents"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "009a7486-2ee8-57ef-8dfd-fcbd035b4e85"
+		id = "7ed62fb1-1922-5f04-9403-1a2714a2df5f"
 		date = "2019-12-04"
 		modified = "2020-08-14"
 		reference = "https://exchange.xforce.ibmcloud.com/collection/JATBOSS-Phishing-Kit-17c74b38860de5cb9fc727e6c0b6d5b5"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_jatboss.yar#L1-L36"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "b81fb37dc48812f6ad61984ecf2a8dbbfe581120257cb4becad5375a12e755bb"
-		logic_hash = "5e6e4c8f6c0896623f166a98eb83a9a4f23139306671cf2e35ba239b2dc191fc"
+		logic_hash = "v1_sha256_5e6e4c8f6c0896623f166a98eb83a9a4f23139306671cf2e35ba239b2dc191fc"
 		score = 75
 		quality = 66
 		tags = "PHISHING, FILE"
@@ -197631,20 +197701,20 @@ rule TRELLIX_ARC_Jatboss : PHISHING FILE
 		$spam = { 54 00 68 00 69 00 73 00 20 00 65 00 2D 00 6D 00 61 00 69 00 6C 00 20 00 61 00 6E 00 64 00 20 00 61 00 6E 00 79 00 20 00 61 00 74 00 74 00 61 00 63 00 68 00 6D 00 65 00 6E 00 74 00 20 00 61 00 72 00 65 00 20 00 43 00 6F 00 6E 00 66 00 69 00 64 00 65 00 6E 00 74 00 69 00 61 00 6C 00 2E 00 }
 
 	condition:
-		( uint16(0)==0x5025 and filesize <1000KB and ($jat or $jatboss)) or ( uint16(0)==0xcfd0 and $spam and any of ($jat*))
+		( uint16( 0 ) == 0x5025 and filesize < 1000KB and ( $jat or $jatboss ) ) or ( uint16( 0 ) == 0xcfd0 and $spam and any of ( $jat* ) )
 }
 rule TRELLIX_ARC_Cyaxsharp_Rezer0 : LOADER
 {
 	meta:
 		description = "Detects CyaX-Sharp/ReZer0 loader samples based on the embedded scheduled task template"
 		author = "Max 'Libra' Kersten for McAfee's Advanced Threat Research Team"
-		id = "7a1addcf-4e8f-5290-8788-9b0738128160"
+		id = "3f88e77e-39c6-5178-97b9-f7141429dcfc"
 		date = "2021-04-08"
 		modified = "2021-08-04"
 		reference = "This rule was published in combination with the following McAfee ATR blog: https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/see-ya-sharp-a-loaders-tale/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MAL_cyax_sharp_loader.yar#L1-L16"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "3d6daaf7a85a9b3898e4ce5d5293b09f26965f9f7280b34ba8f6814b7f14dec2"
+		logic_hash = "v1_sha256_3d6daaf7a85a9b3898e4ce5d5293b09f26965f9f7280b34ba8f6814b7f14dec2"
 		score = 75
 		quality = 70
 		tags = "LOADER"
@@ -197662,14 +197732,14 @@ rule TRELLIX_ARC_Dridex_P2P_Pdb : BACKDOOR FILE
 	meta:
 		description = "Rule to detect Dridex P2P based on the PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "57350c96-877e-57de-9465-df9f7eb6d656"
+		id = "c1095b7b-49ef-508c-b8d4-12e30436dce4"
 		date = "2014-11-29"
 		modified = "2020-08-14"
 		reference = "https://www.us-cert.gov/ncas/alerts/aa19-339a"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_dridex_p2p_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "5345a9405212f3b8ef565d5d793e407ae8db964865a85c97e096295ba3f39a78"
-		logic_hash = "c9c4db48435203cdb882eef8082efd8424bd13f1aa512cfb3082f365b9bc6e83"
+		logic_hash = "v1_sha256_c9c4db48435203cdb882eef8082efd8424bd13f1aa512cfb3082f365b9bc6e83"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -197683,20 +197753,20 @@ rule TRELLIX_ARC_Dridex_P2P_Pdb : BACKDOOR FILE
 		$pdb = "\\c0da\\j.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and any of them
 }
 rule TRELLIX_ARC_MALW_Emotet : FINANCIAL FILE
 {
 	meta:
 		description = "Rule to detect unpacked Emotet"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "5bc83065-dfdd-56b7-9983-200bff35c8b1"
+		id = "34126ea4-785c-5415-b00f-05e35ef88b73"
 		date = "2020-07-21"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_emotet.yar#L1-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "223e4453a6c3b56b0bc0f91147fa55ea59582d64b8a5c08f1f8d06026044065e"
+		logic_hash = "v1_sha256_223e4453a6c3b56b0bc0f91147fa55ea59582d64b8a5c08f1f8d06026044065e"
 		score = 75
 		quality = 70
 		tags = "FINANCIAL, FILE"
@@ -197721,21 +197791,21 @@ rule TRELLIX_ARC_MALW_Emotet : FINANCIAL FILE
 		$pattern_9 = { 5e 8be5 5d c3 55 8bec }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize < 180224
 }
 rule TRELLIX_ARC_Festi_Botnet_Pdb : BOTNET FILE
 {
 	meta:
 		description = "Rule to detect the Festi botnet based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "02f4149d-b8ac-5852-8cbe-c47f4cddcba6"
+		id = "32ef12a2-ea79-5927-a4b0-e03e307f8a40"
 		date = "2013-03-04"
 		modified = "2020-08-14"
 		reference = "https://www.welivesecurity.com/2012/05/11/king-of-spam-festi-botnet-analysis/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_festi_botnet_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "e55913523f5ae67593681ecb28d0fa1accee6739fdc3d52860615e1bc70dcb99"
-		logic_hash = "46e2576900fe94d614a683d4f09079b7ac78654079b2e558d076bcb42db4bf11"
+		logic_hash = "v1_sha256_46e2576900fe94d614a683d4f09079b7ac78654079b2e558d076bcb42db4bf11"
 		score = 75
 		quality = 70
 		tags = "BOTNET, FILE"
@@ -197749,21 +197819,21 @@ rule TRELLIX_ARC_Festi_Botnet_Pdb : BOTNET FILE
 		$pdb = "\\eclipse\\botnet\\drivers\\Bin\\i386\\kernel.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 80KB and any of them
 }
 rule TRELLIX_ARC_Screenlocker_5H311_1Nj3C706 : SCREENLOCKER FILE
 {
 	meta:
 		description = "Rule to detect the screenlocker 5h311_1nj3c706"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "50bbe8e1-4721-5277-b786-d2a2d9acf917"
+		id = "cef0ad3b-6cbc-5755-b9f8-63868f826964"
 		date = "2018-08-07"
 		modified = "2020-08-14"
 		reference = "https://twitter.com/demonslay335/status/1038060120461266944"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_screenlocker_5h311_1nj3c706.yar#L1-L33"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "016ee638bd4fccd5ca438c2e0abddc4b070f59269c08f11c5313ba9c37190718"
-		logic_hash = "61b4495841c77053ba2631f087197719f3ee45cd93add022f23b87ece8563619"
+		logic_hash = "v1_sha256_61b4495841c77053ba2631f087197719f3ee45cd93add022f23b87ece8563619"
 		score = 75
 		quality = 70
 		tags = "SCREENLOCKER, FILE"
@@ -197785,21 +197855,21 @@ rule TRELLIX_ARC_Screenlocker_5H311_1Nj3C706 : SCREENLOCKER FILE
 		$s9 = "After we receive Bitcoin from you. We will send key to your email." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule TRELLIX_ARC_Malw_Browser_Fox_Adware : ADWARE FILE
 {
 	meta:
 		description = "Rule to detect Browser Fox Adware based on the PDB reference"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "67d20c3a-4e9d-5fbf-b26a-d7b5fb270d12"
+		id = "d0b1a6e2-d2e6-53a6-86f1-4f975c961c67"
 		date = "2015-01-15"
 		modified = "2020-08-14"
 		reference = "https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Browse%20Fox.aspx"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_browser_fox_adware.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "c6f3d6024339940896dd18f32064c0773d51f0261ecbee8b0534fdd9a149ac64"
-		logic_hash = "462a05de46ec0d710cac80a05d4935279a43f49cbd5ef49c072f277982a76fce"
+		logic_hash = "v1_sha256_462a05de46ec0d710cac80a05d4935279a43f49cbd5ef49c072f277982a76fce"
 		score = 75
 		quality = 70
 		tags = "ADWARE, FILE"
@@ -197813,21 +197883,21 @@ rule TRELLIX_ARC_Malw_Browser_Fox_Adware : ADWARE FILE
 		$pdb = "\\Utilities\\130ijkfv.o4g\\Desktop\\Desktop.OptChecker\\bin\\Release\\ BooZaka.Opt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and any of them
 }
 rule TRELLIX_ARC_Kartoxa_Malware_Pdb : POS FILE
 {
 	meta:
 		description = "Rule to detect Kartoxa POS based on the PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "3d2dbf22-5d8f-5f19-9048-2d021ada22c8"
+		id = "a8604a84-e463-52b2-9965-443a859eec5b"
 		date = "2010-10-09"
 		modified = "2020-08-14"
 		reference = "https://securitynews.sonicwall.com/xmlpost/guatambu-new-multi-component-infostealer-drops-kartoxa-pos-malware-apr-08-2016/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_backdoor_katorxa_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "86dd21b8388f23371d680e2632d0855b442f0fa7e93cd009d6e762715ba2d054"
-		logic_hash = "6e1810af386f3aada4cd1d72f76d8210d201808c8fe1d21d379ff1a825d93710"
+		logic_hash = "v1_sha256_6e1810af386f3aada4cd1d72f76d8210d201808c8fe1d21d379ff1a825d93710"
 		score = 75
 		quality = 70
 		tags = "POS, FILE"
@@ -197841,20 +197911,20 @@ rule TRELLIX_ARC_Kartoxa_Malware_Pdb : POS FILE
 		$pdb = "\\vm\\devel\\dark\\mmon\\Release\\mmon.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and any of them
 }
 rule TRELLIX_ARC_Msworldexploit_Builder_Doc : MALDOC FILE
 {
 	meta:
 		description = "Rule to detect RTF/Docs files created by MsWordExploit Builder"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "6c4c091b-5fce-583a-bc17-31830251892c"
+		id = "16afb49b-54e0-5691-bb5f-0ce1765c81ac"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_MsWordExploit_DOC.yar#L1-L24"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "f85c6d79e5ed20084d35f9de92a9d9ce20cf4b3100b1226d64147e366934585d"
+		logic_hash = "v1_sha256_f85c6d79e5ed20084d35f9de92a9d9ce20cf4b3100b1226d64147e366934585d"
 		score = 75
 		quality = 68
 		tags = "MALDOC, FILE"
@@ -197868,7 +197938,7 @@ rule TRELLIX_ARC_Msworldexploit_Builder_Doc : MALDOC FILE
 		$s2 = "{\\*\\generator mswordexploit 6.3.9600}" fullword ascii
 
 	condition:
-		uint16(0)==0x3030 and filesize <4000KB and any of them
+		uint16( 0 ) == 0x3030 and filesize < 4000KB and any of them
 }
 import "pe"
 
@@ -197877,13 +197947,13 @@ rule TRELLIX_ARC_Trojan_Coinminer : FILE
 	meta:
 		description = "Rule to detect Coinminer malware"
 		author = "Trellix ATR"
-		id = "ec1f4fb7-bce3-5d5b-bbff-50f9bfc90298"
+		id = "ec689431-ff5e-5987-bc93-f10854e480ea"
 		date = "2021-07-22"
 		modified = "2022-01-19"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/miners/Trojan_CoinMiner.yar#L3-L23"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0d9d502eb0a54f90044f42f8ce485a2df6814064172cb7bf006a8c8a51976acd"
+		logic_hash = "v1_sha256_0d9d502eb0a54f90044f42f8ce485a2df6814064172cb7bf006a8c8a51976acd"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -197900,20 +197970,20 @@ rule TRELLIX_ARC_Trojan_Coinminer : FILE
 		$seq5 = { 01 69 8e 1c 39 7b 11 56 38 0f 43 c8 5f a8 62 d0 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and pe.imphash()=="e4290fa6afc89d56616f34ebbd0b1f2c" and 3 of ($seq*))
+		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and pe.imphash ( ) == "e4290fa6afc89d56616f34ebbd0b1f2c" and 3 of ( $seq* ) )
 }
 rule TRELLIX_ARC_MINER_Monero_Mining_Detection : MINER FILE
 {
 	meta:
 		description = "Monero mining software"
 		author = "Trellix ATR team"
-		id = "98ee7711-16ee-58e1-b52f-c68dd5f2b8a3"
+		id = "ed8a925d-f48f-5272-ba30-22c63c8e7445"
 		date = "2018-04-05"
 		modified = "2022-01-19"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/miners/MINER_Monero.yar#L1-L43"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "4c1815186b0eb9e6be5fb0fcad02fd981ac9cf79c485fe12ce4a73054ef9fda2"
+		logic_hash = "v1_sha256_4c1815186b0eb9e6be5fb0fcad02fd981ac9cf79c485fe12ce4a73054ef9fda2"
 		score = 75
 		quality = 70
 		tags = "MINER, FILE"
@@ -197946,20 +198016,20 @@ rule TRELLIX_ARC_MINER_Monero_Mining_Detection : MINER FILE
 		$20 = "-u, --user=USERNAME      username for mining server" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and (8 of them )) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and ( 8 of them ) ) or ( all of them )
 }
 rule TRELLIX_ARC_STEALER_Lokibot : STEALER FILE
 {
 	meta:
 		description = "Rule to detect Lokibot stealer"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "75f502a3-2d9f-5ccf-93f8-2d6a73e9e1b7"
+		id = "4e20ea74-858d-5c35-8fca-83b78a5d376e"
 		date = "2020-09-23"
 		modified = "2020-09-25"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/stealer/STEALER_Lokibot.yar#L1-L39"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "999a69394a545f726cf15e4361e0dfc17eeac6544e6816a0ad140316e9642510"
+		logic_hash = "v1_sha256_999a69394a545f726cf15e4361e0dfc17eeac6544e6816a0ad140316e9642510"
 		score = 75
 		quality = 70
 		tags = "STEALER, FILE"
@@ -197990,20 +198060,20 @@ rule TRELLIX_ARC_STEALER_Lokibot : STEALER FILE
 		$sq15 = { 55 8B EC 83 7D 0C 00 57 74 39 8B 7D 10 85 FF 74 32 56 8B 75 08 8B 46 08 03 C7 3B 46 04 76 09 57 56 E8 3F FF FF FF 59 59 8B 46 08 03 06 57 FF 75 0C 50 E8 ?? ?? ?? ?? 01 7E 08 83 C4 0C 33 C0 40 5E EB 02 33 C0 5F 5D C3 }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
 rule TRELLIX_ARC_STEALER_Credstealesy : STEALER
 {
 	meta:
 		description = "Generic Rule to detect the CredStealer Malware"
 		author = "IsecG – McAfee Labs"
-		id = "90e23ed8-3243-519b-8eb4-9db5902c73d3"
+		id = "49981bd2-b259-5e09-8ae1-d9e96229d4f3"
 		date = "2015-05-08"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/when-hackers-get-hacked-the-malware-servers-of-a-data-stealing-campaign/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/stealer/STEALER_credstealer.yar#L1-L24"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "3d007fc0d2e2eb3d8f0c2b86dd01ede482e72f6c67fd6d284d77c47b53021b3c"
+		logic_hash = "v1_sha256_3d007fc0d2e2eb3d8f0c2b86dd01ede482e72f6c67fd6d284d77c47b53021b3c"
 		score = 75
 		quality = 70
 		tags = "STEALER"
@@ -198025,14 +198095,14 @@ rule TRELLIX_ARC_STEALER_Emirates_Statement : STEALER
 	meta:
 		description = "Credentials Stealing Attack"
 		author = "Christiaan Beek | McAfee ATR Team"
-		id = "b5a6d996-8a3d-5238-95af-bf5ff893bbc5"
+		id = "7c9f9214-4904-5ccd-a20c-d2e1bfc6480b"
 		date = "2013-06-30"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/stealer/STEALER_EmiratesStatement.yar#L1-L24"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "7cf757e0943b0a6598795156c156cb90feb7d87d4a22c01044499c4e1619ac57"
-		logic_hash = "17eaddf375fc1875fb0275f8c0f93dfe921b452bdc6eb471adc155f749492328"
+		logic_hash = "v1_sha256_17eaddf375fc1875fb0275f8c0f93dfe921b452bdc6eb471adc155f749492328"
 		score = 75
 		quality = 45
 		tags = "STEALER"
@@ -198055,13 +198125,13 @@ rule TRELLIX_ARC_RANSOM_Darkside : RANSOMWARE FILE
 	meta:
 		description = "Rule to detect packed and unpacked samples of DarkSide"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "ecbee92f-236a-5385-9566-502ef1c0aeda"
+		id = "37fcfd0b-c9d3-53da-88c5-37c4579fb937"
 		date = "2020-08-11"
 		modified = "2023-07-27"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Darkside.yar#L1-L23"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "be16d65911336809be103ea667167228e6445de85fd47ecd9ff8b3d91e056693"
+		logic_hash = "v1_sha256_be16d65911336809be103ea667167228e6445de85fd47ecd9ff8b3d91e056693"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -198077,21 +198147,21 @@ rule TRELLIX_ARC_RANSOM_Darkside : RANSOMWARE FILE
 		$pattern_1 = { 70211F3B6E97C50000473D000000A000004602003EBBFF1F92CC558BEC5053515256570FEFC0660333DBFBFFEDFF8B7D088B450C33D2B9100000F7F185C0740B0F110783C710480A692EFB7F75F585D27502EB5892B9081C7F08B60F592E3B040A891F38049B641979F61F02661CD6FEBFEC023802881F5F5E5A595B585DC25D977E20634F8B750C9110110F1006252383FD94C61097EF6819AC59BA226F7F089DEFD8EE0119450F8B1E82C604A23E033232F1240EC602B9EC91C1A5F2048A1EA70CA12CCBD9A64D757D42E9FEFFBFAC8AD8C0E80480E30F3C0072063C09770204303C0A090FB66F6DBB5780FB140804150380C3300C0ADADFFE790F5766AB8AC3034985C975BE6646FF252CD6096564610C55FCB2806FDF86DB8A069701887801BBAD0299058A164FD62EFB4612D273E60A4F430C0F83DB7F2A7B602613C00A74068BDF2BD821EC63DB8A03644762EB9BB80142900BFBFB72EA2BC3BB1C7528B923C96F7FFB1F568BF72BF5F3A45EE94D01D248C1E008C3468BE8DE1EC26E0C0449303D007D4B83D9FF0DD93CD907058000D100BDB01BF250F04C33C974017417B1D8B0B61902561B96204B06E1C25D2B398BC75208111AEE18EDB9FF2660F4F8EFDDF7188BD8680E579B03D981C70B4B85DB75EAEE94CD5EFE7407521546B9F0256F7F6BB7BE02A6B24D50108B58048B7807400C895FF7FFDB540E03440E08895C0E04893C0E81EA10002D048168ED9FB1EB05EF83E91079D57EC0DFFFFDE4EC80108A814A02141E02D08AA20A436BFFBFDF88820688A1053BDF7306FEC175DAEB062C076E0B29A3D227F8A327A8C27DFBEDFE04C6B940998D35378D3D05A7B2F3A57DBC8FF7F31520B41D242A9A1BFB8DDD1CB38A8205AB28888305AA11D88DFFFE02C5478A800EFEC23007FEA0D189402F9684D8893D0D7C6BF07BF8CF6004A8CAFF76FC5630040549FF33FFDBAC59109C0C8B46FC8D3406B9150F477291BD05F0AD50283D52C252D961295A532A02B902BB04550608B902B90103E10843260299C3AD8615B2BF2751565333F959AB329FE0EEF874D8C33F81EC1468C885ECFE7777DFF0FFFF50FF4FA9168BB5F00C8BBDF40583FE055877F74BA483FF017205097313B86D00695BF36DFA8BE55DC36C073C2118751C3300D21C210234DF04D2FD06751785FF1B3C1555109AC11EC8B83DEB6A19023EA419644250033FC866DE2636690A75141864FECDEE4C1DDE00770A760EB8FFFFFF7F1B927C490DFF3083C4AEFD7A84F82D6A0068976A02080AFE8FB07509405A083B268945FC837DFCFF7422916D73DF188D45F85072020C1DFC34ECB0AE3672090C3E59746B43DACC8BFFCE3C0D7472E1AD44FB51AAAA0B04576A1057BC67BF3F16470868EFBEADDE3FA8F6105090BDB0670C31070E47040F92F50EC9080CB8624E071B5913D85CD6A8DE6D1FDF6AF9E4D88D045D6D50DAFF58F78F7D63AEC6BE8BF085F6743429562ADDDCE1CBCE088D430119FDBDFF56B027ECEF0A1AAA065639C68BC37077FB9C630484FAF4BAF10B6807A31DB0B14CF20A8BD12DE09A3871989ABBFD24E84013CB376608A783FB048DD2D90317B87FDEFC87DEF8C4E55D49C628308D17EE000DC32FF145B083C027E0F089850CE3FD202387B960051108102B99FE37040B7D14000F8475C41E0FA6DBC5F60F571C119846100320ED17EF8930B1BD4EB0104E17D32CDBCB1056105E3026074F57CDE6E26E5F304840732AE457008B6FF017BF954D8BFAFB4D148A3FFF88447B6DFBD30FFFA3F389550C02106E5359FDF0A964085556BD0A14078B5F6FFFDFBE354F208B5792F003F2C1C60733DE8BF303F0080933CEED2FFFF28BF103F30D33D68BF203F11233C68907892ECBB26D96898947143A243404CBD612202F3B24342CCBB22C0428380818CBB25C802838081820CBB22C3C0C1C2CDFB22C173C0C1C2CED0463476063760CED04750C53606363ED187510ED18D80863637510ED2C6424ED3036C2142C6524ED30234C818D6538ED3065386DA30DFC4D85ED0F851B975E5DF30702CBE5726BC80357105F1867206FB6022F972877307F380F0C024EE572B9DC1EFE56FE5EFE66FE6EA6D996CBFE76FE7E7F3D7F7F94A6699A7F7F7F7F7F9AE5C8708D6B5757575D8C966B57BED8FE2011BFE4B834118B9DA7274320837B2086F1B195000824E977EF1866C335DB32C500E4B2BD154E8B55BA338942200524B5655BFA24EB16831940030C6D370297C0237485CAFC86C21297EE1A818880308D7D80F3B920B16FE21DF2F3ABB900DF518D7580F810CD33E7FED1168D7604E2F92175128B06194DA6ECED078D7F17F473181911C9600933C441290CD5BB0A5B5B59F033E476B05505E00CEDAA9BBDB266E03AA5D908A6BFB960DDDFFCDD4FE0C64580018BA98F7EF05D0C81C379B981A849B1BE07D84150F8510851FC8DAB8360115F547B8D626FADBB1D508D3B50E874D3815240D3E0BF6563F02203740F9908199BBB4B1961646306AE9B780C830627307DC7E63041B73BDB06F8410ECB8A369391B8D51A68A41F000B8278E2C406CE1F0926023676729008AA12F80C1A24446B4B22170E54206317F226F8C37EF45B18B8C3F8EF238B71C65E4E62F475F8F46A0514066C737F01CE04EB43EB3F3D310A1B1CB5D84CD837C2EBC60D2C5A839117A1C12C4468F7BBA5196AD2C86AD6616CDBD8288E2E33ED3CAD1D14C3999178FF733C02CA74D72E71A1A14402EBFC1C332275D4565858CA5D4F846D35570F06E6AC62895FE9BF454B183B480875278D1F30AABEC220586C3BEA0F2C3A0E186BD5E850C63826070017E40793C5F30C0262CC0D776B110D6F68081017F4FDDD58B2C77568040110976256A3D8B3C4B2CC11D3D23DE2DB4636F677FC57FB571F34102048BC03A1088DA3ADD5456CD8C2BE227A30C3A3B18D922A9B1C2C6A9BDB095B62106E38E18B5E12C37BD86CB0403753132F6E56A573B367B10FBC59A8EE97CD409E848530675464A1183064849F924030C31A2C72E1248313F88D1DCF6C125B166CECFC53EC531BB519E4027936286BC0D263936C0F6A245FD4C70B24B15766738C09E89B4A2C585392A89C53325426816407AA7E5111040C8D9913E810EF52A937B527344930AA660C5E017648727CC960E3F07304ADA50B27ACDB8F2D60F0B5833EAF15107A641F05D019EBCCCBACDD2578763D4FA9744A4A0FFC0618E9E3147A6517C1293AECB517D9F88B122E0146336C2CD67D7C5224760B1D0E08506FC8096E7ACA96504FB6B1B1463FD3A6521911F424E1FC5A0142A91AD9A722EC3EEE6B18B26B1C3D7DB1D75EAFFC8D7531831C8535BF8E68EB803FAA5219367958D984534FBE3C1B690664B0B03CCC09209966A401B44050C83336C9ECA29D0004D88465B109215A244576CF58C96AF0346AF4AE9D3DB360BC0E3989C005A9247508F153A7A564036F644553F675A3D4253BAC3956120C5AEBE66EC682D922722568F4C058B36FD730DAEDB57D14450DAA0BD716168151969EAE69921D76C8D85E08626E130C9C11C00D07C160C7846481EDFF72C8A1BDE3DF9F813C18DEADBEEF980340EBF2C631F9EC4E04136DA456A4A1FC8EAC7E73C8C1E0068BD82373CCBB46C6DE01B16A1630408086A44CB2810B2C2F3616500A17F3DE5F0BAB8EAEA556561FFBE5B2F6150A374D358D83E6070A67B303593A5A56223D5A89E4C8254EB60FE492B3D95E56223D5E4FD9EC447286176256223D223972C96250561FB9E46C766656223D6641363B911C26276A56223D488E5C726A51F62E72362B90C7223D6E9D488E5C52C6367256472E399B223D724B963E9CCD4E247656223D7627922397537E427A56964BCE66223D7A545890672269727E72CCA759E47E0AC8A912678203C11A01B23557FBC2E08A53D968243106BE91ACB86472A8C319698152773D833C038C907C420BB3345B061008091C095EE251887010EBDE251B5A160CE0FD66B80904A10B9566ABE74C161266A4D19EE614ECA72DE3F8DC0F84A129461DF421D89E3DE828139F83DA062D4FEEF350ECD3AEFCF6EB6399F833D285D255B390DB6BFDC90530940107A842EB14BB162E2CC12B8B1BD4CB4D33C9192BFFAE400830040E4183F9080E04AC5F713904576A57014C7042E2C8681122C63664F381D8ED9E70B470B8182C883DA58E0EFFE62C080B5B180C256C469348D2C1B408AC1CEC840704300A44AA0EBBB6044381DC0C4BA62EEA1D487CDA4AE10E58D4DC194871F43A5F5DB37064FBF086F034798B83C9A26B096057B0571E7F83172666FD47FE5CFA66C704475C00D565F15702444702D9EB3D62598B151A11EA0B3531B614F06592BA0E46348A5D3932DAC81B1A386C90410C03802C26E0B1CCCD19502B1B035C4379AA3ACD09D534968523BBEB6953CCECBFEC511DB68B27C8F4CB75EC39326FD94ED2820BEB1E27F41821E12E7548293B02750759AC12C23B9616FF57C6082997A5EC1C846C4EC80C6D026D0630968DE46D06251CA43358A41AF84F9CD06CEBA91B5C107EDA562CE1F7C049A5AE83702B0CCB523367A364CD46000B08DD35AD8C91877A08E63C5798CC25C3AC9C86AD927DC615A3A3DC53E7CA217946B6431A1010E864489E911414F0183891906718F8A44D6148561EEBA0D3363ACC9DD08BC8C45110BA36D092BA42CE140510960626A37C49D0736C658C67F0524156E89E609103 }
 
 	condition:
-		$pattern_0 or $pattern_1 and filesize <5831344
+		$pattern_0 or $pattern_1 and filesize < 5831344
 }
 rule TRELLIX_ARC_RANSOM_Darkside_DLL_May2021 : RANSOM FILE
 {
 	meta:
 		description = "Rule to detect Darkside Ransomware as a DLL"
 		author = "TS @ McAfee ATR"
-		id = "e9d64637-dc8f-5650-81e1-34e27e6ee912"
+		id = "fc4954be-e9d3-574d-af2f-2740f86a1fd7"
 		date = "2021-05-14"
 		modified = "2023-07-27"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Darkside.yar#L26-L47"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "f587adbd83ff3f4d2985453cd45c7ab1"
-		logic_hash = "39930b6f352642647ea6b80f941201b93d6a9defd42cb75f9e4f7239ff17a4ec"
+		logic_hash = "v1_sha256_39930b6f352642647ea6b80f941201b93d6a9defd42cb75f9e4f7239ff17a4ec"
 		score = 75
 		quality = 70
 		tags = "RANSOM, FILE"
@@ -198110,21 +198180,21 @@ rule TRELLIX_ARC_RANSOM_Darkside_DLL_May2021 : RANSOM FILE
 		$pattern5 = {EE452560DBD5A4F46FB562C9C707C8D014BB8F1C18E4467E249F5AC69A87954F5B69650B7A759CE2DD075E99CBCBA37A9C5A0650EDF06285F8F990AF6B94FBA08E3C0B2EBDE3C155ECDB06C30F95D76695}
 
 	condition:
-		filesize >=45KB and filesize <=70KB and all of ($s*) and 4 of ($pattern*)
+		filesize >= 45KB and filesize <= 70KB and all of ( $s* ) and 4 of ( $pattern* )
 }
 rule TRELLIX_ARC_MALW_Thiefquest : KEYLOGGER BACKDOOR RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the Evilquest/ThiefQuest malware"
 		author = "McAfee ATR Team"
-		id = "09b074f7-6899-574d-a7d6-4414509aaa78"
+		id = "312703fb-6a88-5e68-8d4e-9ad57a8c2890"
 		date = "2020-07-09"
 		modified = "2020-10-12"
 		reference = "https://www.bleepingcomputer.com/news/security/thiefquest-ransomware-is-a-file-stealing-mac-wiper-in-disguise/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_thiefquest.yar#L1-L46"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "5a024ffabefa6082031dccdb1e74a7fec9f60f257cd0b1ab0f698ba2a5baca6b"
-		logic_hash = "d40a466b12188d545d3fbe2c9d7e3685dde1250ae1f25df2a72cdf93c470ae25"
+		logic_hash = "v1_sha256_d40a466b12188d545d3fbe2c9d7e3685dde1250ae1f25df2a72cdf93c470ae25"
 		score = 75
 		quality = 68
 		tags = "KEYLOGGER, BACKDOOR, RANSOMWARE, FILE"
@@ -198160,21 +198230,21 @@ rule TRELLIX_ARC_MALW_Thiefquest : KEYLOGGER BACKDOOR RANSOMWARE FILE
 		$pattern_23 = { e2d7 8437 6b4696d9 92 9d a6 }
 
 	condition:
-		7 of them and filesize <124322606
+		7 of them and filesize < 124322606
 }
 rule TRELLIX_ARC_Nemty_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Nemty Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "e9b133d6-fd77-5201-995d-c42bae7cde46"
+		id = "275245b3-4f60-5a22-bcc2-9a7b2623f0e8"
 		date = "2020-02-23"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Nemty.yar#L1-L45"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "73bf76533eb0bcc4afb5c72dcb8e7306471ae971212d05d0ff272f171b94b2d4"
-		logic_hash = "d055286670516318c14dcf4e5873b96eede5e1dfb3ee978553fc11f1ac6b3252"
+		logic_hash = "v1_sha256_d055286670516318c14dcf4e5873b96eede5e1dfb3ee978553fc11f1ac6b3252"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -198207,21 +198277,21 @@ rule TRELLIX_ARC_Nemty_Ransomware : RANSOMWARE FILE
 		$s20 = "puh4wXjVYWJzFN6aIgnClL4W/1/5Eg6bm5uEv6Dru0pfOvhmbF1SY3zav4RQVQTYMfZxAsaBYfJ+Gx+6gDEmKggypl1VcVXWRbxAuDIXaByh9aP4B2QvhLnJxZLe+AG5" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) and 4 of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) and 4 of them ) )
 }
 rule TRELLIX_ARC_Nemty_Ransomware_2_6 : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Nemty Ransomware version 2.6"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "335dff33-d078-58ba-b68b-a949895b710f"
+		id = "4699753d-4aa7-5841-87db-9f73d85010c0"
 		date = "2020-04-06"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Nemty.yar#L47-L80"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "52b7d20d358d1774a360bb3897a889e14d416c3b2dff26156a506ff199c3388d"
-		logic_hash = "dacf709838ef2ef65d25bdbbd92007ab46a95953031d7bee75eac046f670171a"
+		logic_hash = "v1_sha256_dacf709838ef2ef65d25bdbbd92007ab46a95953031d7bee75eac046f670171a"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -198235,21 +198305,21 @@ rule TRELLIX_ARC_Nemty_Ransomware_2_6 : RANSOMWARE FILE
 		$pattern = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????A1????????33??89????8B????578D??????????89??????????E8????????33??6A??5839????76??5683????75??508D????5350E8????????8D??????????508D????E8????????83????6A??5880??????75??C6??????4879??EB??FE????33??8A??????8B??????????30????47403B????72??5E8B????33??5FE8????????C9C3558B??51515333??5633??32??89????39????0F86????????578B????8B????8A????8B??83????74??4F74??4F75??21????0FB6??0FB6??83????8B??C1????C1????0B??8A??????????83????88????8A??????????8B????88??????83????EB??0FB6??0FB6??83????6A??C1????C1????5E0B??EB??33??0FB6??46C1????8A??????????88????40FF????8A??8B????3B????72??5F4E74??4E75??0FB6??83????8A????????????88????C6????????83????EB??0FB6??83????C1????8A??????????88????66????????????83????5EC6??????5BC9C3558B??33??F6??????75??5733??39????76??8B????8A????80????74??80????7C??80????7F??0FB6??8A??????????80????74??8B??83????83????74??4A74??4A74??4A75??08????40EB??8A??C0????80????08????40C0????EB??8A??C0????80????08????40C0????EB??C0????88????473B????72??EB??33??5F5DC3558B??518B??85??74??8B????568B??89????3B??74??576A??33??E8????????83????3B????75??5FFF??E8????????595E33??89??89????89????C9C3558B??80??????74??83??????72??538B??85??74??575356E8????????83????53E8????????595BC7????????????89????C6??????5DC2????C7??????????E9????????558B??568B??C7??????????E8????????F6??????74??56E8????????598B??5E5DC2????558B??83????81??????????A1????????33??89????????????5356578D????508D??????E8????????68????????8D????????????E8????????6A??5F33??83????66????????8D????8B??33??5089??????89??????E8????????E8????????33??66????????8B????????????03??????83????8D??????89??????89??????E8????????538D??????5083????8D??????E8????????538D????????????5083????E8????????8B??8D??????E8????????6A??33??E8????????83????????8B??????73??8D??????8D????????????5150FF??????????89??????83????0F84????????8B??????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????F6??????????????8D????????????508D??????8D??????74??E8????????598D??????51E8????????8B??598D??????E8????????6A??33??8D??????E8????????6A??8D??????E8????????83????8D??????8B??50E8????????E8????????83????E9????????E8????????8B??598D??????E8????????6A??33??8D??????E8????????8D????????????50FF??????????508D??????E8????????8B??????6A??5F39??????73??8D??????8B??????????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??74??8B??????39??????73??8D??????68????????50FF??85??74??83????8B??68????????E8????????83????8D????????????8B??51E8????????E8????????83????85??75??8B??????39??????73??8D??????83????8B??51E8????????E8????????83????6A??33??8D??????E8????????8D????????????50FF??????FF??????????85??0F85????????FF??????FF??????????33??435333??8D?????? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1500KB and $pattern
+		uint16( 0 ) == 0x5a4d and filesize < 1500KB and $pattern
 }
 rule TRELLIX_ARC_Loocipher_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Loocipher ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "d18efe09-4b04-5089-84f8-aead63fc19bb"
+		id = "ec472c24-dbe5-53b7-89cc-c046cf4b05ba"
 		date = "2019-12-05"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/analysis-of-loocipher-a-new-ransomware-family-observed-this-year/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Loocipher.yar#L1-L46"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "7720aa6eb206e589493e440fec8690ceef9e70b5e6712a9fec9208c03cac7ff0"
-		logic_hash = "36e452c34fd9bbb521f5422bffdbb71991de66f3faa29292dc3f27c8d7e1f9ba"
+		logic_hash = "v1_sha256_36e452c34fd9bbb521f5422bffdbb71991de66f3faa29292dc3f27c8d7e1f9ba"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -198282,7 +198352,7 @@ rule TRELLIX_ARC_Loocipher_Ransomware : RANSOMWARE FILE
 		$s20 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::_Compat" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and (1 of ($x*) and 4 of them )) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and ( 1 of ( $x* ) and 4 of them ) ) or ( all of them )
 }
 import "pe"
 
@@ -198291,13 +198361,13 @@ rule TRELLIX_ARC_Ransom_Avoslocker : FILE
 	meta:
 		description = "Rule to detect Avoslocker Ransomware"
 		author = "CB @ ATR"
-		id = "50f029c8-154e-583d-8264-8d86d01075f6"
+		id = "f221214d-2722-551e-8ec1-b8c661ef060e"
 		date = "2021-07-22"
 		modified = "2021-07-22"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Avoslocker.yar#L3-L27"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "316aaab225797eedd62f9cfde1fdbd799a10441b3b15a8abc76141b57b36b1d3"
+		logic_hash = "v1_sha256_316aaab225797eedd62f9cfde1fdbd799a10441b3b15a8abc76141b57b36b1d3"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -198318,21 +198388,21 @@ rule TRELLIX_ARC_Ransom_Avoslocker : FILE
 		$seq2 = { 8b 40 0c 89 85 1c ff ff ff 8b 40 0c 89 85 18 ff }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and pe.imphash()=="a24c2b5bf84a5465eb75f1e6aa8c1eec" and (5 of them ) and all of ($seq*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and pe.imphash ( ) == "a24c2b5bf84a5465eb75f1e6aa8c1eec" and ( 5 of them ) and all of ( $seq* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_Ransom_Maze : RANSOMWARE FILE
 {
 	meta:
 		description = "Detecting MAZE Ransomware"
 		author = "McAfee ATR"
-		id = "098a93c4-9aab-5563-af17-7aa91b056f64"
+		id = "3b08175d-1aa5-5a1f-8ed2-7446b72911a4"
 		date = "2020-04-19"
 		modified = "2020-10-12"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Maze.yar#L1-L39"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "5badaf28bde6dcf77448b919e2290f95cd8d4e709ef2d699aae21f7bae68a76c"
-		logic_hash = "fc16475fbc2a2acf5d053ded4d2ec4126c6d6dcac3a6eafadcd6c61419dd7594"
+		logic_hash = "v1_sha256_fc16475fbc2a2acf5d053ded4d2ec4126c6d6dcac3a6eafadcd6c61419dd7594"
 		score = 75
 		quality = 68
 		tags = "RANSOMWARE, FILE"
@@ -198358,20 +198428,20 @@ rule TRELLIX_ARC_Ransom_Maze : RANSOMWARE FILE
 		$op2 = { 56 e8 34 ca ff ff 83 c4 08 55 e8 0b ca ff ff 83 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) and 4 of them ) and all of ( $op* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_Cryptolocker_Set1 : RANSOMWARE
 {
 	meta:
 		description = "Detection of Cryptolocker Samples"
 		author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
-		id = "13ccc6d3-c2cc-59ac-81af-ec11fb78cd41"
+		id = "1aae69d8-ce19-559f-b205-630ef848dbc7"
 		date = "2014-04-13"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Cryptolocker.yar#L1-L40"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "5be8d077537a59d860a972392be186d2697e55778f750d03b0fd3b0a73f714d9"
+		logic_hash = "v1_sha256_5be8d077537a59d860a972392be186d2697e55778f750d03b0fd3b0a73f714d9"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE"
@@ -198402,20 +198472,20 @@ rule TRELLIX_ARC_Cryptolocker_Set1 : RANSOMWARE
 		$string17 = "C:\\lZbvnoVe.exe" wide
 
 	condition:
-		12 of ($string*)
+		12 of ( $string* )
 }
 rule TRELLIX_ARC_Cryptolocker_Rule2 : RANSOMWARE
 {
 	meta:
 		description = "Detection of CryptoLocker Variants"
 		author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
-		id = "a6e808ef-4f60-5592-9440-69309784efb1"
+		id = "385ccfd3-9235-5b12-a6a7-fdf0d7f567bf"
 		date = "2014-04-14"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Cryptolocker.yar#L42-L79"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "e8e03516cc0b669000c8d6b443be7a5f7a8b904abba98fd3c7d4f038de6741ab"
+		logic_hash = "v1_sha256_e8e03516cc0b669000c8d6b443be7a5f7a8b904abba98fd3c7d4f038de6741ab"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE"
@@ -198445,7 +198515,7 @@ rule TRELLIX_ARC_Cryptolocker_Rule2 : RANSOMWARE
 		$string16 = "3,31363H3P3m3u3z3"
 
 	condition:
-		12 of ($string*)
+		12 of ( $string* )
 }
 import "pe"
 
@@ -198454,14 +198524,14 @@ rule TRELLIX_ARC_Ransom_Conti : RANSOMWARE FILE
 	meta:
 		description = "Conti ransomware is havnig capability too scan and encrypt oover the network"
 		author = "McAfee ATR team"
-		id = "8fc6943d-fb99-5957-929b-4c264d9fba2d"
+		id = "47633300-576d-5669-a0e4-dbe97f4e04d6"
 		date = "2020-07-09"
 		modified = "2020-10-12"
 		reference = "https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Conti.yar#L3-L37"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "eae876886f19ba384f55778634a35a1d975414e83f22f6111e3e792f706301fe"
-		logic_hash = "953471c130309bbc712197d49d2072bd45838f49d2b25f86273a15c6baa87354"
+		logic_hash = "v1_sha256_953471c130309bbc712197d49d2072bd45838f49d2b25f86273a15c6baa87354"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -198480,21 +198550,21 @@ rule TRELLIX_ARC_Ransom_Conti : RANSOMWARE FILE
 		$code3 = { 56 8d 85 38 ff ff ff 50 ff d7 85 c0 0f 84 f2 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and pe.number_of_sections==5 and (pe.imphash()=="30fe3f044289487cddc09bfb16ee1fde" or ( all of them and all of ($code*)))
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and pe.number_of_sections == 5 and ( pe.imphash ( ) == "30fe3f044289487cddc09bfb16ee1fde" or ( all of them and all of ( $code* ) ) )
 }
 rule TRELLIX_ARC_Shrug2_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the Shrug Ransomware"
 		author = "McAfee ATR Team"
-		id = "34e59296-db7c-551b-8d48-ffea20f2b4bb"
+		id = "fedd7ac4-950c-58e8-b240-7ef5a9b014a6"
 		date = "2018-07-12"
 		modified = "2020-10-12"
 		reference = "https://blogs.quickheal.com/new-net-ransomware-shrug2/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_shrug2.yar#L1-L30"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "c89833833885bafdcfa1c6ee84d7dbcf2389b85d7282a6d5747da22138bd5c59"
-		logic_hash = "8c817b7fc4a0eada08b3d298c94b99a85c4e5a49a49d1c3fabdb0c6bbf56676b"
+		logic_hash = "v1_sha256_8c817b7fc4a0eada08b3d298c94b99a85c4e5a49a49d1c3fabdb0c6bbf56676b"
 		score = 75
 		quality = 20
 		tags = "RANSOMWARE, FILE"
@@ -198513,7 +198583,7 @@ rule TRELLIX_ARC_Shrug2_Ransomware : RANSOMWARE FILE
 		$s6 = "\\Desktop\\@ShrugDecryptor@.lnk" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB) and all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB ) and all of them
 }
 import "pe"
 
@@ -198522,13 +198592,13 @@ rule TRELLIX_ARC_Samsamransom2016 : RANSOMWARE FILE
 	meta:
 		description = "No description has been set in the source file - Trellix ARC"
 		author = "Christiaan Beek | McAfee ATR Team"
-		id = "1c7985d0-d01c-52f7-8819-e038ccc01212"
+		id = "78aab23c-46c3-5328-ab98-2074ab46bad7"
 		date = "2018-01-25"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_SamSam.yar#L3-L52"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "9e8034ec0ded82ad82b625d6d1b9918761decef0fd42a253722cdc620b355e1a"
+		logic_hash = "v1_sha256_9e8034ec0ded82ad82b625d6d1b9918761decef0fd42a253722cdc620b355e1a"
 		score = 75
 		quality = 68
 		tags = "RANSOMWARE, FILE"
@@ -198565,7 +198635,7 @@ rule TRELLIX_ARC_Samsamransom2016 : RANSOMWARE FILE
 		$op2 = { 72 a5 0a 00 70 a2 06 20 94 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and pe.imphash()=="f34d5f2d4577ed6d9ceec516c1f5a744" and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and pe.imphash ( ) == "f34d5f2d4577ed6d9ceec516c1f5a744" and ( 1 of ( $x* ) and 4 of them ) and all of ( $op* ) ) or ( all of them )
 }
 import "pe"
 
@@ -198574,14 +198644,14 @@ rule TRELLIX_ARC_Samsam_Ransomware_Latest : RANSOMWARE FILE
 	meta:
 		description = "Latest SamSA ransomware samples"
 		author = "Christiaan Beek"
-		id = "716b9282-013e-5194-8518-2fa1a4007095"
+		id = "6c6827ab-1e88-525d-8c47-122d9d8c7ec6"
 		date = "2018-01-23"
 		modified = "2020-08-14"
 		reference = "http://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_SamSam.yar#L54-L105"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "88e344977bf6451e15fe202d65471a5f75d22370050fe6ba4dfa2c2d0fae7828"
-		logic_hash = "06703479795fdef64813471f11b275df544c90d5bcece4817d415cd504d7b317"
+		logic_hash = "v1_sha256_06703479795fdef64813471f11b275df544c90d5bcece4817d415cd504d7b317"
 		score = 50
 		quality = 68
 		tags = "RANSOMWARE, FILE"
@@ -198617,20 +198687,20 @@ rule TRELLIX_ARC_Samsam_Ransomware_Latest : RANSOMWARE FILE
 		$op2 = { 68 09 00 00 38 66 00 00 23 55 53 00 a0 6f 00 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="f34d5f2d4577ed6d9ceec516c1f5a744" and (8 of them ) and all of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and pe.imphash ( ) == "f34d5f2d4577ed6d9ceec516c1f5a744" and ( 8 of them ) and all of ( $op* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_RANSOM_Suncrypt : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect SunCrypt ransomware"
 		author = "McAfee ATR Team"
-		id = "92655f3e-f8e4-5c9f-ae3f-0796bd31d660"
+		id = "004805a4-2ead-5ad7-90bd-6c3ff26ea58d"
 		date = "2020-10-02"
 		modified = "2020-11-02"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Suncrypt.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "9f27c6c5bfe0d01ed517d55687bf699814679488f95ce4942306f09f39e29d85"
+		logic_hash = "v1_sha256_9f27c6c5bfe0d01ed517d55687bf699814679488f95ce4942306f09f39e29d85"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -198646,20 +198716,20 @@ rule TRELLIX_ARC_RANSOM_Suncrypt : RANSOMWARE FILE
 		$pattern = { 77??2F475263????78??58436463????77??7A??5263????78??5846534D5A4678??48475263??????6B??????4D5A4679??7A??5263????78??584C5163????7A??44475264??5778??58526163????30????475264??30????58556463????31????475264??73??6B??????63????32????4752646C73??6B??????38????32??5047526477??6A??5738????68????????41555039????496C46374931????46446F62????414146442F565169????????????5039????466D4A526669??????????64??63????4F6D38????414169??????????586F69??????????33????30????69????????????6F41444141414974??38????41554542516167??2F5665??4478??434A526679??6666????64??63????4F6D444141414169??????????33??69????????????77??33????2F33????2F33????36??49464141434478??7A??64667A??64??7A??64??6A??73??7A??2F34??454449584164??517A??4F74??69??????????5834??5558672F33????2F33????36??6E362F2F39????59584164??517A??4F73??69??????????33??69????????????554B30????69????????????30????5838????5830????5549554974??4446434C525268????????30??39????77??444A77??574C37495073??4D5A4634??62????65??70??6B??????73??4634??54475265??31????586C5963????35????????65????78??586F63????4636??2F47526570??78??5872??63????37475047526531??78??5875??4931????46446F534163????46442F565169????????????66??51616B??????52434C51416A??63????4C5252442F63????2F566679??78??434677??55454D38??????475368????????41496C462B????462B????4E454974??49496C49434974??454974??434974??454974??49414E494B496C4E39????4639????517A??5041514D6E44565976??555974??434974??434974??434974??494474??4E4855464D38????367A??4C525169??????????????6C72??51574466??68????????454D38??????6F74??434974??434974??434974??494374??4E496C4E2F5039??2F4974??435039????4F6A??2B????2F57566E4A77??574C37494873??41414141494E6C6C4143445A6141416733??514148554969??????????30??????44475266??75??6B??????4D5A4638????475266??73??6B??????4D5A4639????475266??6B??????33????5A462B????4752666B??????5867??73??4634??6E475265??79??6B??????4D5A4635????????65??68????????62????4635????????65??????????70??63????366E4C47526574??78??5873??4D5A4630????475264??70??6B??????73??4630??54475264??31????58565963????31????475264????78??585962????4632????47526470??78??5862????5A4633????475262????78??5739????5A4676??54475262??4478??58416463????77??4C475263????78??58445A63????78??37475263????78??5847554D5A4678??4C475263????78??584A5938????79??58475263??????6B??????38????7A??44475261526178??576C64??????70??584752616475??6B??????63????71??4847526170??78??5772??73??4672??6E47526131??????5775??38????72??2F475262????78??5778??38????73??58475262????78??5730??????4674??6E475262????78??5733????5A4675??434E5265??5136??4D46414142512F31????69????????????51554F677A??514141555039????496C466E4931????46446F4977??414146442F565169????????????6152516A??5877??5039????46442F565169????????????52434C514269????????????4932????502F2F2F31??????667A??565A434677??515A67??32????414142414855433677??4C526677??68????????2F2B????667A??31????46454974??434974??454974??4E4474??47484A4D69??????????414969??????????5838????36??6661414164??69??????????????6A??565978??2F31????68????????32????61414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C4249476F4561414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C42494974??45494E34??414231????74??454974??43476F49575776??42594E38????77??64??474C5252434C514169??????????????534A51534472??476F4561414177??41434C5252434C514169??????????????6F412F31????67??????69??????????456769??????????67????48554636??67??4141434C5252434C51416A??63????4C5252442F63????4C5252442F63????6F30????4141495045444974??454974??434974??454974??43412B??5352534E524167??69????????????38????73??69??????????6C462F4974??454974??43412B??51415935????????4F5774??2F4369??????????????45516130????4B4974??454974??454974??6D414E4D4168????????5838????74??454974??494974??6D414E4D416778??36??59424141434478??7A??73??64??6C4145414141417A??412B????50372F2F34??466C4D6E44565976??555974??434974??434974??45496C49424974??434974??42412B??414431????67??4164??517A??4F73??69??????????414569??????????6B??????67??????554969????????????4969??????????68????????4164??517A?? }
 
 	condition:
-		uint16(0)==0x6441 and all of them
+		uint16( 0 ) == 0x6441 and all of them
 }
 rule TRELLIX_ARC_RANSOM_Suncrypt_Decryptor : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect SunCrypt ransomware decryptor"
 		author = "McAfee ATR Team"
-		id = "ec0d3811-6083-5537-bf29-32ee02d43b5e"
+		id = "019ecf79-ecf4-5b58-b6b8-2f07f10084c2"
 		date = "2020-10-02"
 		modified = "2020-11-02"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Suncrypt.yar#L27-L50"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "59d1193bb0f8d3983a181394b5dd5247470d9e118cc4fe0674167f162bcdb6e1"
+		logic_hash = "v1_sha256_59d1193bb0f8d3983a181394b5dd5247470d9e118cc4fe0674167f162bcdb6e1"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -198674,21 +198744,21 @@ rule TRELLIX_ARC_RANSOM_Suncrypt_Decryptor : RANSOMWARE FILE
 		$pattern = { 558BEC81EC88000000837D08008BC10F101A89957CFFFFFF0F104A10898578FFFFFF0F1062200F106A300F115D940F114DA40F1165B40F116DC40F8E340200008B45D08B4DC48B55B08945F88B45CC8945E08B45C88945E88B45C08945F08B45BC8945F48B45B8538B5DA88945EC8B45AC568B75A48945D48B45A0578975DC8945E48B459403C68BF033F18B4DB4C1C61003CE8BF9337DDCC1C70C03C78945DC33C6C1C0088945D803C18B4DEC89458833C7C1C0078945848B459803C38BF03375E8C1C61003CE8BF933FBC1C70C03C78945E833C6C1C00889458C03C18B4DF48BD88945EC33DF8B459C0345D48B7DE48BF03375E003FAC1C61003CEC1C307894DF4334DD4C1C10C03C133F08945908B45F0C1C6088975800375F433CEC1C107894DE08B4DF833CFC1C11003C133D08945F0C1C20C8D043A8B7DF033C88945E48B45DCC1C10803F9894DF833D7C1C20703C38BC8334DF8C1C11003F18975FC315DFC8B5DFCC1C30C03C389459433C1C1C0088945F88945D003C633D88945F48945BC8B45E80345E08BC8C1C307334DD8C1C110895DFC895DA88B5DEC8D340F8BFE337DE0C1C70C03C789459833C1C1C0088945D88945C403C68B758833F88945F08945C08B459003C2C1C7078BC8897DD4334D8CC1C11003F1897DAC8B7DE433D6037D84C1C20C03C289459C33C1C1C0088945E88945C803C633D08945B48BC7C1C207334580C1C01003D88BCB334D84C1C10C03F98BF7897DE433F0897DA0C1C60803DE8975E08975CC895DEC8B45088BF333F1895DB88B5DFC488B4DD8C1C6078975DC8975A489450885C00F8F30FEFFFF0F106DC48B8578FFFFFF0F1065B45F0F105D948955B00F104DA48B957CFFFFFF5E5B0F10020F105210660FFED80F104230660FFED10F104A200F1118660FFECC660FFEC50F1150100F1148200F1140308BE55DC3CCCCCCCCCCCCCCCCCCCC558BEC83E4F081EC58020000568BC18B4D1489442420578BFA897C24283D000100000F82680A0000660F6E07660F70C800660F6E4704660F70D000660F6E4708660F70D800660F6E470C660F70E000660F6E4710660F70E800660F6E47148B7508660F70F000660F6E47188B550C660F70F8008D8EC0000000660F6E471C660F70C0000F29842430010000660F6E4720660F70C0000F29842440010000660F6E4724660F70C0000F29842450010000660F6E4728660F70C0000F29842460010000660F6E472C894C240C8D8AC0000000660F70C000894C241C8D8E800000000F29842470010000660F6E4738894C24148D8A80000000660F70C000894C24188D4E400F29842480010000660F6E473C894C242C8D4A40660F70C000C1E8080F298C24A00100000F299424B00100000F299C24C00100000F29A424D00100000F29AC24E00100000F29B424F00100000F29BC24000200000F29842490010000894C24108944242066660F1F8400000000000F2884243001000033C00B47308B4F340F298424800000000F288424400100000F298424900000000F288424500100000F294424600F288424600100000F298424100100000F28842470010000894C244C8944244883C0040F298C24D0000000F30F7E4C244883D1000F298424200100000F288424900100000F299424E00000000F2815A02B4200660F6CC90F29442430660FD4D10F2805B02B42000F29A424A0000000660FD4C10F28E20F29B42400010000660F62E0660F6AD00F28F40F299C24F00000000F28DD0F28AC2480010000660F62F20F297C24700F28FE660F6AE2894F348B4D140F295C24500F29AC24C00000000F29A424B00000000F29BC24400200000F29A4245002000089473085C90F84820400000F287C24708BC166900F28D3660FFE9424D0000000660FEFF2660F380035C02B42000F28DE660FFE9C24900000000F28C3660FEF4424500F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942400010000660FFE9424E0000000660FEFF0660F380035D02B42000F29842490000000660FEFE2660F380025C02B42000F28C60F29742470660FFEC30F28DC660FFE5C24600F29842410020000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424000100000F298C24200200000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D7660FFE9424F0000000660FEFE0660F380025D02B42000F29442460660FEFEA660F38002DC02B42000F28C40F29A424B0000000660FFEC30F28DD660FFE9C24100100000F29842430020000660FEFC10F28F0660F72F007660F72D619660FEBF00F28C3660FEFC70F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FFE9424A0000000660FEFE8660F38002DD02B42000F294424500F28E50F29AC24C0000000660FFEE30F28C4660FEFC10F28F8660F72F007660F72D719660FEBF80F286C2430660FEFEA660F38002DC02B42000F28DD660FFE9C24200100000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D6660FEFE8660FFE942490000000660F38002DD02B42000F298424A00000000F296C2430660FFEEB0F28C5660FEFC10F28C8660F72F007660F72D119660FEBC80F28442430660FEFC20F298C2480000000660F380005C02B42000F28D80F29442430660FFEDC0F28C3660FEFC60F287424700F28C8660F72F00C660F72D114660FEBC80F284424300F28E1660FFEE20F28D7660FFE542460660FEFC4660F380005D02B4200660FEFF20F29A424D0000000660F380035C02B42000F29442430660FFEC30F298424100100000F28DE660FEFC1660FFEDD0F28C8660F72F007660F72D119660FEBC80F28C3660FEFC70F298C24000100000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FEFF00F298424E0000000660F380035D02B42000F28C6660FFEC30F29842420010000660FEFC10F28F8660F72F007660F72D719660FEBF8660FFE5424500F28A424B00000000F28AC24C0000000660FEFE2660F380025C02B42000F28DC660FFE9C24100200000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942420020000660FFE9424A0000000660FEFE00F298424F0000000660FEFEA660F380025D02B4200660F38002DC02B42000F29A424B00000000F28C4660FFEC30F28DD660FFE9C24300200000F29842490000000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424200200000F298C24800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F298424A0000000660FEFE8660F38002DD02B42000F29AC24C00000000F28C5660FFEC30F29442460660FEFC10F28D8660F72F007660F72D319660FEBD80F295C245083E8010F8594FBFFFF0F297C24700F28BC24400200000F28AC24A0010000660FFEAC24D00000000F28A424C00100000F28DD660FFEA424F00000000F288C24B00100000F28D4660FFE8C24E00000000F288424D0010000660FFE8424A00000008B44242C8B7C2414660F62D9660F6AE90F28CB660F6AE0660F62D00F10068344241410660F6CCA660FEFC8660F6DDA0F110A0F10008B4424100F28CD660F6DEC660FEFD8660F6CCC0F28A424000200000F111883C0100F10078B7C2418660FFE642470660FEFC883442418100F28D4894424100F110F8B7C240C0F288C24F0010000660FFE8C24000100008344240C100F10078B7C241C8344241C10660FEFE80F28842430010000660FFE8424800000000F112F8B7C242C0F28AC24E0010000660FFE6C24500F28DD660F62D0660F62D9660F6AE90F28CB660F6AE00F104610660F6CCA660FEFC8660F6DDA0F114A100F1047100F28CD660F6DEC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFE80F11280F28AC2440010000660FFEFE660FFEAC24900000000F28A424600100000F28DD660FFEA424100100000F288C24500100000F28D4660FFE4C24600F28842470010000660FFE84242001000083442410108B4424108344241410660F62D98344241810660F6AE90F28CB660F6AE0660F62D00F1046208344240C10660F6CCA660FEFC88344241C100F114A200F104720660F6DDA0F28CD660FEFD8660F6CCC0F11188B44241483442414100F28DF660F6DEC0F28A424800100000F10008B442418660FFEA424C0000000660FEFC883442418100F28D40F11088B44240C0F288C2450020000660FFE8C24B00000008344240C100F10008B44241C660F62D9660FEFE8660F6AF90F288424900100000F28CB660FFE4424300F11288B442410660F62D083C010660F6AE00F1046308344241C10660F6CCA660FEFC8660F6DDA0F114A30894424100F1047300F28CF660F6DFC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFF881442410D000000081C70001000081442418D000000081C2000100008144241CD000000081C60001000081442414D00000008144240CD00000000F288C24A00100000F289424B00100000F289C24C00100000F28A424D00100000F28AC24E00100000F28B424F00100000F11388B4424240F28BC24000200002D00010000836C242001897C242C8B7C2428894424240F85E2F6FFFFEB068B550C8B75088954241083F8400F829A010000C1E80689442420660F1F4400000F10370F1057100F107F200F106F3085C90F84F60000008BC10F1F80000000000F28DA660FFEDE660FEFEB660F38002DC02B42000F28E5660FFEE70F28C4660FEFC20F28C8660F72F00C660F72D114660FEFC80F28D1660FFED3660FEFEA660F70D293660F38002DD02B42000F28DD660F70ED4E660FFEDC660F70E3390F28C3660FEFC10F28C8660F72F007660F72D119660FEFC8660FFED1660FEFEA660F38002DC02B4200660FFEE50F28C4660FEFC10F28D8660F72F00C660F72D314660FEFD80F28C3660FFEC2660F70F039660FEFE8660F38002DD02B42000F28C5660F70ED4E660FFEC4660F70F8930F28C8660FEFCB0F28D1 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule TRELLIX_ARC_Termite_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the Termite Ransomware"
 		author = "McAfee ATR Team"
-		id = "521ec8ee-a54c-57c3-9437-a2ef7f8ed4ca"
+		id = "1f09b972-e927-56e2-a9ae-b394dd0ff1fd"
 		date = "2018-08-28"
 		modified = "2020-10-12"
 		reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_termite.yar#L1-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "021ca4692d3a721af510f294326a31780d6f8fcd9be2046d1c2a0902a7d58133"
-		logic_hash = "e5c01e8377957fa25cf6c2031c2680e802b0082a36f50b97b4e488c5bf40e968"
+		logic_hash = "v1_sha256_e5c01e8377957fa25cf6c2031c2680e802b0082a36f50b97b4e488c5bf40e968"
 		score = 75
 		quality = 20
 		tags = "RANSOMWARE, FILE"
@@ -198709,20 +198779,20 @@ rule TRELLIX_ARC_Termite_Ransomware : RANSOMWARE FILE
 		$s8 = "(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <6000KB) and all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 6000KB ) and all of them
 }
 rule TRELLIX_ARC_Ransom_Win_Blackcat : RANSOMWARE FILE
 {
 	meta:
 		description = "Detecting variants of Windows BlackCat malware"
 		author = " Trellix ATR"
-		id = "65483ffb-6b10-5fd5-8a5f-fc885a5f2e98"
+		id = "5b8934ca-3a64-5fcb-aead-8910a54fc72b"
 		date = "2022-01-06"
 		modified = "2022-01-19"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Win_BlackCat_public.yar#L2-L24"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8faad28ab26690221f6e2130c886446615dbd505f76490cfaf999d130d0de6e3"
+		logic_hash = "v1_sha256_8faad28ab26690221f6e2130c886446615dbd505f76490cfaf999d130d0de6e3"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -198736,7 +198806,7 @@ rule TRELLIX_ARC_Ransom_Win_Blackcat : RANSOMWARE FILE
 		$API = { 3a 7c d8 3f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3500KB and 1 of ($URL*) and $API
+		uint16( 0 ) == 0x5a4d and filesize < 3500KB and 1 of ( $URL* ) and $API
 }
 import "pe"
 
@@ -198745,13 +198815,13 @@ rule TRELLIX_ARC_Ransom_Tunderx : RANSOMWARE FILE
 	meta:
 		description = "Rule to detect tthe ThunderX ransomware family"
 		author = "McAfee ATR team"
-		id = "cf5ecd0c-db26-5fe4-a056-b5c1ca3b1d34"
+		id = "b06fcb9c-04b4-5b3b-b69f-8d85475fd3e8"
 		date = "2020-09-14"
 		modified = "2020-10-12"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_ThunderX.yar#L3-L45"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "f870616c4a35239a01129daad5f12469b2df39251ee4bc9fbeb5523f00231ece"
+		logic_hash = "v1_sha256_f870616c4a35239a01129daad5f12469b2df39251ee4bc9fbeb5523f00231ece"
 		score = 75
 		quality = 68
 		tags = "RANSOMWARE, FILE"
@@ -198789,20 +198859,20 @@ rule TRELLIX_ARC_Ransom_Tunderx : RANSOMWARE FILE
 		$seq2 = { ff 15 34 81 41 00 eb 15 83 f8 fc 75 10 8b 45 f4 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and pe.imphash()=="ea7e408cd2a264fd13492973e97d8d70" and $pattern1 and 4 of them ) and all of ($seq*) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and pe.imphash ( ) == "ea7e408cd2a264fd13492973e97d8d70" and $pattern1 and 4 of them ) and all of ( $seq* ) or ( all of them )
 }
 rule TRELLIX_ARC_Backdoorfckg : CTB_LOCKER_RANSOMWARE RANSOMWARE
 {
 	meta:
 		description = "CTB_Locker"
 		author = "ISG"
-		id = "2a00551d-1f80-5991-9416-d9b1b39db8e9"
+		id = "20af42df-c7c9-5de1-855a-03447e7478b1"
 		date = "2015-01-20"
 		modified = "2020-08-14"
 		reference = "https://blogs.mcafee.com/mcafee-labs/rise-backdoor-fckq-ctb-locker"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_CTBLocker.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "a334b07053db66aa0fb2d2b2ca7f94c480509041724ddd4dd1708052d75baffb"
+		logic_hash = "v1_sha256_a334b07053db66aa0fb2d2b2ca7f94c480509041724ddd4dd1708052d75baffb"
 		score = 75
 		quality = 20
 		tags = "CTB_LOCKER_RANSOMWARE, RANSOMWARE"
@@ -198821,20 +198891,18 @@ rule TRELLIX_ARC_Backdoorfckg : CTB_LOCKER_RANSOMWARE RANSOMWARE
 	condition:
 		3 of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Sodinokobi : RANSOMWARE
 {
 	meta:
 		description = "This rule detect Sodinokobi Ransomware in memory in old samples and perhaps future."
 		author = "McAfee ATR team"
-		id = "dd05ce31-9699-50a9-944c-5883340791af"
+		id = "db4f7c4a-349f-59f5-932e-1443a4f72d86"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Sodinokibi.yar#L33-L54"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "f25039ac743223756461bbeeb349c674473608f9959bf3c79ce4a7587fde3ab2"
+		logic_hash = "v1_sha256_f25039ac743223756461bbeeb349c674473608f9959bf3c79ce4a7587fde3ab2"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE"
@@ -198851,20 +198919,18 @@ rule TRELLIX_ARC_Sodinokobi : RANSOMWARE
 	condition:
 		all of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Ransom_Black_Kingdom : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Black Kingdom ransomware that is spread using the latest Exchange vulns"
 		author = "McAfee ATR"
-		id = "c38e6dbf-7fb9-52f0-acd0-f824647b6041"
+		id = "bf591436-19b9-558b-83a8-ea281c41bdb0"
 		date = "2024-12-01"
 		modified = "2021-04-06"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/ransom_BlackKingDom.yar#L3-L49"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "334e84a9469367ed64509203feb61b5f64d5a7e38d29ff5c5089631246b06588"
+		logic_hash = "v1_sha256_334e84a9469367ed64509203feb61b5f64d5a7e38d29ff5c5089631246b06588"
 		score = 50
 		quality = 68
 		tags = "RANSOMWARE, FILE"
@@ -198905,20 +198971,20 @@ rule TRELLIX_ARC_Ransom_Black_Kingdom : RANSOMWARE FILE
 		$28 = {3C0D4A68792594D2F23F10A465B38B75D272318CA0E532A8A183F8CE5DEE6B45ECFDC96E4FF9158832472ED8CDFA69F92868A503F821D848CBB97B58332D8F84}
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule TRELLIX_ARC_Cryptonar_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect CryptoNar Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "0911250f-fc1f-58bc-ac09-d77d2a2ed3ce"
+		id = "db89c589-8d09-57ab-9892-cedd884e7df7"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_CryptoNar.yar#L1-L36"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "04c1c4f45ad3552aa0876c3b645c6ca92493018f7fdc5d9d9ed26cf67199d21b"
+		logic_hash = "v1_sha256_04c1c4f45ad3552aa0876c3b645c6ca92493018f7fdc5d9d9ed26cf67199d21b"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -198944,22 +199010,20 @@ rule TRELLIX_ARC_Cryptonar_Ransomware : RANSOMWARE FILE
 		$s14 = "CryptoNarDecryptor.Properties.Resources.resources" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB) and all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB ) and all of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Ransom_Vovalex_Part2 : RANSOM FILE
 {
 	meta:
 		description = "Vovalex ransomware detection part 2"
 		author = "CB @ ATR"
-		id = "26c91d06-13da-5039-8b8a-eb8de2774d79"
+		id = "0ed0ca43-0e46-545a-a050-fa02d5b255ea"
 		date = "2021-02-01"
 		modified = "2021-02-01"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Vovalex1.yar#L3-L42"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "82814fd9155ec910c6353de8336733704e05c9f02409ad99cd80da8ef9fe3c04"
+		logic_hash = "v1_sha256_82814fd9155ec910c6353de8336733704e05c9f02409ad99cd80da8ef9fe3c04"
 		score = 75
 		quality = 64
 		tags = "RANSOM, FILE"
@@ -198995,20 +199059,20 @@ rule TRELLIX_ARC_Ransom_Vovalex_Part2 : RANSOM FILE
 		$op2 = { 4c 8d 85 40 ff ff ff 4c 8d 15 d2 78 02 00 4c 89 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and ( 1 of ( $x* ) and 4 of them ) and all of ( $op* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_RANSOM_Exorcist : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Exorcist"
 		author = "McAfee ATR Team"
-		id = "38ab069d-b030-5459-a42f-7ecd5963e68f"
+		id = "437bf7a3-6363-50e2-84c6-238461f63dfd"
 		date = "2020-09-01"
 		modified = "2020-10-12"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Exorcist.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "c376382e60aae0f661151495097d3d93f185faebb11781dbf083324c23a07247"
+		logic_hash = "v1_sha256_c376382e60aae0f661151495097d3d93f185faebb11781dbf083324c23a07247"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199025,20 +199089,20 @@ rule TRELLIX_ARC_RANSOM_Exorcist : RANSOMWARE FILE
 		$sq2 = { 48 8B C4 48 81 EC 38 01 00 00 48 8D 50 08 C7 40 08 04 01 00 00 48 8D 4C 24 20 FF 15 ?? ?? ?? ?? 48 8D 4C 24 20 E8 ?? ?? ?? ?? 48 81 C4 38 01 00 00 C3 }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
 rule TRELLIX_ARC_Bitpaymer_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect BitPaymer Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "20b91cf2-2a84-55d9-8230-90d7b20a461f"
+		id = "3b526246-9ced-5881-abfe-278c0f5fd2da"
 		date = "2019-11-08"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/spanish-mssp-targeted-by-bitpaymer-ransomware/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Bitpaymer.yar#L1-L72"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "527cdbdf51e6f3f5d58e805cf4a1bc09c9d24880c2323046acef6ee03c92d62f"
+		logic_hash = "v1_sha256_527cdbdf51e6f3f5d58e805cf4a1bc09c9d24880c2323046acef6ee03c92d62f"
 		score = 75
 		quality = 66
 		tags = "RANSOMWARE, FILE"
@@ -199077,21 +199141,21 @@ rule TRELLIX_ARC_Bitpaymer_Ransomware : RANSOMWARE FILE
 		$oh2 = { 56 52 ba 00 10 fe 00 8b f1 e8 28 63 00 00 8b c6 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB) and ($s1 and all of ($op*)) or ($pdb and all of ($oj*)) or ($t1 and all of ($ok*)) or ($random and all of ($oi*)) or ($random and all of ($ou*)) or ($random and all of ($oa*) and $ou0) or ($random and all of ($oy*)) or ($random and all of ($oh*)) or ($random and $ou0) or ($random and $oi1)
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB ) and ( $s1 and all of ( $op* ) ) or ( $pdb and all of ( $oj* ) ) or ( $t1 and all of ( $ok* ) ) or ( $random and all of ( $oi* ) ) or ( $random and all of ( $ou* ) ) or ( $random and all of ( $oa* ) and $ou0 ) or ( $random and all of ( $oy* ) ) or ( $random and all of ( $oh* ) ) or ( $random and $ou0 ) or ( $random and $oi1 )
 }
 rule TRELLIX_ARC_Locdoor_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Locdoor/DryCry"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "d855d7fd-a1e3-561e-906e-103752285b0f"
+		id = "6c918a58-5180-584d-b478-7dd033c64060"
 		date = "2018-09-02"
 		modified = "2020-08-14"
 		reference = "https://twitter.com/leotpsc/status/1036180615744376832"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_locdoor.yar#L1-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "0000c55f7cdbbad9bacba0e79637696f3bfeb95a5f71dfa0b398bc77a207eb41"
-		logic_hash = "c9519279a929feedae2bab58cd0de91f6c447827fa59afa927726fde84d21e1c"
+		logic_hash = "v1_sha256_c9519279a929feedae2bab58cd0de91f6c447827fa59afa927726fde84d21e1c"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199112,20 +199176,20 @@ rule TRELLIX_ARC_Locdoor_Ransomware : RANSOMWARE FILE
 		$s9 = "Please enter the password." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB) and all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB ) and all of them
 }
 rule TRELLIX_ARC_Ransom_Linux_Hellokitty_0721 : RANSOMWARE FILE
 {
 	meta:
 		description = "rule to detect Linux variant of the Hello Kitty Ransomware"
 		author = "Christiaan @ ATR"
-		id = "097b02e7-93d8-5d4f-9964-7b660b3cd7b9"
+		id = "4aa66ef0-7e7f-538f-811e-4811fb308294"
 		date = "2021-07-19"
 		modified = "2021-07-19"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Linux_HelloKitty0721.yar#L1-L28"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "77a3809df4c7c591a855aaecd702af62935952937bb81661aa7f68e64dcf4fb4"
+		logic_hash = "v1_sha256_77a3809df4c7c591a855aaecd702af62935952937bb81661aa7f68e64dcf4fb4"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199149,7 +199213,7 @@ rule TRELLIX_ARC_Ransom_Linux_Hellokitty_0721 : RANSOMWARE FILE
 		$v11 = "ChaCha20 for x86_64, CRYPTOGAMS by <appro@openssl.org>" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and (8 of them )) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 200KB and ( 8 of them ) ) or ( all of them )
 }
 import "pe"
 
@@ -199158,13 +199222,13 @@ rule TRELLIX_ARC_Ransom_Mespinoza : FILE
 	meta:
 		description = "rule to detect Mespinoza ransomware"
 		author = "Christiaan Beek @ McAfee ATR"
-		id = "70a76bc4-e0cb-5caa-bb64-1a732349d2ce"
+		id = "b4fe6bbe-10be-5bc4-ac4c-2d19315a9a45"
 		date = "2020-11-24"
 		modified = "2020-11-24"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Mespinoza.yar#L3-L27"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "e245fb9a71d86209690a6f4c7aa38c10dbd32cda2ea3ecde08d0d94e896381cb"
+		logic_hash = "v1_sha256_e245fb9a71d86209690a6f4c7aa38c10dbd32cda2ea3ecde08d0d94e896381cb"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -199185,21 +199249,21 @@ rule TRELLIX_ARC_Ransom_Mespinoza : FILE
 		$op2 = { e8 ef c5 fe ff b8 ff ff ff 7f eb 76 8b 4d 0c 85 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and pe.imphash()=="b5e8bd2552848bb7bf2f28228d014742" and (8 of them ) and 2 of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and pe.imphash ( ) == "b5e8bd2552848bb7bf2f28228d014742" and ( 8 of them ) and 2 of ( $op* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_Amba_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Amba Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "961f2892-e462-55e4-bd96-7dff895cb1e6"
+		id = "24f709e0-558d-564a-8e69-08e57e1b90a6"
 		date = "2017-07-03"
 		modified = "2020-08-14"
 		reference = "https://www.enigmasoftware.com/ambaransomware-removal/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_amba.yar#L1-L41"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "b9b6045a45dd22fcaf2fc13d39eba46180d489cb4eb152c87568c2404aecac2f"
-		logic_hash = "0830ab49956711d3e6ad64785edcf54146a24756c4ab66384305dc18091867bd"
+		logic_hash = "v1_sha256_0830ab49956711d3e6ad64785edcf54146a24756c4ab66384305dc18091867bd"
 		score = 75
 		quality = 68
 		tags = "RANSOMWARE, FILE"
@@ -199228,21 +199292,21 @@ rule TRELLIX_ARC_Amba_Ransomware : RANSOMWARE FILE
 		$s17 = "LWVuY3J5cHQgcHQzIC1wIA=="
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and (8 of them )) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 8 of them ) ) or ( all of them )
 }
 rule TRELLIX_ARC_Robbinhood_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Robbinhood GoLang ransowmare"
 		author = "Christiaan Beek | McAfee ATR"
-		id = "b2654d00-330e-511e-b8f1-75aa7b57d040"
+		id = "df5b576b-ef1d-5f0f-920e-7ba06a3dd258"
 		date = "2019-05-10"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_RobbinHood.yar#L1-L37"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "9977ba861016edef0c3fb38517a8a68dbf7d3c17de07266cfa515b750b0d249e"
-		logic_hash = "19a1b7d92bc49dee6da3fb4c053b118e6475aeca43e891d46470c2c09c148038"
+		logic_hash = "v1_sha256_19a1b7d92bc49dee6da3fb4c053b118e6475aeca43e891d46470c2c09c148038"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199265,20 +199329,20 @@ rule TRELLIX_ARC_Robbinhood_Ransomware : RANSOMWARE FILE
 		$op2 = { 0f b6 34 18 8d 7e d0 97 80 f8 09 97 77 39 81 fd }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and (1 of ($s*)) and all of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of ( $s* ) ) and all of ( $op* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_Ransom_Monglock : RANSOMWARE FILE
 {
 	meta:
 		description = "Ransomware encrypting Mongo Databases "
 		author = "Christiaan Beek - McAfee ATR team"
-		id = "4350a874-dd76-5379-af9f-f1d190385706"
+		id = "cdb2eed8-16cf-534b-8b78-17d26570c954"
 		date = "2019-04-25"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_MONGOLOCK.yar#L1-L41"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "245a7377a410828ed8bc7148f36af6d143ad20d16840238ed5b6d6f94f015984"
+		logic_hash = "v1_sha256_245a7377a410828ed8bc7148f36af6d143ad20d16840238ed5b6d6f94f015984"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199305,21 +199369,21 @@ rule TRELLIX_ARC_Ransom_Monglock : RANSOMWARE FILE
 		$op2 = { c7 41 0c df ff ff ff c7 41 10 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) and 4 of them ) and all of ( $op* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_Kraken_Cryptor_Ransomware_Loader : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the Kraken Cryptor Ransomware loader"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "e6bfa30b-6565-5d03-8f4d-96fc2b6a1c11"
+		id = "5faa92a1-40df-5da0-aa7c-0ff4df120c90"
 		date = "2018-09-30"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Kraken.yar#L1-L30"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd"
-		logic_hash = "9e252a3ba7f6bf861ea7563461a1420959dfb0f5b7c3f6071150d03422504539"
+		logic_hash = "v1_sha256_9e252a3ba7f6bf861ea7563461a1420959dfb0f5b7c3f6071150d03422504539"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199337,21 +199401,21 @@ rule TRELLIX_ARC_Kraken_Cryptor_Ransomware_Loader : RANSOMWARE FILE
 		$s5 = "UNIQUE KEY" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and $pdb or all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and $pdb or all of ( $s* )
 }
 rule TRELLIX_ARC_Kraken_Cryptor_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the Kraken Cryptor Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "7e1e5fa8-6d87-5e64-a8d4-4dae55ab76ca"
+		id = "a6fd3691-abba-5757-b7d3-660c69f092d5"
 		date = "2018-09-30"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Kraken.yar#L32-L64"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd"
-		logic_hash = "2ad7f0bf6110eab79e0f9541c49ae44089ebca3f91ffa80de874d60d5a7ed266"
+		logic_hash = "v1_sha256_2ad7f0bf6110eab79e0f9541c49ae44089ebca3f91ffa80de874d60d5a7ed266"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199371,20 +199435,20 @@ rule TRELLIX_ARC_Kraken_Cryptor_Ransomware : RANSOMWARE FILE
 		$uac = "<!--<requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\" />-->   " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of ($fw*) or all of ($s*) or $uac
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of ( $fw* ) or all of ( $s* ) or $uac
 }
 rule TRELLIX_ARC_Ransom_Note_Kraken_Cryptor_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the ransom note delivered by Kraken Cryptor Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "dec9d364-daf9-5a1d-8e72-ed4dd2aeecdf"
+		id = "121c2eea-50c1-55c1-8f16-444c6a23fffc"
 		date = "2018-09-30"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Kraken.yar#L66-L108"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "d4acdf0716320b0f757b8dbc97bb9d407460b2d69dc8e12292539e823be0f57d"
+		logic_hash = "v1_sha256_d4acdf0716320b0f757b8dbc97bb9d407460b2d69dc8e12292539e823be0f57d"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199417,20 +199481,20 @@ rule TRELLIX_ARC_Ransom_Note_Kraken_Cryptor_Ransomware : RANSOMWARE FILE
 		$s20 = "Please send your message with same subject to both address." fullword ascii
 
 	condition:
-		uint16(0)==0x4120 and filesize <9KB and all of them
+		uint16( 0 ) == 0x4120 and filesize < 9KB and all of them
 }
 rule TRELLIX_ARC_RANSOM_Mountlocker : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Mount Locker ransomware"
 		author = "McAfee ATR Team"
-		id = "8451b78c-3cef-557a-a2e3-0767a0b0eddb"
+		id = "2c78e4c0-b7d1-56dd-9ea8-f246ec3651de"
 		date = "2020-09-25"
 		modified = "2020-10-12"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_mountlocker.yar#L1-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "fb332a6725b9276cca379dd3621943c69f88570fb317da27a857a2544d2aa4e0"
+		logic_hash = "v1_sha256_fb332a6725b9276cca379dd3621943c69f88570fb317da27a857a2544d2aa4e0"
 		score = 75
 		quality = 64
 		tags = "RANSOMWARE, FILE"
@@ -199448,21 +199512,21 @@ rule TRELLIX_ARC_RANSOM_Mountlocker : RANSOMWARE FILE
 		$s3 = {36 6d 6c 7a 61 68 6b 63 37 76 65 6a 79 74 70 70 62 71 68 71 6a 6f 75 34 69 70 66 74 67 73 33 67 69 7a 6f 66 32 78 34 7a 6b 6c 62 6c 6c 69 61 79 68 73 71 62 33 77 61 64 2e 6f 6e 69 6f 6e}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and ($s1 and $s2) or ($s1 and $s3) or $s1
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( $s1 and $s2 ) or ( $s1 and $s3 ) or $s1
 }
 rule TRELLIX_ARC_RANSOM_Makop : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the unpacked Makop ransomware samples"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "2828f2f9-4702-5cef-8b4e-7e98146c0332"
+		id = "3edddb88-ac20-5c0f-894b-17b9c2b96d60"
 		date = "2020-07-19"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_makop.yar#L1-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "008e4c327875110b96deef1dd8ef65cefa201fef60ca1cbb9ab51b5304e66fe1"
-		logic_hash = "2b4f8b90d46530421b66dbb04df6e84d268709fbee884536d8acc91e1b85f8a4"
+		logic_hash = "v1_sha256_2b4f8b90d46530421b66dbb04df6e84d268709fbee884536d8acc91e1b85f8a4"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199485,20 +199549,20 @@ rule TRELLIX_ARC_RANSOM_Makop : RANSOMWARE FILE
 		$pattern_9 = { 85c0 7407 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize < 237568
 }
 rule TRELLIX_ARC_Clop_Ransom_Note : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Clop Ransomware Note"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "b18e4d4d-aa38-5009-a31b-ed038c5bd4f9"
+		id = "bf69fe94-3fb9-5dcc-9a76-d2dbf1e13d48"
 		date = "2019-08-01"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_ClopRansomNote.yar#L1-L34"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "a90862e9dc59b1a8f38b777b4f529d5de740d0f49175813cae64f10ca9677826"
+		logic_hash = "v1_sha256_a90862e9dc59b1a8f38b777b4f529d5de740d0f49175813cae64f10ca9677826"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199522,24 +199586,24 @@ rule TRELLIX_ARC_Clop_Ransom_Note : RANSOMWARE FILE
 		$s11 = "eqaltech.su" fullword ascii
 
 	condition:
-		( uint16(0)==0x6f59) and filesize <10KB and all of them
+		( uint16( 0 ) == 0x6f59 ) and filesize < 10KB and all of them
 }
-import "hash"
 import "pe"
+import "hash"
 
 rule TRELLIX_ARC_Ransom_Egregor : RANSOMWARE FILE
 {
 	meta:
 		description = "Detect Egregor ransomware"
 		author = "Thomas Roccia | McAfee ATR team"
-		id = "b9f1a712-c168-5e0f-8b9e-cb03a6c43fc3"
+		id = "cb639274-ab68-57a5-837f-5de8544f1e9a"
 		date = "2020-10-28"
 		modified = "2020-10-28"
 		reference = "https://bazaar.abuse.ch/sample/004a2dc3ec7b98fa7fe6ae9c23a8b051ec30bcfcd2bc387c440c07ff5180fe9a/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_egregor.yar#L4-L31"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "5f9fcbdf7ad86583eb2bbcaa5741d88a"
-		logic_hash = "8077c656eed0b1633da54f8d017d4eff122f2f4e486c4e1af6f6434ea33c0675"
+		logic_hash = "v1_sha256_8077c656eed0b1633da54f8d017d4eff122f2f4e486c4e1af6f6434ea33c0675"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199557,21 +199621,21 @@ rule TRELLIX_ARC_Ransom_Egregor : RANSOMWARE FILE
 		$s3 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and hash.sha256(pe.rich_signature.clear_data)=="b030ed1a7ca222a0923a59f321be7e55b8d0fc24c1134df1ba775bcf0994c79c" or (pe.sections[4].name==".gfids" and pe.sections[5].name==".00cfg") and ( any of ($p*) or 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and hash.sha256 ( pe.rich_signature.clear_data ) == "b030ed1a7ca222a0923a59f321be7e55b8d0fc24c1134df1ba775bcf0994c79c" or ( pe.sections [ 4 ] . name == ".gfids" and pe.sections [ 5 ] . name == ".00cfg" ) and ( any of ( $p* ) or 2 of ( $s* ) )
 }
 rule TRELLIX_ARC_Ransom_Xinof : RANSOMWARE FILE
 {
 	meta:
 		description = "Detect Xinof ransomware"
 		author = "Thomas Roccia | McAfee ATR team"
-		id = "3b064ce4-cd5b-5a4a-bb55-a2c2c361791e"
+		id = "69c173f2-aa94-56b2-9361-ec6a7a21cdf7"
 		date = "2020-11-20"
 		modified = "2020-11-20"
 		reference = "https://labs.sentinelone.com/the-fonix-raas-new-low-key-threat-with-unnecessary-complexities/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_xinof.yar#L53-L82"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "0c1e6299a2392239dbe7fead33ef4146"
-		logic_hash = "42110ee8869d56c53dc201cbc83652c6457541b8d502aa12b37ef6200e735a15"
+		logic_hash = "v1_sha256_42110ee8869d56c53dc201cbc83652c6457541b8d502aa12b37ef6200e735a15"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199594,21 +199658,21 @@ rule TRELLIX_ARC_Ransom_Xinof : RANSOMWARE FILE
 		$s10 = "XINOF Ransomware Version 3.3" nocase ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 5 of ($s*) or TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 5 of ( $s* ) or TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE
 }
 rule TRELLIX_ARC_Pico_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Pico Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "843cac7a-652e-5cbf-a09d-fb4b1eaa8481"
+		id = "508e8dcf-0ded-5a8e-aa13-42839a45b823"
 		date = "2018-08-30"
 		modified = "2020-08-14"
 		reference = "https://twitter.com/siri_urz/status/1035138577934557184"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Pico.yar#L1-L37"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "cc4a9e410d38a29d0b6c19e79223b270e3a1c326b79c03bec73840b37778bc06"
-		logic_hash = "bb15e66504f393bcb4b173cb2a4ec65aa13110060f7fb70282330b5f6d72f5ed"
+		logic_hash = "v1_sha256_bb15e66504f393bcb4b173cb2a4ec65aa13110060f7fb70282330b5f6d72f5ed"
 		score = 75
 		quality = 20
 		tags = "RANSOMWARE, FILE"
@@ -199634,7 +199698,7 @@ rule TRELLIX_ARC_Pico_Ransomware : RANSOMWARE FILE
 		$s13 = "operator co_await" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB) and all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB ) and all of them
 }
 import "pe"
 
@@ -199643,14 +199707,14 @@ rule TRELLIX_ARC_Ragnarlocker_Ransomware : RANSOMWARE FILE
 	meta:
 		description = "Rule to detect RagnarLocker samples"
 		author = "McAfee ATR Team"
-		id = "58874f27-3070-52c9-bd96-337fdaa4499b"
+		id = "cd2cac4f-ab0f-5eab-93ba-4ecc107fc4e3"
 		date = "2020-04-15"
 		modified = "2020-10-12"
 		reference = "https://www.bleepingcomputer.com/news/security/ragnar-locker-ransomware-targets-msp-enterprise-support-tools/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_ragnarlocker.yar#L3-L45"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "9706a97ffa43a0258571def8912dc2b8bf1ee207676052ad1b9c16ca9953fc2c"
-		logic_hash = "2f31da9182a1b47fb1e7e4459461de4c496ec323ff13e622d3ce27ac8cce1912"
+		logic_hash = "v1_sha256_2f31da9182a1b47fb1e7e4459461de4c496ec323ff13e622d3ce27ac8cce1912"
 		score = 75
 		quality = 68
 		tags = "RANSOMWARE, FILE"
@@ -199674,21 +199738,21 @@ rule TRELLIX_ARC_Ragnarlocker_Ransomware : RANSOMWARE FILE
 		$bp2 = { 8d 85 7c ff ff ff 89 85 64 ff ff ff 8d 4d 84 89 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (4 of ($s*) and $op1) or all of ($p*) and pe.imphash()=="9f611945f0fe0109fe728f39aad47024" or all of ($bp*) and pe.imphash()=="489a2424d7a14a26bfcfb006de3cd226"
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 4 of ( $s* ) and $op1 ) or all of ( $p* ) and pe.imphash ( ) == "9f611945f0fe0109fe728f39aad47024" or all of ( $bp* ) and pe.imphash ( ) == "489a2424d7a14a26bfcfb006de3cd226"
 }
 rule TRELLIX_ARC_Screenlocker_Acroware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the ScreenLocker Acroware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "76eb69eb-dfe7-5629-bf2d-d20574efd662"
+		id = "c132b5f9-40cf-5599-8c27-281326bc2aac"
 		date = "2018-08-28"
 		modified = "2020-08-14"
 		reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_acroware.yar#L1-L29"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "f9efcfc5328e6502cbbbff752a940ac221e437d8732052fc265618f6a6ad72ae"
-		logic_hash = "582f3544cf1f8066b1e9ac04c3a4cc9f0ba96804ca53bc3746b433df9c33e0a1"
+		logic_hash = "v1_sha256_582f3544cf1f8066b1e9ac04c3a4cc9f0ba96804ca53bc3746b433df9c33e0a1"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199706,21 +199770,21 @@ rule TRELLIX_ARC_Screenlocker_Acroware : RANSOMWARE FILE
 		$s5 = "webserver, after 72 hours thedecryption key will get removed and your personal" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB) and all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB ) and all of them
 }
 rule TRELLIX_ARC_Installer_Coronavirus : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the Corona Virus Installer"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "2a224529-bfc7-57ed-91c3-426cae4b7895"
+		id = "495a0983-e891-51da-a7d5-4762ff3f3dcc"
 		date = "2020-03-25"
 		modified = "2020-08-14"
 		reference = "https://twitter.com/malwrhunterteam/status/1238056503493505024"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_coronavirus.yar#L1-L41"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed"
-		logic_hash = "26be8bbfbf615967cc2a0e2d4179cd5f444c53f170a681d2ec236244881dc629"
+		logic_hash = "v1_sha256_26be8bbfbf615967cc2a0e2d4179cd5f444c53f170a681d2ec236244881dc629"
 		score = 75
 		quality = 62
 		tags = "RANSOMWARE, FILE"
@@ -199739,21 +199803,21 @@ rule TRELLIX_ARC_Installer_Coronavirus : RANSOMWARE FILE
 		$s7 = { 25 73 5C 6C 6F 67 5F 25 30 34 64 25 30 32 64 25 30 32 64 5F 25 64 2E 6C 6F 67 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
 rule TRELLIX_ARC_Ransomware_Coronavirus : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the Corona Virus ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "4195a57b-cd51-5050-861a-6436f7ec4eca"
+		id = "4643d0eb-86e6-5713-9475-2006ee5530e1"
 		date = "2020-03-25"
 		modified = "2020-08-14"
 		reference = "https://twitter.com/malwrhunterteam/status/1238056503493505024"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_coronavirus.yar#L43-L80"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "3299f07bc0711b3587fe8a1c6bf3ee6bcbc14cb775f64b28a61d72ebcb8968d3"
-		logic_hash = "2a7e1676a20f30b0cb0321579bb85e4836e2aee5f56b838d2ff2bec7a08c489f"
+		logic_hash = "v1_sha256_2a7e1676a20f30b0cb0321579bb85e4836e2aee5f56b838d2ff2bec7a08c489f"
 		score = 75
 		quality = 64
 		tags = "RANSOMWARE, FILE"
@@ -199771,21 +199835,21 @@ rule TRELLIX_ARC_Ransomware_Coronavirus : RANSOMWARE FILE
 		$s5 = { 5C 5C 2E 5C 50 68 79 73 69 63 61 6C 44 72 69 76 65 25 64 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule TRELLIX_ARC_Anatova_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the Anatova Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "6e3205aa-42e4-5449-877e-37494cdd096b"
+		id = "c5761c04-de77-51c1-911d-7363819b0460"
 		date = "2019-01-22"
 		modified = "2020-08-14"
 		reference = "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/happy-new-year-2019-anatova-is-here/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Anatova.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "97fb79ca6fc5d24384bf5ae3d01bf5e77f1d2c0716968681e79c097a7d95fb93"
-		logic_hash = "4fce15ad0ef2d3cb39f6092677f117308f847815cb2a5a491290a1f9d09776df"
+		logic_hash = "v1_sha256_4fce15ad0ef2d3cb39f6092677f117308f847815cb2a5a491290a1f9d09776df"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199799,21 +199863,21 @@ rule TRELLIX_ARC_Anatova_Ransomware : RANSOMWARE FILE
 		$regex = /anatova[0-9]@tutanota.com/
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and $regex
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and $regex
 }
 rule TRELLIX_ARC_Lockergogaransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "LockerGoga Ransomware"
 		author = "Christiaan Beek - McAfee ATR team"
-		id = "bdf5da34-adf0-5731-820f-96511e647a83"
+		id = "04254cc8-da23-508a-a6a5-b7cfbca93837"
 		date = "2019-03-20"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_LockerGoga.yar#L1-L36"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "ba15c27f26265f4b063b65654e9d7c248d0d651919fafb68cb4765d1e057f93f"
-		logic_hash = "165fa0fa044b2e0d2344626c2064162f23e13dc17310a772b703dbbe9457bd99"
+		logic_hash = "v1_sha256_165fa0fa044b2e0d2344626c2064162f23e13dc17310a772b703dbbe9457bd99"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199837,21 +199901,21 @@ rule TRELLIX_ARC_Lockergogaransomware : RANSOMWARE FILE
 		$op2 = { 8b df 83 cb 0f 81 fb ff ff ff 7f 76 07 bb ff ff }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (6 of them ) and all of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 6 of them ) and all of ( $op* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_RANSOM_Babuk_Packed_Feb2021 : RANSOM T1027_005 T1027 T1083 T1082 T1059 T1129 FILE
 {
 	meta:
 		description = "Rule to detect Babuk Locker packed"
 		author = "McAfee ATR"
-		id = "f5f3a3a6-2531-56c4-9153-b698c7bdc3d3"
+		id = "4371a538-d7f3-56b2-89a1-ffbe78945d1c"
 		date = "2021-02-19"
 		modified = "2021-02-24"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Babuk_Packed_Feb2021.yar#L1-L30"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "48e0f7d87fe74a2b61c74f0d32e6a8a5"
-		logic_hash = "f3312b9c9147e9f892dbfb329cb95d3ee3ae67eefeec2d089b8c89fd26531953"
+		logic_hash = "v1_sha256_f3312b9c9147e9f892dbfb329cb95d3ee3ae67eefeec2d089b8c89fd26531953"
 		score = 75
 		quality = 70
 		tags = "RANSOM, T1027.005, T1027, T1083, T1082, T1059, T1129, FILE"
@@ -199870,7 +199934,7 @@ rule TRELLIX_ARC_RANSOM_Babuk_Packed_Feb2021 : RANSOM T1027_005 T1027 T1083 T108
 		$files_encryption3 = { 8A 46 ?? C1 E9 02 88 47 ?? 83 EE 02 83 EF 02 83 F9 08 72 ?? FD F3 A5 FC FF 24 95 ?? ?? ?? ??}
 
 	condition:
-		filesize <=300KB and any of ($first_stage*) and any of ($files_encryption*)
+		filesize <= 300KB and any of ( $first_stage* ) and any of ( $files_encryption* )
 }
 import "pe"
 
@@ -199879,13 +199943,13 @@ rule TRELLIX_ARC_Megacortex_Signed : RANSOMWARE FILE
 	meta:
 		description = "Rule to detect MegaCortex samples digitally signed"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "78a74e30-4de0-5e63-8ca5-31251c296f98"
+		id = "30a38ef5-7a18-5d71-baf9-de0ff3332f59"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://blog.malwarebytes.com/detections/ransom-megacortex/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_MegaCortex.yar#L3-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8ffced3aca837682fbd7ee68f559f73b8299cbfbe198f48124c4857680735249"
+		logic_hash = "v1_sha256_8ffced3aca837682fbd7ee68f559f73b8299cbfbe198f48124c4857680735249"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199895,22 +199959,20 @@ rule TRELLIX_ARC_Megacortex_Signed : RANSOMWARE FILE
 		actor_group = "Unknown"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "/C=GB/L=ROMFORD/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures[i].serial=="04:c7:cd:cc:16:98:e2:5b:49:3e:b4:33:8d:5e:2f:8b" or pe.signatures[i].subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures[i].serial=="53:cc:4c:69:e5:6a:7d:bc:36:67:d5:ff:d5:24:aa:4b" or pe.signatures[i].subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" or pe.signatures[i].serial=="00:ad:72:9a:65:f1:78:47:ac:b8:f8:49:6a:76:80:ff:1e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "/C=GB/L=ROMFORD/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures [ i ] . serial == "04:c7:cd:cc:16:98:e2:5b:49:3e:b4:33:8d:5e:2f:8b" or pe.signatures [ i ] . subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures [ i ] . serial == "53:cc:4c:69:e5:6a:7d:bc:36:67:d5:ff:d5:24:aa:4b" or pe.signatures [ i ] . subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" or pe.signatures [ i ] . serial == "00:ad:72:9a:65:f1:78:47:ac:b8:f8:49:6a:76:80:ff:1e" )
 }
-import "pe"
-
 rule TRELLIX_ARC_Netwalker_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Netwalker ransomware"
 		author = "McAfee ATR Team"
-		id = "6fe75a64-77b8-5cb8-9365-a5336d4d1617"
+		id = "465ab5e2-77b5-5b2e-b6b0-c45b6f33dbdb"
 		date = "2020-03-30"
 		modified = "2020-11-20"
 		reference = "https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L3-L28"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "11da4b57f8d9ed1fdf053053a51870af2cbf4062cc1340087ee70c3e92a1baf6"
+		logic_hash = "v1_sha256_11da4b57f8d9ed1fdf053053a51870af2cbf4062cc1340087ee70c3e92a1baf6"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199924,7 +199986,7 @@ rule TRELLIX_ARC_Netwalker_Ransomware : RANSOMWARE FILE
 		$pattern3 = { CCCCCCCCCC558B??FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF?????????? }
 
 	condition:
-		uint16(0)==0x5a4d and any of ($pattern*)
+		uint16( 0 ) == 0x5a4d and any of ( $pattern* )
 }
 import "pe"
 
@@ -199933,35 +199995,33 @@ rule TRELLIX_ARC_Netwalker_Signed : FILE
 	meta:
 		description = "Rule to detect Netwalker ransomware digitally signed."
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "6806b917-2e02-57e3-887a-b4c12db83653"
+		id = "58e94206-a0b8-5fc8-9cd3-d3f5e4b8a9dc"
 		date = "2020-03-30"
 		modified = "2020-11-20"
 		reference = "https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L30-L47"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "d78ed22771d7c93516375afb8fd2fd7baa40a357ec3c247939a10d11f80ae226"
+		logic_hash = "v1_sha256_d78ed22771d7c93516375afb8fd2fd7baa40a357ec3c247939a10d11f80ae226"
 		score = 75
 		quality = 70
 		tags = "FILE"
 		note = "The rule will hit also some Dridex samples digitally signed"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "/CN=EWBTCAXQKUMDTHCXCZ" and pe.signatures[i].serial=="17:16:bb:93:fb:a9:a2:41:ba:a8:2e:c7:5e:ff:0c" or pe.signatures[i].thumbprint=="a4:28:e9:4a:61:3a:1f:cf:ff:08:bf:e7:61:51:64:31:1a:6f:87:bc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "/CN=EWBTCAXQKUMDTHCXCZ" and pe.signatures [ i ] . serial == "17:16:bb:93:fb:a9:a2:41:ba:a8:2e:c7:5e:ff:0c" or pe.signatures [ i ] . thumbprint == "a4:28:e9:4a:61:3a:1f:cf:ff:08:bf:e7:61:51:64:31:1a:6f:87:bc" )
 }
-import "pe"
-
 rule TRELLIX_ARC_Netwalker : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule based on code overlap in RagnarLocker ransomware"
 		author = "McAfee ATR team"
-		id = "80097a40-534a-5e1b-8fde-e4d832d76698"
+		id = "6b76aac2-2fea-5389-bdbf-8c2b7b5aa6c8"
 		date = "2020-06-14"
 		modified = "2020-11-20"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L49-L75"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8c56ebed9e097d294045de46942c708da9ba7e01475dcecb0c3d41fcc8004780"
+		logic_hash = "v1_sha256_8c56ebed9e097d294045de46942c708da9ba7e01475dcecb0c3d41fcc8004780"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -199979,23 +200039,21 @@ rule TRELLIX_ARC_Netwalker : RANSOMWARE FILE
 		$6 = {8B431813F2F76F4803C88B432813F2F76F3803C88B434013F2F76F200FA4CE0103C903C88B432013F2F76F4003C88B433013F2F76F3003C8894D6013F2897564}
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and all of them
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and all of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Win_Netwalker_Reflective_Dll_Injection_Decoded : RANSOMWARE
 {
 	meta:
 		description = "Rule to detect Reflective DLL Injection Powershell Script dropping Netwalker, after hexadecimal decoded and xor decrypted "
 		author = "McAfee ATR Team"
-		id = "9562c0b9-e7ac-5b96-99cc-1df91cb617af"
+		id = "0bd8d7d0-8ecc-5fd6-a297-53d928a57d92"
 		date = "2020-05-28"
 		modified = "2020-11-20"
 		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/ | https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L77-L140"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "fd29001b8b635e6c51270788bab7af0bb5adba6917c278b93161cfc2bc7bd6ae"
-		logic_hash = "e99c045f39e7933e877a4df7793aa5ea6be5a782bb079419501929ba99844dec"
+		logic_hash = "v1_sha256_e99c045f39e7933e877a4df7793aa5ea6be5a782bb079419501929ba99844dec"
 		score = 75
 		quality = 30
 		tags = "RANSOMWARE"
@@ -200025,21 +200083,21 @@ rule TRELLIX_ARC_Win_Netwalker_Reflective_Dll_Injection_Decoded : RANSOMWARE
 		$artifact8 = {72 65 74 75 72 6e 20 5b 42 69 74 43 6f 6e 76 65 72 74 65 72 5d 3a 3a 54 6f 49 6e 74 36 34}
 
 	condition:
-		6 of ($api*) or ((3 of ($artifact*)))
+		6 of ( $api* ) or ( ( 3 of ( $artifact* ) ) )
 }
 rule TRELLIX_ARC_Snake_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Snake ransomware"
 		author = "McAfee ATR Team"
-		id = "b8f50af5-5568-5676-93a1-e818f08df0ce"
+		id = "3b6b6f21-9319-5dc0-9593-6cde9a46ace6"
 		date = "2020-02-20"
 		modified = "2020-10-12"
 		reference = "https://dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_snake_ransomware.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60"
-		logic_hash = "3ae64fbacbf886b8d09abc3f5f8eb9c8bff809909a251f2d055056e6d12217a2"
+		logic_hash = "v1_sha256_3ae64fbacbf886b8d09abc3f5f8eb9c8bff809909a251f2d055056e6d12217a2"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200053,20 +200111,20 @@ rule TRELLIX_ARC_Snake_Ransomware : RANSOMWARE FILE
 		$snake = { 43 3A 2F 55 73 ?? 72 ?? 2F 57 49 4E 31 2F 67 6F 2F 73 ?? 63 2F 6A 6F 62 6E 68 62 67 6E 6E 69 66 70 6F 64 68 68 70 ?? 6D 66 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 76 74 5F 73 74 ?? 69 6E 67 2E 67 6F 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <11000KB) and all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 11000KB ) and all of them
 }
 rule TRELLIX_ARC_Buran_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Buran ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "b96c0e5c-dce2-559d-9623-81e8a9a322f2"
+		id = "07d33def-9516-53b3-87df-494e10e2e5fd"
 		date = "2019-11-05"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/buran-ransomware-the-evolution-of-vegalocker/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Buran.yar#L1-L27"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "056cf2e6aca22876fb8bfafc14a3be0e42124a26edab42a6f7a928c87fb8fff4"
+		logic_hash = "v1_sha256_056cf2e6aca22876fb8bfafc14a3be0e42124a26edab42a6f7a928c87fb8fff4"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200084,20 +200142,20 @@ rule TRELLIX_ARC_Buran_Ransomware : RANSOMWARE FILE
 		$s5 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 5? 5? A1 ?? ?? ?? ?? 99 E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 4? 5? 8B ?? ?? 8B ?? 83 ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 8C }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule TRELLIX_ARC_Ryuk_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Ryuk Ransomware hunting rule"
 		author = "Christiaan Beek - McAfee ATR team"
-		id = "d3e67e26-3b34-5c28-a1c0-c4aeacd49df9"
+		id = "0ae0fa13-5578-5940-b6ab-5416815035d3"
 		date = "2019-04-25"
 		modified = "2021-07-12"
 		reference = "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/ryuk-ransomware-attack-rush-to-attribution-misses-the-point/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Ryuk.yar#L1-L47"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "43c0be708fa8a388dce6e1dd721e24329b5b08a942d99e9b2631c90155790c4b"
+		logic_hash = "v1_sha256_43c0be708fa8a388dce6e1dd721e24329b5b08a942d99e9b2631c90155790c4b"
 		score = 50
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200129,21 +200187,21 @@ rule TRELLIX_ARC_Ryuk_Ransomware : RANSOMWARE FILE
 		$op1 = { c7 44 24 34 00 40 00 00 c7 44 24 38 01 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) and 4 of them ) and all of ( $op* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_RANSOM_RYUK_May2021 : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect latest May 2021 compiled Ryuk variant"
 		author = "Marc Elias | McAfee ATR Team"
-		id = "6e415a9e-7373-50a8-ad57-f95220faed9c"
+		id = "7b7bdb72-b917-58bc-922a-5c6fe16e5223"
 		date = "2021-05-21"
 		modified = "2021-07-12"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Ryuk.yar#L91-L113"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a"
-		logic_hash = "b379c1182e60ce8c777668386d8cbd08350dd2363770dec56502bf44aaf5d7f6"
+		logic_hash = "v1_sha256_b379c1182e60ce8c777668386d8cbd08350dd2363770dec56502bf44aaf5d7f6"
 		score = 50
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200155,20 +200213,20 @@ rule TRELLIX_ARC_RANSOM_RYUK_May2021 : RANSOMWARE FILE
 		$icmp_echo_constants = { 68 A4 06 00 00 6A 44 8D [1-6] 5? 6A 00 6A 20 [5-20] FF 15 }
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <200KB and ($ryuk_filemarker or ($sleep_constants and $icmp_echo_constants))
+		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 200KB and ( $ryuk_filemarker or ( $sleep_constants and $icmp_echo_constants ) )
 }
 rule TRELLIX_ARC_Lockbit2_Jul21 : FILE
 {
 	meta:
 		description = "simple rule to detect latest Lockbit ransomware Jul 2021"
 		author = "CB @ ATR"
-		id = "22b423df-ae5c-5672-95be-333b13791fc6"
+		id = "1c9d0148-920f-5e4e-ac43-844a4f1251a6"
 		date = "2021-07-28"
 		modified = "2021-07-28"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Lockbit2.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "b3ed7d7c72b7585877293f586bae5ec7b0135b09d518b4e4b08f64e60db5a159"
+		logic_hash = "v1_sha256_b3ed7d7c72b7585877293f586bae5ec7b0135b09d518b4e4b08f64e60db5a159"
 		score = 50
 		quality = 70
 		tags = "FILE"
@@ -200189,21 +200247,21 @@ rule TRELLIX_ARC_Lockbit2_Jul21 : FILE
 		$p8 = "\\LockBit_Ransomware.hta" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($seq*) and 4 of them )) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $seq* ) and 4 of them ) ) or ( all of them )
 }
 rule TRELLIX_ARC_Jeff_Dev_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Jeff Dev Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "dd5e24f4-a2d8-5db5-9e7e-7f8bded5d401"
+		id = "1709348d-04e5-5a5f-827d-59c8c3529b6a"
 		date = "2018-08-26"
 		modified = "2020-08-14"
 		reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_jeff_dev.yar#L1-L28"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "386d4617046790f7f1fcf37505be4ffe51d165ba7cbd42324aed723288ca7e0a"
-		logic_hash = "58a408f4e1781540e4abdb87b85b94c1f0ea49b40bf241d6d074bc2162ac2032"
+		logic_hash = "v1_sha256_58a408f4e1781540e4abdb87b85b94c1f0ea49b40bf241d6d074bc2162ac2032"
 		score = 75
 		quality = 45
 		tags = "RANSOMWARE, FILE"
@@ -200220,21 +200278,21 @@ rule TRELLIX_ARC_Jeff_Dev_Ransomware : RANSOMWARE FILE
 		$s4 = "WHAT YOU DO TO MY COMPUTER??!??!!!" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB) and all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 5000KB ) and all of them
 }
 rule TRELLIX_ARC_Unpacked_Shiva_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect an unpacked sample of Shiva ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "c6cd4421-216f-5c1f-bb8d-fc8ab00bb72d"
+		id = "3a1f5682-8aca-5fe1-9f3a-8abee3e9283a"
 		date = "2018-09-05"
 		modified = "2020-08-14"
 		reference = "https://twitter.com/malwrhunterteam/status/1037424962569732096"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Shiva.yar#L1-L37"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d"
-		logic_hash = "8a6a1d9f3b75617d8f07489ecf2867f90ddcf9fbe1db1e7c0f5c26833f88be3f"
+		logic_hash = "v1_sha256_8a6a1d9f3b75617d8f07489ecf2867f90ddcf9fbe1db1e7c0f5c26833f88be3f"
 		score = 75
 		quality = 66
 		tags = "RANSOMWARE, FILE"
@@ -200260,21 +200318,21 @@ rule TRELLIX_ARC_Unpacked_Shiva_Ransomware : RANSOMWARE FILE
 		$s13 = "After payment we will send you the decryption tool that will decrypt all your files." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB) and all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 800KB ) and all of them
 }
 rule TRELLIX_ARC_Wannaren_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect WannaRen Ransomware"
 		author = "McAfee ATR Team"
-		id = "f4f30d12-547d-5044-a4e5-b88bf359480f"
+		id = "a2d84270-1d5f-5322-ae7a-25d2b029b098"
 		date = "2020-04-25"
 		modified = "2020-10-12"
 		reference = "https://blog.360totalsecurity.com/en/attention-you-may-have-become-a-susceptible-group-of-wannaren-ransomware/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_wannaren.yar#L1-L34"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "7b364f1c854e6891c8d09766bcc9a49420e0b5b4084d74aa331ae94e2cfb7e1d"
-		logic_hash = "0feb913b84eb0ecdda688f0cf0a5051798fe4fbce8a6ea959825985a81a6699c"
+		logic_hash = "v1_sha256_0feb913b84eb0ecdda688f0cf0a5051798fe4fbce8a6ea959825985a81a6699c"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200297,20 +200355,20 @@ rule TRELLIX_ARC_Wannaren_Ransomware : RANSOMWARE FILE
 		$sq9 = { 1440 4b 41 e8???????? 397c0847 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <21000KB and 7 of them
+		uint16( 0 ) == 0x5a4d and filesize < 21000KB and 7 of them
 }
 rule TRELLIX_ARC_RANSOM_Wastedlocker : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect unpacked samples of WastedLocker"
 		author = "McAfee ATR Team"
-		id = "900923cf-75c0-5342-858d-fe1ffa9486bd"
+		id = "445016b7-841a-5e33-b73c-3e75ff2515ed"
 		date = "2020-07-27"
 		modified = "2020-10-12"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_wastedlocker.yar#L1-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "c5adf88a46c34c8683d0e3d70529b352c77209f004e6c638ff079ea025921781"
+		logic_hash = "v1_sha256_c5adf88a46c34c8683d0e3d70529b352c77209f004e6c638ff079ea025921781"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200334,20 +200392,20 @@ rule TRELLIX_ARC_RANSOM_Wastedlocker : RANSOMWARE FILE
 		$pattern_9 = { 8b4d08 8b19 03d8 f7d0 c1c60f 03f2 0bc6 }
 
 	condition:
-		7 of them and filesize <1806288
+		7 of them and filesize < 1806288
 }
 rule TRELLIX_ARC_Purelocker_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect PureLocker ransomware based on binary sequences"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "3d945869-9faa-59de-add6-d664a7beef6f"
+		id = "22a13e80-b14b-57cc-bf4b-d52f2cad441d"
 		date = "2019-11-13"
 		modified = "2020-08-14"
 		reference = "https://www.pandasecurity.com/mediacenter/security/purelocker-ransomware-servers/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_PureLocker.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "9f39f0ef922023a79919f5b41a7acda6c08373af8f5fd2d4c4dcaca6146970ea"
+		logic_hash = "v1_sha256_9f39f0ef922023a79919f5b41a7acda6c08373af8f5fd2d4c4dcaca6146970ea"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200361,7 +200419,7 @@ rule TRELLIX_ARC_Purelocker_Ransomware : RANSOMWARE FILE
 		$sequence = { 31??FF????E8????????83????5BC2????555357BA????????83????C7????????????4A75??E8????????8B????????????8D????E8????????8B????????????8D??????E8????????FF????8D??????????59E8????????75??FF??????8D??????????59E8????????75??EB??B8????????EB??31??21??74??31??0FBE??E9????????8D??????C7????????????C7????????????66??????????FF??????E8????????89??????52E8????????5A5052E8????????5A50FF??????E8????????8D????????????50E8????????8B??????01??89??????8B??????83????53E8????????89??????8B??????21??75??31??0FBE??E9????????68????????68????????FF????????????FF??????E8????????FF????E8????????89??01??89????????????8B????????????83????53E8????????89????????????8B????????????21??75??FF??????E8????????31??0FBE??E9????????68????????68????????FF??????FF????????????E8????????0FBE??????????83????0F85????????8B??????83????53E8????????89????????????8B????????????21??75??E9????????68????????68????????FF??????FF????????????E8????????FF??????E8????????68????????8D??????508D??????5068????????68????????68????????31??5068????????68????????FF????????????FF????????????68????????E8????????89??????8B??????21??75??31??0FBE??E9????????8D??????FF????E8????????8D??????FF????E8????????FF????????????E8????????FF????????????E8????????B8????????0FBE??E9????????EB??68????????8D??????508D??????5068????????68????????68????????31??5068????????68????????FF??????FF????????????68????????E8????????89??????8B??????21??75??31??0FBE??E9????????8D??????508D??????FF????E8????????89????????????FF??????E8????????C7??????????????FF????????????E8????????C7????????????????????C7????????????????????8B????????????21??74??E9????????0FBE????????????83????75??68????????68????????8D????????????5068????????8D??????FF????E8????????89??????EB??68????????68????????8D????????????5068????????8D??????FF????E8????????89??????8B??????21??74??E9????????0FBE????????????83????75??8D????????????8D????FF????FF??8F??????8F??????EB??8D????????????8B????9952508F??????8F??????FF??????FF??????5B5F83????7F??7C??83????77??31??EB??B8????????09??75??E9????????0FBE????????????83????75??68????????E8????????89????????????8B????????????21??75??E9????????68????????68????????68????????FF????????????FF????????????FF????????????8D??????FF????E8????????89????????????EB??68????????E8????????89??????8B??????21??75??E9????????68????????68????????FF??????8B????????????508D??????FF????E8????????89????????????8B????????????21??74??E9????????0FBE????????????83????75??8B????????????21??75??E9????????8B????????????8D????FF????FF??5B5F83????75??83????74??31??EB??B8????????09??74??E9????????EB??8B??????21??75??E9????????8B??????8B????21??75??E9????????0FBE????????????83????75??C7????????????????????FF????????????E8????????89????????????C7????????????????????68????????68????????FF????????????FF????????????8B????????????8D????FF????FF??8D??????FF????E8????????89????????????EB??C7????????????????????FF????????????E8????????89????????????C7????????????????????68????????FF????????????FF????????????8B????????????FF????8D??????FF????E8????????89????????????8B????????????21??74??E9????????0FBE????????????83????75??8B????????????21??7E??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????EB??8B??????21??7E??68????????68????????FF??????E8????????FF??????E8????????C7??????????????0FBE????????????83????75??8B????????????21??75??E9????????8B????????????8D????89??21??75??E9????????EB??8B????????????21??75??E9????????8B????????????8D????89??21??75??E9????????8B??????83????53E8????????89????????????8B????????????21??75??E9????????68????????68????????FF??????FF????????????E8????????0FBE????????????83????75??68????????68????????FF??????FF????????????8B????????????8D????FF????FF??8D??????FF????E8????????89????????????EB??68????????FF??????FF????????????8B????????????FF????8D??????FF????E8????????89????????????FF????????????E8????????C7????????????????????0FBE????????????83????75??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????EB??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????8B????????????21??74??EB??68????????8D??????FF????E8????????89????????????8B????????????21??74??EB??0FBE????????????83????75??68????????31??508D??????FF????E8????????C6????????8D??????FF????E8????????8D??????FF????E8????????0FBE??????0FBE??E9????????8B????????????21??7E??FF????????????E8????????8B????????????21??7E??FF????????????E8????????8B????????????21??7E??FF????????????E8????????8B??????21??7E??FF??????E8????????8B????????????21??7E??FF????????????E8????????8D??????8B????21??7E??68????????8D??????FF????E8????????8D??????8B????21??7E??8D??????FF????E8????????8D??????8B????21??7E??8D??????FF????E8????????31??0FBE??EB??31??FF????E8????????FF????????????E8????????FF??????E8????????81??????????5F5B5DC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????31??C2????5553BA????????83????C7????????????4A75??E8????????8B??????8D????E8????????83????????????0F84????????FF????E8????????89??01??89??????8B??????83????53E8????????89??????83????????74??68????????68????????FF??????FF??????E8????????89??3B??????75??8B??????83????538D??????5866??????FF??????5866??????FF??????5889????FF??????????5889??????8D??????508D??????5068????????68????????FF??????89??21??75??FF??????5889??????FF??????E8????????8B??????EB??31??FF????E8????????83????5B5DC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????31??5050E8????????FF??????E8????????52E8????????5A50FF??????????8D??????????50E8????????8D??????50E8????????52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????8D??????50E8????????FF????8D??????????59E8????????74??52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????588B??????52E8????????8D??????50E8????????EB??8B????52E8????????5A5052E8????????8B??????52E8????????8D??????50E8????????8B????52E8????????5A5052E8????????5850E8????????5A01??EB??E8????????66????????FF????E8????????FF??????E8????????83????C331??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????555331??50505050E8????????C7??????????????FF??????E8????????89????8B????21??75??31??EB??8D??????50FF??????FF??????68????????E8????????89??21??75??8B????FF????5889??????68????????68????????FF??????E8????????FF????E8????????8B??????EB??31??83????5B5DC35331??50505050E8????????8B??????8D????E8????????FF????E8????????89??????8B??????83????53E8????????89??????83????????74??68????????FF??????FF??????FF??????E8????????21??74??FF??????FF??????68????????E8????????89??F7??89??????FF??????E8????????8B??????EB??31??FF????E8????????83????5BC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????5553BA????????83????C7????????????4A75??E8????????8B??????8D????E8????????FF????8D??????????59E8????????74??31??E9????????52E8????????5A50FF??????????8D??????????50E8????????8B??????52E8????????8D??????50E8????????FF??????E8????????89??01??89??????8B??????83????53E8????????89??????83????????0F84????????68????????68????????FF??????FF??????E8????????89??3B??????0F85????????FF??????8D??????5866??????8B??????83????535866??????FF??????5889????C7??????????????8D??????????8D??????E8????????8D??????C7????????????C7????????????8D??????505889????68????????68????????8D??????508D??????5068????????8D??????50E8????????89??21??75??8B??????21??7E??B8????????EB??31??21??74??FF??????E8????????C7??????????????68????????68????????8D??????508D??????50FF??????E8????????89??21??75??8D??????FF????5889??????FF??????E8????????8B??????21??7E??FF??????E8????????8B??????EB??31??FF??????E8????????FF????E8????????83????5B5DC2????555357BA????????83????C7???????????? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 import "pe"
 
@@ -200370,13 +200428,13 @@ rule TRELLIX_ARC_Badbunny : RANSOMWARE FILE
 	meta:
 		description = "Bad Rabbit Ransomware"
 		author = "Christiaan Beek"
-		id = "190ee396-4c26-54f7-baac-bb45e3587488"
+		id = "bc8271fb-fc21-5912-b6d5-de0ef824d43b"
 		date = "2017-10-24"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_BadRabbit.yar#L3-L47"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "2879b8dc1ca0e86253354ac24b56d950878b23215b503da9b1d5faabd2c4bf9d"
+		logic_hash = "v1_sha256_2879b8dc1ca0e86253354ac24b56d950878b23215b503da9b1d5faabd2c4bf9d"
 		score = 75
 		quality = 45
 		tags = "RANSOMWARE, FILE"
@@ -200409,22 +200467,20 @@ rule TRELLIX_ARC_Badbunny : RANSOMWARE FILE
 		$s19 = "bootable partition not mounted" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and pe.imphash()=="94f57453c539227031b918edd52fc7f1" and (1 of ($x*) or 4 of them )) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and pe.imphash ( ) == "94f57453c539227031b918edd52fc7f1" and ( 1 of ( $x* ) or 4 of them ) ) or ( all of them )
 }
-import "pe"
-
 rule TRELLIX_ARC_Badrabbit_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Bad Rabbit Ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "d6e78c14-0913-5eed-be15-a6d1a8cd1a8d"
+		id = "432b6d04-28ac-53af-81de-db52f731f2b5"
 		date = "2024-12-01"
 		modified = "2020-08-14"
 		reference = "https://securelist.com/bad-rabbit-ransomware/82851/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_BadRabbit.yar#L49-L101"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "7536f021ce7fede0f1a2bf2f4ebc7d6e7269a6dd63005cab1fc6a309a71c61c0"
+		logic_hash = "v1_sha256_7536f021ce7fede0f1a2bf2f4ebc7d6e7269a6dd63005cab1fc6a309a71c61c0"
 		score = 75
 		quality = 43
 		tags = "RANSOMWARE, FILE"
@@ -200458,20 +200514,20 @@ rule TRELLIX_ARC_Badrabbit_Ransomware : RANSOMWARE FILE
 		$ok3 = { e9 ef 05 00 00 6a 10 58 3b f8 73 30 8b 45 f8 85 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*) and all of ($og*)) or all of ($oh*) or all of ($oj*) or all of ($ok*)
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( all of ( $s* ) and all of ( $og* ) ) or all of ( $oh* ) or all of ( $oj* ) or all of ( $ok* )
 }
 rule TRELLIX_ARC_Crime_Ransomware_Windows_Gpgqwerty : RANSOMWARE
 {
 	meta:
 		description = "Detect GPGQwerty ransomware"
 		author = "McAfee Labs"
-		id = "dcbaf3bd-7d0c-5449-a751-82caaad3b5c2"
+		id = "21809851-df53-5d32-8aab-180c62bf885e"
 		date = "2018-03-21"
 		modified = "2020-08-14"
 		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/ransomware-takes-open-source-path-encrypts-gnu-privacy-guard/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_GPGQwerty.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8e77895cb8e7f33707c5080780a49cb4bf1d35aa7a8df829fdc7a93319ce3897"
+		logic_hash = "v1_sha256_8e77895cb8e7f33707c5080780a49cb4bf1d35aa7a8df829fdc7a93319ce3897"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE"
@@ -200495,14 +200551,14 @@ rule TRELLIX_ARC_Ransom_Babuk : RANSOM T1027 T1083 T1057 T1082 T1129 T1490 T1543
 	meta:
 		description = "Rule to detect Babuk Locker"
 		author = "TS @ McAfee ATR"
-		id = "7c0a3b4e-90aa-5442-aa5e-1a7fcae9bec8"
+		id = "0c27cd5c-af45-53ed-bb1c-f55289e3052d"
 		date = "2021-01-19"
 		modified = "2021-02-24"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_BabukLocker_Jan2021.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "e10713a4a5f635767dcd54d609bed977"
-		logic_hash = "123cebd1c2e66f3e91ee235cb9288df63dfaeba02e6df45f896cb50f38851a8f"
+		logic_hash = "v1_sha256_123cebd1c2e66f3e91ee235cb9288df63dfaeba02e6df45f896cb50f38851a8f"
 		score = 75
 		quality = 70
 		tags = "RANSOM, T1027, T1083, T1057, T1082, T1129, T1490, T1543.003, FILE"
@@ -200520,23 +200576,21 @@ rule TRELLIX_ARC_Ransom_Babuk : RANSOM T1027 T1083 T1057 T1082 T1129 T1490 T1543
 		$pattern4 = {400010104000181040002010400028104000301040003810400040104000481040005010400058104000601040006C10400078104000841040008C10400094104000A0104000B0104000C8104000DC104000E8104000F01040000011400008114000181140002411400038114000501140005C11400064114000741140008C114000A8114000C0114000E0114000F4114000101240002812400034124000441240005412400064124000741240008C124000A0124000B8124000D4124000EC1240000C1340002813400054134000741340008C134000A4134000C4134000E8134000FC134000141440003C144000501440006C144000881440009C144000B4144000CC144000E8144000FC144000141540003415400048154000601540007815}
 
 	condition:
-		filesize >=15KB and filesize <=90KB and 1 of ($s*) and 3 of ($pattern*)
+		filesize >= 15KB and filesize <= 90KB and 1 of ( $s* ) and 3 of ( $pattern* )
 }
-import "pe"
-
 rule TRELLIX_ARC_Nefilim_Ransomware : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect Nefilim ransomware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "55d9cb20-5071-5dce-a46f-a20816ba379f"
+		id = "2986496d-ddd9-5638-8254-abc952a5c41a"
 		date = "2020-03-17"
 		modified = "2020-04-03"
 		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_NEFILIM.yar#L3-L48"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "5ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c6"
-		logic_hash = "d8cd5d2dd552d3e9f57f7bd244e941fe89a96ab16bbcc71911e8e2a519f53f03"
+		logic_hash = "v1_sha256_d8cd5d2dd552d3e9f57f7bd244e941fe89a96ab16bbcc71911e8e2a519f53f03"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200557,7 +200611,7 @@ rule TRELLIX_ARC_Nefilim_Ransomware : RANSOMWARE FILE
 		$bp = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????53568D??????????E8????????33??6A??5939????76??5783????75??8B????8D????A5A5A58D??????????A5508D????E8????????596A??588B????8D????80????75??48C6????79??EB??FE????33??8A??????8B????30????43413B????72??5F8B????8B????6A??2B??5E8A????88??404E75??5E5BC9C3558B??81??????????53FF????8D??????????50FF??????????68????????8D??????????50FF??????????33??53536A??535368????????8D??????????50FF??????????89????3B??0F84????????56578D????5053BE????????5689????FF??????????5056E8????????83????85??75??53FF??????????FF????8B??????????53FF??50FF??????????8D????51505689????FF??????????5056E8????????83????85??74??8B????89????8D????50FF????E8????????59595385??74??8D????50FF????FF????FF????FF??????????FF????53FF??50FF??????????5F5E5BC9C3558B??83????81??????????535657FF????8D????????????50FF??????????8B??????????68????????8D????????????50FF??8D??????508D????????????50FF??????????89??????83????0F84????????8B??????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????F6????????FF????8D????????????5074??FF??????????8D??????508D????????????50FF??68????????8D????????????50FF??8D????????????50E8????????E9????????FF??????????8D??????508D????????????50FF??8D??????50E8????????8B??C7????????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????8D??????50FF??85??74??8D????????????50E8????????598D??????50FF??????FF??????????85??0F85????????FF??????FF??????????5F5E5B8B??5DC3558B??81??????????53565768????????FF??????????8B??????????5033??57FF??8B??????????50FF??68????????89????FF??????????89????B8????????39????74??8B????2B??8A??FF????88????4039????75??57576A??575768????????FF????FF??????????89????3B??0F84????????8D????5150FF??????????6A??57FF??50FF??6A??5789????FF??50FF??FF????89????E8????????FF????E8????????595968????????57FF??50FF??68????????5789????FF??50FF??FF????8B????89????E8????????FF????8B????E8????????8B??????????59595757FF????FF????FF????FF??57FF??????????578D????5068????????FF????FF????FF??????????FF??????????83????0F84????????FF??????????83????0F84????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF????FF????FF??????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF??????????50FF????FF????FF??????????8B????8B????3B??0F8C????????7F??81??????????0F86????????89????89????3B??0F8C????????7F??3B??0F86????????EB??8B????2B????1B????89????0F88????????7F??81??????????0F82????????68????????57FF??50FF??????????5757FF????89????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????5757FF????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF??FF????5750FF??????????81????????????8B????11????39????0F8C????????0F8F????????8B????39????0F82????????E9????????3B??7C??7F??81??????????76??68????????57FF??50FF??????????575733??89????5133??50FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????575733??5050FF????FF??578D????5068????????EB??5157FF??50FF??????????575733??89????5133??50FF????FF??578D????50FF????FF????FF????FF??????????FF????8B????FF????FF????FF????E8????????83????575733??5050FF????FF??578D????50FF????FF????FF????FF??????????FF????57FF??50FF??????????FF????FF??????????FF????57FF??8B??????????50FF??FF???? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of ($s*) or all of ($op*) or $bp
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or all of ( $op* ) or $bp
 }
 import "pe"
 
@@ -200566,14 +200620,14 @@ rule TRELLIX_ARC_Nefilim_Signed : RANSOMWARE FILE
 	meta:
 		description = "Rule to detect Nefilim samples digitally signed"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "a9a5daf0-4cfb-556a-b20a-72283fb1a0f9"
+		id = "0e8df876-f652-5bfe-99ba-ffb5eefbf196"
 		date = "2020-04-02"
 		modified = "2020-08-14"
 		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_NEFILIM.yar#L50-L72"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "353ee5805bc5c7a98fb5d522b15743055484dc47144535628d102a4098532cd5"
-		logic_hash = "7625eb7de1ebb2f5410552b8983379f213d639f5e146a5d951975b69eb8111d3"
+		logic_hash = "v1_sha256_7625eb7de1ebb2f5410552b8983379f213d639f5e146a5d951975b69eb8111d3"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200584,23 +200638,21 @@ rule TRELLIX_ARC_Nefilim_Signed : RANSOMWARE FILE
 		actor_group = "Unknown"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Red GmbH/CN=Red GmbH" and pe.signatures[i].serial=="00:b8:81:a7:2d:41:17:bb:c3:8b:81:d3:c6:5c:79:2c:1a" or pe.signatures[i].thumbprint=="5b:19:58:8b:78:74:0a:4c:5d:08:41:99:dc:0f:52:a6:1f:38:00:99")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Red GmbH/CN=Red GmbH" and pe.signatures [ i ] . serial == "00:b8:81:a7:2d:41:17:bb:c3:8b:81:d3:c6:5c:79:2c:1a" or pe.signatures [ i ] . thumbprint == "5b:19:58:8b:78:74:0a:4c:5d:08:41:99:dc:0f:52:a6:1f:38:00:99" )
 }
-import "pe"
-
 rule TRELLIX_ARC_RANSOM_Nefilim_Go : RANSOMWARE FILE
 {
 	meta:
 		description = "Rule to detect the new Nefilim written in GO"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "a8809060-c646-5d54-88e7-c8054305ee6c"
+		id = "861656c8-8b1a-526e-ad43-9397d5a45762"
 		date = "2020-07-13"
 		modified = "2020-08-14"
 		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_NEFILIM.yar#L74-L98"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "a51fec27e478a1908fc58c96eb14f3719608ed925f1b44eb67bbcc67bd4c4099"
-		logic_hash = "f0b10286fb1623a32bcf1f30cadce2901f7711cb36db6bbe812f6c2e03862270"
+		logic_hash = "v1_sha256_f0b10286fb1623a32bcf1f30cadce2901f7711cb36db6bbe812f6c2e03862270"
 		score = 75
 		quality = 70
 		tags = "RANSOMWARE, FILE"
@@ -200614,21 +200666,21 @@ rule TRELLIX_ARC_RANSOM_Nefilim_Go : RANSOMWARE FILE
 		$pattern = { FF20476F206275696C642049443A20226A744368374D37436A4A5732634C5F636633374A2F49625946794336635A64735F4D796A56633461642F486B6D36694A4D39327847785F4F2D65746744692F664E37434C43622D59716E374D795947565A686F220A20FFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108766B83EC0CC744241400000000C7442418000000008B4424108400890424E88D0200008B44240485C0740789C183F8FF7514C744241400000000C74424180000000083C40CC3894C24088B44241083C004890424E8570200008B4424048B4C2408894C24148944241883C40CC3E8AE5A0400E979FFFFFFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EC00000083EC108B44241885C00F84C30000008B4424148400890424E8FD0100008B44240485C0742E89C183F8FF74E38B44241839C10F85800000008B44241C894424048B44241483C004890424E88B12000083C410C3E8620303008B442414890424C744240400000000C7442408FFFFFFFFE8A61200000FB644240C84C07507E868030300EB8B8B44241C894424048B4424148D4804890C24E83F1200008B442418894424048B442414890424E82B120000E83603030083C410C38D05408E4E008904248D05B8CC510089442404E8DA3F02000F0B8D05408E4E008904248D05B0CC510089442404E8C03F02000F0BE899590400E9F4FEFFFFCCCCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B4424088B4C240CF00FB14D000F94442410C3CCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B44240889C1F00FC1450001C1894C240CC3CCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B7424088B7C240C8B45008B550489C389D101F311F9F00FC74D0075F1895C2410894C2414C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B442404A90700000074068B05000000000F6F000F7F4424080F77C3CCCCCCCCE9CBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9BBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C24048B442408874500C3CCCCCCCCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B4424040FBCC074058944240CC38B4424080FBCC0740883C0208944240CC3C744240C40000000C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC83EC208B4424248B088B54242889CB01D1894C241C8B6804890424895C2404896C2408894C240C8B5C242C11DD896C2418896C2410E8160100000FB644241484C074C08B44241C894424308B4424188944243483C420C3CCCCCCCCCCCCCCCCCC83EC208B4424248B08894C24188B50048954241C890424894C2404895424088B5C2428895C240C8B6C242C896C2410E8BC0000000FB644241484C074C68B442418894424308B44241C8944243483C420C3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9EBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DB000000CCCCCCCCCCCCCCCCCCCCCCE97B000000CCCCCCCCCCCCCCCCCCCCCCE9CB000000CCCCCCCCCCCCCCCCCCCCCCE9BBFEFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B2D000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCC8B5C24048B44240889C1F00FC10301C88944240CC3CCCCCCCCCCCCCCCCCCCCCC8B5C24048B44240887038944240CC3CCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B442404A90700000074068B05000000008D5C24080F6F000F7F030F77C3CCCC8B442404A90700000074068B05000000000F6F4424080F7F000F77B800000000F00FC10424C3CCCCCCCCCCCCCCCCCCCC8B4424048A5C2408F00818C3CCCCCCCC8B4424048A5C2408F02018C3CCCCCCCC648B0D140000008B89000000003B610876098B4424088944240CC3E860550400EBDECCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240801000000E8AF4400008B44240C8944241C83C410C3E80E550400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240802000000E85F4400008B44240C8944241C83C410C3E8BE540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240810000000E80F4400008B44240C8944241C83C410C3E86E540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC83EC108D42048B008B4C2414890C248B4C2418894C240489442408E8D04300008B44240C8944241C83C410C3CCCCCCCC648B0D140000008B89000000003B6108762C83EC108B4424148B088B400489442408890C248B44241889442404E88E4300008B44240C8944241C83C410C3E8ED530400EBBBCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B600000083EC108B442414F30F10000F57C90F2EC175060F8B860000000F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240804000000E8C74200008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E80F530400E92AFFFFFFCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B800000083EC108B442414F20F10000F57C9660F2EC175060F8B87000000660F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240808000000E8E54100008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E82D520400E928FFFFFFCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E815FEFFFF8B44241083C0048B4C2408890424894C2404E8FEFDFFFF8B4424088944241883C40CC3E8CD510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E895FEFFFF8B44241083C0088B4C2408890424894C2404E87EFEFFFF8B4424088944241883C40CC3E86D510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86F200000083EC248B4424288B0885C974678B49048B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E8B2FA03008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8F46603008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E81E8E00008B44240C8B4C2408890C2489442404E87A3602000F0BE853500400E9EEFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EF00000083EC248B4424288B0885C974648B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E895F903008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8D76503008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E8018D00008B44240C8B4C2408890C2489442404E85D3502000F0BE8364F0400E9F1FEFFFFCC648B0D140000008B89000000003B61087606C644240C01C3 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 8000KB and all of them
 }
 rule TRELLIX_ARC_Apt_Turla_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect a component of the APT Turla"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "b39ac7fc-16dd-559e-8ab0-76da5cbbc719"
+		id = "d13952f4-74ea-5839-aac8-a150da9579ec"
 		date = "2017-05-31"
 		modified = "2020-08-14"
 		reference = "https://attack.mitre.org/groups/G0010/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_turla_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "3b8bd0a0c6069f2d27d759340721b78fd289f92e0a13965262fea4e8907af122"
-		logic_hash = "d519317c936a38f189bf0de908902ec4e3e079c8c7463c8881ceb332c0a82a26"
+		logic_hash = "v1_sha256_d519317c936a38f189bf0de908902ec4e3e079c8c7463c8881ceb332c0a82a26"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -200642,7 +200694,7 @@ rule TRELLIX_ARC_Apt_Turla_Pdb : BACKDOOR FILE
 		$pdb = "\\Workshop\\Projects\\cobra\\carbon_system\\x64\\Release\\carbon_system.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <650KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 650KB and any of them
 }
 import "pe"
 
@@ -200651,14 +200703,14 @@ rule TRELLIX_ARC_Milum_Trojan : TROJAN FILE
 	meta:
 		description = "Rule to detect Milum trojan from the Wildpressure operation"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "acc56237-a93a-55c0-a90c-11ca1da683db"
+		id = "1ead2373-dc43-5d07-85b7-ee3da68122b3"
 		date = "2020-04-24"
 		modified = "2020-08-14"
 		reference = "https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_milum_wildpressure.yar#L3-L28"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9"
-		logic_hash = "3ab1ff129517cb4a829edac289c00d7701d6f667ba2ef5a28024fd01a3a52e8e"
+		logic_hash = "v1_sha256_3ab1ff129517cb4a829edac289c00d7701d6f667ba2ef5a28024fd01a3a52e8e"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -200672,23 +200724,21 @@ rule TRELLIX_ARC_Milum_Trojan : TROJAN FILE
 		$pattern = { 558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????89??????????C7????????????8D????C7??????????33??6A??89??????????89????E8????????83????3B??0F84????????89????89??8B????89????8B????89????8B????C6??????8B????C6??????C6??????8B??????????BE????????89????89????88????C6??????6A??68????????8D??????????89??????????89??????????88??????????E8????????C6??????6A??538D????528D??????????89??????????89??????????88??????????E8????????C6??????8D??????????508B??E8????????508D??????????5157E8????????C6??????83????????????72??8B??????????52E8????????83????89??????????89??????????88??????????C6??????83????????????72??8B??????????50E8????????83????6A??68????????8D????89??????????89??????????88??????????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????83??????72??8B????51E8????????83????89????89????88????C6??????83??????72??8B????52E8????????83????6A??68????????8D????89????89????88????89????89????88????E8????????C6??????6A??538D????508D????89????89????88????E8????????C6??????83????8B??89??????????6A??89????89????68????????88??E8????????C6??????83????8B??89??????????6A??538D????89????89????5288??E8????????C6??????8D??????????50C6??????E8????????83????C6??????8B??????????2B??????????B8????????F7??03??C1????8B??C1????03??83????75??8B??????????6A??53528D????E8????????8B??????????6A??83????53508D????E8????????6A??538D????508D????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????BF????????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????8B??????????3B??74??8B??????????E8????????8B??????????50E8????????83????BF????????89??????????89??????????89??????????C6??????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????39????72??8B????50E8????????83????89????89????88????88????39????72??8B????51E8????????83????89????89????88????C7????????????39????72??8B????52E8????????83????8B??????????89????89????88????8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????8D??????????508D??????????89??????????E8????????C6??????C7??????????????????C6??????68????????8D??????????51E8????????CCCC558B??6A??68????????64??????????5051535657A1????????33??508D????64??????????8B????C7??????????C7????????????8D????33??83??????89????72??8B??EB??8B??8D????88??8B????8B????518B??E8????????8B????89????8B????89??8B????89????89????88????83??????72??8B??50E8????????83????89????C7????????????88??83????89????89????C7????????????8B????8B??50518D????E8????????89????8B????52E8????????83????8B????64????????????595F5E5B8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????505156A1????????33??508D????64??????????83????C7????????????8B????5156E8????????C7????????????C7????????????8B??8B????64????????????595E8B??5DC2????CCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????33??8B??89??????????8B????8B??89??????????89??????????89??????????3B??0F84????????8D????39??????????0F85????????68????????8D????5750E8????????C7????????????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????E9????????578D????68????????51E8????????C7????????????508D??????????52BA????????E8????????C6??????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????C6??????39??????????72??8B??????????50E8????????83????C7??????????????????89??????????88??????????88????39????72??8B????51E8????????83????C7????????????89????88????FF??????????38????75??8B????38????75??8B??8B??38????75??8D????8B??8B??38????74??EB??8B????38????75??3B????75??8B??8B????38????74??8B??8B??????????3B????0F85????????8B??????????8B??6A??5383????C7????????????89????508B??88??E8????????89????C7??????????????????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????C7????????????89????88????8B????64????????????595E5B8B??5DC3CCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????5356508D????64??????????33??89????538B??68????????8D????89????C7????????????89????88????E8????????C7????????????6A??8D????38????74??68????????EB??68????????E8????????8D????5083????8D????5651E8????????C6??????8D????52578B??E8????????83????C7????????????C6??????BE????????39????72??8B????50E8????????83????C7????????????89????88????88????39????72??8B????51E8????????83????C7????????????89????88????8B??8B????64????????????595E5B8B????33??E8????????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????F6??????C7????????????89????88????74??56E8????????83????8B??8B????64????????????595E5B8B??5DC2????CCCC558B??6A??68????????64??????????50A1????????33??508D????64??????????C7????????????6A??6A??8D????5083????E8????????C7????????????83??????72??8B????51E8????????83????C7????????????C7????????????C6??????8B????64????????????598B??5DC2????CCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????535657508D????64??????????33??89????8B????89????89????B8????????89????C7????????????89????88??89????8D????BF????????39????72??8B??8B????39????73??8D????8B????518D????518B??E8????????C6??????508B??E8????????C6??????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B??33??89????8B????89??????????89?????????? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and pe.imphash()=="548d9f5f1e74f34b85612667335d41f2" and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and pe.imphash ( ) == "548d9f5f1e74f34b85612667335d41f2" and all of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_1 : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the backdoor pwnlnx variant 1"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "5b76ca62-460c-5c36-a239-700cc509f2b0"
+		id = "a0dc8762-e0cb-50a2-96a0-42002f8821c4"
 		date = "2020-04-17"
 		modified = "2020-08-14"
 		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L3-L33"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "0f6033d6f82ce758b576e2d8c483815e908e323d0b700040fbdab5593fb5282b"
-		logic_hash = "1487890494dde891a6dbe7dff7ebd5660ee01fe10220215e680115f168c2ae4a"
+		logic_hash = "v1_sha256_1487890494dde891a6dbe7dff7ebd5660ee01fe10220215e680115f168c2ae4a"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -200702,23 +200752,21 @@ rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_1 : BACKDOOR FILE
 		$bp = { 7F??4C4602??01??000000000000000002??3E????0000????1A????0000000040000000000000??????0000000000000000000040??????????????1D????????0000????????????000000000000??????4000000000??????4000000000????01??00000000????01??00000000????000000000000????0000??????0000????000000000000????4000000000000002????000000001C??0000000000001C??00000000000001??00000000000001??000005????????0000000000000000??????0000000000004000000000????76??00000000????76??000000000000????00000000????0000????0000000080????00000000????????????0000????????????000038??00000000000080??????00000000000020??0000000002??0000060000????80????0000000028??????????000028??????????0000A0????????0000????????????0000????000000000000??????000004??00001C??0000000000001C??4000000000??????4000000000????000000000000????000000000000??????00000000000050E5??6404??00009C6D0000000000009C6D4000000000??????????????0000DC??000000000000DC??00000000000004??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000????6C69????????????2D????????78??78??362D????????6F2E32??04??000010??000001??0000474E5500000000????0000????0000????000000000000????0000??????000001??000006000000000000????000020??0000??????00007D??5A580000000000000000000000000000000000000000000000000000000015????????00000000000000000000??????00000000000082????????00000000000000000000????????????0000????????????00000000000000000000????????????0000??????000012??0000000000000000000062??0000000000006A??000012??000000000000000000001B??0000000000007E??000012??000000000000000000008B??0000000000004902??????00000000000000000000????????????0000????????????00000000000000000000????????00000000??????000012??000000000000000000008E??000000000000F401??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????000000000000000000000000000000000000????0000????000000000000000000000000000000000000??????000012??0000000000000000000025????????0000????????????00000000000000000000????000000000000????0000????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????01??????00000000000000000000??????0000000000006602??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????000000000000????????????00000000000000000000????000000000000????01??????00000000000000000000????000000000000????0000????00000000000000000000????01??00000000????????????00000000000000000000????????????0000????????????00000000000000000000??????000000000000EC01??????00000000000000000000??????0000000000004B01??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????????????0000??????000012??0000000000000000000008??0000000000004302??????00000000000000000000????????????0000??????????????000000000000000000000A??0000000000003F01??????00000000000000000000????????????0000??????000012??00000000000000000000F0????00000000????01??????00000000000000000000??????????????00002F02??????00000000000000000000????01??00000000????????????00000000000000000000????000000000000??????????????0000000000000000000080????00000000????02??????00000000000000000000????000000000000??????000012??0000000000000000000074??000000000000BF????????00000000000000000000????????????0000????02??????00000000000000000000??????000000000000FA0000????00000000000000000000????????????0000??????000012??0000000000000000000011??000000000000A8??000012??0000000000000000000044000000000000??????000012??000000000000000000005A000000000000??????000012??0000000000000000000029??000000000000C6????????00000000000000000000????000000000000????????????00000000000000000000????000000000000????0000????00000000000000000000????????00000000????????????00000000000000000000??????000000000000BC????????00000000000000000000????02??00000000????01??????00000000000000000000??????00000000000034??000012??00000000000000000000A1????????0000????????????00000000000000000000????????????0000??????????????000000000000000000004B000000000000????0000????00000000000000000000????000000000000??????000012??0000000000000000000005????????0000??????000012??0000000000000000000031??00000000000074??000012??00000000000000000000FF??0000000000005E02??????00000000000000000000????000000000000????????????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????02??????00000000000000000000??????000000000000DE??000012??000000000000000000007B??00000000000030??000012??0000000000000000000075??000000000000D9??000012??000000000000000000000E000000000000????????????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????????????00000000000000000000????????????0000????????????00000000000000000000????000000000000????02??????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????????????00000000000000000000??????0000000000005201??????0000????174000000000????00000000000000005F5F676D6F6E5F73??6172??5F5F??????76??52656769????????????6173??6573??6C69????????????61642E????2E30??72??63????72??6D??????68????????5F63????6174????????6E6474????????75??65??????69??????????????6E6F5F6C6F63????69????????????6B????74??72??6164??73??676D6173????????6E6E6563??????74??72??6164??73??6C66??????63????74??70??68????????5F6465????63????6663????6C????????63??73??2E????????63????74??73??72??70????????69????????????????????616E64??????6574??6174??6E??????74??77??69??????????????6469????????????5F6E74??61??????74??72??69??????????????70??????????6D6F6E????????74??6E??????6C6563??????6B????????72??616C6C6F63??676574??69??????????????73??72??6F6B????63????77????????70??6173??72??3634??73??67656D70??79??6574??6D656D73??74??72??6469??????????????????6565??????68????????6173??74??6D65??????74??6F63????70????????616E74??74??6475??32??73??67616464????74??69????????????6472??6663??????65??????74??6F63????70????????6C6C6F63??73??72??6174??72??616C70??74????????6D6F76????????656E6469????????????6C??????74??6F73??62????616D65??????6563??????????72??74????????656164??????6C6F63????74??6C6F63????74??6D65??????616E6469????????????616464??????????????6565????73??74??69????????????????????6D6D6F76????????70??6E3634??5F5F6C69????????????72??5F6D6169????????????73??73??70??69????????????65????????78??74??74??34??474C4942435F32??32??35????????42435F32??33??000002??02??02??03??02??02??02??03??03??02??02??02??0000000002??02??02??02??02??03??02??02??02??02??02??02??02??02??03??02??02??02??04??02??02??03??02??03??02??02??02??03??02??02??02??02??02??03??02??02??02??02??02??02??03??02??02??03??02??02??02??03??02??03??02??03??02??02??02??02??02??02??03??03??03??02??02??02??02??02??000001??01??24??000010??000020??000075??69??????????9602??00000000????????????????????000000000000????69????????????A2????????0000??????69??????????9602??00000000????81????????????060000????????????000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000000082??????0000????0000??????0000000000000000000008??????????0000070000????????????000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000??????6000000000????0000??????000000000000000000004882??????0000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000?????? }
 
 	condition:
-		uint16(0)==0x457f and filesize <100KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 100KB and all of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_2 : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the backdoor pwnlnx variant 2"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "c4ee686b-49d9-5566-b749-1144a19c1fee"
+		id = "bfd7b606-cf62-522a-a526-262b37401154"
 		date = "2020-04-17"
 		modified = "2020-08-14"
 		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L35-L65"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "08cc67002782cbafd97a4bff549d25dd72d6976d2fdf79339aaf5a3ff7c3107e"
-		logic_hash = "08ea40ba72677263a41f62097fc38040361ba595d67cb04979b66548c7f4d271"
+		logic_hash = "v1_sha256_08ea40ba72677263a41f62097fc38040361ba595d67cb04979b66548c7f4d271"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -200732,23 +200780,21 @@ rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_2 : BACKDOOR FILE
 		$bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????00000000000088????????????00000000??????38??05????????????????0000????????????0000000000000000??????0000000000004000000000??????0D??????????????0D????????0000????00000000????0000????0000????????????0000????????????0000????????????0000????12??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????????00000000????????00000000??????000000000000070000??????000080??????0000000080??????0000000080??????0000000028??00000000000070??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55????????????CC78??78??83????????????CB371F0000000080??????0000000025????????0000????7E??00000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000??????4200000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????76??00000000????????????0000????8B????00000000C8??????0000000025????????0000??????4200000000????76??00000000????????????0000????444200000000????76??00000000????????????0000??????4900000000????76??00000000????????????0000??????4600000000????76??00000000????????????0000????424200000000??????EC08??33??0000E8????????E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090554889??534883????80????????????75??BB????????488B??????????4881??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??B8????????4885??74??BF????????E8????????C6????????????4883????5BC9C30F1F????????????55B8????????4885??4889??74??BE????????BF????????E8????????4883????????????74??B8????????4885??74??BF????????C9FF??0F1F??????????C9C39090554889??534881??????????89??????????48C7????????????8B????3D????????0F87????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????BA????????488D??????????4889??4889??E8????????4889????4883??????0F84????????488D??????????488D??????????4889??4889??E8????????85??0F85????????488B??????????4889????C7????????????488B????89????488B????48C1????89????488B????4889????488B????4889??????488B????4889??????E8????????89????BE????????488D????E8????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????BE????????488D????E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??0F85????????8B????89??4889??48C1????8B????89??488D????4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7E??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??74??8B????48984801????488B????483B????7C??EB??90EB??90EB??90EB??90EB??90EB??90488B????4889??E8????????EB??90EB??90EB??90B8????????4881??????????5BC9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????0F84????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????488B????4889????488B????4889??????488B????4889??????E8????????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??0F84????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??0F84????????488D????8B????BA????????4889??89??E8????????85??74??488D????BE????????4889??E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??75??8B????83????75??8B????488B????4889????488B????4889??????488B????4889??????89??E8????????EB??90EB??90EB??90EB??90EB??908B????89??E8????????B8????????4881??????????5BC9C390554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????89??C1????F7????89??48980FB6??????????89??31??488B????88??83??????4883??????8B????3B????7C??488B????C9C3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????C9C39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????BA????????488D??????????488D??????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????0F84????????488D??????????488B????4889??4889??E8????????488D??????????488D????B9????????BA????????4889??4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????488D??????????4989??BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????488B??????????8B??????????4189??4181??????????8B??????????89??81??????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????4889??????4889??????488B????4889??????488B????4889????4589??4189??4889??BE????????4889?? }
 
 	condition:
-		uint16(0)==0x457f and filesize <1000KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 1000KB and all of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_3 : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the backdoor pwnlnx variant"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "02ea1eb2-7235-5ed5-86ba-19d52e8fb428"
+		id = "d88d81db-7e12-532a-b330-3d5629b65de7"
 		date = "2020-04-17"
 		modified = "2020-08-14"
 		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L67-L97"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "08f29e234f0ce3bded1771d702f8b5963b144141727e48b8a0594f58317aac75"
-		logic_hash = "8a1405f430ce57810577f65ef43a1425601bf49b5adb4f6f935505427ad9dc94"
+		logic_hash = "v1_sha256_8a1405f430ce57810577f65ef43a1425601bf49b5adb4f6f935505427ad9dc94"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -200762,23 +200808,21 @@ rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_3 : BACKDOOR FILE
 		$bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????000000000000B0??3A??000000000000000040??????????????????????01??000005????????0000000000000000??????0000000000004000000000????????????0000????????????00000000????00000000????0000????0000????A40C??00000000C0??????????????C0??????????????5013??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????000000000000????000000000000??????000000000000070000??????0000C0??????????????C0??????????????C0??????????????28??00000000000078??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000??????000000000000C0????????????????????????0000????84????00000000C8??????0000000025????????0000????374200000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000??????4200000000????A56C00000000????????????0000????24??00000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000????83??????0000????A56C00000000????????????0000????5E42000000000000A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????914200000000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000??????4200000000??????EC08??4301??????62??0000E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090B8????????55482D????????4883????4889??76??B8????????4885??74??5DBF????????FF??660F1F????????????5DC366666666????????????????????BE????????554881??????????48C1????4889??4889??48C1????4801??48D1??74??B8????????4885??74??5DBF????????FF??0F1F??5DC3660F1F??????80????????????75??554889??53BB????????4881??????????4883????488B??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??E8????????B8????????4885??74??BF????????E8????????C6????????????4883????5B5DF3??669055B8????????4885??4889??74??BE????????BF????????E8????????BF????????4883????75??5DE9????????6690B8????????4885??74??FF??EB??9090554889??534881??????????89??????????48C7????????????8B????3D????????76??E9????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????BE????????4889??E8????????4889????4883??????75??E9????????488D??????????488D??????????4889??4889??E8????????85??74??E9????????488B??????????4889????C7????????????488B????89????488B????48C1????89????4883????FF????FF????FF????E8????????4883????89????BE????????488D????E8????????8B??????????BA????????488D????89??E8????????85??75??E9????????8B??????????BA????????488D????89??E8????????85??75??E9????????BE????????488D????E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??E9????????8B????89??48C1????4889??8B????89??4801??4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7F??EB??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??75??EB??8B????48984801????488B????483B????7C??488B????4889??E8????????B8????????488B????C9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????75??E9????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????4883????FF????FF????FF????E8????????4883????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??75??E9????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??75??EB??488D????8B????BA????????4889??89??E8????????85??75??EB??488D????BE????????4889??E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??EB??8B????83????74??EB??8B????4883????FF????FF????FF????89??E8????????4883????908B????89??E8????????B8????????488B????C9C3554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????99F7????89??48980FB6??????????31??89??488B????88??83??????4883??????8B????3B????7C??488B????5DC3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????5DC39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????488D??????????488D??????????4889??BA????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????75??E9????????488D??????????488B????4889??4889??E8????????488D????488D??????????B9????????BA????????4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????488D??????????488D??????????4989??4889??BA????????BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????4989??488B??????????8B??????????25????????89??8B??????????25????????89??488B????8B????4863??48C1????4801??488B??488D????488D??????????415052FF????FF????4189??4189??BA????????BE????????4889??B8????????E8????????4883????488B????4889??E8????????4889??488D?????????? }
 
 	condition:
-		uint16(0)==0x457f and filesize <4000KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 4000KB and all of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_4 : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the backdoor pwnlnx variant 4"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "199bb534-f0f6-5b67-aedd-3eada5e45cc6"
+		id = "37ac1c30-f5b4-599f-a250-7498fd9618f9"
 		date = "2020-04-17"
 		modified = "2020-08-14"
 		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L99-L129"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "2590ab56d46ff344f2aa4998efd1db216850bdddfc146d5d37e4b7d07c7336fc"
-		logic_hash = "11203beee446aaf0783d3a8d3839a88ef16c27d52be8670d650ebf6a1de2c3aa"
+		logic_hash = "v1_sha256_11203beee446aaf0783d3a8d3839a88ef16c27d52be8670d650ebf6a1de2c3aa"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -200792,23 +200836,21 @@ rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_4 : BACKDOOR FILE
 		$bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000????????????000000000000??????0000000040??????????????000014??000003??0000474E55????9FECFBE5??F973??EB??2A??????????71??BD????????0000000000000000554889??53E8????????FF????????????4889??4889??4881??????????FF????????????4889??5BC9C30F1F??????554889??E8????????FF????????????C9C366666666????????????????????554889??E8????????4885??74??4C8B????4D85??74??65??8B????????????8B??????????4889??????????48C7??????????89??C1????C1????01??25????????29??48984C89????????????FF??????????C9C3660F1F????????????31??C9C36666662E????????????????554889??E8????????4889??????????48C7??????????FF??????????C9C390554889??E8????????8B??????????488B??????????488D????0FB6????3C??400F94??3C??410F94??74??4084??75??B8????????C9C30F1F????????????8B??????????39????74??3B????74??4584??74??8B??????????4801??0FB7??????????66????74??66??????75??4889??41FF??B8????????C9C30F1F??4084??74??8B??????????4801??0FB7??????????66????75??EB??0F1F????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??BE????????E8????????483D????????77??4885??74??488B????4889????31??4889??E8????????31??4883????5BC9C383????EB??660F1F??????554889??415453E8????????4989??4889??BE????????31??E8????????483D????????77??488B????31??4889??488B????4989????488B????4889????E8????????31??5B415CC9C383????EB??554889??4157415641554154534883????E8????????4889??488D????4989??4189??4889??BA????????4989??4489????4D89??E8????????488B??????????448B????4881??????????488D????75??EB??0F1F????488B????4881??????????488D????74??0FB7????4839??75??4883????31??5B415C415D415E415FC9C30F1F??????4D89??4C89??4489??4889??4C89??FF??????????4883????5B415C415D415E415FC9C30F1F????554889??4157415641554154534883????E8????????65??8B????????????4889????4889????4189??8B??????????4889??B9????????48C7??????????4889??4D89??4589??89??C1????C1????01??25????????29??F3A648984C8B????????????0F84????????B9????????48C7??????????4889??F3A60F84????????31??4585??4889??4889????4489????74??418D??????31??488D??????0FB6??4883????4889??48C1????48C1????4801??4801??4839??488D????488D????75??89????488D????4C89??E8????????4885??4889??0F84????????488B????4885??74??81????????????0F84????????488B??????????483D????????4C8D????75??EB??0F1F??????498B????483D????????4C8D????74??498B??4889??E8????????85??75??31??4883????5B415C415D415E415FC9C34589??4D89??488B????4489??4889??488B????FF??????????4883????5B415C415D415E415FC9C30F1F??????????81????????????0F85????????31??EB??488D????4C89??E8????????4885??4889??74??498B????488B??????????488B????4885??74??31??4889??4889????FF??4885??488B????0F84????????31??E9????????0F1F????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??41554154534883????E8????????4C8B??????????4989??4981??????????498D??????75??EB??0F1F????4C8B????4981??????????498D??????74??488B??4C89??E8????????85??75??4C89??E8????????488B??E8????????4889??E8????????4883????5B415C415DC9C36666662E????????????????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889?? }
 
 	condition:
-		uint16(0)==0x457f and filesize <400KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 400KB and all of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_6 : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the backdoor pwnlnx variant 6"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "56bfe9c7-4cd4-51f6-a469-da8af52d64c2"
+		id = "43492f48-4b8c-5710-a908-923a31600a92"
 		date = "2020-04-17"
 		modified = "2020-08-14"
 		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L131-L161"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "d29254ab907c9ef54349de3ec0dd8b22b4692c58ed7a7b340afbc6e44363f96a"
-		logic_hash = "29423135a46ee7b9aa1bd8f1e6f7ffad09725787ad6e75312e1d34b18e3917d4"
+		logic_hash = "v1_sha256_29423135a46ee7b9aa1bd8f1e6f7ffad09725787ad6e75312e1d34b18e3917d4"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -200822,23 +200864,21 @@ rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_6 : BACKDOOR FILE
 		$bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000??????09??00000000000000004000000000??????2B??28??04??000014??000003??0000474E55????4D9585????AB6522????52AD3B??EC9B4BE8????????0000000000000000????00000000554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??41574589??415641554189??4154534889??4883????488B??????????4889????4889????4C89????483D????????4C8D????74??4C63??EB??0F1F??????498B????483D????????4C8D????74??498B??4C89??4889??E8????????85??75??4883????5B415C415D415E415F5DC30F1F??????????4589??4C8B????488B????4489??4889??488B????FF??????????4883????5B415C415D415E415F5DC3660F1F??????E8????????554889??41574589??41564D89??41554989??41544189??BA????????534889??488D????4883????4889????4889??65??8B????????????4889????31??E8????????488B??????????4881??????????488D????74??0FB7????4839??75??EB??0F1F????????????410FB7????4839??74??4C8B????4981??????????498D????75??4589??4D89??4C89??4489??4889??488B????FF??????????488B????65??33????????????75??4883????5B415C415D415E415F5DC3660F1F??????31??EB??E8????????0F1F??????662E0F1F????????????E8????????55BF????????4889??4881??????????65??8B????????????4889????31??488D??????????FF????????????B9????????4889??488D??????????F3??A5488D??????????48C7??????????BE????????B1??E8????????4885??74??48BA???????? }
 
 	condition:
-		uint16(0)==0x457f and filesize <700KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 700KB and all of them
 }
-import "pe"
-
 rule TRELLIX_ARC_Mirai_Casper_Variant : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the Mirai Casper variant"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "0f3a028c-9514-51cd-ad82-415e8ac2dee7"
+		id = "ea0d5f78-2369-58dc-846d-3233f2723c6b"
 		date = "2020-04-17"
 		modified = "2020-08-14"
 		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L163-L193"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "57cc422a6a90c571198a2d1c3db13c31fbdb48ba2f0f4356846d6d636d0f9300"
-		logic_hash = "5449d1ef0c4977c6151fc194ad5f526b6be414c1efb7fd4bacb77d4bcd89c703"
+		logic_hash = "v1_sha256_5449d1ef0c4977c6151fc194ad5f526b6be414c1efb7fd4bacb77d4bcd89c703"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -200852,7 +200892,7 @@ rule TRELLIX_ARC_Mirai_Casper_Variant : BACKDOOR FILE
 		$bp = { 7F??4C4601??01??000000000000000002??03??01??0000E0??04??34??000088??????????000034??20??05????????????????000000000000000080??????80??????15????????0C??05????????10??????0000??????0C??40A510??40A510??80??????904A0000060000000010????????0000D4??0000D4??04??D4??04??440000??????????????000004??0000070000??????0C??40A510??40A510??14??000030??000004??000004??000051E5??64????000000000000000000000000000000000000060000??????000004??000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55??????3A??87????529723????2C??08??????AB35????????2A??0000BC????????0000????A510??2A??0000C4??????????0000C8??????2A??0000CCA510??2A??00005589??5383????E8????????5B81??????????8B??????????85??74??E8????????E8????????E8????????585BC9C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????000000000000000031??5E89??83????50545268????????68????????515668????????E8????????F490909090909090909090909090905589??538D??????80????????????75??BB????????A1????????81??????????C1????83????39??73??908D??????83????A3????????FF????????????A1????????39??72??B8????????85??74??C7????????????E8????????C6????????????8D??????5B5DC3908D??????55B8????????89??8D??????E8????????5A81??????????85??74??89??????C7??????????????C7??????????????C7????????????E8????????A1????????85??74??B8????????85??74??C7????????????FF??C9C39090905589??83????8B????88????A1????????85??74??A1????????0FB6????88??83????A3????????EB??C7??????????????8D????89??????C7????????????E8????????C9C35589??83????EB??8B????0FB6??0FBE??83??????89????E8????????8B????0FB6??84??75??C9C35589??83????8B????0FB6??88????83??????80??????0F84????????80??????74??0FBE????89????E8????????E9????????C7????????????8B????0FB6??88????83??????80??????75??C7????????????8B????0FB6??88????83??????EB??80??????75??C7????????????8B????0FB6??88????83??????C7????????????EB??8B????89??C1????01??01??89??0FBE????8D????83????89????8B????0FB6??88????83??????80??????7E??80??????7E??80??????74??80??????75??83??????8B????0FB6??88????83??????80??????0F84????????0FB6????88????80??????7E??0FB6????83????88????0FBE????83????83????0F87????????8B????????????FF??8B????8D????89????8B??89????C7????????????EB??83??????8B????8B????8D????0FB6??84??75??EB??C7????????????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??8B????89????E8????????EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????8B????8D????89????8B??0FBE??89????E8????????E9????????C7????????????EB??C7????????????EB??C7????????????EB??C7????????????EB??0FBE????89????E8????????E9????????8B????83????85??74??8B????8D????89????8B??EB??80??????75??8B????8D????89????8B??EB??8B????8D????89????8B??89????80??????75??8B????85??79??F7????83??????C7????????????8B????BA????????F7????89??88????8B????BA????????F7????89????80??????7E??80??????75??B8????????EB??B8????????0FB6????01??88????8B????0FB6????83????88??????83??????83??????74??83??????76??8B????83????85??74??8B????C6????????83??????8B????89????8B????83????84??74??B8????????EB??B8????????88????EB??0FBE????89????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??83??????8B????0FB6??????0FBE??89????E8????????83??????75??EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????E9????????90EB??90C9C35589??83????8D????89????8B????89??????8B????89????E8????????C9C35589??83????8B????8B????88????88????C9C35589??57565381??????????8B????8B????88??????????88??????????C7??????????????????C7??????????????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????66????????????8D??????????BA????????89??????C7??????????????89????E8????????83????????????0F84????????83????????????0F84????????8B??????????89????E8????????3D????????0F8F????????8B??????????89????E8????????83????0F8F????????8B??????????89????E8????????83????0F8F????????C7??????????????????EB??8B??????????03??????????0FB6??3C??7E??8B??????????03??????????0FB6??3C??7F??8B??????????03??????????8B??????????03??????????0FB6??83????88??8B??????????83????89??????????8B??????????89????E8????????8B??????????39??7F??81??????????????????7E??C7??????????????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????8B??????????C7??????????????89????E8????????89??????????C7??????????????????E9????????8B??????????69??????????03??????????C6??????8B??????????69??????????03??????????C7??????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????0FB6??????????3C??74??8B??????????69??????????03??????????05????????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????69??????????03??????????81??????????83????89??????89??????89????E8????????8B??????????69??????????03??????????C6????????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????3C??0F87????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????E8????????89??E8????????89??0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????0FB6??89??89??D3??89??8D????89????E8????????89????E8????????89??BA????????89??F7??89??C1????89??C1????01??89??29??83????0F87????????8B????????????FF??C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7???????????? }
 
 	condition:
-		uint16(0)==0x457f and filesize <3000KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 3000KB and all of them
 }
 import "pe"
 
@@ -200861,14 +200901,14 @@ rule TRELLIX_ARC_APT_Stolen_Certificates : BACKDOOR FILE
 	meta:
 		description = "Rule to detect samples digitally signed from these stolen certificates"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "57051977-780c-5c8e-bc66-0f1d8b3bbd93"
+		id = "0be56d06-7f9d-56f8-8844-31837ab688c2"
 		date = "2020-04-17"
 		modified = "2020-08-14"
 		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L196-L221"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "ce3424524fd1f482a0339a3f92e440532cff97c104769837fa6ae52869013558"
-		logic_hash = "9b700e4889349d0203bdd4e00035ee9c9aba5025ccc57eef915b2c78996f8160"
+		logic_hash = "v1_sha256_9b700e4889349d0203bdd4e00035ee9c9aba5025ccc57eef915b2c78996f8160"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -200879,21 +200919,21 @@ rule TRELLIX_ARC_APT_Stolen_Certificates : BACKDOOR FILE
 		actor_group = "Unknown"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures[i].serial=="3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures[i].subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures[i].serial=="3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures[i].subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" or pe.signatures[i].serial=="3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures [ i ] . serial == "3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures [ i ] . subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures [ i ] . serial == "3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures [ i ] . subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" or pe.signatures [ i ] . serial == "3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" )
 }
 rule TRELLIX_ARC_Apt_Auriga_Driver : KERNELDRIVER FILE
 {
 	meta:
 		description = "Rule to detect the Auriga driver"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "b61058a1-1b48-5be1-ba2f-74a7c3d38825"
+		id = "09e61f19-6ddb-558a-9c1a-c0bfc16cdb5b"
 		date = "2013-03-13"
 		modified = "2020-08-14"
 		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_auriga_biscuit.yar#L1-L39"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "207eee627a76449ac6d2ca43338d28087c8b184e7b7b50fdc60a11950c8283ec"
-		logic_hash = "c027073ba398fe89d418be67f0850c8d9e4d4c50a991c45b84cdb416497ccf1c"
+		logic_hash = "v1_sha256_c027073ba398fe89d418be67f0850c8d9e4d4c50a991c45b84cdb416497ccf1c"
 		score = 75
 		quality = 70
 		tags = "KERNELDRIVER, FILE"
@@ -200921,21 +200961,21 @@ rule TRELLIX_ARC_Apt_Auriga_Driver : KERNELDRIVER FILE
 		$s15 = "\\Registry\\Machine\\SOFTWARE\\riodrv32" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
 }
 rule TRELLIX_ARC_Enfal_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect Enfal malware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "09b9667c-cf58-5438-958d-19a99fe91e32"
+		id = "05274809-0c25-593b-8295-5c3e937a3c20"
 		date = "2013-08-27"
 		modified = "2020-08-14"
 		reference = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/enfal"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/enfal_pdb.yar#L1-L29"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "6756808313359cbd7c50cd779f809bc9e2d83c08da90dbd80f5157936673d0bf"
-		logic_hash = "1f7785a4c54981c3e7cb417718312e0ed82132b9bd9288f7b0f322cbeafbaecd"
+		logic_hash = "v1_sha256_1f7785a4c54981c3e7cb417718312e0ed82132b9bd9288f7b0f322cbeafbaecd"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -200953,20 +200993,20 @@ rule TRELLIX_ARC_Enfal_Pdb : BACKDOOR FILE
 		$pdb4 = "\\programs\\LuridDownLoader\\LuridDownloader for Falcon\\ServiceDll\\Release\\ServiceDll.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and any of them
 }
 rule TRELLIX_ARC_APT_Acidbox_Kernelmode_Module : KERNELDRIVER FILE
 {
 	meta:
 		description = "Rule to detect the kernel mode component of AcidBox"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "80b60307-5431-5f21-9e6f-06adaab0519d"
+		id = "7bd2d303-c583-5439-8c2e-d0f3460fb171"
 		date = "2020-07-24"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_acidbox.yar#L1-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "e39da89d0da22115ac7889bc73ff183973a6c5334e304df955362bde76694d42"
+		logic_hash = "v1_sha256_e39da89d0da22115ac7889bc73ff183973a6c5334e304df955362bde76694d42"
 		score = 75
 		quality = 70
 		tags = "KERNELDRIVER, FILE"
@@ -200990,20 +201030,20 @@ rule TRELLIX_ARC_APT_Acidbox_Kernelmode_Module : KERNELDRIVER FILE
 		$pattern_9 = { 33d2 488b4c2428 e8???????? 448b842450040000 4503c0 4c8d8c2450040000 488bd7 }
 
 	condition:
-		7 of them and filesize <78848
+		7 of them and filesize < 78848
 }
 rule TRELLIX_ARC_APT_Acidbox_Main_Module_Dll : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the Main mode component of AcidBox"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "8c9beb0f-62f7-5788-8340-0b1ecdf54253"
+		id = "45a2df98-d7fc-543d-b886-75b9ddeaf3c4"
 		date = "2020-07-24"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_acidbox.yar#L34-L65"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "db98e204742b8629074d47df301ffcbb2dfb977a4da91557fb50838aae79e777"
+		logic_hash = "v1_sha256_db98e204742b8629074d47df301ffcbb2dfb977a4da91557fb50838aae79e777"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201027,20 +201067,20 @@ rule TRELLIX_ARC_APT_Acidbox_Main_Module_Dll : BACKDOOR FILE
 		$pattern_9 = { 4d03c2 4d3bc2 4d13cc 4d0303 4d3b03 4d8903 4c8b13 }
 
 	condition:
-		7 of them and filesize <550912
+		7 of them and filesize < 550912
 }
 rule TRELLIX_ARC_APT_Acidbox_Ssp_Dll_Module : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the SSP DLL component of AcidBox"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "ef1511c5-f650-5e65-937c-466f00932183"
+		id = "321071fd-88e6-54d7-b5f9-f1f1a6aa5592"
 		date = "2020-07-24"
 		modified = "2020-08-14"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_acidbox.yar#L67-L98"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "4c9b9de11d73587ca1ad1efa5455598e41edc5a9a59fc0339c429a212c1c7941"
+		logic_hash = "v1_sha256_4c9b9de11d73587ca1ad1efa5455598e41edc5a9a59fc0339c429a212c1c7941"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201064,21 +201104,21 @@ rule TRELLIX_ARC_APT_Acidbox_Ssp_Dll_Module : BACKDOOR FILE
 		$pattern_9 = { bb02160480 8bc3 488b5c2440 488b742448 488b7c2450 4883c430 }
 
 	condition:
-		7 of them and filesize <199680
+		7 of them and filesize < 199680
 }
 rule TRELLIX_ARC_APT_Winnti : BACKDOOR FILE
 {
 	meta:
 		description = "Detects Winnti variants"
 		author = "McAfee ATR Team"
-		id = "f12b039a-2508-580f-b777-428bbda2c666"
+		id = "188469a7-4527-5481-b5d0-7ed533bc49d1"
 		date = "2020-06-04"
 		modified = "2020-10-14"
 		reference = "https://attack.mitre.org/software/S0141/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_winnti.yar#L1-L27"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "fd539d345821d9ac9b885811b1f642aa1817ba8501d47bc1de575f5bef2fbf9e"
-		logic_hash = "f94b2c552fbb30e1005e5c75a2f449d60b9558a0916197bed41bf32c6477daef"
+		logic_hash = "v1_sha256_f94b2c552fbb30e1005e5c75a2f449d60b9558a0916197bed41bf32c6477daef"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201092,7 +201132,7 @@ rule TRELLIX_ARC_APT_Winnti : BACKDOOR FILE
 		$pattern = { 9090909090909090909090909090C7????????????C2????90909090909081??????????E9????????CCCCCCCCCC8A??????8B??????538A??8A??568B??578B??????8B??C1????66????8B??C1????F3AB8B??83????F3AA8B??5F5E5BC390909090909090909090909090909083????5333??568D??????535089??????89??????E8????????8A??33??3A??8D??????0F94??83????5389??????528B??89??????C6????????E8????????8B??33??81??????????8D??????0F94??6A??89??????5223??89??????C6????????C6????????E8????????33??66????8D??????6A??0F94??89??????89??????5223??C6????????C6????????E8????????8B??83????33??3B??0F94??23??5E495BF7??1B??8B??83????C38B??????8B??????03??C390909090908B??????85??0F84????????8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??E9????????83????C39090909090909090909090909083????8B??????53558B??????33??568B??????83????5789??????76??81??????????8B??76??BF????????8B??????8D????03??C1????03??89??????3B??76??8B??????68????????6A??52E8????????8B??????8B??????8B??????505351565752E8????????8B??????8B??8B??????2B??8B??83????03??8B??????83????89??????77??03??0F84????????8B??????8B??????2B??03??3B??89??????75??81??????????77??8A??04??EB??83????77??08????EB??83????77??8A??80????88??EB??8D????C6????463D????????89??????76??8D????B8????????F7??C1????8B??33??8B??8B??C1????F3AB8B??83????03??F3AA8B??????81??????????4A89??????75??8B??????8B??88??468A??88??46424B75??8B??????C6????465FC6????46C6????2B??8B??????4633??89??5E5D5B83????C390909090909090909083????8B??????53558B??????568B??????8D????5789??????8B??????83????73??B8????????2B??EB??33??03??8B??2B??C1????8D??????89??????8B??????8B??????8D????3B??0F83????????8B??8B??69??????????8B??????8B??????C1????33??66??????03??8B??????2B??????89??????66??????8B??3B??0F85????????8B??????C7??????????????2B??8B??????8B??2B??0F84????????83????77??8A????0A??88????8B????89??03??E9????????83????77??8A??2C??88??468B????89??8B????89????8B????89????8B????89????03??E9????????83????77??8A??80????88??46EB??8D????C6????463D????????89??????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??8B??????81??????????4889??????75??8B??????8B??8B??????88??468B????89??8B????89????8B????89????8B????89????83????83????83????83????73??85??76??8A????88??46454B75??BB????????8B????8B????33??75??BB????????03??8B????8B??33??8B??????83????3B??73??8B??2B??????85??75??83????83????8B????8B??33??8B??????3B??72??EB??84??75??C1????4384??74??8B??????8B??03??2B??83????89??????77??3D????????77??4880????8A??80????C0????C0????0A??88??46C1????88??46E9????????3D????????77??4883????89??????77??80????80????EB??83????C6????4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????2D????????83????89??????77??8B??80????C1????80????8A??0A??80????88??46C0????88??46C1????88??46E9????????8B??83????C1????80????80????88??4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????8B??????E9????????8B??????8B??????8B??????2B??89??8B??5F2B??5E5D03??5B83????C390909090909090909090908B??????538B??????55568B??????C7??????????578A??8D????8B??????80????8B??76??81??????????8D????83????8B??83????0F82????????8A??88??40414F75??EB??33??8A??418B??83????0F83????????85??75??80????75??8A????81??????????4184??74??33??8A??418D??????8B??89??83????83????4E74??83????72??8B??89??83????83????83????83????73??85??76??8A??88??40414E75??EB??8A??88??40414E75??33??8A??418B??83????73??33??8B??8A??C1????2B??C1????2B??8A??????????81??????????4188??40478A??88??8A????4088??408A????83????8B??0F84????????8A??88??404183????76??8A??88??404183????76??8A??88??404133??8A??418B??83????72??8B??8B??C1????83????2B??33??8A??C1????2B??4F41C1????4E8A??88??8A????404788??40478A??88??40474E75??EB??83????72??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????8D????66????81??????????C1????2B??83????EB??83????0F82????????8B??8B??83????C1????2B??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????66????81??????????C1????2B??83????3B??74??81??????????83????0F82????????8B??2B??83????0F8C????????8B??89??83????83????83????8B??89??83????83????83????83????73??85??0F86????????8A??88??40474E75??E9????????33??8B??8A??C1????2B??C1????2B??4F41E9????????8B??????2B??3B??89??75??5F5E5D33??5BC31B??5F24??5E5D83????5BC39090909090909090909090909081??????????568B??68????????C7??????????FF??????????83????75??57B9????????33??8D??????66????????????F3AB66AB8D??????5068????????FF??????????83????5F75??6A??68????????FF??????????8B??5E81??????????C390909090909090909090909090568B??E8????????F6????????74??56E8????????83????8B??5EC2????909068????????C7??????????FF??????????85??75??FF??????????C39090909053558B??????5685??5774??8B??????85??74??33??33??33??85??76??8A??????????8A??????????32??80????32??8A????32??33??88????8D????BE????????F7??8D????BF????????8B??33??F7??413B??8B??72??5F5E5D5BC39083????538B??????55565768????????68????????5333??FF??????????8B??85??0F84????????68????????FF??????????8B??B0??88??????88??????8D??????B1??5056C6????????88??????C6????????C6????????C6????????C6????????88??????C6????????C6????????C6????????C6????????FF??????????5753FF??568B??FF??????????85??74??57FF??????????8B??8B??????B9????????8B??68????????50F3A5E8????????83????B8????????5F5E5D5B83????C35F8B??5E5D5B83????C39090538B??????????5657C7??????????8D????BF???????? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 import "pe"
 
@@ -201101,13 +201141,13 @@ rule TRELLIX_ARC_Shadowspawn_Utility : UTILITY FILE
 	meta:
 		description = "Rule to detect ShadowSpawn utility used in the SoftCell operation"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "0a325f5c-2750-5354-b920-f7e1510a8b71"
+		id = "d73b52ca-73ac-54cf-a4ad-4713022e55dd"
 		date = "2019-06-25"
 		modified = "2020-08-14"
 		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L3-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0f2805aee60cdb4eb932768849c845052c92131d0b25a511b822b79b2ac93e24"
+		logic_hash = "v1_sha256_0f2805aee60cdb4eb932768849c845052c92131d0b25a511b822b79b2ac93e24"
 		score = 75
 		quality = 70
 		tags = "UTILITY, FILE"
@@ -201124,7 +201164,7 @@ rule TRELLIX_ARC_Shadowspawn_Utility : UTILITY FILE
 		$op2 = { e9 34 c1 ff ff cc cc cc cc 48 8b 8a 68 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="eaae87b11d2ebdd286af419682037b4c" and all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "eaae87b11d2ebdd286af419682037b4c" and all of them )
 }
 import "pe"
 
@@ -201133,13 +201173,13 @@ rule TRELLIX_ARC_Poison_Ivy_Softcell : RAT FILE
 	meta:
 		description = "Rule to detect Poison Ivy used in the SoftCell operation"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "c362b116-4cb6-5393-9c64-28e8d2886dc7"
+		id = "3ceed73b-bf76-5207-a8f8-e02674e870fe"
 		date = "2019-06-25"
 		modified = "2020-08-14"
 		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L34-L72"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "ac84023404d76adf8cfd8d26bb59fb51f29057748806c4f5ea0634803fd937cd"
+		logic_hash = "v1_sha256_ac84023404d76adf8cfd8d26bb59fb51f29057748806c4f5ea0634803fd937cd"
 		score = 75
 		quality = 70
 		tags = "RAT, FILE"
@@ -201166,7 +201206,7 @@ rule TRELLIX_ARC_Poison_Ivy_Softcell : RAT FILE
 		$op2 = { 56 ff 75 08 8d b5 f4 ef ff ff e8 17 ff ff ff 8d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="dbb1eb5c3476069287a73206929932fd" and all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "dbb1eb5c3476069287a73206929932fd" and all of them )
 }
 import "pe"
 
@@ -201175,13 +201215,13 @@ rule TRELLIX_ARC_Trochilus_Softcell : TROJAN FILE
 	meta:
 		description = "Rule to detect Trochilus malware used in the SoftCell operation"
 		author = "Trellix ARC Team"
-		id = "81e942ae-936f-5952-8d50-ee8cec74520b"
+		id = "c658f3cd-8a77-5371-9bd4-02b188702344"
 		date = "2019-06-25"
 		modified = "2020-08-14"
 		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L74-L106"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "80a0841a08627acf11707f3aeef4e7c3777aecf04b932755efa618d7e92b0cda"
+		logic_hash = "v1_sha256_80a0841a08627acf11707f3aeef4e7c3777aecf04b932755efa618d7e92b0cda"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -201201,7 +201241,7 @@ rule TRELLIX_ARC_Trochilus_Softcell : TROJAN FILE
 		$op2 = { e8 ea ad ff ff ff b6 8c }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="8e13ebc144667958722686cb04ee16f8" and (pe.exports("Entry") and pe.exports("Main")) and all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "8e13ebc144667958722686cb04ee16f8" and ( pe.exports ( "Entry" ) and pe.exports ( "Main" ) ) and all of them )
 }
 import "pe"
 
@@ -201210,13 +201250,13 @@ rule TRELLIX_ARC_Lg_Utility_Lateral_Movement_Softcell : UTILITY FILE
 	meta:
 		description = "Rule to detect the utility LG from Joeware to do Lateral Movement in the SoftCell operation"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "4f435348-427a-5f35-9545-5582033eb043"
+		id = "9018b245-21d0-53a4-b182-33c09b93b647"
 		date = "2019-06-25"
 		modified = "2020-08-14"
 		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L108-L143"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "f88781b9632cd31bb9e3d68730c63c3fcd0ebe4a09b70b5b54d456cdc9ae8d01"
+		logic_hash = "v1_sha256_f88781b9632cd31bb9e3d68730c63c3fcd0ebe4a09b70b5b54d456cdc9ae8d01"
 		score = 75
 		quality = 70
 		tags = "UTILITY, FILE"
@@ -201240,7 +201280,7 @@ rule TRELLIX_ARC_Lg_Utility_Lateral_Movement_Softcell : UTILITY FILE
 		$op2 = { 66 c7 85 74 ff ff ff 0c 00 8d 55 d8 52 e8 e9 eb }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="327ce3f883a5b59e966b5d0e3a321156" and all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "327ce3f883a5b59e966b5d0e3a321156" and all of them )
 }
 import "pe"
 
@@ -201249,13 +201289,13 @@ rule TRELLIX_ARC_Mangzamel_Softcell : TROJAN FILE
 	meta:
 		description = "Rule to detect Mangzamel used in the SoftCell operation"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "b0473362-7e03-5127-aee5-b5a4f05bcc8e"
+		id = "dffe1e71-88d2-566c-9793-0c5b0bc353c0"
 		date = "2019-06-25"
 		modified = "2020-08-14"
 		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L145-L176"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "3666c645943eb8469096b8093c74e4d819299d3ffc2b99e37a506d8ef09e90c4"
+		logic_hash = "v1_sha256_3666c645943eb8469096b8093c74e4d819299d3ffc2b99e37a506d8ef09e90c4"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -201276,7 +201316,7 @@ rule TRELLIX_ARC_Mangzamel_Softcell : TROJAN FILE
 		$op2 = { 80 0f b6 b5 68 ff ff ff c1 e2 04 0b d6 0f b6 b5 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="ef64bb4aa42ef5a8a2e3858a636bce40" and all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "ef64bb4aa42ef5a8a2e3858a636bce40" and all of them )
 }
 import "pe"
 
@@ -201285,13 +201325,13 @@ rule TRELLIX_ARC_Nbtscan_Utility_Softcell : UTILITY FILE
 	meta:
 		description = "Rule to detect nbtscan utility used in the SoftCell operation"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "a2a8dd43-0d30-5da5-9dd3-6ba9f6473c40"
+		id = "894f6286-784b-50b0-8b83-a8a6dced2f46"
 		date = "2019-06-25"
 		modified = "2020-08-14"
 		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L178-L209"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "6079f1363578f82fd38971d0c8f69cc156f7f678c3f2be22c5d9c3748dc80b1f"
+		logic_hash = "v1_sha256_6079f1363578f82fd38971d0c8f69cc156f7f678c3f2be22c5d9c3748dc80b1f"
 		score = 75
 		quality = 45
 		tags = "UTILITY, FILE"
@@ -201311,7 +201351,7 @@ rule TRELLIX_ARC_Nbtscan_Utility_Softcell : UTILITY FILE
 		$op2 = { 59 59 c3 8b 65 e8 ff 75 d0 ff 15 34 60 40 00 ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="2fa43c5392ec7923ababced078c2f98d" and all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "2fa43c5392ec7923ababced078c2f98d" and all of them )
 }
 import "pe"
 
@@ -201320,13 +201360,13 @@ rule TRELLIX_ARC_Mimikatz_Utility_Softcell : HACKTOOL FILE
 	meta:
 		description = "Rule to detect Mimikatz utility used in the SoftCell operation"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "0c01a2f6-cf3c-57b3-8f19-94d320422658"
+		id = "57eb721d-7dad-56e5-a810-c7e2191b2c37"
 		date = "2019-06-25"
 		modified = "2020-08-14"
 		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L211-L258"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "4ccb44bf0d490a18e35290d904326ce14cdc92c96be1a38e6059431645233e37"
+		logic_hash = "v1_sha256_4ccb44bf0d490a18e35290d904326ce14cdc92c96be1a38e6059431645233e37"
 		score = 75
 		quality = 68
 		tags = "HACKTOOL, FILE"
@@ -201362,7 +201402,7 @@ rule TRELLIX_ARC_Mimikatz_Utility_Softcell : HACKTOOL FILE
 		$op2 = { 48 3b 0d 34 26 01 00 74 05 e8 a9 31 ff ff 48 8b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="169e02f00c6fb64587297444b6c41ff4" and all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "169e02f00c6fb64587297444b6c41ff4" and all of them )
 }
 import "pe"
 
@@ -201371,13 +201411,13 @@ rule TRELLIX_ARC_Sfx_Winrar_Plugx : BUILDER FILE
 	meta:
 		description = "Rule to detect the SFX WinRAR delivering a possible Plugx sample"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "ac975a58-6a8a-515e-b27f-327a7bfc7686"
+		id = "ca1e6324-8562-54f4-99c5-26f4cdefe615"
 		date = "2019-06-25"
 		modified = "2020-08-14"
 		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L260-L307"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8231f46330762cecf8a796d1a29c8fa6ba1c10b527fa86bf6c73130349558dad"
+		logic_hash = "v1_sha256_8231f46330762cecf8a796d1a29c8fa6ba1c10b527fa86bf6c73130349558dad"
 		score = 75
 		quality = 68
 		tags = "BUILDER, FILE"
@@ -201413,21 +201453,21 @@ rule TRELLIX_ARC_Sfx_Winrar_Plugx : BUILDER FILE
 		$op2 = { 56 ff 75 08 8d b5 f4 ef ff ff e8 17 ff ff ff 8d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="dbb1eb5c3476069287a73206929932fd" and all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "dbb1eb5c3476069287a73206929932fd" and all of them )
 }
 rule TRELLIX_ARC_Apt_Miniasp_Pdb : TROJAN FILE
 {
 	meta:
 		description = "Rule to detect MiniASP based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "2e7e2990-5e7f-52b0-884a-fcb54b2f5488"
+		id = "dfb5c873-e42c-5b8f-8356-4fa8de981420"
 		date = "2012-07-12"
 		modified = "2020-08-14"
 		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_MiniASP_pdb.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "42334f2119069b8c0ececfb14a7030e480b5d18ca1cc35f1ceaee847bc040e53"
-		logic_hash = "8ee6f93aaae2c48cc5835269fd526371040cd33cc309220f92a150444ba21055"
+		logic_hash = "v1_sha256_8ee6f93aaae2c48cc5835269fd526371040cd33cc309220f92a150444ba21055"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -201442,21 +201482,21 @@ rule TRELLIX_ARC_Apt_Miniasp_Pdb : TROJAN FILE
 		$pdb1 = "\\XiaoME\\AiH\\20120410\\Attack\\MiniAsp3\\Release\\MiniAsp.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 80KB and any of them
 }
 rule TRELLIX_ARC_Apt_Aurora_Pdb_Samples : BACKDOOR FILE
 {
 	meta:
 		description = "Aurora APT Malware 2006-2010"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "51b080b7-671b-592b-ba52-7fdd0ddf0294"
+		id = "81144726-5c28-5499-9c6c-dd4e63b04b39"
 		date = "2010-01-11"
 		modified = "2020-08-14"
 		reference = "https://en.wikipedia.org/wiki/Operation_Aurora"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_operation_aurora.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "ce7debbcf1ca3a390083fe5753f231e632017ca041dfa662ad56095a500f2364"
-		logic_hash = "5791ae7b96f2b59d0cca1ab97455bb4745edad8980ac4aff22aa36e0bc4f240e"
+		logic_hash = "v1_sha256_5791ae7b96f2b59d0cca1ab97455bb4745edad8980ac4aff22aa36e0bc4f240e"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201471,21 +201511,21 @@ rule TRELLIX_ARC_Apt_Aurora_Pdb_Samples : BACKDOOR FILE
 		$pdb1 = "\\Aurora_Src\\AuroraVNC\\Avc\\Release\\AVC.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and any of them
 }
 rule TRELLIX_ARC_Apt_Gdocupload_Glooxmail : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect gdocupload tool used by APT1"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "deb20196-65e6-5dac-af0c-2f16e5926715"
+		id = "25f6e9b6-5d59-58bd-86cc-66acb215d49e"
 		date = "2013-02-19"
 		modified = "2020-08-14"
 		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_gdocupload_pdb.yar#L1-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "295c5c7aa5fa29628dec9f42ed657fce0bc789079c4e51932bcbc99a28dfd440"
-		logic_hash = "e016bb636af22fae79875bebaf1b4bd4f2a403e797d7ee52ea0691b4d7a54cf8"
+		logic_hash = "v1_sha256_e016bb636af22fae79875bebaf1b4bd4f2a403e797d7ee52ea0691b4d7a54cf8"
 		score = 75
 		quality = 45
 		tags = "BACKDOOR, FILE"
@@ -201506,7 +201546,7 @@ rule TRELLIX_ARC_Apt_Gdocupload_Glooxmail : BACKDOOR FILE
 		$s8 = "Referer: http://sn114w.snt114.mail.live.com/mail/EditMessageLight.aspx?n=%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 import "pe"
 
@@ -201515,13 +201555,13 @@ rule TRELLIX_ARC_Syskit : FILE
 	meta:
 		description = "SYSkit backdoor"
 		author = "Christiaan @ McAfee ATR"
-		id = "f06db38f-52d5-51b5-a17f-63e285dd5f80"
+		id = "5c359066-b108-503c-9598-08829c0d98d6"
 		date = "2019-09-17"
 		modified = "2020-04-02"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Tortoiseshell_Syskit.yar#L3-L40"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "5b489d47d56de5c770b6ff6d6d56bf0fb87174f4a8428052b28fb392d9ac3f87"
+		logic_hash = "v1_sha256_5b489d47d56de5c770b6ff6d6d56bf0fb87174f4a8428052b28fb392d9ac3f87"
 		score = 75
 		quality = 68
 		tags = "FILE"
@@ -201555,21 +201595,21 @@ rule TRELLIX_ARC_Syskit : FILE
 		$op2 = { 06 00 00 11 28 4d 00 00 0a 02 6f 4e 00 00 0a 28 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and pe.imphash()=="f34d5f2d4577ed6d9ceec516c1f5a744" and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and pe.imphash ( ) == "f34d5f2d4577ed6d9ceec516c1f5a744" and ( 1 of ( $x* ) and 4 of them ) and all of ( $op* ) ) or ( all of them )
 }
 rule TRELLIX_ARC_Ixeshe_Bled_Malware_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect Ixeshe_bled malware based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "93356eab-5bb3-5b85-acc6-9a247554aa2d"
+		id = "39ed0923-60d1-5aa3-9bab-9e3b40b31bc7"
 		date = "2012-05-30"
 		modified = "2020-08-14"
 		reference = "https://attack.mitre.org/software/S0015/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/ixeshe_bled_pdb.yar#L1-L24"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "d1be51ef9a873de85fb566d157b034234377a4a1f24dfaf670e6b94b29f35482"
-		logic_hash = "7d2ce7644e25a56c101c148a32f7b0f7c3185c0c17f4d65eaef257f6ac7f8ffb"
+		logic_hash = "v1_sha256_7d2ce7644e25a56c101c148a32f7b0f7c3185c0c17f4d65eaef257f6ac7f8ffb"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201583,21 +201623,21 @@ rule TRELLIX_ARC_Ixeshe_Bled_Malware_Pdb : BACKDOOR FILE
 		$pdb = "\\code\\Blade2009.6.30\\Blade2009.6.30\\EdgeEXE_20003OC\\Debug\\EdgeEXE.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and any of them
 }
 rule TRELLIX_ARC_Apt_Blackenergy_Pdb : TROJAN FILE
 {
 	meta:
 		description = "Rule to detect the BlackEnergy trojan"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "55c96b66-a8bf-5390-a75a-f3d2441c2a55"
+		id = "5c9dff12-20ae-52ef-9c53-47cfc815b559"
 		date = "2013-02-15"
 		modified = "2020-08-14"
 		reference = "https://www.kaspersky.com.au/resource-center/threats/blackenergy"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_blackenergy_pdb.yar#L1-L38"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "4b2efcda5269f4b80dc417a2b01332185f2fafabd8ba7114fa0306baaab5a72d"
-		logic_hash = "7bb85d03d8f2a4d91554f7fea96e9bbe36b153cfa4a91fd13fb99d41d430c9e9"
+		logic_hash = "v1_sha256_7bb85d03d8f2a4d91554f7fea96e9bbe36b153cfa4a91fd13fb99d41d430c9e9"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -201624,21 +201664,21 @@ rule TRELLIX_ARC_Apt_Blackenergy_Pdb : TROJAN FILE
 		$s14 = "\\Msi.dll" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule TRELLIX_ARC_Karkoff_Dnspionaje : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the Karkoff malware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "a5cdc65f-3a4c-5d97-9d88-8d60b14dfb9a"
+		id = "795f8a3f-04eb-545b-8fa8-e94e83109ed2"
 		date = "2019-04-23"
 		modified = "2020-08-14"
 		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_karkoff_dnspionaje.yar#L1-L30"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c"
-		logic_hash = "79dd0087f1197cb1b2cd98416302363951479ba5ebf82289768585b56ed21c3a"
+		logic_hash = "v1_sha256_79dd0087f1197cb1b2cd98416302363951479ba5ebf82289768585b56ed21c3a"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201657,21 +201697,21 @@ rule TRELLIX_ARC_Karkoff_Dnspionaje : BACKDOOR FILE
 		$s6 = "https://www.newtonsoft.com/json 0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule TRELLIX_ARC_Apt_Lagulon_Trojan_Pdb : TROJAN FILE
 {
 	meta:
 		description = "Rule to detect trojan Lagulon based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "a31a465d-1f16-5c3e-a62d-ea15c11253c3"
+		id = "53e64066-cbe9-5145-872e-6b5646adc674"
 		date = "2013-08-31"
 		modified = "2020-08-14"
 		reference = "https://www.cylance.com/operation-cleaver-cylance"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_lagulon_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "e401340020688cdd0f5051b7553815eee6bc04a5a962900883f1b3676bf1de53"
-		logic_hash = "dad04c2deb990f253f952b768b74349dc9afb5f6db91ea3afff889f4c9f3230b"
+		logic_hash = "v1_sha256_dad04c2deb990f253f952b768b74349dc9afb5f6db91ea3afff889f4c9f3230b"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -201685,21 +201725,21 @@ rule TRELLIX_ARC_Apt_Lagulon_Trojan_Pdb : TROJAN FILE
 		$pdb = "\\proj\\wndTest\\Release\\wndTest.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and any of them
 }
 rule TRELLIX_ARC_Apt_Hanover_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect hanover samples based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "e2476ae8-d284-58f5-8bcb-9313a5b4d756"
+		id = "721f4a9d-d992-57b2-a7d2-0c94ca0d3752"
 		date = "2012-01-05"
 		modified = "2020-08-14"
 		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L1-L39"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "a2460412575cdc187dfb69eb2847c5b43156af7f7d94b71422e7f771e8adb51e"
-		logic_hash = "a37d528e4dacddcabe55261f16b51aec626f6180107f154d3ae34cdfa71e2c58"
+		logic_hash = "v1_sha256_a37d528e4dacddcabe55261f16b51aec626f6180107f154d3ae34cdfa71e2c58"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201726,21 +201766,21 @@ rule TRELLIX_ARC_Apt_Hanover_Pdb : BACKDOOR FILE
 		$pdb13 = "\\final project backup\\UPLODER FTP BASED\\New folder\\Tron 1.2.1(Ftp n Startup)\\Release\\Http_t.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and any of them
 }
 rule TRELLIX_ARC_Apt_Hanover_Appinbot_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect hanover appinbot samples based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "fb201000-ca8b-57e0-b560-5082477d8ee7"
+		id = "e3396ad6-cc89-5710-b5f5-adaa59912591"
 		date = "2012-01-05"
 		modified = "2020-08-14"
 		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L41-L77"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "6ad56d64444fa76e1ad43a8c260c493b9086d4116eb18af630e65d3fd39bf6d6"
-		logic_hash = "56cdd22efd81bcdda445242257b2418c6941bf9e5e68065d8b8d73d0f9c27df5"
+		logic_hash = "v1_sha256_56cdd22efd81bcdda445242257b2418c6941bf9e5e68065d8b8d73d0f9c27df5"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201766,21 +201806,21 @@ rule TRELLIX_ARC_Apt_Hanover_Appinbot_Pdb : BACKDOOR FILE
 		$pdb12 = "\\Datahelp\\SCode\\BOT\\MATRIX_1.3.3\\CLIENT\\Build\\Win32\\Release\\appinclient.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <440KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 440KB and any of them
 }
 rule TRELLIX_ARC_Apt_Hanover_Foler_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect hanover foler samples"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "064b12a1-7a6a-5a19-bc9a-c98c1dbc6631"
+		id = "110ffd1a-50c5-5171-a522-cc7e060f9076"
 		date = "2012-01-05"
 		modified = "2020-08-14"
 		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L79-L106"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "bd77d7f8af8329dfb0bcc0624d6d824d427fbaf859ab2dedd8629aa2f3b7ae0d"
-		logic_hash = "cd2bd6a4c8084c02af5aaba81529cdb67aab7c2db397e2757d383534123c5227"
+		logic_hash = "v1_sha256_cd2bd6a4c8084c02af5aaba81529cdb67aab7c2db397e2757d383534123c5227"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201797,21 +201837,21 @@ rule TRELLIX_ARC_Apt_Hanover_Foler_Pdb : BACKDOOR FILE
 		$pdb3 = "\\Monthly Task\\August 2011\\USB Prop\\Usb Propagator.09-24\\nn\\Release\\nn.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <480KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 480KB and any of them
 }
 rule TRELLIX_ARC_Apt_Hanover_Linog_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect hanover linog samples based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "2f4d30ad-aadc-5c90-8234-d1b5802f4781"
+		id = "697dbe0e-b45a-5a73-949b-d09c49da57dc"
 		date = "2012-01-05"
 		modified = "2020-08-14"
 		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L108-L132"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "f6319fd0e1d3b9d3694c46f80208e70b389e7dcc6aaad2508b80575c604c5dba"
-		logic_hash = "3aebafc80ca2e187bdcae3750162d94ce9419988ffd451ba4762b2d299a04ed7"
+		logic_hash = "v1_sha256_3aebafc80ca2e187bdcae3750162d94ce9419988ffd451ba4762b2d299a04ed7"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201826,21 +201866,21 @@ rule TRELLIX_ARC_Apt_Hanover_Linog_Pdb : BACKDOOR FILE
 		$pdb1 = "\\Backup-HP-ABCD-PC\\download\\Release\\download.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <165KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 165KB and any of them
 }
 rule TRELLIX_ARC_Apt_Hanover_Ron_Babylon_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "apt_hanover_ron_babylon"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "2637bba5-67be-5e71-9ce3-570ea14a96df"
+		id = "50876718-68b6-50c2-90de-225ba385d1c9"
 		date = "2012-01-05"
 		modified = "2020-08-14"
 		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L134-L200"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "784cfb1bfdd7080c658fad08b1f679bbb0c94e6e468a3605ea47cdce533df815"
-		logic_hash = "212de25a555335eb4dc24052702ee30d71039f44b448079f19f12fcb775d5298"
+		logic_hash = "v1_sha256_212de25a555335eb4dc24052702ee30d71039f44b448079f19f12fcb775d5298"
 		score = 75
 		quality = 45
 		tags = "BACKDOOR, FILE"
@@ -201896,21 +201936,21 @@ rule TRELLIX_ARC_Apt_Hanover_Ron_Babylon_Pdb : BACKDOOR FILE
 		$pdb42 = "\\Uploader\\HTTP\\ron uplo\\RON 2.0.0\\Release\\Ron.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <330KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 330KB and any of them
 }
 rule TRELLIX_ARC_Apt_Hanover_Slidewin_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect hanover slidewin samples"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "aefa1a2b-6a6f-5209-b1e2-90f1817442da"
+		id = "1db30eca-6ec9-5eb8-81b8-4ad2420838a4"
 		date = "2012-01-05"
 		modified = "2020-08-14"
 		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L202-L229"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "89b80267f9c7fc291474e5751c2e42838fdab7a5cbd50a322ed8f8efc3d2ce83"
-		logic_hash = "28922d75109cf3da4807e08588e076f1496c14ea462a1c8dedb1d1a734f1fb48"
+		logic_hash = "v1_sha256_28922d75109cf3da4807e08588e076f1496c14ea462a1c8dedb1d1a734f1fb48"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201927,21 +201967,21 @@ rule TRELLIX_ARC_Apt_Hanover_Slidewin_Pdb : BACKDOOR FILE
 		$pdb3 = "\\Data\\User\\MFC-Projects\\KeyLoggerWin32-zendossier\\Release\\slidebar.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and any of them
 }
 rule TRELLIX_ARC_Apt_Elise_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect Elise APT based on the PDB reference"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "cc8dd203-baad-5800-ba2c-f9c47d8ca6f0"
+		id = "64ec5d5c-34f4-51b8-8617-e8d54a7182e4"
 		date = "2017-05-31"
 		modified = "2020-08-14"
 		reference = "https://attack.mitre.org/software/S0081/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_elise_pdb.yar#L1-L29"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "b426dbe0f281fe44495c47b35c0fb61b28558b5c8d9418876e22ec3de4df9e7b"
-		logic_hash = "bb7eee8082aa0f6634a8c4cdb9cbe0e2a7f00b97e48609c81a21bdaac64a5496"
+		logic_hash = "v1_sha256_bb7eee8082aa0f6634a8c4cdb9cbe0e2a7f00b97e48609c81a21bdaac64a5496"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201959,21 +201999,21 @@ rule TRELLIX_ARC_Apt_Elise_Pdb : BACKDOOR FILE
 		$pdb4 = "\\lstudio\\projects\\lotus\\evora\\Release\\EvoraDLL\\i386\\EvoraDLL.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and any of them
 }
 rule TRELLIX_ARC_Apt_Gauss_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect Gauss based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "209223cc-16e5-5596-8744-21ad71b5ec2a"
+		id = "2ec81166-fa58-59be-b429-0a0b15888b67"
 		date = "2012-08-14"
 		modified = "2020-08-14"
 		reference = "https://securelist.com/the-mystery-of-the-encrypted-gauss-payload-5/33561/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/gauss_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "7b0d0612b4ecc889a901115c2e77776ef0ea65c056b283d12e80f863062cea28"
-		logic_hash = "cb20c87ea976f395e000f2c631ffd52b09dca2af37adceafe5be72b37f75a997"
+		logic_hash = "v1_sha256_cb20c87ea976f395e000f2c631ffd52b09dca2af37adceafe5be72b37f75a997"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -201987,20 +202027,20 @@ rule TRELLIX_ARC_Apt_Gauss_Pdb : BACKDOOR FILE
 		$pdb = "\\projects\\gauss\\bin\\release\\winshell.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 550KB and any of them
 }
 rule TRELLIX_ARC_Hermeticwiper : TROJAN FILE
 {
 	meta:
 		description = "Detecting variants of Hermetic Wiper malware discovered in UA"
 		author = " cb @ Trellix ATR"
-		id = "fc6d9238-b732-541d-b083-11b43fe8770d"
+		id = "0ad4ad32-cce3-5039-910d-f28c4e366194"
 		date = "2022-02-24"
 		modified = "2022-02-24"
 		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Troj_HermWiper.yar#L1-L27"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "b48e91afa19e09c7035ccda1b9293448e834d612b9a953b593f9412acb78faac"
+		logic_hash = "v1_sha256_b48e91afa19e09c7035ccda1b9293448e834d612b9a953b593f9412acb78faac"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -202021,21 +202061,21 @@ rule TRELLIX_ARC_Hermeticwiper : TROJAN FILE
 		$10 = {DF5519064E31101CF3DA96C15FF96728B708F358F51759E3A22FFA1CF1BB986A2038D6753E6BF037945B8469ADF20BAB71E10F3DE27735F640704C970DFE8672}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule TRELLIX_ARC_Troy_Malware_Campaign_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the Operation Troy based on the PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "c1fc5b9c-104f-5d07-86ee-5a54d9731f04"
+		id = "cdebd6a3-6160-566f-94e0-4b331a51d872"
 		date = "2013-06-23"
 		modified = "2020-08-14"
 		reference = "https://www.mcafee.com/enterprise/en-us/assets/white-papers/wp-dissecting-operation-troy.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_operation_troy.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "2ca6b7e9488c1e9f39392e696704ad3f2b82069e35bc8001d620024ebbf2d65a"
-		logic_hash = "a64b4aa082c45d1753ad30ba2f67df0ef5b7658c3c99e031ef747eb4e6c7bb00"
+		logic_hash = "v1_sha256_a64b4aa082c45d1753ad30ba2f67df0ef5b7658c3c99e031ef747eb4e6c7bb00"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -202050,21 +202090,21 @@ rule TRELLIX_ARC_Troy_Malware_Campaign_Pdb : BACKDOOR FILE
 		$pdb1 = "\\Work\\Make Troy\\Concealment Troy\\Exe_Concealment_Troy(Winlogon_Shell)\\Dll\\Concealment_Troy(Dll)\\Release\\Concealment_Troy.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and any of them
 }
 rule TRELLIX_ARC_Apt_Manitsme_Trojan : TROJAN FILE
 {
 	meta:
 		description = "Rule to detect the Manitsme trojan"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "49e0c934-6920-5e49-837c-27ebbbd5a1a2"
+		id = "a9b9cc87-b911-5b95-a9ca-023995f64c8c"
 		date = "2013-03-08"
 		modified = "2020-08-14"
 		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_manitsme_trojan_pdb.yar#L1-L36"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "c1c0ea096ec4d36c1312171de2a9ebe258c588528a20dbb06a7e3cf97bf1e197"
-		logic_hash = "584053145249a930d3eae5e291d3553c57fa427dbecac9f04e7c0169f153b7af"
+		logic_hash = "v1_sha256_584053145249a930d3eae5e291d3553c57fa427dbecac9f04e7c0169f153b7af"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -202089,21 +202129,21 @@ rule TRELLIX_ARC_Apt_Manitsme_Trojan : TROJAN FILE
 		$s12 = "SendTo(s,(char *)&sztop,sizeof(sztop),FILETYPE) == ERRTYPE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule TRELLIX_ARC_Apt_Mirage_Pdb : TROJAN FILE
 {
 	meta:
 		description = "Rule to detect Mirage samples based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "49b7623f-a2c9-52e4-8679-d62f6aae99ca"
+		id = "1216b9b2-85d8-5045-9599-a5e142acd2c3"
 		date = "2012-09-18"
 		modified = "2020-08-14"
 		reference = "https://www.secureworks.com/research/the-mirage-campaign"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_mirage_pdb.yar#L1-L26"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "0107a12f05bea4040a467dd5bc5bd130fd8a4206a09135d452875da89f121019"
-		logic_hash = "cb88dc787d9964451ea93f5574d9c73ae6a820d81e20d41c3c8ee44c3fee032d"
+		logic_hash = "v1_sha256_cb88dc787d9964451ea93f5574d9c73ae6a820d81e20d41c3c8ee44c3fee032d"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -202118,21 +202158,21 @@ rule TRELLIX_ARC_Apt_Mirage_Pdb : TROJAN FILE
 		$pdb1 = "\\fox_1.2 20110307\\MF-v1.2\\Server\\Release\\MirageFox_Server.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and any of them
 }
 rule TRELLIX_ARC_Apt_Flamer_Pdb : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect Flamer based on the PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "3bbe043d-c0dc-5aa2-b985-800a6d9038fd"
+		id = "9351a710-1c32-59cc-84f1-30dfc6ea4f3e"
 		date = "2012-05-29"
 		modified = "2020-08-14"
 		reference = "https://www.forcepoint.com/ko/blog/x-labs/flameflamerskywiper-one-most-advanced-malware-found-yet"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/flamer_pdb.yar#L1-L25"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "554924ebdde8e68cb8d367b8e9a016c5908640954ec9fb936ece07ac4c5e1b75"
-		logic_hash = "3c1d3d015e086cff1f3d5add39397d8ed251b12144b31d8547165cbd0217735c"
+		logic_hash = "v1_sha256_3c1d3d015e086cff1f3d5add39397d8ed251b12144b31d8547165cbd0217735c"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -202146,21 +202186,21 @@ rule TRELLIX_ARC_Apt_Flamer_Pdb : BACKDOOR FILE
 		$pdb = "\\Projects\\Jimmy\\jimmydll_v2.0\\JimmyForClan\\Jimmy\\bin\\srelease\\jimmydll\\indsvc32.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and any of them
 }
 rule TRELLIX_ARC_Chimera_Recordedtv_Modified : TROJAN FILE
 {
 	meta:
 		description = "Rule to detect the modified version of RecordedTV.ms found in the Operation Skeleton"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "b0969713-41a4-550c-9545-f02783fa8d02"
+		id = "a34f08f5-ac1c-5a8e-a463-a82fff4bea18"
 		date = "2020-04-21"
 		modified = "2020-08-14"
 		reference = "https://medium.com/@cycraft_corp/taiwan-high-tech-ecosystem-targeted-by-foreign-apt-group-5473d2ad8730"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_operation_skeleton.yar#L1-L33"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "66f13964c87fc6fe093a9d8cc0de0bf2b3bdaea9564210283fdb97a1dde9893b"
-		logic_hash = "7165779b66999259a079fa68f898c5f9fb634adcb9d249366d321dff1014184b"
+		logic_hash = "v1_sha256_7165779b66999259a079fa68f898c5f9fb634adcb9d249366d321dff1014184b"
 		score = 75
 		quality = 70
 		tags = "TROJAN, FILE"
@@ -202178,20 +202218,20 @@ rule TRELLIX_ARC_Chimera_Recordedtv_Modified : TROJAN FILE
 		$s4 = "rar.lng" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them
 }
 rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the APT Derusbi ELF file"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "3b1c9644-7279-5e2c-8891-f03ca78cf3b7"
+		id = "b820ab97-c118-50e0-ba65-14f271c52aed"
 		date = "2017-05-31"
 		modified = "2020-08-14"
 		reference = "https://attack.mitre.org/software/S0021/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L1-L61"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0a83566a0540d28d1cc0ebee01d29d15ddc86cabff9044fd8a198b847ba24c50"
+		logic_hash = "v1_sha256_0a83566a0540d28d1cc0ebee01d29d15ddc86cabff9044fd8a198b847ba24c50"
 		score = 75
 		quality = 68
 		tags = "BACKDOOR, FILE"
@@ -202241,20 +202281,20 @@ rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi : BACKDOOR FILE
 		$s37 = "rename"
 
 	condition:
-		( uint32(0)==0x4464c457f) and filesize <200KB and all of them
+		( uint32( 0 ) == 0x4464c457f ) and filesize < 200KB and all of them
 }
 rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Kernelmodule : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect the Derusbi ELK Kernel module"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "1614a63d-c5d1-5ce1-a5b8-eb48325f60e6"
+		id = "3b7630f1-a94c-5f41-b7c5-c9a82469ed71"
 		date = "2017-05-31"
 		modified = "2020-08-14"
 		reference = "https://attack.mitre.org/software/S0021/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L63-L105"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0b86e96ef616e926f0d665e2bd013f2773461483176c68bd5e7c7d059ac13d78"
+		logic_hash = "v1_sha256_0b86e96ef616e926f0d665e2bd013f2773461483176c68bd5e7c7d059ac13d78"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -202287,20 +202327,20 @@ rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Kernelmodule : BACKDOOR FILE
 		$s20 = "kfree_skb"
 
 	condition:
-		( uint32(0)==0x4464c457f) and filesize <200KB and all of them
+		( uint32( 0 ) == 0x4464c457f ) and filesize < 200KB and all of them
 }
 rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect Derusbi Linux Shared Memory creation"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "8d2db62e-22fa-5bbe-ab65-f294fc911b82"
+		id = "b8d64f98-bde3-5da2-9e4e-9a10a4b47665"
 		date = "2017-05-31"
 		modified = "2020-08-14"
 		reference = "https://attack.mitre.org/software/S0021/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L107-L130"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "095af979728f3b71e3192140306e4aa76011e07a25b20b0c5b3b98db41411714"
+		logic_hash = "v1_sha256_095af979728f3b71e3192140306e4aa76011e07a25b20b0c5b3b98db41411714"
 		score = 75
 		quality = 70
 		tags = "BACKDOOR, FILE"
@@ -202314,20 +202354,20 @@ rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation : BACKDOOR FILE
 		$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
 
 	condition:
-		( uint32(0)==0x464C457F) and filesize <200KB and all of them
+		( uint32( 0 ) == 0x464C457F ) and filesize < 200KB and all of them
 }
 rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Linux_Strings : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect APT Derusbi Linux Strings"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "09e47580-9b20-5461-943e-32b932c36214"
+		id = "f0f6f41a-ce7d-5d53-9802-c4079c7b7e21"
 		date = "2017-05-31"
 		modified = "2020-08-14"
 		reference = "https://attack.mitre.org/software/S0021/"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L132-L173"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0e95497c44a0c1d85936a6a072063720a771b7e1eb8da2377e54577e3fc2764e"
+		logic_hash = "v1_sha256_0e95497c44a0c1d85936a6a072063720a771b7e1eb8da2377e54577e3fc2764e"
 		score = 75
 		quality = 68
 		tags = "BACKDOOR, FILE"
@@ -202354,20 +202394,20 @@ rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Linux_Strings : BACKDOOR FILE
 		$c2 = "/tmp/1408.log" wide ascii fullword
 
 	condition:
-		uint32(0)==0x464C457F and filesize <200KB and ((1 of ($a*) and 4 of ($b*)) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*))
+		uint32( 0 ) == 0x464C457F and filesize < 200KB and ( ( 1 of ( $a* ) and 4 of ( $b* ) ) or ( 1 of ( $a* ) and 1 of ( $c* ) ) or 2 of ( $a* ) or all of ( $b* ) )
 }
 rule TRELLIX_ARC_Apt_Hikit_Rootkit : ROOTKIT FILE
 {
 	meta:
 		description = "Rule to detect the rootkit hikit based on PDB"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "c53acbc6-8f4a-590b-8dd7-ce4da6d79cf8"
+		id = "6ba6e964-7289-5dfd-b9b1-706f17fd44a5"
 		date = "2012-08-20"
 		modified = "2020-08-14"
 		reference = "https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hikit_rootkit_pdb.yar#L1-L28"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8a425ababdfbe95bd8ac7d4f519be16c0f1fd0b7eea2874124db2f00dd6eb56d"
+		logic_hash = "v1_sha256_8a425ababdfbe95bd8ac7d4f519be16c0f1fd0b7eea2874124db2f00dd6eb56d"
 		score = 75
 		quality = 70
 		tags = "ROOTKIT, FILE"
@@ -202384,21 +202424,21 @@ rule TRELLIX_ARC_Apt_Hikit_Rootkit : ROOTKIT FILE
 		$pdb3 = "\\JmVodServer\\hikit\\bin64\\w7fw_x64.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and any of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and any of them
 }
 rule TRELLIX_ARC_Apt_Babar_Malware : BACKDOOR FILE
 {
 	meta:
 		description = "Rule to detect Babar malware"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "3cbb63ce-ff93-51ee-93aa-2594fa1f8dad"
+		id = "0a84f105-2ad2-5f1e-9e2c-4bdcd2c65562"
 		date = "2015-02-18"
 		modified = "2020-08-14"
 		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
 		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_babar_pdb.yar#L1-L35"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
 		hash = "c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf"
-		logic_hash = "02acef92691caed4573b609c111302427b9c27c5ef93f9199c52d75cb13e8615"
+		logic_hash = "v1_sha256_02acef92691caed4573b609c111302427b9c27c5ef93f9199c52d75cb13e8615"
 		score = 75
 		quality = 45
 		tags = "BACKDOOR, FILE"
@@ -202422,16 +202462,16 @@ rule TRELLIX_ARC_Apt_Babar_Malware : BACKDOOR FILE
 		$s11 = "USERPROFILE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 /*
  * YARA Rule Set
  * Repository Name: Arkbird SOLG
  * Repository: https://github.com/StrangerealIntel/DailyIOC
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: a873ff1298c43705e9c67286f3014f4300dd04f7
- * Number of Rules: 214
- * Skipped: 0 (age), 10 (quality), 0 (score), 0 (importance)
+ * Number of Rules: 215
+ * Skipped: 0 (age), 11 (quality), 0 (score), 0 (importance)
  *
  *
  * LICENSE
@@ -202443,13 +202483,13 @@ rule ARKBIRD_SOLG_Ran_Onyxlocker_Nov_2020_1 : FILE
 	meta:
 		description = "Detect OnyxLocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "bb7d914c-a074-5d79-a5d2-43c5a0adf49e"
+		id = "ab9d2568-6fef-5908-9759-074c920012b5"
 		date = "2020-11-18"
 		modified = "2020-11-18"
 		reference = "https://twitter.com/Kangxiaopao/status/1328614320016560128"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-18/OnyxLocker/Ran_OnyxLocker_Nov_2020_1.yar#L1-L27"
 		license_url = "N/A"
-		logic_hash = "1ccca1040acee5bb937fd5ebb3536f8c644d3586229d01457d780bef5fcb57a1"
+		logic_hash = "v1_sha256_1ccca1040acee5bb937fd5ebb3536f8c644d3586229d01457d780bef5fcb57a1"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -202474,22 +202514,20 @@ rule ARKBIRD_SOLG_Ran_Onyxlocker_Nov_2020_1 : FILE
 		$s16 = "{0} {1}" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >8KB and 8 of them
+		uint16( 0 ) == 0x5a4d and filesize > 8KB and 8 of them
 }
-import "pe"
-
 rule ARKBIRD_SOLG_APT_MAL_Donot_Loader_June_2020_1 : FILE
 {
 	meta:
 		description = "Detect loader malware used by APT Donot for drops the final stage"
 		author = "Arkbird_SOLG"
-		id = "ec4cac12-529f-56d2-bbc0-5fe30424b10b"
+		id = "ac09f6f0-3043-54d9-a368-8201fbcb5a64"
 		date = "2020-06-22"
 		modified = "2020-06-22"
 		reference = "https://twitter.com/ccxsaber/status/1274978583463649281"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-22/APT_MAL_Donot_Loader_June_2020_1.yar#L3-L22"
 		license_url = "N/A"
-		logic_hash = "986deffd48c1fb707948b00e1e200fa6538d4c73a32ab89f5119403f9bf0d734"
+		logic_hash = "v1_sha256_986deffd48c1fb707948b00e1e200fa6538d4c73a32ab89f5119403f9bf0d734"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202507,20 +202545,20 @@ rule ARKBIRD_SOLG_APT_MAL_Donot_Loader_June_2020_1 : FILE
 		$s9 = "6*6=6P6b6" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 7 of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and 7 of them
 }
 rule ARKBIRD_SOLG_APT_Tardigrade_Nov_2021_1 : FILE
 {
 	meta:
 		description = "Detect Tardigrade loader"
 		author = "Arkbird_SOLG"
-		id = "f6c8014a-21dd-5ebd-9edd-7a9f649a43a0"
+		id = "4db7b343-d4fb-5322-a414-addd226d1a13"
 		date = "2021-11-22"
 		modified = "2021-11-23"
 		reference = "https://www.isac.bio/post/tardigrade"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-22/APT_Tardigrade_Nov_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "98358d9dbf62e653b136268d8694ed4d7f48c80125dd12ccea5f36ff5c6b4a3c"
+		logic_hash = "v1_sha256_98358d9dbf62e653b136268d8694ed4d7f48c80125dd12ccea5f36ff5c6b4a3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202537,20 +202575,20 @@ rule ARKBIRD_SOLG_APT_Tardigrade_Nov_2021_1 : FILE
 		$s4 = { 45 31 c0 48 8d 8c 24 ?? 02 00 00 4c 8d 8c 24 ?? 01 00 00 48 8d 15 [2] 01 00 ff 15 [2] 02 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize > 50KB and all of them
 }
 rule ARKBIRD_SOLG_RAN_Nemty_June_2021_1 : FILE
 {
 	meta:
 		description = "Detect Nemty ransomware"
 		author = "Arkbird_SOLG"
-		id = "1c7994b8-7479-5679-91a5-e3ca4b2e7fde"
+		id = "44fb8759-2b05-500f-852d-a6669500a05a"
 		date = "2021-06-12"
 		modified = "2021-06-13"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-12/Nemty/RAN_Nemty_June_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "25a9e82ae1e950e1c71d6dfa120efd1a2ba39cbf8e9c2cd4ba4e67ce7dabc45e"
+		logic_hash = "v1_sha256_25a9e82ae1e950e1c71d6dfa120efd1a2ba39cbf8e9c2cd4ba4e67ce7dabc45e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202567,20 +202605,20 @@ rule ARKBIRD_SOLG_RAN_Nemty_June_2021_1 : FILE
 		$s4 = { ff ff [0-1] 8d 05 [3] 00 [0-1] 89 04 24 [0-1] c7 44 24 ?? 02 00 00 00 e8 [2] ff ff e8 [2] ff ff [0-1] 8b 4c 24 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >500KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 500KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_APT28_Zekapab_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect Zekapab used by APT28 group"
 		author = "Arkbird_SOLG"
-		id = "634f32dd-8bcf-5c58-a335-9b66ff568a54"
+		id = "dd9fe522-fce9-5202-a0e8-da5eff659095"
 		date = "2021-03-15"
 		modified = "2021-03-15"
 		reference = "https://twitter.com/DrunkBinary/status/1371423755608719360"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-15/APT28/APT_APT28_Zekapab_Mar_2021_1.yar#L1-L25"
 		license_url = "N/A"
-		logic_hash = "dabaab47c193a05620d282a00b6b47f710cfa6b1efc699ea5d47267d10cfdcb6"
+		logic_hash = "v1_sha256_dabaab47c193a05620d282a00b6b47f710cfa6b1efc699ea5d47267d10cfdcb6"
 		score = 60
 		quality = 23
 		tags = "FILE"
@@ -202603,20 +202641,20 @@ rule ARKBIRD_SOLG_APT_APT28_Zekapab_Mar_2021_1 : FILE
 		$dbg6 = { 53 00 6f 00 63 00 6b 00 65 00 74 00 20 00 45 00 72 00 72 00 6f 00 72 00 20 00 23 00 20 00 25 00 64 00 0d 00 0a 00 25 00 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 1 of ($header*) and 3 of ($s*) and 4 of ($dbg*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 1 of ( $header* ) and 3 of ( $s* ) and 4 of ( $dbg* )
 }
 rule ARKBIRD_SOLG_RAN_Medusalocker_July_2021_1 : FILE
 {
 	meta:
 		description = "Detect MedusaLocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "7eec35ac-f1ec-596b-8224-ef27e31e841c"
+		id = "84c43564-b55d-52ac-ba06-1c883026a725"
 		date = "2021-07-25"
 		modified = "2021-08-08"
 		reference = "https://twitter.com/r3dbU7z/status/1418433910057353217"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-25/MedusaLocker/RAN_MedusaLocker_July_2021_1.yara#L1-L28"
 		license_url = "N/A"
-		logic_hash = "541665541c07b585a7dfa024f85516b7be94d7d8d76a85e58c8c3b71fd0550ff"
+		logic_hash = "v1_sha256_541665541c07b585a7dfa024f85516b7be94d7d8d76a85e58c8c3b71fd0550ff"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -202641,20 +202679,20 @@ rule ARKBIRD_SOLG_RAN_Medusalocker_July_2021_1 : FILE
 		$x1 = { 48 89 5c 24 08 57 48 83 ec 30 48 8b da 48 8b f9 e8 0b fe ff ff 44 8b 43 08 48 8d 47 28 44 2b 03 45 33 c9 48 8b 13 48 8b 4f 20 48 89 44 24 28 c7 44 24 20 00 00 00 00 ff 15 [2] 07 00 85 c0 74 12 c6 47 08 01 48 8b c7 48 8b 5c 24 40 48 83 c4 30 5f c3 ff 15 [2] 07 00 48 8b 5c 24 40 89 47 34 48 8b c7 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >150KB and 9 of ($s*) and $x1
+		uint16( 0 ) == 0x5A4D and filesize > 150KB and 9 of ( $s* ) and $x1
 }
 rule ARKBIRD_SOLG_APT_Chimera_Sept_2020_1 : FILE
 {
 	meta:
 		description = "Detect Cobalt Strike agent used by Chimera"
 		author = "Arkbird_SOLG"
-		id = "7a7c3952-fa6e-5643-a40f-d2e466b8c2a2"
+		id = "a518ec2f-3ff0-5549-99e2-3a5f62d3b008"
 		date = "2020-10-03"
 		modified = "2020-10-04"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-03/Chimera/APT_Chimera_Sept_2020_1.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "8fdb34c793534f8632fd2c35b89462d4a736a31f2347e7bab3e8bcebff04c21f"
+		logic_hash = "v1_sha256_8fdb34c793534f8632fd2c35b89462d4a736a31f2347e7bab3e8bcebff04c21f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202674,20 +202712,20 @@ rule ARKBIRD_SOLG_APT_Chimera_Sept_2020_1 : FILE
 		$export = "ReflectiveLoader" fullword ascii
 
 	condition:
-		uint16(0)==0x4a5d and filesize >30KB and $header and 1 of ($s*) and 2 of ($core*) and 2 of ($lib*) and $export
+		uint16( 0 ) == 0x4a5d and filesize > 30KB and $header and 1 of ( $s* ) and 2 of ( $core* ) and 2 of ( $lib* ) and $export
 }
 rule ARKBIRD_SOLG_APT_Turla_Ironpython_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detect IronPython script used by Turla group"
 		author = "Arkbird_SOLG"
-		id = "303929d4-2c43-5e43-aeb0-09f469f7091b"
+		id = "1bbc212e-ab0e-5d4b-b645-4fa056a48496"
 		date = "2021-04-30"
 		modified = "2021-05-01"
 		reference = "https://twitter.com/DrunkBinary/status/1388332507695919104"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-01/Turla/APT_Turla_IronPython_Apr_2021_1.yara#L1-L26"
 		license_url = "N/A"
-		logic_hash = "f6b626cddb4832f842a15eddce705fb24125e4341c425cf27dbbe537e2a98bdc"
+		logic_hash = "v1_sha256_f6b626cddb4832f842a15eddce705fb24125e4341c425cf27dbbe537e2a98bdc"
 		score = 75
 		quality = 57
 		tags = "FILE"
@@ -202711,20 +202749,20 @@ rule ARKBIRD_SOLG_APT_Turla_Ironpython_Apr_2021_1 : FILE
 		$s11 = { 2e 66 6f 72 6d 61 74 28 65 78 2e 4d 65 73 73 61 67 65 2c 65 78 2e 53 74 61 63 6b 54 72 61 63 65 29 29 }
 
 	condition:
-		filesize >100KB and 9 of ($s*)
+		filesize > 100KB and 9 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_ELF_Darkside_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detect the ELF version of Darkside ransomware"
 		author = "Arkbird_SOLG"
-		id = "10c0ba57-d6d6-5d1d-bd2a-f6f240d71f8b"
+		id = "7fd663ef-3a35-5776-a221-d3f7006acde5"
 		date = "2021-05-01"
 		modified = "2021-05-02"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1388301138437578757"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-01/Darkside/RAN_ELF_Darkside_Apr_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "510932893e1e81d6c88e86c7ae2345460b397c936336c7e1a33799dbc1dd6aab"
+		logic_hash = "v1_sha256_510932893e1e81d6c88e86c7ae2345460b397c936336c7e1a33799dbc1dd6aab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202745,20 +202783,20 @@ rule ARKBIRD_SOLG_RAN_ELF_Darkside_Apr_2021_1 : FILE
 		$seq8 = { 4c 8d a4 24 64 05 00 00 66 0f 1f 44 00 00 e8 23 de fd ff 48 8d 94 24 20 04 00 00 48 8d bc 24 a0 03 00 00 48 89 c6 e8 eb df fd ff 48 8b 9c 24 a8 03 00 00 be f7 e4 5b 00 48 8d 7b 08 e8 f5 e2 fd ff 48 8d 7b 70 4c 89 e6 e8 d9 0b fd ff 48 8d bc 24 a0 03 00 00 e8 dc d2 fd ff 48 83 bc 24 20 04 00 00 00 75 a9 48 8d 84 24 c0 03 00 00 be 6c e4 5b 00 48 89 c7 48 89 44 24 08 e8 77 8f ff ff 48 8b 5c 24 08 48 8d 94 24 60 04 00 00 48 8d bc 24 d0 00 00 00 48 89 de e8 7a c8 00 00 48 8b 84 24 c0 03 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 e1 06 fd ff 48 8d b4 24 23 05 00 00 48 8d bc 24 a0 00 00 00 48 89 da e8 29 0d fd ff 48 8d 94 24 a0 03 00 00 48 8d b4 24 60 04 00 00 48 8d bc 24 90 00 00 00 e8 0c 0d fd ff 48 8d bc 24 90 00 00 00 be 90 d6 5c 00 e8 ba 16 fd ff 48 8b 10 48 89 94 24 20 04 00 00 48 c7 00 78 24 8a 00 48 8b 94 24 20 04 00 00 48 8b 84 24 a0 00 00 00 48 8b 4a e8 48 89 ce 48 03 70 e8 48 3b 72 f0 76 0a 48 3b 70 f0 0f 86 b7 08 00 00 48 8d b4 24 a0 00 00 00 48 8d bc 24 20 04 00 00 e8 08 0c fd ff 48 8b 10 be 8d e4 5b 00 48 89 ef 48 89 94 24 40 04 00 00 48 c7 00 78 24 8a 00 e8 89 8e ff ff 48 8d 94 24 40 04 00 00 48 8d bc 24 d0 00 00 00 48 89 ee e8 11 e1 ff ff 48 8b 84 24 e0 03 00 00 48 8d b4 24 00 04 00 00 48 8d 78 e8 e8 f8 05 fd ff 48 8b 84 24 40 04 00 00 48 8d b4 24 00 04 00 00 48 8d 78 e8 e8 df 05 fd ff 48 8b 84 24 20 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 c6 05 fd ff 48 8b 84 24 90 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 ad 05 fd ff 48 8b 84 24 a0 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 94 05 fd ff 48 8d bc 24 00 04 00 00 be 4c e4 5b 00 e8 e2 8d ff ff 48 8d 94 24 e2 04 00 00 48 8d b4 24 00 04 00 00 48 8d bc 24 d0 00 00 00 e8 e5 c6 00 00 48 8b 84 24 00 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 4c 05 fd ff 48 8d bc 24 20 04 00 00 be 98 e4 5b 00 e8 9a 8d ff ff 48 8d 94 24 64 05 00 00 48 8d b4 24 20 04 00 00 48 8d bc 24 d0 00 00 00 e8 9d c6 00 00 48 8b 84 24 20 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >300KB and 7 of ($s*)
+		uint32( 0 ) == 0x464c457f and filesize > 300KB and 7 of ( $s* )
 }
 rule ARKBIRD_SOLG_Ran_Babuklockers_Jan_2021_1 : FILE
 {
 	meta:
 		description = "Detect the BabukLocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "a3bad41d-59fb-564f-a352-ca38af582c08"
+		id = "f8c6b874-cbdc-5a7b-8fbf-c5444927dd27"
 		date = "2020-01-03"
 		modified = "2021-01-03"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-02/BabukLocker/Ran_BabukLockers_Jan_2021_1.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "8939e408948dd7b17acdac5c6b5f50db24ec63f19937b8663a15f52b678d0065"
+		logic_hash = "v1_sha256_8939e408948dd7b17acdac5c6b5f50db24ec63f19937b8663a15f52b678d0065"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -202776,20 +202814,20 @@ rule ARKBIRD_SOLG_Ran_Babuklockers_Jan_2021_1 : FILE
 		$s5 = { 5c 00 5c 00 3f 00 5c 00 00 00 00 00 3a 00 00 00 98 2f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >15KB and 2 of ($seq*) and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 15KB and 2 of ( $seq* ) and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Molerats_Feb_2021_1 : FILE
 {
 	meta:
 		description = "Detect Molerats implants"
 		author = "Arkbird_SOLG"
-		id = "8ede3aa9-9788-52a5-91a7-bb160daad5ba"
+		id = "33ad6a4a-3292-5b76-ab77-e2590d2c8d04"
 		date = "2021-02-27"
 		modified = "2021-03-01"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-28/Molerats/APT_Molerats_Feb_2021_1.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "fbd98f088019434f736107dfe62a307e2c57d0288d68f3133a13de59bf318aea"
+		logic_hash = "v1_sha256_fbd98f088019434f736107dfe62a307e2c57d0288d68f3133a13de59bf318aea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202807,20 +202845,20 @@ rule ARKBIRD_SOLG_APT_Molerats_Feb_2021_1 : FILE
 		$s5 = { 43 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 6f 00 70 00 65 00 6e 00 20 00 63 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 3a 00 20 00 25 00 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >500KB and 2 of ($seq*) and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 500KB and 2 of ( $seq* ) and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_APT34_RDAT_July_2021_1 : FILE
 {
 	meta:
 		description = "Detect RDAT used by APT34"
 		author = "Arkbird_SOLG"
-		id = "136f8a9e-e680-5fab-8113-b4d33a47bc34"
+		id = "493dec6c-2b90-57a0-a4d4-e71798d220c0"
 		date = "2021-07-15"
 		modified = "2021-07-16"
 		reference = "https://twitter.com/ShadowChasing1/status/1415206437806960647"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-15/APT34/APT_APT34_RDAT_July_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "269788430ca8faff4b0ea5ec7c2a62f99f5f48ef3bc4ea3f7a27f1d735e64819"
+		logic_hash = "v1_sha256_269788430ca8faff4b0ea5ec7c2a62f99f5f48ef3bc4ea3f7a27f1d735e64819"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202839,20 +202877,20 @@ rule ARKBIRD_SOLG_APT_APT34_RDAT_July_2021_1 : FILE
 		$s6 = { 48 89 7d f0 48 89 7d f8 45 33 c0 33 d2 48 8d 4d e0 e8 43 a7 ff ff 41 b8 2c 00 00 00 48 8d 15 be bc 08 00 48 8d 4d e0 e8 ad a7 ff ff 48 89 7d 70 48 89 7d 78 45 33 c0 33 d2 48 8d 4d 60 e8 17 a7 ff ff 45 33 c0 48 8d 15 77 94 08 00 48 8d 4d 60 e8 84 a7 ff ff 83 7c 24 30 02 75 6e 48 8d 85 a8 00 00 00 48 89 85 a0 00 00 00 41 b8 03 00 00 00 49 8b 55 08 48 8d 8d a0 00 00 00 e8 c9 0a 00 00 48 8b 95 a0 00 00 00 48 8d 4d a0 e8 89 a5 ff ff 48 8d 85 a8 00 00 00 48 8b 8d a0 00 00 48 89 85 b0 10 00 00 48 8b da 48 8b f9 33 f6 89 74 24 78 c7 45 80 18 00 00 00 c7 45 90 01 00 00 00 48 89 75 88 45 33 c9 4c 8d 45 80 48 8d 54 24 68 48 8d 4c 24 60 ff 15 81 fe 06 00 45 33 c0 8d 56 01 48 8b 4c 24 60 ff 15 68 fe 06 00 45 33 c9 4c 8d 45 80 48 8d 54 24 70 48 8d 4c 24 58 ff 15 59 fe 06 00 45 33 c0 8d 56 01 48 8b 4c 24 58 ff 15 40 fe 06 00 33 c0 48 89 45 98 48 89 45 a0 48 89 45 a8 33 d2 44 8d 46 68 48 8d 4d c0 e8 ab 89 04 00 c7 45 c0 68 00 00 00 48 8b 44 24 68 48 89 45 20 48 8b 44 24 70 48 89 45 18 81 4d fc 00 01 00 00 48 8b d3 48 8d 4d 30 e8 bf fe ff ff 90 4c 8b c0 48 8d 8d 90 00 00 00 e8 9f 0d 00 00 90 45 33 c0 b2 01 48 8d 4d 30 e8 d0 7d ff ff 48 8d 95 90 00 00 00 48 83 bd a8 00 00 00 08 48 0f 43 95 90 00 00 00 48 8d 45 98 48 89 44 24 48 48 8d 45 c0 48 89 44 24 40 48 89 74 24 38 48 89 74 24 30 c7 44 24 28 00 00 00 08 c7 44 24 20 01 00 00 00 45 33 c9 45 33 c0 33 c9 ff 15 a7 fd 06 00 48 8b 4c 24 68 ff 15 94 fd 06 00 48 8b 4c 24 70 ff 15 89 fd 06 00 48 89 b5 80 00 00 00 48 89 b5 88 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 80KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_WIP_Meteorexpress_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect MeteorExpress/BreakWin wiper"
 		author = "Arkbird_SOLG"
-		id = "6dffc8c9-ccd0-5cf3-8f3c-38adad8508b2"
+		id = "7b6d2152-c175-514a-bfce-99cdaaefdcf7"
 		date = "2021-08-06"
 		modified = "2021-08-07"
 		reference = "https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-07/BreakWin/WIP_MeteorExpress_Aug_2021_1.yara#L1-L26"
 		license_url = "N/A"
-		logic_hash = "80e40479d699b988d1282e407edd51b5e3ea796ebf380d82f5a5aafaacafe75d"
+		logic_hash = "v1_sha256_80e40479d699b988d1282e407edd51b5e3ea796ebf380d82f5a5aafaacafe75d"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -202875,20 +202913,20 @@ rule ARKBIRD_SOLG_WIP_Meteorexpress_Aug_2021_1 : FILE
 		$s9 = { 8b 55 ?? 8d 4d ?? e8 ?? ?? fe ff c6 45 fc 08 ff 15 ?? ?? 47 00 8b d0 8d 4d ?? e8 ?? ?? fe ff c6 45 fc 09 8d 45 ?? 50 8d 45 ?? 50 8d 4d ?? e8 ?? ?? ?? ff 83 ec 0c 8b cc 89 65 ?? 51 ff 70 04 ff 30 e8 ?? ?? ?? ff c6 45 fc 0a 83 ec 18 8b cc 89 65 ?? 68 ?? ?? 48 00 e8 ?? ?? ?? ff c6 45 fc 0b c6 45 fc 09 8d }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and 4 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 25KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_2 : FILE
 {
 	meta:
 		description = "Detect EFSPotatoe tool (Generic rule)"
 		author = "Arkbird_SOLG"
-		id = "f40673da-7b16-5657-ba9a-f3f13034ad12"
+		id = "54a39454-2cdb-5a1c-9697-64cc64bf9644"
 		date = "2021-08-27"
 		modified = "2021-08-29"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/Tool_EFSPotatoe_Aug_2021_2.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "eedad68d3192908fea2109c7fa51a2e38e31ed666424307318ac2123b95d1cd3"
+		logic_hash = "v1_sha256_eedad68d3192908fea2109c7fa51a2e38e31ed666424307318ac2123b95d1cd3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202906,20 +202944,20 @@ rule ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_2 : FILE
 		$s5 = { 00 72 48 02 00 70 28 0e 00 00 0a 73 15 00 00 0a 6f 16 00 00 0a 28 0a 00 00 0a 28 06 00 00 0a 00 38 4a 02 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 10KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Loader_Lockfile_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect loader used by lockerfile group"
 		author = "Arkbird_SOLG"
-		id = "031335f3-e6c7-5e94-af23-c7fb254203b7"
+		id = "563abea6-ed1a-569d-b971-2a208c27fdf0"
 		date = "2021-08-28"
 		modified = "2021-08-29"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_loader_Lockfile_Aug_2021_1.yara#L1-L16"
 		license_url = "N/A"
-		logic_hash = "622a673d5cb9832cf0abc9942bf0e1f64bcdbd99524dea0bd64698fffa815a9b"
+		logic_hash = "v1_sha256_622a673d5cb9832cf0abc9942bf0e1f64bcdbd99524dea0bd64698fffa815a9b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202933,20 +202971,20 @@ rule ARKBIRD_SOLG_MAL_Loader_Lockfile_Aug_2021_1 : FILE
 		$s4 = { 33 c5 89 45 fc a1 [2] 00 10 8b 15 [2] 00 10 8b 0d [2] 00 10 56 89 45 dc 66 a1 [2] 00 10 57 89 55 e4 89 4d e0 8a 0d [2] 00 10 66 89 45 e8 33 c0 8d 55 dc 68 [2] 00 10 52 bf [2] 00 10 88 4d ea 89 45 eb 89 45 ef 89 45 f3 89 45 f7 88 45 fb e8 [2] 00 00 8b f0 83 c4 08 85 f6 74 44 8d 64 24 00 56 e8 [2] 00 00 83 c4 04 83 f8 ff 74 29 83 f8 28 75 ed 56 e8 [2] 00 00 83 c4 04 83 f8 ff 74 16 0f be 0f 3b c1 75 0f 56 47 e8 [2] 00 00 83 c4 04 83 f8 ff 75 ea 56 e8 [2] 00 00 83 c4 04 6a 00 ff 15 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 10KB and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect custom .NET variant EFSPotatoe tool"
 		author = "Arkbird_SOLG"
-		id = "614a6543-89ce-5f75-9933-766fd1e5458b"
+		id = "5f40b39e-145f-56f4-a861-325cd8f2340e"
 		date = "2021-08-27"
 		modified = "2021-08-29"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/Tool_EFSPotatoe_Aug_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "a9fed543aeaba380688ec59034b0e8c90fc0bea986085958966101bd44cf480f"
+		logic_hash = "v1_sha256_a9fed543aeaba380688ec59034b0e8c90fc0bea986085958966101bd44cf480f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -202963,20 +203001,20 @@ rule ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_1 : FILE
 		$s6 = "\\\\.\\pipe\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 10KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Kernel_Driver_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect kernel driver used by lockfile group"
 		author = "Arkbird_SOLG"
-		id = "80bf5286-6da6-5380-ad14-345d8122d3d4"
+		id = "689bc562-000f-5111-9e6b-e159890ff82e"
 		date = "2021-08-28"
 		modified = "2021-08-29"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_Kernel_Driver_Aug_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "225bd5995d3f1ed4c0bcb43c862662c9e5badd96a87d779d3bc6f1809d0ce3bb"
+		logic_hash = "v1_sha256_225bd5995d3f1ed4c0bcb43c862662c9e5badd96a87d779d3bc6f1809d0ce3bb"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -202995,20 +203033,20 @@ rule ARKBIRD_SOLG_MAL_Kernel_Driver_Aug_2021_1 : FILE
 		$s6 = { 48 8b 4e 20 41 b9 00 08 00 00 4d 8b c7 49 8b d5 41 ff 54 24 70 85 c0 75 09 48 8d 15 [2] 02 00 eb 49 48 8d 0d [2] 02 00 e8 b9 ef ff ff 48 8d 0d [2] 02 00 e8 ad ef ff ff 4c 8d 85 f0 02 00 00 ba 00 00 00 c0 48 8d 0d [2] 02 00 e8 [2] 00 00 ba d0 07 00 00 49 8b ce ff 15 [2] 01 00 85 c0 74 15 48 8d 15 [2] 02 00 b9 01 00 00 00 e8 [2] 00 00 33 db eb 0b 48 8b d7 48 8b ce e8 4b f3 ff ff 49 8b ce ff 15 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 10KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Lockfile_Packed_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect lockfile ransomware (Packed version)"
 		author = "Arkbird_SOLG"
-		id = "7c1631d0-5bec-5b44-b4b2-5ddf1dbd7222"
+		id = "2481b8a0-bb64-58da-8c37-87ec44dbe224"
 		date = "2021-08-28"
 		modified = "2021-08-29"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/RAN_Lockfile_Packed_Aug_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "a52b2715d505a657c3cd7cd31efb47c16a0ec943a4e1b742bd3ec5c6e46495c9"
+		logic_hash = "v1_sha256_a52b2715d505a657c3cd7cd31efb47c16a0ec943a4e1b742bd3ec5c6e46495c9"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -203024,20 +203062,20 @@ rule ARKBIRD_SOLG_RAN_Lockfile_Packed_Aug_2021_1 : FILE
 		$s4 = { c3 df [0-4] 10 4c c8 20 d3 55 56 57 41 54 41 55 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 10KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Killproc_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect KillProc driver used by Night Dragon for kill process before encryption"
 		author = "Arkbird_SOLG"
-		id = "b0d6a21d-f451-58c9-b640-ad57feec7c38"
+		id = "d20c107f-4b9b-5e56-a732-1f0ae79b467a"
 		date = "2021-08-27"
 		modified = "2021-08-29"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_KillProc_Aug_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "d24634e7719e3b6be3322b07c3e754e8c1275c73102c6d7f8d9abaae9887a0da"
+		logic_hash = "v1_sha256_d24634e7719e3b6be3322b07c3e754e8c1275c73102c6d7f8d9abaae9887a0da"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203056,20 +203094,20 @@ rule ARKBIRD_SOLG_MAL_Killproc_Aug_2021_1 : FILE
 		$s9 = "VipreNis.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >3KB and 6 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 3KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Lockfile_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect Lockfile ransomware (unpacked version)"
 		author = "Arkbird_SOLG"
-		id = "4abe2e70-5df9-5c5c-ac11-0c958d5430b7"
+		id = "99bc3c19-8185-5a81-b566-cf80f340ba47"
 		date = "2021-08-28"
 		modified = "2021-08-29"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/RAN_Lockfile_Aug_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "6fc04316b8b4790494a8c88c8435245a051b2757e5936a5ef95cae2f05907b63"
+		logic_hash = "v1_sha256_6fc04316b8b4790494a8c88c8435245a051b2757e5936a5ef95cae2f05907b63"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -203086,20 +203124,20 @@ rule ARKBIRD_SOLG_RAN_Lockfile_Aug_2021_1 : FILE
 		$s6 = { 33 d2 48 8d 8d c0 00 00 00 41 b8 04 01 00 00 e8 48 99 03 00 48 8d 95 10 03 00 00 c7 85 10 03 00 00 04 01 00 00 48 8d 4d b0 ff 15 c5 a5 05 00 4c 8d 45 b0 48 8d 15 2a df 06 00 48 8d 8d c0 00 00 00 e8 96 f4 ff ff 44 8d 46 02 48 8d 15 33 df 06 00 48 8d 4c 24 68 e8 81 f4 ff ff c6 85 18 03 00 00 2f 8b ce c6 85 19 03 00 00 69 c6 85 1a 03 00 00 75 c6 85 1b 03 00 00 62 40 88 b5 1c 03 00 00 0f b6 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 10KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Luna_Stealer_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detect Luna stealer (also Mercurial Grabber)"
 		author = "Arkbird_SOLG"
-		id = "2fecce99-5869-5de0-afae-6dc245748fa6"
+		id = "daa74f29-58df-5ef9-b9cc-5da518ba7d7b"
 		date = "2021-08-29"
 		modified = "2021-08-30"
 		reference = "https://github.com/NightfallGT/Mercurial-Grabber"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Luna/MAL_Luna_Stealer_Apr_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "934ded815c262fa8bee38638e17ed8c2b1f0dcad28037bf1d525e11bf7e34dce"
+		logic_hash = "v1_sha256_934ded815c262fa8bee38638e17ed8c2b1f0dcad28037bf1d525e11bf7e34dce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203119,20 +203157,20 @@ rule ARKBIRD_SOLG_MAL_Luna_Stealer_Apr_2021_1 : FILE
 		$x3 = { 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 32 00 34 00 7d 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 36 00 7d 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 32 00 37 00 7d 00 01 1d 6d 00 66 00 61 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 38 00 34 00 7d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 2 of ($x*) and 2 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 20KB and 2 of ( $x* ) and 2 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_APT34_RDAT_Feb_2021_1 : FILE
 {
 	meta:
 		description = "Detect Installer from APT34 group"
 		author = "Arkbird_SOLG"
-		id = "32f28376-e792-543b-82f7-36ec627b4fab"
+		id = "246b917b-66fd-5e52-9dd8-c04bd398dbf8"
 		date = "2021-02-26"
 		modified = "2021-02-27"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-26/APT34/APT_APT34_RDAT_Feb_2021_1.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "61ea6eceda0c7d6ec15db87891c4322002c112383c7a4d0089e35db9636bbe73"
+		logic_hash = "v1_sha256_61ea6eceda0c7d6ec15db87891c4322002c112383c7a4d0089e35db9636bbe73"
 		score = 50
 		quality = 73
 		tags = "FILE"
@@ -203149,20 +203187,20 @@ rule ARKBIRD_SOLG_APT_APT34_RDAT_Feb_2021_1 : FILE
 		$seq_RegisterEvent = { 40 53 48 83 ec 20 48 83 3d 5a 79 0a 00 08 48 8d 1d 3b 79 0a 00 48 8b cb 48 8d 15 91 01 00 00 48 0f 43 0d 29 79 0a 00 ff 15 93 1d 07 00 48 89 05 44 77 0a 00 48 8b c8 48 85 c0 75 2d 48 83 3d 24 79 0a 00 08 48 0f 43 1d 04 79 0a 00 48 8b d3 ff 15 7b 1d 07 00 48 85 c0 74 62 48 8b c8 ff 15 35 1d 07 00 48 83 c4 20 5b c3 33 c0 c7 05 db 76 0a 00 10 00 00 00 48 89 05 e0 76 0a 00 48 8d 15 cd 76 0a 00 8b 05 17 1c 0a 00 89 05 d5 76 0a 00 ff c0 89 05 09 1c 0a 00 48 c7 05 b2 76 0a 00 02 00 00 00 c7 05 bc 76 0a 00 b8 0b 00 00 ff 15 06 1d 07 00 48 83 c4 20 5b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and all of ($s*) and 2 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 80KB and all of ( $s* ) and 2 of ( $seq* )
 }
 rule ARKBIRD_SOLG_RAN_Biglock_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect BigLock ransomware"
 		author = "Arkbird_SOLG"
-		id = "6a3fbb70-034d-5932-8c7f-de8d1b3df25c"
+		id = "73e4687e-f675-527c-bd39-36b6e73f19f6"
 		date = "2021-06-05"
 		modified = "2021-06-05"
 		reference = "https://twitter.com/fbgwls245/status/1400971422336311297"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-05/BigLock/RAN_BigLock_Jun_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "f8407f39c4acef3546f8ddc22a04fb0534c5e1fa08d552654d9b9ebdf48fed94"
+		logic_hash = "v1_sha256_f8407f39c4acef3546f8ddc22a04fb0534c5e1fa08d552654d9b9ebdf48fed94"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -203178,20 +203216,20 @@ rule ARKBIRD_SOLG_RAN_Biglock_Jun_2021_1 : FILE
 		$s4 = { 48 8b c3 48 8b 4d b7 48 2b c1 48 83 f8 15 0f 82 7b 04 00 00 4c 8d 4d a7 48 83 7d bf 08 4c 0f 43 4d a7 48 c7 44 24 30 15 00 00 00 48 8d 05 69 c2 04 00 48 89 44 24 28 48 89 4c 24 20 48 8d 4d 07 e8 86 17 00 00 90 45 33 c0 48 8d 55 07 e8 89 05 00 00 90 4c 8b 45 1f 49 83 f8 08 72 0c 49 ff c0 48 8b 55 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_Mal_Boxcaon_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect the BoxCaon malware"
 		author = "Arkbird_SOLG"
-		id = "5f456b73-02f9-5dd7-973e-bde20dcddd27"
+		id = "4151cd87-4aef-5675-9c7f-9e9bbc7d6434"
 		date = "2021-07-01"
 		modified = "2021-07-02"
 		reference = "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-02/IndigoZebra/Mal_BoxCaon_Jul_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "c7dfce8d7a451817a80897d5cb02cec5aba52f86ece0286353865b7d391e2ffc"
+		logic_hash = "v1_sha256_c7dfce8d7a451817a80897d5cb02cec5aba52f86ece0286353865b7d391e2ffc"
 		score = 75
 		quality = 46
 		tags = "FILE"
@@ -203211,20 +203249,20 @@ rule ARKBIRD_SOLG_Mal_Boxcaon_Jul_2021_1 : FILE
 		$s8 = { 25 73 2f [1-4] 2d 25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 2e 74 78 74 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 6 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_Mal_Xcaon_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect the xCaon malware"
 		author = "Arkbird_SOLG"
-		id = "bcd5a52d-9547-5709-95f4-9d1f956f623c"
+		id = "d4b58a27-ec71-5b20-bdcf-16753545884e"
 		date = "2021-07-01"
 		modified = "2021-07-02"
 		reference = "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-02/IndigoZebra/Mal_xCaon_Jul_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "9c3e3d0035596323a505404ecc067bd2b87a4b0ac7499f1c87aac015f59eb65a"
+		logic_hash = "v1_sha256_9c3e3d0035596323a505404ecc067bd2b87a4b0ac7499f1c87aac015f59eb65a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203243,20 +203281,20 @@ rule ARKBIRD_SOLG_Mal_Xcaon_Jul_2021_1 : FILE
 		$s6 = { 8b 45 08 [5] ff [5] 6a 07 89 85 10 ff ff ff ?? 33 ?? 33 c0 89 ?? 14 89 ?? 10 89 ?? 18 ff ff ff 66 89 ?? 8d ?? 1c 89 ?? fc 89 ?? 14 89 ?? 10 66 89 ?? 8d ?? 38 89 ?? 14 89 ?? 10 89 ?? 0c ff ff ff 66 89 ?? 89 ?? 6c 89 ?? 68 66 89 ?? 58 89 ?? 88 00 00 00 89 ?? 84 00 00 00 66 89 ?? 74 89 ?? b8 00 00 00 89 ?? b4 00 00 00 66 89 ?? a4 00 00 00 6a 68 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Turla_Bigboss_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detects new BigBoss implants (SilentMoon/GoldenSky)"
 		author = "Arkbird_SOLG"
-		id = "6f6c8d1e-f2c7-5f08-b1dc-ce726c6d89be"
+		id = "b815d9fc-2b0d-5fb2-9d1e-326aa6ee5a03"
 		date = "2021-04-06"
 		modified = "2021-07-17"
 		reference = "https://twitter.com/DrunkBinary/status/1304086230540390400"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-17/BigBoss/APT_Turla_BigBoss_Apr_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "ce0ffdad9eecb79128b6c08c87914f356c86ac631655c76905a06d953add3998"
+		logic_hash = "v1_sha256_ce0ffdad9eecb79128b6c08c87914f356c86ac631655c76905a06d953add3998"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -203275,20 +203313,20 @@ rule ARKBIRD_SOLG_APT_Turla_Bigboss_Apr_2021_1 : FILE
 		$s8 = { 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 6c 00 61 00 6e 00 6d 00 61 00 6e 00 73 00 65 00 72 00 76 00 65 00 72 00 5c 00 70 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 73 00 00 00 4e 00 75 00 6c 00 6c 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 50 00 69 00 70 00 65 00 73 00 00 00 00 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 4c 00 53 00 41 00 00 00 00 00 52 00 65 00 73 00 74 00 72 00 69 00 63 00 74 00 41 00 6e 00 6f 00 6e 00 79 00 6d 00 6f 00 75 00 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 7 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 20KB and 7 of ( $s* )
 }
 rule ARKBIRD_SOLG_Ran_Conti_Loader_V3_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect Conti V3 loader"
 		author = "Arkbird_SOLG"
-		id = "9541b9f8-befe-5bf4-88ee-b1cc5e92f927"
+		id = "0d84d0bd-0c90-5c3e-86e1-cfd91099d6db"
 		date = "2020-12-15"
 		modified = "2020-12-15"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-15/Conti/Ran_Conti_V3_Nov_2020_1.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "c3c8530e1963c5af8ee93a5d2cc222abbeb3fb7e82ef6de2068795a38dca67aa"
+		logic_hash = "v1_sha256_c3c8530e1963c5af8ee93a5d2cc222abbeb3fb7e82ef6de2068795a38dca67aa"
 		score = 50
 		quality = 71
 		tags = "FILE"
@@ -203305,20 +203343,20 @@ rule ARKBIRD_SOLG_Ran_Conti_Loader_V3_Nov_2020_1 : FILE
 		$s4 = { 8b 2d bc 36 40 00 0f b6 04 2f 0f b6 da 8b 54 24 14 0f b6 14 13 8d 0c 2f 03 d6 03 c2 99 be 40 03 00 00 f7 fe 0f b6 f2 8d 04 2e e8 7f ff ff ff 8d 43 01 99 f7 7c 24 18 47 81 ff 40 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and all of ($seq*) and 2 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and all of ( $seq* ) and 2 of ( $s* )
 }
 rule ARKBIRD_SOLG_Ran_Conti_V3_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect Conti V3 ransomware"
 		author = "Arkbird_SOLG"
-		id = "89702af3-664a-5c4a-8d2b-f195f5dddb6f"
+		id = "824971c4-69ed-5e0c-ad98-49255a9b4e81"
 		date = "2020-12-15"
 		modified = "2020-12-15"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-15/Conti/Ran_Conti_V3_Nov_2020_1.yar#L24-L43"
 		license_url = "N/A"
-		logic_hash = "2c8f2fd9b155bb4fdb1304b4d7f683bc679780d079d8bbe4fb308f94769f1392"
+		logic_hash = "v1_sha256_2c8f2fd9b155bb4fdb1304b4d7f683bc679780d079d8bbe4fb308f94769f1392"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -203333,20 +203371,20 @@ rule ARKBIRD_SOLG_Ran_Conti_V3_Nov_2020_1 : FILE
 		$seq4 = { c6 85 00 ff ff ff 00 c6 85 01 ff ff ff 4b c6 85 02 ff ff ff 1f c6 85 03 ff ff ff 35 c6 85 04 ff ff ff 1f c6 85 05 ff ff ff 23 c6 85 06 ff ff ff 1f c6 85 07 ff ff ff 68 c6 85 08 ff ff ff 1f c6 85 09 ff ff ff 38 c6 85 0a ff ff ff 1f c6 85 0b ff ff ff 10 c6 85 0c ff ff ff 1f c6 85 0d ff ff ff 66 c6 85 0e ff ff ff 1f c6 85 0f ff ff ff 2a c6 85 10 ff ff ff 1f c6 85 11 ff ff ff 43 c6 85 12 ff ff ff 1f c6 85 13 ff ff ff 23 c6 85 14 ff ff ff 1f c6 85 15 ff ff ff 10 c6 85 16 ff ff ff 1f c6 85 17 ff ff ff 07 c6 85 18 ff ff ff 1f c6 85 19 ff ff ff 51 c6 85 1a ff ff ff 1f c6 85 1b ff ff ff 1c c6 85 1c ff ff ff 1f c6 85 1d ff ff ff 43 c6 85 1e ff ff ff 1f c6 85 1f ff ff ff 10 c6 85 20 ff ff ff 1f c6 85 21 ff ff ff 61 c6 85 22 ff ff ff 1f c6 85 23 ff ff ff 74 c6 85 24 ff ff ff 1f c6 85 25 ff ff ff 41 c6 85 26 ff ff ff 1f c6 85 27 ff ff ff 10 c6 85 28 ff ff ff 1f c6 85 29 ff ff ff 59 c6 85 2a ff ff ff 1f c6 85 2b ff ff ff 43 c6 85 2c ff ff ff 1f c6 85 2d ff ff ff 38 c6 85 2e ff ff ff 1f c6 85 2f ff ff ff 2b c6 85 30 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and all of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 80KB and all of ( $seq* )
 }
 rule ARKBIRD_SOLG_MAL_Mysterysnail_RAT_Oct_2021_1 : FILE
 {
 	meta:
 		description = "Detect MysterySnaial RAT implant"
 		author = "Arkbird_SOLG"
-		id = "2fa5015a-144f-52f6-8a5f-28fce10861e3"
+		id = "a277f1df-82bd-532c-a00f-206a811fe44d"
 		date = "2021-10-13"
 		modified = "2021-10-14"
 		reference = "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-14/MAL_MysterySnail_RAT_Oct_2021_1.yara#L1-L25"
 		license_url = "N/A"
-		logic_hash = "bcf072fae02b479084b8d47b4cd676216f72aecfa4ebcf8226b6997839929b57"
+		logic_hash = "v1_sha256_bcf072fae02b479084b8d47b4cd676216f72aecfa4ebcf8226b6997839929b57"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -203365,20 +203403,20 @@ rule ARKBIRD_SOLG_MAL_Mysterysnail_RAT_Oct_2021_1 : FILE
 		$s5 = { 48 8d 4c 24 60 ff 97 18 04 00 00 33 f6 c7 45 90 01 00 00 00 0f 57 c0 48 89 74 24 68 33 c9 66 0f 7f 44 24 70 48 89 75 80 48 89 75 88 c7 45 94 01 00 00 00 48 c7 45 9c 01 00 00 00 48 89 75 a8 e8 32 97 6f 00 8d 4e 01 48 89 45 b0 e8 26 97 6f 00 8d 4e 02 48 89 45 b8 e8 1a 97 6f 00 48 89 45 c0 45 33 c9 48 8d 45 d0 45 33 c0 48 89 44 24 48 48 8b d3 48 8d 44 24 60 33 c9 48 89 44 24 40 48 89 74 24 38 48 89 74 24 30 89 74 24 28 c7 44 24 20 01 00 00 00 ff 97 90 03 00 00 85 c0 74 0a 48 8b 4d d8 ff 15 da 8f 71 00 48 8b 4d d0 ff 15 d0 8f 71 00 b9 10 27 00 00 ff 15 b5 8f 71 00 0f 10 05 96 9c 79 00 48 8d 4d 08 33 d2 f2 0f 10 0d 98 9c 79 00 41 b8 b8 07 00 00 0f 29 45 f0 f2 0f 11 4d 00 e8 84 7d 6f 00 4c 8d 05 65 9c 79 00 48 8d 55 f0 48 8d 4c 24 58 e8 c3 98 6f 00 85 c0 0f 85 af 00 00 00 48 8b 4c 24 58 44 8d 40 02 33 d2 e8 db aa 6f 00 48 8b 4c 24 58 e8 71 94 6f 00 48 8b 4c 24 58 45 33 c0 33 d2 48 63 d8 e8 bf aa 6f 00 8d 4b 01 48 63 c9 e8 d4 67 6f 00 4c 8b 4c 24 58 4c 8b c3 ba 01 00 00 00 48 8b c8 48 8b f0 e8 58 f5 6f 00 48 8b 4c 24 58 48 8b d8 e8 47 99 6f 00 b9 64 00 00 00 ff 15 08 8f 71 00 48 83 bf f0 03 00 00 00 75 11 b9 42 6e aa cf e8 8c e7 ff ff 48 89 87 f0 03 00 00 48 8d 4d f0 ff 97 f0 03 00 00 44 8b cb 89 5c 24 50 4c 8b c6 48 8d 54 24 50 49 8b ce e8 44 d7 5c 00 48 8b ce 85 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >500KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 500KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_A_1 : FILE
 {
 	meta:
 		description = "Detect Kinsing Variant A"
 		author = "Arkbird_SOLG"
-		id = "470fd4a6-faba-52b5-8ffa-5ac33fb607a0"
+		id = "20f2f726-2532-5b88-bcec-cc6c122f7ef0"
 		date = "2020-08-28"
 		modified = "2020-08-29"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1299222198574632961"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-28/Loader_JAVA_Kinsing_Aug_2020_1.yar#L2-L30"
 		license_url = "N/A"
-		logic_hash = "a9654b67ca6fb5de23d385707f01196d6d1c85e527d2bdbe312a2b2fcf998dc0"
+		logic_hash = "v1_sha256_a9654b67ca6fb5de23d385707f01196d6d1c85e527d2bdbe312a2b2fcf998dc0"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -203404,20 +203442,20 @@ rule ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_A_1 : FILE
 		$s5 = { 6f 70 65 6e 43 6f 6e 6e 65 63 74 69 6f 6e }
 
 	condition:
-		filesize <1KB and 4 of ($ClassCode*) and 3 of ($Com*) and 3 of ($s*)
+		filesize < 1KB and 4 of ( $ClassCode* ) and 3 of ( $Com* ) and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_B_1 : FILE
 {
 	meta:
 		description = "Detect Kinsing Variant B"
 		author = "Arkbird_SOLG"
-		id = "7e0f9826-806c-5801-aab5-d2a8dba4e206"
+		id = "b85d8922-7dea-5b90-93f3-379b27d6bfeb"
 		date = "2020-08-28"
 		modified = "2020-08-29"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1299222198574632961"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-28/Loader_JAVA_Kinsing_Aug_2020_1.yar#L32-L52"
 		license_url = "N/A"
-		logic_hash = "5862d02b4e57024aa1c00b0a10ac9ee1a733890cf7d5b9ec7586f0506af113fc"
+		logic_hash = "v1_sha256_5862d02b4e57024aa1c00b0a10ac9ee1a733890cf7d5b9ec7586f0506af113fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203435,20 +203473,20 @@ rule ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_B_1 : FILE
 		$s2 = "getAbsolutePath" fullword ascii
 
 	condition:
-		filesize <1KB and 3 of ($ClassCode*) and 1 of ($Com*) and 2 of ($s*)
+		filesize < 1KB and 3 of ( $ClassCode* ) and 1 of ( $Com* ) and 2 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Keylogger_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect a keylogger used by IAmTheKing group"
 		author = "Arkbird_SOLG"
-		id = "186dc5f5-5cc2-551a-a34c-e775085e7f89"
+		id = "8f54eabb-fa6a-5d59-ab25-7b0dad98a3bb"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_Keylogger_Jul_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "dfdf5892564b93cd1bf564cfe62e37d9477b5ae0bf20e0f9a44ee97b7e3a99f8"
+		logic_hash = "v1_sha256_dfdf5892564b93cd1bf564cfe62e37d9477b5ae0bf20e0f9a44ee97b7e3a99f8"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -203466,20 +203504,20 @@ rule ARKBIRD_SOLG_MAL_Keylogger_Jul_2021_1 : FILE
 		$s6 = { 6a 00 56 ff 75 f8 8d 45 e4 50 ff 75 f0 ff 75 f4 ff 75 08 ff 15 c4 80 40 00 8b f0 3b f7 74 12 56 ff 15 70 80 40 00 85 c0 75 1b 56 ff 15 78 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >25KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 25KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect PowerPool malware"
 		author = "Arkbird_SOLG"
-		id = "8248300e-fc3e-56df-be4a-f1850e2bedc8"
+		id = "86330886-769b-5313-a20e-88c39ee9d2d5"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_PowerPool_Jul_2021_1.yara#L1-L29"
 		license_url = "N/A"
-		logic_hash = "0978a6cd60533ffda0c2b13ea98dc1ba46a464890b895cb2704804a763756fca"
+		logic_hash = "v1_sha256_0978a6cd60533ffda0c2b13ea98dc1ba46a464890b895cb2704804a763756fca"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -203501,20 +203539,20 @@ rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_1 : FILE
 		$s8 = { 25 73 3b 74 79 70 65 3d 25 73 3b 6c 65 6e 67 74 68 3d 25 73 3b 72 65 61 6c 64 61 74 61 3d 25 73 65 6e 64 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 6 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_2 : FILE
 {
 	meta:
 		description = "Detect PowerPool malware (ALPC exploit variant)"
 		author = "Arkbird_SOLG"
-		id = "2988e9a8-da43-51fb-bd39-44aa1d161120"
+		id = "50436ffb-a6cb-581f-913f-6dac8091ca60"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_PowerPool_Jul_2021_2.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "07d7a6444ddccbf4887de18659147354c9961092bb07ee0148392035a6d27086"
+		logic_hash = "v1_sha256_07d7a6444ddccbf4887de18659147354c9961092bb07ee0148392035a6d27086"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203533,20 +203571,20 @@ rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_2 : FILE
 		$s6 = { 83 c4 04 53 56 68 [2] 42 00 ba c8 ?? 43 00 e8 ?? a9 ff ff 83 c4 0c 56 68 [2] 42 00 ba c8 ?? 43 00 e8 ?? a9 ff ff 83 c4 08 83 7c 24 20 00 68 40 01 00 00 74 61 33 ed 55 68 88 ?? 43 00 e8 ?? a4 00 00 b8 50 ?? 42 00 83 c4 0c 8b d0 66 8b 08 83 c0 02 66 3b cd 75 f5 bf 88 ?? 43 00 2b c2 83 c7 fe 8d 64 24 00 66 8b 4f 02 83 c7 02 66 3b cd 75 f4 8b c8 c1 e9 02 8b f2 f3 a5 8b c8 83 e1 03 68 90 ?? 42 00 f3 a4 e8 [2] 00 00 83 c4 04 33 f6 89 74 24 20 eb 66 6a 00 68 88 ?? 43 00 e8 ?? a4 00 00 b8 f0 ?? 42 00 83 c4 0c 8b d0 66 8b 08 83 c0 02 66 85 c9 75 f5 bf 88 ?? 43 00 2b c2 83 c7 fe 8d 64 24 00 66 8b 4f 02 83 c7 02 66 85 c9 75 f4 8b c8 c1 e9 02 8b f2 f3 a5 8b c8 83 e1 03 68 98 ?? 42 00 f3 a4 e8 ?? 95 00 00 c7 44 24 24 01 00 00 00 8b 74 24 24 83 c4 04 33 ed 68 d0 07 00 00 a3 d4 ?? 42 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Queenofclubs_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect QueenOfClubs malware"
 		author = "Arkbird_SOLG"
-		id = "d78df760-5753-528c-b03d-7bb91ec658c0"
+		id = "d0265438-fa70-5359-90a3-e47c1a44f36a"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_QueenOfClubs_Jul_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "c6fe9dd24098ef3c281d9e6727613499988c88b9d2011af77390e0ce358bebf4"
+		logic_hash = "v1_sha256_c6fe9dd24098ef3c281d9e6727613499988c88b9d2011af77390e0ce358bebf4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203564,20 +203602,20 @@ rule ARKBIRD_SOLG_MAL_Queenofclubs_Jul_2021_1 : FILE
 		$s7 = { 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 00 00 25 00 73 00 00 00 00 00 25 00 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >35KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 35KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_Tool_Screencapture_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect Screen Capture utility"
 		author = "Arkbird_SOLG"
-		id = "09e4295e-454a-519a-964e-c5295e603aef"
+		id = "19603735-8e63-54e0-a8cd-3ec9e4255a3f"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/Tool_ScreenCapture_Jul_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "dff6c722ec001f5e3b5c53b41f8d457ab69ae46316f5dc7bbf1d00eb3d1ed3c8"
+		logic_hash = "v1_sha256_dff6c722ec001f5e3b5c53b41f8d457ab69ae46316f5dc7bbf1d00eb3d1ed3c8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -203593,20 +203631,20 @@ rule ARKBIRD_SOLG_Tool_Screencapture_Jul_2021_1 : FILE
 		$s5 = { 8b 57 04 89 4d e8 8d 4d e8 51 52 e8 16 0c 00 00 85 c0 74 03 89 47 08 8b 75 e8 81 fe 00 04 00 00 77 18 56 e8 ac f9 ff ff 83 c4 04 84 c0 74 0b 8b c6 e8 9e 15 00 00 8b f4 eb 35 83 c8 ff 2b c6 83 f8 08 72 15 8d 46 08 50 ff 15 f4 30 40 00 83 c4 04 85 }
 
 	condition:
-		uint16(0)==0x5a4d and ( filesize >8KB and filesize <60KB) and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and ( filesize > 8KB and filesize < 60KB ) and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Queenofhearts_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect QueenOfHearts malware"
 		author = "Arkbird_SOLG"
-		id = "763b35dd-6515-5ae8-a539-200a3647f074"
+		id = "15609526-4e0c-5444-bdbc-99f46f93e273"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "https://twitter.com/ShadowChasing1/status/1413111641504292864"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_QueenOfHearts_Jul_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "51cb8efddbc635e9a54f58a799e6edcf8eda8ca451ebe85cbce5f6cd20bfb083"
+		logic_hash = "v1_sha256_51cb8efddbc635e9a54f58a799e6edcf8eda8ca451ebe85cbce5f6cd20bfb083"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203627,20 +203665,20 @@ rule ARKBIRD_SOLG_MAL_Queenofhearts_Jul_2021_1 : FILE
 		$s8 = { 25 00 73 00 5f 00 25 00 63 00 25 00 63 00 25 00 63 00 25 00 63 00 5f 00 25 00 64 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Jackofhearts_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect JackOfHearts malware"
 		author = "Arkbird_SOLG"
-		id = "42d5eadb-dd94-5a15-8a0d-d1e56b58ce2e"
+		id = "70954910-5c46-59bd-916c-b2d6b0380145"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "hhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_JackOfHearts_Jul_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "6cad69beb7c104ef19beb26ca42b923283a0303c230e30b48dde58f88af4cd42"
+		logic_hash = "v1_sha256_6cad69beb7c104ef19beb26ca42b923283a0303c230e30b48dde58f88af4cd42"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -203661,20 +203699,20 @@ rule ARKBIRD_SOLG_MAL_Jackofhearts_Jul_2021_1 : FILE
 		$s10 = "%s.tmp" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 7 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 20KB and 7 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Kingofhearts_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect KingOfHearts malware"
 		author = "Arkbird_SOLG"
-		id = "b1efb4db-3864-5fdc-a3a0-992734eaf22f"
+		id = "f9498164-2675-57e0-a1a4-1bd532768643"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "https://twitter.com/ShadowChasing1/status/1413111641504292864"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_KingOfHearts_Jul_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "6761958760997030693c832c75098890b0d6d34fd6fe9c60d68d611497d57419"
+		logic_hash = "v1_sha256_6761958760997030693c832c75098890b0d6d34fd6fe9c60d68d611497d57419"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -203693,20 +203731,20 @@ rule ARKBIRD_SOLG_MAL_Kingofhearts_Jul_2021_1 : FILE
 		$s6 = { 66 00 69 00 6c 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 20 00 22 00 25 00 73 00 22 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >35KB and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 35KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Slothfulmedia_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect SlothfulMedia malware"
 		author = "Arkbird_SOLG"
-		id = "f4e1eca6-ecc9-5911-b69e-c8c4de43f1a1"
+		id = "5f121817-b2bb-5700-9d38-341b93a76630"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "hhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_SlothfulMedia_Jul_2021_1.yara#L1-L26"
 		license_url = "N/A"
-		logic_hash = "929364cbb9854336641590d53ee9c4548f02845e26252d359b155e4c2b1032ca"
+		logic_hash = "v1_sha256_929364cbb9854336641590d53ee9c4548f02845e26252d359b155e4c2b1032ca"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -203730,20 +203768,20 @@ rule ARKBIRD_SOLG_MAL_Slothfulmedia_Jul_2021_1 : FILE
 		$s11 = "ExtServiceDelete" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 8 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 20KB and 8 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Stashlog_Sep_2021_1 : FILE
 {
 	meta:
 		description = "Detect Stashlog malware"
 		author = "Arkbird_SOLG"
-		id = "a6ae59df-c45a-5a31-8530-4fd7f0f33f93"
+		id = "724ee252-0fa8-5eaf-ba68-d07968629a82"
 		date = "2021-09-01"
 		modified = "2021-09-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-05/MAL_Stashlog_Sep_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "6bde398a0f13674e72fcbd9809d22773bc1fe699f7c187775740d50910b07d5b"
+		logic_hash = "v1_sha256_6bde398a0f13674e72fcbd9809d22773bc1fe699f7c187775740d50910b07d5b"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -203761,20 +203799,20 @@ rule ARKBIRD_SOLG_MAL_Stashlog_Sep_2021_1 : FILE
 		$s5 = { 31 c0 ff 75 0c ff 75 08 50 50 68 b0 74 43 00 53 ff 15 10 b0 42 00 31 c0 ff 75 0c ff 75 08 50 50 68 b0 74 43 00 53 ff 15 10 b0 42 00 89 c6 ff 25 70 b7 43 00 ff 37 ff 15 0c b0 42 00 8b 4d f0 31 e9 e8 a9 f6 00 00 89 f0 8d 65 f4 5e 5f 5b 5d c3 57 68 19 01 02 00 6a 00 68 70 74 43 00 68 02 00 00 80 ff 15 14 b0 42 00 57 68 19 01 02 00 6a 00 68 70 74 43 00 68 02 00 00 80 ff 15 14 b0 42 00 ff 25 48 b7 43 00 55 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >20KB and 4 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 20KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_PRIVATELOG_Sep_2021_1 : FILE
 {
 	meta:
 		description = "Detect PRIVATELOG malware"
 		author = "Arkbird_SOLG"
-		id = "fa122d77-0bac-5836-85fd-b096660f7412"
+		id = "ac45248d-185e-5d7c-8c1e-8eb7590ff49e"
 		date = "2021-09-01"
 		modified = "2021-09-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-05/MAL_PRIVATELOG_Sep_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "4df78bc3005c67d467a0999751bf4fb42ff9075f1601d51ab3b2b88e5dc38f6e"
+		logic_hash = "v1_sha256_4df78bc3005c67d467a0999751bf4fb42ff9075f1601d51ab3b2b88e5dc38f6e"
 		score = 50
 		quality = 50
 		tags = "FILE"
@@ -203793,20 +203831,20 @@ rule ARKBIRD_SOLG_MAL_PRIVATELOG_Sep_2021_1 : FILE
 		$s6 = "uGlobal\\HVID_" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize >20KB and 4 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 20KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Kimsuky_Aug_2020_1 : FILE
 {
 	meta:
 		description = "Detect Gold Dragon used by Kimsuky APT group"
 		author = "Arkbird_SOLG"
-		id = "dd79aa3b-0bbc-5fdd-808e-c2dee6d89804"
+		id = "01ab6811-b4db-58f3-ab84-33f4e441b5ab"
 		date = "2020-08-31"
 		modified = "2020-09-14"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-09-14/Kimsuky/APT_Kimsuky_Aug_2020_1.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "4644ea81535c867a36a882bb270cea784ae135e7acc7078823be0579b1746932"
+		logic_hash = "v1_sha256_4644ea81535c867a36a882bb270cea784ae135e7acc7078823be0579b1746932"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203827,22 +203865,20 @@ rule ARKBIRD_SOLG_APT_Kimsuky_Aug_2020_1 : FILE
 		$s11 = "Mozilla/5.0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >150KB and 8 of them
+		uint16( 0 ) == 0x5a4d and filesize > 150KB and 8 of them
 }
-import "pe"
-
 rule ARKBIRD_SOLG_Backdoor_APT_Nazar_April_2020_1 : FILE
 {
 	meta:
 		description = "Detect strings used by APT Nazar"
 		author = "Arkbird_SOLG"
-		id = "727a1f4e-1371-5a95-bce9-4a4f701a2ac6"
+		id = "9a1fe3ec-6097-5d2d-949e-68a80f3d716c"
 		date = "2020-04-29"
 		modified = "2023-11-22"
 		reference = "Internal research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-04-29/Yara_Rule_APT_Bazar-April_2020_1.yar#L3-L29"
 		license_url = "N/A"
-		logic_hash = "79028588ac6afd3e3d0d839d10eada9e5382991eebb600b0dae2119bcd7eac93"
+		logic_hash = "v1_sha256_79028588ac6afd3e3d0d839d10eada9e5382991eebb600b0dae2119bcd7eac93"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -203866,20 +203902,20 @@ rule ARKBIRD_SOLG_Backdoor_APT_Nazar_April_2020_1 : FILE
 		$s15 = "\\z.png" fullword ascii
 
 	condition:
-		12 of them and filesize >120KB
+		12 of them and filesize > 120KB
 }
 rule ARKBIRD_SOLG_APT_APT27_Hyperbro_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detect Hyperbro backdoor"
 		author = "Arkbird_SOLG"
-		id = "060a200e-17dd-5789-94d4-eeff5c2e9a18"
+		id = "8e695742-a94a-5098-b943-5a734b7d7a45"
 		date = "2021-05-01"
 		modified = "2021-05-04"
 		reference = "-"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-03/APT27/APT_APT27_Hyperbro_Apr_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "1a32ab7c30885a665ede66640a9b047e3c381f6f535243fcadf1a7a22e76f407"
+		logic_hash = "v1_sha256_1a32ab7c30885a665ede66640a9b047e3c381f6f535243fcadf1a7a22e76f407"
 		score = 75
 		quality = 35
 		tags = "FILE"
@@ -203896,20 +203932,20 @@ rule ARKBIRD_SOLG_APT_APT27_Hyperbro_Apr_2021_1 : FILE
 		$seq3 = { 8b 44 24 08 48 75 [13] be ?? 16 00 10 bb 00 10 00 10 05 [2] 00 00 2b f3 [0-3] 74 0? 8? [0-2] cf [0-4] 03 cb ?? 11 47 3b fe 72 ?? e8 ?? fd ff ff 5f 5e 5b 33 c0 40 c2 0c 00 8b ff 55 8b ec 8b 45 0c 56 57 83 f8 01 75 7c 50 e8 1c 14 00 00 59 85 c0 75 07 33 c0 e9 0e 01 00 00 e8 a6 06 00 00 85 c0 75 07 e8 32 14 00 00 eb e9 e8 af 13 00 00 ff 15 ?? 80 00 10 a3 18 b8 00 10 e8 68 12 00 00 a3 64 ac 00 10 e8 89 0c 00 00 85 c0 7d 07 e8 1f 03 00 00 eb cf e8 93 11 00 00 85 c0 7c 20 e8 12 0f 00 00 85 c0 7c 17 6a 00 e8 41 0a 00 00 59 85 c0 75 0b ff 05 60 ac 00 10 e9 a8 00 00 00 e8 a4 0e 00 00 eb c9 33 ff 3b c7 75 31 39 3d 60 ac 00 10 7e 81 ff 0d 60 ac 00 10 39 3d b4 ac 00 10 75 05 e8 d0 0b 00 00 39 7d 10 75 7b e8 77 0e 00 00 e8 bd 02 00 00 e8 a1 13 00 00 eb 6a 83 f8 02 75 59 e8 78 02 00 00 68 14 02 00 00 6a 01 e8 54 08 00 00 8b f0 59 59 3b f7 0f 84 36 ff ff ff 56 ff 35 00 a0 00 10 ff 35 7c ac 00 10 e8 d3 01 00 00 59 ff d0 85 c0 74 17 57 56 e8 b1 02 00 00 59 59 ff 15 ?? 80 00 10 83 4e 04 ff 89 06 eb 18 56 e8 3f 07 00 00 59 e9 fa fe ff ff 83 f8 03 75 07 57 e8 33 05 00 00 59 33 c0 40 5f 5e 5d c2 0c 00 6a 0c 68 d0 92 00 10 e8 ?? 15 00 00 8b f9 8b f2 8b 5d 08 33 c0 40 89 45 e4 85 f6 75 0c 39 15 60 ac 00 10 0f 84 c5 00 00 00 83 65 fc 00 3b f0 74 05 83 fe 02 75 2e a1 ?? 81 00 10 85 c0 74 08 57 56 53 ff d0 89 45 e4 83 7d e4 00 0f 84 96 00 00 00 57 56 53 e8 72 fe ff ff 89 45 e4 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 2 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 10KB and 2 of ( $seq* )
 }
 rule ARKBIRD_SOLG_SP_Vault7_SIG_F_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect open-source PasswordReminder recovery tools used by Chinese APT in the Past"
 		author = "Arkbird_SOLG"
-		id = "0b65e333-16e2-57c3-84f0-5cd24c9d9593"
+		id = "d4c89c5f-1351-5337-931d-b545a78840ed"
 		date = "2020-11-30"
 		modified = "2020-11-30"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-30/SP_Vault7_SIG_F_Nov_2020_1.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "b03ffb433491b532d891f29aeb5b33c6578067f2f05845514a7bdc1e50f88a10"
+		logic_hash = "v1_sha256_b03ffb433491b532d891f29aeb5b33c6578067f2f05845514a7bdc1e50f88a10"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203928,20 +203964,20 @@ rule ARKBIRD_SOLG_SP_Vault7_SIG_F_Nov_2020_1 : FILE
 		$dbg9 = { 53 55 56 57 68 14 ?? 40 00 e8 17 0c 00 00 8b 6c 24 1c [1-4] 45 00 50 68 e0 ?? 40 00 e8 ?? ?? 00 00 83 c4 ?? e8 ?? 02 00 00 85 c0 75 1d e8 ?? 02 00 00 85 c0 75 14 68 b4 ?? 40 00 e8 ?? 0b 00 00 83 c4 04 33 c0 5f 5e 5d 5b }
 
 	condition:
-		uint16(0)==0x4d5a and filesize >50KB and 6 of them
+		uint16( 0 ) == 0x4d5a and filesize > 50KB and 6 of them
 }
 rule ARKBIRD_SOLG_APT_Lazarus_HTA_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detect HTA with the fake picture header as decoy used by Lazarus"
 		author = "Arkbird_SOLG"
-		id = "1a57251e-f0fb-541c-bf8b-f1afecf7f1c7"
+		id = "cadd66fe-6ba4-5b8d-8013-86904c0ba74c"
 		date = "2021-04-27"
 		modified = "2021-04-27"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-27/Lazarus/APT_Lazarus_HTA_Apr_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "40c2e5b662d1999c3ae5be97604bb9ebc809a383d66331cb4b385666ce55be2a"
+		logic_hash = "v1_sha256_40c2e5b662d1999c3ae5be97604bb9ebc809a383d66331cb4b385666ce55be2a"
 		score = 75
 		quality = 63
 		tags = "FILE"
@@ -203959,20 +203995,20 @@ rule ARKBIRD_SOLG_APT_Lazarus_HTA_Apr_2021_1 : FILE
 		$s7 = { 62 3d 6e 65 77 20 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 27 53 63 72 69 70 74 69 6e 67 2e 46 69 6c 65 53 79 73 74 65 6d 4f 62 6a 65 63 74 27 29 }
 
 	condition:
-		( uint16(0)==0x4d42 or uint16(0)==0xd8ff or uint32(0)==0x474e5089 or uint32(0)==0x38464947) and filesize >20KB and 5 of ($s*)
+		( uint16( 0 ) == 0x4d42 or uint16( 0 ) == 0xd8ff or uint32( 0 ) == 0x474e5089 or uint32( 0 ) == 0x38464947 ) and filesize > 20KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_ATM_Dispcashbr_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect the DispCashBR ATM malware"
 		author = "Arkbird_SOLG"
-		id = "629261d8-242c-580d-aa4d-4b313c77edef"
+		id = "06435f15-7d39-515c-978d-0abbb04d1a70"
 		date = "2020-05-14"
 		modified = "2021-05-14"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-14/DispCashBR/ATM_DispCashBR_May_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "26f641a266c1f187d834a05b327c13ddee93747e182a5458e4ec3cb1f23f5f47"
+		logic_hash = "v1_sha256_26f641a266c1f187d834a05b327c13ddee93747e182a5458e4ec3cb1f23f5f47"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -203988,22 +204024,20 @@ rule ARKBIRD_SOLG_ATM_Dispcashbr_May_2021_1 : FILE
 		$seq4 = { c7 45 ec 00 00 00 00 8d 85 c4 fd ff ff 89 44 24 04 c7 04 24 03 00 02 0b e8 47 1b 00 00 83 ec 08 89 45 e8 83 7d e8 00 74 18 c7 04 24 92 50 40 00 e8 8b 23 00 00 c7 04 24 ff ff ff ff e8 8f 23 00 00 c7 04 24 aa 50 40 00 e8 8b 23 00 00 c7 04 24 f5 ff ff ff e8 ef 23 00 00 83 ec 04 c7 44 24 04 03 00 00 00 89 04 24 e8 e4 23 00 00 83 ec 08 c7 04 24 b8 0b 00 00 e8 dd 23 00 00 83 ec 04 c7 04 24 c4 50 40 00 e8 4e 23 00 00 8d 85 c4 fd ff ff 83 c0 06 89 44 24 04 c7 04 24 ed 50 40 00 e8 1d 23 00 00 8d 85 c4 fd ff ff 05 07 01 00 00 89 44 24 04 c7 04 24 03 51 40 00 e8 02 23 00 00 0f b7 85 c8 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 1a 51 40 00 e8 e8 22 00 00 0f b7 85 c6 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 2f 51 40 00 e8 ce 22 00 00 0f b7 85 c4 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 42 51 40 00 e8 b4 22 00 00 c7 04 24 54 51 40 00 e8 c0 22 00 00 8d 85 c0 fd ff ff 89 04 24 e8 46 1a 00 00 83 ec 04 8b 85 c0 fd ff ff 8d 95 be fd ff ff 89 54 24 20 c7 44 24 1c 00 00 00 00 8d 95 c4 fd ff ff 89 54 24 18 c7 44 24 14 0f 00 02 0b c7 44 24 10 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 89 44 24 04 c7 04 24 7f 51 40 00 e8 f9 19 00 00 83 ec 24 89 45 e8 8b 45 e8 83 c0 36 83 f8 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 3 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 20KB and 3 of ( $seq* )
 }
-import "pe"
-
 rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Screencapture_June_2020_1 : FILE
 {
 	meta:
 		description = "Detect ScreenCapture malware used by Lazarus APT"
 		author = "Arkbird_SOLG, James_inthe_box"
-		id = "bb0463ac-6219-5a12-b3d2-fc82800bda69"
+		id = "bc4b818e-0232-5291-b9f0-52db7ba57b95"
 		date = "2020-06-23"
 		modified = "2021-07-13"
 		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L3-L31"
 		license_url = "N/A"
-		logic_hash = "66f8d3da0f70f6c4ed6f853ab4040d7f96c043e9e194f1720999b48910b3e756"
+		logic_hash = "v1_sha256_66f8d3da0f70f6c4ed6f853ab4040d7f96c043e9e194f1720999b48910b3e756"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204030,22 +204064,20 @@ rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Screencapture_June_2020_1 : FILE
 		$s18 = "Found %d entries." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and 14 of them
+		uint16( 0 ) == 0x5a4d and filesize < 80KB and 14 of them
 }
-import "pe"
-
 rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Keylog_June_2020_1 : FILE
 {
 	meta:
 		description = "Detect keylog malware used by Lazarus APT"
 		author = "Arkbird_SOLG, James_inthe_box"
-		id = "dd6aae8c-76d1-514d-905e-21472eb9b9b2"
+		id = "e73d02a6-7ba1-5ac3-9b77-f546bd83d51c"
 		date = "2020-06-23"
 		modified = "2021-07-13"
 		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L33-L58"
 		license_url = "N/A"
-		logic_hash = "9a4e17903ad2a7c80651aa8f3d57876d1621be06ba7a683135b11929b232b2fa"
+		logic_hash = "v1_sha256_9a4e17903ad2a7c80651aa8f3d57876d1621be06ba7a683135b11929b232b2fa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204069,22 +204101,20 @@ rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Keylog_June_2020_1 : FILE
 		$s15 = "Found %d entries." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and 11 of them
+		uint16( 0 ) == 0x5a4d and filesize < 80KB and 11 of them
 }
-import "pe"
-
 rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Generic_June_2020_1 : FILE
 {
 	meta:
 		description = "Detect stealers used by Lazarus APT by common strings"
 		author = "Arkbird_SOLG, James_inthe_box"
-		id = "11a7c531-91a4-524e-aa5d-c11538f7db58"
+		id = "870c3382-4928-5b7c-a371-9276dc881791"
 		date = "2020-06-23"
 		modified = "2021-07-13"
 		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L60-L85"
 		license_url = "N/A"
-		logic_hash = "878e4a128b7de45f4940e7adccfeb376ce46e87b35b25e162f668303e9fd7852"
+		logic_hash = "v1_sha256_878e4a128b7de45f4940e7adccfeb376ce46e87b35b25e162f668303e9fd7852"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204108,20 +204138,20 @@ rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Generic_June_2020_1 : FILE
 		$s14 = "Entered Windows direcotry, skipping..." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and 11 of them
+		uint16( 0 ) == 0x5a4d and filesize < 80KB and 11 of them
 }
 rule ARKBIRD_SOLG_MAL_Bazarloader_Oct_2021_1 : FILE
 {
 	meta:
 		description = "Detect BazarLoader implant"
 		author = "Arkbird_SOLG"
-		id = "d6462e74-fe1d-599e-aac8-0d0942ca42ad"
+		id = "b521ba3a-cae9-5020-a07f-aa527a530b5f"
 		date = "2021-10-30"
 		modified = "2021-10-30"
 		reference = "https://twitter.com/malwrhunterteam/status/1454154412902002692"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/MAL_BazarLoader_Oct_2021_1.yara#L1-L17"
 		license_url = "N/A"
-		logic_hash = "afbe02ef9e69ac5105aaae28240d6863c9c4578c0e8fd7c86c38d975cf8acdc6"
+		logic_hash = "v1_sha256_afbe02ef9e69ac5105aaae28240d6863c9c4578c0e8fd7c86c38d975cf8acdc6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204136,20 +204166,20 @@ rule ARKBIRD_SOLG_MAL_Bazarloader_Oct_2021_1 : FILE
 		$s3 = { 48 8b 84 24 c0 00 00 00 8b 80 64 01 00 00 39 44 24 30 0f 8d 82 00 00 00 48 63 44 24 30 48 8b 8c 24 c0 00 00 00 48 8b 84 c1 68 01 00 00 48 89 44 24 58 48 8b 44 24 38 48 8b 4c 24 58 8b 40 10 0f af 41 0c 48 8b 4c 24 58 48 63 49 04 48 8b 94 24 c0 00 00 00 48 8b 52 08 48 89 54 24 70 c6 44 24 20 00 4c 8b 44 24 58 45 8b 48 0c 44 8b c0 48 8b 44 24 38 48 8b 54 c8 70 48 8b 8c 24 c0 00 00 00 48 8b 44 24 70 ff 50 40 48 63 4c 24 30 48 89 84 cc 80 00 00 00 e9 5c ff ff ff 48 8b 44 24 38 8b 40 18 89 44 24 40 eb 0a 8b 44 24 40 ff c0 89 44 24 40 48 8b 44 24 38 8b 40 1c 39 44 24 40 0f 8d af 01 00 00 48 8b 44 24 38 8b 40 14 89 44 24 44 eb 0a 8b 44 24 44 ff c0 89 44 24 44 48 8b 84 24 c0 00 00 00 8b 80 88 01 00 00 39 44 24 44 0f 83 6e 01 00 00 c7 44 24 50 00 00 00 00 c7 44 24 30 00 00 00 00 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 84 24 c0 00 00 00 8b 80 64 01 00 00 39 44 24 30 0f 8d e2 00 00 00 48 63 44 24 30 48 8b 8c 24 c0 00 00 00 48 8b 84 c1 68 01 00 00 48 89 44 24 58 48 8b 44 24 58 8b 4c 24 44 0f af 48 38 8b c1 89 44 24 60 c7 44 24 48 00 00 00 00 eb 0a 8b 44 24 48 ff c0 89 44 24 48 48 8b }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >200KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 200KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Cobaltstrike_Oct_2021_1 : FILE
 {
 	meta:
 		description = "Detect Cobalt Strike implant"
 		author = "Arkbird_SOLG"
-		id = "89d46993-cc1b-536b-b1ab-a0e967d0d397"
+		id = "57e0e9ae-4c31-5c24-8b67-f31ed0d5fb3b"
 		date = "2021-10-30"
 		modified = "2021-10-30"
 		reference = "https://twitter.com/malwrhunterteam/status/1454154412902002692"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/MAL_CobaltStrike_Oct_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "4f1a2306b8279be67829d0d515063caae6a9d7a07078a43c2cbe62f675bcb450"
+		logic_hash = "v1_sha256_4f1a2306b8279be67829d0d515063caae6a9d7a07078a43c2cbe62f675bcb450"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204166,20 +204196,20 @@ rule ARKBIRD_SOLG_MAL_Cobaltstrike_Oct_2021_1 : FILE
 		$s4 = { 48 83 ec 48 44 89 4c 24 44 4c 89 44 24 38 48 89 54 24 30 48 89 4c 24 28 c7 44 24 24 ?? 00 00 00 48 8b 05 [3] 00 48 05 [2] 00 00 44 8b 4c 24 44 4c 8b 44 24 38 48 8b 54 24 30 48 8b 4c 24 28 ff d0 90 48 83 c4 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >20KB and 3 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 20KB and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_ELF_Hive_Oct_2021_1 : FILE
 {
 	meta:
 		description = "Detect ELF version of Hive ransomware"
 		author = "Arkbird_SOLG"
-		id = "434cfe85-3209-5990-9c68-47ce4fafd5b8"
+		id = "d786d4c6-4268-5173-9ec0-93eb02910725"
 		date = "2021-10-29"
 		modified = "2021-10-30"
 		reference = "https://twitter.com/ESETresearch/status/1454100591261667329"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/RAN_ELF_Hive_Oct_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "47ccf3b825521986070dba92194d5937289c0335b922537ea3242c4afb2be237"
+		logic_hash = "v1_sha256_47ccf3b825521986070dba92194d5937289c0335b922537ea3242c4afb2be237"
 		score = 60
 		quality = 35
 		tags = "FILE"
@@ -204196,20 +204226,20 @@ rule ARKBIRD_SOLG_RAN_ELF_Hive_Oct_2021_1 : FILE
 		$s4 = { 00 00 48 8b ac 24 68 02 00 00 48 81 c4 70 02 00 00 c3 ?? 80 ?? 0e [6] 48 8b [2] 48 }
 
 	condition:
-		uint32(0)==0x464C457F and filesize >20KB and all of ($s*)
+		uint32( 0 ) == 0x464C457F and filesize > 20KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_ELF_Revil_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect the ELF version of REvil ransomware"
 		author = "Arkbird_SOLG"
-		id = "b4b9d60e-a352-5045-8be3-e9a08d70ef6b"
+		id = "c1a49460-6abe-5f21-87fb-2245bcfaba8c"
 		date = "2021-06-28"
 		modified = "2021-06-29"
 		reference = "https://twitter.com/jaimeblascob/status/1409603887871500288"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-28/REvil/RAN_ELF_REvil_Jun_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "054bdb8362fdea2dc914b11387f6c67e35932acb73ba2b133ca29f69549914ba"
+		logic_hash = "v1_sha256_054bdb8362fdea2dc914b11387f6c67e35932acb73ba2b133ca29f69549914ba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204227,20 +204257,20 @@ rule ARKBIRD_SOLG_RAN_ELF_Revil_Jun_2021_1 : FILE
 		$seq4 = { 48 89 e5 48 83 ec 10 c7 45 fc 58 00 00 00 8b 45 fc 48 8d 55 f0 48 89 c6 bf 00 a5 71 00 e8 [2] 00 00 48 89 05 ?? 0b 31 00 48 8d 45 f0 48 89 c2 be 20 00 00 00 bf c0 a4 71 00 e8 [2] 00 00 48 89 05 [2] 31 00 b8 00 00 00 00 e8 b7 fd ff ff 48 89 05 [2] 31 00 48 8b 05 [2] 31 00 48 85 c0 74 09 48 8b 05 [2] 31 00 eb 05 b8 [2] 41 00 48 89 05 [2] 31 00 b8 00 00 00 00 e8 80 fe ff ff 48 89 05 [2] 31 00 48 8b 05 [2] 31 00 48 85 c0 74 09 48 8b 05 [2] 31 00 eb 05 b8 [2] 41 00 48 89 05 ?? 0a 31 00 48 c7 05 ?? 0a 31 00 [2] 41 00 e8 ?? f6 ff ff e8 f1 f7 ff ff b8 01 00 00 00 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >50KB and 3 of ($seq*)
+		uint32( 0 ) == 0x464c457f and filesize > 50KB and 3 of ( $seq* )
 }
 rule ARKBIRD_SOLG_Ran_Loader_Hades_Dec_2020_1 : FILE
 {
 	meta:
 		description = "Detect the loader used by Hades ransomware for load the final implant in memory"
 		author = "Arkbird_SOLG"
-		id = "d48d3a2b-3f0f-5da2-aba9-db2366489a6c"
+		id = "f14607b4-a8a8-575d-9467-021d864da08b"
 		date = "2020-12-27"
 		modified = "2021-01-01"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-01/Hades/Ran_Loader_Hades_Dec_2020_1.yar#L2-L24"
 		license_url = "N/A"
-		logic_hash = "cfa0f8acd3c526f7f4889794f7c38547a88031bb615a03ad5c1542c61bc0eecd"
+		logic_hash = "v1_sha256_cfa0f8acd3c526f7f4889794f7c38547a88031bb615a03ad5c1542c61bc0eecd"
 		score = 50
 		quality = 71
 		tags = "FILE"
@@ -204258,20 +204288,20 @@ rule ARKBIRD_SOLG_Ran_Loader_Hades_Dec_2020_1 : FILE
 		$s4 = { 53 43 61 4d 69 72 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and 2 of ($seq*) and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 300KB and 2 of ( $seq* ) and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Redxor_Feb_2021_1 : FILE
 {
 	meta:
 		description = "Detect RedXor backdoor (Feb 2021)"
 		author = "Arkbird_SOLG"
-		id = "10ae10b7-b351-5dda-9408-aa01a40e3d6a"
+		id = "7f0d05a3-420b-5e2f-adb8-e8261b2b372d"
 		date = "2021-03-14"
 		modified = "2021-05-24"
 		reference = "https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-23/RedXor/MAL_RedXor_Feb_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "b4e3ea24bb19abe7065ed5fc94f65e68ea84b11da7b45936ee991ef6aac6d33d"
+		logic_hash = "v1_sha256_b4e3ea24bb19abe7065ed5fc94f65e68ea84b11da7b45936ee991ef6aac6d33d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204289,20 +204319,20 @@ rule ARKBIRD_SOLG_MAL_Redxor_Feb_2021_1 : FILE
 		$seq6 = { 55 48 89 e5 53 48 81 ec 68 0d 00 00 48 89 bd d8 f2 ff ff c7 45 90 31 32 37 2e c7 45 94 30 2e 30 2e 48 c7 45 98 31 00 00 00 c7 45 a0 00 00 00 00 c7 85 70 ff ff ff 30 30 2d 30 c7 85 74 ff ff ff 30 2d 30 30 c7 85 78 ff ff ff 2d 30 30 2d c7 85 7c ff ff ff 30 30 2d 30 c7 45 80 30 00 00 00 48 c7 45 a8 [2] 40 00 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >25KB and all of ($seq*)
+		uint32( 0 ) == 0x464c457f and filesize > 25KB and all of ( $seq* )
 }
 rule ARKBIRD_SOLG_MAL_ELF_Rotajakiro_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect the ELF version of RotaJakiro"
 		author = "Arkbird_SOLG"
-		id = "a67f9b64-8778-542f-8481-566a4ffaf5e8"
+		id = "a1f17398-6d12-5803-98c8-8cf2ef453fb8"
 		date = "2020-05-07"
 		modified = "2021-05-08"
 		reference = "https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-08/RotaJakiro/MAL_ELF_RotaJakiro_May_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "8e4b9ef8a908a13e738da31b28c879228c3bdc1d8461417b1c1bf31026c98abf"
+		logic_hash = "v1_sha256_8e4b9ef8a908a13e738da31b28c879228c3bdc1d8461417b1c1bf31026c98abf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204321,20 +204351,20 @@ rule ARKBIRD_SOLG_MAL_ELF_Rotajakiro_May_2021_1 : FILE
 		$seq4 = { ba 15 00 00 00 be 20 00 00 00 c6 44 24 30 b1 c6 44 24 31 be c6 44 24 32 54 c6 44 24 33 93 c6 44 24 34 29 c6 44 24 35 67 c6 44 24 36 1f c6 44 24 37 b5 c6 44 24 38 a5 c6 44 24 39 ec c6 44 24 3a 18 c6 44 24 3b 53 c6 44 24 3c f0 c6 44 24 3d f1 c6 44 24 3e fe c6 44 24 3f 9f c6 44 24 40 27 c6 44 24 41 8f c6 44 24 42 8d c6 44 24 43 77 c6 44 24 44 1e c6 44 24 45 e1 c6 44 24 46 e1 c6 44 24 47 f0 c6 44 24 48 9e c6 44 24 49 e2 c6 44 24 4a 0d c6 44 24 4b 96 c6 44 24 4c ff c6 44 24 4d 6c c6 44 24 4e b4 c6 44 24 4f 16 e8 09 a8 ff ff 4c 89 ef 48 89 c6 49 89 c4 e8 8b a3 ff ff 48 8d bc 24 90 00 00 00 41 b8 08 00 00 00 b9 00 f3 61 00 ba 69 00 00 00 be 70 00 00 00 48 89 04 24 c6 84 24 90 00 00 00 b3 c6 84 24 91 00 00 00 0b c6 84 24 92 00 00 00 18 c6 84 24 93 00 00 00 fd c6 84 24 94 00 00 00 71 c6 84 24 95 00 00 00 3b c6 84 24 96 00 00 00 b7 c6 84 24 97 00 00 00 fc c6 84 24 98 00 00 00 70 c6 84 24 99 00 00 00 18 c6 84 24 9a 00 00 00 f7 c6 84 24 9b 00 00 00 22 c6 84 24 9c 00 00 00 2d c6 84 24 9d 00 00 00 75 c6 84 24 9e 00 00 00 5d c6 84 24 9f 00 00 00 8f c6 84 24 a0 00 00 00 75 c6 84 24 a1 00 00 00 60 c6 84 24 a2 00 00 00 91 c6 84 24 a3 00 00 00 b3 c6 84 24 a4 00 00 00 1a c6 84 24 a5 00 00 00 0b c6 84 24 a6 00 00 00 00 c6 84 24 a7 00 00 00 5c c6 84 24 a8 00 00 00 6b c6 84 24 a9 00 00 00 8d c6 84 24 aa 00 00 00 ee c6 84 24 ab 00 00 00 3b c6 84 24 ac 00 00 00 7e c6 84 24 ad 00 00 00 67 c6 84 24 ae 00 00 00 72 c6 84 24 af 00 00 00 43 c6 84 24 b0 00 00 00 f6 c6 84 24 b1 00 00 00 14 c6 84 24 b2 00 00 00 32 c6 84 24 b3 00 00 00 c1 c6 84 24 b4 00 00 00 79 c6 84 24 b5 00 00 00 0d c6 84 24 b6 00 00 00 0d c6 84 24 b7 00 00 00 22 c6 84 24 b8 00 00 00 e1 c6 84 24 b9 00 00 00 bd c6 84 24 ba 00 00 00 3f c6 84 24 bb 00 00 00 82 c6 84 24 bc 00 00 00 dd c6 84 24 bd 00 00 00 23 c6 84 24 be 00 00 00 7d c6 84 24 bf 00 00 00 87 c6 84 24 c0 00 00 00 34 c6 84 24 c1 00 00 00 9d c6 84 24 c2 00 00 00 43 c6 84 24 c3 00 00 00 98 c6 84 24 c4 00 00 00 da c6 84 24 c5 00 00 00 e0 c6 84 24 c6 00 00 00 3d c6 84 24 c7 00 00 00 64 c6 84 24 c8 00 00 00 1a c6 84 24 c9 00 00 00 d7 c6 84 24 ca 00 00 00 f5 c6 84 24 cb 00 00 00 5a c6 84 24 cc 00 00 00 c3 c6 84 24 cd 00 00 00 9c c6 84 24 ce 00 00 00 97 c6 84 24 cf 00 00 00 c7 c6 84 24 d0 00 00 00 65 c6 84 24 d1 00 00 00 8f c6 84 24 d2 00 00 00 99 c6 84 24 d3 00 00 00 eb c6 84 24 d4 00 00 00 2f c6 84 24 d5 00 00 00 2b c6 84 24 d6 00 00 00 d0 c6 84 24 d7 00 00 00 d9 c6 84 24 d8 00 00 00 4e c6 84 24 d9 00 00 00 8f c6 84 24 da 00 00 00 7b c6 84 24 db 00 00 00 97 c6 84 24 dc 00 00 00 3b c6 84 24 dd 00 00 00 14 c6 84 24 de 00 00 00 e9 c6 84 24 df 00 00 00 e9 c6 84 24 e0 00 00 00 82 c6 84 24 e1 00 00 00 48 c6 84 24 e2 00 00 00 dc c6 84 24 e3 00 00 00 a3 c6 84 24 e4 00 00 00 75 c6 84 24 e5 00 00 00 ca c6 84 24 e6 00 00 00 e6 c6 84 24 e7 00 00 00 40 c6 84 24 e8 00 00 00 6b c6 84 24 e9 00 00 00 b1 c6 84 24 ea 00 00 00 68 c6 84 24 eb 00 00 00 42 c6 84 24 ec 00 00 00 56 c6 84 24 ed 00 00 00 b4 c6 84 24 ee 00 00 00 ac c6 84 24 ef 00 00 00 2a c6 84 24 f0 00 00 00 fc c6 84 24 f1 00 00 00 34 c6 84 24 f2 00 00 00 fa c6 84 24 f3 00 00 00 1d c6 84 24 f4 00 00 00 1b c6 84 24 f5 00 00 00 9a c6 84 24 f6 00 00 00 62 c6 84 24 f7 00 00 00 b3 c6 84 24 f8 00 00 00 39 c6 84 24 f9 00 00 00 6a c6 84 24 fa 00 00 00 19 c6 84 24 fb 00 00 00 1b c6 84 24 fc 00 00 00 f3 c6 84 24 fd 00 00 00 c5 c6 84 24 fe 00 00 00 d2 c6 84 24 ff 00 00 00 6a e8 55 a4 ff ff 48 89 c7 48 89 c5 e8 4a 92 ff ff 44 8d 7c 03 0a 4d 63 ff 4c 89 ff e8 1a 94 ff ff 4c 89 fe 48 89 c3 48 89 c7 e8 dc 94 ff ff 4c 89 f2 48 89 ee 48 89 df 31 c0 e8 2c 95 ff ff 48 89 da 8b 0a 48 83 c2 04 8d 81 ff fe fe fe f7 d1 21 c8 25 80 80 80 80 74 e9 89 c1 4c 8b 3c 24 48 89 de c1 e9 10 a9 80 80 00 00 0f 44 c1 48 8d 4a 02 4c 89 ff 48 0f 44 d1 89 c1 00 c1 48 83 da 03 48 29 da e8 93 a8 ff ff 4c 89 ff be ed 01 00 00 4c 89 3c 24 e8 d2 aa ff ff 48 8d 44 24 50 41 b8 08 00 00 00 b9 00 f3 61 00 ba 34 00 00 00 be 40 00 00 00 c6 44 24 50 c6 48 89 c7 c6 44 24 51 3b c6 44 24 52 16 c6 44 24 53 01 c6 44 24 54 92 c6 44 24 55 36 c6 44 24 56 81 c6 44 24 57 c8 c6 44 24 58 f3 c6 44 24 59 49 c6 44 24 5a a8 c6 44 24 5b 02 c6 44 24 5c 6f c6 44 24 5d 9d c6 44 24 5e db c6 44 24 5f 61 c6 44 24 60 8a c6 44 24 61 e3 c6 44 24 62 f4 c6 44 24 63 1b c6 44 24 64 33 c6 44 24 65 4d c6 44 24 66 b4 c6 44 24 67 00 c6 44 24 68 f4 c6 44 24 69 76 c6 44 24 6a 70 c6 44 24 6b 56 c6 44 24 6c e2 c6 44 24 6d f3 c6 44 24 6e 5c c6 44 24 6f 73 c6 44 24 70 06 c6 44 24 71 de c6 44 24 72 c5 c6 44 24 73 fa c6 44 24 74 4c c6 44 24 75 7b c6 44 24 76 34 c6 44 24 77 b9 c6 44 24 78 d3 c6 44 24 79 a6 c6 44 24 7a 9b c6 44 24 7b 03 c6 44 24 7c f7 c6 44 24 7d 8e c6 44 24 7e 37 c6 44 24 7f 6a c6 84 24 80 00 00 00 3a c6 84 24 81 00 00 00 97 c6 84 24 82 00 00 00 57 c6 84 24 83 00 00 00 25 c6 84 24 84 00 00 00 2c c6 84 24 85 00 00 00 ac c6 84 24 86 00 00 00 a6 c6 84 24 87 00 00 00 de c6 84 24 88 00 00 00 29 c6 84 24 89 00 00 00 ca c6 84 24 8a 00 00 00 c0 c6 84 24 8b 00 00 00 93 c6 84 24 8c 00 00 00 67 c6 84 24 8d 00 00 00 47 c6 84 24 8e 00 00 00 8d c6 84 24 8f 00 00 00 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >10KB and 3 of ($seq*)
+		uint32( 0 ) == 0x464c457f and filesize > 10KB and 3 of ( $seq* )
 }
 rule ARKBIRD_SOLG_RAN_Astrolocker_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Astrolocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "f2c2c96a-277e-575b-8d80-4729f4a1cfe4"
+		id = "06d590a7-132e-5615-a154-b7c28684610d"
 		date = "2020-05-12"
 		modified = "2021-05-16"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-12/Astrolocker/RAN_Astrolocker_May_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "7e50642f5f864b7cffeb5ccf4581ac7566da24fd5361a3303a860f036cd6d439"
+		logic_hash = "v1_sha256_7e50642f5f864b7cffeb5ccf4581ac7566da24fd5361a3303a860f036cd6d439"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -204349,20 +204379,20 @@ rule ARKBIRD_SOLG_RAN_Astrolocker_May_2021_1 : FILE
 		$seq_Apr_2021_1 = { 89 44 24 38 48 8b 05 78 4e 00 00 48 89 05 b9 9e 00 00 48 8b 05 52 4e 00 00 48 89 05 b3 9e 00 00 48 8b 05 4c 4e 00 00 48 89 05 ad 9e 00 00 48 8b 05 46 4e 00 00 48 89 05 a7 9e 00 00 8b 05 51 9e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 1 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 1 of ( $seq* )
 }
 rule ARKBIRD_SOLG_RAN_Mountlocker_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Mountlocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "0bc0d341-4658-500e-b487-1993e5431560"
+		id = "008b8c5f-e724-5eee-bbe7-09cc0e744e2e"
 		date = "2020-05-12"
 		modified = "2021-05-16"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-12/Astrolocker/RAN_MountLocker_May_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "c0826d4c740b5c46b704b42e002602dd0cda2b6d1bf0ba5431877be8bd600b64"
+		logic_hash = "v1_sha256_c0826d4c740b5c46b704b42e002602dd0cda2b6d1bf0ba5431877be8bd600b64"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204379,7 +204409,7 @@ rule ARKBIRD_SOLG_RAN_Mountlocker_May_2021_1 : FILE
 		$seq_Jan_2021_2 = { 4c 8d 05 20 47 00 00 41 8b ce 48 8d 15 1e 47 00 00 e8 [2] 00 00 ba 04 01 00 00 48 8d 4c 24 40 ff 15 ?? 43 00 00 85 c0 75 12 b8 5c 00 00 00 c7 44 24 40 43 00 3a 00 66 89 44 24 44 89 6c 24 38 4c 8d 8c 24 78 02 00 00 48 89 6c 24 30 48 8d 4c 24 40 48 89 6c 24 28 45 33 c0 33 d2 48 89 6c 24 20 66 89 6c 24 46 ff 15 6b 44 00 00 44 8b 84 24 78 02 00 00 48 8d 15 e4 45 00 00 85 c0 b9 bd 07 a2 41 44 0f 44 c1 41 8b c8 44 89 84 24 78 02 00 00 c1 c9 09 41 8b c0 89 4c 24 28 45 8b c8 c1 c8 06 48 8d 4c 24 40 41 c1 c9 03 89 44 24 20 ff 15 8b 44 00 00 4c 8d 44 24 40 33 d2 33 c9 ff 15 ?? 42 00 00 48 85 c0 74 1b ff 15 [2] 00 00 3d b7 00 00 00 74 0e bf 01 00 00 00 48 8d 15 fe 45 00 00 eb 09 8b fd 48 8d 15 a3 45 00 00 41 8b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 1 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 1 of ( $seq* )
 }
 import "pe"
 
@@ -204388,13 +204418,13 @@ rule ARKBIRD_SOLG_APT_NK_Lazarus_Implant_June_2020_1 : FILE
 	meta:
 		description = "Detect Lazarus implant June 2020"
 		author = "Arkbird_SOLG"
-		id = "602c33f2-1e34-5267-9154-ada2d6edc64b"
+		id = "86ba8557-5cea-57cd-a227-b0e5c30922a8"
 		date = "2020-06-28"
 		modified = "2020-06-28"
 		reference = "https://twitter.com/ccxsaber/status/1277064824434745345"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-28/APT_NK_Lazarus_Implant_June_2020_1.yar#L3-L23"
 		license_url = "N/A"
-		logic_hash = "29b6b8d3bdd47707854ed0dc00808d6352934950a8e7244450df78422ff3cb15"
+		logic_hash = "v1_sha256_29b6b8d3bdd47707854ed0dc00808d6352934950a8e7244450df78422ff3cb15"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -204413,7 +204443,7 @@ rule ARKBIRD_SOLG_APT_NK_Lazarus_Implant_June_2020_1 : FILE
 		$s10 = "POST" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and (pe.imphash()=="565005404f00b7def4499142ade5e3dd" or 6 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and ( pe.imphash ( ) == "565005404f00b7def4499142ade5e3dd" or 6 of them )
 }
 import "pe"
 
@@ -204422,13 +204452,13 @@ rule ARKBIRD_SOLG_APT28_Zekapab_June_2020_1 : FILE
 	meta:
 		description = "Detect Delphi variant of Zekapab"
 		author = "Arkbird_SOLG"
-		id = "cf87e67f-2db9-537d-8800-8cd47b47c276"
+		id = "259cea43-a2ec-5f53-874f-8b2ee9ed7008"
 		date = "2020-06-28"
 		modified = "2020-06-28"
 		reference = "https://twitter.com/DrunkBinary/status/1276573779037163520"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-28/APT28_Zekapab_June_2020_1.yar#L3-L29"
 		license_url = "N/A"
-		logic_hash = "a02a78b8f60cf9d4441cc18b70fd00ec89253a5feafdc0eb392486b575bc61e2"
+		logic_hash = "v1_sha256_a02a78b8f60cf9d4441cc18b70fd00ec89253a5feafdc0eb392486b575bc61e2"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -204453,20 +204483,20 @@ rule ARKBIRD_SOLG_APT28_Zekapab_June_2020_1 : FILE
 		$s16 = "ProxyPassword<" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="dbdfe8b60c1de0a9201044b3e91b9502" or 12 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "dbdfe8b60c1de0a9201044b3e91b9502" or 12 of them )
 }
 rule ARKBIRD_SOLG_MAL_Pseudomanuscrypt_Dec_2021_1 : FILE
 {
 	meta:
 		description = "Detect PseudoManuscrypt loader dropped by the installer"
 		author = "Arkbird_SOLG"
-		id = "8784baa0-c52c-5ee0-9a92-9b6457df61ed"
+		id = "9c8fdf07-5c1f-5415-879e-9003343ec34d"
 		date = "2021-12-16"
 		modified = "2021-12-17"
 		reference = "https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-PseudoManuscrypt-a-mass-scale-spyware-attack-campaign-En.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-16/MAL_PseudoManuscrypt_Dec_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "e304323ed26c7040c97efa8041bcd3eb2f6d0caeba76d6674fc2947d7850e830"
+		logic_hash = "v1_sha256_e304323ed26c7040c97efa8041bcd3eb2f6d0caeba76d6674fc2947d7850e830"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204485,20 +204515,20 @@ rule ARKBIRD_SOLG_MAL_Pseudomanuscrypt_Dec_2021_1 : FILE
 		$s5 = { 2e 72 73 72 63 24 30 31 00 00 00 00 a0 ?? 00 00 ?? 04 00 00 2e 72 73 72 63 24 30 32 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >3KB and filesize <30KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 3KB and filesize < 30KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Conti_Dec_2021_1 : FILE
 {
 	meta:
 		description = "Detect Conti ransomware (v3)"
 		author = "Arkbird_SOLG"
-		id = "efa65b86-95d7-55fd-b98a-7b3c747a671c"
+		id = "ea8979ca-7d93-56c4-bd6b-67e7af5f2498"
 		date = "2021-12-16"
 		modified = "2021-12-16"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-16/RAN_Conti_Dec_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "038ad0c7ffcabcaf85de1adadf8a386063f96d5cd0e348a3cea4ea3b7b10fe70"
+		logic_hash = "v1_sha256_038ad0c7ffcabcaf85de1adadf8a386063f96d5cd0e348a3cea4ea3b7b10fe70"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204514,20 +204544,20 @@ rule ARKBIRD_SOLG_RAN_Conti_Dec_2021_1 : FILE
 		$s3 = { 75 f5 88 8d 50 f6 ff ff c6 85 51 f6 ff ff 48 c6 85 52 f6 ff ff 20 c6 85 53 f6 ff ff 5e c6 85 54 f6 ff ff 20 c6 85 55 f6 ff ff 7d c6 85 56 f6 ff ff 20 c6 85 57 f6 ff ff 39 c6 85 58 f6 ff ff 20 c6 85 59 f6 ff ff 33 c6 85 5a f6 ff ff 20 c6 85 5b f6 ff ff 2a c6 85 5c f6 ff ff 20 c6 85 5d f6 ff ff 33 c6 85 5e f6 ff ff 20 c6 85 5f f6 ff ff 4d c6 85 60 f6 ff ff 20 c6 85 61 f6 ff ff 6e c6 85 62 f6 ff ff 20 c6 85 63 f6 ff ff 48 c6 85 64 f6 ff ff 20 c6 85 65 f6 ff ff 4d c6 85 66 f6 ff ff 20 c6 85 67 f6 ff ff 1b c6 85 68 f6 ff ff 20 c6 85 69 f6 ff ff 3a c6 85 6a f6 ff ff 20 c6 85 6b f6 ff ff 52 c6 85 6c f6 ff ff 20 c6 85 6d f6 ff ff 47 c6 85 6e f6 ff ff 20 c6 85 6f f6 ff ff 09 c6 85 70 f6 ff ff 20 c6 85 71 f6 ff ff 14 c6 85 72 f6 ff ff 20 c6 85 73 f6 ff ff 7d c6 85 74 f6 ff ff 20 c6 85 75 f6 ff ff 49 c6 85 76 f6 ff ff 20 c6 85 77 f6 ff ff 74 c6 85 78 f6 ff ff 20 c6 85 79 f6 ff ff 1f c6 85 7a f6 ff ff 20 c6 85 7b f6 ff ff 52 c6 85 7c f6 ff ff 20 c6 85 7d f6 ff ff 71 c6 85 7e f6 ff ff 20 c6 85 7f f6 ff ff 5f c6 85 80 f6 ff ff 20 c6 85 81 f6 ff ff 1f c6 85 82 f6 ff ff 20 c6 85 83 f6 ff ff 54 c6 85 84 f6 ff ff 20 c6 85 85 f6 ff ff 33 c6 85 86 f6 ff ff 20 c6 85 87 f6 ff ff 5e c6 85 88 f6 ff ff 20 c6 85 89 f6 ff ff 44 c6 85 8a f6 ff ff 20 c6 85 8b f6 ff ff 0f c6 85 8c f6 ff ff 20 c6 85 8d f6 ff ff 52 c6 85 8e f6 ff ff 20 c6 85 8f f6 ff ff 74 c6 85 90 f6 ff ff 20 c6 85 91 f6 ff ff 13 c6 85 92 f6 ff ff 20 c6 85 93 f6 ff ff 33 c6 85 94 f6 ff ff 20 c6 85 95 f6 ff ff 5e c6 85 96 f6 ff ff 20 c6 85 97 f6 ff ff 52 c6 85 98 f6 ff ff 20 c6 85 99 f6 ff ff 47 c6 85 9a f6 ff ff 20 c6 85 9b f6 ff ff 31 c6 85 9c f6 ff ff 20 c6 85 9d f6 ff ff 5b c6 85 9e f6 ff ff 20 c6 85 9f f6 ff ff 1b c6 85 a0 f6 ff ff 20 c6 85 a1 f6 ff ff 39 c6 85 a2 f6 ff ff 20 c6 85 a3 f6 ff ff 33 c6 85 a4 f6 ff ff 20 c6 85 a5 f6 ff ff 2a c6 85 a6 f6 ff ff 20 c6 85 a7 f6 ff ff 33 c6 85 a8 f6 ff ff 20 c6 85 a9 f6 ff ff 4d c6 85 aa f6 ff ff 20 c6 85 ab f6 ff ff 1f c6 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >100KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 100KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_Ran_Ranzylocker_Hunting_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect RanzyLocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "0d0c743b-9beb-5413-b5ba-dad75c2ee0b7"
+		id = "1e6292a5-5b3a-5135-a479-baa73dc64e67"
 		date = "2021-03-16"
 		modified = "2021-03-17"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-16/RanzyLocker/Ran_RanzyLocker_Hunting_Mar_2021_1.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "ec7867e40e4418bb662c8cf5a71566cd261d2040ee5d3afa0bbe2b92ebfef98e"
+		logic_hash = "v1_sha256_ec7867e40e4418bb662c8cf5a71566cd261d2040ee5d3afa0bbe2b92ebfef98e"
 		score = 50
 		quality = 53
 		tags = "FILE"
@@ -204549,20 +204579,20 @@ rule ARKBIRD_SOLG_Ran_Ranzylocker_Hunting_Mar_2021_1 : FILE
 		$s13 = { 37 32 36 35 36 31 36 34 36 44 36 35 32 45 37 34 37 38 37 34 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 10 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 10 of ( $s* )
 }
 rule ARKBIRD_SOLG_Ran_Pay2Key_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect Pay2Key ransomware"
 		author = "Arkbird_SOLG"
-		id = "440b8128-4708-54ba-94c3-c0b522004da6"
+		id = "1f7fa8d6-1b1d-5cea-8746-60a9d7a6779b"
 		date = "2020-12-01"
 		modified = "2020-12-14"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-14/Pay2Key/Ran_Pay2Key_Nov_2020_1.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "f1ea1ed141ba7a1eaaa34c216adebfacaa23ef8776a0216b778ccb34bd000590"
+		logic_hash = "v1_sha256_f1ea1ed141ba7a1eaaa34c216adebfacaa23ef8776a0216b778ccb34bd000590"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204588,20 +204618,20 @@ rule ARKBIRD_SOLG_Ran_Pay2Key_Nov_2020_1 : FILE
 		$dbg7 = { 5b 2d 5d 20 43 72 79 70 74 45 6e 63 72 79 70 74 20 66 61 69 6c 65 64 0a }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >500KB and (5 of ($s*) and 4 of ($dbg*))
+		uint16( 0 ) == 0x5a4d and filesize > 500KB and ( 5 of ( $s* ) and 4 of ( $dbg* ) )
 }
 rule ARKBIRD_SOLG_APT_Puzzlemaker_Implant_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect the implant of the PuzzleMaker group"
 		author = "Arkbird_SOLG"
-		id = "9387130c-4474-55bf-9736-09494a5e81b8"
+		id = "81923d73-57b6-52ff-8ef2-b6c556dd96e4"
 		date = "2021-06-10"
 		modified = "2021-11-01"
 		reference = "https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-09/PuzzleMaker/APT_PuzzleMaker_Implant_Jun_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "e54eaaa76b2d370a27a232dee2299266f8b3b82d53da36e35c2a6fcdd7d5b1f7"
+		logic_hash = "v1_sha256_e54eaaa76b2d370a27a232dee2299266f8b3b82d53da36e35c2a6fcdd7d5b1f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204620,20 +204650,20 @@ rule ARKBIRD_SOLG_APT_Puzzlemaker_Implant_Jun_2021_1 : FILE
 		$s6 = { 41 b9 01 00 00 00 c7 44 24 20 00 00 00 f0 45 33 c0 48 8d 4c 24 60 33 d2 ff 15 11 06 04 00 85 c0 74 28 48 8b 4c 24 60 4c 8d 85 b0 00 00 00 ba 20 00 00 00 ff 15 ee 05 04 00 48 8b 4c 24 60 33 d2 85 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 80KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Puzzlemaker_Launcher_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect the launcher of the PuzzleMaker group"
 		author = "Arkbird_SOLG"
-		id = "ae31d9de-8e6c-5c1b-bc45-bc4e50cea00f"
+		id = "933f832a-193d-5ee2-a032-959f88505767"
 		date = "2021-06-10"
 		modified = "2021-11-01"
 		reference = "https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-09/PuzzleMaker/APT_PuzzleMaker_Launcher_Jun_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "5c717ca5c57a86e1b5db45b3d581a45be248d45820c00c40c57a001ac07ce1b2"
+		logic_hash = "v1_sha256_5c717ca5c57a86e1b5db45b3d581a45be248d45820c00c40c57a001ac07ce1b2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204650,7 +204680,7 @@ rule ARKBIRD_SOLG_APT_Puzzlemaker_Launcher_Jun_2021_1 : FILE
 		$s6 = { 33 d2 33 c9 41 b8 3f 00 0f 00 ff 15 f4 46 01 00 48 8b f8 48 85 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 80KB and 5 of ( $s* )
 }
 import "pe"
 
@@ -204659,13 +204689,13 @@ rule ARKBIRD_SOLG_APT_Patchwork_Tool_CVE_2019_0808_1 : FILE
 	meta:
 		description = "Detect CVE 2019-0808 tool used by Patchwork group"
 		author = "Arkbird_SOLG"
-		id = "169255fe-dd7a-5a4e-8f0f-d84a0cf5c684"
+		id = "21cf3a2e-7acb-54fe-9021-a307feb7c1b7"
 		date = "2020-08-27"
 		modified = "2021-07-13"
 		reference = "https://blog.exodusintel.com/2019/05/17/windows-within-windows/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-27/APT_Patchwork_Tool_CVE_2019_0808_1.yar#L3-L34"
 		license_url = "N/A"
-		logic_hash = "e66df5d69d64c00cb68ff7bea0f7a7eec6657aff83d0f6cdb48d908bae8bcec8"
+		logic_hash = "v1_sha256_e66df5d69d64c00cb68ff7bea0f7a7eec6657aff83d0f6cdb48d908bae8bcec8"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -204695,20 +204725,20 @@ rule ARKBIRD_SOLG_APT_Patchwork_Tool_CVE_2019_0808_1 : FILE
 		$s17 = "[!] SetWindowLongA malicious error: 0x%08X" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >70KB and (pe.imphash()=="d4a5e8c255211639195793920eeda70f" and 2 of ($asm*) and 12 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize > 70KB and ( pe.imphash ( ) == "d4a5e8c255211639195793920eeda70f" and 2 of ( $asm* ) and 12 of ( $s* ) )
 }
 rule ARKBIRD_SOLG_EXP_CVE_2021_42321_Nov_2021_1 : CVE_2021_42321 FILE
 {
 	meta:
 		description = "Detect CVE-2021-42321 exploit tool"
 		author = "Arkbird_SOLG"
-		id = "2efd58a1-e5c3-5596-b5fd-f6e2fe0ab620"
+		id = "08def8e1-f5f6-5af3-a3be-553491572641"
 		date = "2021-11-21"
 		modified = "2021-11-21"
 		reference = "https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-21/EXP_CVE_2021_42321_Nov_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "bf45f240875f3c3ab729fe623b6c97d0540c0d7d3e9b2e4beb88af6922f8a643"
+		logic_hash = "v1_sha256_bf45f240875f3c3ab729fe623b6c97d0540c0d7d3e9b2e4beb88af6922f8a643"
 		score = 50
 		quality = 67
 		tags = "CVE-2021-42321, FILE"
@@ -204725,20 +204755,20 @@ rule ARKBIRD_SOLG_EXP_CVE_2021_42321_Nov_2021_1 : CVE_2021_42321 FILE
 		$s5 = { 6d 56 6a 64 45 52 68 64 47 46 51 63 6d 39 32 61 57 52 6c 63 6a 34 4e 43 69 41 67 49 43 41 38 54 32 4a 71 5a 57 4e 30 52 47 46 30 59 56 42 79 62 33 5a 70 5a 47 56 79 49 48 67 36 53 32 56 35 50 53 4a 7a 5a 58 52 4e 5a 58 52 6f 62 32 51 69 49 45 39 69 61 6d 56 6a 64 45 6c 75 63 33 52 68 62 6d 4e 6c 50 53 4a 37 65 44 70 54 64 47 46 30 61 57 4d 67 59 7a 70 44 62 32 35 6d 61 57 64 31 63 6d 46 30 61 57 }
 
 	condition:
-		filesize >3KB and 4 of them
+		filesize > 3KB and 4 of them
 }
 rule ARKBIRD_SOLG_MAL_ELF_Vermilion_Strike_Sep_2021_1 : FILE
 {
 	meta:
 		description = "Detect the ELF version of Vermilion Strike implant"
 		author = "Arkbird_SOLG"
-		id = "bfc498b6-4d3d-5ae9-a360-d31f8cf6c5fc"
+		id = "694511de-c933-5c59-9f88-8fd2feb855ae"
 		date = "2021-09-14"
 		modified = "2021-09-16"
 		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_ELF_Vermilion_Strike_Sep_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "fe4bb6da7b29f1ae7c25a657d27f5e60ffa0e7d9f1f09a5a2331e4a80eb79481"
+		logic_hash = "v1_sha256_fe4bb6da7b29f1ae7c25a657d27f5e60ffa0e7d9f1f09a5a2331e4a80eb79481"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -204755,20 +204785,20 @@ rule ARKBIRD_SOLG_MAL_ELF_Vermilion_Strike_Sep_2021_1 : FILE
 		$s5 = { b8 02 00 00 00 48 89 fb 48 83 ec 10 66 89 04 25 00 00 00 00 e8 a6 4e ff ff 83 f8 ff 89 04 24 74 16 89 04 25 04 00 00 00 b8 01 00 00 00 48 83 c4 10 5b c3 0f 1f 40 00 48 89 df e8 f0 4e ff ff 48 89 c1 31 c0 48 85 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >30KB and 4 of them
+		uint32( 0 ) == 0x464c457f and filesize > 30KB and 4 of them
 }
 rule ARKBIRD_SOLG_MAL_Beacon_Vermilion_Strike_Sep_2021_1 : FILE
 {
 	meta:
 		description = "Detect the windows version of the beacon of Vermilion Strike implant"
 		author = "Arkbird_SOLG"
-		id = "61bb0f02-0eb3-5abe-a2fc-65b94a9486f7"
+		id = "981b6997-7403-5062-b7d7-518d2433eb92"
 		date = "2021-09-14"
 		modified = "2021-09-16"
 		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_Beacon_Vermilion_Strike_Sep_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "801d93fc250666a48fbdd504c8bacab74f0bf7f534a7301a20ad79df3b41750d"
+		logic_hash = "v1_sha256_801d93fc250666a48fbdd504c8bacab74f0bf7f534a7301a20ad79df3b41750d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204786,20 +204816,20 @@ rule ARKBIRD_SOLG_MAL_Beacon_Vermilion_Strike_Sep_2021_1 : FILE
 		$s5 = { a1 c0 72 03 10 33 c4 89 44 24 2c 68 00 00 00 f0 6a 18 6a 00 6a 00 68 4c 97 03 10 ff 15 30 a0 02 10 85 c0 75 11 33 c0 8b 4c 24 2c 33 cc e8 [2] 00 00 83 c4 30 c3 8b 15 58 97 03 10 8b 0d 54 97 03 10 68 50 97 03 10 6a 00 33 c0 6a 00 66 89 44 24 1e a1 5c 97 03 10 89 54 24 2c 6a 1c 8d 54 24 20 89 44 24 34 a1 4c 97 03 10 89 4c 24 2c 8b 0d 60 97 03 10 52 50 c6 44 24 28 08 c6 44 24 29 02 c7 44 24 2c 0e 66 00 00 c7 44 24 30 10 00 00 00 89 4c 24 40 ff 15 2c a0 02 10 85 c0 74 87 8b 0d 50 97 03 10 56 8b 35 38 a0 02 10 6a 00 68 ?? 82 03 10 6a 01 51 c7 44 24 18 01 00 00 00 c7 44 24 20 01 00 00 00 ff d6 85 c0 74 2b a1 50 97 03 10 6a 00 8d 54 24 0c 52 6a 03 50 ff d6 85 c0 74 16 8b 15 50 97 03 10 6a 00 8d 4c 24 14 51 6a 04 52 ff d6 85 c0 75 12 33 c0 5e 8b 4c 24 2c 33 cc e8 [2] 00 00 83 c4 30 c3 8b 15 50 97 03 10 6a }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >30KB and 4 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 30KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Stager_Vermilion_Strike_Sep_2021_1 : FILE
 {
 	meta:
 		description = "Detect the windows version of the stager of Vermilion Strike implant"
 		author = "Arkbird_SOLG"
-		id = "7a8ae258-1fb4-5a24-b69e-3a632e00bfae"
+		id = "d3368bbe-5cec-553f-a31e-91443c2c6848"
 		date = "2021-09-14"
 		modified = "2021-09-16"
 		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_Stager_Vermilion_Strike_Sep_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "cc4d59c92faba1f3435c8454071a1e1c60b6339393796c76e64b890bb85d13cc"
+		logic_hash = "v1_sha256_cc4d59c92faba1f3435c8454071a1e1c60b6339393796c76e64b890bb85d13cc"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -204815,20 +204845,20 @@ rule ARKBIRD_SOLG_MAL_Stager_Vermilion_Strike_Sep_2021_1 : FILE
 		$s4 = { 8d 44 24 18 50 8d 4c 24 18 51 6a 1f 53 c7 44 24 28 04 00 00 00 ff 15 3c 21 41 00 81 4c 24 14 00 01 00 00 6a 04 8d 54 24 18 52 6a 1f 53 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >30KB and 3 of them
+		uint16( 0 ) == 0x5A4D and filesize > 30KB and 3 of them
 }
 rule ARKBIRD_SOLG_RAN_ELF_Hellokitty_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect HelloKitty ransomware"
 		author = "Arkbird_SOLG"
-		id = "3e83f07a-0ee7-5381-9aba-2606c01b9d91"
+		id = "05a704f4-5a2e-5ce7-9000-7f73b1de1b5c"
 		date = "2021-08-14"
 		modified = "2021-08-14"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-14/HelloKitty/RAN_ELF_HelloKitty_Aug_2021_1.yara#L1-L17"
 		license_url = "N/A"
-		logic_hash = "99816756ea0a680eb25da192c9f069082f6479befe4e50188ad8f90b323d1f2d"
+		logic_hash = "v1_sha256_99816756ea0a680eb25da192c9f069082f6479befe4e50188ad8f90b323d1f2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204843,22 +204873,20 @@ rule ARKBIRD_SOLG_RAN_ELF_Hellokitty_Aug_2021_1 : FILE
 		$seq3 = { 48 8d b4 24 90 00 00 00 bf d0 4a 61 00 48 c7 84 24 98 00 00 00 00 00 00 00 48 c7 84 24 90 00 00 00 01 00 00 00 e8 [2] ff ff e8 ?? 22 00 00 89 44 24 08 8b 05 [2] 21 00 89 d9 44 8b 0d [2] 21 00 44 8b 05 [2] 21 00 ba ?? 0e 41 00 48 8b 3d [2] 21 00 be 01 00 00 00 89 04 24 31 c0 e8 ?? f8 ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 31 f6 ba 0a 00 00 00 bf 40 4a 61 00 e8 ?? fa ff ff ba 0a 00 00 00 31 f6 bf 20 4a 61 00 e8 ?? fa ff ff be 01 00 00 00 bf 11 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 14 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 16 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 15 00 00 00 e8 [2] ff ff 83 3d ?? 28 21 00 00 }
 
 	condition:
-		uint32(0)==0x464C457F and filesize >20KB and all of ($seq*)
+		uint32( 0 ) == 0x464C457F and filesize > 20KB and all of ( $seq* )
 }
-import "pe"
-
 rule ARKBIRD_SOLG_APT_MAL_NK_Rivts_Feb_2009_1 : FILE
 {
 	meta:
 		description = "Detect Rivts malware used by NK APT"
 		author = "Arkbird_SOLG"
-		id = "71dacbd4-36bb-5a45-a288-31bfaef784dc"
+		id = "87c4fe91-da12-5757-a5a0-6fbed92cd76c"
 		date = "2020-06-17"
 		modified = "2020-06-18"
 		reference = "https://twitter.com/Arkbird_SOLG/status/1272674621381361672"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-07/NK_Rivts_Feb_2009_1.yar#L3-L22"
 		license_url = "N/A"
-		logic_hash = "aab3e8067933cbaef2725b5db9e744df2e2be0a89aaf7ce85df79c5f45d72d8f"
+		logic_hash = "v1_sha256_aab3e8067933cbaef2725b5db9e744df2e2be0a89aaf7ce85df79c5f45d72d8f"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -204876,20 +204904,20 @@ rule ARKBIRD_SOLG_APT_MAL_NK_Rivts_Feb_2009_1 : FILE
 		$s9 = { 2f 2f 2f 2f 44 41 45 4d 4f 4e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 7 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 7 of them
 }
 rule ARKBIRD_SOLG_APT_Sidewinder_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect Sidewinder DLL decoder algorithm"
 		author = "Arkbird_SOLG"
-		id = "9e948949-f38d-5a76-a34c-965ec9be070d"
+		id = "4e574344-ce5d-5572-9953-368a529ff207"
 		date = "2020-11-14"
 		modified = "2020-11-15"
 		reference = "https://twitter.com/hexfati/status/1325397305051148292"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-15/APT_SideWinder_Nov_2020_1.yar#L1-L12"
 		license_url = "N/A"
-		logic_hash = "661eb5510ff0aa59b38b2c023653f0a23867a2813d854fbd0a7a6b657d9ba671"
+		logic_hash = "v1_sha256_661eb5510ff0aa59b38b2c023653f0a23867a2813d854fbd0a7a6b657d9ba671"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -204899,7 +204927,7 @@ rule ARKBIRD_SOLG_APT_Sidewinder_Nov_2020_1 : FILE
 		$s = { 13 30 05 00 ?? 00 00 00 01 00 00 11 ?? ?? 00 00 ?? ?? ?? 00 00 [30-80] 2B 16 07 08 8F 1? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >3KB and $s
+		uint16( 0 ) == 0x5a4d and filesize > 3KB and $s
 }
 import "pe"
 
@@ -204908,13 +204936,13 @@ rule ARKBIRD_SOLG_Ransom_Ragnarlocker_July_2020_1 : FILE
 	meta:
 		description = "Detect Ragnarlocker by strings (July 2020)"
 		author = "Arkbird_SOLG"
-		id = "9291ed33-8d7d-5b88-9075-b847fdbab179"
+		id = "24d2de5b-fa1b-52b7-b7f5-8e178a33248c"
 		date = "2020-07-30"
 		modified = "2020-07-30"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1288797666688851969"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-30/Yara_Ransom_Ragnarlocker_July_2020_1.yar#L3-L34"
 		license_url = "N/A"
-		logic_hash = "73d3be9a2d3b315ed6d3d93e2c6f9988d60234530b0398e8949c511f919a8954"
+		logic_hash = "v1_sha256_73d3be9a2d3b315ed6d3d93e2c6f9988d60234530b0398e8949c511f919a8954"
 		score = 75
 		quality = 23
 		tags = "FILE"
@@ -204944,20 +204972,20 @@ rule ARKBIRD_SOLG_Ransom_Ragnarlocker_July_2020_1 : FILE
 		$s4 = "Tor browser" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and (pe.imphash()=="2c2aab89a4cba444cf2729e2ed61ed4f" and ((2 of ($f*)) and (3 of ($r*)) and (4 of ($a*)) and (2 of ($c*)) and (2 of ($s*))))
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and ( pe.imphash ( ) == "2c2aab89a4cba444cf2729e2ed61ed4f" and ( ( 2 of ( $f* ) ) and ( 3 of ( $r* ) ) and ( 4 of ( $a* ) ) and ( 2 of ( $c* ) ) and ( 2 of ( $s* ) ) ) )
 }
 rule ARKBIRD_SOLG_EXF_Exmatter_Nov_2021_1 : FILE
 {
 	meta:
 		description = "Detect packed Exmatter with Confuser"
 		author = "Arkbird_SOLG"
-		id = "ddae7776-3202-50e6-b8af-0e5d15373386"
+		id = "6d0978e2-20fb-5be3-b21c-c5e3952a7fd6"
 		date = "2021-11-01"
 		modified = "2021-11-01"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Exmatter/EXF_Exmatter_Nov_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "67aaac3db488a9e28897047a7498b7a447ec63cdb6da82cb3d4217c7d615f176"
+		logic_hash = "v1_sha256_67aaac3db488a9e28897047a7498b7a447ec63cdb6da82cb3d4217c7d615f176"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -204977,20 +205005,20 @@ rule ARKBIRD_SOLG_EXF_Exmatter_Nov_2021_1 : FILE
 		$s6 = "SSH_MSG_KEX_DH_GEX_INIT" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >600KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize > 600KB and 5 of them
 }
 rule ARKBIRD_SOLG_MAL_Phoenix_Stealer_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Phoenix Stealer"
 		author = "Arkbird_SOLG"
-		id = "8c9df216-cbfe-51f3-a6d7-cfeb99fafbe0"
+		id = "5a78a5dd-55d9-513e-b822-15845ab967b4"
 		date = "2021-11-01"
 		modified = "2021-11-01"
 		reference = "https://twitter.com/3xp0rtblog/status/1455111070566207493/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Phoenix_Stealer/MAL_Phoenix_Stealer_Jun_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "989c2518a42201559265ce4b974b35df5c4b8365e53f789fc124ee969e747c87"
+		logic_hash = "v1_sha256_989c2518a42201559265ce4b974b35df5c4b8365e53f789fc124ee969e747c87"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205008,20 +205036,20 @@ rule ARKBIRD_SOLG_MAL_Phoenix_Stealer_Jun_2021_1 : FILE
 		$s5 = { 81 ec 14 02 00 00 a1 0c 50 48 00 33 c5 89 45 fc 53 56 8b d9 be 19 27 00 00 57 8b 7d 0c 83 fb ff 75 0c e8 bb eb ff ff 89 37 89 47 04 eb 17 ff 75 08 52 53 ff 15 bc 22 47 00 85 c0 8b cf 0f 95 c2 e8 b8 fe ff ff e8 98 eb ff ff 8b 4f 04 8b 49 04 3b 48 04 75 08 81 3f 34 27 00 00 74 20 e8 80 eb ff ff 8b 4f 04 8b 49 04 3b 48 04 0f 85 b9 00 00 00 81 3f 33 27 00 00 0f 85 ad 00 00 00 83 fb ff 75 0c e8 5b eb ff ff 89 37 e9 99 00 00 00 33 c0 89 9d f8 fd ff ff 40 89 9d fc fe ff ff 89 85 f4 fd ff ff 89 85 f8 fe ff ff 8d 85 f8 fe ff ff 6a 00 50 8d 85 f4 fd ff ff 50 6a 00 8d 43 01 50 ff 15 d8 22 47 00 8b f0 8b cf 85 f6 0f 98 c2 e8 2a fe ff ff 85 f6 78 53 83 a5 f0 fd ff ff 00 8d 85 ec fd ff ff 50 8d 85 f0 fd ff ff c7 85 ec fd ff ff 04 00 00 00 50 68 07 10 00 00 68 ff ff 00 00 53 ff 15 b0 22 47 00 8b f0 8b cf 85 f6 0f 95 c2 e8 e8 fd ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 80KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Decaf_Nov_2021_1 : FILE
 {
 	meta:
 		description = "Detect Decaf ransomware (unpacked UPX)"
 		author = "Arkbird_SOLG"
-		id = "d19b2d31-a6c5-5033-ba43-4e9ccabc37bb"
+		id = "99b6b91c-a24b-5b88-8823-ad51d7d07a83"
 		date = "2021-11-01"
 		modified = "2021-11-02"
 		reference = "https://blog.morphisec.com/decaf-ransomware-a-new-golang-threat-makes-its-appearance"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Decaf/RAN_Decaf_Nov_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "5cea33d710d252b39bcd8ae227f52d10897b7fe58b1ff5226a1cb8cc094d600c"
+		logic_hash = "v1_sha256_5cea33d710d252b39bcd8ae227f52d10897b7fe58b1ff5226a1cb8cc094d600c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205038,20 +205066,20 @@ rule ARKBIRD_SOLG_RAN_Decaf_Nov_2021_1 : FILE
 		$s5 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 43 67 4b 43 41 51 45 41 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >400KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize > 400KB and 4 of them
 }
 rule ARKBIRD_SOLG_Exp_CVE_2021_36934_July_2021_1 : FILE
 {
 	meta:
 		description = "Detect CVE_2021_36934 exploit (HiveNightmare)"
 		author = "Arkbird_SOLG"
-		id = "3a0ed4f7-8a99-569f-a636-4cd64c2121bb"
+		id = "3c5c8458-58b1-5f11-a76f-947a67f4e31c"
 		date = "2021-07-23"
 		modified = "2021-07-23"
 		reference = "https://github.com/GossiTheDog/HiveNightmare"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/HiveNightmare/Exp_CVE_2021_36934_July_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "2fd6cdf8a81f239473716d2c10a1754ebb2c60099eebd9d0cc1450ad3441075b"
+		logic_hash = "v1_sha256_2fd6cdf8a81f239473716d2c10a1754ebb2c60099eebd9d0cc1450ad3441075b"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -205071,20 +205099,20 @@ rule ARKBIRD_SOLG_Exp_CVE_2021_36934_July_2021_1 : FILE
 		$s7 = { 7a d1 3f 99 5c 2d 21 79 f2 21 3d 00 58 ac 30 7a b5 d1 3f 7e 84 ff 62 3e cf 3d 3d }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >50KB and 5 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 50KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Avoslocker_July_2021_1 : FILE
 {
 	meta:
 		description = "Detect AvosLocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "3fbc707f-9802-54bc-933b-bc4c4953b1d0"
+		id = "abb0e629-0917-5223-b9ea-6ca1752638d7"
 		date = "2021-07-23"
 		modified = "2021-07-24"
 		reference = "https://blog.malwarebytes.com/threat-analysis/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/AvosLocker/RAN_AvosLocker_July_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "e2291f574b5ab68e901a76b6511e0ee4c1eee51d5e3eced62bf68ceedb061958"
+		logic_hash = "v1_sha256_e2291f574b5ab68e901a76b6511e0ee4c1eee51d5e3eced62bf68ceedb061958"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205104,20 +205132,20 @@ rule ARKBIRD_SOLG_RAN_Avoslocker_July_2021_1 : FILE
 		$s8 = { 56 68 01 00 00 08 6a 01 52 ff 15 14 a0 44 00 85 c0 0f 84 97 00 00 00 8d 45 f8 50 53 53 6a 06 53 ff 36 8b 1d 20 a0 44 00 ff d3 85 c0 74 73 ff 75 f8 e8 3b a7 01 00 a3 b8 2c 46 00 59 85 c0 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >50KB and 6 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 50KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_Exp_Petitpotam_July_2021_1 : FILE
 {
 	meta:
 		description = "Detect PetitPotam exploit (local exploit version)"
 		author = "Arkbird_SOLG"
-		id = "dd23c77d-9929-5130-aad8-2bcc0a7dcbaa"
+		id = "11cd69f8-ca96-5fd2-9714-827e895f6b55"
 		date = "2021-07-23"
 		modified = "2021-07-24"
 		reference = "https://github.com/topotam/PetitPotam"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/PetitPotam/Exp_PetitPotam_July_2021_1.yara#L1-L24"
 		license_url = "N/A"
-		logic_hash = "a33a1dc2a3593063de2b65e01a770ff5c72ad360d88efdca588eacb8817fb91d"
+		logic_hash = "v1_sha256_a33a1dc2a3593063de2b65e01a770ff5c72ad360d88efdca588eacb8817fb91d"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -205138,20 +205166,20 @@ rule ARKBIRD_SOLG_Exp_Petitpotam_July_2021_1 : FILE
 		$s10 = { 25 00 6c 00 73 00 28 00 25 00 64 00 29 00 20 00 3a 00 20 00 25 00 6c 00 73 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >50KB and 7 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 50KB and 7 of ( $s* )
 }
 rule ARKBIRD_SOLG_WIP_Unk_Wiper_July_2021_1 : FILE
 {
 	meta:
 		description = "Detect unknown wiper that focuses olympic games in Japan"
 		author = "Arkbird_SOLG"
-		id = "a03d558e-399a-506e-8f37-d4907cc68d54"
+		id = "68005d3c-c24d-5c44-bb04-53e3a94370b8"
 		date = "2021-07-22"
 		modified = "2021-07-22"
 		reference = "https://www.mbsd.jp/research/20210721/blog/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-22/WIP_Unk_Wiper_July_2021_1.yara#L1-L29"
 		license_url = "N/A"
-		logic_hash = "32f66fee2547ef33121620b822f86bfdf66ff337909a56aa4f0e8ef83b6d7730"
+		logic_hash = "v1_sha256_32f66fee2547ef33121620b822f86bfdf66ff337909a56aa4f0e8ef83b6d7730"
 		score = 75
 		quality = 40
 		tags = "FILE"
@@ -205178,20 +205206,20 @@ rule ARKBIRD_SOLG_WIP_Unk_Wiper_July_2021_1 : FILE
 		$p9 = { 72 6f 63 65 94 48 61 63 6b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >200KB and (5 of ($s*) or 7 of ($p*))
+		uint16( 0 ) == 0x5a4d and filesize > 200KB and ( 5 of ( $s* ) or 7 of ( $p* ) )
 }
 rule ARKBIRD_SOLG_APT_APT_C_23_Micropsia_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect Micropsia used by APT-C-23 (Build 2018)"
 		author = "Arkbird_SOLG"
-		id = "517a33bb-0214-588f-80e4-dc82f2552330"
+		id = "954d4add-9710-55ae-8162-c118fbd07034"
 		date = "2021-03-31"
 		modified = "2021-03-31"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-31/APT-C-23/APT_APT_C_23_Micropsia_Mar_2021_1.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "69baab88d80ab15e08f3b08dfca45a1fee6c2e6077152906f391618713fac2ef"
+		logic_hash = "v1_sha256_69baab88d80ab15e08f3b08dfca45a1fee6c2e6077152906f391618713fac2ef"
 		score = 50
 		quality = 69
 		tags = "FILE"
@@ -205212,20 +205240,20 @@ rule ARKBIRD_SOLG_APT_APT_C_23_Micropsia_Mar_2021_1 : FILE
 		$s8 = { 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 25 73 0d 0a }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and 2 of ($code*) and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 50KB and 2 of ( $code* ) and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_APT_C_23_Micropsia_Mar_2021_2 : FILE
 {
 	meta:
 		description = "Detect Micropsia used by APT-C-23 (Build 2020)"
 		author = "Arkbird_SOLG"
-		id = "cdd95b35-09b4-5412-bd86-55c2e7523d3e"
+		id = "16eaf75c-e4cf-54f3-8235-2b49ac199270"
 		date = "2021-03-31"
 		modified = "2021-03-31"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-31/APT-C-23/APT_APT_C_23_Micropsia_Mar_2021_2.yar#L1-L26"
 		license_url = "N/A"
-		logic_hash = "a00091161ec69c9885e983117e2b424f860bfbab2551ea23b74c37fc062850b9"
+		logic_hash = "v1_sha256_a00091161ec69c9885e983117e2b424f860bfbab2551ea23b74c37fc062850b9"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -205248,20 +205276,20 @@ rule ARKBIRD_SOLG_APT_APT_C_23_Micropsia_Mar_2021_2 : FILE
 		$s9 = "postHttpDownload" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and 2 of ($code*) and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 50KB and 2 of ( $code* ) and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_ALPHV_Dec_2021_1 : FILE
 {
 	meta:
 		description = "Detect AlphV ransomware (Nov and Dec 2021)"
 		author = "Arkbird_SOLG"
-		id = "5c758dc9-b1dc-58e0-b443-6f78e27ffefe"
+		id = "19db52a3-7f9a-5247-9a96-d65fb755eb0c"
 		date = "2021-12-09"
 		modified = "2021-12-18"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-09/RAN_ALPHV_Dec_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "416ebea98f660dd9fad27c3be0c79e47bc69e08fe4be7db76a71462d2c5ada49"
+		logic_hash = "v1_sha256_416ebea98f660dd9fad27c3be0c79e47bc69e08fe4be7db76a71462d2c5ada49"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205279,20 +205307,20 @@ rule ARKBIRD_SOLG_RAN_ALPHV_Dec_2021_1 : FILE
 		$s4 = { 83 c4 0c c7 45 ?? 00 00 00 00 c7 45 ?? 02 00 00 89 89 75 ?? 8d 45 ?? c7 45 ?? 00 00 00 00 c7 45 ?? 00 00 00 00 6a 10 50 57 e8 [3] 00 83 f8 ff 0f 84 ?? 02 00 00 f6 45 9c ff }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >300KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 300KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect QNAPCrypt ransomware (x86 version)"
 		author = "Arkbird_SOLG"
-		id = "fcdec43a-de70-57a2-9527-263685acc820"
+		id = "ecc5a44e-af37-534a-9fba-7b3e70f4f4c2"
 		date = "2021-08-11"
 		modified = "2021-08-12"
 		reference = "https://bazaar.abuse.ch/browse/tag/QNAPCrypt/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-11/QNAPCrypt/RAN_ELF_QNAPCrypt_Aug_2021_1.yara#L1-L29"
 		license_url = "N/A"
-		logic_hash = "4dbe5241b9f1b68a15193f3d5c7b0b5fac80208c16917b6e543ce407301f1dcf"
+		logic_hash = "v1_sha256_4dbe5241b9f1b68a15193f3d5c7b0b5fac80208c16917b6e543ce407301f1dcf"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -205318,20 +205346,20 @@ rule ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_1 : FILE
 		$x6 = { 53 61 76 65 20 63 75 72 72 20 50 49 44 20 25 64 }
 
 	condition:
-		uint32(0)==0x464C457F and filesize >25KB and 3 of ($s*) and 2 of ($x*)
+		uint32( 0 ) == 0x464C457F and filesize > 25KB and 3 of ( $s* ) and 2 of ( $x* )
 }
 rule ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_2 : FILE
 {
 	meta:
 		description = "Detect QNAPCrypt ransomware (x64 version)"
 		author = "Arkbird_SOLG"
-		id = "8cd54646-87da-5261-82f3-68ab96549379"
+		id = "5b60188f-cd9b-5007-8e9e-94ee428a590b"
 		date = "2021-08-11"
 		modified = "2021-08-12"
 		reference = "https://bazaar.abuse.ch/browse/tag/QNAPCrypt/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-11/QNAPCrypt/RAN_ELF_QNAPCrypt_Aug_2021_2.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "9eb3a499afbaaf2addb8ee12cc2d479ebbacd4d19cc270e995f12e83546008b4"
+		logic_hash = "v1_sha256_9eb3a499afbaaf2addb8ee12cc2d479ebbacd4d19cc270e995f12e83546008b4"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -205350,20 +205378,20 @@ rule ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_2 : FILE
 		$s6 = { 48 81 ec 48 01 00 00 48 89 ac 24 40 01 00 00 48 8d ac 24 40 01 00 00 48 8d 7c 24 38 48 8d 35 [2] 0f 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 [3] ff 48 8b 6d 00 48 8d 05 [2] 02 00 48 89 04 24 48 8b 84 24 50 01 00 00 48 89 44 24 08 48 89 44 24 10 e8 [3] ff 48 8b 44 24 18 48 89 84 24 38 01 00 00 31 c9 eb 18 8b 54 84 38 48 8b 5c 24 30 48 8b 84 24 38 01 00 00 89 14 98 48 8d 4b 01 48 8b 94 24 50 01 00 00 48 39 d1 7d 2c 48 89 4c 24 30 90 48 8b 05 [3] 00 48 89 04 24 48 c7 44 24 08 40 00 00 00 e8 [3] ff 48 8b 44 24 10 48 83 f8 40 72 b1 eb 46 48 c7 04 24 00 00 00 00 48 89 44 24 08 48 89 54 24 10 48 89 54 24 18 e8 [3] ff 48 8b 44 24 28 48 8b 4c 24 20 48 89 8c 24 58 01 00 00 48 89 84 24 60 01 00 00 48 8b ac 24 40 01 00 }
 
 	condition:
-		uint32(0)==0x464C457F and filesize >25KB and all of ($s*)
+		uint32( 0 ) == 0x464C457F and filesize > 25KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_APT_34_Maildrop_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect MailDrop malware used by APT34"
 		author = "Arkbird_SOLG"
-		id = "a17c4e0b-9bbb-594d-8551-5c146e6a601e"
+		id = "6d88a934-f048-58b9-b272-20a877a4d060"
 		date = "2021-04-03"
 		modified = "2021-04-09"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-03/APT34/APT_APT_34_MailDrop_Mar_2021_1.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "f55192044bf8e190dfdc18aeaac543a5022643ea242e75ff2492939ae6e1814c"
+		logic_hash = "v1_sha256_f55192044bf8e190dfdc18aeaac543a5022643ea242e75ff2492939ae6e1814c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205385,20 +205413,20 @@ rule ARKBIRD_SOLG_APT_APT_34_Maildrop_Mar_2021_1 : FILE
 		$s8 = "get_cmdSubject" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 2 of ($EWS*) and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 20KB and 2 of ( $EWS* ) and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Gmera_June_2021_1 : FILE
 {
 	meta:
 		description = "Detect Gmera malware"
 		author = "Arkbird_SOLG"
-		id = "e1234dc9-b42b-5f54-86cb-ad1b13e9e98d"
+		id = "408042c0-2e80-5066-b2cf-d3763fa87876"
 		date = "2021-06-23"
 		modified = "2021-06-24"
 		reference = "https://twitter.com/BushidoToken/status/1407671196322258948"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-23/MAL_Gmera_June_2021_1.yara#L1-L25"
 		license_url = "N/A"
-		logic_hash = "9a08c46e0c4d4dd83c1373dd3d7e78d8ed466d3822816880600be1a7d7d69d99"
+		logic_hash = "v1_sha256_9a08c46e0c4d4dd83c1373dd3d7e78d8ed466d3822816880600be1a7d7d69d99"
 		score = 75
 		quality = 63
 		tags = "FILE"
@@ -205419,20 +205447,20 @@ rule ARKBIRD_SOLG_MAL_Gmera_June_2021_1 : FILE
 		$s8 = { 62 61 73 68 20 2d 69 20 3e 2f 64 65 76 2f 74 63 70 2f [8-25] 30 3e 26 31 }
 
 	condition:
-		( uint32(0)==0xfeedfacf or uint32(0)==0xbebafeca) and filesize >35KB and 5 of ($s*)
+		( uint32( 0 ) == 0xfeedfacf or uint32( 0 ) == 0xbebafeca ) and filesize > 35KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_Mal_Plugx_Thor_July_2021_1 : FILE
 {
 	meta:
 		description = "Detect Thor variant of PlugX (Variant 1)"
 		author = "Arkbird_SOLG"
-		id = "5447e5df-0326-5987-905b-bfc49acee05a"
+		id = "d78870d1-ea30-5648-8aa0-8c81d25e8594"
 		date = "2021-07-27"
 		modified = "2021-07-28"
 		reference = "https://unit42.paloaltonetworks.com/thor-plugx-variant/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-27/PlugX/Mal_PlugX_Thor_July_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "f94e6cf8a1169526a438dfbf4d6b40f4ce0f6af6eee2e893fb138b81c4172c73"
+		logic_hash = "v1_sha256_f94e6cf8a1169526a438dfbf4d6b40f4ce0f6af6eee2e893fb138b81c4172c73"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205449,20 +205477,20 @@ rule ARKBIRD_SOLG_Mal_Plugx_Thor_July_2021_1 : FILE
 		$s3 = { fe ff ff 6a 40 68 00 10 00 00 8b 95 ?? fe ff ff 52 6a 00 ff 95 ?? fe ff ff 89 85 ?? fe ff ff }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 25KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Piton_Nov_2021_1 : FILE
 {
 	meta:
 		description = "Detect Piton variant (rebuild from the Babuk leaks)"
 		author = "Arkbird_SOLG"
-		id = "433d0692-553b-5efe-84e4-134e99342fe5"
+		id = "9ed27d68-2d07-5579-9807-7cc9137fcf81"
 		date = "2021-11-03"
 		modified = "2021-11-04"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-04/RAN_Piton_Nov_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "cd8287b3be0f8f9338cf6ba8eb24dd9a6f91a54c984a635e1103f7e6028cbf3c"
+		logic_hash = "v1_sha256_cd8287b3be0f8f9338cf6ba8eb24dd9a6f91a54c984a635e1103f7e6028cbf3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205478,20 +205506,20 @@ rule ARKBIRD_SOLG_RAN_Piton_Nov_2021_1 : FILE
 		$s3 = { 81 ec f4 02 00 00 c7 85 7c ff ff ff 90 15 40 00 c7 45 80 98 15 40 00 c7 45 84 a0 15 40 00 c7 45 88 a8 15 40 00 c7 45 8c b0 15 40 00 c7 45 90 b8 15 40 00 c7 45 94 c0 15 40 00 c7 45 98 c8 15 40 00 c7 45 9c d0 15 40 00 c7 45 a0 d8 15 40 00 c7 45 a4 e0 15 40 00 c7 45 a8 e8 15 40 00 c7 45 ac f0 15 40 00 c7 45 b0 f8 15 40 00 c7 45 b4 00 16 40 00 c7 45 b8 08 16 40 00 c7 45 bc 10 16 40 00 c7 45 c0 18 16 40 00 c7 45 c4 20 16 40 00 c7 45 c8 28 16 40 00 c7 45 cc 30 16 40 00 c7 45 d0 38 16 40 00 c7 45 d4 40 16 40 00 c7 45 d8 48 16 40 00 c7 45 dc 50 16 40 00 c7 45 e0 58 16 40 00 c7 45 fc 00 00 00 00 c7 45 e4 78 00 00 00 c7 45 e8 00 00 00 00 c7 45 f4 00 00 00 00 eb 09 8b 45 f4 83 c0 01 89 45 f4 83 7d f4 1a 7d 35 8b 4d f4 8b 94 8d 7c ff ff ff 52 ff 15 f8 50 41 00 83 f8 01 75 1d 8b 45 fc 8b 4d f4 8b 94 8d 7c ff ff ff 89 94 85 14 ff ff ff 8b 45 fc 83 c0 01 89 45 fc eb bc b9 02 00 00 00 6b d1 00 33 c0 66 89 84 15 0c fd ff ff 68 00 00 01 00 e8 00 e8 00 00 83 c4 04 89 45 f8 83 7d f8 00 0f 84 d4 00 00 00 68 00 00 01 00 e8 e6 e7 00 00 83 c4 04 89 45 ec 83 7d ec 00 0f 84 ae 00 00 00 68 00 80 00 00 8b 4d f8 51 ff 15 08 51 41 00 89 45 f0 83 7d fc 00 76 63 8d 55 e8 52 8b 45 e4 50 8d 8d 0c fd ff ff 51 8b 55 f8 52 ff 15 f4 50 41 00 85 c0 74 26 8d 85 0c fd ff ff 50 ff 15 40 50 41 00 83 f8 03 75 14 b9 02 00 00 00 6b d1 00 33 c0 66 89 84 15 0c fd ff ff eb 22 8b 4d fc 83 e9 01 89 4d fc 8b 55 f8 52 8b 45 fc 8b 8c 85 14 ff ff ff 51 ff 15 44 50 41 00 eb 02 eb 1b 68 00 80 00 00 8b 55 f8 52 8b 45 f0 50 ff 15 00 51 41 00 85 c0 0f 85 7a ff ff ff 8b 4d f0 51 ff 15 fc 50 41 00 8b 55 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and all of them
 }
 rule ARKBIRD_SOLG_APT_Oilrig_VBS_2016_1 : FILE
 {
 	meta:
 		description = "Detect VBS script in base 64 used by OilRig (2016)"
 		author = "Arkbird_SOLG"
-		id = "5cc3a3f1-4f2f-56c4-af69-8652d22b6730"
+		id = "4135061c-b665-508b-9550-5fd7f4182252"
 		date = "2020-08-26"
 		modified = "2021-07-13"
 		reference = "https://twitter.com/Arkbird_SOLG/status/1298758788028264450"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-26/APT_OilRig_2016.yar#L4-L23"
 		license_url = "N/A"
-		logic_hash = "a6c42c46c80ca79b01aa0475c823aeccef416a0f8c2f58db95392cbe125b2fad"
+		logic_hash = "v1_sha256_a6c42c46c80ca79b01aa0475c823aeccef416a0f8c2f58db95392cbe125b2fad"
 		score = 75
 		quality = 63
 		tags = "FILE"
@@ -205509,20 +205537,20 @@ rule ARKBIRD_SOLG_APT_Oilrig_VBS_2016_1 : FILE
 		$block8 = { 0a b7 9a b5 e3 9b 8d e7 2d 59 27 2b 8a 9b 52 85 e9 65 46 e9 [1-4] d4 }
 
 	condition:
-		filesize <2KB and 6 of them
+		filesize < 2KB and 6 of them
 }
 rule ARKBIRD_SOLG_APT_Oilrig_PSH_Helminth_2016_1 : FILE
 {
 	meta:
 		description = "Detect Powershell script Helminth in base 64 used by OilRig (2016)"
 		author = "Arkbird_SOLG"
-		id = "782503c2-a292-505c-b513-79cbbd381124"
+		id = "80917ff4-48c4-5cb7-98c5-40e214a0e82f"
 		date = "2020-08-26"
 		modified = "2021-07-13"
 		reference = "https://twitter.com/Arkbird_SOLG/status/1298758788028264450"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-26/APT_OilRig_2016.yar#L25-L45"
 		license_url = "N/A"
-		logic_hash = "0216015765f5abdb6ccf7643344aead51e4eebb19fd947f9484ce5dc6696d4d5"
+		logic_hash = "v1_sha256_0216015765f5abdb6ccf7643344aead51e4eebb19fd947f9484ce5dc6696d4d5"
 		score = 75
 		quality = 61
 		tags = "FILE"
@@ -205541,22 +205569,20 @@ rule ARKBIRD_SOLG_APT_Oilrig_PSH_Helminth_2016_1 : FILE
 		$block9 = { 73 67 44 51 6f 4a 43 57 31 6b 49 43 31 47 62 33 4a 6a 5a 53 41 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 72 4a 33 52 77 58 43 63 70 49 41 30 4b 43 51 6c 48 5a 58 52 4a 52 43 41 4e 43 67 6b 4a 51 32 68 68 62 6d 64 6c 56 47 68 70 63 30 5a 70 62 47 55 67 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 6c 6b 49 41 30 4b 49 43 41 67 49 48 30 67 44 51 6f 67 66 53 41 4e 43 69 42 6d 64 57 35 6a 64 47 6c 76 62 69 42 74 59 57 6c 75 49 41 30 4b }
 
 	condition:
-		filesize <3KB and 7 of them
+		filesize < 3KB and 7 of them
 }
-import "pe"
-
 rule ARKBIRD_SOLG_APT_MAL_NK_Lazarus_Dacls_June_2020_1 : FILE
 {
 	meta:
 		description = "Detect DACLS malware used by APT Lazarus"
 		author = "Arkbird_SOLG"
-		id = "fb85b83a-4367-5f1d-be06-8a8e906b8df7"
+		id = "6734217e-c9e6-5cc1-b041-24391f9b4c52"
 		date = "2020-06-11"
 		modified = "2020-06-12"
 		reference = "https://twitter.com/batrix20/status/1270924079826997248"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-12/Lazarus/Lazarus_June_2020_1.yar#L3-L26"
 		license_url = "N/A"
-		logic_hash = "ed3e4a7a0490c5e8854d4e1bc8a223658ab9657a03c1b237af1056293a51611b"
+		logic_hash = "v1_sha256_ed3e4a7a0490c5e8854d4e1bc8a223658ab9657a03c1b237af1056293a51611b"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -205577,7 +205603,7 @@ rule ARKBIRD_SOLG_APT_MAL_NK_Lazarus_Dacls_June_2020_1 : FILE
 		$s12 = "@dyld_stub_binder" fullword ascii
 
 	condition:
-		uint16(0)==0xfacf and filesize <200KB and 10 of them
+		uint16( 0 ) == 0xfacf and filesize < 200KB and 10 of them
 }
 import "pe"
 
@@ -205586,13 +205612,13 @@ rule ARKBIRD_SOLG_APT_MAL_NK_Lazarus_Nukesped_June_2020_1 : FILE
 	meta:
 		description = "Detect NukeSped malware used by APT Lazarus"
 		author = "Arkbird_SOLG"
-		id = "7a5b27df-43bd-544d-8d0f-72e58ce3064c"
+		id = "35d56d43-c7f5-52d9-b733-68262575026f"
 		date = "2020-06-11"
 		modified = "2020-06-12"
 		reference = "https://twitter.com/batrix20/status/1270924079826997248"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-12/Lazarus/Lazarus_June_2020_1.yar#L28-L54"
 		license_url = "N/A"
-		logic_hash = "b1332eb255f8ae9ae6a68ef8ef86d9f5472584cae8161c27186e341990df7eae"
+		logic_hash = "v1_sha256_b1332eb255f8ae9ae6a68ef8ef86d9f5472584cae8161c27186e341990df7eae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205616,20 +205642,20 @@ rule ARKBIRD_SOLG_APT_MAL_NK_Lazarus_Nukesped_June_2020_1 : FILE
 		$s15 = "GetLogicalDrives" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="c8379f0eeeb3a522f1dd75aa5f1500b0" or 12 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "c8379f0eeeb3a522f1dd75aa5f1500b0" or 12 of them )
 }
 rule ARKBIRD_SOLG_MAL_Netfilter_Dropper_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect the dropper of Netfilter rootkit"
 		author = "Arkbird_SOLG"
-		id = "5e67c99c-6b08-5190-9c8a-55086c20923e"
+		id = "d5891751-e006-50e1-813a-28919c578675"
 		date = "2020-06-18"
 		modified = "2021-06-18"
 		reference = "https://twitter.com/struppigel/status/1405483373280235520"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-18/Netfilter/MAL_Netfilter_Dropper_Jun_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "66e96304e097a0f6cd99cf77b20f61b8a0bcceaf8685a336c039a80947a08f78"
+		logic_hash = "v1_sha256_66e96304e097a0f6cd99cf77b20f61b8a0bcceaf8685a336c039a80947a08f78"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205647,20 +205673,20 @@ rule ARKBIRD_SOLG_MAL_Netfilter_Dropper_Jun_2021_1 : FILE
 		$s3 = "\\\\.\\netfilter" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and ( all of ($seq*) or 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize > 6KB and ( all of ( $seq* ) or 2 of ( $s* ) )
 }
 rule ARKBIRD_SOLG_MAL_Netfilter_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect Netfilter rootkit"
 		author = "Arkbird_SOLG"
-		id = "da333ed8-8cd3-5ae4-bce5-a43a227fdee3"
+		id = "6ae039aa-45b0-5e55-b87d-09519d7a78d8"
 		date = "2021-06-18"
 		modified = "2021-06-21"
 		reference = "https://twitter.com/struppigel/status/1405483373280235520"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-18/Netfilter/MAL_Netfilter_May_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "f219981af907f74e4d95f768d99b7fd877c8bfb00587d198a4b0e2c521c744e1"
+		logic_hash = "v1_sha256_f219981af907f74e4d95f768d99b7fd877c8bfb00587d198a4b0e2c521c744e1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -205680,20 +205706,20 @@ rule ARKBIRD_SOLG_MAL_Netfilter_May_2021_1 : FILE
 		$s3 = "NETIO.SYS" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and (3 of ($seq*) or 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize > 20KB and ( 3 of ( $seq* ) or 2 of ( $s* ) )
 }
 rule ARKBIRD_SOLG_APT_Lazarus_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect a variant of NukeSped malware"
 		author = "Arkbird_SOLG"
-		id = "0f5d42c0-d6dc-573b-9227-787ccbcaa83d"
+		id = "21580087-d6e2-512a-8925-905e6f1a7dab"
 		date = "2021-06-19"
 		modified = "2021-06-21"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-19/Lazarus/APT_Lazarus_Jun_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "ea4ce93d54b9b8e5d1d5bb64d37ac26839e2fa3200da3057597d83c4be6d129f"
+		logic_hash = "v1_sha256_ea4ce93d54b9b8e5d1d5bb64d37ac26839e2fa3200da3057597d83c4be6d129f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205711,20 +205737,20 @@ rule ARKBIRD_SOLG_APT_Lazarus_Jun_2021_1 : FILE
 		$seq5 = { 48 89 5c 24 10 48 89 74 24 18 48 89 7c 24 20 55 48 8d ac 24 70 f2 ff ff 48 81 ec 90 0e 00 00 48 8b 05 da ed 01 00 48 33 c4 48 89 85 80 0d 00 00 48 8b f1 48 8d 8d 81 05 00 00 33 d2 41 b8 ff 07 00 00 c6 85 80 05 00 00 00 e8 b2 4a 00 00 48 8d 4d 71 33 d2 41 b8 03 01 00 00 c6 45 70 00 e8 9d 4a 00 00 33 c0 c6 44 24 50 00 39 05 f4 1c 02 00 89 44 24 51 75 0b e8 b5 dd ff ff 89 05 e3 1c 02 00 48 8d 4d 70 e8 c6 e3 ff ff 8b 05 e8 b5 01 00 48 8d 8d 81 01 00 00 89 44 24 50 0f b6 05 da b5 01 00 33 d2 41 b8 ff 03 00 00 c6 85 80 01 00 00 00 88 44 24 54 e8 46 4a 00 00 48 8d 15 3f b6 01 00 48 8d 8d 80 01 00 00 e8 b3 1f 00 00 48 8d 4d 90 33 d2 0f 10 05 b6 b6 01 00 0f 10 0d bf b6 01 00 41 b8 d4 00 00 00 0f 29 44 24 60 0f 29 4c 24 70 0f 10 05 b8 b6 01 00 0f 29 45 80 e8 ff 49 00 00 48 83 cb ff 48 8b c3 0f 1f 84 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >60KB and 4 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 60KB and 4 of ( $seq* )
 }
 rule ARKBIRD_SOLG_MAL_Mailo_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Mach-O malware"
 		author = "Arkbird_SOLG"
-		id = "4c975200-fce4-5a2a-b565-6d397c4e0b1c"
+		id = "7b238991-5ba0-5e6e-9046-46d1cedfb604"
 		date = "2021-06-09"
 		modified = "2021-06-21"
 		reference = "https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-19/MAIL-O/MAL_MailO_Jun_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "165c5fd90039c14ef1fa1e80bb7f14761e991b09560c5f1da2ddf9a0eadee623"
+		logic_hash = "v1_sha256_165c5fd90039c14ef1fa1e80bb7f14761e991b09560c5f1da2ddf9a0eadee623"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205741,20 +205767,20 @@ rule ARKBIRD_SOLG_MAL_Mailo_Jun_2021_1 : FILE
 		$seq5 = { 48 89 74 24 48 48 8d 0d 99 5e 18 00 4c 89 74 24 50 48 8b d5 4c 89 7c 24 58 e8 5f 13 17 00 4c 8d b7 0c 08 00 00 49 63 06 85 c0 0f 84 b0 00 00 00 48 8b c8 48 c1 e1 03 ff 15 a8 5f 22 00 48 8b f0 48 85 c0 0f 84 04 01 00 00 45 33 ff ba 00 01 00 00 41 8b df 90 48 8b 07 48 85 c0 74 16 4c 39 78 28 74 08 8b cb ff c3 48 89 04 ce 48 8b 00 48 85 c0 75 ea 48 83 c7 08 48 83 ea 01 75 d8 49 63 16 4c 8d 0d ce 01 00 00 41 b8 08 00 00 00 48 8b ce e8 c0 14 17 00 85 db 74 3e 4c 8b f6 49 8b 0e e8 c1 03 00 00 48 8b f8 48 8b cd 48 85 c0 0f 84 85 00 00 00 4c 8b c0 48 8d 15 58 5a 18 00 e8 33 a8 ff ff 48 8b cf ff 15 22 5f 22 00 41 ff c7 49 83 c6 08 44 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and 4 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 300KB and 4 of ( $seq* )
 }
 rule ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_2 : FILE
 {
 	meta:
 		description = "Detect a structure like the bash of WizardUpdate installer on OSX system"
 		author = "Arkbird_SOLG"
-		id = "3e48c2fa-10f4-5152-90e6-f5f8cc507103"
+		id = "101fa8ab-a140-527e-a28b-18116f9daffd"
 		date = "2021-10-22"
 		modified = "2021-10-23"
 		reference = "https://twitter.com/MsftSecIntel/status/1451279679059488773"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-23/WizardUpdate/MAL_OSX_WizardUpdate_Oct_2021_2.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "99d3323e3c155be040fef3beea0a55aec9bd3178df822d5fd6530864186446ed"
+		logic_hash = "v1_sha256_99d3323e3c155be040fef3beea0a55aec9bd3178df822d5fd6530864186446ed"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -205772,20 +205798,20 @@ rule ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_2 : FILE
 		$s7 = { 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 5c 22 31 2e 30 5c 22 20 65 6e 63 6f 64 69 6e 67 3d 5c 22 55 54 46 2d 38 5c 22 3f 3e 0a 09 3c 21 44 4f 43 54 59 50 45 20 70 6c 69 73 74 20 50 55 42 4c 49 43 20 5c 22 2d 2f 2f 41 70 70 6c 65 2f 2f 44 54 44 20 50 4c 49 53 54 20 31 2e 30 2f 2f 45 4e 5c 22 20 5c 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 70 70 6c 65 2e 63 6f 6d 2f 44 54 44 73 2f 50 72 6f 70 65 72 74 79 4c 69 73 74 2d 31 2e 30 2e 64 74 64 5c 22 3e 0a 09 3c 70 6c 69 73 74 20 76 65 72 73 69 6f 6e 3d 5c 22 31 2e 30 5c 22 3e }
 
 	condition:
-		filesize >2KB and 6 of ($s*)
+		filesize > 2KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_1 : FILE
 {
 	meta:
 		description = "Detect WizardUpdate installer on OSX system"
 		author = "Arkbird_SOLG"
-		id = "50974725-6b45-5f2f-aa76-ae73dc752873"
+		id = "1f50b493-9c93-58b2-b9aa-42ea36a19448"
 		date = "2021-10-22"
 		modified = "2021-10-23"
 		reference = "https://twitter.com/MsftSecIntel/status/1451279679059488773"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-23/WizardUpdate/MAL_OSX_WizardUpdate_Oct_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "b25145a9aa33c9518e5e0847b50faa8b67d65078ddfbb66de49196a17ddd3137"
+		logic_hash = "v1_sha256_b25145a9aa33c9518e5e0847b50faa8b67d65078ddfbb66de49196a17ddd3137"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205802,20 +205828,20 @@ rule ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_1 : FILE
 		$s4 = { 48 8b bd d8 fe ff ff e8 73 28 00 00 e9 00 00 00 00 e9 00 00 00 00 c6 85 e7 fe ff ff 01 f6 85 e7 fe ff ff 01 0f 85 0c 00 00 00 48 8b bd b8 fe ff ff e8 cb 27 00 00 48 8b 05 fc 2f 00 00 48 8b 00 48 8b 4d f8 48 39 c8 0f 85 32 00 00 00 48 8b 85 a8 fe ff ff 48 81 c4 80 01 00 }
 
 	condition:
-		uint32(0)==0xFEEDFACF and filesize >50KB and (($s1 and $s3) or ($s2 and $s4))
+		uint32( 0 ) == 0xFEEDFACF and filesize > 50KB and ( ( $s1 and $s3 ) or ( $s2 and $s4 ) )
 }
 rule ARKBIRD_SOLG_APT_Kimsuky_PDF_Enc_Shellcode_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect encoded Kimsuky shellcode used in fake PDF against South Korea"
 		author = "Arkbird_SOLG"
-		id = "8df7090a-6583-5d25-92bd-422e6b4191f7"
+		id = "c01dad63-5172-5a59-a508-3ba7e87c3de3"
 		date = "2021-08-03"
 		modified = "2021-08-04"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-04/Kimsuky/APT_Kimsuky_PDF_Enc_Shellcode_Aug_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "54f549b92c232f789aff039c748f1f987e68e9ee10dfab309f2ecba16d574cdb"
+		logic_hash = "v1_sha256_54f549b92c232f789aff039c748f1f987e68e9ee10dfab309f2ecba16d574cdb"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -205834,20 +205860,20 @@ rule ARKBIRD_SOLG_APT_Kimsuky_PDF_Enc_Shellcode_Aug_2021_1 : FILE
 		$s5 = { 0f 35 fc 43 53 cf 03 67 d3 85 fb 51 b6 49 5f 40 fa 5d a2 3f 7d 31 fb 0b 3d 6f 53 69 ff 78 aa 37 e8 f3 12 fe 35 3e 43 90 7c 9c e3 73 a6 78 1c 9c 21 ec bf 20 df eb f0 5a b7 76 6f fb ad 96 53 57 0f a4 fc c3 6a f5 6d fe 41 fc 19 ed f7 4f 78 3a e9 1f f8 23 3d 2b 8d 2f 86 79 d6 7b b2 f8 e0 85 f2 51 25 fc 70 8c }
 
 	condition:
-		uint32(0)==0x46445025 and filesize >25KB and $x1 and 4 of ($s*)
+		uint32( 0 ) == 0x46445025 and filesize > 25KB and $x1 and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Kimsuky_PDF_Shellcode_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect Kimsuky shellcode used in fake PDF against South Korea"
 		author = "Arkbird_SOLG"
-		id = "0b8d514b-82b6-5106-a87a-0890be1850d5"
+		id = "f4a5d75f-de15-51f7-9502-21648861bd24"
 		date = "2021-08-03"
 		modified = "2021-08-04"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-04/Kimsuky/APT_Kimsuky_PDF_Shellcode_Aug_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "432ae4d1e61aec51be03edf7767b1f05ea98d7cb7af90372a70f8ae86002f82a"
+		logic_hash = "v1_sha256_432ae4d1e61aec51be03edf7767b1f05ea98d7cb7af90372a70f8ae86002f82a"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -205867,20 +205893,20 @@ rule ARKBIRD_SOLG_APT_Kimsuky_PDF_Shellcode_Aug_2021_1 : FILE
 		$s5 = { 91 42 d1 ed c0 be 73 73 3e 35 8f b4 8e 38 f9 97 ba f9 58 d6 8b 37 a8 82 29 e7 4d 35 ea e2 ba 48 e0 61 b5 a4 f6 d4 4b 90 6a 98 89 fb 81 39 8b 3b 18 de dc 9d b7 36 ec d2 f1 51 56 1a 10 d3 b5 6b b4 95 f9 1e 86 97 9c 71 d5 4b 9a fb 0c 89 ec 3c d4 1d ac 51 34 9f 63 4d 51 59 3c b1 11 7a cd 79 a0 7a d6 43 48 52 d6 9a 4f bb 70 9a f6 3d a5 8d 72 37 9c 5b 66 e8 37 b5 48 25 80 74 e3 c7 46 ae 45 47 8e b4 e5 e8 3a 52 cd d3 87 c1 67 27 d7 62 54 6e 52 86 71 c5 c1 9f 2c ee 31 fa 2e c9 6a 7b a0 60 50 9f 16 17 f9 45 cd d9 b5 00 78 e4 6c 6b b5 f2 8e e1 bd 00 7d 74 c5 a5 45 35 0c dc 79 9c 3d 82 6a 86 92 }
 
 	condition:
-		uint32(0)==0x46445025 and filesize >25KB and $x1 and 4 of ($s*)
+		uint32( 0 ) == 0x46445025 and filesize > 25KB and $x1 and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Aridviper_Installer_Feb_2020_1 : FILE
 {
 	meta:
 		description = "Detect Installer used by AridViper group in Febuary 2021"
 		author = "Arkbird_SOLG"
-		id = "3d891aeb-b4d6-50f2-ad08-cb6d9d56064d"
+		id = "6d57b209-53cc-5236-a0de-275ac41ece42"
 		date = "2021-02-08"
 		modified = "2021-02-09"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-08/AridViper/APT_AridViper_Installer_Feb_2020_1.yar#L1-L26"
 		license_url = "N/A"
-		logic_hash = "1fca713b7ac7f3e960a4174325c32578724e87241e159fbf7754c7e2d19779a1"
+		logic_hash = "v1_sha256_1fca713b7ac7f3e960a4174325c32578724e87241e159fbf7754c7e2d19779a1"
 		score = 50
 		quality = 69
 		tags = "FILE"
@@ -205901,20 +205927,20 @@ rule ARKBIRD_SOLG_APT_Aridviper_Installer_Feb_2020_1 : FILE
 		$s6 = { 23 46 69 6c 65 20 45 72 72 6f 72 23 28 25 64 29 20 3a }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >600KB and 3 of ($s*) and $seq_db and $seq_createdb and all of ($OP_Files*)
+		uint16( 0 ) == 0x5a4d and filesize > 600KB and 3 of ( $s* ) and $seq_db and $seq_createdb and all of ( $OP_Files* )
 }
 rule ARKBIRD_SOLG_RAN_Nitro_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect Nitro ransomware"
 		author = "Arkbird_SOLG"
-		id = "256059b2-1683-5108-8fc8-3cf0b2e7b613"
+		id = "600a42e9-1ec3-5727-be55-db1f041e572d"
 		date = "2021-08-12"
 		modified = "2021-08-13"
 		reference = "https://bazaar.abuse.ch/browse/tag/NitroRansomware/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-13/Nitro/RAN_Nitro_Aug_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "c31267cd9bc6c63db8e32b2a0e7518b0432d62f1de52117b9e903fc3370a1f4d"
+		logic_hash = "v1_sha256_c31267cd9bc6c63db8e32b2a0e7518b0432d62f1de52117b9e903fc3370a1f4d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -205934,20 +205960,20 @@ rule ARKBIRD_SOLG_RAN_Nitro_Aug_2021_1 : FILE
 		$s5 = { 7e 4e 00 00 0a 0a [0-1] 73 ?? 00 00 0a 0b [0-1] 07 72 ?? 14 00 70 6f ?? 00 00 0a [0-2] 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a [0-2] 6f ?? 00 00 0a 0a }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 25KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_Ran_ELF_EXX_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect EXX variant ELF ransomware"
 		author = "Arkbird_SOLG"
-		id = "fe85d480-317a-51c3-a817-fc9034e2944f"
+		id = "5d65aca2-cade-51ca-a905-29b38d33ebb8"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-09/EXX/Ran_ELF_EXX_Nov_2020_1.yar#L1-L28"
 		license_url = "N/A"
-		logic_hash = "4508a0cf79d0d85959009f59e1471cbf123fa24f5c21da5801e91ed0bbe8a085"
+		logic_hash = "v1_sha256_4508a0cf79d0d85959009f59e1471cbf123fa24f5c21da5801e91ed0bbe8a085"
 		score = 50
 		quality = 73
 		tags = "FILE"
@@ -205970,22 +205996,20 @@ rule ARKBIRD_SOLG_Ran_ELF_EXX_Nov_2020_1 : FILE
 		$seq3 = { e5 41 55 41 54 53 48 81 ec 18 18 00 00 c7 45 dc 00 00 00 00 48 c7 45 d0 00 00 00 00 bf 00 00 00 00 e8 13 fd ff ff 89 c7 e8 7c fc ff ff e8 d7 fd ff ff 41 89 c5 e8 cf fd ff ff 41 89 c4 e8 c7 fd ff ff 89 c3 e8 c0 fd ff ff 89 c2 48 8d 85 d0 e7 ff ff 4d 89 e9 4d 89 e0 48 89 d9 48 8d 35 bf 0a 02 00 48 89 }
 
 	condition:
-		uint16(0)==0x457f and filesize >80KB and 3 of ($dbg*) and 4 of ($lib*) and 2 of ($seq*)
+		uint16( 0 ) == 0x457f and filesize > 80KB and 3 of ( $dbg* ) and 4 of ( $lib* ) and 2 of ( $seq* )
 }
-import "pe"
-
 rule ARKBIRD_SOLG_APT_APT28_VHD_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect suspicious VHD file with APT28 artefacts inside (November 2020)"
 		author = "Arkbird_SOLG"
-		id = "25452eaa-f135-5b7f-a523-67715a2ab9f7"
+		id = "bf401d05-25ba-540f-b465-99047788b7dc"
 		date = "2020-12-09"
 		modified = "2020-12-10"
 		reference = "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-09/APT28/APT_APT28_Nov_2020_1.yar#L3-L35"
 		license_url = "N/A"
-		logic_hash = "d72c3428cf731feb63c59ef109b99ec234e69bb6df34bdde928cc4b886f0533b"
+		logic_hash = "v1_sha256_d72c3428cf731feb63c59ef109b99ec234e69bb6df34bdde928cc4b886f0533b"
 		score = 50
 		quality = 69
 		tags = "FILE"
@@ -206013,7 +206037,7 @@ rule ARKBIRD_SOLG_APT_APT28_VHD_Nov_2020_1 : FILE
 		$s11 = { 2f 2f 3a 70 74 74 68 }
 
 	condition:
-		uint16(0)==0x33c0 and filesize >40KB and 5 of ($c*) and 8 of ($s*)
+		uint16( 0 ) == 0x33c0 and filesize > 40KB and 5 of ( $c* ) and 8 of ( $s* )
 }
 import "pe"
 
@@ -206022,13 +206046,13 @@ rule ARKBIRD_SOLG_APT_APT28_Zebrocy_GO_Downloader_Nov_2020_1 : FILE
 	meta:
 		description = "Detect Zebrocy Go downloader (November 2020)"
 		author = "Arkbird_SOLG"
-		id = "114c0297-7168-5d20-b56b-89b0b47f18c7"
+		id = "e9902851-dad8-5aeb-baa2-76970fa5b429"
 		date = "2020-12-09"
 		modified = "2020-12-10"
 		reference = "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-09/APT28/APT_APT28_Nov_2020_1.yar#L37-L65"
 		license_url = "N/A"
-		logic_hash = "e7b2e7c250f3a98127399176adf9f93b758f0a5111e126dd0a75a3fb95a48da9"
+		logic_hash = "v1_sha256_e7b2e7c250f3a98127399176adf9f93b758f0a5111e126dd0a75a3fb95a48da9"
 		score = 50
 		quality = 61
 		tags = "FILE"
@@ -206053,22 +206077,20 @@ rule ARKBIRD_SOLG_APT_APT28_Zebrocy_GO_Downloader_Nov_2020_1 : FILE
 		$op6 = { 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 54 45 53 54 49 4e 47 20 4b 45 59 2d 2d 2d 2d 2d }
 
 	condition:
-		uint16(0)==0x4d5a and filesize >800KB and (pe.imphash()=="91802a615b3a5c4bcc05bc5f66a5b219") and 3 of ($c*) and 3 of ($p*) and 3 of ($op*)
+		uint16( 0 ) == 0x4d5a and filesize > 800KB and ( pe.imphash ( ) == "91802a615b3a5c4bcc05bc5f66a5b219" ) and 3 of ( $c* ) and 3 of ( $p* ) and 3 of ( $op* )
 }
-import "pe"
-
 rule ARKBIRD_SOLG_APT_Lazarus_EPS_July_2020_1 : FILE
 {
 	meta:
 		description = " Detected Lazarus EPS script for download and execute the payload in base 64"
 		author = "Arkbird_SOLG"
-		id = "244ef018-bc7b-5e10-bf65-b52fdb5ad403"
+		id = "73ab6ef5-e8e8-50b7-a2b5-7118b463f05d"
 		date = "2020-07-28"
 		modified = "2020-07-28"
 		reference = "https://twitter.com/spider_girl22/status/1287952503280082944"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-28/Lazarus/APT_Lazarus_EPS_July_2020_1.yar#L3-L30"
 		license_url = "N/A"
-		logic_hash = "0fbd6ac10a31cc9a571e42f8696480336cd350e56ba2ffafb386f066fd53c552"
+		logic_hash = "v1_sha256_0fbd6ac10a31cc9a571e42f8696480336cd350e56ba2ffafb386f066fd53c552"
 		score = 75
 		quality = 45
 		tags = "FILE"
@@ -206094,20 +206116,20 @@ rule ARKBIRD_SOLG_APT_Lazarus_EPS_July_2020_1 : FILE
 		$URL2 = { 22 68 74 74 70 73 3A 2F 2F 74 ?? ?? ?? }
 
 	condition:
-		uint16(0)==0x33c9 and filesize <3KB and (1 of ($URL*)) and (12 of ($s*))
+		uint16( 0 ) == 0x33c9 and filesize < 3KB and ( 1 of ( $URL* ) ) and ( 12 of ( $s* ) )
 }
 rule ARKBIRD_SOLG_RAN_Conti_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect packed Conti ransomware (May 2021) [Common parts with Vidar packer, possible false positives to Vidar stealer or Danabot"
 		author = "Arkbird_SOLG"
-		id = "661182f7-4716-50d1-8d98-9fb272cf43eb"
+		id = "ee43b78f-e24f-5aa0-b5f2-1f531800e471"
 		date = "2021-05-19"
 		modified = "2021-05-21"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-20/Conti/RAN_Conti_May_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "397f99dee35d8a0c5f564655e952f8a55d347a74303eadfc6788bd6ff0f6c4c5"
+		logic_hash = "v1_sha256_397f99dee35d8a0c5f564655e952f8a55d347a74303eadfc6788bd6ff0f6c4c5"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -206123,20 +206145,20 @@ rule ARKBIRD_SOLG_RAN_Conti_May_2021_1 : FILE
 		$seq4 = { 81 bd [2] ff ff 22 3b 00 00 75 [4-5] 42 00 [5-6] 81 3d [4] e5 05 00 00 75 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >90KB and all of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 90KB and all of ( $seq* )
 }
 rule ARKBIRD_SOLG_RAN_Conti_May_2021_2 : FILE
 {
 	meta:
 		description = "Detect unpacked Conti ransomware (May 2021)"
 		author = "Arkbird_SOLG"
-		id = "f7580a0d-b94e-560e-a01e-1f0eb0c8833e"
+		id = "e18a259f-a97a-542c-bbd5-796f20160fe8"
 		date = "2021-05-20"
 		modified = "2021-05-21"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-20/Conti/RAN_Conti_May_2021_2.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "d1ec1d2954d0075d9d9ed194bb96a34d457045bfc7a22cb44adb76dee4bc8e41"
+		logic_hash = "v1_sha256_d1ec1d2954d0075d9d9ed194bb96a34d457045bfc7a22cb44adb76dee4bc8e41"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206154,20 +206176,20 @@ rule ARKBIRD_SOLG_RAN_Conti_May_2021_2 : FILE
 		$seq6 = { 83 3b 00 c7 45 94 00 00 00 00 0f 86 57 02 00 00 8b 35 b4 21 41 00 8d 4b 14 8b 3d c8 21 41 00 8b 1d 9c 21 41 00 89 4d 90 c7 45 98 7f 00 00 00 89 b5 7c ff ff ff 89 bd 78 ff ff ff 89 5d 9c 0f 1f 40 00 8b 11 8d 45 d0 89 55 cc b9 2c 00 00 00 0f 1f 00 c6 00 00 8d 40 01 83 e9 01 75 f5 52 ff d6 8b f0 ff d7 c6 45 b4 00 bf 7f 00 00 00 c6 45 b5 42 c6 45 b6 31 c6 45 b7 2a c6 45 b8 0b c6 45 b9 63 8a 4d b5 80 7d b4 00 75 28 33 c9 66 0f 1f 44 00 00 8a 44 0d b5 0f b6 c0 83 e8 63 6b c0 25 99 f7 ff 8d 42 7f 99 f7 ff 88 54 0d b5 41 83 f9 05 72 e0 8d 45 b5 50 56 ff d3 c6 45 a0 00 c6 45 a1 51 c6 45 a2 1f c6 45 a3 2b c6 45 a4 44 c6 45 a5 51 c6 45 a6 12 c6 45 a7 45 c6 45 a8 44 c6 45 a9 26 89 45 84 8a 45 a1 80 7d a0 00 75 27 33 c9 0f 1f 00 8a 44 0d a1 0f b6 c0 83 e8 26 8d 04 80 03 c0 99 f7 ff 8d 42 7f 99 f7 ff 88 54 0d a1 41 83 f9 09 72 de 8d 45 a1 50 56 ff d3 c6 45 bc 00 8b d8 c6 45 bd 42 c6 45 be 19 c6 45 bf 46 c6 45 c0 59 8a 4d bd 80 7d bc 00 89 5d 88 75 2c 33 ff 8d 5f 7f 8a 44 3d bd 0f b6 c8 83 e9 59 8b c1 c1 e0 05 2b c1 99 f7 fb 8d 42 7f 99 f7 fb 88 54 3d bd 47 83 ff 04 72 dc 8b 5d 88 8d 45 bd 50 56 ff 55 9c c6 45 ac 00 8b f8 c6 45 ad 76 c6 45 ae 30 c6 45 af 06 c6 45 b0 21 c6 45 b1 2a 8a 4d ad 80 7d ac 00 75 24 33 c9 8a 44 0d ad 0f b6 c0 83 e8 2a 8d 04 c0 99 f7 7d 98 8d 42 7f 99 f7 7d 98 88 54 0d ad 41 83 f9 05 72 de 8d 45 ad 50 56 ff 55 9c }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and 5 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 50KB and 5 of ( $seq* )
 }
 rule ARKBIRD_SOLG_Ran_Robbinhood_Oct_2020_1 : FILE
 {
 	meta:
 		description = "Detect RobbinHood ransomware"
 		author = "Arkbird_SOLG"
-		id = "adaacb06-0738-5d2b-b97e-b9007341f743"
+		id = "0fe39fe1-4168-5ea1-9b7f-92e60310838b"
 		date = "2020-11-04"
 		modified = "2020-11-05"
 		reference = "https://twitter.com/joakimkennedy/status/1323957238680178689"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-05/RobbinHood/Ran_RobbinHood_Oct_2020_1.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "72d0e9b1e2f6aee8f24125e6e6801329e2fad016f05a94ad65c04874a016d09d"
+		logic_hash = "v1_sha256_72d0e9b1e2f6aee8f24125e6e6801329e2fad016f05a94ad65c04874a016d09d"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -206185,20 +206207,20 @@ rule ARKBIRD_SOLG_Ran_Robbinhood_Oct_2020_1 : FILE
 		$str3 = { 59 32 31 6b 4c 6d 56 34 5a 53 41 76 59 79 42 69 59 32 52 6c 5a 47 6c 30 4c 6d 56 34 5a 53 41 76 63 32 56 30 49 48 74 6b 5a 57 5a 68 64 57 78 30 66 53 42 79 5a 57 4e 76 64 6d 56 79 65 57 56 75 59 57 4a 73 5a 57 51 67 62 6d 38 3d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >600KB and $seq and 2 of ($com*) and 2 of ($str*)
+		uint16( 0 ) == 0x5a4d and filesize > 600KB and $seq and 2 of ( $com* ) and 2 of ( $str* )
 }
 rule ARKBIRD_SOLG_MAL_Skinnyboy_Launcher_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Launcher of SkinnyBoy"
 		author = "Arkbird_SOLG"
-		id = "4e69cba4-92ef-5ea5-95d8-b22ed77f515c"
+		id = "28c632a0-4e91-5cec-85d3-8eb7221c7b85"
 		date = "2021-06-05"
 		modified = "2021-06-06"
 		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Launcher_Jun_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "4d5906832a1bc90552255ada1cc9e3c7cd3e14e4b0cb11b1bf2c11c57bca8ad8"
+		logic_hash = "v1_sha256_4d5906832a1bc90552255ada1cc9e3c7cd3e14e4b0cb11b1bf2c11c57bca8ad8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206215,20 +206237,20 @@ rule ARKBIRD_SOLG_MAL_Skinnyboy_Launcher_Jun_2021_1 : FILE
 		$s6 = { 0f b7 8c 05 f8 fd ff ff 66 31 8c 05 f8 fe ff ff 0f b7 8c 05 fa fd ff ff 66 31 8c 05 fa fe ff ff 0f b7 8c 05 fc fd ff ff 66 31 8c 05 fc fe ff ff 0f b7 8c 05 fe fd ff ff 66 31 8c 05 fe fe ff ff 83 c0 08 3d 00 01 00 00 72 b6 56 8d 85 f8 fe ff ff 50 8d 85 f0 fb ff ff 68 08 02 00 00 50 e8 ed 04 00 00 6a 44 8d 85 98 fb ff ff 6a 00 50 e8 ed 31 00 00 83 c4 1c 8d 85 e0 fb ff ff 50 8d 85 98 fb ff ff 50 6a 00 6a 00 68 00 00 00 08 6a 00 6a 00 6a 00 8d 85 f0 fb ff ff 50 6a 00 c7 85 98 fb ff ff 44 00 00 00 ff 15 38 90 40 00 8b 4d fc 33 cd 5e e8 b9 04 00 00 8b e5 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 40KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Skinnyboy_Dropper_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect SkinnyBoy Dropper"
 		author = "Arkbird_SOLG"
-		id = "1ea4cfe7-d44d-5cdb-8436-cb2b09dd2e56"
+		id = "ab824553-0584-5444-9e71-fd0e73214755"
 		date = "2021-05-01"
 		modified = "2021-06-06"
 		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Dropper_Jun_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "805bc5bb5833a75d68df2a6ce828d70b2257809a3699fdca5e621aae6bdc5070"
+		logic_hash = "v1_sha256_805bc5bb5833a75d68df2a6ce828d70b2257809a3699fdca5e621aae6bdc5070"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -206245,20 +206267,20 @@ rule ARKBIRD_SOLG_MAL_Skinnyboy_Dropper_Jun_2021_1 : FILE
 		$s6 = { 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 40KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Skinnyboy_Implant_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect SkinnyBoy Implant"
 		author = "Arkbird_SOLG"
-		id = "2c78e0f3-a0b3-56fb-b4d2-313c03f1331b"
+		id = "779e30e1-21e0-52b1-b404-fba27a863020"
 		date = "2021-06-05"
 		modified = "2021-06-06"
 		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Implant_Jun_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "37d6b03adaad0a97e91a366d8e5ce47bc0eb77263849422129edf9df28d25bd8"
+		logic_hash = "v1_sha256_37d6b03adaad0a97e91a366d8e5ce47bc0eb77263849422129edf9df28d25bd8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206275,20 +206297,20 @@ rule ARKBIRD_SOLG_MAL_Skinnyboy_Implant_Jun_2021_1 : FILE
 		$s6 = { 6a 00 8d 44 24 28 50 ff 74 24 1c c7 44 24 30 00 00 00 00 57 56 ff 15 38 b0 00 10 56 ff 15 44 b0 00 10 68 80 00 00 00 8d 44 24 34 50 ff 15 48 b0 00 10 8d 44 24 30 50 ff 15 a4 b1 00 10 85 c0 74 2d 8d 44 24 30 50 ff 15 b0 b0 00 10 8b f0 6a 01 56 ff 15 a0 b0 00 10 8d 4c 24 20 51 a3 20 1b 01 10 ff d0 56 89 44 24 20 ff 15 f4 b0 00 10 e8 ad f3 ff ff 57 8b 3d b4 b0 00 10 6a 00 ff d7 8b 35 b8 b0 00 10 50 ff d6 ff 74 24 18 6a 00 ff d7 50 ff d6 8b 44 24 1c 85 c0 74 12 8b 54 24 20 50 b9 4c ef 00 10 e8 77 0c 00 00 83 c4 04 8b 54 24 0c 8b 0c 13 8d 04 13 8d 04 19 83 c3 08 8b 44 10 04 03 c1 03 d8 3b 5c 24 10 0f 82 42 fd ff ff 52 6a 00 ff d7 50 ff d6 68 00 dd 6d 00 ff 35 28 1b 01 10 ff 15 4c b0 00 10 85 c0 0f 85 d4 fc ff ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 40KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_PYSA_Sept_2021_1 : FILE
 {
 	meta:
 		description = "Detect the PYSA ransomware"
 		author = "Arkbird_SOLG"
-		id = "fd939287-ec37-5021-9782-f0f86a9f0e4b"
+		id = "a890802b-4041-54bb-8356-d5e9fe1b8321"
 		date = "2021-09-23"
 		modified = "2021-11-10"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-09/PYSA/RAN_PYSA_Sept_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "e16f2ae581b8627ccd4e8ecb56db52c992022473d006843ed19a69c8059ecb54"
+		logic_hash = "v1_sha256_e16f2ae581b8627ccd4e8ecb56db52c992022473d006843ed19a69c8059ecb54"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206306,20 +206328,20 @@ rule ARKBIRD_SOLG_RAN_PYSA_Sept_2021_1 : FILE
 		$s5 = { 8b ec 6a ff 68 [2] 45 00 64 a1 00 00 00 00 50 83 ec 44 a1 34 52 47 00 33 c5 89 45 f0 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b f1 8b 3d 04 a0 45 00 68 00 00 00 f0 6a 01 6a 00 6a 00 56 c7 06 00 00 00 00 ff d7 85 c0 75 60 ff 15 54 a0 45 00 6a 08 6a 01 6a 00 68 [2] 45 00 56 8b d8 ff d7 85 c0 75 46 6a 28 6a 01 50 68 [2] 45 00 56 ff d7 85 c0 75 35 53 ff 15 58 a0 45 00 68 [2] 45 00 8d 4d d8 e8 ?? 8a fd ff 8d 45 d8 c7 45 fc 00 00 00 00 50 8d 4d b0 e8 d3 00 00 00 68 [2] 47 00 8d 45 b0 50 e8 [2] 00 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d f0 33 cd e8 [2] 00 00 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >100KB and 4 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 100KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_UNK_DEV_0322_Jul_2021_1 : CVE_2021_35211 FILE
 {
 	meta:
 		description = "Detect the script used by DEV-0322 for create a new user after exploit the CVE-2021-35211"
 		author = "Arkbird_SOLG"
-		id = "8d16eb7f-c137-5f23-8830-ce26dc6e4d52"
+		id = "54eecbae-9f49-53f8-a244-b77c6a2548d1"
 		date = "2021-07-16"
 		modified = "2021-11-10"
 		reference = "https://www.cadosecurity.com/triage-analysis-of-serv-u-ftp-user-backdoor-deployed-by-cve-2021-35211/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-09/DEV_0322/UNK_DEV_0322_Jul_2021_1.yara#L1-L26"
 		license_url = "N/A"
-		logic_hash = "7d7f012053bff6217f0fe9087acbeba13f83cb2c3dbe9a4fe8e7e0e4551edefd"
+		logic_hash = "v1_sha256_7d7f012053bff6217f0fe9087acbeba13f83cb2c3dbe9a4fe8e7e0e4551edefd"
 		score = 75
 		quality = 59
 		tags = "CVE-2021-35211, FILE"
@@ -206340,20 +206362,20 @@ rule ARKBIRD_SOLG_UNK_DEV_0322_Jul_2021_1 : CVE_2021_35211 FILE
 		$s4 = { 3c 3c 2d 20 49 6e 63 6c 75 64 65 52 65 73 70 43 6f 64 65 73 49 6e 4d 73 67 46 69 6c 65 73 }
 
 	condition:
-		filesize >1KB and filesize <15KB and all of ($obj*) and all of ($arg*) and 3 of ($s*)
+		filesize > 1KB and filesize < 15KB and all of ( $obj* ) and all of ( $arg* ) and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Winnti_Elfx64_Aug_2020_1 : FILE
 {
 	meta:
 		description = "Detect of ELF implant used by APT Winnti in August 2020"
 		author = "Arkbird_SOLG"
-		id = "112e8d60-cbcb-53a7-b458-d39ee03d5c22"
+		id = "d719ffed-0920-5a09-835f-787134fc029e"
 		date = "2020-08-18"
 		modified = "2020-08-18"
 		reference = "https://twitter.com/KorbenD_Intel/status/1295725146037133312"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-18/Winnti/APT_Winnti_ELFx64_Aug_2020_1.yar#L1-L34"
 		license_url = "N/A"
-		logic_hash = "ebe6e60c45336476fd91c4185eee0414c3eba83960301a610b69c8818dbb17fd"
+		logic_hash = "v1_sha256_ebe6e60c45336476fd91c4185eee0414c3eba83960301a610b69c8818dbb17fd"
 		score = 75
 		quality = 36
 		tags = "FILE"
@@ -206385,20 +206407,20 @@ rule ARKBIRD_SOLG_APT_Winnti_Elfx64_Aug_2020_1 : FILE
 		$info5 = "get_our_pids" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <15KB and (1 of ($lib*) and 4 of ($c*) and 2 of ($d*) and 4 of ($s*) and 3 of ($info*))
+		uint16( 0 ) == 0x457f and filesize < 15KB and ( 1 of ( $lib* ) and 4 of ( $c* ) and 2 of ( $d* ) and 4 of ( $s* ) and 3 of ( $info* ) )
 }
 rule ARKBIRD_SOLG_APT_APT38_Valeforbeta_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect ValeforBeta used in attacks against Japanese organisations by APT38"
 		author = "Arkbird_SOLG"
-		id = "74a20725-3e52-5fef-9934-c812137dc989"
+		id = "7de4cdba-e48b-5a15-a830-be9a2e6545a0"
 		date = "2021-03-23"
 		modified = "2021-03-24"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-23/APT38/APT_APT38_ValeforBeta_Mar_2021_1.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "0ee8202b8978bf487df2a63c17d139076f2e9f68f1827a17929522060a72937a"
+		logic_hash = "v1_sha256_0ee8202b8978bf487df2a63c17d139076f2e9f68f1827a17929522060a72937a"
 		score = 50
 		quality = 67
 		tags = "FILE"
@@ -206417,20 +206439,20 @@ rule ARKBIRD_SOLG_APT_APT38_Valeforbeta_Mar_2021_1 : FILE
 		$s2 = { 45 fc 8b 45 0c 0f b6 48 0f 56 51 0f b6 48 0e 51 0f b6 48 0d 51 0f b6 48 0c 51 0f b6 48 0b 51 0f b6 48 0a 51 0f b6 48 09 51 0f b6 48 08 8b 75 08 83 a5 f8 fe ff ff 00 51 0f b7 48 06 51 0f b7 48 04 51 ff 30 8d 85 fc fe ff ff 68 48 aa 47 00 68 00 01 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 5 of ($dbg*) and 1 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 5 of ( $dbg* ) and 1 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_APT38_Vsingle_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect VSingle used in attacks against Japanese organisations by APT38"
 		author = "Arkbird_SOLG"
-		id = "d1d640f6-bcec-5364-8ea5-e0c0b86da6e1"
+		id = "228f2406-1e1a-51f3-96bd-735ef9fdcebb"
 		date = "2021-03-23"
 		modified = "2021-03-24"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-23/APT38/APT_APT38_VSingle_Mar_2021_1.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "d01baac099ce33b837c83d6778900f7e55b8c63e75d0e552c10ababc8dec744c"
+		logic_hash = "v1_sha256_d01baac099ce33b837c83d6778900f7e55b8c63e75d0e552c10ababc8dec744c"
 		score = 50
 		quality = 69
 		tags = "FILE"
@@ -206450,20 +206472,20 @@ rule ARKBIRD_SOLG_APT_APT38_Vsingle_Mar_2021_1 : FILE
 		$s2 = { 51 83 7d 08 00 75 07 b8 5b ab 66 00 eb 35 8b 45 08 89 45 fc 8b 4d fc }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 6 of ($dbg*) and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 6 of ( $dbg* ) and all of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Jssloader_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect JSSLoader malware"
 		author = "Arkbird_SOLG"
-		id = "192b1386-f0bc-54e8-9341-84f77f4f07c5"
+		id = "bf6f411c-8e1d-507b-a8ef-63be332884d1"
 		date = "2021-06-04"
 		modified = "2021-06-05"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-04/FIN7/MAL_JSSLoader_Jun_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "73942afed6b3471be07be1fba3e7f90ec7f2377a1167aeef70627cd07faa3681"
+		logic_hash = "v1_sha256_73942afed6b3471be07be1fba3e7f90ec7f2377a1167aeef70627cd07faa3681"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206481,20 +206503,20 @@ rule ARKBIRD_SOLG_MAL_Jssloader_Jun_2021_1 : FILE
 		$s4 = { 8b 45 ec 8b 08 81 e1 ff ff 00 00 8b f4 51 8b 55 bc 52 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b 4d f8 89 01 eb 25 8b 45 ec 8b 08 8b 55 08 8d 44 0a 02 8b f4 50 8b 4d bc 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b 55 f8 89 02 8b 45 f8 83 c0 04 89 45 f8 8b 45 ec 83 c0 04 89 45 ec eb 8c 8b 45 c8 83 c0 14 89 45 c8 e9 25 ff ff ff 5f 5e 5b 81 c4 08 01 00 00 3b ec e8 [2] 00 00 8b e5 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and filesize <900KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and filesize < 900KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_2 : FILE
 {
 	meta:
 		description = "Detect NGLite backdoor (version B)"
 		author = "Arkbird_SOLG"
-		id = "e18f2891-366b-5cff-a17e-63523bfd9cee"
+		id = "9b8688d9-cff3-5de8-b687-4865c0c09444"
 		date = "2021-11-08"
 		modified = "2021-11-09"
 		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-08/NGLite/MAL_NGLite_Nov_2021_2.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "4d44d208010ca17f47f597f7d9eb5ee39d91a2d9077218a173ef0015699dc296"
+		logic_hash = "v1_sha256_4d44d208010ca17f47f597f7d9eb5ee39d91a2d9077218a173ef0015699dc296"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206511,20 +206533,20 @@ rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_2 : FILE
 		$s5 = { 8b 05 94 ?? bf 00 89 04 24 c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 e8 ed 05 00 00 8b 44 24 14 8b 4c 24 1c 89 81 b4 01 00 00 85 c0 74 7e 8b 05 94 ?? bf 00 89 04 24 c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 e8 ad 05 00 00 8b 44 24 14 8b 4c 24 1c 89 81 b8 01 00 00 85 c0 74 04 83 c4 18 c3 8d 05 ?? ?? 8b 00 89 04 24 e8 c9 6c 02 00 8b 05 98 ?? bf 00 8b 4c 24 1c 8b 91 b4 01 00 00 89 04 24 89 54 24 04 e8 ad 04 00 00 8b 44 24 1c c7 80 b4 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 40KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_1 : FILE
 {
 	meta:
 		description = "Detect NGLite backdoor (version A)"
 		author = "Arkbird_SOLG"
-		id = "cf2845f3-1176-5197-9d05-f123b0f23c75"
+		id = "f683cd87-a36d-5c80-b41c-cbb8bfc3909a"
 		date = "2021-11-09"
 		modified = "2021-11-09"
 		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-08/NGLite/MAL_NGLite_Nov_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "ebafc52da76b9a960ee3c2c99955fb5dcb4acff2b7a0d7fad714bfc17617331a"
+		logic_hash = "v1_sha256_ebafc52da76b9a960ee3c2c99955fb5dcb4acff2b7a0d7fad714bfc17617331a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206541,20 +206563,20 @@ rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_1 : FILE
 		$s5 = { 48 8b 15 26 29 92 00 48 89 14 24 48 89 4c 24 08 48 89 44 24 10 48 c7 44 24 18 00 10 00 00 48 c7 44 24 20 04 00 00 00 e8 71 64 01 00 48 83 7c 24 28 00 40 0f 94 c6 48 8b 44 24 38 48 8b 4c 24 48 48 8b 54 24 68 48 8b 5c 24 40 e9 61 ff ff ff 48 8b 6c 24 50 48 83 c4 58 c3 48 8b 6c 24 50 48 83 c4 58 c3 e8 25 91 01 00 48 8d 05 e2 b8 56 00 48 89 04 24 48 c7 44 24 08 19 00 00 00 e8 bc 9a 01 00 48 8b 44 24 38 48 89 04 24 e8 be 97 01 00 48 8d 05 9a b1 56 00 48 89 04 24 48 c7 44 24 08 19 00 00 00 e8 95 9a 01 00 8b 44 24 34 48 89 04 24 e8 98 97 01 00 e8 73 93 01 00 e8 5e 91 01 00 48 8d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 40KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Blackmatter_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect BlackMatter ransomware"
 		author = "Arkbird_SOLG"
-		id = "eb308cde-af92-5b34-b256-88009f90810f"
+		id = "4ffa904a-9fc4-5abb-abec-887248cd0ce2"
 		date = "2021-08-02"
 		modified = "2021-08-02"
 		reference = "https://twitter.com/abuse_ch/status/1421834305416933376"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-01/Blackmatter/RAN_BlackMatter_Aug_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "ff158ce977eb10f36c9e8a032dd3880fcd5ecc09e9cc07cd27b98bbce5661d75"
+		logic_hash = "v1_sha256_ff158ce977eb10f36c9e8a032dd3880fcd5ecc09e9cc07cd27b98bbce5661d75"
 		score = 50
 		quality = 71
 		tags = "FILE"
@@ -206574,20 +206596,20 @@ rule ARKBIRD_SOLG_RAN_Blackmatter_Aug_2021_1 : FILE
 		$s7 = { 8b 0e 0f b6 d1 0f b6 dd 57 8d bd fc fe ff ff 8a 04 3a 8a 24 3b c1 e9 10 83 c6 04 0f b6 d1 0f b6 cd 8a 1c 3a 8a 3c 39 5f 8a d4 8a f3 c0 e0 02 c0 eb 02 c0 e6 06 c0 e4 04 c0 ea 04 0a fe 0a c2 0a e3 88 07 88 7f 02 88 67 01 ff 4d fc }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and 5 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 25KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Installer of Dustman wiper used by APT34"
 		author = "Arkbird_SOLG"
-		id = "071063f5-d2a4-5666-a8c4-283c02061f6d"
+		id = "88b3b133-4f58-5cc0-b58e-20650cbaf3e4"
 		date = "2021-04-28"
 		modified = "2021-04-30"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-29/APT34/APT_APT34_Dustman_Apr_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "44e68fa21c1d6258bc9c0dcdc9cc531a15081122c90b23607bcfda716471aeb6"
+		logic_hash = "v1_sha256_44e68fa21c1d6258bc9c0dcdc9cc531a15081122c90b23607bcfda716471aeb6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206604,20 +206626,20 @@ rule ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1 : FILE
 		$s6 = "Release\\Dustman.pdb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize > 50KB and 4 of them
 }
 rule ARKBIRD_SOLG_Ran_Buran_Oct_2020_1 : FILE
 {
 	meta:
 		description = "Detect Buran ransomware"
 		author = "Arkbird_SOLG"
-		id = "dbdc251e-9ac6-5de1-8a72-72ac159daf4c"
+		id = "a0fe9086-8329-5211-bc12-423e1ef82aa7"
 		date = "2020-11-05"
 		modified = "2020-11-06"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1323956405976600579"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-06/Buran/Ran_Buran_Oct_2020_1.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "a6984d21451c980d001e040325c66b547060653ac97556bc379da40f3ab6a70a"
+		logic_hash = "v1_sha256_a6984d21451c980d001e040325c66b547060653ac97556bc379da40f3ab6a70a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206637,20 +206659,20 @@ rule ARKBIRD_SOLG_Ran_Buran_Oct_2020_1 : FILE
 		$s6 = " remove '.' from {.$DEFINE ComplexBraces}" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 4 of them
 }
 rule ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_1 : FILE
 {
 	meta:
 		description = "Detect RYUK ransomware (Sept_2020_V1)"
 		author = "Arkbird_SOLG"
-		id = "7ade43ef-cd31-5308-b5ab-71f04d27018b"
+		id = "81a040ce-7ffe-5ea3-aeed-1a42265c7af9"
 		date = "2020-10-25"
 		modified = "2020-10-27"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Ran_Ruyk_Oct2020_1.yar#L1-L29"
 		license_url = "N/A"
-		logic_hash = "b70eb2e5f58076ea8d4d1370649358acf68f3119cb2be6d5ef0a302bb3bf5d1e"
+		logic_hash = "v1_sha256_b70eb2e5f58076ea8d4d1370649358acf68f3119cb2be6d5ef0a302bb3bf5d1e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206677,20 +206699,20 @@ rule ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_1 : FILE
 		$p2 = "\\Documents and Settings\\Default User\\sys" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 4 of ($c*) and 1 of ($r*) and 4 of ($ref*) and 1 of ($p*)
+		uint16( 0 ) == 0x5a4d and filesize > 40KB and 4 of ( $c* ) and 1 of ( $r* ) and 4 of ( $ref* ) and 1 of ( $p* )
 }
 rule ARKBIRD_SOLG_Mem_Cryptor_Obsidium_Oct_2020_1 : FILE
 {
 	meta:
 		description = "Detect Obsidium cryptor by memory string"
 		author = "Arkbird_SOLG"
-		id = "039c45f0-cc43-50ee-ae4e-a7e0e220dc04"
+		id = "8a88f26c-0541-5a82-910c-d6404322d680"
 		date = "2020-10-25"
 		modified = "2020-10-27"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Mem_Cryptor_Obsidium_Oct_2020_1.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "5f471064505d7ab634b6d52f66fa0a96682af2eb1dd41afe4449543253c6bbf7"
+		logic_hash = "v1_sha256_5f471064505d7ab634b6d52f66fa0a96682af2eb1dd41afe4449543253c6bbf7"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -206703,20 +206725,20 @@ rule ARKBIRD_SOLG_Mem_Cryptor_Obsidium_Oct_2020_1 : FILE
 		$s5 = "'license.key" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 40KB and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_2 : FILE
 {
 	meta:
 		description = "Detect RYUK ransomware (Sept_2020_V1 + V2)"
 		author = "Arkbird_SOLG"
-		id = "82ed6736-00e6-5a30-89cf-a2b86f2e1ba6"
+		id = "a13ba148-3b98-5752-91f3-4b2740a05e60"
 		date = "2020-10-25"
 		modified = "2020-10-28"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Ran_Ruyk_Oct2020_2.yar#L1-L29"
 		license_url = "N/A"
-		logic_hash = "a06d61b9363b732d17a2766b280951198a6adc226e284ab1d909cd98516cfb6f"
+		logic_hash = "v1_sha256_a06d61b9363b732d17a2766b280951198a6adc226e284ab1d909cd98516cfb6f"
 		score = 75
 		quality = 46
 		tags = "FILE"
@@ -206743,20 +206765,20 @@ rule ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_2 : FILE
 		$op2 = { 23 71 59 72 51 6d 58 48 4a 77 65 55 53 76 68 79 4f 62 51 50 6d 44 44 52 44 6e 72 49 53 57 6c 72 56 4a 56 75 68 52 4e 4a 66 6b 50 6e 6b 72 65 68 73 6e 6b 68 54 4e 70 6a 56 7a 7a 64 61 44 6e 62 44 67 5a 54 62 4b 65 63 54 69 35 4f 71 20 64 24 2d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 6 of ($s*) and 1 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize > 40KB and 6 of ( $s* ) and 1 of ( $op* )
 }
 rule ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1 : FILE
 {
 	meta:
 		description = "Detect Downdelph used by APT28 group"
 		author = "Arkbird_SOLG"
-		id = "0376c026-93eb-526a-8ab3-26bdd365e608"
+		id = "9d6ac3b7-cfc8-515b-8eb1-b83cf08e7cf4"
 		date = "2021-02-18"
 		modified = "2021-02-19"
 		reference = "https://twitter.com/RedDrip7/status/1362343352759250946"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-18/APT28/APT_APT28_Downdelph_Feb_2021_1.yar#L1-L18"
 		license_url = "N/A"
-		logic_hash = "15e38ceeb0410645938ce2f90becf9a344711efd6e539f304de7b413f6f3b420"
+		logic_hash = "v1_sha256_15e38ceeb0410645938ce2f90becf9a344711efd6e539f304de7b413f6f3b420"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206771,20 +206793,20 @@ rule ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1 : FILE
 		$s6 = { 45 00 72 00 72 00 6f 00 72 00 20 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 3a 00 20 00 25 00 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 5 of them
 }
 rule ARKBIRD_SOLG_Ran_Mount_Locker_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect Mount Locker ransomware (November 2020 variant)"
 		author = "Arkbird_SOLG"
-		id = "20fde6f4-ef7d-57c4-8cc2-a6ea810c2b0c"
+		id = "4fe3dc42-ce53-51bd-9033-df6038cf94c4"
 		date = "2020-11-20"
 		modified = "2020-11-22"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-21/Mount Locker/Ran_Mount_Locker_Nov_2020_1.yar#L1-L26"
 		license_url = "N/A"
-		logic_hash = "028e89e9c0c46ac5c36fee5cbfba068b4c6c1f53aa224e454ebd358f2c6ae9a9"
+		logic_hash = "v1_sha256_028e89e9c0c46ac5c36fee5cbfba068b4c6c1f53aa224e454ebd358f2c6ae9a9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206807,20 +206829,20 @@ rule ARKBIRD_SOLG_Ran_Mount_Locker_Nov_2020_1 : FILE
 		$seq2 = { 5a 00 3d 00 14 00 51 00 1f 00 67 00 1c 00 24 00 00 00 00 00 00 00 6f 00 27 00 62 00 5d 00 6d 00 30 00 01 00 27 01 25 00 62 00 7b 00 05 00 56 00 24 00 3c 00 3d 00 5d 00 2e 00 62 00 03 00 0a 00 57 00 6a 00 02 00 5d 00 02 01 23 01 67 00 20 00 54 00 01 00 6c 01 17 00 0b 00 44 00 21 00 1e 00 01 00 52 01 60 00 3b 00 11 00 45 00 2a 00 59 00 2c 00 19 00 00 00 5a 00 1e 00 61 00 5c 00 6b 00 31 00 01 00 1a 01 2d 00 4a 00 6f 00 11 00 57 00 2c 00 3a 00 3a 00 50 00 2a 00 61 00 02 00 07 00 53 00 7b 00 01 01 5b 00 02 01 6a 01 0b 00 03 00 6d 00 43 00 0c 00 64 00 4d 00 44 00 5f 00 08 00 5a 00 68 00 2b 00 32 00 68 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 6 of ($s*) and 1 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 6 of ( $s* ) and 1 of ( $seq* )
 }
 rule ARKBIRD_SOLG_Loa_JS_Gootkit_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect JS loader used on the Gootkit killchain (November 2020)"
 		author = "Arkbird_SOLG"
-		id = "649133bd-a44c-5d99-befa-0508fed27ed8"
+		id = "92eab92a-f5d1-5871-ad81-bc39b6c68482"
 		date = "2020-11-21"
 		modified = "2020-11-21"
 		reference = "https://twitter.com/ffforward/status/1330214661577437187"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-21/Gootkit/Loa_JS_Gootkit_Nov_2020_1.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "f24d31e7107b8c59b969481596a5e1369933bf2b0fa5117cd1aa5f7ea116d8d5"
+		logic_hash = "v1_sha256_f24d31e7107b8c59b969481596a5e1369933bf2b0fa5117cd1aa5f7ea116d8d5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206834,20 +206856,20 @@ rule ARKBIRD_SOLG_Loa_JS_Gootkit_Nov_2020_1 : FILE
 		$s5 = { 7b [4-6] 5b [4-6] 5d 20 3d 20 [4-6] 5b [4-6] 5b [4-6] 5d 5d 3b 7d }
 
 	condition:
-		filesize >1KB and 2 of them
+		filesize > 1KB and 2 of them
 }
 rule ARKBIRD_SOLG_APT_APT29_Miniduke_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect MiniDuke implant used by APT29 group"
 		author = "Arkbird_SOLG"
-		id = "2faefc2f-afe3-51df-b530-50d3b3775071"
+		id = "45170c3a-13e8-53e5-90c8-faa915026280"
 		date = "2021-03-08"
 		modified = "2021-03-10"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_MiniDuke_Mar_2021_1.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "2fcbe37f9ee26a246bfc397cc907bb570a01d0f5b8e323a81aae0f6426b60435"
+		logic_hash = "v1_sha256_2fcbe37f9ee26a246bfc397cc907bb570a01d0f5b8e323a81aae0f6426b60435"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -206862,20 +206884,20 @@ rule ARKBIRD_SOLG_APT_APT29_Miniduke_Mar_2021_1 : FILE
 		$s5 = { 8b 85 54 64 ff ff 8b 95 44 64 ff ff 83 c2 44 89 44 24 04 89 14 24 e8 a4 e5 fc ff 83 ec 08 8b 85 44 64 ff ff 83 c0 38 c7 44 24 08 0c 00 00 00 c7 44 24 04 00 00 00 00 89 04 24 e8 8c e8 fd ff 8b 85 44 64 ff ff c7 40 38 0c 00 00 00 8b 85 44 64 ff ff c7 40 40 01 00 00 00 8b 85 44 64 ff ff c7 40 3c 00 00 00 00 8b 85 44 64 ff ff 8d 58 38 8b 85 44 64 ff ff 8d 50 1c 8b 85 44 64 ff ff 83 c0 18 c7 44 24 0c 00 40 00 00 89 5c 24 08 89 54 24 04 89 04 24 e8 2e e5 fc ff 83 ec 10 85 c0 0f 95 c0 84 c0 0f 84 09 05 00 00 8b 85 44 64 ff ff 8d 58 38 8b 85 44 64 ff ff 8d 50 24 8b 85 44 64 ff ff 83 c0 20 c7 44 24 0c 00 40 00 00 89 5c 24 08 89 54 24 04 89 04 24 e8 eb e4 fc ff 83 ec 10 85 c0 0f 95 c0 84 c0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >150KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize > 150KB and 3 of them
 }
 rule ARKBIRD_SOLG_APT_APT29_Fatduke_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect Fatduke implant used by APT29 group"
 		author = "Arkbird_SOLG"
-		id = "aed6d6f0-1baf-5842-8ced-e07f213ef1ff"
+		id = "8c64f89b-31df-584d-a229-f5d50ebb089e"
 		date = "2021-03-08"
 		modified = "2021-03-10"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_Fatduke_Mar_2021_1.yar#L1-L25"
 		license_url = "N/A"
-		logic_hash = "2aec00355b14ec81f577527d3eba1f682ce96cc9e6ac7727b3865ddf01ddf69a"
+		logic_hash = "v1_sha256_2aec00355b14ec81f577527d3eba1f682ce96cc9e6ac7727b3865ddf01ddf69a"
 		score = 50
 		quality = 67
 		tags = "FILE"
@@ -206893,20 +206915,20 @@ rule ARKBIRD_SOLG_APT_APT29_Fatduke_Mar_2021_1 : FILE
 		$op4 = { 61 46 25 7c 5f 56 21 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >350KB and 2 of ($seq*) and 3 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize > 350KB and 2 of ( $seq* ) and 3 of ( $op* )
 }
 rule ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect PolyglotDuke implant used by APT29 group"
 		author = "Arkbird_SOLG"
-		id = "751e4f57-2c31-5cad-a794-e124b40c537b"
+		id = "95e5ea03-a44c-5a5c-a4fa-1be3aa0b1912"
 		date = "2021-03-08"
 		modified = "2021-03-10"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_PolyglotDuke_Mar_2021_1.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "3a6d54fb266fe054886569c200f122b1e4459e0d561fe5246b623a19ec526224"
+		logic_hash = "v1_sha256_3a6d54fb266fe054886569c200f122b1e4459e0d561fe5246b623a19ec526224"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -206920,7 +206942,7 @@ rule ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1 : FILE
 		$seq4 = "InitSvc" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 3 of them
 }
 import "pe"
 
@@ -206929,13 +206951,13 @@ rule ARKBIRD_SOLG_MAL_Stealer_Cookie_July_2020_1 : FILE
 	meta:
 		description = "Detect strings used by EdgeCookiesView and ChromeCookiesView in the ressources of the Cookie Stealer"
 		author = "Arkbird_SOLG"
-		id = "02a68973-73b2-572a-a358-f0edc921773a"
+		id = "d70f73ad-1349-567e-bc73-6973090ce759"
 		date = "2020-07-09"
 		modified = "2020-07-09"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1281154921811841026"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-09/MAL_Stealer_Cookie_July_2020_1.yar#L3-L32"
 		license_url = "N/A"
-		logic_hash = "63747567a9dd68ac0d16b67910957cb9bc28d7237f431ac0c76403ca810e1b94"
+		logic_hash = "v1_sha256_63747567a9dd68ac0d16b67910957cb9bc28d7237f431ac0c76403ca810e1b94"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -206963,7 +206985,7 @@ rule ARKBIRD_SOLG_MAL_Stealer_Cookie_July_2020_1 : FILE
 		$s19 = "c:\\Projects\\VS2005\\EdgeCookiesView\\Release\\EdgeCookiesView.pdb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2600KB and (pe.imphash()=="89c8a19cc2d9172de5901988530c700d" or ((3 of ($x*)) and (8 of ($s*))))
+		uint16( 0 ) == 0x5a4d and filesize < 2600KB and ( pe.imphash ( ) == "89c8a19cc2d9172de5901988530c700d" or ( ( 3 of ( $x* ) ) and ( 8 of ( $s* ) ) ) )
 }
 import "pe"
 
@@ -206972,13 +206994,13 @@ rule ARKBIRD_SOLG_APT_Sidewinder_NET_Loader_Aug_2020_1 : FILE
 	meta:
 		description = "Detected the NET loader used by SideWinder group (August 2020)"
 		author = "Arkbird_SOLG"
-		id = "7334a3b8-cd56-5820-a073-5bd22076644f"
+		id = "58aed6bf-9b08-5fc9-af15-2809d44b487c"
 		date = "2020-08-24"
 		modified = "2020-08-24"
 		reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-24/SideWinder/APT_SideWinder_NET_Loader_Aug_2020_1.yar#L3-L21"
 		license_url = "N/A"
-		logic_hash = "b40127cd845d75ef81eb230c12635da00dd77fc53e5886c253a2466627aa8534"
+		logic_hash = "v1_sha256_b40127cd845d75ef81eb230c12635da00dd77fc53e5886c253a2466627aa8534"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -206995,20 +207017,20 @@ rule ARKBIRD_SOLG_APT_Sidewinder_NET_Loader_Aug_2020_1 : FILE
 		$s8 = "copytight @" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4KB and ((pe.exports("FileRipper") and pe.exports("Gadgets")) and 5 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 4KB and ( ( pe.exports ( "FileRipper" ) and pe.exports ( "Gadgets" ) ) and 5 of them )
 }
 rule ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1 : FILE
 {
 	meta:
 		description = "Detect Redline Stealer (August 2020)"
 		author = "Arkbird_SOLG"
-		id = "6fda87c3-0d00-5c00-a1ff-6d96dd726ddf"
+		id = "d86a186d-cd3c-5fdc-9171-1f2ebc1297b9"
 		date = "2020-08-24"
 		modified = "2020-08-24"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1297878628450152448"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-24/Redline/Mal_Stealer_NET_Redline_Aug_2020_1.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "950641dfaf17f332e6a18961aebb2533732d82ce69f3617efa08cc63272f1786"
+		logic_hash = "v1_sha256_950641dfaf17f332e6a18961aebb2533732d82ce69f3617efa08cc63272f1786"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207037,20 +207059,20 @@ rule ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1 : FILE
 		$s20 = "get_encryptedPassword" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <90KB and 15 of them
+		uint16( 0 ) == 0x5a4d and filesize < 90KB and 15 of them
 }
 rule ARKBIRD_SOLG_MAL_Windealer_Oct_2021_1 : FILE
 {
 	meta:
 		description = "Detect WinDealer implant"
 		author = "Arkbird_SOLG"
-		id = "7ffece8a-b56a-5893-a135-3001c0327f66"
+		id = "5d5049c3-0561-5a55-a46c-41da049addfa"
 		date = "2021-10-30"
 		modified = "2021-10-31"
 		reference = "https://blogs.jpcert.or.jp/en/2021/10/windealer.html"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-30/WinDealer/MAL_WinDealer_Oct_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "b6211274a0ffa55723d3c34763540278197507b4bd4b853249e16501a3aa5acb"
+		logic_hash = "v1_sha256_b6211274a0ffa55723d3c34763540278197507b4bd4b853249e16501a3aa5acb"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -207067,20 +207089,20 @@ rule ARKBIRD_SOLG_MAL_Windealer_Oct_2021_1 : FILE
 		$s5 = { 8b d8 59 85 db 59 74 57 56 e8 [2] 00 00 03 d8 53 ff 15 [2] 41 00 6a 00 50 e8 [2] ff ff 6a 64 8d 45 9c 6a 00 50 e8 [2] 00 00 83 c4 1c 8d 45 9c 68 [2] 41 00 68 [2] 41 00 50 ff 15 [2] 41 00 66 8b 8f d2 07 00 00 51 8a 8f d0 07 00 00 51 50 8d 45 9c 50 e8 ?? f1 ff ff 83 c4 1c 5f 5e 33 c0 5b c9 c3 55 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >80KB and 4 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 80KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Windealer_Oct_2021_2 : FILE
 {
 	meta:
 		description = "Detect modules from WinDealer implant"
 		author = "Arkbird_SOLG"
-		id = "3cca1fa1-2651-5a93-bef1-d32a7b5be4c9"
+		id = "264d5962-9106-556a-8f97-660abd8b8115"
 		date = "2021-10-30"
 		modified = "2021-10-31"
 		reference = "https://blogs.jpcert.or.jp/en/2021/10/windealer.html"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-30/WinDealer/MAL_WinDealer_Oct_2021_2.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "c2fb5697dcdb34e0fb3e2dbd2df05748eddc2796c253e90503372eb73c475fab"
+		logic_hash = "v1_sha256_c2fb5697dcdb34e0fb3e2dbd2df05748eddc2796c253e90503372eb73c475fab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207097,20 +207119,20 @@ rule ARKBIRD_SOLG_MAL_Windealer_Oct_2021_2 : FILE
 		$s5 = { 56 6a 10 e8 [3] 00 8b f0 85 f6 74 3a 8b 4c 24 0c 8d 46 04 85 c9 c7 06 [3] 10 c7 00 00 00 00 00 50 74 11 8b 44 24 0c 50 e8 [3] 00 89 46 08 8b c6 5e c3 8b 4c 24 0c 51 e8 [3] 00 89 46 08 8b c6 5e c3 33 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >80KB and 4 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 80KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Matrix_Sep_2020_1 : FILE
 {
 	meta:
 		description = "Detect MATRIX ransomware"
 		author = "Arkbird_SOLG"
-		id = "a7df188c-e381-55e6-97e6-45f5830ff0d3"
+		id = "b8364d2d-33c7-5afd-a51e-40c597242161"
 		date = "2020-10-15"
 		modified = "2020-10-15"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-15/MATRIX/RAN_Matrix_Sep_2020_1.yar#L1-L28"
 		license_url = "N/A"
-		logic_hash = "e832b258e8d2ee94ebbf2e715ca01960a92d723ee017261b18ce05d3095bf8a3"
+		logic_hash = "v1_sha256_e832b258e8d2ee94ebbf2e715ca01960a92d723ee017261b18ce05d3095bf8a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207136,20 +207158,20 @@ rule ARKBIRD_SOLG_RAN_Matrix_Sep_2020_1 : FILE
 		$reg5 = { 47 00 45 00 54 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >500KB and 4 of ($debug*) and 3 of ($reg*)
+		uint16( 0 ) == 0x5a4d and filesize > 500KB and 4 of ( $debug* ) and 3 of ( $reg* )
 }
 rule ARKBIRD_SOLG_RAN_Crylock_Oct_2020_1 : FILE
 {
 	meta:
 		description = "Detect CryLock ransomware V2.0.0"
 		author = "Arkbird_SOLG"
-		id = "642211e0-b5fe-5842-ab16-ca1fc8d00ac0"
+		id = "c86ab4f1-82d9-50c3-b96d-cb4fdbcd70b7"
 		date = "2020-10-14"
 		modified = "2020-10-15"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1316426560803680257"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-15/Crylock/RAN_CryLock_Oct_2020_1.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "5d9aae41283c5738f2e584ea8d236ae64f7615ec629f9513fddb611714ddc230"
+		logic_hash = "v1_sha256_5d9aae41283c5738f2e584ea8d236ae64f7615ec629f9513fddb611714ddc230"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -207174,7 +207196,7 @@ rule ARKBIRD_SOLG_RAN_Crylock_Oct_2020_1 : FILE
 		$ran6 = "<%HID%>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and 3 of ($s*) and 4 of ($debug*) and 4 of ($ran*)
+		uint16( 0 ) == 0x5a4d and filesize > 300KB and 3 of ( $s* ) and 4 of ( $debug* ) and 4 of ( $ran* )
 }
 import "pe"
 
@@ -207183,13 +207205,13 @@ rule ARKBIRD_SOLG_TA505_Bin_21Nov_1 : FILE
 	meta:
 		description = "module1.bin"
 		author = "Arkbird_SOLG"
-		id = "2f23653e-5158-5a64-86ee-a58048780661"
+		id = "1536c862-9210-5cd3-aef9-e21b60720766"
 		date = "2019-11-21"
 		modified = "2019-11-21"
 		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L3-L30"
 		license_url = "N/A"
-		logic_hash = "133f202300a9e0428d20ce76bc832cf45cb5dacb05e39c21130d8d5cc39446ba"
+		logic_hash = "v1_sha256_133f202300a9e0428d20ce76bc832cf45cb5dacb05e39c21130d8d5cc39446ba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207214,7 +207236,7 @@ rule ARKBIRD_SOLG_TA505_Bin_21Nov_1 : FILE
 		$s16 = ":!:,:>:J:X:^:c:i:v:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (pe.imphash()=="642f4619fb2d93cb205c65c2546516ca" and pe.exports("intc") or 8 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( pe.imphash ( ) == "642f4619fb2d93cb205c65c2546516ca" and pe.exports ( "intc" ) or 8 of them )
 }
 import "pe"
 
@@ -207223,13 +207245,13 @@ rule ARKBIRD_SOLG_TA505_Bin_21Nov_2 : FILE
 	meta:
 		description = "vspub1.bin"
 		author = "Arkbird_SOLG"
-		id = "2bbd1d3a-50ab-5c6a-97fe-60b5a86e8d18"
+		id = "9f61e354-d212-5721-9ad2-dcd9e1accd2b"
 		date = "2019-11-21"
 		modified = "2019-11-21"
 		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L32-L50"
 		license_url = "N/A"
-		logic_hash = "43fb83abdeb1a31da836b4cf99dcda269f6d005cbb8eb2d845498d2c589574e1"
+		logic_hash = "v1_sha256_43fb83abdeb1a31da836b4cf99dcda269f6d005cbb8eb2d845498d2c589574e1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207245,22 +207267,20 @@ rule ARKBIRD_SOLG_TA505_Bin_21Nov_2 : FILE
 		$s7 = "T0p0v0|0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (pe.imphash()=="ff6dd5f31dd7c538ebc02542f09f4280" and pe.exports("setColor") or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( pe.imphash ( ) == "ff6dd5f31dd7c538ebc02542f09f4280" and pe.exports ( "setColor" ) or all of them )
 }
-import "pe"
-
 rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_1 : FILE
 {
 	meta:
 		description = "invitation.doc"
 		author = "Arkbird_SOLG"
-		id = "10562979-0b90-5752-89b8-f0d35121df41"
+		id = "2dc6b753-9cef-5c12-9099-9e24ec980026"
 		date = "2019-11-21"
 		modified = "2019-11-21"
 		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L52-L83"
 		license_url = "N/A"
-		logic_hash = "7d2cbc0a505c245aa3e9e8a76cebc7ea7dbd4bd3be26a858f731b96791293ba5"
+		logic_hash = "v1_sha256_7d2cbc0a505c245aa3e9e8a76cebc7ea7dbd4bd3be26a858f731b96791293ba5"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -207289,22 +207309,20 @@ rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_1 : FILE
 		$s20 = "EP0NM4RB.DLL = 1" fullword wide
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <3000KB and 1 of ($x*) and 4 of them
+		uint16( 0 ) == 0xcfd0 and filesize < 3000KB and 1 of ( $x* ) and 4 of them
 }
-import "pe"
-
 rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_2 : FILE
 {
 	meta:
 		description = "invitation (1).xls"
 		author = "Arkbird_SOLG"
-		id = "e6328342-0d08-58a3-befe-15de41649763"
+		id = "5b047fff-7c3d-51a5-9756-5b1755eb6295"
 		date = "2019-11-21"
 		modified = "2019-11-21"
 		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L85-L116"
 		license_url = "N/A"
-		logic_hash = "84c7f064fb813934e397d81dad8af6288cb919e046cd2bb16f9ca6dc348c43c2"
+		logic_hash = "v1_sha256_84c7f064fb813934e397d81dad8af6288cb919e046cd2bb16f9ca6dc348c43c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207333,22 +207351,20 @@ rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_2 : FILE
 		$s20 = "C:\\Windows\\system32\\stdole2.tlb" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <5000KB and 1 of ($x*) and 4 of them
+		uint16( 0 ) == 0xcfd0 and filesize < 5000KB and 1 of ( $x* ) and 4 of them
 }
-import "pe"
-
 rule ARKBIRD_SOLG_Malware_Casbaneiro_MSI : FILE
 {
 	meta:
 		description = "Detect MSIPackage used by Casbaneiro"
 		author = "Arkbird_SOLG"
-		id = "47a5ea47-f799-5467-a482-9816c0de3ecf"
+		id = "4ee9b1df-133d-5b4d-9adb-6bced12d5637"
 		date = "2020-06-05"
 		modified = "2020-06-05"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1268811438707159040"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-05/Casbaneiro/Casbaneiro_stealer.yar#L3-L22"
 		license_url = "N/A"
-		logic_hash = "fa1c53268d51b4b34b4cf4cd84ddb43ffba1dfa8bbe73cd7506f5e31e970855b"
+		logic_hash = "v1_sha256_fa1c53268d51b4b34b4cf4cd84ddb43ffba1dfa8bbe73cd7506f5e31e970855b"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -207366,20 +207382,20 @@ rule ARKBIRD_SOLG_Malware_Casbaneiro_MSI : FILE
 		$s9 = "7zS.sfx.exe" fullword ascii
 
 	condition:
-		uint16(0)==0xd0cf and filesize >100KB and 7 of them
+		uint16( 0 ) == 0xd0cf and filesize > 100KB and 7 of them
 }
 rule ARKBIRD_SOLG_MAL_Shark_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect Shark backdoor used by Hexane group (aka Siamesekitten)"
 		author = "Arkbird_SOLG"
-		id = "881dcdd9-2f4d-51d3-b046-15cdb2a2cb55"
+		id = "042c63af-24ba-5cb8-9ccf-68f253a68dd6"
 		date = "2021-08-18"
 		modified = "2021-08-19"
 		reference = "https://www.clearskysec.com/siamesekitten/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-19/Hexane/MAL_Shark_Aug_2021_1.yara#L1-L24"
 		license_url = "N/A"
-		logic_hash = "c14abb839f4af81a3db38719f23c47498d577a779950e66978ff14d015043490"
+		logic_hash = "v1_sha256_c14abb839f4af81a3db38719f23c47498d577a779950e66978ff14d015043490"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207400,20 +207416,20 @@ rule ARKBIRD_SOLG_MAL_Shark_Aug_2021_1 : FILE
 		$s7 = { 65 00 63 00 68 00 6f 00 20 00 [2-10] 20 00 7c 00 20 00 64 00 65 00 6c 00 20 00 [2-10] 2e 00 62 00 61 00 74 00 00 0f [2-10] 00 2e 00 62 00 61 00 74 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >15KB and 6 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 15KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Milan_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect Milian backdoor used by Hexane group (aka Siamesekitten)"
 		author = "Arkbird_SOLG"
-		id = "34acac5a-6090-5a68-9afb-4da7073bed58"
+		id = "c96ca7f1-ae74-542d-afc8-b4b47851b450"
 		date = "2021-08-18"
 		modified = "2021-08-19"
 		reference = "https://www.clearskysec.com/siamesekitten/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-19/Hexane/MAL_Milan_Aug_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "bad8ae2a9275bcb6e0e903fda6a128a1bed676c8e1a8e653e9fc3467766ce7fc"
+		logic_hash = "v1_sha256_bad8ae2a9275bcb6e0e903fda6a128a1bed676c8e1a8e653e9fc3467766ce7fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207432,20 +207448,20 @@ rule ARKBIRD_SOLG_MAL_Milan_Aug_2021_1 : FILE
 		$s5 = { 6a 00 ff b5 40 ef ff ff ff b3 88 01 00 00 ff 15 30 b0 4b 00 50 57 6a ff 56 8b b5 48 ef ff ff 56 ff 15 ?? b2 4b 00 85 c0 0f 85 b2 02 00 00 8d bd 00 ef ff ff ab ab ab ab 8d 85 00 ef ff ff 50 ff 15 ?? b2 4b 00 85 c0 0f 84 74 02 00 00 8b 95 04 ef ff ff 85 d2 0f 84 4f 01 00 00 33 c0 8d bd b8 ee ff ff 6a 06 59 f3 ab 83 a5 c8 ee ff ff 00 8d bd f4 ee ff ff 83 a5 c4 ee ff ff 00 40 89 85 bc ee ff ff 89 85 cc ee ff ff 33 c0 ab c7 85 b8 ee ff ff 03 00 00 00 89 95 c0 ee ff ff ab ab 8d 43 08 83 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >15KB and 1 of ($c*) and 4 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 15KB and 1 of ( $c* ) and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Evilnum_LNK_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect LNK file used by EvilNum group"
 		author = "Arkbird_SOLG"
-		id = "9d570c02-606a-5bff-af7a-9b5ef1e6df90"
+		id = "d3923200-9545-579a-b3ba-d036838300c4"
 		date = "2020-07-13"
 		modified = "2021-07-14"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-13/EvilNum/APT_EvilNum_LNK_Jul_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "d20aadfce6a0246f415f94a62edbf7fd48dcdcd9756a5a8d898a5459633b9350"
+		logic_hash = "v1_sha256_d20aadfce6a0246f415f94a62edbf7fd48dcdcd9756a5a8d898a5459633b9350"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207465,20 +207481,20 @@ rule ARKBIRD_SOLG_APT_Evilnum_LNK_Jul_2021_1 : FILE
 		$s7 = { 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 41 00 63 00 63 00 65 00 73 00 73 00 6f 00 72 00 69 00 65 00 73 00 5c 00 77 00 6f 00 72 00 64 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 }
 
 	condition:
-		filesize >60KB and 6 of ($s*)
+		filesize > 60KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Evilnum_JS_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect JS script used by EvilNum group"
 		author = "Arkbird_SOLG"
-		id = "08b410c4-4899-5280-9735-6b3017c7a813"
+		id = "2a66020d-d8ba-5dfb-8d58-9bd223b80fd8"
 		date = "2020-07-13"
 		modified = "2021-07-14"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-13/EvilNum/APT_EvilNum_JS_Jul_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "0ace40e54f6dca078f17e7e157c7973642b83366ba792d2bcdc0d971f729fb68"
+		logic_hash = "v1_sha256_0ace40e54f6dca078f17e7e157c7973642b83366ba792d2bcdc0d971f729fb68"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -207498,20 +207514,20 @@ rule ARKBIRD_SOLG_APT_Evilnum_JS_Jul_2021_1 : FILE
 		$s7 = { 5b ?? 5d 20 3d 20 ?? 20 2b 20 22 2d 22 20 2b 20 ?? 20 2b 20 22 2d 22 20 2b 20 ?? 20 2b 20 22 54 22 20 2b 20 ?? 20 2b 20 22 3a 22 20 2b 20 ?? 20 2b 20 22 3a 22 20 2b 20 ?? 3b }
 
 	condition:
-		filesize >8KB and 6 of ($s*)
+		filesize > 8KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Moriya_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect Moriya rootkit used in the TunnelSnake operation"
 		author = "Arkbird_SOLG"
-		id = "6a78ddc0-b39f-5aec-9c54-980854173abf"
+		id = "b49d6f33-e72f-5add-a663-689f1c988751"
 		date = "2020-05-07"
 		modified = "2021-05-26"
 		reference = "https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-26/Moriya/MAL_Moriya_May_2021_1.yara#L1-L27"
 		license_url = "N/A"
-		logic_hash = "f73049f261428c8921a2c8a86fb5d242719e5dc9f30a5c58e86be1a79d84a42d"
+		logic_hash = "v1_sha256_f73049f261428c8921a2c8a86fb5d242719e5dc9f30a5c58e86be1a79d84a42d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207536,20 +207552,20 @@ rule ARKBIRD_SOLG_MAL_Moriya_May_2021_1 : FILE
 		$s8 = "Moriya start\n" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and (3 of ($seq*) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize > 6KB and ( 3 of ( $seq* ) or 6 of ( $s* ) )
 }
 rule ARKBIRD_SOLG_MAL_Moriya_May_2021_2 : FILE
 {
 	meta:
 		description = "Detect Moriya rootkit used in the TunnelSnake operation"
 		author = "Arkbird_SOLG"
-		id = "25cecff1-94f9-5e8d-8758-9b891e9d7373"
+		id = "1162140f-86c1-53fe-a081-a11984769a8f"
 		date = "2020-05-26"
 		modified = "2021-05-27"
 		reference = "https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-26/Moriya/MAL_Moriya_May_2021_2.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "11ef00940604c3337b1c8c00903297343cfd4e8f3899b949d58e4203ab68d3fd"
+		logic_hash = "v1_sha256_11ef00940604c3337b1c8c00903297343cfd4e8f3899b949d58e4203ab68d3fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207569,20 +207585,20 @@ rule ARKBIRD_SOLG_MAL_Moriya_May_2021_2 : FILE
 		$s4 = "\\DosDevices\\MoriyaStreamWatchmen" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and (3 of ($seq*) or 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize > 6KB and ( 3 of ( $seq* ) or 2 of ( $s* ) )
 }
 rule ARKBIRD_SOLG_EXP_CVE_2021_1647_Apr_2021_1 : CVE_2021_1647 FILE
 {
 	meta:
 		description = "Detect CVE-2021-1647 tool "
 		author = "Arkbird_SOLG"
-		id = "c4c14d22-adf8-51b1-b898-7e253447824f"
+		id = "2a4591c3-7e93-5ed6-bfc1-3a7c9630f35e"
 		date = "2021-05-04"
 		modified = "2021-05-05"
 		reference = "-"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-04/CVE-2021-1647/EXP_CVE_2021_1647_Apr_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "58f16973f68b1b792f6f1575b6a3f386493d033767ee97e48a33044e3ddc3426"
+		logic_hash = "v1_sha256_58f16973f68b1b792f6f1575b6a3f386493d033767ee97e48a33044e3ddc3426"
 		score = 75
 		quality = 75
 		tags = "CVE-2021-1647, FILE"
@@ -207598,20 +207614,20 @@ rule ARKBIRD_SOLG_EXP_CVE_2021_1647_Apr_2021_1 : CVE_2021_1647 FILE
 		$seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }
 
 	condition:
-		filesize >10KB and all of them
+		filesize > 10KB and all of them
 }
 rule ARKBIRD_SOLG_MAL_Emotet_Nov_2021_1 : FILE
 {
 	meta:
 		description = "Detect Emotet loader"
 		author = "Arkbird_SOLG"
-		id = "ad67c735-7ed9-5440-b693-55dce9840f56"
+		id = "934b6da6-a531-56f4-bcfa-827d23d0c130"
 		date = "2021-11-15"
 		modified = "2021-11-16"
 		reference = "https://cyber.wtf/2021/11/15/guess-whos-back/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-16/MAL_Emotet_Nov_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "9ae3cbf863fdf3addd7ec00b4d6b55024c3159156518ef15fff79f5a92988297"
+		logic_hash = "v1_sha256_9ae3cbf863fdf3addd7ec00b4d6b55024c3159156518ef15fff79f5a92988297"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207628,20 +207644,20 @@ rule ARKBIRD_SOLG_MAL_Emotet_Nov_2021_1 : FILE
 		$s5 = { 83 20 00 33 c9 21 4d e8 53 8b 5d 08 57 33 ff 89 4d e4 89 7d e0 8b 03 85 c0 74 56 8d 4d fc 66 c7 45 fc 2a 3f 51 50 c6 45 fe 00 e8 12 55 00 00 59 59 85 c0 75 1a 8d 45 e0 50 33 c0 50 50 ff 33 e8 13 01 00 00 8b f0 83 c4 10 85 f6 75 74 eb 13 8d 4d e0 51 50 ff 33 e8 ad 01 00 00 83 c4 0c 85 c0 75 1d 83 c3 04 8b 03 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 4 of them
 }
 rule ARKBIRD_SOLG_MAL_Klingon_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Klingon RAT"
 		author = "Arkbird_SOLG"
-		id = "bf114c4d-3010-5b34-954e-82794e30edcb"
+		id = "2a47b220-7989-529d-9b74-65649e302f37"
 		date = "2021-06-19"
 		modified = "2021-06-21"
 		reference = "https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-20/Klingon/MAL_Klingon_Jun_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "283452d24edea988dc353fada4cd1e050db244a48cc6ab30f70e1900ca9c7c2f"
+		logic_hash = "v1_sha256_283452d24edea988dc353fada4cd1e050db244a48cc6ab30f70e1900ca9c7c2f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207657,20 +207673,20 @@ rule ARKBIRD_SOLG_MAL_Klingon_Jun_2021_1 : FILE
 		$seq3 = { 48 8d 0d [3] 00 48 89 8c 24 ?? 00 00 00 48 8b 94 24 ?? 00 00 00 48 89 94 24 ?? 00 00 00 48 89 8c 24 ?? 00 00 00 48 8b 94 24 ?? 00 00 00 48 89 94 24 ?? 00 00 00 48 89 8c 24 ?? 00 00 00 48 89 84 24 ?? 00 00 00 48 8d 05 [3] 00 48 89 04 24 48 c7 44 24 08 08 00 00 00 48 8d 84 24 ?? 00 00 00 48 89 44 24 10 48 c7 44 24 18 03 00 00 00 48 c7 44 24 20 03 00 00 00 e8 [3] ff 48 8b 44 24 30 48 89 44 24 58 48 8b 4c 24 28 48 89 8c 24 ?? 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and all of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 300KB and all of ( $seq* )
 }
 rule ARKBIRD_SOLG_APT_APT_C_61_Dec_2021_1 : FILE
 {
 	meta:
 		description = "Detect similiar structures used in the APT-C-61 maldocs"
 		author = "Arkbird_SOLG"
-		id = "48054d32-6613-5a54-b19c-8e9b8f747c14"
+		id = "986d9391-c016-568f-8e64-a0aed12374a5"
 		date = "2021-12-13"
 		modified = "2021-12-14"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-13/APT_APT_C_61_Dec_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "be742a0ebc53f09872d5231cf367bb1e3ae04c1a70ce94610b6597e426eeb389"
+		logic_hash = "v1_sha256_be742a0ebc53f09872d5231cf367bb1e3ae04c1a70ce94610b6597e426eeb389"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -207687,20 +207703,20 @@ rule ARKBIRD_SOLG_APT_APT_C_61_Dec_2021_1 : FILE
 		$s4 = { 3c 77 3a 72 3e 3c 77 3a 69 6e 73 74 72 54 65 78 74 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 3e 20 44 44 45 3c 2f 77 3a 69 6e 73 74 72 54 65 78 74 3e 3c 2f 77 3a 72 3e }
 
 	condition:
-		uint16(0)==0x4b50 and filesize >20KB and all of ($s*)
+		uint16( 0 ) == 0x4b50 and filesize > 20KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Sidoh_Stealer_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect Sidoh Stealer used by RYUK group"
 		author = "Arkbird_SOLG"
-		id = "b4661304-6dfa-5c33-95f2-8694271b9e58"
+		id = "1a105b4a-0cea-51f9-8b2a-57f608a4a79d"
 		date = "2021-08-31"
 		modified = "2021-09-01"
 		reference = "https://www.crowdstrike.com/blog/sidoh-wizard-spiders-mysterious-exfiltration-tool/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-31/Sidoh/MAL_Sidoh_Stealer_Aug_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "baeea14c6be42d64d3ca68298bf6ced34c9587fcda91471945cfc7ed1fe267bd"
+		logic_hash = "v1_sha256_baeea14c6be42d64d3ca68298bf6ced34c9587fcda91471945cfc7ed1fe267bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207718,20 +207734,20 @@ rule ARKBIRD_SOLG_MAL_Sidoh_Stealer_Aug_2021_1 : FILE
 		$s4 = { 6a 04 68 00 10 00 00 ff 75 c4 6a 00 ff d3 8b d8 85 db 75 1a 68 00 80 00 00 50 57 ff 15 ?? 30 41 00 56 ff 15 ?? 31 41 00 59 6a fb 58 eb 79 6a 00 68 ?? ?? 41 00 56 ff 15 ?? 31 41 00 ff 75 c8 8b f0 ff 75 c4 53 56 ff 15 ?? 31 41 00 56 ff 15 ?? 31 41 00 ff 75 f4 ff 15 ?? 31 41 00 ff 75 08 8b 55 c4 8b cb ff 75 f0 e8 3b 02 00 00 8b f0 83 c4 2c 85 f6 75 14 83 7d 08 05 75 0e 8b 55 c4 51 8b cb e8 b3 09 00 00 59 8b f0 68 00 80 00 00 6a 00 53 ff 15 ?? 30 41 00 68 00 80 00 00 6a 00 57 ff 15 ?? 30 41 00 8b c6 5f 5e 5b 8b e5 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >20KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 20KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Milum_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect Milum malware"
 		author = "Arkbird_SOLG"
-		id = "ba1cc56e-f6da-57db-a773-4823ae343e31"
+		id = "bf58de9d-7a03-5adb-b343-a4df387a870e"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://securelist.com/wildpressure-targets-macos/103072/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-08/WildPressure/MAL_Milum_Jul_2021_1.yara#L1-L33"
 		license_url = "N/A"
-		logic_hash = "4321051fdc9ab5f4ee12c4b505e4271df89b489067875eaf3d2cb670815f7e37"
+		logic_hash = "v1_sha256_4321051fdc9ab5f4ee12c4b505e4271df89b489067875eaf3d2cb670815f7e37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207752,20 +207768,65 @@ rule ARKBIRD_SOLG_MAL_Milum_Jul_2021_1 : FILE
 		$s8 = { 8b 45 08 50 68 bc 78 45 00 68 d0 78 45 00 8d 8d d0 fc ff ff 51 ff d6 83 c4 10 8b 3d a0 e0 44 00 8b 35 c4 e0 44 00 8d 64 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 40KB and 5 of ( $s* )
+}
+import "pe"
+
+rule ARKBIRD_SOLG_APT_Lazarus_Stealer_Packed_July_2020_1 : FILE
+{
+	meta:
+		description = "Detected Lazarus Strealer Packed by Thermida - July 2020"
+		author = "Arkbird_SOLG"
+		id = "7cea9ddb-f954-5a84-b106-bae1acac0bdd"
+		date = "2020-07-23"
+		modified = "2023-11-22"
+		reference = "https://twitter.com/DeadlyLynn/status/1286233135751995397"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-23/Yara_Rule_APT_Lazarus_Stealer_July_2020_1.yar#L36-L66"
+		license_url = "N/A"
+		logic_hash = "v1_sha256_f062c8f784133ad586490036757ff9d5e8a799e8abac94eeacf60743783e19ed"
+		score = 75
+		quality = 50
+		tags = "FILE"
+		hash1 = "431e6784ef33f2b3963464458e73915875947b11348533544cc16c53af64740f"
+		hash2 = "70f45a7bbddda140695b953254650486733d8039c63e4eaeb454c1189a97989b"
+
+	strings:
+		$s1 = "fill_win32_filefunc64" fullword ascii
+		$s2 = "gzfread" fullword ascii
+		$s3 = "deflateGetDictionary" fullword ascii
+		$s4 = "gzfwrite" fullword ascii
+		$s5 = "adler32_z" fullword ascii
+		$s6 = "@AJ<LxwBMDNCIFE}#SRV" fullword ascii
+		$s7 = "uncompress2" fullword ascii
+		$s8 = "zxyakauj" fullword ascii
+		$s9 = "gzfwrite" fullword ascii
+		$s10 = "tphfpzvy" fullword ascii
+		$s11 = "Dn.dll" fullword ascii
+		$s12 = ":USER32.8dl" fullword ascii
+		$s13 = "zlib data compression and ZIP file I/O library" fullword wide
+		$s14 = "Dn64.dll" fullword ascii
+		$s15 = "zlibwapi.dll" fullword ascii
+		$s16 = "CTRL+_" fullword ascii
+		$s17 = "ZLib.DLL" fullword ascii
+		$s18 = "(C) 1995-2017 Jean-loup Gailly & Mark Adler-" fullword ascii
+		$s19 = "zlib data compression and ZIP file I/O library" fullword ascii
+		$s20 = "DLL support by Alessandro Iacopetti & Gilles Vollant" fullword ascii
+
+	condition:
+		uint16( 0 ) == 0x5a4d and filesize < 550KB and pe.imphash ( ) == "baa93d47220682c04d92f7797d9224ce" and pe.exports ( "BZ2_bzInit" ) and pe.exports ( "BZ2_bzZip" ) and pe.exports ( "BZ2_bzZipW" ) and pe.exports ( "adler32_z" ) and pe.exports ( "crc32_z" ) and pe.exports ( "deflateGetDictionary" ) and 15 of them
 }
 rule ARKBIRD_SOLG_MAL_Heinote_June_2020_1 : FILE
 {
 	meta:
 		description = "Detect Hienote malware"
 		author = "Arkbird_SOLG"
-		id = "5c0e604a-83d4-5c6f-83fa-0df878da80d8"
+		id = "d424d754-9f61-5c36-bb64-726309ecc3f2"
 		date = "2020-06-26"
 		modified = "2023-11-22"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1276471822217891840"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-26/Heinote_June_2020-1.yar#L1-L29"
 		license_url = "N/A"
-		logic_hash = "679f1113c9c770910d18da395b13aaef009ecdde91a0c11f931d0d7e63ed122a"
+		logic_hash = "v1_sha256_679f1113c9c770910d18da395b13aaef009ecdde91a0c11f931d0d7e63ed122a"
 		score = 75
 		quality = 61
 		tags = "FILE"
@@ -207791,20 +207852,20 @@ rule ARKBIRD_SOLG_MAL_Heinote_June_2020_1 : FILE
 		$s17 = "Referer: %s" fullword ascii
 
 	condition:
-		uint16(0)==0x4D5A and filesize <450KB and 14 of them
+		uint16( 0 ) == 0x4D5A and filesize < 450KB and 14 of them
 }
 rule ARKBIRD_SOLG_MAL_Cadelspy_Stealer_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect Cadelspy stealer"
 		author = "Arkbird_SOLG"
-		id = "bac23ed9-f51c-546e-8f4e-320d33b51829"
+		id = "97f67a2c-1101-5b43-b804-002661aee81b"
 		date = "2021-05-30"
 		modified = "2021-06-05"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-30/APT39/MAL_Cadelspy_Stealer_May_2021_1.yara#L1-L24"
 		license_url = "N/A"
-		logic_hash = "29fade3703c55bd16e67f9bf126cb0d8a06bc0eafe10e145f8d57d8c4abe5656"
+		logic_hash = "v1_sha256_29fade3703c55bd16e67f9bf126cb0d8a06bc0eafe10e145f8d57d8c4abe5656"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207826,21 +207887,21 @@ rule ARKBIRD_SOLG_MAL_Cadelspy_Stealer_May_2021_1 : FILE
 		$seq3 = { 8b 84 b5 e4 d9 ff ff 85 c0 74 66 50 6a 00 68 ff ff 1f 00 ff 15 28 30 40 00 8b f8 85 ff 74 52 8d 85 dc d9 ff ff 50 6a 04 8d 85 d0 d9 ff ff 50 57 ff 15 64 30 40 00 85 c0 74 32 68 04 01 00 00 8d 85 ec fb ff ff 50 ff b5 d0 d9 ff ff 57 ff 15 34 30 40 00 8d 85 ec fb ff ff 68 f8 32 40 00 50 ff 15 38 31 40 00 83 c4 08 85 c0 74 21 57 ff d3 33 ff 8b 85 e0 d9 ff ff 46 c1 e8 02 8b cf 3b f0 0f 82 7b ff ff ff 85 c9 0f 84 43 01 00 00 68 04 01 00 00 8d 85 e4 f9 ff ff 50 6a 00 ff 15 3c 30 40 00 85 c0 0f 84 24 01 00 00 8d 85 f4 fd ff ff 50 68 04 01 00 00 ff 15 14 30 40 00 8d 85 f4 fd ff ff 50 6a 00 68 14 33 40 00 50 ff 15 60 30 40 00 6a 00 8d 85 f4 fd ff ff 50 8d 85 e4 f9 ff ff 50 ff 15 58 30 40 00 85 c0 0f 84 df 00 00 00 6a 00 6a 00 6a 03 6a 00 6a 00 68 00 00 00 c0 8d 85 f4 fd ff ff 50 ff 15 1c 30 40 00 8b f0 83 fe ff 0f 84 b8 00 00 00 6a 00 8d 85 d8 d9 ff ff 50 68 00 10 00 00 8d 85 e4 e9 ff ff 50 56 ff 15 78 30 40 00 85 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 5 of ($str*) and 2 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 5 of ( $str* ) and 2 of ( $seq* )
 }
 rule ARKBIRD_SOLG_APT_Chisel_Hafnium_Feb_2021_1 : FILE
 {
 	meta:
 		description = "Rule for detecting Chisel kit tool used by Hafnium"
 		author = "Arkbird_SOLG"
-		id = "cd6be3b4-71fd-5e17-8835-a331a24fc5d6"
+		id = "d26ac190-c1d6-53d1-a71c-77a837fed4ba"
 		date = "2021-02-23"
 		modified = "2021-04-25"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-23/Hafinum/APT_Chisel_Hafnium_Feb_2021_1.yara#L1-L28"
 		license_url = "N/A"
 		hash = "4afa5fde76f1f3030cf7dbd12e37b717e1f902ac95c8bdf54a2e58a64faade04"
-		logic_hash = "8e56234ce59197a8df51b21b89d3a901785dbb0211ab576cb3d194de34b611de"
+		logic_hash = "v1_sha256_8e56234ce59197a8df51b21b89d3a901785dbb0211ab576cb3d194de34b611de"
 		score = 75
 		quality = 57
 		tags = "FILE"
@@ -207862,20 +207923,20 @@ rule ARKBIRD_SOLG_APT_Chisel_Hafnium_Feb_2021_1 : FILE
 		$seq3 = { 48 89 34 24 e8 65 6c fe ff 48 8d bc 24 f8 03 00 00 48 8d 74 24 08 48 89 6c 24 f0 48 8d 6c 24 f0 e8 2f be e4 ff 48 8b 6d 00 48 8b 84 24 80 01 00 00 48 8b 48 48 48 8b 51 58 48 8b 0a 48 89 e7 48 8d b4 24 f8 03 00 00 0f 1f 80 00 00 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 f7 bd e4 ff 48 8b 6d 00 ff d1 48 8b 84 24 b0 00 00 00 48 8b 8c 24 b8 00 00 00 48 83 bc 24 b0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 2 of ($seq*) and 7 of ($str*)
+		uint16( 0 ) == 0x5a4d and filesize > 100KB and 2 of ( $seq* ) and 7 of ( $str* )
 }
 rule ARKBIRD_SOLG_APT_Babyelephant_Installer_Feb_2021_1 : FILE
 {
 	meta:
 		description = "Detect Installer from BabyElephant APT"
 		author = "Arkbird_SOLG"
-		id = "c89a127d-af49-597e-927d-c9a10c90fabe"
+		id = "4f462112-66f9-5b76-bd49-c7a2609e8fd0"
 		date = "2021-02-23"
 		modified = "2021-02-23"
 		reference = "https://twitter.com/h2jazi/status/1363683531067715584"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-23/BabyElephant/APT_BabyElephant_Installer_Feb_2021_1.yar#L1-L21"
 		license_url = "N/A"
-		logic_hash = "7c4f2cd7e56426e42141b1f2f3a13e1daa01b1de1fe88f4bd135601234407ec9"
+		logic_hash = "v1_sha256_7c4f2cd7e56426e42141b1f2f3a13e1daa01b1de1fe88f4bd135601234407ec9"
 		score = 50
 		quality = 73
 		tags = "FILE"
@@ -207892,20 +207953,20 @@ rule ARKBIRD_SOLG_APT_Babyelephant_Installer_Feb_2021_1 : FILE
 		$s7 = { 68 00 08 00 00 8d 85 48 f6 ff ff 6a 00 50 e8 00 33 00 00 83 c4 0c 8d 85 48 f6 ff ff 6a 00 68 00 08 00 00 50 53 ff d6 85 c0 0f 8e 1f 03 00 00 0f 1f 40 00 6a 08 68 e0 b3 42 00 8d 8d 28 ec ff ff c7 85 38 ec ff ff 00 00 00 00 c7 85 3c ec ff ff 0f 00 00 00 c6 85 28 ec ff ff 00 e8 a3 09 00 00 8d 95 28 ec ff ff c7 45 fc 00 00 00 00 8d 8d 10 ec ff ff e8 2b 05 00 00 83 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize > 80KB and all of them
 }
 rule ARKBIRD_SOLG_RAN_Haron_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect Haron locker"
 		author = "Arkbird_SOLG"
-		id = "5900ad0e-66ca-5127-b8c2-cc23ace8929f"
+		id = "f8dbae55-d3ec-5abd-b8ae-a48272bc2789"
 		date = "2021-08-09"
 		modified = "2021-08-09"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-09/RAN_Haron_Aug_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "5001041d9bb8acc0fa5e0e3b4cfacc5a891bed6885101ae3513b5524c91c572d"
+		logic_hash = "v1_sha256_5001041d9bb8acc0fa5e0e3b4cfacc5a891bed6885101ae3513b5524c91c572d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -207924,7 +207985,7 @@ rule ARKBIRD_SOLG_RAN_Haron_Aug_2021_1 : FILE
 		$s7 = { 28 ?? 00 00 06 0a 02 06 28 ?? 00 00 06 0b 07 6f [2] 00 0a 16 16 17 20 ff 0f 1f 00 17 14 73 [2] 00 0a 16 14 73 [2] 00 0a 6f [2] 00 0a 02 06 07 28 ?? 00 00 06 de 03 26 de 00 2a 00 00 00 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and 6 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 25KB and 6 of ( $s* )
 }
 import "pe"
 
@@ -207933,13 +207994,13 @@ rule ARKBIRD_SOLG_Mal_ATM_Loup_Aug_2020_1 : FILE
 	meta:
 		description = "Detect ATM malware Loup by theirs strings."
 		author = "Arkbird_SOLG"
-		id = "07c0fe02-a82a-58a7-8776-748a1c986f93"
+		id = "d914c806-97e3-5c57-9cbd-2b89b3ea6913"
 		date = "2020-08-17"
 		modified = "2020-08-18"
 		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-17/Loup/Mal_ATM_Loup_Aug_2020_1.yar#L3-L34"
 		license_url = "N/A"
-		logic_hash = "18e4d6af5d89746b42c87d7311e442f61deff3bfcbf57cc008d87290e91baafb"
+		logic_hash = "v1_sha256_18e4d6af5d89746b42c87d7311e442f61deff3bfcbf57cc008d87290e91baafb"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -207969,20 +208030,20 @@ rule ARKBIRD_SOLG_Mal_ATM_Loup_Aug_2020_1 : FILE
 		$s12 = "WFSStartUp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (pe.imphash()=="190fc01f66c40478aa91be89a98c57e9" and (1 of ($pdb*) and 2 of ($dbg*) and 2 of ($info*) and 9 of ($s*)))
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and ( pe.imphash ( ) == "190fc01f66c40478aa91be89a98c57e9" and ( 1 of ( $pdb* ) and 2 of ( $dbg* ) and 2 of ( $info* ) and 9 of ( $s* ) ) )
 }
 rule ARKBIRD_SOLG_Ran_Crysis_Sep_2020_1 : FILE
 {
 	meta:
 		description = "Detect Crysis ransomware"
 		author = "Arkbird_SOLG"
-		id = "9cc1a1b9-c4a9-5add-833d-81be02ffc4fb"
+		id = "7c7d7a68-724d-58e9-b375-ebdf4a5ea974"
 		date = "2020-10-16"
 		modified = "2020-10-16"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-16/Ran_Crysis_Sep_2020_1.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "c7706b862cd0277c8b726d32dc819ad7e15933b28e3a31599922f3dc0beb8348"
+		logic_hash = "v1_sha256_c7706b862cd0277c8b726d32dc819ad7e15933b28e3a31599922f3dc0beb8348"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -208003,20 +208064,20 @@ rule ARKBIRD_SOLG_Ran_Crysis_Sep_2020_1 : FILE
 		$s9 = "sssssbsss" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and all of them
 }
 rule ARKBIRD_SOLG_Ran_Egregor_Sept_2020_1 : FILE
 {
 	meta:
 		description = "Detect Egregor ransomware (variant Sept2020)"
 		author = "Arkbird_SOLG"
-		id = "b44b93ec-b470-511e-b08f-7d83efd30ecc"
+		id = "5d4db1cd-0b16-5e49-8207-3ba363036b13"
 		date = "2020-10-07"
 		modified = "2020-10-16"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-16/Ran_Egregor_Sept_2020_1.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "4ce7398cc6ad0538735aec6490204122690f029cbb8d20f9efd2f612955f106b"
+		logic_hash = "v1_sha256_4ce7398cc6ad0538735aec6490204122690f029cbb8d20f9efd2f612955f106b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -208036,20 +208097,20 @@ rule ARKBIRD_SOLG_Ran_Egregor_Sept_2020_1 : FILE
 		$s7 = "9,94989@9X9" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >200KB and 1 of ($x*) and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 200KB and 1 of ( $x* ) and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Medusalocker_Aug_2021_1 : FILE
 {
 	meta:
 		description = "Detect MedusaLocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "9e647371-b37a-53af-bfb6-cde72855b564"
+		id = "846bf483-2434-5810-8f79-c06ed2304c0c"
 		date = "2021-08-08"
 		modified = "2021-08-08"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-08/medusalocker/RAN_MedusaLocker_Aug_2021_1.yara#L1-L29"
 		license_url = "N/A"
-		logic_hash = "40dd3ec16eefc59cb25c8855fb62cda1d642ec711226c1c964fd26384be7ef15"
+		logic_hash = "v1_sha256_40dd3ec16eefc59cb25c8855fb62cda1d642ec711226c1c964fd26384be7ef15"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -208075,20 +208136,20 @@ rule ARKBIRD_SOLG_RAN_Medusalocker_Aug_2021_1 : FILE
 		$s10 = { 33 c0 48 89 44 24 40 48 c7 44 24 48 07 00 00 00 66 89 44 24 30 44 8d 40 26 48 8d 15 [2] 09 00 48 8d 4c 24 30 e8 [2] ff ff 48 83 7c 24 40 00 74 42 4c 8d 44 24 30 48 83 7c 24 48 08 4c 0f 43 44 24 30 33 d2 b9 01 00 1f 00 ff 15 [2] 07 00 48 85 c0 75 1f 4c 8d 44 24 30 48 83 7c 24 48 08 4c 0f 43 44 24 30 33 d2 33 c9 ff 15 [2] 07 00 32 db eb 02 b3 01 48 8b 54 24 48 48 83 fa 08 72 37 48 8d 14 55 02 00 00 00 48 8b 4c 24 30 48 8b c1 48 81 fa 00 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 d3 00 00 00 e8 [2] 03 00 84 db 0f 85 ad 00 00 00 e8 3e 36 00 00 84 c0 75 05 e8 c5 36 00 00 e8 ?? 94 ff ff 48 8d 1d [2] 0d 00 48 8d 4c 24 30 e8 [2] ff ff 48 8b f8 48 8d 35 [2] 0d 00 0f 1f }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >150KB and 9 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 150KB and 9 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_UNC2452_Sunshuttle_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect Sunshuttle implant used by UNC2452 group"
 		author = "Arkbird_SOLG"
-		id = "faa07d19-4c61-554d-a6b1-ab7cb0919ec0"
+		id = "1a2da724-769d-5cb7-96ec-929b104de16e"
 		date = "2021-03-06"
 		modified = "2021-03-06"
 		reference = "https://twitter.com/Arkbird_SOLG/status/1367570764468224010"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-06/UNC2452/APT_UNC2452_sunshuttle_Mar_2021_1.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "368487f1716aaa5c10e19a428649d6706b3f45c53853e6729752dc41fc97bc38"
+		logic_hash = "v1_sha256_368487f1716aaa5c10e19a428649d6706b3f45c53853e6729752dc41fc97bc38"
 		score = 75
 		quality = 63
 		tags = "FILE"
@@ -208113,20 +208174,20 @@ rule ARKBIRD_SOLG_APT_UNC2452_Sunshuttle_Mar_2021_1 : FILE
 		$s14 = { 2d 2d 2d 2d 2d 45 4e 44 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >800KB and 12 of them
+		uint16( 0 ) == 0x5a4d and filesize > 800KB and 12 of them
 }
 rule ARKBIRD_SOLG_APT_Unknown_Middle_East_Feb_2020_1 : FILE
 {
 	meta:
 		description = "Dectect unknown Middle East implants (retrohunt June 2020)"
 		author = "Arkbird_SOLG"
-		id = "e45675e6-29d5-587b-943e-19450772a092"
+		id = "bcfac370-312a-536e-b975-87e069e9ddfc"
 		date = "2021-03-05"
 		modified = "2021-03-06"
 		reference = "internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-06/Unknown/APT_Unknown_Middle_East_Feb_2020_1.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "64cdac73bc3e29e8716cb24ae6577f853b2cf31303d129a0ec38ba89b7ff5351"
+		logic_hash = "v1_sha256_64cdac73bc3e29e8716cb24ae6577f853b2cf31303d129a0ec38ba89b7ff5351"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -208146,20 +208207,20 @@ rule ARKBIRD_SOLG_APT_Unknown_Middle_East_Feb_2020_1 : FILE
 		$s8 = "\\AppData\\Roaming\\Skype" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >200KB and 1 of ($seq*) and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 200KB and 1 of ( $seq* ) and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_ELF_Specter_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Specter malware"
 		author = "Arkbird_SOLG"
-		id = "24237a56-2717-5efc-9bfb-9ab6d87e082b"
+		id = "3ac7593a-9625-5767-9e02-bbd69cf4c45c"
 		date = "2021-07-02"
 		modified = "2021-07-05"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1410870749473148930"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/Specter/MAL_ELF_Specter_Jul_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "de737f051d34edb2219e77c0d4f0239b95bad9983ee5e435d6ee9741525816f0"
+		logic_hash = "v1_sha256_de737f051d34edb2219e77c0d4f0239b95bad9983ee5e435d6ee9741525816f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -208176,20 +208237,20 @@ rule ARKBIRD_SOLG_MAL_ELF_Specter_Jul_2021_1 : FILE
 		$s5 = { 8b 44 24 50 4d 85 ff 4c 89 38 0f 85 12 f8 ff ff e9 dc f9 ff ff 0f 1f 84 00 00 00 00 00 49 83 bd 68 0c 00 00 00 0f 84 bb f7 ff ff 48 8b 05 e3 6f 30 00 49 8b be 18 04 00 00 ff 10 49 8b b5 68 0c 00 00 48 8d 3d ae 26 0b 00 31 c0 49 c7 86 18 04 00 00 00 00 00 00 e8 22 9b 00 00 48 85 c0 49 89 86 18 04 00 00 0f 85 96 f7 ff ff e9 1d f9 ff ff 0f 1f 44 00 00 41 80 bd ea 0e 00 00 00 48 8d 05 01 26 0b 00 48 89 44 24 60 0f 88 2f f6 ff ff 83 fb 07 0f 87 2a 01 00 00 48 8d 05 76 28 0b 00 89 da 48 63 14 90 48 01 d0 ff e0 0f 1f 00 4c 8b 7c 24 50 49 8b 3f e8 e3 fa fe ff 85 c0 0f 85 eb f7 ff ff 49 8b 3f e8 f3 fa fe ff 49 89 47 08 e9 1e f9 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b b6 d0 00 00 00 49 8b bd f0 10 00 00 e8 5d cf 00 00 85 c0 0f 85 91 f9 ff ff 49 8b 86 d8 03 00 00 45 8b 86 98 01 00 00 8b 80 80 00 00 00 a8 02 74 0d 41 81 f8 bb 01 00 00 0f 84 b9 01 00 00 a8 01 74 0a 41 83 f8 50 0f 84 ab 01 00 00 41 0f b6 86 ad 03 00 00 48 8d 0d 2e e7 0a 00 48 8d 15 8a 1c 0b 00 48 8d 3d de 25 0b 00 48 89 ce 83 e0 02 48 8d 05 3c 07 0b 00 48 0f 45 ca 48 8b 54 24 58 48 0f 45 f0 31 c0 e8 14 9a 00 00 49 89 86 38 04 00 00 48 85 c0 0f 85 99 f9 ff ff e9 0f f8 ff ff 48 8d 05 05 25 0b 00 48 89 44 24 60 e9 2f f5 ff ff 48 8d 05 ef 24 0b 00 48 89 44 24 60 e9 1e f5 ff ff 48 8d 05 56 cd 0a 00 48 89 44 24 60 e9 0d f5 ff ff 48 8d 05 d6 24 0b 00 48 89 44 24 60 e9 fc f4 ff ff 48 8d 05 0e d1 0a 00 48 89 44 24 60 e9 eb f4 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b 86 d0 03 00 00 f6 80 80 00 00 00 03 74 28 8d 43 fd 83 f8 01 0f 86 6a 02 00 00 41 f6 85 eb 0e 00 00 01 74 12 49 83 bd f8 14 00 00 ff 0f 84 62 02 00 00 0f 1f 40 00 41 80 a5 68 06 00 00 bf 48 8d 05 44 e6 0a 00 41 f6 85 68 06 00 00 40 48 89 c1 48 8d 05 60 24 0b 00 48 0f 44 c1 48 89 44 24 70 e9 01 f8 ff ff 66 0f 1f 84 00 00 00 00 00 83 7f 18 04 4c 8d 3d f3 0a 0b 00 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >100KB and 4 of ($s*)
+		uint32( 0 ) == 0x464c457f and filesize > 100KB and 4 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect the DarkRadiation ransomware"
 		author = "Arkbird_SOLG"
-		id = "13d77ecc-14ab-54ce-9eec-2d614f5ae8e4"
+		id = "6ea1e4af-82b3-5dd6-8c03-e991a5b6c287"
 		date = "2021-07-03"
 		modified = "2021-07-05"
 		reference = "https://bazaar.abuse.ch/browse/tag/DarkRadiation/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/DarkRadiation/RAN_ELK_DarkRadiation_Jul_2021_1.yara#L1-L25"
 		license_url = "N/A"
-		logic_hash = "6fbc6eed7dd7f92af0cd8b3b2726636a64dc8de0b795b176169817994f44d4fa"
+		logic_hash = "v1_sha256_6fbc6eed7dd7f92af0cd8b3b2726636a64dc8de0b795b176169817994f44d4fa"
 		score = 75
 		quality = 61
 		tags = "FILE"
@@ -208211,20 +208272,20 @@ rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_1 : FILE
 		$s9 = { 73 79 73 74 65 6d 63 74 6c 20 73 74 6f 70 20 64 6f 63 6b 65 72 20 26 26 20 73 79 73 74 65 6d 63 74 6c 20 64 69 73 61 62 6c 65 20 64 6f 63 6b 65 72 }
 
 	condition:
-		filesize >5KB and 5 of ($s*)
+		filesize > 5KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_3 : FILE
 {
 	meta:
 		description = "Detect structures of scripts like used by the DarkRadiation ransomware"
 		author = "Arkbird_SOLG"
-		id = "144eb08d-e222-5f6f-925d-33077953e7e6"
+		id = "b35a92c8-dd31-5364-bca7-3f1e12406d38"
 		date = "2021-07-03"
 		modified = "2021-07-05"
 		reference = "https://bazaar.abuse.ch/browse/tag/DarkRadiation/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/DarkRadiation/RAN_ELK_DarkRadiation_Jul_2021_3.yara#L1-L29"
 		license_url = "N/A"
-		logic_hash = "8d2fa53f5abd327d100ffc71863f3b49ce8a19f1a72db556902d95ae6ba09d4a"
+		logic_hash = "v1_sha256_8d2fa53f5abd327d100ffc71863f3b49ce8a19f1a72db556902d95ae6ba09d4a"
 		score = 75
 		quality = 55
 		tags = "FILE"
@@ -208250,20 +208311,20 @@ rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_3 : FILE
 		$y3 = { 65 76 61 6c 20 22 24 [2-5] 24 [2-5] 24 [2-5] 24 }
 
 	condition:
-		filesize >1KB and (3 of ($s*) or 5 of ($x*) or all of ($y*))
+		filesize > 1KB and ( 3 of ( $s* ) or 5 of ( $x* ) or all of ( $y* ) )
 }
 rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_2 : FILE
 {
 	meta:
 		description = "Detect the DarkRadiation ransomware"
 		author = "Arkbird_SOLG"
-		id = "3580a41a-ba2e-5a47-b35d-b2482fbc913a"
+		id = "33d917b5-3f1c-5d86-9a4d-b7ee591d23b0"
 		date = "2021-07-03"
 		modified = "2021-07-05"
 		reference = "https://bazaar.abuse.ch/browse/tag/DarkRadiation/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/DarkRadiation/RAN_ELK_DarkRadiation_Jul_2021_2.yara#L1-L27"
 		license_url = "N/A"
-		logic_hash = "b21db1658845cafe37950d69b5bc0aab203e7bea3e43f95394236e0133234e2d"
+		logic_hash = "v1_sha256_b21db1658845cafe37950d69b5bc0aab203e7bea3e43f95394236e0133234e2d"
 		score = 75
 		quality = 57
 		tags = "FILE"
@@ -208287,20 +208348,20 @@ rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_2 : FILE
 		$s11 = { 73 6c 61 76 65 3d 24 28 65 63 68 6f 20 22 24 7b [2-15] 7d 22 20 7c 20 77 63 20 2d 6c 29 }
 
 	condition:
-		filesize >1KB and 6 of ($s*)
+		filesize > 1KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_ELF_Bioset_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Bioset malware"
 		author = "Arkbird_SOLG"
-		id = "1b95c3df-7543-521c-a28b-d540ad0bd648"
+		id = "1b36bc60-3019-57dd-9640-b25fd9ee8d21"
 		date = "2021-07-02"
 		modified = "2021-07-05"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1409848815948111877"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/Bioset/MAL_ELF_Bioset_Jul_2021_1.yara#L1-L26"
 		license_url = "N/A"
-		logic_hash = "b5ba7f4517f07d8657cbd54695cad88d8c2f263ee010bd70c4a05433b2927576"
+		logic_hash = "v1_sha256_b5ba7f4517f07d8657cbd54695cad88d8c2f263ee010bd70c4a05433b2927576"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -208323,20 +208384,20 @@ rule ARKBIRD_SOLG_MAL_ELF_Bioset_Jul_2021_1 : FILE
 		$s8 = { 55 48 89 e5 53 48 81 ec e8 00 00 00 48 89 b5 48 ff ff ff 48 89 95 50 ff ff ff 48 89 8d 58 ff ff ff 4c 89 85 60 ff ff ff 4c 89 8d 68 ff ff ff 84 c0 74 23 0f 29 85 70 ff ff ff 0f 29 4d 80 0f 29 55 90 0f 29 5d a0 0f 29 65 b0 0f 29 6d c0 0f 29 75 d0 0f 29 7d e0 48 89 bd 18 ff ff ff 48 8b 05 [2] 20 00 48 85 c0 75 16 be [2] 40 00 bf [2] 40 00 e8 ?? fd ff ff 48 89 05 [2] 20 00 c7 85 20 ff ff ff 08 00 00 00 c7 85 24 ff ff ff 30 00 00 00 48 8d 45 10 48 89 85 28 ff ff ff 48 8d 85 40 ff ff ff 48 89 85 30 ff ff ff 48 8b 05 [2] 20 00 48 8d 95 20 ff ff ff 48 8b 8d 18 ff ff ff 48 89 ce 48 89 c7 e8 ?? fd ff ff 48 c7 85 38 ff ff ff [2] 40 00 48 8b 1d [2] 20 00 48 8b 85 38 ff ff ff 48 89 c7 e8 ?? fb ff ff 48 89 c6 48 8b 85 38 ff ff ff 48 89 d9 ba 01 00 00 00 48 89 c7 e8 ?? fd ff ff 48 8b 05 [2] 20 00 48 89 c7 e8 ?? fc ff ff 48 81 c4 e8 00 00 00 5b }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >10KB and 6 of ($s*)
+		uint32( 0 ) == 0x464c457f and filesize > 10KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_Exp_Underminer_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detect Underminer exploit kit"
 		author = "Arkbird_SOLG"
-		id = "bd2a6b30-e05a-5f90-8dc2-719c1ba48a61"
+		id = "06222626-010f-51c7-9d90-968ff5b27268"
 		date = "2021-04-14"
 		modified = "2021-04-15"
 		reference = "https://twitter.com/nao_sec/status/1382358986813415427"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-14/Underminer/Exp_Underminer_Apr_2021_1.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "46dd4d8ba58e79761056d3dd6921530520b0071090bcfc3bfaed7a6804f787b7"
+		logic_hash = "v1_sha256_46dd4d8ba58e79761056d3dd6921530520b0071090bcfc3bfaed7a6804f787b7"
 		score = 75
 		quality = 63
 		tags = "FILE"
@@ -208353,20 +208414,20 @@ rule ARKBIRD_SOLG_Exp_Underminer_Apr_2021_1 : FILE
 		$s8 = { 22 30 30 30 30 30 30 30 30 22 2b 28 [1-8] 5b 30 5d 3e 3e 3e 30 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 2e 73 6c 69 63 65 28 2d 38 29 2b 28 22 30 30 30 30 30 30 30 30 22 2b 28 [1-8] 5b 31 5d 3e 3e 3e 30 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 2e 73 6c 69 63 65 28 2d 38 29 }
 
 	condition:
-		filesize >5KB and 6 of ($s*)
+		filesize > 5KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_Loader_Buer_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect Buer loader"
 		author = "Arkbird_SOLG"
-		id = "a2883eca-d576-53ba-aa97-5e3c94f501a5"
+		id = "b2b24bdf-cadf-56fb-a977-3af977a33103"
 		date = "2020-12-01"
 		modified = "2020-12-01"
 		reference = "https://twitter.com/James_inthe_box/status/1333551419735953409"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-01/Buer/Mal_Buer_Nov_2020_1.yar#L35-L64"
 		license_url = "N/A"
-		logic_hash = "96a74b497076be170ce6138189501d8b3a1002bcf07f9d3cf662d64612d04a59"
+		logic_hash = "v1_sha256_96a74b497076be170ce6138189501d8b3a1002bcf07f9d3cf662d64612d04a59"
 		score = 75
 		quality = 55
 		tags = "FILE"
@@ -208391,20 +208452,20 @@ rule ARKBIRD_SOLG_Loader_Buer_Nov_2020_1 : FILE
 		$s14 = "]otju}y&>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 8 of them
+		uint16( 0 ) == 0x5a4d and filesize > 10KB and 8 of them
 }
 rule ARKBIRD_SOLG_APT_UNC2452_Webshell_Chopper_Mar_2021_1 : FILE
 {
 	meta:
 		description = "Detect exploit listener in the exchange configuration for Webshell Chopper used by UNC2452 group"
 		author = "Arkbird_SOLG"
-		id = "174af8e1-0df0-5ad7-ac7d-a208f64cb765"
+		id = "4b03dff6-3560-59bc-b37e-487e9821e17e"
 		date = "2021-03-07"
 		modified = "2021-03-07"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-07/UNC2452/APT_UNC2452_Webshell_Chopper_Mar_2021_1.yar#L1-L26"
 		license_url = "N/A"
-		logic_hash = "77bd7e5c10aa9cf2b407b37a76954b4eed163e36653e1fb3cde5de853f824cf0"
+		logic_hash = "v1_sha256_77bd7e5c10aa9cf2b407b37a76954b4eed163e36653e1fb3cde5de853f824cf0"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -208419,20 +208480,20 @@ rule ARKBIRD_SOLG_APT_UNC2452_Webshell_Chopper_Mar_2021_1 : FILE
 		$c5 = "/Configuration/Schema/ms-Exch-OAB-Virtual-Directory" fullword ascii
 
 	condition:
-		filesize >1KB and 1 of ($l*) and 3 of ($c*)
+		filesize > 1KB and 1 of ( $l* ) and 3 of ( $c* )
 }
 rule ARKBIRD_SOLG_MAL_Nativezone_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect NativeZone malware"
 		author = "Arkbird_SOLG"
-		id = "5b858a8d-6e6a-5712-a83a-229bed1c7872"
+		id = "3be26ef2-d05b-5940-8a58-6276a2b3a7b6"
 		date = "2021-05-28"
 		modified = "2021-06-05"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_NativeZone_May_2021_1.yara#L1-L17"
 		license_url = "N/A"
-		logic_hash = "9281784100e922fe3ef64e7c112276ffa5f8691ab4f24f1b68fbb0495e449bd3"
+		logic_hash = "v1_sha256_9281784100e922fe3ef64e7c112276ffa5f8691ab4f24f1b68fbb0495e449bd3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -208447,20 +208508,20 @@ rule ARKBIRD_SOLG_MAL_Nativezone_May_2021_1 : FILE
 		$s3 = { 8b 45 f4 89 7d f8 8d 04 86 8b c8 89 45 e8 8b c7 89 4d f4 3b 45 dc 74 5b 8b d6 2b d7 89 55 e4 8b 00 8b d0 89 45 ec 8d 42 01 89 45 f0 8a 02 42 84 c0 75 f9 2b 55 f0 8d 42 01 50 ff 75 ec 89 45 f0 8b 45 e8 2b c1 03 45 fc 50 51 e8 [2] 00 00 83 c4 10 85 c0 75 72 8b 45 f8 8b 55 e4 8b 4d f4 89 0c 02 83 c0 04 03 4d f0 89 4d f4 89 45 f8 3b 45 dc 75 ac 8b 45 0c 89 5d f8 89 30 8b f3 53 e8 [2] ff ff 59 8b 45 dc 8b d7 2b c2 89 55 e4 83 c0 03 c1 e8 02 39 55 dc 1b c9 f7 d1 23 c8 89 4d e8 74 18 8b f1 ff 37 e8 [2] ff ff 43 8d 7f 04 59 3b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 50KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Enc_Payload_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect encrypted payload, must be with others APT29 rules maybe give lot fake postives due to the pdf header"
 		author = "Arkbird_SOLG"
-		id = "34da1d06-7892-59ec-8b11-c3278a7f2e34"
+		id = "9de3ad75-b97f-5993-9ad8-6354e711a811"
 		date = "2021-05-28"
 		modified = "2021-06-02"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_Enc_payload_May_2021_1.yara#L1-L17"
 		license_url = "N/A"
-		logic_hash = "484d9947d8acd32126cdc3e3f671cd3b3b048bbdb608d5573f6fcc7e4ddf13f8"
+		logic_hash = "v1_sha256_484d9947d8acd32126cdc3e3f671cd3b3b048bbdb608d5573f6fcc7e4ddf13f8"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -208475,20 +208536,20 @@ rule ARKBIRD_SOLG_MAL_Enc_Payload_May_2021_1 : FILE
 		$s2 = { 25 25 45 4f 46 0a }
 
 	condition:
-		filesize >50KB and all of ($s*)
+		filesize > 50KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Envyscout_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect EnvyScout downloader"
 		author = "Arkbird_SOLG"
-		id = "645f60d1-7c95-515c-a88e-d8528cf8b644"
+		id = "509b6475-493c-5ea0-beee-d4020f3f650e"
 		date = "2021-05-28"
 		modified = "2021-06-02"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_EnvyScout_May_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "7ce4fd18c88f7ea7486c51fc0b673d178bd26ecc2f4a39ec9c5a4a71aaa0daa1"
+		logic_hash = "v1_sha256_7ce4fd18c88f7ea7486c51fc0b673d178bd26ecc2f4a39ec9c5a4a71aaa0daa1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -208506,20 +208567,20 @@ rule ARKBIRD_SOLG_MAL_Envyscout_May_2021_1 : FILE
 		$s6 = { 6e 65 77 20 42 6c 6f 62 28 5b [1-12] 5d 2c 20 7b 74 79 70 65 3a 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 22 7d 29 3b 73 61 76 65 41 73 28 }
 
 	condition:
-		filesize >100KB and 5 of ($s*)
+		filesize > 100KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Boombox_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect BoomBox malware"
 		author = "Arkbird_SOLG"
-		id = "b2629c5b-1fb0-5ea1-8661-faf8f1d6b578"
+		id = "6df95b06-d02d-5187-b8eb-ea620c2fbbc1"
 		date = "2021-05-28"
 		modified = "2021-06-05"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_BoomBox_May_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "b88848ead9c992392c99e88a25541b72d825fbd32c3eb83fefc18e7cfbd08cc8"
+		logic_hash = "v1_sha256_b88848ead9c992392c99e88a25541b72d825fbd32c3eb83fefc18e7cfbd08cc8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -208535,20 +208596,20 @@ rule ARKBIRD_SOLG_MAL_Boombox_May_2021_1 : FILE
 		$s4 = { 1b 30 05 00 b5 00 00 00 06 00 00 11 72 76 05 00 70 72 d5 00 00 70 28 49 00 00 0a 6f 4a 00 00 0a 28 10 00 00 0a 0a 72 84 05 00 70 28 4b 00 00 0a 6f 4c 00 00 0a 28 10 00 00 0a 0b 72 90 05 00 70 0c 28 4d 00 00 0a 28 49 00 00 0a 6f 4e 00 00 0a 13 04 16 13 05 2b 2a 11 04 11 05 9a 13 06 11 06 6f 4f 00 00 0a 18 33 13 08 11 06 6f 50 00 00 0a 72 98 05 00 70 28 37 00 00 0a 0c 11 05 17 58 13 05 11 05 11 04 8e 69 32 ce 28 51 00 00 0a 6f 52 00 00 0a 0d 72 9c 05 00 70 1a 8d 10 00 00 01 25 16 06 a2 25 17 07 a2 25 18 08 a2 25 19 09 a2 28 1d 00 00 0a 13 07 de 06 26 14 13 07 de 00 11 07 2a 00 00 00 01 10 00 00 00 00 00 00 ac ac 00 06 10 00 00 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 6KB and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_1 : CVE_2021_41379 FILE
 {
 	meta:
 		description = "Detect exploit tool using CVE-2021-41379"
 		author = "Arkbird_SOLG"
-		id = "616e697d-0c62-58bb-9f37-29670a09d886"
+		id = "c5ea5339-7c76-5d74-816b-b1f0fb22938f"
 		date = "2021-11-26"
 		modified = "2021-11-29"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1463414554004709384"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "5514ab8f95a5d82453407dd506d55eaf1a0aa22f5ce6a5fb18501ef41645305a"
+		logic_hash = "v1_sha256_5514ab8f95a5d82453407dd506d55eaf1a0aa22f5ce6a5fb18501ef41645305a"
 		score = 75
 		quality = 75
 		tags = "CVE-2021-41379, FILE"
@@ -208566,20 +208627,20 @@ rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_1 : CVE_2021_41379 FILE
 		$s4 = { 50 ff ?? 68 04 01 00 00 8d 85 e0 fb ff ff 50 6a 00 ff 15 [3] 00 50 ff 15 [3] 00 6a 00 e8 [2] ff ff 50 8d 85 e0 fb ff ff 50 ff 15 84 [2] 00 6a 00 ff 15 [3] 00 8d 85 ?? fb ff ff 50 68 [3] 00 6a 04 6a 00 68 [3] 00 ff 15 [3] 00 ff 15 [3] 00 8b 35 [3] 00 8b 3d [3] 00 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 25KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_3 : CVE_2021_41379 FILE
 {
 	meta:
 		description = "Detect exploit tool using CVE-2021-41379 (variant 3)"
 		author = "Arkbird_SOLG"
-		id = "c82578d6-63ca-50f6-b105-321791ec8808"
+		id = "748ca616-3a70-52c7-b47c-b2431e0d0a03"
 		date = "2021-11-26"
 		modified = "2021-11-29"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_3.yara#L1-L27"
 		license_url = "N/A"
-		logic_hash = "559c4ca0e9ac60e3dd7d5b9a8eb22d887b0b436d4e1fc528e05e7a33ecce0aa6"
+		logic_hash = "v1_sha256_559c4ca0e9ac60e3dd7d5b9a8eb22d887b0b436d4e1fc528e05e7a33ecce0aa6"
 		score = 75
 		quality = 75
 		tags = "CVE-2021-41379, FILE"
@@ -208602,20 +208663,20 @@ rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_3 : CVE_2021_41379 FILE
 		$s9 = { 33 d2 33 c9 41 b8 00 00 00 80 ff 15 ba 33 00 00 41 b8 01 00 00 00 48 8d 15 7d 3b 00 00 48 8b c8 48 8b d8 ff 15 d9 33 00 00 48 8b cb 48 8b f8 ff 15 8d 33 00 00 4c 8d 4c 24 20 89 74 24 20 45 33 c0 33 d2 48 8b cf ff 15 ae 33 00 00 8b 5c 24 20 ff 15 64 34 00 00 44 8b c3 ba 0c 00 00 00 48 8b c8 ff 15 33 34 00 00 44 8b 44 24 20 4c 8d 4c 24 20 48 8b d0 48 8b cf 48 8b d8 ff 15 7a 33 00 00 4c 8b 43 10 48 8d 4c 24 30 ba 04 01 00 00 ff 15 46 37 00 00 ff 15 20 34 00 00 4c 8b c3 33 d2 48 8b c8 ff 15 9a 33 00 00 48 8b cf ff 15 11 33 00 00 48 8d 4c 24 30 8b fe ff 15 a4 33 00 00 83 e8 02 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and 3 of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 25KB and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_2 : CVE_2021_41379 FILE
 {
 	meta:
 		description = "Detect exploit tool using CVE-2021-41379 (variant 2)"
 		author = "Arkbird_SOLG"
-		id = "29fe9a9c-5180-55c8-882b-ad18981dc011"
+		id = "9066ab10-98b1-533e-97cf-da0dbe64a66f"
 		date = "2021-11-26"
 		modified = "2021-11-29"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_2.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "28b1d0d6c0ee14cd46b12763692f4f76020cd5ad74bb2b39b61f493b98486068"
+		logic_hash = "v1_sha256_28b1d0d6c0ee14cd46b12763692f4f76020cd5ad74bb2b39b61f493b98486068"
 		score = 75
 		quality = 75
 		tags = "CVE-2021-41379, FILE"
@@ -208633,22 +208694,20 @@ rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_2 : CVE_2021_41379 FILE
 		$s4 = { 48 8b c8 ff 15 [3] 00 33 c9 ff 15 [3] 00 48 8b c8 41 b8 04 01 00 00 48 8d 95 30 02 00 00 ff 15 [3] 00 e8 [2] ff ff 48 8b d0 45 33 c0 48 8d 8d 30 02 00 00 ff 15 [3] 00 33 c9 ff 15 [3] 00 48 8d }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 25KB and all of ( $s* )
 }
-import "pe"
-
 rule ARKBIRD_SOLG_Ran_Mem_Ragnarlocker_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect memory artefacts of the Ragnarlocker ransomware (Nov 2020)"
 		author = "Arkbird_SOLG"
-		id = "910774ab-9ad6-5c56-a921-203f61c9d7f7"
+		id = "cea4506c-95fd-5b9c-9fee-295582013423"
 		date = "2020-11-26"
 		modified = "2020-11-27"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-27/Ran_RagnarLocker_Nov_2020_1.yar#L3-L33"
 		license_url = "N/A"
-		logic_hash = "2cb26677b8f4e464750eb8dec0638fd3f9a28500e68f64d62e99236c93895c85"
+		logic_hash = "v1_sha256_2cb26677b8f4e464750eb8dec0638fd3f9a28500e68f64d62e99236c93895c85"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -208677,7 +208736,7 @@ rule ARKBIRD_SOLG_Ran_Mem_Ragnarlocker_Nov_2020_1 : FILE
 		$s19 = "iconcache.db" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 12 of them
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 12 of them
 }
 import "pe"
 
@@ -208686,13 +208745,13 @@ rule ARKBIRD_SOLG_Ran_Cert_Ragnarlocker_Nov_2020_1 : FILE
 	meta:
 		description = "Detect certificates and VMProtect used for the Ragnarlocker ransomware (Nov 2020)"
 		author = "Arkbird_SOLG"
-		id = "85d51804-eebd-5353-8bd9-01756e7f7d07"
+		id = "ea931e7c-06ee-5c5e-902a-00916dbc8ef4"
 		date = "2020-11-26"
 		modified = "2020-11-27"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-27/Ran_RagnarLocker_Nov_2020_1.yar#L35-L55"
 		license_url = "N/A"
-		logic_hash = "8171128426b48102457f5ba0771b27aaf5f4562293aff04c256bd5bd721a908e"
+		logic_hash = "v1_sha256_8171128426b48102457f5ba0771b27aaf5f4562293aff04c256bd5bd721a908e"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -208705,20 +208764,20 @@ rule ARKBIRD_SOLG_Ran_Cert_Ragnarlocker_Nov_2020_1 : FILE
 		$vmp1 = { 2E 76 6D 70 31 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >5000KB and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "GlobalSign" and pe.signatures[i].serial=="68:65:29:4f:67:f0:c3:bb:2e:19:1f:75") and $vmp0 in (0x100..0x300) and $vmp1 in (0x100..0x300)
+		uint16( 0 ) == 0x5a4d and filesize > 5000KB and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "GlobalSign" and pe.signatures [ i ] . serial == "68:65:29:4f:67:f0:c3:bb:2e:19:1f:75" ) and $vmp0 in ( 0x100 .. 0x300 ) and $vmp1 in ( 0x100 .. 0x300 )
 }
 rule ARKBIRD_SOLG_Mal_Phantomnet_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect PhantomNet (November 2020)"
 		author = "Arkbird_SOLG"
-		id = "16ddcc9a-8254-5d40-adcd-70ebe212fc78"
+		id = "2aa748fc-0490-5a27-ad7d-78a62759b793"
 		date = "2020-12-19"
 		modified = "2020-12-19"
 		reference = "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-19/Mal_PhantomNet_Nov_2020_1.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "a08467f68968fb0dfa82bca5984e1ad823f222946bd0acb62db418556a9a347a"
+		logic_hash = "v1_sha256_a08467f68968fb0dfa82bca5984e1ad823f222946bd0acb62db418556a9a347a"
 		score = 75
 		quality = 65
 		tags = "FILE"
@@ -208740,20 +208799,20 @@ rule ARKBIRD_SOLG_Mal_Phantomnet_Nov_2020_1 : FILE
 		$s12 = "Proxy-Authenticate: NTLM" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >90KB and 9 of them
+		uint16( 0 ) == 0x5a4d and filesize > 90KB and 9 of them
 }
 rule ARKBIRD_SOLG_Mal_Smanager_Installer_Module_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect installer module of Smanager (November 2020)"
 		author = "Arkbird_SOLG"
-		id = "364285bc-2173-5ff0-85d2-af06051a3b70"
+		id = "7c99219f-7090-59e9-bc7c-44dc8cee242e"
 		date = "2020-12-19"
 		modified = "2020-12-19"
 		reference = "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-19/Mal_Smanager_Installer_Module_Nov_2020_1.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "380d28f6cdea24f807f3c29207eb0b8888ebdfea215c53df164fe080c3917438"
+		logic_hash = "v1_sha256_380d28f6cdea24f807f3c29207eb0b8888ebdfea215c53df164fe080c3917438"
 		score = 75
 		quality = 61
 		tags = "FILE"
@@ -208774,20 +208833,20 @@ rule ARKBIRD_SOLG_Mal_Smanager_Installer_Module_Nov_2020_1 : FILE
 		$s12 = "%d.tmp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >90KB and 7 of them
+		uint16( 0 ) == 0x5a4d and filesize > 90KB and 7 of them
 }
 rule ARKBIRD_SOLG_Mal_Funnydream_Backdoor_Nov_2020_1 : FILE
 {
 	meta:
 		description = "Detect backdoor used by FunnyDream (November 2020)"
 		author = "Arkbird_SOLG"
-		id = "48120ba2-adaa-5098-8d8c-5c32bbafb9f6"
+		id = "c6409ed8-9bab-5fbd-9ebd-17b785b4da28"
 		date = "2020-12-19"
 		modified = "2020-12-19"
 		reference = "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-19/Mal_FunnyDream_Backdoor_Nov_2020_1.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "d12c465c735f09295b382fd5679d411c5114c232dabc22be84151e436f8fa199"
+		logic_hash = "v1_sha256_d12c465c735f09295b382fd5679d411c5114c232dabc22be84151e436f8fa199"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -208806,20 +208865,20 @@ rule ARKBIRD_SOLG_Mal_Funnydream_Backdoor_Nov_2020_1 : FILE
 		$s10 = { 5c 63 6d 64 c7 85 e0 fe ff ff 2e 65 78 65 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >90KB and 6 of them
+		uint16( 0 ) == 0x5a4d and filesize > 90KB and 6 of them
 }
 rule ARKBIRD_SOLG_MAL_Polazert_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detect Polazert stealer"
 		author = "Arkbird_SOLG"
-		id = "c7766749-558f-50b8-9054-01f5c4e1238b"
+		id = "f2352f47-1fc4-5c75-be88-83cd0c6fc6fc"
 		date = "2021-04-11"
 		modified = "2021-04-11"
 		reference = "https://bazaar.abuse.ch/browse/tag/Polazert/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-11/Polazert/MAL_Polazert_Apr_2021_1.yar#L1-L21"
 		license_url = "N/A"
-		logic_hash = "29cefeb3816435e70c706ac78395738f075f6c9f81d63e7295b0d8a6f370b51d"
+		logic_hash = "v1_sha256_29cefeb3816435e70c706ac78395738f075f6c9f81d63e7295b0d8a6f370b51d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -208836,20 +208895,20 @@ rule ARKBIRD_SOLG_MAL_Polazert_Apr_2021_1 : FILE
 		$seq9 = { 1f 10 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 47 9d 11 ?? 17 1f 65 9d 11 ?? 18 1f 74 9d 11 ?? 19 1f 54 9d 11 ?? 1a 1f 68 9d 11 ?? 1b 1f 72 9d 11 ?? 1c 1f 65 9d 11 ?? 1d 1f 61 9d 11 ?? 1e 1f 64 9d 11 ?? 1f 09 1f 43 9d 11 ?? 1f 0a 1f 6f 9d 11 ?? 1f 0b 1f 6e 9d 11 ?? 1f 0c 1f 74 9d 11 ?? 1f 0d 1f 65 9d 11 ?? 1f 0e 1f 78 9d 11 ?? 1f 0f 1f 74 9d 11 ?? 28 97 00 00 06 28 09 00 00 2b 13 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >15KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize > 15KB and 3 of them
 }
 rule ARKBIRD_SOLG_MAL_ELF_Go_Worm_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect the worm written in Go that drops XMRig Miner"
 		author = "Arkbird_SOLG"
-		id = "6f4a9d3a-e038-5d7f-9c18-c380a0b295d2"
+		id = "edbe99e1-445c-5964-80f7-b52fad4b9dc6"
 		date = "2021-07-06"
 		modified = "2021-07-06"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1409848815948111877"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-06/MAL_ELF_Go_Worm_Jul_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "be8b95f8aab62d3a2b3376a0481ebc609afcd089e0613d39f258e07366b708a1"
+		logic_hash = "v1_sha256_be8b95f8aab62d3a2b3376a0481ebc609afcd089e0613d39f258e07366b708a1"
 		score = 75
 		quality = 61
 		tags = "FILE"
@@ -208868,20 +208927,20 @@ rule ARKBIRD_SOLG_MAL_ELF_Go_Worm_Jul_2021_1 : FILE
 		$s7 = { 57 6f 72 6b 65 72 3a 20 28 25 64 29 2c 20 54 72 79 3a 20 49 50 3a 20 25 73 2c 20 63 72 65 64 65 6e 74 69 61 6c 3a 20 25 73 2f 25 73 20 28 25 64 2f 25 64 29 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >900KB and all of ($s*)
+		uint32( 0 ) == 0x464c457f and filesize > 900KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_Exp_CVE_2021_40444_Sep_2021_1 : FILE
 {
 	meta:
 		description = "Detect the maldocs with a structure like used for CVE_2021_40444 exploit"
 		author = "Arkbird_SOLG"
-		id = "acaba73d-f744-5d3f-9617-e976832f3577"
+		id = "d08351d3-7f92-52ef-b914-bc19f5ba8587"
 		date = "2021-09-09"
 		modified = "2021-09-09"
 		reference = "https://github.com/StrangerealIntel/DailyIOC"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-09/Exp_CVE_2021_40444_Sep_2021_1.yara#L2-L20"
 		license_url = "N/A"
-		logic_hash = "ba1b256c9caad3371d57e6ecbe54721038c819c7c081edf2443523109c25b184"
+		logic_hash = "v1_sha256_ba1b256c9caad3371d57e6ecbe54721038c819c7c081edf2443523109c25b184"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -208899,20 +208958,20 @@ rule ARKBIRD_SOLG_Exp_CVE_2021_40444_Sep_2021_1 : FILE
 		$x2 = { 77 6d 66 55 54 09 00 03 00 a6 ce 12 00 a6 ce 12 75 78 0b 00 01 04 00 00 00 00 04 00 00 00 00 bb 7e f6 d8 2c 06 38 48 00 93 85 e1 8c 0c 9c 0c 0c cc 52 60 1e 2b 98 64 01 62 66 46 0e 30 8f 9b 09 26 ce 03 66 31 83 55 00 00 50 4b 03 04 ?? 00 00 00 ?? 00 [10] 00 00 [2] 00 00 ?? 00 1c 00 }
 
 	condition:
-		uint16(0)==0x4B50 and filesize >5KB and all of ($x*)
+		uint16( 0 ) == 0x4B50 and filesize > 5KB and all of ( $x* )
 }
 rule ARKBIRD_SOLG_Ran_Ranzy_Locker_Nov_2020_1 : FILE
 {
 	meta:
 		description = " Detect Ranzy Locker (RAAS)"
 		author = "Arkbird_SOLG"
-		id = "7e81d73a-ef18-5f89-b6b3-f56212d30b4a"
+		id = "84d7821f-dfb4-51e6-bd92-48469bbcf9f9"
 		date = "2020-11-19"
 		modified = "2020-11-19"
 		reference = "https://labs.sentinelone.com/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-19/Ranzy_Locker/Ran_Ranzy_Locker_Nov_2020_1.yar#L1-L36"
 		license_url = "N/A"
-		logic_hash = "e27017fa196d14b88c5cb682a070d10e42b63f9e21189d9917c0ae03c47216cc"
+		logic_hash = "v1_sha256_e27017fa196d14b88c5cb682a070d10e42b63f9e21189d9917c0ae03c47216cc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -208945,20 +209004,20 @@ rule ARKBIRD_SOLG_Ran_Ranzy_Locker_Nov_2020_1 : FILE
 		$seq2 = { 8b 75 08 33 ff 8b 55 0c 33 c0 89 b5 68 fb ff ff 89 bd ac fb ff ff c7 85 b0 fb ff ff 07 00 00 00 66 89 85 9c fb ff ff 89 7d fc 39 7a 10 0f 84 da 00 00 00 6a 02 0f 57 c0 8d 8d 84 fb ff ff 58 66 0f 13 85 bc fb ff ff 66 89 85 b4 fb ff ff e8 6e ac ff ff 83 78 14 10 72 02 8b 00 50 ff 15 18 82 41 00 8d 8d 84 fb ff ff 89 85 b8 fb ff ff e8 8f a8 ff ff 68 87 69 00 00 ff 15 0c 82 41 00 bb 01 04 00 00 66 89 85 b6 fb ff ff 53 8d 85 c4 fb ff ff 57 50 e8 fd 2d 00 00 83 c4 0c 8d 7d cc 33 c0 6a 08 59 6a 08 6a 20 f3 ab 8d 45 cc 50 53 8d 85 c4 fb ff ff 50 6a 10 8d 85 b4 fb ff ff 50 ff 15 1c 82 41 00 85 c0 75 45 8d 85 c4 fb ff ff 50 8d 8d 6c fb ff ff e8 7f a8 ff ff 8b d0 c6 45 fc 01 8d 8d 84 fb ff ff e8 26 ab ff ff 50 8d 8d 9c fb ff ff e8 88 bf ff ff 8d 8d 84 fb ff ff e8 c8 c2 ff ff 8d 8d 6c fb ff ff e8 f5 a7 ff ff 8d 85 9c fb }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 10 of ($s*) and 1 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 80KB and 10 of ( $s* ) and 1 of ( $seq* )
 }
 rule ARKBIRD_SOLG_MAL_ELF_Rekoobe_Nov_2021_1 : FILE
 {
 	meta:
 		description = "Detect the Rekoobe rootkit"
 		author = "Arkbird_SOLG"
-		id = "a5b200f1-cbb7-5106-8127-74abd3cde061"
+		id = "77972383-fb05-587c-ba0f-494e9c534184"
 		date = "2021-11-10"
 		modified = "2021-11-11"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-10/MAL_ELF_Rekoobe_Nov_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "bde3d1a3d2d2e9efd4b7c68f69dce40d5e0f01d41885481730d8a7fa67cbab7e"
+		logic_hash = "v1_sha256_bde3d1a3d2d2e9efd4b7c68f69dce40d5e0f01d41885481730d8a7fa67cbab7e"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -208976,20 +209035,20 @@ rule ARKBIRD_SOLG_MAL_ELF_Rekoobe_Nov_2021_1 : FILE
 		$s6 = { 2f 76 61 72 2f 74 6d 70 00 2f 76 61 72 2f 70 72 6f 66 69 6c 65 }
 
 	condition:
-		uint32(0)==0x464C457F and filesize >100KB and 5 of ($s*)
+		uint32( 0 ) == 0x464C457F and filesize > 100KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Donot_Downloader_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect the trojan downloader used by Donot group"
 		author = "Arkbird_SOLG"
-		id = "251a809e-9e36-5c46-955f-006531bd9619"
+		id = "714fb6c2-13d5-59c7-8ce5-6c6974a94521"
 		date = "2020-05-09"
 		modified = "2021-05-09"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-09/Donot/APT_Donot_Downloader_May_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "df64ab97b74935ce8b73c3854eb81fa1dbd4e59b1e27c43ae9c85b90aaaef6f7"
+		logic_hash = "v1_sha256_df64ab97b74935ce8b73c3854eb81fa1dbd4e59b1e27c43ae9c85b90aaaef6f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209007,20 +209066,20 @@ rule ARKBIRD_SOLG_APT_Donot_Downloader_May_2021_1 : FILE
 		$s3 = { 25 73 5c [1-14] 25 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and all of ($seq*) and 2 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 10KB and all of ( $seq* ) and 2 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Fuxsocy_May_2021_1 : FILE
 {
 	meta:
 		description = "Detect FuxSocy ransomware"
 		author = "Arkbird_SOLG"
-		id = "2420c2fa-bc94-51a6-87ab-4e8d226fdd23"
+		id = "ebcf26f8-4087-5bbb-bdd4-74b343184161"
 		date = "2020-05-09"
 		modified = "2021-05-09"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-09/FuxSocy/RAN_FuxSocy_May_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "ab34f95d2b12bdf2d362538e880301542c3308fff427cfb5ee59e9dca89ec033"
+		logic_hash = "v1_sha256_ab34f95d2b12bdf2d362538e880301542c3308fff427cfb5ee59e9dca89ec033"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209037,20 +209096,20 @@ rule ARKBIRD_SOLG_RAN_Fuxsocy_May_2021_1 : FILE
 		$seq5 = { 8b 45 08 56 ff 70 08 ff 15 dc 00 41 00 8b ce e8 af 2e 00 00 33 ff 57 ff 75 08 57 ff 33 ff 15 e4 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 3 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 3 of ( $seq* )
 }
 rule ARKBIRD_SOLG_CRIM_FIN7_PS_Cryptor_Jun_2021_1 : FILE
 {
 	meta:
 		description = "Detect PS Cryptor used by FIN7 for Diceloader and Carbanak"
 		author = "Arkbird_SOLG"
-		id = "26361500-c33e-59c8-a53f-a881966c71a7"
+		id = "2ac9d361-1594-501c-997d-db42c717d6a9"
 		date = "2021-06-07"
 		modified = "2021-06-07"
 		reference = "https://twitter.com/z0ul_/status/1401795117678219267"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-07/FIN7/CRIM_FIN7_PS_Cryptor_Jun_2021_1.yara#L1-L28"
 		license_url = "N/A"
-		logic_hash = "d7eadaa6dec75ecfa2f03860f41b39dbe9e7ffc9e6ad743497586356301ef67c"
+		logic_hash = "v1_sha256_d7eadaa6dec75ecfa2f03860f41b39dbe9e7ffc9e6ad743497586356301ef67c"
 		score = 75
 		quality = 55
 		tags = "FILE"
@@ -209076,20 +209135,20 @@ rule ARKBIRD_SOLG_CRIM_FIN7_PS_Cryptor_Jun_2021_1 : FILE
 		$s11 = { 3d 5b 49 6e 74 50 74 72 5d 3a 3a 5a 65 72 6f }
 
 	condition:
-		filesize >40KB and 8 of ($s*)
+		filesize > 40KB and 8 of ( $s* )
 }
 rule ARKBIRD_SOLG_Ran_Regretlocker_Oct_2020_1 : FILE
 {
 	meta:
 		description = "Detect RegretLocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "a8d58402-15e2-5d20-8d33-2e7a3f8973fd"
+		id = "4238f40d-aa47-5bce-9a50-4b6b21eb9033"
 		date = "2020-11-04"
 		modified = "2020-11-04"
 		reference = "https://twitter.com/VK_Intel/status/1323693700371914753"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-04/RegretLocker/Ran_RegretLocker_Oct_2020_1.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "2c63bdcee6f2a9025d3a1f73f3a38ec58da103752b88bd3a6bf79d85d8f92e4d"
+		logic_hash = "v1_sha256_2c63bdcee6f2a9025d3a1f73f3a38ec58da103752b88bd3a6bf79d85d8f92e4d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209109,20 +209168,20 @@ rule ARKBIRD_SOLG_Ran_Regretlocker_Oct_2020_1 : FILE
 		$str3 = "Content-Type: application/x-www-form-urlencoded" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >200KB and all of ($seq*) and 4 of ($com*) and 2 of ($str*)
+		uint16( 0 ) == 0x5a4d and filesize > 200KB and all of ( $seq* ) and 4 of ( $com* ) and 2 of ( $str* )
 }
 rule ARKBIRD_SOLG_APT_Turla_Comrat_Chinch_V4_Jan_2021_1 : FILE
 {
 	meta:
 		description = "Detect ComRAT V4 (Chinch) used by APT Turla group"
 		author = "Arkbird_SOLG"
-		id = "7d4daf3d-eed9-59fb-a4b9-fbc1c72adfcd"
+		id = "1214c156-5554-5681-87b7-c8d1fcb0b244"
 		date = "2021-01-23"
 		modified = "2021-01-26"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-23/Turla/APT_Turla_ComRAT_Chinch_V4_Jan_2021_1.yar#L1-L28"
 		license_url = "N/A"
-		logic_hash = "0d92207c4716f8d2fbf1d4f0cf3a33c38417fdd1565c87c251f7ff290135c435"
+		logic_hash = "v1_sha256_0d92207c4716f8d2fbf1d4f0cf3a33c38417fdd1565c87c251f7ff290135c435"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209146,20 +209205,20 @@ rule ARKBIRD_SOLG_APT_Turla_Comrat_Chinch_V4_Jan_2021_1 : FILE
 		$seq4 = { b8 09 00 00 00 44 88 a5 60 01 00 00 48 8d 8d 60 01 00 00 f3 0f 7f 85 70 01 00 00 e8 c1 19 fc ff ba df 5e ca 76 48 8d 4d 50 e8 63 ea fc ff 48 8b c8 48 8d 95 60 01 00 00 e8 c4 cb ff ff 0f b6 15 dd 8b 1c 00 48 8b c8 e8 35 cd ff ff 48 8b 95 78 01 00 00 48 83 fa 10 72 34 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >1000KB and 6 of ($com*) and all of ($jmp*) and 3 of ($seq*)
+		uint16( 0 ) == 0x5a4d and filesize > 1000KB and 6 of ( $com* ) and all of ( $jmp* ) and 3 of ( $seq* )
 }
 rule ARKBIRD_SOLG_MAL_Kpot_Oct_2020_1 : FILE
 {
 	meta:
 		description = "Detect KPot stealer (new variant October 2020)"
 		author = "Arkbird_SOLG"
-		id = "316feeb3-59e5-5d18-9800-db41fabd6cb0"
+		id = "2b659f09-b392-5133-a6d2-dec791e112e2"
 		date = "2020-10-17"
 		modified = "2020-10-17"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-17/MAL_KPot_Oct_2020_1.yar#L1-L40"
 		license_url = "N/A"
-		logic_hash = "20010e8f2d45f904911664edee710f4dca18327c2b80766c253970a50624d13c"
+		logic_hash = "v1_sha256_20010e8f2d45f904911664edee710f4dca18327c2b80766c253970a50624d13c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -209194,20 +209253,20 @@ rule ARKBIRD_SOLG_MAL_Kpot_Oct_2020_1 : FILE
 		$op4 = "monero-project" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >120KB and 4 of ($olds*) and 10 of ($debug*) and 2 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize > 120KB and 4 of ( $olds* ) and 10 of ( $debug* ) and 2 of ( $op* )
 }
 rule ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_1 : FILE
 {
 	meta:
 		description = "Detect Gelsenicine malware (Loader - Variant 1)"
 		author = "Arkbird_SOLG"
-		id = "36276150-a5dd-5385-9e50-958a6fa54de5"
+		id = "a8daa0d3-93ea-596e-9585-917fcbc26f97"
 		date = "2021-06-12"
 		modified = "2021-06-14"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsenicine_June_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "66d9fad7105b46a55db11c5224b1a395793f2dee89f779d59c80b2f7cda5a115"
+		logic_hash = "v1_sha256_66d9fad7105b46a55db11c5224b1a395793f2dee89f779d59c80b2f7cda5a115"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209224,20 +209283,20 @@ rule ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_1 : FILE
 		$s4 = { 55 8b ec 51 33 c0 56 f6 05 [3] 74 01 89 45 fc 0f 85 c6 00 00 00 8a 4d 0b 80 0d [3] 74 01 53 bb [3] 74 57 88 0d [3] 74 50 8b cb ff 15 [3] 74 8b 35 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 8a 45 0b bb [3] 74 6a 00 8b cb a2 [3] 74 ff 15 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 8a 45 0b bb [3] 74 6a 00 8b cb a2 [3] 74 ff 15 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 8a 45 0b bb [3] 74 6a 00 8b cb a2 [3] 74 ff 15 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 68 [2] e2 74 e8 [2] 00 00 59 5f 33 c0 5b 8b 75 08 8a 4d 0b 68 [3] 74 68 [3] 74 88 0e 50 8b ce 89 46 04 89 46 08 89 46 0c e8 [2] 00 00 8b c6 5e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >15KB and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 15KB and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_2 : FILE
 {
 	meta:
 		description = "Detect Gelsenicine malware (Loader - Variant 2)"
 		author = "Arkbird_SOLG"
-		id = "c6e28da2-622b-57ba-9381-9f8f6b8879bf"
+		id = "57867a6e-0a67-523a-babf-25368a626d79"
 		date = "2021-06-12"
 		modified = "2021-06-14"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsenicine_June_2021_2.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "e1d6402c743af697c8d1b34087b6fe9db80237834d73967b0a0638023d4e4a40"
+		logic_hash = "v1_sha256_e1d6402c743af697c8d1b34087b6fe9db80237834d73967b0a0638023d4e4a40"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209254,20 +209313,20 @@ rule ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_2 : FILE
 		$s4 = { 45 33 c9 45 33 c0 ba 80 00 00 00 48 8b ce e8 16 f2 ff ff 84 c0 74 71 48 8d 53 18 41 b8 20 00 00 00 48 8b ce e8 e4 f4 ff ff 84 c0 74 5b 48 8d 53 38 41 b8 20 00 00 00 48 8b ce e8 56 f9 ff ff 84 c0 74 45 48 8b 43 10 48 8b 0d [3] 00 48 3b c1 74 0d 48 8b d8 48 8b 00 48 3b c1 75 f5 eb 1b 48 8b 43 08 eb 07 48 8b d8 48 8b 40 08 48 3b 58 10 74 f3 48 39 43 10 48 0f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 30KB and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Gelsemium_Gelsevirine_June_2021_1 : FILE
 {
 	meta:
 		description = "Detect Gelsevirine malware (Main Plug-in)"
 		author = "Arkbird_SOLG"
-		id = "31900186-2531-5558-aafb-67707040ddaf"
+		id = "1028d08a-01cc-51a2-b07a-09f98e468afb"
 		date = "2021-06-12"
 		modified = "2021-06-14"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsevirine_June_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "06e7ee49092621c8469eeb1cd9e5cc1420a1879084e0d0a39181dc046bfa00cf"
+		logic_hash = "v1_sha256_06e7ee49092621c8469eeb1cd9e5cc1420a1879084e0d0a39181dc046bfa00cf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209283,20 +209342,20 @@ rule ARKBIRD_SOLG_APT_Gelsemium_Gelsevirine_June_2021_1 : FILE
 		$s4 = { 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 85 df 06 00 49 8b ce e8 05 dd ff ff e8 e0 db ff ff 48 8d 78 30 e8 27 fc ff ff 33 f6 84 c0 0f 85 ae 01 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 44 8d 46 07 48 8d 15 cf 84 09 00 48 8d 4c 24 20 e8 45 5d 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 44 8d 46 07 48 8d 15 a6 84 09 00 48 8d 4c 24 40 e8 1c 5d 01 00 90 48 8d 54 24 20 48 8b cf e8 5e 24 01 00 48 8b d8 48 8d 54 24 40 48 8d 4d 18 e8 4d 24 01 00 48 8b c8 48 8b d3 e8 72 c1 ff ff 85 c0 0f 9e c3 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 d2 de 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 ac de 06 00 84 db 0f 84 ed 00 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 20 00 00 00 48 8d 15 ec 84 09 00 48 8d 4c 24 20 e8 82 5c 01 00 90 48 8d 05 3a aa 09 00 48 89 44 24 40 48 c7 44 24 60 07 00 00 00 48 89 74 24 58 66 89 74 24 48 49 83 c9 ff 45 33 c0 48 8d 54 24 20 48 8d 4c 24 48 e8 0c 5b 01 00 90 48 8d 05 e4 a8 09 00 48 89 45 80 48 8d 4d 88 ff 15 76 de 06 00 48 8d 05 ff e7 06 00 48 89 45 a0 48 89 75 a8 48 89 75 b0 48 89 75 b8 c7 45 c0 ff ff ff ff 48 8b 45 80 48 63 48 04 48 8d 05 71 9a 09 00 48 89 44 0d 80 48 8b 45 80 48 63 48 08 48 8d 05 bd ac 09 00 48 89 44 0d 80 48 8d 54 24 40 48 8d 4d 80 e8 a2 e0 02 00 48 8b d0 41 b8 01 00 00 00 48 8d 4d d0 e8 e0 05 00 00 48 8d 15 81 f8 0b 00 48 8d 4d d0 e8 a2 46 06 00 90 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 0b 00 00 00 48 8d 15 67 83 09 00 48 8d 4c 24 20 e8 95 5b 01 00 90 48 8d 54 24 20 49 8b cd e8 d7 22 01 00 49 3b c4 74 13 49 83 c9 ff 45 33 c0 49 8b d4 48 8b c8 e8 30 5a 01 00 90 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 54 dd 06 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 07 00 00 00 48 8d 15 bc 82 09 00 48 8d 4c 24 20 e8 32 5b 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 41 b8 07 00 00 00 48 8d 15 91 82 09 00 48 8d 4c 24 40 e8 07 5b 01 00 90 48 8d 54 24 20 48 8d 4d 18 e8 48 22 01 00 48 8b d8 48 8d 54 24 40 48 8b cf e8 38 22 01 00 48 3b c3 74 13 49 83 c9 ff 45 33 c0 48 8b d3 48 8b c8 e8 91 59 01 00 90 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 b5 dc 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 300KB and 3 of ( $s* )
 }
 rule ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1 : FILE
 {
 	meta:
 		description = "Detect Gelsemine malware (Dropper - Variant 1)"
 		author = "Arkbird_SOLG"
-		id = "cfe932fd-ff50-5e54-824c-e11afe8e8575"
+		id = "0d793563-ee56-5da3-ba96-cf32bb2c887b"
 		date = "2021-06-12"
 		modified = "2021-06-14"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsemine_June_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "2b5031412de163ad92dfe00c7da331eb36c4ce7b590df48dfa84df0104e93b15"
+		logic_hash = "v1_sha256_2b5031412de163ad92dfe00c7da331eb36c4ce7b590df48dfa84df0104e93b15"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209313,20 +209372,20 @@ rule ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1 : FILE
 		$s3 = { 55 8b ec 6a ff 68 [2] 40 00 68 [2] 40 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 68 53 56 57 89 65 e8 33 db 89 5d fc 6a 02 5f 57 ff 15 [2] 40 00 59 83 0d [2] 41 00 ff 83 0d [2] 41 00 ff ff 15 [2] 40 00 8b 0d [2] 41 00 89 08 ff 15 [2] 40 00 8b 0d [2] 41 00 89 08 a1 [2] 40 00 8b 00 a3 [2] 41 00 e8 ?? 01 00 00 39 1d [3] 00 75 0c 68 [2] 40 00 ff 15 [2] 40 00 59 e8 ?? 01 00 00 68 [3] 00 68 [3] 00 e8 ?? 01 00 00 a1 [2] 41 00 89 45 94 8d 45 94 50 ff 35 [2] 41 00 8d 45 9c 50 8d 45 90 50 8d 45 a0 50 ff 15 [2] 40 00 68 [3] 00 68 00 [2] 00 e8 ?? 01 00 00 83 c4 24 a1 [2] 40 00 8b 30 3b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >150KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 150KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_MAL_Unknown_PE_Jul_2021_1 : FILE
 {
 	meta:
 		description = "Detect unknown TA that focus russian people"
 		author = "Arkbird_SOLG"
-		id = "228e194c-84d9-562a-8811-326c5efeafae"
+		id = "3d6d1489-896f-5aad-81ca-3c3528e2f72c"
 		date = "2020-07-14"
 		modified = "2021-07-14"
 		reference = "https://twitter.com/ShadowChasing1/status/1415292150258880513"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-14/MAL_Unknown_PE_Jul_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "9c61d2e29315bea0cdaf45b6dc48d35b8cc2d85de84afbb3a213f095a555af71"
+		logic_hash = "v1_sha256_9c61d2e29315bea0cdaf45b6dc48d35b8cc2d85de84afbb3a213f095a555af71"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -209343,20 +209402,20 @@ rule ARKBIRD_SOLG_MAL_Unknown_PE_Jul_2021_1 : FILE
 		$s6 = { 64 6c 6c 00 4d 79 45 78 70 6f 72 74 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >8KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 8KB and 5 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Crylock_July_2021_1 : FILE
 {
 	meta:
 		description = "Detect CryLock ransomware (ex-Cryakl)"
 		author = "Arkbird_SOLG"
-		id = "350bd622-f4b5-5837-a239-dc506b100aef"
+		id = "b1305432-b707-5d53-bd61-e4c02b0a044f"
 		date = "2021-07-17"
 		modified = "2021-07-17"
 		reference = "https://twitter.com/BushidoToken/status/1415958829318217730"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-16/Crylock/RAN_Crylock_July_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "4f5046a64e7491085a55d8d1f2b5b056dc0aa89fcdea47652ecb7db680de2f59"
+		logic_hash = "v1_sha256_4f5046a64e7491085a55d8d1f2b5b056dc0aa89fcdea47652ecb7db680de2f59"
 		score = 75
 		quality = 65
 		tags = "FILE"
@@ -209376,20 +209435,20 @@ rule ARKBIRD_SOLG_RAN_Crylock_July_2021_1 : FILE
 		$s7 = { 25 00 73 00 20 00 28 00 25 00 73 00 2c 00 20 00 6c 00 69 00 6e 00 65 00 20 00 25 00 64 00 29 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 6 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 80KB and 6 of ( $s* )
 }
 rule ARKBIRD_SOLG_RAN_Cring_Apr_2021_1 : FILE
 {
 	meta:
 		description = "Detect CRing ransomware"
 		author = "Arkbird_SOLG"
-		id = "3648494d-8c27-5767-90e8-45e294aac382"
+		id = "8aff62bf-2273-55c5-8f86-d6e5fc70af10"
 		date = "2021-04-08"
 		modified = "2021-04-09"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-08/CRing/RAN_CRing_Apr_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "d82db146c9048391d79bda6cc5913363fc3cfc1a7cca26b23b362b7f3563ef3c"
+		logic_hash = "v1_sha256_d82db146c9048391d79bda6cc5913363fc3cfc1a7cca26b23b362b7f3563ef3c"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -209404,20 +209463,20 @@ rule ARKBIRD_SOLG_RAN_Cring_Apr_2021_1 : FILE
 		$str3 = { 1b 30 03 00 24 00 00 00 05 00 00 11 73 35 00 00 0a 0a 06 03 6f 36 00 00 0a 06 02 17 6f 37 00 00 0a 0b de 0a 06 2c 06 06 6f 12 00 00 0a dc 07 2a 01 10 00 00 02 00 06 00 12 18 00 0a 00 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >5KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize > 5KB and 2 of them
 }
 rule ARKBIRD_SOLG_Ran_Egregor_Oct_2020_1 : FILE
 {
 	meta:
 		description = "Detect Egregor / Maze ransomware by Maze blocks"
 		author = "Arkbird_SOLG"
-		id = "03d3ee25-cd0c-573e-beca-e4ff4377da9f"
+		id = "4ed6e3b4-2665-517d-b30d-37abf6874b0e"
 		date = "2020-10-29"
 		modified = "2023-11-22"
 		reference = "Internal Research"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-31/Ran_Egregor_Oct_2020_1 .yar#L1-L21"
 		license_url = "N/A"
-		logic_hash = "d7d03db002b74d031b725db60e38a46abce564fb090b013aa9ec66376b430000"
+		logic_hash = "v1_sha256_d7d03db002b74d031b725db60e38a46abce564fb090b013aa9ec66376b430000"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209436,20 +209495,20 @@ rule ARKBIRD_SOLG_Ran_Egregor_Oct_2020_1 : FILE
 		$op4 = { 75 09 c7 45 f0 00 00 00 00 eb 17 60 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >350KB and (3 of ($op*) or 2 of ($x*))
+		uint16( 0 ) == 0x5a4d and filesize > 350KB and ( 3 of ( $op* ) or 2 of ( $x* ) )
 }
 rule ARKBIRD_SOLG_RAN_Yanluowang_Dec_2021_1 : FILE
 {
 	meta:
 		description = "Detect Yanluowang ransomware"
 		author = "Arkbird_SOLG"
-		id = "339d3dab-9bdd-5a46-8261-c32862ccc3bf"
+		id = "ce8a306c-05da-55d5-b7b6-3d60bb646caa"
 		date = "2021-12-17"
 		modified = "2021-12-18"
 		reference = "https://samples.vx-underground.org/samples/Families/YanluowangRansomware/"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-18/RAN_Yanluowang_Dec_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "0144874fb24411b4378a2e2992934e674808f01ecc38f23d0d9d37e1d45621e4"
+		logic_hash = "v1_sha256_0144874fb24411b4378a2e2992934e674808f01ecc38f23d0d9d37e1d45621e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209465,20 +209524,20 @@ rule ARKBIRD_SOLG_RAN_Yanluowang_Dec_2021_1 : FILE
 		$s4 = { 8b ec 6a ff 68 2b 52 44 00 64 a1 00 00 00 00 50 81 ec 8c 02 00 00 a1 c0 c8 45 00 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 6a 05 33 c0 c7 45 c0 00 00 00 00 68 84 57 45 00 8d 4d c0 c7 45 d0 00 00 00 00 c7 45 d4 07 00 00 00 66 89 45 c0 e8 59 3f 00 00 c7 45 fc 00 00 00 00 8d 4d d8 6a 03 33 c0 c7 45 d8 00 00 00 00 68 90 57 45 00 c7 45 e8 00 00 00 00 c7 45 ec 07 00 00 00 66 89 45 d8 e8 28 3f 00 00 6a 00 6a 0f c7 45 fc 01 00 00 00 ff 15 98 70 44 00 8b f0 89 b5 74 fd ff ff 83 fe ff 0f 84 2c 02 00 00 a1 9c 70 44 00 8d 7d c0 8b 0d 48 70 44 00 89 85 7c fd ff ff a1 80 70 44 00 89 85 78 fd ff ff a1 4c 70 44 00 89 85 80 fd ff ff a1 90 70 44 00 c7 85 88 fd ff ff 00 00 00 00 89 bd 84 fd ff ff 89 8d 6c fd ff ff 89 85 70 fd ff ff 66 66 66 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >100KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 100KB and all of ( $s* )
 }
 rule ARKBIRD_SOLG_APK_Droidwatcher_Nov_2021_1 : FILE
 {
 	meta:
 		description = "Detect modified DroidWatcher stealer used by Void Balaur group"
 		author = "Arkbird_SOLG"
-		id = "04e02521-d89a-5f72-8b6f-0350f6defdd0"
+		id = "a1d6f27d-aa50-5fdb-b242-17c87a7fcef9"
 		date = "2021-11-11"
 		modified = "2021-11-12"
 		reference = "https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-11/Void_Balaur/APK_DroidWatcher_Nov_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "c16bcdd5d9cd6a3cbb527893e13ac967211d1686edd9f7ae03e37feada725a1b"
+		logic_hash = "v1_sha256_c16bcdd5d9cd6a3cbb527893e13ac967211d1686edd9f7ae03e37feada725a1b"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -209495,20 +209554,20 @@ rule ARKBIRD_SOLG_APK_Droidwatcher_Nov_2021_1 : FILE
 		$s5 = { FA D6 A4 0F EB 79 42 D2 76 F6 54 BA B2 9A 27 FC D0 5E 9E 30 8D 2B 24 E9 A0 AE A8 41 33 06 32 84 51 8C 63 12 33 98 CF 72 36 B0 8B 83 1C E3 12 D7 B8 CD 63 5E 13 B3 A3 FE 45 06 8A D0 80 3E 0C 66 32 33 59 C6 66 0E 10 C1 39 AE F3 84 D7 C4 EF E4 EC C8 37 64 22 17 F9 28 42 45 3A 31 9E A5 EC E1 14 37 79 C0 DB FF FD B6 B3 E7 F3 3B 45 A9 45 28 E3 D9 }
 
 	condition:
-		uint32be(0)==0x504B0304 and filesize >300KB and 4 of them
+		uint32be( 0 ) == 0x504B0304 and filesize > 300KB and 4 of them
 }
 rule ARKBIRD_SOLG_MAL_Zstealer_Nov_2021_1 : FILE
 {
 	meta:
 		description = "Detect ZStealer stealer used by Void Balaur group"
 		author = "Arkbird_SOLG"
-		id = "0282884b-569a-5e46-a6ad-d2776ff71ddb"
+		id = "77ce3d34-737b-5ed2-b865-c8ce543dc1c7"
 		date = "2021-11-11"
 		modified = "2021-11-12"
 		reference = "https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf"
 		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-11/Void_Balaur/MAL_ZStealer_Nov_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "c3bec4fb8338ad71577e63f81c22b5d250083f2475f60610de8dccd4979035d3"
+		logic_hash = "v1_sha256_c3bec4fb8338ad71577e63f81c22b5d250083f2475f60610de8dccd4979035d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -209525,13 +209584,13 @@ rule ARKBIRD_SOLG_MAL_Zstealer_Nov_2021_1 : FILE
 		$s5 = { 45 72 72 6f 72 20 5b 25 64 5d 3a 20 25 73 2e 0d 22 25 73 22 3a 20 25 73 00 00 ff ff ff ff 0a 00 00 00 4e 6f 20 6d 65 73 73 61 67 65 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize > 300KB and all of them
 }
 /*
  * YARA Rule Set
  * Repository Name: Telekom Security
  * Repository: https://github.com/telekom-security/malware_analysis/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: bf832d97e8fd292ec5e095e35bde992a6462e71c
  * Number of Rules: 12
  * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
@@ -209546,14 +209605,14 @@ rule TELEKOM_SECURITY_Android_Flubot : FILE
 	meta:
 		description = "matches on dumped, decrypted V/DEX files of Flubot version > 4.2"
 		author = "Thomas Barabosch, Telekom Security"
-		id = "d6d1eebc-961f-5032-af04-4c95f364a74d"
+		id = "3b943eba-9496-50ae-9913-2ba5e9e644d3"
 		date = "2021-09-14"
 		modified = "2021-09-14"
 		reference = "https://github.com/telekom-security/malware_analysis/"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/flubot/flubot.yar#L1-L19"
 		license_url = "N/A"
 		hash = "37be18494cd03ea70a1fdd6270cef6e3"
-		logic_hash = "db22e0890dfad7cb9cb1d18aadb406514e5e8874051aa7f07a4bb93da9db68df"
+		logic_hash = "v1_sha256_db22e0890dfad7cb9cb1d18aadb406514e5e8874051aa7f07a4bb93da9db68df"
 		score = 75
 		quality = 45
 		tags = "FILE"
@@ -209568,21 +209627,21 @@ rule TELEKOM_SECURITY_Android_Flubot : FILE
 		$s4 = "MANUFACTURER"
 
 	condition:
-		($dex at 0 or $vdex at 0) and 3 of ($s*)
+		($dex at 0 or $vdex at 0 ) and 3 of ( $s* )
 }
 rule TELEKOM_SECURITY_Android_Teabot : FILE
 {
 	meta:
 		description = "matches on dumped, decrypted V/DEX files of Teabot"
 		author = "Thomas Barabosch, Telekom Security"
-		id = "9db701bf-be84-5236-97f7-67043cf3ea93"
+		id = "0a79f0ec-4116-5430-8410-fa743925fcba"
 		date = "2021-09-14"
 		modified = "2021-09-14"
 		reference = "https://github.com/telekom-security/malware_analysis/"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/flubot/teabot.yar#L1-L23"
 		license_url = "N/A"
 		hash = "37be18494cd03ea70a1fdd6270cef6e3"
-		logic_hash = "5aa7fdb191c36510c7698f3eae40c0b7f15c944b8f60113bbb4e40fc926579b8"
+		logic_hash = "v1_sha256_5aa7fdb191c36510c7698f3eae40c0b7f15c944b8f60113bbb4e40fc926579b8"
 		score = 75
 		quality = 45
 		tags = "FILE"
@@ -209601,20 +209660,20 @@ rule TELEKOM_SECURITY_Android_Teabot : FILE
 		$s8 = "xiaomi_autostart"
 
 	condition:
-		($dex at 0 or $vdex at 0) and 6 of ($s*)
+		($dex at 0 or $vdex at 0 ) and 6 of ( $s* )
 }
 rule TELEKOM_SECURITY_Crylock_Binary : FILE
 {
 	meta:
 		description = "Detects CryLock ransomware v2.3.0.0"
 		author = "Thomas Barabosch, Telekom Security"
-		id = "5d46adf6-3ea4-5e3d-ac33-1292c076c0df"
+		id = "563f0f5c-1351-53ed-a664-6a8f533dd94a"
 		date = "2021-06-28"
 		modified = "2021-07-08"
 		reference = "TBA"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/crylock/crylock_20210706.yar#L1-L27"
 		license_url = "N/A"
-		logic_hash = "990be4604c5737383cce1b32dfbf3bc066367d7bf4652e2549730cdeccf1f413"
+		logic_hash = "v1_sha256_990be4604c5737383cce1b32dfbf3bc066367d7bf4652e2549730cdeccf1f413"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -209636,20 +209695,20 @@ rule TELEKOM_SECURITY_Crylock_Binary : FILE
 		$s14 = "Encrypted:" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >150KB and filesize <1MB and 8 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize > 150KB and filesize < 1MB and 8 of ( $s* )
 }
 rule TELEKOM_SECURITY_Crylock_Hta : FILE
 {
 	meta:
 		description = "Detects CryLock ransomware how_to_decrypt.hta ransom note"
 		author = "Thomas Barabosch, Telekom Security"
-		id = "cf6ba6d2-beca-5da0-bb2d-0b8b52418a5e"
+		id = "4fe2f958-b286-5cd8-8ddd-d39be18ece5b"
 		date = "2021-06-28"
 		modified = "2021-07-08"
 		reference = "TBA"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/crylock/crylock_20210706.yar#L29-L53"
 		license_url = "N/A"
-		logic_hash = "3b603a395f872d74d54b98a8ac6e6eb71c3bd0f076b4c834fcb4922e2aaa58b9"
+		logic_hash = "v1_sha256_3b603a395f872d74d54b98a8ac6e6eb71c3bd0f076b4c834fcb4922e2aaa58b9"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -209671,20 +209730,20 @@ rule TELEKOM_SECURITY_Crylock_Hta : FILE
 		$s14 = "Before payment, we can decrypt three files for free." ascii
 
 	condition:
-		filesize <100KB and 8 of ($s*)
+		filesize < 100KB and 8 of ( $s* )
 }
 rule TELEKOM_SECURITY_Win_Systembc_20220311 : FILE
 {
 	meta:
 		description = "Detects unpacked SystemBC module"
 		author = "Thomas Barabosch, Deutsche Telekom Security"
-		id = "39e1a131-bd2c-56e9-961f-2b2c31f29e85"
+		id = "164ec211-cd54-5cec-9106-d6cb96a0ab5f"
 		date = "2022-03-13"
 		modified = "2022-03-13"
 		reference = "https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/systembc/systembc.yara#L1-L27"
 		license_url = "N/A"
-		logic_hash = "2f6e2c4c786941f800678e22679d4b81d1097a46c2555ae70e745df1b997c1c8"
+		logic_hash = "v1_sha256_2f6e2c4c786941f800678e22679d4b81d1097a46c2555ae70e745df1b997c1c8"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -209700,20 +209759,20 @@ rule TELEKOM_SECURITY_Win_Systembc_20220311 : FILE
 		$s8 = "ALLUSERSPROFILE" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and 2 of ($sx*)) or all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 30KB and 2 of ( $sx* ) ) or all of them
 }
 rule TELEKOM_SECURITY_Get_Windows_Proxy_Configuration : CAPABILITY HACKTOOL
 {
 	meta:
 		description = "Queries Windows Registry for proxy configuration"
 		author = "Thomas Barabosch, Deutsche Telekom Security"
-		id = "b67b0b70-a95f-5c65-a522-ef4f41e36159"
+		id = "7fa9aa9b-36bd-5059-8ac8-babd08c0fe1f"
 		date = "2022-01-14"
 		modified = "2023-12-12"
 		reference = "https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-ie-clientnetworkprotocolimplementation-hklmproxyserver"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/hacktools/hacktools.yar#L44-L57"
 		license_url = "N/A"
-		logic_hash = "db52782a56d42f6e460466ea46993490bbbceeb7422d45211f064edb2e37a8eb"
+		logic_hash = "v1_sha256_db52782a56d42f6e460466ea46993490bbbceeb7422d45211f064edb2e37a8eb"
 		score = 75
 		quality = 70
 		tags = "CAPABILITY, HACKTOOL"
@@ -209731,13 +209790,13 @@ rule TELEKOM_SECURITY_Cn_Utf8_Windows_Terminal : CAPABILITY HACKTOOL
 	meta:
 		description = "This is a (dirty) hack to display UTF-8 on Windows command prompt."
 		author = "Thomas Barabosch, Deutsche Telekom Security"
-		id = "a1beee71-c526-58fb-a255-dba55ef7535b"
+		id = "3c2fd792-8bbd-54e8-a277-78871361fd2f"
 		date = "2022-01-14"
 		modified = "2023-12-12"
 		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/hacktools/hacktools.yar#L59-L71"
 		license_url = "N/A"
-		logic_hash = "4c91280c3d6d3b48c4ee11bf3d0c2baecee1368fbf3951c0a3bf386454c557cf"
+		logic_hash = "v1_sha256_4c91280c3d6d3b48c4ee11bf3d0c2baecee1368fbf3951c0a3bf386454c557cf"
 		score = 40
 		quality = 20
 		tags = "CAPABILITY, HACKTOOL"
@@ -209753,13 +209812,13 @@ rule TELEKOM_SECURITY_Vatet_Loader_Rufus_Backdoor : DEFRAY777
 	meta:
 		description = "Detects backdoored Rufus with Vatet Loader of Defray777"
 		author = "Thomas Barabosch, Deutsche Telekom Security"
-		id = "1f6fa228-300c-59de-b89c-3cbdce1b6374"
+		id = "92e55685-3a93-5f95-9c01-7afcf3aa1bb9"
 		date = "2022-03-18"
 		modified = "2022-03-18"
 		reference = "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/defray777/vatet_loader.yar#L1-L27"
 		license_url = "N/A"
-		logic_hash = "3767398112759689078f992eb272cfec3e59f6d9ca30f8da68c2053e1217fd18"
+		logic_hash = "v1_sha256_3767398112759689078f992eb272cfec3e59f6d9ca30f8da68c2053e1217fd18"
 		score = 75
 		quality = 20
 		tags = "DEFRAY777"
@@ -209781,13 +209840,13 @@ rule TELEKOM_SECURITY_Fake_Gzip_Bokbot_202104
 	meta:
 		description = "fake gzip provided by CC"
 		author = "Thomas Barabosch, Telekom Security"
-		id = "538d84d8-aff2-571c-ba60-102f18262434"
+		id = "bbd3914b-74d2-5218-8584-8fc2829fa0e8"
 		date = "2021-04-20"
 		modified = "2021-07-08"
 		reference = "https://github.com/telekom-security/malware_analysis/"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L1-L11"
 		license_url = "N/A"
-		logic_hash = "0f0205234eae1b011b899a59e4430c2de9d913b05efee90ce844a06f1cff04f3"
+		logic_hash = "v1_sha256_0f0205234eae1b011b899a59e4430c2de9d913b05efee90ce844a06f1cff04f3"
 		score = 75
 		quality = 70
 		tags = ""
@@ -209803,13 +209862,13 @@ rule TELEKOM_SECURITY_Win_Iceid_Gzip_Ldr_202104 : FILE
 	meta:
 		description = "2021 initial Bokbot / Icedid loader for fake GZIP payloads"
 		author = "Thomas Barabosch, Telekom Security"
-		id = "9d905e90-dfec-596b-bd09-72413df49345"
+		id = "ab4a62f0-e840-5dd1-a8e3-81070a127657"
 		date = "2021-04-12"
 		modified = "2021-07-08"
 		reference = "https://github.com/telekom-security/malware_analysis/"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L14-L38"
 		license_url = "N/A"
-		logic_hash = "caf997e623920a230acce8a7256516aceb6a587823e0525a17e5d69d0ed45d12"
+		logic_hash = "v1_sha256_caf997e623920a230acce8a7256516aceb6a587823e0525a17e5d69d0ed45d12"
 		score = 75
 		quality = 45
 		tags = "FILE"
@@ -209829,20 +209888,20 @@ rule TELEKOM_SECURITY_Win_Iceid_Gzip_Ldr_202104 : FILE
 		$string10 = "aws.amazon.com" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name or all of ($s*)) or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name or all of ( $s* ) ) or all of them
 }
 rule TELEKOM_SECURITY_Win_Iceid_Core_Ldr_202104 : FILE
 {
 	meta:
 		description = "2021 loader for Bokbot / Icedid core (license.dat)"
 		author = "Thomas Barabosch, Telekom Security"
-		id = "f096e18d-3a31-5236-b3c3-0df39b408d9a"
+		id = "1f44d96c-b4cb-5053-ac62-bfb3da44ce5e"
 		date = "2021-04-13"
 		modified = "2021-07-08"
 		reference = "https://github.com/telekom-security/malware_analysis/"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L40-L62"
 		license_url = "N/A"
-		logic_hash = "d814dbaffb38dc71aaf373512246fd6d811750d526c4afffb0b8018329dcdd90"
+		logic_hash = "v1_sha256_d814dbaffb38dc71aaf373512246fd6d811750d526c4afffb0b8018329dcdd90"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -209860,20 +209919,20 @@ rule TELEKOM_SECURITY_Win_Iceid_Core_Ldr_202104 : FILE
 		$string8 = "CreateThread" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name and 5 of them ) or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name and 5 of them ) or all of them
 }
 rule TELEKOM_SECURITY_Win_Iceid_Core_202104 : FILE
 {
 	meta:
 		description = "2021 Bokbot / Icedid core"
 		author = "Thomas Barabosch, Telekom Security"
-		id = "526a73da-415f-58fe-bb5f-4c3df6b2e647"
+		id = "276b586c-f97d-5467-9418-bc371bb0756c"
 		date = "2021-04-12"
 		modified = "2021-07-08"
 		reference = "https://github.com/telekom-security/malware_analysis/"
 		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L64-L88"
 		license_url = "N/A"
-		logic_hash = "c208b4122159d24d010e2913c515d2ff730b30306f787d703816b5af1522ae88"
+		logic_hash = "v1_sha256_c208b4122159d24d010e2913c515d2ff730b30306f787d703816b5af1522ae88"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -209893,15 +209952,15 @@ rule TELEKOM_SECURITY_Win_Iceid_Core_202104 : FILE
 		$string10 = "PT0S" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name or all of ($s*)) or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name or all of ( $s* ) ) or all of them
 }
 /*
  * YARA Rule Set
  * Repository Name: Volexity
  * Repository: https://github.com/volexity/threat-intel
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: b2dd39c31efbb1ed004fb25faaace7d5caf2f424
- * Number of Rules: 94
+ * Number of Rules: 88
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
  *
  *
@@ -209922,13 +209981,13 @@ rule VOLEXITY_Apt_Malware_Py_Upstyle : UTA0218 FILE MEMORY
 	meta:
 		description = "Detect the UPSTYLE webshell."
 		author = "threatintel@volexity.com"
-		id = "45726f35-8b3e-5095-b145-9e7f6da6838b"
+		id = "d59df16f-2f70-5e46-a156-1fe826c4ab2f"
 		date = "2024-04-11"
 		modified = "2024-04-12"
 		reference = "TIB-20240412"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L1-L33"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "51923600b23d23f4ce29eac7f5ab9f7e1ddb45bed5f6727ddec4dcb75872e473"
+		logic_hash = "v1_sha256_51923600b23d23f4ce29eac7f5ab9f7e1ddb45bed5f6727ddec4dcb75872e473"
 		score = 75
 		quality = 80
 		tags = "UTA0218, FILE, MEMORY"
@@ -209951,20 +210010,20 @@ rule VOLEXITY_Apt_Malware_Py_Upstyle : UTA0218 FILE MEMORY
 		$stage3_str2 = "SHELL_PATTERN"
 
 	condition:
-		all of ($stage1*) or all of ($stage2*) or all of ($stage3*)
+		all of ( $stage1* ) or all of ( $stage2* ) or all of ( $stage3* )
 }
 rule VOLEXITY_Susp_Any_Jarischf_User_Path : FILE MEMORY
 {
 	meta:
 		description = "Detects paths embedded in samples in released projects written by Ferdinand Jarisch, a pentester in AISEC. These tools are sometimes used by attackers in real world intrusions."
 		author = "threatintel@volexity.com"
-		id = "062a6fdb-c516-5643-9c7c-deff32eeb95e"
+		id = "d896095d-3107-5239-921a-21b58dfc8520"
 		date = "2024-04-10"
 		modified = "2024-04-12"
 		reference = "TIB-20240412"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L57-L78"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "574d5b1fadb91c39251600e7d73d4993d4b16565bd1427a0e8d6ed4e7905ab54"
+		logic_hash = "v1_sha256_574d5b1fadb91c39251600e7d73d4993d4b16565bd1427a0e8d6ed4e7905ab54"
 		score = 50
 		quality = 80
 		tags = "FILE, MEMORY"
@@ -209980,20 +210039,20 @@ rule VOLEXITY_Susp_Any_Jarischf_User_Path : FILE MEMORY
 		$proj_1 = "/home/jarischf/"
 
 	condition:
-		any of ($proj_*)
+		any of ( $proj_* )
 }
 rule VOLEXITY_Hacktool_Golang_Reversessh_Fahrj : FILE MEMORY
 {
 	meta:
 		description = "Detects a reverse SSH utility available on GitHub. Attackers may use this tool or similar tools in post-exploitation activity."
 		author = "threatintel@volexity.com"
-		id = "332e323f-cb16-5aa2-8b66-f3d6d50d94f2"
+		id = "683e9c91-8e33-5262-bb91-b545ca3a49ef"
 		date = "2024-04-10"
 		modified = "2024-04-12"
 		reference = "TIB-20240412"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L79-L112"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "38b40cc7fc1e601da2c7a825f1c2eff209093875a5829ddd2f4c5ad438d660f8"
+		logic_hash = "v1_sha256_38b40cc7fc1e601da2c7a825f1c2eff209093875a5829ddd2f4c5ad438d660f8"
 		score = 75
 		quality = 80
 		tags = "FILE, MEMORY"
@@ -210018,23 +210077,20 @@ rule VOLEXITY_Hacktool_Golang_Reversessh_Fahrj : FILE MEMORY
 		$proj_1 = "github.com/Fahrj/reverse-ssh"
 
 	condition:
-		any of ($proj_*) or 4 of ($fun_*)
+		any of ( $proj_* ) or 4 of ( $fun_* )
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Any_Reloadext_Plugin : STORMBAMBOO FILE MEMORY
 {
 	meta:
 		description = "Detection for RELOADEXT, a Google Chrome extension malware."
 		author = "threatintel@volexity.com"
-		id = "6c6c8bee-2a13-5645-89ef-779f00264fd9"
+		id = "d4510cd3-db69-5f0a-9c4a-fafd35a6929a"
 		date = "2024-02-23"
 		modified = "2024-08-02"
 		reference = "TIB-20240227"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-08-02 StormBamboo/rules.yar#L4-L36"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "2b11f8fc5b6260ebf00bde83585cd7469709a4979ca579cdf065724bc15052fc"
+		logic_hash = "v1_sha256_2b11f8fc5b6260ebf00bde83585cd7469709a4979ca579cdf065724bc15052fc"
 		score = 75
 		quality = 80
 		tags = "STORMBAMBOO, FILE, MEMORY"
@@ -210055,23 +210111,20 @@ rule VOLEXITY_Apt_Malware_Any_Reloadext_Plugin : STORMBAMBOO FILE MEMORY
 		$code3 = "0x400*0x400"
 
 	condition:
-		all of ($man*) or (#code1>8 and #code2>=2 and #code3>=2)
+		all of ( $man* ) or ( #code1 > 8 and #code2 >= 2 and #code3 >= 2 )
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Macos_Reloadext_Installer : STORMBAMBOO FILE MEMORY
 {
 	meta:
 		description = "Detect the RELOADEXT installer."
 		author = "threatintel@volexity.com"
-		id = "c65ea2b5-ab98-5693-92ea-05c0f1ea1e5b"
+		id = "7499b1fc-3cfd-5844-84e7-8a4782e908b9"
 		date = "2024-02-23"
 		modified = "2024-08-02"
 		reference = "TIB-20240227"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-08-02 StormBamboo/rules.yar#L37-L62"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "8688796839202d95ded15e10262a7a7c7cbbae4a332b60305402e5984005d452"
+		logic_hash = "v1_sha256_8688796839202d95ded15e10262a7a7c7cbbae4a332b60305402e5984005d452"
 		score = 75
 		quality = 80
 		tags = "STORMBAMBOO, FILE, MEMORY"
@@ -210093,21 +210146,18 @@ rule VOLEXITY_Apt_Malware_Macos_Reloadext_Installer : STORMBAMBOO FILE MEMORY
 	condition:
 		3 of them
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Any_Macma_A : STORMBAMBOO FILE MEMORY
 {
 	meta:
 		description = "Detects variants of the MACMA backdoor, variants of MACMA have been discovered for Windows, macOS and android."
 		author = "threatintel@volexity.com"
-		id = "6ab45af1-41e5-53fc-9297-e2bc07ebf797"
+		id = "81825776-9712-5cbb-96f2-b69eb72fe729"
 		date = "2021-11-12"
 		modified = "2024-08-02"
 		reference = "https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-08-02 StormBamboo/rules.yar#L64-L112"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "7ebaff9fddf6491d6b1ed9ab14c1b87dc8df850536e55aa723d625a593b33ed7"
+		logic_hash = "v1_sha256_7ebaff9fddf6491d6b1ed9ab14c1b87dc8df850536e55aa723d625a593b33ed7"
 		score = 75
 		quality = 53
 		tags = "STORMBAMBOO, FILE, MEMORY"
@@ -210148,23 +210198,20 @@ rule VOLEXITY_Apt_Malware_Any_Macma_A : STORMBAMBOO FILE MEMORY
 		$s14 = "./param.ini" fullword ascii
 
 	condition:
-		any of ($magic*) or 7 of ($s*)
+		any of ( $magic* ) or 7 of ( $s* )
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Macos_Gimmick : STORMBAMBOO FILE MEMORY
 {
 	meta:
 		description = "Detects the macOS port of the GIMMICK malware."
 		author = "threatintel@volexity.com"
-		id = "3d485788-4aab-511b-a49e-5dc09d1950a9"
+		id = "c23b240c-10fc-5f83-b6cb-641afc60aa2a"
 		date = "2021-10-18"
 		modified = "2024-08-02"
 		reference = "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-08-02 StormBamboo/rules.yar#L113-L171"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "00fba9df2212874a45d44b3d098a7b76c97fcd53ff083c76b784d2b510a4a467"
+		logic_hash = "v1_sha256_00fba9df2212874a45d44b3d098a7b76c97fcd53ff083c76b784d2b510a4a467"
 		score = 75
 		quality = 78
 		tags = "STORMBAMBOO, FILE, MEMORY"
@@ -210209,23 +210256,20 @@ rule VOLEXITY_Apt_Malware_Macos_Gimmick : STORMBAMBOO FILE MEMORY
 		$cmd17 = "bash callback...." ascii wide
 
 	condition:
-		$s1 or 5 of ($json*) or 3 of ($msg*) or 9 of ($cmd*)
+		$s1 or 5 of ( $json* ) or 3 of ( $msg* ) or 9 of ( $cmd* )
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes : STORMBAMBOO FILE
 {
 	meta:
 		description = "Detects DUSTPAN malware using API hashes used to resolve functions at runtime."
 		author = "threatintel@volexity.com"
-		id = "ed275da4-cd95-5fa3-a568-e610fb405bb3"
+		id = "e049abc5-d637-53e0-9f3a-35bb884ef123"
 		date = "2023-08-17"
 		modified = "2024-08-02"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-08-02 StormBamboo/rules.yar#L173-L210"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "3edb66ade428c451c18aa152244f869f9f8c10e62ed942bf722b4d1cf1893e93"
+		logic_hash = "v1_sha256_3edb66ade428c451c18aa152244f869f9f8c10e62ed942bf722b4d1cf1893e93"
 		score = 75
 		quality = 80
 		tags = "STORMBAMBOO, FILE"
@@ -210253,23 +210297,20 @@ rule VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes : STORMBAMBOO FILE
 		$magic = "SMHM"
 
 	condition:
-		6 of ($h*) and $magic
+		6 of ( $h* ) and $magic
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Win_Pocostick_Jul23 : STORMBAMBOO FILE MEMORY
 {
 	meta:
 		description = "Detects the July 2023 POCOSTICK variant. These strings are only visible in memory after several rounds of shellcode decryption."
 		author = "threatintel@volexity.com"
-		id = "9632a7fc-06da-58b4-b95c-b46aeb9dd41d"
+		id = "bfa9c805-983a-5b2c-805e-532e05e831af"
 		date = "2023-07-24"
 		modified = "2024-08-02"
 		reference = "TIB-20231221"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-08-02 StormBamboo/rules.yar#L212-L241"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "19487db733c7f793be2a1287df32a165e46f6af0e940b13b389f4d675b5100c4"
+		logic_hash = "v1_sha256_19487db733c7f793be2a1287df32a165e46f6af0e940b13b389f4d675b5100c4"
 		score = 75
 		quality = 80
 		tags = "STORMBAMBOO, FILE, MEMORY"
@@ -210295,21 +210336,18 @@ rule VOLEXITY_Apt_Malware_Win_Pocostick_Jul23 : STORMBAMBOO FILE MEMORY
 	condition:
 		6 of them
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader : STORMBAMBOO FILE MEMORY
 {
 	meta:
 		description = "Detects Python script used by KPlayer to update, modified by attackers to download a malicious payload."
 		author = "threatintel@volexity.com"
-		id = "446d2eef-c60a-50ed-9ff1-df86b6210dff"
+		id = "9f8d5318-75e2-57c3-bf8e-9a3391e09750"
 		date = "2023-07-21"
 		modified = "2024-08-02"
 		reference = "TIB-20231221"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-08-02 StormBamboo/rules.yar#L243-L279"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "bb3a70dad28181534e27abbbd618165652c137264bfd3726ae4480c642493a3b"
+		logic_hash = "v1_sha256_bb3a70dad28181534e27abbbd618165652c137264bfd3726ae4480c642493a3b"
 		score = 75
 		quality = 80
 		tags = "STORMBAMBOO, FILE, MEMORY"
@@ -210335,24 +210373,24 @@ rule VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader : STORMBAMBOO FILE MEMORY
 		$path_1 = "C:\\\\ProgramData\\\\Digiarty\\\\mediainfo.exe"
 
 	condition:
-		3 of ($s_*) or any of ($url_*) or $path_1
+		3 of ( $s_* ) or any of ( $url_* ) or $path_1
 }
-import "hash"
 import "pe"
+import "hash"
 
 rule VOLEXITY_Apt_Malware_Win_Pocostick_B : STORMBAMBOO FILE
 {
 	meta:
 		description = "Detects the POCOSTICK family, variant B."
 		author = "threatintel@volexity.com"
-		id = "2a8a455d-6b5c-53a7-aa5e-91d29efd3aa8"
+		id = "76f88bda-c2ea-55bd-a9f8-58de96810a37"
 		date = "2020-07-08"
 		modified = "2024-08-02"
 		reference = "TIB-20231221"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-08-02 StormBamboo/rules.yar#L281-L312"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "1e81fb62cb57a3231642f66fee3e10d28a7c81637e4d6a03515f5b95654da585"
-		logic_hash = "a51e836425ec407706c7b2a4c21cc12398620c7dae6c9504a855f99e4b4d6ab2"
+		logic_hash = "v1_sha256_a51e836425ec407706c7b2a4c21cc12398620c7dae6c9504a855f99e4b4d6ab2"
 		score = 75
 		quality = 80
 		tags = "STORMBAMBOO, FILE"
@@ -210371,24 +210409,21 @@ rule VOLEXITY_Apt_Malware_Win_Pocostick_B : STORMBAMBOO FILE
 		$a4 = "AVCWinThread@@" ascii
 
 	condition:
-		all of ($a*) or for any resource in pe.resources : (hash.sha256(resource.offset,resource.length)=="b098afd3657b956edbace77499e5e20414ab595a17ffc437b9dadc791eff1cfa" or hash.sha256(resource.offset,resource.length)=="2e53e960d45d657d8ba9929f6c8b34e90b2ae15b879768099474678dd1864f3b")
+		all of ( $a* ) or for any resource in pe.resources : ( hash.sha256 ( resource.offset , resource.length ) == "b098afd3657b956edbace77499e5e20414ab595a17ffc437b9dadc791eff1cfa" or hash.sha256 ( resource.offset , resource.length ) == "2e53e960d45d657d8ba9929f6c8b34e90b2ae15b879768099474678dd1864f3b" )
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Elf_Catchdns_Aug20_Memory : DRIFTINGBAMBOO FILE MEMORY
 {
 	meta:
 		description = "Looks for strings from CatchDNS component used to intercept and modify DNS responses, and likely also intercept/monitor http. This rule would only match against memory in the example file analyzed by Volexity."
 		author = "threatintel@volexity.com"
-		id = "95306735-cdae-5407-ad49-d465d245378d"
+		id = "2019ed83-c61d-5100-891e-4b67866080e8"
 		date = "2020-08-20"
 		modified = "2024-08-02"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-08-02 StormBamboo/rules.yar#L313-L387"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "4f3d35f4f8b810362cbd4c59bfe5a961e559fe5713c9478294ccb3af2d306515"
-		logic_hash = "a7d677d7eecf388df7e7c2343fd3e46188594473c01075bf8a0b54292a51db94"
+		logic_hash = "v1_sha256_a7d677d7eecf388df7e7c2343fd3e46188594473c01075bf8a0b54292a51db94"
 		score = 75
 		quality = 55
 		tags = "DRIFTINGBAMBOO, FILE, MEMORY"
@@ -210447,20 +210482,20 @@ rule VOLEXITY_Apt_Malware_Elf_Catchdns_Aug20_Memory : DRIFTINGBAMBOO FILE MEMORY
 		$cpp2 = "src/test_catch_dns.cpp"
 
 	condition:
-		9 of ($os*) or 3 of ($msg*) or all of ($conf*) or all of ($netw*) or $apache or all of ($cpp*)
+		9 of ( $os* ) or 3 of ( $msg* ) or all of ( $conf* ) or all of ( $netw* ) or $apache or all of ( $cpp* )
 }
 rule VOLEXITY_Apt_Webshell_Pl_Complyshell : UTA0178 FILE MEMORY
 {
 	meta:
 		description = "Detection for the COMPLYSHELL webshell."
 		author = "threatintel@volexity.com"
-		id = "6b44b5bc-a75f-573c-b9c3-562b7874e408"
+		id = "f1fa6923-b489-5fc9-891e-1518b682c78c"
 		date = "2023-12-13"
 		modified = "2024-01-09"
 		reference = "TIB-20231215"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L1-L22"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "ff46691f1add20cff30fe996e2fb199ce42408e86d5642a8a43c430f2245b1f5"
+		logic_hash = "v1_sha256_ff46691f1add20cff30fe996e2fb199ce42408e86d5642a8a43c430f2245b1f5"
 		score = 75
 		quality = 80
 		tags = "UTA0178, FILE, MEMORY"
@@ -210483,13 +210518,13 @@ rule VOLEXITY_Apt_Webshell_Aspx_Glasstoken : UTA0178 FILE MEMORY
 	meta:
 		description = "Detection for a custom webshell seen on external facing server. The webshell contains two functions, the first is to act as a Tunnel, using code borrowed from reGeorg, the second is custom code to execute arbitrary .NET code."
 		author = "threatintel@volexity.com"
-		id = "5d96294c-aa61-5752-ab06-d5b27f6ac3a1"
+		id = "4b865ecd-1e86-55ec-b768-9e5cc0cdf29b"
 		date = "2023-12-12"
 		modified = "2024-01-09"
 		reference = "TIB-20231215"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L24-L49"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "34844dc2ba4b18b25dcb5b14b7b80ec655595c9638600a0f2a6367610c542dd1"
+		logic_hash = "v1_sha256_34844dc2ba4b18b25dcb5b14b7b80ec655595c9638600a0f2a6367610c542dd1"
 		score = 75
 		quality = 80
 		tags = "UTA0178, FILE, MEMORY"
@@ -210506,21 +210541,21 @@ rule VOLEXITY_Apt_Webshell_Aspx_Glasstoken : UTA0178 FILE MEMORY
 		$re = /Assembly\.Load\(errors\)\.CreateInstance\("[a-z0-9A-Z]{4,12}"\).GetHashCode\(\);/
 
 	condition:
-		for any i in (0..#s1) : ($re in (@s1[i]..@s1[i]+512))
+		for any i in ( 0 .. #s1 ) : ( $re in ( @s1 [ i ] .. @s1 [ i ] + 512 ) )
 }
 rule VOLEXITY_Webshell_Aspx_Regeorg : FILE MEMORY
 {
 	meta:
 		description = "Detects the reGeorg webshell based on common strings in the webshell. May also detect other webshells which borrow code from ReGeorg."
 		author = "threatintel@volexity.com"
-		id = "02365a30-769e-5c47-8d36-a79608ffd121"
+		id = "91c0d4ad-77b8-5c5e-a36b-2dc885035858"
 		date = "2018-08-29"
 		modified = "2024-01-09"
 		reference = "TIB-20231215"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L51-L83"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "9d901f1a494ffa98d967ee6ee30a46402c12a807ce425d5f51252eb69941d988"
-		logic_hash = "4fed023e85a32052917f6db1e2e155c91586538938c03acc59f200a8264888ca"
+		logic_hash = "v1_sha256_4fed023e85a32052917f6db1e2e155c91586538938c03acc59f200a8264888ca"
 		score = 75
 		quality = 80
 		tags = "FILE, MEMORY"
@@ -210541,20 +210576,20 @@ rule VOLEXITY_Webshell_Aspx_Regeorg : FILE MEMORY
 		$proxy_b3 = "Response.AddHeader(\"Content-Length\", rbody.Length.ToString());" ascii
 
 	condition:
-		any of ($a*) or $proxy1 or all of ($proxy_b*)
+		any of ( $a* ) or $proxy1 or all of ( $proxy_b* )
 }
 rule VOLEXITY_Hacktool_Py_Pysoxy : FILE MEMORY
 {
 	meta:
 		description = "SOCKS5 proxy tool used to relay connections."
 		author = "threatintel@volexity.com"
-		id = "88094b55-784d-5245-9c40-b1eebf0e6e72"
+		id = "35d798ba-7c95-538c-a489-e7cf9f7bba2c"
 		date = "2024-01-09"
 		modified = "2024-01-09"
 		reference = "TIB-20240109"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L85-L111"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "f73e9d3c2f64c013218469209f3b69fc868efafc151a7de979dde089bfdb24b2"
+		logic_hash = "v1_sha256_f73e9d3c2f64c013218469209f3b69fc868efafc151a7de979dde089bfdb24b2"
 		score = 75
 		quality = 80
 		tags = "FILE, MEMORY"
@@ -210576,21 +210611,18 @@ rule VOLEXITY_Hacktool_Py_Pysoxy : FILE MEMORY
 	condition:
 		all of them
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Vbs_Basicstar : CHARMINGCYPRESS FILE MEMORY
 {
 	meta:
 		description = "VBS backdoor which bares architectural similarity to the POWERSTAR malware family."
 		author = "threatintel@volexity.com"
-		id = "e790defe-2bd5-5629-8420-ce8091483589"
+		id = "ae5cde9c-2f8e-546a-a277-153b49860ae3"
 		date = "2024-01-04"
 		modified = "2024-01-11"
 		reference = "TIB-20240111"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-02-13 CharmingCypress/rules.yar#L64-L92"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "977bb42553bb6585c8d0e1e89675644720ca9abf294eccd797e20d4bca516810"
+		logic_hash = "v1_sha256_977bb42553bb6585c8d0e1e89675644720ca9abf294eccd797e20d4bca516810"
 		score = 75
 		quality = 80
 		tags = "CHARMINGCYPRESS, FILE, MEMORY"
@@ -210611,23 +210643,20 @@ rule VOLEXITY_Apt_Malware_Vbs_Basicstar : CHARMINGCYPRESS FILE MEMORY
 		$magic = "cmd /C start /MIN curl --ssl-no-revoke -s -d " ascii wide
 
 	condition:
-		3 of ($s*) or $magic
+		3 of ( $s* ) or $magic
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Ps1_Powerless_B : CHARMINGCYPRESS FILE MEMORY
 {
 	meta:
 		description = "Detects POWERLESS malware."
 		author = "threatintel@volexity.com"
-		id = "74dd8412-c099-5ecb-af97-c22fede14252"
+		id = "6020de25-2fea-57b7-a293-183f216f8ec4"
 		date = "2023-10-25"
 		modified = "2023-11-03"
 		reference = "TIB-20231027"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-02-13 CharmingCypress/rules.yar#L93-L150"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "a95fe2c8d09d66e07a999eef3a5666cc622bbc063d747626c48b26cfecf35849"
+		logic_hash = "v1_sha256_a95fe2c8d09d66e07a999eef3a5666cc622bbc063d747626c48b26cfecf35849"
 		score = 75
 		quality = 78
 		tags = "CHARMINGCYPRESS, FILE, MEMORY"
@@ -210677,23 +210706,20 @@ rule VOLEXITY_Apt_Malware_Ps1_Powerless_B : CHARMINGCYPRESS FILE MEMORY
 		$s_19 = "Update-Conf -interval $inter -url $url -next_url $next -conf_path $conf_path -key $config_key"
 
 	condition:
-		3 of ($fun_*) or any of ($s_*)
+		3 of ( $fun_* ) or any of ( $s_* )
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Macos_Vpnclient_Cc_Oct23 : CHARMINGCYPRESS FILE MEMORY
 {
 	meta:
 		description = "Detection for fake macOS VPN client used by CharmingCypress."
 		author = "threatintel@volexity.com"
-		id = "e0957936-dc6e-5de6-bb23-d0ef61655029"
+		id = "1809d749-4b45-5195-990c-da025b1edea2"
 		date = "2023-10-17"
 		modified = "2023-10-27"
 		reference = "TIB-20231027"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-02-13 CharmingCypress/rules.yar#L236-L261"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "da5e9be752648b072a9aaeed884b8e1729a14841e33ed6633a0aaae1f11bd139"
+		logic_hash = "v1_sha256_da5e9be752648b072a9aaeed884b8e1729a14841e33ed6633a0aaae1f11bd139"
 		score = 75
 		quality = 80
 		tags = "CHARMINGCYPRESS, FILE, MEMORY"
@@ -210713,23 +210739,20 @@ rule VOLEXITY_Apt_Malware_Macos_Vpnclient_Cc_Oct23 : CHARMINGCYPRESS FILE MEMORY
 		$s4 = "Error in importing the File." ascii
 
 	condition:
-		2 of ($s*)
+		2 of ( $s* )
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Charmingcypress_Openvpn_Configuration : CHARMINGCYPRESS FILE
 {
 	meta:
 		description = "Detection for a .ovpn file used in a malicious VPN client on victim machines by CharmingCypress."
 		author = "threatintel@volexity.com"
-		id = "f39b2d7c-f0c5-5623-a114-02ba32469e59"
+		id = "147b7497-bde0-5f52-8a21-0f991883da3c"
 		date = "2023-10-17"
 		modified = "2023-10-27"
 		reference = "TIB-20231027"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-02-13 CharmingCypress/rules.yar#L262-L286"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "f4c5f13ac75504b14def9c37d3a41c6eea4c45845d4b54c50030b1f00691e4bf"
+		logic_hash = "v1_sha256_f4c5f13ac75504b14def9c37d3a41c6eea4c45845d4b54c50030b1f00691e4bf"
 		score = 75
 		quality = 80
 		tags = "CHARMINGCYPRESS, FILE"
@@ -210750,21 +210773,18 @@ rule VOLEXITY_Apt_Malware_Charmingcypress_Openvpn_Configuration : CHARMINGCYPRES
 	condition:
 		all of them
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Delivery_Win_Charming_Openvpn_Client : CHARMINGCYPRESS FILE
 {
 	meta:
 		description = "Detects a fake OpenVPN client developed by CharmingCypress."
 		author = "threatintel@volexity.com"
-		id = "b69fdd72-4a55-5e83-b754-401fe9339007"
+		id = "961fa733-eb33-5fb7-a2c5-6babcd148cda"
 		date = "2023-10-17"
 		modified = "2023-10-27"
 		reference = "TIB-20231027"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-02-13 CharmingCypress/rules.yar#L287-L310"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "02596a62cb1ba17ecabef0ae93f434e4774b00422a6da2106a2bc4c59d2f8077"
+		logic_hash = "v1_sha256_02596a62cb1ba17ecabef0ae93f434e4774b00422a6da2106a2bc4c59d2f8077"
 		score = 75
 		quality = 80
 		tags = "CHARMINGCYPRESS, FILE"
@@ -210782,23 +210802,20 @@ rule VOLEXITY_Apt_Delivery_Win_Charming_Openvpn_Client : CHARMINGCYPRESS FILE
 		$s3 = "ultralight@@"
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
-import "hash"
-import "pe"
-
 rule VOLEXITY_Apt_Malware_Ps1_Powerstar_Generic : CHARMINGCYPRESS FILE MEMORY
 {
 	meta:
 		description = "Detects POWERSTAR modules based on common HTTP functions used across modules."
 		author = "threatintel@volexity.com"
-		id = "71a3e99d-e1c8-5ac1-abbc-2ba5cba80799"
+		id = "9db4e4b3-df5b-5e49-a153-2d4bb1ea94ae"
 		date = "2023-06-02"
 		modified = "2023-06-28"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-02-13 CharmingCypress/rules.yar#L311-L335"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "4da02190ffd16304eccbc0d12dfcc5637a6b785af0e3dc3dfcafcfe114597eb2"
+		logic_hash = "v1_sha256_4da02190ffd16304eccbc0d12dfcc5637a6b785af0e3dc3dfcafcfe114597eb2"
 		score = 75
 		quality = 80
 		tags = "CHARMINGCYPRESS, FILE, MEMORY"
@@ -210816,20 +210833,20 @@ rule VOLEXITY_Apt_Malware_Ps1_Powerstar_Generic : CHARMINGCYPRESS FILE MEMORY
 		$json4 = "{\"num\":\"" ascii wide
 
 	condition:
-		all of ($http*) or all of ($json*)
+		all of ( $http* ) or all of ( $json* )
 }
 rule VOLEXITY_Apt_Malware_Win_Deepdata_Module : BRAZENBAMBOO FILE MEMORY
 {
 	meta:
 		description = "Detects modules used by DEEPDATA based on the required export names used by those modules."
 		author = "threatintel@volexity.com"
-		id = "1287f5dd-9229-57ce-a91a-73d61041df80"
+		id = "20d4cb5f-4b15-54ec-a7d1-feb87f25994f"
 		date = "2024-07-30"
 		modified = "2024-11-14"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-11-15 BrazenBamboo/rules.yar#L1-L25"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "d36f34343826daf7f7368118c7127c7181a54c99a01803016c9a6965abb309cb"
+		logic_hash = "v1_sha256_d36f34343826daf7f7368118c7127c7181a54c99a01803016c9a6965abb309cb"
 		score = 75
 		quality = 80
 		tags = "BRAZENBAMBOO, FILE, MEMORY"
@@ -210856,13 +210873,13 @@ rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_Core : BRAZENBAMBOO
 	meta:
 		description = "Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc."
 		author = "threatintel@volexity.com"
-		id = "44f8d7a4-7f48-5960-91a7-baf475f7d291"
+		id = "4398b057-b3cf-50f9-ac5e-5c445a60e761"
 		date = "2024-02-15"
 		modified = "2024-07-03"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-11-15 BrazenBamboo/rules.yar#L247-L290"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "f0189c0a84c53e365130e9683f2f2b2f73c14412d8e4d0251a4780d0e80162d8"
+		logic_hash = "v1_sha256_f0189c0a84c53e365130e9683f2f2b2f73c14412d8e4d0251a4780d0e80162d8"
 		score = 75
 		quality = 78
 		tags = "BRAZENBAMBOO, FILE, MEMORY"
@@ -210899,20 +210916,20 @@ rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_Core : BRAZENBAMBOO
 		$pdb3 = "D:\\tmpWork\\"
 
 	condition:
-		1 of ($pdb*) or 5 of ($s*)
+		1 of ( $pdb* ) or 5 of ( $s* )
 }
 rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_C2_Strings : BRAZENBAMBOO FILE MEMORY
 {
 	meta:
 		description = "Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc."
 		author = "threatintel@volexity.com"
-		id = "a0af8fb7-13a3-54e8-8569-e8622fa80d89"
+		id = "5cc2f0c8-d00e-5d45-b1cf-b913075b072c"
 		date = "2024-02-15"
 		modified = "2024-07-03"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-11-15 BrazenBamboo/rules.yar#L291-L339"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "eeaaf6e16d4854a2279bd62596f75cb8b8ec1b05f3b050f5dac97254704b9005"
+		logic_hash = "v1_sha256_eeaaf6e16d4854a2279bd62596f75cb8b8ec1b05f3b050f5dac97254704b9005"
 		score = 75
 		quality = 78
 		tags = "BRAZENBAMBOO, FILE, MEMORY"
@@ -210955,20 +210972,20 @@ rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_C2_Strings : BRAZENB
 		$ctrl17 = "CTRL_TEST_VPDN_ACCOUNT"
 
 	condition:
-		3 of ($s*) or 5 of ($ctrl*)
+		3 of ( $s* ) or 5 of ( $ctrl* )
 }
 rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Modules : UTA0137 FILE MEMORY
 {
 	meta:
 		description = "Detects DISGOMOJI modules based on strings in the ELF."
 		author = "threatintel@volexity.com"
-		id = "b9e4ecdc-9b02-546f-9b79-947cb6b1f99a"
+		id = "dab704e8-646e-54f8-9936-bf2e133e0d1e"
 		date = "2024-02-22"
 		modified = "2024-02-27"
 		reference = "TIB-20240228"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L1-L23"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "7880288e3230b688b780bdfbac2b0761fd7831b7df233672c2242c21a86e1297"
+		logic_hash = "v1_sha256_7880288e3230b688b780bdfbac2b0761fd7831b7df233672c2242c21a86e1297"
 		score = 75
 		quality = 80
 		tags = "UTA0137, FILE, MEMORY"
@@ -210992,13 +211009,13 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Loader : UTA0137 FILE MEMORY
 	meta:
 		description = "Detects the DISGOMOJI loader using strings in the ELF."
 		author = "threatintel@volexity.com"
-		id = "6d7848db-f1a5-5ccc-977a-7597b966a31c"
+		id = "b3c480d3-f43e-53d0-b0ba-e4b479b4f0f8"
 		date = "2024-02-22"
 		modified = "2024-02-27"
 		reference = "TIB-20240228"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L25-L46"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "d9be4846bab5fffcfd60eaec377443819404f30ec088905c2ee26bd3b7525832"
+		logic_hash = "v1_sha256_d9be4846bab5fffcfd60eaec377443819404f30ec088905c2ee26bd3b7525832"
 		score = 75
 		quality = 80
 		tags = "UTA0137, FILE, MEMORY"
@@ -211021,13 +211038,13 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Debug_String : UTA0137 FILE MEMORY
 	meta:
 		description = "Detects the DISGOMOJI malware using strings in the ELF."
 		author = "threatintel@volexity.com"
-		id = "a1bbf285-a8ad-5877-ae2a-a7dd5e61cf46"
+		id = "05775d14-14ee-576d-ab0a-554a29a3b242"
 		date = "2024-02-22"
 		modified = "2024-02-27"
 		reference = "TIB-20240228"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L48-L69"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "030d8044b5d17ba8786ff7a4d6ac0282bc0b0e193ad89a3e84b5ba44505e5be5"
+		logic_hash = "v1_sha256_030d8044b5d17ba8786ff7a4d6ac0282bc0b0e193ad89a3e84b5ba44505e5be5"
 		score = 75
 		quality = 80
 		tags = "UTA0137, FILE, MEMORY"
@@ -211050,13 +211067,13 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_2 : UTA0137 FILE MEMORY
 	meta:
 		description = "Detects the DISGOMOJI malware using strings in the ELF."
 		author = "threatintel@volexity.com"
-		id = "609beb47-5e93-5f69-b89d-2cf62f20851a"
+		id = "b628e69e-3f7b-5f98-b681-74c844cb6362"
 		date = "2024-02-22"
 		modified = "2024-02-27"
 		reference = "TIB-20240228"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L71-L101"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "e03a774cca2946c1becdbd775ef465033dae089d578ea18a4f43fd7bdae9168e"
+		logic_hash = "v1_sha256_e03a774cca2946c1becdbd775ef465033dae089d578ea18a4f43fd7bdae9168e"
 		score = 75
 		quality = 80
 		tags = "UTA0137, FILE, MEMORY"
@@ -211088,13 +211105,13 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_1 : UTA0137 FILE MEMORY
 	meta:
 		description = "Detects the DISGOMOJI malware using strings in the ELF."
 		author = "threatintel@volexity.com"
-		id = "f6643e9a-ca41-57e0-9fce-571d340f1cfe"
+		id = "fbcdc4be-4632-5617-959e-0e7b98f53941"
 		date = "2024-02-22"
 		modified = "2024-02-27"
 		reference = "TIB-20240228"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L103-L129"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "dd3535079881ae9cfe25c129803668cb595be89b7f62eb82af19cc3839f92b6d"
+		logic_hash = "v1_sha256_dd3535079881ae9cfe25c129803668cb595be89b7f62eb82af19cc3839f92b6d"
 		score = 75
 		quality = 80
 		tags = "UTA0137, FILE, MEMORY"
@@ -211122,13 +211139,13 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Bogus_Strings : UTA0137 FILE
 	meta:
 		description = "Detects the DISGOMOJI malware using bogus strings introduced in the newer versions."
 		author = "threatintel@volexity.com"
-		id = "ecff8d3c-d4fe-5b6d-a227-6ff531cf8e2b"
+		id = "9857e276-2772-5013-91a2-ad8daefe46ab"
 		date = "2024-03-14"
 		modified = "2024-03-14"
 		reference = "TIB-20240318"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L131-L157"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "0d8a2b371ffb182e60a8cc0cc500d1a9f906718a55f23f35f6c12f7faabbe971"
+		logic_hash = "v1_sha256_0d8a2b371ffb182e60a8cc0cc500d1a9f906718a55f23f35f6c12f7faabbe971"
 		score = 75
 		quality = 80
 		tags = "UTA0137, FILE"
@@ -211156,13 +211173,13 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Uevent_Seqnum : UTA0137 FILE
 	meta:
 		description = "Detects a script deployed as part of DISGOMOJI malware chain."
 		author = "threatintel@volexity.com"
-		id = "9df61164-6a92-5042-ba4f-64dc7e998283"
+		id = "aa219abd-37d5-54d4-9572-1cefa55773ba"
 		date = "2024-03-07"
 		modified = "2024-03-14"
 		reference = "TIB-20240318"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L159-L185"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "e390e83d9fc15499c9f32ad47d1c526273105602bda7b3532720b0a3f6abc835"
+		logic_hash = "v1_sha256_e390e83d9fc15499c9f32ad47d1c526273105602bda7b3532720b0a3f6abc835"
 		score = 75
 		quality = 80
 		tags = "UTA0137, FILE"
@@ -211190,13 +211207,13 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf : UTA0137 FILE
 	meta:
 		description = "Detects a script deployed as part of DISGOMOJI malware chain."
 		author = "threatintel@volexity.com"
-		id = "b338b3cf-22ce-5767-bdea-503e883bc84b"
+		id = "09a01dfb-8e04-57f7-931e-9ffbcf79c533"
 		date = "2024-03-07"
 		modified = "2024-03-14"
 		reference = "TIB-20240318"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L187-L213"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "2a19d5cff7adc9b1b92538a5df4e3cadea694f925f65080f5093fc5425e840f4"
+		logic_hash = "v1_sha256_2a19d5cff7adc9b1b92538a5df4e3cadea694f925f65080f5093fc5425e840f4"
 		score = 75
 		quality = 80
 		tags = "UTA0137, FILE"
@@ -211224,13 +211241,13 @@ rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy_1 : FILE MEMORY
 	meta:
 		description = "Detects a opensource malware available on github using strings in the ELF. DISGOMOJI used by UTA0137 is based on this malware."
 		author = "threatintel@volexity.com"
-		id = "6816d264-4311-5e90-948b-2e27cdf0b720"
+		id = "1cddd3a1-ed3c-5395-9eab-acadefbbd578"
 		date = "2024-03-28"
 		modified = "2024-03-28"
 		reference = "TIB-20240229"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L215-L241"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "22b3e5109d0738552fbc310344b2651ab3297e324bc883d5332c1e8a7a1df29b"
+		logic_hash = "v1_sha256_22b3e5109d0738552fbc310344b2651ab3297e324bc883d5332c1e8a7a1df29b"
 		score = 75
 		quality = 80
 		tags = "FILE, MEMORY"
@@ -211257,13 +211274,13 @@ rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy : FILE MEMORY
 	meta:
 		description = "Detects a opensource malware available on github using strings in the ELF. DISGOMOJI used by UTA0137 is based on this malware."
 		author = "threatintel@volexity.com"
-		id = "1ddbf476-ba2d-5cbb-ad95-38e0ae8db71b"
+		id = "b44c6a24-f1ef-55a3-8adc-acd5ad60d695"
 		date = "2024-02-22"
 		modified = "2024-03-28"
 		reference = "https://github.com/bmdyy/discord-c2"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L243-L265"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "38b860a43b9937351f74b01983888f18ad101cbe66560feb7455d46b713eba0f"
+		logic_hash = "v1_sha256_38b860a43b9937351f74b01983888f18ad101cbe66560feb7455d46b713eba0f"
 		score = 75
 		quality = 80
 		tags = "FILE, MEMORY"
@@ -211286,14 +211303,14 @@ rule VOLEXITY_Webshell_Aspx_Simpleseesharp : WEBSHELL UNCLASSIFIED FILE
 	meta:
 		description = "A simple ASPX Webshell that allows an attacker to write further files to disk."
 		author = "threatintel@volexity.com"
-		id = "469fdf5c-e09e-5d44-a2e6-0864dcd0e18a"
+		id = "e29deb0d-6f21-5b59-8da6-aa128d501a83"
 		date = "2021-03-01"
 		modified = "2021-09-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L1-L19"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2"
-		logic_hash = "6f62249a68bae94e5cbdb4319ea5cde9dc071ec7a4760df3aafe78bc1e072c30"
+		logic_hash = "v1_sha256_6f62249a68bae94e5cbdb4319ea5cde9dc071ec7a4760df3aafe78bc1e072c30"
 		score = 75
 		quality = 80
 		tags = "WEBSHELL, UNCLASSIFIED, FILE"
@@ -211304,21 +211321,21 @@ rule VOLEXITY_Webshell_Aspx_Simpleseesharp : WEBSHELL UNCLASSIFIED FILE
 		$body = "<% HttpPostedFile thisFile = Request.Files[0];thisFile.SaveAs(Path.Combine"
 
 	condition:
-		$header at 0 and $body and filesize <1KB
+		$header at 0 and $body and filesize < 1KB
 }
 rule VOLEXITY_Webshell_Aspx_Regeorgtunnel : WEBSHELL COMMODITY
 {
 	meta:
 		description = "variation on reGeorgtunnel"
 		author = "threatintel@volexity.com"
-		id = "b8aa27c9-a28a-5051-8f81-1184f28842ed"
+		id = "4797c93a-fd9a-5836-9d63-b7688792530a"
 		date = "2021-03-01"
 		modified = "2021-09-01"
 		reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L21-L43"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928"
-		logic_hash = "ea3d0532cb609682922469e8272dc8061efca3b3ae27df738ef2646e30404c6f"
+		logic_hash = "v1_sha256_ea3d0532cb609682922469e8272dc8061efca3b3ae27df738ef2646e30404c6f"
 		score = 75
 		quality = 80
 		tags = "WEBSHELL, COMMODITY"
@@ -211334,21 +211351,21 @@ rule VOLEXITY_Webshell_Aspx_Regeorgtunnel : WEBSHELL COMMODITY
 		$t5 = "IPAddress ip;"
 
 	condition:
-		all of ($s*) or all of ($t*)
+		all of ( $s* ) or all of ( $t* )
 }
 rule VOLEXITY_Webshell_Aspx_Sportsball : WEBSHELL
 {
 	meta:
 		description = "The SPORTSBALL webshell allows attackers to upload files or execute commands on the system."
 		author = "threatintel@volexity.com"
-		id = "d8cf1eb7-c08b-5c3c-b7d8-135b15418a7d"
+		id = "8890d5eb-1b97-5f71-9d10-3ff61eef614a"
 		date = "2021-03-01"
 		modified = "2021-09-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L45-L68"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
-		logic_hash = "4f90d727db91a93f53d08d2134f57bd03e7e2367aec3d78d275cfd192d7fb928"
+		logic_hash = "v1_sha256_4f90d727db91a93f53d08d2134f57bd03e7e2367aec3d78d275cfd192d7fb928"
 		score = 75
 		quality = 80
 		tags = "WEBSHELL"
@@ -211365,23 +211382,21 @@ rule VOLEXITY_Webshell_Aspx_Sportsball : WEBSHELL
 		$var6 = "<input type=\"submit\" value=\"Upload\" />"
 
 	condition:
-		any of ($uniq*) or all of ($var*)
+		any of ( $uniq* ) or all of ( $var* )
 }
-import "pe"
-
 rule VOLEXITY_Apt_Win_Flipflop_Ldr : APT29
 {
 	meta:
 		description = "A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload."
 		author = "threatintel@volexity.com"
-		id = "58696a6f-55a9-5212-9372-a539cc327e6b"
+		id = "1eeb08e3-b762-5b27-ac85-8c45142f3710"
 		date = "2021-05-25"
 		modified = "2021-09-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L3-L19"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330"
-		logic_hash = "a79d2b0700ae14f7a2af23c8f7df3df3564402b1137478008ccabefea0f543ad"
+		logic_hash = "v1_sha256_a79d2b0700ae14f7a2af23c8f7df3df3564402b1137478008ccabefea0f543ad"
 		score = 75
 		quality = 80
 		tags = "APT29"
@@ -211393,23 +211408,21 @@ rule VOLEXITY_Apt_Win_Flipflop_Ldr : APT29
 		$s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0."
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
-import "pe"
-
 rule VOLEXITY_Trojan_Win_Cobaltstrike : COMMODITY
 {
 	meta:
 		description = "The CobaltStrike malware family."
 		author = "threatintel@volexity.com"
-		id = "113ba304-261f-5c59-bc56-57515c239b6d"
+		id = "ac1fd8f3-afdd-53ce-b442-344ba138d479"
 		date = "2021-05-25"
 		modified = "2021-09-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L21-L41"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
-		logic_hash = "1e8a68050ff25f77e903af2e0a85579be1af77c64684e42e8f357eee4ae59377"
+		logic_hash = "v1_sha256_1e8a68050ff25f77e903af2e0a85579be1af77c64684e42e8f357eee4ae59377"
 		score = 75
 		quality = 80
 		tags = "COMMODITY"
@@ -211434,14 +211447,14 @@ rule VOLEXITY_Apt_Win_Freshfire : APT29
 	meta:
 		description = "The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server."
 		author = "threatintel@volexity.com"
-		id = "050b8e61-139a-5ff5-998a-7de67c9975bf"
+		id = "1ece0d8f-cd02-5a2f-ae1c-f0ceb70a3242"
 		date = "2021-05-27"
 		modified = "2021-09-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L43-L67"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c"
-		logic_hash = "69cd73f5812ba955c1352fb1552774d5cf49019d6b65a304fd1e33f852e678ba"
+		logic_hash = "v1_sha256_69cd73f5812ba955c1352fb1552774d5cf49019d6b65a304fd1e33f852e678ba"
 		score = 75
 		quality = 80
 		tags = "APT29"
@@ -211455,20 +211468,20 @@ rule VOLEXITY_Apt_Win_Freshfire : APT29
 		$path3 = "root/data/%d/%s.json"
 
 	condition:
-		(pe.number_of_exports==1 and pe.exports("WaitPrompt")) or any of ($uniq*) or 2 of ($path*)
+		(pe.number_of_exports == 1 and pe.exports ( "WaitPrompt" ) ) or any of ( $uniq* ) or 2 of ( $path* )
 }
 rule VOLEXITY_Apt_Win_Bluelight_B : INKYSQUID
 {
 	meta:
 		description = "North Korean origin malware which uses a custom Google App for c2 communications."
 		author = "threatintel@volexity.com"
-		id = "8dc51d15-d0ca-5307-ac00-5b20e4900655"
+		id = "41bd1fb3-282e-56e8-956e-e833b214d4e7"
 		date = "2021-06-21"
 		modified = "2021-09-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L1-L100"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "a6e83ca2ae15f1a7819f065449f84166da401739d091565605d62ebba3d47a50"
+		logic_hash = "v1_sha256_a6e83ca2ae15f1a7819f065449f84166da401739d091565605d62ebba3d47a50"
 		score = 75
 		quality = 55
 		tags = "INKYSQUID"
@@ -211553,20 +211566,20 @@ rule VOLEXITY_Apt_Win_Bluelight_B : INKYSQUID
 		$keylogger_component29 = "ALT+"
 
 	condition:
-		$magic or ( all of ($f*) and 5 of ($keylogger_component*)) or 24 of ($chrome*) or 4 of ($msg*) or 27 of ($keylogger_component*)
+		$magic or ( all of ( $f* ) and 5 of ( $keylogger_component* ) ) or 24 of ( $chrome* ) or 4 of ( $msg* ) or 27 of ( $keylogger_component* )
 }
 rule VOLEXITY_Apt_Win_Bluelight : INKYSQUID
 {
 	meta:
 		description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications."
 		author = "threatintel@volexity.com"
-		id = "3ec2d44c-4c08-514d-a839-acef3f53f7dc"
+		id = "39cae893-04e6-5fe9-96c6-b70fbcbb8201"
 		date = "2021-04-23"
 		modified = "2021-09-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L102-L132"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "52589348f42aadbe453ad8a40ac36b58fcc9e07cd298486f09b6f793823d8cc7"
+		logic_hash = "v1_sha256_52589348f42aadbe453ad8a40ac36b58fcc9e07cd298486f09b6f793823d8cc7"
 		score = 75
 		quality = 80
 		tags = "INKYSQUID"
@@ -211591,22 +211604,20 @@ rule VOLEXITY_Apt_Win_Bluelight : INKYSQUID
 		$msg15 = "\"VM\":\"" fullword
 
 	condition:
-		any of ($pdb*) or all of ($msg*)
+		any of ( $pdb* ) or all of ( $msg* )
 }
-import "pe"
-
 rule VOLEXITY_Trojan_Win_Backwash_Cpp : XEGROUP
 {
 	meta:
 		description = "CPP loader for the Backwash malware."
 		author = "threatintel@volexity.com"
-		id = "8a1c4ff1-1827-5e6f-b838-664d8c3be840"
+		id = "e76c5bbf-b35a-5ab9-91cb-ce9f9f7d86b6"
 		date = "2021-11-17"
 		modified = "2021-12-07"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-12-06 - XEGroup/indicators/yara.yar#L3-L20"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "c8ed2d3103aa85363acd7f5573aeb936a5ab5a3bacbcf1f04e6b298299f24dae"
+		logic_hash = "v1_sha256_c8ed2d3103aa85363acd7f5573aeb936a5ab5a3bacbcf1f04e6b298299f24dae"
 		score = 75
 		quality = 80
 		tags = "XEGROUP"
@@ -211622,20 +211633,18 @@ rule VOLEXITY_Trojan_Win_Backwash_Cpp : XEGROUP
 	condition:
 		2 of them
 }
-import "pe"
-
 rule VOLEXITY_Trojan_Win_Iis_Shellsave : XEGROUP
 {
 	meta:
 		description = "Detects an AutoIT backdoor designed to run on IIS servers and to install a webshell. This rule will only work against memory samples."
 		author = "threatintel@volexity.com"
-		id = "a89defa5-4b22-5650-a0c0-f4b3cf3377a7"
+		id = "d56e7ca3-e4e7-5884-ae88-44bcd9501be9"
 		date = "2021-11-17"
 		modified = "2021-12-07"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-12-06 - XEGroup/indicators/yara.yar#L22-L40"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "f34d6f4ecaa4cde5965f6b0deac55c7133a2be96f5c466f34775be6e7f730493"
+		logic_hash = "v1_sha256_f34d6f4ecaa4cde5965f6b0deac55c7133a2be96f5c466f34775be6e7f730493"
 		score = 75
 		quality = 80
 		tags = "XEGROUP"
@@ -211652,20 +211661,18 @@ rule VOLEXITY_Trojan_Win_Iis_Shellsave : XEGROUP
 	condition:
 		all of them
 }
-import "pe"
-
 rule VOLEXITY_Trojan_Backwash_Iis_Scout : XEGROUP
 {
 	meta:
 		description = "Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines."
 		author = "threatintel@volexity.com"
-		id = "1f768b39-21a0-574d-9043-5104540003f7"
+		id = "7d4765fa-e633-5f96-bd68-dcda5b839644"
 		date = "2021-11-17"
 		modified = "2021-12-07"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-12-06 - XEGroup/indicators/yara.yar#L42-L66"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "18c4e338905ff299d75534006037e63a8f9b191f062cc97b0592245518015f88"
+		logic_hash = "v1_sha256_18c4e338905ff299d75534006037e63a8f9b191f062cc97b0592245518015f88"
 		score = 75
 		quality = 80
 		tags = "XEGROUP"
@@ -211688,20 +211695,18 @@ rule VOLEXITY_Trojan_Backwash_Iis_Scout : XEGROUP
 	condition:
 		6 of them
 }
-import "pe"
-
 rule VOLEXITY_Web_Js_Xeskimmer : XEGROUP
 {
 	meta:
 		description = "Detects JScript code using in skimming credit card details."
 		author = "threatintel@volexity.com"
-		id = "2c0911cf-a679-5d4e-baad-777745a28e27"
+		id = "9b710c3c-db02-5588-a42d-d4b54b95c913"
 		date = "2021-11-17"
 		modified = "2021-12-07"
 		reference = "https://github.com/MBThreatIntel/skimmers/blob/master/null_gif_skimmer.js"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-12-06 - XEGroup/indicators/yara.yar#L68-L97"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "cc46e9fab5f408fde13c3897d378a1a2e4acb448f40ca4935c19024ebdc252d7"
+		logic_hash = "v1_sha256_cc46e9fab5f408fde13c3897d378a1a2e4acb448f40ca4935c19024ebdc252d7"
 		score = 75
 		quality = 80
 		tags = "XEGROUP"
@@ -211719,23 +211724,21 @@ rule VOLEXITY_Web_Js_Xeskimmer : XEGROUP
 		$magic = "d=c.charCodeAt(b),a+=d.toString(16);"
 
 	condition:
-		all of ($s*) or all of ($b*) or all of ($c*) or $magic
+		all of ( $s* ) or all of ( $b* ) or all of ( $c* ) or $magic
 }
-import "pe"
-
 rule VOLEXITY_Trojan_Win_Xe_Backwash : XEGROUP FILE
 {
 	meta:
 		description = "The BACKWASH malware family, which acts as a reverse shell on the victim machine."
 		author = "threatintel@volexity.com"
-		id = "93bbbf58-8ba2-565f-98f5-51d6f1a1ab06"
+		id = "fe39e400-d876-5b4f-91b0-387ad17965b3"
 		date = "2020-09-04"
 		modified = "2021-12-07"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-12-06 - XEGroup/indicators/yara.yar#L99-L129"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "815d262d38a26d5695606d03d5a1a49b9c00915ead1d8a2c04eb47846100e93f"
-		logic_hash = "cabe7d17017c95943b7ae9d1827b3a5cb8ed3b02506222367498a73fec8d0914"
+		logic_hash = "v1_sha256_cabe7d17017c95943b7ae9d1827b3a5cb8ed3b02506222367498a73fec8d0914"
 		score = 75
 		quality = 80
 		tags = "XEGROUP, FILE"
@@ -211752,7 +211755,7 @@ rule VOLEXITY_Trojan_Win_Xe_Backwash : XEGROUP FILE
 		$b2 = "setshell" wide
 
 	condition:
-		any of ($pdb*) or (( all of ($a*) or all of ($b*)) and filesize <40KB)
+		any of ( $pdb* ) or ( ( all of ( $a* ) or all of ( $b* ) ) and filesize < 40KB )
 }
 import "pe"
 
@@ -211761,14 +211764,14 @@ rule VOLEXITY_Trojan_Win_Pngexe : XEGROUP FILE
 	meta:
 		description = "Detects PNGEXE, a simple reverse shell loader."
 		author = "threatintel@volexity.com"
-		id = "a0168176-6b2d-56ba-baaa-f011d9f5e3ad"
+		id = "c611e192-5193-5343-935c-7990fe1af08a"
 		date = "2020-09-04"
 		modified = "2021-12-07"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-12-06 - XEGroup/indicators/yara.yar#L132-L159"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "72f7d4d3b9d2e406fa781176bd93e8deee0fb1598b67587e1928455b66b73911"
-		logic_hash = "05ab554eaf208ff0f5fde37b835c92e55bf0de21bd2700fdd31d81ba338cbdc7"
+		logic_hash = "v1_sha256_05ab554eaf208ff0f5fde37b835c92e55bf0de21bd2700fdd31d81ba338cbdc7"
 		score = 75
 		quality = 80
 		tags = "XEGROUP, FILE"
@@ -211781,23 +211784,21 @@ rule VOLEXITY_Trojan_Win_Pngexe : XEGROUP FILE
 		$a2 = "x86.png" ascii
 
 	condition:
-		uint16(0)==0x5A4D and (( any of ($a*) and filesize >30KB and filesize <200KB) or pe.imphash()=="ca41f83b03cf3bb51082dbd72e3ba1ba" or pe.imphash()=="e93abc400902e72707edef1f717805f0" or pe.imphash()=="83a5d4aa20a8aca2a9aa6fc2a0aa30b0")
+		uint16( 0 ) == 0x5A4D and ( ( any of ( $a* ) and filesize > 30KB and filesize < 200KB ) or pe.imphash ( ) == "ca41f83b03cf3bb51082dbd72e3ba1ba" or pe.imphash ( ) == "e93abc400902e72707edef1f717805f0" or pe.imphash ( ) == "83a5d4aa20a8aca2a9aa6fc2a0aa30b0" )
 }
-import "pe"
-
 rule VOLEXITY_Trojan_Win_Backwash_Iis : XEGROUP
 {
 	meta:
 		description = "Variant of the BACKWASH malware family with IIS worm functionality."
 		author = "threatintel@volexity.com"
-		id = "08a86a58-32af-5c82-90d2-d6603dae8d63"
+		id = "e5c8f95f-70b1-5d38-852f-b3f952852bc0"
 		date = "2020-09-04"
 		modified = "2021-12-07"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-12-06 - XEGroup/indicators/yara.yar#L161-L184"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "98e39573a3d355d7fdf3439d9418fdbf4e42c2e03051b5313d5c84f3df485627"
-		logic_hash = "95a7f9e0afb031b49cd0da66b5a887d26ad2e06cce625bc45739b4a80e96ce9c"
+		logic_hash = "v1_sha256_95a7f9e0afb031b49cd0da66b5a887d26ad2e06cce625bc45739b4a80e96ce9c"
 		score = 75
 		quality = 80
 		tags = "XEGROUP"
@@ -211814,20 +211815,20 @@ rule VOLEXITY_Trojan_Win_Backwash_Iis : XEGROUP
 		$b2 = "&shell=backsession.aspx" ascii wide
 
 	condition:
-		all of ($a*) or any of ($b*)
+		all of ( $a* ) or any of ( $b* )
 }
 rule VOLEXITY_Apt_Rb_Rokrat_Loader : INKYSQUID
 {
 	meta:
 		description = "Ruby loader seen loading the ROKRAT malware family."
 		author = "threatintel@volexity.com"
-		id = "69d09560-a769-55d3-a442-e37f10453cde"
+		id = "2af078ec-4953-562f-961e-2af32bfe6f8a"
 		date = "2021-06-22"
 		modified = "2021-09-02"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L1-L25"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "30ae14fd55a3ab60e791064f69377f3b9de9b871adfd055f435df657f89f8007"
+		logic_hash = "v1_sha256_30ae14fd55a3ab60e791064f69377f3b9de9b871adfd055f435df657f89f8007"
 		score = 75
 		quality = 80
 		tags = "INKYSQUID"
@@ -211845,20 +211846,20 @@ rule VOLEXITY_Apt_Rb_Rokrat_Loader : INKYSQUID
 		$s4 = "XZ05WavBlO6UGbkRWaG"
 
 	condition:
-		any of ($magic*) or any of ($s*)
+		any of ( $magic* ) or any of ( $s* )
 }
 rule VOLEXITY_Apt_Py_Bluelight_Ldr : INKYSQUID
 {
 	meta:
 		description = "Python Loader used to execute the BLUELIGHT malware family."
 		author = "threatintel@volexity.com"
-		id = "f8da3e40-c3b0-5b7f-8ece-81874993d8cd"
+		id = "50c334e7-ec0c-5c96-aa49-898e50ac0481"
 		date = "2021-06-22"
 		modified = "2021-09-02"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L27-L45"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "e7e18a6d648b1383706439ba923335ac4396f6b5d2a3dc8f30f63ded7df29eda"
+		logic_hash = "v1_sha256_e7e18a6d648b1383706439ba923335ac4396f6b5d2a3dc8f30f63ded7df29eda"
 		score = 75
 		quality = 80
 		tags = "INKYSQUID"
@@ -211880,14 +211881,14 @@ rule VOLEXITY_Apt_Win_Decrok : INKYSQUID
 	meta:
 		description = "The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload."
 		author = "threatintel@volexity.com"
-		id = "dc83843d-fd2a-52f1-82e8-8e36b135a0c5"
+		id = "c93b6741-5f55-577f-af6b-ed82c8efb8a5"
 		date = "2021-06-23"
 		modified = "2021-09-02"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L47-L67"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
-		logic_hash = "47fa03e95ac17ba7195858cd63b1769e5d56ab8a5edf872b345989b767050b87"
+		logic_hash = "v1_sha256_47fa03e95ac17ba7195858cd63b1769e5d56ab8a5edf872b345989b767050b87"
 		score = 75
 		quality = 80
 		tags = "INKYSQUID"
@@ -211907,14 +211908,14 @@ rule VOLEXITY_Apt_Win_Rokload : INKYSQUID
 	meta:
 		description = "A shellcode loader used to decrypt and run an embedded executable."
 		author = "threatintel@volexity.com"
-		id = "229dbf3c-1538-5ecd-b5f8-8c9a9c81c515"
+		id = "d2fea970-f225-55c0-944c-b13f3af6093c"
 		date = "2021-06-23"
 		modified = "2021-09-02"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L69-L83"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904"
-		logic_hash = "8d65d32fd5bc055ca0e3831d3db88299e7c99f8547a170d3c53ec2c4001496a3"
+		logic_hash = "v1_sha256_8d65d32fd5bc055ca0e3831d3db88299e7c99f8547a170d3c53ec2c4001496a3"
 		score = 75
 		quality = 80
 		tags = "INKYSQUID"
@@ -211931,13 +211932,13 @@ rule VOLEXITY_Apt_Win_Applejeus_Oct22 : LAZARUS
 	meta:
 		description = "Detects AppleJeus DLL samples."
 		author = "threatintel@volexity.com"
-		id = "f88e2253-e296-57d8-a627-6cb4ccff7a92"
+		id = "3d347d4e-df6b-55d5-8726-465ecc6b4d89"
 		date = "2022-11-03"
 		modified = "2022-12-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L1-L16"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "46f3325a7e8e33896862b1971f561f4871670842aecd46bcc7a5a1af869ecdc4"
+		logic_hash = "v1_sha256_46f3325a7e8e33896862b1971f561f4871670842aecd46bcc7a5a1af869ecdc4"
 		score = 75
 		quality = 80
 		tags = "LAZARUS"
@@ -211956,13 +211957,13 @@ rule VOLEXITY_Apt_Win_Applejeus_B_Oct22 : LAZARUS
 	meta:
 		description = "Detected AppleJeus unpacked samples."
 		author = "threatintel@volexity.com"
-		id = "8586dc64-225b-5f28-a6d6-b9b6e8f1c815"
+		id = "1ed00d2b-4d75-512a-bc65-be49c01ddd2f"
 		date = "2022-11-03"
 		modified = "2022-12-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L18-L41"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "76f3c9692ea96d3cadbbcad03477ab6c53445935352cb215152b9b5483666d43"
+		logic_hash = "v1_sha256_76f3c9692ea96d3cadbbcad03477ab6c53445935352cb215152b9b5483666d43"
 		score = 75
 		quality = 80
 		tags = "LAZARUS"
@@ -211977,20 +211978,20 @@ rule VOLEXITY_Apt_Win_Applejeus_B_Oct22 : LAZARUS
 		$str2 = "&act=check"
 
 	condition:
-		( any of ($key*) and 1 of ($str*)) or all of ($str*)
+		( any of ( $key* ) and 1 of ( $str* ) ) or all of ( $str* )
 }
 rule VOLEXITY_Apt_Win_Applejeus_C_Oct22 : LAZARUS
 {
 	meta:
 		description = "Detected AppleJeus unpacked samples."
 		author = "threatintel@volexity.com"
-		id = "6f467e0e-2932-5ba7-9fe3-0f9d28466e23"
+		id = "7b70cc04-201e-5c93-8ce0-40ca5e227b54"
 		date = "2022-11-03"
 		modified = "2022-12-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L43-L63"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "566f5840ff2023f4fd8ffaa9ba1308a7012913cf587838173358b8f1fe4abca8"
+		logic_hash = "v1_sha256_566f5840ff2023f4fd8ffaa9ba1308a7012913cf587838173358b8f1fe4abca8"
 		score = 75
 		quality = 80
 		tags = "LAZARUS"
@@ -212014,13 +212015,13 @@ rule VOLEXITY_Apt_Win_Applejeus_D_Oct22 : LAZARUS
 	meta:
 		description = "Detected AppleJeus unpacked samples."
 		author = "threatintel@volexity.com"
-		id = "80d2821b-a437-573e-9e9d-bf79f9422cc9"
+		id = "205a31e0-2476-5da1-b79b-a70b602fbd40"
 		date = "2022-11-10"
 		modified = "2022-12-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L65-L83"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "23c0642e5be15a75a39d089cd52f2f14d633f7af6889140b9ec6e53c5c023974"
+		logic_hash = "v1_sha256_23c0642e5be15a75a39d089cd52f2f14d633f7af6889140b9ec6e53c5c023974"
 		score = 75
 		quality = 80
 		tags = "LAZARUS"
@@ -212042,13 +212043,13 @@ rule VOLEXITY_Cf_Office_Win_Macro_Lazarus_Jeus_B : LAZARUS
 	meta:
 		description = "Detects macros used by the Lazarus threat actor to distribute AppleJeus."
 		author = "threatintel@volexity.com"
-		id = "ac4d4e82-e29f-5134-999d-b8dcef59d285"
+		id = "83dac501-9491-5834-b61f-f138f6c9f061"
 		date = "2022-11-03"
 		modified = "2022-12-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L85-L104"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "e55199e6ad26894f98e930cd4716127ee868872d08ada1c44675e4db1ec27894"
+		logic_hash = "v1_sha256_e55199e6ad26894f98e930cd4716127ee868872d08ada1c44675e4db1ec27894"
 		score = 75
 		quality = 80
 		tags = "LAZARUS"
@@ -212064,20 +212065,20 @@ rule VOLEXITY_Cf_Office_Win_Macro_Lazarus_Jeus_B : LAZARUS
 		$a5 = " MkDir (" ascii
 
 	condition:
-		all of ($a*)
+		all of ( $a* )
 }
 rule VOLEXITY_Cf_Office_Win_Macro_Lazarus_Jeus : LAZARUS
 {
 	meta:
 		description = "Detects malicious documents used by Lazarus in a campaign dropping the AppleJeus malware."
 		author = "threatintel@volexity.com"
-		id = "03d41314-c19f-566f-9571-48915a292433"
+		id = "0ecf31f8-a15e-53d5-bebb-4592fcabd303"
 		date = "2022-11-02"
 		modified = "2022-12-01"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L106-L124"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "8e5a9042ec1ddaf4da511743434461c9865f259c30a9b02c28475b3a59fe4fc1"
+		logic_hash = "v1_sha256_8e5a9042ec1ddaf4da511743434461c9865f259c30a9b02c28475b3a59fe4fc1"
 		score = 75
 		quality = 80
 		tags = "LAZARUS"
@@ -212092,20 +212093,20 @@ rule VOLEXITY_Cf_Office_Win_Macro_Lazarus_Jeus : LAZARUS
 		$s4 = "Workbook_Open" ascii
 
 	condition:
-		3 of ($s*)
+		3 of ( $s* )
 }
 rule VOLEXITY_Webshell_Jsp_Converge : WEBSHELL
 {
 	meta:
 		description = "File upload webshell observed in incident involving compromise of Confluence server."
 		author = "threatintel@volexity.com"
-		id = "2a74678e-cb00-567c-a2e0-2e095f3e5ee8"
+		id = "7326e963-8325-5c46-a10e-2cbae5e767bb"
 		date = "2022-06-01"
 		modified = "2022-06-06"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L1-L15"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "bb48516342eddd48c35e6db0eb74f95e116dc723503552b99ba721b5bdb391e5"
+		logic_hash = "v1_sha256_bb48516342eddd48c35e6db0eb74f95e116dc723503552b99ba721b5bdb391e5"
 		score = 75
 		quality = 80
 		tags = "WEBSHELL"
@@ -212123,13 +212124,13 @@ rule VOLEXITY_General_Jsp_Possible_Tiny_Fileuploader : GENERAL WEBSHELLS FILE
 	meta:
 		description = "Detects small .jsp files which have possible file upload utility."
 		author = "threatintel@volexity.com"
-		id = "d111aab3-af6e-59cb-a445-ebd4a454fb9a"
+		id = "bc5e30fe-1bb1-54d9-bac9-166bf90a8818"
 		date = "2022-06-01"
 		modified = "2022-06-06"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L17-L50"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "bad62e6fd33ffb0d8551302fd7f85528066992c272b670d44a33b5b2eb174886"
+		logic_hash = "v1_sha256_bad62e6fd33ffb0d8551302fd7f85528066992c272b670d44a33b5b2eb174886"
 		score = 75
 		quality = 80
 		tags = "GENERAL, WEBSHELLS, FILE"
@@ -212146,20 +212147,20 @@ rule VOLEXITY_General_Jsp_Possible_Tiny_Fileuploader : GENERAL WEBSHELLS FILE
 		$encoding3 = ".misc.BASE64Decoder" ascii
 
 	condition:
-		( filesize <4KB and all of ($required*) and any of ($encoding*)) or ( filesize <600 and all of ($required*))
+		( filesize < 4KB and all of ( $required* ) and any of ( $encoding* ) ) or ( filesize < 600 and all of ( $required* ) )
 }
 rule VOLEXITY_Webshell_Java_Realcmd : COMMODITY WEBSHELLS
 {
 	meta:
 		description = "Detects the RealCMD webshell, one of the payloads for BEHINDER."
 		author = "threatintel@volexity.com"
-		id = "d5e7e3c8-a0aa-5c2e-8a2d-654e066593eb"
+		id = "88c8a1fb-f07e-5588-9de7-51eaef23cb2e"
 		date = "2022-06-01"
 		modified = "2022-06-06"
 		reference = "https://github.com/Freakboy/Behinder/blob/master/src/main/java/vip/youwe/sheller/payload/java/RealCMD.java"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L52-L79"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "244add844570b23e5df23882a3fdacf894f3e201b01373d949b0752361960536"
+		logic_hash = "v1_sha256_244add844570b23e5df23882a3fdacf894f3e201b01373d949b0752361960536"
 		score = 75
 		quality = 80
 		tags = "COMMODITY, WEBSHELLS"
@@ -212180,20 +212181,20 @@ rule VOLEXITY_Webshell_Java_Realcmd : COMMODITY WEBSHELLS
 		$s6 = "java.util.Base64" ascii wide
 
 	condition:
-		all of ($fn*) or all of ($s*)
+		all of ( $fn* ) or all of ( $s* )
 }
 rule VOLEXITY_Webshell_Java_Behinder_Shellservice : WEBSHELLS COMMODITY
 {
 	meta:
 		description = "Looks for artifacts generated (generally seen in .class files) related to the Behinder framework."
 		author = "threatintel@volexity.com"
-		id = "21c1e3e9-d048-5c60-9c21-8e54b27f359a"
+		id = "0e670637-9cab-5f18-9303-72b9d1dd3d28"
 		date = "2022-03-18"
 		modified = "2022-07-28"
 		reference = "https://github.com/MountCloud/BehinderClientSource/blob/master/src/main/java/net/rebeyond/behinder/core/ShellService.java"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L1-L23"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "373a8d4ef81e9bbbf1f24ebf0389e7da4b73f88786cc8e1d286ccc9f4c36debc"
+		logic_hash = "v1_sha256_373a8d4ef81e9bbbf1f24ebf0389e7da4b73f88786cc8e1d286ccc9f4c36debc"
 		score = 75
 		quality = 30
 		tags = "WEBSHELLS, COMMODITY"
@@ -212218,13 +212219,13 @@ rule VOLEXITY_General_Java_Encoding_And_Classloader : WEBSHELLS GENERAL FILE
 	meta:
 		description = "Identifies suspicious java-based files which have all the ingredients required for a webshell."
 		author = "threatintel@volexity.com"
-		id = "7de5449d-de70-5153-b1b1-8a995ac8b7a0"
+		id = "a537237b-0237-5e5f-994c-4f3136aa7491"
 		date = "2022-04-07"
 		modified = "2022-07-28"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L25-L43"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "21c226b03451eb98a8be5b26a9f00169f16454ecd21d4131c9991b63d2e3c8cd"
+		logic_hash = "v1_sha256_21c226b03451eb98a8be5b26a9f00169f16454ecd21d4131c9991b63d2e3c8cd"
 		score = 65
 		quality = 80
 		tags = "WEBSHELLS, GENERAL, FILE"
@@ -212238,20 +212239,20 @@ rule VOLEXITY_General_Java_Encoding_And_Classloader : WEBSHELLS GENERAL FILE
 		$s3 = "sun.misc.BASE64Decoder" ascii
 
 	condition:
-		filesize <50KB and all of them
+		filesize < 50KB and all of them
 }
 rule VOLEXITY_Webshell_Php_Str_Replace_Create_Func : WEBSHELLS GENERAL FILE
 {
 	meta:
 		description = "Looks for obfuscated PHP shells where create_function() is obfuscated using str_replace and then called using no arguments."
 		author = "threatintel@volexity.com"
-		id = "e0a5965c-54c3-5699-a45b-58f7152574dd"
+		id = "a84da6e4-2f6e-52ff-8065-387ba4ce8779"
 		date = "2022-04-04"
 		modified = "2022-07-28"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L45-L73"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "6a9ded1f1a8e4b8ae5f3db06f71bec6e9f62b6126b7444408d6319a35ed23827"
+		logic_hash = "v1_sha256_6a9ded1f1a8e4b8ae5f3db06f71bec6e9f62b6126b7444408d6319a35ed23827"
 		score = 75
 		quality = 80
 		tags = "WEBSHELLS, GENERAL, FILE"
@@ -212265,20 +212266,20 @@ rule VOLEXITY_Webshell_Php_Str_Replace_Create_Func : WEBSHELLS GENERAL FILE
 		$anon_func = "(''," ascii
 
 	condition:
-		filesize <100KB and $php at 0 and for any i in (1..#s) : ( for any j in (1..#anon_func) : ( uint16be(@s[i]-2)== uint16be(@anon_func[j]-2)))
+		filesize < 100KB and $php at 0 and for any i in ( 1 .. #s ) : ( for any j in ( 1 .. #anon_func ) : ( uint16be( @s [ i ] - 2 ) == uint16be( @anon_func [ j ] - 2 ) ) )
 }
 rule VOLEXITY_Trojan_Golang_Pantegana : COMMODITY
 {
 	meta:
 		description = "Detects PANTEGANA, a Golang backdoor used by a range of threat actors due to its public availability."
 		author = "threatintel@volexity.com"
-		id = "b6154165-68e0-5986-a0cf-5631d369c230"
+		id = "93c2e655-4adb-5139-ad6c-f4dfb95e36ed"
 		date = "2022-03-30"
 		modified = "2022-07-28"
 		reference = "https://github.com/elleven11/pantegana"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L75-L99"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "791a664a6b4b98051cbfacb451099de085cbab74d73771709377ab68a5a23d2b"
+		logic_hash = "v1_sha256_791a664a6b4b98051cbfacb451099de085cbab74d73771709377ab68a5a23d2b"
 		score = 75
 		quality = 80
 		tags = "COMMODITY"
@@ -212296,20 +212297,20 @@ rule VOLEXITY_Trojan_Golang_Pantegana : COMMODITY
 		$magic = "github.com/elleven11/pantegana" ascii
 
 	condition:
-		5 of ($s*) or $magic
+		5 of ( $s* ) or $magic
 }
 rule VOLEXITY_Trojan_Any_Pupyrat_B : COMMODITY
 {
 	meta:
 		description = "Detects the PUPYRAT malware family, a cross-platform RAT written in Python."
 		author = "threatintel@volexity.com"
-		id = "1da1e5ba-cf00-5935-b3d1-0ff2713b7e34"
+		id = "ea804f71-cae2-5053-9565-884144a08f20"
 		date = "2022-04-07"
 		modified = "2022-07-28"
 		reference = "https://github.com/n1nj4sec/pupy"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L101-L134"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "65eebfea2338deed682693f048a88d46ea4621177acb77c0642583b0dc35c818"
+		logic_hash = "v1_sha256_65eebfea2338deed682693f048a88d46ea4621177acb77c0642583b0dc35c818"
 		score = 75
 		quality = 80
 		tags = "COMMODITY"
@@ -212333,20 +212334,20 @@ rule VOLEXITY_Trojan_Any_Pupyrat_B : COMMODITY
 		$s7 = "LZMA error" ascii
 
 	condition:
-		any of ($elf*) or all of ($pupy*) or all of ($s*)
+		any of ( $elf* ) or all of ( $pupy* ) or all of ( $s* )
 }
 rule VOLEXITY_General_Php_Fileinput_Eval : WEBSHELLS GENERAL
 {
 	meta:
 		description = "Look for PHP files which use file_get_contents and then shortly afterwards use an eval statement."
 		author = "threatintel@volexity.com"
-		id = "c00d8fee-f667-5979-ad2a-dbb762544c2f"
+		id = "8321e50a-4f4b-5dd1-9491-7d7405da81f0"
 		date = "2021-06-16"
 		modified = "2022-07-28"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L136-L152"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "c61f0ee13007e398f45711354a1ca948f7f34893c9bcbdf845be932b63bd746d"
+		logic_hash = "v1_sha256_c61f0ee13007e398f45711354a1ca948f7f34893c9bcbdf845be932b63bd746d"
 		score = 75
 		quality = 80
 		tags = "WEBSHELLS, GENERAL"
@@ -212359,20 +212360,20 @@ rule VOLEXITY_General_Php_Fileinput_Eval : WEBSHELLS GENERAL
 		$s2 = "eval("
 
 	condition:
-		$s2 in (@s1[1]..@s1[1]+512)
+		$s2 in ( @s1 [ 1 ] .. @s1 [ 1 ] + 512 )
 }
 rule VOLEXITY_General_Php_Call_User_Func : GENERAL WEBSHELLS
 {
 	meta:
 		description = "Webshells using call_user_func against an object from a file input or POST variable."
 		author = "threatintel@volexity.com"
-		id = "48c7857e-7dda-5e3f-b82c-7d34c251f083"
+		id = "2ec09628-c2c1-547e-afb5-9d62df9b6de5"
 		date = "2021-06-16"
 		modified = "2022-07-28"
 		reference = "https://zhuanlan.zhihu.com/p/354906657"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L154-L170"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "46c999da97682023861e58f9cd2c8651480db990a0361c1985c6d5c35b5bf0ea"
+		logic_hash = "v1_sha256_46c999da97682023861e58f9cd2c8651480db990a0361c1985c6d5c35b5bf0ea"
 		score = 75
 		quality = 80
 		tags = "GENERAL, WEBSHELLS"
@@ -212391,13 +212392,13 @@ rule VOLEXITY_Webshell_Php_Icescorpion : COMMODITY WEBSHELL FILE
 	meta:
 		description = "Detects the IceScorpion webshell."
 		author = "threatintel@volexity.com"
-		id = "dd165d67-375e-5d51-825a-45241345e268"
+		id = "f3895b69-ddc4-5532-9c01-101c375e53a5"
 		date = "2022-01-17"
 		modified = "2022-07-28"
 		reference = "https://www.codenong.com/cs106064226/"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L172-L190"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "0c75ec7cbbfdba8ce5f71a83d78caf19366954b84f304c1864e68bbe11a9a2df"
+		logic_hash = "v1_sha256_0c75ec7cbbfdba8ce5f71a83d78caf19366954b84f304c1864e68bbe11a9a2df"
 		score = 75
 		quality = 80
 		tags = "COMMODITY, WEBSHELL, FILE"
@@ -212410,20 +212411,20 @@ rule VOLEXITY_Webshell_Php_Icescorpion : COMMODITY WEBSHELL FILE
 		$s2 = "openssl_decrypt"
 
 	condition:
-		all of them and filesize <10KB
+		all of them and filesize < 10KB
 }
 rule VOLEXITY_Apt_Macos_Gimmick : STORMCLOUD
 {
 	meta:
 		description = "Detects the macOS port of the GIMMICK malware."
 		author = "threatintel@volexity.com"
-		id = "258a2bbe-7822-5f74-b4eb-8776ecb15b76"
+		id = "d7349922-1d22-5e9b-ac72-0747408891b2"
 		date = "2021-10-18"
 		modified = "2022-03-22"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-03-22 GIMMICK/indicators/yara.yar#L1-L50"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "403ed1102fe5a99c0aacde02e0830f9c4fa194f10aec4a192f4abf6cde0de99d"
+		logic_hash = "v1_sha256_403ed1102fe5a99c0aacde02e0830f9c4fa194f10aec4a192f4abf6cde0de99d"
 		score = 75
 		quality = 78
 		tags = "STORMCLOUD"
@@ -212462,20 +212463,20 @@ rule VOLEXITY_Apt_Macos_Gimmick : STORMCLOUD
 		$cmd16 = "uploadFiles" ascii wide
 
 	condition:
-		$s1 or 5 of ($json*) or 3 of ($msg*) or 9 of ($cmd*)
+		$s1 or 5 of ( $json* ) or 3 of ( $msg* ) or 9 of ( $cmd* )
 }
 rule VOLEXITY_Apt_Win_Gimmick_Dotnet_Base : STORMCLOUD
 {
 	meta:
 		description = "Detects the base version of GIMMICK in .NET."
 		author = "threatintel@volexity.com"
-		id = "8723253f-ad11-509e-a9b4-f2c3258f9b5c"
+		id = "aec300e7-e67d-518a-8543-09a6252ea32d"
 		date = "2020-03-16"
 		modified = "2022-03-22"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-03-22 GIMMICK/indicators/yara.yar#L52-L76"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "0dd2aab308b7057d3075c792339af89d7ff9d617f1beb78ecdb725554defa5dc"
+		logic_hash = "v1_sha256_0dd2aab308b7057d3075c792339af89d7ff9d617f1beb78ecdb725554defa5dc"
 		score = 75
 		quality = 80
 		tags = "STORMCLOUD"
@@ -212494,20 +212495,20 @@ rule VOLEXITY_Apt_Win_Gimmick_Dotnet_Base : STORMCLOUD
 		$magic2 = "DAE47700E8CF3DAB0@" ascii wide
 
 	condition:
-		5 of ($other*) or any of ($magic*)
+		5 of ( $other* ) or any of ( $magic* )
 }
 rule VOLEXITY_Apt_Js_Sharpext : SHARPTONGUE
 {
 	meta:
 		description = "A malicious Chrome browser extention used by the SharpTongue threat actor to steal mail data from a victim."
 		author = "threatintel@volexity.com"
-		id = "61b5176a-ff73-5fce-bc70-c9e09bb5afed"
+		id = "a7c37fc9-52b3-5bfb-b1a6-efd19dab9cb8"
 		date = "2021-09-14"
 		modified = "2022-07-28"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-07-28 SharpTongue SharpTongue Deploys Clever Mail-Stealing Browser Extension SHARPEXT/yara.yar#L1-L47"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "0ed58c8646582ee36aeac650fac02d1e4962d45c0f6a24783c021d9267bed192"
+		logic_hash = "v1_sha256_0ed58c8646582ee36aeac650fac02d1e4962d45c0f6a24783c021d9267bed192"
 		score = 75
 		quality = 80
 		tags = "SHARPTONGUE"
@@ -212539,20 +212540,20 @@ rule VOLEXITY_Apt_Js_Sharpext : SHARPTONGUE
 		$manifest3 = "\"devtools_page\":\"dev.html\"" ascii
 
 	condition:
-		(5 of ($s*) and all of ($mark*)) or all of ($enc*) or 3 of ($xhr*) or 2 of ($manifest*)
+		(5 of ( $s* ) and all of ( $mark* ) ) or all of ( $enc* ) or 3 of ( $xhr* ) or 2 of ( $manifest* )
 }
 rule VOLEXITY_Webshell_Jsp_Godzilla : WEBSHELLS COMMODITY
 {
 	meta:
 		description = "Detects the JSP implementation of the Godzilla Webshell."
 		author = "threatintel@volexity.com"
-		id = "47c8eab8-84d7-5566-b757-5a6dcc7579b7"
+		id = "03b6d2b2-b27b-5ba2-89b9-ef129487311b"
 		date = "2021-11-08"
 		modified = "2022-08-10"
 		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L1-L28"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "52cba9545f662da18ca6e07340d7a9be637b89e7ed702dd58cac545c702a00e3"
+		logic_hash = "v1_sha256_52cba9545f662da18ca6e07340d7a9be637b89e7ed702dd58cac545c702a00e3"
 		score = 75
 		quality = 80
 		tags = "WEBSHELLS, COMMODITY"
@@ -212570,20 +212571,20 @@ rule VOLEXITY_Webshell_Jsp_Godzilla : WEBSHELLS COMMODITY
 		$magic2 = "<%@page import=\"java.util.*,javax.crypto.*,javax.crypto.spec.*\"%><%!class"
 
 	condition:
-		all of ($s*) or all of ($auth*) or any of ($magic*)
+		all of ( $s* ) or all of ( $auth* ) or any of ( $magic* )
 }
 rule VOLEXITY_Webshell_Jsp_General_Runtime_Exec_Req : GENERAL WEBSHELLS
 {
 	meta:
 		description = "Looks for a common design pattern in webshells where a request attribute is passed directly to exec()."
 		author = "threatintel@volexity.com"
-		id = "7f1539bd-a2f0-50dd-b500-ada4e0971d13"
+		id = "9f1630f5-913d-58d0-a2e4-b34b62594f16"
 		date = "2022-02-02"
 		modified = "2022-08-10"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L30-L45"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "d3048aba80c1c39f1673931cd2d7c5ed83045603b0ad204073fd788d0103a6c8"
+		logic_hash = "v1_sha256_d3048aba80c1c39f1673931cd2d7c5ed83045603b0ad204073fd788d0103a6c8"
 		score = 75
 		quality = 80
 		tags = "GENERAL, WEBSHELLS"
@@ -212602,13 +212603,13 @@ rule VOLEXITY_Webshell_Jsp_Regeorg : WEBSHELL COMMODITY
 	meta:
 		description = "Detects the reGeorg webshells' JSP version."
 		author = "threatintel@volexity.com"
-		id = "205ee383-4298-5469-a509-4ce3eaf9dd0e"
+		id = "394e968b-7b62-5ce4-9eca-3650c32371f1"
 		date = "2022-03-08"
 		modified = "2022-08-10"
 		reference = "https://github.com/SecWiki/WebShell-2/blob/master/reGeorg-master/tunnel.jsp"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L47-L70"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "cecb71605d9112d509823c26e40e1cf9cd6db581db448db5c9ffc63a2bfe529e"
+		logic_hash = "v1_sha256_cecb71605d9112d509823c26e40e1cf9cd6db581db448db5c9ffc63a2bfe529e"
 		score = 75
 		quality = 80
 		tags = "WEBSHELL, COMMODITY"
@@ -212625,206 +212626,20 @@ rule VOLEXITY_Webshell_Jsp_Regeorg : WEBSHELL COMMODITY
 		$a5 = ".flip();" ascii
 
 	condition:
-		$magic or all of ($a*)
-}
-rule VOLEXITY_Apt_Ico_Uta0040_B64_C2 : UTA0040 FILE
-{
-	meta:
-		description = "Detection of malicious ICO files used in 3CX compromise."
-		author = "threatintel@volexity.com"
-		id = "1efb6376-a362-5f03-b4d3-08cd7d634de6"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-03-30 3CX/indicators/rules.yar#L1-L31"
-		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "2667a36ce151c6e964f9ce9a6f587eedbffdd6ec76e451a23c5cfdd08248d15e"
-		score = 75
-		quality = 80
-		tags = "UTA0040, FILE"
-		hash1 = "a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c"
-		memory_suitable = 0
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-
-	strings:
-		$IEND_dollar = {49 45 4e 44 ae 42 60 82 24}
-		$IEND_nodollar = {49 45 4e 44 ae 42 60 82 }
-
-	condition:
-		uint16be(0)==0x0000 and filesize <120KB and ($IEND_dollar in ( filesize -500.. filesize ) and not $IEND_nodollar in ( filesize -20.. filesize ) and for any k in (1..#IEND_dollar) : ( for all i in (1..4) : ( uint8(@IEND_dollar[k]+!IEND_dollar[k]+i)<123 and uint8(@IEND_dollar[k]+!IEND_dollar[k]+i)>47)))
-}
-rule VOLEXITY_Apt_Mac_Iconic : UTA0040
-{
-	meta:
-		description = "Detects the MACOS version of the ICONIC loader."
-		author = "threatintel@volexity.com"
-		id = "6d702ed3-e5b9-5324-a06b-507c9231cc00"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-03-30 3CX/indicators/rules.yar#L32-L50"
-		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "7b689c3931632b01869ac2f21a1edca0a5ca9007299fe7cd16962d6866c27558"
-		score = 75
-		quality = 80
-		tags = "UTA0040"
-		hash1 = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-
-	strings:
-		$str1 = "3CX Desktop App" xor(0x01-0xff)
-		$str2 = "__tutma=" xor(0x01-0xff)
-		$str3 = "Mozilla/5.0" xor(0x01-0xff)
-
-	condition:
-		all of them
-}
-rule VOLEXITY_Apt_Win_Iconicstealer : UTA0040
-{
-	meta:
-		description = "Detect the ICONICSTEALER malware family."
-		author = "threatintel@volexity.com"
-		id = "d7896506-6ce5-59b1-b24a-87ffdb2a5174"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-03-30 3CX/indicators/rules.yar#L51-L69"
-		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "ed7731d2361e7d96a6a35f8359b61a2af049b16bc457cf870db8831e142aebe2"
-		score = 75
-		quality = 80
-		tags = "UTA0040"
-		hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-
-	strings:
-		$str1 = "\\3CXDesktopApp\\config.json" wide
-		$str2 = "url, title FROM urls" wide
-		$str3 = "url, title FROM moz_places" wide
-
-	condition:
-		all of them
-}
-rule VOLEXITY_Apt_Win_Iconic : UTA0040
-{
-	meta:
-		description = "Detect the ICONIC loader."
-		author = "threatintel@volexity.com"
-		id = "e7d6fcc0-c830-5236-90fb-182c66873903"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-03-30 3CX/indicators/rules.yar#L70-L93"
-		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "b62b1543c9af3afb8fc885f313e1a5d2fcb688657e3807cce72b31b56381681e"
-		score = 75
-		quality = 55
-		tags = "UTA0040"
-		hash1 = "f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-
-	strings:
-		$internal_name = "samcli.dll"
-		$str1 = "gzip, deflate, br"
-		$str2 = "__tutma"
-		$str3 = "__tutmc"
-		$str4 = "ChainingModeGCM" wide
-		$str5 = "ChainingMode" wide
-		$str6 = "icon%d.ico" wide
-
-	condition:
-		all of them
-}
-rule VOLEXITY_Apt_Win_3Cx_Backdoored_Lib : UTA0040
-{
-	meta:
-		description = "Detects the malicious library delivered in the backdoored 3CX installer."
-		author = "threatintel@volexity.com"
-		id = "39270b93-830e-598f-a38e-fcc5050e4d30"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-03-30 3CX/indicators/rules.yar#L94-L133"
-		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "40be2d46a318ff03724ea1f6628d78001c14c85a3ae6d032c0324ea849d707f2"
-		score = 75
-		quality = 80
-		tags = "UTA0040"
-		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-
-	strings:
-		$shellcode = {
-                        44 8D 4A ??
-                        44 8D 92 ?? ?? ?? ??
-                        45 85 C9
-                        45 0F 49 D1
-                        41 81 E2 00 FF FF FF
-                        41 F7 DA
-                        44 01 D2
-                        FF C2
-                        4C 63 CA
-                        46 8A 94 0C ?? ?? ?? ??
-                        45 00 D0
-                        45 0F B6 D8
-                        42 8A AC 1C ?? ?? ?? ??
-                        46 88 94 1C ?? ?? ?? ??
-                        42 88 AC 0C ?? ?? ?? ??
-                        42 02 AC 1C ?? ?? ?? ??
-                        44 0F B6 CD
-                        46 8A 8C 0C ?? ?? ?? ??
-                        45 30 0C 0E
-                        48 FF C1
-                        48 39 C8
-                        75 ??
-                }
-
-	condition:
-		all of them
-}
-rule VOLEXITY_Informational_Win_3Cx_Msi : UTA0040
-{
-	meta:
-		description = "Detects 3CX installers created in March 2023, 3CX was known to be compromised at this time."
-		author = "threatintel@volexity.com"
-		id = "ac26e7b1-61eb-5074-bcda-46d714bdba4c"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-03-30 3CX/indicators/rules.yar#L134-L152"
-		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "c04de2653ef587f27c7ebf058c6f6c345e16b67f36ccc4306bc49f8c4394728e"
-		score = 75
-		quality = 80
-		tags = "UTA0040"
-		hash1 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
-		memory_suitable = 0
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-
-	strings:
-		$cert = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
-		$app = "3CXDesktopApp.exe"
-		$data = "202303"
-
-	condition:
-		all of them
+		$magic or all of ( $a* )
 }
 rule VOLEXITY_Apt_Win_Powerstar_Persistence_Batch : CHARMINGKITTEN
 {
 	meta:
 		description = "Detects the batch script used to persist PowerStar via Startup."
 		author = "threatintel@volexity.com"
-		id = "f3ed7b46-d80d-55b1-b6c7-6ea6569f199c"
+		id = "3ff93719-056a-50f6-aeeb-9fa08390c775"
 		date = "2023-05-16"
 		modified = "2023-09-20"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L1-L19"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "9c3a45b759516959eae1cdf8e73bf540b682c90359a6232aa4782a8d1fe15b7d"
+		logic_hash = "v1_sha256_9c3a45b759516959eae1cdf8e73bf540b682c90359a6232aa4782a8d1fe15b7d"
 		score = 75
 		quality = 80
 		tags = "CHARMINGKITTEN"
@@ -212847,13 +212662,13 @@ rule VOLEXITY_Apt_Win_Powerstar_Memonly : CHARMINGKITTEN
 	meta:
 		description = "Detects the initial stage of the memory only variant of PowerStar."
 		author = "threatintel@volexity.com"
-		id = "469fc433-da9e-55ed-99fb-9560ec86a179"
+		id = "8b4a33be-8070-5255-9707-73408500bd1b"
 		date = "2023-05-16"
 		modified = "2023-09-20"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L20-L65"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "d790ff204e4e8adeb3e887d9ebce743e958b523c48317d017487b1b0c6aebc11"
+		logic_hash = "v1_sha256_d790ff204e4e8adeb3e887d9ebce743e958b523c48317d017487b1b0c6aebc11"
 		score = 75
 		quality = 78
 		tags = "CHARMINGKITTEN"
@@ -212891,20 +212706,20 @@ rule VOLEXITY_Apt_Win_Powerstar_Memonly : CHARMINGKITTEN
 		$command_3 = "_____yeolsoe_____"
 
 	condition:
-		2 of ($s_*) or any of ($f_*) or 2 of ($alias_*) or $key or all of ($args_*) or any of ($command_*)
+		2 of ( $s_* ) or any of ( $f_* ) or 2 of ( $alias_* ) or $key or all of ( $args_* ) or any of ( $command_* )
 }
 rule VOLEXITY_Apt_Win_Powerstar_Logmessage : CHARMINGKITTEN
 {
 	meta:
 		description = "Detects interesting log message embedded in memory only version of PowerStar."
 		author = "threatintel@volexity.com"
-		id = "5979c776-5138-50e2-adab-0793ad86ba76"
+		id = "99d76c75-e494-5aa6-bb96-a12b4b7af94e"
 		date = "2023-05-16"
 		modified = "2023-09-20"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L66-L79"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "539c9a8b3de24f2c8058d204900344756a8031822ebebc312612b8fb8422e341"
+		logic_hash = "v1_sha256_539c9a8b3de24f2c8058d204900344756a8031822ebebc312612b8fb8422e341"
 		score = 75
 		quality = 80
 		tags = "CHARMINGKITTEN"
@@ -212922,13 +212737,13 @@ rule VOLEXITY_Apt_Win_Powerstar_Lnk : CHARMINGKITTEN
 	meta:
 		description = "Detects LNK command line used to install PowerStar."
 		author = "threatintel@volexity.com"
-		id = "33f16283-69b9-5109-b723-3ddc8abb8c41"
+		id = "a18db3b5-56b6-57b5-85fb-4098e630bc46"
 		date = "2023-05-16"
 		modified = "2023-09-20"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L80-L97"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "da53aeaf69e80f697068779f4741b8c23cff82dd1bfb0640916a1bcc98c4892f"
+		logic_hash = "v1_sha256_da53aeaf69e80f697068779f4741b8c23cff82dd1bfb0640916a1bcc98c4892f"
 		score = 75
 		quality = 80
 		tags = "CHARMINGKITTEN"
@@ -212949,13 +212764,13 @@ rule VOLEXITY_Apt_Win_Powerstar_Decrypt_Function : CHARMINGKITTEN
 	meta:
 		description = "Detects PowerStar decrypt function, potentially downloaded standalone and then injected."
 		author = "threatintel@volexity.com"
-		id = "1fbc2689-8169-53b1-b581-c41ab2b3a16f"
+		id = "67c7675d-dee9-5a64-9e7f-892044993d12"
 		date = "2023-05-16"
 		modified = "2023-09-20"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L98-L121"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "d022e363464488836a1c161f2b9c7463ac91ae6f60f14dfd574189233201c9aa"
+		logic_hash = "v1_sha256_d022e363464488836a1c161f2b9c7463ac91ae6f60f14dfd574189233201c9aa"
 		score = 75
 		quality = 80
 		tags = "CHARMINGKITTEN"
@@ -212973,20 +212788,20 @@ rule VOLEXITY_Apt_Win_Powerstar_Decrypt_Function : CHARMINGKITTEN
 		$s_6 = "$memii.Close()"
 
 	condition:
-		any of ($f_*) or 2 of ($s_*)
+		any of ( $f_* ) or 2 of ( $s_* )
 }
 rule VOLEXITY_Apt_Win_Powerstar : CHARMINGKITTEN
 {
 	meta:
 		description = "Custom PowerShell backdoor used by Charming Kitten."
 		author = "threatintel@volexity.com"
-		id = "febcd23b-6545-571b-905d-18dffe8e913f"
+		id = "5287876f-fe6b-5746-8948-dead5dc5ba19"
 		date = "2021-10-13"
 		modified = "2023-09-20"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L122-L150"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "2cbf59eaee60a8f84b1ac35cec3b01592a2a0f56c92a2db218bb26a15be24bf3"
+		logic_hash = "v1_sha256_2cbf59eaee60a8f84b1ac35cec3b01592a2a0f56c92a2db218bb26a15be24bf3"
 		score = 75
 		quality = 80
 		tags = "CHARMINGKITTEN"
@@ -213005,21 +212820,21 @@ rule VOLEXITY_Apt_Win_Powerstar : CHARMINGKITTEN
 		$sess = "$session = $v + \";;\" + $env:COMPUTERNAME + $mac;" ascii wide
 
 	condition:
-		$appname or all of ($langfilters*) or all of ($definitions*) or $sess
+		$appname or all of ( $langfilters* ) or all of ( $definitions* ) or $sess
 }
 rule VOLEXITY_Apt_Win_Avburner : SNAKECHARMER
 {
 	meta:
 		description = "Detects AVBurner based on a combination of API calls used, hard-coded strings and bytecode patterns."
 		author = "threatintel@volexity.com"
-		id = "1bde0861-4820-5bb1-98a3-516092c91be0"
+		id = "c242d5b9-2c3f-558d-90dc-df3f88bd4da6"
 		date = "2023-01-02"
 		modified = "2023-03-07"
 		reference = "https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-03-07 AVBurner/yara.yar#L1-L36"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
 		hash = "4b1b1a1293ccd2c0fd51075de9376ebb55ab64972da785153fcb0a4eb523a5eb"
-		logic_hash = "56ff6c8a4b737959a1219699a0457de1f0c34fead4299033840fb23c56a0caad"
+		logic_hash = "v1_sha256_56ff6c8a4b737959a1219699a0457de1f0c34fead4299033840fb23c56a0caad"
 		score = 75
 		quality = 80
 		tags = "SNAKECHARMER"
@@ -213043,20 +212858,20 @@ rule VOLEXITY_Apt_Win_Avburner : SNAKECHARMER
 		$pattern6 = { 41 0F BA 6D 00 0A BB 01 00 00 00 4C 8B F2 4C 8B F9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
 
 	condition:
-		all of ($api*) or all of ($str*) or all of ($pattern*)
+		all of ( $api* ) or all of ( $str* ) or all of ( $pattern* )
 }
 rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate : EVILBAMBOO FILE
 {
 	meta:
 		description = "Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication."
 		author = "threatintel@volexity.com"
-		id = "5a033770-7ad3-5c79-90ac-b1e3fff6b5f0"
+		id = "0d45d971-6601-58c3-8bac-f7c69d9edf68"
 		date = "2023-06-01"
 		modified = "2023-06-13"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L230-L255"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "861d4e1c40847c6ade04eddb047370d645afea6d5c16d55155fa58a16111c39e"
+		logic_hash = "v1_sha256_861d4e1c40847c6ade04eddb047370d645afea6d5c16d55155fa58a16111c39e"
 		score = 75
 		quality = 80
 		tags = "EVILBAMBOO, FILE"
@@ -213075,20 +212890,20 @@ rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate : EVILBAMBOO FILE
 		$s7 = "470326234506Z0a1"
 
 	condition:
-		$b1 at 0 or all of ($s*)
+		$b1 at 0 or all of ( $s* )
 }
 rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 : EVILBAMBOO FILE
 {
 	meta:
 		description = "Detection of the second stage capability of the BadBazaar android malware that has the main malicious capabilities. Will gather various info about the user/phone and routinely send this to the C2."
 		author = "threatintel@volexity.com"
-		id = "1f97c610-773f-5385-935a-445cb9192157"
+		id = "82a64a7c-c78d-5b8d-b884-57ff2f15f1e9"
 		date = "2023-05-25"
 		modified = "2023-08-30"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L257-L285"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "2186369298ebfa0b892ecb14ebacc93c6d14c9c35012e8e6cdff077634cf3773"
+		logic_hash = "v1_sha256_2186369298ebfa0b892ecb14ebacc93c6d14c9c35012e8e6cdff077634cf3773"
 		score = 75
 		quality = 80
 		tags = "EVILBAMBOO, FILE"
@@ -213110,20 +212925,20 @@ rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 : EVILBAMBOO FILE
 		$s9 = "registration_jid"
 
 	condition:
-		1 of ($c*) or 5 of ($s*)
+		1 of ( $c* ) or 5 of ( $s* )
 }
 rule VOLEXITY_Apt_Delivery_Web_Js_Jmask_Str_Array_Variant : EVILBAMBOO FILE
 {
 	meta:
 		description = "Detects the JMASK profiling script in an obfuscated format using a string array and an offset."
 		author = "threatintel@volexity.com"
-		id = "d5d32c8b-53fb-5103-ac73-05f320e71c97"
+		id = "c00dfddc-06f0-51ff-9051-9a9d049960f8"
 		date = "2023-06-27"
 		modified = "2023-09-21"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L408-L444"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "0ae7c96e0f866f21d66d7a23bf937d6ce48c9dd1ea19142dbb13487208780146"
+		logic_hash = "v1_sha256_0ae7c96e0f866f21d66d7a23bf937d6ce48c9dd1ea19142dbb13487208780146"
 		score = 75
 		quality = 80
 		tags = "EVILBAMBOO, FILE"
@@ -213151,20 +212966,20 @@ rule VOLEXITY_Apt_Delivery_Web_Js_Jmask_Str_Array_Variant : EVILBAMBOO FILE
 		$header = "info = {}, finished = 0x0;"
 
 	condition:
-		3 of ($array_*) or 5 of ($ios_*) or $header
+		3 of ( $array_* ) or 5 of ( $ios_* ) or $header
 }
 rule VOLEXITY_Apt_Delivery_Web_Js_Jmask : EVILBAMBOO FILE
 {
 	meta:
 		description = "Detects the JMASK profiling script in its minified // obfuscated format."
 		author = "threatintel@volexity.com"
-		id = "a7b653e1-f7c6-56cc-ab99-3de91d29ef3b"
+		id = "2943c798-2eeb-5108-9390-e42b7cd79d7b"
 		date = "2023-06-15"
 		modified = "2023-09-21"
 		reference = "https://github.com/volexity/threat-intel"
 		source_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L446-L472"
 		license_url = "https://github.com/volexity/threat-intel/blob/b2dd39c31efbb1ed004fb25faaace7d5caf2f424/LICENSE.txt"
-		logic_hash = "64315ac05049954d36297a616a25ffdd7ce81c6313c0878d5ba4082da24c21bb"
+		logic_hash = "v1_sha256_64315ac05049954d36297a616a25ffdd7ce81c6313c0878d5ba4082da24c21bb"
 		score = 75
 		quality = 80
 		tags = "EVILBAMBOO, FILE"
@@ -213183,13 +212998,13 @@ rule VOLEXITY_Apt_Delivery_Web_Js_Jmask : EVILBAMBOO FILE
 		$header = "(function(){info={};finished=" ascii
 
 	condition:
-		all of ($rev*) or all of ($unicode*) or $header
+		all of ( $rev* ) or all of ( $unicode* ) or $header
 }
 /*
  * YARA Rule Set
  * Repository Name: JPCERTCC
  * Repository: https://github.com/JPCERTCC/MalConfScan/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 19ec0d145535a6a4cfd37c0960114f455a8c343e
  * Number of Rules: 30
  * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
@@ -213224,13 +213039,13 @@ rule JPCERTCC_Tscookie_1
 	meta:
 		description = "detect TSCookie in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "5407a5c9-2fc5-5b9b-977f-81384a343d15"
+		id = "792e39d1-2f21-5b98-840a-2f0c96f99772"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L8-L21"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "71e51ceb51cff25abefd698ce33f32388cc28ad5936f30fbbb9925d9af79ad85"
+		logic_hash = "v1_sha256_71e51ceb51cff25abefd698ce33f32388cc28ad5936f30fbbb9925d9af79ad85"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213249,13 +213064,13 @@ rule JPCERTCC_TSC_Loader
 	meta:
 		description = "detect TSCookie Loader in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "378cc8a3-6a76-50d1-b1d2-1a6ca1a75a46"
+		id = "ebb5027d-8f28-5975-a84a-00b4f5bbd3f4"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L23-L35"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "c825253ba897f0f7310162d0473e645dc40b421e9251977384cca2fdc735f7a8"
+		logic_hash = "v1_sha256_c825253ba897f0f7310162d0473e645dc40b421e9251977384cca2fdc735f7a8"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213273,13 +213088,13 @@ rule JPCERTCC_Redleaves
 	meta:
 		description = "detect RedLeaves in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "e17a85de-6a15-5de5-ba9e-03ac6d896d7d"
+		id = "29802ff1-599d-544f-b11e-ff08345feede"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://blogs.jpcert.or.jp/en/2017/05/volatility-plugin-for-detecting-redleaves-malware.html"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L53-L66"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "c79815dd26070184688d43b336dc2be07df5e2236e60c8ecc42f5efec2cab190"
+		logic_hash = "v1_sha256_c79815dd26070184688d43b336dc2be07df5e2236e60c8ecc42f5efec2cab190"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213298,13 +213113,13 @@ rule JPCERTCC_Himawari
 	meta:
 		description = "detect Himawari(a variant of RedLeaves) in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "85c33dc6-0f9b-5645-b236-f416df16b4a4"
+		id = "031e4ddd-21e8-5143-902f-300fabaa53b9"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://www.jpcert.or.jp/present/2018/JSAC2018_01_nakatsuru.pdf"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L68-L82"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "9014e6e02fb9d8fa0f646c61647ab28c3cb08f10f8f584ddd11eba27211307f5"
+		logic_hash = "v1_sha256_9014e6e02fb9d8fa0f646c61647ab28c3cb08f10f8f584ddd11eba27211307f5"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213324,13 +213139,13 @@ rule JPCERTCC_Lavender
 	meta:
 		description = "detect Lavender(a variant of RedLeaves) in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "8c30ae73-161f-5117-a1f9-fad0bd5278de"
+		id = "56e4dc21-0c8b-5007-b8ac-80416c8bb180"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L84-L97"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "bf64f927e2c8e9be0f11497f94357de8e3fadcf09ba224d6fec92841c89c1dc5"
+		logic_hash = "v1_sha256_bf64f927e2c8e9be0f11497f94357de8e3fadcf09ba224d6fec92841c89c1dc5"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213349,13 +213164,13 @@ rule JPCERTCC_Armadill
 	meta:
 		description = "detect Armadill(a variant of RedLeaves) in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "0e6fb091-5c26-5419-ac99-5ddc9db29fc0"
+		id = "57f17a57-4350-5328-b08e-c0095975e987"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L99-L111"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "a76d434469a45e1c48b8ec3dc9622017c78ea52824006ddfcf3c368fbda7c912"
+		logic_hash = "v1_sha256_a76d434469a45e1c48b8ec3dc9622017c78ea52824006ddfcf3c368fbda7c912"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213373,13 +213188,13 @@ rule JPCERTCC_Zark20Rk
 	meta:
 		description = "detect zark20rk(a variant of RedLeaves) in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "baf3ebfe-80dd-5601-9ba9-8866b6ab6f14"
+		id = "1baeca4e-cc6f-5970-a81d-e77a10f85944"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L113-L126"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "07c5c97916bd9ec19591d90f8b7d872fca571f3479148157cf1ee9e05c272e5c"
+		logic_hash = "v1_sha256_07c5c97916bd9ec19591d90f8b7d872fca571f3479148157cf1ee9e05c272e5c"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213398,13 +213213,13 @@ rule JPCERTCC_Ursnif_1
 	meta:
 		description = "detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "e93bc13b-33a9-5d9a-92a9-52f16a97fb16"
+		id = "12b65964-2b82-55c7-b6cb-8aa59b0d7195"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L128-L158"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "6c224b43e8ec0fa9540a1fdedce7ce4b97f8ab7196a9619594b7dcb9c2dc5169"
+		logic_hash = "v1_sha256_6c224b43e8ec0fa9540a1fdedce7ce4b97f8ab7196a9619594b7dcb9c2dc5169"
 		score = 60
 		quality = 60
 		tags = ""
@@ -213433,20 +213248,20 @@ rule JPCERTCC_Ursnif_1
 		$f3 = { 35 0A 60 2E 51 }
 
 	condition:
-		$a1 or ($b1 and 3 of ($c*)) or (5 of ($c*)) or ($b1 and all of ($d*)) or all of ($e*) or all of ($f*)
+		$a1 or ( $b1 and 3 of ( $c* ) ) or ( 5 of ( $c* ) ) or ( $b1 and all of ( $d* ) ) or all of ( $e* ) or all of ( $f* )
 }
 rule JPCERTCC_Emotet_1
 {
 	meta:
 		description = "detect Emotet in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "f1cb5e3e-069d-54bb-829d-2ff4aa80e2bb"
+		id = "afadbd62-700a-59a8-8279-6a4e6f7587fe"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L160-L176"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "32f6c25f324eb9f79b8f0b4bc37d648ed95d6347712208f13f74584ee164dc4f"
+		logic_hash = "v1_sha256_32f6c25f324eb9f79b8f0b4bc37d648ed95d6347712208f13f74584ee164dc4f"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213461,20 +213276,20 @@ rule JPCERTCC_Emotet_1
 		$v7b = { 83 E6 0F 8B CF 83 C6 04 50 8B D6 E8 ?? ?? ?? ?? 59 6A 2F 8D 3C 77 58 66 89 07 83 C7 02 4B 75 }
 
 	condition:
-		all of ($v4*) or $v5a or $v6a or all of ($v7*)
+		all of ( $v4* ) or $v5a or $v6a or all of ( $v7* )
 }
 rule JPCERTCC_Smokeloader_1
 {
 	meta:
 		description = "detect SmokeLoader in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "19666821-1fe9-50e7-958e-22f2260099aa"
+		id = "3a5d6e1f-595e-5736-af4e-fd37004350fe"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://www.cert.pl/en/news/single/dissecting-smoke-loader/"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L178-L191"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "11b7a297d3dcacba57de9b04a6d126970c2be9d5551f7976ac8129b0afbc9bfd"
+		logic_hash = "v1_sha256_11b7a297d3dcacba57de9b04a6d126970c2be9d5551f7976ac8129b0afbc9bfd"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213493,13 +213308,13 @@ rule JPCERTCC_Hawkeye
 	meta:
 		description = "detect HawkEye in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "fc988aaf-bdac-5a53-a90c-d35d86285cd6"
+		id = "915fa6c9-f2a1-52be-b659-472ca126c28f"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L259-L272"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "45256e1e56de3934d2e57a7c036d49a0f56c25538ed7ad3eb7ee8efa7f549e98"
+		logic_hash = "v1_sha256_45256e1e56de3934d2e57a7c036d49a0f56c25538ed7ad3eb7ee8efa7f549e98"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213518,13 +213333,13 @@ rule JPCERTCC_Lokibot
 	meta:
 		description = "detect Lokibot in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "12e8469b-83e9-5f93-a543-1c2efb4d303a"
+		id = "6fc5cf5f-27af-5fbf-8a2f-1b1ecdf02587"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L274-L288"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "3d2db6acb565d705ba26acb7f75be24096ab619a03726f4898391bfe5944bc46"
+		logic_hash = "v1_sha256_3d2db6acb565d705ba26acb7f75be24096ab619a03726f4898391bfe5944bc46"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213544,13 +213359,13 @@ rule JPCERTCC_Bebloh
 	meta:
 		description = "detect Bebloh(a.k.a. URLZone) in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "7c3decb2-9cb5-5569-bab2-982c769ee233"
+		id = "f8e4eb97-ecfc-5b4c-9120-478de3cf3d85"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L290-L304"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "22b8ae9d40d34f83d8cc6c2dab56a866c8de8c9cc38b5da962c7071302f91f03"
+		logic_hash = "v1_sha256_22b8ae9d40d34f83d8cc6c2dab56a866c8de8c9cc38b5da962c7071302f91f03"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213570,13 +213385,13 @@ rule JPCERTCC_Xxmm
 	meta:
 		description = "detect xxmm in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "be459cbf-84a1-539e-b0b5-b7a00b6d278d"
+		id = "76ea7d04-8863-5307-acf7-1e705532ff9a"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L306-L319"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "4a860ac3efb97ce03fa906c2d0e7cd08654f6e82531d9449af7891be83a036d5"
+		logic_hash = "v1_sha256_4a860ac3efb97ce03fa906c2d0e7cd08654f6e82531d9449af7891be83a036d5"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213595,13 +213410,13 @@ rule JPCERTCC_Azorult_1
 	meta:
 		description = "detect Azorult in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "c73a007c-4d5f-5504-9635-9bffe1282aef"
+		id = "2971df05-7be9-57dc-9fea-4abfaa2ada3d"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L321-L334"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "158d65dcd8f3ce8fe4ab2d9bcc97edf585c1d665cc54e1e4969ef83c8103a149"
+		logic_hash = "v1_sha256_158d65dcd8f3ce8fe4ab2d9bcc97edf585c1d665cc54e1e4969ef83c8103a149"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213620,13 +213435,13 @@ rule JPCERTCC_Poisonivy
 	meta:
 		description = "detect PoisonIvy in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "e7b27a88-490f-5f79-9e8c-65b8f7505a72"
+		id = "bcac1161-5442-5841-977e-b717478fdba2"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L336-L349"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "dec7a95c877078f77cbcdcf8646680f6f1d55d438af98e519d13461a7854b095"
+		logic_hash = "v1_sha256_dec7a95c877078f77cbcdcf8646680f6f1d55d438af98e519d13461a7854b095"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213645,13 +213460,13 @@ rule JPCERTCC_Netwire
 	meta:
 		description = "detect netwire in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "cf71b80f-2618-5209-bb49-fefea9e0a7f3"
+		id = "76256e5c-0bd8-53d6-abfc-74b39a956def"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L351-L367"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "fa6ec967b6b3de226dcdb06d6b8f684800331a2420f038dd6274a8b9c3d8be78"
+		logic_hash = "v1_sha256_fa6ec967b6b3de226dcdb06d6b8f684800331a2420f038dd6274a8b9c3d8be78"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213666,20 +213481,20 @@ rule JPCERTCC_Netwire
 		$log = "[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
 
 	condition:
-		($v1) or ($v2 and $v3 and $v4) or ($ping and $log)
+		($v1 ) or ( $v2 and $v3 and $v4 ) or ( $ping and $log )
 }
 rule JPCERTCC_Nanocore
 {
 	meta:
 		description = "detect Nanocore in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "0b12ad94-99c2-5d48-a860-ff75b82971af"
+		id = "21234914-8c17-5f7e-8ed8-7c478bb2a621"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L369-L382"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "471dcda6f5fb9c30e3a1df7171fdba889114d54166d038d18c7910e2765d5250"
+		logic_hash = "v1_sha256_471dcda6f5fb9c30e3a1df7171fdba889114d54166d038d18c7910e2765d5250"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213698,13 +213513,13 @@ rule JPCERTCC_Formbook_1
 	meta:
 		description = "detect Formbook in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "71291f9b-eb8e-55e5-a499-df54c35efdbf"
+		id = "2b5303ca-6c3f-5e9b-9771-2c78ff002cc7"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L384-L397"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "62bd3717af8970f67f28d923ce2483ff55a5ef4585a183d4d510e3a2c45fcc8c"
+		logic_hash = "v1_sha256_62bd3717af8970f67f28d923ce2483ff55a5ef4585a183d4d510e3a2c45fcc8c"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213723,13 +213538,13 @@ rule JPCERTCC_Agenttesla_Type1
 	meta:
 		description = "detect Agenttesla in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "92bfb3ab-d8d0-50ec-8ab8-ad34f1edb906"
+		id = "55b3ab81-d7f0-581b-ba06-18edf827ae4a"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L399-L411"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "24b9b815400967a9086048527f7aa1fce08bcd94a16aec8080aeac97045b297a"
+		logic_hash = "v1_sha256_24b9b815400967a9086048527f7aa1fce08bcd94a16aec8080aeac97045b297a"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213748,13 +213563,13 @@ rule JPCERTCC_Agenttesla_Type2 : FILE
 	meta:
 		description = "detect Agenttesla in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "6a0b8075-4a7a-56e8-99d2-794340fd1f8b"
+		id = "b2f7899e-0065-53ed-bc89-f54ba30fdbbd"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L413-L427"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "22f0a7e8f542aa1861f580a2ec3fb2b58ff0ac5d1c606ced0d207a3c350c3633"
+		logic_hash = "v1_sha256_22f0a7e8f542aa1861f580a2ec3fb2b58ff0ac5d1c606ced0d207a3c350c3633"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -213768,20 +213583,20 @@ rule JPCERTCC_Agenttesla_Type2 : FILE
 		$type2db4 = "Berkelet DB" wide
 
 	condition:
-		( uint16(0)==0x5A4D) and 3 of them
+		( uint16( 0 ) == 0x5A4D ) and 3 of them
 }
 rule JPCERTCC_Noderat
 {
 	meta:
 		description = "detect Noderat in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "9c2c4b0f-0f45-54f6-a98c-b592af882eef"
+		id = "f6ffb336-c300-5f42-9b23-7ca3e02febef"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L429-L442"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "e1254b6cf28161943db202ea0a6ff2d86aa7975d4a3ecc0f26eed58101e54960"
+		logic_hash = "v1_sha256_e1254b6cf28161943db202ea0a6ff2d86aa7975d4a3ecc0f26eed58101e54960"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213800,13 +213615,13 @@ rule JPCERTCC_Njrat
 	meta:
 		description = "detect njRAT in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "96b35796-3e1d-5721-998a-e678612e4de7"
+		id = "dda849d8-b7af-52be-99ac-f19b3ceb5ea2"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://github.com/JPCERTCC/MalConfScan/"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L444-L456"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "398614ff5ea37dfaf6c36f60702cb7cdfe66b4569c698e9c3ea29563e4031856"
+		logic_hash = "v1_sha256_398614ff5ea37dfaf6c36f60702cb7cdfe66b4569c698e9c3ea29563e4031856"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213826,13 +213641,13 @@ rule JPCERTCC_Trickbot
 	meta:
 		description = "detect TrickBot in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "1a3c5193-bea1-5f64-be40-47bd22c09772"
+		id = "4b6202c2-232a-51fe-bf07-5d54a48a8b57"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://github.com/JPCERTCC/MalConfScan/"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L458-L478"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "b0c3437bc4b4f9e7b2a1562e2d514b7aad398d5e387bb79829757b5772a1ebc3"
+		logic_hash = "v1_sha256_b0c3437bc4b4f9e7b2a1562e2d514b7aad398d5e387bb79829757b5772a1ebc3"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213853,20 +213668,20 @@ rule JPCERTCC_Trickbot
 		$dllname = { 6C 00 00 00 CC 00 00 00 19 01 00 00 00 00 00 00 1A 01 }
 
 	condition:
-		all of ($tagm*) or all of ($tagc*) or all of ($tagi*) or all of ($tags*) or all of ($tagl*) or $dllname
+		all of ( $tagm* ) or all of ( $tagc* ) or all of ( $tagi* ) or all of ( $tags* ) or all of ( $tagl* ) or $dllname
 }
 rule JPCERTCC_Remcos_1
 {
 	meta:
 		description = "detect Remcos in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "4a27a16a-2669-5009-bc82-082ec0c9b2c1"
+		id = "484b3454-44f3-5142-88c2-f735ea3fc770"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://github.com/JPCERTCC/MalConfScan/"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L480-L493"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "1b4b9f7a88f33faeda71ea9a354eeccba8889800f48a6280c4ec533bb1b3ef3d"
+		logic_hash = "v1_sha256_1b4b9f7a88f33faeda71ea9a354eeccba8889800f48a6280c4ec533bb1b3ef3d"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213880,20 +213695,20 @@ rule JPCERTCC_Remcos_1
 		$resource = "SETTINGS" ascii wide fullword
 
 	condition:
-		1 of ($url*) and $remcos and $resource
+		1 of ( $url* ) and $remcos and $resource
 }
 rule JPCERTCC_Quasar
 {
 	meta:
 		description = "detect QuasarRAT in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "f0a81a46-c19b-5012-a1a2-f2f4310fcde3"
+		id = "4fc48a28-85d6-5c8a-bbf0-1dfc8b551faf"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://github.com/JPCERTCC/MalConfScan/"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L495-L513"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "a3bb45f2ea217ae1825d80e1ead9c3e47ca88575c960ce1f9feb2db09f489e08"
+		logic_hash = "v1_sha256_a3bb45f2ea217ae1825d80e1ead9c3e47ca88575c960ce1f9feb2db09f489e08"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213912,21 +213727,21 @@ rule JPCERTCC_Quasar
 		$resource = { 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 73 00 00 17 69 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 69 00 6F 00 6E 00 00 }
 
 	condition:
-		(( all of ($quasarstr*) or all of ($sql*)) and $resource) or all of ($net*)
+		(( all of ( $quasarstr* ) or all of ( $sql* ) ) and $resource ) or all of ( $net* )
 }
 rule JPCERTCC_Elf_Plead
 {
 	meta:
 		description = "ELF_PLEAD"
 		author = "JPCERT/CC Incident Response Group"
-		id = "12f93939-812f-52b6-9582-b375bb361892"
+		id = "2d291c78-de65-5dd4-b134-92d41fbf0976"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://github.com/JPCERTCC/MalConfScan/"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L515-L529"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
 		hash = "f704303f3acc2fd090145d5ee893914734d507bd1e6161f82fb34d45ab4a164b"
-		logic_hash = "088d17afe77076f8b1e5f7cb285d825d597d9c971a03f878bf64b6d2af14a01f"
+		logic_hash = "v1_sha256_088d17afe77076f8b1e5f7cb285d825d597d9c971a03f878bf64b6d2af14a01f"
 		score = 75
 		quality = 80
 		tags = ""
@@ -213946,13 +213761,13 @@ rule JPCERTCC_Asyncrat
 	meta:
 		description = "detect AsyncRat in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "758614e8-df93-54ff-9f06-0020b54fbf88"
+		id = "3a957c59-5780-5eb2-b8e6-92d48c9d2509"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L531-L548"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "0a60718ea3412129c40e2eee53591dbf094a6b914502242b5ab9b54f8fd95da0"
+		logic_hash = "v1_sha256_0a60718ea3412129c40e2eee53591dbf094a6b914502242b5ab9b54f8fd95da0"
 		score = 75
 		quality = 76
 		tags = ""
@@ -213969,20 +213784,20 @@ rule JPCERTCC_Asyncrat
 		$s3 = "Stub.exe" ascii wide
 
 	condition:
-		($salt and (2 of ($s*) or 1 of ($b*))) or ( all of ($b*) and 2 of ($s*))
+		($salt and ( 2 of ( $s* ) or 1 of ( $b* ) ) ) or ( all of ( $b* ) and 2 of ( $s* ) )
 }
 rule JPCERTCC_Wellmess : FILE
 {
 	meta:
 		description = "detect WellMess in memory"
 		author = "JPCERT/CC Incident Response Group"
-		id = "07084b85-b4fa-5534-aca5-1ddac3a3988b"
+		id = "f6693695-2f70-5147-9b8c-cb8b86be233d"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "internal research"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L550-L569"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "1f5a1ba51dd99eadaf5de344539712057f4635b060d4f306b50a6ecb65931970"
+		logic_hash = "v1_sha256_1f5a1ba51dd99eadaf5de344539712057f4635b060d4f306b50a6ecb65931970"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -214001,21 +213816,21 @@ rule JPCERTCC_Wellmess : FILE
 		$dotnet4 = "AES_Encrypt" ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and ( all of ($botlib*) or all of ($dotnet*))
+		( uint16( 0 ) == 0x5A4D ) and ( all of ( $botlib* ) or all of ( $dotnet* ) )
 }
 rule JPCERTCC_Elf_Wellmess : FILE
 {
 	meta:
 		description = "ELF_Wellmess"
 		author = "JPCERT/CC Incident Response Group"
-		id = "3e6cb461-fc51-5ea6-bd6f-6dab11d5704c"
+		id = "666f4edf-9019-5080-a0b9-127abf86180a"
 		date = "2021-08-16"
 		modified = "2021-08-16"
 		reference = "https://github.com/JPCERTCC/MalConfScan/"
 		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L571-L584"
 		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
 		hash = "00654dd07721e7551641f90cba832e98c0acb030e2848e5efc0e1752c067ec07"
-		logic_hash = "99789bba9c398b7927b3ab42bb4df40e5470e0816cc048dcc7d09c6a78a1a505"
+		logic_hash = "v1_sha256_99789bba9c398b7927b3ab42bb4df40e5470e0816cc048dcc7d09c6a78a1a505"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -214027,13 +213842,13 @@ rule JPCERTCC_Elf_Wellmess : FILE
 		$botlib4 = "botlib.AES_Encrypt" ascii
 
 	condition:
-		( uint32(0)==0x464C457F) and all of ($botlib*)
+		( uint32( 0 ) == 0x464C457F ) and all of ( $botlib* )
 }
 /*
  * YARA Rule Set
  * Repository Name: SecuInfra
  * Repository: https://github.com/SIFalcon/Detection
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd
  * Number of Rules: 45
  * Skipped: 0 (age), 11 (quality), 0 (score), 0 (importance)
@@ -214048,13 +213863,13 @@ rule SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_Usage
 	meta:
 		description = "Detects the frequent usage of Wscript to get an hex encoded string from an array and interpret it. Used by e.g WSHRAT"
 		author = "SECUINFRA Falcon Team"
-		id = "dd55753e-4f7b-56be-a6d4-66f1d7dc8747"
+		id = "5e8eb5c8-6e90-52c2-8192-97e37cfe89fd"
 		date = "2022-12-02"
 		modified = "2022-02-13"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/javascript_obfuscation.yar#L2-L19"
 		license_url = "N/A"
-		logic_hash = "62bc3261b3c2e902a82423239a7ee0bcedfccbeeeda11833b935197144dc7c35"
+		logic_hash = "v1_sha256_62bc3261b3c2e902a82423239a7ee0bcedfccbeeeda11833b935197144dc7c35"
 		score = 75
 		quality = 70
 		tags = ""
@@ -214067,20 +213882,20 @@ rule SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_Usage
 		$hex_enc_str4 = "\\x41\\x72\\x67\\x75"
 
 	condition:
-		#wscript>30 and 2 of ($hex_enc_str*)
+		#wscript> 30 and 2 of ( $hex_enc_str* )
 }
 rule SECUINFRA_OBFUS_VBS_Reverse_Startup : FILE
 {
 	meta:
 		description = "Detecs reversed StartUp Path. Sometimes used as obfuscation"
 		author = "SECUINFRA Falcon Team"
-		id = "ecb96e30-0ac0-530a-83af-bb030f7dce4c"
+		id = "d9b08c0a-6ad6-513f-a8db-22ffecf584f6"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/vbs_obfuscation.yar#L2-L13"
 		license_url = "N/A"
-		logic_hash = "7b4d56d3bbe8d16d5e01fa9a021a368feb28b8b062860df76a2569966a97b8bc"
+		logic_hash = "v1_sha256_7b4d56d3bbe8d16d5e01fa9a021a368feb28b8b062860df76a2569966a97b8bc"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -214089,20 +213904,20 @@ rule SECUINFRA_OBFUS_VBS_Reverse_Startup : FILE
 		$reverse = "\\putratS\\smargorP\\uneM" wide nocase
 
 	condition:
-		filesize <200KB and $reverse
+		filesize < 200KB and $reverse
 }
 rule SECUINFRA_OBFUS_Powershell_Execution : FILE
 {
 	meta:
 		description = "Detects some variations of obfuscated PowerShell code to execute further PowerShell code"
 		author = "SECUINFRA Falcon Team"
-		id = "b32c2a92-599c-5916-a335-dc996dcdc1bf"
+		id = "75e9a4d3-a048-5958-97bc-13a6cc4128f7"
 		date = "2022-09-02"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/powershell_obfuscation.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "b201774edc4a20a0035cd68898a785a6c2fc03fb8739d515196e428d4a88af70"
+		logic_hash = "v1_sha256_b201774edc4a20a0035cd68898a785a6c2fc03fb8739d515196e428d4a88af70"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -214113,20 +213928,20 @@ rule SECUINFRA_OBFUS_Powershell_Execution : FILE
 		$b1 = "SQBFAF"
 
 	condition:
-		filesize <300KB and $b1 and 1 of ($a*)
+		filesize < 300KB and $b1 and 1 of ( $a* )
 }
 rule SECUINFRA_OBFUS_Powershell_Replace_Tilde : FILE
 {
 	meta:
 		description = "Detects usage of Replace to replace tilde. Often observed in obfuscation"
 		author = "SECUINFRA Falcon Team"
-		id = "59b68982-01ae-588a-9802-bb92c72342a8"
+		id = "79f51545-31ad-58fd-843f-397fa485e6e8"
 		date = "2022-10-02"
 		modified = "2022-02-27"
 		reference = "https://bazaar.abuse.ch/sample/4c391b57d604c695925938bfc10ceb4673edd64e9655759c2aead9e12b3e17cf/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/powershell_obfuscation.yar#L19-L32"
 		license_url = "N/A"
-		logic_hash = "a2693757f9aedc1019a94a15ae00f87af852d319aa698dadd7f9bb98128622a0"
+		logic_hash = "v1_sha256_a2693757f9aedc1019a94a15ae00f87af852d319aa698dadd7f9bb98128622a0"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -214135,20 +213950,20 @@ rule SECUINFRA_OBFUS_Powershell_Replace_Tilde : FILE
 		$a = ".Replace(\"~\",\"0\")"
 
 	condition:
-		filesize <400KB and $a
+		filesize < 400KB and $a
 }
 rule SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23
 {
 	meta:
 		description = "Detects PlugX-style Malware delivery via removable Drives (USB) - LNK File"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "14c2e37e-91d7-5b66-916f-a1544a69a6fc"
+		id = "5d64ddf9-748d-57bb-a757-460448d10034"
 		date = "2023-06-21"
 		modified = "2023-06-21"
 		reference = "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_PlugX_USB_Delivery_Jun21.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "afbbaf44e97b6db584780e0739bffd9c70e05e86284cb25b25a9d02cbeffff1f"
+		logic_hash = "v1_sha256_afbbaf44e97b6db584780e0739bffd9c70e05e86284cb25b25a9d02cbeffff1f"
 		score = 75
 		quality = 70
 		tags = ""
@@ -214164,20 +213979,20 @@ rule SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23
 		$s_comspec = "%ComSpec%" ascii
 
 	condition:
-		$lnk_magic at 0x0 and any of ($s_*) and ($driveletter_4X or $driveletter_5X)
+		$lnk_magic at 0x0 and any of ( $s_* ) and ( $driveletter_4X or $driveletter_5X )
 }
 rule SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23
 {
 	meta:
 		description = "Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Icon File; could potentially yield FPs"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "faaa507f-8478-5412-be86-4cae7fe28d21"
+		id = "6bb49a2f-d149-5f5a-b6e7-89c05a1f6ee1"
 		date = "2023-06-21"
 		modified = "2023-06-21"
 		reference = "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_PlugX_USB_Delivery_Jun21.yar#L33-L49"
 		license_url = "N/A"
-		logic_hash = "1cf552c4627073d13832cf0ac602a610e0919af9e9a197aa07fef5d6a414644b"
+		logic_hash = "v1_sha256_1cf552c4627073d13832cf0ac602a610e0919af9e9a197aa07fef5d6a414644b"
 		score = 75
 		quality = 70
 		tags = ""
@@ -214188,20 +214003,20 @@ rule SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23
 		$s_IconRes = "IconResource=C:\\Windows\\system32\\SHELL32.dll,7" ascii
 
 	condition:
-		all of ($s_*)
+		all of ( $s_* )
 }
 rule SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23
 {
 	meta:
 		description = "Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Recycle Bin; could potentially yield FPs"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "026eba63-12c1-55aa-b736-aea0494c1ab9"
+		id = "1df504b9-5385-5a3a-a7b9-8acfb3ecbbaa"
 		date = "2023-06-21"
 		modified = "2023-06-21"
 		reference = "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_PlugX_USB_Delivery_Jun21.yar#L51-L70"
 		license_url = "N/A"
-		logic_hash = "af5a1f20e46d9db3a9b50b5d8845e60f058c2885a560756266afbd8f3a01bf1e"
+		logic_hash = "v1_sha256_af5a1f20e46d9db3a9b50b5d8845e60f058c2885a560756266afbd8f3a01bf1e"
 		score = 75
 		quality = 70
 		tags = ""
@@ -214213,20 +214028,20 @@ rule SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23
 		$neg_LRN = "shell32.dll,-8964" ascii
 
 	condition:
-		all of ($s_*) and not $neg_LRN
+		all of ( $s_* ) and not $neg_LRN
 }
 rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23
 {
 	meta:
 		description = "Detects the ESXiArgs Ransomware encryption bash script"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "dafcb312-bad2-5dcc-8260-80d09e11853b"
+		id = "6e3f98ef-3b38-5de9-a395-74487634f274"
 		date = "2023-02-07"
 		modified = "2023-02-07"
 		reference = "https://secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_ESXiArgs_Ransomware_Bash_Feb23.yar#L1-L45"
 		license_url = "N/A"
-		logic_hash = "e9838fd86e25c434f419dcc8d37a56f4f83c38930b0558181585bbfe77cd1baf"
+		logic_hash = "v1_sha256_e9838fd86e25c434f419dcc8d37a56f4f83c38930b0558181585bbfe77cd1baf"
 		score = 75
 		quality = 70
 		tags = ""
@@ -214254,20 +214069,20 @@ rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23
 		$clean1 = "/bin/echo '' > /etc/rc.local.d/local.sh"
 
 	condition:
-		$bash and $wait and any of ($comment*) and 2 of ($kill*) and $index and 4 of ($ext*) and 2 of ($clean*)
+		$bash and $wait and any of ( $comment* ) and 2 of ( $kill* ) and $index and 4 of ( $ext* ) and 2 of ( $clean* )
 }
 rule SECUINFRA_MALWARE_Formbook_Filename_Stage_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - SecuInfra"
 		author = "SECUINFRA Falcon Team"
-		id = "74ae157c-30b3-5f07-83a3-6bc9e854fa84"
+		id = "6bdca5e0-26d8-5341-a3f0-eb90a708c8b6"
 		date = "2022-02-19"
 		modified = "2022-02-27"
 		reference = "https://bazaar.abuse.ch/sample/295a708fd87173762a4971443304e23990462f94e8db48d83472f19425daaa87"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/formbook.yar#L2-L14"
 		license_url = "N/A"
-		logic_hash = "707fa457a99b47419b0b77716ed1f61cdb493f04cc26a156f903a30ef30ac428"
+		logic_hash = "v1_sha256_707fa457a99b47419b0b77716ed1f61cdb493f04cc26a156f903a30ef30ac428"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -214277,21 +214092,21 @@ rule SECUINFRA_MALWARE_Formbook_Filename_Stage_2 : FILE
 		$name = "PDF-Scan180220225499044" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and $name
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and $name
 }
 rule SECUINFRA_RANSOM_Magniber_LNK_Jan23
 {
 	meta:
 		description = "Detects Magniber Ransomware LNK files from fake Windows Update delivery method"
 		author = "SECUINFRA Falcon Team"
-		id = "2459a9e9-a6bb-50fc-9920-7632fdec7e91"
+		id = "ae044f24-ef62-5659-a582-106c6bddbb09"
 		date = "2023-01-13"
 		modified = "2023-01-13"
 		reference = "https://twitter.com/SI_FalconTeam/status/1613540054382559234"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_Magniber_LNK_Jan23.yar#L1-L18"
 		license_url = "N/A"
 		hash = "16ecec4efa2174dec11f6a295779f905c8f593ab5cc96ae0f5249dc50469841c"
-		logic_hash = "074611d74e382bb19a45b052b5b2cc186bf3667420cb1625e9bda37f2e9774c5"
+		logic_hash = "v1_sha256_074611d74e382bb19a45b052b5b2cc186bf3667420cb1625e9bda37f2e9774c5"
 		score = 75
 		quality = 70
 		tags = ""
@@ -214302,20 +214117,20 @@ rule SECUINFRA_RANSOM_Magniber_LNK_Jan23
 		$macAddress = {00 0C 29 07 E1 6D}
 
 	condition:
-		uint32be(0x0)==0x4C000000 and all of them
+		uint32be( 0x0 ) == 0x4C000000 and all of them
 }
 rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Encryptor_Feb23
 {
 	meta:
 		description = "Detects the ESXiArgs Ransomware 'encrypt' binary"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "e91398bd-c8b5-5702-974e-017d2c0f6054"
+		id = "74731dbb-65cc-5b33-ae64-35c48c732fdd"
 		date = "2023-02-07"
 		modified = "2023-02-07"
 		reference = "https://secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_ESXiArgs_Ransomware_Encrypt_Feb23.yar#L1-L32"
 		license_url = "N/A"
-		logic_hash = "f0c9858275f547d4cf7d907377f079b817bf69cae9940b134e523bd7794d6f3b"
+		logic_hash = "v1_sha256_f0c9858275f547d4cf7d907377f079b817bf69cae9940b134e523bd7794d6f3b"
 		score = 75
 		quality = 70
 		tags = ""
@@ -214331,7 +214146,7 @@ rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Encryptor_Feb23
 		$help = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]"
 
 	condition:
-		uint32be(0x0)==0x7F454C46 and all of ($sosemanuk_*) and $interpreter and 2 of ($debug*) and $help
+		uint32be( 0x0 ) == 0x7F454C46 and all of ( $sosemanuk_* ) and $interpreter and 2 of ( $debug* ) and $help
 }
 import "pe"
 
@@ -214340,13 +214155,13 @@ rule SECUINFRA_RANSOM_Medusalocker_July22 : RANSOMWARE FILE
 	meta:
 		description = "Detects MedusaLocker Ransomware"
 		author = "SECUINFRA Falcon Team"
-		id = "ca8c4ab6-cb7d-5b1d-a3c3-6921133c646c"
+		id = "78617397-85c6-5796-8b29-0b64cb21bd16"
 		date = "2022-07-08"
 		modified = "2022-07-08"
 		reference = "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-181A_stopransomware_medusalocker.pdf"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_MedusaLocker_July22.yar#L3-L68"
 		license_url = "N/A"
-		logic_hash = "f585e29cf8d381813e489296b88fbd8ebd0e48b48395237b264596f54e0db472"
+		logic_hash = "v1_sha256_f585e29cf8d381813e489296b88fbd8ebd0e48b48395237b264596f54e0db472"
 		score = 75
 		quality = 68
 		tags = "RANSOMWARE, FILE"
@@ -214394,21 +214209,21 @@ rule SECUINFRA_RANSOM_Medusalocker_July22 : RANSOMWARE FILE
 		$system5 = "wmic.exe SHADOWCOPY /nointeractive" wide
 
 	condition:
-		uint16(0)==0x5a4d and pe.imphash()=="1a395bd10b20c116b11c2db5ee44c225" and filesize >450KB and filesize <1MB and all of ($log*) and $mutex and any of ($uacbypass*) and 2 of ($note*) and $ext and $services and 2 of ($system*)
+		uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "1a395bd10b20c116b11c2db5ee44c225" and filesize > 450KB and filesize < 1MB and all of ( $log* ) and $mutex and any of ( $uacbypass* ) and 2 of ( $note* ) and $ext and $services and 2 of ( $system* )
 }
 rule SECUINFRA_RANSOM_Magniber_ISO_Jan23 : FILE
 {
 	meta:
 		description = "Detects Magniber Ransomware ISO files from fake Windows Update delivery method"
 		author = "SECUINFRA Falcon Team"
-		id = "6d5a937d-ac31-5c59-8e93-3fadc772d132"
+		id = "01634001-d4ff-516c-ad95-13798c1cb7bb"
 		date = "2023-01-13"
 		modified = "2023-01-13"
 		reference = "https://twitter.com/SI_FalconTeam/status/1613540054382559234"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_Magniber_ISO_Jan23.yar#L1-L24"
 		license_url = "N/A"
 		hash = "4dcbcc070e7e3d0696c777b63e185406e3042de835b734fe7bb33cc12e539bf6"
-		logic_hash = "238baa794f4a87102534f7d6901819aa1b5dbb8156d56fb311e9fb1a6bc77f30"
+		logic_hash = "v1_sha256_238baa794f4a87102534f7d6901819aa1b5dbb8156d56fb311e9fb1a6bc77f30"
 		score = 75
 		quality = 68
 		tags = "FILE"
@@ -214422,20 +214237,20 @@ rule SECUINFRA_RANSOM_Magniber_ISO_Jan23 : FILE
 		$lnkMagic = {4C 00 00 00}
 
 	condition:
-		filesize >200KB and filesize <800KB and all of them
+		filesize > 200KB and filesize < 800KB and all of them
 }
 rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Python_Feb23
 {
 	meta:
 		description = "Detects the ESXiArgs Ransomware encryption bash script"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "6e2d6695-b727-5b71-bfa0-e8290e057c36"
+		id = "8f8775f6-725a-5b8e-803a-4eb2f84ece72"
 		date = "2023-02-07"
 		modified = "2023-02-07"
 		reference = "https://secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_ESXiArgs_Ransomware_Python_Feb23.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "b821d1829ab4fb5eea896156a303198d6531d734196f0f947aef5d46754e6ccb"
+		logic_hash = "v1_sha256_b821d1829ab4fb5eea896156a303198d6531d734196f0f947aef5d46754e6ccb"
 		score = 75
 		quality = 70
 		tags = ""
@@ -214454,10 +214269,10 @@ rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Python_Feb23
 		$listener = "HTTPServer(('127.0.0.1', 8008), PostServer).serve_forever()"
 
 	condition:
-		$python and $desc and 4 of ($command*) and $cmd and $OpenSLPPort and $listener
+		$python and $desc and 4 of ( $command* ) and $cmd and $OpenSLPPort and $listener
 }
-import "console"
 import "pe"
+import "console"
 import "math"
 
 rule SECUINFRA_RANSOM_Lockbit_Black_Packer : RANSOMWARE FILE
@@ -214465,13 +214280,13 @@ rule SECUINFRA_RANSOM_Lockbit_Black_Packer : RANSOMWARE FILE
 	meta:
 		description = "Detects the packer used by Lockbit Black (Version 3)"
 		author = "SECUINFRA Falcon Team"
-		id = "f4c1a12b-eb89-5a46-97a9-f0207ca1bbde"
+		id = "d09ad53a-eb4c-5697-86a1-0a603e53b8d4"
 		date = "2022-07-04"
 		modified = "2022-07-04"
 		reference = "https://twitter.com/vxunderground/status/1543661557883740161"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_Lockbit_Black_Packer.yar#L5-L40"
 		license_url = "N/A"
-		logic_hash = "cde7f5374b97b2462cfd951994b6bb3ef0962e1be71253e25ca14d53c3d3d615"
+		logic_hash = "v1_sha256_cde7f5374b97b2462cfd951994b6bb3ef0962e1be71253e25ca14d53c3d3d615"
 		score = 75
 		quality = 45
 		tags = "RANSOMWARE, FILE"
@@ -214488,20 +214303,20 @@ rule SECUINFRA_RANSOM_Lockbit_Black_Packer : RANSOMWARE FILE
 		$asciiCalc = {66 83 f8 41 ?? ?? 66 83 f8 46 ?? ?? 66 83 e8 37}
 
 	condition:
-		uint16(0)==0x5a4d and filesize >111KB and filesize <270KB and all of ($sectionname*) and any of ($check*) and $asciiCalc and for any i in (0..pe.number_of_sections-1) : (math.entropy(pe.sections[i].raw_data_offset,pe.sections[i].raw_data_size)>7.9 and (pe.sections[i].name==".text" or pe.sections[i].name==".data" or pe.sections[i].name==".pdata") and console.log("High Entropy section found:",pe.sections[i].name))
+		uint16( 0 ) == 0x5a4d and filesize > 111KB and filesize < 270KB and all of ( $sectionname* ) and any of ( $check* ) and $asciiCalc and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) > 7.9 and ( pe.sections [ i ] . name == ".text" or pe.sections [ i ] . name == ".data" or pe.sections [ i ] . name == ".pdata" ) and console.log ( "High Entropy section found:" , pe.sections [ i ] . name ) )
 }
 rule SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23
 {
 	meta:
 		description = "Detects Microsoft OneNote files used to deliver Emotet (.wsf Payload)"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "a9201240-407d-5ca9-b7fd-37372a2e7d2a"
+		id = "df7adc1c-943e-59dc-892c-9c87963127a5"
 		date = "2023-03-16"
 		modified = "2023-03-16"
 		reference = "https://www.secuinfra.com/en/news/the-whale-surfaces-again-emotet-epoch4-spam-botnet-returns/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_Emotet_OneNote_Delivery_wsf_Mar23.yar#L1-L33"
 		license_url = "N/A"
-		logic_hash = "ca48f5e694b18e3f0b89b0128817848a7d36f60d8a3ada522739849bf3f7126b"
+		logic_hash = "v1_sha256_ca48f5e694b18e3f0b89b0128817848a7d36f60d8a3ada522739849bf3f7126b"
 		score = 75
 		quality = 70
 		tags = ""
@@ -214521,7 +214336,7 @@ rule SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23
 		$endTmp = /rad.{5}\.tmp/
 
 	condition:
-		uint32be(0x0)==0xE4525C7B and any of ($s_*) and $script and $wsfExt and $GUIDwsf and $endTmp
+		uint32be( 0x0 ) == 0xE4525C7B and any of ( $s_* ) and $script and $wsfExt and $GUIDwsf and $endTmp
 }
 import "console"
 
@@ -214530,13 +214345,13 @@ rule SECUINFRA_HUNT_RTF_CVE_2023_21716_Mar23 : CVE_2023_21716
 	meta:
 		description = "Detects RTF documents with an inflated fonttable. Hunting for CVE-2023-21716"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "1b76f428-f2a8-5d1d-a78c-b4a70ac4f5db"
+		id = "2b1a8ff2-cee3-56a3-99fa-8a03899b25bb"
 		date = "2023-03-07"
 		modified = "2023-03-07"
 		reference = "https://www.bleepingcomputer.com/news/security/proof-of-concept-released-for-critical-microsoft-word-rce-bug/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Hunting/HUNT_RTF_CVE_2023_21716.yar#L3-L20"
 		license_url = "N/A"
-		logic_hash = "456008db725b8348f9f3851bb9aae9990e7613e1b9056846b121605c3e080297"
+		logic_hash = "v1_sha256_456008db725b8348f9f3851bb9aae9990e7613e1b9056846b121605c3e080297"
 		score = 50
 		quality = 70
 		tags = "CVE-2023-21716"
@@ -214546,20 +214361,20 @@ rule SECUINFRA_HUNT_RTF_CVE_2023_21716_Mar23 : CVE_2023_21716
 		$fonttbl_len = /\\fonttbl\{.{1,10}\;\}(\s.{1,10}\}){10,}/
 
 	condition:
-		uint32be(0x0)==0x7B5C7274 and !fonttbl_len[1]>256 and console.log("[!] Inflated fonttable with length: ",!fonttbl_len[1])
+		uint32be( 0x0 ) == 0x7B5C7274 and !fonttbl_len [ 1 ] > 256 and console.log ( "[!] Inflated fonttable with length: " , !fonttbl_len [ 1 ] )
 }
 rule SECUINFRA_SUSP_Scheduled_Tasks_Create_From_Susp_Dir : FILE
 {
 	meta:
 		description = "Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory"
 		author = "SECUINFRA Falcon Team"
-		id = "65aad597-c5fe-50c3-8970-19fb502f1602"
+		id = "af348eea-eb96-5149-89c5-4082957ce94e"
 		date = "2022-02-21"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Windows/windows_misc.yar#L2-L25"
 		license_url = "N/A"
-		logic_hash = "abe0592a8936898a43a1df9039829948f8a4a425c74cb970d2899d513c9cfffe"
+		logic_hash = "v1_sha256_abe0592a8936898a43a1df9039829948f8a4a425c74cb970d2899d513c9cfffe"
 		score = 60
 		quality = 25
 		tags = "FILE"
@@ -214577,20 +214392,20 @@ rule SECUINFRA_SUSP_Scheduled_Tasks_Create_From_Susp_Dir : FILE
 		$path3 = "AppData\\Local"
 
 	condition:
-		filesize <30KB and 1 of ($path*) and ($create and $execute) or ($trigger and $at_param) or ($register and $action)
+		filesize < 30KB and 1 of ( $path* ) and ( $create and $execute ) or ( $trigger and $at_param ) or ( $register and $action )
 }
 rule SECUINFRA_SUSP_Reverse_Run_Key : FILE
 {
 	meta:
 		description = "Detects a Reversed Run Key"
 		author = "SECUINFRA Falcon Team"
-		id = "230bed16-278e-574c-bb9b-cf6c44a7e9cd"
+		id = "4c46675f-c417-5ea1-a21c-5fe46920cf34"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Windows/windows_misc.yar#L27-L38"
 		license_url = "N/A"
-		logic_hash = "dcb1a7e2c688287d08ade3d75e5c3d0dde6b645889bd4ec09ce8c131d8d3265e"
+		logic_hash = "v1_sha256_dcb1a7e2c688287d08ade3d75e5c3d0dde6b645889bd4ec09ce8c131d8d3265e"
 		score = 65
 		quality = 70
 		tags = "FILE"
@@ -214599,7 +214414,7 @@ rule SECUINFRA_SUSP_Reverse_Run_Key : FILE
 		$run = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide
 
 	condition:
-		filesize <100KB and $run
+		filesize < 100KB and $run
 }
 import "pe"
 
@@ -214608,19 +214423,19 @@ rule SECUINFRA_MAL_Redline_Certificate_Bosch : FILE
 	meta:
 		description = "Detects Certificate used by Redline Stealer"
 		author = "SECUINFRA Falcon Team"
-		id = "a91d0510-ab4e-5f22-bcce-9a42beff5190"
+		id = "c1d30185-78e2-5cc5-94d5-99a957a4aa49"
 		date = "2022-12-02"
 		modified = "2022-02-13"
 		reference = "https://bazaar.abuse.ch/sample/60e40ccfc16ca9f36dee7ec2b4e2fc81398ff408bf7cc63fb7ddf0fef1d4b72b"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Stealer/redline_stealer.yar#L3-L16"
 		license_url = "N/A"
-		logic_hash = "b3084bee5151543c0931bef9d320805d9e4d63c25be029da4e592d5a0b080a0e"
+		logic_hash = "v1_sha256_b3084bee5151543c0931bef9d320805d9e4d63c25be029da4e592d5a0b080a0e"
 		score = 75
 		quality = 70
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "BOSCH BOSCH SDS-plus Professional 607557501" and pe.signatures[i].serial=="72:76:34:57:ef:50:d5:b0:4e:00:b3:74:ab:c6:ff:11")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "BOSCH BOSCH SDS-plus Professional 607557501" and pe.signatures [ i ] . serial == "72:76:34:57:ef:50:d5:b0:4e:00:b3:74:ab:c6:ff:11" )
 }
 import "pe"
 
@@ -214629,32 +214444,32 @@ rule SECUINFRA_MAL_Redline_Certificate_Geforce : FILE
 	meta:
 		description = "Detects Certificate used by Redline Stealer"
 		author = "SECUINFRA Falcon Team"
-		id = "70081810-704e-5734-8a78-f97e17989460"
+		id = "9088c2ed-9d7a-5346-8dca-4f3ef6d945b4"
 		date = "2022-02-13"
 		modified = "2022-02-13"
 		reference = "https://bazaar.abuse.ch/sample/f36c1c2f6b6f334be93b72fccb8e46cadd59304dc244b3a5aabecc8f4018eb77"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Stealer/redline_stealer.yar#L18-L31"
 		license_url = "N/A"
-		logic_hash = "04e9bfd886be1550b0efd22f0098cc13a5fb6e7cae30b866a4066d0c8f433367"
+		logic_hash = "v1_sha256_04e9bfd886be1550b0efd22f0098cc13a5fb6e7cae30b866a4066d0c8f433367"
 		score = 75
 		quality = 70
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "Palit GeForce RTX 3070 Dual H21 LHR" and pe.signatures[i].serial=="11:cd:b5:d5:9d:fb:90:84:45:f3:a7:22:25:47:a4:54")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "Palit GeForce RTX 3070 Dual H21 LHR" and pe.signatures [ i ] . serial == "11:cd:b5:d5:9d:fb:90:84:45:f3:a7:22:25:47:a4:54" )
 }
 rule SECUINFRA_MALWARE_Onenote_Delivery_Jan23
 {
 	meta:
 		description = "Detects suspicious Microsoft OneNote files used to deliver Malware"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "ebf02a11-6f53-573d-bd7a-9948cef9fb3a"
+		id = "39ea1f67-9c3c-5ac5-a3a3-cef591b16a9a"
 		date = "2023-01-19"
 		modified = "2023-01-19"
 		reference = "https://twitter.com/James_inthe_box/status/1615421130877329409"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/MALWARE_OneNote_Delivery_Jan23.yar#L1-L56"
 		license_url = "N/A"
-		logic_hash = "08c38eedf500fd1a0224e396b41aebb8ac82b3705321ca798ac1007ea34366e1"
+		logic_hash = "v1_sha256_08c38eedf500fd1a0224e396b41aebb8ac82b3705321ca798ac1007ea34366e1"
 		score = 65
 		quality = 66
 		tags = ""
@@ -214691,20 +214506,20 @@ rule SECUINFRA_MALWARE_Onenote_Delivery_Jan23
 		$path3 = "C:\\Users\\julien.galleron\\Downloads" wide
 
 	condition:
-		uint32be(0x0)==0xE4525C7B and 3 of them
+		uint32be( 0x0 ) == 0xE4525C7B and 3 of them
 }
 rule SECUINFRA_SUS_Unsigned_APPX_MSIX_Installer_Feb23
 {
 	meta:
 		description = "Detects suspicious, unsigned Microsoft Windows APPX/MSIX Installer Packages"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "beaf08a8-a1c3-5d9c-b7cb-81a49c5bc2ec"
+		id = "30252da4-8094-5cde-b290-ab6e4ade4826"
 		date = "2023-02-01"
 		modified = "2023-02-07"
 		reference = "https://twitter.com/SI_FalconTeam/status/1620500572481945600"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/SUS_Unsigned_APPX_MSIX_Installer_Feb23.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "ad3f0545b2fe285adf67f053c8b422126a1bdff1b6835631280442495d975d16"
+		logic_hash = "v1_sha256_ad3f0545b2fe285adf67f053c8b422126a1bdff1b6835631280442495d975d16"
 		score = 50
 		quality = 30
 		tags = ""
@@ -214717,20 +214532,20 @@ rule SECUINFRA_SUS_Unsigned_APPX_MSIX_Installer_Feb23
 		$sig = "AppxSignature.p7x"
 
 	condition:
-		uint16be(0x0)==0x504B and 2 of ($s*) and not $sig
+		uint16be( 0x0 ) == 0x504B and 2 of ( $s* ) and not $sig
 }
 rule SECUINFRA_SUS_Unsigned_APPX_MSIX_Manifest_Feb23
 {
 	meta:
 		description = "Detects suspicious Microsoft Windows APPX/MSIX Installer Manifests"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "f24f7e03-3cc5-5214-b6d2-205b69898636"
+		id = "5f821581-cf0e-51e4-84d1-0a6671478305"
 		date = "2023-02-01"
 		modified = "2023-02-07"
 		reference = "https://twitter.com/SI_FalconTeam/status/1620500572481945600"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/SUS_Unsigned_APPX_MSIX_Manifest_Feb23.yar#L1-L25"
 		license_url = "N/A"
-		logic_hash = "4e3de25fdad9d76cefbb191424a739368b521c4f234656c397f4122debe749fa"
+		logic_hash = "v1_sha256_4e3de25fdad9d76cefbb191424a739368b521c4f234656c397f4122debe749fa"
 		score = 65
 		quality = 70
 		tags = ""
@@ -214744,22 +214559,20 @@ rule SECUINFRA_SUS_Unsigned_APPX_MSIX_Manifest_Feb23
 		$s_peExt = ".exe"
 
 	condition:
-		uint32be(0x0)==0x3C3F786D and $xlmns and $identity and 2 of ($s*)
+		uint32be( 0x0 ) == 0x3C3F786D and $xlmns and $identity and 2 of ( $s* )
 }
-import "pe"
-
 rule SECUINFRA_SUSP_Discord_Attachments_URL : PE DOWNLOAD FILE
 {
 	meta:
 		description = "Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads"
 		author = "SECUINFRA Falcon Team"
-		id = "bf81920b-f8ab-594a-aa45-d92446411113"
+		id = "7b2122ae-f4f8-58f0-a9ac-787e2a7e5fa3"
 		date = "2022-02-19"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L3-L16"
 		license_url = "N/A"
-		logic_hash = "3270b74506e520064361379b274f44a467c55bdcd3d8456967e864526aca8521"
+		logic_hash = "v1_sha256_3270b74506e520064361379b274f44a467c55bdcd3d8456967e864526aca8521"
 		score = 65
 		quality = 70
 		tags = "PE, DOWNLOAD, FILE"
@@ -214769,7 +214582,7 @@ rule SECUINFRA_SUSP_Discord_Attachments_URL : PE DOWNLOAD FILE
 		$url = "cdn.discordapp.com/attachments" nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and $url
+		uint16( 0 ) == 0x5a4d and $url
 }
 import "pe"
 
@@ -214778,13 +214591,13 @@ rule SECUINFRA_SUSP_DOTNET_PE_Download_To_Specialfolder : DOTNET DOWNLOAD FILE
 	meta:
 		description = "Detects a .NET Binary that downloads further payload and retrieves a special folder"
 		author = "SECUINFRA Falcon Team"
-		id = "106683bf-1d36-58ee-b5af-4723aa70fdad"
+		id = "d80a746a-f3db-5a73-a38a-83019f5702b2"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L45-L64"
 		license_url = "N/A"
-		logic_hash = "d44c89ab126f79596c8bf3f1327b37a2463faa4e3bb258f9a96d495ac40003f8"
+		logic_hash = "v1_sha256_d44c89ab126f79596c8bf3f1327b37a2463faa4e3bb258f9a96d495ac40003f8"
 		score = 65
 		quality = 70
 		tags = "DOTNET, DOWNLOAD, FILE"
@@ -214795,7 +214608,7 @@ rule SECUINFRA_SUSP_DOTNET_PE_Download_To_Specialfolder : DOTNET DOWNLOAD FILE
 		$download = ".DownloadFile(" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and pe.imports("mscoree.dll") and $special_folder and $webclient and $download
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and pe.imports ( "mscoree.dll" ) and $special_folder and $webclient and $download
 }
 import "pe"
 
@@ -214804,13 +214617,13 @@ rule SECUINFRA_SUSP_DOTNET_PE_List_AV : DOTNET AV FILE
 	meta:
 		description = "Detecs .NET Binary that lists installed AVs"
 		author = "SECUINFRA Falcon Team"
-		id = "0f27567a-ab41-5d17-a1d8-a59c9602eb35"
+		id = "ae40af55-279b-5564-9a11-c2b486d6875f"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L66-L82"
 		license_url = "N/A"
-		logic_hash = "b82e6ed5740cab26eb3848717204190d61663e7e42ff42536386b00181a15ebb"
+		logic_hash = "v1_sha256_b82e6ed5740cab26eb3848717204190d61663e7e42ff42536386b00181a15ebb"
 		score = 65
 		quality = 70
 		tags = "DOTNET, AV, FILE"
@@ -214820,22 +214633,20 @@ rule SECUINFRA_SUSP_DOTNET_PE_List_AV : DOTNET AV FILE
 		$query = "Select * from AntivirusProduct" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and pe.imports("mscoree.dll") and $mgt_obj_searcher and $query
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and pe.imports ( "mscoree.dll" ) and $mgt_obj_searcher and $query
 }
-import "pe"
-
 rule SECUINFRA_SUSP_Netsh_Firewall_Command : PE FILE
 {
 	meta:
 		description = "No description has been set in the source file - SecuInfra"
 		author = "SECUINFRA Falcon Team"
-		id = "c62cbe3f-9585-56c0-bb09-83a36437abda"
+		id = "f4c36477-bce6-521f-853f-013e8d8523c1"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L84-L97"
 		license_url = "N/A"
-		logic_hash = "7d19b433785684ce1d2b008b3fdd36b22c5c82bfec476c787dfa025080b6178d"
+		logic_hash = "v1_sha256_7d19b433785684ce1d2b008b3fdd36b22c5c82bfec476c787dfa025080b6178d"
 		score = 65
 		quality = 70
 		tags = "PE, FILE"
@@ -214845,20 +214656,20 @@ rule SECUINFRA_SUSP_Netsh_Firewall_Command : PE FILE
 		$netsh_add = "netsh firewall add" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and ($netsh_delete or $netsh_add)
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( $netsh_delete or $netsh_add )
 }
 rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll : POWERSHELL DOWNLOAD FILE
 {
 	meta:
 		description = "Detect a Download to %temp% and execution with rundll32.exe"
 		author = "SECUINFRA Falcon Team"
-		id = "6b09a6f0-29c6-5baf-ae64-7aa49a37a9d3"
+		id = "b5c2e8d9-c1e7-5c71-9427-fa6e63f4a070"
 		date = "2022-09-02"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/powershell.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "4d7860dc94614b10bc0eea0189ad9b964399d4ee6404ebeaef40720c716c592d"
+		logic_hash = "v1_sha256_4d7860dc94614b10bc0eea0189ad9b964399d4ee6404ebeaef40720c716c592d"
 		score = 65
 		quality = 70
 		tags = "POWERSHELL, DOWNLOAD, FILE"
@@ -214869,20 +214680,20 @@ rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll : POWERSHELL DOWNLOAD FILE
 		$rundll = "rundll32.exe"
 
 	condition:
-		filesize <100KB and $location and $download and $rundll
+		filesize < 100KB and $location and $download and $rundll
 }
 rule SECUINFRA_SUSP_Powershell_Base64_Decode : POWERSHELL B64 FILE
 {
 	meta:
 		description = "Detects PowerShell code to decode Base64 data. This can yield many FP"
 		author = "SECUINFRA Falcon Team"
-		id = "7cb01c0b-d7e3-5196-b78d-f41765ba0368"
+		id = "986623ae-994b-55ca-ac01-00cda18f6602"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/powershell.yar#L19-L31"
 		license_url = "N/A"
-		logic_hash = "b323089ac61823d969d04a05890ad9fffe8589165d4b026b08e9fd633d4247de"
+		logic_hash = "v1_sha256_b323089ac61823d969d04a05890ad9fffe8589165d4b026b08e9fd633d4247de"
 		score = 60
 		quality = 50
 		tags = "POWERSHELL, B64, FILE"
@@ -214891,20 +214702,20 @@ rule SECUINFRA_SUSP_Powershell_Base64_Decode : POWERSHELL B64 FILE
 		$b64_decode = "[System.Convert]::FromBase64String("
 
 	condition:
-		filesize <500KB and $b64_decode
+		filesize < 500KB and $b64_decode
 }
 rule SECUINFRA_SUSP_LNK_Staging_Directory : FILE
 {
 	meta:
 		description = "Detects typical staging directories being referenced inside lnk files"
 		author = "SECUINFRA Falcon Team"
-		id = "459ed2e6-133c-5cde-bf49-95bf8a5eb8c8"
+		id = "0ae9a112-b8d0-5669-8383-b303334a91d8"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/lnk.yar#L31-L46"
 		license_url = "N/A"
-		logic_hash = "3f2a04702b39bce48fc85aa68f39e6062c3b5ee37667eb086222a866a5e438e4"
+		logic_hash = "v1_sha256_3f2a04702b39bce48fc85aa68f39e6062c3b5ee37667eb086222a866a5e438e4"
 		score = 65
 		quality = 70
 		tags = "FILE"
@@ -214914,20 +214725,20 @@ rule SECUINFRA_SUSP_LNK_Staging_Directory : FILE
 		$public = "$env:public" wide
 
 	condition:
-		filesize <20KB and ($header at 0) and $public
+		filesize < 20KB and ( $header at 0 ) and $public
 }
 rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1 : POWERSHELL DOWNLOAD
 {
 	meta:
 		description = "Detect a Download to %temp% and execution with rundll32.exe"
 		author = "SECUINFRA Falcon Team"
-		id = "f7a9d2e6-bebf-598b-9e59-db0a3001b9f9"
+		id = "6e2b69e0-caa6-5f1a-b34e-494454e50c8f"
 		date = "2022-09-02"
 		modified = "2022-02-19"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/PowerShell_Misc/download_variations.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "7982438c032127349fb1c3477a23bab1c92eb68d9c3b26e2f5fb0a8c332dbc44"
+		logic_hash = "v1_sha256_7982438c032127349fb1c3477a23bab1c92eb68d9c3b26e2f5fb0a8c332dbc44"
 		score = 65
 		quality = 70
 		tags = "POWERSHELL, DOWNLOAD"
@@ -214940,21 +214751,18 @@ rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1 : POWERSHELL DOWNLOAD
 	condition:
 		$location and $download and $rundll
 }
-import "pe"
-import "dotnet"
-
 rule SECUINFRA_APT_Bitter_Maldoc_Verify : CVE_2018_0798
 {
 	meta:
 		description = "Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "8e0e32d3-f00e-5145-9386-f42ddca703ae"
+		id = "50b9545c-74b3-5148-85d9-e09bcb23f741"
 		date = "2022-06-01"
 		modified = "2022-07-05"
 		reference = "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L11-L40"
 		license_url = "N/A"
-		logic_hash = "1d30e2ad0d99d274a4e3dd029ff41ec05e8ba4160bea37762bce1bb5286493d8"
+		logic_hash = "v1_sha256_1d30e2ad0d99d274a4e3dd029ff41ec05e8ba4160bea37762bce1bb5286493d8"
 		score = 75
 		quality = 70
 		tags = "CVE-2018-0798"
@@ -214974,9 +214782,8 @@ rule SECUINFRA_APT_Bitter_Maldoc_Verify : CVE_2018_0798
 		$padding = {000001128341000001128341000001128342000001128342}
 
 	condition:
-		3 of ($xor_string*) and $padding
+		3 of ( $xor_string* ) and $padding
 }
-import "pe"
 import "dotnet"
 
 rule SECUINFRA_APT_Bitter_Almond_RAT : FILE
@@ -214984,14 +214791,14 @@ rule SECUINFRA_APT_Bitter_Almond_RAT : FILE
 	meta:
 		description = "Detects Bitter (T-APT-17) Almond RAT (.NET)"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "191fadf9-4f64-56c9-bc2a-a7b4e27ab0fc"
+		id = "830e3e4b-9767-58e4-8d74-09ffffae7e28"
 		date = "2022-06-01"
 		modified = "2022-07-05"
 		reference = " https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L82-L108"
 		license_url = "N/A"
 		hash = "55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396"
-		logic_hash = "b8d6b95987fe434fc16c87a7bc144f1fe69301a32bb93588df7c2abbfef62d75"
+		logic_hash = "v1_sha256_b8d6b95987fe434fc16c87a7bc144f1fe69301a32bb93588df7c2abbfef62d75"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -215006,23 +214813,20 @@ rule SECUINFRA_APT_Bitter_Almond_RAT : FILE
 		$dbg2 = "[Command Executed Successfully]" wide
 
 	condition:
-		uint16(0)==0x5a4d and dotnet.version=="v4.0.30319" and filesize >12KB and filesize <68KB and any of ($function*) and any of ($dbg*)
+		uint16( 0 ) == 0x5a4d and dotnet.version == "v4.0.30319" and filesize > 12KB and filesize < 68KB and any of ( $function* ) and any of ( $dbg* )
 }
-import "pe"
-import "dotnet"
-
 rule SECUINFRA_APT_Bitter_PDB_Paths : FILE
 {
 	meta:
 		description = "Detects Bitter (T-APT-17) PDB Paths"
 		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "e2ad4ac3-45fe-5087-b0d6-a5de16774229"
+		id = "334be759-c6de-5b6b-b589-1f8e11e7c2ca"
 		date = "2022-06-22"
 		modified = "2022-07-05"
 		reference = "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L110-L133"
 		license_url = "N/A"
-		logic_hash = "7eb9e4c1b4e0cca070596f3702045756eb32716481bb59f2f8322221804291f5"
+		logic_hash = "v1_sha256_7eb9e4c1b4e0cca070596f3702045756eb32716481bb59f2f8322221804291f5"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -215036,21 +214840,21 @@ rule SECUINFRA_APT_Bitter_PDB_Paths : FILE
 		$pdbPath3 = "renewedstink\\renewedstink\\obj\\Release\\stimulies.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and any of ($pdbPath*)
+		uint16( 0 ) == 0x5a4d and any of ( $pdbPath* )
 }
 rule SECUINFRA_MAL_WSHRAT : RAT JAVASCRIPT WSHRAT FILE
 {
 	meta:
 		description = "Detects the final Payload of WSHART"
 		author = "SECUINFRA Falcon Team"
-		id = "8db5e349-c83e-53c3-a44d-cfe4732fe08d"
+		id = "a642c203-2827-50e8-91e9-bfefc3ce4bbd"
 		date = "2022-12-02"
 		modified = "2022-02-13"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/wshrat.yar#L2-L44"
 		license_url = "N/A"
 		hash = "b7f53ccc492400290016e802e946e526"
-		logic_hash = "12d893f0ca83e805fa570d3f72eb733c8d8b1ae6c0d37bf179ac675d108c7412"
+		logic_hash = "v1_sha256_12d893f0ca83e805fa570d3f72eb733c8d8b1ae6c0d37bf179ac675d108c7412"
 		score = 75
 		quality = 68
 		tags = "RAT, JAVASCRIPT, WSHRAT, FILE"
@@ -215087,7 +214891,7 @@ rule SECUINFRA_MAL_WSHRAT : RAT JAVASCRIPT WSHRAT FILE
 		$cmd4 = "decode_pass(retcmd);"
 
 	condition:
-		filesize <2MB and 2 of ($cmd*) and 12 of ($function*)
+		filesize < 2MB and 2 of ( $cmd* ) and 12 of ( $function* )
 }
 import "pe"
 
@@ -215096,13 +214900,13 @@ rule SECUINFRA_MAL_Njrat : FILE
 	meta:
 		description = "No description has been set in the source file - SecuInfra"
 		author = "SECUINFRA Falcon Team"
-		id = "eeea8bcf-0d19-5c43-92cc-55c1110f46e5"
+		id = "bc2c1ade-6102-519a-980d-40e8e2df6049"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://github.com/SIFalcon/Detection"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/njrat.yar#L3-L35"
 		license_url = "N/A"
-		logic_hash = "e6f5ce20df70bc2f9d00931a84db08c1918a0639555204de8e86f3ba583a73f5"
+		logic_hash = "v1_sha256_e6f5ce20df70bc2f9d00931a84db08c1918a0639555204de8e86f3ba583a73f5"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -215122,21 +214926,21 @@ rule SECUINFRA_MAL_Njrat : FILE
 		$b4 = "Execute ERROR" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and pe.imports("mscoree.dll") and pe.imports("avicap32.dll") and 1 of ($mutex_*) or (1 of ($a*) and 2 of ($b*))
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and pe.imports ( "mscoree.dll" ) and pe.imports ( "avicap32.dll" ) and 1 of ( $mutex_* ) or ( 1 of ( $a* ) and 2 of ( $b* ) )
 }
 rule SECUINFRA_MAL_Nw0Rm : FILE
 {
 	meta:
 		description = "Detect the final RAT dropped by N-W0rm"
 		author = "SECUINFRA Falcon Team"
-		id = "b014ce63-33ec-51df-a529-0c197dac2d7a"
+		id = "b50c9e20-1231-574f-92f4-f01c7b448be4"
 		date = "2022-03-02"
 		modified = "2022-02-07"
 		reference = "https://www.secuinfra.com/en/techtalk/n-w0rm-analysis-part-2/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/n-w0rm.yar#L1-L24"
 		license_url = "N/A"
 		hash = "08587e04a2196aa97a0f939812229d2d"
-		logic_hash = "04078c57c1aa0065fceec7dc92b201bda23de1c5f5a940803a81250bdd685736"
+		logic_hash = "v1_sha256_04078c57c1aa0065fceec7dc92b201bda23de1c5f5a940803a81250bdd685736"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -215152,21 +214956,21 @@ rule SECUINFRA_MAL_Nw0Rm : FILE
 		$b5 = "nyanmoney02.duckdns.org" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 2 of ($a*) and 2 of ($b*)
+		uint16( 0 ) == 0x5a4d and 2 of ( $a* ) and 2 of ( $b* )
 }
 rule SECUINFRA_DROPPER_WSHRAT_Stage_1 : FILE
 {
 	meta:
 		description = "Detects the first stage of WSHRAT as obfuscated JavaScript"
 		author = "SECUINFRA Falcon Team"
-		id = "3bd363dc-3183-595e-931b-668eb17495f5"
+		id = "a8b0bfae-d06b-5cfc-8e1b-08ad07c1873f"
 		date = "2022-11-02"
 		modified = "2022-02-27"
 		reference = "https://bazaar.abuse.ch/sample/ad24ae27346d930e75283b10d4b949a4986c18dbd5872a91f073334a08169a14/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/wshrat.yar#L1-L18"
 		license_url = "N/A"
 		hash = "793eff1b2039727e76fdd04300d44fc6"
-		logic_hash = "1390929d06bd1259dbab425fd4e953119f632be460f57756a0c226e9f510d75a"
+		logic_hash = "v1_sha256_1390929d06bd1259dbab425fd4e953119f632be460f57756a0c226e9f510d75a"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -215178,20 +214982,20 @@ rule SECUINFRA_DROPPER_WSHRAT_Stage_1 : FILE
 		$b3 = "Array.prototype"
 
 	condition:
-		filesize <1500KB and $a1 and #b3>3 and #b1>2 and $b2
+		filesize < 1500KB and $a1 and #b3 > 3 and #b1 > 2 and $b2
 }
 rule SECUINFRA_DROPPER_Njrat_VBS : VBS NJRAT DROPPER FILE
 {
 	meta:
 		description = "No description has been set in the source file - SecuInfra"
 		author = "SECUINFRA Falcon Team"
-		id = "5296667a-2932-597e-8f49-b7fa755cb387"
+		id = "917a5313-9e75-505e-afc7-0d3298958e7f"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://bazaar.abuse.ch/sample/daea0b5dfcc3e20b75292df60fe5f0e16a40735254485ff6cc7884697a007c0d/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/njrat.yar#L2-L23"
 		license_url = "N/A"
-		logic_hash = "7640be8850992ee7f05e85e1f781b4c63ccf958cf62da8deacfe9bb116627ceb"
+		logic_hash = "v1_sha256_7640be8850992ee7f05e85e1f781b4c63ccf958cf62da8deacfe9bb116627ceb"
 		score = 75
 		quality = 70
 		tags = "VBS, NJRAT, DROPPER, FILE"
@@ -215206,20 +215010,20 @@ rule SECUINFRA_DROPPER_Njrat_VBS : VBS NJRAT DROPPER FILE
 		$b5 = "= ogidoC$" wide
 
 	condition:
-		filesize <300KB and ((1 of ($a*)) or (2 of ($b*)))
+		filesize < 300KB and ( ( 1 of ( $a* ) ) or ( 2 of ( $b* ) ) )
 }
 rule SECUINFRA_DROPPER_Vjw0Rm_Stage_1 : JAVASCRIPT DROPPER VJW0RM FILE
 {
 	meta:
 		description = "No description has been set in the source file - SecuInfra"
 		author = "SECUINFRA Falcon Team"
-		id = "a07f80e4-56c3-5b75-be64-648bc1fde964"
+		id = "b8856fc7-b910-5b0a-a458-1797904d4ca9"
 		date = "2022-02-19"
 		modified = "2022-02-27"
 		reference = "https://bazaar.abuse.ch/browse.php?search=tag%3AVjw0rm"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/Vjw0rm.yar#L2-L19"
 		license_url = "N/A"
-		logic_hash = "e5cc23431239e8a650369729050809cf6fe2acc58941086f79ce004b4f506eed"
+		logic_hash = "v1_sha256_e5cc23431239e8a650369729050809cf6fe2acc58941086f79ce004b4f506eed"
 		score = 75
 		quality = 20
 		tags = "JAVASCRIPT, DROPPER, VJW0RM, FILE"
@@ -215232,20 +215036,20 @@ rule SECUINFRA_DROPPER_Vjw0Rm_Stage_1 : JAVASCRIPT DROPPER VJW0RM FILE
 		$a4 = "join(\"\")"
 
 	condition:
-		( uint16(0)==0x7566 or uint16(0)==0x6176 or uint16(0)==0x0a0d or uint16(0)==0x660a) and filesize <60KB and all of ($a*)
+		( uint16( 0 ) == 0x7566 or uint16( 0 ) == 0x6176 or uint16( 0 ) == 0x0a0d or uint16( 0 ) == 0x660a ) and filesize < 60KB and all of ( $a* )
 }
 rule SECUINFRA_DROPPER_Valyria_Stage_1 : JAVASCRIPT VBS VALYRIA FILE
 {
 	meta:
 		description = "Family was taken from VirusTotal"
 		author = "SECUINFRA Falcon Team"
-		id = "7e2ab9db-142c-5dee-92b7-4a70d747c540"
+		id = "5a12e833-212a-5b32-ada7-72772ad89454"
 		date = "2022-02-18"
 		modified = "2022-02-18"
 		reference = "https://bazaar.abuse.ch/sample/c8a8fea3cbe08cd97e56a0e0dbc59a892f8ab1ff3b5217ca3c9b326eeee6ca66/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/valyria.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "94643123a4be26c818d43a77b907edf8651d306463f4df750db67cef790f10eb"
+		logic_hash = "v1_sha256_94643123a4be26c818d43a77b907edf8651d306463f4df750db67cef790f10eb"
 		score = 75
 		quality = 70
 		tags = "JAVASCRIPT, VBS, VALYRIA, FILE"
@@ -215262,21 +215066,21 @@ rule SECUINFRA_DROPPER_Valyria_Stage_1 : JAVASCRIPT VBS VALYRIA FILE
 		$c2 = "eval"
 
 	condition:
-		filesize <600KB and all of ($a*) and 3 of ($b*) and 1 of ($c*)
+		filesize < 600KB and all of ( $a* ) and 3 of ( $b* ) and 1 of ( $c* )
 }
 rule SECUINFRA_DROPPER_Unknown_1 : DROPPER HTA FILE
 {
 	meta:
 		description = "Detects unknown HTA Dropper"
 		author = "SECUINFRA Falcon Team"
-		id = "70c06b9d-8474-5b6e-bd9c-d45a25585ee9"
+		id = "5cfd547b-be8b-59a6-9258-ba07f08b08e2"
 		date = "2022-10-02"
 		modified = "2022-02-19"
 		reference = "https://bazaar.abuse.ch/sample/c2bf8931028e0a18eeb8f1a958ade0ab9d64a00c16f72c1a3459f160f0761348/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/unknown.yar#L1-L21"
 		license_url = "N/A"
 		hash = "1749f4127bba3f7204710286b1252e14"
-		logic_hash = "d02874514bcb6c3603d1bfee702ec9e18c15153bc14a55ca8d637308c3f35a75"
+		logic_hash = "v1_sha256_d02874514bcb6c3603d1bfee702ec9e18c15153bc14a55ca8d637308c3f35a75"
 		score = 75
 		quality = 43
 		tags = "DROPPER, HTA, FILE"
@@ -215290,21 +215094,21 @@ rule SECUINFRA_DROPPER_Unknown_1 : DROPPER HTA FILE
 		$b = "chr" nocase
 
 	condition:
-		filesize <70KB and all of ($a*) and #b>7
+		filesize < 70KB and all of ( $a* ) and #b > 7
 }
 rule SECUINFRA_MAL_Agenttesla_Stage_1 : JAVASCRIPT AGENTTESLA OBFUSCATORIO FILE
 {
 	meta:
 		description = "Detects the first stage of AgentTesla (JavaScript)"
 		author = "SECUINFRA Falcon Team"
-		id = "0a098f27-8dbc-5749-9a0d-fd0198184c7a"
+		id = "9b5129b0-1d6d-58bc-a593-5e949f6b4c03"
 		date = "2022-02-27"
 		modified = "2022-02-27"
 		reference = "https://bazaar.abuse.ch/sample/bd257d674778100639b298ea35550bf3bcb8b518978c502453e9839846f9bbec/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/agent_tesla.yar#L1-L18"
 		license_url = "N/A"
 		hash = "bd257d674778100639b298ea35550bf3bcb8b518978c502453e9839846f9bbec"
-		logic_hash = "7c21f80a02aa161ffb2edf47aff796f22aff2a563abcb0097cc86371c05e516d"
+		logic_hash = "v1_sha256_7c21f80a02aa161ffb2edf47aff796f22aff2a563abcb0097cc86371c05e516d"
 		score = 75
 		quality = 45
 		tags = "JAVASCRIPT, AGENTTESLA, OBFUSCATORIO, FILE"
@@ -215317,20 +215121,20 @@ rule SECUINFRA_MAL_Agenttesla_Stage_1 : JAVASCRIPT AGENTTESLA OBFUSCATORIO FILE
 		$a4 = "skype.exe"
 
 	condition:
-		filesize <500KB and $mz and 3 of ($a*)
+		filesize < 500KB and $mz and 3 of ( $a* )
 }
 rule SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - SecuInfra"
 		author = "SECUINFRA Falcon Team"
-		id = "80f84c2f-7af0-55c1-bc06-d605beae3e33"
+		id = "0aa7c733-e24a-548f-98ee-9a16f11b4061"
 		date = "2022-02-21"
 		modified = "2022-02-21"
 		reference = "https://bazaar.abuse.ch/sample/06cd1e75f05d55ac1ea77ef7bee38bb3b748110b79128dab4c300f1796a2b941/"
 		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/asyncrat.yar#L2-L18"
 		license_url = "N/A"
-		logic_hash = "80c86b0cbb7382135bb9ae8c80ac42f499081fe1fe48fadf21f0e136bcc04358"
+		logic_hash = "v1_sha256_80c86b0cbb7382135bb9ae8c80ac42f499081fe1fe48fadf21f0e136bcc04358"
 		score = 75
 		quality = 70
 		tags = "FILE"
@@ -215342,15 +215146,15 @@ rule SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1 : FILE
 		$c = "replace("
 
 	condition:
-		filesize <10KB and ($a1 or ( all of ($b*) and #c>10))
+		filesize < 10KB and ( $a1 or ( all of ( $b* ) and #c > 10 ) )
 }
 /*
  * YARA Rule Set
  * Repository Name: RussianPanda
  * Repository: https://github.com/RussianPanda95/Yara-Rules
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 2b40630c067f4ba3a207fcf1951e07a9a01ba69a
- * Number of Rules: 77
+ * Number of Rules: 75
  * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
  *
  *
@@ -215363,14 +215167,14 @@ rule RUSSIANPANDA_Susp_Obf_Py_Marshal_Module : FILE
 	meta:
 		description = "Detects Obfuscated Code Using Python Marshal Module"
 		author = "RussianPanda"
-		id = "23ed45f6-69ba-5027-ad68-4be858fc1f91"
+		id = "0e41950f-f225-5375-b997-e889927a195d"
 		date = "2024-01-16"
 		modified = "2024-01-16"
 		reference = "https://www.trendmicro.com/fr_fr/research/23/j/infection-techniques-across-supply-chains-and-codebases.html"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Techniques/susp_obf_py_marshal_module.yar#L1-L18"
 		license_url = "N/A"
 		hash = "d740129ff6bdb65a324eadf4ac8de3893a54306cf2a11712a305ef6247204092"
-		logic_hash = "f150fae6d7a4642f714f4620dab65f452e5eb9cb57e9cbea46010aac3ecbb3cb"
+		logic_hash = "v1_sha256_f150fae6d7a4642f714f4620dab65f452e5eb9cb57e9cbea46010aac3ecbb3cb"
 		score = 65
 		quality = 60
 		tags = "FILE"
@@ -215383,20 +215187,20 @@ rule RUSSIANPANDA_Susp_Obf_Py_Marshal_Module : FILE
 		$t5 = "binascii"
 
 	condition:
-		$s1 and any of ($t*) and filesize <2MB
+		$s1 and any of ( $t* ) and filesize < 2MB
 }
 rule RUSSIANPANDA_Win_Sus_Internetshortcutfile
 {
 	meta:
 		description = "Detects suspicious Internet Shortcut Files that are often used to retrieve malware"
 		author = "RussianPanda"
-		id = "88d5d33f-0342-5575-b5e4-31ac5695abf2"
+		id = "cd0b3f87-25f0-5bb1-99c8-f0ce02a62a8c"
 		date = "2024-02-17"
 		modified = "2024-02-17"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Techniques/win_sus_InternetShortcutFile.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "9ec321ba521949fcc1db09b843913424182bfbb14eac61e92b7132d88b275ceb"
+		logic_hash = "v1_sha256_9ec321ba521949fcc1db09b843913424182bfbb14eac61e92b7132d88b275ceb"
 		score = 65
 		quality = 58
 		tags = ""
@@ -215413,21 +215217,21 @@ rule RUSSIANPANDA_Win_Sus_Internetshortcutfile
 		$a7 = ".cmd"
 
 	condition:
-		all of ($s*) and any of ($a*)
+		all of ( $s* ) and any of ( $a* )
 }
 rule RUSSIANPANDA_Golang_Base64_Enc : FILE
 {
 	meta:
 		description = "Detects Base64 Encoding and Decoding patterns in Golang binaries"
 		author = "RussianPanda"
-		id = "6330e005-9c67-5acd-9063-aa7e30e92f5f"
+		id = "4295cfaf-c3e6-5ae0-b907-16e26b6bd064"
 		date = "2024-01-10"
 		modified = "2024-01-14"
 		reference = "https://unprotect.it/technique/base64/"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Techniques/golang_base64_enc.yar#L1-L18"
 		license_url = "N/A"
 		hash = "509a359b4d0cd993497671b91255c3775628b078cde31a32158c1bc3b2ce461c"
-		logic_hash = "72cf3ee948df9c4ce593f16a49397e79fdc5ecc3264b3685bbc54f60ed1278bd"
+		logic_hash = "v1_sha256_72cf3ee948df9c4ce593f16a49397e79fdc5ecc3264b3685bbc54f60ed1278bd"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -215439,21 +215243,21 @@ rule RUSSIANPANDA_Golang_Base64_Enc : FILE
 		$s4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
 
 	condition:
-		all of ($s*) and uint16(0)==0x5A4D
+		all of ( $s* ) and uint16( 0 ) == 0x5A4D
 }
 rule RUSSIANPANDA_Check_Installed_Software : FILE
 {
 	meta:
 		description = "No description has been set in the source file - RussianPanda"
 		author = "RussianPanda"
-		id = "a45c7012-dc83-59da-a691-251f0a06be12"
+		id = "b6844286-b923-52bd-b9c5-f2ad7d5ca39a"
 		date = "2024-01-14"
 		modified = "2024-01-15"
 		reference = "https://unprotect.it/technique/checking-installed-software/"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Techniques/check_installed_software.yar#L1-L19"
 		license_url = "N/A"
 		hash = "db44d4cd1ea8142790a6b26880b41ee23de5db5c2a63afb9ee54585882f1aa07"
-		logic_hash = "ab079f1edaffca5bce1e872d6e4fc44f7c22b9260feaed7cd38e578646d420ef"
+		logic_hash = "v1_sha256_ab079f1edaffca5bce1e872d6e4fc44f7c22b9260feaed7cd38e578646d420ef"
 		score = 45
 		quality = 35
 		tags = "FILE"
@@ -215465,21 +215269,21 @@ rule RUSSIANPANDA_Check_Installed_Software : FILE
 		$h = {68 (01|02) 00 00 80}
 
 	condition:
-		uint16(0)==0x5A4D and $reg and $h and for any i in (1..#u1) : ($d1 in (@u1[i]-200..@u1[i]+200))
+		uint16( 0 ) == 0x5A4D and $reg and $h and for any i in ( 1 .. #u1 ) : ( $d1 in ( @u1 [ i ] - 200 .. @u1 [ i ] + 200 ) )
 }
 rule RUSSIANPANDA_Zharkbot : FILE
 {
 	meta:
 		description = "Detects ZharkBot, version 1.2.5"
 		author = "RussianPanda"
-		id = "e20875ed-a0a1-5ac8-8758-33766c522c17"
+		id = "35751844-4a0c-5fb1-acff-3ed320e3a0cd"
 		date = "2024-09-02"
 		modified = "2024-09-03"
 		reference = "https://research.openanalysis.net/zharkbot/triage/x64dbg/2024/09/02/zharkbot-config.html"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/ZharkBot/Zharkbot.yar#L1-L15"
 		license_url = "N/A"
 		hash = "1aa0622a744ec4d28a561bac60ec5e907476587efbadfde546d2b145be4b8109"
-		logic_hash = "fded6a0c7af4fda13619778669ef619f88b43e12f12284a3c551c4fddac01024"
+		logic_hash = "v1_sha256_fded6a0c7af4fda13619778669ef619f88b43e12f12284a3c551c4fddac01024"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -215489,21 +215293,21 @@ rule RUSSIANPANDA_Zharkbot : FILE
 		$s2 = "^d{6}$"
 
 	condition:
-		uint16(0)==0x5A4D and all of them and filesize <500KB
+		uint16( 0 ) == 0x5A4D and all of them and filesize < 500KB
 }
 rule RUSSIANPANDA_Zharkbot_1 : FILE
 {
 	meta:
 		description = "Detects ZharkBot"
 		author = "RussianPanda"
-		id = "54213d76-7e27-559d-b653-5390a0c6813c"
+		id = "e60461bb-5633-5152-ac6f-3541c7ba0cf1"
 		date = "2024-01-21"
 		modified = "2024-03-12"
 		reference = "https://x.com/ViriBack/status/1749184882822029564?s=20"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/ZharkBot/zharkbot.yar#L1-L15"
 		license_url = "N/A"
 		hash = "d53ce8c0a8a89c2e3eb080849da8b1c47eaac614248fc55d03706dd5b4e10bdd"
-		logic_hash = "ffaec6b19dd4385cd1bc156fdfde39a356367c7fba4135c48a8de62a18a78576"
+		logic_hash = "v1_sha256_ffaec6b19dd4385cd1bc156fdfde39a356367c7fba4135c48a8de62a18a78576"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -215513,21 +215317,21 @@ rule RUSSIANPANDA_Zharkbot_1 : FILE
 		$s2 = {F7 E2 C1 EA 04 0F BE C2 8B 55 ?? 8A CA 6B C0 ?? 2A C8 80 C1 ?? 30 8C 15}
 
 	condition:
-		uint16(0)==0x5A4D and #s1>3 and #s2>3 and filesize <500KB
+		uint16( 0 ) == 0x5A4D and #s1 > 3 and #s2 > 3 and filesize < 500KB
 }
 rule RUSSIANPANDA_Sentinel_Stealer
 {
 	meta:
 		description = "Detects Sentinel Stealer"
 		author = "RussianPanda"
-		id = "8a221d7b-8fa6-53cd-a3e8-63cc67285186"
+		id = "d743f249-4388-533c-8cb2-67905791e64e"
 		date = "2024-01-19"
 		modified = "2024-01-19"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/SentinelStealer/sentinel_stealer.yar#L1-L14"
 		license_url = "N/A"
 		hash = "3a540a8a81c5a5b452f154d7875423a3"
-		logic_hash = "b9d72848842ea4d26544633bb83fccd17239b28493bde3f73341eb2004d8ee0c"
+		logic_hash = "v1_sha256_b9d72848842ea4d26544633bb83fccd17239b28493bde3f73341eb2004d8ee0c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -215545,14 +215349,14 @@ rule RUSSIANPANDA_Lummac2 : FILE
 	meta:
 		description = "Detects LummaC2 Stealer"
 		author = "RussianPanda"
-		id = "94d6b63f-066e-59d2-9d14-24c5d5219ba8"
+		id = "b4070d9e-48b2-5ce4-9717-d7177f811ec5"
 		date = "2024-09-12"
 		modified = "2024-09-12"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/LummaC2/LummaC2.yar#L1-L14"
 		license_url = "N/A"
 		hash = "988f54f9694dd1ae701bacec3b83c752"
-		logic_hash = "875709f48ff93c8e986f3c1d2e32268bf3458d870082072e7727d8ec85b1a021"
+		logic_hash = "v1_sha256_875709f48ff93c8e986f3c1d2e32268bf3458d870082072e7727d8ec85b1a021"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -215562,21 +215366,21 @@ rule RUSSIANPANDA_Lummac2 : FILE
 		$s2 = {F3 A5 8B 74 24 F8 8B 7C 24 F4 8D 54 24 04 FF 54 24 FC C3}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule RUSSIANPANDA_Johnwalkertexasloader_V2 : FILE
 {
 	meta:
 		description = "Detects JohnWalkerTexasLoader (JWTL)"
 		author = "RussianPanda"
-		id = "1a05245e-5ee0-5916-801b-4f7f3a573e71"
+		id = "a0504ae4-b0fa-56b4-bdb2-8a978f95f448"
 		date = "2024-10-15"
 		modified = "2024-10-15"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/JWTL/JohnWalkerTexasLoader_v2.yar#L1-L16"
 		license_url = "N/A"
 		hash = "9f6bf0473f5541d84faad4c33a0bc5b1928fceb5938f2d6a7e6e02b7f0980341"
-		logic_hash = "70cbf6cf0602dc8087f4845451d13d0043872733615050161c077e3346387873"
+		logic_hash = "v1_sha256_70cbf6cf0602dc8087f4845451d13d0043872733615050161c077e3346387873"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -215587,21 +215391,21 @@ rule RUSSIANPANDA_Johnwalkertexasloader_V2 : FILE
 		$s3 = {73 65 6E 64 6F 70 65 6E 32}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule RUSSIANPANDA_Johnwalkertexasloader : FILE
 {
 	meta:
 		description = "Detects JohnWalkerTexasLoader (JWTL)"
 		author = "RussianPanda"
-		id = "af91ab47-245b-58f2-a35a-1cb408b2229a"
+		id = "5628bc7b-4dc4-5bb3-8228-9de082be62d0"
 		date = "2024-10-10"
 		modified = "2024-10-10"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/JWTL/JohnWalkerTexasLoader.yar#L1-L16"
 		license_url = "N/A"
 		hash = "3784fc39dc5c0dec08ad0a49bbbb990359e313a9fa87e6842fd67ed7cc1c0baa"
-		logic_hash = "414be3219d12823639d140d132a9bbc2ca7bf8c44d0c560e4a49b76323be3f8a"
+		logic_hash = "v1_sha256_414be3219d12823639d140d132a9bbc2ca7bf8c44d0c560e4a49b76323be3f8a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -215612,20 +215416,20 @@ rule RUSSIANPANDA_Johnwalkertexasloader : FILE
 		$s3 = "/api-debug.php" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule RUSSIANPANDA_Danabot
 {
 	meta:
 		description = "Detects DanaBot"
 		author = "RussianPanda"
-		id = "804604d9-db3b-5678-ae0d-67f0e876c93e"
+		id = "b0ecf5b5-a40f-56a9-8374-bf53ee8e9d32"
 		date = "2023-12-01"
 		modified = "2023-12-01"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/DanaBot/danabot_yara.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "4968531f27fa1a8bc3fca536a04b75277adefc42addb9f1999c564510cbcb684"
+		logic_hash = "v1_sha256_4968531f27fa1a8bc3fca536a04b75277adefc42addb9f1999c564510cbcb684"
 		score = 75
 		quality = 83
 		tags = ""
@@ -215639,21 +215443,21 @@ rule RUSSIANPANDA_Danabot
 		$a = {44 45 4C 50 48 49 43 4C 41 53 53}
 
 	condition:
-		3 of ($s*) and $a
+		3 of ( $s* ) and $a
 }
 rule RUSSIANPANDA_Win_Mal_Rustydropper : FILE
 {
 	meta:
 		description = "Detects RustyDropper"
 		author = "RussianPanda"
-		id = "9f217080-81e0-547a-9336-cf8ac2fadf36"
+		id = "f254ed4b-fed4-5189-bb2b-e0c46fa2e4d6"
 		date = "2024-03-01"
 		modified = "2024-03-01"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/RustyDropper/win_mal_RustyDropper.yar#L1-L12"
 		license_url = "N/A"
 		hash = "a3a5e7011335a2284e2d4f73fd464ff129f0c9276878a054c1932bc50608584b"
-		logic_hash = "d0c76bcd1af63cc1b1fbabc3fa33e6caafd7d9c7c3780a94a1ed37eadef655d7"
+		logic_hash = "v1_sha256_d0c76bcd1af63cc1b1fbabc3fa33e6caafd7d9c7c3780a94a1ed37eadef655d7"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -215663,20 +215467,20 @@ rule RUSSIANPANDA_Win_Mal_Rustydropper : FILE
 		$s2 = {46 45 41 54 55 52 45 5f 42 52 4f 57 53 45 52 5f 45 4d 55 4c 41 54 49 4f 4e}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule RUSSIANPANDA_Win_Mal_Zloader : FILE
 {
 	meta:
 		description = "Detects Zloader and other Zloader modules that employ the same encryption"
 		author = "RussianPanda"
-		id = "3f72e067-c82b-5c65-92c8-010955971d87"
+		id = "ce58383a-a3b7-5610-91cb-c08465d503af"
 		date = "2024-03-10"
 		modified = "2024-03-10"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Zloader/win_mal_Zloader.yar#L1-L13"
 		license_url = "N/A"
-		logic_hash = "9ac9e8ca4a6f84e1bccac2292705ee6ebbc1595eb3f40ed777f7973e9bda7fc1"
+		logic_hash = "v1_sha256_9ac9e8ca4a6f84e1bccac2292705ee6ebbc1595eb3f40ed777f7973e9bda7fc1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -215688,21 +215492,21 @@ rule RUSSIANPANDA_Win_Mal_Zloader : FILE
 		$s4 = {8B 45 ?? BE 11 00 00 00 99 F7 [0-20] 83 F6 FF}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule RUSSIANPANDA_Win_Mal_Glorysprout_Stealer : FILE
 {
 	meta:
 		description = "Detects GlorySprout Stealer"
 		author = "RussianPanda"
-		id = "44c50f20-479e-5960-9ab9-97b9a17d7cbf"
+		id = "bd63520d-9e0a-5401-9e42-51fb9c529eb2"
 		date = "2024-03-16"
 		modified = "2024-03-16"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/GlorySprout/win_mal_GlorySprout_Stealer.yar#L1-L13"
 		license_url = "N/A"
 		hash = "8996c252fc41b7ec0ec73ce814e84136be6efef898822146c25af2330f4fd04a"
-		logic_hash = "c843f7924e69c1b9fc3676178aa630319fe25605deddcd73c4905c51cc97d7eb"
+		logic_hash = "v1_sha256_c843f7924e69c1b9fc3676178aa630319fe25605deddcd73c4905c51cc97d7eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -215713,21 +215517,21 @@ rule RUSSIANPANDA_Win_Mal_Glorysprout_Stealer : FILE
 		$s3 = {0F B6 06 C1 E7 04 03 F8 8B C7 25 00 00 00 F0 74 0B C1 E8 18}
 
 	condition:
-		uint16(0)==0x5A4D and all of them and #s1>100
+		uint16( 0 ) == 0x5A4D and all of them and #s1 > 100
 }
 rule RUSSIANPANDA_Mal_Botnetfenix_Payload : FILE
 {
 	meta:
 		description = "Detects BotnetFenix payload"
 		author = "RussianPanda"
-		id = "566bfae1-c43d-5bd6-adcf-faff32d8c325"
+		id = "279f3c2a-f849-5e58-97d3-c54273ab5895"
 		date = "2024-02-02"
 		modified = "2024-02-04"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/FenixBotnet/mal_BotnetFenix_Payload.yar#L1-L16"
 		license_url = "N/A"
 		hash = "65a9575c50a96d04a3f649fe0f6b8ccd"
-		logic_hash = "27f423b509ad8de0f8389c7b3e3bfec2eeb10c964aa8c70bad47cc4334df1a5e"
+		logic_hash = "v1_sha256_27f423b509ad8de0f8389c7b3e3bfec2eeb10c964aa8c70bad47cc4334df1a5e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -215741,21 +215545,21 @@ rule RUSSIANPANDA_Mal_Botnetfenix_Payload : FILE
 		$a = "_CorExeMain"
 
 	condition:
-		uint16(0)==0x5A4D and 4 of ($s*) and $a
+		uint16( 0 ) == 0x5A4D and 4 of ( $s* ) and $a
 }
 rule RUSSIANPANDA_Mal_Fenixbotnet_Jse
 {
 	meta:
 		description = "Detects Fenix Botnet JSE downloader"
 		author = "RussianPanda"
-		id = "00c6f8a6-c2e2-5b08-b332-b91371060bbe"
+		id = "1e756db2-68a9-5337-a2f1-6acde19f5797"
 		date = "2024-01-18"
 		modified = "2024-02-02"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/FenixBotnet/mal_FenixBotnet_jse.yar#L1-L14"
 		license_url = "N/A"
 		hash = "a7fadf0050d4d0b2cefd808e16dfde69"
-		logic_hash = "848c00361fba60e63e8ec4098404e87d4ba2b11d8489ad16d49c20fc653a5e45"
+		logic_hash = "v1_sha256_848c00361fba60e63e8ec4098404e87d4ba2b11d8489ad16d49c20fc653a5e45"
 		score = 75
 		quality = 85
 		tags = ""
@@ -215767,20 +215571,20 @@ rule RUSSIANPANDA_Mal_Fenixbotnet_Jse
 		$s4 = {6E 65 77 20 46 75 6E 63 74 69 6F 6E 28 64 65 63 6F 64 65 55 52 49 43 6F 6D 70 6F 6E 65 6E 74 28 [0-30] 29 29 2E 63 61 6C 6C 28 29}
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
 rule RUSSIANPANDA_Mal_Asuka_Stealer : FILE
 {
 	meta:
 		description = "Detects AsukaStealer"
 		author = "RussianPanda"
-		id = "a718be5f-dc76-5610-9237-038a9719d7e5"
+		id = "f6d1b85e-c7ce-5a4a-b97c-2dc5e1bf98d3"
 		date = "2024-02-02"
 		modified = "2024-03-18"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/AsukaStealer/mal_asuka_stealer.yar#L1-L12"
 		license_url = "N/A"
-		logic_hash = "7974e0de821ddcafd4f00b27d587108f0d80f8a231dd0db4d2be4fa6ab44fef4"
+		logic_hash = "v1_sha256_7974e0de821ddcafd4f00b27d587108f0d80f8a231dd0db4d2be4fa6ab44fef4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -215791,7 +215595,7 @@ rule RUSSIANPANDA_Mal_Asuka_Stealer : FILE
 		$s3 = {58 00 2D 00 49 00 6E 00 66 00 6F}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 import "pe"
 
@@ -215800,13 +215604,13 @@ rule RUSSIANPANDA_Swaetrat
 	meta:
 		description = "Detects SwaetRAT"
 		author = "RussianPanda"
-		id = "e5238ae4-7ae3-505c-a3fd-ecf6be608fac"
+		id = "5784af70-a809-5372-b84f-e04423ebd223"
 		date = "2023-11-27"
 		modified = "2023-11-27"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/SwaetRAT/swaetrat.yar#L3-L19"
 		license_url = "N/A"
-		logic_hash = "4dc1107a34d678c3fa0939fab7986fe744ac246400823d08b1ab6db0942821da"
+		logic_hash = "v1_sha256_4dc1107a34d678c3fa0939fab7986fe744ac246400823d08b1ab6db0942821da"
 		score = 75
 		quality = 85
 		tags = ""
@@ -215818,7 +215622,7 @@ rule RUSSIANPANDA_Swaetrat
 		$s5 = "OfflineGet" wide
 
 	condition:
-		all of ($s*) and pe.imports("mscoree.dll")
+		all of ( $s* ) and pe.imports ( "mscoree.dll" )
 }
 import "dotnet"
 
@@ -215827,14 +215631,14 @@ rule RUSSIANPANDA_Purecrypter_Core : FILE
 	meta:
 		description = "Detects PureCrypter Core payload"
 		author = "RussianPanda"
-		id = "41aaa187-0fb5-53fe-a162-8d1a4974ccc1"
+		id = "b897aa42-13ae-5d14-a526-9d2dcadab9de"
 		date = "2024-01-09"
 		modified = "2024-01-09"
 		reference = "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/PureCrypter/purecrypter_core.yar#L3-L28"
 		license_url = "N/A"
 		hash = "e4faa7d7a098414449abffb210fd874798207ee9d27643c8088676ff429b56b7"
-		logic_hash = "8c761a98369436ffbe1379152461753778985a42ae656567018b47c71af7d866"
+		logic_hash = "v1_sha256_8c761a98369436ffbe1379152461753778985a42ae656567018b47c71af7d866"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -215850,7 +215654,7 @@ rule RUSSIANPANDA_Purecrypter_Core : FILE
 		$nr4 = {7B 00 31 00 31 00 31 00 31 00 31 00 2D 00 32 00 32 00 32 00 32 00 32 00 2D 00 32 00 30 00 30 00 30 00 31 00 2D 00 30 00 30 00 30 00 30 00 31 00 7D}
 
 	condition:
-		filesize <5MB and all of ($s*) and dotnet.number_of_resources>4 and dotnet.number_of_resources<6 and 2 of ($nr*) and dotnet.assembly_refs[1].name contains "protobuf-net" and #cnct>5
+		filesize < 5MB and all of ( $s* ) and dotnet.number_of_resources > 4 and dotnet.number_of_resources < 6 and 2 of ( $nr* ) and dotnet.assembly_refs [ 1 ] . name contains "protobuf-net" and #cnct > 5
 }
 import "dotnet"
 
@@ -215859,14 +215663,14 @@ rule RUSSIANPANDA_Purecrypter : FILE
 	meta:
 		description = "Detects PureCrypter"
 		author = "RussianPanda"
-		id = "5670772c-ada1-55fa-b7fd-9dadd1756259"
+		id = "dcc81b77-6894-5da7-b1b9-812c397aef22"
 		date = "2024-01-09"
 		modified = "2024-01-09"
 		reference = "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/PureCrypter/purecrypter.yar#L3-L22"
 		license_url = "N/A"
 		hash = "566d8749e166436792dfcbb5e5514f18c9afc0e1314833ac2e3d86f37ff2030f"
-		logic_hash = "dd8592fa0b7d240d23235008601500a20e068032f6dcd6e90a38b06ac747b8af"
+		logic_hash = "v1_sha256_dd8592fa0b7d240d23235008601500a20e068032f6dcd6e90a38b06ac747b8af"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -215879,7 +215683,7 @@ rule RUSSIANPANDA_Purecrypter : FILE
 		$s5 = {28 ?? 00 00 ?? 6F ?? 00 00 0A 28 03 00 00 2B ?? 6F ?? 00 00 0A 28 ?? 00 00 2B}
 
 	condition:
-		filesize <6MB and 4 of ($s*) and dotnet.number_of_resources>0 and dotnet.number_of_resources<2 and dotnet.resources[0].length>300KB
+		filesize < 6MB and 4 of ( $s* ) and dotnet.number_of_resources > 0 and dotnet.number_of_resources < 2 and dotnet.resources [ 0 ] . length > 300KB
 }
 import "pe"
 
@@ -215888,13 +215692,13 @@ rule RUSSIANPANDA_Bandit_Stealer : FILE
 	meta:
 		description = "Detects the latest build of Bandit Stealer"
 		author = "RussianPanda"
-		id = "ed61177d-d70d-5062-8703-f2f2b9d63751"
+		id = "c28c30b4-64bc-5032-b9ac-ec961ed5358a"
 		date = "2023-05-05"
 		modified = "2023-05-05"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/BanditStealer/bandit_stealer.yar#L3-L21"
 		license_url = "N/A"
-		logic_hash = "304bf05a58d5b762ffe078457739188692f4f7109db929418832c4379b21ae72"
+		logic_hash = "v1_sha256_304bf05a58d5b762ffe078457739188692f4f7109db929418832c4379b21ae72"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -215904,20 +215708,20 @@ rule RUSSIANPANDA_Bandit_Stealer : FILE
 		$s2 = {48 FF C0 88 17 83 E9 01 8A 10 48 8D 7F 01 75 F0}
 
 	condition:
-		all of ($s*) and ( uint16(0)==0x5A4D or uint32(0)==0x4464c457f) and pe.sections[0].name contains "UPX0" and pe.sections[1].name contains "UPX1" and pe.sections[0].characteristics&pe.SECTION_MEM_EXECUTE and pe.sections[0].characteristics&pe.SECTION_MEM_WRITE and pe.sections[1].characteristics&pe.SECTION_MEM_EXECUTE and pe.sections[1].characteristics&pe.SECTION_MEM_WRITE
+		all of ( $s* ) and ( uint16( 0 ) == 0x5A4D or uint32( 0 ) == 0x4464c457f ) and pe.sections [ 0 ] . name contains "UPX0" and pe.sections [ 1 ] . name contains "UPX1" and pe.sections [ 0 ] . characteristics & pe.SECTION_MEM_EXECUTE and pe.sections [ 0 ] . characteristics & pe.SECTION_MEM_WRITE and pe.sections [ 1 ] . characteristics & pe.SECTION_MEM_EXECUTE and pe.sections [ 1 ] . characteristics & pe.SECTION_MEM_WRITE
 }
 rule RUSSIANPANDA_Win_Mal_Gobitloader : FILE
 {
 	meta:
 		description = "Detects GoBitLoader"
 		author = "RussianPanda"
-		id = "4ebc7987-c1b2-5682-943f-7c19a9cb6b36"
+		id = "eea80726-3923-5683-8fef-9575a9981138"
 		date = "2024-03-24"
 		modified = "2024-03-24"
 		reference = "https://www.malwarebytes.com/blog/threat-intelligence/2024/03/new-go-loader-pushes-rhadamanthys"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/GoBitLoader/win_mal_GoBitLoader.yar#L1-L13"
 		license_url = "N/A"
-		logic_hash = "66951b290bef6a6c9eef4ea674472465dfe0ec5072dce21f48b58191f7ce90e3"
+		logic_hash = "v1_sha256_66951b290bef6a6c9eef4ea674472465dfe0ec5072dce21f48b58191f7ce90e3"
 		score = 75
 		quality = 79
 		tags = "FILE"
@@ -215928,21 +215732,21 @@ rule RUSSIANPANDA_Win_Mal_Gobitloader : FILE
 		$s3 = {6D 61 69 6E 2E 41 65 73 44 65 63 6F 64 65 2E 66 75 6E 63 31}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule RUSSIANPANDA_Easycrypter : FILE
 {
 	meta:
 		description = "Detects EasyCrypter"
 		author = "RussianPanda"
-		id = "73b01a6c-dcd1-502e-a431-daf82ab3ed50"
+		id = "61a1d5cb-81a4-5102-af36-09d3b7e809a1"
 		date = "2024-01-05"
 		modified = "2024-01-05"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/EasyCrypter/easycrypter.yar#L1-L16"
 		license_url = "N/A"
 		hash = "60063c99fda3b6c5c839ec1c310b03e8f9c7c8823f2eb7bf75e22c6d738ffa8f"
-		logic_hash = "761ed4629150453009b76d9c2ad251754009b464550b92dab3395fa30422f6ef"
+		logic_hash = "v1_sha256_761ed4629150453009b76d9c2ad251754009b464550b92dab3395fa30422f6ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -215952,21 +215756,21 @@ rule RUSSIANPANDA_Easycrypter : FILE
 		$s2 = {81 38 50 45 00 00 [20-22] 8B 88 A0 00 00 00 [2-4] 8B 80 A4 00 00 00 [5-7] 8B 40 50 [50-56] 89 0C 24 89 44 24 04 C7 44 24 08 00 30 00 00 C7 44 24 0C 04 00 00 00 FF 15 [3] 00}
 
 	condition:
-		uint16(0)==0x5A4D and $s1 and $s2
+		uint16( 0 ) == 0x5A4D and $s1 and $s2
 }
 rule RUSSIANPANDA_Win_Mal_Mpxdropper : FILE
 {
 	meta:
 		description = "Detects MpxDropper"
 		author = "RussianPanda"
-		id = "26ee0a12-c727-5953-8ebb-dd8a8d772561"
+		id = "0616c052-4bd7-5fe5-a4ca-b732b0ab5fa6"
 		date = "2024-03-01"
 		modified = "2024-03-01"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/MpxDropper/mal_win_MpxDropper.yar#L1-L11"
 		license_url = "N/A"
 		hash = "3a44a45afbfe5fc7cdeb3723e05c4e892b079abdb7d1e8d6fc70496ef0a14d5d"
-		logic_hash = "e8d2672553c7f44e1cc177fad6596bd58b5c32a7541f91ce1207e6b21ef6e52d"
+		logic_hash = "v1_sha256_e8d2672553c7f44e1cc177fad6596bd58b5c32a7541f91ce1207e6b21ef6e52d"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -215975,21 +215779,21 @@ rule RUSSIANPANDA_Win_Mal_Mpxdropper : FILE
 		$s1 = {43 3a 5c 55 73 65 72 73 5c 6d 70 78 31 36 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule RUSSIANPANDA_Ghostgambit : FILE
 {
 	meta:
 		description = "Detects GhostGambit dropper"
 		author = "RussianPanda"
-		id = "0348b9fa-59be-5f30-8ebc-f1e87cf98b07"
+		id = "17ea7fbe-4041-5fd9-a3d0-7d795388e6e7"
 		date = "2024-07-09"
 		modified = "2024-07-09"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/GhostGambit/GhostGambit.yar#L1-L14"
 		license_url = "N/A"
 		hash = "2b16c68d9bafbd2ecf3634d991d7c794"
-		logic_hash = "419efbea3c347d0ec9365c0c21cccb6f229f8c42d22a2bcfdf14854e7f83aea1"
+		logic_hash = "v1_sha256_419efbea3c347d0ec9365c0c21cccb6f229f8c42d22a2bcfdf14854e7f83aea1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216001,7 +215805,7 @@ rule RUSSIANPANDA_Ghostgambit : FILE
 		$s4 = "/c ping -n 4 127.0.0.1 > nul && del" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 import "pe"
 
@@ -216010,13 +215814,13 @@ rule RUSSIANPANDA_Ducktail_Myrdpservice_Bot : FILE
 	meta:
 		description = "Detects Ducktail myRdpService bot"
 		author = "RussianPanda"
-		id = "50786786-a7db-5290-a363-6fda139a0343"
+		id = "e5e0a2b6-9cb3-5075-a6b2-215320a560d0"
 		date = "2023-12-24"
 		modified = "2023-12-26"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Ducktail/ducktail_myrdpservice-12-2023.yar#L3-L17"
 		license_url = "N/A"
-		logic_hash = "a329067fbb2acc34c4970167bbce0706c5a3ec09ee89ce16817c105ae1c17b1b"
+		logic_hash = "v1_sha256_a329067fbb2acc34c4970167bbce0706c5a3ec09ee89ce16817c105ae1c17b1b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216027,20 +215831,20 @@ rule RUSSIANPANDA_Ducktail_Myrdpservice_Bot : FILE
 		$s3 = {00 43 00 6F 00 6E 00 6E 00 65 00 63 00 74 00 65 00 64 00}
 
 	condition:
-		all of ($s*) and filesize <12MB and pe.exports("DotNetRuntimeDebugHeader")
+		all of ( $s* ) and filesize < 12MB and pe.exports ( "DotNetRuntimeDebugHeader" )
 }
 rule RUSSIANPANDA_Ducktail : FILE
 {
 	meta:
 		description = "Ducktail Infostealer"
 		author = "RussianPanda"
-		id = "14ba165f-a1f3-5820-a6d8-e2b6ab2fbb51"
+		id = "f7df4df0-de62-537e-88a7-903e38367ea4"
 		date = "2023-04-25"
 		modified = "2023-05-05"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Ducktail/ducktail.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "cb248870f6945d7a6d60d54944dc726d40ba326448af39b87325ec56445602a5"
+		logic_hash = "v1_sha256_cb248870f6945d7a6d60d54944dc726d40ba326448af39b87325ec56445602a5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -216054,7 +215858,7 @@ rule RUSSIANPANDA_Ducktail : FILE
 		$s5 = {53 79 73 74 65 6d 2e 4e 65 74 2e 4d 61 69 6c 2e 64 6c 6c}
 
 	condition:
-		all of them and filesize >60MB
+		all of them and filesize > 60MB
 }
 import "pe"
 
@@ -216063,13 +215867,13 @@ rule RUSSIANPANDA_Ducktail_Mainbot : FILE
 	meta:
 		description = "Detects Ducktail mainbot"
 		author = "RussianPanda"
-		id = "f280903f-13d3-54e1-8308-781e3f777d13"
+		id = "8cbd09ed-10ec-5cd8-b0e3-bc305176bf56"
 		date = "2023-12-24"
 		modified = "2023-12-26"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Ducktail/ducktail_mainbot-12-2023.yar#L3-L19"
 		license_url = "N/A"
-		logic_hash = "33b85c6e1e1137aeeb07eba957b73d738a70ddc561b42bd2d39258e90280fca4"
+		logic_hash = "v1_sha256_33b85c6e1e1137aeeb07eba957b73d738a70ddc561b42bd2d39258e90280fca4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216081,20 +215885,20 @@ rule RUSSIANPANDA_Ducktail_Mainbot : FILE
 		$s4 = {62 00 65 00 67 00 69 00 6E 00 20 00 73 00 65 00 6E 00 64 00 69 00 6E 00 67}
 
 	condition:
-		all of ($s*) and filesize <12MB and pe.exports("DotNetRuntimeDebugHeader")
+		all of ( $s* ) and filesize < 12MB and pe.exports ( "DotNetRuntimeDebugHeader" )
 }
 rule RUSSIANPANDA_Prysmax_Stealer : FILE
 {
 	meta:
 		description = "Detects Prysmax Stealer"
 		author = "RussianPanda"
-		id = "97ab92b8-1771-5881-9cd1-d8ff76b8f380"
+		id = "86096c82-455b-5b71-b2cb-5a8b9adffdf4"
 		date = "2024-01-09"
 		modified = "2024-01-10"
 		reference = "https://www.cyfirma.com/outofband/new-maas-prysmax-launches-fully-undetectable-infostealer/"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Prysmax Stealer/prysmax_stealer.yar#L1-L21"
 		license_url = "N/A"
-		logic_hash = "869eee7dd5209bdea98c248791b9ac911e3daabe6d440aa62aecefa43539a41c"
+		logic_hash = "v1_sha256_869eee7dd5209bdea98c248791b9ac911e3daabe6d440aa62aecefa43539a41c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -216108,7 +215912,7 @@ rule RUSSIANPANDA_Prysmax_Stealer : FILE
 		$s6 = {50 79 49 6E 73 74 61 6C 6C 65 72}
 
 	condition:
-		all of ($s*) and uint16(0)==0x5A4D and $a1 in (9600000.. filesize ) and #a1>600 and filesize >60MB and filesize <200MB
+		all of ( $s* ) and uint16( 0 ) == 0x5A4D and $a1 in ( 9600000 .. filesize ) and #a1 > 600 and filesize > 60MB and filesize < 200MB
 }
 import "pe"
 
@@ -216117,13 +215921,13 @@ rule RUSSIANPANDA_Metastealer
 	meta:
 		description = "Detects the old version of MetaStealer 11-2023"
 		author = "RussianPanda"
-		id = "c178630b-d188-5faf-86b3-436894241d77"
+		id = "ef7e51c1-3c0d-5088-bc64-a221db90a9ce"
 		date = "2023-11-16"
 		modified = "2023-12-30"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/MetaStealer/metastealer.yar#L2-L19"
 		license_url = "N/A"
-		logic_hash = "f78b376713daf82aa2e0cbd6bf45f33d25530449fa05673c8a7c6b4c0dddca79"
+		logic_hash = "v1_sha256_f78b376713daf82aa2e0cbd6bf45f33d25530449fa05673c8a7c6b4c0dddca79"
 		score = 75
 		quality = 85
 		tags = ""
@@ -216136,20 +215940,20 @@ rule RUSSIANPANDA_Metastealer
 		$s5 = "Biohazard"
 
 	condition:
-		4 of ($s*) and pe.imports("mscoree.dll")
+		4 of ( $s* ) and pe.imports ( "mscoree.dll" )
 }
 rule RUSSIANPANDA_Metastealer_NET_Reactor_Packer : FILE
 {
 	meta:
 		description = "Detects NET_Reactor_packer 12-2023 used in MetaStealer"
 		author = "RussianPanda"
-		id = "5d4f62d2-6a27-53af-9b03-61daa99c10a4"
+		id = "67bcaf63-12fa-5926-9222-20e57db05211"
 		date = "2023-12-29"
 		modified = "2023-12-30"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/MetaStealer/metastealer_12-2023_packer.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "1951d8b05f11b8a77a5bf792ad2b0ad95b8dede936ab5cd0699383468c3c97a8"
+		logic_hash = "v1_sha256_1951d8b05f11b8a77a5bf792ad2b0ad95b8dede936ab5cd0699383468c3c97a8"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -216161,7 +215965,7 @@ rule RUSSIANPANDA_Metastealer_NET_Reactor_Packer : FILE
 		$s4 = {80 F1 E7 80 F2 44 [16] 80 F1 4B 80 F2 23}
 
 	condition:
-		3 of ($s*) and filesize <600KB
+		3 of ( $s* ) and filesize < 600KB
 }
 import "pe"
 
@@ -216170,13 +215974,13 @@ rule RUSSIANPANDA_Metastealer_Core_Payload
 	meta:
 		description = "Detects MetaStealer Core Payload"
 		author = "RussianPanda"
-		id = "ff5854b5-4dac-59d7-8c5a-d5b808d63483"
+		id = "2a1c5e2b-0246-5d21-aa10-751f68ff5362"
 		date = "2023-12-29"
 		modified = "2023-12-29"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/MetaStealer/metastealer_core_payload_12-2023.yar#L2-L19"
 		license_url = "N/A"
-		logic_hash = "99a319023f2c1b714a70458bd33649d6cc343b500a409af12c2eb1ce38ba4241"
+		logic_hash = "v1_sha256_99a319023f2c1b714a70458bd33649d6cc343b500a409af12c2eb1ce38ba4241"
 		score = 75
 		quality = 85
 		tags = ""
@@ -216189,20 +215993,20 @@ rule RUSSIANPANDA_Metastealer_Core_Payload
 		$s5 = "AccountDetails"
 
 	condition:
-		4 of ($s*) and pe.imports("mscoree.dll")
+		4 of ( $s* ) and pe.imports ( "mscoree.dll" )
 }
 rule RUSSIANPANDA_Aurorastealer_March_2023
 {
 	meta:
 		description = "Detects an unobfuscated AuroraStealer March update binary"
 		author = "RussianPanda"
-		id = "a115de7a-bff7-5bb0-b83f-f66a29bbcf3f"
+		id = "c336b8f0-6431-5f19-89e9-7ae5578efc30"
 		date = "2023-03-23"
 		modified = "2023-05-05"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/AuroraStealer/Aurora_March_2023.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "d74d2843a03e826f334ce3c5eb10cc2b43cfd832174769e5d067fb877abe13a0"
+		logic_hash = "v1_sha256_d74d2843a03e826f334ce3c5eb10cc2b43cfd832174769e5d067fb877abe13a0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -216219,13 +216023,13 @@ rule RUSSIANPANDA_Aurorastealer_1
 	meta:
 		description = "Detects the Build/Group IDs if present / detects an unobfuscated AuroraStealer binary; tested on version 22.12.2022"
 		author = "RussianPanda"
-		id = "1a94096f-c838-5272-856e-42efbd123a31"
+		id = "87979a9d-4ff1-51ff-ad9b-9b24892e39f3"
 		date = "2023-02-07"
 		modified = "2023-05-05"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/AuroraStealer/AuroraStealer.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "7a9900266a0dfa7bf0ea91a0260a1d30bd7799a491fba87db083f4fea4115f2a"
+		logic_hash = "v1_sha256_7a9900266a0dfa7bf0ea91a0260a1d30bd7799a491fba87db083f4fea4115f2a"
 		score = 50
 		quality = 85
 		tags = ""
@@ -216245,13 +216049,13 @@ rule RUSSIANPANDA_Purelogs_Stealer_Core : FILE
 	meta:
 		description = "Detects Pure Logs Stealer Core Payload"
 		author = "RussianPanda"
-		id = "bda876c3-76ce-5e1e-8dd4-f06e8240fc11"
+		id = "735760fe-6b07-5b90-ae3b-4d5e83c2c0da"
 		date = "2023-12-26"
 		modified = "2024-01-10"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Pure Logs Stealer/purelogs_stealer_core.yar#L3-L18"
 		license_url = "N/A"
-		logic_hash = "7388299ebcc70aeb86c46c29a787f790993a67148d9f3968def1109e45f69452"
+		logic_hash = "v1_sha256_7388299ebcc70aeb86c46c29a787f790993a67148d9f3968def1109e45f69452"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -216262,20 +216066,20 @@ rule RUSSIANPANDA_Purelogs_Stealer_Core : FILE
 		$s3 = {7E 64 01 00 0A 28 65 01 00 0A}
 
 	condition:
-		all of ($s*) and filesize <5MB and pe.imports("mscoree.dll")
+		all of ( $s* ) and filesize < 5MB and pe.imports ( "mscoree.dll" )
 }
 rule RUSSIANPANDA_Purelogs_Stealer_Initial_Dropper : FILE
 {
 	meta:
 		description = "Detects PureLogs Stealer Initial Payload"
 		author = "RussianPanda"
-		id = "c1e6a0a0-f8ed-5b78-bcae-55c1c1dfc9e4"
+		id = "2ee7d3a5-07b9-56ee-8481-19025c5ab857"
 		date = "2024-01-10"
 		modified = "2024-01-10"
 		reference = "https://russianpanda.com/2023/12/26/Pure-Logs-Stealer-Malware-Analysis/"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Pure Logs Stealer/purelogs_stealer_initial_payload.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "0fe94c705b94f82163f952d0a29aac4689947a1d439bdc1847ee510c25cf2e40"
+		logic_hash = "v1_sha256_0fe94c705b94f82163f952d0a29aac4689947a1d439bdc1847ee510c25cf2e40"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216288,21 +216092,21 @@ rule RUSSIANPANDA_Purelogs_Stealer_Initial_Dropper : FILE
 		$s5 = {28 ?? 00 00 ?? 73 ?? 00 00 [29] 73 15 00 00 0A [22] 28 01 00 00 2B 28 02 00 00 2B}
 
 	condition:
-		all of ($s*) and uint16(0)==0x5A4D and filesize <1MB
+		all of ( $s* ) and uint16( 0 ) == 0x5A4D and filesize < 1MB
 }
 rule RUSSIANPANDA_Darkvnc : FILE
 {
 	meta:
 		description = "Detects DarkVNC"
 		author = "RussianPanda"
-		id = "dbc86ac8-5ea3-59a7-b3ab-68c603165720"
+		id = "fc9c70ca-4dfb-5430-8b8a-883095ab21a4"
 		date = "2024-01-15"
 		modified = "2024-01-15"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/DarkVNC/darkvnc.yar#L1-L15"
 		license_url = "N/A"
 		hash = "3c74dccd06605bcf527ffc27b3122959"
-		logic_hash = "1dd1246e0b22181706433f0cff9b231017e747d8faaa2db4cb9adefeab492ab7"
+		logic_hash = "v1_sha256_1dd1246e0b22181706433f0cff9b231017e747d8faaa2db4cb9adefeab492ab7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216314,21 +216118,21 @@ rule RUSSIANPANDA_Darkvnc : FILE
 		$s4 = "VncStartServer"
 
 	condition:
-		uint16(0)==0x5A4D and 3 of them and filesize <700KB
+		uint16( 0 ) == 0x5A4D and 3 of them and filesize < 700KB
 }
 rule RUSSIANPANDA_Legionloader_Dropper : FILE
 {
 	meta:
 		description = "Detects malicious LegionLoader DLL dropper"
 		author = "RussianPanda"
-		id = "a1b04033-cfe0-5088-bfee-d08752e8840b"
+		id = "1d61d2ab-93b8-5291-a718-ec18d8c0bb7f"
 		date = "2024-09-23"
 		modified = "2024-09-23"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satacom"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/LegionLoader/LegionLoader_dropper.yar#L1-L17"
 		license_url = "N/A"
 		hash = "ef5b961ebc6167e728f9bf40e726ac71"
-		logic_hash = "0871a6a0ab2c405793e8a49e662ba41acdcc6c8afac315f290de2cc05abd39fa"
+		logic_hash = "v1_sha256_0871a6a0ab2c405793e8a49e662ba41acdcc6c8afac315f290de2cc05abd39fa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216339,20 +216143,20 @@ rule RUSSIANPANDA_Legionloader_Dropper : FILE
 		$s3 = {8B ?? 8B ?? 83 ?? 01 D1 ?? F7 ?? 81 ?? 20 83 B8 ED 8B}
 
 	condition:
-		uint16(0)==0x5A4D and all of them and filesize <1MB
+		uint16( 0 ) == 0x5A4D and all of them and filesize < 1MB
 }
 rule RUSSIANPANDA_Win_Mal_Planetstealer : FILE
 {
 	meta:
 		description = "Detects PlanetStealer"
 		author = "RussianPanda"
-		id = "f912066f-4151-5f83-8d34-6bffdf9e25e5"
+		id = "2b78ac1e-78ba-5ef6-ad5f-6cbca8140a70"
 		date = "2024-03-04"
 		modified = "2024-03-24"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/PlanetStealer/win_mal_PlanetStealer.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "e1660d6fed4c48b45b40bd51fb52254c5b19ca6f1938b68f2344bde473820b86"
+		logic_hash = "v1_sha256_e1660d6fed4c48b45b40bd51fb52254c5b19ca6f1938b68f2344bde473820b86"
 		score = 75
 		quality = 79
 		tags = "FILE"
@@ -216365,21 +216169,21 @@ rule RUSSIANPANDA_Win_Mal_Planetstealer : FILE
 		$s5 = {74 6F 74 61 6C 5F 63 6F 6F 6B 69 65 73}
 
 	condition:
-		uint16(0)==0x5A4D and all of them and #s2>100 and #s1>100 and filesize <20MB
+		uint16( 0 ) == 0x5A4D and all of them and #s2 > 100 and #s1 > 100 and filesize < 20MB
 }
 rule RUSSIANPANDA_Mal_Cleanuploader : FILE
 {
 	meta:
 		description = "Detects CleanUpLoader"
 		author = "RussianPanda"
-		id = "fc75fed2-0f8c-55c9-bd10-efe95a678f31"
+		id = "31ad6642-e02d-561f-94c3-44c1336eac5b"
 		date = "2024-02-14"
 		modified = "2024-02-14"
 		reference = "https://x.com/AnFam17/status/1757871703282077857?s=20"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/CleanUpLoader/mal_cleanuploader.yar#L1-L14"
 		license_url = "N/A"
 		hash = "2b62dd154b431d8309002d5b4a35de07"
-		logic_hash = "a9267c568c11420e36f0781469aa7d932c87d52707981912558eb0f4f84f673a"
+		logic_hash = "v1_sha256_a9267c568c11420e36f0781469aa7d932c87d52707981912558eb0f4f84f673a"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -216390,20 +216194,20 @@ rule RUSSIANPANDA_Mal_Cleanuploader : FILE
 		$s3 = {49 00 6E 00 73 00 74 00 61 00 6C 00 6C 00 20 00 45 00 64 00 67 00 65}
 
 	condition:
-		uint16(0)==0x5A4D and all of them and #s1>15
+		uint16( 0 ) == 0x5A4D and all of them and #s1 > 15
 }
 rule RUSSIANPANDA_Pikabot_1 : FILE
 {
 	meta:
 		description = "Detects PikaBot"
 		author = "RussianPanda"
-		id = "e740b821-69cc-5053-9f90-439b4364656f"
+		id = "c92a6faf-fbf3-5e0e-a055-55171bfa79d2"
 		date = "2024-01-02"
 		modified = "2024-01-02"
 		reference = "https://research.openanalysis.net/pikabot/debugging/string%20decryption/2023/11/12/new-pikabot.html"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/PikaBot/Pikabot_1-2-2024.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "f2dd26c23aba72c2b6b959fb411381b7d3a7466f94bf5259f57e96e44d3ee153"
+		logic_hash = "v1_sha256_f2dd26c23aba72c2b6b959fb411381b7d3a7466f94bf5259f57e96e44d3ee153"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216414,20 +216218,20 @@ rule RUSSIANPANDA_Pikabot_1 : FILE
 		$s3 = {8D 53 BF 80 FA 19 0F B6 C3}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of ($s*) and filesize <500KB
+		uint16( 0 ) == 0x5A4D and 2 of ( $s* ) and filesize < 500KB
 }
 rule RUSSIANPANDA_Vidar_DLL_Embedded
 {
 	meta:
 		description = "Vidar Stealer with embedded DLL dependencies"
 		author = "RussianPanda"
-		id = "462fe42a-2504-5e7e-ad90-2c7e54478204"
+		id = "e47af203-fb28-5d09-97d1-5b6ca4a166f0"
 		date = "2023-05-02"
 		modified = "2023-05-05"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/VidarStealer/vidar_ver3.6_3.7_dll_embedded.yar#L1-L21"
 		license_url = "N/A"
-		logic_hash = "98d23523c2ab196f670dc33164954fc69a1c1692fa870a476e25d7dd3cebace2"
+		logic_hash = "v1_sha256_98d23523c2ab196f670dc33164954fc69a1c1692fa870a476e25d7dd3cebace2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -216443,21 +216247,21 @@ rule RUSSIANPANDA_Vidar_DLL_Embedded
 		$a7 = "Exodus\\exodus.wallet"
 
 	condition:
-		$s and 5 of ($a*)
+		$s and 5 of ( $a* )
 }
 rule RUSSIANPANDA_Raccoonstealer : FILE
 {
 	meta:
 		description = "Detects Raccoon Stealer v2.3.1.1"
 		author = "RussianPanda"
-		id = "29f28cd5-370b-5831-8b71-a253f468f7e4"
+		id = "8dc7c512-8bc5-5d83-b129-a59915bae98f"
 		date = "2024-01-08"
 		modified = "2024-01-08"
 		reference = "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-raccoon-stealer-v2-0"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/RaccoonStealer_v2/raccoonstealer_v2.3.1.1.yar#L1-L20"
 		license_url = "N/A"
 		hash = "c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb"
-		logic_hash = "ee2b39c1c2068b97e63a03330a2f9e2f12e53aaf9cfffb274acde2372a11fe45"
+		logic_hash = "v1_sha256_ee2b39c1c2068b97e63a03330a2f9e2f12e53aaf9cfffb274acde2372a11fe45"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216471,20 +216275,20 @@ rule RUSSIANPANDA_Raccoonstealer : FILE
 		$s6 = "machineId="
 
 	condition:
-		all of ($s*) and #s1>10 and uint16(0)==0x5A4D and filesize <5MB
+		all of ( $s* ) and #s1 > 10 and uint16( 0 ) == 0x5A4D and filesize < 5MB
 }
 rule RUSSIANPANDA_Raccoonstealerv2 : FILE
 {
 	meta:
 		description = "Detects the latest unpacked/unobfuscated build 2.1.0-4"
 		author = "RussianPanda"
-		id = "eda6216a-219b-5f60-8084-4c0c240a4cb4"
+		id = "f540a7b5-e627-5f70-a37b-9b11db723706"
 		date = "2023-04-17"
 		modified = "2023-05-05"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/RaccoonStealer_v2/raccoonstealerv2_2.1.0-4_build.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "e2226f08753a3571045953363c04ec52de3c79cd0cd29e7ecb6afaf2ad573e4e"
+		logic_hash = "v1_sha256_e2226f08753a3571045953363c04ec52de3c79cd0cd29e7ecb6afaf2ad573e4e"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -216497,21 +216301,21 @@ rule RUSSIANPANDA_Raccoonstealerv2 : FILE
 		$m2 = {68 ?? ?? ?? 00 ?? 68 01 00 1f 00 ff 15 64 ?? ?? 00}
 
 	condition:
-		2 of ($pattern*) and uint16(0)==0x5A4D and 1 of ($m*) and uint32( uint32(0x3C))==0x00004550 and filesize <200KB
+		2 of ( $pattern* ) and uint16( 0 ) == 0x5A4D and 1 of ( $m* ) and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 200KB
 }
 rule RUSSIANPANDA_Atomic_Stealer : FILE
 {
 	meta:
 		description = "Detects Atomic Stealer targering MacOS"
 		author = "RussianPanda"
-		id = "259c5c33-0164-568f-aec4-4fe0a2c6d015"
+		id = "ea10360e-8cfb-54a9-98fb-4c10989f0803"
 		date = "2024-01-13"
 		modified = "2024-01-17"
 		reference = "https://www.bleepingcomputer.com/news/security/macos-info-stealers-quickly-evolve-to-evade-xprotect-detection/"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/AtomicStealer/Atomic_Stealer.yar#L1-L27"
 		license_url = "N/A"
 		hash = "dd8aa38c7f06cb1c12a4d2c0927b6107"
-		logic_hash = "7601e508aeccba943b54e675212993920c984271f655e68c19efaf6d12cfebd5"
+		logic_hash = "v1_sha256_7601e508aeccba943b54e675212993920c984271f655e68c19efaf6d12cfebd5"
 		score = 75
 		quality = 58
 		tags = "FILE"
@@ -216526,49 +216330,20 @@ rule RUSSIANPANDA_Atomic_Stealer : FILE
 		$c2 = {64 65 73 6B 77 61 6C 6C 65 74 73}
 
 	condition:
-		( uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xcafebabe or uint32(0)==0xbebafeca) and all of ($s*) and #s1>60 and #s2>100 or ( all of ($t*) and #t1>10 and #t2>5) or (#c1>200 and $c2)
-}
-rule RUSSIANPANDA_Darkgate_Autoit
-{
-	meta:
-		description = "Detects DarkGate AutoIT script"
-		author = "RussianPanda"
-		id = "b30544b5-88c9-5a84-8582-f4f72b228f24"
-		date = "2024-01-26"
-		modified = "2024-01-26"
-		reference = "https://yara.readthedocs.io/en/stable/writingrules.html?highlight=xor"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/DarkGate/darkgate_autoit.yar#L1-L19"
-		license_url = "N/A"
-		hash = "e1803b01e3f187355dbeb87a0c91b76c"
-		logic_hash = "dda6726d09035d6f61ca331d18ed37f032c6f6a5ab88e1754a21587f4c79ac87"
-		score = 75
-		quality = 85
-		tags = ""
-
-	strings:
-		$h = "AU3!EA06"
-		$s1 = "just_test.txt" xor(0x01-0xff)
-		$s2 = "c:\\temp\\data.txt" xor(0x01-0xff)
-		$s3 = "test.txt" xor(0x01-0xff)
-		$s4 = "cc.txt" xor(0x01-0xff)
-		$s5 = "c:\\temp\\data.txt" xor(0x01-0xff)
-		$s6 = "uu.txt" xor(0x01-0xff)
-
-	condition:
-		3 of ($s*) and $h
+		( uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xcefaedfe or uint32( 0 ) == 0xfeedfacf or uint32( 0 ) == 0xcffaedfe or uint32( 0 ) == 0xcafebabe or uint32( 0 ) == 0xbebafeca ) and all of ( $s* ) and #s1 > 60 and #s2 > 100 or ( all of ( $t* ) and #t1 > 10 and #t2 > 5 ) or ( #c1 > 200 and $c2 )
 }
 rule RUSSIANPANDA_Workersdevbackdoor_PS : FILE
 {
 	meta:
 		description = "Detects WorkersDevBackdoor PowerShell script"
 		author = "RussianPanda"
-		id = "d2b526c1-a9f5-57de-818c-99b02e778a0d"
+		id = "d9a41923-718d-5364-a418-546e7449fc96"
 		date = "2023-12-15"
 		modified = "2023-12-15"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/WorkersDevBackdoor/WorkersDevBackdoor_PS.yar#L1-L18"
 		license_url = "N/A"
-		logic_hash = "c71eed8fd7a44f3018150cc6ef55d10779093ed8e4c77fd9babcf9b1b9fadfda"
+		logic_hash = "v1_sha256_c71eed8fd7a44f3018150cc6ef55d10779093ed8e4c77fd9babcf9b1b9fadfda"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216582,7 +216357,7 @@ rule RUSSIANPANDA_Workersdevbackdoor_PS : FILE
 		$s6 = "CSharp" wide
 
 	condition:
-		all of ($s*) and filesize <200KB
+		all of ( $s* ) and filesize < 200KB
 }
 import "pe"
 
@@ -216591,13 +216366,13 @@ rule RUSSIANPANDA_Workersdevbackdoor : FILE
 	meta:
 		description = "Detects WorkersDevBackdoor"
 		author = "RussianPanda"
-		id = "725e0924-c108-5927-8d27-e4bc5b284883"
+		id = "3b37afdf-fb4e-5455-bbbe-464883abfca8"
 		date = "2023-12-15"
 		modified = "2024-01-05"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/WorkersDevBackdoor/WorkDevBackdoor.yar#L3-L20"
 		license_url = "N/A"
-		logic_hash = "f92ad9dc657d87a47e539ea2ee896f9b86bb95e51a890a838c6e6b0efa5deb7d"
+		logic_hash = "v1_sha256_f92ad9dc657d87a47e539ea2ee896f9b86bb95e51a890a838c6e6b0efa5deb7d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216609,20 +216384,20 @@ rule RUSSIANPANDA_Workersdevbackdoor : FILE
 		$s4 = {43 00 4F 00 4D 00 50 00 55 00 54 00 45 00 52 00 4E 00 41 00 4D 00 45}
 
 	condition:
-		3 of ($s*) and pe.imports("mscoree.dll") and filesize <2MB
+		3 of ( $s* ) and pe.imports ( "mscoree.dll" ) and filesize < 2MB
 }
 rule RUSSIANPANDA_PSWSTEALER : FILE
 {
 	meta:
 		description = "PSWSTEALER"
 		author = "RussianPanda"
-		id = "8a596074-ffe3-5979-b384-487ebe8b953c"
+		id = "09e7b4c4-8ef5-5479-b804-cdd9f93379e3"
 		date = "2023-04-02"
 		modified = "2023-05-05"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/PSWSTEALER/pswstealer.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "7d85b0ccaa07419f22b9f38a4bc66435cd689b21fa7e4584ef8bea485b6bd2c1"
+		logic_hash = "v1_sha256_7d85b0ccaa07419f22b9f38a4bc66435cd689b21fa7e4584ef8bea485b6bd2c1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216634,7 +216409,7 @@ rule RUSSIANPANDA_PSWSTEALER : FILE
 		$s = {73 ?? 00 00 0A 0C 08 6F ?? 00 00 0A}
 
 	condition:
-		all of them and filesize <200KB
+		all of them and filesize < 200KB
 }
 import "pe"
 
@@ -216643,13 +216418,13 @@ rule RUSSIANPANDA_Andeloader
 	meta:
 		description = "Detects Ande Loader"
 		author = "RussianPanda"
-		id = "c08d63b6-9fef-505d-9611-9dd0403c7c7c"
+		id = "9fc46b01-761e-58d3-9162-c33bc1e7b5cf"
 		date = "2023-12-11"
 		modified = "2023-12-11"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/AndeLoader/ande_loader.yar#L3-L18"
 		license_url = "N/A"
-		logic_hash = "cd55153077e5cfbd84cbe5b062dbd842def245417acfea4ed6c2b1db702dcc81"
+		logic_hash = "v1_sha256_cd55153077e5cfbd84cbe5b062dbd842def245417acfea4ed6c2b1db702dcc81"
 		score = 75
 		quality = 83
 		tags = ""
@@ -216660,20 +216435,20 @@ rule RUSSIANPANDA_Andeloader
 		$s3 = ".vbs" wide
 
 	condition:
-		3 of ($s*) and pe.imports("mscoree.dll")
+		3 of ( $s* ) and pe.imports ( "mscoree.dll" )
 }
 rule RUSSIANPANDA_Fakebat_Powershell
 {
 	meta:
 		description = "Detects FakeBat PowerShell scripts"
 		author = "RussianPanda"
-		id = "76149a6f-c370-5e48-82cc-c89b545c0aa8"
+		id = "2cbb9451-6d1c-5c47-8489-44d6d513c8dc"
 		date = "2023-12-01"
 		modified = "2023-12-01"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/FakeBat/fakebat_powershell.yar#L1-L13"
 		license_url = "N/A"
-		logic_hash = "df6b30d97ac6c9b248fed0d901e8a0a6ad1d855483a5006b008b839d9961092a"
+		logic_hash = "v1_sha256_df6b30d97ac6c9b248fed0d901e8a0a6ad1d855483a5006b008b839d9961092a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -216683,21 +216458,21 @@ rule RUSSIANPANDA_Fakebat_Powershell
 		$s2 = "$xxx.gpg" nocase
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
 rule RUSSIANPANDA_Garystealer : FILE
 {
 	meta:
 		description = "Detects GaryStealer 1-3-2024"
 		author = "RussianPanda"
-		id = "4b0af30e-2cf1-539d-89fa-7e4e32cd6eab"
+		id = "20ffbda3-e2e8-5716-9591-dea0d76f153e"
 		date = "2024-01-03"
 		modified = "2024-01-03"
 		reference = "https://cybersecurity.att.com/blogs/labs-research/behind-the-scenes-jaskagos-coordinated-strike-on-macos-and-windows"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/GaryStealer/garystealer-1-3-2024.yar#L1-L20"
 		license_url = "N/A"
 		hash = "6efa29a0f9d112cfbb982f7d9c0ddfe395b0b0edb885c2d5409b33ad60ce1435"
-		logic_hash = "f71655d0cb237c08af9c298ec9eec1ae9bd1efd50e26d61afddf9056b6883a15"
+		logic_hash = "v1_sha256_f71655d0cb237c08af9c298ec9eec1ae9bd1efd50e26d61afddf9056b6883a15"
 		score = 75
 		quality = 79
 		tags = "FILE"
@@ -216709,21 +216484,21 @@ rule RUSSIANPANDA_Garystealer : FILE
 		$s4 = {C7 40 28 ?? 00 00 00}
 
 	condition:
-		uint16(0)==0x5A4D and 3 of ($s*) and filesize <20MB and #s4>2
+		uint16( 0 ) == 0x5A4D and 3 of ( $s* ) and filesize < 20MB and #s4 > 2
 }
 rule RUSSIANPANDA_Mal_Xred_Backdoor : FILE
 {
 	meta:
 		description = "Detects XRed backdoor"
 		author = "RussianPanda"
-		id = "61f5fcb8-9351-5db0-8bce-123c96d2a443"
+		id = "9e4a9ff0-24c2-5fc1-95f2-26ce9473da6d"
 		date = "2024-02-09"
 		modified = "2024-02-09"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/XRed_Backdoor/mal_xred_backdoor.yar#L1-L18"
 		license_url = "N/A"
 		hash = "9e1fbae3a659899dde8db18a32daa46a"
-		logic_hash = "36d138a0efade1d5c075662dc528235fe66b49879730db78c4c7290fec7420b5"
+		logic_hash = "v1_sha256_36d138a0efade1d5c075662dc528235fe66b49879730db78c4c7290fec7420b5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -216737,21 +216512,21 @@ rule RUSSIANPANDA_Mal_Xred_Backdoor : FILE
 		$s6 = {58 52 65 64 35 37}
 
 	condition:
-		uint16(0)==0x5A4D and 3 of them
+		uint16( 0 ) == 0x5A4D and 3 of them
 }
 rule RUSSIANPANDA_Win_Mal_Xworm : FILE
 {
 	meta:
 		description = "Detects XWorm RAT"
 		author = "RussianPanda"
-		id = "5701f382-3c97-5a00-9673-6c39b0f11cc2"
+		id = "5bb71bf3-66a0-51cf-a4e0-0d68d09d2108"
 		date = "2024-03-11"
 		modified = "2024-03-11"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/XWorm/win_mal_XWorm.yar#L1-L15"
 		license_url = "N/A"
 		hash = "fc422800144383ef6e2e0eee37e7d6ba"
-		logic_hash = "c42544285517dc61628e8df2ee5ab6733924fbb2cc08b9b2df273eec0a401d90"
+		logic_hash = "v1_sha256_c42544285517dc61628e8df2ee5ab6733924fbb2cc08b9b2df273eec0a401d90"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216764,20 +216539,20 @@ rule RUSSIANPANDA_Win_Mal_Xworm : FILE
 		$s5 = "_CorExeMain"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule RUSSIANPANDA_Meduzastealer : FILE
 {
 	meta:
 		description = "Detects MeduzaStealer 1-2024"
 		author = "RussianPanda"
-		id = "6bc4c048-a32d-5a9c-b213-980c64d08d29"
+		id = "5841acc1-a354-5983-be49-ba215be2ffc1"
 		date = "2024-01-01"
 		modified = "2024-01-01"
 		reference = "https://russianpanda.com/2023/06/28/Meduza-Stealer-or-The-Return-of-The-Infamous-Aurora-Stealer/"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/MeduzaStealer/MeduzaStealer_1-1-2024.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "0547e51abd04302c45f1319bc21046ade019bc98eb85d9cba67cb2109ff642eb"
+		logic_hash = "v1_sha256_0547e51abd04302c45f1319bc21046ade019bc98eb85d9cba67cb2109ff642eb"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -216789,21 +216564,21 @@ rule RUSSIANPANDA_Meduzastealer : FILE
 		$s4 = {48 8d 0d ?? ?? 06 00 ff 15 ?? ?? 06 00}
 
 	condition:
-		3 of ($s*) and filesize <1MB
+		3 of ( $s* ) and filesize < 1MB
 }
 rule RUSSIANPANDA_Jinxloader : FILE
 {
 	meta:
 		description = "Detects JinxLoader Golang version"
 		author = "RussianPanda"
-		id = "25570c99-5938-5be0-a153-a07be0d0571c"
+		id = "429d4b94-09d2-5eba-b844-b2c409ee884d"
 		date = "2024-01-02"
 		modified = "2024-01-02"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/JinxLoader/JinxLoader-1-2-2024.yar#L1-L16"
 		license_url = "N/A"
 		hash = "6bd7ff5d764214f239af2bb58b368308c2d04f1147678c2f638f37a893995f71"
-		logic_hash = "13dee435fb4d40c629c0a30b6f655b87f14b10a6f6acf61d00e6c692c9bb0ff1"
+		logic_hash = "v1_sha256_13dee435fb4d40c629c0a30b6f655b87f14b10a6f6acf61d00e6c692c9bb0ff1"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -216815,21 +216590,21 @@ rule RUSSIANPANDA_Jinxloader : FILE
 		$s4 = {48 8D 1D B7 24 08 00 [25] E8 EF FC E4 FF}
 
 	condition:
-		uint16(0)==0x5A4D and all of ($s*) and filesize <9MB
+		uint16( 0 ) == 0x5A4D and all of ( $s* ) and filesize < 9MB
 }
 rule RUSSIANPANDA_Smartapesg_JS_Netsupportrat_Stage2 : FILE
 {
 	meta:
 		description = "Detects SmartApeSG JavaScript Stage 2 retrieving NetSupportRAT"
 		author = "RussianPanda"
-		id = "2a614e11-be32-5bf1-9fd1-da224f0a644e"
+		id = "cda8c131-b162-53a8-a2bb-f4ea74f2f735"
 		date = "2024-01-11"
 		modified = "2024-01-12"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/SmartApeSG/SmartApeSG_JS_NetSupportRAT_stage2.yar#L1-L23"
 		license_url = "N/A"
 		hash = "67d8f84b37732cf85e05b327ad6b6a9f"
-		logic_hash = "5a2afaa14d513e0a3c4e52acfb433e53a4541983a05d15318a217c14dc06453c"
+		logic_hash = "v1_sha256_5a2afaa14d513e0a3c4e52acfb433e53a4541983a05d15318a217c14dc06453c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216844,21 +216619,21 @@ rule RUSSIANPANDA_Smartapesg_JS_Netsupportrat_Stage2 : FILE
 		$s5 = "Start-Process -FilePath $"
 
 	condition:
-		filesize <1MB and ((1 of ($x*) and 3 of them ) or 5 of them )
+		filesize < 1MB and ( ( 1 of ( $x* ) and 3 of them ) or 5 of them )
 }
 rule RUSSIANPANDA_Smartapesg_JS_Dropper_Stage1 : FILE
 {
 	meta:
 		description = "Detects SmartApeSG initial JavaScript file"
 		author = "RussianPanda"
-		id = "9513f323-c315-5ae2-92a5-c831d0a7ce2a"
+		id = "3f701e6c-1875-5edf-a0d8-d89d494b7afd"
 		date = "2024-01-11"
 		modified = "2024-01-11"
 		reference = "https://medium.com/walmartglobaltech/smartapesg-4605157a5b80"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/SmartApeSG/SmartApeSG_JS_dropper_stage1.yar#L1-L18"
 		license_url = "N/A"
 		hash = "8769d9ebcf14b24a657532cd96f9520f54aa0e799399d840285311dfebe3fb15"
-		logic_hash = "de7e4ec30c780699b46de7baf2a916fdb7331da2ee7c2d637422ea664cd03b82"
+		logic_hash = "v1_sha256_de7e4ec30c780699b46de7baf2a916fdb7331da2ee7c2d637422ea664cd03b82"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216873,21 +216648,21 @@ rule RUSSIANPANDA_Smartapesg_JS_Dropper_Stage1 : FILE
 		$s5 = /\/news\.php\?([0-9]|[1-9][0-9]|100)/
 
 	condition:
-		all of ($s*) and filesize <1MB and any of ($a*)
+		all of ( $s* ) and filesize < 1MB and any of ( $a* )
 }
 rule RUSSIANPANDA_Gh0Strat : FILE
 {
 	meta:
 		description = "Detects Gh0stRAT"
 		author = "RussianPanda"
-		id = "db310549-feed-57b8-9ec0-232b6eda62f9"
+		id = "6d378476-10f5-5c13-af4c-fac00d89f762"
 		date = "2024-07-09"
 		modified = "2024-07-09"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Gh0stRAT/Gh0stRAT.yar#L1-L14"
 		license_url = "N/A"
 		hash = "678b06ecdbc9b186788cf960332566f9"
-		logic_hash = "bc4bdad83a0e23273774c3d4812cabe9fa44897c8ff2e308004e03b4f1622cd5"
+		logic_hash = "v1_sha256_bc4bdad83a0e23273774c3d4812cabe9fa44897c8ff2e308004e03b4f1622cd5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216899,20 +216674,20 @@ rule RUSSIANPANDA_Gh0Strat : FILE
 		$s4 = "WinSta0\\Default"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule RUSSIANPANDA_Whitesnakestealer : FILE
 {
 	meta:
 		description = "WhiteSnake Stealer"
 		author = "RussianPanda"
-		id = "70b69aba-5096-59a6-bb0b-44d248aecc26"
+		id = "e7b1b060-16f6-57c5-b451-09ac3ffe5a66"
 		date = "2023-07-04"
 		modified = "2023-12-11"
 		reference = "https://russianpanda.com/2023/07/04/WhiteSnake-Stealer-Malware-Analysis/"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/WhiteSnake-Stealer/WhiteSnake_rc4.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "24985a2c3b0d72858decd17cb2b8e485caa94c01ad72a014edc68ed4facfd71e"
+		logic_hash = "v1_sha256_24985a2c3b0d72858decd17cb2b8e485caa94c01ad72a014edc68ed4facfd71e"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -216924,20 +216699,20 @@ rule RUSSIANPANDA_Whitesnakestealer : FILE
 		$s4 = "vbox" wide
 
 	condition:
-		all of ($s*) and filesize <300KB
+		all of ( $s* ) and filesize < 300KB
 }
 rule RUSSIANPANDA_Whitesnakestealer_1 : FILE
 {
 	meta:
 		description = "Detects WhiteSnake Stealer XOR samples "
 		author = "RussianPanda"
-		id = "cfe168a6-cc2f-5cfe-985c-78b232dc2651"
+		id = "2ab82bdf-cf77-5c5d-8e3f-43b14e2bd901"
 		date = "2023-07-04"
 		modified = "2023-12-11"
 		reference = "https://russianpanda.com/2023/07/04/WhiteSnake-Stealer-Malware-Analysis/"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/WhiteSnake-Stealer/WhiteSnake_xor.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "0bd0e250b8598be297296ecf6644d3bf649e3dc4598438325a0913afed04c819"
+		logic_hash = "v1_sha256_0bd0e250b8598be297296ecf6644d3bf649e3dc4598438325a0913afed04c819"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -216947,21 +216722,21 @@ rule RUSSIANPANDA_Whitesnakestealer_1 : FILE
 		$s2 = {61 6e 61 6c 2e 6a 70 67}
 
 	condition:
-		all of ($s*) and filesize <600KB
+		all of ( $s* ) and filesize < 600KB
 }
 rule RUSSIANPANDA_Solarmarker_Loader_PS2EXE : FILE
 {
 	meta:
 		description = "Detects SolarMarker loader using PS2EXE"
 		author = "RussianPanda"
-		id = "837883a1-b657-52ae-95c4-ebafc8ac55de"
+		id = "5bb82d33-abcf-5606-9c8c-4c7416083880"
 		date = "2024-01-04"
 		modified = "2024-01-04"
 		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/SolarMarker/solarmarker_loader.yar#L1-L17"
 		license_url = "N/A"
 		hash = "b45c31679c2516b38c7ff8c395f1d11d"
-		logic_hash = "4f579f350c3320e7b811cae0efe7302e852f59adc02d805f64ba464f8a995f25"
+		logic_hash = "v1_sha256_4f579f350c3320e7b811cae0efe7302e852f59adc02d805f64ba464f8a995f25"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -216972,20 +216747,20 @@ rule RUSSIANPANDA_Solarmarker_Loader_PS2EXE : FILE
 		$s3 = {72 C1 02 00 70 72 B2 03 00 70 72 B8 03 00 70}
 
 	condition:
-		all of ($s*) and filesize >200MB
+		all of ( $s* ) and filesize > 200MB
 }
 rule RUSSIANPANDA_Solardropper
 {
 	meta:
 		description = "SolarMarker first stage detection"
 		author = "RussianPanda"
-		id = "8e40b001-ae00-5768-bb91-e45264748087"
+		id = "d85e3e33-be85-55ee-929b-4b9e013be207"
 		date = "2024-01-03"
 		modified = "2024-01-03"
 		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/SolarMarker/solardropper.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "5dccb7be94e814335c0c867f8b3dd8855043375fe9f1235d5519c690fc7df842"
+		logic_hash = "v1_sha256_5dccb7be94e814335c0c867f8b3dd8855043375fe9f1235d5519c690fc7df842"
 		score = 75
 		quality = 85
 		tags = ""
@@ -216996,21 +216771,21 @@ rule RUSSIANPANDA_Solardropper
 		$p3 = {5e 00 2d 00 28 00 5b 00 5e 00 3a 00 20 00 5d 00 2b 00 29 00 5b 00 20 00 3a 00 5d 00 3f 00 28 00 5b 00 5e 00 3a 00 5d 00 2a 00 29 00 24 00}
 
 	condition:
-		all of ($p*)
+		all of ( $p* )
 }
 rule RUSSIANPANDA_Solarmarker_First_Stage_Payload : FILE
 {
 	meta:
 		description = "Detects SolarMarker First Stage payload"
 		author = "RussianPanda"
-		id = "56eec644-9ad7-51db-9d11-68ea3e12c36a"
+		id = "8a3101b9-a428-5a97-9554-af4448084ca8"
 		date = "2024-01-30"
 		modified = "2024-01-30"
 		reference = "https://x.com/luke92881/status/1751968350689771966?s=20"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/SolarMarker/solarmarker_first_stage_payload.yar#L1-L21"
 		license_url = "N/A"
 		hash = "f53563541293a826738d3b8f1164ea43"
-		logic_hash = "e704614782b0f3cba60c53413e889113d2d44f37e60801205e5ed5ff921b13ee"
+		logic_hash = "v1_sha256_e704614782b0f3cba60c53413e889113d2d44f37e60801205e5ed5ff921b13ee"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -217026,20 +216801,20 @@ rule RUSSIANPANDA_Solarmarker_First_Stage_Payload : FILE
 		$s8 = "_CorExeMain"
 
 	condition:
-		all of them and filesize >250MB
+		all of them and filesize > 250MB
 }
 rule RUSSIANPANDA_Solarphantom : FILE
 {
 	meta:
 		description = "SolarPhantom Backdoor Detection"
 		author = "RussianPanda"
-		id = "f564a943-e83b-5c1b-ba8c-b227d69d3fd8"
+		id = "a3e38bb8-04f4-5b47-9d3a-cc4f19b69c9a"
 		date = "2023-12-11"
 		modified = "2023-12-11"
 		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/SolarMarker/solarphantom.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "3b49d301e625d5abf1b726481a80d6a97d33acd3301c12964f2f37d37130c1b7"
+		logic_hash = "v1_sha256_3b49d301e625d5abf1b726481a80d6a97d33acd3301c12964f2f37d37130c1b7"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -217050,7 +216825,7 @@ rule RUSSIANPANDA_Solarphantom : FILE
 		$p3 = {62 72 76 70 72 66 5f 62 6b 70}
 
 	condition:
-		uint16(0)==0x5A4D and 1 of ($p*) and filesize <600KB
+		uint16( 0 ) == 0x5A4D and 1 of ( $p* ) and filesize < 600KB
 }
 import "pe"
 
@@ -217059,14 +216834,14 @@ rule RUSSIANPANDA_Solarmarker_Loader : FILE
 	meta:
 		description = "Detects SolarMarker loader 1-4-2024"
 		author = "RussianPanda"
-		id = "b385fcd4-62b7-5a83-8a2e-6841fdd17526"
+		id = "7f98815a-78ee-5a1a-a6ff-875d80c83e00"
 		date = "2024-01-04"
 		modified = "2024-01-04"
 		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/SolarMarker/solarmarker_backdoor.yar#L3-L19"
 		license_url = "N/A"
 		hash = "8eeefe0df0b057fc866b8d35625156de"
-		logic_hash = "035eccb41f2ecdeb196003542c165cedad96e3e8e741511b4beda3dfe1ece74e"
+		logic_hash = "v1_sha256_035eccb41f2ecdeb196003542c165cedad96e3e8e741511b4beda3dfe1ece74e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -217075,20 +216850,20 @@ rule RUSSIANPANDA_Solarmarker_Loader : FILE
 		$s1 = {06 [0-7] 58 D1 8C [3] 01 28 [3] 0A 0A}
 
 	condition:
-		all of ($s*) and #s1>5 and filesize <7MB and pe.imports("mscoree.dll")
+		all of ( $s* ) and #s1 > 5 and filesize < 7MB and pe.imports ( "mscoree.dll" )
 }
 rule RUSSIANPANDA_Neptune_Loader : FILE
 {
 	meta:
 		description = "Detects Neptune Loader"
 		author = "RussianPanda"
-		id = "d576bf47-10bd-55d0-99b0-69c02dc87f17"
+		id = "0f19af97-e840-56a7-b6e5-dc5c9835b52d"
 		date = "2024-01-17"
 		modified = "2024-01-21"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/NeptuneLoader/neptune_loader.yar#L1-L18"
 		license_url = "N/A"
-		logic_hash = "ca54b8a624d48aa28bc727420f25e6f0fd67b193ac79443a357d88a9fe7cbdbb"
+		logic_hash = "v1_sha256_ca54b8a624d48aa28bc727420f25e6f0fd67b193ac79443a357d88a9fe7cbdbb"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -217103,21 +216878,21 @@ rule RUSSIANPANDA_Neptune_Loader : FILE
 		$t3 = {8B ?? ?? FF D0 B8}
 
 	condition:
-		uint16(0)==0x5A4D and 3 of ($s*) or 2 of ($t*) and filesize <6MB
+		uint16( 0 ) == 0x5A4D and 3 of ( $s* ) or 2 of ( $t* ) and filesize < 6MB
 }
 rule RUSSIANPANDA_Mal_Narniarat : FILE
 {
 	meta:
 		description = "Detects NarniaRAT from BotnetFenix campaign"
 		author = "RussianPanda"
-		id = "64c3a44b-5d75-5fec-bfc1-b66a5eb5780c"
+		id = "e729451a-fb5b-56c4-8907-4b310097d62e"
 		date = "2024-02-02"
 		modified = "2024-02-02"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/NarniaRAT/mal_NarniaRAT.yar#L1-L16"
 		license_url = "N/A"
 		hash = "43f6c3f92a025d12de4c4f14afa5d098"
-		logic_hash = "3ee8bf6b3970c6f56ca98c87752050217e350da160a650e1724b19f340bf0230"
+		logic_hash = "v1_sha256_3ee8bf6b3970c6f56ca98c87752050217e350da160a650e1724b19f340bf0230"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -217131,21 +216906,21 @@ rule RUSSIANPANDA_Mal_Narniarat : FILE
 		$s6 = "_CorExeMain"
 
 	condition:
-		uint16(0)==0x5A4D and 5 of them
+		uint16( 0 ) == 0x5A4D and 5 of them
 }
 rule RUSSIANPANDA_Truecrypt_Crypter : FILE
 {
 	meta:
 		description = "Detects TrueCrypt crypter"
 		author = "RussianPanda"
-		id = "3ecf9c2f-6205-5e55-83a5-2b4e3ba89f07"
+		id = "748a8683-fe3b-5433-aed0-a1b282949f7a"
 		date = "2024-01-06"
 		modified = "2024-01-06"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/TrueCrypt/truecrypt_crypter.yar#L1-L27"
 		license_url = "N/A"
 		hash = "167637397fb45ea19bafcf208d8f27dceec82caa7ab19d40ecdb08eb1b7d4f60"
-		logic_hash = "68612c68053e9fb81d9616c04b04ac2e2cb685f3b7ed71f8b31e8f22e3a539e7"
+		logic_hash = "v1_sha256_68612c68053e9fb81d9616c04b04ac2e2cb685f3b7ed71f8b31e8f22e3a539e7"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -217162,21 +216937,21 @@ rule RUSSIANPANDA_Truecrypt_Crypter : FILE
 		$s_crpt = {6F 5F 64 75 6D 6D 79 5F 65 78 70 6F 72 74}
 
 	condition:
-		uint16(0)==0x5A4D and $s1_crpt1 and $s2_crpt1 and $s2_crpt2 and $s3_crpt1 and $s3_crpt2 and $s4_crpt1 and $s4_crpt2 and $a_crpt and $s_crpt and filesize <7MB
+		uint16( 0 ) == 0x5A4D and $s1_crpt1 and $s2_crpt1 and $s2_crpt2 and $s3_crpt1 and $s3_crpt2 and $s4_crpt1 and $s4_crpt2 and $a_crpt and $s_crpt and filesize < 7MB
 }
 rule RUSSIANPANDA_Obfuscation_Powershell_Special_Chars
 {
 	meta:
 		description = "Detects PowerShell special character obfuscation"
 		author = "RussianPanda"
-		id = "dd2d41d4-3431-5252-adf1-d537f3b8db7e"
+		id = "31449f3d-09f4-5d9c-90c1-56b4cf2afcea"
 		date = "2024-01-12"
 		modified = "2024-02-02"
 		reference = "https://perl-users.jp/articles/advent-calendar/2010/sym/11"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/PowerShell Obfuscation/obfuscation_powershell_special_chars.yar#L1-L15"
 		license_url = "N/A"
 		hash = "d77efad78ef3afc5426432597ba129141952719846bc5ccd058249bb23d8a905"
-		logic_hash = "4cc4ebffe7bf712b412a060536acc51d94381d24b46e5494195ae17482076cd6"
+		logic_hash = "v1_sha256_4cc4ebffe7bf712b412a060536acc51d94381d24b46e5494195ae17482076cd6"
 		score = 75
 		quality = 81
 		tags = ""
@@ -217188,7 +216963,7 @@ rule RUSSIANPANDA_Obfuscation_Powershell_Special_Chars
 		$s4 = {24 7B [1-10] 7D 24 7B}
 
 	condition:
-		2 of ($s*)
+		2 of ( $s* )
 }
 import "pe"
 
@@ -217197,14 +216972,14 @@ rule RUSSIANPANDA_Illyrianstealer : FILE
 	meta:
 		description = "Detects Illyrian Stealer"
 		author = "RussianPanda"
-		id = "2f85e87c-6883-5f41-a37c-00f9e93f61bf"
+		id = "c59695c4-c3ee-5b0d-9e36-dab0b4b2dee4"
 		date = "2024-01-08"
 		modified = "2024-01-08"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/IllyrianStealer/illyrian_stealer.yar#L2-L18"
 		license_url = "N/A"
 		hash = "fae0aed6173804e8c22027cbb0c121eedd927f16ea7e2b23662dbe6e016980e8"
-		logic_hash = "2012d401d3e7ce2d4d6ea12ed01a30b7d3e18f4ed47dbf70d43bae6c328960ea"
+		logic_hash = "v1_sha256_2012d401d3e7ce2d4d6ea12ed01a30b7d3e18f4ed47dbf70d43bae6c328960ea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -217216,21 +216991,21 @@ rule RUSSIANPANDA_Illyrianstealer : FILE
 		$s4 = "|Black|" wide
 
 	condition:
-		all of ($s*) and filesize <50KB and pe.imports("mscoree.dll")
+		all of ( $s* ) and filesize < 50KB and pe.imports ( "mscoree.dll" )
 }
 rule RUSSIANPANDA_Mal_Msedge_Dll_Virusloader : FILE
 {
 	meta:
 		description = "Detects malicious msedge.dll file"
 		author = "RussianPanda"
-		id = "7139ee30-de9a-5ef0-a96f-2ab9c239c6ff"
+		id = "c8fc3ab7-54a0-5ae4-acb4-bebffcadc397"
 		date = "2024-01-19"
 		modified = "2024-01-19"
 		reference = "https://blog.phylum.io/npm-package-found-delivering-sophisticated-rat/"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/virusloader/mal_msedge_dll_virusloader.yar#L1-L16"
 		license_url = "N/A"
 		hash = "ab2e3b07170ef1516af3af0d03388868"
-		logic_hash = "659fd5fa3121fec5bf4cceb6f3dea95bf4cbcde7441d6f11c35288d8ad75a803"
+		logic_hash = "v1_sha256_659fd5fa3121fec5bf4cceb6f3dea95bf4cbcde7441d6f11c35288d8ad75a803"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -217241,46 +217016,20 @@ rule RUSSIANPANDA_Mal_Msedge_Dll_Virusloader : FILE
 		$s3 = {BF 60 01 00 00 [18] 30 04 39 41}
 
 	condition:
-		uint16(0)==0x5A4D and all of ($s*) and #s1>30 and #s2>30 and filesize <300KB
-}
-import "pe"
-
-rule RUSSIANPANDA_Nitrogen_Python311_Rule : FILE
-{
-	meta:
-		description = "Detects side-loaded Python311 DLL for the new Nitrogen campaign 10-23-2023"
-		author = "RussianPanda"
-		id = "608d20b2-24f8-5c95-bab5-83748a7bf3b1"
-		date = "2023-10-24"
-		modified = "2023-12-11"
-		reference = "https://www.esentire.com/blog/persistent-connection-established-nitrogen-campaign-leverages-dll-side-loading-technique-for-c2-communication"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Nitrogen/nitrogen_python311.yar#L3-L21"
-		license_url = "N/A"
-		logic_hash = "04db05b3b130c9de3ff02a6a16775be9d3a50d3025bcf1e075ae56c751304154"
-		score = 75
-		quality = 83
-		tags = "FILE"
-
-	strings:
-		$s1 = { 68 62 6F 6B 62 69 30 2F }
-		$s2 = { 48 B8 ?? ?? ?? ?? ?? ?? ?? 00 48 89 44 24 5C }
-		$s3 = { 48 8B 05 ?? ?? 09 00}
-
-	condition:
-		all of ($s*) and uint16(0)==0x5A4D and pe.exports("nop")
+		uint16( 0 ) == 0x5A4D and all of ( $s* ) and #s1 > 30 and #s2 > 30 and filesize < 300KB
 }
 rule RUSSIANPANDA_Mal_Nitrogen : FILE
 {
 	meta:
 		description = "Detects Nitrogen campaign"
 		author = "RussianPanda"
-		id = "9d591f87-47ec-54ea-b0ae-26a0542733a0"
+		id = "a6ec667e-8bd5-5e15-9660-dffc112acd09"
 		date = "2024-02-04"
 		modified = "2024-02-04"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Nitrogen/mal_nitrogen.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "642d5a16c7fb217a297bba683221de474eb028ac48ec8f52be897eaa056acb9b"
+		logic_hash = "v1_sha256_642d5a16c7fb217a297bba683221de474eb028ac48ec8f52be897eaa056acb9b"
 		score = 75
 		quality = 79
 		tags = "FILE"
@@ -217294,21 +217043,21 @@ rule RUSSIANPANDA_Mal_Nitrogen : FILE
 		$s6 = {4E 69 74 72 6F 67 65 6E 54 61 72 67 65 74}
 
 	condition:
-		uint16(0)==0x5A4D and 5 of them
+		uint16( 0 ) == 0x5A4D and 5 of them
 }
 rule RUSSIANPANDA_Win_Mal_Koistealer_PS
 {
 	meta:
 		description = "Detects KoiStealer PowerShell script"
 		author = "RussianPanda"
-		id = "6dfdb39c-1b6a-5969-9c2d-e09869af6e0f"
+		id = "12bc4093-8c00-5d9a-8cbf-0decb81640db"
 		date = "2024-04-04"
 		modified = "2024-04-04"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Koi/win_mal_KoiStealer_PS.yar#L1-L12"
 		license_url = "N/A"
 		hash = "4f55be0b55ec67dfda42b88e9c743a2a"
-		logic_hash = "8a60a1d770eb4b5048762ddfd4657fdf7a430b09eb454ae5a5bb3103460907db"
+		logic_hash = "v1_sha256_8a60a1d770eb4b5048762ddfd4657fdf7a430b09eb454ae5a5bb3103460907db"
 		score = 75
 		quality = 85
 		tags = ""
@@ -217318,21 +217067,21 @@ rule RUSSIANPANDA_Win_Mal_Koistealer_PS
 		$s2 = "$config"
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
 rule RUSSIANPANDA_Win_Mal_Koi_Loader_Decrypted : FILE
 {
 	meta:
 		description = "Detects decrypted Koi Loader"
 		author = "RussianPanda"
-		id = "71de93d3-5c9f-5994-a54d-d4455d500280"
+		id = "b21c9524-2e9c-5b7a-b1f1-26c6affacd31"
 		date = "2024-04-04"
 		modified = "2024-04-04"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Koi/win_mal_Koi_loader_decrypted.yar#L1-L12"
 		license_url = "N/A"
 		hash = "1901593e0299930d46b963866f33a93b"
-		logic_hash = "f73ada7185ff109afe1e186a0fb7b4420b3d0e04c93c7c5423243db97eb34e49"
+		logic_hash = "v1_sha256_f73ada7185ff109afe1e186a0fb7b4420b3d0e04c93c7c5423243db97eb34e49"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -217342,21 +217091,21 @@ rule RUSSIANPANDA_Win_Mal_Koi_Loader_Decrypted : FILE
 		$s2 = {25 00 74 00 65 00 6D 00 70 00 25 00 5C 00 25 00 70 00 61 00 74 00 68 00 73 00 25}
 
 	condition:
-		uint16(0)==0x5A4D and all of ($s*)
+		uint16( 0 ) == 0x5A4D and all of ( $s* )
 }
 rule RUSSIANPANDA_Win_Mal_Koi_Loader : FILE
 {
 	meta:
 		description = "Detects Koi Loader"
 		author = "RussianPanda"
-		id = "a608558d-97c8-5161-a6eb-29fd420458a8"
+		id = "e4becd2c-cb4b-5c93-a74d-5a7a64b4880f"
 		date = "2024-04-04"
 		modified = "2024-04-04"
 		reference = "https://github.com/RussianPanda95/Yara-Rules"
 		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/2b40630c067f4ba3a207fcf1951e07a9a01ba69a/Koi/win_mal_Koi_loader.yar#L1-L14"
 		license_url = "N/A"
 		hash = "47e208687c2fb40bdbaa17e368aaa1bd"
-		logic_hash = "4f909865c6d274804c3fa7f66822d7bea71bb93e7c6a422ebaf220df056ac095"
+		logic_hash = "v1_sha256_4f909865c6d274804c3fa7f66822d7bea71bb93e7c6a422ebaf220df056ac095"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -217368,13 +217117,13 @@ rule RUSSIANPANDA_Win_Mal_Koi_Loader : FILE
 		$s4 = {74 [0-10] C1 E9 18}
 
 	condition:
-		uint16(0)==0x5A4D and all of ($s*)
+		uint16( 0 ) == 0x5A4D and all of ( $s* )
 }
 /*
  * YARA Rule Set
  * Repository Name: Check Point
  * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
  * Number of Rules: 4
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -217389,7 +217138,7 @@ rule CHECK_POINT_Apt_Nazar_Component_Guids
 	meta:
 		description = "Detect Nazar Components by COM Objects' GUID"
 		author = "Itay Cohen"
-		id = "1bdc0b54-4903-559d-9037-450470fc7ef7"
+		id = "ccffba17-9ead-5d0d-a6d7-de995270a864"
 		date = "2020-04-27"
 		modified = "2023-04-10"
 		reference = "https://research.checkpoint.com/2020/nazar-spirits-of-the-past/"
@@ -217408,7 +217157,7 @@ rule CHECK_POINT_Apt_Nazar_Component_Guids
 		hash = "d34a996826ea5a028f5b4713c797247913f036ca0063cc4c18d8b04736fa0b65"
 		hash = "d9801b4da1dbc5264e83029abb93e800d3c9971c650ecc2df5f85bcc10c7bd61"
 		hash = "eb705459c2b37fba5747c73ce4870497aa1d4de22c97aaea4af38cdc899b51d3"
-		logic_hash = "9fb69a0ea7272f1b1cbb290ae81e08f7e2b2f6c5409bbca12d9b0b781cb4c267"
+		logic_hash = "v1_sha256_9fb69a0ea7272f1b1cbb290ae81e08f7e2b2f6c5409bbca12d9b0b781cb4c267"
 		score = 75
 		quality = 85
 		tags = ""
@@ -217429,13 +217178,13 @@ rule CHECK_POINT_Injector_ZZ_Dotrunpex : FILE
 	meta:
 		description = "Detects new version of dotRunpeX - configurable .NET injector"
 		author = "Jiri Vinopal (jiriv)"
-		id = "6cdbe54b-2e8d-5f7b-81ac-983236d1449f"
+		id = "46b69d36-95fd-5468-965e-9af7f708f7ad"
 		date = "2022-10-30"
 		modified = "2023-04-10"
 		reference = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/injector_ZZ_dotRunpeX.yar#L1-L58"
 		license_url = "N/A"
-		logic_hash = "ca4336533f90598a6b6f594036e20595073e0e7cab5fcd186995c5c7f2be287e"
+		logic_hash = "v1_sha256_ca4336533f90598a6b6f594036e20595073e0e7cab5fcd186995c5c7f2be287e"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -217487,20 +217236,20 @@ rule CHECK_POINT_Injector_ZZ_Dotrunpex : FILE
 		$koiVM2 = "#Koi"
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and ($regPath or $rsrcName or 1 of ($koiVM*)) and 24 of ($implmap*) and 1 of ($modulerefKernel*) and 1 of ($modulerefNtdll*) and 1 of ($modulerefAdvapi*)
+		uint16( 0 ) == 0x5a4d and uint16( uint32( 0x3c ) ) == 0x4550 and ( $regPath or $rsrcName or 1 of ( $koiVM* ) ) and 24 of ( $implmap* ) and 1 of ( $modulerefKernel* ) and 1 of ( $modulerefNtdll* ) and 1 of ( $modulerefAdvapi* )
 }
 rule CHECK_POINT_Injector_ZZ_Dotrunpex_Oldnew : FILE
 {
 	meta:
 		description = "Detects new and old version of dotRunpeX - configurable .NET injector"
 		author = "Jiri Vinopal (jiriv)"
-		id = "43e2d520-bfe4-5530-a5b4-508cfba9d06e"
+		id = "4b4c64ea-022a-5f9d-bee3-833e78841515"
 		date = "2022-10-30"
 		modified = "2023-04-10"
 		reference = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/injector_ZZ_dotRunpeX_oldnew.yar#L1-L45"
 		license_url = "N/A"
-		logic_hash = "c6ae0b4fb6cae16ae8d71e238f7753e0eadd23820507616fa2331375f4403052"
+		logic_hash = "v1_sha256_c6ae0b4fb6cae16ae8d71e238f7753e0eadd23820507616fa2331375f4403052"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -217540,20 +217289,20 @@ rule CHECK_POINT_Injector_ZZ_Dotrunpex_Oldnew : FILE
 		$koiVM2 = "#Koi"
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and ($regPath or $rsrcName or 1 of ($koiVM*)) and 9 of ($implmap*) and 1 of ($modulerefKernel*) and 1 of ($modulerefNtdll*)
+		uint16( 0 ) == 0x5a4d and uint16( uint32( 0x3c ) ) == 0x4550 and ( $regPath or $rsrcName or 1 of ( $koiVM* ) ) and 9 of ( $implmap* ) and 1 of ( $modulerefKernel* ) and 1 of ( $modulerefNtdll* )
 }
 rule CHECK_POINT_Malware_Bumblebee_Packed
 {
 	meta:
 		description = "Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic."
 		author = "Marc Salinas @ CheckPoint Research"
-		id = "35f00c87-c26e-5189-b66d-15d5a1b1dd20"
+		id = "5e85e593-cdcd-5b3c-927e-3b2d9cb952f5"
 		date = "2022-07-13"
 		modified = "2023-04-10"
 		reference = "https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/malware_bumblebee_packed.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "063209aad7ab8a0be46fd578a16b04afc086f930cbdb6c2f7b02824f704d7330"
+		logic_hash = "v1_sha256_063209aad7ab8a0be46fd578a16b04afc086f930cbdb6c2f7b02824f704d7330"
 		score = 75
 		quality = 85
 		tags = ""
@@ -217588,7 +217337,7 @@ rule CHECK_POINT_Malware_Bumblebee_Packed
  * YARA Rule Set
  * Repository Name: Dragon Threat Labs
  * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
  * Number of Rules: 7
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -217603,14 +217352,14 @@ rule DRAGON_THREAT_LABS_Apt_C16_Win_Disk_Pcclient : DISK
 	meta:
 		description = "Encoded version of pcclient found on disk"
 		author = "@dragonthreatlab"
-		id = "40e9133c-60e8-5fec-be56-1115c8bde9b1"
+		id = "f4fda4fa-2cf8-54d3-a28c-f40c659f3f52"
 		date = "2015-01-11"
 		modified = "2016-09-27"
 		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/apt_c16_win_disk_pcclient.yar#L1-L13"
 		license_url = "N/A"
 		hash = "55f84d88d84c221437cd23cdbc541d2e"
-		logic_hash = "47e9588ef1f350ee0d2aecc7686d9e4df1ad6c19f27d749e31340eff7e31adcb"
+		logic_hash = "v1_sha256_47e9588ef1f350ee0d2aecc7686d9e4df1ad6c19f27d749e31340eff7e31adcb"
 		score = 75
 		quality = 80
 		tags = "DISK"
@@ -217626,14 +217375,14 @@ rule DRAGON_THREAT_LABS_Apt_C16_Win32_Dropper : DROPPER FILE
 	meta:
 		description = "APT malware used to drop PcClient RAT"
 		author = "@dragonthreatlab"
-		id = "a1546f02-f01b-50ba-b4d9-9676e52dc4c1"
+		id = "0beafe4b-6192-5ce6-af54-ccc4fced7df9"
 		date = "2015-01-11"
 		modified = "2016-09-27"
 		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/apt_c16_win32_dropper.yar#L1-L18"
 		license_url = "N/A"
 		hash = "ad17eff26994df824be36db246c8fb6a"
-		logic_hash = "bb29bcf5e62cb1a55d7f0cb87b53bace26b99f858513dc4e544d531f70f54281"
+		logic_hash = "v1_sha256_bb29bcf5e62cb1a55d7f0cb87b53bace26b99f858513dc4e544d531f70f54281"
 		score = 75
 		quality = 28
 		tags = "DROPPER, FILE"
@@ -217647,20 +217396,20 @@ rule DRAGON_THREAT_LABS_Apt_C16_Win32_Dropper : DROPPER FILE
 		$str5 = {8A 08 2A CA 32 CA 88 08 40 4E 75 F4 5E}
 
 	condition:
-		$mz at 0 and all of ($str*)
+		$mz at 0 and all of ( $str* )
 }
 rule DRAGON_THREAT_LABS_Apt_Win_Mocelpa
 {
 	meta:
 		description = "APT malware; Mocelpa, downloader."
 		author = "@int0x00"
-		id = "2cf2ba5e-86b1-5533-9e14-61113e5f574d"
+		id = "56541477-ce0d-5a69-9051-08b3d001caf8"
 		date = "2023-04-10"
 		modified = "2023-04-10"
 		reference = "https://github.com/DragonThreatLabs/IntelReports/blob/master/DTL-06282015-01.pdf"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/apt_win_mocelpa.yar#L1-L11"
 		license_url = "N/A"
-		logic_hash = "0331c0f690ac7a8870b3f4012f2828ed23850340edcf0b6ff80bc408d9174977"
+		logic_hash = "v1_sha256_0331c0f690ac7a8870b3f4012f2828ed23850340edcf0b6ff80bc408d9174977"
 		score = 75
 		quality = 28
 		tags = ""
@@ -217670,21 +217419,21 @@ rule DRAGON_THREAT_LABS_Apt_Win_Mocelpa
 		$ssl_hello = {16 03 01 00 6B 01 00 00 67 03 01 54 B4 C9 7B 4F CF BC 5A 01 EC 4A 73 C8 6D BB C0 86 9F 7B A9 08 6A 60 37 05 81 97 1A C8 9F 45 E5 00 00 18 00 2F 00 35 00 05 00 0A C0 13 C0 14 C0 09 C0 0A 00 32 00 38 00 13 00 04 01 00 00 26 00 00 00 12 00 10 00 00 0D 77 77 77 2E 61 70 70 6C 65 2E 63 6F 6D 00 0A 00 06 00 04 00 17 00 18 00 0B 00 02 01 00}
 
 	condition:
-		($mz at 0) and ($ssl_hello)
+		($mz at 0 ) and ( $ssl_hello )
 }
 rule DRAGON_THREAT_LABS_Apt_C16_Win_Swisyn : MEMORY FILE
 {
 	meta:
 		description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
 		author = "@dragonthreatlab"
-		id = "af369075-aca3-576d-a10b-849703ffb4f1"
+		id = "9cba57d9-1546-5aee-93ff-0565f6a92b9b"
 		date = "2015-01-11"
 		modified = "2016-09-27"
 		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/apt_c16_win_swisyn.yar#L1-L17"
 		license_url = "N/A"
 		hash = "a6a18c846e5179259eba9de238f67e41"
-		logic_hash = "2fa29d3b17aa37501131132640953645d0089c9bc5ec13ffed7a498ad89c1558"
+		logic_hash = "v1_sha256_2fa29d3b17aa37501131132640953645d0089c9bc5ec13ffed7a498ad89c1558"
 		score = 75
 		quality = 28
 		tags = "MEMORY, FILE"
@@ -217697,23 +217446,21 @@ rule DRAGON_THREAT_LABS_Apt_C16_Win_Swisyn : MEMORY FILE
 		$str4 = {8A 11 2A 55 FC 8B 45 08 88 10 8B 4D 08 8A 11 32 55 FC 8B 45 08 88 10}
 
 	condition:
-		$mz at 0 and all of ($str*)
+		$mz at 0 and all of ( $str* )
 }
-import "pe"
-
 rule DRAGON_THREAT_LABS_Apt_C16_Win_Memory_Pcclient : MEMORY APT
 {
 	meta:
 		description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
 		author = "@dragonthreatlab"
-		id = "59333cd4-b532-510e-afe5-fc3b2e96698f"
+		id = "325eb739-c6a2-59e0-9116-0baa5e3d14b1"
 		date = "2015-01-11"
 		modified = "2016-09-27"
 		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L4-L19"
 		license_url = "N/A"
 		hash = "ec532bbe9d0882d403473102e9724557"
-		logic_hash = "e863fcbcbde61db569a34509061732371143f38734a0213dc856dc3c9188b042"
+		logic_hash = "v1_sha256_e863fcbcbde61db569a34509061732371143f38734a0213dc856dc3c9188b042"
 		score = 75
 		quality = 80
 		tags = "MEMORY, APT"
@@ -217727,20 +217474,18 @@ rule DRAGON_THREAT_LABS_Apt_C16_Win_Memory_Pcclient : MEMORY APT
 	condition:
 		all of them
 }
-import "pe"
-
 rule DRAGON_THREAT_LABS_Apt_C16_Win_Wateringhole
 {
 	meta:
 		description = "Detects code from APT wateringhole"
 		author = "@dragonthreatlab"
-		id = "4958f894-91a7-56b4-90f0-40085c03382c"
+		id = "11c498d2-0987-5f8a-9af3-553c7c32faea"
 		date = "2015-01-11"
 		modified = "2016-09-27"
 		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L72-L85"
 		license_url = "N/A"
-		logic_hash = "e866499ec77984f5bacf3f5e352393b63e0dd08fd8fd57b4990292a1dc7fbcbe"
+		logic_hash = "v1_sha256_e866499ec77984f5bacf3f5e352393b63e0dd08fd8fd57b4990292a1dc7fbcbe"
 		score = 75
 		quality = 80
 		tags = ""
@@ -217751,22 +217496,20 @@ rule DRAGON_THREAT_LABS_Apt_C16_Win_Wateringhole
 		$str3 = "function MoSaklgEs7(k)"
 
 	condition:
-		any of ($str*)
+		any of ( $str* )
 }
-import "pe"
-
 rule DRAGON_THREAT_LABS_Apt_C16_Win64_Dropper : DROPPER FILE
 {
 	meta:
 		description = "APT malware used to drop PcClient RAT"
 		author = "@dragonthreatlab"
-		id = "dbd1a16c-52a5-5b07-b34f-7eb7b78c1eab"
+		id = "245a728c-7276-535d-8d48-f405cb855a38"
 		date = "2015-01-11"
 		modified = "2016-09-27"
 		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L87-L104"
 		license_url = "N/A"
-		logic_hash = "df905711eca68c698ad6340e88ae99fdcae918c86ec2b7c26b62eead54fef892"
+		logic_hash = "v1_sha256_df905711eca68c698ad6340e88ae99fdcae918c86ec2b7c26b62eead54fef892"
 		score = 75
 		quality = 28
 		tags = "DROPPER, FILE"
@@ -217779,13 +217522,13 @@ rule DRAGON_THREAT_LABS_Apt_C16_Win64_Dropper : DROPPER FILE
 		$str4 = { 0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC }
 
 	condition:
-		$mz at 0 and all of ($str*)
+		$mz at 0 and all of ( $str* )
 }
 /*
  * YARA Rule Set
  * Repository Name: Microsoft
  * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
  * Number of Rules: 21
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -217800,14 +217543,14 @@ rule MICROSOFT_Trojan_Win32_Plasrv : PLATINUM
 	meta:
 		description = "Hotpatching Injector"
 		author = "Microsoft"
-		id = "2a099b68-fb13-5926-8a86-4d788326609c"
+		id = "17809055-a991-58a2-8b8e-e1e4be694ebd"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L1-L19"
 		license_url = "N/A"
 		hash = "ff7f949da665ba8ce9fb01da357b51415634eaad"
-		logic_hash = "5978502454d66a930a535ffe61d78f2106c3c17c8df9be1b22bc10ef900c891f"
+		logic_hash = "v1_sha256_5978502454d66a930a535ffe61d78f2106c3c17c8df9be1b22bc10ef900c891f"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -217827,14 +217570,14 @@ rule MICROSOFT_Trojan_Win32_Platual : PLATINUM
 	meta:
 		description = "Installer component"
 		author = "Microsoft"
-		id = "ac963388-cc73-5842-96be-77349398efcc"
+		id = "41649dac-3594-5231-92e7-36e01e5d4d91"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L21-L38"
 		license_url = "N/A"
 		hash = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
-		logic_hash = "3692b5c1d873fb799b64ea69f3762177198dbb0fb971bc29bb80048c0de735d4"
+		logic_hash = "v1_sha256_3692b5c1d873fb799b64ea69f3762177198dbb0fb971bc29bb80048c0de735d4"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -217854,14 +217597,14 @@ rule MICROSOFT_Trojan_Win32_Plaplex : PLATINUM
 	meta:
 		description = "Variant of the JPin backdoor"
 		author = "Microsoft"
-		id = "2d670c09-dc0a-556e-8d00-5f94e5907d99"
+		id = "7f483c9c-dd9a-5563-a580-93289a0b18f0"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L40-L57"
 		license_url = "N/A"
 		hash = "ca3bda30a3cdc15afb78e54fa1bbb9300d268d66"
-		logic_hash = "ff7b9a52befae5f22f7c6093af44bef4a4cf271548c1caf22f30d3c8aec42de4"
+		logic_hash = "v1_sha256_ff7b9a52befae5f22f7c6093af44bef4a4cf271548c1caf22f30d3c8aec42de4"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -217881,13 +217624,13 @@ rule MICROSOFT_Trojan_Win32_Dipsind_B : PLATINUM
 	meta:
 		description = "Dipsind Family"
 		author = "Microsoft"
-		id = "513c18a6-af25-58ad-9232-9a089f4ced3d"
+		id = "d9048d7a-130b-5034-988e-293452b19bc9"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L59-L77"
 		license_url = "N/A"
-		logic_hash = "1f99f298dc4d1483eb95cfb898dd9eee32b2f72a8da562f58a57f44559cbd2c7"
+		logic_hash = "v1_sha256_1f99f298dc4d1483eb95cfb898dd9eee32b2f72a8da562f58a57f44559cbd2c7"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -217908,14 +217651,14 @@ rule MICROSOFT_Trojan_Win32_Plakeylog_B : PLATINUM
 	meta:
 		description = "Keylogger component"
 		author = "Microsoft"
-		id = "bc84ef20-f428-5f3d-bc88-ab14991a2350"
+		id = "0cd16ec0-be16-53ed-b667-841b31930ee0"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L79-L97"
 		license_url = "N/A"
 		hash = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
-		logic_hash = "288fb5a724baaa032ca36124cf803698e315aaf61662f999f3b894049ece63f2"
+		logic_hash = "v1_sha256_288fb5a724baaa032ca36124cf803698e315aaf61662f999f3b894049ece63f2"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -217935,14 +217678,14 @@ rule MICROSOFT_Trojan_Win32_Adupib : PLATINUM
 	meta:
 		description = "Adupib SSL Backdoor"
 		author = "Microsoft"
-		id = "4c5a63e5-7110-57e9-b939-df8999f317d3"
+		id = "5a770573-43f2-5818-8913-0c06dc149112"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L99-L120"
 		license_url = "N/A"
 		hash = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
-		logic_hash = "b83f642929a372a21e63055cd4adcab5d24b98b5a98b6fd0b35ee31e9f7f3b90"
+		logic_hash = "v1_sha256_b83f642929a372a21e63055cd4adcab5d24b98b5a98b6fd0b35ee31e9f7f3b90"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -217965,14 +217708,14 @@ rule MICROSOFT_Trojan_Win32_Plalsalog : PLATINUM
 	meta:
 		description = "Loader / possible incomplete LSA Password Filter"
 		author = "Microsoft"
-		id = "e5c7e07d-79e3-580f-ac24-28920a9b0e70"
+		id = "115b0e25-156d-5c1d-938a-2c05ef2b788b"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L122-L140"
 		license_url = "N/A"
 		hash = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
-		logic_hash = "58d937be220c0f356396c28367ab63ff4c4a6bf2cbf9e0ce8f8cac25e4fe3fec"
+		logic_hash = "v1_sha256_58d937be220c0f356396c28367ab63ff4c4a6bf2cbf9e0ce8f8cac25e4fe3fec"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -217992,14 +217735,14 @@ rule MICROSOFT_Trojan_Win32_Plagon : PLATINUM
 	meta:
 		description = "Dipsind variant"
 		author = "Microsoft"
-		id = "ae3b7eb0-d54e-5817-9484-c054cd27c1fd"
+		id = "6da24e2c-399b-5d0f-85cb-081e769ed293"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L142-L162"
 		license_url = "N/A"
 		hash = "48b89f61d58b57dba6a0ca857bce97bab636af65"
-		logic_hash = "99e0d300f030bb6407de1fda488b47c73f8278e9c015bf779259ddf1b68903a2"
+		logic_hash = "v1_sha256_99e0d300f030bb6407de1fda488b47c73f8278e9c015bf779259ddf1b68903a2"
 		score = 75
 		quality = 78
 		tags = "PLATINUM"
@@ -218021,14 +217764,14 @@ rule MICROSOFT_Trojan_Win32_Plakelog : PLATINUM
 	meta:
 		description = "Raw-input based keylogger"
 		author = "Microsoft"
-		id = "26f552e6-9abf-59ca-a8df-19473d6d775a"
+		id = "e5071526-c4e8-58a7-89e9-e7b28028c579"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L164-L184"
 		license_url = "N/A"
 		hash = "3907a9e41df805f912f821a47031164b6636bd04"
-		logic_hash = "e18cae8bb2a79f7d39a80669896b1f7a7c1726f14192abcc91388fd53781ffef"
+		logic_hash = "v1_sha256_e18cae8bb2a79f7d39a80669896b1f7a7c1726f14192abcc91388fd53781ffef"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218050,14 +217793,14 @@ rule MICROSOFT_Trojan_Win32_Plainst : PLATINUM
 	meta:
 		description = "Installer component"
 		author = "Microsoft"
-		id = "41a4770a-b4d8-5ddc-8b4f-a4e87a1f3923"
+		id = "5b7ef00e-3e6c-5bfb-bcd4-afc43811e673"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L186-L204"
 		license_url = "N/A"
 		hash = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
-		logic_hash = "5fa8e52c044e05d96c2c09b69ef884ed0ea863ceb3ba00cdf243a4907050de69"
+		logic_hash = "v1_sha256_5fa8e52c044e05d96c2c09b69ef884ed0ea863ceb3ba00cdf243a4907050de69"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218077,14 +217820,14 @@ rule MICROSOFT_Trojan_Win32_Plagicom : PLATINUM
 	meta:
 		description = "Installer component"
 		author = "Microsoft"
-		id = "86ef6fbf-cd39-533f-893c-72f22d73c99a"
+		id = "78a32a8f-dc06-55cc-a719-a31b4ba193f2"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L206-L225"
 		license_url = "N/A"
 		hash = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
-		logic_hash = "d2645ecc3b4400af7d9949eeca01b1ed5d74516010658c66934772e04040d9cf"
+		logic_hash = "v1_sha256_d2645ecc3b4400af7d9949eeca01b1ed5d74516010658c66934772e04040d9cf"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218105,14 +217848,14 @@ rule MICROSOFT_Trojan_Win32_Plaklog : PLATINUM
 	meta:
 		description = "Hook-based keylogger"
 		author = "Microsoft"
-		id = "4faffe66-63fc-5498-be59-dbbbb909ad74"
+		id = "0ce14bfd-37d5-5289-85d3-17c282f9e58d"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L227-L246"
 		license_url = "N/A"
 		hash = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
-		logic_hash = "af8dd0749d07f0b99cf3dd24bc144d38fe6db00f699bc7f45f197ac6e1663cad"
+		logic_hash = "v1_sha256_af8dd0749d07f0b99cf3dd24bc144d38fe6db00f699bc7f45f197ac6e1663cad"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218133,14 +217876,14 @@ rule MICROSOFT_Trojan_Win32_Plapiio : PLATINUM
 	meta:
 		description = "JPin backdoor"
 		author = "Microsoft"
-		id = "538086b5-eb06-5e41-90d4-ab8f2b001c42"
+		id = "61be2001-62d2-55b5-a36c-01184341811f"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L248-L267"
 		license_url = "N/A"
 		hash = "3119de80088c52bd8097394092847cd984606c88"
-		logic_hash = "580fb1377d98e7ffcb9823b5c485ff536813e3df5d8bded745373b2a3a82fcfd"
+		logic_hash = "v1_sha256_580fb1377d98e7ffcb9823b5c485ff536813e3df5d8bded745373b2a3a82fcfd"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218161,13 +217904,13 @@ rule MICROSOFT_Trojan_Win32_Plabit : PLATINUM
 	meta:
 		description = "Installer component"
 		author = "Microsoft"
-		id = "cee48cbb-f980-50cc-b28a-2e80e7f1798b"
+		id = "1d7e25ad-e881-5bfd-bca9-9aed9caa3d9a"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L269-L287"
 		license_url = "N/A"
-		logic_hash = "35f12d45c8ee5f8e2b0bcd57ae14c0ba52670abc1212f94aa276efbbe1043146"
+		logic_hash = "v1_sha256_35f12d45c8ee5f8e2b0bcd57ae14c0ba52670abc1212f94aa276efbbe1043146"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218188,14 +217931,14 @@ rule MICROSOFT_Trojan_Win32_Placisc2 : PLATINUM
 	meta:
 		description = "Dipsind variant"
 		author = "Microsoft"
-		id = "a5557cfa-354c-5913-9b63-f53ffb294796"
+		id = "ad15ca7f-804e-5c60-9973-de79f0fa52e9"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L289-L309"
 		license_url = "N/A"
 		hash = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
-		logic_hash = "6629ca96c73e48bc14c811df781973f8040f88bcbf9eda601e9f5db86e11c20b"
+		logic_hash = "v1_sha256_6629ca96c73e48bc14c811df781973f8040f88bcbf9eda601e9f5db86e11c20b"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218217,14 +217960,14 @@ rule MICROSOFT_Trojan_Win32_Placisc3 : PLATINUM
 	meta:
 		description = "Dipsind variant"
 		author = "Microsoft"
-		id = "f2089236-8227-5042-9086-fb77aebd147f"
+		id = "2ea82576-cc07-5095-a8e1-d417dc9a2b1f"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L311-L329"
 		license_url = "N/A"
 		hash = "1b542dd0dacfcd4200879221709f5fa9683cdcda"
-		logic_hash = "3a1afe737c08b4d9149380e04f5d6240a00b237822c3c82d82eccf5412cb05d1"
+		logic_hash = "v1_sha256_3a1afe737c08b4d9149380e04f5d6240a00b237822c3c82d82eccf5412cb05d1"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218245,14 +217988,14 @@ rule MICROSOFT_Trojan_Win32_Placisc4 : PLATINUM
 	meta:
 		description = "Installer for Dipsind variant"
 		author = "Microsoft"
-		id = "04770059-06ca-5315-a7b3-0e9fbcecfc57"
+		id = "80fe3dbd-f4d4-5fa6-9c02-acf0170c9c12"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L331-L350"
 		license_url = "N/A"
 		hash = "3d17828632e8ff1560f6094703ece5433bc69586"
-		logic_hash = "4fa4f48d6747cde6d635eca2f5277da7be17473a561828eafa604fbc2801073a"
+		logic_hash = "v1_sha256_4fa4f48d6747cde6d635eca2f5277da7be17473a561828eafa604fbc2801073a"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218273,14 +218016,14 @@ rule MICROSOFT_Trojan_Win32_Plakpers : PLATINUM
 	meta:
 		description = "Injector / loader component"
 		author = "Microsoft"
-		id = "d37c6ac5-ca46-5fb2-80bd-ab63c8dbcd21"
+		id = "ca0e862e-77fa-5455-b0ce-eca959cbcdf1"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L352-L371"
 		license_url = "N/A"
 		hash = "fa083d744d278c6f4865f095cfd2feabee558056"
-		logic_hash = "d3705a34232ba2b00786b32f84823d3a6b037ed6a5882983e69addc020bc0b35"
+		logic_hash = "v1_sha256_d3705a34232ba2b00786b32f84823d3a6b037ed6a5882983e69addc020bc0b35"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218301,14 +218044,14 @@ rule MICROSOFT_Trojan_Win32_Plainst2 : PLATINUM
 	meta:
 		description = "Zc tool"
 		author = "Microsoft"
-		id = "7202eeb5-269d-5e9a-9a93-bdf489639e74"
+		id = "19da2356-2a9d-5f6a-9f94-e49533b6aa2e"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L373-L392"
 		license_url = "N/A"
 		hash = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
-		logic_hash = "4dc897a598fd491694f8fe3ec4ae9278dc341ffd9f95f416eb5e98fb5aa200e4"
+		logic_hash = "v1_sha256_4dc897a598fd491694f8fe3ec4ae9278dc341ffd9f95f416eb5e98fb5aa200e4"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218329,14 +218072,14 @@ rule MICROSOFT_Trojan_Win32_Plakpeer : PLATINUM
 	meta:
 		description = "Zc tool v2"
 		author = "Microsoft"
-		id = "e573279b-4a7b-5e15-8ab2-a77cd98a8b6e"
+		id = "a78ea91a-11d5-510c-9ba1-67542958cec5"
 		date = "2016-04-12"
 		modified = "2016-12-21"
 		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L394-L414"
 		license_url = "N/A"
 		hash = "2155c20483528377b5e3fde004bb604198463d29"
-		logic_hash = "cc34ce9f12c95133872783090efd5813d3e2f44a1c726d29b2ba834509c9a1d5"
+		logic_hash = "v1_sha256_cc34ce9f12c95133872783090efd5813d3e2f44a1c726d29b2ba834509c9a1d5"
 		score = 75
 		quality = 80
 		tags = "PLATINUM"
@@ -218360,13 +218103,13 @@ rule MICROSOFT_Devilstongue_Hijackdll : FILE
 	meta:
 		description = "Detects SOURGUM's DevilsTongue hijack DLL"
 		author = "Microsoft Threat Intelligence Center (MSTIC)"
-		id = "b5de2a8c-e0c8-5c8c-bb65-aee5701b4bb3"
+		id = "123f9c0e-59dc-5f2c-863d-5e1c3e0afd88"
 		date = "2021-07-15"
 		modified = "2022-07-07"
 		reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/DevilsTongue_HijackDll.yar#L2-L45"
 		license_url = "N/A"
-		logic_hash = "d1c01df74a00672bb8229d5433314d7cfa49ab22565e6cf78a4b6b2884dbd299"
+		logic_hash = "v1_sha256_d1c01df74a00672bb8229d5433314d7cfa49ab22565e6cf78a4b6b2884dbd299"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218383,13 +218126,13 @@ rule MICROSOFT_Devilstongue_Hijackdll : FILE
 		$code2 = {44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19}
 
 	condition:
-		filesize <800KB and uint16(0)==0x5A4D and (pe.characteristics&pe.DLL) and (4 of them or ($code1 and $code2) or (pe.imphash()=="9a964e810949704ff7b4a393d9adda60"))
+		filesize < 800KB and uint16( 0 ) == 0x5A4D and ( pe.characteristics & pe.DLL ) and ( 4 of them or ( $code1 and $code2 ) or ( pe.imphash ( ) == "9a964e810949704ff7b4a393d9adda60" ) )
 }
 /*
  * YARA Rule Set
  * Repository Name: NCSC
  * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
  * Number of Rules: 17
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -218406,13 +218149,13 @@ rule NCSC_Sparrowdoor_Clipshot : FILE
 	meta:
 		description = "The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file."
 		author = "NCSC"
-		id = "186e694b-6ae1-5042-847a-f54708dc76ef"
+		id = "e3c5ad1c-0e62-5336-94d7-89eeeceefc18"
 		date = "2022-02-28"
 		modified = "2022-07-06"
 		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_clipshot.yar#L3-L20"
 		license_url = "N/A"
-		logic_hash = "7662e3be2752ac82d6cfe4b2e420157e78367c201c25ae34b5d956dc53ba20ae"
+		logic_hash = "v1_sha256_7662e3be2752ac82d6cfe4b2e420157e78367c201c25ae34b5d956dc53ba20ae"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218424,20 +218167,20 @@ rule NCSC_Sparrowdoor_Clipshot : FILE
 		$cre_fil_args = {6A 00 68 80 00 00 00 6A 04 6A 00 6A 02 68 00 00 00 40 52}
 
 	condition:
-		( uint16(0)==0x5A4D) and uint32( uint32(0x3C))==0x00004550 and all of them and (pe.imports("User32.dll","OpenClipboard") and pe.imports("User32.dll","GetClipboardData") and pe.imports("Kernel32.dll","GetLocalTime") and pe.imports("Kernel32.dll","GlobalSize"))
+		( uint16( 0 ) == 0x5A4D ) and uint32( uint32( 0x3C ) ) == 0x00004550 and all of them and ( pe.imports ( "User32.dll" , "OpenClipboard" ) and pe.imports ( "User32.dll" , "GetClipboardData" ) and pe.imports ( "Kernel32.dll" , "GetLocalTime" ) and pe.imports ( "Kernel32.dll" , "GlobalSize" ) )
 }
 rule NCSC_Sparrowdoor_Loader : FILE
 {
 	meta:
 		description = "Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant."
 		author = "NCSC"
-		id = "7107cb82-c4c9-503f-b006-baec6b667498"
+		id = "9b751019-6813-57e1-8251-860ee1abce01"
 		date = "2022-02-28"
 		modified = "2022-07-06"
 		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_loader.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "fa1bd386114d912722a5101a0112355dec654e2e9446c885c12946c7fae1c8f4"
+		logic_hash = "v1_sha256_fa1bd386114d912722a5101a0112355dec654e2e9446c885c12946c7fae1c8f4"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218449,41 +218192,41 @@ rule NCSC_Sparrowdoor_Loader : FILE
 		$lj = {2B CE 83 E9 05 8D [3] 52 C6 06 E9 89 4E 01 8B [3] 50 6A 05 56}
 
 	condition:
-		( uint16(0)==0x5A4D) and uint32( uint32(0x3C))==0x00004550 and all of them
+		( uint16( 0 ) == 0x5A4D ) and uint32( uint32( 0x3C ) ) == 0x00004550 and all of them
 }
 rule NCSC_Sparrowdoor_Config : FILE
 {
 	meta:
 		description = "Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key."
 		author = "NCSC"
-		id = "16eec5b6-c77a-585d-88f3-2c86abdbf2bd"
+		id = "0d098a09-1e2c-5ca7-9499-907634cbb017"
 		date = "2022-02-28"
 		modified = "2022-07-06"
 		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_config.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "bd52496b6e7cabc875a277ce7d49f6b891c3f61591edef295dbee43716c15509"
+		logic_hash = "v1_sha256_bd52496b6e7cabc875a277ce7d49f6b891c3f61591edef295dbee43716c15509"
 		score = 75
 		quality = 80
 		tags = "FILE"
 		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
 
 	condition:
-		( uint16(0)!=0x5A4D) and ( uint16(0)!=0x8b55) and ( uint32(0)^ uint32(0x4c)==0x00) and ( uint32(0)^ uint32(0x34)==0x00) and ( uint16(0)^ uint16(0x50)==0x8b55)
+		( uint16( 0 ) != 0x5A4D ) and ( uint16( 0 ) != 0x8b55 ) and ( uint32( 0 ) ^ uint32( 0x4c ) == 0x00 ) and ( uint32( 0 ) ^ uint32( 0x34 ) == 0x00 ) and ( uint16( 0 ) ^ uint16( 0x50 ) == 0x8b55 )
 }
 rule NCSC_Neuron_Common_Strings : FILE
 {
 	meta:
 		description = "Rule for detection of Neuron based on commonly used strings"
 		author = "NCSC UK"
-		id = "b0f12276-300c-537e-b495-a06c97deccd7"
+		id = "b8d4b128-6dd5-5cbe-8936-1f3ca60b8876"
 		date = "2018-02-06"
 		modified = "2018-02-06"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L1-L23"
 		license_url = "N/A"
 		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
-		logic_hash = "ac5926d6173f291e7907a2ced61c9968660d24fdd28ed3dca097567040b059e3"
+		logic_hash = "v1_sha256_ac5926d6173f291e7907a2ced61c9968660d24fdd28ed3dca097567040b059e3"
 		score = 75
 		quality = 55
 		tags = "FILE"
@@ -218503,21 +218246,21 @@ rule NCSC_Neuron_Common_Strings : FILE
 		$dotnetMagic = "BSJB" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 6 of ($str*)
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $dotnetMagic and 6 of ( $str* )
 }
 rule NCSC_Neuron_Standalone_Signature : FILE
 {
 	meta:
 		description = "Rule for detection of Neuron based on a standalone signature from .NET metadata"
 		author = "NCSC UK"
-		id = "e0be2fe2-32fd-5bdf-bfac-a596264be7ba"
+		id = "1d7d0a03-6fb0-5c4b-9854-a199ff047f14"
 		date = "2018-02-06"
 		modified = "2018-02-06"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L25-L37"
 		license_url = "N/A"
 		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
-		logic_hash = "a0d8d7e834fb07c22951ea4a31bf507e0c3d471e7cd500b60096f5e09844b452"
+		logic_hash = "v1_sha256_a0d8d7e834fb07c22951ea4a31bf507e0c3d471e7cd500b60096f5e09844b452"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218527,21 +218270,21 @@ rule NCSC_Neuron_Standalone_Signature : FILE
 		$dotnetMagic = "BSJB" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of them
 }
 rule NCSC_Neuron_Functions_Classes_And_Vars : FILE
 {
 	meta:
 		description = "Rule for detection of Neuron based on .NET function, variable and class names"
 		author = "NCSC UK"
-		id = "6c785b63-637b-5343-b839-0b482cfc9cf6"
+		id = "622025c1-3f74-5edc-891b-05c847e08b71"
 		date = "2018-02-06"
 		modified = "2018-02-06"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L39-L66"
 		license_url = "N/A"
 		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
-		logic_hash = "2e378af2ddb15ed1285eafecee1075caf958c7ff470608801c49c951e044d912"
+		logic_hash = "v1_sha256_2e378af2ddb15ed1285eafecee1075caf958c7ff470608801c49c951e044d912"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218566,21 +218309,21 @@ rule NCSC_Neuron_Functions_Classes_And_Vars : FILE
 		$dotnetMagic = "BSJB" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 6 of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $dotnetMagic and 6 of them
 }
 rule NCSC_Nautilus_Modified_Rc4_Loop : FILE
 {
 	meta:
 		description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
 		author = "NCSC UK"
-		id = "0c5da057-0f1d-5852-ad75-94bf40c133e4"
+		id = "aed45e07-75bb-51c2-805a-24d3c11906b4"
 		date = "2018-02-06"
 		modified = "2018-02-06"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L68-L79"
 		license_url = "N/A"
 		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
-		logic_hash = "58673db1d995ac2fed1eefa8baab426558bb9d46b239cdc8715d41925d5f4657"
+		logic_hash = "v1_sha256_58673db1d995ac2fed1eefa8baab426558bb9d46b239cdc8715d41925d5f4657"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218589,21 +218332,21 @@ rule NCSC_Nautilus_Modified_Rc4_Loop : FILE
 		$a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $a
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $a
 }
 rule NCSC_Nautilus_Rc4_Key : FILE
 {
 	meta:
 		description = "Rule for detection of Nautilus based on a hardcoded RC4 key"
 		author = "NCSC UK"
-		id = "124c8b95-46fb-5cc1-9b10-b10536e1781d"
+		id = "3cb7b8cc-3158-5c5b-9971-d2b7654e87e9"
 		date = "2018-02-06"
 		modified = "2018-02-06"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L81-L92"
 		license_url = "N/A"
 		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
-		logic_hash = "215c0a20b3793411eea3cbf85a2e5ada8ce6b1f5aa8d84fc468a354c53df2b0c"
+		logic_hash = "v1_sha256_215c0a20b3793411eea3cbf85a2e5ada8ce6b1f5aa8d84fc468a354c53df2b0c"
 		score = 75
 		quality = 78
 		tags = "FILE"
@@ -218612,21 +218355,21 @@ rule NCSC_Nautilus_Rc4_Key : FILE
 		$key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $key
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $key
 }
 rule NCSC_Nautilus_Common_Strings : FILE
 {
 	meta:
 		description = "Rule for detection of Nautilus based on common plaintext strings"
 		author = "NCSC UK"
-		id = "0e3af6ef-1a97-5324-a186-95e6f3d836f4"
+		id = "553add82-b7ea-5e59-af47-645ce36bd721"
 		date = "2018-02-06"
 		modified = "2018-02-06"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L94-L110"
 		license_url = "N/A"
 		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
-		logic_hash = "28d664018e396d48928678de35ea95148ca1c6579efcb832c50606f43089a862"
+		logic_hash = "v1_sha256_28d664018e396d48928678de35ea95148ca1c6579efcb832c50606f43089a862"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218640,21 +218383,21 @@ rule NCSC_Nautilus_Common_Strings : FILE
 		$ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 3 of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and 3 of them
 }
 rule NCSC_Neuron2_Loader_Strings : FILE
 {
 	meta:
 		description = "Rule for detection of Neuron2 based on strings within the loader"
 		author = "NCSC"
-		id = "eaef4710-1971-55a2-9079-07a9b8bd86eb"
+		id = "41a42a6c-d752-5b42-89ae-31c7aadff061"
 		date = "2018-02-06"
 		modified = "2018-02-06"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L130-L146"
 		license_url = "N/A"
 		hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
-		logic_hash = "c873eaf6f00ea1ee7d86dad451b997d4c8c45c27ac07c3a222b57b5dc203a810"
+		logic_hash = "v1_sha256_c873eaf6f00ea1ee7d86dad451b997d4c8c45c27ac07c3a222b57b5dc203a810"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218668,21 +218411,21 @@ rule NCSC_Neuron2_Loader_Strings : FILE
 		$ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 2 of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and 2 of them
 }
 rule NCSC_Neuron2_Decryption_Routine : FILE
 {
 	meta:
 		description = "Rule for detection of Neuron2 based on the routine used to decrypt the payload"
 		author = "NCSC"
-		id = "6fa43865-f970-57c0-81c7-e9c851e9453c"
+		id = "179d0b38-afbd-52d0-8ec2-d18bc006bc51"
 		date = "2018-02-06"
 		modified = "2018-02-06"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L148-L159"
 		license_url = "N/A"
 		hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
-		logic_hash = "27a9de186dd1a91e3e3c18a786e5604e46e8d2f6364d76fa441bff15eb1aed84"
+		logic_hash = "v1_sha256_27a9de186dd1a91e3e3c18a786e5604e46e8d2f6364d76fa441bff15eb1aed84"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218691,21 +218434,21 @@ rule NCSC_Neuron2_Decryption_Routine : FILE
 		$ = {81 FA FF 00 00 00 0F B6 C2 0F 46 C2 0F B6 0C 04 48 03 CF 0F B6 D1 8A 0C 14 8D 50 01 43 32 0C 13 41 88 0A 49 FF C2 49 83 E9 01}
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of them
 }
 rule NCSC_Neuron2_Dotnet_Strings : FILE
 {
 	meta:
 		description = "Rule for detection of the .NET payload for Neuron2 based on strings used"
 		author = "NCSC"
-		id = "a36e4009-e1a1-520a-9397-8b6f2ad4065a"
+		id = "4ee29a31-fb9e-50bd-8be8-3c1efa65423f"
 		date = "2018-02-06"
 		modified = "2018-02-06"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L161-L176"
 		license_url = "N/A"
 		hash = "83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015"
-		logic_hash = "9a0e8a3b627fa46f11fb5bbf926665aed4de6250c5229c8acb59c784e66943e5"
+		logic_hash = "v1_sha256_9a0e8a3b627fa46f11fb5bbf926665aed4de6250c5229c8acb59c784e66943e5"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -218718,20 +218461,20 @@ rule NCSC_Neuron2_Dotnet_Strings : FILE
 		$s4 = "D:\\Develop\\sps\\neuron2\\neuron2\\obj\\Release\\neuron2.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 2 of ($s*)
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $dotnetMagic and 2 of ( $s* )
 }
 rule NCSC_Sparrowdoor_Apipatch
 {
 	meta:
 		description = "Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory."
 		author = "NCSC"
-		id = "119b7f3a-1850-53ab-a5d1-8882e34a34b4"
+		id = "459390af-131f-58cc-b41e-562d0129f516"
 		date = "2022-02-28"
 		modified = "2022-07-06"
 		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_apipatch.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "302ad7fc0354636c57e6ec86876c7d4a5baaa784f5ecf0f2d51ce47631b8542a"
+		logic_hash = "v1_sha256_302ad7fc0354636c57e6ec86876c7d4a5baaa784f5ecf0f2d51ce47631b8542a"
 		score = 75
 		quality = 80
 		tags = ""
@@ -218753,13 +218496,13 @@ rule NCSC_Sparrowdoor_Shellcode
 	meta:
 		description = "Targets code features of the reflective loader for SparrowDoor. Targeting in memory."
 		author = "NCSC"
-		id = "572187fb-1a11-54f2-9fe7-2b7468b56556"
+		id = "7bfc74fe-a774-5a85-8607-13c916936303"
 		date = "2022-02-28"
 		modified = "2022-07-06"
 		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_shellcode.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "7186bab23114b4825161f58fb02ff397ec8278385482232a4086c86c6fc47082"
+		logic_hash = "v1_sha256_7186bab23114b4825161f58fb02ff397ec8278385482232a4086c86c6fc47082"
 		score = 75
 		quality = 80
 		tags = ""
@@ -218779,13 +218522,13 @@ rule NCSC_Sparrowdoor_Strings
 	meta:
 		description = "Strings that appear in SparrowDoor’s backdoor. Targeting in memory."
 		author = "NCSC"
-		id = "6f96a577-fb59-57db-a66a-f514ecfbf982"
+		id = "052da73d-0f40-5366-a601-d229cc32d6f6"
 		date = "2022-02-28"
 		modified = "2022-07-06"
 		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_strings.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "65ec5d266ecd81ab8e4cfbcb352173f825bdae92fd4737b577cb209bace2a943"
+		logic_hash = "v1_sha256_65ec5d266ecd81ab8e4cfbcb352173f825bdae92fd4737b577cb209bace2a943"
 		score = 75
 		quality = 80
 		tags = ""
@@ -218813,13 +218556,13 @@ rule NCSC_Sparrowdoor_Xor
 	meta:
 		description = "Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory."
 		author = "NCSC"
-		id = "9c07feea-91fc-528e-91ac-14d09fa1fc10"
+		id = "23711ae8-707d-5817-9f9c-baf871de89c5"
 		date = "2022-02-28"
 		modified = "2022-07-06"
 		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_xor.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "3244e9017e5a0bf1c54e03b3191a5c695b2c1586b3ed4c529742f9b48903a348"
+		logic_hash = "v1_sha256_3244e9017e5a0bf1c54e03b3191a5c695b2c1586b3ed4c529742f9b48903a348"
 		score = 75
 		quality = 80
 		tags = ""
@@ -218838,13 +218581,13 @@ rule NCSC_Sparrowdoor_Sleep_Routine
 	meta:
 		description = "SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header."
 		author = "NCSC"
-		id = "9a0aa77d-7dbe-5007-b875-211cf528614b"
+		id = "7f017f10-b162-5348-bf95-37f6252d85a7"
 		date = "2022-02-28"
 		modified = "2022-07-06"
 		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
 		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_sleep_routine.yar#L1-L12"
 		license_url = "N/A"
-		logic_hash = "8ae231cb43440e1771d9f7ecaccfedae33f4d14e5ebabd94a909e05bd9fe1bc1"
+		logic_hash = "v1_sha256_8ae231cb43440e1771d9f7ecaccfedae33f4d14e5ebabd94a909e05bd9fe1bc1"
 		score = 75
 		quality = 80
 		tags = ""
@@ -218860,7 +218603,7 @@ rule NCSC_Sparrowdoor_Sleep_Routine
  * YARA Rule Set
  * Repository Name: Dr4k0nia
  * Repository: https://github.com/dr4k0nia/yara-rules
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8
  * Number of Rules: 5
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -218892,14 +218635,14 @@ rule DR4K0NIA_MAL_MSIL_NET_Typhonlogger_Jul23 : FILE
 	meta:
 		description = "Detects TyphonLogger .NET payloads"
 		author = "dr4k0nia"
-		id = "2fbc1d9e-9c07-560b-9476-a176cdbe1bad"
+		id = "828cbf24-6773-5284-9b01-b1f23160e31a"
 		date = "2023-11-07"
 		modified = "2023-07-11"
 		reference = "https://github.com/dr4k0nia/yara-rules"
 		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/mal_msil_typhon_logger.yar#L1-L21"
 		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
 		hash = "fc8733c217b49ca14702a59a637efc7dba6a2993d57e67424513ce2f5e9d8ed8"
-		logic_hash = "5c22aab1942e31095989b8267e0231191718d4ec44eb3afc6a50f929aae872c8"
+		logic_hash = "v1_sha256_5c22aab1942e31095989b8267e0231191718d4ec44eb3afc6a50f929aae872c8"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -218915,7 +218658,7 @@ rule DR4K0NIA_MAL_MSIL_NET_Typhonlogger_Jul23 : FILE
 		$sx = "New Projects\\EmeraldLogger\\EmeraldLogger\\obj\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($sx or ( all of ($sa*) and 2 of ($op*)))
+		uint16( 0 ) == 0x5a4d and ( $sx or ( all of ( $sa* ) and 2 of ( $op* ) ) )
 }
 import "dotnet"
 
@@ -218924,14 +218667,14 @@ rule DR4K0NIA_Msil_Susp_Obf_Antidump : FILE
 	meta:
 		description = "No description has been set in the source file - Dr4k0nia"
 		author = "dr4k0nia"
-		id = "d9217ade-a016-548e-b63f-f6ee78ff8775"
+		id = "a38b3494-f592-5dac-bfb2-c7d92a942951"
 		date = "2023-12-03"
 		modified = "2023-03-13"
 		reference = "https://github.com/dr4k0nia/yara-rules"
 		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_susp_obf_antidump.yar#L7-L39"
 		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
 		hash = "ef7bb2464a2b430aa98bd65a1a40b851b57cb909ac0aea3e53729c0ff900fa42"
-		logic_hash = "18cfc720f54b2178398f8214591a3fb777ea11e67a8a6d2ce26cc4891a62fd35"
+		logic_hash = "v1_sha256_18cfc720f54b2178398f8214591a3fb777ea11e67a8a6d2ce26cc4891a62fd35"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -218955,7 +218698,7 @@ rule DR4K0NIA_Msil_Susp_Obf_Antidump : FILE
 		10 01 00 00 14 01 00 00 1c 01 00 00}
 
 	condition:
-		uint16(0)==0x5a4d and dotnet.is_dotnet and all of them
+		uint16( 0 ) == 0x5a4d and dotnet.is_dotnet and all of them
 }
 import "dotnet"
 
@@ -218964,13 +218707,13 @@ rule DR4K0NIA_Msil_Susp_Obf_Xorstringsnet : FILE
 	meta:
 		description = "Detects XorStringsNET string encryption, and other obfuscators derived from it"
 		author = "dr4k0nia"
-		id = "0bea654d-9244-5320-a815-691384decc74"
+		id = "86529061-c16f-51ab-8d3a-e0324c1d5340"
 		date = "2023-03-26"
 		modified = "2023-03-26"
 		reference = "https://github.com/dr4k0nia/yara-rules"
 		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_susp_obf_xorstringsnet.yar#L3-L16"
 		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
-		logic_hash = "c494b5b64bcb63d1edd611206fb41eb9a23a940a72c3e9fc3f626e91482b1352"
+		logic_hash = "v1_sha256_c494b5b64bcb63d1edd611206fb41eb9a23a940a72c3e9fc3f626e91482b1352"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -218980,20 +218723,20 @@ rule DR4K0NIA_Msil_Susp_Obf_Xorstringsnet : FILE
 		$pattern = { 06 1E 58 07 8E 69 FE17 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25MB and dotnet.is_dotnet and $pattern
+		uint16( 0 ) == 0x5a4d and filesize < 25MB and dotnet.is_dotnet and $pattern
 }
 rule DR4K0NIA_MAL_Msil_Net_Niximports_Loader : FILE
 {
 	meta:
 		description = "Detects NixImports .NET loader"
 		author = "dr4k0nia"
-		id = "ba0d072d-674a-5790-9381-4dac98204268"
+		id = "0984a80f-88ab-5486-a2ee-1d15bfc2b20a"
 		date = "2023-05-21"
 		modified = "2023-05-22"
 		reference = "https://github.com/dr4k0nia/NixImports"
 		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_mal_niximports_loader.yar#L1-L21"
 		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
-		logic_hash = "79421b2677705852f893fa53478deb2e4aa8bd354ac05cbf5438a3a2a15d70bf"
+		logic_hash = "v1_sha256_79421b2677705852f893fa53478deb2e4aa8bd354ac05cbf5438a3a2a15d70bf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -219007,7 +218750,7 @@ rule DR4K0NIA_MAL_Msil_Net_Niximports_Loader : FILE
 		$a4 = "netstandard" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3MB and all of ($a*) and 2 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 3MB and all of ( $a* ) and 2 of ( $op* )
 }
 import "dotnet"
 
@@ -219016,14 +218759,14 @@ rule DR4K0NIA_Msil_Suspicious_Use_Of_Strreverse : FILE
 	meta:
 		description = "Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse"
 		author = "dr4k0nia"
-		id = "6d4682c3-b372-5d9e-bd6b-747c63e507c6"
+		id = "6a560868-aca5-5b38-9201-e3d6ca2ce84e"
 		date = "2023-01-31"
 		modified = "2023-02-22"
 		reference = "https://github.com/dr4k0nia/yara-rules"
 		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_suspicious_use_of_strreverse.yar#L3-L26"
 		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
 		hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
-		logic_hash = "ce44f1df536104134303b705bda5798dd14dc413296636f2380ecf5811dd63b7"
+		logic_hash = "v1_sha256_ce44f1df536104134303b705bda5798dd14dc413296636f2380ecf5811dd63b7"
 		score = 60
 		quality = 55
 		tags = "FILE"
@@ -219035,13 +218778,13 @@ rule DR4K0NIA_Msil_Suspicious_Use_Of_Strreverse : FILE
 		$strreverse = "StrReverse"
 
 	condition:
-		uint16(0)==0x5a4d and dotnet.is_dotnet and filesize <50MB and $csharp and $vbnet and $strreverse
+		uint16( 0 ) == 0x5a4d and dotnet.is_dotnet and filesize < 50MB and $csharp and $vbnet and $strreverse
 }
 /*
  * YARA Rule Set
  * Repository Name: EmbeeResearch
  * Repository: https://github.com/embee-research/Yara-detection-rules/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4
  * Number of Rules: 39
  * Skipped: 0 (age), 8 (quality), 0 (score), 0 (importance)
@@ -219056,14 +218799,14 @@ rule EMBEERESEARCH_Win_Redline_Updated_Bytecodes_Oct_2023
 	meta:
 		description = "Configuration related bytecodes in redline .net files"
 		author = "Matthew @ Embee_Research"
-		id = "1e4470cf-fad3-57e5-8a95-deb97e98dbdc"
+		id = "87aac748-1fb2-5c43-a85a-36240bcb3f42"
 		date = "2023-10-11"
 		modified = "2023-10-11"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_bytecodes_oct_2023.yar#L2-L35"
 		license_url = "N/A"
 		hash = "0cc3a0f8b48ef8d8562b9cdf9c7cfe7f63faf43a5ac6dc6973dc8bf13b6c88cf"
-		logic_hash = "77273ba3736baf2c197fb8b17de1e22ba8f2380f73f9114f324ef56bfa508654"
+		logic_hash = "v1_sha256_77273ba3736baf2c197fb8b17de1e22ba8f2380f73f9114f324ef56bfa508654"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219094,14 +218837,14 @@ rule EMBEERESEARCH_Win_Lumma_Simple_Strings : FILE
 	meta:
 		description = ""
 		author = "Matthew @ Embee_Research"
-		id = "d949d547-a2ee-56d9-8510-74f3b718b2c0"
+		id = "fb701eba-bcdf-5a27-b0f5-3b17b5601f6a"
 		date = "2023-09-13"
 		modified = "2023-09-21"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_lumma _simple_sep_2023.yar#L1-L40"
 		license_url = "N/A"
 		hash = "277d7f450268aeb4e7fe942f70a9df63aa429d703e9400370f0621a438e918bf"
-		logic_hash = "0b3cb6721d26b79afe892b1c4df5e54c18cd7a5492aeacd442deca6b9b926f3c"
+		logic_hash = "v1_sha256_0b3cb6721d26b79afe892b1c4df5e54c18cd7a5492aeacd442deca6b9b926f3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219116,14 +218859,14 @@ rule EMBEERESEARCH_Win_Lumma_Simple_Strings : FILE
 		$o3 = {4c 00 6f 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 67 00 69 00 6e 00 20 00 44 00 61 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 74 00 61 00}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and (( all of ($s*)) or ( all of ($o*)))
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( ( all of ( $s* ) ) or ( all of ( $o* ) ) )
 }
 rule EMBEERESEARCH_Win_Darkgate_Xllloader_Oct_2023
 {
 	meta:
 		description = "Detects XLL Files Related to DarkGate"
 		author = "Matthew @ Embee_Research"
-		id = "4b5d9a2d-90ee-5452-83be-1677e1888045"
+		id = "118caa8a-ac81-541c-8659-95beb18e41e8"
 		date = "2023-10-03"
 		modified = "2023-10-04"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219135,7 +218878,7 @@ rule EMBEERESEARCH_Win_Darkgate_Xllloader_Oct_2023
 		hash = "27ec297e1fc34e29963303782ff881e74f8bd4126f4c5be0c4754f745d85f79a"
 		hash = "392fd4d218a8e333bc422635e48fdfae59054413c7a6be764c0275752d45ab23"
 		hash = "9a34b32d0a66dd4f59aeea82ef48f335913c47c6ca901ab109df702cd166892f"
-		logic_hash = "ea9a166550c53225b0a06e2cd86760f63aed8973e889a457470bdba3d87ce6af"
+		logic_hash = "v1_sha256_ea9a166550c53225b0a06e2cd86760f63aed8973e889a457470bdba3d87ce6af"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219145,7 +218888,7 @@ rule EMBEERESEARCH_Win_Darkgate_Xllloader_Oct_2023
 		$s2 = { 49 ?? ?? 4c ?? ?? 48 ?? ?? 48 ?? ?? 02 e8 ?? ?? ?? ?? 48 ?? ?? 31 ?? 48 ?? ?? 01 48 ?? ?? 41 ?? ?? ?? ?? 30 ?? 48 ?? ?? 01 49 ?? ?? 75 ?? }
 
 	condition:
-		( all of ($s*))
+		( all of ( $s* ) )
 }
 import "dotnet"
 
@@ -219154,14 +218897,14 @@ rule EMBEERESEARCH_Win_Solarmarker_Bytecodes : FILE
 	meta:
 		description = "Detects bytecodes present in solarmarker Packer"
 		author = "Matthew @ Embee_Research"
-		id = "d405e7ae-f09b-5993-a510-e5e1bc289898"
+		id = "3005f23a-0d6b-5862-8514-e39f4a42f1a4"
 		date = "2023-09-10"
 		modified = "2023-09-11"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_solarmarker_bytecodes_aug_2023.yar#L3-L21"
 		license_url = "N/A"
 		hash = "a433dad1e31f2e19ab5d22b6348c73fa4c874502acc20d5517d785b554754279"
-		logic_hash = "52256184706b7173ee8e8683ac79c1b9d4773778c135e4dae255376c0a6651fb"
+		logic_hash = "v1_sha256_52256184706b7173ee8e8683ac79c1b9d4773778c135e4dae255376c0a6651fb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219170,7 +218913,7 @@ rule EMBEERESEARCH_Win_Solarmarker_Bytecodes : FILE
 		$s1 = {8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 20 ?? ?? ?? ?? 13 ?? 06 11 ?? 20 ?? ?? ?? ?? 58 D1 8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 20 ?? ?? ?? ?? 13 ?? 06 11 ?? 20 ?? ?? ?? ?? 58 D1 8C ?? ?? ?? ?? 28 ?? ?? ?? ??}
 
 	condition:
-		dotnet.is_dotnet and filesize <7000KB and $s1
+		dotnet.is_dotnet and filesize < 7000KB and $s1
 }
 import "dotnet"
 
@@ -219179,14 +218922,14 @@ rule EMBEERESEARCH_Win_Exela_Stealer_Simple_Strings_Sep_2023
 	meta:
 		description = "No description has been set in the source file - EmbeeResearch"
 		author = "Matthew @embee_research"
-		id = "e63aa1d3-997e-5200-93fc-869c177fe1a8"
+		id = "adcb2546-8bc7-5b47-900c-44dee5d4764c"
 		date = "2023-09-24"
 		modified = "2023-09-26"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_exela_stealer_simple_strings_sep_2023.yar#L4-L32"
 		license_url = "N/A"
 		hash = "bf5d70ca2faf355d86f4b40b58032f21e99c3944b1c5e199b9bb728258a95c1b"
-		logic_hash = "2312b63fe86fd34eb12f42f079f470eb3af27ef8c199f3620253c828ad28441a"
+		logic_hash = "v1_sha256_2312b63fe86fd34eb12f42f079f470eb3af27ef8c199f3620253c828ad28441a"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219204,21 +218947,21 @@ rule EMBEERESEARCH_Win_Exela_Stealer_Simple_Strings_Sep_2023
 		$e5 = "Exela.exe" wide ascii
 
 	condition:
-		dotnet.is_dotnet and (( all of ($s*)) or (3 of ($e*)))
+		dotnet.is_dotnet and ( ( all of ( $s* ) ) or ( 3 of ( $e* ) ) )
 }
 rule EMBEERESEARCH_Win_Redline_Loader_Dec_2023
 {
 	meta:
 		description = "Patterns observed in redline loader"
 		author = "Matthew @ Embee_Research"
-		id = "59d933a8-8ccd-565f-b379-e0bf6c3d3111"
+		id = "ceb681ce-a5b0-569c-8e1f-e044be6b713b"
 		date = "2023-12-24"
 		modified = "2023-12-29"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_loader_dec_2023.yar#L1-L20"
 		license_url = "N/A"
 		hash = ""
-		logic_hash = "831c32f9998b97f7ceeb14df73a264a998df5f8800aaa5271755aaaeac070010"
+		logic_hash = "v1_sha256_831c32f9998b97f7ceeb14df73a264a998df5f8800aaa5271755aaaeac070010"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219239,7 +218982,7 @@ rule EMBEERESEARCH_Win_Quasar_Rat_Client : FILE
 	meta:
 		description = "Detects strings present in Quasar Rat Samples."
 		author = "Matthew @ Embee_Research"
-		id = "7fc0bd6d-e187-51b7-a8b8-68b17271cef8"
+		id = "96d7bac0-c01e-5acd-852c-d8418654d35f"
 		date = "2023-08-27"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219248,7 +218991,7 @@ rule EMBEERESEARCH_Win_Quasar_Rat_Client : FILE
 		hash = "914d88f295ac2213f37d3f71e6d4383979283d1728079a208f286effb44d840c"
 		hash = "45a724179ae1d08044c4bafb69c7f9cdb4ed35891dc9cf24aa664d75464ceb6d"
 		hash = "7e13bcd73232c3f33410aa95f61e1196a2f9ae35e05c1f9c8f251e07077a9dfb"
-		logic_hash = "efba911780ffb144f277e88ff8ca8f53a90c32a677ccb19ec26e71f974a1b91f"
+		logic_hash = "v1_sha256_efba911780ffb144f277e88ff8ca8f53a90c32a677ccb19ec26e71f974a1b91f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219261,7 +219004,7 @@ rule EMBEERESEARCH_Win_Quasar_Rat_Client : FILE
 		$s5 = "Yandex\\YandexBrowser\\User Data\\Default\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and dotnet.is_dotnet and filesize <7000KB and ( for any i in (0..dotnet.number_of_resources-1) : (dotnet.resources[i].name=="Quasar.Client*") or (3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and dotnet.is_dotnet and filesize < 7000KB and ( for any i in ( 0 .. dotnet.number_of_resources - 1 ) : ( dotnet.resources [ i ] . name == "Quasar.Client*" ) or ( 3 of ( $s* ) ) )
 }
 import "dotnet"
 
@@ -219270,7 +219013,7 @@ rule EMBEERESEARCH_Win_Xworm_Bytestring
 	meta:
 		description = "Detects bytestring present in unobfuscated xworm"
 		author = "Matthew @ Embee_Research"
-		id = "b7bad89d-ff15-50ae-8c97-64b181dad07f"
+		id = "368f35e3-8ec3-5b0c-a720-3cad56a96d45"
 		date = "2023-08-27"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219278,7 +219021,7 @@ rule EMBEERESEARCH_Win_Xworm_Bytestring
 		license_url = "N/A"
 		hash = "8948b34d471db1e334e6caa00492bd11a60d0ec378933386b0cb7bc1b971c102"
 		hash = "52634ade55558807042eae35e2777894e405e811102e980a2e2b25d151fde121"
-		logic_hash = "dd9955c3616ee65cf94625f5fc92298464a9a3b6deaf32ae70d7e8206c0ceb5b"
+		logic_hash = "v1_sha256_dd9955c3616ee65cf94625f5fc92298464a9a3b6deaf32ae70d7e8206c0ceb5b"
 		score = 50
 		quality = 75
 		tags = ""
@@ -219294,7 +219037,7 @@ rule EMBEERESEARCH_Win_Pikabot_Loader_Bytecodes_Oct_2023
 	meta:
 		description = "Detects bytecodes in recent PikaBot Loaders"
 		author = "Matthew @ Embee_Research"
-		id = "c15b9390-1d20-5325-81c3-c6cf59ffb21f"
+		id = "652b0b07-06a1-5b7d-a6f4-d618c1c4bd7b"
 		date = "2023-10-03"
 		modified = "2023-10-08"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219303,7 +219046,7 @@ rule EMBEERESEARCH_Win_Pikabot_Loader_Bytecodes_Oct_2023
 		hash = "778b6797bb9c9d2f868d3faaaf6b36ce3f06178c133bb592c5345c95ffb034a9"
 		hash = "e26d44d740b4edbd37fa6196dcc9171e49e711d8ce64f67aae36c4299e352108"
 		hash = "2d212cacc4767ef4383bdf462a9bb8aaf87f0b3c55b4c2f4a47c97c710ec1cd8"
-		logic_hash = "a078df39fda5ab6f432c4bf42fb61bdf106386d9684188189e3cea81803b3952"
+		logic_hash = "v1_sha256_a078df39fda5ab6f432c4bf42fb61bdf106386d9684188189e3cea81803b3952"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219323,7 +219066,7 @@ rule EMBEERESEARCH_Win_Agent_Tesla_Bytecodes_Sep_2023
 	meta:
 		description = "No description has been set in the source file - EmbeeResearch"
 		author = "Matthew @embee_research"
-		id = "9d1c5010-7c64-5a6a-bf60-35c042732761"
+		id = "97b9a38d-e2d1-5204-8cd5-9d1d74c05b5b"
 		date = "2023-09-21"
 		modified = "2023-09-21"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219332,7 +219075,7 @@ rule EMBEERESEARCH_Win_Agent_Tesla_Bytecodes_Sep_2023
 		hash = "ce696cf7a6111f5e7c6781854de04ddc262b6c9b39c059fd5435dfb3b8901f04"
 		hash = "afc29232c4989587db2c54b7c9f145fd0d73537e045ece15338582ede5389fce"
 		hash = "fba4374163ba25c9dc572f1a5d7f3e46e09531ab964d808f3dde2a19c05a2ee5"
-		logic_hash = "1cc40ab16dfa5245b3146e4512509037f540d59e155040a2336a97cd0f42e612"
+		logic_hash = "v1_sha256_1cc40ab16dfa5245b3146e4512509037f540d59e155040a2336a97cd0f42e612"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219348,14 +219091,14 @@ rule EMBEERESEARCH_Win_Cobalt_Sleep_Encrypt : FILE
 	meta:
 		description = "Detects Sleep Encryption Logic Found in Cobalt Strike Deployments"
 		author = "Matthew @ Embee_Research"
-		id = "6bd6fbb4-6634-5b51-90f0-f24e48d69043"
+		id = "e472a49c-4e0c-5a7d-a082-a689f5f5071d"
 		date = "2023-08-27"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobalt_sleep_encrypt_aug_2023.yar#L1-L55"
 		license_url = "N/A"
 		hash = "26b2f12906c3590c8272b80358867944fd86b9f2cc21ee6f76f023db812e5bb1"
-		logic_hash = "7aa2674ecaaae819c3f26924fa0622df322b1214493f37b1bdf5e00ba5ee98e6"
+		logic_hash = "v1_sha256_7aa2674ecaaae819c3f26924fa0622df322b1214493f37b1bdf5e00ba5ee98e6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219365,14 +219108,14 @@ rule EMBEERESEARCH_Win_Cobalt_Sleep_Encrypt : FILE
 		$r2_nokey = {49 8B F9 4C 8B 03 B8 ?? ?? ?? ?? 41 F7 E1 41 8B C1 C1 EA 02 41 FF C1 6B D2 0D 2B C2 8A 4C 18 18 42 30 0C 07 48 FF C7 45 3B CB}
 
 	condition:
-		($r1_nokey or $r2_nokey)
+		($r1_nokey or $r2_nokey )
 }
 rule EMBEERESEARCH_Win_Cobaltstrike_Pipe_Strings_Nov_2023 : FILE
 {
 	meta:
 		description = "Detects default strings related to cobalt strike named pipes"
 		author = "Matthew @ Embee_Research"
-		id = "9237f4e8-b9c4-54cb-9cb2-999d267392af"
+		id = "924ea723-1807-5ce1-bd48-bd57c26929ae"
 		date = "2023-11-04"
 		modified = "2023-11-04"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219381,7 +219124,7 @@ rule EMBEERESEARCH_Win_Cobaltstrike_Pipe_Strings_Nov_2023 : FILE
 		hash = "99986d438ec146bbb8b5faa63ce47264750a8fdf508a4d4250a8e1e3d58377fd"
 		hash = "090402a6e2db12cbdd3a889b7b46bb7702acc0cad37d87ff201230b618fe7ed5"
 		hash = "eb2b263937f8d28aa9df7277b6f25d10604a5037d5644c98ee0ab8f7a25db7b4"
-		logic_hash = "ff17fe9d04d9ad6aa5c034b69d412b0d62c48c537c3a54a465761e27e9255e6d"
+		logic_hash = "v1_sha256_ff17fe9d04d9ad6aa5c034b69d412b0d62c48c537c3a54a465761e27e9255e6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219393,7 +219136,7 @@ rule EMBEERESEARCH_Win_Cobaltstrike_Pipe_Strings_Nov_2023 : FILE
 		$s4 = "TlsGetValue"
 
 	condition:
-		( all of ($s*)) and filesize <500KB
+		( all of ( $s* ) ) and filesize < 500KB
 }
 import "dotnet"
 
@@ -219402,14 +219145,14 @@ rule EMBEERESEARCH_Win_Njrat_Strings_Oct_2023
 	meta:
 		description = ""
 		author = "Matthew @ Embee_Research"
-		id = "c89711cb-aae9-5409-80c2-145a8d5fca56"
+		id = "fc1b016b-10f2-5703-b55a-0eccc1c8c3cf"
 		date = "2023-10-03"
 		modified = "2023-10-03"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_njrat_strings_oct_2023.yar#L3-L25"
 		license_url = "N/A"
 		hash = "59d6e2958780d15131c102a93fefce6e388e81da7dc78d9c230aeb6cab7e3474"
-		logic_hash = "ed36a991aa2699486f1ef34f4f4d559a3dd351180602f017ad7d868e146c703b"
+		logic_hash = "v1_sha256_ed36a991aa2699486f1ef34f4f4d559a3dd351180602f017ad7d868e146c703b"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219423,7 +219166,7 @@ rule EMBEERESEARCH_Win_Njrat_Strings_Oct_2023
 		$s6 = "Download ERROR" wide
 
 	condition:
-		dotnet.is_dotnet and ( all of ($s*))
+		dotnet.is_dotnet and ( all of ( $s* ) )
 }
 import "dotnet"
 
@@ -219432,7 +219175,7 @@ rule EMBEERESEARCH_Win_Xworm_Simple_Strings
 	meta:
 		description = "Detects simple strings present in unobfuscated xworm"
 		author = "Matthew @ Embee_Research"
-		id = "8d5d8f07-72fa-596b-a3fc-1dee4b7fd058"
+		id = "a33ed275-ea94-568e-a1a0-6b8840f6a8f5"
 		date = "2023-08-30"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219440,7 +219183,7 @@ rule EMBEERESEARCH_Win_Xworm_Simple_Strings
 		license_url = "N/A"
 		hash = "4459d95c0493d640ecc9453cf6a4f2b7538b1a7b95032f70803fc726b8e40422"
 		hash = "820bb1a31f421b90ea51efc3e71cc720c8c2784fb1e882e732e8fafb8631a389"
-		logic_hash = "f7df310b24b2078249cdb670ece71ebe30f985c92b3e44b6dcf0e37405a26bc3"
+		logic_hash = "v1_sha256_f7df310b24b2078249cdb670ece71ebe30f985c92b3e44b6dcf0e37405a26bc3"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219452,21 +219195,21 @@ rule EMBEERESEARCH_Win_Xworm_Simple_Strings
 		$s3 = "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath " wide
 
 	condition:
-		dotnet.is_dotnet and $x1 and (2 of ($s*))
+		dotnet.is_dotnet and $x1 and ( 2 of ( $s* ) )
 }
 rule EMBEERESEARCH_Win_Redline_Bytecodes_Jan_2024 : FILE
 {
 	meta:
 		description = "Bytecodes found in late 2023 Redline malware"
 		author = "Matthew @ Embee_Research"
-		id = "8acf0fbb-f7d1-5a3d-9ccb-ee21926d6a31"
+		id = "7a108c6b-a45a-5150-a481-651e261f933e"
 		date = "2023-08-27"
 		modified = "2024-01-02"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_bytecodes_jan_2024.yar#L1-L22"
 		license_url = "N/A"
 		hash = "ea1271c032046d482ed94c6d2c2c6e3ede9bea57dff13156cabca42b24fb9332"
-		logic_hash = "43f4d718611c16983071587c2806f92550ebba6bae737c59c63cd8584a5cc01f"
+		logic_hash = "v1_sha256_43f4d718611c16983071587c2806f92550ebba6bae737c59c63cd8584a5cc01f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219476,21 +219219,21 @@ rule EMBEERESEARCH_Win_Redline_Bytecodes_Jan_2024 : FILE
 		$s2 = "mscoree.dll" ascii
 
 	condition:
-		$s1 and $s2 and uint16(0)==0x5a4d
+		$s1 and $s2 and uint16( 0 ) == 0x5a4d
 }
 rule EMBEERESEARCH_Win_Redline_Payload_Dec_2023
 {
 	meta:
 		description = "Patterns observed in redline"
 		author = "Matthew @ Embee_Research"
-		id = "6208779a-69b2-55b5-9744-987575c00d96"
+		id = "d9035b96-df10-5303-84f7-1c48bbfd4350"
 		date = "2023-12-24"
 		modified = "2023-12-29"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_payload_dec_2023.yar#L1-L16"
 		license_url = "N/A"
 		hash = "5790aead07ce0b9b508392b9a2f363ef77055ae16c44231773849c87a1dd15a4"
-		logic_hash = "d016baa5017120a3037e9cef7fd649228f7be60e511ecbdedf97916f59eec881"
+		logic_hash = "v1_sha256_d016baa5017120a3037e9cef7fd649228f7be60e511ecbdedf97916f59eec881"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219506,14 +219249,14 @@ rule EMBEERESEARCH_Win_Remcos_Rat_Unpacked : FILE
 	meta:
 		description = "Detects strings present in remcos rat Samples."
 		author = "Matthew @ Embee_Research"
-		id = "d4282638-592a-5c07-b07b-937e2a7879e4"
+		id = "2802342f-4423-543c-a9d4-937d0609cf5c"
 		date = "2023-08-27"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_remcos_rat_unpacked_aug_2023.yar#L2-L32"
 		license_url = "N/A"
 		hash = "ec901217558e77f2f449031a6a1190b1e99b30fa1bb8d8dabc3a99bc69833784"
-		logic_hash = "c6d1772a5517b104de3022f4bab55d92784d35c3a252a4e0516083d8bd28cad0"
+		logic_hash = "v1_sha256_c6d1772a5517b104de3022f4bab55d92784d35c3a252a4e0516083d8bd28cad0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219530,14 +219273,14 @@ rule EMBEERESEARCH_Win_Remcos_Rat_Unpacked : FILE
 		$s3 = " BreakingSecurity.net" ascii
 
 	condition:
-		(( all of ($r*)) or ( all of ($s*)))
+		(( all of ( $r* ) ) or ( all of ( $s* ) ) )
 }
 rule EMBEERESEARCH_Win_Stealc_Bytecodes_Oct_2023
 {
 	meta:
 		description = "Bytecodes present in Stealc decoding routine"
 		author = "Matthew @ Embee_Research"
-		id = "ecac28a0-cd77-5e6a-8af2-59ea62e733bf"
+		id = "43397d18-6c69-5fc5-a5df-63d7522cf210"
 		date = "2023-08-27"
 		modified = "2023-10-09"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219545,7 +219288,7 @@ rule EMBEERESEARCH_Win_Stealc_Bytecodes_Oct_2023
 		license_url = "N/A"
 		hash = "74ff68245745b9d4cec9ef3c539d8da15295bdc70caa6fdb0632acdd9be4130a"
 		hash = "9f44a4cbc30e7a05d7eb00b531a9b3a4ada5d49ecf585b48892643a189358526"
-		logic_hash = "d50f57e32a7f513d92625549fcd139b7fa1e478879283fd61426fcd19d03d296"
+		logic_hash = "v1_sha256_d50f57e32a7f513d92625549fcd139b7fa1e478879283fd61426fcd19d03d296"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219554,21 +219297,21 @@ rule EMBEERESEARCH_Win_Stealc_Bytecodes_Oct_2023
 		$s1 = {8b 4d f0 89 4d f8 8b 45 f8 c1 e0 03 33 d2 b9 06 00 00 00 f7 f1 8b e5 5d c2 04 00}
 
 	condition:
-		( all of ($s*))
+		( all of ( $s* ) )
 }
 rule EMBEERESEARCH_Win_Lumma_Update_Simple_Strings_Sep_2023 : FILE
 {
 	meta:
 		description = ""
 		author = "Matthew @ Embee_Research"
-		id = "90209fc6-fd50-5b55-a400-112b2f207885"
+		id = "3c93e046-c4f0-57e3-894e-290c917e21a5"
 		date = "2023-09-13"
 		modified = "2023-09-21"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_lumma_updated_sep_2023.yar#L1-L25"
 		license_url = "N/A"
 		hash = "898a2bdbbb33ccd63b038c67d217554a668a52e9642874bd0f57e08153e6e5be"
-		logic_hash = "61571057a5a9c114b6ed5b94b922f2b389406a05e705b3e9e6ddbee221f74c92"
+		logic_hash = "v1_sha256_61571057a5a9c114b6ed5b94b922f2b389406a05e705b3e9e6ddbee221f74c92"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219580,14 +219323,14 @@ rule EMBEERESEARCH_Win_Lumma_Update_Simple_Strings_Sep_2023 : FILE
 		$s4 = "Crypt build to disable this message" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ( all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( all of ( $s* ) )
 }
 rule EMBEERESEARCH_Win_Solarmarker_Stage2_Bytecodes_Dec_2023
 {
 	meta:
 		description = "Patterns observed in Solarmarker stage2 dll"
 		author = "Matthew @ Embee_Research"
-		id = "9aba6cdf-1491-579d-b4a7-fe229272015d"
+		id = "ce85727e-fc17-5b61-8ce9-efd98f2170c2"
 		date = "2023-12-28"
 		modified = "2023-12-28"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219595,7 +219338,7 @@ rule EMBEERESEARCH_Win_Solarmarker_Stage2_Bytecodes_Dec_2023
 		license_url = "N/A"
 		hash = "4a3b60496a793ee96a51fecf8690ef8312429a6b54d32f2a4424395c47b47fc8"
 		hash = "e0b2457491a8c2d50710aa343ad1957a76f83ceaf680165ffa0e287fe18abbd6"
-		logic_hash = "8e50e5942f0029ffda1d9750f8cc8e004a2512e50b6a14c1619ae0b83477a944"
+		logic_hash = "v1_sha256_8e50e5942f0029ffda1d9750f8cc8e004a2512e50b6a14c1619ae0b83477a944"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219613,7 +219356,7 @@ rule EMBEERESEARCH_Win_Icedid_Snowloader_Bytecodes_Oct_2023
 	meta:
 		description = "No description has been set in the source file - EmbeeResearch"
 		author = "Matthew @ Embee_Research"
-		id = "ad5d7bf5-813d-519d-91ae-e6a69fd557df"
+		id = "e0844fee-97bb-5fb7-9b86-2c95ebbc508b"
 		date = "2023-08-27"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219622,7 +219365,7 @@ rule EMBEERESEARCH_Win_Icedid_Snowloader_Bytecodes_Oct_2023
 		hash = "e096de90f65ff83ed0e929b330aa765a8e2322625325fb042775bff1748467cc"
 		hash = "e87928fcddf13935c91a0b5577e28efd29bb6a5c1d98e5129dec63e231601053"
 		hash = "82a01607ebdcaa73b9ff201ccb76780ad8de4a99dd3df026dcb71b0f007456ed"
-		logic_hash = "5baa308ce130cbbe80f94fc127b083f26ae87552910c2bc6f3bae3008cf1aa63"
+		logic_hash = "v1_sha256_5baa308ce130cbbe80f94fc127b083f26ae87552910c2bc6f3bae3008cf1aa63"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219633,21 +219376,21 @@ rule EMBEERESEARCH_Win_Icedid_Snowloader_Bytecodes_Oct_2023
 		$s_3 = {10 e1 8a c3}
 
 	condition:
-		( all of ($s*)) and pe.number_of_exports>20
+		( all of ( $s* ) ) and pe.number_of_exports > 20
 }
 rule EMBEERESEARCH_Win_Berbew_Strings_Dec_2023
 {
 	meta:
 		description = "Strings observed in Berbew malware."
 		author = "Matthew @ Embee_Research"
-		id = "402711af-c543-5c95-ae9e-e663825b6653"
+		id = "6cd82f17-a6a4-58b2-a600-7e98bc2eed68"
 		date = "2023-12-24"
 		modified = "2023-12-26"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_berbew_strings_dec_2023.yar#L1-L19"
 		license_url = "N/A"
 		hash = "24dc0af3c51118697df999d8bffcdfc9cbf0d07f2630473450dd826a1ae4b9ae"
-		logic_hash = "a7f687e749ec69961777063d52678461a8e288c80037fac051d7b1a5b568d9e8"
+		logic_hash = "v1_sha256_a7f687e749ec69961777063d52678461a8e288c80037fac051d7b1a5b568d9e8"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219665,14 +219408,14 @@ rule EMBEERESEARCH_Win_Orcus_Rat_Simple_Strings_Dec_2023
 	meta:
 		description = "Strings observed in Orcus RAT"
 		author = "Matthew @ Embee_Research"
-		id = "baef6b96-bf94-5363-9186-9761a8055afd"
+		id = "e58d6ff9-9f74-5bb6-9ddd-d1be42c9c1ec"
 		date = "2023-12-24"
 		modified = "2023-12-24"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_orcus_rat_simple_strings_dec_2023.yar#L1-L26"
 		license_url = "N/A"
 		hash = "30a2a674d55d7898d304713dd2f69a043d875230ea7ebee22596ba4c640768db"
-		logic_hash = "2e0a44ec2749e0fc646dfb003a2d32b3fecfa07ece72ca5a65116250d80496b8"
+		logic_hash = "v1_sha256_2e0a44ec2749e0fc646dfb003a2d32b3fecfa07ece72ca5a65116250d80496b8"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219697,7 +219440,7 @@ rule EMBEERESEARCH_Win_Njrat_Bytecodes_V2_Oct_2023
 	meta:
 		description = ""
 		author = "Matthew @ Embee_Research"
-		id = "9090574e-7ad4-5207-af8b-7b56f2a1c917"
+		id = "eaf944b6-9bb9-5510-b81d-473a1d4e81e1"
 		date = "2023-10-03"
 		modified = "2023-10-08"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219705,7 +219448,7 @@ rule EMBEERESEARCH_Win_Njrat_Bytecodes_V2_Oct_2023
 		license_url = "N/A"
 		hash = "9877fc613035d533feda6adc6848e183bf8c8660de3a34b1acd73c75e62e2823"
 		hash = "40f07bdfb74e61fe7d7973bcd4167ffefcff2f8ba2ed6f82e9fcb5a295aaf113"
-		logic_hash = "0bdbf5715e3873d96c88a24ba08487af2b798d26cdcd3e35d783ce4828dae775"
+		logic_hash = "v1_sha256_0bdbf5715e3873d96c88a24ba08487af2b798d26cdcd3e35d783ce4828dae775"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219715,7 +219458,7 @@ rule EMBEERESEARCH_Win_Njrat_Bytecodes_V2_Oct_2023
 		$s2 = {0B 14 0C 16 0D 16 13 ?? 16 13 ?? 14}
 
 	condition:
-		dotnet.is_dotnet and ( all of ($s*))
+		dotnet.is_dotnet and ( all of ( $s* ) )
 }
 import "pe"
 import "math"
@@ -219725,7 +219468,7 @@ rule EMBEERESEARCH_Win_Pikabot_Resource_Entropy_Oct_2023
 	meta:
 		description = "Pikabot Loaders embedding encrypted inside of numerous png images"
 		author = "Matthew @ Embee_Research"
-		id = "253d35ae-a325-51c7-8da5-32bb46c51acd"
+		id = "0aeedec2-f960-506c-87da-94a4964f72be"
 		date = "2023-10-03"
 		modified = "2023-10-08"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219740,7 +219483,7 @@ rule EMBEERESEARCH_Win_Pikabot_Resource_Entropy_Oct_2023
 		hash = "951c906a1fa179050d30c06849d42e49a295dd1baad91efb244b2e5486b5801d"
 		hash = "a06bd2623c389f2547d0bf750ca720ab7a74c90982267aad49ba31d5de345288"
 		hash = "aeb2bf8898636b572b0703d9ddb90b9a4c5c6db9eee631ee726ad753f197ac12"
-		logic_hash = "7beec034fc927990734691bd6859870921027860c0591c7a0d5a3815f919112d"
+		logic_hash = "v1_sha256_7beec034fc927990734691bd6859870921027860c0591c7a0d5a3815f919112d"
 		score = 75
 		quality = 50
 		tags = ""
@@ -219751,7 +219494,7 @@ rule EMBEERESEARCH_Win_Pikabot_Resource_Entropy_Oct_2023
 		$s3 = "ARROW-RIGHT" wide
 
 	condition:
-		pe.DLL and ( all of ($s*)) and pe.number_of_resources>25 and pe.sections[3].raw_data_size>400KB and math.entropy(pe.sections[3].raw_data_offset,pe.sections[3].raw_data_size)>7.5
+		pe.DLL and ( all of ( $s* ) ) and pe.number_of_resources > 25 and pe.sections [ 3 ] . raw_data_size > 400KB and math.entropy ( pe.sections [ 3 ] . raw_data_offset , pe.sections [ 3 ] . raw_data_size ) > 7.5
 }
 import "dotnet"
 
@@ -219760,7 +219503,7 @@ rule EMBEERESEARCH_Win_Njrat_Bytecodes_Oct_2023
 	meta:
 		description = ""
 		author = "Matthew @ Embee_Research"
-		id = "9e39587a-e878-5f99-806f-e9964952f0ac"
+		id = "d9ead83d-015f-5a17-a32b-03c068b11a0e"
 		date = "2023-10-03"
 		modified = "2023-10-03"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219769,7 +219512,7 @@ rule EMBEERESEARCH_Win_Njrat_Bytecodes_Oct_2023
 		hash = "59d6e2958780d15131c102a93fefce6e388e81da7dc78d9c230aeb6cab7e3474"
 		hash = "4c56ade4409add1d78eac3b202a9fbd6afbd71878c31f798026082467ace2628"
 		hash = "d5a78790a1b388145424327e78f019584466d30d2d450bba832c0128aa3cd274"
-		logic_hash = "7df39219e2f2da55e461b1536e92ab125d488a048e41daaaa1fb9516be395d10"
+		logic_hash = "v1_sha256_7df39219e2f2da55e461b1536e92ab125d488a048e41daaaa1fb9516be395d10"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219785,7 +219528,7 @@ rule EMBEERESEARCH_Win_Mystic_Stealer_Bytecodes_Sep_2023
 	meta:
 		description = "No description has been set in the source file - EmbeeResearch"
 		author = "Matthew @ Embee_reserch"
-		id = "ef7c51e1-9c8c-5b66-bc1e-f35a796c84f2"
+		id = "1f732dff-6181-5981-a96f-ff972c23a24c"
 		date = "2023-09-21"
 		modified = "2023-11-12"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
@@ -219794,7 +219537,7 @@ rule EMBEERESEARCH_Win_Mystic_Stealer_Bytecodes_Sep_2023
 		hash = "ef9fce75334befe0b435798c0b61dab1239ea5bc62b97654943676dd96dc6318"
 		hash = "36d8cb1447e2c5da60d2b86bf29856919c25f8e71a17f1d0d61d03c5e0505e4b"
 		hash = "e907c22288dacb37efa07481fef7a0d4ec0ce42954f12b2572ea7f5ffeecf313"
-		logic_hash = "f68b6ef307e48b7ff6f944cfcf9c906a83611400af5af7d8621227874356960d"
+		logic_hash = "v1_sha256_f68b6ef307e48b7ff6f944cfcf9c906a83611400af5af7d8621227874356960d"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219822,13 +219565,13 @@ rule EMBEERESEARCH_Win_Ursnif_Patterns_Oct_2022
 	meta:
 		description = "No description has been set in the source file - EmbeeResearch"
 		author = "Embee_Research @ Huntress"
-		id = "2c8da2b7-63f2-5cce-86ab-8a88f50d0263"
+		id = "9735d647-6338-530b-acee-220bee5cac12"
 		date = "2022-10-14"
 		modified = "2023-06-14"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_ursnif_patterns_oct_2022.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "241804ea3b7ac98071c533d9a98a45cdd0f7043f11994327c1f79e29f5fdce2c"
+		logic_hash = "v1_sha256_241804ea3b7ac98071c533d9a98a45cdd0f7043f11994327c1f79e29f5fdce2c"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219845,14 +219588,14 @@ rule EMBEERESEARCH_Win_Medusa_Bytecodes
 	meta:
 		description = "Medusa Bytecodes"
 		author = "Matthew @ Embee_Research"
-		id = "48b659f8-cd26-540a-89b6-6349f8d21e8f"
+		id = "fce19b52-749e-55da-9150-1c9dc7a909ff"
 		date = "2023-08-27"
 		modified = "2024-03-03"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_medusa_dotnet_bytecodes.yar#L1-L17"
 		license_url = "N/A"
 		hash = "a1211549b4e1a7befd953d03b4d929b3dc9f25ec6c1bc9c05ae92a0ec08fb77c"
-		logic_hash = "aa01afd6981af99625a9fca93e512cc00931aca18e55c5cb6dee11efb9ea2968"
+		logic_hash = "v1_sha256_aa01afd6981af99625a9fca93e512cc00931aca18e55c5cb6dee11efb9ea2968"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219869,14 +219612,14 @@ rule EMBEERESEARCH_Win_Marsstealer_Encryption_Bytecodes
 	meta:
 		description = "Encryption observed in MarsStealer"
 		author = "Matthew @ Embee_Research"
-		id = "7a66ea9c-966e-5780-8b36-a268904b9c1b"
+		id = "5fee994d-1b16-523f-8392-0753146a4134"
 		date = "2023-12-24"
 		modified = "2023-12-24"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_marsStealer_encryption_bytecodes_dec_2023.yar#L1-L16"
 		license_url = "N/A"
 		hash = "7a391340b6677f74bcf896b5cc16a470543e2a384049df47949038df5e770df1"
-		logic_hash = "49ffde28c8823c00959ddbaa516fc48c7908b533c8f91608b0e3a645045c9048"
+		logic_hash = "v1_sha256_49ffde28c8823c00959ddbaa516fc48c7908b533c8f91608b0e3a645045c9048"
 		score = 75
 		quality = 75
 		tags = ""
@@ -219892,13 +219635,13 @@ rule EMBEERESEARCH_Win_Cobalt_Strike_Loader_Shellcode_Jun_2023 : FILE
 	meta:
 		description = "Detection of an encoder observed with Cobalt Strike shellcode"
 		author = "Matthew @ Embee_research"
-		id = "ea52b9e7-f2bd-5c9f-9ee1-506baa48be84"
+		id = "04396c3c-1662-5d20-9d91-e1c29ec9b39e"
 		date = "2023-07-03"
 		modified = "2023-07-03"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobalt_shellcode_encoder_jun_2023.yar#L1-L21"
 		license_url = "N/A"
-		logic_hash = "42b4b9ab681f3164168de84e76bcd8161865fa9e5871d70a6de534b23896e4f0"
+		logic_hash = "v1_sha256_42b4b9ab681f3164168de84e76bcd8161865fa9e5871d70a6de534b23896e4f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219910,20 +219653,20 @@ rule EMBEERESEARCH_Win_Cobalt_Strike_Loader_Shellcode_Jun_2023 : FILE
 		$b64_initial_bytes = "SInISIlMJAiLiMAAAACLkMQAAABIjbDIAAAA" wide ascii
 
 	condition:
-		(($get_enc_offset and $decode_loop) or $b64_initial_bytes) and filesize <10000KB
+		(( $get_enc_offset and $decode_loop ) or $b64_initial_bytes ) and filesize < 10000KB
 }
 rule EMBEERESEARCH_Win_Emotet_String_Patterns_Oct_2022 : FILE
 {
 	meta:
 		description = "Detection of string hashing routines observed in emotet"
 		author = "Embee_Research @ HuntressLabs"
-		id = "fd9c3133-95dc-5dd8-9e94-ed85ad8e1fc7"
+		id = "2ccc7cea-2738-589a-a1ed-f8a5aaf5b8ca"
 		date = "2022-10-14"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_emotet_string_patterns_oct_2022.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "36f4a3fed124b8c25711f706c5b4f1c9b0801c2105cf86077b8c002dd70a6fbc"
+		logic_hash = "v1_sha256_36f4a3fed124b8c25711f706c5b4f1c9b0801c2105cf86077b8c002dd70a6fbc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219935,20 +219678,20 @@ rule EMBEERESEARCH_Win_Emotet_String_Patterns_Oct_2022 : FILE
 		$em4 = {8b cb 41 8b d0 d3 e2 41 8b cb d3 e0 03 d0 41 0f be c1 03 d0 41 2b d0 49 ff c2 44 8b c2}
 
 	condition:
-		uint16(0)==0x5a4d and ( any of them )
+		uint16( 0 ) == 0x5a4d and ( any of them )
 }
 rule EMBEERESEARCH_Win_Qakbot_String_Decrypt_Nov_2022 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - EmbeeResearch"
 		author = "Embee_Research @ Huntress"
-		id = "0023872f-8edb-59d6-88eb-a76528ba6ec8"
+		id = "8e39d71d-e48d-50c1-baed-0eb3aae40ea5"
 		date = "2022-11-14"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_qakbot_string_decrypt_nov_2022.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "d225f69fa4dd0e8d7c98e7f8968ad285f05b232225e9ce1070b7a23257a0ef9d"
+		logic_hash = "v1_sha256_d225f69fa4dd0e8d7c98e7f8968ad285f05b232225e9ce1070b7a23257a0ef9d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219957,20 +219700,20 @@ rule EMBEERESEARCH_Win_Qakbot_String_Decrypt_Nov_2022 : FILE
 		$qakbot_decrypt = {33 d2 8b c7 f7 75 10 8a 04 1a 8b 55 fc 32 04 17 88 04 39 47 83 ee 01}
 
 	condition:
-		uint16(0)==0x5a4d and $qakbot_decrypt
+		uint16( 0 ) == 0x5a4d and $qakbot_decrypt
 }
 rule EMBEERESEARCH_Win_Gracewire_Loader_Dec_2022 : FILE
 {
 	meta:
 		description = "Yara rule to detect GraceWireLoader via usage of Stack Strings"
 		author = "Embee_Research @ Huntress"
-		id = "63d0cd9f-34f7-5ec4-8061-66d36859bd0c"
+		id = "b0e902ed-69df-54ed-96ad-0a317d226f87"
 		date = "2022-12-12"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_gracewire_loader_dec_2022.yar#L2-L24"
 		license_url = "N/A"
-		logic_hash = "168af6d24c0646e90717f27e6ba4a18da8e92950ffa7a881243860305037da48"
+		logic_hash = "v1_sha256_168af6d24c0646e90717f27e6ba4a18da8e92950ffa7a881243860305037da48"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -219989,13 +219732,13 @@ rule EMBEERESEARCH_Win_Bruteratel_Syscall_Hashes_Oct_2022 : FILE
 	meta:
 		description = "Detection of Brute Ratel Badger via api hashes of Nt* functions. "
 		author = "Embee_Research @ Huntress"
-		id = "b82612b4-272e-5ae2-bd87-3593e55918f8"
+		id = "bb4cdbdb-9bfa-5e23-ba4a-341dd2bfd0d9"
 		date = "2022-10-12"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_bruteratel_syscall_hashes_oct_2022.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "e284d5568e0b5ffa0f231f98ecce13b5f5518a4e005ea001a5c89087c91eb8a1"
+		logic_hash = "v1_sha256_e284d5568e0b5ffa0f231f98ecce13b5f5518a4e005ea001a5c89087c91eb8a1"
 		score = 60
 		quality = 25
 		tags = "FILE"
@@ -220008,20 +219751,20 @@ rule EMBEERESEARCH_Win_Bruteratel_Syscall_Hashes_Oct_2022 : FILE
 		$hash4 = {74 eb 1d 4d}
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x00e8) and (2 of ($hash*))
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x00e8 ) and ( 2 of ( $hash* ) )
 }
 rule EMBEERESEARCH_Win_Icedid_Encryption_Oct_2022 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - EmbeeResearch"
 		author = "Embee_Research @ Huntress"
-		id = "1ecbb3b3-dfc1-5d69-807d-3a44c39a3536"
+		id = "92d59584-7ddc-5b43-8ab5-8740bcd8002a"
 		date = "2022-10-14"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_icedid_encryption_oct_2022.yar#L1-L18"
 		license_url = "N/A"
-		logic_hash = "da657cf87e043a1fdb2ec683de8a7a12acb8c8f1c24034bb376d525c0a1c5740"
+		logic_hash = "v1_sha256_da657cf87e043a1fdb2ec683de8a7a12acb8c8f1c24034bb376d525c0a1c5740"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -220037,13 +219780,13 @@ rule EMBEERESEARCH_Win_Nighthawk_Nov_2022 : FILE
 	meta:
 		description = "Experimental Yara rule for patterns observed in Nighthawk"
 		author = "Embee_Research @ Huntress"
-		id = "853b0623-ea35-5055-90d0-bb2b5aea8ecd"
+		id = "2c303027-da31-5af5-aced-16fe552fbccc"
 		date = "2022-11-23"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_nighthawk_nov_2022.yar#L1-L100"
 		license_url = "N/A"
-		logic_hash = "ef39067c12396db1de2feb560ff5628cbb3126e34e6318e88bdb08f6eb7940fb"
+		logic_hash = "v1_sha256_ef39067c12396db1de2feb560ff5628cbb3126e34e6318e88bdb08f6eb7940fb"
 		score = 50
 		quality = 67
 		tags = "FILE"
@@ -220081,20 +219824,20 @@ rule EMBEERESEARCH_Win_Nighthawk_Nov_2022 : FILE
 		$shr_block = {c1 e9 02 33 ca 66 d1 e8 d1 e9 33 ca c1 e9 02 33 ca c1 e2 0f}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ((((3 of ($s*)) or (3 of ($g*))) and ((1 of ($ror*)) and (1 of ($gs_offset*)))) or $shr_block)
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( ( ( ( 3 of ( $s* ) ) or ( 3 of ( $g* ) ) ) and ( ( 1 of ( $ror* ) ) and ( 1 of ( $gs_offset* ) ) ) ) or $shr_block )
 }
 rule EMBEERESEARCH_Win_Qakbot_Api_Hashing_Oct_2022 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - EmbeeResearch"
 		author = "@Embee_Research"
-		id = "b5478404-659d-5b3a-b722-f8ba33875d8a"
+		id = "d3650228-9c96-5be7-8946-df4976aca40a"
 		date = "2022-11-14"
 		modified = "2022-12-01"
 		reference = "https://twitter.com/embee_research/status/1592067841154756610"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_qakbot_api_hashing_oct_2022.yar#L2-L21"
 		license_url = "N/A"
-		logic_hash = "595cabd508ee60c5606f965eb9a290ae21ea32af0f56e213f6ce2d2e35dc4e11"
+		logic_hash = "v1_sha256_595cabd508ee60c5606f965eb9a290ae21ea32af0f56e213f6ce2d2e35dc4e11"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -220111,13 +219854,13 @@ rule EMBEERESEARCH_Win_Havoc_Djb2_Hashing_Routine_Oct_2022 : FILE
 	meta:
 		description = "No description has been set in the source file - EmbeeResearch"
 		author = "embee_research @ HuntressLabs"
-		id = "cde3e14f-0671-5bcf-93e8-e0a0af9b462c"
+		id = "2bc00be0-edc0-5728-865f-9e6cac78dbdd"
 		date = "2022-10-11"
 		modified = "2023-10-18"
 		reference = "https://github.com/embee-research/Yara-detection-rules/"
 		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_havoc_djb2_hashing_routine_oct_2022.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "9f645480c3d78153186a247440739a1d2e627ec64a4225083bd8db4ad9bd5ef3"
+		logic_hash = "v1_sha256_9f645480c3d78153186a247440739a1d2e627ec64a4225083bd8db4ad9bd5ef3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -220128,13 +219871,13 @@ rule EMBEERESEARCH_Win_Havoc_Djb2_Hashing_Routine_Oct_2022 : FILE
 		$shellcode = {41 80 f8 60 76 04 41 83 e8 20 6b c0 21 45 0f b6 c0 49 ff c1 44 01 c0 eb c4}
 
 	condition:
-		( any of them ) and ( uint16(0)==0x5a4d or uint16(0)==0x00e8 or uint16(0)==0x4856)
+		( any of them ) and ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x00e8 or uint16( 0 ) == 0x4856 )
 }
 /*
  * YARA Rule Set
  * Repository Name: AvastTI
  * Repository: https://github.com/avast/ioc
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: c696ec4bc17b1d41d5585d40ccf476f445b4a3de
  * Number of Rules: 33
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -220149,32 +219892,32 @@ private rule AVASTTI_EXE_PRIVATE : FILE
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "1096b81d-5853-5d19-b502-c8166b712a3d"
+		id = "69b37032-9cce-58c3-891a-a3977b4b4040"
 		date = "2022-10-05"
 		modified = "2022-10-05"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/Manjusaka/Manjusaka.yar#L9-L13"
 		license_url = "N/A"
-		logic_hash = "0688672446142f95a22e49a04234cc90b6c9021efeda9ce57034c88d84944663"
+		logic_hash = "v1_sha256_0688672446142f95a22e49a04234cc90b6c9021efeda9ce57034c88d84944663"
 		score = 75
 		quality = 90
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550
 }
 private rule AVASTTI_ELF_PRIVATE
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "38aa7852-e7ea-5b90-a5f6-0862ad19a051"
+		id = "74b86d32-88a1-5b8c-b61e-222d1a823e52"
 		date = "2022-10-05"
 		modified = "2022-10-05"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/Manjusaka/Manjusaka.yar#L1-L7"
 		license_url = "N/A"
-		logic_hash = "eb05e5d53bb8dea91467a76a164542894cdb1355cf3909f56818e27c589344ec"
+		logic_hash = "v1_sha256_eb05e5d53bb8dea91467a76a164542894cdb1355cf3909f56818e27c589344ec"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220190,7 +219933,7 @@ rule AVASTTI_Manjusaka_Framework_Go_Build_Id
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "eca3324c-c029-53b5-b33d-9ec758dcd863"
+		id = "a8015382-2c43-582c-aa34-c459667d47fd"
 		date = "2022-10-05"
 		modified = "2022-10-05"
 		reference = "https://github.com/avast/ioc"
@@ -220209,7 +219952,7 @@ rule AVASTTI_Manjusaka_Framework_Go_Build_Id
 		hash = "4a0f47132867c12a6d009e43812729a1bb41f4eb83472ac352fc5b20fe937bef"
 		hash = "bb1b7d506559c783ed747da461f58ea5256ba0a083768ae6aa1a2325017c4387"
 		hash = "bd0e09e9ee4db74ada6433f00024a543f799046c15f635216ca4ae5e1f0c42e2"
-		logic_hash = "de68bc483255c9c1095771925a7c2fc3062489a4468d42e7c6aa9f0146841c5c"
+		logic_hash = "v1_sha256_de68bc483255c9c1095771925a7c2fc3062489a4468d42e7c6aa9f0146841c5c"
 		score = 75
 		quality = 88
 		tags = ""
@@ -220237,13 +219980,13 @@ rule AVASTTI_Manjusaka_Payload_Encoded_Hexstring
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "9799081c-67ec-5ab8-9b23-31f60c05fc05"
+		id = "87f702ab-3675-569c-a64e-fb3ad231c856"
 		date = "2022-10-05"
 		modified = "2022-10-05"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/Manjusaka/Manjusaka.yar#L64-L93"
 		license_url = "N/A"
-		logic_hash = "5c0b83e709baea7db6185d888bfa10bab073eb0eb2f3fb72df2da76fff3f6f22"
+		logic_hash = "v1_sha256_5c0b83e709baea7db6185d888bfa10bab073eb0eb2f3fb72df2da76fff3f6f22"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220260,14 +220003,14 @@ rule AVASTTI_Manjusaka_Payload_Encoded_Hexstring
 		$s15 = "1f8b08000000000000ffecbd79785445d6305eb7934e3a90e676846887451abc68c7b5e33293284b37e924a7e506a222a022c45119501c23744b1c194ce6764b2a97abcc88233a3aaee38a"
 
 	condition:
-		(AVASTTI_EXE_PRIVATE or AVASTTI_ELF_PRIVATE) and ( any of ($s0*) and any of ($s1*))
+		(AVASTTI_EXE_PRIVATE or AVASTTI_ELF_PRIVATE ) and ( any of ( $s0* ) and any of ( $s1* ) )
 }
 rule AVASTTI_Manjusaka_Payload_Elf
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "010398f6-ca9b-58b4-a9d8-12428f649ffc"
+		id = "e2491acc-b103-58fc-b7dc-e110ec603cad"
 		date = "2022-10-05"
 		modified = "2022-10-05"
 		reference = "https://github.com/avast/ioc"
@@ -220279,7 +220022,7 @@ rule AVASTTI_Manjusaka_Payload_Elf
 		hash = "63e7f6fa89faa88b346d0cceddf2ef2e3ebf5d5828aa0087663c227422041db7"
 		hash = "400855b63b8452221869630c58b7ab03373dabf77c0f10df635e746c13f98ea9"
 		hash = "4eb337c12f0e0ee73b3209bed4b819719c4af9f63f3e81dbc3bbf06212450f1c"
-		logic_hash = "bbc496788381b57b3ea2814dd61a824d552233f9c5f73287f8bc284252fbedfe"
+		logic_hash = "v1_sha256_bbc496788381b57b3ea2814dd61a824d552233f9c5f73287f8bc284252fbedfe"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220296,14 +220039,14 @@ rule AVASTTI_Manjusaka_Payload_Elf
 		$s15 = "/NPSC2/npc/libs/"
 
 	condition:
-		AVASTTI_ELF_PRIVATE and ( all of ($s0*) and any of ($s1*))
+		AVASTTI_ELF_PRIVATE and ( all of ( $s0* ) and any of ( $s1* ) )
 }
 rule AVASTTI_Manjusaka_Payload_Mz
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "808fe840-27e2-5361-b97a-4b04e6d8f7da"
+		id = "8d29574d-4b61-5331-bd68-226e48b567c5"
 		date = "2022-10-05"
 		modified = "2022-10-05"
 		reference = "https://github.com/avast/ioc"
@@ -220318,7 +220061,7 @@ rule AVASTTI_Manjusaka_Payload_Mz
 		hash = "51857882d1202e72c0cf18ff21de773c2a31ee68ff28385f968478401c5ab4bb"
 		hash = "e07aa10f19574a856a4ac389a3ded96f2d78f41f939935dd678811bd12b5bd03"
 		hash = "9e7144540430d97de38a2adcef16ad43e23c91281462b135fcc56cafc2f34160"
-		logic_hash = "81b01eff8384707ce67f6d888e59e690d7fb7b4e32359043ced9230499813aa7"
+		logic_hash = "v1_sha256_81b01eff8384707ce67f6d888e59e690d7fb7b4e32359043ced9230499813aa7"
 		score = 60
 		quality = 50
 		tags = ""
@@ -220342,20 +220085,20 @@ rule AVASTTI_Manjusaka_Payload_Mz
 		$s111 = "plug_test_nps.dll"
 
 	condition:
-		AVASTTI_EXE_PRIVATE and (2 of ($s0*) or 3 of ($s1*))
+		AVASTTI_EXE_PRIVATE and ( 2 of ( $s0* ) or 3 of ( $s1* ) )
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Dns_Stager_X86
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "817c4a72-7be1-5a58-987d-fe203d7778ea"
+		id = "03df1c25-bb01-5f85-a84d-c8d9da2777df"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L1-L26"
 		license_url = "N/A"
-		logic_hash = "d447fac16f0a712b1c264bc83b4cf2e56e5e98b369617799b981cd75b37c3511"
+		logic_hash = "v1_sha256_d447fac16f0a712b1c264bc83b4cf2e56e5e98b369617799b981cd75b37c3511"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220364,20 +220107,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Dns_Stager_X86
 		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		uint32(@h01+0x00a3)==0xe553a458 and uint32(@h01+0x00bd)==0x0726774c and uint32(@h01+0x012f)==0xc99cc96a and uint32(@h01+0x0198)==0x56a2b5f0 and uint32(@h01+0x01a4)==0xe035f044 and uint32(@h01+0x01e4)==0xcc8e00f4
+		uint32( @h01 + 0x00a3 ) == 0xe553a458 and uint32( @h01 + 0x00bd ) == 0x0726774c and uint32( @h01 + 0x012f ) == 0xc99cc96a and uint32( @h01 + 0x0198 ) == 0x56a2b5f0 and uint32( @h01 + 0x01a4 ) == 0xe035f044 and uint32( @h01 + 0x01e4 ) == 0xcc8e00f4
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Smb_Stager_X86
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "29911a14-08ea-54de-9c07-630c6516bd49"
+		id = "1e13c697-bbae-59b2-80c4-fd5410fe5d5e"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L28-L57"
 		license_url = "N/A"
-		logic_hash = "7459bcb0353f114a869aa61adc0229197ca9a1cfce0741dc227fabbeea2afba9"
+		logic_hash = "v1_sha256_7459bcb0353f114a869aa61adc0229197ca9a1cfce0741dc227fabbeea2afba9"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220386,20 +220129,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Smb_Stager_X86
 		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		uint32(@h01+0x00a1)==0xe553a458 and uint32(@h01+0x00c4)==0xd4df7045 and uint32(@h01+0x00d2)==0xe27d6f28 and uint32(@h01+0x00f8)==0xbb5f9ead and uint32(@h01+0x010d)==0xbb5f9ead and uint32(@h01+0x0131)==0xfcddfac0 and uint32(@h01+0x0139)==0x528796c6 and uint32(@h01+0x014b)==0x56a2b5f0
+		uint32( @h01 + 0x00a1 ) == 0xe553a458 and uint32( @h01 + 0x00c4 ) == 0xd4df7045 and uint32( @h01 + 0x00d2 ) == 0xe27d6f28 and uint32( @h01 + 0x00f8 ) == 0xbb5f9ead and uint32( @h01 + 0x010d ) == 0xbb5f9ead and uint32( @h01 + 0x0131 ) == 0xfcddfac0 and uint32( @h01 + 0x0139 ) == 0x528796c6 and uint32( @h01 + 0x014b ) == 0x56a2b5f0
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X86
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "ec0a9e27-3650-5393-a93b-2a461b9a0e29"
+		id = "6d643f41-9c89-5520-a6a4-5e1f05d3783e"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L59-L96"
 		license_url = "N/A"
-		logic_hash = "5c56e1f1d85375f19b6085b3d4654d2d1ba38d3dfcfea66707ca8957a6ed7bf8"
+		logic_hash = "v1_sha256_5c56e1f1d85375f19b6085b3d4654d2d1ba38d3dfcfea66707ca8957a6ed7bf8"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220408,20 +220151,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X86
 		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00ac)==0x006b8029 and uint32(@h01+0x00bb)==0xe0df0fea and uint32(@h01+0x00d5)==0x6737dbc2 and uint32(@h01+0x00de)==0xff38e9b7 and uint32(@h01+0x00e8)==0xe13bec74 and uint32(@h01+0x00f1)==0x614d6e75 and uint32(@h01+0x00fa)==0x56a2b5f0 and uint32(@h01+0x0107)==0x5fc8d902 and uint32(@h01+0x011a)==0xe553a458 and uint32(@h01+0x0128)==0x5fc8d902 and uint32(@h01+0x013d)==0x614d6e75
+		uint32( @h01 + 0x009c ) == 0x0726774c and uint32( @h01 + 0x00ac ) == 0x006b8029 and uint32( @h01 + 0x00bb ) == 0xe0df0fea and uint32( @h01 + 0x00d5 ) == 0x6737dbc2 and uint32( @h01 + 0x00de ) == 0xff38e9b7 and uint32( @h01 + 0x00e8 ) == 0xe13bec74 and uint32( @h01 + 0x00f1 ) == 0x614d6e75 and uint32( @h01 + 0x00fa ) == 0x56a2b5f0 and uint32( @h01 + 0x0107 ) == 0x5fc8d902 and uint32( @h01 + 0x011a ) == 0xe553a458 and uint32( @h01 + 0x0128 ) == 0x5fc8d902 and uint32( @h01 + 0x013d ) == 0x614d6e75
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X64
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "3575408a-3309-5723-a49a-9c2088d43de9"
+		id = "83e4a899-a055-50a5-b659-e59708554cd9"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L98-L133"
 		license_url = "N/A"
-		logic_hash = "a803a9c76142ccadda5f5c8f6abf78ac9a60523576edf62f4a1600556f4b6261"
+		logic_hash = "v1_sha256_a803a9c76142ccadda5f5c8f6abf78ac9a60523576edf62f4a1600556f4b6261"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220430,20 +220173,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X64
 		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
 
 	condition:
-		uint32(@h01+0x0100)==0x0726774c and uint32(@h01+0x0111)==0x006b8029 and uint32(@h01+0x012d)==0xe0df0fea and uint32(@h01+0x0142)==0x6737dbc2 and uint32(@h01+0x0150)==0xff38e9b7 and uint32(@h01+0x0161)==0xe13bec74 and uint32(@h01+0x016f)==0x614d6e75 and uint32(@h01+0x0198)==0x5fc8d902 and uint32(@h01+0x01b8)==0xe553a458 and uint32(@h01+0x01d2)==0x5fc8d902 and uint32(@h01+0x01ee)==0x614d6e75
+		uint32( @h01 + 0x0100 ) == 0x0726774c and uint32( @h01 + 0x0111 ) == 0x006b8029 and uint32( @h01 + 0x012d ) == 0xe0df0fea and uint32( @h01 + 0x0142 ) == 0x6737dbc2 and uint32( @h01 + 0x0150 ) == 0xff38e9b7 and uint32( @h01 + 0x0161 ) == 0xe13bec74 and uint32( @h01 + 0x016f ) == 0x614d6e75 and uint32( @h01 + 0x0198 ) == 0x5fc8d902 and uint32( @h01 + 0x01b8 ) == 0xe553a458 and uint32( @h01 + 0x01d2 ) == 0x5fc8d902 and uint32( @h01 + 0x01ee ) == 0x614d6e75
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X86
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "ac824189-614d-5bff-9bbb-a4244cace563"
+		id = "71231dd3-28e8-5698-8470-69e049191651"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L135-L164"
 		license_url = "N/A"
-		logic_hash = "c20de49c3225a7aed8460d0e3cc3bce715c8746fb4313a2faf9da3c8d1d87387"
+		logic_hash = "v1_sha256_c20de49c3225a7aed8460d0e3cc3bce715c8746fb4313a2faf9da3c8d1d87387"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220452,20 +220195,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X86
 		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00ac)==0x006b8029 and uint32(@h01+0x00bb)==0xe0df0fea and uint32(@h01+0x00d5)==0x6174a599 and uint32(@h01+0x00e5)==0x56a2b5f0 and uint32(@h01+0x00f2)==0x5fc8d902 and uint32(@h01+0x0105)==0xe553a458 and uint32(@h01+0x0113)==0x5fc8d902
+		uint32( @h01 + 0x009c ) == 0x0726774c and uint32( @h01 + 0x00ac ) == 0x006b8029 and uint32( @h01 + 0x00bb ) == 0xe0df0fea and uint32( @h01 + 0x00d5 ) == 0x6174a599 and uint32( @h01 + 0x00e5 ) == 0x56a2b5f0 and uint32( @h01 + 0x00f2 ) == 0x5fc8d902 and uint32( @h01 + 0x0105 ) == 0xe553a458 and uint32( @h01 + 0x0113 ) == 0x5fc8d902
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X64
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "21151a9c-1d15-514f-b33b-c9eff08463fb"
+		id = "9fe50c32-90ac-5c3c-936e-e9223cee472b"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L166-L195"
 		license_url = "N/A"
-		logic_hash = "58ae5351bac70ab9530cb033d1f6bb90acb6b66df395d59a55d221ef2a2e5dcf"
+		logic_hash = "v1_sha256_58ae5351bac70ab9530cb033d1f6bb90acb6b66df395d59a55d221ef2a2e5dcf"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220474,20 +220217,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X64
 		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
 
 	condition:
-		uint32(@h01+0x0100)==0x0726774c and uint32(@h01+0x0111)==0x006b8029 and uint32(@h01+0x012d)==0xe0df0fea and uint32(@h01+0x0142)==0x6174a599 and uint32(@h01+0x016b)==0x5fc8d902 and uint32(@h01+0x018b)==0xe553a458 and uint32(@h01+0x01a5)==0x5fc8d902 and uint32(@h01+0x01c1)==0x614d6e75
+		uint32( @h01 + 0x0100 ) == 0x0726774c and uint32( @h01 + 0x0111 ) == 0x006b8029 and uint32( @h01 + 0x012d ) == 0xe0df0fea and uint32( @h01 + 0x0142 ) == 0x6174a599 and uint32( @h01 + 0x016b ) == 0x5fc8d902 and uint32( @h01 + 0x018b ) == 0xe553a458 and uint32( @h01 + 0x01a5 ) == 0x5fc8d902 and uint32( @h01 + 0x01c1 ) == 0x614d6e75
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X86
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "01f89b14-55f2-5a5e-b0d5-6bca609621fe"
+		id = "5a42c801-1d0e-5d78-9e35-517c0ff570af"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L197-L232"
 		license_url = "N/A"
-		logic_hash = "d3c74ff363d113d25d9ecca114dd0872487e713a978da4f94f3cccc2e92943ff"
+		logic_hash = "v1_sha256_d3c74ff363d113d25d9ecca114dd0872487e713a978da4f94f3cccc2e92943ff"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220496,20 +220239,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X86
 		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00aa)==0xa779563a and uint32(@h01+0x00c6)==0xc69f8957 and uint32(@h01+0x00de)==0x3b2e55eb and uint32(@h01+0x00f2)==0x7b18062d and uint32(@h01+0x010b)==0x5de2c5aa and uint32(@h01+0x0114)==0x315e2145 and uint32(@h01+0x0123)==0x0be057b7 and uint32(@h01+0x02c4)==0x56a2b5f0 and uint32(@h01+0x02d8)==0xe553a458 and uint32(@h01+0x02f3)==0xe2899612
+		uint32( @h01 + 0x009c ) == 0x0726774c and uint32( @h01 + 0x00aa ) == 0xa779563a and uint32( @h01 + 0x00c6 ) == 0xc69f8957 and uint32( @h01 + 0x00de ) == 0x3b2e55eb and uint32( @h01 + 0x00f2 ) == 0x7b18062d and uint32( @h01 + 0x010b ) == 0x5de2c5aa and uint32( @h01 + 0x0114 ) == 0x315e2145 and uint32( @h01 + 0x0123 ) == 0x0be057b7 and uint32( @h01 + 0x02c4 ) == 0x56a2b5f0 and uint32( @h01 + 0x02d8 ) == 0xe553a458 and uint32( @h01 + 0x02f3 ) == 0xe2899612
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X64
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "7eeeb2a1-4903-5649-ae30-fd43367ab468"
+		id = "68c1ce16-6fe4-53b0-b9a3-6af6b3f21913"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L234-L263"
 		license_url = "N/A"
-		logic_hash = "a89a8e25d894bf7e5c4a10e2a14b78a52543e42fb185667db9f9548f52ef58bf"
+		logic_hash = "v1_sha256_a89a8e25d894bf7e5c4a10e2a14b78a52543e42fb185667db9f9548f52ef58bf"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220518,20 +220261,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X64
 		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
 
 	condition:
-		uint32(@h01+0x00e9)==0x0726774c and uint32(@h01+0x0101)==0xa779563a and uint32(@h01+0x0120)==0xc69f8957 and uint32(@h01+0x013f)==0x3b2e55eb and uint32(@h01+0x0163)==0x7b18062d and uint32(@h01+0x0308)==0x56a2b5f0 and uint32(@h01+0x0324)==0xe553a458 and uint32(@h01+0x0342)==0xe2899612
+		uint32( @h01 + 0x00e9 ) == 0x0726774c and uint32( @h01 + 0x0101 ) == 0xa779563a and uint32( @h01 + 0x0120 ) == 0xc69f8957 and uint32( @h01 + 0x013f ) == 0x3b2e55eb and uint32( @h01 + 0x0163 ) == 0x7b18062d and uint32( @h01 + 0x0308 ) == 0x56a2b5f0 and uint32( @h01 + 0x0324 ) == 0xe553a458 and uint32( @h01 + 0x0342 ) == 0xe2899612
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X86
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "f1d7e939-92b5-5441-8014-b2390854d059"
+		id = "1b407e3f-902a-5cba-ba4b-1af5715bac5e"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L266-L303"
 		license_url = "N/A"
-		logic_hash = "c168b6f2ce35e57cd4c572ce40652261df7af7900beab7ffcdae58113cad88c0"
+		logic_hash = "v1_sha256_c168b6f2ce35e57cd4c572ce40652261df7af7900beab7ffcdae58113cad88c0"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220540,20 +220283,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X86
 		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00af)==0xa779563a and uint32(@h01+0x00cb)==0xc69f8957 and uint32(@h01+0x00e7)==0x3b2e55eb and uint32(@h01+0x0100)==0x869e4675 and uint32(@h01+0x0110)==0x7b18062d and uint32(@h01+0x0129)==0x5de2c5aa and uint32(@h01+0x0132)==0x315e2145 and uint32(@h01+0x0141)==0x0be057b7 and uint32(@h01+0x02e9)==0x56a2b5f0 and uint32(@h01+0x02fd)==0xe553a458 and uint32(@h01+0x0318)==0xe2899612
+		uint32( @h01 + 0x009c ) == 0x0726774c and uint32( @h01 + 0x00af ) == 0xa779563a and uint32( @h01 + 0x00cb ) == 0xc69f8957 and uint32( @h01 + 0x00e7 ) == 0x3b2e55eb and uint32( @h01 + 0x0100 ) == 0x869e4675 and uint32( @h01 + 0x0110 ) == 0x7b18062d and uint32( @h01 + 0x0129 ) == 0x5de2c5aa and uint32( @h01 + 0x0132 ) == 0x315e2145 and uint32( @h01 + 0x0141 ) == 0x0be057b7 and uint32( @h01 + 0x02e9 ) == 0x56a2b5f0 and uint32( @h01 + 0x02fd ) == 0xe553a458 and uint32( @h01 + 0x0318 ) == 0xe2899612
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X64
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "5f9c7426-63be-5049-91fc-63b5c29618bd"
+		id = "6b11e3fb-8a57-5cd2-a255-6a3d339751d5"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L306-L337"
 		license_url = "N/A"
-		logic_hash = "cb36d75efcd0e76bf96793863d1aa5145237ec3ce5c7195e679f2e1019d5bbab"
+		logic_hash = "v1_sha256_cb36d75efcd0e76bf96793863d1aa5145237ec3ce5c7195e679f2e1019d5bbab"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220562,20 +220305,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X64
 		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
 
 	condition:
-		uint32(@h01+0x00e9)==0x0726774c and uint32(@h01+0x0101)==0xa779563a and uint32(@h01+0x0123)==0xc69f8957 and uint32(@h01+0x0142)==0x3b2e55eb and uint32(@h01+0x016c)==0x869e4675 and uint32(@h01+0x0186)==0x7b18062d and uint32(@h01+0x032b)==0x56a2b5f0 and uint32(@h01+0x0347)==0xe553a458 and uint32(@h01+0x0365)==0xe2899612
+		uint32( @h01 + 0x00e9 ) == 0x0726774c and uint32( @h01 + 0x0101 ) == 0xa779563a and uint32( @h01 + 0x0123 ) == 0xc69f8957 and uint32( @h01 + 0x0142 ) == 0x3b2e55eb and uint32( @h01 + 0x016c ) == 0x869e4675 and uint32( @h01 + 0x0186 ) == 0x7b18062d and uint32( @h01 + 0x032b ) == 0x56a2b5f0 and uint32( @h01 + 0x0347 ) == 0xe553a458 and uint32( @h01 + 0x0365 ) == 0xe2899612
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Dns_Stager_X86_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "d148ca33-b233-519d-8ba4-d389de721d15"
+		id = "bf151d9a-d06d-5592-8438-9c7b12b9de23"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L339-L354"
 		license_url = "N/A"
-		logic_hash = "3519d2af99a159483ba22cd87907bcc87bea1cfc2fb92f5f0334fff1c385ef00"
+		logic_hash = "v1_sha256_3519d2af99a159483ba22cd87907bcc87bea1cfc2fb92f5f0334fff1c385ef00"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220584,20 +220327,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Dns_Stager_X86_Utf16
 		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		uint32(@h01+0x0149)==0xe5005300 and uint32(@h01+0x017d)==0x07002600 and uint32(@h01+0x0261)==0xc9009c00 and uint32(@h01+0x0333)==0x5600a200 and uint32(@h01+0x034b)==0xe0003500 and uint32(@h01+0x03cb)==0xcc008e00
+		uint32( @h01 + 0x0149 ) == 0xe5005300 and uint32( @h01 + 0x017d ) == 0x07002600 and uint32( @h01 + 0x0261 ) == 0xc9009c00 and uint32( @h01 + 0x0333 ) == 0x5600a200 and uint32( @h01 + 0x034b ) == 0xe0003500 and uint32( @h01 + 0x03cb ) == 0xcc008e00
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Smb_Stager_X86_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "d88e050f-9e6c-5349-b809-ad7dc25a79b9"
+		id = "02172e3b-73b2-58b5-97aa-32f2a848715a"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L356-L373"
 		license_url = "N/A"
-		logic_hash = "74c50e1c989167ea6d9309e2b53629c7103484faa809a80e90b7d5c318b2370c"
+		logic_hash = "v1_sha256_74c50e1c989167ea6d9309e2b53629c7103484faa809a80e90b7d5c318b2370c"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220606,20 +220349,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Smb_Stager_X86_Utf16
 		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		uint32(@h01+0x0145)==0xe5005300 and uint32(@h01+0x018b)==0xd400df00 and uint32(@h01+0x01a7)==0xe2007d00 and uint32(@h01+0x01f3)==0xbb005f00 and uint32(@h01+0x021d)==0xbb005f00 and uint32(@h01+0x0265)==0xfc00dd00 and uint32(@h01+0x0275)==0x52008700 and uint32(@h01+0x0299)==0x5600a200
+		uint32( @h01 + 0x0145 ) == 0xe5005300 and uint32( @h01 + 0x018b ) == 0xd400df00 and uint32( @h01 + 0x01a7 ) == 0xe2007d00 and uint32( @h01 + 0x01f3 ) == 0xbb005f00 and uint32( @h01 + 0x021d ) == 0xbb005f00 and uint32( @h01 + 0x0265 ) == 0xfc00dd00 and uint32( @h01 + 0x0275 ) == 0x52008700 and uint32( @h01 + 0x0299 ) == 0x5600a200
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X86_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "7f17985d-b245-5e95-9b35-af669aafc263"
+		id = "edb204c1-868c-5b0b-9318-8cc43a283fcf"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L375-L396"
 		license_url = "N/A"
-		logic_hash = "2c5ac98ffbea197d14cd6e508729885b5f86adbace0a6d978664908e070965cf"
+		logic_hash = "v1_sha256_2c5ac98ffbea197d14cd6e508729885b5f86adbace0a6d978664908e070965cf"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220628,20 +220371,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X86_Utf16
 		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x015b)==0x00006b00 and uint32(@h01+0x0179)==0xe000df00 and uint32(@h01+0x01ad)==0x67003700 and uint32(@h01+0x01bf)==0xff003800 and uint32(@h01+0x01d3)==0xe1003b00 and uint32(@h01+0x01e5)==0x61004d00 and uint32(@h01+0x01f7)==0x5600a200 and uint32(@h01+0x0211)==0x5f00c800 and uint32(@h01+0x0237)==0xe5005300 and uint32(@h01+0x0253)==0x5f00c800 and uint32(@h01+0x027d)==0x61004d00
+		uint32( @h01 + 0x013b ) == 0x07002600 and uint32( @h01 + 0x015b ) == 0x00006b00 and uint32( @h01 + 0x0179 ) == 0xe000df00 and uint32( @h01 + 0x01ad ) == 0x67003700 and uint32( @h01 + 0x01bf ) == 0xff003800 and uint32( @h01 + 0x01d3 ) == 0xe1003b00 and uint32( @h01 + 0x01e5 ) == 0x61004d00 and uint32( @h01 + 0x01f7 ) == 0x5600a200 and uint32( @h01 + 0x0211 ) == 0x5f00c800 and uint32( @h01 + 0x0237 ) == 0xe5005300 and uint32( @h01 + 0x0253 ) == 0x5f00c800 and uint32( @h01 + 0x027d ) == 0x61004d00
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X64_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "bd52fb44-379a-5c82-9c7c-b10c8080b53f"
+		id = "9fa4a505-b61e-564d-bced-fb09fe0ebeb3"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L398-L418"
 		license_url = "N/A"
-		logic_hash = "cdd8e0c9bdaf8d7662a118964abdea8eaea6c0e17fe1f20a80497c0c43d496d6"
+		logic_hash = "v1_sha256_cdd8e0c9bdaf8d7662a118964abdea8eaea6c0e17fe1f20a80497c0c43d496d6"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220650,20 +220393,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X64_Utf16
 		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
 
 	condition:
-		uint32(@h01+0x0203)==0x07002600 and uint32(@h01+0x0225)==0x00006b00 and uint32(@h01+0x025d)==0xe000df00 and uint32(@h01+0x0287)==0x67003700 and uint32(@h01+0x02a3)==0xff003800 and uint32(@h01+0x02c5)==0xe1003b00 and uint32(@h01+0x02e1)==0x61004d00 and uint32(@h01+0x0333)==0x5f00c800 and uint32(@h01+0x0373)==0xe5005300 and uint32(@h01+0x03a7)==0x5f00c800 and uint32(@h01+0x03df)==0x61004d00
+		uint32( @h01 + 0x0203 ) == 0x07002600 and uint32( @h01 + 0x0225 ) == 0x00006b00 and uint32( @h01 + 0x025d ) == 0xe000df00 and uint32( @h01 + 0x0287 ) == 0x67003700 and uint32( @h01 + 0x02a3 ) == 0xff003800 and uint32( @h01 + 0x02c5 ) == 0xe1003b00 and uint32( @h01 + 0x02e1 ) == 0x61004d00 and uint32( @h01 + 0x0333 ) == 0x5f00c800 and uint32( @h01 + 0x0373 ) == 0xe5005300 and uint32( @h01 + 0x03a7 ) == 0x5f00c800 and uint32( @h01 + 0x03df ) == 0x61004d00
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X86_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "321c1f3f-b7fc-5408-b460-6aa4423d381c"
+		id = "e4527d35-5a11-54e5-8ea1-3016a257c9f5"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L420-L437"
 		license_url = "N/A"
-		logic_hash = "5495405ef3a54c960cf27147dce0d25cb298fee84a99415b59bc548c4f64a1e6"
+		logic_hash = "v1_sha256_5495405ef3a54c960cf27147dce0d25cb298fee84a99415b59bc548c4f64a1e6"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220672,20 +220415,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X86_Utf16
 		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x015b)==0x00006b00 and uint32(@h01+0x0179)==0xe000df00 and uint32(@h01+0x01ad)==0x61007400 and uint32(@h01+0x01cd)==0x5600a200 and uint32(@h01+0x01e7)==0x5f00c800 and uint32(@h01+0x020d)==0xe5005300 and uint32(@h01+0x0229)==0x5f00c800
+		uint32( @h01 + 0x013b ) == 0x07002600 and uint32( @h01 + 0x015b ) == 0x00006b00 and uint32( @h01 + 0x0179 ) == 0xe000df00 and uint32( @h01 + 0x01ad ) == 0x61007400 and uint32( @h01 + 0x01cd ) == 0x5600a200 and uint32( @h01 + 0x01e7 ) == 0x5f00c800 and uint32( @h01 + 0x020d ) == 0xe5005300 and uint32( @h01 + 0x0229 ) == 0x5f00c800
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X64_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "1cc2494c-1f39-5a72-93af-c267eaf768fe"
+		id = "b1953a76-ecd1-5587-b0b4-7440fb240348"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L439-L456"
 		license_url = "N/A"
-		logic_hash = "d7e8fe5d2e07b7a85fadaa432bf345231ac4ddac5458167431403ddfe05467fc"
+		logic_hash = "v1_sha256_d7e8fe5d2e07b7a85fadaa432bf345231ac4ddac5458167431403ddfe05467fc"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220694,20 +220437,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X64_Utf16
 		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
 
 	condition:
-		uint32(@h01+0x0203)==0x07002600 and uint32(@h01+0x0225)==0x00006b00 and uint32(@h01+0x025d)==0xe000df00 and uint32(@h01+0x0287)==0x61007400 and uint32(@h01+0x02d9)==0x5f00c800 and uint32(@h01+0x0319)==0xe5005300 and uint32(@h01+0x034d)==0x5f00c800 and uint32(@h01+0x0385)==0x61004d00
+		uint32( @h01 + 0x0203 ) == 0x07002600 and uint32( @h01 + 0x0225 ) == 0x00006b00 and uint32( @h01 + 0x025d ) == 0xe000df00 and uint32( @h01 + 0x0287 ) == 0x61007400 and uint32( @h01 + 0x02d9 ) == 0x5f00c800 and uint32( @h01 + 0x0319 ) == 0xe5005300 and uint32( @h01 + 0x034d ) == 0x5f00c800 and uint32( @h01 + 0x0385 ) == 0x61004d00
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X86_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "c1602e85-5b42-5005-a6d1-7140cb57a3c7"
+		id = "dc5738d2-395a-544e-a8ce-4f836b3f18d1"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L458-L478"
 		license_url = "N/A"
-		logic_hash = "b6e19ee9141aa22d73de6d8145257eba7b3b2bb2edc0996591085c84f242ec87"
+		logic_hash = "v1_sha256_b6e19ee9141aa22d73de6d8145257eba7b3b2bb2edc0996591085c84f242ec87"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220716,20 +220459,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X86_Utf16
 		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x0157)==0xa7007900 and uint32(@h01+0x018f)==0xc6009f00 and uint32(@h01+0x01bf)==0x3b002e00 and uint32(@h01+0x01e7)==0x7b001800 and uint32(@h01+0x0219)==0x5d00e200 and uint32(@h01+0x022b)==0x31005e00 and uint32(@h01+0x0249)==0x0b00e000 and uint32(@h01+0x058b)==0x5600a200 and uint32(@h01+0x05b3)==0xe5005300 and uint32(@h01+0x05e9)==0xe2008900
+		uint32( @h01 + 0x013b ) == 0x07002600 and uint32( @h01 + 0x0157 ) == 0xa7007900 and uint32( @h01 + 0x018f ) == 0xc6009f00 and uint32( @h01 + 0x01bf ) == 0x3b002e00 and uint32( @h01 + 0x01e7 ) == 0x7b001800 and uint32( @h01 + 0x0219 ) == 0x5d00e200 and uint32( @h01 + 0x022b ) == 0x31005e00 and uint32( @h01 + 0x0249 ) == 0x0b00e000 and uint32( @h01 + 0x058b ) == 0x5600a200 and uint32( @h01 + 0x05b3 ) == 0xe5005300 and uint32( @h01 + 0x05e9 ) == 0xe2008900
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X64_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "78672e3b-6f76-573a-8a9a-610334baa389"
+		id = "33984e6a-ed78-5c32-b560-83e89f736f08"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L480-L497"
 		license_url = "N/A"
-		logic_hash = "f88378749f0da0c66d66b917eeb11a56f083bb487c19c22a230dee4f50e1e309"
+		logic_hash = "v1_sha256_f88378749f0da0c66d66b917eeb11a56f083bb487c19c22a230dee4f50e1e309"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220738,20 +220481,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X64_Utf16
 		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
 
 	condition:
-		uint32(@h01+0x01d5)==0x07002600 and uint32(@h01+0x0205)==0xa7007900 and uint32(@h01+0x0243)==0xc6009f00 and uint32(@h01+0x0281)==0x3b002e00 and uint32(@h01+0x02c9)==0x7b001800 and uint32(@h01+0x0613)==0x5600a200 and uint32(@h01+0x064b)==0xe5005300 and uint32(@h01+0x0687)==0xe2008900
+		uint32( @h01 + 0x01d5 ) == 0x07002600 and uint32( @h01 + 0x0205 ) == 0xa7007900 and uint32( @h01 + 0x0243 ) == 0xc6009f00 and uint32( @h01 + 0x0281 ) == 0x3b002e00 and uint32( @h01 + 0x02c9 ) == 0x7b001800 and uint32( @h01 + 0x0613 ) == 0x5600a200 and uint32( @h01 + 0x064b ) == 0xe5005300 and uint32( @h01 + 0x0687 ) == 0xe2008900
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X86_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "dcd3e5c8-7626-5a78-9f90-7a8e67311d90"
+		id = "05d2479e-ab75-5ab5-82cd-55a8582b6e5a"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L499-L520"
 		license_url = "N/A"
-		logic_hash = "5003ebd545182bb105cdcaaac2105a92cdd99a0178c24eb5ae2888232897aeb5"
+		logic_hash = "v1_sha256_5003ebd545182bb105cdcaaac2105a92cdd99a0178c24eb5ae2888232897aeb5"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220760,20 +220503,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X86_Utf16
 		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x0161)==0xa7007900 and uint32(@h01+0x0199)==0xc6009f00 and uint32(@h01+0x01d1)==0x3b002e00 and uint32(@h01+0x0203)==0x86009e00 and uint32(@h01+0x0223)==0x7b001800 and uint32(@h01+0x0255)==0x5d00e200 and uint32(@h01+0x0267)==0x31005e00 and uint32(@h01+0x0285)==0x0b00e000 and uint32(@h01+0x05d5)==0x5600a200 and uint32(@h01+0x05fd)==0xe5005300 and uint32(@h01+0x0633)==0xe2008900
+		uint32( @h01 + 0x013b ) == 0x07002600 and uint32( @h01 + 0x0161 ) == 0xa7007900 and uint32( @h01 + 0x0199 ) == 0xc6009f00 and uint32( @h01 + 0x01d1 ) == 0x3b002e00 and uint32( @h01 + 0x0203 ) == 0x86009e00 and uint32( @h01 + 0x0223 ) == 0x7b001800 and uint32( @h01 + 0x0255 ) == 0x5d00e200 and uint32( @h01 + 0x0267 ) == 0x31005e00 and uint32( @h01 + 0x0285 ) == 0x0b00e000 and uint32( @h01 + 0x05d5 ) == 0x5600a200 and uint32( @h01 + 0x05fd ) == 0xe5005300 and uint32( @h01 + 0x0633 ) == 0xe2008900
 }
 rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X64_Utf16
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "aa93dd56-9589-5958-9711-ca2f9c763665"
+		id = "74a273f2-8333-50ce-8b61-93e2ba570fa3"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L522-L540"
 		license_url = "N/A"
-		logic_hash = "dee3eb3353da0179c58a33c3be0af6ad1e6aa9f13e9e6b9821c94f11d209266f"
+		logic_hash = "v1_sha256_dee3eb3353da0179c58a33c3be0af6ad1e6aa9f13e9e6b9821c94f11d209266f"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220782,20 +220525,20 @@ rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X64_Utf16
 		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
 
 	condition:
-		uint32(@h01+0x01d5)==0x07002600 and uint32(@h01+0x0205)==0xa7007900 and uint32(@h01+0x0249)==0xc6009f00 and uint32(@h01+0x0287)==0x3b002e00 and uint32(@h01+0x02db)==0x86009e00 and uint32(@h01+0x030f)==0x7b001800 and uint32(@h01+0x0659)==0x5600a200 and uint32(@h01+0x0691)==0xe5005300 and uint32(@h01+0x06cd)==0xe2008900
+		uint32( @h01 + 0x01d5 ) == 0x07002600 and uint32( @h01 + 0x0205 ) == 0xa7007900 and uint32( @h01 + 0x0249 ) == 0xc6009f00 and uint32( @h01 + 0x0287 ) == 0x3b002e00 and uint32( @h01 + 0x02db ) == 0x86009e00 and uint32( @h01 + 0x030f ) == 0x7b001800 and uint32( @h01 + 0x0659 ) == 0x5600a200 and uint32( @h01 + 0x0691 ) == 0xe5005300 and uint32( @h01 + 0x06cd ) == 0xe2008900
 }
 rule AVASTTI_Cobaltstrike_Payload_Encoded
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "b5176740-2dda-5e5d-8c0f-47a27846753d"
+		id = "6274d8aa-f907-5084-a60d-1349c1c38ff4"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L542-L593"
 		license_url = "N/A"
-		logic_hash = "03c650b3c1797c03c635e25ea9d1d4589c6a4b31da0a3e48631fa16d0e3a342b"
+		logic_hash = "v1_sha256_03c650b3c1797c03c635e25ea9d1d4589c6a4b31da0a3e48631fa16d0e3a342b"
 		score = 75
 		quality = 68
 		tags = ""
@@ -220834,13 +220577,13 @@ rule AVASTTI_Cobaltstrike_Strike_Payload_Xored
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "0e075644-e278-5c5b-bdcc-dc2d6a32ce73"
+		id = "0e118a1c-64e2-55ea-bcf6-54cc4e09ab13"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L595-L613"
 		license_url = "N/A"
-		logic_hash = "532cf38554ad7211fab74d050007f6fe8d63c20e05f21a6737fff12ac92a81d7"
+		logic_hash = "v1_sha256_532cf38554ad7211fab74d050007f6fe8d63c20e05f21a6737fff12ac92a81d7"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220849,20 +220592,20 @@ rule AVASTTI_Cobaltstrike_Strike_Payload_Xored
 		$h01 = { 10 ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? 61 61 61 61 }
 
 	condition:
-		uint32be(@h01+8)^ uint32be(@h01+16)==0xFCE88900 or uint32be(@h01+8)^ uint32be(@h01+16)==0xFC4883E4 or uint32be(@h01+8)^ uint32be(@h01+16)==0x4D5AE800 or uint32be(@h01+8)^ uint32be(@h01+16)==0x4D5A4152 or uint32be(@h01+8)^ uint32be(@h01+16)==0x90909090
+		uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0xFCE88900 or uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0xFC4883E4 or uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0x4D5AE800 or uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0x4D5A4152 or uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0x90909090
 }
 rule AVASTTI_Cobaltstrike_Beacon_X86
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "6ffaafe6-2758-53e4-b5b8-6d8350baf428"
+		id = "69ce47ef-9ad9-5f88-8421-018f1e80a9b6"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L615-L632"
 		license_url = "N/A"
-		logic_hash = "e6328aae5954ac8e3914e65603813ba4f11d97ff91d08a1398e1f71740879463"
+		logic_hash = "v1_sha256_e6328aae5954ac8e3914e65603813ba4f11d97ff91d08a1398e1f71740879463"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220874,20 +220617,20 @@ rule AVASTTI_Cobaltstrike_Beacon_X86
 		$h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
 
 	condition:
-		$h01 and any of ($h1*)
+		$h01 and any of ( $h1* )
 }
 rule AVASTTI_Cobaltstrike_Beacon_X64
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "5d6d86ec-9e05-5596-b623-30f44c6f44db"
+		id = "b0ccdbed-429c-5c79-a16d-970596d4f248"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L634-L651"
 		license_url = "N/A"
-		logic_hash = "7abf5f9a337c60944a52efcc7a16a768652c46843d2da3df2f946dd6e63f9375"
+		logic_hash = "v1_sha256_7abf5f9a337c60944a52efcc7a16a768652c46843d2da3df2f946dd6e63f9375"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220899,20 +220642,20 @@ rule AVASTTI_Cobaltstrike_Beacon_X64
 		$h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
 
 	condition:
-		$h01 and any of ($h1*)
+		$h01 and any of ( $h1* )
 }
 rule AVASTTI_Cobaltstrike_Beacon_Encoded
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "497e2a32-015a-5786-a6fa-de7084bfc389"
+		id = "55b773b0-701c-5442-aeb0-31388f68edc3"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L653-L703"
 		license_url = "N/A"
-		logic_hash = "f763c0c41a69c6bafb65517d20ef76242bf7b1626d6745d9a1c26772de3ffa26"
+		logic_hash = "v1_sha256_f763c0c41a69c6bafb65517d20ef76242bf7b1626d6745d9a1c26772de3ffa26"
 		score = 75
 		quality = 68
 		tags = ""
@@ -220951,13 +220694,13 @@ rule AVASTTI_Cobaltstrike_Beacon_Xored_X86
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "d93c20e6-3e01-5132-88a0-63ace507cae9"
+		id = "88375a9c-2c06-5155-a717-6865af828bcc"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L705-L726"
 		license_url = "N/A"
-		logic_hash = "1415c8ab5b4ddd6eb0f561b570358f04f967621dfc6274e0380879563b612c27"
+		logic_hash = "v1_sha256_1415c8ab5b4ddd6eb0f561b570358f04f967621dfc6274e0380879563b612c27"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220968,20 +220711,20 @@ rule AVASTTI_Cobaltstrike_Beacon_Xored_X86
 		$h11 = { 7402 EB(E8|EA) ?? FF?? E8(D0|D4)FFFFFF }
 
 	condition:
-		any of ($h0*) and ( uint32be(@h11+12)^ uint32be(@h11+20)==0x4D5AE800 or uint32be(@h11+12)^ uint32be(@h11+20)==0x904D5AE8 or uint32be(@h11+12)^ uint32be(@h11+20)==0x90904D5A or uint32be(@h11+12)^ uint32be(@h11+20)==0x9090904D or uint32be(@h11+12)^ uint32be(@h11+20)==0x90909090)
+		any of ( $h0* ) and ( uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x4D5AE800 or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x904D5AE8 or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x90904D5A or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x9090904D or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x90909090 )
 }
 rule AVASTTI_Cobaltstrike_Beacon_Xored_X64
 {
 	meta:
 		description = "No description has been set in the source file - AvastTI"
 		author = "Avast Threat Intel Team"
-		id = "15be610a-7552-5473-8da2-639220313783"
+		id = "5097999d-9da8-5a86-a56d-ee7aebbc97ef"
 		date = "2021-07-08"
 		modified = "2021-07-08"
 		reference = "https://github.com/avast/ioc"
 		source_url = "https://github.com/avast/ioc/blob/c696ec4bc17b1d41d5585d40ccf476f445b4a3de/CobaltStrike/yara_rules/cs_rules.yar#L728-L746"
 		license_url = "N/A"
-		logic_hash = "11e6c8be28325d42f24fb5bb43c0b5fd35990a46857bae7c9940262a33c02a8c"
+		logic_hash = "v1_sha256_11e6c8be28325d42f24fb5bb43c0b5fd35990a46857bae7c9940262a33c02a8c"
 		score = 75
 		quality = 90
 		tags = ""
@@ -220991,13 +220734,13 @@ rule AVASTTI_Cobaltstrike_Beacon_Xored_X64
 		$h11 = { FC 4883E4F0 FFD0 E8C8FFFFFF }
 
 	condition:
-		$h01 and ( uint32be(@h11+12)^ uint32be(@h11+20)==0x4D5A4152 or uint32be(@h11+12)^ uint32be(@h11+20)==0x904D5A41 or uint32be(@h11+12)^ uint32be(@h11+20)==0x90904D5A or uint32be(@h11+12)^ uint32be(@h11+20)==0x9090904D or uint32be(@h11+12)^ uint32be(@h11+20)==0x90909090)
+		$h01 and ( uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x4D5A4152 or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x904D5A41 or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x90904D5A or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x9090904D or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x90909090 )
 }
 /*
  * YARA Rule Set
  * Repository Name: SBousseaden
  * Repository: https://github.com/sbousseaden/YaraHunts/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 71b27a2a7c57c2aa1877a11d8933167794e2b4fb
  * Number of Rules: 36
  * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
@@ -221012,13 +220755,13 @@ rule SBOUSSEADEN_Infinityhook : FILE
 	meta:
 		description = "Infinityhook is a legit research PoC to hook NT Syscalls bypassing PatchGuard"
 		author = "SBousseaden"
-		id = "82f4eef2-fca7-58b1-a85c-3c237f523740"
+		id = "8345e51b-8b86-5003-95b2-a5c6f60ec52a"
 		date = "2020-09-07"
 		modified = "2020-07-10"
 		reference = "https://github.com/everdox/InfinityHook"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/infinityhook.yara#L1-L17"
 		license_url = "N/A"
-		logic_hash = "c621ce3be8049de7584af73ca4472df5561d3c4ac8b458937db2ad68fdcbe2d8"
+		logic_hash = "v1_sha256_c621ce3be8049de7584af73ca4472df5561d3c4ac8b458937db2ad68fdcbe2d8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -221030,21 +220773,21 @@ rule SBOUSSEADEN_Infinityhook : FILE
 		$CKL = "Circular Kernel Context Logger" wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_Strings : FILE
 {
 	meta:
 		description = "This rule is looking for some key encoded strings of the SUNBURST backdoor"
 		author = "SBousseaden"
-		id = "04a63bd6-9737-568f-a20e-c573b915cbd4"
+		id = "b59eea8e-cf77-5781-a5ae-c149380bca42"
 		date = "2020-12-14"
 		modified = "2020-12-18"
 		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/apt_solarwinds_backdoor_encoded_strings.yara#L1-L28"
 		license_url = "N/A"
 		hash = "846e27a652a5e1bfbd0ddd38a16dc865"
-		logic_hash = "8808cca8d89f089a8bca5ef62c1764061c8210ba5f9813c886d6ed9f79579ba6"
+		logic_hash = "v1_sha256_8808cca8d89f089a8bca5ef62c1764061c8210ba5f9813c886d6ed9f79579ba6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -221070,20 +220813,20 @@ rule SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_Strings : FILE
 		$pat4 = {9D 2A 9A F3 27 D6 F8 EF}
 
 	condition:
-		uint16(0)==0x5a4d and $sw and (2 of ($pat*) or 2 of ($priv*) or all of ($disc*) or 2 of ($wmi*) or all of ($key*))
+		uint16( 0 ) == 0x5a4d and $sw and ( 2 of ( $pat* ) or 2 of ( $priv* ) or all of ( $disc* ) or 2 of ( $wmi* ) or all of ( $key* ) )
 }
 rule SBOUSSEADEN_Zerlologon_Mimikatz : FILE
 {
 	meta:
 		description = "Generic Hunting rule for Mimikatz Implementation of ZeroLogon PrivEsc Exploit"
 		author = "SBousseaden"
-		id = "0fd32f14-d82d-5af4-b4a2-b21e2325ade8"
+		id = "c8c6955c-3204-597c-a6e0-4124490d90d4"
 		date = "2020-09-17"
 		modified = "2020-09-17"
 		reference = "https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20200916"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_mimikatz_zerologon.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "5b8d618e8e680acd4e5a9def4e3b56617080dec0c5787c3d6f948489346a6888"
+		logic_hash = "v1_sha256_5b8d618e8e680acd4e5a9def4e3b56617080dec0c5787c3d6f948489346a6888"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -221100,20 +220843,20 @@ rule SBOUSSEADEN_Zerlologon_Mimikatz : FILE
 		$rpc3 = {00 48 00 00 00 00 04 00 28 00 31 08 00 00 00 5C 3C 00 44 00 46 05 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 0A 01 10 00 14 00 12 21 18 00 14 00 70 00 20 00 08 00 00 48 00 00 00 00 0F 00 40 00 31 08 00 00 00 5C 5E 00 60 00 46 08 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 48 00 10 00 0D 00 0B 01 18 00 08 00 0A 01 20 00 14 00 12 21 28 00 14 00 58 01 30 00 08 00 70 00 38 00 08 00 00 48 00 00 00 00 1E 00 40 00 31 08 00 00 00 5C 8E 02 58 00 46 08 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 48 00 10 00 0D 00 0B 01 18 00 08 00 0A 01 20 00 2A 00 12 41 28 00 2A 00 0A 01 30 00 42 00 70 00 38 00 08 00 00 48 00 00 00 00 2A 00 48 00 31 08 00 00 00 5C 56 00 40 01 46 09 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 48 00 10 00 0D 00 0B 01 18 00 08 00 0A 01 20 00 2A 00 12 41 28 00 2A 00 12 41 30 00 5A 00 12 41 38 00 5A 00 70 00 40 00 08 00 00 00}
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($rch*) and 1 of ($auth*) and 1 of ($pwd*)) and 2 of ($rpc*)
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $rch* ) and 1 of ( $auth* ) and 1 of ( $pwd* ) ) and 2 of ( $rpc* )
 }
 rule SBOUSSEADEN_Hunt_Common_Credit_Card_Memscrapper : FILE
 {
 	meta:
 		description = "Hunting rule for possible CC data memory scrapper"
 		author = "SBousseaden"
-		id = "f342535f-2236-5da0-8a4d-d7fecb7737b8"
+		id = "a515a2da-2057-5e49-8c61-770dd388ff91"
 		date = "2020-07-17"
 		modified = "2020-07-18"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_creditcard_memscrap.yara#L1-L28"
 		license_url = "N/A"
-		logic_hash = "983cc0c93dd19b32f729540dcc691b3a01ead8ed916e3ef5259456f5e25bd009"
+		logic_hash = "v1_sha256_983cc0c93dd19b32f729540dcc691b3a01ead8ed916e3ef5259456f5e25bd009"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -221140,7 +220883,7 @@ rule SBOUSSEADEN_Hunt_Common_Credit_Card_Memscrapper : FILE
 		$cc16 = "^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$"
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($cc*) and all of ($api*)
+		uint16( 0 ) == 0x5a4d and 1 of ( $cc* ) and all of ( $api* )
 }
 import "pe"
 
@@ -221149,13 +220892,13 @@ rule SBOUSSEADEN_Shad0W_Beacon : FILE
 	meta:
 		description = "Shad0w beacon default suspicous strings"
 		author = "SBousseaden"
-		id = "e725172d-dd07-5027-ac85-86d366881856"
+		id = "5c8ee640-4ab7-512e-b7d9-69f0dd2aa686"
 		date = "2020-06-04"
 		modified = "2020-06-05"
 		reference = "https://github.com/bats3c/shad0w"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w.yara#L3-L15"
 		license_url = "N/A"
-		logic_hash = "9ea7cf72da0d93f607f58b61cc0fb5f3f114d4454101c69b08c59e6b61353550"
+		logic_hash = "v1_sha256_9ea7cf72da0d93f607f58b61cc0fb5f3f114d4454101c69b08c59e6b61353550"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -221166,7 +220909,7 @@ rule SBOUSSEADEN_Shad0W_Beacon : FILE
 		$s3 = "Policy"
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and pe.sections[0].name=="XPU0" and pe.imports("winhttp.dll","WinHttpOpen")
+		uint16( 0 ) == 0x5a4d and all of ( $s* ) and pe.sections [ 0 ] . name == "XPU0" and pe.imports ( "winhttp.dll" , "WinHttpOpen" )
 }
 import "pe"
 
@@ -221175,13 +220918,13 @@ rule SBOUSSEADEN_Susp_Winsvc_Upx : FILE
 	meta:
 		description = "broad hunt for any PE exporting ServiceMain API and upx packed"
 		author = "SBousseaden"
-		id = "883691fe-3858-5177-97ca-122ff2ec54af"
+		id = "4edbda1d-bfa4-5347-8837-1888cd606334"
 		date = "2019-01-28"
 		modified = "2020-06-05"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/susp_winsvc_upx.yara#L3-L13"
 		license_url = "N/A"
-		logic_hash = "85b1932eaab4e559f0805aa76ad9b58553708391b3ac894a8e4f1cf34470dcb7"
+		logic_hash = "v1_sha256_85b1932eaab4e559f0805aa76ad9b58553708391b3ac894a8e4f1cf34470dcb7"
 		score = 65
 		quality = 75
 		tags = "FILE"
@@ -221192,20 +220935,20 @@ rule SBOUSSEADEN_Susp_Winsvc_Upx : FILE
 		$upx_sig = "UPX!"
 
 	condition:
-		uint16(0)==0x5a4d and $upx1 in (0..1024) and $upx2 in (0..1024) and $upx_sig in (0..1024) and pe.exports("ServiceMain")
+		uint16( 0 ) == 0x5a4d and $upx1 in ( 0 .. 1024 ) and $upx2 in ( 0 .. 1024 ) and $upx_sig in ( 0 .. 1024 ) and pe.exports ( "ServiceMain" )
 }
 rule SBOUSSEADEN_TDL_Loader_Bootstrap_Shellcode : FILE
 {
 	meta:
 		description = "No description has been set in the source file - SBousseaden"
 		author = "SBousseaden"
-		id = "a2adedef-ba38-599f-b52c-e2156aa5ef98"
+		id = "ec42a3e5-6fd7-53c6-8177-1828775cbdf9"
 		date = "2020-10-10"
 		modified = "2020-10-10"
 		reference = "https://github.com/hfiref0x/TDL"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/tdl_loader_bootstrat_shellcode.yara#L1-L9"
 		license_url = "N/A"
-		logic_hash = "14a993b415e330e284503c409ab66445c5e369a21ef0be37297d9c8946b5559b"
+		logic_hash = "v1_sha256_14a993b415e330e284503c409ab66445c5e369a21ef0be37297d9c8946b5559b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -221215,20 +220958,20 @@ rule SBOUSSEADEN_TDL_Loader_Bootstrap_Shellcode : FILE
 		$shc2 = {41 B8 54 64 6C 53 4C 63 73 3C 4C 03 F3 45 8B 7E 50 41 8D 97 00 10 00 00 41 FF D1 45 33 C9}
 
 	condition:
-		uint16(0)==0x5a4d and any of ($shc*)
+		uint16( 0 ) == 0x5a4d and any of ( $shc* )
 }
 rule SBOUSSEADEN_Shad0W_Ldrloaddll_Hook : FILE
 {
 	meta:
 		description = "Shad0w beacon LdrLoadDll hook"
 		author = "SBousseaden"
-		id = "f9f75b96-2341-553f-b6ca-28d6cb9b880a"
+		id = "51236b90-d180-5e3d-afd7-d751254f1d53"
 		date = "2020-06-06"
 		modified = "2020-06-07"
 		reference = "https://github.com/bats3c/shad0w"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w_ldrhook.yara#L1-L13"
 		license_url = "N/A"
-		logic_hash = "28e8ca9eee2377fd816dd3bd29e05f4146cea975e0ba5ec180073e10a49895e0"
+		logic_hash = "v1_sha256_28e8ca9eee2377fd816dd3bd29e05f4146cea975e0ba5ec180073e10a49895e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -221240,7 +220983,7 @@ rule SBOUSSEADEN_Shad0W_Ldrloaddll_Hook : FILE
 		$s4 = {B8 49 BB DE AD C0}
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*)
+		uint16( 0 ) == 0x5a4d and all of ( $s* )
 }
 import "pe"
 
@@ -221249,13 +220992,13 @@ rule SBOUSSEADEN_Susp_Msoffice_Addins_Wxll : FILE
 	meta:
 		description = "hunt for suspicious MS Office Addins with code injection capabilities"
 		author = "SBousseaden"
-		id = "39d3b2af-f848-51c0-a13b-13c0fe3a79dd"
+		id = "4ab27ed2-ae38-5cda-a564-0c6576bc8089"
 		date = "2020-11-10"
 		modified = "2023-03-27"
 		reference = "https://twitter.com/JohnLaTwC/status/1315287078855352326"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_susp_msoffice_addins_wxll.yara#L3-L29"
 		license_url = "N/A"
-		logic_hash = "130a0292b16e934311597d4f91456e6a605477e306a7b1d8171cc4e13794db31"
+		logic_hash = "v1_sha256_130a0292b16e934311597d4f91456e6a605477e306a7b1d8171cc4e13794db31"
 		score = 65
 		quality = 75
 		tags = "FILE"
@@ -221281,20 +221024,20 @@ rule SBOUSSEADEN_Susp_Msoffice_Addins_Wxll : FILE
 		$inj18 = "RtlCreateUserThread"
 
 	condition:
-		uint16(0)==0x5a4d and (pe.exports("wdAutoOpen") or pe.exports("xlAutoOpen")) and 3 of ($inj*)
+		uint16( 0 ) == 0x5a4d and ( pe.exports ( "wdAutoOpen" ) or pe.exports ( "xlAutoOpen" ) ) and 3 of ( $inj* )
 }
 rule SBOUSSEADEN_APT_Xdsspy_Xdupload : FILE
 {
 	meta:
 		description = "No description has been set in the source file - SBousseaden"
 		author = "SBousseaden"
-		id = "ae38d017-6420-596c-af29-62f15cfe56b8"
+		id = "ec56abdf-353a-5eca-b234-fa920b668d66"
 		date = "2020-05-10"
 		modified = "2020-10-05"
 		reference = "https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/apt_xdspy_xdupload.yara#L1-L11"
 		license_url = "N/A"
-		logic_hash = "648ea81d1b44d8514439683cf2f86a8027f9e1eb64abf76d42347fc2ce9c4e68"
+		logic_hash = "v1_sha256_648ea81d1b44d8514439683cf2f86a8027f9e1eb64abf76d42347fc2ce9c4e68"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -221305,14 +221048,14 @@ rule SBOUSSEADEN_APT_Xdsspy_Xdupload : FILE
 		$s3 = "cmd.exe /u /c del" wide
 
 	condition:
-		uint16(0)==0x5a4d and 2 of ($s*)
+		uint16( 0 ) == 0x5a4d and 2 of ( $s* )
 }
 rule SBOUSSEADEN_Hunt_Slub_Backdoor : FILE
 {
 	meta:
 		description = "No description has been set in the source file - SBousseaden"
 		author = "SBousseaden"
-		id = "c15d5f14-d17f-528b-bf85-e06a5e23518c"
+		id = "5efb7960-db6f-5c9d-9490-df59e00f278c"
 		date = "2020-10-22"
 		modified = "2020-10-22"
 		reference = "https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-kitsune.pdf"
@@ -221322,7 +221065,7 @@ rule SBOUSSEADEN_Hunt_Slub_Backdoor : FILE
 		hash = "59e4510b7b15011d67eb2f80484589f7211e67756906a87ce466a7bb68f2095b"
 		hash = "c7788c015244e12e4c8cc69a2b1344d589284c84102c2f1871bbb4f4c32c2936"
 		hash = "6678a5964db74d477b39bd0a8c18adf02844bed8b112c7bcca6984032918bdfb"
-		logic_hash = "aa17dcfde1e2227ff04bda708d4c40c1e1f07b404d2c43582632d83c98d65e83"
+		logic_hash = "v1_sha256_aa17dcfde1e2227ff04bda708d4c40c1e1f07b404d2c43582632d83c98d65e83"
 		score = 50
 		quality = 73
 		tags = "FILE"
@@ -221340,20 +221083,20 @@ rule SBOUSSEADEN_Hunt_Slub_Backdoor : FILE
 		$s10 = "goto del_two" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
 rule SBOUSSEADEN_Cve_2019_1458 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - SBousseaden"
 		author = "SBousseaden"
-		id = "7bcbfccb-2db0-5438-9ed1-eee4c92710b6"
+		id = "beb61edf-a1ac-5130-9557-f57a12c77bfc"
 		date = "2020-10-23"
 		modified = "2020-10-23"
 		reference = "https://github.com/unamer/CVE-2019-1458"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_cve_2019_1458.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "8c5eac6b9fb9f87e0ffb219f0af8f83475799e062ed339da7a0525180292f5f2"
+		logic_hash = "v1_sha256_8c5eac6b9fb9f87e0ffb219f0af8f83475799e062ed339da7a0525180292f5f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -221376,20 +221119,20 @@ rule SBOUSSEADEN_Cve_2019_1458 : FILE
 		$s16 = "IsMenu"
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SBOUSSEADEN_Mem_Webcreds_Regexp_Xor
 {
 	meta:
 		description = "No description has been set in the source file - SBousseaden"
 		author = "SBousseaden"
-		id = "38087b99-5f64-58c0-b3dc-51c7981912e7"
+		id = "3ac2971d-619b-5bb7-a9a6-ffd06e0f98d1"
 		date = "2020-03-08"
 		modified = "2020-12-28"
 		reference = "https://github.com/orlyjamie/mimikittenz/blob/master/Invoke-mimikittenz.ps1"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L3-L22"
 		license_url = "N/A"
-		logic_hash = "0ecc15dd51807ccd1c35b5a6152aa16714d8a14889524163a421f79becd6a775"
+		logic_hash = "v1_sha256_0ecc15dd51807ccd1c35b5a6152aa16714d8a14889524163a421f79becd6a775"
 		score = 60
 		quality = 45
 		tags = ""
@@ -221409,20 +221152,20 @@ rule SBOUSSEADEN_Mem_Webcreds_Regexp_Xor
 		$reg = ".{1," xor
 
 	condition:
-		3 of ($p*) and 3 of ($u*) and #reg>3
+		3 of ( $p* ) and 3 of ( $u* ) and #reg > 3
 }
 rule SBOUSSEADEN_Webcreds_Regexp_B64
 {
 	meta:
 		description = "No description has been set in the source file - SBousseaden"
 		author = "SBousseaden"
-		id = "85283a81-5bc3-5e3f-89f6-bcc1f40f3dc2"
+		id = "20ac2adc-b36a-5e7e-8049-34da45796dcc"
 		date = "2020-03-08"
 		modified = "2020-12-28"
 		reference = "https://github.com/orlyjamie/mimikittenz/blob/master/Invoke-mimikittenz.ps1"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L24-L43"
 		license_url = "N/A"
-		logic_hash = "432c812177a50c50d08feb88a1293ecb625b9b0aa6a839789da150255bc83228"
+		logic_hash = "v1_sha256_432c812177a50c50d08feb88a1293ecb625b9b0aa6a839789da150255bc83228"
 		score = 75
 		quality = 75
 		tags = ""
@@ -221442,20 +221185,20 @@ rule SBOUSSEADEN_Webcreds_Regexp_B64
 		$reg = ".{1,"
 
 	condition:
-		3 of ($p*) and 3 of ($u*) and #reg>3
+		3 of ( $p* ) and 3 of ( $u* ) and #reg > 3
 }
 rule SBOUSSEADEN_Adsync_Creddump_Wide
 {
 	meta:
 		description = "AD Connect Sync Credential Extract"
 		author = "SBousseaden"
-		id = "ccbfa79a-924b-512a-a9e9-005567b4fe83"
+		id = "01f73156-ef6d-5272-9a42-8d60550b0582"
 		date = "2020-04-08"
 		modified = "2020-12-28"
 		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L45-L67"
 		license_url = "N/A"
-		logic_hash = "e8b0ff1fa9117a98799239d37c5a0ae8be25c2c2519c4fc2a1d7f085a9ebe2e1"
+		logic_hash = "v1_sha256_e8b0ff1fa9117a98799239d37c5a0ae8be25c2c2519c4fc2a1d7f085a9ebe2e1"
 		score = 75
 		quality = 75
 		tags = ""
@@ -221483,13 +221226,13 @@ rule SBOUSSEADEN_Adsync_Creddump_Xor
 	meta:
 		description = "Azure AdSync Service Account Password Dumping"
 		author = "SBousseaden"
-		id = "e0d951ec-ec39-5f37-b5a8-ddd0b1dc588d"
+		id = "8fc06aa5-31b2-5433-9802-58d9dcb32cc0"
 		date = "2020-03-08"
 		modified = "2020-12-28"
 		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L69-L89"
 		license_url = "N/A"
-		logic_hash = "831ed0410000ad9dfa7be2ab1f64a4130810465cf699bb3e45c93075db6fdb74"
+		logic_hash = "v1_sha256_831ed0410000ad9dfa7be2ab1f64a4130810465cf699bb3e45c93075db6fdb74"
 		score = 75
 		quality = 75
 		tags = ""
@@ -221509,20 +221252,20 @@ rule SBOUSSEADEN_Adsync_Creddump_Xor
 		$b6 = "forest-login-domain" xor
 
 	condition:
-		4 of ($a*) or 4 of ($b*)
+		4 of ( $a* ) or 4 of ( $b* )
 }
 rule SBOUSSEADEN_Adsync_Creddump_V64
 {
 	meta:
 		description = "Azure AdSync Service Account Password Dumping"
 		author = "SBousseaden"
-		id = "9f536ff2-95b6-5f93-8c6f-e3738d6404c7"
+		id = "8f8fc081-b78b-5f93-a5f2-5cbe04d88404"
 		date = "2020-03-08"
 		modified = "2020-12-28"
 		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L91-L111"
 		license_url = "N/A"
-		logic_hash = "e2465fec6dd9384d5d7f31f1c0e7661f4fbd5e3f87a14abfcb9b0412985cb1d6"
+		logic_hash = "v1_sha256_e2465fec6dd9384d5d7f31f1c0e7661f4fbd5e3f87a14abfcb9b0412985cb1d6"
 		score = 75
 		quality = 75
 		tags = ""
@@ -221542,20 +221285,20 @@ rule SBOUSSEADEN_Adsync_Creddump_V64
 		$b6 = "forest-login-domain" base64
 
 	condition:
-		4 of ($a*) or 4 of ($b*)
+		4 of ( $a* ) or 4 of ( $b* )
 }
 rule SBOUSSEADEN_Adsync_Creddump_Xwide
 {
 	meta:
 		description = "Azure AdSync Service Account Password Dumping"
 		author = "SBousseaden"
-		id = "a8c3e60a-99b8-50c8-992c-fbe18499a615"
+		id = "b284980b-c019-567c-9259-889fb8773a40"
 		date = "2020-03-08"
 		modified = "2020-12-28"
 		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L112-L132"
 		license_url = "N/A"
-		logic_hash = "9015005494cb3cc52645a9c82f6179992942243a816b05273bc26f58ac70a2e0"
+		logic_hash = "v1_sha256_9015005494cb3cc52645a9c82f6179992942243a816b05273bc26f58ac70a2e0"
 		score = 75
 		quality = 75
 		tags = ""
@@ -221575,20 +221318,20 @@ rule SBOUSSEADEN_Adsync_Creddump_Xwide
 		$b6 = "forest-login-domain" wide xor
 
 	condition:
-		4 of ($a*) or 4 of ($b*)
+		4 of ( $a* ) or 4 of ( $b* )
 }
 rule SBOUSSEADEN_Hunt_Credaccess_Cloud
 {
 	meta:
 		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
 		author = "SBousseaden"
-		id = "a1916a13-ba08-57b4-8615-5ff08986e128"
+		id = "3df37d45-2e6e-5c3d-812c-a150dc4c7e87"
 		date = "2020-07-20"
 		modified = "2020-12-28"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L134-L150"
 		license_url = "N/A"
-		logic_hash = "09814a4bb118b5015936943c8585475fd88e0b49d08587fedeeb2c0b4d7ab979"
+		logic_hash = "v1_sha256_09814a4bb118b5015936943c8585475fd88e0b49d08587fedeeb2c0b4d7ab979"
 		score = 50
 		quality = 75
 		tags = ""
@@ -221612,13 +221355,13 @@ rule SBOUSSEADEN_Hunt_Credaccess_Cloud_Wide_Xor
 	meta:
 		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
 		author = "SBousseaden"
-		id = "8e48151c-8a9b-57b1-8464-5be28afc347b"
+		id = "e46bb8bf-a274-5b66-a064-bbb35f612865"
 		date = "2020-07-20"
 		modified = "2020-12-28"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L152-L168"
 		license_url = "N/A"
-		logic_hash = "0625fc019eeeac8c219fa997c5957b69e5073c82d5cb1b880a5c1f7295ba2b7a"
+		logic_hash = "v1_sha256_0625fc019eeeac8c219fa997c5957b69e5073c82d5cb1b880a5c1f7295ba2b7a"
 		score = 50
 		quality = 75
 		tags = ""
@@ -221642,13 +221385,13 @@ rule SBOUSSEADEN_Hunt_Credaccess_Cloud_Base64
 	meta:
 		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
 		author = "SBousseaden"
-		id = "34460cb1-acf4-53e7-9c95-f69824a87836"
+		id = "bf05b5cc-69bc-5050-b5ad-446f6a609111"
 		date = "2020-07-20"
 		modified = "2020-12-28"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L170-L186"
 		license_url = "N/A"
-		logic_hash = "bf0acdc6e72e3528a93709b99f40aa13b45d9a3d22d8373d54414cc9be49d4d0"
+		logic_hash = "v1_sha256_bf0acdc6e72e3528a93709b99f40aa13b45d9a3d22d8373d54414cc9be49d4d0"
 		score = 50
 		quality = 75
 		tags = ""
@@ -221672,13 +221415,13 @@ rule SBOUSSEADEN_Hunt_Credaccess_Cloud_Wide_Base64
 	meta:
 		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
 		author = "SBousseaden"
-		id = "5c9a77b6-612b-5d5d-926c-833e49f8020e"
+		id = "024805cd-4b4a-5067-b9b4-db6db66ef154"
 		date = "2020-07-20"
 		modified = "2020-12-28"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L188-L204"
 		license_url = "N/A"
-		logic_hash = "1dd7aba89ddef2d18807bef77abd106a74f2e339e1e3bbd102c2edee14ffcf6f"
+		logic_hash = "v1_sha256_1dd7aba89ddef2d18807bef77abd106a74f2e339e1e3bbd102c2edee14ffcf6f"
 		score = 50
 		quality = 75
 		tags = ""
@@ -221702,13 +221445,13 @@ rule SBOUSSEADEN_Hunt_Credaccess_Iis
 	meta:
 		description = "hunt for strings related to iis credential access"
 		author = "SBousseaden"
-		id = "0edfb8a5-83ab-5d6f-b8c9-7d3e03a6e32a"
+		id = "89b622d3-eda3-54d3-882d-d0e615e44522"
 		date = "2020-07-20"
 		modified = "2020-12-28"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L206-L219"
 		license_url = "N/A"
-		logic_hash = "b193e40e932d3168c826baaa070b2484e7e4781a481ab911a9526f9bc23d24a1"
+		logic_hash = "v1_sha256_b193e40e932d3168c826baaa070b2484e7e4781a481ab911a9526f9bc23d24a1"
 		score = 50
 		quality = 73
 		tags = ""
@@ -221722,20 +221465,20 @@ rule SBOUSSEADEN_Hunt_Credaccess_Iis
 		$b2 = "/text:password"
 
 	condition:
-		( all of ($a*) or all of ($b*))
+		( all of ( $a* ) or all of ( $b* ) )
 }
 rule SBOUSSEADEN_Hunt_Credaccess_Iis_Xor
 {
 	meta:
 		description = "hunt for strings related to iis credential access"
 		author = "SBousseaden"
-		id = "ed5dd469-cf08-5eb1-bfde-36460c10197b"
+		id = "b36e0315-f6d6-5584-b334-8999a0c9ec50"
 		date = "2020-07-20"
 		modified = "2020-12-28"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L221-L234"
 		license_url = "N/A"
-		logic_hash = "58c316238cacfbfd5a539d6dbae9bc31836c414d5179ca5c40aa2cfae6c69655"
+		logic_hash = "v1_sha256_58c316238cacfbfd5a539d6dbae9bc31836c414d5179ca5c40aa2cfae6c69655"
 		score = 60
 		quality = 45
 		tags = ""
@@ -221749,20 +221492,20 @@ rule SBOUSSEADEN_Hunt_Credaccess_Iis_Xor
 		$b2 = "/text:password" wide xor
 
 	condition:
-		( all of ($a*) or all of ($b*))
+		( all of ( $a* ) or all of ( $b* ) )
 }
 rule SBOUSSEADEN_Hunt_Credaccess_Iis_Base64
 {
 	meta:
 		description = "hunt for strings related to iis credential access"
 		author = "SBousseaden"
-		id = "3a6b41b1-5a6a-536e-ac99-fb45ec460767"
+		id = "f5429241-6096-5da1-ae7e-4dcf91562ef8"
 		date = "2020-07-20"
 		modified = "2020-12-28"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L236-L249"
 		license_url = "N/A"
-		logic_hash = "b09c4cfaefeae28cb9381ae7b94ef970f10a6a265a3e40766d2a8c109b2df054"
+		logic_hash = "v1_sha256_b09c4cfaefeae28cb9381ae7b94ef970f10a6a265a3e40766d2a8c109b2df054"
 		score = 50
 		quality = 75
 		tags = ""
@@ -221776,20 +221519,20 @@ rule SBOUSSEADEN_Hunt_Credaccess_Iis_Base64
 		$b2 = "/text:password" base64
 
 	condition:
-		(3 of ($a*) or all of ($b*))
+		(3 of ( $a* ) or all of ( $b* ) )
 }
 rule SBOUSSEADEN_Hunt_Credaccess_Iis_Wide_Base64
 {
 	meta:
 		description = "hunt for strings related to iis credential access"
 		author = "SBousseaden"
-		id = "9e709338-2b61-53b6-99b4-36b52991bc27"
+		id = "19fc69bb-3963-5e16-a2f4-123f75735180"
 		date = "2020-07-20"
 		modified = "2020-12-28"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L251-L264"
 		license_url = "N/A"
-		logic_hash = "6b06ef3a19fc4ce4d6a3f23815ac411094574cf15bfcc18d675017c7e357d1cf"
+		logic_hash = "v1_sha256_6b06ef3a19fc4ce4d6a3f23815ac411094574cf15bfcc18d675017c7e357d1cf"
 		score = 50
 		quality = 75
 		tags = ""
@@ -221803,20 +221546,20 @@ rule SBOUSSEADEN_Hunt_Credaccess_Iis_Wide_Base64
 		$b2 = "/text:password" wide base64
 
 	condition:
-		(3 of ($a*) or all of ($b*))
+		(3 of ( $a* ) or all of ( $b* ) )
 }
 rule SBOUSSEADEN_Hunt_Teamviewer_Registry_Pwddump : CVE_2019_18988 FILE
 {
 	meta:
 		description = "cve-2019-18988 - decryption of AES 128 bits encrypted TV config pwds saved in TV registry hive"
 		author = "SBousseaden"
-		id = "b2240cda-a37a-572e-b915-be39cbaabaaf"
+		id = "819ce25a-1e11-5cf9-a2bf-bb98487e0180"
 		date = "2020-07-23"
 		modified = "2020-12-28"
 		reference = "https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L266-L286"
 		license_url = "N/A"
-		logic_hash = "a0cb06e06904e98e963798fddc28e2a7cf8b737a50ff7d380e7f871c78ed9479"
+		logic_hash = "v1_sha256_a0cb06e06904e98e963798fddc28e2a7cf8b737a50ff7d380e7f871c78ed9479"
 		score = 50
 		quality = 63
 		tags = "CVE-2019-18988, FILE"
@@ -221834,7 +221577,7 @@ rule SBOUSSEADEN_Hunt_Teamviewer_Registry_Pwddump : CVE_2019_18988 FILE
 		$p6 = "PermanentPassword" nocase wide
 
 	condition:
-		any of ($key*) and any of ($iv*) and 2 of ($p*) and filesize <700KB
+		any of ( $key* ) and any of ( $iv* ) and 2 of ( $p* ) and filesize < 700KB
 }
 import "pe"
 
@@ -221843,32 +221586,32 @@ rule SBOUSSEADEN_Hunt_Dllhijack_Wow64Log : FILE
 	meta:
 		description = "broad hunt for non MS wow64log module"
 		author = "SBousseaden"
-		id = "1d01917f-0690-5ede-947a-90fc86c03c38"
+		id = "33d4d58f-0e36-50f4-9fe0-6bcc5c0d4ffb"
 		date = "2020-06-05"
 		modified = "2020-06-05"
 		reference = "http://waleedassar.blogspot.com/2013/01/wow64logdll.html"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/wow64log.yara#L3-L13"
 		license_url = "N/A"
-		logic_hash = "e8ec491fe579b7e57b7e9078515a9628cfc2e0f3645882b9a352ff28a2fcb817"
+		logic_hash = "v1_sha256_e8ec491fe579b7e57b7e9078515a9628cfc2e0f3645882b9a352ff28a2fcb817"
 		score = 50
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and (pe.exports("Wow64LogInitialize") or pe.exports("Wow64LogMessageArgList") or pe.exports("Wow64LogSystemService") or pe.exports("Wow64LogTerminate"))
+		uint16( 0 ) == 0x5a4d and ( pe.exports ( "Wow64LogInitialize" ) or pe.exports ( "Wow64LogMessageArgList" ) or pe.exports ( "Wow64LogSystemService" ) or pe.exports ( "Wow64LogTerminate" ) )
 }
 rule SBOUSSEADEN_Dcsync_Mimikatz : FILE
 {
 	meta:
 		description = "Hunting rule for Mimikatz Implementation of DCSync Attack"
 		author = "SBousseaden"
-		id = "2d5d5fdb-8a84-5e88-b136-4e3e788c46cd"
+		id = "9baa93f8-06db-5f9e-8cdb-053de852e6b3"
 		date = "2020-09-22"
 		modified = "2020-09-22"
 		reference = "https://github.com/gentilkiwi/mimikatz"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_mimikatz_dcsync.yara#L1-L24"
 		license_url = "N/A"
-		logic_hash = "436979d794b7b599f2186252c7f233f091100880c2d39008d8bd7f839553fb53"
+		logic_hash = "v1_sha256_436979d794b7b599f2186252c7f233f091100880c2d39008d8bd7f839553fb53"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -221891,20 +221634,20 @@ rule SBOUSSEADEN_Dcsync_Mimikatz : FILE
 		$def2 = "mimikatz" wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($DRS*) or all of ($DRSW*)) and all of ($rpc*) and not ( any of ($def*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $DRS* ) or all of ( $DRSW* ) ) and all of ( $rpc* ) and not ( any of ( $def* ) )
 }
 rule SBOUSSEADEN_Hunt_Evtmutehook_Memory
 {
 	meta:
 		description = "memory hunt for default wevtsv EtwEventCallback hook pattern to apply to eventlog svchost memory dump"
 		author = "SBousseaden"
-		id = "5326581e-90d9-59b9-8dc5-74df97571600"
+		id = "c4c32b8b-e1c8-5ff0-a5ab-3fdfd00cf84f"
 		date = "2020-09-05"
 		modified = "2020-09-05"
 		reference = "https://blog.dylan.codes/pwning-windows-event-logging/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_memory_evtmutehook.yara#L1-L11"
 		license_url = "N/A"
-		logic_hash = "3db66069ed67d90031a6fe071dad4d0200ddd661b263dd2860df026673031e48"
+		logic_hash = "v1_sha256_3db66069ed67d90031a6fe071dad4d0200ddd661b263dd2860df026673031e48"
 		score = 50
 		quality = 75
 		tags = ""
@@ -221921,13 +221664,13 @@ rule SBOUSSEADEN_Hunt_Procinj_Instrumentationcallback : FILE
 	meta:
 		description = "hunt for possible injection with Instrumentation Callback PE"
 		author = "SBousseaden"
-		id = "f450bf71-d848-540e-b700-c046662f1cbc"
+		id = "24398247-2907-56e1-8c34-baad7a6bbff8"
 		date = "2020-07-25"
 		modified = "2020-07-25"
 		reference = "https://movaxbx.ru/2020/07/24/weaponizing-mapping-injection-with-instrumentation-callback-for-stealthier-process-injection/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_procinj_instrcallback.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "b33dae550bae9508b9fd5b2d6cabf1d4d928792d3988af23cdba34d9d3d03162"
+		logic_hash = "v1_sha256_b33dae550bae9508b9fd5b2d6cabf1d4d928792d3988af23cdba34d9d3d03162"
 		score = 50
 		quality = 71
 		tags = "FILE"
@@ -221947,20 +221690,20 @@ rule SBOUSSEADEN_Hunt_Procinj_Instrumentationcallback : FILE
 		$ss3 = {49 89 CA 0F 05 C3}
 
 	condition:
-		uint16(0)==0x5a4d and $picb and 1 of ($mv*) and 1 of ($spi*) and 1 of ($ss*)
+		uint16( 0 ) == 0x5a4d and $picb and 1 of ( $mv* ) and 1 of ( $spi* ) and 1 of ( $ss* )
 }
 rule SBOUSSEADEN_Hunt_Susp_Vhd : FILE
 {
 	meta:
 		description = "Virtual hard disk file with embedded PE"
 		author = "SBousseaden"
-		id = "14b082b2-c5cd-5f34-85e9-5987650eaacd"
+		id = "bba4c86e-0710-566b-9c70-83629105411a"
 		date = "2020-07-13"
 		modified = "2020-07-13"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_susp_vhd.yara#L1-L12"
 		license_url = "N/A"
-		logic_hash = "4ba2e3f533942b27c1d235be4677afdac774b558429c414043a8e3a609123ad3"
+		logic_hash = "v1_sha256_4ba2e3f533942b27c1d235be4677afdac774b558429c414043a8e3a609123ad3"
 		score = 65
 		quality = 73
 		tags = "FILE"
@@ -221972,7 +221715,7 @@ rule SBOUSSEADEN_Hunt_Susp_Vhd : FILE
 		$s3 = "!This program cannot be run in DOS mode." xor
 
 	condition:
-		$hvhd at 0 and any of ($s*) and filesize <=10MB
+		$hvhd at 0 and any of ( $s* ) and filesize <= 10MB
 }
 import "pe"
 
@@ -221981,13 +221724,13 @@ rule SBOUSSEADEN_Maliciousdllgenerator : FILE
 	meta:
 		description = "MaliciousDLLGenerator default decoder and export name"
 		author = "SBousseaden"
-		id = "a5f4d0b2-ef40-5e69-935e-208464944487"
+		id = "210a39a3-8442-5b46-ac10-2988abe6b974"
 		date = "2020-06-07"
 		modified = "2020-06-08"
 		reference = "https://github.com/Mr-Un1k0d3r/MaliciousDLLGenerator"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/MaliciousDLLGenerator.yara#L3-L12"
 		license_url = "N/A"
-		logic_hash = "70976f4a7043f52277a1d436c1725b2583383880d7158c74c4d93f3e603708c7"
+		logic_hash = "v1_sha256_70976f4a7043f52277a1d436c1725b2583383880d7158c74c4d93f3e603708c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -221996,7 +221739,7 @@ rule SBOUSSEADEN_Maliciousdllgenerator : FILE
 		$decoder = {E8 00 00 00 00 5B 48 31 C0 48 89 C1 B1 80 48 83 C3 11 48 F7 14 CB E2 FA 48 83 C3 08 53 C3}
 
 	condition:
-		uint16(0)==0x5a4d and $decoder and pe.exports("Init") and pe.number_of_exports==2
+		uint16( 0 ) == 0x5a4d and $decoder and pe.exports ( "Init" ) and pe.number_of_exports == 2
 }
 import "pe"
 
@@ -222005,13 +221748,13 @@ rule SBOUSSEADEN_Gosliver
 	meta:
 		description = "No description has been set in the source file - SBousseaden"
 		author = "SBousseaden"
-		id = "eba5043a-ca4d-5c5d-a895-51218b03e59e"
+		id = "fa299fbc-11dc-5544-86c7-c456fd6f50a2"
 		date = "2020-10-11"
 		modified = "2020-10-11"
 		reference = "https://github.com/BishopFox/sliver"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_sliver_go_framwwork.yara#L2-L9"
 		license_url = "N/A"
-		logic_hash = "8dc96e533adc29c78a998d9f064ff294d2ef8a4ff00cef8b0c81ef465ef70b08"
+		logic_hash = "v1_sha256_8dc96e533adc29c78a998d9f064ff294d2ef8a4ff00cef8b0c81ef465ef70b08"
 		score = 75
 		quality = 75
 		tags = ""
@@ -222020,20 +221763,20 @@ rule SBOUSSEADEN_Gosliver
 		$go = "_cgo_"
 
 	condition:
-		#go>10 and pe.exports("RunSliver")
+		#go> 10 and pe.exports ( "RunSliver" )
 }
 rule SBOUSSEADEN_Mimikatz_Kiwikey
 {
 	meta:
 		description = "hunt for default mimikatz kiwikey"
 		author = "SBousseaden"
-		id = "3141e679-6e07-5017-9675-4557fb876ebc"
+		id = "7849ba37-46bc-5625-b1d8-d6421e1480e6"
 		date = "2020-08-08"
 		modified = "2020-08-09"
 		reference = "https://github.com/sbousseaden/YaraHunts/"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/kiwikey.yara#L1-L10"
 		license_url = "N/A"
-		logic_hash = "03745aed838dafad2fc6e190f181141bda31c212af56edb8ba665b86671f8bee"
+		logic_hash = "v1_sha256_03745aed838dafad2fc6e190f181141bda31c212af56edb8ba665b86671f8bee"
 		score = 75
 		quality = 75
 		tags = ""
@@ -222043,20 +221786,20 @@ rule SBOUSSEADEN_Mimikatz_Kiwikey
 		$B = {48 B8 ?? ?? ?? ?? ?? ?? ?? ?? FF D0}
 
 	condition:
-		$A and #B>10
+		$A and #B > 10
 }
 rule SBOUSSEADEN_Shad0W_Beacon_16June : FILE
 {
 	meta:
 		description = "Shad0w beacon compressed"
 		author = "SBousseaden"
-		id = "1229e84f-bf6e-5e87-9351-a48cd50397b0"
+		id = "e9f1417d-69e3-589f-8adb-e9a00f4a3918"
 		date = "2020-06-16"
 		modified = "2020-06-17"
 		reference = "https://github.com/bats3c/shad0w"
 		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w_beacon_16June.yara#L1-L13"
 		license_url = "N/A"
-		logic_hash = "c313e995d6eaae6d2ee63964f6fc94964065af7a61d7f304280d914e6f0dd548"
+		logic_hash = "v1_sha256_c313e995d6eaae6d2ee63964f6fc94964065af7a61d7f304280d914e6f0dd548"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -222068,13 +221811,13 @@ rule SBOUSSEADEN_Shad0W_Beacon_16June : FILE
 		$s4 = "GetProcAddress"
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*)
+		uint16( 0 ) == 0x5a4d and all of ( $s* )
 }
 /*
  * YARA Rule Set
  * Repository Name: Elceef
  * Repository: https://github.com/elceef/yara-rulz
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 05834717d1464d5efce8ad9d688ff7b53886a0bb
  * Number of Rules: 17
  * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -222110,13 +221853,13 @@ rule ELCEEF_Obfuscated_IP_Address_In_URL
 	meta:
 		description = "Detects hexadecimal and octal IP address representations in URL"
 		author = "marcin@ulikowski.pl"
-		id = "f2ebf5f7-5446-5eaa-8e30-90d08b8616d9"
+		id = "a0eb25d7-9515-5a64-b550-a68e8e969762"
 		date = "2020-09-17"
 		modified = "2024-03-04"
 		reference = "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/evasive-urls-in-spam/"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Obfuscated_IPAddr_URL.yara#L1-L17"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "ab2a2a3a56e6eed9f4a3a8f994c89a167f00b86ce442820c81d8ee673b0ab85c"
+		logic_hash = "v1_sha256_ab2a2a3a56e6eed9f4a3a8f994c89a167f00b86ce442820c81d8ee673b0ab85c"
 		score = 75
 		quality = 65
 		tags = ""
@@ -222135,13 +221878,13 @@ rule ELCEEF_Base64_SVG_Javascript
 	meta:
 		description = "Detects base64 encoded SVG objects containing Javascript"
 		author = "marcin@ulikowski.pl"
-		id = "99275772-1f4f-5616-9a9c-f76b613fe143"
+		id = "962489d0-b83f-5733-ac59-1926dd2bb389"
 		date = "2022-10-25"
 		modified = "2022-12-12"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Base64_SVG_Javascript.yara#L1-L16"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "e4cb08ccc75dc00b518c4ee1495409ae6bb99e7d493be55312b8d39aa9099cfc"
+		logic_hash = "v1_sha256_e4cb08ccc75dc00b518c4ee1495409ae6bb99e7d493be55312b8d39aa9099cfc"
 		score = 75
 		quality = 75
 		tags = ""
@@ -222160,13 +221903,13 @@ rule ELCEEF_HTML_Smuggling_A : T1027 FILE
 	meta:
 		description = "Generic detection for HTML smuggling (T1027.006)"
 		author = "marcin@ulikowski.pl"
-		id = "b711318f-81d2-5d0b-968f-04ae18fdea5b"
+		id = "457bd8eb-8686-56d3-827e-a8288d96b789"
 		date = "2021-05-13"
 		modified = "2023-04-16"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Smuggling.yara#L1-L31"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "bc076e9f3d4c6d2aa5a3602436408e5b2ac3140ca9f7cc776c44835cba211951"
+		logic_hash = "v1_sha256_bc076e9f3d4c6d2aa5a3602436408e5b2ac3140ca9f7cc776c44835cba211951"
 		score = 75
 		quality = 75
 		tags = "T1027, FILE"
@@ -222189,20 +221932,20 @@ rule ELCEEF_HTML_Smuggling_A : T1027 FILE
 		$jsxor = { 2e 63 68 61 72 43 6f 64 65 41 74 28 [1-10] 29 ( 5e | 20 5e ) }
 
 	condition:
-		filesize <5MB and ($mssave or (#element==1 and #objecturl==1 and #download==1 and #click==1)) and $blob and $array and $atob and (#ole2+#pe32+#iso+#udf+#zip+#jsxor)==1
+		filesize < 5MB and ( $mssave or ( #element == 1 and #objecturl == 1 and #download == 1 and #click == 1 ) ) and $blob and $array and $atob and ( #ole2 + #pe32 + #iso + #udf + #zip + #jsxor ) == 1
 }
 rule ELCEEF_HTML_Smuggling_B : T1027 FILE
 {
 	meta:
 		description = "Generic detection for HTML smuggling (T1027.006)"
 		author = "marcin@ulikowski.pl"
-		id = "640d70c2-f1fc-5e32-a720-ebc92839ec40"
+		id = "f99cd5db-b0b7-58c7-8665-3a3ad2ecbb17"
 		date = "2022-12-02"
 		modified = "2023-04-16"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Smuggling.yara#L33-L60"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "3c42e6f715bd5476aea4d47e9f6431747ddf7c7c8098840560201e2c21723eeb"
+		logic_hash = "v1_sha256_3c42e6f715bd5476aea4d47e9f6431747ddf7c7c8098840560201e2c21723eeb"
 		score = 75
 		quality = 75
 		tags = "T1027, FILE"
@@ -222222,20 +221965,20 @@ rule ELCEEF_HTML_Smuggling_B : T1027 FILE
 		$jsxor = { 2e 63 68 61 72 43 6f 64 65 41 74 28 [1-10] 29 ( 5e | 20 5e ) }
 
 	condition:
-		filesize <5MB and $atob and #objecturl==1 and #file==1 and #blob==1 and #array==1 and (#ole2+#pe32+#iso+#udf+#zip+#jsxor)==1
+		filesize < 5MB and $atob and #objecturl == 1 and #file == 1 and #blob == 1 and #array == 1 and ( #ole2 + #pe32 + #iso + #udf + #zip + #jsxor ) == 1
 }
 rule ELCEEF_HTML_Smuggling_C : T1027 FILE
 {
 	meta:
 		description = "Generic detection for HTML smuggling (T1027.006)"
 		author = "marcin@ulikowski.pl"
-		id = "ea1eafad-905b-571e-a016-8774e65bd976"
+		id = "08b82a07-cdcd-552c-9f8e-b0b8d8301dda"
 		date = "2023-04-17"
 		modified = "2023-04-17"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Smuggling.yara#L62-L82"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "83409b0b173980975f6349e448e72fe1b2115fc7dbdec8ee7ad1826a65db17d3"
+		logic_hash = "v1_sha256_83409b0b173980975f6349e448e72fe1b2115fc7dbdec8ee7ad1826a65db17d3"
 		score = 75
 		quality = 75
 		tags = "T1027, FILE"
@@ -222250,20 +221993,20 @@ rule ELCEEF_HTML_Smuggling_C : T1027 FILE
 		$loop = { ?? 5b 69 5d ( 3d | 20 3d | 3d 20 | 20 3d 20 ) ?? 5b 69 5d ( 2d | 20 2d | 2d 20 | 20 2d 20 ) 3? 3b }
 
 	condition:
-		filesize <5MB and $mssave and #blob==1 and #array==1 and #loop==1
+		filesize < 5MB and $mssave and #blob == 1 and #array == 1 and #loop == 1
 }
 rule ELCEEF_OLE2_Autoopen_Reversed_Payload : FILE
 {
 	meta:
 		description = "Detects suspiciously reversed payloads in OLE2 objects with auto-open macros"
 		author = "marcin@ulikowski.pl"
-		id = "9244fdb7-9949-58a0-9e39-e61e04cc1574"
+		id = "a728cbda-8476-595f-ad3c-08378c4019e2"
 		date = "2021-12-01"
 		modified = "2023-04-04"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/OLE2_Reversed.yara#L1-L20"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "425750e77d31ddc356f803ee6e2f192f93f64534a9633fef02da5caaa60dbcaf"
+		logic_hash = "v1_sha256_425750e77d31ddc356f803ee6e2f192f93f64534a9633fef02da5caaa60dbcaf"
 		score = 65
 		quality = 67
 		tags = "FILE"
@@ -222275,20 +222018,20 @@ rule ELCEEF_OLE2_Autoopen_Reversed_Payload : FILE
 		$windows = /\\swodniW\\\\?:C/ wide ascii nocase
 
 	condition:
-		filesize <1MB and uint32be(0)==0xd0cf11e0 and $auto_open and any of ($http,$programdata,$windows)
+		filesize < 1MB and uint32be( 0 ) == 0xd0cf11e0 and $auto_open and any of ( $http , $programdata , $windows )
 }
 rule ELCEEF_Suspicious_SFX : FILE
 {
 	meta:
 		description = "Detects self-extracting archives (SFX) executing cmd.exe or powershell.exe"
 		author = "marcin@ulikowski.pl"
-		id = "78f4ae8b-ba17-5c02-a6f0-66bec873aba8"
+		id = "4eddc90f-014b-5461-b81b-16ede0c0fc3c"
 		date = "2023-04-04"
 		modified = "2023-04-04"
 		reference = "https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_SFX.yara#L1-L22"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "688ed356e2fa936a0e07a8479591c28fb457053ed94351bad4bf367b02f04b0a"
+		logic_hash = "v1_sha256_688ed356e2fa936a0e07a8479591c28fb457053ed94351bad4bf367b02f04b0a"
 		score = 65
 		quality = 73
 		tags = "FILE"
@@ -222301,20 +222044,20 @@ rule ELCEEF_Suspicious_SFX : FILE
 		$silent = "\nSilent=1"
 
 	condition:
-		filesize <1MB and uint16be(0)==0x4d5a and any of ($zip,$rar) and any of ($setup_*) and $silent
+		filesize < 1MB and uint16be( 0 ) == 0x4d5a and any of ( $zip , $rar ) and any of ( $setup_* ) and $silent
 }
 rule ELCEEF_HTML_Windows_Search_Abuse
 {
 	meta:
 		description = "Detects HTML files abusing Windows system functionalities to redirect and download malicious payloads"
 		author = "marcin@ulikowski.pl"
-		id = "537cb46e-4cfc-517c-8d6d-0019f2c3e5ef"
+		id = "ac53acf4-6f4c-5c3d-88b4-a19ca660c9ee"
 		date = "2024-06-15"
 		modified = "2024-06-16"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Windows_Search.yara#L1-L22"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "6a0d490cf08ab0aad3c535645abe9ebc26d12768cf2a2e932cdb7ec93cf3e2bd"
+		logic_hash = "v1_sha256_6a0d490cf08ab0aad3c535645abe9ebc26d12768cf2a2e932cdb7ec93cf3e2bd"
 		score = 75
 		quality = 73
 		tags = ""
@@ -222332,20 +222075,20 @@ rule ELCEEF_HTML_Windows_Search_Abuse
 		$crumb2 = "&amp;crumb=location:" wide ascii
 
 	condition:
-		( any of ($location*) or $metarefresh) and any of ($search*) and any of ($crumb*)
+		( any of ( $location* ) or $metarefresh ) and any of ( $search* ) and any of ( $crumb* )
 }
 rule ELCEEF_Winrar_CVE_2023_38831_Exploit : CVE_2023_38831 FILE
 {
 	meta:
 		description = "Detects ZIP archives exploiting CVE-2023-38831 in WinRAR"
 		author = "marcin@ulikowski.pl"
-		id = "7d592eb7-b344-59ed-adf8-fe69ebb1e43f"
+		id = "39f38d0d-1af5-580d-a341-b8e74bda00ca"
 		date = "2023-09-23"
 		modified = "2023-09-28"
 		reference = "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/WinRAR_CVE_2023_38831.yara#L1-L17"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "06f1d807429fb175831cf333b05b44b6ce33b4ae981e16c03e36ec7564a4fdd1"
+		logic_hash = "v1_sha256_06f1d807429fb175831cf333b05b44b6ce33b4ae981e16c03e36ec7564a4fdd1"
 		score = 75
 		quality = 75
 		tags = "CVE-2023-38831, FILE"
@@ -222356,20 +222099,20 @@ rule ELCEEF_Winrar_CVE_2023_38831_Exploit : CVE_2023_38831 FILE
 		$ = { 50 4b 03 04 [24] 00 00 [3-64] 2e ?? ?? ?? 20 2f [3-64] 2e ?? ?? ?? 20 2e ( 626174 | 636d64 | 707331 ) }
 
 	condition:
-		uint16be(0)==0x504b and all of them
+		uint16be( 0 ) == 0x504b and all of them
 }
 rule ELCEEF_EICAR_Encrypted_ZIP
 {
 	meta:
 		description = "Detects EICAR file in any encrypted ZIP archive"
 		author = "marcin@ulikowski.pl"
-		id = "c12d42de-356a-584b-9c48-71e65940f1cf"
+		id = "1240f186-9db2-565f-84a1-e4f8631798cf"
 		date = "2022-12-13"
 		modified = "2022-12-16"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/EICAR_Encrypted_ZIP.yara#L14-L44"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "56851056671bde38338bd200d9fde59c042f35a2cd84ac9401e716f376c9502c"
+		logic_hash = "v1_sha256_56851056671bde38338bd200d9fde59c042f35a2cd84ac9401e716f376c9502c"
 		score = 75
 		quality = 75
 		tags = ""
@@ -222388,20 +222131,20 @@ rule ELCEEF_EICAR_Encrypted_ZIP
 			}
 
 	condition:
-		for any i in (1..#local) : (( uint8(@local[i]+6)&0x01 or uint8(@local[i]+6)&0x40) and uint32(@local[i]+14)==0x6851cf3c and uint32(@local[i]+22)==68)
+		for any i in ( 1 .. #local ) : ( ( uint8( @local [ i ] + 6 ) & 0x01 or uint8( @local [ i ] + 6 ) & 0x40 ) and uint32( @local [ i ] + 14 ) == 0x6851cf3c and uint32( @local [ i ] + 22 ) == 68 )
 }
 rule ELCEEF_BAT_Obfuscated_Setenv
 {
 	meta:
 		description = "Detects batch script with obfuscated SET command located directly after @echo off"
 		author = "marcin@ulikowski.pl"
-		id = "999d192e-a792-5953-b9e2-de4b298444d3"
+		id = "8f24ce35-fd4b-5cb0-9820-c4eeb681aaf4"
 		date = "2023-05-01"
 		modified = "2023-05-05"
 		reference = "https://twitter.com/wdormann/status/1651631372438585344"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L1-L20"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "da3a2245207d79cb720079cc2bc88d5f9db22fc16601d21e7c8dcea381ed11e9"
+		logic_hash = "v1_sha256_da3a2245207d79cb720079cc2bc88d5f9db22fc16601d21e7c8dcea381ed11e9"
 		score = 75
 		quality = 75
 		tags = ""
@@ -222415,20 +222158,20 @@ rule ELCEEF_BAT_Obfuscated_Setenv
 		$s2 = { 40 65 63 68 6f 20 6f 66 66 0d 0a 73 65 74 20 22 [4] 3d 73 65 74 20 22 0d 0a 25 }
 
 	condition:
-		$s1 in (0..4) or $s2 in (0..4)
+		$s1 in ( 0 .. 4 ) or $s2 in ( 0 .. 4 )
 }
 rule ELCEEF_BAT_Chunked_Payload_Setenv
 {
 	meta:
 		description = "Detects batch script storing chunks of payload in random environment variables"
 		author = "marcin@ulikowski.pl"
-		id = "18f3ddac-bc19-5b54-891e-93271d59490a"
+		id = "e52ffe28-5429-53ba-8d9c-ddd3d00e6903"
 		date = "2023-05-05"
 		modified = "2024-04-10"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L22-L37"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "6b202d1a5723db664c7ca689c73fc1f84365801fd56fc9a035c8d3a0b6b2b9da"
+		logic_hash = "v1_sha256_6b202d1a5723db664c7ca689c73fc1f84365801fd56fc9a035c8d3a0b6b2b9da"
 		score = 75
 		quality = 75
 		tags = ""
@@ -222439,20 +222182,20 @@ rule ELCEEF_BAT_Chunked_Payload_Setenv
 		$set = { ( 0d 0a | 26 20 ) 73 65 74 20 22 [10] 3d [2-6] 22 }
 
 	condition:
-		$echo in (0..4) and #set>10
+		$echo in ( 0 .. 4 ) and #set > 10
 }
 rule ELCEEF_BAT_Begin_Substring_Env
 {
 	meta:
 		description = "Detects suspicious substring syntax at the begining of batch script"
 		author = "marcin@ulikowski.pl"
-		id = "3fca187b-d2e7-595c-9330-25141a54285b"
+		id = "ca3b032b-f0a2-5f1c-a8f9-fda473ec9c08"
 		date = "2023-06-02"
 		modified = "2024-04-10"
 		reference = "https://cybersecurity.att.com/blogs/labs-research/seroxen-rat-for-sale"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L39-L55"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "cc5e6e511bbc0a5cbb277ed0cbac1f2b21db8e21c4cdc802b6a1c3313d3b55cc"
+		logic_hash = "v1_sha256_cc5e6e511bbc0a5cbb277ed0cbac1f2b21db8e21c4cdc802b6a1c3313d3b55cc"
 		score = 65
 		quality = 75
 		tags = ""
@@ -222463,20 +222206,20 @@ rule ELCEEF_BAT_Begin_Substring_Env
 		$substr = { 3a 7e ( 3? 2c 3? | 2d 3? 2c 3? | 3? 2c 2d 3? | 3? 3? 2c 3? | 2d 3? 3? 2c 3? | 3? 3? 2c 2d 3? ) 25 }
 
 	condition:
-		$echo in (0..4) and $substr in (10..100)
+		$echo in ( 0 .. 4 ) and $substr in ( 10 .. 100 )
 }
 rule ELCEEF_Polymorph_BAT_CAB : FILE
 {
 	meta:
 		description = "Detects polymorphic BAT/CAB files self-extracting payload with extrac32.exe/extract.exe"
 		author = "marcin@ulikowski.pl"
-		id = "10a46120-beaf-5443-bc35-c6d9ef065bb4"
+		id = "1397c822-7bf0-5244-bac9-66131e370b36"
 		date = "2024-04-10"
 		modified = "2024-04-10"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L57-L72"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "d29d488b0ebcfb485818c181ac674e3586aa1a41ab68185a1f1d3e49295ffbce"
+		logic_hash = "v1_sha256_d29d488b0ebcfb485818c181ac674e3586aa1a41ab68185a1f1d3e49295ffbce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -222486,20 +222229,20 @@ rule ELCEEF_Polymorph_BAT_CAB : FILE
 		$extract = { 65 78 74 72 61 63 ( 33 32 | 74 ) 20 2f 79 20 22 25 7e 66 30 22 }
 
 	condition:
-		uint32be(0)==0x4d534346 and uint32(16)>80 and $extract in (48..80)
+		uint32be( 0 ) == 0x4d534346 and uint32( 16 ) > 80 and $extract in ( 48 .. 80 )
 }
 rule ELCEEF_HTA_Wscriptshell_Onenote : FILE
 {
 	meta:
 		description = "Detects suspicious OneNote documents with embedded HTA + WScript.Shell"
 		author = "marcin@ulikowski.pl"
-		id = "8cebd862-8dfb-5f5d-befb-5c41cde945ff"
+		id = "7ee9ca40-5a4a-5d99-bb08-813429d2b2a4"
 		date = "2023-02-01"
 		modified = "2023-02-02"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTA_OneNote.yara#L1-L17"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "0287ac5d618c9a8332d167f1a05157aa829c7e8a052c35100fcaeb644d452e5c"
+		logic_hash = "v1_sha256_0287ac5d618c9a8332d167f1a05157aa829c7e8a052c35100fcaeb644d452e5c"
 		score = 65
 		quality = 75
 		tags = "FILE"
@@ -222511,20 +222254,20 @@ rule ELCEEF_HTA_Wscriptshell_Onenote : FILE
 		$wsh = "CreateObject(\"WScript.Shell\")"
 
 	condition:
-		filesize <5MB and $magic at 8 and $wsh and $hta
+		filesize < 5MB and $magic at 8 and $wsh and $hta
 }
 rule ELCEEF_Suspicious_Onenote
 {
 	meta:
 		description = "Detects OneNote documents with FileDataStoreObject structure containing: PE32, shortcut files (*.lnk), encoded JS, Windows Help File (*.chm), or batch script"
 		author = "marcin@ulikowski.pl"
-		id = "57f6fc7f-666f-5887-ac97-513588415757"
+		id = "66abec5b-2467-5306-bd56-d8a38c0ac249"
 		date = "2023-01-22"
 		modified = "2023-02-21"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_OneNote.yara#L1-L23"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "b65f0976b71c1e827ecce09f0c435d9ffa6a5d3b3a41401efc6a14b6259af4ad"
+		logic_hash = "v1_sha256_b65f0976b71c1e827ecce09f0c435d9ffa6a5d3b3a41401efc6a14b6259af4ad"
 		score = 65
 		quality = 75
 		tags = ""
@@ -222543,20 +222286,20 @@ rule ELCEEF_Suspicious_Onenote
 		$fdso_chm = { a4 c4 8d 4d 0b 7a 9e ac [20] 49 54 53 46 03 }
 
 	condition:
-		$magic at 8 and 1 of ($fdso_*)
+		$magic at 8 and 1 of ( $fdso_* )
 }
 rule ELCEEF_ZIP_High_Ratio_Single_Doc : FILE
 {
 	meta:
 		description = "Detects ZIP archives containing single MS Word document with unusually high compression ratio"
 		author = "marcin@ulikowski.pl"
-		id = "0fbe89d9-1bf5-50a9-b6c1-1d739162a2ba"
+		id = "e1e9708d-e85e-5bd8-9c2e-bc0ab70e4907"
 		date = "2023-03-08"
 		modified = "2023-03-08"
 		reference = "https://github.com/elceef/yara-rulz"
 		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/ZIP_High_Ratio_Single_Doc.yara#L8-L27"
 		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "470300b8d6356cff43a1e2be3a23a97be5d1e2ce5a76f2fb2eccdbbb47a4d327"
+		logic_hash = "v1_sha256_470300b8d6356cff43a1e2be3a23a97be5d1e2ce5a76f2fb2eccdbbb47a4d327"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -222568,284 +222311,13 @@ rule ELCEEF_ZIP_High_Ratio_Single_Doc : FILE
 		$ext = ".doc"
 
 	condition:
-		filesize <1MB and $magic at 0 and #magic==1 and uint32(22)>1024*1024*100 and $ext at ( uint16(26)+26)
-}
-/*
- * YARA Rule Set
- * Repository Name: GodModeRules
- * Repository: https://github.com/Neo23x0/god-mode-rules/
- * Retrieval Date: 2024-12-08
- * Git Commit: 436dc682164cf17a123d6b09d1424e7e2acf0c25
- * Number of Rules: 1
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- *                                  Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
- */
-rule GODMODERULES_IDDQD_God_Mode_Rule
-{
-	meta:
-		description = "Detects a wide array of cyber threats, from malware and ransomware to advanced persistent threats (APTs)"
-		author = "Florian Roth"
-		id = "cb16ab74-1452-5898-b819-4346fea28c69"
-		date = "2019-05-15"
-		modified = "2024-01-12"
-		reference = "Internal Research - get a god mode rule set with THOR by Nextron Systems"
-		source_url = "https://github.com/Neo23x0/god-mode-rules//blob/436dc682164cf17a123d6b09d1424e7e2acf0c25/godmode.yar#L24-L69"
-		license_url = "https://github.com/Neo23x0/god-mode-rules//blob/436dc682164cf17a123d6b09d1424e7e2acf0c25/LICENSE"
-		logic_hash = "f2996ad7090a79c470e64c9e0ac43c2ba3fc1bf18e39686ecda9dc5b89744d7e"
-		score = 60
-		quality = 46
-		tags = ""
-		importance = 60
-
-	strings:
-		$ = "sekurlsa::logonpasswords" ascii wide nocase
-		$ = "ERROR kuhl" wide xor
-		$ = " -w hidden " ascii wide nocase
-		$ = "Koadic." ascii
-		$ = "ReflectiveLoader" fullword ascii wide xor
-		$ = "%s as %s\\%s: %d" ascii xor
-		$ = "[System.Convert]::FromBase64String(" ascii
-		$ = "/meterpreter/" ascii xor
-		$ = / -[eE][decoman]{0,41} ['"]?(JAB|SUVYI|aWV4I|SQBFAFgA|aQBlAHgA|cgBlAG)/ ascii wide
-		$ = /  (sEt|SEt|SeT|sET|seT)  / ascii wide
-		$ = ");iex " nocase ascii wide
-		$ = "Nir Sofer" fullword wide
-		$ = "impacket." ascii
-		$ = /\[[\+\-!E]\] (exploit|target|vulnerab|shell|inject)/ nocase
-		$ = "0000FEEDACDC}" ascii wide
-		$ = "vssadmin delete shadows" ascii nocase
-		$ = ".exe delete shadows" ascii nocase
-		$ = " shadowcopy delete" ascii wide nocase
-		$ = " delete catalog -quiet" ascii wide nocase
-		$ = "stratum+tcp://" ascii wide
-		$ = /\\(Debug|Release)\\(Key[lL]og|[Ii]nject|Steal|By[Pp]ass|Amsi|Dropper|Loader|CVE\-)/
-		$ = /(Dropper|Bypass|Injection|Potato)\.pdb/ nocase
-		$ = "Mozilla/5.0" xor(0x01-0xff) ascii wide
-		$ = "amsi.dllATVSH" ascii xor
-		$ = "BeaconJitter" xor
-		$ = "main.Merlin" ascii fullword
-		$ = "\x48\x83\xec\x50\x4d\x63\x68\x3c\x48\x89\x4d\x10" xor
-		$ = "}{0}\"-f " ascii wide
-		$ = "HISTORY=/dev/null" ascii
-		$ = " /tmp/x;" ascii
-		$ = /comsvcs(\.dll)?[, ]{1,2}(MiniDump|#24)/
-		$ = "AmsiScanBuffer" base64 base64wide
-		$ = "AmsiScanBuffer" xor(0x01-0xff)
-		$ = "%%%%%%%%%%%######%%%#%%####%  &%%**#" ascii wide xor
-
-	condition:
-		1 of them
+		filesize < 1MB and $magic at 0 and #magic == 1 and uint32( 22 ) > 1024 * 1024 * 100 and $ext at ( uint16( 26 ) + 26 )
 }
 /*
  * YARA Rule Set
  * Repository Name: Cod3nym
  * Repository: https://github.com/cod3nym/detection-rules/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: ad485bff0ce30afb56e367b7f2b76fea81e78fc9
  * Number of Rules: 13
  * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -222898,14 +222370,14 @@ rule COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24 : FILE
 	meta:
 		description = "Detects indicators of shellcode loaders in .NET binaries"
 		author = "Jonathan Peters"
-		id = "606a444a-b894-5076-8d5e-1716bbfa588e"
+		id = "004a6481-a20d-5c5a-8f7a-cbb468b32757"
 		date = "2024-01-11"
 		modified = "2024-01-12"
 		reference = "https://github.com/Workingdaturah/Payload-Generator/tree/main"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/suspicious_indicators.yar#L1-L22"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "c48752a5b07b58596564f13301276dd5b700bd648a04af2e27d3f78512a06408"
-		logic_hash = "28267eb54a4108924df57512bbae9f47f51fd4860b3cf93c014d73b0d4b2dec2"
+		logic_hash = "v1_sha256_28267eb54a4108924df57512bbae9f47f51fd4860b3cf93c014d73b0d4b2dec2"
 		score = 65
 		quality = 80
 		tags = "FILE"
@@ -222920,21 +222392,21 @@ rule COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24 : FILE
 		$x = "__StaticArrayInitTypeSize=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($sa*) and #x==1
+		uint16( 0 ) == 0x5a4d and 3 of ( $sa* ) and #x == 1
 }
 rule COD3NYM_SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24 : FILE
 {
 	meta:
 		description = "Detects .NET images obfuscated with Eazfuscator string encryption. Eazfuscator is a widely used commercial obfuscation solution used by both legitimate software and malware."
 		author = "Jonathan Peters"
-		id = "09a400f5-e837-58c2-9b51-9213c8ab0883"
+		id = "19c6b7b3-46d8-57ef-be21-1fe8ff9e0559"
 		date = "2024-01-01"
 		modified = "2024-01-03"
 		reference = "https://www.gapotchenko.com/eazfuscator.net"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_eazfuscator.yar#L1-L28"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "3a9ee09ed965e3aee677043ba42c7fdbece0150ef9d1382c518b4b96bbd0e442"
-		logic_hash = "5f3f3358e3cfb274aa2e8465dde58a080f9fb282aa519885b9d39429521db6d9"
+		logic_hash = "v1_sha256_5f3f3358e3cfb274aa2e8465dde58a080f9fb282aa519885b9d39429521db6d9"
 		score = 50
 		quality = 80
 		tags = "FILE"
@@ -222950,21 +222422,21 @@ rule COD3NYM_SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24 : FILE
 		$op4 = { 7B ?? 00 00 04 16 91 02 7B ?? 00 00 04 17 91 1E 62 60 02 7B ?? 00 00 04 18 91 1F 10 62 60 02 7B ?? 00 00 04 19 91 1F 18 62 60 }
 
 	condition:
-		uint16(0)==0x5a4d and all of ($sa*) and (2 of ($op*) or #op1==2)
+		uint16( 0 ) == 0x5a4d and all of ( $sa* ) and ( 2 of ( $op* ) or #op1 == 2 )
 }
 rule COD3NYM_SUSP_OBF_NET_Eazfuscator_Virtualization_Jan24 : FILE
 {
 	meta:
 		description = "Detects .NET images obfuscated with Eazfuscator virtualization protection. Eazfuscator is a widely used commercial obfuscation solution used by both legitimate software and malware."
 		author = "Jonathan Peters"
-		id = "d39bba65-1220-5b60-b919-1bd88f1bc7f1"
+		id = "0f40a18c-18e3-5390-a332-92a90c94aaf6"
 		date = "2024-01-02"
 		modified = "2024-01-03"
 		reference = "https://www.gapotchenko.com/eazfuscator.net"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_eazfuscator.yar#L30-L51"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "53d5c2574c7f70b7aa69243916acf6e43fe4258fbd015660032784e150b3b4fa"
-		logic_hash = "7a647973eae9163cb5b82c27141956da58f4a9fd2ad51cf82523b93536cfaea3"
+		logic_hash = "v1_sha256_7a647973eae9163cb5b82c27141956da58f4a9fd2ad51cf82523b93536cfaea3"
 		score = 60
 		quality = 80
 		tags = "FILE"
@@ -222978,21 +222450,21 @@ rule COD3NYM_SUSP_OBF_NET_Eazfuscator_Virtualization_Jan24 : FILE
 		$op3 = { 02 20 [4] 1F 09 73 [4] 7D [3] 04 }
 
 	condition:
-		uint16(0)==0x5a4d and all of ($sa*) and 2 of ($op*)
+		uint16( 0 ) == 0x5a4d and all of ( $sa* ) and 2 of ( $op* )
 }
 rule COD3NYM_SUSP_OBF_NET_Confuserex_Name_Pattern_Jan24 : FILE
 {
 	meta:
 		description = "Detects Naming Pattern used by ConfuserEx. ConfuserEx is a widely used open source obfuscator often found in malware"
 		author = "Jonathan Peters"
-		id = "2b57f135-9d9d-5401-be29-a1053f4249ec"
+		id = "367b4090-9684-51aa-9e50-b8a50884506c"
 		date = "2024-01-03"
 		modified = "2024-01-09"
 		reference = "https://github.com/yck1509/ConfuserEx/tree/master"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_confuserex.yar#L1-L21"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "2f67f590cabb9c79257d27b578d8bf9d1a278afa96b205ad2b4704e7b9a87ca7"
-		logic_hash = "f28f3bd61c6f257cc622f6f323a5b5113d7d7b79ce8b852df02c42af22ecf033"
+		logic_hash = "v1_sha256_f28f3bd61c6f257cc622f6f323a5b5113d7d7b79ce8b852df02c42af22ecf033"
 		score = 50
 		quality = 80
 		tags = "FILE"
@@ -223006,21 +222478,21 @@ rule COD3NYM_SUSP_OBF_NET_Confuserex_Name_Pattern_Jan24 : FILE
 		$name_pattern = { E2 ( 80 8? | 81 AA ) E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 80 AE}
 
 	condition:
-		uint16(0)==0x5a4d and 2 of ($s*) and #name_pattern>5
+		uint16( 0 ) == 0x5a4d and 2 of ( $s* ) and #name_pattern > 5
 }
 rule COD3NYM_SUSP_OBF_NET_Confuserex_Packer_Jan24 : FILE
 {
 	meta:
 		description = "Detects binaries packed with ConfuserEx compression packer. This feature compresses and encrypts the actual image into a stub that unpacks and loads the original image on runtime."
 		author = "Jonathan Peters"
-		id = "cd53a62f-62e3-58a1-8bc3-7f40949e3f00"
+		id = "d4d67d06-bb6f-58f1-af92-e7f39873975f"
 		date = "2024-01-09"
 		modified = "2024-01-09"
 		reference = "https://github.com/yck1509/ConfuserEx/tree/master"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_confuserex.yar#L23-L42"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "2570bd4c3f564a61d6b3d589126e0940af27715e1e8d95de7863579fbe25f86f"
-		logic_hash = "43aee4c01b47ca04ee516d418939ec3e90fd08566f2a4b501c4698b7f9e0225d"
+		logic_hash = "v1_sha256_43aee4c01b47ca04ee516d418939ec3e90fd08566f2a4b501c4698b7f9e0225d"
 		score = 70
 		quality = 80
 		tags = "FILE"
@@ -223033,7 +222505,7 @@ rule COD3NYM_SUSP_OBF_NET_Confuserex_Packer_Jan24 : FILE
 		$op3 = { 16 91 7E [3] 04 17 91 1E 62 60 7E [3] 04 18 91 1F 10 62 60 7E [3] 04 19 91 1F 18 62 }
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 2 of ($op*)
+		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 2 of ( $op* )
 }
 import "pe"
 
@@ -223042,13 +222514,13 @@ rule COD3NYM_DOTNET_Singlefilehost_Bundled_App : FILE
 	meta:
 		description = "Detects single file host .NET bundled apps."
 		author = "Jonathan Peters"
-		id = "061bd294-58d6-57be-b8b5-b8a8f31ce316"
+		id = "74c70d43-f709-5819-a818-06f8b8f2ef4f"
 		date = "2024-01-02"
 		modified = "2024-01-05"
 		reference = "https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/framework_identiciation.yar#L3-L17"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		logic_hash = "12075b07a9feb951898ac8eba303471d9253ed9535db927244e5562f4fad33d6"
+		logic_hash = "v1_sha256_12075b07a9feb951898ac8eba303471d9253ed9535db927244e5562f4fad33d6"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -223058,7 +222530,7 @@ rule COD3NYM_DOTNET_Singlefilehost_Bundled_App : FILE
 		$ = "singlefilehost.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them and pe.exports("DotNetRuntimeInfo") and pe.exports("CLRJitAttachState")
+		uint16( 0 ) == 0x5a4d and 1 of them and pe.exports ( "DotNetRuntimeInfo" ) and pe.exports ( "CLRJitAttachState" )
 }
 import "pe"
 
@@ -223067,14 +222539,14 @@ rule COD3NYM_SUSP_OBF_NET_Reactor_Native_Stub_Jan24
 	meta:
 		description = "Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc."
 		author = "Jonathan Peters"
-		id = "529dce88-a81d-5a98-aa6c-1f1b739ad074"
+		id = "2a09e111-2103-5f85-8d87-61954513707d"
 		date = "2024-01-05"
 		modified = "2024-01-12"
 		reference = "https://notes.netbytesec.com/2023/08/understand-ransomware-ttps-blackbit.html"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_net_reactor.yar#L3-L16"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "6e8a7adf680bede7b8429a18815c232004057607fdfbf0f4b0fb1deba71c5df7"
-		logic_hash = "287273babd3cd6bc1986b018367317019f2249851a2c19fc83857f7ff0b90b54"
+		logic_hash = "v1_sha256_287273babd3cd6bc1986b018367317019f2249851a2c19fc83857f7ff0b90b54"
 		score = 70
 		quality = 80
 		tags = ""
@@ -223083,23 +222555,21 @@ rule COD3NYM_SUSP_OBF_NET_Reactor_Native_Stub_Jan24
 		$op = {C6 44 24 18 E0 C6 44 24 19 3B C6 44 24 1A 8D C6 44 24 1B 2A C6 44 24 1C A2 C6 44 24 1D 2A C6 44 24 1E 2A C6 44 24 1F 41 C6 44 24 20 D3 C6 44 24 21 20 C6 44 24 22 64 C6 44 24 23 06 C6 44 24 24 8A C6 44 24 25 F7 C6 44 24 26 3D C6 44 24 27 9D C6 44 24 28 D9 C6 44 24 29 EE C6 44 24 2A 15 C6 44 24 2B 68 C6 44 24 2C F4 C6 44 24 2D 76 C6 44 24 2E B9 C6 44 24 2F 34 C6 44 24 30 BF C6 44 24 31 1E C6 44 24 32 E7 C6 44 24 33 78 C6 44 24 34 98 C6 44 24 35 E9 C6 44 24 36 6F C6 44 24 37 B4}
 
 	condition:
-		for any i in (0..pe.number_of_resources-1) : (pe.resources[i].name_string=="_\x00_\x00") and $op
+		for any i in ( 0 .. pe.number_of_resources - 1 ) : ( pe.resources [ i ] . name_string == "_\x00_\x00" ) and $op
 }
-import "pe"
-
 rule COD3NYM_SUSP_OBF_NET_Reactor_Indicators_Jan24 : FILE
 {
 	meta:
 		description = "Detects indicators of .NET Reactors managed obfuscation. Reactor is a commercial obfuscation solution, pirated versions are often abused by threat actors."
 		author = "Jonathan Peters"
-		id = "8dc07bbd-cbeb-5214-a27a-555a0d396197"
+		id = "9918de8b-8f06-5c7b-95b5-203b81dafe50"
 		date = "2024-01-09"
 		modified = "2024-01-12"
 		reference = "https://www.eziriz.com/dotnet_reactor.htm"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_net_reactor.yar#L18-L34"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "be842a9de19cfbf42ea5a94e3143d58390a1abd1e72ebfec5deeb8107dddf038"
-		logic_hash = "40a03eb487e2c02a032c4bfb51580dbb764e0a49ceee5ae92c54a5ee3ede9696"
+		logic_hash = "v1_sha256_40a03eb487e2c02a032c4bfb51580dbb764e0a49ceee5ae92c54a5ee3ede9696"
 		score = 65
 		quality = 80
 		tags = "FILE"
@@ -223110,21 +222580,21 @@ rule COD3NYM_SUSP_OBF_NET_Reactor_Indicators_Jan24 : FILE
 		$ = { 3C 4D 6F 64 75 6C 65 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D }
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
 rule COD3NYM_MAL_NET_Niximports_Loader_Jan24 : FILE
 {
 	meta:
 		description = "Detects open-source NixImports .NET malware loader. A stealthy loader using dynamic import resolving to evade static detection"
 		author = "Jonathan Peters"
-		id = "f36ad127-4c4b-5b7e-a13c-bfb9d222a438"
+		id = "bc49c84d-8ac4-5dae-9653-aff6690f30d3"
 		date = "2024-01-12"
 		modified = "2024-01-12"
 		reference = "https://github.com/dr4k0nia/NixImports/tree/master"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/mal/mal_net_niximports_loader.yar#L1-L22"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "dd3f22871879b0bc4990c96d1de957848c7ed0714635bb036c73d8a989fb0b39"
-		logic_hash = "e41d7f4cb46aa0baa87d3024e0550efe5058ca49d908bbd34197431c7c054e58"
+		logic_hash = "v1_sha256_e41d7f4cb46aa0baa87d3024e0550efe5058ca49d908bbd34197431c7c054e58"
 		score = 80
 		quality = 80
 		tags = "FILE"
@@ -223139,21 +222609,21 @@ rule COD3NYM_MAL_NET_Niximports_Loader_Jan24 : FILE
 		$sa3 = "netstandard" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($sa*) and 2 of ($op*)
+		uint16( 0 ) == 0x5a4d and all of ( $sa* ) and 2 of ( $op* )
 }
 rule COD3NYM_MAL_NET_Limecrypter_Runpe_Jan24 : FILE
 {
 	meta:
 		description = "Detects LimeCrypter RunPE module. LimeCrypter is an open source .NET based crypter and loader commonly used by threat actors"
 		author = "Jonathan Peters"
-		id = "06ecd638-0102-5762-b363-fdc390dda04b"
+		id = "26c333ec-867b-531e-9c20-a137846b7d35"
 		date = "2024-01-16"
 		modified = "2024-01-16"
 		reference = "https://github.com/NYAN-x-CAT/Lime-Crypter/tree/master"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/mal/mal_net_limecrypter_runpe.yar#L1-L22"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "bcc8c679acfc3aabf22ebdb2349b1fabd351a89fd23a716d85154049d352dd12"
-		logic_hash = "b01a68c60d62cf94ef16340316acb9b96d1e671c372559b86a8e6a5d8e80f7d9"
+		logic_hash = "v1_sha256_b01a68c60d62cf94ef16340316acb9b96d1e671c372559b86a8e6a5d8e80f7d9"
 		score = 80
 		quality = 80
 		tags = "FILE"
@@ -223167,21 +222637,21 @@ rule COD3NYM_MAL_NET_Limecrypter_Runpe_Jan24 : FILE
 		$s2 = "CommonAce" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 2 of ($op*)
+		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 2 of ( $op* )
 }
 rule COD3NYM_SUSP_Direct_Syscall_Shellcode_Invocation_Jan24 : FILE
 {
 	meta:
 		description = "Detects direct syscall evasion technqiue using NtProtectVirtualMemory to invoke shellcode"
 		author = "Jonathan Peters"
-		id = "2a0ce887-299d-5aad-bed3-3e698b4dea79"
+		id = "b4c909a6-2406-57ec-9fc8-63f9132ff24c"
 		date = "2024-01-14"
 		modified = "2024-01-14"
 		reference = "https://unprotect.it/technique/evasion-using-direct-syscalls/"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/other/susp_direct_syscall_shellcode_invocation.yar#L1-L14"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "f7cd214e7460c539d6f8d02b6650098e3983862ff658b76ea02c33f5a45fc836"
-		logic_hash = "b5b0ad86289a4e2af7cdc909192f4dc9325c1763259f40adcc1e60c088c9e4f3"
+		logic_hash = "v1_sha256_b5b0ad86289a4e2af7cdc909192f4dc9325c1763259f40adcc1e60c088c9e4f3"
 		score = 65
 		quality = 80
 		tags = "FILE"
@@ -223190,21 +222660,21 @@ rule COD3NYM_SUSP_Direct_Syscall_Shellcode_Invocation_Jan24 : FILE
 		$ = { B8 40 00 00 00 67 4C 8D 08 49 89 CA 48 C7 C0 50 00 00 00 0F 05 [4-8] 4C 8D 3D 02 00 00 00 FF E0 }
 
 	condition:
-		all of them and filesize <2MB
+		all of them and filesize < 2MB
 }
 rule COD3NYM_SUSP_OBF_Pyarmor_Jan24
 {
 	meta:
 		description = "Detects PyArmor python code obfuscation. PyArmor is used by various threat actors like BatLoader"
 		author = "Jonathan Peters"
-		id = "2627c764-57ed-5781-8c77-ad2d9f4bd0ee"
+		id = "9691acb1-c01b-5b82-b496-e0efff8fbc5f"
 		date = "2024-01-16"
 		modified = "2024-01-16"
 		reference = "https://www.trendmicro.com/en_us/research/23/h/batloader-campaigns-use-pyarmor-pro-for-evasion.html"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/other/susp_obf_pyarmor.yar#L1-L18"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "2727a418f31e8c0841f8c3e79455067798a1c11c2b83b5c74d2de4fb3476b654"
-		logic_hash = "6bbbe4c9ad54a1d1042b53803ca6011f3eaaeebbe864703e741c25a0d788342f"
+		logic_hash = "v1_sha256_6bbbe4c9ad54a1d1042b53803ca6011f3eaaeebbe864703e741c25a0d788342f"
 		score = 65
 		quality = 80
 		tags = ""
@@ -223224,14 +222694,14 @@ rule COD3NYM_SUSP_RLO_Exe_Extension_Spoofing_Jan24
 	meta:
 		description = "Detects Right-To-Left (RLO) Unicode (U+202E) extension spoofing for .exe files"
 		author = "Jonathan Peters"
-		id = "60c1a8db-6bfc-547b-98d9-21c198a703f0"
+		id = "86eed888-19dc-5e92-92d9-ae4ff0472991"
 		date = "2024-01-14"
 		modified = "2024-02-19"
 		reference = "https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/"
 		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/other/susp_rlo_exe_extension_spoofing.yar#L2-L58"
 		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
 		hash = "cae0ab10f7c1afd7941aff767a9b59901270e3de4d44167e932dae0991515487"
-		logic_hash = "6126f36b3cd695b4002c29c9163faa6ec295699863d8db7fe17afc407f5a5736"
+		logic_hash = "v1_sha256_6126f36b3cd695b4002c29c9163faa6ec295699863d8db7fe17afc407f5a5736"
 		score = 70
 		quality = 55
 		tags = ""
@@ -223289,7 +222759,7 @@ rule COD3NYM_SUSP_RLO_Exe_Extension_Spoofing_Jan24
  * YARA Rule Set
  * Repository Name: craiu
  * Repository: https://github.com/craiu/yararules
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 23cf0ca22021fa3684e180a18416b9ae1b695243
  * Number of Rules: 13
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -223978,7 +223448,7 @@ rule CRAIU_Crime_Noabot : FILE
 	meta:
 		description = "Noabot is a clone of Mirai"
 		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "8626783b-898c-587d-9b23-c8c9111cde66"
+		id = "d2cae1fc-2cda-5de2-85fa-946bcc821a06"
 		date = "2024-01-11"
 		modified = "2024-01-11"
 		reference = "https://www.akamai.com/blog/security-research/mirai-based-noabot-crypto-mining"
@@ -223991,7 +223461,7 @@ rule CRAIU_Crime_Noabot : FILE
 		hash = "829b3c298f7003f49986fb26920f7972e52982651ae6127c6e8e219a86f46890"
 		hash = "c723a221cff37a700e0e3b9dc5f69cdd6a4cc82502ac7c144d6ca1eaf963e800"
 		hash = "c8d3c0b87176b7f8d5667d479cb40d1b9f030d30afe588826254f26ebb4ac58e"
-		logic_hash = "51c63f45f891ee80c5e8428575f12cb5881665cb9fe26018d173335db0f02012"
+		logic_hash = "v1_sha256_51c63f45f891ee80c5e8428575f12cb5881665cb9fe26018d173335db0f02012"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -224013,20 +223483,20 @@ rule CRAIU_Crime_Noabot : FILE
 		$c2 = "SOCKET_CREATING_ERROR RECYCLE"
 
 	condition:
-		filesize <10MB and ( uint32(0)==0x464c457f) and (( any of ($a*)) or ( all of ($b*)) or ( all of ($c*)))
+		filesize < 10MB and ( uint32( 0 ) == 0x464c457f ) and ( ( any of ( $a* ) ) or ( all of ( $b* ) ) or ( all of ( $c* ) ) )
 }
 rule CRAIU_Susp_Ios_Shutdown
 {
 	meta:
 		description = "Detect shutdown.log files from sysdiags with suspicious entries"
 		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "08aa1fb9-7af0-515a-91a8-09ed35e48155"
+		id = "653c93c7-5e5a-5652-921d-eb39da145f63"
 		date = "2023-12-28"
 		modified = "2024-03-05"
 		reference = "https://securelist.com/shutdown-log-lightweight-ios-malware-detection-method/111734/"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/susp_ios_shutdown.yara#L2-L25"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "936101f2dddb73f6dda41be47d775199c458aa4fecdcf348ed479da620343ea1"
+		logic_hash = "v1_sha256_936101f2dddb73f6dda41be47d775199c458aa4fecdcf348ed479da620343ea1"
 		score = 65
 		quality = 85
 		tags = ""
@@ -224040,21 +223510,21 @@ rule CRAIU_Susp_Ios_Shutdown
 		$c1 = "After "
 
 	condition:
-		($c1 at 0) and $a1 and ( any of ($b*))
+		($c1 at 0 ) and $a1 and ( any of ( $b* ) )
 }
 rule CRAIU_Crime_Chaos_Ransomware_Gen : FILE
 {
 	meta:
 		description = "Chaos ransomware generic strings"
 		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "e909f7e4-50c2-54a6-8274-9ef92f95bf93"
+		id = "10b830e8-1026-5054-87d7-bbb6794d8e60"
 		date = "2024-05-27"
 		modified = "2024-05-28"
 		reference = "https://blog.sonicwall.com/en-us/2024/05/politically-charged-ransomware-weaponized-as-a-file-destroyer/"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_chaos_ransomware.yara#L2-L39"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
 		hash = "524a898e18999ceac864dbac5b85fa2f14392e389b3c32f77d58e2a89cdf01c4"
-		logic_hash = "7d2e1c9178d5bf360cebc90056bbdae6a11729b1b3c5e963c522a29fd7ba7a3e"
+		logic_hash = "v1_sha256_7d2e1c9178d5bf360cebc90056bbdae6a11729b1b3c5e963c522a29fd7ba7a3e"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -224076,14 +223546,14 @@ rule CRAIU_Crime_Chaos_Ransomware_Gen : FILE
 		$b11 = "\\Saved Games" ascii wide fullword
 
 	condition:
-		( filesize <9MB) and ( uint16(0)==0x5a4d) and ((3 of them ))
+		( filesize < 9MB ) and ( uint16( 0 ) == 0x5a4d ) and ( ( 3 of them ) )
 }
 rule CRAIU_Crime_Lockbit3_Ransomware : FILE
 {
 	meta:
 		description = "Generic LockBit detection, also catches the version used in attacks in Indonesia."
 		author = "Costin G. Raiu, TLPBLACK, craiu@noh.ro"
-		id = "167788a4-a610-5770-9f51-aa4cc4d3d350"
+		id = "ce2891c8-7950-5460-be54-dde17c17cf73"
 		date = "2024-07-03"
 		modified = "2024-07-03"
 		reference = "https://www.bleepingcomputer.com/news/security/meet-brain-cipher-the-new-ransomware-behind-indonesia-data-center-attack/"
@@ -224091,7 +223561,7 @@ rule CRAIU_Crime_Lockbit3_Ransomware : FILE
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
 		hash = "eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12"
 		hash = "6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417"
-		logic_hash = "84efb899315379d85a03959359f89fbcb97cbb6477f1ec439380a4d15fed4f53"
+		logic_hash = "v1_sha256_84efb899315379d85a03959359f89fbcb97cbb6477f1ec439380a4d15fed4f53"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -224106,20 +223576,20 @@ rule CRAIU_Crime_Lockbit3_Ransomware : FILE
 		$a6 = {5D 8BC3 5F 5E 5B 5D C20C00 90 55 8BEC 53 56 57 33C0 8B5D14 33C9 33D2 8B750C 8B7D08 85F6 }
 
 	condition:
-		( filesize <1MB) and ( uint16(0)==0x5a4d) and (2 of them )
+		( filesize < 1MB ) and ( uint16( 0 ) == 0x5a4d ) and ( 2 of them )
 }
 rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Dropperandmainpayload : KWAMPIRS
 {
 	meta:
 		description = "Kwampirs dropper and main payload components"
 		author = "Symantec"
-		id = "5a40a5e7-0b98-5f6e-a808-493676b57cda"
+		id = "636e7d03-adf9-5c8b-b9b7-545a5a6cb8e5"
 		date = "2018-04-23"
 		modified = "2020-03-31"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L2-L80"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "40e197f4278a2d14e8fe1359676558319e86728f7e61ddf612bcc894c311d53a"
+		logic_hash = "v1_sha256_40e197f4278a2d14e8fe1359676558319e86728f7e61ddf612bcc894c311d53a"
 		score = 75
 		quality = 85
 		tags = "KWAMPIRS"
@@ -224190,13 +223660,13 @@ rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon_Code : FILE
 	meta:
 		description = "Kwampirs and Shamoon common code"
 		author = "FBI / cywatch@fbi.gov"
-		id = "0d403b3b-a5a8-5ac6-a12d-7181a1ad11b3"
+		id = "f4988b6a-1785-59c3-9aaf-2e197da49dfc"
 		date = "2020-01-14"
 		modified = "2020-03-31"
 		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L85-L105"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "5ab949280be87d242ad2843dee001eee5a338e266ef52da55883f7c77e66cf5b"
+		logic_hash = "v1_sha256_5ab949280be87d242ad2843dee001eee5a338e266ef52da55883f7c77e66cf5b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -224210,20 +223680,20 @@ rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon_Code : FILE
 		01 5E C3 32 C0 5E C3 32 C0 C3 }
 
 	condition:
-		( uint16(0)==0x5a4d) and (1 of them )
+		( uint16( 0 ) == 0x5a4d ) and ( 1 of them )
 }
 rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Installer : FILE
 {
 	meta:
 		description = "Kwampirs installer xor keys and Unicode string length routine"
 		author = "FBI / cywatch@fbi.gov"
-		id = "8c80d0d5-8c65-5cef-ad86-b38f4d671bec"
+		id = "ecbe82f6-ba05-5492-88cf-1a0ffb766766"
 		date = "2020-01-14"
 		modified = "2020-03-31"
 		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L109-L127"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "ac9c3ba7188cbbe736ff81b41086fdc874ac24ae83d3cec390907f8edd0a0ce5"
+		logic_hash = "v1_sha256_ac9c3ba7188cbbe736ff81b41086fdc874ac24ae83d3cec390907f8edd0a0ce5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -224235,20 +223705,20 @@ rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Installer : FILE
 		$strlenW = { 33 C0 85 C9 74 17 80 3C 41 00 75 07 80 7C 41 01 00 74 0A 3D 00 94 35 77 73 03 40 EB E9 C3}
 
 	condition:
-		(( uint16(0)==0x5a4d) and (2 of them ))
+		(( uint16( 0 ) == 0x5a4d ) and ( 2 of them ) )
 }
 rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Implant : FILE
 {
 	meta:
 		description = "Kwampirs implant xor and rsa keys"
 		author = "FBI / cywatch@fbi.gov"
-		id = "d1c1ab0e-e07d-5f0e-97e8-5aee53ab620e"
+		id = "e654762a-8d07-5911-8e9f-69e463e1bac6"
 		date = "2020-01-14"
 		modified = "2020-03-31"
 		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L130-L177"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "a9559c17c802c6060799d0a1ee96d68bd521475dd12ff6040a74874cabe3a9a9"
+		logic_hash = "v1_sha256_a9559c17c802c6060799d0a1ee96d68bd521475dd12ff6040a74874cabe3a9a9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -224290,20 +223760,20 @@ rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Implant : FILE
                         26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF F7 E4 0C B3 }
 
 	condition:
-		(( uint16(0)==0x5a4d) and (2 of them ))
+		(( uint16( 0 ) == 0x5a4d ) and ( 2 of them ) )
 }
 rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon : FILE
 {
 	meta:
 		description = "Kwampirs Shamoon overlap"
 		author = "FBI / cywatch@fbi.gov"
-		id = "87d28867-383e-5e09-8369-63c8a4e3f966"
+		id = "3f41e2b8-9276-5997-8b94-48013aa1c725"
 		date = "2020-01-14"
 		modified = "2020-03-31"
 		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L200-L221"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "43f352c3db016d2831d11a13ae6c0baf440fa464560090e00432780df6a8982d"
+		logic_hash = "v1_sha256_43f352c3db016d2831d11a13ae6c0baf440fa464560090e00432780df6a8982d"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -224317,14 +223787,14 @@ rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon : FILE
 		$op3 = { 74 0a 3d 00 94 35 77 }
 
 	condition:
-		(( uint16(0)==0x5a4d) and ( filesize <4000KB) and (3 of them ))
+		(( uint16( 0 ) == 0x5a4d ) and ( filesize < 4000KB ) and ( 3 of them ) )
 }
 rule CRAIU_Unk_Liblzma_Backdoor : FILE
 {
 	meta:
 		description = "liblzma backdoored"
 		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "3527227b-e19f-5704-8a56-f7d318890658"
+		id = "4ded5723-5bd2-5ac5-99dd-f79352a9897d"
 		date = "2024-03-30"
 		modified = "2024-03-30"
 		reference = "https://seclists.org/oss-sec/2024/q1/268"
@@ -224334,7 +223804,7 @@ rule CRAIU_Unk_Liblzma_Backdoor : FILE
 		hash = "319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae"
 		hash = "b418bfd34aa246b2e7b5cb5d263a640e5d080810f767370c4d2c24662a274963"
 		hash = "cbeef92e67bf41ca9c015557d81f39adaba67ca9fb3574139754999030b83537"
-		logic_hash = "ac58a38bff3020dbc881a78b70cf18279644cf6f3ede8d652be3f345ba00974f"
+		logic_hash = "v1_sha256_ac58a38bff3020dbc881a78b70cf18279644cf6f3ede8d652be3f345ba00974f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -224345,20 +223815,20 @@ rule CRAIU_Unk_Liblzma_Backdoor : FILE
 		$a2 = {48 BF 30 30 30 30 30 30 30 30 8B F1 49 89 D1 89 43 28 48 89 3C 24 BF 3F FC FF 03}
 
 	condition:
-		( uint32be(0)==0x7F454C46) and ( filesize <10MB) and ( any of them )
+		( uint32be( 0 ) == 0x7F454C46 ) and ( filesize < 10MB ) and ( any of them )
 }
 rule CRAIU_Unk_Liblzma_Encstrings : FILE
 {
 	meta:
 		description = "liblzma backdoor, encoded strings"
 		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "ca491b9c-400e-5f5e-9372-e403a095edba"
+		id = "c26e974b-a429-58cb-b9a9-5c7df8164ddd"
 		date = "2024-03-30"
 		modified = "2024-03-30"
 		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L32-L70"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "99f5c82f941bb5c1f908209e108f9f80a835ad84157a383faa0dde502486dbd3"
+		logic_hash = "v1_sha256_99f5c82f941bb5c1f908209e108f9f80a835ad84157a383faa0dde502486dbd3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -224385,21 +223855,21 @@ rule CRAIU_Unk_Liblzma_Encstrings : FILE
               B3 01 00 00 A2 00 00 00 53 00 00 00 B3 00 00 00 C2 01 00 00 D3 01 00 00 03 00 00 00 22 00 00 00 63 00 00 00 12 00 00 00 }
 
 	condition:
-		( filesize <15MB) and ( any of them )
+		( filesize < 15MB ) and ( any of them )
 }
 rule CRAIU_Crashstrike : FILE
 {
 	meta:
 		description = "Crowdstrike C-00000???-*.sys files"
 		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "9a5168c4-0a7f-5269-bafa-728f123a04c5"
+		id = "db1451e6-bcac-5108-a96e-9973c5242067"
 		date = "2024-07-19"
 		modified = "2024-07-19"
 		reference = "https://en.wikipedia.org/wiki/July_2024_global_cyber_outages"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/20240719_crashstrike.yara#L2-L26"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
 		hash = "9d001ef3206fe2f955095244e6103ad7f8f318c7c5cbd91a0dd1f33e4217fcb2"
-		logic_hash = "9a8dacf9d95042851073c40f5eab2a6aff61be3a576363ffcd8c21aaec7f0b96"
+		logic_hash = "v1_sha256_9a8dacf9d95042851073c40f5eab2a6aff61be3a576363ffcd8c21aaec7f0b96"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -224410,21 +223880,21 @@ rule CRAIU_Crashstrike : FILE
 		$a2 = "AbCDEfghIjklMNoPqrstuV"
 
 	condition:
-		( filesize <60KB) and ( uint32(0)==0xaaaaaaaa) and ( all of them )
+		( filesize < 60KB ) and ( uint32( 0 ) == 0xaaaaaaaa ) and ( all of them )
 }
 rule CRAIU_Exploit_CVE_2024_6387 : CVE_2024_6387 FILE
 {
 	meta:
 		description = "Strings from CVE-2024-6387 exploit PoC by zgzhang."
 		author = "Costin G. Raiu, TLPBLACK, craiu@noh.ro"
-		id = "6ac63016-864d-57af-bb36-3115a0a91021"
+		id = "affb786d-47dd-587b-be52-2d670825822d"
 		date = "2024-07-02"
 		modified = "2024-07-03"
 		reference = "https://github.com/zgzhang/cve-2024-6387-poc/tree/main"
 		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/exploit_cve_2024_6387.yara#L2-L38"
 		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
 		hash = "62b06a6c30a0c891c2246ff87c0ad9ae03d2123601ba5331d6348c43b38d185e"
-		logic_hash = "d43a77c2690b5e01639590bc31fa64fa36b1da5efd3cc0761be7369ce80e4253"
+		logic_hash = "v1_sha256_d43a77c2690b5e01639590bc31fa64fa36b1da5efd3cc0761be7369ce80e4253"
 		score = 75
 		quality = 85
 		tags = "CVE-2024-6387, FILE"
@@ -224448,13 +223918,13 @@ rule CRAIU_Exploit_CVE_2024_6387 : CVE_2024_6387 FILE
 		$a14 = "Attempt %d of 10000" ascii wide fullword
 
 	condition:
-		( filesize <5MB) and ( uint32be(0)==0x7F454C46) and (4 of ($a*))
+		( filesize < 5MB ) and ( uint32be( 0 ) == 0x7F454C46 ) and ( 4 of ( $a* ) )
 }
 /*
  * YARA Rule Set
  * Repository Name: DitekSHen
  * Repository: https://github.com/ditekshen/detection
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: e76c93dcdedff04076380ffc60ea54e45b313635
  * Number of Rules: 1443
  * Skipped: 0 (age), 112 (quality), 0 (score), 0 (importance)
@@ -224472,20 +223942,18 @@ Redistribution and use in source and binary forms, with or without modification,
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
  */
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Meshagent : FILE
 {
 	meta:
 		description = "Detects MeshAgent. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "3d0baa87-22c9-569d-ba84-37ccaac577b8"
+		id = "732591cb-c95a-5f9a-8c42-7972b9a18122"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L3-L27"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f36c0e23b20e4466100cf4ea2a91515bf1d54505e7b1f0926a4e416a04e0dbcf"
+		logic_hash = "v1_sha256_f36c0e23b20e4466100cf4ea2a91515bf1d54505e7b1f0926a4e416a04e0dbcf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224506,7 +223974,7 @@ rule DITEKSHEN_INDICATOR_RMM_Meshagent : FILE
 		$s7 = "console.log('Error Initializing script from Zip file');process._exit();" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and 3 of ($s*)) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or 6 of ( $s* ) )
 }
 import "pe"
 
@@ -224515,34 +223983,32 @@ rule DITEKSHEN_INDICATOR_RMM_Meshagent_CERT : FILE
 	meta:
 		description = "Detects Mesh Agent by (default) certificate. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "b4b52faa-53a5-5ecf-bff8-984994449ee0"
+		id = "5c98e2f4-a966-564f-970b-969b5fb5ffdb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L29-L42"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d8ac3aec723a87146be99aefbde5642d095d8d41f69c6f5e9981c39104790d33"
+		logic_hash = "v1_sha256_d8ac3aec723a87146be99aefbde5642d095d8d41f69c6f5e9981c39104790d33"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "MeshCentralRoot-")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "MeshCentralRoot-" )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Connectwise_Screenconnect : FILE
 {
 	meta:
 		description = "Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory"
 		author = "ditekSHen"
-		id = "d752b7e4-b595-56cb-97f1-a60e73160e5a"
+		id = "33822bd5-655b-5657-b819-f13d64a9b538"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L62-L83"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "43003f97c33c631a2806ce2b82b2367d2452ceb21b0267b5dfe78b350b66924a"
+		logic_hash = "v1_sha256_43003f97c33c631a2806ce2b82b2367d2452ceb21b0267b5dfe78b350b66924a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224560,7 +224026,7 @@ rule DITEKSHEN_INDICATOR_RMM_Connectwise_Screenconnect : FILE
 		$s9 = "relay.screenconnect.com" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and 3 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0xcfd0 ) and 3 of them
 }
 import "pe"
 
@@ -224569,34 +224035,32 @@ rule DITEKSHEN_INDICATOR_RMM_Connectwise_Screenconnect_CERT : FILE
 	meta:
 		description = "Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "7a032c24-8a9e-51c3-983e-62e13594aa35"
+		id = "0dbf5c9d-914f-56d0-aaa4-ee7730ab4c91"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L85-L99"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "14291bd9ddb7fd3ee7932f8104687aae58fe7f5de13726153e5e1ee9c211f598"
+		logic_hash = "v1_sha256_14291bd9ddb7fd3ee7932f8104687aae58fe7f5de13726153e5e1ee9c211f598"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert" and pe.signatures[i].subject contains "Connectwise, LLC")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert" and pe.signatures [ i ] . subject contains "Connectwise, LLC" )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Agent : FILE
 {
 	meta:
 		description = "Detects FleetDeck Agent. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "342a196c-1c5c-5951-85e4-d288311b4980"
+		id = "ba5a9bae-c22a-559b-aaac-315ae0ea8093"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L101-L123"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "121e59ea0088c519b618e740b57c560d60cced4a48c9d468e6bf1ab22fa8c8ff"
+		logic_hash = "v1_sha256_121e59ea0088c519b618e740b57c560d60cced4a48c9d468e6bf1ab22fa8c8ff"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224615,22 +224079,20 @@ rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Agent : FILE
 		$s10 = "main.hookMqttLogging" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander : FILE
 {
 	meta:
 		description = "Detects FleetDeck Commander. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "27d533b5-7a66-507e-8ef8-ad9a6cd39ab1"
+		id = "78ea4cf1-9776-502d-b4d6-cb0e6008cae1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L125-L143"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "feee888c6649af0d8e8b08a38dda0bf7970089cf064f58b8bd9c6ebd8378e094"
+		logic_hash = "v1_sha256_feee888c6649af0d8e8b08a38dda0bf7970089cf064f58b8bd9c6ebd8378e094"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224645,22 +224107,20 @@ rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander : FILE
 		$s6 = "c:\\agent\\_work\\66\\s\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_SVC : FILE
 {
 	meta:
 		description = "Detects FleetDeck Commander SVC. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "c03b61b4-36d0-5d38-9af8-e78b9930231f"
+		id = "84fd1651-fd5a-51c6-bd56-d5ab9b1c9f0e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L145-L162"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "20bd69df3d058c24f83af312671cf249a3f26f54ef2e60f6b5b48a5bdb21b68b"
+		logic_hash = "v1_sha256_20bd69df3d058c24f83af312671cf249a3f26f54ef2e60f6b5b48a5bdb21b68b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224674,22 +224134,20 @@ rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_SVC : FILE
 		$s5 = "commanderupdate.fleetdeck.io" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_Launcher : FILE
 {
 	meta:
 		description = "Detects FleetDeck Commander Launcher. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "9a4a221e-7a7a-5008-b509-7f01e4a3eea6"
+		id = "cb009e5d-0aa2-5855-9cc3-68707e0b194e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L164-L178"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9429f55f162eebc58a7a9af8706244438cb76b1f0987facbb52d29997ed48b95"
+		logic_hash = "v1_sha256_9429f55f162eebc58a7a9af8706244438cb76b1f0987facbb52d29997ed48b95"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224700,7 +224158,7 @@ rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_Launcher : FILE
 		$s2 = "FleetDeck Commander Launcher" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 import "pe"
 
@@ -224709,34 +224167,32 @@ rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_CERT : FILE
 	meta:
 		description = "Detects FleetDeck agent by (default) certificate. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "49a6b0bb-599a-54b0-85bc-b2f6849e3ae8"
+		id = "ddb8fb5e-c0ad-5628-94a5-1d5f4a16205c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L180-L198"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8f72713eb4a5d9d32629351b937eee7de5d83abe1cd409cd8c3a8c9c52e6e490"
+		logic_hash = "v1_sha256_8f72713eb4a5d9d32629351b937eee7de5d83abe1cd409cd8c3a8c9c52e6e490"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : ((pe.signatures[i].issuer contains "Sectigo Limited" or pe.signatures[i].issuer contains "COMODO CA Limited") and pe.signatures[i].subject contains "FleetDeck Inc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( ( pe.signatures [ i ] . issuer contains "Sectigo Limited" or pe.signatures [ i ] . issuer contains "COMODO CA Limited" ) and pe.signatures [ i ] . subject contains "FleetDeck Inc" )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Pdqconnect_Agent : FILE
 {
 	meta:
 		description = "Detects PDQ Connect Agent. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "067e75a3-291b-500f-865d-8758eebe91e7"
+		id = "b3748589-9b77-59d7-8874-a0eed939c9e0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L200-L227"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "34d0b07925551d1b08b86aa226c59aba569b6548cfa00a86ce6b1f271e427662"
+		logic_hash = "v1_sha256_34d0b07925551d1b08b86aa226c59aba569b6548cfa00a86ce6b1f271e427662"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224760,7 +224216,7 @@ rule DITEKSHEN_INDICATOR_RMM_Pdqconnect_Agent : FILE
 		$s11 = "https://app.pdq.com/" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and (4 of ($s*) or (3 of ($api*) and 1 of ($s*)))
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0xcfd0 ) and ( 4 of ( $s* ) or ( 3 of ( $api* ) and 1 of ( $s* ) ) )
 }
 import "pe"
 
@@ -224769,34 +224225,32 @@ rule DITEKSHEN_INDICATOR_RMM_Pdqconnect_Agent_CERT : FILE
 	meta:
 		description = "Detects PDQ Connect Agent by (default) certificate. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "7e830cf0-8f47-5b38-85cd-9777a6878cf1"
+		id = "bee7a712-125f-521b-a58c-0fda8c0e3b6e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L229-L243"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "373a32b8bfd8c4295ba0c0302a217ccfbb7c7c616f91035097adbc5384b8afdb"
+		logic_hash = "v1_sha256_373a32b8bfd8c4295ba0c0302a217ccfbb7c7c616f91035097adbc5384b8afdb"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert, Inc." and pe.signatures[i].subject contains "PDQ.com Corporation")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert, Inc." and pe.signatures [ i ] . subject contains "PDQ.com Corporation" )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Pulseway_Pcmontasksrv : FILE
 {
 	meta:
 		description = "Detects Pulseway pcmontask and service user agent responsible for Remote Control, Screens View, Computer Lock, etc"
 		author = "ditekSHen"
-		id = "83901679-ffff-5710-b472-ece592e6764f"
+		id = "33e93449-8c62-51f4-b1da-33fcc0499d18"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L245-L266"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "80ba217960dd1ddeb220545c1cccbe96d9b676d327364e1ca8a9dde2b059261f"
+		logic_hash = "v1_sha256_80ba217960dd1ddeb220545c1cccbe96d9b676d327364e1ca8a9dde2b059261f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224814,22 +224268,20 @@ rule DITEKSHEN_INDICATOR_RMM_Pulseway_Pcmontasksrv : FILE
 		$s9 = "computermonitor.mmsoft.ro" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and 7 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0xcfd0 ) and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Pulseway_Remotedesktop : FILE
 {
 	meta:
 		description = "Detects Pulseway Rempte Desktop client"
 		author = "ditekSHen"
-		id = "8bca3cef-b24f-597a-a6e2-86040ed726f4"
+		id = "dd31b111-6506-5ab3-a760-164a07eefdac"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L268-L286"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a542c11f21ab48f4da69df4e7cb46531658a714687e2c2f8ccf78dc2a0338b68"
+		logic_hash = "v1_sha256_a542c11f21ab48f4da69df4e7cb46531658a714687e2c2f8ccf78dc2a0338b68"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224844,7 +224296,7 @@ rule DITEKSHEN_INDICATOR_RMM_Pulseway_Remotedesktop : FILE
 		$s6 = "$31f50968-d45c-49d6-ace9-ebc790855a51" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and 5 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0xcfd0 ) and 5 of them
 }
 import "pe"
 
@@ -224853,34 +224305,32 @@ rule DITEKSHEN_INDICATOR_RMM_Pulseway_CERT : FILE
 	meta:
 		description = "Detects PulseWay by (default) certificate. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "e00f51dc-261e-5a38-89ed-1899d9b522d4"
+		id = "60a3bf7e-f339-5412-a0a7-400dce352b3e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L288-L302"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c667caa9b7de4b166630c66e5162071948fa93c68b1cdb3038fce28e13dcb1a9"
+		logic_hash = "v1_sha256_c667caa9b7de4b166630c66e5162071948fa93c68b1cdb3038fce28e13dcb1a9"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert, Inc." and pe.signatures[i].subject contains "MMSOFT Design Ltd.")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert, Inc." and pe.signatures [ i ] . subject contains "MMSOFT Design Ltd." )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Manageengine_Zohomeeting : FILE
 {
 	meta:
 		description = "Detects ManageEngine Zoho Meeting (dc_rds.exe)"
 		author = "ditekSHen"
-		id = "b15efdd1-323c-5ed6-894d-b44f04d2eaf3"
+		id = "02bf2ff6-63e5-5174-9cc3-dd3930276f07"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L304-L324"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8066bcd17245efcc73f2bef7f022ad23ab648fe0ad15ca66c0d387ce4eda998b"
+		logic_hash = "v1_sha256_8066bcd17245efcc73f2bef7f022ad23ab648fe0ad15ca66c0d387ce4eda998b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224897,22 +224347,20 @@ rule DITEKSHEN_INDICATOR_RMM_Manageengine_Zohomeeting : FILE
 		$s8 = ".\\engines\\ccgost\\gost_" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Atera : FILE
 {
 	meta:
 		description = "Detects Atera. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "9801f5c9-bc1e-5502-8bca-ee1f5ca0f497"
+		id = "90d112ab-03a2-5cc5-839b-36bc8b504630"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L345-L366"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dbc37a941b38d36ea9bc31880c3cba6cd2b88b534583e86741f7686fcb410235"
+		logic_hash = "v1_sha256_dbc37a941b38d36ea9bc31880c3cba6cd2b88b534583e86741f7686fcb410235"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224930,7 +224378,7 @@ rule DITEKSHEN_INDICATOR_RMM_Atera : FILE
 		$s9 = "AlphaControlAgent.CloudLogsManager+<>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
 import "pe"
 
@@ -224939,35 +224387,33 @@ rule DITEKSHEN_INDICATOR_RMM_Atera_CERT : FILE
 	meta:
 		description = "Detects Atera by certificate. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "a5ccb684-1e28-51c8-a4d6-0b5abba97de0"
+		id = "9505fc92-8060-5b40-a75d-ae9919df98cb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L368-L383"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f51fef767cd529271f06d578146634e1ab5ee5ac3ffb829cbaa870e7c69ca3f6"
+		logic_hash = "v1_sha256_f51fef767cd529271f06d578146634e1ab5ee5ac3ffb829cbaa870e7c69ca3f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		clamav1 = "INDICATOR.Win.RMM.Atera"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert" and pe.signatures[i].subject contains "Atera Networks Ltd")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert" and pe.signatures [ i ] . subject contains "Atera Networks Ltd" )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Splashtopstreamer : FILE
 {
 	meta:
 		description = "Detects Splashtop Streamer. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "317f2be4-983f-5528-b629-75a13de7b411"
+		id = "977571d6-37a6-53dd-88a1-68f2b3f939e8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L385-L403"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "67181cd6ae071074c6bf35f44963c11c9ee9b7df242027c15b1e165d108f7b98"
+		logic_hash = "v1_sha256_67181cd6ae071074c6bf35f44963c11c9ee9b7df242027c15b1e165d108f7b98"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -224982,7 +224428,7 @@ rule DITEKSHEN_INDICATOR_RMM_Splashtopstreamer : FILE
 		$s6 = "[RemoveStreamer] Send msg 2 cloud(%d:%d:%d)" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
 import "pe"
 
@@ -224991,34 +224437,32 @@ rule DITEKSHEN_INDICATOR_RMM_Splashtopstreamer_CERT : FILE
 	meta:
 		description = "Detects Splashtop Streamer by certificate. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "7e0e4d6f-38a3-5cac-8a82-8aea7943d373"
+		id = "9ee59123-2573-5c6e-9cc5-1c17f2c27c2b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L405-L419"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0a1225a79ff30678846b9cb4315419be04b46276b3e05310a21d088b30f01b72"
+		logic_hash = "v1_sha256_0a1225a79ff30678846b9cb4315419be04b46276b3e05310a21d088b30f01b72"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert" and pe.signatures[i].subject contains "Splashtop Inc.")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert" and pe.signatures [ i ] . subject contains "Splashtop Inc." )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Aeroadmin : FILE
 {
 	meta:
 		description = "Detects AeroAdmin. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "0f69c6da-40e4-5952-b6f9-ed401279eb9e"
+		id = "7a02a63d-a3b2-5e9f-bed6-8958adf9e7be"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L421-L442"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a0a9e15f31b6b06fbc749b863563c30351c775c1b1d17952013670e7e1d68c41"
+		logic_hash = "v1_sha256_a0a9e15f31b6b06fbc749b863563c30351c775c1b1d17952013670e7e1d68c41"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225036,7 +224480,7 @@ rule DITEKSHEN_INDICATOR_RMM_Aeroadmin : FILE
 		$s9 = "aeroadmin.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
 import "pe"
 
@@ -225045,35 +224489,33 @@ rule DITEKSHEN_INDICATOR_RMM_Aeroadmin_CERT : FILE
 	meta:
 		description = "Detects AeroAdmin by certificate. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "ca34fd3c-eb76-57e3-8b62-ab0d0c9ec7b3"
+		id = "9771e605-dc11-5df4-b336-16ec18fce9ab"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L444-L461"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f1fe2d2bb6a8afd25fc5ee7a60fe5a931484591bafab24c5d488c7f0483e248a"
+		logic_hash = "v1_sha256_f1fe2d2bb6a8afd25fc5ee7a60fe5a931484591bafab24c5d488c7f0483e248a"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		clamav1 = "INDICATOR.Win.RMM.AeroAdmin"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "GlobalSign" and (pe.signatures[i].subject contains "Aeroadmin LLC" or pe.signatures[i].subject contains "@aeroadmin.com"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "GlobalSign" and ( pe.signatures [ i ] . subject contains "Aeroadmin LLC" or pe.signatures [ i ] . subject contains "@aeroadmin.com" ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Dwagentlib : FILE
 {
 	meta:
 		description = "Detect DWAgent Remote Administration Tool library"
 		author = "ditekSHen"
-		id = "af0f9940-fbec-5775-9b74-bd73b55ec0ca"
+		id = "173a26a0-f1af-5756-8889-177187319c9a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L463-L482"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "608dd9bc8cfcec5a671bee9456dccedace31d7ae37180387ac2408f79fd9f452"
+		logic_hash = "v1_sha256_608dd9bc8cfcec5a671bee9456dccedace31d7ae37180387ac2408f79fd9f452"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225089,22 +224531,20 @@ rule DITEKSHEN_INDICATOR_RMM_Dwagentlib : FILE
 		$s7 = "taskKill" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Dwagentsvc : FILE
 {
 	meta:
 		description = "Detect DWAgent Remote Administration Tool service"
 		author = "ditekSHen"
-		id = "5d124c20-a0f8-5e82-8bab-93a782a2a649"
+		id = "877f15b3-03b9-5e8c-af16-d62ae658ffde"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L484-L501"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "590d41d2e433a7a1bb373fbd0b0d47818a9867bee0399101881b05e83b586f6e"
+		logic_hash = "v1_sha256_590d41d2e433a7a1bb373fbd0b0d47818a9867bee0399101881b05e83b586f6e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225118,22 +224558,20 @@ rule DITEKSHEN_INDICATOR_RMM_Dwagentsvc : FILE
 		$s5 = "Check updating..." wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Dwagent_Screencapture : FILE
 {
 	meta:
 		description = "Detect DWAgent Remote Administration Tool Screen Capture Module"
 		author = "ditekSHen"
-		id = "79586e5e-b7e5-5adc-97f3-0d29ad695079"
+		id = "40c5c1df-abef-56c5-a946-2b369628c78f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L503-L528"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d3160fd4cce445aa6d2bc6c083893c7610ea5e72824fe9824ad853700f4d3874"
+		logic_hash = "v1_sha256_d3160fd4cce445aa6d2bc6c083893c7610ea5e72824fe9824ad853700f4d3874"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225155,22 +224593,20 @@ rule DITEKSHEN_INDICATOR_RMM_Dwagent_Screencapture : FILE
 		$s13 = "isUserInAdminGroup" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_RMM_Dwagent_Soundcapture : FILE
 {
 	meta:
 		description = "Detect DWAgent Remote Administration Tool Sound Capture Module"
 		author = "ditekSHen"
-		id = "4e395d1e-96a1-5ecc-abe5-6f8323a2c8ca"
+		id = "803e7bf4-3de0-5bb1-adad-fcf461584797"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L530-L545"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c0efa9f383373dec1c5b9d127c2b4c6f4906718ae8f62eea28d7a369001be5af"
+		logic_hash = "v1_sha256_c0efa9f383373dec1c5b9d127c2b4c6f4906718ae8f62eea28d7a369001be5af"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225182,7 +224618,7 @@ rule DITEKSHEN_INDICATOR_RMM_Dwagent_Soundcapture : FILE
 		$s3 = "_Z6recordPvS_" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 import "pe"
 
@@ -225191,35 +224627,33 @@ rule DITEKSHEN_INDICATOR_RMM_Dwagent_CERT : FILE
 	meta:
 		description = "Detects DWAgent by certificate. Review RMM Inventory"
 		author = "ditekSHen"
-		id = "96572e83-ffb9-58d9-93d1-84e16ae1a3ba"
+		id = "4c3adfc9-8d41-5b4c-a597-41a13dedb4e7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L547-L563"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9ed86f053c8d1423aae8cfc6e0bba6021510dfb6d722430c8c7edb15d3e8233a"
+		logic_hash = "v1_sha256_9ed86f053c8d1423aae8cfc6e0bba6021510dfb6d722430c8c7edb15d3e8233a"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		thumbprint = "4a13f46def2c9427898a46a88a6a2122ed106b37"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DWSNET srl" and pe.signatures[i].issuer contains "Sectigo Public Code Signing CA R36" and pe.signatures[i].serial=="00:af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DWSNET srl" and pe.signatures [ i ] . issuer contains "Sectigo Public Code Signing CA R36" and pe.signatures [ i ] . serial == "00:af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53" )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_OSX_RMM_Dwagent : FILE
 {
 	meta:
 		description = "Detect DWAgent Remote Administration Tool macOS run"
 		author = "ditekSHen"
-		id = "0eeb9ae3-826e-52b7-bbb8-3f8c4920f5c3"
+		id = "1715ac27-4136-5b2b-b4cc-91c4ffe00bf7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L565-L580"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9864668abdd534d8a33940f9513d07356451ce1eaa9233771e82b8138dc0b41b"
+		logic_hash = "v1_sha256_9864668abdd534d8a33940f9513d07356451ce1eaa9233771e82b8138dc0b41b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225231,7 +224665,7 @@ rule DITEKSHEN_INDICATOR_OSX_RMM_Dwagent : FILE
 		$s3 = "customWindowsToEnterFullScreenForWindow:onScreen:" ascii
 
 	condition:
-		uint16(0)==0xfeca and all of them
+		uint16( 0 ) == 0xfeca and all of them
 }
 import "pe"
 
@@ -225240,13 +224674,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56203Db039Adbd6094B6A142C5E50587 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "b3e56f78-e79a-52e3-b29e-1f566946609e"
+		id = "6b623521-d906-5b88-8c79-54dddeb99c62"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3-L14"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "38380bc1a22b8d0fe851f76d2ecadba638f10b01873be44766124fb738e23d71"
+		logic_hash = "v1_sha256_38380bc1a22b8d0fe851f76d2ecadba638f10b01873be44766124fb738e23d71"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225254,7 +224688,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56203Db039Adbd6094B6A142C5E50587 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bccabdacabbdcda" and pe.signatures[i].serial=="56:20:3d:b0:39:ad:bd:60:94:b6:a1:42:c5:e5:05:87")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bccabdacabbdcda" and pe.signatures [ i ] . serial == "56:20:3d:b0:39:ad:bd:60:94:b6:a1:42:c5:e5:05:87" )
 }
 import "pe"
 
@@ -225263,13 +224697,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B5F34B7C326C73C392B515Eb4C2Ec80E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f5d19333-4aee-52d3-aeac-822b39ec653a"
+		id = "68d57d5a-c2a3-5e15-a86e-5e685b0764e4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L16-L27"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "553ef777cb7a93934caa53cc9acdc37fc4cbe2a28ae320f4a7f10b2a4073d675"
+		logic_hash = "v1_sha256_553ef777cb7a93934caa53cc9acdc37fc4cbe2a28ae320f4a7f10b2a4073d675"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225277,7 +224711,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B5F34B7C326C73C392B515Eb4C2Ec80E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cdaadbffbaedaabbdedfdbfebf" and pe.signatures[i].serial=="b5:f3:4b:7c:32:6c:73:c3:92:b5:15:eb:4c:2e:c8:0e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cdaadbffbaedaabbdedfdbfebf" and pe.signatures [ i ] . serial == "b5:f3:4b:7c:32:6c:73:c3:92:b5:15:eb:4c:2e:c8:0e" )
 }
 import "pe"
 
@@ -225286,13 +224720,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A1Dc99E4D5264C45A5090F93242A30A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8efea9da-a3ae-5af3-83b2-cac5baa4fa89"
+		id = "736d652a-f25b-523b-977d-ab6a76eae747"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L29-L40"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cb230503e17e93f78b04723c32d7ce66bdf146846e0208d268eebc0e446a6917"
+		logic_hash = "v1_sha256_cb230503e17e93f78b04723c32d7ce66bdf146846e0208d268eebc0e446a6917"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225300,7 +224734,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A1Dc99E4D5264C45A5090F93242A30A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "K & D KOMPANI d.o.o." and pe.signatures[i].serial=="0a:1d:c9:9e:4d:52:64:c4:5a:50:90:f9:32:42:a3:0a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "K & D KOMPANI d.o.o." and pe.signatures [ i ] . serial == "0a:1d:c9:9e:4d:52:64:c4:5a:50:90:f9:32:42:a3:0a" )
 }
 import "pe"
 
@@ -225309,13 +224743,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0D53690631Dd186C56Be9026Eb931Ae2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f0afbdf4-68db-522f-95d7-cd76aa7b9710"
+		id = "bf0f24b2-5b8a-5d66-93f8-3c392d58575c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L42-L53"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "645c2340fe7e7ce992f3f655d5058834d0df6a64ea20ef7794893a592124c55e"
+		logic_hash = "v1_sha256_645c2340fe7e7ce992f3f655d5058834d0df6a64ea20ef7794893a592124c55e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225323,7 +224757,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0D53690631Dd186C56Be9026Eb931Ae2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STA-R TOV" and pe.signatures[i].serial=="0d:53:69:06:31:dd:18:6c:56:be:90:26:eb:93:1a:e2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "STA-R TOV" and pe.signatures [ i ] . serial == "0d:53:69:06:31:dd:18:6c:56:be:90:26:eb:93:1a:e2" )
 }
 import "pe"
 
@@ -225332,13 +224766,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fd8C468Cc1B45C9Cfb41Cbd8C835Cc9E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "836af706-3a82-5aaf-9a96-244eef5820b2"
+		id = "a6ee48a0-fb54-5c3e-b70b-f919b022c563"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L55-L66"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "495ec6dbfdec3f608e387280e2d34093bb4965f5ada7c101e3119ae970eaf80d"
+		logic_hash = "v1_sha256_495ec6dbfdec3f608e387280e2d34093bb4965f5ada7c101e3119ae970eaf80d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225346,7 +224780,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fd8C468Cc1B45C9Cfb41Cbd8C835Cc9E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pivo ZLoun s.r.o." and pe.signatures[i].serial=="fd:8c:46:8c:c1:b4:5c:9c:fb:41:cb:d8:c8:35:cc:9e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Pivo ZLoun s.r.o." and pe.signatures [ i ] . serial == "fd:8c:46:8c:c1:b4:5c:9c:fb:41:cb:d8:c8:35:cc:9e" )
 }
 import "pe"
 
@@ -225355,13 +224789,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_32Fbf8Cfa43Dca3F85Efabe96Dfefa49 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "9a228e0e-256b-547d-af6d-960089f2f803"
+		id = "368605e9-e302-5ee7-a84d-73264acce425"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L68-L79"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7e53dcd2e10285f710f1fb2355d77db3507ce346e8d0f26843ca8df2271a6e9e"
+		logic_hash = "v1_sha256_7e53dcd2e10285f710f1fb2355d77db3507ce346e8d0f26843ca8df2271a6e9e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225369,7 +224803,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_32Fbf8Cfa43Dca3F85Efabe96Dfefa49 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foxstyle LLC" and pe.signatures[i].serial=="32:fb:f8:cf:a4:3d:ca:3f:85:ef:ab:e9:6d:fe:fa:49")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Foxstyle LLC" and pe.signatures [ i ] . serial == "32:fb:f8:cf:a4:3d:ca:3f:85:ef:ab:e9:6d:fe:fa:49" )
 }
 import "pe"
 
@@ -225378,13 +224812,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7E0Ccda0Ef37Acef6C2Ebe4538627E5C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "89006ac2-5cbc-5e7f-9ca6-51316b8d4bfd"
+		id = "411698ce-f13d-5280-844c-662ab6786aa5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L81-L92"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "aed6c65f9c6400c0cc94386be684d3b9dd8d7637f9798fb49f4f651cf28b2d12"
+		logic_hash = "v1_sha256_aed6c65f9c6400c0cc94386be684d3b9dd8d7637f9798fb49f4f651cf28b2d12"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225392,7 +224826,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7E0Ccda0Ef37Acef6C2Ebe4538627E5C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Orangetree B.V." and pe.signatures[i].serial=="7e:0c:cd:a0:ef:37:ac:ef:6c:2e:be:45:38:62:7e:5c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Orangetree B.V." and pe.signatures [ i ] . serial == "7e:0c:cd:a0:ef:37:ac:ef:6c:2e:be:45:38:62:7e:5c" )
 }
 import "pe"
 
@@ -225401,13 +224835,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0095E5793F2Abe0B4Ec9Be54Fd24F76Ae5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "94878b56-5b29-55a8-a8ec-7ace588e34ef"
+		id = "919e5850-388e-5f40-801e-5351e20e5d3e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L94-L105"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b1f8867b47c1bec43b3603af343d6d5728ec218a66863a6777c0ee59ae1faa98"
+		logic_hash = "v1_sha256_b1f8867b47c1bec43b3603af343d6d5728ec218a66863a6777c0ee59ae1faa98"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225415,7 +224849,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0095E5793F2Abe0B4Ec9Be54Fd24F76Ae5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kommservice LLC" and pe.signatures[i].serial=="00:95:e5:79:3f:2a:be:0b:4e:c9:be:54:fd:24:f7:6a:e5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kommservice LLC" and pe.signatures [ i ] . serial == "00:95:e5:79:3f:2a:be:0b:4e:c9:be:54:fd:24:f7:6a:e5" )
 }
 import "pe"
 
@@ -225424,13 +224858,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C167F04B338B1E8747B92C2197403C43 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d838e09b-e2f2-585a-a33d-bfe34f989e77"
+		id = "6ad99fbf-d116-5c9a-893d-6f8c88b3d509"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L107-L118"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "008fe748c7956c1885c7d7e3a843d2310c17b7552dbbe9b4750809a5642d7ca6"
+		logic_hash = "v1_sha256_008fe748c7956c1885c7d7e3a843d2310c17b7552dbbe9b4750809a5642d7ca6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225438,7 +224872,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C167F04B338B1E8747B92C2197403C43 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTUNE STAR TRADING, INC." and pe.signatures[i].serial=="00:c1:67:f0:4b:33:8b:1e:87:47:b9:2c:21:97:40:3c:43")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FORTUNE STAR TRADING, INC." and pe.signatures [ i ] . serial == "00:c1:67:f0:4b:33:8b:1e:87:47:b9:2c:21:97:40:3c:43" )
 }
 import "pe"
 
@@ -225447,13 +224881,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fc7065Abf8303Fb472B8Af85918F5C24 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d8c25f8a-e129-5cd4-9e60-d2e7ebbb1ea6"
+		id = "ac19c2d4-8e4b-5e70-a0f7-0842884dfb5d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L120-L131"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8ce0d25ef802948f754f155010f42d76256895ebd6ffdce8d97063dada58e668"
+		logic_hash = "v1_sha256_8ce0d25ef802948f754f155010f42d76256895ebd6ffdce8d97063dada58e668"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225461,7 +224895,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fc7065Abf8303Fb472B8Af85918F5C24 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIG IN VISION SP Z O O" and pe.signatures[i].serial=="00:fc:70:65:ab:f8:30:3f:b4:72:b8:af:85:91:8f:5c:24")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DIG IN VISION SP Z O O" and pe.signatures [ i ] . serial == "00:fc:70:65:ab:f8:30:3f:b4:72:b8:af:85:91:8f:5c:24" )
 }
 import "pe"
 
@@ -225470,13 +224904,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B61B8E71514059Adc604Da05C283E514 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d52bd370-a1da-56f1-8edd-da61c9e2e75b"
+		id = "8d7635fe-c645-557a-9934-d35abcdc276e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L133-L144"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b771d40e4e2db1d3f26d8fb2fa140f57871712700e584005d2377b701fc9538a"
+		logic_hash = "v1_sha256_b771d40e4e2db1d3f26d8fb2fa140f57871712700e584005d2377b701fc9538a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225484,7 +224918,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B61B8E71514059Adc604Da05C283E514 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APP DIVISION ApS" and pe.signatures[i].serial=="00:b6:1b:8e:71:51:40:59:ad:c6:04:da:05:c2:83:e5:14")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APP DIVISION ApS" and pe.signatures [ i ] . serial == "00:b6:1b:8e:71:51:40:59:ad:c6:04:da:05:c2:83:e5:14" )
 }
 import "pe"
 
@@ -225493,13 +224927,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_51Cd5393514F7Ace2B407C3Dbfb09D8D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f2f7b08e-111c-570b-b376-79145050ca42"
+		id = "99beedf5-d764-51b0-a794-a96929b90a8d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L146-L157"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "389dbdc85035fdd94e831940eda910349134600e921720729840c932123db36d"
+		logic_hash = "v1_sha256_389dbdc85035fdd94e831940eda910349134600e921720729840c932123db36d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225507,7 +224941,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_51Cd5393514F7Ace2B407C3Dbfb09D8D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APPI CZ a.s" and pe.signatures[i].serial=="51:cd:53:93:51:4f:7a:ce:2b:40:7c:3d:bf:b0:9d:8d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APPI CZ a.s" and pe.signatures [ i ] . serial == "51:cd:53:93:51:4f:7a:ce:2b:40:7c:3d:bf:b0:9d:8d" )
 }
 import "pe"
 
@@ -225516,13 +224950,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_030012F134E64347669F3256C7D050C5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "7f16b535-8a0f-583d-8bc3-0abf24f26632"
+		id = "b94d22be-2739-54a1-9a5d-a6e5ef7b323b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L159-L170"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "68bfd2e146e3b2bd1222de7f9981bb0e373bcb4727a81eb7060af36e6275d438"
+		logic_hash = "v1_sha256_68bfd2e146e3b2bd1222de7f9981bb0e373bcb4727a81eb7060af36e6275d438"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225530,7 +224964,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_030012F134E64347669F3256C7D050C5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Futumarket LLC" and pe.signatures[i].serial=="03:00:12:f1:34:e6:43:47:66:9f:32:56:c7:d0:50:c5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Futumarket LLC" and pe.signatures [ i ] . serial == "03:00:12:f1:34:e6:43:47:66:9f:32:56:c7:d0:50:c5" )
 }
 import "pe"
 
@@ -225539,13 +224973,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B7F19B13De9Bee8A52Ff365Ced6F67Fa : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "b9cbe1bd-b24f-5599-a8b9-9e6f9b70f37f"
+		id = "731f1943-154b-5ab6-a6f3-16cf653d312f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L172-L183"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "afdc41aed0480593bb8c92955db044ebe1a695d4912176123e26e052a3e9d3ea"
+		logic_hash = "v1_sha256_afdc41aed0480593bb8c92955db044ebe1a695d4912176123e26e052a3e9d3ea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225553,7 +224987,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B7F19B13De9Bee8A52Ff365Ced6F67Fa : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALEXIS SECURITY GROUP, LLC" and pe.signatures[i].serial=="00:b7:f1:9b:13:de:9b:ee:8a:52:ff:36:5c:ed:6f:67:fa")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALEXIS SECURITY GROUP, LLC" and pe.signatures [ i ] . serial == "00:b7:f1:9b:13:de:9b:ee:8a:52:ff:36:5c:ed:6f:67:fa" )
 }
 import "pe"
 
@@ -225562,13 +224996,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4C8Def294478B7D59Ee95C61Fae3D965 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "2f95a688-2fb2-55b7-9cd5-44586d6d4dc8"
+		id = "7c773f9d-79bf-5d23-8a4c-7862334c38b4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L185-L196"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d9e956d7d5b9389aebafd4b7025818ac8eb5a72aaa1b94068a12aa7a8029f97c"
+		logic_hash = "v1_sha256_d9e956d7d5b9389aebafd4b7025818ac8eb5a72aaa1b94068a12aa7a8029f97c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225576,7 +225010,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4C8Def294478B7D59Ee95C61Fae3D965 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DREAM SECURITY USA INC" and pe.signatures[i].serial=="4c:8d:ef:29:44:78:b7:d5:9e:e9:5c:61:fa:e3:d9:65")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DREAM SECURITY USA INC" and pe.signatures [ i ] . serial == "4c:8d:ef:29:44:78:b7:d5:9e:e9:5c:61:fa:e3:d9:65" )
 }
 import "pe"
 
@@ -225585,13 +225019,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A23B660E7322E54D7Bd0E5Acc890966 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "c9817cbd-edce-5ae0-ad70-58d592ac415f"
+		id = "8ff025cc-8d2b-5035-b51f-f1e95a43fa27"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L198-L209"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6b9009d0c509b38107eba5742613f8ec6f48e447225c664e374ef56d64b035f0"
+		logic_hash = "v1_sha256_6b9009d0c509b38107eba5742613f8ec6f48e447225c664e374ef56d64b035f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225599,7 +225033,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A23B660E7322E54D7Bd0E5Acc890966 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ARTBUD RADOM SP Z O O" and pe.signatures[i].serial=="0a:23:b6:60:e7:32:2e:54:d7:bd:0e:5a:cc:89:09:66")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ARTBUD RADOM SP Z O O" and pe.signatures [ i ] . serial == "0a:23:b6:60:e7:32:2e:54:d7:bd:0e:5a:cc:89:09:66" )
 }
 import "pe"
 
@@ -225608,13 +225042,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_04332C16724Ffeda5868D22Af56Aea43 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "7e6be2f5-2f34-5337-8beb-4ccc6c50ad2d"
+		id = "e3598fb7-7de7-580c-a7b0-e3975db74c6a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L211-L222"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "338e7d9374de04d00162c9caf86d922f4d659b024ae7908f0e02ca4709a14a1d"
+		logic_hash = "v1_sha256_338e7d9374de04d00162c9caf86d922f4d659b024ae7908f0e02ca4709a14a1d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225622,7 +225056,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_04332C16724Ffeda5868D22Af56Aea43 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bespoke Software Solutions Limited" and pe.signatures[i].serial=="04:33:2c:16:72:4f:fe:da:58:68:d2:2a:f5:6a:ea:43")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bespoke Software Solutions Limited" and pe.signatures [ i ] . serial == "04:33:2c:16:72:4f:fe:da:58:68:d2:2a:f5:6a:ea:43" )
 }
 import "pe"
 
@@ -225631,13 +225065,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_085B70224253486624Fc36Fa658A1E32 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8d0f4499-1ed2-5277-be80-0b7f3499b360"
+		id = "97800312-0741-51f0-a912-3b3d9e4c9dab"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L224-L235"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8779cca652b366ce33a3735069fdc35657a6bed5b469a956cd236d76901f8f54"
+		logic_hash = "v1_sha256_8779cca652b366ce33a3735069fdc35657a6bed5b469a956cd236d76901f8f54"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225645,7 +225079,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_085B70224253486624Fc36Fa658A1E32 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Best Fud, OOO" and pe.signatures[i].serial=="08:5b:70:22:42:53:48:66:24:fc:36:fa:65:8a:1e:32")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Best Fud, OOO" and pe.signatures [ i ] . serial == "08:5b:70:22:42:53:48:66:24:fc:36:fa:65:8a:1e:32" )
 }
 import "pe"
 
@@ -225654,13 +225088,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0086E5A9B9E89E5075C475006D0Ca03832 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "898bfe5f-5ac6-51f3-be55-09279a286835"
+		id = "f040b32f-8026-5686-a018-e5b8d3680a4d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L237-L248"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "613f21989dc369ef6b1d8e42a0d707810ef064c608e4e34ba5eb475164f14abc"
+		logic_hash = "v1_sha256_613f21989dc369ef6b1d8e42a0d707810ef064c608e4e34ba5eb475164f14abc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225668,7 +225102,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0086E5A9B9E89E5075C475006D0Ca03832 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BlueMarble GmbH" and pe.signatures[i].serial=="00:86:e5:a9:b9:e8:9e:50:75:c4:75:00:6d:0c:a0:38:32")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BlueMarble GmbH" and pe.signatures [ i ] . serial == "00:86:e5:a9:b9:e8:9e:50:75:c4:75:00:6d:0c:a0:38:32" )
 }
 import "pe"
 
@@ -225677,13 +225111,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_039668034826Df47E6207Ec9Daed57C3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8ae5f710-db8e-5d29-b247-a103f0878aa5"
+		id = "24f75e94-d63c-57f5-86a9-853d20acb2d5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L250-L261"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b9579ba5dac45e38ef7b2b3381d1651395a4f648c68ae8e6fc36a0ea2d9b6300"
+		logic_hash = "v1_sha256_b9579ba5dac45e38ef7b2b3381d1651395a4f648c68ae8e6fc36a0ea2d9b6300"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225691,7 +225125,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_039668034826Df47E6207Ec9Daed57C3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CHOO FSP, LLC" and pe.signatures[i].serial=="03:96:68:03:48:26:df:47:e6:20:7e:c9:da:ed:57:c3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CHOO FSP, LLC" and pe.signatures [ i ] . serial == "03:96:68:03:48:26:df:47:e6:20:7e:c9:da:ed:57:c3" )
 }
 import "pe"
 
@@ -225700,13 +225134,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_736Dcfd309Ea4C3Bea23287473Ffe071 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "058c4e85-e004-5fe0-9e16-9dbe333371f6"
+		id = "aab3772d-270d-5757-acc9-ce3d2b8f70d7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L263-L274"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "68a91e0e042606d49a5c83c972b0a6bf387c9d7d20c2df132edec717ab4603a0"
+		logic_hash = "v1_sha256_68a91e0e042606d49a5c83c972b0a6bf387c9d7d20c2df132edec717ab4603a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225714,7 +225148,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_736Dcfd309Ea4C3Bea23287473Ffe071 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ESTELLA, OOO" and pe.signatures[i].serial=="73:6d:cf:d3:09:ea:4c:3b:ea:23:28:74:73:ff:e0:71")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ESTELLA, OOO" and pe.signatures [ i ] . serial == "73:6d:cf:d3:09:ea:4c:3b:ea:23:28:74:73:ff:e0:71" )
 }
 import "pe"
 
@@ -225723,13 +225157,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_09C89De6F64A7Fdf657E69353C5Fdd44 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "613c4253-8a53-5faa-8376-10c9a35805cf"
+		id = "e5bb2f10-80e1-55b7-aa90-b8e1e53ee64f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L276-L287"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7fcb517a4160226cf89c13b5b27310d1e8a02d3f164a338a8d2901ef604f1d8a"
+		logic_hash = "v1_sha256_7fcb517a4160226cf89c13b5b27310d1e8a02d3f164a338a8d2901ef604f1d8a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225737,7 +225171,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_09C89De6F64A7Fdf657E69353C5Fdd44 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EXON RENTAL SP Z O O" and pe.signatures[i].serial=="09:c8:9d:e6:f6:4a:7f:df:65:7e:69:35:3c:5f:dd:44")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EXON RENTAL SP Z O O" and pe.signatures [ i ] . serial == "09:c8:9d:e6:f6:4a:7f:df:65:7e:69:35:3c:5f:dd:44" )
 }
 import "pe"
 
@@ -225746,13 +225180,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_03B630F9645531F8868Dae8Ac0F8Cfe6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "ca5203b8-3029-5914-b611-1717aefc7ccf"
+		id = "bed950fa-e0e2-5a23-9873-4a94f9b122ea"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L289-L300"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0c388ee7cfc2f35d5e020520d0c5a04b872d5deff63fc551308168e60122f7fc"
+		logic_hash = "v1_sha256_0c388ee7cfc2f35d5e020520d0c5a04b872d5deff63fc551308168e60122f7fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225760,7 +225194,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_03B630F9645531F8868Dae8Ac0F8Cfe6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Geksan LLC" and pe.signatures[i].serial=="03:b6:30:f9:64:55:31:f8:86:8d:ae:8a:c0:f8:cf:e6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Geksan LLC" and pe.signatures [ i ] . serial == "03:b6:30:f9:64:55:31:f8:86:8d:ae:8a:c0:f8:cf:e6" )
 }
 import "pe"
 
@@ -225769,13 +225203,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_020Bc03538Fbdc792F39D99A24A81B97 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d5fd84b4-cccf-569d-96ea-26d9d21c6adf"
+		id = "5ea3c381-48fa-528b-9712-a697804e1503"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L302-L313"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "154d7d814ff0b1c2d85557211dd68d0bd82e9953a9912ac3c26475a1316b0cb3"
+		logic_hash = "v1_sha256_154d7d814ff0b1c2d85557211dd68d0bd82e9953a9912ac3c26475a1316b0cb3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225783,7 +225217,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_020Bc03538Fbdc792F39D99A24A81B97 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GLOBAL PARK HORIZON SP Z O O" and pe.signatures[i].serial=="02:0b:c0:35:38:fb:dc:79:2f:39:d9:9a:24:a8:1b:97")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GLOBAL PARK HORIZON SP Z O O" and pe.signatures [ i ] . serial == "02:0b:c0:35:38:fb:dc:79:2f:39:d9:9a:24:a8:1b:97" )
 }
 import "pe"
 
@@ -225792,13 +225226,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4E8D4Fc7D9F38Aca1169Fbf8Ef2Aaf50 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "03a23987-bbec-5072-bea4-56773bdc7d53"
+		id = "c56c24ac-c49f-52f5-922b-07c15c0f4454"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L315-L326"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2b440d21183745ac89de56f5ca22cf3f01be3212e20ce80fa67a45adbb6b16fe"
+		logic_hash = "v1_sha256_2b440d21183745ac89de56f5ca22cf3f01be3212e20ce80fa67a45adbb6b16fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225806,7 +225240,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4E8D4Fc7D9F38Aca1169Fbf8Ef2Aaf50 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "INFINITE PROGRAMMING LIMITED" and pe.signatures[i].serial=="4e:8d:4f:c7:d9:f3:8a:ca:11:69:fb:f8:ef:2a:af:50")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "INFINITE PROGRAMMING LIMITED" and pe.signatures [ i ] . serial == "4e:8d:4f:c7:d9:f3:8a:ca:11:69:fb:f8:ef:2a:af:50" )
 }
 import "pe"
 
@@ -225815,13 +225249,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_09830675Eb483E265C3153F0A77C3De9 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "3370886e-6866-598b-b3bf-29c7f2537425"
+		id = "870c4122-00b1-5d16-b723-442aad7af4b0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L328-L339"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b0a504ed2a2816602ac378a700567909812650f409626a7b2c1e25cf7f8cb51c"
+		logic_hash = "v1_sha256_b0a504ed2a2816602ac378a700567909812650f409626a7b2c1e25cf7f8cb51c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225829,7 +225263,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_09830675Eb483E265C3153F0A77C3De9 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "James LTH d.o.o." and pe.signatures[i].serial=="09:83:06:75:eb:48:3e:26:5c:31:53:f0:a7:7c:3d:e9")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "James LTH d.o.o." and pe.signatures [ i ] . serial == "09:83:06:75:eb:48:3e:26:5c:31:53:f0:a7:7c:3d:e9" )
 }
 import "pe"
 
@@ -225838,13 +225272,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_351Fe2Efdc0Ac56A0C822Cf8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "dcd82e7a-f235-5ff6-805b-0da7e0c0e385"
+		id = "aab9f88c-ca21-5e94-8588-8d41008c5d55"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L341-L352"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a661adcd9366da7eab0aa8059bbe6236022f7513996603eb06c43a0b38ff4b85"
+		logic_hash = "v1_sha256_a661adcd9366da7eab0aa8059bbe6236022f7513996603eb06c43a0b38ff4b85"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225852,7 +225286,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_351Fe2Efdc0Ac56A0C822Cf8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Logika OOO" and pe.signatures[i].serial=="35:1f:e2:ef:dc:0a:c5:6a:0c:82:2c:f8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Logika OOO" and pe.signatures [ i ] . serial == "35:1f:e2:ef:dc:0a:c5:6a:0c:82:2c:f8" )
 }
 import "pe"
 
@@ -225861,13 +225295,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_07Bb6A9D1C642C5973C16D5353B17Ca4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a29590bb-d8f9-5842-81bd-f9a9f7cea642"
+		id = "6456c0a1-6ee2-5a96-b775-ed33c286e7a8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L354-L365"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "faecdcd78bc60f730bfe5a049fd0bd1309b44d185c0cbc81dfc326a162d5fcb2"
+		logic_hash = "v1_sha256_faecdcd78bc60f730bfe5a049fd0bd1309b44d185c0cbc81dfc326a162d5fcb2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225875,7 +225309,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_07Bb6A9D1C642C5973C16D5353B17Ca4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MADAS d.o.o." and pe.signatures[i].serial=="07:bb:6a:9d:1c:64:2c:59:73:c1:6d:53:53:b1:7c:a4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MADAS d.o.o." and pe.signatures [ i ] . serial == "07:bb:6a:9d:1c:64:2c:59:73:c1:6d:53:53:b1:7c:a4" )
 }
 import "pe"
 
@@ -225884,13 +225318,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_044E05Bb1A01A1Cbb50Cfb6Cd24E5D6B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "e8dc8963-29c1-5306-bd7d-80ad9e1334d9"
+		id = "6e77fe0a-32e8-5fb0-8b73-8f539cc816d9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L367-L378"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c433b63f9c875a564f424ecc8e9239701ce8be78cd0046c1eefca8cf732abca3"
+		logic_hash = "v1_sha256_c433b63f9c875a564f424ecc8e9239701ce8be78cd0046c1eefca8cf732abca3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225898,7 +225332,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_044E05Bb1A01A1Cbb50Cfb6Cd24E5D6B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MUSTER PLUS SP Z O O" and pe.signatures[i].serial=="04:4e:05:bb:1a:01:a1:cb:b5:0c:fb:6c:d2:4e:5d:6b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MUSTER PLUS SP Z O O" and pe.signatures [ i ] . serial == "04:4e:05:bb:1a:01:a1:cb:b5:0c:fb:6c:d2:4e:5d:6b" )
 }
 import "pe"
 
@@ -225907,13 +225341,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0C14B611A44A1Bae0E8C7581651845B6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a6ebe304-e896-5cb3-8a49-ebffe0525601"
+		id = "37747746-25b2-557d-902c-e22a02901c78"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L380-L391"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dae6318cf6f8e33e11af5c4b06379f8ef2744e784bb793c78f782b6a6286b84b"
+		logic_hash = "v1_sha256_dae6318cf6f8e33e11af5c4b06379f8ef2744e784bb793c78f782b6a6286b84b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225921,7 +225355,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0C14B611A44A1Bae0E8C7581651845B6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NEEDCODE SP Z O O" and pe.signatures[i].serial=="0c:14:b6:11:a4:4a:1b:ae:0e:8c:75:81:65:18:45:b6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NEEDCODE SP Z O O" and pe.signatures [ i ] . serial == "0c:14:b6:11:a4:4a:1b:ae:0e:8c:75:81:65:18:45:b6" )
 }
 import "pe"
 
@@ -225930,13 +225364,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0B1926A5E8Ae50A0Efa504F005F93869 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "905a4b5c-3255-5f53-be54-429038378ee0"
+		id = "8c3226ea-0203-5329-ab2d-b057a507b5d5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L393-L404"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "78d507f76d44ed982d12c293604d5c4fed14316cbc18473b7131bb89997bad28"
+		logic_hash = "v1_sha256_78d507f76d44ed982d12c293604d5c4fed14316cbc18473b7131bb89997bad28"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225944,7 +225378,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0B1926A5E8Ae50A0Efa504F005F93869 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nordkod LLC" and pe.signatures[i].serial=="0b:19:26:a5:e8:ae:50:a0:ef:a5:04:f0:05:f9:38:69")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Nordkod LLC" and pe.signatures [ i ] . serial == "0b:19:26:a5:e8:ae:50:a0:ef:a5:04:f0:05:f9:38:69" )
 }
 import "pe"
 
@@ -225953,13 +225387,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Bab6A2Aa84B495D9E554A4C42C0126D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "be364465-0cab-59cd-82a2-b7b16f260f34"
+		id = "03cb2c96-398a-5e51-90e8-fe2c387f9529"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L406-L417"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a9ecdf1107cba0767ac3fa52c7dd65a13015e4fd735da70b6f1e6dbcfe2f7526"
+		logic_hash = "v1_sha256_a9ecdf1107cba0767ac3fa52c7dd65a13015e4fd735da70b6f1e6dbcfe2f7526"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225967,7 +225401,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Bab6A2Aa84B495D9E554A4C42C0126D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NOSOV SP Z O O" and pe.signatures[i].serial=="0b:ab:6a:2a:a8:4b:49:5d:9e:55:4a:4c:42:c0:12:6d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NOSOV SP Z O O" and pe.signatures [ i ] . serial == "0b:ab:6a:2a:a8:4b:49:5d:9e:55:4a:4c:42:c0:12:6d" )
 }
 import "pe"
 
@@ -225976,13 +225410,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_066226Cf6A4D8Ae1100961A0C5404Ff9 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "75db8056-a5da-5db4-a837-84c5cc05f0fc"
+		id = "5c5bfdf9-8068-569c-96da-455522979198"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L419-L430"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0b7fa450d143de99650d0364e461178ad4e0b147b19dae53b59928b2a17c9b6d"
+		logic_hash = "v1_sha256_0b7fa450d143de99650d0364e461178ad4e0b147b19dae53b59928b2a17c9b6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -225990,7 +225424,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_066226Cf6A4D8Ae1100961A0C5404Ff9 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO MEP" and pe.signatures[i].serial=="06:62:26:cf:6a:4d:8a:e1:10:09:61:a0:c5:40:4f:f9")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO MEP" and pe.signatures [ i ] . serial == "06:62:26:cf:6a:4d:8a:e1:10:09:61:a0:c5:40:4f:f9" )
 }
 import "pe"
 
@@ -225999,13 +225433,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0E96837Dbe5F4548547203919B96Ac27 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "83258afe-66e0-56d1-8361-125a1142ffe4"
+		id = "22b374f1-cb85-5085-ba22-357d61bfe4a7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L432-L443"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2eedcc1d782df3c078c20a275680c2ff724e5b7675890af1335ff22d6138ab25"
+		logic_hash = "v1_sha256_2eedcc1d782df3c078c20a275680c2ff724e5b7675890af1335ff22d6138ab25"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226013,7 +225447,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0E96837Dbe5F4548547203919B96Ac27 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PLAN CORP PTY LTD" and pe.signatures[i].serial=="0e:96:83:7d:be:5f:45:48:54:72:03:91:9b:96:ac:27")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PLAN CORP PTY LTD" and pe.signatures [ i ] . serial == "0e:96:83:7d:be:5f:45:48:54:72:03:91:9b:96:ac:27" )
 }
 import "pe"
 
@@ -226022,13 +225456,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5B320A2F46C99C1Ba1357Bee : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "376aab03-0bc7-5993-bbbd-9bf5b742d29d"
+		id = "5db443a0-ea6e-5b60-90f8-1a5314ed1eb7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L445-L456"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b0a515aa69b5de58cf7d1a496f95038e090cefe511803e7a29332b411a20d19f"
+		logic_hash = "v1_sha256_b0a515aa69b5de58cf7d1a496f95038e090cefe511803e7a29332b411a20d19f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226036,7 +225470,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5B320A2F46C99C1Ba1357Bee : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REGION TOURISM LLC" and pe.signatures[i].serial=="5b:32:0a:2f:46:c9:9c:1b:a1:35:7b:ee")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "REGION TOURISM LLC" and pe.signatures [ i ] . serial == "5b:32:0a:2f:46:c9:9c:1b:a1:35:7b:ee" )
 }
 import "pe"
 
@@ -226045,13 +225479,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02C5351936Abe405Ac760228A40387E8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "32e200c3-678f-5be4-b55b-2a7a32e56843"
+		id = "57f97601-cd51-597e-ab27-d1118c4091a7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L458-L469"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ae9e428c5e7c1ab67be291da93e6d3fa694e3a9b347672817cbf1cac44837a04"
+		logic_hash = "v1_sha256_ae9e428c5e7c1ab67be291da93e6d3fa694e3a9b347672817cbf1cac44837a04"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226059,7 +225493,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02C5351936Abe405Ac760228A40387E8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RESURS-RM OOO" and pe.signatures[i].serial=="02:c5:35:19:36:ab:e4:05:ac:76:02:28:a4:03:87:e8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RESURS-RM OOO" and pe.signatures [ i ] . serial == "02:c5:35:19:36:ab:e4:05:ac:76:02:28:a4:03:87:e8" )
 }
 import "pe"
 
@@ -226068,13 +225502,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_08D4352185317271C1Cec9D05C279Af7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a0197037-874c-55e7-80aa-e8b7156a26a3"
+		id = "fb50e333-031d-58d0-8f91-f00030dcf6a6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L471-L482"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6f4b8a52e152097a6e18f55b6b677eb1ba0f4da78ce68ffa35510bfb485e01e9"
+		logic_hash = "v1_sha256_6f4b8a52e152097a6e18f55b6b677eb1ba0f4da78ce68ffa35510bfb485e01e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226082,7 +225516,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_08D4352185317271C1Cec9D05C279Af7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Retalit LLC" and pe.signatures[i].serial=="08:d4:35:21:85:31:72:71:c1:ce:c9:d0:5c:27:9a:f7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Retalit LLC" and pe.signatures [ i ] . serial == "08:d4:35:21:85:31:72:71:c1:ce:c9:d0:5c:27:9a:f7" )
 }
 import "pe"
 
@@ -226091,13 +225525,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ed8Ade5D73B73Dade6943D557Ff87E5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "ebdab290-d388-528e-b392-0ae87941b69d"
+		id = "24ef11e1-9615-50c7-a632-049fe67a87f4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L484-L495"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e2e269a83a86567bf359996945cddc597406033aa7c5a7acf30b58d30816b28f"
+		logic_hash = "v1_sha256_e2e269a83a86567bf359996945cddc597406033aa7c5a7acf30b58d30816b28f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226105,7 +225539,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ed8Ade5D73B73Dade6943D557Ff87E5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rumikon LLC" and pe.signatures[i].serial=="0e:d8:ad:e5:d7:3b:73:da:de:69:43:d5:57:ff:87:e5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rumikon LLC" and pe.signatures [ i ] . serial == "0e:d8:ad:e5:d7:3b:73:da:de:69:43:d5:57:ff:87:e5" )
 }
 import "pe"
 
@@ -226114,13 +225548,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ed1847A2Ae5D71Def1E833Fddd33D38 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "5e09087b-3fd0-5979-8f98-f242231c8b4f"
+		id = "92be3435-1222-57c8-af40-3fc38204598f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L497-L508"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2acc6d2262bac8bfe49bb244d62be4dcf626dd9b2c9786b7a8963c48b17e6ab9"
+		logic_hash = "v1_sha256_2acc6d2262bac8bfe49bb244d62be4dcf626dd9b2c9786b7a8963c48b17e6ab9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226128,7 +225562,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ed1847A2Ae5D71Def1E833Fddd33D38 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SNAB-RESURS, OOO" and pe.signatures[i].serial=="0e:d1:84:7a:2a:e5:d7:1d:ef:1e:83:3f:dd:d3:3d:38")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SNAB-RESURS, OOO" and pe.signatures [ i ] . serial == "0e:d1:84:7a:2a:e5:d7:1d:ef:1e:83:3f:dd:d3:3d:38" )
 }
 import "pe"
 
@@ -226137,13 +225571,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0292C7D574132Ba5C0441D1C7Ffcb805 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "0792bf83-c0e9-55f8-b6bd-b05bc575e2b4"
+		id = "16a4a4a3-76d2-595e-94c3-806b3cdc37e0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L510-L521"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8d0a6714ce5bfed90c80dcfffe4f1d61ec25c817cdc48907cbc67bcee52a1d9a"
+		logic_hash = "v1_sha256_8d0a6714ce5bfed90c80dcfffe4f1d61ec25c817cdc48907cbc67bcee52a1d9a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226151,7 +225585,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0292C7D574132Ba5C0441D1C7Ffcb805 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TES LOGISTIKA d.o.o." and pe.signatures[i].serial=="02:92:c7:d5:74:13:2b:a5:c0:44:1d:1c:7f:fc:b8:05")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TES LOGISTIKA d.o.o." and pe.signatures [ i ] . serial == "02:92:c7:d5:74:13:2b:a5:c0:44:1d:1c:7f:fc:b8:05" )
 }
 import "pe"
 
@@ -226160,13 +225594,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_028D50Ae0C554B49148E82Db5B1C2699 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "35cd05db-c399-5d37-a191-9170b048e263"
+		id = "b531046e-6587-5695-a2f6-ab70bb751d10"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L523-L534"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7fe907059e83a058705a2884d514938c51fd206b0a175cfb9e8619244c20c62f"
+		logic_hash = "v1_sha256_7fe907059e83a058705a2884d514938c51fd206b0a175cfb9e8619244c20c62f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226174,7 +225608,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_028D50Ae0C554B49148E82Db5B1C2699 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VAS CO PTY LTD" and pe.signatures[i].serial=="02:8d:50:ae:0c:55:4b:49:14:8e:82:db:5b:1c:26:99")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VAS CO PTY LTD" and pe.signatures [ i ] . serial == "02:8d:50:ae:0c:55:4b:49:14:8e:82:db:5b:1c:26:99" )
 }
 import "pe"
 
@@ -226183,13 +225617,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ca41D2D9F5E991F49B162D584B0F386 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "bd395177-daf6-56b1-822c-e659083e0f53"
+		id = "fb3f0020-92ea-54d3-b4a6-7ca40c9ec3f5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L536-L547"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "51f80dfd63b273e62abaa8b60a00525cfdc6b28341466a9f414703382ad088bd"
+		logic_hash = "v1_sha256_51f80dfd63b273e62abaa8b60a00525cfdc6b28341466a9f414703382ad088bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226197,7 +225631,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ca41D2D9F5E991F49B162D584B0F386 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VB CORPORATE PTY. LTD." and pe.signatures[i].serial=="0c:a4:1d:2d:9f:5e:99:1f:49:b1:62:d5:84:b0:f3:86")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VB CORPORATE PTY. LTD." and pe.signatures [ i ] . serial == "0c:a4:1d:2d:9f:5e:99:1f:49:b1:62:d5:84:b0:f3:86" )
 }
 import "pe"
 
@@ -226206,13 +225640,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1389C8373C00B792207Bca20Aa40Aa40 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "7f22411b-6e66-5177-8837-12b82b3b916b"
+		id = "d555aac3-b92f-5f79-8e81-10256e530d66"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L549-L560"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5c0c9ca9e1179f253f1b2ecd9c8a1a0ed17345eb9830201c7c16050339d7ccbc"
+		logic_hash = "v1_sha256_5c0c9ca9e1179f253f1b2ecd9c8a1a0ed17345eb9830201c7c16050339d7ccbc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226220,7 +225654,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1389C8373C00B792207Bca20Aa40Aa40 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VITA-DE d.o.o." and pe.signatures[i].serial=="13:89:c8:37:3c:00:b7:92:20:7b:ca:20:aa:40:aa:40")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VITA-DE d.o.o." and pe.signatures [ i ] . serial == "13:89:c8:37:3c:00:b7:92:20:7b:ca:20:aa:40:aa:40" )
 }
 import "pe"
 
@@ -226229,13 +225663,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A596Fd2779E507Aa466D159706Fe4150 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8cf28e2a-d90f-5bf6-b746-7f46e8f6aa2a"
+		id = "ae07d5c1-0f08-5a94-869b-ef2dc428810f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L562-L573"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b88f346175e9084fdba94b9a8cbbf28a5012d28ab43350d927aac099921ab1a3"
+		logic_hash = "v1_sha256_b88f346175e9084fdba94b9a8cbbf28a5012d28ab43350d927aac099921ab1a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226243,7 +225677,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A596Fd2779E507Aa466D159706Fe4150 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ClamAV" and pe.signatures[i].serial=="a5:96:fd:27:79:e5:07:aa:46:6d:15:97:06:fe:41:50")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ClamAV" and pe.signatures [ i ] . serial == "a5:96:fd:27:79:e5:07:aa:46:6d:15:97:06:fe:41:50" )
 }
 import "pe"
 
@@ -226252,13 +225686,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_45D76C63929C4620Ab706772F5907F82 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6ade67b1-cff5-5e5d-917c-f31010e09b82"
+		id = "a12513a0-4697-5f45-8279-700a565ebe15"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L575-L586"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9854a8812f55f2ae7cddc714b780def3d0511b236685a17ffe202711237c4b7e"
+		logic_hash = "v1_sha256_9854a8812f55f2ae7cddc714b780def3d0511b236685a17ffe202711237c4b7e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226266,7 +225700,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_45D76C63929C4620Ab706772F5907F82 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NEON CRAYON LIMITED" and pe.signatures[i].serial=="45:d7:6c:63:92:9c:46:20:ab:70:67:72:f5:90:7f:82")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NEON CRAYON LIMITED" and pe.signatures [ i ] . serial == "45:d7:6c:63:92:9c:46:20:ab:70:67:72:f5:90:7f:82" )
 }
 import "pe"
 
@@ -226275,13 +225709,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5029Daca439511456D9Ed8153703F4Bc : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "1d7f0d61-fbe7-58d1-a9d8-083678e8b9bd"
+		id = "621fdc6b-3077-5f2e-b997-91819783b173"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L588-L599"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "256b4bebbe4567de9e7d1938dd99f7f9fa13749de2f331aec0bc15f4ab5ab488"
+		logic_hash = "v1_sha256_256b4bebbe4567de9e7d1938dd99f7f9fa13749de2f331aec0bc15f4ab5ab488"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226289,7 +225723,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5029Daca439511456D9Ed8153703F4Bc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE GREEN PARTNERSHIP LTD" and pe.signatures[i].serial=="50:29:da:ca:43:95:11:45:6d:9e:d8:15:37:03:f4:bc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THE GREEN PARTNERSHIP LTD" and pe.signatures [ i ] . serial == "50:29:da:ca:43:95:11:45:6d:9e:d8:15:37:03:f4:bc" )
 }
 import "pe"
 
@@ -226298,13 +225732,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1C7D3F6E116554809F49Ce16Ccb62E84 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "66f4c531-5c0d-5467-a875-eff00a5d00c8"
+		id = "af960e38-d99b-5c3d-b498-51d7ebea0d38"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L601-L612"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f24037e6ac40844095e06ea12cebdf4dd22a35382c728f9586b90e40c57a4188"
+		logic_hash = "v1_sha256_f24037e6ac40844095e06ea12cebdf4dd22a35382c728f9586b90e40c57a4188"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226312,7 +225746,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1C7D3F6E116554809F49Ce16Ccb62E84 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "1549 LIMITED" and pe.signatures[i].serial=="1c:7d:3f:6e:11:65:54:80:9f:49:ce:16:cc:b6:2e:84")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "1549 LIMITED" and pe.signatures [ i ] . serial == "1c:7d:3f:6e:11:65:54:80:9f:49:ce:16:cc:b6:2e:84" )
 }
 import "pe"
 
@@ -226321,13 +225755,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_75522215406335725687Af888Dcdc80C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "712d41e1-6760-5124-8af2-c57a87816237"
+		id = "b48510ac-b03c-5f5a-ae69-dbd9d0197a0b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L614-L625"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5166ea726b1be824e5702c411800236d60c44fbfc89a39b1bc103de965249d7d"
+		logic_hash = "v1_sha256_5166ea726b1be824e5702c411800236d60c44fbfc89a39b1bc103de965249d7d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226335,7 +225769,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_75522215406335725687Af888Dcdc80C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THEESOLUTIONS LTD" and pe.signatures[i].serial=="75:52:22:15:40:63:35:72:56:87:af:88:8d:cd:c8:0c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THEESOLUTIONS LTD" and pe.signatures [ i ] . serial == "75:52:22:15:40:63:35:72:56:87:af:88:8d:cd:c8:0c" )
 }
 import "pe"
 
@@ -226344,13 +225778,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_768Ddcf9Ed8D16A6Bc77451Ee88Dfd90 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f7d24c5f-e102-568e-bf44-47ccaad6225c"
+		id = "23d57973-78cd-58c7-8234-1f24f3ce08ac"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L627-L638"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ba98f0da84b678262ee98e5c5fec2aaeab9a0c304fd4552dd27e87aa54f79cdf"
+		logic_hash = "v1_sha256_ba98f0da84b678262ee98e5c5fec2aaeab9a0c304fd4552dd27e87aa54f79cdf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226358,7 +225792,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_768Ddcf9Ed8D16A6Bc77451Ee88Dfd90 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THEESOLUTIONS LTD" and pe.signatures[i].serial=="76:8d:dc:f9:ed:8d:16:a6:bc:77:45:1e:e8:8d:fd:90")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THEESOLUTIONS LTD" and pe.signatures [ i ] . serial == "76:8d:dc:f9:ed:8d:16:a6:bc:77:45:1e:e8:8d:fd:90" )
 }
 import "pe"
 
@@ -226367,13 +225801,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_59E378994Cf1C0022764896D826E6Bb8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "465d0b0c-c9fa-5364-a5f4-0d765ee40081"
+		id = "e69e25da-25b9-5115-8666-936280347d2e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L640-L651"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1720636723f0eeab074e29e7c9bf2df3c8d951e27b25ea4b7db60f6c00102589"
+		logic_hash = "v1_sha256_1720636723f0eeab074e29e7c9bf2df3c8d951e27b25ea4b7db60f6c00102589"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226381,7 +225815,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_59E378994Cf1C0022764896D826E6Bb8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SEVA MEDICAL LTD" and pe.signatures[i].serial=="59:e3:78:99:4c:f1:c0:02:27:64:89:6d:82:6e:6b:b8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SEVA MEDICAL LTD" and pe.signatures [ i ] . serial == "59:e3:78:99:4c:f1:c0:02:27:64:89:6d:82:6e:6b:b8" )
 }
 import "pe"
 
@@ -226390,13 +225824,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3D2580E89526F7852B570654Efd9A8Bf : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a80493e6-ed0c-597a-a87e-19c8fa8dd8ce"
+		id = "d4f8404e-8d17-52ec-aa57-714a6d74d012"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L668-L679"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "19f418672850536aaac1983b45c3239d5c81c1e4b9b6ee36a761cfc7e2351531"
+		logic_hash = "v1_sha256_19f418672850536aaac1983b45c3239d5c81c1e4b9b6ee36a761cfc7e2351531"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226404,7 +225838,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3D2580E89526F7852B570654Efd9A8Bf : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MIKL LIMITED" and pe.signatures[i].serial=="3d:25:80:e8:95:26:f7:85:2b:57:06:54:ef:d9:a8:bf")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MIKL LIMITED" and pe.signatures [ i ] . serial == "3d:25:80:e8:95:26:f7:85:2b:57:06:54:ef:d9:a8:bf" )
 }
 import "pe"
 
@@ -226413,13 +225847,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Da173Eb1Ac76340Ac058E1Ff4Bf5E1B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "1ef8f8b6-e4e9-5504-94bd-b24e81de5694"
+		id = "5f7dfd38-06e7-545a-9491-44074b664095"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L681-L692"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c9bfbef4470ee2339ef68484f8a4f21628c0cf9a07770d68d91e6c11e0345786"
+		logic_hash = "v1_sha256_c9bfbef4470ee2339ef68484f8a4f21628c0cf9a07770d68d91e6c11e0345786"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226427,7 +225861,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Da173Eb1Ac76340Ac058E1Ff4Bf5E1B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALISA LTD" and pe.signatures[i].serial=="5d:a1:73:eb:1a:c7:63:40:ac:05:8e:1f:f4:bf:5e:1b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALISA LTD" and pe.signatures [ i ] . serial == "5d:a1:73:eb:1a:c7:63:40:ac:05:8e:1f:f4:bf:5e:1b" )
 }
 import "pe"
 
@@ -226436,13 +225870,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_378D5543048E583A06A0819F25Bd9E85 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "3525888c-9558-5164-b94e-b16511a5ea72"
+		id = "4cbb0928-484b-5d64-8b31-fdc5c3429388"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L694-L705"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "29c6ae99675b8ab2c497faad71791c3fc018e92447bd96f5b2b3f426e1a1322b"
+		logic_hash = "v1_sha256_29c6ae99675b8ab2c497faad71791c3fc018e92447bd96f5b2b3f426e1a1322b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226450,7 +225884,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_378D5543048E583A06A0819F25Bd9E85 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KITTY'S LTD" and pe.signatures[i].serial=="37:8d:55:43:04:8e:58:3a:06:a0:81:9f:25:bd:9e:85")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KITTY'S LTD" and pe.signatures [ i ] . serial == "37:8d:55:43:04:8e:58:3a:06:a0:81:9f:25:bd:9e:85" )
 }
 import "pe"
 
@@ -226459,13 +225893,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fdb6F4C09A1Ad69D4Fd2E46Bb1F54313 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "e1250c37-fa89-5b8e-bea2-3b5e14039aea"
+		id = "eb09a1ba-4345-5fce-884e-682ee251aefa"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L720-L731"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ce78ab52d8aeb87ada9cb86007907a8ad46e91982cc8fff43a61e7ec96609eb2"
+		logic_hash = "v1_sha256_ce78ab52d8aeb87ada9cb86007907a8ad46e91982cc8fff43a61e7ec96609eb2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226473,7 +225907,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fdb6F4C09A1Ad69D4Fd2E46Bb1F54313 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FDSMMCME" and pe.signatures[i].serial=="fd:b6:f4:c0:9a:1a:d6:9d:4f:d2:e4:6b:b1:f5:43:13")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FDSMMCME" and pe.signatures [ i ] . serial == "fd:b6:f4:c0:9a:1a:d6:9d:4f:d2:e4:6b:b1:f5:43:13" )
 }
 import "pe"
 
@@ -226482,13 +225916,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E5Bf5B5C0880Db96477C24C18519B9B9 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a28dbf8f-1b30-525d-baaf-51342aaf1cb3"
+		id = "daeab014-460e-5efa-9c95-990f8871e390"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L733-L744"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b3e0401a9cf3005abac24114193f34bf439107bf6661b7c2c0b66ca91438c7b9"
+		logic_hash = "v1_sha256_b3e0401a9cf3005abac24114193f34bf439107bf6661b7c2c0b66ca91438c7b9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226496,7 +225930,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E5Bf5B5C0880Db96477C24C18519B9B9 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WATWGHFC" and pe.signatures[i].serial=="e5:bf:5b:5c:08:80:db:96:47:7c:24:c1:85:19:b9:b9")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "WATWGHFC" and pe.signatures [ i ] . serial == "e5:bf:5b:5c:08:80:db:96:47:7c:24:c1:85:19:b9:b9" )
 }
 import "pe"
 
@@ -226505,13 +225939,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ede6Cfbf9Fa18337B0Fdb49C1F693020 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f1f34147-132e-53a3-b82c-d98121fc3f2c"
+		id = "e56eab7c-815a-5fa7-a0fe-fbf992344acc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L746-L757"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "27f06a7a07b818fd34f5d23fd8e78f041063e035c1f8caa99aaaf53ec73a717a"
+		logic_hash = "v1_sha256_27f06a7a07b818fd34f5d23fd8e78f041063e035c1f8caa99aaaf53ec73a717a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226519,7 +225953,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ede6Cfbf9Fa18337B0Fdb49C1F693020 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "START ARCHITECTURE LTD" and pe.signatures[i].serial=="00:ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "START ARCHITECTURE LTD" and pe.signatures [ i ] . serial == "00:ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20" )
 }
 import "pe"
 
@@ -226528,13 +225962,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4F407Eb50803845Cc43937823E1344C0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d5a6df76-bbbc-5025-b0c4-49e0034c03f3"
+		id = "6ee14e73-effb-57c0-9cab-4ffe53a6e0a5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L759-L770"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bb01e912cf40155b0b00e1901bbb3235048ee033d0ddea7a809f0ce8e871e1ce"
+		logic_hash = "v1_sha256_bb01e912cf40155b0b00e1901bbb3235048ee033d0ddea7a809f0ce8e871e1ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226542,7 +225976,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4F407Eb50803845Cc43937823E1344C0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLOW COOKED VENTURES LTD" and pe.signatures[i].serial=="4f:40:7e:b5:08:03:84:5c:c4:39:37:82:3e:13:44:c0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SLOW COOKED VENTURES LTD" and pe.signatures [ i ] . serial == "4f:40:7e:b5:08:03:84:5c:c4:39:37:82:3e:13:44:c0" )
 }
 import "pe"
 
@@ -226551,13 +225985,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Bffef48E6A321B418041310Fdb9B0D0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "fc945c76-b743-52d3-8e15-77afdc629f6d"
+		id = "ef412928-2ec9-568e-bcd2-0f54fd516bf9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L785-L796"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8d0223b6366f7bc22fd6dd053c1fb6c9e52f80b3bdf9ee46017ddf038bd1e00f"
+		logic_hash = "v1_sha256_8d0223b6366f7bc22fd6dd053c1fb6c9e52f80b3bdf9ee46017ddf038bd1e00f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226565,7 +225999,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Bffef48E6A321B418041310Fdb9B0D0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "A&D DOMUS LIMITED" and pe.signatures[i].serial=="2b:ff:ef:48:e6:a3:21:b4:18:04:13:10:fd:b9:b0:d0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "A&D DOMUS LIMITED" and pe.signatures [ i ] . serial == "2b:ff:ef:48:e6:a3:21:b4:18:04:13:10:fd:b9:b0:d0" )
 }
 import "pe"
 
@@ -226574,13 +226008,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_73B60719Ee57974447C68187E49969A2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "c72fb0b8-efdc-5734-9754-2289bd95ae3c"
+		id = "0f0145e0-ad89-53f4-9320-7d9fcf954c03"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L798-L809"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f9cc0f526a3acbfc30c6b76b6705f1a2d9c905b9bb7c996e4db3ca6d4d63be1c"
+		logic_hash = "v1_sha256_f9cc0f526a3acbfc30c6b76b6705f1a2d9c905b9bb7c996e4db3ca6d4d63be1c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226588,7 +226022,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_73B60719Ee57974447C68187E49969A2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIT HORIZON LIMITED" and pe.signatures[i].serial=="73:b6:07:19:ee:57:97:44:47:c6:81:87:e4:99:69:a2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIT HORIZON LIMITED" and pe.signatures [ i ] . serial == "73:b6:07:19:ee:57:97:44:47:c6:81:87:e4:99:69:a2" )
 }
 import "pe"
 
@@ -226597,13 +226031,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2925263B65C7Fe1Cd47B0851Cc6951E3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "9e531592-b68c-550b-8609-51f7c9ac63ae"
+		id = "ec8bf1ab-f644-5b50-b71c-34d5a46ed0b4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L811-L822"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "163293ce805cdd3ec265fb9c527a5ce19ddab0f6b96355acb636c941ce0bc5f2"
+		logic_hash = "v1_sha256_163293ce805cdd3ec265fb9c527a5ce19ddab0f6b96355acb636c941ce0bc5f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226611,7 +226045,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2925263B65C7Fe1Cd47B0851Cc6951E3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "tuning buddy limited" and pe.signatures[i].serial=="29:25:26:3b:65:c7:fe:1c:d4:7b:08:51:cc:69:51:e3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "tuning buddy limited" and pe.signatures [ i ] . serial == "29:25:26:3b:65:c7:fe:1c:d4:7b:08:51:cc:69:51:e3" )
 }
 import "pe"
 
@@ -226620,13 +226054,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4Ff4Eda5Fa641E70162713426401F438 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "cc81ed1d-bd77-5cec-8bee-23e8ef448edc"
+		id = "9da087b2-b26a-5b36-ba32-09d08b53b5f4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L824-L835"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d08e12e74e9c0b7a89ffa81a1b8595953d857e571a5b7a6947eba18bf39610f6"
+		logic_hash = "v1_sha256_d08e12e74e9c0b7a89ffa81a1b8595953d857e571a5b7a6947eba18bf39610f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226634,7 +226068,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4Ff4Eda5Fa641E70162713426401F438 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DUHANEY LIMITED" and pe.signatures[i].serial=="4f:f4:ed:a5:fa:64:1e:70:16:27:13:42:64:01:f4:38")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DUHANEY LIMITED" and pe.signatures [ i ] . serial == "4f:f4:ed:a5:fa:64:1e:70:16:27:13:42:64:01:f4:38" )
 }
 import "pe"
 
@@ -226643,13 +226077,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_04C7Cdcc1698E25B493Eb4338D5E2F8B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "446608c2-4c9e-56a9-8ac4-2c90397d68e5"
+		id = "7f512be3-a10a-58e4-a746-9b7759f8eac5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L837-L848"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d1e81d040a279d6024989acbdd40f69de99c97baf789591400370806e846a1c4"
+		logic_hash = "v1_sha256_d1e81d040a279d6024989acbdd40f69de99c97baf789591400370806e846a1c4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226657,7 +226091,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_04C7Cdcc1698E25B493Eb4338D5E2F8B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "3AN LIMITED" and pe.signatures[i].serial=="04:c7:cd:cc:16:98:e2:5b:49:3e:b4:33:8d:5e:2f:8b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "3AN LIMITED" and pe.signatures [ i ] . serial == "04:c7:cd:cc:16:98:e2:5b:49:3e:b4:33:8d:5e:2f:8b" )
 }
 import "pe"
 
@@ -226666,13 +226100,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4C450Eccd61D334E0Afb2B2D9Bb1D812 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "116c86c1-facf-5b69-94f1-3f0f81c38a7d"
+		id = "82a69a9d-64ab-5989-ace7-8553d916ea13"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L850-L861"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "70851d76af4a4dfe8f1ca4de9925f030d9b937050876828775b78eddd123e3cd"
+		logic_hash = "v1_sha256_70851d76af4a4dfe8f1ca4de9925f030d9b937050876828775b78eddd123e3cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226680,7 +226114,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4C450Eccd61D334E0Afb2B2D9Bb1D812 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ANJELA KEY LIMITED" and pe.signatures[i].serial=="4c:45:0e:cc:d6:1d:33:4e:0a:fb:2b:2d:9b:b1:d8:12")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ANJELA KEY LIMITED" and pe.signatures [ i ] . serial == "4c:45:0e:cc:d6:1d:33:4e:0a:fb:2b:2d:9b:b1:d8:12" )
 }
 import "pe"
 
@@ -226689,13 +226123,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0E1Bacb85E77D355Ea69Ba0B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "18e2dce1-c6aa-55d8-907a-75097feb7acf"
+		id = "f0a4e6cd-9d0f-5af1-96eb-3811b0f807bd"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L863-L874"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f0753c83001e2b9d235afe51ce5d245e085551584ee052a35aaadd95c6c5eeb7"
+		logic_hash = "v1_sha256_f0753c83001e2b9d235afe51ce5d245e085551584ee052a35aaadd95c6c5eeb7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226703,7 +226137,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0E1Bacb85E77D355Ea69Ba0B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BULDOK LIMITED" and pe.signatures[i].serial=="0e:1b:ac:b8:5e:77:d3:55:ea:69:ba:0b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BULDOK LIMITED" and pe.signatures [ i ] . serial == "0e:1b:ac:b8:5e:77:d3:55:ea:69:ba:0b" )
 }
 import "pe"
 
@@ -226712,13 +226146,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5998B4Affe2Adf592E6528Ff800E567C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "b81787fd-a8f1-5640-bf8a-8129f708a337"
+		id = "c0179140-5d07-572f-a76b-65792f6e0912"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L876-L887"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d9f589ce6367517f3c93b7b0675b19249108849e52bd9264e31bf8109e5a121f"
+		logic_hash = "v1_sha256_d9f589ce6367517f3c93b7b0675b19249108849e52bd9264e31bf8109e5a121f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226726,7 +226160,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5998B4Affe2Adf592E6528Ff800E567C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BEAT GOES ON LIMITED" and pe.signatures[i].serial=="59:98:b4:af:fe:2a:df:59:2e:65:28:ff:80:0e:56:7c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BEAT GOES ON LIMITED" and pe.signatures [ i ] . serial == "59:98:b4:af:fe:2a:df:59:2e:65:28:ff:80:0e:56:7c" )
 }
 import "pe"
 
@@ -226735,13 +226169,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B7E0Cf12E4Ae50Dd643A24285485602F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d314925c-c6b2-5a7f-ba73-038ea4759149"
+		id = "80e3e1d6-b244-54c6-9fa9-4d4427dff785"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L889-L900"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7aefb436b7e3865b1abb6bbc3e0027a628f39e25cb4b28f35f070e000c19c1c7"
+		logic_hash = "v1_sha256_7aefb436b7e3865b1abb6bbc3e0027a628f39e25cb4b28f35f070e000c19c1c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226749,7 +226183,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B7E0Cf12E4Ae50Dd643A24285485602F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GESO LTD" and pe.signatures[i].serial=="00:b7:e0:cf:12:e4:ae:50:dd:64:3a:24:28:54:85:60:2f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GESO LTD" and pe.signatures [ i ] . serial == "00:b7:e0:cf:12:e4:ae:50:dd:64:3a:24:28:54:85:60:2f" )
 }
 import "pe"
 
@@ -226758,13 +226192,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_767436921B2698Bd18400A24B01341B6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "ffd19457-1a5d-5782-89e2-3dd4090f124f"
+		id = "5fea4100-53fd-5e70-90d8-55fe1899b6f4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L902-L913"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b09ec625a06dcf90df52c56b78889f24d55dbd8cbd7d82a07bdbc842318ff19a"
+		logic_hash = "v1_sha256_b09ec625a06dcf90df52c56b78889f24d55dbd8cbd7d82a07bdbc842318ff19a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226772,7 +226206,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_767436921B2698Bd18400A24B01341B6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REBROSE LEISURE LIMITED" and pe.signatures[i].serial=="76:74:36:92:1b:26:98:bd:18:40:0a:24:b0:13:41:b6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "REBROSE LEISURE LIMITED" and pe.signatures [ i ] . serial == "76:74:36:92:1b:26:98:bd:18:40:0a:24:b0:13:41:b6" )
 }
 import "pe"
 
@@ -226781,13 +226215,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_26B125E669E77A5E58Db378E9816Fbc3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "18985965-9e26-526c-9354-20667d472615"
+		id = "e2de7d19-7d53-562e-990d-0633a16e1406"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L915-L926"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "859793bfeba55c9912a1e18db86cd391d4c4981f4be11f3a53d887d429882671"
+		logic_hash = "v1_sha256_859793bfeba55c9912a1e18db86cd391d4c4981f4be11f3a53d887d429882671"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226795,7 +226229,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_26B125E669E77A5E58Db378E9816Fbc3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLOWER DELI LTD" and pe.signatures[i].serial=="26:b1:25:e6:69:e7:7a:5e:58:db:37:8e:98:16:fb:c3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FLOWER DELI LTD" and pe.signatures [ i ] . serial == "26:b1:25:e6:69:e7:7a:5e:58:db:37:8e:98:16:fb:c3" )
 }
 import "pe"
 
@@ -226804,13 +226238,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_29A248A77D5D4066Fe5Da75F32102Bb5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "b71f4ee4-55d1-51c7-8fc3-1c6fcaa64a86"
+		id = "ae83463c-c052-5acf-abb0-28aa15ce0f4e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L928-L939"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "063a8b361e9fc91619912109427f6a0cbc7755e85dae820ea0f16709ac580ed1"
+		logic_hash = "v1_sha256_063a8b361e9fc91619912109427f6a0cbc7755e85dae820ea0f16709ac580ed1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226818,7 +226252,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_29A248A77D5D4066Fe5Da75F32102Bb5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SUN & STARZ LIMITED" and pe.signatures[i].serial=="29:a2:48:a7:7d:5d:40:66:fe:5d:a7:5f:32:10:2b:b5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SUN & STARZ LIMITED" and pe.signatures [ i ] . serial == "29:a2:48:a7:7d:5d:40:66:fe:5d:a7:5f:32:10:2b:b5" )
 }
 import "pe"
 
@@ -226827,13 +226261,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3A9Bdec10E00E780316Baaebfe7A772C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "0879b4f7-4058-5391-b8bf-90a46ef337f6"
+		id = "73c2f158-2599-55b4-8809-4633d490d301"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L941-L952"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f1c0d23c9aa2ff705e3350e15b7ff83fc007ce6aaa57c4ed59201f3022f5d00a"
+		logic_hash = "v1_sha256_f1c0d23c9aa2ff705e3350e15b7ff83fc007ce6aaa57c4ed59201f3022f5d00a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226841,7 +226275,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3A9Bdec10E00E780316Baaebfe7A772C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PLAN ALPHA LIMITED" and pe.signatures[i].serial=="3a:9b:de:c1:0e:00:e7:80:31:6b:aa:eb:fe:7a:77:2c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PLAN ALPHA LIMITED" and pe.signatures [ i ] . serial == "3a:9b:de:c1:0e:00:e7:80:31:6b:aa:eb:fe:7a:77:2c" )
 }
 import "pe"
 
@@ -226850,13 +226284,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_73F9819F3A1A49Bac1E220D7F3E0009B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "06f448cf-1f0e-5db5-bdb5-30238c5f7341"
+		id = "a1241ae6-f473-5928-b5af-e0c51ee92e94"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L954-L965"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9244fae0be6c1addbd0c740d7e153fd4109101184bc61375ddadb6d784769010"
+		logic_hash = "v1_sha256_9244fae0be6c1addbd0c740d7e153fd4109101184bc61375ddadb6d784769010"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226864,7 +226298,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_73F9819F3A1A49Bac1E220D7F3E0009B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jean Binquet" and pe.signatures[i].serial=="73:f9:81:9f:3a:1a:49:ba:c1:e2:20:d7:f3:e0:00:9b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Jean Binquet" and pe.signatures [ i ] . serial == "73:f9:81:9f:3a:1a:49:ba:c1:e2:20:d7:f3:e0:00:9b" )
 }
 import "pe"
 
@@ -226873,13 +226307,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0989C97804C93Ec0004E2843 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "13b2dd06-878e-5539-91d1-eff8607997c3"
+		id = "a52bdc4b-439b-5751-9507-d40068d56ca9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L967-L978"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "65b695eed221db86928ebd32a1f3cb35729754ba41cb2e5b6cf944890d211120"
+		logic_hash = "v1_sha256_65b695eed221db86928ebd32a1f3cb35729754ba41cb2e5b6cf944890d211120"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226887,7 +226321,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0989C97804C93Ec0004E2843 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shanghai Hintsoft Co., Ltd." and pe.signatures[i].serial=="09:89:c9:78:04:c9:3e:c0:00:4e:28:43")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shanghai Hintsoft Co., Ltd." and pe.signatures [ i ] . serial == "09:89:c9:78:04:c9:3e:c0:00:4e:28:43" )
 }
 import "pe"
 
@@ -226896,13 +226330,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Ba32F984444Ea464Bea41D99A977Ea8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6fee5b3f-f72e-531e-b11e-e402207072ff"
+		id = "4b3d02c8-1652-5797-ac27-5c591e1a982d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L980-L991"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fcabdd038a2594dffddbfff71a7a8a1abae89c637355b3be7e5f26c1eb9e39c7"
+		logic_hash = "v1_sha256_fcabdd038a2594dffddbfff71a7a8a1abae89c637355b3be7e5f26c1eb9e39c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226910,7 +226344,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Ba32F984444Ea464Bea41D99A977Ea8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JIN CONSULTANCY LIMITED" and pe.signatures[i].serial=="6b:a3:2f:98:44:44:ea:46:4b:ea:41:d9:9a:97:7e:a8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JIN CONSULTANCY LIMITED" and pe.signatures [ i ] . serial == "6b:a3:2f:98:44:44:ea:46:4b:ea:41:d9:9a:97:7e:a8" )
 }
 import "pe"
 
@@ -226919,13 +226353,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4F5A9Bf75Da76B949645475473793A7D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "094b56b9-15fc-5366-9023-c706613882c4"
+		id = "2868a00c-a99b-5ae8-beb1-484be07e4aac"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L993-L1004"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8f00efcd62a934fb6ec0205dc1d7bb7f7f3ab168150fee942536ef92f686d21d"
+		logic_hash = "v1_sha256_8f00efcd62a934fb6ec0205dc1d7bb7f7f3ab168150fee942536ef92f686d21d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226933,7 +226367,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4F5A9Bf75Da76B949645475473793A7D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EXEC CONTROL LIMITED" and pe.signatures[i].serial=="4f:5a:9b:f7:5d:a7:6b:94:96:45:47:54:73:79:3a:7d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "EXEC CONTROL LIMITED" and pe.signatures [ i ] . serial == "4f:5a:9b:f7:5d:a7:6b:94:96:45:47:54:73:79:3a:7d" )
 }
 import "pe"
 
@@ -226942,13 +226376,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_68B050Aa3D2C16F77E14A16Dc8D1C1Ac : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "b49d3f1d-34b4-578e-ab36-b0744deef548"
+		id = "328347e4-2343-5423-ab6b-357d2be8474c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1006-L1017"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9de23897fbfe3c4a6d649558d1d71f890117ec80967bc5bd975aa6f33576c702"
+		logic_hash = "v1_sha256_9de23897fbfe3c4a6d649558d1d71f890117ec80967bc5bd975aa6f33576c702"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226956,7 +226390,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_68B050Aa3D2C16F77E14A16Dc8D1C1Ac : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLOW POKE LTD" and pe.signatures[i].serial=="68:b0:50:aa:3d:2c:16:f7:7e:14:a1:6d:c8:d1:c1:ac")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SLOW POKE LTD" and pe.signatures [ i ] . serial == "68:b0:50:aa:3d:2c:16:f7:7e:14:a1:6d:c8:d1:c1:ac" )
 }
 import "pe"
 
@@ -226965,13 +226399,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0F2B44E398Ba76C5F57779C41548607B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6a962fd8-c2cd-5abd-8f80-95697771037c"
+		id = "942dc1be-7790-5de6-b240-9e4ba4a31215"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1019-L1030"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "172622595a3f6a6ab4ac2677c3064fab87b0a872c261031331c99cbd58671da2"
+		logic_hash = "v1_sha256_172622595a3f6a6ab4ac2677c3064fab87b0a872c261031331c99cbd58671da2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -226979,7 +226413,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0F2B44E398Ba76C5F57779C41548607B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIGITAL DR" and pe.signatures[i].serial=="0f:2b:44:e3:98:ba:76:c5:f5:77:79:c4:15:48:60:7b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DIGITAL DR" and pe.signatures [ i ] . serial == "0f:2b:44:e3:98:ba:76:c5:f5:77:79:c4:15:48:60:7b" )
 }
 import "pe"
 
@@ -226988,13 +226422,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Ad4Ce116B131Daf8D784C6Fab2Ea1F1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "abb6c51b-987a-5a1f-9d31-1422b41a6a6d"
+		id = "260ba222-9998-5a06-a226-56439fd306f3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1032-L1043"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3221ffd8203cbef8735ed48acd77daae6bee33ade236b1ff2ced81a0f27d4ce5"
+		logic_hash = "v1_sha256_3221ffd8203cbef8735ed48acd77daae6bee33ade236b1ff2ced81a0f27d4ce5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227002,7 +226436,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Ad4Ce116B131Daf8D784C6Fab2Ea1F1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORDARA LTD" and pe.signatures[i].serial=="5a:d4:ce:11:6b:13:1d:af:8d:78:4c:6f:ab:2e:a1:f1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ORDARA LTD" and pe.signatures [ i ] . serial == "5a:d4:ce:11:6b:13:1d:af:8d:78:4c:6f:ab:2e:a1:f1" )
 }
 import "pe"
 
@@ -227011,13 +226445,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_48Ce01Ac7E137F4313Cc5723Af817Da0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d5eb08a7-eb2b-5318-a941-da3ce0a6b634"
+		id = "1afc0e10-76fe-5fe3-9c33-dc291bbc1643"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1045-L1056"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d92d4aa491b028620f17fd997a782f5e75247b2d3de7ef9026e2c62309275ce1"
+		logic_hash = "v1_sha256_d92d4aa491b028620f17fd997a782f5e75247b2d3de7ef9026e2c62309275ce1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227025,7 +226459,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_48Ce01Ac7E137F4313Cc5723Af817Da0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ET HOMES LTD" and pe.signatures[i].serial=="48:ce:01:ac:7e:13:7f:43:13:cc:57:23:af:81:7d:a0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ET HOMES LTD" and pe.signatures [ i ] . serial == "48:ce:01:ac:7e:13:7f:43:13:cc:57:23:af:81:7d:a0" )
 }
 import "pe"
 
@@ -227034,13 +226468,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C7E62986C36246C64B8C9F2348141570 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "44d75e1d-5d5b-5d6f-8f7b-d94cd3908ed7"
+		id = "3f17562a-c6d5-57ee-98d1-1d6d1b5d2512"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1058-L1069"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dfb669ad42ac16d954405dc243b9d81dd9a748a14044d1fce3b71b490c58c82e"
+		logic_hash = "v1_sha256_dfb669ad42ac16d954405dc243b9d81dd9a748a14044d1fce3b71b490c58c82e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227048,7 +226482,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C7E62986C36246C64B8C9F2348141570 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC Mail.Ru" and pe.signatures[i].serial=="c7:e6:29:86:c3:62:46:c6:4b:8c:9f:23:48:14:15:70")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LLC Mail.Ru" and pe.signatures [ i ] . serial == "c7:e6:29:86:c3:62:46:c6:4b:8c:9f:23:48:14:15:70" )
 }
 import "pe"
 
@@ -227057,13 +226491,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ee663737D82Df09C7038A6A6693A8323 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "c6684a9f-ca92-53e9-9723-9d2437a16fc6"
+		id = "862d0cdd-f712-566c-8e00-f50fcbfab338"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1086-L1097"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4057374b73ef13b6f101b939e11569cf010896097fd9322ab490c73d6808fa6f"
+		logic_hash = "v1_sha256_4057374b73ef13b6f101b939e11569cf010896097fd9322ab490c73d6808fa6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227071,7 +226505,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ee663737D82Df09C7038A6A6693A8323 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KREACIJA d.o.o." and pe.signatures[i].serial=="00:ee:66:37:37:d8:2d:f0:9c:70:38:a6:a6:69:3a:83:23")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KREACIJA d.o.o." and pe.signatures [ i ] . serial == "00:ee:66:37:37:d8:2d:f0:9c:70:38:a6:a6:69:3a:83:23" )
 }
 import "pe"
 
@@ -227080,13 +226514,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3D568325Dec56Abf48E72317675Cacb7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "e958b9c4-2f1b-5b5d-8a44-7393204a6f41"
+		id = "a8c7a2ec-15ea-55e0-b37c-d586b8a418f8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1099-L1110"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a575c9989a3ee7824e8734940877ddb255b19070def460508f70d32f457411ac"
+		logic_hash = "v1_sha256_a575c9989a3ee7824e8734940877ddb255b19070def460508f70d32f457411ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227094,7 +226528,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3D568325Dec56Abf48E72317675Cacb7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Virtual Byte F-B-I" and pe.signatures[i].serial=="3d:56:83:25:de:c5:6a:bf:48:e7:23:17:67:5c:ac:b7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Virtual Byte F-B-I" and pe.signatures [ i ] . serial == "3d:56:83:25:de:c5:6a:bf:48:e7:23:17:67:5c:ac:b7" )
 }
 import "pe"
 
@@ -227103,13 +226537,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3533080B377F80C0Ea826B2492Bf767B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "42d2328e-742e-5c35-aa14-3b42442543ce"
+		id = "66e1c090-d945-500d-9877-034eb32e2dad"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1127-L1138"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a7adb9190be4a9cf60adf4b55c8abaa80e01224ea834fc05705afef37703899e"
+		logic_hash = "v1_sha256_a7adb9190be4a9cf60adf4b55c8abaa80e01224ea834fc05705afef37703899e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227117,7 +226551,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3533080B377F80C0Ea826B2492Bf767B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xA8\\x9C\\xE8\\xBF\\xAA\\xD0\\x91\\xE8\\xBF\\xAA\\xD0\\x91\\xE5\\xA8\\x9C\\xE5\\x93\\xA6\\xE5\\xB0\\xBA\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xD0\\x91\\xE8\\xBF\\xAA\\xD0\\x91\\xE5\\xB0\\xBA\\xE5\\xB0\\xBA\\xE8\\xBF\\xAA\\xE5\\x93\\xA6\\xE8\\xBF\\xAA\\xE5\\x8B\\x92\\xD0\\x91\\xE5\\x8B\\x92\\xE5\\x93\\xA6\\xE5\\x8B\\x92\\xE5\\x93\\xA6\\xD0\\x91" and pe.signatures[i].serial=="35:33:08:0b:37:7f:80:c0:ea:82:6b:24:92:bf:76:7b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\xA8\\x9C\\xE8\\xBF\\xAA\\xD0\\x91\\xE8\\xBF\\xAA\\xD0\\x91\\xE5\\xA8\\x9C\\xE5\\x93\\xA6\\xE5\\xB0\\xBA\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xD0\\x91\\xE8\\xBF\\xAA\\xD0\\x91\\xE5\\xB0\\xBA\\xE5\\xB0\\xBA\\xE8\\xBF\\xAA\\xE5\\x93\\xA6\\xE8\\xBF\\xAA\\xE5\\x8B\\x92\\xD0\\x91\\xE5\\x8B\\x92\\xE5\\x93\\xA6\\xE5\\x8B\\x92\\xE5\\x93\\xA6\\xD0\\x91" and pe.signatures [ i ] . serial == "35:33:08:0b:37:7f:80:c0:ea:82:6b:24:92:bf:76:7b" )
 }
 import "pe"
 
@@ -227126,13 +226560,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B0Ecd32F95F8761B8A6D5710C7F34590 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "2535c9eb-ed4a-52b9-8ad5-80c44c035135"
+		id = "17eeac94-5f6e-5099-aa48-d1dc20a6477d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1140-L1151"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5c181dab1f39138c67650d6654353de2be29cdbf45e0f5235776d28d40194f24"
+		logic_hash = "v1_sha256_5c181dab1f39138c67650d6654353de2be29cdbf45e0f5235776d28d40194f24"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227140,7 +226574,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B0Ecd32F95F8761B8A6D5710C7F34590 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x96\\xAF\\xD0\\xA8\\xD0\\xA8\\xE5\\xBC\\x97\\xE6\\xAF\\x94\\xE5\\xBC\\x97\\xD0\\xA8\\xE6\\xAF\\x94\\xD0\\xA8\\xE5\\xBC\\x97\\xD0\\xA8\\xE5\\xB0\\x94\\xE5\\xBC\\x97\\xE5\\xBC\\x97\\xD0\\xA8\\xE5\\xB0\\x94\\xD0\\xA8\\xE6\\x96\\xAF\\xE5\\xB0\\x94\\xE5\\xBC\\x97" and pe.signatures[i].serial=="00:b0:ec:d3:2f:95:f8:76:1b:8a:6d:57:10:c7:f3:45:90")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE6\\x96\\xAF\\xD0\\xA8\\xD0\\xA8\\xE5\\xBC\\x97\\xE6\\xAF\\x94\\xE5\\xBC\\x97\\xD0\\xA8\\xE6\\xAF\\x94\\xD0\\xA8\\xE5\\xBC\\x97\\xD0\\xA8\\xE5\\xB0\\x94\\xE5\\xBC\\x97\\xE5\\xBC\\x97\\xD0\\xA8\\xE5\\xB0\\x94\\xD0\\xA8\\xE6\\x96\\xAF\\xE5\\xB0\\x94\\xE5\\xBC\\x97" and pe.signatures [ i ] . serial == "00:b0:ec:d3:2f:95:f8:76:1b:8a:6d:57:10:c7:f3:45:90" )
 }
 import "pe"
 
@@ -227149,13 +226583,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3A727248E1940C5Bf91A466B29C3B9Cd : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "db43ed73-de46-526e-a255-137a4eaaedce"
+		id = "ff72521f-8287-5303-8a70-ef00971ec16c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1153-L1164"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0afeb50b36d0ca1adbd6cb3accccb3ee093434b8c0bd8b03ae70ecc45c7423b5"
+		logic_hash = "v1_sha256_0afeb50b36d0ca1adbd6cb3accccb3ee093434b8c0bd8b03ae70ecc45c7423b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227163,7 +226597,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3A727248E1940C5Bf91A466B29C3B9Cd : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x90\\x89\\xE5\\x90\\x89\\xD0\\x98\\xE5\\x90\\x89\\xD0\\x98\\xE4\\xB8\\x9D\\xE4\\xB8\\x9D" and pe.signatures[i].serial=="3a:72:72:48:e1:94:0c:5b:f9:1a:46:6b:29:c3:b9:cd")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\x90\\x89\\xE5\\x90\\x89\\xD0\\x98\\xE5\\x90\\x89\\xD0\\x98\\xE4\\xB8\\x9D\\xE4\\xB8\\x9D" and pe.signatures [ i ] . serial == "3a:72:72:48:e1:94:0c:5b:f9:1a:46:6b:29:c3:b9:cd" )
 }
 import "pe"
 
@@ -227172,13 +226606,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ce40906451925405D0F6C130Db461F71 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "5e858504-b1c4-579e-b0e8-f6cf4f434672"
+		id = "82acbd4b-1f09-5d62-9ef3-11a54b57ee73"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1166-L1177"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "02b03b18942cff20ddce429f7be7cc9e54dfbf4884c79c7438c9b9d4415c5b93"
+		logic_hash = "v1_sha256_02b03b18942cff20ddce429f7be7cc9e54dfbf4884c79c7438c9b9d4415c5b93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227186,7 +226620,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ce40906451925405D0F6C130Db461F71 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xD0\\xA5\\xE7\\xBB\\xB4\\xE6\\x9D\\xB0\\xE6\\x96\\xAF\\xE6\\x96\\xAF\\xE7\\xBB\\xB4\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xD0\\xA5\\xE6\\x96\\xAF\\xD0\\xA5\\xD0\\xA5\\xE6\\x96\\xAF\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE6\\x96\\xAF\\xE6\\x9D\\xB0" and pe.signatures[i].serial=="00:ce:40:90:64:51:92:54:05:d0:f6:c1:30:db:46:1f:71")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xD0\\xA5\\xE7\\xBB\\xB4\\xE6\\x9D\\xB0\\xE6\\x96\\xAF\\xE6\\x96\\xAF\\xE7\\xBB\\xB4\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xD0\\xA5\\xE6\\x96\\xAF\\xD0\\xA5\\xD0\\xA5\\xE6\\x96\\xAF\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE6\\x96\\xAF\\xE6\\x9D\\xB0" and pe.signatures [ i ] . serial == "00:ce:40:90:64:51:92:54:05:d0:f6:c1:30:db:46:1f:71" )
 }
 import "pe"
 
@@ -227195,13 +226629,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E130D3537E0B7A4Dda47B4D6F95F9481 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "efcc63ba-51f9-5b16-a33d-05d536efa6c6"
+		id = "4ea621dc-4999-5c95-89f4-b16a974aae67"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1179-L1190"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c394a115fa3fbd7fb2838b61b3c439df3daa9aa44b1901d1740060df0539411e"
+		logic_hash = "v1_sha256_c394a115fa3fbd7fb2838b61b3c439df3daa9aa44b1901d1740060df0539411e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227209,7 +226643,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E130D3537E0B7A4Dda47B4D6F95F9481 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE4\\xBC\\x8A\\xE6\\x96\\xAF\\xE8\\x89\\xBE\\xE4\\xBC\\x8A\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xE5\\x8B\\x92" and pe.signatures[i].serial=="00:e1:30:d3:53:7e:0b:7a:4d:da:47:b4:d6:f9:5f:94:81")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE4\\xBC\\x8A\\xE6\\x96\\xAF\\xE8\\x89\\xBE\\xE4\\xBC\\x8A\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xE5\\x8B\\x92" and pe.signatures [ i ] . serial == "00:e1:30:d3:53:7e:0b:7a:4d:da:47:b4:d6:f9:5f:94:81" )
 }
 import "pe"
 
@@ -227218,13 +226652,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4Bec555C48Aada75E83C09C9Ad22Dc7C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "664b8f55-03f8-5f36-aaf7-60ee4e613af4"
+		id = "1ddbcfce-30df-5c79-8bde-2241cf64bfc9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1192-L1203"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "de4562f70bbe25aa053f2476efca12b99cd4f2ee721df620d02d004bac2a59f9"
+		logic_hash = "v1_sha256_de4562f70bbe25aa053f2476efca12b99cd4f2ee721df620d02d004bac2a59f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227232,7 +226666,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4Bec555C48Aada75E83C09C9Ad22Dc7C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xD0\\x92\\xE5\\xB1\\x81\\xE5\\xB0\\x94\\xE5\\x90\\xBE\\xD0\\x92\\xE5\\x90\\x89\\xE5\\xB0\\x94\\xE5\\x90\\xBE\\xD0\\x92\\xE4\\xB8\\x9D\\xE5\\xB1\\x81" and pe.signatures[i].serial=="4b:ec:55:5c:48:aa:da:75:e8:3c:09:c9:ad:22:dc:7c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xD0\\x92\\xE5\\xB1\\x81\\xE5\\xB0\\x94\\xE5\\x90\\xBE\\xD0\\x92\\xE5\\x90\\x89\\xE5\\xB0\\x94\\xE5\\x90\\xBE\\xD0\\x92\\xE4\\xB8\\x9D\\xE5\\xB1\\x81" and pe.signatures [ i ] . serial == "4b:ec:55:5c:48:aa:da:75:e8:3c:09:c9:ad:22:dc:7c" )
 }
 import "pe"
 
@@ -227241,13 +226675,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009356E0361Bcf983Ab14276C332F814E7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6b5966d7-59ab-5d8a-936e-71b937424234"
+		id = "35ad52af-fb1b-5917-b7e7-b60b7c94c75c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1205-L1216"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e85adfa9c004a46fe6060a36def3f8387de1484eb9fc3ae935d00265da135eab"
+		logic_hash = "v1_sha256_e85adfa9c004a46fe6060a36def3f8387de1484eb9fc3ae935d00265da135eab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227255,7 +226689,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009356E0361Bcf983Ab14276C332F814E7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\x89\\xBE\\xE5\\x90\\x89\\xE4\\xB8\\x9D\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE4\\xB8\\x9D\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A\\xE6\\x9D\\xB0\\xE5\\x90\\x89\\xE4\\xBC\\x8A" and pe.signatures[i].serial=="00:93:56:e0:36:1b:cf:98:3a:b1:42:76:c3:32:f8:14:e7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE8\\x89\\xBE\\xE5\\x90\\x89\\xE4\\xB8\\x9D\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE4\\xB8\\x9D\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A\\xE6\\x9D\\xB0\\xE5\\x90\\x89\\xE4\\xBC\\x8A" and pe.signatures [ i ] . serial == "00:93:56:e0:36:1b:cf:98:3a:b1:42:76:c3:32:f8:14:e7" )
 }
 import "pe"
 
@@ -227264,13 +226698,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E5D20477E850C9F35C5C47123Ef34271 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "c8777008-b15f-58c8-9172-f54a4864d2cc"
+		id = "0ab9efe7-fbbd-5e1a-8aca-f1e418accaef"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1218-L1229"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "984f6dba8613ca43a9ffdcba63e57516bd2c6df02698b87aa4a080f89cc6abc0"
+		logic_hash = "v1_sha256_984f6dba8613ca43a9ffdcba63e57516bd2c6df02698b87aa4a080f89cc6abc0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227278,7 +226712,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E5D20477E850C9F35C5C47123Ef34271 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\x89\\xBE\\xD0\\x92\\xE5\\xBE\\xB7\\xE8\\x89\\xBE\\xE5\\x8B\\x92\\xD0\\x92\\xE8\\xB4\\x9D\\xE8\\x89\\xBE\\xE5\\xBE\\xB7\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92\\xE8\\xB4\\x9D\\xE5\\x8B\\x92\\xD0\\x92\\xE5\\xBE\\xB7\\xE8\\xB4\\x9D\\xD0\\x92\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92" and pe.signatures[i].serial=="00:e5:d2:04:77:e8:50:c9:f3:5c:5c:47:12:3e:f3:42:71")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE8\\x89\\xBE\\xD0\\x92\\xE5\\xBE\\xB7\\xE8\\x89\\xBE\\xE5\\x8B\\x92\\xD0\\x92\\xE8\\xB4\\x9D\\xE8\\x89\\xBE\\xE5\\xBE\\xB7\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92\\xE8\\xB4\\x9D\\xE5\\x8B\\x92\\xD0\\x92\\xE5\\xBE\\xB7\\xE8\\xB4\\x9D\\xD0\\x92\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92" and pe.signatures [ i ] . serial == "00:e5:d2:04:77:e8:50:c9:f3:5c:5c:47:12:3e:f3:42:71" )
 }
 import "pe"
 
@@ -227287,13 +226721,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C865D49345F1Ed9A84Bea40743Cdf1D7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "2ef45336-bb59-5510-af6f-29e41c9258b9"
+		id = "24ca79b2-4afb-59ce-84d9-09b51c52f193"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1231-L1242"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1a43e85e8c8d254dc3ba48ee9be5c233818fd6137967cd0235e802a2de1f9564"
+		logic_hash = "v1_sha256_1a43e85e8c8d254dc3ba48ee9be5c233818fd6137967cd0235e802a2de1f9564"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227301,7 +226735,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C865D49345F1Ed9A84Bea40743Cdf1D7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xB0\\x94\\xE5\\x93\\xA6\\xD0\\x93\\xE8\\x89\\xBE\\xE5\\xB1\\x81\\xE5\\xB1\\x81\\xE5\\x93\\xA6\\xE5\\xB1\\x81\\xE5\\x93\\xA6\\xE7\\xBB\\xB4\\xE5\\x93\\xA6\\xE8\\x89\\xBE\\xE5\\xB0\\x94\\xE8\\x89\\xBE" and pe.signatures[i].serial=="00:c8:65:d4:93:45:f1:ed:9a:84:be:a4:07:43:cd:f1:d7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\xB0\\x94\\xE5\\x93\\xA6\\xD0\\x93\\xE8\\x89\\xBE\\xE5\\xB1\\x81\\xE5\\xB1\\x81\\xE5\\x93\\xA6\\xE5\\xB1\\x81\\xE5\\x93\\xA6\\xE7\\xBB\\xB4\\xE5\\x93\\xA6\\xE8\\x89\\xBE\\xE5\\xB0\\x94\\xE8\\x89\\xBE" and pe.signatures [ i ] . serial == "00:c8:65:d4:93:45:f1:ed:9a:84:be:a4:07:43:cd:f1:d7" )
 }
 import "pe"
 
@@ -227310,13 +226744,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_29F2093E925B7Fe70A9Ba7B909415251 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "51c21421-18e4-52df-8fe7-75db7141824c"
+		id = "21213e2d-4f6a-57d8-b1c6-10ba684aed47"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1244-L1255"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9b3c6a0571c096e431594d9331b3ae8127b02cc3cdf1e994a113026d77bbae4c"
+		logic_hash = "v1_sha256_9b3c6a0571c096e431594d9331b3ae8127b02cc3cdf1e994a113026d77bbae4c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227324,7 +226758,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_29F2093E925B7Fe70A9Ba7B909415251 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xD0\\x99\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A\\xE5\\x85\\x8B\\xD0\\x99\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x99\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xE4\\xB8\\x9D\\xD0\\x99\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xD0\\x9D\\xE8\\x89\\xBE\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A" and pe.signatures[i].serial=="29:f2:09:3e:92:5b:7f:e7:0a:9b:a7:b9:09:41:52:51")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xD0\\x99\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A\\xE5\\x85\\x8B\\xD0\\x99\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x99\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xE4\\xB8\\x9D\\xD0\\x99\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xD0\\x9D\\xE8\\x89\\xBE\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A" and pe.signatures [ i ] . serial == "29:f2:09:3e:92:5b:7f:e7:0a:9b:a7:b9:09:41:52:51" )
 }
 import "pe"
 
@@ -227333,13 +226767,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0889E4181E71B16C4A810Bee38A78419 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "e9ada9f1-4b52-5da6-ba82-3ea2625ccefd"
+		id = "2918c8cc-0489-5301-99b8-fc756967db49"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1257-L1268"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2411f7ac79d18af295d77078c6e1c98c5a116ab24125c08946cb6ca09c28bc7b"
+		logic_hash = "v1_sha256_2411f7ac79d18af295d77078c6e1c98c5a116ab24125c08946cb6ca09c28bc7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227347,7 +226781,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0889E4181E71B16C4A810Bee38A78419 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x8B\\x92\\xE5\\xBC\\x97\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE5\\x90\\xBE\\xE4\\xBC\\x8A\\xE5\\x90\\xBE" and pe.signatures[i].serial=="08:89:e4:18:1e:71:b1:6c:4a:81:0b:ee:38:a7:84:19")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\x8B\\x92\\xE5\\xBC\\x97\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE5\\x90\\xBE\\xE4\\xBC\\x8A\\xE5\\x90\\xBE" and pe.signatures [ i ] . serial == "08:89:e4:18:1e:71:b1:6c:4a:81:0b:ee:38:a7:84:19" )
 }
 import "pe"
 
@@ -227356,13 +226790,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C1Afabdaa1321F815Cdbb9467728Bc08 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "e7904179-672a-5668-8b6d-f7f7090678fb"
+		id = "87d42025-40e5-5a15-b679-8c971e7907a3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1270-L1281"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "be637a192a90a35be9879d5e36fb3cf9a56ca4158329d6b1fad458e2d05e3d26"
+		logic_hash = "v1_sha256_be637a192a90a35be9879d5e36fb3cf9a56ca4158329d6b1fad458e2d05e3d26"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227370,7 +226804,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C1Afabdaa1321F815Cdbb9467728Bc08 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xD0\\x92\\xD0\\x93\\xE5\\x84\\xBF\\xD0\\x93\\xE5\\x8B\\x92\\xD0\\x92\\xE5\\x8B\\x92\\xD0\\x93\\xD0\\x93\\xE5\\x84\\xBF\\xE8\\x89\\xBE\\xD0\\x92\\xD0\\x93\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xD0\\x92\\xD0\\x93\\xE8\\x89\\xBE\\xE9\\xA9\\xAC\\xD0\\x93\\xE8\\x89\\xBE\\xE9\\xA9\\xAC\\xD0\\x93" and pe.signatures[i].serial=="00:c1:af:ab:da:a1:32:1f:81:5c:db:b9:46:77:28:bc:08")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xD0\\x92\\xD0\\x93\\xE5\\x84\\xBF\\xD0\\x93\\xE5\\x8B\\x92\\xD0\\x92\\xE5\\x8B\\x92\\xD0\\x93\\xD0\\x93\\xE5\\x84\\xBF\\xE8\\x89\\xBE\\xD0\\x92\\xD0\\x93\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xD0\\x92\\xD0\\x93\\xE8\\x89\\xBE\\xE9\\xA9\\xAC\\xD0\\x93\\xE8\\x89\\xBE\\xE9\\xA9\\xAC\\xD0\\x93" and pe.signatures [ i ] . serial == "00:c1:af:ab:da:a1:32:1f:81:5c:db:b9:46:77:28:bc:08" )
 }
 import "pe"
 
@@ -227379,13 +226813,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_371381A66Fb96A07077860Ae4A6721E1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "cd9c9965-922c-5ced-839c-97d1dcde33ff"
+		id = "e982a24d-6ff4-5d06-8ef7-9d7d37ce3966"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1283-L1294"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f087df37fdb6d921f411f130f26f9b5a58c36ae163bc88565178e0ed12be79d9"
+		logic_hash = "v1_sha256_f087df37fdb6d921f411f130f26f9b5a58c36ae163bc88565178e0ed12be79d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227393,7 +226827,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_371381A66Fb96A07077860Ae4A6721E1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE7\\xBB\\xB4\\xD0\\xA9\\xE5\\x90\\xBE\\xE7\\xBB\\xB4\\xD0\\xA9\\xD0\\xA9\\xE7\\xBB\\xB4\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xD0\\xA9\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xD0\\xA9\\xE5\\xA8\\x9C\\xE6\\x9D\\xB0\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xE5\\xA8\\x9C\\xE5\\xA8\\x9C\\xD0\\xA9" and pe.signatures[i].serial=="37:13:81:a6:6f:b9:6a:07:07:78:60:ae:4a:67:21:e1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE7\\xBB\\xB4\\xD0\\xA9\\xE5\\x90\\xBE\\xE7\\xBB\\xB4\\xD0\\xA9\\xD0\\xA9\\xE7\\xBB\\xB4\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xD0\\xA9\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xD0\\xA9\\xE5\\xA8\\x9C\\xE6\\x9D\\xB0\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xE5\\xA8\\x9C\\xE5\\xA8\\x9C\\xD0\\xA9" and pe.signatures [ i ] . serial == "37:13:81:a6:6f:b9:6a:07:07:78:60:ae:4a:67:21:e1" )
 }
 import "pe"
 
@@ -227402,13 +226836,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Deb004E56D7Fcec1Caa8F2928D4E768 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "bb4e62b1-3528-56db-b004-1d590ad1ee61"
+		id = "855e0826-18bc-5115-a949-436514869ddf"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1296-L1307"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "69910c81ce85bc59972b644f548a4382b8f3b70ec2737ada9da7adcb4779ce9c"
+		logic_hash = "v1_sha256_69910c81ce85bc59972b644f548a4382b8f3b70ec2737ada9da7adcb4779ce9c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227416,7 +226850,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Deb004E56D7Fcec1Caa8F2928D4E768 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC Mail.Ru" and pe.signatures[i].serial=="0d:eb:00:4e:56:d7:fc:ec:1c:aa:8f:29:28:d4:e7:68")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LLC Mail.Ru" and pe.signatures [ i ] . serial == "0d:eb:00:4e:56:d7:fc:ec:1c:aa:8f:29:28:d4:e7:68" )
 }
 import "pe"
 
@@ -227425,13 +226859,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7Bd36898217B4Cc6B6427Dd7C361E43D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "ff5be4ad-9471-5d9f-a1ad-ed7aca345a7f"
+		id = "71c66de4-7c66-5754-8a8e-628ee106045b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1309-L1320"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9ff149b5a12e154c0ede5015a0432fb70d6001507356c006952e8db91afaa72d"
+		logic_hash = "v1_sha256_9ff149b5a12e154c0ede5015a0432fb70d6001507356c006952e8db91afaa72d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227439,7 +226873,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7Bd36898217B4Cc6B6427Dd7C361E43D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aeafefcafbafbaf" and pe.signatures[i].serial=="7b:d3:68:98:21:7b:4c:c6:b6:42:7d:d7:c3:61:e4:3d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Aeafefcafbafbaf" and pe.signatures [ i ] . serial == "7b:d3:68:98:21:7b:4c:c6:b6:42:7d:d7:c3:61:e4:3d" )
 }
 import "pe"
 
@@ -227448,13 +226882,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02D17Fbf4869F23Fea43C7863902Df93 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6e96f5b2-f3de-5d5a-babe-d46b9e3edd3e"
+		id = "a42e1fcb-a1aa-5b43-9fad-d9e2acbfd840"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1322-L1333"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a66e10934cc58e364a694dde3865d0de33e61ce0128ef144c61fa5728d22b8f8"
+		logic_hash = "v1_sha256_a66e10934cc58e364a694dde3865d0de33e61ce0128ef144c61fa5728d22b8f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227462,7 +226896,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02D17Fbf4869F23Fea43C7863902Df93 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Windows" and pe.signatures[i].serial=="02:d1:7f:bf:48:69:f2:3f:ea:43:c7:86:39:02:df:93")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Microsoft Windows" and pe.signatures [ i ] . serial == "02:d1:7f:bf:48:69:f2:3f:ea:43:c7:86:39:02:df:93" )
 }
 import "pe"
 
@@ -227471,13 +226905,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1E74Cfe7De8C5F57840A61034414Ca9F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "b46992d5-f4fb-5e51-8f3c-eb87d4397f14"
+		id = "d7f06726-8add-5a80-af51-1841d688ea79"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1335-L1346"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "14f57732a82b5139059bbe6f713184659187b57419d79e85a12ab197def4b761"
+		logic_hash = "v1_sha256_14f57732a82b5139059bbe6f713184659187b57419d79e85a12ab197def4b761"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227485,7 +226919,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1E74Cfe7De8C5F57840A61034414Ca9F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Insta Software Solution Inc." and pe.signatures[i].serial=="1e:74:cf:e7:de:8c:5f:57:84:0a:61:03:44:14:ca:9f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Insta Software Solution Inc." and pe.signatures [ i ] . serial == "1e:74:cf:e7:de:8c:5f:57:84:0a:61:03:44:14:ca:9f" )
 }
 import "pe"
 
@@ -227494,13 +226928,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009272607Cfc982B782A5D36C4B78F5E7B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "dfb01400-dff2-5df1-b38e-7eb2ee2c71b8"
+		id = "53c1920e-87fd-5e74-87ad-1d3d7215c054"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1348-L1359"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d1c2b44e782befc8dae6852935b6f5b0071c13dd9b56857c38cb290c9069df18"
+		logic_hash = "v1_sha256_d1c2b44e782befc8dae6852935b6f5b0071c13dd9b56857c38cb290c9069df18"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227508,7 +226942,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009272607Cfc982B782A5D36C4B78F5E7B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rada SP Z o o" and pe.signatures[i].serial=="00:92:72:60:7c:fc:98:2b:78:2a:5d:36:c4:b7:8f:5e:7b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rada SP Z o o" and pe.signatures [ i ] . serial == "00:92:72:60:7c:fc:98:2b:78:2a:5d:36:c4:b7:8f:5e:7b" )
 }
 import "pe"
 
@@ -227517,13 +226951,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7B91468122273Aa32B7Cfc80C331Ea13 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "4369d88d-f592-5a5a-bdf6-c63b77d45326"
+		id = "426ec8ff-bbcf-5317-84cc-d0aebb21934f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1361-L1372"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4c0fa18edb23c6a7474185adc67101ad9b13c71188f25612165cb97d236562d8"
+		logic_hash = "v1_sha256_4c0fa18edb23c6a7474185adc67101ad9b13c71188f25612165cb97d236562d8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227531,7 +226965,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7B91468122273Aa32B7Cfc80C331Ea13 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO KBI" and pe.signatures[i].serial=="7b:91:46:81:22:27:3a:a3:2b:7c:fc:80:c3:31:ea:13")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO KBI" and pe.signatures [ i ] . serial == "7b:91:46:81:22:27:3a:a3:2b:7c:fc:80:c3:31:ea:13" )
 }
 import "pe"
 
@@ -227540,13 +226974,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0082Cb93593B658100Cdd7A00C874287F2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "3e618656-6c9d-5172-bad4-f507cec1dc0c"
+		id = "88ad4db8-31ec-57de-8261-028dd8fcdde6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1374-L1385"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "df8eb4feef3992bae7097a05860f57a1408fc79d92741e3ea2f202d072d9f47e"
+		logic_hash = "v1_sha256_df8eb4feef3992bae7097a05860f57a1408fc79d92741e3ea2f202d072d9f47e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227554,7 +226988,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0082Cb93593B658100Cdd7A00C874287F2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sportsonline24 B.V." and pe.signatures[i].serial=="00:82:cb:93:59:3b:65:81:00:cd:d7:a0:0c:87:42:87:f2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sportsonline24 B.V." and pe.signatures [ i ] . serial == "00:82:cb:93:59:3b:65:81:00:cd:d7:a0:0c:87:42:87:f2" )
 }
 import "pe"
 
@@ -227563,13 +226997,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Df683D46D8C3832489672Cc4E82D3D5D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "532ee72a-00f6-513e-b4f9-0827f77d643e"
+		id = "419710e6-ffc5-54ce-ab8e-d8398698f667"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1387-L1398"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "153fdb25769d912732a1fb4ecc757fc8c7e4766cd6588ea16d9cf642b4be8bf6"
+		logic_hash = "v1_sha256_153fdb25769d912732a1fb4ecc757fc8c7e4766cd6588ea16d9cf642b4be8bf6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227577,7 +227011,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Df683D46D8C3832489672Cc4E82D3D5D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Osatokio Oy" and pe.signatures[i].serial=="00:df:68:3d:46:d8:c3:83:24:89:67:2c:c4:e8:2d:3d:5d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Osatokio Oy" and pe.signatures [ i ] . serial == "00:df:68:3d:46:d8:c3:83:24:89:67:2c:c4:e8:2d:3d:5d" )
 }
 import "pe"
 
@@ -227586,13 +227020,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_105440F57E9D04419F5A3E72195110E6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "44600134-156b-5762-bdae-f4c016f454a3"
+		id = "8b3570fe-d2b6-5b3e-b17c-76933760cde5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1400-L1411"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f8b7aebe91466a587dac366cf6483586f22f95ebc186aa139e55c6e52d276f63"
+		logic_hash = "v1_sha256_f8b7aebe91466a587dac366cf6483586f22f95ebc186aa139e55c6e52d276f63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227600,7 +227034,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_105440F57E9D04419F5A3E72195110E6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CRYPTOLAYER SRL" and pe.signatures[i].serial=="10:54:40:f5:7e:9d:04:41:9f:5a:3e:72:19:51:10:e6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CRYPTOLAYER SRL" and pe.signatures [ i ] . serial == "10:54:40:f5:7e:9d:04:41:9f:5a:3e:72:19:51:10:e6" )
 }
 import "pe"
 
@@ -227609,13 +227043,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C01E41Ff29078E6626A640C5A19A8D80 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "93ee927f-71bd-5490-8f70-5486ee9c3b79"
+		id = "8f294014-6778-5248-afe8-323386f106aa"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1413-L1424"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1ee6f365d46fb1ee0e448fc0ab9d07c51a46f6ee95155094ec956f1cad6c1052"
+		logic_hash = "v1_sha256_1ee6f365d46fb1ee0e448fc0ab9d07c51a46f6ee95155094ec956f1cad6c1052"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227623,7 +227057,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C01E41Ff29078E6626A640C5A19A8D80 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BurnAware" and pe.signatures[i].serial=="c0:1e:41:ff:29:07:8e:66:26:a6:40:c5:a1:9a:8d:80")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BurnAware" and pe.signatures [ i ] . serial == "c0:1e:41:ff:29:07:8e:66:26:a6:40:c5:a1:9a:8d:80" )
 }
 import "pe"
 
@@ -227632,13 +227066,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fa3Dcac19B884B44Ef4F81541184D6B0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a188e033-4381-5ff0-8f54-f36571ae7097"
+		id = "80860bdb-0f04-51f6-8f85-76ad4dd09ea2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1426-L1437"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7e9e2b22f6f2cfd5d7c962fb43c85d703d0a600f954f614073c708f4b881d90e"
+		logic_hash = "v1_sha256_7e9e2b22f6f2cfd5d7c962fb43c85d703d0a600f954f614073c708f4b881d90e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227646,7 +227080,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fa3Dcac19B884B44Ef4F81541184D6B0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unicom Ltd" and pe.signatures[i].serial=="00:fa:3d:ca:c1:9b:88:4b:44:ef:4f:81:54:11:84:d6:b0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Unicom Ltd" and pe.signatures [ i ] . serial == "00:fa:3d:ca:c1:9b:88:4b:44:ef:4f:81:54:11:84:d6:b0" )
 }
 import "pe"
 
@@ -227655,13 +227089,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_70E1Ebd170Db8102D8C28E58392E5632 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f5ccfbdd-d72d-5060-84e6-0ab8477f73fe"
+		id = "86bc7b05-ce01-5572-a812-f2b690f5c531"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1439-L1450"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b639424c97fb1da440c458cf5cb8f04562292284db7b576c0676a632704f597b"
+		logic_hash = "v1_sha256_b639424c97fb1da440c458cf5cb8f04562292284db7b576c0676a632704f597b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227669,7 +227103,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_70E1Ebd170Db8102D8C28E58392E5632 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Equal Cash Technologies Limited" and pe.signatures[i].serial=="70:e1:eb:d1:70:db:81:02:d8:c2:8e:58:39:2e:56:32")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Equal Cash Technologies Limited" and pe.signatures [ i ] . serial == "70:e1:eb:d1:70:db:81:02:d8:c2:8e:58:39:2e:56:32" )
 }
 import "pe"
 
@@ -227678,13 +227112,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Cfa5050C819C4Acbb8Fa75979688Dff : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "35673979-5578-5d32-b8f9-9e74f0c336a2"
+		id = "233be86c-1836-548d-af51-86941a7e1da0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1452-L1463"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e5978deb84a0c6cee9132f8806f239f33478462da31a423a04922c195cbd343a"
+		logic_hash = "v1_sha256_e5978deb84a0c6cee9132f8806f239f33478462da31a423a04922c195cbd343a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227692,7 +227126,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Cfa5050C819C4Acbb8Fa75979688Dff : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elite Web Development Ltd." and pe.signatures[i].serial=="6c:fa:50:50:c8:19:c4:ac:bb:8f:a7:59:79:68:8d:ff")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Elite Web Development Ltd." and pe.signatures [ i ] . serial == "6c:fa:50:50:c8:19:c4:ac:bb:8f:a7:59:79:68:8d:ff" )
 }
 import "pe"
 
@@ -227701,13 +227135,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B8164F7143E1A313003Ab0C834562F1F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d6ebdfb9-55db-58e2-89a8-d47d747e3432"
+		id = "a1427947-00f3-5236-96d3-d86ea1fa36d6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1465-L1476"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "77f8f125740de97e6fdd98103eefa2a431df0cbe2e7de44f7e863e22ebcfea4c"
+		logic_hash = "v1_sha256_77f8f125740de97e6fdd98103eefa2a431df0cbe2e7de44f7e863e22ebcfea4c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227715,7 +227149,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B8164F7143E1A313003Ab0C834562F1F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ekitai Data Inc." and pe.signatures[i].serial=="00:b8:16:4f:71:43:e1:a3:13:00:3a:b0:c8:34:56:2f:1f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ekitai Data Inc." and pe.signatures [ i ] . serial == "00:b8:16:4f:71:43:e1:a3:13:00:3a:b0:c8:34:56:2f:1f" )
 }
 import "pe"
 
@@ -227724,13 +227158,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E3C7Cc0950152E9Ceead4304D01F6C89 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8bea34fa-3620-5f5f-895f-3baa3b7b458a"
+		id = "ea0b29ac-1e73-563c-a24a-5cb3da87bee2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1478-L1489"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "395ed4c9c8668f6416632f85883c5fd5b6038ce8388410f22bcbe2a9e6281c35"
+		logic_hash = "v1_sha256_395ed4c9c8668f6416632f85883c5fd5b6038ce8388410f22bcbe2a9e6281c35"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227738,7 +227172,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E3C7Cc0950152E9Ceead4304D01F6C89 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DNS KOMPLEKT" and pe.signatures[i].serial=="e3:c7:cc:09:50:15:2e:9c:ee:ad:43:04:d0:1f:6c:89")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DNS KOMPLEKT" and pe.signatures [ i ] . serial == "e3:c7:cc:09:50:15:2e:9c:ee:ad:43:04:d0:1f:6c:89" )
 }
 import "pe"
 
@@ -227747,13 +227181,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6A241Ffe96A6349Df608D22C02942268 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "571f5f11-576a-511b-975d-0643ae834502"
+		id = "b9f088ab-5e8d-5886-9417-5d9184afb597"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1491-L1502"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "41db1a9b11e2d5b8de5ba81496d0e76ea5eddacc01c77bc28c7e05496842df04"
+		logic_hash = "v1_sha256_41db1a9b11e2d5b8de5ba81496d0e76ea5eddacc01c77bc28c7e05496842df04"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227761,7 +227195,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6A241Ffe96A6349Df608D22C02942268 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HELP, d.o.o." and pe.signatures[i].serial=="6a:24:1f:fe:96:a6:34:9d:f6:08:d2:2c:02:94:22:68")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HELP, d.o.o." and pe.signatures [ i ] . serial == "6a:24:1f:fe:96:a6:34:9d:f6:08:d2:2c:02:94:22:68" )
 }
 import "pe"
 
@@ -227770,13 +227204,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C04F5D17Af872Cb2C37E3367Fe761D0D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9d008f04-8d02-5c6b-b38d-234409cce277"
+		id = "7df831c7-e086-50af-81a6-8feba589e4ce"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1504-L1518"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7fa0d16600ae89e41d7b2b0655b142ea36202e8bbbf5f8e25cbb45a005995e79"
+		logic_hash = "v1_sha256_7fa0d16600ae89e41d7b2b0655b142ea36202e8bbbf5f8e25cbb45a005995e79"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227784,7 +227218,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C04F5D17Af872Cb2C37E3367Fe761D0D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DES SP Z O O" and (pe.signatures[i].serial=="00:c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d" or pe.signatures[i].serial=="c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DES SP Z O O" and ( pe.signatures [ i ] . serial == "00:c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d" or pe.signatures [ i ] . serial == "c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d" ) )
 }
 import "pe"
 
@@ -227793,13 +227227,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5C7E78F53C31D6Aa5B45De14B47Eb5C4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e6bd4476-d287-54d9-82b3-d80f328d7831"
+		id = "8d576369-0f76-5c97-b8f0-65c475412549"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1520-L1531"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0c804e7f1e43a98b150a97adcbba882f7764000abdf7c7408e3361aefa9298b5"
+		logic_hash = "v1_sha256_0c804e7f1e43a98b150a97adcbba882f7764000abdf7c7408e3361aefa9298b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227807,7 +227241,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5C7E78F53C31D6Aa5B45De14B47Eb5C4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cubic Information Systems, UAB" and pe.signatures[i].serial=="5c:7e:78:f5:3c:31:d6:aa:5b:45:de:14:b4:7e:b5:c4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cubic Information Systems, UAB" and pe.signatures [ i ] . serial == "5c:7e:78:f5:3c:31:d6:aa:5b:45:de:14:b4:7e:b5:c4" )
 }
 import "pe"
 
@@ -227816,13 +227250,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7156Ec47Ef01Ab8359Ef4304E5Af1A05 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f77ccdb6-77b6-5c47-bde6-2b1b449f9533"
+		id = "0dbc8cca-7270-52f1-858c-91d4129b9b22"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1533-L1544"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fc8073ebb9847d642f15cc74859b643afe00b3c331f68c06f3ff62c037225201"
+		logic_hash = "v1_sha256_fc8073ebb9847d642f15cc74859b643afe00b3c331f68c06f3ff62c037225201"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227830,7 +227264,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7156Ec47Ef01Ab8359Ef4304E5Af1A05 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BOREC, OOO" and pe.signatures[i].serial=="71:56:ec:47:ef:01:ab:83:59:ef:43:04:e5:af:1a:05")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BOREC, OOO" and pe.signatures [ i ] . serial == "71:56:ec:47:ef:01:ab:83:59:ef:43:04:e5:af:1a:05" )
 }
 import "pe"
 
@@ -227839,13 +227273,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B2E730B0526F36Faf7D093D48D6D9997 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7c74d3aa-dc4f-51ed-9574-74e0539cd22b"
+		id = "094567a6-2070-51b9-b75c-55f643fc2a76"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1546-L1557"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "16c50b7a2b7b55662d5cdb2261a6b352657b2689a9328916fcf63ddfbef5d08f"
+		logic_hash = "v1_sha256_16c50b7a2b7b55662d5cdb2261a6b352657b2689a9328916fcf63ddfbef5d08f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227853,7 +227287,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B2E730B0526F36Faf7D093D48D6D9997 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bamboo Connect s.r.o." and pe.signatures[i].serial=="00:b2:e7:30:b0:52:6f:36:fa:f7:d0:93:d4:8d:6d:99:97")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bamboo Connect s.r.o." and pe.signatures [ i ] . serial == "00:b2:e7:30:b0:52:6f:36:fa:f7:d0:93:d4:8d:6d:99:97" )
 }
 import "pe"
 
@@ -227862,13 +227296,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2C90Eaf4De3Afc03Ba924C719435C2A3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0b1ae208-bf81-55d0-b4e5-b1c1f7556387"
+		id = "f9f9c17b-362f-5af9-9e8a-9b429666cb32"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1559-L1570"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "792898b34ebe4dfc603b3f3b54777a86827a52fd3699a799e95c436317be77da"
+		logic_hash = "v1_sha256_792898b34ebe4dfc603b3f3b54777a86827a52fd3699a799e95c436317be77da"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227876,7 +227310,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2C90Eaf4De3Afc03Ba924C719435C2A3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AntiFIX s.r.o." and pe.signatures[i].serial=="2c:90:ea:f4:de:3a:fc:03:ba:92:4c:71:94:35:c2:a3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AntiFIX s.r.o." and pe.signatures [ i ] . serial == "2c:90:ea:f4:de:3a:fc:03:ba:92:4c:71:94:35:c2:a3" )
 }
 import "pe"
 
@@ -227885,13 +227319,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Bdc81Bc76090Dae0Eee2E1Eb744A4F9A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9c91e39e-a120-537d-a24c-f0b8ffe9dd6e"
+		id = "89c994dc-441f-5a36-9cee-bd12cdd52cf5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1572-L1583"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "90c695b0cffd4786471faca21b77161ae6e930540766c4f18796a7adea74b6f5"
+		logic_hash = "v1_sha256_90c695b0cffd4786471faca21b77161ae6e930540766c4f18796a7adea74b6f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227899,7 +227333,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Bdc81Bc76090Dae0Eee2E1Eb744A4F9A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALM4U GmbH" and pe.signatures[i].serial=="00:bd:c8:1b:c7:60:90:da:e0:ee:e2:e1:eb:74:4a:4f:9a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALM4U GmbH" and pe.signatures [ i ] . serial == "00:bd:c8:1b:c7:60:90:da:e0:ee:e2:e1:eb:74:4a:4f:9a" )
 }
 import "pe"
 
@@ -227908,13 +227342,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E38259Cf24Cc702Ce441B683Ad578911 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "79e00e92-4ddb-5f87-8f60-78f326674c66"
+		id = "f079a83e-82b7-5f7b-9439-a9fe67ed22b1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1585-L1596"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "53d135553b88484e2c40976a9eaa0eb3f4f34c40ce775c198dfd6552155d1859"
+		logic_hash = "v1_sha256_53d135553b88484e2c40976a9eaa0eb3f4f34c40ce775c198dfd6552155d1859"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227922,7 +227356,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E38259Cf24Cc702Ce441B683Ad578911 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Akhirah Technologies Inc." and pe.signatures[i].serial=="00:e3:82:59:cf:24:cc:70:2c:e4:41:b6:83:ad:57:89:11")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Akhirah Technologies Inc." and pe.signatures [ i ] . serial == "00:e3:82:59:cf:24:cc:70:2c:e4:41:b6:83:ad:57:89:11" )
 }
 import "pe"
 
@@ -227931,13 +227365,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4929Ab561C812Af93Ddb9758B545F546 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e57e442a-6fe3-5d09-bbc4-d290a7a80090"
+		id = "65e618a5-3f65-527e-936c-1e15e109b038"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1598-L1609"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a03f37840b24456a4a2ef8e7c456dc99396886682156e4e95f7547bf38d8dc4d"
+		logic_hash = "v1_sha256_a03f37840b24456a4a2ef8e7c456dc99396886682156e4e95f7547bf38d8dc4d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227945,7 +227379,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4929Ab561C812Af93Ddb9758B545F546 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Everything Wow s.r.o." and pe.signatures[i].serial=="49:29:ab:56:1c:81:2a:f9:3d:db:97:58:b5:45:f5:46")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Everything Wow s.r.o." and pe.signatures [ i ] . serial == "49:29:ab:56:1c:81:2a:f9:3d:db:97:58:b5:45:f5:46" )
 }
 import "pe"
 
@@ -227954,13 +227388,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B649A966410F62999C939384Af553919 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6b88b712-6d25-5152-80bf-562bf82f336c"
+		id = "7792dd13-ebf4-5801-8dc4-6fbcbef4165f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1611-L1622"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "231b0aa0a1e7c72552d683cc4f93b39444f7c1ebb3bb719bee224aa62e9a28dd"
+		logic_hash = "v1_sha256_231b0aa0a1e7c72552d683cc4f93b39444f7c1ebb3bb719bee224aa62e9a28dd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227968,7 +227402,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B649A966410F62999C939384Af553919 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "F.A.T. SARL" and pe.signatures[i].serial=="00:b6:49:a9:66:41:0f:62:99:9c:93:93:84:af:55:39:19")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "F.A.T. SARL" and pe.signatures [ i ] . serial == "00:b6:49:a9:66:41:0f:62:99:9c:93:93:84:af:55:39:19" )
 }
 import "pe"
 
@@ -227977,13 +227411,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_22367Dbefd0A325C3893Af52547B14Fa : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "301f126d-1ff6-5512-a38b-ca1dd7d67765"
+		id = "6937b608-db97-5048-9382-da86049f2d5a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1624-L1635"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7b717a86ba0a6c3c8ba59c7b7c97dae802c351340ad67a9baf3f526b084e995a"
+		logic_hash = "v1_sha256_7b717a86ba0a6c3c8ba59c7b7c97dae802c351340ad67a9baf3f526b084e995a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -227991,7 +227425,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_22367Dbefd0A325C3893Af52547B14Fa : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "F.lux Software LLC" and pe.signatures[i].serial=="22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:fa")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "F.lux Software LLC" and pe.signatures [ i ] . serial == "22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:fa" )
 }
 import "pe"
 
@@ -228000,13 +227434,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E04A344B397F752A45B128A594A3D6B5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "85a7c3f7-a449-54ad-aac4-53f2a2c6c30e"
+		id = "ecb1a466-971d-5d5d-878d-a2a09f82b296"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1637-L1648"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "db3c854b68387aa5c6976783e6f79f99fe3389344b64d38c603d298128193e12"
+		logic_hash = "v1_sha256_db3c854b68387aa5c6976783e6f79f99fe3389344b64d38c603d298128193e12"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228014,7 +227448,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E04A344B397F752A45B128A594A3D6B5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Highweb Ireland Operations Limited" and pe.signatures[i].serial=="00:e0:4a:34:4b:39:7f:75:2a:45:b1:28:a5:94:a3:d6:b5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Highweb Ireland Operations Limited" and pe.signatures [ i ] . serial == "00:e0:4a:34:4b:39:7f:75:2a:45:b1:28:a5:94:a3:d6:b5" )
 }
 import "pe"
 
@@ -228023,13 +227457,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A7989F8Be0C82D35A19E7B3Dd4Be30E5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0bb81ddc-b63b-534b-852f-7b0a2feeef9e"
+		id = "f3754d33-3686-5e0c-bd33-9003eac88b22"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1650-L1661"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "66d600d97b5aca1aa9a302671f06aef0d5c4ae9829d6cb16f191bd4c59462d2e"
+		logic_hash = "v1_sha256_66d600d97b5aca1aa9a302671f06aef0d5c4ae9829d6cb16f191bd4c59462d2e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228037,7 +227471,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A7989F8Be0C82D35A19E7B3Dd4Be30E5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Instamix Limited" and pe.signatures[i].serial=="00:a7:98:9f:8b:e0:c8:2d:35:a1:9e:7b:3d:d4:be:30:e5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Instamix Limited" and pe.signatures [ i ] . serial == "00:a7:98:9f:8b:e0:c8:2d:35:a1:9e:7b:3d:d4:be:30:e5" )
 }
 import "pe"
 
@@ -228046,13 +227480,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_39F56251Df2088223Cc03494084E6081 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4b5c27e0-0b3e-52e6-a867-1c2adadf3af3"
+		id = "ba70fae7-1d16-5df7-adf7-d5b0e9c469c8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1663-L1674"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dc757f831b2537f12151f4f9e886ccf83bacfbcaea3ce12b2199f13ae00b199e"
+		logic_hash = "v1_sha256_dc757f831b2537f12151f4f9e886ccf83bacfbcaea3ce12b2199f13ae00b199e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228060,7 +227494,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_39F56251Df2088223Cc03494084E6081 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Inter Med Pty. Ltd." and pe.signatures[i].serial=="39:f5:62:51:df:20:88:22:3c:c0:34:94:08:4e:60:81")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Inter Med Pty. Ltd." and pe.signatures [ i ] . serial == "39:f5:62:51:df:20:88:22:3c:c0:34:94:08:4e:60:81" )
 }
 import "pe"
 
@@ -228069,13 +227503,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009Cfbb4C69008821Aaacecde97Ee149Ab : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0b0d815b-2232-5159-9b78-9227d9b2ec11"
+		id = "04818898-ee0e-51e2-9b06-d9f9cfc34bcc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1676-L1687"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "de04f12b1fb1e12860bf4ac077b700d180b8d412890922b75264319559fbd997"
+		logic_hash = "v1_sha256_de04f12b1fb1e12860bf4ac077b700d180b8d412890922b75264319559fbd997"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228083,7 +227517,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009Cfbb4C69008821Aaacecde97Ee149Ab : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kivaliz Prest s.r.l." and pe.signatures[i].serial=="00:9c:fb:b4:c6:90:08:82:1a:aa:ce:cd:e9:7e:e1:49:ab")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kivaliz Prest s.r.l." and pe.signatures [ i ] . serial == "00:9c:fb:b4:c6:90:08:82:1a:aa:ce:cd:e9:7e:e1:49:ab" )
 }
 import "pe"
 
@@ -228092,13 +227526,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008Cff807Edaf368A60E4106906D8Df319 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ad8bed7f-3bc6-53d3-9e7a-0868e2ad267a"
+		id = "860df7e0-095a-5620-8870-a9d8411abdc2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1689-L1700"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "48752aff88cd3d546757a4220a64ca17cc9a5f00a42d2bc0571dedf5de769bc2"
+		logic_hash = "v1_sha256_48752aff88cd3d546757a4220a64ca17cc9a5f00a42d2bc0571dedf5de769bc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228106,7 +227540,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008Cff807Edaf368A60E4106906D8Df319 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KRAFT BOKS OOO" and pe.signatures[i].serial=="00:8c:ff:80:7e:da:f3:68:a6:0e:41:06:90:6d:8d:f3:19")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KRAFT BOKS OOO" and pe.signatures [ i ] . serial == "00:8c:ff:80:7e:da:f3:68:a6:0e:41:06:90:6d:8d:f3:19" )
 }
 import "pe"
 
@@ -228115,13 +227549,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2924785Fd7990B2D510675176Dae2Bed : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2aedb37c-8991-5750-b0c6-b9d6e7bb5e79"
+		id = "8df46218-68d2-5520-bd2f-ed9de2dda4dd"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1702-L1713"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dbdd714575d3c5f9554026fea97c6e91073d30cf728396111a5106303bb7b624"
+		logic_hash = "v1_sha256_dbdd714575d3c5f9554026fea97c6e91073d30cf728396111a5106303bb7b624"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228129,7 +227563,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2924785Fd7990B2D510675176Dae2Bed : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Neoopt LLC" and pe.signatures[i].serial=="29:24:78:5f:d7:99:0b:2d:51:06:75:17:6d:ae:2b:ed")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Neoopt LLC" and pe.signatures [ i ] . serial == "29:24:78:5f:d7:99:0b:2d:51:06:75:17:6d:ae:2b:ed" )
 }
 import "pe"
 
@@ -228138,13 +227572,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F2C4B99487Ed33396D77029B477494Bc : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "594a5def-2516-5639-a72b-9b84b65de1e0"
+		id = "69853229-35ba-5c67-89b4-fb4593148d1d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1715-L1726"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "109d71674b652a2f42bb2a45c877d3a6cbfe280d0324f9ac8fa746d322440694"
+		logic_hash = "v1_sha256_109d71674b652a2f42bb2a45c877d3a6cbfe280d0324f9ac8fa746d322440694"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228152,7 +227586,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F2C4B99487Ed33396D77029B477494Bc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bedaabaefadfdfedcbbbebaaef" and pe.signatures[i].serial=="f2:c4:b9:94:87:ed:33:39:6d:77:02:9b:47:74:94:bc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bedaabaefadfdfedcbbbebaaef" and pe.signatures [ i ] . serial == "f2:c4:b9:94:87:ed:33:39:6d:77:02:9b:47:74:94:bc" )
 }
 import "pe"
 
@@ -228161,13 +227595,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C54Cccff8Acceb9654B6F585E2442Ef7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c199b65f-5e95-5c6a-8ccc-7f343b867885"
+		id = "7ca7d890-2ff1-532b-8c1b-0ffe19921437"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1728-L1739"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4be5e0f9f522f0d4096a63b001a02ea130ef56149dec7f0ac90be686b885cc4a"
+		logic_hash = "v1_sha256_4be5e0f9f522f0d4096a63b001a02ea130ef56149dec7f0ac90be686b885cc4a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228175,7 +227609,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C54Cccff8Acceb9654B6F585E2442Ef7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eadbebdebcc" and pe.signatures[i].serial=="c5:4c:cc:ff:8a:cc:eb:96:54:b6:f5:85:e2:44:2e:f7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Eadbebdebcc" and pe.signatures [ i ] . serial == "c5:4c:cc:ff:8a:cc:eb:96:54:b6:f5:85:e2:44:2e:f7" )
 }
 import "pe"
 
@@ -228184,13 +227618,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_690910Dc89D7857C3500Fb74Bed2B08D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d10931e2-8abb-592b-a070-3767f286bd74"
+		id = "2ccceb8d-159f-5ed8-bc76-f6ef2837c7b7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1741-L1752"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "62a1be8435f73f3768030feb6b5917d9a8075e7abac52e654231ba9d16ccc374"
+		logic_hash = "v1_sha256_62a1be8435f73f3768030feb6b5917d9a8075e7abac52e654231ba9d16ccc374"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228198,7 +227632,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_690910Dc89D7857C3500Fb74Bed2B08D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OLIMP STROI" and pe.signatures[i].serial=="69:09:10:dc:89:d7:85:7c:35:00:fb:74:be:d2:b0:8d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OLIMP STROI" and pe.signatures [ i ] . serial == "69:09:10:dc:89:d7:85:7c:35:00:fb:74:be:d2:b0:8d" )
 }
 import "pe"
 
@@ -228207,13 +227641,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Af9B523180F34A24Fcfd11B74E7D6Cd : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d9ef3746-8b8e-5259-bcc4-408e27bc8ce3"
+		id = "7b140f17-5640-5530-b935-722f83165e9f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1754-L1765"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e06c87bddfc4fbb8918b7b1d64ec66b810a5a0c635c34d820b33c3cf9789229c"
+		logic_hash = "v1_sha256_e06c87bddfc4fbb8918b7b1d64ec66b810a5a0c635c34d820b33c3cf9789229c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228221,7 +227655,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Af9B523180F34A24Fcfd11B74E7D6Cd : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORBIS LTD" and pe.signatures[i].serial=="0a:f9:b5:23:18:0f:34:a2:4f:cf:d1:1b:74:e7:d6:cd")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ORBIS LTD" and pe.signatures [ i ] . serial == "0a:f9:b5:23:18:0f:34:a2:4f:cf:d1:1b:74:e7:d6:cd" )
 }
 import "pe"
 
@@ -228230,13 +227664,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F4D2Def53Bccb0Dd2B7D54E4853A2Fc5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8c1970b7-10b5-5976-a89c-a0d30f4b04af"
+		id = "5d3b0c1f-c651-5319-b410-b31793506519"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1767-L1778"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0d9813d79f86ff22d5478469bee6cf457afe3780dd4308caa5da502faf816377"
+		logic_hash = "v1_sha256_0d9813d79f86ff22d5478469bee6cf457afe3780dd4308caa5da502faf816377"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228244,7 +227678,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F4D2Def53Bccb0Dd2B7D54E4853A2Fc5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PETROYL GROUP, TOV" and pe.signatures[i].serial=="00:f4:d2:de:f5:3b:cc:b0:dd:2b:7d:54:e4:85:3a:2f:c5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PETROYL GROUP, TOV" and pe.signatures [ i ] . serial == "00:f4:d2:de:f5:3b:cc:b0:dd:2b:7d:54:e4:85:3a:2f:c5" )
 }
 import "pe"
 
@@ -228253,13 +227687,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56D576A062491Ea0A5877Ced418203A1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "94e29354-b6bc-5936-abc8-2b42d2e65294"
+		id = "1524284a-b2ea-53d8-bafe-7f2a08409510"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1780-L1791"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "877b773cb1bdc6c6c309374e95dc7eac4d525c681200169fcf492476f6335342"
+		logic_hash = "v1_sha256_877b773cb1bdc6c6c309374e95dc7eac4d525c681200169fcf492476f6335342"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228267,7 +227701,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56D576A062491Ea0A5877Ced418203A1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Silvo LLC" and pe.signatures[i].serial=="56:d5:76:a0:62:49:1e:a0:a5:87:7c:ed:41:82:03:a1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Silvo LLC" and pe.signatures [ i ] . serial == "56:d5:76:a0:62:49:1e:a0:a5:87:7c:ed:41:82:03:a1" )
 }
 import "pe"
 
@@ -228276,13 +227710,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4152169F22454Ed604D03555B7Afb175 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "61286549-7561-5607-9073-2a3ee0d54a44"
+		id = "54b31e1f-e499-5fee-9982-f5b3171e6dce"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1793-L1804"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ee965ee8b6ebbb6171e3b10a7887acf35c9ed7fcbe49b7f403190c7fb046ec63"
+		logic_hash = "v1_sha256_ee965ee8b6ebbb6171e3b10a7887acf35c9ed7fcbe49b7f403190c7fb046ec63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228290,7 +227724,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4152169F22454Ed604D03555B7Afb175 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SMACKTECH SOFTWARE LIMITED" and pe.signatures[i].serial=="41:52:16:9f:22:45:4e:d6:04:d0:35:55:b7:af:b1:75")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SMACKTECH SOFTWARE LIMITED" and pe.signatures [ i ] . serial == "41:52:16:9f:22:45:4e:d6:04:d0:35:55:b7:af:b1:75" )
 }
 import "pe"
 
@@ -228299,13 +227733,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_41D05676E0D31908Be4Dead3486Aeae3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d668f53b-3d1c-5fcb-9f9c-2923e63f93a9"
+		id = "8f6cc4ad-a31a-5bb9-be06-e058188d6d4f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1806-L1817"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e4eb406e433b38ac127ba22040c48b510636eb55e2b524b02386710709d343b6"
+		logic_hash = "v1_sha256_e4eb406e433b38ac127ba22040c48b510636eb55e2b524b02386710709d343b6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228313,7 +227747,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_41D05676E0D31908Be4Dead3486Aeae3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rov SP Z O O" and pe.signatures[i].serial=="41:d0:56:76:e0:d3:19:08:be:4d:ea:d3:48:6a:ea:e3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rov SP Z O O" and pe.signatures [ i ] . serial == "41:d0:56:76:e0:d3:19:08:be:4d:ea:d3:48:6a:ea:e3" )
 }
 import "pe"
 
@@ -228322,13 +227756,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_13C7B92282Aae782Bfb00Baf879935F4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "244ff442-0bce-5f9f-85ea-33fafe9a2e7b"
+		id = "7db8d59c-5e0c-54e3-8ec7-ae3f6af67000"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1819-L1830"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2742fd71eb8219db7785ad46be18a906fdab0914f632dfbf531238fd551a5b65"
+		logic_hash = "v1_sha256_2742fd71eb8219db7785ad46be18a906fdab0914f632dfbf531238fd551a5b65"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228336,7 +227770,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_13C7B92282Aae782Bfb00Baf879935F4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures[i].serial=="13:c7:b9:22:82:aa:e7:82:bf:b0:0b:af:87:99:35:f4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures [ i ] . serial == "13:c7:b9:22:82:aa:e7:82:bf:b0:0b:af:87:99:35:f4" )
 }
 import "pe"
 
@@ -228345,13 +227779,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D627F1000D12485995514Bfbdefc55D9 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dd18086c-063b-542e-915b-5bd452ee452e"
+		id = "895cc049-e8f0-5de6-8404-b9eaf202be50"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1832-L1843"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9ff60a73b889c8f1df127ead90a93fbf92131cfb475d58eea1ba1569f3e99e00"
+		logic_hash = "v1_sha256_9ff60a73b889c8f1df127ead90a93fbf92131cfb475d58eea1ba1569f3e99e00"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228359,7 +227793,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D627F1000D12485995514Bfbdefc55D9 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THREE D CORPORATION PTY LTD" and pe.signatures[i].serial=="00:d6:27:f1:00:0d:12:48:59:95:51:4b:fb:de:fc:55:d9")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THREE D CORPORATION PTY LTD" and pe.signatures [ i ] . serial == "00:d6:27:f1:00:0d:12:48:59:95:51:4b:fb:de:fc:55:d9" )
 }
 import "pe"
 
@@ -228368,13 +227802,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_62205361A758B00572D417Cba014F007 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7838c733-7212-5e86-bb3c-5dfefb727a4b"
+		id = "917f9015-b94b-56a4-8765-4d5571f459e4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1845-L1856"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "52d67bc94e82bb9a36e969d393c395465c84ff76f89c5f8407c20e2c761000e3"
+		logic_hash = "v1_sha256_52d67bc94e82bb9a36e969d393c395465c84ff76f89c5f8407c20e2c761000e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228382,7 +227816,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_62205361A758B00572D417Cba014F007 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UNITEKH-S, OOO" and pe.signatures[i].serial=="62:20:53:61:a7:58:b0:05:72:d4:17:cb:a0:14:f0:07")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "UNITEKH-S, OOO" and pe.signatures [ i ] . serial == "62:20:53:61:a7:58:b0:05:72:d4:17:cb:a0:14:f0:07" )
 }
 import "pe"
 
@@ -228391,13 +227825,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_566Ac16A57B132D3F64Dced14De790Ee : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "05f49d36-7bf1-5bbc-b728-e1616366c15e"
+		id = "f17125f4-7e81-5eb2-9b8c-671b5ae63272"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1858-L1869"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0618ce3ce0c5f8923c12a99586bbec8ec86229c7e08af75f5b0756f348d53bd5"
+		logic_hash = "v1_sha256_0618ce3ce0c5f8923c12a99586bbec8ec86229c7e08af75f5b0756f348d53bd5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228405,7 +227839,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_566Ac16A57B132D3F64Dced14De790Ee : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unirad LLC" and pe.signatures[i].serial=="56:6a:c1:6a:57:b1:32:d3:f6:4d:ce:d1:4d:e7:90:ee")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Unirad LLC" and pe.signatures [ i ] . serial == "56:6a:c1:6a:57:b1:32:d3:f6:4d:ce:d1:4d:e7:90:ee" )
 }
 import "pe"
 
@@ -228414,13 +227848,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_661Ba8F3C9D1B348413484E9A49502F7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "75fb83a1-c493-510a-8c01-4cc699d71465"
+		id = "cfcadded-5db3-50dc-94cf-804881132087"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1871-L1882"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "661af02d7a206f50e996caf690ded541acab8c8268df9e86744d36f7322efe5c"
+		logic_hash = "v1_sha256_661af02d7a206f50e996caf690ded541acab8c8268df9e86744d36f7322efe5c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228428,7 +227862,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_661Ba8F3C9D1B348413484E9A49502F7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unique Digital Services Ltd." and pe.signatures[i].serial=="66:1b:a8:f3:c9:d1:b3:48:41:34:84:e9:a4:95:02:f7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Unique Digital Services Ltd." and pe.signatures [ i ] . serial == "66:1b:a8:f3:c9:d1:b3:48:41:34:84:e9:a4:95:02:f7" )
 }
 import "pe"
 
@@ -228437,13 +227871,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0092D9B92F8Cf7A1Ba8B2C025Be730C300 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "856b4522-f314-5cbb-872e-08b21107881b"
+		id = "6addbb57-4f7a-5f0a-bc9e-891977466d5a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1884-L1895"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "207fcc48053afb6a435c40fd8e25a88753139c35f4882a1975fdb8c55dc8ea89"
+		logic_hash = "v1_sha256_207fcc48053afb6a435c40fd8e25a88753139c35f4882a1975fdb8c55dc8ea89"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228451,7 +227885,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0092D9B92F8Cf7A1Ba8B2C025Be730C300 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UPLagga Systems s.r.o." and pe.signatures[i].serial=="00:92:d9:b9:2f:8c:f7:a1:ba:8b:2c:02:5b:e7:30:c3:00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "UPLagga Systems s.r.o." and pe.signatures [ i ] . serial == "00:92:d9:b9:2f:8c:f7:a1:ba:8b:2c:02:5b:e7:30:c3:00" )
 }
 import "pe"
 
@@ -228460,13 +227894,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E5Ad42C509A7C24605530D35832C091E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "44615e9d-6677-5642-b56d-82c0577f758c"
+		id = "bacaeca8-33a8-5c56-8e7e-ab55a173be93"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1897-L1908"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8d76474257ee9a24d4785ddd119e586712a157ff7b420a7db2b8efe06c43f76c"
+		logic_hash = "v1_sha256_8d76474257ee9a24d4785ddd119e586712a157ff7b420a7db2b8efe06c43f76c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228474,7 +227908,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E5Ad42C509A7C24605530D35832C091E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VESNA, OOO" and pe.signatures[i].serial=="00:e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VESNA, OOO" and pe.signatures [ i ] . serial == "00:e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e" )
 }
 import "pe"
 
@@ -228483,13 +227917,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3E57584Db26A2C2Ebc24Ae3E1954Fff6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9073846e-97c7-5b2e-a81f-3bbd06699842"
+		id = "03484203-2707-5cc4-8121-a21b82d1895a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1910-L1921"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cfc68c32ceba351610651d34fb420c64bab9a3b1564d9b6392f0ee8cdcdac7de"
+		logic_hash = "v1_sha256_cfc68c32ceba351610651d34fb420c64bab9a3b1564d9b6392f0ee8cdcdac7de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228497,7 +227931,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3E57584Db26A2C2Ebc24Ae3E1954Fff6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zaryad LLC" and pe.signatures[i].serial=="3e:57:58:4d:b2:6a:2c:2e:bc:24:ae:3e:19:54:ff:f6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Zaryad LLC" and pe.signatures [ i ] . serial == "3e:57:58:4d:b2:6a:2c:2e:bc:24:ae:3e:19:54:ff:f6" )
 }
 import "pe"
 
@@ -228506,13 +227940,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_13794371C052Ec0559E9B492Abb25C26 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e2a4fdb2-fa04-5662-bb84-5c0c4892e3af"
+		id = "a91fc0b0-6a0a-5f71-b9e6-f5bfd2b4e08b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1923-L1934"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "af80177181efd92b4e1a4a5c665df01add069dc3b47074bcbdd503516cf5a844"
+		logic_hash = "v1_sha256_af80177181efd92b4e1a4a5c665df01add069dc3b47074bcbdd503516cf5a844"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228520,7 +227954,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_13794371C052Ec0559E9B492Abb25C26 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Carmel group LLC" and pe.signatures[i].serial=="13:79:43:71:c0:52:ec:05:59:e9:b4:92:ab:b2:5c:26")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Carmel group LLC" and pe.signatures [ i ] . serial == "13:79:43:71:c0:52:ec:05:59:e9:b4:92:ab:b2:5c:26" )
 }
 import "pe"
 
@@ -228529,13 +227963,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_51Aead5A9Ab2D841B449Fa82De3A8A00 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d64ff10d-e4dd-5d89-a600-d136571be940"
+		id = "3045a700-438d-5c8a-98dd-4bf99a64d8ca"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1936-L1947"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1658a12bb040b5b16c61469fe52abbaaecf5bd66bf5e45a2c2da9f80fa0c66f5"
+		logic_hash = "v1_sha256_1658a12bb040b5b16c61469fe52abbaaecf5bd66bf5e45a2c2da9f80fa0c66f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228543,7 +227977,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_51Aead5A9Ab2D841B449Fa82De3A8A00 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Corsair Software Solution Inc." and pe.signatures[i].serial=="51:ae:ad:5a:9a:b2:d8:41:b4:49:fa:82:de:3a:8a:00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Corsair Software Solution Inc." and pe.signatures [ i ] . serial == "51:ae:ad:5a:9a:b2:d8:41:b4:49:fa:82:de:3a:8a:00" )
 }
 import "pe"
 
@@ -228552,13 +227986,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Bce1D49Ff444D032Ba3Dda6394A311E9 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ee980353-b7c3-5738-84ae-e51c021e6597"
+		id = "0de55ef3-fc27-5ad3-b08e-dff7b7d4e308"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1949-L1960"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "eeb1556808e790eea964658a8499ec2d9cc5638bf696fbbade2bc08a29fb3e65"
+		logic_hash = "v1_sha256_eeb1556808e790eea964658a8499ec2d9cc5638bf696fbbade2bc08a29fb3e65"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228566,7 +228000,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Bce1D49Ff444D032Ba3Dda6394A311E9 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DECIPHER MEDIA LLC" and pe.signatures[i].serial=="bc:e1:d4:9f:f4:44:d0:32:ba:3d:da:63:94:a3:11:e9")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DECIPHER MEDIA LLC" and pe.signatures [ i ] . serial == "bc:e1:d4:9f:f4:44:d0:32:ba:3d:da:63:94:a3:11:e9" )
 }
 import "pe"
 
@@ -228575,13 +228009,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Dadf44E4046372313Ee97B8E394C4079 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bb7178f4-079f-5f7e-9761-3f73203603c7"
+		id = "b9667032-bd91-5b2a-acf6-e5e130fa3c2f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1962-L1973"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e4480ad6ce302a87e38915ef7ba09a94a4626ed359333276b899474f21d46238"
+		logic_hash = "v1_sha256_e4480ad6ce302a87e38915ef7ba09a94a4626ed359333276b899474f21d46238"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228589,7 +228023,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Dadf44E4046372313Ee97B8E394C4079 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Digital Capital Management Ireland Limited" and pe.signatures[i].serial=="00:da:df:44:e4:04:63:72:31:3e:e9:7b:8e:39:4c:40:79")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Digital Capital Management Ireland Limited" and pe.signatures [ i ] . serial == "00:da:df:44:e4:04:63:72:31:3e:e9:7b:8e:39:4c:40:79" )
 }
 import "pe"
 
@@ -228598,13 +228032,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F8C2E08438Bb0E9Adc955E4B493E5821 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "75f505d0-c79a-5eab-a61f-29ec238ac045"
+		id = "cf5ae09f-927a-5d16-b969-7289fee077d4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1975-L1986"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2258ea96b56acb3025b5b2f39c07d482c375e75323d6f8e8ded91b8dab00656e"
+		logic_hash = "v1_sha256_2258ea96b56acb3025b5b2f39c07d482c375e75323d6f8e8ded91b8dab00656e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228612,7 +228046,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F8C2E08438Bb0E9Adc955E4B493E5821 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DocsGen Software Solutions Inc." and pe.signatures[i].serial=="00:f8:c2:e0:84:38:bb:0e:9a:dc:95:5e:4b:49:3e:58:21")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DocsGen Software Solutions Inc." and pe.signatures [ i ] . serial == "00:f8:c2:e0:84:38:bb:0e:9a:dc:95:5e:4b:49:3e:58:21" )
 }
 import "pe"
 
@@ -228621,13 +228055,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D2Caf7908Aaebfa1A8F3E2136Fece024 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "043a598d-8b84-597f-ac2e-035cc9ccef77"
+		id = "668d8a42-ea40-545a-983d-edd5a704b15e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L1988-L1999"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2c8a322e687ed575e66ff308bcf0950ab87bc5ac3ab561c8cc3d81e9181ac708"
+		logic_hash = "v1_sha256_2c8a322e687ed575e66ff308bcf0950ab87bc5ac3ab561c8cc3d81e9181ac708"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228635,7 +228069,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D2Caf7908Aaebfa1A8F3E2136Fece024 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FANATOR, OOO" and pe.signatures[i].serial=="00:d2:ca:f7:90:8a:ae:bf:a1:a8:f3:e2:13:6f:ec:e0:24")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FANATOR, OOO" and pe.signatures [ i ] . serial == "00:d2:ca:f7:90:8a:ae:bf:a1:a8:f3:e2:13:6f:ec:e0:24" )
 }
 import "pe"
 
@@ -228644,13 +228078,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_003223B4616C2687C04865Bee8321726A8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "05320823-08e5-58f4-896c-ae7f01b40a3b"
+		id = "0ccd577e-fb24-5326-9897-51d1885d97cd"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2001-L2012"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "671e3a589fb24a6c5e38126df45a4767815eff32014172930cab6ffbe135af81"
+		logic_hash = "v1_sha256_671e3a589fb24a6c5e38126df45a4767815eff32014172930cab6ffbe135af81"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228658,7 +228092,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_003223B4616C2687C04865Bee8321726A8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTUNE STAR TRADING, INC." and pe.signatures[i].serial=="32:23:b4:61:6c:26:87:c0:48:65:be:e8:32:17:26:a8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FORTUNE STAR TRADING, INC." and pe.signatures [ i ] . serial == "32:23:b4:61:6c:26:87:c0:48:65:be:e8:32:17:26:a8" )
 }
 import "pe"
 
@@ -228667,13 +228101,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Fa13Ae98E17Ae23Fcfe7Ae873D0C120 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5e926cb1-efd0-5f9d-9327-341bb2f1a5f5"
+		id = "e7ac456a-9887-541e-8c3f-6aaeef3a3729"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2014-L2025"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "312d810386aebb509ffbd09d6b1ad6a761a03bc07ba5e4a158235786063389a9"
+		logic_hash = "v1_sha256_312d810386aebb509ffbd09d6b1ad6a761a03bc07ba5e4a158235786063389a9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228681,7 +228115,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Fa13Ae98E17Ae23Fcfe7Ae873D0C120 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KLAKSON, LLC" and pe.signatures[i].serial=="0f:a1:3a:e9:8e:17:ae:23:fc:fe:7a:e8:73:d0:c1:20")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KLAKSON, LLC" and pe.signatures [ i ] . serial == "0f:a1:3a:e9:8e:17:ae:23:fc:fe:7a:e8:73:d0:c1:20" )
 }
 import "pe"
 
@@ -228690,13 +228124,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3696883055975D571199C6B5D48F3Cd5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8af62be2-488f-5474-b674-73bf157dff00"
+		id = "fe9b35a9-8f5c-531f-ab33-a9626903cb5f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2027-L2038"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9232413a071a6100ba806b1fad2cd6cd2bb85351c36ad25cfc31b66ad041d686"
+		logic_hash = "v1_sha256_9232413a071a6100ba806b1fad2cd6cd2bb85351c36ad25cfc31b66ad041d686"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228704,7 +228138,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3696883055975D571199C6B5D48F3Cd5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Korist Networks Incorporated" and pe.signatures[i].serial=="36:96:88:30:55:97:5d:57:11:99:c6:b5:d4:8f:3c:d5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Korist Networks Incorporated" and pe.signatures [ i ] . serial == "36:96:88:30:55:97:5d:57:11:99:c6:b5:d4:8f:3c:d5" )
 }
 import "pe"
 
@@ -228713,13 +228147,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Aff762E907F0644E76Ed8A7485Fb12A1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "92113fc4-ef5b-5e86-bc8e-baf342ddf276"
+		id = "791fb1ea-608d-5e27-813b-dd4b61e3629d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2040-L2051"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0be4642f6aaf2183d593240efcc8c2046970d3806a67ff53ca4ce7ee85df90e5"
+		logic_hash = "v1_sha256_0be4642f6aaf2183d593240efcc8c2046970d3806a67ff53ca4ce7ee85df90e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228727,7 +228161,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Aff762E907F0644E76Ed8A7485Fb12A1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lets Start SP Z O O" and pe.signatures[i].serial=="00:af:f7:62:e9:07:f0:64:4e:76:ed:8a:74:85:fb:12:a1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Lets Start SP Z O O" and pe.signatures [ i ] . serial == "00:af:f7:62:e9:07:f0:64:4e:76:ed:8a:74:85:fb:12:a1" )
 }
 import "pe"
 
@@ -228736,13 +228170,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5B440A47E8Ce3Dd202271E5C7A666C78 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "62c9a37c-e4dd-5925-a019-08bf6a77476d"
+		id = "af565050-bd78-588a-b57f-436cfa4b6fd6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2053-L2064"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f898a3495e173d85fd62598da87ab15cbee0674519231a5e770204a4db3cd93f"
+		logic_hash = "v1_sha256_f898a3495e173d85fd62598da87ab15cbee0674519231a5e770204a4db3cd93f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228750,7 +228184,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5B440A47E8Ce3Dd202271E5C7A666C78 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Master Networking s.r.o." and pe.signatures[i].serial=="5b:44:0a:47:e8:ce:3d:d2:02:27:1e:5c:7a:66:6c:78")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Master Networking s.r.o." and pe.signatures [ i ] . serial == "5b:44:0a:47:e8:ce:3d:d2:02:27:1e:5c:7a:66:6c:78" )
 }
 import "pe"
 
@@ -228759,13 +228193,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fe41941464B9992A69B7317418Ae8Eb7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "44626304-7f68-5d3a-81b4-91ee0bd09cc3"
+		id = "e1a77e3e-6039-58be-9d4a-2061f7bcefff"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2066-L2077"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "713a2cfc95b83de71064e198b26b716790c7cf21674961720695ab6749cb2ad1"
+		logic_hash = "v1_sha256_713a2cfc95b83de71064e198b26b716790c7cf21674961720695ab6749cb2ad1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228773,7 +228207,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fe41941464B9992A69B7317418Ae8Eb7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Milsean Software Limited" and pe.signatures[i].serial=="00:fe:41:94:14:64:b9:99:2a:69:b7:31:74:18:ae:8e:b7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Milsean Software Limited" and pe.signatures [ i ] . serial == "00:fe:41:94:14:64:b9:99:2a:69:b7:31:74:18:ae:8e:b7" )
 }
 import "pe"
 
@@ -228782,13 +228216,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_29128A56E7B3Bfb230742591Ac8B4718 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "58a9e9f1-531b-5dee-aa11-1537838e9d3f"
+		id = "b3d2839c-bf90-59c3-a4f6-c9fe6f5b039a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2079-L2090"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "16c9843b5e3edafa64e07626fda494452efa5d0bcaa80d7d80683258c2b9acd4"
+		logic_hash = "v1_sha256_16c9843b5e3edafa64e07626fda494452efa5d0bcaa80d7d80683258c2b9acd4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228796,7 +228230,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_29128A56E7B3Bfb230742591Ac8B4718 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Programavimo paslaugos, MB" and pe.signatures[i].serial=="29:12:8a:56:e7:b3:bf:b2:30:74:25:91:ac:8b:47:18")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Programavimo paslaugos, MB" and pe.signatures [ i ] . serial == "29:12:8a:56:e7:b3:bf:b2:30:74:25:91:ac:8b:47:18" )
 }
 import "pe"
 
@@ -228805,13 +228239,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C2Bb11Cfc5E80Bf4E8Db2Ed0Aa7E50C5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d22ee868-71a7-52f4-93f3-b04b105fd399"
+		id = "9c739af0-cc92-58bc-8a61-9ca399369fe1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2092-L2103"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e54eeea70e85396b26fe188b848ef37c619aae5fc909c1a06ad0bc42fb9b0468"
+		logic_hash = "v1_sha256_e54eeea70e85396b26fe188b848ef37c619aae5fc909c1a06ad0bc42fb9b0468"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228819,7 +228253,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C2Bb11Cfc5E80Bf4E8Db2Ed0Aa7E50C5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rooth Media Enterprises Limited" and pe.signatures[i].serial=="00:c2:bb:11:cf:c5:e8:0b:f4:e8:db:2e:d0:aa:7e:50:c5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rooth Media Enterprises Limited" and pe.signatures [ i ] . serial == "00:c2:bb:11:cf:c5:e8:0b:f4:e8:db:2e:d0:aa:7e:50:c5" )
 }
 import "pe"
 
@@ -228828,13 +228262,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_040Cc2255Db4E48Da1B4F242F5Edfa73 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4673a61f-1c2b-5f92-af28-d55b5d913784"
+		id = "0520fa6e-714c-53f1-a7fb-9d524af4a2ac"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2105-L2116"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ade204ebb2bf26515984d20ae459aaea56136acfd37a54abc794969fd05c54ce"
+		logic_hash = "v1_sha256_ade204ebb2bf26515984d20ae459aaea56136acfd37a54abc794969fd05c54ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228842,7 +228276,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_040Cc2255Db4E48Da1B4F242F5Edfa73 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Softland SRL" and pe.signatures[i].serial=="04:0c:c2:25:5d:b4:e4:8d:a1:b4:f2:42:f5:ed:fa:73")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Softland SRL" and pe.signatures [ i ] . serial == "04:0c:c2:25:5d:b4:e4:8d:a1:b4:f2:42:f5:ed:fa:73" )
 }
 import "pe"
 
@@ -228851,13 +228285,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Bcaed3Ef678F2F9Bf38D09E149B8D70 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "decdae98-333f-58b3-8c48-b997da5fc3f3"
+		id = "3905b95a-c947-5ca3-bf66-fdbebfee2e94"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2118-L2129"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9981e0aed672ebfcbe7f0bc1eee6a26a1523b8577d5ee572612aaebf23d1fbcf"
+		logic_hash = "v1_sha256_9981e0aed672ebfcbe7f0bc1eee6a26a1523b8577d5ee572612aaebf23d1fbcf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228865,7 +228299,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Bcaed3Ef678F2F9Bf38D09E149B8D70 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "StarY Media Inc." and pe.signatures[i].serial=="3b:ca:ed:3e:f6:78:f2:f9:bf:38:d0:9e:14:9b:8d:70")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "StarY Media Inc." and pe.signatures [ i ] . serial == "3b:ca:ed:3e:f6:78:f2:f9:bf:38:d0:9e:14:9b:8d:70" )
 }
 import "pe"
 
@@ -228874,13 +228308,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_091736D368A5980Ebeb433A0Ecb49Fbb : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fb9446b5-2d49-51de-bedb-ea541d415ae2"
+		id = "052ec2bd-891b-5c85-8910-67c1dbe9fae6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2131-L2142"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "858a98ba8fd3244b2c0f6d3dd89a294b0187dd1a82cdcca67c162985d80ca6ed"
+		logic_hash = "v1_sha256_858a98ba8fd3244b2c0f6d3dd89a294b0187dd1a82cdcca67c162985d80ca6ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228888,7 +228322,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_091736D368A5980Ebeb433A0Ecb49Fbb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ELEKSIR, OOO" and pe.signatures[i].serial=="09:17:36:d3:68:a5:98:0e:be:b4:33:a0:ec:b4:9f:bb")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ELEKSIR, OOO" and pe.signatures [ i ] . serial == "09:17:36:d3:68:a5:98:0e:be:b4:33:a0:ec:b4:9f:bb" )
 }
 import "pe"
 
@@ -228897,13 +228331,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E48Cb3314977D77Dedcd4C77Dd144C50 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9b708e1b-a878-5244-8fe2-3061f058a9ab"
+		id = "fa147843-1ec9-5af5-9bc0-9eb527a84d92"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2144-L2155"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a2ca0ce3812be5e46cb0bc9c73fc4f31294c8d594ca821ad924a3f06cf2430ca"
+		logic_hash = "v1_sha256_a2ca0ce3812be5e46cb0bc9c73fc4f31294c8d594ca821ad924a3f06cf2430ca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228911,7 +228345,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E48Cb3314977D77Dedcd4C77Dd144C50 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BESPOKE SOFTWARE SOLUTIONS LIMITED" and pe.signatures[i].serial=="00:e4:8c:b3:31:49:77:d7:7d:ed:cd:4c:77:dd:14:4c:50")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BESPOKE SOFTWARE SOLUTIONS LIMITED" and pe.signatures [ i ] . serial == "00:e4:8c:b3:31:49:77:d7:7d:ed:cd:4c:77:dd:14:4c:50" )
 }
 import "pe"
 
@@ -228920,13 +228354,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1E72A72351Aecf884Df9Cdb77A16Fd84 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7972befe-3a88-5ea5-a865-3d008b712bc9"
+		id = "cde21894-69d7-5494-90ba-0ce919725599"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2157-L2168"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6555b89f1643f2e461a936df402dcbe8dd5100a1def76c7c6d8f792d1c0ed006"
+		logic_hash = "v1_sha256_6555b89f1643f2e461a936df402dcbe8dd5100a1def76c7c6d8f792d1c0ed006"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228934,7 +228368,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1E72A72351Aecf884Df9Cdb77A16Fd84 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Buket and Co." and pe.signatures[i].serial=="1e:72:a7:23:51:ae:cf:88:4d:f9:cd:b7:7a:16:fd:84")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Buket and Co." and pe.signatures [ i ] . serial == "1e:72:a7:23:51:ae:cf:88:4d:f9:cd:b7:7a:16:fd:84" )
 }
 import "pe"
 
@@ -228943,13 +228377,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B383658885E271129A43D19De40C1Fc6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "47389dc4-8092-5e12-91a1-f370c9c507a9"
+		id = "deb79387-2539-51cd-8b0f-bb7a3e90c25c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2170-L2181"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9312bc8f1005d71393ab63f05bdabff52752ad939dd4311485dc4b56f75eece9"
+		logic_hash = "v1_sha256_9312bc8f1005d71393ab63f05bdabff52752ad939dd4311485dc4b56f75eece9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228957,7 +228391,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B383658885E271129A43D19De40C1Fc6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elekon" and pe.signatures[i].serial=="00:b3:83:65:88:85:e2:71:12:9a:43:d1:9d:e4:0c:1f:c6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Elekon" and pe.signatures [ i ] . serial == "00:b3:83:65:88:85:e2:71:12:9a:43:d1:9d:e4:0c:1f:c6" )
 }
 import "pe"
 
@@ -228966,13 +228400,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ca7D54577243934F665Fd1D443855A3D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8519119d-a37b-5438-a642-48e1d40024b8"
+		id = "aacc93ed-673e-5ef7-8807-f27ac5ecf725"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2183-L2194"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "867844464609a043902f07aad3fa568b482259655bc181d992bd409437165790"
+		logic_hash = "v1_sha256_867844464609a043902f07aad3fa568b482259655bc181d992bd409437165790"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -228980,7 +228414,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ca7D54577243934F665Fd1D443855A3D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FABO SP Z O O" and pe.signatures[i].serial=="00:ca:7d:54:57:72:43:93:4f:66:5f:d1:d4:43:85:5a:3d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FABO SP Z O O" and pe.signatures [ i ] . serial == "00:ca:7d:54:57:72:43:93:4f:66:5f:d1:d4:43:85:5a:3d" )
 }
 import "pe"
 
@@ -228989,13 +228423,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7709D2Df39E9A4F7Db2F3Cbc29B49743 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "55e8815f-0885-5eb0-bf85-05bbd874a821"
+		id = "fa816a2f-f56c-51ec-9bea-c13803233868"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2196-L2207"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b63fa6e4e92549ae92b9a414390471c49fd50010bb7e10e1db72ff53370a6354"
+		logic_hash = "v1_sha256_b63fa6e4e92549ae92b9a414390471c49fd50010bb7e10e1db72ff53370a6354"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229003,7 +228437,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7709D2Df39E9A4F7Db2F3Cbc29B49743 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Grina LLC" and pe.signatures[i].serial=="77:09:d2:df:39:e9:a4:f7:db:2f:3c:bc:29:b4:97:43")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Grina LLC" and pe.signatures [ i ] . serial == "77:09:d2:df:39:e9:a4:f7:db:2f:3c:bc:29:b4:97:43" )
 }
 import "pe"
 
@@ -229012,13 +228446,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_186D49Fac34Ce99775B8E7Ffbf50679D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "eeea3085-9fd7-5077-8c13-e0c4438b2e79"
+		id = "298e1273-9489-55c4-80b1-6a4085090178"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2209-L2220"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "950b14787e707be843d1443a612c372ceb0c2830de20bce1f62317fa39149e5b"
+		logic_hash = "v1_sha256_950b14787e707be843d1443a612c372ceb0c2830de20bce1f62317fa39149e5b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229026,7 +228460,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_186D49Fac34Ce99775B8E7Ffbf50679D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hairis LLC" and pe.signatures[i].serial=="18:6d:49:fa:c3:4c:e9:97:75:b8:e7:ff:bf:50:67:9d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Hairis LLC" and pe.signatures [ i ] . serial == "18:6d:49:fa:c3:4c:e9:97:75:b8:e7:ff:bf:50:67:9d" )
 }
 import "pe"
 
@@ -229035,13 +228469,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0097Df46Acb26B7C81A13Cc467B47688C8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1c281766-abd4-534b-9442-233369e1f55e"
+		id = "0a007d44-e6d4-50fc-ae1f-b08e2c3ac81f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2222-L2233"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ab4da0ddd001acf9f8d78c4beb28c648f8516088561e3140739b4b41d93b58ef"
+		logic_hash = "v1_sha256_ab4da0ddd001acf9f8d78c4beb28c648f8516088561e3140739b4b41d93b58ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229049,7 +228483,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0097Df46Acb26B7C81A13Cc467B47688C8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Information Civilized System Oy" and pe.signatures[i].serial=="00:97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Information Civilized System Oy" and pe.signatures [ i ] . serial == "00:97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8" )
 }
 import "pe"
 
@@ -229058,13 +228492,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2A52Acb34Bd075Ac9F58771D2A4Bbfba : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2d6b6ff5-e081-5e91-b03f-6e0d02afdb8f"
+		id = "1fd65170-3c27-5247-b966-709fd4984ad8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2235-L2246"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9ffad34a94e9210bb98021c0ee0ddba4144406cca976537efe24e63367a295cd"
+		logic_hash = "v1_sha256_9ffad34a94e9210bb98021c0ee0ddba4144406cca976537efe24e63367a295cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229072,7 +228506,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2A52Acb34Bd075Ac9F58771D2A4Bbfba : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Katarzyna Galganek mim e coc" and pe.signatures[i].serial=="2a:52:ac:b3:4b:d0:75:ac:9f:58:77:1d:2a:4b:bf:ba")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Katarzyna Galganek mim e coc" and pe.signatures [ i ] . serial == "2a:52:ac:b3:4b:d0:75:ac:9f:58:77:1d:2a:4b:bf:ba" )
 }
 import "pe"
 
@@ -229081,13 +228515,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5A9D897077A22Afe7Ad4C4A01Df6C418 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e44fcc54-9d0c-5b9b-a34a-03f31ae5333d"
+		id = "fc00e808-d96f-5034-b9ee-6cca73c3ebfc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2248-L2259"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f82b59f5d1996ae37b0cb7f7a799e2fcc7d9da0ffddfe63cbbb84b6f0e7e7b23"
+		logic_hash = "v1_sha256_f82b59f5d1996ae37b0cb7f7a799e2fcc7d9da0ffddfe63cbbb84b6f0e7e7b23"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229095,7 +228529,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5A9D897077A22Afe7Ad4C4A01Df6C418 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Klarens LLC" and pe.signatures[i].serial=="5a:9d:89:70:77:a2:2a:fe:7a:d4:c4:a0:1d:f6:c4:18")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Klarens LLC" and pe.signatures [ i ] . serial == "5a:9d:89:70:77:a2:2a:fe:7a:d4:c4:a0:1d:f6:c4:18" )
 }
 import "pe"
 
@@ -229104,13 +228538,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D7C432E8D4Edef515Bfb9D1C214Ff0F5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fc3fd388-91f6-5f53-a284-4ef0a7d22290"
+		id = "2de9dab3-057d-57f5-8b7c-b867b8d0ec57"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2261-L2272"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9ef64774a0b6b11820321cd36d49213ad245cea82960aab99bb18e44a2ee79a8"
+		logic_hash = "v1_sha256_9ef64774a0b6b11820321cd36d49213ad245cea82960aab99bb18e44a2ee79a8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229118,7 +228552,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D7C432E8D4Edef515Bfb9D1C214Ff0F5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC \"MILKY PUT\"" and pe.signatures[i].serial=="00:d7:c4:32:e8:d4:ed:ef:51:5b:fb:9d:1c:21:4f:f0:f5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LLC \"MILKY PUT\"" and pe.signatures [ i ] . serial == "00:d7:c4:32:e8:d4:ed:ef:51:5b:fb:9d:1c:21:4f:f0:f5" )
 }
 import "pe"
 
@@ -229127,13 +228561,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0085E1Af2Be0F380E5A5D11513Ddf45Fc6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d55fd5ca-0e20-51de-84b6-f30dd2660529"
+		id = "f967f5e0-165b-54af-812d-2d1f84905f46"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2274-L2285"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5a86b9aecf7697bd8e1f40407934c6a9941714404a931b0f1bed4ae7440f6921"
+		logic_hash = "v1_sha256_5a86b9aecf7697bd8e1f40407934c6a9941714404a931b0f1bed4ae7440f6921"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229141,7 +228575,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0085E1Af2Be0F380E5A5D11513Ddf45Fc6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Makke Digital Works" and pe.signatures[i].serial=="00:85:e1:af:2b:e0:f3:80:e5:a5:d1:15:13:dd:f4:5f:c6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Makke Digital Works" and pe.signatures [ i ] . serial == "00:85:e1:af:2b:e0:f3:80:e5:a5:d1:15:13:dd:f4:5f:c6" )
 }
 import "pe"
 
@@ -229150,13 +228584,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02Aa497D39320Fc979Ad96160D90D410 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9387010e-94f5-5787-b30f-609d98c48ddf"
+		id = "276e2d1e-d8fb-5128-b0f4-13a6817f259d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2287-L2298"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "762b1730c8cfcf5a89e49858723d5701c1fb958eb2cd4da5b240f21763cdabf8"
+		logic_hash = "v1_sha256_762b1730c8cfcf5a89e49858723d5701c1fb958eb2cd4da5b240f21763cdabf8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229164,7 +228598,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02Aa497D39320Fc979Ad96160D90D410 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MATCHLESS GIFTS, INC." and pe.signatures[i].serial=="02:aa:49:7d:39:32:0f:c9:79:ad:96:16:0d:90:d4:10")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MATCHLESS GIFTS, INC." and pe.signatures [ i ] . serial == "02:aa:49:7d:39:32:0f:c9:79:ad:96:16:0d:90:d4:10" )
 }
 import "pe"
 
@@ -229173,13 +228607,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_D0B094274C761F367A8Eaea08E1D9C8F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3683b66b-3dc0-5b89-be71-1e1267ef7de8"
+		id = "734edca9-f7a8-56ba-a9f4-b315da4c1e8f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2300-L2311"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5ce9be0bdd8350dd5a8ae8cf2447d1be6b34ee3abc5c19754c63ef03b7cccec9"
+		logic_hash = "v1_sha256_5ce9be0bdd8350dd5a8ae8cf2447d1be6b34ee3abc5c19754c63ef03b7cccec9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229187,7 +228621,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_D0B094274C761F367A8Eaea08E1D9C8F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nsasoft US LLC" and pe.signatures[i].serial=="d0:b0:94:27:4c:76:1f:36:7a:8e:ae:a0:8e:1d:9c:8f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Nsasoft US LLC" and pe.signatures [ i ] . serial == "d0:b0:94:27:4c:76:1f:36:7a:8e:ae:a0:8e:1d:9c:8f" )
 }
 import "pe"
 
@@ -229196,13 +228630,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D59A05955A4A421500F9561Ce983Aac4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "97c4e8fa-8d66-500f-a63f-fac84ad9e508"
+		id = "251e771d-8263-548a-a5c7-01b5b0564a4c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2313-L2324"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9187dcdbf29e5119d90ede266a14c7e46f5050800a38c57fa86e957c885c1d60"
+		logic_hash = "v1_sha256_9187dcdbf29e5119d90ede266a14c7e46f5050800a38c57fa86e957c885c1d60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229210,7 +228644,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D59A05955A4A421500F9561Ce983Aac4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Olymp LLC" and pe.signatures[i].serial=="00:d5:9a:05:95:5a:4a:42:15:00:f9:56:1c:e9:83:aa:c4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Olymp LLC" and pe.signatures [ i ] . serial == "00:d5:9a:05:95:5a:4a:42:15:00:f9:56:1c:e9:83:aa:c4" )
 }
 import "pe"
 
@@ -229219,13 +228653,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_35590Ebe4A02Dc23317D8Ce47A947A9B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "36630916-26df-5d2c-8faf-9fa2e240bff3"
+		id = "252a5f74-dac7-56c2-a304-f0254f9beccf"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2326-L2337"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c01f9ecb1e69f6d0cb8061930cda27469eb18be19c0471192b31d516cddf828f"
+		logic_hash = "v1_sha256_c01f9ecb1e69f6d0cb8061930cda27469eb18be19c0471192b31d516cddf828f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229233,7 +228667,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_35590Ebe4A02Dc23317D8Ce47A947A9B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Largos" and pe.signatures[i].serial=="35:59:0e:be:4a:02:dc:23:31:7d:8c:e4:7a:94:7a:9b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Largos" and pe.signatures [ i ] . serial == "35:59:0e:be:4a:02:dc:23:31:7d:8c:e4:7a:94:7a:9b" )
 }
 import "pe"
 
@@ -229242,13 +228676,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1F23F001458716D435Cca1A55D660Ec5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "16a904e4-bf1a-5530-9269-d92c0f1bb4d3"
+		id = "0188e0bb-5507-5fb2-b9c4-a9922d9b983f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2339-L2350"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3e91429f7b25ad54103ee230a36d4b51060adb458b533b9cbd00178a02676629"
+		logic_hash = "v1_sha256_3e91429f7b25ad54103ee230a36d4b51060adb458b533b9cbd00178a02676629"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229256,7 +228690,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1F23F001458716D435Cca1A55D660Ec5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Ringen" and pe.signatures[i].serial=="1f:23:f0:01:45:87:16:d4:35:cc:a1:a5:5d:66:0e:c5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Ringen" and pe.signatures [ i ] . serial == "1f:23:f0:01:45:87:16:d4:35:cc:a1:a5:5d:66:0e:c5" )
 }
 import "pe"
 
@@ -229265,13 +228699,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C2Fc83D458E653837Fcfc132C9B03062 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fbc9420d-4670-502f-af6a-13d17fb73938"
+		id = "f73f3061-9d6c-53e5-8236-27c577d15e9e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2352-L2363"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "96ed5e78195f12cdc0316ed454ad4e2235253ed897905c4a97756b306933d874"
+		logic_hash = "v1_sha256_96ed5e78195f12cdc0316ed454ad4e2235253ed897905c4a97756b306933d874"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229279,7 +228713,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C2Fc83D458E653837Fcfc132C9B03062 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Vertical" and pe.signatures[i].serial=="00:c2:fc:83:d4:58:e6:53:83:7f:cf:c1:32:c9:b0:30:62")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Vertical" and pe.signatures [ i ] . serial == "00:c2:fc:83:d4:58:e6:53:83:7f:cf:c1:32:c9:b0:30:62" )
 }
 import "pe"
 
@@ -229288,13 +228722,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fcb3D3519E66E5B6D90B8B595F558E81 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "966650b5-d776-5ed0-a99b-507b46abd882"
+		id = "5093a703-8bd1-5f9f-9f34-7423af8c451a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2365-L2376"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "62c7189cc906b9f2d2724492489218d9aecf08ef431463ebf1963b034222f2ad"
+		logic_hash = "v1_sha256_62c7189cc906b9f2d2724492489218d9aecf08ef431463ebf1963b034222f2ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229302,7 +228736,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fcb3D3519E66E5B6D90B8B595F558E81 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pegasun" and pe.signatures[i].serial=="fc:b3:d3:51:9e:66:e5:b6:d9:0b:8b:59:5f:55:8e:81")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Pegasun" and pe.signatures [ i ] . serial == "fc:b3:d3:51:9e:66:e5:b6:d9:0b:8b:59:5f:55:8e:81" )
 }
 import "pe"
 
@@ -229311,13 +228745,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4B03Cabe6A0481F17A2Dbeb9Aefad425 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3995296a-58ce-5615-8524-525698af3537"
+		id = "37230816-bab3-5ea1-8c20-b6168db071f3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2378-L2389"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e3c0d68a65bc53b83a48310857605afda0004b4122201c18a66fea085a210924"
+		logic_hash = "v1_sha256_e3c0d68a65bc53b83a48310857605afda0004b4122201c18a66fea085a210924"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229325,7 +228759,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4B03Cabe6A0481F17A2Dbeb9Aefad425 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RASSVET, OOO" and pe.signatures[i].serial=="4b:03:ca:be:6a:04:81:f1:7a:2d:be:b9:ae:fa:d4:25")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RASSVET, OOO" and pe.signatures [ i ] . serial == "4b:03:ca:be:6a:04:81:f1:7a:2d:be:b9:ae:fa:d4:25" )
 }
 import "pe"
 
@@ -229334,13 +228768,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_539015999E304A5952985A994F9C3A53 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b53f5843-fb4c-5c61-be24-21bdbc445239"
+		id = "55fc19ec-ff81-5c46-9ebf-e548aab3df7c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2391-L2402"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "72304761de1d5e81659487947a1cfa017f7f41d5639f18634db4dfd094980518"
+		logic_hash = "v1_sha256_72304761de1d5e81659487947a1cfa017f7f41d5639f18634db4dfd094980518"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229348,7 +228782,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_539015999E304A5952985A994F9C3A53 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Service lab LLC" and pe.signatures[i].serial=="53:90:15:99:9e:30:4a:59:52:98:5a:99:4f:9c:3a:53")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Service lab LLC" and pe.signatures [ i ] . serial == "53:90:15:99:9e:30:4a:59:52:98:5a:99:4f:9c:3a:53" )
 }
 import "pe"
 
@@ -229357,13 +228791,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_016836311Fc39Fbb8E6F308Bb03Cc2B3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "06cc9c38-c5a6-5311-8ceb-943ea3993fc7"
+		id = "ac05afc9-2054-53e5-9bbb-7818c041b010"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2404-L2415"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "912d490ac5d746c584e4dd5639be98d9577faba215cc1f8ebdf360581be53d5c"
+		logic_hash = "v1_sha256_912d490ac5d746c584e4dd5639be98d9577faba215cc1f8ebdf360581be53d5c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229371,7 +228805,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_016836311Fc39Fbb8E6F308Bb03Cc2B3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SERVICE STREAM LIMITED" and pe.signatures[i].serial=="01:68:36:31:1f:c3:9f:bb:8e:6f:30:8b:b0:3c:c2:b3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SERVICE STREAM LIMITED" and pe.signatures [ i ] . serial == "01:68:36:31:1f:c3:9f:bb:8e:6f:30:8b:b0:3c:c2:b3" )
 }
 import "pe"
 
@@ -229380,13 +228814,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009Bd81A9Adaf71F1Ff081C1F4A05D7Fd7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "deedbc3a-8c77-5c2c-b3c1-40e5d082ec5a"
+		id = "f5927668-0ac2-592d-b7d9-163f434d9bea"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2417-L2428"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "85efd10f6c49b93215c9f8f97915c62fb3ed3bb158b2137e953022b550263726"
+		logic_hash = "v1_sha256_85efd10f6c49b93215c9f8f97915c62fb3ed3bb158b2137e953022b550263726"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229394,7 +228828,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009Bd81A9Adaf71F1Ff081C1F4A05D7Fd7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SMART TOYS AND GAMES" and pe.signatures[i].serial=="00:9b:d8:1a:9a:da:f7:1f:1f:f0:81:c1:f4:a0:5d:7f:d7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SMART TOYS AND GAMES" and pe.signatures [ i ] . serial == "00:9b:d8:1a:9a:da:f7:1f:1f:f0:81:c1:f4:a0:5d:7f:d7" )
 }
 import "pe"
 
@@ -229403,13 +228837,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_082023879112289Bf351D297Cc8Efcfc : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "292f99be-2eb0-5ad1-bd07-766de7822f1e"
+		id = "7b3e04df-09ee-5b38-8cf0-10dffb51dca9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2430-L2441"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0747b37139daaba10a17098aeb0c6246290fbd997345de34ce9de8da26d7db05"
+		logic_hash = "v1_sha256_0747b37139daaba10a17098aeb0c6246290fbd997345de34ce9de8da26d7db05"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229417,7 +228851,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_082023879112289Bf351D297Cc8Efcfc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STA-R TOV" and pe.signatures[i].serial=="08:20:23:87:91:12:28:9b:f3:51:d2:97:cc:8e:fc:fc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "STA-R TOV" and pe.signatures [ i ] . serial == "08:20:23:87:91:12:28:9b:f3:51:d2:97:cc:8e:fc:fc" )
 }
 import "pe"
 
@@ -229426,13 +228860,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ece6Cbf67Dc41635A5E5D075F286Af23 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "53312007-179d-547c-8195-0b5d78181300"
+		id = "3e602e0f-9fd3-5aef-a0b6-f2d2c0fa4e4c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2443-L2454"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "27ecc138f8d574c15095032c35ad51c00d8b98f21162d1f59f1f9ca9e5b54391"
+		logic_hash = "v1_sha256_27ecc138f8d574c15095032c35ad51c00d8b98f21162d1f59f1f9ca9e5b54391"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229440,7 +228874,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ece6Cbf67Dc41635A5E5D075F286Af23 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THRANE AGENTUR ApS" and pe.signatures[i].serial=="00:ec:e6:cb:f6:7d:c4:16:35:a5:e5:d0:75:f2:86:af:23")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THRANE AGENTUR ApS" and pe.signatures [ i ] . serial == "00:ec:e6:cb:f6:7d:c4:16:35:a5:e5:d0:75:f2:86:af:23" )
 }
 import "pe"
 
@@ -229449,13 +228883,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Fb6Bae8834Edd8D3D58818Edc86D7D7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "65f5e05c-f5cd-53ba-b4ec-7f412aa63796"
+		id = "c0f2f608-5646-5e7c-947b-8b1cd3d7fc1a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2456-L2467"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9cec6eae024d738c68d670fb61f7667bdc156245da83e5d0ae0f2012baa5bc0a"
+		logic_hash = "v1_sha256_9cec6eae024d738c68d670fb61f7667bdc156245da83e5d0ae0f2012baa5bc0a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229463,7 +228897,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Fb6Bae8834Edd8D3D58818Edc86D7D7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tramplink LLC" and pe.signatures[i].serial=="5f:b6:ba:e8:83:4e:dd:8d:3d:58:81:8e:dc:86:d7:d7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Tramplink LLC" and pe.signatures [ i ] . serial == "5f:b6:ba:e8:83:4e:dd:8d:3d:58:81:8e:dc:86:d7:d7" )
 }
 import "pe"
 
@@ -229472,13 +228906,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6E0Ccbdfb4777E10Ea6221B90Dc350C2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c8f66f21-db29-5a5d-a74d-58c152a17bc3"
+		id = "6281b2de-9b2f-5754-a42f-990f86dae795"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2469-L2480"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fee9662133f0a3d88ce97c27f150bcea8faf21b4c4b97f90bb2aae73ee332bb9"
+		logic_hash = "v1_sha256_fee9662133f0a3d88ce97c27f150bcea8faf21b4c4b97f90bb2aae73ee332bb9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229486,7 +228920,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6E0Ccbdfb4777E10Ea6221B90Dc350C2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRAUMALAB INTERNATIONAL APS" and pe.signatures[i].serial=="6e:0c:cb:df:b4:77:7e:10:ea:62:21:b9:0d:c3:50:c2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TRAUMALAB INTERNATIONAL APS" and pe.signatures [ i ] . serial == "6e:0c:cb:df:b4:77:7e:10:ea:62:21:b9:0d:c3:50:c2" )
 }
 import "pe"
 
@@ -229495,13 +228929,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1249Aa2Ada4967969B71Ce63Bf187C38 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3af35255-7583-5463-b130-ebc8abd4803b"
+		id = "44a90840-c747-5c67-93f5-82ecbccd1d89"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2482-L2493"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9f8ff46a3b0f5179c2c3b89e82188183fa399c67c3f0ebc28218cf3cb4ce5c70"
+		logic_hash = "v1_sha256_9f8ff46a3b0f5179c2c3b89e82188183fa399c67c3f0ebc28218cf3cb4ce5c70"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229509,7 +228943,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1249Aa2Ada4967969B71Ce63Bf187C38 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Umbrella LLC" and pe.signatures[i].serial=="12:49:aa:2a:da:49:67:96:9b:71:ce:63:bf:18:7c:38")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Umbrella LLC" and pe.signatures [ i ] . serial == "12:49:aa:2a:da:49:67:96:9b:71:ce:63:bf:18:7c:38" )
 }
 import "pe"
 
@@ -229518,13 +228952,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Dcd0699Da08915Dde6D044Cb474157C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0b4e1d10-d385-5ca8-b9e2-00341a4c6fd9"
+		id = "6e9455eb-7b62-586a-a568-c0166131dddb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2495-L2506"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "096cf4bb17aa86821bd8d6c8b9fd603664beb12f54a97a87e660b560bd0fc246"
+		logic_hash = "v1_sha256_096cf4bb17aa86821bd8d6c8b9fd603664beb12f54a97a87e660b560bd0fc246"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229532,7 +228966,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Dcd0699Da08915Dde6D044Cb474157C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VENTE DE TOUT" and pe.signatures[i].serial=="2d:cd:06:99:da:08:91:5d:de:6d:04:4c:b4:74:15:7c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VENTE DE TOUT" and pe.signatures [ i ] . serial == "2d:cd:06:99:da:08:91:5d:de:6d:04:4c:b4:74:15:7c" )
 }
 import "pe"
 
@@ -229541,13 +228975,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008D52Fb12A2511E86Bbb0Ba75C517Eab0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "04b78a1c-bb2c-5844-933b-f95a0cc8c71e"
+		id = "a1fc9aec-01fe-5c86-96d2-bea07a88944d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2508-L2519"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "23dc0500af88af0e2c8ea7ff2c5a149d24fb7fd23853c4bf5ee5921a66a34672"
+		logic_hash = "v1_sha256_23dc0500af88af0e2c8ea7ff2c5a149d24fb7fd23853c4bf5ee5921a66a34672"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229555,7 +228989,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008D52Fb12A2511E86Bbb0Ba75C517Eab0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VThink Software Consulting Inc." and pe.signatures[i].serial=="00:8d:52:fb:12:a2:51:1e:86:bb:b0:ba:75:c5:17:ea:b0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VThink Software Consulting Inc." and pe.signatures [ i ] . serial == "00:8d:52:fb:12:a2:51:1e:86:bb:b0:ba:75:c5:17:ea:b0" )
 }
 import "pe"
 
@@ -229564,13 +228998,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B1Aea98Bf0Ce789B6C952310F14Edde0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9ab5382f-d768-553c-b52c-88d3a3824459"
+		id = "d6f2e1f9-1994-5ce4-b617-29b18fde2c18"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2521-L2532"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f7e8a4a0dcd952129e24e8e9351f271d7ea98ffcb7ef9ebe65c27dcc62e6a820"
+		logic_hash = "v1_sha256_f7e8a4a0dcd952129e24e8e9351f271d7ea98ffcb7ef9ebe65c27dcc62e6a820"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229578,7 +229012,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B1Aea98Bf0Ce789B6C952310F14Edde0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Absolut LLC" and pe.signatures[i].serial=="00:b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Absolut LLC" and pe.signatures [ i ] . serial == "00:b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0" )
 }
 import "pe"
 
@@ -229587,13 +229021,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F097E59809Ae2E771B7B9Ae5Fc3408D7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "edd8674d-7d45-5f77-aa47-3fbe32176324"
+		id = "5557b4d4-e4fb-5d91-bf4b-182fb08109aa"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2534-L2545"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "817876ab8e649b36cac2e7b23d58fe94963c55481fbf3deff7e60a70896af6d0"
+		logic_hash = "v1_sha256_817876ab8e649b36cac2e7b23d58fe94963c55481fbf3deff7e60a70896af6d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229601,7 +229035,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F097E59809Ae2E771B7B9Ae5Fc3408D7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABEL RENOVATIONS, INC." and pe.signatures[i].serial=="00:f0:97:e5:98:09:ae:2e:77:1b:7b:9a:e5:fc:34:08:d7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ABEL RENOVATIONS, INC." and pe.signatures [ i ] . serial == "00:f0:97:e5:98:09:ae:2e:77:1b:7b:9a:e5:fc:34:08:d7" )
 }
 import "pe"
 
@@ -229610,13 +229044,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2E8023A5A0328F66656E1Fc251C82680 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "192695ab-2f38-5a0b-98ba-5c800f6b9ec1"
+		id = "b39636db-2156-5ca0-bff5-1d6421fd23bf"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2547-L2558"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5f0ff46d6cb2a6fe50a4e433dfbf8f62acd92b7c92d922680894fdaee2558d31"
+		logic_hash = "v1_sha256_5f0ff46d6cb2a6fe50a4e433dfbf8f62acd92b7c92d922680894fdaee2558d31"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229624,7 +229058,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2E8023A5A0328F66656E1Fc251C82680 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Philippe Mantes" and pe.signatures[i].serial=="2e:80:23:a5:a0:32:8f:66:65:6e:1f:c2:51:c8:26:80")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Philippe Mantes" and pe.signatures [ i ] . serial == "2e:80:23:a5:a0:32:8f:66:65:6e:1f:c2:51:c8:26:80" )
 }
 import "pe"
 
@@ -229633,13 +229067,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_38B0Eaa7C533051A456Fb96C4Ecf91C4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1133fb37-2616-5d95-83da-554d9a5a5373"
+		id = "836f20be-405e-589c-af5f-41155e45d757"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2560-L2571"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3ea8eaf1fc17075a8c1f34f9b1d8a987071d58a4b68bed70db763402a9a6de97"
+		logic_hash = "v1_sha256_3ea8eaf1fc17075a8c1f34f9b1d8a987071d58a4b68bed70db763402a9a6de97"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229647,7 +229081,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_38B0Eaa7C533051A456Fb96C4Ecf91C4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marianne Septier" and pe.signatures[i].serial=="38:b0:ea:a7:c5:33:05:1a:45:6f:b9:6c:4e:cf:91:c4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Marianne Septier" and pe.signatures [ i ] . serial == "38:b0:ea:a7:c5:33:05:1a:45:6f:b9:6c:4e:cf:91:c4" )
 }
 import "pe"
 
@@ -229656,13 +229090,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_738Db9460A10Bb8Bc03Dc59Feac3Be5E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3451fe9d-067a-57ea-9df1-35d427d8c71a"
+		id = "c9f5485c-056a-587f-8578-6dfd5f55f6e5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2573-L2584"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6a7060f2a5867e9974cb01de516ef34fb367ef9acf88e2f63c97dd05b1676504"
+		logic_hash = "v1_sha256_6a7060f2a5867e9974cb01de516ef34fb367ef9acf88e2f63c97dd05b1676504"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229670,7 +229104,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_738Db9460A10Bb8Bc03Dc59Feac3Be5E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jocelyn Bennett" and pe.signatures[i].serial=="73:8d:b9:46:0a:10:bb:8b:c0:3d:c5:9f:ea:c3:be:5e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Jocelyn Bennett" and pe.signatures [ i ] . serial == "73:8d:b9:46:0a:10:bb:8b:c0:3d:c5:9f:ea:c3:be:5e" )
 }
 import "pe"
 
@@ -229679,13 +229113,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_141D6Dafed065980D97520E666493396 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1a2e44d7-b801-5c3e-bf74-616f211c6d93"
+		id = "13a1357e-8a90-5dc6-8427-367cb5f46819"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2586-L2597"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "37ed05b7a472ec6cbc1bba453f3be9ca1bd590ed6470d6607873ef52b28e3ea5"
+		logic_hash = "v1_sha256_37ed05b7a472ec6cbc1bba453f3be9ca1bd590ed6470d6607873ef52b28e3ea5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229693,7 +229127,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_141D6Dafed065980D97520E666493396 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ralph Schmidt" and pe.signatures[i].serial=="14:1d:6d:af:ed:06:59:80:d9:75:20:e6:66:49:33:96")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ralph Schmidt" and pe.signatures [ i ] . serial == "14:1d:6d:af:ed:06:59:80:d9:75:20:e6:66:49:33:96" )
 }
 import "pe"
 
@@ -229702,13 +229136,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_07Cf63Bdccc15C55E5Ce785Bdfbeaacf : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7bdc16ed-ff95-5e96-bfe9-ad326c77c82a"
+		id = "e86aa8eb-a6e6-52c3-86a2-b58eac77759f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2599-L2610"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1fdd8f6535bf5a78fcd7e33475a650914053f1391fe04f885e9e5a84452bfe5a"
+		logic_hash = "v1_sha256_1fdd8f6535bf5a78fcd7e33475a650914053f1391fe04f885e9e5a84452bfe5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229716,7 +229150,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_07Cf63Bdccc15C55E5Ce785Bdfbeaacf : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REITSUPER ESTATE LLC" and pe.signatures[i].serial=="07:cf:63:bd:cc:c1:5c:55:e5:ce:78:5b:df:be:aa:cf")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "REITSUPER ESTATE LLC" and pe.signatures [ i ] . serial == "07:cf:63:bd:cc:c1:5c:55:e5:ce:78:5b:df:be:aa:cf" )
 }
 import "pe"
 
@@ -229725,13 +229159,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0382Cd4B6Ed21Ed7C3Eaea266269D000 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ad4bc1bc-4d72-51bf-a22c-cd98f33f3931"
+		id = "93629fd0-cd83-5477-9df6-1bd49a8f68c9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2612-L2623"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7e8204f2ec30da73bc2eb83e065412c96e084d7ff5f8ab6125d643693d7407d1"
+		logic_hash = "v1_sha256_7e8204f2ec30da73bc2eb83e065412c96e084d7ff5f8ab6125d643693d7407d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229739,7 +229173,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0382Cd4B6Ed21Ed7C3Eaea266269D000 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LOOK AND FEEL SP Z O O" and pe.signatures[i].serial=="03:82:cd:4b:6e:d2:1e:d7:c3:ea:ea:26:62:69:d0:00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LOOK AND FEEL SP Z O O" and pe.signatures [ i ] . serial == "03:82:cd:4b:6e:d2:1e:d7:c3:ea:ea:26:62:69:d0:00" )
 }
 import "pe"
 
@@ -229748,13 +229182,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_08653Ef2Ed9E6Ebb56Ffa7E93F963235 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8883185a-8239-5648-bebc-3a4c3578a7d6"
+		id = "e23fe034-fc86-5b49-98c8-12afac13c624"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2625-L2636"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b0e35f2dbd27de0dc9ea6ee7958c477e6a154bc4c8bb5484ba85ed5732502645"
+		logic_hash = "v1_sha256_b0e35f2dbd27de0dc9ea6ee7958c477e6a154bc4c8bb5484ba85ed5732502645"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229762,7 +229196,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_08653Ef2Ed9E6Ebb56Ffa7E93F963235 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Haw Farm LIMITED" and pe.signatures[i].serial=="08:65:3e:f2:ed:9e:6e:bb:56:ff:a7:e9:3f:96:32:35")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Haw Farm LIMITED" and pe.signatures [ i ] . serial == "08:65:3e:f2:ed:9e:6e:bb:56:ff:a7:e9:3f:96:32:35" )
 }
 import "pe"
 
@@ -229771,13 +229205,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ddce8Cdc91B5B649Bb4B45Ffbba6C6C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "180b2e63-7151-5899-8c12-7e4cd3bb2e0d"
+		id = "84107034-d5af-52d6-a248-4d6124bad8fe"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2638-L2649"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "940d257253a0a1a3f70dcec1cb57e9ab08108138ce3b80c9f74228a8b702601c"
+		logic_hash = "v1_sha256_940d257253a0a1a3f70dcec1cb57e9ab08108138ce3b80c9f74228a8b702601c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229785,7 +229219,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ddce8Cdc91B5B649Bb4B45Ffbba6C6C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLIM DOG GROUP SP Z O O" and pe.signatures[i].serial=="0d:dc:e8:cd:c9:1b:5b:64:9b:b4:b4:5f:fb:ba:6c:6c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SLIM DOG GROUP SP Z O O" and pe.signatures [ i ] . serial == "0d:dc:e8:cd:c9:1b:5b:64:9b:b4:b4:5f:fb:ba:6c:6c" )
 }
 import "pe"
 
@@ -229794,13 +229228,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4Af27Cd14F5C809Eec1F46E483F03898 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e7bbc10b-54fc-5950-99fc-80a459406780"
+		id = "3c7f2f28-7215-5d01-967a-c0605bde23bf"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2651-L2662"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0297f156d1e4d1c20143953759000b286ac9e1f8864aa511e0e2f8fa5c3eac7f"
+		logic_hash = "v1_sha256_0297f156d1e4d1c20143953759000b286ac9e1f8864aa511e0e2f8fa5c3eac7f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229808,7 +229242,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4Af27Cd14F5C809Eec1F46E483F03898 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DAhan Advertising planning" and pe.signatures[i].serial=="4a:f2:7c:d1:4f:5c:80:9e:ec:1f:46:e4:83:f0:38:98")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DAhan Advertising planning" and pe.signatures [ i ] . serial == "4a:f2:7c:d1:4f:5c:80:9e:ec:1f:46:e4:83:f0:38:98" )
 }
 import "pe"
 
@@ -229817,13 +229251,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_105765998695197De4109828A68A4Ee0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "97a4bad1-9b84-54e3-a1c2-6d01bd4cde4c"
+		id = "372bddaa-6f46-5761-aa48-2c3398e846fa"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2664-L2675"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c251f28eec6f93522f5a3706e1abcfd892affa2b36ed84ec277dc0d4716ff667"
+		logic_hash = "v1_sha256_c251f28eec6f93522f5a3706e1abcfd892affa2b36ed84ec277dc0d4716ff667"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229831,7 +229265,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_105765998695197De4109828A68A4Ee0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cryptonic ApS" and pe.signatures[i].serial=="10:57:65:99:86:95:19:7d:e4:10:98:28:a6:8a:4e:e0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cryptonic ApS" and pe.signatures [ i ] . serial == "10:57:65:99:86:95:19:7d:e4:10:98:28:a6:8a:4e:e0" )
 }
 import "pe"
 
@@ -229840,13 +229274,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_53F575F7C33Ee007887F30680486Db5E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8353ac89-1d98-5b05-a851-50d9e42f8f74"
+		id = "81d8164c-ada5-512c-bbef-1b0d74781648"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2677-L2688"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "050d8c4dcb80cd637981c208c6d1316e9933d4f06bbf8af3717d2205a4f84f6d"
+		logic_hash = "v1_sha256_050d8c4dcb80cd637981c208c6d1316e9933d4f06bbf8af3717d2205a4f84f6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229854,7 +229288,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_53F575F7C33Ee007887F30680486Db5E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RET PTY. LTD." and pe.signatures[i].serial=="53:f5:75:f7:c3:3e:e0:07:88:7f:30:68:04:86:db:5e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RET PTY. LTD." and pe.signatures [ i ] . serial == "53:f5:75:f7:c3:3e:e0:07:88:7f:30:68:04:86:db:5e" )
 }
 import "pe"
 
@@ -229863,13 +229297,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7E89B9Df006Bd1Aa4C48D865039634Ca : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "aa208da9-06e2-5bf5-8453-a545c640efa7"
+		id = "20261414-f7f9-51f6-8d4f-f2f47afa118b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2690-L2701"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "825e4b69aec565b6ef6b4ac2394f5a562a84615e3c91331934fa378152635df4"
+		logic_hash = "v1_sha256_825e4b69aec565b6ef6b4ac2394f5a562a84615e3c91331934fa378152635df4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229877,7 +229311,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7E89B9Df006Bd1Aa4C48D865039634Ca : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dummy" and pe.signatures[i].serial=="7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dummy" and pe.signatures [ i ] . serial == "7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca" )
 }
 import "pe"
 
@@ -229886,13 +229320,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ddeb53F957337Fbeaf98C4A615B149D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "13347f66-c726-59be-9d0e-871512335bbd"
+		id = "dffdfea9-5228-5062-9ec8-03ffa836994f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2703-L2714"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4932dcea41879fd29250456cfef7a32a1303f599adbd4b61d91cb2e7e22cf5a2"
+		logic_hash = "v1_sha256_4932dcea41879fd29250456cfef7a32a1303f599adbd4b61d91cb2e7e22cf5a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229900,7 +229334,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ddeb53F957337Fbeaf98C4A615B149D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mozilla Corporation" and pe.signatures[i].serial=="0d:de:b5:3f:95:73:37:fb:ea:f9:8c:4a:61:5b:14:9d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Mozilla Corporation" and pe.signatures [ i ] . serial == "0d:de:b5:3f:95:73:37:fb:ea:f9:8c:4a:61:5b:14:9d" )
 }
 import "pe"
 
@@ -229909,13 +229343,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C88Af896B6452241Fe00E3Aaec11B1F8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4d73705a-e980-5aa0-a326-e35990226e37"
+		id = "ce7e899e-c32e-5c84-9ba9-134bd8df1ba2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2716-L2727"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3a5f290f9479189ff83bf5da3a3d086453c9230311a48f4c0bd4654024ebeef8"
+		logic_hash = "v1_sha256_3a5f290f9479189ff83bf5da3a3d086453c9230311a48f4c0bd4654024ebeef8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229923,7 +229357,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C88Af896B6452241Fe00E3Aaec11B1F8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TeamViewer Germany GmbH" and pe.signatures[i].serial=="00:c8:8a:f8:96:b6:45:22:41:fe:00:e3:aa:ec:11:b1:f8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TeamViewer Germany GmbH" and pe.signatures [ i ] . serial == "00:c8:8a:f8:96:b6:45:22:41:fe:00:e3:aa:ec:11:b1:f8" )
 }
 import "pe"
 
@@ -229932,13 +229366,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_09E015E98E4Fabcc9Ac43E042C96090D : FILE
 	meta:
 		description = "Detects BestEncrypt commercial disk encryption and wiping software signing certificate"
 		author = "ditekSHen"
-		id = "577cff87-b676-598b-acea-e7c01df0ef15"
+		id = "af438bd4-24a2-580f-bfe7-102743c2c5cf"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://blog.macnica.net/blog/2020/11/dtrack.html"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2729-L2742"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "77f9f50c6dd862419edaa7c3fcee0ce3f607a5b7b939d7844969082ab9777bbf"
+		logic_hash = "v1_sha256_77f9f50c6dd862419edaa7c3fcee0ce3f607a5b7b939d7844969082ab9777bbf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229946,7 +229380,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_09E015E98E4Fabcc9Ac43E042C96090D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jetico Inc. Oy" and pe.signatures[i].serial=="09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Jetico Inc. Oy" and pe.signatures [ i ] . serial == "09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d" )
 }
 import "pe"
 
@@ -229955,13 +229389,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_118D813D830F218C0F46D4Fc : FILE
 	meta:
 		description = "Detects BestEncrypt commercial disk encryption and wiping software signing certificate"
 		author = "ditekSHen"
-		id = "b14b14c8-202d-533d-97dc-c6336ddf75c4"
+		id = "7894a77d-91cb-5962-8093-d75c8d322392"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2744-L2755"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3240504794394c06f050ef3eb5ef82e0b476e2bbeabfb394fc4646e98bc6e976"
+		logic_hash = "v1_sha256_3240504794394c06f050ef3eb5ef82e0b476e2bbeabfb394fc4646e98bc6e976"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229969,7 +229403,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_118D813D830F218C0F46D4Fc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si" and pe.signatures[i].serial=="11:8d:81:3d:83:0f:21:8c:0f:46:d4:fc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si" and pe.signatures [ i ] . serial == "11:8d:81:3d:83:0f:21:8c:0f:46:d4:fc" )
 }
 import "pe"
 
@@ -229978,13 +229412,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2304Ecf0Ea2B2736Beddd26A903Ba952 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3e064799-2333-5d10-8841-8d0a44ad9c1b"
+		id = "94d3ec3b-1c24-5b89-85e3-e704011e1d7b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2757-L2768"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c10695440ec4e39cf5b51c926ceeacc13caf3a58006c64b0168a04b4755978a6"
+		logic_hash = "v1_sha256_c10695440ec4e39cf5b51c926ceeacc13caf3a58006c64b0168a04b4755978a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -229992,7 +229426,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2304Ecf0Ea2B2736Beddd26A903Ba952 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x88\\x90\\xE9\\x83\\xBD\\xE5\\x90\\x89\\xE8\\x83\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE8\\xB4\\xA3\\xE4\\xBB\\xBB\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="23:04:ec:f0:ea:2b:27:36:be:dd:d2:6a:90:3b:a9:52")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE6\\x88\\x90\\xE9\\x83\\xBD\\xE5\\x90\\x89\\xE8\\x83\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE8\\xB4\\xA3\\xE4\\xBB\\xBB\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "23:04:ec:f0:ea:2b:27:36:be:dd:d2:6a:90:3b:a9:52" )
 }
 import "pe"
 
@@ -230001,13 +229435,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4D78E90E0950Fc630000000055657E1A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bb48d309-e7b8-5c39-b989-cce4093b2082"
+		id = "6a31e58c-1406-5266-aee6-64810f6ba147"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2770-L2781"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c2a3714173defa7b8e97ea92f8f85fb47011099bdc24067aafa273ebdd282f0f"
+		logic_hash = "v1_sha256_c2a3714173defa7b8e97ea92f8f85fb47011099bdc24067aafa273ebdd282f0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230015,7 +229449,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4D78E90E0950Fc630000000055657E1A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Telus Health Solutions Inc." and pe.signatures[i].serial=="4d:78:e9:0e:09:50:fc:63:00:00:00:00:55:65:7e:1a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Telus Health Solutions Inc." and pe.signatures [ i ] . serial == "4d:78:e9:0e:09:50:fc:63:00:00:00:00:55:65:7e:1a" )
 }
 import "pe"
 
@@ -230024,13 +229458,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0092Bc051F1811Bb0B86727C36394F7849 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9ffef880-ed00-54a7-8eb2-995c5c4e74f1"
+		id = "547f448d-871a-52e7-b667-534ab47c3103"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2783-L2794"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bdf847f95bc6cc50513b76c57c3e76bc17caacd3419baabb2cab0161feb67508"
+		logic_hash = "v1_sha256_bdf847f95bc6cc50513b76c57c3e76bc17caacd3419baabb2cab0161feb67508"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230038,7 +229472,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0092Bc051F1811Bb0B86727C36394F7849 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MISTO EKONOMSKE STORITVE, d.o.o." and pe.signatures[i].serial=="00:92:bc:05:1f:18:11:bb:0b:86:72:7c:36:39:4f:78:49")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MISTO EKONOMSKE STORITVE, d.o.o." and pe.signatures [ i ] . serial == "00:92:bc:05:1f:18:11:bb:0b:86:72:7c:36:39:4f:78:49" )
 }
 import "pe"
 
@@ -230047,13 +229481,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B4F42E2C153C904Fda64C957Ed7E1028 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d284b7f0-9728-5755-87d5-f8251903e778"
+		id = "c0786d64-b3bb-53a1-9f46-9240d27c94a2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2796-L2807"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d47f85602234eae7629b778b09ed5c3656c6afa8b6a7ba42cc46f451202a16c0"
+		logic_hash = "v1_sha256_d47f85602234eae7629b778b09ed5c3656c6afa8b6a7ba42cc46f451202a16c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230061,7 +229495,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B4F42E2C153C904Fda64C957Ed7E1028 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NONO spol. s r.o." and pe.signatures[i].serial=="b4:f4:2e:2c:15:3c:90:4f:da:64:c9:57:ed:7e:10:28")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NONO spol. s r.o." and pe.signatures [ i ] . serial == "b4:f4:2e:2c:15:3c:90:4f:da:64:c9:57:ed:7e:10:28" )
 }
 import "pe"
 
@@ -230070,13 +229504,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ac307E5257Bb814B818D3633B630326F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b6d6c195-cd02-5ecd-82f3-348ab6f26eb5"
+		id = "4d2fc482-20e4-5ed7-887b-b29f86ad168d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2809-L2820"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f187d3084eb189cdd0e858aed1d9589d586f369b128679c6c1dec860e544f326"
+		logic_hash = "v1_sha256_f187d3084eb189cdd0e858aed1d9589d586f369b128679c6c1dec860e544f326"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230084,7 +229518,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ac307E5257Bb814B818D3633B630326F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aqua Direct s.r.o." and pe.signatures[i].serial=="00:ac:30:7e:52:57:bb:81:4b:81:8d:36:33:b6:30:32:6f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Aqua Direct s.r.o." and pe.signatures [ i ] . serial == "00:ac:30:7e:52:57:bb:81:4b:81:8d:36:33:b6:30:32:6f" )
 }
 import "pe"
 
@@ -230093,13 +229527,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_063A7D09107Eddd8Aa1F733634C6591B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "489daa61-8409-500d-bc46-a42a444fcdc0"
+		id = "31c392a3-3475-58d9-ba2d-6e67737e643a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2822-L2833"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8b6c1935d51207e6b9919c85d369dcc6963f52ee4d21758d18e2c57115e9051b"
+		logic_hash = "v1_sha256_8b6c1935d51207e6b9919c85d369dcc6963f52ee4d21758d18e2c57115e9051b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230107,7 +229541,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_063A7D09107Eddd8Aa1F733634C6591B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Smart Line Logistics" and pe.signatures[i].serial=="06:3a:7d:09:10:7e:dd:d8:aa:1f:73:36:34:c6:59:1b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Smart Line Logistics" and pe.signatures [ i ] . serial == "06:3a:7d:09:10:7e:dd:d8:aa:1f:73:36:34:c6:59:1b" )
 }
 import "pe"
 
@@ -230116,13 +229550,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4C687A0022C36F89E253F91D1F6954E2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d4b03832-60f2-5342-8186-3e6c3d7eeb63"
+		id = "2a69caee-6809-5f89-b141-6793e5187930"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2835-L2846"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0bcbe8c85f02735378b5be95c098ca5088f451e390ec6ce76fb732f0db297c1f"
+		logic_hash = "v1_sha256_0bcbe8c85f02735378b5be95c098ca5088f451e390ec6ce76fb732f0db297c1f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230130,7 +229564,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4C687A0022C36F89E253F91D1F6954E2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HETCO ApS" and pe.signatures[i].serial=="4c:68:7a:00:22:c3:6f:89:e2:53:f9:1d:1f:69:54:e2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HETCO ApS" and pe.signatures [ i ] . serial == "4c:68:7a:00:22:c3:6f:89:e2:53:f9:1d:1f:69:54:e2" )
 }
 import "pe"
 
@@ -230139,13 +229573,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Cee26C125B8C188F316C3Fa78D9C2F1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d9271a74-1a04-5863-afc6-4b1d2982f680"
+		id = "03a49c5d-d007-57ac-a228-e1cfc71b12a9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2848-L2859"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "673a275a6d899b5de66d80cb55fa6438c2e14c70a96ba8461eb4946e1f4b4dfa"
+		logic_hash = "v1_sha256_673a275a6d899b5de66d80cb55fa6438c2e14c70a96ba8461eb4946e1f4b4dfa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230153,7 +229587,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Cee26C125B8C188F316C3Fa78D9C2F1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bitubit LLC" and pe.signatures[i].serial=="3c:ee:26:c1:25:b8:c1:88:f3:16:c3:fa:78:d9:c2:f1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bitubit LLC" and pe.signatures [ i ] . serial == "3c:ee:26:c1:25:b8:c1:88:f3:16:c3:fa:78:d9:c2:f1" )
 }
 import "pe"
 
@@ -230162,13 +229596,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A0A27Aefd067Ac62Ce0247B72Bf33De3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1e8db3c4-8d32-5a8d-96ac-785d8f703c7d"
+		id = "78aa7751-5e0f-53e1-abd4-586d4ee07a64"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2861-L2872"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c49e1d8b1a2d0e27fd25574ce587f60770ecac75c1db437bf7538d2ff47c8d4c"
+		logic_hash = "v1_sha256_c49e1d8b1a2d0e27fd25574ce587f60770ecac75c1db437bf7538d2ff47c8d4c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230176,7 +229610,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A0A27Aefd067Ac62Ce0247B72Bf33De3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cfbcdabfdbdccaaccadfeaacacf" and pe.signatures[i].serial=="a0:a2:7a:ef:d0:67:ac:62:ce:02:47:b7:2b:f3:3d:e3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cfbcdabfdbdccaaccadfeaacacf" and pe.signatures [ i ] . serial == "a0:a2:7a:ef:d0:67:ac:62:ce:02:47:b7:2b:f3:3d:e3" )
 }
 import "pe"
 
@@ -230185,13 +229619,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Eee8Cf0A0E4C78Faa03D07470161A90E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a91c84db-99b4-5e24-ba8a-4e009219eb05"
+		id = "84b95867-f3e1-52d6-ab20-f7ef5ee23768"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2874-L2885"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5c14eeeab8cf9797499d23f451a695b443ecc8d3ebbc2edb830ae450e444178c"
+		logic_hash = "v1_sha256_5c14eeeab8cf9797499d23f451a695b443ecc8d3ebbc2edb830ae450e444178c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230199,7 +229633,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Eee8Cf0A0E4C78Faa03D07470161A90E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aafabffdbdbcbfcaebdf" and pe.signatures[i].serial=="ee:e8:cf:0a:0e:4c:78:fa:a0:3d:07:47:01:61:a9:0e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Aafabffdbdbcbfcaebdf" and pe.signatures [ i ] . serial == "ee:e8:cf:0a:0e:4c:78:fa:a0:3d:07:47:01:61:a9:0e" )
 }
 import "pe"
 
@@ -230208,13 +229642,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_79E1Cc0F6722E1A2C4647C21023Ca4Ee : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0abbd882-0224-5c94-98b2-870853344883"
+		id = "2382664a-894a-5152-a496-bc9e38e1f0f0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2887-L2898"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9d0c02ae3eab7f7c28dba04cd08fdddef2be64a1622d7fb519a4bf3a40ef19b1"
+		logic_hash = "v1_sha256_9d0c02ae3eab7f7c28dba04cd08fdddef2be64a1622d7fb519a4bf3a40ef19b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230222,7 +229656,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_79E1Cc0F6722E1A2C4647C21023Ca4Ee : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPAGETTI LTD" and pe.signatures[i].serial=="79:e1:cc:0f:67:22:e1:a2:c4:64:7c:21:02:3c:a4:ee")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SPAGETTI LTD" and pe.signatures [ i ] . serial == "79:e1:cc:0f:67:22:e1:a2:c4:64:7c:21:02:3c:a4:ee" )
 }
 import "pe"
 
@@ -230231,13 +229665,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6D688Ecf46286Fe4B6823B91384Eca86 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4718996b-cb42-5b83-8fdf-d87751302a00"
+		id = "c5385ecf-290f-57a6-adb5-62920e4d2a4a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2900-L2911"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "33296b5b9156af6d95bec9981a9fab3137bcd17bfb26ea2d212ae004275bf42e"
+		logic_hash = "v1_sha256_33296b5b9156af6d95bec9981a9fab3137bcd17bfb26ea2d212ae004275bf42e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230245,7 +229679,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6D688Ecf46286Fe4B6823B91384Eca86 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AtomPark Software JSC" and pe.signatures[i].serial=="6d:68:8e:cf:46:28:6f:e4:b6:82:3b:91:38:4e:ca:86")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AtomPark Software JSC" and pe.signatures [ i ] . serial == "6d:68:8e:cf:46:28:6f:e4:b6:82:3b:91:38:4e:ca:86" )
 }
 import "pe"
 
@@ -230254,13 +229688,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_9Aa99F1B75A463460D38C4539Fae4F73 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5ffad411-49e2-5691-95e7-1e294a2a101e"
+		id = "7ea59a58-0c7b-5c5c-966b-3c5233af589f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2913-L2924"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b73c6ca2c0cd0e09f0add77c3af3c8e16f46cec29b49d4dcab5a569fed8d3d39"
+		logic_hash = "v1_sha256_b73c6ca2c0cd0e09f0add77c3af3c8e16f46cec29b49d4dcab5a569fed8d3d39"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230268,7 +229702,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_9Aa99F1B75A463460D38C4539Fae4F73 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beaacdfaeeccbbedadcb" and pe.signatures[i].serial=="9a:a9:9f:1b:75:a4:63:46:0d:38:c4:53:9f:ae:4f:73")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beaacdfaeeccbbedadcb" and pe.signatures [ i ] . serial == "9a:a9:9f:1b:75:a4:63:46:0d:38:c4:53:9f:ae:4f:73" )
 }
 import "pe"
 
@@ -230277,13 +229711,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E414655F025399Cca4D7225D89689A04 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2df4eb66-4890-540f-95e1-fb69eeb32df2"
+		id = "6d9b330c-cdf6-513d-8422-80b88d29e0b6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2926-L2937"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "589ad4939d235138791a98f5d43f6a786ad14345c995ad2e073d3673fb41365a"
+		logic_hash = "v1_sha256_589ad4939d235138791a98f5d43f6a786ad14345c995ad2e073d3673fb41365a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230291,7 +229725,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E414655F025399Cca4D7225D89689A04 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\xAF\\x94\\xE5\\x90\\xBE\\xE8\\xBF\\xAA\\xE5\\x90\\xBE\\xE8\\xBF\\xAA\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE8\\xBF\\xAA\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE6\\x8F\\x90\\xE4\\xBC\\x8A\\xE6\\xAF\\x94\\xE6\\x8F\\x90\\xE8\\xBF\\xAA\\xE8\\xBF\\xAA\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE6\\x8F\\x90\\xE7\\xBB\\xB4\\xE6\\xAF\\x94" and pe.signatures[i].serial=="e4:14:65:5f:02:53:99:cc:a4:d7:22:5d:89:68:9a:04")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE6\\xAF\\x94\\xE5\\x90\\xBE\\xE8\\xBF\\xAA\\xE5\\x90\\xBE\\xE8\\xBF\\xAA\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE8\\xBF\\xAA\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE6\\x8F\\x90\\xE4\\xBC\\x8A\\xE6\\xAF\\x94\\xE6\\x8F\\x90\\xE8\\xBF\\xAA\\xE8\\xBF\\xAA\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE6\\x8F\\x90\\xE7\\xBB\\xB4\\xE6\\xAF\\x94" and pe.signatures [ i ] . serial == "e4:14:65:5f:02:53:99:cc:a4:d7:22:5d:89:68:9a:04" )
 }
 import "pe"
 
@@ -230300,13 +229734,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_64F82Ed8A90F92A940Be2Bb90Fbf6F48 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "70469507-30f1-56be-90bb-1055f7df2496"
+		id = "8a7b82ef-305c-5481-b489-25c88f21e8c9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2939-L2950"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "eacb9d8834bdf618b5aa44bfb37b0b6413f9b4595b6261a948566a63e9855162"
+		logic_hash = "v1_sha256_eacb9d8834bdf618b5aa44bfb37b0b6413f9b4595b6261a948566a63e9855162"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230314,7 +229748,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_64F82Ed8A90F92A940Be2Bb90Fbf6F48 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Klimate Vision Plus" and pe.signatures[i].serial=="64:f8:2e:d8:a9:0f:92:a9:40:be:2b:b9:0f:bf:6f:48")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Klimate Vision Plus" and pe.signatures [ i ] . serial == "64:f8:2e:d8:a9:0f:92:a9:40:be:2b:b9:0f:bf:6f:48" )
 }
 import "pe"
 
@@ -230323,13 +229757,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F0031491B673Ecdf533D4Ebe4B54697F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ad027dc9-14bc-50dd-b260-7672c528ef9a"
+		id = "2b7ab5aa-f32a-5742-b245-c653e85c1590"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2952-L2963"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4697ce0a7fcd1fa6ac1dd5246f2a23b85865bef4010280c4ca2e12c433b8ceb2"
+		logic_hash = "v1_sha256_4697ce0a7fcd1fa6ac1dd5246f2a23b85865bef4010280c4ca2e12c433b8ceb2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230337,7 +229771,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F0031491B673Ecdf533D4Ebe4B54697F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eebbffbceacddbfaeefaecdbaf" and pe.signatures[i].serial=="00:f0:03:14:91:b6:73:ec:df:53:3d:4e:be:4b:54:69:7f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Eebbffbceacddbfaeefaecdbaf" and pe.signatures [ i ] . serial == "00:f0:03:14:91:b6:73:ec:df:53:3d:4e:be:4b:54:69:7f" )
 }
 import "pe"
 
@@ -230346,13 +229780,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Becd4Ef55Ced54E5Bcde595D872Ae7Eb : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "85835042-a4ab-5cb2-963d-4ef776b740d1"
+		id = "0d6aee60-98a7-59bf-ac5b-f1ca16c539b1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2965-L2976"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b573853cfb28bdbda37c929834faa15475707684edfe99f14174599faf7b4fb6"
+		logic_hash = "v1_sha256_b573853cfb28bdbda37c929834faa15475707684edfe99f14174599faf7b4fb6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230360,7 +229794,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Becd4Ef55Ced54E5Bcde595D872Ae7Eb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dedbfdefcac" and pe.signatures[i].serial=="be:cd:4e:f5:5c:ed:54:e5:bc:de:59:5d:87:2a:e7:eb")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dedbfdefcac" and pe.signatures [ i ] . serial == "be:cd:4e:f5:5c:ed:54:e5:bc:de:59:5d:87:2a:e7:eb" )
 }
 import "pe"
 
@@ -230369,13 +229803,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_55B5E1Cf84A89C4E023399784B42A268 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "de2890d4-3758-5e90-a9af-dc519f0b9e4c"
+		id = "cd3b4fb8-43b2-5a64-9811-3f8151dc8b16"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2978-L2989"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "37f08db5373cf46da7c0a4a03af21559fdcddb2481f935d5cece55a1fb4abc3c"
+		logic_hash = "v1_sha256_37f08db5373cf46da7c0a4a03af21559fdcddb2481f935d5cece55a1fb4abc3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230383,7 +229817,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_55B5E1Cf84A89C4E023399784B42A268 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fbbdefaccbbcdc" and pe.signatures[i].serial=="55:b5:e1:cf:84:a8:9c:4e:02:33:99:78:4b:42:a2:68")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fbbdefaccbbcdc" and pe.signatures [ i ] . serial == "55:b5:e1:cf:84:a8:9c:4e:02:33:99:78:4b:42:a2:68" )
 }
 import "pe"
 
@@ -230392,13 +229826,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_84C3A47B739F1835D35B755D1E6741B5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "00fba5a5-b87d-54f7-a5b8-f7b377af2202"
+		id = "2a43dc7a-86e0-51ff-b80f-5fa111e10d77"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L2991-L3002"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6beb0966f2ed981c2e1a859ff9f659a566de867888123c387eeb89a97620345e"
+		logic_hash = "v1_sha256_6beb0966f2ed981c2e1a859ff9f659a566de867888123c387eeb89a97620345e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230406,7 +229840,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_84C3A47B739F1835D35B755D1E6741B5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bddbdcfabededdeadbefed" and pe.signatures[i].serial=="84:c3:a4:7b:73:9f:18:35:d3:5b:75:5d:1e:67:41:b5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bddbdcfabededdeadbefed" and pe.signatures [ i ] . serial == "84:c3:a4:7b:73:9f:18:35:d3:5b:75:5d:1e:67:41:b5" )
 }
 import "pe"
 
@@ -230415,13 +229849,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_28F6Ca1F249Cfb6Bdb16Bc57Aaf0Bd79 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b0568efe-d0cc-528d-a9b4-fdb8106c3d0f"
+		id = "3ee6c40d-4c5b-5a2d-b3cb-9536a6d2d99c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3004-L3015"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c27ad7caa87b366593b82ff5e2b38bda5383e178e2cc01121aaaa5e90beaec86"
+		logic_hash = "v1_sha256_c27ad7caa87b366593b82ff5e2b38bda5383e178e2cc01121aaaa5e90beaec86"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230429,7 +229863,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_28F6Ca1F249Cfb6Bdb16Bc57Aaf0Bd79 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cdcafaabbdcaaaeaaee" and pe.signatures[i].serial=="28:f6:ca:1f:24:9c:fb:6b:db:16:bc:57:aa:f0:bd:79")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cdcafaabbdcaaaeaaee" and pe.signatures [ i ] . serial == "28:f6:ca:1f:24:9c:fb:6b:db:16:bc:57:aa:f0:bd:79" )
 }
 import "pe"
 
@@ -230438,13 +229872,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2C3E87B9D430C2F0B14Fc1152E961F1A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8e686e58-8fc5-50cf-9259-dcd70f5cc27b"
+		id = "d385df48-db47-5f42-a0e4-695fc19be2a2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3017-L3028"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "43a8f2d9055091f930af456abd334e38fb6a98bee3bfb8dcbf84c9563c777101"
+		logic_hash = "v1_sha256_43a8f2d9055091f930af456abd334e38fb6a98bee3bfb8dcbf84c9563c777101"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230452,7 +229886,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2C3E87B9D430C2F0B14Fc1152E961F1A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Abfaacccde" and pe.signatures[i].serial=="2c:3e:87:b9:d4:30:c2:f0:b1:4f:c1:15:2e:96:1f:1a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Abfaacccde" and pe.signatures [ i ] . serial == "2c:3e:87:b9:d4:30:c2:f0:b1:4f:c1:15:2e:96:1f:1a" )
 }
 import "pe"
 
@@ -230461,13 +229895,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4808C88Ea243Eefa47610D5F5F0D02A2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ea3aadc6-3edd-5e4b-adfe-824103531deb"
+		id = "f42b9a64-02a5-5b70-9aca-74ed23fe11e3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3030-L3041"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9fa722bfed0c31e263772615799bbdc054da1424b139c7d73e5755334fb86346"
+		logic_hash = "v1_sha256_9fa722bfed0c31e263772615799bbdc054da1424b139c7d73e5755334fb86346"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230475,7 +229909,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4808C88Ea243Eefa47610D5F5F0D02A2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bfcdcdfcdfcaaeff" and pe.signatures[i].serial=="48:08:c8:8e:a2:43:ee:fa:47:61:0d:5f:5f:0d:02:a2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bfcdcdfcdfcaaeff" and pe.signatures [ i ] . serial == "48:08:c8:8e:a2:43:ee:fa:47:61:0d:5f:5f:0d:02:a2" )
 }
 import "pe"
 
@@ -230484,13 +229918,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2F184A6F054Dc9F7C74A63714B14Ce33 : FILE
 	meta:
 		description = "Detects executables signed AprelTech Silent Install Builder certificate"
 		author = "ditekSHen"
-		id = "17797e5c-acf2-5c4e-b3e0-c48fb7bff996"
+		id = "4439803a-a3d2-53b0-98d0-ef81de04b16f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3043-L3054"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d14428b81b4ae4a77a517d2148f4b67b45963b71d998139b42ed4e4352fae6a5"
+		logic_hash = "v1_sha256_d14428b81b4ae4a77a517d2148f4b67b45963b71d998139b42ed4e4352fae6a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230498,7 +229932,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2F184A6F054Dc9F7C74A63714B14Ce33 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APREL Tehnologija d.o.o." and pe.signatures[i].serial=="2f:18:4a:6f:05:4d:c9:f7:c7:4a:63:71:4b:14:ce:33")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APREL Tehnologija d.o.o." and pe.signatures [ i ] . serial == "2f:18:4a:6f:05:4d:c9:f7:c7:4a:63:71:4b:14:ce:33" )
 }
 import "pe"
 
@@ -230507,13 +229941,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ced72Cc75Aa0Ebce09Dc0283076Ce9B1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7482c8a9-22d7-5ecf-951c-83818e2aeda7"
+		id = "a7793c20-8876-570d-9c03-c9699b9949da"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3056-L3067"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "47fceb2a79271011bc6feed209ef4021db155dbc0fd4891f0dc1e900f2cb7fdb"
+		logic_hash = "v1_sha256_47fceb2a79271011bc6feed209ef4021db155dbc0fd4891f0dc1e900f2cb7fdb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230521,7 +229955,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ced72Cc75Aa0Ebce09Dc0283076Ce9B1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Valerie LLC" and pe.signatures[i].serial=="00:ce:d7:2c:c7:5a:a0:eb:ce:09:dc:02:83:07:6c:e9:b1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Valerie LLC" and pe.signatures [ i ] . serial == "00:ce:d7:2c:c7:5a:a0:eb:ce:09:dc:02:83:07:6c:e9:b1" )
 }
 import "pe"
 
@@ -230530,13 +229964,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C4564802095258281A284809930Dcf43 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f70f481c-f5cf-5767-9fb0-0adecd0dc1f3"
+		id = "599929e8-2cc6-5343-9f90-601318eb82a5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3069-L3080"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "547613d507b04e3bd944515c77cb6ec161fe008b8e2b43cda574a46cbe2ef5ef"
+		logic_hash = "v1_sha256_547613d507b04e3bd944515c77cb6ec161fe008b8e2b43cda574a46cbe2ef5ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230544,7 +229978,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C4564802095258281A284809930Dcf43 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cfeaaeedaefddfaaccefcdbae" and pe.signatures[i].serial=="c4:56:48:02:09:52:58:28:1a:28:48:09:93:0d:cf:43")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cfeaaeedaefddfaaccefcdbae" and pe.signatures [ i ] . serial == "c4:56:48:02:09:52:58:28:1a:28:48:09:93:0d:cf:43" )
 }
 import "pe"
 
@@ -230553,13 +229987,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3D31Ed3B22867F425Db86Fb532Eb449F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a9924b9e-381a-58b2-8839-fcafeb730a32"
+		id = "5f1516d1-6979-5c5d-83ab-a439490573f8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3082-L3093"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e3ec4fcd47867b688241dee693bcec98e633e179757ec8e7afd755c7d53a0cd7"
+		logic_hash = "v1_sha256_e3ec4fcd47867b688241dee693bcec98e633e179757ec8e7afd755c7d53a0cd7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230567,7 +230001,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3D31Ed3B22867F425Db86Fb532Eb449F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Badfcbdbcdbfafcaeebad" and pe.signatures[i].serial=="3d:31:ed:3b:22:86:7f:42:5d:b8:6f:b5:32:eb:44:9f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Badfcbdbcdbfafcaeebad" and pe.signatures [ i ] . serial == "3d:31:ed:3b:22:86:7f:42:5d:b8:6f:b5:32:eb:44:9f" )
 }
 import "pe"
 
@@ -230576,13 +230010,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_531549Ed4D2D53Fc7E1Beb47C6B13D58 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6aec64ae-cda3-57e8-94c6-07c1e07d34ad"
+		id = "764117c6-66ff-5728-9e57-e9b0d9d9e331"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3095-L3106"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "554574657a913dbe0c576dbfcdd93a2494f2ffccf51eaabf06e5fafe2a895c3a"
+		logic_hash = "v1_sha256_554574657a913dbe0c576dbfcdd93a2494f2ffccf51eaabf06e5fafe2a895c3a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230590,7 +230024,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_531549Ed4D2D53Fc7E1Beb47C6B13D58 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bdabfbdfbcbab" and pe.signatures[i].serial=="53:15:49:ed:4d:2d:53:fc:7e:1b:eb:47:c6:b1:3d:58")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bdabfbdfbcbab" and pe.signatures [ i ] . serial == "53:15:49:ed:4d:2d:53:fc:7e:1b:eb:47:c6:b1:3d:58" )
 }
 import "pe"
 
@@ -230599,13 +230033,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_8035Ed9C58Ea895505B05Ff926D486Bc : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "35b5d9a1-eaa8-53d8-9917-9a688fb95a04"
+		id = "0365389b-e5e7-5d22-a03f-04eb0cde3773"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3108-L3119"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "caf1c962a0f4bd6c90753c6f1f0a2acadafa5fde6c7dacd02a3ca5cc15446ab4"
+		logic_hash = "v1_sha256_caf1c962a0f4bd6c90753c6f1f0a2acadafa5fde6c7dacd02a3ca5cc15446ab4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230613,7 +230047,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_8035Ed9C58Ea895505B05Ff926D486Bc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fecddacdddfaadcddcabceded" and pe.signatures[i].serial=="80:35:ed:9c:58:ea:89:55:05:b0:5f:f9:26:d4:86:bc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fecddacdddfaadcddcabceded" and pe.signatures [ i ] . serial == "80:35:ed:9c:58:ea:89:55:05:b0:5f:f9:26:d4:86:bc" )
 }
 import "pe"
 
@@ -230622,13 +230056,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Ca646B4275406Df639Cf603756F63D77 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "46603413-3e03-57d0-a141-1fee730de6c5"
+		id = "4c9c1297-143f-5b55-b37d-f994640f9dd0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3121-L3135"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "564ca7048413d6cd65371d65906132f62386410442b36b8bafeac5e09917465f"
+		logic_hash = "v1_sha256_564ca7048413d6cd65371d65906132f62386410442b36b8bafeac5e09917465f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230636,7 +230070,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Ca646B4275406Df639Cf603756F63D77 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHOECORP LIMITED" and (pe.signatures[i].serial=="ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77" or pe.signatures[i].serial=="00:ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SHOECORP LIMITED" and ( pe.signatures [ i ] . serial == "ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77" or pe.signatures [ i ] . serial == "00:ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77" ) )
 }
 import "pe"
 
@@ -230645,13 +230079,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E267Fdbdc16F22E8185D35C437F84C87 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "520e335d-4b9f-5006-959a-1510312807be"
+		id = "deae0261-0df8-5938-8bc1-32d1793af4a3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3137-L3148"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "403f0f8a65997d27494d7ac4aa99cf5ebb1471839f67b2f8b380225a0263fd67"
+		logic_hash = "v1_sha256_403f0f8a65997d27494d7ac4aa99cf5ebb1471839f67b2f8b380225a0263fd67"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230659,7 +230093,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E267Fdbdc16F22E8185D35C437F84C87 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APOTHEKA, s.r.o." and pe.signatures[i].serial=="00:e2:67:fd:bd:c1:6f:22:e8:18:5d:35:c4:37:f8:4c:87")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APOTHEKA, s.r.o." and pe.signatures [ i ] . serial == "00:e2:67:fd:bd:c1:6f:22:e8:18:5d:35:c4:37:f8:4c:87" )
 }
 import "pe"
 
@@ -230668,13 +230102,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Taffias : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7ace9b76-104c-511a-801b-0c2d5860eaba"
+		id = "0806b402-d7e2-545d-aad8-65222255f3b8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3150-L3161"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dc6b65757ceb3818101c8694680d1f44af3726876bef30843cfc2cb51ec6ea02"
+		logic_hash = "v1_sha256_dc6b65757ceb3818101c8694680d1f44af3726876bef30843cfc2cb51ec6ea02"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230682,7 +230116,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Taffias : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TAFFIAS" and pe.signatures[i].serial=="00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TAFFIAS" and pe.signatures [ i ] . serial == "00" )
 }
 import "pe"
 
@@ -230691,13 +230125,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_9F2492304Fc9C93844Dea7E5D6F0Ec77 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "73acca59-8362-5d34-b28a-71d141d3013a"
+		id = "810fe4e9-dd83-5ca4-9ac5-18ef525c2a0d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3163-L3174"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9c76d5756cc79e96d194addc0e2c2c11fa4341ffa9df8f171f35df76cb9c56c0"
+		logic_hash = "v1_sha256_9c76d5756cc79e96d194addc0e2c2c11fa4341ffa9df8f171f35df76cb9c56c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230705,7 +230139,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_9F2492304Fc9C93844Dea7E5D6F0Ec77 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bbddebeea" and pe.signatures[i].serial=="9f:24:92:30:4f:c9:c9:38:44:de:a7:e5:d6:f0:ec:77")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bbddebeea" and pe.signatures [ i ] . serial == "9f:24:92:30:4f:c9:c9:38:44:de:a7:e5:d6:f0:ec:77" )
 }
 import "pe"
 
@@ -230714,13 +230148,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dca9012634E8B609884Fe9284D30Eff5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f22ef616-c7f1-5036-b303-ef8ae038ec4f"
+		id = "a87a28e5-fca3-593e-bceb-ed48297a95c7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3176-L3189"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b5d663228a27d5dae46f9f03bd04833b129fc453852cb9cb9fe43e405cdcecca"
+		logic_hash = "v1_sha256_b5d663228a27d5dae46f9f03bd04833b129fc453852cb9cb9fe43e405cdcecca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230728,7 +230162,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dca9012634E8B609884Fe9284D30Eff5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bebaeefaeba" and (pe.signatures[i].serial=="dc:a9:01:26:34:e8:b6:09:88:4f:e9:28:4d:30:ef:f5" or pe.signatures[i].serial=="00:dc:a9:01:26:34:e8:b6:09:88:4f:e9:28:4d:30:ef:f5"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bebaeefaeba" and ( pe.signatures [ i ] . serial == "dc:a9:01:26:34:e8:b6:09:88:4f:e9:28:4d:30:ef:f5" or pe.signatures [ i ] . serial == "00:dc:a9:01:26:34:e8:b6:09:88:4f:e9:28:4d:30:ef:f5" ) )
 }
 import "pe"
 
@@ -230737,13 +230171,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_781Ec65C3E38392D4C2F9E7F55F5C424 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d056fb18-e641-50bb-af86-ea124203f16c"
+		id = "70ce8431-50fb-50fb-83ac-d554cf3e268c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3191-L3202"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "00b01a874e29fd2e25200f5e50c7121c3cc4bca614c31dd149d6197088292b35"
+		logic_hash = "v1_sha256_00b01a874e29fd2e25200f5e50c7121c3cc4bca614c31dd149d6197088292b35"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230751,7 +230185,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_781Ec65C3E38392D4C2F9E7F55F5C424 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Facacafbfddbdbfad" and pe.signatures[i].serial=="78:1e:c6:5c:3e:38:39:2d:4c:2f:9e:7f:55:f5:c4:24")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Facacafbfddbdbfad" and pe.signatures [ i ] . serial == "78:1e:c6:5c:3e:38:39:2d:4c:2f:9e:7f:55:f5:c4:24" )
 }
 import "pe"
 
@@ -230760,13 +230194,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Bd1E93D5787A737Eef930C70986D2A69 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3b5ec355-9d68-5285-bda0-ddd379ad1cf8"
+		id = "91c548df-b5a1-5dca-a4c9-f39ed02119a7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3204-L3215"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0332d05f0f53ad22516fd41cb10238ad0b92ef49011e9e71a82fa2da1de5e953"
+		logic_hash = "v1_sha256_0332d05f0f53ad22516fd41cb10238ad0b92ef49011e9e71a82fa2da1de5e953"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230774,7 +230208,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Bd1E93D5787A737Eef930C70986D2A69 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cdefedddbdedbcbfffbeadb" and pe.signatures[i].serial=="bd:1e:93:d5:78:7a:73:7e:ef:93:0c:70:98:6d:2a:69")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cdefedddbdedbcbfffbeadb" and pe.signatures [ i ] . serial == "bd:1e:93:d5:78:7a:73:7e:ef:93:0c:70:98:6d:2a:69" )
 }
 import "pe"
 
@@ -230783,13 +230217,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B0009Bb062F52Eb6001Ba79606De243D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "41293f0b-604a-5993-8b05-9ca639828eec"
+		id = "de65aa83-970e-532b-a165-b48f7727200c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3217-L3228"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "111a08d62f483daf23220e7044cc291b6ea6922746d48934f72a892b7dfd762b"
+		logic_hash = "v1_sha256_111a08d62f483daf23220e7044cc291b6ea6922746d48934f72a892b7dfd762b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230797,7 +230231,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B0009Bb062F52Eb6001Ba79606De243D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fbfdddcfabc" and pe.signatures[i].serial=="b0:00:9b:b0:62:f5:2e:b6:00:1b:a7:96:06:de:24:3d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fbfdddcfabc" and pe.signatures [ i ] . serial == "b0:00:9b:b0:62:f5:2e:b6:00:1b:a7:96:06:de:24:3d" )
 }
 import "pe"
 
@@ -230806,13 +230240,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_294E7A2Ccfc28Ed02843Ecff25F2Ac98 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ae3c0758-7863-54eb-a94f-3c86d5d34d21"
+		id = "f4003a49-2575-5f50-af02-97ad617c2bf9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3230-L3241"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "75c3093978875c7e523525a3b64bf985139359d9696fdb9dbd7db3e915043194"
+		logic_hash = "v1_sha256_75c3093978875c7e523525a3b64bf985139359d9696fdb9dbd7db3e915043194"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230820,7 +230254,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_294E7A2Ccfc28Ed02843Ecff25F2Ac98 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eadbaadbdcecafdfafbe" and pe.signatures[i].serial=="29:4e:7a:2c:cf:c2:8e:d0:28:43:ec:ff:25:f2:ac:98")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Eadbaadbdcecafdfafbe" and pe.signatures [ i ] . serial == "29:4e:7a:2c:cf:c2:8e:d0:28:43:ec:ff:25:f2:ac:98" )
 }
 import "pe"
 
@@ -230829,13 +230263,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A61B5590C2D8Dc70A31F8Ea78Cda4353 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0a22b3a5-cc61-5aec-9fc7-bbd03cd4ab03"
+		id = "6e6b6898-4d0d-57a5-bf3e-27dd3c9a64b4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3243-L3254"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7d57f5cb2691d8dfb5f5ef63f7bfb4290f0bd8d990c61fe0655e35c1b3f554f0"
+		logic_hash = "v1_sha256_7d57f5cb2691d8dfb5f5ef63f7bfb4290f0bd8d990c61fe0655e35c1b3f554f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230843,7 +230277,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A61B5590C2D8Dc70A31F8Ea78Cda4353 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bdddcfaebffbfdcabaffe" and pe.signatures[i].serial=="a6:1b:55:90:c2:d8:dc:70:a3:1f:8e:a7:8c:da:43:53")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bdddcfaebffbfdcabaffe" and pe.signatures [ i ] . serial == "a6:1b:55:90:c2:d8:dc:70:a3:1f:8e:a7:8c:da:43:53" )
 }
 import "pe"
 
@@ -230852,13 +230286,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_21C9A6Daff942F2Db6A0614D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e09476f7-d48d-58e5-aeca-fffacf569243"
+		id = "22463e8f-2058-5109-8090-9d9d125b01d1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3256-L3267"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c466a829d8141ba40187309559f62af73ea47e325eb95ef4c634bac60167788b"
+		logic_hash = "v1_sha256_c466a829d8141ba40187309559f62af73ea47e325eb95ef4c634bac60167788b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230866,7 +230300,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_21C9A6Daff942F2Db6A0614D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ledger SAS" and pe.signatures[i].serial=="21:c9:a6:da:ff:94:2f:2d:b6:a0:61:4d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ledger SAS" and pe.signatures [ i ] . serial == "21:c9:a6:da:ff:94:2f:2d:b6:a0:61:4d" )
 }
 import "pe"
 
@@ -230875,13 +230309,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1F55Ae3Fca38827Cde6Cc7Ca1C0D2731 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8a32fa5d-671e-5012-9de1-6afc21751b94"
+		id = "31ec9682-3826-596f-9e33-b5ab881a40e6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3269-L3280"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1aa7c6c5430f196d1031acabfe141c30044c23c4119619752c50f4665966606e"
+		logic_hash = "v1_sha256_1aa7c6c5430f196d1031acabfe141c30044c23c4119619752c50f4665966606e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230889,7 +230323,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1F55Ae3Fca38827Cde6Cc7Ca1C0D2731 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fcceaeafbbdccccddfbbb" and pe.signatures[i].serial=="1f:55:ae:3f:ca:38:82:7c:de:6c:c7:ca:1c:0d:27:31")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fcceaeafbbdccccddfbbb" and pe.signatures [ i ] . serial == "1f:55:ae:3f:ca:38:82:7c:de:6c:c7:ca:1c:0d:27:31" )
 }
 import "pe"
 
@@ -230898,13 +230332,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008D1Bae9F7Aef1A2Bcc0D392F3Edf3A36 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8d1e7615-f462-56eb-9198-30b868572cf1"
+		id = "7cdce7c1-03b7-53a1-8771-d5f6c23ed8b9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3282-L3293"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6b15f97a51f25b1292cc3fd80889ea1edb01814d1951ef1d3b4cac5e83c7fbca"
+		logic_hash = "v1_sha256_6b15f97a51f25b1292cc3fd80889ea1edb01814d1951ef1d3b4cac5e83c7fbca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230912,7 +230346,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008D1Bae9F7Aef1A2Bcc0D392F3Edf3A36 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beaffbebfeebbefbeeb" and pe.signatures[i].serial=="00:8d:1b:ae:9f:7a:ef:1a:2b:cc:0d:39:2f:3e:df:3a:36")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beaffbebfeebbefbeeb" and pe.signatures [ i ] . serial == "00:8d:1b:ae:9f:7a:ef:1a:2b:cc:0d:39:2f:3e:df:3a:36" )
 }
 import "pe"
 
@@ -230921,13 +230355,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_239Ba103C2943D2Dff5E3211D6800D09 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1444a44e-2f45-547f-a5fc-0941edd506bc"
+		id = "10a2a4cb-4bbe-5813-b775-ac8515b21127"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3295-L3306"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b155ba969334945013af40fbf43b8318a221f6212c4a29e0ee98bc02bb9acafb"
+		logic_hash = "v1_sha256_b155ba969334945013af40fbf43b8318a221f6212c4a29e0ee98bc02bb9acafb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230935,7 +230369,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_239Ba103C2943D2Dff5E3211D6800D09 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bcafaecbecacbca" and pe.signatures[i].serial=="23:9b:a1:03:c2:94:3d:2d:ff:5e:32:11:d6:80:0d:09")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bcafaecbecacbca" and pe.signatures [ i ] . serial == "23:9b:a1:03:c2:94:3d:2d:ff:5e:32:11:d6:80:0d:09" )
 }
 import "pe"
 
@@ -230944,13 +230378,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_205B80A74A5Dddedea6B84A1E1C44010 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "43e34fe4-e580-572e-a14e-5ee58b3bf594"
+		id = "556a7a7f-3be7-51a8-8b66-b3776a503d1d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3308-L3319"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1af8527193acdbcb3ba0239879c3b23c6ba4e68d920ae4d5ce503d44e32991f7"
+		logic_hash = "v1_sha256_1af8527193acdbcb3ba0239879c3b23c6ba4e68d920ae4d5ce503d44e32991f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230958,7 +230392,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_205B80A74A5Dddedea6B84A1E1C44010 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Befadbffde" and pe.signatures[i].serial=="20:5b:80:a7:4a:5d:dd:ed:ea:6b:84:a1:e1:c4:40:10")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Befadbffde" and pe.signatures [ i ] . serial == "20:5b:80:a7:4a:5d:dd:ed:ea:6b:84:a1:e1:c4:40:10" )
 }
 import "pe"
 
@@ -230967,13 +230401,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6C8D0Cf4D1593Ee8Dc8D34Be71E90251 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fe5cbea2-1704-550c-bd2e-82defba20f24"
+		id = "96fc5d6d-e81f-5b82-95fb-97a90cf838c5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3321-L3332"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "981e4b426e926bd042f25a50de40d3e3462ed5fec0cf7261523b314b908a1276"
+		logic_hash = "v1_sha256_981e4b426e926bd042f25a50de40d3e3462ed5fec0cf7261523b314b908a1276"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -230981,7 +230415,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6C8D0Cf4D1593Ee8Dc8D34Be71E90251 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dbdbecdbdfafdc" and pe.signatures[i].serial=="6c:8d:0c:f4:d1:59:3e:e8:dc:8d:34:be:71:e9:02:51")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dbdbecdbdfafdc" and pe.signatures [ i ] . serial == "6c:8d:0c:f4:d1:59:3e:e8:dc:8d:34:be:71:e9:02:51" )
 }
 import "pe"
 
@@ -230990,13 +230424,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7D08A74747557D6016Aaaf47A679312F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "031cf958-1c37-5190-8fbd-6896f1048c9a"
+		id = "d33f3203-b94d-5470-b7bd-3ff2feed45bb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3334-L3345"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ff7c9635b9b43bef7401861d5dbf984d1e2aa1ea9e4d3df9ad348c552767628e"
+		logic_hash = "v1_sha256_ff7c9635b9b43bef7401861d5dbf984d1e2aa1ea9e4d3df9ad348c552767628e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231004,7 +230438,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7D08A74747557D6016Aaaf47A679312F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Abfacfbdcd" and pe.signatures[i].serial=="7d:08:a7:47:47:55:7d:60:16:aa:af:47:a6:79:31:2f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Abfacfbdcd" and pe.signatures [ i ] . serial == "7d:08:a7:47:47:55:7d:60:16:aa:af:47:a6:79:31:2f" )
 }
 import "pe"
 
@@ -231013,13 +230447,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2095C6F1Eadb65Ce02862Bd620623B92 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c44d8942-569b-50c6-8363-0576c7d54dfb"
+		id = "795f2f1d-4ebf-536d-a71c-e1b4dd363cc9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3347-L3358"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0b75d8c59486d197f2cdff298114a7367bb6ad4cf71ee28273e0946e42d3f7e8"
+		logic_hash = "v1_sha256_0b75d8c59486d197f2cdff298114a7367bb6ad4cf71ee28273e0946e42d3f7e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231027,7 +230461,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2095C6F1Eadb65Ce02862Bd620623B92 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Febeecad" and pe.signatures[i].serial=="20:95:c6:f1:ea:db:65:ce:02:86:2b:d6:20:62:3b:92")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Febeecad" and pe.signatures [ i ] . serial == "20:95:c6:f1:ea:db:65:ce:02:86:2b:d6:20:62:3b:92" )
 }
 import "pe"
 
@@ -231036,13 +230470,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_899E32C9Bf2B533B9275C39F8F9Ff96D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "62ecae58-7576-5170-8eb5-2becd292e5de"
+		id = "e7ca5444-8ef9-5a06-a916-36a4beb138f9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3373-L3384"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c5fe3726fd19d050e762cc9e4e2099e74e3780c89a75dab55c12e16bfecd8642"
+		logic_hash = "v1_sha256_c5fe3726fd19d050e762cc9e4e2099e74e3780c89a75dab55c12e16bfecd8642"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231050,7 +230484,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_899E32C9Bf2B533B9275C39F8F9Ff96D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eecaaffcbfdffaedcfec" and pe.signatures[i].serial=="89:9e:32:c9:bf:2b:53:3b:92:75:c3:9f:8f:9f:f9:6d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Eecaaffcbfdffaedcfec" and pe.signatures [ i ] . serial == "89:9e:32:c9:bf:2b:53:3b:92:75:c3:9f:8f:9f:f9:6d" )
 }
 import "pe"
 
@@ -231059,13 +230493,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0B5759Bc22Ad2128B8792E8535F9161E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c35c4e07-73d9-54d6-a8cb-1558502a82e9"
+		id = "2c6e1390-1d3a-5e42-8054-b13e54952f0b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3386-L3397"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1ee543c204e5bf004224a2010f8cfd3196bb9c1e96de350548403224eaa502f6"
+		logic_hash = "v1_sha256_1ee543c204e5bf004224a2010f8cfd3196bb9c1e96de350548403224eaa502f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231073,7 +230507,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0B5759Bc22Ad2128B8792E8535F9161E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ceeacfeacafdcdffabdbbacf" and pe.signatures[i].serial=="0b:57:59:bc:22:ad:21:28:b8:79:2e:85:35:f9:16:1e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ceeacfeacafdcdffabdbbacf" and pe.signatures [ i ] . serial == "0b:57:59:bc:22:ad:21:28:b8:79:2e:85:35:f9:16:1e" )
 }
 import "pe"
 
@@ -231082,13 +230516,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_630Cf0E612F12805Ffa00A41D1032D7C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1c3e2b33-24e5-584c-b375-96c1e653a3ca"
+		id = "08ddd847-b13f-54c2-9139-c9a0bac7b63e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3399-L3410"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2256858ae75c47568fc6a38e2a587d302d99dd396dd398a450eaa6459ed55d13"
+		logic_hash = "v1_sha256_2256858ae75c47568fc6a38e2a587d302d99dd396dd398a450eaa6459ed55d13"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231096,7 +230530,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_630Cf0E612F12805Ffa00A41D1032D7C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dadebfaca" and pe.signatures[i].serial=="63:0c:f0:e6:12:f1:28:05:ff:a0:0a:41:d1:03:2d:7c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dadebfaca" and pe.signatures [ i ] . serial == "63:0c:f0:e6:12:f1:28:05:ff:a0:0a:41:d1:03:2d:7c" )
 }
 import "pe"
 
@@ -231105,13 +230539,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_603Bce30597089D068320Fc77E400D06 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0f2a2411-f3d4-5959-8470-d7424d714c1d"
+		id = "0a2d0591-ba4c-535c-b38c-40615f19db8a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3412-L3423"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1e13c78cec21a015d9593b492ce5040f93247be63c079bfece96a3a74055aeba"
+		logic_hash = "v1_sha256_1e13c78cec21a015d9593b492ce5040f93247be63c079bfece96a3a74055aeba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231119,7 +230553,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_603Bce30597089D068320Fc77E400D06 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fcaddefffedacfc" and pe.signatures[i].serial=="60:3b:ce:30:59:70:89:d0:68:32:0f:c7:7e:40:0d:06")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fcaddefffedacfc" and pe.signatures [ i ] . serial == "60:3b:ce:30:59:70:89:d0:68:32:0f:c7:7e:40:0d:06" )
 }
 import "pe"
 
@@ -231128,13 +230562,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5D5D03Edb4Ec4E185Caa3041824Ab75C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e1c93911-5c7c-5fe8-aed3-014a9bb7379e"
+		id = "2b1d7e38-c85f-5357-823d-c5511518a6ad"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3425-L3436"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "863a1496ce37449fa7e94c407ce0e63a9d727fef9094135715d0cb14ed442e5e"
+		logic_hash = "v1_sha256_863a1496ce37449fa7e94c407ce0e63a9d727fef9094135715d0cb14ed442e5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231142,7 +230576,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5D5D03Edb4Ec4E185Caa3041824Ab75C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ffcdcbacfeaedbfbcecccafeb" and pe.signatures[i].serial=="5d:5d:03:ed:b4:ec:4e:18:5c:aa:30:41:82:4a:b7:5c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ffcdcbacfeaedbfbcecccafeb" and pe.signatures [ i ] . serial == "5d:5d:03:ed:b4:ec:4e:18:5c:aa:30:41:82:4a:b7:5c" )
 }
 import "pe"
 
@@ -231151,13 +230585,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Aec009984Fa957F3F48Fe3104Ca9Babc : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "76b5d6b6-f443-55b5-b353-88201fe09e1f"
+		id = "f3ff773e-08e1-5c01-93ce-38bc98d9354a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3438-L3449"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "de9008e30468b94b4afbc622403b0257f5c5e3964344b980c18fc95219e06667"
+		logic_hash = "v1_sha256_de9008e30468b94b4afbc622403b0257f5c5e3964344b980c18fc95219e06667"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231165,7 +230599,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Aec009984Fa957F3F48Fe3104Ca9Babc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ceefaccdedbfbbaaaadacdbf" and pe.signatures[i].serial=="ae:c0:09:98:4f:a9:57:f3:f4:8f:e3:10:4c:a9:ba:bc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ceefaccdedbfbbaaaadacdbf" and pe.signatures [ i ] . serial == "ae:c0:09:98:4f:a9:57:f3:f4:8f:e3:10:4c:a9:ba:bc" )
 }
 import "pe"
 
@@ -231174,13 +230608,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_283518F1940A11Caf187646D8063D61D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cf5f7f11-3af6-577b-9a5e-eafe2de34e2b"
+		id = "6c536e45-cee8-5afb-9f42-4bd9b26bf935"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3451-L3462"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7db16bc44059e2538eb896011598a599c6aead90fb873c530ce8f5391e440164"
+		logic_hash = "v1_sha256_7db16bc44059e2538eb896011598a599c6aead90fb873c530ce8f5391e440164"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231188,7 +230622,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_283518F1940A11Caf187646D8063D61D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eeeeeeba" and pe.signatures[i].serial=="28:35:18:f1:94:0a:11:ca:f1:87:64:6d:80:63:d6:1d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Eeeeeeba" and pe.signatures [ i ] . serial == "28:35:18:f1:94:0a:11:ca:f1:87:64:6d:80:63:d6:1d" )
 }
 import "pe"
 
@@ -231197,13 +230631,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_72F3E4707B94D0Eef214384De9B36E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bf02ea89-b3f3-58a1-8bcd-1a23b3c96b68"
+		id = "f0cf814b-211a-5c41-b126-cbd9c8303c86"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3464-L3475"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c2a310ff70012076856239b5b5e6b46ffa121479dea38815e61f5336cecf8868"
+		logic_hash = "v1_sha256_c2a310ff70012076856239b5b5e6b46ffa121479dea38815e61f5336cecf8868"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231211,7 +230645,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_72F3E4707B94D0Eef214384De9B36E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eaaebecedccfd" and pe.signatures[i].serial=="72:f3:e4:70:7b:94:d0:ee:f2:14:38:4d:e9:b3:6e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Eaaebecedccfd" and pe.signatures [ i ] . serial == "72:f3:e4:70:7b:94:d0:ee:f2:14:38:4d:e9:b3:6e" )
 }
 import "pe"
 
@@ -231220,13 +230654,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D875B3E3F2Db6C3Eb426E24946066111 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a44cde8b-904b-5f1a-8cdb-4a8b16a42669"
+		id = "a9d578e5-d82e-546a-a4f4-7ea012a466f0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3477-L3488"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "470424bf28b723063be5d6801ee27b0f3748b761f9005616dcab4bd864db5463"
+		logic_hash = "v1_sha256_470424bf28b723063be5d6801ee27b0f3748b761f9005616dcab4bd864db5463"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231234,7 +230668,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D875B3E3F2Db6C3Eb426E24946066111 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kubit LLC" and pe.signatures[i].serial=="00:d8:75:b3:e3:f2:db:6c:3e:b4:26:e2:49:46:06:61:11")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kubit LLC" and pe.signatures [ i ] . serial == "00:d8:75:b3:e3:f2:db:6c:3e:b4:26:e2:49:46:06:61:11" )
 }
 import "pe"
 
@@ -231243,13 +230677,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3990362C34015Ce4C23Ecc3377Fd3C06 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e76824c2-6ee7-5117-a83f-0b8e4f2d3b61"
+		id = "80ed2f49-e9c6-59df-925e-44670210f955"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3490-L3501"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5e91a10f5027cae35524bef326edf7d5bf3df5bbc37c111b01e33f7667b03ce3"
+		logic_hash = "v1_sha256_5e91a10f5027cae35524bef326edf7d5bf3df5bbc37c111b01e33f7667b03ce3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231257,7 +230691,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3990362C34015Ce4C23Ecc3377Fd3C06 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RZOH ApS" and pe.signatures[i].serial=="39:90:36:2c:34:01:5c:e4:c2:3e:cc:33:77:fd:3c:06")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RZOH ApS" and pe.signatures [ i ] . serial == "39:90:36:2c:34:01:5c:e4:c2:3e:cc:33:77:fd:3c:06" )
 }
 import "pe"
 
@@ -231266,13 +230700,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_54A6D33F73129E0Ef059Ccf51Be0C35E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7b010276-718f-5168-bd8c-414252996fe6"
+		id = "2bbda6f3-9af2-532d-ad91-3ecd58bc28ac"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3503-L3514"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "93b332e4ad4e13c7e8241cf866091708232a6555a9240d828e558688167359a0"
+		logic_hash = "v1_sha256_93b332e4ad4e13c7e8241cf866091708232a6555a9240d828e558688167359a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231280,7 +230714,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_54A6D33F73129E0Ef059Ccf51Be0C35E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STAFFORD MEAT COMPANY, INC." and pe.signatures[i].serial=="54:a6:d3:3f:73:12:9e:0e:f0:59:cc:f5:1b:e0:c3:5e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "STAFFORD MEAT COMPANY, INC." and pe.signatures [ i ] . serial == "54:a6:d3:3f:73:12:9e:0e:f0:59:cc:f5:1b:e0:c3:5e" )
 }
 import "pe"
 
@@ -231289,13 +230723,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A55C15F733Bf1633E9Ffae8A6E3B37D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "86d8453b-115d-59f8-8123-5aff071ec3dd"
+		id = "633df735-07a3-53b7-9a8d-67471f4525a0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3516-L3527"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a772edb12dc0c351bb4d11f3e6ab3d9705af156ebeb4b8fff281bb418bfa1764"
+		logic_hash = "v1_sha256_a772edb12dc0c351bb4d11f3e6ab3d9705af156ebeb4b8fff281bb418bfa1764"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231303,7 +230737,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A55C15F733Bf1633E9Ffae8A6E3B37D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Osnova OOO" and pe.signatures[i].serial=="0a:55:c1:5f:73:3b:f1:63:3e:9f:fa:e8:a6:e3:b3:7d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Osnova OOO" and pe.signatures [ i ] . serial == "0a:55:c1:5f:73:3b:f1:63:3e:9f:fa:e8:a6:e3:b3:7d" )
 }
 import "pe"
 
@@ -231312,13 +230746,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F675139Ea68B897A865A98F8E4611F00 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7035ed66-73f9-568e-9698-13d9bbede64e"
+		id = "3a3f4d3a-d832-5e02-8fc2-cc17b5990f91"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3529-L3540"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9893e21fd2d5a475c9defb484921de17f4afc00619be413b9d5d55095e7f596a"
+		logic_hash = "v1_sha256_9893e21fd2d5a475c9defb484921de17f4afc00619be413b9d5d55095e7f596a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231326,7 +230760,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F675139Ea68B897A865A98F8E4611F00 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BS TEHNIK d.o.o." and pe.signatures[i].serial=="00:f6:75:13:9e:a6:8b:89:7a:86:5a:98:f8:e4:61:1f:00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BS TEHNIK d.o.o." and pe.signatures [ i ] . serial == "00:f6:75:13:9e:a6:8b:89:7a:86:5a:98:f8:e4:61:1f:00" )
 }
 import "pe"
 
@@ -231335,13 +230769,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_121Fca3Cfa4Bd011669F5Cc4E053Aa3F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "be18fe1a-f810-5153-b565-97a0e33cf406"
+		id = "c48fad91-9045-51e4-87da-0b08952a3be9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3542-L3553"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c5f7f23d9ba35bed3540233217e18b84c5ac0528fd3fe809c162fce6ccce0791"
+		logic_hash = "v1_sha256_c5f7f23d9ba35bed3540233217e18b84c5ac0528fd3fe809c162fce6ccce0791"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231349,7 +230783,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_121Fca3Cfa4Bd011669F5Cc4E053Aa3F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kymijoen Projektipalvelut Oy" and pe.signatures[i].serial=="12:1f:ca:3c:fa:4b:d0:11:66:9f:5c:c4:e0:53:aa:3f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kymijoen Projektipalvelut Oy" and pe.signatures [ i ] . serial == "12:1f:ca:3c:fa:4b:d0:11:66:9f:5c:c4:e0:53:aa:3f" )
 }
 import "pe"
 
@@ -231358,13 +230792,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_62B80Fc5E1C02072019C88Ee356152C1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "08db7669-c3d6-5f27-988e-96e9fc0a60f3"
+		id = "0b99017f-fb2f-5c03-9647-2f1605fbd2c7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3555-L3566"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c06e31f5a071ff7c87af216d22bffa2970372fa341ad2593ef0c3c6a71dac945"
+		logic_hash = "v1_sha256_c06e31f5a071ff7c87af216d22bffa2970372fa341ad2593ef0c3c6a71dac945"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231372,7 +230806,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_62B80Fc5E1C02072019C88Ee356152C1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Inversum" and pe.signatures[i].serial=="62:b8:0f:c5:e1:c0:20:72:01:9c:88:ee:35:61:52:c1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Inversum" and pe.signatures [ i ] . serial == "62:b8:0f:c5:e1:c0:20:72:01:9c:88:ee:35:61:52:c1" )
 }
 import "pe"
 
@@ -231381,13 +230815,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F0E150C304De35F2E9086185581F4053 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d2a5cd5b-1e4a-5714-bff2-08f2c958cd0b"
+		id = "1d9d3a31-3123-59b4-a7f3-a1b7a715ecc4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3581-L3592"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fe3d5d57d0a98414e3e4f35248d3ebf64617c16a4119a21883c3679b06146745"
+		logic_hash = "v1_sha256_fe3d5d57d0a98414e3e4f35248d3ebf64617c16a4119a21883c3679b06146745"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231395,7 +230829,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F0E150C304De35F2E9086185581F4053 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rare Ideas, LLC" and pe.signatures[i].serial=="f0:e1:50:c3:04:de:35:f2:e9:08:61:85:58:1f:40:53")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rare Ideas, LLC" and pe.signatures [ i ] . serial == "f0:e1:50:c3:04:de:35:f2:e9:08:61:85:58:1f:40:53" )
 }
 import "pe"
 
@@ -231404,13 +230838,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A1A3E7280E0A2Df12F84309649820519 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "71ad82d6-e45e-52a9-b1ff-f00cfe7b5186"
+		id = "6a5b8193-ce57-57c8-9541-9702a232e9a3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3594-L3605"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5c656fa5a6671f717cda5433c8780d308f11b7937e5ff66b4f3f74623b217365"
+		logic_hash = "v1_sha256_5c656fa5a6671f717cda5433c8780d308f11b7937e5ff66b4f3f74623b217365"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231418,7 +230852,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A1A3E7280E0A2Df12F84309649820519 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nir Sofer" and pe.signatures[i].serial=="a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Nir Sofer" and pe.signatures [ i ] . serial == "a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19" )
 }
 import "pe"
 
@@ -231427,13 +230861,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Fb984D5A7296Ba74445C23Ead7D20Aa : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1e290f81-11ab-5d5f-ab7a-c703c875bde4"
+		id = "e75423d0-6790-591a-9dba-4ce22371d05b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3607-L3618"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ff29013eb20bccbec16107404fc18b07c87ac5269b788c48a49a490271e94052"
+		logic_hash = "v1_sha256_ff29013eb20bccbec16107404fc18b07c87ac5269b788c48a49a490271e94052"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231441,7 +230875,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Fb984D5A7296Ba74445C23Ead7D20Aa : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DrWeb Digital LLC" and pe.signatures[i].serial=="1f:b9:84:d5:a7:29:6b:a7:44:45:c2:3e:ad:7d:20:aa")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DrWeb Digital LLC" and pe.signatures [ i ] . serial == "1f:b9:84:d5:a7:29:6b:a7:44:45:c2:3e:ad:7d:20:aa" )
 }
 import "pe"
 
@@ -231450,13 +230884,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C314A8736F82C411B9F02076A6Db4771 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0a8af16c-f232-5e09-9825-0e8203ba7b45"
+		id = "f3161f35-2c04-5ca8-a39c-31df0b945d7d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3620-L3631"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8aa08c4d1da62d0629db6e29f7a730da3534f114620e30f8d89e5475c12f43de"
+		logic_hash = "v1_sha256_8aa08c4d1da62d0629db6e29f7a730da3534f114620e30f8d89e5475c12f43de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231464,7 +230898,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C314A8736F82C411B9F02076A6Db4771 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cbcbaeaabbfcebfcbbeeffeadfc" and pe.signatures[i].serial=="c3:14:a8:73:6f:82:c4:11:b9:f0:20:76:a6:db:47:71")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cbcbaeaabbfcebfcbbeeffeadfc" and pe.signatures [ i ] . serial == "c3:14:a8:73:6f:82:c4:11:b9:f0:20:76:a6:db:47:71" )
 }
 import "pe"
 
@@ -231473,13 +230907,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5F7Ef778D51Cd33A5Fc0D2E035Ccd29D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "95b1cba9-9625-55da-a321-08cdd4d3056f"
+		id = "4b168816-e80e-5d06-8384-8ac2ff4791ec"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3633-L3644"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9b57fd9840dceea97a2f013f803e8639add6c6b01f3764b65b3c1fe60ae0dd57"
+		logic_hash = "v1_sha256_9b57fd9840dceea97a2f013f803e8639add6c6b01f3764b65b3c1fe60ae0dd57"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231487,7 +230921,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5F7Ef778D51Cd33A5Fc0D2E035Ccd29D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ffadbcfabbe" and pe.signatures[i].serial=="5f:7e:f7:78:d5:1c:d3:3a:5f:c0:d2:e0:35:cc:d2:9d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ffadbcfabbe" and pe.signatures [ i ] . serial == "5f:7e:f7:78:d5:1c:d3:3a:5f:c0:d2:e0:35:cc:d2:9d" )
 }
 import "pe"
 
@@ -231496,13 +230930,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ab1D5E43E4Dde77221381E21A764C082 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "55135b31-93d7-512f-8506-51e49bc3dc92"
+		id = "c744dfda-5e35-5208-bb8c-ef166a38d60d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3646-L3657"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3746c3494dca7fd2e0c7ab6641fe9ebbb8519df755022a3bde99c192158e4299"
+		logic_hash = "v1_sha256_3746c3494dca7fd2e0c7ab6641fe9ebbb8519df755022a3bde99c192158e4299"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231510,7 +230944,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ab1D5E43E4Dde77221381E21A764C082 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dadddbffbfcbdaaeeccecbbffac" and pe.signatures[i].serial=="00:ab:1d:5e:43:e4:dd:e7:72:21:38:1e:21:a7:64:c0:82")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dadddbffbfcbdaaeeccecbbffac" and pe.signatures [ i ] . serial == "00:ab:1d:5e:43:e4:dd:e7:72:21:38:1e:21:a7:64:c0:82" )
 }
 import "pe"
 
@@ -231519,13 +230953,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4743E140C05B33F0449023946Bd05Acb : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f3e8046a-0df7-5a67-a363-02961ec1545b"
+		id = "10a15324-fa26-53a1-bbd5-507df077177e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3659-L3670"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "be8764a008743f8ca8c1a5760c5daa7f6896c8710f5f79f9d5b42b07ef0d5fa8"
+		logic_hash = "v1_sha256_be8764a008743f8ca8c1a5760c5daa7f6896c8710f5f79f9d5b42b07ef0d5fa8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231533,7 +230967,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4743E140C05B33F0449023946Bd05Acb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STROI RENOV SARL" and pe.signatures[i].serial=="47:43:e1:40:c0:5b:33:f0:44:90:23:94:6b:d0:5a:cb")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "STROI RENOV SARL" and pe.signatures [ i ] . serial == "47:43:e1:40:c0:5b:33:f0:44:90:23:94:6b:d0:5a:cb" )
 }
 import "pe"
 
@@ -231542,13 +230976,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2C1Ee9B583310B5E34A1Ee6945A34B26 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0cc94ceb-a5bf-511a-bcd0-136b5d35c348"
+		id = "cf39b525-22c7-58f2-917a-92296cc40b82"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3672-L3683"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4891757929b64b45591792dd2526ffb7588345f76bcbd3e47f567e72ba03d7f2"
+		logic_hash = "v1_sha256_4891757929b64b45591792dd2526ffb7588345f76bcbd3e47f567e72ba03d7f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231556,7 +230990,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2C1Ee9B583310B5E34A1Ee6945A34B26 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Artmarket" and pe.signatures[i].serial=="2c:1e:e9:b5:83:31:0b:5e:34:a1:ee:69:45:a3:4b:26")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Artmarket" and pe.signatures [ i ] . serial == "2c:1e:e9:b5:83:31:0b:5e:34:a1:ee:69:45:a3:4b:26" )
 }
 import "pe"
 
@@ -231565,13 +230999,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D338F8A490E37E6C2Be80A0E349929Fa : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5bb542de-637f-58a4-b96a-f20dba7be1b7"
+		id = "7f1a32d0-ed29-546f-9e14-9827b1cc6da3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3685-L3696"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ed7a48df55f2d7873795470b9074421f4008d715db07978c79b174fc3f2a801a"
+		logic_hash = "v1_sha256_ed7a48df55f2d7873795470b9074421f4008d715db07978c79b174fc3f2a801a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231579,7 +231013,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D338F8A490E37E6C2Be80A0E349929Fa : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAGUARO ApS" and pe.signatures[i].serial=="00:d3:38:f8:a4:90:e3:7e:6c:2b:e8:0a:0e:34:99:29:fa")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SAGUARO ApS" and pe.signatures [ i ] . serial == "00:d3:38:f8:a4:90:e3:7e:6c:2b:e8:0a:0e:34:99:29:fa" )
 }
 import "pe"
 
@@ -231588,13 +231022,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_778906D40695F65Ba518Db760Df44Cd3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "87f5a591-ed92-5ee8-99f8-04afe302609e"
+		id = "22e413d4-bfe6-5e71-84b6-778f05e7508c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3698-L3709"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2687ec82b9c968dca91b8f54c600fae794d01be43a31cce4b0e6ef63672870fd"
+		logic_hash = "v1_sha256_2687ec82b9c968dca91b8f54c600fae794d01be43a31cce4b0e6ef63672870fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231602,7 +231036,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_778906D40695F65Ba518Db760Df44Cd3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="77:89:06:d4:06:95:f6:5b:a5:18:db:76:0d:f4:4c:d3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . serial == "77:89:06:d4:06:95:f6:5b:a5:18:db:76:0d:f4:4c:d3" )
 }
 import "pe"
 
@@ -231611,13 +231045,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_45Eb9187A2505D8E6C842E6D366Ad0C8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "75494bb2-fa70-5983-a75c-067b06c597e5"
+		id = "b3d63758-4459-50a0-98c8-32e772aed695"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3711-L3722"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a900017eb33db455b94e3474ce3a2f1ebf6416ff21477a464aba68d32fd7c938"
+		logic_hash = "v1_sha256_a900017eb33db455b94e3474ce3a2f1ebf6416ff21477a464aba68d32fd7c938"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231625,7 +231059,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_45Eb9187A2505D8E6C842E6D366Ad0C8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BAKERA s.r.o." and pe.signatures[i].serial=="45:eb:91:87:a2:50:5d:8e:6c:84:2e:6d:36:6a:d0:c8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BAKERA s.r.o." and pe.signatures [ i ] . serial == "45:eb:91:87:a2:50:5d:8e:6c:84:2e:6d:36:6a:d0:c8" )
 }
 import "pe"
 
@@ -231634,13 +231068,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Cbc2Af7D82295A8535F3B26B47522640 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d4f422a7-2b1c-5db0-ad9b-1eb8b3a75e3c"
+		id = "4afe4123-0455-53c6-8013-f75651ff0de9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3724-L3735"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6d9fb9b36bc4370851fd0f54bb9fb05e02fc7a6288355b57073c31b1feade41e"
+		logic_hash = "v1_sha256_6d9fb9b36bc4370851fd0f54bb9fb05e02fc7a6288355b57073c31b1feade41e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231648,7 +231082,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Cbc2Af7D82295A8535F3B26B47522640 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eabfdafffefaccaedaec" and pe.signatures[i].serial=="cb:c2:af:7d:82:29:5a:85:35:f3:b2:6b:47:52:26:40")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Eabfdafffefaccaedaec" and pe.signatures [ i ] . serial == "cb:c2:af:7d:82:29:5a:85:35:f3:b2:6b:47:52:26:40" )
 }
 import "pe"
 
@@ -231657,13 +231091,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ca1D9391Cf5Fe3E696831D98D6C35A6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e2f026d6-031d-5058-a7f1-fc492ea47908"
+		id = "3cb5028d-f4be-5b39-b0ad-ac69c13b3483"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3737-L3748"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4c60dea4fe28c2799dc88712275e62a795c848120c4b463109942b8d9bc29a81"
+		logic_hash = "v1_sha256_4c60dea4fe28c2799dc88712275e62a795c848120c4b463109942b8d9bc29a81"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231671,7 +231105,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ca1D9391Cf5Fe3E696831D98D6C35A6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "www.norton.com" and pe.signatures[i].serial=="0c:a1:d9:39:1c:f5:fe:3e:69:68:31:d9:8d:6c:35:a6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "www.norton.com" and pe.signatures [ i ] . serial == "0c:a1:d9:39:1c:f5:fe:3e:69:68:31:d9:8d:6c:35:a6" )
 }
 import "pe"
 
@@ -231680,13 +231114,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_43A36A26Ebc78E111A874D8211A95E3F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "651ca649-c707-59d2-b482-5ca6d1e569b0"
+		id = "62f42897-1192-5d62-a0cc-041fde577d36"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3750-L3761"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2588c91e1cce7e595e4237843b03f3e65427b4c3ea634e9a4f8249e9c9f49dbe"
+		logic_hash = "v1_sha256_2588c91e1cce7e595e4237843b03f3e65427b4c3ea634e9a4f8249e9c9f49dbe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231694,7 +231128,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_43A36A26Ebc78E111A874D8211A95E3F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Efacefcafeabbdcbcea" and pe.signatures[i].serial=="43:a3:6a:26:eb:c7:8e:11:1a:87:4d:82:11:a9:5e:3f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Efacefcafeabbdcbcea" and pe.signatures [ i ] . serial == "43:a3:6a:26:eb:c7:8e:11:1a:87:4d:82:11:a9:5e:3f" )
 }
 import "pe"
 
@@ -231703,13 +231137,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5172Caa2119185382343Fcbe09C43Bee : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "54f38317-2d36-54ec-a3fc-04f8b0fc5529"
+		id = "a58c3335-db60-54fe-b226-7ae05978032c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3763-L3774"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7aa1447bd0ac43ac29ed69bd6618c3695bfb50517a7ffce7d4e793ae0c5e0fa6"
+		logic_hash = "v1_sha256_7aa1447bd0ac43ac29ed69bd6618c3695bfb50517a7ffce7d4e793ae0c5e0fa6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231717,7 +231151,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5172Caa2119185382343Fcbe09C43Bee : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aefcdac" and pe.signatures[i].serial=="51:72:ca:a2:11:91:85:38:23:43:fc:be:09:c4:3b:ee")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Aefcdac" and pe.signatures [ i ] . serial == "51:72:ca:a2:11:91:85:38:23:43:fc:be:09:c4:3b:ee" )
 }
 import "pe"
 
@@ -231726,13 +231160,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009245D1511923F541844Faa3C6Bfebcbe : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "db876459-a0d2-542f-8f7e-a486ba68aeb4"
+		id = "3bfbfe5a-f992-500e-8ad5-cc0983a799d7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3776-L3787"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8d2c186b3aaaf353857e67ffd51a785e674335e824be78fc1c2ae1b9a0532eae"
+		logic_hash = "v1_sha256_8d2c186b3aaaf353857e67ffd51a785e674335e824be78fc1c2ae1b9a0532eae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231740,7 +231174,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009245D1511923F541844Faa3C6Bfebcbe : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LEHTEH d.o.o.," and pe.signatures[i].serial=="00:92:45:d1:51:19:23:f5:41:84:4f:aa:3c:6b:fe:bc:be")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LEHTEH d.o.o.," and pe.signatures [ i ] . serial == "00:92:45:d1:51:19:23:f5:41:84:4f:aa:3c:6b:fe:bc:be" )
 }
 import "pe"
 
@@ -231749,13 +231183,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E161F76Da3B5E4623892C8E6Fda1Ea3D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a010cf24-b29a-5613-8122-92ced507564f"
+		id = "b1793332-7697-56f0-a717-c588b5613d9b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3789-L3800"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7aae91e2873633989b3716930354361ee56d7fd7af35e105ae15ed6bf87de67a"
+		logic_hash = "v1_sha256_7aae91e2873633989b3716930354361ee56d7fd7af35e105ae15ed6bf87de67a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231763,7 +231197,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E161F76Da3B5E4623892C8E6Fda1Ea3D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TGN Nedelica d.o.o." and pe.signatures[i].serial=="00:e1:61:f7:6d:a3:b5:e4:62:38:92:c8:e6:fd:a1:ea:3d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TGN Nedelica d.o.o." and pe.signatures [ i ] . serial == "00:e1:61:f7:6d:a3:b5:e4:62:38:92:c8:e6:fd:a1:ea:3d" )
 }
 import "pe"
 
@@ -231772,13 +231206,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009Faf8705A3Eaef9340800Cc4Fd38597C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5b85e806-6b13-5356-a225-23399b947114"
+		id = "9ca87827-d808-57d7-ae5a-f723452dae3c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3802-L3813"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "41c6561ef50950c7a5b4107b788e0469f77b9905b777edb24501649e4c313bd6"
+		logic_hash = "v1_sha256_41c6561ef50950c7a5b4107b788e0469f77b9905b777edb24501649e4c313bd6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231786,7 +231220,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009Faf8705A3Eaef9340800Cc4Fd38597C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tekhnokod LLC" and pe.signatures[i].serial=="00:9f:af:87:05:a3:ea:ef:93:40:80:0c:c4:fd:38:59:7c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Tekhnokod LLC" and pe.signatures [ i ] . serial == "00:9f:af:87:05:a3:ea:ef:93:40:80:0c:c4:fd:38:59:7c" )
 }
 import "pe"
 
@@ -231795,13 +231229,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2888Cf0F953A4A3640Ee4Cfc6304D9D4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4c3153e4-d3ce-5e87-8e72-969cba972e26"
+		id = "56bf4b03-a1bc-5824-aa0f-c51bfa880b33"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3815-L3826"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5e0d1b74422ae1004b0054c161d1dc949bb368ac17575e33c9b6d550bb136126"
+		logic_hash = "v1_sha256_5e0d1b74422ae1004b0054c161d1dc949bb368ac17575e33c9b6d550bb136126"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231809,7 +231243,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2888Cf0F953A4A3640Ee4Cfc6304D9D4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lotte Schmidt" and pe.signatures[i].serial=="28:88:cf:0f:95:3a:4a:36:40:ee:4c:fc:63:04:d9:d4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Lotte Schmidt" and pe.signatures [ i ] . serial == "28:88:cf:0f:95:3a:4a:36:40:ee:4c:fc:63:04:d9:d4" )
 }
 import "pe"
 
@@ -231818,13 +231252,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C8Edcfe8Be174C2F204D858C5B91Dea5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "196da268-b9a3-562c-ad68-67d17ea94ccf"
+		id = "fbb66734-0688-56ca-bcfe-36e802c08751"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3828-L3839"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "56801a71547218413ab48381c412a8e1b7fd41a9f7a7c85dc6debdc38a19d6c4"
+		logic_hash = "v1_sha256_56801a71547218413ab48381c412a8e1b7fd41a9f7a7c85dc6debdc38a19d6c4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231832,7 +231266,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C8Edcfe8Be174C2F204D858C5B91Dea5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Paarcopy Oy" and pe.signatures[i].serial=="00:c8:ed:cf:e8:be:17:4c:2f:20:4d:85:8c:5b:91:de:a5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Paarcopy Oy" and pe.signatures [ i ] . serial == "00:c8:ed:cf:e8:be:17:4c:2f:20:4d:85:8c:5b:91:de:a5" )
 }
 import "pe"
 
@@ -231841,13 +231275,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1A311630876F694Fe1B75D972A953Bca : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2a39397f-1585-5f7f-a2a9-aab62d29a2b2"
+		id = "6e2b0ceb-b2a9-5a26-bf2f-668e67ad668b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3841-L3852"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f14532caf49e6f46f75e42e334d3170db0ebebfe75c9f3e057c237691b5d86a2"
+		logic_hash = "v1_sha256_f14532caf49e6f46f75e42e334d3170db0ebebfe75c9f3e057c237691b5d86a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231855,7 +231289,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1A311630876F694Fe1B75D972A953Bca : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GTEC s.r.o." and pe.signatures[i].serial=="1a:31:16:30:87:6f:69:4f:e1:b7:5d:97:2a:95:3b:ca")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GTEC s.r.o." and pe.signatures [ i ] . serial == "1a:31:16:30:87:6f:69:4f:e1:b7:5d:97:2a:95:3b:ca" )
 }
 import "pe"
 
@@ -231864,13 +231298,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A496Bc774575C31Abec861B68C36Dcb6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2415bf62-15d4-562a-a448-682474d89af0"
+		id = "be197683-7b7b-5b03-86a1-a6f16472b0a7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3854-L3865"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bf5282687f4707bc16d388361ddc0af1102df0d29066ece0b57215fcf9fdcc94"
+		logic_hash = "v1_sha256_bf5282687f4707bc16d388361ddc0af1102df0d29066ece0b57215fcf9fdcc94"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231878,7 +231312,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A496Bc774575C31Abec861B68C36Dcb6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORGLE DVORSAK, d.o.o" and pe.signatures[i].serial=="00:a4:96:bc:77:45:75:c3:1a:be:c8:61:b6:8c:36:dc:b6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ORGLE DVORSAK, d.o.o" and pe.signatures [ i ] . serial == "00:a4:96:bc:77:45:75:c3:1a:be:c8:61:b6:8c:36:dc:b6" )
 }
 import "pe"
 
@@ -231887,13 +231321,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ea720222D92Dc8D48E3B3C3B0Fc360A6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2e43e98a-61f8-5f93-a415-52cb6453620d"
+		id = "ce65fc3d-4bc7-5172-bd4e-9a92f3abfb66"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3867-L3878"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "97b2699d4cb0fd88e3440ea82dd6ea87cdac69c6ba2acd884f5aef577b55e79d"
+		logic_hash = "v1_sha256_97b2699d4cb0fd88e3440ea82dd6ea87cdac69c6ba2acd884f5aef577b55e79d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231901,7 +231335,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ea720222D92Dc8D48E3B3C3B0Fc360A6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CAVANAGH NETS LIMITED" and pe.signatures[i].serial=="00:ea:72:02:22:d9:2d:c8:d4:8e:3b:3c:3b:0f:c3:60:a6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CAVANAGH NETS LIMITED" and pe.signatures [ i ] . serial == "00:ea:72:02:22:d9:2d:c8:d4:8e:3b:3c:3b:0f:c3:60:a6" )
 }
 import "pe"
 
@@ -231910,13 +231344,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_333Ca7D100B139B0D9C1A97Cb458E226 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dd5b3eb8-81c0-570d-9ec8-6a55eb7864f9"
+		id = "e7687d7b-60cd-5888-b740-e6600465011e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3880-L3891"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4519127b975d93297cca9b465ad88b3d38ad0fce0de182246dca3f000e2438be"
+		logic_hash = "v1_sha256_4519127b975d93297cca9b465ad88b3d38ad0fce0de182246dca3f000e2438be"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231924,7 +231358,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_333Ca7D100B139B0D9C1A97Cb458E226 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FSE, d.o.o." and pe.signatures[i].serial=="33:3c:a7:d1:00:b1:39:b0:d9:c1:a9:7c:b4:58:e2:26")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FSE, d.o.o." and pe.signatures [ i ] . serial == "33:3c:a7:d1:00:b1:39:b0:d9:c1:a9:7c:b4:58:e2:26" )
 }
 import "pe"
 
@@ -231933,13 +231367,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_58Ec8821Aa2A3755E1075F73321756F4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "efa0e5c6-773a-5740-b7f9-ec10a92b1623"
+		id = "c23b7c9e-bcab-59be-b758-bc60a53de832"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3893-L3904"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b79f161c77cbae0bec55fb2b047983660c84d2bb93db8c91cb6c22fd4ad197cc"
+		logic_hash = "v1_sha256_b79f161c77cbae0bec55fb2b047983660c84d2bb93db8c91cb6c22fd4ad197cc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231947,7 +231381,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_58Ec8821Aa2A3755E1075F73321756F4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cbebbfeaddcbcccffdcdc" and pe.signatures[i].serial=="58:ec:88:21:aa:2a:37:55:e1:07:5f:73:32:17:56:f4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cbebbfeaddcbcccffdcdc" and pe.signatures [ i ] . serial == "58:ec:88:21:aa:2a:37:55:e1:07:5f:73:32:17:56:f4" )
 }
 import "pe"
 
@@ -231956,13 +231390,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0940Fa9A4080F35052B2077333769C2F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2cc722de-97ff-53d1-9436-dc88c844186b"
+		id = "1e707abb-b224-56ce-96df-431a51156524"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3906-L3917"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3ecf6982c779a5fd867fef4b753313e379151491fa8865e8ae20f0c9362431a2"
+		logic_hash = "v1_sha256_3ecf6982c779a5fd867fef4b753313e379151491fa8865e8ae20f0c9362431a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231970,7 +231404,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0940Fa9A4080F35052B2077333769C2F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROFF LAIN, OOO" and pe.signatures[i].serial=="09:40:fa:9a:40:80:f3:50:52:b2:07:73:33:76:9c:2f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PROFF LAIN, OOO" and pe.signatures [ i ] . serial == "09:40:fa:9a:40:80:f3:50:52:b2:07:73:33:76:9c:2f" )
 }
 import "pe"
 
@@ -231979,13 +231413,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56Fff139Df5Ae7E788E5D72196Dd563A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7cdca79f-5bf3-5768-b034-4d3bb177ffc9"
+		id = "1fb00ed2-f99c-549f-a3e1-2402537e0eb3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3919-L3930"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "022fd24ba023dba06f1c63d1d1c90d17dc82b060d634a27b237d37e37455964f"
+		logic_hash = "v1_sha256_022fd24ba023dba06f1c63d1d1c90d17dc82b060d634a27b237d37e37455964f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -231993,7 +231427,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56Fff139Df5Ae7E788E5D72196Dd563A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cifromatika LLC" and pe.signatures[i].serial=="56:ff:f1:39:df:5a:e7:e7:88:e5:d7:21:96:dd:56:3a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cifromatika LLC" and pe.signatures [ i ] . serial == "56:ff:f1:39:df:5a:e7:e7:88:e5:d7:21:96:dd:56:3a" )
 }
 import "pe"
 
@@ -232002,13 +231436,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_03D433Fdc2469E9Fd878C80Bc0545147 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4f793397-2768-5b34-a9f5-9100dccfa80e"
+		id = "ebb67ea8-e5ef-5834-9bc5-710746a2244e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3932-L3943"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fde125138ade8ab1a61544b90160f2c1d4bba3a09ffcf828768f98d925ab91c6"
+		logic_hash = "v1_sha256_fde125138ade8ab1a61544b90160f2c1d4bba3a09ffcf828768f98d925ab91c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232016,7 +231450,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_03D433Fdc2469E9Fd878C80Bc0545147 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xEC\\xA3\\xBC\\xEC\\x8B\\x9D\\xED\\x9A\\x8C\\xEC\\x82\\xAC \\xEC\\x97\\x98\\xEB\\xA6\\xAC\\xEC\\x8B\\x9C\\xEC\\x98\\xA8\\xEB\\x9E\\xA9" and pe.signatures[i].serial=="03:d4:33:fd:c2:46:9e:9f:d8:78:c8:0b:c0:54:51:47")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xEC\\xA3\\xBC\\xEC\\x8B\\x9D\\xED\\x9A\\x8C\\xEC\\x82\\xAC \\xEC\\x97\\x98\\xEB\\xA6\\xAC\\xEC\\x8B\\x9C\\xEC\\x98\\xA8\\xEB\\x9E\\xA9" and pe.signatures [ i ] . serial == "03:d4:33:fd:c2:46:9e:9f:d8:78:c8:0b:c0:54:51:47" )
 }
 import "pe"
 
@@ -232025,13 +231459,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Be3F393D1Ef0272Aed0E2319C1B5Dd0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2be05341-c7a2-58fd-9211-8d3a912a7d5c"
+		id = "5d6bef9c-ed75-56f0-89ec-3239da8cff86"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3945-L3956"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a7ff863b07d5ce011bdbcf86a3f562e8201926c138848544559bd1d16597ff95"
+		logic_hash = "v1_sha256_a7ff863b07d5ce011bdbcf86a3f562e8201926c138848544559bd1d16597ff95"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232039,7 +231473,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Be3F393D1Ef0272Aed0E2319C1B5Dd0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Invincea, Inc." and pe.signatures[i].serial=="0b:e3:f3:93:d1:ef:02:72:ae:d0:e2:31:9c:1b:5d:d0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Invincea, Inc." and pe.signatures [ i ] . serial == "0b:e3:f3:93:d1:ef:02:72:ae:d0:e2:31:9c:1b:5d:d0" )
 }
 import "pe"
 
@@ -232048,13 +231482,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_65628C146Ace93037Fc58659F14Bd35F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9104836a-3385-5b78-9e1d-705b7ed4b721"
+		id = "4d2f5df4-643e-5d23-8bfe-535f4550db0b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3958-L3969"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a6b4cc307d6e6f4d5d275ef0765a7082216b1d277c9b1328abe7cb2c2497e411"
+		logic_hash = "v1_sha256_a6b4cc307d6e6f4d5d275ef0765a7082216b1d277c9b1328abe7cb2c2497e411"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232062,7 +231496,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_65628C146Ace93037Fc58659F14Bd35F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ESET, spol. s r.o." and pe.signatures[i].serial=="65:62:8c:14:6a:ce:93:03:7f:c5:86:59:f1:4b:d3:5f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ESET, spol. s r.o." and pe.signatures [ i ] . serial == "65:62:8c:14:6a:ce:93:03:7f:c5:86:59:f1:4b:d3:5f" )
 }
 import "pe"
 
@@ -232071,13 +231505,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0084817E07288A5025B9435570E7Fec1D3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "31528b27-4a0c-5e97-b201-07e89248196a"
+		id = "62627740-265c-58a1-bfc6-dc75e49094ba"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3971-L3982"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "89da849911c6d6a3b6d45166bd9975828887b50ee149dea4cbae9cc5c0ecf6d2"
+		logic_hash = "v1_sha256_89da849911c6d6a3b6d45166bd9975828887b50ee149dea4cbae9cc5c0ecf6d2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232085,7 +231519,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0084817E07288A5025B9435570E7Fec1D3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\xB4\\xBC\\xE8\\x89\\xBE\\xE5\\xBE\\xB7\\xE8\\xB4\\xBC\\xE6\\x8F\\x90\\xD0\\xAD\\xD0\\xAD\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE8\\xB4\\xBC\\xD0\\xAD\\xE5\\xBE\\xB7\\xE8\\xB4\\xBC\\xE8\\xB4\\xBC\\xE5\\xB0\\x94\\xE6\\x8F\\x90\\xE8\\x89\\xBE\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE5\\xB0\\x94\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE8\\x89\\xBE\\xD0\\xAD\\xE8\\x89\\xBE" and pe.signatures[i].serial=="00:84:81:7e:07:28:8a:50:25:b9:43:55:70:e7:fe:c1:d3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE8\\xB4\\xBC\\xE8\\x89\\xBE\\xE5\\xBE\\xB7\\xE8\\xB4\\xBC\\xE6\\x8F\\x90\\xD0\\xAD\\xD0\\xAD\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE8\\xB4\\xBC\\xD0\\xAD\\xE5\\xBE\\xB7\\xE8\\xB4\\xBC\\xE8\\xB4\\xBC\\xE5\\xB0\\x94\\xE6\\x8F\\x90\\xE8\\x89\\xBE\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE5\\xB0\\x94\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE8\\x89\\xBE\\xD0\\xAD\\xE8\\x89\\xBE" and pe.signatures [ i ] . serial == "00:84:81:7e:07:28:8a:50:25:b9:43:55:70:e7:fe:c1:d3" )
 }
 import "pe"
 
@@ -232094,13 +231528,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4D26Bab89Fcf7Ff9Fa4Dc4847E563563 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "168281bf-35ad-542a-adb4-20d719e31e2d"
+		id = "e077fb43-37e1-58b6-8ddf-63594eb27d50"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3984-L3995"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3eadf6eda2819101a370688d636250085915be3ebf1b3dec7a86d12a6a5ce681"
+		logic_hash = "v1_sha256_3eadf6eda2819101a370688d636250085915be3ebf1b3dec7a86d12a6a5ce681"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232108,7 +231542,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4D26Bab89Fcf7Ff9Fa4Dc4847E563563 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "qvarn pty ltd" and pe.signatures[i].serial=="4d:26:ba:b8:9f:cf:7f:f9:fa:4d:c4:84:7e:56:35:63")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "qvarn pty ltd" and pe.signatures [ i ] . serial == "4d:26:ba:b8:9f:cf:7f:f9:fa:4d:c4:84:7e:56:35:63" )
 }
 import "pe"
 
@@ -232117,13 +231551,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D9D419C9095A79B1F764297Addb935Da : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7c45a78c-2cde-5200-81fd-239effef7fe6"
+		id = "c960976e-aeeb-5905-8f57-e64abdeefa49"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L3997-L4008"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dd35b48752eec01e1bfff182410da9a857735e0052e9c1a0d7c366dbee808d3c"
+		logic_hash = "v1_sha256_dd35b48752eec01e1bfff182410da9a857735e0052e9c1a0d7c366dbee808d3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232131,7 +231565,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D9D419C9095A79B1F764297Addb935Da : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Nova soft" and pe.signatures[i].serial=="00:d9:d4:19:c9:09:5a:79:b1:f7:64:29:7a:dd:b9:35:da")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Nova soft" and pe.signatures [ i ] . serial == "00:d9:d4:19:c9:09:5a:79:b1:f7:64:29:7a:dd:b9:35:da" )
 }
 import "pe"
 
@@ -232140,13 +231574,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02E44D7D1D38Ae223B27A02Bacd79B53 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7f2ad143-c46b-58cb-9fe5-c7bb9c6d9234"
+		id = "dd4d88c5-e17c-5944-8e90-873deee2d533"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4010-L4021"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7ab506b2e4a716bc6f7115a071f46df4ea4ac88a4b636506a13ac0d383664e58"
+		logic_hash = "v1_sha256_7ab506b2e4a716bc6f7115a071f46df4ea4ac88a4b636506a13ac0d383664e58"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232154,7 +231588,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02E44D7D1D38Ae223B27A02Bacd79B53 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuhai Kingsoft Office Software Co., Ltd." and pe.signatures[i].serial=="02:e4:4d:7d:1d:38:ae:22:3b:27:a0:2b:ac:d7:9b:53")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Zhuhai Kingsoft Office Software Co., Ltd." and pe.signatures [ i ] . serial == "02:e4:4d:7d:1d:38:ae:22:3b:27:a0:2b:ac:d7:9b:53" )
 }
 import "pe"
 
@@ -232163,13 +231597,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_041868Dd49840Ff44F8E3D3070568350 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2cfbae1f-9c8a-5263-b9d6-5be27fdca822"
+		id = "7c810670-f8fa-5e50-93fc-89eaf511b4c2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4023-L4034"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "80abb596d96cb388bf3ff23598fc889d4c14cccf262d01f10a5be3a738a4907e"
+		logic_hash = "v1_sha256_80abb596d96cb388bf3ff23598fc889d4c14cccf262d01f10a5be3a738a4907e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232177,7 +231611,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_041868Dd49840Ff44F8E3D3070568350 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuhai Kingsoft Office Software Co., Ltd." and pe.signatures[i].serial=="04:18:68:dd:49:84:0f:f4:4f:8e:3d:30:70:56:83:50")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Zhuhai Kingsoft Office Software Co., Ltd." and pe.signatures [ i ] . serial == "04:18:68:dd:49:84:0f:f4:4f:8e:3d:30:70:56:83:50" )
 }
 import "pe"
 
@@ -232186,13 +231620,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C501B7176B29A3Cb737361Cf85414874 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8bebf02c-de14-5488-8720-5fc98b0799bd"
+		id = "b1a7c64e-2b9a-5dcf-9152-c50fe6aacce6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4036-L4047"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f3eb67b39e0e4e12388f17d231fadfc2ea36b1568191a411950c2e24c32ed09c"
+		logic_hash = "v1_sha256_f3eb67b39e0e4e12388f17d231fadfc2ea36b1568191a411950c2e24c32ed09c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232200,7 +231634,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C501B7176B29A3Cb737361Cf85414874 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x8B\\x92\\xE8\\x89\\xBE\\xE8\\xAF\\xB6\\xE8\\x89\\xBE\\xE8\\xB4\\x9D\\xE8\\xAF\\xB6\\xE8\\xAF\\xB6\\xE8\\xB4\\x9D\\xE5\\x90\\xBE\\xE5\\xBC\\x97\\xE5\\xBC\\x97\\xE5\\x90\\xBE\\xE8\\xAF\\xB6\\xE5\\x8B\\x92\\xE8\\xB4\\x9D\\xE5\\xBC\\x97\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE8\\xAF\\xB6\\xE8\\x89\\xBE\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE8\\x89\\xBE\\xE5\\xBC\\x97\\xE5\\xBC\\x97" and pe.signatures[i].serial=="c5:01:b7:17:6b:29:a3:cb:73:73:61:cf:85:41:48:74")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE5\\x8B\\x92\\xE8\\x89\\xBE\\xE8\\xAF\\xB6\\xE8\\x89\\xBE\\xE8\\xB4\\x9D\\xE8\\xAF\\xB6\\xE8\\xAF\\xB6\\xE8\\xB4\\x9D\\xE5\\x90\\xBE\\xE5\\xBC\\x97\\xE5\\xBC\\x97\\xE5\\x90\\xBE\\xE8\\xAF\\xB6\\xE5\\x8B\\x92\\xE8\\xB4\\x9D\\xE5\\xBC\\x97\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE8\\xAF\\xB6\\xE8\\x89\\xBE\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE8\\x89\\xBE\\xE5\\xBC\\x97\\xE5\\xBC\\x97" and pe.signatures [ i ] . serial == "c5:01:b7:17:6b:29:a3:cb:73:73:61:cf:85:41:48:74" )
 }
 import "pe"
 
@@ -232209,13 +231643,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_234Bf4Ef892Df307373638014B35Ab37 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "af403af3-2c10-5742-80f2-c507695106a2"
+		id = "e2dff650-5284-5cbd-b882-cb43727f647d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4049-L4060"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d01dbb798b309927e666e5e68c56c6eeabad7ccbc427d62f0507597c6e9e7aa7"
+		logic_hash = "v1_sha256_d01dbb798b309927e666e5e68c56c6eeabad7ccbc427d62f0507597c6e9e7aa7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232223,7 +231657,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_234Bf4Ef892Df307373638014B35Ab37 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="23:4b:f4:ef:89:2d:f3:07:37:36:38:01:4b:35:ab:37")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . serial == "23:4b:f4:ef:89:2d:f3:07:37:36:38:01:4b:35:ab:37" )
 }
 import "pe"
 
@@ -232232,13 +231666,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C650Ae531100A91389A7F030228B3095 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "80ee9422-190d-5a4e-9a4c-fb8d1b2e2f8c"
+		id = "478be0d2-5793-5098-912c-37575c72b595"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4062-L4073"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e5afd76711e1b466d7eba742f50c7f9551498796f0aca45566bd9686034efac3"
+		logic_hash = "v1_sha256_e5afd76711e1b466d7eba742f50c7f9551498796f0aca45566bd9686034efac3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232246,7 +231680,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C650Ae531100A91389A7F030228B3095 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "POKEROWA STRUNA SP Z O O" and pe.signatures[i].serial=="c6:50:ae:53:11:00:a9:13:89:a7:f0:30:22:8b:30:95")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "POKEROWA STRUNA SP Z O O" and pe.signatures [ i ] . serial == "c6:50:ae:53:11:00:a9:13:89:a7:f0:30:22:8b:30:95" )
 }
 import "pe"
 
@@ -232255,13 +231689,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4F8Ebbb263F3Cbe558D37118C43F8D58 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c273f7e4-8c88-5205-be4b-3a8e8bed144e"
+		id = "f1f7ab0c-dd6f-5f59-bff2-9b36f2a51cc7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4075-L4086"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e502e7e08fa82f8bd1b2b15c34999ece6b3d59d75ab1a4dda05b4b9440c49b7c"
+		logic_hash = "v1_sha256_e502e7e08fa82f8bd1b2b15c34999ece6b3d59d75ab1a4dda05b4b9440c49b7c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232269,7 +231703,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4F8Ebbb263F3Cbe558D37118C43F8D58 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Maxthon Technology Co, Ltd." and pe.signatures[i].serial=="4f:8e:bb:b2:63:f3:cb:e5:58:d3:71:18:c4:3f:8d:58")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Maxthon Technology Co, Ltd." and pe.signatures [ i ] . serial == "4f:8e:bb:b2:63:f3:cb:e5:58:d3:71:18:c4:3f:8d:58" )
 }
 import "pe"
 
@@ -232278,13 +231712,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_01Ea62E443Cb2250C870Ff6Bb13Ba98E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "40c5f73b-70b6-5db7-8060-01ad77e5f319"
+		id = "21295193-5e84-5c42-9b3f-d3221cd725c6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4088-L4099"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dbf281989fb89976f83e0e2395f02c1e8c4c9ec5f96095786d9c6406518eb315"
+		logic_hash = "v1_sha256_dbf281989fb89976f83e0e2395f02c1e8c4c9ec5f96095786d9c6406518eb315"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232292,7 +231726,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_01Ea62E443Cb2250C870Ff6Bb13Ba98E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tencent Technology(Shenzhen) Company Limited" and pe.signatures[i].serial=="01:ea:62:e4:43:cb:22:50:c8:70:ff:6b:b1:3b:a9:8e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Tencent Technology(Shenzhen) Company Limited" and pe.signatures [ i ] . serial == "01:ea:62:e4:43:cb:22:50:c8:70:ff:6b:b1:3b:a9:8e" )
 }
 import "pe"
 
@@ -232301,13 +231735,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_726Ee7F5999B9E8574Ec59969C04955C : FILE
 	meta:
 		description = "Detects IntelliAdmin commercial remote administration signing certificate"
 		author = "ditekSHen"
-		id = "5e88abd2-97d5-5271-ace5-6b7cb2cd6633"
+		id = "cc252b68-00b5-5844-8762-f2fbd9d99b6a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4101-L4112"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "494afa3711d93c56d52b8ae944db737cb53db8d27f2255c7045c3bf4478995a3"
+		logic_hash = "v1_sha256_494afa3711d93c56d52b8ae944db737cb53db8d27f2255c7045c3bf4478995a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232315,7 +231749,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_726Ee7F5999B9E8574Ec59969C04955C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IntelliAdmin, LLC" and pe.signatures[i].serial=="72:6e:e7:f5:99:9b:9e:85:74:ec:59:96:9c:04:95:5c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IntelliAdmin, LLC" and pe.signatures [ i ] . serial == "72:6e:e7:f5:99:9b:9e:85:74:ec:59:96:9c:04:95:5c" )
 }
 import "pe"
 
@@ -232324,13 +231758,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A005D2E2Bcd4137168217D8C727747C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c3888d90-0c09-539a-9155-a60e4670320d"
+		id = "98e71087-8bc5-5857-863e-d99bebd2b4bd"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4114-L4125"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b4024cd0d6c9a86d3956b9ba5d9692fc7ec2d7aa399a56a0b12f9387801a0b08"
+		logic_hash = "v1_sha256_b4024cd0d6c9a86d3956b9ba5d9692fc7ec2d7aa399a56a0b12f9387801a0b08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232338,7 +231772,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A005D2E2Bcd4137168217D8C727747C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing JoinHope Image Technology Ltd." and pe.signatures[i].serial=="0a:00:5d:2e:2b:cd:41:37:16:82:17:d8:c7:27:74:7c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing JoinHope Image Technology Ltd." and pe.signatures [ i ] . serial == "0a:00:5d:2e:2b:cd:41:37:16:82:17:d8:c7:27:74:7c" )
 }
 import "pe"
 
@@ -232347,13 +231781,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D3D74Ae548830D5B1Bca9856E16C564A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "692ef744-9609-5cb1-b425-3bacf012fcdb"
+		id = "90d52cf6-c91d-55a3-955b-e05cda8b410c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4127-L4138"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c72f10af530a6af4526ad956ef6058d097417a8fe3b902e3c7cba27b04e0c2c1"
+		logic_hash = "v1_sha256_c72f10af530a6af4526ad956ef6058d097417a8fe3b902e3c7cba27b04e0c2c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232361,7 +231795,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D3D74Ae548830D5B1Bca9856E16C564A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Insite Software Inc." and pe.signatures[i].serial=="00:d3:d7:4a:e5:48:83:0d:5b:1b:ca:98:56:e1:6c:56:4a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Insite Software Inc." and pe.signatures [ i ] . serial == "00:d3:d7:4a:e5:48:83:0d:5b:1b:ca:98:56:e1:6c:56:4a" )
 }
 import "pe"
 
@@ -232370,13 +231804,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_41F8253E1Ceafbfd8E49F32C34A68F9E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "84bd03de-88cd-5180-af11-916dbecd0366"
+		id = "1a30a76a-f03b-5828-91a8-a6bf4971b9f5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4140-L4151"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "53f71030815dcdda8424fe858d26a08cf947a683e69c50ea5fda53f51b88bb93"
+		logic_hash = "v1_sha256_53f71030815dcdda8424fe858d26a08cf947a683e69c50ea5fda53f51b88bb93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232384,7 +231818,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_41F8253E1Ceafbfd8E49F32C34A68F9E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shenzhen Smartspace Software technology Co.,Limited" and pe.signatures[i].serial=="41:f8:25:3e:1c:ea:fb:fd:8e:49:f3:2c:34:a6:8f:9e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shenzhen Smartspace Software technology Co.,Limited" and pe.signatures [ i ] . serial == "41:f8:25:3e:1c:ea:fb:fd:8e:49:f3:2c:34:a6:8f:9e" )
 }
 import "pe"
 
@@ -232393,13 +231827,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A5B4F67Ad8B22Afc2Debe6Ce5F8F679 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e1cc3d27-4f76-58a8-8dd6-fd8dbe48252e"
+		id = "4ae9792c-5fbd-577a-b1d2-b13729702d15"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4153-L4164"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "19cf46c112b546c26f12891727fdbc74aaa78bbdcdbc4e041781394f4cf5f719"
+		logic_hash = "v1_sha256_19cf46c112b546c26f12891727fdbc74aaa78bbdcdbc4e041781394f4cf5f719"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232407,7 +231841,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A5B4F67Ad8B22Afc2Debe6Ce5F8F679 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Farad LLC" and pe.signatures[i].serial=="0a:5b:4f:67:ad:8b:22:af:c2:de:be:6c:e5:f8:f6:79")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Farad LLC" and pe.signatures [ i ] . serial == "0a:5b:4f:67:ad:8b:22:af:c2:de:be:6c:e5:f8:f6:79" )
 }
 import "pe"
 
@@ -232416,13 +231850,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_65Cd323C2483668B90A44A711D2A6B98 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b976e930-cf9a-5b0f-9a1b-c35c3f134bdd"
+		id = "b6489511-a4ba-53f7-b3f1-efda2dd8cc85"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4166-L4177"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e0a9868f9a42aeb8f90aff540a73bc8fa1bfebbf8ee6c0c71bd921cf914e0875"
+		logic_hash = "v1_sha256_e0a9868f9a42aeb8f90aff540a73bc8fa1bfebbf8ee6c0c71bd921cf914e0875"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232430,7 +231864,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_65Cd323C2483668B90A44A711D2A6B98 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Giperion" and pe.signatures[i].serial=="65:cd:32:3c:24:83:66:8b:90:a4:4a:71:1d:2a:6b:98")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Giperion" and pe.signatures [ i ] . serial == "65:cd:32:3c:24:83:66:8b:90:a4:4a:71:1d:2a:6b:98" )
 }
 import "pe"
 
@@ -232439,13 +231873,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0F7E3Fda780E47E171864D8F5386Bc05 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "33b8ce54-fa2c-5aac-9022-2309f7fc4a86"
+		id = "0d4250b2-a7f4-5ba0-a889-9106d6fc3201"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4192-L4203"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "30e2daf85ee7f9f9615a49af949a034b50a97a1a7abf6a318547809cc9e7b0b7"
+		logic_hash = "v1_sha256_30e2daf85ee7f9f9615a49af949a034b50a97a1a7abf6a318547809cc9e7b0b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232453,7 +231887,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0F7E3Fda780E47E171864D8F5386Bc05 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Louhos Solutions Oy" and pe.signatures[i].serial=="0f:7e:3f:da:78:0e:47:e1:71:86:4d:8f:53:86:bc:05")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Louhos Solutions Oy" and pe.signatures [ i ] . serial == "0f:7e:3f:da:78:0e:47:e1:71:86:4d:8f:53:86:bc:05" )
 }
 import "pe"
 
@@ -232462,13 +231896,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C2Cbbd946Bc3Fdb944D522931D61D51A : FILE
 	meta:
 		description = "Detects executables signed with Sordum Software certificate, particularly Defender Control"
 		author = "ditekSHen"
-		id = "b8ccfb1a-4e3f-5823-af38-e1607458023e"
+		id = "0b4b1abf-529e-53d1-a58e-c34140c2004a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4231-L4242"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6e67835cf85c713ef5a21b866a277e90236c607fb67d3fd9b2bba627c31d9e97"
+		logic_hash = "v1_sha256_6e67835cf85c713ef5a21b866a277e90236c607fb67d3fd9b2bba627c31d9e97"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232476,7 +231910,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C2Cbbd946Bc3Fdb944D522931D61D51A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sordum Software" and pe.signatures[i].serial=="c2:cb:bd:94:6b:c3:fd:b9:44:d5:22:93:1d:61:d5:1a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sordum Software" and pe.signatures [ i ] . serial == "c2:cb:bd:94:6b:c3:fd:b9:44:d5:22:93:1d:61:d5:1a" )
 }
 import "pe"
 
@@ -232485,13 +231919,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6E3B09F43C3A0Fd53B7D600F08Fae2B5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d23e7b9b-4424-50c5-a768-9cb33e0de192"
+		id = "6f6deefc-6e67-5a8a-a8d6-9520544f4e1b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4244-L4255"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "45e2833dedacd875912d07dc63216400ddff76846f9c7bdf808f1db56ed4720c"
+		logic_hash = "v1_sha256_45e2833dedacd875912d07dc63216400ddff76846f9c7bdf808f1db56ed4720c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232499,7 +231933,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6E3B09F43C3A0Fd53B7D600F08Fae2B5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Divisible Limited" and pe.signatures[i].serial=="6e:3b:09:f4:3c:3a:0f:d5:3b:7d:60:0f:08:fa:e2:b5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Divisible Limited" and pe.signatures [ i ] . serial == "6e:3b:09:f4:3c:3a:0f:d5:3b:7d:60:0f:08:fa:e2:b5" )
 }
 import "pe"
 
@@ -232508,13 +231942,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Aa12C95D2Bcde0Ce141C6F1145B0D7Ef : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "66ef7681-7467-5c9f-8e0b-749a9711f15a"
+		id = "3ea27677-d551-5ea7-9106-c7c5738c7621"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4257-L4268"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "34edd92640d8059f074513b526c7a2bf0d9265af9466a2ae66b93255044744c4"
+		logic_hash = "v1_sha256_34edd92640d8059f074513b526c7a2bf0d9265af9466a2ae66b93255044744c4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232522,7 +231956,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Aa12C95D2Bcde0Ce141C6F1145B0D7Ef : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROKON, OOO" and pe.signatures[i].serial=="00:aa:12:c9:5d:2b:cd:e0:ce:14:1c:6f:11:45:b0:d7:ef")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PROKON, OOO" and pe.signatures [ i ] . serial == "00:aa:12:c9:5d:2b:cd:e0:ce:14:1c:6f:11:45:b0:d7:ef" )
 }
 import "pe"
 
@@ -232531,13 +231965,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_03E9Eb4Dff67D4F9A554A422D5Ed86F3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b76ab1af-01f9-5d03-8d5e-7314a7a2de43"
+		id = "09e92411-53cd-50db-b0b7-2f9600c58d92"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4270-L4281"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a56f53cb94f78496b4935fc2a613d030bd550b749427501dd9dda18cb9e05ab3"
+		logic_hash = "v1_sha256_a56f53cb94f78496b4935fc2a613d030bd550b749427501dd9dda18cb9e05ab3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232545,7 +231979,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_03E9Eb4Dff67D4F9A554A422D5Ed86F3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "philandro Software GmbH" and pe.signatures[i].serial=="03:e9:eb:4d:ff:67:d4:f9:a5:54:a4:22:d5:ed:86:f3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "philandro Software GmbH" and pe.signatures [ i ] . serial == "03:e9:eb:4d:ff:67:d4:f9:a5:54:a4:22:d5:ed:86:f3" )
 }
 import "pe"
 
@@ -232554,13 +231988,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4A7F07C5D4Ad2E23F9E8E03F0E229Dd4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4e39ae25-c62c-5018-9780-d1549b10942f"
+		id = "d11f3284-0dcd-5628-b6e3-32e80e6268c3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4283-L4294"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2493dfe7e5a993a573c7b3c2f2642a8834feb525b3fc8402315a63ac09b9fccd"
+		logic_hash = "v1_sha256_2493dfe7e5a993a573c7b3c2f2642a8834feb525b3fc8402315a63ac09b9fccd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232568,7 +232002,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4A7F07C5D4Ad2E23F9E8E03F0E229Dd4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Danalis LLC" and pe.signatures[i].serial=="4a:7f:07:c5:d4:ad:2e:23:f9:e8:e0:3f:0e:22:9d:d4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Danalis LLC" and pe.signatures [ i ] . serial == "4a:7f:07:c5:d4:ad:2e:23:f9:e8:e0:3f:0e:22:9d:d4" )
 }
 import "pe"
 
@@ -232577,13 +232011,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C6D7Ad852Af211Bf48F19Cc0242Dcd72 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1aca90d4-6cb6-5bcd-a4c9-e8f8cddc0d04"
+		id = "0acfe608-d35f-5b20-a19a-f04ed3f7f033"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4296-L4307"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e10de48bfa1edec81157eb95ef3478346c22dd6f7ef163e30887d3c7bb580c5e"
+		logic_hash = "v1_sha256_e10de48bfa1edec81157eb95ef3478346c22dd6f7ef163e30887d3c7bb580c5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232591,7 +232025,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C6D7Ad852Af211Bf48F19Cc0242Dcd72 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APDZQKILIIQVIJSCTY" and pe.signatures[i].serial=="c6:d7:ad:85:2a:f2:11:bf:48:f1:9c:c0:24:2d:cd:72")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APDZQKILIIQVIJSCTY" and pe.signatures [ i ] . serial == "c6:d7:ad:85:2a:f2:11:bf:48:f1:9c:c0:24:2d:cd:72" )
 }
 import "pe"
 
@@ -232600,13 +232034,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0084888D5A12228E8950683Ecdab62Fe7A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5036d604-55df-565a-b6db-c788da007ea8"
+		id = "57afe284-8b67-5122-892b-8b0e5e5a31a5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4309-L4320"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4deda791923cdacccf57d54651ca44bd8c04d053a11ccf5700354f9f37be17de"
+		logic_hash = "v1_sha256_4deda791923cdacccf57d54651ca44bd8c04d053a11ccf5700354f9f37be17de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232614,7 +232048,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0084888D5A12228E8950683Ecdab62Fe7A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ub30 Limited" and pe.signatures[i].serial=="00:84:88:8d:5a:12:22:8e:89:50:68:3e:cd:ab:62:fe:7a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ub30 Limited" and pe.signatures [ i ] . serial == "00:84:88:8d:5a:12:22:8e:89:50:68:3e:cd:ab:62:fe:7a" )
 }
 import "pe"
 
@@ -232623,13 +232057,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_709D547A2F09D39C4C2334983F2Cbf50 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e3b2ab8b-be90-5593-843f-59f2d626e604"
+		id = "8c45a1c9-52bf-5859-a90a-76980cea3e35"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4322-L4333"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f45a2047181f3f07a8fb9cc00aafc31ba7aa369fc5c0165557757306a0de0d44"
+		logic_hash = "v1_sha256_f45a2047181f3f07a8fb9cc00aafc31ba7aa369fc5c0165557757306a0de0d44"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232637,7 +232071,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_709D547A2F09D39C4C2334983F2Cbf50 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BMUZVYUGWSQWLAIISX" and pe.signatures[i].serial=="70:9d:54:7a:2f:09:d3:9c:4c:23:34:98:3f:2c:bf:50")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BMUZVYUGWSQWLAIISX" and pe.signatures [ i ] . serial == "70:9d:54:7a:2f:09:d3:9c:4c:23:34:98:3f:2c:bf:50" )
 }
 import "pe"
 
@@ -232646,13 +232080,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_98A04Ea05E8A949A4D880D0136794Df3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cda10dcf-bc46-56d9-a4b5-60a76249334c"
+		id = "ccd0843a-ddf0-5c9c-be23-4d85d7ddbb74"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4335-L4346"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "05c63386558b954da3cfec1fd514a7a567189d9ac33d818cbbabf3eaf72ed130"
+		logic_hash = "v1_sha256_05c63386558b954da3cfec1fd514a7a567189d9ac33d818cbbabf3eaf72ed130"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232660,7 +232094,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_98A04Ea05E8A949A4D880D0136794Df3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FRVFMPRLNIMAMSUIMT" and pe.signatures[i].serial=="98:a0:4e:a0:5e:8a:94:9a:4d:88:0d:01:36:79:4d:f3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FRVFMPRLNIMAMSUIMT" and pe.signatures [ i ] . serial == "98:a0:4e:a0:5e:8a:94:9a:4d:88:0d:01:36:79:4d:f3" )
 }
 import "pe"
 
@@ -232669,13 +232103,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2355895F1759E9E3648026F4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d716ed7f-8886-587d-a868-805da13bb925"
+		id = "1108f023-db22-5fbd-833d-da562e10f0e9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4348-L4360"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "429375af70872755ab2d517b125042795c9a20238405a4af5b0caecc46a3f563"
+		logic_hash = "v1_sha256_429375af70872755ab2d517b125042795c9a20238405a4af5b0caecc46a3f563"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232684,7 +232118,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2355895F1759E9E3648026F4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Avira Operations GmbH & Co. KG" and pe.signatures[i].serial=="23:55:89:5f:17:59:e9:e3:64:80:26:f4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Avira Operations GmbH & Co. KG" and pe.signatures [ i ] . serial == "23:55:89:5f:17:59:e9:e3:64:80:26:f4" )
 }
 import "pe"
 
@@ -232693,13 +232127,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00818631110B5D14331Dac7E6Ad998B902 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "15efa9cf-5457-5b04-abee-8f86721c5d56"
+		id = "fdc846b6-2d65-54cd-8d08-cc1d91a57d6b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4376-L4390"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ee82090ceb1378b44c283586d0f0b6ec0d9779fab2497b0168acec8e5546a4a8"
+		logic_hash = "v1_sha256_ee82090ceb1378b44c283586d0f0b6ec0d9779fab2497b0168acec8e5546a4a8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232707,7 +232141,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00818631110B5D14331Dac7E6Ad998B902 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2 TOY GUYS LLC" and (pe.signatures[i].serial=="00:81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02" or pe.signatures[i].serial=="81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "2 TOY GUYS LLC" and ( pe.signatures [ i ] . serial == "00:81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02" or pe.signatures [ i ] . serial == "81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02" ) )
 }
 import "pe"
 
@@ -232716,13 +232150,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7Ab21306B11Ff280A93Fc445876988Ab : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "583fccef-3ad5-5f9a-a030-d6bf9ebed00f"
+		id = "3f7bf900-84c9-51bb-b8b6-fec7ae150e03"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4392-L4403"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "aa93d36d472d24cdd937c323ffa048fc71984fcf8a13400618ec8a0f2c172fc0"
+		logic_hash = "v1_sha256_aa93d36d472d24cdd937c323ffa048fc71984fcf8a13400618ec8a0f2c172fc0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232730,7 +232164,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7Ab21306B11Ff280A93Fc445876988Ab : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABC BIOS d.o.o." and pe.signatures[i].serial=="7a:b2:13:06:b1:1f:f2:80:a9:3f:c4:45:87:69:88:ab")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ABC BIOS d.o.o." and pe.signatures [ i ] . serial == "7a:b2:13:06:b1:1f:f2:80:a9:3f:c4:45:87:69:88:ab" )
 }
 import "pe"
 
@@ -232739,13 +232173,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0086909B91F07F9316984D888D1E28Ab76 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "58b191cc-82f2-5ad3-8d1e-91c7528880c6"
+		id = "8b0a3064-67c8-5ac2-a78d-170c5ff15c96"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4405-L4416"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "eb8807437edbbba52a928de4ebf0a25513127bd9800088e0d85e41c8375a05b1"
+		logic_hash = "v1_sha256_eb8807437edbbba52a928de4ebf0a25513127bd9800088e0d85e41c8375a05b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232753,7 +232187,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0086909B91F07F9316984D888D1E28Ab76 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dantherm Intelligent Monitoring A/S" and pe.signatures[i].serial=="00:86:90:9b:91:f0:7f:93:16:98:4d:88:8d:1e:28:ab:76")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dantherm Intelligent Monitoring A/S" and pe.signatures [ i ] . serial == "00:86:90:9b:91:f0:7f:93:16:98:4d:88:8d:1e:28:ab:76" )
 }
 import "pe"
 
@@ -232762,13 +232196,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D4Ef1Ab6Ab5D3Cb35E4Efb7984Def7A2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d96df78b-3824-5f94-8a32-87dfd9cd585f"
+		id = "b63af8b6-c362-5933-b122-58a766dd3234"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4418-L4429"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "845abc1f08a4d56b32477fbe8855f45633833c68f4255d0690f10cc23c167e84"
+		logic_hash = "v1_sha256_845abc1f08a4d56b32477fbe8855f45633833c68f4255d0690f10cc23c167e84"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232776,7 +232210,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D4Ef1Ab6Ab5D3Cb35E4Efb7984Def7A2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REIGN BROS ApS" and pe.signatures[i].serial=="00:d4:ef:1a:b6:ab:5d:3c:b3:5e:4e:fb:79:84:de:f7:a2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "REIGN BROS ApS" and pe.signatures [ i ] . serial == "00:d4:ef:1a:b6:ab:5d:3c:b3:5e:4e:fb:79:84:de:f7:a2" )
 }
 import "pe"
 
@@ -232785,13 +232219,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_13039Da3B2924B7A8B0A2Ac4637C2Efa : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9621584b-a115-5b96-8de5-15776232cdb2"
+		id = "38ad56f1-681e-565e-9af0-7ed9edc6712f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4431-L4442"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7492f2a50effae809b512ce7a2a769f3db62ab3573974206b729417cc629ca83"
+		logic_hash = "v1_sha256_7492f2a50effae809b512ce7a2a769f3db62ab3573974206b729417cc629ca83"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232799,7 +232233,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_13039Da3B2924B7A8B0A2Ac4637C2Efa : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Tekhnokom" and pe.signatures[i].serial=="13:03:9d:a3:b2:92:4b:7a:8b:0a:2a:c4:63:7c:2e:fa")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Tekhnokom" and pe.signatures [ i ] . serial == "13:03:9d:a3:b2:92:4b:7a:8b:0a:2a:c4:63:7c:2e:fa" )
 }
 import "pe"
 
@@ -232808,13 +232242,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Abd2Eef14D480Dfea9Ca9Fdd823Cf03 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5e17d055-26d7-5dde-a905-9d03fb164fa2"
+		id = "783a02d4-71e6-5cd0-838f-52067bb6518a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4444-L4455"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5f0f5dac599923f385fcd8e8b14349263cabe1c83242fe097d9fb26ea0567c1a"
+		logic_hash = "v1_sha256_5f0f5dac599923f385fcd8e8b14349263cabe1c83242fe097d9fb26ea0567c1a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232822,7 +232256,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Abd2Eef14D480Dfea9Ca9Fdd823Cf03 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BE SOL d.o.o." and pe.signatures[i].serial=="2a:bd:2e:ef:14:d4:80:df:ea:9c:a9:fd:d8:23:cf:03")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BE SOL d.o.o." and pe.signatures [ i ] . serial == "2a:bd:2e:ef:14:d4:80:df:ea:9c:a9:fd:d8:23:cf:03" )
 }
 import "pe"
 
@@ -232831,13 +232265,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_08622B9Dd9D78E67678Ecc21E026522E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "922282e9-9f34-537b-9fd1-283ae44b9b54"
+		id = "af9fa5ea-ad95-5998-81d6-2c90cfe46ec4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4457-L4468"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7e572c4241d92ad34efd91c3f6338da4093c83d84a734766448ac7cb2a72bc0c"
+		logic_hash = "v1_sha256_7e572c4241d92ad34efd91c3f6338da4093c83d84a734766448ac7cb2a72bc0c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232845,7 +232279,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_08622B9Dd9D78E67678Ecc21E026522E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kayak Republic af 2015 APS" and pe.signatures[i].serial=="08:62:2b:9d:d9:d7:8e:67:67:8e:cc:21:e0:26:52:2e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kayak Republic af 2015 APS" and pe.signatures [ i ] . serial == "08:62:2b:9d:d9:d7:8e:67:67:8e:cc:21:e0:26:52:2e" )
 }
 import "pe"
 
@@ -232854,13 +232288,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5A17D5De74Fd8F09Df596Df3123139Bb : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "871d9840-4540-58d3-980e-d356c856dbca"
+		id = "841e42be-5168-5b8a-b719-ddb0b12e7e4a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4470-L4481"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f5ff9f7d857da3329708ba9c0bfac0999b04aeb170fb60387f4b48fa6029a641"
+		logic_hash = "v1_sha256_f5ff9f7d857da3329708ba9c0bfac0999b04aeb170fb60387f4b48fa6029a641"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232868,7 +232302,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5A17D5De74Fd8F09Df596Df3123139Bb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTA FIS d.o.o." and pe.signatures[i].serial=="5a:17:d5:de:74:fd:8f:09:df:59:6d:f3:12:31:39:bb")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ACTA FIS d.o.o." and pe.signatures [ i ] . serial == "5a:17:d5:de:74:fd:8f:09:df:59:6d:f3:12:31:39:bb" )
 }
 import "pe"
 
@@ -232877,13 +232311,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_15Da61D7E1A631803431561674Fb9B90 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d1fd8200-0960-567d-9bb6-2bd1ed99f61b"
+		id = "8d8dc2a8-291f-5ac3-a346-382144817f02"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4483-L4494"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4d30a4bf1b0425081369351df707be0531dcc1751512d9012a859b621d61a1b3"
+		logic_hash = "v1_sha256_4d30a4bf1b0425081369351df707be0531dcc1751512d9012a859b621d61a1b3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232891,7 +232325,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_15Da61D7E1A631803431561674Fb9B90 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JAY DANCE STUDIO d.o.o." and pe.signatures[i].serial=="15:da:61:d7:e1:a6:31:80:34:31:56:16:74:fb:9b:90")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JAY DANCE STUDIO d.o.o." and pe.signatures [ i ] . serial == "15:da:61:d7:e1:a6:31:80:34:31:56:16:74:fb:9b:90" )
 }
 import "pe"
 
@@ -232900,13 +232334,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_58Aa64564A50E8B2D6E31D5Cd6250Fde : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b6eff323-241a-5f11-837f-bfacdc547d89"
+		id = "dbaec48e-20a4-5691-b823-fbe1461796bc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4496-L4507"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7383dfc8b22379dc69cd1d93d2da40e177ba1e3b0b8b8891afb8ce594269d170"
+		logic_hash = "v1_sha256_7383dfc8b22379dc69cd1d93d2da40e177ba1e3b0b8b8891afb8ce594269d170"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232914,7 +232348,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_58Aa64564A50E8B2D6E31D5Cd6250Fde : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foreground" and pe.signatures[i].serial=="58:aa:64:56:4a:50:e8:b2:d6:e3:1d:5c:d6:25:0f:de")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Foreground" and pe.signatures [ i ] . serial == "58:aa:64:56:4a:50:e8:b2:d6:e3:1d:5c:d6:25:0f:de" )
 }
 import "pe"
 
@@ -232923,13 +232357,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Bbd4Dc3768A51Aa2B3059C1Bad569276 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cb5214b4-1af5-5b31-b690-6531139e92b1"
+		id = "b2bf7f7d-9d69-5420-a881-f06c377e01c1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4509-L4520"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d506c2d6e630fabe1d4b805cd31aa54b04959db80630f656b3460c869ad544fa"
+		logic_hash = "v1_sha256_d506c2d6e630fabe1d4b805cd31aa54b04959db80630f656b3460c869ad544fa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232937,7 +232371,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Bbd4Dc3768A51Aa2B3059C1Bad569276 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JJ ELECTRICAL SERVICES LIMITED" and pe.signatures[i].serial=="00:bb:d4:dc:37:68:a5:1a:a2:b3:05:9c:1b:ad:56:92:76")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JJ ELECTRICAL SERVICES LIMITED" and pe.signatures [ i ] . serial == "00:bb:d4:dc:37:68:a5:1a:a2:b3:05:9c:1b:ad:56:92:76" )
 }
 import "pe"
 
@@ -232946,13 +232380,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3A236F003Bdefc0C55Aa42D9C6C0B08E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "02c95d8f-f694-5d0f-bf79-b806334e8af3"
+		id = "a761bef8-54be-5491-a1c5-24ef8ac91afb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4522-L4533"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9930b2d3fdbd2f6da17d78dfbfe6229f0bd004686e4cc4960720710241237e48"
+		logic_hash = "v1_sha256_9930b2d3fdbd2f6da17d78dfbfe6229f0bd004686e4cc4960720710241237e48"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232960,7 +232394,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3A236F003Bdefc0C55Aa42D9C6C0B08E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Assurio" and pe.signatures[i].serial=="3a:23:6f:00:3b:de:fc:0c:55:aa:42:d9:c6:c0:b0:8e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Assurio" and pe.signatures [ i ] . serial == "3a:23:6f:00:3b:de:fc:0c:55:aa:42:d9:c6:c0:b0:8e" )
 }
 import "pe"
 
@@ -232969,14 +232403,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_010000000001302693Cb45 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0ab8e30d-dd75-5dd1-9bc8-413e59d5d310"
+		id = "236b3542-6eb9-530a-8312-e071c5d7977d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4535-L4547"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "74069d20e8b8299590420c9af2fdc8856c14d94929c285948585fc89ab2f938f"
-		logic_hash = "74c5d88012ab3e975123cde51ae3d01b6bee1ad0d6c0f5492c507fb2472b7532"
+		logic_hash = "v1_sha256_74c5d88012ab3e975123cde51ae3d01b6bee1ad0d6c0f5492c507fb2472b7532"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -232984,7 +232418,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_010000000001302693Cb45 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AutoIt Consulting Ltd" and pe.signatures[i].serial=="01:00:00:00:00:01:30:26:93:cb:45")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AutoIt Consulting Ltd" and pe.signatures [ i ] . serial == "01:00:00:00:00:01:30:26:93:cb:45" )
 }
 import "pe"
 
@@ -232993,13 +232427,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3F8D23C136Ae9Cbeeac7605B24Ec0391 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "86617b78-86b0-59dc-a072-cb4acecd60e1"
+		id = "59b63b4d-cc43-591b-ab94-e4e31eac3243"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4565-L4576"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f074e141e07cbf6b5b4726b52faa382b8ece809804dcfb9d45a5b2450125b5b7"
+		logic_hash = "v1_sha256_f074e141e07cbf6b5b4726b52faa382b8ece809804dcfb9d45a5b2450125b5b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233007,7 +232441,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3F8D23C136Ae9Cbeeac7605B24Ec0391 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bandicam Company" and pe.signatures[i].serial=="3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bandicam Company" and pe.signatures [ i ] . serial == "3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91" )
 }
 import "pe"
 
@@ -233016,13 +232450,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3972443Af922B751D7D36C10Dd313595 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "21ada866-167a-54d5-a137-7720de32520e"
+		id = "428a658e-23e2-5af6-9cb5-f3705d0870cd"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4578-L4589"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "764d0a288edd3bac90c0b93319f4f8ff8a7d567cda42aa52fe6114f4e56216ad"
+		logic_hash = "v1_sha256_764d0a288edd3bac90c0b93319f4f8ff8a7d567cda42aa52fe6114f4e56216ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233030,7 +232464,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3972443Af922B751D7D36C10Dd313595 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sore Loser Games ApS" and pe.signatures[i].serial=="39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sore Loser Games ApS" and pe.signatures [ i ] . serial == "39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95" )
 }
 import "pe"
 
@@ -233039,13 +232473,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_37F3384B16D4Eef0A9B3344B50F1D8A3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a7eef803-2c9e-5f23-acde-22ae2223fec2"
+		id = "737e87b3-e0a3-5a10-b1fe-540cb14a29e9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4591-L4602"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4496052ff9677e0d031471e4ae9b3541099a2dbe024b4b5ba3f757800bfdcb07"
+		logic_hash = "v1_sha256_4496052ff9677e0d031471e4ae9b3541099a2dbe024b4b5ba3f757800bfdcb07"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233053,7 +232487,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_37F3384B16D4Eef0A9B3344B50F1D8A3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sore Loser Games ApS" and pe.signatures[i].serial=="37:f3:38:4b:16:d4:ee:f0:a9:b3:34:4b:50:f1:d8:a3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sore Loser Games ApS" and pe.signatures [ i ] . serial == "37:f3:38:4b:16:d4:ee:f0:a9:b3:34:4b:50:f1:d8:a3" )
 }
 import "pe"
 
@@ -233062,13 +232496,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B3969Cd6B2F913Acc99C3F61Fc14852F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2cd4cee3-0adc-595f-b86f-7c515cd0ea64"
+		id = "13d7ce98-b004-5255-854a-68b9247e973a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4604-L4619"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4ee7f3da2ae707517c1c426e6a73fdede51514e4ddf60b93fd77c1b6c23e82c0"
+		logic_hash = "v1_sha256_4ee7f3da2ae707517c1c426e6a73fdede51514e4ddf60b93fd77c1b6c23e82c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233077,7 +232511,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B3969Cd6B2F913Acc99C3F61Fc14852F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "S.O.M GmbH" and (pe.signatures[i].serial=="b3:96:9c:d6:b2:f9:13:ac:c9:9c:3f:61:fc:14:85:2f" or pe.signatures[i].serial=="00:b3:96:9c:d6:b2:f9:13:ac:c9:9c:3f:61:fc:14:85:2f"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "S.O.M GmbH" and ( pe.signatures [ i ] . serial == "b3:96:9c:d6:b2:f9:13:ac:c9:9c:3f:61:fc:14:85:2f" or pe.signatures [ i ] . serial == "00:b3:96:9c:d6:b2:f9:13:ac:c9:9c:3f:61:fc:14:85:2f" ) )
 }
 import "pe"
 
@@ -233086,13 +232520,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0D83E7F47189Cdbfc7Fa3E5F58882329 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6574aab4-f307-53c2-8cf7-bcc7565facc8"
+		id = "de07441d-d70e-59e0-8f39-46e38686af22"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4621-L4632"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c4dffcad286e161980ccec2188459b8b7eaf0e982c7c69ca5ffbaf8e4d85d1b4"
+		logic_hash = "v1_sha256_c4dffcad286e161980ccec2188459b8b7eaf0e982c7c69ca5ffbaf8e4d85d1b4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233100,7 +232534,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0D83E7F47189Cdbfc7Fa3E5F58882329 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures[i].serial=="0d:83:e7:f4:71:89:cd:bf:c7:fa:3e:5f:58:88:23:29")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures [ i ] . serial == "0d:83:e7:f4:71:89:cd:bf:c7:fa:3e:5f:58:88:23:29" )
 }
 import "pe"
 
@@ -233109,13 +232543,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008385684419Ab26A3F2640B1496E1Fe94 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5aa92ac6-241f-54a1-b828-f8a5deb6d212"
+		id = "d716263b-41d5-57b2-b825-82cf4b67be05"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4634-L4645"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7c9de438d5c7156052e30ce70310aaa989ff1896f7b34ffc6c4fd8fc2bc60b85"
+		logic_hash = "v1_sha256_7c9de438d5c7156052e30ce70310aaa989ff1896f7b34ffc6c4fd8fc2bc60b85"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233123,7 +232557,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008385684419Ab26A3F2640B1496E1Fe94 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CAUSE FOR CHANGE LTD" and pe.signatures[i].serial=="00:83:85:68:44:19:ab:26:a3:f2:64:0b:14:96:e1:fe:94")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CAUSE FOR CHANGE LTD" and pe.signatures [ i ] . serial == "00:83:85:68:44:19:ab:26:a3:f2:64:0b:14:96:e1:fe:94" )
 }
 import "pe"
 
@@ -233132,13 +232566,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Aec3D3F752A38617C1D7A677D0B5591 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8e1bb307-733c-5626-98f6-a5c2587bf800"
+		id = "3583df49-73af-5ead-b8ce-6fe38450b4cc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4647-L4658"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4bbe5aac8a470061abab48070fafd2100c577cab1f40fcc5924dbd13bc747487"
+		logic_hash = "v1_sha256_4bbe5aac8a470061abab48070fafd2100c577cab1f40fcc5924dbd13bc747487"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233146,7 +232580,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Aec3D3F752A38617C1D7A677D0B5591 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SILVER d.o.o." and pe.signatures[i].serial=="1a:ec:3d:3f:75:2a:38:61:7c:1d:7a:67:7d:0b:55:91")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SILVER d.o.o." and pe.signatures [ i ] . serial == "1a:ec:3d:3f:75:2a:38:61:7c:1d:7a:67:7d:0b:55:91" )
 }
 import "pe"
 
@@ -233155,13 +232589,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E5B2Af04Ea4B84A94609A47Eba3164Ec : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ea78ae13-cd9f-578a-95e4-906ab7045faf"
+		id = "22c6203f-01be-5949-a62c-78dcda890156"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4660-L4671"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2e32bb0d9689625cd860a75539961410241de341ad4b7ee661df7d3b2dd47c46"
+		logic_hash = "v1_sha256_2e32bb0d9689625cd860a75539961410241de341ad4b7ee661df7d3b2dd47c46"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233169,7 +232603,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E5B2Af04Ea4B84A94609A47Eba3164Ec : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RRGRQJRWZHRTLFAUVK" and pe.signatures[i].serial=="e5:b2:af:04:ea:4b:84:a9:46:09:a4:7e:ba:31:64:ec")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RRGRQJRWZHRTLFAUVK" and pe.signatures [ i ] . serial == "e5:b2:af:04:ea:4b:84:a9:46:09:a4:7e:ba:31:64:ec" )
 }
 import "pe"
 
@@ -233178,13 +232612,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dummy01 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "eaf3bbdd-72b4-513c-9a5b-04f16292fa00"
+		id = "3bbaf54f-82c2-513d-953a-979afd41922b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4673-L4687"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c72ac977ef92feead0a7ec72ec99b1a11f20b8c5258a08842a4dceddff91d659"
+		logic_hash = "v1_sha256_c72ac977ef92feead0a7ec72ec99b1a11f20b8c5258a08842a4dceddff91d659"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233195,7 +232629,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dummy01 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dummy certificate" and pe.signatures[i].serial=="01")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Dummy certificate" and pe.signatures [ i ] . serial == "01" )
 }
 import "pe"
 
@@ -233204,13 +232638,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A7E1Dc5352C3852C5523030F57F2425C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fba8f1a8-ca08-5d6f-a83e-c817daf94703"
+		id = "dfdadbe5-3891-57e6-bd1a-24a000ec08a0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4689-L4700"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "06c151ae8b4a45eccef028ea69f0adf74445bd4d871fc65cc1d308f2005cede1"
+		logic_hash = "v1_sha256_06c151ae8b4a45eccef028ea69f0adf74445bd4d871fc65cc1d308f2005cede1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233218,7 +232652,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A7E1Dc5352C3852C5523030F57F2425C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pushka LLC" and pe.signatures[i].serial=="00:a7:e1:dc:53:52:c3:85:2c:55:23:03:0f:57:f2:42:5c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Pushka LLC" and pe.signatures [ i ] . serial == "00:a7:e1:dc:53:52:c3:85:2c:55:23:03:0f:57:f2:42:5c" )
 }
 import "pe"
 
@@ -233227,13 +232661,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_635517466B67Bd4Bba805Bc67Ac3328C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b7533186-b5dc-53ce-912b-39bd42c92071"
+		id = "ed1c0644-f9e0-569c-a214-e1da37f03520"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4702-L4713"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "71cdb314e2f6bda70f9f627d72aea49290fdbce66f76a170aa6571873ca82860"
+		logic_hash = "v1_sha256_71cdb314e2f6bda70f9f627d72aea49290fdbce66f76a170aa6571873ca82860"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233241,7 +232675,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_635517466B67Bd4Bba805Bc67Ac3328C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MEDIATEK INC." and pe.signatures[i].serial=="63:55:17:46:6b:67:bd:4b:ba:80:5b:c6:7a:c3:32:8c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MEDIATEK INC." and pe.signatures [ i ] . serial == "63:55:17:46:6b:67:bd:4b:ba:80:5b:c6:7a:c3:32:8c" )
 }
 import "pe"
 
@@ -233250,13 +232684,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A2253Aeb5B0Ff1Aecbfd412C18Ccf07A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "82d70dae-97e7-5fa3-8a91-de6143fa2164"
+		id = "8b2e4423-937e-58aa-a99f-ff6c11dae315"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4729-L4740"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "357de1cbdf3223dfb1a920bfb15bbbd66906de5225c0ed015e5a3fbbbb65a753"
+		logic_hash = "v1_sha256_357de1cbdf3223dfb1a920bfb15bbbd66906de5225c0ed015e5a3fbbbb65a753"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233264,7 +232698,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A2253Aeb5B0Ff1Aecbfd412C18Ccf07A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gallopers Software Solutions Limited" and pe.signatures[i].serial=="a2:25:3a:eb:5b:0f:f1:ae:cb:fd:41:2c:18:cc:f0:7a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Gallopers Software Solutions Limited" and pe.signatures [ i ] . serial == "a2:25:3a:eb:5b:0f:f1:ae:cb:fd:41:2c:18:cc:f0:7a" )
 }
 import "pe"
 
@@ -233273,13 +232707,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_21E3Cae5B77C41528658Ada08509C392 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bd97478f-1b75-542d-814c-8d318d745240"
+		id = "cefc516d-33f3-5c02-9012-c094b03dabe3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4742-L4753"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c860e888b19b98c40cf00babfb022a79a35f12def0077733e796b2aeeea324ea"
+		logic_hash = "v1_sha256_c860e888b19b98c40cf00babfb022a79a35f12def0077733e796b2aeeea324ea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233287,7 +232721,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_21E3Cae5B77C41528658Ada08509C392 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Network Design International Holdings Limited" and pe.signatures[i].serial=="21:e3:ca:e5:b7:7c:41:52:86:58:ad:a0:85:09:c3:92")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Network Design International Holdings Limited" and pe.signatures [ i ] . serial == "21:e3:ca:e5:b7:7c:41:52:86:58:ad:a0:85:09:c3:92" )
 }
 import "pe"
 
@@ -233296,13 +232730,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_09B3A7E559Fcb024C4B66B794E9540Cb : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5e1057d4-a40c-5e48-8965-91fd533c04dc"
+		id = "95bb1c0e-2572-5f72-8602-f113b3efcf59"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4790-L4802"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "345abbb31986fe3f8f6b7eb05c73d4d42daa9df6a7706b9cd2fb4f8aac61d40b"
+		logic_hash = "v1_sha256_345abbb31986fe3f8f6b7eb05c73d4d42daa9df6a7706b9cd2fb4f8aac61d40b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233311,7 +232745,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_09B3A7E559Fcb024C4B66B794E9540Cb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Windscribe Limited" and pe.signatures[i].serial=="09:b3:a7:e5:59:fc:b0:24:c4:b6:6b:79:4e:95:40:cb")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Windscribe Limited" and pe.signatures [ i ] . serial == "09:b3:a7:e5:59:fc:b0:24:c4:b6:6b:79:4e:95:40:cb" )
 }
 import "pe"
 
@@ -233320,13 +232754,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_19Beff8A6C129663E5E8C18953Dc1F67 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8bc27a0c-898d-510f-ad9d-78d5bab40cad"
+		id = "f6df7365-a97b-59ea-ba21-61065b312d56"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4804-L4815"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e62c4ab0652f872887b7bedadba3306c831351f57bc4a177302b1268d823f9f4"
+		logic_hash = "v1_sha256_e62c4ab0652f872887b7bedadba3306c831351f57bc4a177302b1268d823f9f4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233334,7 +232768,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_19Beff8A6C129663E5E8C18953Dc1F67 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CULNADY LTD LTD" and pe.signatures[i].serial=="19:be:ff:8a:6c:12:96:63:e5:e8:c1:89:53:dc:1f:67")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CULNADY LTD LTD" and pe.signatures [ i ] . serial == "19:be:ff:8a:6c:12:96:63:e5:e8:c1:89:53:dc:1f:67" )
 }
 import "pe"
 
@@ -233343,13 +232777,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Cf2D0B5Bfdd68Cf777A0C12F806A569 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "610f4147-9b32-5d96-bf27-10a8e0c3c347"
+		id = "68355a05-f255-5425-bc91-b50e487ffe52"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4817-L4828"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d3e625c05e974650bb9750f6dadbbba5825a34ea10902c807b9da457902d2b59"
+		logic_hash = "v1_sha256_d3e625c05e974650bb9750f6dadbbba5825a34ea10902c807b9da457902d2b59"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233357,7 +232791,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Cf2D0B5Bfdd68Cf777A0C12F806A569 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROTIP d.o.o." and pe.signatures[i].serial=="0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PROTIP d.o.o." and pe.signatures [ i ] . serial == "0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69" )
 }
 import "pe"
 
@@ -233366,13 +232800,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56F008E69A7C4C3Feb389C66Eaf58259 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bcd0cd8e-82ec-5d20-85d1-cbad455b6d90"
+		id = "c5c77878-7ef0-5dd3-96fe-37fd1d16f8cc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4830-L4841"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3ba02eb734b461b02744c5fc901e45f4574249607398fb8a73850d5d5e89788b"
+		logic_hash = "v1_sha256_3ba02eb734b461b02744c5fc901e45f4574249607398fb8a73850d5d5e89788b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233380,7 +232814,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56F008E69A7C4C3Feb389C66Eaf58259 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MEDIATEK INC." and pe.signatures[i].serial=="56:f0:08:e6:9a:7c:4c:3f:eb:38:9c:66:ea:f5:82:59")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MEDIATEK INC." and pe.signatures [ i ] . serial == "56:f0:08:e6:9a:7c:4c:3f:eb:38:9c:66:ea:f5:82:59" )
 }
 import "pe"
 
@@ -233389,13 +232823,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_279B3A26F16A069Aa7Bca1811D44Ad9B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3ead1500-d510-5a9b-8a19-19f9f7f2cf95"
+		id = "fbc94c0b-5235-563c-9b7e-87dc586c14dc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4857-L4873"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5a01fd3db421a4b41318fa1264e8bc621ddeddb44b82b8f0b15e97eccec616e8"
+		logic_hash = "v1_sha256_5a01fd3db421a4b41318fa1264e8bc621ddeddb44b82b8f0b15e97eccec616e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233408,7 +232842,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_279B3A26F16A069Aa7Bca1811D44Ad9B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIGITAL DEVLIN LIMITED" and pe.signatures[i].serial=="27:9b:3a:26:f1:6a:06:9a:a7:bc:a1:81:1d:44:ad:9b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DIGITAL DEVLIN LIMITED" and pe.signatures [ i ] . serial == "27:9b:3a:26:f1:6a:06:9a:a7:bc:a1:81:1d:44:ad:9b" )
 }
 import "pe"
 
@@ -233417,13 +232851,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_07Cef66A71C35Bc3Aed6D100C6493863 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e07b0a2c-64ff-5e12-9f19-00a67a13fb89"
+		id = "770fa57d-65e3-5533-80bd-3c659ff7db11"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4875-L4886"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "24b89e65bc9d60a60e57f749735214c462e56c3194906e4bca52d74463617be4"
+		logic_hash = "v1_sha256_24b89e65bc9d60a60e57f749735214c462e56c3194906e4bca52d74463617be4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233431,7 +232865,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_07Cef66A71C35Bc3Aed6D100C6493863 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fubon Technologies Ltd" and pe.signatures[i].serial=="07:ce:f6:6a:71:c3:5b:c3:ae:d6:d1:00:c6:49:38:63")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fubon Technologies Ltd" and pe.signatures [ i ] . serial == "07:ce:f6:6a:71:c3:5b:c3:ae:d6:d1:00:c6:49:38:63" )
 }
 import "pe"
 
@@ -233440,13 +232874,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D3356318924C8C42959Bf1D1574E6482 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7e23e9cf-5a34-55bb-a88d-4c0aef411372"
+		id = "ed69bb3d-af1e-5486-9fbe-95e76852d136"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4888-L4899"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "86ca8da7e9e704f64be8ecd9e270108337d28b540ba8cd669a8d536ccfefea95"
+		logic_hash = "v1_sha256_86ca8da7e9e704f64be8ecd9e270108337d28b540ba8cd669a8d536ccfefea95"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233454,7 +232888,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D3356318924C8C42959Bf1D1574E6482 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADV TOURS d.o.o." and pe.signatures[i].serial=="00:d3:35:63:18:92:4c:8c:42:95:9b:f1:d1:57:4e:64:82")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ADV TOURS d.o.o." and pe.signatures [ i ] . serial == "00:d3:35:63:18:92:4c:8c:42:95:9b:f1:d1:57:4e:64:82" )
 }
 import "pe"
 
@@ -233463,13 +232897,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_038Fc745523B41B40D653B83Aa381B80 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ed7581eb-52e7-5216-86a2-079bc5741b05"
+		id = "7c36fca2-c45e-5f64-8f4a-b25840a3c241"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4901-L4912"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b760525c38610b8a5cc990335122eab81cb895dc523908ef841c5c3117a1a372"
+		logic_hash = "v1_sha256_b760525c38610b8a5cc990335122eab81cb895dc523908ef841c5c3117a1a372"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233477,7 +232911,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_038Fc745523B41B40D653B83Aa381B80 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Optima" and pe.signatures[i].serial=="03:8f:c7:45:52:3b:41:b4:0d:65:3b:83:aa:38:1b:80")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Optima" and pe.signatures [ i ] . serial == "03:8f:c7:45:52:3b:41:b4:0d:65:3b:83:aa:38:1b:80" )
 }
 import "pe"
 
@@ -233486,13 +232920,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ac0A7B9420B369Af3Ddb748385B981 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0935fd31-3d8f-57d2-a00e-ad7d5cdbe12d"
+		id = "50fb30cc-52d6-5da3-b4c7-e4ecde36ee88"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4914-L4925"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "47dca0d0b84dd0d210cf7fdda3bcce796d090e5de3f4266bbed01eebdd397bfa"
+		logic_hash = "v1_sha256_47dca0d0b84dd0d210cf7fdda3bcce796d090e5de3f4266bbed01eebdd397bfa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233500,7 +232934,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ac0A7B9420B369Af3Ddb748385B981 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Tochka" and pe.signatures[i].serial=="00:ac:0a:7b:94:20:b3:69:af:3d:db:74:83:85:b9:81")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Tochka" and pe.signatures [ i ] . serial == "00:ac:0a:7b:94:20:b3:69:af:3d:db:74:83:85:b9:81" )
 }
 import "pe"
 
@@ -233509,13 +232943,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00913Ba16962Cd7Eee25965A6D0Eeffa10 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7a053089-44c8-5f30-8eee-dcd4ba24efe8"
+		id = "729cd386-846c-585a-a39f-6e317152ee2b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4927-L4938"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a2e729c053d1a9d5895dc2247ea0804525f8f1744875d5c2f96b4255ad325dc5"
+		logic_hash = "v1_sha256_a2e729c053d1a9d5895dc2247ea0804525f8f1744875d5c2f96b4255ad325dc5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233523,7 +232957,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00913Ba16962Cd7Eee25965A6D0Eeffa10 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JMT TRADING GROUP INC" and pe.signatures[i].serial=="00:91:3b:a1:69:62:cd:7e:ee:25:96:5a:6d:0e:ef:fa:10")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JMT TRADING GROUP INC" and pe.signatures [ i ] . serial == "00:91:3b:a1:69:62:cd:7e:ee:25:96:5a:6d:0e:ef:fa:10" )
 }
 import "pe"
 
@@ -233532,13 +232966,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F44A91704F9Ea388446D2635F2A8C8A5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "52f08ec1-fb83-59bc-bb90-2ae12245c0f7"
+		id = "b3db00fc-01bb-5960-8137-5e3a28b3bfce"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4940-L4953"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cec66648ecde5b11a2a20674b2e1f10c8b917ebeb26ddba0ead2b6af45c8519b"
+		logic_hash = "v1_sha256_cec66648ecde5b11a2a20674b2e1f10c8b917ebeb26ddba0ead2b6af45c8519b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233548,7 +232982,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F44A91704F9Ea388446D2635F2A8C8A5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Binance" and pe.signatures[i].serial=="f4:4a:91:70:4f:9e:a3:88:44:6d:26:35:f2:a8:c8:a5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Binance" and pe.signatures [ i ] . serial == "f4:4a:91:70:4f:9e:a3:88:44:6d:26:35:f2:a8:c8:a5" )
 }
 import "pe"
 
@@ -233557,13 +232991,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_029685Cda1C8233D2409A31206F78F9F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2c1d858b-3adc-5c05-bc72-2a6f12f7245e"
+		id = "6b86b849-f47d-5e26-b3d4-096182b52925"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4955-L4966"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a7eec901d92d6126cbc4468d7f2fbccc905f550c7dc8d28b405f583cfde9aea3"
+		logic_hash = "v1_sha256_a7eec901d92d6126cbc4468d7f2fbccc905f550c7dc8d28b405f583cfde9aea3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233571,7 +233005,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_029685Cda1C8233D2409A31206F78F9F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KOTO TRADE" and pe.signatures[i].serial=="02:96:85:cd:a1:c8:23:3d:24:09:a3:12:06:f7:8f:9f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KOTO TRADE" and pe.signatures [ i ] . serial == "02:96:85:cd:a1:c8:23:3d:24:09:a3:12:06:f7:8f:9f" )
 }
 import "pe"
 
@@ -233580,13 +233014,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Aebe117A13B8Bca21685Df48C74F584D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2b9c40e8-9c0e-523d-b746-4e31d0a780e0"
+		id = "12f81e29-f950-512b-89b3-69d7feaca1b6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4968-L4979"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cb17c6f311d88125ad0c790c61fe0dd1ffbdefdbea45ffb54c47da5d98f99900"
+		logic_hash = "v1_sha256_cb17c6f311d88125ad0c790c61fe0dd1ffbdefdbea45ffb54c47da5d98f99900"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233594,7 +233028,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Aebe117A13B8Bca21685Df48C74F584D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NANAX d.o.o." and pe.signatures[i].serial=="00:ae:be:11:7a:13:b8:bc:a2:16:85:df:48:c7:4f:58:4d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NANAX d.o.o." and pe.signatures [ i ] . serial == "00:ae:be:11:7a:13:b8:bc:a2:16:85:df:48:c7:4f:58:4d" )
 }
 import "pe"
 
@@ -233603,13 +233037,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_38989Ec61Ecdb7391Ff5647F7D58Ad18 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "40c742ec-f683-57fe-bb35-7c44617f9199"
+		id = "f73e986b-5a25-574d-a2e1-807c15c8e060"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4981-L4992"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f2108c41c814a815047268d9934a01231936a1cf73cbb92476eb96c9fe4b1091"
+		logic_hash = "v1_sha256_f2108c41c814a815047268d9934a01231936a1cf73cbb92476eb96c9fe4b1091"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233617,7 +233051,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_38989Ec61Ecdb7391Ff5647F7D58Ad18 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RotA Games ApS" and pe.signatures[i].serial=="38:98:9e:c6:1e:cd:b7:39:1f:f5:64:7f:7d:58:ad:18")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RotA Games ApS" and pe.signatures [ i ] . serial == "38:98:9e:c6:1e:cd:b7:39:1f:f5:64:7f:7d:58:ad:18" )
 }
 import "pe"
 
@@ -233626,13 +233060,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D08D83Ff118Df3777E371C5C482Cce7B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d4857ec5-2c99-51f8-a5b8-938c8d83169e"
+		id = "1127dca7-06f1-5665-a2c4-1472fbbfb563"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L4994-L5005"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b6c7f5c57c79d11132535bedce77276f67c4f854f5e8ef2c12aced64f8a188d0"
+		logic_hash = "v1_sha256_b6c7f5c57c79d11132535bedce77276f67c4f854f5e8ef2c12aced64f8a188d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233640,7 +233074,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D08D83Ff118Df3777E371C5C482Cce7B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMO-K Limited Liability Company" and pe.signatures[i].serial=="00:d0:8d:83:ff:11:8d:f3:77:7e:37:1c:5c:48:2c:ce:7b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMO-K Limited Liability Company" and pe.signatures [ i ] . serial == "00:d0:8d:83:ff:11:8d:f3:77:7e:37:1c:5c:48:2c:ce:7b" )
 }
 import "pe"
 
@@ -233649,13 +233083,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_249E3F1B7595E7D0Fe6Df13303287343 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3f780428-a482-5201-a7ca-d3608779a5e4"
+		id = "d0389d45-919d-5131-afdb-4a958b795c72"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5007-L5018"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4df122a53f2c1a08d1694c8e64b802f58507bb985f1aed8c91e6d7ad24906fca"
+		logic_hash = "v1_sha256_4df122a53f2c1a08d1694c8e64b802f58507bb985f1aed8c91e6d7ad24906fca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233663,7 +233097,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_249E3F1B7595E7D0Fe6Df13303287343 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "gsLPuSUgRZueWihiZHqYBriNSQqS" and pe.signatures[i].serial=="24:9e:3f:1b:75:95:e7:d0:fe:6d:f1:33:03:28:73:43")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "gsLPuSUgRZueWihiZHqYBriNSQqS" and pe.signatures [ i ] . serial == "24:9e:3f:1b:75:95:e7:d0:fe:6d:f1:33:03:28:73:43" )
 }
 import "pe"
 
@@ -233672,13 +233106,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_31D852F5Fca1A5966B5Ed08A14825C54 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8d65caa2-ce28-5f9b-b8a5-3fe903dd5628"
+		id = "fb459784-680a-5c46-81e8-9e7bde6f10c6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5020-L5031"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e2890f8c623ce15d8a3f996e87be4b73a8cd9f96386ce8d356d7e0fad0342dd3"
+		logic_hash = "v1_sha256_e2890f8c623ce15d8a3f996e87be4b73a8cd9f96386ce8d356d7e0fad0342dd3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233686,7 +233120,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_31D852F5Fca1A5966B5Ed08A14825C54 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BBT KLA d.o.o." and pe.signatures[i].serial=="31:d8:52:f5:fc:a1:a5:96:6b:5e:d0:8a:14:82:5c:54")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BBT KLA d.o.o." and pe.signatures [ i ] . serial == "31:d8:52:f5:fc:a1:a5:96:6b:5e:d0:8a:14:82:5c:54" )
 }
 import "pe"
 
@@ -233695,14 +233129,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_510C5E540503F30C9Caa3082296Aa452 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "eddbe6f1-fb7c-5129-afb4-6b4d67e39f60"
+		id = "ff8a4a55-3e11-56ac-b374-fdec6a19b291"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5033-L5045"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "cb01f31a322572035cf19f6cda00bcf1d8235dcc692588810405d0fc6e8d239c"
-		logic_hash = "9b6ad8b3e90fcd63f86b353e89ce7e6226197bfcb491e2151b8dbf580466076e"
+		logic_hash = "v1_sha256_9b6ad8b3e90fcd63f86b353e89ce7e6226197bfcb491e2151b8dbf580466076e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233710,7 +233144,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_510C5E540503F30C9Caa3082296Aa452 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Systems Analysis 360 Ltd" and pe.signatures[i].serial=="51:0c:5e:54:05:03:f3:0c:9c:aa:30:82:29:6a:a4:52")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Systems Analysis 360 Ltd" and pe.signatures [ i ] . serial == "51:0c:5e:54:05:03:f3:0c:9c:aa:30:82:29:6a:a4:52" )
 }
 import "pe"
 
@@ -233719,13 +233153,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56Bba7Fe242E6B49695Bcf07870F5F5E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "902c1949-81e6-5070-ac60-2ebbb363fc6d"
+		id = "00127ba4-132d-5788-ab31-2265cfde6d19"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5047-L5058"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6c9da28b90bcff069509fc8e91c0a960805bb8339d0fa21f5466c38b6d20f95f"
+		logic_hash = "v1_sha256_6c9da28b90bcff069509fc8e91c0a960805bb8339d0fa21f5466c38b6d20f95f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233733,7 +233167,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_56Bba7Fe242E6B49695Bcf07870F5F5E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ewGMiQgCHj" and pe.signatures[i].serial=="56:bb:a7:fe:24:2e:6b:49:69:5b:cf:07:87:0f:5f:5e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ewGMiQgCHj" and pe.signatures [ i ] . serial == "56:bb:a7:fe:24:2e:6b:49:69:5b:cf:07:87:0f:5f:5e" )
 }
 import "pe"
 
@@ -233742,13 +233176,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Dfef1A8C0Dbfef64Bc6C8A0647D6E873 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a8e2a271-399f-531a-8e69-27a1598ba086"
+		id = "5d294190-a2c1-5d11-9f27-1322099e1e8e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5060-L5071"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "104f066ddfd34edc328844d06a84a1663b0d271c02599825c1797704e582883a"
+		logic_hash = "v1_sha256_104f066ddfd34edc328844d06a84a1663b0d271c02599825c1797704e582883a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233756,7 +233190,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Dfef1A8C0Dbfef64Bc6C8A0647D6E873 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NnTqRHlSFNJSUHGaiKWzqyHGdPzBarblmWEzpKHvkZrqn" and pe.signatures[i].serial=="00:df:ef:1a:8c:0d:bf:ef:64:bc:6c:8a:06:47:d6:e8:73")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NnTqRHlSFNJSUHGaiKWzqyHGdPzBarblmWEzpKHvkZrqn" and pe.signatures [ i ] . serial == "00:df:ef:1a:8c:0d:bf:ef:64:bc:6c:8a:06:47:d6:e8:73" )
 }
 import "pe"
 
@@ -233765,13 +233199,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0609B5Aad2Dfb81Fbe6B75E4Cfe372A6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "db7bf2e3-f514-5133-a35a-87c43a5f12cf"
+		id = "5bccf41b-4d39-5be2-b3a4-5c182be7859c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5073-L5084"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2f483d06fd7af8db8e79203dcd4252d74f4859c0681e0bfcc4a97b351cb758a9"
+		logic_hash = "v1_sha256_2f483d06fd7af8db8e79203dcd4252d74f4859c0681e0bfcc4a97b351cb758a9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233779,7 +233213,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0609B5Aad2Dfb81Fbe6B75E4Cfe372A6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "vVBhgeghjdigSdWYSAdmy" and pe.signatures[i].serial=="06:09:b5:aa:d2:df:b8:1f:be:6b:75:e4:cf:e3:72:a6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "vVBhgeghjdigSdWYSAdmy" and pe.signatures [ i ] . serial == "06:09:b5:aa:d2:df:b8:1f:be:6b:75:e4:cf:e3:72:a6" )
 }
 import "pe"
 
@@ -233788,13 +233222,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02B6656292310B84022Db5541Bc48Faf : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "252c8339-73d3-5de0-8f75-78a6a2da4abc"
+		id = "015038fd-72ee-56b0-9633-815eb4912788"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5086-L5097"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "374f7abfab6f7def8b895dc9536ca6bb7a605e9478934af6c97e8b7595fbee19"
+		logic_hash = "v1_sha256_374f7abfab6f7def8b895dc9536ca6bb7a605e9478934af6c97e8b7595fbee19"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233802,7 +233236,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02B6656292310B84022Db5541Bc48Faf : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DILA d.o.o." and pe.signatures[i].serial=="02:b6:65:62:92:31:0b:84:02:2d:b5:54:1b:c4:8f:af")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DILA d.o.o." and pe.signatures [ i ] . serial == "02:b6:65:62:92:31:0b:84:02:2d:b5:54:1b:c4:8f:af" )
 }
 import "pe"
 
@@ -233811,13 +233245,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D609B6C95428954A999A8A99D4F198Af : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e1b732d2-24fd-5819-a26a-049a9a569089"
+		id = "f9e396a6-deb8-5d3f-9d8d-161d949e00ec"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5099-L5110"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "62eecc7cf240b9de6e04a43413bbeb84b673e9d3f1c4d67ec4082c099c6a87db"
+		logic_hash = "v1_sha256_62eecc7cf240b9de6e04a43413bbeb84b673e9d3f1c4d67ec4082c099c6a87db"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233825,7 +233259,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D609B6C95428954A999A8A99D4F198Af : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Fudl" and pe.signatures[i].serial=="00:d6:09:b6:c9:54:28:95:4a:99:9a:8a:99:d4:f1:98:af")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Fudl" and pe.signatures [ i ] . serial == "00:d6:09:b6:c9:54:28:95:4a:99:9a:8a:99:d4:f1:98:af" )
 }
 import "pe"
 
@@ -233834,13 +233268,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6A568F85De2061F67Ded98707D4988Df : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ed8748ce-cd90-527b-a58e-da9c7164ed18"
+		id = "9f3e0bf8-e1b5-545d-9174-81c8727a548c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5112-L5123"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f1aea9f6237cfbda49fea6d38ece935f9d4cc5abc678590c63b9a339aa37e104"
+		logic_hash = "v1_sha256_f1aea9f6237cfbda49fea6d38ece935f9d4cc5abc678590c63b9a339aa37e104"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233848,7 +233282,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6A568F85De2061F67Ded98707D4988Df : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Apladis" and pe.signatures[i].serial=="6a:56:8f:85:de:20:61:f6:7d:ed:98:70:7d:49:88:df")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Apladis" and pe.signatures [ i ] . serial == "6a:56:8f:85:de:20:61:f6:7d:ed:98:70:7d:49:88:df" )
 }
 import "pe"
 
@@ -233857,14 +233291,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F90E68Cbf92Fd7Ad409E281C3F2A0F0A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e92daa7b-2d8a-5806-840e-678a9aa24fef"
+		id = "5bfc4ad5-46a7-5dcf-8d2a-002ac248ac6d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5125-L5137"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "d79a8f491c0112c3f26572350336fe7d22674f5550f37894643eba980ae5bd32"
-		logic_hash = "ca8d80a446df0c28e9fb4944bd69d9fa008be968c449e5a469b182fbf8744a3f"
+		logic_hash = "v1_sha256_ca8d80a446df0c28e9fb4944bd69d9fa008be968c449e5a469b182fbf8744a3f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233872,7 +233306,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F90E68Cbf92Fd7Ad409E281C3F2A0F0A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SUCK-MY-DICK-ESET" and pe.signatures[i].serial=="f9:0e:68:cb:f9:2f:d7:ad:40:9e:28:1c:3f:2a:0f:0a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SUCK-MY-DICK-ESET" and pe.signatures [ i ] . serial == "f9:0e:68:cb:f9:2f:d7:ad:40:9e:28:1c:3f:2a:0f:0a" )
 }
 import "pe"
 
@@ -233881,13 +233315,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7Ddd3796A427B42F2E52D7C7Af0Ca54F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2619669f-cceb-5177-9738-d28236e1344e"
+		id = "65330090-3214-5837-b8b5-1dc565b74612"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5139-L5150"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "15df43212a842936e2ea0d834797f11fe80af3d376a19aa9a806aa6ed793e679"
+		logic_hash = "v1_sha256_15df43212a842936e2ea0d834797f11fe80af3d376a19aa9a806aa6ed793e679"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233895,7 +233329,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7Ddd3796A427B42F2E52D7C7Af0Ca54F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Fobos" and pe.signatures[i].serial=="7d:dd:37:96:a4:27:b4:2f:2e:52:d7:c7:af:0c:a5:4f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Fobos" and pe.signatures [ i ] . serial == "7d:dd:37:96:a4:27:b4:2f:2e:52:d7:c7:af:0c:a5:4f" )
 }
 import "pe"
 
@@ -233904,13 +233338,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_17D99Cc2F5B29522D422332E681F3E18 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "98493d50-2bee-50a5-93f3-851559c494a6"
+		id = "01ad3e5e-a445-52db-a05d-d32826171faf"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5152-L5163"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "95116d1114239795707b310afea3122d274dac471546de1e0147992d1f3a1d4f"
+		logic_hash = "v1_sha256_95116d1114239795707b310afea3122d274dac471546de1e0147992d1f3a1d4f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233918,7 +233352,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_17D99Cc2F5B29522D422332E681F3E18 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PKV Trading ApS" and pe.signatures[i].serial=="17:d9:9c:c2:f5:b2:95:22:d4:22:33:2e:68:1f:3e:18")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PKV Trading ApS" and pe.signatures [ i ] . serial == "17:d9:9c:c2:f5:b2:95:22:d4:22:33:2e:68:1f:3e:18" )
 }
 import "pe"
 
@@ -233927,13 +233361,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02De1Cc6C487954592F1Bf574Ca2B000 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1dc1b576-34f4-5017-8340-c6f58692a31c"
+		id = "7f9b0400-ec8c-59ed-a7a5-53269737e38d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5165-L5176"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5963377fee755a859bc4330a1094ea1c8b2b588133706a22f67c1fb85542e64f"
+		logic_hash = "v1_sha256_5963377fee755a859bc4330a1094ea1c8b2b588133706a22f67c1fb85542e64f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233941,7 +233375,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02De1Cc6C487954592F1Bf574Ca2B000 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Orca System" and pe.signatures[i].serial=="02:de:1c:c6:c4:87:95:45:92:f1:bf:57:4c:a2:b0:00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Orca System" and pe.signatures [ i ] . serial == "02:de:1c:c6:c4:87:95:45:92:f1:bf:57:4c:a2:b0:00" )
 }
 import "pe"
 
@@ -233950,13 +233384,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_142Aac4217E22B525C8587589773Ba9B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "86ef1337-71cc-5231-a31c-8d8a8d95873f"
+		id = "ccf02f70-11a1-586e-a4d2-712919a37ebc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5178-L5188"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a0abe691c6b0a7be8ceea313068a6943d611b1424a1a03e43b82239ddfe9cbd2"
+		logic_hash = "v1_sha256_a0abe691c6b0a7be8ceea313068a6943d611b1424a1a03e43b82239ddfe9cbd2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233964,7 +233398,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_142Aac4217E22B525C8587589773Ba9B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="14:2a:ac:42:17:e2:2b:52:5c:85:87:58:97:73:ba:9b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . serial == "14:2a:ac:42:17:e2:2b:52:5c:85:87:58:97:73:ba:9b" )
 }
 import "pe"
 
@@ -233973,13 +233407,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4026D6291F1Ac7Cf86C2C81172Cfb200 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ea11705d-37a1-5050-b01a-b7fc523c675a"
+		id = "c522370a-bb4f-5b63-af45-f2db89cd1953"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5218-L5229"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c821f288bb6555e3955dfccf02edde2448f0499942eea24c488a6426985bff74"
+		logic_hash = "v1_sha256_c821f288bb6555e3955dfccf02edde2448f0499942eea24c488a6426985bff74"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -233987,7 +233421,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4026D6291F1Ac7Cf86C2C81172Cfb200 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MztxUCVYqnxgsyqVryViRnMfHFYBgyVMXkXuVGqmyPx" and pe.signatures[i].serial=="40:26:d6:29:1f:1a:c7:cf:86:c2:c8:11:72:cf:b2:00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MztxUCVYqnxgsyqVryViRnMfHFYBgyVMXkXuVGqmyPx" and pe.signatures [ i ] . serial == "40:26:d6:29:1f:1a:c7:cf:86:c2:c8:11:72:cf:b2:00" )
 }
 import "pe"
 
@@ -233996,13 +233430,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B0A308Fc2E71Ac4Ac40677B9C27Ccbad : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "207aa920-528c-5fa2-a8d4-4a44da4c870e"
+		id = "e1c0fa8d-7c41-5845-b6f0-82a9efc81a6b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5231-L5242"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a71c47475327fb6268db34cd9d47451090fa3e673accfa905d32ebfb35f11e40"
+		logic_hash = "v1_sha256_a71c47475327fb6268db34cd9d47451090fa3e673accfa905d32ebfb35f11e40"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234010,7 +233444,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B0A308Fc2E71Ac4Ac40677B9C27Ccbad : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Volpayk LLC" and pe.signatures[i].serial=="00:b0:a3:08:fc:2e:71:ac:4a:c4:06:77:b9:c2:7c:cb:ad")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Volpayk LLC" and pe.signatures [ i ] . serial == "00:b0:a3:08:fc:2e:71:ac:4a:c4:06:77:b9:c2:7c:cb:ad" )
 }
 import "pe"
 
@@ -234019,13 +233453,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009Ecaa6E28E7615Ef5A12D87E327264C0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8fd9f4e8-4ec3-5731-8032-e2657ee229ca"
+		id = "889e8352-ff1c-577c-83b1-ef6ef0e46dfc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5244-L5255"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "24858027f62fd057c06dbf58b4a6e1e5f1dcd9429676232a8e66d231e713f56a"
+		logic_hash = "v1_sha256_24858027f62fd057c06dbf58b4a6e1e5f1dcd9429676232a8e66d231e713f56a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234033,7 +233467,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_009Ecaa6E28E7615Ef5A12D87E327264C0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HaqMkgGQmnNHpFsQmzMRDcavkPBzOcvMatDmcLHuDNoiQWMqj" and pe.signatures[i].serial=="00:9e:ca:a6:e2:8e:76:15:ef:5a:12:d8:7e:32:72:64:c0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HaqMkgGQmnNHpFsQmzMRDcavkPBzOcvMatDmcLHuDNoiQWMqj" and pe.signatures [ i ] . serial == "00:9e:ca:a6:e2:8e:76:15:ef:5a:12:d8:7e:32:72:64:c0" )
 }
 import "pe"
 
@@ -234042,13 +233476,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_19985190B09206952Efd412D3Ccc18E2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bd94cfd0-adaa-5e37-880e-8ef50328499d"
+		id = "937f381c-5cba-52c7-8e1c-ccdbd7e8c613"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5257-L5268"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6db1aaabd9a257e863a5ff771a736b705391602f7f5e2b799f8c47d3ae566f0f"
+		logic_hash = "v1_sha256_6db1aaabd9a257e863a5ff771a736b705391602f7f5e2b799f8c47d3ae566f0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234056,7 +233490,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_19985190B09206952Efd412D3Ccc18E2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "cwcpbvBhYEPeJYcCNDldHTnGK" and pe.signatures[i].serial=="19:98:51:90:b0:92:06:95:2e:fd:41:2d:3c:cc:18:e2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "cwcpbvBhYEPeJYcCNDldHTnGK" and pe.signatures [ i ] . serial == "19:98:51:90:b0:92:06:95:2e:fd:41:2d:3c:cc:18:e2" )
 }
 import "pe"
 
@@ -234065,13 +233499,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_03B27D7F4Ee21A462A064A17Eef70D6C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "96920ba8-b6d6-5cf4-9a3c-cb6f5c9b3048"
+		id = "de4f1b22-8078-5733-8cf7-a13ff65004fb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5270-L5281"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "53a4c4474b1add510624e23eac642e8cba145248d72a2ffc37d0aca141a041c2"
+		logic_hash = "v1_sha256_53a4c4474b1add510624e23eac642e8cba145248d72a2ffc37d0aca141a041c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234079,7 +233513,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_03B27D7F4Ee21A462A064A17Eef70D6C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CCL TRADING LIMITED" and pe.signatures[i].serial=="03:b2:7d:7f:4e:e2:1a:46:2a:06:4a:17:ee:f7:0d:6c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CCL TRADING LIMITED" and pe.signatures [ i ] . serial == "03:b2:7d:7f:4e:e2:1a:46:2a:06:4a:17:ee:f7:0d:6c" )
 }
 import "pe"
 
@@ -234088,14 +233522,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_66F98881Fbb02D0352Bef7C13Bd61Df2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9cc569f4-1686-5f17-99a4-90750023d519"
+		id = "ac369c69-f146-55b0-8a0d-25516979d553"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5283-L5294"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "f265524fb9a4a58274dbd32b2ed0c3f816c5eff05e1007a2e7bba286b8ffa72c"
-		logic_hash = "3d70da3f644a90bc6e7b405a41225a328d7007187525a0b277f0fc1136be8b5b"
+		logic_hash = "v1_sha256_3d70da3f644a90bc6e7b405a41225a328d7007187525a0b277f0fc1136be8b5b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234103,7 +233537,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_66F98881Fbb02D0352Bef7C13Bd61Df2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="66:f9:88:81:fb:b0:2d:03:52:be:f7:c1:3b:d6:1d:f2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . serial == "66:f9:88:81:fb:b0:2d:03:52:be:f7:c1:3b:d6:1d:f2" )
 }
 import "pe"
 
@@ -234112,13 +233546,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3F8B1D4C656982A34435F971C9F3C301 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7bafe9c8-7ec5-5847-81dc-2f2d0753f784"
+		id = "41e7b753-e0bc-5ae6-828b-0e2c8cc3b0a3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5296-L5307"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "95fd60c5f236b06fca308696dfe3e3aeb3aa6f255c6030d44822dc33a7c4c917"
+		logic_hash = "v1_sha256_95fd60c5f236b06fca308696dfe3e3aeb3aa6f255c6030d44822dc33a7c4c917"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234126,7 +233560,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3F8B1D4C656982A34435F971C9F3C301 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Word" and pe.signatures[i].serial=="3f:8b:1d:4c:65:69:82:a3:44:35:f9:71:c9:f3:c3:01")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Word" and pe.signatures [ i ] . serial == "3f:8b:1d:4c:65:69:82:a3:44:35:f9:71:c9:f3:c3:01" )
 }
 import "pe"
 
@@ -234135,13 +233569,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ef9D0Cf071D463Cd63D13083046A7B8D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f4b83bdf-ce07-5bad-b3e2-2c192d67f9f1"
+		id = "c23a98db-c59c-5aa9-8d08-4da0e1c635b1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5309-L5320"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9cf4ee1b3000d96d419bfd3e9ac3fb07f843aed735582c72e3a9799e2a56e364"
+		logic_hash = "v1_sha256_9cf4ee1b3000d96d419bfd3e9ac3fb07f843aed735582c72e3a9799e2a56e364"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234149,7 +233583,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ef9D0Cf071D463Cd63D13083046A7B8D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rubin LLC" and pe.signatures[i].serial=="00:ef:9d:0c:f0:71:d4:63:cd:63:d1:30:83:04:6a:7b:8d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rubin LLC" and pe.signatures [ i ] . serial == "00:ef:9d:0c:f0:71:d4:63:cd:63:d1:30:83:04:6a:7b:8d" )
 }
 import "pe"
 
@@ -234158,13 +233592,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E1E7E596F8F5Ccbeed4Ab882B6Cfe6Ce : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "063d70e1-06b0-53f6-8edb-c81c89af0a05"
+		id = "dd2edf7b-a686-5f30-a069-b3f41b857908"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5322-L5333"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "56977d47d8fcfd5eb7b5b4a141a9465e1cd2c497f05e61854e0ab09e2c7065a0"
+		logic_hash = "v1_sha256_56977d47d8fcfd5eb7b5b4a141a9465e1cd2c497f05e61854e0ab09e2c7065a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234172,7 +233606,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E1E7E596F8F5Ccbeed4Ab882B6Cfe6Ce : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LnvNzpvYjsjJOwcvwfalIvRAJHVApnpJU" and pe.signatures[i].serial=="00:e1:e7:e5:96:f8:f5:cc:be:ed:4a:b8:82:b6:cf:e6:ce")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LnvNzpvYjsjJOwcvwfalIvRAJHVApnpJU" and pe.signatures [ i ] . serial == "00:e1:e7:e5:96:f8:f5:cc:be:ed:4a:b8:82:b6:cf:e6:ce" )
 }
 import "pe"
 
@@ -234181,13 +233615,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_047801D5B55C800B48411Fd8C320Ca5B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "750b5b0d-7752-5407-a29e-3272b764a276"
+		id = "d266f857-79b0-5631-974d-42f065b61ced"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5335-L5346"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5e64b59f3d7f7554a482eaa32f5eac80f289bf57865a21381a3c1c78b1dabcab"
+		logic_hash = "v1_sha256_5e64b59f3d7f7554a482eaa32f5eac80f289bf57865a21381a3c1c78b1dabcab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234195,7 +233629,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_047801D5B55C800B48411Fd8C320Ca5B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LICHFIELD STUDIO GLASS LIMITED" and pe.signatures[i].serial=="04:78:01:d5:b5:5c:80:0b:48:41:1f:d8:c3:20:ca:5b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LICHFIELD STUDIO GLASS LIMITED" and pe.signatures [ i ] . serial == "04:78:01:d5:b5:5c:80:0b:48:41:1f:d8:c3:20:ca:5b" )
 }
 import "pe"
 
@@ -234204,13 +233638,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Ceb6B2Eec12934A64F75A4592159F084 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a37bf0a2-3205-515c-9957-374108e199e9"
+		id = "0f66677a-111d-5232-b5e1-0ceb32425221"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5366-L5377"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3e4aa8d970ead42bf1abb36a922ef31ac1b1aa308944cf099d6bbfb50e07c588"
+		logic_hash = "v1_sha256_3e4aa8d970ead42bf1abb36a922ef31ac1b1aa308944cf099d6bbfb50e07c588"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234218,7 +233652,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Ceb6B2Eec12934A64F75A4592159F084 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WMade by H5et.com" and pe.signatures[i].serial=="ce:b6:b2:ee:c1:29:34:a6:4f:75:a4:59:21:59:f0:84")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "WMade by H5et.com" and pe.signatures [ i ] . serial == "ce:b6:b2:ee:c1:29:34:a6:4f:75:a4:59:21:59:f0:84" )
 }
 import "pe"
 
@@ -234227,14 +233661,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6B6739E55F3F25B147C4A6767De41F57 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ee84787b-cc90-545d-8e15-bf84676f222c"
+		id = "d29f79c5-8345-5771-87a7-e8da5a93e33f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5379-L5391"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "da0921c1e416b3734272dfa619f88c8cd32e9816cdcbeeb81d9e2b2e8a95af4c"
-		logic_hash = "9d1a20f3dfa6c31ed557e531f7a57c64032e518c033993234849882ef769fcbd"
+		logic_hash = "v1_sha256_9d1a20f3dfa6c31ed557e531f7a57c64032e518c033993234849882ef769fcbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234242,7 +233676,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6B6739E55F3F25B147C4A6767De41F57 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Avast Antivirus SEC" and pe.signatures[i].serial=="6b:67:39:e5:5f:3f:25:b1:47:c4:a6:76:7d:e4:1f:57")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Avast Antivirus SEC" and pe.signatures [ i ] . serial == "6b:67:39:e5:5f:3f:25:b1:47:c4:a6:76:7d:e4:1f:57" )
 }
 import "pe"
 
@@ -234251,13 +233685,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B97F66Bb221772Dc07Ef1D4Bed8F6085 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c0797751-d03c-59c7-a02a-27e6f466bd96"
+		id = "30c340d3-2cda-5ab1-809e-7ac18db5be7c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5393-L5404"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e68f6ebbeadc9381c2888abf77e040f27648a40d770524830f8a49fe2d11534f"
+		logic_hash = "v1_sha256_e68f6ebbeadc9381c2888abf77e040f27648a40d770524830f8a49fe2d11534f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234265,7 +233699,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B97F66Bb221772Dc07Ef1D4Bed8F6085 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "S-PRO d.o.o." and pe.signatures[i].serial=="00:b9:7f:66:bb:22:17:72:dc:07:ef:1d:4b:ed:8f:60:85")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "S-PRO d.o.o." and pe.signatures [ i ] . serial == "00:b9:7f:66:bb:22:17:72:dc:07:ef:1d:4b:ed:8f:60:85" )
 }
 import "pe"
 
@@ -234274,13 +233708,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Cc95D6Ebf18A3711E196Aea210465A19 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bd6957ac-d5e0-5e77-87b3-a62c442f7f72"
+		id = "e59487c2-7c77-5797-a722-7659406a2bb5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5406-L5417"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "640ba6d64ad7e0791ef29d3ee9387e0944826f22f01a6a01486f6b3ac4138826"
+		logic_hash = "v1_sha256_640ba6d64ad7e0791ef29d3ee9387e0944826f22f01a6a01486f6b3ac4138826"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234288,7 +233722,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Cc95D6Ebf18A3711E196Aea210465A19 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GEN Sistemi, d.o.o." and pe.signatures[i].serial=="00:cc:95:d6:eb:f1:8a:37:11:e1:96:ae:a2:10:46:5a:19")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GEN Sistemi, d.o.o." and pe.signatures [ i ] . serial == "00:cc:95:d6:eb:f1:8a:37:11:e1:96:ae:a2:10:46:5a:19" )
 }
 import "pe"
 
@@ -234297,13 +233731,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dde89C647Dc2138244228040E324Dc77 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5008d334-964a-516b-895e-761ae94e5bd4"
+		id = "30bbf542-c60a-55e5-aeb0-051ed1667f16"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5419-L5430"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d6c11a277f855ad8a4b235e1461ad024c4490d04530b91ecb47c8fcf8dee1239"
+		logic_hash = "v1_sha256_d6c11a277f855ad8a4b235e1461ad024c4490d04530b91ecb47c8fcf8dee1239"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234311,7 +233745,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dde89C647Dc2138244228040E324Dc77 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WMade by H5et.com" and pe.signatures[i].serial=="dd:e8:9c:64:7d:c2:13:82:44:22:80:40:e3:24:dc:77")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "WMade by H5et.com" and pe.signatures [ i ] . serial == "dd:e8:9c:64:7d:c2:13:82:44:22:80:40:e3:24:dc:77" )
 }
 import "pe"
 
@@ -234320,13 +233754,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fed006Fbf85Cd1C6Ba6B4345B198E1E6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8f7d0337-7840-5c6e-b562-dbaef1a7c022"
+		id = "1561ac43-b1b2-56ab-8afc-e63d108455e9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5432-L5443"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "26690cb1ef7eb9b7009376b4c2a30505f01184f4462478f65379372e84e02bc8"
+		logic_hash = "v1_sha256_26690cb1ef7eb9b7009376b4c2a30505f01184f4462478f65379372e84e02bc8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234334,7 +233768,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fed006Fbf85Cd1C6Ba6B4345B198E1E6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LoL d.o.o." and pe.signatures[i].serial=="00:fe:d0:06:fb:f8:5c:d1:c6:ba:6b:43:45:b1:98:e1:e6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LoL d.o.o." and pe.signatures [ i ] . serial == "00:fe:d0:06:fb:f8:5c:d1:c6:ba:6b:43:45:b1:98:e1:e6" )
 }
 import "pe"
 
@@ -234343,13 +233777,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4E7545C9Fc5938F5198Ab9F1749Ca31C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "af27fbf7-f4e2-59e9-8b2b-b353704ce9d6"
+		id = "579ef418-86aa-5cbc-bcac-d649efdf6b44"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5445-L5456"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4b7bc07622ad3f7ec77f4bb0d51350c82734af4b73a26ecd21955e55e99bb515"
+		logic_hash = "v1_sha256_4b7bc07622ad3f7ec77f4bb0d51350c82734af4b73a26ecd21955e55e99bb515"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234357,7 +233791,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4E7545C9Fc5938F5198Ab9F1749Ca31C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "For M d.o.o." and pe.signatures[i].serial=="4e:75:45:c9:fc:59:38:f5:19:8a:b9:f1:74:9c:a3:1c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "For M d.o.o." and pe.signatures [ i ] . serial == "4e:75:45:c9:fc:59:38:f5:19:8a:b9:f1:74:9c:a3:1c" )
 }
 import "pe"
 
@@ -234366,13 +233800,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_040F11F124A73Bdecc41259845A8A773 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0502773a-356e-5eae-9c37-e1ef89de3547"
+		id = "179ba33c-8215-5b85-8b83-0482eaac8ae4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5458-L5469"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "70edbe8be481ccb7b5c6a6485c2ac249ec5120a4cde18d551954cfeaae121f27"
+		logic_hash = "v1_sha256_70edbe8be481ccb7b5c6a6485c2ac249ec5120a4cde18d551954cfeaae121f27"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234380,7 +233814,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_040F11F124A73Bdecc41259845A8A773 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TrustPort" and pe.signatures[i].serial=="04:0f:11:f1:24:a7:3b:de:cc:41:25:98:45:a8:a7:73")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TrustPort" and pe.signatures [ i ] . serial == "04:0f:11:f1:24:a7:3b:de:cc:41:25:98:45:a8:a7:73" )
 }
 import "pe"
 
@@ -234389,14 +233823,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1B1E87E90519D7273C0033Bf489B798F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b154ae08-108c-5980-a611-5e086877af2a"
+		id = "6aec61cb-d54c-53b3-817b-c4d0fb56d125"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5471-L5483"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "84cef0aed269e6213bfa213d95a3db625bcdde130f33bf4227436985e4473252"
-		logic_hash = "b47f80ecc895e73d69c60a5e88d6a6c95fcb9bddb30f14a1421b68aabc2290c9"
+		logic_hash = "v1_sha256_b47f80ecc895e73d69c60a5e88d6a6c95fcb9bddb30f14a1421b68aabc2290c9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234404,7 +233838,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1B1E87E90519D7273C0033Bf489B798F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IBIS, OOO" and pe.signatures[i].serial=="1b:1e:87:e9:05:19:d7:27:3c:00:33:bf:48:9b:79:8f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IBIS, OOO" and pe.signatures [ i ] . serial == "1b:1e:87:e9:05:19:d7:27:3c:00:33:bf:48:9b:79:8f" )
 }
 import "pe"
 
@@ -234413,14 +233847,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D9E834182Dec62C654E775E809Ac1D1B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ce1640b7-6631-5e8f-a2df-0716b2f86b99"
+		id = "535f067c-9baa-5324-b608-6ff0a7ef3ee7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5485-L5497"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6"
-		logic_hash = "3e7ca9aec19f118c7a143826838244f3f8d0a603a44980522f5227a9c3a82a88"
+		logic_hash = "v1_sha256_3e7ca9aec19f118c7a143826838244f3f8d0a603a44980522f5227a9c3a82a88"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234428,7 +233862,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D9E834182Dec62C654E775E809Ac1D1B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FoodLehto Oy" and pe.signatures[i].serial=="00:d9:e8:34:18:2d:ec:62:c6:54:e7:75:e8:09:ac:1d:1b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FoodLehto Oy" and pe.signatures [ i ] . serial == "00:d9:e8:34:18:2d:ec:62:c6:54:e7:75:e8:09:ac:1d:1b" )
 }
 import "pe"
 
@@ -234437,14 +233871,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ced87Bd70B092Cb93B182Fac32655F6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5e716e70-0c78-5194-9134-0ee140221610"
+		id = "14ee5701-1ddb-5f88-a2cb-f0e07c8573eb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5499-L5511"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89"
-		logic_hash = "3d4d84a60095e608fbd774f2b3a0f86e32dd9fe25801da06ee10188425a029e0"
+		logic_hash = "v1_sha256_3d4d84a60095e608fbd774f2b3a0f86e32dd9fe25801da06ee10188425a029e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234452,7 +233886,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ced87Bd70B092Cb93B182Fac32655F6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Creator Soft Limited" and pe.signatures[i].serial=="0c:ed:87:bd:70:b0:92:cb:93:b1:82:fa:c3:26:55:f6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Creator Soft Limited" and pe.signatures [ i ] . serial == "0c:ed:87:bd:70:b0:92:cb:93:b1:82:fa:c3:26:55:f6" )
 }
 import "pe"
 
@@ -234461,13 +233895,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Afd1491D52F89Ba41Fa6C0281Bb9716 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a0e5569f-7895-519b-9c1b-9cea3126391f"
+		id = "7093e76c-fe60-59ee-a502-a1df46bdb558"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5513-L5524"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "071895cc37527aa634410dc79bf1656068e4c2b9f61d24912160c5f847e154f9"
+		logic_hash = "v1_sha256_071895cc37527aa634410dc79bf1656068e4c2b9f61d24912160c5f847e154f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234475,7 +233909,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Afd1491D52F89Ba41Fa6C0281Bb9716 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TestCert" and pe.signatures[i].serial=="1a:fd:14:91:d5:2f:89:ba:41:fa:6c:02:81:bb:97:16")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TestCert" and pe.signatures [ i ] . serial == "1a:fd:14:91:d5:2f:89:ba:41:fa:6c:02:81:bb:97:16" )
 }
 import "pe"
 
@@ -234484,13 +233918,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_719Ac44966D05762Ef95245Eefcf3046 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e215971c-67f0-5fdb-9525-7aef2559674f"
+		id = "fbd4801a-9bb7-599c-b4c4-1ba62aec9f6c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5526-L5537"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2b7c5ccc7a09d3917cf8625bc3e78526ba9620eb8bb08490124c24a5c2eda629"
+		logic_hash = "v1_sha256_2b7c5ccc7a09d3917cf8625bc3e78526ba9620eb8bb08490124c24a5c2eda629"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234498,7 +233932,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_719Ac44966D05762Ef95245Eefcf3046 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "jZQtQDMvyDRzWsoVFeitFmeNcWMtKauvidXSUrSEwqmi" and pe.signatures[i].serial=="71:9a:c4:49:66:d0:57:62:ef:95:24:5e:ef:cf:30:46")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "jZQtQDMvyDRzWsoVFeitFmeNcWMtKauvidXSUrSEwqmi" and pe.signatures [ i ] . serial == "71:9a:c4:49:66:d0:57:62:ef:95:24:5e:ef:cf:30:46" )
 }
 import "pe"
 
@@ -234507,13 +233941,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008Fe807310D98357A59382090634B93F0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bf4326b3-a838-5dff-a6e1-ac71c6fb871d"
+		id = "10a6c519-6bb1-5bbd-926a-1509e58567fa"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5539-L5550"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a90430a6f07f67ead37e5cba9f0baee92551511a9f33a2a1fd3d2419322aaa8b"
+		logic_hash = "v1_sha256_a90430a6f07f67ead37e5cba9f0baee92551511a9f33a2a1fd3d2419322aaa8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234521,7 +233955,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008Fe807310D98357A59382090634B93F0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MAVE MEDIA" and pe.signatures[i].serial=="00:8f:e8:07:31:0d:98:35:7a:59:38:20:90:63:4b:93:f0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MAVE MEDIA" and pe.signatures [ i ] . serial == "00:8f:e8:07:31:0d:98:35:7a:59:38:20:90:63:4b:93:f0" )
 }
 import "pe"
 
@@ -234530,13 +233964,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00801689896Ed339237464A41A2900A969 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "91cecd18-0007-59a4-94f3-bdaa06b25822"
+		id = "197c56db-63a7-5aae-9f74-3ee05aa7fa29"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5552-L5563"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9dc505e00e0085587aee2bf2e70db04850e11d057b8d16e31e8caebb130e047b"
+		logic_hash = "v1_sha256_9dc505e00e0085587aee2bf2e70db04850e11d057b8d16e31e8caebb130e047b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234544,7 +233978,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00801689896Ed339237464A41A2900A969 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GLG Rental ApS" and pe.signatures[i].serial=="00:80:16:89:89:6e:d3:39:23:74:64:a4:1a:29:00:a9:69")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GLG Rental ApS" and pe.signatures [ i ] . serial == "00:80:16:89:89:6e:d3:39:23:74:64:a4:1a:29:00:a9:69" )
 }
 import "pe"
 
@@ -234553,13 +233987,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Podangers : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b394c4a1-1614-578f-bbfc-6eb9998b4a06"
+		id = "d5e8ef27-6e00-5709-bd74-b5b334a6af14"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5565-L5576"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6a041e8ae4a7a1af59b81799b5c014691e347c8305266adeffd9d49337712b2e"
+		logic_hash = "v1_sha256_6a041e8ae4a7a1af59b81799b5c014691e347c8305266adeffd9d49337712b2e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234567,7 +234001,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Podangers : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PODANGERS" and pe.signatures[i].serial=="00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PODANGERS" and pe.signatures [ i ] . serial == "00" )
 }
 import "pe"
 
@@ -234576,13 +234010,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E9A1E07314Bc2F2D51818454B63E5829 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2c9f0497-0fcd-591c-be72-e92464b689f3"
+		id = "f96e2f2a-4893-5c07-a0ba-e39b0cbc68b5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5578-L5589"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e3dfb75350bcdbb6861612f2f6cc757724260f99e4024df2b20c7b273bc50266"
+		logic_hash = "v1_sha256_e3dfb75350bcdbb6861612f2f6cc757724260f99e4024df2b20c7b273bc50266"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234590,7 +234024,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E9A1E07314Bc2F2D51818454B63E5829 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "iWLiYpLtpOlZYGmysAZkhz" and pe.signatures[i].serial=="00:e9:a1:e0:73:14:bc:2f:2d:51:81:84:54:b6:3e:58:29")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "iWLiYpLtpOlZYGmysAZkhz" and pe.signatures [ i ] . serial == "00:e9:a1:e0:73:14:bc:2f:2d:51:81:84:54:b6:3e:58:29" )
 }
 import "pe"
 
@@ -234599,13 +234033,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_9D915138Acdac1A044Afa6E5D99567C5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "89182dfb-b100-573c-85ae-38bdf7f24a64"
+		id = "e6216186-538e-5563-9c7c-2a4f02aac20a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5591-L5602"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "32fb0d12a9b61461104e29571fcc7210f7ea8a82a8e240c747a0070d8d43a9b0"
+		logic_hash = "v1_sha256_32fb0d12a9b61461104e29571fcc7210f7ea8a82a8e240c747a0070d8d43a9b0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234613,7 +234047,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_9D915138Acdac1A044Afa6E5D99567C5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AAAruntest" and pe.signatures[i].serial=="9d:91:51:38:ac:da:c1:a0:44:af:a6:e5:d9:95:67:c5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AAAruntest" and pe.signatures [ i ] . serial == "9d:91:51:38:ac:da:c1:a0:44:af:a6:e5:d9:95:67:c5" )
 }
 import "pe"
 
@@ -234622,13 +234056,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_11A9Bf6B2Dcbc683475B431A1C79133E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9c49f529-330f-5d37-b613-e45aad50afcb"
+		id = "fad5f908-a7cc-5075-b776-050724873a3d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5604-L5615"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fa424180e60d2fde2fce085d0c848c5b33bcc58c2ca54f327f446ff5cf361fe2"
+		logic_hash = "v1_sha256_fa424180e60d2fde2fce085d0c848c5b33bcc58c2ca54f327f446ff5cf361fe2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234636,7 +234070,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_11A9Bf6B2Dcbc683475B431A1C79133E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BINDOX" and pe.signatures[i].serial=="11:a9:bf:6b:2d:cb:c6:83:47:5b:43:1a:1c:79:13:3e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BINDOX" and pe.signatures [ i ] . serial == "11:a9:bf:6b:2d:cb:c6:83:47:5b:43:1a:1c:79:13:3e" )
 }
 import "pe"
 
@@ -234645,13 +234079,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Fd3661533Eef209153C9Afec3Ba4D8A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d47bc223-f29e-54d3-a452-064f89fa80f7"
+		id = "38c0ea8a-74a0-5a9b-b9b9-46a1c5a9e0e3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5617-L5628"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e9662abf4c70d54fc719850ef216352fd59a559726fbad5db9e265660400b432"
+		logic_hash = "v1_sha256_e9662abf4c70d54fc719850ef216352fd59a559726fbad5db9e265660400b432"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234659,7 +234093,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Fd3661533Eef209153C9Afec3Ba4D8A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SFB Regnskabsservice ApS" and pe.signatures[i].serial=="3f:d3:66:15:33:ee:f2:09:15:3c:9a:fe:c3:ba:4d:8a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SFB Regnskabsservice ApS" and pe.signatures [ i ] . serial == "3f:d3:66:15:33:ee:f2:09:15:3c:9a:fe:c3:ba:4d:8a" )
 }
 import "pe"
 
@@ -234668,13 +234102,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Ba40F65086686Dd4Ab7171E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "13909741-cba3-5143-86eb-bcc227cfaa9c"
+		id = "b9901bf9-c134-5f8e-80b6-9c84a0776ee8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5630-L5641"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8ed65c0b5d231be9dbbe34da493087d1bf83cf21c401435fed7e2851acdb6f60"
+		logic_hash = "v1_sha256_8ed65c0b5d231be9dbbe34da493087d1bf83cf21c401435fed7e2851acdb6f60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234682,7 +234116,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Ba40F65086686Dd4Ab7171E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RITEIL SISTEMS LLC" and pe.signatures[i].serial=="2b:a4:0f:65:08:66:86:dd:4a:b7:17:1e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RITEIL SISTEMS LLC" and pe.signatures [ i ] . serial == "2b:a4:0f:65:08:66:86:dd:4a:b7:17:1e" )
 }
 import "pe"
 
@@ -234691,13 +234125,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_67144B9Ed89Fb2D106D0233873C6E35F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f9806e55-9efa-504a-b27c-d3418fc5cd38"
+		id = "70f9d0d2-ead2-5cf5-b7c8-a21504691946"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5643-L5654"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9d3c39c590a75b3ea1d1f699bea279c0c68498e51e2ab7f4ad3e3f8857d6d668"
+		logic_hash = "v1_sha256_9d3c39c590a75b3ea1d1f699bea279c0c68498e51e2ab7f4ad3e3f8857d6d668"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234705,7 +234139,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_67144B9Ed89Fb2D106D0233873C6E35F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Infosignal LLC" and pe.signatures[i].serial=="67:14:4b:9e:d8:9f:b2:d1:06:d0:23:38:73:c6:e3:5f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Infosignal LLC" and pe.signatures [ i ] . serial == "67:14:4b:9e:d8:9f:b2:d1:06:d0:23:38:73:c6:e3:5f" )
 }
 import "pe"
 
@@ -234714,13 +234148,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ca4822E6905Aa4Fca9E28523F04F14A3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "713f84b3-b09a-5fcf-85ed-899be9f14b84"
+		id = "af31c422-00df-5d24-a840-377ce8a7721a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5656-L5667"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6e0d7abd82805019c6b1c9df2479489bbd3fe7a4a1703971c02324072692b1e5"
+		logic_hash = "v1_sha256_6e0d7abd82805019c6b1c9df2479489bbd3fe7a4a1703971c02324072692b1e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234728,7 +234162,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ca4822E6905Aa4Fca9E28523F04F14A3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ELISTREID, OOO" and pe.signatures[i].serial=="00:ca:48:22:e6:90:5a:a4:fc:a9:e2:85:23:f0:4f:14:a3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ELISTREID, OOO" and pe.signatures [ i ] . serial == "00:ca:48:22:e6:90:5a:a4:fc:a9:e2:85:23:f0:4f:14:a3" )
 }
 import "pe"
 
@@ -234737,13 +234171,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3769815A97A8Fb411E005282B37878E3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "da41e9a7-1660-5157-9148-f2f774df647a"
+		id = "b97f6b88-f901-5102-82fc-2a052d61137b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5669-L5680"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ccd548ebe2be2c7b44e6c39df50ffea4703d0b1decd78cc6fb4b3bbf9d85be0b"
+		logic_hash = "v1_sha256_ccd548ebe2be2c7b44e6c39df50ffea4703d0b1decd78cc6fb4b3bbf9d85be0b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234751,7 +234185,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3769815A97A8Fb411E005282B37878E3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Yandex" and pe.signatures[i].serial=="37:69:81:5a:97:a8:fb:41:1e:00:52:82:b3:78:78:e3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Yandex" and pe.signatures [ i ] . serial == "37:69:81:5a:97:a8:fb:41:1e:00:52:82:b3:78:78:e3" )
 }
 import "pe"
 
@@ -234760,13 +234194,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3B007314844B114C61Bc156A0609A286 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bb68c2fc-2389-5fb8-96f0-5731f008fd3c"
+		id = "04df50cc-5522-55f0-a11e-badfc498ff0b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5682-L5693"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f6f4e551a9be96f43a81e4da69f7b312dbdc16da17659a00a3486543a9c078e9"
+		logic_hash = "v1_sha256_f6f4e551a9be96f43a81e4da69f7b312dbdc16da17659a00a3486543a9c078e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234774,7 +234208,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3B007314844B114C61Bc156A0609A286 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SATURDAY CITY LIMITED" and pe.signatures[i].serial=="3b:00:73:14:84:4b:11:4c:61:bc:15:6a:06:09:a2:86")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SATURDAY CITY LIMITED" and pe.signatures [ i ] . serial == "3b:00:73:14:84:4b:11:4c:61:bc:15:6a:06:09:a2:86" )
 }
 import "pe"
 
@@ -234783,13 +234217,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_262Ca7Ae19D688138E75932832B18F9D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "891717e4-502f-5820-903c-3d9f2751a9d3"
+		id = "087af643-27b6-5e4b-adf8-e120315fb851"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5695-L5706"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0e6e75206bea63856e4ab07ff9b1220448f3cad6d845ae09703b9e836015520d"
+		logic_hash = "v1_sha256_0e6e75206bea63856e4ab07ff9b1220448f3cad6d845ae09703b9e836015520d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234797,7 +234231,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_262Ca7Ae19D688138E75932832B18F9D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bisoyetutu Ltd Ltd" and pe.signatures[i].serial=="26:2c:a7:ae:19:d6:88:13:8e:75:93:28:32:b1:8f:9d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bisoyetutu Ltd Ltd" and pe.signatures [ i ] . serial == "26:2c:a7:ae:19:d6:88:13:8e:75:93:28:32:b1:8f:9d" )
 }
 import "pe"
 
@@ -234806,13 +234240,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6B0008Bbd5Eb53F5D9E616C3Ed00000008Bbd5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "51e670b5-a679-52ef-9c07-5a2bd21f8a20"
+		id = "7dbd0b59-a6dd-5dd3-a3c8-0f7c00453a36"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5708-L5719"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "185334d7f484585cd88a1d89516f805d0248234a61153f8a38cc78b52d4bd764"
+		logic_hash = "v1_sha256_185334d7f484585cd88a1d89516f805d0248234a61153f8a38cc78b52d4bd764"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234820,7 +234254,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6B0008Bbd5Eb53F5D9E616C3Ed00000008Bbd5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "microsoft.com" and pe.signatures[i].serial=="6b:00:08:bb:d5:eb:53:f5:d9:e6:16:c3:ed:00:00:00:08:bb:d5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "microsoft.com" and pe.signatures [ i ] . serial == "6b:00:08:bb:d5:eb:53:f5:d9:e6:16:c3:ed:00:00:00:08:bb:d5" )
 }
 import "pe"
 
@@ -234829,13 +234263,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Abc3555Becca0Bc4B6987Ccc2Ea42B5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b3ced8b8-ec42-56e4-8a3e-9cb7f6845b6f"
+		id = "cb0d9322-af9f-5c57-86de-053de9255fa4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5721-L5732"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "76d4895f805a6638549c2d3b01a53873156e142d741b1fc2ccc0b18971b275a7"
+		logic_hash = "v1_sha256_76d4895f805a6638549c2d3b01a53873156e142d741b1fc2ccc0b18971b275a7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234843,7 +234277,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Abc3555Becca0Bc4B6987Ccc2Ea42B5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jwkwjaagoh" and pe.signatures[i].serial=="6a:bc:35:55:be:cc:a0:bc:4b:69:87:cc:c2:ea:42:b5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Jwkwjaagoh" and pe.signatures [ i ] . serial == "6a:bc:35:55:be:cc:a0:bc:4b:69:87:cc:c2:ea:42:b5" )
 }
 import "pe"
 
@@ -234852,13 +234286,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3C5Fc5D02273F297404F7B9306E447Bb : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2dd0805d-f43e-5aec-a0d9-98fc9fa6c088"
+		id = "5d441fbb-34fb-5326-9d13-eace97f315df"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5734-L5745"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e73fd0a38c76783e3110abe82411cc3d22fbbc95684667dc754618f590f29970"
+		logic_hash = "v1_sha256_e73fd0a38c76783e3110abe82411cc3d22fbbc95684667dc754618f590f29970"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234866,7 +234300,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3C5Fc5D02273F297404F7B9306E447Bb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Wirpool Soft" and pe.signatures[i].serial=="3c:5f:c5:d0:22:73:f2:97:40:4f:7b:93:06:e4:47:bb")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Wirpool Soft" and pe.signatures [ i ] . serial == "3c:5f:c5:d0:22:73:f2:97:40:4f:7b:93:06:e4:47:bb" )
 }
 import "pe"
 
@@ -234875,13 +234309,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7D36Cbb64Bc9Add17Ba71737D3Ecceca : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "23786dd4-2ad2-5d86-a0d2-46bc5f1825eb"
+		id = "9c6fd840-1b95-53d4-9c62-0fc7743034b6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5763-L5774"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "070600994d7e137a769432e7c5995dac90f01cbce2c50de4c5baecea5d556baf"
+		logic_hash = "v1_sha256_070600994d7e137a769432e7c5995dac90f01cbce2c50de4c5baecea5d556baf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234889,7 +234323,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7D36Cbb64Bc9Add17Ba71737D3Ecceca : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LTD SERVICES LIMITED" and pe.signatures[i].serial=="7d:36:cb:b6:4b:c9:ad:d1:7b:a7:17:37:d3:ec:ce:ca")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LTD SERVICES LIMITED" and pe.signatures [ i ] . serial == "7d:36:cb:b6:4b:c9:ad:d1:7b:a7:17:37:d3:ec:ce:ca" )
 }
 import "pe"
 
@@ -234898,13 +234332,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Df7139E106Dbb68Dfe4De97D862Af708 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8da7c163-02a7-571e-a995-c1d500d90b5b"
+		id = "3eaff912-66d8-5f0a-96b4-5d1768680479"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5776-L5787"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "503ff5f570191ac61a20c2a6ffa5117d5c3ed632c04c4a02c710644c18a494d0"
+		logic_hash = "v1_sha256_503ff5f570191ac61a20c2a6ffa5117d5c3ed632c04c4a02c710644c18a494d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234912,7 +234346,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Df7139E106Dbb68Dfe4De97D862Af708 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "zPfPJHDCzusZRYQYJZGZoFfZmvYtSlFXDPQKtoQzc" and pe.signatures[i].serial=="00:df:71:39:e1:06:db:b6:8d:fe:4d:e9:7d:86:2a:f7:08")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "zPfPJHDCzusZRYQYJZGZoFfZmvYtSlFXDPQKtoQzc" and pe.signatures [ i ] . serial == "00:df:71:39:e1:06:db:b6:8d:fe:4d:e9:7d:86:2a:f7:08" )
 }
 import "pe"
 
@@ -234921,13 +234355,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D4F9Fc08895654F8Bde8D1Cc26Eff015 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d32f82a7-36dd-555f-87cf-28e520a3916f"
+		id = "f4b0427a-cd22-5a67-af43-8e02df870c7b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5789-L5800"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dfc90ce9c1d8a0fad9c50f61c90c4f7b00b6890ee45d218417f4a7196c3d1c18"
+		logic_hash = "v1_sha256_dfc90ce9c1d8a0fad9c50f61c90c4f7b00b6890ee45d218417f4a7196c3d1c18"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234935,7 +234369,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D4F9Fc08895654F8Bde8D1Cc26Eff015 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "kfbdAfVnDMDc" and pe.signatures[i].serial=="00:d4:f9:fc:08:89:56:54:f8:bd:e8:d1:cc:26:ef:f0:15")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "kfbdAfVnDMDc" and pe.signatures [ i ] . serial == "00:d4:f9:fc:08:89:56:54:f8:bd:e8:d1:cc:26:ef:f0:15" )
 }
 import "pe"
 
@@ -234944,13 +234378,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0393Be7Fd785Ba0E3223A73B15Ee6736 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "852c3c5c-e20c-5e45-acee-7f5a5a35fa24"
+		id = "1bb1002f-4289-544a-9a19-6afacc8447c7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5802-L5813"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6805b2d04f8b89b9d4db8d47d74e83b6cdd7e778b038883fc8d3ef2e1b157070"
+		logic_hash = "v1_sha256_6805b2d04f8b89b9d4db8d47d74e83b6cdd7e778b038883fc8d3ef2e1b157070"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234958,7 +234392,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0393Be7Fd785Ba0E3223A73B15Ee6736 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FZaKundypKakCIvoMBPpTnwIDUJM" and pe.signatures[i].serial=="03:93:be:7f:d7:85:ba:0e:32:23:a7:3b:15:ee:67:36")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FZaKundypKakCIvoMBPpTnwIDUJM" and pe.signatures [ i ] . serial == "03:93:be:7f:d7:85:ba:0e:32:23:a7:3b:15:ee:67:36" )
 }
 import "pe"
 
@@ -234967,13 +234401,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008B7369B2F0C313634A1C1Dfc4A828A54 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e4da4da0-68f1-548b-b307-e11ad6def316"
+		id = "472b8999-d08e-5c4a-962b-fbe496f57d39"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5815-L5826"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "857eaa56ff5106e3808750b8833fd33a328b53a04f6fd2939aca30dbc6048329"
+		logic_hash = "v1_sha256_857eaa56ff5106e3808750b8833fd33a328b53a04f6fd2939aca30dbc6048329"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -234981,7 +234415,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008B7369B2F0C313634A1C1Dfc4A828A54 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LFpKdFUgpGKj" and pe.signatures[i].serial=="00:8b:73:69:b2:f0:c3:13:63:4a:1c:1d:fc:4a:82:8a:54")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LFpKdFUgpGKj" and pe.signatures [ i ] . serial == "00:8b:73:69:b2:f0:c3:13:63:4a:1c:1d:fc:4a:82:8a:54" )
 }
 import "pe"
 
@@ -234990,13 +234424,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_59A57E8Ba3Dcf2B6F59981Fda14B03 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "07e68e53-ffb8-5f12-ad0e-cf64a3c9cb72"
+		id = "c38b0657-dbcb-5c3e-945f-d126639ef45d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5828-L5841"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1eeeef14502daafb303d1c09d8e55fb4df57a6bf250d1adc7e53862f2f5d5824"
+		logic_hash = "v1_sha256_1eeeef14502daafb303d1c09d8e55fb4df57a6bf250d1adc7e53862f2f5d5824"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235006,7 +234440,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_59A57E8Ba3Dcf2B6F59981Fda14B03 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Medium LLC" and pe.signatures[i].serial=="59:a5:7e:8b:a3:dc:f2:b6:f5:99:81:fd:a1:4b:03")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Medium LLC" and pe.signatures [ i ] . serial == "59:a5:7e:8b:a3:dc:f2:b6:f5:99:81:fd:a1:4b:03" )
 }
 import "pe"
 
@@ -235015,13 +234449,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C79F817F082986Bef3209F6723C8Da97 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2e831cd7-6992-5b5f-ad84-52590f3cc65a"
+		id = "ee0dc3f5-21d9-57ee-b10b-ed6aa9a74dc3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5843-L5856"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b6dd9cb0d2383bce3ab13b6a660b3f5ba554a2bf1fce4aabb6dd36187cc57f45"
+		logic_hash = "v1_sha256_b6dd9cb0d2383bce3ab13b6a660b3f5ba554a2bf1fce4aabb6dd36187cc57f45"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235031,7 +234465,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C79F817F082986Bef3209F6723C8Da97 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Al-Faris group d.o.o." and pe.signatures[i].serial=="00:c7:9f:81:7f:08:29:86:be:f3:20:9f:67:23:c8:da:97")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Al-Faris group d.o.o." and pe.signatures [ i ] . serial == "00:c7:9f:81:7f:08:29:86:be:f3:20:9f:67:23:c8:da:97" )
 }
 import "pe"
 
@@ -235040,13 +234474,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Beb721Fcb3274C984479D6554Efe8F49 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "311b4a7a-3185-5c61-961e-bd7d9bca28dd"
+		id = "ca53a239-54f7-519c-aff8-00561d20e771"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5858-L5869"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fdb28b4f8cf79d067ee8dcfc3109ceae38f7952c6fb34e61f489924d97d67151"
+		logic_hash = "v1_sha256_fdb28b4f8cf79d067ee8dcfc3109ceae38f7952c6fb34e61f489924d97d67151"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235054,7 +234488,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Beb721Fcb3274C984479D6554Efe8F49 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CONFUSER" and pe.signatures[i].serial=="be:b7:21:fc:b3:27:4c:98:44:79:d6:55:4e:fe:8f:49")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CONFUSER" and pe.signatures [ i ] . serial == "be:b7:21:fc:b3:27:4c:98:44:79:d6:55:4e:fe:8f:49" )
 }
 import "pe"
 
@@ -235063,13 +234497,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C4188D6B70B4Bd3B977B19Abd04C1157 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f5b2b4cf-39a5-59c6-860e-b738a2acfd89"
+		id = "0d8fdc36-cbef-53bc-82ff-45403a5366e5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5871-L5882"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6ed619e18d749c2524ad3c1ddc3268f9ddf77feb3a3f2c5954ae4e7124d63c75"
+		logic_hash = "v1_sha256_6ed619e18d749c2524ad3c1ddc3268f9ddf77feb3a3f2c5954ae4e7124d63c75"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235077,7 +234511,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C4188D6B70B4Bd3B977B19Abd04C1157 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PRESTO Co., s.r.o." and pe.signatures[i].serial=="00:c4:18:8d:6b:70:b4:bd:3b:97:7b:19:ab:d0:4c:11:57")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PRESTO Co., s.r.o." and pe.signatures [ i ] . serial == "00:c4:18:8d:6b:70:b4:bd:3b:97:7b:19:ab:d0:4c:11:57" )
 }
 import "pe"
 
@@ -235086,13 +234520,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ad255D4Ebefa751F3782587396C08629 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "58e77872-5bd0-53b1-9595-c961c45e138c"
+		id = "cb979243-bd9b-5e9a-9fac-6d068e89d087"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5884-L5895"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cc51de3852257b12a780f80755c7ca21f5d82542649c65072fd9427271da12ef"
+		logic_hash = "v1_sha256_cc51de3852257b12a780f80755c7ca21f5d82542649c65072fd9427271da12ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235100,7 +234534,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ad255D4Ebefa751F3782587396C08629 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Ornitek" and pe.signatures[i].serial=="00:ad:25:5d:4e:be:fa:75:1f:37:82:58:73:96:c0:86:29")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Ornitek" and pe.signatures [ i ] . serial == "00:ad:25:5d:4e:be:fa:75:1f:37:82:58:73:96:c0:86:29" )
 }
 import "pe"
 
@@ -235109,13 +234543,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_084B6F19898214A02A5F32E6Ea69F0Fd : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "37149424-6ce7-56db-98c5-3895bf3f5c9b"
+		id = "9f7b64f0-ccd4-561f-8ff2-3172224ec4b8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5897-L5908"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "844339ec8aaf93e279b294830a842f007d97adc4be4f6910d143ee16e5710ed5"
+		logic_hash = "v1_sha256_844339ec8aaf93e279b294830a842f007d97adc4be4f6910d143ee16e5710ed5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235123,7 +234557,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_084B6F19898214A02A5F32E6Ea69F0Fd : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TORG-ALYANS, LLC" and pe.signatures[i].serial=="08:4b:6f:19:89:82:14:a0:2a:5f:32:e6:ea:69:f0:fd")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TORG-ALYANS, LLC" and pe.signatures [ i ] . serial == "08:4b:6f:19:89:82:14:a0:2a:5f:32:e6:ea:69:f0:fd" )
 }
 import "pe"
 
@@ -235132,13 +234566,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_24C1Ef800F275Ab2780280C595De3464 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0bd14ac3-9761-5ac4-8cdc-6212a92c5b5d"
+		id = "a9480505-3f6a-5790-86d3-a91e3ea1749c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5910-L5921"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "773fdb6d15a5bd1282dd9a48601b453b62de2e9832822858ad750c6462d6e116"
+		logic_hash = "v1_sha256_773fdb6d15a5bd1282dd9a48601b453b62de2e9832822858ad750c6462d6e116"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235146,7 +234580,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_24C1Ef800F275Ab2780280C595De3464 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HOLGAN LIMITED" and pe.signatures[i].serial=="24:c1:ef:80:0f:27:5a:b2:78:02:80:c5:95:de:34:64")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HOLGAN LIMITED" and pe.signatures [ i ] . serial == "24:c1:ef:80:0f:27:5a:b2:78:02:80:c5:95:de:34:64" )
 }
 import "pe"
 
@@ -235155,13 +234589,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6401831B46588B9D872B02076C3A7B00 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d651bbe4-7e50-51bc-8f96-a78b11846699"
+		id = "cf9006b4-82fb-5e61-9a05-f52ea211b636"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5923-L5934"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9a90c9d51dd6eb37bb3b6b17c5e3e5ebb6b6922efa14e3d8d60e72bcdb7b7259"
+		logic_hash = "v1_sha256_9a90c9d51dd6eb37bb3b6b17c5e3e5ebb6b6922efa14e3d8d60e72bcdb7b7259"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235169,7 +234603,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6401831B46588B9D872B02076C3A7B00 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTIV GROUP ApS" and pe.signatures[i].serial=="64:01:83:1b:46:58:8b:9d:87:2b:02:07:6c:3a:7b:00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ACTIV GROUP ApS" and pe.signatures [ i ] . serial == "64:01:83:1b:46:58:8b:9d:87:2b:02:07:6c:3a:7b:00" )
 }
 import "pe"
 
@@ -235178,13 +234612,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Cf1Ed2A6Ff4Bee621Efdf725Ea174B7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f3cb7bd9-9e28-5478-b65d-60915157dd3b"
+		id = "4d9c5184-1eba-5c0f-b432-c20824565e10"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5936-L5947"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2902b075f40f1413eee937c045e082a3141ec309f9d8e1dfd3a384050ea0776c"
+		logic_hash = "v1_sha256_2902b075f40f1413eee937c045e082a3141ec309f9d8e1dfd3a384050ea0776c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235192,7 +234626,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Cf1Ed2A6Ff4Bee621Efdf725Ea174B7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LEVEL LIST SP Z O O" and pe.signatures[i].serial=="0c:f1:ed:2a:6f:f4:be:e6:21:ef:df:72:5e:a1:74:b7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "LEVEL LIST SP Z O O" and pe.signatures [ i ] . serial == "0c:f1:ed:2a:6f:f4:be:e6:21:ef:df:72:5e:a1:74:b7" )
 }
 import "pe"
 
@@ -235201,13 +234635,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7Ed801843Fa001B8Add52D3A97B25931 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8dc9fbde-57bb-56ca-b925-902059612606"
+		id = "6d6fbf47-71b8-5659-9ec3-5737505a21ee"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5949-L5960"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2607dde1318b9b84056fc73664e4c1f82f20c23f311216e2201c3fdee0d1b6db"
+		logic_hash = "v1_sha256_2607dde1318b9b84056fc73664e4c1f82f20c23f311216e2201c3fdee0d1b6db"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235215,7 +234649,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7Ed801843Fa001B8Add52D3A97B25931 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AM El-Teknik ApS" and pe.signatures[i].serial=="7e:d8:01:84:3f:a0:01:b8:ad:d5:2d:3a:97:b2:59:31")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AM El-Teknik ApS" and pe.signatures [ i ] . serial == "7e:d8:01:84:3f:a0:01:b8:ad:d5:2d:3a:97:b2:59:31" )
 }
 import "pe"
 
@@ -235224,13 +234658,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0F0Ed5318848703405D40F7C62D0F39A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6baebaa7-275c-571d-b321-9a21d7799a33"
+		id = "f3db515c-c70a-563b-b7ae-40288298025b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5962-L5973"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "77bd8fd2dc48e2fc8abbf0f3411dfa8010326b6a9928fb392cce6e0fe8e9d309"
+		logic_hash = "v1_sha256_77bd8fd2dc48e2fc8abbf0f3411dfa8010326b6a9928fb392cce6e0fe8e9d309"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235238,7 +234672,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0F0Ed5318848703405D40F7C62D0F39A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SIES UPRAVLENIE PROTSESSAMI, OOO" and pe.signatures[i].serial=="0f:0e:d5:31:88:48:70:34:05:d4:0f:7c:62:d0:f3:9a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SIES UPRAVLENIE PROTSESSAMI, OOO" and pe.signatures [ i ] . serial == "0f:0e:d5:31:88:48:70:34:05:d4:0f:7c:62:d0:f3:9a" )
 }
 import "pe"
 
@@ -235247,13 +234681,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_537Aa4F1Bae48F052C3E57C3E2E1Ee61 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "33316c5e-b14f-50b5-8971-3a8b5a3c2497"
+		id = "6b48848e-6e20-5f7c-ad68-083b79ceea81"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5975-L5986"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "83d205998f43a2404146064e13726c149bc56fed6b886ee1812378c027f03da0"
+		logic_hash = "v1_sha256_83d205998f43a2404146064e13726c149bc56fed6b886ee1812378c027f03da0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235261,7 +234695,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_537Aa4F1Bae48F052C3E57C3E2E1Ee61 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALPHA AME LIMITED LLP" and pe.signatures[i].serial=="53:7a:a4:f1:ba:e4:8f:05:2c:3e:57:c3:e2:e1:ee:61")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALPHA AME LIMITED LLP" and pe.signatures [ i ] . serial == "53:7a:a4:f1:ba:e4:8f:05:2c:3e:57:c3:e2:e1:ee:61" )
 }
 import "pe"
 
@@ -235270,13 +234704,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_61B11Ef9726Ab2E78132E01Bd791B336 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5b830ab1-16d2-573c-81b7-b8b922af6f4b"
+		id = "a421b4fe-877a-58b8-997e-3ecd5166dcfa"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L5988-L5999"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "50c89d732409ff680734f481d858256001245c10345d9e6f1cbb51dcdc9c2cc9"
+		logic_hash = "v1_sha256_50c89d732409ff680734f481d858256001245c10345d9e6f1cbb51dcdc9c2cc9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235284,7 +234718,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_61B11Ef9726Ab2E78132E01Bd791B336 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Skalari" and pe.signatures[i].serial=="61:b1:1e:f9:72:6a:b2:e7:81:32:e0:1b:d7:91:b3:36")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Skalari" and pe.signatures [ i ] . serial == "61:b1:1e:f9:72:6a:b2:e7:81:32:e0:1b:d7:91:b3:36" )
 }
 import "pe"
 
@@ -235293,13 +234727,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E339C8069126Aa6313484Fea85B4B326F7B8860C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a8a6a285-98e1-5a2a-ab89-c67809fea3b2"
+		id = "d61603fd-0a97-5e0d-8d5b-0183bf2e4d38"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6001-L6012"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6f373c5a8f99893088fa1afffeccdf24ae6ed118d7bea9df43281073bd8e85bb"
+		logic_hash = "v1_sha256_6f373c5a8f99893088fa1afffeccdf24ae6ed118d7bea9df43281073bd8e85bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235307,7 +234741,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E339C8069126Aa6313484Fea85B4B326F7B8860C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Germany classer software" and pe.signatures[i].serial=="01")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Germany classer software" and pe.signatures [ i ] . serial == "01" )
 }
 import "pe"
 
@@ -235316,13 +234750,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_734D0Baf7A6B44743Ff852C8Ba7A751A7Ff0Ec73 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1dc06f6e-2152-516a-b9cc-0d95c098c88f"
+		id = "66027f3b-180d-5c7f-89d7-b4b022c553fb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6031-L6042"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "54620c58bae2c2f9859916a58b0fef4310dd27fdada663c28bb7d58bdaefc7c5"
+		logic_hash = "v1_sha256_54620c58bae2c2f9859916a58b0fef4310dd27fdada663c28bb7d58bdaefc7c5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235330,7 +234764,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_734D0Baf7A6B44743Ff852C8Ba7A751A7Ff0Ec73 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Transition software (C) 2018" and pe.signatures[i].serial=="01")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Transition software (C) 2018" and pe.signatures [ i ] . serial == "01" )
 }
 import "pe"
 
@@ -235339,14 +234773,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02Fa994D660De659Ee9037Ecb437D766 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cb2aa5d6-913e-5d74-a903-1cb88fb63b1c"
+		id = "5fa8d58c-29db-5247-8eb3-7585ab4f7e34"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6044-L6056"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "0868a2a7b5e276d3a4a40cdef994de934d33d62a689d7207a31fd57d012ef948"
-		logic_hash = "04244701311fcdc77b1e3a8f20621e474ed607be3d109c629280d528e2f24e1f"
+		logic_hash = "v1_sha256_04244701311fcdc77b1e3a8f20621e474ed607be3d109c629280d528e2f24e1f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235354,7 +234788,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_02Fa994D660De659Ee9037Ecb437D766 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Piriform Software Ltd" and pe.signatures[i].serial=="02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Piriform Software Ltd" and pe.signatures [ i ] . serial == "02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66" )
 }
 import "pe"
 
@@ -235363,14 +234797,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0B446546C36525Bf5F084F6Bbbba7097 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "608a410d-d34f-5eea-92db-3d156d01d360"
+		id = "3d794a26-9f12-53ff-8a3c-568e8cc31fba"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6058-L6071"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "3163ffc06848f6c48ac460ab844470ef85a07b847bf187c2c9cb26c14032a1a5"
-		logic_hash = "6dcf87b929c28cc013ee5c9de85aa026e335e1e5c38a440bc6b5dc11c6bf9a91"
+		logic_hash = "v1_sha256_6dcf87b929c28cc013ee5c9de85aa026e335e1e5c38a440bc6b5dc11c6bf9a91"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235378,7 +234812,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0B446546C36525Bf5F084F6Bbbba7097 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TeamViewer Germany GmbH" and pe.signatures[i].serial=="0b:44:65:46:c3:65:25:bf:5f:08:4f:6b:bb:ba:70:97" and 1608724800<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TeamViewer Germany GmbH" and pe.signatures [ i ] . serial == "0b:44:65:46:c3:65:25:bf:5f:08:4f:6b:bb:ba:70:97" and 1608724800 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -235387,13 +234821,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E4E795Fd1Fd25595B869Ce22Aa7Dc49F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8807c05d-c13b-58e8-9dda-c2eae6b5979c"
+		id = "99283db0-df1c-5e6b-ad2d-5645fe58da65"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6087-L6101"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0aef5e2af3059597d218c544bc0b56078e1ef924af0530c62aa12679e0816410"
+		logic_hash = "v1_sha256_0aef5e2af3059597d218c544bc0b56078e1ef924af0530c62aa12679e0816410"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235401,7 +234835,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E4E795Fd1Fd25595B869Ce22Aa7Dc49F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OASIS COURT LIMITED" and (pe.signatures[i].serial=="00:e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f" or pe.signatures[i].serial=="e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OASIS COURT LIMITED" and ( pe.signatures [ i ] . serial == "00:e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f" or pe.signatures [ i ] . serial == "e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f" ) )
 }
 import "pe"
 
@@ -235410,13 +234844,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008E0Fa6B464D466Df1B267504B04F7B27 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6de3aab7-7175-537b-8a33-56cb0662b7a6"
+		id = "2ecf6a3e-6020-51b6-ba28-b0e82011cc1c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6103-L6114"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1f992d81b63108840d457f3f1906524cf4a9d4bec4a91f7bc826fae9989d40e0"
+		logic_hash = "v1_sha256_1f992d81b63108840d457f3f1906524cf4a9d4bec4a91f7bc826fae9989d40e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235424,7 +234858,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008E0Fa6B464D466Df1B267504B04F7B27 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ApcWCjFsGXwbWUJrKZ" and pe.signatures[i].serial=="00:8e:0f:a6:b4:64:d4:66:df:1b:26:75:04:b0:4f:7b:27")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ApcWCjFsGXwbWUJrKZ" and pe.signatures [ i ] . serial == "00:8e:0f:a6:b4:64:d4:66:df:1b:26:75:04:b0:4f:7b:27" )
 }
 import "pe"
 
@@ -235433,13 +234867,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_559Cb90Fd16E9D1Ad375F050Ab6A6616 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8b2ed295-5aae-5ced-9603-8125b4e261f9"
+		id = "8fd76e44-95c9-51f0-8be1-286409ca7e7a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6116-L6127"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a91f23e2281efb95b780b26018f1c89485a87c6541ac84025dad3e6dd55c742e"
+		logic_hash = "v1_sha256_a91f23e2281efb95b780b26018f1c89485a87c6541ac84025dad3e6dd55c742e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235447,7 +234881,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_559Cb90Fd16E9D1Ad375F050Ab6A6616 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shenzhen Smartspace Software technology Co.,Limited" and pe.signatures[i].serial=="55:9c:b9:0f:d1:6e:9d:1a:d3:75:f0:50:ab:6a:66:16")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Shenzhen Smartspace Software technology Co.,Limited" and pe.signatures [ i ] . serial == "55:9c:b9:0f:d1:6e:9d:1a:d3:75:f0:50:ab:6a:66:16" )
 }
 import "pe"
 
@@ -235456,13 +234890,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Eb95A7Bd7553533D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b9198469-4eba-552d-a8f5-5841893ff85e"
+		id = "24ada41b-9315-5980-a04e-e9311e6e35c0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6159-L6170"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e646346d94791c2a86a7240d4cf1f9138a30ca583b021ae5b17471cef20a98de"
+		logic_hash = "v1_sha256_e646346d94791c2a86a7240d4cf1f9138a30ca583b021ae5b17471cef20a98de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235470,7 +234904,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Eb95A7Bd7553533D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\x02C\\x02\\x97\\x04\\x17\\x04\\x1e\\x04.\\x02\\x90\\x00g\\x02\\x94\\x02\\xae\\x00p\\x04 \\x00K\\x04J\\x02\\x88\\x042\\x02K\\x02\\xa3" and pe.signatures[i].serial=="eb:95:a7:bd:75:53:53:3d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\x02C\\x02\\x97\\x04\\x17\\x04\\x1e\\x04.\\x02\\x90\\x00g\\x02\\x94\\x02\\xae\\x00p\\x04 \\x00K\\x04J\\x02\\x88\\x042\\x02K\\x02\\xa3" and pe.signatures [ i ] . serial == "eb:95:a7:bd:75:53:53:3d" )
 }
 import "pe"
 
@@ -235479,14 +234913,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A1F3A057A1Dce4Bf7D76D0C7Adf837E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c4829ec0-b6be-5701-a4cf-e4b1205240b3"
+		id = "efc595d9-6f06-562d-aa0c-985ed155992f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6172-L6184"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "2df05a70d3ce646285a0f888df15064b4e73034b67e06d9a4f4da680ed62e926"
-		logic_hash = "de9ae66e497730db54fc21a745426c687c3a4d9819c08bc1dca0b42a5b8070ac"
+		logic_hash = "v1_sha256_de9ae66e497730db54fc21a745426c687c3a4d9819c08bc1dca0b42a5b8070ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235494,7 +234928,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A1F3A057A1Dce4Bf7D76D0C7Adf837E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Qihu Technology Co., Ltd." and pe.signatures[i].serial=="0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Beijing Qihu Technology Co., Ltd." and pe.signatures [ i ] . serial == "0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e" )
 }
 import "pe"
 
@@ -235503,13 +234937,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00849Ea0945Dd2Ea2Dc3Cc2486578A5715 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8584af2e-6b1e-5141-abbf-84e414ffaead"
+		id = "647773b1-8da4-5e26-b871-1e5a2173d9dd"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6186-L6197"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "824744510e73cd6717e3626a5a250466bfb5817fd7172fc32466c2e68e20947b"
+		logic_hash = "v1_sha256_824744510e73cd6717e3626a5a250466bfb5817fd7172fc32466c2e68e20947b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235517,7 +234951,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00849Ea0945Dd2Ea2Dc3Cc2486578A5715 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Biglin" and pe.signatures[i].serial=="00:84:9e:a0:94:5d:d2:ea:2d:c3:cc:24:86:57:8a:57:15")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Biglin" and pe.signatures [ i ] . serial == "00:84:9e:a0:94:5d:d2:ea:2d:c3:cc:24:86:57:8a:57:15" )
 }
 import "pe"
 
@@ -235526,14 +234960,14 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0537F25A88E24Cafdd7919Fa301E8146 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b0dd33b4-2040-5021-bebc-5ca26d75f14c"
+		id = "d2607803-5620-5cdb-9e20-9c1bba215135"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6215-L6227"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
 		hash = "72ac61e6311f2a6430d005052dbc0cc58587e7b75722b5e34a71081370f4ddd5"
-		logic_hash = "8cd68612354a756c4a52d6baea9ef6ed74c94f5fcf25baa2f72c1131e0828f84"
+		logic_hash = "v1_sha256_8cd68612354a756c4a52d6baea9ef6ed74c94f5fcf25baa2f72c1131e0828f84"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235541,7 +234975,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0537F25A88E24Cafdd7919Fa301E8146 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Avira Operations GmbH & Co. KG" and pe.signatures[i].serial=="05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Avira Operations GmbH & Co. KG" and pe.signatures [ i ] . serial == "05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46" )
 }
 import "pe"
 
@@ -235550,13 +234984,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2E4A279Bde2Eb688E8Ab30F5904Fa875 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3fd40418-9efe-5dfe-a4e2-01ff9c46a4d5"
+		id = "ecaec84a-2b79-519d-9183-fa1f75eb8740"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6229-L6240"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "768b2cb64f7ce359285721bbfd2f2f6aac4065ec234dc091933d962a7f0ab79a"
+		logic_hash = "v1_sha256_768b2cb64f7ce359285721bbfd2f2f6aac4065ec234dc091933d962a7f0ab79a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235564,7 +234998,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2E4A279Bde2Eb688E8Ab30F5904Fa875 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lespeed Technology Co., Ltd" and pe.signatures[i].serial=="2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Lespeed Technology Co., Ltd" and pe.signatures [ i ] . serial == "2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75" )
 }
 import "pe"
 
@@ -235573,13 +235007,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fbe6758Ae785D7C678A4Ad8De5C3F7E6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4d080acc-fb11-5e4d-9c59-562f30376936"
+		id = "03e07ca5-c9d8-5f62-979d-a90f0fc14092"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6242-L6253"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c6d84435c5c4f71696ce0414c87216bbb0603cb75d6e37abaf73e3708904032e"
+		logic_hash = "v1_sha256_c6d84435c5c4f71696ce0414c87216bbb0603cb75d6e37abaf73e3708904032e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235587,7 +235021,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fbe6758Ae785D7C678A4Ad8De5C3F7E6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HORUM" and pe.signatures[i].serial=="fb:e6:75:8a:e7:85:d7:c6:78:a4:ad:8d:e5:c3:f7:e6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HORUM" and pe.signatures [ i ] . serial == "fb:e6:75:8a:e7:85:d7:c6:78:a4:ad:8d:e5:c3:f7:e6" )
 }
 import "pe"
 
@@ -235596,13 +235030,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A73B6D821F84Db4451D6Eedd62C42848 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c7533bc5-7d83-550e-a36c-eb459f2be842"
+		id = "348955b3-4acf-570f-a204-c754ad1b937d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6255-L6266"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "448527bcbe2851bffefabe06a58e3ca68c092a2080041c51acacad3d5119aa0c"
+		logic_hash = "v1_sha256_448527bcbe2851bffefabe06a58e3ca68c092a2080041c51acacad3d5119aa0c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235610,7 +235044,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A73B6D821F84Db4451D6Eedd62C42848 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mht Holding Vinderup ApS" and pe.signatures[i].serial=="00:a7:3b:6d:82:1f:84:db:44:51:d6:ee:dd:62:c4:28:48")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Mht Holding Vinderup ApS" and pe.signatures [ i ] . serial == "00:a7:3b:6d:82:1f:84:db:44:51:d6:ee:dd:62:c4:28:48" )
 }
 import "pe"
 
@@ -235619,13 +235053,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_500D76B1B4Bfaf4A131F027668Fea2D3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "670138fc-7f2f-5145-8488-196912292ef7"
+		id = "fbf0b28c-7d5d-5bd0-87c2-f75e65bdbe76"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6268-L6279"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a4f626e5ae9d273723814b0d944b067e70714e10776600a1bd0f90af31c1146a"
+		logic_hash = "v1_sha256_a4f626e5ae9d273723814b0d944b067e70714e10776600a1bd0f90af31c1146a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235633,7 +235067,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_500D76B1B4Bfaf4A131F027668Fea2D3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FviSBJQX" and pe.signatures[i].serial=="50:0d:76:b1:b4:bf:af:4a:13:1f:02:76:68:fe:a2:d3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FviSBJQX" and pe.signatures [ i ] . serial == "50:0d:76:b1:b4:bf:af:4a:13:1f:02:76:68:fe:a2:d3" )
 }
 import "pe"
 
@@ -235642,13 +235076,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_54Cd7Ae1C27F1421136Ed25088F4979A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2f7a0a34-6650-59d1-acf9-5ded0317ee6f"
+		id = "b7975ae7-ef32-56f6-9a31-513650dc19a0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6281-L6292"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2b94ccd7f85a2b21edaf4b28f14827b399cdb82307c20320f77eb775c05751f1"
+		logic_hash = "v1_sha256_2b94ccd7f85a2b21edaf4b28f14827b399cdb82307c20320f77eb775c05751f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235656,7 +235090,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_54Cd7Ae1C27F1421136Ed25088F4979A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABBYMAJUTA LTD LIMITED" and pe.signatures[i].serial=="54:cd:7a:e1:c2:7f:14:21:13:6e:d2:50:88:f4:97:9a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ABBYMAJUTA LTD LIMITED" and pe.signatures [ i ] . serial == "54:cd:7a:e1:c2:7f:14:21:13:6e:d2:50:88:f4:97:9a" )
 }
 import "pe"
 
@@ -235665,13 +235099,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_65Efa92A4164A3A2D888B5Cf8Ff073C8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "07392a87-7d81-58c1-8dd6-2a9cbc8caa6b"
+		id = "972f6c2f-5a9b-5614-8d81-7ea1946ef035"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6294-L6305"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "189f154d5b71bea9c06cd2c79d2460a1fb8cc9e0670a9ef8545e3abad80c8a06"
+		logic_hash = "v1_sha256_189f154d5b71bea9c06cd2c79d2460a1fb8cc9e0670a9ef8545e3abad80c8a06"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235679,7 +235113,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_65Efa92A4164A3A2D888B5Cf8Ff073C8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ghisler Software GmbH" and pe.signatures[i].serial=="65:ef:a9:2a:41:64:a3:a2:d8:88:b5:cf:8f:f0:73:c8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ghisler Software GmbH" and pe.signatures [ i ] . serial == "65:ef:a9:2a:41:64:a3:a2:d8:88:b5:cf:8f:f0:73:c8" )
 }
 import "pe"
 
@@ -235688,13 +235122,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ad0A958Cdf188Bed43154A54Bf23Afba : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0b42f6fd-732c-5802-b616-774a1da9e3aa"
+		id = "5f7ce373-0e27-58fb-a9ca-ef327c60c9e2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6307-L6321"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6031cb276cbb419789a3f3e57654dd9569feb612b0aebc2b72ae8b644f07bca9"
+		logic_hash = "v1_sha256_6031cb276cbb419789a3f3e57654dd9569feb612b0aebc2b72ae8b644f07bca9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235702,7 +235136,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ad0A958Cdf188Bed43154A54Bf23Afba : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RHM Ltd" and (pe.signatures[i].serial=="ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba" or pe.signatures[i].serial=="00:ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "RHM Ltd" and ( pe.signatures [ i ] . serial == "ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba" or pe.signatures [ i ] . serial == "00:ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba" ) )
 }
 import "pe"
 
@@ -235711,13 +235145,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_05Abac07F8D0Ce567F7D75Ee047Efee2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "17355de3-08a9-585d-bc4f-fd16ff59e2a2"
+		id = "742e4a94-d7ce-5311-b026-4b5330579d65"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6323-L6334"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0196ebd0b5821863c99676907a972e214f46411650fe20557e9f919609d12659"
+		logic_hash = "v1_sha256_0196ebd0b5821863c99676907a972e214f46411650fe20557e9f919609d12659"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235725,7 +235159,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_05Abac07F8D0Ce567F7D75Ee047Efee2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ultrareach Internet Corp." and pe.signatures[i].serial=="05:ab:ac:07:f8:d0:ce:56:7f:7d:75:ee:04:7e:fe:e2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ultrareach Internet Corp." and pe.signatures [ i ] . serial == "05:ab:ac:07:f8:d0:ce:56:7f:7d:75:ee:04:7e:fe:e2" )
 }
 import "pe"
 
@@ -235734,13 +235168,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_62165B335C13A1A847Ce9Acff2B29368 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "62cd9a29-023d-5ff4-89cf-a2e74ec66ac4"
+		id = "277197dc-e5f3-5c87-9837-dd658a3781f0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6336-L6347"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "19e189c49f435f8b2aca0944d0f648a4126f83b7498982a262230e2f69ada8b7"
+		logic_hash = "v1_sha256_19e189c49f435f8b2aca0944d0f648a4126f83b7498982a262230e2f69ada8b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235748,7 +235182,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_62165B335C13A1A847Ce9Acff2B29368 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "t55555Prh" and pe.signatures[i].serial=="62:16:5b:33:5c:13:a1:a8:47:ce:9a:cf:f2:b2:93:68")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "t55555Prh" and pe.signatures [ i ] . serial == "62:16:5b:33:5c:13:a1:a8:47:ce:9a:cf:f2:b2:93:68" )
 }
 import "pe"
 
@@ -235757,13 +235191,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4Cdffb4F02C55Ae60A099652605Da274 : FILE
 	meta:
 		description = "Enigma Protector Demo Certificate"
 		author = "ditekSHen"
-		id = "843929be-68e5-56b0-99fc-f5d71b91c3cf"
+		id = "86fb23c7-7ba1-58f5-9107-4089e988b607"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6366-L6377"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1b655f42302bed2091aaa5d37156c68eaf812f0c287bf42b24942a8b845b7476"
+		logic_hash = "v1_sha256_1b655f42302bed2091aaa5d37156c68eaf812f0c287bf42b24942a8b845b7476"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235771,7 +235205,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4Cdffb4F02C55Ae60A099652605Da274 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DEMO" and pe.signatures[i].serial=="4c:df:fb:4f:02:c5:5a:e6:0a:09:96:52:60:5d:a2:74")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DEMO" and pe.signatures [ i ] . serial == "4c:df:fb:4f:02:c5:5a:e6:0a:09:96:52:60:5d:a2:74" )
 }
 import "pe"
 
@@ -235780,13 +235214,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_25Ad5Ae68C38Ad1021086F4Ffc8Ba470 : FILE
 	meta:
 		description = "Enigma Protector CA Certificate"
 		author = "ditekSHen"
-		id = "6f1c6d3a-72a1-5c70-9c7d-1616b13767cd"
+		id = "54675b34-368f-55ba-abc1-cfd94fa9d591"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6379-L6390"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "80b67b804e47fba825fabfee39f9a0aae78a4465b088c28b6f6972acd614bb89"
+		logic_hash = "v1_sha256_80b67b804e47fba825fabfee39f9a0aae78a4465b088c28b6f6972acd614bb89"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235794,7 +235228,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_25Ad5Ae68C38Ad1021086F4Ffc8Ba470 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Enigma Protector CA" and pe.signatures[i].serial=="25:ad:5a:e6:8c:38:ad:10:21:08:6f:4f:fc:8b:a4:70")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Enigma Protector CA" and pe.signatures [ i ] . serial == "25:ad:5a:e6:8c:38:ad:10:21:08:6f:4f:fc:8b:a4:70" )
 }
 import "pe"
 
@@ -235803,13 +235237,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_277Cd16De5D61B9398B645Afe41C09C7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d5ada3bf-322a-5794-aff7-75ff8dd9a7d1"
+		id = "b2fd2a7e-1bdb-50e6-b9e4-57de73c47211"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6392-L6403"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dccfd52a3bcc11897d05f5450600dbd2f1f699732341cebed6dda37a76fd5f2d"
+		logic_hash = "v1_sha256_dccfd52a3bcc11897d05f5450600dbd2f1f699732341cebed6dda37a76fd5f2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235817,7 +235251,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_277Cd16De5D61B9398B645Afe41C09C7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE SIGN COMPANY LIMITED" and pe.signatures[i].serial=="27:7c:d1:6d:e5:d6:1b:93:98:b6:45:af:e4:1c:09:c7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "THE SIGN COMPANY LIMITED" and pe.signatures [ i ] . serial == "27:7c:d1:6d:e5:d6:1b:93:98:b6:45:af:e4:1c:09:c7" )
 }
 import "pe"
 
@@ -235826,13 +235260,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_066276Af2F2C7E246D3B1Cab1B4Aa42E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "32b8e28b-361f-53e5-b06c-504dd9e86ae9"
+		id = "faf181d0-6935-545b-a73d-724ec0f35c78"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6405-L6416"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2a554105ae99de388621adefb2f53d2d0873ac3175ca2ccf00fc6a498ea2fd29"
+		logic_hash = "v1_sha256_2a554105ae99de388621adefb2f53d2d0873ac3175ca2ccf00fc6a498ea2fd29"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235840,7 +235274,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_066276Af2F2C7E246D3B1Cab1B4Aa42E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IQ Trade ApS" and pe.signatures[i].serial=="06:62:76:af:2f:2c:7e:24:6d:3b:1c:ab:1b:4a:a4:2e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IQ Trade ApS" and pe.signatures [ i ] . serial == "06:62:76:af:2f:2c:7e:24:6d:3b:1c:ab:1b:4a:a4:2e" )
 }
 import "pe"
 
@@ -235849,13 +235283,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_289051A83F350A2C600187C99B6C0A73 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f84a7749-a487-52e5-813b-e376ccde13d1"
+		id = "62ef3428-be9f-5f7e-ae7a-d7a5d9d6000c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6418-L6429"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f094e923dc53cc1edc6ac83cf69fb60fd3c564606a5bfb68facb482918399799"
+		logic_hash = "v1_sha256_f094e923dc53cc1edc6ac83cf69fb60fd3c564606a5bfb68facb482918399799"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235863,7 +235297,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_289051A83F350A2C600187C99B6C0A73 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HALL HAULAGE LTD LTD" and pe.signatures[i].serial=="28:90:51:a8:3f:35:0a:2c:60:01:87:c9:9b:6c:0a:73")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HALL HAULAGE LTD LTD" and pe.signatures [ i ] . serial == "28:90:51:a8:3f:35:0a:2c:60:01:87:c9:9b:6c:0a:73" )
 }
 import "pe"
 
@@ -235872,13 +235306,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_25A28E418Ef2D55B87Ee715B42Afbedb : FILE
 	meta:
 		description = "VMProtect Software CA Certificate"
 		author = "ditekSHen"
-		id = "dc0b80f1-c720-5d83-a92b-144b1fd05138"
+		id = "3ab251ec-e18c-5b40-b2c6-a5e7d9b48d25"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6431-L6442"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "be40d3b202b400eda7e78280b674823f789e292a35f0892ab3a323d1b055e789"
+		logic_hash = "v1_sha256_be40d3b202b400eda7e78280b674823f789e292a35f0892ab3a323d1b055e789"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235886,7 +235320,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_25A28E418Ef2D55B87Ee715B42Afbedb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Enigma Protector CA" and pe.signatures[i].serial=="25:a2:8e:41:8e:f2:d5:5b:87:ee:71:5b:42:af:be:db")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Enigma Protector CA" and pe.signatures [ i ] . serial == "25:a2:8e:41:8e:f2:d5:5b:87:ee:71:5b:42:af:be:db" )
 }
 import "pe"
 
@@ -235895,13 +235329,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Vmprotect_Client : FILE
 	meta:
 		description = "VMProtect Client Certificate"
 		author = "ditekSHen"
-		id = "f9fd6478-0fe5-54b6-ba33-79c02eb9ad04"
+		id = "3633d634-5ffe-58eb-906d-7d0a563c8f77"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6444-L6455"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d55d9fe608d5ff357a3bcf700a3d8bd9556f83c7c792b50d2276228a77209346"
+		logic_hash = "v1_sha256_d55d9fe608d5ff357a3bcf700a3d8bd9556f83c7c792b50d2276228a77209346"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235910,7 +235344,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Vmprotect_Client : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VMProtect Client ")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VMProtect Client " )
 }
 import "pe"
 
@@ -235919,13 +235353,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_44Fe73F320Aa8B7B4F5Ca910Aa22333A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fb7a2f49-d5b4-59af-b64b-27624ff18323"
+		id = "633a1c6a-8567-5e3d-8710-ed3dc9a7bbff"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6457-L6468"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a456cd32eed6c1f037bc565e7a43f2a5a2237749afc31f6b7a8b8d7a657973c6"
+		logic_hash = "v1_sha256_a456cd32eed6c1f037bc565e7a43f2a5a2237749afc31f6b7a8b8d7a657973c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235933,7 +235367,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_44Fe73F320Aa8B7B4F5Ca910Aa22333A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Alpeks LLC" and pe.signatures[i].serial=="44:fe:73:f3:20:aa:8b:7b:4f:5c:a9:10:aa:22:33:3a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Alpeks LLC" and pe.signatures [ i ] . serial == "44:fe:73:f3:20:aa:8b:7b:4f:5c:a9:10:aa:22:33:3a" )
 }
 import "pe"
 
@@ -235942,13 +235376,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Df45B36C9D0Bd248C3F9494E7Ca822 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "95100ec5-01bf-5a5a-a703-b10d320beed1"
+		id = "a5d90391-d52f-5627-b027-fa1275e099f5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6470-L6481"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "40f4ad4183ca0bc76295c535a9286994ef0e3f8ac932372328016d543bb58ab5"
+		logic_hash = "v1_sha256_40f4ad4183ca0bc76295c535a9286994ef0e3f8ac932372328016d543bb58ab5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235956,7 +235390,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Df45B36C9D0Bd248C3F9494E7Ca822 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MPO STORITVE d.o.o." and pe.signatures[i].serial=="df:45:b3:6c:9d:0b:d2:48:c3:f9:49:4e:7c:a8:22")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MPO STORITVE d.o.o." and pe.signatures [ i ] . serial == "df:45:b3:6c:9d:0b:d2:48:c3:f9:49:4e:7c:a8:22" )
 }
 import "pe"
 
@@ -235965,13 +235399,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Adbb8Aebf8B53C6713Abaca38Be9Bf0A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b3edea3e-8844-58a5-a600-b0695869b2c3"
+		id = "077b3bee-f8e0-56cd-b627-a6ac537117df"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6483-L6497"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d5e85240df57bf3b5ec4f690943f71609aaf2fb2f751b2919b6024b4247cd571"
+		logic_hash = "v1_sha256_d5e85240df57bf3b5ec4f690943f71609aaf2fb2f751b2919b6024b4247cd571"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -235979,7 +235413,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Adbb8Aebf8B53C6713Abaca38Be9Bf0A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Konstant LLC" and (pe.signatures[i].serial=="ad:bb:8a:eb:f8:b5:3c:67:13:ab:ac:a3:8b:e9:bf:0a" or pe.signatures[i].serial=="00:ad:bb:8a:eb:f8:b5:3c:67:13:ab:ac:a3:8b:e9:bf:0a"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Konstant LLC" and ( pe.signatures [ i ] . serial == "ad:bb:8a:eb:f8:b5:3c:67:13:ab:ac:a3:8b:e9:bf:0a" or pe.signatures [ i ] . serial == "00:ad:bb:8a:eb:f8:b5:3c:67:13:ab:ac:a3:8b:e9:bf:0a" ) )
 }
 import "pe"
 
@@ -235988,13 +235422,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Ffc9825644Caf5B1F521780C5C7F42C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b9ed2db5-b7d4-5d74-bb11-1e8b1dfe1648"
+		id = "4ac5edd1-d3e7-5c71-80cf-6ef07e4f2330"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6499-L6510"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9866608a02a043e6873c6fbd231cd733b3b5a1e5b77e3205e5cf53f5ae2bcadd"
+		logic_hash = "v1_sha256_9866608a02a043e6873c6fbd231cd733b3b5a1e5b77e3205e5cf53f5ae2bcadd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236002,7 +235436,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Ffc9825644Caf5B1F521780C5C7F42C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTIVUS LIMITED" and pe.signatures[i].serial=="1f:fc:98:25:64:4c:af:5b:1f:52:17:80:c5:c7:f4:2c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ACTIVUS LIMITED" and pe.signatures [ i ] . serial == "1f:fc:98:25:64:4c:af:5b:1f:52:17:80:c5:c7:f4:2c" )
 }
 import "pe"
 
@@ -236011,13 +235445,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3112C69D460C781Fd649C71E61Bfec82 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a8092e36-92f9-5cb0-a427-74d40a39d94f"
+		id = "3a684a7b-64d7-5b99-9ff0-61312e674088"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6512-L6523"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9662a01369bc01367bcae7813b3fcb3050721471dd247885bcab8918de7c6b99"
+		logic_hash = "v1_sha256_9662a01369bc01367bcae7813b3fcb3050721471dd247885bcab8918de7c6b99"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236025,7 +235459,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3112C69D460C781Fd649C71E61Bfec82 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KREATURHANDLER BJARNE ANDERSEN ApS" and pe.signatures[i].serial=="31:12:c6:9d:46:0c:78:1f:d6:49:c7:1e:61:bf:ec:82")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KREATURHANDLER BJARNE ANDERSEN ApS" and pe.signatures [ i ] . serial == "31:12:c6:9d:46:0c:78:1f:d6:49:c7:1e:61:bf:ec:82" )
 }
 import "pe"
 
@@ -236034,13 +235468,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F64E5B34Dc0E4893495D3B9Fd9Cde4B7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d408b662-6328-55a8-ab64-42ea8f18c1cf"
+		id = "a8237220-bf9a-5953-a475-5e80999bdc6c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6525-L6536"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "497e63e4a19fa5b05d1098177dc73ae2255d4608d97e1001461dc4f8edced169"
+		logic_hash = "v1_sha256_497e63e4a19fa5b05d1098177dc73ae2255d4608d97e1001461dc4f8edced169"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236048,7 +235482,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F64E5B34Dc0E4893495D3B9Fd9Cde4B7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMASoft" and pe.signatures[i].serial=="f6:4e:5b:34:dc:0e:48:93:49:5d:3b:9f:d9:cd:e4:b7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMASoft" and pe.signatures [ i ] . serial == "f6:4e:5b:34:dc:0e:48:93:49:5d:3b:9f:d9:cd:e4:b7" )
 }
 import "pe"
 
@@ -236057,13 +235491,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Bec31A0A40D2E834E51Ae704E1Bf9D3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9228c13e-b380-5867-ad1f-e483c8977196"
+		id = "02a597ac-b338-55c6-95a2-b9aef65ee80a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6538-L6549"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f1fdd6e76deea106db9fc4ef0916b2cecd6edb3849847946f15c194a9028a76e"
+		logic_hash = "v1_sha256_f1fdd6e76deea106db9fc4ef0916b2cecd6edb3849847946f15c194a9028a76e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236071,7 +235505,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Bec31A0A40D2E834E51Ae704E1Bf9D3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "whatsupfuckers" and pe.signatures[i].serial=="6b:ec:31:a0:a4:0d:2e:83:4e:51:ae:70:4e:1b:f9:d3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "whatsupfuckers" and pe.signatures [ i ] . serial == "6b:ec:31:a0:a4:0d:2e:83:4e:51:ae:70:4e:1b:f9:d3" )
 }
 import "pe"
 
@@ -236080,13 +235514,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_9Fac361Ee3304079 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4143adb3-bd23-549c-b862-0db3583be161"
+		id = "3016bfa1-4572-51a8-915f-c59922776d18"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6551-L6565"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a32fe70e2242e587007c3985420c3bea25d35aff37f62881cc386bdeff22ca93"
+		logic_hash = "v1_sha256_a32fe70e2242e587007c3985420c3bea25d35aff37f62881cc386bdeff22ca93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236094,7 +235528,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_9Fac361Ee3304079 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and (pe.signatures[i].serial=="9f:ac:36:1e:e3:30:40:79" or pe.signatures[i].serial=="00:9f:ac:36:1e:e3:30:40:79"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "2021945 Ontario Inc." and ( pe.signatures [ i ] . serial == "9f:ac:36:1e:e3:30:40:79" or pe.signatures [ i ] . serial == "00:9f:ac:36:1e:e3:30:40:79" ) )
 }
 import "pe"
 
@@ -236103,13 +235537,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1895De749994D0Db : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2a8129ac-9838-5798-a115-ec03c1b3c205"
+		id = "b28b6f76-bb51-59af-97c7-942248cc7261"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6567-L6578"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0b5e7998bd6303a12a8681bca88b7802caa08d9272196b830ffac5573b6e3772"
+		logic_hash = "v1_sha256_0b5e7998bd6303a12a8681bca88b7802caa08d9272196b830ffac5573b6e3772"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236117,7 +235551,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1895De749994D0Db : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and pe.signatures[i].serial=="18:95:de:74:99:94:d0:db")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "2021945 Ontario Inc." and pe.signatures [ i ] . serial == "18:95:de:74:99:94:d0:db" )
 }
 import "pe"
 
@@ -236126,13 +235560,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_28B691272719B1Ee : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5a8cf540-701f-5f94-b630-ccbaa62abfdd"
+		id = "b2296f4f-5626-5986-b602-933d2f3d2b9d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6580-L6591"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b2224f8107e7c50334c7e12963e4e37c0a6824c49842afb314c12d6de9d6bc5e"
+		logic_hash = "v1_sha256_b2224f8107e7c50334c7e12963e4e37c0a6824c49842afb314c12d6de9d6bc5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236140,7 +235574,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_28B691272719B1Ee : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and pe.signatures[i].serial=="28:b6:91:27:27:19:b1:ee")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "2021945 Ontario Inc." and pe.signatures [ i ] . serial == "28:b6:91:27:27:19:b1:ee" )
 }
 import "pe"
 
@@ -236149,13 +235583,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E3B80C0932B52A708477939B0D32186F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "41525cdd-f65a-5aad-bd99-1cdcf8b11981"
+		id = "fc7bd59c-742f-5885-9497-206c71072df4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6593-L6607"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a0a95c20c5c82b460ddef686731d1053181cb5066bbb4f585a4f402f50efe030"
+		logic_hash = "v1_sha256_a0a95c20c5c82b460ddef686731d1053181cb5066bbb4f585a4f402f50efe030"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236163,7 +235597,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E3B80C0932B52A708477939B0D32186F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BISOYETUTU LTD LIMITED" and (pe.signatures[i].serial=="e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f" or pe.signatures[i].serial=="00:e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BISOYETUTU LTD LIMITED" and ( pe.signatures [ i ] . serial == "e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f" or pe.signatures [ i ] . serial == "00:e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f" ) )
 }
 import "pe"
 
@@ -236172,13 +235606,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C667Ffe3A5B0A5Ae7Cf3A9E41682E91B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "509dcc22-1202-5b6e-a602-6b06c282b28d"
+		id = "2adf42ab-198b-5b43-bd26-bd79ce2da493"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6609-L6623"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6d3d0cfb42758f917b003f7979f7123c1789c9e9b4e01b1aebf265a298eac08f"
+		logic_hash = "v1_sha256_6d3d0cfb42758f917b003f7979f7123c1789c9e9b4e01b1aebf265a298eac08f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236186,7 +235620,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00C667Ffe3A5B0A5Ae7Cf3A9E41682E91B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NAILS UNLIMITED LIMITED" and (pe.signatures[i].serial=="c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b" or pe.signatures[i].serial=="00:c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NAILS UNLIMITED LIMITED" and ( pe.signatures [ i ] . serial == "c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b" or pe.signatures [ i ] . serial == "00:c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b" ) )
 }
 import "pe"
 
@@ -236195,13 +235629,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Sagsanlgs : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b08e46a5-de76-5711-98dc-2144c7bbe66f"
+		id = "077a4847-de22-55c6-a1da-cd18eed827ba"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6639-L6650"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3ab10d8605f501f3c4f3a3afa31c5b001e03354846ff1953e7e36ceb9b564bf6"
+		logic_hash = "v1_sha256_3ab10d8605f501f3c4f3a3afa31c5b001e03354846ff1953e7e36ceb9b564bf6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236209,7 +235643,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Sagsanlgs : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sagsanlgs" and pe.signatures[i].serial=="00")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Sagsanlgs" and pe.signatures [ i ] . serial == "00" )
 }
 import "pe"
 
@@ -236218,13 +235652,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00989A33B72A2Aa29E32D0A5E155C53963 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "59fcdc74-ca44-5d30-b9b0-5e9c7a3b50f3"
+		id = "e12ad0d4-0db3-5b70-8da1-9ca24a993320"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6668-L6682"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f016093cd512bcbf31814ff1619441e476b3988d0670f469f6311eda37ae295d"
+		logic_hash = "v1_sha256_f016093cd512bcbf31814ff1619441e476b3988d0670f469f6311eda37ae295d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236232,7 +235666,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00989A33B72A2Aa29E32D0A5E155C53963 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TAKE CARE SP Z O O" and (pe.signatures[i].serial=="98:9a:33:b7:2a:2a:a2:9e:32:d0:a5:e1:55:c5:39:63" or pe.signatures[i].serial=="00:98:9a:33:b7:2a:2a:a2:9e:32:d0:a5:e1:55:c5:39:63"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TAKE CARE SP Z O O" and ( pe.signatures [ i ] . serial == "98:9a:33:b7:2a:2a:a2:9e:32:d0:a5:e1:55:c5:39:63" or pe.signatures [ i ] . serial == "00:98:9a:33:b7:2a:2a:a2:9e:32:d0:a5:e1:55:c5:39:63" ) )
 }
 import "pe"
 
@@ -236241,13 +235675,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B8F726508Cf1D7B7913Bf4Bbd1E5C19C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0acaaed9-ba18-56b0-95b9-e05181843129"
+		id = "b9680c05-f12f-51ca-9b34-766677719f0d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6684-L6698"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "71eb50a47465d69dbdd488c57b3fd9f70a4dd3b0bc086ed14038320928bc947e"
+		logic_hash = "v1_sha256_71eb50a47465d69dbdd488c57b3fd9f70a4dd3b0bc086ed14038320928bc947e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236255,7 +235689,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00B8F726508Cf1D7B7913Bf4Bbd1E5C19C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TMerkuri LLC" and (pe.signatures[i].serial=="b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c" or pe.signatures[i].serial=="00:b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TMerkuri LLC" and ( pe.signatures [ i ] . serial == "b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c" or pe.signatures [ i ] . serial == "00:b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c" ) )
 }
 import "pe"
 
@@ -236264,13 +235698,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Aa099E64E214D655801Ea38Ad876711 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "00b9cd1f-e389-51fd-8a08-73334bb0d0ef"
+		id = "309e33dc-c7bc-575c-bc92-05f4006f2bab"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6700-L6712"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a4211bc2f3cedb8b135566d4b22251523a3a2bbdb04c1f1c5b1336ae7c198773"
+		logic_hash = "v1_sha256_a4211bc2f3cedb8b135566d4b22251523a3a2bbdb04c1f1c5b1336ae7c198773"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236279,7 +235713,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Aa099E64E214D655801Ea38Ad876711 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Psiphon Inc." and pe.signatures[i].serial=="0a:a0:99:e6:4e:21:4d:65:58:01:ea:38:ad:87:67:11")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Psiphon Inc." and pe.signatures [ i ] . serial == "0a:a0:99:e6:4e:21:4d:65:58:01:ea:38:ad:87:67:11" )
 }
 import "pe"
 
@@ -236288,13 +235722,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_54Cc50D147Fa549E3F721C754E4E3A91 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2007dabd-74c0-5cc7-986c-21fb1df9136a"
+		id = "f91096c7-ff56-50db-b886-f981c0a3bf6e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6714-L6726"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "367237a9370542a4506fb13683f0a91e4bf5eb871e4b9f62b4cae8316bdf2d9a"
+		logic_hash = "v1_sha256_367237a9370542a4506fb13683f0a91e4bf5eb871e4b9f62b4cae8316bdf2d9a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236303,7 +235737,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_54Cc50D147Fa549E3F721C754E4E3A91 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ralink Technology Corporation" and pe.signatures[i].serial=="54:cc:50:d1:47:fa:54:9e:3f:72:1c:75:4e:4e:3a:91")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Ralink Technology Corporation" and pe.signatures [ i ] . serial == "54:cc:50:d1:47:fa:54:9e:3f:72:1c:75:4e:4e:3a:91" )
 }
 import "pe"
 
@@ -236312,13 +235746,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1E508Bb2398808Bc420A5A1F67Ba5D0B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "32f79595-6526-5dea-824a-cc073b6a2b5c"
+		id = "d7702548-41fc-587c-86fe-c4b8b11e02f3"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6728-L6740"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "71b7efab5359408e3897498ce031c8375e2d67bfc8ff15c685df5ac6dd4bb015"
+		logic_hash = "v1_sha256_71b7efab5359408e3897498ce031c8375e2d67bfc8ff15c685df5ac6dd4bb015"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236327,7 +235761,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1E508Bb2398808Bc420A5A1F67Ba5D0B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WakeNet AB" and pe.signatures[i].serial=="1e:50:8b:b2:39:88:08:bc:42:0a:5a:1f:67:ba:5d:0b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "WakeNet AB" and pe.signatures [ i ] . serial == "1e:50:8b:b2:39:88:08:bc:42:0a:5a:1f:67:ba:5d:0b" )
 }
 import "pe"
 
@@ -236336,13 +235770,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008B3333D32B2C2A1D33B41Ba5Db9D4D2D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "90947492-2f42-5d90-b635-62a5f7e79ffc"
+		id = "03c8e856-082a-5524-8dcc-a0895ff1baf6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6742-L6757"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c15a248dd52e7e888da381fda296cf19c53196ef52c4c4ce74af646d427eccde"
+		logic_hash = "v1_sha256_c15a248dd52e7e888da381fda296cf19c53196ef52c4c4ce74af646d427eccde"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236351,7 +235785,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_008B3333D32B2C2A1D33B41Ba5Db9D4D2D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BOOK CAF\\xC3\\x89" and (pe.signatures[i].serial=="8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d" or pe.signatures[i].serial=="00:8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BOOK CAF\\xC3\\x89" and ( pe.signatures [ i ] . serial == "8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d" or pe.signatures [ i ] . serial == "00:8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d" ) )
 }
 import "pe"
 
@@ -236360,13 +235794,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B548765Eebe9468348Af40B9891C1E63 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0ee1a31b-6324-5dbd-bd0d-765bc4891415"
+		id = "e3a480a6-e605-5c9d-9237-7964bc2ecf58"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6759-L6771"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "db8136f63657130bb3fe2527bb597e70bc3d46395aa3137810f4ee4b4de6c6ec"
+		logic_hash = "v1_sha256_db8136f63657130bb3fe2527bb597e70bc3d46395aa3137810f4ee4b4de6c6ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236375,7 +235809,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B548765Eebe9468348Af40B9891C1E63 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OSIRIS Corporation" and pe.signatures[i].serial=="b5:48:76:5e:eb:e9:46:83:48:af:40:b9:89:1c:1e:63")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OSIRIS Corporation" and pe.signatures [ i ] . serial == "b5:48:76:5e:eb:e9:46:83:48:af:40:b9:89:1c:1e:63" )
 }
 import "pe"
 
@@ -236384,13 +235818,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4697C7Ddd3E37Fe275Fdc6961A9093E3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9d611fee-cf29-523e-86f7-5c67f0e563a9"
+		id = "25aebf37-02f8-5a99-9f45-8572dd03bbc1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6773-L6785"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b3de1a753ac7a2f43ae64ee54fc81d92f70c32d4a04398a6dfc9a6ec856d8300"
+		logic_hash = "v1_sha256_b3de1a753ac7a2f43ae64ee54fc81d92f70c32d4a04398a6dfc9a6ec856d8300"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236399,7 +235833,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4697C7Ddd3E37Fe275Fdc6961A9093E3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xC3\\x89tienne Hill" and pe.signatures[i].serial=="46:97:c7:dd:d3:e3:7f:e2:75:fd:c6:96:1a:90:93:e3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xC3\\x89tienne Hill" and pe.signatures [ i ] . serial == "46:97:c7:dd:d3:e3:7f:e2:75:fd:c6:96:1a:90:93:e3" )
 }
 import "pe"
 
@@ -236408,13 +235842,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_74C94Ef697Dc9783F845D26Dccc1E7Fd : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3cd08af1-8999-59a8-a679-a39871ecf68e"
+		id = "5b11134e-7ad1-5965-a047-0568fcabb609"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6787-L6799"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "226dfe366c31e9cb38910df7d6cb2037c545745594fd133d7b7359175f153a90"
+		logic_hash = "v1_sha256_226dfe366c31e9cb38910df7d6cb2037c545745594fd133d7b7359175f153a90"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236423,7 +235857,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_74C94Ef697Dc9783F845D26Dccc1E7Fd : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CIBIKART d.o.o." and pe.signatures[i].serial=="74:c9:4e:f6:97:dc:97:83:f8:45:d2:6d:cc:c1:e7:fd")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CIBIKART d.o.o." and pe.signatures [ i ] . serial == "74:c9:4e:f6:97:dc:97:83:f8:45:d2:6d:cc:c1:e7:fd" )
 }
 import "pe"
 
@@ -236432,13 +235866,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Dd1Cb148A90123Dcc13498B54E5A798 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8bdc91bc-5a59-5c22-8d39-fe1bf4267813"
+		id = "f9f137f3-4c2d-5323-aff2-b6bda1a922c0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6801-L6812"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9b5ec1b9d3fd15259d3628b5199b274f85674b404c57329d8af4f779ae357454"
+		logic_hash = "v1_sha256_9b5ec1b9d3fd15259d3628b5199b274f85674b404c57329d8af4f779ae357454"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236446,7 +235880,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Dd1Cb148A90123Dcc13498B54E5A798 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "33adab6a2ixdac07i4cLb4ac05j6yG2ew95e" and pe.signatures[i].serial=="5d:d1:cb:14:8a:90:12:3d:cc:13:49:8b:54:e5:a7:98")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "33adab6a2ixdac07i4cLb4ac05j6yG2ew95e" and pe.signatures [ i ] . serial == "5d:d1:cb:14:8a:90:12:3d:cc:13:49:8b:54:e5:a7:98" )
 }
 import "pe"
 
@@ -236455,13 +235889,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A758504E7971869D0Aec2775Fffa03D5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1ecfe521-0148-5a13-b23f-dd1b14b835ed"
+		id = "c6f8eb49-7c5f-59a9-95b2-67d9938290f2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6814-L6829"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "08f52e96d1e93e2d406753fd0dee5d03501ac037ab022b710362b113eaae6239"
+		logic_hash = "v1_sha256_08f52e96d1e93e2d406753fd0dee5d03501ac037ab022b710362b113eaae6239"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236470,7 +235904,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A758504E7971869D0Aec2775Fffa03D5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Amcert LLC" and (pe.signatures[i].serial=="a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5" or pe.signatures[i].serial=="00:a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Amcert LLC" and ( pe.signatures [ i ] . serial == "a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5" or pe.signatures [ i ] . serial == "00:a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5" ) )
 }
 import "pe"
 
@@ -236479,13 +235913,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F13A4F94Bf233525 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1d048571-661e-5d7f-a255-f07b84069b20"
+		id = "3327c861-cb28-5962-95cd-ec22a955caaa"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6831-L6845"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "29284d9ced0d5e6d587edc9727321cdc7bf5ce4ad8407d460afa7f1e6d1bcb90"
+		logic_hash = "v1_sha256_29284d9ced0d5e6d587edc9727321cdc7bf5ce4ad8407d460afa7f1e6d1bcb90"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236493,7 +235927,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F13A4F94Bf233525 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SocketOptionName" and (pe.signatures[i].serial=="f1:3a:4f:94:bf:23:35:25" or pe.signatures[i].serial=="00:f1:3a:4f:94:bf:23:35:25"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SocketOptionName" and ( pe.signatures [ i ] . serial == "f1:3a:4f:94:bf:23:35:25" or pe.signatures [ i ] . serial == "00:f1:3a:4f:94:bf:23:35:25" ) )
 }
 import "pe"
 
@@ -236502,13 +235936,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_119Acead668Bad57A48B4F42F294F8F0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d3f45ee1-134f-5b16-81f8-83405a5e3181"
+		id = "06cffa63-71a3-501a-9f01-857653886767"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6847-L6858"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bae9aed4f53059b2ec0de630f681bb157c148d9ad38be35dd8c1a74b19619077"
+		logic_hash = "v1_sha256_bae9aed4f53059b2ec0de630f681bb157c148d9ad38be35dd8c1a74b19619077"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236516,7 +235950,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_119Acead668Bad57A48B4F42F294F8F0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PB03 TRANSPORT LTD." and pe.signatures[i].serial=="11:9a:ce:ad:66:8b:ad:57:a4:8b:4f:42:f2:94:f8:f0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PB03 TRANSPORT LTD." and pe.signatures [ i ] . serial == "11:9a:ce:ad:66:8b:ad:57:a4:8b:4f:42:f2:94:f8:f0" )
 }
 import "pe"
 
@@ -236525,13 +235959,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_21144343720267Ba42F586105Ff279De : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "54e4133f-4fb7-5f70-a4dc-77c6f8120d29"
+		id = "f17337ff-08d9-576f-9aec-598c72cfd297"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6860-L6871"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a1eacebed0966ad5d78eb7e38d8b854d183f21a19a53bbcb57503e4271b2cc84"
+		logic_hash = "v1_sha256_a1eacebed0966ad5d78eb7e38d8b854d183f21a19a53bbcb57503e4271b2cc84"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236539,7 +235973,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_21144343720267Ba42F586105Ff279De : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Varta Blue Dynamic" and pe.signatures[i].serial=="21:14:43:43:72:02:67:ba:42:f5:86:10:5f:f2:79:de")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Varta Blue Dynamic" and pe.signatures [ i ] . serial == "21:14:43:43:72:02:67:ba:42:f5:86:10:5f:f2:79:de" )
 }
 import "pe"
 
@@ -236548,13 +235982,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A3Cb8E964244768969B837Ca9981De68 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a9d74cc6-0d89-5de9-8f13-966455e49b9c"
+		id = "695e4b67-4403-576b-afd0-78f92cad6f84"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6873-L6884"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d88c9ac03a4b3803b85c5ee30ad127aca43cbfc33d754bc42c15593f7294b1bc"
+		logic_hash = "v1_sha256_d88c9ac03a4b3803b85c5ee30ad127aca43cbfc33d754bc42c15593f7294b1bc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236562,7 +235996,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00A3Cb8E964244768969B837Ca9981De68 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="a3:cb:8e:96:42:44:76:89:69:b8:37:ca:99:81:de:68" or pe.signatures[i].serial=="00:a3:cb:8e:96:42:44:76:89:69:b8:37:ca:99:81:de:68")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . serial == "a3:cb:8e:96:42:44:76:89:69:b8:37:ca:99:81:de:68" or pe.signatures [ i ] . serial == "00:a3:cb:8e:96:42:44:76:89:69:b8:37:ca:99:81:de:68" )
 }
 import "pe"
 
@@ -236571,13 +236005,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Bd96F0B87Edca41E777507015B3B2775 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5ef0b542-01de-53ee-9a52-0a05bccccd22"
+		id = "66f665af-7fec-5c03-b318-35115bb2c98b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6886-L6900"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a9906821de34bf6a20bfe1a4be81563a22b110bde68fbe36b491955c23d2dcc6"
+		logic_hash = "v1_sha256_a9906821de34bf6a20bfe1a4be81563a22b110bde68fbe36b491955c23d2dcc6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236585,7 +236019,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Bd96F0B87Edca41E777507015B3B2775 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ООО \"СМ\"" and (pe.signatures[i].serial=="bd:96:f0:b8:7e:dc:a4:1e:77:75:07:01:5b:3b:27:75" or pe.signatures[i].serial=="00:bd:96:f0:b8:7e:dc:a4:1e:77:75:07:01:5b:3b:27:75"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ООО \"СМ\"" and ( pe.signatures [ i ] . serial == "bd:96:f0:b8:7e:dc:a4:1e:77:75:07:01:5b:3b:27:75" or pe.signatures [ i ] . serial == "00:bd:96:f0:b8:7e:dc:a4:1e:77:75:07:01:5b:3b:27:75" ) )
 }
 import "pe"
 
@@ -236594,13 +236028,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E41537B8Dd65670D6Eb01954Becacf1E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "80ac0d4e-5865-562a-a4a1-fa02b6859bdb"
+		id = "8c5ec8ca-ffcc-5683-92f7-0790ca57f9a9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6902-L6916"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "94b7feb2d1ed8a7004599ac2018746bf43529f7cf7c4776fbdf21282013935c8"
+		logic_hash = "v1_sha256_94b7feb2d1ed8a7004599ac2018746bf43529f7cf7c4776fbdf21282013935c8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236608,7 +236042,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00E41537B8Dd65670D6Eb01954Becacf1E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marketing Concept s.r.o." and (pe.signatures[i].serial=="e4:15:37:b8:dd:65:67:0d:6e:b0:19:54:be:ca:cf:1e" or pe.signatures[i].serial=="00:e4:15:37:b8:dd:65:67:0d:6e:b0:19:54:be:ca:cf:1e"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Marketing Concept s.r.o." and ( pe.signatures [ i ] . serial == "e4:15:37:b8:dd:65:67:0d:6e:b0:19:54:be:ca:cf:1e" or pe.signatures [ i ] . serial == "00:e4:15:37:b8:dd:65:67:0d:6e:b0:19:54:be:ca:cf:1e" ) )
 }
 import "pe"
 
@@ -236617,13 +236051,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06808C5934Da036A1297A936D72E93D4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c75ae0da-e8b9-581f-bfde-f23b3b3f9d22"
+		id = "a65b5e89-54ce-58f2-a813-3df77059e7b9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6918-L6929"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "45840d354dcea86c38effc86b3b6f92540f32eab78286d51ff7f472618accb8b"
+		logic_hash = "v1_sha256_45840d354dcea86c38effc86b3b6f92540f32eab78286d51ff7f472618accb8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236631,7 +236065,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06808C5934Da036A1297A936D72E93D4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rhaon Entertainment Inc" and pe.signatures[i].serial=="06:80:8c:59:34:da:03:6a:12:97:a9:36:d7:2e:93:d4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rhaon Entertainment Inc" and pe.signatures [ i ] . serial == "06:80:8c:59:34:da:03:6a:12:97:a9:36:d7:2e:93:d4" )
 }
 import "pe"
 
@@ -236640,13 +236074,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_97D50C7E3Ab45B9A441A37D870484C10 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "54c391df-ea76-5944-aae6-63f44ec557e5"
+		id = "8cf21fe4-1b1c-5b0f-8c6f-aff7b04fbe57"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6931-L6942"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2f535f66a4aabffff48f167ffcabcb366398e358eaafa2b3d67ee4c7ad19eb66"
+		logic_hash = "v1_sha256_2f535f66a4aabffff48f167ffcabcb366398e358eaafa2b3d67ee4c7ad19eb66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236654,7 +236088,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_97D50C7E3Ab45B9A441A37D870484C10 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHENZHEN MINIWAN TECHNOLOGY CO. LTD." and pe.signatures[i].serial=="97:d5:0c:7e:3a:b4:5b:9a:44:1a:37:d8:70:48:4c:10")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SHENZHEN MINIWAN TECHNOLOGY CO. LTD." and pe.signatures [ i ] . serial == "97:d5:0c:7e:3a:b4:5b:9a:44:1a:37:d8:70:48:4c:10" )
 }
 import "pe"
 
@@ -236663,13 +236097,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0B2B192657B37632518B08A06E201381 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "917d2d66-f4b4-59b1-aeed-3b10c337d4b8"
+		id = "8c25a7ad-608c-5360-89f1-6a2ca6e4ec41"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6944-L6955"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "361005555e5d4b51c4538617c99fe668fca61ccc0c0847611e1423f69194999c"
+		logic_hash = "v1_sha256_361005555e5d4b51c4538617c99fe668fca61ccc0c0847611e1423f69194999c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236677,7 +236111,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0B2B192657B37632518B08A06E201381 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Atomic Protocol Systems" and pe.signatures[i].serial=="0b:2b:19:26:57:b3:76:32:51:8b:08:a0:6e:20:13:81")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Atomic Protocol Systems" and pe.signatures [ i ] . serial == "0b:2b:19:26:57:b3:76:32:51:8b:08:a0:6e:20:13:81" )
 }
 import "pe"
 
@@ -236686,13 +236120,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00945Aaac27E7D6D810C0A542Bedd562A4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5698130c-0696-5474-8b86-b6ba290d2822"
+		id = "968850ef-0fb5-5bf1-8078-c65c289adc37"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6957-L6972"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "292657717cb42835324b6ff42d563bca47e042e82afef24b5d666b16979b8103"
+		logic_hash = "v1_sha256_292657717cb42835324b6ff42d563bca47e042e82afef24b5d666b16979b8103"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236701,7 +236135,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00945Aaac27E7D6D810C0A542Bedd562A4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DYNAMX BUSINESS GROUP LTD." and (pe.signatures[i].serial=="94:5a:aa:c2:7e:7d:6d:81:0c:0a:54:2b:ed:d5:62:a4" or pe.signatures[i].serial=="00:94:5a:aa:c2:7e:7d:6d:81:0c:0a:54:2b:ed:d5:62:a4"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DYNAMX BUSINESS GROUP LTD." and ( pe.signatures [ i ] . serial == "94:5a:aa:c2:7e:7d:6d:81:0c:0a:54:2b:ed:d5:62:a4" or pe.signatures [ i ] . serial == "00:94:5a:aa:c2:7e:7d:6d:81:0c:0a:54:2b:ed:d5:62:a4" ) )
 }
 import "pe"
 
@@ -236710,13 +236144,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6D450Cc59Acdb4B7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "845e3f48-5660-525e-bd18-5953c64322f1"
+		id = "a47887e1-24f7-52fe-8a2d-6d98892d054b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6974-L6985"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8328159dce3586c26b777f92d7a87e0660520cf08d122505d34ed427bdd7ff6f"
+		logic_hash = "v1_sha256_8328159dce3586c26b777f92d7a87e0660520cf08d122505d34ed427bdd7ff6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236724,7 +236158,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6D450Cc59Acdb4B7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CancellationTokenSource" and pe.signatures[i].serial=="6d:45:0c:c5:9a:cd:b4:b7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CancellationTokenSource" and pe.signatures [ i ] . serial == "6d:45:0c:c5:9a:cd:b4:b7" )
 }
 import "pe"
 
@@ -236733,13 +236167,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_66390Fc17786D4A342F0Ee89996D6522 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "202e4270-9b49-5516-8188-a64bd528a9c4"
+		id = "f12d268f-75ea-510f-aa09-7be887f1d892"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L6987-L6998"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a38d09beee8ddaa6e8273e04fe3c5cc9ff9a4e55344e2b9191bb3e5928e9e79b"
+		logic_hash = "v1_sha256_a38d09beee8ddaa6e8273e04fe3c5cc9ff9a4e55344e2b9191bb3e5928e9e79b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236747,7 +236181,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_66390Fc17786D4A342F0Ee89996D6522 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Logitech Z-" and pe.signatures[i].serial=="66:39:0f:c1:77:86:d4:a3:42:f0:ee:89:99:6d:65:22")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Logitech Z-" and pe.signatures [ i ] . serial == "66:39:0f:c1:77:86:d4:a3:42:f0:ee:89:99:6d:65:22" )
 }
 import "pe"
 
@@ -236756,13 +236190,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D1737E5A94D2Aff121163Df177Ed7Cf7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "92ba22ba-9610-5b9b-9075-1da84fb148c1"
+		id = "fa240be0-a54c-554f-8bd4-d7b944e6b655"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7000-L7015"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7889e42ca0bc6c4aad0c7cf90459958e9d256b984fae719bd418fc17120cb4a2"
+		logic_hash = "v1_sha256_7889e42ca0bc6c4aad0c7cf90459958e9d256b984fae719bd418fc17120cb4a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236771,7 +236205,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00D1737E5A94D2Aff121163Df177Ed7Cf7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BedstSammen ApS" and (pe.signatures[i].serial=="d1:73:7e:5a:94:d2:af:f1:21:16:3d:f1:77:ed:7c:f7" or pe.signatures[i].serial=="00:d1:73:7e:5a:94:d2:af:f1:21:16:3d:f1:77:ed:7c:f7"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BedstSammen ApS" and ( pe.signatures [ i ] . serial == "d1:73:7e:5a:94:d2:af:f1:21:16:3d:f1:77:ed:7c:f7" or pe.signatures [ i ] . serial == "00:d1:73:7e:5a:94:d2:af:f1:21:16:3d:f1:77:ed:7c:f7" ) )
 }
 import "pe"
 
@@ -236780,13 +236214,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Aa94583A95D42F1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a77e58c7-c613-5416-9bcd-336c036d99bd"
+		id = "8f654f54-5f8a-5441-a521-b9ae7074753c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7017-L7028"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "174ce032fd87028e34843417d5a4695d6d6e2eb444095e005588f1acf291cdf8"
+		logic_hash = "v1_sha256_174ce032fd87028e34843417d5a4695d6d6e2eb444095e005588f1acf291cdf8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236794,7 +236228,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Aa94583A95D42F1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UInt32" and pe.signatures[i].serial=="5a:a9:45:83:a9:5d:42:f1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "UInt32" and pe.signatures [ i ] . serial == "5a:a9:45:83:a9:5d:42:f1" )
 }
 import "pe"
 
@@ -236803,13 +236237,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Ce7A0C62F27Fa98F78853E1Ad11173F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dd6ba685-deac-5ba0-8268-2ff17f3efc5a"
+		id = "dbb45686-90f4-5eef-9253-cf9d99fe4931"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7030-L7041"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "48692213d57293d28d0eb146d24036fa7e7357e55df07330d596a51a0665f063"
+		logic_hash = "v1_sha256_48692213d57293d28d0eb146d24036fa7e7357e55df07330d596a51a0665f063"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236817,7 +236251,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Ce7A0C62F27Fa98F78853E1Ad11173F : FILE
 		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint32(0)==0xe011cfd0) and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "D&K ENGINEERING" and pe.signatures[i].serial=="6c:e7:a0:c6:2f:27:fa:98:f7:88:53:e1:ad:11:17:3f")
+		( uint16( 0 ) == 0x5a4d or uint32( 0 ) == 0xe011cfd0 ) and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "D&K ENGINEERING" and pe.signatures [ i ] . serial == "6c:e7:a0:c6:2f:27:fa:98:f7:88:53:e1:ad:11:17:3f" )
 }
 import "pe"
 
@@ -236826,13 +236260,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_670C3494206B9F0C18714Fdcffaaa42F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cbe10923-794e-50f0-bcc7-026ca2235836"
+		id = "76d2209f-dc45-56df-8641-089edbcf833f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7043-L7054"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5215f3e877ac4b37d33a29f9d2e92567db02f41f5fa1592d2de199ee06b43885"
+		logic_hash = "v1_sha256_5215f3e877ac4b37d33a29f9d2e92567db02f41f5fa1592d2de199ee06b43885"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236840,7 +236274,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_670C3494206B9F0C18714Fdcffaaa42F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADRIATIK PORT SERVIS, d.o.o." and pe.signatures[i].serial=="67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ADRIATIK PORT SERVIS, d.o.o." and pe.signatures [ i ] . serial == "67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f" )
 }
 import "pe"
 
@@ -236849,13 +236283,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5F11C47D3F8C468E5D38279De98078Ce : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d7ec5ceb-df6d-518c-977d-84ab2a40f6ed"
+		id = "791ea2be-beab-551c-9b84-029f04c05839"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7056-L7067"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "82db6d0b96303be79aa9a0980a4ce491a1216adbba65443e8e59c5cf69a4a1e4"
+		logic_hash = "v1_sha256_82db6d0b96303be79aa9a0980a4ce491a1216adbba65443e8e59c5cf69a4a1e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236863,7 +236297,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5F11C47D3F8C468E5D38279De98078Ce : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Atera Networks LTD." and pe.signatures[i].serial=="5f:11:c4:7d:3f:8c:46:8e:5d:38:27:9d:e9:80:78:ce")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Atera Networks LTD." and pe.signatures [ i ] . serial == "5f:11:c4:7d:3f:8c:46:8e:5d:38:27:9d:e9:80:78:ce" )
 }
 import "pe"
 
@@ -236872,13 +236306,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Bdb99D5Ecf8271D48E35F1039C2160Ef : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a87a3295-fbdb-5501-97a1-7cb23009f925"
+		id = "62ffc9a2-5314-5ef6-b0ad-246f9fe94259"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7069-L7083"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3a7fd1705d440306e7643167f46b0735bedab291e714cd01068be321f489e3f3"
+		logic_hash = "v1_sha256_3a7fd1705d440306e7643167f46b0735bedab291e714cd01068be321f489e3f3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236886,7 +236320,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Bdb99D5Ecf8271D48E35F1039C2160Ef : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gavrilov Andrei Alekseevich" and (pe.signatures[i].serial=="bd:b9:9d:5e:cf:82:71:d4:8e:35:f1:03:9c:21:60:ef" or pe.signatures[i].serial=="00:bd:b9:9d:5e:cf:82:71:d4:8e:35:f1:03:9c:21:60:ef"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Gavrilov Andrei Alekseevich" and ( pe.signatures [ i ] . serial == "bd:b9:9d:5e:cf:82:71:d4:8e:35:f1:03:9c:21:60:ef" or pe.signatures [ i ] . serial == "00:bd:b9:9d:5e:cf:82:71:d4:8e:35:f1:03:9c:21:60:ef" ) )
 }
 import "pe"
 
@@ -236895,13 +236329,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_025020668F51235E9Ecfff8Cf00Da63E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5b9af281-09b0-5df5-af3b-4868a7243636"
+		id = "fa55f3dd-f7cc-59fb-8e8d-c47ce98b0a1d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7085-L7096"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c99caf6ada228fe1229ea8e8ca0b160468f044a9a1e13ed9a83c12afeae337a1"
+		logic_hash = "v1_sha256_c99caf6ada228fe1229ea8e8ca0b160468f044a9a1e13ed9a83c12afeae337a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236909,7 +236343,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_025020668F51235E9Ecfff8Cf00Da63E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Knassar DK ApS" and pe.signatures[i].serial=="02:50:20:66:8f:51:23:5e:9e:cf:ff:8c:f0:0d:a6:3e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Knassar DK ApS" and pe.signatures [ i ] . serial == "02:50:20:66:8f:51:23:5e:9e:cf:ff:8c:f0:0d:a6:3e" )
 }
 import "pe"
 
@@ -236918,13 +236352,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Cfae7E6F538B9F2E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c144fe64-ad45-5ac6-b2ee-904a66230674"
+		id = "4fd88bc0-b279-5d98-a0ee-99808065ab82"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7098-L7112"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "23032d387bbfc81edb08982a196b90a136faf935d74c46771c59ef19095ac3a4"
+		logic_hash = "v1_sha256_23032d387bbfc81edb08982a196b90a136faf935d74c46771c59ef19095ac3a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236932,7 +236366,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Cfae7E6F538B9F2E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SequenceDesigner" and (pe.signatures[i].serial=="cf:ae:7e:6f:53:8b:9f:2e" or pe.signatures[i].serial=="00:cf:ae:7e:6f:53:8b:9f:2e"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SequenceDesigner" and ( pe.signatures [ i ] . serial == "cf:ae:7e:6f:53:8b:9f:2e" or pe.signatures [ i ] . serial == "00:cf:ae:7e:6f:53:8b:9f:2e" ) )
 }
 import "pe"
 
@@ -236941,13 +236375,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Bc9B800F480691Bd6B60963466B0C75 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ff76c8b3-8120-54ed-90e1-3ee01e57895e"
+		id = "b81581d0-fd71-5e6c-8beb-20b7adada311"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7114-L7125"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "15143a6dc374f22252880ce61a419df46d81bc1ee99a29d03a61348f9c230064"
+		logic_hash = "v1_sha256_15143a6dc374f22252880ce61a419df46d81bc1ee99a29d03a61348f9c230064"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236955,7 +236389,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Bc9B800F480691Bd6B60963466B0C75 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HasCred ApS" and pe.signatures[i].serial=="0b:c9:b8:00:f4:80:69:1b:d6:b6:09:63:46:6b:0c:75")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HasCred ApS" and pe.signatures [ i ] . serial == "0b:c9:b8:00:f4:80:69:1b:d6:b6:09:63:46:6b:0c:75" )
 }
 import "pe"
 
@@ -236964,13 +236398,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_69Ad1E8B5941C93D5017B7C3Fdb8E7B6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4b961b30-dc0d-513c-8a66-ed8fe71f5439"
+		id = "6a269ff7-e03e-5f56-93b8-c8004f19be72"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7127-L7138"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1a37133dcc7af9c3f229f517dca847d7c007b8a2fdc6af50721d68f68c5d9c20"
+		logic_hash = "v1_sha256_1a37133dcc7af9c3f229f517dca847d7c007b8a2fdc6af50721d68f68c5d9c20"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -236978,7 +236412,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_69Ad1E8B5941C93D5017B7C3Fdb8E7B6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Afia Wave Enterprises Oy" and pe.signatures[i].serial=="69:ad:1e:8b:59:41:c9:3d:50:17:b7:c3:fd:b8:e7:b6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Afia Wave Enterprises Oy" and pe.signatures [ i ] . serial == "69:ad:1e:8b:59:41:c9:3d:50:17:b7:c3:fd:b8:e7:b6" )
 }
 import "pe"
 
@@ -236987,13 +236421,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_072472F2386F4608A0790Da2Be8A48F7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "79f1e6da-003a-5291-a60c-7693ca2efbeb"
+		id = "6f10a19b-946d-5032-a843-9c19bd5b9c33"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7140-L7151"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "32b61f42ee9f3109c747e8a159376d03349d8a5061be0c31504e929cb3c3042e"
+		logic_hash = "v1_sha256_32b61f42ee9f3109c747e8a159376d03349d8a5061be0c31504e929cb3c3042e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237001,7 +236435,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_072472F2386F4608A0790Da2Be8A48F7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FOXIT SOFTWARE INC." and pe.signatures[i].serial=="07:24:72:f2:38:6f:46:08:a0:79:0d:a2:be:8a:48:f7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FOXIT SOFTWARE INC." and pe.signatures [ i ] . serial == "07:24:72:f2:38:6f:46:08:a0:79:0d:a2:be:8a:48:f7" )
 }
 import "pe"
 
@@ -237010,13 +236444,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ea734E1Dfb6E69Ed2Bc55E513Bf95B5E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4e40ce70-d5d1-5719-bb43-40f860510093"
+		id = "48f854b0-07f0-5d9e-b2e0-94ab468541c8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7153-L7168"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e2d07a2af36608d6eab6db85bcb968e486293239d0cfaeea7de2bb8223e58a29"
+		logic_hash = "v1_sha256_e2d07a2af36608d6eab6db85bcb968e486293239d0cfaeea7de2bb8223e58a29"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237025,7 +236459,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Ea734E1Dfb6E69Ed2Bc55E513Bf95B5E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Postmarket LLC" and (pe.signatures[i].serial=="00:ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e" or pe.signatures[i].serial=="ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Postmarket LLC" and ( pe.signatures [ i ] . serial == "00:ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e" or pe.signatures [ i ] . serial == "ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e" ) )
 }
 import "pe"
 
@@ -237034,13 +236468,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Dfa4F0Cff90319951B019A4681Ebd2A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bbb0be70-de74-5da9-80d2-2ba474b7f472"
+		id = "2b738ad3-7dea-5c5e-8d64-c844e214bf19"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7170-L7182"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d89cda38cf6149c004f7d7b307243567768cba73bd49979d7d4f92f902ef4508"
+		logic_hash = "v1_sha256_d89cda38cf6149c004f7d7b307243567768cba73bd49979d7d4f92f902ef4508"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237049,7 +236483,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Dfa4F0Cff90319951B019A4681Ebd2A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "deepinstruction O" and pe.signatures[i].serial=="0d:fa:4f:0c:ff:90:31:99:51:b0:19:a4:68:1e:bd:2a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "deepinstruction O" and pe.signatures [ i ] . serial == "0d:fa:4f:0c:ff:90:31:99:51:b0:19:a4:68:1e:bd:2a" )
 }
 import "pe"
 
@@ -237058,13 +236492,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4D03Ae6512B85Eab4184Ca7F4Fa2E49C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a7dc0a07-f295-5aff-9df0-71f27f0fe88c"
+		id = "84a3c83f-089e-5988-98e4-537f1ededbc2"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7184-L7196"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2cbeaf65b0d3340df08baf67134a2fe0b26921f2e35ce541884209e3ecddf233"
+		logic_hash = "v1_sha256_2cbeaf65b0d3340df08baf67134a2fe0b26921f2e35ce541884209e3ecddf233"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237073,7 +236507,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4D03Ae6512B85Eab4184Ca7F4Fa2E49C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lenovo IdeaCentre" and pe.signatures[i].serial=="4d:03:ae:65:12:b8:5e:ab:41:84:ca:7f:4f:a2:e4:9c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Lenovo IdeaCentre" and pe.signatures [ i ] . serial == "4d:03:ae:65:12:b8:5e:ab:41:84:ca:7f:4f:a2:e4:9c" )
 }
 import "pe"
 
@@ -237082,13 +236516,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_333705C20B56E57F60B5Eb191Eef0D90 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e868c3ff-a701-59bd-9cd6-bf49305fe28a"
+		id = "a26db843-8a27-50ef-a44c-8457958fef8a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7198-L7209"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f5ca35381842a0ea7c319d8388753347a72fc6df746064e520794aeb4b6724d0"
+		logic_hash = "v1_sha256_f5ca35381842a0ea7c319d8388753347a72fc6df746064e520794aeb4b6724d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237096,7 +236530,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_333705C20B56E57F60B5Eb191Eef0D90 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TASK Holding ApS" and pe.signatures[i].serial=="33:37:05:c2:0b:56:e5:7f:60:b5:eb:19:1e:ef:0d:90")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TASK Holding ApS" and pe.signatures [ i ] . serial == "33:37:05:c2:0b:56:e5:7f:60:b5:eb:19:1e:ef:0d:90" )
 }
 import "pe"
 
@@ -237105,13 +236539,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_79906Faf4Fbd75Baa10B322356A07F6D : FILE
 	meta:
 		description = "Detects NetSupport (client) signed executables"
 		author = "ditekSHen"
-		id = "afca727c-ff08-5e47-9ef4-4cd2af96d294"
+		id = "c8850d15-9a5f-53b2-be4a-bddb1115cbf0"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7211-L7222"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "59862f31d0ba0cf56a93a86783ad802ea2e511845ab1d141aa224c0c61b720a7"
+		logic_hash = "v1_sha256_59862f31d0ba0cf56a93a86783ad802ea2e511845ab1d141aa224c0c61b720a7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237119,7 +236553,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_79906Faf4Fbd75Baa10B322356A07F6D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NetSupport Ltd" and pe.signatures[i].serial=="79:90:6f:af:4f:bd:75:ba:a1:0b:32:23:56:a0:7f:6d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NetSupport Ltd" and pe.signatures [ i ] . serial == "79:90:6f:af:4f:bd:75:ba:a1:0b:32:23:56:a0:7f:6d" )
 }
 import "pe"
 
@@ -237128,13 +236562,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_030Ba877Daf788A0048D04A85B1F6Eca : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "66689847-aa67-5029-9f37-cc410a564633"
+		id = "87292629-2c1e-5cbb-9927-e8f310c8d688"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7224-L7235"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "70b5b9011b53b7c9ac9dc286f3512a7a8bec5ec35ade0ee1c4bedd0a128994da"
+		logic_hash = "v1_sha256_70b5b9011b53b7c9ac9dc286f3512a7a8bec5ec35ade0ee1c4bedd0a128994da"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237142,7 +236576,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_030Ba877Daf788A0048D04A85B1F6Eca : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Skylum Software USA, Inc." and pe.signatures[i].serial=="03:0b:a8:77:da:f7:88:a0:04:8d:04:a8:5b:1f:6e:ca")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Skylum Software USA, Inc." and pe.signatures [ i ] . serial == "03:0b:a8:77:da:f7:88:a0:04:8d:04:a8:5b:1f:6e:ca" )
 }
 import "pe"
 
@@ -237151,13 +236585,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fe83F58D001327Fbaafd7Bac76Ae6818 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5d41be99-85de-55bc-817b-eea510aff308"
+		id = "747ca5f0-cf34-58cc-a89b-7f67746f43ab"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7237-L7251"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8aac715daba042ca4a57cd65b98e6192c87a13e7e0c8ff4a3bc81c43223035ad"
+		logic_hash = "v1_sha256_8aac715daba042ca4a57cd65b98e6192c87a13e7e0c8ff4a3bc81c43223035ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237165,7 +236599,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Fe83F58D001327Fbaafd7Bac76Ae6818 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "A. Jensen FLY Fishing ApS" and (pe.signatures[i].serial=="fe:83:f5:8d:00:13:27:fb:aa:fd:7b:ac:76:ae:68:18" or pe.signatures[i].serial=="00:fe:83:f5:8d:00:13:27:fb:aa:fd:7b:ac:76:ae:68:18"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "A. Jensen FLY Fishing ApS" and ( pe.signatures [ i ] . serial == "fe:83:f5:8d:00:13:27:fb:aa:fd:7b:ac:76:ae:68:18" or pe.signatures [ i ] . serial == "00:fe:83:f5:8d:00:13:27:fb:aa:fd:7b:ac:76:ae:68:18" ) )
 }
 import "pe"
 
@@ -237174,13 +236608,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0788260F8541539D97F49Ddaa837B166 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fb102e07-92fc-5ed8-a9cf-1cfd53f54281"
+		id = "276324f8-2f02-5765-a2d9-9c130c6143f1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7253-L7265"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "48985ac2c450bc4b3c5de635717dcf3a7ecf64109aa4059477ba79606f7fc2a4"
+		logic_hash = "v1_sha256_48985ac2c450bc4b3c5de635717dcf3a7ecf64109aa4059477ba79606f7fc2a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237189,7 +236623,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0788260F8541539D97F49Ddaa837B166 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TechSmith Corporation" and pe.signatures[i].serial=="07:88:26:0f:85:41:53:9d:97:f4:9d:da:a8:37:b1:66")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TechSmith Corporation" and pe.signatures [ i ] . serial == "07:88:26:0f:85:41:53:9d:97:f4:9d:da:a8:37:b1:66" )
 }
 import "pe"
 
@@ -237198,13 +236632,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ca5Acafb5Fdca6F8B5D66D1339A5D85 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6f0e9e3a-52fc-5ffd-90b3-743d925388df"
+		id = "9f11908f-52b2-5e3d-9f9b-8bad222937b1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7267-L7279"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2612e58b4e1a6fa65b32fe855b3542882c79345e93ab134933c893e90bb1a75c"
+		logic_hash = "v1_sha256_2612e58b4e1a6fa65b32fe855b3542882c79345e93ab134933c893e90bb1a75c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237213,7 +236647,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Ca5Acafb5Fdca6F8B5D66D1339A5D85 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Valve" and pe.signatures[i].serial=="0c:a5:ac:af:b5:fd:ca:6f:8b:5d:66:d1:33:9a:5d:85")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Valve" and pe.signatures [ i ] . serial == "0c:a5:ac:af:b5:fd:ca:6f:8b:5d:66:d1:33:9a:5d:85" )
 }
 import "pe"
 
@@ -237222,13 +236656,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_387Eeb89B8Bf626Bbf4C7C9F5B998B40 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "56dfc1b5-3aba-5c21-93e6-85d41a2a4415"
+		id = "287e6b12-0f03-5230-bb05-9b9c192dec08"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7281-L7293"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3436b7954e5488614f8f0998fe9eae7773d821c776436836d7b2230cd9c97f46"
+		logic_hash = "v1_sha256_3436b7954e5488614f8f0998fe9eae7773d821c776436836d7b2230cd9c97f46"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237237,7 +236671,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_387Eeb89B8Bf626Bbf4C7C9F5B998B40 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ULTRA ACADEMY LTD" and pe.signatures[i].serial=="38:7e:eb:89:b8:bf:62:6b:bf:4c:7c:9f:5b:99:8b:40")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ULTRA ACADEMY LTD" and pe.signatures [ i ] . serial == "38:7e:eb:89:b8:bf:62:6b:bf:4c:7c:9f:5b:99:8b:40" )
 }
 import "pe"
 
@@ -237246,13 +236680,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_035B41766660B08Aaf121536F0D83D4D : FILE
 	meta:
 		description = "Detects signed excutable of DiskCryptor open encryption solution that offers encryption of all disk partitions"
 		author = "ditekSHen"
-		id = "80c803e1-16b8-583d-9d4f-3a0f693c9e24"
+		id = "50542bf9-c537-5bdd-a852-5a32cc524ba9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7295-L7306"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "924ed1d3c6a8d378471a2e5301f3a813ee8622135ce001d3061918d9454cdcc4"
+		logic_hash = "v1_sha256_924ed1d3c6a8d378471a2e5301f3a813ee8622135ce001d3061918d9454cdcc4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237260,7 +236694,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_035B41766660B08Aaf121536F0D83D4D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Alexander Lomachevsky" and pe.signatures[i].serial=="03:5b:41:76:66:60:b0:8a:af:12:15:36:f0:d8:3d:4d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Alexander Lomachevsky" and pe.signatures [ i ] . serial == "03:5b:41:76:66:60:b0:8a:af:12:15:36:f0:d8:3d:4d" )
 }
 import "pe"
 
@@ -237269,13 +236703,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1A041Db92237C18948109789F627B3Cd : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0a5a6b19-0fbe-5e0c-bfb1-ca201207f6c7"
+		id = "62f6fbee-d3e2-57fe-9fe6-0f91a156e261"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7308-L7320"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f5e07eb58a68dea062522869c43daeddab666f12b078a4f2ce9aa37885e46cbd"
+		logic_hash = "v1_sha256_f5e07eb58a68dea062522869c43daeddab666f12b078a4f2ce9aa37885e46cbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237284,7 +236718,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1A041Db92237C18948109789F627B3Cd : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Amitotic" and pe.signatures[i].serial=="1a:04:1d:b9:22:37:c1:89:48:10:97:89:f6:27:b3:cd")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Amitotic" and pe.signatures [ i ] . serial == "1a:04:1d:b9:22:37:c1:89:48:10:97:89:f6:27:b3:cd" )
 }
 import "pe"
 
@@ -237293,13 +236727,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06Df5C318759D6Ea9D090Bfb2Faf1D94 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8c1f226f-6fc0-5136-ac19-7d88d7505a8e"
+		id = "50ce81e8-8cfc-5fed-a042-7cdb97168ca8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7322-L7334"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3be08901a44c1c94cfb93e56075270ed974399ccc0a4dce15299456dad645822"
+		logic_hash = "v1_sha256_3be08901a44c1c94cfb93e56075270ed974399ccc0a4dce15299456dad645822"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237308,7 +236742,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06Df5C318759D6Ea9D090Bfb2Faf1D94 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SpiffyTech Inc." and pe.signatures[i].serial=="06:df:5c:31:87:59:d6:ea:9d:09:0b:fb:2f:af:1d:94")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SpiffyTech Inc." and pe.signatures [ i ] . serial == "06:df:5c:31:87:59:d6:ea:9d:09:0b:fb:2f:af:1d:94" )
 }
 import "pe"
 
@@ -237317,13 +236751,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_330000026551Ae1Bbd005Cbfbd000000000265 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7f86e427-110f-5bcc-bb53-ca534f7444fc"
+		id = "e2556e7a-5dfa-5985-945a-5c44ff7ce8d7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7337-L7351"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ae836069665d088c6a309efe5166e260836dce6398c51701b2274515bdaa2cbd"
+		logic_hash = "v1_sha256_ae836069665d088c6a309efe5166e260836dce6398c51701b2274515bdaa2cbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237332,7 +236766,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_330000026551Ae1Bbd005Cbfbd000000000265 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Windows" and pe.signatures[i].issuer contains "Microsoft Windows Production PCA 2011" and pe.signatures[i].serial=="33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65" and 1614796238<=pe.signatures[i].not_after)
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Microsoft Windows" and pe.signatures [ i ] . issuer contains "Microsoft Windows Production PCA 2011" and pe.signatures [ i ] . serial == "33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65" and 1614796238 <= pe.signatures [ i ] . not_after )
 }
 import "pe"
 
@@ -237341,13 +236775,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_309368B122Ab63103Dddd4Ad6321A82C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a9c2fa86-506e-503a-a864-8368f63662c4"
+		id = "25eb5c39-86f9-5aff-b441-975df7588846"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7353-L7365"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "37a39d63e2bce6d4ce501e3032ee12fe8c5b39e8d8cb0f3e0c6d0be375bcffc8"
+		logic_hash = "v1_sha256_37a39d63e2bce6d4ce501e3032ee12fe8c5b39e8d8cb0f3e0c6d0be375bcffc8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237356,7 +236790,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_309368B122Ab63103Dddd4Ad6321A82C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Systems Accounting Limited" and pe.signatures[i].serial=="30:93:68:b1:22:ab:63:10:3d:dd:d4:ad:63:21:a8:2c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Systems Accounting Limited" and pe.signatures [ i ] . serial == "30:93:68:b1:22:ab:63:10:3d:dd:d4:ad:63:21:a8:2c" )
 }
 import "pe"
 
@@ -237365,13 +236799,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_19F613Cf951D49814250701037442Ee2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "780c515e-811c-5f44-97a2-9ed93a7d9d89"
+		id = "15990942-3df6-5a1b-b653-55544c78b580"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7367-L7384"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1ea5f770ddbb7dba836049bec0c7b73cd5bc6a87514f8ea00288cb9d52d17651"
+		logic_hash = "v1_sha256_1ea5f770ddbb7dba836049bec0c7b73cd5bc6a87514f8ea00288cb9d52d17651"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237382,7 +236816,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_19F613Cf951D49814250701037442Ee2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cooler Master" and (pe.signatures[i].serial=="19:f6:13:cf:95:1d:49:81:42:50:70:10:37:44:2e:e2" or pe.signatures[i].serial=="6b:e8:ee:f0:82:a4:f5:96:4c:75:0b:c0:07:24:f6:4a"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Cooler Master" and ( pe.signatures [ i ] . serial == "19:f6:13:cf:95:1d:49:81:42:50:70:10:37:44:2e:e2" or pe.signatures [ i ] . serial == "6b:e8:ee:f0:82:a4:f5:96:4c:75:0b:c0:07:24:f6:4a" ) )
 }
 import "pe"
 
@@ -237391,13 +236825,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2D8Cfcf04209Dc7F771D8D18E462C35A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6b2b25af-dae5-5055-851d-e515f6beee58"
+		id = "6460dc2f-8009-59aa-874e-07f11d062d42"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7386-L7398"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e7eee6a6593c231c193145eeefd03a0f32c1d8cc103c97cfa26b5af7363c9b08"
+		logic_hash = "v1_sha256_e7eee6a6593c231c193145eeefd03a0f32c1d8cc103c97cfa26b5af7363c9b08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237406,7 +236840,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2D8Cfcf04209Dc7F771D8D18E462C35A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AA PLUS INVEST d.o.o." and pe.signatures[i].serial=="2d:8c:fc:f0:42:09:dc:7f:77:1d:8d:18:e4:62:c3:5a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AA PLUS INVEST d.o.o." and pe.signatures [ i ] . serial == "2d:8c:fc:f0:42:09:dc:7f:77:1d:8d:18:e4:62:c3:5a" )
 }
 import "pe"
 
@@ -237415,13 +236849,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06De439Ba2Df4Dcd8240C211D60Cdf5E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "90623074-58ac-51fd-9b80-881d3187dc74"
+		id = "574a8b84-acd7-5f61-9a20-8260a7d18e3d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7400-L7412"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a2847853e2e9cc9e6909871b3f8e6de399fb76353e997b084c92dbcfe6c1a48f"
+		logic_hash = "v1_sha256_a2847853e2e9cc9e6909871b3f8e6de399fb76353e997b084c92dbcfe6c1a48f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237430,7 +236864,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06De439Ba2Df4Dcd8240C211D60Cdf5E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microleaves LTD" and pe.signatures[i].serial=="06:de:43:9b:a2:df:4d:cd:82:40:c2:11:d6:0c:df:5e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Microleaves LTD" and pe.signatures [ i ] . serial == "06:de:43:9b:a2:df:4d:cd:82:40:c2:11:d6:0c:df:5e" )
 }
 import "pe"
 
@@ -237439,13 +236873,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F454F2Fdc800B3454059D8889Bd73D67 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "277ac503-91c4-5266-b8a4-c01a48b8df4d"
+		id = "d9ac7733-d810-57b5-8124-35231afad48b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7414-L7429"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "91b33a3e915a007d00482905471e124045a373fef9c8b0fe9a987196d2ec013a"
+		logic_hash = "v1_sha256_91b33a3e915a007d00482905471e124045a373fef9c8b0fe9a987196d2ec013a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237454,7 +236888,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00F454F2Fdc800B3454059D8889Bd73D67 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BEAUTY CORP SRL" and (pe.signatures[i].serial=="f4:54:f2:fd:c8:00:b3:45:40:59:d8:88:9b:d7:3d:67" or pe.signatures[i].serial=="00:f4:54:f2:fd:c8:00:b3:45:40:59:d8:88:9b:d7:3d:67"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BEAUTY CORP SRL" and ( pe.signatures [ i ] . serial == "f4:54:f2:fd:c8:00:b3:45:40:59:d8:88:9b:d7:3d:67" or pe.signatures [ i ] . serial == "00:f4:54:f2:fd:c8:00:b3:45:40:59:d8:88:9b:d7:3d:67" ) )
 }
 import "pe"
 
@@ -237463,13 +236897,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Afe693728F8406054A613F6736F89E3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "64c4157e-2183-5f41-b938-df29e210ee80"
+		id = "ed61d542-cc09-52cd-a85c-22211f121438"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7431-L7443"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6993a13546a1eff8a4f770f224a14bffe7e3393f628337cff27cbf57ebab2a65"
+		logic_hash = "v1_sha256_6993a13546a1eff8a4f770f224a14bffe7e3393f628337cff27cbf57ebab2a65"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237478,7 +236912,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Afe693728F8406054A613F6736F89E3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ROB ALDERMAN FITNESS LIMITED" and pe.signatures[i].serial=="3a:fe:69:37:28:f8:40:60:54:a6:13:f6:73:6f:89:e3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ROB ALDERMAN FITNESS LIMITED" and pe.signatures [ i ] . serial == "3a:fe:69:37:28:f8:40:60:54:a6:13:f6:73:6f:89:e3" )
 }
 import "pe"
 
@@ -237487,13 +236921,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Fd7F9Cac1E9Ce71Ac757F93266E3B13 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6021f566-e297-5af4-b692-663480091296"
+		id = "71ab5969-4878-533f-b751-1c21ceec4395"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7445-L7457"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "319f858a15f8752d7637ab7036ed89b17c501c2422769339578e685fe6a57eea"
+		logic_hash = "v1_sha256_319f858a15f8752d7637ab7036ed89b17c501c2422769339578e685fe6a57eea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237502,7 +236936,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Fd7F9Cac1E9Ce71Ac757F93266E3B13 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE9\\x9D\\x92\\xE5\\xB2\\x9B\\xE4\\xB8\\x89\\xE5\\x96\\x9C\\xE8\\xB4\\xB8\\xE6\\x98\\x93\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="0f:d7:f9:ca:c1:e9:ce:71:ac:75:7f:93:26:6e:3b:13")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "\\xE9\\x9D\\x92\\xE5\\xB2\\x9B\\xE4\\xB8\\x89\\xE5\\x96\\x9C\\xE8\\xB4\\xB8\\xE6\\x98\\x93\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures [ i ] . serial == "0f:d7:f9:ca:c1:e9:ce:71:ac:75:7f:93:26:6e:3b:13" )
 }
 import "pe"
 
@@ -237511,13 +236945,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Fbf16A33D26390A15F046C310030Cf0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6c010106-141d-5121-9594-73edc872a381"
+		id = "155c38e1-9f29-5a7a-8163-dd01f8077ba9"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7459-L7471"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fc68fe14ec70de74a6dae7891dfbb82ee7974f37469cfa72d735e70e9194c405"
+		logic_hash = "v1_sha256_fc68fe14ec70de74a6dae7891dfbb82ee7974f37469cfa72d735e70e9194c405"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237526,7 +236960,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Fbf16A33D26390A15F046C310030Cf0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MACHINES SATU MARE SRL" and pe.signatures[i].serial=="5f:bf:16:a3:3d:26:39:0a:15:f0:46:c3:10:03:0c:f0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MACHINES SATU MARE SRL" and pe.signatures [ i ] . serial == "5f:bf:16:a3:3d:26:39:0a:15:f0:46:c3:10:03:0c:f0" )
 }
 import "pe"
 
@@ -237535,13 +236969,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_292Eb1133507F42E6F36C5549C189D5E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "60d3cc6e-bf58-55ae-a13b-0e22ecc8d5cd"
+		id = "73326ea9-79e3-590a-9533-28a9191706ad"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7473-L7485"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "456a09b1939d3f60e6ef735631eb681a9d15ea573552672fd14b19f60e8d8c73"
+		logic_hash = "v1_sha256_456a09b1939d3f60e6ef735631eb681a9d15ea573552672fd14b19f60e8d8c73"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237550,7 +236984,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_292Eb1133507F42E6F36C5549C189D5E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Affairs-case s.r.o." and pe.signatures[i].serial=="29:2e:b1:13:35:07:f4:2e:6f:36:c5:54:9c:18:9d:5e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Affairs-case s.r.o." and pe.signatures [ i ] . serial == "29:2e:b1:13:35:07:f4:2e:6f:36:c5:54:9c:18:9d:5e" )
 }
 import "pe"
 
@@ -237559,13 +236993,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Aaa455A172F7E3A2Dffb5C6B14F9C16 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "81c115a7-7ddf-58ba-b56e-a92652c7f217"
+		id = "6614b600-df8e-5b7c-950f-76f6339ac42c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7487-L7499"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dd10d388e9122585c8e5b2073725f50edbc85d0ca1e94a4b034e500e0e89b608"
+		logic_hash = "v1_sha256_dd10d388e9122585c8e5b2073725f50edbc85d0ca1e94a4b034e500e0e89b608"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237574,7 +237008,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2Aaa455A172F7E3A2Dffb5C6B14F9C16 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DREAM VILLAGE s.r.o." and pe.signatures[i].serial=="2a:aa:45:5a:17:2f:7e:3a:2d:ff:b5:c6:b1:4f:9c:16")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DREAM VILLAGE s.r.o." and pe.signatures [ i ] . serial == "2a:aa:45:5a:17:2f:7e:3a:2d:ff:b5:c6:b1:4f:9c:16" )
 }
 import "pe"
 
@@ -237583,13 +237017,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Ef6392B2993A6F67578299659467Ea8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f5539ca9-d5cc-538e-8e53-3274791bfa2b"
+		id = "55980cb6-ab10-501f-b4b3-8929e42fc174"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7501-L7513"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "eabfeb7abc968188276ba76cd94bd80aba340f5f920881fe13c0f7b093d65a55"
+		logic_hash = "v1_sha256_eabfeb7abc968188276ba76cd94bd80aba340f5f920881fe13c0f7b093d65a55"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237598,7 +237032,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Ef6392B2993A6F67578299659467Ea8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALUSEN d. o. o." and pe.signatures[i].serial=="1e:f6:39:2b:29:93:a6:f6:75:78:29:96:59:46:7e:a8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ALUSEN d. o. o." and pe.signatures [ i ] . serial == "1e:f6:39:2b:29:93:a6:f6:75:78:29:96:59:46:7e:a8" )
 }
 import "pe"
 
@@ -237607,13 +237041,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0F007898Afcba5F8Af8Ae65D01803617 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1c3fddc2-3348-5f94-bf3e-5ce95b6ef009"
+		id = "381c150f-b563-5317-bce3-e2c327e33980"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7515-L7527"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "260dbdd3d295ace9c478cc27061065803c159957a1eb2f7965ee2b358f02a73c"
+		logic_hash = "v1_sha256_260dbdd3d295ace9c478cc27061065803c159957a1eb2f7965ee2b358f02a73c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237622,7 +237056,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0F007898Afcba5F8Af8Ae65D01803617 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TechnoElek s.r.o." and pe.signatures[i].serial=="0f:00:78:98:af:cb:a5:f8:af:8a:e6:5d:01:80:36:17")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TechnoElek s.r.o." and pe.signatures [ i ] . serial == "0f:00:78:98:af:cb:a5:f8:af:8a:e6:5d:01:80:36:17" )
 }
 import "pe"
 
@@ -237631,13 +237065,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Aa1D84779792B57F91Fe7A4Bde041942 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "57b4741a-a23d-51aa-ad83-3a7d80368290"
+		id = "a40c3096-eeba-555b-b1a7-d1b788ec56c4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7529-L7543"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2e57d646910c570f421939fd0d47ddee60bc38bb2ca2ba1991bf334cf8d5574b"
+		logic_hash = "v1_sha256_2e57d646910c570f421939fd0d47ddee60bc38bb2ca2ba1991bf334cf8d5574b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237645,7 +237079,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00Aa1D84779792B57F91Fe7A4Bde041942 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AXIUM NORTHWESTERN HYDRO INC." and (pe.signatures[i].serial=="aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42" or pe.signatures[i].serial=="00:aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AXIUM NORTHWESTERN HYDRO INC." and ( pe.signatures [ i ] . serial == "aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42" or pe.signatures [ i ] . serial == "00:aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42" ) )
 }
 import "pe"
 
@@ -237654,13 +237088,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0690Ee21E99B1Cb3B599Bba7B9262Cdc : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0fa2103e-c04e-5380-b4e3-6ac35f0b71d8"
+		id = "ebbc471c-9205-5309-96f8-5e181258f43b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7545-L7556"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bc2aac1bd21f80d4233af37028820a36ebd56bceed9b1318e99e75b28b9408e3"
+		logic_hash = "v1_sha256_bc2aac1bd21f80d4233af37028820a36ebd56bceed9b1318e99e75b28b9408e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237668,7 +237102,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0690Ee21E99B1Cb3B599Bba7B9262Cdc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xiamen Tongbu Networks Ltd." and pe.signatures[i].serial=="06:90:ee:21:e9:9b:1c:b3:b5:99:bb:a7:b9:26:2c:dc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Xiamen Tongbu Networks Ltd." and pe.signatures [ i ] . serial == "06:90:ee:21:e9:9b:1c:b3:b5:99:bb:a7:b9:26:2c:dc" )
 }
 import "pe"
 
@@ -237677,13 +237111,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_425Dc3E0Ca8Bcdce19D00D87E3F0Ba28 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "41423db4-c475-558b-9a27-2b0ea59102ad"
+		id = "7055f575-a1ee-591e-9677-5b4e4e232172"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7558-L7569"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0fc85d3d01b37ff7870cade6f8e0e756593ff0b5c9eea3b687ff52985caa20dd"
+		logic_hash = "v1_sha256_0fc85d3d01b37ff7870cade6f8e0e756593ff0b5c9eea3b687ff52985caa20dd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237691,7 +237125,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_425Dc3E0Ca8Bcdce19D00D87E3F0Ba28 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Protover LLC" and pe.signatures[i].serial=="42:5d:c3:e0:ca:8b:cd:ce:19:d0:0d:87:e3:f0:ba:28")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Protover LLC" and pe.signatures [ i ] . serial == "42:5d:c3:e0:ca:8b:cd:ce:19:d0:0d:87:e3:f0:ba:28" )
 }
 import "pe"
 
@@ -237700,13 +237134,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00881573Fc67Ff7395Dde5Bccfbce5B088 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "10ef1865-9267-5f06-a1d5-9196b00f3dc6"
+		id = "167e4586-a004-58f3-9d2f-528576191932"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7571-L7585"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5b137cccecb16ad116b73fa1f9025f76846b85009fbd4962956499031d6eff35"
+		logic_hash = "v1_sha256_5b137cccecb16ad116b73fa1f9025f76846b85009fbd4962956499031d6eff35"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237714,7 +237148,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_00881573Fc67Ff7395Dde5Bccfbce5B088 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trade in Brasil s.r.o." and (pe.signatures[i].serial=="88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88" or pe.signatures[i].serial=="00:88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Trade in Brasil s.r.o." and ( pe.signatures [ i ] . serial == "88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88" or pe.signatures [ i ] . serial == "00:88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88" ) )
 }
 import "pe"
 
@@ -237723,13 +237157,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_15C5Af15Afecf1C900Cbab0Ca9165629 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "795fa78b-0cd4-5eb4-9d37-72b5c38e7466"
+		id = "abe2e400-cf23-5c8d-9693-6978dda1c4ff"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7587-L7599"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cfc72a85954cb12d89a09b47b5937216a7cfee4a71ac6335a2a94faadea1f68c"
+		logic_hash = "v1_sha256_cfc72a85954cb12d89a09b47b5937216a7cfee4a71ac6335a2a94faadea1f68c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237738,7 +237172,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_15C5Af15Afecf1C900Cbab0Ca9165629 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kompaniya Auttek" and pe.signatures[i].serial=="15:c5:af:15:af:ec:f1:c9:00:cb:ab:0c:a9:16:56:29")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Kompaniya Auttek" and pe.signatures [ i ] . serial == "15:c5:af:15:af:ec:f1:c9:00:cb:ab:0c:a9:16:56:29" )
 }
 import "pe"
 
@@ -237747,13 +237181,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_12705Fb66Bc22C68372A1C4E5Fa662E2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c9604f76-ad8a-5ac0-ba12-5030b12bedbf"
+		id = "60070717-21bc-5816-8b7e-324da9d571dd"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7601-L7613"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a212e491ce661dec5512f82eed42b1863afb75ce7fb185c41af178f3852b78c8"
+		logic_hash = "v1_sha256_a212e491ce661dec5512f82eed42b1863afb75ce7fb185c41af178f3852b78c8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237762,7 +237196,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_12705Fb66Bc22C68372A1C4E5Fa662E2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APRIL BROTHERS LTD" and pe.signatures[i].serial=="12:70:5f:b6:6b:c2:2c:68:37:2a:1c:4e:5f:a6:62:e2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APRIL BROTHERS LTD" and pe.signatures [ i ] . serial == "12:70:5f:b6:6b:c2:2c:68:37:2a:1c:4e:5f:a6:62:e2" )
 }
 import "pe"
 
@@ -237771,13 +237205,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_205483936F360924E8D2A4Eb6D3A9F31 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5cce232b-4dfc-5931-a4ea-2e3df5616026"
+		id = "1c0cf950-4fc8-5060-9cdb-35f323804e37"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7615-L7627"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "09bf63b88eda95aae094cecb868838f08b88a6b4fe2993145e20293034c12863"
+		logic_hash = "v1_sha256_09bf63b88eda95aae094cecb868838f08b88a6b4fe2993145e20293034c12863"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237786,7 +237220,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_205483936F360924E8D2A4Eb6D3A9F31 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SATURN CONSULTANCY LTD" and pe.signatures[i].serial=="20:54:83:93:6f:36:09:24:e8:d2:a4:eb:6d:3a:9f:31")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SATURN CONSULTANCY LTD" and pe.signatures [ i ] . serial == "20:54:83:93:6f:36:09:24:e8:d2:a4:eb:6d:3a:9f:31" )
 }
 import "pe"
 
@@ -237795,13 +237229,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06Bcb74291D96096577Bdb1E165Dce85 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e7c24edc-2e59-5ee1-ad2f-d260b4014fdd"
+		id = "a003178d-642f-581c-86bc-eef4af1b1f18"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7629-L7641"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "34f533f7c7e12aaac9a1998654fae6ffde366affa90e9cba061b356fa7190e71"
+		logic_hash = "v1_sha256_34f533f7c7e12aaac9a1998654fae6ffde366affa90e9cba061b356fa7190e71"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237810,7 +237244,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06Bcb74291D96096577Bdb1E165Dce85 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Revo Security SRL" and pe.signatures[i].serial=="06:bc:b7:42:91:d9:60:96:57:7b:db:1e:16:5d:ce:85")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Revo Security SRL" and pe.signatures [ i ] . serial == "06:bc:b7:42:91:d9:60:96:57:7b:db:1e:16:5d:ce:85" )
 }
 import "pe"
 
@@ -237819,13 +237253,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0D261C8470Adbb65800Ceaf3Eac70819 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "0304b3ae-6a3c-5831-a749-76432b3356b4"
+		id = "6a29b7d5-c9e7-5cba-aed6-f6e4dea1f8b7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7643-L7655"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e71f5d24500ac202aad5a439aa0d5f1bf7e6259c1d7e11bb40c7b9ae93bd86c0"
+		logic_hash = "v1_sha256_e71f5d24500ac202aad5a439aa0d5f1bf7e6259c1d7e11bb40c7b9ae93bd86c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237834,7 +237268,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0D261C8470Adbb65800Ceaf3Eac70819 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bandicam Company Corp." and pe.signatures[i].serial=="0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Bandicam Company Corp." and pe.signatures [ i ] . serial == "0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19" )
 }
 import "pe"
 
@@ -237843,13 +237277,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_40E27B7404Aa9B485F8A2Fc0C8E53Af3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1aee45e6-ff0b-56a6-a50e-284bf2122e3b"
+		id = "23d681a2-3f68-5012-b500-8627ab25ab76"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7657-L7668"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "95a0bcf9b52ba8f4b63453abf0ee28027689450557a2408c6b27f8aafcbbe945"
+		logic_hash = "v1_sha256_95a0bcf9b52ba8f4b63453abf0ee28027689450557a2408c6b27f8aafcbbe945"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237857,7 +237291,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_40E27B7404Aa9B485F8A2Fc0C8E53Af3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Southern Wall Systems, LLC" and pe.signatures[i].serial=="40:e2:7b:74:04:aa:9b:48:5f:8a:2f:c0:c8:e5:3a:f3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Southern Wall Systems, LLC" and pe.signatures [ i ] . serial == "40:e2:7b:74:04:aa:9b:48:5f:8a:2f:c0:c8:e5:3a:f3" )
 }
 import "pe"
 
@@ -237866,13 +237300,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_627Dfdf73A1455De5143A270799E6B7B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7d5f0279-9498-5713-9c02-a025268d108f"
+		id = "2f8768ac-f0e2-5108-ba5a-6f46d5d4af26"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7670-L7681"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "833e772e56e87f730ee1acb9d6ed747d239903cfd9470d777efab73c5d656f49"
+		logic_hash = "v1_sha256_833e772e56e87f730ee1acb9d6ed747d239903cfd9470d777efab73c5d656f49"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237880,7 +237314,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_627Dfdf73A1455De5143A270799E6B7B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuhai liancheng Technology Co., Ltd." and pe.signatures[i].serial=="62:7d:fd:f7:3a:14:55:de:51:43:a2:70:79:9e:6b:7b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Zhuhai liancheng Technology Co., Ltd." and pe.signatures [ i ] . serial == "62:7d:fd:f7:3a:14:55:de:51:43:a2:70:79:9e:6b:7b" )
 }
 import "pe"
 
@@ -237889,13 +237323,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1966Bc76Bda1A708334792Da9A336F69 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "254ccdb7-df1c-560a-af68-123ea66c3463"
+		id = "4856380c-5461-5827-9e23-9f17a6f35f4f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7683-L7694"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d0293e76f8a595d769fd302829bd94a576d647bbacb586728e804bf4dce1af78"
+		logic_hash = "v1_sha256_d0293e76f8a595d769fd302829bd94a576d647bbacb586728e804bf4dce1af78"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237903,7 +237337,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1966Bc76Bda1A708334792Da9A336F69 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SYNTHETIC LABS LIMITED" and pe.signatures[i].serial=="19:66:bc:76:bd:a1:a7:08:33:47:92:da:9a:33:6f:69")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SYNTHETIC LABS LIMITED" and pe.signatures [ i ] . serial == "19:66:bc:76:bd:a1:a7:08:33:47:92:da:9a:33:6f:69" )
 }
 import "pe"
 
@@ -237912,13 +237346,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_82D224323Efa65060B641F51Fadfef02 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2c0b0e6d-2c82-506b-88ea-a6d49f0f64a6"
+		id = "eeb1caad-1c76-5d2b-b08c-4a29aaa16fe1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7696-L7710"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3ed849dfd905e01145274d41b3bbb2c0265b099e540ac17909b6ed59f006e245"
+		logic_hash = "v1_sha256_3ed849dfd905e01145274d41b3bbb2c0265b099e540ac17909b6ed59f006e245"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237926,7 +237360,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_82D224323Efa65060B641F51Fadfef02 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAVAS INVESTMENTS PTY LTD" and (pe.signatures[i].serial=="82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02" or pe.signatures[i].serial=="00:82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SAVAS INVESTMENTS PTY LTD" and ( pe.signatures [ i ] . serial == "82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02" or pe.signatures [ i ] . serial == "00:82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02" ) )
 }
 import "pe"
 
@@ -237935,13 +237369,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Be2F22C152Bb218B898C4029056816A9 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "50c0cee3-39d5-5c57-9515-11356f8cab93"
+		id = "abdf4c7d-1b17-5df4-90d6-0156054ed178"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7712-L7726"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9eba1585d92b184afb7b75b84e0010539ac42ca27e4d5d8bccee6b01e3471cca"
+		logic_hash = "v1_sha256_9eba1585d92b184afb7b75b84e0010539ac42ca27e4d5d8bccee6b01e3471cca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237949,7 +237383,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Be2F22C152Bb218B898C4029056816A9 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marts GmbH" and (pe.signatures[i].serial=="be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9" or pe.signatures[i].serial=="00:be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9"))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Marts GmbH" and ( pe.signatures [ i ] . serial == "be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9" or pe.signatures [ i ] . serial == "00:be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9" ) )
 }
 import "pe"
 
@@ -237958,13 +237392,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_29E8E993D2406454B6B18Cb377471Bc6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a80f015c-3793-52ac-a405-1a7fe2ca0caa"
+		id = "837be216-7f18-567b-88a7-e14b32b05b74"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7728-L7739"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bf248e664d00675d3fc87070b6358ca7539ef6e748b8bfafcba7ecb91cb1ea05"
+		logic_hash = "v1_sha256_bf248e664d00675d3fc87070b6358ca7539ef6e748b8bfafcba7ecb91cb1ea05"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237972,7 +237406,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_29E8E993D2406454B6B18Cb377471Bc6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MONDIAL MONTERO SP Z O O" and pe.signatures[i].serial=="29:e8:e9:93:d2:40:64:54:b6:b1:8c:b3:77:47:1b:c6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MONDIAL MONTERO SP Z O O" and pe.signatures [ i ] . serial == "29:e8:e9:93:d2:40:64:54:b6:b1:8c:b3:77:47:1b:c6" )
 }
 import "pe"
 
@@ -237981,13 +237415,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Daa67498C3A5D8133F28Fefe9Ccc20E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5eb899b3-347d-5e74-8afa-29ffa73c7231"
+		id = "bfe85bb4-4950-59a9-b70a-88665684194d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7741-L7754"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dc66a18e4f8d14f98e5a8073d32b641e0eb795e989fb62ac23207e765838561a"
+		logic_hash = "v1_sha256_dc66a18e4f8d14f98e5a8073d32b641e0eb795e989fb62ac23207e765838561a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -237996,7 +237430,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6Daa67498C3A5D8133F28Fefe9Ccc20E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rimsara Development OU" and pe.signatures[i].serial=="6d:aa:67:49:8c:3a:5d:81:33:f2:8f:ef:e9:cc:c2:0e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rimsara Development OU" and pe.signatures [ i ] . serial == "6d:aa:67:49:8c:3a:5d:81:33:f2:8f:ef:e9:cc:c2:0e" )
 }
 import "pe"
 
@@ -238005,13 +237439,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_59F296D0Af649E0962D724248D9Fdcdb : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c9423cae-07a7-5ecb-966d-b1636563934a"
+		id = "48840741-5537-5674-85d1-95296b126b20"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7756-L7769"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0212033b2ea12f568a3c2e4d3768194c8035c6b6ebf054af90fe82ffcd7e6a5b"
+		logic_hash = "v1_sha256_0212033b2ea12f568a3c2e4d3768194c8035c6b6ebf054af90fe82ffcd7e6a5b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238020,7 +237454,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_59F296D0Af649E0962D724248D9Fdcdb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MK ZN s.r.o." and pe.signatures[i].serial=="59:f2:96:d0:af:64:9e:09:62:d7:24:24:8d:9f:dc:db")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MK ZN s.r.o." and pe.signatures [ i ] . serial == "59:f2:96:d0:af:64:9e:09:62:d7:24:24:8d:9f:dc:db" )
 }
 import "pe"
 
@@ -238029,13 +237463,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A32F3Ba229704Ad400473F7479E4C3E4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "28d687bc-e67c-51d1-82af-53255ee44a8d"
+		id = "39092df2-663e-5641-9d6d-74511948b5cf"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7771-L7784"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9c7b9b6827e10a8c2a6d771d14068a074104683fe75f24dea85c5bf3f3bc04db"
+		logic_hash = "v1_sha256_9c7b9b6827e10a8c2a6d771d14068a074104683fe75f24dea85c5bf3f3bc04db"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238044,7 +237478,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A32F3Ba229704Ad400473F7479E4C3E4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SOTUL SOLUTIONS LIMITED" and pe.signatures[i].serial=="a3:2f:3b:a2:29:70:4a:d4:00:47:3f:74:79:e4:c3:e4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SOTUL SOLUTIONS LIMITED" and pe.signatures [ i ] . serial == "a3:2f:3b:a2:29:70:4a:d4:00:47:3f:74:79:e4:c3:e4" )
 }
 import "pe"
 
@@ -238053,13 +237487,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Ab74A2Ebf93447Adb83554B5564Fe03 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1b0be137-ddcf-5215-9cb0-d687d7b6ca6c"
+		id = "5604c445-201c-5ec2-8cfc-e9df815b2f2e"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7786-L7799"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8dbc549ecaf1cb3f07486bac7ed265882af4b6b29b9772736118490eb9233303"
+		logic_hash = "v1_sha256_8dbc549ecaf1cb3f07486bac7ed265882af4b6b29b9772736118490eb9233303"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238068,7 +237502,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3Ab74A2Ebf93447Adb83554B5564Fe03 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IMPERIOUS TECHNOLOGIES LIMITED" and pe.signatures[i].serial=="3a:b7:4a:2e:bf:93:44:7a:db:83:55:4b:55:64:fe:03")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "IMPERIOUS TECHNOLOGIES LIMITED" and pe.signatures [ i ] . serial == "3a:b7:4a:2e:bf:93:44:7a:db:83:55:4b:55:64:fe:03" )
 }
 import "pe"
 
@@ -238077,13 +237511,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_90212473C706F523Fe84Bdb9A78A01F4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f195cf1e-4e01-51ec-ae12-21ff56dd58e2"
+		id = "bc498f60-b2f8-5a57-a034-7ea3d3204052"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7801-L7814"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8cd1e984bb81f071053614ae9d037d7ff5e01fb95aaa0474492386a7b5faecec"
+		logic_hash = "v1_sha256_8cd1e984bb81f071053614ae9d037d7ff5e01fb95aaa0474492386a7b5faecec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238092,7 +237526,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_90212473C706F523Fe84Bdb9A78A01F4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DEMUS, OOO" and pe.signatures[i].serial=="90:21:24:73:c7:06:f5:23:fe:84:bd:b9:a7:8a:01:f4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DEMUS, OOO" and pe.signatures [ i ] . serial == "90:21:24:73:c7:06:f5:23:fe:84:bd:b9:a7:8a:01:f4" )
 }
 import "pe"
 
@@ -238101,13 +237535,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5C9F5F96726A6E6Fc3B8Bb153Ac82Af2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f79e1a89-c7b4-5390-b20b-3f563f409cfe"
+		id = "f359ef16-93eb-5e76-a57b-a9d2eb3b8857"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7816-L7829"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "da76d86509aee2f9cac992e6b081dce5e68c747ad34abd2daeb32e6e390b880b"
+		logic_hash = "v1_sha256_da76d86509aee2f9cac992e6b081dce5e68c747ad34abd2daeb32e6e390b880b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238116,7 +237550,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5C9F5F96726A6E6Fc3B8Bb153Ac82Af2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "1105 SOFTWARE LLC" and pe.signatures[i].serial=="5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "1105 SOFTWARE LLC" and pe.signatures [ i ] . serial == "5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2" )
 }
 import "pe"
 
@@ -238125,13 +237559,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2A2F270535C2D5E7630720Fb229B5D1C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3ed98546-92b2-5566-9716-ae8209ece9d6"
+		id = "2285f251-b7ff-509d-8d02-2fd6c534f544"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7831-L7844"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7d9785c12d2d744fbafab009edfb1ef232eadcdbc8eee99d0ad0daacabbabf26"
+		logic_hash = "v1_sha256_7d9785c12d2d744fbafab009edfb1ef232eadcdbc8eee99d0ad0daacabbabf26"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238140,7 +237574,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2A2F270535C2D5E7630720Fb229B5D1C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KOZUZ SP. Z O.O." and pe.signatures[i].serial=="2a:2f:27:05:35:c2:d5:e7:63:07:20:fb:22:9b:5d:1c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "KOZUZ SP. Z O.O." and pe.signatures [ i ] . serial == "2a:2f:27:05:35:c2:d5:e7:63:07:20:fb:22:9b:5d:1c" )
 }
 import "pe"
 
@@ -238149,13 +237583,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4659Fa5Fc1E0397Df79Fd6A4083D93B0 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a0d2449c-c1b0-5e6a-9fa3-d8fe8e318c62"
+		id = "f7e3e416-2b11-553c-a3e1-47c01cfce541"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7846-L7859"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6d8a10d77e63d2a62ce45606dd9a317220aa124a50fa95028a45d9f5899ec6e3"
+		logic_hash = "v1_sha256_6d8a10d77e63d2a62ce45606dd9a317220aa124a50fa95028a45d9f5899ec6e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238164,7 +237598,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4659Fa5Fc1E0397Df79Fd6A4083D93B0 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Incuber Services LLP" and pe.signatures[i].serial=="46:59:fa:5f:c1:e0:39:7d:f7:9f:d6:a4:08:3d:93:b0")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Incuber Services LLP" and pe.signatures [ i ] . serial == "46:59:fa:5f:c1:e0:39:7d:f7:9f:d6:a4:08:3d:93:b0" )
 }
 import "pe"
 
@@ -238173,13 +237607,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_651F3E5B491B197D20C49B9C7B25B775 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fb8b4a88-631b-5a5c-ab36-286b74a3a346"
+		id = "c95f617a-a8c8-5d4f-bd71-7d714ad1d244"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7861-L7874"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fe06e8f6fd87d5a9044a6ff609da73b7d9e7d1f07cc9e84ee2fd2940be615323"
+		logic_hash = "v1_sha256_fe06e8f6fd87d5a9044a6ff609da73b7d9e7d1f07cc9e84ee2fd2940be615323"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238188,7 +237622,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_651F3E5B491B197D20C49B9C7B25B775 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rhynedahll Software LLC" and pe.signatures[i].serial=="65:1f:3e:5b:49:1b:19:7d:20:c4:9b:9c:7b:25:b7:75")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Rhynedahll Software LLC" and pe.signatures [ i ] . serial == "65:1f:3e:5b:49:1b:19:7d:20:c4:9b:9c:7b:25:b7:75" )
 }
 import "pe"
 
@@ -238197,13 +237631,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_67936A84Bed66Ef021Dbe771De331772 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2739308a-7396-5fe2-bf1b-fe7e6e5d1f80"
+		id = "1fcb52d4-ff12-544e-86df-a4c602847c7a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7876-L7889"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "da149e6835be937e0bf2763052d4cbabb367910061aec3c394dffaa45d9b0ac6"
+		logic_hash = "v1_sha256_da149e6835be937e0bf2763052d4cbabb367910061aec3c394dffaa45d9b0ac6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238212,7 +237646,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_67936A84Bed66Ef021Dbe771De331772 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APEX SOFTWARE DESIGN, LLC" and pe.signatures[i].serial=="67:93:6a:84:be:d6:6e:f0:21:db:e7:71:de:33:17:72")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "APEX SOFTWARE DESIGN, LLC" and pe.signatures [ i ] . serial == "67:93:6a:84:be:d6:6e:f0:21:db:e7:71:de:33:17:72" )
 }
 import "pe"
 
@@ -238221,13 +237655,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_8538A6C5018F50Fc : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8790c06a-3b7a-5e40-9a9c-0f2064029daf"
+		id = "af9d792c-078c-59d6-95a3-75d880f981a1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7891-L7904"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2ef3c7a45eb1d46e6c159ec9692fa5c17ff7679f41d96d04de52aa52ce96fa6b"
+		logic_hash = "v1_sha256_2ef3c7a45eb1d46e6c159ec9692fa5c17ff7679f41d96d04de52aa52ce96fa6b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238236,7 +237670,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_8538A6C5018F50Fc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trading Technologies International, Inc." and pe.signatures[i].serial=="85:38:a6:c5:01:8f:50:fc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Trading Technologies International, Inc." and pe.signatures [ i ] . serial == "85:38:a6:c5:01:8f:50:fc" )
 }
 import "pe"
 
@@ -238245,13 +237679,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fecc3B3C675F7Ffd7De22507F3Fdacd7 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b91a7dcd-6212-5750-9bc8-0eb37d9e129b"
+		id = "f99a1bee-3dfc-50f3-b293-3b392dd35d46"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7906-L7919"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1319f4ccb5ab07c1c538d6a183fa25726b3d42192eaa878a2c402be2c93219f7"
+		logic_hash = "v1_sha256_1319f4ccb5ab07c1c538d6a183fa25726b3d42192eaa878a2c402be2c93219f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238260,7 +237694,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Fecc3B3C675F7Ffd7De22507F3Fdacd7 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gromit Electronics Limited" and pe.signatures[i].serial=="fe:cc:3b:3c:67:5f:7f:fd:7d:e2:25:07:f3:fd:ac:d7")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Gromit Electronics Limited" and pe.signatures [ i ] . serial == "fe:cc:3b:3c:67:5f:7f:fd:7d:e2:25:07:f3:fd:ac:d7" )
 }
 import "pe"
 
@@ -238269,13 +237703,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5294F0F841F29855E33A18402421949A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3153f039-afd2-5eb5-b090-b205d9778eb7"
+		id = "62719793-83ca-50d9-9a55-cd81cb9de464"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7921-L7934"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b9d2b10c4117de276cb41148b41921115f414aa17e261956c8550adf6127d5b9"
+		logic_hash = "v1_sha256_b9d2b10c4117de276cb41148b41921115f414aa17e261956c8550adf6127d5b9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238284,7 +237718,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5294F0F841F29855E33A18402421949A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Integrated Plotting Solutions Limited" and pe.signatures[i].serial=="52:94:f0:f8:41:f2:98:55:e3:3a:18:40:24:21:94:9a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Integrated Plotting Solutions Limited" and pe.signatures [ i ] . serial == "52:94:f0:f8:41:f2:98:55:e3:3a:18:40:24:21:94:9a" )
 }
 import "pe"
 
@@ -238293,13 +237727,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1614Ef66B2C4B886E71A93Dd34869F48 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "27bead15-f7fa-55a1-9347-ea551e1e0e18"
+		id = "062b741a-3c35-5d5a-87b2-6ea19ca0279f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7936-L7949"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "26265d54d8b58128c1a9a3b322f339d1beb438f403637519b11ff324af91d1e2"
+		logic_hash = "v1_sha256_26265d54d8b58128c1a9a3b322f339d1beb438f403637519b11ff324af91d1e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238308,7 +237742,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1614Ef66B2C4B886E71A93Dd34869F48 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHIRT AND CUFF LIMITED" and pe.signatures[i].serial=="16:14:ef:66:b2:c4:b8:86:e7:1a:93:dd:34:86:9f:48")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SHIRT AND CUFF LIMITED" and pe.signatures [ i ] . serial == "16:14:ef:66:b2:c4:b8:86:e7:1a:93:dd:34:86:9f:48" )
 }
 import "pe"
 
@@ -238317,13 +237751,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_65Cfd8419D70Ce4011D97Bc79D18315E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2368b3d1-1cd5-575b-a3ff-270349563d1a"
+		id = "1f5ac78a-2817-5807-9a6e-4167b3f3401b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7951-L7964"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "675ab6ef0f744f62db892992c6b3614e14b95f64e2800a0d10e55b915a2b4e74"
+		logic_hash = "v1_sha256_675ab6ef0f744f62db892992c6b3614e14b95f64e2800a0d10e55b915a2b4e74"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238332,7 +237766,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_65Cfd8419D70Ce4011D97Bc79D18315E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FACE AESTHETICS LTD" and pe.signatures[i].serial=="65:cf:d8:41:9d:70:ce:40:11:d9:7b:c7:9d:18:31:5e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FACE AESTHETICS LTD" and pe.signatures [ i ] . serial == "65:cf:d8:41:9d:70:ce:40:11:d9:7b:c7:9d:18:31:5e" )
 }
 import "pe"
 
@@ -238341,13 +237775,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_01Cf0B0F01B20B70Bfaa69722979Ef5C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "23f5047d-b8f9-5f17-9add-6e29dce9a976"
+		id = "b5993055-861d-53b2-a7c0-70cea1e70d54"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7966-L7979"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5942c0196d7264783590c599ccfb0fe6518b338238ddb3df4e4f8999922ce86b"
+		logic_hash = "v1_sha256_5942c0196d7264783590c599ccfb0fe6518b338238ddb3df4e4f8999922ce86b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238356,7 +237790,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_01Cf0B0F01B20B70Bfaa69722979Ef5C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PET PLUS PTY LTD" and pe.signatures[i].serial=="01:cf:0b:0f:01:b2:0b:70:bf:aa:69:72:29:79:ef:5c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PET PLUS PTY LTD" and pe.signatures [ i ] . serial == "01:cf:0b:0f:01:b2:0b:70:bf:aa:69:72:29:79:ef:5c" )
 }
 import "pe"
 
@@ -238365,13 +237799,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_698Ff388Adb50B88Afb832E76B0A0Ad1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8118e0ee-6214-54f3-b025-234f9e685832"
+		id = "46fd90be-0912-591a-b940-57eabf72c034"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7981-L7994"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7734256201739dece5ae039d45ed79c74be6228f7da51fc82c0cfd2d4aacfd4b"
+		logic_hash = "v1_sha256_7734256201739dece5ae039d45ed79c74be6228f7da51fc82c0cfd2d4aacfd4b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238380,7 +237814,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_698Ff388Adb50B88Afb832E76B0A0Ad1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BELLAP LIMITED" and pe.signatures[i].serial=="69:8f:f3:88:ad:b5:0b:88:af:b8:32:e7:6b:0a:0a:d1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BELLAP LIMITED" and pe.signatures [ i ] . serial == "69:8f:f3:88:ad:b5:0b:88:af:b8:32:e7:6b:0a:0a:d1" )
 }
 import "pe"
 
@@ -238389,13 +237823,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5143Cf38D5Fd26858830826632Be9Fda : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "653a969a-9aed-5a26-9962-92bc173ddfdd"
+		id = "695c787a-d21b-5b04-bd66-287c3fb6ef4b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L7996-L8009"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b6f33fd94f8098ca9d4fe98b3dc0a833f0be78fe854c62d715b98a2ba980b8ac"
+		logic_hash = "v1_sha256_b6f33fd94f8098ca9d4fe98b3dc0a833f0be78fe854c62d715b98a2ba980b8ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238404,7 +237838,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5143Cf38D5Fd26858830826632Be9Fda : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIGI CORP MEDIA LLC" and pe.signatures[i].serial=="51:43:cf:38:d5:fd:26:85:88:30:82:66:32:be:9f:da")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DIGI CORP MEDIA LLC" and pe.signatures [ i ] . serial == "51:43:cf:38:d5:fd:26:85:88:30:82:66:32:be:9f:da" )
 }
 import "pe"
 
@@ -238413,13 +237847,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3628B93Bcd902B6B3E1Ffdf2E13Dfcf5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8b8fa36d-181b-57a1-853e-ab11a5127fd7"
+		id = "96874d78-a12e-5737-a4f4-02afcb498c0f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8011-L8024"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bf9b2ab7a379437daa04565fdf7adc04db2f6f1a6284d1fd91f037b255523c42"
+		logic_hash = "v1_sha256_bf9b2ab7a379437daa04565fdf7adc04db2f6f1a6284d1fd91f037b255523c42"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238428,7 +237862,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3628B93Bcd902B6B3E1Ffdf2E13Dfcf5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="36:28:b9:3b:cd:90:2b:6b:3e:1f:fd:f2:e1:3d:fc:f5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT,LLC" and pe.signatures [ i ] . serial == "36:28:b9:3b:cd:90:2b:6b:3e:1f:fd:f2:e1:3d:fc:f5" )
 }
 import "pe"
 
@@ -238437,13 +237871,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A32B8B4F1Be43C23Eb2848Ab4Ef06Bb2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f0baf7ea-7022-5834-a46c-b67bfbe706d0"
+		id = "cf3b9c47-c74c-5eee-b793-f0f78870b509"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8026-L8039"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "438667b55f23b689627fc1e5bce0e53b960ef51d1a7d3203e398c59bd94ffe93"
+		logic_hash = "v1_sha256_438667b55f23b689627fc1e5bce0e53b960ef51d1a7d3203e398c59bd94ffe93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238452,7 +237886,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_A32B8B4F1Be43C23Eb2848Ab4Ef06Bb2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pak El AB" and pe.signatures[i].serial=="a3:2b:8b:4f:1b:e4:3c:23:eb:28:48:ab:4e:f0:6b:b2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Pak El AB" and pe.signatures [ i ] . serial == "a3:2b:8b:4f:1b:e4:3c:23:eb:28:48:ab:4e:f0:6b:b2" )
 }
 import "pe"
 
@@ -238461,13 +237895,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_17Ccecc181Ed65A357Edf3B01Df62Cc9 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b692d8dd-e7c9-53cb-8c65-0001c2af3f6f"
+		id = "f9041d83-57ed-51c6-9f89-f33515549c75"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8041-L8054"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d79968633717744ab9e9006f8d958c1e240a1e0f99fd0b4c603d42bb7cd4773c"
+		logic_hash = "v1_sha256_d79968633717744ab9e9006f8d958c1e240a1e0f99fd0b4c603d42bb7cd4773c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238476,7 +237910,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_17Ccecc181Ed65A357Edf3B01Df62Cc9 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="17:cc:ec:c1:81:ed:65:a3:57:ed:f3:b0:1d:f6:2c:c9")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT,LLC" and pe.signatures [ i ] . serial == "17:cc:ec:c1:81:ed:65:a3:57:ed:f3:b0:1d:f6:2c:c9" )
 }
 import "pe"
 
@@ -238485,13 +237919,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_332Bd5801E8415585E72C87E0E2Ec71D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a4e1560f-12e4-5f49-a714-7df939dad513"
+		id = "0dc6c1c6-a5ce-5b87-b06f-09060437aec4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8056-L8069"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ad3b1aebedd1ecef9af96da991cdbaca8033e0d48b5e7b776dd3fd3c4024928e"
+		logic_hash = "v1_sha256_ad3b1aebedd1ecef9af96da991cdbaca8033e0d48b5e7b776dd3fd3c4024928e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238500,7 +237934,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_332Bd5801E8415585E72C87E0E2Ec71D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elite Marketing Strategies, Inc." and pe.signatures[i].serial=="33:2b:d5:80:1e:84:15:58:5e:72:c8:7e:0e:2e:c7:1d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Elite Marketing Strategies, Inc." and pe.signatures [ i ] . serial == "33:2b:d5:80:1e:84:15:58:5e:72:c8:7e:0e:2e:c7:1d" )
 }
 import "pe"
 
@@ -238509,13 +237943,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0139Dde119Bb320Dfb9F5Defe3F71245 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4962ea0c-ce99-57d3-8848-48dcaab4f346"
+		id = "5400edcd-db34-5f5b-9d47-d7b057e2b9ef"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8071-L8084"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b2a7154d73eb9271a181d71d65c73e399bb2f7d1fe031240e94b6ef4c4f7cb18"
+		logic_hash = "v1_sha256_b2a7154d73eb9271a181d71d65c73e399bb2f7d1fe031240e94b6ef4c4f7cb18"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238524,7 +237958,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0139Dde119Bb320Dfb9F5Defe3F71245 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hangil IT Co., Ltd" and pe.signatures[i].serial=="01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Hangil IT Co., Ltd" and pe.signatures [ i ] . serial == "01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45" )
 }
 import "pe"
 
@@ -238533,13 +237967,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2F96A89Bfec6E44Dd224E8Fd7E72D9Bb : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a905ee22-94c6-5d16-a9a4-a1c1528e4ac2"
+		id = "adbd9cc3-3b69-5627-a0e9-4dac3432c00c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8086-L8099"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "94a5721bd3089f46699a947afcd03287712f94754666809e6495b01fc9cd6dcf"
+		logic_hash = "v1_sha256_94a5721bd3089f46699a947afcd03287712f94754666809e6495b01fc9cd6dcf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238548,7 +237982,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2F96A89Bfec6E44Dd224E8Fd7E72D9Bb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NAILS UNLIMITED LIMITED" and pe.signatures[i].serial=="2f:96:a8:9b:fe:c6:e4:4d:d2:24:e8:fd:7e:72:d9:bb")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "NAILS UNLIMITED LIMITED" and pe.signatures [ i ] . serial == "2f:96:a8:9b:fe:c6:e4:4d:d2:24:e8:fd:7e:72:d9:bb" )
 }
 import "pe"
 
@@ -238557,13 +237991,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_626735Ed30E50E3E0553986D806Bfc54 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5cab852e-8483-5c38-a396-3a53cf64450a"
+		id = "23ee05fa-d51e-5c46-aa4e-424d21762673"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8101-L8114"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "960005fe1a28ddb50261aeaaa850a2410ac03ee9709af2a75485313676c92c53"
+		logic_hash = "v1_sha256_960005fe1a28ddb50261aeaaa850a2410ac03ee9709af2a75485313676c92c53"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238572,7 +238006,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_626735Ed30E50E3E0553986D806Bfc54 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FISH ACCOUNTING & TRANSLATING LIMITED" and pe.signatures[i].serial=="62:67:35:ed:30:e5:0e:3e:05:53:98:6d:80:6b:fc:54")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FISH ACCOUNTING & TRANSLATING LIMITED" and pe.signatures [ i ] . serial == "62:67:35:ed:30:e5:0e:3e:05:53:98:6d:80:6b:fc:54" )
 }
 import "pe"
 
@@ -238581,13 +238015,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4A2E337Fff23E5B2A1321Ffde56D1759 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "60d218b2-5297-59e6-9370-fc0ba036c688"
+		id = "1610c800-7ca1-5c4a-94b8-9dae440941cc"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8116-L8129"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "524048d39de89002efbb8bf75135551b300e03f1126e5e117a4682c79ec04c9a"
+		logic_hash = "v1_sha256_524048d39de89002efbb8bf75135551b300e03f1126e5e117a4682c79ec04c9a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238596,7 +238030,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4A2E337Fff23E5B2A1321Ffde56D1759 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Karolina Klimowska" and pe.signatures[i].serial=="4a:2e:33:7f:ff:23:e5:b2:a1:32:1f:fd:e5:6d:17:59")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Karolina Klimowska" and pe.signatures [ i ] . serial == "4a:2e:33:7f:ff:23:e5:b2:a1:32:1f:fd:e5:6d:17:59" )
 }
 import "pe"
 
@@ -238605,13 +238039,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_967Cb0898680D1C174B2Baae5Fa332Db : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a95f7912-89fc-5c80-96ab-19e6ee2ccafd"
+		id = "3e4df6a9-dd04-5abc-814d-eba54382f6c7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8131-L8144"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8c68127b29d1a1aa4c1e2033c809fa57466f224c2bb4ede0ffb2b572a3d58c0f"
+		logic_hash = "v1_sha256_8c68127b29d1a1aa4c1e2033c809fa57466f224c2bb4ede0ffb2b572a3d58c0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238620,7 +238054,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_967Cb0898680D1C174B2Baae5Fa332Db : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "James Caulfield" and pe.signatures[i].serial=="96:7c:b0:89:86:80:d1:c1:74:b2:ba:ae:5f:a3:32:db")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "James Caulfield" and pe.signatures [ i ] . serial == "96:7c:b0:89:86:80:d1:c1:74:b2:ba:ae:5f:a3:32:db" )
 }
 import "pe"
 
@@ -238629,13 +238063,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_890570B6B0E2868A53Be3F8F904A88Ee : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8d619117-00cb-5276-87c1-3f6cd701218d"
+		id = "77915577-ba4d-5a6e-85a9-64d3c70129c6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8146-L8159"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "952b211cc2c7988b9a09ca5a96c44fea24bbaced28a79ab0ae6732675fda7365"
+		logic_hash = "v1_sha256_952b211cc2c7988b9a09ca5a96c44fea24bbaced28a79ab0ae6732675fda7365"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238644,7 +238078,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_890570B6B0E2868A53Be3F8F904A88Ee : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JESEN LESS d.o.o." and pe.signatures[i].serial=="89:05:70:b6:b0:e2:86:8a:53:be:3f:8f:90:4a:88:ee")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "JESEN LESS d.o.o." and pe.signatures [ i ] . serial == "89:05:70:b6:b0:e2:86:8a:53:be:3f:8f:90:4a:88:ee" )
 }
 import "pe"
 
@@ -238653,13 +238087,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7D27332C3Cb3A382A4Fd232C5C66A2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d9f0d30b-ac9d-57f9-8220-c6a376fe68db"
+		id = "e9e60dae-3f4e-57d1-a8f3-5b3e9e38a38d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8161-L8174"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d21218469ae41def8eed3d2cff38744ae928d9e8fed8ff68c539d33193136e0f"
+		logic_hash = "v1_sha256_d21218469ae41def8eed3d2cff38744ae928d9e8fed8ff68c539d33193136e0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238668,7 +238102,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_7D27332C3Cb3A382A4Fd232C5C66A2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MALVINA RECRUITMENT LIMITED" and pe.signatures[i].serial=="7d:27:33:2c:3c:b3:a3:82:a4:fd:23:2c:5c:66:a2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "MALVINA RECRUITMENT LIMITED" and pe.signatures [ i ] . serial == "7d:27:33:2c:3c:b3:a3:82:a4:fd:23:2c:5c:66:a2" )
 }
 import "pe"
 
@@ -238677,13 +238111,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_40F5660A90301E7A8A8C3B42 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c3c8fbdf-49ca-5898-b267-74256154973a"
+		id = "ace92961-3499-5d7c-abae-8a5a1382b5ca"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8176-L8189"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ed584aa8ad833066ed9f7ddbf98dc75efe88e0b7e69f564a90eade63dc2aee2d"
+		logic_hash = "v1_sha256_ed584aa8ad833066ed9f7ddbf98dc75efe88e0b7e69f564a90eade63dc2aee2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238692,7 +238126,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_40F5660A90301E7A8A8C3B42 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Booz Allen Hamilton Inc." and pe.signatures[i].serial=="40:f5:66:0a:90:30:1e:7a:8a:8c:3b:42")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Booz Allen Hamilton Inc." and pe.signatures [ i ] . serial == "40:f5:66:0a:90:30:1e:7a:8a:8c:3b:42" )
 }
 import "pe"
 
@@ -238701,13 +238135,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dfc1F1B0F205Cc17Ed7D216Bb991F859 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "93d5fd87-af92-5449-9d02-4666afa38fff"
+		id = "de291853-786c-5e81-a7a7-af94a409a333"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8191-L8204"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "24783267ab27f8102f724810322a7fbb010b7a2abf59ad206b96a3eb75968907"
+		logic_hash = "v1_sha256_24783267ab27f8102f724810322a7fbb010b7a2abf59ad206b96a3eb75968907"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238716,7 +238150,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dfc1F1B0F205Cc17Ed7D216Bb991F859 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Astori LLC" and pe.signatures[i].serial=="df:c1:f1:b0:f2:05:cc:17:ed:7d:21:6b:b9:91:f8:59")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Astori LLC" and pe.signatures [ i ] . serial == "df:c1:f1:b0:f2:05:cc:17:ed:7d:21:6b:b9:91:f8:59" )
 }
 import "pe"
 
@@ -238725,13 +238159,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E573D9C8B403C41Bd59Ffa0A8Efd4168 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "683ea9a6-2002-5c48-8512-51f65e70dd2c"
+		id = "29553e84-bc51-57b1-b8f7-d80bb1278aec"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8206-L8219"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ec53ab007d8be2f3cad45e787e724c5af0dd3f18c2b66a179b822bdeeb0d1560"
+		logic_hash = "v1_sha256_ec53ab007d8be2f3cad45e787e724c5af0dd3f18c2b66a179b822bdeeb0d1560"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238740,7 +238174,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E573D9C8B403C41Bd59Ffa0A8Efd4168 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VERONIKA 2\" OOO\"" and pe.signatures[i].serial=="e5:73:d9:c8:b4:03:c4:1b:d5:9f:fa:0a:8e:fd:41:68")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VERONIKA 2\" OOO\"" and pe.signatures [ i ] . serial == "e5:73:d9:c8:b4:03:c4:1b:d5:9f:fa:0a:8e:fd:41:68" )
 }
 import "pe"
 
@@ -238749,13 +238183,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2F38De4Ced0B070973B9E9B9B1Dcfa7F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "39910712-4a11-5722-9b48-c069bfcefb14"
+		id = "976d6f30-2b2f-5a16-8d4a-4b119693fd3b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8221-L8234"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "84c3d89e8393bcaddea53326730d795f482ec65c574fde5c1c81f395178b591a"
+		logic_hash = "v1_sha256_84c3d89e8393bcaddea53326730d795f482ec65c574fde5c1c81f395178b591a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238764,7 +238198,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_2F38De4Ced0B070973B9E9B9B1Dcfa7F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fahad Malik" and pe.signatures[i].serial=="2f:38:de:4c:ed:0b:07:09:73:b9:e9:b9:b1:dc:fa:7f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Fahad Malik" and pe.signatures [ i ] . serial == "2f:38:de:4c:ed:0b:07:09:73:b9:e9:b9:b1:dc:fa:7f" )
 }
 import "pe"
 
@@ -238773,13 +238207,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_53E1F226Cb77574F8Fbeb5682Da091Bb : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6967042e-156b-541d-970c-491dece12f08"
+		id = "80250bc3-3381-5443-a2f7-9a546e7a1637"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8236-L8249"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "41f4902e9d02254efdfd19a73de16e1128b15d264c3ed128d5ec28bd92f2d8a4"
+		logic_hash = "v1_sha256_41f4902e9d02254efdfd19a73de16e1128b15d264c3ed128d5ec28bd92f2d8a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238788,7 +238222,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_53E1F226Cb77574F8Fbeb5682Da091Bb : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OdyLab Inc" and pe.signatures[i].serial=="53:e1:f2:26:cb:77:57:4f:8f:be:b5:68:2d:a0:91:bb")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OdyLab Inc" and pe.signatures [ i ] . serial == "53:e1:f2:26:cb:77:57:4f:8f:be:b5:68:2d:a0:91:bb" )
 }
 import "pe"
 
@@ -238797,13 +238231,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Df2547B2Cab5689A81D61De80Eaaa3A2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4eba17f8-df3c-552d-90b5-faef7b860203"
+		id = "91e612cd-5ec6-5160-aaf5-8c2fa86ebe76"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8251-L8264"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c32a6510bd3cfd09e84ccf36140eb405945059c981fb1888298501493f6ef68f"
+		logic_hash = "v1_sha256_c32a6510bd3cfd09e84ccf36140eb405945059c981fb1888298501493f6ef68f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238812,7 +238246,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Df2547B2Cab5689A81D61De80Eaaa3A2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORWARD MUSIC AGENCY SRL" and pe.signatures[i].serial=="df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FORWARD MUSIC AGENCY SRL" and pe.signatures [ i ] . serial == "df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2" )
 }
 import "pe"
 
@@ -238821,13 +238255,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_58Af00Ce542760Fc116B41Fa92E18589 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "62fd5f76-b890-5532-8c6f-e26942584899"
+		id = "a463b7a8-c7d3-550b-9a84-351b410980ac"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8266-L8279"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bcabd77b40ad9eae4c499c8cd4b3e3d39e5478fa590be536860375e890c1b62e"
+		logic_hash = "v1_sha256_bcabd77b40ad9eae4c499c8cd4b3e3d39e5478fa590be536860375e890c1b62e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238836,7 +238270,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_58Af00Ce542760Fc116B41Fa92E18589 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DICKIE MUSDALE WINDFARM LIMITED" and pe.signatures[i].serial=="58:af:00:ce:54:27:60:fc:11:6b:41:fa:92:e1:85:89")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DICKIE MUSDALE WINDFARM LIMITED" and pe.signatures [ i ] . serial == "58:af:00:ce:54:27:60:fc:11:6b:41:fa:92:e1:85:89" )
 }
 import "pe"
 
@@ -238845,13 +238279,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5B1F9Ec88D185631Ab032Dbfd5166C0D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "233466e6-7b5f-50d7-967a-976b698e9194"
+		id = "13ec6f6c-0bd8-59a7-82bb-cecaa34e3011"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8281-L8294"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "05428b4e636a60fb409ead0f4aeb25ed08dae24d58c98a17bb77aa521706763a"
+		logic_hash = "v1_sha256_05428b4e636a60fb409ead0f4aeb25ed08dae24d58c98a17bb77aa521706763a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238860,7 +238294,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5B1F9Ec88D185631Ab032Dbfd5166C0D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TOPFLIGHT GROUP LIMITED" and pe.signatures[i].serial=="5b:1f:9e:c8:8d:18:56:31:ab:03:2d:bf:d5:16:6c:0d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TOPFLIGHT GROUP LIMITED" and pe.signatures [ i ] . serial == "5b:1f:9e:c8:8d:18:56:31:ab:03:2d:bf:d5:16:6c:0d" )
 }
 import "pe"
 
@@ -238869,13 +238303,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Ff52Eb011Bb748Fee75153Cbe1E50Dd6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "452d9f84-a950-5503-adaf-fba95b45e798"
+		id = "9f83889c-a042-552c-9d20-8a68327283a6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8296-L8309"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e439f15c3312ed3a1840967bb165300a491ffe3d1c9c629abcbebf3efd9b1f50"
+		logic_hash = "v1_sha256_e439f15c3312ed3a1840967bb165300a491ffe3d1c9c629abcbebf3efd9b1f50"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238884,7 +238318,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Ff52Eb011Bb748Fee75153Cbe1E50Dd6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TASK ANNA LIMITED" and pe.signatures[i].serial=="ff:52:eb:01:1b:b7:48:fe:e7:51:53:cb:e1:e5:0d:d6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "TASK ANNA LIMITED" and pe.signatures [ i ] . serial == "ff:52:eb:01:1b:b7:48:fe:e7:51:53:cb:e1:e5:0d:d6" )
 }
 import "pe"
 
@@ -238893,13 +238327,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Eda0F47B3B38E781Cdf6Ef6Be5D3F6Ee : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4d845dd7-4153-5082-bff0-d5f9a7b4b46e"
+		id = "5469e3d3-e25a-51c5-abea-d14602239a9b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8311-L8324"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7b53d30e5b6176eaae854bf4046339864225b417a147fe6f24fb51dfb0535911"
+		logic_hash = "v1_sha256_7b53d30e5b6176eaae854bf4046339864225b417a147fe6f24fb51dfb0535911"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238908,7 +238342,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Eda0F47B3B38E781Cdf6Ef6Be5D3F6Ee : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADVANCED ACCESS SERVICES LTD" and pe.signatures[i].serial=="ed:a0:f4:7b:3b:38:e7:81:cd:f6:ef:6b:e5:d3:f6:ee")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ADVANCED ACCESS SERVICES LTD" and pe.signatures [ i ] . serial == "ed:a0:f4:7b:3b:38:e7:81:cd:f6:ef:6b:e5:d3:f6:ee" )
 }
 import "pe"
 
@@ -238917,13 +238351,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4728189Fa0F57793484Cdf764F5E283D : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "02ec531e-aa1b-50b8-ae32-d885a0185cfe"
+		id = "1539391a-0803-5716-a490-8ee29bb45fcb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8326-L8339"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "181971946ee4d643430b733ed57ccf07c940205853c9e5102b08b7bc509bcc63"
+		logic_hash = "v1_sha256_181971946ee4d643430b733ed57ccf07c940205853c9e5102b08b7bc509bcc63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238932,7 +238366,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4728189Fa0F57793484Cdf764F5E283D : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Power Save Systems s.r.o." and pe.signatures[i].serial=="47:28:18:9f:a0:f5:77:93:48:4c:df:76:4f:5e:28:3d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Power Save Systems s.r.o." and pe.signatures [ i ] . serial == "47:28:18:9f:a0:f5:77:93:48:4c:df:76:4f:5e:28:3d" )
 }
 import "pe"
 
@@ -238941,13 +238375,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_24E4A2B3Db6Be1007B9Ddc91995Bc0C8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "47ca5986-3de8-56f2-a15d-ef588d8a9e03"
+		id = "208b7c23-ecd7-50c0-ac4f-f2707b5b225a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8341-L8354"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "71d1f8e9113170f410007b31c0d7316c537001b2a761f1e35d6bd2aa0b39f2d9"
+		logic_hash = "v1_sha256_71d1f8e9113170f410007b31c0d7316c537001b2a761f1e35d6bd2aa0b39f2d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238956,7 +238390,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_24E4A2B3Db6Be1007B9Ddc91995Bc0C8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLY BETTER s.r.o." and pe.signatures[i].serial=="24:e4:a2:b3:db:6b:e1:00:7b:9d:dc:91:99:5b:c0:c8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FLY BETTER s.r.o." and pe.signatures [ i ] . serial == "24:e4:a2:b3:db:6b:e1:00:7b:9d:dc:91:99:5b:c0:c8" )
 }
 import "pe"
 
@@ -238965,13 +238399,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0772B4D1D63233D2B8771997Bc8Da5C4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a05a2bc4-a4a3-5e86-9a1c-ed82de7786df"
+		id = "b9fe9b85-56c1-5843-9c70-cb1d3e07e184"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8356-L8369"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "056fefbc03cff00a40ea9bb65893b92fcc15134c7cf7bf7dedf98f43b44bc03d"
+		logic_hash = "v1_sha256_056fefbc03cff00a40ea9bb65893b92fcc15134c7cf7bf7dedf98f43b44bc03d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -238980,7 +238414,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0772B4D1D63233D2B8771997Bc8Da5C4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Maya logistika d.o.o." and pe.signatures[i].serial=="07:72:b4:d1:d6:32:33:d2:b8:77:19:97:bc:8d:a5:c4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Maya logistika d.o.o." and pe.signatures [ i ] . serial == "07:72:b4:d1:d6:32:33:d2:b8:77:19:97:bc:8d:a5:c4" )
 }
 import "pe"
 
@@ -238989,13 +238423,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Deea179F5757Fe529043577762419Df : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a6b9b9e4-0998-5f67-8c12-7628ba3a5a56"
+		id = "f2f38adb-8998-59de-97db-334a24a92103"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8371-L8384"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b521363d1d38a4ed1b2b4126aec85ed6bffc23dc4e30f6f6c942e1fa96b0dd8d"
+		logic_hash = "v1_sha256_b521363d1d38a4ed1b2b4126aec85ed6bffc23dc4e30f6f6c942e1fa96b0dd8d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239004,7 +238438,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_1Deea179F5757Fe529043577762419Df : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPIRIT CONSULTING s. r. o." and pe.signatures[i].serial=="1d:ee:a1:79:f5:75:7f:e5:29:04:35:77:76:24:19:df")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SPIRIT CONSULTING s. r. o." and pe.signatures [ i ] . serial == "1d:ee:a1:79:f5:75:7f:e5:29:04:35:77:76:24:19:df" )
 }
 import "pe"
 
@@ -239013,13 +238447,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_061A27A3A3771Bb440Fc16Cadf2675C4 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ef600135-6f5d-59a9-b387-60e8eb97cbf9"
+		id = "484687a7-7733-500f-9f71-ec555c770f85"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8386-L8399"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d85b9d2b6fe4ce99670a8f51e84d63f1ec6d0341a3715eeed3e3d6a0fda93dc5"
+		logic_hash = "v1_sha256_d85b9d2b6fe4ce99670a8f51e84d63f1ec6d0341a3715eeed3e3d6a0fda93dc5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239028,7 +238462,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_061A27A3A3771Bb440Fc16Cadf2675C4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Westeast Tech Consulting, Corp." and pe.signatures[i].serial=="06:1a:27:a3:a3:77:1b:b4:40:fc:16:ca:df:26:75:c4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Westeast Tech Consulting, Corp." and pe.signatures [ i ] . serial == "06:1a:27:a3:a3:77:1b:b4:40:fc:16:ca:df:26:75:c4" )
 }
 import "pe"
 
@@ -239037,13 +238471,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06675181E7B5E1030B3D40926E2A47D3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2452580b-bbe8-5d54-888e-6f8fffb055cf"
+		id = "e11fc6de-d136-506f-9d77-4e9945620504"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8401-L8414"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "14d963fd03187afb7afabc208e36d8bb45ec818b27782a6c3037229f82bf22d6"
+		logic_hash = "v1_sha256_14d963fd03187afb7afabc208e36d8bb45ec818b27782a6c3037229f82bf22d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239052,7 +238486,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_06675181E7B5E1030B3D40926E2A47D3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORANGE VIEW LIMITED" and pe.signatures[i].serial=="06:67:51:81:e7:b5:e1:03:0b:3d:40:92:6e:2a:47:d3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ORANGE VIEW LIMITED" and pe.signatures [ i ] . serial == "06:67:51:81:e7:b5:e1:03:0b:3d:40:92:6e:2a:47:d3" )
 }
 import "pe"
 
@@ -239061,13 +238495,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dbc03Ca7E6Ae6Db6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "801bc9fc-0bd6-5c46-8c45-8cb06cfc4309"
+		id = "8e96ce83-856c-5256-bb34-6f4b792c0aef"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8416-L8429"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7d188663b00870e98984b4be4c72b0fd183b5fb8dd61512c1d65d386f1ebad0a"
+		logic_hash = "v1_sha256_7d188663b00870e98984b4be4c72b0fd183b5fb8dd61512c1d65d386f1ebad0a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239076,7 +238510,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Dbc03Ca7E6Ae6Db6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPIDER DEVELOPMENTS PTY LTD" and pe.signatures[i].serial=="db:c0:3c:a7:e6:ae:6d:b6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SPIDER DEVELOPMENTS PTY LTD" and pe.signatures [ i ] . serial == "db:c0:3c:a7:e6:ae:6d:b6" )
 }
 import "pe"
 
@@ -239085,13 +238519,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_26F855A25890B749578F13E4B9459768 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2953afc3-6a46-5126-8f82-52f8dc1f89d6"
+		id = "41d10184-f83b-56cf-b63d-72726197047a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8431-L8444"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2de5a2d4d692c14660a9ec3ed18a7d2d6741a862c86812fcd640b1378281c328"
+		logic_hash = "v1_sha256_2de5a2d4d692c14660a9ec3ed18a7d2d6741a862c86812fcd640b1378281c328"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239100,7 +238534,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_26F855A25890B749578F13E4B9459768 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Boo’s Q & Sweets Corporation" and pe.signatures[i].serial=="26:f8:55:a2:58:90:b7:49:57:8f:13:e4:b9:45:97:68")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Boo’s Q & Sweets Corporation" and pe.signatures [ i ] . serial == "26:f8:55:a2:58:90:b7:49:57:8f:13:e4:b9:45:97:68" )
 }
 import "pe"
 
@@ -239109,13 +238543,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_25Ba18A267D6D8E08Ebc6E2457D58D1E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d2c4907e-cec2-5386-96d3-8c122c7557fa"
+		id = "9d334b85-14e7-5739-9d40-2e1d24487ea5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8446-L8459"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "38bdfa2291c7c3f81b29d41c65814002db3e4de11928699d2d946e87d313558d"
+		logic_hash = "v1_sha256_38bdfa2291c7c3f81b29d41c65814002db3e4de11928699d2d946e87d313558d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239124,7 +238558,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_25Ba18A267D6D8E08Ebc6E2457D58D1E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "5Y TECHNOLOGY LIMITED" and pe.signatures[i].serial=="25:ba:18:a2:67:d6:d8:e0:8e:bc:6e:24:57:d5:8d:1e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "5Y TECHNOLOGY LIMITED" and pe.signatures [ i ] . serial == "25:ba:18:a2:67:d6:d8:e0:8e:bc:6e:24:57:d5:8d:1e" )
 }
 import "pe"
 
@@ -239133,13 +238567,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A2787Fbb4627C91611573E323584113 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5da7ac8f-34f7-5949-9987-32e983a77ebe"
+		id = "1096ef5d-ec18-53d5-9427-1e8a111bc000"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8461-L8474"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e4ea9149f28798b48482ff68c3e08593a4510e3bd01e49ebdca7d450f15537e4"
+		logic_hash = "v1_sha256_e4ea9149f28798b48482ff68c3e08593a4510e3bd01e49ebdca7d450f15537e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239148,7 +238582,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A2787Fbb4627C91611573E323584113 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "exxon.com" and pe.signatures[i].serial=="0a:27:87:fb:b4:62:7c:91:61:15:73:e3:23:58:41:13")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "exxon.com" and pe.signatures [ i ] . serial == "0a:27:87:fb:b4:62:7c:91:61:15:73:e3:23:58:41:13" )
 }
 import "pe"
 
@@ -239157,13 +238591,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C81319D20C6F1F1Aec3398522189D90C : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d93f571b-49f6-5a8b-9478-1054ede2257f"
+		id = "e8553f30-9275-592f-9316-44c934db86b6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8476-L8489"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1271d0cc05d35a70a90f605e7c68fc52605570e453e9e67fbeb74762a88a0a96"
+		logic_hash = "v1_sha256_1271d0cc05d35a70a90f605e7c68fc52605570e453e9e67fbeb74762a88a0a96"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239172,7 +238606,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C81319D20C6F1F1Aec3398522189D90C : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="c8:13:19:d2:0c:6f:1f:1a:ec:33:98:52:21:89:d9:0c")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT,LLC" and pe.signatures [ i ] . serial == "c8:13:19:d2:0c:6f:1f:1a:ec:33:98:52:21:89:d9:0c" )
 }
 import "pe"
 
@@ -239181,13 +238615,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_77550Ed697992B397E3F1Ad8E2A662D1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1d969340-de5e-569e-bfed-a80a1623d1b4"
+		id = "3abf41cb-6321-5597-a6c3-37c2a54ce91a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8491-L8504"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "87a70f10a111c4c5d1c3fb5b1c2a9da528f7d484ae6391c91e4052aba5c6bbe0"
+		logic_hash = "v1_sha256_87a70f10a111c4c5d1c3fb5b1c2a9da528f7d484ae6391c91e4052aba5c6bbe0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239196,7 +238630,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_77550Ed697992B397E3F1Ad8E2A662D1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GRASS RAIN, s.r.o." and pe.signatures[i].serial=="77:55:0e:d6:97:99:2b:39:7e:3f:1a:d8:e2:a6:62:d1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GRASS RAIN, s.r.o." and pe.signatures [ i ] . serial == "77:55:0e:d6:97:99:2b:39:7e:3f:1a:d8:e2:a6:62:d1" )
 }
 import "pe"
 
@@ -239205,13 +238639,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B1Bbef3Aba79Ab2Eae5B8015F26B34F8 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "382952bd-ffb3-5ff7-aff1-cf9fe8f20d1d"
+		id = "4f9702ff-2763-54bc-9391-036b2c0a9bbb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8506-L8519"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "34b00243f0b5e8d09938f1500871797125644f839298427c877801027638fd34"
+		logic_hash = "v1_sha256_34b00243f0b5e8d09938f1500871797125644f839298427c877801027638fd34"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239220,7 +238654,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_B1Bbef3Aba79Ab2Eae5B8015F26B34F8 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIDZHITAL ART, OOO" and pe.signatures[i].serial=="b1:bb:ef:3a:ba:79:ab:2e:ae:5b:80:15:f2:6b:34:f8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DIDZHITAL ART, OOO" and pe.signatures [ i ] . serial == "b1:bb:ef:3a:ba:79:ab:2e:ae:5b:80:15:f2:6b:34:f8" )
 }
 import "pe"
 
@@ -239229,13 +238663,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_05D50A0E09Bb9A836Ffb90A3 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f6947bf1-7f20-5be5-a242-c1025be40055"
+		id = "cf89003b-0942-5f05-bc6e-1425a77e426f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8521-L8534"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fc38ae0c9d4fc26739deab65ae3669f272e999b76dbc521dae04b9a3e3e7cef0"
+		logic_hash = "v1_sha256_fc38ae0c9d4fc26739deab65ae3669f272e999b76dbc521dae04b9a3e3e7cef0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239244,7 +238678,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_05D50A0E09Bb9A836Ffb90A3 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Toliz Info Tech Solutions INC." and pe.signatures[i].serial=="05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Toliz Info Tech Solutions INC." and pe.signatures [ i ] . serial == "05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3" )
 }
 import "pe"
 
@@ -239253,13 +238687,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_623Eae6A66D3A6Ee80Df9Ccebe51181E : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7c3b85e4-8ce7-5c48-8f3b-e237a5cae9a0"
+		id = "074f321b-ccbd-5dc2-ac8d-a596b082d8dd"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8536-L8549"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "79fceab5a19025d25abb12a8e6f57f8a930d348d538d9c556b6d4fc461af66f2"
+		logic_hash = "v1_sha256_79fceab5a19025d25abb12a8e6f57f8a930d348d538d9c556b6d4fc461af66f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239268,7 +238702,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_623Eae6A66D3A6Ee80Df9Ccebe51181E : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GAIN AI LTD" and pe.signatures[i].serial=="62:3e:ae:6a:66:d3:a6:ee:80:df:9c:ce:be:51:18:1e")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "GAIN AI LTD" and pe.signatures [ i ] . serial == "62:3e:ae:6a:66:d3:a6:ee:80:df:9c:ce:be:51:18:1e" )
 }
 import "pe"
 
@@ -239277,13 +238711,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A392F03Ded5D73Cdeeda75052A57176 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c0a8cc1c-7427-589b-9e32-8679e9cdf251"
+		id = "223b271f-6580-5dd8-98a1-637f14bcd7f5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8551-L8564"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ea0159ec1c4670c1e961a87131998fa796cf205eaa8a06bf829c61c9694fa5ef"
+		logic_hash = "v1_sha256_ea0159ec1c4670c1e961a87131998fa796cf205eaa8a06bf829c61c9694fa5ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239292,7 +238726,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0A392F03Ded5D73Cdeeda75052A57176 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLOWER COMPUTERS LTD" and pe.signatures[i].serial=="0a:39:2f:03:de:d5:d7:3c:de:ed:a7:50:52:a5:71:76")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "FLOWER COMPUTERS LTD" and pe.signatures [ i ] . serial == "0a:39:2f:03:de:d5:d7:3c:de:ed:a7:50:52:a5:71:76" )
 }
 import "pe"
 
@@ -239301,13 +238735,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E9268Ed63A7D7E9Dfd40A664Ddfbaf18 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "59e63c76-1051-5274-b886-fcd75c8b0b38"
+		id = "83747e83-fdc6-597b-8e24-25fb31a27c7f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8566-L8579"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "62b9ea3c5197635db2101972af951f4afbd9b311b3c8286525bbd5b5baa17c41"
+		logic_hash = "v1_sha256_62b9ea3c5197635db2101972af951f4afbd9b311b3c8286525bbd5b5baa17c41"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239316,7 +238750,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_E9268Ed63A7D7E9Dfd40A664Ddfbaf18 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Casta, s.r.o." and pe.signatures[i].serial=="e9:26:8e:d6:3a:7d:7e:9d:fd:40:a6:64:dd:fb:af:18")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Casta, s.r.o." and pe.signatures [ i ] . serial == "e9:26:8e:d6:3a:7d:7e:9d:fd:40:a6:64:dd:fb:af:18" )
 }
 import "pe"
 
@@ -239325,13 +238759,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Da156922F4760E0C5F5Bcf79812A27E1 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "065bacbc-3004-53c1-ba73-4779743e8221"
+		id = "d7982bb0-0b74-5a9d-b397-42a7599d22aa"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8581-L8594"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f6dd0f2373e412a753cbe5e27152f48d6c8980de9b26e5ab212b926e7e41c813"
+		logic_hash = "v1_sha256_f6dd0f2373e412a753cbe5e27152f48d6c8980de9b26e5ab212b926e7e41c813"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239340,7 +238774,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Da156922F4760E0C5F5Bcf79812A27E1 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DRINK AND BUBBLE LTD" and pe.signatures[i].serial=="da:15:69:22:f4:76:0e:0c:5f:5b:cf:79:81:2a:27:e1")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DRINK AND BUBBLE LTD" and pe.signatures [ i ] . serial == "da:15:69:22:f4:76:0e:0c:5f:5b:cf:79:81:2a:27:e1" )
 }
 import "pe"
 
@@ -239349,13 +238783,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5226A724Cfa0B4Bc0164Ecda3F02A3Dc : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "37d1061f-80b1-5944-bde3-6279633e321a"
+		id = "13daa1c5-441a-5fce-84fb-a0296dbb2121"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8596-L8609"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8fa1dad2cd4c1406c1346bbe0fef88eba415437d159cf9010dcfaaa7210aef0e"
+		logic_hash = "v1_sha256_8fa1dad2cd4c1406c1346bbe0fef88eba415437d159cf9010dcfaaa7210aef0e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239364,7 +238798,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5226A724Cfa0B4Bc0164Ecda3F02A3Dc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VALENTE SP Z O O" and pe.signatures[i].serial=="52:26:a7:24:cf:a0:b4:bc:01:64:ec:da:3f:02:a3:dc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "VALENTE SP Z O O" and pe.signatures [ i ] . serial == "52:26:a7:24:cf:a0:b4:bc:01:64:ec:da:3f:02:a3:dc" )
 }
 import "pe"
 
@@ -239373,13 +238807,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_121070Be1E782F206985543Bc7Bc58B6 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8432c7f0-ee2e-5935-8fe8-36b0094a5e1a"
+		id = "9882a510-1240-5281-b064-165378b9499a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8611-L8624"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "21eb6fed2225d2ab056948603b0990c2eb7dc9289da9a9df16f0d6cd042b3778"
+		logic_hash = "v1_sha256_21eb6fed2225d2ab056948603b0990c2eb7dc9289da9a9df16f0d6cd042b3778"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239388,7 +238822,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_121070Be1E782F206985543Bc7Bc58B6 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Prod Can Holdings Inc." and pe.signatures[i].serial=="12:10:70:be:1e:78:2f:20:69:85:54:3b:c7:bc:58:b6")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Prod Can Holdings Inc." and pe.signatures [ i ] . serial == "12:10:70:be:1e:78:2f:20:69:85:54:3b:c7:bc:58:b6" )
 }
 import "pe"
 
@@ -239397,13 +238831,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_15C21Dab7F4E644E4B35C4858004D8A9 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7dac5657-038f-5cbd-a854-cdb12921121e"
+		id = "796e7648-0806-5185-95dc-d4ca0261b2fb"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8626-L8639"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "646a858b10de89da4e639d3902ada78fad3a45868f0d7782546a865396cf226c"
+		logic_hash = "v1_sha256_646a858b10de89da4e639d3902ada78fad3a45868f0d7782546a865396cf226c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239412,7 +238846,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_15C21Dab7F4E644E4B35C4858004D8A9 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "P.REGO, s.r.o." and pe.signatures[i].serial=="15:c2:1d:ab:7f:4e:64:4e:4b:35:c4:85:80:04:d8:a9")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "P.REGO, s.r.o." and pe.signatures [ i ] . serial == "15:c2:1d:ab:7f:4e:64:4e:4b:35:c4:85:80:04:d8:a9" )
 }
 import "pe"
 
@@ -239421,13 +238855,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_101D6A5A29D9A77807553Ceac669D853 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8554ce79-fd87-54ac-b538-e2899fe95414"
+		id = "3313354a-0bd4-52f5-b3e5-92efbc79413a"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8641-L8654"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "be6b5a98d5c218c39d8f10bc2a0e443bc8be8a591ab368ee902de4a45a95c8d2"
+		logic_hash = "v1_sha256_be6b5a98d5c218c39d8f10bc2a0e443bc8be8a591ab368ee902de4a45a95c8d2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239436,7 +238870,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_101D6A5A29D9A77807553Ceac669D853 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIC GROUP LIMITED" and pe.signatures[i].serial=="10:1d:6a:5a:29:d9:a7:78:07:55:3c:ea:c6:69:d8:53")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "BIC GROUP LIMITED" and pe.signatures [ i ] . serial == "10:1d:6a:5a:29:d9:a7:78:07:55:3c:ea:c6:69:d8:53" )
 }
 import "pe"
 
@@ -239445,13 +238879,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4679C5398A279318365Fd77A84445699 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ff4061e7-5e45-596f-9d40-c33661a18e71"
+		id = "c8570757-30da-5147-9edd-4d17ad8467b7"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8656-L8669"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1c591cbb2d35d8dad01ff4ea8c71c8b3a0a5f999f1edfcfc038e47f96d3a3a67"
+		logic_hash = "v1_sha256_1c591cbb2d35d8dad01ff4ea8c71c8b3a0a5f999f1edfcfc038e47f96d3a3a67"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239460,7 +238894,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_4679C5398A279318365Fd77A84445699 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HURT GROUP HOLDINGS LIMITED" and pe.signatures[i].serial=="46:79:c5:39:8a:27:93:18:36:5f:d7:7a:84:44:56:99")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HURT GROUP HOLDINGS LIMITED" and pe.signatures [ i ] . serial == "46:79:c5:39:8a:27:93:18:36:5f:d7:7a:84:44:56:99" )
 }
 import "pe"
 
@@ -239469,13 +238903,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_282A8A04073Eced658B9770Bda8C0D28 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d735ccfc-3f5e-5858-95ec-f385172ea8e6"
+		id = "8b8b2a99-526c-5f1b-bc84-6b1e56b13f1b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8671-L8684"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4cfebe55887a2a09293678e4dff2f93f22bec151dada7c84a41ac6deb10b7cc3"
+		logic_hash = "v1_sha256_4cfebe55887a2a09293678e4dff2f93f22bec151dada7c84a41ac6deb10b7cc3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239484,7 +238918,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_282A8A04073Eced658B9770Bda8C0D28 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Betamaynd" and pe.signatures[i].serial=="28:2a:8a:04:07:3e:ce:d6:58:b9:77:0b:da:8c:0d:28")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "OOO Betamaynd" and pe.signatures [ i ] . serial == "28:2a:8a:04:07:3e:ce:d6:58:b9:77:0b:da:8c:0d:28" )
 }
 import "pe"
 
@@ -239493,13 +238927,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0C48732873Ac8Ccebaf8F0E1E8329Cec : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dacde33d-3925-52c6-87fd-9f3ead6bfab0"
+		id = "84842403-533f-59fe-9bbe-93c03177a812"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8686-L8699"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "64c61d1bb48d790a2a3da85c6e57b542f0ee8a85296fc3e8c17ea18d8241790d"
+		logic_hash = "v1_sha256_64c61d1bb48d790a2a3da85c6e57b542f0ee8a85296fc3e8c17ea18d8241790d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239508,7 +238942,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0C48732873Ac8Ccebaf8F0E1E8329Cec : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hermetica Digital Ltd" and pe.signatures[i].serial=="0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Hermetica Digital Ltd" and pe.signatures [ i ] . serial == "0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec" )
 }
 import "pe"
 
@@ -239517,13 +238951,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Da20761Afbb0463C55B1Ea88Bbc7Ec57 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "63e4b8f6-64f1-58a2-920a-e1d4b113380b"
+		id = "e8dae21c-ab39-5b6c-a430-80cadc85bbbe"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8716-L8729"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a4f6bb9742ab40e8003ea14f9645f0c7f885b461fbeb01164b86ddacbda1113f"
+		logic_hash = "v1_sha256_a4f6bb9742ab40e8003ea14f9645f0c7f885b461fbeb01164b86ddacbda1113f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239532,7 +238966,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Da20761Afbb0463C55B1Ea88Bbc7Ec57 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CLEVER CLOSE s.r.o." and pe.signatures[i].serial=="da:20:76:1a:fb:b0:46:3c:55:b1:ea:88:bb:c7:ec:57")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CLEVER CLOSE s.r.o." and pe.signatures [ i ] . serial == "da:20:76:1a:fb:b0:46:3c:55:b1:ea:88:bb:c7:ec:57" )
 }
 import "pe"
 
@@ -239541,13 +238975,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C51F4Cf4D82Bc920421E1Ad93E39D490 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cbb6cb90-b0f0-5271-81ae-8639c28a5df1"
+		id = "ab006b8e-956f-5ade-bae8-a30743de4f18"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8731-L8744"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b9152998eb3c4ba2b6e7571ed03c63ae1ade2f922df6901f8e46b08f41474f7b"
+		logic_hash = "v1_sha256_b9152998eb3c4ba2b6e7571ed03c63ae1ade2f922df6901f8e46b08f41474f7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239556,7 +238990,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_C51F4Cf4D82Bc920421E1Ad93E39D490 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CUT AHEAD LTD" and pe.signatures[i].serial=="c5:1f:4c:f4:d8:2b:c9:20:42:1e:1a:d9:3e:39:d4:90")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "CUT AHEAD LTD" and pe.signatures [ i ] . serial == "c5:1f:4c:f4:d8:2b:c9:20:42:1e:1a:d9:3e:39:d4:90" )
 }
 import "pe"
 
@@ -239565,13 +238999,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_69A72F5591Ad78A0825Fbb9402Ab9543 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a30ca6aa-3bf4-5fa2-8297-7b983410e5d4"
+		id = "8142b303-c541-5fac-b887-38c95380e75d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8746-L8759"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b2a8c08a612f7352a159a9d3f7d9152d9de043db1ec69e4bb2493533453f8f5c"
+		logic_hash = "v1_sha256_b2a8c08a612f7352a159a9d3f7d9152d9de043db1ec69e4bb2493533453f8f5c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239580,7 +239014,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_69A72F5591Ad78A0825Fbb9402Ab9543 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PUSH BANK LIMITED" and pe.signatures[i].serial=="69:a7:2f:55:91:ad:78:a0:82:5f:bb:94:02:ab:95:43")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PUSH BANK LIMITED" and pe.signatures [ i ] . serial == "69:a7:2f:55:91:ad:78:a0:82:5f:bb:94:02:ab:95:43" )
 }
 import "pe"
 
@@ -239589,13 +239023,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_8Cece6Df54Cf6Ad63596546D77Ba3581 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c5c19072-5a2f-5851-83bf-25a9e2fd9033"
+		id = "69fa7e29-f4cd-5c68-9ddc-3af699a6da8f"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8761-L8774"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1980b3ef7df1bfa43d401fdd8393cb8ffb5c919d558c23314ffb9e823cf9590d"
+		logic_hash = "v1_sha256_1980b3ef7df1bfa43d401fdd8393cb8ffb5c919d558c23314ffb9e823cf9590d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239604,7 +239038,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_8Cece6Df54Cf6Ad63596546D77Ba3581 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mikael LLC" and pe.signatures[i].serial=="8c:ec:e6:df:54:cf:6a:d6:35:96:54:6d:77:ba:35:81")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Mikael LLC" and pe.signatures [ i ] . serial == "8c:ec:e6:df:54:cf:6a:d6:35:96:54:6d:77:ba:35:81" )
 }
 import "pe"
 
@@ -239613,13 +239047,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Db95B22362D46A73C39E0Ac924883C5B : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "df60473d-da8a-59c1-84d1-717d52d2411d"
+		id = "4aedba4c-01eb-5a7c-bcdb-617c0a5296f5"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8776-L8789"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "29015f6e11f2c93cc12e39cf50a1bda3bd4aa0bb7df0d7374223031361067495"
+		logic_hash = "v1_sha256_29015f6e11f2c93cc12e39cf50a1bda3bd4aa0bb7df0d7374223031361067495"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239628,7 +239062,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_Db95B22362D46A73C39E0Ac924883C5B : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPSLTD PLYMOUTH LTD" and pe.signatures[i].serial=="db:95:b2:23:62:d4:6a:73:c3:9e:0a:c9:24:88:3c:5b")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SPSLTD PLYMOUTH LTD" and pe.signatures [ i ] . serial == "db:95:b2:23:62:d4:6a:73:c3:9e:0a:c9:24:88:3c:5b" )
 }
 import "pe"
 
@@ -239637,13 +239071,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_D3Aee8Abb9948844A3Ac1C04Cc7E6Bdf : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8b17b23f-3296-55b2-8e7b-40e13a14a610"
+		id = "b254df88-40e1-53b5-bf62-91a19da243f8"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8791-L8804"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9af0b27e96575298a31b53f6f88cdb20934db75637abdd0acb40bb3c6921542c"
+		logic_hash = "v1_sha256_9af0b27e96575298a31b53f6f88cdb20934db75637abdd0acb40bb3c6921542c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239652,7 +239086,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_D3Aee8Abb9948844A3Ac1C04Cc7E6Bdf : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HOUSE 9A s.r.o" and pe.signatures[i].serial=="d3:ae:e8:ab:b9:94:88:44:a3:ac:1c:04:cc:7e:6b:df")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "HOUSE 9A s.r.o" and pe.signatures [ i ] . serial == "d3:ae:e8:ab:b9:94:88:44:a3:ac:1c:04:cc:7e:6b:df" )
 }
 import "pe"
 
@@ -239661,13 +239095,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6000F8C02B0A15B1E53B8399845Faddf : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6d4224bd-1522-5b0f-b39e-1ba4ec0f1a63"
+		id = "458c632e-2c0a-5d06-8c1a-1d8d0e7ac3b1"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8806-L8819"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a8687b2aa02909af5fc7c706f31c419c4af48225abe7415bf262de57bb85258f"
+		logic_hash = "v1_sha256_a8687b2aa02909af5fc7c706f31c419c4af48225abe7415bf262de57bb85258f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239676,7 +239110,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_6000F8C02B0A15B1E53B8399845Faddf : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAY LIMITED" and pe.signatures[i].serial=="60:00:f8:c0:2b:0a:15:b1:e5:3b:83:99:84:5f:ad:df")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SAY LIMITED" and pe.signatures [ i ] . serial == "60:00:f8:c0:2b:0a:15:b1:e5:3b:83:99:84:5f:ad:df" )
 }
 import "pe"
 
@@ -239685,13 +239119,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F6Ad45188E5566Aa317Be23B4B8B2C2F : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d4afb6ed-1cfd-5c49-8959-0cf136d0e9f0"
+		id = "737e9eff-3536-56a4-8840-f261e43b670b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8821-L8834"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7afafea141727e2ed4c1975a18aa77b282c7d9ece5729dbd96cbb49cc2b393f1"
+		logic_hash = "v1_sha256_7afafea141727e2ed4c1975a18aa77b282c7d9ece5729dbd96cbb49cc2b393f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239700,7 +239134,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_F6Ad45188E5566Aa317Be23B4B8B2C2F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gary Kramlich" and pe.signatures[i].serial=="f6:ad:45:18:8e:55:66:aa:31:7b:e2:3b:4b:8b:2c:2f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Gary Kramlich" and pe.signatures [ i ] . serial == "f6:ad:45:18:8e:55:66:aa:31:7b:e2:3b:4b:8b:2c:2f" )
 }
 import "pe"
 
@@ -239709,13 +239143,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_74Fc9257Bc86F8C618501695Ad4B1606 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c0ed5369-ca51-50b8-941a-580262b4f644"
+		id = "351ba635-227b-5e6f-9129-997ceeb7ad18"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8836-L8849"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d6a9956d8bcc717186c205d07b94df1df4818bee58f98bdc128ec569331ab5e6"
+		logic_hash = "v1_sha256_d6a9956d8bcc717186c205d07b94df1df4818bee58f98bdc128ec569331ab5e6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239724,7 +239158,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_74Fc9257Bc86F8C618501695Ad4B1606 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "169Teaco Limited" and pe.signatures[i].serial=="74:fc:92:57:bc:86:f8:c6:18:50:16:95:ad:4b:16:06")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "169Teaco Limited" and pe.signatures [ i ] . serial == "74:fc:92:57:bc:86:f8:c6:18:50:16:95:ad:4b:16:06" )
 }
 import "pe"
 
@@ -239733,13 +239167,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3B0914E2982Be8980Aa23F49848555E5 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bda3e8b2-5d1b-5898-a4c3-318fc88506b8"
+		id = "4d02c5c6-0bc4-5ba1-8293-481b0e5c11c4"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8851-L8864"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b1ced5176720e0a3bd475172a167675de8211987fbae11b93eab1fba6b3629f5"
+		logic_hash = "v1_sha256_b1ced5176720e0a3bd475172a167675de8211987fbae11b93eab1fba6b3629f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239748,7 +239182,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3B0914E2982Be8980Aa23F49848555E5 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Office Rat s.r.o." and pe.signatures[i].serial=="3b:09:14:e2:98:2b:e8:98:0a:a2:3f:49:84:85:55:e5")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Office Rat s.r.o." and pe.signatures [ i ] . serial == "3b:09:14:e2:98:2b:e8:98:0a:a2:3f:49:84:85:55:e5" )
 }
 import "pe"
 
@@ -239757,13 +239191,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_029Bf7E1Cb09Fe277564Bd27C267De5A : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "19d1012f-9a9e-5d84-885c-2571bfd1876c"
+		id = "591ee9d6-d734-5ac3-8ed3-f8f9c577660d"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8866-L8879"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a8c817dc99d55dcbea31334cc10b6a7ae3b5cf831e28cb2daf9d4b06fb4bec60"
+		logic_hash = "v1_sha256_a8c817dc99d55dcbea31334cc10b6a7ae3b5cf831e28cb2daf9d4b06fb4bec60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239772,7 +239206,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_029Bf7E1Cb09Fe277564Bd27C267De5A : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAMOYAJ LIMITED" and pe.signatures[i].serial=="02:9b:f7:e1:cb:09:fe:27:75:64:bd:27:c2:67:de:5a")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "SAMOYAJ LIMITED" and pe.signatures [ i ] . serial == "02:9b:f7:e1:cb:09:fe:27:75:64:bd:27:c2:67:de:5a" )
 }
 import "pe"
 
@@ -239781,13 +239215,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_984E84Cfe362E278F558E2C70Aaafac2 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3d071d42-b96a-5491-96f5-4605b6b5584e"
+		id = "ad4608d5-4a33-54fa-9227-98d2d874eb4c"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8881-L8894"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a3a42c5b6ad094deb2a9f33789b6f7e52f76e65b2336372341f16389cef40f88"
+		logic_hash = "v1_sha256_a3a42c5b6ad094deb2a9f33789b6f7e52f76e65b2336372341f16389cef40f88"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239796,7 +239230,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_984E84Cfe362E278F558E2C70Aaafac2 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Arctic Nights Äkäslompolo Oy" and pe.signatures[i].serial=="98:4e:84:cf:e3:62:e2:78:f5:58:e2:c7:0a:aa:fa:c2")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Arctic Nights Äkäslompolo Oy" and pe.signatures [ i ] . serial == "98:4e:84:cf:e3:62:e2:78:f5:58:e2:c7:0a:aa:fa:c2" )
 }
 import "pe"
 
@@ -239805,13 +239239,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_45245Eef53Fcf38169C715Cf68F44452 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3e92744d-1eb8-511a-b933-6dbe1e74fcfd"
+		id = "758c3442-b10b-5d94-9020-b1765a0a8af6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8896-L8909"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7667563aa02be9a85ba286bc16eb37380d5988b32f0ce27b1dbd9ae18b8b9175"
+		logic_hash = "v1_sha256_7667563aa02be9a85ba286bc16eb37380d5988b32f0ce27b1dbd9ae18b8b9175"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239820,7 +239254,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_45245Eef53Fcf38169C715Cf68F44452 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PAPER AND CORE SUPPLIES LTD" and pe.signatures[i].serial=="45:24:5e:ef:53:fc:f3:81:69:c7:15:cf:68:f4:44:52")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "PAPER AND CORE SUPPLIES LTD" and pe.signatures [ i ] . serial == "45:24:5e:ef:53:fc:f3:81:69:c7:15:cf:68:f4:44:52" )
 }
 import "pe"
 
@@ -239829,13 +239263,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0406C4A1521A38C8D0C4Aa214388E4Dc : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "108dd1b8-110a-5680-bd96-5517392300fa"
+		id = "aad5ef49-0861-5666-94c5-a9423a360a04"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8911-L8924"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3db3a4f424d2974b746b8290a461f777eb88e0d8c6048e6e51e561c1f91b7747"
+		logic_hash = "v1_sha256_3db3a4f424d2974b746b8290a461f777eb88e0d8c6048e6e51e561c1f91b7747"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239844,7 +239278,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0406C4A1521A38C8D0C4Aa214388E4Dc : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Venezia Design SRL" and pe.signatures[i].serial=="04:06:c4:a1:52:1a:38:c8:d0:c4:aa:21:43:88:e4:dc")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Venezia Design SRL" and pe.signatures [ i ] . serial == "04:06:c4:a1:52:1a:38:c8:d0:c4:aa:21:43:88:e4:dc" )
 }
 import "pe"
 
@@ -239853,13 +239287,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Ef27Fc51Ee80B30430947C9967Db440 : FILE
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "53f7b334-8feb-5581-a64c-5db6558a6434"
+		id = "d0091626-6584-5221-9833-4425fc172f60"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://bazaar.abuse.ch/faq/#cscb"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8926-L8939"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e282054102d852c0f66435148ce97050b15fb6f60f5d1bfc875b02de9c50c297"
+		logic_hash = "v1_sha256_e282054102d852c0f66435148ce97050b15fb6f60f5d1bfc875b02de9c50c297"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239868,7 +239302,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_5Ef27Fc51Ee80B30430947C9967Db440 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="5e:f2:7f:c5:1e:e8:0b:30:43:09:47:c9:96:7d:b4:40")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "AMCERT,LLC" and pe.signatures [ i ] . serial == "5e:f2:7f:c5:1e:e8:0b:30:43:09:47:c9:96:7d:b4:40" )
 }
 import "pe"
 
@@ -239877,13 +239311,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_672237253A9B7Ef9D02D7D1Cb27A3Ff4 : FILE
 	meta:
 		description = "No description has been set in the source file - DitekSHen"
 		author = "ditekSHen"
-		id = "590b3764-c4e2-59a5-b263-bc3e0d57c85a"
+		id = "996a2841-63e9-560a-8157-47aba5974a7b"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8941-L8952"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9b989f8d89c566980f3f7e6490f0271ab0f531fb2717b55e6f3b7ff6fadd9144"
+		logic_hash = "v1_sha256_9b989f8d89c566980f3f7e6490f0271ab0f531fb2717b55e6f3b7ff6fadd9144"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239891,7 +239325,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_672237253A9B7Ef9D02D7D1Cb27A3Ff4 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foshan Yongqiheng Trading Co., Ltd." and pe.signatures[i].issuer contains "Certum Extended Validation Code Signing 2021 CA" and pe.signatures[i].serial=="67:22:37:25:3a:9b:7e:f9:d0:2d:7d:1c:b2:7a:3f:f4")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Foshan Yongqiheng Trading Co., Ltd." and pe.signatures [ i ] . issuer contains "Certum Extended Validation Code Signing 2021 CA" and pe.signatures [ i ] . serial == "67:22:37:25:3a:9b:7e:f9:d0:2d:7d:1c:b2:7a:3f:f4" )
 }
 import "pe"
 
@@ -239900,13 +239334,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_708737C791C878D6Dd7B7C43 : FILE
 	meta:
 		description = "No description has been set in the source file - DitekSHen"
 		author = "ditekSHen"
-		id = "65f3827d-25c4-59bb-8555-508c3e92ed5d"
+		id = "2ee4f878-1bec-5560-ac72-113b7f35d4f6"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8954-L8965"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5e47fc7ed52e57aafc5eb2f1d56eb8296080218b65d70879bd75fd1a0ac58f66"
+		logic_hash = "v1_sha256_5e47fc7ed52e57aafc5eb2f1d56eb8296080218b65d70879bd75fd1a0ac58f66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239914,7 +239348,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_708737C791C878D6Dd7B7C43 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Langfang Alkem Material Technology Co., Ltd." and pe.signatures[i].issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and pe.signatures[i].serial=="70:87:37:c7:91:c8:78:d6:dd:7b:7c:43")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Langfang Alkem Material Technology Co., Ltd." and pe.signatures [ i ] . issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and pe.signatures [ i ] . serial == "70:87:37:c7:91:c8:78:d6:dd:7b:7c:43" )
 }
 import "pe"
 
@@ -239923,13 +239357,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Bc777F88Ddf5F3Ce479452F : FILE
 	meta:
 		description = "No description has been set in the source file - DitekSHen"
 		author = "ditekSHen"
-		id = "da891fe8-fe9f-53f8-836c-161d13fd5382"
+		id = "0f4711d4-4187-52d2-937d-3f20dfa9b430"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8967-L8978"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "988fd5e652910f7b4388fe5bed91195261ff95d84cc7e53a389432577a114baa"
+		logic_hash = "v1_sha256_988fd5e652910f7b4388fe5bed91195261ff95d84cc7e53a389432577a114baa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239937,7 +239371,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_0Bc777F88Ddf5F3Ce479452F : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ARION LLC" and pe.signatures[i].issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and pe.signatures[i].serial=="0b:c7:77:f8:8d:df:5f:3c:e4:79:45:2f")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "ARION LLC" and pe.signatures [ i ] . issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and pe.signatures [ i ] . serial == "0b:c7:77:f8:8d:df:5f:3c:e4:79:45:2f" )
 }
 import "pe"
 
@@ -239946,13 +239380,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_691Ed2236Cca78D180F29Dfd : FILE
 	meta:
 		description = "No description has been set in the source file - DitekSHen"
 		author = "ditekSHen"
-		id = "f889f1a6-070d-505e-aaa6-0d454f52a876"
+		id = "8cabc7fd-e9c0-5e6c-be48-2da6dc371983"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8980-L8991"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "94e7c3aea1fca253395eae398176dc9875ca1f1c13002063b5eda8ffb4ad973f"
+		logic_hash = "v1_sha256_94e7c3aea1fca253395eae398176dc9875ca1f1c13002063b5eda8ffb4ad973f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239960,7 +239394,7 @@ rule DITEKSHEN_INDICATOR_KB_CERT_691Ed2236Cca78D180F29Dfd : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "COSMART LLC" and pe.signatures[i].issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and pe.signatures[i].serial=="69:1e:d2:23:6c:ca:78:d1:80:f2:9d:fd")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "COSMART LLC" and pe.signatures [ i ] . issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and pe.signatures [ i ] . serial == "69:1e:d2:23:6c:ca:78:d1:80:f2:9d:fd" )
 }
 import "pe"
 
@@ -239969,13 +239403,13 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3B0E3879266F3Bc98225B390 : FILE
 	meta:
 		description = "No description has been set in the source file - DitekSHen"
 		author = "ditekSHen"
-		id = "0b85d4be-678a-51a1-acbc-3e7b94bec804"
+		id = "2e37f1ab-1ba9-5ac7-9888-e9864a80cefd"
 		date = "2024-10-04"
 		modified = "2024-10-04"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_certs.yar#L8993-L9004"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2d480534c046e38fe90ee01dc0fa9abf1ade15f879c3770f3df54c6e2c2e1552"
+		logic_hash = "v1_sha256_2d480534c046e38fe90ee01dc0fa9abf1ade15f879c3770f3df54c6e2c2e1552"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -239983,23 +239417,22 @@ rule DITEKSHEN_INDICATOR_KB_CERT_3B0E3879266F3Bc98225B390 : FILE
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hangzhou Yueju Apparel Co., Ltd." and pe.signatures[i].issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and pe.signatures[i].serial=="3b:0e:38:79:26:6f:3b:c9:82:25:b3:90")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Hangzhou Yueju Apparel Co., Ltd." and pe.signatures [ i ] . issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and pe.signatures [ i ] . serial == "3b:0e:38:79:26:6f:3b:c9:82:25:b3:90" )
 }
 import "pe"
-import "time"
 
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Reflectiveloader : FILE
 {
 	meta:
 		description = "Detects Reflective DLL injection artifacts"
 		author = "ditekSHen"
-		id = "b7bd9184-48f8-5ad8-a234-632e4ec9814d"
+		id = "3d4c866d-2d39-56cf-afa4-1a31852e9b55"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L29-L43"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "540a48f98652c84b09f1076c2e2fca680781f533c936d602809179469a850ba0"
+		logic_hash = "v1_sha256_540a48f98652c84b09f1076c2e2fca680781f533c936d602809179469a850ba0"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240010,23 +239443,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Reflectiveloader : FILE
 		$s2 = "ReflectiveLoader@" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of them or (pe.exports("ReflectiveLoader@4") or pe.exports("_ReflectiveLoader@4") or pe.exports("ReflectiveLoader")))
+		uint16( 0 ) == 0x5a4d and ( 1 of them or ( pe.exports ( "ReflectiveLoader@4" ) or pe.exports ( "_ReflectiveLoader@4" ) or pe.exports ( "ReflectiveLoader" ) ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_IMG_Embedded_Archive : FILE
 {
 	meta:
 		description = "Detects images embedding archives. Observed in TheRat RAT."
 		author = "ditekSHen"
-		id = "2c8e15dc-2e84-5f9b-b538-cba204a3d38c"
+		id = "30ae6066-7690-59e0-b645-676322b201db"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L45-L66"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0e61bc2489a54047c66a659ae2cb6df66683845676e1c02c34d9a0987ddec4bb"
+		logic_hash = "v1_sha256_0e61bc2489a54047c66a659ae2cb6df66683845676e1c02c34d9a0987ddec4bb"
 		score = 40
 		quality = 37
 		tags = "FILE"
@@ -240048,23 +239478,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_IMG_Embedded_Archive : FILE
 		$pksfx = { 50 4B 53 70 58 }
 
 	condition:
-		( uint32(0)==0xe0ffd8ff or uint32(0)==0x474e5089 or uint16(0)==0x4d42) and 1 of them
+		( uint32( 0 ) == 0xe0ffd8ff or uint32( 0 ) == 0x474e5089 or uint16( 0 ) == 0x4d42 ) and 1 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Eventviewer : FILE
 {
 	meta:
 		description = "detects Windows exceutables potentially bypassing UAC using eventvwr.exe"
 		author = "ditekSHen"
-		id = "e4e82d5a-a524-5fac-b14c-4e53a95f4f2c"
+		id = "f648082e-5137-5ab4-8fb1-38eb483c56bd"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L68-L77"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4b893db727ea3ef07805058e9a93664dc01590f249158d9b825cc9cece935640"
+		logic_hash = "v1_sha256_4b893db727ea3ef07805058e9a93664dc01590f249158d9b825cc9cece935640"
 		score = 40
 		quality = 41
 		tags = "FILE"
@@ -240075,23 +239502,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Eventviewer : FILE
 		$s2 = "eventvwr.exe" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Cleanmgr : FILE
 {
 	meta:
 		description = "detects Windows exceutables potentially bypassing UAC using cleanmgr.exe"
 		author = "ditekSHen"
-		id = "cebbe22d-d54d-5a1e-978a-37ddd96133b7"
+		id = "bd17410e-037b-5cd7-9fa4-f8c4e1774a5e"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L79-L88"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9b9e2789bee4f3b54384dabde028a7b6e70b3e0d66090d5141145a72df515db4"
+		logic_hash = "v1_sha256_9b9e2789bee4f3b54384dabde028a7b6e70b3e0d66090d5141145a72df515db4"
 		score = 40
 		quality = 41
 		tags = "FILE"
@@ -240102,23 +239526,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Cleanmgr : FILE
 		$s2 = "\\system32\\cleanmgr.exe" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Enable_Officemacro : FILE
 {
 	meta:
 		description = "Detects Windows executables referencing Office macro registry keys. Observed modifying Office configurations via the registy to enable macros"
 		author = "ditekSHen"
-		id = "2cd26bc8-33c7-5628-982f-dc59ce158082"
+		id = "adc9dcdb-24b8-5f5c-b8a0-712461248ad0"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L90-L108"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "18f66cff1fe2ab32366bf385bfe08f4895071c83e26812709eeb334857754c0f"
+		logic_hash = "v1_sha256_18f66cff1fe2ab32366bf385bfe08f4895071c83e26812709eeb334857754c0f"
 		score = 40
 		quality = 39
 		tags = "FILE"
@@ -240136,23 +239557,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Enable_Officemacro : FILE
 		$d3 = "5c%5c%45%78%63%65%6c%5c%5c%53%65%63%75%72%69%74%79%5c%5c%56%42%41%57%61%72%6e%69%6e%67%73" nocase ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or 2 of ($h*) or 2 of ($d*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or 2 of ( $h* ) or 2 of ( $d* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Disable_Officeprotectedview : FILE
 {
 	meta:
 		description = "Detects Windows executables referencing Office ProtectedView registry keys. Observed modifying Office configurations via the registy to disable ProtectedView"
 		author = "ditekSHen"
-		id = "fed81219-d141-5fbf-a7b6-518e3d4de6f6"
+		id = "249714e9-0764-58d6-a0e7-61c489eac15a"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L110-L128"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "14b2c19ec1f1ade9285f9e73a8779865c1e09d5ad1df2e0469b5f4a5eb278110"
+		logic_hash = "v1_sha256_14b2c19ec1f1ade9285f9e73a8779865c1e09d5ad1df2e0469b5f4a5eb278110"
 		score = 40
 		quality = 39
 		tags = "FILE"
@@ -240170,23 +239588,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Disable_Officeprotectedview : FILE
 		$d3 = "5c%53%65%63%75%72%69%74%79%5c%50%72%6f%74%65%63%74%65%64%56%69%65%77%5c%44%69%73%61%62%6c%65%55%6e%73%61%66%65%4c%6f%63%61%74%69%6f%6e%73%49%6e%50%56" nocase ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or 2 of ($h*) or 2 of ($d*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or 2 of ( $h* ) or 2 of ( $d* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Sandboxproductid : FILE
 {
 	meta:
 		description = "Detects binaries and memory artifacts referencing sandbox product IDs"
 		author = "ditekSHen"
-		id = "5af0ace7-6ffb-5695-94c5-d8172d326662"
+		id = "11b0d6cb-cdd1-5b2b-a185-2e972ceb10b1"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L130-L149"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3a047ef7e70956e1c2222bde47036d7fff6d98cd8a5df81ea85584a3b5006d4a"
+		logic_hash = "v1_sha256_3a047ef7e70956e1c2222bde47036d7fff6d98cd8a5df81ea85584a3b5006d4a"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240207,23 +239622,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Sandboxproductid : FILE
 		$id12 = "76487 - 640 - 1464517 - 23259" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_AHK_Downloader : FILE
 {
 	meta:
 		description = "Detects AutoHotKey binaries acting as second stage droppers"
 		author = "ditekSHen"
-		id = "ac8320ed-a9e1-5660-a50f-ec010ac162a6"
+		id = "2b907699-ea3b-5e04-afb8-c56963004d3c"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L184-L196"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8806d8c03adb4ea4cd9b806f8f8c21e561b39b5602c70d09ed193e35e1502d35"
+		logic_hash = "v1_sha256_8806d8c03adb4ea4cd9b806f8f8c21e561b39b5602c70d09ed193e35e1502d35"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240237,23 +239649,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_AHK_Downloader : FILE
 		$s3 = /AHK\s(Keybd|Mouse)/ fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($d*) and 1 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $d* ) and 1 of ( $s* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_CMSTPCOM : T1218 FILE
 {
 	meta:
 		description = "Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)"
 		author = "ditekSHen"
-		id = "cdcf6e29-6ee7-5ac7-bd52-c8d42f3f8bf6"
+		id = "e6d7c077-9032-507a-ae46-e13d1b05c9d8"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L198-L213"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d198db97901475c0dd10603875fc339d8a7c6d40c7f9c22cda31bb0b1d6d0f2a"
+		logic_hash = "v1_sha256_d198db97901475c0dd10603875fc339d8a7c6d40c7f9c22cda31bb0b1d6d0f2a"
 		score = 40
 		quality = 39
 		tags = "T1218, FILE"
@@ -240267,23 +239676,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_CMSTPCOM : T1218 FILE
 		$s2 = "Elevation:Administrator!new:" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($guid*) and 1 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $guid* ) and 1 of ( $s* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store : FILE
 {
 	meta:
 		description = "Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers"
 		author = "ditekSHen"
-		id = "07223564-bf4f-5fcd-ad3d-b67eb3baea8e"
+		id = "fff47c35-deaf-53d7-a60a-4e87ca7392ea"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L345-L359"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5350f79b01e8e8ae9e0607aa02965cd9ccc52c59a901abcb51e401476cb0fa3a"
+		logic_hash = "v1_sha256_5350f79b01e8e8ae9e0607aa02965cd9ccc52c59a901abcb51e401476cb0fa3a"
 		score = 40
 		quality = 31
 		tags = "FILE"
@@ -240299,23 +239705,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store : FIL
 		$s7 = "wallet.dat" nocase ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients : FILE
 {
 	meta:
 		description = "Detects executables referencing many file transfer clients. Observed in information stealers"
 		author = "ditekSHen"
-		id = "0967c8d6-fc80-5341-9974-c6f16f024c2c"
+		id = "2e9da5c0-e7b7-5c06-904d-ee347ab6dd83"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L418-L472"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "49daece8c3da43b3dba26ab6f71fa5c27d3a6ab2c0427b3d2613c1feb25458de"
+		logic_hash = "v1_sha256_49daece8c3da43b3dba26ab6f71fa5c27d3a6ab2c0427b3d2613c1feb25458de"
 		score = 40
 		quality = 20
 		tags = "FILE"
@@ -240371,23 +239774,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients : FILE
 		$s57 = "South River Technologies\\WebDrive\\Connections" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Usndeletejournal : FILE
 {
 	meta:
 		description = "Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware"
 		author = "ditekSHen"
-		id = "eafc7ed9-d0e7-562d-8215-6f3feddee27a"
+		id = "dc8be150-f2a0-5768-96c7-ceba3f467d90"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L612-L628"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1920fc2bc8c3628016bb91403960f5fbb101b5822f553c1f28d9502841a9832c"
+		logic_hash = "v1_sha256_1920fc2bc8c3628016bb91403960f5fbb101b5822f553c1f28d9502841a9832c"
 		score = 40
 		quality = 35
 		tags = "FILE"
@@ -240405,23 +239805,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Usndeletejournal : FILE
 		$ne4 = "fsutil objectid query C:\\Temp\\sample.txt" wide
 
 	condition:
-		uint16(0)==0x5a4d and ( not any of ($ne*) and ((1 of ($cmd*) and 1 of ($s*)) or 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( not any of ( $ne* ) and ( ( 1 of ( $cmd* ) and 1 of ( $s* ) ) or 1 of ( $s* ) ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Geninfostealer : FILE
 {
 	meta:
 		description = "Detects executables containing common artifacts observed in infostealers"
 		author = "ditekSHen"
-		id = "531d8f7f-dee5-5d05-9293-f1ab5d5ac780"
+		id = "0063a170-c781-5093-a73b-4bce6426c92f"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L630-L657"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f9e6f6b470e010d362db55fcf563f85a3a408ef8331c04a157f2676442b63b1a"
+		logic_hash = "v1_sha256_f9e6f6b470e010d362db55fcf563f85a3a408ef8331c04a157f2676442b63b1a"
 		score = 40
 		quality = 31
 		tags = "FILE"
@@ -240450,23 +239847,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Geninfostealer : FILE
 		$a5 = "httpRealm" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($f*) and 2 of ($b*) and 1 of ($s*) and 3 of ($a*)) or (14 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 2 of ( $f* ) and 2 of ( $b* ) and 1 of ( $s* ) and 3 of ( $a* ) ) or ( 14 of them ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWSH_Asciiencoding_Pattern : FILE
 {
 	meta:
 		description = "Detects PowerShell scripts containing ASCII encoded files"
 		author = "ditekSHen"
-		id = "df96d801-1a14-58af-b245-3a4a6ccf22c6"
+		id = "ea0c02fe-cb13-511c-8330-0a86f5e2fcaf"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L710-L724"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "037ce50a6c6d2bf25163e658c5a8c18950715a52fcdf47162fcd288306acbf9c"
+		logic_hash = "v1_sha256_037ce50a6c6d2bf25163e658c5a8c18950715a52fcdf47162fcd288306acbf9c"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240482,23 +239876,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWSH_Asciiencoding_Pattern : FILE
 		$s5 = "Get-Random" ascii
 
 	condition:
-		1 of ($enc*) and 4 of ($s*) and filesize <2500KB
+		1 of ( $enc* ) and 4 of ( $s* ) and filesize < 2500KB
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_JS_Hex_B64Encoded_EXE : FILE
 {
 	meta:
 		description = "Detects JavaScript files hex and base64 encoded executables"
 		author = "ditekSHen"
-		id = "37516c6b-0a77-5a20-a36f-5f8309b37362"
+		id = "8e77ccb7-882f-5a99-af60-24baf871d42a"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L726-L740"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "60185e6ec96875085ffb7a6bf6eb8643368bbce42b89290ab987eb32c1e153bd"
+		logic_hash = "v1_sha256_60185e6ec96875085ffb7a6bf6eb8643368bbce42b89290ab987eb32c1e153bd"
 		score = 40
 		quality = 20
 		tags = "FILE"
@@ -240514,23 +239905,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_JS_Hex_B64Encoded_EXE : FILE
 		$pattern = /[\s\{\(\[=]_0x[0-9a-z]{3,6}/ ascii
 
 	condition:
-		$binary and $pattern and 2 of ($s*) and filesize <2500KB
+		$binary and $pattern and 2 of ( $s* ) and filesize < 2500KB
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_WMIC_Downloader : FILE
 {
 	meta:
 		description = "Detects files utilizing WMIC for whitelisting bypass and downloading second stage payloads"
 		author = "ditekSHen"
-		id = "bdd6deeb-9d43-55ef-9264-652044ba6938"
+		id = "37a67fc9-6574-542e-829d-e564e17a7a2c"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L765-L776"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0c665f77659b57770f726297b64780764235ba0e72730c985eea62c116fe97e7"
+		logic_hash = "v1_sha256_0c665f77659b57770f726297b64780764235ba0e72730c985eea62c116fe97e7"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240543,23 +239931,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_WMIC_Downloader : FILE
 		$s4 = "WMIC.exe desktop get /format:\"http" wide
 
 	condition:
-		( uint16(0)==0x004c or uint16(0)==0x5a4d) and 1 of them
+		( uint16( 0 ) == 0x004c or uint16( 0 ) == 0x5a4d ) and 1 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_AMSI_Bypass : FILE
 {
 	meta:
 		description = "Detects AMSI bypass pattern"
 		author = "ditekSHen"
-		id = "cdb457b3-1f41-5f58-a482-a00d269c1293"
+		id = "308f21d0-099d-5cec-b076-13c90295ef5c"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L778-L791"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b398c20a0e7b2dff5fab87575c555b657749d7c3b3e8f1a0f99db7e8f669e3ce"
+		logic_hash = "v1_sha256_b398c20a0e7b2dff5fab87575c555b657749d7c3b3e8f1a0f99db7e8f669e3ce"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240574,23 +239959,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_AMSI_Bypass : FILE
 		$v1_6 = "SetValue(" ascii nocase
 
 	condition:
-		5 of them and filesize <2000KB
+		5 of them and filesize < 2000KB
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_PE_Resourcetuner : FILE
 {
 	meta:
 		description = "Detects executables with modified PE resources using the unpaid version of Resource Tuner"
 		author = "ditekSHen"
-		id = "2ada52b4-de9e-5b66-a05e-da894ca79e48"
+		id = "ab7e8215-9c45-5b99-8505-85557d1c40f2"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L793-L801"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "25959ba2f974ecdcda624b4b34cd8dac0336af0dd7c88d2e3b17ec94d58b87b8"
+		logic_hash = "v1_sha256_25959ba2f974ecdcda624b4b34cd8dac0336af0dd7c88d2e3b17ec94d58b87b8"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240600,23 +239982,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_PE_Resourcetuner : FILE
 		$s1 = "Modified by an unpaid evaluation copy of Resource Tuner 2 (www.heaventools.com)" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_References_Sectools_B64Encoded : FILE
 {
 	meta:
 		description = "Detects executables referencing many base64-encoded IR and analysis tools names"
 		author = "ditekSHen"
-		id = "2d3c994a-5b7c-52c5-a4a1-e67a773b692b"
+		id = "d9ff43e5-8cec-59cc-ab4e-0434c1bdf95a"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L897-L941"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "20f889c9c50e8c5e55fd7ebe508015b1e72e6f7ef1b410e5e707d554fb8e8588"
+		logic_hash = "v1_sha256_20f889c9c50e8c5e55fd7ebe508015b1e72e6f7ef1b410e5e707d554fb8e8588"
 		score = 40
 		quality = 43
 		tags = "FILE"
@@ -240662,23 +240041,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_References_Sectools_B64Encoded : FILE
 		$s37 = "Tm9GdXNlckV4" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_References_Sandbox_Artifacts : FILE
 {
 	meta:
 		description = "Detects executables referencing sandbox artifacts"
 		author = "ditekSHen"
-		id = "2c0e4d38-8d68-5cd2-9f9e-e56f372b67cf"
+		id = "bc1511a7-cc10-55fc-b978-b863ef97eeee"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L943-L976"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3d4a356191ec914eba86e78d3823dd1dc2d18f17074abb9986f3337169821bc6"
+		logic_hash = "v1_sha256_3d4a356191ec914eba86e78d3823dd1dc2d18f17074abb9986f3337169821bc6"
 		score = 40
 		quality = 43
 		tags = "FILE"
@@ -240713,23 +240089,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_References_Sandbox_Artifacts : FILE
 		$s26 = "d:\\sandbox_svc.exe" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File : FILE
 {
 	meta:
 		description = "Detects executables containing bas64 encoded gzip files"
 		author = "ditekSHen"
-		id = "e50f8560-d53b-5388-b94d-d104b7c064f2"
+		id = "7dc79522-0104-59c7-a9bb-9bc7b05ec189"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L978-L987"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "431e5a45bf8ed5874b330419675b3d43eb6a563c42873730e823cdd7d6efba97"
+		logic_hash = "v1_sha256_431e5a45bf8ed5874b330419675b3d43eb6a563c42873730e823cdd7d6efba97"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240740,23 +240113,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File : FILE
 		$s2 = "AAAAAAAIs4H" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWSH_Passwordcredential_Retrievepassword
 {
 	meta:
 		description = "Detects PowerShell content designed to retrieve passwords from host"
 		author = "ditekSHen"
-		id = "b34599ab-b874-5ea5-990d-bc7593bb08b5"
+		id = "29016310-cefe-57bc-80eb-c7193d3c9318"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1048-L1058"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f09320d9c4734579a535c7fee993fa076974b13ffd25e0d9ab02bc09663595f8"
+		logic_hash = "v1_sha256_f09320d9c4734579a535c7fee993fa076974b13ffd25e0d9ab02bc09663595f8"
 		score = 40
 		quality = 39
 		tags = ""
@@ -240768,23 +240138,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWSH_Passwordcredential_Retrievepassword
 		$method2 = ".RetrievePassword()" ascii wide nocase
 
 	condition:
-		$namespace and 1 of ($method*)
+		$namespace and 1 of ( $method* )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Envvarscheduledtasks
 {
 	meta:
 		description = "detects Windows exceutables potentially bypassing UAC (ab)using Environment Variables in Scheduled Tasks"
 		author = "ditekSHen"
-		id = "14244310-e524-54bf-8822-9b953378bb75"
+		id = "44267803-1ec9-56f7-b6c6-7f31b10e2d62"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1070-L1081"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dacca794aefd66526535a87c8890c0ad65550ff88bc0242f05c84c9452a31fe2"
+		logic_hash = "v1_sha256_dacca794aefd66526535a87c8890c0ad65550ff88bc0242f05c84c9452a31fe2"
 		score = 40
 		quality = 45
 		tags = ""
@@ -240799,21 +240166,18 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Envvarscheduledtasks
 	condition:
 		all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Fodhelper
 {
 	meta:
 		description = "detects Windows exceutables potentially bypassing UAC using fodhelper.exe"
 		author = "ditekSHen"
-		id = "0651e428-a2ef-508d-ad89-c68ac758808f"
+		id = "22ed4fb7-9bb5-5c31-8d51-3a1693fab90b"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1083-L1094"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ec41ca2185732e418825f7c32095dea361a53e586e498baf4c17eaaf9602ba5e"
+		logic_hash = "v1_sha256_ec41ca2185732e418825f7c32095dea361a53e586e498baf4c17eaaf9602ba5e"
 		score = 40
 		quality = 43
 		tags = ""
@@ -240828,21 +240192,18 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Fodhelper
 	condition:
 		all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Finger_Download_Pattern
 {
 	meta:
 		description = "Detects files embedding and abusing the finger command for download"
 		author = "ditekSHen"
-		id = "6647b410-c8f0-596b-95d7-dbc6a951a83f"
+		id = "812a9d3a-46b4-558d-89a4-1045a3efe03c"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1108-L1118"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "04cbb1abc4c3d2990bae798ece052eb8aa1b5104b5712e98aeb80731316b9c57"
+		logic_hash = "v1_sha256_04cbb1abc4c3d2990bae798ece052eb8aa1b5104b5712e98aeb80731316b9c57"
 		score = 40
 		quality = 45
 		tags = ""
@@ -240854,23 +240215,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Finger_Download_Pattern
 		$ne1 = "Nmap service detection probe list" ascii
 
 	condition:
-		not any of ($ne*) and any of ($pat*)
+		not any of ( $ne* ) and any of ( $pat* )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_CMSTPCMD : FILE
 {
 	meta:
 		description = "Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF"
 		author = "ditekSHen"
-		id = "7bad57dc-ee8b-559d-8b17-af44c5bdf35b"
+		id = "8296afa8-b247-5b85-a01d-6379d4ddd5df"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1120-L1133"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4cb92224d5a520dbd42d00d053aba3da21a49fda9391e5a462fd292d2e87e884"
+		logic_hash = "v1_sha256_4cb92224d5a520dbd42d00d053aba3da21a49fda9391e5a462fd292d2e87e884"
 		score = 40
 		quality = 41
 		tags = "FILE"
@@ -240885,23 +240243,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_CMSTPCMD : FILE
 		$s6 = "\"HKLM\", \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\CMMGR32.EXE\", \"ProfileInstallPath\", \"%UnexpectedError%\", \"\"" fullword wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_JS_WMI_Execquery
 {
 	meta:
 		description = "Detects JS potentially executing WMI queries"
 		author = "ditekSHen"
-		id = "28f37b24-8bf3-5f5c-af47-dc6da5f6397a"
+		id = "a7389187-ed77-57c4-9ef1-af55c27c2024"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1135-L1147"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e5145aa3a7ce54cda84929f6806a1d7b1cb37db729bb932c5c76994fb683250e"
+		logic_hash = "v1_sha256_e5145aa3a7ce54cda84929f6806a1d7b1cb37db729bb932c5c76994fb683250e"
 		score = 40
 		quality = 45
 		tags = ""
@@ -240915,23 +240270,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_JS_WMI_Execquery
 		$s4 = ".Sleep(" ascii nocase
 
 	condition:
-		($ex and all of ($s*))
+		($ex and all of ( $s* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_XML_Liverpool_Downlaoder_Userconfig : FILE
 {
 	meta:
 		description = "Detects XML files associated with 'Liverpool' downloader containing encoded executables"
 		author = "ditekSHen"
-		id = "b5840af5-a285-53f4-bac7-07821e740089"
+		id = "67d21c0a-ef37-5243-8cd6-40be143f0db3"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1227-L1236"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8140c29eb54d8c8786b268d5241fcd221a5fb95433bc1038a7f23295afe8c9b8"
+		logic_hash = "v1_sha256_8140c29eb54d8c8786b268d5241fcd221a5fb95433bc1038a7f23295afe8c9b8"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240942,23 +240294,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_XML_Liverpool_Downlaoder_Userconfig : FILE
 		$s2 = "<value>77 90" ascii nocase
 
 	condition:
-		uint32(0)==0x6d783f3c and all of them
+		uint32( 0 ) == 0x6d783f3c and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_B64_Encoded_Useragent : FILE
 {
 	meta:
 		description = "Detects executables containing base64 encoded User Agent"
 		author = "ditekSHen"
-		id = "e6a6eba2-587f-5b6b-b23d-4e4aa5289d1d"
+		id = "22bdf355-203e-59e9-b440-bbb0901a62a7"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1238-L1247"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ee06d3d9f2f7a294ce0f117d5838fe86ae77f98da0ba30551b0b42811227b1bd"
+		logic_hash = "v1_sha256_ee06d3d9f2f7a294ce0f117d5838fe86ae77f98da0ba30551b0b42811227b1bd"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240969,23 +240318,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_B64_Encoded_Useragent : FILE
 		$s2 = "TW96aWxsYS81LjAgKFdpbmRvd3M" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Winddefender_Antiemaulation : FILE
 {
 	meta:
 		description = "Detects executables containing potential Windows Defender anti-emulation checks"
 		author = "ditekSHen"
-		id = "e7dca0e6-060b-5394-afc5-b3705a51d934"
+		id = "3fe9aad7-0494-5355-9338-7ba53a766639"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1249-L1258"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "76f8a532a59c2a7fcd45d9f9aed3ea2020889228c81410445728f42b6b9d891e"
+		logic_hash = "v1_sha256_76f8a532a59c2a7fcd45d9f9aed3ea2020889228c81410445728f42b6b9d891e"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -240996,23 +240342,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Winddefender_Antiemaulation : FILE
 		$s2 = "HAL9TH" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Attrib : FILE
 {
 	meta:
 		description = "Detects executables using attrib with suspicious attributes attributes"
 		author = "ditekSHen"
-		id = "69925f45-b8a9-516c-857c-7a687b32e0c6"
+		id = "97372b53-f2c0-5f7a-94d3-8fffe5167b61"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1260-L1268"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2d26581037a34f32b3e3aa6df5570f0de0b9e070cbe6190318a99c6f147250d8"
+		logic_hash = "v1_sha256_2d26581037a34f32b3e3aa6df5570f0de0b9e070cbe6190318a99c6f147250d8"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241022,23 +240365,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Attrib : FILE
 		$s1 = "attrib +h +r +s" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Clearmytracksbyprocess : FILE
 {
 	meta:
 		description = "Detects executables calling ClearMyTracksByProcess"
 		author = "ditekSHen"
-		id = "d548cf61-ffb7-5a21-9b76-246f8ffb6ad4"
+		id = "86f2e783-35cf-5cca-9149-df9ca89beb91"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1270-L1278"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "970bdf2cfebc5196204087de134b9d2f032d8074cacbb3b9cc2c859aab3a95fc"
+		logic_hash = "v1_sha256_970bdf2cfebc5196204087de134b9d2f032d8074cacbb3b9cc2c859aab3a95fc"
 		score = 40
 		quality = 43
 		tags = "FILE"
@@ -241048,23 +240388,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Clearmytracksbyprocess : FILE
 		$s1 = "InetCpl.cpl,ClearMyTracksByProcess" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Dotnetprochook : FILE
 {
 	meta:
 		description = "Detects executables with potential process hoocking"
 		author = "ditekSHen"
-		id = "1c32c7ee-0ac6-50ae-892e-73f46902115d"
+		id = "ad3890ef-6991-5913-ba81-aab7eb3a8cdb"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1280-L1291"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e01147886444f8080b7cf7b423dc70b4b08fae6b88a8875eb075530fdb9f7909"
+		logic_hash = "v1_sha256_e01147886444f8080b7cf7b423dc70b4b08fae6b88a8875eb075530fdb9f7909"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241077,23 +240414,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Dotnetprochook : FILE
 		$s4 = "_hook" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Telegramchatbot : FILE
 {
 	meta:
 		description = "Detects executables using Telegram Chat Bot"
 		author = "ditekSHen"
-		id = "bcee52fe-495a-5ea1-bcd9-78b57c992752"
+		id = "753ae9c6-f833-5540-942a-75b0ce1be023"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1293-L1308"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "40374d9dda3d1896906f342725425860e83fbe6b5b0ac656a7035094e36340c0"
+		logic_hash = "v1_sha256_40374d9dda3d1896906f342725425860e83fbe6b5b0ac656a7035094e36340c0"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241110,23 +240444,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Telegramchatbot : FILE
 		$p4 = "/sendLocation" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or (2 of ($p*) and 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or ( 2 of ( $p* ) and 1 of ( $s* ) ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_B64_Artifacts : FILE
 {
 	meta:
 		description = "Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc."
 		author = "ditekSHen"
-		id = "b76ba291-6af5-5800-a280-c04c84cc3f29"
+		id = "946e27d4-d350-5c47-ae52-1b11da9365e0"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1310-L1321"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "35a7a9c0722d8bd174b272c659e62db3e9f41483dc3a9bf5f339b9066ed06c57"
+		logic_hash = "v1_sha256_35a7a9c0722d8bd174b272c659e62db3e9f41483dc3a9bf5f339b9066ed06c57"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241139,23 +240470,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_B64_Artifacts : FILE
 		$s4 = "VmlydHVhbFByb3RlY3Q" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Discordurl : FILE
 {
 	meta:
 		description = "Detects executables Discord URL observed in first stage droppers"
 		author = "ditekSHen"
-		id = "d7221bb4-48c5-5d80-ace1-95cf25fb585d"
+		id = "dd0e8800-9b3b-5ca5-8f70-7074c7d559f4"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1323-L1338"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7f600215268147f8e18f2b4eb6b2e9ba6dd44ab5603a140d3e1b2bb16ebb29c4"
+		logic_hash = "v1_sha256_7f600215268147f8e18f2b4eb6b2e9ba6dd44ab5603a140d3e1b2bb16ebb29c4"
 		score = 40
 		quality = 37
 		tags = "FILE"
@@ -241172,23 +240500,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Discordurl : FILE
 		$s8 = "WboNWY0RXYv02bj5CcwFGZy92YzlGZu4GZj9yL6MHc0RHa" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Regkeycomb_Disablewindefender : FILE
 {
 	meta:
 		description = "Detects executables embedding registry key / value combination indicative of disabling Windows Defender features"
 		author = "ditekSHen"
-		id = "74c82d78-bdb3-54af-b04a-20d66ff123d7"
+		id = "e1cfc4b9-aa1d-5dc3-bb29-6f69d4dc9633"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1448-L1470"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5a33052ded0823a8528590bd0da0023024db174f6f6a0766284c3195f5d3d41f"
+		logic_hash = "v1_sha256_5a33052ded0823a8528590bd0da0023024db174f6f6a0766284c3195f5d3d41f"
 		score = 40
 		quality = 33
 		tags = "FILE"
@@ -241212,23 +240537,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Regkeycomb_Disablewindefender : FILE
 		$k9 = "Add-MpPreference -ExclusionPath \"{0}\"" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($r*) and 1 of ($k*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $r* ) and 1 of ( $k* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Regkeycomb_Iexecutecommandcom : FILE
 {
 	meta:
 		description = "Detects executables embedding command execution via IExecuteCommand COM object"
 		author = "ditekSHen"
-		id = "4bc7e6aa-1771-5c33-bc62-71072dec04cb"
+		id = "3bfe4ba3-ccdc-5928-a3ed-403bdf0ce44b"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1472-L1486"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "269109f96f3fca5eacc19664b7b0c7f970131db29c47bfe1e9e67e56604bf1c1"
+		logic_hash = "v1_sha256_269109f96f3fca5eacc19664b7b0c7f970131db29c47bfe1e9e67e56604bf1c1"
 		score = 40
 		quality = 43
 		tags = "FILE"
@@ -241244,23 +240566,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Regkeycomb_Iexecutecommandcom : FILE
 		$s5 = "/RunAs" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($r*) and 1 of ($k*)) or ( all of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $r* ) and 1 of ( $k* ) ) or ( all of ( $s* ) ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_WMI_Enumeratevideodevice : FILE
 {
 	meta:
 		description = "Detects executables attemping to enumerate video devices using WMI"
 		author = "ditekSHen"
-		id = "6d4ede5e-4ec5-5753-bd50-8e129ac532a4"
+		id = "a66202bc-a7c0-5e67-ae78-3941a4433bc7"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1488-L1502"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8ef63d7a569ee1530a23d151ee394969f4b3b6bac28ed571f48e3f97b87d020a"
+		logic_hash = "v1_sha256_8ef63d7a569ee1530a23d151ee394969f4b3b6bac28ed571f48e3f97b87d020a"
 		score = 40
 		quality = 41
 		tags = "FILE"
@@ -241276,23 +240595,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_WMI_Enumeratevideodevice : FILE
 		$d6 = "HardwareInformation.qwMemorySize" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($q*) and 1 of ($d*)) or 3 of ($d*))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $q* ) and 1 of ( $d* ) ) or 3 of ( $d* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Dcratby : FILE
 {
 	meta:
 		description = "Detects executables containing the string DcRatBy"
 		author = "ditekSHen"
-		id = "d8408cc0-0245-59b7-9134-1f4edd811df7"
+		id = "08bb7153-a258-55ea-a110-58a853302850"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1504-L1512"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1a0f863fb71c84a9a01c3f07da0fdff9ea06b061f85532ac523d6a5d1e0e1e11"
+		logic_hash = "v1_sha256_1a0f863fb71c84a9a01c3f07da0fdff9ea06b061f85532ac523d6a5d1e0e1e11"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241302,23 +240618,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Dcratby : FILE
 		$s1 = "DcRatBy" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Anti_Winjail : FILE
 {
 	meta:
 		description = "Detects executables potentially checking for WinJail sandbox window"
 		author = "ditekSHen"
-		id = "f3a3d099-7659-50aa-8dca-3a2b1c18c3b5"
+		id = "98a3069a-7f7e-5de5-8d29-3df71dfcb0e4"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1514-L1522"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ae8080dad4481b6a2e295c29d3ed24e86da83575e1a5aeda8b1317e6caa74707"
+		logic_hash = "v1_sha256_ae8080dad4481b6a2e295c29d3ed24e86da83575e1a5aeda8b1317e6caa74707"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241328,23 +240641,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Anti_Winjail : FILE
 		$s1 = "Afx:400000:0" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Anti_Oldcopypaste : FILE
 {
 	meta:
 		description = "Detects executables potentially checking for WinJail sandbox window"
 		author = "ditekSHen"
-		id = "10a70ad3-c37e-5522-ae3f-3f85f89f9394"
+		id = "5d6f0f68-9c66-545f-bd1b-fcd8e2611d27"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1524-L1543"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "084a1613eaf1df4cd54c44e4389b9edc1c44b4b947a8c4416cb7cbdabc186747"
+		logic_hash = "v1_sha256_084a1613eaf1df4cd54c44e4389b9edc1c44b4b947a8c4416cb7cbdabc186747"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241365,23 +240675,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Anti_Oldcopypaste : FILE
 		$v7 = "CURRENTUSER" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or all of ($v*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or all of ( $v* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Go_Golazagne : FILE
 {
 	meta:
 		description = "Detects Go executables using GoLazagne"
 		author = "ditekSHen"
-		id = "3b54892d-8015-518c-af0b-03ddd65478f6"
+		id = "1ffbacc0-e55e-50b8-895f-a5089b049026"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1545-L1554"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9618f8a6eb9a5db01b7a58a469309220b1e22afe928006d642e5404380f312f1"
+		logic_hash = "v1_sha256_9618f8a6eb9a5db01b7a58a469309220b1e22afe928006d642e5404380f312f1"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241392,23 +240699,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Go_Golazagne : FILE
 		$s2 = "Go build ID:" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_CSPROJ : FILE
 {
 	meta:
 		description = "Detects suspicious .CSPROJ files then compiled with msbuild"
 		author = "ditekSHen"
-		id = "99f9fbd0-9435-511a-b9f5-7ea11e655b79"
+		id = "813e98e9-3382-5c4e-aecd-c2281289f732"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1556-L1568"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e41c82ab0da47192463f76192ea7748dfcf59193475871daf1a7a4ff2fda4d52"
+		logic_hash = "v1_sha256_e41c82ab0da47192463f76192ea7748dfcf59193475871daf1a7a4ff2fda4d52"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241422,23 +240726,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_CSPROJ : FILE
 		$x3 = "CallWindowProc(" ascii nocase
 
 	condition:
-		uint32(0)==0x6f72503c and ( all of ($s*) and 2 of ($x*))
+		uint32( 0 ) == 0x6f72503c and ( all of ( $s* ) and 2 of ( $x* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Sandbox_Evasion_Filescomb : FILE
 {
 	meta:
 		description = "Detects executables referencing specific set of files observed in sandob anti-evation, and Emotet"
 		author = "ditekSHen"
-		id = "04108277-03ac-5479-ac9f-0c7377dc70b8"
+		id = "81af980c-654e-5705-b8cb-9b35cb8811fc"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1694-L1711"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d9f235e212e75cef51e3321f49968c75523304dc94a2b7cf3965c9f88d039b43"
+		logic_hash = "v1_sha256_d9f235e212e75cef51e3321f49968c75523304dc94a2b7cf3965c9f88d039b43"
 		score = 40
 		quality = 23
 		tags = "FILE"
@@ -241457,23 +240758,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Sandbox_Evasion_Filescomb : FILE
 		$s10 = "c:\\symbols\\aagmmc.pdb" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_VM_Evasion_Virtdrvcomb : FILE
 {
 	meta:
 		description = "Detects executables referencing combination of virtualization drivers"
 		author = "ditekSHen"
-		id = "88f271d5-07a3-5ca6-9536-4f68bccf49bc"
+		id = "707948e8-5d0d-54ac-b671-d24bd4fabffc"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1713-L1757"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a7bbd05e17b8a111b841ed2a86b4794cde8972a673acf331d800029e54d8f602"
+		logic_hash = "v1_sha256_a7bbd05e17b8a111b841ed2a86b4794cde8972a673acf331d800029e54d8f602"
 		score = 40
 		quality = 43
 		tags = "FILE"
@@ -241514,23 +240812,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_VM_Evasion_Virtdrvcomb : FILE
 		$vw6 = "hgfs.sys" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($p*) and (2 of ($vb*) or 2 of ($vp*) or 2 of ($vw*))) or (2 of ($vb*) and (2 of ($p*) or 2 of ($vp*) or 2 of ($vw*))) or (2 of ($vp*) and (2 of ($p*) or 2 of ($vb*) or 2 of ($vw*))) or (2 of ($vw*) and (2 of ($p*) or 2 of ($vb*) or 2 of ($vp*))))
+		uint16( 0 ) == 0x5a4d and ( ( 2 of ( $p* ) and ( 2 of ( $vb* ) or 2 of ( $vp* ) or 2 of ( $vw* ) ) ) or ( 2 of ( $vb* ) and ( 2 of ( $p* ) or 2 of ( $vp* ) or 2 of ( $vw* ) ) ) or ( 2 of ( $vp* ) and ( 2 of ( $p* ) or 2 of ( $vb* ) or 2 of ( $vw* ) ) ) or ( 2 of ( $vw* ) and ( 2 of ( $p* ) or 2 of ( $vb* ) or 2 of ( $vp* ) ) ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Nonewindowsua : FILE
 {
 	meta:
 		description = "Detects Windows executables referencing non-Windows User-Agents"
 		author = "ditekSHen"
-		id = "3bf62a67-4c21-5bcc-a356-424e798141f1"
+		id = "c444f12c-7eca-5998-8641-7b5cc332f1cc"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1759-L1784"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fb65643fd93ce4dbec0f98259b3dacda748a3f62f71258726073fdb3e354ab42"
+		logic_hash = "v1_sha256_fb65643fd93ce4dbec0f98259b3dacda748a3f62f71258726073fdb3e354ab42"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241556,23 +240851,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Nonewindowsua : FILE
 		$ua17 = "Mozilla / 5.0 (SymbianOS" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Toomanywindowsua : FILE
 {
 	meta:
 		description = "Detects executables referencing many varying, potentially fake Windows User-Agents"
 		author = "ditekSHen"
-		id = "28dba61e-b2da-5708-b82f-a139d0929a7d"
+		id = "ad8ce5b7-7b74-5888-909e-117655a84390"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1786-L1810"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a79ea9b8471148176c210fe834e7b2f0549291956489e2853235a75ea3e4e1db"
+		logic_hash = "v1_sha256_a79ea9b8471148176c210fe834e7b2f0549291956489e2853235a75ea3e4e1db"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241598,23 +240890,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Toomanywindowsua : FILE
 		$ua17 = "Mozilla/5.0 (Windows; U; Windows NT 6.1; tr-TR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_VM_Evasion_Macaddrcomb : FILE
 {
 	meta:
 		description = "Detects executables referencing virtualization MAC addresses"
 		author = "ditekSHen"
-		id = "7e399d31-090a-57f7-89fa-0a2c4e563283"
+		id = "075d6aa0-1cc4-5037-a7a9-00ffa73b0db9"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1812-L1827"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "53a87bffc327c38545d9f213834726af9a1fbe86f273e189dc355567e6a671bf"
+		logic_hash = "v1_sha256_53a87bffc327c38545d9f213834726af9a1fbe86f273e189dc355567e6a671bf"
 		score = 40
 		quality = 29
 		tags = "FILE"
@@ -241631,23 +240920,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_VM_Evasion_Macaddrcomb : FILE
 		$s8 = "08:00:27" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Discord_Regex : FILE
 {
 	meta:
 		description = "Detects executables referencing Discord tokens regular expressions"
 		author = "ditekSHen"
-		id = "4c508cae-bb25-549b-8f35-a6a22928a9a3"
+		id = "88be8fc0-ae75-569d-9aee-597a986b41c7"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1890-L1898"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b6be1dd8e25311442a59ee2afbd99f6e9663dd06919c07269b76238af0bbd5f2"
+		logic_hash = "v1_sha256_b6be1dd8e25311442a59ee2afbd99f6e9663dd06919c07269b76238af0bbd5f2"
 		score = 40
 		quality = 43
 		tags = "FILE"
@@ -241657,23 +240943,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Discord_Regex : FILE
 		$s1 = "[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{6}\\.[a-zA-Z0-9_\\-]{27}|mfa\\.[a-zA-Z0-9_\\-]{84}" ascii wide nocase
 
 	condition:
-		( uint16(0)==0x5a4d and all of them ) or all of them
+		( uint16( 0 ) == 0x5a4d and all of them ) or all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_VPN : FILE
 {
 	meta:
 		description = "Detects executables referencing many VPN software clients. Observed in infosteslers"
 		author = "ditekSHen"
-		id = "301977a8-0619-50a2-a718-78ff9e039e65"
+		id = "8239f3a0-af57-5d01-887a-7f770cc9649f"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1900-L1914"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5bef727d3c6fa7ea01c16e7b1fdf146b4cef58c06189bf8540bbfe7915790578"
+		logic_hash = "v1_sha256_5bef727d3c6fa7ea01c16e7b1fdf146b4cef58c06189bf8540bbfe7915790578"
 		score = 40
 		quality = 31
 		tags = "FILE"
@@ -241689,23 +240972,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_VPN : FILE
 		$s7 = "\\VPN\\EarthVPN" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Vaultschemaguid : FILE
 {
 	meta:
 		description = "Detects executables referencing Windows vault credential objects. Observed in infostealers"
 		author = "ditekSHen"
-		id = "440ac8a8-19c9-5284-a8e2-e0f2e8892a5e"
+		id = "529f4cd2-7c70-52b9-9218-344558a4df64"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1930-L1953"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "121a51bbb749cc86d50fd5f79d7a24fbbb3e589e2fb25c553764a16202ff4065"
+		logic_hash = "v1_sha256_121a51bbb749cc86d50fd5f79d7a24fbbb3e589e2fb25c553764a16202ff4065"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241722,23 +241002,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Vaultschemaguid : FILE
 		$s8 = "3C886FF3-2669-4AA2-A8FB-3F6759A77548" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Antivm_UNK01 : FILE
 {
 	meta:
 		description = "Detects memory artifacts referencing specific combination of anti-VM checks"
 		author = "ditekSHen"
-		id = "57344ff4-5204-535a-a128-0f9f7eb7c760"
+		id = "f6f94144-6faa-50c9-8367-2e76ff475728"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1955-L1977"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c34b23e26df0d33d60cf87e406dfbc90f9fd6df0da4415b6622d477cf38bc024"
+		logic_hash = "v1_sha256_c34b23e26df0d33d60cf87e406dfbc90f9fd6df0da4415b6622d477cf38bc024"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241762,23 +241039,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Antivm_UNK01 : FILE
 		$s15 = "%systemroot%\\system32\\ntdll.dll" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Antivm_WMIC : FILE
 {
 	meta:
 		description = "Detects memory artifacts referencing WMIC commands for anti-VM checks"
 		author = "ditekSHen"
-		id = "f7166171-15b7-5e11-bbec-355764e58caa"
+		id = "a5b7ef6e-4431-5dfd-9e97-f8deba1ca56a"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1979-L1989"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2c26ea8b008bf9cb4d8e24c909a3c6f5d67783b483747268f949fadc3fa72532"
+		logic_hash = "v1_sha256_2c26ea8b008bf9cb4d8e24c909a3c6f5d67783b483747268f949fadc3fa72532"
 		score = 40
 		quality = 39
 		tags = "FILE"
@@ -241790,23 +241064,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Antivm_WMIC : FILE
 		$s3 = "wmic process where \"name like '%vbox%'\"" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Enablesmbv1 : FILE
 {
 	meta:
 		description = "Detects binaries with PowerShell command enabling SMBv1"
 		author = "ditekSHen"
-		id = "cb3b43f3-8f45-5e4e-8e5e-9bfb89e842d3"
+		id = "64997f2d-c8cd-53d6-8b61-84ad16b4c0ac"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L1991-L1999"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "68eb41d843b39e784d99153607c1deecdb5258cdbf641e2dd177c364847d85b1"
+		logic_hash = "v1_sha256_68eb41d843b39e784d99153607c1deecdb5258cdbf641e2dd177c364847d85b1"
 		score = 40
 		quality = 43
 		tags = "FILE"
@@ -241816,23 +241087,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Enablesmbv1 : FILE
 		$s1 = "Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Enablenetworkdiscovery : FILE
 {
 	meta:
 		description = "Detects binaries manipulating Windows firewall to enable permissive network discovery"
 		author = "ditekSHen"
-		id = "b1203e7a-b4f3-587e-aaea-a4cccaedc07d"
+		id = "a03c5c52-898b-54fd-9ff1-4e9de44e3b44"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2001-L2010"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6c28a33849d1c6c72b65926a81e96f0e3f5b9bb0a48739bf4240a16f6a10dcea"
+		logic_hash = "v1_sha256_6c28a33849d1c6c72b65926a81e96f0e3f5b9bb0a48739bf4240a16f6a10dcea"
 		score = 40
 		quality = 41
 		tags = "FILE"
@@ -241843,23 +241111,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Enablenetworkdiscovery : FILE
 		$s2 = "netsh advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Authapps : FILE
 {
 	meta:
 		description = "Detects executables referencing many authentication apps. Observed in information stealers"
 		author = "ditekSHen"
-		id = "b2c1307d-ac4a-567f-ab14-7c65e16d984e"
+		id = "a2e7bd7b-d794-5cac-9595-0a8a0f868067"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2012-L2021"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9c730ba532dca023821fd9073bffeecf099a2a956b7715421bd0b4e5e5d4b2cf"
+		logic_hash = "v1_sha256_9c730ba532dca023821fd9073bffeecf099a2a956b7715421bd0b4e5e5d4b2cf"
 		score = 40
 		quality = 41
 		tags = "FILE"
@@ -241870,23 +241135,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Authapps : FILE
 		$s2 = "Authy Desktop\\Local" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Undocumented_Winapi_Kerberos : FILE
 {
 	meta:
 		description = "Detects executables referencing undocumented kerberos Windows APIs and obsereved in malware"
 		author = "ditekSHen"
-		id = "1eb7faab-66b8-5d98-b6a8-75a078c2f6f8"
+		id = "1f31938f-0cf5-54f6-9da7-1c36c8c41823"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2054-L2068"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "19f22dcbc63723624d92be22cd69dcbab03a0b46299d43bc50ba73c79e573596"
+		logic_hash = "v1_sha256_19f22dcbc63723624d92be22cd69dcbab03a0b46299d43bc50ba73c79e573596"
 		score = 40
 		quality = 35
 		tags = "FILE"
@@ -241898,23 +241160,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Undocumented_Winapi_Kerberos : FILE
 		$kdc3 = "KerbFreeKey" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of ($kdc*)
+		uint16( 0 ) == 0x5a4d and all of ( $kdc* )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_NKN_BCP2P : FILE
 {
 	meta:
 		description = "Detects executables referencing NKN Blockchain P2P network"
 		author = "ditekSHen"
-		id = "21aa4034-8c8f-515e-b8a4-4ce32ad816a6"
+		id = "b8799f1c-ec63-5be0-83b7-69d13bb2e9c3"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2070-L2086"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "98161fcac130ba758bd9f8c4bc7133b9ba862df61dd86ad7d0ecbb0f18813a5e"
+		logic_hash = "v1_sha256_98161fcac130ba758bd9f8c4bc7133b9ba862df61dd86ad7d0ecbb0f18813a5e"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -241932,23 +241191,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_NKN_BCP2P : FILE
 		$s6 = ".GetNodeStateContext" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $s* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Passwordmanagers : FILE
 {
 	meta:
 		description = "Detects executables referencing many Password Manager software clients. Observed in infostealers"
 		author = "ditekSHen"
-		id = "4da7bf22-fdd7-53b7-bdfc-da7ac5657f6f"
+		id = "834d8506-fd22-5bae-bdd6-5dd17167c6b5"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2088-L2099"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6d2f7739282611166a7e06d96345c46df92500b387d9f940169d5ee6664ea5ad"
+		logic_hash = "v1_sha256_6d2f7739282611166a7e06d96345c46df92500b387d9f940169d5ee6664ea5ad"
 		score = 40
 		quality = 37
 		tags = "FILE"
@@ -241961,23 +241217,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Passwordmanagers : FILE
 		$s4 = "RoboForm\\" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Wirelessnetreccon : FILE
 {
 	meta:
 		description = "Detects executables with interest in wireless interface using netsh"
 		author = "ditekSHen"
-		id = "15515523-fe53-5512-95f3-79d0695e7da0"
+		id = "7694bcf8-357f-5b45-9a53-8ed8e8143e19"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2101-L2111"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a8614a8c11e3797e7d7fb7ec2c0705fafc98ce50714e48798594e6fb5bfc1789"
+		logic_hash = "v1_sha256_a8614a8c11e3797e7d7fb7ec2c0705fafc98ce50714e48798594e6fb5bfc1789"
 		score = 40
 		quality = 39
 		tags = "FILE"
@@ -241989,23 +241242,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Wirelessnetreccon : FILE
 		$s3 = "netsh wlan show networks mode=bssid" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Gitconfdata : FILE
 {
 	meta:
 		description = "Detects executables referencing potentially confidential GIT artifacts. Observed in infostealer"
 		author = "ditekSHen"
-		id = "5462491b-f1cf-55ae-b120-ed09eb9549bc"
+		id = "e43f72cc-7de9-5289-ac9f-725185fa4d77"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2113-L2125"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d8b370ea31fade4f6f4ae12903e40026d806862f6c4a7b5818e3942b6b849fd2"
+		logic_hash = "v1_sha256_d8b370ea31fade4f6f4ae12903e40026d806862f6c4a7b5818e3942b6b849fd2"
 		score = 40
 		quality = 41
 		tags = "FILE"
@@ -242019,23 +241269,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Gitconfdata : FILE
 		$s5 = ".gitconfig" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Reversed : FILE
 {
 	meta:
 		description = "Detects reversed executables. Observed N-stage drop"
 		author = "ditekSHen"
-		id = "765b1983-8831-5f7d-9cbd-90af0cd452f7"
+		id = "0819191f-8650-5006-acc8-db21809b1686"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2127-L2135"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4d031f59b201f5c5c9b69bbbe277cc10c3b5ed8427c5c2f679fdd33c8bc41501"
+		logic_hash = "v1_sha256_4d031f59b201f5c5c9b69bbbe277cc10c3b5ed8427c5c2f679fdd33c8bc41501"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -242045,23 +241292,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Reversed : FILE
 		$s1 = "edom SOD ni nur eb tonnac margorp sihT" ascii
 
 	condition:
-		uint16( filesize -0x2)==0x4d5a and $s1
+		uint16( filesize - 0x2 ) == 0x4d5a and $s1
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICOUS_EXE_UNC_Regex : FILE
 {
 	meta:
 		description = "Detects executables with considerable number of regexes often observed in infostealers"
 		author = "ditekSHen"
-		id = "968ed633-46ed-5efe-84e5-64718f89fb0a"
+		id = "bd3fbb14-8082-5838-bcfe-7ad5b54daffc"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2279-L2308"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9201469952c2cacebbcbf6801e2c22d018f36742ffbefedc8ee4aa34f413334a"
+		logic_hash = "v1_sha256_9201469952c2cacebbcbf6801e2c22d018f36742ffbefedc8ee4aa34f413334a"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -242092,23 +241336,20 @@ rule DITEKSHEN_INDICATOR_SUSPICOUS_EXE_UNC_Regex : FILE
 		$s22 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}|mfa\\.[\\w-]{84}" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deleterecentitems : FILE
 {
 	meta:
 		description = "Detects executables embedding anti-forensic artifacts of deleting Windows Recent Items"
 		author = "ditekSHen"
-		id = "58a14ad6-8f32-54d8-b343-88629af8810b"
+		id = "83d6b16d-acf1-578c-b076-89712b74a136"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2310-L2321"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "01efada47910a345e7bde4e9295754aefec38355193f45c4630f55050d835cd9"
+		logic_hash = "v1_sha256_01efada47910a345e7bde4e9295754aefec38355193f45c4630f55050d835cd9"
 		score = 40
 		quality = 37
 		tags = "FILE"
@@ -242121,23 +241362,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deleterecentitems : FILE
 		$s4 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deletewindefenderquarantinefiles : FILE
 {
 	meta:
 		description = "Detects executables embedding anti-forensic artifacts of deleting Windows defender quarantine files"
 		author = "ditekSHen"
-		id = "a2b5c531-4e51-5c44-838b-3dffc2ed0263"
+		id = "ca0b8df8-a596-5428-be8f-11467b23f308"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2323-L2337"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1cf82a8fb6c878cb3aaeaf36eb346b2f8038e166e8ce7b5c214769e475ae91de"
+		logic_hash = "v1_sha256_1cf82a8fb6c878cb3aaeaf36eb346b2f8038e166e8ce7b5c214769e475ae91de"
 		score = 40
 		quality = 29
 		tags = "FILE"
@@ -242153,23 +241391,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deletewindefenderquarantinefiles : FILE
 		$p3 = "Microsoft\\Windows Defender\\Quarantine\\ResourceData /S" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or (1 of ($r*) and 2 of ($p*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or ( 1 of ( $r* ) and 2 of ( $p* ) ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deleteshimcache : FILE
 {
 	meta:
 		description = "Detects executables embedding anti-forensic artifacts of deleting shim cache"
 		author = "ditekSHen"
-		id = "32b185f2-a11e-522e-822e-7023698975f8"
+		id = "098aa4fe-11d9-5168-83b3-21eed77b3e12"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2339-L2350"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4ecd9e4db082a464735e447f95175ec5b35164d42fce7be862400191c143aa23"
+		logic_hash = "v1_sha256_4ecd9e4db082a464735e447f95175ec5b35164d42fce7be862400191c143aa23"
 		score = 40
 		quality = 37
 		tags = "FILE"
@@ -242182,23 +241417,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deleteshimcache : FILE
 		$m2 = "rundll32" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($s*) or all of ($m*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $s* ) or all of ( $m* ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_Shredfilesteps : FILE
 {
 	meta:
 		description = "Detects executables embedding/copying file shredding steps"
 		author = "ditekSHen"
-		id = "2a4ac767-8946-5e58-9087-aa1d3a97b5d5"
+		id = "45dc6433-1ec6-5718-a3b5-2dd3ede81613"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2352-L2365"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9e784c1d06b232ac2de7318854a59b237aeb88d8e6670fe4ecc9f3230310088a"
+		logic_hash = "v1_sha256_9e784c1d06b232ac2de7318854a59b237aeb88d8e6670fe4ecc9f3230310088a"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -242213,23 +241445,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Shredfilesteps : FILE
                 db 6d b6 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWS_Capturescreenshot
 {
 	meta:
 		description = "Detects PowerShell script with screenshot capture capability"
 		author = "ditekSHen"
-		id = "d769936a-a81d-5052-8b1b-7bd5a73b41db"
+		id = "73273c6d-0519-5b0b-a509-86bdd9779798"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2367-L2379"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "26e02d7dc242fb2c913b3a7c07e92c84becad62a4cdbae781bce948bfe0eb81b"
+		logic_hash = "v1_sha256_26e02d7dc242fb2c913b3a7c07e92c84becad62a4cdbae781bce948bfe0eb81b"
 		score = 40
 		quality = 45
 		tags = ""
@@ -242243,23 +241472,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWS_Capturescreenshot
 		$save = ".Save(" ascii nocase
 
 	condition:
-		$encoder and (1 of ($capture*) and ($access or $save))
+		$encoder and ( 1 of ( $capture* ) and ( $access or $save ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWS_Capturebrowserplugins
 {
 	meta:
 		description = "Detects PowerShell script with browser plugins capture capability"
 		author = "ditekSHen"
-		id = "9b1bb195-6e32-5f93-ba70-efcb21b26bb0"
+		id = "27111039-da0f-550d-92fc-36203f40d070"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2381-L2394"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ac7be8663507e96ecb224f7f09f9092069eab5967598e33c107fa341de86bc77"
+		logic_hash = "v1_sha256_ac7be8663507e96ecb224f7f09f9092069eab5967598e33c107fa341de86bc77"
 		score = 40
 		quality = 45
 		tags = ""
@@ -242274,23 +241500,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWS_Capturebrowserplugins
 		$o3 = ".Add(" ascii nocase
 
 	condition:
-		2 of ($s*) and 2 of ($o*)
+		2 of ( $s* ) and 2 of ( $o* )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_IMG_Embedded_B64_EXE : FILE
 {
 	meta:
 		description = "Detects images with specific base64 markers and/or embedding (reversed) base64-encoded executables"
 		author = "ditekSHen"
-		id = "c620b461-5ad8-530b-a3e1-f75a9e30534e"
+		id = "e46eff3e-5caa-5cfa-8591-011d65224932"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2396-L2413"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0fe1328aba3b30820e3885c87a93e52306bd25abc5912378a12e1213a686cd39"
+		logic_hash = "v1_sha256_0fe1328aba3b30820e3885c87a93e52306bd25abc5912378a12e1213a686cd39"
 		score = 40
 		quality = 45
 		tags = "FILE"
@@ -242309,23 +241532,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_IMG_Embedded_B64_EXE : FILE
 		$h2 = "AQqVT" ascii
 
 	condition:
-		( uint32(0)==0xd8ff or uint32(0)==0x474e5089 or uint16(0)==0x4d42) and ((2 of ($m*)) or (1 of ($h*)))
+		( uint32( 0 ) == 0xd8ff or uint32( 0 ) == 0x474e5089 or uint16( 0 ) == 0x4d42 ) and ( ( 2 of ( $m* ) ) or ( 1 of ( $h* ) ) )
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Transfersh_URL : FILE
 {
 	meta:
 		description = "Detects files referencing the transfer.sh file sharing website"
 		author = "ditekSHen"
-		id = "15c6ba05-199d-52ba-98bf-7e8a8eda0295"
+		id = "9d692ffb-353f-5a84-bd6a-dd93ad9aa033"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2415-L2423"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "45b16f853bcd9c492468bc478d0a7eeecd261ae47b5b00bb1e4a79788fdec7a1"
+		logic_hash = "v1_sha256_45b16f853bcd9c492468bc478d0a7eeecd261ae47b5b00bb1e4a79788fdec7a1"
 		score = 40
 		quality = 43
 		tags = "FILE"
@@ -242335,23 +241555,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Transfersh_URL : FILE
 		$s1 = "//transfer.sh/get/" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
-import "pe"
-import "time"
-
 rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Publicserviceinterface : FILE
 {
 	meta:
 		description = "Detect executables referencing public and free service interface testing and dev services as means of CnC"
 		author = "ditekSHen"
-		id = "f6ac752b-0afc-5834-82b4-4dbcfded2f3a"
+		id = "ea6d9939-1d65-5331-8886-ec5a2b8c36e3"
 		date = "2024-06-08"
 		modified = "2024-06-08"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L2450-L2461"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2a7b4fe7ddb41a7ae895a2ac8e9bb5eda61f5b86ca35575be32d65611e2d0a9e"
+		logic_hash = "v1_sha256_2a7b4fe7ddb41a7ae895a2ac8e9bb5eda61f5b86ca35575be32d65611e2d0a9e"
 		score = 40
 		quality = 37
 		tags = "FILE"
@@ -242364,22 +241581,20 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Publicserviceinterface : FILE
 		$s4 = "devtunnels.ms/" ascii wide nocase
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and 1 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and 1 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Lazagne : FILE
 {
 	meta:
 		description = "Detects LaZagne post-exploitation password stealing tool. It is typically embedded with malware in the binary resources."
 		author = "ditekSHen"
-		id = "68bc50b0-a64f-50b6-bfbf-a26a4d0970ef"
+		id = "8e5511e4-5c1f-5bc9-a681-697ee4723809"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L3-L20"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "af4427174c1026204dc9c71878c5125efdf190328840b65fe4a69277a16fe7d2"
+		logic_hash = "v1_sha256_af4427174c1026204dc9c71878c5125efdf190328840b65fe4a69277a16fe7d2"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -242397,22 +241612,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Lazagne : FILE
 		$s10 = "lazagne.config." ascii
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Credstealer : FILE
 {
 	meta:
 		description = "Detects Python executable for stealing credentials including domain environments. Observed in MuddyWater."
 		author = "ditekSHen"
-		id = "ab587b12-f3e1-5f08-b27c-03ee9752e513"
+		id = "e9e587ea-dd51-59ad-b44a-805ab12b32e8"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L22-L41"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e729c8b0b1db642acabbc4590833c05ce81447bb89e5f40aea5f0b8ebdee4438"
+		logic_hash = "v1_sha256_e729c8b0b1db642acabbc4590833c05ce81447bb89e5f40aea5f0b8ebdee4438"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242432,22 +241645,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Credstealer : FILE
 		$p7 = "Combo file containing a list of domain\\username:password or username:password entriess" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) and 1 of ($p*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) and 1 of ( $p* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_CNC_Shootback : FILE
 {
 	meta:
 		description = "detects Python executable for CnC communication via reverse tunnels. Used by MuddyWater group."
 		author = "ditekSHen"
-		id = "fb608115-6d9f-5640-88be-674e53b07126"
+		id = "7fda61bc-12a4-548a-8896-901f462a5d72"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L43-L62"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "996cabd4965164cb844cee1ab1e2894fc2b4fac14d4e660c456b494c5cbd0688"
+		logic_hash = "v1_sha256_996cabd4965164cb844cee1ab1e2894fc2b4fac14d4e660c456b494c5cbd0688"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -242467,22 +241678,20 @@ rule DITEKSHEN_INDICATOR_TOOL_CNC_Shootback : FILE
 		$p7 = "the actual traffic is:  customer <--> master(1.2.3.4) <--> slaver(this pc) <--> ssh(this pc)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) and 2 of ($p*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) and 2 of ( $p* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Fgdump : FILE
 {
 	meta:
 		description = "detects all versions of the password dumping tool, fgdump. Observed to be used by DustSquad group."
 		author = "ditekSHen"
-		id = "2759fce2-db2a-5a48-bb37-931fd847a32d"
+		id = "e6986887-babb-56c8-8ee5-4955ee0c86be"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L64-L81"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fdccd91a84374f7c94843bd9c2191720959416acf2e33d7b28b42d63d7ea4ce3"
+		logic_hash = "v1_sha256_fdccd91a84374f7c94843bd9c2191720959416acf2e33d7b28b42d63d7ea4ce3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242500,22 +241709,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Fgdump : FILE
 		$10 = "writable connection to %s" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Sharpweb : FILE
 {
 	meta:
 		description = "detects all versions of the browser password dumping .NET tool, SharpWeb."
 		author = "ditekSHen"
-		id = "f85dd689-c2a9-5cea-9c19-1e66ec942606"
+		id = "798bcd72-db02-5d91-b904-248d5a20d053"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L83-L110"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "036d576eb7acdededda7b31d3dda3a4928e01ff761bf45a1112da6bf7d4e2966"
+		logic_hash = "v1_sha256_036d576eb7acdededda7b31d3dda3a4928e01ff761bf45a1112da6bf7d4e2966"
 		score = 75
 		quality = 40
 		tags = "FILE"
@@ -242539,22 +241746,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Sharpweb : FILE
 		$pdb = "\\SharpWeb\\obj\\Debug\\SharpWeb.pdb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($func*) and 3 of ($param*) and (1 of ($path*) or 1 of ($sql*))) or $pdb)
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $func* ) and 3 of ( $param* ) and ( 1 of ( $path* ) or 1 of ( $sql* ) ) ) or $pdb )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Blackbone : FILE
 {
 	meta:
 		description = "detects Blackbone password dumping tool on Windows 7-10 operating system."
 		author = "ditekSHen"
-		id = "a6d9f9d1-75fb-51af-87ad-80b4e135e759"
+		id = "5958f41f-f2bb-546d-9a3c-c422f11555b6"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L112-L129"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e9dacd28accaef8a93ff8d3b5cf9437b3848791711a4a7118ab46d2bb6ca42d3"
+		logic_hash = "v1_sha256_e9dacd28accaef8a93ff8d3b5cf9437b3848791711a4a7118ab46d2bb6ca42d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242572,22 +241777,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Blackbone : FILE
 		$s10 = "WDKTestCert Ton," ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Mimikatz : FILE
 {
 	meta:
 		description = "Detects Mimikatz"
 		author = "ditekSHen"
-		id = "feb236c0-6e0d-5c2c-a050-cf1d000aaf38"
+		id = "729cbdda-23b6-5786-8258-4058cb8c5b5c"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L131-L164"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "42c9c78c88bb7c427d5f0bf1d3b0113205780142b499eb17858037ded0f2971e"
+		logic_hash = "v1_sha256_42c9c78c88bb7c427d5f0bf1d3b0113205780142b499eb17858037ded0f2971e"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -242618,22 +241821,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Mimikatz : FILE
 		$sys_x64 = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($*) or 3 of ($f*) or all of ($dll_*) or any of ($sys_*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $* ) or 3 of ( $f* ) or all of ( $dll_* ) or any of ( $sys_* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_SCN_Portscan : FILE
 {
 	meta:
 		description = "Detects a port scanner tool observed as second or third stage post-compromise or dropped by malware."
 		author = "ditekSHen"
-		id = "f270e098-17a0-5d66-acd0-c946a29919f4"
+		id = "003fd6ac-9261-5af7-8f7c-cf0d036ba6df"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L166-L180"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ebe5eb045a250ca38a55ac43018548074e9db160d76737c36f8ae5ea268b7b10"
+		logic_hash = "v1_sha256_ebe5eb045a250ca38a55ac43018548074e9db160d76737c36f8ae5ea268b7b10"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242648,22 +241849,20 @@ rule DITEKSHEN_INDICATOR_TOOL_SCN_Portscan : FILE
 		$s7 = "Normal Scan: About To Scan %" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_MEM_Mxtract : FILE
 {
 	meta:
 		description = "Detects mXtract, a linux-based tool that dumps memory for offensive pentration testing and can be used to scan memory for private keys, ips, and passwords using regexes."
 		author = "ditekSHen"
-		id = "e8c5e5b3-aa98-5f7f-9410-3efeef725f41"
+		id = "6ca65129-e203-54f4-be08-f1eb3b9d2147"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L182-L195"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8271722c3b8f4458d20cf874d37e87e3b1fde701205ff54f0360fb87f717fc3f"
+		logic_hash = "v1_sha256_8271722c3b8f4458d20cf874d37e87e3b1fde701205ff54f0360fb87f717fc3f"
 		score = 50
 		quality = 69
 		tags = "FILE"
@@ -242677,22 +241876,20 @@ rule DITEKSHEN_INDICATOR_TOOL_MEM_Mxtract : FILE
 		$s6 = "ERROR SCANNING MEMORY RANGE" fullword ascii
 
 	condition:
-		( uint32(0)==0x464c457f or uint16(0)==0x457f) and 3 of them
+		( uint32( 0 ) == 0x464c457f or uint16( 0 ) == 0x457f ) and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Sniffpass : FILE
 {
 	meta:
 		description = "Detects SniffPass, a password monitoring software that listens on the network and captures passwords over POP3, IMAP4, SMTP, FTP, and HTTP."
 		author = "ditekSHen"
-		id = "b96498d4-bbe3-5cb8-9c24-91ebb51e078a"
+		id = "4dac0beb-c211-5d82-a5f6-00382e1bdcaf"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L197-L212"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9b56ee4bac39b4220b24e92d00076650ffe84b71a60c0213a84fcf21c6cfe4cf"
+		logic_hash = "v1_sha256_9b56ee4bac39b4220b24e92d00076650ffe84b71a60c0213a84fcf21c6cfe4cf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242708,22 +241905,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Sniffpass : FILE
 		$s8 = "npptools.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Avbypass_Aviator : FILE
 {
 	meta:
 		description = "Detects AVIator, which is a backdoor generator utility, which uses cryptographic and injection techniques in order to bypass AV detection. This was observed to bypass Win.Trojan.AZorult. This rule works for binaries and memory."
 		author = "ditekSHen"
-		id = "2bddd64e-baca-58cb-ba52-27487cc4ded5"
+		id = "0b062338-1564-5757-a8a8-8cfb7edcddd9"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L214-L240"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1fb497eec2b0cd4051b5ddd53463f1da511c0a7b72d54a0bc68736a99fdc6143"
+		logic_hash = "v1_sha256_1fb497eec2b0cd4051b5ddd53463f1da511c0a7b72d54a0bc68736a99fdc6143"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242749,22 +241944,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Avbypass_Aviator : FILE
 		$pwsh8 = /ConstantsAndExtCalls\.(WriteProcessMemory\(|CreateRemoteThread\()/ ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and (3 of ($s*) or 2 of ($pwsh*))) or (3 of ($s*) or 2 of ($pwsh*))
+		( uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 2 of ( $pwsh* ) ) ) or ( 3 of ( $s* ) or 2 of ( $pwsh* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Pwdump7 : FILE
 {
 	meta:
 		description = "Detects Pwdump7 password Dumper"
 		author = "ditekSHen"
-		id = "dc6ff544-b9de-547b-9fa8-7d0b32e9592d"
+		id = "2d24d5b2-b31b-5721-942c-4554cd080fac"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L242-L254"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f84ab69ecc6837a826dc8726785165b8135edf51a47fb5bbaf19dc589b3032bd"
+		logic_hash = "v1_sha256_f84ab69ecc6837a826dc8726785165b8135edf51a47fb5bbaf19dc589b3032bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242777,22 +241970,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Pwdump7 : FILE
 		$s5 = "NO PASSWORD" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 4 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and 4 of them ) or ( all of them )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_LTM_Sharpexec : FILE
 {
 	meta:
 		description = "Detects SharpExec lateral movement tool"
 		author = "ditekSHen"
-		id = "4373a052-9525-5b24-81a4-65cd68afcb6c"
+		id = "551e4e54-3a93-56d7-abc8-c7128ba178c5"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L256-L275"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "17ae5c9f0b22e8ecbbbcbe052e466d00cb7b62cff423688b5138209c52f0698d"
+		logic_hash = "v1_sha256_17ae5c9f0b22e8ecbbbcbe052e466d00cb7b62cff423688b5138209c52f0698d"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -242812,22 +242003,20 @@ rule DITEKSHEN_INDICATOR_TOOL_LTM_Sharpexec : FILE
 		$s12 = "LOGON32_LOGON_NEW_CREDENTIALS" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 9 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and 9 of them ) or ( all of them )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PRV_Advancedrun : FILE
 {
 	meta:
 		description = "Detects NirSoft AdvancedRun privialge escalation tool"
 		author = "ditekSHen"
-		id = "c886951a-7ee9-5d38-a724-3dbba8c6ec31"
+		id = "2f291aec-5b25-5a4f-86a7-a5027fa0f81e"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L277-L289"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3f39e8f0629647f44a2f473d7b49a8b6adb1acd62de36420b80e7820e63854bb"
+		logic_hash = "v1_sha256_3f39e8f0629647f44a2f473d7b49a8b6adb1acd62de36420b80e7820e63854bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242840,22 +242029,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PRV_Advancedrun : FILE
 		$s5 = "\"Current User - Allow UAC Elevation$Current User - Without UAC Elevation#Administrator (Force UAC Elevation)" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Amady : FILE
 {
 	meta:
 		description = "Detects password stealer DLL. Dropped by Amadey"
 		author = "ditekSHen"
-		id = "6ee4e25b-bf38-5664-a08f-94e3fa92aa29"
+		id = "641e99a7-1d37-5b2a-8373-93e4bbebd204"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L291-L306"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "409374bec5f58abeb7741b41f0fc7ea1c3fdc7bbc3f0c0628db0e3aac82836d1"
+		logic_hash = "v1_sha256_409374bec5f58abeb7741b41f0fc7ea1c3fdc7bbc3f0c0628db0e3aac82836d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242871,22 +242058,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Amady : FILE
 		$s8 = "cred.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 7 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_SCR_Amady : FILE
 {
 	meta:
 		description = "Detects screenshot stealer DLL. Dropped by Amadey"
 		author = "ditekSHen"
-		id = "f7660899-ed12-5765-a856-6a1c7bbd8978"
+		id = "e951992f-9847-5db3-9242-cf8873014283"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L308-L320"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9e7ab39976e3219f0c6c3ce5341442343cc4baf30757cd1c9d0c2d3845fdda2f"
+		logic_hash = "v1_sha256_9e7ab39976e3219f0c6c3ce5341442343cc4baf30757cd1c9d0c2d3845fdda2f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242899,22 +242084,20 @@ rule DITEKSHEN_INDICATOR_TOOL_SCR_Amady : FILE
 		$s5 = "scr.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_EXP_Eternalblue : FILE
 {
 	meta:
 		description = "Detects Windows executables containing EternalBlue explitation artifacts"
 		author = "ditekSHen"
-		id = "08173a1e-2e32-5add-864a-d92ffa0a3e44"
+		id = "838651ac-0e75-5be2-b313-d7341a740b3d"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L322-L342"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "63e56637118accb8c32c20e52465c027df2dbf83b3b663d316b453ce879572c8"
+		logic_hash = "v1_sha256_63e56637118accb8c32c20e52465c027df2dbf83b3b663d316b453ce879572c8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242933,22 +242116,20 @@ rule DITEKSHEN_INDICATOR_TOOL_EXP_Eternalblue : FILE
 		$cm3 = "--DaveProxyPort=0 --NetworkTimeout 30 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($ci*)) or (2 of ($dp*)) or (1 of ($dp*) and 1 of ($ci*)) or (1 of ($cm*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $ci* ) ) or ( 2 of ( $dp* ) ) or ( 1 of ( $dp* ) and 1 of ( $ci* ) ) or ( 1 of ( $cm* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_EXP_Weblogic : FILE
 {
 	meta:
 		description = "Detects Windows executables containing Weblogic exploits commands"
 		author = "ditekSHen"
-		id = "e761a968-35cb-5284-99f2-6d516ad348e3"
+		id = "5c57ff57-9223-574e-9573-9e5d47b2f8ec"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L344-L353"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "01855f1125b0ba87dd40f7d460440dbda2d75c8b484e842a2b2e20c089b4ab5e"
+		logic_hash = "v1_sha256_01855f1125b0ba87dd40f7d460440dbda2d75c8b484e842a2b2e20c089b4ab5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242958,22 +242139,20 @@ rule DITEKSHEN_INDICATOR_TOOL_EXP_Weblogic : FILE
 		$s2 = "powershell (new-object System.Net.WebClient).DownloadFile('AAAAA','BBBBB')" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_SCN_Smbtouch : FILE
 {
 	meta:
 		description = "Detects SMBTouch scanner EternalBlue, EternalChampion, EternalRomance, EternalSynergy"
 		author = "ditekSHen"
-		id = "4e8176dd-4113-5fa8-a695-77e7169f6975"
+		id = "f5d6fb70-3a1e-5b8a-8595-39ebdf1cf719"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L376-L400"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "78c2a435762d3febe927eb15910d5a18c1ffe74604673463543d3c859f5ef8e9"
+		logic_hash = "v1_sha256_78c2a435762d3febe927eb15910d5a18c1ffe74604673463543d3c859f5ef8e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -242997,22 +242176,20 @@ rule DITEKSHEN_INDICATOR_TOOL_SCN_Smbtouch : FILE
 		$w8 = "UserRejected: " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or all of ($w*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or all of ( $w* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_SCN_Nbtscan : FILE
 {
 	meta:
 		description = "Detects NBTScan scanner for open NETBIOS nameservers on a local or remote TCP/IP network"
 		author = "ditekSHen"
-		id = "663c324e-4784-5efe-bbdf-60fa42e13944"
+		id = "09b7ac03-345e-5e15-9500-1c08e1f9a808"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L402-L420"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a81b95ad60aac4d66586ae7dc61f6bcbe2b7185b66b2bb895f45abff3ad3f430"
+		logic_hash = "v1_sha256_a81b95ad60aac4d66586ae7dc61f6bcbe2b7185b66b2bb895f45abff3ad3f430"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243031,22 +242208,20 @@ rule DITEKSHEN_INDICATOR_TOOL_SCN_Nbtscan : FILE
 		$s11 = "lookup_hostname.c" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 10 of ($s*)
+		uint16( 0 ) == 0x5a4d and 10 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_ENC_Bestcrypt : FILE
 {
 	meta:
 		description = "Detects BestEncrypt commercial disk encryption and wiping software"
 		author = "ditekSHen"
-		id = "30c3c17c-c951-5b14-80ba-eec7b2195985"
+		id = "b6fefcd3-556f-5528-82c2-31ad39605c83"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L442-L453"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "77d338c6f3e4b733cb31eb1ae05e4ce8631812f7161bc70074a3fe1dee9df770"
+		logic_hash = "v1_sha256_77d338c6f3e4b733cb31eb1ae05e4ce8631812f7161bc70074a3fe1dee9df770"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -243058,22 +242233,20 @@ rule DITEKSHEN_INDICATOR_TOOL_ENC_Bestcrypt : FILE
 		$s4 = "%c:\\EFI\\Jetico\\" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_CNC_Earthworm : FILE
 {
 	meta:
 		description = "Detects Earthworm C&C Windows/macOS tool"
 		author = "ditekSHen"
-		id = "4a6edcf3-b3c4-5620-8eac-102b1ce425f8"
+		id = "dabd1a39-5ddb-583e-b38d-672f124394e4"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L455-L471"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5045faaaa9e60d4bd506240d51ff78dad4e89ccee0e824e7e5c309a8d3ae2883"
+		logic_hash = "v1_sha256_5045faaaa9e60d4bd506240d51ff78dad4e89ccee0e824e7e5c309a8d3ae2883"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -243090,22 +242263,20 @@ rule DITEKSHEN_INDICATOR_TOOL_CNC_Earthworm : FILE
 		$url = "http://rootkiter.com/EarthWrom/" nocase fullword ascii
 
 	condition:
-		( uint16(0)==0xfacf or uint16(0)==0x5a4d) and (5 of ($s*) or $url)
+		( uint16( 0 ) == 0xfacf or uint16( 0 ) == 0x5a4d ) and ( 5 of ( $s* ) or $url )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Keychaindumper : FILE
 {
 	meta:
 		description = "Detects macOS certificate/password keychain dumping tool"
 		author = "ditekSHen"
-		id = "cec094fa-c651-58a6-a306-f16d8603e536"
+		id = "3a6dcb9a-5c46-519d-8acb-f02ef7962ce1"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L473-L484"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f606bdd5dba2180ffc552c46373b52801a0bd65a538b381fb9f4240efc5bd458"
+		logic_hash = "v1_sha256_f606bdd5dba2180ffc552c46373b52801a0bd65a538b381fb9f4240efc5bd458"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -243117,22 +242288,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Keychaindumper : FILE
 		$s3 = "_dumpKeychainEntitlements" fullword ascii
 
 	condition:
-		( uint16(0)==0xfeca or uint16(0)==0xfacf) and all of them
+		( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf ) and all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PET_P0Wnedshell : FILE
 {
 	meta:
 		description = "Detects compiled executables of p0wnedShell post-exploitation toolkit"
 		author = "ditekSHen"
-		id = "7df8f9b4-48d3-5271-9d60-5dd4bfaed316"
+		id = "0661e07a-c0e8-5927-a438-6992850a7137"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L486-L512"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9745b69573bf695fdada122143fb1889a7b2025250b5fb1e8f1a86b3be6f27d3"
+		logic_hash = "v1_sha256_9745b69573bf695fdada122143fb1889a7b2025250b5fb1e8f1a86b3be6f27d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243159,22 +242328,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PET_P0Wnedshell : FILE
 		$k6 = "PatchEventLog" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or 7 of ($e*) or all of ($k*) or (2 of ($s*) and 2 of ($e*) and 2 of ($k*)))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 7 of ( $e* ) or all of ( $k* ) or ( 2 of ( $s* ) and 2 of ( $e* ) and 2 of ( $k* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Rubeus : FILE
 {
 	meta:
 		description = "Detects Rubeus kerberos defensive/offensive toolset"
 		author = "ditekSHen"
-		id = "5af8cee0-e664-5dfe-9932-0e74ed41b6b4"
+		id = "6d9ba40b-ef91-5535-9a9c-cdae4f48050e"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L514-L531"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ee817d23427970d7e77f9ce2a7cbc25c77177d81354fed83e7551cdcbc2d7cd2"
+		logic_hash = "v1_sha256_ee817d23427970d7e77f9ce2a7cbc25c77177d81354fed83e7551cdcbc2d7cd2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243192,22 +242359,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Rubeus : FILE
 		$s10 = "WriteUserPasswordToFile" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_RTK_Hiddenrootkit : FILE
 {
 	meta:
 		description = "Detects the Hidden public rootkit"
 		author = "ditekSHen"
-		id = "c9e9d160-224f-505f-a135-56a9793f99c2"
+		id = "76c3213d-0bd8-56e7-8f2b-9527a41feeb3"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L533-L554"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "20180fc040c1b988b17b1ca9b61a7dab5180df4961a00f0afcb03e2cbe99b28f"
+		logic_hash = "v1_sha256_20180fc040c1b988b17b1ca9b61a7dab5180df4961a00f0afcb03e2cbe99b28f"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -243229,22 +242394,20 @@ rule DITEKSHEN_INDICATOR_TOOL_RTK_Hiddenrootkit : FILE
 		$s6 = "\\hidden-master\\Debug\\QAssist.pdb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($h*) or 5 of ($s*) or (2 of ($s*) and 2 of ($h*)))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $h* ) or 5 of ( $s* ) or ( 2 of ( $s* ) and 2 of ( $h* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PET_Sharphound : FILE
 {
 	meta:
 		description = "Detects BloodHound"
 		author = "ditekSHen"
-		id = "d8f44e15-3e7c-5e5d-9d74-30c61e679fcb"
+		id = "ed10375c-ef66-5256-ae3d-d0bd987dc50b"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L556-L573"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bdf10d0aabd6c41e8dd1f87c0fa141f300d785146d059fcd301ec35f65fbe990"
+		logic_hash = "v1_sha256_bdf10d0aabd6c41e8dd1f87c0fa141f300d785146d059fcd301ec35f65fbe990"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -243262,22 +242425,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PET_Sharphound : FILE
 		$s8 = "a517a8de-5834-411d-abda-2d0e1766539c" fullword ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($id*) or 6 of ($s*) or (1 of ($id*) and 4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $id* ) or 6 of ( $s* ) or ( 1 of ( $id* ) and 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_UAC_NSISUAC : FILE
 {
 	meta:
 		description = "Detects NSIS UAC plugin"
 		author = "ditekSHen"
-		id = "4a7c20f6-bf0e-55fb-a0b9-7b51e4af7cd3"
+		id = "c16729ff-bcf8-57de-af8b-ff1ba359fa1e"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L575-L587"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "48c0247c789328a0ff62816f5d6ecac7a0f2a3fe2cb95d99c0e7d988147f7137"
+		logic_hash = "v1_sha256_48c0247c789328a0ff62816f5d6ecac7a0f2a3fe2cb95d99c0e7d988147f7137"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243290,22 +242451,20 @@ rule DITEKSHEN_INDICATOR_TOOL_UAC_NSISUAC : FILE
 		$s5 = "UAC.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_REM_Intelliadmin : FILE
 {
 	meta:
 		description = "Detects commerical IntelliAdmin remote tool"
 		author = "ditekSHen"
-		id = "15385e0b-ead4-5614-a04e-55878eb70b34"
+		id = "0685307f-939c-5236-bafd-abbb3ebe347f"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L589-L602"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8b601d68eff65bc6cc2fb46630a7021e229764f9a80f6d3278ba3b9f55e5b114"
+		logic_hash = "v1_sha256_8b601d68eff65bc6cc2fb46630a7021e229764f9a80f6d3278ba3b9f55e5b114"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243319,22 +242478,20 @@ rule DITEKSHEN_INDICATOR_TOOL_REM_Intelliadmin : FILE
 		$s4 = "IntelliAdminRPC" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($pdb*) or 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $pdb* ) or 2 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpwmi : FILE
 {
 	meta:
 		description = "Detects SharpWMI"
 		author = "ditekSHen"
-		id = "9c58d9fa-04b8-5a9c-8ae9-ff2e7530772f"
+		id = "82eb666f-80e5-56ee-9707-42e6890822c5"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L604-L619"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e6c5764d0883e2882e06f07e4729362011a4d65614259b85978e1c6ef5cfadb7"
+		logic_hash = "v1_sha256_e6c5764d0883e2882e06f07e4729362011a4d65614259b85978e1c6ef5cfadb7"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -243350,22 +242507,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpwmi : FILE
 		$s8 = "scriptb64" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PET_Defendercontrol : FILE
 {
 	meta:
 		description = "Detects Defender Control"
 		author = "ditekSHen"
-		id = "7bc1f26e-2432-5642-b1e7-c87683f7d932"
+		id = "9c11f1e2-d7ba-5767-8a77-88e76d37f529"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L621-L631"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "826ed0643a07580750eb11c4cf2c2759f53b6c2bda51705476edc4808abccbf8"
+		logic_hash = "v1_sha256_826ed0643a07580750eb11c4cf2c2759f53b6c2bda51705476edc4808abccbf8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243376,22 +242531,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PET_Defendercontrol : FILE
 		$s3 = "dControl" wide
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PET_Mulit_Venomagent : FILE
 {
 	meta:
 		description = "Detects Venom Proxy Agent"
 		author = "ditekSHen"
-		id = "598bc773-cbe9-503b-ba3e-27c2cde8910d"
+		id = "25c24d65-0587-5c91-b813-fccb247ef710"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L633-L645"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5eda23a237404a44dc9eb057adbf6106166374168eb08e55c182da5c05ecb4f1"
+		logic_hash = "v1_sha256_5eda23a237404a44dc9eb057adbf6106166374168eb08e55c182da5c05ecb4f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243404,22 +242557,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PET_Mulit_Venomagent : FILE
 		$s5 = "golang.org/x/crypto/ssh.(*handshakeTransport).readPacket"
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and 3 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_HFS_Webserver : FILE
 {
 	meta:
 		description = "Detects HFS Web Server"
 		author = "ditekSHen"
-		id = "2c9d9a38-8a6c-5c53-84bc-4eef77933172"
+		id = "2164532d-1860-5b21-ae79-161c2055ff38"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L647-L658"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f5b8947e3858466dae5f476790842500f8184c4676d8c0c4870adb7fd3206652"
+		logic_hash = "v1_sha256_f5b8947e3858466dae5f476790842500f8184c4676d8c0c4870adb7fd3206652"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243431,22 +242582,20 @@ rule DITEKSHEN_INDICATOR_TOOL_HFS_Webserver : FILE
 		$s4 = "Server: HFS" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PROX_Lanproxy : FILE
 {
 	meta:
 		description = "Detects lanproxy-go-client"
 		author = "ditekSHen"
-		id = "71fc23d9-9aae-5666-832b-90cf5a86c474"
+		id = "9805da55-7a07-5ea8-9b3f-00db42619660"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L660-L675"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "13a5aaea0fb522e3badb4a60d2db8d7dd46e5721bd6dc2e2b2e29d49e197c375"
+		logic_hash = "v1_sha256_13a5aaea0fb522e3badb4a60d2db8d7dd46e5721bd6dc2e2b2e29d49e197c375"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243462,22 +242611,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PROX_Lanproxy : FILE
 		$s8 = ".WithDeadline(.in-addr.arpa." ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 6 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PET_Peirates : FILE
 {
 	meta:
 		description = "Detects Kubernetes penetration tool Peirates"
 		author = "ditekSHen"
-		id = "74ce83ed-0d93-5cb0-97e8-6885ae83b336"
+		id = "f2782cf4-b797-5872-a745-b5075f9254b6"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L677-L694"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "321f06af098283638f99d027dc3c95a25a72192a25c7afa5081a7dbff8c3acb7"
+		logic_hash = "v1_sha256_321f06af098283638f99d027dc3c95a25a72192a25c7afa5081a7dbff8c3acb7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243495,22 +242642,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PET_Peirates : FILE
 		$s10 = "name: attack-" ascii
 
 	condition:
-		uint16(0)==0x457f and 9 of them
+		uint16( 0 ) == 0x457f and 9 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PET_Botb : FILE
 {
 	meta:
 		description = "Detects Break out the Box (BOtB)"
 		author = "ditekSHen"
-		id = "acafa6dd-51b9-5945-b1df-7763a97a424f"
+		id = "16aeb691-ac0d-5542-a6c3-ca0280901f33"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L696-L710"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a01f796b27852f9217d9bfea32f8d9ffb3c88521d4413f6612f7a0544cf44fb3"
+		logic_hash = "v1_sha256_a01f796b27852f9217d9bfea32f8d9ffb3c88521d4413f6612f7a0544cf44fb3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243525,22 +242670,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PET_Botb : FILE
 		$s7 = "http: request too largehttp://100.100.100.200/http://169.254.169.254/index out of range" ascii
 
 	condition:
-		uint16(0)==0x457f and 6 of them
+		uint16( 0 ) == 0x457f and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_LSASS_Createminidump : FILE
 {
 	meta:
 		description = "Detects CreateMiniDump tool"
 		author = "ditekSHen"
-		id = "0d8642d1-2ed9-5270-a54a-6ba788026f5f"
+		id = "9be8d928-1892-5e09-9aab-e27a9ec97aa9"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L712-L724"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "577ccc783554363c0bed80d9642e8a0f107fc2ec66d84f76b9556aa3506c86c0"
+		logic_hash = "v1_sha256_577ccc783554363c0bed80d9642e8a0f107fc2ec66d84f76b9556aa3506c86c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243553,22 +242696,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_LSASS_Createminidump : FILE
 		$s5 = "MiniDumpWriteDump" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Browserpassworddumper : FILE
 {
 	meta:
 		description = "Detects SecurityXploded Browser Password Dumper tool"
 		author = "ditekSHen"
-		id = "ce90ef96-43c0-5d68-ba7d-21aafb3f754b"
+		id = "ffa524ca-a353-5571-a0b4-3b38e8d977f4"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L726-L737"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b3c6e9b393c244c7bf6489f54ebd622a09da050a65d6dbde325d5bcd7d85f39a"
+		logic_hash = "v1_sha256_b3c6e9b393c244c7bf6489f54ebd622a09da050a65d6dbde325d5bcd7d85f39a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243580,22 +242721,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Browserpassworddumper : FILE
 		$s4 = "%s Dumping secrets from login json file %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Ftppassworddumper : FILE
 {
 	meta:
 		description = "Detects SecurityXploded FTP Password Dumper tool"
 		author = "ditekSHen"
-		id = "d876c201-b527-531c-9563-0b1a1c6334cb"
+		id = "6513663f-2a9b-5024-8450-1f03a5448871"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L739-L750"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "941bfb9b1ce71252c5aa05bd654bdcf1af6cc1d5f720bc2c239e17454f15beda"
+		logic_hash = "v1_sha256_941bfb9b1ce71252c5aa05bd654bdcf1af6cc1d5f720bc2c239e17454f15beda"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243607,22 +242746,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Ftppassworddumper : FILE
 		$s4 = "FTP Password Dump" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Emailpassworddumper : FILE
 {
 	meta:
 		description = "Detects SecurityXploded Email Password Dumper tool"
 		author = "ditekSHen"
-		id = "25e140de-4a0a-5d4f-a93f-a414b9879f2b"
+		id = "1476a57a-7894-534c-aea8-a6e1f1d780bf"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L752-L764"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7f07611385d45bf45bfb8ee95e56febfb992fb7b416321c5b590878636a5c1b7"
+		logic_hash = "v1_sha256_7f07611385d45bf45bfb8ee95e56febfb992fb7b416321c5b590878636a5c1b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243635,22 +242772,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Emailpassworddumper : FILE
 		$s5 = "Email Password Dump" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpsphere : FILE
 {
 	meta:
 		description = "Detects SharpSphere red teamers tool to interact with the guest operating systems of virtual machines managed by vCenter"
 		author = "ditekSHen"
-		id = "878b5174-2368-5fc8-9573-7b2759cab409"
+		id = "938bb820-6723-56e2-882a-9c14cb72056c"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L766-L783"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "aae9355fcc7a6b5faf3807c85983032519550e936d5660c823d13731083be512"
+		logic_hash = "v1_sha256_aae9355fcc7a6b5faf3807c85983032519550e936d5660c823d13731083be512"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -243668,22 +242803,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpsphere : FILE
 		$s10 = "C:\\Users\\Public\\" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Exchangeexploit : FILE
 {
 	meta:
 		description = "Hunt for executables potentially embedding Exchange Server exploitation artificats"
 		author = "ditekSHen"
-		id = "429f738a-009a-5326-92e0-bdc907be96f2"
+		id = "d56b3da0-bf1b-5ad0-94dd-b13a9d0e20c3"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L785-L798"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4b0d22a296cab6591d63568aa44845ef7fcc413d45c368a712928411d11a8177"
+		logic_hash = "v1_sha256_4b0d22a296cab6591d63568aa44845ef7fcc413d45c368a712928411d11a8177"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -243697,22 +242830,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Exchangeexploit : FILE
 		$s6 = "https://%s/owa/auth/" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 5 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Goclr : FILE
 {
 	meta:
 		description = "Detects binaries utilizing Go-CLR for hosting the CLR in a Go process and using it to execute a DLL from disk or an assembly from memory"
 		author = "ditekSHen"
-		id = "21766cad-17dd-525a-9ebe-cd90e892cff1"
+		id = "d2b91baf-081e-5ae1-8d62-c60072830e46"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L800-L814"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a2a79793b1f530bcf9f79983f29a655f270cf0147606690b19eaeb82d4bd1f0d"
+		logic_hash = "v1_sha256_a2a79793b1f530bcf9f79983f29a655f270cf0147606690b19eaeb82d4bd1f0d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243727,22 +242858,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Goclr : FILE
 		$go = "Go build ID:" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) or (2 of ($c*) and $go)
+		uint16( 0 ) == 0x5a4d and all of ( $s* ) or ( 2 of ( $c* ) and $go )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Edgecookiesview : FILE
 {
 	meta:
 		description = "Detects EdgeCookiesView"
 		author = "ditekSHen"
-		id = "42c6eb2e-bf5c-5956-9009-c29551ce715d"
+		id = "d0ee8d8b-5ecb-5988-9a40-be9a70577618"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L833-L847"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9ba6d416e02c1958806356c67636609dcca758da9f7e3d1fc15244cc5ff038fc"
+		logic_hash = "v1_sha256_9ba6d416e02c1958806356c67636609dcca758da9f7e3d1fc15244cc5ff038fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243757,22 +242886,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Edgecookiesview : FILE
 		$pdb = "\\EdgeCookiesView\\Release\\EdgeCookiesView.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or (($pdb) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( ( $pdb ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Sharpnopsexec : FILE
 {
 	meta:
 		description = "Detects SharpNoPSExec"
 		author = "ditekSHen"
-		id = "10898364-6d77-5127-a16b-5fd3b1c652d5"
+		id = "b5803b16-37d4-5772-b5fd-64ced90fd10e"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L849-L864"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c1d76639e7b6464d302729b48bbcd810216132868035904bb9866e7b31ccfac2"
+		logic_hash = "v1_sha256_c1d76639e7b6464d302729b48bbcd810216132868035904bb9866e7b31ccfac2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243788,22 +242915,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Sharpnopsexec : FILE
 		$pdb2 = "SharpNoPSExec\\obj\\Release\\SharpNoPSExec.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( 1 of ( $pdb* ) and 1 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Chromecookiesview : FILE
 {
 	meta:
 		description = "Detects ChromeCookiesView"
 		author = "ditekSHen"
-		id = "c1b89468-edf2-59d1-89b3-5822fa19d6ab"
+		id = "22c929a2-932f-5f48-ba28-67eb42c00ff3"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L866-L880"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "81acd0978fc03525e7092ab51c681b61f9de0252066ce871298e2cd96b1d3024"
+		logic_hash = "v1_sha256_81acd0978fc03525e7092ab51c681b61f9de0252066ce871298e2cd96b1d3024"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243818,22 +242943,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Chromecookiesview : FILE
 		$pdb = "\\ChromeCookiesView\\Release\\ChromeCookiesView.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or (($pdb) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( ( $pdb ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Sliver : FILE
 {
 	meta:
 		description = "Detects Sliver implant cross-platform adversary emulation/red team"
 		author = "ditekSHen"
-		id = "e0c5404b-8e6b-5c3a-9e37-56012c3802dd"
+		id = "ffe8df76-c969-5bcf-bbbd-7ef873c69fc6"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L882-L900"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4f9442b74c84c7b4a8fcf93de2919d12efe2f41d0b4e8514b43822fba0962af2"
+		logic_hash = "v1_sha256_4f9442b74c84c7b4a8fcf93de2919d12efe2f41d0b4e8514b43822fba0962af2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243852,22 +242975,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Sliver : FILE
 		$s10 = ".TCPPivotReq" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and (1 of ($x*) or 5 of ($s*))
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( 1 of ( $x* ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Owlproxy : FILE
 {
 	meta:
 		description = "Hunt for OwlProxy"
 		author = "ditekSHen"
-		id = "86e2144e-c5d3-5bd6-b287-1157066126a3"
+		id = "747db016-a7aa-54c1-beb8-b88800e909fe"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L902-L921"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fa7dd5eeb9799fd651317ceecbed6c960f16c387dc18723409053e44cd281582"
+		logic_hash = "v1_sha256_fa7dd5eeb9799fd651317ceecbed6c960f16c387dc18723409053e44cd281582"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -243887,22 +243008,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Owlproxy : FILE
 		$iu3 = "%s://+:%d%spx/" wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of ($is*) or ( all of ($iu*) and 2 of ($is*))
+		uint16( 0 ) == 0x5a4d and 6 of ( $is* ) or ( all of ( $iu* ) and 2 of ( $is* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Backstab : FILE
 {
 	meta:
 		description = "Detect Backstab tool capable of killing antimalware protected processes by leveraging sysinternals Process Explorer (ProcExp) driver"
 		author = "ditekSHen"
-		id = "1e514d03-9b78-5e75-9a31-02c0413e23a7"
+		id = "3f2d5890-c14f-5256-8ea9-e8c2e9260f84"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L923-L939"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d25c3ff4d7c120fdf7c275d11da7a321bcbdb275dcfaa699b5bb4bd66167ec92"
+		logic_hash = "v1_sha256_d25c3ff4d7c120fdf7c275d11da7a321bcbdb275dcfaa699b5bb4bd66167ec92"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243919,22 +243038,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Backstab : FILE
 		$s9 = "backstab.exe -" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_EXP_Sharpprintnightmare : FILE
 {
 	meta:
 		description = "Detect SharpPrintNightmare"
 		author = "ditekSHen"
-		id = "15f52fce-27cc-52e7-91d5-7e2f6db5b596"
+		id = "028fdf5b-b000-507d-878c-0835818e43a9"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L941-L961"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "22c890a22ce6b7c1a06068018364f7c5a2afe1bee5b5bc6a8bae3703a11fac26"
+		logic_hash = "v1_sha256_22c890a22ce6b7c1a06068018364f7c5a2afe1bee5b5bc6a8bae3703a11fac26"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243955,22 +243072,20 @@ rule DITEKSHEN_INDICATOR_TOOL_EXP_Sharpprintnightmare : FILE
 		$s13 = "APD_COPY_" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_REC_Adfind : FILE
 {
 	meta:
 		description = "Detect ADFind"
 		author = "ditekSHen"
-		id = "2f0d02a1-7488-5645-aa08-1eadee2862e8"
+		id = "5988785a-aabd-5c6c-8645-fc431c12494b"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L963-L974"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "41fb9f72032f76adc6f1fccd25a1364f153eb2430063e9d582f3dcd9fc9ac84a"
+		logic_hash = "v1_sha256_41fb9f72032f76adc6f1fccd25a1364f153eb2430063e9d582f3dcd9fc9ac84a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -243982,22 +243097,20 @@ rule DITEKSHEN_INDICATOR_TOOL_REC_Adfind : FILE
 		$s4 = "joeware_default_adfind.cf" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_CNC_Chisel : FILE
 {
 	meta:
 		description = "Detect binaries using Chisel"
 		author = "ditekSHen"
-		id = "d126f2c8-655f-564f-ae46-f6bd6385dcac"
+		id = "6110b1ed-fc42-5835-a1a3-79b9d7ed2bc6"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L976-L990"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "08c7b2c4725431c1bf85ae8068f4250c98e58890e3b4c97aa9e419e4f487cada"
+		logic_hash = "v1_sha256_08c7b2c4725431c1bf85ae8068f4250c98e58890e3b4c97aa9e419e4f487cada"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244012,22 +243125,20 @@ rule DITEKSHEN_INDICATOR_TOOL_CNC_Chisel : FILE
 		$ws4 = "Sec-Websocket-Extensions" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($s*) and 3 of ($ws*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $s* ) and 3 of ( $ws* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_ANT_Sharpedrchecker : FILE
 {
 	meta:
 		description = "Detect SharpEDRChecke, C# Implementation of Invoke-EDRChecker"
 		author = "ditekSHen"
-		id = "c0b41787-b8b4-5aa7-b1f0-0a89dbebe45e"
+		id = "10ed763b-fb4c-5711-9064-69e21502e6d4"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L992-L1023"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "77a26ff5298dddebc669d9b6c39905a48a86884cf98adebdf935b94c62d36ddc"
+		logic_hash = "v1_sha256_77a26ff5298dddebc669d9b6c39905a48a86884cf98adebdf935b94c62d36ddc"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -244059,22 +243170,20 @@ rule DITEKSHEN_INDICATOR_TOOL_ANT_Sharpedrchecker : FILE
 		$s20 = "CheckRegistry" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 10 of ($s*) or (1 of ($pdb*) and (1 of ($x*) or 2 of ($s*))) or (#x3>4 and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 10 of ( $s* ) or ( 1 of ( $pdb* ) and ( 1 of ( $x* ) or 2 of ( $s* ) ) ) or ( #x3 > 4 and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_ANT_Invizzzible : FILE
 {
 	meta:
 		description = "Detect InviZzzible"
 		author = "ditekSHen"
-		id = "23533d1c-e0d8-51c8-ac18-60c845bff197"
+		id = "3f4be97a-77e8-5a09-a03a-2e31b3594784"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1025-L1059"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bd84015f9fdc160a6ed9010c5a5905fcf13987b1fdec6fdd9535e315dc3617e8"
+		logic_hash = "v1_sha256_bd84015f9fdc160a6ed9010c5a5905fcf13987b1fdec6fdd9535e315dc3617e8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -244109,22 +243218,20 @@ rule DITEKSHEN_INDICATOR_TOOL_ANT_Invizzzible : FILE
 		$f12 = ".?AVXen@SandboxEvasion@@" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or 4 of ($f*) or (2 of ($f*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 4 of ( $f* ) or ( 2 of ( $f* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_EXFIL_Sharpbox : FILE
 {
 	meta:
 		description = "Detect SharpBox, C# tool for compressing, encrypting, and exfiltrating data to Dropbox using the Dropbox API"
 		author = "ditekSHen"
-		id = "cd834fe2-dc77-509d-a8f9-d631f395bcd8"
+		id = "a6321e91-08b3-58f8-bdfe-d00416a3c177"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1061-L1080"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b03ab3786b2a2e6774d94be4edf700a7154d8d400c7b2b31c73c68ce9fe0c08a"
+		logic_hash = "v1_sha256_b03ab3786b2a2e6774d94be4edf700a7154d8d400c7b2b31c73c68ce9fe0c08a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244144,22 +243251,20 @@ rule DITEKSHEN_INDICATOR_TOOL_EXFIL_Sharpbox : FILE
 		$s13 = "X509Certificate [{0}] Policy Error: '{1}'" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_EXP_Serioussam01 : CVE_2021_36934 FILE
 {
 	meta:
 		description = "Detect tool variants potentially exploiting SeriousSAM / HiveNightmare CVE-2021-36934"
 		author = "ditekSHen"
-		id = "e8f24ae4-48fb-5ee7-9e8e-0d144bb3b046"
+		id = "6e10e47d-96e8-53dc-a025-9e2872b6e23a"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1082-L1104"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8b9de87dc073e6ba3eb36dd57b31e9749849c2e277f2bcd1c98ffc2d02861e10"
+		logic_hash = "v1_sha256_8b9de87dc073e6ba3eb36dd57b31e9749849c2e277f2bcd1c98ffc2d02861e10"
 		score = 75
 		quality = 25
 		tags = "CVE-2021-36934, FILE"
@@ -244182,22 +243287,20 @@ rule DITEKSHEN_INDICATOR_TOOL_EXP_Serioussam01 : CVE_2021_36934 FILE
 		$r3 = "[*] SECURITY" wide
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or ( all of ($r*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( all of ( $r* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_EXP_Petitpotam01 : FILE
 {
 	meta:
 		description = "Detect tool potentially exploiting/attempting PetitPotam"
 		author = "ditekSHen"
-		id = "12d7b533-f477-5fbb-8b1f-1a93c9a63500"
+		id = "1b8061c0-4996-5676-862e-aca80528ea15"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1127-L1143"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "37a9477b41560904e8874ecaf93eb2667b9450b5d42665677abc1442538f9000"
+		logic_hash = "v1_sha256_37a9477b41560904e8874ecaf93eb2667b9450b5d42665677abc1442538f9000"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -244214,22 +243317,20 @@ rule DITEKSHEN_INDICATOR_TOOL_EXP_Petitpotam01 : FILE
 		$r5 = "NdrClientCall2" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) and 4 of ($r*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) and 4 of ( $r* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpstrike : FILE
 {
 	meta:
 		description = "Detect SharpStrike post-exploitation tool written in C# that uses either CIM or WMI to query remote systems"
 		author = "ditekSHen"
-		id = "00b36fce-3d84-51cf-a800-042d7484d78c"
+		id = "0dd29874-e1c4-59e3-b294-fa855f9448b4"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1145-L1160"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c479d85878d9f9659fc157f0c6706703af3748a8740df6a5090cddc720dd7661"
+		logic_hash = "v1_sha256_c479d85878d9f9659fc157f0c6706703af3748a8740df6a5090cddc720dd7661"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244245,22 +243346,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpstrike : FILE
 		$s5 = "GetCommands" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladon : FILE
 {
 	meta:
 		description = "Detect Ladon tool that assists in lateral movement across a network"
 		author = "ditekSHen"
-		id = "227e63ce-8383-5bb1-870e-6c4e767b402f"
+		id = "1d8d8b27-4803-520c-9988-4c4e24347d5c"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1162-L1178"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f31276bcbcae672966cfddc9af4f5b507d7244360b421de7fe1e811fb954fb7d"
+		logic_hash = "v1_sha256_f31276bcbcae672966cfddc9af4f5b507d7244360b421de7fe1e811fb954fb7d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244277,22 +243376,20 @@ rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladon : FILE
 		$s7 = "kNumBitPriceShiftBits" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($d*) or all of ($s*) or (1 of ($d*) and 5 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $d* ) or all of ( $s* ) or ( 1 of ( $d* ) and 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladonexp : FILE
 {
 	meta:
 		description = "Detect Ladon tool that assists in lateral movement across a network"
 		author = "ditekSHen"
-		id = "bd1e7ef5-ae68-5e0d-8261-0eb765453bae"
+		id = "bf2f5178-29e1-57f0-a355-9c40fc5822f2"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1180-L1191"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "22f6a717b8464bddd850bb5ea8b416e99bceb91fe917f188be178f2fff620730"
+		logic_hash = "v1_sha256_22f6a717b8464bddd850bb5ea8b416e99bceb91fe917f188be178f2fff620730"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244304,22 +243401,20 @@ rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladonexp : FILE
 		$s4 = "namespace netscan" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladongo : FILE
 {
 	meta:
 		description = "Detect LadonGo tool that assists in lateral movement across a network"
 		author = "ditekSHen"
-		id = "4dbf7f24-b9ab-5629-8e78-667d9623dea9"
+		id = "5ec4a321-3627-5c71-a5d3-1bb69a1aab6d"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1193-L1207"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "606172b8fb251cb4ad75de40b55d74779aef6409832f6edf09068083143ec749"
+		logic_hash = "v1_sha256_606172b8fb251cb4ad75de40b55d74779aef6409832f6edf09068083143ec749"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244334,22 +243429,20 @@ rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladongo : FILE
 		$f7 = "main.LadonUrlScan" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xface) and 5 of ($f*)
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xface ) and 5 of ( $f* )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_ENC_Diskcryptor : FILE
 {
 	meta:
 		description = "Detect DiskCryptor open encryption solution that offers encryption of all disk partitions"
 		author = "ditekSHen"
-		id = "22b25d5c-d67f-53ac-9ae8-2de077afdda9"
+		id = "34b3cc48-c30e-51ca-a286-a177d2b2bb73"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1209-L1232"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7ef0bf3b11f7e4055908518ce5b6a49e04d7002ebc3396fd2da32b4e13cf68e0"
+		logic_hash = "v1_sha256_7ef0bf3b11f7e4055908518ce5b6a49e04d7002ebc3396fd2da32b4e13cf68e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244371,22 +243464,20 @@ rule DITEKSHEN_INDICATOR_TOOL_ENC_Diskcryptor : FILE
 		$d5 = "%s\\$dcsys$" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or 4 of ($s*) or 3 of ($d*))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or 4 of ( $s* ) or 3 of ( $d* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PRI_Installerfiletakeover : CVE_2021_41379 FILE
 {
 	meta:
 		description = "Detect InstallerFileTakeOver CVE-2021-41379"
 		author = "ditekSHen"
-		id = "8581a306-e6d3-5ac1-a778-76c6505ee174"
+		id = "4eece656-288c-535e-902e-dd1d81f242a0"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1234-L1253"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0a9e53138d33494d9b2aa0271b877e405ea2e8accba7c6eeac547caaa7a7c2ea"
+		logic_hash = "v1_sha256_0a9e53138d33494d9b2aa0271b877e405ea2e8accba7c6eeac547caaa7a7c2ea"
 		score = 75
 		quality = 50
 		tags = "CVE-2021-41379, FILE"
@@ -244406,22 +243497,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PRI_Installerfiletakeover : CVE_2021_41379 FILE
 		$o5 = { 66 89 7c 24 50 48 c7 c2 ff ff ff ff 48 ff c2 66 }
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (2 of ($s*) or 3 of ($o*))) or 4 of ($s*) or ( all of ($o*) and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 2 of ( $s* ) or 3 of ( $o* ) ) ) or 4 of ( $s* ) or ( all of ( $o* ) and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PRI_Juicypotato : FILE
 {
 	meta:
 		description = "Detect JuicyPotato"
 		author = "ditekSHen"
-		id = "2fb52598-9771-507b-a06d-7b9bc693ffee"
+		id = "93f00ce7-d3fe-50d0-be1d-bacdbeb45d80"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1255-L1270"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "43a7ac16b9633fd2e6c43ca142cd0d0e2166287bb51e1b6344119959fe054c19"
+		logic_hash = "v1_sha256_43a7ac16b9633fd2e6c43ca142cd0d0e2166287bb51e1b6344119959fe054c19"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244437,22 +243526,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PRI_Juicypotato : FILE
 		$s6 = "Priv Adjust FALSE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or (5 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or ( 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_ENUM_Sharpshares : FILE
 {
 	meta:
 		description = "Detects SharpShares multithreaded C# .NET Assembly to enumerate accessible network shares in a domain"
 		author = "ditekSHen"
-		id = "1da53e34-21a3-5b3c-885e-dcc8814ac3c8"
+		id = "d89b682a-003b-5199-990b-19f7a3307cd2"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1290-L1305"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8b35d6a692814e1b27ffc1db4ab124bf621c156aaf57f24796c422ec95a85715"
+		logic_hash = "v1_sha256_8b35d6a692814e1b27ffc1db4ab124bf621c156aaf57f24796c422ec95a85715"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -244468,22 +243555,20 @@ rule DITEKSHEN_INDICATOR_TOOL_ENUM_Sharpshares : FILE
 		$s8 = "entriesread" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PROX_Revsocks : FILE
 {
 	meta:
 		description = "Detects revsocks Reverse socks5 tunneler with SSL/TLS and proxy support"
 		author = "ditekSHen"
-		id = "f85bc557-40ab-5533-8a89-a2de9bbc9ad9"
+		id = "7226254c-07a7-5a34-a2b8-633f878fe648"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1307-L1321"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4a8e68f25b7ba10b0eb9772ed4ba2b9c6566768f2b5a2859df8bac644d196bf3"
+		logic_hash = "v1_sha256_4a8e68f25b7ba10b0eb9772ed4ba2b9c6566768f2b5a2859df8bac644d196bf3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244498,22 +243583,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PROX_Revsocks : FILE
 		$s7 = "main.getPEMs" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 4 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_PWS_Azbelt : FILE
 {
 	meta:
 		description = "Detects azbelt for enumerating Azure related credentials primarily on AAD joined machines"
 		author = "ditekSHen"
-		id = "cf9268d2-1928-51e8-9643-ee0a5bada9fa"
+		id = "b9fd70d4-d4aa-5878-a07d-03b46c4fbf31"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1323-L1338"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "71cc2b3418ea5e285adafe03fa80bade67dc3e4073fe58d42bc6190860b48b43"
+		logic_hash = "v1_sha256_71cc2b3418ea5e285adafe03fa80bade67dc3e4073fe58d42bc6190860b48b43"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244529,22 +243612,20 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Azbelt : FILE
 		$s8 = "@http://169.254.169.254/metadata/instance?api-version=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Dontsleep : FILE
 {
 	meta:
 		description = "Detects Keep Host Unlocked (Don't Sleep)"
 		author = "ditekShen"
-		id = "f71bd0d5-a526-5f1e-8bd3-9e653db610a7"
+		id = "8e0066b8-947b-5fa4-853a-68d1b2fec1bc"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1340-L1354"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b8e2132d3b36c3e2d2662a586916c7e4fc029f81af08b5c18006833c4e6f772f"
+		logic_hash = "v1_sha256_b8e2132d3b36c3e2d2662a586916c7e4fc029f81af08b5c18006833c4e6f772f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244559,22 +243640,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Dontsleep : FILE
 		$s7 = "BlockbyExecutionState: %d on:%d by_enable:%d" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Nsudo : FILE
 {
 	meta:
 		description = "Detects NSudo allowing to run processes as TrustedInstaller or System"
 		author = "ditekShen"
-		id = "9a21b923-b02e-553b-8f53-026d7034c319"
+		id = "21151857-e0b6-5f32-ae56-2cef8738d39a"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1356-L1369"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6bcffa79ca06b0b4178d6ea256f98d917c2b19cec0b059889b8d015d226a53f9"
+		logic_hash = "v1_sha256_6bcffa79ca06b0b4178d6ea256f98d917c2b19cec0b059889b8d015d226a53f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244588,22 +243667,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Nsudo : FILE
 		$s3 = "NSudo.RunAs." ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 2 of ($s*)) or all of ($s*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) or all of ( $s* ) or 4 of them )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Ligolo : FILE
 {
 	meta:
 		description = "Detects Ligolo tool for establishing SOCKS5 or TCP tunnels from a reverse connection"
 		author = "ditekSHen"
-		id = "cc461fd1-9a2f-59ce-af74-a0f55b8850b1"
+		id = "79ae2f07-529a-5496-9b13-59fa6edd698c"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1371-L1385"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b515dc184013c2f67d37e42d7172e2471b3a93c94024be12c7f587296287282d"
+		logic_hash = "v1_sha256_b515dc184013c2f67d37e42d7172e2471b3a93c94024be12c7f587296287282d"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -244618,22 +243695,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Ligolo : FILE
 		$s5 = "main.verifyTlsCertificate" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and (( all of ($p*) and 1 of ($s*)) or all of ($s*) or (1 of ($p*) and 4 of ($s*)))
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( ( all of ( $p* ) and 1 of ( $s* ) ) or all of ( $s* ) or ( 1 of ( $p* ) and 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Extpassword : FILE
 {
 	meta:
 		description = "Detects ExtPassword External Drive Password Recovery"
 		author = "ditekSHen"
-		id = "bb06d2c1-964d-5a3d-a741-09b8ef5ac7fa"
+		id = "6ea3f284-42cb-524c-a1e8-3e7a8e9fa5fc"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1387-L1403"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "525530cb7e9f44be0408fd710306f90056b1b6b9a9e4779d8c1eb1ddef443fb0"
+		logic_hash = "v1_sha256_525530cb7e9f44be0408fd710306f90056b1b6b9a9e4779d8c1eb1ddef443fb0"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -244650,22 +243725,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Extpassword : FILE
 		$s9 = "password#Ck" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) and 3 of ($s*)) or 6 of ($s*)
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) and 3 of ( $s* ) ) or 6 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Ngrok : FILE
 {
 	meta:
 		description = "Detects Ngrok"
 		author = "ditekSHen"
-		id = "fc0a0de8-b68b-5b6b-a222-bbc031ebabd3"
+		id = "5042f714-3e8b-5129-8cc9-2c474da8a8c0"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1405-L1418"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f4bba142652aaf77e5b7c123b743cf165ae17210c39cf65b7311f7e7bd91f7e1"
+		logic_hash = "v1_sha256_f4bba142652aaf77e5b7c123b743cf165ae17210c39cf65b7311f7e7bd91f7e1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244679,22 +243752,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Ngrok : FILE
 		$s6 = "/{{ .ID }}/tunnel_sessions/{{ .ID }}/restart" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and (3 of them )
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( 3 of them )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Sqlrecon : FILE
 {
 	meta:
 		description = "Detects SQLRecon C# MS-SQL toolkit designed for offensive reconnaissance and post-exploitation"
 		author = "ditekSHen"
-		id = "ec91285b-690d-5fd3-b0fc-f8d72cbb7e15"
+		id = "8c318fc6-a447-599d-97df-708046316426"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1420-L1436"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "784dbc518cf9492557c9b3536256c4a9b03e4536cf7cee7e764b8009dd4686bb"
+		logic_hash = "v1_sha256_784dbc518cf9492557c9b3536256c4a9b03e4536cf7cee7e764b8009dd4686bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244711,22 +243782,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Sqlrecon : FILE
 		$s9 = "(&(sAMAccountType=805306368)(servicePrincipalName=MSSQL*))" wide
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Atlasreaper : FILE
 {
 	meta:
 		description = "Detects AtlasReaper command-line tool for Confluence and Jira reconnaissance, credential farming and social engineering"
 		author = "ditekSHen"
-		id = "a0b4e134-bb05-5cc3-af71-516a0407aa1b"
+		id = "635a44da-f6b9-5b05-af93-c2ccc62ed470"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1438-L1453"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4a0436d5c3f1609d23b2b919bebdc56a7fd63e81b99e72dcda1022487cb88240"
+		logic_hash = "v1_sha256_4a0436d5c3f1609d23b2b919bebdc56a7fd63e81b99e72dcda1022487cb88240"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -244742,22 +243811,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Atlasreaper : FILE
 		$s8 = /AtlasReaper\.(Jira|Confluence)/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Ngroksharp : FILE
 {
 	meta:
 		description = "Detects NgrokSharp .NET library for Ngrok"
 		author = "ditekSHen"
-		id = "7c335021-4afd-5878-83c3-9bb2c81f3586"
+		id = "f55aaffd-a369-5526-ad3c-87a39a6c88f0"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1455-L1471"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c60637177114d369af9c3e96689811845ce1c1dfde8f7f971c4de21439564b4b"
+		logic_hash = "v1_sha256_c60637177114d369af9c3e96689811845ce1c1dfde8f7f971c4de21439564b4b"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -244774,22 +243841,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Ngroksharp : FILE
 		$s7 = "_ngrokDownloadUrl" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 4 of ($*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or 4 of ( $* ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Ngrokgo : FILE
 {
 	meta:
 		description = "Detects Go implementation variant for Ngrok"
 		author = "ditekSHen"
-		id = "b11f67c5-846d-57b2-8edc-521b2dc77503"
+		id = "c4e9695d-9a7d-5b95-bcaf-232f4ef5daa4"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1473-L1488"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4ec151661e3af922aba202c68392a2af17e2c4ed25a71a0b5aacc13fbfcc5c53"
+		logic_hash = "v1_sha256_4ec151661e3af922aba202c68392a2af17e2c4ed25a71a0b5aacc13fbfcc5c53"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244805,22 +243870,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Ngrokgo : FILE
 		$s8 = "github.com/nikolay-ngrok/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_Tool_Forensia : FILE
 {
 	meta:
 		description = "Detects Forensia anti-forensics tool used for erasing footprints"
 		author = "ditekSHen"
-		id = "bcd05c2e-7ddd-5ce7-a6a7-0659bed38744"
+		id = "03732cfb-31dd-5acd-9ea2-b36a0500d3cb"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1490-L1523"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7147eee62df10cd8a6c00ec80c4d1bdb8234a181dd6af81d0580d847f05bd0b6"
+		logic_hash = "v1_sha256_7147eee62df10cd8a6c00ec80c4d1bdb8234a181dd6af81d0580d847f05bd0b6"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -244854,22 +243917,20 @@ rule DITEKSHEN_INDICATOR_Tool_Forensia : FILE
                 db 6d b6 }
 
 	condition:
-		uint16(0)==0x5a4d and ((4 of ($c*) and 2 of ($r*)) or (4 of ($r*) and 2 of ($c*)) or 6 of ($s*) or (3 of ($s*) and 2 of ($r*) and 1 of ($c*)))
+		uint16( 0 ) == 0x5a4d and ( ( 4 of ( $c* ) and 2 of ( $r* ) ) or ( 4 of ( $r* ) and 2 of ( $c* ) ) or 6 of ( $s* ) or ( 3 of ( $s* ) and 2 of ( $r* ) and 1 of ( $c* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Dogzproxy : FILE
 {
 	meta:
 		description = "Detects Dogz proxy tool"
 		author = "ditekSHen"
-		id = "de2a8d26-0e8e-5999-baca-1e43933af866"
+		id = "25dd0f2c-5fab-5e90-9366-55389e5ae6f0"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1525-L1537"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "575cfed9cb7979216fd8fd2a05efe5dfece3a9120b4f185c015918337829ed63"
+		logic_hash = "v1_sha256_575cfed9cb7979216fd8fd2a05efe5dfece3a9120b4f185c015918337829ed63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244882,22 +243943,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Dogzproxy : FILE
 		$s5 = "dogz " ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Fastreverseproxy : FILE
 {
 	meta:
 		description = "Detects Fast Reverse Proxy (FRP) tool"
 		author = "ditekSHen"
-		id = "d643cc38-a96c-5353-bb46-ca46ea740e3b"
+		id = "9ec552a3-2cb7-5013-afbb-aba9969b1b2c"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1539-L1555"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c26d9e8833c7055a03a446eb983c7f70f1f18669d009ebc204dda3f0bb6048f7"
+		logic_hash = "v1_sha256_c26d9e8833c7055a03a446eb983c7f70f1f18669d009ebc204dda3f0bb6048f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244914,22 +243973,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Fastreverseproxy : FILE
 		$s7 = "frpc sudp visitor proxy is close" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 4 of ($s*)) or ( all of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( all of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Gogoscan : FILE
 {
 	meta:
 		description = "Detects GoGo scan tool"
 		author = "ditekSHen"
-		id = "c24ede04-2971-55f8-8b60-ec3bdca844d7"
+		id = "e178f7fd-0772-5e9b-87b3-15fb218d13a9"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1557-L1571"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c9fbc98a28c74bf920f5f7d62713834d18b33b5c65483a1bd42e4555764c8346"
+		logic_hash = "v1_sha256_c9fbc98a28c74bf920f5f7d62713834d18b33b5c65483a1bd42e4555764c8346"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244944,22 +244001,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Gogoscan : FILE
 		$s7 = "Starting task %s ,total ports: %d , mod: %s" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Gogoprocdump : FILE
 {
 	meta:
 		description = "Detects GoGo (lsass) process dump tool"
 		author = "ditekSHen"
-		id = "f92845c6-f8ae-50d0-97ea-cfa72051c2de"
+		id = "dad827b9-9c5f-5d14-b40b-83c1e7e037b4"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1573-L1586"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f410882e4c6c8b65e7d3c192cf94bf99d61cf54dc21d80cdf17193b34752c576"
+		logic_hash = "v1_sha256_f410882e4c6c8b65e7d3c192cf94bf99d61cf54dc21d80cdf17193b34752c576"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -244973,22 +244028,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Gogoprocdump : FILE
 		$s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\lsass.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Fscan : FILE
 {
 	meta:
 		description = "Detects GoGo scan tool"
 		author = "ditekSHen"
-		id = "3bf73853-15c1-54f7-866a-6a7632e39f19"
+		id = "5d38c2c6-b2d2-5c3d-8d28-6cdac15af096"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1588-L1602"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b107eb767454c4c084a7237c107c8414bdb03c324902769ac544c5903e346e17"
+		logic_hash = "v1_sha256_b107eb767454c4c084a7237c107c8414bdb03c324902769ac544c5903e346e17"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245003,22 +244056,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Fscan : FILE
 		$s7 = "rules:" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_BURTNCIGAR : FILE
 {
 	meta:
 		description = "Detects BURNTCIGAR a utility which terminates processes associated with endpoint security software"
 		author = "ditekSHen"
-		id = "b5260d7e-07ac-5633-b450-e2124cbba65b"
+		id = "4dbb2cc1-5abc-54a7-b284-0b8fa8fcd1f0"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1604-L1616"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4977332a0b20b300a5fc34f0f8d56221f55b66783853306d803e91701cb7e6ec"
+		logic_hash = "v1_sha256_4977332a0b20b300a5fc34f0f8d56221f55b66783853306d803e91701cb7e6ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245031,22 +244082,20 @@ rule DITEKSHEN_INDICATOR_TOOL_BURTNCIGAR : FILE
 		$s4 = "DeviceIoControl" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Pplblade : FILE
 {
 	meta:
 		description = "Detects PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk"
 		author = "ditekSHen"
-		id = "60c9b036-51a0-5e08-83de-1f69f62245c3"
+		id = "c729531e-5fce-58fa-b47a-a3b51dfa2003"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1634-L1658"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "da21402b07fcd0358ba630e48ab35956cb7ed8c12836a339c85b2ee5e414543e"
+		logic_hash = "v1_sha256_da21402b07fcd0358ba630e48ab35956cb7ed8c12836a339c85b2ee5e414543e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245071,22 +244120,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Pplblade : FILE
 		$m11 = "main.miniDumpWriteDump" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and (1 of ($s*) or 3 of ($m*))) or ( all of ($s*) and 3 of ($m*)) or (7 of ($m*)))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or ( 1 of ( $x* ) and ( 1 of ( $s* ) or 3 of ( $m* ) ) ) or ( all of ( $s* ) and 3 of ( $m* ) ) or ( 7 of ( $m* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Sharpldap : FILE
 {
 	meta:
 		description = "Detects SharpLDAP tool written in C# that aims to do enumeration via LDAP queries"
 		author = "ditekSHen"
-		id = "597e578d-41f0-595e-b92c-0c3676d8b47a"
+		id = "6c623d22-d143-5c79-ba97-47ad9812a91a"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1660-L1675"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "da5db3f2907229dc68e3c6f3351361a4b1fb9fe8afc597c9dfe611f9725c6181"
+		logic_hash = "v1_sha256_da5db3f2907229dc68e3c6f3351361a4b1fb9fe8afc597c9dfe611f9725c6181"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245102,22 +244149,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Sharpldap : FILE
 		$s6 = "get_SamAccountName" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 4 of ($s*)) or (5 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Pandora : FILE
 {
 	meta:
 		description = "Detects Pandora tool to extract credentials from password managers"
 		author = "ditekSHen"
-		id = "3f71f24b-755f-5967-afbf-04a512bd0a19"
+		id = "e75d5578-3676-5546-8214-3cd33f6dc164"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1677-L1691"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dd5be3b99b62ec40c242225d9420b9ce299c4f348882b0380289309dfedbc1e8"
+		logic_hash = "v1_sha256_dd5be3b99b62ec40c242225d9420b9ce299c4f348882b0380289309dfedbc1e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245132,7 +244177,7 @@ rule DITEKSHEN_INDICATOR_TOOL_Pandora : FILE
 		$s7 = "\\pandora.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
 import "pe"
 
@@ -245141,13 +244186,13 @@ rule DITEKSHEN_INDICATOR_TOOL_Havoc : FILE
 	meta:
 		description = "Detects Havoc Demon"
 		author = "ditekSHen"
-		id = "71ad145c-4017-597a-837e-5d11ba64d7c0"
+		id = "8a5a1bd2-ca9c-5fd4-9ab4-c5d2cd6f55a6"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1693-L1710"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c5806deaa57590ebe1923608b9b085460e0edd024721e6e9d7073765a79bf22b"
+		logic_hash = "v1_sha256_c5806deaa57590ebe1923608b9b085460e0edd024721e6e9d7073765a79bf22b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245159,22 +244204,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Havoc : FILE
 		$s2 = "/funny_cat.gif" wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 3 of them or (pe.number_of_imports==0 and pe.number_of_exports==0 and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 3 of them or ( pe.number_of_imports == 0 and pe.number_of_exports == 0 and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOLS_Localpotato : FILE
 {
 	meta:
 		description = "Detects LocalPotato"
 		author = "ditekShen"
-		id = "65f8305b-b830-58e7-970b-da1df9a06e9b"
+		id = "21fe774d-dbb2-5775-9dba-f9531a4b30be"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1712-L1743"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "88fba16a6eec6d2c23331642041c6adfddddeb21ba8e74b6959bd48c90f73cbb"
+		logic_hash = "v1_sha256_88fba16a6eec6d2c23331642041c6adfddddeb21ba8e74b6959bd48c90f73cbb"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -245206,22 +244249,20 @@ rule DITEKSHEN_INDICATOR_TOOLS_Localpotato : FILE
 		$o6 = { 48 b9 ff ff ff ff ff ff 0f 00 48 8b c2 41 b8 0c }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 5 of ($s*)) or 8 of ($s*) or (4 of ($o*) and (1 of ($x*) or 5 of ($s*))))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) or 8 of ( $s* ) or ( 4 of ( $o* ) and ( 1 of ( $x* ) or 5 of ( $s* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOLS_Edrsandblast : FILE
 {
 	meta:
 		description = "Detects EDRSandBlast"
 		author = "ditekShen"
-		id = "85d6d82b-a30e-5c79-93e7-8a3bbbf4a403"
+		id = "5236e8cb-fdd6-5e36-b82c-c4dd29437497"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1745-L1767"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9b801f053e42fbd646cf62fecf6cbf5f2cceeec82bed93ecd8625984eccb08c6"
+		logic_hash = "v1_sha256_9b801f053e42fbd646cf62fecf6cbf5f2cceeec82bed93ecd8625984eccb08c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245244,22 +244285,20 @@ rule DITEKSHEN_INDICATOR_TOOLS_Edrsandblast : FILE
 		$o2 = { 74 48 8b 85 34 15 00 00 41 b9 04 01 00 00 4c 8d }
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOLS_Rsockstun : FILE
 {
 	meta:
 		description = "Detects rsockstun"
 		author = "ditekShen"
-		id = "a284a607-abea-5914-ad3a-84eaff733ee0"
+		id = "06504398-5aca-5a0c-bbf7-405c91313d72"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1769-L1781"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4ad0ac389bf8961b0dd987a72d5dd534e5e3cc673f0e07aa49d39d1fd3f5f53e"
+		logic_hash = "v1_sha256_4ad0ac389bf8961b0dd987a72d5dd534e5e3cc673f0e07aa49d39d1fd3f5f53e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245272,22 +244311,20 @@ rule DITEKSHEN_INDICATOR_TOOLS_Rsockstun : FILE
 		$s5 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and all of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Scmaldevinj_Go : FILE
 {
 	meta:
 		description = "Detects Go shell/malware dev injector"
 		author = "ditekShen"
-		id = "56ec114f-8e16-5ab6-ae3b-a182cb381b4a"
+		id = "7911ee72-c18c-5805-b992-b07d53eb9adc"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1783-L1793"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "48c3c759283c63a0c439cfba0194da89f402189e4c3cd831c22b5078ccae47b1"
+		logic_hash = "v1_sha256_48c3c759283c63a0c439cfba0194da89f402189e4c3cd831c22b5078ccae47b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245298,22 +244335,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Scmaldevinj_Go : FILE
 		$s3 = "Binject/debug/pe." ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Reversessh_Go : FILE
 {
 	meta:
 		description = "Detects golang reverse ssh tool"
 		author = "ditekShen"
-		id = "4fb671aa-ad42-5f7e-bd5a-c19f018088c9"
+		id = "b929cd95-7c6c-55d9-9f14-3f82fba67ea0"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1795-L1804"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4f9899aacc09c7da05fb5d412cfe8e91ee0d8e922189a6f921410d73ae8b3a9c"
+		logic_hash = "v1_sha256_4f9899aacc09c7da05fb5d412cfe8e91ee0d8e922189a6f921410d73ae8b3a9c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245323,22 +244358,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Reversessh_Go : FILE
 		$s2 = "main.rsshService" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Sharpghosttask : FILE
 {
 	meta:
 		description = "Detects SharpGhostTask"
 		author = "ditekSHen"
-		id = "84d71179-0cfd-5389-b6bd-92c292361b3c"
+		id = "1f957a3f-e1c8-57e9-9ef1-e9bf497ebcef"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1806-L1817"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3de8d9fe7804e208ff556b6bedbd80eebfda1a730626403418a555ad9fbbb820"
+		logic_hash = "v1_sha256_3de8d9fe7804e208ff556b6bedbd80eebfda1a730626403418a555ad9fbbb820"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245350,22 +244383,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Sharpghosttask : FILE
 		$s4 = "__GhostTask|" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Krbrelay : FILE
 {
 	meta:
 		description = "Detects KrbRelay"
 		author = "ditekshen"
-		id = "c8baac8a-54f3-5f53-93f8-daabeaaaff44"
+		id = "70cc7c1a-5754-57e2-b379-1199bf14c855"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1819-L1836"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f76b585cd2d741eab9d91ffd5a34c38696ac573cba1a3752d21c4b8b6681ad7b"
+		logic_hash = "v1_sha256_f76b585cd2d741eab9d91ffd5a34c38696ac573cba1a3752d21c4b8b6681ad7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245383,22 +244414,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Krbrelay : FILE
 		$g7 = "AuthnSvc: {0} - PrincName: {1}" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*) and 4 of ($g*)) or (7 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 4 of ( $g* ) ) or ( 7 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Edrsilencer : FILE
 {
 	meta:
 		description = "Detects EDRSilencer"
 		author = "ditekshen"
-		id = "29b6da1e-9138-5ee6-b9fd-d7b3c7f48626"
+		id = "80e0ab29-c9c7-5f68-84e9-c17dcd88cede"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1838-L1857"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "da00aced2608fd5e192397ef2346ac247f29f993995fb90189e05da60be15d13"
+		logic_hash = "v1_sha256_da00aced2608fd5e192397ef2346ac247f29f993995fb90189e05da60be15d13"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245418,22 +244447,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Edrsilencer : FILE
 		$v6 = "CylanceSvc.exe" fullword ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or (3 of ($s*) and 1 of ($v*)))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $v* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Edrprison : FILE
 {
 	meta:
 		description = "Detects EDRPrison"
 		author = "ditekshen"
-		id = "85831265-fd9e-5e0e-b5d9-22bf1c89b3f2"
+		id = "500f7d4e-4139-5afc-9914-92fb940018cb"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1859-L1872"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e1ef9e9c6bd0d2efa7b0b617fb52100075658221559f92a61c672807ab5a4d77"
+		logic_hash = "v1_sha256_e1ef9e9c6bd0d2efa7b0b617fb52100075658221559f92a61c672807ab5a4d77"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245447,22 +244474,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Edrprison : FILE
 		$s6 = "GetRmAddrPortNetwork" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Sharpsqlpwn : FILE
 {
 	meta:
 		description = "Detects SharpSQLPwn"
 		author = "ditekshen"
-		id = "f99c0ddb-a073-5c15-9a7c-60f6766cd0a2"
+		id = "7c6ace5b-03db-5a9f-aae2-fdda7ffb2c4e"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1874-L1891"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c811d4926c433c6521f4bbe03a1abf4a5b27b56931a18a8bb672f37fe4fccfb8"
+		logic_hash = "v1_sha256_c811d4926c433c6521f4bbe03a1abf4a5b27b56931a18a8bb672f37fe4fccfb8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245480,22 +244505,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Sharpsqlpwn : FILE
 		$s10 = "EXEC master..xp_dirtree \"\\\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_TOOL_Chromekatz : FILE
 {
 	meta:
 		description = "Detects ChromeKatz: CookieKatz and CredentialKatz"
 		author = "ditekshen"
-		id = "9dd706c8-552c-5c96-9b81-cfd50157ac34"
+		id = "0fd1862a-fb17-5423-9d67-74c806d114db"
 		date = "2024-09-25"
 		modified = "2024-09-25"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1893-L1908"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4f1bdbb7f8c4893444baac287c8fcefaca80a4301845706b56e9f9628c9f116f"
+		logic_hash = "v1_sha256_4f1bdbb7f8c4893444baac287c8fcefaca80a4301845706b56e9f9628c9f116f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245511,22 +244534,20 @@ rule DITEKSHEN_INDICATOR_TOOL_Chromekatz : FILE
 		$t2 = "szPasswordReuseDetectorInstances" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Laturo : FILE
 {
 	meta:
 		description = "Laturo information stealer payload"
 		author = "ditekSHen"
-		id = "221a1ee8-e1ae-558c-919c-e3f55c1500f0"
+		id = "7df7d1bf-c5ec-540d-a834-1a082468a4d4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3-L26"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bfb0c5676c926f58a4395a56dad09b37e8ac1cf0bf6b5521767c16698644b73a"
+		logic_hash = "v1_sha256_bfb0c5676c926f58a4395a56dad09b37e8ac1cf0bf6b5521767c16698644b73a"
 		score = 75
 		quality = 61
 		tags = "FILE"
@@ -245550,22 +244571,20 @@ rule DITEKSHEN_MALWARE_Win_Laturo : FILE
 		$data8 = "webcam.bmp" nocase ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 5 of ($str*) and 1 of ($data*)
+		uint16( 0 ) == 0x5a4d and 5 of ( $str* ) and 1 of ( $data* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Xpertrat : FILE
 {
 	meta:
 		description = "XpertRAT payload"
 		author = "ditekSHen"
-		id = "cea7de47-b47c-5fea-96ee-5858b16cca8d"
+		id = "fad23c2e-017f-5192-9464-8542d03b4014"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L28-L56"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2a521bd1d6ce16fa16aa7757db2657dcab15e6802454ad899906d4ed17401feb"
+		logic_hash = "v1_sha256_2a521bd1d6ce16fa16aa7757db2657dcab15e6802454ad899906d4ed17401feb"
 		score = 75
 		quality = 63
 		tags = "FILE"
@@ -245592,22 +244611,20 @@ rule DITEKSHEN_MALWARE_Win_Xpertrat : FILE
 		$s12 = "cZip_EndCompress" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($v*) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $v* ) or 6 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Isrstealer : FILE
 {
 	meta:
 		description = "ISRStealer payload"
 		author = "ditekSHen"
-		id = "d6c3acdd-e881-5f97-8856-b7b60f56a1c2"
+		id = "fe04ea8f-cd49-5b27-996d-65132d7bf537"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L112-L128"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5dd030ab8122b5dd432168647c7a3465cb3593a326f68b4863a91d16587641e5"
+		logic_hash = "v1_sha256_5dd030ab8122b5dd432168647c7a3465cb3593a326f68b4863a91d16587641e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245624,22 +244641,20 @@ rule DITEKSHEN_MALWARE_Win_Isrstealer : FILE
 		$s8 = "/scomma" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 6 of them ) or all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 6 of them ) or all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Limerat : FILE
 {
 	meta:
 		description = "LimeRAT payload"
 		author = "ditekSHen"
-		id = "a4b85cad-97a8-514c-9380-f3e8ec95a44d"
+		id = "011d78ee-c399-5a47-8ec0-7c4e62fc9732"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L152-L168"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8ae35c5fa48773b93da0b76b238fc8dbaf19fdeb6fd81bf23842c5121d620116"
+		logic_hash = "v1_sha256_8ae35c5fa48773b93da0b76b238fc8dbaf19fdeb6fd81bf23842c5121d620116"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245656,22 +244671,20 @@ rule DITEKSHEN_MALWARE_Win_Limerat : FILE
 		$s9 = "cmd.exe /c ping 0" wide
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Arkei : FILE
 {
 	meta:
 		description = "Detect Arkei infostealer variants"
 		author = "ditekSHen"
-		id = "d32a27bf-abb9-553c-9913-d675c340a5c5"
+		id = "bf411356-d4f1-5226-ac32-302412d1865f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L210-L226"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8a79bcc6ac94900c8a8913b2e81424bf900bbac416f44a91db6f208f23980155"
+		logic_hash = "v1_sha256_8a79bcc6ac94900c8a8913b2e81424bf900bbac416f44a91db6f208f23980155"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245688,22 +244701,20 @@ rule DITEKSHEN_MALWARE_Win_Arkei : FILE
 		$s9 = "files\\cookies_" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Firebirdrat : FILE
 {
 	meta:
 		description = "Firebird/Hive RAT payload"
 		author = "ditekSHen"
-		id = "456ae70e-8004-5fb0-a4fd-ce7c0f4704f9"
+		id = "890242e9-5c73-5d9e-928e-4055a5212ae1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L316-L339"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1c24e924171db1b99a3b03764f4551b6f4b6b1c9c6147b49dbc0651e85e9040c"
+		logic_hash = "v1_sha256_1c24e924171db1b99a3b03764f4551b6f4b6b1c9c6147b49dbc0651e85e9040c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -245727,22 +244738,20 @@ rule DITEKSHEN_MALWARE_Win_Firebirdrat : FILE
 		$s11 = "de4fuckyou" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($id*) or 7 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $id* ) or 7 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Phoenix : FILE
 {
 	meta:
 		description = "Phoenix/404KeyLogger keylogger payload"
 		author = "ditekSHen"
-		id = "62101881-9b5e-586d-8e1b-184787f25d6b"
+		id = "a8ba591a-fd1d-5ba8-b8e2-25e7981758db"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L341-L367"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b2c2a4ffc36d708a121853fb0268e6dc85b3fe2cd58e05c8124cbef18e03ec0b"
+		logic_hash = "v1_sha256_b2c2a4ffc36d708a121853fb0268e6dc85b3fe2cd58e05c8124cbef18e03ec0b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245768,22 +244777,20 @@ rule DITEKSHEN_MALWARE_Win_Phoenix : FILE
 		$m7 = "Logs |" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of ($s*) or 3 of ($m*)) or 9 of them
+		( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) or 3 of ( $m* ) ) or 9 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Backnet : FILE
 {
 	meta:
 		description = "BackNet payload"
 		author = "ditekSHen"
-		id = "c53ef72f-4957-5ddb-b096-dcdb69cf900d"
+		id = "30ec29cf-ad4e-50ed-9f61-8a890e1b3e43"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L369-L386"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c276f2b809caad680455fc4ca0a021887d4ff2c9114f05737542a1d3c5cca848"
+		logic_hash = "v1_sha256_c276f2b809caad680455fc4ca0a021887d4ff2c9114f05737542a1d3c5cca848"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245801,22 +244808,20 @@ rule DITEKSHEN_MALWARE_Win_Backnet : FILE
 		$pdb = "\\BackNet-master\\Slave\\obj\\Release\\Slave.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($pdb or all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( $pdb or all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Acridrain : FILE
 {
 	meta:
 		description = "AcidRain stealer payload"
 		author = "ditekSHen"
-		id = "9890c9e0-ce53-5f08-9077-c73a9e4ba29c"
+		id = "5ba582b8-9eca-56c7-a538-34bbe16fe94f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L388-L401"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "11884073f4bf466503b07f297ae7fad188f79df148fcc7ca48827c7dbd07e211"
+		logic_hash = "v1_sha256_11884073f4bf466503b07f297ae7fad188f79df148fcc7ca48827c7dbd07e211"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245830,22 +244835,20 @@ rule DITEKSHEN_MALWARE_Win_Acridrain : FILE
 		$s6 = "encryptedUsernamencryptedPassworERROR Don't copy string" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Chachaddos : FILE
 {
 	meta:
 		description = "ChaChaDDoS variant of XorDDoS payload"
 		author = "ditekSHen"
-		id = "78a5cf3a-0e84-59bd-a936-bd335647e3d0"
+		id = "8633d62d-cdad-51e0-b1b2-3aeef4d4ab87"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L403-L418"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2bf99771046650820f02a24d5bd825afeacd03d1e865b05d8563a3ef74d521fb"
+		logic_hash = "v1_sha256_2bf99771046650820f02a24d5bd825afeacd03d1e865b05d8563a3ef74d521fb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245861,22 +244864,20 @@ rule DITEKSHEN_MALWARE_Linux_Chachaddos : FILE
 		$x8 = "syn_probe" ascii
 
 	condition:
-		uint16(0)==0x457f and 6 of them
+		uint16( 0 ) == 0x457f and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Multi_Exaramel : FILE
 {
 	meta:
 		description = "Exaramel Windows/Linux backdoor payload"
 		author = "ditekSHen"
-		id = "014f10f3-4502-5719-93f6-4b2940f53876"
+		id = "991ebe6e-cebc-569c-9644-fe82d8e94069"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L420-L459"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e64383304bc913b07a2e63d61c81354b996c01171357005f4a28957d4d889599"
+		logic_hash = "v1_sha256_e64383304bc913b07a2e63d61c81354b996c01171357005f4a28957d4d889599"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -245914,22 +244915,20 @@ rule DITEKSHEN_MALWARE_Multi_Exaramel : FILE
 		$ws14 = "ReportDir" ascii
 
 	condition:
-		( uint16(0)==0x457f and ( all of ($s*) and 6 of ($cmd*))) or ( uint16(0)==0x5a4d and 12 of ($ws*))
+		( uint16( 0 ) == 0x457f and ( all of ( $s* ) and 6 of ( $cmd* ) ) ) or ( uint16( 0 ) == 0x5a4d and 12 of ( $ws* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Hiddenwasp : FILE
 {
 	meta:
 		description = "HiddenWasp backdoor payload"
 		author = "ditekSHen"
-		id = "220e5e6e-7c5c-5f70-b3eb-50d9c5ec636d"
+		id = "7d7f1350-79e5-5e2a-8d25-0c87fca0c8b2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L461-L486"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a2aad022de41ba2633fc92a7dc5a5fa2efde9da2211cfc01fb2999e33365d6c9"
+		logic_hash = "v1_sha256_a2aad022de41ba2633fc92a7dc5a5fa2efde9da2211cfc01fb2999e33365d6c9"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -245955,22 +244954,20 @@ rule DITEKSHEN_MALWARE_Linux_Hiddenwasp : FILE
 		$s10 = "hexdump -ve '1/1 \"%%.2X\"' %s | sed \"s/%s/%s/g\" | xxd -r -p > %s.tmp"
 
 	condition:
-		uint16(0)==0x457f and (4 of ($x*) or all of ($s*) or (3 of ($x*) and 5 of ($s*)))
+		uint16( 0 ) == 0x457f and ( 4 of ( $x* ) or all of ( $s* ) or ( 3 of ( $x* ) and 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Multi_Wellmess : FILE
 {
 	meta:
 		description = "WellMess Windows/Linux backdoor payload"
 		author = "ditekSHen"
-		id = "cfa0f077-9d45-5796-b888-66fb397e74f8"
+		id = "a82e4c84-f041-5e1d-9812-800ac25dffc6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L488-L510"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9cbbca609fd289d7406d9073237688d250dc68c450676b9b755509540d8f76a5"
+		logic_hash = "v1_sha256_9cbbca609fd289d7406d9073237688d250dc68c450676b9b755509540d8f76a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -245990,22 +244987,20 @@ rule DITEKSHEN_MALWARE_Multi_Wellmess : FILE
 		$s9 = "<autogenerated>" ascii wide
 
 	condition:
-		( uint16(0)==0x457f or uint16(0)==0x5a4d) and all of them
+		( uint16( 0 ) == 0x457f or uint16( 0 ) == 0x5a4d ) and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Konni : FILE
 {
 	meta:
 		description = "Konni payload"
 		author = "ditekSHen"
-		id = "86eae9f6-60b0-5720-8528-ddbe32b6d4a6"
+		id = "c2148d06-fa84-5d58-bcfd-b9829106fd0c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L512-L530"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d57c51f7ede28b74395e5e0fbcc5fd9247b3353330f3e549d5abf99bbd7a1b93"
+		logic_hash = "v1_sha256_d57c51f7ede28b74395e5e0fbcc5fd9247b3353330f3e549d5abf99bbd7a1b93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246024,22 +245019,20 @@ rule DITEKSHEN_MALWARE_Win_Konni : FILE
 		$pdb2 = "\\virus-init\\Release\\virus-init.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or (3 of ($s*) and 1 of ($pdb*)))
+		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $pdb* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bitterrat : FILE
 {
 	meta:
 		description = "BitterRAT payload"
 		author = "ditekSHen"
-		id = "cccb2102-b78a-59ce-98e6-c702c4bec4d4"
+		id = "e115492b-21de-526f-9c46-3bd86a0462d1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L532-L551"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f9dec388af6ddc767f82d7de7ba47754e76058022e6e55bbafd846ca8655a03b"
+		logic_hash = "v1_sha256_f9dec388af6ddc767f82d7de7ba47754e76058022e6e55bbafd846ca8655a03b"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -246059,22 +245052,20 @@ rule DITEKSHEN_MALWARE_Win_Bitterrat : FILE
 		$pdb2 = "\\Shellcode\\Release\\Shellcode.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($*) or (4 of ($s*) and 1 of ($pdb*)))
+		uint16( 0 ) == 0x5a4d and ( 7 of ( $* ) or ( 4 of ( $s* ) and 1 of ( $pdb* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Tjkeylogger : FILE
 {
 	meta:
 		description = "TJKeylogger payload"
 		author = "ditekSHen"
-		id = "6aaa11b2-3734-5538-b593-f5276f3acc72"
+		id = "1cdd86f1-0c46-5379-b2f4-88288792a336"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L553-L567"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "52d98a6f5a2cfc6717b7097b4e70c1e813851222f9f06ae74be4e5703b0b0dde"
+		logic_hash = "v1_sha256_52d98a6f5a2cfc6717b7097b4e70c1e813851222f9f06ae74be4e5703b0b0dde"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246089,22 +245080,20 @@ rule DITEKSHEN_MALWARE_Win_Tjkeylogger : FILE
 		$s7 = "KL_GETMODE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_W1RAT : FILE
 {
 	meta:
 		description = "W1 RAT payload"
 		author = "ditekSHen"
-		id = "d5841bc0-97e7-575e-91f6-d264f507a8b5"
+		id = "6bab5b1d-5778-5181-a169-b7d5b5c2ee5b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L569-L585"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "84b9a2e309ed9ab0fb8343d941585356d23348683073d0a37fc7194f58a43a0e"
+		logic_hash = "v1_sha256_84b9a2e309ed9ab0fb8343d941585356d23348683073d0a37fc7194f58a43a0e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246121,22 +245110,20 @@ rule DITEKSHEN_MALWARE_Win_W1RAT : FILE
 		$s9 = "Stdin   pipe   creation   failed" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of ($s*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( all of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Raccoon : FILE
 {
 	meta:
 		description = "Raccoon stealer payload"
 		author = "ditekSHen"
-		id = "5ebef663-623c-592e-b69a-f620492f0cc1"
+		id = "aa561e60-6462-516e-94d3-0df2576277db"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L587-L606"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "258481982d20d229506f442a5a205fdc05f6ac4399f3a0665860e6529c30943b"
+		logic_hash = "v1_sha256_258481982d20d229506f442a5a205fdc05f6ac4399f3a0665860e6529c30943b"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -246156,22 +245143,20 @@ rule DITEKSHEN_MALWARE_Win_Raccoon : FILE
 		$x4 = "Microsoft_WinInet_*" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((3 of ($x*) and 2 of ($s*)) or (4 of ($s*) and 1 of ($x*)))
+		uint16( 0 ) == 0x5a4d and ( ( 3 of ( $x* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) and 1 of ( $x* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Tefosteal : FILE
 {
 	meta:
 		description = "Tefosteal payload"
 		author = "ditekSHen"
-		id = "56646933-3ed3-5b77-9135-993b57603490"
+		id = "0e203279-8009-5d06-b2f9-099e7ef48dd0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L653-L674"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a350863270cbe3349f271e55d66a2ebdd6406e8d122c11071de74a774eb77ebf"
+		logic_hash = "v1_sha256_a350863270cbe3349f271e55d66a2ebdd6406e8d122c11071de74a774eb77ebf"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -246193,22 +245178,20 @@ rule DITEKSHEN_MALWARE_Win_Tefosteal : FILE
 		$f6 = "\\delete.vbs" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) and 2 of ($f*)
+		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) and 2 of ( $f* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cryptostealergo : FILE
 {
 	meta:
 		description = "CryptoStealerGo payload"
 		author = "ditekSHen"
-		id = "83886aeb-af7e-564c-989a-fb7d955814e2"
+		id = "e32a89c7-6f39-5143-9e73-dbf7bde89f91"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L676-L692"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0050be7522e7d89cb9688e63fdca11d24baa74aa858e8c19ee7b4658518536b6"
+		logic_hash = "v1_sha256_0050be7522e7d89cb9688e63fdca11d24baa74aa858e8c19ee7b4658518536b6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246225,22 +245208,20 @@ rule DITEKSHEN_MALWARE_Win_Cryptostealergo : FILE
 		$s9 = "XFxBcHBEYXRhXFxMb2NhbFxc" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_M00Nd3V : FILE
 {
 	meta:
 		description = "M00nD3v keylogger payload"
 		author = "ditekSHen"
-		id = "4000f55d-e072-50b6-b6ee-72cefc0ec53f"
+		id = "55a71c32-1351-5fc4-80a2-9da973b3e51b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L694-L715"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "68a0888da3b114dc895fe18a3d03b2b88d140fbf82b888f7a031b9364d01aabf"
+		logic_hash = "v1_sha256_68a0888da3b114dc895fe18a3d03b2b88d140fbf82b888f7a031b9364d01aabf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246262,22 +245243,20 @@ rule DITEKSHEN_MALWARE_Win_M00Nd3V : FILE
 		$s14 = "get_pnlPawns" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of them ) or (9 of them )
+		( uint16( 0 ) == 0x5a4d and 6 of them ) or ( 9 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Vssdestroy : FILE
 {
 	meta:
 		description = "VSSDestroy/Matrix ransomware payload"
 		author = "ditekSHen"
-		id = "734ece56-b993-5b44-ae15-f673fabfe8ad"
+		id = "e8190086-3119-52cb-83cb-f3db0ce22171"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L717-L740"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "24bfd32580f784440252d629a7ab86b84a570ded34409940616be2a89bf73088"
+		logic_hash = "v1_sha256_24bfd32580f784440252d629a7ab86b84a570ded34409940616be2a89bf73088"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246301,22 +245280,20 @@ rule DITEKSHEN_MALWARE_Win_Vssdestroy : FILE
 		$s6 = "Old file list dump found. Want to load it? (y/n):" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and 4 of ($o*) and 3 of ($s*)) or (5 of ($o*) and 4 of ($s*))
+		( uint16( 0 ) == 0x5a4d and 4 of ( $o* ) and 3 of ( $s* ) ) or ( 5 of ( $o* ) and 4 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Goldenaxe : FILE
 {
 	meta:
 		description = "GoldenAxe ransomware payload"
 		author = "ditekSHen"
-		id = "23874106-dbbb-5cb2-b61a-1661d8e2d868"
+		id = "78f22bce-c6a6-5991-b148-a1a01d186812"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L742-L763"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6dfd88ce65acdfed4749e3b817b317c3c514ea42f892a7f5f95853c148507918"
+		logic_hash = "v1_sha256_6dfd88ce65acdfed4749e3b817b317c3c514ea42f892a7f5f95853c148507918"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246338,22 +245315,20 @@ rule DITEKSHEN_MALWARE_Win_Goldenaxe : FILE
 		$g5 = "'Golden Axe ransomware'" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($g*) and 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $g* ) and 1 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Robbinhood : FILE
 {
 	meta:
 		description = "Robbinhood ransomware payload"
 		author = "ditekSHen"
-		id = "a5066a22-3c87-5e9f-a94f-5a44af2f96fd"
+		id = "feb8d843-d04d-51cf-b28d-91f39e1ae51b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L765-L787"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f1c4226ed5cb1583418d5ef0efc2c2b5bc3cfe7f148f359c5d432fd660331a46"
+		logic_hash = "v1_sha256_f1c4226ed5cb1583418d5ef0efc2c2b5bc3cfe7f148f359c5d432fd660331a46"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246376,22 +245351,20 @@ rule DITEKSHEN_MALWARE_Win_Robbinhood : FILE
 		$s9 = "/valery/go/src/oldboy/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($go and 1 of ($cmd*) and 3 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( $go and 1 of ( $cmd* ) and 3 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Getcrypt : FILE
 {
 	meta:
 		description = "GetCrypt ransomware payload"
 		author = "ditekSHen"
-		id = "fb6db807-372f-59e6-96c6-54dd4ece336d"
+		id = "33c15da8-0a7f-5505-9525-1da25eac9609"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L789-L825"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fd7ee98757c3ac1f2b2a4dd9041c78d33273d7a7d596c3d99c6b8d79988f29f1"
+		logic_hash = "v1_sha256_fd7ee98757c3ac1f2b2a4dd9041c78d33273d7a7d596c3d99c6b8d79988f29f1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -246426,22 +245399,20 @@ rule DITEKSHEN_MALWARE_Win_Getcrypt : FILE
                  45 78 57 00 53 48 45 4c 4c 33 32 2e 64 6c 6c 00 }
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or 8 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or 8 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Joego : FILE
 {
 	meta:
 		description = "JoeGo ransomware payload"
 		author = "ditekSHen"
-		id = "23d38bcd-e66d-5ff1-ad6a-3e6432d83562"
+		id = "7cb69adf-0b78-54db-8639-b4b109b8b609"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L827-L847"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3ddf3506aefb3cd1845f9daa689848a02a2422ca98c5c984bc918cc7ea2b2677"
+		logic_hash = "v1_sha256_3ddf3506aefb3cd1845f9daa689848a02a2422ca98c5c984bc918cc7ea2b2677"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246462,22 +245433,20 @@ rule DITEKSHEN_MALWARE_Joego : FILE
 		$cnc4 = "://nebezpecnyweb.eu/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and $go and ( all of ($s*) or (3 of ($s*) and 1 of ($cnc*)))
+		uint16( 0 ) == 0x5a4d and $go and ( all of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $cnc* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Aurora : FILE
 {
 	meta:
 		description = "Aurora ransomware payload"
 		author = "ditekSHen"
-		id = "d3eafe9c-c8d9-5744-ba5d-4eb0249cceea"
+		id = "56e18950-fa90-562f-9b43-ed3c88eb5893"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L849-L869"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "056bb11e8b947ef90462503db82b2001e4a5d4847fad9c0d5d771384a80d779a"
+		logic_hash = "v1_sha256_056bb11e8b947ef90462503db82b2001e4a5d4847fad9c0d5d771384a80d779a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246498,22 +245467,20 @@ rule DITEKSHEN_MALWARE_Win_Aurora : FILE
 		$pdb2 = "\\Desktop\\source\\Release\\Ransom.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($pdb*) and 5 of ($s*)) or (8 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and 5 of ( $s* ) ) or ( 8 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Buran : FILE
 {
 	meta:
 		description = "Buran ransomware payload"
 		author = "ditekSHen"
-		id = "1433bac5-2ece-54bb-8e57-b5834fffc719"
+		id = "e2a616bc-fc50-5fc7-b829-605139e0aa11"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L871-L903"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "eaf50d824dbade0ca63fafc5b4a376553039de9b51a0f6387cb28c8f91a7e0b9"
+		logic_hash = "v1_sha256_eaf50d824dbade0ca63fafc5b4a376553039de9b51a0f6387cb28c8f91a7e0b9"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -246544,22 +245511,20 @@ rule DITEKSHEN_MALWARE_Win_Buran : FILE
 		$v2_12 = "$*@@@*$@@@$" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((( all of ($v1*) and 1 of ($h*)) or ($path and 2 of ($v1*) and 1 of ($h*)) or 10 of them ) or all of ($v2*))
+		uint16( 0 ) == 0x5a4d and ( ( ( all of ( $v1* ) and 1 of ( $h* ) ) or ( $path and 2 of ( $v1* ) and 1 of ( $h* ) ) or 10 of them ) or all of ( $v2* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Masslogger : FILE
 {
 	meta:
 		description = "MassLogger keylogger payload"
 		author = "ditekSHen"
-		id = "9181b89a-2ce8-59b6-9703-c01a8471b8d6"
+		id = "1de77bf2-9026-5227-b739-dbaf0e61bbcf"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L905-L934"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7d8bbefa71a1eb20cd9d029bd516d6c37e39cfa053ed0617eace200d210d9b58"
+		logic_hash = "v1_sha256_7d8bbefa71a1eb20cd9d029bd516d6c37e39cfa053ed0617eace200d210d9b58"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -246589,22 +245554,20 @@ rule DITEKSHEN_MALWARE_Win_Masslogger : FILE
 		$c13 = "encryptedPassword" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 9 of ($c*)) or (5 of ($s*) or 9 of ($c*))
+		( uint16( 0 ) == 0x5a4d and 9 of ( $c* ) ) or ( 5 of ( $s* ) or 9 of ( $c* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Echelon : FILE
 {
 	meta:
 		description = "Echelon information stealer payload"
 		author = "ditekSHen"
-		id = "e13d2003-c755-5dd3-bb16-8e41dd19a151"
+		id = "8b60b548-5f5d-538e-884a-fab9170ff9a7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L936-L957"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c070bf52cc51dd334ea24614e33eaa2b7b1a17e7790e586cbbb8c7e33ba1bd76"
+		logic_hash = "v1_sha256_c070bf52cc51dd334ea24614e33eaa2b7b1a17e7790e586cbbb8c7e33ba1bd76"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246626,22 +245589,20 @@ rule DITEKSHEN_MALWARE_Win_Echelon : FILE
 		$pdb = "\\Echelon-Stealer-master\\obj\\Release\\Echelon.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and (8 of ($s*) or $pdb)) or (8 of ($s*) or $pdb)
+		( uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or $pdb ) ) or ( 8 of ( $s* ) or $pdb )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Qulab
 {
 	meta:
 		description = "Qulab information stealer payload or artifacts"
 		author = "ditekSHen"
-		id = "6ae24c67-5700-5330-a3bd-d542162faebb"
+		id = "fd3e6412-5bff-5ca3-a9da-6e0762ceb853"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L959-L983"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "659d828cbef38c6362b612be9bdc05ae820f49c23684e77af6462ea677133284"
+		logic_hash = "v1_sha256_659d828cbef38c6362b612be9bdc05ae820f49c23684e77af6462ea677133284"
 		score = 75
 		quality = 75
 		tags = ""
@@ -246666,22 +245627,20 @@ rule DITEKSHEN_MALWARE_Win_Qulab
 		$s11 = "\\getMe" ascii wide
 
 	condition:
-		9 of them or ((1 of ($x*) and 4 of ($s*)) or 1 of ($x*))
+		9 of them or ( ( 1 of ( $x* ) and 4 of ( $s* ) ) or 1 of ( $x* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Orion : FILE
 {
 	meta:
 		description = "Orion Keylogger payload"
 		author = "ditekSHen"
-		id = "b380b93b-6ceb-5244-aeca-b1f8f9a5b553"
+		id = "035db397-11f8-5357-a783-2322b0f2c215"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L985-L1005"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9e5521ebaf9bdef6dadd2a2a093bd6f87ded023d9a74db126ac8ec9a5f1f9744"
+		logic_hash = "v1_sha256_9e5521ebaf9bdef6dadd2a2a093bd6f87ded023d9a74db126ac8ec9a5f1f9744"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -246702,22 +245661,20 @@ rule DITEKSHEN_MALWARE_Win_Orion : FILE
 		$s13 = "<p style=\"color:#CC7A00\">[" wide
 
 	condition:
-		( uint16(0)==0x5a4d and 5 of ($s*)) or (6 of ($s*))
+		( uint16( 0 ) == 0x5a4d and 5 of ( $s* ) ) or ( 6 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Aspire : FILE
 {
 	meta:
 		description = "Aspire Keylogger payload"
 		author = "ditekSHen"
-		id = "25724975-f373-553e-b27e-43168e956c16"
+		id = "150b9259-3cb0-5ff2-90bf-cf4db92672b0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1007-L1022"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3ea0136dbacb79e4c7556f562d17b26b84ac3e4c967b117021e2399ded0a0fdf"
+		logic_hash = "v1_sha256_3ea0136dbacb79e4c7556f562d17b26b84ac3e4c967b117021e2399ded0a0fdf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246733,22 +245690,20 @@ rule DITEKSHEN_MALWARE_Win_Aspire : FILE
 		$s8 = "logins.json" wide
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of ($s*)) or (7 of ($s*))
+		( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( 7 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_S05Kitty : FILE
 {
 	meta:
 		description = "Sector05 Kitty RAT payload"
 		author = "ditekSHen"
-		id = "3261f6b6-21e7-5195-98db-9607ba530572"
+		id = "0bdb3536-72c4-54ac-ae82-d14f8d59c6bb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1024-L1045"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "df2930694671c9ca16f2afeb799704647c9acf32be118706c342347ffe8ceb36"
+		logic_hash = "v1_sha256_df2930694671c9ca16f2afeb799704647c9acf32be118706c342347ffe8ceb36"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246770,22 +245725,20 @@ rule DITEKSHEN_MALWARE_Win_S05Kitty : FILE
 		$x5 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\fontchk.jse" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (8 of ($s*) or all of ($x*))
+		uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or all of ( $x* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Fakewmi : FILE
 {
 	meta:
 		description = "FakeWMI payload"
 		author = "ditekSHen"
-		id = "689bc207-2bc6-50de-80d6-d1ba0a26b264"
+		id = "36587520-4223-5cad-a78d-b64d4c38109e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1047-L1064"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "627886cdd01f5f02e454ef284c77c87eb027ee33f6a51536758fb7f095271a40"
+		logic_hash = "v1_sha256_627886cdd01f5f02e454ef284c77c87eb027ee33f6a51536758fb7f095271a40"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246803,22 +245756,20 @@ rule DITEKSHEN_MALWARE_Win_Fakewmi : FILE
 		$s9 = "CreateService" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) and #s2>10)
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) and #s2 > 10 )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Baldr : FILE
 {
 	meta:
 		description = "Baldr payload"
 		author = "ditekSHen"
-		id = "cdc35a11-a97b-5e21-929e-01fed5172b55"
+		id = "151bac1b-5d6f-5a7b-ac9e-100c10624061"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1066-L1083"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f8e97fd618209bc6ce609b60b1e1f1e359be7678474fad3b18a529487c64cd99"
+		logic_hash = "v1_sha256_f8e97fd618209bc6ce609b60b1e1f1e359be7678474fad3b18a529487c64cd99"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -246836,22 +245787,20 @@ rule DITEKSHEN_MALWARE_Win_Baldr : FILE
 		$s5 = "get_Passwordcheck" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and all of ($x*)) or (2 of ($x*) and 4 of ($s*))
+		( uint16( 0 ) == 0x5a4d and all of ( $x* ) ) or ( 2 of ( $x* ) and 4 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Megumin : FILE
 {
 	meta:
 		description = "Megumin payload"
 		author = "ditekSHen"
-		id = "bb1743f7-0bd8-5c0a-ad78-c4747904204f"
+		id = "fa301ed6-3d2e-5672-ba8b-783f80200405"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1085-L1108"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fb4934814c45d2465b6e1589c3b489116343ca0c17ebb916b5c9247fc676c74d"
+		logic_hash = "v1_sha256_fb4934814c45d2465b6e1589c3b489116343ca0c17ebb916b5c9247fc676c74d"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -246873,22 +245822,20 @@ rule DITEKSHEN_MALWARE_Win_Megumin : FILE
 		$pdb = "\\MeguminV2\\Release\\MeguminV2.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($cnc*) or $pdb)) or 11 of them
+		( uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 5 of ( $cnc* ) or $pdb ) ) or 11 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Rietspoof : FILE
 {
 	meta:
 		description = "Rietspoof payload"
 		author = "ditekSHen"
-		id = "b2d94705-ca59-56ae-8471-2c6895d355dc"
+		id = "17a97fa9-09cc-50c5-ae6b-b91604ef8ae4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1110-L1140"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d1d9baab83c904d1e8dcd7aeacdabfc79c1acee67006793c2240a42ebf9c62b2"
+		logic_hash = "v1_sha256_d1d9baab83c904d1e8dcd7aeacdabfc79c1acee67006793c2240a42ebf9c62b2"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -246916,22 +245863,20 @@ rule DITEKSHEN_MALWARE_Win_Rietspoof : FILE
 		$pdb2 = "\\loader\\Release\\loader_v1.0.pdb" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($c*) and (3 of ($v*) or 1 of ($pdb*)))
+		uint16( 0 ) == 0x5a4d and ( 7 of ( $c* ) and ( 3 of ( $v* ) or 1 of ( $pdb* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Modirat : FILE
 {
 	meta:
 		description = "MoDiRAT payload"
 		author = "ditekSHen"
-		id = "8b641c7a-5ebd-50e7-83cb-e408683c456b"
+		id = "00af938a-978d-582c-93cf-e4cca27ea25a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1142-L1158"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d0760e9dab7e9c0affb2193ea249feea8bb58e519522ca2a562f015059ad5590"
+		logic_hash = "v1_sha256_d0760e9dab7e9c0affb2193ea249feea8bb58e519522ca2a562f015059ad5590"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -246948,22 +245893,20 @@ rule DITEKSHEN_MALWARE_Win_Modirat : FILE
 		$s9 = "Recording_Time" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and 7 of them ) or all of them
+		( uint16( 0 ) == 0x5a4d and 7 of them ) or all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_DOC_Koadicdoc : FILE
 {
 	meta:
 		description = "Koadic post-exploitation framework document payload"
 		author = "ditekSHen"
-		id = "76d6c8df-4e42-5c0a-8344-f8848e7ac945"
+		id = "b195e780-519c-511e-82fa-176a0aaa4d0d"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1160-L1174"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9f0538e1faee737a08d403a7f321ce45bdc70b390accfe378ba0d26292509fd7"
+		logic_hash = "v1_sha256_9f0538e1faee737a08d403a7f321ce45bdc70b390accfe378ba0d26292509fd7"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -246978,22 +245921,20 @@ rule DITEKSHEN_MALWARE_DOC_Koadicdoc : FILE
 		$b3 = ".bat',%" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and all of ($s*) and 2 of ($b*)
+		uint16( 0 ) == 0xcfd0 and all of ( $s* ) and 2 of ( $b* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_BAT_Koadicbat : FILE
 {
 	meta:
 		description = "Koadic post-exploitation framework BAT payload"
 		author = "ditekSHen"
-		id = "dad7bb32-b1f1-5c6d-89b2-77cc49b5f020"
+		id = "abcfb61c-b425-5151-9074-03e400546411"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1176-L1186"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1ee6c0189a5111c61af1dbe571524427bff95a7e3907f97ce51d272a8f701cf5"
+		logic_hash = "v1_sha256_1ee6c0189a5111c61af1dbe571524427bff95a7e3907f97ce51d272a8f701cf5"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -247004,22 +245945,20 @@ rule DITEKSHEN_MALWARE_BAT_Koadicbat : FILE
 		$m1 = /:~\d+,1%+/ ascii
 
 	condition:
-		uint16(0)==0xfeff and ((1 of ($v1*) or 1 of ($v2*)) and #m1>100)
+		uint16( 0 ) == 0xfeff and ( ( 1 of ( $v1* ) or 1 of ( $v2* ) ) and #m1 > 100 )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_JS_Koadicjs
 {
 	meta:
 		description = "Koadic post-exploitation framework JS payload"
 		author = "ditekSHen"
-		id = "8598d5cb-0486-52b0-a686-6bd014f35c44"
+		id = "7f8e5c49-eedc-5dc3-91f1-7effe6578678"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1188-L1208"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "689116f74996fecf4c16c224e8cd842ad5b5e989de2dfdf0debeb9a26d8a12fa"
+		logic_hash = "v1_sha256_689116f74996fecf4c16c224e8cd842ad5b5e989de2dfdf0debeb9a26d8a12fa"
 		score = 75
 		quality = 75
 		tags = ""
@@ -247040,22 +245979,20 @@ rule DITEKSHEN_MALWARE_JS_Koadicjs
 		$ht6 = "scroll=\"no\"" ascii
 
 	condition:
-		all of ($s*) and (1 of ($hf*) or all of ($ht*))
+		all of ( $s* ) and ( 1 of ( $hf* ) or all of ( $ht* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_NETEAGLE : FILE
 {
 	meta:
 		description = "NETEAGLE backdoor payload"
 		author = "ditekSHen"
-		id = "89d1304a-63a0-50fc-855a-2e36cde1c5e7"
+		id = "b77d32d3-3fc2-521d-b836-40709aff7161"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1210-L1225"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "148de0ca332d3885d94eae8d15eb4aaa2bc4950c691c0e8817c816b7d4c55510"
+		logic_hash = "v1_sha256_148de0ca332d3885d94eae8d15eb4aaa2bc4950c691c0e8817c816b7d4c55510"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247071,22 +246008,20 @@ rule DITEKSHEN_MALWARE_Win_NETEAGLE : FILE
 		$s8 = /pic\d\.bmp/ ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_WIN_BACKSPACE : FILE
 {
 	meta:
 		description = "BACKSPACE backdoor payload"
 		author = "ditekSHen"
-		id = "ff9b1c2e-66a1-5e09-8bc2-a7543161e518"
+		id = "514d9371-d790-51da-8d97-d50eb03de443"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1227-L1247"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3d366327c2272761349687b11e4d6baada5000936dc7f81665e0303f7d1e5121"
+		logic_hash = "v1_sha256_3d366327c2272761349687b11e4d6baada5000936dc7f81665e0303f7d1e5121"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247107,22 +246042,20 @@ rule DITEKSHEN_MALWARE_WIN_BACKSPACE : FILE
 		$s13 = "User-Agent: Mozilla/5.00 (compatible; MSIE 6.0; Win32)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Rhttpctrl : FILE
 {
 	meta:
 		description = "RHttpCtrl backdoor payload"
 		author = "ditekSHen"
-		id = "fa80db13-90af-5d6a-bcc2-ad1f6808268e"
+		id = "905f9daa-1f4f-5833-a2c5-911b16af7ac7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1249-L1265"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a8b27fcc4636c2fe02a0e006295ece7f705cc9a042921f66ef1f9b6a88aaf9a1"
+		logic_hash = "v1_sha256_a8b27fcc4636c2fe02a0e006295ece7f705cc9a042921f66ef1f9b6a88aaf9a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247139,22 +246072,20 @@ rule DITEKSHEN_MALWARE_Win_Rhttpctrl : FILE
 		$pdb = "\\WorkSources\\RHttpCtrl\\Server\\Release\\svchost.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or ($pdb and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( $pdb and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Pillowmint : FILE
 {
 	meta:
 		description = "PillowMint POS payload"
 		author = "ditekSHen"
-		id = "e3d26a12-45aa-5f5d-997a-f350bc1bea97"
+		id = "35c540af-c3ad-5807-8c3b-e49d3cf4dc93"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1267-L1283"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ed2597fce1c56d2e110790e0eb89834b1bb9f6f52d39105157c9ffe2ede6cc7a"
+		logic_hash = "v1_sha256_ed2597fce1c56d2e110790e0eb89834b1bb9f6f52d39105157c9ffe2ede6cc7a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247171,22 +246102,20 @@ rule DITEKSHEN_MALWARE_Win_Pillowmint : FILE
 		$s9 = "ReflectiveLoader" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Blackshadesrat : FILE
 {
 	meta:
 		description = "BlackshadesRAT / Cambot POS payload"
 		author = "ditekSHen"
-		id = "bd0ad920-109a-50b5-94af-6580684bff52"
+		id = "b398a340-f151-54bf-8fa4-e70ad71fda7f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1285-L1300"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5c2a76ce52bce9c37a3518ff459011acb733c2c5abac74786e41a1c169459ce2"
+		logic_hash = "v1_sha256_5c2a76ce52bce9c37a3518ff459011acb733c2c5abac74786e41a1c169459ce2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247202,22 +246131,20 @@ rule DITEKSHEN_MALWARE_Win_Blackshadesrat : FILE
 		$pdb = "*\\AC:\\Users\\Admin\\Desktop_old\\Blackshades project\\bs_bot\\bots\\bot\\bs_bot.vbp" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or ($pdb and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( $pdb and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Goldenspy : FILE
 {
 	meta:
 		description = "GoldenSpy dropper payload"
 		author = "SpiderLabs Trustwave"
-		id = "01d3f14a-fefb-5cea-b055-d7e9f4c7d13b"
+		id = "b488bdc8-b8fb-5483-9b6c-b3307924646a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://trustwave.azureedge.net/media/16908/the-golden-tax-department-and-emergence-of-goldenspy-malware.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1302-L1314"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "908047db2167733da0089375dbfd636881e721cc219da110755b81581d438cfa"
+		logic_hash = "v1_sha256_908047db2167733da0089375dbfd636881e721cc219da110755b81581d438cfa"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -247229,22 +246156,20 @@ rule DITEKSHEN_MALWARE_Win_Goldenspy : FILE
 		$str3 = { 510F4345[0-10]50518D8DCCFE[0-20]837D1C[0-20]8D45[0-15]0F4345[0-20]505157 }
 
 	condition:
-		( uint16(0)==0x5A4D) and $reg and 2 of ($str*)
+		( uint16( 0 ) == 0x5A4D ) and $reg and 2 of ( $str* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Plurox : FILE
 {
 	meta:
 		description = "Plurox backdoor payload"
 		author = "ditekSHen"
-		id = "c8a97132-c1d5-5456-a055-d46a9399dbdd"
+		id = "7dc1e7a7-22f5-5b70-a72b-a39457c762bc"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1316-L1328"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c2ec2ce7a9210d8eebb06c755eab51cab93fe6d48d737fd1756ffe42d46b35d1"
+		logic_hash = "v1_sha256_c2ec2ce7a9210d8eebb06c755eab51cab93fe6d48d737fd1756ffe42d46b35d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247257,22 +246182,20 @@ rule DITEKSHEN_MALWARE_Win_Plurox : FILE
 		$s5 = "RunFromMemory" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Avalon : FILE
 {
 	meta:
 		description = "Avalon infostealer payload"
 		author = "ditekSHen"
-		id = "3de01419-9f45-5d82-8391-2e1e41df2b34"
+		id = "85d0d6f9-74a9-57ec-8f51-887d09a40f66"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1330-L1359"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1aa9dc09ec4c8962dee0455dd367e32139e4c03f1b306f17ac6e82d71aacf713"
+		logic_hash = "v1_sha256_1aa9dc09ec4c8962dee0455dd367e32139e4c03f1b306f17ac6e82d71aacf713"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247299,22 +246222,20 @@ rule DITEKSHEN_MALWARE_Win_Avalon : FILE
 		$p2 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Kinsing : FILE
 {
 	meta:
 		description = "Kinsing RAT payload"
 		author = "ditekSHen"
-		id = "b13d2c36-c8d3-5138-9e9a-8b5390a93c8d"
+		id = "4b53220d-6857-5420-bf57-0bc9f7b78e46"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1361-L1376"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "566eb7d1864e3a8088ad4f5d032d6d62a33080bbfc5c20c2520315cfc8146afc"
+		logic_hash = "v1_sha256_566eb7d1864e3a8088ad4f5d032d6d62a33080bbfc5c20c2520315cfc8146afc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247330,22 +246251,20 @@ rule DITEKSHEN_MALWARE_Linux_Kinsing : FILE
 		$s8 = "doTask with type %s" ascii
 
 	condition:
-		uint16(0)==0x457f and 6 of them
+		uint16( 0 ) == 0x457f and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Avaddon : FILE
 {
 	meta:
 		description = "Avaddon ransomware payload"
 		author = "ditekSHen"
-		id = "d5618c8a-17b7-5009-9947-a6462ad2a4af"
+		id = "545a762f-f970-5036-9e5a-5fd57faafd36"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1378-L1395"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fc3032572d2ab2550d3dde738a3d403459da9b5b640acc814596d958b83620bf"
+		logic_hash = "v1_sha256_fc3032572d2ab2550d3dde738a3d403459da9b5b640acc814596d958b83620bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247363,22 +246282,20 @@ rule DITEKSHEN_MALWARE_Win_Avaddon : FILE
 		$s10 = ".?AUANEventGetCpuMax@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Prolock : FILE
 {
 	meta:
 		description = "ProLock ransomware payload"
 		author = "ditekSHen"
-		id = "88fa19ba-238c-5d4d-bf0c-d421ee2ecf1d"
+		id = "d4134e62-e431-50a3-8fb4-a6aec88a81eb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1397-L1413"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b7d2cc71acc4f643a86781d957afcf5203a2f4034b9ca7da93e8227ddee79f3b"
+		logic_hash = "v1_sha256_b7d2cc71acc4f643a86781d957afcf5203a2f4034b9ca7da93e8227ddee79f3b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247395,22 +246312,20 @@ rule DITEKSHEN_MALWARE_Win_Prolock : FILE
 		$s8 = { 55 89 E5 8B 45 08 EB 00 89 45 EC 8D 15 4F 10 40 00 8D 05 08 10 40 00 83 E8 08 29 C2 8B 45 EC 01 C2 31 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Purplewave : FILE
 {
 	meta:
 		description = "PurpleWave infostealer payload"
 		author = "ditekSHen"
-		id = "6f978190-4b4d-5346-9218-0c9104254b45"
+		id = "f57350ca-4f63-5fc8-a1c9-fbb65c30e399"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1415-L1432"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "98dca005d2fdf7eea89661e162292451b544847a7f8b63c8c25c82241ec8e04a"
+		logic_hash = "v1_sha256_98dca005d2fdf7eea89661e162292451b544847a7f8b63c8c25c82241ec8e04a"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -247428,22 +246343,20 @@ rule DITEKSHEN_MALWARE_Win_Purplewave : FILE
 		$s10 = "at t.me/LuckyStoreSupport" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Java_Pyrogenic
 {
 	meta:
 		description = "Pyrogenic/Qealler infostealer payload"
 		author = "ditekSHen"
-		id = "2b9268f0-2f73-51ad-ab72-9289e42e5bb1"
+		id = "65b1d2d8-be2c-591d-9d51-bbd57cbe2852"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1434-L1446"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bb8cb939f06a376f72dcbbb1f04ec34526f72c3bcc3b146b905a8466826d2c24"
+		logic_hash = "v1_sha256_bb8cb939f06a376f72dcbbb1f04ec34526f72c3bcc3b146b905a8466826d2c24"
 		score = 75
 		quality = 75
 		tags = ""
@@ -247458,20 +246371,18 @@ rule DITEKSHEN_MALWARE_Java_Pyrogenic
 	condition:
 		all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Agentteslav3 : FILE
 {
 	meta:
 		description = "AgentTeslaV3 infostealer payload"
 		author = "ditekSHen"
-		id = "c44c69dd-5e95-595c-88c7-89e243648198"
+		id = "6d5a62ec-c982-5aab-8b40-8db85500e22c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1448-L1481"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6c62b2f601eba3c83b60f7f6dbd3d0ec3c01af30f4312df897bb5e902c36fdac"
+		logic_hash = "v1_sha256_6c62b2f601eba3c83b60f7f6dbd3d0ec3c01af30f4312df897bb5e902c36fdac"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -247503,22 +246414,20 @@ rule DITEKSHEN_MALWARE_Win_Agentteslav3 : FILE
 		$m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and (8 of ($s*) or (6 of ($*) and all of ($g*)))) or (2 of ($m*))
+		( uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 6 of ( $* ) and all of ( $g* ) ) ) ) or ( 2 of ( $m* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Taurus : FILE
 {
 	meta:
 		description = "Taurus infostealer payload"
 		author = "ditekSHen"
-		id = "c02114c1-9c97-5d0c-b7ce-1bd6a00a9e9a"
+		id = "3c9f20ee-c4cc-5dff-91fc-57b66b7688ed"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1483-L1519"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6039c27e69b47dfcc1327c34306627d2d9bd57f6bd365bb80b47ad21f892ae8a"
+		logic_hash = "v1_sha256_6039c27e69b47dfcc1327c34306627d2d9bd57f6bd365bb80b47ad21f892ae8a"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -247554,22 +246463,20 @@ rule DITEKSHEN_MALWARE_Win_Taurus : FILE
 		$o5 = { 8d 8d ?? ff ff ff e8 5b }
 
 	condition:
-		((3 of ($s*) or (6 of ($txt*) and 2 of ($s*)) or ($upat and 1 of ($s*) and 2 of ($txt*)) or ( all of ($url*) and (2 of ($txt*) or 1 of ($s*)))) or ( uint16(0)==0x5a4d and all of ($x*) or ( all of ($o*) and 3 of ($x*))))
+		(( 3 of ( $s* ) or ( 6 of ( $txt* ) and 2 of ( $s* ) ) or ( $upat and 1 of ( $s* ) and 2 of ( $txt* ) ) or ( all of ( $url* ) and ( 2 of ( $txt* ) or 1 of ( $s* ) ) ) ) or ( uint16( 0 ) == 0x5a4d and all of ( $x* ) or ( all of ( $o* ) and 3 of ( $x* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Remoteutilitiesrat : FILE
 {
 	meta:
 		description = "RemoteUtilitiesRAT RAT payload"
 		author = "ditekSHen"
-		id = "1cf3ece1-e723-5302-9673-273381ba7a8b"
+		id = "8febc60c-4158-5e16-b75d-1de85deedc07"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1521-L1537"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "179a559f6a6ffbce31595bd613d338bb6ac40b8a083ed0169cde754b6ed756c7"
+		logic_hash = "v1_sha256_179a559f6a6ffbce31595bd613d338bb6ac40b8a083ed0169cde754b6ed756c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247586,22 +246493,20 @@ rule DITEKSHEN_MALWARE_Win_Remoteutilitiesrat : FILE
 		$s8 = "rms_internet_id_settings" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Slothfulmedia : FILE
 {
 	meta:
 		description = "SlothfulMedia backdoor payload"
 		author = "ditekSHen"
-		id = "e94b6d67-137c-5cfb-9c59-fbeb6cd85f0a"
+		id = "74def1f9-a521-525c-af81-bc1ef79474a1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1539-L1565"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6f742e8d9d555b44daaa09835f599c99e16cd39bb106c8f43fbbca7093de462e"
+		logic_hash = "v1_sha256_6f742e8d9d555b44daaa09835f599c99e16cd39bb106c8f43fbbca7093de462e"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -247626,22 +246531,20 @@ rule DITEKSHEN_MALWARE_Win_Slothfulmedia : FILE
 		$cnc4 = "Content-Length: %d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or 7 of ($s*) or all of ($cnc*) or (1 of ($x*) and 4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or 7 of ( $s* ) or all of ( $cnc* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ircbot : FILE
 {
 	meta:
 		description = "IRCBot payload"
 		author = "ditekSHen"
-		id = "69739d82-9760-5c4e-bf9e-60c60617a12a"
+		id = "cb02d22b-4863-5bf3-9b83-6c9d00f5e5fb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1567-L1596"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1ea640202cfbd0c3425a192c45938f632dc644f41c7974118e7491b026122818"
+		logic_hash = "v1_sha256_1ea640202cfbd0c3425a192c45938f632dc644f41c7974118e7491b026122818"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -247669,22 +246572,20 @@ rule DITEKSHEN_MALWARE_Win_Ircbot : FILE
 		$pdb = "\\Projects\\USBStarter\\USBStarter\\obj\\Release\\USBStarter.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or 3 of ($cnc*) or ($pdb and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or 3 of ( $cnc* ) or ( $pdb and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Apocalypse : FILE
 {
 	meta:
 		description = "Apocalypse infostealer payload"
 		author = "ditekSHen"
-		id = "f1fa6642-fe42-57e7-a1bc-0f59815049f8"
+		id = "5c2dc4f9-b6e2-5728-ac91-88de15aa8f88"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1598-L1615"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d18ac492ad57cf390f20693cb47ae2c6e3dbdd921fa846130a4bc20047e1aa27"
+		logic_hash = "v1_sha256_d18ac492ad57cf390f20693cb47ae2c6e3dbdd921fa846130a4bc20047e1aa27"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247702,22 +246603,20 @@ rule DITEKSHEN_MALWARE_Win_Apocalypse : FILE
 		$s10 = "get_PrimaryScreen" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Osno : FILE
 {
 	meta:
 		description = "Osno ransomware and infostealer payload"
 		author = "ditekSHen"
-		id = "25ed5ad4-804a-5608-b6fe-a811ca6744d8"
+		id = "840398d4-548f-5be6-9bc1-2b10d15ca4d6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1617-L1652"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3df59c306017001467a5f237db2ab37d97c34116558e18420a6a1f01f08f520f"
+		logic_hash = "v1_sha256_3df59c306017001467a5f237db2ab37d97c34116558e18420a6a1f01f08f520f"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -247751,22 +246650,20 @@ rule DITEKSHEN_MALWARE_Win_Osno : FILE
 		$cnc8 = "&type=" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and (6 of ($s*) or 4 of ($txt*) or (4 of ($s*) and 2 of ($txt*)))) or (7 of ($cnc*))
+		( uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 4 of ( $txt* ) or ( 4 of ( $s* ) and 2 of ( $txt* ) ) ) ) or ( 7 of ( $cnc* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Betabot : FILE
 {
 	meta:
 		description = "BetaBot payload"
 		author = "ditekSHen"
-		id = "377c500c-5727-5bea-ac46-cb69c868a607"
+		id = "27b87200-f5cc-5e62-96cb-d44726ba3f84"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1654-L1666"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e594d01874ee622169d6708ddc6cfde7f1d26d2bea1604961dc860700e8a1d5d"
+		logic_hash = "v1_sha256_e594d01874ee622169d6708ddc6cfde7f1d26d2bea1604961dc860700e8a1d5d"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -247779,22 +246676,20 @@ rule DITEKSHEN_MALWARE_Win_Betabot : FILE
 		$s5 = "VirtualProtectEx" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Wshratplugin : FILE
 {
 	meta:
 		description = "WSHRAT keylogger plugin payload"
 		author = "ditekSHen"
-		id = "45c4fc87-6c45-5cd7-9fc4-7d3ea664a740"
+		id = "97031035-8bd9-557c-afbf-dc2491bf01d1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1668-L1685"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3feeab43b58b533b7d2d41a71f2107e6f05b9c54ff805607843d253cadbe9384"
+		logic_hash = "v1_sha256_3feeab43b58b533b7d2d41a71f2107e6f05b9c54ff805607843d253cadbe9384"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247812,22 +246707,20 @@ rule DITEKSHEN_MALWARE_Win_Wshratplugin : FILE
 		$pdb = "\\Android\\documents\\visual studio 2010\\Projects\\Keylogger\\Keylogger\\obj\\x86\\Debug\\Keylogger.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Revengerat : FILE
 {
 	meta:
 		description = "RevengeRAT and variants payload"
 		author = "ditekSHen"
-		id = "7d725050-108c-54b5-978e-2dd2124f5b0f"
+		id = "b1daf31e-1a12-545a-b682-479a39d783a7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1687-L1713"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "be9e50052f45b94d5995db723dd64d16a91c5ba0d3f589c018155c0cce45124f"
+		logic_hash = "v1_sha256_be9e50052f45b94d5995db723dd64d16a91c5ba0d3f589c018155c0cce45124f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247852,22 +246745,20 @@ rule DITEKSHEN_MALWARE_Win_Revengerat : FILE
 		$q3 = "select * from Win32_Processor" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($l*) and 3 of ($s*)) or ( all of ($q*) and 3 of ($s*)) or 3 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $l* ) and 3 of ( $s* ) ) or ( all of ( $q* ) and 3 of ( $s* ) ) or 3 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_TRAT : FILE
 {
 	meta:
 		description = "TRAT payload"
 		author = "ditekSHen"
-		id = "15f80970-6bc7-5e29-86d6-f7529a10d227"
+		id = "175b89e5-fa7b-55dc-982c-e76394a3a3e2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1715-L1730"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b8474c74cd9f21fcb3a8ae1c7a7a0a801f0f117782e9803cdae39daf7f0f8b2f"
+		logic_hash = "v1_sha256_b8474c74cd9f21fcb3a8ae1c7a7a0a801f0f117782e9803cdae39daf7f0f8b2f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247883,22 +246774,20 @@ rule DITEKSHEN_MALWARE_Win_TRAT : FILE
 		$s7 = "//B //Nologo *Y" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cryptbot : FILE
 {
 	meta:
 		description = "CryptBot/Fugrafa stealer payload"
 		author = "ditekSHen"
-		id = "248961dd-b98d-509b-92a0-1670b7687e25"
+		id = "7c31d3f8-cb1c-582f-8781-974d45b1476f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1732-L1766"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6322b8b1ad210fac4475c194e060046538d4174f69a7c0e3618646d262cd33bd"
+		logic_hash = "v1_sha256_6322b8b1ad210fac4475c194e060046538d4174f69a7c0e3618646d262cd33bd"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -247933,22 +246822,20 @@ rule DITEKSHEN_MALWARE_Win_Cryptbot : FILE
 		$pattern3 = /(_AllPasswords_list.txt|_AllForms_list.txt|_AllCookies_list.txt|_All_CC_list.txt|_Information.txt|_Info.txt|_Screen_Desktop.jpeg)/ fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((5 of ($s*) and 1 of ($p*)) or (4 of ($s*) and 1 of ($f*) and 1 of ($p*)) or (2 of ($pattern*) and 3 of ($s*)) or (#pattern1>6 and (2 of ($s*) or 1 of ($p*))))
+		uint16( 0 ) == 0x5a4d and ( ( 5 of ( $s* ) and 1 of ( $p* ) ) or ( 4 of ( $s* ) and 1 of ( $f* ) and 1 of ( $p* ) ) or ( 2 of ( $pattern* ) and 3 of ( $s* ) ) or ( #pattern1 > 6 and ( 2 of ( $s* ) or 1 of ( $p* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Matiex : FILE
 {
 	meta:
 		description = "Matiex/XetimaLogger keylogger payload"
 		author = "ditekSHen"
-		id = "61803e0c-8f6a-5ded-855a-ff26eed1384f"
+		id = "57187d9a-c30e-53d3-b818-190a8768da50"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1768-L1788"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "62b45c43d99bef93a6c0e72200b869fdce331f8fa325640df7d8b72af56a3ef2"
+		logic_hash = "v1_sha256_62b45c43d99bef93a6c0e72200b869fdce331f8fa325640df7d8b72af56a3ef2"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -247967,22 +246854,20 @@ rule DITEKSHEN_MALWARE_Win_Matiex : FILE
 		$pdb = "\\Before FprmT\\Document VB project\\FireFox Stub\\FireFox Stub\\obj\\Debug\\VNXT.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($id or 4 of ($s*) or ($pdb and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( $id or 4 of ( $s* ) or ( $pdb and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Iamthekingkeylogger : FILE
 {
 	meta:
 		description = "IAmTheKing Keylogger payload"
 		author = "ditekSHen"
-		id = "f9c84241-6db2-5243-9bea-2165104cb0c3"
+		id = "07d5c4e4-f72c-5427-a3fc-78b0c2fcb2b7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1790-L1805"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "80d8cabfd02cd73e19e6cf1c2a8a5f06c5b3b502fe4f07289e92b448425aaa6d"
+		logic_hash = "v1_sha256_80d8cabfd02cd73e19e6cf1c2a8a5f06c5b3b502fe4f07289e92b448425aaa6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -247998,22 +246883,20 @@ rule DITEKSHEN_MALWARE_Win_Iamthekingkeylogger : FILE
 		$s7 = "sonme hting is wrong x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Iamthekingscrcap : FILE
 {
 	meta:
 		description = "IAmTheKing screen capture payload"
 		author = "ditekSHen"
-		id = "ba385194-9578-568c-b908-bc4fc742e52e"
+		id = "9bd12131-5b4f-51c1-b371-25f8d10b8c65"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1807-L1821"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "594ddad4e08bad51f90de1c4299e28b4800b4fa686bd4176e406ba401a1242ba"
+		logic_hash = "v1_sha256_594ddad4e08bad51f90de1c4299e28b4800b4fa686bd4176e406ba401a1242ba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248028,22 +246911,20 @@ rule DITEKSHEN_MALWARE_Win_Iamthekingscrcap : FILE
 		$s7 = ".?AVCAtlException@ATL@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Iamthekingkingofhearts : FILE
 {
 	meta:
 		description = "IAmTheKing King Of Hearts payload"
 		author = "ditekSHen"
-		id = "95c73ec0-75b0-5d46-87da-b30feb170716"
+		id = "3d3da2e6-d90c-59ee-a6e2-313bf382db0a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1823-L1843"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "75b6dd0ebb90fd04f9e4a0b1fc6a1bbf417fc66daad24c8b01f0390f6155ec55"
+		logic_hash = "v1_sha256_75b6dd0ebb90fd04f9e4a0b1fc6a1bbf417fc66daad24c8b01f0390f6155ec55"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248063,22 +246944,20 @@ rule DITEKSHEN_MALWARE_Win_Iamthekingkingofhearts : FILE
 		$u2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($u*) and 4 of ($s*)) or ( all of ($u*) and 3 of ($s*)) or (5 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $u* ) and 4 of ( $s* ) ) or ( all of ( $u* ) and 3 of ( $s* ) ) or ( 5 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cobaltstrike : FILE
 {
 	meta:
 		description = "CobaltStrike payload"
 		author = "ditekSHen"
-		id = "140e16d0-0102-5650-a371-c95013d7f021"
+		id = "14c7689e-39b5-5f2b-9383-d1d665392747"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1845-L1864"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "43513aef0ed715f0c214d7a14e465350f9c1bcadf87535e1c12561e976398bb3"
+		logic_hash = "v1_sha256_43513aef0ed715f0c214d7a14e465350f9c1bcadf87535e1c12561e976398bb3"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -248097,22 +246976,20 @@ rule DITEKSHEN_MALWARE_Win_Cobaltstrike : FILE
 		$pwsh2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or ( all of ($pwsh*) and 2 of ($s*)) or (#s9>6 and 4 of them ))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( all of ( $pwsh* ) and 2 of ( $s* ) ) or ( #s9 > 6 and 4 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Redlinedropperahk : FILE
 {
 	meta:
 		description = "Detects AutoIt/AutoHotKey executables dropping RedLine infostealer"
 		author = "ditekSHen"
-		id = "16eee826-f1fd-5a6f-b6f3-e02ccd889614"
+		id = "6aa7511a-0106-579d-a630-0791f3fc8382"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1866-L1878"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0950fe9daa02f3a8fd527f75275766111be7e8774578963b0bdb455800dfc4f9"
+		logic_hash = "v1_sha256_0950fe9daa02f3a8fd527f75275766111be7e8774578963b0bdb455800dfc4f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248125,22 +247002,20 @@ rule DITEKSHEN_MALWARE_Win_Redlinedropperahk : FILE
 		$s4 = ">AUTOHOTKEY SCRIPT<" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent01 : FILE
 {
 	meta:
 		description = "Detects known downloader agent"
 		author = "ditekSHen"
-		id = "85ead6fd-b56e-5e78-8fb4-7c9ecb4c0b58"
+		id = "36fd70df-eefd-59aa-85a7-7baa9a1684a7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1880-L1894"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7aec81655af9b779a314c3e2cff933aa6426fcfe21b5a87e60e159c7e7f5238a"
+		logic_hash = "v1_sha256_7aec81655af9b779a314c3e2cff933aa6426fcfe21b5a87e60e159c7e7f5238a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248155,22 +247030,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent01 : FILE
 		$s5 = "%d:%I64d:%I64d:%I64d" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_PLEAD : FILE
 {
 	meta:
 		description = "PLEAD Linux payload"
 		author = "ditekSHen"
-		id = "07aa0561-d6d9-53b6-97ac-670cdf04335d"
+		id = "377dd43f-8f1e-5977-b25a-cb370e2da878"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1896-L1920"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "539998248ded0eb8ea1702c527804f89cfd55412f17ec699bd0af801f4fba673"
+		logic_hash = "v1_sha256_539998248ded0eb8ea1702c527804f89cfd55412f17ec699bd0af801f4fba673"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248194,22 +247067,20 @@ rule DITEKSHEN_MALWARE_Linux_PLEAD : FILE
 		$s9 = "%s %s %s %s" ascii
 
 	condition:
-		uint16(0)==0x457f and ( all of ($x*) or all of ($s*) or 12 of them )
+		uint16( 0 ) == 0x457f and ( all of ( $x* ) or all of ( $s* ) or 12 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_CRAT : FILE
 {
 	meta:
 		description = "Detects CRAT main DLL"
 		author = "ditekSHen"
-		id = "9757a8de-61ea-55c0-b64c-055798450985"
+		id = "7de68105-d9cf-5027-8668-2828df9f4fba"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1922-L1944"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5a9fef68e110a1564dd5956408abcc3736cfa6853e1ac5510a089cc68f6bdc35"
+		logic_hash = "v1_sha256_5a9fef68e110a1564dd5956408abcc3736cfa6853e1ac5510a089cc68f6bdc35"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248232,22 +247103,20 @@ rule DITEKSHEN_MALWARE_Win_CRAT : FILE
 		$v2s_3 = "id=%u&content=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 6 of ($v2x*) or all of ($v2s*) or (2 of ($v2s*) and 4 of ($v2x*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 6 of ( $v2x* ) or all of ( $v2s* ) or ( 2 of ( $v2s* ) and 4 of ( $v2x* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cratpluginkeylogger : FILE
 {
 	meta:
 		description = "Detects CRAT keylogger plugin DLL"
 		author = "ditekSHen"
-		id = "a8682786-7704-56f0-a6df-b4e2ab4d7536"
+		id = "362e56ed-a5a9-54f0-8b32-529e72b5d16a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1946-L1962"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "58ef1f7466fcc871be2e74aa447c76970fd90c9d9d345a896fb8e6335114d189"
+		logic_hash = "v1_sha256_58ef1f7466fcc871be2e74aa447c76970fd90c9d9d345a896fb8e6335114d189"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248264,22 +247133,20 @@ rule DITEKSHEN_MALWARE_Win_Cratpluginkeylogger : FILE
 		$s4 = /KeyLog_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 5 of them )
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $ai* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $ai* ) ) or 5 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cratpluginclipboardmonitor : FILE
 {
 	meta:
 		description = "Detects CRAT Clipboad Monitor plugin DLL"
 		author = "ditekSHen"
-		id = "587487c7-f00b-5d4a-8b18-e46d6c6560e2"
+		id = "0d81e693-4f7c-515d-9475-d5a38732b044"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1964-L1979"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c3e692a06388e143a8e1053e75a6eb6a82da5bdf26d38e3a0e339bc20d8312a1"
+		logic_hash = "v1_sha256_c3e692a06388e143a8e1053e75a6eb6a82da5bdf26d38e3a0e339bc20d8312a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248295,22 +247162,20 @@ rule DITEKSHEN_MALWARE_Win_Cratpluginclipboardmonitor : FILE
 		$s4 = /ClipboardMonitor_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 5 of them )
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $ai* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $ai* ) ) or 5 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cratpluginscreencapture : FILE
 {
 	meta:
 		description = "Detects CRAT Screen Capture plugin DLL"
 		author = "ditekSHen"
-		id = "ef0b6b88-8b1b-5ab5-ad81-276eaff0411f"
+		id = "0ffa3eda-c0f8-5630-b203-ea53d8c0839a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1981-L2000"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7b4378ae883d01338fabe2eb50a5509b722c661e63afc287afa07b263a0ebc42"
+		logic_hash = "v1_sha256_7b4378ae883d01338fabe2eb50a5509b722c661e63afc287afa07b263a0ebc42"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248330,22 +247195,20 @@ rule DITEKSHEN_MALWARE_Win_Cratpluginscreencapture : FILE
 		$s8 = /ScreenCapture_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 6 of them )
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $ai* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $ai* ) ) or 6 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cratpluginransomhansom : FILE
 {
 	meta:
 		description = "Detects CRAT Hansom Ransomware plugin DLL"
 		author = "ditekSHen"
-		id = "0bfc97df-545f-5453-afe0-5777dc1c95b4"
+		id = "01aaca59-c6b7-5952-bace-536d37490102"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2002-L2020"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b22f6d22630f311241634513eb051df2b36af84a938c1ae1f5284e5a5d7d3077"
+		logic_hash = "v1_sha256_b22f6d22630f311241634513eb051df2b36af84a938c1ae1f5284e5a5d7d3077"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -248364,22 +247227,20 @@ rule DITEKSHEN_MALWARE_Win_Cratpluginransomhansom : FILE
 		$s7 = /Ransom_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($cmd*) and 2 of ($s*)) or (4 of ($s*) and 1 of ($cmd*)) or 6 of them )
+		uint16( 0 ) == 0x5a4d and ( ( 2 of ( $cmd* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) and 1 of ( $cmd* ) ) or 6 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Aliencrypter : FILE
 {
 	meta:
 		description = "Detects AlienCrypter injector/downloader/obfuscator"
 		author = "ditekSHen"
-		id = "af9e785a-bdec-5d3e-9a50-56f7f1a0507e"
+		id = "36bfaf16-24a7-5ec4-83a8-f8434a9767c5"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2022-L2036"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "28a2a6e6d58fd6efbb5753a7be5b621a3eac546d45f9481b9dd2641cbe70b547"
+		logic_hash = "v1_sha256_28a2a6e6d58fd6efbb5753a7be5b621a3eac546d45f9481b9dd2641cbe70b547"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248394,22 +247255,20 @@ rule DITEKSHEN_MALWARE_Win_Aliencrypter : FILE
 		$resp2 = "</p><p>@@@HH,JA," ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and 3 of them ) or (1 of ($resp*) and 2 of ($s*))
+		( uint16( 0 ) == 0x5a4d and 3 of them ) or ( 1 of ( $resp* ) and 2 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ficker : FILE
 {
 	meta:
 		description = "Detects Ficker infostealer"
 		author = "ditekSHen"
-		id = "1cfeea86-e8bf-50fb-ba08-435d7a14a913"
+		id = "ce56206e-f496-5daa-9042-209bcae35a00"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2038-L2055"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "adcc0ffc0e1ded36dc41c22d10d2ea293d5740484203892bcecf89a5f4001452"
+		logic_hash = "v1_sha256_adcc0ffc0e1ded36dc41c22d10d2ea293d5740484203892bcecf89a5f4001452"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248427,22 +247286,20 @@ rule DITEKSHEN_MALWARE_Win_Ficker : FILE
 		$s9 = "_matherr(): %s in %s(%g, %g)  (retval=%g)" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Xorist : FILE
 {
 	meta:
 		description = "Detects Xorist ransomware"
 		author = "ditekSHen"
-		id = "76119441-343d-51c3-90eb-9d54c80a983d"
+		id = "96e27290-c602-5eeb-babf-8579536121c0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2057-L2078"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b34e3fa065cabcd8d26908866e53ff599631128e1da884e42a2e63d890879eaa"
+		logic_hash = "v1_sha256_b34e3fa065cabcd8d26908866e53ff599631128e1da884e42a2e63d890879eaa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248464,22 +247321,20 @@ rule DITEKSHEN_MALWARE_Win_Xorist : FILE
 		$s6 = { 43 6f 6d 53 70 65 63 00 2f 63 20 64 65 6c 20 22 00 22 20 3e 3e 20 4e 55 4c }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 5 of ($s*) or (1 of ($x*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 5 of ( $s* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_PYSA : FILE
 {
 	meta:
 		description = "Detects PYSA/Mespinoza ransomware"
 		author = "ditekSHen"
-		id = "3a3fad6a-46bc-51dc-9723-4412034ca442"
+		id = "dcd9f0b9-1da0-522a-90ef-b30949fa7ac1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2080-L2100"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e614b827bd8d065e94852fed01497c785bf90c52c3624aff9939b3f40ecf96a4"
+		logic_hash = "v1_sha256_e614b827bd8d065e94852fed01497c785bf90c52c3624aff9939b3f40ecf96a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248500,22 +247355,20 @@ rule DITEKSHEN_MALWARE_Win_PYSA : FILE
 		$f3 = "@VTF_EncryptorBase@CryptoPP@@" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($f*) and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and all of ( $f* ) and 3 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Polar : FILE
 {
 	meta:
 		description = "Detects Polar ransomware"
 		author = "ditekSHen"
-		id = "ab4e4478-5417-5918-b5df-5b6ffe7438a9"
+		id = "36d3357f-2e8a-5922-939d-2f3138964eeb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2102-L2123"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4f05a8ace9a03d02f54f0ebdd5349d1d1b23db8e34aa71edd44eebf02b88745c"
+		logic_hash = "v1_sha256_4f05a8ace9a03d02f54f0ebdd5349d1d1b23db8e34aa71edd44eebf02b88745c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248537,22 +247390,20 @@ rule DITEKSHEN_MALWARE_Win_Polar : FILE
 		$pdb2 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x64\\Release\\Encode.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (8 of ($s*) or (1 of ($pdb*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 1 of ( $pdb* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bitrat : FILE
 {
 	meta:
 		description = "Detects BitRAT RAT"
 		author = "ditekSHen"
-		id = "9041a21f-0f27-5e90-8429-863e361381bf"
+		id = "668605cd-e47c-546e-bed1-624562ce5814"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2125-L2153"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "128c3c8cea0439f272de241c77fc9ed46e64419e497091e444e98123dad059cb"
+		logic_hash = "v1_sha256_128c3c8cea0439f272de241c77fc9ed46e64419e497091e444e98123dad059cb"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -248581,22 +247432,20 @@ rule DITEKSHEN_MALWARE_Win_Bitrat : FILE
 		$t2 = "<silent>N/A</silent>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or (4 of ($s*) and 1 of ($t*)))
+		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 4 of ( $s* ) and 1 of ( $t* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Poullight : FILE
 {
 	meta:
 		description = "Detects Poullight infostealer"
 		author = "ditekSHen"
-		id = "c80143f8-9c44-5e96-b1ff-2adb4bf031e4"
+		id = "f7386727-7997-5e5f-8525-d21246b1f0a1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2155-L2176"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e60ffb10892d35664a088d69c965e130f87bb1a59c257d484bdfe5085074bccd"
+		logic_hash = "v1_sha256_e60ffb10892d35664a088d69c965e130f87bb1a59c257d484bdfe5085074bccd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248618,22 +247467,20 @@ rule DITEKSHEN_MALWARE_Win_Poullight : FILE
 		$s11 = "{0}Browsers\\Passwords.txt" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Snakekeylogger : FILE
 {
 	meta:
 		description = "Detects Snake Keylogger"
 		author = "ditekSHen"
-		id = "e44bf33c-916d-5dc3-ba2a-89e13f1511a2"
+		id = "712849ed-ae40-586d-985d-c631c6bee979"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2178-L2207"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7d787026b290c3c6a43c7de83233f22980733e7401260ff2f763e6f1b534ecba"
+		logic_hash = "v1_sha256_7d787026b290c3c6a43c7de83233f22980733e7401260ff2f763e6f1b534ecba"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -248662,22 +247509,20 @@ rule DITEKSHEN_MALWARE_Win_Snakekeylogger : FILE
 		$m4 = "\\SnakeKeylogger\\" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and ( all of ($id*) or 6 of ($s*) or (1 of ($id*) and 3 of ($s*)) or 4 of ($x*))) or (2 of ($m*))
+		( uint16( 0 ) == 0x5a4d and ( all of ( $id* ) or 6 of ( $s* ) or ( 1 of ( $id* ) and 3 of ( $s* ) ) or 4 of ( $x* ) ) ) or ( 2 of ( $m* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Xorddos : FILE
 {
 	meta:
 		description = "Detects XORDDoS"
 		author = "ditekSHen"
-		id = "0ca581c3-bce2-5b4f-8146-9aeb49b88813"
+		id = "3e9fa52a-4497-5457-a49d-93839335ec0f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2209-L2220"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "192378d903316c1d80b064e78feb6ed9d2ffc9e6c7dc0c8df223d83d17e4e8d9"
+		logic_hash = "v1_sha256_192378d903316c1d80b064e78feb6ed9d2ffc9e6c7dc0c8df223d83d17e4e8d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248689,22 +247534,20 @@ rule DITEKSHEN_MALWARE_Linux_Xorddos : FILE
 		$s4 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)" fullword ascii
 
 	condition:
-		uint32(0)==0x464c457f and 3 of them
+		uint32( 0 ) == 0x464c457f and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Blacknet : FILE
 {
 	meta:
 		description = "Detects BlackNET RAT"
 		author = "ditekSHen"
-		id = "c1ece46a-3cd9-54aa-a105-1c5b19357a7e"
+		id = "b60183d8-6b2a-523f-83c5-f7031dfd93f3"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2222-L2250"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "64e00325a5a6a595067c6133800e73d943f45e2783475c24ed4a9bd9937fe0d6"
+		logic_hash = "v1_sha256_64e00325a5a6a595067c6133800e73d943f45e2783475c24ed4a9bd9937fe0d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248733,22 +247576,20 @@ rule DITEKSHEN_MALWARE_Win_Blacknet : FILE
 		$cnc4 = "/receive.php?command=" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (9 of ($s*) or all of ($cnc*) or all of ($b*) or 12 of them )
+		uint16( 0 ) == 0x5a4d and ( 9 of ( $s* ) or all of ( $cnc* ) or all of ( $b* ) or 12 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Stormkitty : FILE
 {
 	meta:
 		description = "Detects StormKitty infostealer"
 		author = "ditekSHen"
-		id = "a061a1c0-9ed5-5048-85df-4d7ed6995e92"
+		id = "67b37080-96a4-5d1c-b8d4-369540643827"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2252-L2269"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5d139aad6932f177cd14e0356f822ad68ddc659ea4fabd2fd2fbcbc8bad58888"
+		logic_hash = "v1_sha256_5d139aad6932f177cd14e0356f822ad68ddc659ea4fabd2fd2fbcbc8bad58888"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248766,7 +247607,7 @@ rule DITEKSHEN_MALWARE_Win_Stormkitty : FILE
 		$s6 = "\"encrypted_key\":\"(.*?)\"" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 5 of ($s*) or (3 of ($s*) and 1 of ($x*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 5 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $x* ) ) )
 }
 import "pe"
 
@@ -248775,13 +247616,13 @@ rule DITEKSHEN_MALWARE_Win_Bulz01 : FILE
 	meta:
 		description = "Detects trojan loader"
 		author = "ditekSHen"
-		id = "4ac4125b-70f5-5cda-ae45-fd5713e25a6e"
+		id = "c114b884-b3d3-5781-b5ba-8fe0560d49b0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2271-L2281"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "29884dda4936016660f5d1e33ffcf97a20c7d3116483a5895a5e2a1dd4ac9e9f"
+		logic_hash = "v1_sha256_29884dda4936016660f5d1e33ffcf97a20c7d3116483a5895a5e2a1dd4ac9e9f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248790,22 +247631,20 @@ rule DITEKSHEN_MALWARE_Win_Bulz01 : FILE
 		$s1 = "DisableTrivet.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and all of ($s*) and (pe.exports("Ordinal") or pe.exports("Chechako") or pe.exports("Originator") or pe.exports("Repressions"))
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and all of ( $s* ) and ( pe.exports ( "Ordinal" ) or pe.exports ( "Chechako" ) or pe.exports ( "Originator" ) or pe.exports ( "Repressions" ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Revcoderat : FILE
 {
 	meta:
 		description = "Detects RevCode/WebMonitor RAT"
 		author = "ditekSHen"
-		id = "4acf6742-7f5c-5126-89cc-b39b1acd922e"
+		id = "d9b7f77d-7788-5fd4-a156-27c7ad2a0f56"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2283-L2332"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e5bf1ce79b7955f597df1a9e361a3be892de55cd3db767278d4ccc02ace9e9f5"
+		logic_hash = "v1_sha256_e5bf1ce79b7955f597df1a9e361a3be892de55cd3db767278d4ccc02ace9e9f5"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -248853,22 +247692,20 @@ rule DITEKSHEN_MALWARE_Win_Revcoderat : FILE
 		$cnc12 = "&key=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or all of ($cnc*) or 8 of ($s*) or (1 of ($x*) and 6 of ($s*)) or (6 of ($cnc*) and 6 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or all of ( $cnc* ) or 8 of ( $s* ) or ( 1 of ( $x* ) and 6 of ( $s* ) ) or ( 6 of ( $cnc* ) and 6 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Powerpool_STG1 : FILE
 {
 	meta:
 		description = "Detects first stage PowerPool backdoor"
 		author = "ditekSHen"
-		id = "8531c22d-8d71-5794-b9c8-0a4cd81bb2b0"
+		id = "b52e9c4f-c1f7-54fd-8d7a-a4814910381c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2334-L2361"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9ab00d6e3007743a8bb30fbcdb435ac49101b52face55549ae454c64345caff9"
+		logic_hash = "v1_sha256_9ab00d6e3007743a8bb30fbcdb435ac49101b52face55549ae454c64345caff9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248896,22 +247733,20 @@ rule DITEKSHEN_MALWARE_Win_Powerpool_STG1 : FILE
 		$c5 = "185.227.82.35" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($c*) and 5 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $c* ) and 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Powerpool_STG2 : FILE
 {
 	meta:
 		description = "Detects second stage PowerPool backdoor"
 		author = "ditekSHen"
-		id = "1a059900-3292-5419-a143-caea3e710191"
+		id = "192e49cc-0665-54ce-b414-0294843e435d"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2363-L2395"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b80712bab281dbde816e2eda6ab1b4a9e21be26578fb755a1e1e1635675aa911"
+		logic_hash = "v1_sha256_b80712bab281dbde816e2eda6ab1b4a9e21be26578fb755a1e1e1635675aa911"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -248944,7 +247779,7 @@ rule DITEKSHEN_MALWARE_Win_Powerpool_STG2 : FILE
 		$s22 = "add cookie failed..." ascii
 
 	condition:
-		uint16(0)==0x5a4d and 14 of them
+		uint16( 0 ) == 0x5a4d and 14 of them
 }
 import "pe"
 
@@ -248953,13 +247788,13 @@ rule DITEKSHEN_MALWARE_Win_Egregor : FILE
 	meta:
 		description = "Detects Egregor ransomware variants"
 		author = "ditekSHen"
-		id = "2e24d4ec-39c2-5148-80a1-04f96bc8b477"
+		id = "1879259d-9e72-5807-a421-679e309107f4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2397-L2434"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d39a7bf89a7574f7dfe56db78c8cdbbee97782f829805d4ee87fd9f1635154cd"
+		logic_hash = "v1_sha256_d39a7bf89a7574f7dfe56db78c8cdbbee97782f829805d4ee87fd9f1635154cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -248987,7 +247822,7 @@ rule DITEKSHEN_MALWARE_Win_Egregor : FILE
 		$p18 = "--greetings" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and pe.is_dll() and (( all of ($s*) and 1 of ($p*)) or (2 of them and filesize <1000KB and for any i in (0..pe.number_of_sections) : ((pe.sections[i].name==".00cfg"))))) or 8 of ($p*)
+		( uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and ( ( all of ( $s* ) and 1 of ( $p* ) ) or ( 2 of them and filesize < 1000KB and for any i in ( 0 .. pe.number_of_sections ) : ( ( pe.sections [ i ] . name == ".00cfg" ) ) ) ) ) or 8 of ( $p* )
 }
 import "pe"
 
@@ -248996,13 +247831,13 @@ rule DITEKSHEN_MALWARE_Win_Redlinedropperexe : FILE
 	meta:
 		description = "Detects executables dropping RedLine infostealer"
 		author = "ditekSHen"
-		id = "364ba540-60a5-5e1b-bb21-505a442eabb6"
+		id = "bbeed423-2ffb-5ba4-984c-849a8cf82fa8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2461-L2484"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cd1fb4a1d0883221dbdcc519db7f54b0f7285e8a19201dbc586c2520e8086bc2"
+		logic_hash = "v1_sha256_cd1fb4a1d0883221dbdcc519db7f54b0f7285e8a19201dbc586c2520e8086bc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249018,22 +247853,20 @@ rule DITEKSHEN_MALWARE_Win_Redlinedropperexe : FILE
 		$s7 = "Yikezevavuzus gucajanesan#Rolapucededoxu xewulep fuwehofiwifi" wide
 
 	condition:
-		uint16(0)==0x5a4d and (pe.exports("_fgeek@8") and 2 of them ) or (2 of them and for any i in (0..pe.number_of_sections) : ((pe.sections[i].name==".rig")))
+		uint16( 0 ) == 0x5a4d and ( pe.exports ( "_fgeek@8" ) and 2 of them ) or ( 2 of them and for any i in ( 0 .. pe.number_of_sections ) : ( ( pe.sections [ i ] . name == ".rig" ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nibiru : FILE
 {
 	meta:
 		description = "Detects Nibiru ransomware"
 		author = "ditekSHen"
-		id = "78c3bf75-1ab3-5f88-ba4b-d5a0a906d57c"
+		id = "1e58fb50-300b-59ae-bb00-4169d5b49963"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2486-L2504"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f3718e9091b09e0f47ecd6715a3a2c160ede6ab9fb144e7ed115dd5a25c8e379"
+		logic_hash = "v1_sha256_f3718e9091b09e0f47ecd6715a3a2c160ede6ab9fb144e7ed115dd5a25c8e379"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249052,22 +247885,20 @@ rule DITEKSHEN_MALWARE_Win_Nibiru : FILE
 		$pdb = "\\Projects\\Nibiru\\Nibiru\\obj\\x86\\Release\\Nibiru.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (7 of them or ($pdb and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 7 of them or ( $pdb and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Medusalocker : FILE
 {
 	meta:
 		description = "Detects MedusaLocker ransomware"
 		author = "ditekshen"
-		id = "06b7645f-228d-5ec1-9b82-88caee447a5c"
+		id = "2f2df686-afba-5c4d-bc05-0f4eb84c2603"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2506-L2537"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0e2a0a9f12f550a5c6a11731710e0dc2c2e26d17f43d2385bf6e298518631771"
+		logic_hash = "v1_sha256_0e2a0a9f12f550a5c6a11731710e0dc2c2e26d17f43d2385bf6e298518631771"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -249099,22 +247930,20 @@ rule DITEKSHEN_MALWARE_Win_Medusalocker : FILE
 		$ext2 = ".exe,.dll,.sys,.ini,.lnk,.rdp,.encrypted" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and (4 of ($s*) or 1 of ($mut*))) or 6 of ($s*) or (1 of ($mut*) and 2 of ($cmd*)) or (1 of ($ext*) and 5 of them ))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and ( 4 of ( $s* ) or 1 of ( $mut* ) ) ) or 6 of ( $s* ) or ( 1 of ( $mut* ) and 2 of ( $cmd* ) ) or ( 1 of ( $ext* ) and 5 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ransomexx : FILE
 {
 	meta:
 		description = "Detects RansomEXX ransomware"
 		author = "ditekshen"
-		id = "4d1294de-d73c-5f9c-adb7-18ce5b5aca9f"
+		id = "f589b237-ad04-5942-9e4e-6a91890b8877"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2539-L2555"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "351398d89b847b3439fa58b7aab50f3c6e48be27877d3f8b85cc78e994413ecc"
+		logic_hash = "v1_sha256_351398d89b847b3439fa58b7aab50f3c6e48be27877d3f8b85cc78e994413ecc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249131,22 +247960,20 @@ rule DITEKSHEN_MALWARE_Win_Ransomexx : FILE
 		$s7 = "?ReflectiveLoader@@" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (($id and 3 of ($s*)) or all of ($*))
+		uint16( 0 ) == 0x5a4d and ( ( $id and 3 of ( $s* ) ) or all of ( $* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Quasarstealer : FILE
 {
 	meta:
 		description = "Detects Quasar infostealer"
 		author = "ditekshen"
-		id = "d0d532fe-bd0a-560a-8570-f6038d694338"
+		id = "13a995f1-e2bb-59d7-af01-c2904143e235"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2557-L2572"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4b6ab49992db4d7bf4404d51b0ef1773249de89545ec31176ad45d00803ba703"
+		logic_hash = "v1_sha256_4b6ab49992db4d7bf4404d51b0ef1773249de89545ec31176ad45d00803ba703"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249162,22 +247989,20 @@ rule DITEKSHEN_MALWARE_Win_Quasarstealer : FILE
 		$s7 = "BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bandook : FILE
 {
 	meta:
 		description = "Detects Bandook backdoor"
 		author = "ditekshen"
-		id = "c74bd688-c79e-5939-93a8-c2cd9f2cd60e"
+		id = "dfe3d465-a35c-5a88-99d2-3244efd6b687"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2676-L2705"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bff09f769aae890d81efe9926cc8ce85c1caa4eeeb6bc7d2321d2d906ac8d6cf"
+		logic_hash = "v1_sha256_bff09f769aae890d81efe9926cc8ce85c1caa4eeeb6bc7d2321d2d906ac8d6cf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249205,22 +248030,20 @@ rule DITEKSHEN_MALWARE_Win_Bandook : FILE
 		$x2 = "AVE_MARIA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 6 of ($f*) or (2 of ($s*) and 3 of ($f*)) or ( all of ($x*) and (2 of ($f*) or 3 of ($s*))))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 6 of ( $f* ) or ( 2 of ( $s* ) and 3 of ( $f* ) ) or ( all of ( $x* ) and ( 2 of ( $f* ) or 3 of ( $s* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Kimsuky : FILE
 {
 	meta:
 		description = "Detects Kimsuky backdoor"
 		author = "ditekshen"
-		id = "6216b874-13f1-5283-9d17-90b7ca6996f8"
+		id = "83eda82f-053c-5993-902e-40f4eee36dfb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2707-L2730"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9f9e64a9cfb3f61bc6b355035c5f0644e4750b740e05cb557c6183c7acfc5a19"
+		logic_hash = "v1_sha256_9f9e64a9cfb3f61bc6b355035c5f0644e4750b740e05cb557c6183c7acfc5a19"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249244,22 +248067,20 @@ rule DITEKSHEN_MALWARE_Win_Kimsuky : FILE
 		$dll2 = "dropper-ie64.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($dll*) and 7 of ($s*)) or (11 of ($*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $dll* ) and 7 of ( $s* ) ) or ( 11 of ( $* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent03 : FILE
 {
 	meta:
 		description = "Detects known Delphi downloader agent downloading second stage payload, notably from discord"
 		author = "ditekSHen"
-		id = "18493e3d-224f-5000-8e44-9ffda9c65cf0"
+		id = "94e58461-0753-5d56-8fd6-90364b2ffb5e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2732-L2753"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dea63edd48759fd04875e2eb8ac8b00ff801767f071337c667e31c15f0925cdc"
+		logic_hash = "v1_sha256_dea63edd48759fd04875e2eb8ac8b00ff801767f071337c667e31c15f0925cdc"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -249278,22 +248099,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent03 : FILE
 		$url3 = "http://www.xboxharddrive.com" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($delph*) and 1 of ($url*) and ( all of ($v1*) or 1 of ($v2*))
+		uint16( 0 ) == 0x5a4d and 1 of ( $delph* ) and 1 of ( $url* ) and ( all of ( $v1* ) or 1 of ( $v2* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Salfram : FILE
 {
 	meta:
 		description = "Detects Salfram executables"
 		author = "ditekSHen"
-		id = "323e1c8e-2184-5831-9af5-a460c55fbf7c"
+		id = "ec0f197b-5ca8-5709-a9e9-17700867a1ec"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2755-L2766"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "19d7934727baa870dcd3ec77ba596cd64e49763477ba3feb7baec5ab6d3866d3"
+		logic_hash = "v1_sha256_19d7934727baa870dcd3ec77ba596cd64e49763477ba3feb7baec5ab6d3866d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249305,22 +248124,20 @@ rule DITEKSHEN_MALWARE_Win_Salfram : FILE
 		$s1 = "!This Salfram cannot be run in DOS mode." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Hawkeyev9
 {
 	meta:
 		description = "Detects HawkEyeV9 payload"
 		author = "ditekshen"
-		id = "ca59aa45-fb55-5f9a-a224-8bd2b72ce5ac"
+		id = "d84893ad-fcf4-594c-a000-1ab1fe6ea94c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2768-L2793"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d24111930dd0230c01963a90c9fbbc0a0a71df170c2ca116bb329e6158cb681c"
+		logic_hash = "v1_sha256_d24111930dd0230c01963a90c9fbbc0a0a71df170c2ca116bb329e6158cb681c"
 		score = 75
 		quality = 75
 		tags = ""
@@ -249346,22 +248163,20 @@ rule DITEKSHEN_MALWARE_Win_Hawkeyev9
 		$str15 = "_InstallStartupPersistance" ascii
 
 	condition:
-		int16 (0)==0x5a4d and (1 of ($id*) or 5 of ($str*))
+		int16 ( 0 ) == 0x5a4d and ( 1 of ( $id* ) or 5 of ( $str* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Hyperbro : FILE
 {
 	meta:
 		description = "Detects HyperBro (class names) payload"
 		author = "ditekSHen"
-		id = "539b796d-297b-5e2f-84df-282ceaa57bd4"
+		id = "1709d554-1f1b-5db1-be45-d01536242806"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2795-L2813"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f6e86ef963de885e0bf92ead075e265618c0745104d223302edd824d409c45cd"
+		logic_hash = "v1_sha256_f6e86ef963de885e0bf92ead075e265618c0745104d223302edd824d409c45cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249380,22 +248195,20 @@ rule DITEKSHEN_MALWARE_Win_Hyperbro : FILE
 		$s10 = "VTFileDataRes" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 9 of them
+		uint16( 0 ) == 0x5a4d and 9 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_UNK01 : FILE
 {
 	meta:
 		description = "Detects unknown/unidentified Linux malware"
 		author = "ditekSHen"
-		id = "24c6ff35-9378-5a6b-90d1-9740917b1b72"
+		id = "d0f4a500-9cfe-5959-967d-edbf467e1250"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2815-L2836"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8bb4822c1c7e0f52726ecafafa696d83c741257587f351360c5295163c245450"
+		logic_hash = "v1_sha256_8bb4822c1c7e0f52726ecafafa696d83c741257587f351360c5295163c245450"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249417,22 +248230,20 @@ rule DITEKSHEN_MALWARE_Linux_UNK01 : FILE
 		$s9 = "&mac[]=%02X%02X%02X%02X%02X%02X" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and (3 of ($f*) or 6 of ($s*))
+		uint16( 0 ) == 0x457f and ( 3 of ( $f* ) or 6 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_UNK02 : FILE
 {
 	meta:
 		description = "Detects unknown/unidentified Linux malware"
 		author = "ditekSHen"
-		id = "6e62df0d-d329-5e52-af74-2a1f19dc4cca"
+		id = "78786459-ac9f-5c07-baf1-7b0cbb019646"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2838-L2852"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4cde21932c27fe3c08495f557b5e086b1fb668d8b5508249891828b9ed48edd4"
+		logic_hash = "v1_sha256_4cde21932c27fe3c08495f557b5e086b1fb668d8b5508249891828b9ed48edd4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249447,22 +248258,20 @@ rule DITEKSHEN_MALWARE_Linux_UNK02 : FILE
 		$f5 = "libnss_%s.so.%d.%d" ascii fullword
 
 	condition:
-		uint16(0)==0x457f and ( all of ($f*) and #rf1>3 and #rf2>3)
+		uint16( 0 ) == 0x457f and ( all of ( $f* ) and #rf1 > 3 and #rf2 > 3 )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Itranslatorexe : FILE
 {
 	meta:
 		description = "Detects iTranslator EXE payload"
 		author = "ditekSHen"
-		id = "763e8fa4-cf5c-54bc-9310-4e4171bf5a71"
+		id = "53c4ef66-c889-58b1-b0b8-3620fda3887b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2854-L2874"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3c796d58cdf2d4dc4c838d05fb862640c7f9de6c7e8ebb5fb0002821354208d9"
+		logic_hash = "v1_sha256_3c796d58cdf2d4dc4c838d05fb862640c7f9de6c7e8ebb5fb0002821354208d9"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -249483,22 +248292,20 @@ rule DITEKSHEN_MALWARE_Win_Itranslatorexe : FILE
 		$s12 = "&x=32" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of ($s*)
+		uint16( 0 ) == 0x5a4d and 8 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Itranslatordll : FILE
 {
 	meta:
 		description = "Detects iTranslator DLL payload"
 		author = "ditekSHen"
-		id = "df05da78-3626-5eb5-81a2-a93fba844484"
+		id = "0a58eb2f-293b-599a-9d78-d01deb69d11e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2876-L2892"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ca0479efd241058f358553b6382a1987a5b4c069965f4adb88cd2f3fc4bef21a"
+		logic_hash = "v1_sha256_ca0479efd241058f358553b6382a1987a5b4c069965f4adb88cd2f3fc4bef21a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249515,22 +248322,20 @@ rule DITEKSHEN_MALWARE_Win_Itranslatordll : FILE
 		$d8 = ".php" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWWARE_Win_Octopus : FILE
 {
 	meta:
 		description = "Detects Octopus trojan payload"
 		author = "ditekSHen"
-		id = "eb092e23-864f-52f3-bfa4-7e3c616d3984"
+		id = "7a10e86b-c15b-5f9a-a65b-c83f414eef05"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2894-L2917"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "012b75c94be3021dbcc5b8e8bd62f807c9aa8bc0df94f830a5294aaf0d21b9fc"
+		logic_hash = "v1_sha256_012b75c94be3021dbcc5b8e8bd62f807c9aa8bc0df94f830a5294aaf0d21b9fc"
 		score = 75
 		quality = 23
 		tags = "FILE"
@@ -249554,22 +248359,20 @@ rule DITEKSHEN_MALWWARE_Win_Octopus : FILE
 		$wq7 = "path win32_physicalmedia" wide
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) and 5 of ($wq*))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) and 5 of ( $wq* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Caspertroy : FILE
 {
 	meta:
 		description = "Detects CasperTroy payload"
 		author = "ditekSHen"
-		id = "822c3231-60ba-5e60-8df8-06dea80b318a"
+		id = "7f3db099-d102-53e0-9d30-bd1354b1fd14"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2919-L2931"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ce070b1e6279ef9fa47f84da7c5166cd93b3e7a0f95541ae14c048b2af9bc431"
+		logic_hash = "v1_sha256_ce070b1e6279ef9fa47f84da7c5166cd93b3e7a0f95541ae14c048b2af9bc431"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249582,22 +248385,20 @@ rule DITEKSHEN_MALWARE_Win_Caspertroy : FILE
 		$s5 = "Content-Disposition: form-data; name=\"SESS_ID\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Rasftuby : FILE
 {
 	meta:
 		description = "Detects Rasftuby/DarkCrystal"
 		author = "ditekSHen"
-		id = "908624a8-0068-5512-a5d0-77ce1f4efd80"
+		id = "538b4094-4248-5812-a6be-33dab5d47f78"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2933-L2950"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b769c1986d23173cf8a8a3c8a14d388a7c0327e46d936fc97c449dc55f2a5575"
+		logic_hash = "v1_sha256_b769c1986d23173cf8a8a3c8a14d388a7c0327e46d936fc97c449dc55f2a5575"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249615,22 +248416,20 @@ rule DITEKSHEN_MALWARE_Win_Rasftuby : FILE
 		$s9 = "DCS.Internal" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and 5 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Protonbot : FILE
 {
 	meta:
 		description = "Detects ProtonBot loader"
 		author = "ditekSHen"
-		id = "b0d08378-0297-5e70-99f1-1dc0fec6fa01"
+		id = "330c9d1d-7042-57d8-8892-e7cd9f44d2fe"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2952-L2969"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b511dfd47109d36ffc7fcb23b49779e1164d50a28061ab724d7a2c744ac23ac8"
+		logic_hash = "v1_sha256_b511dfd47109d36ffc7fcb23b49779e1164d50a28061ab724d7a2c744ac23ac8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249648,22 +248447,20 @@ rule DITEKSHEN_MALWARE_Win_Protonbot : FILE
 		$s6 = "urlmon.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or ( all of ($s*) and 1 of ($x*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( all of ( $s* ) and 1 of ( $x* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Imminentrat : FILE
 {
 	meta:
 		description = "Detects ImminentRAT"
 		author = "ditekSHen"
-		id = "99831b32-d8a0-5814-bf41-491f607ee825"
+		id = "a8faa399-b7b4-5f76-811b-01797e30e690"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2971-L2994"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f959fd28e818b17c962fcd5bb99fa5ac0058f22494950e0200f139703f3e756a"
+		logic_hash = "v1_sha256_f959fd28e818b17c962fcd5bb99fa5ac0058f22494950e0200f139703f3e756a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249687,22 +248484,20 @@ rule DITEKSHEN_MALWARE_Win_Imminentrat : FILE
 		$s11 = "Couldn't get FW!" wide
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($x*) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Warzonerat : FILE
 {
 	meta:
 		description = "Detects AveMaria/WarzoneRAT"
 		author = "ditekSHen"
-		id = "4f3df696-280c-5f2b-9511-8cc7c9dff1d6"
+		id = "db74554d-fa95-551c-b116-bd679c394e8b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2996-L3011"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1af8b0f90b0de3287499082a6d6d9da6ed62a3110018e0c0f7149353693060b2"
+		logic_hash = "v1_sha256_1af8b0f90b0de3287499082a6d6d9da6ed62a3110018e0c0f7149353693060b2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249718,22 +248513,20 @@ rule DITEKSHEN_MALWARE_Win_Warzonerat : FILE
 		$s8 = "warzone160" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and 5 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Karaganycore : FILE
 {
 	meta:
 		description = "Detects Karagany/xFrost core plugin"
 		author = "ditekSHen"
-		id = "c066805b-9373-5524-aff9-d16cd59f5a24"
+		id = "c39607c1-185a-5e5b-92c5-c71537e9818c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3013-L3027"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cde96ac6477fda1312ce4f7532018c9f11df7d39c40155d10bdde0e3d84c6d57"
+		logic_hash = "v1_sha256_cde96ac6477fda1312ce4f7532018c9f11df7d39c40155d10bdde0e3d84c6d57"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249748,22 +248541,20 @@ rule DITEKSHEN_MALWARE_Win_Karaganycore : FILE
 		$s7 = "<supportedOS Id=\"{" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Karaganykeylogger : FILE
 {
 	meta:
 		description = "Detects Karagany/xFrost keylogger plugin"
 		author = "ditekSHen"
-		id = "dd14ede0-7132-5b7f-872a-d96d5275a8e4"
+		id = "7f0db4f0-4b2b-5bae-99dc-05a2173304fd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3029-L3041"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7f1f5b2ca67e62380c8a8095fed4a4fd76d7bc15c9fe2d76e780ad85f886ef7b"
+		logic_hash = "v1_sha256_7f1f5b2ca67e62380c8a8095fed4a4fd76d7bc15c9fe2d76e780ad85f886ef7b"
 		score = 75
 		quality = 23
 		tags = "FILE"
@@ -249776,22 +248567,20 @@ rule DITEKSHEN_MALWARE_Win_Karaganykeylogger : FILE
 		$s5 = "\\Update\\Tmp" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Karaganyscreenutil : FILE
 {
 	meta:
 		description = "Detects Karagany/xFrost ScreenUtil module"
 		author = "ditekSHen"
-		id = "5eab1bb9-a433-54e6-963b-4aca863dc73f"
+		id = "b39a2a10-7faf-506d-b7dc-73da7c6a567f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3043-L3055"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d10230d94adfdddd604e2569ae3323efa1d5722647b9c704fceefe9446ccebd1"
+		logic_hash = "v1_sha256_d10230d94adfdddd604e2569ae3323efa1d5722647b9c704fceefe9446ccebd1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249804,22 +248593,20 @@ rule DITEKSHEN_MALWARE_Win_Karaganyscreenutil : FILE
 		$s5 = "\\Update\\Tmp" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Karaganylistrix : FILE
 {
 	meta:
 		description = "Detects Karagany/xFrost Listrix module"
 		author = "ditekSHen"
-		id = "837cc9e7-eefb-530c-854b-51bb4444ae78"
+		id = "b790a0f5-41da-57d6-9aff-61e1c9188e35"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3057-L3069"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "02216061dbe93b7bea108f4b27c052d87c14cfe9395c6c5d4eed46ed7819e7ae"
+		logic_hash = "v1_sha256_02216061dbe93b7bea108f4b27c052d87c14cfe9395c6c5d4eed46ed7819e7ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249832,22 +248619,20 @@ rule DITEKSHEN_MALWARE_Win_Karaganylistrix : FILE
 		$s5 = "/c del" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Osx_Macsearch : FILE
 {
 	meta:
 		description = "Detects MacSearch adware"
 		author = "ditekSHen"
-		id = "facdf05c-5ee4-54c6-9ca3-01978af2b6e6"
+		id = "92ec8a7d-df57-52ae-a823-431fab6d67af"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3071-L3092"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "973b7215fc8d04685a46d05b53b4092e7b81ed0d64d6982b534f2b89d0a59443"
+		logic_hash = "v1_sha256_973b7215fc8d04685a46d05b53b4092e7b81ed0d64d6982b534f2b89d0a59443"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -249869,22 +248654,20 @@ rule DITEKSHEN_MALWARE_Osx_Macsearch : FILE
 		$s14 = "/safefinder.build/Release/macsearch.build/" ascii
 
 	condition:
-		uint16(0)==0xfacf and 10 of them
+		uint16( 0 ) == 0xfacf and 10 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Osx_Genieo : FILE
 {
 	meta:
 		description = "Detects LinqurySearch/Genieo adware"
 		author = "ditekSHen"
-		id = "ac44eefd-bf1c-5d4b-bcd4-9a5d394ac1d3"
+		id = "3694ef5c-a58f-5dc1-8437-b0395178eed4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3094-L3112"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "951dc8539435a52d9eea00b3fdaf98cf618c03867066819f2f9244165e57c675"
+		logic_hash = "v1_sha256_951dc8539435a52d9eea00b3fdaf98cf618c03867066819f2f9244165e57c675"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249903,22 +248686,20 @@ rule DITEKSHEN_MALWARE_Osx_Genieo : FILE
 		$s10 = /LinqurySearch-[a-f0-9]{40,}/
 
 	condition:
-		uint16(0)==0xfacf and 6 of them
+		uint16( 0 ) == 0xfacf and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Osx_AMCPCVARK : FILE
 {
 	meta:
 		description = "Detects OSX TechyUtils/PCVARK adware"
 		author = "ditekSHen"
-		id = "1378364b-db10-5194-98f8-5347504a92e6"
+		id = "4875c144-1da2-5cb8-8659-b40e01f204a1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3114-L3139"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b18a9f578af98feb5107d9ef85850457ba5921ab58af7b097a815e3af74f05f7"
+		logic_hash = "v1_sha256_b18a9f578af98feb5107d9ef85850457ba5921ab58af7b097a815e3af74f05f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -249941,22 +248722,20 @@ rule DITEKSHEN_MALWARE_Osx_AMCPCVARK : FILE
 		$developerid = "Developer ID Application: Rahul Gahlot (RZ74UYT742)" ascii
 
 	condition:
-		uint16(0)==0xfacf and (6 of ($s*) or 2 of ($cnc*) or all of ($x*) or $developerid)
+		uint16( 0 ) == 0xfacf and ( 6 of ( $s* ) or 2 of ( $cnc* ) or all of ( $x* ) or $developerid )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Osx_Realtimespy : FILE
 {
 	meta:
 		description = "Detects macOS RealtimeSpy monitoring app"
 		author = "ditekSHen"
-		id = "6485abf3-896c-54cd-ad84-7bd86456e47b"
+		id = "53afca5a-0604-51b2-b289-f53abeba414f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3141-L3166"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4ef2e1b8d34962cd3eab23f401b764b38b8332233aa2ae91b218af499d8ab8ff"
+		logic_hash = "v1_sha256_4ef2e1b8d34962cd3eab23f401b764b38b8332233aa2ae91b218af499d8ab8ff"
 		score = 75
 		quality = 57
 		tags = "FILE"
@@ -249981,22 +248760,20 @@ rule DITEKSHEN_MALWARE_Osx_Realtimespy : FILE
 		$c9 = "_OBJC_CLASS_$_WebsiteLogger" fullword ascii
 
 	condition:
-		uint16(0)==0xfacf and (2 of ($x*) or 2 of ($c*))
+		uint16( 0 ) == 0xfacf and ( 2 of ( $x* ) or 2 of ( $c* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Osx_Maxofferdeal : FILE
 {
 	meta:
 		description = "Detects macOS MaxOfferDeal adware"
 		author = "ditekSHen"
-		id = "aec4ab77-7025-5856-99fb-aa7b86413c00"
+		id = "4fcd4a0b-4dd4-57b3-85f5-e8a93b7858a0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3168-L3187"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a9788b2049ae7f345760a078b2932e79fe8fc0dd71e0446c213df64480c3e3d6"
+		logic_hash = "v1_sha256_a9788b2049ae7f345760a078b2932e79fe8fc0dd71e0446c213df64480c3e3d6"
 		score = 75
 		quality = 46
 		tags = "FILE"
@@ -250016,22 +248793,20 @@ rule DITEKSHEN_MALWARE_Osx_Maxofferdeal : FILE
 		$s11 = "/Library/Caches/com.apple.xbs/Sources/arclite/arclite-66/source/" fullword ascii
 
 	condition:
-		uint16(0)==0xfacf and all of them
+		uint16( 0 ) == 0xfacf and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Osx_Windtrail : FILE
 {
 	meta:
 		description = "Detects WindTrail OSX trojan"
 		author = "ditekSHen"
-		id = "abf7cd20-b37d-5d0a-8f3f-f4e491965713"
+		id = "a0caca3f-6500-5345-9508-74094f7b5266"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3189-L3206"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "291f919cb1e8c4b33960dd3f2c842b9efec04852bd5661543e3ee60bc0fc5ba6"
+		logic_hash = "v1_sha256_291f919cb1e8c4b33960dd3f2c842b9efec04852bd5661543e3ee60bc0fc5ba6"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -250049,22 +248824,20 @@ rule DITEKSHEN_MALWARE_Osx_Windtrail : FILE
 		$developerid = "Developer ID Application: warren portman (95RKE2AA8F)" ascii
 
 	condition:
-		uint16(0)==0xfacf and ( all of ($s*) or $developerid)
+		uint16( 0 ) == 0xfacf and ( all of ( $s* ) or $developerid )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Osx_Techyutils : FILE
 {
 	meta:
 		description = "Detects TechyUtils OSX packages"
 		author = "ditekSHen"
-		id = "59fd4165-987f-5b68-9341-d78184b25a1c"
+		id = "d50971ad-5fc9-5f0c-900e-176a2be142c0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3208-L3224"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "071c67cace09dd66233bd4c4dd78c32d0f39f7e38dc06ec62e09fef67762d098"
+		logic_hash = "v1_sha256_071c67cace09dd66233bd4c4dd78c32d0f39f7e38dc06ec62e09fef67762d098"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -250081,22 +248854,20 @@ rule DITEKSHEN_MALWARE_Osx_Techyutils : FILE
 		$developerid = "Developer ID Application: Techyutils Software Private Limited (VS9Q8BRRRJ)" ascii
 
 	condition:
-		uint16(0)==0xfacf and ( all of ($s*) or $developerid)
+		uint16( 0 ) == 0xfacf and ( all of ( $s* ) or $developerid )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent04 : FILE
 {
 	meta:
 		description = "Detects known downloader agent downloading encoded binaries in patches from paste-like websites, most notably hastebin"
 		author = "ditekSHen"
-		id = "d591c591-aecc-557e-85b4-1e2589fbfbf9"
+		id = "c6860e61-80b3-5ff7-bc9b-3aadd32901c9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3247-L3263"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "73e6af7c32d38ec5d1d2bc9f2517860367b46779b53e0faff8885b655561ab01"
+		logic_hash = "v1_sha256_73e6af7c32d38ec5d1d2bc9f2517860367b46779b53e0faff8885b655561ab01"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250113,22 +248884,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent04 : FILE
 		$s7 = "DownloadString" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and #x1>1 and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and #x1 > 1 and 4 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Gdriverat : FILE
 {
 	meta:
 		description = "Detects GDriveRAT"
 		author = "ditekSHen"
-		id = "29e46280-39d1-5d49-ab0d-0a32398b30f0"
+		id = "e080fa41-2df8-5033-97f9-a5ee07cc58e4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3265-L3284"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "134e66d0afc90e7fbab2c9dd034f85eb504903481e12c1ab8d7bab9321da817a"
+		logic_hash = "v1_sha256_134e66d0afc90e7fbab2c9dd034f85eb504903481e12c1ab8d7bab9321da817a"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -250148,22 +248917,20 @@ rule DITEKSHEN_MALWARE_Win_Gdriverat : FILE
 		$s7 = "execute" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($h*) and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and 3 of ( $h* ) and 5 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_STOP : FILE
 {
 	meta:
 		description = "Detects STOP ransomware"
 		author = "ditekSHen"
-		id = "e928d917-a9d9-5830-938a-59b62608e84c"
+		id = "679440b9-ac6c-550b-ac04-a9b6cfc1277c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3286-L3309"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "61f7e7c1139c56088b2f58b78ae132ffcfef0f931c15b67ea775b0d5e51d189d"
+		logic_hash = "v1_sha256_61f7e7c1139c56088b2f58b78ae132ffcfef0f931c15b67ea775b0d5e51d189d"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -250187,22 +248954,20 @@ rule DITEKSHEN_MALWARE_Win_STOP : FILE
 		$mutex3 = "{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($x*) and 1 of ($mutex*)) or ( all of ($x*)) or (6 of ($s*) and (1 of ($x*) or 1 of ($mutex*))) or (9 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 2 of ( $x* ) and 1 of ( $mutex* ) ) or ( all of ( $x* ) ) or ( 6 of ( $s* ) and ( 1 of ( $x* ) or 1 of ( $mutex* ) ) ) or ( 9 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Parallaxrat : FILE
 {
 	meta:
 		description = "Detects ParallaxRAT"
 		author = "ditekSHen"
-		id = "e602b28f-ae5d-52af-b1c5-5c41776dd4c5"
+		id = "73ada978-3f7e-5043-bd09-51551d95dd2f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3311-L3328"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7fd94dee44079b595b906f1687f44b51b8cebabbeb0900563b8d4fcc0e46bdd0"
+		logic_hash = "v1_sha256_7fd94dee44079b595b906f1687f44b51b8cebabbeb0900563b8d4fcc0e46bdd0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250220,22 +248985,20 @@ rule DITEKSHEN_MALWARE_Win_Parallaxrat : FILE
 		$x2 = "This program cannot be run in DOS mode" ascii
 
 	condition:
-		(( uint16(0)==0x5a4d and all of ($s*)) or all of them )
+		(( uint16( 0 ) == 0x5a4d and all of ( $s* ) ) or all of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Meterpreter : FILE
 {
 	meta:
 		description = "Detects Meterpreter payload"
 		author = "ditekSHen"
-		id = "d72fef80-d624-5e39-963a-8d7c12eb2d9c"
+		id = "0738aa4c-8fe0-50ee-b670-cbf4ef989205"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3330-L3343"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5226cd7bb2344b822ee94d75f81a523ff701778de97a32ae52c604a4855e960c"
+		logic_hash = "v1_sha256_5226cd7bb2344b822ee94d75f81a523ff701778de97a32ae52c604a4855e960c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250248,22 +249011,20 @@ rule DITEKSHEN_MALWARE_Win_Meterpreter : FILE
 		$s5 = "server.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and all of them ) or ( filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and all of them ) or ( filesize < 300KB and all of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Trojan_Expresscms : FILE
 {
 	meta:
 		description = "Detects ExpressCMS"
 		author = "ditekSHen"
-		id = "d096db0c-05f6-5b69-9d84-0105f2182ff3"
+		id = "258511ea-a95b-5e85-bd0b-15f0e6257b07"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3366-L3382"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "64d551e0c11b6394f9ae2b8fa749c36cb1b5c3f498592f95dc19fdea23c53160"
+		logic_hash = "v1_sha256_64d551e0c11b6394f9ae2b8fa749c36cb1b5c3f498592f95dc19fdea23c53160"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250280,22 +249041,20 @@ rule DITEKSHEN_MALWARE_Win_Trojan_Expresscms : FILE
 		$s8 = "\\Microsoft\\svchost.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Meterpreterstager : FILE
 {
 	meta:
 		description = "Detects Meterpreter stager payload"
 		author = "ditekSHen"
-		id = "dfbc37e9-13e0-55e2-a501-1005eea52b63"
+		id = "5dcd66f4-a246-536d-a710-30480d1a7d54"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3384-L3395"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0ac53a10abb1e4dd7da57872cd1779851d953127a912c31a5e411d8eb9bd07f4"
+		logic_hash = "v1_sha256_0ac53a10abb1e4dd7da57872cd1779851d953127a912c31a5e411d8eb9bd07f4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250307,22 +249066,20 @@ rule DITEKSHEN_MALWARE_Win_Meterpreterstager : FILE
 		$s4 = "KERNEL32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them and filesize <100KB
+		uint16( 0 ) == 0x5a4d and all of them and filesize < 100KB
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ziggy : FILE
 {
 	meta:
 		description = "Detects Ziggy ransomware"
 		author = "ditekSHen"
-		id = "6d2d316a-cf19-5001-bf94-842346229d76"
+		id = "7a102277-0ebd-54ca-be4b-1052a3efdb48"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3397-L3421"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "103a50511971161ca673e0c8378aeca2fa7d0f6309966bbb2b70e0d039e0f196"
+		logic_hash = "v1_sha256_103a50511971161ca673e0c8378aeca2fa7d0f6309966bbb2b70e0d039e0f196"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250347,22 +249104,20 @@ rule DITEKSHEN_MALWARE_Win_Ziggy : FILE
 		$msg4 = "# Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can becom" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($id*) or 4 of ($s*) or 3 of ($msg*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $id* ) or 4 of ( $s* ) or 3 of ( $msg* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nworm : FILE
 {
 	meta:
 		description = "Detects NWorm/N-W0rm payload"
 		author = "ditekSHen"
-		id = "06546ccf-8914-5b1c-942f-99664b9ecf44"
+		id = "37da5fc0-8da1-5581-9457-c6541fcc718b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3423-L3443"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a1397a057422be260b5bdf1eb58571e95c259c132cc2518b39e1524a0eda9c66"
+		logic_hash = "v1_sha256_a1397a057422be260b5bdf1eb58571e95c259c132cc2518b39e1524a0eda9c66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250383,22 +249138,20 @@ rule DITEKSHEN_MALWARE_Win_Nworm : FILE
 		$s8 = "Start-Sleep -Seconds 1.5; Remove-Item -Path '" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($id*) and (1 of ($x*) or 3 of ($s*))) or ( all of ($x*) and 2 of ($s*)) or 7 of ($s*) or 10 of them )
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $id* ) and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( all of ( $x* ) and 2 of ( $s* ) ) or 7 of ( $s* ) or 10 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Qakbot : FILE
 {
 	meta:
 		description = "Detects variants of QakBot payload"
 		author = "ditekSHen"
-		id = "3a3b3b6c-0969-584e-a184-7acfca3cdd42"
+		id = "ffa5d267-211e-523c-a7c2-7597c4487f53"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3445-L3457"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b64c05eb7ac03b2b4709f9979d117e4cacc617f21d0b3bf1c1be42aa18cc44cc"
+		logic_hash = "v1_sha256_b64c05eb7ac03b2b4709f9979d117e4cacc617f21d0b3bf1c1be42aa18cc44cc"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -250411,22 +249164,20 @@ rule DITEKSHEN_MALWARE_Win_Qakbot : FILE
 		$s5 = "0>user32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Fonix : FILE
 {
 	meta:
 		description = "Detects Fonix ransomware"
 		author = "ditekSHen"
-		id = "d67cce49-5f4f-59f6-b2a9-9c4dd1c6c0f6"
+		id = "0ef152e1-e219-5252-b944-eb9f50a37be0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3459-L3481"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "159b8946f7772c76271de821eb12897689bf73d96fc6a1d7c4a65cdc50b877c7"
+		logic_hash = "v1_sha256_159b8946f7772c76271de821eb12897689bf73d96fc6a1d7c4a65cdc50b877c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250449,22 +249200,20 @@ rule DITEKSHEN_MALWARE_Win_Fonix : FILE
 		$id6 = "Ransomware\\Fonix" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or 3 of ($id*) or (1 of ($id*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 3 of ( $id* ) or ( 1 of ( $id* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bobik : FILE
 {
 	meta:
 		description = "Detects Bobik infostealer"
 		author = "ditekSHen"
-		id = "12f14151-0c89-519d-85d3-4b4b82a950a3"
+		id = "cd8f62ef-0cc2-5a94-a5b7-94ed4ca9bb47"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3483-L3498"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "735dcb9e04956863305ca89a43686b8e48e3b20784ae9292cfc40d1c2c09d467"
+		logic_hash = "v1_sha256_735dcb9e04956863305ca89a43686b8e48e3b20784ae9292cfc40d1c2c09d467"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250480,22 +249229,20 @@ rule DITEKSHEN_MALWARE_Win_Bobik : FILE
 		$s7 = "threads.nim" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Runningrat : FILE
 {
 	meta:
 		description = "Detects RunningRAT"
 		author = "ditekSHen"
-		id = "161faa8c-614e-5102-bb6d-c1ed4abf8274"
+		id = "a849d464-3a39-5ffc-9d9a-a05c9ef06870"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3500-L3536"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e3cddec792ad95d823190f12970b8e0515b73be4a91f89cbb2bbde2fa1cfde63"
+		logic_hash = "v1_sha256_e3cddec792ad95d823190f12970b8e0515b73be4a91f89cbb2bbde2fa1cfde63"
 		score = 75
 		quality = 23
 		tags = "FILE"
@@ -250531,22 +249278,20 @@ rule DITEKSHEN_MALWARE_Win_Runningrat : FILE
 		$v2_7 = "\\Server.ini" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($rev*) or 6 of ($v*) or 8 of them )
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 5 of ( $rev* ) or 6 of ( $v* ) or 8 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent05 : FILE
 {
 	meta:
 		description = "Detects an unknown dropper. Typically exisys as a DLL in base64-encoded gzip-compressed file embedded within another executable"
 		author = "ditekSHen"
-		id = "a8a72484-42be-5c5c-962b-75bed8acdf39"
+		id = "33a146b9-8eb6-500d-881b-d9b772944d3e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3538-L3551"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e8c7c03451bbfcba7a1ab02f8c1320ad50d17d2e990f0e2f89942faea2a1e531"
+		logic_hash = "v1_sha256_e8c7c03451bbfcba7a1ab02f8c1320ad50d17d2e990f0e2f89942faea2a1e531"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250560,22 +249305,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent05 : FILE
 		$s5 = "res_name" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nemty : FILE
 {
 	meta:
 		description = "Detects Nemty/Nefilim ransomware"
 		author = "ditekSHen"
-		id = "361269c6-5215-5ecf-869c-3c55ff8387e1"
+		id = "1677d2c5-13fa-5070-a3aa-a0bc81534dd7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3553-L3577"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dcebcddc472f4fb3bb34c35fc5a5424e54bfc3a262fdae10b189d210217b9b37"
+		logic_hash = "v1_sha256_dcebcddc472f4fb3bb34c35fc5a5424e54bfc3a262fdae10b189d210217b9b37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250600,22 +249343,20 @@ rule DITEKSHEN_MALWARE_Win_Nemty : FILE
 		$vf1_5 = "main.SaveNote" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (9 of ($s*) or ( all of ($vx*) and 2 of ($s*)) or all of ($vf*))
+		uint16( 0 ) == 0x5a4d and ( 9 of ( $s* ) or ( all of ( $vx* ) and 2 of ( $s* ) ) or all of ( $vf* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Qnapcrypt : FILE
 {
 	meta:
 		description = "Detects QnapCrypt/Lockedv1/Cryptfile2 ransomware"
 		author = "ditekSHen"
-		id = "3ef5643a-f2af-5d62-8927-e46679e069c2"
+		id = "db5267f7-7af5-5f20-8fc4-2cdff0a2ef5d"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3579-L3607"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "68fc3f0503d82295ffa5bfb49bda8b790142913217775a2812e3965a6c9a1fe1"
+		logic_hash = "v1_sha256_68fc3f0503d82295ffa5bfb49bda8b790142913217775a2812e3965a6c9a1fe1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -250644,22 +249385,20 @@ rule DITEKSHEN_MALWARE_Win_Qnapcrypt : FILE
 		$s20 = "net stop " ascii
 
 	condition:
-		uint16(0)==0x5a4d and $go and 6 of ($s*)
+		uint16( 0 ) == 0x5a4d and $go and 6 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Alfonoso : FILE
 {
 	meta:
 		description = "Detects Alfonoso / Shurk / HunterStealer infostealer"
 		author = "ditekSHen"
-		id = "2766e74e-c13a-5ce4-8f62-de9cc11e3cf0"
+		id = "89154c62-ca45-5590-af60-21134cc35f24"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3609-L3638"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "18e5731ffd70abf2ab70852d54dacc3588dd90cfb4f2ceaee66dfce750535b26"
+		logic_hash = "v1_sha256_18e5731ffd70abf2ab70852d54dacc3588dd90cfb4f2ceaee66dfce750535b26"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -250689,22 +249428,20 @@ rule DITEKSHEN_MALWARE_Win_Alfonoso : FILE
 		$f3 = "\\USERDATA.DAT" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (8 of ($s*) or (6 of ($s*) and 2 of ($f*)) or ( all of ($f*) and 5 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 6 of ( $s* ) and 2 of ( $f* ) ) or ( all of ( $f* ) and 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Vidar : FILE
 {
 	meta:
 		description = "Detects Vidar / ArkeiStealer"
 		author = "ditekSHen"
-		id = "d858c463-26d7-5f96-ad9a-cb261a8c61c6"
+		id = "b9c5fd96-bbc9-515a-b05c-de1df1276a3a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3640-L3650"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c95c8694c05ff0e8d28f098e668a8ae8fa70130e31af6c0e540c4e5596007e41"
+		logic_hash = "v1_sha256_c95c8694c05ff0e8d28f098e668a8ae8fa70130e31af6c0e540c4e5596007e41"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250715,22 +249452,20 @@ rule DITEKSHEN_MALWARE_Win_Vidar : FILE
 		$s3 = "Content-Disposition: form-data; name=\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Babuk : FILE
 {
 	meta:
 		description = "Detects Babuk ransomware"
 		author = "ditekSHen"
-		id = "6bb7093f-bbef-5b43-b4f9-be72ae4ef319"
+		id = "195011c7-613f-5879-8c9c-eacfc0f16701"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3652-L3674"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5ca5c5106747cf8f4ccd5df4ddbc78321fea3c8f533cb807a704d270eb956007"
+		logic_hash = "v1_sha256_5ca5c5106747cf8f4ccd5df4ddbc78321fea3c8f533cb807a704d270eb956007"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250753,22 +249488,20 @@ rule DITEKSHEN_MALWARE_Win_Babuk : FILE
 		$arg6 = "gdebug" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or (3 of ($arg*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( 3 of ( $arg* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nitol : FILE
 {
 	meta:
 		description = "Detects Nitol backdoor"
 		author = "ditekSHen"
-		id = "d545f826-11ff-5d0f-9a95-8232b19d35b6"
+		id = "1a771b2a-797c-5705-ace4-a80bb505187d"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3676-L3704"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c0ddcd6179bea2f3af77ae198e07f55f62884e07a975623ae41bcec163060f89"
+		logic_hash = "v1_sha256_c0ddcd6179bea2f3af77ae198e07f55f62884e07a975623ae41bcec163060f89"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -250797,22 +249530,20 @@ rule DITEKSHEN_MALWARE_Win_Nitol : FILE
 		$v2_5 = "lepejagas" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or ( all of ($v2*)) or ($domain and 3 of them ) or (#w1>2 and #w2>2 and #w3>2 and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( all of ( $v2* ) ) or ( $domain and 3 of them ) or ( #w1 > 2 and #w2 > 2 and #w3 > 2 and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Strongpity : FILE
 {
 	meta:
 		description = "Detects StrongPity"
 		author = "ditekSHen"
-		id = "9dcc5edb-5c86-5412-af63-f88d488d5829"
+		id = "b99302dd-e983-541a-9548-e8f55245e607"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3706-L3720"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e92147966cd68152eb536b805c4918462f72f64280d1b3df800bb41266aa232f"
+		logic_hash = "v1_sha256_e92147966cd68152eb536b805c4918462f72f64280d1b3df800bb41266aa232f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -250827,22 +249558,20 @@ rule DITEKSHEN_MALWARE_Win_Strongpity : FILE
 		$s7 = "& rmdir /Q /S \"" wide
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Jssloader : FILE
 {
 	meta:
 		description = "Detects JSSLoader RAT/backdoor"
 		author = "ditekSHen"
-		id = "ef710c21-5c64-513e-b882-b5768478976e"
+		id = "5cc3aab6-2ca2-547b-91fd-97ce74823f82"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3722-L3752"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "91764dabfb40cb51914110de229ddb00cd565078fef83c825f7a86fa502fda37"
+		logic_hash = "v1_sha256_91764dabfb40cb51914110de229ddb00cd565078fef83c825f7a86fa502fda37"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -250873,22 +249602,20 @@ rule DITEKSHEN_MALWARE_Win_Jssloader : FILE
 		$e7 = "AT.U() {0}. format" wide
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($cmd*) or 5 of ($s*) or all of ($e*) or 7 of them )
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $cmd* ) or 5 of ( $s* ) or all of ( $e* ) or 7 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_CHUWI_Seth : FILE
 {
 	meta:
 		description = "First sighting on 2020-01-05 didn't include ransomware artificats. Second sighting on 2020-01-24 with several correlations between the two samples now include ransomware artifacts."
 		author = "ditekSHen"
-		id = "62af3cd3-59c3-580b-9d66-71fd4acfaf17"
+		id = "2df12fb5-b1ae-5dd1-9eab-1fe60c15f076"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3754-L3801"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e6e3f5e9af093268667f67fec2176a943b35721e9f220804e176c6b5a3bb24e1"
+		logic_hash = "v1_sha256_e6e3f5e9af093268667f67fec2176a943b35721e9f220804e176c6b5a3bb24e1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -250928,7 +249655,7 @@ rule DITEKSHEN_MALWARE_Win_CHUWI_Seth : FILE
 		$x9 = "MyAgent" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($pdb or 5 of ($cmd*) or 4 of ($cnc*) or all of ($rcnc*) or 5 of ($x*) or 8 of them )
+		uint16( 0 ) == 0x5a4d and ( $pdb or 5 of ( $cmd* ) or 4 of ( $cnc* ) or all of ( $rcnc* ) or 5 of ( $x* ) or 8 of them )
 }
 import "pe"
 
@@ -250937,13 +249664,13 @@ rule DITEKSHEN_MALWARE_Win_Gulpix : FILE
 	meta:
 		description = "Detects Gulpix/HyperPlus backddor"
 		author = "ditekSHen"
-		id = "b3dfd1d9-42fe-57d4-8047-135103689be7"
+		id = "8efc5bed-ec71-54bf-9ec6-4a607fa8a50d"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3803-L3832"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5026726f093b31b444fc934ac1446b6c25f182b8714a37da05f4498f32a9a65f"
+		logic_hash = "v1_sha256_5026726f093b31b444fc934ac1446b6c25f182b8714a37da05f4498f32a9a65f"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -250964,22 +249691,20 @@ rule DITEKSHEN_MALWARE_Win_Gulpix : FILE
 		$s9 = "FD873AC4-CF86-4FED-84EC-4BD59C6F17A7" wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 6 of ($s*) or (2 of ($x*) and 4 of ($s*)) or (2 of them and pe.exports("daemon") and pe.exports("run") and pe.exports("session") and pe.exports("work")))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 6 of ( $s* ) or ( 2 of ( $x* ) and 4 of ( $s* ) ) or ( 2 of them and pe.exports ( "daemon" ) and pe.exports ( "run" ) and pe.exports ( "session" ) and pe.exports ( "work" ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Ransomexx : FILE
 {
 	meta:
 		description = "Detects RansomEXX ransomware"
 		author = "ditekshen"
-		id = "b449afc7-9055-55ed-a876-316d1aea8fee"
+		id = "d39f50e1-2cb1-57f8-aabc-a80783ec78ca"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3834-L3858"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c233ccc3e741cb2c53f182c48093e41595a82a3f4e5bdb1dc0204f1f57b96c2a"
+		logic_hash = "v1_sha256_c233ccc3e741cb2c53f182c48093e41595a82a3f4e5bdb1dc0204f1f57b96c2a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251003,22 +249728,20 @@ rule DITEKSHEN_MALWARE_Linux_Ransomexx : FILE
 		$s8 = "ctr_drbg_update_internal" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and (5 of ($c*) or 6 of ($s*) or (3 of ($c*) and 3 of ($s*)))
+		uint16( 0 ) == 0x457f and ( 5 of ( $c* ) or 6 of ( $s* ) or ( 3 of ( $c* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Trickbotmodule : FILE
 {
 	meta:
 		description = "Detects Trickbot modules"
 		author = "ditekshen"
-		id = "c56c664f-5928-5e2e-ab06-0b9d504981be"
+		id = "c66ec9c4-8484-51f8-8169-6c48c2b12d8c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3860-L3881"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4d06653dad5f8a18598855212548364b3c3d2b68b99784846b494fcb1d1c8df9"
+		logic_hash = "v1_sha256_4d06653dad5f8a18598855212548364b3c3d2b68b99784846b494fcb1d1c8df9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251040,22 +249763,20 @@ rule DITEKSHEN_MALWARE_Win_Trickbotmodule : FILE
 		$w8 = "<moduleconfig> </moduleconfig" ascii
 
 	condition:
-		uint16(0)==0x5a4d and $mc and (2 of ($s*) or (1 of ($s*) and 1 of ($w*)) or 1 of ($w*))
+		uint16( 0 ) == 0x5a4d and $mc and ( 2 of ( $s* ) or ( 1 of ( $s* ) and 1 of ( $w* ) ) or 1 of ( $w* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Gaudox : FILE
 {
 	meta:
 		description = "Detects Gaudox RAT"
 		author = "ditekshen"
-		id = "c60ac433-20a1-5f01-9447-fa99621bd9e2"
+		id = "5098ec6b-b502-549f-8e1a-fe6938b63093"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3883-L3893"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "117ee89e264067ab3e695688872bbe7d83963731e877d04ac7e2505e64f6e793"
+		logic_hash = "v1_sha256_117ee89e264067ab3e695688872bbe7d83963731e877d04ac7e2505e64f6e793"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251065,22 +249786,20 @@ rule DITEKSHEN_MALWARE_Win_Gaudox : FILE
 		$s2 = "\\\\\\\\.\\\\PhysicalDrive%u" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Phobos : FILE
 {
 	meta:
 		description = "Detects Phobos ransomware"
 		author = "ditekshen"
-		id = "7bf659ef-f2a1-5ee2-a334-c233e26a2526"
+		id = "cae2e4c9-849c-5ac0-937d-ea11d96ff37a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3895-L3908"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bbf8eef0863e9d6423b3b0f938561b2be486b92b4f59b5d0b67f52dba536a582"
+		logic_hash = "v1_sha256_bbf8eef0863e9d6423b3b0f938561b2be486b92b4f59b5d0b67f52dba536a582"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -251094,22 +249813,20 @@ rule DITEKSHEN_MALWARE_Win_Phobos : FILE
 		$s3 = { 41 31 47 ?? 41 2b }
 
 	condition:
-		uint16(0)==0x5a4d and all of ($x*) and 1 of ($s*)
+		uint16( 0 ) == 0x5a4d and all of ( $x* ) and 1 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ratty : FILE
 {
 	meta:
 		description = "Detects Ratty Java RAT"
 		author = "ditekshen"
-		id = "87719e28-dfe7-5366-8d90-65e6c0c6fb4f"
+		id = "f49f083e-39b1-5445-ad20-1e596ecfd19a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3910-L3929"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d90bca1b18023da8e60cb6ca86d1c562bff3867c6d5cf893dce605ebb92b9637"
+		logic_hash = "v1_sha256_d90bca1b18023da8e60cb6ca86d1c562bff3867c6d5cf893dce605ebb92b9637"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251129,22 +249846,20 @@ rule DITEKSHEN_MALWARE_Win_Ratty : FILE
 		$e6 = "/engine/noise/PerlinNoise.class" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0 or uint16(0)==0x4b50) and (3 of ($s*) or all of ($e*))
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0xcfd0 or uint16( 0 ) == 0x4b50 ) and ( 3 of ( $s* ) or all of ( $e* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Fatduke : FILE
 {
 	meta:
 		description = "Detects FatDuke"
 		author = "ditekSHen"
-		id = "dc80c0f0-c61c-5f0c-841b-3a75e8a1cef3"
+		id = "3a12eed2-61d8-5632-9837-a893f35ebde4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3931-L3946"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a7923d15b10098e9402614fe7107a6ba1d71512efa6e462d522ef64e13f82b47"
+		logic_hash = "v1_sha256_a7923d15b10098e9402614fe7107a6ba1d71512efa6e462d522ef64e13f82b47"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251158,22 +249873,20 @@ rule DITEKSHEN_MALWARE_Win_Fatduke : FILE
 		$b64 = "eyJjb25maWdfaWQiOi" wide
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or ($b64 and 2 of them ) or (#pattern>3 and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( $b64 and 2 of them ) or ( #pattern > 3 and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Miniduke : FILE
 {
 	meta:
 		description = "Detects MiniDuke"
 		author = "ditekSHen"
-		id = "947cd414-d19d-5543-8961-94aef69cc94e"
+		id = "4e94a11b-f97f-56cb-95ee-33cb5943b8b3"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3948-L3969"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c3ab139b4fda2ff9678ceecbdf5ac0c57536bd658f62aa9d19610028b0a5f92c"
+		logic_hash = "v1_sha256_c3ab139b4fda2ff9678ceecbdf5ac0c57536bd658f62aa9d19610028b0a5f92c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251194,7 +249907,7 @@ rule DITEKSHEN_MALWARE_Win_Miniduke : FILE
 		$net6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or 4 of ($net*) or 7 of them )
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 4 of ( $net* ) or 7 of them )
 }
 import "pe"
 
@@ -251203,13 +249916,13 @@ rule DITEKSHEN_MALWARE_Win_Polyglotduke : FILE
 	meta:
 		description = "Detects PolyGlotDuke"
 		author = "ditekSHen"
-		id = "01ac90db-35f6-5192-8630-81000573b4f9"
+		id = "b59bb95c-8fc3-5b23-9c63-68952ca41e30"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3971-L3986"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c1fb8ea1d21768cbd65bd7b91e3f817fa97a0a933b511dff2ae4d5db49bdb2ec"
+		logic_hash = "v1_sha256_c1fb8ea1d21768cbd65bd7b91e3f817fa97a0a933b511dff2ae4d5db49bdb2ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251220,22 +249933,20 @@ rule DITEKSHEN_MALWARE_Win_Polyglotduke : FILE
 		$s3 = { 48 8b 05 19 ?4 4b 00 48 05 48 83 00 00 4c 8b 44 24 50 8b 54 24 48 48 8b }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*)) or (2 of them and pe.exports("InitSvc"))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) ) or ( 2 of them and pe.exports ( "InitSvc" ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Guidlma : FILE
 {
 	meta:
 		description = "Detects Guildma"
 		author = "ditekSHen"
-		id = "135ddc6a-5001-54c0-a66c-3e0e5fe6319f"
+		id = "428c0f7e-944d-507c-a8b6-3c7b3e6e3319"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3988-L4006"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "11a0d9c67139627b6820c928840d816ed22b48452ce0b2f856c86c183cdfc8ab"
+		logic_hash = "v1_sha256_11a0d9c67139627b6820c928840d816ed22b48452ce0b2f856c86c183cdfc8ab"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -251254,22 +249965,20 @@ rule DITEKSHEN_MALWARE_Win_Guidlma : FILE
 		$v2_6 = ":*:/:4:C:H:M:\\:a:f:u:z:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($v1*) or 5 of ($v2*)
+		uint16( 0 ) == 0x5a4d and 3 of ( $v1* ) or 5 of ( $v2* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cybergate : FILE
 {
 	meta:
 		description = "Detects CyberGate/Spyrat/Rebhip RTA"
 		author = "ditekSHen"
-		id = "3b50ccfb-6603-5002-8ceb-e9252d4c7dff"
+		id = "db58f189-2c10-5eca-8fbc-b27928a7cf9f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4008-L4026"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b4a3c07533c2b251e1a714b28fb0b654c76881fb6ce970f6586c5908ee65609b"
+		logic_hash = "v1_sha256_b4a3c07533c2b251e1a714b28fb0b654c76881fb6ce970f6586c5908ee65609b"
 		score = 75
 		quality = 46
 		tags = "FILE"
@@ -251288,22 +249997,20 @@ rule DITEKSHEN_MALWARE_Win_Cybergate : FILE
 		$s11 = "password" nocase ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_WSHRATJS : FILE
 {
 	meta:
 		description = "Detects WSHRAT JS variants"
 		author = "ditekSHen"
-		id = "7dbaea67-48dc-5fb8-ba58-b0d6eeca207b"
+		id = "e1057f58-1fe5-586a-aff1-0b27c6298ce6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4028-L4045"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9956ed4613ac403360ab0222a7ed62350fcd998710843bd6700717f8bbb5052e"
+		logic_hash = "v1_sha256_9956ed4613ac403360ab0222a7ed62350fcd998710843bd6700717f8bbb5052e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251321,22 +250028,20 @@ rule DITEKSHEN_MALWARE_Win_WSHRATJS : FILE
 		$s4 = "* 1].item =" ascii
 
 	condition:
-		filesize <400KB and ($charset_full or ($charset_begin and $charset_end)) and 2 of ($wsc_object*) and 3 of ($s*)
+		filesize < 400KB and ( $charset_full or ( $charset_begin and $charset_end ) ) and 2 of ( $wsc_object* ) and 3 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Asyncrat : FILE
 {
 	meta:
 		description = "Detects AsyncRAT"
 		author = "ditekSHen"
-		id = "6465b50d-8f1a-5c09-84fd-cd1e5994e68f"
+		id = "9407d0ce-2423-5937-834e-ee781161629e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4047-L4074"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "073d4a8667fb1a48bf2bd503a551d7f78e38a6066feedc646d92c27fb7201fca"
+		logic_hash = "v1_sha256_073d4a8667fb1a48bf2bd503a551d7f78e38a6066feedc646d92c27fb7201fca"
 		score = 60
 		quality = 35
 		tags = "FILE"
@@ -251362,22 +250067,20 @@ rule DITEKSHEN_MALWARE_Win_Asyncrat : FILE
 		$cnc4 = "POST / HTTP/1.1" fullword ascii wide
 
 	condition:
-		(( uint16(0)==0x5a4d and filesize <4000KB) and (1 of ($x*) or 6 of ($s*) or all of ($cnc*) or (4 of ($s*) and 2 of ($cnc*)))) or (1 of ($x*) or 6 of ($s*) or all of ($cnc*) or (4 of ($s*) and 2 of ($cnc*)))
+		(( uint16( 0 ) == 0x5a4d and filesize < 4000KB ) and ( 1 of ( $x* ) or 6 of ( $s* ) or all of ( $cnc* ) or ( 4 of ( $s* ) and 2 of ( $cnc* ) ) ) ) or ( 1 of ( $x* ) or 6 of ( $s* ) or all of ( $cnc* ) or ( 4 of ( $s* ) and 2 of ( $cnc* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Quilclipper
 {
 	meta:
 		description = "Detects QuilClipper variants mostly in memory or extracted AutoIt script"
 		author = "ditekSHen"
-		id = "bd23ec5a-f21a-5133-a77a-de2615933b82"
+		id = "eff4257d-0210-5e92-a3f5-328258d25067"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4076-L4094"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dcac93806a438b188ae70a679301cb6630b9eb6849bf8fbbb1cea5fed5e7cf75"
+		logic_hash = "v1_sha256_dcac93806a438b188ae70a679301cb6630b9eb6849bf8fbbb1cea5fed5e7cf75"
 		score = 75
 		quality = 75
 		tags = ""
@@ -251396,22 +250099,20 @@ rule DITEKSHEN_MALWARE_Win_Quilclipper
 		$s8 = "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Schedule" ascii
 
 	condition:
-		all of ($cnc*) or all of ($s*)
+		all of ( $cnc* ) or all of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Spyeye : FILE
 {
 	meta:
 		description = "Detects SpyEye"
 		author = "ditekSHen"
-		id = "aa15220a-6fd4-5c5e-8287-957fc3c3fe52"
+		id = "9794931c-d0b7-5619-bdaf-0ef15ae7bc4e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4096-L4111"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "352853d600d1f4fbc09e58b783eb4e13b335fefbfe89842873710f0a9085d107"
+		logic_hash = "v1_sha256_352853d600d1f4fbc09e58b783eb4e13b335fefbfe89842873710f0a9085d107"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251427,7 +250128,7 @@ rule DITEKSHEN_MALWARE_Win_Spyeye : FILE
 		$s5 = "]YH0%Yn" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and 1 of ( $s* ) ) )
 }
 import "pe"
 
@@ -251436,13 +250137,13 @@ rule DITEKSHEN_MALWARE_Win_Renamer : FILE
 	meta:
 		description = "Detects Renamer/Tainp variants"
 		author = "ditekSHen"
-		id = "9e701bbe-d698-510a-b63d-3c1575dac7b0"
+		id = "efdafb82-485b-585f-8fe3-6381edd95231"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4114-L4135"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "df80657631f072bc1627e1cf503881a2c065396f8798d7f347259672f600198d"
+		logic_hash = "v1_sha256_df80657631f072bc1627e1cf503881a2c065396f8798d7f347259672f600198d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251456,22 +250157,20 @@ rule DITEKSHEN_MALWARE_Win_Renamer : FILE
 		$s6 = "Dropped" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) or (4 of ($s*) and for any directory in pe.data_directories : (directory.virtual_address!=0 and directory.size==0))
+		uint16( 0 ) == 0x5a4d and all of ( $s* ) or ( 4 of ( $s* ) and for any directory in pe.data_directories : ( directory.virtual_address != 0 and directory.size == 0 ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Epsilon : FILE
 {
 	meta:
 		description = "Detects Epsilon ransomware"
 		author = "ditekSHen"
-		id = "c5561a0d-85ac-5137-a97e-310aa03eb787"
+		id = "0f0a7202-3ccb-5c92-a5e8-9165536cf466"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4137-L4169"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cc4481ddb6f5fd52a0bc901dde4c34ccf79024cd68605245df0dcbea22d0adee"
+		logic_hash = "v1_sha256_cc4481ddb6f5fd52a0bc901dde4c34ccf79024cd68605245df0dcbea22d0adee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251504,22 +250203,20 @@ rule DITEKSHEN_MALWARE_Win_Epsilon : FILE
                 65 00 78 00 65 }
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or ( all of ($e*) and 4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( all of ( $e* ) and 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Corebot : FILE
 {
 	meta:
 		description = "Detects CoreBot"
 		author = "ditekSHen"
-		id = "f0351bdb-34ff-5b6d-bc4b-61fc491401ef"
+		id = "b34c5e8c-49cf-5ab9-ac0a-baaab3a89ee3"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4171-L4226"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "518209458fc8912d47b0b99896178fda823c3174c37f21d5e9331349a69322d7"
+		logic_hash = "v1_sha256_518209458fc8912d47b0b99896178fda823c3174c37f21d5e9331349a69322d7"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -251574,22 +250271,20 @@ rule DITEKSHEN_MALWARE_Win_Corebot : FILE
 		$cnc10 = "&uni=" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($f*) or all of ($s*) or (3 of ($s*) and 2 of ($f*)) or 3 of ($x*) or 8 of ($v1*) or (4 of ($cnc*) and 4 of ($v1*)) or 12 of them )
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $f* ) or all of ( $s* ) or ( 3 of ( $s* ) and 2 of ( $f* ) ) or 3 of ( $x* ) or 8 of ( $v1* ) or ( 4 of ( $cnc* ) and 4 of ( $v1* ) ) or 12 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dllloader : FILE
 {
 	meta:
 		description = "Detects unknown DLL Loader"
 		author = "ditekSHen"
-		id = "164967b8-d0f5-543d-82ac-bb2465b85c2a"
+		id = "11bb02a8-afab-5e3d-b561-1d995690ceaf"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4228-L4239"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "aaf1ff0f93d1fe6cf189c9f30403c226e64146178150dff8dfd3a9e3ed84bcc2"
+		logic_hash = "v1_sha256_aaf1ff0f93d1fe6cf189c9f30403c226e64146178150dff8dfd3a9e3ed84bcc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251601,22 +250296,20 @@ rule DITEKSHEN_MALWARE_Win_Dllloader : FILE
 		$s4 = "DisableThreadLibraryCalls" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Farfli : FILE
 {
 	meta:
 		description = "Detects Farfli backdoor"
 		author = "ditekSHen"
-		id = "4c3c86f4-5493-5e8a-9618-b0c3d55e2b86"
+		id = "f54d82d3-53a7-51f7-9922-2b167d90ae99"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4241-L4253"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cb1856b32c66d6d070b8ec2d9feea25d6d6748057ceaa342be2ddc589f9a89d6"
+		logic_hash = "v1_sha256_cb1856b32c66d6d070b8ec2d9feea25d6d6748057ceaa342be2ddc589f9a89d6"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -251629,22 +250322,20 @@ rule DITEKSHEN_MALWARE_Win_Farfli : FILE
 		$s5 = "C:\\2.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Warezov : FILE
 {
 	meta:
 		description = "Detects Warezov worm/downloader"
 		author = "ditekSHen"
-		id = "8cb1dcb1-981d-5ff2-b0d9-aa18dfbfc795"
+		id = "2f0bb3b6-c66a-5e01-9f15-3639ac8acb86"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4255-L4269"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e65922902fd18175a3ce7b600d46535e92b92240fa3ca83dced6f9ce14f3e815"
+		logic_hash = "v1_sha256_e65922902fd18175a3ce7b600d46535e92b92240fa3ca83dced6f9ce14f3e815"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251659,22 +250350,20 @@ rule DITEKSHEN_MALWARE_Win_Warezov : FILE
 		$s7 = { 25 73 25 73 2e 25 73 ?? ?? 22 22 26 6c 79 79 56 00 00 00 00 25 73 25 30 34 64 25 30 32 64 25 30 32 64 00 }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Arechclient2 : FILE
 {
 	meta:
 		description = "Detects Arechclient2 RAT"
 		author = "ditekSHen"
-		id = "c12858ea-5e06-5303-9df0-0f59ba83b5e5"
+		id = "281b19b5-1bbc-5278-b0c2-12b0e5ce5ea4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4271-L4303"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0d841f4d4664fb09801c51f7b65e897e4e698753ad67fc20e2b81d98c0b3d07d"
+		logic_hash = "v1_sha256_0d841f4d4664fb09801c51f7b65e897e4e698753ad67fc20e2b81d98c0b3d07d"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -251707,22 +250396,20 @@ rule DITEKSHEN_MALWARE_Win_Arechclient2 : FILE
 		$v1_10 = "\\sitemanager.xml MB or SELECT * FROM Cookiesconfig" wide
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or 7 of ($v1*) or (6 of ($v1*) and 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 7 of ( $v1* ) or ( 6 of ( $v1* ) and 1 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Killmbr : FILE
 {
 	meta:
 		description = "Detects KillMBR"
 		author = "ditekSHen"
-		id = "b109865f-e268-5633-bb8e-f390dd050d99"
+		id = "831e9b27-fc74-59b2-8079-79cc005a83d7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4305-L4316"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1ed9206f90052df7e533be4612afa373e5e69fba8f5b5ae4df1c09a9d98958cf"
+		logic_hash = "v1_sha256_1ed9206f90052df7e533be4612afa373e5e69fba8f5b5ae4df1c09a9d98958cf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251734,22 +250421,20 @@ rule DITEKSHEN_MALWARE_Win_Killmbr : FILE
 		$s4 = "No, this ransomware dont encrypt your files, erases it" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of them and #s1>10)
+		uint16( 0 ) == 0x5a4d and ( 2 of them and #s1 > 10 )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lcpdot : FILE
 {
 	meta:
 		description = "Detects LCPDot"
 		author = "ditekSHen"
-		id = "e4db3784-7fb0-58bd-997e-788f409445cd"
+		id = "ad5129a7-f017-59ec-a85e-2573cb3766a6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4318-L4337"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b0f77f17976c38a69c2ff0d84002f2db29a4d25873309259519115b5f2b210ff"
+		logic_hash = "v1_sha256_b0f77f17976c38a69c2ff0d84002f2db29a4d25873309259519115b5f2b210ff"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251769,22 +250454,20 @@ rule DITEKSHEN_MALWARE_Win_Lcpdot : FILE
 		$o2 = { c7 44 24 30 47 49 46 38 c7 44 24 34 39 61 27 00 }
 
 	condition:
-		uint16(0)==0x5a4d and 6 of ($s*) or ( all of ($o*) and 3 of ($s*))
+		uint16( 0 ) == 0x5a4d and 6 of ( $s* ) or ( all of ( $o* ) and 3 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Torisma : FILE
 {
 	meta:
 		description = "Detects Torisma"
 		author = "ditekSHen"
-		id = "e62a0f1c-4404-5da1-9c43-4cb58e735827"
+		id = "a5ef0441-e9c8-5e37-a97d-5b82ee65facb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4339-L4355"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bd3823f8a91fdfc443e20bcb299a5103b7176a694f0d5328e7986de83f677a31"
+		logic_hash = "v1_sha256_bd3823f8a91fdfc443e20bcb299a5103b7176a694f0d5328e7986de83f677a31"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251801,22 +250484,20 @@ rule DITEKSHEN_MALWARE_Win_Torisma : FILE
 		$o2 = { f3 aa 83 7c 24 30 01 75 34 c7 44 24 20 01 }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) or ( all of ($o*) and 3 of ($s*))
+		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $o* ) and 3 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Thanos : FILE
 {
 	meta:
 		description = "Detects Thanos / Prometheus / Spook ransomware"
 		author = "ditekSHen"
-		id = "f523906e-ef5e-57be-82ed-06e75c393f42"
+		id = "3f112513-2f5f-5e11-9023-a2890c16be6c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4357-L4389"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8ce7cdfe4bca31e21d6fa31a75c46737a41fae3b5b0fda818e3a4709ceaf9bf5"
+		logic_hash = "v1_sha256_8ce7cdfe4bca31e21d6fa31a75c46737a41fae3b5b0fda818e3a4709ceaf9bf5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -251849,22 +250530,20 @@ rule DITEKSHEN_MALWARE_Win_Thanos : FILE
 		$m2 = "QWxsIHlvdXIgZmlsZXMgd2VyZSBlbmNyeXB0" wide
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($f*) or 5 of ($s*) or (4 of ($f*) and 2 of ($s*) or ( all of ($m*) and 3 of them )) or 8 of them )
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $f* ) or 5 of ( $s* ) or ( 4 of ( $f* ) and 2 of ( $s* ) or ( all of ( $m* ) and 3 of them ) ) or 8 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Tmanager : FILE
 {
 	meta:
 		description = "Detects TManager RAT. Associated with TA428"
 		author = "ditekSHen"
-		id = "391b72bd-ddf5-5251-b566-c75c1cc16b74"
+		id = "6a8d1317-669a-5b2b-af73-ed473b7409a6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4391-L4410"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cdbcc00ae67c9161f6db89cfa658c8bc8fb7fab3915ac5ae99bdd34c42ee2abb"
+		logic_hash = "v1_sha256_cdbcc00ae67c9161f6db89cfa658c8bc8fb7fab3915ac5ae99bdd34c42ee2abb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251884,22 +250563,20 @@ rule DITEKSHEN_MALWARE_Win_Tmanager : FILE
 		$s12 = "chcp & exit" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Sn0Wlogger : FILE
 {
 	meta:
 		description = "Detects Sn0w Logger"
 		author = "ditekSHen"
-		id = "cdb70164-3f72-553f-a6c5-190f699e0743"
+		id = "0e1865c8-4488-5a5c-bce1-0c01449d47c9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4412-L4428"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ea4b2281f906271dc249b5036b22eadfc5add94def4f8e4f8a40c384618465d8"
+		logic_hash = "v1_sha256_ea4b2281f906271dc249b5036b22eadfc5add94def4f8e4f8a40c384618465d8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251916,22 +250593,20 @@ rule DITEKSHEN_MALWARE_Win_Sn0Wlogger : FILE
 		$r4 = "(\\w+)=(\\d+)-(\\d+)$" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or ( all of ($r*) and 2 of ($s*)) or 7 of them )
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( all of ( $r* ) and 2 of ( $s* ) ) or 7 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Danabot : FILE
 {
 	meta:
 		description = "Detects DanaBot variants"
 		author = "ditekSHen"
-		id = "a49e21b9-d40a-5273-a9a2-322a1ec9bbbc"
+		id = "a7a38cf6-90c5-5d04-a8df-be221dca858e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4430-L4459"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8d037b46d719159dc3e60f0c7143022ce8745cfd753c3754ae80a220a838567d"
+		logic_hash = "v1_sha256_8d037b46d719159dc3e60f0c7143022ce8745cfd753c3754ae80a220a838567d"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -251955,22 +250630,20 @@ rule DITEKSHEN_MALWARE_Win_Danabot : FILE
 		$ds4 = "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF0123456789ABCDEF" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or all of ($ds*))
+		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or all of ( $ds* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Klackring : FILE
 {
 	meta:
 		description = "Detects Klackring variants. Associated with ZINC / Lazarus"
 		author = "ditekSHen"
-		id = "7bd9a68f-d58b-5437-a28b-5a7f1a11038e"
+		id = "6bae395b-8924-5834-a6dc-cedb1cecb216"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4461-L4475"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b894e89de720affadd80966d726a44ffce75d71095b0530edb6bfddb76660c54"
+		logic_hash = "v1_sha256_b894e89de720affadd80966d726a44ffce75d71095b0530edb6bfddb76660c54"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -251985,22 +250658,20 @@ rule DITEKSHEN_MALWARE_Win_Klackring : FILE
 		$s7 = ".?AVA5Stream@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Comebacker : FILE
 {
 	meta:
 		description = "Detects ComeBacker variants. Associated with ZINC / Lazarus"
 		author = "ditekSHen"
-		id = "d0454d09-4a15-5251-aa7a-cb00604715ca"
+		id = "5b5bf65c-ef19-5228-952b-ee7728ad5571"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4477-L4492"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0d806fd199f0e8e3576ca837781c2fa06f1a09d75ea16602effb72754d8e4940"
+		logic_hash = "v1_sha256_0d806fd199f0e8e3576ca837781c2fa06f1a09d75ea16602effb72754d8e4940"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -252016,22 +250687,20 @@ rule DITEKSHEN_MALWARE_Win_Comebacker : FILE
 		$x3 = "SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($x*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $x* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Suncrypt : FILE
 {
 	meta:
 		description = "Detects SunCrypt ransomware"
 		author = "ditekSHen"
-		id = "1a28fcbf-1fc0-5f18-ae71-2e813ed0f958"
+		id = "f33d435b-d69d-5f21-81d9-a1413cbc6e38"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4494-L4532"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "abde9bbf2577304ff059972a38e803ba17de7a1f0346efe880a710f2ad79db37"
+		logic_hash = "v1_sha256_abde9bbf2577304ff059972a38e803ba17de7a1f0346efe880a710f2ad79db37"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -252070,22 +250739,20 @@ rule DITEKSHEN_MALWARE_Win_Suncrypt : FILE
 		$m5 = ",'/#/client/','<h2>\\x20Whats\\x20Happen" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or 6 of ($g*) or 3 of ($m*))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 6 of ( $g* ) or 3 of ( $m* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Zegost : FILE
 {
 	meta:
 		description = "Detects Zegost"
 		author = "ditekSHen"
-		id = "cce29602-c096-53df-a99b-16f18ed43b80"
+		id = "06c09b76-4d2c-51b1-a232-f3a892cccd7b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4534-L4560"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "96727a0f5c113e5cdfe871f104553fd1c04a8f63ecbb8db7223afb71fcdd4087"
+		logic_hash = "v1_sha256_96727a0f5c113e5cdfe871f104553fd1c04a8f63ecbb8db7223afb71fcdd4087"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252112,22 +250779,20 @@ rule DITEKSHEN_MALWARE_Win_Zegost : FILE
 		$s19 = "%s\\shell\\open\\command" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_GENERIC01 : FILE
 {
 	meta:
 		description = "Detects known unamed malicious executables, mostly DLLs"
 		author = "ditekSHen"
-		id = "3c16df71-f2e2-591c-b377-7e5ed697d43f"
+		id = "3734c145-10fe-506f-859b-5fb266ff386f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4562-L4575"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ddae979db5ddda772ca66a3d50e4b5479b16052ea002fd04fdbf295ce784e291"
+		logic_hash = "v1_sha256_ddae979db5ddda772ca66a3d50e4b5479b16052ea002fd04fdbf295ce784e291"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252141,22 +250806,20 @@ rule DITEKSHEN_MALWARE_Win_GENERIC01 : FILE
 		$s6 = "Stupid Japanese" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_GENERIC02 : FILE
 {
 	meta:
 		description = "Detects known unamed malicious executables"
 		author = "ditekSHen"
-		id = "d0d24e69-0e99-5766-8e8e-9cdce902fa8f"
+		id = "dbeb20db-c1aa-5e36-be33-c20f2b2043b9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4577-L4591"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4f750c871ee061ed2d5d1f68e6ac1f56b8127321cfc207e2dd1dbed9d9848ce5"
+		logic_hash = "v1_sha256_4f750c871ee061ed2d5d1f68e6ac1f56b8127321cfc207e2dd1dbed9d9848ce5"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -252171,22 +250834,20 @@ rule DITEKSHEN_MALWARE_Win_GENERIC02 : FILE
 		$s7 = { 83 c1 02 e8 3c ff ff ff 8b c8 ba ff 03 00 00 8d }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent06 : FILE
 {
 	meta:
 		description = "Detects known downloader agent downloading encoded binaries in patches"
 		author = "ditekSHen"
-		id = "00cb5184-b12d-5014-bee8-116cc72dfa47"
+		id = "0c2781c0-d79b-5a62-8142-f8f6f4a0073e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4593-L4610"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9188804ad0e08f3e0cd09eb8815abea14da5aa28aef9084d19108a24f49f65c7"
+		logic_hash = "v1_sha256_9188804ad0e08f3e0cd09eb8815abea14da5aa28aef9084d19108a24f49f65c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252204,22 +250865,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent06 : FILE
 		$var2_5 = "WebClient" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*) and 2 of ($var2*)) or (4 of ($var2*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 2 of ( $var2* ) ) or ( 4 of ( $var2* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_PWSH_Poshkeylogger
 {
 	meta:
 		description = "Detects PowerShell PoshKeylogger"
 		author = "ditekSHen"
-		id = "a816d716-caeb-5f08-9043-29db531f9e7c"
+		id = "8d7f55ad-7ef0-545d-8691-9bea3b4066c8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4612-L4627"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "20bde87ded7e3b68bc554c4b9a6c2ef08514f0d47b6b144763927bede81ea540"
+		logic_hash = "v1_sha256_20bde87ded7e3b68bc554c4b9a6c2ef08514f0d47b6b144763927bede81ea540"
 		score = 75
 		quality = 75
 		tags = ""
@@ -252237,20 +250896,18 @@ rule DITEKSHEN_MALWARE_Win_PWSH_Poshkeylogger
 	condition:
 		6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Fujinamarat : FILE
 {
 	meta:
 		description = "Detects FujinamaRAT"
 		author = "ditekSHen"
-		id = "f6b08713-1c03-5914-b0a2-ea9164a3f2cb"
+		id = "200b3809-b70b-502b-b9e8-498b39b5e071"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4629-L4645"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "42557094afe67196442f46d76f156c09852d694bcc5f03eac51e79ad247c2fdd"
+		logic_hash = "v1_sha256_42557094afe67196442f46d76f156c09852d694bcc5f03eac51e79ad247c2fdd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252267,22 +250924,20 @@ rule DITEKSHEN_MALWARE_Win_Fujinamarat : FILE
 		$s7 = "t_save" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Phorpiex : FILE
 {
 	meta:
 		description = "Detects Phorpiex variants"
 		author = "ditekSHen"
-		id = "e2d26c5f-939e-53e3-8730-622341d26273"
+		id = "408001b9-7604-5c3e-9448-a5b9f1e265d8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4647-L4666"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4c48a20aaf37d65471710181238d2c39c1cb0fc5a37b9c411e8d4dcfd7a9e26e"
+		logic_hash = "v1_sha256_4c48a20aaf37d65471710181238d2c39c1cb0fc5a37b9c411e8d4dcfd7a9e26e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252302,22 +250957,20 @@ rule DITEKSHEN_MALWARE_Win_Phorpiex : FILE
 		$v1_3 = "/tst.php" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or all of ($v1*))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or all of ( $v1* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_EXEPWSH_Dlagent : FILE
 {
 	meta:
 		description = "Detects SystemBC"
 		author = "ditekSHen"
-		id = "f5e7490f-806c-52d2-8f1c-9e00ab3e2780"
+		id = "fcd99d6e-8601-5a7b-a51e-d08a49f6cbe1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4668-L4687"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6380359db1ac775cea3ebb93f7cf22a92d2f2e634c6aa724e2814c10d4ed42f5"
+		logic_hash = "v1_sha256_6380359db1ac775cea3ebb93f7cf22a92d2f2e634c6aa724e2814c10d4ed42f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252337,22 +250990,20 @@ rule DITEKSHEN_MALWARE_Win_EXEPWSH_Dlagent : FILE
 		$v6 = "start" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (($pwsh and ($bitstansfer or 2 of ($s*))) or (5 of ($v*)))
+		uint16( 0 ) == 0x5a4d and ( ( $pwsh and ( $bitstansfer or 2 of ( $s* ) ) ) or ( 5 of ( $v* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Hdlocker : FILE
 {
 	meta:
 		description = "Detects HDLocker ransomware"
 		author = "ditekSHen"
-		id = "03ada32b-6ef5-5600-954b-e9f430c6ff2d"
+		id = "0c2432ba-2a47-5363-bb2e-d391b23e7cf6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4689-L4703"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "337678a4a780947841a19c401601f1be7218276c8d4161229567dc4d6026b16a"
+		logic_hash = "v1_sha256_337678a4a780947841a19c401601f1be7218276c8d4161229567dc4d6026b16a"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -252367,22 +251018,20 @@ rule DITEKSHEN_MALWARE_Win_Hdlocker : FILE
 		$s7 = "BlackMoon RunTime Error:" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Vovalex : FILE
 {
 	meta:
 		description = "Detects Vovalex ransomware"
 		author = "ditekSHen"
-		id = "967af585-8a91-5ed0-8400-a8a24d95fd12"
+		id = "3c49bed5-4e9c-5134-b436-60ce39396fee"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4705-L4718"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ea695521981f4b007eee50e95f7989dda1f07cc411c59450489bb17391ff29dc"
+		logic_hash = "v1_sha256_ea695521981f4b007eee50e95f7989dda1f07cc411c59450489bb17391ff29dc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252396,22 +251045,20 @@ rule DITEKSHEN_MALWARE_Win_Vovalex : FILE
 		$s6 = "If you don't know where to buy" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dharma : FILE
 {
 	meta:
 		description = "Detects Dharma ransomware"
 		author = "ditekSHen"
-		id = "070be95e-8d9c-5c4d-9d46-cddea6dbb682"
+		id = "fdee834c-0c69-5694-8ff6-bcc916270406"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4720-L4728"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2727b2c0295e32699e08c3c79d7ac6fd52f1520358ac23290d40df428c969f4b"
+		logic_hash = "v1_sha256_2727b2c0295e32699e08c3c79d7ac6fd52f1520358ac23290d40df428c969f4b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252420,22 +251067,20 @@ rule DITEKSHEN_MALWARE_Win_Dharma : FILE
 		$s1 = "C:\\crysis\\Release\\PDB\\payload.pdb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cryptolocker : FILE
 {
 	meta:
 		description = "Detects Cryptolocker ransomware variants (Betarasite)"
 		author = "ditekSHen"
-		id = "4c6d714d-1fb1-55ce-8022-40f6f634e2cd"
+		id = "4da1b961-cd06-586d-8c3e-6d22005e3e68"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4730-L4752"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e1700e8ace338c25119305878e8bc52210506bd42183007985ba9601abdab87b"
+		logic_hash = "v1_sha256_e1700e8ace338c25119305878e8bc52210506bd42183007985ba9601abdab87b"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -252458,22 +251103,20 @@ rule DITEKSHEN_MALWARE_Win_Cryptolocker : FILE
 		$c3 = "https://bitpanda.com" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or (2 of ($x*) and 5 of ($s*)) or ( all of ($c*) and 1 of ($x*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or all of ( $s* ) or ( 2 of ( $x* ) and 5 of ( $s* ) ) or ( all of ( $c* ) and 1 of ( $x* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_PWSH_Poshwifistealer
 {
 	meta:
 		description = "Detects PowerShell PoshWiFiStealer"
 		author = "ditekSHen"
-		id = "69ac123d-b746-57f1-a488-547f9a9cdd86"
+		id = "21e47fe4-2891-5aaf-9c28-984a0236bb7a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4754-L4765"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "769349360b5d22226a5339a9e8471d06731dc522475c9385c1c145a0488e0ad1"
+		logic_hash = "v1_sha256_769349360b5d22226a5339a9e8471d06731dc522475c9385c1c145a0488e0ad1"
 		score = 75
 		quality = 75
 		tags = ""
@@ -252485,22 +251128,20 @@ rule DITEKSHEN_MALWARE_Win_PWSH_Poshwifistealer
 		$u2 = "/exploitechx/wifi-password-extractor" ascii
 
 	condition:
-		all of ($s*) or all of ($u*)
+		all of ( $s* ) or all of ( $u* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Steamhook : FILE
 {
 	meta:
 		description = "Detects potential Steam stealer"
 		author = "ditekSHen"
-		id = "7533fb83-d721-54e6-8ae1-1c840dd5a13d"
+		id = "f6ba7648-a108-5e02-a55a-7e40b2464a74"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4767-L4781"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "da743ca99fd19828e3938875acaf6544f17d884587a59623c8361f5905af4a57"
+		logic_hash = "v1_sha256_da743ca99fd19828e3938875acaf6544f17d884587a59623c8361f5905af4a57"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -252515,22 +251156,20 @@ rule DITEKSHEN_MALWARE_Win_Steamhook : FILE
 		$pdb2 = "\\SteamHook\\dll\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($pdb*) or (1 of ($pdb*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $pdb* ) or ( 1 of ( $pdb* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Netwire : FILE
 {
 	meta:
 		description = "Detects NetWire RAT"
 		author = "ditekSHen"
-		id = "c215f449-c725-51da-8f5b-2619bc282b22"
+		id = "c6280032-8a7f-5c69-82bd-0ecde4b479ec"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4783-L4805"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bae4f0cd7a431336bd784ba95f6ba3396e6f0f12c081e62482ad37ff859c1f1c"
+		logic_hash = "v1_sha256_bae4f0cd7a431336bd784ba95f6ba3396e6f0f12c081e62482ad37ff859c1f1c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252553,22 +251192,20 @@ rule DITEKSHEN_MALWARE_Win_Netwire : FILE
 		$g7 = "encryptedPassword" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($x*) or (1 of ($x*) and 2 of ($s*)) or ( all of ($g*) and (2 of ($s*) or 1 of ($x*))))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $x* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( all of ( $g* ) and ( 2 of ( $s* ) or 1 of ( $x* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Breakstaf : FILE
 {
 	meta:
 		description = "Detects BreakStaf ransomware"
 		author = "ditekSHen"
-		id = "3c8ca485-2cb4-56fd-a1f5-16b43515cec9"
+		id = "d5b41579-77a1-5191-93a2-8a629c9b8fe4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4807-L4827"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "56078b797c64ce77398f9b92e5677f7159d8357eafb03cf62bb30f06d4f3b2e3"
+		logic_hash = "v1_sha256_56078b797c64ce77398f9b92e5677f7159d8357eafb03cf62bb30f06d4f3b2e3"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -252589,22 +251226,20 @@ rule DITEKSHEN_MALWARE_Win_Breakstaf : FILE
 		$s13 = ".BAC" fullword wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 12 of them
+		uint16( 0 ) == 0x5a4d and 12 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Kitty : FILE
 {
 	meta:
 		description = "Detects HelloKitty ransomware, triggers on FIVEHANDS"
 		author = "ditekSHen"
-		id = "4147294a-7eff-595a-ad4f-8a84ffff960f"
+		id = "822c3e24-950e-5bdd-98c7-22f221577580"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4829-L4847"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3a36755c81ec70c127bb73448fc29325444b85b5f0704327fc81975c2af2e99e"
+		logic_hash = "v1_sha256_3a36755c81ec70c127bb73448fc29325444b85b5f0704327fc81975c2af2e99e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252623,22 +251258,20 @@ rule DITEKSHEN_MALWARE_Win_Kitty : FILE
 		$n2 = "DECRYPT_NOTE.txt" wide
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or 1 of ($n*) and 4 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 1 of ( $n* ) and 4 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent07 : FILE
 {
 	meta:
 		description = "Detects delf downloader agent"
 		author = "ditekSHen"
-		id = "a45afe84-15ae-528a-ad7e-ab9f03045789"
+		id = "6e1955d7-9458-565f-b927-aad743610ff1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4849-L4867"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1e0001d18524d0d34ad876e67e2c4dc0495ee18a73c34f53f97367876e27b406"
+		logic_hash = "v1_sha256_1e0001d18524d0d34ad876e67e2c4dc0495ee18a73c34f53f97367876e27b406"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252657,22 +251290,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent07 : FILE
 		$x2 = "uuid:A9BD8E384B2FDE118D26E6EE744C235C\" stRef:documentID=\"uuid:A8BD8E384B2FDE118D26E6EE744C235C\"/>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($s*) and 5 of ($o*)) or ( all of ($s*) and 2 of ($o*)) or ( all of ($x*) and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 2 of ( $s* ) and 5 of ( $o* ) ) or ( all of ( $s* ) and 2 of ( $o* ) ) or ( all of ( $x* ) and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Clop : FILE
 {
 	meta:
 		description = "Detects Clop ransomware variants"
 		author = "ditekSHen"
-		id = "d3c9e950-8b03-5d19-8448-9cf208813df2"
+		id = "dded6042-60b2-5dfa-82e8-0d44c1fa7639"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4869-L4889"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a1a21100c468c4db147f97b0724b7a3aefbb92b157071bfe6f61d02768573b44"
+		logic_hash = "v1_sha256_a1a21100c468c4db147f97b0724b7a3aefbb92b157071bfe6f61d02768573b44"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252693,22 +251324,20 @@ rule DITEKSHEN_MALWARE_Win_Clop : FILE
 		$o5 = { a1 64 32 41 00 43 56 89 9d 08 d5 ff ff ff d0 8b }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($x*) and (3 of ($s*) or 4 of ($o*))) or ( all of ($o*) and 2 of ($s*)) or (4 of ($s*) and 4 of ($o*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $x* ) and ( 3 of ( $s* ) or 4 of ( $o* ) ) ) or ( all of ( $o* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) and 4 of ( $o* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Maktub : FILE
 {
 	meta:
 		description = "Detects Maktub ransomware"
 		author = "ditekSHen"
-		id = "be47d858-8497-593f-865b-c3d3a5db6c2e"
+		id = "0cc944f5-3579-5fe9-ba50-c90c978bb308"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4891-L4905"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5c11d04fc3088eb8a0132b9ed83748ddb7e1bbe9d03b9e884d4003181cbb6d69"
+		logic_hash = "v1_sha256_5c11d04fc3088eb8a0132b9ed83748ddb7e1bbe9d03b9e884d4003181cbb6d69"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252723,22 +251352,20 @@ rule DITEKSHEN_MALWARE_Win_Maktub : FILE
 		$s7 = /_request@\d+/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe01
 {
 	meta:
 		description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs"
 		author = "ditekSHen"
-		id = "fd44f48c-7a24-512b-8375-c9f978a8b5bd"
+		id = "e13638db-fb70-5821-84b1-7c3db141cdbf"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4907-L4920"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7dd377f6a1cc48ef8ab9d53989755fb967c89d3798b721781bc09043ba3d86f4"
+		logic_hash = "v1_sha256_7dd377f6a1cc48ef8ab9d53989755fb967c89d3798b721781bc09043ba3d86f4"
 		score = 75
 		quality = 75
 		tags = ""
@@ -252752,22 +251379,20 @@ rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe01
 		$s2 = "[Reflection.Assembly]::Load(" ascii
 
 	condition:
-		all of ($s*) and 1 of ($rp*) and 1 of ($rm*)
+		all of ( $s* ) and 1 of ( $rp* ) and 1 of ( $rm* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe02
 {
 	meta:
 		description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs"
 		author = "ditekSHen"
-		id = "08261054-bebc-58fe-949a-27f6e817003a"
+		id = "0012e59a-a2ad-5565-9523-881fbf5f5e1c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4922-L4934"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d7677689938d3e3eb6b59b99b7e347c60214f6edf8e5f83bf85da5a5f1ad33bb"
+		logic_hash = "v1_sha256_d7677689938d3e3eb6b59b99b7e347c60214f6edf8e5f83bf85da5a5f1ad33bb"
 		score = 75
 		quality = 75
 		tags = ""
@@ -252780,22 +251405,20 @@ rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe02
 		$pe2 = "='4D5A" ascii
 
 	condition:
-		all of ($s*) and (#pe1>1 or #pe2>1) and #s1>4
+		all of ( $s* ) and ( #pe1 > 1 or #pe2 > 1 ) and #s1 > 4
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Peloader_Runpe : FILE
 {
 	meta:
 		description = "Detects PE loader / injector. Observed Gorgon TTPs"
 		author = "ditekSHen"
-		id = "262dedee-05d2-5783-b0ff-24470d310ab8"
+		id = "f61b07e9-32ff-593a-8182-2b3bc1dedffc"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4936-L4950"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0369c3e2f83a0265c81e5dcd10b4d88753bd6ce3da4bb893a364486712a2b80d"
+		logic_hash = "v1_sha256_0369c3e2f83a0265c81e5dcd10b4d88753bd6ce3da4bb893a364486712a2b80d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252810,22 +251433,20 @@ rule DITEKSHEN_MALWARE_Win_Peloader_Runpe : FILE
 		$s7 = "startupInfo" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Peloader_INF : FILE
 {
 	meta:
 		description = "Detects PE loader / injector. Potentical HCrypt. Observed Gorgon TTPs"
 		author = "ditekSHen"
-		id = "09823302-34e0-5283-9740-1475ab8077be"
+		id = "335a0baa-f048-5ee8-a9ed-87eaf5b05a29"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4952-L4963"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "758f7b465b8f9dab5c1194bee266392efe143ac219a5307e6886845b3c862700"
+		logic_hash = "v1_sha256_758f7b465b8f9dab5c1194bee266392efe143ac219a5307e6886845b3c862700"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252837,22 +251458,20 @@ rule DITEKSHEN_MALWARE_Win_Peloader_INF : FILE
 		$x4 = "3System.Resources.Tools.StronglyTypedResourceBuilder" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent08 : FILE
 {
 	meta:
 		description = "Detects known downloader agent downloading encoded binaries in patches"
 		author = "ditekSHen"
-		id = "e3450f93-7c57-5386-a901-bc5e710657a4"
+		id = "1065a92e-9b80-5f39-ad90-bd0bc96eafc8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4965-L4975"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0238c13b00e5778ef216b4e8576c321803da6e269c96c3051b9cc45a3ac6e567"
+		logic_hash = "v1_sha256_0238c13b00e5778ef216b4e8576c321803da6e269c96c3051b9cc45a3ac6e567"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252863,22 +251482,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent08 : FILE
 		$pat = /\/base\/[A-F0-9]{32}\.html/ ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and $pat and #pat>1
+		uint16( 0 ) == 0x5a4d and $pat and #pat > 1
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Doejocrypt : FILE
 {
 	meta:
 		description = "Detects DoejoCrypt / DearCry ransomware"
 		author = "ditekSHen"
-		id = "2c90f8e7-ced4-56da-ab8d-61b5ba63dacd"
+		id = "f008c94a-30e0-5923-a155-623132edbe0f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4977-L4993"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f8a3897de9522340799a59e3e755c323b0defaab73a9030b6b69a1a82c05dcd0"
+		logic_hash = "v1_sha256_f8a3897de9522340799a59e3e755c323b0defaab73a9030b6b69a1a82c05dcd0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252895,22 +251512,20 @@ rule DITEKSHEN_MALWARE_Win_Doejocrypt : FILE
 		$o3 = { 0f 8c 2a ff ff ff 53 57 e8 b7 42 00 00 8b 4c 24 }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) or ( all of ($o*) and (2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $o* ) and ( 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Sunshuttle : FILE
 {
 	meta:
 		description = "Detects SunShuttle / GoldMax"
 		author = "ditekSHen"
-		id = "1618d0bc-6e72-5f1e-81e7-56611bfd7f8b"
+		id = "f10231f9-8bdc-576b-aeae-bae350f422b7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4995-L5017"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fa8feb069e73aa0a7fcb4daecc1fdf8edeff65e5aeefef161626647fe989e5c0"
+		logic_hash = "v1_sha256_fa8feb069e73aa0a7fcb4daecc1fdf8edeff65e5aeefef161626647fe989e5c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252933,22 +251548,20 @@ rule DITEKSHEN_MALWARE_Win_Sunshuttle : FILE
 		$s15 = "main.write_file" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ranzylocker : FILE
 {
 	meta:
 		description = "Detects RanzyLocker / REntS ransomware"
 		author = "ditekSHen"
-		id = "0d74f6fd-e1d2-5939-991e-7fdd2ca3310b"
+		id = "a352d72b-7fc6-56f0-a9dc-f9c7f33dbb8f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5019-L5042"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "15897144843acf49b81c5428fd1bb56d7a2acf16047a6e5d3ca4f2aaa8891577"
+		logic_hash = "v1_sha256_15897144843acf49b81c5428fd1bb56d7a2acf16047a6e5d3ca4f2aaa8891577"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -252972,22 +251585,20 @@ rule DITEKSHEN_MALWARE_Win_Ranzylocker : FILE
 		$o4 = { 8b 44 24 2? 8b ?c 24 34 05 00 00 a0 00 89 44 24 }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($hx*) or (2 of ($hr*) and 2 of ($hx*)) or ( all of ($o*) and 2 of ($h*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $hx* ) or ( 2 of ( $hr* ) and 2 of ( $hx* ) ) or ( all of ( $o* ) and 2 of ( $h* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Wobbychipmbr : FILE
 {
 	meta:
 		description = "Detects WobbyChipMBR / Covid-21 ransomware"
 		author = "ditekSHen"
-		id = "581fbce1-128d-5323-a259-14d9bfdf09b1"
+		id = "21cb3ae6-f5f3-561c-b906-11dccb7777b3"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5044-L5060"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "168c7f610625131c9552252d2b824a90918d2961996ee0f783497dff5cf17351"
+		logic_hash = "v1_sha256_168c7f610625131c9552252d2b824a90918d2961996ee0f783497dff5cf17351"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253004,22 +251615,20 @@ rule DITEKSHEN_MALWARE_Win_Wobbychipmbr : FILE
 		$s5 = "HD(Part%d,MBRType=%02x,SigType=%02x)" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or all of ($s*) or (1 of ($x*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Snatch : FILE
 {
 	meta:
 		description = "Detects Snatch / GoRansome / MauriGo ransomware"
 		author = "ditekSHen"
-		id = "00dce673-b909-571f-8117-c5d4ce73fb31"
+		id = "fd2cca15-d837-5e2f-ae54-8ac183b368ff"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5062-L5091"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bf8c33a7203458c80a43944c3117bb897b1702f0024271904d9be682cbd695fc"
+		logic_hash = "v1_sha256_bf8c33a7203458c80a43944c3117bb897b1702f0024271904d9be682cbd695fc"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -253049,22 +251658,20 @@ rule DITEKSHEN_MALWARE_Win_Snatch : FILE
 		$p3 = "/Go/src/kitty/kidata/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or 2 of ($m*) or (1 of ($m*) and 1 of ($s*)) or ( all of ($p*) and (1 of ($s*) or 1 of ($m*))))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 2 of ( $m* ) or ( 1 of ( $m* ) and 1 of ( $s* ) ) or ( all of ( $p* ) and ( 1 of ( $s* ) or 1 of ( $m* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Meteorite : FILE
 {
 	meta:
 		description = "Detects Meteorite downloader"
 		author = "ditekSHen"
-		id = "ce7a72ce-56a8-5def-a952-f0b08efe8a4a"
+		id = "0309e8e9-1fa1-5ac6-b4da-1d1d6676139c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5093-L5109"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0ae8183d949046be4257b48571a266f2501d60dd302f511ca1a2d518884e6a7f"
+		logic_hash = "v1_sha256_0ae8183d949046be4257b48571a266f2501d60dd302f511ca1a2d518884e6a7f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253081,22 +251688,20 @@ rule DITEKSHEN_MALWARE_Win_Meteorite : FILE
 		$s6 = "^_http" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or (5 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Legionlocker : FILE
 {
 	meta:
 		description = "Detects LegionLocker ransomware"
 		author = "ditekSHen"
-		id = "4e5c50d0-808e-5adb-bce9-804ddf66ca61"
+		id = "91f95506-a8d6-51f8-9229-4d1a81b76335"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5111-L5129"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2da897b5603415f14fff134b3a94d77e6963da79e117d26ba16e6b04e45f4045"
+		logic_hash = "v1_sha256_2da897b5603415f14fff134b3a94d77e6963da79e117d26ba16e6b04e45f4045"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253115,22 +251720,20 @@ rule DITEKSHEN_MALWARE_Win_Legionlocker : FILE
 		$pdb2 = "\\obj\\Release\\LegionLocker.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($m*) or 1 of ($pdb*) or 4 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $m* ) or 1 of ( $pdb* ) or 4 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagentgo : FILE
 {
 	meta:
 		description = "Detects Go-based downloader"
 		author = "ditekSHen"
-		id = "e16ccb89-2eb6-5457-a88e-f802f3c35764"
+		id = "eb868b46-b69c-5d90-bea6-29170499891c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5131-L5144"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b9dd2446eddff18be00feb34d8911600feb395a9ce2566786d42b48b444230d0"
+		logic_hash = "v1_sha256_b9dd2446eddff18be00feb34d8911600feb395a9ce2566786d42b48b444230d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253144,22 +251747,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagentgo : FILE
 		$s6 = "/go/src/installwrap/main.go" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Blackmoon : FILE
 {
 	meta:
 		description = "Detects executables using BlackMoon RunTime"
 		author = "ditekSHen"
-		id = "76071d36-3d2d-589c-8c3f-0ae60e69996e"
+		id = "4d1045bd-8c8b-5d15-bed6-4a090d375c5f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5146-L5155"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "05bfde8ec3a469df5707c195e25995ac6af730e8a1595b1a598276c024420be2"
+		logic_hash = "v1_sha256_05bfde8ec3a469df5707c195e25995ac6af730e8a1595b1a598276c024420be2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253169,22 +251770,20 @@ rule DITEKSHEN_MALWARE_Win_Blackmoon : FILE
 		$s2 = "BlackMoon RunTime Error:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Iceid : FILE
 {
 	meta:
 		description = "Detects IceID / Bokbot variants"
 		author = "ditekSHen"
-		id = "0da94737-0f82-5892-a0eb-f9f3c0a114cc"
+		id = "ee8e7567-b2a9-507b-bcdd-cd6067855172"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5157-L5176"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "204b4c297806a36ca14bb3e659824f4eb49b18308af7090f0db1194705f1e2c9"
+		logic_hash = "v1_sha256_204b4c297806a36ca14bb3e659824f4eb49b18308af7090f0db1194705f1e2c9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253204,22 +251803,20 @@ rule DITEKSHEN_MALWARE_Win_Iceid : FILE
 		$s5 = "%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.8X" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($n*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($n*)))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $n* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $n* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Purge : FILE
 {
 	meta:
 		description = "Detects Purge ransomware"
 		author = "ditekSHen"
-		id = "b3fb9f38-ce12-5e0e-8908-3379b5da3497"
+		id = "87b5a4a9-02cd-5f5f-95bc-5b8b9fdfc8ed"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5178-L5201"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "83d13eca69bc99539e47d6d29689edf2a4fcd2260c6e909582126a490eef8115"
+		logic_hash = "v1_sha256_83d13eca69bc99539e47d6d29689edf2a4fcd2260c6e909582126a490eef8115"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253243,22 +251840,20 @@ rule DITEKSHEN_MALWARE_Win_Purge : FILE
 		$s8 = "FinishEnds" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($n*) or 2 of ($m*) or (3 of ($s*) and (1 of ($n*) or 1 of ($m*))))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $n* ) or 2 of ( $m* ) or ( 3 of ( $s* ) and ( 1 of ( $n* ) or 1 of ( $m* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Njrat : FILE
 {
 	meta:
 		description = "Detects NjRAT / Bladabindi / NjRAT Golden"
 		author = "ditekSHen"
-		id = "078dea64-8f95-5939-a1fb-c0a888adcf0d"
+		id = "1437a9fd-00e5-5b6c-9438-3a74df55d5a8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5203-L5220"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "92d535a7c7f361b7a0901d0b99427ebc82a69577bfea73c04a7f9d51d2054b36"
+		logic_hash = "v1_sha256_92d535a7c7f361b7a0901d0b99427ebc82a69577bfea73c04a7f9d51d2054b36"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253276,22 +251871,20 @@ rule DITEKSHEN_MALWARE_Win_Njrat : FILE
 		$s9 = "No Antivirus" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Darktrackrat : FILE
 {
 	meta:
 		description = "Detects OzoneRAT / DarkTrack / DarkSky"
 		author = "ditekSHen"
-		id = "ef8675f8-f643-5948-a967-e4a9ce5ab89e"
+		id = "a0a127cd-0346-512c-8481-49093a076ee2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5222-L5245"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2a831c0f7707864d8c9e9fa338085a52933869d8cfbdbe0d12715da301c12646"
+		logic_hash = "v1_sha256_2a831c0f7707864d8c9e9fa338085a52933869d8cfbdbe0d12715da301c12646"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253315,22 +251908,20 @@ rule DITEKSHEN_MALWARE_Win_Darktrackrat : FILE
 		$s8 = "\\\\.\\SyserBoot" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($x*) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or 6 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Godzilla : FILE
 {
 	meta:
 		description = "Detects Godzilla loader"
 		author = "ditekSHen"
-		id = "3384b844-6abf-5f94-a62b-7ebbdfe321bd"
+		id = "8088fc71-a3c0-547f-8dc2-b9fc3735498c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5247-L5265"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ff87fbaaf488ac69e06a03a7f8e5305ec114caa6271c25fa130033f50f0d9095"
+		logic_hash = "v1_sha256_ff87fbaaf488ac69e06a03a7f8e5305ec114caa6271c25fa130033f50f0d9095"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253349,22 +251940,20 @@ rule DITEKSHEN_MALWARE_Win_Godzilla : FILE
 		$s8 = "Foredestine8" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($x*) and 2 of ($s*)
+		uint16( 0 ) == 0x5a4d and all of ( $x* ) and 2 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_UNK03 : FILE
 {
 	meta:
 		description = "Detects unknown malware"
 		author = "ditekSHen"
-		id = "b0711427-b6bf-5e4b-af36-9c752ead4d6c"
+		id = "0377c36d-739c-5640-922e-dc5fc6182393"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5267-L5280"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f1a4be68206628c3addbce8b6bbc1f801e67632d4e6a6af1d45cdad833e9a991"
+		logic_hash = "v1_sha256_f1a4be68206628c3addbce8b6bbc1f801e67632d4e6a6af1d45cdad833e9a991"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253378,22 +251967,20 @@ rule DITEKSHEN_MALWARE_Win_UNK03 : FILE
 		$s6 = "%s\\appl%c.jpg" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_UNK04 : FILE
 {
 	meta:
 		description = "Detects unknown malware (proxy tool)"
 		author = "ditekSHen"
-		id = "6a178f37-a9fd-5a83-a550-c6333342ac9b"
+		id = "9831104d-6c43-542b-88b6-224683c83659"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5282-L5296"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ba6e5bbc1d094b23e3870af963503d1ccbcd56adc24126b4a38b77d4b88b4b67"
+		logic_hash = "v1_sha256_ba6e5bbc1d094b23e3870af963503d1ccbcd56adc24126b4a38b77d4b88b4b67"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253408,22 +251995,20 @@ rule DITEKSHEN_MALWARE_Win_UNK04 : FILE
 		$s4 = "Miner.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($x*) and 2 of ($s*)
+		uint16( 0 ) == 0x5a4d and all of ( $x* ) and 2 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Karkoff : FILE
 {
 	meta:
 		description = "Detects Karkoff"
 		author = "ditekSHen"
-		id = "7d2fe783-18b3-5d84-a9b5-e8e0b5a0db98"
+		id = "724eadea-0279-5e02-b0ef-71fe6f7f6d53"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5298-L5313"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e9b6ba5be2b3cd0faa898347e57cee5a57b80b19842c3a1ddb42d620307c8b39"
+		logic_hash = "v1_sha256_e9b6ba5be2b3cd0faa898347e57cee5a57b80b19842c3a1ddb42d620307c8b39"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253439,22 +252024,20 @@ rule DITEKSHEN_MALWARE_Win_Karkoff : FILE
 		$s5 = "new backdoor" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 4 of ($s*) or (2 of ($x*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 4 of ( $s* ) or ( 2 of ( $x* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent09 : FILE
 {
 	meta:
 		description = "Detects known downloader agent"
 		author = "ditekSHen"
-		id = "90f71ac7-19d9-5a8e-9830-df2f16e12c9b"
+		id = "3e82b7ea-f6e6-5dc8-b8b5-2ebc545e666d"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5315-L5328"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9336507fa4bb9d3a6325d5e9caafc8c4e816a0166fded7d4e53e09a87628bc89"
+		logic_hash = "v1_sha256_9336507fa4bb9d3a6325d5e9caafc8c4e816a0166fded7d4e53e09a87628bc89"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -253468,22 +252051,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent09 : FILE
 		$s4 = "WebClient" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($h*) and all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $h* ) and all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Coinminingbot : FILE
 {
 	meta:
 		description = "Detects coinmining bot"
 		author = "ditekSHen"
-		id = "df15bfbd-f531-5eaa-b160-ad8a1fbe992f"
+		id = "9f1308d4-d0e0-519a-a0f7-f88e23924339"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5330-L5343"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a307a6c9184e8f4068cfa89a8432ae017c8aab10b706ba065051f8749860c15c"
+		logic_hash = "v1_sha256_a307a6c9184e8f4068cfa89a8432ae017c8aab10b706ba065051f8749860c15c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253497,7 +252078,7 @@ rule DITEKSHEN_MALWARE_Win_Coinminingbot : FILE
 		$s6 = "/Data/GetUpdateInfo" wide
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
 import "pe"
 
@@ -253506,34 +252087,32 @@ rule DITEKSHEN_MALWARE_Win_Fyanti : FILE
 	meta:
 		description = "Hunt for FYAnti third-stage loader DLLs"
 		author = "ditekSHen"
-		id = "7a1f913c-d83f-50e9-943c-246c4c71c654"
+		id = "86d4de8e-f1ac-5dc7-99c2-e960cc647054"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5345-L5351"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "baaeef0b1452d7ea41ffaaff592cac2c5e16f921dbbfb3a300a63e69f134e9d0"
+		logic_hash = "v1_sha256_baaeef0b1452d7ea41ffaaff592cac2c5e16f921dbbfb3a300a63e69f134e9d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.exports("FuckYouAnti")
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and pe.exports ( "FuckYouAnti" )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent10 : FILE
 {
 	meta:
 		description = "Detects known downloader agent"
 		author = "ditekSHen"
-		id = "b5807adf-9d15-5e08-97fb-a529acb1c1eb"
+		id = "0c85eb89-af38-50d2-8fc5-209c151edbf3"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5353-L5364"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "74647b39331727000608bc89b30189d802e62d59876659d4477deb4da2fcfe13"
+		logic_hash = "v1_sha256_74647b39331727000608bc89b30189d802e62d59876659d4477deb4da2fcfe13"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -253545,22 +252124,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent10 : FILE
 		$s4 = "_CreateNoWindow" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Pureloader : FILE
 {
 	meta:
 		description = "Detects Pure loader / injector"
 		author = "ditekSHen"
-		id = "ad44a12a-4ac7-5cc7-92ab-13c23514de69"
+		id = "ec57b47e-2af8-5d50-9ca7-2593073ec508"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5366-L5382"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1f0bd20e769ea79d28d6e60ca06aa8aa2b3436426cfe0cd4f2023a08236875cd"
+		logic_hash = "v1_sha256_1f0bd20e769ea79d28d6e60ca06aa8aa2b3436426cfe0cd4f2023a08236875cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253577,22 +252154,20 @@ rule DITEKSHEN_MALWARE_Win_Pureloader : FILE
 		$s9 = "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_VBS_Dlagent01
 {
 	meta:
 		description = "Detects VBS MSHTA downloader"
 		author = "ditekSHen"
-		id = "447ea323-ecab-5f6b-b13e-0690254c754e"
+		id = "d591b203-82c5-56ca-b2dc-cf347e0bb6b1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5384-L5395"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0e47839a55773764aca0aebcf1078c06c729b86d1e2f18d7d64e3bb11e87f3eb"
+		logic_hash = "v1_sha256_0e47839a55773764aca0aebcf1078c06c729b86d1e2f18d7d64e3bb11e87f3eb"
 		score = 75
 		quality = 75
 		tags = ""
@@ -253606,20 +252181,18 @@ rule DITEKSHEN_MALWARE_Win_VBS_Dlagent01
 	condition:
 		all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ranumbot : FILE
 {
 	meta:
 		description = "Detects RanumBot / Windigo / GoStealer"
 		author = "ditekSHen"
-		id = "26a0832e-8a39-5a0e-bd39-710744212c16"
+		id = "dd0ff9c0-6064-5159-b0e4-1856adee9854"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5397-L5430"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a9c32445e62d072e4184d25497696ef6225edb176dc7a9743a54194d4ddb4b0c"
+		logic_hash = "v1_sha256_a9c32445e62d072e4184d25497696ef6225edb176dc7a9743a54194d4ddb4b0c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -253651,22 +252224,20 @@ rule DITEKSHEN_MALWARE_Win_Ranumbot : FILE
 		$uf9 = /main\.detect(Browsers|Chrome|Coccoc|Edge|Firefox|InternetExplorer|Opera|Yandex)/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($f*) or 4 of ($s*) or (2 of ($f*) and 2 of ($s*)) or ( all of ($xf*) and 1 of ($uf*)) or 6 of ($uf*))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $f* ) or 4 of ( $s* ) or ( 2 of ( $f* ) and 2 of ( $s* ) ) or ( all of ( $xf* ) and 1 of ( $uf* ) ) or 6 of ( $uf* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dllhijacker01 : FILE
 {
 	meta:
 		description = "Hunt for VSNTAR21 / DllHijacker01 IronTiger / LuckyMouse / APT27 malware"
 		author = "ditekSHen"
-		id = "0a858058-310a-5b1c-a6fe-abdec7b25abe"
+		id = "1dbab1bc-a665-5b63-9686-51c154672b70"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5432-L5448"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "48535c0bb5342e2f91ac9d015c761d8d543b122dd3cc08b7029631fcf3037bfb"
+		logic_hash = "v1_sha256_48535c0bb5342e2f91ac9d015c761d8d543b122dd3cc08b7029631fcf3037bfb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253683,22 +252254,20 @@ rule DITEKSHEN_MALWARE_Win_Dllhijacker01 : FILE
 		$s9 = "dll.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Hyperbro02 : FILE
 {
 	meta:
 		description = "Detects HyperBro IronTiger / LuckyMouse / APT27 malware"
 		author = "ditekSHen"
-		id = "1880afd7-ca06-5b43-af8f-e791ded0d7d8"
+		id = "c113c81b-6eba-5a14-8f3c-69851bde269e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5450-L5474"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ca4ee116516549fc42f7e32b3c24d631b7f2c638efbde5c07227358e78fd6f35"
+		logic_hash = "v1_sha256_ca4ee116516549fc42f7e32b3c24d631b7f2c638efbde5c07227358e78fd6f35"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253723,22 +252292,20 @@ rule DITEKSHEN_MALWARE_Win_Hyperbro02 : FILE
 		$cnc3 = "139.180.208.225" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or (2 of ($cnc*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 2 of ( $cnc* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dllhijacker02 : FILE
 {
 	meta:
 		description = "Detects ServiceCrt / DllHijacker03 IronTiger / LuckyMouse / APT27 malware"
 		author = "ditekSHen"
-		id = "de5eee06-570a-5ec3-9e1b-13de4c4f260f"
+		id = "ffe970be-0dd1-5700-900b-4f31b7fa9dca"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5512-L5527"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d4eb236256c413d4d3223cc897783f5631c7798c0f3280e72d8c8504438fcaf9"
+		logic_hash = "v1_sha256_d4eb236256c413d4d3223cc897783f5631c7798c0f3280e72d8c8504438fcaf9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253754,22 +252321,20 @@ rule DITEKSHEN_MALWARE_Win_Dllhijacker02 : FILE
 		$o6 = { 73 c7 dc 0d 4c ff 00 10 eb bf dd 05 34 ff 00 10 }
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 5 of ($o*)
+		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 5 of ( $o* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Zeoticus : FILE
 {
 	meta:
 		description = "Detects Zeoticus ransomware"
 		author = "ditekSHen"
-		id = "6d1096dd-d075-54eb-ade9-48e2f945145d"
+		id = "12f72c06-2146-5aab-9c85-b9162469e6b9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5529-L5549"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "588c140c141e82dae56758550549dfb96410db50521ac546477e1adc5575b4a0"
+		logic_hash = "v1_sha256_588c140c141e82dae56758550549dfb96410db50521ac546477e1adc5575b4a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253790,22 +252355,20 @@ rule DITEKSHEN_MALWARE_Win_Zeoticus : FILE
 		$pdb = "_cryptor\\shell_gen\\Release\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or ($pdb))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( $pdb ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent11 : FILE
 {
 	meta:
 		description = "Detects downloader agent"
 		author = "ditekSHen"
-		id = "c8bf9b1a-4ec1-5291-a334-82c79980ef53"
+		id = "0a0e45bc-1ac4-58b6-8353-1a3d37074b82"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5551-L5564"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "61df4855766050237c0b67bf70684020beb5d88f5928fa2814077e505be938a6"
+		logic_hash = "v1_sha256_61df4855766050237c0b67bf70684020beb5d88f5928fa2814077e505be938a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253819,22 +252382,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent11 : FILE
 		$s5 = "System Clear" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (($pdb) and 4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( ( $pdb ) and 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Softcnapp : FILE
 {
 	meta:
 		description = "Detects SoftCNApp"
 		author = "ditekSHen"
-		id = "473442e2-d411-5e2b-948e-c7ce034a5810"
+		id = "789b781b-89a3-57e3-8c84-5a95bafda87b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5566-L5583"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2d7f4320282218842fa2e82906bcaf691610ad1a6ea257a2a9fc9e062229a2e8"
+		logic_hash = "v1_sha256_2d7f4320282218842fa2e82906bcaf691610ad1a6ea257a2a9fc9e062229a2e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253852,22 +252413,20 @@ rule DITEKSHEN_MALWARE_Win_Softcnapp : FILE
 		$n2 = "127.0.0.1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or ( all of ($n*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( all of ( $n* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Covenantgruntstager : FILE
 {
 	meta:
 		description = "Detects Covenant Grunt Stager"
 		author = "ditekSHen"
-		id = "61495541-ed9c-5227-aa50-cbaeacfb20a2"
+		id = "65ec129c-248e-5911-9e7a-0c582d19365c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5585-L5606"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "638f63f605b21154f062b0f4d0659cd6cd87aee319debb2c1a991a679fec087a"
+		logic_hash = "v1_sha256_638f63f605b21154f062b0f4d0659cd6cd87aee319debb2c1a991a679fec087a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253889,22 +252448,20 @@ rule DITEKSHEN_MALWARE_Win_Covenantgruntstager : FILE
 		$s7 = "GetWebRequest" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or all of ($s*) or (1 of ($x*) and 5 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Fabookie : FILE
 {
 	meta:
 		description = "Detects Fabookie / ElysiumStealer"
 		author = "ditekSHen"
-		id = "dfa653c4-37d9-5e31-9c47-23adf751e4aa"
+		id = "709bb150-5cc2-5f03-bb6d-fb0e50974d16"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5608-L5624"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bbe10323817d501a361a33abf61a49ad59fcac69d78d9d9ec1744ee99a4b4629"
+		logic_hash = "v1_sha256_bbe10323817d501a361a33abf61a49ad59fcac69d78d9d9ec1744ee99a4b4629"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -253921,22 +252478,20 @@ rule DITEKSHEN_MALWARE_Win_Fabookie : FILE
 		$s9 = "CUdpClient::Start" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x0805) and 6 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x0805 ) and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cobianrat : FILE
 {
 	meta:
 		description = "Detects CobianRAT, a fork of Njrat"
 		author = "ditekSHen"
-		id = "5a9b6f04-fc52-52a9-b72f-d24dd093e886"
+		id = "31900ba2-63d3-581a-a290-38810747618a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5626-L5640"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5c8f55e5328b61c3591c876797b4521f8e98af7a6c53bab918f10d5c3c2b5013"
+		logic_hash = "v1_sha256_5c8f55e5328b61c3591c876797b4521f8e98af7a6c53bab918f10d5c3c2b5013"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253951,22 +252506,20 @@ rule DITEKSHEN_MALWARE_Win_Cobianrat : FILE
 		$s7 = "Hidden" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Leivion : FILE
 {
 	meta:
 		description = "Detects Leivion"
 		author = "ditekSHen"
-		id = "77800add-8fff-5657-9ed6-a23517bce0b1"
+		id = "af25b45e-9881-5843-8dfe-1c2ae572240a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5660-L5673"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a0cda23df4301b66feedad7c04b4d051c07474ccaa07c05598dd0b47bb6fc7e6"
+		logic_hash = "v1_sha256_a0cda23df4301b66feedad7c04b4d051c07474ccaa07c05598dd0b47bb6fc7e6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -253980,22 +252533,20 @@ rule DITEKSHEN_MALWARE_Win_Leivion : FILE
 		$s6 = "/var/lib/veil/go/src/runtime/mgcsweep.go" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Banload : FILE
 {
 	meta:
 		description = "Detects Banload"
 		author = "ditekSHen"
-		id = "4672bce1-1280-576d-b7df-f0181a854058"
+		id = "ee5fe587-191d-52af-a0a6-a6fba31fdc98"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5675-L5688"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5cbc69d11b73f60d6eee3f23ed6cc217ba37a3408cb69e396e0394b5a1e20b75"
+		logic_hash = "v1_sha256_5cbc69d11b73f60d6eee3f23ed6cc217ba37a3408cb69e396e0394b5a1e20b75"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254009,22 +252560,20 @@ rule DITEKSHEN_MALWARE_Win_Banload : FILE
 		$s6 = "invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrie" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_TYRAT : FILE
 {
 	meta:
 		description = "Detects TYRAT"
 		author = "ditekSHen"
-		id = "316c50cc-964e-5d24-b169-7a09fdf61638"
+		id = "39fa7646-cbb3-5987-9a98-29ff18cda824"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5690-L5703"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b733b7aa3ba1195807fb728453c0f3f4df2177836054af6f7a863e14058884cb"
+		logic_hash = "v1_sha256_b733b7aa3ba1195807fb728453c0f3f4df2177836054af6f7a863e14058884cb"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -254038,22 +252587,20 @@ rule DITEKSHEN_MALWARE_Win_TYRAT : FILE
 		$s6 = "User-Agent: wget" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Infinitylock : FILE
 {
 	meta:
 		description = "Detects InfinityLock ransomware"
 		author = "ditekSHen"
-		id = "7a66cc19-c635-580b-abc2-b58bd48673bd"
+		id = "56fda489-f69a-54ff-a22d-a254c5ff6002"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5705-L5723"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "634759f1c2d48becebc9c87e146e898524071738f74b7001b112dc793bcb581c"
+		logic_hash = "v1_sha256_634759f1c2d48becebc9c87e146e898524071738f74b7001b112dc793bcb581c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -254072,22 +252619,20 @@ rule DITEKSHEN_MALWARE_Win_Infinitylock : FILE
 		$pdb2 = "\\ChkDsk\\obj\\Debug\\PremiereCrack.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*) and 1 of ($d*)) or (4 of ($d*) and 2 of ($s*)) or ( any of ($pdb*) and 1 of ($s*) and 1 of ($d*)))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 1 of ( $d* ) ) or ( 4 of ( $d* ) and 2 of ( $s* ) ) or ( any of ( $pdb* ) and 1 of ( $s* ) and 1 of ( $d* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Mountlocker : FILE
 {
 	meta:
 		description = "Detects MountLocker ransomware"
 		author = "ditekSHen"
-		id = "0590d08d-1ee8-5dfe-af12-15b149acd2d6"
+		id = "246d8d1e-e9fa-5828-935c-db2fe723b9e9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5725-L5740"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "30bc601fef60cc1c9d8bff5dd3f8a53214f088b74eb24fe2369f5664613e0eaf"
+		logic_hash = "v1_sha256_30bc601fef60cc1c9d8bff5dd3f8a53214f088b74eb24fe2369f5664613e0eaf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254103,22 +252648,20 @@ rule DITEKSHEN_MALWARE_Win_Mountlocker : FILE
 		$s8 = "/?cid=%CLIENT_ID%" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Pingback : FILE
 {
 	meta:
 		description = "Detects PingBack ICMP backdoor"
 		author = "ditekSHen"
-		id = "ecb313b6-f923-5b6d-a4d7-a4650817ed84"
+		id = "378df4d8-1749-59c5-af95-7db4a8f83767"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5742-L5761"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c5fa9ecefca1188ba5e81c0518f74023884ad0f66718fc030601cb458bdf2f12"
+		logic_hash = "v1_sha256_c5fa9ecefca1188ba5e81c0518f74023884ad0f66718fc030601cb458bdf2f12"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254138,22 +252681,20 @@ rule DITEKSHEN_MALWARE_Win_Pingback : FILE
 		$c6 = "shell" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or all of ($c*) or (4 of ($c*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or all of ( $c* ) or ( 4 of ( $c* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bazarloader : FILE
 {
 	meta:
 		description = "Detects BazarLoader variants"
 		author = "ditekSHen"
-		id = "6282df59-7244-501f-bb60-09a2a519bd47"
+		id = "de6b094c-32aa-5d00-9649-259115cffe6c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5763-L5776"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8febd1355bc03f71794ffb8d51cbb112e8acd2d26fec5bb736a388d5384e7747"
+		logic_hash = "v1_sha256_8febd1355bc03f71794ffb8d51cbb112e8acd2d26fec5bb736a388d5384e7747"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254167,22 +252708,20 @@ rule DITEKSHEN_MALWARE_Win_Bazarloader : FILE
 		$s6 = "[+] makeMD5hash. " ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and 3 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Coinminer01 : FILE
 {
 	meta:
 		description = "Detects coinmining malware"
 		author = "ditekSHen"
-		id = "739e7cea-c6b6-5add-86d4-382b00e2b645"
+		id = "6110ef59-9c4c-5bbf-9329-cd4fb173f09d"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5778-L5790"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "31a7531ecc7b8a35ba882c17d15bd3581e65b4b99dd3a7cb8bca8f6edf204114"
+		logic_hash = "v1_sha256_31a7531ecc7b8a35ba882c17d15bd3581e65b4b99dd3a7cb8bca8f6edf204114"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254195,22 +252734,20 @@ rule DITEKSHEN_MALWARE_Win_Coinminer01 : FILE
 		$dl = "github.com/ethereum-mining/ethminer/releases/download" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or ($dl))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( $dl ) )
 }
-import "pe"
-
 rule DITEKSHEN_PUA_Win_Ultrasurf : FILE
 {
 	meta:
 		description = "Detects UltraSurf / Ultrareach PUA"
 		author = "ditekSHen"
-		id = "ba0f6867-bddc-5e72-978c-8e29b1b6b709"
+		id = "c3dcdec6-4e3c-5596-8ee2-894d0c6d641c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5792-L5807"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d8d17b1bf20c12f864697d3dd66f345a8b93e2a75f0489b58b23b7f5264b6be3"
+		logic_hash = "v1_sha256_d8d17b1bf20c12f864697d3dd66f345a8b93e2a75f0489b58b23b7f5264b6be3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254226,22 +252763,20 @@ rule DITEKSHEN_PUA_Win_Ultrasurf : FILE
 		$m4 = "main.openbrowser" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or ( all of ($m*) and 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or ( all of ( $m* ) and 1 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Hello : FILE
 {
 	meta:
 		description = "Hunt for Hello / WickrMe ransomware"
 		author = "ditekSHen"
-		id = "99c11aab-8a3a-5e10-9af0-542e55129d51"
+		id = "0c1e4f77-eb14-5f65-94b3-f254734b36b0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5809-L5820"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f52f12eb38613f5afd5258b5263c6e6e2d9db6c9659a769f896a2bb66564fa69"
+		logic_hash = "v1_sha256_f52f12eb38613f5afd5258b5263c6e6e2d9db6c9659a769f896a2bb66564fa69"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254253,22 +252788,20 @@ rule DITEKSHEN_MALWARE_Win_Hello : FILE
 		$s4 = "DismountVirtualDisks" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Buterat : FILE
 {
 	meta:
 		description = "Detects ButeRAT"
 		author = "ditekSHen"
-		id = "74f63d61-6589-5fb1-864a-3a02ddd57ebc"
+		id = "6fab0acf-6179-523c-a4b0-8af78389fdfd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5822-L5839"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c3d93e8dc1bde8e77c11586c8d8b67d137ef2c4791e12269f1af310fbe14832b"
+		logic_hash = "v1_sha256_c3d93e8dc1bde8e77c11586c8d8b67d137ef2c4791e12269f1af310fbe14832b"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -254286,22 +252819,20 @@ rule DITEKSHEN_MALWARE_Win_Buterat : FILE
 		$z1 = /(edge|chrome|opera|exodus|jaxx|atomic|coinomi)\.zip/ ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) or 1 of ($z*)) and (4 of ($s*)) or (6 of ($s*)) or (#z1>4 and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) or 1 of ( $z* ) ) and ( 4 of ( $s* ) ) or ( 6 of ( $s* ) ) or ( #z1 > 4 and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cookiestealer : FILE
 {
 	meta:
 		description = "Detects generic cookie stealer"
 		author = "ditekSHen"
-		id = "64c6c59d-4046-5949-bf71-22a5f6bfa209"
+		id = "603abdb1-71a3-58fb-b001-f8a0b46bd233"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5841-L5857"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9cc406ae078e37430b3cf10954c02014b9760bc887344842e724df735d1d9808"
+		logic_hash = "v1_sha256_9cc406ae078e37430b3cf10954c02014b9760bc887344842e724df735d1d9808"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254318,22 +252849,20 @@ rule DITEKSHEN_MALWARE_Win_Cookiestealer : FILE
 		$ua2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*) and 1 of ($pdb*) and 1 of ($ua*)) or ( all of ($ua*) and 1 of ($pdb*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 1 of ( $pdb* ) and 1 of ( $ua* ) ) or ( all of ( $ua* ) and 1 of ( $pdb* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bitcoingrabber : FILE
 {
 	meta:
 		description = "Detects generic bitcoin stealer"
 		author = "ditekSHen"
-		id = "f73b58da-1db5-5767-ae0a-074648e30966"
+		id = "50197a55-a450-51d4-9f07-509f7c02d22e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5859-L5875"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2dc762525c1fbf25517df52f0561d96d7469bf1367eada31c236fc313001c6cb"
+		logic_hash = "v1_sha256_2dc762525c1fbf25517df52f0561d96d7469bf1367eada31c236fc313001c6cb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254350,22 +252879,20 @@ rule DITEKSHEN_MALWARE_Win_Bitcoingrabber : FILE
 		$pat3 = "\\b4([0-9]|[A-B])(.){93}\\b" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) or ( all of ($pat*) and 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $pat* ) and 2 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_FOXGRABBER : FILE
 {
 	meta:
 		description = "Detects FOXGRABBER utility"
 		author = "ditekSHen"
-		id = "b98e501c-e9c6-5fcc-bfa0-9475ce32864c"
+		id = "29650f11-df6c-5276-a9a4-8104ff9491f2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5877-L5890"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5ecba516f1155bdcccf83b0a034b11d8eac8619d4c3326fdbc76082fbe4daf02"
+		logic_hash = "v1_sha256_5ecba516f1155bdcccf83b0a034b11d8eac8619d4c3326fdbc76082fbe4daf02"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254379,22 +252906,20 @@ rule DITEKSHEN_MALWARE_Win_FOXGRABBER : FILE
 		$pdb2 = "\\obj\\Release\\grabff.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $pdb* ) and 1 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Browsergrabber : FILE
 {
 	meta:
 		description = "Hunt for FOXGRABBER-like samples but for various browsers"
 		author = "ditekSHen"
-		id = "a50a60cf-5ab8-5e4e-be00-aa0306f4d84f"
+		id = "f58b1b2b-5790-55f9-924b-7c3e33efc7b0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5892-L5906"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c96a63566280758d8c32542bfab3c6faa7d21329430345f51ea4c2f0a6809dc2"
+		logic_hash = "v1_sha256_c96a63566280758d8c32542bfab3c6faa7d21329430345f51ea4c2f0a6809dc2"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -254409,22 +252934,20 @@ rule DITEKSHEN_MALWARE_Win_Browsergrabber : FILE
 		$pdb2 = "\\obj\\Release\\grab" ascii
 
 	condition:
-		uint16(0)==0x5a4d and not ($ff) and ( all of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and not ( $ff ) and ( all of ( $s* ) or ( 1 of ( $pdb* ) and 1 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Deathransom : FILE
 {
 	meta:
 		description = "Detects known DeathRansom ransomware"
 		author = "ditekSHen"
-		id = "a6eeb607-8b5c-5982-8b5a-aa2b3c6a65e6"
+		id = "4e902b25-8a17-5492-8e43-251e27159184"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5908-L5925"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3c87364a7ecc403262056eeccaa16bf230fbbe684e21d35099d0d572abba9eda"
+		logic_hash = "v1_sha256_3c87364a7ecc403262056eeccaa16bf230fbbe684e21d35099d0d572abba9eda"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254442,22 +252965,20 @@ rule DITEKSHEN_MALWARE_Win_Deathransom : FILE
 		$h6 = "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($pdb*) or ( all of ($s*) and 1 of ($pdb*)) or 5 of ($h*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $pdb* ) or ( all of ( $s* ) and 1 of ( $pdb* ) ) or 5 of ( $h* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Unlockyourfiles : FILE
 {
 	meta:
 		description = "Detects UnlockYourFiles ransomware"
 		author = "ditekSHen"
-		id = "265f2a48-143a-56c9-9cd4-b5137799a9e8"
+		id = "24437eaa-e647-51ab-adda-89900eeaeb9b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5927-L5946"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "05f549467fac03d4aa2248a9c6c87e4c4273ed6ad727ebb77a4dd115032e454b"
+		logic_hash = "v1_sha256_05f549467fac03d4aa2248a9c6c87e4c4273ed6ad727ebb77a4dd115032e454b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254477,22 +252998,20 @@ rule DITEKSHEN_MALWARE_Win_Unlockyourfiles : FILE
 		$m6 = "Unlock File" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or 5 of ($m*) or (2 of ($s*) and 2 of ($m*)))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or 5 of ( $m* ) or ( 2 of ( $s* ) and 2 of ( $m* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Decryptmyfiles : FILE
 {
 	meta:
 		description = "Detects DecryptMyFiles ransomware"
 		author = "ditekSHen"
-		id = "dab518f2-3fac-5492-88fb-35cd0000ec47"
+		id = "3e16af1e-64ad-5483-95e4-779d545e4a17"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5948-L5964"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5b7f74569700e2ad3f31388571dad5ffda45f5ab3dd36806f7514aff0367d5ba"
+		logic_hash = "v1_sha256_5b7f74569700e2ad3f31388571dad5ffda45f5ab3dd36806f7514aff0367d5ba"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -254509,22 +253028,20 @@ rule DITEKSHEN_MALWARE_Win_Decryptmyfiles : FILE
 		$c3 = "/contact/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or all of ($c*) or (2 of ($c*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or all of ( $c* ) or ( 2 of ( $c* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Motocos : FILE
 {
 	meta:
 		description = "Detects Motocos ransomware"
 		author = "ditekSHen"
-		id = "be7284be-b57d-5a2c-9a84-37d76445cd0d"
+		id = "ecbd5610-2a1c-55fc-b779-e0f9a6ee2fef"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5966-L5981"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "99ac365c277058503874313e3a74ab016d6d279b47c754c3df950e3ce60e29f1"
+		logic_hash = "v1_sha256_99ac365c277058503874313e3a74ab016d6d279b47c754c3df950e3ce60e29f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254540,22 +253057,20 @@ rule DITEKSHEN_MALWARE_Win_Motocos : FILE
 		$s8 = "TDNSUtils.SendCommand" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent12 : FILE
 {
 	meta:
 		description = "Detects downloader agent"
 		author = "ditekSHen"
-		id = "841b998b-99d1-50d8-bc7b-75b2a8e690bf"
+		id = "d9e43122-ac99-578f-b892-b7fba6b4f11c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5983-L5993"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b9845414f4ce4cc25b75a8de7569c4135bbb7ba9098fd4c50d7ac80302e99b8f"
+		logic_hash = "v1_sha256_b9845414f4ce4cc25b75a8de7569c4135bbb7ba9098fd4c50d7ac80302e99b8f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254566,22 +253081,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent12 : FILE
 		$s3 = "packet_server" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them and filesize <50KB
+		uint16( 0 ) == 0x5a4d and all of them and filesize < 50KB
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlinjector01 : FILE
 {
 	meta:
 		description = "Detects specific downloader injector shellcode"
 		author = "ditekSHen"
-		id = "c5e0946c-3e15-5ebc-b1b5-3f00566dc5cd"
+		id = "65119c35-b308-516d-aba5-3c3cbf59b23b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5995-L6015"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5c13af5fdbb2e8a27103d9502126a82d0bff15d9a269b22e4279b5b459d50e2d"
+		logic_hash = "v1_sha256_5c13af5fdbb2e8a27103d9502126a82d0bff15d9a269b22e4279b5b459d50e2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254602,22 +253115,20 @@ rule DITEKSHEN_MALWARE_Win_Dlinjector01 : FILE
 		$o7 = "bYkoDA7G" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and all of ($o*)) or ( all of ($s*))
+		( uint16( 0 ) == 0x5a4d and all of ( $o* ) ) or ( all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlinjector02 : FILE
 {
 	meta:
 		description = "Detects downloader injector"
 		author = "ditekSHen"
-		id = "ce2c418d-18e4-579c-9828-94e294385846"
+		id = "1b19e74c-2fd0-56a1-98d9-6074050b69d8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6017-L6034"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "76d185cfcbc7f4996c2fb5c7c1ba4eb20b32d322d8ff47594283a4ca3e573a0b"
+		logic_hash = "v1_sha256_76d185cfcbc7f4996c2fb5c7c1ba4eb20b32d322d8ff47594283a4ca3e573a0b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254635,22 +253146,20 @@ rule DITEKSHEN_MALWARE_Win_Dlinjector02 : FILE
 		$s4 = "vsmacros" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or ( all of ($a*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( all of ( $a* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nermer : FILE
 {
 	meta:
 		description = "Detects Nermer ransomware"
 		author = "ditekSHen"
-		id = "fce4f178-8e98-53b0-ae09-2ce876ad524e"
+		id = "313131b0-257f-5129-9c3f-4ca0245105d6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6036-L6062"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e885b1b908b256ee07f5cb144d63f5ad65e5bf746b70efe168b0ac742a246ab3"
+		logic_hash = "v1_sha256_e885b1b908b256ee07f5cb144d63f5ad65e5bf746b70efe168b0ac742a246ab3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254677,22 +253186,20 @@ rule DITEKSHEN_MALWARE_Win_Nermer : FILE
 		$c4 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($m*) or all of ($c*) or all of ($s*) or (4 of ($s*) and (1 of ($x*) or 1 of ($m*) or 2 of ($c*))) or 14 of them )
+		uint16( 0 ) == 0x5a4d and ( all of ( $m* ) or all of ( $c* ) or all of ( $s* ) or ( 4 of ( $s* ) and ( 1 of ( $x* ) or 1 of ( $m* ) or 2 of ( $c* ) ) ) or 14 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Beastdoor : FILE
 {
 	meta:
 		description = "Detects Beastdoor backdoor"
 		author = "ditekSHen"
-		id = "b271d53e-2693-5a93-825a-ef32f72a4b01"
+		id = "e1dd22a9-185e-559f-ab30-63c5ac7945e2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6064-L6084"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d9a72717d124bcf1e3b95850cd524e577abe96a094586a5555faadba78fcb9ad"
+		logic_hash = "v1_sha256_d9a72717d124bcf1e3b95850cd524e577abe96a094586a5555faadba78fcb9ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254713,22 +253220,20 @@ rule DITEKSHEN_MALWARE_Win_Beastdoor : FILE
 		$n7 = "mirabilis.com" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($n*) or (3 of ($s*) and 3 of ($n*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 5 of ( $n* ) or ( 3 of ( $s* ) and 3 of ( $n* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Gravityrat : FILE
 {
 	meta:
 		description = "Detects GravityRAT"
 		author = "ditekSHen"
-		id = "cb581dd6-15b2-54ae-9f27-30ec21554fb9"
+		id = "854b799c-d96d-5970-b348-53d6fa00e1d6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6086-L6108"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a6b049dbf21f22f751c15da98536e9ef2a4ced7755ade0cc9904afddef1d3ae6"
+		logic_hash = "v1_sha256_a6b049dbf21f22f751c15da98536e9ef2a4ced7755ade0cc9904afddef1d3ae6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254751,22 +253256,20 @@ rule DITEKSHEN_MALWARE_Win_Gravityrat : FILE
 		$f5 = "<MatchMacAdd>b__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or ( all of ($f*) and 1 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( all of ( $f* ) and 1 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Fatalrat : FILE
 {
 	meta:
 		description = "Detects FatalRAT"
 		author = "ditekSHen"
-		id = "f9d0c5dd-ae69-512d-a260-01b9765e10eb"
+		id = "1eea8168-edf0-50a8-abf5-76af1aa65403"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6110-L6128"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fb7f6822aa4ef98e77670d276d06c9a37718bce38d32ce5b53fe67513b107fbe"
+		logic_hash = "v1_sha256_fb7f6822aa4ef98e77670d276d06c9a37718bce38d32ce5b53fe67513b107fbe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254785,22 +253288,20 @@ rule DITEKSHEN_MALWARE_Win_Fatalrat : FILE
 		$s10 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Wingo : FILE
 {
 	meta:
 		description = "Detects malicious Golang executables"
 		author = "ditekSHen"
-		id = "bc0c84d6-7ea1-5234-89f6-98337900e044"
+		id = "d3f41352-8257-59e6-98b2-2e1b1249cc88"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6130-L6141"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "423b1631ad625fd46a9d10f0ecdf24931cf62a2c1694da3ebdd38daad0a4f724"
+		logic_hash = "v1_sha256_423b1631ad625fd46a9d10f0ecdf24931cf62a2c1694da3ebdd38daad0a4f724"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -254812,22 +253313,20 @@ rule DITEKSHEN_MALWARE_Win_Wingo : FILE
 		$s4 = /main\.[a-z]{9}rundll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of them and #s2>2 and #s3>2 and #s4>2)
+		uint16( 0 ) == 0x5a4d and ( all of them and #s2 > 2 and #s3 > 2 and #s4 > 2 )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_GENERIC03 : FILE
 {
 	meta:
 		description = "Detects unknown malicious executables"
 		author = "ditekSHen"
-		id = "aa0a720d-8215-58d8-b3ce-98d50318cbf9"
+		id = "1cc4a80b-c0cc-566e-ab01-4815b8a32aa1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6143-L6154"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9166808a3dab80d9d85b3b976ae658160c8389c7d0e05a46d553b5bb9d41a1cb"
+		logic_hash = "v1_sha256_9166808a3dab80d9d85b3b976ae658160c8389c7d0e05a46d553b5bb9d41a1cb"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -254839,22 +253338,20 @@ rule DITEKSHEN_MALWARE_Win_GENERIC03 : FILE
 		$s4 = "C++\\Browser_noime\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Pandastealer : FILE
 {
 	meta:
 		description = "Detects Panda Stealer"
 		author = "ditekSHen"
-		id = "099f0a03-6dfd-5ae5-baaf-fe2b66de759d"
+		id = "0c0d5696-d097-5a7f-87f5-7766df603487"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6156-L6172"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "23a911bfe14defe8f961068d43bb349b66ee73f8b2f281f2bec1c0ecb8f37b25"
+		logic_hash = "v1_sha256_23a911bfe14defe8f961068d43bb349b66ee73f8b2f281f2bec1c0ecb8f37b25"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -254871,22 +253368,20 @@ rule DITEKSHEN_MALWARE_Win_Pandastealer : FILE
 		$s9 = "|| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Gelsemine : FILE
 {
 	meta:
 		description = "Detects Gelsemine"
 		author = "ditekSHen"
-		id = "f7e9ca53-fc52-5da0-a760-cb09c2544f4f"
+		id = "866eab1d-3cc4-55b3-87bf-5b174eb06d98"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6174-L6194"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8c20efa6f34ee9165fac9f1f2e5eb20830a02016309dfaa5681977e1a8ac6068"
+		logic_hash = "v1_sha256_8c20efa6f34ee9165fac9f1f2e5eb20830a02016309dfaa5681977e1a8ac6068"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254907,22 +253402,20 @@ rule DITEKSHEN_MALWARE_Win_Gelsemine : FILE
 		$o6 = { 68 00 06 00 00 6a 00 e8 d3 ff ff ff a2 48 00 41 }
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or ( all of ($o*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( all of ( $o* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Gelsevirine : FILE
 {
 	meta:
 		description = "Detects Gelsevirine"
 		author = "ditekSHen"
-		id = "70f0ed08-4e07-5ab3-968e-95059d20a8e9"
+		id = "10912bb0-29c9-5785-bf8e-0612c47b17b7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6224-L6254"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "60d41d6d789f1cd2a7040d6535f13c69ea58a489035838f047b886e8f1f37f63"
+		logic_hash = "v1_sha256_60d41d6d789f1cd2a7040d6535f13c69ea58a489035838f047b886e8f1f37f63"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -254953,22 +253446,20 @@ rule DITEKSHEN_MALWARE_Win_Gelsevirine : FILE
 		$m8 = "6BDA7FEF-232F-4EA6-8FC8-24F58CD7B366" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or (2 of ($c*) and 4 of ($s*)) or (5 of ($m*) and (1 of ($c*) or 3 of ($s*))))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( 2 of ( $c* ) and 4 of ( $s* ) ) or ( 5 of ( $m* ) and ( 1 of ( $c* ) or 3 of ( $s* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ipsechelper : FILE
 {
 	meta:
 		description = "Detects IPsecHelper backdoor"
 		author = "ditekSHen"
-		id = "f848ac2a-95ad-596a-b193-5cfb424e33a2"
+		id = "3190bfdc-6406-5ce6-bbfd-7c5629183fa2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6256-L6279"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "be0ecf8a97d289b15b902420d769925b7b22ab835bd7d10d10b059119f41e540"
+		logic_hash = "v1_sha256_be0ecf8a97d289b15b902420d769925b7b22ab835bd7d10d10b059119f41e540"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -254992,22 +253483,20 @@ rule DITEKSHEN_MALWARE_Win_Ipsechelper : FILE
 		$c6 = "DeviceIdSalt" wide
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or 4 of ($c*) or 8 of them )
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 4 of ( $c* ) or 8 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Apostle : FILE
 {
 	meta:
 		description = "Detects Apsotle"
 		author = "ditekSHen"
-		id = "6e6d2ef0-b709-5915-b644-db86d9d3f26a"
+		id = "8ecb6519-832d-5ca8-a44e-90ead7ffc2dd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6281-L6295"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "aa5a522383cbb7e2fdb90f4c4395c7f92f546aa1dbda8f44090225861f011630"
+		logic_hash = "v1_sha256_aa5a522383cbb7e2fdb90f4c4395c7f92f546aa1dbda8f44090225861f011630"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255022,22 +253511,20 @@ rule DITEKSHEN_MALWARE_Win_Apostle : FILE
 		$s7 = "disall" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_DEADWOOD : FILE
 {
 	meta:
 		description = "Detects DEADWOOD"
 		author = "ditekSHen"
-		id = "a75e30d8-75ec-5eaf-94f5-5556a3b947ae"
+		id = "645dff7c-fe37-5668-9098-5f6d8cef358f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6297-L6313"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bf53abc801971b294e0a23bb0162ceb7c56a563a16e73c317f6a890ba545b67d"
+		logic_hash = "v1_sha256_bf53abc801971b294e0a23bb0162ceb7c56a563a16e73c317f6a890ba545b67d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255054,22 +253541,20 @@ rule DITEKSHEN_MALWARE_Win_DEADWOOD : FILE
 		$s9 = "\\params" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Turian : FILE
 {
 	meta:
 		description = "Hunt for Turian / Qurian"
 		author = "ditekSHen"
-		id = "eafa9442-a01b-5044-bc47-634297a3efcc"
+		id = "13f7a450-c004-5d9b-810e-5275384108e9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6315-L6343"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "87f4263381c5e93fcba0873aa3bb9a1db4b21225141cd7f06be30f5777a47806"
+		logic_hash = "v1_sha256_87f4263381c5e93fcba0873aa3bb9a1db4b21225141cd7f06be30f5777a47806"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255098,22 +253583,20 @@ rule DITEKSHEN_MALWARE_Win_Turian : FILE
 		$m4 = "uwatchdaemon" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or ( all of ($c*) and (2 of ($s*) or 1 of ($m*) or 1 of ($p*))) or (1 of ($m*) and 1 of ($s*) and (1 of ($c*) or 1 of ($p*))))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( all of ( $c* ) and ( 2 of ( $s* ) or 1 of ( $m* ) or 1 of ( $p* ) ) ) or ( 1 of ( $m* ) and 1 of ( $s* ) and ( 1 of ( $c* ) or 1 of ( $p* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlagent14 : FILE
 {
 	meta:
 		description = "Detects downloader injector"
 		author = "ditekSHen"
-		id = "6f80567e-b89a-557d-a282-b61c0b99625e"
+		id = "6095ac4a-94b4-5682-86d9-6f8bb57918ab"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6365-L6378"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2806b553635dbf96e9c00d3554dd5732df64200b3ae2c4845a2675218bd56387"
+		logic_hash = "v1_sha256_2806b553635dbf96e9c00d3554dd5732df64200b3ae2c4845a2675218bd56387"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255127,22 +253610,20 @@ rule DITEKSHEN_MALWARE_Win_Dlagent14 : FILE
 		$s6 = "= CreateObject(\"Microsoft.XMLHTTP\")" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Markirat : FILE
 {
 	meta:
 		description = "Detects MarkiRAT"
 		author = "ditekSHen"
-		id = "6cfa276c-a64e-532a-a1ae-11a9e00867bd"
+		id = "7cc3d54a-f2cf-58dd-ab6b-c84592917f74"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6380-L6403"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "17b8bcfe8d2b4c87ff8e0bddb436e18029a3b28a5ad3994fe9bef359588d9cad"
+		logic_hash = "v1_sha256_17b8bcfe8d2b4c87ff8e0bddb436e18029a3b28a5ad3994fe9bef359588d9cad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255166,22 +253647,20 @@ rule DITEKSHEN_MALWARE_Win_Markirat : FILE
 		$c6 = "Content-Disposition: form-data; name=\"uploadedfile\"; filename=\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (($pdb and any of them ) or (5 of ($s*)) or (3 of ($c*)) or ((#ba>3 and 4 of them )))
+		uint16( 0 ) == 0x5a4d and ( ( $pdb and any of them ) or ( 5 of ( $s* ) ) or ( 3 of ( $c* ) ) or ( ( #ba > 3 and 4 of them ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Klingonrat : FILE
 {
 	meta:
 		description = "Detects KlingonRAT"
 		author = "ditekSHen"
-		id = "bea50bce-b38c-50a0-902a-1014615bd9b8"
+		id = "d069fe34-360e-577a-b23d-4565cf5156f3"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6405-L6427"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2abfbfc1b67f931f15bfdfd2cd4ba7821e62eb8c518bbc04629c0dd694bbd9c1"
+		logic_hash = "v1_sha256_2abfbfc1b67f931f15bfdfd2cd4ba7821e62eb8c518bbc04629c0dd694bbd9c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255204,22 +253683,20 @@ rule DITEKSHEN_MALWARE_Win_Klingonrat : FILE
 		$c6 = "failurehttps://%s:%d/botif-modified-sinceillegal" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($go) and (3 of ($c*) or 5 of ($s*) or (3 of ($s*) and 1 of ($c*)))
+		uint16( 0 ) == 0x5a4d and ( $go ) and ( 3 of ( $c* ) or 5 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $c* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Xfiles : FILE
 {
 	meta:
 		description = "Detects X-Files infostealer (formerly BotSh1zoid)"
 		author = "ditekSHen"
-		id = "3f8b2f9b-aa6a-5ffc-95b8-5e44de0d1a49"
+		id = "193dacd7-6443-5d5c-ba34-d4c5e2e1dc0b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6429-L6460"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0c04a8f019aea36f4bba3ce8289c2d608c69d76bbf321052560b4ca2214be057"
+		logic_hash = "v1_sha256_0c04a8f019aea36f4bba3ce8289c2d608c69d76bbf321052560b4ca2214be057"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -255251,22 +253728,20 @@ rule DITEKSHEN_MALWARE_Win_Xfiles : FILE
 		$g3 = "$ebc25cf6-9120-4283-b972-0e5520d0000C" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($v1*) or 3 of ($v2*))) or 7 of ($v1*) or 3 of ($v2*) or (2 of ($g*) and 3 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 3 of ( $s* ) or 3 of ( $v1* ) or 3 of ( $v2* ) ) ) or 7 of ( $v1* ) or 3 of ( $v2* ) or ( 2 of ( $g* ) and 3 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Allakore : FILE
 {
 	meta:
 		description = "Detects AllaKore"
 		author = "ditekSHen"
-		id = "371663c1-6faf-5ca3-a79e-e4340d44660b"
+		id = "081b10ce-077d-5c8a-8d3d-8d2c2e50dd41"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6462-L6493"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0e93682787e27246cdddbd67ca5360728c65049a2e97e71809b5902854aa4bef"
+		logic_hash = "v1_sha256_0e93682787e27246cdddbd67ca5360728c65049a2e97e71809b5902854aa4bef"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -255298,22 +253773,20 @@ rule DITEKSHEN_MALWARE_Win_Allakore : FILE
 		$s10 = "Remote File Manager" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($x*) or 4 of ($s*) or (3 of ($s*) and 2 of ($x*)))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or 4 of ( $s* ) or ( 3 of ( $s* ) and 2 of ( $x* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Reverserat : FILE
 {
 	meta:
 		description = "Detects ReverseRAT"
 		author = "ditekSHen"
-		id = "df13fc6c-025a-54db-809d-4f3c27b8aa7a"
+		id = "90b87ec7-bdba-5b47-ae15-aa754fc8502c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6495-L6514"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "87ab00a5588bfce04ec47a07b184fffe359e472ac8bf561b02a8b070edf2e014"
+		logic_hash = "v1_sha256_87ab00a5588bfce04ec47a07b184fffe359e472ac8bf561b02a8b070edf2e014"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255333,22 +253806,20 @@ rule DITEKSHEN_MALWARE_Win_Reverserat : FILE
                 78 00 69 00 74 00 }
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($pdb*) and 2 of ($s*)) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and 2 of ( $s* ) ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Smokeloader : FILE
 {
 	meta:
 		description = "Detects SmokeLoader variants"
 		author = "ditekSHen"
-		id = "e8f28f89-3a79-5d78-8c0a-bad16a57df84"
+		id = "43f1f782-38f0-5c12-91a4-b31f3c2304db"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6516-L6539"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "65c56ed11a3cb4e4bcf8fd2a6be097545cb96e84ba4c4202969d1d163a2a36ed"
+		logic_hash = "v1_sha256_65c56ed11a3cb4e4bcf8fd2a6be097545cb96e84ba4c4202969d1d163a2a36ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255368,22 +253839,20 @@ rule DITEKSHEN_MALWARE_Win_Smokeloader : FILE
 		$e3 = "\\fodhelper.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 4 of ($s*)) or (5 of ($s*) and 1 of ($e*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $e* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlinjector03 : FILE
 {
 	meta:
 		description = "Detects unknown loader / injector"
 		author = "ditekSHen"
-		id = "2d0df2d8-5b1c-5408-b8c7-8ca14d57da0f"
+		id = "4a35736c-ef1e-59aa-97cc-8e191bb02846"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6541-L6551"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "10092e7916775fe0a39baa5714fdda89f443ceabdcc610cc1fcd5a0fb0e68d0c"
+		logic_hash = "v1_sha256_10092e7916775fe0a39baa5714fdda89f443ceabdcc610cc1fcd5a0fb0e68d0c"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -255394,22 +253863,20 @@ rule DITEKSHEN_MALWARE_Win_Dlinjector03 : FILE
 		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Coinminer02 : FILE
 {
 	meta:
 		description = "Detects coinmining malware"
 		author = "ditekSHen"
-		id = "1878a1b5-4e97-5575-802e-573caded2b3a"
+		id = "ceeae5a1-8f6e-571e-b87c-926450e10239"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6553-L6571"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "83760aef667819923a2ac67c006e03bb6d4260b7a4aedd691dd5b145fb50d5c1"
+		logic_hash = "v1_sha256_83760aef667819923a2ac67c006e03bb6d4260b7a4aedd691dd5b145fb50d5c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255428,22 +253895,20 @@ rule DITEKSHEN_MALWARE_Win_Coinminer02 : FILE
 		$c5 = "losedaemon+https://" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) and 1 of ($c*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) and 1 of ( $c* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Mercurial : FILE
 {
 	meta:
 		description = "Detects Mercurial infostealer"
 		author = "ditekSHen"
-		id = "c262ada2-01ca-5fc1-adef-987908514019"
+		id = "2479804d-876c-5bd5-affe-2334d1fb0987"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6573-L6593"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "400f8f717a4e07bf4de508c02bbcd9e82bf21f3df84c989fc622378f33e192f0"
+		logic_hash = "v1_sha256_400f8f717a4e07bf4de508c02bbcd9e82bf21f3df84c989fc622378f33e192f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255464,22 +253929,20 @@ rule DITEKSHEN_MALWARE_Win_Mercurial : FILE
 		$p2 = "mfa\\.[\\w-]{84}" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 5 of ($s*) or ( all of ($p*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 5 of ( $s* ) or ( all of ( $p* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Phonzy : FILE
 {
 	meta:
 		description = "Detects specific downloader agent"
 		author = "ditekSHen"
-		id = "d35f41e4-4633-5482-9ae4-79354463f1b9"
+		id = "024d6db3-6adf-53d2-a0ef-b07d8d3123af"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6595-L6608"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "924e7674d76594314df1a32d38f19cee12a3ed49cdf5e153f98bb08a7634055c"
+		logic_hash = "v1_sha256_924e7674d76594314df1a32d38f19cee12a3ed49cdf5e153f98bb08a7634055c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255493,22 +253956,20 @@ rule DITEKSHEN_MALWARE_Win_Phonzy : FILE
 		$s5 = "WriteByte" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($ua*) and ($s1) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $ua* ) and ( $s1 ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Hive : FILE
 {
 	meta:
 		description = "Detects Hive ransomware"
 		author = "ditekSHen"
-		id = "7b79dc54-01c7-5667-acf5-a32cd7a45b54"
+		id = "02566b6d-926d-5771-8698-ff14481b90e2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6610-L6647"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "14c20ff2fa62d80eed0f4f364e24d93d493d4f3b47f664983714940afa74046f"
+		logic_hash = "v1_sha256_14c20ff2fa62d80eed0f4f364e24d93d493d4f3b47f664983714940afa74046f"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -255546,22 +254007,20 @@ rule DITEKSHEN_MALWARE_Win_Hive : FILE
 		$v2_9 = "yaml:\"ignore_dir\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($url*) or all of ($s*) or 4 of ($x*) or 5 of ($v1*) or 5 of ($v2*) or (4 of ($v2*) and #v2_1>10))
+		uint16( 0 ) == 0x5a4d and ( all of ( $url* ) or all of ( $s* ) or 4 of ( $x* ) or 5 of ( $v1* ) or 5 of ( $v2* ) or ( 4 of ( $v2* ) and #v2_1 > 10 ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Spyro : FILE
 {
 	meta:
 		description = "Detects Spyro / VoidCrypt / Limbozar ransomware"
 		author = "ditekSHen"
-		id = "8b3273c4-827e-50ce-983e-a5843f6b5a78"
+		id = "1b3ed7b4-7520-5279-98cd-e9ce3c684da8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6649-L6675"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2e3be361f6d4283fd312a4486eaa39d6594813937cc3f62dbb603babeff17929"
+		logic_hash = "v1_sha256_2e3be361f6d4283fd312a4486eaa39d6594813937cc3f62dbb603babeff17929"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255588,22 +254047,20 @@ rule DITEKSHEN_MALWARE_Win_Spyro : FILE
 		$c6 = "unique-id=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or 4 of ($c*) or 3 of ($m*) or 8 of them )
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 4 of ( $c* ) or 3 of ( $m* ) or 8 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Darkvnc : FILE
 {
 	meta:
 		description = "Detects DarkVNC"
 		author = "ditekSHen"
-		id = "3c7d215c-fcca-5a0f-b59c-d84fd894677a"
+		id = "4a1ff649-769c-5090-a3eb-c150225ce8b3"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6677-L6696"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b0dbde04c0a05e476d505b92cf7dbf3b4ef0dd9e88eafcd21b7a7d0e3623abbd"
+		logic_hash = "v1_sha256_b0dbde04c0a05e476d505b92cf7dbf3b4ef0dd9e88eafcd21b7a7d0e3623abbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255623,22 +254080,20 @@ rule DITEKSHEN_MALWARE_Win_Darkvnc : FILE
 		$s12 = "#hvnc" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_RSJON : FILE
 {
 	meta:
 		description = "Detects RSJON / Ryzerlo / HiddenTear ransomware"
 		author = "ditekSHen"
-		id = "7cc3e863-b594-51a9-9d41-68021ce3b97c"
+		id = "e3b755e4-80b3-54de-b86c-a50d6be39457"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6698-L6727"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "abfea2955bf0d0b0511ea820582cc15fbcfc38dbed71fb2a0050cd98a9311cda"
+		logic_hash = "v1_sha256_abfea2955bf0d0b0511ea820582cc15fbcfc38dbed71fb2a0050cd98a9311cda"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -255668,22 +254123,20 @@ rule DITEKSHEN_MALWARE_Win_RSJON : FILE
 		$c6 = "/rnsm/write.php" wide
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or 6 of ($s*) or 4 of ($c*) or (2 of ($c*) and 4 of ($s*)) or (1 of ($pdb*) and 1 of them ))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or 6 of ( $s* ) or 4 of ( $c* ) or ( 2 of ( $c* ) and 4 of ( $s* ) ) or ( 1 of ( $pdb* ) and 1 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Boxcaon : FILE
 {
 	meta:
 		description = "Detects IndigoZebra BoxCaon"
 		author = "ditekSHen"
-		id = "becbde73-8b72-5e98-8684-87068ffff71b"
+		id = "6f5a9311-4398-5904-967b-621a6eaa9296"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6729-L6746"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4f2f26e6678d49bfa5937511b1788a059ee10e1b5f19e53d6386199738a925a5"
+		logic_hash = "v1_sha256_4f2f26e6678d49bfa5937511b1788a059ee10e1b5f19e53d6386199738a925a5"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -255701,22 +254154,20 @@ rule DITEKSHEN_MALWARE_Win_Boxcaon : FILE
 		$ts5 = "%scscode%d.log" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and all of ($s*)) or all of ($ts*)
+		( uint16( 0 ) == 0x5a4d and all of ( $s* ) ) or all of ( $ts* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Avoslocker : FILE
 {
 	meta:
 		description = "Hunt for AvosLocker ransomware"
 		author = "ditekSHen"
-		id = "390e57b2-207e-5013-899a-0b04aa63a56f"
+		id = "237713dd-877a-55ac-8958-ae6730aa60b0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6748-L6757"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "85601fdd13ddeb1fc0b8b98eb68e324046d60c1ae9467d083a75abebcb50e3a0"
+		logic_hash = "v1_sha256_85601fdd13ddeb1fc0b8b98eb68e324046d60c1ae9467d083a75abebcb50e3a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255726,22 +254177,20 @@ rule DITEKSHEN_MALWARE_Win_Avoslocker : FILE
 		$s2 = ".avos" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Diavol : FILE
 {
 	meta:
 		description = "Detects Diavol ransomware"
 		author = "ditekSHen"
-		id = "df5cea04-505e-5009-b247-ba71b6d81ecc"
+		id = "a370a7e0-d743-5642-8d12-22d2fa4e65e9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6759-L6784"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bcc7a9dc2dcb12ded75af9d79ab0f46f0e69da9e9fe72539be6351306ed11c18"
+		logic_hash = "v1_sha256_bcc7a9dc2dcb12ded75af9d79ab0f46f0e69da9e9fe72539be6351306ed11c18"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -255767,22 +254216,20 @@ rule DITEKSHEN_MALWARE_Win_Diavol : FILE
 		$c6 = "/BnpOnspQwtjCA/register" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or 5 of ($m*) or 4 of ($c*) or 7 of them )
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or 5 of ( $m* ) or 4 of ( $c* ) or 7 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Margulasrat : FILE
 {
 	meta:
 		description = "Detects MargulasRAT"
 		author = "ditekSHen"
-		id = "6efabf80-9194-542d-afd2-9bf9c8e26e55"
+		id = "31fabc11-d249-532c-9350-7c57d9c8dcfd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6786-L6810"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dd5b94c947d97cdc34032f2cb84b4975a1e8f510638857fb6dbe553bcff7d16e"
+		logic_hash = "v1_sha256_dd5b94c947d97cdc34032f2cb84b4975a1e8f510638857fb6dbe553bcff7d16e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255807,22 +254254,20 @@ rule DITEKSHEN_MALWARE_Win_Margulasrat : FILE
 		$c3 = "://www.mod.gov.in/dod/sites/default/files/" wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($pdb*) and (1 of ($c*) or 3 of ($s*))) or (1 of ($c*) and 3 of ($s*)) or (6 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and ( 1 of ( $c* ) or 3 of ( $s* ) ) ) or ( 1 of ( $c* ) and 3 of ( $s* ) ) or ( 6 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lilithrat : FILE
 {
 	meta:
 		description = "Detects LilithRAT"
 		author = "ditekSHen"
-		id = "87e56524-f557-5662-86bc-2b26e7c74aee"
+		id = "87ae9249-df0f-5535-8871-296ffa49e88f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6812-L6839"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1e8ac8a329ff99318e12666ea1d90d21bb9b0dff656a5eb1ce741b940c99afd5"
+		logic_hash = "v1_sha256_1e8ac8a329ff99318e12666ea1d90d21bb9b0dff656a5eb1ce741b940c99afd5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255850,22 +254295,20 @@ rule DITEKSHEN_MALWARE_Win_Lilithrat : FILE
 		$s13 = "packettype" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($pdb*) or 6 of ($s*) or (1 of ($pdb*) and 4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $pdb* ) or 6 of ( $s* ) or ( 1 of ( $pdb* ) and 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Epicenterrat : FILE
 {
 	meta:
 		description = "Detects EpicenterRAT"
 		author = "ditekSHen"
-		id = "6abe6e94-d7f5-5f88-96a6-a8fad599ef6a"
+		id = "32aa7463-79a3-52cd-a420-2cadbb2ad5ef"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6841-L6863"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e9086dff22e301f57c6a9bdb38fbed8e902d5b8ca20a5e5b3cda56db08d5582e"
+		logic_hash = "v1_sha256_e9086dff22e301f57c6a9bdb38fbed8e902d5b8ca20a5e5b3cda56db08d5582e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255888,22 +254331,20 @@ rule DITEKSHEN_MALWARE_Win_Epicenterrat : FILE
 		$s13 = "getvrs" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($pdb*) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $pdb* ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lastconn : FILE
 {
 	meta:
 		description = "Detects LastConn"
 		author = "ditekSHen"
-		id = "18727c30-d84d-5ffa-acd4-2cc54e553604"
+		id = "88e12084-a310-5425-8a0e-93cecbebc3ae"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6865-L6894"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "94f5874353d0fb475595373c06a0de91603cad9b435d35dc00febf90608d6b5a"
+		logic_hash = "v1_sha256_94f5874353d0fb475595373c06a0de91603cad9b435d35dc00febf90608d6b5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255933,22 +254374,20 @@ rule DITEKSHEN_MALWARE_Win_Lastconn : FILE
 		$s15 = "CDropbox.Api.DropboxRequestHandler+<RequestJsonStringWithRetry>d__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 12 of them
+		uint16( 0 ) == 0x5a4d and 12 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Crimsonrat : FILE
 {
 	meta:
 		description = "Detects CrimsonRAT"
 		author = "ditekSHen"
-		id = "54c9bbb2-9fa6-5c1f-9272-13255357ddbf"
+		id = "786f2872-33e8-55c6-8690-1e745fb2a3a2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6896-L6920"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a40cf09dbaafb2e7b9130af1b40e46b4c38fed6185b16435ad4c118f9e6d56c7"
+		logic_hash = "v1_sha256_a40cf09dbaafb2e7b9130af1b40e46b4c38fed6185b16435ad4c118f9e6d56c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -255973,22 +254412,20 @@ rule DITEKSHEN_MALWARE_Win_Crimsonrat : FILE
 		$s17 = "|fileslog=" wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Actionrat : FILE
 {
 	meta:
 		description = "Detects ActionRAT, CSharp and Delfi variants"
 		author = "ditekSHen"
-		id = "ceb4bd65-85c0-5614-a7cb-8f3f2f849eae"
+		id = "7ca153d4-4394-571c-a8c9-b44d87dd9934"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6922-L6955"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1552cda3f02c08582e3dd97df98416635a25005081627097df181bfc6aac4665"
+		logic_hash = "v1_sha256_1552cda3f02c08582e3dd97df98416635a25005081627097df181bfc6aac4665"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -256022,22 +254459,20 @@ rule DITEKSHEN_MALWARE_Win_Actionrat : FILE
 		$pdb2 = "\\WindowsMediaPlayer10\\obj\\x86\\Release\\winow4.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (#x1>5 or ( all of ($f*) and (1 of ($s*) or 2 of ($c*))) or 7 of ($s*) or all of ($c*) or ( all of ($pdb*) and 4 of them ) or (2 of ($x*) and 5 of them ))
+		uint16( 0 ) == 0x5a4d and ( #x1 > 5 or ( all of ( $f* ) and ( 1 of ( $s* ) or 2 of ( $c* ) ) ) or 7 of ( $s* ) or all of ( $c* ) or ( all of ( $pdb* ) and 4 of them ) or ( 2 of ( $x* ) and 5 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nodachi : FILE
 {
 	meta:
 		description = "Detects Nodachi infostealer"
 		author = "ditekSHen"
-		id = "bce0c44d-7e75-5c51-ba93-75bd81896921"
+		id = "efd933e7-22cc-561b-b5bc-6a0c1fcbf808"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6957-L6972"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c8a262b862a47d5c0c9bd76b722aa4ceb55dd365b5dca35a61318d8a1c53269d"
+		logic_hash = "v1_sha256_c8a262b862a47d5c0c9bd76b722aa4ceb55dd365b5dca35a61318d8a1c53269d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256053,22 +254488,20 @@ rule DITEKSHEN_MALWARE_Win_Nodachi : FILE
 		$s7 = "C://Users//public//cred.json" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or (4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or ( 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofhearts : FILE
 {
 	meta:
 		description = "IAmTheKing Queen Of Hearts payload"
 		author = "ditekSHen"
-		id = "b8d222f0-b3ce-5143-816b-4bbcde645672"
+		id = "5210d52a-ba6d-5728-809b-d5d627c425e7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6974-L6991"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0aafeb1dce380ebe6cccc3c7f9564022e1a4cdcf20091943d2bfcc845129152d"
+		logic_hash = "v1_sha256_0aafeb1dce380ebe6cccc3c7f9564022e1a4cdcf20091943d2bfcc845129152d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256086,22 +254519,20 @@ rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofhearts : FILE
 		$s10 = "?what@exception@std@@UBEPBDXZ" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofclubs : FILE
 {
 	meta:
 		description = "IAmTheKing Queen Of Clubs payload"
 		author = "ditekSHen"
-		id = "4d19a484-0483-5b3e-a9ad-1cd8ca263a04"
+		id = "8dd3e682-d936-5f83-bb6e-d4f6b4bdd591"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6993-L7007"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "28d7d3e9a3b7c104fc5b0fa38ce33b34596f16f6987c34a0e2e3fd93a8a908bd"
+		logic_hash = "v1_sha256_28d7d3e9a3b7c104fc5b0fa38ce33b34596f16f6987c34a0e2e3fd93a8a908bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256116,22 +254547,20 @@ rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofclubs : FILE
 		$s7 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Iamtheking : FILE
 {
 	meta:
 		description = "IAmTheKing payload"
 		author = "ditekSHen"
-		id = "cf0d7c8d-0ac3-542d-b42e-f215af36044b"
+		id = "9ffb3dac-94d4-5052-b5b1-a9afad7075bb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7009-L7029"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1cc2aa9b672b8519a3e8a22e31403fb7adace0d430f9cab160e9a7d52e56e875"
+		logic_hash = "v1_sha256_1cc2aa9b672b8519a3e8a22e31403fb7adace0d430f9cab160e9a7d52e56e875"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -256152,22 +254581,20 @@ rule DITEKSHEN_MALWARE_Win_Iamtheking : FILE
 		$s13 = "\\1-driver-vmsrvc" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Gobrut : FILE
 {
 	meta:
 		description = "Detects unknown Go multi-bruteforcer bot (StealthWorker / GoBrut) against multiple systems: QNAP, MagOcart, WordPress, Opencart, Bitrix, Postgers, MySQL, Drupal, Joomla, SSH, FTP, Magneto, CPanel"
 		author = "ditekSHen"
-		id = "f5605123-12d9-55d1-8a32-acebf16834f8"
+		id = "660c5a3d-d754-5d5b-9d82-163610b366bc"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7031-L7086"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fb93d0dcf7f38294444ac6d2e1a7a126027ce07f0305af9ae0f8aa8f4b806c5c"
+		logic_hash = "v1_sha256_fb93d0dcf7f38294444ac6d2e1a7a126027ce07f0305af9ae0f8aa8f4b806c5c"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -256223,22 +254650,20 @@ rule DITEKSHEN_MALWARE_Win_Gobrut : FILE
 		$v1_7 = "?sevlyar/4-da" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and ((2 of ($x*) and 3 of ($s*)) or all of ($s*) or 6 of ($w*) or 6 of ($p*) or 6 of ($v1*) or 12 of them )
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and ( ( 2 of ( $x* ) and 3 of ( $s* ) ) or all of ( $s* ) or 6 of ( $w* ) or 6 of ( $p* ) or 6 of ( $v1* ) or 12 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Biopass_Dropper : FILE
 {
 	meta:
 		description = "Detects Go BioPass dropper"
 		author = "ditekSHen"
-		id = "56037c79-59f7-587c-8f54-c9618e871f34"
+		id = "903b93d3-db9b-5117-a851-c30588b38854"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7088-L7111"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "06f3b3ee38349ddcf9be7cbb7627d60fa673962409dde6e4badd112841a3ed19"
+		logic_hash = "v1_sha256_06f3b3ee38349ddcf9be7cbb7627d60fa673962409dde6e4badd112841a3ed19"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256262,22 +254687,20 @@ rule DITEKSHEN_MALWARE_Win_Biopass_Dropper : FILE
 		$x7 = ".Path ='-----BEGIN RSA TESTING KEY-----" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($x*) or (1 of ($url*) and ($go)) or 9 of them )
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 5 of ( $x* ) or ( 1 of ( $url* ) and ( $go ) ) or 9 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_A310Logger : FILE
 {
 	meta:
 		description = "Detects A310Logger"
 		author = "ditekSHen"
-		id = "d2cf2f7b-5710-56ab-b13d-97a70fe7f618"
+		id = "7f372295-77fd-5a0e-af48-c19dd98e1154"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7113-L7149"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8205169c9c78eb784b9d07a5fd85ad3a54763452e1e315f7e7911b8ac49a6c01"
+		logic_hash = "v1_sha256_8205169c9c78eb784b9d07a5fd85ad3a54763452e1e315f7e7911b8ac49a6c01"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -256313,22 +254736,20 @@ rule DITEKSHEN_MALWARE_Win_A310Logger : FILE
 		$v1_10 = "get_sPassword" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or (3 of ($en*) and 4 of ($s*)) or (5 of ($s*) and 1 of ($en*)) or 5 of ($v1*) or (4 of ($v1*) and 2 of ($s*) and 2 of ($en*)))
+		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 3 of ( $en* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $en* ) ) or 5 of ( $v1* ) or ( 4 of ( $v1* ) and 2 of ( $s* ) and 2 of ( $en* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Crylock : FILE
 {
 	meta:
 		description = "Detects CryLock ransomware"
 		author = "ditekSHen"
-		id = "296288d8-2fdd-592a-aef9-7d4853885594"
+		id = "d9569d75-46e5-5f59-bad8-4c0f9e406d6e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7151-L7186"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dde35dd2c7e89212c4562f2dcf6a78d06fbb3d31150d49e6c48f758b07f1834f"
+		logic_hash = "v1_sha256_dde35dd2c7e89212c4562f2dcf6a78d06fbb3d31150d49e6c48f758b07f1834f"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -256364,22 +254785,20 @@ rule DITEKSHEN_MALWARE_Win_Crylock : FILE
 		$p9 = " -f -s -t 00" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or 6 of ($p*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 6 of ( $p* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Deeprats : FILE
 {
 	meta:
 		description = "Detects DeepRats ("
 		author = "ditekSHen"
-		id = "5b774e24-3864-519f-9cfd-d729d7d567a0"
+		id = "78f247d9-d140-5101-bbb7-5d49fa9c1bdc"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7188-L7218"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "511264c0b6932f90069a5206cd142ca7210b0bc40c51ef5aa9c41a161fb57aab"
+		logic_hash = "v1_sha256_511264c0b6932f90069a5206cd142ca7210b0bc40c51ef5aa9c41a161fb57aab"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -256410,22 +254829,20 @@ rule DITEKSHEN_MALWARE_Win_Deeprats : FILE
 		$f13 = ".ListenCMD" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or 8 of ($f*))
+		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or 8 of ( $f* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Gasket : FILE
 {
 	meta:
 		description = "Detects Gasket"
 		author = "ditekSHen"
-		id = "3afa131d-9c88-50df-a3b4-552db4a84e69"
+		id = "7813e6b0-5817-5e53-82e8-169ad836d8f8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7220-L7250"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0279979915891fc8c813ba555120ee5705b53b234a808b5ca77bff35a082e376"
+		logic_hash = "v1_sha256_0279979915891fc8c813ba555120ee5705b53b234a808b5ca77bff35a082e376"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -256456,22 +254873,20 @@ rule DITEKSHEN_MALWARE_Win_Gasket : FILE
 		$f20 = ".(*InfoPacket).XXX_" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 16 of ($f*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 16 of ( $f* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Silentmoon : FILE
 {
 	meta:
 		description = "Detects SilentMoon"
 		author = "ditekSHen"
-		id = "0b41a07b-0e2a-5bbf-8789-3b46460d2c09"
+		id = "41355c88-cda7-5f6e-a851-57074b5984a5"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7252-L7272"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1aa61e83d0003ef41d16fd40698485fdf41a957639ac3c3f2770994a43bd502a"
+		logic_hash = "v1_sha256_1aa61e83d0003ef41d16fd40698485fdf41a957639ac3c3f2770994a43bd502a"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -256492,22 +254907,20 @@ rule DITEKSHEN_MALWARE_Win_Silentmoon : FILE
 		$x7 = "internalstoragerpc" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 3 of ($x*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 3 of ( $x* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lu0Bot : FILE
 {
 	meta:
 		description = "Detects Lu0Bot"
 		author = "ditekSHen"
-		id = "f8595553-b911-5e30-9ece-cad7d5913f19"
+		id = "843359fc-3c7a-580b-a85f-2aaa9de4ba58"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7274-L7285"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b4822248230a804b1dc75f8d517af28a621dab1746c9ef45eaa4754149ce0cba"
+		logic_hash = "v1_sha256_b4822248230a804b1dc75f8d517af28a621dab1746c9ef45eaa4754149ce0cba"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256519,22 +254932,20 @@ rule DITEKSHEN_MALWARE_Win_Lu0Bot : FILE
 		$o2 = { 53 50 e8 b0 01 00 00 e9 99 01 00 00 e8 ae 01 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4KB and 1 of ($s*) and all of ($o*)
+		uint16( 0 ) == 0x5a4d and filesize < 4KB and 1 of ( $s* ) and all of ( $o* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Shellcodedlei : FILE
 {
 	meta:
 		description = "Detects shellcode downloader, executer, injector"
 		author = "ditekSHen"
-		id = "62a4f141-87f8-596a-adf6-5bf9a50c9e91"
+		id = "0a4b1cae-0821-5968-9380-d99c3634b71e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7287-L7304"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "064c17427ae6b33ffb09a14abcb924d20ead44250e8bd03070bf40869f1c812e"
+		logic_hash = "v1_sha256_064c17427ae6b33ffb09a14abcb924d20ead44250e8bd03070bf40869f1c812e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256552,22 +254963,20 @@ rule DITEKSHEN_MALWARE_Win_Shellcodedlei : FILE
 		$s10 = "GetEntryFromBuffer" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 5 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 5 of ( $s* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bluebot : FILE
 {
 	meta:
 		description = "Detects BlueBot"
 		author = "ditekSHen"
-		id = "cddd40bb-c3c6-5c44-9cb1-480571375be8"
+		id = "74978be6-fb0a-56f3-bcaa-1c5610d56cf3"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7306-L7333"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "04a19f649eb2fff7a5bc59ccead80cd0a04c4e5418cbc83e850045dba75b03e0"
+		logic_hash = "v1_sha256_04a19f649eb2fff7a5bc59ccead80cd0a04c4e5418cbc83e850045dba75b03e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256595,22 +255004,20 @@ rule DITEKSHEN_MALWARE_Win_Bluebot : FILE
 		$v8 = "blogList" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 5 of ($s*) or 5 of ($v*) or 9 of them )
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 5 of ( $s* ) or 5 of ( $v* ) or 9 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Unkcobaltstrike : FILE
 {
 	meta:
 		description = "Detects unknown malware, potentially CobaltStrike related"
 		author = "ditekSHen"
-		id = "24ddccc7-3700-57a1-999c-ddefae6911bb"
+		id = "501b8dde-e759-55eb-bb87-7073f8da78b7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7335-L7354"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2fb4e87eec3b56773b812ce6a5c28143183087e0f93d92d76c1103563f8e0891"
+		logic_hash = "v1_sha256_2fb4e87eec3b56773b812ce6a5c28143183087e0f93d92d76c1103563f8e0891"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256630,22 +255037,20 @@ rule DITEKSHEN_MALWARE_Win_Unkcobaltstrike : FILE
 		$s12 = { 0d 4c e3 5c c9 0d 1f 4c 89 7c da a1 b7 8c ee 7c }
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_EXEPWSHDL : FILE
 {
 	meta:
 		description = "Detects executable downloaders using PowerShell"
 		author = "ditekSHen"
-		id = "1e5a414b-e81e-5915-b00b-75edbfcc32d2"
+		id = "db6f7b44-a49c-556e-890a-f0095a3bc8cb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7356-L7374"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "58fbd27758ecd435eb30b7c34f4cf142db8e31edee0838175992923a51706508"
+		logic_hash = "v1_sha256_58fbd27758ecd435eb30b7c34f4cf142db8e31edee0838175992923a51706508"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -256664,22 +255069,20 @@ rule DITEKSHEN_MALWARE_Win_EXEPWSHDL : FILE
 		$d4 = ".send(" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of ($x*) and (3 of ($s*) or all of ($d*))
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of ( $x* ) and ( 3 of ( $s* ) or all of ( $d* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_MB150 : FILE
 {
 	meta:
 		description = "Detects MB150? Go ransomware"
 		author = "ditekSHen"
-		id = "9688974b-ccf9-59ea-bb31-e46c63f021bf"
+		id = "e65abc79-0d84-5969-925b-15e38240cae0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7376-L7402"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a07535fc53912ddde6a0bed187c21ecdb2701d317d7de0cbdd2db37071bc9a21"
+		logic_hash = "v1_sha256_a07535fc53912ddde6a0bed187c21ecdb2701d317d7de0cbdd2db37071bc9a21"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256706,22 +255109,20 @@ rule DITEKSHEN_MALWARE_Win_MB150 : FILE
 		$s6 = "getmonero.org" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($x*) or ($go and 4 of ($s*)) or (1 of ($mac*) and (2 of ($x*) or 3 of ($s*))))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or ( $go and 4 of ( $s* ) ) or ( 1 of ( $mac* ) and ( 2 of ( $x* ) or 3 of ( $s* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Chaos : FILE
 {
 	meta:
 		description = "Detects Chaos ransomware"
 		author = "ditekSHen"
-		id = "59d43cfb-72d8-5c17-87bf-f1f364d23bed"
+		id = "7570a28e-196c-5ec0-9f49-3d2585c2c35f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7404-L7433"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6203ab09745db817b9e909d70cf1d5be9769c414461ee5f7bb344b6959986537"
+		logic_hash = "v1_sha256_6203ab09745db817b9e909d70cf1d5be9769c414461ee5f7bb344b6959986537"
 		score = 75
 		quality = 44
 		tags = "FILE"
@@ -256751,22 +255152,20 @@ rule DITEKSHEN_MALWARE_Win_Chaos : FILE
 		$m4 = "where do I get Bitcoin" wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of ($s*) or all of ($m*) or (2 of ($m*) and 4 of ($s*))
+		uint16( 0 ) == 0x5a4d and 6 of ( $s* ) or all of ( $m* ) or ( 2 of ( $m* ) and 4 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Horuseyesrat : FILE
 {
 	meta:
 		description = "Detects HorusEyesRAT"
 		author = "ditekSHen"
-		id = "80b2fd11-f8b4-5aee-b55a-4f7ee9fad6cf"
+		id = "7c9694cf-ac7b-5ae2-83f3-130ee1c33950"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7435-L7451"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c0f499e3a17923b391ed6b7fa723525a9d4aef0ce04a2c7abec60d5eda15888f"
+		logic_hash = "v1_sha256_c0f499e3a17923b391ed6b7fa723525a9d4aef0ce04a2c7abec60d5eda15888f"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -256783,22 +255182,20 @@ rule DITEKSHEN_MALWARE_Win_Horuseyesrat : FILE
 		$s6 = /Plugins\\[A-Z]{2}.dll/ fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 3 of ($s*)) or (4 of ($s*) and #s6>4))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or ( 4 of ( $s* ) and #s6 > 4 ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Breakwin : FILE
 {
 	meta:
 		description = "Detects BreakWin Wiper"
 		author = "ditekSHen"
-		id = "4ffadbfa-c1cc-59e6-a9ba-7a34eca6c3fe"
+		id = "9302db17-7176-54cb-bbba-a2b76030ffff"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7453-L7471"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "86fc89e28fc107c2d4fe98dc16048d9e076b1fef53a3df0814f80a88bbe09c48"
+		logic_hash = "v1_sha256_86fc89e28fc107c2d4fe98dc16048d9e076b1fef53a3df0814f80a88bbe09c48"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256817,22 +255214,20 @@ rule DITEKSHEN_MALWARE_Win_Breakwin : FILE
 		$s11 = ".?AVProcessSnapshotCreationFailedException@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Coinminer03 : FILE
 {
 	meta:
 		description = "Detects coinmining malware"
 		author = "ditekSHen"
-		id = "e0e57557-7c46-5336-b904-c4c1f142bd81"
+		id = "1a9f8146-905b-5b82-ae27-376d5d6dcb5b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7506-L7528"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f22e1af955a0d132dda820fe5e5e1ae2f077b7264ce1f0125a2f37c0da6b6508"
+		logic_hash = "v1_sha256_f22e1af955a0d132dda820fe5e5e1ae2f077b7264ce1f0125a2f37c0da6b6508"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256855,22 +255250,20 @@ rule DITEKSHEN_MALWARE_Win_Coinminer03 : FILE
 		$f3 = "<StartGpurvnGminer>b__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($cnc*) or (2 of ($f*) and (1 of ($s*) or 1 of ($f*))) or all of ($f*) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $cnc* ) or ( 2 of ( $f* ) and ( 1 of ( $s* ) or 1 of ( $f* ) ) ) or all of ( $f* ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Zeppelin : FILE
 {
 	meta:
 		description = "Detects Zeppelin (Delphi) ransomware"
 		author = "ditekSHen"
-		id = "368d0c31-745d-50ad-a265-50561fdc822a"
+		id = "ef2197a4-bed3-585b-9fa9-2a584cdab20f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7530-L7545"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f6c8420756b562662985dd26eaad58500a24cae786a47b788c953e86276116a1"
+		logic_hash = "v1_sha256_f6c8420756b562662985dd26eaad58500a24cae786a47b788c953e86276116a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256886,22 +255279,20 @@ rule DITEKSHEN_MALWARE_Win_Zeppelin : FILE
 		$x3 = "!!! ENCLOCALPRIVKEY !!!" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($x*) or (2 of ($x*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $x* ) or ( 2 of ( $x* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Slackbot : FILE
 {
 	meta:
 		description = "Detects SlackBot"
 		author = "ditekSHen"
-		id = "cd540aa2-dc8f-5ccc-b66c-a8d72b73c896"
+		id = "b1520459-709c-5550-a21b-2b3f77c4a75a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7547-L7588"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "919839883c437b69cf7f380830f2499be24415f96f1e42424e4859114f958581"
+		logic_hash = "v1_sha256_919839883c437b69cf7f380830f2499be24415f96f1e42424e4859114f958581"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -256943,22 +255334,20 @@ rule DITEKSHEN_MALWARE_Win_Slackbot : FILE
 		$c20 = "!@raw" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or all of ($m*) or (10 of ($c*) and (1 of ($x*) or 3 of ($s*) or 2 of ($m*))))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or all of ( $s* ) or all of ( $m* ) or ( 10 of ( $c* ) and ( 1 of ( $x* ) or 3 of ( $s* ) or 2 of ( $m* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Sweetystealer : FILE
 {
 	meta:
 		description = "Detects SweetyStealer"
 		author = "ditekSHen"
-		id = "21dd1706-2cb5-5b27-ad3a-c3de8e6fb333"
+		id = "f1691f4a-fc1d-53e2-9e5d-d47497357a0e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7590-L7608"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ecf22240b47af077055260faba0406721f1b4cc5ed04180285df0de86c4e1241"
+		logic_hash = "v1_sha256_ecf22240b47af077055260faba0406721f1b4cc5ed04180285df0de86c4e1241"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -256977,22 +255366,20 @@ rule DITEKSHEN_MALWARE_Win_Sweetystealer : FILE
 		$f4 = "<PostExtractCommandLine>k__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($s*) or (3 of ($f*) and 1 of ($s*))
+		uint16( 0 ) == 0x5a4d and 3 of ( $s* ) or ( 3 of ( $f* ) and 1 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Genircbot : FILE
 {
 	meta:
 		description = "Detects generic IRCBots"
 		author = "ditekSHen"
-		id = "e1faa1dd-bbf5-5208-97d6-a6e8597d39bc"
+		id = "64db5bfe-27da-526e-a86f-c5238559713e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7610-L7626"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cc7f4599148c45fdf755c07530ae4846b7e283b5c1001c121f9ea05279997dc1"
+		logic_hash = "v1_sha256_cc7f4599148c45fdf755c07530ae4846b7e283b5c1001c121f9ea05279997dc1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -257009,22 +255396,20 @@ rule DITEKSHEN_MALWARE_Win_Genircbot : FILE
 		$x3 = "#evilChannel" fullword ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 2 of ($x*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 2 of ( $x* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nitro : FILE
 {
 	meta:
 		description = "Detects Nitro Ransomware"
 		author = "ditekSHen"
-		id = "3edb62e0-0544-5291-a949-a45fdf881c7e"
+		id = "b9242e11-5ba2-58a8-be07-7259b4d298da"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7628-L7652"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "03da21ece2de530a9c2ba08a9e44c9a92bc9ca0a6d4ac9507899d1f3dcd03e37"
+		logic_hash = "v1_sha256_03da21ece2de530a9c2ba08a9e44c9a92bc9ca0a6d4ac9507899d1f3dcd03e37"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -257049,22 +255434,20 @@ rule DITEKSHEN_MALWARE_Win_Nitro : FILE
 		$s13 = "decryption key. If you do so, your files may get corrupted" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (3 of ($s*) and 1 of ($x*)) or (7 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or ( 3 of ( $s* ) and 1 of ( $x* ) ) or ( 7 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nanocore : FILE
 {
 	meta:
 		description = "Detects NanoCore"
 		author = "ditekSHen"
-		id = "931b98f6-df2b-538b-bc49-ecbbd24334da"
+		id = "f692f02e-053c-5209-9b42-d2ee8f453c23"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7654-L7681"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7"
+		logic_hash = "v1_sha256_6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257092,22 +255475,20 @@ rule DITEKSHEN_MALWARE_Win_Nanocore : FILE
 		$s7 = "get_Connected" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 8 of ($i*) or all of ($s*) or (1 of ($x*) and (3 of ($i*) or 2 of ($s*))))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 8 of ( $i* ) or all of ( $s* ) or ( 1 of ( $x* ) and ( 3 of ( $i* ) or 2 of ( $s* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Satan : FILE
 {
 	meta:
 		description = "Detects Satan ransomware"
 		author = "ditekSHen"
-		id = "f0a9369e-a3d7-5770-b490-4c9a919abb82"
+		id = "866a20ef-6932-5bfe-a41b-94f3656bb98d"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7683-L7709"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e50daa88e0067a0f00329c6369c0334bd282fb102c91ba5ca770da97851d6d2e"
+		logic_hash = "v1_sha256_e50daa88e0067a0f00329c6369c0334bd282fb102c91ba5ca770da97851d6d2e"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -257134,22 +255515,20 @@ rule DITEKSHEN_MALWARE_Win_Satan : FILE
 		$o3 = { 53 8d 84 24 34 01 00 00 b9 01 00 00 80 50 a1 64 }
 
 	condition:
-		uint16(0)==0x5a4d and ((8 of ($s*) and 4 of ($e*)) or all of ($s*) or ( all of ($e*) and 5 of ($s*)) or ( all of ($o*) and 8 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 8 of ( $s* ) and 4 of ( $e* ) ) or all of ( $s* ) or ( all of ( $e* ) and 5 of ( $s* ) ) or ( all of ( $o* ) and 8 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Neshta : FILE
 {
 	meta:
 		description = "Detects Neshta"
 		author = "ditekSHen"
-		id = "b96ee19e-b631-57fd-bf8a-67d790202c46"
+		id = "534a4e11-5fb0-5fdd-a194-bfc83a1518a8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7711-L7720"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7967c1154f652e28e541058a7b7f61aa077cfaf6be58282e1de68d9a6088c1ac"
+		logic_hash = "v1_sha256_7967c1154f652e28e541058a7b7f61aa077cfaf6be58282e1de68d9a6088c1ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257159,22 +255538,20 @@ rule DITEKSHEN_MALWARE_Win_Neshta : FILE
 		$s2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Hellokitty : FILE
 {
 	meta:
 		description = "Detects Linux version of HelloKitty ransomware"
 		author = "ditekSHen"
-		id = "bb228937-8cd8-5fb8-aaed-3bd539ae96f2"
+		id = "cd4c863e-a8d3-5af4-873b-00f4f1e5dfdb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7722-L7746"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bcb1188d616b29fa535e757a37476435a3061d27e143339413f6829876701868"
+		logic_hash = "v1_sha256_bcb1188d616b29fa535e757a37476435a3061d27e143339413f6829876701868"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -257199,22 +255576,20 @@ rule DITEKSHEN_MALWARE_Linux_Hellokitty : FILE
 		$m4 = "Data will be Published and/or Sold" ascii nocase
 
 	condition:
-		uint16(0)==0x457f and (6 of ($s*) or (2 of ($m*) and 2 of ($s*)) or 8 of them )
+		uint16( 0 ) == 0x457f and ( 6 of ( $s* ) or ( 2 of ( $m* ) and 2 of ( $s* ) ) or 8 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Blackmatter : FILE
 {
 	meta:
 		description = "Detects BlackMatter ransomware"
 		author = "ditekSHen"
-		id = "8883e652-edab-5cbf-a4fa-963b437447d9"
+		id = "8d7deacf-58b8-5ba3-84f6-f0e175a7bec4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7748-L7767"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4558002b424f7102f67fc44dfc37ac20f6013e25ae827c6aee0fc37231e2fa72"
+		logic_hash = "v1_sha256_4558002b424f7102f67fc44dfc37ac20f6013e25ae827c6aee0fc37231e2fa72"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257231,22 +255606,20 @@ rule DITEKSHEN_MALWARE_Win_Blackmatter : FILE
 		$o6 = { c7 85 68 ff ff ff 00 04 00 00 8b 85 6c ff ff ff }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) and all of ($o*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) and all of ( $o* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlinjector04 : FILE
 {
 	meta:
 		description = "Detects downloader / injector"
 		author = "ditekSHen"
-		id = "fe423aee-6ff4-5fd0-9fa2-51dd0c27f54b"
+		id = "08922a79-04bc-5c1b-8282-f754c1af811e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7769-L7790"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ab9a047e53dec2cc5986522636783b5cb8aae7fc0297292d017ec22ee5750cce"
+		logic_hash = "v1_sha256_ab9a047e53dec2cc5986522636783b5cb8aae7fc0297292d017ec22ee5750cce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257268,22 +255641,20 @@ rule DITEKSHEN_MALWARE_Win_Dlinjector04 : FILE
 		$a11 = "CheckEmulator" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*) and 5 of ($a*)) or 10 of ($a*))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 5 of ( $a* ) ) or 10 of ( $a* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Darkcomet : FILE
 {
 	meta:
 		description = "Detects DarkComet"
 		author = "ditekSHen"
-		id = "ae2412df-adae-5640-9404-7b093c5095b4"
+		id = "4513bfa8-1ca0-55be-a516-28e754c14980"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7792-L7812"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "444df3c914c47500018614af10036864b459e7873daf079b684352dbe52f0486"
+		logic_hash = "v1_sha256_444df3c914c47500018614af10036864b459e7873daf079b684352dbe52f0486"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -257304,22 +255675,20 @@ rule DITEKSHEN_MALWARE_Win_Darkcomet : FILE
 		$s13 = "dclogs\\" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Macoute : FILE
 {
 	meta:
 		description = "Detects Macoute"
 		author = "ditekSHen"
-		id = "0ecfb923-2e51-544e-984d-efdeeb175727"
+		id = "c587fe17-60fb-5a2c-a490-aedf23c224bc"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7814-L7836"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1dffa48fe6c0ac053509b5f5994d323fd72d090da0f077b52c9bc33df6997964"
+		logic_hash = "v1_sha256_1dffa48fe6c0ac053509b5f5994d323fd72d090da0f077b52c9bc33df6997964"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257342,22 +255711,20 @@ rule DITEKSHEN_MALWARE_Win_Macoute : FILE
 		$s15 = "<html><HEAD></HEAD><body bgColor=3D#ffffff><iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe></body></html>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 10 of them
+		uint16( 0 ) == 0x5a4d and 10 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Coinminer04 : FILE
 {
 	meta:
 		description = "Detects coinmining malware"
 		author = "ditekSHen"
-		id = "d90d8ad3-20b7-5bb4-8c58-3488c60ed9a2"
+		id = "8de0285f-1ca6-5783-bed9-e6ec233ccb88"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7838-L7858"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2ef60dbf0bac3d5910635bb011a45e5ebc1392094b10425604fa9dd290198f8b"
+		logic_hash = "v1_sha256_2ef60dbf0bac3d5910635bb011a45e5ebc1392094b10425604fa9dd290198f8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257378,22 +255745,20 @@ rule DITEKSHEN_MALWARE_Win_Coinminer04 : FILE
 		$cnc5 = "/cmd.php" wide
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) and 1 of ($cnc*))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) and 1 of ( $cnc* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Sidewalk : FILE
 {
 	meta:
 		description = "Detects SideWalk"
 		author = "ditekSHen"
-		id = "ab82b83a-a279-555a-83c2-6340431b10da"
+		id = "c58b7a5d-c65e-58a4-bb9b-c7e761f39318"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7860-L7880"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6885a1ad69d61fa5875ee0db949071e84390fc2db4307c412b32cd17c0806f6a"
+		logic_hash = "v1_sha256_6885a1ad69d61fa5875ee0db949071e84390fc2db4307c412b32cd17c0806f6a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257414,22 +255779,20 @@ rule DITEKSHEN_MALWARE_Win_Sidewalk : FILE
 		$m7 = "LogonWithProfile" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or all of ($m*) or (11 of them ))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or all of ( $m* ) or ( 11 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Vanillarat : FILE
 {
 	meta:
 		description = "Detects VanillaRAT"
 		author = "ditekSHen"
-		id = "70c2cd1a-a6d4-562e-a6fc-c16a9e87c6b7"
+		id = "55cb51d2-1fea-50ce-a791-df84a502ade0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7882-L7902"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d7b90ac88a50693ec4bb0676c04f5d161f04f67970ea60d80e79d774da75bfdc"
+		logic_hash = "v1_sha256_d7b90ac88a50693ec4bb0676c04f5d161f04f67970ea60d80e79d774da75bfdc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257450,22 +255813,20 @@ rule DITEKSHEN_MALWARE_Win_Vanillarat : FILE
 		$f5 = "KillClient" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (($stub and (2 of ($s*) or 2 of ($f*))) or 6 of ($s*) or all of ($f*))
+		uint16( 0 ) == 0x5a4d and ( ( $stub and ( 2 of ( $s* ) or 2 of ( $f* ) ) ) or 6 of ( $s* ) or all of ( $f* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Sectoprat : FILE
 {
 	meta:
 		description = "Detects SectopRAT"
 		author = "ditekSHen"
-		id = "d6594834-24d7-5e86-84b5-5a7920e7bc89"
+		id = "06aa845c-0647-5fa8-8fc0-04f3f443a49f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7904-L7929"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b4048f837c02560a8b650247173be25893b466e5cec8f2784eea58172f973822"
+		logic_hash = "v1_sha256_b4048f837c02560a8b650247173be25893b466e5cec8f2784eea58172f973822"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257491,22 +255852,20 @@ rule DITEKSHEN_MALWARE_Win_Sectoprat : FILE
 		$m8 = "keybd_event" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((5 of ($s*) and 2 of ($b*)) or all of ($s*) or ( all of ($b*) and (4 of ($s*) or 5 of ($m*))))
+		uint16( 0 ) == 0x5a4d and ( ( 5 of ( $s* ) and 2 of ( $b* ) ) or all of ( $s* ) or ( all of ( $b* ) and ( 4 of ( $s* ) or 5 of ( $m* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Neptune : FILE
 {
 	meta:
 		description = "Detects Neptune keylogger / infostealer"
 		author = "ditekSHen"
-		id = "0f619bea-f00b-5078-95a4-83306e3e87b4"
+		id = "0186f846-e3c4-5751-bb42-a496c81ae973"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7931-L7953"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e3298bf55f89180ed7e9f7ad35b59d39284a5143fd69fa2a4fbc27d91fb2fbd3"
+		logic_hash = "v1_sha256_e3298bf55f89180ed7e9f7ad35b59d39284a5143fd69fa2a4fbc27d91fb2fbd3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257529,22 +255888,20 @@ rule DITEKSHEN_MALWARE_Win_Neptune : FILE
 		$s9 = "http://www.exampleserver.com/directfile.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 7 of ($s*) or (1 of ($x*) and 5 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 7 of ( $s* ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Tomiris : FILE
 {
 	meta:
 		description = "Detects Tomiris"
 		author = "ditekSHen"
-		id = "86efd4fb-3c76-504e-b367-132aee59e09a"
+		id = "41b33c03-8a6b-5377-bac5-3506e81181e0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7955-L7978"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1d9baeb6db2e849dd053c3fc735984e23b9cead39cf166f8a544ee5a439185d1"
+		logic_hash = "v1_sha256_1d9baeb6db2e849dd053c3fc735984e23b9cead39cf166f8a544ee5a439185d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257568,22 +255925,20 @@ rule DITEKSHEN_MALWARE_Win_Tomiris : FILE
 		$r2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($f*) and 3 of ($s*) and 2 of ($t*) and 1 of ($r*)) or (4 of ($s*) and 2 of ($t*) and 1 of ($r*)) or 12 of them )
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $f* ) and 3 of ( $s* ) and 2 of ( $t* ) and 1 of ( $r* ) ) or ( 4 of ( $s* ) and 2 of ( $t* ) and 1 of ( $r* ) ) or 12 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Jennlog : FILE
 {
 	meta:
 		description = "Detects JennLog loader"
 		author = "ditekSHen"
-		id = "38f8cd13-f157-5cce-bf04-80c29d254144"
+		id = "2894f8a4-0355-5868-ab49-40553916fb13"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7980-L7996"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "085a4783c7c01ec95491d9999d1835ad9ab3dc70d77b944578e097b3ffe3a627"
+		logic_hash = "v1_sha256_085a4783c7c01ec95491d9999d1835ad9ab3dc70d77b944578e097b3ffe3a627"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257600,22 +255955,20 @@ rule DITEKSHEN_MALWARE_Win_Jennlog : FILE
 		$s7 = "] Update enhanced config info is enabled." ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*) or ( all of ($x*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) or ( all of ( $x* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lockfile : FILE
 {
 	meta:
 		description = "Detects LockFile ransomware"
 		author = "ditekSHen"
-		id = "762ac376-43ff-56d2-b279-2879ce6d8542"
+		id = "47b56f97-4f4c-55dc-a6ed-6821f14f1c32"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7998-L8014"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "28c8aa8931d599e5a1860fe2ed0b8172e709dad1a48a319858a907fa775af293"
+		logic_hash = "v1_sha256_28c8aa8931d599e5a1860fe2ed0b8172e709dad1a48a319858a907fa775af293"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -257632,22 +255985,20 @@ rule DITEKSHEN_MALWARE_Win_Lockfile : FILE
 		$m2 = "<hta:application id=LOCKFILE applicationName=LOCKFILE" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or (1 of ($x*) and (2 of ($s*) or 1 of ($m*))) or (1 of ($m*) and (1 of ($x*) or 2 of ($s*))))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 1 of ( $m* ) ) ) or ( 1 of ( $m* ) and ( 1 of ( $x* ) or 2 of ( $s* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_HUNT_Foggyweb : FILE
 {
 	meta:
 		description = "Attempt on hunting FoggyWeb"
 		author = "ditekSHen"
-		id = "429827f7-2ccf-5c13-ac0d-1fd8b35a6740"
+		id = "282ac457-4f50-54fd-89e2-10b930422999"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8016-L8032"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d868501bc52ad7787d9e99927dd61e9ad9e2132f02348fc71e64666bfc0c9e15"
+		logic_hash = "v1_sha256_d868501bc52ad7787d9e99927dd61e9ad9e2132f02348fc71e64666bfc0c9e15"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -257664,22 +256015,20 @@ rule DITEKSHEN_MALWARE_Win_HUNT_Foggyweb : FILE
 		$s7 = "ExecuteBinary" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_HUNT_Apostle
 {
 	meta:
 		description = "Attempt on hunting new variants of Apostle"
 		author = "ditekSHen"
-		id = "31d15111-6935-5a77-ae9a-6bee16c1d2f6"
+		id = "3aacbb57-08f0-5247-b898-412d47d93be0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8034-L8043"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9acab5dadee0760431376075450f54bbb32ebed10dc928db91a44d069afc1576"
+		logic_hash = "v1_sha256_9acab5dadee0760431376075450f54bbb32ebed10dc928db91a44d069afc1576"
 		score = 50
 		quality = 73
 		tags = ""
@@ -257698,34 +256047,32 @@ rule DITEKSHEN_MALWARE_Win_HUNT_Ghostemperor_Remotecontrolpayload : FILE
 	meta:
 		description = "Attempt on hunting GhostEmperor Stage 4 Remote Control Payload"
 		author = "ditekSHen"
-		id = "d30a2aad-8bd6-5291-a31d-7dade250e57e"
+		id = "06762844-5a23-599d-820e-c2f666a8fa9c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8045-L8052"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dabce4e0add0d05b4efd8e7540e4f14767c7b5fab361bd731234dd9dd844c658"
+		logic_hash = "v1_sha256_dabce4e0add0d05b4efd8e7540e4f14767c7b5fab361bd731234dd9dd844c658"
 		score = 50
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.number_of_exports==2 and pe.exports("1") and pe.exports("__acrt_iob_func")
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and pe.number_of_exports == 2 and pe.exports ( "1" ) and pe.exports ( "__acrt_iob_func" )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Unicorn : FILE
 {
 	meta:
 		description = "Detects Unicorn infostealer"
 		author = "ditekSHen"
-		id = "7cc8298d-abbd-5dda-bbd4-8b061095c367"
+		id = "d493a66a-1094-5aa8-9f3a-4a0e4b0cf2fe"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8077-L8107"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c4150b213c0dd88c87eb81e3ad455d8f658a57b0998bc6e394c5afac9423d9f2"
+		logic_hash = "v1_sha256_c4150b213c0dd88c87eb81e3ad455d8f658a57b0998bc6e394c5afac9423d9f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257756,22 +256103,20 @@ rule DITEKSHEN_MALWARE_Win_Unicorn : FILE
 		$s12 = "http://izuw6rclbgl2lwsh.onion/o.php" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 8 of ($s*) or (3 of ($x*) and 5 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 8 of ( $s* ) or ( 3 of ( $x* ) and 5 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Spectre : FILE
 {
 	meta:
 		description = "Detects Spectre infostealer"
 		author = "ditekSHen"
-		id = "43b32900-8dff-5a95-bcff-d6bd17703476"
+		id = "c7fe56d8-3958-555c-8edd-0c477816dd37"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8109-L8124"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ee041928ab5010fd5a06538f9a7cf9c72e44903fdb05f13b12362af0b326fd6f"
+		logic_hash = "v1_sha256_ee041928ab5010fd5a06538f9a7cf9c72e44903fdb05f13b12362af0b326fd6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257787,22 +256132,20 @@ rule DITEKSHEN_MALWARE_Win_Spectre : FILE
 		$h3 = "Content-Disposition: form-data; name=\"file\"; filename=\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and (( all of ($s*) and 1 of ($h*)) or ( all of ($h*) and 2 of ($s*)))) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 1 of ( $h* ) ) or ( all of ( $h* ) and 2 of ( $s* ) ) ) ) or ( 6 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_HUNT_Blackbyte : FILE
 {
 	meta:
 		description = "Attempt on hunting BlackByte ransomware"
 		author = "ditekSHen"
-		id = "c07e9b83-3bbf-52c9-b9fa-ca03f285a906"
+		id = "1220f115-880f-5494-a7ee-e69e21556bde"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8126-L8139"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4ceb71e42b888522c183af7e180bae47510fc7aa60a713aa83ffc2c98c03466f"
+		logic_hash = "v1_sha256_4ceb71e42b888522c183af7e180bae47510fc7aa60a713aa83ffc2c98c03466f"
 		score = 50
 		quality = 57
 		tags = "FILE"
@@ -257816,22 +256159,20 @@ rule DITEKSHEN_MALWARE_Win_HUNT_Blackbyte : FILE
 		$s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlinjector05 : FILE
 {
 	meta:
 		description = "Detects downloader / injector (NiceProcess)"
 		author = "ditekSHen"
-		id = "857eb13b-a882-5326-b7aa-4d2fcd0b6425"
+		id = "e89c385f-c55e-5c26-b61b-2b167c20ce29"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8141-L8158"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5345c2b03e14b7324a13bac0da783eec8c30da18043c1b2d46162e5b511fae63"
+		logic_hash = "v1_sha256_5345c2b03e14b7324a13bac0da783eec8c30da18043c1b2d46162e5b511fae63"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257849,22 +256190,20 @@ rule DITEKSHEN_MALWARE_Win_Dlinjector05 : FILE
                 65 78 65 }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Kutaki : FILE
 {
 	meta:
 		description = "Detects Kutaki"
 		author = "ditekSHen"
-		id = "d91812bb-4564-56b5-9757-81255b5233fb"
+		id = "8bc8adb1-728d-5354-b383-3f0d77c2acfc"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8160-L8173"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "24fbc9ca6de421275813c285a8fca91cfcede48f4b4de9feda010c644f0c251f"
+		logic_hash = "v1_sha256_24fbc9ca6de421275813c285a8fca91cfcede48f4b4de9feda010c644f0c251f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257878,22 +256217,20 @@ rule DITEKSHEN_MALWARE_Win_Kutaki : FILE
 		$s4 = "<rdf:Description about='uuid:0ab54f47-96d6-11d9-a59c-cbc93330e07e'" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 1 of ($s*)) or ( all of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or ( all of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlinjector06 : FILE
 {
 	meta:
 		description = "Detects downloader / injector"
 		author = "ditekSHen"
-		id = "9d8164ee-49b3-5eb1-bd1d-9437fc6f1392"
+		id = "83502a12-305f-5a14-9bc7-bb4710ab0cc8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8175-L8189"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e44ea8dbb94c6cd3b63d66eac3e9b3d6d5ff7d561410b8328e6c24630645305b"
+		logic_hash = "v1_sha256_e44ea8dbb94c6cd3b63d66eac3e9b3d6d5ff7d561410b8328e6c24630645305b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257908,22 +256245,20 @@ rule DITEKSHEN_MALWARE_Win_Dlinjector06 : FILE
 		$s7 = "POST" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Crown : FILE
 {
 	meta:
 		description = "Detects Crown Tech Support Scam"
 		author = "ditekSHen"
-		id = "ac4551d0-a574-5287-9b37-899c736db792"
+		id = "1c5ef5c6-6c62-5d16-928f-7326e2bf1e12"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8191-L8211"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "eeb36993c93d76ed118643ee417f15e1768015f72464dbabca7ae001f64a0aef"
+		logic_hash = "v1_sha256_eeb36993c93d76ed118643ee417f15e1768015f72464dbabca7ae001f64a0aef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -257944,7 +256279,7 @@ rule DITEKSHEN_MALWARE_Win_Crown : FILE
 		$s6 = "Support Assistance Override Activated!" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($c*) or 4 of ($s*) or (1 of ($d*) and (3 of ($c*) or 2 of ($s*))))
+		uint16( 0 ) == 0x5a4d and ( all of ( $c* ) or 4 of ( $s* ) or ( 1 of ( $d* ) and ( 3 of ( $c* ) or 2 of ( $s* ) ) ) )
 }
 import "pe"
 
@@ -257953,34 +256288,32 @@ rule DITEKSHEN_MALWARE_Win_Floodfix : FILE
 	meta:
 		description = "Detects FloodFix"
 		author = "ditekSHen"
-		id = "b05b0b40-0de8-58a0-889e-44a12d346de4"
+		id = "a6778a05-dc7e-53b3-9234-2232ab80f570"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8213-L8219"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d7da820b00ef5ee2e943b012cfa57421a39f8a7bfc627cc1909151a47092a26d"
+		logic_hash = "v1_sha256_d7da820b00ef5ee2e943b012cfa57421a39f8a7bfc627cc1909151a47092a26d"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and (pe.exports("FloodFix") or pe.exports("FloodFix2")) and pe.exports("crc32")
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and ( pe.exports ( "FloodFix" ) or pe.exports ( "FloodFix2" ) ) and pe.exports ( "crc32" )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_UNK_Infostealer : FILE
 {
 	meta:
 		description = "Detects unknown information stealer"
 		author = "ditekSHen"
-		id = "f6f9816f-79bd-527c-9c0f-24e09c95ae35"
+		id = "276ac287-3c2d-5315-b0ff-fc43c41e1075"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8221-L8246"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ca57ebf4b56020d278ec8a7e721c72de7a1f925a8e7f1f3a9edc8a70b88ff9d1"
+		logic_hash = "v1_sha256_ca57ebf4b56020d278ec8a7e721c72de7a1f925a8e7f1f3a9edc8a70b88ff9d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258006,22 +256339,20 @@ rule DITEKSHEN_MALWARE_Win_UNK_Infostealer : FILE
 		$s13 = "2:?/v /v /v /^Y" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_DECAF : FILE
 {
 	meta:
 		description = "Detects DECAF ransomware"
 		author = "ditekSHen"
-		id = "c6e4ce00-0be9-572d-987c-c47d699002f0"
+		id = "b4687ba4-47a9-5cb5-a652-7873c032fd07"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8248-L8268"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5d79a4f310fb00022eb9d636f161227e84a7e15517c4d2c39acafa7d81af5c2a"
+		logic_hash = "v1_sha256_5d79a4f310fb00022eb9d636f161227e84a7e15517c4d2c39acafa7d81af5c2a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258042,7 +256373,7 @@ rule DITEKSHEN_MALWARE_Win_DECAF : FILE
 		$m4 = "We WILL NOT be able to RESTORE them." ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or 3 of ($m*) or (1 of ($m*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or 3 of ( $m* ) or ( 1 of ( $m* ) and 2 of ( $s* ) ) )
 }
 import "pe"
 
@@ -258051,13 +256382,13 @@ rule DITEKSHEN_MALWARE_Win_Windealer : FILE
 	meta:
 		description = "Detects WinDealer"
 		author = "ditekSHen"
-		id = "d4f3b0cc-121e-5032-9721-1e2a86842fa5"
+		id = "eb0fa010-5342-5bfa-a001-57a2e197545c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8270-L8301"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "eabc41ea69f142ee7c243cbc75ceda909a722be382ad91a01c805aef637be915"
+		logic_hash = "v1_sha256_eabc41ea69f142ee7c243cbc75ceda909a722be382ad91a01c805aef637be915"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -258089,22 +256420,20 @@ rule DITEKSHEN_MALWARE_Win_Windealer : FILE
 		$s7 = "%s\\%s\\main.db" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((4 of ($d*) and 1 of ($s*)) or (5 of ($s*) and 1 of ($d*)) or 6 of ($l*) or (pe.exports("DealC") and pe.exports("DealR") and pe.exports("DealS") and 1 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 4 of ( $d* ) and 1 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $d* ) ) or 6 of ( $l* ) or ( pe.exports ( "DealC" ) and pe.exports ( "DealR" ) and pe.exports ( "DealS" ) and 1 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Exmatter : FILE
 {
 	meta:
 		description = "Detects BlackMatter data exfiltration tool"
 		author = "ditekSHen"
-		id = "93df7a68-1e19-5db3-95d4-39d77d1036d8"
+		id = "a03e82f6-5925-52a0-bf4d-de948b46b324"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8303-L8325"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "25a35c82919f96bdba00558616f574e901b83785713ed1a63a6f06df576777cd"
+		logic_hash = "v1_sha256_25a35c82919f96bdba00558616f574e901b83785713ed1a63a6f06df576777cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258127,22 +256456,20 @@ rule DITEKSHEN_MALWARE_Win_Exmatter : FILE
 		$x3 = "157.230.28.192" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($x*) and 7 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $x* ) and 7 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Brbbot : FILE
 {
 	meta:
 		description = "Detects BrbBot"
 		author = "ditekSHen"
-		id = "d77dfdcf-4cd5-578e-99eb-c987e7b5b706"
+		id = "41f7709a-e85d-5c9b-9a01-f4cc67fb084e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8327-L8345"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "64df5bba698fbba1baf27eedb9a2eb46c5e0752996ea91900f8377200d54eeeb"
+		logic_hash = "v1_sha256_64df5bba698fbba1baf27eedb9a2eb46c5e0752996ea91900f8377200d54eeeb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258161,22 +256488,20 @@ rule DITEKSHEN_MALWARE_Win_Brbbot : FILE
                 65 78 65 63 }
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($x*) and 1 of ($s*)) or (1 of ($x*) and 4 of ($s*)) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $x* ) and 1 of ( $s* ) ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Babylonrat : FILE
 {
 	meta:
 		description = "Detects BabylonRAT / CollectorStealer / ParadoxRAT"
 		author = "ditekSHen"
-		id = "7352e0cf-64ab-5ba4-afaf-04067a0046e8"
+		id = "094ce0ec-f0d8-5136-8a8d-85cd844988d1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8347-L8373"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "352efb98e298e9f0ce17c20d44d193f2565ec559923210d80dec1a0988545a30"
+		logic_hash = "v1_sha256_352efb98e298e9f0ce17c20d44d193f2565ec559923210d80dec1a0988545a30"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -258203,22 +256528,20 @@ rule DITEKSHEN_MALWARE_Win_Babylonrat : FILE
 		$s17 = "sckRelay" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 8 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or 8 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Netsupport : FILE
 {
 	meta:
 		description = "Detects NetSupport client"
 		author = "ditekSHen"
-		id = "958e82c5-aeac-58f4-b214-a9382b598cd9"
+		id = "416a5059-b59f-546d-a6b8-b6d49e58981c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8375-L8386"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4e8120d902fdee2a3f87c85bb6bb7d3bba79e3828500f297c2dc57d5213cf6a8"
+		logic_hash = "v1_sha256_4e8120d902fdee2a3f87c85bb6bb7d3bba79e3828500f297c2dc57d5213cf6a8"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -258230,7 +256553,7 @@ rule DITEKSHEN_MALWARE_Win_Netsupport : FILE
 		$s3 = "<description>NetSupport Manager Remote Control.</description>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
 import "pe"
 
@@ -258239,34 +256562,32 @@ rule DITEKSHEN_MALWARE_Win_Gobrutloader : FILE
 	meta:
 		description = "Detects GoBrut StealthWorker laoder"
 		author = "ditekSHen"
-		id = "748f8055-71d9-5757-8eb0-90dc3ee35c74"
+		id = "88765b16-27a7-56d6-a0b0-d04439ca8641"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8388-L8394"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6241117cffb147763ace41b36cd1524f48bfc7cb06d56a82d7b30bec9e1baf5b"
+		logic_hash = "v1_sha256_6241117cffb147763ace41b36cd1524f48bfc7cb06d56a82d7b30bec9e1baf5b"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and pe.exports("@SetFirstEverVice@8")
+		uint16( 0 ) == 0x5a4d and pe.exports ( "@SetFirstEverVice@8" )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Milan : FILE
 {
 	meta:
 		description = "Detects Milan Lyceum backdoor"
 		author = "ditekSHen"
-		id = "2ea0775b-65d4-58b9-9af9-c07f29742627"
+		id = "c62b7f63-8c29-5d9c-86d2-927aad3701f5"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8396-L8467"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "102af43be7cc3d873fbce78c95c767ebb6aadb2e7084b48f3cf48c11071d7a71"
+		logic_hash = "v1_sha256_102af43be7cc3d873fbce78c95c767ebb6aadb2e7084b48f3cf48c11071d7a71"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -258338,22 +256659,20 @@ rule DITEKSHEN_MALWARE_Win_Milan : FILE
 		$d26 = "zonestatistic.com" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($p*) and (2 of ($s*) or 2 of ($ua*))) or (5 of ($n*) and (2 of ($ua*) or 1 of ($p*) or 1 of ($s*))) or (3 of ($s*) and (2 of ($ua*) or 5 of ($n*))) or (2 of ($d*) and 6 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $p* ) and ( 2 of ( $s* ) or 2 of ( $ua* ) ) ) or ( 5 of ( $n* ) and ( 2 of ( $ua* ) or 1 of ( $p* ) or 1 of ( $s* ) ) ) or ( 3 of ( $s* ) and ( 2 of ( $ua* ) or 5 of ( $n* ) ) ) or ( 2 of ( $d* ) and 6 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_UNK05 : FILE
 {
 	meta:
 		description = "Detects potential BazarLoader"
 		author = "ditekSHen"
-		id = "12f66315-f381-5910-b1d4-2cbf21c889a4"
+		id = "7e1d879e-66c1-5ac7-9d0e-ff1eb72915b0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8469-L8486"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b3074f237fbaf449a53dcc219f48509db6af4c0d0859e6590563c3412be30aa8"
+		logic_hash = "v1_sha256_b3074f237fbaf449a53dcc219f48509db6af4c0d0859e6590563c3412be30aa8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258371,22 +256690,20 @@ rule DITEKSHEN_MALWARE_Win_UNK05 : FILE
 		$s10 = "{065f6686-990b-46fc-829c-a53ec188a723}" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Clipbanker01 : FILE
 {
 	meta:
 		description = "Detects ClipBanker infostealer"
 		author = "ditekSHen"
-		id = "b56514f4-8362-5698-8142-be836b70a11a"
+		id = "03c50476-3d0a-5165-bfbb-29293da9382c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8488-L8521"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8ef90e22299a1009468761a4cdb8e2a92920d721f1a7ebceeb81a07e14f9156f"
+		logic_hash = "v1_sha256_8ef90e22299a1009468761a4cdb8e2a92920d721f1a7ebceeb81a07e14f9156f"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -258420,22 +256737,20 @@ rule DITEKSHEN_MALWARE_Win_Clipbanker01 : FILE
 		$s18 = "AntiVm" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Zombieboy : FILE
 {
 	meta:
 		description = "Detects ZombieBoy Downloader"
 		author = "ditekSHen"
-		id = "c1345196-1686-534c-ab4c-557113c83411"
+		id = "83ccfe37-21aa-5b37-a932-15322bfc6819"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8523-L8532"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0840367c1b56c4c266f22400df95411ba7784b98919a922380e1ec789783bb65"
+		logic_hash = "v1_sha256_0840367c1b56c4c266f22400df95411ba7784b98919a922380e1ec789783bb65"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258445,22 +256760,20 @@ rule DITEKSHEN_MALWARE_Win_Zombieboy : FILE
 		$s2 = "RookIE/1.0" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Pcrat : FILE
 {
 	meta:
 		description = "Detects PCRat / Gh0st"
 		author = "ditekSHen"
-		id = "de5b3e08-16da-56e2-a0a4-d8bed5840804"
+		id = "ec7cc7ee-2274-5c3f-9ab1-289205395e59"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8534-L8561"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ad56d7d6a2bb6d09bc4530c31b51456b6bbca5def1810449fd2a31973cce18f8"
+		logic_hash = "v1_sha256_ad56d7d6a2bb6d09bc4530c31b51456b6bbca5def1810449fd2a31973cce18f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258488,22 +256801,20 @@ rule DITEKSHEN_MALWARE_Win_Pcrat : FILE
 		$a11 = "ashDisp.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of ($s*) and 6 of ($a*)
+		uint16( 0 ) == 0x5a4d and 5 of ( $s* ) and 6 of ( $a* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Rapid : FILE
 {
 	meta:
 		description = "Detects Rapid ransomware"
 		author = "ditekSHen"
-		id = "3a23f344-8345-5ae8-aacb-f2f422d3fc9d"
+		id = "4dcfba90-6b6f-5433-a1cf-d46190e5a6dd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8563-L8585"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c3f1bffeb402951da8bcccc899b2cdeb3c218b342d8338c750b9ff275537b4b5"
+		logic_hash = "v1_sha256_c3f1bffeb402951da8bcccc899b2cdeb3c218b342d8338c750b9ff275537b4b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258526,22 +256837,20 @@ rule DITEKSHEN_MALWARE_Win_Rapid : FILE
 		$m2 = "really want to restore your files?" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or (1 of ($m*) and 4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( 1 of ( $m* ) and 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Satana : FILE
 {
 	meta:
 		description = "Detects Satana ransomware"
 		author = "ditekSHen"
-		id = "f3cb7cc4-3c63-50b2-8e19-d675abbb33f8"
+		id = "ed3fc9ca-59d4-5f72-90c0-30246d8c5a46"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8587-L8604"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b2946e8c37be4a57237999aaa0c0a760a181306320162e04bc6fc12a542b81d5"
+		logic_hash = "v1_sha256_b2946e8c37be4a57237999aaa0c0a760a181306320162e04bc6fc12a542b81d5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -258559,22 +256868,20 @@ rule DITEKSHEN_MALWARE_Win_Satana : FILE
 		$bf9 = "%s: NET RES FOUND: %s" wide
 
 	condition:
-		( uint16(0)==0x5a4d and 4 of ($bf*)) or (5 of ($bf*))
+		( uint16( 0 ) == 0x5a4d and 4 of ( $bf* ) ) or ( 5 of ( $bf* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Virlock : FILE
 {
 	meta:
 		description = "Detects VirLock ransomware"
 		author = "ditekSHen"
-		id = "dbf46963-3e74-54a0-8f7d-b24436c3ea2c"
+		id = "ea6db8bb-2a14-5e58-a5c7-5ecb2b3602c8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8606-L8624"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8d516a0d771d7134c0f917f010b3973ed53b4ee7e4a2cf0bb5daecf9867b0081"
+		logic_hash = "v1_sha256_8d516a0d771d7134c0f917f010b3973ed53b4ee7e4a2cf0bb5daecf9867b0081"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258593,22 +256900,20 @@ rule DITEKSHEN_MALWARE_Win_Virlock : FILE
 		$s7 = "del /F /Q %0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and ((2 of ($x*) and 2 of ($s*)) or (5 of ($s*) and 1 of ($x*)))) or (8 of them )
+		( uint16( 0 ) == 0x5a4d and ( ( 2 of ( $x* ) and 2 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $x* ) ) ) ) or ( 8 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Piratestealer : FILE
 {
 	meta:
 		description = "Detects PirateStealer"
 		author = "ditekSHen"
-		id = "07278b99-b990-5016-8389-fbd27538a722"
+		id = "c6e797f1-b219-5d48-b4cf-1523290d6014"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8626-L8644"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c29fbc6cfa9e529218fa7315481e0922dc10b2da729931b8580bdd76ecdf6b68"
+		logic_hash = "v1_sha256_c29fbc6cfa9e529218fa7315481e0922dc10b2da729931b8580bdd76ecdf6b68"
 		score = 50
 		quality = 75
 		tags = "FILE"
@@ -258627,22 +256932,20 @@ rule DITEKSHEN_MALWARE_Win_Piratestealer : FILE
                6d 00 53 79 73 74 65 6d 00 4d 61 69 6e 00 }
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nglite : FILE
 {
 	meta:
 		description = "Detects NGLite"
 		author = "ditekSHen"
-		id = "b014ed4f-57b1-597e-befc-6e7f80855201"
+		id = "0a05526c-78c9-5233-9b25-220c402d3749"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8646-L8668"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d83663908949f69018461c73cf7137cf4ab16cc057cfe47942e6de0415ab5447"
+		logic_hash = "v1_sha256_d83663908949f69018461c73cf7137cf4ab16cc057cfe47942e6de0415ab5447"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258665,7 +256968,7 @@ rule DITEKSHEN_MALWARE_Win_Nglite : FILE
 		$s10 = "main.Sender" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and ((1 of ($x*) and 2 of ($s*)) or (6 of ($s*)))
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( 6 of ( $s* ) ) )
 }
 import "pe"
 
@@ -258674,13 +256977,13 @@ rule DITEKSHEN_MALWARE_Win_Kdcsponge : FILE
 	meta:
 		description = "Detects KdcSponge"
 		author = "ditekSHen"
-		id = "8832a141-a85d-5604-992e-7e9bd892d410"
+		id = "7a2e33e8-82d6-5438-8094-4df6c0f72c3c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8670-L8700"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c891db94df9cde9eaa6096ad68d96c7b85a9c03e255ce43ccb8543a016bd3853"
+		logic_hash = "v1_sha256_c891db94df9cde9eaa6096ad68d96c7b85a9c03e255ce43ccb8543a016bd3853"
 		score = 75
 		quality = 65
 		tags = "FILE"
@@ -258699,22 +257002,20 @@ rule DITEKSHEN_MALWARE_Win_Kdcsponge : FILE
 		$s3 = /WinHttp(Send|Receive)(Request|Response) failed (0x%.8X)/ fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of them ) or ( all of ($kdc*) and (1 of ($x*) or all of ($r*) or 2 of ($s*))) or (8 of them ) or (pe.exports("MainFun") and pe.exports("NetApiBufferFree") and pe.exports("BeaEngineRevision") and pe.exports("BeaEngineVersion") and pe.exports("Disasm") and pe.exports("DllRegisterServer") and pe.exports("DsGetDcName") and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of them ) or ( all of ( $kdc* ) and ( 1 of ( $x* ) or all of ( $r* ) or 2 of ( $s* ) ) ) or ( 8 of them ) or ( pe.exports ( "MainFun" ) and pe.exports ( "NetApiBufferFree" ) and pe.exports ( "BeaEngineRevision" ) and pe.exports ( "BeaEngineVersion" ) and pe.exports ( "Disasm" ) and pe.exports ( "DllRegisterServer" ) and pe.exports ( "DsGetDcName" ) and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Chinotto : FILE
 {
 	meta:
 		description = "Detects Chinotto"
 		author = "ditekSHen"
-		id = "e66703d4-c9c6-5bb4-9e07-11dc89b0a034"
+		id = "26463703-4fb4-5340-acac-2ad349aaed19"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8702-L8754"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "92f37bdc4cf17e07bb556c60e3bde4547c34f67a2fb5c806000d9cb2446adff1"
+		logic_hash = "v1_sha256_92f37bdc4cf17e07bb556c60e3bde4547c34f67a2fb5c806000d9cb2446adff1"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -258767,7 +257068,7 @@ rule DITEKSHEN_MALWARE_Win_Chinotto : FILE
 		$c7 = "id=%s&type=result&direction=" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and (2 of ($s*) or 2 of ($c*))) or 4 of ($c*) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 2 of ( $c* ) ) ) or 4 of ( $c* ) or 5 of ( $s* ) )
 }
 import "pe"
 
@@ -258776,13 +257077,13 @@ rule DITEKSHEN_MALWARE_Win_Tardigrade : FILE
 	meta:
 		description = "Detects Tardigrade"
 		author = "ditekSHen"
-		id = "a46caaaa-2954-552a-a20f-952c47370393"
+		id = "57821a6d-9075-572c-ba9d-fad901251b7b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8756-L8787"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2bd4f23f66844a320b6bed6242ba39096f66a08affb84abd78c342d433ed9fe6"
+		logic_hash = "v1_sha256_2bd4f23f66844a320b6bed6242ba39096f66a08affb84abd78c342d433ed9fe6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258805,22 +257106,20 @@ rule DITEKSHEN_MALWARE_Win_Tardigrade : FILE
 		$s7 = ">\"%s\"&exit" ascii
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and (1 of ($x*) or 6 of ($s*)) and (pe.exports("DllGetClassObject") and pe.exports("DllMain") and pe.exports("DllRegisterServer") and pe.exports("DllUnregisterServer") and pe.exports("InitHelperDll") and pe.exports("StartW"))
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and ( 1 of ( $x* ) or 6 of ( $s* ) ) and ( pe.exports ( "DllGetClassObject" ) and pe.exports ( "DllMain" ) and pe.exports ( "DllRegisterServer" ) and pe.exports ( "DllUnregisterServer" ) and pe.exports ( "InitHelperDll" ) and pe.exports ( "StartW" ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Clipbanker02 : FILE
 {
 	meta:
 		description = "Detects ClipBanker infostealer"
 		author = "ditekSHen"
-		id = "c2a480cf-e81b-53a2-999a-80209050e0cf"
+		id = "0466c034-8152-51bd-a048-57914aef21b8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8789-L8814"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "51a43245b1e0b6fea874302b73bf552012c54c3f7c12b8c447c96c2ffdcc1dcb"
+		logic_hash = "v1_sha256_51a43245b1e0b6fea874302b73bf552012c54c3f7c12b8c447c96c2ffdcc1dcb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258846,22 +257145,20 @@ rule DITEKSHEN_MALWARE_Win_Clipbanker02 : FILE
 		$re7 = "(\\d{3})" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (5 of ($v1*) or all of ($v2*))) or (3 of ($re*) and (2 of ($v1*) or 2 of ($v2*))))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 5 of ( $v1* ) or all of ( $v2* ) ) ) or ( 3 of ( $re* ) and ( 2 of ( $v1* ) or 2 of ( $v2* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Badjoke : FILE
 {
 	meta:
 		description = "Detects BadJoke / Witch"
 		author = "ditekSHen"
-		id = "082727d5-618f-542d-93ca-ba93be16cd80"
+		id = "31d003e8-bcc3-5e5b-b31d-3656de4a4e26"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8816-L8831"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4699a772bcd50d2fe43740df59a4c56598ba43ebcc18acbf8ec401b6f5a01fe6"
+		logic_hash = "v1_sha256_4699a772bcd50d2fe43740df59a4c56598ba43ebcc18acbf8ec401b6f5a01fe6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258877,22 +257174,20 @@ rule DITEKSHEN_MALWARE_Win_Badjoke : FILE
 		$m2 = "you cannot get rid of this virus" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($m*) or all of ($s*) or (1 of ($m*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $m* ) or all of ( $s* ) or ( 1 of ( $m* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Heracles : FILE
 {
 	meta:
 		description = "Detects Heracles infostealer"
 		author = "ditekSHen"
-		id = "36cb9366-c70b-5117-955f-402f87f3a88c"
+		id = "16b68220-3799-5b27-8654-3f35dde693fd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8833-L8861"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1d5c80c084f9d6e4692a18f74574179095ecdd5eaadd70b5d16c19702761d74f"
+		logic_hash = "v1_sha256_1d5c80c084f9d6e4692a18f74574179095ecdd5eaadd70b5d16c19702761d74f"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -258921,22 +257216,20 @@ rule DITEKSHEN_MALWARE_Win_Heracles : FILE
 		$s9 = "<postData>5__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 8 of ($s*) or (4 of ($b*) and 4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 8 of ( $s* ) or ( 4 of ( $b* ) and 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Onlylogger : FILE
 {
 	meta:
 		description = "Detects OnlyLogger loader variants"
 		author = "ditekSHen"
-		id = "525aa2a0-5090-5f96-999b-67ca4379f897"
+		id = "e33c897e-b1f5-5aaa-8d23-a59d472c4d5b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8863-L8882"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1b39a4d2a6d3a2633cfa98adc1dfe99d10d2493fd06c9f875c56ec7689b7a561"
+		logic_hash = "v1_sha256_1b39a4d2a6d3a2633cfa98adc1dfe99d10d2493fd06c9f875c56ec7689b7a561"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -258956,22 +257249,20 @@ rule DITEKSHEN_MALWARE_Win_Onlylogger : FILE
 		$h5 = "Content-Type: application/x-www-form-urlencoded" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (#ip>5 and ($gn or 3 of ($s*) or all of ($h*))) or ( all of ($h*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( #ip > 5 and ( $gn or 3 of ( $s* ) or all of ( $h* ) ) ) or ( all of ( $h* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Blackbytego : FILE
 {
 	meta:
 		description = "Detects BlackByte ransomware Go variants"
 		author = "ditekSHen"
-		id = "25431446-8cce-54cc-925d-5d9147344c6d"
+		id = "b143cc1c-0e39-5bd1-b290-ea018357b5b4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8884-L8904"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b3e6a4a2f043293e8693cfbe1515681ce0616d98e2492732fc06a01a96309883"
+		logic_hash = "v1_sha256_b3e6a4a2f043293e8693cfbe1515681ce0616d98e2492732fc06a01a96309883"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -258990,22 +257281,20 @@ rule DITEKSHEN_MALWARE_Win_Blackbytego : FILE
 		$s9 = "C:\\Windows\\regedit.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Vulturi : FILE
 {
 	meta:
 		description = "Detects Vulturi infostealer"
 		author = "ditekSHen"
-		id = "dca814d6-ca26-5315-9f80-628ee50e8dfa"
+		id = "2d2566c1-fd08-55c6-a029-330835f0992e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8906-L8931"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4d1d88764dd72ae78a74b802e11c2f28899b7b9f45c54cf3bf7aaac49dd48d7f"
+		logic_hash = "v1_sha256_4d1d88764dd72ae78a74b802e11c2f28899b7b9f45c54cf3bf7aaac49dd48d7f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259031,22 +257320,20 @@ rule DITEKSHEN_MALWARE_Win_Vulturi : FILE
 		$n3 = "?username=" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and any of them ) or all of ($n*) or 5 of ($s*) or (1 of ($n*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and any of them ) or all of ( $n* ) or 5 of ( $s* ) or ( 1 of ( $n* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Tofsee : FILE
 {
 	meta:
 		description = "Detects Tofsee"
 		author = "ditekSHen"
-		id = "86371c0b-72f9-56c0-9f34-f14d2a069c91"
+		id = "1d01a42b-65ef-5698-bd64-24931e733a8e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8933-L8949"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9ef06643173c70c5b06b19200cb5b5efa7db7eb3516b67621f0b1975f1c80781"
+		logic_hash = "v1_sha256_9ef06643173c70c5b06b19200cb5b5efa7db7eb3516b67621f0b1975f1c80781"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259063,22 +257350,20 @@ rule DITEKSHEN_MALWARE_Win_Tofsee : FILE
 		$s9 = "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Khonsari : FILE
 {
 	meta:
 		description = "Detects Khonsari ransomware"
 		author = "ditekSHen"
-		id = "2d562e62-a948-570d-8ff2-cc4835b91573"
+		id = "2ee82a64-83e5-5918-9b70-65e7c5a30042"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8951-L8963"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2a78f36259481fccb31b2e6248fed19699b6eb05bacfd08905414764c3045943"
+		logic_hash = "v1_sha256_2a78f36259481fccb31b2e6248fed19699b6eb05bacfd08905414764c3045943"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -259091,7 +257376,7 @@ rule DITEKSHEN_MALWARE_Win_Khonsari : FILE
 		$s4 = "277e5e6a-4da6-4138-97fa-3fecbdad0176" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or ( all of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( all of ( $s* ) ) )
 }
 import "pe"
 
@@ -259100,13 +257385,13 @@ rule DITEKSHEN_MALWARE_Win_Quantum : FILE
 	meta:
 		description = "Detects Quantum locker / ransomware"
 		author = "ditekSHen"
-		id = "76a9240e-5b4f-5a1e-9841-e5ba855fb06f"
+		id = "c1a9fb46-9df2-5d5e-8c5a-5557ce41fafd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8965-L8987"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f35422d1f52f1f9f55a5e38c782d2cf621cd84da028358ab250584334d41249c"
+		logic_hash = "v1_sha256_f35422d1f52f1f9f55a5e38c782d2cf621cd84da028358ab250584334d41249c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259129,22 +257414,20 @@ rule DITEKSHEN_MALWARE_Win_Quantum : FILE
 		$s13 = "NetGetJoinInformation" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and ( all of ($x*) or 9 of ($s*) or (pe.number_of_exports==2 and pe.exports("RunW") and pe.exports("runW") and 5 of ($s*)))) or all of ($x*)
+		( uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 9 of ( $s* ) or ( pe.number_of_exports == 2 and pe.exports ( "RunW" ) and pe.exports ( "runW" ) and 5 of ( $s* ) ) ) ) or all of ( $x* )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Owowa : FILE
 {
 	meta:
 		description = "Detects Owowa"
 		author = "ditekSHen"
-		id = "c0a61601-e810-5acc-91a3-fa70db6d94da"
+		id = "f0884657-6ba7-53a9-ba30-db76a60e9688"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8989-L9007"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "afdeb30845ed4ef7b79e733e05d3e1ee53a8c441db74519577893d75c1249a41"
+		logic_hash = "v1_sha256_afdeb30845ed4ef7b79e733e05d3e1ee53a8c441db74519577893d75c1249a41"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259163,22 +257446,20 @@ rule DITEKSHEN_MALWARE_Win_Owowa : FILE
 		$s8 = "ExtenderControlDesigner" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($u*) or (2 of ($u*) and 3 of ($s*)) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $u* ) or ( 2 of ( $u* ) and 3 of ( $s* ) ) or 6 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Chebka : FILE
 {
 	meta:
 		description = "Detects Chebka"
 		author = "ditekSHen"
-		id = "df486522-695c-56f5-b93a-6f16829a3a3e"
+		id = "5b78d482-5cab-5508-b4cb-646ccd622e5f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9009-L9030"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cc8123a5d20fac51d4dfc225e743539456efb4d649060d078c3ed93e7724da01"
+		logic_hash = "v1_sha256_cc8123a5d20fac51d4dfc225e743539456efb4d649060d078c3ed93e7724da01"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259200,22 +257481,20 @@ rule DITEKSHEN_MALWARE_Win_Chebka : FILE
 		$f6 = ".?AVCScreenSpy@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or all of ($f*) or (3 of ($f*) and 3 of ($s*)) or (#s8>2 and 5 of them ))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or all of ( $f* ) or ( 3 of ( $f* ) and 3 of ( $s* ) ) or ( #s8 > 2 and 5 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Flagpro : FILE
 {
 	meta:
 		description = "Detects Flagpro"
 		author = "ditekSHen"
-		id = "da1bf899-feb5-5ed0-956e-c20bc3565a6e"
+		id = "604c3b18-f4f8-5033-959d-7360b961ebde"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9032-L9049"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c5e5944426b7be690ad62dd0d98a8fc6f8135cab0dbdd8a5aaf1670491eda59d"
+		logic_hash = "v1_sha256_c5e5944426b7be690ad62dd0d98a8fc6f8135cab0dbdd8a5aaf1670491eda59d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259233,22 +257512,20 @@ rule DITEKSHEN_MALWARE_Win_Flagpro : FILE
 		$b1 = /(get all|click|close|maybe|get_outerHTML|download\d) (finished|pass|ok|windows|failed)!/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) or (1 of ($n*) and (2 of ($s*) or 1 of ($b*))) or (2 of ($s*) and 1 of ($b*))
+		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( 1 of ( $n* ) and ( 2 of ( $s* ) or 1 of ( $b* ) ) ) or ( 2 of ( $s* ) and 1 of ( $b* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Nplusminer
 {
 	meta:
 		description = "Detects PowerShell based NPlusMiner"
 		author = "ditekSHen"
-		id = "a16b504f-e69a-5abb-8e37-01bf7c2df6ef"
+		id = "e1820843-4465-5c1f-9ac8-7af76ac11d93"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9051-L9064"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f6b81c2276765455d46e20ed81e19caa3ae36a31827568486a09bc1619ec478c"
+		logic_hash = "v1_sha256_f6b81c2276765455d46e20ed81e19caa3ae36a31827568486a09bc1619ec478c"
 		score = 75
 		quality = 75
 		tags = ""
@@ -259264,20 +257541,18 @@ rule DITEKSHEN_MALWARE_Win_Nplusminer
 	condition:
 		3 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_PWSH_Poshcookiestealer
 {
 	meta:
 		description = "Detects PowerShell PoshCookieStealer"
 		author = "ditekSHen"
-		id = "7326a056-288b-534b-811d-172bd6936d7b"
+		id = "f7b454c4-2691-53e9-b786-920947db72d0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9066-L9080"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "234958098d09732675dd539e8d25c6754ba50bf92b3a19e7fef8c68d70503ec4"
+		logic_hash = "v1_sha256_234958098d09732675dd539e8d25c6754ba50bf92b3a19e7fef8c68d70503ec4"
 		score = 75
 		quality = 75
 		tags = ""
@@ -259294,20 +257569,18 @@ rule DITEKSHEN_MALWARE_Win_PWSH_Poshcookiestealer
 	condition:
 		5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Garrantdecrypt : FILE
 {
 	meta:
 		description = "Detects GarrantDecrypt ransomware"
 		author = "ditekSHen"
-		id = "e3be3663-9978-5b8e-b6b2-0f44f269adb2"
+		id = "703e3acf-42a1-5fd8-bd6c-ad3f29d6a4a1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9082-L9096"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "84b139e51f0ef0389c641d62409d702b0ae7ec6ecd2fa54baf2cf0c0078a8f5a"
+		logic_hash = "v1_sha256_84b139e51f0ef0389c641d62409d702b0ae7ec6ecd2fa54baf2cf0c0078a8f5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259322,22 +257595,20 @@ rule DITEKSHEN_MALWARE_Win_Garrantdecrypt : FILE
 		$s4 = "Write to our ICQ @" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($x*) and 1 of ($s*)) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( ( 2 of ( $x* ) and 1 of ( $s* ) ) or all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Locked : FILE
 {
 	meta:
 		description = "Detects Locked ransomware"
 		author = "ditekSHen"
-		id = "ad2f91ab-9bbb-5d47-a5c3-5a38dbab2ebe"
+		id = "9cec2f47-6db8-56f7-aaa9-da88079e43f6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9098-L9114"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b838b996946fb268c66bac68d5e326ff3049340dfb08f2e0a77492df49915d5a"
+		logic_hash = "v1_sha256_b838b996946fb268c66bac68d5e326ff3049340dfb08f2e0a77492df49915d5a"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -259354,22 +257625,20 @@ rule DITEKSHEN_MALWARE_Win_Locked : FILE
 		$s6 = /C:\\windows\\temp\\[a-z0-9A-Z]{6}\.tmp/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or (1 of ($x*) and 4 of ($s*)) or (#s6>1 and 4 of them ))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( #s6 > 1 and 4 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Maze : FILE
 {
 	meta:
 		description = "Detects Maze ransomware"
 		author = "ditekSHen"
-		id = "f5d1d3e2-1ffe-5ec6-b1ee-bded81867fb8"
+		id = "1e06d277-973e-5552-8293-3456473cbaa1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9116-L9145"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d3ce3b43c65dfd9f59ba3c6b64e8d7687db175673cc62068caa1e1da023390c0"
+		logic_hash = "v1_sha256_d3ce3b43c65dfd9f59ba3c6b64e8d7687db175673cc62068caa1e1da023390c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259399,22 +257668,20 @@ rule DITEKSHEN_MALWARE_Win_Maze : FILE
                74 2d 4c 65 6e 67 74 68 3a 20 00 }
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 6 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Teslarevenge : FILE
 {
 	meta:
 		description = "Detects TeslaRevenge ransomware"
 		author = "ditekSHen"
-		id = "13e5bb15-47eb-5e49-a1a5-3d51cacede2f"
+		id = "5e2b13a9-5ce0-5c65-9262-fd172ce882b2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9147-L9167"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0f68eae8a076d00c8d058ec148d3557f5770dc827d4690b931faf98797426dbc"
+		logic_hash = "v1_sha256_0f68eae8a076d00c8d058ec148d3557f5770dc827d4690b931faf98797426dbc"
 		score = 75
 		quality = 65
 		tags = "FILE"
@@ -259435,22 +257702,20 @@ rule DITEKSHEN_MALWARE_Win_Teslarevenge : FILE
 		$e5 = "cmd.exe" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or ( all of ($e*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( all of ( $e* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lokilocker : FILE
 {
 	meta:
 		description = "Detects LokiLocker ransomware"
 		author = "ditekSHen"
-		id = "4f4927c5-79e6-5c5a-b84d-c4728affe9e1"
+		id = "6da8f594-463c-5c1c-a64e-cd27a1c047b0"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9169-L9194"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bf78f5e8f40c1a19f6b078a85854e95d5ef1f321393a831edda17b0d65515da7"
+		logic_hash = "v1_sha256_bf78f5e8f40c1a19f6b078a85854e95d5ef1f321393a831edda17b0d65515da7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259476,22 +257741,20 @@ rule DITEKSHEN_MALWARE_Win_Lokilocker : FILE
 		$n8 = "&elapsed-time=" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 4 of ($s*) or 6 of ($n*) or (3 of ($s*) and 3 of ($n*)) or (1 of ($x*) and (2 of ($s*) or 2 of ($n*))))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 4 of ( $s* ) or 6 of ( $n* ) or ( 3 of ( $s* ) and 3 of ( $n* ) ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 2 of ( $n* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Osx_Dazzlespy : FILE
 {
 	meta:
 		description = "Attemp at hunting for DazzleSpy"
 		author = "ditekSHen"
-		id = "8c5f6605-13d2-578e-9e0b-6a8226991ac5"
+		id = "67ed9be0-51cd-562e-ad4a-c4ca554036ad"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9196-L9210"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "61305384055f71d92ce2ac3d427a1b6f85ce21f502e759f3af952127b1413470"
+		logic_hash = "v1_sha256_61305384055f71d92ce2ac3d427a1b6f85ce21f502e759f3af952127b1413470"
 		score = 50
 		quality = 71
 		tags = "FILE"
@@ -259506,22 +257769,20 @@ rule DITEKSHEN_MALWARE_Osx_Dazzlespy : FILE
 		$s5 = "RDPInfo" ascii wide
 
 	condition:
-		uint16(0)==0xfacf and ( all of ($x*) or all of ($s*) or (1 of ($x*) and 3 of ($s*)))
+		uint16( 0 ) == 0xfacf and ( all of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bhunt : FILE
 {
 	meta:
 		description = "Detects BHunt infostealer"
 		author = "ditekSHen"
-		id = "4c699f10-64a0-5e3c-af00-e08ebe1c6830"
+		id = "0400e653-759e-5ae1-a551-56cbbc6c599c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9212-L9233"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ca0a7e6898047fa3b369125a4402e2beffd328a5db47b1d5dd5914a86d6f0073"
+		logic_hash = "v1_sha256_ca0a7e6898047fa3b369125a4402e2beffd328a5db47b1d5dd5914a86d6f0073"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259543,22 +257804,20 @@ rule DITEKSHEN_MALWARE_Win_Bhunt : FILE
 		$g2 = "$6d0feb35-213d-4b9f-afc7-06d168cfcb5e" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and (5 of ($s*) or 2 of ($c*))) or (6 of ($s*) and 2 of ($c*)) or ( all of ($g*) and 2 of them ))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and ( 5 of ( $s* ) or 2 of ( $c* ) ) ) or ( 6 of ( $s* ) and 2 of ( $c* ) ) or ( all of ( $g* ) and 2 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lorenz : FILE
 {
 	meta:
 		description = "Detects Lorenz ransomware"
 		author = "ditekSHen"
-		id = "9c11cfbc-aa77-5138-81e4-3a5f4f21a470"
+		id = "41b00f10-71b5-5755-8fcd-eeefacb12445"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9235-L9265"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e9fc9d405b955c379ae40b1804d43b19999f6ea264fc645c897080fb020e8ae8"
+		logic_hash = "v1_sha256_e9fc9d405b955c379ae40b1804d43b19999f6ea264fc645c897080fb020e8ae8"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -259589,22 +257848,20 @@ rule DITEKSHEN_MALWARE_Win_Lorenz : FILE
 		$n5 = "&file=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 8 of ($s*) or (4 of ($n*) and 2 of them ) or (1 of ($x*) and 6 of them ))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 8 of ( $s* ) or ( 4 of ( $n* ) and 2 of them ) or ( 1 of ( $x* ) and 6 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Blackcat : FILE
 {
 	meta:
 		description = "Detects BlackCat ransomware"
 		author = "ditekSHen"
-		id = "b6831d84-40d7-52ae-8c4d-30b087b0007b"
+		id = "beaffcae-8cc2-55c6-8096-cef5dd6cdbe7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9267-L9289"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cd76e5b87f33d91c17fd032417583c3f68d0e310aaf6f08e26ec5d53844ed9d2"
+		logic_hash = "v1_sha256_cd76e5b87f33d91c17fd032417583c3f68d0e310aaf6f08e26ec5d53844ed9d2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259625,22 +257882,20 @@ rule DITEKSHEN_MALWARE_Win_Blackcat : FILE
 		$s11 = "hidden_partitions::mount_all::mounting=" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and ( all of ($x*) or 5 of ($s*) or (1 of ($x*) and 3 of ($s*)))
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and ( all of ( $x* ) or 5 of ( $s* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Koxic : FILE
 {
 	meta:
 		description = "Detects Koxic ransomware"
 		author = "ditekSHen"
-		id = "6a82bf44-b155-5746-b798-20a13623a14a"
+		id = "62b8fb51-fa4f-57a8-94a4-7bca14d31a3f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9291-L9309"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d874c8ebf330814e52d159cbf71f8bc05ebeb4a9fb93d96c3f861b51e57925a3"
+		logic_hash = "v1_sha256_d874c8ebf330814e52d159cbf71f8bc05ebeb4a9fb93d96c3f861b51e57925a3"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -259659,22 +257914,20 @@ rule DITEKSHEN_MALWARE_Win_Koxic : FILE
 		$s6 = "[Recommended] Using an email" wide
 
 	condition:
-		uint16(0)==0x5a4d and ((4 of ($s*) and 1 of ($c*)) or (2 of ($s*) and (#c1>5 or #c2>5 or #c3>5 or #c5>5)))
+		uint16( 0 ) == 0x5a4d and ( ( 4 of ( $s* ) and 1 of ( $c* ) ) or ( 2 of ( $s* ) and ( #c1 > 5 or #c2 > 5 or #c3 > 5 or #c5 > 5 ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Timetime : FILE
 {
 	meta:
 		description = "Detects TimeTime ransomware"
 		author = "ditekSHen"
-		id = "4d6a31b5-b5a5-58e2-bfce-c40c72cda391"
+		id = "93c59d1f-f5ef-5f64-b2dc-1cac74caa363"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9311-L9327"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c75ca595ff25f8c79bfe8e5c6af29349be8f07c2de79fd24f09b02afffb7168b"
+		logic_hash = "v1_sha256_c75ca595ff25f8c79bfe8e5c6af29349be8f07c2de79fd24f09b02afffb7168b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259691,22 +257944,20 @@ rule DITEKSHEN_MALWARE_Win_Timetime : FILE
 		$s9 = "EncrFiles_Load" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Strifewater : FILE
 {
 	meta:
 		description = "Detects StrifeWater RAT"
 		author = "ditekSHen"
-		id = "69f0bd07-3e4e-5245-9c42-c3f8199b566e"
+		id = "c7e2c948-6af8-5747-aa95-b1eb4b239aa9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9329-L9354"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ddb189dfe58af08d2c0682239551a5b9d82db94eedcefc02895316bcbbaca3f2"
+		logic_hash = "v1_sha256_ddb189dfe58af08d2c0682239551a5b9d82db94eedcefc02895316bcbbaca3f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259732,22 +257983,20 @@ rule DITEKSHEN_MALWARE_Win_Strifewater : FILE
 		$n7 = "Content-Disposition: form-data; name=\"tid\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($xn*) or 6 of ($s*) or 6 of ($n*) or (1 of ($xn*) and 4 of them ) or ($pdb and 4 of them ) or (3 of ($s*) and 3 of ($n*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $xn* ) or 6 of ( $s* ) or 6 of ( $n* ) or ( 1 of ( $xn* ) and 4 of them ) or ( $pdb and 4 of them ) or ( 3 of ( $s* ) and 3 of ( $n* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Surtr : FILE
 {
 	meta:
 		description = "Detects Surtr ransomware. Ransom note is similar to LockFile"
 		author = "ditekSHen"
-		id = "7a31415d-5c03-5537-9adb-65e637f9fa0e"
+		id = "9c1eedf3-56fa-55e4-a3f7-10fd3c59f614"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9356-L9378"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a8db5588079d471d8904f0444973973a0c01dbec1ccbe3d43a34d41a0dde495d"
+		logic_hash = "v1_sha256_a8db5588079d471d8904f0444973973a0c01dbec1ccbe3d43a34d41a0dde495d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259766,22 +258015,20 @@ rule DITEKSHEN_MALWARE_Win_Surtr : FILE
 		$s11 = /(Public|Private|ID)_DATA\.surt/ wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Udprat : FILE
 {
 	meta:
 		description = "Detects UDPRat"
 		author = "ditekSHen"
-		id = "938fc9fd-4f08-5c23-8583-06083d2efe59"
+		id = "40baf759-358c-599f-a86d-94fad092678f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9380-L9395"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4606b304d179148c6e44a0a8329675f2823f862a0944284cb646e5910659ea7c"
+		logic_hash = "v1_sha256_4606b304d179148c6e44a0a8329675f2823f862a0944284cb646e5910659ea7c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259797,22 +258044,20 @@ rule DITEKSHEN_MALWARE_Win_Udprat : FILE
 		$s8 = "microsoftonliser-based Securi" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Jesterstealer : FILE
 {
 	meta:
 		description = "Detects JesterStealer"
 		author = "ditekSHen"
-		id = "7b07061f-97a4-5158-8084-46ccf212f6be"
+		id = "a1a8ccc3-1347-57e8-8962-5843e681b33a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9397-L9417"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c84df5d3ad2bc7a75a11c07995cc034c2a92b2f6f6f6943288add9c44c57bf6d"
+		logic_hash = "v1_sha256_c84df5d3ad2bc7a75a11c07995cc034c2a92b2f6f6f6943288add9c44c57bf6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259833,22 +258078,20 @@ rule DITEKSHEN_MALWARE_Win_Jesterstealer : FILE
 		$s14 = /Stealer\.(Recovery|Grabber|Investigation)\./ ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Soranostealer : FILE
 {
 	meta:
 		description = "Detects SoranoStealer / HogGrabber. Available on Github: /Alexuiop1337/SoranoStealer"
 		author = "ditekSHen"
-		id = "2fc40a73-5f28-5b5c-938a-35e8336e1d11"
+		id = "533aa078-faaf-5515-9e68-044eb2af5781"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9419-L9443"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "27c9d6bf3f40f3d41c35975e856671fafcd4a0a8143b3bcbdff61c1fb28a37ab"
+		logic_hash = "v1_sha256_27c9d6bf3f40f3d41c35975e856671fafcd4a0a8143b3bcbdff61c1fb28a37ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259873,22 +258116,20 @@ rule DITEKSHEN_MALWARE_Win_Soranostealer : FILE
 		$s9 = "  - 96188142294460126639341306" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (2 of ($x*) and 3 of ($s*)) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 2 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Gloomanestealer : FILE
 {
 	meta:
 		description = "Detects GloomaneStealer"
 		author = "ditekSHen"
-		id = "6e3c7e8f-4b75-5198-aa41-076f29aac227"
+		id = "56109579-5842-539c-a1c8-3819aea861e4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9445-L9461"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "36aa9f863efb8172ed6449932169e6cb26cdeedd84bc734e09a8116a9c7774ac"
+		logic_hash = "v1_sha256_36aa9f863efb8172ed6449932169e6cb26cdeedd84bc734e09a8116a9c7774ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259905,22 +258146,20 @@ rule DITEKSHEN_MALWARE_Win_Gloomanestealer : FILE
 		$s7 = "$3b0e2d3d-3d66-42bb-8f9c-d6e188f359ae" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lockdown : FILE
 {
 	meta:
 		description = "Detects Lockdown / cantopen ransomware"
 		author = "ditekSHen"
-		id = "793df99d-016a-5f96-9ff9-76d3f08e0dd2"
+		id = "31a2473f-3c5d-5ed1-8566-37f64b9bf2cd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9463-L9476"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a9bc2f514730703f3edf78a61f1bc357eee12b3289fc7491197c3b885286ca7e"
+		logic_hash = "v1_sha256_a9bc2f514730703f3edf78a61f1bc357eee12b3289fc7491197c3b885286ca7e"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -259934,22 +258173,20 @@ rule DITEKSHEN_MALWARE_Win_Lockdown : FILE
 		$s6 = "CreateEncryptor" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Unamedstealer : FILE
 {
 	meta:
 		description = "Detects unknown infostealer. Observed as 2nd stage and injects into .NET AppLaunch.exe"
 		author = "ditekSHen"
-		id = "cb3d575b-3d53-5b89-abc1-3b3857ec9f46"
+		id = "d8874018-eb91-5241-bb30-169f7b09582e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9478-L9494"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "84f4ac7489a0d522763f69ce55f816642a8511dc4b9698ce47c983020a2b7bea"
+		logic_hash = "v1_sha256_84f4ac7489a0d522763f69ce55f816642a8511dc4b9698ce47c983020a2b7bea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -259966,7 +258203,7 @@ rule DITEKSHEN_MALWARE_Win_Unamedstealer : FILE
 		$s9 = "### {0} ### ({1})" wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
 import "pe"
 
@@ -259975,13 +258212,13 @@ rule DITEKSHEN_MALWARE_Win_Zxshell_Loader : FILE
 	meta:
 		description = "Detects ZXShell kernel driver loader"
 		author = "ditekSHen"
-		id = "c55c718b-6af3-5d3b-aa1c-369319fca603"
+		id = "a6b99f3e-8178-5b12-bc70-8d90374912e9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9496-L9544"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b20350af231e0c329423c71d8f099305ed447d2ffcb7a533b7531dc9f5357b93"
+		logic_hash = "v1_sha256_b20350af231e0c329423c71d8f099305ed447d2ffcb7a533b7531dc9f5357b93"
 		score = 75
 		quality = 57
 		tags = "FILE"
@@ -260015,22 +258252,20 @@ rule DITEKSHEN_MALWARE_Win_Zxshell_Loader : FILE
 		$m6 = "can k1ll the pr0cessId" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($m*) or 5 of ($s*) or 5 of ($x*) or (3 of ($s*) and 3 of ($x*)) or (2 of ($s*) and 1 of ($x*) and 1 of ($m*)) or (pe.exports("KillAvpProcess") and pe.exports("ProtectDllFile") and pe.exports("LoadSys")) or (3 of them and (pe.exports("KillAvpProcess") or pe.exports("ProtectDllFile") or pe.exports("LoadSys") or pe.exports("CallDriver") or pe.exports("DoRVA"))))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $m* ) or 5 of ( $s* ) or 5 of ( $x* ) or ( 3 of ( $s* ) and 3 of ( $x* ) ) or ( 2 of ( $s* ) and 1 of ( $x* ) and 1 of ( $m* ) ) or ( pe.exports ( "KillAvpProcess" ) and pe.exports ( "ProtectDllFile" ) and pe.exports ( "LoadSys" ) ) or ( 3 of them and ( pe.exports ( "KillAvpProcess" ) or pe.exports ( "ProtectDllFile" ) or pe.exports ( "LoadSys" ) or pe.exports ( "CallDriver" ) or pe.exports ( "DoRVA" ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bandit : FILE
 {
 	meta:
 		description = "Detects Bandit Infostealer"
 		author = "ditekSHen"
-		id = "06866232-bd40-5bbc-9f08-3892193b5f36"
+		id = "795621a8-514c-5a5c-9806-7fc83318f3cd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9546-L9582"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e557f5a928b5da90f3ec878d6d8615a2d8b5f33e97954cd3278044f76b543386"
+		logic_hash = "v1_sha256_e557f5a928b5da90f3ec878d6d8615a2d8b5f33e97954cd3278044f76b543386"
 		score = 75
 		quality = 57
 		tags = "FILE"
@@ -260067,22 +258302,20 @@ rule DITEKSHEN_MALWARE_Win_Bandit : FILE
 		$s6 = "/user:Administrator" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 4 of ($n*) or 5 of ($f*) or ($path and (1 of ($n*) or 1 of ($f*))) or (1 of ($x*) and (1 of ($n*) or 1 of ($f2*))) or 6 of ($m*) or ( all of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 4 of ( $n* ) or 5 of ( $f* ) or ( $path and ( 1 of ( $n* ) or 1 of ( $f* ) ) ) or ( 1 of ( $x* ) and ( 1 of ( $n* ) or 1 of ( $f2* ) ) ) or 6 of ( $m* ) or ( all of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Laplas : FILE
 {
 	meta:
 		description = "Detects LapLas Infostealer"
 		author = "ditekSHen"
-		id = "bf2b0183-2b21-535a-896c-250fa448d090"
+		id = "cec2b1dd-a28b-5fba-8c73-809c2abc23b7"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9584-L9612"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e4a1f39a539782118db9c4ab89d03e359420397ef970165389cc79e7ea0952b3"
+		logic_hash = "v1_sha256_e4a1f39a539782118db9c4ab89d03e359420397ef970165389cc79e7ea0952b3"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -260109,22 +258342,20 @@ rule DITEKSHEN_MALWARE_Win_Laplas : FILE
 		$v2_7 = "RefreshRegex" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($c*) and 5 of ($f*)) or (1 of ($c*) and 7 of ($f*)) or (6 of ($v2*)))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $c* ) and 5 of ( $f* ) ) or ( 1 of ( $c* ) and 7 of ( $f* ) ) or ( 6 of ( $v2* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Mystic : FILE
 {
 	meta:
 		description = "Hunt for Mystic Infostealer"
 		author = "ditekSHen"
-		id = "959eceab-0a2c-5361-b8f4-6739033ffae5"
+		id = "ebdcba26-3c04-5321-a82f-382a1d2670fe"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9614-L9628"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "26e0b85141df818d70124c0b19b5b6a05ac24ae679724d7a8ad94415a6462d17"
+		logic_hash = "v1_sha256_26e0b85141df818d70124c0b19b5b6a05ac24ae679724d7a8ad94415a6462d17"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260139,22 +258370,20 @@ rule DITEKSHEN_MALWARE_Win_Mystic : FILE
 		$p2 = /G:\\Projects\\stealer\\.{15}\\Release\\.{5,25}\.pdb/ ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and (4 of ($s*) or (1 of ($p*) and 3 of ($s*)))) or ( all of ($s*))
+		( uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( 1 of ( $p* ) and 3 of ( $s* ) ) ) ) or ( all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Buhti : FILE
 {
 	meta:
 		description = "Detects Buhti Ransomware"
 		author = "ditekSHen"
-		id = "a50b8c34-e9e2-5466-80a1-b0ab805c68be"
+		id = "1ca43e8d-9390-5821-a769-7df27f520b7e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9630-L9643"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1bab3202dbeaf088b233c3ab1056c357d156b7eef3111bea997b1c610a27f561"
+		logic_hash = "v1_sha256_1bab3202dbeaf088b233c3ab1056c357d156b7eef3111bea997b1c610a27f561"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260168,22 +258397,20 @@ rule DITEKSHEN_MALWARE_Linux_Buhti : FILE
 		$s4 = ".buhti390625" ascii
 
 	condition:
-		uint16(0)==0x457f and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 5 of them )
+		uint16( 0 ) == 0x457f and ( all of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Commonmagic : FILE
 {
 	meta:
 		description = "Detects CommonMagic and Modules"
 		author = "ditekSHen"
-		id = "cbebe334-9b66-5931-8f92-25d080f7fd6a"
+		id = "68bf7d44-0465-5f88-bfb3-d6526b8065f2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9645-L9660"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e94ba53f31f3effe12b1fbaca19fea59c0e12f742f6fc0af2a0a679bf4299cbe"
+		logic_hash = "v1_sha256_e94ba53f31f3effe12b1fbaca19fea59c0e12f742f6fc0af2a0a679bf4299cbe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260199,22 +258426,20 @@ rule DITEKSHEN_MALWARE_Win_Commonmagic : FILE
 		$ua2 = "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136" wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($p*) and 1 of ($s*)) or (1 of ($ua*) and 1 of ($s*) and 1 of ($p*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $p* ) and 1 of ( $s* ) ) or ( 1 of ( $ua* ) and 1 of ( $s* ) and 1 of ( $p* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Greetingghoul : FILE
 {
 	meta:
 		description = "Detects GreetingGhoul Cryptocurrency Infostealer"
 		author = "ditekSHen"
-		id = "42791b26-1cda-5bf3-b955-9de2dda1d63b"
+		id = "f8343072-f053-5511-a6cf-6bbe07bc004a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9662-L9679"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5a2635066df031ba6e291c3ba14f9ed85bf3247c82c66eb1b3d3618fdebb47a6"
+		logic_hash = "v1_sha256_5a2635066df031ba6e291c3ba14f9ed85bf3247c82c66eb1b3d3618fdebb47a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260232,22 +258457,20 @@ rule DITEKSHEN_MALWARE_Win_Greetingghoul : FILE
 		$s10 = "\\??\\%programdata%\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Multi_Family_Infostealer : FILE
 {
 	meta:
 		description = "Detects Prynt, WorldWind, DarkEye, Stealerium and ToxicEye / TelegramRAT infostealers"
 		author = "ditekSHen"
-		id = "960830ba-df0d-539d-be2a-7778229f79bd"
+		id = "6efb664a-867a-5ac5-acbd-d0b25bf61444"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9681-L9703"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0fdd1cdc4f2e5bee6c763e6e6b2e79d85285e44e2b5e3168a56d7d360252ee99"
+		logic_hash = "v1_sha256_0fdd1cdc4f2e5bee6c763e6e6b2e79d85285e44e2b5e3168a56d7d360252ee99"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -260270,22 +258493,20 @@ rule DITEKSHEN_MALWARE_Win_Multi_Family_Infostealer : FILE
 		$s9 = "### {0} ### ({1})" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Worldwind : FILE
 {
 	meta:
 		description = "Detects WorldWind infostealer"
 		author = "ditekSHen"
-		id = "226f591a-dc06-54f5-96ae-d142f624ff71"
+		id = "382f9037-e024-5ab0-ba48-2f5714b09a32"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9705-L9726"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9bb04fad460193cd877ea7f2de9337f69aadda01aee6c79f0a23cdf564b1e6c8"
+		logic_hash = "v1_sha256_9bb04fad460193cd877ea7f2de9337f69aadda01aee6c79f0a23cdf564b1e6c8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260307,22 +258528,20 @@ rule DITEKSHEN_MALWARE_Win_Worldwind : FILE
 		$s7 = "Bot connected" wide
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($c*) and (1 of ($x*) or 2 of ($m*) or 3 of ($s*))
+		uint16( 0 ) == 0x5a4d and 1 of ( $c* ) and ( 1 of ( $x* ) or 2 of ( $m* ) or 3 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Prynt : FILE
 {
 	meta:
 		description = "Detects Prynt infostealer"
 		author = "ditekSHen"
-		id = "844fd100-b04e-5ff0-9fab-d45f48b55bcc"
+		id = "7b699f87-47e6-5caf-8117-e15fceeb1cac"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9728-L9749"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "84f2b33285ab1d129a62940a02990639cc8f7c92d490d7257e6aed9170d1e34e"
+		logic_hash = "v1_sha256_84f2b33285ab1d129a62940a02990639cc8f7c92d490d7257e6aed9170d1e34e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260344,22 +258563,20 @@ rule DITEKSHEN_MALWARE_Win_Prynt : FILE
 		$s7 = "Bot connected" wide
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($c*) and (1 of ($x*) or 2 of ($m*) or 3 of ($s*))
+		uint16( 0 ) == 0x5a4d and 1 of ( $c* ) and ( 1 of ( $x* ) or 2 of ( $m* ) or 3 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Darkeye : FILE
 {
 	meta:
 		description = "Detects DarkEye infostealer"
 		author = "ditekSHen"
-		id = "5296fe28-b54e-5d0f-aa2f-2050db585d82"
+		id = "b5007fea-f65e-51ef-93a2-97a6acd52622"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9751-L9770"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5496dcbfe075a4030a446027765186e9dd1931561a29a481139281e1708ce87d"
+		logic_hash = "v1_sha256_5496dcbfe075a4030a446027765186e9dd1931561a29a481139281e1708ce87d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260379,22 +258596,20 @@ rule DITEKSHEN_MALWARE_Win_Darkeye : FILE
 		$s7 = "Bot connected" wide
 
 	condition:
-		uint16(0)==0x5a4d and not any of ($c*) and ((1 of ($x*) and 2 of ($s*)) or (4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and not any of ( $c* ) and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Invalidprinter : FILE
 {
 	meta:
 		description = "Invalid Printer (in2al5d p3in4er) Loader"
 		author = "ditekSHen"
-		id = "9b0a59e1-8105-5687-83b2-fb96229f59f9"
+		id = "0f900ea5-6616-5985-b529-55f048c94c73"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9772-L9782"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d14d53b2a73952244641f4e68a3dd5af8cb1e2bfc5936f300f9347b4881ceeb8"
+		logic_hash = "v1_sha256_d14d53b2a73952244641f4e68a3dd5af8cb1e2bfc5936f300f9347b4881ceeb8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260405,22 +258620,20 @@ rule DITEKSHEN_MALWARE_Win_Invalidprinter : FILE
 		$s2 = "CreateDXGIFactory" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <15000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Raccoonv2 : FILE
 {
 	meta:
 		description = "Detects Raccoon Stealer 2.0, also referred to as RecordBreaker"
 		author = "ditekSHen"
-		id = "2fc8313f-42f4-5b7e-8ae6-20455f736064"
+		id = "91e1d4d4-c564-5399-bedb-bb415e7c4fdb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9784-L9805"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d47bb9051923147010452bcd6e7c370c2ff9ea9095bcb920b64f69873b15ec16"
+		logic_hash = "v1_sha256_d47bb9051923147010452bcd6e7c370c2ff9ea9095bcb920b64f69873b15ec16"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -260442,22 +258655,20 @@ rule DITEKSHEN_MALWARE_Win_Raccoonv2 : FILE
 		$s6 = "Content-Type: application/x-object" fullword ascii
 
 	condition:
-		(( uint16(0)==0x5a4d and (4 of ($f*) or all of ($s*) or 7 of them )) or 10 of them )
+		(( uint16( 0 ) == 0x5a4d and ( 4 of ( $f* ) or all of ( $s* ) or 7 of them ) ) or 10 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Truebot : FILE
 {
 	meta:
 		description = "Detects TrueBot"
 		author = "ditekSHen"
-		id = "7210a0bd-d310-55bf-bb0c-14cadb59bd67"
+		id = "d6678818-42b9-57fc-b162-ea41cb0ecde6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9807-L9827"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a92141ef0aa7d68b3594a0f56c0370498fe5751a472c9011ac8b92ae46e88e53"
+		logic_hash = "v1_sha256_a92141ef0aa7d68b3594a0f56c0370498fe5751a472c9011ac8b92ae46e88e53"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260478,23 +258689,21 @@ rule DITEKSHEN_MALWARE_Win_Truebot : FILE
                 20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 }
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lummastealer : FILE
 {
 	meta:
 		description = "Detects Lumma Stealer"
 		author = "ditekSHen"
-		id = "b54521ab-4a31-5c1c-8ef2-b08b0f713693"
+		id = "d873fbfd-074c-5e29-9d2c-cd5c80ad525f"
 		date = "2034-02-17"
 		date = "2034-02-17"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9829-L9854"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "74014c5bcc85977b90faed93b348c34e47ee033b06c2f145348ca9c54c27bda5"
+		logic_hash = "v1_sha256_74014c5bcc85977b90faed93b348c34e47ee033b06c2f145348ca9c54c27bda5"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -260518,22 +258727,20 @@ rule DITEKSHEN_MALWARE_Win_Lummastealer : FILE
 		$s13 = "gapi-node.io" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 2 of ($s*)) or 5 of ($s*) or 7 of them )
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) or 5 of ( $s* ) or 7 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Clipbanker03 : FILE
 {
 	meta:
 		description = "Detects ClipBanker"
 		author = "ditekSHen"
-		id = "57ba7d33-eba4-5bc1-9893-5441e439b900"
+		id = "30a83628-6c02-5719-86d5-a7a6b8442501"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9884-L9904"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "29bbb833c9aecc18b398b8c0d80649994f4992277d1aa2ee4ae8e319b59125d5"
+		logic_hash = "v1_sha256_29bbb833c9aecc18b398b8c0d80649994f4992277d1aa2ee4ae8e319b59125d5"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -260554,22 +258761,20 @@ rule DITEKSHEN_MALWARE_Win_Clipbanker03 : FILE
 		$w5 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or all of ($w*) or 6 of them )
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or all of ( $w* ) or 6 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dotrunpex : FILE
 {
 	meta:
 		description = "Detects dotRunpeX injector"
 		author = "ditekSHen"
-		id = "4845edc1-110c-59a2-ace0-57a62b1e69e8"
+		id = "b71b4d4f-3461-5e60-abd0-b53d352c494c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9906-L9918"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d7f802f233b2b4ff2c250bb8e96649f307bbb3457c78004751401b3ea7f531a0"
+		logic_hash = "v1_sha256_d7f802f233b2b4ff2c250bb8e96649f307bbb3457c78004751401b3ea7f531a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260582,22 +258787,20 @@ rule DITEKSHEN_MALWARE_Win_Dotrunpex : FILE
 		$s5 = "Kernel32.Dll" wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cyberstealer : FILE
 {
 	meta:
 		description = "Detects CyberStealer infostealer"
 		author = "ditekSHen"
-		id = "cb02013f-ffb2-5a17-9d6e-1d19b0e98fb8"
+		id = "b3649f3a-b507-5c05-b130-c2aec64ecc88"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9920-L9941"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "72413b68fa1381656202165dcd878761727e7caf0f15ccd65f3f2f842243a1f6"
+		logic_hash = "v1_sha256_72413b68fa1381656202165dcd878761727e7caf0f15ccd65f3f2f842243a1f6"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -260619,22 +258822,20 @@ rule DITEKSHEN_MALWARE_Win_Cyberstealer : FILE
 		$r4 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (2 of ($s*) or 2 of ($r*))) or 7 of ($s*) or (5 of ($s*) and 2 of ($r*)) or ( all of ($r*) and 4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 2 of ( $s* ) or 2 of ( $r* ) ) ) or 7 of ( $s* ) or ( 5 of ( $s* ) and 2 of ( $r* ) ) or ( all of ( $r* ) and 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Arrowrat : FILE
 {
 	meta:
 		description = "Detects ArrowRAT"
 		author = "ditekSHen"
-		id = "14d3aabe-1ef5-599f-adbd-61b580099447"
+		id = "6f99047c-5979-5901-aa47-3ea5875fa1a1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9943-L9961"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "13e6d4fd274f75c50aa4110276812d02885c03cfc269dde480db66955e5f703a"
+		logic_hash = "v1_sha256_13e6d4fd274f75c50aa4110276812d02885c03cfc269dde480db66955e5f703a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260653,22 +258854,20 @@ rule DITEKSHEN_MALWARE_Win_Arrowrat : FILE
 		$s11 = "WinExec" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ducktail : FILE
 {
 	meta:
 		description = "Detects DuckTail"
 		author = "ditekSHen"
-		id = "2d1a8f9e-ed5f-53fa-8ba8-b6d1344f6d39"
+		id = "23e179fc-3ee7-564a-aae3-7cbd5c02e1fb"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9963-L9991"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a416212e5f87b33fdc14590c3d6d6ebc2915c2b383adf78d660c9408beb2323f"
+		logic_hash = "v1_sha256_a416212e5f87b33fdc14590c3d6d6ebc2915c2b383adf78d660c9408beb2323f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260697,22 +258896,20 @@ rule DITEKSHEN_MALWARE_Win_Ducktail : FILE
                52 00 7d 00 2e 00 6a 00 70 00 67 }
 
 	condition:
-		uint16(0)==0x5a4d and 13 of them
+		uint16( 0 ) == 0x5a4d and 13 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Grum : FILE
 {
 	meta:
 		description = "Detect Grum spam bot"
 		author = "ditekSHen"
-		id = "e9abaed1-f462-5099-b310-9f9244c0c8a2"
+		id = "dd4cbad0-2f2b-5354-bd86-e59cb95069ad"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9993-L10007"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "42a1d57dcddda4a24037af136caace6110b90ee5702c7c01d2a77d2676048c74"
+		logic_hash = "v1_sha256_42a1d57dcddda4a24037af136caace6110b90ee5702c7c01d2a77d2676048c74"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -260727,22 +258924,20 @@ rule DITEKSHEN_MALWARE_Win_Grum : FILE
 		$s7 = "%OUTLOOK_BND_" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 5 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and 5 of them ) or ( all of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Dlinjector07 : FILE
 {
 	meta:
 		description = "Detects downloader injector"
 		author = "ditekSHen"
-		id = "244ad6fb-8769-5b57-84e2-66f51fccb32a"
+		id = "b1ed6a3c-e448-560c-be36-c3a70bd57d7e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10009-L10025"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "aef43b59ef7d0d62a853280ec1588a48d6c21da5218b7fd7e6ab1aa0f048896b"
+		logic_hash = "v1_sha256_aef43b59ef7d0d62a853280ec1588a48d6c21da5218b7fd7e6ab1aa0f048896b"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -260759,22 +258954,20 @@ rule DITEKSHEN_MALWARE_Win_Dlinjector07 : FILE
 		$s3 = "_ENABLE_PROFILING" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or (1 of ($l*) and 2 of ($r*)) or 6 of them )
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( 1 of ( $l* ) and 2 of ( $r* ) ) or 6 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Stealerium : FILE
 {
 	meta:
 		description = "Detects Stealerium infostealer"
 		author = "ditekSHen"
-		id = "ea137900-3add-54b4-9ce9-bc7e98f86d41"
+		id = "abd128ee-1dcd-58d9-aa48-4ad0e80149c3"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10027-L10042"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a2834e7fe26ad0197a9e490ab517029ceed2e09506fcc37e6ddf0c1804fa6cb9"
+		logic_hash = "v1_sha256_a2834e7fe26ad0197a9e490ab517029ceed2e09506fcc37e6ddf0c1804fa6cb9"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -260790,22 +258983,20 @@ rule DITEKSHEN_MALWARE_Win_Stealerium : FILE
 		$s5 = " *Keylogger " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (2 of ($x*) and all of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 2 of ( $x* ) and all of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Gobrat : FILE
 {
 	meta:
 		description = "Detects GobRAT"
 		author = "ditekSHen"
-		id = "0561fa99-24ee-5e02-ba54-17a1dd81daa4"
+		id = "ffd2548b-2ad4-5a7c-8686-11eb1fde7604"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10044-L10062"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "070687c909b066e38f72b6421b77670e87476d7e1eb1ed8d41d027836629eb71"
+		logic_hash = "v1_sha256_070687c909b066e38f72b6421b77670e87476d7e1eb1ed8d41d027836629eb71"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260824,22 +259015,20 @@ rule DITEKSHEN_MALWARE_Linux_Gobrat : FILE
 		$s7 = ".SimpleCommand" ascii
 
 	condition:
-		uint16(0)==0x457f and (3 of ($x*) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or all of ($s*))
+		uint16( 0 ) == 0x457f and ( 3 of ( $x* ) or ( 2 of ( $x* ) and 3 of ( $s* ) ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) or all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Hakunamatata : FILE
 {
 	meta:
 		description = "Detects HakunaMatata ransomware"
 		author = "ditekSHen"
-		id = "43ca40bb-9eb6-558e-977d-f1fff5659565"
+		id = "e4690b4b-2dc1-5a1c-b10a-66c61d8b430c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10064-L10084"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b49705845e5440c3c1e47e196592ca2b31319d1af5265f2f954d3367e3d39d5c"
+		logic_hash = "v1_sha256_b49705845e5440c3c1e47e196592ca2b31319d1af5265f2f954d3367e3d39d5c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260860,22 +259049,20 @@ rule DITEKSHEN_MALWARE_Win_Hakunamatata : FILE
 		$s13 = "<RECURSIVE_DIRECTORY_LOOK>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Hakunamatata_Builder : FILE
 {
 	meta:
 		description = "Detects HakunaMatata ransomware builder"
 		author = "ditekSHen"
-		id = "dbf3490f-418c-5d3b-9f9e-e9fb29d8b652"
+		id = "30aa1fae-21a2-5ede-a140-c9276fa49395"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10086-L10104"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ac258851de38504cf63ba51fd06f8a9a3dfbe0096d199ba702e9763b5ecc43e4"
+		logic_hash = "v1_sha256_ac258851de38504cf63ba51fd06f8a9a3dfbe0096d199ba702e9763b5ecc43e4"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -260894,22 +259081,20 @@ rule DITEKSHEN_MALWARE_Win_Hakunamatata_Builder : FILE
 		$s11 = /\\obj\\(Debug|Release)\\Hakuna\sMatata\.pdb/ ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Twarbot : FILE
 {
 	meta:
 		description = "Detect TWarBot IRC Bot"
 		author = "ditekSHen"
-		id = "3acae103-c8d8-5959-83fd-f47d33da350b"
+		id = "44371e45-0e2a-578b-a2e6-23cfa141ef78"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10106-L10121"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6b1b0b92d2ea7adec58a4b0ac712384542d96dc8707b6f1f13df2d8150a03a7a"
+		logic_hash = "v1_sha256_6b1b0b92d2ea7adec58a4b0ac712384542d96dc8707b6f1f13df2d8150a03a7a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -260925,22 +259110,20 @@ rule DITEKSHEN_MALWARE_Win_Twarbot : FILE
 		$s7 = "a -idp -inul -c- -m5" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_G0Crypt : FILE
 {
 	meta:
 		description = "Detects G0Crypt / BRG0SNet / NovaGP ransomware"
 		author = "ditekSHen"
-		id = "c0dd8a1b-1aa6-50be-92c4-125eabaf3f9f"
+		id = "5a39fcdf-16bb-54dc-809b-e5d4270ed9d8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10123-L10156"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a678bbb02b82c34fb5e7bdce2e60b0da88f12b094e7ca3b74345814d0da5ce42"
+		logic_hash = "v1_sha256_a678bbb02b82c34fb5e7bdce2e60b0da88f12b094e7ca3b74345814d0da5ce42"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -260974,22 +259157,20 @@ rule DITEKSHEN_MALWARE_Win_G0Crypt : FILE
 		$s9 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v DelLogSoft /t REG_SZ /d"
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 7 of ($f*) or (1 of ($x*) and (5 of ($f*) or 5 of ($s*))) or (6 of ($f*) and 4 of ($s*)) or 12 of them )
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 7 of ( $f* ) or ( 1 of ( $x* ) and ( 5 of ( $f* ) or 5 of ( $s* ) ) ) or ( 6 of ( $f* ) and 4 of ( $s* ) ) or 12 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Akira : FILE
 {
 	meta:
 		description = "Detects Akira Ransomware Windows"
 		author = "ditekSHen"
-		id = "350ecf81-7926-5cd2-b0c8-2dd748775e74"
+		id = "faff6fc2-d96f-55c6-8b78-f56e0f16ccd5"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10220-L10243"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "73dd0a1b21be8ff7362536f6b6255cd19510632782effd67a56d7656bebf04ff"
+		logic_hash = "v1_sha256_73dd0a1b21be8ff7362536f6b6255cd19510632782effd67a56d7656bebf04ff"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261013,22 +259194,20 @@ rule DITEKSHEN_MALWARE_Win_Akira : FILE
 		$s11 = "-fork" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and 4 of ($s*)) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or 6 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Akira : FILE
 {
 	meta:
 		description = "Detects Akira Ransomware Linux"
 		author = "ditekSHen"
-		id = "3ac144b3-c747-58e5-bc75-b3f90786f404"
+		id = "4d223613-28cb-5bcc-84ba-c8944356073b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10245-L10264"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3a00154e1cfc442718e753641d3706ffd4dd8465525d0bb2854f74dfb1cf5dd0"
+		logic_hash = "v1_sha256_3a00154e1cfc442718e753641d3706ffd4dd8465525d0bb2854f74dfb1cf5dd0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261048,7 +259227,7 @@ rule DITEKSHEN_MALWARE_Linux_Akira : FILE
 		$s8 = "-fork" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and (3 of ($x*) or (1 of ($x*) and 4 of ($s*)) or 6 of ($s*))
+		uint16( 0 ) == 0x457f and ( 3 of ( $x* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or 6 of ( $s* ) )
 }
 import "pe"
 
@@ -261057,19 +259236,19 @@ rule DITEKSHEN_MALWARE_Win_Romcom_Loader : FILE
 	meta:
 		description = "Hunt for RomCom loader"
 		author = "ditekShen"
-		id = "49a5398a-e28d-51e2-90d5-479d815f9967"
+		id = "0795798f-b44d-5fb8-8ac4-0bd3fc1abc91"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10291-L10307"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7aef88aa9f201c3a1852d63b17c14e44c7c2a7dfe94a9bc77897a4aa0eb97486"
+		logic_hash = "v1_sha256_7aef88aa9f201c3a1852d63b17c14e44c7c2a7dfe94a9bc77897a4aa0eb97486"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and (pe.exports("DllCanUnloadNow") and pe.exports("DllGetClassObject") and pe.exports("DllRegisterServer") and pe.exports("DllUnregisterServer") and pe.exports("GetProxyDllInfo")) and for any fn in pe.export_details : (fn.forward_name contains "Dll")
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and ( pe.exports ( "DllCanUnloadNow" ) and pe.exports ( "DllGetClassObject" ) and pe.exports ( "DllRegisterServer" ) and pe.exports ( "DllUnregisterServer" ) and pe.exports ( "GetProxyDllInfo" ) ) and for any fn in pe.export_details : ( fn.forward_name contains "Dll" )
 }
 import "pe"
 
@@ -261078,13 +259257,13 @@ rule DITEKSHEN_MALWARE_Win_Romcom_Worker : FILE
 	meta:
 		description = "Hunt for RomCom worker"
 		author = "ditekShen"
-		id = "ce545a33-731c-5ecd-b02e-cedf24f75cc7"
+		id = "acddee72-6df8-562f-b109-f789460a7931"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10309-L10322"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "488db046458585882a4709438042b57e02d7dbc06483fdfdfc463a64ee8db203"
+		logic_hash = "v1_sha256_488db046458585882a4709438042b57e02d7dbc06483fdfdfc463a64ee8db203"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -261098,7 +259277,7 @@ rule DITEKSHEN_MALWARE_Win_Romcom_Worker : FILE
 		$s6 = "PeekNamedPipe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.number_of_exports==1 and pe.exports("Main") and all of them
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and pe.number_of_exports == 1 and pe.exports ( "Main" ) and all of them
 }
 import "pe"
 
@@ -261107,13 +259286,13 @@ rule DITEKSHEN_MALWARE_Win_Romcom_Dropper : FILE
 	meta:
 		description = "Hunt for RomCom worker"
 		author = "ditekShen"
-		id = "1b77122d-95d7-535d-897e-b542da17f499"
+		id = "0426a1ef-0e13-5dad-8fa3-54b945c3e826"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10324-L10335"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "89f62f71e5870c1e5d14bc32dd3508da620f5fa85494251c69682eb09d630029"
+		logic_hash = "v1_sha256_89f62f71e5870c1e5d14bc32dd3508da620f5fa85494251c69682eb09d630029"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261125,7 +259304,7 @@ rule DITEKSHEN_MALWARE_Win_Romcom_Dropper : FILE
 		$s4 = "POST" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.number_of_exports==1 and pe.exports("Main") and 3 of them
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and pe.number_of_exports == 1 and pe.exports ( "Main" ) and 3 of them
 }
 import "pe"
 
@@ -261134,13 +259313,13 @@ rule DITEKSHEN_MALWARE_Win_STEALDEAL : FILE
 	meta:
 		description = "Hunt for STEALDEAL stealer"
 		author = "ditekShen"
-		id = "4685fea3-4050-5395-af2b-cb0ba4104b47"
+		id = "c1f24dc3-807c-5a35-8968-9a3fd4a164ed"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10337-L10348"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "366c33b06ed9403b2b840d98e25287333eb52f2588f747981b3c0c3baf4fd27a"
+		logic_hash = "v1_sha256_366c33b06ed9403b2b840d98e25287333eb52f2588f747981b3c0c3baf4fd27a"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -261152,22 +259331,20 @@ rule DITEKSHEN_MALWARE_Win_STEALDEAL : FILE
 		$s3 = "SUBQUERY %u" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.exports("stub") and (1 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and pe.exports ( "stub" ) and ( 1 of ( $x* ) or all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Darkcloud : FILE
 {
 	meta:
 		description = "Detects DarkCloud infostealer"
 		author = "ditekSHen"
-		id = "e29e1dc7-87b8-5d6b-b73b-460dc2530875"
+		id = "e20841f2-deda-5d9c-8650-d107205cbd90"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10350-L10371"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7826cc4185d6edb760d062019e0fa30f800c34e5fb4b0eedcfb17081e6c7643d"
+		logic_hash = "v1_sha256_7826cc4185d6edb760d062019e0fa30f800c34e5fb4b0eedcfb17081e6c7643d"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -261189,22 +259366,20 @@ rule DITEKSHEN_MALWARE_Win_Darkcloud : FILE
 		$i6 = "\\163MailContacts.txt" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($i*))) or ( all of ($s*) and 1 of ($i*)) or (4 of ($s*) and 4 of ($i*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 3 of ( $s* ) or 3 of ( $i* ) ) ) or ( all of ( $s* ) and 1 of ( $i* ) ) or ( 4 of ( $s* ) and 4 of ( $i* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Arcrypt : FILE
 {
 	meta:
 		description = "Detects ARCrypt / ChileLocker ransomware"
 		author = "ditekSHen"
-		id = "a53bbae6-a321-549d-9d45-e1a408d08740"
+		id = "b4f3a9f8-ee79-519a-9a8f-089f992073d4"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10373-L10399"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cc9fa68d093fdf9745a06beb28e29108cb2ba846122ce097ad892213b1edba25"
+		logic_hash = "v1_sha256_cc9fa68d093fdf9745a06beb28e29108cb2ba846122ce097ad892213b1edba25"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261231,22 +259406,20 @@ rule DITEKSHEN_MALWARE_Win_Arcrypt : FILE
 		$s9 = "RemotePath" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($c*) or 7 of ($s*) or (3 of ($c*) and 4 of ($s*)) or (1 of ($e*) and (1 of ($c*) and 1 of ($s*))) or ( all of ($e*) and (1 of ($c*) or 1 of ($s*))))
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $c* ) or 7 of ( $s* ) or ( 3 of ( $c* ) and 4 of ( $s* ) ) or ( 1 of ( $e* ) and ( 1 of ( $c* ) and 1 of ( $s* ) ) ) or ( all of ( $e* ) and ( 1 of ( $c* ) or 1 of ( $s* ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Rootteamstealer : FILE
 {
 	meta:
 		description = "Detects RootTeam infostealer"
 		author = "ditekSHen"
-		id = "3b57ff3e-09cf-52be-ac7f-45ee832d70ab"
+		id = "6f09eaac-1992-5249-be7b-58efc0f78f85"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10401-L10417"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d1693865253067527d58c980653d550b55d022d5a394b88090a958e5d5818143"
+		logic_hash = "v1_sha256_d1693865253067527d58c980653d550b55d022d5a394b88090a958e5d5818143"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261263,22 +259436,20 @@ rule DITEKSHEN_MALWARE_Win_Rootteamstealer : FILE
 		$s5 = /RootTeamStl\/managers\/(browser|coldwallets|discord|filegrabber|steam|userinformation)?/ ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and 3 of ($s*)) or 4 of ($s*) or 5 of them )
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or 4 of ( $s* ) or 5 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Espioloader : FILE
 {
 	meta:
 		description = "Detects Espio loader and obfuscator"
 		author = "ditekSHen"
-		id = "fb2be984-abd6-5f71-b448-d41c9c3e35c5"
+		id = "a095b81d-4ce2-5a63-83ff-6bc4ee1e561d"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10438-L10451"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8ad77a50db48f12e6f6465652b24fc1daa56375bb27e37e0eead1bea55b89e0c"
+		logic_hash = "v1_sha256_8ad77a50db48f12e6f6465652b24fc1daa56375bb27e37e0eead1bea55b89e0c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261292,22 +259463,20 @@ rule DITEKSHEN_MALWARE_Win_Espioloader : FILE
 		$s4 = "C:\\windows\\system32\\ntdll.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($pdb or 3 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( $pdb or 3 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Celestybinderloader : FILE
 {
 	meta:
 		description = "Detects Celesty Binder loader"
 		author = "ditekSHen"
-		id = "9c3404b7-311c-565d-b0fa-cfa80ba97289"
+		id = "f2cc6c9c-dc47-5499-b192-cec4c9877883"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10453-L10466"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8c9ffd48c9c8cd345dccfb48bcb345282f9978f7cf906a61e2ea81c48486b16d"
+		logic_hash = "v1_sha256_8c9ffd48c9c8cd345dccfb48bcb345282f9978f7cf906a61e2ea81c48486b16d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261321,22 +259490,20 @@ rule DITEKSHEN_MALWARE_Win_Celestybinderloader : FILE
 		$s6 = "%USERDIR%" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Blitzgrabber : FILE
 {
 	meta:
 		description = "Detects BlitzGrabber infostealer"
 		author = "ditekSHen"
-		id = "4240527e-c2f8-5424-986a-c1616fafb9bb"
+		id = "176415eb-58fd-5e6d-8029-bd24eb849f7a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10468-L10487"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8baceacf3c2af61e00b31e8106820b6f1ce2e7a9d98eaed965e698109ae08314"
+		logic_hash = "v1_sha256_8baceacf3c2af61e00b31e8106820b6f1ce2e7a9d98eaed965e698109ae08314"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -261356,22 +259523,20 @@ rule DITEKSHEN_MALWARE_Win_Blitzgrabber : FILE
 		$s9 = ".UploadFile(\"https://api.anonfiles.com/upload\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) and 3 of ($s*)) or (7 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) and 3 of ( $s* ) ) or ( 7 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Bagle : FILE
 {
 	meta:
 		description = "Detect Bagle / Beagle email worm"
 		author = "ditekSHen"
-		id = "32632bdf-6cf5-5542-8e1f-70686139a465"
+		id = "34e0cdbe-930b-5ef2-8b6d-be517682c1a1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10489-L10505"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4c3a09f10c792de1ab25001da29ea2fee84c583d49d9a5225817644aabde2dea"
+		logic_hash = "v1_sha256_4c3a09f10c792de1ab25001da29ea2fee84c583d49d9a5225817644aabde2dea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261388,22 +259553,20 @@ rule DITEKSHEN_MALWARE_Win_Bagle : FILE
 		$s9 = "http://www.%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ragestealer : FILE
 {
 	meta:
 		description = "Detect Rage / Priv8 infostealer"
 		author = "ditekShen"
-		id = "dfc1abaa-d975-5e6a-ad4d-344031b0c40c"
+		id = "915ab3c4-a79c-536a-bf25-0c2352838d44"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10507-L10522"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a26b86845bcd62d4a360a8dae9cfa56b5d96ebc521f224c18a01cc0a2bd958e9"
+		logic_hash = "v1_sha256_a26b86845bcd62d4a360a8dae9cfa56b5d96ebc521f224c18a01cc0a2bd958e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261419,22 +259582,20 @@ rule DITEKSHEN_MALWARE_Win_Ragestealer : FILE
 		$s6 = "snder" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) and 4 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) and 4 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Abubasbanditbot : FILE
 {
 	meta:
 		description = "Detects Abubasbandit Bot. Observed to drop cryptocurrency miner detected by MALWARE_Win_CoinMiner02"
 		author = "ditekSHen"
-		id = "8bedd1f7-bd77-5f26-8665-1d23fe56100f"
+		id = "1afe52bc-a9b7-5003-82ef-ae3671deb01f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10524-L10541"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "aae40178dadff720b42d211a025fd696eabdcc91761c6a91809f5f088c588c31"
+		logic_hash = "v1_sha256_aae40178dadff720b42d211a025fd696eabdcc91761c6a91809f5f088c588c31"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261452,22 +259613,20 @@ rule DITEKSHEN_MALWARE_Win_Abubasbanditbot : FILE
 		$s5 = "temp_file.bin" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (4 of ($x*) and 2 of ($s*)) or (( all of ($s*) and 3 of ($x*))) or (8 of them ))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 4 of ( $x* ) and 2 of ( $s* ) ) or ( ( all of ( $s* ) and 3 of ( $x* ) ) ) or ( 8 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Oracrat : FILE
 {
 	meta:
 		description = "Detects OracRAT / Comfoo / Babar"
 		author = "ditekSHen"
-		id = "53f3778e-56d5-5390-8ce7-82d4ede46be4"
+		id = "f015118e-8356-5713-938d-f9285592cce1"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10543-L10557"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "078a5df9f3d0bb8213ea2fe28eefdb453ef186e6c1f62d3ba10cb04fca047700"
+		logic_hash = "v1_sha256_078a5df9f3d0bb8213ea2fe28eefdb453ef186e6c1f62d3ba10cb04fca047700"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261482,22 +259641,20 @@ rule DITEKSHEN_MALWARE_Win_Oracrat : FILE
 		$s7 = "userctfm" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Phemedronestealer : FILE
 {
 	meta:
 		description = "Detects Phemedrone Stealer infostealer"
 		author = "ditekSHen"
-		id = "297aab1f-351c-5955-8a19-9aa2b7c94748"
+		id = "84eb7a18-ac4e-596e-9271-02e9d4307b46"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10559-L10580"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "74e150cc971f5648f9e3f6146afba162b1a29cf2744c862b2320db52c2efa930"
+		logic_hash = "v1_sha256_74e150cc971f5648f9e3f6146afba162b1a29cf2744c862b2320db52c2efa930"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261519,22 +259676,20 @@ rule DITEKSHEN_MALWARE_Win_Phemedronestealer : FILE
 		$s9 = "rgsFilenames" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($p*) and 3 of ($s*)) or (3 of ($p*) and 4 of ($s*)) or (7 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $p* ) and 3 of ( $s* ) ) or ( 3 of ( $p* ) and 4 of ( $s* ) ) or ( 7 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_WSHRAT : FILE
 {
 	meta:
 		description = "Detects WASHRAT"
 		author = "ditekSHen"
-		id = "e7940b7f-51dd-5a32-899b-64310f27bf3e"
+		id = "5e49a1d7-6ac2-585c-9447-96d95a19097b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10582-L10600"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "297bfe65815637a464e2a8fc23570c6e79694ffe0467d5898b7c845f1450de95"
+		logic_hash = "v1_sha256_297bfe65815637a464e2a8fc23570c6e79694ffe0467d5898b7c845f1450de95"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -261553,22 +259708,20 @@ rule DITEKSHEN_MALWARE_Win_WSHRAT : FILE
 		$s7 = /(rdp|keylogger|get-pass|uvnc)\|http/ wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 1 of ($s*)) or (6 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and 1 of ( $s* ) ) or ( 6 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Rustystealer : FILE
 {
 	meta:
 		description = "Detect Rusty / Luca stealer"
 		author = "ditekSHen"
-		id = "af39f88c-e0df-51f6-bb11-f3a7231180d0"
+		id = "bc02845d-ee99-5c0a-8ffe-2b0b708f3eac"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10602-L10625"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e60e66360c8f97a31e75cd90a12519f75f3a672874fc985a8da1d4d02e185b4d"
+		logic_hash = "v1_sha256_e60e66360c8f97a31e75cd90a12519f75f3a672874fc985a8da1d4d02e185b4d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261592,22 +259745,20 @@ rule DITEKSHEN_MALWARE_Win_Rustystealer : FILE
 		$s16 = "AutoFill@~" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Simplepacker : FILE
 {
 	meta:
 		description = "Detects Hydrochasma packer / dropper"
 		author = "ditekSHen"
-		id = "449f7531-408f-5bda-aa64-d148c363c3e5"
+		id = "42b711f1-9e9e-5ed4-ae42-77d04e43bd5f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10627-L10638"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e2c07947fdf53814669250052f6cceb7412aa302422f3a0b430879da638c7e6a"
+		logic_hash = "v1_sha256_e2c07947fdf53814669250052f6cceb7412aa302422f3a0b430879da638c7e6a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261619,22 +259770,20 @@ rule DITEKSHEN_MALWARE_Win_Simplepacker : FILE
 		$s2 = "None{\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($p*) or (1 of ($p*) and all of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $p* ) or ( 1 of ( $p* ) and all of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Multi_Golangbypassav : FILE
 {
 	meta:
 		description = "Detect Go executables using GolangBypassAV"
 		author = "ditekSHen"
-		id = "bd41ff7e-ce57-5bee-b6ca-9341b4c1c1fa"
+		id = "20c38022-fa20-5caf-89ae-2948a810ff38"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10679-L10689"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "842dfc7c04cbd19bbbc8b6fbf9d9925f81a21dfb713af4542ca4157d64fa5b51"
+		logic_hash = "v1_sha256_842dfc7c04cbd19bbbc8b6fbf9d9925f81a21dfb713af4542ca4157d64fa5b51"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261645,22 +259794,20 @@ rule DITEKSHEN_MALWARE_Multi_Golangbypassav : FILE
 		$s1 = "/GolangBypassAV/gen/" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 1 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and 1 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Blankstealer : FILE
 {
 	meta:
 		description = "Detects BlankStealer / BlankGrabber / Blank-c Stealer"
 		author = "ditekSHen"
-		id = "19686781-4be8-56c1-b606-d8fe14dbdc48"
+		id = "ef756d6c-d327-5d92-904f-573a8f97c759"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10691-L10703"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cc0c8d3e0061d192e445ef661387360644ab428a9e9fc2480e966db96bc8264c"
+		logic_hash = "v1_sha256_cc0c8d3e0061d192e445ef661387360644ab428a9e9fc2480e966db96bc8264c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261673,22 +259820,20 @@ rule DITEKSHEN_MALWARE_Win_Blankstealer : FILE
 		$h1 = { 42 6c 61 6e 6b 2d 63 0a 53 74 65 61 6c 65 72 20 4c 69 63 65 6e 73 65 0a 55 49 44 3d }
 
 	condition:
-		( uint16(0)==0x4152 and 2 of them ) or ( all of ($s*) or 1 of ($h*))
+		( uint16( 0 ) == 0x4152 and 2 of them ) or ( all of ( $s* ) or 1 of ( $h* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Linux_Getshell : FILE
 {
 	meta:
 		description = "Detect GetShell Linux backdoor"
 		author = "ditekSHen"
-		id = "cccad93d-cd49-5237-96ac-66c9ac6ef532"
+		id = "121e1b29-f3e7-5d4d-ae48-5f2969b0ff6f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10705-L10725"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9d44ad2a3c270eed0e905402e8c32dcca54da90f4229d9d59874ee09b3b47277"
+		logic_hash = "v1_sha256_9d44ad2a3c270eed0e905402e8c32dcca54da90f4229d9d59874ee09b3b47277"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261709,22 +259854,20 @@ rule DITEKSHEN_MALWARE_Linux_Getshell : FILE
 		$s10 = "bc_connect" ascii
 
 	condition:
-		uint16(0)==0x457f and (( all of ($x*) and 1 of ($s*)) or 5 of ($s*))
+		uint16( 0 ) == 0x457f and ( ( all of ( $x* ) and 1 of ( $s* ) ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Solarmarker : FILE
 {
 	meta:
 		description = "Detects SolarMarker"
 		author = "ditekSHen"
-		id = "78c2f739-76b2-5a80-8b9a-6c677d578eaa"
+		id = "5aaa7877-d6e8-59c7-9125-80eeb35e026b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10727-L10745"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "84182c8948c2f40439cd932885ae8b88bb677ecc9fba366f22d30e13dc4ffb68"
+		logic_hash = "v1_sha256_84182c8948c2f40439cd932885ae8b88bb677ecc9fba366f22d30e13dc4ffb68"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261743,22 +259886,20 @@ rule DITEKSHEN_MALWARE_Win_Solarmarker : FILE
 		$s7 = "<set>b__1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) and 4 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) and 4 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWRE_Win_Darkgate : FILE
 {
 	meta:
 		description = "Detects DarkGate infostealer and coinminer"
 		author = "ditekSHen"
-		id = "4488e1e6-daac-5832-8326-3151c834daf1"
+		id = "7cca6074-8aaf-5e91-8c5b-364879a57b30"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10747-L10771"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "805a04bbb3915d539e76927393384a2786c25490e8b9fc151d5b12415247578b"
+		logic_hash = "v1_sha256_805a04bbb3915d539e76927393384a2786c25490e8b9fc151d5b12415247578b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261783,22 +259924,20 @@ rule DITEKSHEN_MALWRE_Win_Darkgate : FILE
 		$s13 = /Stub: (WARNING:|Configuration updated:|Global Ping Invoked)/ ascii
 
 	condition:
-		( uint16(0)==0x5a4d and ((3 of ($x*)) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or (6 of ($s*)))) or (10 of them )
+		( uint16( 0 ) == 0x5a4d and ( ( 3 of ( $x* ) ) or ( 2 of ( $x* ) and 3 of ( $s* ) ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) or ( 6 of ( $s* ) ) ) ) or ( 10 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Rookie_Downloader : FILE
 {
 	meta:
 		description = "Detect malware downlaoder, variant of ZombieBoy downloader"
 		author = "ditekSHen"
-		id = "a991eecb-5275-5e33-bea4-e709590474a8"
+		id = "cc287ec0-4d5d-515b-9888-115400af433c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10773-L10786"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6d5625c2cd7e3a51c2fce9948e691ff2d1b7cf85083708790f89e15c6522059b"
+		logic_hash = "v1_sha256_6d5625c2cd7e3a51c2fce9948e691ff2d1b7cf85083708790f89e15c6522059b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261812,22 +259951,20 @@ rule DITEKSHEN_MALWARE_Win_Rookie_Downloader : FILE
 		$s5 = "#32770" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Fiber : FILE
 {
 	meta:
 		description = "Detects Fiber .NET injector"
 		author = "ditekSHen"
-		id = "0e562e2e-cb91-5acf-bb8f-5e7e7d971a3d"
+		id = "3c0295ff-b7aa-5940-b1dd-7fca01e37c11"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10788-L10824"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bd6c2c02272fe59c8d7de533197f15d94b5532d32875f01e3e4bd52506456a34"
+		logic_hash = "v1_sha256_bd6c2c02272fe59c8d7de533197f15d94b5532d32875f01e3e4bd52506456a34"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261864,22 +260001,20 @@ rule DITEKSHEN_MALWARE_Win_Fiber : FILE
                 65 00 72 00 6e 00 65 00 6c }
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*) and 2 of ($i*)) or (4 of ($s*) and 4 of ($i*)) or (2 of ($s*) and 6 of ($i*)) or (1 of ($x*) and 3 of ($v*)) or ( all of ($v*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) and 2 of ( $i* ) ) or ( 4 of ( $s* ) and 4 of ( $i* ) ) or ( 2 of ( $s* ) and 6 of ( $i* ) ) or ( 1 of ( $x* ) and 3 of ( $v* ) ) or ( all of ( $v* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Unknown_Packedloader_01 : FILE
 {
 	meta:
 		description = "Detects unknown loader / packer. Observed running LummaStealer"
 		author = "ditekShen"
-		id = "2969090f-dff9-5745-b87d-a031741dd2e0"
+		id = "d34ec7d7-ecd2-59ba-a1b4-e8a48b24067a"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10826-L10845"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6fd9075793b55e04c68bb13d21b88741889a9c37a0a9d1a19d895c7b68af4506"
+		logic_hash = "v1_sha256_6fd9075793b55e04c68bb13d21b88741889a9c37a0a9d1a19d895c7b68af4506"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261899,22 +260034,20 @@ rule DITEKSHEN_MALWARE_Win_Unknown_Packedloader_01 : FILE
 		$s12 = "GetAdaptersInfo" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 11 of them
+		uint16( 0 ) == 0x5a4d and 11 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_LOLKEK : FILE
 {
 	meta:
 		description = "Detects LOLKEK / GlobeImposter ransowmare"
 		author = "ditekShen"
-		id = "96374c8d-2ef7-5706-a96f-27d60f73f8c1"
+		id = "f438ea67-fa7a-579a-a507-8776390d1a31"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10847-L10864"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "047492f8b7b56c75cfdcc4359de2b02a76cf9591b902171785806987e552995a"
+		logic_hash = "v1_sha256_047492f8b7b56c75cfdcc4359de2b02a76cf9591b902171785806987e552995a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261932,22 +260065,20 @@ rule DITEKSHEN_MALWARE_Win_LOLKEK : FILE
 		$s10 = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Spacecolon : FILE
 {
 	meta:
 		description = "Detects Spacecolon ransomware"
 		author = "ditekSHen"
-		id = "38bde0b6-96a3-5081-b152-c251d7a2ffac"
+		id = "67a4d881-d02c-5c78-90e9-777ab14c0349"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10866-L10886"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d6e55c45f9df98bc152dadc1ba0953b4b89b5a503af0fc5ba53e12a1aa4f6d28"
+		logic_hash = "v1_sha256_d6e55c45f9df98bc152dadc1ba0953b4b89b5a503af0fc5ba53e12a1aa4f6d28"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -261968,22 +260099,20 @@ rule DITEKSHEN_MALWARE_Win_Spacecolon : FILE
 		$s13 = "tufhackteam@gmail.com" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16( 0 ) == 0x5a4d and 8 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Rhysida : FILE
 {
 	meta:
 		description = "Detects Rhysida ransomware"
 		author = "ditekSHen"
-		id = "a70bdf19-3b56-5dc0-be74-20a2e85099cc"
+		id = "ce65ee97-0638-5846-b557-92ee73b27120"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10888-L10902"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fb15f497cdee40b237dfc2aafcde2da95ff2a6f9c162273862ec1a0053269932"
+		logic_hash = "v1_sha256_fb15f497cdee40b237dfc2aafcde2da95ff2a6f9c162273862ec1a0053269932"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -261998,22 +260127,20 @@ rule DITEKSHEN_MALWARE_Win_Rhysida : FILE
 		$s7 = "Rhysida-" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of ($s*) or (3 of ($s*) and #s1>5)
+		uint16( 0 ) == 0x5a4d and 5 of ( $s* ) or ( 3 of ( $s* ) and #s1 > 5 )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Povertystealer : FILE
 {
 	meta:
 		description = "Detects PovertyStealer"
 		author = "ditekSHen"
-		id = "a431b82a-81cb-51a9-b3a8-61d71f36a60e"
+		id = "5db1e646-f0ca-523e-a020-3ec71d5be5c6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10904-L10917"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0d8a4dd1f3a9935935878840d19e16d91d240da776f99eb2dd3f12df96efa1d9"
+		logic_hash = "v1_sha256_0d8a4dd1f3a9935935878840d19e16d91d240da776f99eb2dd3f12df96efa1d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262027,22 +260154,20 @@ rule DITEKSHEN_MALWARE_Win_Povertystealer : FILE
 		$s5 = "$d.log" fullword wide
 
 	condition:
-		(( uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))) or all of them )
+		(( uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $s* ) ) ) or all of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Janelarat : FILE
 {
 	meta:
 		description = "Detects JanelaRAT"
 		author = "ditekSHen"
-		id = "6a49eeda-307f-5429-aa24-658223360239"
+		id = "774871a2-e71d-5253-899a-41045344235f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10919-L10939"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9f10112b6ffa382b03511e7b6c8757438d5910ee2c24d650d05bb53abfff3860"
+		logic_hash = "v1_sha256_9f10112b6ffa382b03511e7b6c8757438d5910ee2c24d650d05bb53abfff3860"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262063,22 +260188,20 @@ rule DITEKSHEN_MALWARE_Win_Janelarat : FILE
 		$s10 = "VisaoAPP" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or (6 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 2 of ( $x* ) and 3 of ( $s* ) ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) or ( 6 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Qwixxrat : FILE
 {
 	meta:
 		description = "Detects QwixxRAT. Uses ToxicEye / TelegramRAT as base (MALWARE_Win_TelegramRAT)"
 		author = "ditekSHen"
-		id = "0a8f2f6f-aa78-56c2-aca0-d575fbf0b91e"
+		id = "3cb717a4-9db3-51ac-a68a-82a939739bf9"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10941-L10953"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e6e44697e393da35215f7835f122cb74b05dbeebb558345d5110d6fbc809f4dd"
+		logic_hash = "v1_sha256_e6e44697e393da35215f7835f122cb74b05dbeebb558345d5110d6fbc809f4dd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262091,22 +260214,20 @@ rule DITEKSHEN_MALWARE_Win_Qwixxrat : FILE
 		$s5 = "\\Qwixx Rat\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16( 0 ) == 0x5a4d and 2 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Toxiceye : FILE
 {
 	meta:
 		description = "Detects ToxicEye / TelegramRAT. Observed used as the basis for many infostealers"
 		author = "ditekSHen"
-		id = "99304f11-2444-5864-b174-514bb5bef0f7"
+		id = "affb766f-c711-56e8-b89a-548fdebf6081"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10955-L10973"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ee01c107dd295b923801c0d1a77b1534d3a5f2abf8d2cfa93c6786a1b0553504"
+		logic_hash = "v1_sha256_ee01c107dd295b923801c0d1a77b1534d3a5f2abf8d2cfa93c6786a1b0553504"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262125,22 +260246,20 @@ rule DITEKSHEN_MALWARE_Win_Toxiceye : FILE
 		$s11 = /\/LimerBoy\/(ToxicEye|Adamantium-Thief|hackpy)/ wide
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Rdpcredsstealerinjector : FILE
 {
 	meta:
 		description = "Detects RDP Credentials Stealer injector"
 		author = "ditekSHen"
-		id = "221b7d64-6585-5f3a-bffa-bde05390db73"
+		id = "5f3fc017-6dd7-564e-843c-993014ebb25e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10994-L11007"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0dfade8dde987f5134158b7c4abc3eaf8dcece86e1ff2ab1da4466da316939a2"
+		logic_hash = "v1_sha256_0dfade8dde987f5134158b7c4abc3eaf8dcece86e1ff2ab1da4466da316939a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262154,22 +260273,20 @@ rule DITEKSHEN_MALWARE_Win_Rdpcredsstealerinjector : FILE
 		$s5 = /(OpenProcess|VirtualAllocEx|CreateRemoteThread)\(\) failed:/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Krakenstealer : FILE
 {
 	meta:
 		description = "Detect Kraken infostealer"
 		author = "ditekSHen"
-		id = "460eb574-99c9-5f78-9efa-7a8808aaaae7"
+		id = "f94cf0ce-6570-5345-bf7c-192556540a26"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11009-L11030"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7f15823db706e6e51d8ea58fb026efb49f42234255d2f448614dc645d12648bb"
+		logic_hash = "v1_sha256_7f15823db706e6e51d8ea58fb026efb49f42234255d2f448614dc645d12648bb"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -262191,22 +260308,20 @@ rule DITEKSHEN_MALWARE_Win_Krakenstealer : FILE
 		$s12 = "HoneyPotStatus" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or 9 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or 9 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Whiffyrecon : FILE
 {
 	meta:
 		description = "Detects Whiffy Recon"
 		author = "ditekSHen"
-		id = "19b0f327-06ee-5f78-abac-9c4fbcad98ac"
+		id = "c6e9ef90-5233-5117-8345-fde3d799ec6f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11032-L11052"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "58df9f47f5890c5e31d352be682c6164a940dad206ad29c54c43f70d3afb9543"
+		logic_hash = "v1_sha256_58df9f47f5890c5e31d352be682c6164a940dad206ad29c54c43f70d3afb9543"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262227,22 +260342,20 @@ rule DITEKSHEN_MALWARE_Win_Whiffyrecon : FILE
 		$s13 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Quiterat : FILE
 {
 	meta:
 		description = "Detects QuiteRAT"
 		author = "ditekSHen"
-		id = "54f7b899-3418-5074-8138-38cf073cda8c"
+		id = "8795ed26-7970-579d-b99a-e3efbe1f5ede"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11054-L11068"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "257f9151294254e3e86979f184963f0396587438393b11bad068ba0f386cfc4a"
+		logic_hash = "v1_sha256_257f9151294254e3e86979f184963f0396587438393b11bad068ba0f386cfc4a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262257,22 +260370,20 @@ rule DITEKSHEN_MALWARE_Win_Quiterat : FILE
 		$s4 = "XhkbDBEXFkU" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($x*) and 1 of ($s*)) or (1 of ($x*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $x* ) and 1 of ( $s* ) ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_PWSH_CUMII
 {
 	meta:
 		description = "Detects multi-dropper PowerShell"
 		author = "ditekSHen"
-		id = "07b77251-1d79-5521-8c05-ecfc662f45cb"
+		id = "3cd3672a-bc42-577c-8389-db3baf788c24"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11070-L11086"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ab9e59b0552718928d170a988d129b38352700076847f2f409976016858864eb"
+		logic_hash = "v1_sha256_ab9e59b0552718928d170a988d129b38352700076847f2f409976016858864eb"
 		score = 75
 		quality = 75
 		tags = ""
@@ -262289,22 +260400,20 @@ rule DITEKSHEN_MALWARE_PWSH_CUMII
 		$b3 = "01001101010110101001*11*0000" ascii
 
 	condition:
-		(3 of ($s*) and 1 of ($b*))
+		(3 of ( $s* ) and 1 of ( $b* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Agnianestealer : FILE
 {
 	meta:
 		description = "Detects Agniane infostealer"
 		author = "ditekSHen"
-		id = "fcbbf748-dc01-579f-a6f8-37e0f3dea35e"
+		id = "49db56d2-6ede-5e39-84f6-7ebf93912531"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11088-L11114"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0031fbe6d76868819cbcfc638433d60a50e8f5cfd14ff25af88ed3dffefd7d62"
+		logic_hash = "v1_sha256_0031fbe6d76868819cbcfc638433d60a50e8f5cfd14ff25af88ed3dffefd7d62"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262331,22 +260440,20 @@ rule DITEKSHEN_MALWARE_Win_Agnianestealer : FILE
 		$u8 = "&domaindetects=" wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and (2 of ($s*) or 3 of ($u*))) or ( all of ($s*) and 3 of ($u*)) or (7 of ($u*)))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 3 of ( $u* ) ) ) or ( all of ( $s* ) and 3 of ( $u* ) ) or ( 7 of ( $u* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_TOITOIN_Kritaloader : FILE
 {
 	meta:
 		description = "Detects TOITOIN KritaLoader"
 		author = "ditekSHen"
-		id = "5ff002fc-1108-554e-9de6-92d568826d1d"
+		id = "e0dcdcec-4da2-5e7f-b5de-d4f99c00a102"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11116-L11127"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9629a4cfa606812d2579c0c0d486dec5971854e5133f0594a4638db5b89c3135"
+		logic_hash = "v1_sha256_9629a4cfa606812d2579c0c0d486dec5971854e5133f0594a4638db5b89c3135"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262358,22 +260465,20 @@ rule DITEKSHEN_MALWARE_Win_TOITOIN_Kritaloader : FILE
 		$s1 = "krita_main" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($p*) and 1 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $p* ) and 1 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_TOITOIN_Injectordll : FILE
 {
 	meta:
 		description = "Detects TOITOIN InjectorDLL"
 		author = "ditekSHen"
-		id = "40776e0a-29df-52ea-8486-35027ab31a1b"
+		id = "76d324fb-692f-5f41-94e7-270195bc4981"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11129-L11141"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fc80c702305657ba1058ca7f55579d1d5254dd0f619c5f7fda7886a868b65c93"
+		logic_hash = "v1_sha256_fc80c702305657ba1058ca7f55579d1d5254dd0f619c5f7fda7886a868b65c93"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -262386,22 +260491,20 @@ rule DITEKSHEN_MALWARE_Win_TOITOIN_Injectordll : FILE
 		$s2 = "\\users\\Public\\Documents\\" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($p*) and all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $p* ) and all of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_TOITOIN_Downloader : FILE
 {
 	meta:
 		description = "Detects TOITOIN Downloader"
 		author = "ditekSHen"
-		id = "0282ea26-e381-5c9a-9dad-c90246d8add0"
+		id = "dd9e622c-675d-5f0b-81bb-343a8b9bbead"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11143-L11154"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d7e5e99c9266ec144152c3d1066e0e1a862f48ded17fab8f504192ca48219826"
+		logic_hash = "v1_sha256_d7e5e99c9266ec144152c3d1066e0e1a862f48ded17fab8f504192ca48219826"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262413,22 +260516,20 @@ rule DITEKSHEN_MALWARE_Win_TOITOIN_Downloader : FILE
 		$o1 = { 48 83 fa 10 72 34 48 8b 8d 10 ?? 00 00 48 ff c2 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Venomrat : FILE
 {
 	meta:
 		description = "Detects VenomRAT"
 		author = "ditekSHen"
-		id = "93cd5ae3-c222-51a2-bbb9-bdd3254006e5"
+		id = "1fb2e85b-8bb5-55fc-a058-cffd531cba93"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11156-L11170"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "47d343def76a323c66db4ba6fb1c0d119f45323f9b7f36695e4aeb7b070819d7"
+		logic_hash = "v1_sha256_47d343def76a323c66db4ba6fb1c0d119f45323f9b7f36695e4aeb7b070819d7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262443,22 +260544,20 @@ rule DITEKSHEN_MALWARE_Win_Venomrat : FILE
 		$s4 = "Po_ng" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) and 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) and 2 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Sapphirestealer : FILE
 {
 	meta:
 		description = "Detects SapphireStealer"
 		author = "ditekSHen"
-		id = "ed6cffe4-23f1-5791-b07d-75abb698c899"
+		id = "15ac911d-f3ef-5cfe-9410-1bfcb438bcd2"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11172-L11190"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "97088c0decf158d45a02571bd50b5f370c139339c19b8071f38c0f9816232d1f"
+		logic_hash = "v1_sha256_97088c0decf158d45a02571bd50b5f370c139339c19b8071f38c0f9816232d1f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262477,7 +260576,7 @@ rule DITEKSHEN_MALWARE_Win_Sapphirestealer : FILE
 		$s11 = ".SendLog+<UploadToTelegram>d__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16( 0 ) == 0x5a4d and 5 of them
 }
 import "pe"
 
@@ -262486,13 +260585,13 @@ rule DITEKSHEN_MALWARE_Win_R77 : FILE
 	meta:
 		description = "Detects r77 rootkit"
 		author = "ditekSHen"
-		id = "813d207e-c6d9-5fea-8387-19da33bc3317"
+		id = "b577a165-e4a9-56ee-97a6-bd72fcbb387e"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11192-L11217"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e3ec6e88a3a77b7dc69eb51a528e6417f6b8695c7cb01d699cf248cebd9b84e2"
+		logic_hash = "v1_sha256_e3ec6e88a3a77b7dc69eb51a528e6417f6b8695c7cb01d699cf248cebd9b84e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262508,22 +260607,20 @@ rule DITEKSHEN_MALWARE_Win_R77 : FILE
 		$s8 = "SOFTWARE\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (5 of them and pe.exports("ReflectiveDllMain")) or (5 of them and for any i in (0..pe.number_of_sections) : ((pe.sections[i].name==".detourd"))))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 5 of them and pe.exports ( "ReflectiveDllMain" ) ) or ( 5 of them and for any i in ( 0 .. pe.number_of_sections ) : ( ( pe.sections [ i ] . name == ".detourd" ) ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Disco_Nightclub : FILE
 {
 	meta:
 		description = "Hunts for Disco NightClub"
 		author = "ditekSHen"
-		id = "79cbd351-e5d9-5f1f-8e73-71e0acca2707"
+		id = "eb026c40-ea39-5be4-98da-ad5d289e3130"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11219-L11237"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ee0bd110ea1a3182284c4b3d6dd7eff48ca809a35a925147c716b18a88c0a233"
+		logic_hash = "v1_sha256_ee0bd110ea1a3182284c4b3d6dd7eff48ca809a35a925147c716b18a88c0a233"
 		score = 75
 		quality = 51
 		tags = "FILE"
@@ -262542,22 +260639,20 @@ rule DITEKSHEN_MALWARE_Win_Disco_Nightclub : FILE
 		$pdb2 = "\\Autogen\\Kh\\AutogenAlg\\" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($pdb*) and 2 of ($s*)) or (4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Risepro : FILE
 {
 	meta:
 		description = "Detects RisePro infostealer"
 		author = "ditekShen"
-		id = "77bc8791-cbe8-53b5-86f4-bc918454a6a6"
+		id = "e453482f-a1e7-54fc-a09b-b0079e462910"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11239-L11269"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f6f1832f316df51ca108a3c75034bd53c3823cd3d9b16da120e12e252dbf90ff"
+		logic_hash = "v1_sha256_f6f1832f316df51ca108a3c75034bd53c3823cd3d9b16da120e12e252dbf90ff"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -262588,22 +260683,20 @@ rule DITEKSHEN_MALWARE_Win_Risepro : FILE
 		$s9 = /catch (save )?(windows cred|screen|pluginscrypto|historyCC|autofill|cookies|passwords|passwords sql|autofills sql|dwnlhistory sql|discordToken|quantum|isDropped)/ fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 6 of ( $s* ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Graphicalproton_Rsockstun : FILE
 {
 	meta:
 		description = "Detects GraphicalProton custom rsockstun"
 		author = "ditekShen"
-		id = "5efa85f6-7e73-53a1-92df-4cb975e62345"
+		id = "b1f68fef-f9d3-50a1-acd8-306c882a9d18"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11271-L11286"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ca4d18160b89d82106310237cf81bba57a7f51be77a31d2f18ca8c2987972c2c"
+		logic_hash = "v1_sha256_ca4d18160b89d82106310237cf81bba57a7f51be77a31d2f18ca8c2987972c2c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262619,7 +260712,7 @@ rule DITEKSHEN_MALWARE_Win_Graphicalproton_Rsockstun : FILE
 		$s4 = "wine_get" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($m*) and 2 of ($s*)) or ( all of ($s*) and 1 of ($m*)) or 7 of them )
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $m* ) and 2 of ( $s* ) ) or ( all of ( $s* ) and 1 of ( $m* ) ) or 7 of them )
 }
 import "pe"
 
@@ -262628,13 +260721,13 @@ rule DITEKSHEN_MALWARE_Win_PWSHDLLDL : FILE
 	meta:
 		description = "Detects downloader"
 		author = "ditekShen"
-		id = "553ed216-c8c2-504f-b689-0e8d21a00eaa"
+		id = "11547455-21e1-5aec-815d-0c42d06a147c"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11288-L11303"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7acef81f0e6e282650c161963599dcbe2b3975d482eb7c330581901b0fe85655"
+		logic_hash = "v1_sha256_7acef81f0e6e282650c161963599dcbe2b3975d482eb7c330581901b0fe85655"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262650,7 +260743,7 @@ rule DITEKSHEN_MALWARE_Win_PWSHDLLDL : FILE
 		$op1 = { 4b 04 00 00 34 01 00 00 7f 05 00 00 1a }
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and 5 of them
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and 5 of them
 }
 import "pe"
 
@@ -262659,13 +260752,13 @@ rule DITEKSHEN_MALWARE_Win_Nppspy : FILE
 	meta:
 		description = "Detects NPPSpy / Ntospy"
 		author = "ditekShen"
-		id = "3867ba96-1162-5693-b58e-fc6fa04d880a"
+		id = "bfaca421-05d9-5311-bfc4-390450419375"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11305-L11325"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "53e929b52dddd5e3d060d2dd9937411f1ff215be4d3c67f5935c2a3fbab006d6"
+		logic_hash = "v1_sha256_53e929b52dddd5e3d060d2dd9937411f1ff215be4d3c67f5935c2a3fbab006d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262684,22 +260777,20 @@ rule DITEKSHEN_MALWARE_Win_Nppspy : FILE
 		$path = "\\GrzegorzTworek\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((pe.is_dll() and filesize <110KB and pe.number_of_exports==2 and ((pe.exports("NPGetCaps") and pe.exports("NPLogonNotify")) or (1 of ($s*) and (pe.exports("NPGetCaps") or pe.exports("NPLogonNotify"))))) or (($path) and any of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( pe.is_dll ( ) and filesize < 110KB and pe.number_of_exports == 2 and ( ( pe.exports ( "NPGetCaps" ) and pe.exports ( "NPLogonNotify" ) ) or ( 1 of ( $s* ) and ( pe.exports ( "NPGetCaps" ) or pe.exports ( "NPLogonNotify" ) ) ) ) ) or ( ( $path ) and any of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Agentracoon : FILE
 {
 	meta:
 		description = "Detects AgentRacoon. Not Raccoon"
 		author = "ditekShen"
-		id = "cc31bd71-da96-5a3d-b2f1-40f9745d8d46"
+		id = "7c46c811-0487-518e-98bb-03cd4a226d79"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11327-L11343"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7ed17a1bc161855f2bdc432952086f3b86b58ae9ea6c0d541544f4b63a8e08e8"
+		logic_hash = "v1_sha256_7ed17a1bc161855f2bdc432952086f3b86b58ae9ea6c0d541544f4b63a8e08e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262716,22 +260807,20 @@ rule DITEKSHEN_MALWARE_Win_Agentracoon : FILE
 		$s9 = "xn--" wide
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Simda : FILE
 {
 	meta:
 		description = "Detects Simda / Shifu infostealer"
 		author = "ditekShen"
-		id = "892a5ffe-ea1a-5df3-9c36-0198fa61b8b6"
+		id = "0cb5f124-afd6-5363-b717-4889a9149863"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11345-L11361"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3f06e86033e8f9534f9904a2a63c4717a9532eb235f6f4405ef1db7d9b93f036"
+		logic_hash = "v1_sha256_3f06e86033e8f9534f9904a2a63c4717a9532eb235f6f4405ef1db7d9b93f036"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262748,22 +260837,20 @@ rule DITEKSHEN_MALWARE_Win_Simda : FILE
 		$s9 = /(!|&|data_)inject(=ok)?/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Vbsdownloader : FILE
 {
 	meta:
 		description = "Detects second stage VBS downloader of third stage VBS"
 		author = "ditekShen"
-		id = "480e6872-3a8c-58c5-a455-02342ec7918c"
+		id = "3b8339db-95be-55a9-9639-b0cc93e9208f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11363-L11375"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fee9a78e60d02ff2f03035812af2bf36fe350c70d3e4e094713791833f8ba4d6"
+		logic_hash = "v1_sha256_fee9a78e60d02ff2f03035812af2bf36fe350c70d3e4e094713791833f8ba4d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262776,22 +260863,20 @@ rule DITEKSHEN_MALWARE_Win_Vbsdownloader : FILE
 		$s5 = "ExecuteGlobal" wide
 
 	condition:
-		filesize <50KB and all of them
+		filesize < 50KB and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Umbralstealer : FILE
 {
 	meta:
 		description = "Detects Umbral infostealer"
 		author = "ditekShen"
-		id = "695a350b-3d8e-5244-a275-a60202a8e956"
+		id = "6690bd83-75b7-595a-89c9-baeac3406af6"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11377-L11398"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1686e4626e4d6335f028d6cb6471c32dac747a77fc95d97b4c9dfd043ba975e9"
+		logic_hash = "v1_sha256_1686e4626e4d6335f028d6cb6471c32dac747a77fc95d97b4c9dfd043ba975e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262813,22 +260898,20 @@ rule DITEKSHEN_MALWARE_Win_Umbralstealer : FILE
 		$c6 = "trendmicro.com" wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 5 of ($s*) or (3 of ($s*) and 4 of ($c*)))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 5 of ( $s* ) or ( 3 of ( $s* ) and 4 of ( $c* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Metastealer : FILE
 {
 	meta:
 		description = "Detects MetaStealer infostealer"
 		author = "ditekSHen"
-		id = "46aa30c1-12c2-56df-8c65-0b96147f9051"
+		id = "e426c440-cc9b-5e80-93fc-f395d0193d6b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11400-L11423"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "260c6d90a89ddb6219a5cbad18058e41611ae2dc68a8d4e589fa6ca81853752f"
+		logic_hash = "v1_sha256_260c6d90a89ddb6219a5cbad18058e41611ae2dc68a8d4e589fa6ca81853752f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262852,7 +260935,7 @@ rule DITEKSHEN_MALWARE_Win_Metastealer : FILE
 		$s16 = "FileScannerRule" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 7 of ($s*)
+		uint16( 0 ) == 0x5a4d and 7 of ( $s* )
 }
 import "pe"
 
@@ -262861,13 +260944,13 @@ rule DITEKSHEN_MALWARE_Win_Mediapi : FILE
 	meta:
 		description = "Detects MediaPI"
 		author = "ditekSHen"
-		id = "95db8772-1bcd-5eea-956c-c9578b8e1329"
+		id = "cf66f7b0-0260-58e0-9d60-6d3157a63066"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11425-L11439"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2bce0a96b45e46c0cbd913dacb3dfe7ae1b519102d637e0fd9dabe2008037d94"
+		logic_hash = "v1_sha256_2bce0a96b45e46c0cbd913dacb3dfe7ae1b519102d637e0fd9dabe2008037d94"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262882,22 +260965,20 @@ rule DITEKSHEN_MALWARE_Win_Mediapi : FILE
 		$s7 = "\"-socket" ascii
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and ((6 of them ) or (3 of them and pe.exports("SomeFunction")))
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and ( ( 6 of them ) or ( 3 of them and pe.exports ( "SomeFunction" ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Blackhunt : FILE
 {
 	meta:
 		description = "Detects BlackHunt ransomware"
 		author = "ditekSHen"
-		id = "4bdb26dd-a424-54a6-b313-e98bdf18cfce"
+		id = "c42bb10a-a055-5947-ad85-be32b814cea5"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11441-L11456"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "62e9bc505eff3e19ff0cdaf180e45e6d7917f0bec7cd9b007bee9fe1d9d09b66"
+		logic_hash = "v1_sha256_62e9bc505eff3e19ff0cdaf180e45e6d7917f0bec7cd9b007bee9fe1d9d09b66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -262913,7 +260994,7 @@ rule DITEKSHEN_MALWARE_Win_Blackhunt : FILE
 		$s8 = "BLACK_HUNT_MUTEX" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
 import "pe"
 
@@ -262922,13 +261003,13 @@ rule DITEKSHEN_MALWARE_Win_Scoutelite : FILE
 	meta:
 		description = "Detects ScoutElite"
 		author = "ditekSHen"
-		id = "989f558b-f84c-5f64-b85d-618d83f96782"
+		id = "d75618c8-68bd-5700-a9db-e742b6b10fd5"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/back-in-2017"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11458-L11531"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "935bd891a9b68cb6ddad86db843de624f3a7ec0824f2b4c6ff0da56422b79668"
+		logic_hash = "v1_sha256_935bd891a9b68cb6ddad86db843de624f3a7ec0824f2b4c6ff0da56422b79668"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -262999,22 +261080,20 @@ rule DITEKSHEN_MALWARE_Win_Scoutelite : FILE
 		$confe9 = "[/connection]" fullword ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and (2 of ($cmd*) or 7 of ($gcmd*) or (2 of ($confs*) and 2 of ($confe*)) or (pe.exports("__elite") and 2 of them ))) or (15 of them )
+		( uint16( 0 ) == 0x5a4d and ( 2 of ( $cmd* ) or 7 of ( $gcmd* ) or ( 2 of ( $confs* ) and 2 of ( $confe* ) ) or ( pe.exports ( "__elite" ) and 2 of them ) ) ) or ( 15 of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Scouteliteps
 {
 	meta:
 		description = "Detects actor PowerShell tool designed to steal browsers session cookie and passwords on-disk and in-memory"
 		author = "ditekshen"
-		id = "d2c04d55-9bf7-54f5-8053-835fa60f19cb"
+		id = "8fa657fd-bae5-57db-951b-47d509403901"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/back-in-2017"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11534-L11569"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9b1047b8b485fcfa29225f53674050703d32498cfa99654c8ac5f8bfac29878e"
+		logic_hash = "v1_sha256_9b1047b8b485fcfa29225f53674050703d32498cfa99654c8ac5f8bfac29878e"
 		score = 75
 		quality = 37
 		tags = ""
@@ -263049,22 +261128,20 @@ rule DITEKSHEN_MALWARE_Win_Scouteliteps
 		$def9 = "Start-Sleep" ascii wide nocase
 
 	condition:
-		(1 of ($cnc*) and any of ($db*) and any of ($cond*) and any of ($sql*) and 7 of ($def*)) or ( all of them )
+		(1 of ( $cnc* ) and any of ( $db* ) and any of ( $cond* ) and any of ( $sql* ) and 7 of ( $def* ) ) or ( all of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Houdiniconfig : FILE
 {
 	meta:
 		description = "Detects Houdini Trojan configurations"
 		author = "ditekshen"
-		id = "e4f974fe-731e-55a8-aa5f-068a1e62f54d"
+		id = "14cb51b6-d84d-5187-a997-839092a6f540"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/back-in-2017"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11600-L11616"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "70a67c9a91d2f82184f1d7a5ea51de911a054dd4e38e2cc36f495ed59219afab"
+		logic_hash = "v1_sha256_70a67c9a91d2f82184f1d7a5ea51de911a054dd4e38e2cc36f495ed59219afab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263080,22 +261157,20 @@ rule DITEKSHEN_MALWARE_Win_Houdiniconfig : FILE
 		$s8 = "injection_process"
 
 	condition:
-		( uint16(0)==0x5a4d and 5 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and 5 of them ) or ( all of them )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Houdini : FILE
 {
 	meta:
 		description = "Detects the raw binary of the Houdini Trojan Delphi variant"
 		author = "ditekshen"
-		id = "79681ca3-b956-52d4-81b8-b3bd4c86872a"
+		id = "6e4fc458-c746-5813-abe4-001c300ef1bd"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/back-in-2017"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11618-L11689"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0580d2525d9d989f98e815dd98b9258724b6e31f058092132c0fbd67cbc5c63c"
+		logic_hash = "v1_sha256_0580d2525d9d989f98e815dd98b9258724b6e31f058092132c0fbd67cbc5c63c"
 		score = 75
 		quality = 46
 		tags = "FILE"
@@ -263160,22 +261235,20 @@ rule DITEKSHEN_MALWARE_Win_Houdini : FILE
 		$pl3 = "plugin_stop" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Lighthand : FILE
 {
 	meta:
 		description = "Detects LightHand"
 		author = "ditekshen"
-		id = "2b644dfb-f09a-50a5-8260-7b7022bce1f4"
+		id = "35c6d25f-e403-5dbc-9118-3c93dd8a5cfe"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11691-L11718"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4f06467a522b786045839e6b22b888cecc554b0f63cc20dc43dc0f8ec80f5654"
+		logic_hash = "v1_sha256_4f06467a522b786045839e6b22b888cecc554b0f63cc20dc43dc0f8ec80f5654"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263203,22 +261276,20 @@ rule DITEKSHEN_MALWARE_Win_Lighthand : FILE
                 25 00 2e 00 31 00 66 00 4d 00 42 }
 
 	condition:
-		uint16(0)==0x5a4d and ((5 of ($s*)) or (1 of ($x*) and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 5 of ( $s* ) ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Validalpha : FILE
 {
 	meta:
 		description = "Detects ValidApha / BlackRAT"
 		author = "ditekshen"
-		id = "3162eb5f-6e2d-598a-b199-22b70ec8a773"
+		id = "fdd90d48-7043-54b0-8be5-4a10edc11d86"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11720-L11736"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "54d170076d1b32cee6f6252d40548acc7e23b467d692c59d6146a8aadf431211"
+		logic_hash = "v1_sha256_54d170076d1b32cee6f6252d40548acc7e23b467d692c59d6146a8aadf431211"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263235,22 +261306,20 @@ rule DITEKSHEN_MALWARE_Win_Validalpha : FILE
 		$s7 = "main.PeekNamedPipe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or (6 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( 6 of ( $s* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Tigerrat : FILE
 {
 	meta:
 		description = "Detects TigerRAT"
 		author = "ditekshen"
-		id = "37192fc8-1932-5f33-994a-bb319b131c58"
+		id = "2a78d7a6-bbac-5928-a846-df7a0a8b6a26"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11738-L11756"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "38a238339db7e7f573e0c7362af5a08654a9e134f902c0ecae441250a0364c64"
+		logic_hash = "v1_sha256_38a238339db7e7f573e0c7362af5a08654a9e134f902c0ecae441250a0364c64"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263269,22 +261338,20 @@ rule DITEKSHEN_MALWARE_Win_Tigerrat : FILE
 		$s5 = "del \"%s\"%s \"%s\" goto " ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*)) or (5 of ($m*)) or (3 of ($m*) and 2 of ($s*)) or (5 of them ))
+		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) ) or ( 5 of ( $m* ) ) or ( 3 of ( $m* ) and 2 of ( $s* ) ) or ( 5 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Ktlvdoor : FILE
 {
 	meta:
 		description = "Detects KTLVdoor"
 		author = "ditekshen"
-		id = "f63ebd05-fb4b-50fb-887b-dacd379594a4"
+		id = "44249db4-32ef-54e4-9503-64d9c266dc2b"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11758-L11791"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3ced9b558c7e17acd015cd2c9dd0c5d024bf9c31c7f2e7c9b7b937124109cf8b"
+		logic_hash = "v1_sha256_3ced9b558c7e17acd015cd2c9dd0c5d024bf9c31c7f2e7c9b7b937124109cf8b"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -263318,22 +261385,20 @@ rule DITEKSHEN_MALWARE_Win_Ktlvdoor : FILE
 		$fr2 = /\.Scan(WMI|WinRM|Web|Smb2|RDP|Ping|Oxid|Mssql|Banner)\./ ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and ((6 of ($h*)) or (12 of ($f*)) or (2 of ($h*) and 4 of ($f*)) or (1 of ($s*) and (4 of ($h*) or 4 of ($f*))) or (13 of them ))
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and ( ( 6 of ( $h* ) ) or ( 12 of ( $f* ) ) or ( 2 of ( $h* ) and 4 of ( $f* ) ) or ( 1 of ( $s* ) and ( 4 of ( $h* ) or 4 of ( $f* ) ) ) or ( 13 of them ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Fakecaptcha_Downloader : FILE
 {
 	meta:
 		description = "Detects downloader executables dropped by fake captcha"
 		author = "ditekshen"
-		id = "d577e8ef-11df-565c-9925-63b8768a7115"
+		id = "8d5bcc64-cb14-5c37-b474-66337bcaae18"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11793-L11803"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "57c39ce93f74d03767e7fde53281983a8462e4f3705d1bb9084bc169a08a0f83"
+		logic_hash = "v1_sha256_57c39ce93f74d03767e7fde53281983a8462e4f3705d1bb9084bc169a08a0f83"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263344,22 +261409,20 @@ rule DITEKSHEN_MALWARE_Win_Fakecaptcha_Downloader : FILE
 		$s3 = "eval(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Xenorat : FILE
 {
 	meta:
 		description = "Detects Blacksuit"
 		author = "ditekshen"
-		id = "7f27ebef-8a0e-591a-a926-ac950db86053"
+		id = "66c91f2b-adeb-567d-a407-807eb4bb5727"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11805-L11820"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "487046464f545fb9e4a1d6e277cdc010eac6886583f0b388555a483d9021191b"
+		logic_hash = "v1_sha256_487046464f545fb9e4a1d6e277cdc010eac6886583f0b388555a483d9021191b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263375,22 +261438,20 @@ rule DITEKSHEN_MALWARE_Win_Xenorat : FILE
 		$s5 = "Plugin.Chromium+<Get" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or (4 of ($s*)) or (2 of ($x*)))
+		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) ) or ( 2 of ( $x* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Multi_POOLRAT : FILE
 {
 	meta:
 		description = "Detects POOLRAT"
 		author = "ditekshen"
-		id = "5831b479-592d-591b-88b4-73102fe4b6ec"
+		id = "4cfd2d0b-1833-5cc5-87f5-9826d633225f"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11822-L11839"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "efc5881975e97583188d43a8a6b0eb59bb7103664897cc0f88ddc4d2376bd842"
+		logic_hash = "v1_sha256_efc5881975e97583188d43a8a6b0eb59bb7103664897cc0f88ddc4d2376bd842"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263408,22 +261469,20 @@ rule DITEKSHEN_MALWARE_Multi_POOLRAT : FILE
 		$s8 = "MSG_SetPathP" ascii
 
 	condition:
-		( uint16(0)==0x457f or uint16(0)==0xfacf or uint16(0)==0xfeca) and 7 of them
+		( uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf or uint16( 0 ) == 0xfeca ) and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Multi_Pondrat : FILE
 {
 	meta:
 		description = "Detects PondRAT"
 		author = "ditekshen"
-		id = "cb8cca87-6b5e-5984-8a73-9f800b262d77"
+		id = "395bdc6e-e392-5cb5-870d-c73f2b7a25ef"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11841-L11858"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "affa35f789725d3a8cea8dc95744c4e771690fde5f73936d0806a8c9f72fdb2e"
+		logic_hash = "v1_sha256_affa35f789725d3a8cea8dc95744c4e771690fde5f73936d0806a8c9f72fdb2e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263441,22 +261500,20 @@ rule DITEKSHEN_MALWARE_Multi_Pondrat : FILE
 		$s8 = "FConnectProxy" ascii
 
 	condition:
-		( uint16(0)==0x457f or uint16(0)==0xfacf or uint16(0)==0xfeca) and 7 of them
+		( uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf or uint16( 0 ) == 0xfeca ) and 7 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Cicada3301 : FILE
 {
 	meta:
 		description = "Detects Cicada3301"
 		author = "ditekshen"
-		id = "0aebee9f-177d-5a1b-87e0-8797fb6f6823"
+		id = "a980faba-fde1-5e4b-ba58-6fcb80c7e513"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11860-L11885"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b8b7596bc8ae01b89742e17bd3dbfcc1e2fad486cc6ea19c8de813fc677509f4"
+		logic_hash = "v1_sha256_b8b7596bc8ae01b89742e17bd3dbfcc1e2fad486cc6ea19c8de813fc677509f4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263482,7 +261539,7 @@ rule DITEKSHEN_MALWARE_Win_Cicada3301 : FILE
 		$c6 = "wevtutil" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or (4 of ($c*) and 4 of ($s*)) or ( all of ($c*) and 2 of ($s*)) or 9 of them )
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( 4 of ( $c* ) and 4 of ( $s* ) ) or ( all of ( $c* ) and 2 of ( $s* ) ) or 9 of them )
 }
 import "pe"
 
@@ -263491,13 +261548,13 @@ rule DITEKSHEN_MALWARE_Win_Fpspy : FILE
 	meta:
 		description = "FPSpy"
 		author = "ditekshen"
-		id = "39d3be12-1b06-57b1-b3c2-2cbd13a17b03"
+		id = "d9ec2129-a741-5346-b7cc-9ec023275caf"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11887-L11916"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c26736c7f056f3d13c58e724fda601e88468e2386852b072a37c6646fb5ef8f9"
+		logic_hash = "v1_sha256_c26736c7f056f3d13c58e724fda601e88468e2386852b072a37c6646fb5ef8f9"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -263527,22 +261584,20 @@ rule DITEKSHEN_MALWARE_Win_Fpspy : FILE
 		$s7 = "FPSpy" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ((pe.exports("MazeFunc") and 2 of ($f*) and 1 of ($s*)) or (6 of ($f*) and 1 of ($s*)) or (5 of ($s*) and 1 of ($f*)) or (8 of ($f*)))
+		uint16( 0 ) == 0x5a4d and ( ( pe.exports ( "MazeFunc" ) and 2 of ( $f* ) and 1 of ( $s* ) ) or ( 6 of ( $f* ) and 1 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $f* ) ) or ( 8 of ( $f* ) ) )
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Klogexe : FILE
 {
 	meta:
 		description = "Detects KLogExe"
 		author = "ditekshen"
-		id = "8c3ebc2c-717b-5c42-9233-274006d4331b"
+		id = "5a331120-e255-5671-b4ac-f3009f848dcf"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11918-L11937"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1f1809b83dc468122022b68d63734ba1597c6fede01582c31d1700ca0b9e1e22"
+		logic_hash = "v1_sha256_1f1809b83dc468122022b68d63734ba1597c6fede01582c31d1700ca0b9e1e22"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -263562,22 +261617,20 @@ rule DITEKSHEN_MALWARE_Win_Klogexe : FILE
 		$s11 = "dynamic_import.cpp [resolve_call] can`nt" wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
-import "pe"
-
 rule DITEKSHEN_MALWARE_Win_Babylockerkz : FILE
 {
 	meta:
 		description = "Detects BabyLockerKZ"
 		author = "ditekshen"
-		id = "faa35818-2bed-528f-a6f0-5356a723ef5b"
+		id = "979ddc9d-cba2-5ff3-933d-f7fae6cbc8f8"
 		date = "2024-11-01"
 		modified = "2024-11-01"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11939-L11957"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "423bbd3b23591608a32e4e724c156fbaa5d1d087515137a82a0aeb8c4865d1ca"
+		logic_hash = "v1_sha256_423bbd3b23591608a32e4e724c156fbaa5d1d087515137a82a0aeb8c4865d1ca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -263596,20 +261649,20 @@ rule DITEKSHEN_MALWARE_Win_Babylockerkz : FILE
 		$s11 = "[-] Start encrypt" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
 rule DITEKSHEN_INDICATOR_KB_ID_Bazarloader : FILE
 {
 	meta:
 		description = "Detects Bazar executables with specific email addresses found in the code signing certificate"
 		author = "ditekShen"
-		id = "94b814e3-56c2-5cdb-9335-c92eea8ec668"
+		id = "cc4a6c80-7a7e-5ace-8d77-43f267252c80"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L11-L21"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fd47a1d996c78a6efc144f0fe0a28951c34becab3101e7d25acc980bb6b9f8ce"
+		logic_hash = "v1_sha256_fd47a1d996c78a6efc144f0fe0a28951c34becab3101e7d25acc980bb6b9f8ce"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -263620,20 +261673,20 @@ rule DITEKSHEN_INDICATOR_KB_ID_Bazarloader : FILE
 		$s3 = "support@pro-kon.ru" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
 rule DITEKSHEN_INDICATOR_KB_ID_Qakbot : FILE
 {
 	meta:
 		description = "Detects QakBot executables with specific email addresses found in the code signing certificate"
 		author = "ditekShen"
-		id = "24ad36b2-5022-5f72-b01c-fbb64da20f34"
+		id = "3caa4b2f-a244-5197-9df0-e8489607ec61"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L23-L37"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7a38069b3b553cba1a789dac706638382dae5bb748b0c10ef50138879767b6dd"
+		logic_hash = "v1_sha256_7a38069b3b553cba1a789dac706638382dae5bb748b0c10ef50138879767b6dd"
 		score = 75
 		quality = 61
 		tags = "FILE"
@@ -263648,20 +261701,20 @@ rule DITEKSHEN_INDICATOR_KB_ID_Qakbot : FILE
 		$s7 = "mitja.vidovi@aol.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
 rule DITEKSHEN_INDICATOR_KB_ID_Amadey : FILE
 {
 	meta:
 		description = "Detects Amadey executables with specific email addresses found in the code signing certificate"
 		author = "ditekShen"
-		id = "f9abbf1d-2077-52a8-bfb0-df3732649624"
+		id = "e32b616f-0a56-5112-8745-8b7ddf6506de"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L39-L47"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3df3fe67835f76e51743b1b4fa2cbc48277d82689c2fc27457b4d7d820e56e43"
+		logic_hash = "v1_sha256_3df3fe67835f76e51743b1b4fa2cbc48277d82689c2fc27457b4d7d820e56e43"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -263670,20 +261723,20 @@ rule DITEKSHEN_INDICATOR_KB_ID_Amadey : FILE
 		$s1 = "tochka.director@gmail.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
 rule DITEKSHEN_INDICATOR_KB_ID_UNK01 : FILE
 {
 	meta:
 		description = "Detects Amadey executables with specific email addresses found in the code signing certificate"
 		author = "ditekShen"
-		id = "56e83bfb-e17d-5d27-87fa-e275cc540148"
+		id = "d86ed85c-4bd7-5e07-a3af-d7644c2b5cea"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L49-L58"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d85461f74186fcabcbf7f2bc1dce06b0012c504cf3235a6fc3e1499dc6f8a3ee"
+		logic_hash = "v1_sha256_d85461f74186fcabcbf7f2bc1dce06b0012c504cf3235a6fc3e1499dc6f8a3ee"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -263693,20 +261746,20 @@ rule DITEKSHEN_INDICATOR_KB_ID_UNK01 : FILE
 		$s1 = "etienne@tetracerous.br" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16( 0 ) == 0x5a4d and any of them
 }
 rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Lockergoga
 {
 	meta:
 		description = "Detects files referencing identities associated with LockerGoga ransomware"
 		author = "ditekShen"
-		id = "ff257dae-d09b-52b3-93ca-68a560231b0d"
+		id = "80e50e79-42f5-5674-ac80-234def18b2af"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L60-L80"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f3474f92d935dda0d4c3b11b6934aede69ed949c8ba4d196bfe320476d39ac36"
+		logic_hash = "v1_sha256_f3474f92d935dda0d4c3b11b6934aede69ed949c8ba4d196bfe320476d39ac36"
 		score = 75
 		quality = 49
 		tags = ""
@@ -263734,13 +261787,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Goldenaxe
 	meta:
 		description = "Detects files referencing identities associated with GoldenAxe ransomware"
 		author = "ditekShen"
-		id = "cd6486eb-742f-50fb-bd99-c5d778886477"
+		id = "129b803b-e60b-5e75-9e21-a73a1e0493fe"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L82-L91"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2540da85880dc08b51a2d096cefd8ed3cb14ccd171b71b434ccf26e7c5f1b54b"
+		logic_hash = "v1_sha256_2540da85880dc08b51a2d096cefd8ed3cb14ccd171b71b434ccf26e7c5f1b54b"
 		score = 75
 		quality = 71
 		tags = ""
@@ -263757,13 +261810,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Getcrypt
 	meta:
 		description = "Detects files referencing identities associated with GetCrypt ransomware"
 		author = "ditekShen"
-		id = "b5e31968-e626-5fbb-8bfe-942b48737367"
+		id = "b4c47700-db7d-5f72-a737-3e7b693be999"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L93-L106"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "401f4e69235873adc271f8861912ec17daaa71a798c83df8cc3a9b88520708c9"
+		logic_hash = "v1_sha256_401f4e69235873adc271f8861912ec17daaa71a798c83df8cc3a9b88520708c9"
 		score = 75
 		quality = 63
 		tags = ""
@@ -263784,13 +261837,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Cryptomix
 	meta:
 		description = "Detects files referencing identities associated with CryptoMix ransomware"
 		author = "ditekShen"
-		id = "7e623d06-36e8-576d-b261-d562eccf549b"
+		id = "35b9c48e-150e-5ecb-b8ff-18ac07d24e72"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L108-L123"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "27b75a476229fc877c316f7a61d1ed647f5a67ac44a174d86c084063f039b20c"
+		logic_hash = "v1_sha256_27b75a476229fc877c316f7a61d1ed647f5a67ac44a174d86c084063f039b20c"
 		score = 75
 		quality = 34
 		tags = ""
@@ -263813,13 +261866,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Buran
 	meta:
 		description = "Detects files referencing identities associated with Buran ransomware"
 		author = "ditekShen"
-		id = "63cdda3f-78ed-5ce5-a8e0-e0893f2c314e"
+		id = "6f6c6af4-7661-51a7-adef-8e90b796f464"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L125-L140"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "685126efa7f90ce296fc616bd8d5d89a5b4b9aba8b60601b29534de21a0d0015"
+		logic_hash = "v1_sha256_685126efa7f90ce296fc616bd8d5d89a5b4b9aba8b60601b29534de21a0d0015"
 		score = 75
 		quality = 59
 		tags = ""
@@ -263842,13 +261895,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ransomwareexx
 	meta:
 		description = "Detects files referencing identities associated with RansomwareEXX Linux ransomware"
 		author = "ditekShen"
-		id = "dfcff8cb-c50c-559e-b5b9-8c2cdac7a3dc"
+		id = "0158595b-c049-5857-a545-b4a3666c4f4b"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L142-L150"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a83ada5d29c6d62a292c4b3a1379558cddcaf63d97dbdfc6afd27cc52f6f656d"
+		logic_hash = "v1_sha256_a83ada5d29c6d62a292c4b3a1379558cddcaf63d97dbdfc6afd27cc52f6f656d"
 		score = 75
 		quality = 73
 		tags = ""
@@ -263864,13 +261917,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Phobos
 	meta:
 		description = "Detects files referencing identities associated with Phobos ransomware"
 		author = "ditekShen"
-		id = "cee09220-4038-5190-b595-28f67c845588"
+		id = "52314937-4f3b-5cee-b00b-fb9a1c0faa55"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L152-L161"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cf9e163d2315d465afb47bf83f30d5d27e14c4cbbc1c235dcb15b75fb509ba7d"
+		logic_hash = "v1_sha256_cf9e163d2315d465afb47bf83f30d5d27e14c4cbbc1c235dcb15b75fb509ba7d"
 		score = 75
 		quality = 71
 		tags = ""
@@ -263887,13 +261940,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Epsilon
 	meta:
 		description = "Detects files referencing identities associated with Epsilon ransomware"
 		author = "ditekShen"
-		id = "acdeb3b1-872b-5892-9dfe-2e506f767da2"
+		id = "d295df58-7a48-5873-8fd5-324ed9acd5d1"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L163-L171"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "163694ed2ae181764fc6e62027487d183114be35a689dd44d4d9761149df244b"
+		logic_hash = "v1_sha256_163694ed2ae181764fc6e62027487d183114be35a689dd44d4d9761149df244b"
 		score = 75
 		quality = 73
 		tags = ""
@@ -263909,13 +261962,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Thanos
 	meta:
 		description = "Detects files referencing identities associated with Thanos ransomware"
 		author = "ditekShen"
-		id = "22ffb4c9-f113-5d3e-a466-6c384c0c6e8a"
+		id = "a540c805-fede-5e07-908c-6f1d483ee74f"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L173-L182"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "039ea384136a1aaa261702ed75ab9358aaa1ec2d5a8d35fe4789647f39490c7c"
+		logic_hash = "v1_sha256_039ea384136a1aaa261702ed75ab9358aaa1ec2d5a8d35fe4789647f39490c7c"
 		score = 75
 		quality = 71
 		tags = ""
@@ -263932,13 +261985,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Vovalex
 	meta:
 		description = "Detects files referencing identities associated with Vovalex ransomware"
 		author = "ditekShen"
-		id = "95e9ddce-8a19-59f1-baf4-bdac61c9c396"
+		id = "22286d1c-dab6-518d-aa34-212de6ea63b7"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L184-L192"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0e8b426e55c1efaf59e5f255f1da9cdfbb509561d3f7ea5baa2815c3131866eb"
+		logic_hash = "v1_sha256_0e8b426e55c1efaf59e5f255f1da9cdfbb509561d3f7ea5baa2815c3131866eb"
 		score = 75
 		quality = 73
 		tags = ""
@@ -263954,13 +262007,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Alumnilocker
 	meta:
 		description = "Detects files referencing identities associated with AlumniLocker ransomware"
 		author = "ditekShen"
-		id = "64b6aff8-3758-5837-b814-e2505a9c12a3"
+		id = "099718eb-cb3c-5504-b97c-4bf671da916f"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L194-L202"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "aeab9cb2b2da246e1863cd1102d901d322017d0b309e852d83e4f66f6e4bdd22"
+		logic_hash = "v1_sha256_aeab9cb2b2da246e1863cd1102d901d322017d0b309e852d83e4f66f6e4bdd22"
 		score = 75
 		quality = 73
 		tags = ""
@@ -263976,13 +262029,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Doejocrypt
 	meta:
 		description = "Detects files referencing identities associated with DoejoCrypt ransomware"
 		author = "ditekShen"
-		id = "bdf67fd3-8614-52f0-8804-9905f067a848"
+		id = "941001f1-9a2a-5265-9711-1280981a00d9"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L204-L213"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b76996ef413d017fa571115f7331154c808fed0f1b1e0c97241cadbbef260a00"
+		logic_hash = "v1_sha256_b76996ef413d017fa571115f7331154c808fed0f1b1e0c97241cadbbef260a00"
 		score = 75
 		quality = 71
 		tags = ""
@@ -263999,13 +262052,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Purge
 	meta:
 		description = "Detects files referencing identities associated with Purge ransomware"
 		author = "ditekShen"
-		id = "2a0f2c69-b179-5e48-9db6-be25e329f72b"
+		id = "375a9540-d12f-5aa4-9873-a0582de2bc78"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L215-L224"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "49f3f5a88212d4bed1f0237a4437fb537e84cd6dd26c5fe224250f3b6e39d384"
+		logic_hash = "v1_sha256_49f3f5a88212d4bed1f0237a4437fb537e84cd6dd26c5fe224250f3b6e39d384"
 		score = 75
 		quality = 71
 		tags = ""
@@ -264022,13 +262075,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Zeoticus
 	meta:
 		description = "Detects files referencing identities associated with Zeoticus ransomware"
 		author = "ditekShen"
-		id = "4d5f0d6d-f792-563d-9a9b-1986f5af8743"
+		id = "58e9acbe-0451-5581-9a03-bdebf4c7b6a0"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L226-L235"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "7a83b15b0c8e81f67d11f8b5d9a43ba4e1e3a0f6741ddd0daafe4e742dd91cd8"
+		logic_hash = "v1_sha256_7a83b15b0c8e81f67d11f8b5d9a43ba4e1e3a0f6741ddd0daafe4e742dd91cd8"
 		score = 75
 		quality = 71
 		tags = ""
@@ -264045,13 +262098,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Jobcryptor
 	meta:
 		description = "Detects files referencing identities associated with JobCryptor ransomware"
 		author = "ditekShen"
-		id = "406f5638-883b-57a4-a2ba-532d2bd3ae83"
+		id = "81b46856-5533-550e-a777-029ecd683a4e"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L237-L247"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c8c5dcc0d7484a3ac6e702cca8bd0907f9e4f4aea5e99c4c3f988389e0d803a7"
+		logic_hash = "v1_sha256_c8c5dcc0d7484a3ac6e702cca8bd0907f9e4f4aea5e99c4c3f988389e0d803a7"
 		score = 75
 		quality = 69
 		tags = ""
@@ -264069,13 +262122,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Cuba
 	meta:
 		description = "Detects files referencing identities associated with JobCryptor ransomware"
 		author = "ditekShen"
-		id = "5eea027d-2164-54f2-a2bf-74b5d532e610"
+		id = "5a0de502-95b6-578b-840e-d22819aff035"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L249-L261"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b734199c8593c338c803518b2729e9d9ceaaed5d21585a3d299885433d8f796e"
+		logic_hash = "v1_sha256_b734199c8593c338c803518b2729e9d9ceaaed5d21585a3d299885433d8f796e"
 		score = 75
 		quality = 65
 		tags = ""
@@ -264095,13 +262148,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Hello
 	meta:
 		description = "Detects files referencing identities associated with Hello / WickrMe ransomware"
 		author = "ditekShen"
-		id = "02bbaa61-7ea3-5edd-8b38-27ef1f6ee1e2"
+		id = "7df6e4d4-b049-5638-ab77-06061945d237"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L263-L277"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dfafb0323a50891c03c4b706d4f3a6a511cecdee2448c1f554b416ba1e3d3df9"
+		logic_hash = "v1_sha256_dfafb0323a50891c03c4b706d4f3a6a511cecdee2448c1f554b416ba1e3d3df9"
 		score = 75
 		quality = 61
 		tags = ""
@@ -264123,13 +262176,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Unlockyourfiles
 	meta:
 		description = "Detects files referencing identities associated with UnlockYourFiles ransomware"
 		author = "ditekShen"
-		id = "fdc3ec49-66cc-5a0b-87a6-3660dd6f3b72"
+		id = "3aefe7c3-4d06-53c2-9c3b-8d1516161d09"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L279-L288"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a33dae7f08eb0c2415fbfdadf2cbbf90c68bc802352277422c6d0a2dbd62cd82"
+		logic_hash = "v1_sha256_a33dae7f08eb0c2415fbfdadf2cbbf90c68bc802352277422c6d0a2dbd62cd82"
 		score = 75
 		quality = 71
 		tags = ""
@@ -264146,13 +262199,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Darkside
 	meta:
 		description = "Detects files referencing identities associated with DarkSide ransomware"
 		author = "ditekShen"
-		id = "7b29b9b9-4657-551e-b770-880a2278ef60"
+		id = "1775ce25-5820-50d6-bf63-bd0f74da20c9"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L290-L299"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3c6cdb15cad19f1db38c0fe03ecb24d5cd4861a699aa2bee0f99b8dddacc8bd1"
+		logic_hash = "v1_sha256_3c6cdb15cad19f1db38c0fe03ecb24d5cd4861a699aa2bee0f99b8dddacc8bd1"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264169,13 +262222,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Spyro
 	meta:
 		description = "Detects files referencing identities associated with Spyro ransomware"
 		author = "ditekShen"
-		id = "9a42a9fd-dfaf-5719-acae-e7c3b92ecdc9"
+		id = "43d26de5-0886-5b06-96ac-ec024d3a35c4"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L301-L310"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b12b24b7b1b9800d249fd322532d957ddfc020c495ca89414d8d7e9fa7d58eb7"
+		logic_hash = "v1_sha256_b12b24b7b1b9800d249fd322532d957ddfc020c495ca89414d8d7e9fa7d58eb7"
 		score = 75
 		quality = 71
 		tags = ""
@@ -264192,13 +262245,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ryzerlo
 	meta:
 		description = "Detects files referencing identities associated with Ryzerlo / HiddenTear / RSJON ransomware"
 		author = "ditekShen"
-		id = "1e8b79dc-4a81-5126-a7a3-ad7a2e8f62bf"
+		id = "af383865-51e3-5441-a7dd-906263e4a186"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L312-L320"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "2d925cac74411c3e408d674e27a27ae029d39977026a79df8f90edae345a31db"
+		logic_hash = "v1_sha256_2d925cac74411c3e408d674e27a27ae029d39977026a79df8f90edae345a31db"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264214,13 +262267,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_PYSA
 	meta:
 		description = "Detects files referencing identities associated with PYSA / Mespinoza ransomware"
 		author = "ditekShen"
-		id = "b26d472b-c94e-576d-b168-6f273bb8fca5"
+		id = "e74b206c-85eb-566b-9724-bc23bfd9a737"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L322-L340"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cf0fbc0160f1d21efdb4a6935ae0d2206107042e3d020722f50d2c302aff246c"
+		logic_hash = "v1_sha256_cf0fbc0160f1d21efdb4a6935ae0d2206107042e3d020722f50d2c302aff246c"
 		score = 75
 		quality = 55
 		tags = ""
@@ -264246,13 +262299,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ranzylocker
 	meta:
 		description = "Detects files referencing identities associated with RanzyLocker ransomware"
 		author = "ditekShen"
-		id = "33478dc4-c0ec-5cc8-8620-79e770f6a773"
+		id = "1247731b-2647-5c74-a863-13bbb4f55c4f"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L354-L363"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "dc345257a3cca82a95e20505c94e90d8ac42240e1491ea1f34be121871673e26"
+		logic_hash = "v1_sha256_dc345257a3cca82a95e20505c94e90d8ac42240e1491ea1f34be121871673e26"
 		score = 75
 		quality = 71
 		tags = ""
@@ -264269,13 +262322,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Alkhal
 	meta:
 		description = "Detects files referencing identities associated with AlKhal ransomware"
 		author = "ditekShen"
-		id = "32e14a6e-fc2e-5c0a-b8e3-33e219923d90"
+		id = "966ac616-4379-5ad3-b0c9-758e0347cace"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L365-L374"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bd2d66a9cd33ab15b451158cd6c0e6579735653611ee2e6c8045a5807091938d"
+		logic_hash = "v1_sha256_bd2d66a9cd33ab15b451158cd6c0e6579735653611ee2e6c8045a5807091938d"
 		score = 75
 		quality = 71
 		tags = ""
@@ -264292,13 +262345,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_DECAF
 	meta:
 		description = "Detects files referencing identities associated with DECAF ransomware"
 		author = "ditekShen"
-		id = "24422015-56f3-503e-a902-0183eb601b22"
+		id = "d0beb40c-aa83-5608-b8ef-0158b660ea9e"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L376-L408"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "8fca3a6564cd11e625b65e7f0f278b79678368dd0c77440e9f8d46035e0c3426"
+		logic_hash = "v1_sha256_8fca3a6564cd11e625b65e7f0f278b79678368dd0c77440e9f8d46035e0c3426"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264337,13 +262390,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Babuk
 	meta:
 		description = "Detects files referencing identities associated with Babuk ransomware"
 		author = "ditekShen"
-		id = "139cea69-9661-5cb7-bf74-a14e3556c759"
+		id = "3f693e79-74c2-5227-9f82-1e1dde465000"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L410-L426"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "129b1364bb59423aab1f5f67a4c2d2a76a9c4f55aa6aa1e59bcebc717a14ee19"
+		logic_hash = "v1_sha256_129b1364bb59423aab1f5f67a4c2d2a76a9c4f55aa6aa1e59bcebc717a14ee19"
 		score = 75
 		quality = 61
 		tags = ""
@@ -264367,13 +262420,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Rapid
 	meta:
 		description = "Detects files referencing identities associated with Rapid ransomware"
 		author = "ditekShen"
-		id = "a1c6f3c0-2fec-5d96-9965-8129a843ae90"
+		id = "5dd46687-2fbb-530e-9b4b-87fece5421c8"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L428-L436"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ea82a3fcb1d836e1c250e9a576064e1babdb82b4970555260af2eb68726cfd16"
+		logic_hash = "v1_sha256_ea82a3fcb1d836e1c250e9a576064e1babdb82b4970555260af2eb68726cfd16"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264389,13 +262442,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Satana
 	meta:
 		description = "Detects files referencing identities associated with Satana ransomware"
 		author = "ditekShen"
-		id = "a362d4ca-d475-5392-a3ac-45337425d8e7"
+		id = "95cdd756-fe8d-5032-9bff-85d199fffad3"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L438-L447"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6d82e2497044518cee1b56da85f1ad6ac7934eec9ca68501932d55add4236d45"
+		logic_hash = "v1_sha256_6d82e2497044518cee1b56da85f1ad6ac7934eec9ca68501932d55add4236d45"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264412,13 +262465,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Zeppelin
 	meta:
 		description = "Detects files referencing identities associated with Zeppelin ransomware"
 		author = "ditekShen"
-		id = "f3bbfcd0-c66c-589e-ae04-904314d6a869"
+		id = "80459e8d-9e41-560b-856b-03ed62eae9ea"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L449-L462"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "66dd92423cfac32de4bea95ad0c9594cb449dc897cc6315d782c1db6de7dc5b1"
+		logic_hash = "v1_sha256_66dd92423cfac32de4bea95ad0c9594cb449dc897cc6315d782c1db6de7dc5b1"
 		score = 75
 		quality = 63
 		tags = ""
@@ -264439,13 +262492,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_STOP
 	meta:
 		description = "Detects files referencing identities associated with STOP ransomware"
 		author = "ditekShen"
-		id = "b2279a7f-a187-5a44-bf1f-87c21b3ffa4f"
+		id = "0d63efff-7903-5595-8a8f-b363e90e9b71"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L464-L480"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f0d902edbcbe8ff8f3a751b649554499933b06471920c86a9eea3de23890b4bc"
+		logic_hash = "v1_sha256_f0d902edbcbe8ff8f3a751b649554499933b06471920c86a9eea3de23890b4bc"
 		score = 75
 		quality = 57
 		tags = ""
@@ -264469,13 +262522,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Diavol
 	meta:
 		description = "Detects files referencing identities associated with Diavol ransomware"
 		author = "ditekShen"
-		id = "ea499318-ed5b-5597-8f9f-4ece7942cf4b"
+		id = "d48783d5-2dd5-58f7-8d19-74e96bef50aa"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L482-L491"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c72f4d7854f7ba813c4872d47aad69edb8c2927f380b9213ced1aca52454eee5"
+		logic_hash = "v1_sha256_c72f4d7854f7ba813c4872d47aad69edb8c2927f380b9213ced1aca52454eee5"
 		score = 75
 		quality = 71
 		tags = ""
@@ -264492,13 +262545,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Chaos
 	meta:
 		description = "Detects files referencing identities associated with Chaos ransomware"
 		author = "ditekShen"
-		id = "18476655-1468-569e-b518-ebeaf289fbd6"
+		id = "a8ab8e5c-147b-5d4d-93ef-632625fccf17"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L493-L511"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6e8dce1622dbccca6aa15040b49fc9ea05ec7192f8a79409fd7414690102d09a"
+		logic_hash = "v1_sha256_6e8dce1622dbccca6aa15040b49fc9ea05ec7192f8a79409fd7414690102d09a"
 		score = 75
 		quality = 67
 		tags = ""
@@ -264523,13 +262576,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Maze
 	meta:
 		description = "Detects files referencing identities associated with Maze ransomware"
 		author = "ditekShen"
-		id = "7cc11912-e5d2-5477-ab9b-0c470bb5e1d6"
+		id = "76bcee57-e862-5413-a6d1-e0be7cd8ba93"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L513-L521"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "46070d46c502837e5fb87d0fb75244a1a21e90b4e0ce4b73c408b8dc67fe1bcb"
+		logic_hash = "v1_sha256_46070d46c502837e5fb87d0fb75244a1a21e90b4e0ce4b73c408b8dc67fe1bcb"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264545,13 +262598,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Lokilocker
 	meta:
 		description = "Detects files referencing identities associated with LokiLocker ransomware"
 		author = "ditekShen"
-		id = "ab2cf390-4544-54ed-913c-d463d0f1bdb0"
+		id = "22a8eeb5-251a-5130-bf8e-2b5409472a1e"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L523-L531"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "1ab9a2ce7e39d916b389e2adb975e3558ddb7d87f7e9494e6b20cb25edd3cb84"
+		logic_hash = "v1_sha256_1ab9a2ce7e39d916b389e2adb975e3558ddb7d87f7e9494e6b20cb25edd3cb84"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264567,13 +262620,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Blackcat
 	meta:
 		description = "Detects files referencing identities associated with BlackCat ransomware"
 		author = "ditekShen"
-		id = "21038f8e-73cd-59d2-9eb3-6947d263ab79"
+		id = "0a67a0c1-9679-596d-bceb-f4863645032c"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L533-L569"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "eb0a4d26170f030775f778cc524749ca283dfa983f84bd364e4df6321eb96cf1"
+		logic_hash = "v1_sha256_eb0a4d26170f030775f778cc524749ca283dfa983f84bd364e4df6321eb96cf1"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264607,20 +262660,20 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Blackcat
 		$url14 = "://y4722ss64vel5hmph75te7lx2x5xz463322ypjirm5ytxviijtdpybid.onion" ascii wide
 
 	condition:
-		(1 of ($pk*) and 1 of ($url*))
+		(1 of ( $pk* ) and 1 of ( $url* ) )
 }
 rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Koxic
 {
 	meta:
 		description = "Detects files referencing identities associated with LokiLocker ransomware"
 		author = "ditekShen"
-		id = "4c4ff722-cac1-5967-9e79-681f47566e96"
+		id = "4e9b3e5e-6fee-505f-abd4-cb9554df27bd"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L571-L580"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ca4d0e85cf4c7a134609262e21d5cef98100ba0a046d17ffe51bf3975dc7cae9"
+		logic_hash = "v1_sha256_ca4d0e85cf4c7a134609262e21d5cef98100ba0a046d17ffe51bf3975dc7cae9"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264637,13 +262690,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ryuk
 	meta:
 		description = "Detects files referencing identities associated with Ryuk ransomware"
 		author = "ditekShen"
-		id = "00cf99da-ff3c-5c91-8966-69a8afc8613a"
+		id = "bec876ba-e1b8-5e36-a051-11148086aa5e"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L582-L592"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a2b6106fc49dd254ca936e285fa0c2a3aee7110832686638d20d369d77f6c48f"
+		logic_hash = "v1_sha256_a2b6106fc49dd254ca936e285fa0c2a3aee7110832686638d20d369d77f6c48f"
 		score = 75
 		quality = 71
 		tags = ""
@@ -264661,13 +262714,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Lockdown
 	meta:
 		description = "Detects files referencing identities associated with LockDown / cantopen ransomware"
 		author = "ditekShen"
-		id = "603f0113-d77b-590c-b2a0-804c6d1fbfbc"
+		id = "bb07492e-fc83-5507-ba5f-d46a658b06f6"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L594-L603"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cb17bb92d6e8189a08508481b75d301a1227906815c684753859914d77d7b3e7"
+		logic_hash = "v1_sha256_cb17bb92d6e8189a08508481b75d301a1227906815c684753859914d77d7b3e7"
 		score = 75
 		quality = 73
 		tags = ""
@@ -264684,13 +262737,13 @@ rule DITEKSHEN_INDICATOR_KB_LNK_BOI_MAC : FILE
 	meta:
 		description = "Detects Windows Shortcut .lnk files with previously known bad Birth Object ID and MAC address combination"
 		author = "ditekSHen"
-		id = "bfef07dc-a368-5119-82dd-de2096b17dd1"
+		id = "f793dad0-9ff4-53fe-baf7-25652cddd5fa"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L605-L637"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "31a7966a0ea0fca363d2b926b06c8acbdae0c24dd2156389196255dbbf4ed662"
+		logic_hash = "v1_sha256_31a7966a0ea0fca363d2b926b06c8acbdae0c24dd2156389196255dbbf4ed662"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -264721,20 +262774,20 @@ rule DITEKSHEN_INDICATOR_KB_LNK_BOI_MAC : FILE
 		$mac9 = { 00 D8 61 85 FD 9F }
 
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and filesize <3KB and (1 of ($boi*) and 1 of ($mac*))
+		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and filesize < 3KB and ( 1 of ( $boi* ) and 1 of ( $mac* ) )
 }
 rule DITEKSHEN_INDICATOR_KB_ID_Powershellwifistealer
 {
 	meta:
 		description = "Detects email accounts used for exfiltration observed in PowerShellWiFiStealer"
 		author = "ditekShen"
-		id = "fa19e422-c682-5464-b034-330942daf3bd"
+		id = "83bfacc1-1a84-53d0-a8e7-5cd2745cbabe"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L691-L704"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f119b54032e2a6ca35819e811e6479b00936115d98ef6e928f4c819d04a8321f"
+		logic_hash = "v1_sha256_f119b54032e2a6ca35819e811e6479b00936115d98ef6e928f4c819d04a8321f"
 		score = 75
 		quality = 63
 		tags = ""
@@ -264755,13 +262808,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Powershellcookiestealer
 	meta:
 		description = "Detects email accounts used for exfiltration observed in PowerShellCookieStealer"
 		author = "ditekShen"
-		id = "c2bbb9a8-3e4c-5676-9676-2708a196ef8d"
+		id = "3e0dc1e6-6c69-5978-8b97-81d416c35cca"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L706-L715"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "bd404e94939acb92dd56a7d2a1f7536bcb3f520ca1e9dc614b53828afbc6dac8"
+		logic_hash = "v1_sha256_bd404e94939acb92dd56a7d2a1f7536bcb3f520ca1e9dc614b53828afbc6dac8"
 		score = 75
 		quality = 71
 		tags = ""
@@ -264778,13 +262831,13 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Zebrocy : FILE
 	meta:
 		description = "Detects Golang Build IDs in known bad samples"
 		author = "ditekSHen"
-		id = "fc805e9d-47a0-5fcb-9b21-4806c13ab7b4"
+		id = "61da25a2-12ae-54a0-83a7-b611b0853e24"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1541-L1550"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "16b88460896012b42ca576995f5de98a7a9d2fcc53f8e148427bca31a883d19b"
+		logic_hash = "v1_sha256_16b88460896012b42ca576995f5de98a7a9d2fcc53f8e148427bca31a883d19b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -264794,20 +262847,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Zebrocy : FILE
 		$s2 = "Go build ID: \"fiGGvLVFcvIhuJsSaail/jLt9TEPQiusg7IpRkp4H/hlcoXZIfsl1D4521LqEL/yL8dN86mCNc39WqQTgGn\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gostealer : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in known bad samples"
 		author = "ditekSHen"
-		id = "25c0eb8b-c69c-5f50-b622-daaa3c8c62a4"
+		id = "0b3b9779-1a9a-5a3b-9895-1ce8c4a592d4"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1552-L1562"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d548bc2580c8e8233a5fcdf85b947547c10f2c4d0056d14e990f30dd7b9a0672"
+		logic_hash = "v1_sha256_d548bc2580c8e8233a5fcdf85b947547c10f2c4d0056d14e990f30dd7b9a0672"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -264818,20 +262871,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gostealer : FILE
 		$s3 = "Go build ID: \"BPRThIYWbHcZQQ4K1y2t/2mO0-FjLC50P0QZuMTgC/9i6TYw_akiEF9ZPN0s3p/s1XoqXr7EyXMDVw5TTP3\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Goldenaxe : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in known bad samples"
 		author = "ditekSHen"
-		id = "e734d5b4-2332-5b46-a05e-fb35134ea070"
+		id = "1dd52af6-e93b-5b13-b328-f28b45e54dd6"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1564-L1573"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4ab9aeaa74530de4a62ddfa8d7e8607e455d0ba4330260037327bec6d8d7abab"
+		logic_hash = "v1_sha256_4ab9aeaa74530de4a62ddfa8d7e8607e455d0ba4330260037327bec6d8d7abab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -264841,20 +262894,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Goldenaxe : FILE
 		$s2 = "Go build ID: \"5bgieaBe9PcZCZf23WFp/bCZ0AUHYlqQmX8GJASV6/fGxRLMDDYrTm1jcLMt8j/Wof3n5634bwiwLHFKHTn\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nemty : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in known bad samples"
 		author = "ditekSHen"
-		id = "512fe910-e38c-513c-b678-a0592bdc4ae2"
+		id = "9e15c5c6-3342-5389-9535-b60683c37829"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1575-L1588"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "246766ab1d2871b5c22323f622d39ce9fa9b46a2d43bace122ed5549484f3aac"
+		logic_hash = "v1_sha256_246766ab1d2871b5c22323f622d39ce9fa9b46a2d43bace122ed5549484f3aac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -264868,20 +262921,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nemty : FILE
 		$s6 = "Go build ID: \"KWssFDTp6mq16xlI5c0t/mQLgof0oyp-eYKqNYUFL/Np8S71zE5W5_BsJCpjsj/hXpFDaVCtay2509R05fd\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Qnapcrypt : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in known bad samples"
 		author = "ditekSHen"
-		id = "4cdea15f-d8fd-5720-ba25-eb60e9b0f9ce"
+		id = "b5c590c4-2813-5b5f-8024-94c4534f505c"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1590-L1598"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b3ee583c395701350c091041a72f988d1b5ae607b642b42152fcda29f9be63e2"
+		logic_hash = "v1_sha256_b3ee583c395701350c091041a72f988d1b5ae607b642b42152fcda29f9be63e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -264890,20 +262943,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Qnapcrypt : FILE
 		$s1 = "Go build ID: \"XcBqbQohm7UevdYNABvs/2RcJz1616naXSRu2xvTX/b6F3Jt1-5WAIexSyzeun/MpHqs5fJA5G2D9gVuUCe\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Snatch : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in known bad samples"
 		author = "ditekSHen"
-		id = "6ab6b7bc-c905-5ff9-8059-a2d512ba13b3"
+		id = "82e0156a-977e-52d4-8a07-4a688955e64b"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1600-L1610"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5a19c791ed0d829c4c97e35cfa604a8716bad3f02632712903d765db95ba87f6"
+		logic_hash = "v1_sha256_5a19c791ed0d829c4c97e35cfa604a8716bad3f02632712903d765db95ba87f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -264914,20 +262967,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Snatch : FILE
 		$s3 = "Go build ID: \"5zCy9jt7UZaIs5YPk4tt/1Yt6v7gCpDG---pRFyW-/7729nLSeKJik31ftz_Ve/Z5EVG3lWak3ynxNrJ4ih\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Godownloader : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in known bad samples"
 		author = "ditekSHen"
-		id = "da53c062-4a55-543d-b2b6-52acdf13febc"
+		id = "b344caa1-31b0-5db0-a61f-c34b3f7854ae"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1612-L1622"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e0f5ee6ade4608a8b5c5bd02bf5aef0fcb9cb1fe1cc3a9d00b1ace91e5d0d33f"
+		logic_hash = "v1_sha256_e0f5ee6ade4608a8b5c5bd02bf5aef0fcb9cb1fe1cc3a9d00b1ace91e5d0d33f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -264938,20 +262991,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Godownloader : FILE
 		$s3 = "Go build ID: \"MiW7XJnQsBXxlBHro8GW/HMqQknRgJg-mCXomgFRt/88ccKMrfA_s6AcOJs3aM/jSUAU_l3RrMzlV6ANEYE\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Ranumbot : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in known bad samples"
 		author = "ditekSHen"
-		id = "f368cd9d-f974-56cf-a2b5-bd300f30cedc"
+		id = "6e68ee27-d1cb-5550-8307-5898507a7041"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1624-L1633"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c3d0ba55ca2be1b11ebf1b82490c5d26f2b35958b31a7e55892e27f24bf4118f"
+		logic_hash = "v1_sha256_c3d0ba55ca2be1b11ebf1b82490c5d26f2b35958b31a7e55892e27f24bf4118f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -264961,20 +263014,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Ranumbot : FILE
 		$s2 = "Go build ID: \"NivDrAudWE-E6xtBXeww/3pv6fDzDqt4v0YxoTkPt/8vd79TNE-9Bt38ftxf_V/_GNqnqEUsRf-WTSmn8dM\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Banload : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in known bad samples"
 		author = "ditekSHen"
-		id = "5955afd5-f26f-5df1-b355-b8f168b694b0"
+		id = "f00fa107-172f-51cf-8498-5b6b8871a5eb"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1635-L1643"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "534de1ce161e5e27f380f96b83630aa75031f268658aa7e8ff8ecce82ed5d4cd"
+		logic_hash = "v1_sha256_534de1ce161e5e27f380f96b83630aa75031f268658aa7e8ff8ecce82ed5d4cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -264983,20 +263036,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Banload : FILE
 		$s1 = "Go build ID: \"a3629ee6ab610a57f242f59a3dd5e5f6de73da40\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Hive : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in Hive ransomware"
 		author = "ditekSHen"
-		id = "7d7f7757-de7b-52a7-aab0-8fda38a86fd1"
+		id = "59d892f3-9fe4-5e89-98aa-2cb7515c51b0"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1645-L1653"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f311a3661ea3a26ebca6cd283d1e219011acfdfbb13fa8b919ca2724b9f4aae7"
+		logic_hash = "v1_sha256_f311a3661ea3a26ebca6cd283d1e219011acfdfbb13fa8b919ca2724b9f4aae7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265005,20 +263058,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Hive : FILE
 		$s1 = "Go build ID: \"XDub7DGmWVQ2COC6W4If/XHMqRPf2lnJUiVkG1CR6/u_MaUU0go2UUmLb_INuv/WrZSyz-WMW1st_NaM935\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nodachi : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in Nodachi"
 		author = "ditekSHen"
-		id = "9d578768-7995-5fb0-8bf1-9c2221cdef80"
+		id = "1bb12adb-17d4-544f-8bea-4e20f1cb5e23"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1655-L1666"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "177269623e0f3850c37c6b203d9a637fa92c0ed3fa823cc8d885f28cb383bf7d"
+		logic_hash = "v1_sha256_177269623e0f3850c37c6b203d9a637fa92c0ed3fa823cc8d885f28cb383bf7d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265030,20 +263083,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nodachi : FILE
 		$s4 = "Go build ID: \"67RcwNspLH__QJrElMcB/zMJf7Go1s0ZoXqd30Lb_/NaJl4rfcuLEG5LeZ-Y4k/MzFNvW79enRRdx3LmA47\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gobrut : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in GoBrut"
 		author = "ditekSHen"
-		id = "65953012-fc84-50d0-b769-64df66d8a54b"
+		id = "38bad9e5-7d19-52e7-8ec7-e893aff03ac8"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1668-L1676"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "40c305f019cb31222fa75a24315764cb5e5356afaa72aefb59916d615a8fca28"
+		logic_hash = "v1_sha256_40c305f019cb31222fa75a24315764cb5e5356afaa72aefb59916d615a8fca28"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265052,20 +263105,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gobrut : FILE
 		$s1 = "Go build ID: \"sf_2_ylcjquGBe4mQ99L/aPvdLbM2z9HfoDN3RazG/8bhYeVA67N-ifbDYCDJe/UZzCu_EFL9f10gSfO4L0\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_Gobuildid_Biopassdropper : FILE
 {
 	meta:
 		description = "Detects Golang Build IDs in BioPass dropper"
 		author = "ditekSHen"
-		id = "b82d34d9-7774-5f99-9d76-b5426e015981"
+		id = "f69349a0-d3d4-5d09-aaf4-31efc1ea2b74"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1678-L1686"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3b586e886b9f901dde1c73aa07ce0d45e4ff417459f298094359ec1c1e02e522"
+		logic_hash = "v1_sha256_3b586e886b9f901dde1c73aa07ce0d45e4ff417459f298094359ec1c1e02e522"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265074,20 +263127,20 @@ rule DITEKSHEN_INDICATOR_KB_Gobuildid_Biopassdropper : FILE
 		$s1 = "Go build ID: \"OS0VlkdEIlcl3WDDr9Za/_oVwEipaaX6V4mEEYg2V/PytlyeIYgV65maz4wT2Y/IQvgbHv3bbLV42i10qq2\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Rhysida
 {
 	meta:
 		description = "Detects files referencing identities associated with Rhysida ransomware"
 		author = "ditekShen"
-		id = "7ee0fb41-9267-5b65-ada3-229f2e390da6"
+		id = "4c30fe6f-7379-5af7-941c-2d7f1004c154"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1688-L1697"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e3e07bab2982a30a5372e6708ede6707d132d410aa5b5b1a29bdb5d06910a88e"
+		logic_hash = "v1_sha256_e3e07bab2982a30a5372e6708ede6707d132d410aa5b5b1a29bdb5d06910a88e"
 		score = 75
 		quality = 71
 		tags = ""
@@ -265104,13 +263157,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Payola
 	meta:
 		description = "Detects files referencing identities associated with Payola ransomware"
 		author = "ditekShen"
-		id = "7c1fc06b-fc71-5679-befd-686b2e05e3a4"
+		id = "db39d8f2-21d7-5013-bdbe-d19f03539186"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1699-L1708"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "568141c03d14faef0cfc4f5fbdec45a5109a1ad5cbbe99e76a1db86e7ef4dc5d"
+		logic_hash = "v1_sha256_568141c03d14faef0cfc4f5fbdec45a5109a1ad5cbbe99e76a1db86e7ef4dc5d"
 		score = 75
 		quality = 71
 		tags = ""
@@ -265127,13 +263180,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Xorist
 	meta:
 		description = "Detects files referencing identities associated with Xorist ransomware"
 		author = "ditekShen"
-		id = "151d182c-c60a-54dd-a3d2-b32d27521b57"
+		id = "d95a280c-ee85-55c9-a988-20c8c136cf81"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1710-L1723"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5975a730ad1a1f7e54e95ec5897aa2940ccc3ed1aa8e83b38cb7ac836c233208"
+		logic_hash = "v1_sha256_5975a730ad1a1f7e54e95ec5897aa2940ccc3ed1aa8e83b38cb7ac836c233208"
 		score = 75
 		quality = 67
 		tags = ""
@@ -265154,13 +263207,13 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Blackhunt
 	meta:
 		description = "Detects files referencing identities associated with BlackHunt ransomware"
 		author = "ditekShen"
-		id = "87613fcc-7d9a-57ba-9653-c48760dd5ef0"
+		id = "6c158ed8-6a61-5a40-9e92-80ae8c523e30"
 		date = "2024-01-23"
 		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1725-L1739"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "6b875d4abdedc8032f89ab3cbdf4acdc855d83b5bcc08f96b2fbc38b4a5daa7f"
+		logic_hash = "v1_sha256_6b875d4abdedc8032f89ab3cbdf4acdc855d83b5bcc08f96b2fbc38b4a5daa7f"
 		score = 75
 		quality = 61
 		tags = ""
@@ -265177,20 +263230,18 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Blackhunt
 	condition:
 		any of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_JAVA_Packed_Allatori
 {
 	meta:
 		description = "Detects files packed with Allatori Java Obfuscator"
 		author = "ditekSHen"
-		id = "16b9f455-ba73-5f09-9822-8349c53fa965"
+		id = "aad2336b-b0c1-5db3-85c4-1e81e0239a89"
 		date = "2023-08-29"
 		modified = "2023-08-29"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_packed.yar#L113-L121"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ac48a573eb9d9fffe38d09993ff062f308edb07b8a7498e332cc3eb501d48db7"
+		logic_hash = "v1_sha256_ac48a573eb9d9fffe38d09993ff062f308edb07b8a7498e332cc3eb501d48db7"
 		score = 75
 		quality = 75
 		tags = ""
@@ -265202,20 +263253,18 @@ rule DITEKSHEN_INDICATOR_JAVA_Packed_Allatori
 	condition:
 		all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_EXE_Python_Byte_Compiled : FILE
 {
 	meta:
 		description = "Detects python-byte compiled executables"
 		author = "ditekSHen"
-		id = "04ae604c-6176-54cf-98e9-4386e52420f8"
+		id = "327718ed-cf7d-5658-b4aa-592d9f9d7c54"
 		date = "2023-08-29"
 		modified = "2023-08-29"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_packed.yar#L211-L220"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "212d525509a4d8fb7f1b5efa929526c8758549bfdb8591c88ce602315e6b3147"
+		logic_hash = "v1_sha256_212d525509a4d8fb7f1b5efa929526c8758549bfdb8591c88ce602315e6b3147"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265226,22 +263275,20 @@ rule DITEKSHEN_INDICATOR_EXE_Python_Byte_Compiled : FILE
 		$s2 = "decompress" ascii
 
 	condition:
-		uint32(0)==0x0a0df303 and filesize <5KB and all of them
+		uint32( 0 ) == 0x0a0df303 and filesize < 5KB and all of them
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_MSI_EXE2MSI : FILE
 {
 	meta:
 		description = "Detects executables converted to .MSI packages using a free online converter."
 		author = "ditekSHen"
-		id = "039df7b6-e4bf-5537-ae5b-f2168044e77e"
+		id = "9aec32aa-93e0-5983-ade4-4a5214d88ae7"
 		date = "2023-08-29"
 		modified = "2023-08-29"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_packed.yar#L222-L233"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "afd48b54766600805ae1aeef13b11de4ca160ea1f96419a4090ab9dae55fa4cd"
+		logic_hash = "v1_sha256_afd48b54766600805ae1aeef13b11de4ca160ea1f96419a4090ab9dae55fa4cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265254,22 +263301,20 @@ rule DITEKSHEN_INDICATOR_MSI_EXE2MSI : FILE
 		$title = "Exe to msi converter free" ascii
 
 	condition:
-		uint32(0)==0xe011cfd0 and ($winin and $title)
+		uint32( 0 ) == 0xe011cfd0 and ( $winin and $title )
 }
-import "pe"
-
 rule DITEKSHEN_INDICATOR_PY_Packed_Pyminifier : FILE
 {
 	meta:
 		description = "Detects python code potentially obfuscated using PyMinifier"
 		author = "ditekSHen"
-		id = "a111c116-a2b3-5689-8d44-221adf37e932"
+		id = "e71ab35e-8abf-5740-9b66-d61144cff712"
 		date = "2023-08-29"
 		modified = "2023-08-29"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_packed.yar#L331-L339"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "c7e916906d4654215de6d12e1bff790f24bcf69e97a7e5314a2a057a91b135a3"
+		logic_hash = "v1_sha256_c7e916906d4654215de6d12e1bff790f24bcf69e97a7e5314a2a057a91b135a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265279,20 +263324,20 @@ rule DITEKSHEN_INDICATOR_PY_Packed_Pyminifier : FILE
 		$s1 = "exec(lzma.decompress(base64.b64decode("
 
 	condition:
-		( uint32(0)==0x6f706d69 or uint16(0)==0x2123 or uint16(0)==0x0a0d or uint16(0)==0x5a4d) and all of them
+		( uint32( 0 ) == 0x6f706d69 or uint16( 0 ) == 0x2123 or uint16( 0 ) == 0x0a0d or uint16( 0 ) == 0x5a4d ) and all of them
 }
 rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_0199_1 : CVE_2017_0199 FILE
 {
 	meta:
 		description = "Detects RTF documents potentially exploiting CVE-2017-0199"
 		author = "ditekSHen"
-		id = "74b3702a-7b4d-58be-ad2c-c2b1cf0ebc50"
+		id = "c61403a9-043e-53c0-a843-efed9fd9b31f"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L1-L69"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "06b75267f00b775a6c1cd7a2022a9cfa0ea2c976f969c2c066be51449f197f58"
+		logic_hash = "v1_sha256_06b75267f00b775a6c1cd7a2022a9cfa0ea2c976f969c2c066be51449f197f58"
 		score = 75
 		quality = 75
 		tags = "CVE-2017-0199, FILE"
@@ -265332,20 +263377,20 @@ rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_0199_1 : CVE_2017_0199 FILE
 		$obj6 = "\\objlink" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($urlmoniker*) and 1 of ($ole*) and 1 of ($obj*)
+		uint32( 0 ) == 0x74725c7b and 1 of ( $urlmoniker* ) and 1 of ( $ole* ) and 1 of ( $obj* )
 }
 rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_1 : CVE_2017_8759 FILE
 {
 	meta:
 		description = "detects CVE-2017-8759 weaponized RTF documents."
 		author = "ditekSHen"
-		id = "8f873145-b909-5185-9f85-07c820d1f38e"
+		id = "149bfbc0-57fe-5351-a47c-a2e8471e521e"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L215-L238"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "595dc0153a2349fbd4f92dd544a3dfd05715059dd639653e7c7e6ac80624360e"
+		logic_hash = "v1_sha256_595dc0153a2349fbd4f92dd544a3dfd05715059dd639653e7c7e6ac80624360e"
 		score = 75
 		quality = 75
 		tags = "CVE-2017-8759, FILE"
@@ -265366,20 +263411,20 @@ rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_1 : CVE_2017_8759 FILE
 		$s4 = "!This program cannot be run in DOS mode" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($clsid*) and 1 of ($ole*) and 2 of ($s*)
+		uint32( 0 ) == 0x74725c7b and 1 of ( $clsid* ) and 1 of ( $ole* ) and 2 of ( $s* )
 }
 rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2 : CVE_2017_8759 FILE
 {
 	meta:
 		description = "detects CVE-2017-8759 weaponized RTF documents."
 		author = "ditekSHen"
-		id = "92c8f45e-3792-51b3-bda4-7e9eae0e9a80"
+		id = "8f616717-1bb1-57d6-bf31-fa05b9b0a723"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L240-L268"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "15c9a5cfce5d1a797bab049352d8506b8bc112cabe2f510019f5d203690419e8"
+		logic_hash = "v1_sha256_15c9a5cfce5d1a797bab049352d8506b8bc112cabe2f510019f5d203690419e8"
 		score = 75
 		quality = 75
 		tags = "CVE-2017-8759, FILE"
@@ -265403,20 +263448,20 @@ rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2 : CVE_2017_8759 FILE
 		$soap1 = "c7b0abec197fd211978e0000f8757e" ascii nocase
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($clsid*) and 1 of ($ole*) and (2 of ($obj*) or 1 of ($soap*))
+		uint32( 0 ) == 0x74725c7b and 1 of ( $clsid* ) and 1 of ( $ole* ) and ( 2 of ( $obj* ) or 1 of ( $soap* ) )
 }
 rule DITEKSHEN_INDICATOR_RTF_Exploit_Scripting : CVE_2017_8759 CVE_2017_8570 FILE
 {
 	meta:
 		description = "detects CVE-2017-8759 or CVE-2017-8570 weaponized RTF documents."
 		author = "ditekSHen"
-		id = "e8fd1231-3ef5-5b0b-987c-f55337804da3"
+		id = "b5a09bfb-d6ec-56c6-a93b-aaa1bc6a301b"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L270-L302"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a1f4c833f0132dcbe2b3677d6ac0f3597c152702515375d60d4332c21183bd76"
+		logic_hash = "v1_sha256_a1f4c833f0132dcbe2b3677d6ac0f3597c152702515375d60d4332c21183bd76"
 		score = 75
 		quality = 75
 		tags = "CVE-2017-8759, CVE-2017-8570, FILE"
@@ -265444,20 +263489,20 @@ rule DITEKSHEN_INDICATOR_RTF_Exploit_Scripting : CVE_2017_8759 CVE_2017_8570 FIL
 		$sct2 = { (3737|3537) (3733|3533) (3633|3433) (3732|3532) (3639|3439) (3730|3530) (3734|3534) (3245|3265) (3733|3533) (3638|3438) (3635|3435) (3643|3443) (3643|3443) }
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($clsid*) and 1 of ($ole*) and 1 of ($obj*) and 1 of ($sct*)
+		uint32( 0 ) == 0x74725c7b and 1 of ( $clsid* ) and 1 of ( $ole* ) and 1 of ( $obj* ) and 1 of ( $sct* )
 }
 rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Sheetmacroenabled : FILE
 {
 	meta:
 		description = "Detects RTF documents embedding an Excel sheet with macros enabled. Observed in exploit followed by dropper behavior"
 		author = "ditekSHen"
-		id = "342d10b3-61d2-5fcb-8f4f-1fe45049257b"
+		id = "7eb0f19f-877a-5ce4-b51b-799ccca35f86"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L304-L328"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cc3b52e549c2697c6e0a2fea365d193311d90d26854bd2fe321aa26c118975a0"
+		logic_hash = "v1_sha256_cc3b52e549c2697c6e0a2fea365d193311d90d26854bd2fe321aa26c118975a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265479,20 +263524,20 @@ rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Sheetmacroenabled : FILE
 		$obj7 = "\\mmath" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and (1 of ($ex*) and 1 of ($ole*) and 2 of ($obj*))
+		uint32( 0 ) == 0x74725c7b and ( 1 of ( $ex* ) and 1 of ( $ole* ) and 2 of ( $obj* ) )
 }
 rule DITEKSHEN_INDICATOR_OLE_Metadatacmd : FILE
 {
 	meta:
 		description = "Detects OLE documents with Windows command-line utilities commands (certutil, powershell, etc.) stored in the metadata (author, last modified by, etc.)."
 		author = "ditekSHen"
-		id = "63b23630-b344-5fba-95f4-950d072beaff"
+		id = "6045b583-8794-511a-ab45-d5aeac9adf5b"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L330-L349"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0562d026a1ad4510310ebff5da154064f92afc7bf714973f7de362435476772c"
+		logic_hash = "v1_sha256_0562d026a1ad4510310ebff5da154064f92afc7bf714973f7de362435476772c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265506,20 +263551,20 @@ rule DITEKSHEN_INDICATOR_OLE_Metadatacmd : FILE
 		$cmd6 = { 00 1E 00 00 00 [1-4] 00 00 (6E|4E) (65|45) (74|54) 2E (77|57) (65|45) (62|42) (63|43) (6C|4C) (69|49) (65|45) (6E|4E) (74|54) (00|20) }
 
 	condition:
-		uint16(0)==0xcfd0 and any of them
+		uint16( 0 ) == 0xcfd0 and any of them
 }
 rule DITEKSHEN_INDICATOR_RTF_Equation_Bitsadmin_Downloader : FILE
 {
 	meta:
 		description = "Detects RTF documents that references both Microsoft Equation Editor and BITSAdmin. Common exploit + dropper behavior."
 		author = "ditekSHen"
-		id = "e96a6f18-9a5e-58ca-829e-c82b444ad403"
+		id = "c18ddbf1-7087-5345-acfe-8527c10fbbbc"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L428-L451"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "39a07a0af243e929a6b3df48b6cf8a9d30bc8ef9e7deac494348945427b015e7"
+		logic_hash = "v1_sha256_39a07a0af243e929a6b3df48b6cf8a9d30bc8ef9e7deac494348945427b015e7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265539,20 +263584,20 @@ rule DITEKSHEN_INDICATOR_RTF_Equation_Bitsadmin_Downloader : FILE
 		$obj7 = "\\mmath" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and (($eq and $ba) and 1 of ($obj*))
+		uint32( 0 ) == 0x74725c7b and ( ( $eq and $ba ) and 1 of ( $obj* ) )
 }
 rule DITEKSHEN_INDICATOR_RTF_Equation_Certutil_Downloader : FILE
 {
 	meta:
 		description = "Detects RTF documents that references both Microsoft Equation Editor and CertUtil. Common exploit + dropper behavior."
 		author = "ditekSHen"
-		id = "a47f31f9-91fc-5009-8aff-2b9e334c3139"
+		id = "b1d36f9e-f272-5013-9501-7e08f568d2d0"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L453-L476"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d6c62957ce40ed755a84bd9aa8900e4990c466097d6df55c539b289bf50fe94e"
+		logic_hash = "v1_sha256_d6c62957ce40ed755a84bd9aa8900e4990c466097d6df55c539b289bf50fe94e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265572,20 +263617,20 @@ rule DITEKSHEN_INDICATOR_RTF_Equation_Certutil_Downloader : FILE
 		$obj7 = "\\mmath" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and (($eq and $cu) and 1 of ($obj*))
+		uint32( 0 ) == 0x74725c7b and ( ( $eq and $cu ) and 1 of ( $obj* ) )
 }
 rule DITEKSHEN_INDICATOR_RTF_Equation_Powershell_Downloader : FILE
 {
 	meta:
 		description = "Detects RTF documents that references both Microsoft Equation Editor and PowerShell. Common exploit + dropper behavior."
 		author = "ditekSHen"
-		id = "5d1d65ef-e183-5a0d-a0fa-d0d5f09f21a1"
+		id = "df0520ef-163f-5a39-85e0-29dc664aff4e"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L478-L501"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "0b8b9b7b40f8b4d659de9e025a65d5c6b64c6066bb618a3e7ed3c318f70befe5"
+		logic_hash = "v1_sha256_0b8b9b7b40f8b4d659de9e025a65d5c6b64c6066bb618a3e7ed3c318f70befe5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265605,20 +263650,20 @@ rule DITEKSHEN_INDICATOR_RTF_Equation_Powershell_Downloader : FILE
 		$obj7 = "\\mmath" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and (($ps and $eq) and 1 of ($obj*))
+		uint32( 0 ) == 0x74725c7b and ( ( $ps and $eq ) and 1 of ( $obj* ) )
 }
 rule DITEKSHEN_INDICATOR_RTF_LNK_Shell_Explorer_Execution : FILE
 {
 	meta:
 		description = "detects RTF files with Shell.Explorer.1 OLE objects with embedded LNK files referencing an executable."
 		author = "ditekSHen"
-		id = "2cac4dd8-086a-5220-a658-94cedd9cf7c3"
+		id = "62a964d9-61c9-5a66-825f-635b594d6e12"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L503-L517"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "4c11a37425e260692e11dc8fca317611106245d1590081a7038036ad568702f8"
+		logic_hash = "v1_sha256_4c11a37425e260692e11dc8fca317611106245d1590081a7038036ad568702f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265630,20 +263675,20 @@ rule DITEKSHEN_INDICATOR_RTF_LNK_Shell_Explorer_Execution : FILE
 		$file_url = "660069006c0065003a" ascii nocase
 
 	condition:
-		uint32(0)==0x74725c7b and filesize <1500KB and $clsid and $lnk_header and ($http_url or $file_url)
+		uint32( 0 ) == 0x74725c7b and filesize < 1500KB and $clsid and $lnk_header and ( $http_url or $file_url )
 }
 rule DITEKSHEN_INDICATOR_RTF_Forms_HTML_Execution : FILE
 {
 	meta:
 		description = "detects RTF files with Forms.HTML:Image.1 or Forms.HTML:Submitbutton.1 OLE objects referencing file or HTTP URLs."
 		author = "ditekSHen"
-		id = "26b21c94-9192-53be-808b-b553f87769e1"
+		id = "5456fe04-3b5e-5819-9429-459d8e7bb7b8"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L519-L533"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "5e8a2072971c40d6fbc0e0265a9adfbe4faa04d0f3c6962fda443da33aa06906"
+		logic_hash = "v1_sha256_5e8a2072971c40d6fbc0e0265a9adfbe4faa04d0f3c6962fda443da33aa06906"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265655,20 +263700,20 @@ rule DITEKSHEN_INDICATOR_RTF_Forms_HTML_Execution : FILE
 		$file_url = "660069006c0065003a" ascii nocase
 
 	condition:
-		uint32(0)==0x74725c7b and filesize <1500KB and ($img_clsid or $sub_clsid) and ($http_url or $file_url)
+		uint32( 0 ) == 0x74725c7b and filesize < 1500KB and ( $img_clsid or $sub_clsid ) and ( $http_url or $file_url )
 }
 rule DITEKSHEN_INDICATOR_PUB_MSIEXEC_Remote : FILE
 {
 	meta:
 		description = "detects VB-enable Microsoft Publisher files utilizing Microsoft Installer to retrieve remote files and execute them"
 		author = "ditekSHen"
-		id = "518db2bb-174b-54c4-b330-1e8a8e36265d"
+		id = "cd529d04-793b-5637-9628-46ec54be67de"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L535-L549"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "be5407e6e6e21e77f6de1d3a378996bfc6ce4326986aa03eb152e772bb495184"
+		logic_hash = "v1_sha256_be5407e6e6e21e77f6de1d3a378996bfc6ce4326986aa03eb152e772bb495184"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265683,20 +263728,20 @@ rule DITEKSHEN_INDICATOR_PUB_MSIEXEC_Remote : FILE
 		$s7 = "\\VBE6.DLL#" wide
 
 	condition:
-		uint16(0)==0xcfd0 and 6 of them
+		uint16( 0 ) == 0xcfd0 and 6 of them
 }
 rule DITEKSHEN_INDICATOR_RTF_Ancalog_Exploit_Builder_Document : FILE
 {
 	meta:
 		description = "Detects documents generated by Phantom Crypter/Ancalog"
 		author = "ditekSHen"
-		id = "01e7f949-8ced-5355-978c-34d6e639e61a"
+		id = "c138bca6-d792-5993-9d38-51f6fc6e5be4"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L551-L563"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "e458be78ca8975d067110dc38119437b3ffe55afdbfdab47468c9ed74bba9f9d"
+		logic_hash = "v1_sha256_e458be78ca8975d067110dc38119437b3ffe55afdbfdab47468c9ed74bba9f9d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265709,20 +263754,20 @@ rule DITEKSHEN_INDICATOR_RTF_Ancalog_Exploit_Builder_Document : FILE
 		$builder2 = "\\ancalog" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($builder*)
+		uint32( 0 ) == 0x74725c7b and 1 of ( $builder* )
 }
 rule DITEKSHEN_INDICATOR_RTF_Threadkit_Exploit_Builder_Document : FILE
 {
 	meta:
 		description = "Detects vaiations of RTF documents generated by ThreadKit builder."
 		author = "ditekSHen"
-		id = "f4a4e7f0-ea2f-523f-9634-a939dc90706e"
+		id = "0ccedd91-af38-5e0c-aaed-5379a54d749a"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L565-L582"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f2308ac6ae5345e0c783871dd6b471397ec83ba7194db5cc74c8984d84c2c0c2"
+		logic_hash = "v1_sha256_f2308ac6ae5345e0c783871dd6b471397ec83ba7194db5cc74c8984d84c2c0c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265738,20 +263783,20 @@ rule DITEKSHEN_INDICATOR_RTF_Threadkit_Exploit_Builder_Document : FILE
 		$pat1 = /\\objupdate\\v[\\\s\n\r]/ ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 2 of ($obj*) and 1 of ($pat*)
+		uint32( 0 ) == 0x74725c7b and 2 of ( $obj* ) and 1 of ( $pat* )
 }
 rule DITEKSHEN_INDICATOR_XML_Legacydrawing_Autoload_Document : FILE
 {
 	meta:
 		description = "detects AutoLoad documents using LegacyDrawing"
 		author = "ditekSHen"
-		id = "ce116601-7048-5a3f-9b73-5127ca3b359e"
+		id = "be48164b-037d-59f0-a2bd-26504ae71f23"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L584-L594"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a038636f5e8e7837c2209072f1659b921c8a9a48d4ed153e735915cf1f7f3fcc"
+		logic_hash = "v1_sha256_a038636f5e8e7837c2209072f1659b921c8a9a48d4ed153e735915cf1f7f3fcc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265762,20 +263807,20 @@ rule DITEKSHEN_INDICATOR_XML_Legacydrawing_Autoload_Document : FILE
 		$s3 = "autoLoad=\"true\"" ascii
 
 	condition:
-		uint32(0)==0x6d783f3c and all of ($s*)
+		uint32( 0 ) == 0x6d783f3c and all of ( $s* )
 }
 rule DITEKSHEN_INDICATOR_XML_OLE_Autoload_Document : FILE
 {
 	meta:
 		description = "detects AutoLoad documents using OLE Object"
 		author = "ditekSHen"
-		id = "b3d682c3-641a-554a-8607-e99d07e9a57d"
+		id = "e1e02fe1-d583-52f7-8263-cbff12407f40"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L596-L606"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b262a9f8e82dea55afc26acac731827b64f52069a2bf314f716832b3dfc2c04f"
+		logic_hash = "v1_sha256_b262a9f8e82dea55afc26acac731827b64f52069a2bf314f716832b3dfc2c04f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265786,20 +263831,20 @@ rule DITEKSHEN_INDICATOR_XML_OLE_Autoload_Document : FILE
 		$s3 = "Target=\"../embeddings/oleObject" ascii
 
 	condition:
-		uint32(0)==0x6d783f3c and all of ($s*)
+		uint32( 0 ) == 0x6d783f3c and all of ( $s* )
 }
 rule DITEKSHEN_INDICATOR_XML_Squiblydoo_1 : FILE
 {
 	meta:
 		description = "detects Squiblydoo variants extracted from exploit RTF documents."
 		author = "ditekSHen"
-		id = "cac326ab-cc31-59c1-bd12-285db1675695"
+		id = "4dddd68b-293c-5552-8937-aa4b78282b3e"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L608-L622"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "b52ebd76dd4e60f6bd5cb19fed3a72b6aeb90dea95f0d1be61dcfff39ea674ae"
+		logic_hash = "v1_sha256_b52ebd76dd4e60f6bd5cb19fed3a72b6aeb90dea95f0d1be61dcfff39ea674ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265814,20 +263859,20 @@ rule DITEKSHEN_INDICATOR_XML_Squiblydoo_1 : FILE
 		$r3 = ".run chr(" nocase ascii
 
 	condition:
-		( uint32(0)==0x4d583f3c or uint32(0)==0x6d783f3c) and $slt and 1 of ($ws*) and 1 of ($r*)
+		( uint32( 0 ) == 0x4d583f3c or uint32( 0 ) == 0x6d783f3c ) and $slt and 1 of ( $ws* ) and 1 of ( $r* )
 }
 rule DITEKSHEN_INDICATOR_OLE_Suspicious_Reverse : FILE
 {
 	meta:
 		description = "detects OLE documents containing VB scripts with reversed suspicious strings"
 		author = "ditekSHen"
-		id = "a7f4d18d-add6-5df2-9a8c-f88d8e3766da"
+		id = "8ec28f09-aa84-5799-b493-fa2035d684d4"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L624-L644"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "04950549eede23b7006103539f20437713a54138c073d9805048392ea0a3df2a"
+		logic_hash = "v1_sha256_04950549eede23b7006103539f20437713a54138c073d9805048392ea0a3df2a"
 		score = 65
 		quality = 71
 		tags = "FILE"
@@ -265845,20 +263890,20 @@ rule DITEKSHEN_INDICATOR_OLE_Suspicious_Reverse : FILE
 		$kw7 = "-JOIn" nocase ascii
 
 	condition:
-		uint16(0)==0xcfd0 and $vb and ((1 of ($cmd*) and 1 of ($kw*)) or (2 of ($kw*)))
+		uint16( 0 ) == 0xcfd0 and $vb and ( ( 1 of ( $cmd* ) and 1 of ( $kw* ) ) or ( 2 of ( $kw* ) ) )
 }
 rule DITEKSHEN_INDICATOR_OLE_Suspicious_Activex : FILE
 {
 	meta:
 		description = "detects OLE documents with suspicious ActiveX content"
 		author = "ditekSHen"
-		id = "e4a74955-8519-561d-bb23-6469e7ae5aaa"
+		id = "13bc3e82-ed25-532e-8b97-665ff54333c4"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L646-L676"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "d9a672b0eeccd93b4ae98fef45560490171f8fc16b712d1e0141fc0ef1d0e342"
+		logic_hash = "v1_sha256_d9a672b0eeccd93b4ae98fef45560490171f8fc16b712d1e0141fc0ef1d0e342"
 		score = 65
 		quality = 73
 		tags = "FILE"
@@ -265886,20 +263931,20 @@ rule DITEKSHEN_INDICATOR_OLE_Suspicious_Activex : FILE
 		$kw7 = { 41 63 74 69 76 65 44 6f 63 75 6d 65 6e 74 }
 
 	condition:
-		uint16(0)==0xcfd0 and $vb and 1 of ($ax*) and 2 of ($kw*)
+		uint16( 0 ) == 0xcfd0 and $vb and 1 of ( $ax* ) and 2 of ( $kw* )
 }
 rule DITEKSHEN_INDICATOR_OLE_Suspicious_MITRE_T1117 : T1117 FILE
 {
 	meta:
 		description = "Detects MITRE technique T1117 in OLE documents"
 		author = "ditekSHen"
-		id = "0f41b011-2b63-581f-aa10-9560f27d0a27"
+		id = "88694a38-bdba-5321-aa4c-b01803b12df4"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L678-L689"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f0d97f4de8bde18299ee0caee680a15070a1faa99fc318d144a7b7918c8cbb1f"
+		logic_hash = "v1_sha256_f0d97f4de8bde18299ee0caee680a15070a1faa99fc318d144a7b7918c8cbb1f"
 		score = 65
 		quality = 75
 		tags = "T1117, FILE"
@@ -265911,20 +263956,20 @@ rule DITEKSHEN_INDICATOR_OLE_Suspicious_MITRE_T1117 : T1117 FILE
 		$s4 = "HNjcm9iai5kbGw" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and 2 of them
+		uint16( 0 ) == 0xcfd0 and 2 of them
 }
 rule DITEKSHEN_INDICATOR_OLE_Remotetemplate
 {
 	meta:
 		description = "Detects XML relations where an OLE object is refrencing an external target in dropper OOXML documents"
 		author = "ditekSHen"
-		id = "fbf40436-fc0a-5e55-89ac-5e1dd93e1833"
+		id = "7ace8581-e087-58e0-ad4e-793ff361c7b7"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L691-L702"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "80cc5b1a8a8899f632401956055374d265c734449e56ffeee5f0ba4911050f36"
+		logic_hash = "v1_sha256_80cc5b1a8a8899f632401956055374d265c734449e56ffeee5f0ba4911050f36"
 		score = 75
 		quality = 75
 		tags = ""
@@ -265936,20 +263981,20 @@ rule DITEKSHEN_INDICATOR_OLE_Remotetemplate
 		$mode = "TargetMode=\"External" ascii
 
 	condition:
-		$olerel and $mode and 1 of ($target*)
+		$olerel and $mode and 1 of ( $target* )
 }
 rule DITEKSHEN_INDICATOR_RTF_Malver_Objects : FILE
 {
 	meta:
 		description = "Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents."
 		author = "ditekSHen"
-		id = "2d9d80e0-473e-5aac-a576-8f0002e120e2"
+		id = "1df08d1e-9753-566a-9a58-5d5879debb07"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L704-L718"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "69136fb8ba180f6f86e569471bcefe8f55c61af73c66ebd6062ba7369aee9a72"
+		logic_hash = "v1_sha256_69136fb8ba180f6f86e569471bcefe8f55c61af73c66ebd6062ba7369aee9a72"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -265963,20 +264008,20 @@ rule DITEKSHEN_INDICATOR_RTF_Malver_Objects : FILE
 		$obj6 = "\\objlink" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and (( not uint8(4)==0x66 or not uint8(5)==0x31 or not uint8(6)==0x5c) and 1 of ($obj*))
+		uint32( 0 ) == 0x74725c7b and ( ( not uint8( 4 ) == 0x66 or not uint8( 5 ) == 0x31 or not uint8( 6 ) == 0x5c ) and 1 of ( $obj* ) )
 }
 rule DITEKSHEN_INDICATOR_PPT_Mastermana : FILE
 {
 	meta:
 		description = "Detects known malicious pattern (MasterMana) in PowerPoint documents."
 		author = "ditekSHen"
-		id = "8e9b8185-6211-54c6-946d-b16f2226312a"
+		id = "993e0369-1853-539a-8a50-b2947a0810d9"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L720-L740"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "f8169e63b22fbbd48de9a63ff228d9d9fb105e95d2ea8a37c0993493515e8b2e"
+		logic_hash = "v1_sha256_f8169e63b22fbbd48de9a63ff228d9d9fb105e95d2ea8a37c0993493515e8b2e"
 		score = 75
 		quality = 71
 		tags = "FILE"
@@ -265997,20 +264042,20 @@ rule DITEKSHEN_INDICATOR_PPT_Mastermana : FILE
 		$i6 = "\\pm.j@" ascii wide
 
 	condition:
-		uint16(0)==0xcfd0 and 1 of ($i*) and $clsid and 1 of ($a*) and 1 of ($vb*)
+		uint16( 0 ) == 0xcfd0 and 1 of ( $i* ) and $clsid and 1 of ( $a* ) and 1 of ( $vb* )
 }
 rule DITEKSHEN_INDICATOR_XML_Webrelframe_Remotetemplate : FILE
 {
 	meta:
 		description = "Detects XML web frame relations refrencing an external target in dropper OOXML documents"
 		author = "ditekSHen"
-		id = "724650db-8d58-5e73-92e7-287890babc3b"
+		id = "cf7bb8e1-a8bc-5e33-b92b-6c9d1dd6eba9"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L742-L752"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "fbe209e31ddb4369de02b6e91bf65f0588089c7b838dcf80f182248790b59e20"
+		logic_hash = "v1_sha256_fbe209e31ddb4369de02b6e91bf65f0588089c7b838dcf80f182248790b59e20"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266021,20 +264066,20 @@ rule DITEKSHEN_INDICATOR_XML_Webrelframe_Remotetemplate : FILE
 		$mode = "TargetMode=\"External" ascii
 
 	condition:
-		uint32(0)==0x6d783f3c and (1 of ($target*) and $mode)
+		uint32( 0 ) == 0x6d783f3c and ( 1 of ( $target* ) and $mode )
 }
 rule DITEKSHEN_INDICATOR_PDF_Ipdropper : FILE
 {
 	meta:
 		description = "Detects PDF documents with Action and URL pointing to direct IP address"
 		author = "ditekSHen"
-		id = "83368671-f1ec-5b09-9d55-6e45e576ebdb"
+		id = "55cf6968-5704-5cc8-bb7f-e1514632ab35"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L754-L763"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "be37ee7ef5d8c980483f31bf5667c2dad4321d662be05c495ec6755362d33fd6"
+		logic_hash = "v1_sha256_be37ee7ef5d8c980483f31bf5667c2dad4321d662be05c495ec6755362d33fd6"
 		score = 60
 		quality = 35
 		tags = "FILE"
@@ -266044,20 +264089,20 @@ rule DITEKSHEN_INDICATOR_PDF_Ipdropper : FILE
 		$s2 = /\/URI \(http(s)?:\/\/([0-9]{1,3}\.){3}[0-9]{1,3}\// ascii
 
 	condition:
-		uint32(0)==0x46445025 and all of them
+		uint32( 0 ) == 0x46445025 and all of them
 }
 rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL1 : FILE
 {
 	meta:
 		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
 		author = "ditekSHen"
-		id = "4212d762-ea49-5884-b697-9313f43140d5"
+		id = "a08a3833-4622-5e8e-90c2-49ad799ce875"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L765-L789"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a3248027b83b982cccf235267aa27def4f640987d41c5f11509bde3e27b82fee"
+		logic_hash = "v1_sha256_a3248027b83b982cccf235267aa27def4f640987d41c5f11509bde3e27b82fee"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -266079,20 +264124,20 @@ rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL1 : FILE
 		$fa_js = ".js" ascii nocase
 
 	condition:
-		uint16(0)==0xcfd0 and (3 of ($s*) and 1 of ($fa*))
+		uint16( 0 ) == 0xcfd0 and ( 3 of ( $s* ) and 1 of ( $fa* ) )
 }
 rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL2 : FILE
 {
 	meta:
 		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
 		author = "ditekSHen"
-		id = "ea331976-6e5d-5377-a100-0f265e97177f"
+		id = "f752b909-b632-5241-8bd6-957687bebd6a"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L791-L812"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "48ab27a2f81934f6f2f034ebcd40fc083b0d90850d12a951f03dab3a4c396ec6"
+		logic_hash = "v1_sha256_48ab27a2f81934f6f2f034ebcd40fc083b0d90850d12a951f03dab3a4c396ec6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266114,20 +264159,20 @@ rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL2 : FILE
 		$x5 = "Reverse" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and (1 of ($e*) and 1 of ($a*) and (#x1>3 or 2 of ($x*)))
+		uint16( 0 ) == 0xcfd0 and ( 1 of ( $e* ) and 1 of ( $a* ) and ( #x1 > 3 or 2 of ( $x* ) ) )
 }
 rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Urldownloadtofile : FILE
 {
 	meta:
 		description = "Detects RTF documents that embed Excel documents for detection evation."
 		author = "ditekSHen"
-		id = "39b8723c-1755-5e2f-8fb2-cca5e9eef915"
+		id = "883f92e4-ab64-59f3-8b77-4deb432bef50"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L814-L840"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "9416664683c249a9dc2b3d506d9dea7067a638cc4ee5ef7138e5b33a8fcd2b96"
+		logic_hash = "v1_sha256_9416664683c249a9dc2b3d506d9dea7067a638cc4ee5ef7138e5b33a8fcd2b96"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266150,20 +264195,20 @@ rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Urldownloadtofile : FILE
 		$s2 = "55524c4d4f4e" ascii nocase
 
 	condition:
-		uint32(0)==0x74725c7b and (1 of ($clsid*) and 1 of ($obj*) and 1 of ($ole*) and 1 of ($s*))
+		uint32( 0 ) == 0x74725c7b and ( 1 of ( $clsid* ) and 1 of ( $obj* ) and 1 of ( $ole* ) and 1 of ( $s* ) )
 }
 rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL3 : FILE
 {
 	meta:
 		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
 		author = "ditekSHen"
-		id = "794cac49-e917-5282-8cbd-8ecf91a2dc9e"
+		id = "33cf3576-e6f9-589a-9f37-99ddbcd79911"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L842-L860"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "83eaf60b900119b9fcd458e9e9dda119fd71785821bf282e9385031368ff9891"
+		logic_hash = "v1_sha256_83eaf60b900119b9fcd458e9e9dda119fd71785821bf282e9385031368ff9891"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266182,20 +264227,20 @@ rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL3 : FILE
 		$s4 = "DllRegisterServer" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and 1 of ($a*) and all of ($s*) and #s1>3
+		uint16( 0 ) == 0xcfd0 and 1 of ( $a* ) and all of ( $s* ) and #s1 > 3
 }
 rule DITEKSHEN_INDICATOR_DOC_Phishingpatterns : FILE
 {
 	meta:
 		description = "Detects OLE, RTF, PDF and OOXML (decompressed) documents with common phishing strings"
 		author = "ditekSHen"
-		id = "67372eb5-ed07-5062-a12e-9ad8c7070f0f"
+		id = "125cd004-546f-5257-ac49-22154f9c0a95"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L862-L883"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "50b6566cb18512f887c07576391eb492101f7534da3460d5f7740ee6f4cf707d"
+		logic_hash = "v1_sha256_50b6566cb18512f887c07576391eb492101f7534da3460d5f7740ee6f4cf707d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266217,20 +264262,20 @@ rule DITEKSHEN_INDICATOR_DOC_Phishingpatterns : FILE
 		$s14 = "document created in earlier version of microsoft office" ascii nocase
 
 	condition:
-		( uint16(0)==0xcfd0 or uint32(0)==0x74725c7b or uint32(0)==0x46445025 or uint32(0)==0x6d783f3c) and 2 of them
+		( uint16( 0 ) == 0xcfd0 or uint32( 0 ) == 0x74725c7b or uint32( 0 ) == 0x46445025 or uint32( 0 ) == 0x6d783f3c ) and 2 of them
 }
 rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_EXEC : FILE
 {
 	meta:
 		description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet"
 		author = "ditekSHen"
-		id = "674ef310-d3bc-5e15-862f-29aa111becb3"
+		id = "fe89616e-613e-56b0-a00d-12f9080a495d"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L885-L898"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "ab3994e4082390f65d030db0b898a20df1d7e4b0ca2fdedc7a9d0f1480fd0334"
+		logic_hash = "v1_sha256_ab3994e4082390f65d030db0b898a20df1d7e4b0ca2fdedc7a9d0f1480fd0334"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266244,20 +264289,20 @@ rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_EXEC : FILE
 		$s4 = ">RUN(" ascii nocase
 
 	condition:
-		uint32(0)==0x6d783f3c and $ms and (2 of ($s*) or ($s3))
+		uint32( 0 ) == 0x6d783f3c and $ms and ( 2 of ( $s* ) or ( $s3 ) )
 }
 rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_Autoopenhidden : FILE
 {
 	meta:
 		description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet auto_open and state hidden"
 		author = "ditekSHen"
-		id = "c5aab620-5254-5fc6-b236-4fe0f69cbd8e"
+		id = "3ed60f98-34ef-5af1-806b-bd4b84925a55"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L900-L910"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "a93d8aa7ac025a0c2e8a9ac833f6d4c3cd3769ffca3f87455f43411d0021e828"
+		logic_hash = "v1_sha256_a93d8aa7ac025a0c2e8a9ac833f6d4c3cd3769ffca3f87455f43411d0021e828"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266268,20 +264313,20 @@ rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_Autoopenhidden : FILE
 		$s2 = "<definedName name=\"_xlnm.Auto_Open" ascii nocase
 
 	condition:
-		uint32(0)==0x6d783f3c and all of them
+		uint32( 0 ) == 0x6d783f3c and all of them
 }
 rule DITEKSHEN_INDICATOR_SUSPICOIUS_RTF_Encodedurl : FILE
 {
 	meta:
 		description = "Detects executables calling ClearMyTracksByProcess"
 		author = "ditekSHen"
-		id = "6b3f0434-24b2-5ae8-a6fc-c0fdded4996f"
+		id = "f8e3608f-f223-57fd-bd52-038c20deffdd"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L930-L941"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "cb791bb5e2af46ff9f1f07cef33bbd51edc44b2394d6f3eff31d39eaa5ff2a33"
+		logic_hash = "v1_sha256_cb791bb5e2af46ff9f1f07cef33bbd51edc44b2394d6f3eff31d39eaa5ff2a33"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266293,20 +264338,20 @@ rule DITEKSHEN_INDICATOR_SUSPICOIUS_RTF_Encodedurl : FILE
 		$s4 = "\\u-65434?\\u-65431?\\u-65428?\\u-65435?\\u-" ascii wide
 
 	condition:
-		uint32(0)==0x74725c7b and any of them
+		uint32( 0 ) == 0x74725c7b and any of them
 }
 rule DITEKSHEN_INDICATOR_RTF_Remotetemplate : CVE_2017_11882 FILE
 {
 	meta:
 		description = "Detects RTF documents potentially exploiting CVE-2017-11882"
 		author = "ditekSHen"
-		id = "59b31243-a360-531f-99ea-32b54d19ab52"
+		id = "66cd46ff-5c9d-511d-a8da-a2dbf7be44bc"
 		date = "2024-09-06"
 		modified = "2024-09-06"
 		reference = "https://github.com/ditekshen/detection"
 		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L943-L953"
 		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
-		logic_hash = "3a75072bc4d9c7dc53220afe359911c04cd3267c142058352de80ec430a53517"
+		logic_hash = "v1_sha256_3a75072bc4d9c7dc53220afe359911c04cd3267c142058352de80ec430a53517"
 		score = 60
 		quality = 35
 		tags = "CVE-2017-11882, FILE"
@@ -266317,13 +264362,13 @@ rule DITEKSHEN_INDICATOR_RTF_Remotetemplate : CVE_2017_11882 FILE
 		$s3 = "{\\*\\template \\u-" ascii nocase
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of them
+		uint32( 0 ) == 0x74725c7b and 1 of them
 }
 /*
  * YARA Rule Set
  * Repository Name: WithSecureLabs
  * Repository: https://github.com/WithSecureLabs/iocs
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c
  * Number of Rules: 5
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -266363,13 +264408,13 @@ rule WITHSECURELABS_SILKLOADER
 	meta:
 		description = "Detects SILKLOADER samples"
 		author = "WithSecure"
-		id = "bb8a543e-fdbf-5be1-901e-3e2a9965fd62"
+		id = "e2282d83-3112-57ad-9841-482cf973a77e"
 		date = "2023-03-15"
 		modified = "2023-03-15"
 		reference = "https://labs.withsecure.com/publications/silkloader"
 		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/SILKLOADER/silkloader.yar#L2-L20"
 		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "48aa249ea78e5a3bfe9934fd0dfa26b79f9e6cbe1e5b1426b84f8d8a3d77d742"
+		logic_hash = "v1_sha256_48aa249ea78e5a3bfe9934fd0dfa26b79f9e6cbe1e5b1426b84f8d8a3d77d742"
 		score = 75
 		quality = 75
 		tags = ""
@@ -266383,7 +264428,7 @@ rule WITHSECURELABS_SILKLOADER
 		$str2 = {760062006300630073006200}
 
 	condition:
-		pe.is_pe and pe.characteristics&pe.DLL and all of them
+		pe.is_pe and pe.characteristics & pe.DLL and all of them
 }
 import "pe"
 
@@ -266392,13 +264437,13 @@ rule WITHSECURELABS_Ducktail_Nativeaot : FILE
 	meta:
 		description = "Detects NativeAOT variants of DUCKTAIL malware"
 		author = "WithSecure"
-		id = "1961d3e1-987b-588b-bfc2-8239797cd049"
+		id = "bfe6cacd-5b88-5c64-86a1-6273cb8d8d64"
 		date = "2022-11-17"
 		modified = "2022-11-22"
 		reference = "https://labs.withsecure.com/publications/ducktail_returns"
 		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/DUCKTAIL/ducktail_nativeaot.yara#L2-L22"
 		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "976b28ac45e5a13d4ce900b857e6bd3afc82b65b0235791fd698b762287cd60e"
+		logic_hash = "v1_sha256_976b28ac45e5a13d4ce900b857e6bd3afc82b65b0235791fd698b762287cd60e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266408,20 +264453,20 @@ rule WITHSECURELABS_Ducktail_Nativeaot : FILE
 		hash3 = "d1f6b5f9718a2fe9eaac0c1a627228d3f3b86f87"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >15MB and (pe.section_index(".managed")>=0 or pe.exports("DotNetRuntimeDebugHeader")) and pe.exports("SendFile") and pe.exports("Start") and pe.exports("Open")
+		uint16( 0 ) == 0x5A4D and filesize > 15MB and ( pe.section_index ( ".managed" ) >= 0 or pe.exports ( "DotNetRuntimeDebugHeader" ) ) and pe.exports ( "SendFile" ) and pe.exports ( "Start" ) and pe.exports ( "Open" )
 }
 rule WITHSECURELABS_Ducktail_Artifacts : FILE
 {
 	meta:
 		description = "Detects artifacts found in files associated to DUCKTAIL malware"
 		author = "WithSecure"
-		id = "937c9688-b74f-5e02-838f-ab6757a8d2a1"
+		id = "69ea6739-d743-5e62-8242-4aab51320c4f"
 		date = "2022-07-18"
 		modified = "2022-07-26"
 		reference = "https://labs.withsecure.com/publications/ducktail"
 		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/DUCKTAIL/ducktail_artifacts.yar#L1-L20"
 		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "1daa5e654058c802826b6a306b5bfc9d0c05c4ee54607e94e618a8d409ce74d9"
+		logic_hash = "v1_sha256_1daa5e654058c802826b6a306b5bfc9d0c05c4ee54607e94e618a8d409ce74d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -266437,20 +264482,20 @@ rule WITHSECURELABS_Ducktail_Artifacts : FILE
 		$email = "ductai2308@gmail.com" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule WITHSECURELABS_Ducktail_Dotnet_Core_Infostealer : FILE
 {
 	meta:
 		description = "Detects DUCKTAIL malware written in .NET Core"
 		author = "WithSecure"
-		id = "22eef7ce-9e11-55ec-9f0b-00a6776f8eee"
+		id = "edddfd83-7d75-5cd9-959a-bfcd02a7d1d6"
 		date = "2022-07-18"
 		modified = "2022-07-25"
 		reference = "https://labs.withsecure.com/publications/ducktail"
 		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/DUCKTAIL/ducktail_dotnet_core_infostealer.yar#L1-L103"
 		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "81b4da5860894397e9cd416e451c3098f8560407cd79f070f8edd5a3ba91512a"
+		logic_hash = "v1_sha256_81b4da5860894397e9cd416e451c3098f8560407cd79f070f8edd5a3ba91512a"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -266540,7 +264585,7 @@ rule WITHSECURELABS_Ducktail_Dotnet_Core_Infostealer : FILE
 		$browser_str_22 = "encrypted_key\":\"" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and $dotnet_core_bundle_signature and ((7 of ($fb_str_*) and (7 of ($browser_str_*) or 3 of ($exfil_str_*))) or (7 of ($browser_str_*) and 3 of ($exfil_str_*)))
+		uint16( 0 ) == 0x5A4D and $dotnet_core_bundle_signature and ( ( 7 of ( $fb_str_* ) and ( 7 of ( $browser_str_* ) or 3 of ( $exfil_str_* ) ) ) or ( 7 of ( $browser_str_* ) and 3 of ( $exfil_str_* ) ) )
 }
 import "pe"
 
@@ -266549,13 +264594,13 @@ rule WITHSECURELABS_Kapeka_Backdoor : FILE
 	meta:
 		description = "Detects Kapeka backdoor based on common strings."
 		author = "WithSecure"
-		id = "7b874a4a-a009-5365-9c31-ca61bf5ab491"
+		id = "5290a735-9ffe-5a79-9e0e-bf6ea762cbfc"
 		date = "2024-04-17"
 		modified = "2024-04-17"
 		reference = "https://labs.withsecure.com/publications/kapeka"
 		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/Kapeka/kapeka_backdoor.yar#L2-L21"
 		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "49795c6e3f3690eeccd731a9ba0c6bd8d5840d9171939e71d3a4d6f0d1834f05"
+		logic_hash = "v1_sha256_49795c6e3f3690eeccd731a9ba0c6bd8d5840d9171939e71d3a4d6f0d1834f05"
 		score = 75
 		quality = 25
 		tags = "FILE"
@@ -266572,13 +264617,13 @@ rule WITHSECURELABS_Kapeka_Backdoor : FILE
 		$e = "2: " wide
 
 	condition:
-		pe.is_dll() and filesize >50000 and filesize <500000 and 4 of them
+		pe.is_dll( ) and filesize > 50000 and filesize < 500000 and 4 of them
 }
 /*
  * YARA Rule Set
  * Repository Name: HarfangLab
  * Repository: https://github.com/HarfangLab/iocs
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: 8dd8e9296b110ce3fb13bc557a0295dff8c4c357
  * Number of Rules: 18
  * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -266593,14 +264638,14 @@ rule HARFANGLAB_Masepie_Campaign_Htmlstarter : FILE
 	meta:
 		description = "Detect Malicious Web page HTML file from CERT-UA#8399"
 		author = "HarfangLab"
-		id = "0cca485c-7941-5760-8c24-d993dcbf376d"
+		id = "84611cb9-494f-51dc-8f44-d30a4f5f70c2"
 		date = "2024-01-24"
 		modified = "2024-09-05"
 		reference = "TRR240101;https://cert.gov.ua/article/6276894"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L1-L16"
 		license_url = "N/A"
 		hash = "628bc9f4aa71a015ec415d5d7d8cb168359886a231e17ecac2e5664760ee8eba"
-		logic_hash = "d131372c6ad01ae77e5630bae0c0a04ce311718eb1bcf423e6575f3b0ecdba5d"
+		logic_hash = "v1_sha256_d131372c6ad01ae77e5630bae0c0a04ce311718eb1bcf423e6575f3b0ecdba5d"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -266611,21 +264656,21 @@ rule HARFANGLAB_Masepie_Campaign_Htmlstarter : FILE
 		$s2 = "src=\".\\Capture" ascii wide
 
 	condition:
-		filesize >600 and filesize <5KB and ( all of them )
+		filesize > 600 and filesize < 5KB and ( all of them )
 }
 rule HARFANGLAB_Masepie_Campaign_Webdavlnk : FILE
 {
 	meta:
 		description = "Detect Malicious LNK from CERT-UA#8399"
 		author = "HarfangLab"
-		id = "de7fd592-e733-52d0-af9b-55adf37eaf74"
+		id = "0bc10990-c6df-5398-9b15-657629e23f4a"
 		date = "2024-01-24"
 		modified = "2024-09-05"
 		reference = "TRR240101;https://cert.gov.ua/article/6276894"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L17-L39"
 		license_url = "N/A"
 		hash = "19d0c55ac466e4188c4370e204808ca0bc02bba480ec641da8190cb8aee92bdc"
-		logic_hash = "26075e47b54404c55f4ca5eb757efa2b1711d919de0ffbfbdf6935e2e4dd3f3d"
+		logic_hash = "v1_sha256_26075e47b54404c55f4ca5eb757efa2b1711d919de0ffbfbdf6935e2e4dd3f3d"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -266639,21 +264684,21 @@ rule HARFANGLAB_Masepie_Campaign_Webdavlnk : FILE
 		$s2 = "desktop-q0f4sik" ascii fullword
 
 	condition:
-		filesize >1200 and filesize <5KB and ( uint16be(0)==0x4c00) and (( all of ($a*)) or ( any of ($s*)))
+		filesize > 1200 and filesize < 5KB and ( uint16be( 0 ) == 0x4c00 ) and ( ( all of ( $a* ) ) or ( any of ( $s* ) ) )
 }
 rule HARFANGLAB_Masepie_Campaign_Masepie : FILE
 {
 	meta:
 		description = "Detect MASEPIE from CERT-UA#8399"
 		author = "HarfangLab"
-		id = "f0a034fa-38d4-5c54-b865-f830f85e245e"
+		id = "238a8d03-fd62-5642-b19a-207c6b91fcf9"
 		date = "2024-01-24"
 		modified = "2024-09-05"
 		reference = "TRR240101;https://cert.gov.ua/article/6276894"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L40-L60"
 		license_url = "N/A"
 		hash = "18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6"
-		logic_hash = "02da8119267978e63e3ee5ecdefb52285718f8875ec64d320f2752460c05588d"
+		logic_hash = "v1_sha256_02da8119267978e63e3ee5ecdefb52285718f8875ec64d320f2752460c05588d"
 		score = 75
 		quality = 78
 		tags = "FILE"
@@ -266669,21 +264714,21 @@ rule HARFANGLAB_Masepie_Campaign_Masepie : FILE
 		$a3 = "os.popen('whoami').read()" ascii wide fullword
 
 	condition:
-		filesize >2KB and filesize <15MB and (4 of them )
+		filesize > 2KB and filesize < 15MB and ( 4 of them )
 }
 rule HARFANGLAB_Masepie_Campaign_Oceanmap : FILE
 {
 	meta:
 		description = "Detect OCEANMAP from CERT-UA#8399"
 		author = "HarfangLab"
-		id = "7dcbce01-ab91-56ae-8789-e2e25ba1bf8c"
+		id = "a2e4e5b9-1bf8-51f8-9aed-6c6338dcd444"
 		date = "2024-01-24"
 		modified = "2024-01-31"
 		reference = "TRR240101;https://cert.gov.ua/article/6276894"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L61-L95"
 		license_url = "N/A"
 		hash = "24fd571600dcc00bf2bb8577c7e4fd67275f7d19d852b909395bebcbb1274e04"
-		logic_hash = "5fe244025f49358b4285e1272489378a46363ae915881dece26691d971aa93f3"
+		logic_hash = "v1_sha256_5fe244025f49358b4285e1272489378a46363ae915881dece26691d971aa93f3"
 		score = 75
 		quality = 78
 		tags = "FILE"
@@ -266709,20 +264754,20 @@ rule HARFANGLAB_Masepie_Campaign_Oceanmap : FILE
 		$t9 = "cmd.exe" wide fullword
 
 	condition:
-		filesize >8KB and filesize <100KB and ( uint16be(0)==0x4D5A) and $dotNet and (3 of ($a*)) and (2 of ($t*))
+		filesize > 8KB and filesize < 100KB and ( uint16be( 0 ) == 0x4D5A ) and $dotNet and ( 3 of ( $a* ) ) and ( 2 of ( $t* ) )
 }
 rule HARFANGLAB_Allasenhamaycampaign_Executorloader
 {
 	meta:
 		description = "Detects Delphi ExecutorLoader DLLs and executables."
 		author = "HarfangLab"
-		id = "0a09414d-cd86-54a4-99e4-121a7df7624b"
+		id = "fd1c5669-23f4-5594-9a02-2d0bf07674bb"
 		date = "2024-05-28"
 		modified = "2024-09-05"
 		reference = "TRR240501"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L96-L114"
 		license_url = "N/A"
-		logic_hash = "61aa0bf180574856e57d0b26442bfa6f4b1e25844611d6eadaed529e1bb86625"
+		logic_hash = "v1_sha256_61aa0bf180574856e57d0b26442bfa6f4b1e25844611d6eadaed529e1bb86625"
 		score = 75
 		quality = 55
 		tags = ""
@@ -266737,20 +264782,20 @@ rule HARFANGLAB_Allasenhamaycampaign_Executorloader
 		$default2 = "Default~" wide fullword
 
 	condition:
-		$delphi and all of ($s*) and any of ($default*)
+		$delphi and all of ( $s* ) and any of ( $default* )
 }
 rule HARFANGLAB_Allasenhamaycampaign_Allasenha
 {
 	meta:
 		description = "Detects AllaSenha banking trojan DLLs."
 		author = "HarfangLab"
-		id = "787c4e66-2053-5f14-a52e-6b0415700e8c"
+		id = "886530c9-d4d4-5b01-a483-8c9fe8d3f6be"
 		date = "2024-05-28"
 		modified = "2024-09-05"
 		reference = "TRR240501"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L115-L137"
 		license_url = "N/A"
-		logic_hash = "affe75ade6c8d9eeba00006f78678a48b1cfc5ffa9f9675fdea6ffd6cb3a02bd"
+		logic_hash = "v1_sha256_affe75ade6c8d9eeba00006f78678a48b1cfc5ffa9f9675fdea6ffd6cb3a02bd"
 		score = 75
 		quality = 80
 		tags = ""
@@ -266770,21 +264815,21 @@ rule HARFANGLAB_Allasenhamaycampaign_Allasenha
 		$dga = { 76 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 78 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 7A 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 77 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 6B 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 79 00 00 00 }
 
 	condition:
-		$dga and (4 of ($a*))
+		$dga and ( 4 of ( $a* ) )
 }
 rule HARFANGLAB_Charmingkitten_Cyclops : FILE
 {
 	meta:
 		description = "Detects Cyclops Golang Malware"
 		author = "HarfangLab"
-		id = "2cc7b2ff-25ca-5eac-a607-c3ee5136e0aa"
+		id = "4323493e-771e-50a3-a158-82922983a945"
 		date = "2024-08-05"
 		modified = "2024-09-05"
 		reference = "TRR240801"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L254-L274"
 		license_url = "N/A"
 		hash = "fafa68e626f1b789261c4dd7fae692756cf71881c7273260af26ca051a094a69"
-		logic_hash = "70ab3f44b6889d478a94dc6aefcd30f0e82e0b80bcf26921167b72f35bdb7fa8"
+		logic_hash = "v1_sha256_70ab3f44b6889d478a94dc6aefcd30f0e82e0b80bcf26921167b72f35bdb7fa8"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -266798,21 +264843,21 @@ rule HARFANGLAB_Charmingkitten_Cyclops : FILE
 		$a4 = "/JD-M42KItJncJfqb38qh/" ascii
 
 	condition:
-		filesize >2MB and filesize <20MB and ( uint16(0)==0x5A4D) and $go and (2 of ($a*))
+		filesize > 2MB and filesize < 20MB and ( uint16( 0 ) == 0x5A4D ) and $go and ( 2 of ( $a* ) )
 }
 rule HARFANGLAB_Samecoin_Campaign_Loader : FILE
 {
 	meta:
 		description = "Matches the loader used in the SameCoin campaign"
 		author = "HarfangLab"
-		id = "ab4d59f6-300d-5cdf-b91f-87f8cc1f0eac"
+		id = "1d7849d6-b91a-57e2-b726-d83ac16e32a2"
 		date = "2024-02-13"
 		modified = "2024-09-05"
 		reference = "TRR240201"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L275-L295"
 		license_url = "N/A"
 		hash = "cff976d15ba6c14c501150c63b69e6c06971c07f8fa048a9974ecf68ab88a5b6"
-		logic_hash = "7df04ab208d2caa5a137b1c3481ef734df54bbe8330979f524b16e9ba8cf48d5"
+		logic_hash = "v1_sha256_7df04ab208d2caa5a137b1c3481ef734df54bbe8330979f524b16e9ba8cf48d5"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -266829,21 +264874,21 @@ rule HARFANGLAB_Samecoin_Campaign_Loader : FILE
 		$wl_5 = "C:\\Users\\Public\\Windows Defender Agent.exe"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >5MB and filesize <7MB and $hebrew_layout and $runas and $jpg_magic and 3 of ($wl_*)
+		uint16( 0 ) == 0x5A4D and filesize > 5MB and filesize < 7MB and $hebrew_layout and $runas and $jpg_magic and 3 of ( $wl_* )
 }
 rule HARFANGLAB_Samecoin_Campaign_Wiper : FILE
 {
 	meta:
 		description = "Matches the wiper used in the SameCoin campaign"
 		author = "HarfangLab"
-		id = "695e9181-cc96-5212-b33c-4d55065b7b85"
+		id = "47dd5d28-275f-55a5-87b6-d176a59f45be"
 		date = "2024-02-13"
 		modified = "2024-09-05"
 		reference = "TRR240201"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L296-L314"
 		license_url = "N/A"
 		hash = "e6d2f43622e3ecdce80939eec9fffb47e6eb7fc0b9aa036e9e4e07d7360f2b89"
-		logic_hash = "ebe7c90398464ecf74ede17551c2ebc58b851ba6502092320934d1f5353581a2"
+		logic_hash = "v1_sha256_ebe7c90398464ecf74ede17551c2ebc58b851ba6502092320934d1f5353581a2"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -266858,21 +264903,21 @@ rule HARFANGLAB_Samecoin_Campaign_Wiper : FILE
 		$wl_5 = "C:\\Users\\Public\\Windows Defender Agent.exe" ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <200KB and $code and 3 of ($wl_*)
+		uint16( 0 ) == 0x5A4D and filesize < 200KB and $code and 3 of ( $wl_* )
 }
 rule HARFANGLAB_Samecoin_Campaign_Tasksspreader : FILE
 {
 	meta:
 		description = "Detect .NET Task Scheduler that is dropper by SameCoin Loader"
 		author = "HarfangLab"
-		id = "7dcfdecd-00c3-502a-b29e-a10a1fd9543f"
+		id = "eca68933-6e47-5978-8b5a-30bc6ba8022b"
 		date = "2024-02-13"
 		modified = "2024-09-05"
 		reference = "TRR240201"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L315-L352"
 		license_url = "N/A"
 		hash = "b447ba4370d9becef9ad084e7cdf8e1395bafde1d15e82e23ca1b9808fef13a7"
-		logic_hash = "61d602c343365608e5bc587ee9c7898e256f2411d78c7fe74c211e68bf4ab707"
+		logic_hash = "v1_sha256_61d602c343365608e5bc587ee9c7898e256f2411d78c7fe74c211e68bf4ab707"
 		score = 75
 		quality = 78
 		tags = "FILE"
@@ -266899,21 +264944,21 @@ rule HARFANGLAB_Samecoin_Campaign_Tasksspreader : FILE
 		$c6 = "(objectClass=computer)" wide fullword
 
 	condition:
-		filesize >8KB and filesize <40KB and ( uint16be(0)==0x4D5A) and $dotNet and (4 of ($a*)) and ((( any of ($b*)) and ( any of ($c*))) or ( all of ($c*)))
+		filesize > 8KB and filesize < 40KB and ( uint16be( 0 ) == 0x4D5A ) and $dotNet and ( 4 of ( $a* ) ) and ( ( ( any of ( $b* ) ) and ( any of ( $c* ) ) ) or ( all of ( $c* ) ) )
 }
 rule HARFANGLAB_Samecoin_Campaign_Nativewiper : FILE
 {
 	meta:
 		description = "Matches the native Android library used in the SameCoin campaign"
 		author = "HarfangLab"
-		id = "9c77c26e-50f7-5ee4-bc6b-c0333e268b2c"
+		id = "4d090fa1-0c9f-5c06-a9ff-4577ba94b8e1"
 		date = "2024-02-13"
 		modified = "2024-09-05"
 		reference = "TRR240201"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L353-L373"
 		license_url = "N/A"
 		hash = "248054658277e6971eb0b29e2f44d7c3c8d7c5abc7eafd16a3df6c4ca555e817"
-		logic_hash = "2779664830df3b5be72b7fe7d4da3d27e2a86b289ee3974596abf1df12317cd8"
+		logic_hash = "v1_sha256_2779664830df3b5be72b7fe7d4da3d27e2a86b289ee3974596abf1df12317cd8"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -266930,20 +264975,20 @@ rule HARFANGLAB_Samecoin_Campaign_Nativewiper : FILE
 		$s4 = "Current Chunk Size is:  %dl\n" ascii
 
 	condition:
-		filesize <500KB and uint32(0)==0x464C457F and ($native_export or all of ($f*) or all of ($s*))
+		filesize < 500KB and uint32( 0 ) == 0x464C457F and ( $native_export or all of ( $f* ) or all of ( $s* ) )
 }
 rule HARFANGLAB_Supposed_Grasshopper_Downloader : FILE
 {
 	meta:
 		description = "Detects the Nim downloader from the Supposed Grasshopper campaign."
 		author = "HarfangLab"
-		id = "e53656b5-a1be-53f0-a4d4-908f24e08bd6"
+		id = "5065f9b3-09b8-535d-9f2a-9973a1940f06"
 		date = "2024-06-20"
 		modified = "2024-09-05"
 		reference = "TRR240601"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L374-L389"
 		license_url = "N/A"
-		logic_hash = "93509319ab8028b0215fcfb81d1ff5d3d810922999f1dd8359b706a965221b2f"
+		logic_hash = "v1_sha256_93509319ab8028b0215fcfb81d1ff5d3d810922999f1dd8359b706a965221b2f"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -266956,20 +265001,20 @@ rule HARFANGLAB_Supposed_Grasshopper_Downloader : FILE
 		$function_2 = "toByteSeq" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule HARFANGLAB_Donut_Shellcode : FILE
 {
 	meta:
 		description = "Detects Donut shellcode in memory."
 		author = "HarfangLab"
-		id = "54facb12-3f33-5430-b4bf-0d223dc2a413"
+		id = "25c9a234-cd43-545f-a059-acc7bd9bf6b0"
 		date = "2024-06-20"
 		modified = "2024-09-05"
 		reference = "TRR240601"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L390-L438"
 		license_url = "N/A"
-		logic_hash = "1bf4e253195e39cc0b3cf45797c35a9f06078350aa35e65d9d36adbcc09a150b"
+		logic_hash = "v1_sha256_1bf4e253195e39cc0b3cf45797c35a9f06078350aa35e65d9d36adbcc09a150b"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -266987,21 +265032,21 @@ rule HARFANGLAB_Donut_Shellcode : FILE
 		$function_5 = "AmsiScanString" ascii
 
 	condition:
-		uint8(0)==0xE8 and ((#amsi_patch>1 and $wldp_patch and $api_hashing) or ($loaded_dlls and all of ($function_*)))
+		uint8( 0 ) == 0xE8 and ( ( #amsi_patch > 1 and $wldp_patch and $api_hashing ) or ( $loaded_dlls and all of ( $function_* ) ) )
 }
 rule HARFANGLAB_Muddywater_Ateraagent_Operators : FILE
 {
 	meta:
 		description = "Detect Atera Agent abused by MuddyWater"
 		author = "HarfangLab"
-		id = "1494a0da-92de-5cfb-a870-325d02e2cdfb"
+		id = "c35ac6e1-6f61-5983-a62d-2494e299d640"
 		date = "2024-04-17"
 		modified = "2024-09-05"
 		reference = "TRR240402"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L439-L469"
 		license_url = "N/A"
 		hash = "9b49d6640f5f0f1d68f649252a96052f1d2e0822feadd7ebe3ab6a3cadd75985"
-		logic_hash = "63d5d3a6723191dccd20c8d9f25607df512b91f57ac891ef8c87b2dd107ee5a2"
+		logic_hash = "v1_sha256_63d5d3a6723191dccd20c8d9f25607df512b91f57ac891ef8c87b2dd107ee5a2"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -267026,21 +265071,21 @@ rule HARFANGLAB_Muddywater_Ateraagent_Operators : FILE
 		$cert2 = { 06 7F 60 47 95 66 24 A7 15 99 61 74 3D 81 94 93 }
 
 	condition:
-		filesize >1MB and filesize <4MB and ( uint16be(0)==0xD0CF) and any of ($s*) and any of ($cert*)
+		filesize > 1MB and filesize < 4MB and ( uint16be( 0 ) == 0xD0CF ) and any of ( $s* ) and any of ( $cert* )
 }
 rule HARFANGLAB_Apt31_Rawdoor_Dropper : FILE
 {
 	meta:
 		description = "Matches the RawDoor dropper"
 		author = "HarfangLab"
-		id = "b278a157-20e2-5271-aca0-0692929b881d"
+		id = "e16c61c8-7b17-5ea7-b8f2-00dd35f2ea82"
 		date = "2024-04-12"
 		modified = "2024-09-05"
 		reference = "TRR240401"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L470-L491"
 		license_url = "N/A"
 		hash = "c3056e39f894ff73bba528faac04a1fc86deeec57641ad882000d7d40e5874be"
-		logic_hash = "d0cbe02c4fafb4895bd0126d2496802a3fee6a0362e55bfa91cfd1c75043d94a"
+		logic_hash = "v1_sha256_d0cbe02c4fafb4895bd0126d2496802a3fee6a0362e55bfa91cfd1c75043d94a"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -267057,21 +265102,21 @@ rule HARFANGLAB_Apt31_Rawdoor_Dropper : FILE
 		$msg5 = "Can't GetNetSvcs Buffer!" ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize >350KB and filesize <600KB and (($service_target and $service_dispname and $drop_name) or 3 of ($msg*))
+		uint16( 0 ) == 0x5A4D and filesize > 350KB and filesize < 600KB and ( ( $service_target and $service_dispname and $drop_name ) or 3 of ( $msg* ) )
 }
 rule HARFANGLAB_Apt31_Rawdoor_Payload : FILE
 {
 	meta:
 		description = "Matches the RawDoor payload"
 		author = "HarfangLab"
-		id = "5fef27fe-a2ea-56b4-8cf6-8f6c4bf85d80"
+		id = "706bf2a4-6bdd-5f60-a8fd-32ae57a71625"
 		date = "2024-04-12"
 		modified = "2024-09-05"
 		reference = "TRR240401"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L492-L516"
 		license_url = "N/A"
 		hash = "fade96ec359474962f2167744ca8c55ab4e6d0700faa142b3d95ec3f4765023b"
-		logic_hash = "51bd04603419d5bc77f12618df986f6b31ea8ddea553c6bc7580698fa236b3ed"
+		logic_hash = "v1_sha256_51bd04603419d5bc77f12618df986f6b31ea8ddea553c6bc7580698fa236b3ed"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -267091,21 +265136,21 @@ rule HARFANGLAB_Apt31_Rawdoor_Payload : FILE
 		$msg4 = "%u:TCP:*:Enabled:%u" ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <200KB and (($name and $key) or (3 of ($cmd*) and 3 of ($msg*)))
+		uint16( 0 ) == 0x5A4D and filesize < 200KB and ( ( $name and $key ) or ( 3 of ( $cmd* ) and 3 of ( $msg* ) ) )
 }
 rule HARFANGLAB_Packxor : FILE
 {
 	meta:
 		description = "Detection rule for PackXOR"
 		author = "Harfanglab"
-		id = "6b4b6d61-b698-5e15-90b1-de2bdb76e425"
+		id = "bb0f92c2-8c5e-56ec-9e3e-b411ca9d8dcb"
 		date = "2024-08-05"
 		modified = "2024-09-05"
 		reference = "https://harfanglab.io/insidethelab/unpacking-packxor/"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/hl_public_reports_master.yar#L517-L656"
 		license_url = "N/A"
 		hash = "0506372e2c2b6646c539ac5a08265dd66d0da58a25545e444c25b9a02f8d9a44"
-		logic_hash = "ecc7e241f98da8bcd248493f6443676e4c1e516f1fd19f488a62acd314be1898"
+		logic_hash = "v1_sha256_ecc7e241f98da8bcd248493f6443676e4c1e516f1fd19f488a62acd314be1898"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -267238,20 +265283,20 @@ rule HARFANGLAB_Packxor : FILE
         }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <20MB and 2 of ($s_packer*)
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 20MB and 2 of ( $s_packer* )
 }
 rule HARFANGLAB_Custom_Ateraagent_Operator : FILE
 {
 	meta:
 		description = "Detect Atera Agent configured to certain email addresses, or email domains"
 		author = "HarfangLab"
-		id = "af0fae1d-2d25-5551-8720-ff1172ff4eea"
+		id = "c2450339-d798-5c69-8300-4cad1f482f7b"
 		date = "2024-04-17"
 		modified = "2024-04-22"
 		reference = "TRR240402"
 		source_url = "https://github.com/HarfangLab/iocs/blob/8dd8e9296b110ce3fb13bc557a0295dff8c4c357/TRR240402/trr240402_yara-template.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "71622b61c5f645dd846327b79bf6dddefef458b73a82caa34d086da2ba48cd8c"
+		logic_hash = "v1_sha256_71622b61c5f645dd846327b79bf6dddefef458b73a82caa34d086da2ba48cd8c"
 		score = 75
 		quality = 80
 		tags = "FILE"
@@ -267265,13 +265310,13 @@ rule HARFANGLAB_Custom_Ateraagent_Operator : FILE
 		$sc2 = { 06 7F 60 47 95 66 24 A7 15 99 61 74 3D 81 94 93 }
 
 	condition:
-		filesize >1MB and filesize <4MB and ( uint16be(0)==0xD0CF) and @s1<@email and @email<@s2[3] and any of ($sc*)
+		filesize > 1MB and filesize < 4MB and ( uint16be( 0 ) == 0xD0CF ) and @s1 < @email and @email < @s2 [ 3 ] and any of ( $sc* )
 }
 /*
  * YARA Rule Set
  * Repository Name: LOLDrivers
  * Repository: https://github.com/magicsword-io/LOLDrivers/
- * Retrieval Date: 2024-12-08
+ * Retrieval Date: 2024-12-15
  * Git Commit: c9f1c82aac6d9d4c2e472375af843110e0f9b663
  * Number of Rules: 529
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -267487,7 +265532,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_34BE : FILE
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "eacc5085-aa34-5f46-977d-84761649bd6d"
+		id = "0266f778-a997-52aa-9c67-d669fe369f1f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267502,7 +265547,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_34BE : FILE
 		hash = "572c545b5a95d3f4d8c9808ebeff23f3c62ed41910eb162343dd5338e2d6b0b4"
 		hash = "bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa"
 		hash = "da617fe914a5f86dc9d657ef891bbbceb393c8a6fea2313c84923f3630255cdb"
-		logic_hash = "99bb403a6a21e02d2c100267f008feaf6cafd8eb5209d26adc249bf113f87d42"
+		logic_hash = "v1_sha256_99bb403a6a21e02d2c100267f008feaf6cafd8eb5209d26adc249bf113f87d42"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267518,14 +265563,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_34BE : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310037002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0E85 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "caf170d7-172f-56eb-beae-0c40e7ac78fa"
+		id = "07a626d8-db9c-51ad-9576-d626a5950af2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267541,7 +265586,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0E85 : FILE
 		hash = "405a99028c99f36ab0f84a1fd810a167b8f0597725e37513d7430617106501f1"
 		hash = "ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d"
 		hash = "78d49094913526340d8d0ef952e8fe9ada9e8b20726b77fb88c9fb5d54510663"
-		logic_hash = "2e3f7c31d7bad9d21c921e2cebe38c717909cbbc44f60fb2da2623f2d1f3ce88"
+		logic_hash = "v1_sha256_2e3f7c31d7bad9d21c921e2cebe38c717909cbbc44f60fb2da2623f2d1f3ce88"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267557,14 +265602,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0E85 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310036002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_786F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiseUnlo.sys"
 		author = "Florian Roth"
-		id = "78b84e8a-1f92-5954-a1da-19d7208279db"
+		id = "ccee2f15-b503-58b4-af41-9cfa2c2dedbc"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267575,7 +265620,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_786F : FILE
 		hash = "daf549a7080d384ba99d1b5bd2383dbb1aa640f7ea3a216df1f08981508155f5"
 		hash = "48b1344e45e4de4dfb74ef918af5e0e403001c9061018e703261bbd72dc30548"
 		hash = "358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69"
-		logic_hash = "b2d462b62be6d3300a514d6d21dad64162bb43ae7775730d65068ea180f3115f"
+		logic_hash = "v1_sha256_b2d462b62be6d3300a514d6d21dad64162bb43ae7775730d65068ea180f3115f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267591,14 +265636,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_786F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310035 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_A397 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "957addda-818b-504f-98b4-63fdfed768b4"
+		id = "61de93b8-fe71-5e70-8ee1-c45cf1b35d49"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267619,7 +265664,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_A397 : FILE
 		hash = "deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578"
 		hash = "955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad"
 		hash = "f8d6ce1c86cbd616bb821698037f60a41e129d282a8d6f1f5ecdd37a9688f585"
-		logic_hash = "bf47bed12e7e3677190ab26b8384597e297fef0dc6bd654c30b8f787d9fc5573"
+		logic_hash = "v1_sha256_bf47bed12e7e3677190ab26b8384597e297fef0dc6bd654c30b8f787d9fc5573"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267635,21 +265680,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_A397 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310034002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_D7E0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "62c2caf4-0f8e-5873-bc77-ea5a6b390e29"
+		id = "1e120f01-c78d-5e3a-908a-a32ec58c6c53"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L125-L142"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
-		logic_hash = "229c98a4e55486cde122edd3a846c6cec6b242ee9e0269bf25e92d1e00e63d67"
+		logic_hash = "v1_sha256_229c98a4e55486cde122edd3a846c6cec6b242ee9e0269bf25e92d1e00e63d67"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267663,14 +265708,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_D7E0 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_2298 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "85b7f3f1-6324-543f-8855-8cb13096b367"
+		id = "1e5b01f2-4338-5d73-a41b-4d243b50850b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267683,7 +265728,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_2298 : FILE
 		hash = "68671b735716ffc168addc052c5dc3d635e63e71c1e78815e7874286c3fcc248"
 		hash = "3813c1aab1760acb963bcc10d6ea3fddc2976b9e291710756408de392bc9e5d5"
 		hash = "aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399"
-		logic_hash = "81287d89ca576746e6a896bd07fbe5170da2360d614164940621d709c439ca8e"
+		logic_hash = "v1_sha256_81287d89ca576746e6a896bd07fbe5170da2360d614164940621d709c439ca8e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267699,14 +265744,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_2298 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310032002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_4D03 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrDrv.sys"
 		author = "Florian Roth"
-		id = "b35951c3-d0df-5a4d-8c81-333adee6310e"
+		id = "66932d39-375e-58fc-bed2-18f9fdcdec42"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267723,7 +265768,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_4D0
 		hash = "53bb076e81f6104f41bc284eedae36bd99b53e42719573fa5960932720ebc854"
 		hash = "f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b"
 		hash = "a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc"
-		logic_hash = "d0008f29063c14f41a9f433521ef2851b233760d90dc171f9a80247377431035"
+		logic_hash = "v1_sha256_d0008f29063c14f41a9f433521ef2851b233760d90dc171f9a80247377431035"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267739,21 +265784,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_4D0
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystemserviceprovider_0ABC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GtcKmdfBs.sys"
 		author = "Florian Roth"
-		id = "c321b01f-a328-5fba-81d9-fa55af63ce5c"
+		id = "9e389461-9ab7-5388-8432-bf57264b8fb4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L205-L224"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0abca92512fc98fe6c2e7d0a33935686fc3acbd0a4c68b51f4a70ece828c0664"
-		logic_hash = "5c46f095f8329b4dab225ff3b15eb102ecfa9f25f0f86f1d18ea3a6690e267b8"
+		logic_hash = "v1_sha256_5c46f095f8329b4dab225ff3b15eb102ecfa9f25f0f86f1d18ea3a6690e267b8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267769,14 +265814,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003900200047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_D7B7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
 		author = "Florian Roth"
-		id = "d9aab490-9368-54fa-8fc2-711c0446b19c"
+		id = "496f27ea-77ad-5382-96fb-3dde9c9194c5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267786,7 +265831,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_D7B7 : FILE
 		hash = "567809308cfb72d59b89364a6475f34a912d03889aa50866803ac3d0bf2c3270"
 		hash = "93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63"
 		hash = "2665d3127ddd9411af38a255787a4e2483d720aa021be8d6418e071da52ed266"
-		logic_hash = "90f4fe8425b1fe8cf7c820566d6b943bc070f33cdf1b42e691ecd6127c17d549"
+		logic_hash = "v1_sha256_90f4fe8425b1fe8cf7c820566d6b943bc070f33cdf1b42e691ecd6127c17d549"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267802,14 +265847,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_D7B7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310037002e002000520061007a00650072002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwinddkdriver_9DBC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
 		author = "Florian Roth"
-		id = "8fb3920a-b0bf-57b3-bf15-24f323efde31"
+		id = "32c964a7-4fb7-5747-871d-f63086a9c71e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267822,7 +265867,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwind
 		hash = "1a0f57a4d7c8137baf24c65d542729547b876979273df7a245aaeea87280c090"
 		hash = "62b14bb308c99132d90646e85bc7d6eb593f38e225c8232f69f24b74a019c176"
 		hash = "0f3e7bf7b103613844a38afb574817ddaecd00e4d206d891660dbb0e5dfee04e"
-		logic_hash = "47b59ba788b51c8b9a94ecddd486fad5aeb9266e406b14b963ac69800ebd5e6d"
+		logic_hash = "v1_sha256_47b59ba788b51c8b9a94ecddd486fad5aeb9266e406b14b963ac69800ebd5e6d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267838,14 +265883,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwind
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020004e0065007400460069006c00740065007200530044004b002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Lgdatacatchersys_Gameacc_07FB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LgDataCatcher.sys"
 		author = "Florian Roth"
-		id = "4d2f4d82-aa28-5be1-8e0a-9db164a4bb50"
+		id = "8e20a5a5-429b-5bca-88d4-ab3319449009"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267854,7 +265899,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Lgdatacatchersys_Gameacc_
 		hash = "07fb2bb6c852f6a6fe982b2232f047e167be39738bac26806ffe0927ba873756"
 		hash = "516159871730b18c2bddedb1a9da110577112d4835606ee79bb80e7a58784a13"
 		hash = "45b07a2f387e047a6bb0e59b7f22fb56182d57b50e84e386a38c2dbb7e773837"
-		logic_hash = "a41af54c12aae5c2c95f6ed4754dcb4e17265abdb763f6be29a5a1ba1fcfdacd"
+		logic_hash = "v1_sha256_a41af54c12aae5c2c95f6ed4754dcb4e17265abdb763f6be29a5a1ba1fcfdacd"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267870,21 +265915,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Lgdatacatchersys_Gameacc_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002000320030003200300020006e006e002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditions_D53F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxguest.sys"
 		author = "Florian Roth"
-		id = "f3412abe-99c6-5ced-823c-1c681f446bab"
+		id = "f6d8e346-ecb1-517d-bae9-25ae968b869d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L304-L323"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d53f9111a5e6c94b37e3f39c5860897405cb250dd11aa91c3814a98b1759c055"
-		logic_hash = "06994b6e75aefad03b1346e1bcaf68dca8464526bf182557257c4f5635bb93ce"
+		logic_hash = "v1_sha256_06994b6e75aefad03b1346e1bcaf68dca8464526bf182557257c4f5635bb93ce"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267900,14 +265945,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditions_D
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300034002d003200300030003700200069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elrawdsk.sys"
 		author = "Florian Roth"
-		id = "13de286c-92f2-5677-86ee-99c70a338c8e"
+		id = "730d3ada-a2b9-5ead-b59c-aec7e4456f20"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -267915,7 +265960,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
 		hash = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
-		logic_hash = "01faeb5fe7618ce1135a8532c76357cfea1dfb0932e3d7c4cf9ff7d1c8c1d8fb"
+		logic_hash = "v1_sha256_01faeb5fe7618ce1135a8532c76357cfea1dfb0932e3d7c4cf9ff7d1c8c1d8fb"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267931,21 +265976,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d0032003000310031002c00200045006c0064006f005300200043006f00720070006f0072006100740069006f006e0020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_81AA : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
 		author = "Florian Roth"
-		id = "03cc80bd-699d-5c23-9acc-a523fa3110f3"
+		id = "30fa0ea4-8ed3-5d8f-bf4d-c201298ea59d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L349-L368"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0"
-		logic_hash = "8be18437fb165bab491d1d63b01d744f14df8594288bf0d447b76913de934aa9"
+		logic_hash = "v1_sha256_8be18437fb165bab491d1d63b01d744f14df8594288bf0d447b76913de934aa9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267961,21 +266006,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_F6CD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
 		author = "Florian Roth"
-		id = "40d54ac5-209a-5f0e-b799-f492b7fcc973"
+		id = "37d17010-b6ba-5cd8-b0a6-70f9ef00770c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L371-L390"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f"
-		logic_hash = "1f489ec71f92390aeb4137ba72cb88a950ed91f8e67bb82cf176a8c2fb4ef50f"
+		logic_hash = "v1_sha256_1f489ec71f92390aeb4137ba72cb88a950ed91f8e67bb82cf176a8c2fb4ef50f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -267991,21 +266036,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_2594 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "3d265316-2b94-581a-b44a-fe015d316eff"
+		id = "cb773518-749f-5058-aa59-95519a2b38a6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L393-L412"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2"
-		logic_hash = "ef0e7b48aaee9dc6251120a879a192993d86043dbfd11e2be1f6e675aaa4d2e4"
+		logic_hash = "v1_sha256_ef0e7b48aaee9dc6251120a879a192993d86043dbfd11e2be1f6e675aaa4d2e4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268021,14 +266066,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_8473 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
 		author = "Florian Roth"
-		id = "730567f0-ae1e-5d8d-a9e6-df176faf4878"
+		id = "79b5f7e7-0e91-5ab3-946f-c3182bd93c08"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268039,7 +266084,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_8473 : FILE
 		hash = "e279e425d906ba77784fb5b2738913f5065a567d03abe4fd5571695d418c1c0f"
 		hash = "3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0"
 		hash = "8b688dd055ead2c915a139598c8db7962b42cb6e744eaacfcb338c093fc1f4e7"
-		logic_hash = "62c957b30267a5f34ff98f36170473d042ccd30686b2e178513957126cde194c"
+		logic_hash = "v1_sha256_62c957b30267a5f34ff98f36170473d042ccd30686b2e178513957126cde194c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268054,14 +266099,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_8473 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutsys_Inpoutdriverversion_CFAB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpout32.sys"
 		author = "Florian Roth"
-		id = "0ce7b65a-8472-5964-88cf-879cdd3c15a2"
+		id = "87a2b35c-b41d-5c9e-97df-d1d7d1974147"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268072,7 +266117,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutsy
 		hash = "7db320e49139f636c8b6d12b6c78b666a62599e9d59587ba87c6b89b0a34b18d"
 		hash = "16360ead229b13deb47bc2bef40f282474c9f18c213c636cdfb8cc2495168251"
 		hash = "b8ded5e10dfc997482ba4377c60e7902e6f755674be51b0e181ae465529fb2f2"
-		logic_hash = "5e5c8949d41009360058f6af3ef374708ebf45e9eede873297afbfd26de8874c"
+		logic_hash = "v1_sha256_5e5c8949d41009360058f6af3ef374708ebf45e9eede873297afbfd26de8874c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268088,14 +266133,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutsy
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300030003800200048006900670068007200650073006f006c007500740069006f006e00200045006e007400650072007000720069007300650073002e00200050006f007200740069006f006e007300200043006f007000790072006900670068007400200028006300290020004c006f00670069007800340075 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_4CD8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
 		author = "Florian Roth"
-		id = "62e8e5f9-be64-5989-ace0-71a5910cef95"
+		id = "352f1876-7970-5029-89f0-2e82e05a7444"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268104,7 +266149,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_4CD8 : FILE
 		hash = "4cd80f4e33b713570f6a16b9f77679efa45a466737e41db45b41924e7d7caef4"
 		hash = "00c02901472d74e8276743c847b8148be3799b0e3037c1dfdca21fa81ad4b922"
 		hash = "66a20fc2658c70facd420f5437a73fa07a5175998e569255cfb16c2f14c5e796"
-		logic_hash = "822a064ed95de5c44932b3ba5d0f89c16ee12f9fb5201b99344a74461eef932c"
+		logic_hash = "v1_sha256_822a064ed95de5c44932b3ba5d0f89c16ee12f9fb5201b99344a74461eef932c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268119,21 +266164,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_4CD8 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310034002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditions_9833 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxguest.sys"
 		author = "Florian Roth"
-		id = "b569d61f-4b07-50f7-8e3f-a63631a060a0"
+		id = "730ad164-3654-5bd6-841a-5b9919ee0c20"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L489-L508"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "983310cdce8397c016bfcfcc9c3a8abbb5c928b235bc3c3ae3a3cc10ef24dfbd"
-		logic_hash = "8d2323bd83c70339f41fc8f90c67729f57ee1e54dc4f7d05dfded438c7bc419a"
+		logic_hash = "v1_sha256_8d2323bd83c70339f41fc8f90c67729f57ee1e54dc4f7d05dfded438c7bc419a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268149,14 +266194,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditions_9
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300034002d003200300030003700200069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_45BA : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RwDrv.sys"
 		author = "Florian Roth"
-		id = "c9279259-59ab-5816-aa59-4d8d53f95793"
+		id = "3db7fa39-b92a-5daf-922f-c24115afbcf5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268170,7 +266215,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_45BA : FILE
 		hash = "1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe"
 		hash = "d15a0bc7a39bbeff10019496c1ed217b7c1b26da37b2bdd46820b35161ddb3c4"
 		hash = "ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3"
-		logic_hash = "773f6985a98adffe12b087c7e8e37c5fe0dba3040440d2300316464e7fa961e4"
+		logic_hash = "v1_sha256_773f6985a98adffe12b087c7e8e37c5fe0dba3040440d2300316464e7fa961e4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268186,14 +266231,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_45BA : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002000520057002d00450076006500720079007400680069006e0067 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdriver_5C0B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vmdrv.sys"
 		author = "Florian Roth"
-		id = "20989ad0-08b4-5fe0-b4cc-9846bdf4bb89"
+		id = "0d4ec65b-32a5-5341-8805-37dcb03047d2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268202,7 +266247,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdr
 		hash = "5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921"
 		hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
 		hash = "d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3"
-		logic_hash = "11d62a2a3de4eafb1a523876ce2bc34f96f43e2a228ad9cb5da6c5cb452c3838"
+		logic_hash = "v1_sha256_11d62a2a3de4eafb1a523876ce2bc34f96f43e2a228ad9cb5da6c5cb452c3838"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268218,14 +266263,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdr
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200056006f006900630065006d006f006400200053002e004c002e0032003000310030002d0032003000320030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_A130 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
 		author = "Florian Roth"
-		id = "c810bb03-5e0d-501a-af32-66a5f73b410e"
+		id = "80cfa017-9373-5af9-a622-b575a1e5bde7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268233,7 +266278,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
 		hash = "7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d"
-		logic_hash = "46c2abfe24d092b974e0916f7ccf53b71c12f3d438dff3e0ef9ffd1c253b0144"
+		logic_hash = "v1_sha256_46c2abfe24d092b974e0916f7ccf53b71c12f3d438dff3e0ef9ffd1c253b0144"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268249,21 +266294,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003800200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfoisys_Hwinfoiakerneldriver_33C6 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO64I.SYS"
 		author = "Florian Roth"
-		id = "04f7cd8f-1716-5b97-861c-0c8601774332"
+		id = "bcfd7fe6-3298-52a8-8989-94b05b9f9339"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L587-L606"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "33c6c622464f80a8d8017a03ff3aa196840da8bb03bfb5212b51612b5cf953dc"
-		logic_hash = "b9ec2a1a569f6972c9713a8e1512b0de974b4536bc92bd5466ee808d7574fada"
+		logic_hash = "v1_sha256_b9ec2a1a569f6972c9713a8e1512b0de974b4536bc92bd5466ee808d7574fada"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268279,21 +266324,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfoisys_Hwinfoiakerneldriver_33C6 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100320020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdeliveryfirmwareupdateutilitydriver_6945 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PDFWKRNL.sys"
 		author = "Florian Roth"
-		id = "84e31b9f-a36a-51c8-8f71-59748c8e9765"
+		id = "a00af327-f872-5acb-bc20-64296cd61ccf"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L609-L628"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6945077a6846af3e4e2f6a2f533702f57e993c5b156b6965a552d6a5d63b7402"
-		logic_hash = "06b458c2f8c6eb5dadf2a05c69225fdc4cbd6bd48e4380fa224573139de6a466"
+		logic_hash = "v1_sha256_06b458c2f8c6eb5dadf2a05c69225fdc4cbd6bd48e4380fa224573139de6a466"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268309,14 +266354,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdel
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300032003100200041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Fintekcorp_Fintekcorpfintekpcieuart_32BD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FPCIE2COM.sys"
 		author = "Florian Roth"
-		id = "61ea6f89-2dc0-525c-919a-8b47b85f0240"
+		id = "a399f23d-c297-5722-8fca-7311a39e1fd9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268325,7 +266370,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Fintekcorp_Fintekcorpfintekpcieuart_32BD : FILE
 		hash = "32bd0edb9daa60175b1dc054f30e28e8dbfa293a32e6c86bfd06bc046eaa2f9e"
 		hash = "17942865680bd3d6e6633c90cc4bd692ae0951a8589dbe103c1e293b3067344d"
 		hash = "b1920889466cd5054e3ab6433a618e76c6671c3e806af8b3084c77c0e7648cbe"
-		logic_hash = "5ff39e43789f0d6b39dd02caeeff027d3c117628113113897e6abc70c30e277a"
+		logic_hash = "v1_sha256_5ff39e43789f0d6b39dd02caeeff027d3c117628113113897e6abc70c30e277a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268340,14 +266385,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Fintekcorp_Fintekcorpfintekpcieuart_32BD : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200040002000460069006e00740065006b00200043006f00720070002e00200032003000300032002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_42B3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
 		author = "Florian Roth"
-		id = "613560d6-26ea-5a38-8d88-95988af8371f"
+		id = "0508fc5c-8be0-5dab-ad97-7b4cf5312fcc"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268355,7 +266400,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_42B3 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "42b31b850894bf917372ff50fbe1aff3990331e8bd03840d75e29dcc1026c180"
 		hash = "c0c52425dd90f36d110952c665e5b644bb1092f952942c07bb4da998c9ce6e5b"
-		logic_hash = "d9437369dd7a913176a1351f991216f3190b608f3a3182e891bdb7778835b815"
+		logic_hash = "v1_sha256_d9437369dd7a913176a1351f991216f3190b608f3a3182e891bdb7778835b815"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268371,21 +266416,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_42B3 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_5BD4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "0cf3d047-c497-5957-b0d3-717220393501"
+		id = "7cc677c8-9b25-55e1-b776-acb65806548f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L677-L696"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c"
-		logic_hash = "69948e6d3cc375d78ba95a51c7a78e5a3f17e0ca07cf1e3e53d54f350d9ac0a9"
+		logic_hash = "v1_sha256_69948e6d3cc375d78ba95a51c7a78e5a3f17e0ca07cf1e3e53d54f350d9ac0a9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268401,21 +266446,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxusbsys_Virtualboxusbdriver_C509 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxUSB.Sys"
 		author = "Florian Roth"
-		id = "85270071-0faf-5672-9c20-1f8244bf18eb"
+		id = "4a243132-d0ce-5655-9651-0f772db80142"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L699-L718"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c509935f3812ad9b363754216561e0a529fc2d5b8e86bfa7302b8d149b7d04aa"
-		logic_hash = "5bf3a4f5e3f674c4f32de55abd9d1981ad0b1fd48fb460905d017096b30ae10e"
+		logic_hash = "v1_sha256_5bf3a4f5e3f674c4f32de55abd9d1981ad0b1fd48fb460905d017096b30ae10e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268431,21 +266476,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxusbsys_Virtualboxusbdriver_C509
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_F171 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
 		author = "Florian Roth"
-		id = "7572033b-bb49-531f-a14a-decf9a50aab3"
+		id = "972e7e2b-0157-5e35-8df1-8c63fc2f219c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L721-L740"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f1718a005232d1261894b798a60c73d971416359b70d0e545d7e7a40ed742b71"
-		logic_hash = "2879360aef7b25e7d5ea9e4cbdce9f60a33ca4181ef35e18117e69832589cc73"
+		logic_hash = "v1_sha256_2879360aef7b25e7d5ea9e4cbdce9f60a33ca4181ef35e18117e69832589cc73"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268461,14 +266506,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_F171 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000770079006a00730071002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_DD4F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NICM.sys"
 		author = "Florian Roth"
-		id = "e9506ae9-b5ea-5ed7-a126-1b6070df89d0"
+		id = "a1e8c3bb-de2f-52b6-be04-5e51cfe1019e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268479,7 +266524,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_DD4F : FILE
 		hash = "1c2f1e2b0cc4da128feb73a6b9dd040df8495fefe861d69c9f44778c6ddb9b9b"
 		hash = "cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190"
 		hash = "6b71b7f86e41540a82d7750a698e0386b74f52962b879cbb46f17935183cd2c7"
-		logic_hash = "731f87935b48d5fb208b94671a94bed5dfea3f7f6f433fef32cb72c73ce4f8f9"
+		logic_hash = "v1_sha256_731f87935b48d5fb208b94671a94bed5dfea3f7f6f433fef32cb72c73ce4f8f9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268494,14 +266539,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_DD4F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_7627 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
 		author = "Florian Roth"
-		id = "ccce2f4d-4cdc-5ea5-a8dd-271f7d7b5482"
+		id = "6a2e93db-1e0c-50f5-aae9-c6e40016f506"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268509,7 +266554,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_7627 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "76276c87617b836dd6f31b73d2bb0e756d4b3d133bddfe169cb4225124ca6bfb"
 		hash = "1e9c236ed39507661ec32731033c4a9b9c97a6221def69200e03685c08e0bfa7"
-		logic_hash = "eba1a04dc1de06122a8bad80399c4233b9c3101f4fcbc805ec7615010da76833"
+		logic_hash = "v1_sha256_eba1a04dc1de06122a8bad80399c4233b9c3101f4fcbc805ec7615010da76833"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268524,14 +266569,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_7627 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310032002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_16AE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "0c0b8367-fb93-5f0c-8fac-28bd19c20166"
+		id = "db3cd5a9-ad68-5495-a235-573df45ad2d5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268539,7 +266584,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "16ae28284c09839900b99c0bdf6ce4ffcd7fe666cfd5cfb0d54a3ad9bea9aa9c"
 		hash = "d54ac69c438ba77cde88c6efd6a423491996d4e8a235666644b1db954eb1da9c"
-		logic_hash = "4c4359af17cfc03947722c644064fa2e2bacc5adcbd66499bfba4aa483ac56f6"
+		logic_hash = "v1_sha256_4c4359af17cfc03947722c644064fa2e2bacc5adcbd66499bfba4aa483ac56f6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268555,21 +266600,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Computerz_Computerzsys_Computerzsystemdriver_61F3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "ca51c99d-79fe-57b3-9832-adfb2d1d59d4"
+		id = "95a5a388-f8ed-59aa-800a-6899756867df"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L813-L832"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "61f3b1c026d203ce94fab514e3d15090222c0eedc2a768cc2d073ec658671874"
-		logic_hash = "73d2e39a2e1d9810f5f0999a8f79a238a36305d36db731a3e84859e6d15bfdd8"
+		logic_hash = "v1_sha256_73d2e39a2e1d9810f5f0999a8f79a238a36305d36db731a3e84859e6d15bfdd8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268585,14 +266630,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerz_Computerzsys_Computerzsystemdriver_61F
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300030003800200043006f006d00700075007400650072005a }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_88E2 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "e6f3c13e-0cec-5430-beeb-fc980dd29887"
+		id = "05a8adef-6a8b-53b8-a7d7-68d26322369e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268609,7 +266654,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		hash = "59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879"
 		hash = "e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd"
 		hash = "9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2"
-		logic_hash = "bd5ecf74e339330abb48c31bf14ea7cdfbacc93fa6c60debb435249f88a4408a"
+		logic_hash = "v1_sha256_bd5ecf74e339330abb48c31bf14ea7cdfbacc93fa6c60debb435249f88a4408a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268625,14 +266670,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwinddkdriver_1F4D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "145b846a-8721-5a56-aa76-6d7d5dd16562"
+		id = "3eeeba79-ebfa-5050-88b1-933156b40c72"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268650,7 +266695,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwinddkdri
 		hash = "b7aa4c17afdaff1603ef9b5cc8981bed535555f8185b59d5ae13f342f27ca6c5"
 		hash = "65deb5dca18ee846e7272894f74d84d9391bbe260c22f24a65ab37d48bd85377"
 		hash = "60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289"
-		logic_hash = "2ca64f822a558d25fc885da4fc79c80d4ed9c473179db3343958af0e1f21e0e8"
+		logic_hash = "v1_sha256_2ca64f822a558d25fc885da4fc79c80d4ed9c473179db3343958af0e1f21e0e8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268666,21 +266711,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwinddkdri
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Mitactechnologycorporation_Vdbsvsys_Mitacsystemserviceprovider_91AF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VdBSv64.sys"
 		author = "Florian Roth"
-		id = "513c1b59-e721-5bbf-979a-31c25c4d566e"
+		id = "d8e723e2-c4a9-5c4a-862e-c69cae7bec61"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L900-L919"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "91afa3de4b70ee26a4be68587d58b154c7b32b50b504ff0dc0babc4eb56578f4"
-		logic_hash = "e93e2620e452d0d6d834057921ed0de35309098130b47e98da7c1e87b31b86ee"
+		logic_hash = "v1_sha256_e93e2620e452d0d6d834057921ed0de35309098130b47e98da7c1e87b31b86ee"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268696,14 +266741,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Mitactechnologycorporation_Vdbsvsys_Mitacsystems
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_00B3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
 		author = "Florian Roth"
-		id = "638c6150-1380-57d7-b2a2-acfd4302e2b5"
+		id = "e51869fe-45ef-5d9d-b5e2-6bfaae33a2a1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268714,7 +266759,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_00B3 : FILE
 		hash = "18f306b6edcfacd33b7b244eaecdd0986ef342f0d381158844d1f0ee1ac5c8d7"
 		hash = "94c226a530dd3cd8d911901f702f3dab8200d1d4fdc73fcb269f7001f4e66915"
 		hash = "c08581e3e444849729c5b956d0d6030080553d0bc6e5ae7e9a348d45617b9746"
-		logic_hash = "6a7f2670ea396bb3401fdfae3ccc6ca90d8f82e92c386ef5f63959d75e6df296"
+		logic_hash = "v1_sha256_6a7f2670ea396bb3401fdfae3ccc6ca90d8f82e92c386ef5f63959d75e6df296"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268729,14 +266774,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_00B3 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310035002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_B50F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
 		author = "Florian Roth"
-		id = "fc6032d2-ef08-5fdb-be73-39dd42185b13"
+		id = "fcbccbaa-6e77-554a-84ef-f1135f1334d6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268747,7 +266792,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_B50F : FILE
 		hash = "b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b"
 		hash = "0cfb7ea2cc515a7fe913ab3619cbfcf1ca96d8cf72dc350905634a5782907a49"
 		hash = "d1c78c8ba70368e96515fb0596598938a8f9efa8f9f5d9e068ee008f03020fee"
-		logic_hash = "662af5d505b5fee483356c1b5bcf2767c594bd690d5367a7b9f7ac9bea6b3c9d"
+		logic_hash = "v1_sha256_662af5d505b5fee483356c1b5bcf2767c594bd690d5367a7b9f7ac9bea6b3c9d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268762,14 +266807,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_B50F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0.sys, WinRing0x64"
 		author = "Florian Roth"
-		id = "370f3fc6-6199-5c19-a0b5-8c02fb89f30a"
+		id = "4bb89ba2-b70d-50ad-a39c-4b130dc9cccc"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268777,7 +266822,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"
 		hash = "a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062"
-		logic_hash = "e5777a3a1e71f287c18434a48c2990abd3e202c919378a9473541abe2b8f0ba5"
+		logic_hash = "v1_sha256_e5777a3a1e71f287c18434a48c2990abd3e202c919378a9473541abe2b8f0ba5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268793,21 +266838,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d00320030003000380020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_Hardwarereadwritedriver_21CC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwRwDrv.sys"
 		author = "Florian Roth"
-		id = "fa8e9fd9-7d07-5e05-a8d0-3769b9dd9157"
+		id = "87f01ec9-f4a2-5338-ad61-4e110ff3a7bf"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L995-L1014"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21"
-		logic_hash = "da6f9de9c0529ef274b989f63d9d6308ea78a0f7f91d81caaafb5478412c33eb"
+		logic_hash = "v1_sha256_da6f9de9c0529ef274b989f63d9d6308ea78a0f7f91d81caaafb5478412c33eb"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268823,21 +266868,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_Hardw
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_AD8F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "25dc4405-52ae-51f9-9afd-49f2a9fcaa08"
+		id = "31513bd3-1094-5e6c-a733-74e7cc515234"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1017-L1036"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833"
-		logic_hash = "fba0440ab68b148f26224cce5d2b8bdb684a2d185502fb3b920fe12288e6d775"
+		logic_hash = "v1_sha256_fba0440ab68b148f26224cce5d2b8bdb684a2d185502fb3b920fe12288e6d775"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268853,21 +266898,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_AD8F : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3124 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "25893130-a0b5-5c5c-b7d2-e22bf8eec311"
+		id = "5747ba77-5ab3-5eb3-a7ea-b8ada0553c8e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1039-L1058"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5"
-		logic_hash = "4e22250223e272624f9608e7981ba91c1fb0e00eaf6d8388b81ad91fd8dbcc5c"
+		logic_hash = "v1_sha256_4e22250223e272624f9608e7981ba91c1fb0e00eaf6d8388b81ad91fd8dbcc5c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268883,21 +266928,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3124 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_FF55 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
 		author = "Florian Roth"
-		id = "4b402b27-36ca-5e2c-bb00-64ab93b8720f"
+		id = "7d4344f3-b327-515d-9e6b-5dbff43df77d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1061-L1080"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ff55c1f308a5694eb66a3e9ba326266c826c5341c44958831a7a59a23ed5ecc8"
-		logic_hash = "298b509c736082f651b32be6ff3ba8b2044d48e8d1ac5c411449524750794d4f"
+		logic_hash = "v1_sha256_298b509c736082f651b32be6ff3ba8b2044d48e8d1ac5c411449524750794d4f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268913,14 +266958,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A855 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
 		author = "Florian Roth"
-		id = "8cc90fa3-6be0-5b67-a555-0c922947fa60"
+		id = "f3ab5c90-0e77-59c0-94a4-6b1977058257"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -268929,7 +266974,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A855 : FILE
 		hash = "a855b6ec385b3369c547a3c54e88a013dd028865aba0f3f08be84cdcbaa9a0f6"
 		hash = "49ef680510e3dac6979a20629d10f06822c78f45b9a62ec209b71827a526be94"
 		hash = "653f6a65e0e608cae217bea2f90f05d8125cf23f83ba01a60de0f5659cfa5d4d"
-		logic_hash = "8ea1eeb7ddc8fbda767ab5fb5aaad6eecd83361f90685d904bbb4e524c4d64c9"
+		logic_hash = "v1_sha256_8ea1eeb7ddc8fbda767ab5fb5aaad6eecd83361f90685d904bbb4e524c4d64c9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268944,21 +266989,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A855 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310034002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_DB71 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "85b1e297-b9f8-5147-93e3-a084ec658782"
+		id = "5ee9afa8-b054-5b20-aa33-d34fad2a7701"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1106-L1125"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "db711ec3f4c96b60e4ed674d60c20ff7212d80e34b7aa171ad626eaa8399e8c7"
-		logic_hash = "c62675b8ae01311a74bd0b0717219dde73badf621f2b6af1d5d6ff12317048f0"
+		logic_hash = "v1_sha256_c62675b8ae01311a74bd0b0717219dde73badf621f2b6af1d5d6ff12317048f0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -268974,21 +267019,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_DB71 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Monitorsys_Advancedsystemcare_E4A7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Monitor_win10_x64.sys"
 		author = "Florian Roth"
-		id = "65b75be5-98a2-56ca-bb4a-cfd0c6871c0e"
+		id = "019d2c3b-7821-5de7-9c36-c1062b1665a6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1128-L1147"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb"
-		logic_hash = "798dad45f7ac1267da440c3ca7aba1da1dbd2bdead9b6979379902e009bbd2a2"
+		logic_hash = "v1_sha256_798dad45f7ac1267da440c3ca7aba1da1dbd2bdead9b6979379902e009bbd2a2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269004,14 +267049,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Monitorsys_Advancedsystemcare_E4A7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_2B33 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iobitunlocker.sys"
 		author = "Florian Roth"
-		id = "ce40dddf-a58e-542b-b2d9-45f55c502d35"
+		id = "fa23d3bb-9577-5e1d-8160-076f2da80430"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269030,7 +267075,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_2B33 : FILE
 		hash = "a92d2736c8cd99195a1ef4d0d9a3412bee481acf585944e3b5946b465361a3e7"
 		hash = "0209934453e9ce60b1a5e4b85412e6faf29127987505bfb1185fc9296c578b09"
 		hash = "969f73a1da331e43777a3c1f08ec0734e7cf8c8136e5d469cbad8035fbfe3b47"
-		logic_hash = "dd77671686a88736713d59771eef44d47b8acb18454dc3e6f229282aa534dcd3"
+		logic_hash = "v1_sha256_dd77671686a88736713d59771eef44d47b8acb18454dc3e6f229282aa534dcd3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269046,21 +267091,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_2B33 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0049004f00620069007400200043006f0070007900720069006700680074002000a900200032003000300035002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologiesltd_Phlashnt_Winphlash_65DB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PhlashNT.sys"
 		author = "Florian Roth"
-		id = "7c0b1c20-b3ef-56e9-b2e2-e2542c7a85e3"
+		id = "49600fee-8ad4-5bd6-9887-2d9935654c7a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1184-L1203"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890"
-		logic_hash = "52b33a82d9835242e397f693094494508a9a1e17ab7125ad6818130f4b2dc2de"
+		logic_hash = "v1_sha256_52b33a82d9835242e397f693094494508a9a1e17ab7125ad6818130f4b2dc2de"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269076,21 +267121,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologiesltd_Phlashnt_Winphlash_65DB :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800630029002000500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e00200032003000300030002d0032003000300033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7196 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
 		author = "Florian Roth"
-		id = "3b631d10-d727-53f8-8f56-87695e305198"
+		id = "a7eeac7d-8cbe-54aa-bbf7-77a015e95dad"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1206-L1225"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d"
-		logic_hash = "c69a031ad9d7eff41358cd2ae9404c25c48ca747ac5fc9b806e48be2fe59aee8"
+		logic_hash = "v1_sha256_c69a031ad9d7eff41358cd2ae9404c25c48ca747ac5fc9b806e48be2fe59aee8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269106,14 +267151,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7196 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdriveservicedriver_F4DC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AODDriver.sys"
 		author = "Florian Roth"
-		id = "200fe944-ea33-52ad-9729-a42319b169a8"
+		id = "ab5c1471-b604-58ff-ac1a-88b13effb541"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269121,7 +267166,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdrivese
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f4dc11b7922bf2674ca9673638e7fe4e26aceb0ebdc528e6d10c8676e555d7b2"
 		hash = "070ff602cccaaef9e2b094e03983fd7f1bf0c0326612eb76593eabbf1bda9103"
-		logic_hash = "6d49bcb5159d3be15ec42748089baff846ce661446a73d7986deb945e379a45f"
+		logic_hash = "v1_sha256_6d49bcb5159d3be15ec42748089baff846ce661446a73d7986deb945e379a45f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269137,14 +267182,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdrivese
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003200200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovider_8FE4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
 		author = "Florian Roth"
-		id = "85e60907-b5da-5c9a-811e-0ddb0c850087"
+		id = "8fee7e19-e8ab-5538-85e3-de5174692931"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269152,7 +267197,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovide
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8fe429c46fedbab8f06e5396056adabbb84a31efef7f9523eb745fc60144db65"
 		hash = "71423a66165782efb4db7be6ce48ddb463d9f65fd0f266d333a6558791d158e5"
-		logic_hash = "c768c1592586c6a053f69d8f64c66ba213dc054113d98f3144610fdb5978a0f1"
+		logic_hash = "v1_sha256_c768c1592586c6a053f69d8f64c66ba213dc054113d98f3144610fdb5978a0f1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269168,21 +267213,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovide
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200032003000300035 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Anticheatexpertcom_Acebase_Anticheatexpert_7326 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ACE-BASE.sys"
 		author = "Florian Roth"
-		id = "5a93b810-f40c-56eb-a3da-8075fb9b15a9"
+		id = "d86247a9-d200-551f-b74d-127f27f8677b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1274-L1292"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7326aefff9ea3a32286b423a62baebe33b73251348666c1ee569afe62dd60e11"
-		logic_hash = "c309c294def3fb6601ab76b4b67bdda0d38db398a8a56b0ced0d4ce8cafc8602"
+		logic_hash = "v1_sha256_c309c294def3fb6601ab76b4b67bdda0d38db398a8a56b0ced0d4ce8cafc8602"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269197,21 +267242,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Anticheatexpertcom_Acebase_Anticheatexpert_7326
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200041006e0074006900430068006500610074004500780070006500720074002e0063006f006d0020004c0069006d0069007400650064002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1900KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1900KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_133E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
 		author = "Florian Roth"
-		id = "f1f06952-1500-57af-8486-eb127a90b110"
+		id = "8114d3b4-0ea6-5228-83d2-964bb84743b0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1295-L1314"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743"
-		logic_hash = "8294e9a9d7bf9e4471d494ca78db936c69b2b2ee495207cde79aeabff9910463"
+		logic_hash = "v1_sha256_8294e9a9d7bf9e4471d494ca78db936c69b2b2ee495207cde79aeabff9910463"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269227,14 +267272,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1072 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
 		author = "Florian Roth"
-		id = "8604d594-f5ab-5015-907a-4424cd2e62b8"
+		id = "239261fd-2723-5d1a-ad01-d9deb9bd5568"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269242,7 +267287,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1072 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1072beb3ff6b191b3df1a339e3a8c87a8dc5eae727f2b993ea51b448e837636a"
 		hash = "e8eb1c821dbf56bde05c0c49f6d560021628df89c29192058ce68907e7048994"
-		logic_hash = "99645f9bf3c3ba88788ad609ee067cdda808effac07990db725b9be5fca32658"
+		logic_hash = "v1_sha256_99645f9bf3c3ba88788ad609ee067cdda808effac07990db725b9be5fca32658"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269258,14 +267303,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1072 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003200200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_8A07 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "6820d35b-66a3-512f-a734-0adefbf6a183"
+		id = "758a2526-b10d-5dd9-9df9-e6d14b9485d4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269282,7 +267327,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_8A07 : FILE
 		hash = "c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26"
 		hash = "53bd8e8d3542fcf02d09c34282ebf97aee9515ee6b9a01cefd81baa45c6fd3d6"
 		hash = "0484defcf1b5afbe573472753dc2395e528608b688e5c7d1d178164e48e7bed7"
-		logic_hash = "b1abafa69f65ebde217ebc1fbde8d19c00054aeb37f111bf82be07cf08525235"
+		logic_hash = "v1_sha256_b1abafa69f65ebde217ebc1fbde8d19c00054aeb37f111bf82be07cf08525235"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269298,14 +267343,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_8A07 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310033002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "46f31bf7-9e9f-5fe2-95cc-1b0be823c41b"
+		id = "77ee8129-de3f-59d9-a21d-04323e6d98a5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269330,7 +267375,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37 : FILE
 		hash = "19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758"
 		hash = "e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90"
 		hash = "11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b"
-		logic_hash = "b1f0e78bd40da89202a98d2a74d47af7f28092832dc1b063f1d4c4ef04e1cef1"
+		logic_hash = "v1_sha256_b1f0e78bd40da89202a98d2a74d47af7f28092832dc1b063f1d4c4ef04e1cef1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269346,21 +267391,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310030002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Proxydrvsys_Nn_C0E7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ProxyDrv.sys"
 		author = "Florian Roth"
-		id = "e50ded09-0134-5c76-85e5-9fed8302e1e8"
+		id = "6e73adae-b388-5cf1-b455-83a0cb3ae97c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1412-L1431"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c0e74f565237c32989cb81234f4b5ad85f9dd731c112847c0a143d771021cb99"
-		logic_hash = "b4248d60006efcf3f489cfad8a68bbf594bd45f75e8b9c8d7b9f727c6ee05042"
+		logic_hash = "v1_sha256_b4248d60006efcf3f489cfad8a68bbf594bd45f75e8b9c8d7b9f727c6ee05042"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269376,14 +267421,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Proxydrvsys_Nn_C0E7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000400020005700770077002e004e006e002e0043006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5381 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
 		author = "Florian Roth"
-		id = "29276926-535b-55f9-a882-845fc9561513"
+		id = "d3db434d-dd24-56d5-8d0f-ed930d0914e7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269392,7 +267437,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5381 : FILE
 		hash = "53810ca98e07a567bb082628d95d796f14c218762cbbaa79704740284dccda4b"
 		hash = "8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c"
 		hash = "003e61358878c7e49e18420ee0b4a37b51880be40929a76e529c7b3fb18e81b4"
-		logic_hash = "3803b2f85576fc0bad1a8e3dbfc3c5bee7ba7146560be9d60d685b40adf91838"
+		logic_hash = "v1_sha256_3803b2f85576fc0bad1a8e3dbfc3c5bee7ba7146560be9d60d685b40adf91838"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269407,14 +267452,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5381 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_26D6 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
 		author = "Florian Roth"
-		id = "906cd223-3c34-5e3b-8a04-97b87e9e1752"
+		id = "a12c787e-13d9-5b1e-9212-7bd59ad69803"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269423,7 +267468,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_26D6 : FILE
 		hash = "26d67d479dafe6b33c980bd1eed0b6d749f43d05d001c5dcaaf5fcddb9b899fe"
 		hash = "6a234a2b8eb3844f7b5831ee048f88e8a76e9d38e753cc82f61b234c79fe1660"
 		hash = "2fa78c2988f9580b0c18822b117d065fb419f9c476f4cfa43925ba6cd2dffac3"
-		logic_hash = "66f4b6bb594702e2bbc813988f048170277f5dd06f840b9c9bf7269a774654d7"
+		logic_hash = "v1_sha256_66f4b6bb594702e2bbc813988f048170277f5dd06f840b9c9bf7269a774654d7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269439,14 +267484,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_26D6 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000770079006a00730071002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asustek_Driversys_Ectool_927C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver7-x86-withoutdbg.sys"
 		author = "Florian Roth"
-		id = "4513216a-2654-5743-8550-01e82743f67a"
+		id = "68183932-66b9-51ca-a963-efeb3ec2ea96"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269456,7 +267501,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustek_Driversys_Ectool_927C : FILE
 		hash = "42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0"
 		hash = "1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb"
 		hash = "771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd"
-		logic_hash = "edb698ba1d60e24a41c683a8c0a36548d01c4abd09f5a6cd2358ccf0d8e234ba"
+		logic_hash = "v1_sha256_edb698ba1d60e24a41c683a8c0a36548d01c4abd09f5a6cd2358ccf0d8e234ba"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269472,21 +267517,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustek_Driversys_Ectool_927C : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantimalwaredriver_DD62 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Tmel.sys"
 		author = "Florian Roth"
-		id = "31dc7b9b-b8bd-5af5-be43-ad3bfdc2a5b3"
+		id = "b8e96e68-813e-587e-83d6-fc279a61d33c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1506-L1525"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "dd628061d6e53f3f0b44f409ad914b3494c5d7b5ff6ff0e8fc3161aacec93e96"
-		logic_hash = "f0bf2e418bed091c1d9f1d604f284586f27d2d28b277c29f241aeaee9b9bdccf"
+		logic_hash = "v1_sha256_f0bf2e418bed091c1d9f1d604f284586f27d2d28b277c29f241aeaee9b9bdccf"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269502,21 +267547,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantim
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorp_Stdcdrvwssys_Selftestdatacollectordriverforwindowsx_70AF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - stdcdrvws64.sys"
 		author = "Florian Roth"
-		id = "8915229e-1b50-5c66-b20c-7221e3645c17"
+		id = "dd5132d4-104b-55c1-b61b-7fa5c8fcd2a4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1528-L1547"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "70afdc0e11db840d5367afe53c35d9642c1cf616c7832ab283781d085988e505"
-		logic_hash = "06aae42f1cfaaa5d797ef384786a8cdb54685465240d324216d8832be82c5db0"
+		logic_hash = "v1_sha256_06aae42f1cfaaa5d797ef384786a8cdb54685465240d324216d8832be82c5db0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269532,21 +267577,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorp_Stdcdrvwssys_Selftestdatacollectordriv
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realteksemiconductorcorp_Rtportsys_Realtekportio_FF32 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
 		author = "Florian Roth"
-		id = "4f6b5de0-26e8-50f8-b4a1-948b6acebb62"
+		id = "7a7914f4-862a-5221-a8d3-3ade50c79540"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1550-L1569"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ff322cd0cc30976f9dbdb7a3681529aeab0de7b7f5c5763362b02c15da9657a1"
-		logic_hash = "814b2a2bc284623f620341ec841cd080eb04ef9c9f4a11387d0b79c5010e70e8"
+		logic_hash = "v1_sha256_814b2a2bc284623f620341ec841cd080eb04ef9c9f4a11387d0b79c5010e70e8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269562,21 +267607,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realteksemiconductorcorp_Rtportsys_Realtekportio
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200031003900390039002d00320030003000310020005200450041004c00540045004b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_A6F7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "f8f7041b-7141-5f0e-9bec-aaf2b54e5c94"
+		id = "38bc421a-5ce9-5558-8f6d-8e4986ef9097"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1572-L1591"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a6f7897cd08fe9de5e902bb204ff87215584a008f458357d019a50d6139ca4af"
-		logic_hash = "e6b52b789ba1f5bf60722a7b4ec2f94e650b186605ea558780018edaa74090b4"
+		logic_hash = "v1_sha256_e6b52b789ba1f5bf60722a7b4ec2f94e650b186605ea558780018edaa74090b4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269592,14 +267637,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_A6F7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_834A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
 		author = "Florian Roth"
-		id = "e37497ee-2ee8-5517-8cbe-8aa218770816"
+		id = "ba31dfea-3184-5835-9102-c3346741ccfb"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269607,7 +267652,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_834A : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "834a3d755b5ae798561f8e5fbb18cf28dfcae7a111dc6a03967888e9d10f6d78"
 		hash = "e89cb7217ec1568b43ad9ca35bf059b17c3e26f093e373ab6ebdeee24272db21"
-		logic_hash = "54a915ecbb2fb9f77603a19628d8130cf9896bc649618e3448442e1408b1f8a4"
+		logic_hash = "v1_sha256_54a915ecbb2fb9f77603a19628d8130cf9896bc649618e3448442e1408b1f8a4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269622,14 +267667,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_834A : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310032002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_F4C7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
 		author = "Florian Roth"
-		id = "609554bc-0f2f-5861-ad56-fc7a772459a6"
+		id = "b2b89549-0422-5ee4-8351-daf5d7a4a036"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269638,7 +267683,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedrive
 		hash = "f4c7e94a7c2e49b130671b573a9e4ff4527a777978f371c659c3f97c14d126de"
 		hash = "cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb"
 		hash = "1fac3fab8ea2137a7e81a26de121187bf72e7d16ffa3e9aec3886e2376d3c718"
-		logic_hash = "e2af00ec7cb87e1fe02844a4f26a73c0276f5620f63a59903e4283e4be4b8c72"
+		logic_hash = "v1_sha256_e2af00ec7cb87e1fe02844a4f26a73c0276f5620f63a59903e4283e4be4b8c72"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269654,21 +267699,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedrive
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000340020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F42E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "8368db29-0a16-5a24-9053-ec5b079c1afc"
+		id = "e1f6eb8e-205a-5264-9965-0eb49b8d06be"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1640-L1659"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f42eb29f5b2bcb2a70d796fd71fd1b259d5380b216ee672cf46dcdd4604b87ad"
-		logic_hash = "2bbf7257a20468f12ffa8e8dc70c126a41124043acfcae776cda173ed68788c3"
+		logic_hash = "v1_sha256_2bbf7257a20468f12ffa8e8dc70c126a41124043acfcae776cda173ed68788c3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269684,21 +267729,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F42E : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CF4B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "61555f9e-6caf-5c8c-b4ee-01046e04f744"
+		id = "a7d1508c-fc2c-5494-94a7-72cce8dd13cc"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1662-L1681"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b"
-		logic_hash = "50f8cbf8834910e3560b3d092ae897977db2c9cb26107219e1604b2c26bba2ae"
+		logic_hash = "v1_sha256_50f8cbf8834910e3560b3d092ae897977db2c9cb26107219e1604b2c26bba2ae"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269714,14 +267759,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CF4B : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_3867 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "759c6fa4-abce-5dfc-924c-9fbe2ab5d6ff"
+		id = "24f33944-f18f-5e68-87f7-7f64454c397c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269729,7 +267774,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_3867 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "386745d23a841e1c768b5bdf052e0c79bb47245f9713ee64e2a63f330697f0c8"
 		hash = "5aee1bae73d056960b3a2d2e24ea07c44358dc7bc3f8ac58cc015cccc8f8d89c"
-		logic_hash = "f911813c40d65c443b01e00635da122cd1969817c6d3842eca7a5a20ff57513e"
+		logic_hash = "v1_sha256_f911813c40d65c443b01e00635da122cd1969817c6d3842eca7a5a20ff57513e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269745,21 +267790,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_3867 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003100300020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_D783 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "12d08eab-49f0-5d40-bd2d-1a4834deaef1"
+		id = "854c9721-2e53-5ec0-b16d-d25a4e0d55d2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1707-L1726"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f"
-		logic_hash = "f92c013f7c10a9c63b2f630b198d9ef360e944182b9760e8c268dc7145f82e95"
+		logic_hash = "v1_sha256_f92c013f7c10a9c63b2f630b198d9ef360e944182b9760e8c268dc7145f82e95"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269775,21 +267820,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_D783 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_4B52 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys"
 		author = "Florian Roth"
-		id = "06a605d6-893e-5ee7-a3d7-bfb128363b81"
+		id = "62f921b6-a4e4-5ead-87dd-868bb9480887"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1729-L1748"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
-		logic_hash = "c1df652b20d7bbea94d71bdef159c26b59180b736859bb4a16d03880a99d2841"
+		logic_hash = "v1_sha256_c1df652b20d7bbea94d71bdef159c26b59180b736859bb4a16d03880a99d2841"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269805,21 +267850,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_4B52 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003100200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_38D6 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
 		author = "Florian Roth"
-		id = "8ac8f353-494f-5940-a0f2-3f4ee61655e6"
+		id = "a8c0ba65-bde0-5f2a-8dfa-11dd643807c3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1751-L1770"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "38d6d90d543bf6037023c1b1b14212b4fa07731cbbb44bdb17e8faffc12b22e8"
-		logic_hash = "d1cc4c2d1335784f723849ab37131f3b5384628652594fe8e3a1ab4b0729eacd"
+		logic_hash = "v1_sha256_d1cc4c2d1335784f723849ab37131f3b5384628652594fe8e3a1ab4b0729eacd"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269835,14 +267880,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310033002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_I2cIo.sys"
 		author = "Florian Roth"
-		id = "eb5f5339-f11a-5502-8feb-4bfbd4698a31"
+		id = "938544b5-06b9-5547-be42-b58c8677a18c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -269851,7 +267896,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E1 :
 		hash = "42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb"
 		hash = "f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65"
 		hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
-		logic_hash = "cfdf34c33d78aebf592047ecc9f15b50d6c33c8d59e5d7684e9a862f440fa1ce"
+		logic_hash = "v1_sha256_cfdf34c33d78aebf592047ecc9f15b50d6c33c8d59e5d7684e9a862f440fa1ce"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269867,21 +267912,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E1 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d0032003000300036002000420049004f0053005400410052002000470072006f00750070 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_07AF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "3e0bd3b4-4a9f-5d06-ae16-f0c3acf8643a"
+		id = "dc51ccdb-731f-5aa5-a274-4a3a6e67e212"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1797-L1816"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "07af8c5659ad293214364789df270c0e6d03d90f4f4495da76abc2d534c64d88"
-		logic_hash = "832d90cd437cb6912630943fcae9e103341c0bc6770a4515525cf42f72812faa"
+		logic_hash = "v1_sha256_832d90cd437cb6912630943fcae9e103341c0bc6770a4515525cf42f72812faa"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269897,21 +267942,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_07AF : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200045006c00610062006f007200610074006500200042007900740065007300200032003000300030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Mitactechnologycorporation_Mtcbsvsys_Mitacsystemserviceprovider_C9CF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mtcBSv64.sys"
 		author = "Florian Roth"
-		id = "36fcbeca-f19e-54b8-9687-121bd9809e9d"
+		id = "4d661c9d-d628-5c26-97b2-650ff02a952c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1819-L1838"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8"
-		logic_hash = "402e0a50c61722ffbbf6778df2483750fae17d6a18d8b247d65df8302d725c14"
+		logic_hash = "v1_sha256_402e0a50c61722ffbbf6778df2483750fae17d6a18d8b247d65df8302d725c14"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269927,21 +267972,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Mitactechnologycorporation_Mtcbsvsys_Mitacsystem
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7125 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "0a115fe0-135b-5087-97ef-c5631b50d13f"
+		id = "c30bd393-b133-5631-b04e-b1dc2558ff0e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1841-L1860"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7125c9831a52d89d3d59fb28043b67fbe0068d69732da006fabb95550d1fa730"
-		logic_hash = "b91987339120b171bf8059bd06c95b25ec8124a902d53c0d05558e95bdfa588b"
+		logic_hash = "v1_sha256_b91987339120b171bf8059bd06c95b25ec8124a902d53c0d05558e95bdfa588b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269957,21 +268002,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7125 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100310020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F65 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "7b5d5036-d7ec-5722-a18c-9ccaeea8088e"
+		id = "da266799-1477-53f9-8dde-05659df1ead2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1863-L1882"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0"
-		logic_hash = "66fa3b5461eb9cf7c9f0eba976ac1546338ac11b937cc9753340042a0dc49066"
+		logic_hash = "v1_sha256_66fa3b5461eb9cf7c9f0eba976ac1546338ac11b937cc9753340042a0dc49066"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -269987,21 +268032,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F65 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003700200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_58A7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viraglt64.sys, viragt64.sys"
 		author = "Florian Roth"
-		id = "5ea684cc-982c-5056-9e80-26fe74cb3a64"
+		id = "86103b36-9496-59e5-bdbc-359496d6da9f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1885-L1904"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
-		logic_hash = "f1f16f31db7cd1249b3a76eddf0091a1b89d158da5c3beb1e3ed5ec18a3a7d72"
+		logic_hash = "v1_sha256_f1f16f31db7cd1249b3a76eddf0091a1b89d158da5c3beb1e3ed5ec18a3a7d72"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270017,21 +268062,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_58A7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltxsys_Pancafemanager_0650 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFltX64.sys"
 		author = "Florian Roth"
-		id = "bc354ed5-befe-5421-9dbe-a5faef0cfa4a"
+		id = "b4f66e18-3daf-50d1-b41e-858639b731d9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1907-L1926"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf"
-		logic_hash = "ad7595823bec8291999096f6249051d51741761c09e5a00ed72b01beeb13389b"
+		logic_hash = "v1_sha256_ad7595823bec8291999096f6249051d51741761c09e5a00ed72b01beeb13389b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270047,14 +268092,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfl
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_D633 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "e99866a4-4787-5813-835f-0c9570f80eda"
+		id = "66d223d2-be83-55d8-a287-30f83bcb27d3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270062,7 +268107,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d633055c7eda26dacfc30109eb790625519fc7b0a3a601ceed9e21918aad8a1b"
 		hash = "29f449fca0a41deccef5b0dccd22af18259222f69ed6389beafe8d5168c59e36"
-		logic_hash = "40d935ad81305da16adadabbbb18376bb0af64df5ce164625ec1e223ee01ceba"
+		logic_hash = "v1_sha256_40d935ad81305da16adadabbbb18376bb0af64df5ce164625ec1e223ee01ceba"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270078,21 +268123,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_0F17 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "a54ff7bf-30a8-5cfc-aaca-a172bee2062b"
+		id = "f0adffec-1bf4-5f4a-a599-9ae807137dd6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L1952-L1971"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf"
-		logic_hash = "3e9d3d998c97ac3491211c231552ee36be1428ca8ec61e89e9c1c1b7ff4ccf22"
+		logic_hash = "v1_sha256_3e9d3d998c97ac3491211c231552ee36be1428ca8ec61e89e9c1c1b7ff4ccf22"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270108,14 +268153,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_0F17 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Bsmisys_5962 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BSMI.sys, BSMIXP64.sys"
 		author = "Florian Roth"
-		id = "86a0715c-4f0b-52ba-b6dc-44bd4499a222"
+		id = "de87c165-b963-5f0b-aead-0c22c225a297"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270123,7 +268168,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Bsmisys_5962 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
 		hash = "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9"
-		logic_hash = "2ddfc5fea50425403654a8c60b372e2416cb0e0424ab26a8812e0b1fb35d399d"
+		logic_hash = "v1_sha256_2ddfc5fea50425403654a8c60b372e2416cb0e0424ab26a8812e0b1fb35d399d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270137,14 +268182,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Bsmisys_5962 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000420049004f005300540041005200200043006f00720070002e00200032003000310031 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_C6FE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
 		author = "Florian Roth"
-		id = "4472b910-a043-5c2b-ab57-2a5f6d19f5f0"
+		id = "74309e74-e5ec-50c4-9841-52064b3a9c00"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270154,7 +268199,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_C6FE : FILE
 		hash = "e7b79fe1377b3da749590c080d4d96e59e622b1013b2183b98c81baa8bf2fffe"
 		hash = "f77fe6b1e0e913ac109335a8fa2ac4961d35cbbd50729936059aba8700690a9e"
 		hash = "1675eedd4c7f2ec47002d623bb4ec689ca9683020e0fdb0729a9047c8fb953dd"
-		logic_hash = "15258a5e43b0728b4ab93211fa636f90bdf53c4547733c1ef68ef82f8f26839c"
+		logic_hash = "v1_sha256_15258a5e43b0728b4ab93211fa636f90bdf53c4547733c1ef68ef82f8f26839c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270169,21 +268214,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_C6FE : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310035002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_AF16 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "7863f53e-e2eb-5302-8a28-91966f3d8482"
+		id = "1f5e809e-e308-5fa2-bfce-58e5641ca5d6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2019-L2038"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "af16c36480d806adca881e4073dcd41acb20c35ed0b1a8f9bd4331de655036e1"
-		logic_hash = "390b48999576261d87a970dee3dd1da4d82f45bdcf4db37be180c464bacfa488"
+		logic_hash = "v1_sha256_390b48999576261d87a970dee3dd1da4d82f45bdcf4db37be180c464bacfa488"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270199,14 +268244,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_AF16 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003200200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_99F4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "b1168895-eef9-5dfc-9b19-b3e0e302586d"
+		id = "2895a0a4-0eee-5950-87b4-3d9a79dac925"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270243,7 +268288,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_99F4 : FILE
 		hash = "47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005"
 		hash = "38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a"
 		hash = "ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0"
-		logic_hash = "762965fc7a01b572f1eee45df3f84a13ac185b7a9cbba9b04c285c2e798353e0"
+		logic_hash = "v1_sha256_762965fc7a01b572f1eee45df3f84a13ac185b7a9cbba9b04c285c2e798353e0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270259,21 +268304,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_99F4 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhardwaremanagerdriver_7C8A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
 		author = "Florian Roth"
-		id = "4d44aa9c-4f6d-5d70-886d-43a602c1d6d0"
+		id = "a34c6a0c-2284-507b-979e-3e69f137ee5a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2093-L2112"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7c8ad57b3a224fdc2aac9dd2d7c3624f1fcd3542d4db804de25a90155657e2cc"
-		logic_hash = "cc7c365f36d9c7fc0367b57f9d5b24004c8c4453e0ed227941623c6057fce39a"
+		logic_hash = "v1_sha256_cc7c365f36d9c7fc0367b57f9d5b24004c8c4453e0ed227941623c6057fce39a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270289,14 +268334,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhardwar
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0032003000300032002d0032003000310038004e0043005200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avaluetechnologyinc_Avalueio_Avalueio_A5A4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - avalueio.sys"
 		author = "Florian Roth"
-		id = "e0e5d6b9-6e7e-5955-b7f0-a4c331fb19fc"
+		id = "f6da25c9-6988-5394-ac7f-acc6c35d630d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270304,7 +268349,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avaluetechnologyinc_Avalueio_Avalueio_A5A4 : FIL
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a5a4a3c3d3d5a79f3ed703fc56d45011c21f9913001fcbcc43a3f7572cff44ec"
 		hash = "defde359045213ae6ae278e2a92c5b4a46a74119902364c7957a38138e9c9bbd"
-		logic_hash = "ec187ba5aadc7b9395008155d4b6331b099b3ae9e3ab738568a9980b3d0ce448"
+		logic_hash = "v1_sha256_ec187ba5aadc7b9395008155d4b6331b099b3ae9e3ab738568a9980b3d0ce448"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270320,14 +268365,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avaluetechnologyinc_Avalueio_Avalueio_A5A4 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020006300200032003000310036 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatftatcamfntamfnbvctvcbmftwc_5F5E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Bs_Def.sys"
 		author = "Florian Roth"
-		id = "e4e1fc9a-b453-5996-8675-7accb0de023e"
+		id = "7c6cd75f-1c5f-5819-9a04-6d2257a749d9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270337,7 +268382,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatf
 		hash = "3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5"
 		hash = "0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3"
 		hash = "36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb"
-		logic_hash = "bc91d83188674f0b81615a983aa92e905c878afa3040b4895778222249db8929"
+		logic_hash = "v1_sha256_bc91d83188674f0b81615a983aa92e905c878afa3040b4895778222249db8929"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270353,14 +268398,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatf
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004100730075007300540065006b00200043006f006d00700075007400650072002e00200031003900390032002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F27F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
 		author = "Florian Roth"
-		id = "73d525b8-d109-5872-8841-b1c5149f732e"
+		id = "71954321-8e0f-559b-8491-df914d0b3f57"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270372,7 +268417,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F27F : FILE
 		hash = "e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790"
 		hash = "ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a"
 		hash = "da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d"
-		logic_hash = "0395f7d17d51104b09a35065dcebf608ae8a60fde71c22c1f6d414c2fd0c7cc9"
+		logic_hash = "v1_sha256_0395f7d17d51104b09a35065dcebf608ae8a60fde71c22c1f6d414c2fd0c7cc9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270387,21 +268432,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F27F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_965D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx64.sys"
 		author = "Florian Roth"
-		id = "74533a7c-1b5b-5840-843c-455fc73c4e19"
+		id = "aed407b8-3b57-5af6-bbf8-281913801cc4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2189-L2208"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "965d4f981b54669a96c5ab02d09bf0a9850d13862425b8981f1a9271350f28bb"
-		logic_hash = "e5ba23bf3914d121647d6b7aef5ec81d9d62af56397e152fb39179349f1f6146"
+		logic_hash = "v1_sha256_e5ba23bf3914d121647d6b7aef5ec81d9d62af56397e152fb39179349f1f6146"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270417,14 +268462,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_965D : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310031 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5A66 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
 		author = "Florian Roth"
-		id = "ba5a060c-e889-5f23-9938-7fbfceaae7af"
+		id = "eea8a6f3-eab8-5823-a9f6-dd0a56cccdab"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270436,7 +268481,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5A66 : FILE
 		hash = "76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22"
 		hash = "2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0"
 		hash = "b0b6a410c22cc36f478ff874d4a23d2e4b4e37c6e55f2a095fc4c3ef32bcb763"
-		logic_hash = "ebc8dd2d213b0ff084b8537cc50d7bc2ba692b103251dfc976cad1d2767fc5e3"
+		logic_hash = "v1_sha256_ebc8dd2d213b0ff084b8537cc50d7bc2ba692b103251dfc976cad1d2767fc5e3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270451,21 +268496,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5A66 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panioxsys_Paniolibrary_6B83 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIOx64.sys"
 		author = "Florian Roth"
-		id = "c5eec4c9-0210-5e0e-b819-96a6943f270d"
+		id = "ecb2e423-2b6e-5a72-9779-fec47ec22829"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2237-L2256"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74"
-		logic_hash = "d6d95fe0d738012ca0643f478c59accd2d1e47742a502f5fea65040e59e9f42a"
+		logic_hash = "v1_sha256_d6d95fe0d738012ca0643f478c59accd2d1e47742a502f5fea65040e59e9f42a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270481,21 +268526,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panioxsy
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_82FB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "db7c877e-4b76-5b66-8a4f-a33cb7c76d5a"
+		id = "f79a78fa-4766-5459-a9b5-2b013998c598"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2259-L2278"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989"
-		logic_hash = "38df982e74818094d0aa508b6b0ad94b885e6554760b4678de833fcc86e8bb13"
+		logic_hash = "v1_sha256_38df982e74818094d0aa508b6b0ad94b885e6554760b4678de833fcc86e8bb13"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270511,21 +268556,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_82FB : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Entechtaiwan_Seasys_Softenginex_6CB5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Se64a.sys"
 		author = "Florian Roth"
-		id = "c6298a6f-761c-5e78-b97c-9713b29b0e00"
+		id = "3939bbeb-e276-51ba-aa00-b67bf9042988"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2281-L2300"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc"
-		logic_hash = "aa425e95a0b920bf68c0221d8fb1cc16f00755b626f496b758cf50d26949c27b"
+		logic_hash = "v1_sha256_aa425e95a0b920bf68c0221d8fb1cc16f00755b626f496b758cf50d26949c27b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270541,21 +268586,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Entechtaiwan_Seasys_Softenginex_6CB5 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200045006e0054006500630068002000540061006900770061006e002c00200032003000300034002d0032003000300036002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0B54 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "87caf882-a59a-55ca-89ce-a2c2115a1e50"
+		id = "b8dba457-68f6-5ed8-83c7-c52e034d233f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2303-L2322"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917"
-		logic_hash = "264c22a6b54b47962561ea3d8400aab606dd2d28f5d288ba4777ff2ca290c38e"
+		logic_hash = "v1_sha256_264c22a6b54b47962561ea3d8400aab606dd2d28f5d288ba4777ff2ca290c38e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270571,14 +268616,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_F159 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
 		author = "Florian Roth"
-		id = "8b50ddd6-40b2-5d3e-b9b9-c166e241e611"
+		id = "e61aabde-51b8-5ab7-9bf9-364983e19f6a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270588,7 +268633,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_F159 : FILE
 		hash = "9fa120bda98633e30480d8475c9ac6637470c4ca7c63763560bf869138091b01"
 		hash = "0b547368c03e0a584ae3c5e62af3728426c68b316a15f3290316844d193ad182"
 		hash = "9eba5d1545fdbf37cf053ac3f3ba45bcb651b8abb7805cbfdfb5f91ea294fb95"
-		logic_hash = "070d055353bb978e4d8bd82ea4eed3291b747414423cb9ab45676e692defa7bb"
+		logic_hash = "v1_sha256_070d055353bb978e4d8bd82ea4eed3291b747414423cb9ab45676e692defa7bb"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270604,21 +268649,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_F159 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310037002e002000520061007a00650072002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1273 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "323e0a63-c74c-5d9c-b3af-c64d2bceb724"
+		id = "8f20848b-fa91-520b-958f-ddec5fc81b02"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2350-L2369"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1"
-		logic_hash = "1bf31b51302ade1b65e6c24a0dfcc6e144a2f0104e687cef4a14e6307c27c9e1"
+		logic_hash = "v1_sha256_1bf31b51302ade1b65e6c24a0dfcc6e144a2f0104e687cef4a14e6307c27c9e1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270634,14 +268679,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1273 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "2c945052-bb7b-52be-9c11-18eedac5a28e"
+		id = "d341cdf9-582e-586a-b93e-af9bd1814836"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270649,7 +268694,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854 : FI
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039"
 		hash = "b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3"
-		logic_hash = "0cdfef6284465ea9f5509cb4e0ad6efb531d60150fb355a388f8152b322e3da9"
+		logic_hash = "v1_sha256_0cdfef6284465ea9f5509cb4e0ad6efb531d60150fb355a388f8152b322e3da9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270665,14 +268710,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdriveservicedriver_3C11 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AODDriver.sys"
 		author = "Florian Roth"
-		id = "64eea295-1181-5364-a30a-3ee0e329a04d"
+		id = "cbeb32ae-45ec-542b-9751-e009c8a2abd2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270681,7 +268726,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdrivese
 		hash = "3c11dec1571253594d64619d8efc8c0212897be84a75a8646c578e665f58bf5d"
 		hash = "5a0b10a9e662a0b0eeb951ffd2a82cc71d30939a78daebd26b3f58bb24351ac9"
 		hash = "7a1105548bfc4b0a1b7b891cde0356d39b6633975cbcd0f2e2d8e31b3646d2ca"
-		logic_hash = "76740f37a63b7fcf52dc77db4384bc2d232c993ba3553dbfbdd897413b3d1306"
+		logic_hash = "v1_sha256_76740f37a63b7fcf52dc77db4384bc2d232c993ba3553dbfbdd897413b3d1306"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270697,21 +268742,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdrivese
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020003200300030003900200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_EAA5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "d7e481c0-695e-5536-8b06-b66d0f711f86"
+		id = "1598e576-7ffe-5335-9f1e-d3ec40aec3ab"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2419-L2438"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "eaa5dae373553024d7294105e4e07d996f3a8bd47c770cdf8df79bf57619a8cd"
-		logic_hash = "9149c106ff7ea0326b9e010ef7ae32c25f57c3b9b2e738f4915eda205a512888"
+		logic_hash = "v1_sha256_9149c106ff7ea0326b9e010ef7ae32c25f57c3b9b2e738f4915eda205a512888"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270727,21 +268772,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Wind
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_8FE9 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "45ac5fe9-25e2-5ee9-a410-95d19ec75e33"
+		id = "0759994a-d607-5952-94d0-a4beab741688"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2441-L2457"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
-		logic_hash = "f293cb0a8bbc710428a7a4ae582f9d6ed60954afeb84efe8b74da38ff41732c1"
+		logic_hash = "v1_sha256_f293cb0a8bbc710428a7a4ae582f9d6ed60954afeb84efe8b74da38ff41732c1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270754,14 +268799,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_8FE9 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_4932 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "6fa00211-cb55-5870-92ec-18a6e2c7eb89"
+		id = "48b4a03c-e34e-596f-bd63-50adf2ce3a4f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270776,7 +268821,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Wind
 		hash = "8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126"
 		hash = "79440da6b8178998bdda5ebde90491c124b1967d295db1449ec820a85dc246dd"
 		hash = "6001c6acae09d2a91f8773bbdfd52654c99bc672a9756dc4cb53dc2e3efeb097"
-		logic_hash = "683d1c1b912190afc4933e285a335257039356935354a851faa4cdc31f59a144"
+		logic_hash = "v1_sha256_683d1c1b912190afc4933e285a335257039356935354a851faa4cdc31f59a144"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270792,21 +268837,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Wind
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3D9E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "023a5c66-aae0-5583-95aa-0a62f3f27352"
+		id = "7c95ec6a-5f0e-543d-ba20-4312303c84e0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2490-L2509"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3"
-		logic_hash = "fdb944988945780b774d73f3d729d2468b0c9006aca100fa8bbf913a9c5402c6"
+		logic_hash = "v1_sha256_fdb944988945780b774d73f3d729d2468b0c9006aca100fa8bbf913a9c5402c6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270822,21 +268867,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3D9E : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Logitech_Lgcoretempsys_Lgcoretemp_E0CB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LgCoreTemp.sys"
 		author = "Florian Roth"
-		id = "148a795b-926c-50eb-8da4-bbf8d1ceb3bb"
+		id = "67470dce-783d-5c7d-b6a6-b41ba1ff5303"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2512-L2531"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e0cb07a0624ddfacaa882af49e3783ae02c9fbd0ab232541a05a95b4a8abd8ef"
-		logic_hash = "f3162a80eb6ab357766aaafbf62aec608291873980c81c6d21d835bc349cda76"
+		logic_hash = "v1_sha256_f3162a80eb6ab357766aaafbf62aec608291873980c81c6d21d835bc349cda76"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270852,21 +268897,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Logitech_Lgcoretempsys_Lgcoretemp_E0CB : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020004c006f006700690074006500630068002c00200049006e0063 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Stdcdrvsys_Selftestdatacollector_3702 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - stdcdrv64.sys"
 		author = "Florian Roth"
-		id = "e9509179-09c1-58e7-a08c-ceffd1c6c05c"
+		id = "e311f361-fc9d-5ebf-b5ff-99571fdf70a1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2534-L2553"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "37022838c4327e2a5805e8479330d8ff6f8cd3495079905e867811906c98ea20"
-		logic_hash = "dfc77d3461c57240baea160b35e9174aa370fc533d08a9331dd8ce53a0048ad4"
+		logic_hash = "v1_sha256_dfc77d3461c57240baea160b35e9174aa370fc533d08a9331dd8ce53a0048ad4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270882,14 +268927,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Stdcdrvsys_Selftestdatacollecto
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200049006e00740065006c00200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_2BBE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "fbe65027-5e7a-5944-bd8a-c0673cd165a1"
+		id = "b01feacf-494a-554e-afa1-c6faf6d30d6f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270897,7 +268942,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_2BBE : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250"
 		hash = "e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a"
-		logic_hash = "23365c52fd3ce5d9c113c0779072b82325632c75f27cbfde9037b7ffc543a209"
+		logic_hash = "v1_sha256_23365c52fd3ce5d9c113c0779072b82325632c75f27cbfde9037b7ffc543a209"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270913,14 +268958,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_2BBE : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_092D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
 		author = "Florian Roth"
-		id = "89160c3c-ff81-5425-a205-09be7fd5a412"
+		id = "f714a71a-47dc-550c-a719-ae4833bf6e93"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -270928,7 +268973,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0"
 		hash = "0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c"
-		logic_hash = "771400b6e3f2d216fd38db681bf78fbc4e764a45ff9e11d2e33b62f93ac4a8e2"
+		logic_hash = "v1_sha256_771400b6e3f2d216fd38db681bf78fbc4e764a45ff9e11d2e33b62f93ac4a8e2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270944,21 +268989,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovider_3C0A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
 		author = "Florian Roth"
-		id = "41080479-633a-5f9b-88c9-fba696c3205a"
+		id = "7c9731c9-8bc8-54a4-8958-a8625bd43fa2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2602-L2621"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3c0a36990f7eef89b2d5f454b6452b6df1304609903f31f475502e4050241dd8"
-		logic_hash = "0460def7e251adf398560c0f05cac2d161951339eb2bcc2b2f4840edbd0d6991"
+		logic_hash = "v1_sha256_0460def7e251adf398560c0f05cac2d161951339eb2bcc2b2f4840edbd0d6991"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -270974,21 +269019,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovide
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200032003000300035 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5FAE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
 		author = "Florian Roth"
-		id = "f80d2c53-58e9-5e76-94fc-9a86ea80cfc9"
+		id = "ff2e0e7f-67aa-5fdc-be72-96d59f14a05b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2624-L2643"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5fae7e491b0d919f0b551e15e0942ac7772f2889722684aea32cff369e975879"
-		logic_hash = "7dfbd2e11b8a37a8b276a2279f19f57064f3d561cf2555680c71679206ec1452"
+		logic_hash = "v1_sha256_7dfbd2e11b8a37a8b276a2279f19f57064f3d561cf2555680c71679206ec1452"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271004,21 +269049,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5FAE : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxusbmonsys_Virtualboxusbmonitordriver_3D05 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxUSBMon.sys"
 		author = "Florian Roth"
-		id = "b765649a-a926-50cd-9772-86ed7538dd2e"
+		id = "a8fe9891-8925-5180-ade5-6a80d4f079c5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2646-L2665"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3d055be2671e136c937f361cef905e295ddb6983526341f1d5f80a16b7655b40"
-		logic_hash = "ca021b6b3c733e75d33996652ca9602541e4c9eb9e74f2a995d1b2c2989ca68b"
+		logic_hash = "v1_sha256_ca021b6b3c733e75d33996652ca9602541e4c9eb9e74f2a995d1b2c2989ca68b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271034,21 +269079,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxusbmonsys_Virtualboxusbmonitordr
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1A45 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
 		author = "Florian Roth"
-		id = "a9aae6dc-3328-5541-a437-509b5ac81261"
+		id = "1c6336d7-564c-5a82-be35-787cb21ebb52"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2668-L2687"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1a450ae0c9258ab0ae64f126f876b5feed63498db729ec61d06ed280e6c46f67"
-		logic_hash = "51f72d08bd6f0b0e683a9af729e16e08e8d652d9ea5f43872aa402ec3da65cfe"
+		logic_hash = "v1_sha256_51f72d08bd6f0b0e683a9af729e16e08e8d652d9ea5f43872aa402ec3da65cfe"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271064,14 +269109,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1A45 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "e66960f5-d39e-5b0b-b573-77ffeb276925"
+		id = "b1ba11e1-1064-53ac-a4e2-305c79ee96ef"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271079,7 +269124,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5 : FI
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0"
 		hash = "ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7"
-		logic_hash = "13b9c0f468e8ce5a9ff8938879d6d22a56c0d7e01b3a72969ecff55954a07b89"
+		logic_hash = "v1_sha256_13b9c0f468e8ce5a9ff8938879d6d22a56c0d7e01b3a72969ecff55954a07b89"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271095,14 +269140,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Yyinc_Dianhu_80CB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys"
 		author = "Florian Roth"
-		id = "166a402d-9679-54b8-9703-3e3b2b001236"
+		id = "8c003722-17b9-55d9-beca-eb92d70022cd"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271110,7 +269155,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Yyinc_Dianhu_80CB : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
 		hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955"
-		logic_hash = "fb1f5f8687f1673585ee2652b9dde20ae925ee33d527d2052707b2370a5df1fc"
+		logic_hash = "v1_sha256_fb1f5f8687f1673585ee2652b9dde20ae925ee33d527d2052707b2370a5df1fc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271124,14 +269169,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Yyinc_Dianhu_80CB : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d003200300031003700200059005900200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8F68 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "6a773b61-ac40-5cdd-ad93-0b16061587f7"
+		id = "4569aa88-e10c-59ea-83e5-040e22d9e8ed"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271141,7 +269186,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8F68 : FILE
 		hash = "7227377a47204f8e2ff167eee54b4b3545c0a19e3727f0ec59974e1a904f4a96"
 		hash = "c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9"
 		hash = "b11e109f6b3dbc8aa82cd7da0b7ba93d07d9809ee2a4b21ec014f6a676a53027"
-		logic_hash = "7be41a2e50b883e4e8196b37a35c5b1fd4169b3bc1975832baa4b8983bcfb051"
+		logic_hash = "v1_sha256_7be41a2e50b883e4e8196b37a35c5b1fd4169b3bc1975832baa4b8983bcfb051"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271157,21 +269202,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8F68 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003600200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_A5A5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "b68851b2-66b6-5b8a-9aaa-918a34934a92"
+		id = "2e8da3b4-1e95-5ead-9d89-70adaf48421d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2759-L2778"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad"
-		logic_hash = "38048706f3e5bd4248779dc8890d14a31daafa177c51953c31f2e7a81c6871a0"
+		logic_hash = "v1_sha256_38048706f3e5bd4248779dc8890d14a31daafa177c51953c31f2e7a81c6871a0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271187,21 +269232,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_A5A5 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Wnbiossys_Windowsrwinddkdriver_530D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wnbios.sys"
 		author = "Florian Roth"
-		id = "98c36c7b-603b-5fe4-8774-7ea9ecf84ef9"
+		id = "26567246-e710-56a7-a1d4-ce88ca685aff"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2781-L2800"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "530d9223ec7e4123532a403abef96dfd1af5291eb49497392ff5d14d18fccfbb"
-		logic_hash = "73e496811ab4097aa8311e510fa913a10691a00e314944d509df05084d373379"
+		logic_hash = "v1_sha256_73e496811ab4097aa8311e510fa913a10691a00e314944d509df05084d373379"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271217,21 +269262,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Wnbiossys_Windowsrwinddkd
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_98EC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "67443d8d-b463-51f0-96fa-8ed06833286f"
+		id = "a2c08ac0-9eed-5728-bd9b-e718987b6ff2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2803-L2822"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "98ec7cc994d26699f5d26103a0aeb361128cff3c2c4d624fc99126540e23e97e"
-		logic_hash = "27e4fb74a63ee1fe3b3bcf97e2ed01b02d05339cce2f18c2f010577d80dbb243"
+		logic_hash = "v1_sha256_27e4fb74a63ee1fe3b3bcf97e2ed01b02d05339cce2f18c2f010577d80dbb243"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271247,21 +269292,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_98EC : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200045006c00610062006f007200610074006500200042007900740065007300200032003000300030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_591B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "b4f581f6-66e5-5b85-9b2d-b1532dd2defe"
+		id = "46b0ba03-276e-579e-92a6-dbb33cf91106"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2825-L2844"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52"
-		logic_hash = "471fab20146586dacf37b9bb3f43ee578339c73f204487556987803d12a64f95"
+		logic_hash = "v1_sha256_471fab20146586dacf37b9bb3f43ee578339c73f204487556987803d12a64f95"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271277,14 +269322,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_591B : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_47EA : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0.sys, WinRing0x64"
 		author = "Florian Roth"
-		id = "b14e5697-a0f7-5af0-a0da-0f5ca2d88c1c"
+		id = "611d71f1-436f-5a97-89c6-5ececeda340e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271292,7 +269337,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_47EA : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84"
 		hash = "3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8"
-		logic_hash = "e6bea09a04b7f043d9a8cef4c8dc3e2f087fdf1a981f6d23dee728ea6d15d792"
+		logic_hash = "v1_sha256_e6bea09a04b7f043d9a8cef4c8dc3e2f087fdf1a981f6d23dee728ea6d15d792"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271308,21 +269353,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_47EA : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_6532 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
 		author = "Florian Roth"
-		id = "b9a6e1e6-1bc5-587f-a31f-8dc55568ad9e"
+		id = "a5ca2a78-9be6-5496-b5e4-45d1a9ce9ee7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2870-L2889"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
-		logic_hash = "b4f90f50b2e90fd8dc57778ba8f650ed201fe2f11f145e981d13021f87746d1f"
+		logic_hash = "v1_sha256_b4f90f50b2e90fd8dc57778ba8f650ed201fe2f11f145e981d13021f87746d1f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271338,21 +269383,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310035002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_909D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
 		author = "Florian Roth"
-		id = "8dcbf930-ae97-5389-9b68-793dc82b042b"
+		id = "23ddc2aa-b674-576c-a4a1-37c420120c32"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2892-L2911"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880"
-		logic_hash = "669972137fad6a5cc701ea56cf8ae85e08d2131f026e8cf1bd5c85ca1754d3cb"
+		logic_hash = "v1_sha256_669972137fad6a5cc701ea56cf8ae85e08d2131f026e8cf1bd5c85ca1754d3cb"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271368,14 +269413,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003000200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_AD40 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atillk64.sys"
 		author = "Florian Roth"
-		id = "f5e53c71-1c12-5df8-a2cc-563473190c87"
+		id = "b9441942-84a2-5a15-8752-198ecac9bbb1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271387,7 +269432,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_AD40
 		hash = "c825a47817399e988912bb75106befaefae0babc0743a7e32b46f17469c78cad"
 		hash = "be66f3bbfed7d648cfd110853ddb8cef561f94a45405afc6be06e846b697d2b0"
 		hash = "5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a"
-		logic_hash = "929e467d52a19dfba2c8ca6c4124881d76c239a4d04ce10c195665bf4bfea373"
+		logic_hash = "v1_sha256_929e467d52a19dfba2c8ca6c4124881d76c239a4d04ce10c195665bf4bfea373"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271403,14 +269448,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_AD40
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e002c00200032003000300033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_E502 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "b0f9239b-2acb-5164-8b21-791f69d4e047"
+		id = "6f4f7c16-e476-5ed1-ba03-145868277261"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271420,7 +269465,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_E502 : FILE
 		hash = "5c80dc051c4b0c62b9284211f71e5567c0c0187e466591eacb93e7dc10e4b9ab"
 		hash = "d6801e845d380c809d0da8c7a5d3cd2faa382875ae72f5f7af667a34df25fbf7"
 		hash = "d474ea066d416ded9ed8501c285ca6b1c26a1d1c813c8f6bd5523eeb66c5d01e"
-		logic_hash = "f1e88064cf1a4902da5ee870a605219943740e557845b1f4e99f1cea2c28b77c"
+		logic_hash = "v1_sha256_f1e88064cf1a4902da5ee870a605219943740e557845b1f4e99f1cea2c28b77c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271436,21 +269481,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_E502 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003100300020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0CD4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "6ee8fb67-896d-534f-9602-a0f46a43e5cd"
+		id = "17543626-9047-511e-a907-788060577f48"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2966-L2985"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c"
-		logic_hash = "b0ef81e3a05326390a7d2f00499cf3aaf0610b03f3df2313d5a1f2dddff3555f"
+		logic_hash = "v1_sha256_b0ef81e3a05326390a7d2f00499cf3aaf0610b03f3df2313d5a1f2dddff3555f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271466,21 +269511,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_3FA6 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "25f27f08-3aab-5b8f-bf59-37a40de4fb44"
+		id = "8b559566-a604-5642-a114-005c927ade96"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L2988-L3007"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e"
-		logic_hash = "c1d75b4073f212403f3e7b50cd8c1ea2a8a979bca7cf2dd4cd05bfca03d49c48"
+		logic_hash = "v1_sha256_c1d75b4073f212403f3e7b50cd8c1ea2a8a979bca7cf2dd4cd05bfca03d49c48"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271496,21 +269541,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_3FA6 : F
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3E1D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "d8d61d0b-d859-5e7e-9ef6-b232ab499560"
+		id = "cf999d1b-962f-53b7-bff3-57a0e9d4bc4f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3010-L3029"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272"
-		logic_hash = "29f4dbbd8dd749a9ccf94cd59010c8c8b63ce1d33c93f05b1f24b1e6a216aff6"
+		logic_hash = "v1_sha256_29f4dbbd8dd749a9ccf94cd59010c8c8b63ce1d33c93f05b1f24b1e6a216aff6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271526,21 +269571,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3E1D : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6FB5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "a9926e8c-f504-5926-8be0-e4e9ccf3b971"
+		id = "e293f23b-5f32-5c97-a65d-09a72d2e8bd5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3032-L3051"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d"
-		logic_hash = "108670db45ff60bd5d31187755019cd7530f29da12d36c96be06880c23d5e7f9"
+		logic_hash = "v1_sha256_108670db45ff60bd5d31187755019cd7530f29da12d36c96be06880c23d5e7f9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271556,14 +269601,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_3B71 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
 		author = "Florian Roth"
-		id = "da77918c-29d1-57f2-bf66-63f2759dc350"
+		id = "0c7bf23e-9da9-5245-ae0e-75e8e37f0b11"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271573,7 +269618,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_3B71 : FILE
 		hash = "72b67b6b38f5e5447880447a55fead7f1de51ca37ae4a0c2b2f23a4cb7455f35"
 		hash = "d04c72fd31e7d36b101ad30e119e14f6df9cbc7a761526da9b77f9e0b9888bc4"
 		hash = "87e094214feb56a482cd8ae7ee7c7882b5a8dccce7947fdaa04a660fa19f41e5"
-		logic_hash = "cbd39f2f901a1d5f1929331659fbad14e82a7e69cacc1b0c4ee2f8137e3613aa"
+		logic_hash = "v1_sha256_cbd39f2f901a1d5f1929331659fbad14e82a7e69cacc1b0c4ee2f8137e3613aa"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271588,21 +269633,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_3B71 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310035002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_0BD1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
 		author = "Florian Roth"
-		id = "6710f3a1-8cec-57be-a854-f848e693290a"
+		id = "422d01a9-3ab7-53f8-a44f-fc0d6093afb5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3078-L3097"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0bd1523a68900b80ed1bccb967643525cca55d4ff4622d0128913690e6bb619e"
-		logic_hash = "c5fa94fee1260b2c8f188c996ed4ce2095ad8c72fcf6a03b6985303209f17a3a"
+		logic_hash = "v1_sha256_c5fa94fee1260b2c8f188c996ed4ce2095ad8c72fcf6a03b6985303209f17a3a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271618,21 +269663,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_0BD1 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_1E94 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
 		author = "Florian Roth"
-		id = "a869389f-4b07-5f15-8157-f8880a8c4bbf"
+		id = "245cb69b-4f3c-57f0-881a-6c3898a6b497"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3100-L3119"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1e94d4e6d903e98f60c240dc841dcace5f9e8bbb0802e6648a49ab80c23318cb"
-		logic_hash = "86cbd2762bb8bf050343f4e738216a33764997046a9b59bbb6a435afa2859f0e"
+		logic_hash = "v1_sha256_86cbd2762bb8bf050343f4e738216a33764997046a9b59bbb6a435afa2859f0e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271648,21 +269693,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_1E94 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310031 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Hpdevelopmentcompany_Etdsuppsys_Hpetdidriverdll_F744 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - etdsupp.sys"
 		author = "Florian Roth"
-		id = "cfc5dca9-7ccc-590e-a79e-07f13cbbb080"
+		id = "cd8550b4-6345-50a5-98b7-b843ee4569ca"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3122-L3141"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
-		logic_hash = "9fcdfda30bb8fb16c5112c22b34be1c42f9ce1a32d21a7554ba0aff2a7696aa1"
+		logic_hash = "v1_sha256_9fcdfda30bb8fb16c5112c22b34be1c42f9ce1a32d21a7554ba0aff2a7696aa1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271678,14 +269723,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hpdevelopmentcompany_Etdsuppsys_Hpetdidriverdll_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200031003900390031002d00320030003200320020004800650077006c006500740074002d005000610063006b00610072006400200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079002c0020004c002e0050002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwinddkdriver_DB1D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
 		author = "Florian Roth"
-		id = "cca75a99-2482-54a2-8891-2cd23c8836e9"
+		id = "cc27a3c0-46f7-5266-aab4-6478091a94c7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271699,7 +269744,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwind
 		hash = "639ff79f13e40d47b90ecd709699edd10e740cb41451acb95590a68b6352de2b"
 		hash = "f488500be4eaafba74b644be95d4c0523297770fb9bb78c449f643ab8d4a05d9"
 		hash = "8017e618b5a7aa608cc4bce16e4defd6b4e99138c4ba1bdd6ad78e39f035cf59"
-		logic_hash = "c8ed6d101a45f797156391f2fa31ecdd66a21bff557a53e8af35838c8ab3d469"
+		logic_hash = "v1_sha256_c8ed6d101a45f797156391f2fa31ecdd66a21bff557a53e8af35838c8ab3d469"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271715,21 +269760,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwind
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020004e0065007400460069006c00740065007200530044004b002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_4ED2 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "a9729999-5b31-5b09-bdd1-9d47e4227ab5"
+		id = "9a7339d7-d401-5510-ba88-42f2004379b8"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3173-L3192"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7"
-		logic_hash = "07981841e989bc762fbce94915e29595b1e6db881ed57064c03b126019538fca"
+		logic_hash = "v1_sha256_07981841e989bc762fbce94915e29595b1e6db881ed57064c03b126019538fca"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271745,14 +269790,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_4ED2 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_1265 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
 		author = "Florian Roth"
-		id = "fde7c85f-96f3-536f-b0b5-0d12424c16a3"
+		id = "d6dd69fe-ba0a-5864-bfcc-68f553b2fe57"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271761,7 +269806,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_1265 : FILE
 		hash = "12656fc113b178fa3e6bfffc6473897766c44120082483eb8059ebff29b5d2df"
 		hash = "7ff8fe4c220cf6416984b70a7e272006a018e5662da3cedc2a88efeb6411b4a4"
 		hash = "1cd75de5f54b799b60789696587b56a4a793cf60775b81f236f0e65189d863af"
-		logic_hash = "894e7a4baa9287019f06e0dc91eccd11e2d3043f60be53efd2240879eb8d2772"
+		logic_hash = "v1_sha256_894e7a4baa9287019f06e0dc91eccd11e2d3043f60be53efd2240879eb8d2772"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271777,21 +269822,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_1265 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000770079006a00730071002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_1F81 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "9610cbd7-8521-54ea-a4db-c6d26048fb4b"
+		id = "32fd2f38-fcd3-58ac-9905-1b4d55ad7316"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3219-L3238"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501"
-		logic_hash = "e5b9e4c1559e91b575933d2dd5574a6c374fe967256f65243122c22efbc666ce"
+		logic_hash = "v1_sha256_e5b9e4c1559e91b575933d2dd5574a6c374fe967256f65243122c22efbc666ce"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271807,21 +269852,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_1F81 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_C79A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iobitunlocker.sys"
 		author = "Florian Roth"
-		id = "f81ad3f3-755f-546b-8246-2ee9dd885813"
+		id = "82eed543-f35e-586d-bed5-8ff245ed64cc"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3241-L3260"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66"
-		logic_hash = "b711978610592c579a05d332b72c294a5b960a18033264d6a75b8b482dbe8903"
+		logic_hash = "v1_sha256_b711978610592c579a05d332b72c294a5b960a18033264d6a75b8b482dbe8903"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271837,21 +269882,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_C79A : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0049004f00620069007400200043006f0070007900720069006700680074002000a900200032003000300035002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_16B5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "82c31b8b-46ae-5202-9ea5-d243063f8522"
+		id = "e5c85934-b629-5a42-831e-d13cacd0d674"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3263-L3282"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "16b591cf5dc1e7282fdb25e45497fe3efc8095cbe31c05f6d97c5221a9a547e1"
-		logic_hash = "57f379da59234cd2e83802180faecd15784a28fcd09f2eb0a5944f494972c9fc"
+		logic_hash = "v1_sha256_57f379da59234cd2e83802180faecd15784a28fcd09f2eb0a5944f494972c9fc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271867,14 +269912,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_16B5 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologies_Agentsys_Driveragent_4045 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Agent64.sys"
 		author = "Florian Roth"
-		id = "41ccdc0b-ec41-51b3-9039-bf5206f9a79f"
+		id = "6b00a372-e3f8-500c-8ffd-fa9fe9c7fb6a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271886,7 +269931,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologies_Agentsys_Driveragent_4045 :
 		hash = "b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414"
 		hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
 		hash = "4db1e0fdc9e6cefeb1d588668ea6161a977c372d841e7b87098cf90aa679abfb"
-		logic_hash = "1902f186f263eaeaf3de6712a8fe2c01f2225f7ba051f4020de27832e197e256"
+		logic_hash = "v1_sha256_1902f186f263eaeaf3de6712a8fe2c01f2225f7ba051f4020de27832e197e256"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271902,14 +269947,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologies_Agentsys_Driveragent_4045 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0045006e0054006500630068002000540061006900770061006e002c00200031003900390037002d0032003000300039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_FA77 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "b092767e-5f04-59f9-b653-c4ab28860de0"
+		id = "33e4f420-9807-5001-93fa-257f331de8ee"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -271917,7 +269962,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_FA77 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "fa77a472e95c4d0a2271e5d7253a85af25c07719df26941b39082cfc0733071a"
 		hash = "423f052690b6b523502931151dfcc63530e3bd9d79680f9b5ac033b23b5c6f18"
-		logic_hash = "e59a975ce22fb83623ae84000e07bcc0f2060b7e16cfc3e2b538138246ef296a"
+		logic_hash = "v1_sha256_e59a975ce22fb83623ae84000e07bcc0f2060b7e16cfc3e2b538138246ef296a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271933,21 +269978,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_FA77 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100360020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_D0E2 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
 		author = "Florian Roth"
-		id = "1ee0136e-73bc-5b88-ae0b-74f3f53fe93f"
+		id = "ee6dba8c-9b76-55bb-abb7-89e4b8f9ad84"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3335-L3354"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605"
-		logic_hash = "c265c6c89ea9bf09b9dcf47e1ce60f3531d76521a0ef1bbdc07d401a7b4164ed"
+		logic_hash = "v1_sha256_c265c6c89ea9bf09b9dcf47e1ce60f3531d76521a0ef1bbdc07d401a7b4164ed"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271963,21 +270008,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_D0E2 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_F060 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
 		author = "Florian Roth"
-		id = "b6ebdc92-1ca5-5f13-beef-d6adf037e732"
+		id = "4f9646d0-1f3b-5b96-936a-8cffaa46b8fd"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3357-L3376"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008"
-		logic_hash = "c73f19c87d63e9986e5f44a368f4b8305b7bff17ebdeb85f309751f54f76db48"
+		logic_hash = "v1_sha256_c73f19c87d63e9986e5f44a368f4b8305b7bff17ebdeb85f309751f54f76db48"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -271993,21 +270038,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_F060 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4AC0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "8839157b-8e6c-5929-8041-443ecccbb688"
+		id = "0855f6ad-bd70-5f54-b090-ddead1319f42"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3379-L3398"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4ac08a6035cfcafdac712d7c3cf2eef6e10258f14cee6e80e1ef2f71f5045173"
-		logic_hash = "b3a6dc1e2b7e806eb56133af99e995139dccddb2cba897f54144203ea3558f29"
+		logic_hash = "v1_sha256_b3a6dc1e2b7e806eb56133af99e995139dccddb2cba897f54144203ea3558f29"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272023,14 +270068,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4AC0 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedriver_2A65 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrIbDrv.sys"
 		author = "Florian Roth"
-		id = "f98969ca-e570-5f95-93d8-5b73fc3221fd"
+		id = "fff64e9e-40e4-51e8-9c26-00a0da62c0d0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272042,7 +270087,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedrive
 		hash = "47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc"
 		hash = "0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb"
 		hash = "2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14"
-		logic_hash = "818a6a8b09db442f8abf2c466339d01665220768dfebc6faf6c74d3f9855542b"
+		logic_hash = "v1_sha256_818a6a8b09db442f8abf2c466339d01665220768dfebc6faf6c74d3f9855542b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272058,21 +270103,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedrive
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002000520057002d00450076006500720079007400680069006e0067 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5027 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "e46d3ca0-a605-503d-86ac-67ac7ac8c7cc"
+		id = "5476d5e0-a0b2-5fb9-a944-5ceb728f9a31"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3428-L3447"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48"
-		logic_hash = "f2f0788448e15b372c67c310a411c9533fad7e03b24c24a1a1da7eeb595b6e75"
+		logic_hash = "v1_sha256_f2f0788448e15b372c67c310a411c9533fad7e03b24c24a1a1da7eeb595b6e75"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272088,21 +270133,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5027 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_2203 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "1c940da3-7e22-54eb-822b-8dad331e410e"
+		id = "edf50a59-3be7-5041-b98d-2759df5f54b2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3450-L3469"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2203bd4731a8fdc2a1c60e975fd79fd5985369e98a117df7ee43c528d3c85958"
-		logic_hash = "30602a4c8f91277805e82cdcd5ccae77b22e77644baf59d9ab2235e575ed9f25"
+		logic_hash = "v1_sha256_30602a4c8f91277805e82cdcd5ccae77b22e77644baf59d9ab2235e575ed9f25"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272118,14 +270163,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_442C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "213d1f7e-f283-5551-a942-c7b5b12014e6"
+		id = "9d21da12-b1f8-527c-b309-2602b355a915"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272133,7 +270178,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_442C : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "442c18aeb09556bb779b21185c4f7e152b892410429c123c86fc209a802bff3c"
 		hash = "3e1f592533625bf794e0184485a4407782018718ae797103f9e968ff6f0973a1"
-		logic_hash = "b44ece633deccb00cea884422a24053616bf92a71a7f0a0264102d548ce02bb7"
+		logic_hash = "v1_sha256_b44ece633deccb00cea884422a24053616bf92a71a7f0a0264102d548ce02bb7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272149,14 +270194,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_442C : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_468B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "e13ecd37-8ec8-5cc1-8a3a-c53fb10bf2dc"
+		id = "e423b47a-bef6-5187-a8ba-94625ca4b8aa"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272164,7 +270209,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_468B : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "468b087a0901d7bd971ab564b03ded48c508840b1f9e5d233a7916d1da6d9bd5"
 		hash = "f93e0d776481c4ded177d5e4aebb27f30f0d47dcb4a1448aee8b66099ac686e1"
-		logic_hash = "b286d189f5709b74d0da658841a1a626408db584696c467b07b4c341ec6d6748"
+		logic_hash = "v1_sha256_b286d189f5709b74d0da658841a1a626408db584696c467b07b4c341ec6d6748"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272180,21 +270225,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_468B : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100360020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_19D0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "9d4595ab-29a2-5b71-b03b-9730db4eadca"
+		id = "4deec140-7466-5037-a921-abb3ce65ed9f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3518-L3537"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0"
-		logic_hash = "0d4f44ece27db1def197e6353d59677915f7f58eb5ff4661d2b8e024eb07acb7"
+		logic_hash = "v1_sha256_0d4f44ece27db1def197e6353d59677915f7f58eb5ff4661d2b8e024eb07acb7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272210,21 +270255,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_9B1A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
 		author = "Florian Roth"
-		id = "9dd62c3a-8f3c-5df0-a6a2-fcaa72c4ed16"
+		id = "79a34c39-782a-58db-b765-9027e9a78b78"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3540-L3559"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194"
-		logic_hash = "fcef672d2e2c24f4b1323554ca206f3bd67657af96ad774056e5fd0181cc7ac7"
+		logic_hash = "v1_sha256_fcef672d2e2c24f4b1323554ca206f3bd67657af96ad774056e5fd0181cc7ac7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272240,21 +270285,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltsys_Pancafemanager_7E01 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFlt.sys"
 		author = "Florian Roth"
-		id = "1d9363a1-e32e-5989-8777-6e530efa6a55"
+		id = "8382e8e5-8492-5ab2-a8fb-d8bed0af04ce"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3562-L3581"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7"
-		logic_hash = "6f9a951d64947f6930614206f10eb51a5f43566fdc6425821608e0f847818f75"
+		logic_hash = "v1_sha256_6f9a951d64947f6930614206f10eb51a5f43566fdc6425821608e0f847818f75"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272270,14 +270315,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfl
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_F4E5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "f939adf6-310c-5d8a-bfb5-4ebcbd6bccfe"
+		id = "ca1adebb-a06b-5d1e-8518-bd85ec25a0e8"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272285,7 +270330,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f4e500a9ac5991da5bf114fa80e66456a2cde3458a3d41c14e127ac09240c114"
 		hash = "642857fc8d737e92db8771e46e8638a37d9743928c959ed056c15427c6197a54"
-		logic_hash = "a787fd5e5b62f39a19222a8167382966dd707e2aba99f4c08ad839b221a17e75"
+		logic_hash = "v1_sha256_a787fd5e5b62f39a19222a8167382966dd707e2aba99f4c08ad839b221a17e75"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272301,21 +270346,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Lenovogrouplimitedr_Lenovodiagnosticsdriversys_Lenovodiagnostics_F05B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LenovoDiagnosticsDriver.sys"
 		author = "Florian Roth"
-		id = "791da32a-272c-5bde-9722-cc4c68321ad7"
+		id = "cdf3be90-736d-5746-b15d-ec3765ccdf4a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3607-L3626"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe"
-		logic_hash = "22098d721c4814786834b3ea781283f53d195ba35f51fc8fd75b45f7781d39d4"
+		logic_hash = "v1_sha256_22098d721c4814786834b3ea781283f53d195ba35f51fc8fd75b45f7781d39d4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272331,21 +270376,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lenovogrouplimitedr_Lenovodiagnosticsdriversys_L
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000320030003200310020004c0065006e006f0076006f002000470072006f007500700020004c0069006d0069007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_3F20 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - pchunter.sys"
 		author = "Florian Roth"
-		id = "ab0247c7-eb20-5481-9fed-f9608dd4cb93"
+		id = "2e148761-3180-5577-a036-0c02fb7cb772"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3629-L3645"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3f20ac5dac9171857fc5791865458fdb6eac4fab837d7eabc42cb0a83cb522fc"
-		logic_hash = "6265acf1ebd52e5efe41774f35b3b01ede27f18c04975ac57afbd62b7d6d7600"
+		logic_hash = "v1_sha256_6265acf1ebd52e5efe41774f35b3b01ede27f18c04975ac57afbd62b7d6d7600"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272358,21 +270403,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_3F20 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200032003000310039002d003200300032003100200041006e00580069006e00530065006300200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospackage_7D4C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NCHGBIOS2x64.SYS"
 		author = "Florian Roth"
-		id = "f3c02bcb-2c9e-5319-a0ac-3773a81d68f6"
+		id = "996cd953-b6bf-50b7-9182-12f6316e8e91"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3648-L3667"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7d4ca5760b6ad2e4152080e115f040f9d42608d2c7d7f074a579f911d06c8cf8"
-		logic_hash = "a724598247e27cca91bd76f60ebbad471d199ae290c8ec100bcf1efc02b74963"
+		logic_hash = "v1_sha256_a724598247e27cca91bd76f60ebbad471d199ae290c8ec100bcf1efc02b74963"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272388,21 +270433,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospacka
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200031003900390039002d003200300031003000200054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Dell_Dbutil_71FE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys"
 		author = "Florian Roth"
-		id = "172e8e13-e1ff-5caf-9759-d607ef072215"
+		id = "f07d4e31-dca8-584a-9ff3-0273437f270c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3670-L3686"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
-		logic_hash = "dad7c23d78176f31a2a324998e3170a5096a50389ff83af590503fac69791890"
+		logic_hash = "v1_sha256_dad7c23d78176f31a2a324998e3170a5096a50389ff83af590503fac69791890"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272415,14 +270460,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dell_Dbutil_71FE : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000320031002000440065006c006c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e0020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_6D2C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "3a685339-ca77-557e-ad5d-94943d9b3ee1"
+		id = "60d20ac2-1a65-5434-b043-4bdd67635e30"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272430,7 +270475,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_6D2C : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6d2cc7e1d95bb752d79613d0ea287ea48a63fb643dcb88c12b516055da56a11d"
 		hash = "8047859a7a886bcf4e666494bd03a6be9ce18e20dc72df0e5b418d180efef250"
-		logic_hash = "c2c74038259bec413bbacf0957449d1da5291b84c6f6848e5573ca50bbea006f"
+		logic_hash = "v1_sha256_c2c74038259bec413bbacf0957449d1da5291b84c6f6848e5573ca50bbea006f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272446,14 +270491,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_6D2C : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100330020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Atszio_Atsziodriver_673B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
 		author = "Florian Roth"
-		id = "bcd5bc05-5e71-5491-be7d-94cdbebddd9f"
+		id = "aee197ee-a355-5cf8-afce-a8ef783509fa"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272461,7 +270506,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Atszio_Atsziodriver_673B : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b"
 		hash = "31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a"
-		logic_hash = "d3f753b1bd9dc99cece28a3da9a87e9d211207204f05f573f01391f2c1a08f07"
+		logic_hash = "v1_sha256_d3f753b1bd9dc99cece28a3da9a87e9d211207204f05f573f01391f2c1a08f07"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272476,21 +270521,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Atszio_Atsziodriver_673B : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asus_Asmmapsys_Atkgenericfunctionservice_025E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - asmmap64.sys"
 		author = "Florian Roth"
-		id = "68572e19-5b92-57fb-b301-0224e00139cd"
+		id = "1427a5ba-8579-5c8d-96d4-d73aab0919b7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3734-L3753"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4"
-		logic_hash = "81100a6b0917bd9d6641c1f3db32353d1fe02b34feb5136c3f316f5deaa32f7d"
+		logic_hash = "v1_sha256_81100a6b0917bd9d6641c1f3db32353d1fe02b34feb5136c3f316f5deaa32f7d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272506,14 +270551,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asus_Asmmapsys_Atkgenericfunctionservice_025E :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9724 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
 		author = "Florian Roth"
-		id = "a0be3cf9-193d-5bee-ac83-a5701ad9e4e9"
+		id = "68c69b6c-a783-54d7-bb06-4d16cd704bfd"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272523,7 +270568,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9724 : FILE
 		hash = "a66d2fb7ef7350ea74d4290c57fb62bc59c6ea93f759d4ca93c3febca7aeb512"
 		hash = "e77786b21dbe73e9619ac9aac5e7e92989333d559aa22b4b65c97f0a42ff2e21"
 		hash = "8ed0c00920ce76e832701d45117ed00b12e20588cb6fe8039fbccdfef9841047"
-		logic_hash = "f48f9cb6cc160c9fd749a73001a904ab727e33704064f4220a56671b89ce0f5a"
+		logic_hash = "v1_sha256_f48f9cb6cc160c9fd749a73001a904ab727e33704064f4220a56671b89ce0f5a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272539,21 +270584,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9724 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_7133 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "1d9df905-34d9-5503-b08d-ea4ff2cd826a"
+		id = "3588d3d4-abcc-52e2-a2a8-70fbefd236f0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3781-L3800"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129"
-		logic_hash = "7abc5f0325fa8552b38499b061dd10f6a4cdb56ba1071446ce6ca91e42b8c9f7"
+		logic_hash = "v1_sha256_7abc5f0325fa8552b38499b061dd10f6a4cdb56ba1071446ce6ca91e42b8c9f7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272569,14 +270614,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_7133 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoperatingsystem_23BA : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LHA.sys"
 		author = "Florian Roth"
-		id = "8af33121-526d-5f4c-8cde-6e427f36ad97"
+		id = "e41cb82f-af68-5676-ae50-adbacd746c37"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272584,7 +270629,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoperatin
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade"
 		hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
-		logic_hash = "fcc57907a8653acc1175b486f719f029ba3c982dbc73ab0cd878f08b2fcb0aad"
+		logic_hash = "v1_sha256_fcc57907a8653acc1175b486f719f029ba3c982dbc73ab0cd878f08b2fcb0aad"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272600,21 +270645,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoperatin
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0075006c00740072006100620069006f007300400068006f0074006d00610069006c002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elitegroupcomputersystems_Ecsiodriversys_Ecsiodriver_2705 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ecsiodriverx64.sys"
 		author = "Florian Roth"
-		id = "08f5ad86-8243-5591-9cc4-88bc0a0160fa"
+		id = "bde96b61-87fa-5be3-a050-658ac0c2fd0a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3826-L3845"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "270547552060c6f4f5b2ebd57a636d5e71d5f8a9d4305c2b0fe5db0aa2f389cc"
-		logic_hash = "899c58fe4793270c3e314e2c3f04c1341b6fefedba37d53200e5477f1108a5cf"
+		logic_hash = "v1_sha256_899c58fe4793270c3e314e2c3f04c1341b6fefedba37d53200e5477f1108a5cf"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272630,14 +270675,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elitegroupcomputersystems_Ecsiodriversys_Ecsiodr
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d003200300031003000200045006c00690074006500670072006f0075007000200043006f006d00700075007400650072002000530079007300740065006d0073002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_8D33 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "f7b27f03-ea78-5f2c-8b48-ea62c495cb89"
+		id = "e7119ed2-2dc9-5918-b440-46ddf0de22ac"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272645,7 +270690,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_8D33 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8d3347c93dff62eecdde22ccc6ba3ce8c0446874738488527ea76d0645341409"
 		hash = "31ffc8218a52c3276bece1e5bac7fcb638dca0bc95c2d385511958abdbe4e4a5"
-		logic_hash = "9868c2b401562623484d7bc00700332a754380b25b05cb95f38a8b242e7f59fa"
+		logic_hash = "v1_sha256_9868c2b401562623484d7bc00700332a754380b25b05cb95f38a8b242e7f59fa"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272661,14 +270706,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_8D33 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100320020003300360030002e0063006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_C586 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "a407037f-0b6e-56a9-9562-592a2e0954c7"
+		id = "e27dddea-55c2-52bb-b932-28e9d589261c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272676,7 +270721,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_C586 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c586befc3fd561fcbf1cf706214ae2adaa43ce9ba760efd548d581f60deafc65"
 		hash = "dda2a604bb94a274e23f0005f0aa330d45ca1ea25111746fb46fa5ef6d155b1d"
-		logic_hash = "761661cb4ab100aad58ca83f20dd3eb25173bb6c987a7643ca93b91e90f25409"
+		logic_hash = "v1_sha256_761661cb4ab100aad58ca83f20dd3eb25173bb6c987a7643ca93b91e90f25409"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272692,21 +270737,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_C586 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Logmeininc_Lmiinfosys_Logmein_453B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LMIinfo.sys"
 		author = "Florian Roth"
-		id = "50e671ec-752c-5494-97bc-bd29cd7452f1"
+		id = "6d9761fb-e7b2-5385-88e8-ff15f86627ba"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3894-L3913"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233"
-		logic_hash = "1940aec392f250b22b8480d7b75f0c1a21c7bad13c0e83a4eb6065b3d045e4cd"
+		logic_hash = "v1_sha256_1940aec392f250b22b8480d7b75f0c1a21c7bad13c0e83a4eb6065b3d045e4cd"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272722,21 +270767,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Logmeininc_Lmiinfosys_Logmein_453B : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033002d00320030003100370020004c006f0067004d00650049006e002c00200049006e0063002e00200050006100740065006e00740065006400200061006e006400200070006100740065006e00740073002000700065006e00640069006e0067002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_76AF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "f89b7e66-c5d6-576b-8487-1530a3e37121"
+		id = "b5d65ba3-489b-5c14-9c0a-cfed244a0dc7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3916-L3935"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "76af3f9fa111d694e37058606f2636430bdd378c85b94f426fbfcd6666ebe6cc"
-		logic_hash = "d4031de065552af6807677430ee6aa17fb754052f6fdeb147db0105bd235acd8"
+		logic_hash = "v1_sha256_d4031de065552af6807677430ee6aa17fb754052f6fdeb147db0105bd235acd8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272752,21 +270797,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_76AF : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003000380020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1284 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
 		author = "Florian Roth"
-		id = "673660ad-6d19-5b50-b467-ea6a5a00fa76"
+		id = "715011dd-8d8c-5990-ba67-a293fb458c5c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L3938-L3957"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1284a1462a5270833ec7719f768cdb381e7d0a9c475041f9f3c74fa8eea83590"
-		logic_hash = "2453f457e43fd2dade465a33189f8ae41ca5ebd16d9a9c42d8edaf22ca990916"
+		logic_hash = "v1_sha256_2453f457e43fd2dade465a33189f8ae41ca5ebd16d9a9c42d8edaf22ca990916"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272782,14 +270827,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1284 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300035002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Asrsetupdrvsys_Asrsetupdrvdriver_9D93 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrSetupDrv103.sys"
 		author = "Florian Roth"
-		id = "cfb5259e-deef-57db-ab34-fa909845043c"
+		id = "241884b4-cfbf-5f80-86ae-688074b942e6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272797,7 +270842,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Asrsetupdrvsys_Asrsetupdrvdriver_9D
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9d9346e6f46f831e263385a9bd32428e01919cca26a035bbb8e9cb00bf410bc3"
 		hash = "a0728184caead84f2e88777d833765f2d8af6a20aad77b426e07e76ef91f5c3f"
-		logic_hash = "875be865b5c6a924c48aada4c97ae39552a9944d9efb4e419dd754ce3f7ec217"
+		logic_hash = "v1_sha256_875be865b5c6a924c48aada4c97ae39552a9944d9efb4e419dd754ce3f7ec217"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272813,14 +270858,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Asrsetupdrvsys_Asrsetupdrvdriver_9D
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002000520057002d00450076006500720079007400680069006e0067 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_C628 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
 		author = "Florian Roth"
-		id = "35330a4b-841a-5e61-b8c1-5e02f61ec021"
+		id = "18765492-6f3a-590a-a528-30d5de38842c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272829,7 +270874,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
 		hash = "c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2"
 		hash = "7164aaff86b3b7c588fc7ae7839cc09c5c8c6ae29d1aff5325adaf5bedd7c9f5"
 		hash = "0d30c6c4fa0216d0637b4049142bc275814fd674859373bd4af520ce173a1c75"
-		logic_hash = "e7bff1c9a45ea37c1d26aeaa0946bd55387ef6adf318d04196ad6aa55950765a"
+		logic_hash = "v1_sha256_e7bff1c9a45ea37c1d26aeaa0946bd55387ef6adf318d04196ad6aa55950765a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272845,21 +270890,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310034002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantimalwaredriver_D0EB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Tmel.sys"
 		author = "Florian Roth"
-		id = "f5251fdb-8e6e-5ea7-abdd-3a85dfbda449"
+		id = "1360670c-0380-5827-9715-5f5071be27ae"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4007-L4026"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d0eb3ba0aff471d19260192784bf9f056d669b779b6eaff84e732b7124ce1d11"
-		logic_hash = "434964576b56367bc1ef4a198b6d6315c00c3fea0af9f1e0f08da6b7bd2cd0d1"
+		logic_hash = "v1_sha256_434964576b56367bc1ef4a198b6d6315c00c3fea0af9f1e0f08da6b7bd2cd0d1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272875,14 +270920,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantim
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystemserviceprovider_EDBB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GtcKmdfBs.sys"
 		author = "Florian Roth"
-		id = "242dd7a2-f959-5394-aa81-9984a80fe634"
+		id = "a9bef13a-2a8f-53b1-a28f-50bd6e9077ad"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -272890,7 +270935,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "edbb23e74562e98b849e5d0eefde3af056ec6e272802a04b61bebd12395754e5"
 		hash = "4b465faf013929edf2f605c8cd1ac7a278ddc9a536c4c34096965e6852cbfb51"
-		logic_hash = "0a729463c077e67113c7aeb1347b6ff2374fa8e4e5524b05c0a5ed2194b605b6"
+		logic_hash = "v1_sha256_0a729463c077e67113c7aeb1347b6ff2374fa8e4e5524b05c0a5ed2194b605b6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272906,21 +270951,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003900200047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2FBB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "a688139a-c44f-5a93-933d-73369facec6c"
+		id = "485ac263-38db-5978-8af1-1eb0fc123ac5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4052-L4071"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445"
-		logic_hash = "b25969777810ff75d8cc35ae042a58e35f268c09aaa6f7fd6e10b1a1741898b4"
+		logic_hash = "v1_sha256_b25969777810ff75d8cc35ae042a58e35f268c09aaa6f7fd6e10b1a1741898b4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272936,21 +270981,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2FBB : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BCED : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "25dd8cda-6aa3-595c-8502-cc83e04b8235"
+		id = "7bead0f3-77e7-5d55-941e-b5ce9a8f1ee2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4074-L4093"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f"
-		logic_hash = "21a234179b5f2ae97262100f990587238339777bf919f8a9f04e84e64c77fb1d"
+		logic_hash = "v1_sha256_21a234179b5f2ae97262100f990587238339777bf919f8a9f04e84e64c77fb1d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272966,21 +271011,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300035 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_082C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "48446c71-f353-5f4f-a158-20bc7dec694f"
+		id = "0e96e09c-7e9d-51cd-a0bf-267ab0535585"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4096-L4115"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d"
-		logic_hash = "805a4da51dd1a85c46b830b747ed15f5cfb7539b42fd598987d3cd879d93cc97"
+		logic_hash = "v1_sha256_805a4da51dd1a85c46b830b747ed15f5cfb7539b42fd598987d3cd879d93cc97"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -272996,14 +271041,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_082C : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_1493 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
 		author = "Florian Roth"
-		id = "f1b0bccc-950b-5039-b181-fe4cee4e84b1"
+		id = "d0382fa0-4ce5-510f-866a-d177ed2a260d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273015,7 +271060,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_1493 : FILE
 		hash = "a495ffa623a5220179b0dd519935e255dd6910b7b7bc3d68906528496561ff53"
 		hash = "e4cf438838dc10b188b3d4a318fd9ba2479abb078458d7f97591c723e2d637ce"
 		hash = "ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2"
-		logic_hash = "cc5f7ae21d2025a266f826b65146f88ba439a63ebd868f663b7dd69c4b3be468"
+		logic_hash = "v1_sha256_cc5f7ae21d2025a266f826b65146f88ba439a63ebd868f663b7dd69c4b3be468"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273030,14 +271075,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_1493 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Powertool_Kevpsys_Powertool_7C0F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kEvP64.sys"
 		author = "Florian Roth"
-		id = "b4eb0239-e787-50d8-bac9-78178e245bb8"
+		id = "9407835f-ea1f-537e-8c7f-0785386ddd06"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273052,7 +271097,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Powertool_Kevpsys_Powertool_7C0F : FILE
 		hash = "7462b7ae48ae9469474222d4df2f0c4f72cdef7f3a69a524d4fccc5ed0fd343f"
 		hash = "97363f377aaf3c01641ac04a15714acbec978afb1219ac8f22c7e5df7f2b2d56"
 		hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
-		logic_hash = "3eeba224179a144483bbb9222579539f58857449173a55e331a98152ba4df7a8"
+		logic_hash = "v1_sha256_3eeba224179a144483bbb9222579539f58857449173a55e331a98152ba4df7a8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273068,21 +271113,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Powertool_Kevpsys_Powertool_7C0F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0050006f0077006500720054006f006f006c }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2900KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2900KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_D1F4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "c1e8abd1-14c1-5ddd-87cb-647dfcc652fd"
+		id = "37aa2537-743e-5de6-9e44-bd06d2b6b721"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4174-L4193"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f"
-		logic_hash = "8152947116f7cb31e716db449c855255c30f5034d065e8287cf480157274ba9b"
+		logic_hash = "v1_sha256_8152947116f7cb31e716db449c855255c30f5034d065e8287cf480157274ba9b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273098,14 +271143,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_D1F4 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_BC45 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "1abef091-37a1-53ee-9de8-c59a79b3775f"
+		id = "de4a878a-d60a-518c-897c-3fecdbf24963"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273113,7 +271158,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_BC45 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "bc453d428fc224960fa8cbbaf90c86ce9b4c8c30916ad56e525ab19b6516424e"
 		hash = "182bbdb9ecd3932e0f0c986b779c2b2b3997a7ca9375caa2ec59b4b08f4e9714"
-		logic_hash = "283d6d71ba7ace25c248949d232d2ce0c86fa87115304b8d6c07e7564e6757a3"
+		logic_hash = "v1_sha256_283d6d71ba7ace25c248949d232d2ce0c86fa87115304b8d6c07e7564e6757a3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273129,21 +271174,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_BC45 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100340020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_7CB4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "b578c798-3923-51b7-80c7-b4e123dc8747"
+		id = "ea0b30e1-ff83-51dd-b5f7-25f619ec193f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4219-L4238"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7"
-		logic_hash = "bec5e91150c9c0760c91f8a2b4b83867af030ede236c8596c3558e0f8fca1004"
+		logic_hash = "v1_sha256_bec5e91150c9c0760c91f8a2b4b83867af030ede236c8596c3558e0f8fca1004"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273159,21 +271204,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_7CB4 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003900200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Safenetinc_Hostnt_Hostnt_07B6 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HOSTNT.sys"
 		author = "Florian Roth"
-		id = "a1210220-529b-5103-888f-aaa707040eee"
+		id = "d07bf1c2-9378-52a6-8227-7ba5995ee7f1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4241-L4260"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357"
-		logic_hash = "b07f335b6941ef2095903cb8841358bff6b09518a96512d69fdf90bf328888e7"
+		logic_hash = "v1_sha256_b07f335b6941ef2095903cb8841358bff6b09518a96512d69fdf90bf328888e7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273189,21 +271234,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Safenetinc_Hostnt_Hostnt_07B6 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000200053006100660065004e00650074002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_9A91 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo11X64.sys"
 		author = "Florian Roth"
-		id = "a8c05c92-a133-5f8f-bc4e-ff7e21f262e0"
+		id = "e997935c-89e4-5e69-a1ee-25fa3b703cae"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4263-L4282"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba"
-		logic_hash = "29ba3734f177a3ca166a3c02d066da4b9e4cbd146724f037ac82e3ced1d7951e"
+		logic_hash = "v1_sha256_29ba3734f177a3ca166a3c02d066da4b9e4cbd146724f037ac82e3ced1d7951e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273219,21 +271264,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontro
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_848B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "efe27764-9166-5ed5-8d08-1944e9fead43"
+		id = "d9a39720-5ef9-5d5f-9aa9-e693e4b28186"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4285-L4304"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "848b150ffcf1301b26634a41f28deacb5ccdd3117d79b590d515ed49849b8891"
-		logic_hash = "e56d5221962e4fe353c0e37cc3bbebf68d785d86f49269d7e6d935ef6cff6f38"
+		logic_hash = "v1_sha256_e56d5221962e4fe353c0e37cc3bbebf68d785d86f49269d7e6d935ef6cff6f38"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273249,21 +271294,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_7CB5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "4af76d57-3f28-5d80-b72a-796f65942488"
+		id = "e7eec5ef-b9b8-5ef7-9f31-c60fec810469"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4307-L4324"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21"
-		logic_hash = "df3e79bf8db29cb712ac4fe3670954a0793d7d839f3368ad52e5f826afd18b7f"
+		logic_hash = "v1_sha256_df3e79bf8db29cb712ac4fe3670954a0793d7d839f3368ad52e5f826afd18b7f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273277,21 +271322,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_7CB5 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautochkupddrvdriver_2AA1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrAutoChkUpdDrv.sys"
 		author = "Florian Roth"
-		id = "78768248-afa1-5e3c-a9cd-c9ab73ea4f74"
+		id = "e21c4f11-4abe-5ca5-a5f5-3ebd19679172"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4327-L4346"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4"
-		logic_hash = "87c0e6a3d0ff8f88e8f190c6b643adde45dc7d4c2aa73b79ba0f38a13bd86f1c"
+		logic_hash = "v1_sha256_87c0e6a3d0ff8f88e8f190c6b643adde45dc7d4c2aa73b79ba0f38a13bd86f1c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273307,14 +271352,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautoc
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_97B3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "ef15eec0-caf8-58e9-9c63-cfee3275253d"
+		id = "c292f202-f998-500f-8e48-6c88ca2bfb47"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273322,7 +271367,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_97B3 : FI
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd"
 		hash = "89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10"
-		logic_hash = "800b43309abd2921378c28cace1ccfb2f7d3420c0f7059c9cbd7422095cbba43"
+		logic_hash = "v1_sha256_800b43309abd2921378c28cace1ccfb2f7d3420c0f7059c9cbd7422095cbba43"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273338,21 +271383,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_97B3 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_0EAB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
 		author = "Florian Roth"
-		id = "ca020c04-c1b4-5496-bbac-beb1ea4537aa"
+		id = "20b7ab6a-35c0-59a0-9413-254acfba30bf"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4372-L4391"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0eab16c7f54b61620277977f8c332737081a46bc6bbde50742b6904bdd54f502"
-		logic_hash = "a4b1e73c5706e29fc31722f82bdf03c705a03821feb22da48c8c5d0d0f7f2dbb"
+		logic_hash = "v1_sha256_a4b1e73c5706e29fc31722f82bdf03c705a03821feb22da48c8c5d0d0f7f2dbb"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273368,21 +271413,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_0EAB : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d00500072006500730065006e0074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_8EF5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "ccd6832d-72d2-599d-9eba-7616e59120e2"
+		id = "ecd4c79d-4076-5570-9d65-af5ec447de1d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4394-L4413"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8ef59605ebb2cb259f19aba1a8c122629c224c58e603f270eaa72f516277620c"
-		logic_hash = "d0b94553fb03576dea69fd13042db119825009c0a90ba111560102fed8bb3154"
+		logic_hash = "v1_sha256_d0b94553fb03576dea69fd13042db119825009c0a90ba111560102fed8bb3154"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273398,21 +271443,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_8EF5 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1F15 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "f24de207-322f-596a-94c0-ec3ef3f2b907"
+		id = "acbc2d70-e9cf-57af-94ff-7689256e4921"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4416-L4435"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1f15fd9b81092a98fabcc4ac95e45cec2d9ff3874d2e3faac482f3e86edad441"
-		logic_hash = "5eebc2d90e6d17134c100e4f04271f4e1f6546a6c74ef4737e60ec76d4fa8227"
+		logic_hash = "v1_sha256_5eebc2d90e6d17134c100e4f04271f4e1f6546a6c74ef4737e60ec76d4fa8227"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273428,21 +271473,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1F15 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_0452 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
 		author = "Florian Roth"
-		id = "2cd9eb8f-25c1-5bd2-a5be-ae295ee7179f"
+		id = "d6a85ea6-4679-56e2-89de-26994b1fbdd2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4438-L4457"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0452a6e8f00bae0b79335c1799a26b2b77d603451f2e6cc3b137ad91996d4dec"
-		logic_hash = "3e5eddf984eb85a304bd19a444238850dc2d153f8e59bb215a08f781efc270c6"
+		logic_hash = "v1_sha256_3e5eddf984eb85a304bd19a444238850dc2d153f8e59bb215a08f781efc270c6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273458,21 +271503,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310033002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_818E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "534b26bd-7298-5e16-ba49-f48b1bc405d7"
+		id = "73860626-398c-5801-b528-3f465ccc63e9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4460-L4479"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01"
-		logic_hash = "de48cb605c339f13f94451361531ea2661d79311aacbb87878b24866766b6e3f"
+		logic_hash = "v1_sha256_de48cb605c339f13f94451361531ea2661d79311aacbb87878b24866766b6e3f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273488,21 +271533,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_818E : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_6FFD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "b0799b63-2938-586a-8a10-c3d9916b3d01"
+		id = "26d16e37-cee5-5c9d-8239-fb7f4b41ce92"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4482-L4501"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc"
-		logic_hash = "f8d629b1c9b785204c61c95ac83dc7516db14aa8abd68dc8cb5250d53408f20d"
+		logic_hash = "v1_sha256_f8d629b1c9b785204c61c95ac83dc7516db14aa8abd68dc8cb5250d53408f20d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273518,14 +271563,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_6FFD : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_7710 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "9b4f6fc7-e597-5efd-9a85-6fd63fa9844b"
+		id = "2a8b5c79-e71d-5095-8530-66e289195247"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273537,7 +271582,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_7710 : FILE
 		hash = "900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88"
 		hash = "f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c"
 		hash = "b8ffe83919afc08a430c017a98e6ace3d9cbd7258c16c09c4f3a4e06746fc80a"
-		logic_hash = "3c281f5381de85adcfba468cfced2fa0b400d90bb2a14494da37bd9b21e60e36"
+		logic_hash = "v1_sha256_3c281f5381de85adcfba468cfced2fa0b400d90bb2a14494da37bd9b21e60e36"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273553,14 +271598,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_7710 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310035002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_AD8F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
 		author = "Florian Roth"
-		id = "f811136f-64db-5a3e-b4f3-e4c92c43b888"
+		id = "034f652b-ef53-54d6-81d4-12470fd4ff8f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273568,7 +271613,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_AD8F : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ad8fd8300ed375e22463cea8767f68857d9a3b0ff8585fbeb60acef89bf4a7d7"
 		hash = "0507d893e3fd2917c81c1dc13ccb22ae5402ab6ca9fb8d89485010838050d08d"
-		logic_hash = "2cbeb5784c1f074b8d76d8f884e7529b8c137ff6b9df0320db677927766fcc70"
+		logic_hash = "v1_sha256_2cbeb5784c1f074b8d76d8f884e7529b8c137ff6b9df0320db677927766fcc70"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273584,14 +271629,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_AD8F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_71C0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "f25a60ba-cfb0-5287-97b7-3a17b0aceca9"
+		id = "f4ee3d3b-3964-52cb-9a14-6d04740e505b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273603,7 +271648,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_71C0 : FILE
 		hash = "e642d82c5cde2bc40a204736b5b8d6578e8e2b893877ae0508cfa3371fc254dc"
 		hash = "ed3448152bcacf20d7c33e9194c89d5304dee3fba16034dd0cc03a3374e63c91"
 		hash = "5c9e257c9740561b5744812e1343815e7972c362c8993d972b96a56e18c712f3"
-		logic_hash = "b25f9b0fcc34bd25d77bb0bbdc383f6f03e104c9d275caa61c53366855c10312"
+		logic_hash = "v1_sha256_b25f9b0fcc34bd25d77bb0bbdc383f6f03e104c9d275caa61c53366855c10312"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273619,21 +271664,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_71C0 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100350020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Speedfansys_Windowsrserverddkdriver_22BE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - speedfan.sys"
 		author = "Florian Roth"
-		id = "c683be43-e577-5248-8a28-b13dbefd7f91"
+		id = "4e13cf1b-eef3-5f6a-8da7-4b4f944bc8b8"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4581-L4600"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
-		logic_hash = "ce5fb5f559f97130403f8f4c22a2f223892ba46b1df9fd6a99624e879a3fcea3"
+		logic_hash = "v1_sha256_ce5fb5f559f97130403f8f4c22a2f223892ba46b1df9fd6a99624e879a3fcea3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273649,21 +271694,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Speedfansys_Windowsrse
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_9131 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
 		author = "Florian Roth"
-		id = "94026bd4-e66c-551c-b054-b3b5191a5bb2"
+		id = "b828481d-b7d1-5108-a523-1690d4db2b7c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4603-L4622"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c"
-		logic_hash = "e61f4452ecae438072b37ae00ca67401541db0e8f6d5b0f1d697190fdff16d23"
+		logic_hash = "v1_sha256_e61f4452ecae438072b37ae00ca67401541db0e8f6d5b0f1d697190fdff16d23"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273679,21 +271724,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_9131 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E4EC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
 		author = "Florian Roth"
-		id = "888a2b05-46c1-54b2-a996-14fb9fae5779"
+		id = "fa913303-a4c1-5445-95dc-361006948a8b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4625-L4644"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148"
-		logic_hash = "08fa3c764599e1f0cb4e76b38b9d577a2fd70fb3f6f3e8e70eea65f0cf16d93a"
+		logic_hash = "v1_sha256_08fa3c764599e1f0cb4e76b38b9d577a2fd70fb3f6f3e8e70eea65f0cf16d93a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273709,21 +271754,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E4EC : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_FB6B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
 		author = "Florian Roth"
-		id = "106afe18-1312-559d-87f5-319d67d36435"
+		id = "58ce80f9-7cf8-5e7d-9087-119216516e11"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4647-L4666"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22"
-		logic_hash = "f62cc8ddd443bf196d36d5a3a2724aff4858fcc78abcdbb3cf7362228fde7a7b"
+		logic_hash = "v1_sha256_f62cc8ddd443bf196d36d5a3a2724aff4858fcc78abcdbb3cf7362228fde7a7b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273739,14 +271784,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_FB6B :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_075D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "e58174ba-c931-549b-bf5d-bdc9aeb362cc"
+		id = "31116b8c-8c91-52bb-90fe-b4b3194c39a8"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273754,7 +271799,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85"
 		hash = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
-		logic_hash = "467c47d2a64332dc3b94a3b55655f0e0c4f10b19e8724718b8f2ccf97ffe6446"
+		logic_hash = "v1_sha256_467c47d2a64332dc3b94a3b55655f0e0c4f10b19e8724718b8f2ccf97ffe6446"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273770,14 +271815,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_AE42 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
 		author = "Florian Roth"
-		id = "65c75c41-8edb-526b-b0e8-73eea5cb7502"
+		id = "a473521a-9d39-5469-b94d-03e59de8ac2c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273786,7 +271831,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_
 		hash = "ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471"
 		hash = "d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2"
 		hash = "0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff"
-		logic_hash = "04c6c306d589c72ca5315bc2c931ae06d1e229bb355d4fba7b987ffb3e599b58"
+		logic_hash = "v1_sha256_04c6c306d589c72ca5315bc2c931ae06d1e229bb355d4fba7b987ffb3e599b58"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273802,21 +271847,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004d00490043005300590053 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_3724 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
 		author = "Florian Roth"
-		id = "1305b627-146c-5ec6-9e27-abac84f5a2f4"
+		id = "89a4e871-13be-5f7b-a86b-be99809415e7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4716-L4735"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b"
-		logic_hash = "6c2a12c5866686cde0e621bd35b73079d7d37d5b5d4b42bb962435a73682c32b"
+		logic_hash = "v1_sha256_6c2a12c5866686cde0e621bd35b73079d7d37d5b5d4b42bb962435a73682c32b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273832,21 +271877,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2380 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "24415567-6904-52b1-964d-1a0a4aefe08e"
+		id = "6ca33dd4-dd3c-5dab-81a8-db60d69c6f0b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4738-L4757"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4"
-		logic_hash = "7ac9c6ae541d6689a986d884e96f2f024a18736a59b02a1103e44538d725bb52"
+		logic_hash = "v1_sha256_7ac9c6ae541d6689a986d884e96f2f024a18736a59b02a1103e44538d725bb52"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273862,14 +271907,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2380 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_D7C9 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "6ffeb0f5-e438-5187-8cbb-53f3fec6ab06"
+		id = "c4c432ca-c5b8-5784-bdd1-4fc5e3683b8b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273877,7 +271922,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d7c90cf3fdbbd2f40fe6a39ad0bb2a9a97a0416354ea84db3aeff6d925d14df8"
 		hash = "64a8e00570c68574b091ebdd5734b87f544fa59b75a4377966c661d0475d69a5"
-		logic_hash = "1e5669c7c79c027bdef5dbd135b35ea4e9af8c164b6b8f027490e2fa49ebf904"
+		logic_hash = "v1_sha256_1e5669c7c79c027bdef5dbd135b35ea4e9af8c164b6b8f027490e2fa49ebf904"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273893,14 +271938,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_A97B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "2644da4b-8a15-5b41-b92c-6e4cd2e2d696"
+		id = "beca5fe1-ba2b-53b6-8368-595a283199b1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273908,7 +271953,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_A97B : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a97b404aae301048e0600693457c3320d33f395e9312938831bc5a0e808f2e67"
 		hash = "47c490cc83a17ff36a1a92e08d63e76edffba49c9577865315a6c9be6ba80a7d"
-		logic_hash = "1b7961c9c0e0812fa68f330f45ba1834a246f3571e9086280b03c155865746e9"
+		logic_hash = "v1_sha256_1b7961c9c0e0812fa68f330f45ba1834a246f3571e9086280b03c155865746e9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273924,14 +271969,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_A97B : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100310020003300360030002e0063006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "208dd67e-2d2d-5104-a497-1311cea9e223"
+		id = "16dc5951-27e1-53aa-9d8c-d3a8d7e9c66c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273939,7 +271984,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee"
 		hash = "5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3"
-		logic_hash = "673d993f0ad7800551cfc11d73a38aa37b306902f2d28db4d5ec5f33bc51f21f"
+		logic_hash = "v1_sha256_673d993f0ad7800551cfc11d73a38aa37b306902f2d28db4d5ec5f33bc51f21f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273955,14 +272000,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Featureintegrationtechnologyinc_Fintekpciecom_81FB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FPCIE2COM.sys"
 		author = "Florian Roth"
-		id = "d741c03b-0ad5-5cf7-8fcd-3267c3f40d64"
+		id = "17face9d-31ad-5a95-b91a-8738393ad2d8"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -273970,7 +272015,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Featureintegrationtechnologyinc_Fintekpciecom_81
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "81fbc9d02ef9e05602ea9c0804d423043d0ea5a06393c7ece3be03459f76a41d"
 		hash = "ebf0e56a1941e3a6583aab4a735f1b04d4750228c18666925945ed9d7c9007e1"
-		logic_hash = "24ae9365e55b29c55f83f944154f8fd4643c733f33cfb6542e9159b52acdb9c3"
+		logic_hash = "v1_sha256_24ae9365e55b29c55f83f944154f8fd4643c733f33cfb6542e9159b52acdb9c3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -273985,14 +272030,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Featureintegrationtechnologyinc_Fintekpciecom_81
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200320020004600650061007400750072006500200049006e0074006500670072006100740069006f006e00200054006500630068006e006f006c006f0067007900200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_6BFC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "c5104fcb-7d6a-54dc-a79e-366f16ecd8a0"
+		id = "f68eb21f-3151-591c-b132-72f4ebba3948"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -274001,7 +272046,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		hash = "6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e"
 		hash = "3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc"
 		hash = "46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7"
-		logic_hash = "bc754dc4c4a916691f3d32e8cfad99f1a426d9d6d59d9d6f3c93cabfd581d8a9"
+		logic_hash = "v1_sha256_bc754dc4c4a916691f3d32e8cfad99f1a426d9d6d59d9d6f3c93cabfd581d8a9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274017,21 +272062,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310031 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_7A48 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "7c796850-8413-53b0-bbbd-4991c1af6626"
+		id = "d46cd6c6-d02b-5680-9978-d435d775feeb"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4875-L4894"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf"
-		logic_hash = "3827cad3f54342cba5e6cfc98b2e30522feb79ea8917d882b95dcc66863e389d"
+		logic_hash = "v1_sha256_3827cad3f54342cba5e6cfc98b2e30522feb79ea8917d882b95dcc66863e389d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274047,21 +272092,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_45F4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "56dc2fa5-c19c-5a77-9590-e7a957ccb27f"
+		id = "8814d080-85af-548f-aedc-8272a30e3375"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4897-L4913"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef"
-		logic_hash = "539d1795ae819c2705e77cb41ec4248c7239ffa8cd805addbb9e5da5e98a83e2"
+		logic_hash = "v1_sha256_539d1795ae819c2705e77cb41ec4248c7239ffa8cd805addbb9e5da5e98a83e2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274074,14 +272119,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_45F4 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "e52c22aa-347f-5618-93b8-b4dab3f04b35"
+		id = "37b5a867-bf94-5456-ad8e-241ae44d51d4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -274095,7 +272140,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05 : FI
 		hash = "a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5"
 		hash = "57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572"
 		hash = "d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1"
-		logic_hash = "4e043c30e6b74d21ef14aec63454c6a48c0ac3e770b39114dc6ba988023ebabf"
+		logic_hash = "v1_sha256_4e043c30e6b74d21ef14aec63454c6a48c0ac3e770b39114dc6ba988023ebabf"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274111,21 +272156,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300030003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_86A1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "57b41ebc-6c75-5ba3-b2fc-0bb50e92207b"
+		id = "d1b7d350-4da2-5c3c-821f-ea8acf1a0c48"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4945-L4964"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882"
-		logic_hash = "ed28688de49b089def60861ffe53f4e3a7f714b255035fdb19122375c83ebac2"
+		logic_hash = "v1_sha256_ed28688de49b089def60861ffe53f4e3a7f714b255035fdb19122375c83ebac2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274141,21 +272186,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_86A1 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_61BE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "8242879f-ce39-5f05-b43e-ec2c6b185e82"
+		id = "cbf52192-15d0-52b1-8060-5f0ed78ae045"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L4967-L4986"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf"
-		logic_hash = "70969db52d4e88e1662902634e0cb21c44ab694928e15e4bdaa9a1b2604146dd"
+		logic_hash = "v1_sha256_70969db52d4e88e1662902634e0cb21c44ab694928e15e4bdaa9a1b2604146dd"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274171,14 +272216,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_61BE : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_8899 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
 		author = "Florian Roth"
-		id = "e7728971-efb9-5c8b-8600-8f2b393d966e"
+		id = "8e948117-01b5-529f-91d3-bb43645964bc"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -274188,7 +272233,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserver
 		hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
 		hash = "6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38"
 		hash = "17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229"
-		logic_hash = "9e28e5d1a7003e9911b2c5a7597d1c45c304bdb18cb9177d459f2b35c0da9658"
+		logic_hash = "v1_sha256_9e28e5d1a7003e9911b2c5a7597d1c45c304bdb18cb9177d459f2b35c0da9658"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274204,21 +272249,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Fildds_Filseclabdynamicdefensesystem_F8C0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - fildds.sys"
 		author = "Florian Roth"
-		id = "6a9cf1b0-8d2c-522b-8fca-7f81f2aead8d"
+		id = "bb3ee17e-1c7c-57da-8ce3-c04bb599d5f4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5014-L5033"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f8c07b6e2066a5a22a92d9f521ecdeb8c68698c400e4b83e0501b9f340957c22"
-		logic_hash = "5eb7f097384c0e4b418611a37d6a03dc7a6ff21814716489bf35e0bd43f390cf"
+		logic_hash = "v1_sha256_5eb7f097384c0e4b418611a37d6a03dc7a6ff21814716489bf35e0bd43f390cf"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274234,21 +272279,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Fildds_Filseclabdynamicdefe
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d0032003000310031002000460069006c007300650063006c0061006200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_BE8D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "e655289a-61d1-5908-b495-ce2c00caae3c"
+		id = "734ed672-7491-5e1f-9e35-7b38105f650f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5036-L5055"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2"
-		logic_hash = "98be6af9aa551ba153413f75d4038b2840181418e0b8eba2cfcac2aa29a4460e"
+		logic_hash = "v1_sha256_98be6af9aa551ba153413f75d4038b2840181418e0b8eba2cfcac2aa29a4460e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274264,21 +272309,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_BE8D :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_3E85 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "fde3f78e-f20e-5172-bede-b089c0851680"
+		id = "13b89fd1-58ba-5c4e-a0a6-b1520aef4dc6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5058-L5077"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3e85cf32562a47d51827b21ab1e7f8c26c0dbd1cd86272f3cc64caae61a7e5fb"
-		logic_hash = "23d11200a9d5ad71d8578e3ec3ac40ad6f7d9971177aa59a1ea6bac3de4f0b04"
+		logic_hash = "v1_sha256_23d11200a9d5ad71d8578e3ec3ac40ad6f7d9971177aa59a1ea6bac3de4f0b04"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274294,21 +272339,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_3E85 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3070 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "38ae805f-4be8-526f-b3b3-d644b05c2b25"
+		id = "e9d263d4-9060-52e9-9725-0e7b7eb4f653"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5080-L5099"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab"
-		logic_hash = "05e9f35f83489d262ffece0c406eebf1b81514ea60278415fbc53adc0bc365fb"
+		logic_hash = "v1_sha256_05e9f35f83489d262ffece0c406eebf1b81514ea60278415fbc53adc0bc365fb"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274324,21 +272369,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3070 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CC58 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "cfb96174-106f-5ad0-875b-1be75f70ce51"
+		id = "94fd2e86-9027-543e-8007-310521f003f3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5102-L5121"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b"
-		logic_hash = "8eb46633cce7959cfefbc65ede889c748a077cddc59fb79d87b54ddcd42ca524"
+		logic_hash = "v1_sha256_8eb46633cce7959cfefbc65ede889c748a077cddc59fb79d87b54ddcd42ca524"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274354,14 +272399,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CC58 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Windowsrcodenamelonghornddkdriver_916C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "346488b2-5390-528e-8d54-5ed3dbc6e322"
+		id = "fb9b4c84-fed4-58ab-aae9-c5cafdbf4316"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -274370,7 +272415,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Win
 		hash = "916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677"
 		hash = "caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab"
 		hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
-		logic_hash = "e4834bc67ef64766852404f06631941fa3475b55718e4f79c53f121a9809dc5e"
+		logic_hash = "v1_sha256_e4834bc67ef64766852404f06631941fa3475b55718e4f79c53f121a9809dc5e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274386,21 +272431,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Win
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nmscommunications_Cgkwinksys_Ctaccess_223F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cg6kwin2k.sys"
 		author = "Florian Roth"
-		id = "0de735b8-bbaf-551c-91f0-245740c1c78b"
+		id = "2f28951f-ecc6-5816-b7df-02612f4cbf62"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5148-L5167"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a1"
-		logic_hash = "2ec82ad1a839ff65d3e8288ed161650bd678f8a201bb513bd869d1e9bcfb2a65"
+		logic_hash = "v1_sha256_2ec82ad1a839ff65d3e8288ed161650bd678f8a201bb513bd869d1e9bcfb2a65"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274416,21 +272461,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nmscommunications_Cgkwinksys_Ctaccess_223F : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004e004d005300200043006f006d006d0075006e00690063006100740069006f006e007300200043006f00720070002e0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E4D9 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "b0ef62c7-b223-5d70-883d-1a6a3d28dc0d"
+		id = "4af3ccae-1109-5861-9f9f-24d935bd347c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5170-L5189"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036"
-		logic_hash = "e17c01d291e60fff225ee60e296450ab2d4a293084dc4c07de7347f55566d7ee"
+		logic_hash = "v1_sha256_e17c01d291e60fff225ee60e296450ab2d4a293084dc4c07de7347f55566d7ee"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274446,21 +272491,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E4D9 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_B9AE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
 		author = "Florian Roth"
-		id = "33a0b3ee-4ea1-54ba-95ef-cebfcaa7945d"
+		id = "7e97187a-241d-5219-9852-ad8440e8ccfd"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5192-L5211"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b9ae1d53a464bc9bb86782ab6c55e2da8804c80a361139a82a6c8eef30fddd7c"
-		logic_hash = "dac574b12f72b99fe66500edb6447802f95ad8d6c787ddbea69b36a1c0dfdab7"
+		logic_hash = "v1_sha256_dac574b12f72b99fe66500edb6447802f95ad8d6c787ddbea69b36a1c0dfdab7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274476,21 +272521,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310034002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Cupfixerxsys_Windowsrwinddkdriver_8C74 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CupFixerx64.sys"
 		author = "Florian Roth"
-		id = "32559d4c-eef4-5b67-a74c-f89589bc446b"
+		id = "23266563-15b0-5d34-90b5-171408a59f53"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5214-L5233"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9"
-		logic_hash = "d0eb0738da64ce1a94278a422e829f01d1514ac4536fc2187aa5f4112b70f6e0"
+		logic_hash = "v1_sha256_d0eb0738da64ce1a94278a422e829f01d1514ac4536fc2187aa5f4112b70f6e0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274506,14 +272551,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Cupfixerxsys_Windowsrwind
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdeliveryfirmwareupdatetoolkerneldriver_0CF8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PDFWKRNL.sys"
 		author = "Florian Roth"
-		id = "2eb54e4c-3e7b-5b75-895e-5985c8536282"
+		id = "47451309-01f2-5eee-8a1d-0e996f12cb1e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -274521,7 +272566,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdel
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0cf84400c09582ee2911a5b1582332c992d1cd29fcf811cb1dc00fcd61757db0"
 		hash = "f190919f1668652249fa23d8c0455acbde9d344089fde96566239b1a18b91da2"
-		logic_hash = "6497a69a7fd7502a78ec6d373a2b0bdc1da73bca4590a256f7094463e0f0b363"
+		logic_hash = "v1_sha256_6497a69a7fd7502a78ec6d373a2b0bdc1da73bca4590a256f7094463e0f0b363"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274537,21 +272582,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdel
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300032003100200041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_B175 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
 		author = "Florian Roth"
-		id = "1c0669aa-b156-580f-9bb0-d69502af6a7f"
+		id = "7f72423f-e0f1-55c3-a862-45246df1afe7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5259-L5278"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0"
-		logic_hash = "bfcaa037bc06303a0de6a0372cd9dd49bd9801610989df46ca19fd844b22560e"
+		logic_hash = "v1_sha256_bfcaa037bc06303a0de6a0372cd9dd49bd9801610989df46ca19fd844b22560e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274567,21 +272612,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedrive
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000370020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_4D77 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "5edd8373-0756-59cf-8079-8cfd5b1fd454"
+		id = "ee74cb1d-2426-588a-8724-4565289eb577"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5281-L5300"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4d777a9e2c61e8b55b3c34c5265b301454bb080abe7ffb373e7800bd6a498f8d"
-		logic_hash = "bed34d3bcb856628a688bb189f5bc1a0adf2384698ac28196fc5313e57387a1e"
+		logic_hash = "v1_sha256_bed34d3bcb856628a688bb189f5bc1a0adf2384698ac28196fc5313e57387a1e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274597,21 +272642,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_2AFD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "4dc89f62-c0e0-5abf-9774-3ca21f8a1d8e"
+		id = "7a9a0dbf-d402-582e-9fb4-d605800b8c1c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5303-L5322"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30"
-		logic_hash = "a687639311529ca919f90d478ddbb39e441ce24a58be056af7a7108db3f11f25"
+		logic_hash = "v1_sha256_a687639311529ca919f90d478ddbb39e441ce24a58be056af7a7108db3f11f25"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274627,21 +272672,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_2AFD : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_00D9 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "608b2435-4923-5979-9fbd-1a4cff95a450"
+		id = "40a53cd9-2f7e-5d15-8994-0149463846da"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5325-L5344"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "00d9781d0823ab49505ef9c877aa6fa674e19ecc8b02c39ee2728f298bc92b03"
-		logic_hash = "dd1b181f975ada1e7d1def32be88e41df2f994c698e794dc0fade119b0eabf2d"
+		logic_hash = "v1_sha256_dd1b181f975ada1e7d1def32be88e41df2f994c698e794dc0fade119b0eabf2d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274657,21 +272702,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_00D9 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100340020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_C35C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
 		author = "Florian Roth"
-		id = "52742e0b-0e2f-5a83-9993-b3cde1a5cb5e"
+		id = "adab94be-f7b6-5dbe-9141-f07c2f2a3ef6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5347-L5366"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c35cab244bd88bf0b1e7fc89c587d82763f66cf1108084713f867f72cc6f3633"
-		logic_hash = "f9010e0f70eb1c94a1e41e5999623f5eeb6aff155c36cb7b17c196eb363a62c4"
+		logic_hash = "v1_sha256_f9010e0f70eb1c94a1e41e5999623f5eeb6aff155c36cb7b17c196eb363a62c4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274687,21 +272732,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedriverfornt_EA85 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IOMap64.sys"
 		author = "Florian Roth"
-		id = "8b2fbab4-4b54-57dc-9591-1d993e844dc0"
+		id = "158eb557-e8c0-5a66-9860-14a1f033bb72"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5369-L5388"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41"
-		logic_hash = "f9ffedd3761c0cf68d5f862ceb8e22a61a5da73e757cf92317085b714656e139"
+		logic_hash = "v1_sha256_f9ffedd3761c0cf68d5f862ceb8e22a61a5da73e757cf92317085b714656e139"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274717,21 +272762,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003100300020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E05E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt.sys"
 		author = "Florian Roth"
-		id = "71c7a688-d20a-57c3-b4c5-b8344e936900"
+		id = "2d9200bd-503c-5ed8-9c0a-7a5410931a88"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5391-L5410"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
-		logic_hash = "94ee30a5cbd1ff47cddf35ec2205d9008857e87c457dce025501132231a146e4"
+		logic_hash = "v1_sha256_94ee30a5cbd1ff47cddf35ec2205d9008857e87c457dce025501132231a146e4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274747,21 +272792,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E05E : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E452 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "15332784-229c-5b5e-b06c-2ea6cff64113"
+		id = "fac915cd-2f42-59ae-91ce-e3feda85495f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5413-L5432"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9"
-		logic_hash = "0a35b3e88bb078e61c2769267fdba624d171492b0e4d1c57ecf7ea770fa2f44d"
+		logic_hash = "v1_sha256_0a35b3e88bb078e61c2769267fdba624d171492b0e4d1c57ecf7ea770fa2f44d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274777,14 +272822,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_5596 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - hw.sys"
 		author = "Florian Roth"
-		id = "2a470258-2ec1-5d80-8ce8-d8f83a27c365"
+		id = "5c9e60bd-5c72-580c-84c6-24d756b70623"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -274792,7 +272837,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_5596 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa"
 		hash = "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8"
-		logic_hash = "fcfc255a20b512b38057022c05a694e757b08950d6d35b3c361b0559da51a689"
+		logic_hash = "v1_sha256_fcfc255a20b512b38057022c05a694e757b08950d6d35b3c361b0559da51a689"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274808,21 +272853,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_5596 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003200310020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystemserviceprovider_E602 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GtcKmdfBs.sys"
 		author = "Florian Roth"
-		id = "b8357662-5966-55fc-801f-a82f137edcd4"
+		id = "22ff4a67-35f3-53b8-a279-c87d7ecd9327"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5458-L5477"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e6023b8fd2ce4ad2f3005a53aa160772e43fe58da8e467bd05ab71f3335fb822"
-		logic_hash = "6e220e39e765c6af5d2e80cce4a4a07b587ccd559e0cb455d56046cf4c2ff447"
+		logic_hash = "v1_sha256_6e220e39e765c6af5d2e80cce4a4a07b587ccd559e0cb455d56046cf4c2ff447"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274838,21 +272883,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003900200047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Genitlkiwibenjaminxxxxx_Titidrv_Titidrvtiticatz_208E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - titidrv.sys"
 		author = "Florian Roth"
-		id = "06cdecba-e002-5354-ac4a-09bd8178ae37"
+		id = "dbcd1f16-2548-5dc4-a407-0722544313e1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5480-L5499"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "208ea38734979aa2c86332eba1ea5269999227077ff110ac0a0d411073165f85"
-		logic_hash = "c1a57d6f66fd8818dd72813a3bac78eab44b2b546f65a78864739cb55a258d39"
+		logic_hash = "v1_sha256_c1a57d6f66fd8818dd72813a3bac78eab44b2b546f65a78864739cb55a258d39"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274868,21 +272913,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Genitlkiwibenjaminxxxxx_Titidrv_Titidrvtiticatz_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000670065006e00690074006c006b0069007700690020002800420065006e006a0061006d0069006e0020005800580058005800580029 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdeliveryfirmwareupdateutilitydriver_5DF6 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PDFWKRNL.sys"
 		author = "Florian Roth"
-		id = "c43c80e9-64c4-553a-8c2e-1b32cee12673"
+		id = "08ba4156-82b8-51b4-b176-bc1384a6da85"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5502-L5521"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5df689a62003d26df4aefbaed41ec1205abbf3a2e18e1f1d51b97711e8fcdf00"
-		logic_hash = "b560682fe9ed95a19df7dcc6ea823545d2303a51aaa06dc14e48c73f2e6fe8b7"
+		logic_hash = "v1_sha256_b560682fe9ed95a19df7dcc6ea823545d2303a51aaa06dc14e48c73f2e6fe8b7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274898,21 +272943,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdel
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300032003300200041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_B9AD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "b5b42779-0d81-5133-864f-f36337593c81"
+		id = "f2c690a7-e2a1-548b-a1e7-2d5fbf806372"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5524-L5543"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b9ad7199c00d477ebbc15f2dcf78a6ba60c2670dad0ef0994cebccb19111f890"
-		logic_hash = "c8efd23f9fb60831cede71737c5d1e62d94f3b44a2b3da7f29db06ca4599821d"
+		logic_hash = "v1_sha256_c8efd23f9fb60831cede71737c5d1e62d94f3b44a2b3da7f29db06ca4599821d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274928,14 +272973,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_B9AD : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_348D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "4856e997-d5de-5bae-a35b-88ab55b77ae7"
+		id = "ea262b71-2536-5d5a-b892-99d5bf0e74a2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -274943,7 +272988,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_348D : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "348dc502ac57d7362c7f222e656c52e630c90bef92217a3bd20e49193b5a69f1"
 		hash = "c186967cc4f2a0cb853c9796d3ea416d233e48e735f02b1bb013967964e89778"
-		logic_hash = "435219f0b49a009eb42ffa096c4acefc48f85d03a8656d5142df20deee19cf08"
+		logic_hash = "v1_sha256_435219f0b49a009eb42ffa096c4acefc48f85d03a8656d5142df20deee19cf08"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274959,21 +273004,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_348D : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100310020003300360030002e0063006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Mydriverscom_Hwm_Drivergenius_08EB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mydrivers.sys"
 		author = "Florian Roth"
-		id = "a944a7a1-f938-548e-8788-a4733d777850"
+		id = "de8cf1ae-4210-5fa1-8017-d755db46dcb6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5569-L5588"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6"
-		logic_hash = "2371de5547217734226420bbbee12dee897206bd2419387d2c2fc2ae07df7fec"
+		logic_hash = "v1_sha256_2371de5547217734226420bbbee12dee897206bd2419387d2c2fc2ae07df7fec"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -274989,21 +273034,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Mydriverscom_Hwm_Drivergenius_08EB : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020004d00790044007200690076006500720073002e0063006f006d00200061006c006c002000720069006700680074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_3E27 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA.sys"
 		author = "Florian Roth"
-		id = "5e116c70-6da1-5397-9b73-32955086c886"
+		id = "78fc2846-7dab-5308-8390-11d93ca7dd2f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5591-L5610"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75"
-		logic_hash = "18affdea7f982e47ca4852d9a4a28797a1ca3175c404c8e5c316ee3a610cf858"
+		logic_hash = "v1_sha256_18affdea7f982e47ca4852d9a4a28797a1ca3175c404c8e5c316ee3a610cf858"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275019,21 +273064,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_3E27 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Evgatechnologyinc_Windowsvistasmartiodevice_Windowsvistasmartiodevice_3C95 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SMARTEIO64.SYS"
 		author = "Florian Roth"
-		id = "a5b9f906-4250-52f7-84ba-ad8f6a5ebabc"
+		id = "f3cbe812-aa34-5fa8-8f3e-4188b284ba0b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5613-L5632"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3c95ebf3f1a87f67d2861dbd1c85dc26c118610af0c9fbf4180428e653ac3e50"
-		logic_hash = "e0bf6bd64e91baa27e1181223cba6f4975b5b5a9fd9918d4c65180ed584b319b"
+		logic_hash = "v1_sha256_e0bf6bd64e91baa27e1181223cba6f4975b5b5a9fd9918d4c65180ed584b319b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275049,21 +273094,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Evgatechnologyinc_Windowsvistasmartiodevice_Wind
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002800630029002000320030003000370020004500560047004100200054006500630068006e006f006c006f0067007900200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_033C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "13af3aa3-b338-57ac-b803-f811b695717e"
+		id = "ece585cb-779a-5d47-81c5-780b52c58ded"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5635-L5654"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "033c4634ab1a43bc3247384864f3380401d3b4006a383312193799dded0de4c7"
-		logic_hash = "fea547a999db61dd4c87d648d8e0e1a50f9c677439d514cfdd0a75a5a6da4c8f"
+		logic_hash = "v1_sha256_fea547a999db61dd4c87d648d8e0e1a50f9c677439d514cfdd0a75a5a6da4c8f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275079,21 +273124,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_033C : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbsys_Virtualboxusbdriver_5B26 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxUSB.Sys"
 		author = "Florian Roth"
-		id = "66da7fa1-1387-5a73-858f-05a877f810a9"
+		id = "1deb4725-57ba-5430-8b8b-0c0774014710"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5657-L5676"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5b26c4678ecd37d1829513f41ff9e9df9ef1d1d6fea9e3d477353c90cc915291"
-		logic_hash = "49554df6ecdbfafbb3cf8f78cdece896830dd842cf1cae1129f11eb69a3588c4"
+		logic_hash = "v1_sha256_49554df6ecdbfafbb3cf8f78cdece896830dd842cf1cae1129f11eb69a3588c4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275109,21 +273154,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbsys_Virtualboxusbdrive
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_3B6E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "d2e411b6-da38-5ff0-a24a-78064a5fafcf"
+		id = "c3e4fb00-2b3b-512e-8e40-75ed5eec785c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5679-L5698"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b"
-		logic_hash = "f3736282399849376632ee9392bf679779cecbb76fa7bd8ccaff0b787a3370f5"
+		logic_hash = "v1_sha256_f3736282399849376632ee9392bf679779cecbb76fa7bd8ccaff0b787a3370f5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275139,14 +273184,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_3B6E : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "ab7574a5-acba-5e3d-9259-e5833d43d195"
+		id = "36fdf67b-91f0-5268-acc6-150f08729c46"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -275154,7 +273199,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73 : FI
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b"
 		hash = "fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c"
-		logic_hash = "9e024ac35be2fe02ecaae96f3cfbbae60b4032986f22710809699049456e979c"
+		logic_hash = "v1_sha256_9e024ac35be2fe02ecaae96f3cfbbae60b4032986f22710809699049456e979c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275170,21 +273215,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Wistroncorporation_Wirwadrvsys_Wistronrwadriver_D8FC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiRwaDrv.sys"
 		author = "Florian Roth"
-		id = "67b74d38-f26d-56b9-8a92-c923ad1f797e"
+		id = "e76e017b-f5b3-5cf8-91b5-d92a09b551be"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5724-L5743"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d8fc8e3a1348393c5d7c3a84bcbae383d85a4721a751ad7afac5428e5e579b4e"
-		logic_hash = "e991957205079fb282f9fb248637d4723c940a7e9ab708e68082e99adbed647c"
+		logic_hash = "v1_sha256_e991957205079fb282f9fb248637d4723c940a7e9ab708e68082e99adbed647c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275200,21 +273245,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wistroncorporation_Wirwadrvsys_Wistronrwadriver_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000570069007300740072006f006e00200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1A42 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "d776ad80-318f-5e3c-b006-daa70a14aff4"
+		id = "39a64555-7e08-5626-821d-327917888181"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5746-L5765"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0"
-		logic_hash = "bfd4ff6c58d83e8d09d43d75e655993319283d0a41407d20417011d663791fd3"
+		logic_hash = "v1_sha256_bfd4ff6c58d83e8d09d43d75e655993319283d0a41407d20417011d663791fd3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275230,14 +273275,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1A42 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_F14D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "ffc28a07-9de8-5b22-88eb-1fd7e71db360"
+		id = "5503d7d8-0c71-5169-af5e-261110a2f214"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -275245,7 +273290,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_F14D : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f14da8aa5c8eea8df63cf935481d673fdf3847f5701c310abf4023f9d80ad57d"
 		hash = "c6a5663f20e5cee2c92dee43a0f2868fb0af299f842410f4473dcde7abcb6413"
-		logic_hash = "6d1a98e8b5ab416446cf15cf15a2bad93dfbe9b984b40f5fae523e17e6eb5caa"
+		logic_hash = "v1_sha256_6d1a98e8b5ab416446cf15cf15a2bad93dfbe9b984b40f5fae523e17e6eb5caa"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275261,21 +273306,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_F14D : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100350020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_EC5F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "1d73baba-017c-527d-9eb8-0eb9865656b6"
+		id = "633feb59-f8da-50d1-8c20-ef4d539fe5b1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5791-L5810"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5"
-		logic_hash = "74fad50be13de00367a5cecb25f7e3feb53f5e8553fac8cd32edc500a91aad88"
+		logic_hash = "v1_sha256_74fad50be13de00367a5cecb25f7e3feb53f5e8553fac8cd32edc500a91aad88"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275291,21 +273336,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_EC5F : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_34E0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "11164331-fdba-5e7d-a2ea-4621b438060a"
+		id = "7834e9a9-5745-5e42-af49-7ae06b72778e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5813-L5832"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf"
-		logic_hash = "a2f304406595b6cad63dbc83f32f1a35477d022fe5cad1c11ac9746d3775199d"
+		logic_hash = "v1_sha256_a2f304406595b6cad63dbc83f32f1a35477d022fe5cad1c11ac9746d3775199d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275321,21 +273366,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_D0BD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "81712338-7518-565a-8004-4708808d93ee"
+		id = "0c08ad20-f651-5798-9a9a-3de48270b01c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5835-L5854"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889"
-		logic_hash = "c285e87a94025916ed6d3fac65761d1ca4bef13102a0a37b256525bf651bd16c"
+		logic_hash = "v1_sha256_c285e87a94025916ed6d3fac65761d1ca4bef13102a0a37b256525bf651bd16c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275351,21 +273396,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_D0BD : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Atlaccesssys_Windowsrwinddkdriver_0B57 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atlAccess.sys"
 		author = "Florian Roth"
-		id = "1c6be4ef-90f7-5b77-8490-0362233c02d9"
+		id = "0e77db79-f35a-5b4b-a3be-fc75b362e343"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5857-L5876"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0b57569aaa0f4789d9642dd2189b0a82466b80ad32ff35f88127210ed105fe57"
-		logic_hash = "93d5121da2037ffcc961550b6859bff4257f56b783d7c49e442dc97a3f9257ae"
+		logic_hash = "v1_sha256_93d5121da2037ffcc961550b6859bff4257f56b783d7c49e442dc97a3f9257ae"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275381,21 +273426,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Atlaccesssys_Windowsrwind
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_909F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "f6ca1049-6a11-5bdb-a9b7-79200c57e339"
+		id = "d2b1ea82-b759-58d4-a80a-7060ecc896a1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5879-L5898"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "909f6c4b8f779df01ef91e549679aa4600223ac75bc7f3a3a79a37cee2326e77"
-		logic_hash = "4e4a093fcdd97298aa6ead7c4412263837a7403f87b4d8f72e6ea27bc6f4d15f"
+		logic_hash = "v1_sha256_4e4a093fcdd97298aa6ead7c4412263837a7403f87b4d8f72e6ea27bc6f4d15f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275411,21 +273456,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_3C18 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "94b7a58c-0092-5d81-985f-330599efe25a"
+		id = "9563528e-4251-5d67-8558-37fb5a27a916"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5901-L5917"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b"
-		logic_hash = "4f958ccb21b5cbd28c25a9c2e1a08fcf00e24bfa9e7814b9e68b87814dd04f4c"
+		logic_hash = "v1_sha256_4f958ccb21b5cbd28c25a9c2e1a08fcf00e24bfa9e7814b9e68b87814dd04f4c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275438,21 +273483,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_3C18 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2B4C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
 		author = "Florian Roth"
-		id = "a337e8f1-1473-51a4-9098-69719f0c48e4"
+		id = "185eb8b8-904b-5ef9-8a18-dc9ad9de5d3f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5920-L5939"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a"
-		logic_hash = "3db68ef927d373e7774d52bbf1dccfa2960b4bb1b42a32a181ad9e1f00458f23"
+		logic_hash = "v1_sha256_3db68ef927d373e7774d52bbf1dccfa2960b4bb1b42a32a181ad9e1f00458f23"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275468,21 +273513,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2B4C : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Iprt_Virtualboxguestadditions_BBF5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxMouseNT.sys"
 		author = "Florian Roth"
-		id = "a1a4e7d1-5a54-5265-8911-117e50071c7e"
+		id = "bbfd3183-0ed7-5f74-b2c5-4b7c77c33839"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5942-L5961"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "bbf564a02784d53b8006333406807c3539ee4a594585b1f3713325904cb730ec"
-		logic_hash = "7f5480d84195854bdc5c7554495e0ecd9b69b9c527152def1e85fd61084fd22d"
+		logic_hash = "v1_sha256_7f5480d84195854bdc5c7554495e0ecd9b69b9c527152def1e85fd61084fd22d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275498,14 +273543,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Iprt_Virtualboxguestadditions_BBF5 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300034002d003200300030003700200069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_9399 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
 		author = "Florian Roth"
-		id = "30c2cc30-6613-5158-8cd1-b80eac8d6fbc"
+		id = "413fb6f4-eab0-567e-b654-553ec60a871a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -275513,7 +273558,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_9399 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9399f35b90f09b41f9eeda55c8e37f6d1cb22de6e224e54567d1f0865a718727"
 		hash = "a66b4420fa1df81a517e2bbea1a414b57721c67a4aa1df1967894f77e81d036e"
-		logic_hash = "92139b7123c13dc80c1671b92ad6d1c6d6f4d02e1a3bc07e95cac27c7d43df66"
+		logic_hash = "v1_sha256_92139b7123c13dc80c1671b92ad6d1c6d6f4d02e1a3bc07e95cac27c7d43df66"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275529,21 +273574,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_9399 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300032002d0032003000320031002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_3D23 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
 		author = "Florian Roth"
-		id = "b29e4411-a408-5bd5-a763-73c18b85e2b2"
+		id = "78b62971-23d4-52c2-9bba-4ee05d4bd73a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L5987-L6006"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4"
-		logic_hash = "4f494f3f2367bbc5751a09b79775ea61f62986b82375c8c98bf6a77203174be1"
+		logic_hash = "v1_sha256_4f494f3f2367bbc5751a09b79775ea61f62986b82375c8c98bf6a77203174be1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275559,21 +273604,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_3D23 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_496F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA.sys"
 		author = "Florian Roth"
-		id = "7754e086-1936-5e47-9576-ee940453c5e7"
+		id = "a562eec6-edb0-509d-b4b7-6f30002ffe02"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6009-L6028"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b"
-		logic_hash = "405e7a16f8290d1d5462227ccf7d42e137bc98f084c9d5763b000d101e615c6a"
+		logic_hash = "v1_sha256_405e7a16f8290d1d5462227ccf7d42e137bc98f084c9d5763b000d101e615c6a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275589,14 +273634,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_496F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300036002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_1B00 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "d29981ff-6c7b-55fb-a77e-c16755e988ab"
+		id = "182b10a1-8974-54bc-abdf-ba02239e91b0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -275604,7 +273649,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e"
 		hash = "51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5"
-		logic_hash = "191ef735b2fa7cf3c1e0ae1a28e7996580ed2094d214f2ce7b42d856b119eb5e"
+		logic_hash = "v1_sha256_191ef735b2fa7cf3c1e0ae1a28e7996580ed2094d214f2ce7b42d856b119eb5e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275620,21 +273665,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Multitheftauto_Mtasanandreas_9F4C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FairplayKD.sys"
 		author = "Florian Roth"
-		id = "a7059f0e-ae46-506f-a3c0-8ecb6911cd1d"
+		id = "62d025ba-8790-5698-a01c-469ba2d4c281"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6054-L6071"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5"
-		logic_hash = "b8c423a00732d4e0fb4c45c64a6794a466e604feb9d455bc110cf5169f95ab55"
+		logic_hash = "v1_sha256_b8c423a00732d4e0fb4c45c64a6794a466e604feb9d455bc110cf5169f95ab55"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275648,21 +273693,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Multitheftauto_Mtasanandreas_9F4C : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003000330020002d002000320030003100370020004d0075006c007400690020005400680065006600740020004100750074006f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_2732 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "ec2c7c9f-d4cd-5497-9de5-4948767ba125"
+		id = "cf1be476-7dde-534b-bc9b-c48e2d6630f3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6074-L6093"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c"
-		logic_hash = "17723afb429fe90b2e49d61676c6564ce94547b55be45ea6a66cf8d2edcdc49b"
+		logic_hash = "v1_sha256_17723afb429fe90b2e49d61676c6564ce94547b55be45ea6a66cf8d2edcdc49b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275678,14 +273723,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_2732 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A153 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
 		author = "Florian Roth"
-		id = "fde5a9a5-38d3-5ce4-b18d-11fd6a48687d"
+		id = "31db76f1-fd85-5882-abc2-f5900e4cd016"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -275694,7 +273739,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A153 : FILE
 		hash = "a15325e9e6b8e4192291deb56c20c558dde3f96eb682c6e90952844edb984a00"
 		hash = "e728b259113d772b4e96466ab8fe18980f37c36f187b286361c852bd88101717"
 		hash = "4c859b3d11d2ff0049b644a19f3a316a8ca1a4995aa9c39991a7bde8d4f426a4"
-		logic_hash = "6f5ca89515d8e224288c81dc941a5e4589fd111b4f2b8e519d272bf5efac76dc"
+		logic_hash = "v1_sha256_6f5ca89515d8e224288c81dc941a5e4589fd111b4f2b8e519d272bf5efac76dc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275709,14 +273754,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A153 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310034002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_3F36 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "9b7d79c3-549b-549f-ab67-b091798154f5"
+		id = "1b3dfd70-6c1c-5f84-9b31-b119bbe391fb"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -275724,7 +273769,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_3F36 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3f3684a37b2645fa6827943d9812ffc2d83e89e962935b29874bec7c3714a06f"
 		hash = "37d999df20c1a0b8ffaef9484c213a97b9987ed308b4ba07316a6013fbd31c60"
-		logic_hash = "c82730df0e7b53c67478f3fa01728841eb3794354c3233b87fe342e652fadb2e"
+		logic_hash = "v1_sha256_c82730df0e7b53c67478f3fa01728841eb3794354c3233b87fe342e652fadb2e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275740,21 +273785,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_3F36 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003200300020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7702 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "2388fb25-1e77-5225-864e-ef38c9b52007"
+		id = "cad8ca69-3764-50dd-8ea7-3f91d58f6598"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6142-L6161"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7702f240800528d8186e3e6a26e2680486fed65a6fb5a2a000ad12c1fb61a398"
-		logic_hash = "c2f1170c6fc0353b99f0c0487937d05cba9a79c3b70eafa1895999074c6c4972"
+		logic_hash = "v1_sha256_c2f1170c6fc0353b99f0c0487937d05cba9a79c3b70eafa1895999074c6c4972"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275770,21 +273815,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7702 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_EF6D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
 		author = "Florian Roth"
-		id = "28e934c7-1705-5dd7-967f-ac259af3809e"
+		id = "760435e1-f6e7-5f54-b706-1b7da0330b31"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6164-L6183"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850"
-		logic_hash = "aff0eae9976189fe89534f7c3f1a35f093627f71d2c65aa446da85185f972bea"
+		logic_hash = "v1_sha256_aff0eae9976189fe89534f7c3f1a35f093627f71d2c65aa446da85185f972bea"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275800,21 +273845,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_EF6D : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Microfocus_Microfocusxtier_95D5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
 		author = "Florian Roth"
-		id = "394be6fa-5c49-5af2-ac20-d0da0ffe7624"
+		id = "a090115c-968e-56dd-9ec7-d4af5fb6ac45"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6186-L6204"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
-		logic_hash = "070ce1aff2ca552a049602c694e77bd89caa4f6712d86671e21745d9d88f3bc3"
+		logic_hash = "v1_sha256_070ce1aff2ca552a049602c694e77bd89caa4f6712d86671e21745d9d88f3bc3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275829,21 +273874,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Microfocus_Microfocusxtier_95D5 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Z_Computerzsys_Zwuqisystemdriver_61E7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "c691fecf-9556-5b70-9a84-b645b053cfc0"
+		id = "d3cc6f64-27d7-592d-9479-7210c5f7400a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6207-L6226"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "61e7f9a91ef25529d85b22c39e830078b96f40b94d00756595dded9d1a8f6629"
-		logic_hash = "891a11f7f82c6aaa05801bdf0fd82d9786ec1e35c6d699119a801d5cc8e1fe24"
+		logic_hash = "v1_sha256_891a11f7f82c6aaa05801bdf0fd82d9786ec1e35c6d699119a801d5cc8e1fe24"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275859,21 +273904,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Z_Computerzsys_Zwuqisystemdriver_61E7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020007700770077002e007a0077007500710069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_8DCE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "176b70cc-3b8c-57f2-82be-42d9a9b9069f"
+		id = "19100907-b47b-5cba-9bb4-8199f78fa153"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6229-L6248"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8dcec67a1f4903981c3e0ab938784c2f241e041e26748e1c22059e0e507cfb37"
-		logic_hash = "4900c684a248338e686b0da0288fe2937cf5d0f5e453419b6f8091c2fc7fc061"
+		logic_hash = "v1_sha256_4900c684a248338e686b0da0288fe2937cf5d0f5e453419b6f8091c2fc7fc061"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275889,21 +273934,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_8DCE : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E3EF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "3778fe25-a5d5-5cb0-8f03-9ceed5d71aa9"
+		id = "e64a729c-4b68-5766-8522-a347569508f4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6251-L6270"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918"
-		logic_hash = "50c225f42f3b7ac785d01cc9ad5542ac2e12d26e707d0ed5b8c5415d981479bc"
+		logic_hash = "v1_sha256_50c225f42f3b7ac785d01cc9ad5542ac2e12d26e707d0ed5b8c5415d981479bc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275919,21 +273964,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E3EF : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7F37 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
 		author = "Florian Roth"
-		id = "f523949b-aff9-532a-9f13-983f4a47635d"
+		id = "39167c72-796e-568e-8db4-9f08b77d19c2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6273-L6292"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa"
-		logic_hash = "5e796e1ebc587faf2f8255e6229fe4f97f781fd66100398561703320d34728c1"
+		logic_hash = "v1_sha256_5e796e1ebc587faf2f8255e6229fe4f97f781fd66100398561703320d34728c1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275949,21 +273994,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7F37 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Paniosys_Paniolibrary_F596 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIO.sys"
 		author = "Florian Roth"
-		id = "098abff0-1471-5793-8366-89df85dc216c"
+		id = "f75d3cd5-9b61-55d9-8699-cea3cac75638"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6295-L6314"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960"
-		logic_hash = "5694c7f1a74ffd5cdaa143bc563939589305450c3ee24c758fb7379b79f73764"
+		logic_hash = "v1_sha256_5694c7f1a74ffd5cdaa143bc563939589305450c3ee24c758fb7379b79f73764"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -275979,14 +274024,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Paniosys
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_6C5A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
 		author = "Florian Roth"
-		id = "eb1ea3d1-6435-5ca6-b16a-111befaf2000"
+		id = "1f8a30a5-e40d-50f3-8f3d-9dd54cd5c343"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -275994,7 +274039,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_6C5A : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6c5aef14613b8471f5f4fdeb9f25b5907c2335a4bc18b3c2266fb1ffd8f1741d"
 		hash = "ec1307356828426d60eab78ffb5fc48a06a389dea6e7cc13621f1fa82858a613"
-		logic_hash = "02155af4ab432fbbec1bf582fa8161eb2e39c258bb0f67fcc7054d2f3c8a46be"
+		logic_hash = "v1_sha256_02155af4ab432fbbec1bf582fa8161eb2e39c258bb0f67fcc7054d2f3c8a46be"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276009,21 +274054,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_6C5A : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_1768 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "4d79b72a-0848-5fe4-89fe-b16ab03d18d3"
+		id = "5f906307-da5b-5bc6-a9c9-4d8b7c2d449b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6339-L6358"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca"
-		logic_hash = "5fb10d691fda963001b9a3c07b22db5e63beef984f26bc7d31ad98a1524ce5ff"
+		logic_hash = "v1_sha256_5fb10d691fda963001b9a3c07b22db5e63beef984f26bc7d31ad98a1524ce5ff"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276039,14 +274084,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_1768 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_3913 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "26b781e0-c148-5506-b135-9b0b8fbf7cf3"
+		id = "1422a0c8-07d9-5b88-a9ac-c8a25a1bab4b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276055,7 +274100,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_3913 : FILE
 		hash = "39134750f909987f6ebb46cf37519bb80707be0ca2017f3735018bac795a3f8d"
 		hash = "a34e45e5bbec861e937aefb3cbb7c8818f72df2082029e43264c2b361424cbb1"
 		hash = "3e758221506628b116e88c14e71be99940894663013df3cf1a9e0b6fb18852b9"
-		logic_hash = "3750522328a703bfff3a782a9470848875ac679f2a4a4bcabc148f0d8d89697d"
+		logic_hash = "v1_sha256_3750522328a703bfff3a782a9470848875ac679f2a4a4bcabc148f0d8d89697d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276071,14 +274116,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_3913 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100310020003300360030002e0063006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_767E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "b4b9dbcc-b5bd-5a9b-b190-10e20afc5220"
+		id = "b53efcab-4bca-5b66-ba71-c4fe0b603677"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276086,7 +274131,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_767E : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "767ef5c831f92d92f2bfc3e6ea7fd76d11999eeea24cb464fd62e73132ed564b"
 		hash = "d9a73df5ac5c68ef5b37a67e5e649332da0f649c3bb6828f70b65c0a2e7d3a23"
-		logic_hash = "624a88bcb301508151c2afdd1d5f076d04e2941dc2178b931f9dcfe3d63ab47d"
+		logic_hash = "v1_sha256_624a88bcb301508151c2afdd1d5f076d04e2941dc2178b931f9dcfe3d63ab47d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276102,21 +274147,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_767E : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100340020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_9A54 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "17496639-ec11-519b-8143-2d43568e09cd"
+		id = "8836a02a-407b-57af-b012-faa08f721e80"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6408-L6427"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7"
-		logic_hash = "a520f2236b800f2dd2b8ac9963b8e9ba3ce782cca2c1b2835540899da65168b5"
+		logic_hash = "v1_sha256_a520f2236b800f2dd2b8ac9963b8e9ba3ce782cca2c1b2835540899da65168b5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276132,21 +274177,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Oti_Otipcibussys_Kernelmodedrivertoaccessphysicalmemoryandports_4E3E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - otipcibus.sys"
 		author = "Florian Roth"
-		id = "71052609-e8a3-5611-ad92-8cf43a0fddf0"
+		id = "c622317a-3193-5f9e-b862-ce0b066e4bb9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6430-L6448"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80"
-		logic_hash = "ef5cb96dc4f6eaaf24fe9d0a65ccb5efe54cb672a9328b9dc2bbc36af82d96e2"
+		logic_hash = "v1_sha256_ef5cb96dc4f6eaaf24fe9d0a65ccb5efe54cb672a9328b9dc2bbc36af82d96e2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276161,21 +274206,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Oti_Otipcibussys_Kernelmodedrivertoaccessphysica
 		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_DCB8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "72ff75ea-c085-51bc-806e-1a43127d1c64"
+		id = "da6ef035-8d92-5517-a627-81869d0c98f5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6451-L6470"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258"
-		logic_hash = "80b8d0833d2e3675c5a1105725ef61e6914774019d4499c752a25b628a985274"
+		logic_hash = "v1_sha256_80b8d0833d2e3675c5a1105725ef61e6914774019d4499c752a25b628a985274"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276191,21 +274236,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_DCB8 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_CFCF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
 		author = "Florian Roth"
-		id = "a4c49dca-e35c-5326-9b30-729ecf65653c"
+		id = "ed7c2797-fa9e-5eb7-a692-b034db5d10c3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6473-L6492"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab"
-		logic_hash = "2dd35edfdf8b82b650278186df087c5ae103f3b807faf30c72278521ff56224b"
+		logic_hash = "v1_sha256_2dd35edfdf8b82b650278186df087c5ae103f3b807faf30c72278521ff56224b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276221,21 +274266,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_F8D4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
 		author = "Florian Roth"
-		id = "2de9949d-830d-5540-8b4f-1d1262b8b76c"
+		id = "95abe26a-a0d1-5b53-80e3-36b7290b3754"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6495-L6514"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f8d45fa03f56e2ea14920b902856666b8d44f1f1b16644baf8c1ae9a61851fb6"
-		logic_hash = "522145d0081891d18a0c1e657ca6228962e97325697b556d97a4fe311efa3aee"
+		logic_hash = "v1_sha256_522145d0081891d18a0c1e657ca6228962e97325697b556d97a4fe311efa3aee"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276251,14 +274296,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_D0E4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
 		author = "Florian Roth"
-		id = "a85c77e3-b898-568a-afae-39452ba4b84a"
+		id = "b5ce1228-3711-5058-b183-847922fc9459"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276266,7 +274311,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_D0E4 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d0e4d3e1f5d5942aaf2c72631e9490eecc4d295ee78c323d8fe05092e5b788eb"
 		hash = "2ad8c38f6e0ca6c93abe3228c8a5d4299430ce0a2eeb80c914326c75ba8a33f9"
-		logic_hash = "6a29c44686032d2367b1b4b9ef342239b9490e48ba1cc5f862b66f3de6a3f4b2"
+		logic_hash = "v1_sha256_6a29c44686032d2367b1b4b9ef342239b9490e48ba1cc5f862b66f3de6a3f4b2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276282,14 +274327,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_D0E4 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_77DA : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "5a49351a-0d32-55e6-acb8-f55a861a7da2"
+		id = "4c5a8705-7880-59b4-8828-2fef573af816"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276297,7 +274342,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "77da3e8c5d70978b287d433ae1e1236c895b530a8e1475a9a190cdcc06711d2f"
 		hash = "837d3b67d3e66ef1674c9f1a47046e1617ed13f73ee08441d95a6de3d73ee9f2"
-		logic_hash = "a2918e4ffce0affe25aa7b8793c19dfa61da8321b35cb91600d0a5552e14fef6"
+		logic_hash = "v1_sha256_a2918e4ffce0affe25aa7b8793c19dfa61da8321b35cb91600d0a5552e14fef6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276313,14 +274358,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_0368 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "eda7e3e6-6fbe-59cd-af4d-159113c685b1"
+		id = "635cbd42-1193-507c-8015-d561a046b848"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276328,7 +274373,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_0368 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "03680068ec41bbe725e1ed2042b63b82391f792e8e21e45dc114618641611d5d"
 		hash = "66f851b309bada6d3e4b211baa23b534165b29ba16b5cbf5e8f44eaeb3ca86ea"
-		logic_hash = "67626089334102cf852d0863b58a29562dda673b6601a90b13d97a2380a4295c"
+		logic_hash = "v1_sha256_67626089334102cf852d0863b58a29562dda673b6601a90b13d97a2380a4295c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276344,21 +274389,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_0368 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100360020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_B0DC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvaudio.sys"
 		author = "Florian Roth"
-		id = "225ebe9f-c453-5d4b-89af-d6fcffa254cc"
+		id = "3144e7fb-65d1-5132-87f6-2d5ebd8e88c1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6586-L6605"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b0dcdbdc62949c981c4fc04ccea64be008676d23506fc05637d9686151a4b77f"
-		logic_hash = "13f4cfb57115eab4850771248b479f523f3c6d9a25a21b16ce224ab783dd4abc"
+		logic_hash = "v1_sha256_13f4cfb57115eab4850771248b479f523f3c6d9a25a21b16ce224ab783dd4abc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276374,21 +274419,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinchardwaremanagerdriver_7C79 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
 		author = "Florian Roth"
-		id = "6d37a9e4-e1b3-5e4a-bc33-1621c32b82dc"
+		id = "1ee64233-8f22-5bf1-a443-54b5f7e85d88"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6608-L6627"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7c79e5196c2f51d2ab16e40b9d5725a8bf6ae0aaa70b02377aedc0f4e93ca37f"
-		logic_hash = "1e60cfe82a13e311e8dc98cb4da82f0f1aecc606aaa5c57cda445228e78acd6b"
+		logic_hash = "v1_sha256_1e60cfe82a13e311e8dc98cb4da82f0f1aecc606aaa5c57cda445228e78acd6b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276404,21 +274449,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinch
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0032003000300032002d0032003000300039002000520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e0020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_DD4A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
 		author = "Florian Roth"
-		id = "65abda74-40d3-57c2-ade1-463b3e1ad1ef"
+		id = "6845b817-d964-59b2-8611-b65eedc83ff0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6630-L6649"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097"
-		logic_hash = "f04d75e5ff735d30d5bb3959722a5162b1ab7ce4db8d05a2007f98fc901b2179"
+		logic_hash = "v1_sha256_f04d75e5ff735d30d5bb3959722a5162b1ab7ce4db8d05a2007f98fc901b2179"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276434,21 +274479,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_DD4A : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Pchuntersys_Pchunter_1B7F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PCHunter.sys"
 		author = "Florian Roth"
-		id = "229e07ae-2358-5b7e-843d-a0038c57dcd0"
+		id = "0a4ee062-ba25-56ea-8ef5-d53301906c4f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6652-L6671"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa"
-		logic_hash = "54232c91f0f6d119ece865269eec9d5ea885c8dd0119a0eecd889a405af828a0"
+		logic_hash = "v1_sha256_54232c91f0f6d119ece865269eec9d5ea885c8dd0119a0eecd889a405af828a0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276464,21 +274509,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Pchuntersys_Pchunter_1B7F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200032003000310033002d0032003000310036002000450070006f006f006c0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_6500 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "87ed66d7-4903-5334-9bdb-90ba882c3e98"
+		id = "2d061d87-3fde-52fa-9e8e-f522d32c0f07"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6674-L6693"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3"
-		logic_hash = "a3a2b21c9a58fee77857f3074fe6b69506eecb2627d93f1ea3a51c4cccdd2bab"
+		logic_hash = "v1_sha256_a3a2b21c9a58fee77857f3074fe6b69506eecb2627d93f1ea3a51c4cccdd2bab"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276494,14 +274539,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_6500 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_0FC3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "df483112-63ae-51a2-9ebe-795c8ede056f"
+		id = "c0b1703b-1035-54ee-aa60-d453d644cb25"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276509,7 +274554,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_0FC3 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0fc3bc6e81b04dcaa349f59f04d6c85c55a2fea5db8fa0ba53d3096a040ce5a7"
 		hash = "40eef1f52c7b81750cee2b74b5d2f4155d4e58bdde5e18ea612ab09ed0864554"
-		logic_hash = "56d3b62717fae240ed7c6becfd6523962bb536fe4f7746e7c80f97851fe30501"
+		logic_hash = "v1_sha256_56d3b62717fae240ed7c6becfd6523962bb536fe4f7746e7c80f97851fe30501"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276525,14 +274570,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_0FC3 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100340020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_EDC6 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
 		author = "Florian Roth"
-		id = "382202e4-66c5-574b-a16f-1ce4f6e10f24"
+		id = "fd418690-b6f3-5535-8421-658efc530475"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276541,7 +274586,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_EDC6 : FILE
 		hash = "edc6e32e3545f859e5b49ece1cabd13623122c1f03a2f7454a61034b3ff577ed"
 		hash = "79e7165e626c7bde546cd1bea4b9ec206de8bed7821479856bdb0a2adc3e3617"
 		hash = "18b923b169b2c3c7db5cbfda0db0999f04adb2cf6c917e5b1fb2ff04714ecac1"
-		logic_hash = "e55f801255f5962479d0f69a162490ef45acd014d157118b6808c100583cafa3"
+		logic_hash = "v1_sha256_e55f801255f5962479d0f69a162490ef45acd014d157118b6808c100583cafa3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276557,21 +274602,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_EDC6 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000770079006a00730071002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_E428 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "3a87403b-9df1-566b-af2d-e22732584b63"
+		id = "ae44f119-9492-5806-b0ea-c6bb13e75192"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6743-L6759"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f"
-		logic_hash = "8bd47884d13cfc03ececb849688a1c843c4de684a6d32923493f9d0af3d33b7b"
+		logic_hash = "v1_sha256_8bd47884d13cfc03ececb849688a1c843c4de684a6d32923493f9d0af3d33b7b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276584,21 +274629,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_E428 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserverddkdriver_BE68 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "5eede083-38a6-50f5-b31e-a4880d4b4304"
+		id = "e6c367fc-e591-51ff-aadf-a597d0b5ac04"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6762-L6781"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "be683cd38e64280567c59f7dc0a45570abcb8a75f1d894853bbbd25675b4adf7"
-		logic_hash = "6fc3676bace692d3c83f0ccebe39be7d9dec3965935a8cf8971594fd6c206b90"
+		logic_hash = "v1_sha256_6fc3676bace692d3c83f0ccebe39be7d9dec3965935a8cf8971594fd6c206b90"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276614,21 +274659,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_0909 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "e1be6d99-bee6-5208-976b-04a2fde0602b"
+		id = "36bc2cdf-4e6e-50bb-8716-457224e01f3e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6784-L6803"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06"
-		logic_hash = "f224ce42de29a91805c38c230c5b311878339c20d18bcd482b5738f246b12cbc"
+		logic_hash = "v1_sha256_f224ce42de29a91805c38c230c5b311878339c20d18bcd482b5738f246b12cbc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276644,14 +274689,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_0909 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_3CB1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "0f9615f9-4cb9-5be7-bc88-4965e143da3e"
+		id = "ddad007e-2af0-5cf3-ae86-b7e708371443"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276659,7 +274704,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3cb111fdedc32f2f253aacde4372b710035c8652eb3586553652477a521c9284"
 		hash = "9bfd24947052bfe9f2979113a7941e40bd7e3a82eaa081a32ad4064159f07c91"
-		logic_hash = "cb6f7a26f4564d7a60a8dee25f5018fd4f3b4decfef6dfdb0d0b2f1df982adf7"
+		logic_hash = "v1_sha256_cb6f7a26f4564d7a60a8dee25f5018fd4f3b4decfef6dfdb0d0b2f1df982adf7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276675,21 +274720,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Watchdogdevelopmentcomllc_Wsdkdsys_Wsdkd_6278 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wsdkd.sys"
 		author = "Florian Roth"
-		id = "4beb5c5a-5bdf-513e-9d43-00c30289eddb"
+		id = "7d5a51ed-ad60-5c78-903e-2847aad2a07f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6829-L6848"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6278bc785113831b2ec3368e2c9c9e89e8aca49085a59d8d38dac651471d6440"
-		logic_hash = "3df6c8424981c50e765d8730f702b2a541b4e7312eea2ae27518d0958531f3e0"
+		logic_hash = "v1_sha256_3df6c8424981c50e765d8730f702b2a541b4e7312eea2ae27518d0958531f3e0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276705,14 +274750,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Watchdogdevelopmentcomllc_Wsdkdsys_Wsdkd_6278 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Huawei_Hwosec_Huaweimatebook_B179 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwOs2Ec7x64.sys"
 		author = "Florian Roth"
-		id = "7fdaa5bb-7874-51cc-90a0-d718b5ad7ac8"
+		id = "3939f8dd-5678-5727-9d61-043b274f44ec"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276720,7 +274765,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Huawei_Hwosec_Huaweimatebook_B179 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de"
 		hash = "bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc"
-		logic_hash = "6c35f9cdd6d48a5804a95bbfd15564e1b9d145b121a72df7fe345ede0c2eed26"
+		logic_hash = "v1_sha256_6c35f9cdd6d48a5804a95bbfd15564e1b9d145b121a72df7fe345ede0c2eed26"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276736,21 +274781,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Huawei_Hwosec_Huaweimatebook_B179 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310036 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
 		author = "Florian Roth"
-		id = "ee20509d-fdf5-5c5a-8f49-5392c6f015ad"
+		id = "44f792c4-2364-5aed-b0c7-324b8eb3b27f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6874-L6892"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9"
-		logic_hash = "a1e7828c2e39afe4279e6c9b5d34263478919336ed6b7d01bb45b1fdb2032878"
+		logic_hash = "v1_sha256_a1e7828c2e39afe4279e6c9b5d34263478919336ed6b7d01bb45b1fdb2032878"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276765,21 +274810,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468 : FILE
 		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_7661 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "cf60dd6e-f13e-5498-b3e1-b28c4b469f10"
+		id = "ae51f6f7-e792-5b6b-ae55-3a0221d0bf93"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6895-L6911"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a"
-		logic_hash = "8428303996166eb968534f192a1e15cc374ed412b8915b41a323fcf6d8bd238c"
+		logic_hash = "v1_sha256_8428303996166eb968534f192a1e15cc374ed412b8915b41a323fcf6d8bd238c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276792,21 +274837,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_7661 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_8B92 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
 		author = "Florian Roth"
-		id = "158dd78f-3665-59d6-8528-f4489791d55e"
+		id = "b0044384-fba9-5545-a636-b4260112c4eb"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6914-L6933"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2"
-		logic_hash = "565bd93231c1cffbb52efc9fedae7c41593ba93a2540dadf199806793359f67d"
+		logic_hash = "v1_sha256_565bd93231c1cffbb52efc9fedae7c41593ba93a2540dadf199806793359f67d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276822,21 +274867,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_881B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA.sys"
 		author = "Florian Roth"
-		id = "926f0aef-ede3-554e-874d-7b617efbf2bd"
+		id = "20a097de-ec32-55af-8ad3-24c4ad6724b3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6936-L6955"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461"
-		logic_hash = "0d1427a94c21e7055a8d3d1e23e0ee3c513030530c15778eed40283979dba6f9"
+		logic_hash = "v1_sha256_0d1427a94c21e7055a8d3d1e23e0ee3c513030530c15778eed40283979dba6f9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276852,21 +274897,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_881B : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300035002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5192 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "63cc2959-9cfa-575d-894f-fbb63349a4e7"
+		id = "2b3f308b-a637-5e17-97aa-7e2e060b9a55"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L6958-L6977"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b"
-		logic_hash = "39194a4e7085e17fef079075949360155d6ce279e3bc1a92f1b3a12b70e7f15c"
+		logic_hash = "v1_sha256_39194a4e7085e17fef079075949360155d6ce279e3bc1a92f1b3a12b70e7f15c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276882,14 +274927,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5192 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinchardwaremanagerdriver_0F30 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
 		author = "Florian Roth"
-		id = "17bc5473-e539-503d-8805-957c4384a0d7"
+		id = "486e0beb-c0ba-580e-a648-e33b2e570e66"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -276897,7 +274942,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinch
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0f30ecd4faec147a2335a4fc031c8a1ac9310c35339ebeb651eb1429421951a0"
 		hash = "903d6d71da64566b1d9c32d4fb1a1491e9f91006ad2281bb91d4f1ee9567ef7b"
-		logic_hash = "09782a4b713c385896e9793c7fe4771ad00b8736e44c2639f94239751cf17222"
+		logic_hash = "v1_sha256_09782a4b713c385896e9793c7fe4771ad00b8736e44c2639f94239751cf17222"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276913,21 +274958,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinch
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0032003000300032002d0032003000300039002000520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e0020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftware_Insydeflash_Insydeflashutilitybitdriver_CE0A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iscflashx64.sys"
 		author = "Florian Roth"
-		id = "76578c75-a19c-54b1-b956-c26b8fe6e4ad"
+		id = "d73850b6-f6cf-517f-b401-b25e4e8a4974"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7003-L7022"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ce0a4430d090ba2f1b46abeaae0cb5fd176ac39a236888fa363bf6f9fd6036d9"
-		logic_hash = "ba20c0a151a7e6ef4c2e70426cf4132d9c30f40b6a91e4402e20d15201b6c56e"
+		logic_hash = "v1_sha256_ba20c0a151a7e6ef4c2e70426cf4132d9c30f40b6a91e4402e20d15201b6c56e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276943,21 +274988,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftware_Insydeflash_Insydeflashutilitybit
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003500200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_80A5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "80e3827b-44e7-5b59-a7db-c7daf0e38664"
+		id = "c18d296b-8023-5832-9fd4-5afc7f5c7fb9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7025-L7044"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085"
-		logic_hash = "f736ac96f1efde446400aaa49fba7cc84a0a10b3425561f67811da86dbee14a8"
+		logic_hash = "v1_sha256_f736ac96f1efde446400aaa49fba7cc84a0a10b3425561f67811da86dbee14a8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -276973,21 +275018,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_80A5 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Microfocus_Microfocusxtier_5351 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
 		author = "Florian Roth"
-		id = "e2d580c9-79e6-53f1-ab4a-77e2715b6f91"
+		id = "a1ecee9f-c5f5-5199-8af8-0a94c47623cb"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7047-L7065"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c"
-		logic_hash = "efbf3fd36c3ca5c2b95796cdaefb175ad1957866649e73366a1d6810cbcb5e81"
+		logic_hash = "v1_sha256_efbf3fd36c3ca5c2b95796cdaefb175ad1957866649e73366a1d6810cbcb5e81"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277002,14 +275047,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Microfocus_Microfocusxtier_5351 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7882 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxdrv.sys"
 		author = "Florian Roth"
-		id = "c367a41e-58e4-59cd-a3f4-dfcd001e7040"
+		id = "836b1204-c005-555e-8b6c-8b9fd2e10eea"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -277017,7 +275062,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_78
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f"
 		hash = "c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924"
-		logic_hash = "5e95853e7a2013132a6565b5908475e6369a56ff6c58f0e10c875b72b15b2523"
+		logic_hash = "v1_sha256_5e95853e7a2013132a6565b5908475e6369a56ff6c58f0e10c875b72b15b2523"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277033,14 +275078,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_78
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_5FAD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
 		author = "Florian Roth"
-		id = "95bb049c-cef2-5235-8e3d-ebe9591b7e27"
+		id = "eaf24cf2-7b4f-5643-982a-0b29019ebd4a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -277048,7 +275093,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36"
 		hash = "29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6"
-		logic_hash = "5dc9ec007f318b16034b43248be9807c024780aa58eb714982130656e7f2b6a6"
+		logic_hash = "v1_sha256_5dc9ec007f318b16034b43248be9807c024780aa58eb714982130656e7f2b6a6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277064,14 +275109,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_16E2 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
 		author = "Florian Roth"
-		id = "8c1ee58c-e03e-55dd-a1ff-bc03594778ae"
+		id = "5a452c01-7f13-5861-8017-e846ffb64e2f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -277079,7 +275124,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_16E2 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "16e2b071991b470a76dff4b6312d3c7e2133ad9ac4b6a62dda4e32281952fb23"
 		hash = "0c925468c3376458d0e1ec65e097bd1a81a03901035c0195e8f6ef904ef3f901"
-		logic_hash = "162cf712c505520635388ec61c69165a2fff8704c7edef58c63cc8cbcc624e0d"
+		logic_hash = "v1_sha256_162cf712c505520635388ec61c69165a2fff8704c7edef58c63cc8cbcc624e0d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277095,14 +275140,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_16E2 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_060D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "3efdeeef-8fe7-57a7-9424-505b46fb75e4"
+		id = "df742850-e4b6-5d11-8b97-39811386aa97"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -277110,7 +275155,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "060d25126e45309414b380ee29f900840b689eae4217a8e621563f130c1d457f"
 		hash = "b8321471be85dc8a67ac18a2460cab50e7c41cb47252f9a7278b1e69d6970f25"
-		logic_hash = "f7a87edc0403a7b8273256805bb8c7aadadde8143db84be9b3968ef67cf3c1c4"
+		logic_hash = "v1_sha256_f7a87edc0403a7b8273256805bb8c7aadadde8143db84be9b3968ef67cf3c1c4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277126,14 +275171,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_7553 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "9880d118-943b-5532-8e6a-22f0a9d9b255"
+		id = "6227660d-cdc4-514e-9014-a6dd731be9bf"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -277141,7 +275186,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_7553 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7553c76b006bd2c75af4e4ee00a02279d3f1f5d691e7dbdc955eac46fd3614c3"
 		hash = "64dddd5ac53fe2c9de2b317c09034d1bccaf21d6c03ccfde3518e5aa3623dd66"
-		logic_hash = "e60b387fe83bffdd1411f3b8fb491f0b60ff0de3eac87c9c5ee8c55ca6c48afc"
+		logic_hash = "v1_sha256_e60b387fe83bffdd1411f3b8fb491f0b60ff0de3eac87c9c5ee8c55ca6c48afc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277157,14 +275202,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_7553 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100390020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Overclockingtool_Atillksys_Overclockingtool_11A9 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atillk64.sys"
 		author = "Florian Roth"
-		id = "9b7e6787-abbf-5bfb-a833-a0b078566ed7"
+		id = "d69cee95-2073-5251-a56e-8e75fa221a3a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -277172,7 +275217,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Overclockingtool_Atillksys_Overclockingtool_11A9
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "11a9787831ac4f0657aeb5e7019c23acc39d8833faf28f85bd10d7590ea4cc5f"
 		hash = "d2182b6ef3255c7c1a69223cd3c2d68eb8ba3112ce433cd49cd803dc76412d4b"
-		logic_hash = "07b8fb1b1b86b58a6fb7f18f3b1b70eee5826fa5c629a8cef1b97afbae7ea7c3"
+		logic_hash = "v1_sha256_07b8fb1b1b86b58a6fb7f18f3b1b70eee5826fa5c629a8cef1b97afbae7ea7c3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277188,21 +275233,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Overclockingtool_Atillksys_Overclockingtool_11A9
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002c00200032003000300035 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2A62 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
 		author = "Florian Roth"
-		id = "7c67b2a6-a2da-56ce-8ed4-017838ea7673"
+		id = "53901741-8c99-5239-be62-811f2a3dc855"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7206-L7225"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8"
-		logic_hash = "5fae0a4ba7d11e3714baab3417a1bdd9fff6275fa9347c0389d8627374533bbf"
+		logic_hash = "v1_sha256_5fae0a4ba7d11e3714baab3417a1bdd9fff6275fa9347c0389d8627374533bbf"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277218,21 +275263,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2A62 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_AAA3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "9b0770d3-d004-552f-be65-6dcc14f06cc7"
+		id = "79bddb71-e594-534d-9320-60a70602a084"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7228-L7247"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c"
-		logic_hash = "bb87661658fa874985bbe1050c19eb8ea9136ec62c224d53cd4920866e6a6b1f"
+		logic_hash = "v1_sha256_bb87661658fa874985bbe1050c19eb8ea9136ec62c224d53cd4920866e6a6b1f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277248,21 +275293,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_AAA3 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswvmmsys_Avastantivirus_3650 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswVmm.sys"
 		author = "Florian Roth"
-		id = "1b3abcb0-5317-58f0-bb7a-6bc1996483fa"
+		id = "8c297ed0-45f6-5f57-b263-67203c4f48b3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7250-L7269"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10"
-		logic_hash = "afe8e12664ee9061c2b2ecdcaaef0c38ece604d050e31b46208f9a22545042ca"
+		logic_hash = "v1_sha256_afe8e12664ee9061c2b2ecdcaaef0c38ece604d050e31b46208f9a22545042ca"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277278,21 +275323,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswvmmsys_Avastantivirus_3650 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003300200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gdrv_FF67 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
 		author = "Florian Roth"
-		id = "b5062d65-a4bc-5d0e-9883-7c1fa54138e8"
+		id = "bcb342e0-3326-52b0-ad66-accbb7b1aea4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7272-L7291"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339"
-		logic_hash = "18c40b7312d0b65d83287e452e8b9429eaed36245d17ef1b82ec04a968303a39"
+		logic_hash = "v1_sha256_18c40b7312d0b65d83287e452e8b9429eaed36245d17ef1b82ec04a968303a39"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277308,21 +275353,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gdrv_FF67 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_4408 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "d5bbf94d-394a-599e-93f3-6f9d79cca02f"
+		id = "ea33b41d-3612-5288-bdf3-d0af6bc6ae25"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7294-L7313"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
-		logic_hash = "b038dcb0a536e16d71035d11537757f529589a435616abacd94aadd5663c2a17"
+		logic_hash = "v1_sha256_b038dcb0a536e16d71035d11537757f529589a435616abacd94aadd5663c2a17"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277338,21 +275383,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_B583 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo10X64.sys"
 		author = "Florian Roth"
-		id = "eff26fc8-a458-5c15-8a0b-86773f8f6289"
+		id = "ad5e1354-692e-5a72-a7a1-aa0c1aa62f6a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7316-L7335"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704"
-		logic_hash = "d4f37a4c7014694cfcf57c11ee9d41edec1b6fa77a564341663c3411764dbcda"
+		logic_hash = "v1_sha256_d4f37a4c7014694cfcf57c11ee9d41edec1b6fa77a564341663c3411764dbcda"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277368,21 +275413,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontro
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_3D00 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "1ffe9a5e-5cdc-5db4-8247-e9726ee15428"
+		id = "a5dfecf5-009e-5b55-a17c-3edae7dac81a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7338-L7357"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3d008e636e74c846fe7c00f90089ff725561cb3d49ce3253f2bbfbc939bbfcb2"
-		logic_hash = "d52c104de520b575b404d320a8ec762a146da8cc0567b5f30dc8594b7a1742ef"
+		logic_hash = "v1_sha256_d52c104de520b575b404d320a8ec762a146da8cc0567b5f30dc8594b7a1742ef"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277398,21 +275443,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_ED2F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "288ce092-a3f2-57d0-9d28-a0c4b6faa52f"
+		id = "df48d574-6cbb-5a5d-a4ed-af067bec9a1b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7360-L7379"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39"
-		logic_hash = "1da8ef4d1877ba9d2c31d994735f6395367de990be6c875c0cba37654ee39ad3"
+		logic_hash = "v1_sha256_1da8ef4d1877ba9d2c31d994735f6395367de990be6c875c0cba37654ee39ad3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277428,21 +275473,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_ED2F : F
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolib_09BE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "30b7487c-d5b7-52b1-a209-f6eb01f0f406"
+		id = "065693c2-0879-53e2-921a-85e5d9884a01"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7382-L7401"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1"
-		logic_hash = "23f5a77bae75d686a980e65dd6efe4ad216a60d75631fed169a83cc88d64675e"
+		logic_hash = "v1_sha256_23f5a77bae75d686a980e65dd6efe4ad216a60d75631fed169a83cc88d64675e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277458,21 +275503,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolib_09BE : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_A802 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "9cb0be23-e1d9-5698-bde2-81a870f81f83"
+		id = "752abddd-5171-5ae8-987a-156020619a87"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7404-L7423"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e"
-		logic_hash = "8ef06932883bbd5ad62bd5d975fb341277a83271f7a21fc77cdebc6b9f4a05a6"
+		logic_hash = "v1_sha256_8ef06932883bbd5ad62bd5d975fb341277a83271f7a21fc77cdebc6b9f4a05a6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277488,21 +275533,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_A802 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0F01 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "0328757c-e561-567c-b7ad-7e6bcba19bb5"
+		id = "980e59fc-88fa-5c20-b0e1-85d21c2d8e1a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7426-L7445"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8"
-		logic_hash = "014039b9b1b4ea903b4c014ca3d3ff946b1b0f4759d8d78c1fcf825d11318e42"
+		logic_hash = "v1_sha256_014039b9b1b4ea903b4c014ca3d3ff946b1b0f4759d8d78c1fcf825d11318e42"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277518,21 +275563,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7539 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
 		author = "Florian Roth"
-		id = "5ccaf486-04c4-5066-b307-e76b6e484d01"
+		id = "8edbc73b-716e-5f35-8eee-712f4adbe94b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7448-L7467"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c"
-		logic_hash = "dd40b144e403136b4359106d2efeb24335b83ffc13a62fdce7c9bd602dc45506"
+		logic_hash = "v1_sha256_dd40b144e403136b4359106d2efeb24335b83ffc13a62fdce7c9bd602dc45506"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277548,21 +275593,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_75
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxc_1183 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CP2X72C.SYS"
 		author = "Florian Roth"
-		id = "cd8eccb8-d106-514c-8b92-7d5016d9a182"
+		id = "bd3354d7-34a6-5240-8350-3fa099e6e465"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7470-L7489"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "11832c345e9898c4f74d3bf8f126cf84b4b1a66ad36135e15d103dbf2ac17359"
-		logic_hash = "5842fcb278bb2b659760677fea80cbb110347e495e9f1a39fc901f0927753b88"
+		logic_hash = "v1_sha256_5842fcb278bb2b659760677fea80cbb110347e495e9f1a39fc901f0927753b88"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277578,21 +275623,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxc_1183 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000300031002c0020003200300030003700200049006e007400650072006600610063006500200043006f00720070002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_478D : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "13ee4d76-b778-593e-85e6-8402d01352e8"
+		id = "d3ecdce9-9b3e-5c82-808f-b3f12e5bec01"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7492-L7511"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0"
-		logic_hash = "29a09ee10d391b3183052255622f7b96a0e2bf649acc30e10d57e1cb3b17b84f"
+		logic_hash = "v1_sha256_29a09ee10d391b3183052255622f7b96a0e2bf649acc30e10d57e1cb3b17b84f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277608,21 +275653,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_478D : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Activeclean_A903 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "3142d323-869f-5e25-b860-da2c34f659ce"
+		id = "6e8f717e-cefa-51eb-9386-7125a22e9288"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7514-L7533"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e"
-		logic_hash = "b79d850df65fa7a96642e4a1da2240e001c87d44d64c621c756face489c0eb6b"
+		logic_hash = "v1_sha256_b79d850df65fa7a96642e4a1da2240e001c87d44d64c621c756face489c0eb6b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277638,14 +275683,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Activeclean_A903 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_3FF3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "ce58b5cb-437a-56b2-8ccb-9399ce2ef6c3"
+		id = "8f7473b8-a1cd-51d8-a751-7795564cec0c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -277653,7 +275698,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa"
 		hash = "86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675"
-		logic_hash = "3035342ffaf651efc8de23d2da68540ee7d89b2bf2b5c2925094e7fe2a3f7c28"
+		logic_hash = "v1_sha256_3035342ffaf651efc8de23d2da68540ee7d89b2bf2b5c2925094e7fe2a3f7c28"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277669,21 +275714,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_1B17 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "f9c35fdf-7048-53b3-bff2-b30f283eadc6"
+		id = "a2cda3b2-aadc-557b-9b3b-9618a1f43d09"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7559-L7578"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1b17d12076d047e74d15e6e51e10497ad49419bec7fbe93386c57d3efbaadc0b"
-		logic_hash = "cd8e28cc91da2da748b449b175c24f7271019fa6e9b475b8689183eb1866c59a"
+		logic_hash = "v1_sha256_cd8e28cc91da2da748b449b175c24f7271019fa6e9b475b8689183eb1866c59a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277699,21 +275744,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_1B17 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_6CF1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
 		author = "Florian Roth"
-		id = "4226b41f-4828-558b-b990-fd63dbc5b2e3"
+		id = "02debf9c-c224-58c5-b46a-59597a881a23"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7581-L7599"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6cf1cac0e97d30bb445b710fd8513879678a8b07be95d309cbf29e9b328ff259"
-		logic_hash = "60fcd09b5ad2beef9a28c78590e6a935b5a2818db45175960527285a4a765ea5"
+		logic_hash = "v1_sha256_60fcd09b5ad2beef9a28c78590e6a935b5a2818db45175960527285a4a765ea5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277728,21 +275773,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_6CF1 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310030002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_EAE5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
 		author = "Florian Roth"
-		id = "bd54bf19-8af7-5afb-b861-e1ecb145ca1a"
+		id = "6371737e-7afd-5517-ba22-77a885545d6d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7602-L7621"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "eae5c993b250dcc5fee01deeb30045b0e5ee7cf9306ef6edd8c58e4dc743a8ed"
-		logic_hash = "ea0bb86a2cc5f3349678d9a698e14301207ba1bf6c19f9caf91abd72e7794a8c"
+		logic_hash = "v1_sha256_ea0bb86a2cc5f3349678d9a698e14301207ba1bf6c19f9caf91abd72e7794a8c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277758,21 +275803,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_EAE5 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300032002d0032003000310034002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BDBC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "a101f69b-ca19-5aeb-a168-1a10dbd6ec12"
+		id = "06789e44-0259-5dd5-aaf1-67749cf33b73"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7624-L7643"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c"
-		logic_hash = "c4310d622e5861f4c63d9e9c39ee94acbfb35d24a91f50158f1d695d1f0cf254"
+		logic_hash = "v1_sha256_c4310d622e5861f4c63d9e9c39ee94acbfb35d24a91f50158f1d695d1f0cf254"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277788,21 +275833,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300037 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Databaseharborsoftware_Sysinfodetectorxsys_Sysinfodetector_45E5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SysInfoDetectorX64.sys"
 		author = "Florian Roth"
-		id = "5d65c0b6-176b-5c11-996d-2caae24c95af"
+		id = "ead65fa3-faab-57fa-984f-76e05a61fa02"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7646-L7665"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "45e5977b8d5baec776eb2e62a84981a8e46f6ce17947c9a76fa1f955dc547271"
-		logic_hash = "3c67bbee00427b7f8ed689a5ff83641bad2b62dc685b5155ea81f6dbba4377b0"
+		logic_hash = "v1_sha256_3c67bbee00427b7f8ed689a5ff83641bad2b62dc685b5155ea81f6dbba4377b0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277818,14 +275863,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Databaseharborsoftware_Sysinfodetectorxsys_Sysin
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003400200044006100740061006200610073006500200048006100720062006f007200200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7048 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "adc55873-9711-5304-97d4-037174c036ff"
+		id = "8cbc317d-26a4-5c31-9244-d5933984e9e0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -277834,7 +275879,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7048 : FILE
 		hash = "7048d90ed4c83ad52eb9c677f615627b32815066e34230c3b407ebb01279bae6"
 		hash = "d80714d87529bb0bc7abcc12d768c43a697fbca59741c38fa0b46900da4db30e"
 		hash = "fed0fe2489ae807913be33827b3b11359652a127e33b64464cc570c05abd0d17"
-		logic_hash = "2768d499d0f387278553c77bd313337202b107474d44e41b8b59b22254680637"
+		logic_hash = "v1_sha256_2768d499d0f387278553c77bd313337202b107474d44e41b8b59b22254680637"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277850,21 +275895,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7048 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003600200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7837 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "47963173-d9a8-5a16-9959-d99e6e8920f3"
+		id = "5302c765-1611-5bc1-ab69-73aba8a84cf4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7692-L7711"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408"
-		logic_hash = "0d0e3e2675e5d6b11369a388a6e7a947e603db2562aefb802c977728419bb667"
+		logic_hash = "v1_sha256_0d0e3e2675e5d6b11369a388a6e7a947e603db2562aefb802c977728419bb667"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277880,21 +275925,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7837 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantimalwaredriver_E505 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Tmel.sys"
 		author = "Florian Roth"
-		id = "03f8b653-0ecc-5161-935e-5f670fd54bb1"
+		id = "261074ce-3752-570e-8725-d7a269a6eccf"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7714-L7733"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e505569892551b2ba79d8792badff0a41faea033e8d8f85c3afea33463c70bd9"
-		logic_hash = "7645c180f10ba31e259cdfa4904c16941ce777412416527c95fa9592ed76da8c"
+		logic_hash = "v1_sha256_7645c180f10ba31e259cdfa4904c16941ce777412416527c95fa9592ed76da8c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277910,21 +275955,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantim
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhardwaremanagerdriver_Dev_DF96 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
 		author = "Florian Roth"
-		id = "e5a0a70b-13ea-584f-a7f8-387ca23b9ecd"
+		id = "3dde3830-6f15-58bf-b677-5021108fdf85"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7736-L7755"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "df96d844b967d404e58a12fc57487abc24cd3bd1f8417acfe1ce1ee4a0b0b858"
-		logic_hash = "2194da0b4589893a0884b9a8c0ed5a556b008152b9c03613074892001406fc21"
+		logic_hash = "v1_sha256_2194da0b4589893a0884b9a8c0ed5a556b008152b9c03613074892001406fc21"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277940,21 +275985,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhardwar
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d00320030003100370020004e0043005200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0B2A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "9e448b85-4455-5a80-9147-e6c83b1427aa"
+		id = "b965c6dd-e349-5881-b284-c6f106e16660"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7758-L7777"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d"
-		logic_hash = "e4e6178a894262ed52bd5ee6e0879f54d4cb81ec467f065f0b00d34ac55064b0"
+		logic_hash = "v1_sha256_e4e6178a894262ed52bd5ee6e0879f54d4cb81ec467f065f0b00d34ac55064b0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -277970,21 +276015,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_BA40 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
 		author = "Florian Roth"
-		id = "a932bccb-6c13-5d78-afab-ecca0d072815"
+		id = "de40c84a-c331-5b89-8e30-c55526740029"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7780-L7799"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ba40b1fc798c2f78165e78997b4baf3d99858ee39a372ca6fbc303057793e50d"
-		logic_hash = "ea4d6b524d8e4229b090890145a02617482c38ae077d5fd9a7fd46fa6e917b1a"
+		logic_hash = "v1_sha256_ea4d6b524d8e4229b090890145a02617482c38ae077d5fd9a7fd46fa6e917b1a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278000,21 +276045,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_BA40 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300032002d0032003000310034002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_828A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "0ff55ef5-4de8-53e9-b10e-2c3eda501fa7"
+		id = "43b05f32-97ed-5373-ba96-939f254f32a7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7802-L7821"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "828a18b16418c021b6c4aa8c6d54cef4e815efca0d48b9ff14822f9ccb69dff2"
-		logic_hash = "e5eb524d77c082acac68ea7b24bf10e445dd1afc9be97333980d8a8d580a6e98"
+		logic_hash = "v1_sha256_e5eb524d77c082acac68ea7b24bf10e445dd1afc9be97333980d8a8d580a6e98"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278030,21 +276075,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_828A : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbmonsys_Virtualboxusbmonitordriver_8A24 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxUSBMon.sys"
 		author = "Florian Roth"
-		id = "f1c042e9-1bbe-5a21-9a46-519c93cb7b2c"
+		id = "ae5debfc-eff4-579d-982f-1a1d73e486cd"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7824-L7843"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8a2482e19040d591c7cec5dfc35865596ce0154350b5c4e1c9eecc86e7752145"
-		logic_hash = "bf3569ba1652fc95c0752a4bf58586ecbe41db63d58ff6326cbd7ef6c2d5b65f"
+		logic_hash = "v1_sha256_bf3569ba1652fc95c0752a4bf58586ecbe41db63d58ff6326cbd7ef6c2d5b65f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278060,21 +276105,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbmonsys_Virtualboxusbmo
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Copyright_Advancedmalwareprotection_6F55 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amsdk.sys"
 		author = "Florian Roth"
-		id = "6eb82ac7-9544-5554-b7af-557dd843d29d"
+		id = "acfec69c-87d3-5cb5-8f17-9d04a918253f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7846-L7864"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c"
-		logic_hash = "4b5b303a3311ec88e1ebad890eb08fe3af13b3c6fdd7cf88421a9f7590661832"
+		logic_hash = "v1_sha256_4b5b303a3311ec88e1ebad890eb08fe3af13b3c6fdd7cf88421a9f7590661832"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278089,21 +276134,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Copyright_Advancedmalwareprotection_6F55 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000310038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_0DC4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "80f3a10e-1943-522d-a881-4e67bc908de3"
+		id = "d2d44715-a44d-58b6-814b-d63da2315155"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7867-L7886"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0dc4ff96d7e7db696e0391c5a1dda92a0b0aedbf1b0535bf5d62ebeec5b2311c"
-		logic_hash = "291aa7d4bd435f112fb6678d8b495d38df94b7a6256d71ac39dd055ab3c94719"
+		logic_hash = "v1_sha256_291aa7d4bd435f112fb6678d8b495d38df94b7a6256d71ac39dd055ab3c94719"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278119,14 +276164,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_0DC4 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003500200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_3670 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
 		author = "Florian Roth"
-		id = "0756f1e4-4cc4-5161-8792-c8b7cfe11965"
+		id = "f87b07e1-fc88-51be-90c9-70b3951c2425"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -278134,7 +276179,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_3670 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3670ccd9515d529bb31751fcd613066348057741adeaf0bffd1b9a54eb8baa76"
 		hash = "0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180"
-		logic_hash = "3ca3c8fe11a696ad5eaf4b806c277a903a665b3c16a5c8a86dbf8468a71ad9ee"
+		logic_hash = "v1_sha256_3ca3c8fe11a696ad5eaf4b806c277a903a665b3c16a5c8a86dbf8468a71ad9ee"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278150,21 +276195,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_3670 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300032002d0032003000310037002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_EEA5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "2942b5b0-7270-5b7a-98f7-beee11e7aa57"
+		id = "66457299-c4d9-52ef-9ade-bcb049ed045e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7912-L7931"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
-		logic_hash = "47bcbc01fc9d12d72613093da34efd44b9d45af700a83450e36aed9fa972ae9b"
+		logic_hash = "v1_sha256_47bcbc01fc9d12d72613093da34efd44b9d45af700a83450e36aed9fa972ae9b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278180,21 +276225,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_EEA5 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9CA5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "41660c6a-2c4c-5362-94cc-f701eb939870"
+		id = "9fa312aa-97b8-5bc6-917d-6a9fae262c3b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7934-L7953"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9ca586b49135166eea00c6f83329a2d134152e0e9423822a51c13394265b6340"
-		logic_hash = "a666e2b5c53129dc1f82a945d828bb84fc31e54c1c69cc6666222e4b9a45ea39"
+		logic_hash = "v1_sha256_a666e2b5c53129dc1f82a945d828bb84fc31e54c1c69cc6666222e4b9a45ea39"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278210,21 +276255,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9CA5 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4E54 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "d6f57b92-e6fe-5723-9fbf-ee7ccc3aa5a2"
+		id = "a0252b4b-b290-5c97-b092-6571fc61b363"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7956-L7975"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4e54e98df13110aac41f3207e400cce2a00df29ce18c32186e536c1de25a75ce"
-		logic_hash = "81a80cb4cdeb79ba7b32cb981c4f6d986fc465a78566aded7d7bf3f06e3e027f"
+		logic_hash = "v1_sha256_81a80cb4cdeb79ba7b32cb981c4f6d986fc465a78566aded7d7bf3f06e3e027f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278240,21 +276285,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4E54 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003000390020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_2D2C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "f2aefc0c-b851-5341-acee-20d02c838548"
+		id = "59c25307-9533-5155-a248-c1ef4ce10514"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L7978-L7997"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b"
-		logic_hash = "991c554b098cc048d925ab989b0ca3950b07fd13e75ddcc0e8d8f4e24f6e58a6"
+		logic_hash = "v1_sha256_991c554b098cc048d925ab989b0ca3950b07fd13e75ddcc0e8d8f4e24f6e58a6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278270,21 +276315,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_2D2C : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003200200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_F4EE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx64.sys"
 		author = "Florian Roth"
-		id = "efacff94-b2cd-55b8-94ef-076b29aba00d"
+		id = "93a15d9a-9dc9-51bd-b0e7-a286439bfc81"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8000-L8019"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f4ee803eefdb4eaeedb3024c3516f1f9a202c77f4870d6b74356bbde32b3b560"
-		logic_hash = "7ad25b1c03c5f7aff57f6ae40fae6232a0649d643a4ccd6ed1eee886bfad7f68"
+		logic_hash = "v1_sha256_7ad25b1c03c5f7aff57f6ae40fae6232a0649d643a4ccd6ed1eee886bfad7f68"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278300,21 +276345,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_F4EE : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5CFA : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "a563b3de-1a05-55bf-ae93-03e84ef1cb26"
+		id = "23b1ddd6-9722-51ea-beb1-60dfb81b8234"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8022-L8041"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185"
-		logic_hash = "772f33e1190458ffbe4f6636fc775fea47d4ab242cecc5a77d00ee34de4ecf86"
+		logic_hash = "v1_sha256_772f33e1190458ffbe4f6636fc775fea47d4ab242cecc5a77d00ee34de4ecf86"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278330,14 +276375,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5CFA : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_898E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "fc239233-68cc-5e0c-94b3-fa78f95998b1"
+		id = "adeaa3c8-55d0-5930-b7dd-c99ca1b7341e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -278345,7 +276390,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_898E : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "898e07cf276ec2090b3e7ca7c192cc0fa10d6f13d989ef1cb5826ca9ce25b289"
 		hash = "07d0090c76155318e78a676e2f8af1500c20aaa1e84f047c674d5f990f5a09c8"
-		logic_hash = "8895375f8ce3efa2fec38f6b42d4401b64d5dbde4c1bd9eead31ecb442f72588"
+		logic_hash = "v1_sha256_8895375f8ce3efa2fec38f6b42d4401b64d5dbde4c1bd9eead31ecb442f72588"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278361,14 +276406,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_898E : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003100300020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_AFDA : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "9a6e76da-aff1-5944-a5ce-a056f3f013c4"
+		id = "6a6ebfd3-269f-5906-9751-3911dc5150c0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -278376,7 +276421,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "afda5af5f210336061bff0fab0ed93ee495312bed639ec5db56fbac0ea8247d3"
 		hash = "b2364c3cf230648dad30952701aef90acfc9891541c7e154e30c9750da213ed1"
-		logic_hash = "c969121df4f2e873fbff32b00484550a8a80e4fcc0cd093a2c93c566c249977a"
+		logic_hash = "v1_sha256_c969121df4f2e873fbff32b00484550a8a80e4fcc0cd093a2c93c566c249977a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278392,14 +276437,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_6386 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CP2X72C.SYS"
 		author = "Florian Roth"
-		id = "b6d09923-9ea3-56a0-9692-ee2cf00545e7"
+		id = "3e9ede7c-1ece-57ea-91cd-926621513a55"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -278407,7 +276452,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_6
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "63865f04c1150655817ed4c9f56ad9f637d41ebd2965b6127fc7c02757a7800e"
 		hash = "9c8ed1506b3e35f5eea6ac539e286d46ef76ddbfdfc5406390fd2157c762ce91"
-		logic_hash = "ceae34b4cd1698fc1d779b5860437b1017401c8f954d74804fcdbb13a5603186"
+		logic_hash = "v1_sha256_ceae34b4cd1698fc1d779b5860437b1017401c8f954d74804fcdbb13a5603186"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278423,14 +276468,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_6
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000300031002c0020003200300031003400200049006e007400650072006600610063006500200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_C490 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
 		author = "Florian Roth"
-		id = "054d4045-5d8d-5bd9-aaba-3a0cbef517af"
+		id = "0ad1adda-80c7-5d31-9a8f-31cc383c1c3f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -278439,7 +276484,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_
 		hash = "c490d6c0844f59fdb4aa850a06e283fbf5e5b6ac20ff42ead03d549d8ae1c01b"
 		hash = "a29093d4d708185ba8be35709113fb42e402bbfbf2960d3e00fd7c759ef0b94e"
 		hash = "e3dbafce5ad2bf17446d0f853aeedf58cc25aa1080ab97e22375a1022d6acb16"
-		logic_hash = "380ba354000358c8d9035f44b83c14b2d38bdfafbba7cc8b33d190884d43874a"
+		logic_hash = "v1_sha256_380ba354000358c8d9035f44b83c14b2d38bdfafbba7cc8b33d190884d43874a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278455,21 +276500,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_119C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
 		author = "Florian Roth"
-		id = "abb75d3f-eeb2-5ae7-976a-3f9e8627d6ca"
+		id = "a9e71f16-8f4d-5867-9ab8-ec8db7258954"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8137-L8156"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280"
-		logic_hash = "1ff636a8954a5f049c582d8436111ffe5a4e89e3f38870c9c8ac9706f0b1acd2"
+		logic_hash = "v1_sha256_1ff636a8954a5f049c582d8436111ffe5a4e89e3f38870c9c8ac9706f0b1acd2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278485,21 +276530,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_119C : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300031003900200041007200740068007500720020004c0069006200650072006d0061006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_263E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
 		author = "Florian Roth"
-		id = "2ff1ee8e-cd67-58e7-b301-e1f7712b6031"
+		id = "d6ee4463-b6f0-5070-aaa4-2a62d5409106"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8159-L8178"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24"
-		logic_hash = "c4a5f4e6908dcf3280adcebb9d8c58fb58be06267b524cb37f15d99091eb4a98"
+		logic_hash = "v1_sha256_c4a5f4e6908dcf3280adcebb9d8c58fb58be06267b524cb37f15d99091eb4a98"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278515,21 +276560,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_263E : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100300020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_88FB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx64.sys"
 		author = "Florian Roth"
-		id = "b97c6cc0-76f2-56a2-9725-672ac9f6aa9b"
+		id = "728fa41e-5d99-5bb9-b283-7346d68d7d41"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8181-L8200"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "88fb0a846f52c3b680c695cd349bf56151a53a75a07b8b0b4fe026ab8aa0a9af"
-		logic_hash = "9c38d3552116177e73a66e56d3f53f8f50ed698a8747cbc59ccbee3cfec0db0d"
+		logic_hash = "v1_sha256_9c38d3552116177e73a66e56d3f53f8f50ed698a8747cbc59ccbee3cfec0db0d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278545,21 +276590,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_88FB : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_E839 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "8a7a82a3-f24e-5887-9d95-a997179616d9"
+		id = "da85ce40-84d9-5d23-81b6-e9cb0a306dcc"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8203-L8222"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa"
-		logic_hash = "452a3eeb969ca2a3145b1f525401490911aeec23b29e88395f33dddb693417d0"
+		logic_hash = "v1_sha256_452a3eeb969ca2a3145b1f525401490911aeec23b29e88395f33dddb693417d0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278575,21 +276620,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_E839 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Hilschergesellschaftfrsystemaoutomationmbh_Physmemsys_Physicalmemoryaccessdriver_C299 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - physmem.sys"
 		author = "Florian Roth"
-		id = "1759efbf-dabf-5790-a624-9e344884f98c"
+		id = "4b1585ca-6e06-5140-88ab-0a1fe68aaafe"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8225-L8244"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
-		logic_hash = "64d1a7c9772d6a627bd2cec5c466a2627fa28d4a640ebe7fac5b948a02f1ff2a"
+		logic_hash = "v1_sha256_64d1a7c9772d6a627bd2cec5c466a2627fa28d4a640ebe7fac5b948a02f1ff2a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278605,21 +276650,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hilschergesellschaftfrsystemaoutomationmbh_Physm
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_4CE8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
 		author = "Florian Roth"
-		id = "b9e35ec1-d960-5b7a-9461-93b206ded648"
+		id = "35379a79-4996-51e4-8152-5a08a0941fa3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8247-L8266"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4ce8583768720be90fae66eed3b6b4a8c7c64e033be53d4cd98246d6e06086d0"
-		logic_hash = "65d2d5a1727f55c5a09c2dac5472095b92316eaaabf6356224b175ffe6b7c5a3"
+		logic_hash = "v1_sha256_65d2d5a1727f55c5a09c2dac5472095b92316eaaabf6356224b175ffe6b7c5a3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278635,21 +276680,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_4CE8 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300030002d0032003000310031002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_AF10 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
 		author = "Florian Roth"
-		id = "f80640c2-ec8d-5350-ba26-4dc6974816f2"
+		id = "e2f7daf5-0f4b-5a3d-b669-5aa1bc5ef54b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8269-L8288"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a"
-		logic_hash = "9fc3405f0415b37f348f5a7ea83344a60a9a987acfa844663811e834927f234a"
+		logic_hash = "v1_sha256_9fc3405f0415b37f348f5a7ea83344a60a9a987acfa844663811e834927f234a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278665,21 +276710,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_ADA4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "55ef1733-e9e8-5c60-8461-233e4fa4f0ae"
+		id = "b4eae4f0-9e53-59e1-9d82-e0603e4ae8f4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8291-L8310"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47"
-		logic_hash = "d102d9add684a93cec7f05196b3e3ca39ff470df7df1b5fd58001b460c0a2dfc"
+		logic_hash = "v1_sha256_d102d9add684a93cec7f05196b3e3ca39ff470df7df1b5fd58001b460c0a2dfc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278695,21 +276740,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_ADA4 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_9B2F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
 		author = "Florian Roth"
-		id = "d2e1c8d4-b8a7-5a0d-817a-f68ddda1c652"
+		id = "d81e9983-f03c-5d4b-b93c-be32b56f8c41"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8313-L8332"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285"
-		logic_hash = "156c30e23f3a22442c635c449290dfcfc5f02fb3b3a0a65f0966306bd1d71f7c"
+		logic_hash = "v1_sha256_156c30e23f3a22442c635c449290dfcfc5f02fb3b3a0a65f0966306bd1d71f7c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278725,14 +276770,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_9B2F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F629 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
 		author = "Florian Roth"
-		id = "05b5dc1a-9507-512f-9f1c-42cd36a2666f"
+		id = "18e79fdf-02e3-5f82-86ea-b8b771ccdc8a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -278740,7 +276785,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F629 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f62911334068c9edd44b9c3e8dee8155a0097aa331dd4566a61afa3549f35f65"
 		hash = "0cf91e8f64a7c98dbeab21597bd76723aee892ed8fa4ee44b09f9e75089308e2"
-		logic_hash = "b4ad3eedff5e41aa07d42c46dd5ef97ef281c049ed676e6b93474f21e20da428"
+		logic_hash = "v1_sha256_b4ad3eedff5e41aa07d42c46dd5ef97ef281c049ed676e6b93474f21e20da428"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278755,21 +276800,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F629 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310032002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cyreninc_Amp_Cyrenamp_CBB8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amp.sys"
 		author = "Florian Roth"
-		id = "a2b01649-d98b-5d99-9fb3-e9a648db62ad"
+		id = "4a2966d7-0b97-54e5-af61-d70556418f7b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8357-L8376"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6"
-		logic_hash = "79514ed74f7ca8fae3b4a36ae240d325fb70555cb8371e03a498b6fb9992b961"
+		logic_hash = "v1_sha256_79514ed74f7ca8fae3b4a36ae240d325fb70555cb8371e03a498b6fb9992b961"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278785,21 +276830,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cyreninc_Amp_Cyrenamp_CBB8 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000310039003900390020002d00200032003000310034002e00200043005900520045004e00200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersdkcom_Lgdcatchersys_Netfiltersdk_0C42 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LgDCatcher.sys"
 		author = "Florian Roth"
-		id = "3659a46f-25cf-5f9f-9ac5-578e2ffa6e45"
+		id = "92ec9951-692d-5540-8951-08d03941d71b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8379-L8398"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0c42fe45ffa9a9c36c87a7f01510a077da6340ffd86bf8509f02c6939da133c5"
-		logic_hash = "ca3a99d2b899c907450d0a975db142d391135f70d8f6e42f937e03e2b0c7a9ce"
+		logic_hash = "v1_sha256_ca3a99d2b899c907450d0a975db142d391135f70d8f6e42f937e03e2b0c7a9ce"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278815,21 +276860,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersdkcom_Lgdcatchersys_Netfiltersdk_0C42
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020003f0020004e0065007400460069006c00740065007200530044004b002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Supermicrocomputerinc_Superbmc_Superbmc_F843 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - superbmc.sys"
 		author = "Florian Roth"
-		id = "bf870b5d-ab2d-587d-a7ce-da7a02960d2c"
+		id = "60f7d602-2102-5584-8627-bc05e40ba9ce"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8401-L8420"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35"
-		logic_hash = "a628c561060c20f97c03b11be8c6d475b390d10ee7bf8dff9cc05600d68b8fc8"
+		logic_hash = "v1_sha256_a628c561060c20f97c03b11be8c6d475b390d10ee7bf8dff9cc05600d68b8fc8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278845,21 +276890,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Supermicrocomputerinc_Superbmc_Superbmc_F843 : F
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1023 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "45f59f43-b8eb-5c58-a386-a7bb19a88253"
+		id = "60308c6f-98d7-5076-ace6-96d2689ea450"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8423-L8442"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4"
-		logic_hash = "5dd553f7a90a5680d1a250a951e0166a526690dbef5fe431fa37347b3a5f2078"
+		logic_hash = "v1_sha256_5dd553f7a90a5680d1a250a951e0166a526690dbef5fe431fa37347b3a5f2078"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278875,14 +276920,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_F877 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "b2a52cf7-6f64-5409-8764-e26f7b9e45c8"
+		id = "ca963a33-6c3d-5b29-886d-f754bd698264"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -278890,7 +276935,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_F877 : FI
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54"
 		hash = "de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5"
-		logic_hash = "65966a05952fcf57b8d722154fe6dcafba49fffa0494086e1ff2bf76229d0c78"
+		logic_hash = "v1_sha256_65966a05952fcf57b8d722154fe6dcafba49fffa0494086e1ff2bf76229d0c78"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278906,21 +276951,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_F877 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_AE3A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "9c9c668c-f83c-5166-a4ae-717709df5e70"
+		id = "852360fe-b17a-5da8-bdf7-8e9263ab164b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8468-L8487"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ae3a6a0726f667658fc3e3180980609dcb31bdbf833d7cb76ba5d405058d5156"
-		logic_hash = "7ff6b127fcdbe2a1612d46fccdf23d0fbaa2f6a91a54b718658ebd2d3fea8bce"
+		logic_hash = "v1_sha256_7ff6b127fcdbe2a1612d46fccdf23d0fbaa2f6a91a54b718658ebd2d3fea8bce"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278936,21 +276981,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_AD23 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
 		author = "Florian Roth"
-		id = "df1de7d1-dd2a-5c6c-980d-a080b343f4f7"
+		id = "cfef16a0-2111-5d5c-b9a7-d1e9d3d04d10"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8490-L8509"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b"
-		logic_hash = "8cdd734afe9bdf25157395096e64bfa743e4f17e1bde796269d6b5c875147561"
+		logic_hash = "v1_sha256_8cdd734afe9bdf25157395096e64bfa743e4f17e1bde796269d6b5c875147561"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278966,21 +277011,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_AD23 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_6F80 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
 		author = "Florian Roth"
-		id = "8ed20998-ff6a-56d1-aa40-b6b35f308cbd"
+		id = "bb9f7ac3-1306-55fd-a4d2-750794345129"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8512-L8531"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6f806a9de79ac2886613c20758546f7e9597db5a20744f7dd82d310b7d6457d0"
-		logic_hash = "707ec81c9fb679a439f23e97e92c6d08b541cd433bfa4fa4296a664cabb403d0"
+		logic_hash = "v1_sha256_707ec81c9fb679a439f23e97e92c6d08b541cd433bfa4fa4296a664cabb403d0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -278996,21 +277041,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_B205 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow8x64.sys "
 		author = "Florian Roth"
-		id = "0246761e-08b5-557b-950c-598083488d4f"
+		id = "85754c15-fa64-5166-8efd-513dc5d7bc37"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8534-L8553"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038"
-		logic_hash = "8313ea1ab68c635fd99927884741a087ea5d93e3e2d3d3c9171609f17545d3cc"
+		logic_hash = "v1_sha256_8313ea1ab68c635fd99927884741a087ea5d93e3e2d3d3c9171609f17545d3cc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279026,21 +277071,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_B205 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Filnk_Filseclabdynamicdefensesystem_AE55 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - filnk.sys"
 		author = "Florian Roth"
-		id = "cedb7acf-a1a9-566c-becd-f3e9952a9a3d"
+		id = "e1bb4f87-ca91-54c4-b389-6a16ce4d2d7a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8556-L8575"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ae55a0e93e5ef3948adecf20fa55b0f555dcf40589917a5bfbaa732075f0cc12"
-		logic_hash = "36e491c2841bb77cfc3c07545a30af7edef940e4f36fffd33f6a35f5d8980c86"
+		logic_hash = "v1_sha256_36e491c2841bb77cfc3c07545a30af7edef940e4f36fffd33f6a35f5d8980c86"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279056,21 +277101,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Filnk_Filseclabdynamicdefen
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d0032003000310033002000460069006c007300650063006c0061006200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_CBF7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
 		author = "Florian Roth"
-		id = "b6cf6e40-1414-57a4-839a-7bd45e33b6c8"
+		id = "4116be82-8d73-5169-9b5a-5d2f3e0877b3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8578-L8597"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "cbf74bed1a4d3d5819b7c50e9d91e5760db1562d8032122edac6f0970f427183"
-		logic_hash = "4093b8e8e67632b5ee28b0e8843398e3e32c33b6fbb18c68730f4495d4c025ad"
+		logic_hash = "v1_sha256_4093b8e8e67632b5ee28b0e8843398e3e32c33b6fbb18c68730f4495d4c025ad"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279086,21 +277131,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_CBF7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d00500072006500730065006e0074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_A475 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "54901649-06c2-5bcb-a725-8a4d206dc00c"
+		id = "43ff8ede-ede7-55d6-82dd-9a6e82fae80a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8600-L8619"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a47555d04b375f844073fdcc71e5ccaa1bbb201e24dcdebe2399e055e15c849f"
-		logic_hash = "212de91b3abdc9948aad64531983df3c75e36ff73e56a6b5e8a488571fc39465"
+		logic_hash = "v1_sha256_212de91b3abdc9948aad64531983df3c75e36ff73e56a6b5e8a488571fc39465"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279116,14 +277161,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_66F8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
 		author = "Florian Roth"
-		id = "4ced2cc9-9068-5e5f-a9c6-f091b4550028"
+		id = "43d7364e-3731-5b76-954a-327542e54b78"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -279131,7 +277176,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_66F8 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "66f8bd2b29763acfbb7423f4c3c9c3af9f3ca4113bd580ab32f6e3ee4a4fc64e"
 		hash = "7f84f009704bc36f0e97c7be3de90648a5e7c21b4f870e4f210514d4418079a0"
-		logic_hash = "bb8f360956167a6616fa3449f4dcbc78f938a69c979298d921757c6f1e779601"
+		logic_hash = "v1_sha256_bb8f360956167a6616fa3449f4dcbc78f938a69c979298d921757c6f1e779601"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279146,21 +277191,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_66F8 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_55B5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
 		author = "Florian Roth"
-		id = "91f857f9-14eb-5b6d-8aed-41c2dae736e1"
+		id = "8b88709f-0cbc-5da2-a26d-0283b1ef37ab"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8644-L8663"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "55b5bcbf8fb4e1ce99d201d3903d785888c928aa26e947ce2cdb99eefd0dae03"
-		logic_hash = "3379ec91998a5850e3181784a43fa669817d2f3930bc790bf7b46857a2393d93"
+		logic_hash = "v1_sha256_3379ec91998a5850e3181784a43fa669817d2f3930bc790bf7b46857a2393d93"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279176,14 +277221,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_1A4F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
 		author = "Florian Roth"
-		id = "a7b74018-53bc-5f36-b1cd-50d87c5928e0"
+		id = "5543f433-dd84-57f9-a5c9-04807435f4b1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -279194,7 +277239,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_1A4F :
 		hash = "e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f"
 		hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
 		hash = "ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282"
-		logic_hash = "46cf4eeb547c5924f29ba44a85da013b505732cea5f2ddc8e7e8645b793994a9"
+		logic_hash = "v1_sha256_46cf4eeb547c5924f29ba44a85da013b505732cea5f2ddc8e7e8645b793994a9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279210,21 +277255,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_1A4F :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Filwfp_Filseclabfirewall_490C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - filwfp.sys"
 		author = "Florian Roth"
-		id = "ca80dd10-59cc-576d-a077-01dff115016f"
+		id = "c8836b4c-9808-529b-a4a2-1a2c842efd6a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8692-L8711"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "490cfbb540dcd70b7bff4fdd62e7ed7400bbfebaf5083523d49f7184670f7b9a"
-		logic_hash = "722b36f80e7c899c75667c989390161a30d1336be397c771174e8753865a6f8c"
+		logic_hash = "v1_sha256_722b36f80e7c899c75667c989390161a30d1336be397c771174e8753865a6f8c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279240,21 +277285,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Filwfp_Filseclabfirewall_49
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000460069006c007300650063006c0061006200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautochkupddrvdriver_4AE4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrAutoChkUpdDrv_1_0_32.sys"
 		author = "Florian Roth"
-		id = "64fed65f-7b98-54a9-b84d-00401c4e4094"
+		id = "109542bd-db9a-504a-b065-d6590130914f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8714-L8733"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4ae42c1f11a98dee07a0d7199f611699511f1fb95120fabc4c3c349c485467fe"
-		logic_hash = "a07a0630526bf3b9d427a83b00269428059e640787a834ff129cdb23b4c4c245"
+		logic_hash = "v1_sha256_a07a0630526bf3b9d427a83b00269428059e640787a834ff129cdb23b4c4c245"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279270,21 +277315,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautoc
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9E34 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
 		author = "Florian Roth"
-		id = "17aba336-885e-556a-a05e-9cba2ddbf656"
+		id = "0fa0fcb8-25a8-507b-bafa-c39d17d138d9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8736-L8755"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9e3430d5e0e93bc4a5dccc985053912065e65722bfc2eaf431bc1da91410434c"
-		logic_hash = "d07bb8afe8e9e55d9bbf5c96ab8be6bf1f3b65a08873f8956436b87ad3b826d8"
+		logic_hash = "v1_sha256_d07bb8afe8e9e55d9bbf5c96ab8be6bf1f3b65a08873f8956436b87ad3b826d8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279300,14 +277345,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9E34 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_9D53 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiseUnlo.sys"
 		author = "Florian Roth"
-		id = "4b731a73-af46-5607-96c3-6aeeb7df9976"
+		id = "e59d1fa4-0a92-5ade-8fe5-18c7b6bde0a3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -279315,7 +277360,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_9D53 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9d530642aeb6524691d06b9e02a84e3487c9cdd86c264b105035d925c984823a"
 		hash = "5e27fe26110d2b9f6c2bad407d3d0611356576b531564f75ff96f9f72d5fcae4"
-		logic_hash = "bdf3933b96f571ca3f07d9c3775847d5053f3f147b75068e7dad4a152480935e"
+		logic_hash = "v1_sha256_bdf3933b96f571ca3f07d9c3775847d5053f3f147b75068e7dad4a152480935e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279331,21 +277376,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_9D53 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310035 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_BCFC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "aabd529a-516f-5e7f-85e2-b7fa207b89cd"
+		id = "49c6a25e-d7b6-5505-b710-fe51107efaad"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8781-L8800"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f"
-		logic_hash = "10b04a7ca71652632fb836bfb76f6be8b4c1d9e7e6566f623b52a850b3dbebde"
+		logic_hash = "v1_sha256_10b04a7ca71652632fb836bfb76f6be8b4c1d9e7e6566f623b52a850b3dbebde"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279361,14 +277406,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_BCFC : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_F4FF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
 		author = "Florian Roth"
-		id = "e7e01116-2971-59fd-bada-ac22cdc17670"
+		id = "f3bd01bb-a84c-5014-b927-0c579c80bf12"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -279376,7 +277421,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_F4
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b"
 		hash = "cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b"
-		logic_hash = "e7ca103b49c11733154f9f4bf164be90f25d3534ea103312047d7f1a9c240131"
+		logic_hash = "v1_sha256_e7ca103b49c11733154f9f4bf164be90f25d3534ea103312047d7f1a9c240131"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279392,21 +277437,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_F4
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_DBC6 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "9a004873-765d-5db7-87e1-8796286635e3"
+		id = "537a0163-7126-5a50-9fd9-163a190d53da"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8826-L8845"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed"
-		logic_hash = "becd57b696fe37ea0ae1bd83aa1c00258d1a58fd83c80d9772bea625ad0d6afc"
+		logic_hash = "v1_sha256_becd57b696fe37ea0ae1bd83aa1c00258d1a58fd83c80d9772bea625ad0d6afc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279422,21 +277467,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_DBC6 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_F15A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
 		author = "Florian Roth"
-		id = "ec067130-dde8-58a8-884f-eeda3c7adf57"
+		id = "f77867e9-c16f-5e9c-82f8-99b4e5b015d6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8848-L8867"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1"
-		logic_hash = "ae01cd2b9b1c504298c0295fd4f3e54199df371787676f19ba0a3ad9340f0c56"
+		logic_hash = "v1_sha256_ae01cd2b9b1c504298c0295fd4f3e54199df371787676f19ba0a3ad9340f0c56"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279452,21 +277497,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_4E37 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "c827a2fc-e533-5113-a7e5-8ae4f5718d63"
+		id = "f35a8c2a-b8a8-5d1c-b249-febc46d51618"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8870-L8889"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69"
-		logic_hash = "cd104e4130ef7fcc525a31aacc1180933cd6fe99a7b0c10a54622c512d699364"
+		logic_hash = "v1_sha256_cd104e4130ef7fcc525a31aacc1180933cd6fe99a7b0c10a54622c512d699364"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279482,21 +277527,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_4E37 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_ECD0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "f683f7c5-15cb-5e1b-9d6e-4261c85a581a"
+		id = "971b36d8-ba17-5a3a-b19f-fbe364019da9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8892-L8911"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566"
-		logic_hash = "48342828a25e7fdd6dad197bb079d58fc1937b9630f021067a7f197e53c912d9"
+		logic_hash = "v1_sha256_48342828a25e7fdd6dad197bb079d58fc1937b9630f021067a7f197e53c912d9"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279512,21 +277557,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_ECD0 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6701 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "89f292a0-04cd-5c07-9c43-9fef78748ef4"
+		id = "552ae2da-fa73-5a39-8c5a-115dc79d8514"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8914-L8933"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6701433861742c08eb50f1e785962378143ad5b6c374ac29118168599f8a0f1c"
-		logic_hash = "c6d8f88f83fffed54cd4adf0542a40531765b0cea0e963ed7ad5d646a7901f19"
+		logic_hash = "v1_sha256_c6d8f88f83fffed54cd4adf0542a40531765b0cea0e963ed7ad5d646a7901f19"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279542,21 +277587,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6701 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100310020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinchardwaremanagerdriver_00C3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
 		author = "Florian Roth"
-		id = "1903bced-7391-5d95-a71b-a2657286b5cd"
+		id = "e3f0deb2-72dd-52e2-98f7-a633f6962a09"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8936-L8955"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "00c3e86952eebb113d91d118629077b3370ebc41eeacb419762d2de30a43c09c"
-		logic_hash = "d5975b9f192b982cb0febc0314e9597f387830e6c1cc4bf0202918ce75c8ca33"
+		logic_hash = "v1_sha256_d5975b9f192b982cb0febc0314e9597f387830e6c1cc4bf0202918ce75c8ca33"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279572,14 +277617,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinch
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d0032003000300034002000520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e0020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_DEE3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "189bf93d-db65-50d7-8637-62877742ccae"
+		id = "503e52fc-13b9-54e9-a759-d90b2a27ec53"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -279587,7 +277632,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_DEE3 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "dee384604d2d0018473941acbefe553711ded7344a4932daeffb876fe2fa0233"
 		hash = "26ecd3cea139218120a9f168c8c0c3b856e0dd8fb2205c2a4bcb398f5f35d8dd"
-		logic_hash = "106ecc5e36dbf66a7660d00bfcce40934528899d60bd2bb7711c56f515119fcc"
+		logic_hash = "v1_sha256_106ecc5e36dbf66a7660d00bfcce40934528899d60bd2bb7711c56f515119fcc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279603,21 +277648,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_DEE3 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100320020003300360030002e0063006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_36E3 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "6ea52f09-df49-5bc4-a3bc-34a80e78b739"
+		id = "a8d042bd-d5c7-5ebd-8437-8642b3fb63ab"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L8981-L9000"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289"
-		logic_hash = "c8c776a3ef3f452b261c7348f0634f9bac7e00f5028eeb56af41461d240a5216"
+		logic_hash = "v1_sha256_c8c776a3ef3f452b261c7348f0634f9bac7e00f5028eeb56af41461d240a5216"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279633,21 +277678,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_36E3 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_FDA9 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "d405ca94-8b2c-57cd-b6da-8dbfd5f8d858"
+		id = "1b4cdcb9-e37b-5ea1-be94-1ebf446ffca3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9003-L9022"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280"
-		logic_hash = "2548a054742e55e13e146fa3389c4fb17bdf4e7785bc824e5dd8be7d0cddd75a"
+		logic_hash = "v1_sha256_2548a054742e55e13e146fa3389c4fb17bdf4e7785bc824e5dd8be7d0cddd75a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279663,21 +277708,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_FDA9 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6E9E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "8ec4875c-4f84-5706-81c8-9dd94dccb962"
+		id = "ebbb990d-2bc4-59c4-bf25-0010fee7d025"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9025-L9044"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6e9e9e0b9a23deec5f28dc45f0bbe7423565f037f74be2957e82e5f72c886094"
-		logic_hash = "1a5841556e8589b9fda2167a5ad9c6ac0ec7bb9e9358220ebc18e9675fe6254b"
+		logic_hash = "v1_sha256_1a5841556e8589b9fda2167a5ad9c6ac0ec7bb9e9358220ebc18e9675fe6254b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279693,21 +277738,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6E9E : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1228 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "a46d53f7-ddac-5597-be0d-0e05232bbaec"
+		id = "f51fed91-1544-508e-941a-d6b4ba04f8f9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9047-L9066"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1228d0b6b4f907384346f64e918cc28021fe1cd7d4e39687bca34a708998261a"
-		logic_hash = "6d10896a203562741de37cb97e858a1d70451ad5fc1341ad80d6aa4765b8de9a"
+		logic_hash = "v1_sha256_6d10896a203562741de37cb97e858a1d70451ad5fc1341ad80d6aa4765b8de9a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279723,21 +277768,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1228 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003400200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_D205 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_RCIO64.sys"
 		author = "Florian Roth"
-		id = "ea90277d-696d-5674-b679-9a340359e853"
+		id = "6c56665d-0938-5a44-b40b-35e3b56a8d0f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9069-L9088"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
-		logic_hash = "8c88f91ab8ff231e4ab6e532b8d71ba810fa62e684dec7fff6b74c4f85a96f65"
+		logic_hash = "v1_sha256_8c88f91ab8ff231e4ab6e532b8d71ba810fa62e684dec7fff6b74c4f85a96f65"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279753,14 +277798,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_D205 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrwinddkdriver_38D8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amifldrv64.sys, amifldrv.sys"
 		author = "Florian Roth"
-		id = "9c05031d-2062-53fb-982c-f874bf902b48"
+		id = "211b3781-8a0c-5dd1-88ca-7ed416ff1808"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -279768,7 +277813,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrwindd
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20"
 		hash = "ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f"
-		logic_hash = "fb233e5c3cd88ab1450d3371b2f916af9dc8f0b5ffd145e47ad2f0678495b630"
+		logic_hash = "v1_sha256_fb233e5c3cd88ab1450d3371b2f916af9dc8f0b5ffd145e47ad2f0678495b630"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279784,14 +277829,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrwindd
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Inferre_Hwdetectngsys_Hwdetectngsys_D456 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - hwdetectng.sys"
 		author = "Florian Roth"
-		id = "861a355c-e883-5384-9d77-b572575905d1"
+		id = "14ac0f00-6287-5ee9-ace1-ac7ceff973f3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -279800,7 +277845,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Inferre_Hwdetectngsys_Hwdetectngsys_D456 : FILE
 		hash = "d45600f3015a54fa2c9baa7897edbd821aeea2532e6aadb8065415ed0a23d0c2"
 		hash = "43136de6b77ef85bc661d401723f38624e93c4408d758bc9f27987f2b4511fee"
 		hash = "2f8b68de1e541093f2d4525a0d02f36d361cd69ee8b1db18e6dd064af3856f4f"
-		logic_hash = "8cf397f3b2c7d5b6a3517b40727839c9ab9a460375f0159f69c0d160a38cb470"
+		logic_hash = "v1_sha256_8cf397f3b2c7d5b6a3517b40727839c9ab9a460375f0159f69c0d160a38cb470"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279816,21 +277861,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Inferre_Hwdetectngsys_Hwdetectngsys_D456 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280063002900200032003000300038002d0030003900200069004e00460045005200520045 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Adlicesoftware_Truesight_Truesight_BFC2 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - truesight.sys"
 		author = "Florian Roth"
-		id = "89e4602a-9233-5955-9edb-c09fb2b01376"
+		id = "b1b9b131-75f7-573f-82a0-0b48bedb6deb"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9138-L9157"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c"
-		logic_hash = "31bf547d77d003653090c31588635255d5983e179146bf53b5624dc3fdcf8422"
+		logic_hash = "v1_sha256_31bf547d77d003653090c31588635255d5983e179146bf53b5624dc3fdcf8422"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279846,21 +277891,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Adlicesoftware_Truesight_Truesight_BFC2 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000410064006c00690063006500200053006f00660074007700610072006500280043002900200032003000320033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_87B4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "3c2a3d3b-ec7f-509d-a00a-0bb1b73f50cf"
+		id = "c663fc96-4a60-5aac-92a0-b9fa9f60fa51"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9160-L9179"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "87b4c5b7f653b47c9c3bed833f4d65648db22481e9fc54aa4a8c6549fa31712b"
-		logic_hash = "e1bf0fb9255ba7cd386ac0d51ce1d22ffde535a0064683f2178fac388b6944a0"
+		logic_hash = "v1_sha256_e1bf0fb9255ba7cd386ac0d51ce1d22ffde535a0064683f2178fac388b6944a0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279876,14 +277921,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxsys_Inpoutxdriverversion_X_F581 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpoutx64.sys"
 		author = "Florian Roth"
-		id = "2103d553-3e8a-5f81-b54e-c125aa7746ca"
+		id = "a94e7840-b5e9-5a59-b0c6-c837364a17d7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -279892,7 +277937,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxs
 		hash = "f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af"
 		hash = "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b"
 		hash = "2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d"
-		logic_hash = "ae7082fe90cf522f7bcbb615b751961972331147af1a56af961d35bf70e87f90"
+		logic_hash = "v1_sha256_ae7082fe90cf522f7bcbb615b751961972331147af1a56af961d35bf70e87f90"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279908,21 +277953,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxs
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300030003800200048006900670068007200650073006f006c007500740069006f006e00200045006e007400650072007000720069007300650073002e00200050006f007200740069006f006e007300200043006f007000790072006900670068007400200028006300290020004c006f00670069007800340075 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_12ED : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "d8599978-d388-5b67-99ff-d4bde156b433"
+		id = "293841b9-bad4-55d6-920b-8bbd6edffb40"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9206-L9225"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56"
-		logic_hash = "9c43c1e37bcc87d616e8d7fa1a610b4d3f28b60d2203d0e466939a41b1a8a7d7"
+		logic_hash = "v1_sha256_9c43c1e37bcc87d616e8d7fa1a610b4d3f28b60d2203d0e466939a41b1a8a7d7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279938,21 +277983,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_12ED : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_FF1C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "2c04159c-312f-52a5-8a6c-3fc8346dda5e"
+		id = "59e3ac0f-69b9-5ccc-99d6-2e557d3b46ff"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9228-L9247"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ff1ccef7374a1a5054a6f4437e3e0504b14ed76e17090cc6b1a4ec0e2da427a5"
-		logic_hash = "ee97df01a31ceb88274de9890887f6203bee9b173a2034ad4570a9bb92d13dd2"
+		logic_hash = "v1_sha256_ee97df01a31ceb88274de9890887f6203bee9b173a2034ad4570a9bb92d13dd2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279968,21 +278013,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_FF1C : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100310020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_EBE2 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "6d854b08-4675-53c5-9d7f-753c94310df0"
+		id = "23f1bc55-cd0f-5afb-a355-5fd4fdc31b7b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9250-L9269"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3"
-		logic_hash = "4f671c0023ef9bbb82a3fdd328709bb9c2a579fbef7f0a348b01fd4188ded3d4"
+		logic_hash = "v1_sha256_4f671c0023ef9bbb82a3fdd328709bb9c2a579fbef7f0a348b01fd4188ded3d4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -279998,21 +278043,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_EBE2 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_CA34 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
 		author = "Florian Roth"
-		id = "326a5e40-0706-5daf-b1a5-8bcff8b3fcae"
+		id = "8ce5936a-b62b-5345-aec7-98aad4e40f34"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9272-L9290"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ca34f945117ec853a713183fa4e8cf85ea0c2c49ca26e73d869fee021f7b491d"
-		logic_hash = "20276f0c10cef963957e6f868643166567862b89124d96371b80dfe217eab4b6"
+		logic_hash = "v1_sha256_20276f0c10cef963957e6f868643166567862b89124d96371b80dfe217eab4b6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280027,14 +278072,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_CA34 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390037002d00320030003000370020004e006f00760065006c006c002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_46D1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
 		author = "Florian Roth"
-		id = "af2cb913-c98c-5d29-9822-095df2e8c270"
+		id = "3a273c25-275b-5d7d-8626-b33c212b0495"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -280044,7 +278089,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_46D1 : FILE
 		hash = "dafa4459d88a8ab738b003b70953e0780f6b8f09344ce3cd631af70c78310b53"
 		hash = "4c2d2122ef7a100e1651f2ec50528c0d1a2b8a71c075461f0dc58a1aca36bc61"
 		hash = "d59cc3765a2a9fa510273dded5a9f9ac5190f1edf24a00ffd6a1bbd1cb34c757"
-		logic_hash = "58fde74c3e542d3c0c05f60c92592cf5f9a3b217c0e3d3daf484e91684201564"
+		logic_hash = "v1_sha256_58fde74c3e542d3c0c05f60c92592cf5f9a3b217c0e3d3daf484e91684201564"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280060,14 +278105,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_46D1 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310038002e002000520061007a00650072002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_A334 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
 		author = "Florian Roth"
-		id = "50cf8320-c182-5f59-b2a7-750c618312bf"
+		id = "8bc16fbe-0426-5ee6-9f20-0c796eec4b4d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -280075,7 +278120,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d"
 		hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
-		logic_hash = "881222a52349787251b723640a42b468e4d3f8ee614329de61d7816b00beb9ff"
+		logic_hash = "v1_sha256_881222a52349787251b723640a42b468e4d3f8ee614329de61d7816b00beb9ff"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280091,21 +278136,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_1C12 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "14390895-6fae-5e00-9d0d-76347782873c"
+		id = "5d970335-095d-597b-9501-c9ed33c59789"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9341-L9360"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687"
-		logic_hash = "d8f6326a34caddc2c91ac47e57ed022086bea7122203f166cd5e3176c369a3e4"
+		logic_hash = "v1_sha256_d8f6326a34caddc2c91ac47e57ed022086bea7122203f166cd5e3176c369a3e4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280121,21 +278166,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_1C12 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_4BC0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "da911735-e7b3-5721-8254-958f25b0efa1"
+		id = "94431089-c74d-5119-af11-b56db6f4a3a2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9363-L9382"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4"
-		logic_hash = "1f138a336f979f9a4a75796cdd6cab5716a17f1ded02350db64a6ec618c7a1dd"
+		logic_hash = "v1_sha256_1f138a336f979f9a4a75796cdd6cab5716a17f1ded02350db64a6ec618c7a1dd"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280151,21 +278196,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_4BC0 : F
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Iobitinformationtechnology_Iobitunlockersys_Unlocker_F85C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iobitunlocker.sys"
 		author = "Florian Roth"
-		id = "a9cbfdc3-6c84-5c6f-98a9-8cf77cc32d9d"
+		id = "579f91dc-9751-555a-aaf7-4f16e6febab1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9385-L9404"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004"
-		logic_hash = "1a7df58e346f6ae2224163302bbc14815c6d612c1414b59663d3d9f730925499"
+		logic_hash = "v1_sha256_1a7df58e346f6ae2224163302bbc14815c6d612c1414b59663d3d9f730925499"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280181,21 +278226,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobitinformationtechnology_Iobitunlockersys_Unlo
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_C190 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
 		author = "Florian Roth"
-		id = "9a9903d6-bdab-5694-9e26-66a797e299d5"
+		id = "25ce1969-9f99-58e4-b325-6519891663a7"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9407-L9425"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c190e4a7f1781ec9fa8c17506b4745a1369dcdf174ce07f85de1a66cf4b5ed8a"
-		logic_hash = "44017c1fab02aec40335b310646d9760ce4db2da785d08a430442a5afe9d4887"
+		logic_hash = "v1_sha256_44017c1fab02aec40335b310646d9760ce4db2da785d08a430442a5afe9d4887"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280210,21 +278255,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_C190 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390037002d00320030003000370020004e006f00760065006c006c002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_9B6A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "8fc2f891-9898-551b-8a21-5222af319764"
+		id = "5714b85a-7082-502b-a432-fa4ddf6bbf1f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9428-L9447"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4"
-		logic_hash = "beca5e85d2b29d6a37e9d783facf37bb375095ae5d47a8a2eff663afbc22ffc3"
+		logic_hash = "v1_sha256_beca5e85d2b29d6a37e9d783facf37bb375095ae5d47a8a2eff663afbc22ffc3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280240,21 +278285,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_7D43 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "6c041a1a-b6f2-50f1-a079-1a4abc0c1f37"
+		id = "ab03e09d-47fd-5116-abee-85e11f011ff3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9450-L9469"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea"
-		logic_hash = "5c3addc4d27338e1ed76b65327198acef97969b13e6ac8284153fcc1fd992b4d"
+		logic_hash = "v1_sha256_5c3addc4d27338e1ed76b65327198acef97969b13e6ac8284153fcc1fd992b4d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280270,14 +278315,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310034002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_7337 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
 		author = "Florian Roth"
-		id = "69622a5d-bccf-51cc-8e8b-f1792c89275a"
+		id = "31f885f9-aa5c-521b-a811-5f6c6edf6fb1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -280285,7 +278330,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_7337 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "733789d0a253e8d80cc3240e365b8d4274e510e36007f6e4b5fd13b07b084c3e"
 		hash = "d1463b7fec911c10a8c96d84eb7c0f9e95fa488d826647a591a38c0593f812a4"
-		logic_hash = "9f3772548952491a3c20cdecdba491017a7bb7c113360feae778426539e5d9b8"
+		logic_hash = "v1_sha256_9f3772548952491a3c20cdecdba491017a7bb7c113360feae778426539e5d9b8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280301,21 +278346,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_7337 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_ADC1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "77819373-6f49-56bc-8636-d25cd75491b7"
+		id = "02885b73-8ee4-5216-86b2-dd03cbf7fdef"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9495-L9514"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee"
-		logic_hash = "896055705d276e007082616e944be968d90087798e3c4cfcc35c3ecaf3a781b0"
+		logic_hash = "v1_sha256_896055705d276e007082616e944be968d90087798e3c4cfcc35c3ecaf3a781b0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280331,14 +278376,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_ADC1 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosiodriver_1E24 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SBIOSIO64.sys"
 		author = "Florian Roth"
-		id = "e8515bb1-cf81-510a-9d48-7fd353c6c37a"
+		id = "93d79f65-65fd-55ef-ae3b-b114db272e6b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -280346,7 +278391,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosio
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1e24c45ce2672ee403db34077c88e8b7d7797d113c6fd161906dce3784da627d"
 		hash = "39336e2ce105901ab65021d6fdc3932d3d6aab665fe4bd55aa1aa66eb0de32f0"
-		logic_hash = "d9be90591690481e778ebb8a18c633d7ceccdaafa3989352d94bd1995e3470f4"
+		logic_hash = "v1_sha256_d9be90591690481e778ebb8a18c633d7ceccdaafa3989352d94bd1995e3470f4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280362,21 +278407,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosio
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000530061006d00730075006e006700200045006c0065006300740072006f006e006900630073002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_9491 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "1ac2562c-9d06-5372-bc45-e9491a7bfeea"
+		id = "02e5fb06-b96f-5437-a7e7-ae0cb64ff5c5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9540-L9559"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5"
-		logic_hash = "45bd63fd965c9c40b0d687af623f58922c708608a25e58b2c1ad436312e6284d"
+		logic_hash = "v1_sha256_45bd63fd965c9c40b0d687af623f58922c708608a25e58b2c1ad436312e6284d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280392,21 +278437,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Fujitsulimited_Advdrvsys_Microsoftrwindowsroperatingsystem_04A8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ADV64DRV.sys"
 		author = "Florian Roth"
-		id = "fa878fd1-9d19-561e-bd01-b4693a48f480"
+		id = "15f0471e-dcfb-5bea-9e5f-1d7f8d906e6e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9562-L9580"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162"
-		logic_hash = "7b98ca983166c65065b6fe146957ac438426c0ad2566016e0a61ca3be68f163e"
+		logic_hash = "v1_sha256_7b98ca983166c65065b6fe146957ac438426c0ad2566016e0a61ca3be68f163e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280421,21 +278466,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Fujitsulimited_Advdrvsys_Microsoftrwindowsropera
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002800430029002000460055004a00490054005300550020004c0049004d004900540045004400200032003000300035 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_FF96 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
 		author = "Florian Roth"
-		id = "aa757ead-9ab0-5c5f-ba50-f310130e3d08"
+		id = "01923319-8e81-5e2d-b605-8a920405390a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9583-L9602"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5"
-		logic_hash = "d47eec2132d31ce4f4009456805e7b75e43054edf13c3f056416638cf3928e41"
+		logic_hash = "v1_sha256_d47eec2132d31ce4f4009456805e7b75e43054edf13c3f056416638cf3928e41"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280451,21 +278496,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003900200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxtapsys_Virtualboxhostinterfacenetworkingdriver_CFA2 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxTAP.sys"
 		author = "Florian Roth"
-		id = "657161e9-b714-5bd9-bbb7-5ad7df6a83c5"
+		id = "92426b70-2756-584b-8216-05c7cd98977d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9605-L9624"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "cfa28e2f624f927d4cbd2952306570d86901d2f24e3d07cc6277e98289d09783"
-		logic_hash = "1fefb271c505de9c1d08d558a53f8150cb8724b1b97ac2014f30d2c593f05f6b"
+		logic_hash = "v1_sha256_1fefb271c505de9c1d08d558a53f8150cb8724b1b97ac2014f30d2c593f05f6b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280481,14 +278526,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxtapsys_Virtualboxhostinte
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e002000260020004f00740068006500720073 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Generalelectriccompany_Gedevicedriver_Proficymachineedition_Build_A369 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GEDevDrv.SYS"
 		author = "Florian Roth"
-		id = "c9951c04-1a18-53df-abaa-bfcd7c0a1aec"
+		id = "c5ea99d0-cf9f-54f0-bf3d-96e7780e3225"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -280496,7 +278541,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Generalelectriccompany_Gedevicedriver_Proficymac
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a369942ce8d4b70ebf664981e12c736ec980dbe5a74585dd826553c4723b1bce"
 		hash = "ae73dd357e5950face9c956570088f334d18464cd49f00c56420e3d6ff47e8dc"
-		logic_hash = "e9af30ff414f7c42b656519453924a90be7cf567c5d5ac6c29713d6799a369c1"
+		logic_hash = "v1_sha256_e9af30ff414f7c42b656519453924a90be7cf567c5d5ac6c29713d6799a369c1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280512,21 +278557,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Generalelectriccompany_Gedevicedriver_Proficymac
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000310037002000470065006e006500720061006c00200045006c00650063007400720069006300200043006f006d00700061006e0079 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_85FD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
 		author = "Florian Roth"
-		id = "50552007-935f-5476-a596-6052030c08c4"
+		id = "ec70cfc5-2b76-52e9-b4ff-cfcf4e3bf8bb"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9650-L9669"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "85fdd255c5d7add25fd7cd502221387a5e11f02144753890218dd31a8333a1a3"
-		logic_hash = "dd2e7c64c1f0139e2c365e8f726e026c66857334dbfd29eda3ebffa483677b5f"
+		logic_hash = "v1_sha256_dd2e7c64c1f0139e2c365e8f726e026c66857334dbfd29eda3ebffa483677b5f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280542,21 +278587,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_85FD : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7CF7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "7114725c-9cca-53c3-8902-79d83386fef4"
+		id = "7ebbc989-ef76-554c-98f0-b02e04aceca4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9672-L9691"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7cf756afcaf2ce4f8fb479fdede152a17eabf4c5c7c329699dab026a4c1d4fd0"
-		logic_hash = "f6570bb8a690a21b67637f265f36dbe8a3adb63e30c025216c25df73099ad173"
+		logic_hash = "v1_sha256_f6570bb8a690a21b67637f265f36dbe8a3adb63e30c025216c25df73099ad173"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280572,21 +278617,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7CF7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_7795 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "84866b07-19cc-5c75-acc3-7640adcf68e8"
+		id = "b6b610f5-3c68-50e8-92f5-604397e60f6b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9694-L9713"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c"
-		logic_hash = "f59507fdf64c5eca6139f149595b9919704fead73d4e66c93630ca6cf9582a82"
+		logic_hash = "v1_sha256_f59507fdf64c5eca6139f149595b9919704fead73d4e66c93630ca6cf9582a82"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280602,21 +278647,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_7795 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_B019 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA.sys"
 		author = "Florian Roth"
-		id = "4edbf604-a98c-5877-8385-eff85575daa4"
+		id = "fb53fc6a-53d1-52dc-a36e-26e2820c100b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9716-L9735"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a"
-		logic_hash = "1ef6c4c199fad08babe5f4484444c157dfcfea891f392682689cf2df34088179"
+		logic_hash = "v1_sha256_1ef6c4c199fad08babe5f4484444c157dfcfea891f392682689cf2df34088179"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280632,21 +278677,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_B019 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Amdpowerprofilersys_Amduprof_0AF5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDPowerProfiler.sys"
 		author = "Florian Roth"
-		id = "6475e885-711f-53ea-9ab6-cdb45b3a0917"
+		id = "727b0291-4141-5d31-828c-0c4de40938a0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9738-L9757"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
-		logic_hash = "ac1fd75b411624e0f4cd6d455a61e1ac3c08d421182c4f9eb90698ee29eff77a"
+		logic_hash = "v1_sha256_ac1fd75b411624e0f4cd6d455a61e1ac3c08d421182c4f9eb90698ee29eff77a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280662,21 +278707,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Amdpowerprofilersys_Amdu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020003200300032003100200041004d004400200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_074A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "2cb53106-382d-5645-a72c-28a64112bb47"
+		id = "327f06fb-462c-5d50-b08e-8048e2e19626"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9760-L9779"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761"
-		logic_hash = "b76e7a17aa7da3d6a1972a40fbcaa4ca63edb4220b07d807ee54fea649b13a6d"
+		logic_hash = "v1_sha256_b76e7a17aa7da3d6a1972a40fbcaa4ca63edb4220b07d807ee54fea649b13a6d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280692,21 +278737,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_074A : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_98B7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "f827cf5e-23c7-5db8-9949-14382788bbdd"
+		id = "dcac7439-a118-571b-a53b-bf35e0479304"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9782-L9801"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8"
-		logic_hash = "db97be0a54fc813022a609ffdabe0e0cff306ef894c560f75a43a4aa890590d5"
+		logic_hash = "v1_sha256_db97be0a54fc813022a609ffdabe0e0cff306ef894c560f75a43a4aa890590d5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280722,21 +278767,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_98B7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_7A2C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
 		author = "Florian Roth"
-		id = "eae98a64-3478-55fc-b839-7a1ec0f1521d"
+		id = "f6d42d57-3227-5b27-ad4f-be1ed9b34301"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9804-L9822"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7a2cd1dc110d014165c001ce65578da0c0c8d7d41cc1fa44f974e8a82296fc25"
-		logic_hash = "01badc48c33814577b1a6000b4ff46473b48f85d8f8e8d6071d26b81d3cde22d"
+		logic_hash = "v1_sha256_01badc48c33814577b1a6000b4ff46473b48f85d8f8e8d6071d26b81d3cde22d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280751,21 +278796,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_7A2C : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390037002d00320030003000370020004e006f00760065006c006c002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_9A95 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "de7c3f85-1101-58c2-882b-e7e59d95fdd8"
+		id = "759139e3-1a4b-5f0f-b3c2-689554f77a2e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9825-L9841"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c"
-		logic_hash = "3b699e2afa7e4c4284d725cc159b46a609e4020703bc0efc7ba6563084d67f0e"
+		logic_hash = "v1_sha256_3b699e2afa7e4c4284d725cc159b46a609e4020703bc0efc7ba6563084d67f0e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280778,21 +278823,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_9A95 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_19BF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "4e733353-21f8-5a32-b735-fccd3ffba831"
+		id = "7b6e7a93-33ad-51ee-87ff-ab7b4f08231f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9844-L9863"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775"
-		logic_hash = "b05c520a5816f2dc7a35319f7f5d11001c5d64cdee479e213ac95950acf26bfc"
+		logic_hash = "v1_sha256_b05c520a5816f2dc7a35319f7f5d11001c5d64cdee479e213ac95950acf26bfc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280808,21 +278853,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_19BF : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003100200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_2BBC : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "171ebc5a-3e8a-5771-8960-b623f6581759"
+		id = "060c50f6-95fc-565b-9b87-5d85c0db2f9e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9866-L9882"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1"
-		logic_hash = "d311a2d88741100de1ca65107b08418f0d5a3fc44e4e388faf3434f9fec77dcc"
+		logic_hash = "v1_sha256_d311a2d88741100de1ca65107b08418f0d5a3fc44e4e388faf3434f9fec77dcc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280835,21 +278880,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_2BBC : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Logitechinc_Lvavsys_Logitechwebcamsoftware_E86C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Lv561av.sys"
 		author = "Florian Roth"
-		id = "3402e3fc-82be-577d-a297-fcae7539bcfc"
+		id = "1a859fce-ecf1-5f30-a4a2-7adbf98290cf"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9885-L9904"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4"
-		logic_hash = "ffab2936594602db403cd2aa85e7dffdcb10ec199fe857b947ae3214492106d4"
+		logic_hash = "v1_sha256_ffab2936594602db403cd2aa85e7dffdcb10ec199fe857b947ae3214492106d4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280865,21 +278910,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Logitechinc_Lvavsys_Logitechwebcamsoftware_E86C
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280063002900200031003900390036002d00320030003000390020004c006f006700690074006500630068002e002000200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystemserviceprovider_E6D1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GtcKmdfBs.sys"
 		author = "Florian Roth"
-		id = "8634c295-d4b3-5f35-8ed3-4b11936593f9"
+		id = "46e439c6-d5fa-552a-af83-8dafff9fdf05"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9907-L9926"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e6d1ee0455068b74cf537388c874acb335382876aa9d74586efb05d6cc362ae5"
-		logic_hash = "bdd3eb671365ee774f50c3bbffc33aaffb3651f92101a133d1ddcc8b4a495e8f"
+		logic_hash = "v1_sha256_bdd3eb671365ee774f50c3bbffc33aaffb3651f92101a133d1ddcc8b4a495e8f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280895,21 +278940,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003900200047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_C505 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
 		author = "Florian Roth"
-		id = "2fb75598-3743-50c5-b9cf-d0e928f0c57c"
+		id = "bcf86d5e-ffda-55e4-9bbd-d488ecf12cd3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9929-L9948"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
-		logic_hash = "6174ef1374e0dfd523f7dcdbbdaab1002a95040c1a33f26bf5145d5dcbf87b08"
+		logic_hash = "v1_sha256_6174ef1374e0dfd523f7dcdbbdaab1002a95040c1a33f26bf5145d5dcbf87b08"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280925,21 +278970,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_C505 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002d003200300032003100200048005000200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_AB8F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "fd0941e8-747f-5337-aaf2-f819e32b8884"
+		id = "131d6e0f-7958-5ddf-a25e-f22ba4343bce"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9951-L9970"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
-		logic_hash = "9be0907f77c5d4803a1ad7ac79cc42c15807a5b2d43e00a2448c6278ad5ea6c4"
+		logic_hash = "v1_sha256_9be0907f77c5d4803a1ad7ac79cc42c15807a5b2d43e00a2448c6278ad5ea6c4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280955,21 +279000,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_AB8F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_2CE8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "e7cfd1c7-bd56-5fb1-8e6a-bc49b67b7c2c"
+		id = "6f9faf45-9879-5d10-92b2-0910ed4a6fa8"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9973-L9992"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1"
-		logic_hash = "0ac2638aaea5a401222d1451281ba8dba8fe4ef43da24e5eecbdd6d57f7b1dbb"
+		logic_hash = "v1_sha256_0ac2638aaea5a401222d1451281ba8dba8fe4ef43da24e5eecbdd6d57f7b1dbb"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -280985,21 +279030,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxtapsys_Virtualboxhostinterfacenetworkingdriver_994F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxTAP.sys"
 		author = "Florian Roth"
-		id = "3e90f336-734c-53bd-bc82-5045a9eb1ed2"
+		id = "bf1eb5f4-1d86-5b12-b441-6dda4c055fe5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L9995-L10014"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "994f322def98c99aec7ea0036ef5f4b802120458782ae3867d116d55215c56e4"
-		logic_hash = "25e4171bb112adf44101ca24c7d88e8a11a487b3c41d1f9eed29129c5621456b"
+		logic_hash = "v1_sha256_25e4171bb112adf44101ca24c7d88e8a11a487b3c41d1f9eed29129c5621456b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281015,21 +279060,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxtapsys_Virtualboxhostinterfacene
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0069006e006e006f00740065006b00200047006d00620048002000260020004f00740068006500720073 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_9254 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "ac7837d9-055e-502d-a497-fe96b0aa701d"
+		id = "248300de-8812-5c8b-8ceb-2b0af7bd75ab"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10017-L10036"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b"
-		logic_hash = "cfe16d39c54ccb7ceca1e0fc1033a4d67a0bc9c62c27dcefabe07b68b947e688"
+		logic_hash = "v1_sha256_cfe16d39c54ccb7ceca1e0fc1033a4d67a0bc9c62c27dcefabe07b68b947e688"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281045,21 +279090,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_9254 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_3AF9 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
 		author = "Florian Roth"
-		id = "b44afa7f-6a0d-5cbd-ab2c-910d211f5cb0"
+		id = "a8474b71-8e24-514f-8670-52f8d8e7e451"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10039-L10058"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3af9c376d43321e813057ecd0403e71cafc3302139e2409ab41e254386c33ecb"
-		logic_hash = "84d9015bf6ddbfcd60052a6ffcf4bfa6a2c2f8748b3b7f21ad65c1c8377dc3cb"
+		logic_hash = "v1_sha256_84d9015bf6ddbfcd60052a6ffcf4bfa6a2c2f8748b3b7f21ad65c1c8377dc3cb"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281075,14 +279120,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iqvw64e.sys, iQVW64.SYS, NalDrv.sys"
 		author = "Florian Roth"
-		id = "0ffa7a9b-5174-53df-a332-e8b9e460eb1b"
+		id = "b4c5cc3d-085f-53b2-8dd0-e00fa0d88b3c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -281090,7 +279135,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429 : FI
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b"
 		hash = "a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df"
-		logic_hash = "3dd4326755957e11ca961eb87d0ccae5b63dc7ea4e9dc8e9c67e9c6d52bf894b"
+		logic_hash = "v1_sha256_3dd4326755957e11ca961eb87d0ccae5b63dc7ea4e9dc8e9c67e9c6d52bf894b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281106,21 +279151,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003300200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_32E1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
 		author = "Florian Roth"
-		id = "52d07201-6af3-5675-a5f0-9b6a7bb39b28"
+		id = "33ef1399-4db0-5db3-9566-1d7f7738da89"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10084-L10103"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993"
-		logic_hash = "fd106f69d83d2b1aeb1fdaf16f5809b0fd0d200dec00292efd9bd62422e518a8"
+		logic_hash = "v1_sha256_fd106f69d83d2b1aeb1fdaf16f5809b0fd0d200dec00292efd9bd62422e518a8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281136,21 +279181,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_32E1 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_43BA : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
 		author = "Florian Roth"
-		id = "6db1af54-b12d-5213-b184-7df7f628882e"
+		id = "80ab3381-355f-5211-adb2-bdae128ca696"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10106-L10125"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
-		logic_hash = "910724e7bac9c9c83e703be52e43f4cd88dda344127f2ebc7aee01981467e9e7"
+		logic_hash = "v1_sha256_910724e7bac9c9c83e703be52e43f4cd88dda344127f2ebc7aee01981467e9e7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281166,21 +279211,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1078 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "30ef7f0d-e6f4-5a98-87c2-286ac64c3886"
+		id = "6f9c2a42-6b0b-511b-8f77-3c28b34ca853"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10128-L10147"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c"
-		logic_hash = "e565dcf1bdc8ebaf90c1e42bf3e72ce561cb95f5977809fb9082bb430353dd9b"
+		logic_hash = "v1_sha256_e565dcf1bdc8ebaf90c1e42bf3e72ce561cb95f5977809fb9082bb430353dd9b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281196,21 +279241,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_26C2 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
 		author = "Florian Roth"
-		id = "dba48ad5-9b35-555e-814e-73b74f157b66"
+		id = "0fc2e4cc-0fd3-5989-898a-a7c834bedbaf"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10150-L10169"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097"
-		logic_hash = "2a6f460b66c7e94dfead7bdb3dc46a181ba2e33b40fca1812f0b412daf0a46c4"
+		logic_hash = "v1_sha256_2a6f460b66c7e94dfead7bdb3dc46a181ba2e33b40fca1812f0b412daf0a46c4"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281226,14 +279271,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_05C1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CP2X72C.SYS"
 		author = "Florian Roth"
-		id = "da7c0052-5ff9-5257-a65f-7856f772b4c6"
+		id = "0e544c1a-7816-5582-8f00-36861deb3c94"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -281241,7 +279286,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_0
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "05c15a75d183301382a082f6d76bf3ab4c520bf158abca4433d9881134461686"
 		hash = "4b4ea21da21a1167c00b903c05a4e3af6c514ea3dfe0b5f371f6a06305e1d27f"
-		logic_hash = "485222f31dbe1e486e86c64b607de6742747b3ab2571adfc8c210205032b380b"
+		logic_hash = "v1_sha256_485222f31dbe1e486e86c64b607de6742747b3ab2571adfc8c210205032b380b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281257,21 +279302,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_0
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000300031002c0020003200300032003000200049006e007400650072006600610063006500200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_CC68 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "14971376-05dc-59c2-bce7-498eabb52678"
+		id = "d269f836-bb47-51ec-be80-525e019939bc"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10195-L10214"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
-		logic_hash = "26f1740a069d238aadb1922512e23184cb3cf34d9ef1ff1b942755a49fbd48b0"
+		logic_hash = "v1_sha256_26f1740a069d238aadb1922512e23184cb3cf34d9ef1ff1b942755a49fbd48b0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281287,21 +279332,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_CC68 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_A209 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt.sys"
 		author = "Florian Roth"
-		id = "e38fec7b-bc36-5fa5-a32e-fd82aa05dd19"
+		id = "cf704146-fa15-51b4-8bcc-98a1ab161f9c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10217-L10236"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a2096b460e31451659b0dde752264c362f47254c8191930bc921ff16a4311641"
-		logic_hash = "33238c8b189c5aabe45b238a44fde02b6f9436329c8700ff5b64505784438e69"
+		logic_hash = "v1_sha256_33238c8b189c5aabe45b238a44fde02b6f9436329c8700ff5b64505784438e69"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281317,21 +279362,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_A209 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpudriver_Windowsrcodenamelonghornddkdriver_159E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WCPU.sys"
 		author = "Florian Roth"
-		id = "4ca1b53c-7539-5e0e-8309-224a4a859480"
+		id = "681c955b-8143-5fdc-b390-923efd6e7605"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10239-L10258"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980"
-		logic_hash = "e4bcd8644bcc82c63d9d963aeb9a0a4250d8b3be3fb1122156148f4582fe6d48"
+		logic_hash = "v1_sha256_e4bcd8644bcc82c63d9d963aeb9a0a4250d8b3be3fb1122156148f4582fe6d48"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281347,21 +279392,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpudriver_Wi
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020006200790020004100530055005300540065006b00200043004f004d0050005500540045005200200049004e0043002e00200032003000300036 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Proxydrvsys_Nn_0B20 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ProxyDrv.sys"
 		author = "Florian Roth"
-		id = "cf4d7446-a97e-58b5-aea7-c77516abacf5"
+		id = "c8525814-36d2-5bdd-be5a-abd45c1f9956"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10261-L10280"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0b205838a8271daea89656b1ec7c5bb7244c42a8b8000d7697e92095da6b9b94"
-		logic_hash = "04460d4fa04b60519b0479baab3e07b389dfe255f43b3dcea3d13ca33dc84ded"
+		logic_hash = "v1_sha256_04460d4fa04b60519b0479baab3e07b389dfe255f43b3dcea3d13ca33dc84ded"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281377,21 +279422,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Proxydrvsys_Nn_0B20 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000400020005700770077002e004e006e002e0043006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_1DDF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
 		author = "Florian Roth"
-		id = "54f03573-22a0-51ea-b3cd-201d27459cf1"
+		id = "2c5e089b-ddc7-5486-91a8-81e6fa29c68c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10283-L10302"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219"
-		logic_hash = "23a5fb0826068df015769d604ff393d7d649b919efabd237a004c6946a358448"
+		logic_hash = "v1_sha256_23a5fb0826068df015769d604ff393d7d649b919efabd237a004c6946a358448"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281407,21 +279452,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_1DDF : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_654C : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "c2883a08-8832-514d-a472-e53370fe9a88"
+		id = "883e9019-f8cf-5e7a-9029-aa8f574ee553"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10305-L10324"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad"
-		logic_hash = "f494a64914971b82f191becf020023de1139e5f466e5c1db9912d1d1edbdd0f2"
+		logic_hash = "v1_sha256_f494a64914971b82f191becf020023de1139e5f466e5c1db9912d1d1edbdd0f2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281437,14 +279482,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_654C : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_FD38 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HW.sys"
 		author = "Florian Roth"
-		id = "50ae31e8-41e0-5913-b04a-63b97aa9bbc2"
+		id = "17fc87f3-9a35-5e58-9e14-d588fc43cd64"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -281452,7 +279497,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_FD38 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c"
 		hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
-		logic_hash = "9307a3f6003f6b88d4384aad37803597d7444bcfae806a9f3d59c9a1e59d56e5"
+		logic_hash = "v1_sha256_9307a3f6003f6b88d4384aad37803597d7444bcfae806a9f3d59c9a1e59d56e5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281468,21 +279513,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_FD38 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003100350020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6E0A : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "140374de-63f5-5ea2-9546-9356d697f971"
+		id = "9abcd323-59e7-5202-8e2a-f54c960f1ad1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10350-L10369"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf"
-		logic_hash = "79370b21c6049790a259feebf590222ef8c57bb1564401d68a960ae2c547639a"
+		logic_hash = "v1_sha256_79370b21c6049790a259feebf590222ef8c57bb1564401d68a960ae2c547639a"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281498,21 +279543,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_A2F4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "c7b13c18-84a2-5362-bd10-a80c001c6efc"
+		id = "44a0780b-4adc-5a23-872b-6a0b44db7c9f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10372-L10391"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1"
-		logic_hash = "7fc1a629395b0558eecf2744dcb121a5b2cdbd51f4291a679f9526f21c4f21c0"
+		logic_hash = "v1_sha256_7fc1a629395b0558eecf2744dcb121a5b2cdbd51f4291a679f9526f21c4f21c0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281528,21 +279573,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdriveservicedriver_81D5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AODDriver.sys"
 		author = "Florian Roth"
-		id = "8ad51684-d220-51ff-ab94-3a4326f514ab"
+		id = "9e2f29bb-84b8-5ac5-9702-26283d23a45b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10394-L10413"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "81d54ebef1716e195955046ffded498a5a7e325bf83e7847893aa3b0b3776d05"
-		logic_hash = "fc91d46473eecbc49e074df0c05a1dfee352d3607f9393a6836e37a1c071bdf6"
+		logic_hash = "v1_sha256_fc91d46473eecbc49e074df0c05a1dfee352d3607f9393a6836e37a1c071bdf6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281558,21 +279603,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdrivese
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020003200300031003000200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_EC9B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
 		author = "Florian Roth"
-		id = "a77a77da-6373-5298-86c3-88503aa6a7e5"
+		id = "947fbafa-fcd2-5ce7-aa06-0f7ec515b737"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10416-L10435"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "ec9bd7fb90c3a2aa4605bd73fe1f74399e2cda75fd4c5fff84660ad4f797c4fe"
-		logic_hash = "e16906686623895cf9d6e3c58701f32d44b50b1fe85b95dcf3a8978a62f06a3c"
+		logic_hash = "v1_sha256_e16906686623895cf9d6e3c58701f32d44b50b1fe85b95dcf3a8978a62f06a3c"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281588,21 +279633,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_EC9B : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100310020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_D7C7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
 		author = "Florian Roth"
-		id = "37c763dd-7375-518a-afc8-d3ca5623987e"
+		id = "1e3ae79b-3c0a-5f3e-b5dd-c0c4aff608bc"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10438-L10457"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d7c79238f862b471740aff4cc3982658d1339795e9ec884a8921efe2e547d7c3"
-		logic_hash = "146b74a7750951a07d2e8b64d25e0c0371fc6295b2ee843cf6a7d67c272555a7"
+		logic_hash = "v1_sha256_146b74a7750951a07d2e8b64d25e0c0371fc6295b2ee843cf6a7d67c272555a7"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281618,21 +279663,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_D7C7 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d00500072006500730065006e0074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorporation_Nvflash_Nvidiaflashdriver_AFDD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvflash.sys"
 		author = "Florian Roth"
-		id = "f8e2c69d-d3fb-58f8-bc03-3ad5ce67f0bf"
+		id = "887e2fd4-22b3-5043-b76e-fa33a1c2311c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10460-L10479"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508"
-		logic_hash = "f23537a1efc5e13efb9e145d6c04bb21c3dc7cd49d1913755528f08b94c316ac"
+		logic_hash = "v1_sha256_f23537a1efc5e13efb9e145d6c04bb21c3dc7cd49d1913755528f08b94c316ac"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281648,21 +279693,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorporation_Nvflash_Nvidiaflashdriver_AFDD
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003100370020004e0056004900440049004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F85E : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "43ea92d7-a820-5ccc-b37f-05b96ead1246"
+		id = "b7eb1362-0dda-5735-beaf-2b59744071b1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10482-L10501"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439"
-		logic_hash = "71bef9b60efad8f7bc149d93b94c37e59fd42f01ee01d7964c39ef0d79b997e0"
+		logic_hash = "v1_sha256_71bef9b60efad8f7bc149d93b94c37e59fd42f01ee01d7964c39ef0d79b997e0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281678,21 +279723,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F85E : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublicbyvektortrev_26F4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
 		author = "Florian Roth"
-		id = "1ee8489d-ef29-5d5b-80f5-8f0a206eda3f"
+		id = "7ca3b478-6cae-5a49-bd64-5fa52e16d0e2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10504-L10523"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712"
-		logic_hash = "913dc412be3eaa31903d3fac94e07174789bb746bb382a5f1c08fea50541f6c6"
+		logic_hash = "v1_sha256_913dc412be3eaa31903d3fac94e07174789bb746bb382a5f1c08fea50541f6c6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281708,21 +279753,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublicb
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100380020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3C42 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "e4c649d8-941e-57d8-9193-a7e5c3de4671"
+		id = "dfa0536c-7462-5854-b131-03f3288795f4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10526-L10545"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f"
-		logic_hash = "b3e67939d8f6e6121c3d36dfe5ccb01c9cd2a2d5488053a9834c7cb147ac250e"
+		logic_hash = "v1_sha256_b3e67939d8f6e6121c3d36dfe5ccb01c9cd2a2d5488053a9834c7cb147ac250e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281738,14 +279783,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3C42 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55A1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
 		author = "Florian Roth"
-		id = "3bd64a09-bfa9-5b87-8048-60e61c1a61f7"
+		id = "54817589-f1e3-5d03-a5be-c54a783e502e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -281753,7 +279798,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55A1 :
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9"
 		hash = "c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc"
-		logic_hash = "a6c5fd6c88e08f663479840ae853a0dd22427d0059f0c6aa961dcc1a395dacce"
+		logic_hash = "v1_sha256_a6c5fd6c88e08f663479840ae853a0dd22427d0059f0c6aa961dcc1a395dacce"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281769,14 +279814,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55A1 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosiodriver_B3D1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SBIOSIO64.sys"
 		author = "Florian Roth"
-		id = "d2eed5da-ca7c-5ae3-ab44-2a49f43ec409"
+		id = "f2ecb5d8-aeb5-5fad-b9a9-77dfcd1c0fb8"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -281784,7 +279829,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosio
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b3d1bdd4ad819b99870b6e2ed3527dfc0e3ce27b929ad64382b9c3d4e332315c"
 		hash = "442d506c1ac1f48f6224f0cdd64590779aee9c88bdda2f2cc3169b862cba1243"
-		logic_hash = "5bcc568a4f4edc03e51801c4b256b34ed7f7ae08b7e00ca3f4bd7559502e3c76"
+		logic_hash = "v1_sha256_5bcc568a4f4edc03e51801c4b256b34ed7f7ae08b7e00ca3f4bd7559502e3c76"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281800,21 +279845,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosio
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000530061006d00730075006e006700200045006c0065006300740072006f006e006900630073002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1AAF : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
 		author = "Florian Roth"
-		id = "9fc423bb-451b-52e8-ba81-7113cd1621c8"
+		id = "f96fa9c1-ac47-57f0-8035-000a2e42e86e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10594-L10613"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b"
-		logic_hash = "e441204be274ce4379526096008b545e2a53b11c26c270c2df0c1f70b98d1e57"
+		logic_hash = "v1_sha256_e441204be274ce4379526096008b545e2a53b11c26c270c2df0c1f70b98d1e57"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281830,21 +279875,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1AAF : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_1698 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
 		author = "Florian Roth"
-		id = "4be3fa3a-dec2-5906-99b0-024c8ed059a5"
+		id = "9de85376-2389-5a3a-995f-536bb98bafc6"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10616-L10635"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1698ba7eeee6ff9272cc25b242af89190ff23fd9530f21aa8f0f3792412594f3"
-		logic_hash = "be362e0f19f3565a77b1dbd78ea04f85b7f56fd6889d8fa48ed9ded25134bc2e"
+		logic_hash = "v1_sha256_be362e0f19f3565a77b1dbd78ea04f85b7f56fd6889d8fa48ed9ded25134bc2e"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281860,21 +279905,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_C901 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "a1c33a78-bef9-59fc-8976-876c1fe68aff"
+		id = "b4fba7c5-1d37-5d4f-bd3e-0f6bc42dd2db"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10638-L10657"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c"
-		logic_hash = "2320a0cc02aa28c6495f553b2c7c9c0486599e510d8378dfb3f15b988ff90983"
+		logic_hash = "v1_sha256_2320a0cc02aa28c6495f553b2c7c9c0486599e510d8378dfb3f15b988ff90983"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281890,21 +279935,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_C901 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Symanteccorporation_Vproeventmonitorsys_Symanteceventmonitorsdriverdevelopmentedition_7877 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VProEventMonitor.sys"
 		author = "Florian Roth"
-		id = "84fa4df8-ac81-5de0-994d-9d754642a01e"
+		id = "1c10e551-82e0-583b-9cb6-cc2bac7e9d6c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10660-L10679"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca"
-		logic_hash = "693ace66d01afcdd61fe23a3baa8b950153d38bdc386a43861005654c269cd3d"
+		logic_hash = "v1_sha256_693ace66d01afcdd61fe23a3baa8b950153d38bdc386a43861005654c269cd3d"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281920,21 +279965,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Symanteccorporation_Vproeventmonitorsys_Symantec
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d0032003000300038002000530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Wj_Kprocesshacker_C725 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kprocesshacker.sys"
 		author = "Florian Roth"
-		id = "53a8740a-65a5-5eb5-afc5-b86058982071"
+		id = "e9ff0e0d-2fb6-5d12-8c6a-e6a30e6b4a2e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10682-L10700"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c"
-		logic_hash = "78c3a92f79cbbc31d9191da527bf834e366454f1b5109600aca7954ca4e77226"
+		logic_hash = "v1_sha256_78c3a92f79cbbc31d9191da527bf834e366454f1b5109600aca7954ca4e77226"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281949,21 +279994,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wj_Kprocesshacker_C725 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_7AD0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "e9db51b4-48a2-53a9-999d-5676d0a4aa91"
+		id = "3f004f09-9550-5352-a415-e89ec9101211"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10703-L10722"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed"
-		logic_hash = "2cfb950364b5259679e0dcc7ebe34fd6703ae376b5e1717428a88f0c2ba823f5"
+		logic_hash = "v1_sha256_2cfb950364b5259679e0dcc7ebe34fd6703ae376b5e1717428a88f0c2ba823f5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -281979,21 +280024,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_7AD0 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_83A1 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "5164ae7c-795d-55fd-837a-e45a054fdd3e"
+		id = "ee773229-e594-5d0b-8d6f-45599b17ca54"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10725-L10744"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "83a1fabf782d5f041132d7c7281525f6610207b38f33ff3c5e44eb9444dd0cbc"
-		logic_hash = "16b76760cc8831b7e53cb5f12625cd1dcd059253aa195d763011ccc1cf48a2c5"
+		logic_hash = "v1_sha256_16b76760cc8831b7e53cb5f12625cd1dcd059253aa195d763011ccc1cf48a2c5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282009,21 +280054,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_83A1 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003500200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_C082 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "36d4d011-edf0-53e8-9665-b75520140df3"
+		id = "ed3ba1d8-7a83-5ed2-ac28-114db7d14a6a"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10747-L10766"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd"
-		logic_hash = "de63522d95ff422588d388c3533e268bd09fcf895d60277b7f7470ca7b1e9a33"
+		logic_hash = "v1_sha256_de63522d95ff422588d388c3533e268bd09fcf895d60277b7f7470ca7b1e9a33"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282039,21 +280084,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_C082 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Creativetechnologyinnovationcoltd_Ctiiosys_Ctiiodriverversion_X_2121 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CtiIo64.sys"
 		author = "Florian Roth"
-		id = "3cc780a4-7b9c-516e-91a1-705f785922d2"
+		id = "217767ea-85d9-5e85-98be-56ff8457f8d1"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10769-L10788"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109"
-		logic_hash = "58b715cbea724f7d8f946f613ec35fc3bf29cc34c1e32ebc2910d73092f96d83"
+		logic_hash = "v1_sha256_58b715cbea724f7d8f946f613ec35fc3bf29cc34c1e32ebc2910d73092f96d83"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282069,21 +280114,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Creativetechnologyinnovationcoltd_Ctiiosys_Ctiio
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004300540049 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Ssmartsoftwaresolutionsgmbh_Sysdrvs_Sysdrvs_0E53 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SysDrv3S.sys"
 		author = "Florian Roth"
-		id = "9ace902a-a3bf-56fa-8eb8-99a82c1adf0b"
+		id = "797c9b45-02c4-5821-b08a-bf2109256a0d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10791-L10810"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b"
-		logic_hash = "4d165a6f340f31b18e62ae9f35dd1c5e278217b949e6162119f0e512a262dc38"
+		logic_hash = "v1_sha256_4d165a6f340f31b18e62ae9f35dd1c5e278217b949e6162119f0e512a262dc38"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282099,21 +280144,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ssmartsoftwaresolutionsgmbh_Sysdrvs_Sysdrvs_0E53
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300036002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_14AD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "0501fc8b-cc72-5c03-97cf-411051119ccf"
+		id = "75ddefec-fc03-5d9f-a507-61bd62a5e39f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10813-L10832"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8"
-		logic_hash = "157a559b87310d33a96c77208afd4ae9ceea23df99417408e413dee0be507dd3"
+		logic_hash = "v1_sha256_157a559b87310d33a96c77208afd4ae9ceea23df99417408e413dee0be507dd3"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282129,14 +280174,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_14AD :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Geintelligentplatformsinc_Gedevicedriver_Proficymachineedition_Build_CAC5 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GEDevDrv.SYS"
 		author = "Florian Roth"
-		id = "d90e2248-2b47-51d5-a3d2-06a7b61bc95d"
+		id = "52da8e64-11b6-523e-93bc-02926e148e55"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -282144,7 +280189,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Geintelligentplatformsinc_Gedevicedriver_Proficy
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "cac5dc7c3da69b682097144f12a816530091d4708ca432a7ce39f6abe6616461"
 		hash = "51145a3fa8258aac106f65f34159d23c54b48b6d54ec0421748b3939ab6778eb"
-		logic_hash = "f3c26142b2f18490c79ea7a658397b9c029286a3040bf2159e3fcc76c4bbd788"
+		logic_hash = "v1_sha256_f3c26142b2f18490c79ea7a658397b9c029286a3040bf2159e3fcc76c4bbd788"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282160,21 +280205,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Geintelligentplatformsinc_Gedevicedriver_Proficy
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000310031002c00200047004500200049006e00740065006c006c006900670065006e007400200050006c006100740066006f0072006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserverddkdriver_3871 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz_x64.sys"
 		author = "Florian Roth"
-		id = "ddcb8217-640d-598d-9afd-a1c15d1bbb8c"
+		id = "61831e1a-850f-5ebb-9c76-3685a641d87b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10858-L10877"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3"
-		logic_hash = "5613c77f79128bc7ac3bbe698dcd8be2fca2f59cb60a40ed97f0c80ba9aff690"
+		logic_hash = "v1_sha256_5613c77f79128bc7ac3bbe698dcd8be2fca2f59cb60a40ed97f0c80ba9aff690"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282190,21 +280235,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Lowleveldriver_F941 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GPU-Z.sys"
 		author = "Florian Roth"
-		id = "a65168c0-5f0e-5871-867b-bab6f42b3c21"
+		id = "a72df34d-3a95-51e5-b127-f0b5921a8634"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10880-L10896"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f9418b5e90a235339a4a1a889490faca39cd117a51ba4446daa1011da06c7ecd"
-		logic_hash = "fdc81fdc11ac6db386f4c41c2c34ab9dbd8dd93836a6a91b9412288eca7f0411"
+		logic_hash = "v1_sha256_fdc81fdc11ac6db386f4c41c2c34ab9dbd8dd93836a6a91b9412288eca7f0411"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282217,21 +280262,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lowleveldriver_F941 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000300034002d00320030003100300020002800630029002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_37C6 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "f4b17a75-3160-5a73-afe6-531c41fae197"
+		id = "7a232ded-225b-528d-a0b3-099bb62c77a4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10899-L10918"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
-		logic_hash = "7ab6c3fe4c9cd61c171a71d631a8efc34121bac85e1abf5f281b150f4b6a77a5"
+		logic_hash = "v1_sha256_7ab6c3fe4c9cd61c171a71d631a8efc34121bac85e1abf5f281b150f4b6a77a5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282247,21 +280292,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_37C6 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospackage_3143 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NCHGBIOS2x64.SYS"
 		author = "Florian Roth"
-		id = "c0a7d14e-65aa-51e1-a2c1-88a7c56dce57"
+		id = "26a69296-5cc2-5bd4-8124-117db2ba81f2"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10921-L10940"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
-		logic_hash = "ce2da14c74299d4ad3ab5b882de8bfe810444f21711f2417291bd0298a480e71"
+		logic_hash = "v1_sha256_ce2da14c74299d4ad3ab5b882de8bfe810444f21711f2417291bd0298a480e71"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282277,14 +280322,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospacka
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200031003900390039002d003200300031003200200054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_5439 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "f35db7b6-8a4b-5c26-9e00-da5c1c7780e8"
+		id = "9eb03c5a-dae9-5685-b72b-d68c8e7234b3"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -282292,7 +280337,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_5439 : FILE
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
 		hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
-		logic_hash = "d43a364d3f39951140fa3b3395f1d74c306558a6c6946f665873e72377345949"
+		logic_hash = "v1_sha256_d43a364d3f39951140fa3b3395f1d74c306558a6c6946f665873e72377345949"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282305,21 +280350,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_5439 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_30AB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "cd4dd891-8d86-5afa-83ed-1ad0997608de"
+		id = "6bd5bb07-5228-5f64-b69e-4a24986b9c3e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10963-L10982"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb"
-		logic_hash = "7e1f69495559ca298a05ef6fb3817799b09d66013bae574ec585d27ef89b4dcc"
+		logic_hash = "v1_sha256_7e1f69495559ca298a05ef6fb3817799b09d66013bae574ec585d27ef89b4dcc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282335,21 +280380,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300038 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_DE8F : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
 		author = "Florian Roth"
-		id = "245da08c-d629-53cb-83fb-476f4fdd1512"
+		id = "63ee8a3a-766f-5e0c-a2c2-24f9dc69d2be"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L10985-L11001"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
-		logic_hash = "0cb5b26dd0cd26c77df642ea6bfffdcede293cdb1ecc15430241ab538f835162"
+		logic_hash = "v1_sha256_0cb5b26dd0cd26c77df642ea6bfffdcede293cdb1ecc15430241ab538f835162"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282362,21 +280407,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_DE8F : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_0FC0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
 		author = "Florian Roth"
-		id = "00b4e2c2-cb2b-5de7-be7f-67fd1ed5bb1f"
+		id = "79e65bf7-715f-5612-ac60-ea6844a7301f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11004-L11023"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0fc0644085f956706ea892563309ba72f0986b7a3d4aa9ae81c1fa1c35e3e2d3"
-		logic_hash = "be5fef829971251225d9cbb72d173affd394c8cce6116b0b705c4b02409b6096"
+		logic_hash = "v1_sha256_be5fef829971251225d9cbb72d173affd394c8cce6116b0b705c4b02409b6096"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282392,21 +280437,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Supermicrocomputerinc_Phymem_Phymem_1963 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - phymem64.sys"
 		author = "Florian Roth"
-		id = "19673477-eb54-52d7-886e-ebf3216aa77b"
+		id = "6c8cdefd-8266-5407-989f-b8db694e1c72"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11026-L11045"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52"
-		logic_hash = "8f4cdca4c4bc91f216ee3d89093d482d6e56623a159c3eae6debc388cb9d108f"
+		logic_hash = "v1_sha256_8f4cdca4c4bc91f216ee3d89093d482d6e56623a159c3eae6debc388cb9d108f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282422,14 +280467,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Supermicrocomputerinc_Phymem_Phymem_1963 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_16A2 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
 		author = "Florian Roth"
-		id = "826ee893-06af-5dee-9436-ec3ea7ddd8d9"
+		id = "c2216d09-777f-5c4e-8fc1-ebb9bd10c046"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -282437,7 +280482,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1"
 		hash = "98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb"
-		logic_hash = "ee91ed74d1577bc881a029a6790de6d41e0b9494bfeeceec4511b3d8b7c5cff2"
+		logic_hash = "v1_sha256_ee91ed74d1577bc881a029a6790de6d41e0b9494bfeeceec4511b3d8b7c5cff2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282453,21 +280498,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_CFB7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
 		author = "Florian Roth"
-		id = "e80a43d2-d96f-5fed-a5e1-3e1ea617542a"
+		id = "2c90c3b3-fc98-58bc-ba59-a508d9b4d09f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11071-L11090"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40"
-		logic_hash = "8611a572b8366722e237d622b3701072f564f13a73dd71899dbde6faeab73ef8"
+		logic_hash = "v1_sha256_8611a572b8366722e237d622b3701072f564f13a73dd71899dbde6faeab73ef8"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282483,21 +280528,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_C894 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
 		author = "Florian Roth"
-		id = "b4cef531-b146-5c20-b429-a90beaad5712"
+		id = "cf22bb03-c318-5af9-a778-5efaade8d35d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11093-L11112"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada"
-		logic_hash = "4f0a6ffa08a2c219e47c6ae13f6cc6914fe7d0dccb0273bf0905dd9a71eb439f"
+		logic_hash = "v1_sha256_4f0a6ffa08a2c219e47c6ae13f6cc6914fe7d0dccb0273bf0905dd9a71eb439f"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282513,21 +280558,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_C8
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Pinduoduoltdcorp_Vboxdrv_Pinduoduosecurevdi_9DAB : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
 		author = "Florian Roth"
-		id = "44e2c561-b9f4-5840-9e0c-53ffee5a3bd1"
+		id = "6af081b9-d855-50ad-b349-1fb0fe119b37"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11115-L11134"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4"
-		logic_hash = "894060011b20c84849499127305d8f1d45621c5893f74d59c9278067a329a4d2"
+		logic_hash = "v1_sha256_894060011b20c84849499127305d8f1d45621c5893f74d59c9278067a329a4d2"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282543,21 +280588,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Pinduoduoltdcorp_Vboxdrv_Pinduoduosecurevdi_9DAB
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d0032003000320031002000500069006e00640075006f00640075006f00200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_18DE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
 		author = "Florian Roth"
-		id = "c3b0b3b0-9281-5d90-bf26-6c4c46c4143b"
+		id = "41538b51-4abd-5703-a9a6-008c41660950"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11137-L11156"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506"
-		logic_hash = "d01aeb1783377e6067976e6955e63495706c96c8d6c113b393a47e6fe17992f0"
+		logic_hash = "v1_sha256_d01aeb1783377e6067976e6955e63495706c96c8d6c113b393a47e6fe17992f0"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282573,21 +280618,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_18DE : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_8CFD : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "4affbef6-26ac-5087-a881-32fad34fd192"
+		id = "947bfac2-1104-55d1-b3c1-3c84aa7a01af"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11159-L11178"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9"
-		logic_hash = "5bc5d8a6cd02e9a684515ea333084c788353641cb29ff08f18a1066d533cf0ed"
+		logic_hash = "v1_sha256_5bc5d8a6cd02e9a684515ea333084c788353641cb29ff08f18a1066d533cf0ed"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282603,21 +280648,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_D5C4 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "9994e1c0-b86b-578d-8002-554584e1de2b"
+		id = "952977a1-2bd5-58cd-a13b-2b6ec566383e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11181-L11200"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9"
-		logic_hash = "d6ad094f2e26ff574917770a94af31110f2ed68e47ee082ad4adfcd7376679a5"
+		logic_hash = "v1_sha256_d6ad094f2e26ff574917770a94af31110f2ed68e47ee082ad4adfcd7376679a5"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282633,21 +280678,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_D5C4 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Wj_Kprocesshacker_7021 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kprocesshacker.sys"
 		author = "Florian Roth"
-		id = "dd2a2bfd-12be-5cdb-8293-c51220015bd9"
+		id = "229766ff-6505-593d-a6f5-48e01769587e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11203-L11221"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
-		logic_hash = "e5d17a5b57183c3a27815b5b64014e9d95f49129cd451c62380ba8e1b4d25be6"
+		logic_hash = "v1_sha256_e5d17a5b57183c3a27815b5b64014e9d95f49129cd451c62380ba8e1b4d25be6"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282662,21 +280707,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wj_Kprocesshacker_7021 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_76E8 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "2d26b107-7fcb-5acd-94e4-ed18c399ad66"
+		id = "a9732f6b-d0eb-5247-95d2-e7885bf66852"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11224-L11243"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524"
-		logic_hash = "0a9822cd471bb7fdaab454e824e31e1dcd685f9226c4fa34af4f13dd228dc97b"
+		logic_hash = "v1_sha256_0a9822cd471bb7fdaab454e824e31e1dcd685f9226c4fa34af4f13dd228dc97b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282692,21 +280737,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_76E8 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5148 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "8685ea34-689e-5b00-8aeb-8f15dd7b3f25"
+		id = "38eb919c-2f53-59a2-bf7b-f20c15dfa863"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11246-L11265"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "51480eebbbfb684149842c3e19a8ffbd3f71183c017e0c4bc6cf06aacf9c0292"
-		logic_hash = "b36414a71e9bd69512ef0c702bf4f7b4bfdb812326a67a0e50f6f75f5c89c152"
+		logic_hash = "v1_sha256_b36414a71e9bd69512ef0c702bf4f7b4bfdb812326a67a0e50f6f75f5c89c152"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282722,21 +280767,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5148 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003300200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_1D03 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_HWMIO64_W10.sys"
 		author = "Florian Roth"
-		id = "ea157129-3347-5ba0-a115-928b4aef345f"
+		id = "e4629e40-87a9-5049-a042-74efbffff5cf"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11268-L11287"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
-		logic_hash = "26e886b28b40a920558a652197a0d7a31fc5f7b239d3886fdf0f44da4590dabb"
+		logic_hash = "v1_sha256_26e886b28b40a920558a652197a0d7a31fc5f7b239d3886fdf0f44da4590dabb"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282752,21 +280797,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_1D03 : FIL
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E2E7 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "ec02c434-7918-5212-85f6-5ee417940b7c"
+		id = "e9b1c524-fb9f-5737-9b41-816dd412f5fa"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11290-L11309"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6"
-		logic_hash = "9f77c427b54f1a940547cfc206b8d1aed0288d0664a5a124785c7fcec7b90507"
+		logic_hash = "v1_sha256_9f77c427b54f1a940547cfc206b8d1aed0288d0664a5a124785c7fcec7b90507"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282782,21 +280827,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_B224 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
 		author = "Florian Roth"
-		id = "d5d84ed9-f0c5-54a8-8a7d-0006c1c98f1d"
+		id = "1f7a0222-f642-5fe4-a9d5-e357d5808092"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11312-L11331"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b2247e68386c1bdfd48687105c3728ebbad672daffa91b57845b4e49693ffd71"
-		logic_hash = "e1d35eb3ea6012cf8b742e97f08d797b4fd64bcc72bd7ebccb8ca33f11afad67"
+		logic_hash = "v1_sha256_e1d35eb3ea6012cf8b742e97f08d797b4fd64bcc72bd7ebccb8ca33f11afad67"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282812,21 +280857,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F69 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
 		author = "Florian Roth"
-		id = "04fdd9f7-605b-54ee-849d-44a50ef732d2"
+		id = "cfc6b564-a1fe-59e8-af4e-b00406fecef9"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11334-L11353"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683"
-		logic_hash = "0242a0398f90468dfc41eb04570a70d5072fe089b270feb1f5ab7fbd2c7a1ffc"
+		logic_hash = "v1_sha256_0242a0398f90468dfc41eb04570a70d5072fe089b270feb1f5ab7fbd2c7a1ffc"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282842,21 +280887,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F69 : FI
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5E3B : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
 		author = "Florian Roth"
-		id = "f454f9bf-3dd3-5bb1-a5b5-c00f5356bd25"
+		id = "f514adc0-8f3c-5280-9a47-069b4e9afe34"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11356-L11375"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "5e3bc2d7bc56971457d642458563435c7e5c9c3c7c079ef5abeb6a61fb4d52ea"
-		logic_hash = "893fe9de3a164fd33483d139e76db4c213c402f276bd285c9acefd76da1d2f38"
+		logic_hash = "v1_sha256_893fe9de3a164fd33483d139e76db4c213c402f276bd285c9acefd76da1d2f38"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282872,21 +280917,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5E3B : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_9DEE : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
 		author = "Florian Roth"
-		id = "38c59d28-a35d-57f5-ad0e-7822e3381b53"
+		id = "0c80b042-6c7e-588a-ac15-f06f31f3b0e5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11378-L11397"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9dee9c925f7ea84f56d4a2ad4cf9a88c4dac27380887bf9ac73e7c8108066504"
-		logic_hash = "e7f65896009629498b16fdacd7dcdaafae8336365e621f791e880c108bbab75b"
+		logic_hash = "v1_sha256_e7f65896009629498b16fdacd7dcdaafae8336365e621f791e880c108bbab75b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282902,21 +280947,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9679 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "a1b5efd0-2dd2-5c54-86b6-12684d6ea56b"
+		id = "8270cab5-6ca9-5652-af48-742b4c5250f5"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11400-L11419"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d"
-		logic_hash = "fa486cd644c20c827abc8568933d8537c254cff445f2aef520775e119b6db067"
+		logic_hash = "v1_sha256_fa486cd644c20c827abc8568933d8537c254cff445f2aef520775e119b6db067"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282932,21 +280977,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9679 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8137 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "0e696bff-b5da-5116-a5a7-341b6c3098b8"
+		id = "d3239a14-4538-563e-8fcb-aad95a0713ac"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11422-L11441"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60"
-		logic_hash = "cd4ace0ee1000ec8367bdca57423f311d0993d54359e4b3ca6a503738ba07b3b"
+		logic_hash = "v1_sha256_cd4ace0ee1000ec8367bdca57423f311d0993d54359e4b3ca6a503738ba07b3b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282962,21 +281007,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8137 : FILE
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Asmediatechnologyinc_Asmiosys_Asmediapcidriver_E465 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsmIo64.sys"
 		author = "Florian Roth"
-		id = "196ff2dc-bbf5-5728-bcc9-29fa774b1e84"
+		id = "5ef1a6c9-c049-5ec4-978f-388e494267ff"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11444-L11463"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "e4658d93544f69f5cb9aa6d9fec420fecc8750cb57e1e9798da38c139d44f2eb"
-		logic_hash = "93c9c472f0664eabf5aeba70babe66f974fd79eaf37b65987c396e35faea4d4b"
+		logic_hash = "v1_sha256_93c9c472f0664eabf5aeba70babe66f974fd79eaf37b65987c396e35faea4d4b"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -282992,21 +281037,21 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asmediatechnologyinc_Asmiosys_Asmediapcidriver_E
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000410073006d006500640069006100200054006500630068006e006f006c006f00670079002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_4DA0 : FILE
 {
 	meta:
 		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
 		author = "Florian Roth"
-		id = "bde91bb0-9211-5fea-b725-d556c5a3ccc9"
+		id = "21364cd9-bd24-5c67-ac56-3070a2f9ff6d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_vuln_drivers_strict.yar#L11466-L11485"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba"
-		logic_hash = "c8f2c5a171d1a7192a2eaeae0ab70ce97956b93e68db7a41265e54480bd582f1"
+		logic_hash = "v1_sha256_c8f2c5a171d1a7192a2eaeae0ab70ce97956b93e68db7a41265e54480bd582f1"
 		score = 40
 		quality = 80
 		tags = "FILE"
@@ -283022,14 +281067,14 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_4DA0 :
 		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_6994
 {
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys"
 		author = "Florian Roth"
-		id = "05060e37-3c01-5b86-a3ee-6e141399164a"
+		id = "b6acdb61-b185-52d4-b7cb-ecf1c8affc96"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283052,7 +281097,7 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperat
 		hash = "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d"
 		hash = "e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12"
 		hash = "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df"
-		logic_hash = "161f83c85ad516f3f06f3719a1d8ae0c841e818e50f985403133c2f77b7be894"
+		logic_hash = "v1_sha256_161f83c85ad516f3f06f3719a1d8ae0c841e818e50f985403133c2f77b7be894"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283075,7 +281120,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_AAF0
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "57e5655e-1313-585f-931c-d892e8952d0e"
+		id = "daa94b74-94fc-5dc7-97c2-78b17ebe981b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283121,7 +281166,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_AAF0
 		hash = "d43520128871c83b904f3136542ea46644ac81a62d51ae9d3c3a3f32405aad96"
 		hash = "94c71954ac0b1fd9fa2bd5c506a16302100ba75d9f84f39ee9b333546c714601"
 		hash = "793b78e70b3ae3bb400c5a8bc4d2d89183f1d7fc70954aed43df7287248b6875"
-		logic_hash = "9566444b1d3adb2a8a5f48b45bbbdb5c9be3ce399ec091e3ffd13780a90227f1"
+		logic_hash = "v1_sha256_9566444b1d3adb2a8a5f48b45bbbdb5c9be3ce399ec091e3ffd13780a90227f1"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283144,7 +281189,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_DDF4
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "0b38be06-60df-5b49-a748-eb175e1db33f"
+		id = "85de279a-3938-5610-a39b-dcbc660e0494"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283165,7 +281210,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_DDF4
 		hash = "0740359baef32cbb0b14a9d1bd3499ea2e770ff9b1c85898cfac8fd9aca4fa39"
 		hash = "62764ddc2dce74f2620cd2efd97a2950f50c8ac5a1f2c1af00dc5912d52f6920"
 		hash = "3b2cd65a4fbdd784a6466e5196bc614c17d1dbaed3fd991d242e3be3e9249da6"
-		logic_hash = "d20bfd9f05a7cdb031f3ada2801ee3b978a9d27407b4425c7aa7eb41b4549b18"
+		logic_hash = "v1_sha256_d20bfd9f05a7cdb031f3ada2801ee3b978a9d27407b4425c7aa7eb41b4549b18"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283188,7 +281233,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_0F58
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "0531a88d-cb21-5055-b365-a80b6e99a6e9"
+		id = "b96a79ed-73b5-5222-ba8f-e3a9c1f4d090"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283208,7 +281253,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_0F58
 		hash = "4dc24fd07f8fb854e685bc540359c59f177de5b91231cc44d6231e33c9e932b1"
 		hash = "baf7fbc4743a81eb5e4511023692b2dfdc32ba670ba3e4ed8c09db7a19bd82d3"
 		hash = "bcca03ce1dd040e67eb71a7be0b75576316f0b6587b2058786fda8b6f0a5adfd"
-		logic_hash = "ffa3eaf9032aa673119558217d212ff819ce91e99ab6c046f8801990d5826689"
+		logic_hash = "v1_sha256_ffa3eaf9032aa673119558217d212ff819ce91e99ab6c046f8801990d5826689"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283231,7 +281276,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_7662
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "2bb58484-03d2-5ccc-b165-cfe405f60f03"
+		id = "7f5e67b5-7d00-5c38-8392-23a6fffbf138"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283260,7 +281305,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_7662
 		hash = "d7aa8abdda8a68b8418e86bef50c19ef2f34bc66e7b139e43c2a99ab48c933be"
 		hash = "82ac05fefaa8c7ee622d11d1a378f1d255b647ab2f3200fd323cc374818a83f2"
 		hash = "c7cd14c71bcac5420872c3d825ff6d4be6a86f3d6a8a584f1a756541efff858e"
-		logic_hash = "089f046e94a9cb4f576896e90375d6dbcaef61aa302af07f80230a74bc33ed18"
+		logic_hash = "v1_sha256_089f046e94a9cb4f576896e90375d6dbcaef61aa302af07f80230a74bc33ed18"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283283,7 +281328,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_14B8
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "a9965f8f-4969-52ae-953f-a06d8fabe951"
+		id = "d11c99fe-5d41-5fcf-8617-e994fe744a13"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283320,7 +281365,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_14B8
 		hash = "d50cb5f4b28c6c26f17b9d44211e515c3c0cc2c0c4bf24cd8f9ed073238053ad"
 		hash = "4999541c47abd4a7f2a002c180ae8d31c19804ce538b85870b8db53d3652862b"
 		hash = "a32dc2218fb1f538fba33701dfd9ca34267fda3181e82eb58b971ae8b78f0852"
-		logic_hash = "e4d4b0da09beff889931b8d90365c3a04ff4b5b410004fb820cb2551365cf63c"
+		logic_hash = "v1_sha256_e4d4b0da09beff889931b8d90365c3a04ff4b5b410004fb820cb2551365cf63c"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283343,7 +281388,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_41AD
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "8a8887dd-0f3d-5ab4-a945-b47966789b99"
+		id = "77769469-db06-5916-987a-a78f95e9778b"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283365,7 +281410,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_41AD
 		hash = "c4f041de66ec8cc5ab4a03bbc46f99e073157a4e915a9ab4069162de834ffc5c"
 		hash = "26ef7b27d1afb685e0c136205a92d29b1091e3dcf6b7b39a4ec03fbbdb57cb55"
 		hash = "406b844f4b5c82caf26056c67f9815ad8ecf1e6e5b07d446b456e5ff4a1476f9"
-		logic_hash = "a51e3e4c17122bf15b70b47693c3d24792cc7c7cbead1b26e501cb2907113968"
+		logic_hash = "v1_sha256_a51e3e4c17122bf15b70b47693c3d24792cc7c7cbead1b26e501cb2907113968"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283388,14 +281433,14 @@ rule LOLDRIVERS_MAL_Driver_Sensecorp_42B2
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
 		author = "Florian Roth"
-		id = "6b64ff77-866b-5d77-b2cf-5e507acc6cb9"
+		id = "a31c24d0-b87a-532f-b5be-0aeeab239b3e"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_mal_drivers.yar#L305-L321"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25"
-		logic_hash = "72e213913bf4317fa0751775e6a1a82ba2706e79c52fcd3e2c8ca69050e3a9d7"
+		logic_hash = "v1_sha256_72e213913bf4317fa0751775e6a1a82ba2706e79c52fcd3e2c8ca69050e3a9d7"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283415,14 +281460,14 @@ rule LOLDRIVERS_MAL_Driver_Legalcorp_Pciexpressvideocapture_FD22
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PcieCubed.sys"
 		author = "Florian Roth"
-		id = "c9b28922-d4c7-5c09-9df8-b7b8d8ffc2e8"
+		id = "3f7bbef0-f5ef-5f21-9eb3-c562a570cc68"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_mal_drivers.yar#L324-L342"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8"
-		logic_hash = "4c47a159595f420c520e6924238bd260f49ccf163208713c72c62638b13756d9"
+		logic_hash = "v1_sha256_4c47a159595f420c520e6924238bd260f49ccf163208713c72c62638b13756d9"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283444,7 +281489,7 @@ rule LOLDRIVERS_MAL_Driver_Gmer_Gmersys_Gmer_0052
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gmer64.sys, superman.sys"
 		author = "Florian Roth"
-		id = "a2197304-4455-52bb-ac73-9218b310bb99"
+		id = "a71e7d8c-52e5-52ec-aaf6-c41be8ca8cbb"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283452,7 +281497,7 @@ rule LOLDRIVERS_MAL_Driver_Gmer_Gmersys_Gmer_0052
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3"
 		hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
-		logic_hash = "1644a972cb9bde33e5e8ec078b0ee67b34b6a298504895f364260b96a453a3ba"
+		logic_hash = "v1_sha256_1644a972cb9bde33e5e8ec078b0ee67b34b6a298504895f364260b96a453a3ba"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283475,14 +281520,14 @@ rule LOLDRIVERS_MAL_Driver_Mimidrv_Mimidrvmimikatz_2FAF
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "0160f2aa-f60f-5590-be0a-6751487eab92"
+		id = "196fc189-1664-5fbd-86ff-1f0d4012171d"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_mal_drivers.yar#L368-L384"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "2faf95a3405578d0e613c8d88d534aa7233da0a6217ce8475890140ab8fb33c8"
-		logic_hash = "e7b3f0a8f5a91896f7d487a39c622b12fc7488f9f80c80b6b551e7e5f6a67f18"
+		logic_hash = "v1_sha256_e7b3f0a8f5a91896f7d487a39c622b12fc7488f9f80c80b6b551e7e5f6a67f18"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283502,7 +281547,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_2FD4
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "e77f1fc7-4700-5afe-908f-b0d206757365"
+		id = "bdb44e4f-5108-5b51-adb6-dccc66587dfe"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283511,7 +281556,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_2FD4
 		hash = "2fd43a749b5040ebfafd7cdbd088e27ef44341d121f313515ebde460bf3aaa21"
 		hash = "7824931e55249a501074a258b4f65cd66157ee35672ba17d1c0209f5b0384a28"
 		hash = "28f5aa194a384680a08c0467e94a8fc40f8b0f3f2ac5deb42e0f51a80d27b553"
-		logic_hash = "e24fab351505faf86bd12d6dd97662542c8cf5fca09d916b716af1478f3c9ddf"
+		logic_hash = "v1_sha256_e24fab351505faf86bd12d6dd97662542c8cf5fca09d916b716af1478f3c9ddf"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283534,7 +281579,7 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntope
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ntbios_2.sys"
 		author = "Florian Roth"
-		id = "f16b4b22-985a-5d39-ae51-709aa9a69d8d"
+		id = "461b915a-2d7e-5c78-a5b4-0ece737db61c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283542,7 +281587,7 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntope
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c"
 		hash = "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc"
-		logic_hash = "74ad0b57644d82a77bc902786250156f5e3700671bdf9765055b5908dc345a67"
+		logic_hash = "v1_sha256_74ad0b57644d82a77bc902786250156f5e3700671bdf9765055b5908dc345a67"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283565,7 +281610,7 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wintapixsys_Microsoftwindowsoper
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinTapix.sys, SRVNET2.SYS"
 		author = "Florian Roth"
-		id = "0bb182e8-e64b-5b01-9ca5-105212ebeb51"
+		id = "dab4619c-9b0c-5a80-a4e7-2b7ac6aaeff0"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283573,7 +281618,7 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wintapixsys_Microsoftwindowsoper
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330"
 		hash = "1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e"
-		logic_hash = "dd85f0dc471425fe692e5a51580a97facdaea45505c48b5e01dd6dbc975f2ffe"
+		logic_hash = "v1_sha256_dd85f0dc471425fe692e5a51580a97facdaea45505c48b5e01dd6dbc975f2ffe"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283596,7 +281641,7 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperati
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_6.sys"
 		author = "Florian Roth"
-		id = "5f883209-6887-5cb4-96bb-988898d47c09"
+		id = "3b1f4168-e21a-599e-808e-83283fceeb27"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283606,7 +281651,7 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperati
 		hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3"
 		hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce"
 		hash = "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4"
-		logic_hash = "b4d12069a9a3a8d8d9bde9a4ed3f80f21f2654b6f96943d201933198678d01d9"
+		logic_hash = "v1_sha256_b4d12069a9a3a8d8d9bde9a4ed3f80f21f2654b6f96943d201933198678d01d9"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283629,7 +281674,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_30E0
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "888de0dc-5643-5e55-8272-9363cc55bfcf"
+		id = "d9c8c59e-d48a-5860-9926-2bac4ed92706"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
@@ -283637,7 +281682,7 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_30E0
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "30e083cd7616b1b969a92fd18cf03097735596cce7fcf3254b2ca344e526acc2"
 		hash = "a906251667a103a484a6888dca3e9c8c81f513b8f037b98dfc11440802b0d640"
-		logic_hash = "e2c964f7e30da210778e8a2e5bb96d53485a0736cf3ff28bccbefacb6b46765a"
+		logic_hash = "v1_sha256_e2c964f7e30da210778e8a2e5bb96d53485a0736cf3ff28bccbefacb6b46765a"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283660,14 +281705,14 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperati
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_2.sys"
 		author = "Florian Roth"
-		id = "3bd8b888-8170-5da6-ba1c-f13c1ca27e6f"
+		id = "e63ce419-82f3-5dce-bb58-65bbda1591ad"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_mal_drivers.yar#L505-L524"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f"
-		logic_hash = "9cde0a399b852038979993375be2a6d0f9f9f760381e94df0190256e8810949f"
+		logic_hash = "v1_sha256_9cde0a399b852038979993375be2a6d0f9f9f760381e94df0190256e8810949f"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283690,14 +281735,14 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Srvnetsys_Microsoftwindowsoperat
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinTapix.sys, SRVNET2.SYS"
 		author = "Florian Roth"
-		id = "3559718f-59d7-5bff-860c-6a073f4c05d9"
+		id = "737bf776-7648-5263-82dc-1e99f715e670"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_mal_drivers.yar#L527-L546"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d"
-		logic_hash = "ab1aea5cec71668c0e35ea149b9e537c8468738c3b3e70382ebedf51bb8729d0"
+		logic_hash = "v1_sha256_ab1aea5cec71668c0e35ea149b9e537c8468738c3b3e70382ebedf51bb8729d0"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283720,14 +281765,14 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperati
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_3.sys"
 		author = "Florian Roth"
-		id = "43ae822a-c4c4-5525-bfd3-a05d1ec50bd0"
+		id = "c2589627-3f1b-542f-82be-d8dcab321873"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_mal_drivers.yar#L549-L568"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1"
-		logic_hash = "ec9e321bbc89bffb6243e3edde45e60dc06513e88dfb9a262768ef081db60c5b"
+		logic_hash = "v1_sha256_ec9e321bbc89bffb6243e3edde45e60dc06513e88dfb9a262768ef081db60c5b"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283750,14 +281795,14 @@ rule LOLDRIVERS_MAL_Driver_773B
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
 		author = "Florian Roth"
-		id = "f47ab2f1-86f6-5550-939e-4477ec1c367c"
+		id = "603aff8a-ed08-5fe4-af7e-bf1d261f28f4"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_mal_drivers.yar#L571-L585"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "773b4a1efb9932dd5116c93d06681990759343dfe13c0858d09245bc610d5894"
-		logic_hash = "5e01850384ac0dc0e9f33e3e217e0e824cfe3c2bb46feff94dffa070f2f7c9a0"
+		logic_hash = "v1_sha256_5e01850384ac0dc0e9f33e3e217e0e824cfe3c2bb46feff94dffa070f2f7c9a0"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283775,14 +281820,14 @@ rule LOLDRIVERS_MAL_Driver_Sensecorp_7F45
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
 		author = "Florian Roth"
-		id = "6c1f5ba4-fd14-5069-9d99-e3072b2dbbc2"
+		id = "ff924271-36af-50d6-8871-2cf6e9bbe03c"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_mal_drivers.yar#L588-L604"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6"
-		logic_hash = "dbef723d7e44da110675402fc13708c5b077eeb6a66c1772885f5879d795ec4e"
+		logic_hash = "v1_sha256_dbef723d7e44da110675402fc13708c5b077eeb6a66c1772885f5879d795ec4e"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283802,14 +281847,14 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowsopera
 	meta:
 		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ndislan.sys"
 		author = "Florian Roth"
-		id = "c94adcf3-2ea6-5856-9327-2e5ed1c49b22"
+		id = "891b8c5d-043a-58a5-b4ce-8c8aa9e8589f"
 		date = "2024-08-07"
 		modified = "2024-08-07"
 		reference = "https://github.com/magicsword-io/LOLDrivers"
 		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/detections/yara/yara-rules_mal_drivers.yar#L607-L626"
 		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/c9f1c82aac6d9d4c2e472375af843110e0f9b663/LICENSE"
 		hash = "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427"
-		logic_hash = "4b92b69636dea19a23172def47e9a1bbd4507075ec118b48db30fec377b8fbff"
+		logic_hash = "v1_sha256_4b92b69636dea19a23172def47e9a1bbd4507075ec118b48db30fec377b8fbff"
 		score = 70
 		quality = 80
 		tags = ""
@@ -283831,9 +281876,9 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowsopera
  * YARA Rule Set
  * Repository Name: Signature Base
  * Repository: https://github.com/Neo23x0/signature-base
- * Retrieval Date: 2024-12-08
- * Git Commit: b1bc331bada41a30f3b2f8943e750798f7aaa1a9
- * Number of Rules: 4289
+ * Retrieval Date: 2024-12-15
+ * Git Commit: 7f13b425aac90a00c208de8e3b28751b5aba3c45
+ * Number of Rules: 4294
  * Skipped: 0 (age), 6 (quality), 4 (score), 0 (importance)
  *
  *
@@ -283884,13 +281929,13 @@ private rule SIGNATURE_BASE_Hatman_Mftmsr_PRIVATE : HATMAN
 	meta:
 		description = "No description has been set in the source file - Signature Base"
 		author = "Florian Roth"
-		id = "cbbd6008-7722-5d92-bb82-73c8b2b6bea9"
+		id = "56b400d4-2989-5c34-9e8a-0a14b0bf0af1"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L65-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a03a3f5c583843acb216a8edefceaa1e89248fe72db49bcd906d2183998b1674"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L65-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a03a3f5c583843acb216a8edefceaa1e89248fe72db49bcd906d2183998b1674"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
@@ -283902,20 +281947,20 @@ private rule SIGNATURE_BASE_Hatman_Mftmsr_PRIVATE : HATMAN
 		$mtmsr_le = { 24 01 63 7c }
 
 	condition:
-		($mfmsr_be and $mtmsr_be) or ($mfmsr_le and $mtmsr_le)
+		($mfmsr_be and $mtmsr_be ) or ( $mfmsr_le and $mtmsr_le )
 }
 private rule SIGNATURE_BASE_Hatman_Origcode_PRIVATE : HATMAN
 {
 	meta:
 		description = "No description has been set in the source file - Signature Base"
 		author = "Florian Roth"
-		id = "582b4cb6-54b5-5128-8c42-6759ec0f3976"
+		id = "75acf3a2-0e9b-5280-8830-211c0f46737f"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L58-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f6286e084bdbf3e2730a1aa3b7e302c1611c987447e083780e2d03000d1d226e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L58-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f6286e084bdbf3e2730a1aa3b7e302c1611c987447e083780e2d03000d1d226e"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
@@ -283932,13 +281977,13 @@ private rule SIGNATURE_BASE_Hatman_Loadoff_PRIVATE : HATMAN
 	meta:
 		description = "No description has been set in the source file - Signature Base"
 		author = "Florian Roth"
-		id = "1ad2f77b-4360-512d-ac06-9933ac2cdc67"
+		id = "59229427-e982-59af-8fed-59b3db4b5374"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L74-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "70d33c40b919d1852eded8c4afa96978c8b4503f95fb4a48e1d8b89864b77d38"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L74-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_70d33c40b919d1852eded8c4afa96978c8b4503f95fb4a48e1d8b89864b77d38"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
@@ -283957,13 +282002,13 @@ private rule SIGNATURE_BASE_Hatman_Origaddr_PRIVATE : HATMAN
 	meta:
 		description = "No description has been set in the source file - Signature Base"
 		author = "Florian Roth"
-		id = "5eb29f1f-f49f-54e9-8a9e-ba10fc9c826e"
+		id = "b37364d4-928d-556b-9515-9bb944befe8a"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L51-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e9f775326dc0496662fbec98438e0273c51a88a434542dfcabd6e8b11131ab3e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L51-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e9f775326dc0496662fbec98438e0273c51a88a434542dfcabd6e8b11131ab3e"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
@@ -283980,13 +282025,13 @@ private rule SIGNATURE_BASE_Hatman_Memcpy_PRIVATE : HATMAN
 	meta:
 		description = "No description has been set in the source file - Signature Base"
 		author = "Florian Roth"
-		id = "2eb11f72-b37f-563f-8ce9-c4d4388598d3"
+		id = "ddbd452a-bf74-5dcb-98a6-034846188aa5"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L29-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1e1566cc09e1ddd70cdb3b199f6972931f84a29ae2ef4815a5ecf1fe42afe42b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L29-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1e1566cc09e1ddd70cdb3b199f6972931f84a29ae2ef4815a5ecf1fe42afe42b"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
@@ -284005,13 +282050,13 @@ private rule SIGNATURE_BASE_Hatman_Nullsub_PRIVATE : HATMAN
 	meta:
 		description = "No description has been set in the source file - Signature Base"
 		author = "Florian Roth"
-		id = "1b0e708d-6e4c-5688-9fc6-c31a4fb3c4a8"
+		id = "feaf2242-1db8-5a30-a420-d826b9038266"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L45-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7e7a7494e68450a03aeddfaa1fd0a3fb3cff06684d5bb0c4615571e698293fe3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L45-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7e7a7494e68450a03aeddfaa1fd0a3fb3cff06684d5bb0c4615571e698293fe3"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
@@ -284027,13 +282072,13 @@ private rule SIGNATURE_BASE_Hatman_Dividers_PRIVATE : HATMAN
 	meta:
 		description = "No description has been set in the source file - Signature Base"
 		author = "Florian Roth"
-		id = "1612a184-e06c-5c1b-987d-04e330e17ed0"
+		id = "8c88e1d9-c7bf-5df0-80e9-7ea4ad45c20b"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L38-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "92ec47ea81b78ec9b05f5c17164daaef7112c8590b4443f70cf3bf2efd108e1f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L38-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_92ec47ea81b78ec9b05f5c17164daaef7112c8590b4443f70cf3bf2efd108e1f"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
@@ -284050,13 +282095,13 @@ private rule SIGNATURE_BASE_Hatman_Setstatus_PRIVATE : HATMAN
 	meta:
 		description = "No description has been set in the source file - Signature Base"
 		author = "Florian Roth"
-		id = "a0619dad-7cee-585a-9246-b3d4554e512f"
+		id = "1d5d5568-8a65-510f-a49f-aa551fb9c7a2"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L21-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "264292bbc479413bf70f05b96bcea3c856906eb8c711720831bea9b887a7ffb0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L21-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_264292bbc479413bf70f05b96bcea3c856906eb8c711720831bea9b887a7ffb0"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
@@ -284078,9 +282123,9 @@ rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hex_Encoded_Code
 		date = "2019-04-29"
 		modified = "2023-12-05"
 		reference = "https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_obfuscation.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f1451e2dd0e4e70a0f39f609331762cce369642e9fadbef83d932da2a0a6c60b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_obfuscation.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f1451e2dd0e4e70a0f39f609331762cce369642e9fadbef83d932da2a0a6c60b"
 		score = 65
 		quality = 85
 		tags = ""
@@ -284091,7 +282136,7 @@ rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hex_Encoded_Code
 		$fp1 = "Microsoft Azure Code Signp$"
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		1 of ( $x* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Double_Base64_Encoded_Executable
 {
@@ -284102,9 +282147,9 @@ rule SIGNATURE_BASE_SUSP_Double_Base64_Encoded_Executable
 		date = "2019-10-29"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/TweeterCyber/status/1189073238803877889"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_obfuscation.yar#L19-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ac739ed2af7dff70d7a05e661582a8fdd618e77aa5e0e0f42d6ea314265a129c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_obfuscation.yar#L19-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ac739ed2af7dff70d7a05e661582a8fdd618e77aa5e0e0f42d6ea314265a129c"
 		score = 65
 		quality = 85
 		tags = ""
@@ -284139,9 +282184,9 @@ rule SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE : FILE
 		date = "2020-04-06"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_obfuscation.yar#L47-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a2f1caf2235ee24f531c9f9a5ebdc0c97a90890218669749a4c83bede80a336"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_obfuscation.yar#L47-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a2f1caf2235ee24f531c9f9a5ebdc0c97a90890218669749a4c83bede80a336"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -284158,7 +282203,7 @@ rule SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE : FILE
 		$sh3 = "uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV" ascii
 
 	condition:
-		filesize <10000KB and 1 of them
+		filesize < 10000KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Script_Base64_Blocks_Jun20_1
 {
@@ -284169,9 +282214,9 @@ rule SIGNATURE_BASE_SUSP_Script_Base64_Blocks_Jun20_1
 		date = "2020-06-05"
 		modified = "2023-12-05"
 		reference = "https://posts.specterops.io/covenant-v0-5-eee0507b85ba"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_obfuscation.yar#L70-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d456cbbbd76f543afe144a2876a02db834aa6b09ecd4d6aa2f25ce8eeac5de8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_obfuscation.yar#L70-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d456cbbbd76f543afe144a2876a02db834aa6b09ecd4d6aa2f25ce8eeac5de8"
 		score = 70
 		quality = 85
 		tags = ""
@@ -284192,9 +282237,9 @@ rule SIGNATURE_BASE_SUSP_Reversed_Hacktool_Author : FILE
 		date = "2020-06-10"
 		modified = "2023-12-05"
 		reference = "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_obfuscation.yar#L85-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3681fb11dabf9905915d23f4198145b503a260d628415fd79ad71d7703ba9f6f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_obfuscation.yar#L85-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3681fb11dabf9905915d23f4198145b503a260d628415fd79ad71d7703ba9f6f"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -284204,7 +282249,7 @@ rule SIGNATURE_BASE_SUSP_Reversed_Hacktool_Author : FILE
 		$x2 = " eetbus@ " ascii wide
 
 	condition:
-		filesize <4000KB and 1 of them
+		filesize < 4000KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hacktool_Dev : FILE
 {
@@ -284215,9 +282260,9 @@ rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hacktool_Dev : FILE
 		date = "2020-06-10"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1270626274826911744"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_obfuscation.yar#L101-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7345a528a12f87e5cbcabccf649566a038dd2115e8aec4f39599e357c8c6d57f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_obfuscation.yar#L101-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7345a528a12f87e5cbcabccf649566a038dd2115e8aec4f39599e357c8c6d57f"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -284234,7 +282279,7 @@ rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hacktool_Dev : FILE
 		$ = "gQHN1YnRlZ" ascii wide
 
 	condition:
-		filesize <6000KB and 1 of them
+		filesize < 6000KB and 1 of them
 }
 import "pe"
 
@@ -284247,9 +282292,9 @@ rule SIGNATURE_BASE_SUSP_Unsigned_OSPPSVC : FILE
 		date = "2019-09-26"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2019/09/24/no-summer-vacations-zebrocy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_sign_anomalies.yar#L4-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "27d8d8d19e25a2e3cffb765a0b3122e38dcb72d60c00c554163ee193a04b3d82"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_sign_anomalies.yar#L4-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_27d8d8d19e25a2e3cffb765a0b3122e38dcb72d60c00c554163ee193a04b3d82"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -284267,10 +282312,8 @@ rule SIGNATURE_BASE_SUSP_Unsigned_OSPPSVC : FILE
                00 65 00 72 00 76 00 69 00 63 00 65 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and $sc1 and pe.number_of_signatures<1
+		uint16( 0 ) == 0x5a4d and filesize < 8000KB and $sc1 and pe.number_of_signatures < 1
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_PE_Signed_By_Suspicious_Entitiy_Mar23 : FILE
 {
 	meta:
@@ -284280,8 +282323,8 @@ rule SIGNATURE_BASE_SUSP_PE_Signed_By_Suspicious_Entitiy_Mar23 : FILE
 		date = "2023-03-06"
 		modified = "2023-12-05"
 		reference = "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_sign_anomalies.yar#L28-L214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_sign_anomalies.yar#L28-L214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2fb7a38e69a88e3da8fece4c6a1a81842c1be6ae9d6ac299afa4aef4eb55fd4b"
 		hash = "9a24befcc0c0926abb49d43174fe25c2469cca06d6ab3b5000d7c9d434c42fe9"
 		hash = "9ad716f0173489e74fefe086000dfbea9dc093b1c3460bed9cdb82f923073806"
@@ -284432,7 +282475,7 @@ rule SIGNATURE_BASE_SUSP_PE_Signed_By_Suspicious_Entitiy_Mar23 : FILE
 		hash = "4b482ebf88bcb55e7b0769690ccca4d08856c879af82ad7165436b82a315d742"
 		hash = "79c9acadd99ab1251dbba3bff7d0b67de4252f913f485465d63f4f0c4d9a6419"
 		hash = "9bcc3f36c32e3efbf8bdcba7670658042db65dd617dad0709d92c554ba841b57"
-		logic_hash = "68c3f2c97a8eab3d334222eae4c4b808e6b763896f198d033f4d11218e9ff551"
+		logic_hash = "v1_sha256_68c3f2c97a8eab3d334222eae4c4b808e6b763896f198d033f4d11218e9ff551"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -284455,7 +282498,7 @@ rule SIGNATURE_BASE_SUSP_PE_Signed_By_Suspicious_Entitiy_Mar23 : FILE
 		$cert14 = { e5 a4 a7 e8 bf 9e e7 ba b5 e6 a2 a6 e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <20MB and any of ($cert*)
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 20MB and any of ( $cert* )
 }
 import "pe"
 
@@ -284468,9 +282511,9 @@ rule SIGNATURE_BASE_Tophat_Malware_Jan18_1 : FILE
 		date = "2018-01-29"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_tophat.yar#L13-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "69a1e1105b28d66203f74e68038efacc926e501e28a73865485adf2fd7fc0ac0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_tophat.yar#L13-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_69a1e1105b28d66203f74e68038efacc926e501e28a73865485adf2fd7fc0ac0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284488,7 +282531,7 @@ rule SIGNATURE_BASE_Tophat_Malware_Jan18_1 : FILE
 		$s7 = "DIALOG INCLUDE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="c221006b240b1c993217bd61e5ee31b6" or 6 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "c221006b240b1c993217bd61e5ee31b6" or 6 of them )
 }
 import "pe"
 
@@ -284501,9 +282544,9 @@ rule SIGNATURE_BASE_Tophat_Malware_Jan18_2 : FILE
 		date = "2018-01-29"
 		modified = "2023-01-06"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_tophat.yar#L38-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2321e89559363c04ef0e92a9c9e03d11ff27410103b3aaba954b544e33961b2f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_tophat.yar#L38-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2321e89559363c04ef0e92a9c9e03d11ff27410103b3aaba954b544e33961b2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284519,10 +282562,8 @@ rule SIGNATURE_BASE_Tophat_Malware_Jan18_2 : FILE
 		$s6 = "TEXPORTAPIS" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="f98cebcae832abc3c46e6e296aecfc03" and 5 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.imphash ( ) == "f98cebcae832abc3c46e6e296aecfc03" and 5 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Tophat_BAT : FILE
 {
 	meta:
@@ -284532,9 +282573,9 @@ rule SIGNATURE_BASE_Tophat_BAT : FILE
 		date = "2018-01-29"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_tophat.yar#L62-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5dc58fa39d8b2aed95b39da575191fe5d10d5dd95b57c320cde8983505e7184f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_tophat.yar#L62-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5dc58fa39d8b2aed95b39da575191fe5d10d5dd95b57c320cde8983505e7184f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284548,7 +282589,7 @@ rule SIGNATURE_BASE_Tophat_BAT : FILE
 		$s3 = ":Start" fullword ascii
 
 	condition:
-		filesize <5KB and all of them
+		filesize < 5KB and all of them
 }
 rule SIGNATURE_BASE_Apt_Equation_Exploitlib_Mutexes : FILE
 {
@@ -284559,9 +282600,9 @@ rule SIGNATURE_BASE_Apt_Equation_Exploitlib_Mutexes : FILE
 		date = "2016-02-15"
 		modified = "2023-01-27"
 		reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L3-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4414dd4ca16d08b8edad26842640960ace434cdde769766fb1c38a1a249565fd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L3-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4414dd4ca16d08b8edad26842640960ace434cdde769766fb1c38a1a249565fd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284575,7 +282616,7 @@ rule SIGNATURE_BASE_Apt_Equation_Exploitlib_Mutexes : FILE
 		$a5 = "cnFormVoidFBC"
 
 	condition:
-		uint16(0)==0x5A4D and any of ($a*)
+		uint16( 0 ) == 0x5A4D and any of ( $a* )
 }
 rule SIGNATURE_BASE_Apt_Equation_Equationlaser_Runtimeclasses
 {
@@ -284586,9 +282627,9 @@ rule SIGNATURE_BASE_Apt_Equation_Equationlaser_Runtimeclasses
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L40-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "663ea56f869f7099a92658df5bddd76d4e5ba8ac5dfc693733579682b9eee860"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L40-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_663ea56f869f7099a92658df5bddd76d4e5ba8ac5dfc693733579682b9eee860"
 		score = 75
 		quality = 85
 		tags = ""
@@ -284614,9 +282655,9 @@ rule SIGNATURE_BASE_Apt_Equation_Cryptotable
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L59-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e660fe423330334a1e3167d6a45e5ce2469fec276838618a7cb0340ec8172275"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L59-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e660fe423330334a1e3167d6a45e5ce2469fec276838618a7cb0340ec8172275"
 		score = 75
 		quality = 85
 		tags = ""
@@ -284637,10 +282678,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_1 : FILE
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L75-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L75-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"
-		logic_hash = "cfa3c1756c8dfb04e0a1590f76cad6d5b3878000d220c263d199322cf6a4f58a"
+		logic_hash = "v1_sha256_cfa3c1756c8dfb04e0a1590f76cad6d5b3878000d220c263d199322cf6a4f58a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284663,7 +282704,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_1 : FILE
 		$z3 = "127.0.0.1:3128" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300000 and (( all of ($s*) and all of ($z*)) or ( all of ($s*) and 1 of ($x*)))
+		uint16( 0 ) == 0x5a4d and filesize < 300000 and ( ( all of ( $s* ) and all of ( $z* ) ) or ( all of ( $s* ) and 1 of ( $x* ) ) )
 }
 rule SIGNATURE_BASE_Equation_Kaspersky_Doublefantasy_1 : FILE
 {
@@ -284674,10 +282715,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Doublefantasy_1 : FILE
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L109-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L109-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"
-		logic_hash = "4471601300616b5442de95a3eb23c28563206f3423b57fe81007d005203a439f"
+		logic_hash = "v1_sha256_4471601300616b5442de95a3eb23c28563206f3423b57fe81007d005203a439f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284697,7 +282738,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Doublefantasy_1 : FILE
 		$x7 = "September " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <350000 and (($z1) or ( all of ($s*) and 6 of ($x*)))
+		uint16( 0 ) == 0x5a4d and filesize < 350000 and ( ( $z1 ) or ( all of ( $s* ) and 6 of ( $x* ) ) )
 }
 rule SIGNATURE_BASE_Equation_Kaspersky_GROK_Keylogger : FILE
 {
@@ -284708,10 +282749,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_GROK_Keylogger : FILE
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L140-L172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L140-L172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"
-		logic_hash = "502afd23b92e948a8fba33ccc4da2f4b1ec91bce5a24d153ffc545129fd8c9fa"
+		logic_hash = "v1_sha256_502afd23b92e948a8fba33ccc4da2f4b1ec91bce5a24d153ffc545129fd8c9fa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284733,7 +282774,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_GROK_Keylogger : FILE
 		$z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250000 and ($s0 or ($s1 and 6 of ($x*)) or (6 of ($x*) and all of ($z*)))
+		uint16( 0 ) == 0x5a4d and filesize < 250000 and ( $s0 or ( $s1 and 6 of ( $x* ) ) or ( 6 of ( $x* ) and all of ( $z* ) ) )
 }
 rule SIGNATURE_BASE_Equation_Kaspersky_Greyfishinstaller
 {
@@ -284744,10 +282785,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Greyfishinstaller
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L174-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L174-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"
-		logic_hash = "dae6963f3210503c6c86c818a9cd6f309ba7876f14ca42966097023d474a2366"
+		logic_hash = "v1_sha256_dae6963f3210503c6c86c818a9cd6f309ba7876f14ca42966097023d474a2366"
 		score = 75
 		quality = 85
 		tags = ""
@@ -284770,10 +282811,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Equationdruginstaller : FILE
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L191-L213"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L191-L213"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "61fab1b8451275c7fd580895d9c68e152ff46417"
-		logic_hash = "815ed47a53bbc5f6c3fec3464336863028e804bde4681526ecac5de0cfff21b4"
+		logic_hash = "v1_sha256_815ed47a53bbc5f6c3fec3464336863028e804bde4681526ecac5de0cfff21b4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284791,7 +282832,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Equationdruginstaller : FILE
 		$x7 = "BINRES" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500000 and all of ($s*) and 5 of ($x*)
+		uint16( 0 ) == 0x5a4d and filesize < 500000 and all of ( $s* ) and 5 of ( $x* )
 }
 rule SIGNATURE_BASE_Equation_Kaspersky_Equationlaserinstaller : FILE
 {
@@ -284802,10 +282843,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Equationlaserinstaller : FILE
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L215-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L215-L236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"
-		logic_hash = "6f8ba26f5efaa7ec422171862e1b645472387395f0be3a4625d58de5f0584c0b"
+		logic_hash = "v1_sha256_6f8ba26f5efaa7ec422171862e1b645472387395f0be3a4625d58de5f0584c0b"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -284821,7 +282862,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Equationlaserinstaller : FILE
 		$s8 = "5.2.3790.220 (srv03_gdr.040918-1552)" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d) and filesize <250000 and 6 of ($s*)
+		( uint16( 0 ) == 0x5a4d ) and filesize < 250000 and 6 of ( $s* )
 }
 rule SIGNATURE_BASE_Equation_Kaspersky_Fannyworm : FILE
 {
@@ -284832,10 +282873,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Fannyworm : FILE
 		date = "2015-02-16"
 		modified = "2023-01-06"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L238-L277"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L238-L277"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"
-		logic_hash = "57e938ba1e53eeb99491547f53086eae3fc4d50bc5612e1b5ae6da6b029ac49e"
+		logic_hash = "v1_sha256_57e938ba1e53eeb99491547f53086eae3fc4d50bc5612e1b5ae6da6b029ac49e"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -284862,7 +282903,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Fannyworm : FILE
 		$x16 = "Global\\DirectMarketing" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d) and filesize <300000 and ((2 of ($s*)) or (1 of ($s*) and 6 of ($x*)) or (14 of ($x*)))
+		( uint16( 0 ) == 0x5a4d ) and filesize < 300000 and ( ( 2 of ( $s* ) ) or ( 1 of ( $s* ) and 6 of ( $x* ) ) or ( 14 of ( $x* ) ) )
 }
 rule SIGNATURE_BASE_Equation_Kaspersky_HDD_Reprogramming_Module : FILE
 {
@@ -284873,10 +282914,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_HDD_Reprogramming_Module : FILE
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L279-L297"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L279-L297"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
-		logic_hash = "65800e5f122dce1dd4473bc8cebce0f9258b38d570118b154dbaf6939b68f925"
+		logic_hash = "v1_sha256_65800e5f122dce1dd4473bc8cebce0f9258b38d570118b154dbaf6939b68f925"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284890,7 +282931,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_HDD_Reprogramming_Module : FILE
 		$s4 = "READ_REGISTER_UCHAR" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300000 and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 300000 and all of ( $s* )
 }
 rule SIGNATURE_BASE_Equation_Kaspersky_EOP_Package : FILE
 {
@@ -284901,10 +282942,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_EOP_Package : FILE
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L299-L318"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L299-L318"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"
-		logic_hash = "abbc562b8e822422ae1852a5675a680e797a6af0be5581a8482785bd0c1ad1bf"
+		logic_hash = "v1_sha256_abbc562b8e822422ae1852a5675a680e797a6af0be5581a8482785bd0c1ad1bf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284920,7 +282961,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_EOP_Package : FILE
 		$s6 = "cnFormVoidFBC" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100000 and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 100000 and all of ( $s* )
 }
 rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_Loader : FILE
 {
@@ -284931,10 +282972,10 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_Loader : FILE
 		date = "2015-02-16"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L320-L342"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L320-L342"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
-		logic_hash = "f49735a587085e95f1a8e405e42e5ff3eb4beda1f26c7b4c3c0a33bec21f48c7"
+		logic_hash = "v1_sha256_f49735a587085e95f1a8e405e42e5ff3eb4beda1f26c7b4c3c0a33bec21f48c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -284952,7 +282993,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_Loader : FILE
 		$s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50000 and ( all of ($x*) and all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 50000 and ( all of ( $x* ) and all of ( $s* ) )
 }
 rule SIGNATURE_BASE_Equation_Kaspersky_Suspiciousstring : FILE
 {
@@ -284963,9 +283004,9 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Suspiciousstring : FILE
 		date = "2015-02-17"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L346-L364"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd7f72c2263a3af9b8c9072b415a3b066e821e000b52ddd684ecb6b80a99067a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L346-L364"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd7f72c2263a3af9b8c9072b415a3b066e821e000b52ddd684ecb6b80a99067a"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -284980,7 +283021,7 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Suspiciousstring : FILE
 		$s6 = "c:\\users\\rmgree5\\"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500000 and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 500000 and all of ( $s* )
 }
 rule SIGNATURE_BASE_Equationdrug_Networksniffer1
 {
@@ -284991,10 +283032,10 @@ rule SIGNATURE_BASE_Equationdrug_Networksniffer1
 		date = "2015-03-11"
 		modified = "2023-01-06"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L368-L388"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L368-L388"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"
-		logic_hash = "ec90cba3b790c52f475a08b586f5af5a88ec46cfcf8abd74435981a34dfdb3f7"
+		logic_hash = "v1_sha256_ec90cba3b790c52f475a08b586f5af5a88ec46cfcf8abd74435981a34dfdb3f7"
 		score = 75
 		quality = 35
 		tags = ""
@@ -285021,10 +283062,10 @@ rule SIGNATURE_BASE_Equationdrug_Compatlayer_Unilaydll : FILE
 		date = "2015-03-11"
 		modified = "2023-12-05"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L390-L402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L390-L402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
-		logic_hash = "86434bd0456ea0c9ac9ed74dc3cf63520eb6b880dd4ea7920d0e82873dfec21e"
+		logic_hash = "v1_sha256_86434bd0456ea0c9ac9ed74dc3cf63520eb6b880dd4ea7920d0e82873dfec21e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285033,7 +283074,7 @@ rule SIGNATURE_BASE_Equationdrug_Compatlayer_Unilaydll : FILE
 		$s0 = "unilay.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $s0
+		uint16( 0 ) == 0x5a4d and $s0
 }
 rule SIGNATURE_BASE_Equationdrug_HDDSSD_Op
 {
@@ -285044,10 +283085,10 @@ rule SIGNATURE_BASE_Equationdrug_HDDSSD_Op
 		date = "2015-03-11"
 		modified = "2023-12-05"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L404-L416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L404-L416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
-		logic_hash = "9b45b2016a15f22079c439ff33c20e49d3c846fb4dd83caf2880767ea513a6e3"
+		logic_hash = "v1_sha256_9b45b2016a15f22079c439ff33c20e49d3c846fb4dd83caf2880767ea513a6e3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -285067,10 +283108,10 @@ rule SIGNATURE_BASE_Equationdrug_Networksniffer2
 		date = "2015-03-11"
 		modified = "2023-12-05"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L418-L437"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L418-L437"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"
-		logic_hash = "d29744a801194e5488795a8167965b94290be477efe478ee3e71c4bc98733967"
+		logic_hash = "v1_sha256_d29744a801194e5488795a8167965b94290be477efe478ee3e71c4bc98733967"
 		score = 75
 		quality = 35
 		tags = ""
@@ -285097,10 +283138,10 @@ rule SIGNATURE_BASE_Equationdrug_Networksniffer3
 		date = "2015-03-11"
 		modified = "2023-12-05"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L439-L454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L439-L454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "14599516381a9646cd978cf962c4f92386371040"
-		logic_hash = "18c516fe0cd74e7a02ee15260abf3d27bba992492e6042a148abdee3086a9a00"
+		logic_hash = "v1_sha256_18c516fe0cd74e7a02ee15260abf3d27bba992492e6042a148abdee3086a9a00"
 		score = 75
 		quality = 85
 		tags = ""
@@ -285123,10 +283164,10 @@ rule SIGNATURE_BASE_Equationdrug_Volrec_Driver
 		date = "2015-03-11"
 		modified = "2023-12-05"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L456-L470"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L456-L470"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"
-		logic_hash = "24b8202a8590ddb1dd76e01499d02282ad40a6fd6f6b9020040381a370e91f40"
+		logic_hash = "v1_sha256_24b8202a8590ddb1dd76e01499d02282ad40a6fd6f6b9020040381a370e91f40"
 		score = 75
 		quality = 85
 		tags = ""
@@ -285148,10 +283189,10 @@ rule SIGNATURE_BASE_Equationdrug_Kernelrootkit
 		date = "2015-03-11"
 		modified = "2023-01-06"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L472-L492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L472-L492"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "597715224249e9fb77dc733b2e4d507f0cc41af6"
-		logic_hash = "4b41af8656ada1b4db7ec11f65aeb2d335f424d8557cfa74a064b40c65627012"
+		logic_hash = "v1_sha256_4b41af8656ada1b4db7ec11f65aeb2d335f424d8557cfa74a064b40c65627012"
 		score = 75
 		quality = 60
 		tags = ""
@@ -285178,10 +283219,10 @@ rule SIGNATURE_BASE_Equationdrug_Keylogger
 		date = "2015-03-11"
 		modified = "2023-12-05"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L494-L509"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L494-L509"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"
-		logic_hash = "b5db0e6e24979b07cd180fed11545daef281e7b0858a7de001a83c2cbc186557"
+		logic_hash = "v1_sha256_b5db0e6e24979b07cd180fed11545daef281e7b0858a7de001a83c2cbc186557"
 		score = 75
 		quality = 85
 		tags = ""
@@ -285204,10 +283245,10 @@ rule SIGNATURE_BASE_Equationdrug_Platformorchestrator
 		date = "2015-03-11"
 		modified = "2023-12-05"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L537-L554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L537-L554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "febc4f30786db7804008dc9bc1cebdc26993e240"
-		logic_hash = "26c3b84a00702f155daa50c8f17e5f37e1aac46adde8a06a711e732a4cd806e9"
+		logic_hash = "v1_sha256_26c3b84a00702f155daa50c8f17e5f37e1aac46adde8a06a711e732a4cd806e9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -285232,10 +283273,10 @@ rule SIGNATURE_BASE_Equationdrug_Networksniffer5
 		date = "2015-03-11"
 		modified = "2023-01-06"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L556-L574"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L556-L574"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
-		logic_hash = "84f009e2ef639e5270273a7d9dd2542fdf1386c4c8363071d711e2333a112cd1"
+		logic_hash = "v1_sha256_84f009e2ef639e5270273a7d9dd2542fdf1386c4c8363071d711e2333a112cd1"
 		score = 75
 		quality = 60
 		tags = ""
@@ -285260,10 +283301,10 @@ rule SIGNATURE_BASE_Equationdrug_Filesystem_Filter
 		date = "2015-03-11"
 		modified = "2023-12-05"
 		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L576-L590"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L576-L590"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
-		logic_hash = "5da0c279da1b84a41e7d15df3c19cd50af1872156f133de0a367b9140425aa11"
+		logic_hash = "v1_sha256_5da0c279da1b84a41e7d15df3c19cd50af1872156f133de0a367b9140425aa11"
 		score = 75
 		quality = 85
 		tags = ""
@@ -285285,9 +283326,9 @@ rule SIGNATURE_BASE_Apt_Equation_Keyword : FILE
 		date = "2015-09-26"
 		modified = "2023-12-05"
 		reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_equation_fiveeyes.yar#L592-L603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d9a2b31d078eabbc930e9ec06e5ead5a6cda4eebf1c0ebe8164caf75a9d3cba6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_equation_fiveeyes.yar#L592-L603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d9a2b31d078eabbc930e9ec06e5ead5a6cda4eebf1c0ebe8164caf75a9d3cba6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285297,7 +283338,7 @@ rule SIGNATURE_BASE_Apt_Equation_Keyword : FILE
 		$a2 = "Backsnarf_AB25" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($a*)
+		uint16( 0 ) == 0x5a4d and 1 of ( $a* )
 }
 rule SIGNATURE_BASE_OSX_Backdoor_Bella : FILE
 {
@@ -285308,10 +283349,10 @@ rule SIGNATURE_BASE_OSX_Backdoor_Bella : FILE
 		date = "2018-02-23"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/JohnLaTwC/status/911998777182924801"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_osx_backdoor_bella.yar#L2-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_osx_backdoor_bella.yar#L2-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
-		logic_hash = "c2fa72072decd850698fbaaa9c2a6687cdf64e6bac068ff52a97963053db4339"
+		logic_hash = "v1_sha256_c2fa72072decd850698fbaaa9c2a6687cdf64e6bac068ff52a97963053db4339"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285333,11 +283374,8 @@ rule SIGNATURE_BASE_OSX_Backdoor_Bella : FILE
 		$subpart2_c = "iTunes" fullword ascii
 
 	condition:
-		uint32(0)==0x752f2123 and $h1 at 0 and filesize <120KB and @s0[1]<100 and @s1[1]<100 and @s2[1]<100 and 1 of ($p*) or all of ($subpart1_*) or all of ($subpart2_*)
+		uint32( 0 ) == 0x752f2123 and $h1 at 0 and filesize < 120KB and @s0 [ 1 ] < 100 and @s1 [ 1 ] < 100 and @s2 [ 1 ] < 100 and 1 of ( $p* ) or all of ( $subpart1_* ) or all of ( $subpart2_* )
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Apt_Projectsauron_Pipe_Backdoor : FILE
 {
 	meta:
@@ -285347,9 +283385,9 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Pipe_Backdoor : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron.yara#L4-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "72f6c6fa65f15e4bab18a0f9d5b5b2f571b21d70c7ff306020784ce604a2e0a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron.yara#L4-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_72f6c6fa65f15e4bab18a0f9d5b5b2f571b21d70c7ff306020784ce604a2e0a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285363,7 +283401,7 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Pipe_Backdoor : FILE
 		$a5 = "%s%s%X" fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*)) and filesize <100000
+		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) ) and filesize < 100000
 }
 import "pe"
 import "math"
@@ -285377,9 +283415,9 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_LSA : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron.yara#L23-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aaeee77b596e304836e23241fdc602d0ffed3379b386724210859c84033ac2b5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron.yara#L23-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aaeee77b596e304836e23241fdc602d0ffed3379b386724210859c84033ac2b5"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -285395,7 +283433,7 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_LSA : FILE
 		$a7 = {488D4C24304889442450488D452044886424304889442460488D4520C7442434030000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($a*) or (pe.exports("InitializeChangeNotify") and pe.exports("PasswordChangeNotify") and math.entropy(0x400, filesize )>=7.5)) and filesize <1000000
+		uint16( 0 ) == 0x5A4D and ( any of ( $a* ) or ( pe.exports ( "InitializeChangeNotify" ) and pe.exports ( "PasswordChangeNotify" ) and math.entropy ( 0x400 , filesize ) >= 7.5 ) ) and filesize < 1000000
 }
 import "pe"
 import "math"
@@ -285409,20 +283447,17 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_SSPI : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron.yara#L49-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "99d7444ffc45076e97ac3f5c9909ae26a927bbdcfef274d12d162c59e8113d65"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron.yara#L49-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_99d7444ffc45076e97ac3f5c9909ae26a927bbdcfef274d12d162c59e8113d65"
 		score = 75
 		quality = 60
 		tags = "FILE"
 		version = "1.0"
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1000000 and pe.exports("InitSecurityInterfaceA") and pe.characteristics&pe.DLL and (pe.machine==pe.MACHINE_AMD64 or pe.machine==pe.MACHINE_IA64) and math.entropy(0x400, filesize )>=7.5
+		uint16( 0 ) == 0x5A4D and filesize < 1000000 and pe.exports ( "InitSecurityInterfaceA" ) and pe.characteristics & pe.DLL and ( pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64 ) and math.entropy ( 0x400 , filesize ) >= 7.5
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Apt_Projectsauron_Mytrampoline : FILE
 {
 	meta:
@@ -285432,9 +283467,9 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Mytrampoline : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron.yara#L65-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bd98815fbf6e82cf477e4f4f98360a4c132b2b21e2e5991f6c10903bd4df52b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron.yara#L65-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bd98815fbf6e82cf477e4f4f98360a4c132b2b21e2e5991f6c10903bd4df52b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285448,9 +283483,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Mytrampoline : FILE
 		$b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and filesize <5000000 and ( all of ($a*) or any of ($b*))
+		uint16( 0 ) == 0x5A4D and filesize < 5000000 and ( all of ( $a* ) or any of ( $b* ) )
 }
-import "pe"
 import "math"
 
 rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_Container : FILE
@@ -285462,9 +283496,9 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_Container : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron.yara#L85-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9b36f2f1161fd2ff856db520efca8648892656b7a2587dce1a7445af4fbba013"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron.yara#L85-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9b36f2f1161fd2ff856db520efca8648892656b7a2587dce1a7445af4fbba013"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -285475,11 +283509,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_Container : FILE
 		$salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}
 
 	condition:
-		uint16(0)==0x5A4D and ((@vfs_header<0x4000) or $salt) and math.entropy(0x400, filesize )>=6.5 and ( filesize >0x400) and filesize <10000000
+		uint16( 0 ) == 0x5A4D and ( ( @vfs_header < 0x4000 ) or $salt ) and math.entropy ( 0x400 , filesize ) >= 6.5 and ( filesize > 0x400 ) and filesize < 10000000
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Apt_Projectsauron_Encryption : FILE
 {
 	meta:
@@ -285489,9 +283520,9 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encryption : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron.yara#L105-L123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ae3a681b0cf9ed93d25fa35982daab48c460ba9737eb643ba28a972ea3a7b401"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron.yara#L105-L123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ae3a681b0cf9ed93d25fa35982daab48c460ba9737eb643ba28a972ea3a7b401"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285503,11 +283534,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encryption : FILE
 		$a3 = {803E225775??807E019F75??807E02BE75??807E0309}
 
 	condition:
-		filesize <5000000 and any of ($a*)
+		filesize < 5000000 and any of ( $a* )
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Apt_Projectsauron_Generic_Pipe_Backdoor : FILE
 {
 	meta:
@@ -285517,9 +283545,9 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Generic_Pipe_Backdoor : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron.yara#L125-L144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec8a311ec1bd98532c278f72c77e58edb5890db940046dfcd14adf1495e9de1e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron.yara#L125-L144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec8a311ec1bd98532c278f72c77e58edb5890db940046dfcd14adf1495e9de1e"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -285533,7 +283561,7 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Generic_Pipe_Backdoor : FILE
 		$e = "WS2_32"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of them ) and filesize <400000
+		uint16( 0 ) == 0x5A4D and ( all of them ) and filesize < 400000
 }
 rule SIGNATURE_BASE_Sofacy_Fybis_ELF_Backdoor_Gen1 : FILE
 {
@@ -285544,9 +283572,9 @@ rule SIGNATURE_BASE_Sofacy_Fybis_ELF_Backdoor_Gen1 : FILE
 		date = "2016-02-13"
 		modified = "2023-01-27"
 		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_fysbis.yar#L9-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fb5239aa75512c8c83b066e64b75469f90fb22cb0918af1e44edb29e7ab38206"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_fysbis.yar#L9-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fb5239aa75512c8c83b066e64b75469f90fb22cb0918af1e44edb29e7ab38206"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -285566,7 +283594,7 @@ rule SIGNATURE_BASE_Sofacy_Fybis_ELF_Backdoor_Gen1 : FILE
 		$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <500KB and 1 of ($x*)) or (1 of ($x*) and 3 of ($s*))
+		( uint16( 0 ) == 0x457f and filesize < 500KB and 1 of ( $x* ) ) or ( 1 of ( $x* ) and 3 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Sofacy_Fysbis_ELF_Backdoor_Gen2 : FILE
 {
@@ -285577,9 +283605,9 @@ rule SIGNATURE_BASE_Sofacy_Fysbis_ELF_Backdoor_Gen2 : FILE
 		date = "2016-02-13"
 		modified = "2023-12-05"
 		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_fysbis.yar#L37-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1d50a789e9c43fce27f3ad390cbdd9533c61e4f263cec1aa1abfba6545e55c57"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_fysbis.yar#L37-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1d50a789e9c43fce27f3ad390cbdd9533c61e4f263cec1aa1abfba6545e55c57"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -285594,7 +283622,7 @@ rule SIGNATURE_BASE_Sofacy_Fysbis_ELF_Backdoor_Gen2 : FILE
 		$s3 = "HttpChannel" ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <500KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos : FILE
 {
@@ -285605,9 +283633,9 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos : FILE
 		date = "2020-11-02"
 		modified = "2023-12-05"
 		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lnx_kobalos.yar#L32-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "48aec47b70633d4c8cb55d90a2e168f3c2027ef27cfe1cd5d30dcdc08a2ff717"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lnx_kobalos.yar#L32-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_48aec47b70633d4c8cb55d90a2e168f3c2027ef27cfe1cd5d30dcdc08a2ff717"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285626,7 +283654,7 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos : FILE
 		$strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
 
 	condition:
-		uint16(0)==0x457f and any of them
+		uint16( 0 ) == 0x457f and any of them
 }
 rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos_SSH_Credential_Stealer : FILE
 {
@@ -285637,9 +283665,9 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos_SSH_Credential_Stealer : FILE
 		date = "2020-11-02"
 		modified = "2023-12-05"
 		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lnx_kobalos.yar#L59-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fdabaea0c838e43b8716bcd102bdeebf2f08fc041b0b909333e3d9d6f94391fc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lnx_kobalos.yar#L59-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fdabaea0c838e43b8716bcd102bdeebf2f08fc041b0b909333e3d9d6f94391fc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285650,10 +283678,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos_SSH_Credential_Stealer : FILE
 		$ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"
 
 	condition:
-		uint16(0)==0x457f and any of them
+		uint16( 0 ) == 0x457f and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_1 : FILE
 {
 	meta:
@@ -285663,9 +283689,9 @@ rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_1 : FILE
 		date = "2018-01-28"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_suckfly.yar#L14-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf617259df00b16272caffa8f1ffcf8d29cb98cb6ab85ca52e0bb0706f0cd5b0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_suckfly.yar#L14-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf617259df00b16272caffa8f1ffcf8d29cb98cb6ab85ca52e0bb0706f0cd5b0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285678,10 +283704,8 @@ rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_1 : FILE
 		$s3 = "CreateRemoteThread Succ" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_2 : FILE
 {
 	meta:
@@ -285691,9 +283715,9 @@ rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_2 : FILE
 		date = "2018-01-28"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_suckfly.yar#L31-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2e4f6a920e063113a9ff252869e1c2ebdf5a2495b4adb1edaf9500904234f362"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_suckfly.yar#L31-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2e4f6a920e063113a9ff252869e1c2ebdf5a2495b4adb1edaf9500904234f362"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285715,7 +283739,7 @@ rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_2 : FILE
 		$s9 = "DllRegisterServer is called" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 4 of them )
 }
 import "pe"
 
@@ -285728,9 +283752,9 @@ rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_3 : FILE
 		date = "2018-01-28"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_suckfly.yar#L61-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4fddb55999bbbeecd92863219e878c840640e4d17008cb789a255528ef3fac9c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_suckfly.yar#L61-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4fddb55999bbbeecd92863219e878c840640e4d17008cb789a255528ef3fac9c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285750,7 +283774,7 @@ rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_3 : FILE
 		$s3 = "%s\\%08x.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="ae0f4ebf7e8ce91d6548318a3cf82b7a" or 1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "ae0f4ebf7e8ce91d6548318a3cf82b7a" or 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Chinese_Keyboard_Layout
 {
@@ -285761,9 +283785,9 @@ rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Chinese_Keyboard_Layout
 		date = "2019-10-12"
 		modified = "2020-12-16"
 		reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/log_teamviewer_keyboard_layouts.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ba3bc7cbdfc5a47f6bc4cd9049c52eb95d25465af107ae3d068ef785b714279a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/log_teamviewer_keyboard_layouts.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ba3bc7cbdfc5a47f6bc4cd9049c52eb95d25465af107ae3d068ef785b714279a"
 		score = 60
 		quality = 85
 		tags = ""
@@ -285776,7 +283800,7 @@ rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Chinese_Keyboard_Layout
 		$fp2 = "Changing keyboard layout to: 042a042a" ascii
 
 	condition:
-		(#x1+#x2)>(#fp1+#fp2)
+		(#x1 + #x2 ) > ( #fp1 + #fp2 )
 }
 rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Russian_Keyboard_Layout
 {
@@ -285787,9 +283811,9 @@ rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Russian_Keyboard_Layout
 		date = "2019-10-12"
 		modified = "2022-12-07"
 		reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/log_teamviewer_keyboard_layouts.yar#L23-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9de52ec41fb410fcff50d49eb7871eadd07b520c3cfa089e1eeecc580e610eaa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/log_teamviewer_keyboard_layouts.yar#L23-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9de52ec41fb410fcff50d49eb7871eadd07b520c3cfa089e1eeecc580e610eaa"
 		score = 60
 		quality = 85
 		tags = ""
@@ -285800,7 +283824,7 @@ rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Russian_Keyboard_Layout
 		$fp1 = "Changing keyboard layout to: 04190419" ascii
 
 	condition:
-		#x1>#fp1
+		#x1> #fp1
 }
 rule SIGNATURE_BASE_Gen_Python_Pyminifier_Encoded_Payload : FILE
 {
@@ -285811,8 +283835,8 @@ rule SIGNATURE_BASE_Gen_Python_Pyminifier_Encoded_Payload : FILE
 		date = "2019-12-16"
 		modified = "2023-12-05"
 		reference = "https://github.com/liftoff/pyminifier"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_python_pyminifier_encoded_payload.yar#L1-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_python_pyminifier_encoded_payload.yar#L1-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "01df8765ea35db382d1dd67a502bf1d9647d8fe818ec31abff41c7e41c2816c0"
 		hash = "15d201152a9465497a0f9dd6939e48315b358702c5e2a3c506ad436bb8816da7"
 		hash = "ab91f76394ddf866cc0b315d862a19b57ded93be5dfc2dd0a81e6a43d0c5f301"
@@ -285821,7 +283845,7 @@ rule SIGNATURE_BASE_Gen_Python_Pyminifier_Encoded_Payload : FILE
 		hash = "dd2b0e2c2cb8a83574248bda54ce472899b22eb602e8ebecafcce2c4355177fe"
 		hash = "ed76bd136f40a23aeffe0aba02f13b9fea3428c19b715aafa6ea9be91e4006ca"
 		hash = "b454179c13cb4727ae06cc9cd126c3379e2aded5c293af0234ac3312bf9bdad2"
-		logic_hash = "6e744d9404ca476766b217fe808ba6a8cc6cbf09232a69aae6259acd377080a0"
+		logic_hash = "v1_sha256_6e744d9404ca476766b217fe808ba6a8cc6cbf09232a69aae6259acd377080a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285832,7 +283856,7 @@ rule SIGNATURE_BASE_Gen_Python_Pyminifier_Encoded_Payload : FILE
 		$s3 = "zlib" fullword
 
 	condition:
-		filesize <20KB and uint32be(0)==0x696d706f and all of them
+		filesize < 20KB and uint32be( 0 ) == 0x696d706f and all of them
 }
 rule SIGNATURE_BASE_SUSP_Vulndriver_HP_Hardware_Diagnostics_Etdsupp_May23 : FILE
 {
@@ -285843,10 +283867,10 @@ rule SIGNATURE_BASE_SUSP_Vulndriver_HP_Hardware_Diagnostics_Etdsupp_May23 : FILE
 		date = "2023-05-12"
 		modified = "2023-12-05"
 		reference = "https://github.com/alfarom256/HPHardwareDiagnostics-PoC/tree/main/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/susp_vulndriver_hp_hardware_diagnostics_etdsupp_may23.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/susp_vulndriver_hp_hardware_diagnostics_etdsupp_may23.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
-		logic_hash = "bb50f591e49b1b0b08ccbe4ca5cb3685d8f358e51e6d6f77677bc05701f6b301"
+		logic_hash = "v1_sha256_bb50f591e49b1b0b08ccbe4ca5cb3685d8f358e51e6d6f77677bc05701f6b301"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -285857,7 +283881,7 @@ rule SIGNATURE_BASE_SUSP_Vulndriver_HP_Hardware_Diagnostics_Etdsupp_May23 : FILE
 		$s3 = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}([\x00-\xff]{2}[\x00-\x11]\x00[\x00-\xff]{4}|\x00\x00\x12\x00\x00\x00\x00\x00)/
 
 	condition:
-		uint16(0)==0x5a4d and int16 ( uint32(0x3C)+0x5c)==0x0001 and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Cloudduke_Malware : FILE
 {
@@ -285868,9 +283892,9 @@ rule SIGNATURE_BASE_Cloudduke_Malware : FILE
 		date = "2015-07-22"
 		modified = "2023-12-05"
 		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cloudduke.yar#L10-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eaa159a99b6518db736adfd555bfcd052c2ae21b2e60a1db80b90459c47c90ab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cloudduke.yar#L10-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eaa159a99b6518db736adfd555bfcd052c2ae21b2e60a1db80b90459c47c90ab"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -285894,7 +283918,7 @@ rule SIGNATURE_BASE_Cloudduke_Malware : FILE
 		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <720KB and 4 of ($s*) and 1 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 720KB and 4 of ( $s* ) and 1 of ( $op* )
 }
 rule SIGNATURE_BASE_SFXRAR_Acrotray : FILE
 {
@@ -285905,9 +283929,9 @@ rule SIGNATURE_BASE_SFXRAR_Acrotray : FILE
 		date = "2015-07-22"
 		modified = "2023-12-05"
 		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cloudduke.yar#L42-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b318ab2854eb7614dd1a42d3971a96d1d485d5cce552336ad3a7f39886ba710"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cloudduke.yar#L42-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b318ab2854eb7614dd1a42d3971a96d1d485d5cce552336ad3a7f39886ba710"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -285923,7 +283947,7 @@ rule SIGNATURE_BASE_SFXRAR_Acrotray : FILE
 		$s4 = "CryptUnprotectMemory failed" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2449KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2449KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_Doc_Windowsinstaller_Call_Feb22_1 : FILE
 {
@@ -285934,9 +283958,9 @@ rule SIGNATURE_BASE_SUSP_Doc_Windowsinstaller_Call_Feb22_1 : FILE
 		date = "2022-02-26"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/threatinsight/status/1497355737844133895"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_maldoc.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "279182487ab7d35264adfbd0d122ee7634cd92ae1711de78ec7f20928df34f49"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_maldoc.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_279182487ab7d35264adfbd0d122ee7634cd92ae1711de78ec7f20928df34f49"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -285948,7 +283972,7 @@ rule SIGNATURE_BASE_SUSP_Doc_Windowsinstaller_Call_Feb22_1 : FILE
 		$ = "InstallProduct"
 
 	condition:
-		uint32be(0)==0xd0cf11e0 and all of them
+		uint32be( 0 ) == 0xd0cf11e0 and all of them
 }
 import "pe"
 
@@ -285961,9 +283985,9 @@ rule SIGNATURE_BASE_MAL_PE_Type_Babyshark_Loader : FILE
 		date = "2019-02-24"
 		modified = "2023-12-05"
 		reference = "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_babyshark.yar#L4-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0ab9a30cb731922d965a9cf58094fea36d5c74b9989324efee603808591ea6a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_babyshark.yar#L4-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0ab9a30cb731922d965a9cf58094fea36d5c74b9989324efee603808591ea6a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -285976,10 +284000,8 @@ rule SIGNATURE_BASE_MAL_PE_Type_Babyshark_Loader : FILE
                2E 44 4C 4C 00 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and (pe.imphash()=="57b6d88707d9cd1c87169076c24f962e" or 1 of them or for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "thawte SHA256 Code Signing CA" and pe.signatures[i].serial=="0f:ff:e4:32:a5:3f:f0:3b:92:23:f8:8b:e1:b8:3d:9d"))
+		uint16( 0 ) == 0x5a4d and ( pe.imphash ( ) == "57b6d88707d9cd1c87169076c24f962e" or 1 of them or for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "thawte SHA256 Code Signing CA" and pe.signatures [ i ] . serial == "0f:ff:e4:32:a5:3f:f0:3b:92:23:f8:8b:e1:b8:3d:9d" ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_NK_Babyshark_Kimjoingrat_Apr19_1 : FILE
 {
 	meta:
@@ -285989,9 +284011,9 @@ rule SIGNATURE_BASE_APT_NK_Babyshark_Kimjoingrat_Apr19_1 : FILE
 		date = "2019-04-27"
 		modified = "2023-12-05"
 		reference = "https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_babyshark.yar#L29-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3fec0f21e299e09ae9734f256edbbca81a53f860b42e99a78b07d344552f1062"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_babyshark.yar#L29-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3fec0f21e299e09ae9734f256edbbca81a53f860b42e99a78b07d344552f1062"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -286008,7 +284030,7 @@ rule SIGNATURE_BASE_APT_NK_Babyshark_Kimjoingrat_Apr19_1 : FILE
 		$s6 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or ($a1 and 3 of ($s*)))
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or ( $a1 and 3 of ( $s* ) ) )
 }
 rule SIGNATURE_BASE_LOG_EXPL_Proxytoken_Exploitation_Aug21_1 : CVE_2021_33766
 {
@@ -286019,9 +284041,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Proxytoken_Exploitation_Aug21_1 : CVE_2021_33766
 		date = "2021-08-30"
 		modified = "2023-12-05"
 		reference = "https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2021_33766_proxytoken.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff0c3e4f7491f5faec3e2688819ea5ec636a7d4eb57941afff6f53f60b0c0293"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2021_33766_proxytoken.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff0c3e4f7491f5faec3e2688819ea5ec636a7d4eb57941afff6f53f60b0c0293"
 		score = 75
 		quality = 85
 		tags = "CVE-2021-33766"
@@ -286035,7 +284057,7 @@ rule SIGNATURE_BASE_LOG_EXPL_Proxytoken_Exploitation_Aug21_1 : CVE_2021_33766
 		$sb2 = "SecurityToken=" ascii
 
 	condition:
-		all of ($ss*) and ( all of ($sa*) or all of ($sb*))
+		all of ( $ss* ) and ( all of ( $sa* ) or all of ( $sb* ) )
 }
 rule SIGNATURE_BASE_FVEY_Shadowbroker_Auct_Dez16_Strings : FILE
 {
@@ -286046,9 +284068,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Auct_Dez16_Strings : FILE
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L11-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c632d90c5b26b840b267647faf453f85496b78c900910ad22896698c553c949"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L11-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c632d90c5b26b840b267647faf453f85496b78c900910ad22896698c553c949"
 		score = 60
 		quality = 60
 		tags = "FILE"
@@ -286103,7 +284125,7 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Auct_Dez16_Strings : FILE
 		$pe3 = "ghost_x86" fullword ascii wide
 
 	condition:
-		( uint16(0)==0x457f and 1 of ($elf*)) or ( uint16(0)==0x5a4d and 1 of ($pe*)) or 1 of ($s*)
+		( uint16( 0 ) == 0x457f and 1 of ( $elf* ) ) or ( uint16( 0 ) == 0x5a4d and 1 of ( $pe* ) ) or 1 of ( $s* )
 }
 rule SIGNATURE_BASE_FVEY_Shadowbroker_Violetspirit
 {
@@ -286114,9 +284136,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Violetspirit
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L73-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "01a45feb5c9f9cfe8834306993c53b1e53d79b89b07106ffec0c81cdebb8b71c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L73-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_01a45feb5c9f9cfe8834306993c53b1e53d79b89b07106ffec0c81cdebb8b71c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286138,9 +284160,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gr_Gr
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L88-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "facce45a335d7ca799d68fc26ee2bf5682cec0914502482189cd6aa496cba489"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L88-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_facce45a335d7ca799d68fc26ee2bf5682cec0914502482189cd6aa496cba489"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286162,9 +284184,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Yellowspirit
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L103-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "698b23cc4cc6f319ddef7a93cf7ddc83ffae1d2c2b0a9545011b51e381f8cd0c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L103-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_698b23cc4cc6f319ddef7a93cf7ddc83ffae1d2c2b0a9545011b51e381f8cd0c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286187,9 +284209,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Eleganteagle_Opscript_1_0_0
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L119-L132"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3df5ba1a497ffe5306ed7966f25f69c30a5191e935c5638869a62b3cb2324f70"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L119-L132"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3df5ba1a497ffe5306ed7966f25f69c30a5191e935c5638869a62b3cb2324f70"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286211,9 +284233,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Opscript
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L134-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "23dd6d537a8639bd84ede141cca577dc91328bd293f96f865c7dedd9ef693ee3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L134-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_23dd6d537a8639bd84ede141cca577dc91328bd293f96f865c7dedd9ef693ee3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286235,9 +284257,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Shentysdelight
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L149-L162"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1acfb6aea7e208b7fd52325258219c162482deb4fa7ee87ddc4de0774e3e74f4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L149-L162"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1acfb6aea7e208b7fd52325258219c162482deb4fa7ee87ddc4de0774e3e74f4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286259,9 +284281,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Epichero
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L164-L178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "36dc38f2dd630f22b87e8d9130de7d40ee3cdba45597b2b667a1a9536d990aad"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L164-L178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_36dc38f2dd630f22b87e8d9130de7d40ee3cdba45597b2b667a1a9536d990aad"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286284,9 +284306,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L180-L193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8135c07b8c217e81f7618d58c9c3da6585cdb9b8f7afab85bb6556c5b846ba64"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L180-L193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8135c07b8c217e81f7618d58c9c3da6585cdb9b8f7afab85bb6556c5b846ba64"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286308,9 +284330,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Dubmoat
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L195-L209"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "368c0a6a1db0003e3a2e4ec5e42a5b5563ea1c2cb89db1751226891e1f7181d8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L195-L209"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_368c0a6a1db0003e3a2e4ec5e42a5b5563ea1c2cb89db1751226891e1f7181d8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286333,9 +284355,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Strifeworld
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L211-L225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2b113b042fd62109ee3ee39515fbd22f3898abf320d75f1288ea88e40b3444c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L211-L225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2b113b042fd62109ee3ee39515fbd22f3898abf320d75f1288ea88e40b3444c0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286358,9 +284380,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Pork
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L227-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c3f9f90f83f3672b101e52f36012c485c29840cf0b2ced00087fb27725fd1545"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L227-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c3f9f90f83f3672b101e52f36012c485c29840cf0b2ced00087fb27725fd1545"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286384,9 +284406,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Ebbisland
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L244-L258"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a45ea3cd6aeea9299ef67ae82c9f4bf929a961695e7cce344aa1737fa4c07b0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L244-L258"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a45ea3cd6aeea9299ef67ae82c9f4bf929a961695e7cce344aa1737fa4c07b0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286409,9 +284431,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Stoicsurgeon
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L260-L273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "322599ba7d5536b7f0856980a6caab86de66c02da75bf55e97bf129d08c43031"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L260-L273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_322599ba7d5536b7f0856980a6caab86de66c02da75bf55e97bf129d08c43031"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286433,9 +284455,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Elgingamble
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L275-L288"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2f4dd668c59244e92ebfe0e2fc2859b2376cf1dd6fc6522e8f452787aa96365f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L275-L288"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2f4dd668c59244e92ebfe0e2fc2859b2376cf1dd6fc6522e8f452787aa96365f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286457,9 +284479,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_README_Cup
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L290-L304"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bd05a23ce29be88c1a459358c984e1317cf56d21e5b378624af644fb2b41931d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L290-L304"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bd05a23ce29be88c1a459358c984e1317cf56d21e5b378624af644fb2b41931d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286482,9 +284504,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Nopen_Oneshot
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L306-L319"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "19aa32aafaaccc6697bbaff642d996554eccf2261d23071cfb8599ea0eea628b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L306-L319"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_19aa32aafaaccc6697bbaff642d996554eccf2261d23071cfb8599ea0eea628b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286506,9 +284528,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Earlyshovel
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L321-L334"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "396810b439ac53f393ad37a8acbd7236f8325730c75c1a6339e4c6343ecade7a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L321-L334"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_396810b439ac53f393ad37a8acbd7236f8325730c75c1a6339e4c6343ecade7a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286530,9 +284552,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Envisioncollision
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L336-L352"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "36b2a20ef3a6540a686d7f52c8c885842fd84ba7c7daa74c21e241e25826030e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L336-L352"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_36b2a20ef3a6540a686d7f52c8c885842fd84ba7c7daa74c21e241e25826030e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286557,9 +284579,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme1
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L356-L372"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "171d3df191e5c9ae4a4afc3a878cc25548238046b8c4c52dbb9ca4431aae45b0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L356-L372"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_171d3df191e5c9ae4a4afc3a878cc25548238046b8c4c52dbb9ca4431aae45b0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286584,9 +284606,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme2
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L374-L389"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb68c415d64d1db3d4bb0f4ad994bd050cb2287e4dc7b3ac57549f818a7914d8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L374-L389"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb68c415d64d1db3d4bb0f4ad994bd050cb2287e4dc7b3ac57549f818a7914d8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286610,9 +284632,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme3
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L391-L411"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "968ec80f26750ac734ad9e296b5afb35867f6c53de1e88f7c8af78daeac24b61"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L391-L411"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_968ec80f26750ac734ad9e296b5afb35867f6c53de1e88f7c8af78daeac24b61"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286641,9 +284663,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme4
 		date = "2016-12-17"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_dec16.yar#L413-L429"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c19c77d7e7e26e01a9a50fd67cc0a7fd05069def878bf18726c3e115df307cb2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_dec16.yar#L413-L429"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c19c77d7e7e26e01a9a50fd67cc0a7fd05069def878bf18726c3e115df307cb2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286668,10 +284690,10 @@ rule SIGNATURE_BASE_Locky_Ransomware
 		date = "2016-02-17"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/qScSrE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_locky.yar#L8-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_locky.yar#L8-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
-		logic_hash = "c7584ea39c4aceedeb0ea2952be6ff212461674175855274f1783eef80ffba86"
+		logic_hash = "v1_sha256_c7584ea39c4aceedeb0ea2952be6ff212461674175855274f1783eef80ffba86"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286681,7 +284703,7 @@ rule SIGNATURE_BASE_Locky_Ransomware
 		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 }
 
 	condition:
-		all of ($o*)
+		all of ( $o* )
 }
 rule SIGNATURE_BASE_MAL_RTF_Embedded_OLE_PE : FILE
 {
@@ -286692,9 +284714,9 @@ rule SIGNATURE_BASE_MAL_RTF_Embedded_OLE_PE : FILE
 		date = "2018-01-22"
 		modified = "2023-11-25"
 		reference = "https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_strings_in_ole.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "054abb34ae84e02469d726809a6d8aa582ebad65dd8385de7800d3f5db7ee31c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_strings_in_ole.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_054abb34ae84e02469d726809a6d8aa582ebad65dd8385de7800d3f5db7ee31c"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -286709,7 +284731,7 @@ rule SIGNATURE_BASE_MAL_RTF_Embedded_OLE_PE : FILE
 		$m1 = "4d5a90000300000004000000ffff"
 
 	condition:
-		uint32be(0)==0x7B5C7274 and 1 of them
+		uint32be( 0 ) == 0x7B5C7274 and 1 of them
 }
 import "pe"
 
@@ -286722,9 +284744,9 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1 : FILE
 		date = "2023-03-29"
 		modified = "2023-04-20"
 		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L3-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "68f4007791d365900c84e32e076aa3cac9f3a9ed46de297f1005306554ee13f5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L3-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_68f4007791d365900c84e32e076aa3cac9f3a9ed46de297f1005306554ee13f5"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -286743,10 +284765,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1 : FILE
 		$opb4 = { 49 63 C1 44 0F B6 44 05 ?? 44 88 5C 05 ?? 44 88 02 0F B6 54 05 ?? 49 03 D0 0F B6 C2 0F B6 54 05 ?? 41 30 12}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5MB and pe.characteristics&pe.DLL and (2 of ($opa*) or 2 of ($opb*))
+		uint16( 0 ) == 0x5a4d and filesize < 5MB and pe.characteristics & pe.DLL and ( 2 of ( $opa* ) or 2 of ( $opb* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_2 : FILE
 {
 	meta:
@@ -286756,9 +284776,9 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_2 : FILE
 		date = "2023-03-29"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/dan__mayer/status/1641170769194672128?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L32-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dec8310c1f5b304a755737a0005bb33b1762f21ed380b2b98b0f5427948ab930"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L32-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dec8310c1f5b304a755737a0005bb33b1762f21ed380b2b98b0f5427948ab930"
 		score = 80
 		quality = 60
 		tags = "FILE"
@@ -286774,10 +284794,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_2 : FILE
 		$op5 = { f7 f3 03 d5 69 ca e8 03 00 00 ff 15 c9 0a 02 00 48 8d 44 24 30 45 33 c0 4c 8d 4c 24 38 48 89 44 24 20 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 3 of them or 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and 3 of them or 5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_3
 {
 	meta:
@@ -286787,9 +284805,9 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_3
 		date = "2023-03-29"
 		modified = "2023-12-05"
 		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L56-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "adfe04904d796690631e5841ee1ee10c767f9f4c340e5b9df78918e981359d4d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L56-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_adfe04904d796690631e5841ee1ee10c767f9f4c340e5b9df78918e981359d4d"
 		score = 80
 		quality = 85
 		tags = ""
@@ -286804,10 +284822,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_3
 		$opb4 = { 33 C0 48 8D 6B ?? 4C 8D 4C 24 ?? 89 44 24 ?? BA ?? ?? ?? ?? 48 89 44 24 ?? 48 8B CD 89 44 24 ?? 44 8D 40 ?? 8B F8 FF 15}
 
 	condition:
-		( all of ($opa*)) or (1 of ($opa*) and 1 of ($opb*)) or (3 of ($opb*))
+		( all of ( $opa* ) ) or ( 1 of ( $opa* ) and 1 of ( $opb* ) ) or ( 3 of ( $opb* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1
 {
 	meta:
@@ -286817,9 +284833,9 @@ rule SIGNATURE_BASE_SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1
 		date = "2023-03-29"
 		modified = "2023-04-20"
 		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L81-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dcce1f5e769a2821d746a960cd333f8042fb71c8469aa41c29bbbd0dce79369c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L81-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dcce1f5e769a2821d746a960cd333f8042fb71c8469aa41c29bbbd0dce79369c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -286834,8 +284850,6 @@ rule SIGNATURE_BASE_SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_SUSP_NK_3CX_RC4_Key_Mar23_1 : FILE
 {
 	meta:
@@ -286845,9 +284859,9 @@ rule SIGNATURE_BASE_APT_SUSP_NK_3CX_RC4_Key_Mar23_1 : FILE
 		date = "2023-03-29"
 		modified = "2023-12-05"
 		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L100-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8324b537b149ad3816b12ae0f887f66a284a8e1ef4fe7cf51eb21d59c0f055b9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L100-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8324b537b149ad3816b12ae0f887f66a284a8e1ef4fe7cf51eb21d59c0f055b9"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -286860,7 +284874,7 @@ rule SIGNATURE_BASE_APT_SUSP_NK_3CX_RC4_Key_Mar23_1 : FILE
 		$x1 = "3jB(2bsG#@c7"
 
 	condition:
-		( uint16(0)==0xcfd0 or uint16(0)==0x5a4d) and $x1
+		( uint16( 0 ) == 0xcfd0 or uint16( 0 ) == 0x5a4d ) and $x1
 }
 import "pe"
 
@@ -286873,9 +284887,9 @@ rule SIGNATURE_BASE_SUSP_3CX_App_Signed_Binary_Mar23_1 : FILE
 		date = "2023-03-29"
 		modified = "2023-12-05"
 		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L119-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3834b5ebb5a0db27a452fda1c97c921b2c9c8702505738232b15a3ed4a47dc47"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L119-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3834b5ebb5a0db27a452fda1c97c921b2c9c8702505738232b15a3ed4a47dc47"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -286888,10 +284902,8 @@ rule SIGNATURE_BASE_SUSP_3CX_App_Signed_Binary_Mar23_1 : FILE
 		$sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
 
 	condition:
-		uint16(0)==0x5a4d and pe.timestamp>1669680000 and pe.timestamp<1680108505 and all of ($sa*) and $sc1
+		uint16( 0 ) == 0x5a4d and pe.timestamp > 1669680000 and pe.timestamp < 1680108505 and all of ( $sa* ) and $sc1
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_3CX_MSI_Signed_Binary_Mar23_1 : FILE
 {
 	meta:
@@ -286901,9 +284913,9 @@ rule SIGNATURE_BASE_SUSP_3CX_MSI_Signed_Binary_Mar23_1 : FILE
 		date = "2023-03-29"
 		modified = "2023-12-05"
 		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L141-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b0fa9821a02803473ce8139b19d005968b03c9765cff5b9ae5428a259d88cc9f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L141-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b0fa9821a02803473ce8139b19d005968b03c9765cff5b9ae5428a259d88cc9f"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -286917,10 +284929,8 @@ rule SIGNATURE_BASE_SUSP_3CX_MSI_Signed_Binary_Mar23_1 : FILE
 		$s2 = "202303"
 
 	condition:
-		uint16(0)==0xcfd0 and $a1 and $sc1 and ($s1 in ( filesize -20000.. filesize ) and $s2 in ( filesize -20000.. filesize ))
+		uint16( 0 ) == 0xcfd0 and $a1 and $sc1 and ( $s1 in ( filesize - 20000 .. filesize ) and $s2 in ( filesize - 20000 .. filesize ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_Malicious_Samples_Mar23_1 : FILE
 {
 	meta:
@@ -286930,9 +284940,9 @@ rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_Malicious_Samples_Mar23_1 : FILE
 		date = "2023-03-30"
 		modified = "2023-12-05"
 		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L168-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c2733c2f7dcca82e5a0b2301777fb54853d04dfa893bcf88ecbec34d37e1a38a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L168-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c2733c2f7dcca82e5a0b2301777fb54853d04dfa893bcf88ecbec34d37e1a38a"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -286945,10 +284955,8 @@ rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_Malicious_Samples_Mar23_1 : FILE
 		$s2 = "Developer ID Application: 3CX (33CF4654HL)"
 
 	condition:
-		( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and all of them
+		( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_DYLIB_Mar23_1
 {
 	meta:
@@ -286958,9 +284966,9 @@ rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_DYLIB_Mar23_1
 		date = "2023-03-30"
 		modified = "2023-12-05"
 		reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e52c76de1e995cc7084ddb390b60f4bc66e5bdf89aaa28ef3fd70578ed3145a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e52c76de1e995cc7084ddb390b60f4bc66e5bdf89aaa28ef3fd70578ed3145a6"
 		score = 80
 		quality = 85
 		tags = ""
@@ -286982,8 +284990,6 @@ rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_DYLIB_Mar23_1
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1
 {
 	meta:
@@ -286993,9 +284999,9 @@ rule SIGNATURE_BASE_APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1
 		date = "2023-03-30"
 		modified = "2023-12-05"
 		reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L216-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ab8a4ac184eaba6eb56bfc49d6fa03f9b0877d75294aa9a242e9ac96482fab0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L216-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ab8a4ac184eaba6eb56bfc49d6fa03f9b0877d75294aa9a242e9ac96482fab0"
 		score = 70
 		quality = 85
 		tags = ""
@@ -287010,8 +285016,6 @@ rule SIGNATURE_BASE_APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_4
 {
 	meta:
@@ -287021,10 +285025,10 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_4
 		date = "2023-03-29"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/WhichbufferArda/status/1641404343323688964?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L234-L249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L234-L249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "851c2c99ebafd4e5e9e140cfe3f2d03533846ca16f8151ae8ee0e83c692884b7"
-		logic_hash = "2fd56527a094b1f155cf33af402328835d4fb8aee9a058742d3e3763acef9e46"
+		logic_hash = "v1_sha256_2fd56527a094b1f155cf33af402328835d4fb8aee9a058742d3e3763acef9e46"
 		score = 80
 		quality = 85
 		tags = ""
@@ -287037,8 +285041,6 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_4
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Backdoor_Mar23 : FILE
 {
 	meta:
@@ -287048,10 +285050,10 @@ rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Backdoor_Mar23 : FILE
 		date = "2023-03-30"
 		modified = "2023-12-05"
 		reference = "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
-		logic_hash = "777a0a29c376f3697021dd627e716c31bda7933c5f40a8fe79b80e3cea46ce43"
+		logic_hash = "v1_sha256_777a0a29c376f3697021dd627e716c31bda7933c5f40a8fe79b80e3cea46ce43"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287063,10 +285065,8 @@ rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Backdoor_Mar23 : FILE
 		$op2 = { 0F 11 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 31 C0 80 B4 04 ?? ?? ?? ?? ?? 48 FF C0}
 
 	condition:
-		(( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and filesize <6MB and ((1 of ($sa*) and 1 of ($op*)) or all of ($sa*))) or ( all of ($op*))
+		(( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and filesize < 6MB and ( ( 1 of ( $sa* ) and 1 of ( $op* ) ) or all of ( $sa* ) ) ) or ( all of ( $op* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1 : FILE
 {
 	meta:
@@ -287076,9 +285076,9 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1 : FILE
 		date = "2023-03-31"
 		modified = "2023-12-05"
 		reference = "https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/attachments/iconicstealer.7z"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L279-L304"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1f57a2af4a5b9e71e2b72ddc3839400731d9d37eb4349c393b37b3f86c0c7f73"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L279-L304"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1f57a2af4a5b9e71e2b72ddc3839400731d9d37eb4349c393b37b3f86c0c7f73"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287095,10 +285095,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1 : FILE
 		$op2 = { 48 8b c8 8b 56 f0 48 89 46 d8 e8 78 8f f8 ff e9 ec 13 00 00 c7 46 20 ff ff ff ff e9 e0 13 00 00 33 ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and 4 of them or 6 of them
+		uint16( 0 ) == 0x5a4d and filesize < 4000KB and 4 of them or 6 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_NK_3CX_Macos_Elextron_App_Mar23_1 : FILE
 {
 	meta:
@@ -287108,9 +285106,9 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Macos_Elextron_App_Mar23_1 : FILE
 		date = "2023-03-31"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L306-L328"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "00dd28c3edd94e04e35ee9e3a43c30b5a0a1ad21ec8ecf2099bbeb9de2fca8d0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L306-L328"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_00dd28c3edd94e04e35ee9e3a43c30b5a0a1ad21ec8ecf2099bbeb9de2fca8d0"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287124,10 +285122,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Macos_Elextron_App_Mar23_1 : FILE
 		$s2 = "o8NQKPJE6voVZUIGtXihq7lp0cY=" ascii
 
 	condition:
-		uint16(0)==0xfacf and filesize <400KB and ( all of ($a*) and 1 of ($s*))
+		uint16( 0 ) == 0xfacf and filesize < 400KB and ( all of ( $a* ) and 1 of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Updateagent_Mar23 : FILE
 {
 	meta:
@@ -287137,10 +285133,10 @@ rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Updateagent_Mar23 : FILE
 		date = "2023-03-30"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/patrickwardle/status/1641692164303515653?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L330-L354"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L330-L354"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9e9a5f8d86356796162cee881c843cde9eaedfb3"
-		logic_hash = "0818a8f0b59a9baaefaa0b505f8261e0e0df283e79da8e95dc71e9afdca224ab"
+		logic_hash = "v1_sha256_0818a8f0b59a9baaefaa0b505f8261e0e0df283e79da8e95dc71e9afdca224ab"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287153,10 +285149,8 @@ rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Updateagent_Mar23 : FILE
 		$s4 = "\"AccountName\": \""
 
 	condition:
-		uint16(0)==0xfeca and filesize <6MB and (1 of ($x*) or ($a1 and all of ($s*))) or all of them
+		uint16( 0 ) == 0xfeca and filesize < 6MB and ( 1 of ( $x* ) or ( $a1 and all of ( $s* ) ) ) or all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2
 {
 	meta:
@@ -287166,10 +285160,10 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2
 		date = "2023-04-29"
 		modified = "2023-12-05"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L373-L392"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L373-L392"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c4887a5cd6d98e273ba6e9ea3c1d8f770ef26239819ea24a1bfebd81d6870505"
-		logic_hash = "a15f7f06be5e620baf33d595afc35246dae0307978984af832940a74ef2c84eb"
+		logic_hash = "v1_sha256_a15f7f06be5e620baf33d595afc35246dae0307978984af832940a74ef2c84eb"
 		score = 80
 		quality = 85
 		tags = ""
@@ -287183,10 +285177,8 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2
 		$op3 = { 48 89 74 24 ?? 45 33 C0 89 74 24 ?? 41 B9 ?? ?? ?? ?? 89 74 24 ?? 48 8B D8 48 C7 00 ?? ?? ?? ?? 48 8B 0F 41 8D 50 ?? 48 89 44 24 ?? 89 74 24 ?? FF 15}
 
 	condition:
-		all of ($op*) or all of ($sa*)
+		all of ( $op* ) or all of ( $sa* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3
 {
 	meta:
@@ -287196,10 +285188,10 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3
 		date = "2023-04-29"
 		modified = "2023-12-05"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L394-L410"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L394-L410"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "595392959b609caf088d027a23443cf2fefd043607ccdec3de19ad3bb43a74b1"
-		logic_hash = "58f860926db4a7dfefbd39ee35efaa0081b7e31a361efce02f5144266ab652a6"
+		logic_hash = "v1_sha256_58f860926db4a7dfefbd39ee35efaa0081b7e31a361efce02f5144266ab652a6"
 		score = 80
 		quality = 85
 		tags = ""
@@ -287213,8 +285205,6 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4
 {
 	meta:
@@ -287224,10 +285214,10 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4
 		date = "2023-04-29"
 		modified = "2023-12-05"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_3cx_compromise_mar23.yar#L412-L428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_3cx_compromise_mar23.yar#L412-L428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9b0761f81afb102bb784b398b16faa965594e469a7fcfdfd553ced19cc17e70b"
-		logic_hash = "ad22df404d948073428fc35b0c8fbfea25da3bc66e46ea6397ff751ae65d5939"
+		logic_hash = "v1_sha256_ad22df404d948073428fc35b0c8fbfea25da3bc66e46ea6397ff751ae65d5939"
 		score = 80
 		quality = 85
 		tags = ""
@@ -287252,9 +285242,9 @@ rule SIGNATURE_BASE_ATM_Malware_Dispenserxfs_1 : FILE
 		date = "2019-02-27"
 		modified = "2023-01-06"
 		reference = "https://twitter.com/r3c0nst/status/1100775857306652673"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_atm_dispenserxfs.yar#L4-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c7331b29f7cd8c40f99e235664f86361ba99c9ca0092c1cfb6faf367764303e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_atm_dispenserxfs.yar#L4-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c7331b29f7cd8c40f99e235664f86361ba99c9ca0092c1cfb6faf367764303e"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287267,7 +285257,7 @@ rule SIGNATURE_BASE_ATM_Malware_Dispenserxfs_1 : FILE
 		$s5 = "Waiting for freeze msxfs processes..." fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and (1 of them or pe.imphash()=="617e037ae26d1931818db0790fb44bfe")
+		uint16( 0 ) == 0x5A4D and ( 1 of them or pe.imphash ( ) == "617e037ae26d1931818db0790fb44bfe" )
 }
 rule SIGNATURE_BASE_SUSP_Macro_Staroffice : FILE
 {
@@ -287278,9 +285268,9 @@ rule SIGNATURE_BASE_SUSP_Macro_Staroffice : FILE
 		date = "2019-02-06"
 		modified = "2021-05-27"
 		reference = "https://twitter.com/JohnLaTwC/status/1093259873993732096"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_macro_staroffice_suspicious.yar#L1-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49385335488fa0a598ed48203d9483c5c2f53ae287e003a8cf7d64d56280e62a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_macro_staroffice_suspicious.yar#L1-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49385335488fa0a598ed48203d9483c5c2f53ae287e003a8cf7d64d56280e62a"
 		score = 60
 		quality = 81
 		tags = "FILE"
@@ -287307,7 +285297,7 @@ rule SIGNATURE_BASE_SUSP_Macro_Staroffice : FILE
 		$fp1 = "LibreOffice project" ascii
 
 	condition:
-		filesize <1MB and uint32be(0)==0x3c3f786d and all of ($r*) and 1 of ($s*) and not 1 of ($fp*)
+		filesize < 1MB and uint32be( 0 ) == 0x3c3f786d and all of ( $r* ) and 1 of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_RUAG_Tavdig_Malformed_Executable : FILE
 {
@@ -287318,15 +285308,15 @@ rule SIGNATURE_BASE_RUAG_Tavdig_Malformed_Executable : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ruag.yar#L9-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2a6eb90cc77f4556da0b5b0211bf0c4759dae0d78e9c6b765eff0e9a34f52e0f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ruag.yar#L9-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2a6eb90cc77f4556da0b5b0211bf0c4759dae0d78e9c6b765eff0e9a34f52e0f"
 		score = 60
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x0000AD0B
+		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x0000AD0B
 }
 rule SIGNATURE_BASE_RUAG_Bot_Config_File : FILE
 {
@@ -287337,9 +285327,9 @@ rule SIGNATURE_BASE_RUAG_Bot_Config_File : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ruag.yar#L21-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "256808511233da446ec69db4f5a5e23a237296c100e79e78bbe5e4964fa5dde6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ruag.yar#L21-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_256808511233da446ec69db4f5a5e23a237296c100e79e78bbe5e4964fa5dde6"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -287350,7 +285340,7 @@ rule SIGNATURE_BASE_RUAG_Bot_Config_File : FILE
 		$s3 = "exe = cmd.exe" ascii
 
 	condition:
-		uint32(0)==0x4e4f435b and $s1 at 0 and $s2 and $s3 and filesize <160
+		uint32( 0 ) == 0x4e4f435b and $s1 at 0 and $s2 and $s3 and filesize < 160
 }
 rule SIGNATURE_BASE_RUAG_Cobra_Malware : FILE
 {
@@ -287361,9 +285351,9 @@ rule SIGNATURE_BASE_RUAG_Cobra_Malware : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ruag.yar#L36-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5576e8e465eb289e8da44009cb2237080c5b5c3eb6d7a337634d91c5d68ecd80"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ruag.yar#L36-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5576e8e465eb289e8da44009cb2237080c5b5c3eb6d7a337634d91c5d68ecd80"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -287372,7 +285362,7 @@ rule SIGNATURE_BASE_RUAG_Cobra_Malware : FILE
 		$s1 = "\\Cobra\\Release\\Cobra.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and $s1
+		uint16( 0 ) == 0x5a4d and $s1
 }
 rule SIGNATURE_BASE_RUAG_Cobra_Config_File : FILE
 {
@@ -287383,9 +285373,9 @@ rule SIGNATURE_BASE_RUAG_Cobra_Config_File : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ruag.yar#L49-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "703a89562f3a2e5692883892f468288276459ad528cd371b1ac226e1d1c4be02"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ruag.yar#L49-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_703a89562f3a2e5692883892f468288276459ad528cd371b1ac226e1d1c4be02"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -287404,7 +285394,7 @@ rule SIGNATURE_BASE_RUAG_Cobra_Config_File : FILE
 		$s10 = "address1" ascii
 
 	condition:
-		uint32(0)==0x4d414e5b and $h1 at 0 and 8 of ($s*) and filesize <5KB
+		uint32( 0 ) == 0x4d414e5b and $h1 at 0 and 8 of ( $s* ) and filesize < 5KB
 }
 rule SIGNATURE_BASE_RUAG_Exfil_Config_File : FILE
 {
@@ -287415,9 +285405,9 @@ rule SIGNATURE_BASE_RUAG_Exfil_Config_File : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ruag.yar#L73-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "379e8762932ca565f3bd35ec241aef2d0445fbe6182a041e4d4e16a1170202ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ruag.yar#L73-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_379e8762932ca565f3bd35ec241aef2d0445fbe6182a041e4d4e16a1170202ef"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -287431,7 +285421,7 @@ rule SIGNATURE_BASE_RUAG_Exfil_Config_File : FILE
 		$s5 = "pfsgrowperiod" ascii
 
 	condition:
-		uint32(0)==0x4152545b and $h1 at 0 and all of ($s*) and filesize <1KB
+		uint32( 0 ) == 0x4152545b and $h1 at 0 and all of ( $s* ) and filesize < 1KB
 }
 import "pe"
 
@@ -287444,9 +285434,9 @@ rule SIGNATURE_BASE_Cmstar_Malware_Sep17 : FILE
 		date = "2017-10-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/pTffPA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cmstar.yar#L13-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "498b6a3e02cf4979babe6379c2d6b3529d2a28210d44a8ce05aef1acdd325953"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cmstar.yar#L13-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_498b6a3e02cf4979babe6379c2d6b3529d2a28210d44a8ce05aef1acdd325953"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -287458,7 +285448,7 @@ rule SIGNATURE_BASE_Cmstar_Malware_Sep17 : FILE
 		$s2 = "StateNum:%d,FileSize:%d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="22021985de78a48ea8fb82a2ff9eb693" or pe.exports("WinCred") or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "22021985de78a48ea8fb82a2ff9eb693" or pe.exports ( "WinCred" ) or all of them )
 }
 rule SIGNATURE_BASE_Malware_QA_Not_Copy : FILE
 {
@@ -287469,9 +285459,9 @@ rule SIGNATURE_BASE_Malware_QA_Not_Copy : FILE
 		date = "2016-08-29"
 		modified = "2023-12-05"
 		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_malware_set_qa.yar#L13-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4001d71101a9c6d4134e7ed4b9b03d34ada62241a668970e21a60d7a23dd7b86"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_malware_set_qa.yar#L13-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4001d71101a9c6d4134e7ed4b9b03d34ada62241a668970e21a60d7a23dd7b86"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287490,7 +285480,7 @@ rule SIGNATURE_BASE_Malware_QA_Not_Copy : FILE
 		$s6 = "netsh firewall delete allowedprogram" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 4 of ($s*))) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_Malware_QA_Update : FILE
 {
@@ -287501,9 +285491,9 @@ rule SIGNATURE_BASE_Malware_QA_Update : FILE
 		date = "2016-08-29"
 		modified = "2023-12-05"
 		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_malware_set_qa.yar#L39-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "97e0fec7bb4ebf326b449cc0d65eb9f024b33e1d2e54c6d3893164b66c024b2a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_malware_set_qa.yar#L39-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_97e0fec7bb4ebf326b449cc0d65eb9f024b33e1d2e54c6d3893164b66c024b2a"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287528,7 +285518,7 @@ rule SIGNATURE_BASE_Malware_QA_Update : FILE
 		$s8 = "POST /index.php/1.0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or 3 of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Malware_QA_Tls : FILE
 {
@@ -287539,9 +285529,9 @@ rule SIGNATURE_BASE_Malware_QA_Tls : FILE
 		date = "2016-08-29"
 		modified = "2023-12-05"
 		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_malware_set_qa.yar#L71-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "20c849d8c60acd77a28244c7ebcbb2f96b233e74af6c52112a0c828e1de2ed84"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_malware_set_qa.yar#L71-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_20c849d8c60acd77a28244c7ebcbb2f96b233e74af6c52112a0c828e1de2ed84"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287554,7 +285544,7 @@ rule SIGNATURE_BASE_Malware_QA_Tls : FILE
 		$s3 = "ultimate-payload-template1" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Malware_QA_Get_The_Fucking_IP : FILE
 {
@@ -287565,9 +285555,9 @@ rule SIGNATURE_BASE_Malware_QA_Get_The_Fucking_IP : FILE
 		date = "2016-08-29"
 		modified = "2023-12-05"
 		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_malware_set_qa.yar#L89-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ab6a60142ef0e7a6e079a1b62da0b962dc3b59584b785516e93c74669574a81b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_malware_set_qa.yar#L89-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ab6a60142ef0e7a6e079a1b62da0b962dc3b59584b785516e93c74669574a81b"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287582,7 +285572,7 @@ rule SIGNATURE_BASE_Malware_QA_Get_The_Fucking_IP : FILE
 		$x5 = "MDR3M kik: Mdr3mhm" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 1 of ($x*)) or (2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of ( $x* ) ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Malware_QA_Vqgk : FILE
 {
@@ -287593,9 +285583,9 @@ rule SIGNATURE_BASE_Malware_QA_Vqgk : FILE
 		date = "2016-08-29"
 		modified = "2022-12-21"
 		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_malware_set_qa.yar#L109-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "19b7099cdb8a984f1ba6cf88024db398a81ac4f4bf3c16cac40c5ee0e5b465fd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_malware_set_qa.yar#L109-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_19b7099cdb8a984f1ba6cf88024db398a81ac4f4bf3c16cac40c5ee0e5b465fd"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287618,7 +285608,7 @@ rule SIGNATURE_BASE_Malware_QA_Vqgk : FILE
 		$s9 = "Failed to impersonate token from %d (%u)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 5 of ($s*))) or (7 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 5 of ( $s* ) ) ) or ( 7 of them )
 }
 rule SIGNATURE_BASE_Malware_QA_1177 : FILE
 {
@@ -287629,9 +285619,9 @@ rule SIGNATURE_BASE_Malware_QA_1177 : FILE
 		date = "2016-08-29"
 		modified = "2023-12-05"
 		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_malware_set_qa.yar#L139-L161"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0fa8e6c048bcc51553e8078a71416013696dd937c1508cd636873eab56c3797f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_malware_set_qa.yar#L139-L161"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0fa8e6c048bcc51553e8078a71416013696dd937c1508cd636873eab56c3797f"
 		score = 80
 		quality = 81
 		tags = "FILE"
@@ -287648,7 +285638,7 @@ rule SIGNATURE_BASE_Malware_QA_1177 : FILE
 		$s5 = "'%CopyToStartUp%" fullword ascii
 
 	condition:
-		( uint16(0)==0x4d27 and filesize <100KB and (1 of ($x*) or 4 of ($s*))) or (5 of them )
+		( uint16( 0 ) == 0x4d27 and filesize < 100KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_MAL_Fake_Document_Software_Indicators_Nov23 : FILE
 {
@@ -287659,9 +285649,9 @@ rule SIGNATURE_BASE_MAL_Fake_Document_Software_Indicators_Nov23 : FILE
 		date = "2023-11-13"
 		modified = "2024-04-24"
 		reference = "https://nochlab.blogspot.com/2023/09/net-in-javascript-fake-pdf-converter.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_fake_document_software.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5f0a088bf672559fbac90313768d41b79be7f1f56c6ddb36f0dcd265a07f98b2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_fake_document_software.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5f0a088bf672559fbac90313768d41b79be7f1f56c6ddb36f0dcd265a07f98b2"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -287676,7 +285666,7 @@ rule SIGNATURE_BASE_MAL_Fake_Document_Software_Indicators_Nov23 : FILE
 		$ = "www.pdfconvertercompare.com" wide
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Polyvice_Jan23_1 : FILE
 {
@@ -287687,9 +285677,9 @@ rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Polyvice_Jan23_1 : FILE
 		date = "2023-01-12"
 		modified = "2023-01-13"
 		reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ransom_vicesociety_dec22.yar#L2-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c7b76a693e5666515afee5c819b21e119ce5f1b0be675252673e6a24251ce8d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ransom_vicesociety_dec22.yar#L2-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c7b76a693e5666515afee5c819b21e119ce5f1b0be675252673e6a24251ce8d"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -287708,7 +285698,7 @@ rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Polyvice_Jan23_1 : FILE
 		$op3 = { 48 29 c4 4c 8d 74 24 30 4c 89 f1 e8 46 3c 00 00 84 c0 41 89 c4 0f 85 2b 02 00 00 0f b7 45 f2 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 2 of them ) or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 2 of them ) or 4 of them
 }
 rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Chily_Jan23_1 : FILE
 {
@@ -287719,9 +285709,9 @@ rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Chily_Jan23_1 : FILE
 		date = "2023-01-12"
 		modified = "2023-12-05"
 		reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ransom_vicesociety_dec22.yar#L33-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fc2967d86bf73033e68b8b9409a197ae8f7fcdf06e1e2a17e3d277d243caa541"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ransom_vicesociety_dec22.yar#L33-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fc2967d86bf73033e68b8b9409a197ae8f7fcdf06e1e2a17e3d277d243caa541"
 		score = 80
 		quality = 83
 		tags = "FILE"
@@ -287741,7 +285731,7 @@ rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Chily_Jan23_1 : FILE
 		$op3 = { 31 c0 47 8d 2c 00 45 85 f6 4d 63 ed 0f 8e ec 00 00 00 0f 1f 80 00 00 00 00 0f b7 94 44 40 0c 00 00 83 c1 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 3 of them ) or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
 }
 rule SIGNATURE_BASE_EXPL_Log4J_Callbackdomain_Iocs_Dec21_1 : CVE_2021_44228
 {
@@ -287752,9 +285742,9 @@ rule SIGNATURE_BASE_EXPL_Log4J_Callbackdomain_Iocs_Dec21_1 : CVE_2021_44228
 		date = "2021-12-12"
 		modified = "2023-12-05"
 		reference = "https://gist.github.com/superducktoes/9b742f7b44c71b4a0d19790228ce85d8"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8d5e60f91b715242c6f8ee806ab81d3e296ce1467cf2d065b053f33e3ae00f14"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8d5e60f91b715242c6f8ee806ab81d3e296ce1467cf2d065b053f33e3ae00f14"
 		score = 60
 		quality = 85
 		tags = "CVE-2021-44228"
@@ -287774,9 +285764,9 @@ rule SIGNATURE_BASE_EXPL_JNDI_Exploit_Patterns_Dec21_1
 		date = "2021-12-12"
 		modified = "2023-12-05"
 		reference = "https://github.com/pimps/JNDI-Exploit-Kit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L16-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9442c8c4eee76539892752361657c86e80acc7990876e787317b042a4637f669"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L16-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9442c8c4eee76539892752361657c86e80acc7990876e787317b042a4637f669"
 		score = 60
 		quality = 85
 		tags = ""
@@ -287805,7 +285795,7 @@ rule SIGNATURE_BASE_EXPL_JNDI_Exploit_Patterns_Dec21_1
 		$fp1 = "<html"
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		1 of ( $x* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_JAVA_Exception_Dec21_1 : CVE_2021_44228
 {
@@ -287816,9 +285806,9 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_JAVA_Exception_Dec21_1 : CVE_2021_
 		date = "2021-12-12"
 		modified = "2023-12-05"
 		reference = "https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L51-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "98eabec4ad2f5c4d22db9c3bebdc82c8dc6723599748360875fc7b613b1019ab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L51-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_98eabec4ad2f5c4d22db9c3bebdc82c8dc6723599748360875fc7b613b1019ab"
 		score = 60
 		quality = 85
 		tags = "CVE-2021-44228"
@@ -287829,7 +285819,7 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_JAVA_Exception_Dec21_1 : CVE_2021_
 		$sa2 = "Error looking up JNDI resource"
 
 	condition:
-		$xa1 or all of ($sa*)
+		$xa1 or all of ( $sa* )
 }
 rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Soft : FILE CVE_2021_44228
 {
@@ -287840,9 +285830,9 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Soft : FILE CVE_2021_44228
 		date = "2021-12-10"
 		modified = "2021-12-20"
 		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L68-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "61a005060e2041afa5a9aa0b2a5e26cfc9a53cbafa78b15e4dd2c3b38127373a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L68-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_61a005060e2041afa5a9aa0b2a5e26cfc9a53cbafa78b15e4dd2c3b38127373a"
 		score = 60
 		quality = 85
 		tags = "FILE, CVE-2021-44228"
@@ -287861,7 +285851,7 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Soft : FILE CVE_2021_44228
 		$fp2 = "/nessus}"
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		1 of ( $x* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_OBFUSC : CVE_2021_44228
 {
@@ -287872,9 +285862,9 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_OBFUSC : CVE_2021_44228
 		date = "2021-12-12"
 		modified = "2021-12-13"
 		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L94-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "00231db2ae83a89c187dbde1f2bc67fdaedcf1cbdf872afdcc374d2d0abee515"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L94-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_00231db2ae83a89c187dbde1f2bc67fdaedcf1cbdf872afdcc374d2d0abee515"
 		score = 60
 		quality = 85
 		tags = "CVE-2021-44228"
@@ -287891,7 +285881,7 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_OBFUSC : CVE_2021_44228
 		$fp1 = "<html"
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		1 of ( $x* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Hard : FILE CVE_2021_44228
 {
@@ -287902,9 +285892,9 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Hard : FILE CVE_2021_44228
 		date = "2021-12-10"
 		modified = "2023-10-23"
 		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L118-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9a4fc285dd1680ebc8a1042eeb5fbba73b9e2df70678adf3163122d84405325e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L118-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9a4fc285dd1680ebc8a1042eeb5fbba73b9e2df70678adf3163122d84405325e"
 		score = 75
 		quality = 85
 		tags = "FILE, CVE-2021-44228"
@@ -287920,7 +285910,7 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Hard : FILE CVE_2021_44228
 		$fp3 = "/nessus}"
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		1 of ( $x* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21 : CVE_2021_44228
 {
@@ -287931,9 +285921,9 @@ rule SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21 : CVE_2021_4422
 		date = "2021-12-10"
 		modified = "2021-12-13"
 		reference = "https://twitter.com/Reelix/status/1469327487243071493"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L142-L165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "703a83916c7279bcdc3cd61602472c2a3815140235be169f5b2063a547438c61"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L142-L165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_703a83916c7279bcdc3cd61602472c2a3815140235be169f5b2063a547438c61"
 		score = 70
 		quality = 85
 		tags = "CVE-2021-44228"
@@ -287948,7 +285938,7 @@ rule SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21 : CVE_2021_4422
 		$fp1 = "<html"
 
 	condition:
-		1 of ($sa*) and 1 of ($sb*) and not 1 of ($fp*)
+		1 of ( $sa* ) and 1 of ( $sb* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Jdniexploit_Indicators_Dec21 : FILE
 {
@@ -287959,9 +285949,9 @@ rule SIGNATURE_BASE_SUSP_Jdniexploit_Indicators_Dec21 : FILE
 		date = "2021-12-10"
 		modified = "2021-12-12"
 		reference = "https://github.com/flypig5211/JNDIExploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L167-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7886a67672001f0db72575d96d3a12341bfcdc49a9951e3d5e2a88ab46bf5a5d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L167-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7886a67672001f0db72575d96d3a12341bfcdc49a9951e3d5e2a88ab46bf5a5d"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -287970,7 +285960,7 @@ rule SIGNATURE_BASE_SUSP_Jdniexploit_Indicators_Dec21 : FILE
 		$xr1 = /(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/\/[a-zA-Z0-9\.]{7,80}:[0-9]{2,5}\/(Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass)\//
 
 	condition:
-		filesize <100MB and $xr1
+		filesize < 100MB and $xr1
 }
 rule SIGNATURE_BASE_SUSP_EXPL_OBFUSC_Dec21_1 : CVE_2021_44228 FILE
 {
@@ -287981,9 +285971,9 @@ rule SIGNATURE_BASE_SUSP_EXPL_OBFUSC_Dec21_1 : CVE_2021_44228 FILE
 		date = "2021-12-11"
 		modified = "2022-11-08"
 		reference = "https://twitter.com/testanull/status/1469549425521348609"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L182-L211"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d6ffb70da82fe16e7a76feb31c01aa3e0cfc5625cc0e2b237ec851c646550839"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L182-L211"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d6ffb70da82fe16e7a76feb31c01aa3e0cfc5625cc0e2b237ec851c646550839"
 		score = 60
 		quality = 85
 		tags = "CVE-2021-44228, FILE"
@@ -288000,7 +285990,7 @@ rule SIGNATURE_BASE_SUSP_EXPL_OBFUSC_Dec21_1 : CVE_2021_44228 FILE
 		$fp1 = "<html"
 
 	condition:
-		(1 of ($x*) or filesize <200KB and 1 of ($f*)) and not 1 of ($fp*)
+		(1 of ( $x* ) or filesize < 200KB and 1 of ( $f* ) ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Jdniexploit_Error_Indicators_Dec21_1
 {
@@ -288011,9 +286001,9 @@ rule SIGNATURE_BASE_SUSP_Jdniexploit_Error_Indicators_Dec21_1
 		date = "2021-12-10"
 		modified = "2023-06-23"
 		reference = "https://twitter.com/marcioalm/status/1470361495405875200?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_log4j_cve_2021_44228.yar#L213-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2ab98814b2ed66b0bda875fecc0b09db82035d7edcdb0af65f815817ec8c6cc8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_log4j_cve_2021_44228.yar#L213-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2ab98814b2ed66b0bda875fecc0b09db82035d7edcdb0af65f815817ec8c6cc8"
 		score = 70
 		quality = 85
 		tags = ""
@@ -288035,10 +286025,10 @@ rule SIGNATURE_BASE_APT_Donotteam_Ytyframework : APT DONOTTEAM WINDOWS FILE
 		date = "2018-08-03"
 		modified = "2023-12-05"
 		reference = "https://labs.bitdefender.com/2017/09/ehdevel-the-story-of-a-continuously-improving-advanced-threat-creation-toolkit/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_donotteam_ytyframework.yar#L3-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_donotteam_ytyframework.yar#L3-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1e0c1b97925e1ed90562d2c68971e038d8506b354dd6c1d2bcc252d2a48bc31c"
-		logic_hash = "8e2841fd4550f12d88fb451a893f1ba41f0d3c123d9c195fe97366202376ef61"
+		logic_hash = "v1_sha256_8e2841fd4550f12d88fb451a893f1ba41f0d3c123d9c195fe97366202376ef61"
 		score = 75
 		quality = 83
 		tags = "APT, DONOTTEAM, WINDOWS, FILE"
@@ -288068,7 +286058,7 @@ rule SIGNATURE_BASE_APT_Donotteam_Ytyframework : APT DONOTTEAM WINDOWS FILE
 		$s12 = "saveLogs" ascii fullword
 
 	condition:
-		uint16be(0)==0x4d5a and filesize <500KB and (pe.imphash()=="87775285899fa860b9963b11596a2ded" or 1 of ($x*) or 3 of ($a*) or 6 of ($s*))
+		uint16be( 0 ) == 0x4d5a and filesize < 500KB and ( pe.imphash ( ) == "87775285899fa860b9963b11596a2ded" or 1 of ( $x* ) or 3 of ( $a* ) or 6 of ( $s* ) )
 }
 import "pe"
 
@@ -288081,9 +286071,9 @@ rule SIGNATURE_BASE_MAL_Ryuk_Ransomware : FILE
 		date = "2018-12-31"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ryuk_ransomware.yar#L3-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "01e8ad348e5954374fc0f9fc25ba1ee83db4a2a50e622b27640aa2eb394dc5a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ryuk_ransomware.yar#L3-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_01e8ad348e5954374fc0f9fc25ba1ee83db4a2a50e622b27640aa2eb394dc5a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288098,7 +286088,7 @@ rule SIGNATURE_BASE_MAL_Ryuk_Ransomware : FILE
 		$x5 = "RyukReadMe.txt" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="4a069c1abe5aca148d5a8fdabc26751e" or pe.imphash()=="dc5733c013378fa418d13773f5bfe6f1" or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "4a069c1abe5aca148d5a8fdabc26751e" or pe.imphash ( ) == "dc5733c013378fa418d13773f5bfe6f1" or 1 of them )
 }
 rule SIGNATURE_BASE_MAL_Backdoor_Naikon_APT_Sample1 : FILE
 {
@@ -288109,11 +286099,11 @@ rule SIGNATURE_BASE_MAL_Backdoor_Naikon_APT_Sample1 : FILE
 		date = "2015-05-14"
 		modified = "2023-01-06"
 		reference = "https://goo.gl/7vHyvh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_naikon.yar#L2-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_naikon.yar#L2-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
 		hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
-		logic_hash = "e582fc3518dab2392a79909b5369c48656b6f280b915fad4befb0839ec7ce1bd"
+		logic_hash = "v1_sha256_e582fc3518dab2392a79909b5369c48656b6f280b915fad4befb0839ec7ce1bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288138,7 +286128,7 @@ rule SIGNATURE_BASE_MAL_Backdoor_Naikon_APT_Sample1 : FILE
 		$s12 = "\\cmd.exe" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 7 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 7 of ( $s* ) )
 }
 rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_1 : FILE
 {
@@ -288149,9 +286139,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_1 : FILE
 		date = "2023-02-04"
 		modified = "2023-12-05"
 		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ransom_esxi_attacks_feb23.yar#L6-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1143ee36603f604874432ee280314a9f62ffe64e58ec5cd4eb114b7b175b365a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ransom_esxi_attacks_feb23.yar#L6-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1143ee36603f604874432ee280314a9f62ffe64e58ec5cd4eb114b7b175b365a"
 		score = 85
 		quality = 60
 		tags = "FILE"
@@ -288165,7 +286155,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_1 : FILE
 		$s2 = "/bin/find / -name *.log -exec /bin" ascii fullword
 
 	condition:
-		uint16(0)==0x2123 and filesize <10KB and (1 of ($x*) or 2 of them ) or 3 of them
+		uint16( 0 ) == 0x2123 and filesize < 10KB and ( 1 of ( $x* ) or 2 of them ) or 3 of them
 }
 rule SIGNATURE_BASE_MAL_RANSOM_ELF_Esxi_Attacks_Feb23_1 : FILE
 {
@@ -288176,9 +286166,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_ELF_Esxi_Attacks_Feb23_1 : FILE
 		date = "2023-02-04"
 		modified = "2023-12-05"
 		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ransom_esxi_attacks_feb23.yar#L30-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "27ff018574323c10821993c30cf74de15121caa92a308fbcae4eceae954e63b6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ransom_esxi_attacks_feb23.yar#L30-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_27ff018574323c10821993c30cf74de15121caa92a308fbcae4eceae954e63b6"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -288195,7 +286185,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_ELF_Esxi_Attacks_Feb23_1 : FILE
 		$op3 = { 31 55 b4 f7 55 b8 8b 4d ac 09 4d b8 8b 45 b8 31 45 bc c1 4d bc 13 c1 4d b4 1d }
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and (1 of ($x*) or 3 of them ) or 4 of them
+		uint16( 0 ) == 0x457f and filesize < 200KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
 }
 rule SIGNATURE_BASE_APT_PY_Esxi_Backdoor_Dec22 : FILE
 {
@@ -288206,9 +286196,9 @@ rule SIGNATURE_BASE_APT_PY_Esxi_Backdoor_Dec22 : FILE
 		date = "2022-12-14"
 		modified = "2023-12-05"
 		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ransom_esxi_attacks_feb23.yar#L58-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "86b628f007720aa706c30d91e845d867ed481d1e99bcc9315c84a4e0b7b1b2a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ransom_esxi_attacks_feb23.yar#L58-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_86b628f007720aa706c30d91e845d867ed481d1e99bcc9315c84a4e0b7b1b2a6"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -288218,7 +286208,7 @@ rule SIGNATURE_BASE_APT_PY_Esxi_Backdoor_Dec22 : FILE
 		$x2 = "sh -i 2>&1 | nc %s %s > /tmp/" ascii
 
 	condition:
-		filesize <10KB and 1 of them or all of them
+		filesize < 10KB and 1 of them or all of them
 }
 rule SIGNATURE_BASE_APT_SH_Esxi_Backdoor_Dec22 : FILE
 {
@@ -288229,9 +286219,9 @@ rule SIGNATURE_BASE_APT_SH_Esxi_Backdoor_Dec22 : FILE
 		date = "2022-12-14"
 		modified = "2023-12-05"
 		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ransom_esxi_attacks_feb23.yar#L73-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "155a90a6c55b99285555634d91a66fca9c7e7297f05314fa4d6ce1d84257ee11"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ransom_esxi_attacks_feb23.yar#L73-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_155a90a6c55b99285555634d91a66fca9c7e7297f05314fa4d6ce1d84257ee11"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288242,7 +286232,7 @@ rule SIGNATURE_BASE_APT_SH_Esxi_Backdoor_Dec22 : FILE
 		$x3 = "/bin/rm /bin/hostd-probe.sh.1"
 
 	condition:
-		filesize <10KB and 1 of them
+		filesize < 10KB and 1 of them
 }
 rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_2 : FILE
 {
@@ -288253,9 +286243,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_2 : FILE
 		date = "2023-02-06"
 		modified = "2023-12-05"
 		reference = "https://dev.to/xakrume/esxiargs-encryption-malware-launches-massive-attacks-against-vmware-esxi-servers-pfe"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ransom_esxi_attacks_feb23.yar#L89-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3f240784873a0239cbf61f7f420fdd72b8992d5943ffc3d4dcad43c836569f4d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ransom_esxi_attacks_feb23.yar#L89-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3f240784873a0239cbf61f7f420fdd72b8992d5943ffc3d4dcad43c836569f4d"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -288264,7 +286254,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_2 : FILE
 		$x1 = "echo \"START ENCRYPT: $file_e SIZE: $size_kb STEP SIZE: " ascii
 
 	condition:
-		filesize <10KB and 1 of them
+		filesize < 10KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Esxiargs_Endpoint_Conf_Aug23 : FILE
 {
@@ -288275,9 +286265,9 @@ rule SIGNATURE_BASE_SUSP_Esxiargs_Endpoint_Conf_Aug23 : FILE
 		date = "2023-08-04"
 		modified = "2023-12-05"
 		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ransom_esxi_attacks_feb23.yar#L103-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "794d460eec0e2f0b48e6ced94b125a1e48acde6be6281866e0b4a2ae6c2d3b51"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ransom_esxi_attacks_feb23.yar#L103-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_794d460eec0e2f0b48e6ced94b125a1e48acde6be6281866e0b4a2ae6c2d3b51"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288290,7 +286280,7 @@ rule SIGNATURE_BASE_SUSP_Esxiargs_Endpoint_Conf_Aug23 : FILE
 		$s1 = " local 8008 allow allow"
 
 	condition:
-		filesize <2KB and all of them
+		filesize < 2KB and all of them
 }
 rule SIGNATURE_BASE_EXP_Drivecrypt_1 : FILE
 {
@@ -288301,9 +286291,9 @@ rule SIGNATURE_BASE_EXP_Drivecrypt_1 : FILE
 		date = "2018-08-21"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_drivecrypt.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1959f2e4838e40f2abc26ee16b03089088c96cafb101125bdc346f69fe76d7a4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_drivecrypt.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1959f2e4838e40f2abc26ee16b03089088c96cafb101125bdc346f69fe76d7a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288316,7 +286306,7 @@ rule SIGNATURE_BASE_EXP_Drivecrypt_1 : FILE
 		$s3 = "amd64\\x64pass.sys" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and 2 of them
 }
 rule SIGNATURE_BASE_EXP_Drivecrypt_X64Passldr : FILE
 {
@@ -288327,9 +286317,9 @@ rule SIGNATURE_BASE_EXP_Drivecrypt_X64Passldr : FILE
 		date = "2018-08-21"
 		modified = "2023-01-06"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_drivecrypt.yar#L19-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "573cd96f7f82788a3884cd4b4d91c739a890835c3ed1b3933af48ba5756cc5a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_drivecrypt.yar#L19-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_573cd96f7f82788a3884cd4b4d91c739a890835c3ed1b3933af48ba5756cc5a6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288345,7 +286335,7 @@ rule SIGNATURE_BASE_EXP_Drivecrypt_X64Passldr : FILE
 		$s7 = "%ws\\%ws\\Security" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them
 }
 rule SIGNATURE_BASE_Irontiger_Aspxspy : HIGHVOL
 {
@@ -288356,9 +286346,9 @@ rule SIGNATURE_BASE_Irontiger_Aspxspy : HIGHVOL
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L1-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6b5830d3fd6aa346b27788cd4abd581b4724fecc4e880b14dd7b1dd27ef1eea3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L1-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6b5830d3fd6aa346b27788cd4abd581b4724fecc4e880b14dd7b1dd27ef1eea3"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL"
@@ -288368,7 +286358,7 @@ rule SIGNATURE_BASE_Irontiger_Aspxspy : HIGHVOL
 		$str3 = "protected void DGCoW(object sender,EventArgs e)" wide ascii
 
 	condition:
-		any of ($str*)
+		any of ( $str* )
 }
 rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Driversinstall : FILE
 {
@@ -288379,9 +286369,9 @@ rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Driversinstall : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L15-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2ae32596da4f98a0ec2556c2cd87fc7a0f85c37ce96c7163664f2e8cc3ec498d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L15-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2ae32596da4f98a0ec2556c2cd87fc7a0f85c37ce96c7163664f2e8cc3ec498d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288393,7 +286383,7 @@ rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Driversinstall : FILE
 		$str4 = "NdisVersion" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($str*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $str* ) )
 }
 rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Changeportexe : FILE
 {
@@ -288404,9 +286394,9 @@ rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Changeportexe : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L31-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b5a5a1cff372d97bfa281d297b6230279cd1526c5df636efe4dec3aa3d923edf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L31-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b5a5a1cff372d97bfa281d297b6230279cd1526c5df636efe4dec3aa3d923edf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288419,7 +286409,7 @@ rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Changeportexe : FILE
 		$str5 = "Door is bind on %s" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($str*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $str* ) )
 }
 rule SIGNATURE_BASE_Irontiger_Dllshellexc2010 : FILE
 {
@@ -288430,9 +286420,9 @@ rule SIGNATURE_BASE_Irontiger_Dllshellexc2010 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b75477f01627ac05013c5e4ccb1d58a6bb25bfbe83ad0cec392140d44637a028"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b75477f01627ac05013c5e4ccb1d58a6bb25bfbe83ad0cec392140d44637a028"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288445,7 +286435,7 @@ rule SIGNATURE_BASE_Irontiger_Dllshellexc2010 : FILE
 		$bla2 = "auth.owa" wide ascii
 
 	condition:
-		( uint16(0)==0x5a4d) and (( any of ($str*)) or ( all of ($bla*)))
+		( uint16( 0 ) == 0x5a4d ) and ( ( any of ( $str* ) ) or ( all of ( $bla* ) ) )
 }
 rule SIGNATURE_BASE_Irontiger_Dnstunnel : FILE
 {
@@ -288456,9 +286446,9 @@ rule SIGNATURE_BASE_Irontiger_Dnstunnel : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L65-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "84b7dec3a89fe309149c7a3141279755adafbf793521c7b9b4031827f1020d7d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L65-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_84b7dec3a89fe309149c7a3141279755adafbf793521c7b9b4031827f1020d7d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288475,7 +286465,7 @@ rule SIGNATURE_BASE_Irontiger_Dnstunnel : FILE
 		$mistake5 = "Program try to use the have deleted the buffer" wide ascii
 
 	condition:
-		( uint16(0)==0x5a4d) and (( any of ($str*)) or ( any of ($mistake*)))
+		( uint16( 0 ) == 0x5a4d ) and ( ( any of ( $str* ) ) or ( any of ( $mistake* ) ) )
 }
 rule SIGNATURE_BASE_Irontiger_EFH3_Encoder : FILE
 {
@@ -288486,9 +286476,9 @@ rule SIGNATURE_BASE_Irontiger_EFH3_Encoder : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L86-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e620222f815a6c915e372c11d28c480179fd2abdb139ed6984ca5a7a61b8088c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L86-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e620222f815a6c915e372c11d28c480179fd2abdb139ed6984ca5a7a61b8088c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288499,7 +286489,7 @@ rule SIGNATURE_BASE_Irontiger_EFH3_Encoder : FILE
 		$str3 = "ENCODER: b[i]: = " wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( any of ($str*))
+		uint16( 0 ) == 0x5a4d and ( any of ( $str* ) )
 }
 rule SIGNATURE_BASE_Irontiger_Getpassword_X64 : FILE
 {
@@ -288510,9 +286500,9 @@ rule SIGNATURE_BASE_Irontiger_Getpassword_X64 : FILE
 		date = "2023-01-06"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L101-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2adabc629fcd4bc89a015874376daf51b2a367bb13ec25e917e5d899080d8a74"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L101-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2adabc629fcd4bc89a015874376daf51b2a367bb13ec25e917e5d899080d8a74"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288527,7 +286517,7 @@ rule SIGNATURE_BASE_Irontiger_Getpassword_X64 : FILE
 		$bla4 = "Primary User:" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( any of ($str*)) or ( all of ($bla*)))
+		uint16( 0 ) == 0x5a4d and ( ( any of ( $str* ) ) or ( all of ( $bla* ) ) )
 }
 rule SIGNATURE_BASE_Irontiger_Gtalk_Trojan : FILE
 {
@@ -288538,9 +286528,9 @@ rule SIGNATURE_BASE_Irontiger_Gtalk_Trojan : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L121-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9b6139d34ad91db2e418668be9ca947442ff614a241f0c1aa61f8334af5421c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L121-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9b6139d34ad91db2e418668be9ca947442ff614a241f0c1aa61f8334af5421c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288552,7 +286542,7 @@ rule SIGNATURE_BASE_Irontiger_Gtalk_Trojan : FILE
 		$str4 = "Error: PeekNamedPipe failed with %i" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($str*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $str* ) )
 }
 rule SIGNATURE_BASE_Irontiger_HTTP_SOCKS_Proxy_Soexe : FILE
 {
@@ -288563,9 +286553,9 @@ rule SIGNATURE_BASE_Irontiger_HTTP_SOCKS_Proxy_Soexe : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L137-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f262751727de3d47a8d7cdc1f8ba8d92f4f60e22bc4e897bd5e53a8f2c118c95"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L137-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f262751727de3d47a8d7cdc1f8ba8d92f4f60e22bc4e897bd5e53a8f2c118c95"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288578,7 +286568,7 @@ rule SIGNATURE_BASE_Irontiger_HTTP_SOCKS_Proxy_Soexe : FILE
 		$str5 = "Create SOCKET error." wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($str*))
+		uint16( 0 ) == 0x5a4d and ( 3 of ( $str* ) )
 }
 rule SIGNATURE_BASE_Irontiger_Nbddos_Gh0Stvariant_Dropper : FILE
 {
@@ -288589,9 +286579,9 @@ rule SIGNATURE_BASE_Irontiger_Nbddos_Gh0Stvariant_Dropper : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L154-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e877c52d5cb0067388e9a138f48dcf7d3bd6d7d491eea6acffb2527ba0a906c7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L154-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e877c52d5cb0067388e9a138f48dcf7d3bd6d7d491eea6acffb2527ba0a906c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288604,7 +286594,7 @@ rule SIGNATURE_BASE_Irontiger_Nbddos_Gh0Stvariant_Dropper : FILE
 		$bla2 = "%4.2f GB" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( any of ($str*)) or ( all of ($bla*)))
+		uint16( 0 ) == 0x5a4d and ( ( any of ( $str* ) ) or ( all of ( $bla* ) ) )
 }
 rule SIGNATURE_BASE_Irontiger_Plugx_Dosemulator : FILE
 {
@@ -288615,9 +286605,9 @@ rule SIGNATURE_BASE_Irontiger_Plugx_Dosemulator : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L171-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "502adc142b0f7a2980b4b851f2360086cec855b5e9851a6e9afbaba1846d11ed"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L171-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_502adc142b0f7a2980b4b851f2360086cec855b5e9851a6e9afbaba1846d11ed"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288629,7 +286619,7 @@ rule SIGNATURE_BASE_Irontiger_Plugx_Dosemulator : FILE
 		$str4 = "fail,error code = %d." wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and 2 of ($str*)
+		uint16( 0 ) == 0x5a4d and 2 of ( $str* )
 }
 rule SIGNATURE_BASE_Irontiger_Plugx_Fastproxy : FILE
 {
@@ -288640,9 +286630,9 @@ rule SIGNATURE_BASE_Irontiger_Plugx_Fastproxy : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L187-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6659595f65b445d2bd69b13b8d01c2dd78b5c055fa39f810a61646d9408df2ff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L187-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6659595f65b445d2bd69b13b8d01c2dd78b5c055fa39f810a61646d9408df2ff"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288656,7 +286646,7 @@ rule SIGNATURE_BASE_Irontiger_Plugx_Fastproxy : FILE
 		$str6 = "[+Y] cwnd : %3d, fligth:" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( any of ($str*))
+		uint16( 0 ) == 0x5a4d and ( any of ( $str* ) )
 }
 rule SIGNATURE_BASE_Irontiger_Plugx_Server : FILE
 {
@@ -288667,9 +286657,9 @@ rule SIGNATURE_BASE_Irontiger_Plugx_Server : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L205-L225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "14b3f3b75cf6d042934e6916c99fe41d54065d59be6eb30b3cecc799997ac9d4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L205-L225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_14b3f3b75cf6d042934e6916c99fe41d54065d59be6eb30b3cecc799997ac9d4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288687,7 +286677,7 @@ rule SIGNATURE_BASE_Irontiger_Plugx_Server : FILE
 		$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($str*))
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $str* ) )
 }
 rule SIGNATURE_BASE_Irontiger_Readpwd86 : FILE
 {
@@ -288698,9 +286688,9 @@ rule SIGNATURE_BASE_Irontiger_Readpwd86 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L227-L240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c188b033aee6b7e811c125af545aa7851cd45ba02e057ee93967fa98d1c13947"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L227-L240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c188b033aee6b7e811c125af545aa7851cd45ba02e057ee93967fa98d1c13947"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288711,7 +286701,7 @@ rule SIGNATURE_BASE_Irontiger_Readpwd86 : FILE
 		$str3 = "User Principal" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($str*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $str* ) )
 }
 rule SIGNATURE_BASE_Irontiger_Ring_Gh0Stvariant : FILE
 {
@@ -288722,9 +286712,9 @@ rule SIGNATURE_BASE_Irontiger_Ring_Gh0Stvariant : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L242-L257"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6df729e3b472d3930f5bc4a1b5b8736567df43b78bec3401f5d41bf7ba30d93b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L242-L257"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6df729e3b472d3930f5bc4a1b5b8736567df43b78bec3401f5d41bf7ba30d93b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288737,7 +286727,7 @@ rule SIGNATURE_BASE_Irontiger_Ring_Gh0Stvariant : FILE
 		$bla2 = "user canceled!" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( any of ($str*)) or ( all of ($bla*)))
+		uint16( 0 ) == 0x5a4d and ( ( any of ( $str* ) ) or ( all of ( $bla* ) ) )
 }
 rule SIGNATURE_BASE_Irontiger_Wmiexec
 {
@@ -288748,9 +286738,9 @@ rule SIGNATURE_BASE_Irontiger_Wmiexec
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger_trendmicro.yar#L259-L276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7988b993345e13b64e5f02ecd2679fc484b063a4cd2f18b52d00d2dfa34d82cb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger_trendmicro.yar#L259-L276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7988b993345e13b64e5f02ecd2679fc484b063a4cd2f18b52d00d2dfa34d82cb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -288765,7 +286755,7 @@ rule SIGNATURE_BASE_Irontiger_Wmiexec
 		$str7 = "win2008 fso has no privilege to delete file" wide ascii
 
 	condition:
-		2 of ($str*)
+		2 of ( $str* )
 }
 rule SIGNATURE_BASE_APT_UNC5221_Ivanti_Forensicartifacts_Jan24_1 : FILE
 {
@@ -288776,9 +286766,9 @@ rule SIGNATURE_BASE_APT_UNC5221_Ivanti_Forensicartifacts_Jan24_1 : FILE
 		date = "2024-01-11"
 		modified = "2024-04-24"
 		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_report_ivanti_mandiant_jan24.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7f485f41072f5584dc76e71564e13066d9fe41685f33bff9c2886fa7d2155f94"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_report_ivanti_mandiant_jan24.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7f485f41072f5584dc76e71564e13066d9fe41685f33bff9c2886fa7d2155f94"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288789,7 +286779,7 @@ rule SIGNATURE_BASE_APT_UNC5221_Ivanti_Forensicartifacts_Jan24_1 : FILE
 		$x3 = "sed -i '/retval=$(exec $installer $@)/d' /pkg/do-install"
 
 	condition:
-		filesize <5MB and 1 of them
+		filesize < 5MB and 1 of them
 }
 rule SIGNATURE_BASE_M_Hunting_Backdoor_ZIPLINE_1 : FILE
 {
@@ -288800,9 +286790,9 @@ rule SIGNATURE_BASE_M_Hunting_Backdoor_ZIPLINE_1 : FILE
 		date = "2024-01-11"
 		modified = "2024-04-24"
 		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_report_ivanti_mandiant_jan24.yar#L18-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "41857ba465dd1f2e1aa8c1eed36b73606385eeedf233fd480bb8a4ef15499174"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_report_ivanti_mandiant_jan24.yar#L18-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_41857ba465dd1f2e1aa8c1eed36b73606385eeedf233fd480bb8a4ef15499174"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288816,7 +286806,7 @@ rule SIGNATURE_BASE_M_Hunting_Backdoor_ZIPLINE_1 : FILE
 		$t4 = "/tmp/data/root/home/etc/manifest/exclusion_list" ascii
 
 	condition:
-		uint32(0)==0x464c457f and filesize <5MB and ((1 of ($s*)) or (3 of ($t*)))
+		uint32( 0 ) == 0x464c457f and filesize < 5MB and ( ( 1 of ( $s* ) ) or ( 3 of ( $t* ) ) )
 }
 rule SIGNATURE_BASE_M_Hunting_Dropper_WIREFIRE_1 : FILE
 {
@@ -288827,10 +286817,10 @@ rule SIGNATURE_BASE_M_Hunting_Dropper_WIREFIRE_1 : FILE
 		date = "2024-01-11"
 		modified = "2024-04-24"
 		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_report_ivanti_mandiant_jan24.yar#L40-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_report_ivanti_mandiant_jan24.yar#L40-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6de651357a15efd01db4e658249d4981"
-		logic_hash = "c389a666bd093cdd7700385da43c8fa58b9f3d899e658c516df0f3aca439401d"
+		logic_hash = "v1_sha256_c389a666bd093cdd7700385da43c8fa58b9f3d899e658c516df0f3aca439401d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288843,7 +286833,7 @@ rule SIGNATURE_BASE_M_Hunting_Dropper_WIREFIRE_1 : FILE
 		$s5 = "Utils.api_log_admin" ascii
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_M_Hunting_Webshell_LIGHTWIRE_2 : FILE
 {
@@ -288854,10 +286844,10 @@ rule SIGNATURE_BASE_M_Hunting_Webshell_LIGHTWIRE_2 : FILE
 		date = "2024-01-11"
 		modified = "2024-01-12"
 		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_report_ivanti_mandiant_jan24.yar#L60-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_report_ivanti_mandiant_jan24.yar#L60-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3d97f55a03ceb4f71671aa2ecf5b24e9"
-		logic_hash = "37b22a6c45dd53bc7b3f0c75cc5072e990246fea24591d192176c0b496e92084"
+		logic_hash = "v1_sha256_37b22a6c45dd53bc7b3f0c75cc5072e990246fea24591d192176c0b496e92084"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288870,7 +286860,7 @@ rule SIGNATURE_BASE_M_Hunting_Webshell_LIGHTWIRE_2 : FILE
 		$s5 = "\"Compatibility check: $@\";}"
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_M_Hunting_Dropper_THINSPOOL_1 : FILE
 {
@@ -288881,10 +286871,10 @@ rule SIGNATURE_BASE_M_Hunting_Dropper_THINSPOOL_1 : FILE
 		date = "2024-01-11"
 		modified = "2024-04-24"
 		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_report_ivanti_mandiant_jan24.yar#L83-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_report_ivanti_mandiant_jan24.yar#L83-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "677c1aa6e2503b56fe13e1568a814754"
-		logic_hash = "a8043822cd36a802ba6656c42085f09d67cedb0689c9da48438d788b320bd6c0"
+		logic_hash = "v1_sha256_a8043822cd36a802ba6656c42085f09d67cedb0689c9da48438d788b320bd6c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288896,7 +286886,7 @@ rule SIGNATURE_BASE_M_Hunting_Dropper_THINSPOOL_1 : FILE
 		$s4 = "ADM20447" ascii
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_M_Hunting_Credtheft_WARPWIRE_1 : FILE
 {
@@ -288907,10 +286897,10 @@ rule SIGNATURE_BASE_M_Hunting_Credtheft_WARPWIRE_1 : FILE
 		date = "2024-01-11"
 		modified = "2024-04-24"
 		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_report_ivanti_mandiant_jan24.yar#L102-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_report_ivanti_mandiant_jan24.yar#L102-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d0c7a334a4d9dcd3c6335ae13bee59ea"
-		logic_hash = "8029df5998166ab3db3319b0dd765ef3356b4b44dc16d2d418015a0f7ffac97e"
+		logic_hash = "v1_sha256_8029df5998166ab3db3319b0dd765ef3356b4b44dc16d2d418015a0f7ffac97e"
 		score = 75
 		quality = 77
 		tags = "FILE"
@@ -288923,7 +286913,7 @@ rule SIGNATURE_BASE_M_Hunting_Credtheft_WARPWIRE_1 : FILE
 		$s5 = "Remember the last selected auth realm for 30 days" ascii
 
 	condition:
-		filesize <8KB and all of them
+		filesize < 8KB and all of them
 }
 rule SIGNATURE_BASE_MAL_Xbash_PY_Sep18 : FILE
 {
@@ -288934,9 +286924,9 @@ rule SIGNATURE_BASE_MAL_Xbash_PY_Sep18 : FILE
 		date = "2018-09-18"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_xbash.yar#L13-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d686c42e6bf440507735f846463f2df5fbf4f7bd5f5656883655a5278a1fc252"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_xbash.yar#L13-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d686c42e6bf440507735f846463f2df5fbf4f7bd5f5656883655a5278a1fc252"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288946,7 +286936,7 @@ rule SIGNATURE_BASE_MAL_Xbash_PY_Sep18 : FILE
 		$s1 = { 73 58 62 61 73 68 00 00 00 00 00 00 00 00 }
 
 	condition:
-		uint16(0)==0x457f and filesize <10000KB and 1 of them
+		uint16( 0 ) == 0x457f and filesize < 10000KB and 1 of them
 }
 rule SIGNATURE_BASE_MAL_Xbash_SH_Sep18 : FILE
 {
@@ -288957,9 +286947,9 @@ rule SIGNATURE_BASE_MAL_Xbash_SH_Sep18 : FILE
 		date = "2018-09-18"
 		modified = "2023-01-06"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_xbash.yar#L27-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b48cbd64002025d861e2fd381be5a68efd7f6fc5fd239850c940f887e2b01673"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_xbash.yar#L27-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b48cbd64002025d861e2fd381be5a68efd7f6fc5fd239850c940f887e2b01673"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -288977,7 +286967,7 @@ rule SIGNATURE_BASE_MAL_Xbash_SH_Sep18 : FILE
 		$s8 = "-C /tmp/pools.txt>/dev/null 2>&1" ascii
 
 	condition:
-		uint16(0)==0x2123 and filesize <3KB and 1 of them
+		uint16( 0 ) == 0x2123 and filesize < 3KB and 1 of them
 }
 rule SIGNATURE_BASE_MAL_Xbash_JS_Sep18 : FILE
 {
@@ -288988,9 +286978,9 @@ rule SIGNATURE_BASE_MAL_Xbash_JS_Sep18 : FILE
 		date = "2018-09-18"
 		modified = "2023-01-06"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_xbash.yar#L50-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf2f9006e0ab07f6ff1a0ce4946af34468f7c74143c853c5d77c6db725bb590a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_xbash.yar#L50-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf2f9006e0ab07f6ff1a0ce4946af34468f7c74143c853c5d77c6db725bb590a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289003,7 +286993,7 @@ rule SIGNATURE_BASE_MAL_Xbash_JS_Sep18 : FILE
 		$s4 = "<script language=\"JScript\">" fullword ascii
 
 	condition:
-		filesize <5KB and 3 of them
+		filesize < 5KB and 3 of them
 }
 rule SIGNATURE_BASE_Minirat_Gen_1 : FILE
 {
@@ -289014,9 +287004,9 @@ rule SIGNATURE_BASE_Minirat_Gen_1 : FILE
 		date = "2018-01-22"
 		modified = "2023-12-05"
 		reference = "https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_darkcaracal.yar#L12-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "53c4ba16ae2c3eb3a6c7371e7fc8b962cfbee5b70abd8267294834eac3e55769"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_darkcaracal.yar#L12-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_53c4ba16ae2c3eb3a6c7371e7fc8b962cfbee5b70abd8267294834eac3e55769"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289032,7 +287022,7 @@ rule SIGNATURE_BASE_Minirat_Gen_1 : FILE
 		$x2 = "\\Projects\\ali\\Clever Components v7\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 7000KB and 1 of them
 }
 rule SIGNATURE_BASE_Notpetya_Ransomware_Jun17 : FILE
 {
@@ -289043,9 +287033,9 @@ rule SIGNATURE_BASE_Notpetya_Ransomware_Jun17 : FILE
 		date = "2017-06-27"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/h6iaGj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_nopetya_jun17.yar#L12-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e49fd918e9cc09a60434e62767794cd908f195cb71fd7a752a2b4802973bc92e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_nopetya_jun17.yar#L12-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e49fd918e9cc09a60434e62767794cd908f195cb71fd7a752a2b4802973bc92e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289070,7 +287060,7 @@ rule SIGNATURE_BASE_Notpetya_Ransomware_Jun17 : FILE
 		$s7 = "dllhost.dat" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_SUSP_NET_Msil_Suspicious_Use_Strreverse : FILE
 {
@@ -289081,10 +287071,10 @@ rule SIGNATURE_BASE_SUSP_NET_Msil_Suspicious_Use_Strreverse : FILE
 		date = "2023-01-31"
 		modified = "2023-02-22"
 		reference = "https://github.com/dr4k0nia/yara-rules"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_net_msil.yar#L2-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_net_msil.yar#L2-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
-		logic_hash = "a7440600ee4826568d465d204e0a602f61752e4ffcfa3b4f29e5bc81c4d67b46"
+		logic_hash = "v1_sha256_a7440600ee4826568d465d204e0a602f61752e4ffcfa3b4f29e5bc81c4d67b46"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -289098,7 +287088,7 @@ rule SIGNATURE_BASE_SUSP_NET_Msil_Suspicious_Use_Strreverse : FILE
 		$strreverse = "StrReverse"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50MB and all of ($a*) and $csharp and $vbnet and $strreverse
+		uint16( 0 ) == 0x5a4d and filesize < 50MB and all of ( $a* ) and $csharp and $vbnet and $strreverse
 }
 rule SIGNATURE_BASE_HKTL_Bruteratel_Badger_Indicators_Oct22_4 : FILE
 {
@@ -289109,9 +287099,9 @@ rule SIGNATURE_BASE_HKTL_Bruteratel_Badger_Indicators_Oct22_4 : FILE
 		date = "2022-10-12"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/embee_research/status/1580030310778953728"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/hktl_bruteratel_c4_badger.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9af05225f462c8d4ec1fb14dc06bb789f76b0d818cb82c3dfcd5abc693727f33"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/hktl_bruteratel_c4_badger.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9af05225f462c8d4ec1fb14dc06bb789f76b0d818cb82c3dfcd5abc693727f33"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289123,7 +287113,7 @@ rule SIGNATURE_BASE_HKTL_Bruteratel_Badger_Indicators_Oct22_4 : FILE
 		$s4 = { b? 74 eb 1d 4d }
 
 	condition:
-		filesize <8000KB and all of ($s*) and not uint8(0)==0x02
+		filesize < 8000KB and all of ( $s* ) and not uint8( 0 ) == 0x02
 }
 rule SIGNATURE_BASE_ATM_Malware_Loup_1 : FILE
 {
@@ -289134,10 +287124,10 @@ rule SIGNATURE_BASE_ATM_Malware_Loup_1 : FILE
 		date = "2020-08-17"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_atm_loup.yar#L3-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_atm_loup.yar#L3-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
-		logic_hash = "5068c3f27cf821f512fb9a473d2bd45066d550f30fbc26f0cbebbe103e6f4ccb"
+		logic_hash = "v1_sha256_5068c3f27cf821f512fb9a473d2bd45066d550f30fbc26f0cbebbe103e6f4ccb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289148,10 +287138,8 @@ rule SIGNATURE_BASE_ATM_Malware_Loup_1 : FILE
 		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8}
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and all of ($String*) and $Code
+		uint16( 0 ) == 0x5A4D and filesize < 100KB and all of ( $String* ) and $Code
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT41_POISONPLUG_3 : FILE
 {
 	meta:
@@ -289161,9 +287149,9 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG_3 : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L14-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b74b89ac382b2b839c169cd1388d86888172f133091afd079ec42c9380935fdc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L14-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b74b89ac382b2b839c169cd1388d86888172f133091afd079ec42c9380935fdc"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -289177,7 +287165,7 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG_3 : FILE
 		$s5 = "%04d-%02d-%02d_%02d-%02d-%02d.dmp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and 3 of them
 }
 import "pe"
 
@@ -289190,19 +287178,17 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG_SHADOW : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L33-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fc923c7e85f3870e08a077b344e575d3c349fa02f3d218a9a7ec31992f14866b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L33-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fc923c7e85f3870e08a077b344e575d3c349fa02f3d218a9a7ec31992f14866b"
 		score = 85
 		quality = 85
 		tags = "FILE"
 		hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and pe.imphash()=="c67de089f2009b21715744762fc484e8"
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and pe.imphash ( ) == "c67de089f2009b21715744762fc484e8"
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT41_CRACKSHOT : FILE
 {
 	meta:
@@ -289212,9 +287198,9 @@ rule SIGNATURE_BASE_APT_APT41_CRACKSHOT : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L46-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "70dd9edfc7f9ace7b00a35eb2ef664aa4fbaab8e2d268922d1593074897e769c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L46-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_70dd9edfc7f9ace7b00a35eb2ef664aa4fbaab8e2d268922d1593074897e769c"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -289228,10 +287214,8 @@ rule SIGNATURE_BASE_APT_APT41_CRACKSHOT : FILE
 		$s4 = "%s|%s|%s|%s|%s|%s|%s|%dx%d|%04x|%08X|%s|%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and ( 1 of ( $x* ) or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT41_POISONPLUG_2 : FILE
 {
 	meta:
@@ -289241,9 +287225,9 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG_2 : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L66-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f2ec2e91edaaf976169b1fa6645aeae75135e5d5f522e0fda2438f84d674f383"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L66-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f2ec2e91edaaf976169b1fa6645aeae75135e5d5f522e0fda2438f84d674f383"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -289256,7 +287240,7 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG_2 : FILE
 		$s4 = "McAfee Agent" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <11000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 11000KB and all of them
 }
 import "pe"
 
@@ -289269,9 +287253,9 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L84-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "34459c2a8a13b8084c93a640723a3e2b67d2f695ff84ab63f4e313cacc458f32"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L84-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_34459c2a8a13b8084c93a640723a3e2b67d2f695ff84ab63f4e313cacc458f32"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -289287,10 +287271,8 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG : FILE
 		$s4 = "Remote Desktop Services" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and (pe.imphash()=="1b074ef7a1c0888ef31337c8ad2f2e0a" or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 10000KB and ( pe.imphash ( ) == "1b074ef7a1c0888ef31337c8ad2f2e0a" or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT41_HIGHNOON : FILE
 {
 	meta:
@@ -289300,9 +287282,9 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L108-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c8afa91f90157c3ac0f7954cd2d42022392c4e6f039d88d1dd4bace19028c2b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L108-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c8afa91f90157c3ac0f7954cd2d42022392c4e6f039d88d1dd4bace19028c2b1"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -289325,7 +287307,7 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON : FILE
 		$s11 = "Global\\%s-%d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 4 of them )
 }
 import "pe"
 
@@ -289338,9 +287320,9 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON_2 : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L137-L157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dc35b78df1631b1c9650de2bac625a7bc629225f36fe5e32fbff829cb77dc9ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L137-L157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dc35b78df1631b1c9650de2bac625a7bc629225f36fe5e32fbff829cb77dc9ac"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289353,7 +287335,7 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON_2 : FILE
 		$s3 = "\\svchost.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="b70358b00dd0138566ac940d0da26a03" or pe.exports("DllMain_mem") or $x1 or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "b70358b00dd0138566ac940d0da26a03" or pe.exports ( "DllMain_mem" ) or $x1 or 3 of them )
 }
 import "pe"
 
@@ -289366,9 +287348,9 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L159-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c6557bff952454482271d1b52fb37b2dd0471abd237449fd9c94b293ea5218b3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L159-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c6557bff952454482271d1b52fb37b2dd0471abd237449fd9c94b293ea5218b3"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -289383,10 +287365,8 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN : FILE
 		$s5 = "%s%s\\Enum" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="b70358b00dd0138566ac940d0da26a03" or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "b70358b00dd0138566ac940d0da26a03" or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN_2 : FILE
 {
 	meta:
@@ -289396,9 +287376,9 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN_2 : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L182-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1e3d622b4719962f59d95dbf1374c526c22461dd1d9313504f28e8e5c9184272"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L182-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1e3d622b4719962f59d95dbf1374c526c22461dd1d9313504f28e8e5c9184272"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -289413,7 +287393,7 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN_2 : FILE
 		$x5 = "About RbDoor" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
 }
 import "pe"
 
@@ -289426,18 +287406,16 @@ rule SIGNATURE_BASE_APT_APT41_Revokedcert_Aug19_1 : FILE
 		date = "2019-08-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L202-L231"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f78c1310f99ac1993b01f3469f2f8e0765b79b2ea17fc6e7cff4e99949ca1139"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L202-L231"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f78c1310f99ac1993b01f3469f2f8e0765b79b2ea17fc6e7cff4e99949ca1139"
 		score = 60
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="0b:72:79:06:8b:eb:15:ff:e8:06:0d:2c:56:15:3c:35" or pe.signatures[i].serial=="63:66:a9:ac:97:df:4d:e1:73:66:94:3c:9b:29:1a:aa" or pe.signatures[i].serial=="01:00:00:00:00:01:30:73:85:f7:02" or pe.signatures[i].serial=="14:0d:2c:51:5e:8e:e9:73:9b:b5:f1:b2:63:7d:c4:78" or pe.signatures[i].serial=="7b:d5:58:18:c5:97:1b:63:dc:45:cf:57:cb:eb:95:0b" or pe.signatures[i].serial=="53:0c:e1:4c:81:f3:62:10:a1:68:2a:ff:17:9e:25:80" or pe.signatures[i].serial=="54:c6:c1:40:6f:b4:ac:b5:d2:06:74:e9:93:92:c6:3e" or pe.signatures[i].serial=="fd:f2:83:7d:ac:12:b7:bb:30:ad:05:8f:99:9e:cf:00" or pe.signatures[i].serial=="18:63:79:57:5a:31:46:e2:6b:ef:c9:0a:58:0d:1b:d2" or pe.signatures[i].serial=="5c:2f:97:a3:1a:bc:32:b0:8c:ac:01:00:59:8f:32:f6" or pe.signatures[i].serial=="4c:0b:2e:9d:2e:f9:09:d1:52:70:d4:dd:7f:a5:a4:a5" or pe.signatures[i].serial=="58:01:5a:cd:50:1f:c9:c3:44:26:4e:ac:e2:ce:57:30" or pe.signatures[i].serial=="47:6b:f2:4a:4b:1e:9f:4b:c2:a6:1b:15:21:15:e1:fe" or pe.signatures[i].serial=="30:d3:c1:67:26:5b:52:0c:b8:7f:25:84:4f:95:cb:04" or pe.signatures[i].serial=="1e:52:bb:f5:c9:0e:c1:64:d0:5b:e0:e4:16:61:52:5f" or pe.signatures[i].serial=="25:f8:78:22:de:56:d3:98:21:59:28:73:ea:09:ca:37" or pe.signatures[i].serial=="67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . serial == "0b:72:79:06:8b:eb:15:ff:e8:06:0d:2c:56:15:3c:35" or pe.signatures [ i ] . serial == "63:66:a9:ac:97:df:4d:e1:73:66:94:3c:9b:29:1a:aa" or pe.signatures [ i ] . serial == "01:00:00:00:00:01:30:73:85:f7:02" or pe.signatures [ i ] . serial == "14:0d:2c:51:5e:8e:e9:73:9b:b5:f1:b2:63:7d:c4:78" or pe.signatures [ i ] . serial == "7b:d5:58:18:c5:97:1b:63:dc:45:cf:57:cb:eb:95:0b" or pe.signatures [ i ] . serial == "53:0c:e1:4c:81:f3:62:10:a1:68:2a:ff:17:9e:25:80" or pe.signatures [ i ] . serial == "54:c6:c1:40:6f:b4:ac:b5:d2:06:74:e9:93:92:c6:3e" or pe.signatures [ i ] . serial == "fd:f2:83:7d:ac:12:b7:bb:30:ad:05:8f:99:9e:cf:00" or pe.signatures [ i ] . serial == "18:63:79:57:5a:31:46:e2:6b:ef:c9:0a:58:0d:1b:d2" or pe.signatures [ i ] . serial == "5c:2f:97:a3:1a:bc:32:b0:8c:ac:01:00:59:8f:32:f6" or pe.signatures [ i ] . serial == "4c:0b:2e:9d:2e:f9:09:d1:52:70:d4:dd:7f:a5:a4:a5" or pe.signatures [ i ] . serial == "58:01:5a:cd:50:1f:c9:c3:44:26:4e:ac:e2:ce:57:30" or pe.signatures [ i ] . serial == "47:6b:f2:4a:4b:1e:9f:4b:c2:a6:1b:15:21:15:e1:fe" or pe.signatures [ i ] . serial == "30:d3:c1:67:26:5b:52:0c:b8:7f:25:84:4f:95:cb:04" or pe.signatures [ i ] . serial == "1e:52:bb:f5:c9:0e:c1:64:d0:5b:e0:e4:16:61:52:5f" or pe.signatures [ i ] . serial == "25:f8:78:22:de:56:d3:98:21:59:28:73:ea:09:ca:37" or pe.signatures [ i ] . serial == "67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT41_CN_ELF_Speculoos_Backdoor : FILE
 {
 	meta:
@@ -289447,9 +287425,9 @@ rule SIGNATURE_BASE_APT_APT41_CN_ELF_Speculoos_Backdoor : FILE
 		date = "2020-04-14"
 		modified = "2023-12-05"
 		reference = "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt41.yar#L233-L267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ee4cbbc5fc51fb24cbf6017dfb4763ac72a0b23a3b6e794b909e678ebfbabc03"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt41.yar#L233-L267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ee4cbbc5fc51fb24cbf6017dfb4763ac72a0b23a3b6e794b909e678ebfbabc03"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -289476,10 +287454,8 @@ rule SIGNATURE_BASE_APT_APT41_CN_ELF_Speculoos_Backdoor : FILE
                63 2F }
 
 	condition:
-		uint16(0)==0x457f and filesize <600KB and 1 of ($x*) or 4 of them
+		uint16( 0 ) == 0x457f and filesize < 600KB and 1 of ( $x* ) or 4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Emotet_JS_Dropper_Oct19_1 : FILE
 {
 	meta:
@@ -289489,9 +287465,9 @@ rule SIGNATURE_BASE_MAL_Emotet_JS_Dropper_Oct19_1 : FILE
 		date = "2019-10-03"
 		modified = "2023-12-05"
 		reference = "https://app.any.run/tasks/aaa75105-dc85-48ca-9732-085b2ceeb6eb/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_emotet.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "563077f3bc8ee18a887eecb9f0591c693e5543a9875eebad2186745154af1ade"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_emotet.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_563077f3bc8ee18a887eecb9f0591c693e5543a9875eebad2186745154af1ade"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289503,7 +287479,7 @@ rule SIGNATURE_BASE_MAL_Emotet_JS_Dropper_Oct19_1 : FILE
                27 00 }
 
 	condition:
-		uint32(0)==0x0076feff and filesize <=700KB and $xc1 at 0
+		uint32( 0 ) == 0x0076feff and filesize <= 700KB and $xc1 at 0
 }
 import "pe"
 
@@ -289516,9 +287492,9 @@ rule SIGNATURE_BASE_MAL_Emotet_Jan20_1 : FILE
 		date = "2020-01-29"
 		modified = "2023-12-05"
 		reference = "https://app.any.run/tasks/5e81638e-df2e-4a5b-9e45-b07c38d53929/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_emotet.yar#L20-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "23ffcdde3eae7637e5b47a0f940cbebafccfd4c3f222b882e73d7d02447b83c3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_emotet.yar#L20-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_23ffcdde3eae7637e5b47a0f940cbebafccfd4c3f222b882e73d7d02447b83c3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289530,10 +287506,8 @@ rule SIGNATURE_BASE_MAL_Emotet_Jan20_1 : FILE
 		$op2 = { 8b 7d fc 0f 85 49 ff ff ff 85 db 0f 84 d1 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=200KB and (pe.imphash()=="009889c73bd2e55113bf6dfa5f395e0d" or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize <= 200KB and ( pe.imphash ( ) == "009889c73bd2e55113bf6dfa5f395e0d" or 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Emotet_BKA_Quarantine_Apr21
 {
 	meta:
@@ -289543,9 +287517,9 @@ rule SIGNATURE_BASE_MAL_Emotet_BKA_Quarantine_Apr21
 		date = "2021-03-23"
 		modified = "2023-12-05"
 		reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_emotet.yar#L39-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cc75be5f641e21446a41bf9cc855330a612847e7e3a3be935577d33195f40d05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_emotet.yar#L39-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cc75be5f641e21446a41bf9cc855330a612847e7e3a3be935577d33195f40d05"
 		score = 75
 		quality = 85
 		tags = ""
@@ -289559,8 +287533,6 @@ rule SIGNATURE_BASE_MAL_Emotet_BKA_Quarantine_Apr21
 	condition:
 		$key at 0
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Emotet_BKA_Cleanup_Apr21 : FILE
 {
 	meta:
@@ -289570,9 +287542,9 @@ rule SIGNATURE_BASE_MAL_Emotet_BKA_Cleanup_Apr21 : FILE
 		date = "2021-03-23"
 		modified = "2023-12-05"
 		reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_emotet.yar#L54-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "533adaed96d015ea2dcd54d5aaf9e71b5b70430ed5733a98618925cf978a6515"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_emotet.yar#L54-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_533adaed96d015ea2dcd54d5aaf9e71b5b70430ed5733a98618925cf978a6515"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289584,7 +287556,7 @@ rule SIGNATURE_BASE_MAL_Emotet_BKA_Cleanup_Apr21 : FILE
 		$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
 
 	condition:
-		filesize >300KB and filesize <700KB and uint16(0)==0x5A4D and $key
+		filesize > 300KB and filesize < 700KB and uint16( 0 ) == 0x5A4D and $key
 }
 rule SIGNATURE_BASE_Quasar_RAT_1 : FILE
 {
@@ -289595,9 +287567,9 @@ rule SIGNATURE_BASE_Quasar_RAT_1 : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_quasar_rat.yar#L10-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7cceccb7c283774318f6285b482a422566f4f821eb51d564104205783401931a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_quasar_rat.yar#L10-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7cceccb7c283774318f6285b482a422566f4f821eb51d564104205783401931a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289617,7 +287589,7 @@ rule SIGNATURE_BASE_Quasar_RAT_1 : FILE
 		$op3 = { 00 04 03 69 91 1b 40 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and all of ($s*) or all of ($op*))
+		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of ( $s* ) or all of ( $op* ) )
 }
 rule SIGNATURE_BASE_Quasar_RAT_2 : FILE
 {
@@ -289628,9 +287600,9 @@ rule SIGNATURE_BASE_Quasar_RAT_2 : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_quasar_rat.yar#L35-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b113cb63b0bb75766c905dd3b327b1b2df228733622df8f7517d3daed72432a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_quasar_rat.yar#L35-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b113cb63b0bb75766c905dd3b327b1b2df228733622df8f7517d3daed72432a3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289651,7 +287623,7 @@ rule SIGNATURE_BASE_Quasar_RAT_2 : FILE
 		$s5 = "RunHidden" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and $x1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_MAL_Quasarrat_May19_1 : FILE
 {
@@ -289662,9 +287634,9 @@ rule SIGNATURE_BASE_MAL_Quasarrat_May19_1 : FILE
 		date = "2019-05-27"
 		modified = "2023-01-06"
 		reference = "https://blog.ensilo.com/uncovering-new-activity-by-apt10"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_quasar_rat.yar#L61-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a189bce433c71d45fd7f5d7fc284fc5b35c88a7ec616dd392d0e931165263aca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_quasar_rat.yar#L61-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a189bce433c71d45fd7f5d7fc284fc5b35c88a7ec616dd392d0e931165263aca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289688,7 +287660,7 @@ rule SIGNATURE_BASE_MAL_Quasarrat_May19_1 : FILE
                00 20 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 10000KB and 1 of them
 }
 rule SIGNATURE_BASE_Hatman_Compiled_Python : HATMAN
 {
@@ -289699,9 +287671,9 @@ rule SIGNATURE_BASE_Hatman_Compiled_Python : HATMAN
 		date = "2017-12-19"
 		modified = "2023-12-05"
 		reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L86-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a18018e4c6ea5b7ab6e1dbdc050e565f66520676565db6d352f58a786097960f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L86-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a18018e4c6ea5b7ab6e1dbdc050e565f66520676565db6d352f58a786097960f"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
@@ -289718,15 +287690,15 @@ rule SIGNATURE_BASE_Hatman_Injector : HATMAN
 		date = "2017-12-19"
 		modified = "2023-01-09"
 		reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L96-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "19edf44bec6e1cbccefa145c5ae1bf0820729a80ac3ef1c8e7100b465b487e3c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L96-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_19edf44bec6e1cbccefa145c5ae1bf0820729a80ac3ef1c8e7100b465b487e3c"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
 
 	condition:
-		(SIGNATURE_BASE_Hatman_Memcpy_PRIVATE and SIGNATURE_BASE_Hatman_Origaddr_PRIVATE and SIGNATURE_BASE_Hatman_Loadoff_PRIVATE)
+		(SIGNATURE_BASE_Hatman_Memcpy_PRIVATE and SIGNATURE_BASE_Hatman_Origaddr_PRIVATE and SIGNATURE_BASE_Hatman_Loadoff_PRIVATE )
 }
 rule SIGNATURE_BASE_Hatman_Payload : HATMAN
 {
@@ -289737,15 +287709,15 @@ rule SIGNATURE_BASE_Hatman_Payload : HATMAN
 		date = "2017-12-19"
 		modified = "2023-12-05"
 		reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hatman.yar#L107-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9a6e5d2c2f2be35e6dc8b418e33419977460006923ecd9f029cacf51d8c0477a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hatman.yar#L107-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9a6e5d2c2f2be35e6dc8b418e33419977460006923ecd9f029cacf51d8c0477a"
 		score = 75
 		quality = 85
 		tags = "HATMAN"
 
 	condition:
-		(SIGNATURE_BASE_Hatman_Memcpy_PRIVATE and SIGNATURE_BASE_Hatman_Origcode_PRIVATE and SIGNATURE_BASE_Hatman_Mftmsr_PRIVATE) and not (SIGNATURE_BASE_Hatman_Origaddr_PRIVATE and SIGNATURE_BASE_Hatman_Loadoff_PRIVATE)
+		(SIGNATURE_BASE_Hatman_Memcpy_PRIVATE and SIGNATURE_BASE_Hatman_Origcode_PRIVATE and SIGNATURE_BASE_Hatman_Mftmsr_PRIVATE ) and not ( SIGNATURE_BASE_Hatman_Origaddr_PRIVATE and SIGNATURE_BASE_Hatman_Loadoff_PRIVATE )
 }
 rule SIGNATURE_BASE_APT_MAL_CISA_10365227_03_Clientuploader_Dec21 : FILE
 {
@@ -289756,9 +287728,9 @@ rule SIGNATURE_BASE_APT_MAL_CISA_10365227_03_Clientuploader_Dec21 : FILE
 		date = "2021-12-23"
 		modified = "2021-12-24"
 		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stealer_cisa_ar22_277a.yar#L4-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "76f552b2416ae2426b73a321485f34a611c2a3c1ca35791bc9f1834072dc28be"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stealer_cisa_ar22_277a.yar#L4-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_76f552b2416ae2426b73a321485f34a611c2a3c1ca35791bc9f1834072dc28be"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -289773,7 +287745,7 @@ rule SIGNATURE_BASE_APT_MAL_CISA_10365227_03_Clientuploader_Dec21 : FILE
 		$s6 = "$ee1b3f3b-b13c-432e-a461-e52d273896a7"
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21 : APPSTORAGE FILE
 {
@@ -289784,9 +287756,9 @@ rule SIGNATURE_BASE_APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21 : APPSTORAGE FILE
 		date = "2021-12-23"
 		modified = "2021-12-24"
 		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stealer_cisa_ar22_277a.yar#L25-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6a46bc4efa1f22d9fc65d946dbaa7b94de6074e65c228373bb6001f152d5b603"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stealer_cisa_ar22_277a.yar#L25-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6a46bc4efa1f22d9fc65d946dbaa7b94de6074e65c228373bb6001f152d5b603"
 		score = 80
 		quality = 85
 		tags = "APPSTORAGE, FILE"
@@ -289803,7 +287775,7 @@ rule SIGNATURE_BASE_APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21 : APPSTORAGE FILE
 		$s6 = "hrjio2mfsdlf235d" wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_APT_MAL_CISA_10365227_02_Clientuploader_Dec21 : FILE
 {
@@ -289814,9 +287786,9 @@ rule SIGNATURE_BASE_APT_MAL_CISA_10365227_02_Clientuploader_Dec21 : FILE
 		date = "2021-12-23"
 		modified = "2021-12-24"
 		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stealer_cisa_ar22_277a.yar#L48-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f9f82b4577568d0bd60bac0d3132ed7ffcb338f508a8689f3126f3d2440432ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stealer_cisa_ar22_277a.yar#L48-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f9f82b4577568d0bd60bac0d3132ed7ffcb338f508a8689f3126f3d2440432ef"
 		score = 80
 		quality = 81
 		tags = "FILE"
@@ -289831,7 +287803,7 @@ rule SIGNATURE_BASE_APT_MAL_CISA_10365227_02_Clientuploader_Dec21 : FILE
 		$s6 = { 4F 6E 65 44 72 69 76 65 43 6C 69 65 6E 74 2E 4F 6E 65 44 72 69 76 65 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_HKTL_Koh_Tokenstealer : FILE
 {
@@ -289842,9 +287814,9 @@ rule SIGNATURE_BASE_HKTL_Koh_Tokenstealer : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/GhostPack/Koh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_hktl_koh_tokenstealer.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e2c4d948e23f1a3a92689f35fedde6e041d09cd88deac9ff3249556be0b8f789"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_hktl_koh_tokenstealer.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e2c4d948e23f1a3a92689f35fedde6e041d09cd88deac9ff3249556be0b8f789"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -289857,10 +287829,8 @@ rule SIGNATURE_BASE_HKTL_Koh_Tokenstealer : FILE
 		$s4 = "\\Koh.pdb" ascii
 
 	condition:
-		uint16(0)==0x5A4D and 1 of ($x*) or 3 of them
+		uint16( 0 ) == 0x5A4D and 1 of ( $x* ) or 3 of them
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Generic : FILE
 {
 	meta:
@@ -289870,8 +287840,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic : FILE
 		date = "2021-01-14"
 		modified = "2023-09-18"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L83-L410"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L83-L410"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd"
 		hash = "6bf351900a408120bee3fc6ea39905c6a35fe6efcf35d0a783ee92062e63a854"
 		hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
@@ -289899,7 +287869,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic : FILE
 		hash = "a09dcf52da767815f29f66cb7b03f3d8c102da5cf7b69567928961c389eac11f"
 		hash = "d9ae762b011216e520ebe4b7abcac615c61318a8195601526cfa11bbc719a8f1"
 		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
-		logic_hash = "7180250e8a6dd8c14f193fe007b7fd17dc215b470065eb71e7e987699605bc4f"
+		logic_hash = "v1_sha256_7180250e8a6dd8c14f193fe007b7fd17dc215b470065eb71e7e987699605bc4f"
 		score = 75
 		quality = -259
 		tags = "FILE"
@@ -290083,10 +288053,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic : FILE
 		$fp2 = "{@see TFileUpload} for further details." ascii
 
 	condition:
-		not ( any of ($gfp_tiny*) or 1 of ($fp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($inp*)) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) and (( filesize <1000 and not any of ($wfp_tiny*)) or (($gif at 0 or ( filesize <4KB and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 3 of ($gen_bit_sus*))) or ( filesize <50KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <100KB and (2 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <150KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*)))) and ( filesize >5KB or not any of ($wfp_tiny*))) or ( filesize <500KB and (4 of ($cmpayload*))))
+		not ( any of ( $gfp_tiny* ) or 1 of ( $fp* ) ) and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( any of ( $inp* ) ) and ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) and ( ( filesize < 1000 and not any of ( $wfp_tiny* ) ) or ( ( $gif at 0 or ( filesize < 4KB and ( 1 of ( $gen_much_sus* ) or 2 of ( $gen_bit_sus* ) ) ) or ( filesize < 20KB and ( 2 of ( $gen_much_sus* ) or 3 of ( $gen_bit_sus* ) ) ) or ( filesize < 50KB and ( 2 of ( $gen_much_sus* ) or 4 of ( $gen_bit_sus* ) ) ) or ( filesize < 100KB and ( 2 of ( $gen_much_sus* ) or 6 of ( $gen_bit_sus* ) ) ) or ( filesize < 150KB and ( 3 of ( $gen_much_sus* ) or 7 of ( $gen_bit_sus* ) ) ) or ( filesize < 500KB and ( 4 of ( $gen_much_sus* ) or 8 of ( $gen_bit_sus* ) ) ) ) and ( filesize > 5KB or not any of ( $wfp_tiny* ) ) ) or ( filesize < 500KB and ( 4 of ( $cmpayload* ) ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Callback : FILE
 {
 	meta:
@@ -290096,8 +288064,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Callback : FILE
 		date = "2021-01-14"
 		modified = "2023-09-18"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L412-L717"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L412-L717"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e98889690101b59260e871c49263314526f2093f"
 		hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
 		hash = "81388c8cc99353cdb42572bb88df7d3bd70eefc748c2fa4224b6074aa8d7e6a2"
@@ -290113,7 +288081,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Callback : FILE
 		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
 		hash = "de1ef827bcd3100a259f29730cb06f7878220a7c02cee0ebfc9090753d2237a8"
 		hash = "487e8c08e85774dfd1f5e744050c08eb7d01c6877f7d03d7963187748339e8c4"
-		logic_hash = "e12dec5252a816c10443fe0e0b40b0b9b4a187b32facd8e09e1f057801da25f9"
+		logic_hash = "v1_sha256_e12dec5252a816c10443fe0e0b40b0b9b4a187b32facd8e09e1f057801da25f9"
 		score = 60
 		quality = -153
 		tags = "FILE"
@@ -290302,10 +288270,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Callback : FILE
 		$gif = { 47 49 46 38 }
 
 	condition:
-		not ( any of ($gfp*)) and not ( any of ($gfp_tiny*)) and ( any of ($inp*)) and ( not any of ($cfp*) and ( any of ($callback*) or all of ($m_callback*))) and ( filesize <1000 or ($gif at 0 or ( filesize <4KB and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 3 of ($gen_bit_sus*))) or ( filesize <50KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <100KB and (2 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <150KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*)))))
+		not ( any of ( $gfp* ) ) and not ( any of ( $gfp_tiny* ) ) and ( any of ( $inp* ) ) and ( not any of ( $cfp* ) and ( any of ( $callback* ) or all of ( $m_callback* ) ) ) and ( filesize < 1000 or ( $gif at 0 or ( filesize < 4KB and ( 1 of ( $gen_much_sus* ) or 2 of ( $gen_bit_sus* ) ) ) or ( filesize < 20KB and ( 2 of ( $gen_much_sus* ) or 3 of ( $gen_bit_sus* ) ) ) or ( filesize < 50KB and ( 2 of ( $gen_much_sus* ) or 4 of ( $gen_bit_sus* ) ) ) or ( filesize < 100KB and ( 2 of ( $gen_much_sus* ) or 6 of ( $gen_bit_sus* ) ) ) or ( filesize < 150KB and ( 3 of ( $gen_much_sus* ) or 7 of ( $gen_bit_sus* ) ) ) or ( filesize < 500KB and ( 4 of ( $gen_much_sus* ) or 8 of ( $gen_bit_sus* ) ) ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Base64_Encoded_Payloads : FILE
 {
 	meta:
@@ -290315,8 +288281,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Base64_Encoded_Payloads : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L719-L869"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L719-L869"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "88d0d4696c9cb2d37d16e330e236cb37cfaec4cd"
 		hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
 		hash = "e726cd071915534761822805724c6c6bfe0fcac604a86f09437f03f301512dc5"
@@ -290332,7 +288298,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Base64_Encoded_Payloads : FILE
 		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
 		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
 		hash = "e2b1dfcfaa61e92526a3a444be6c65330a8db4e692543a421e19711760f6ffe2"
-		logic_hash = "8f606dc3e1e688cca144fe769af50980b4c25fa69b08c67aca8c676a6a060010"
+		logic_hash = "v1_sha256_8f606dc3e1e688cca144fe769af50980b4c25fa69b08c67aca8c676a6a060010"
 		score = 75
 		quality = 17
 		tags = "FILE"
@@ -290421,10 +288387,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Base64_Encoded_Payloads : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize <300KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and not any of ($fp*) and any of ($decode*) and (( any of ($one*) and not any of ($execu*)) or any of ($two*) or any of ($three*) or ( any of ($four*) and not any of ($esystem*)) or ( any of ($five*) and not any of ($opening*)) or any of ($six*) or any of ($seven*) or any of ($eight*) or any of ($nine*))
+		filesize < 300KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and not any of ( $fp* ) and any of ( $decode* ) and ( ( any of ( $one* ) and not any of ( $execu* ) ) or any of ( $two* ) or any of ( $three* ) or ( any of ( $four* ) and not any of ( $esystem* ) ) or ( any of ( $five* ) and not any of ( $opening* ) ) or any of ( $six* ) or any of ( $seven* ) or any of ( $eight* ) or any of ( $nine* ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Unknown_1 : FILE
 {
 	meta:
@@ -290434,11 +288398,11 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Unknown_1 : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L871-L893"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L871-L893"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "12ce6c7167b33cc4e8bdec29fb1cfc44ac9487d1"
 		hash = "cf4abbd568ce0c0dfce1f2e4af669ad2"
-		logic_hash = "ce2d4c87c001a45febf7eac5474aa0d24ea73067f9154203ef5653bf77e7028f"
+		logic_hash = "v1_sha256_ce2d4c87c001a45febf7eac5474aa0d24ea73067f9154203ef5653bf77e7028f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -290452,10 +288416,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Unknown_1 : FILE
 		$sp3 = " = NULL; for(" wide ascii
 
 	condition:
-		filesize <300KB and all of ($sp*)
+		filesize < 300KB and all of ( $sp* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Eval : FILE
 {
 	meta:
@@ -290465,8 +288427,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Eval : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L895-L954"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L895-L954"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a61437a427062756e2221bfb6d58cd62439d09d9"
 		hash = "90c5cc724ec9cf838e4229e5e08955eec4d7bf95"
 		hash = "2b41abc43c5b6c791d4031005bf7c5104a98e98a00ee24620ce3e8e09a78e78f"
@@ -290486,7 +288448,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Eval : FILE
 		hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
 		hash = "6d042b6393669bb4d98213091cabe554ab192a6c916e86c04d06cc2a4ca92c00"
 		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
-		logic_hash = "4b7759e4761f5897bfb5e576df645a2e99cec4e703fb28d0fc275cf8f8848263"
+		logic_hash = "v1_sha256_4b7759e4761f5897bfb5e576df645a2e99cec4e703fb28d0fc275cf8f8848263"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -290511,10 +288473,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Eval : FILE
 		$gfp_4 = " POST /"
 
 	condition:
-		filesize <300KB and not ( any of ($gfp*)) and $geval
+		filesize < 300KB and not ( any of ( $gfp* ) ) and $geval
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Double_Eval_Tiny : FILE
 {
 	meta:
@@ -290524,14 +288484,14 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Double_Eval_Tiny : FILE
 		date = "2021-01-11"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L956-L1007"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L956-L1007"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f66fb918751acc7b88a17272a044b5242797976c73a6e54ac6b04b02f61e9761"
 		hash = "6b2f0a3bd80019dea536ddbf92df36ab897dd295840cb15bb7b159d0ee2106ff"
 		hash = "aabfd179aaf716929c8b820eefa3c1f613f8dcac"
 		hash = "9780c70bd1c76425d4313ca7a9b89dda77d2c664"
 		hash = "006620d2a701de73d995fc950691665c0692af11"
-		logic_hash = "cf0405e8a44497574d75291bf86bf9413d9a64140e820f7f5a655fe5302c6918"
+		logic_hash = "v1_sha256_cf0405e8a44497574d75291bf86bf9413d9a64140e820f7f5a655fe5302c6918"
 		score = 75
 		quality = 42
 		tags = "FILE"
@@ -290554,10 +288514,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Double_Eval_Tiny : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize >70 and filesize <300 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and #payload>=2 and not any of ($fp*)
+		filesize > 70 and filesize < 300 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and #payload >= 2 and not any of ( $fp* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC : FILE
 {
 	meta:
@@ -290567,13 +288525,13 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC : FILE
 		date = "2021-01-12"
 		modified = "2024-03-11"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1009-L1135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1009-L1135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "eec9ac58a1e763f5ea0f7fa249f1fe752047fa60"
 		hash = "181a71c99a4ae13ebd5c94bfc41f9ec534acf61cd33ef5bce5fb2a6f48b65bf4"
 		hash = "76d4e67e13c21662c4b30aab701ce9cdecc8698696979e504c288f20de92aee7"
 		hash = "1d0643927f04cb1133f00aa6c5fa84aaf88e5cf14d7df8291615b402e8ab6dc2"
-		logic_hash = "8d7150a4fc657efe3526d5f8f624a66e7186a3f42b4605cc349bd31deeb71b7f"
+		logic_hash = "v1_sha256_8d7150a4fc657efe3526d5f8f624a66e7186a3f42b4605cc349bd31deeb71b7f"
 		score = 75
 		quality = -73
 		tags = "FILE"
@@ -290631,10 +288589,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC : FILE
 		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
 
 	condition:
-		not ( any of ($gfp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( not $fp1 and (( filesize <20KB and ((#o1+#o2)>50 or #o3>10 or (#o4+#o5+#o6+#o7+#o8+#o9)>20)) or ( filesize <200KB and ((#o1+#o2)>200 or #o3>30 or (#o4+#o5+#o6+#o7+#o8+#o9)>30)))) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*))
+		not ( any of ( $gfp* ) ) and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( not $fp1 and ( ( filesize < 20KB and ( ( #o1 + #o2 ) > 50 or #o3 > 10 or ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 20 ) ) or ( filesize < 200KB and ( ( #o1 + #o2 ) > 200 or #o3 > 30 or ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 30 ) ) ) ) and ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded : FILE
 {
 	meta:
@@ -290644,12 +288600,12 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded : FILE
 		date = "2021-04-18"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1137-L1188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1137-L1188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "119fc058c9c5285498a47aa271ac9a27f6ada1bf4d854ccd4b01db993d61fc52"
 		hash = "d5ca3e4505ea122019ea263d6433221030b3f64460d3ce2c7d0d63ed91162175"
 		hash = "8a1e2d72c82f6a846ec066d249bfa0aaf392c65149d39b7b15ba19f9adc3b339"
-		logic_hash = "c2a88e48374f949fcc9c14b773f7709c96b3147d1982ae9721708474ee5a3dcd"
+		logic_hash = "v1_sha256_c2a88e48374f949fcc9c14b773f7709c96b3147d1982ae9721708474ee5a3dcd"
 		score = 70
 		quality = -64
 		tags = "FILE"
@@ -290672,10 +288628,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize <700KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($enc*)
+		filesize < 700KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and any of ( $enc* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex : FILE
 {
 	meta:
@@ -290685,8 +288639,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex : FILE
 		date = "2021-04-18"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1190-L1246"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1190-L1246"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0e21931b16f30b1db90a27eafabccc91abd757fa63594ba8a6ad3f477de1ab1c"
 		hash = "929975272f0f42bf76469ed89ebf37efcbd91c6f8dac1129c7ab061e2564dd06"
 		hash = "88fce6c1b589d600b4295528d3fcac161b581f739095b99cd6c768b7e16e89ff"
@@ -290699,7 +288653,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex : FILE
 		hash = "fb031af7aa459ee88a9ca44013a76f6278ad5846aa20e5add4aeb5fab058d0ee"
 		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
 		hash = "0ff05e6695074f98b0dee6200697a997c509a652f746d2c1c92c0b0a0552ca47"
-		logic_hash = "d9b4d224d43915cf08050c173627b314c3e41a30ecfffe28038281eadc114e51"
+		logic_hash = "v1_sha256_d9b4d224d43915cf08050c173627b314c3e41a30ecfffe28038281eadc114e51"
 		score = 75
 		quality = 17
 		tags = "FILE"
@@ -290719,10 +288673,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize <700KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($mix*)
+		filesize < 700KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and any of ( $mix* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Tiny : FILE
 {
 	meta:
@@ -290732,12 +288684,12 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Tiny : FILE
 		date = "2021-01-12"
 		modified = "2024-03-11"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1248-L1343"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1248-L1343"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b7b7aabd518a2f8578d4b1bc9a3af60d155972f1"
 		hash = "694ec6e1c4f34632a9bd7065f73be473"
 		hash = "5c871183444dbb5c8766df6b126bd80c624a63a16cc39e20a0f7b002216b2ba5"
-		logic_hash = "993f1c98362dcbc207c6ceacb116a27d44505dc6dfa1874def780af50422e1b9"
+		logic_hash = "v1_sha256_993f1c98362dcbc207c6ceacb116a27d44505dc6dfa1874def780af50422e1b9"
 		score = 75
 		quality = -190
 		tags = "FILE"
@@ -290788,10 +288740,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Tiny : FILE
 		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
 
 	condition:
-		filesize <500 and not ( any of ($gfp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) and ((#obf1+#obf2)>2 or #obf3>10)
+		filesize < 500 and not ( any of ( $gfp* ) ) and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) and ( ( #obf1 + #obf2 ) > 2 or #obf3 > 10 )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Str_Replace : FILE
 {
 	meta:
@@ -290801,15 +288751,15 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Str_Replace : FILE
 		date = "2021-01-12"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1345-L1400"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1345-L1400"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "691305753e26884d0f930cda0fe5231c6437de94"
 		hash = "7efd463aeb5bf0120dc5f963b62463211bd9e678"
 		hash = "fb655ddb90892e522ae1aaaf6cd8bde27a7f49ef"
 		hash = "d1863aeca1a479462648d975773f795bb33a7af2"
 		hash = "4d31d94b88e2bbd255cf501e178944425d40ee97"
 		hash = "e1a2af3477d62a58f9e6431f5a4a123fb897ea80"
-		logic_hash = "74fb86a7ee7342ede9f49ef004a92fb7bdf06ca62f8e8f0ea1c6adcff96bcb2d"
+		logic_hash = "v1_sha256_74fb86a7ee7342ede9f49ef004a92fb7bdf06ca62f8e8f0ea1c6adcff96bcb2d"
 		score = 75
 		quality = 46
 		tags = "FILE"
@@ -290834,10 +288784,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Str_Replace : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize <300KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($payload*) and #goto>1 and (#chr1>10 or #chr2>10 or #chr3>10)
+		filesize < 300KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and any of ( $payload* ) and #goto > 1 and ( #chr1 > 10 or #chr2 > 10 or #chr3 > 10 )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Fopo : FILE
 {
 	meta:
@@ -290847,12 +288795,12 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Fopo : FILE
 		date = "2021-01-12"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1402-L1462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1402-L1462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fbcff8ea5ce04fc91c05384e847f2c316e013207"
 		hash = "6da57ad8be1c587bb5cc8a1413f07d10fb314b72"
 		hash = "a698441f817a9a72908a0d93a34133469f33a7b34972af3e351bdccae0737d99"
-		logic_hash = "076c0c256e5951cdcb2b7bc55030f55bec48c1bea953b8bd85559a3230e387ae"
+		logic_hash = "v1_sha256_076c0c256e5951cdcb2b7bc55030f55bec48c1bea953b8bd85559a3230e387ae"
 		score = 75
 		quality = 40
 		tags = "FILE"
@@ -290884,10 +288832,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Fopo : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize <3000KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and $payload and ( any of ($one*) or any of ($two*))
+		filesize < 3000KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and $payload and ( any of ( $one* ) or any of ( $two* ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Gzinflated : FILE
 {
 	meta:
@@ -290897,14 +288843,14 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Gzinflated : FILE
 		date = "2021-01-12"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1464-L1537"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1464-L1537"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "49e5bc75a1ec36beeff4fbaeb16b322b08cf192d"
 		hash = "6f36d201cd32296bad9d5864c7357e8634f365cc"
 		hash = "ab10a1e69f3dfe7c2ad12b2e6c0e66db819c2301"
 		hash = "a6cf337fe11fe646d7eee3d3f09c7cb9643d921d"
 		hash = "07eb6634f28549ebf26583e8b154c6a579b8a733"
-		logic_hash = "d2edb7050c986a00889fd01b709ec0aa1409ce2e40a15b7942562d12596b190e"
+		logic_hash = "v1_sha256_d2edb7050c986a00889fd01b709ec0aa1409ce2e40a15b7942562d12596b190e"
 		score = 75
 		quality = 32
 		tags = "FILE"
@@ -290941,10 +288887,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Gzinflated : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize <700KB and not ( any of ($gfp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and 1 of ($payload*) and not any of ($fp*)
+		filesize < 700KB and not ( any of ( $gfp* ) ) and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and 1 of ( $payload* ) and not any of ( $fp* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_3 : FILE
 {
 	meta:
@@ -290954,13 +288898,13 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_3 : FILE
 		date = "2021-04-17"
 		modified = "2024-03-11"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1539-L1844"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1539-L1844"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "11bb1fa3478ec16c00da2a1531906c05e9c982ea"
 		hash = "d6b851cae249ea6744078393f622ace15f9880bc"
 		hash = "14e02b61905cf373ba9234a13958310652a91ece"
 		hash = "6f97f607a3db798128288e32de851c6f56e91c1d"
-		logic_hash = "904deddb937c39cd5aab3cdeccb8101e87c909a70f52bed1c9f7e3e4c923e685"
+		logic_hash = "v1_sha256_904deddb937c39cd5aab3cdeccb8101e87c909a70f52bed1c9f7e3e4c923e685"
 		score = 75
 		quality = -298
 		tags = "FILE"
@@ -291150,10 +289094,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_3 : FILE
 		$gif = { 47 49 46 38 }
 
 	condition:
-		((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and (( not any of ($cfp*) and ( any of ($callback*) or all of ($m_callback*))) or ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*))) and ( any of ($cobfs*)) and ( filesize <1KB or ( filesize <3KB and (($gif at 0 or ( filesize <4KB and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 3 of ($gen_bit_sus*))) or ( filesize <50KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <100KB and (2 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <150KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*)))) or #obf1>10)))
+		(( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( ( not any of ( $cfp* ) and ( any of ( $callback* ) or all of ( $m_callback* ) ) ) or ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) ) and ( any of ( $cobfs* ) ) and ( filesize < 1KB or ( filesize < 3KB and ( ( $gif at 0 or ( filesize < 4KB and ( 1 of ( $gen_much_sus* ) or 2 of ( $gen_bit_sus* ) ) ) or ( filesize < 20KB and ( 2 of ( $gen_much_sus* ) or 3 of ( $gen_bit_sus* ) ) ) or ( filesize < 50KB and ( 2 of ( $gen_much_sus* ) or 4 of ( $gen_bit_sus* ) ) ) or ( filesize < 100KB and ( 2 of ( $gen_much_sus* ) or 6 of ( $gen_bit_sus* ) ) ) or ( filesize < 150KB and ( 3 of ( $gen_much_sus* ) or 7 of ( $gen_bit_sus* ) ) ) or ( filesize < 500KB and ( 4 of ( $gen_much_sus* ) or 8 of ( $gen_bit_sus* ) ) ) ) or #obf1 > 10 ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Eval : FILE
 {
 	meta:
@@ -291163,13 +289105,13 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Eval : FILE
 		date = "2021-01-13"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1846-L1895"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1846-L1895"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3a07e9188028efa32872ba5b6e5363920a6b2489"
 		hash = "ab771bb715710892b9513b1d075b4e2c0931afb6"
 		hash = "202dbcdc2896873631e1a0448098c820c82bcc8385a9f7579a0dc9702d76f580"
 		hash = "b51a6d208ec3a44a67cce16dcc1e93cdb06fe150acf16222815333ddf52d4db8"
-		logic_hash = "a7e9632c495e5d4cc883e2593c8ebe41cdf6a18b54bd6dfd3aec85352f19321c"
+		logic_hash = "v1_sha256_a7e9632c495e5d4cc883e2593c8ebe41cdf6a18b54bd6dfd3aec85352f19321c"
 		score = 75
 		quality = 46
 		tags = "FILE"
@@ -291192,10 +289134,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Eval : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize <200 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and 1 of ($payload*) and 1 of ($include*)
+		filesize < 200 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and 1 of ( $payload* ) and 1 of ( $include* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Tiny : FILE
 {
 	meta:
@@ -291205,12 +289145,12 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Tiny : FILE
 		date = "2021-04-17"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1897-L1942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1897-L1942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0687585025f99596508783b891e26d6989eec2ba"
 		hash = "9e856f5cb7cb901b5003e57c528a6298341d04dc"
 		hash = "b3b0274cda28292813096a5a7a3f5f77378b8905205bda7bb7e1a679a7845004"
-		logic_hash = "e1efb6384009def30d845650fd0dd77319c3c7b4402cca074ca5c2a06372ab58"
+		logic_hash = "v1_sha256_e1efb6384009def30d845650fd0dd77319c3c7b4402cca074ca5c2a06372ab58"
 		score = 75
 		quality = 42
 		tags = "FILE"
@@ -291230,10 +289170,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Tiny : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize <100 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($php_include*)
+		filesize < 100 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and any of ( $php_include* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic : FILE
 {
 	meta:
@@ -291243,13 +289181,13 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic : FILE
 		date = "2021-01-13"
 		modified = "2023-10-06"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L1944-L2016"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L1944-L2016"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "65dca1e652d09514e9c9b2e0004629d03ab3c3ef"
 		hash = "b8ab38dc75cec26ce3d3a91cb2951d7cdd004838"
 		hash = "c4765e81550b476976604d01c20e3dbd415366df"
 		hash = "2e11ba2d06ebe0aa818e38e24a8a83eebbaae8877c10b704af01bf2977701e73"
-		logic_hash = "5eb0a574852163008d7bd9bd4822248fdc6bd333bc38715201ea346e07a2e75c"
+		logic_hash = "v1_sha256_5eb0a574852163008d7bd9bd4822248fdc6bd333bc38715201ea346e07a2e75c"
 		score = 60
 		quality = -131
 		tags = "FILE"
@@ -291287,7 +289225,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic : FILE
 		$fp8 = "/* Auto-generated from php/php-langspec tests */"
 
 	condition:
-		filesize >20 and filesize <200 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($dynamic*)) and not any of ($pd_fp*) and not 1 of ($fp*)
+		filesize > 20 and filesize < 200 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( any of ( $dynamic* ) ) and not any of ( $pd_fp* ) and not 1 of ( $fp* )
 }
 import "math"
 
@@ -291300,8 +289238,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic_Big : FILE
 		date = "2021-02-07"
 		modified = "2024-02-23"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2018-L2335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2018-L2335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6559bfc4be43a55c6bb2bd867b4c9b929713d3f7f6de8111a3c330f87a9b302c"
 		hash = "9e82c9c2fa64e26fd55aa18f74759454d89f968068d46b255bd4f41eb556112e"
 		hash = "6def5296f95e191a9c7f64f7d8ac5c529d4a4347ae484775965442162345dc93"
@@ -291311,7 +289249,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic_Big : FILE
 		hash = "b49d0f942a38a33d2b655b1c32ac44f19ed844c2479bad6e540f69b807dd3022"
 		hash = "575edeb905b434a3b35732654eedd3afae81e7d99ca35848c509177aa9bf9eef"
 		hash = "ee34d62e136a04e2eaf84b8daa12c9f2233a366af83081a38c3c973ab5e2c40f"
-		logic_hash = "9e033789ab2f3d28bf48d8102edf51daf84a1d61d50cd59f3810be7c07a8e8d9"
+		logic_hash = "v1_sha256_9e033789ab2f3d28bf48d8102edf51daf84a1d61d50cd59f3810be7c07a8e8d9"
 		score = 50
 		quality = -386
 		tags = "FILE"
@@ -291471,7 +289409,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic_Big : FILE
 		$fp4 = "* @param string $lstat encoded LStat string" ascii
 
 	condition:
-		not ( uint16(0)==0x5a4d or uint32be(0)==0x3c3f786d or uint32be(0)==0x3c3f584d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50 or 1 of ($fp*)) and ( any of ($new_php*) or $php_short at 0) and ( any of ($dynamic*)) and ($gif at 0 or (( filesize <1KB and (1 of ($gen_much_sus*))) or ( filesize <2KB and ((#weevely1+#weevely2+#weevely3)>2 and #weevely4>1)) or ( filesize <4000 and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <50KB and (3 of ($gen_much_sus*) or 5 of ($gen_bit_sus*))) or ( filesize <100KB and (3 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <160KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*) or (math.deviation(500, filesize -500,89.0)>70))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*) or #gen_much_sus104>4))) or ( filesize >2KB and filesize <1MB and ((math.entropy(500, filesize -500)>=5.7 and math.mean(500, filesize -500)>80 and math.deviation(500, filesize -500,89.0)<23) or (math.entropy(500, filesize -500)>=7.7 and math.mean(500, filesize -500)>120 and math.mean(500, filesize -500)<136 and math.deviation(500, filesize -500,89.0)>65))))
+		not ( uint16( 0 ) == 0x5a4d or uint32be( 0 ) == 0x3c3f786d or uint32be( 0 ) == 0x3c3f584d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 or 1 of ( $fp* ) ) and ( any of ( $new_php* ) or $php_short at 0 ) and ( any of ( $dynamic* ) ) and ( $gif at 0 or ( ( filesize < 1KB and ( 1 of ( $gen_much_sus* ) ) ) or ( filesize < 2KB and ( ( #weevely1 + #weevely2 + #weevely3 ) > 2 and #weevely4 > 1 ) ) or ( filesize < 4000 and ( 1 of ( $gen_much_sus* ) or 2 of ( $gen_bit_sus* ) ) ) or ( filesize < 20KB and ( 2 of ( $gen_much_sus* ) or 4 of ( $gen_bit_sus* ) ) ) or ( filesize < 50KB and ( 3 of ( $gen_much_sus* ) or 5 of ( $gen_bit_sus* ) ) ) or ( filesize < 100KB and ( 3 of ( $gen_much_sus* ) or 6 of ( $gen_bit_sus* ) ) ) or ( filesize < 160KB and ( 3 of ( $gen_much_sus* ) or 7 of ( $gen_bit_sus* ) or ( math.deviation ( 500 , filesize - 500 , 89.0 ) > 70 ) ) ) or ( filesize < 500KB and ( 4 of ( $gen_much_sus* ) or 8 of ( $gen_bit_sus* ) or #gen_much_sus104 > 4 ) ) ) or ( filesize > 2KB and filesize < 1MB and ( ( math.entropy ( 500 , filesize - 500 ) >= 5.7 and math.mean ( 500 , filesize - 500 ) > 80 and math.deviation ( 500 , filesize - 500 , 89.0 ) < 23 ) or ( math.entropy ( 500 , filesize - 500 ) >= 7.7 and math.mean ( 500 , filesize - 500 ) > 120 and math.mean ( 500 , filesize - 500 ) < 136 and math.deviation ( 500 , filesize - 500 , 89.0 ) > 65 ) ) ) )
 }
 import "math"
 
@@ -291484,14 +289422,14 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Encoded_Big : FILE
 		date = "2021-02-07"
 		modified = "2024-03-11"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2337-L2424"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2337-L2424"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1d4b374d284c12db881ba42ee63ebce2759e0b14"
 		hash = "fc0086caee0a2cd20609a05a6253e23b5e3245b8"
 		hash = "b15b073801067429a93e116af1147a21b928b215"
 		hash = "74c92f29cf15de34b8866db4b40748243fb938b4"
 		hash = "042245ee0c54996608ff8f442c8bafb8"
-		logic_hash = "bbd6c1056d852ecae44d3abdb4a8386a62e985794f34037c4aa5fe7e1f4f3a72"
+		logic_hash = "v1_sha256_bbd6c1056d852ecae44d3abdb4a8386a62e985794f34037c4aa5fe7e1f4f3a72"
 		score = 50
 		quality = -129
 		tags = "FILE"
@@ -291522,10 +289460,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Encoded_Big : FILE
 		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
 
 	condition:
-		filesize <1000KB and ( any of ($new_php*) or $php_short at 0) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) and ( filesize >2KB and (math.entropy(500, filesize -500)>=5.7 and math.mean(500, filesize -500)>80 and math.deviation(500, filesize -500,89.0)<24) or (math.entropy(500, filesize -500)>=7.7 and math.mean(500, filesize -500)>120 and math.mean(500, filesize -500)<136 and math.deviation(500, filesize -500,89.0)>65))
+		filesize < 1000KB and ( any of ( $new_php* ) or $php_short at 0 ) and ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) and ( filesize > 2KB and ( math.entropy ( 500 , filesize - 500 ) >= 5.7 and math.mean ( 500 , filesize - 500 ) > 80 and math.deviation ( 500 , filesize - 500 , 89.0 ) < 24 ) or ( math.entropy ( 500 , filesize - 500 ) >= 7.7 and math.mean ( 500 , filesize - 500 ) > 120 and math.mean ( 500 , filesize - 500 ) < 136 and math.deviation ( 500 , filesize - 500 , 89.0 ) > 65 ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks : FILE
 {
 	meta:
@@ -291535,15 +289471,15 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2426-L2474"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2426-L2474"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "339f32c883f6175233f0d1a30510caa52fdcaa37"
 		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
 		hash = "af987b0eade03672c30c095cee0c7c00b663e4b3c6782615fb7e430e4a7d1d75"
 		hash = "67339f9e70a17af16cf51686918cbe1c0604e129950129f67fe445eaff4b4b82"
 		hash = "144e242a9b219c5570973ca26d03e82e9fbe7ba2773305d1713288ae3540b4ad"
 		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
-		logic_hash = "faa064686a5632788497d0300ba017c3e564f3b70f07a01f2e49bf7c934feb28"
+		logic_hash = "v1_sha256_faa064686a5632788497d0300ba017c3e564f3b70f07a01f2e49bf7c934feb28"
 		score = 75
 		quality = 44
 		tags = "FILE"
@@ -291563,10 +289499,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and $backtick and filesize <200
+		(( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and $backtick and filesize < 200
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks_OBFUSC : FILE
 {
 	meta:
@@ -291576,13 +289510,13 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks_OBFUSC : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2476-L2522"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2476-L2522"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "23dc299f941d98c72bd48659cdb4673f5ba93697"
 		hash = "e3f393a1530a2824125ecdd6ac79d80cfb18fffb89f470d687323fb5dff0eec1"
 		hash = "1e75914336b1013cc30b24d76569542447833416516af0d237c599f95b593f9b"
 		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
-		logic_hash = "34354283762d6f62a4537e914d969f84546339da9be533e209d8738605b7e3ac"
+		logic_hash = "v1_sha256_34354283762d6f62a4537e914d969f84546339da9be533e209d8738605b7e3ac"
 		score = 75
 		quality = 44
 		tags = "FILE"
@@ -291602,10 +289536,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks_OBFUSC : FILE
 		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		filesize <500 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and $s1
+		filesize < 500 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and $s1
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_By_String_Known_Webshell : FILE
 {
 	meta:
@@ -291615,8 +289547,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_By_String_Known_Webshell : FILE
 		date = "2021-01-09"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2524-L2658"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2524-L2658"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d889da22893536d5965541c30896f4ed4fdf461d"
 		hash = "10f4988a191774a2c6b85604344535ee610b844c1708602a355cf7e9c12c3605"
 		hash = "7b6471774d14510cf6fa312a496eed72b614f6fc"
@@ -291636,7 +289568,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_By_String_Known_Webshell : FILE
 		hash = "15c4e5225ff7811e43506f0e123daee869a8292fc8a38030d165cc3f6a488c95"
 		hash = "0c845a031e06925c22667e101a858131bbeb681d78b5dbf446fdd5bca344d765"
 		hash = "d52128bcfff5e9a121eab3d76382420c3eebbdb33cd0879fbef7c3426e819695"
-		logic_hash = "22b6d58e24748933792c29b63c4f68c08b86c17a2751fbef5b93bc06c8c5341d"
+		logic_hash = "v1_sha256_22b6d58e24748933792c29b63c4f68c08b86c17a2751fbef5b93bc06c8c5341d"
 		score = 70
 		quality = 17
 		tags = "FILE"
@@ -291713,10 +289645,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_By_String_Known_Webshell : FILE
 		$pack = { 50 41 43 4b 00 00 00 02 00 }
 
 	condition:
-		filesize <1000KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ( any of ($pbs*) or $front1 in (0..60))
+		filesize < 1000KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( any of ( $pbs* ) or $front1 in ( 0 .. 60 ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Strings_SUSP : FILE
 {
 	meta:
@@ -291726,14 +289656,14 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Strings_SUSP : FILE
 		date = "2021-01-12"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2660-L2746"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2660-L2746"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0dd568dbe946b5aa4e1d33eab1decbd71903ea04"
 		hash = "dde2bdcde95730510b22ae8d52e4344997cb1e74"
 		hash = "499db4d70955f7d40cf5cbaf2ecaf7a2"
 		hash = "281b66f62db5caab2a6eb08929575ad95628a690"
 		hash = "1ab3ae4d613b120f9681f6aa8933d66fa38e4886"
-		logic_hash = "5c3837ab761ee2209fab5fc333b050a56d80addb03b088ae28040c7393429bb3"
+		logic_hash = "v1_sha256_5c3837ab761ee2209fab5fc333b050a56d80addb03b088ae28040c7393429bb3"
 		score = 50
 		quality = 40
 		tags = "FILE"
@@ -291777,10 +289707,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Strings_SUSP : FILE
 		$inp19 = /file_get_contents\("https?:\/\// wide ascii
 
 	condition:
-		filesize <700KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and not ( any of ($gfp*)) and (1 of ($sstring*) and ( any of ($inp*)))
+		filesize < 700KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and not ( any of ( $gfp* ) ) and ( 1 of ( $sstring* ) and ( any of ( $inp* ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_In_Htaccess : FILE
 {
 	meta:
@@ -291790,14 +289718,14 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_In_Htaccess : FILE
 		date = "2021-01-07"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2748-L2770"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2748-L2770"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
 		hash = "d79e9b13a32a9e9f3fa36aa1a4baf444bfd2599a"
 		hash = "e1d1091fee6026829e037b2c70c228344955c263"
 		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
 		hash = "8c9e65cd3ef093cd9c5b418dc5116845aa6602bc92b9b5991b27344d8b3f7ef2"
-		logic_hash = "0652a4cb0cb6c61afece5c2e4cbf2f281714509f0d828047f2e3ccd411602115"
+		logic_hash = "v1_sha256_0652a4cb0cb6c61afece5c2e4cbf2f281714509f0d828047f2e3ccd411602115"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -291808,10 +289736,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_In_Htaccess : FILE
 		$hta = "AddType application/x-httpd-php .htaccess" wide ascii
 
 	condition:
-		filesize <100KB and $hta
+		filesize < 100KB and $hta
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Function_Via_Get : FILE
 {
 	meta:
@@ -291821,12 +289747,12 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Function_Via_Get : FILE
 		date = "2021-01-09"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2772-L2816"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2772-L2816"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ce739d65c31b3c7ea94357a38f7bd0dc264da052d4fd93a1eabb257f6e3a97a6"
 		hash = "d870e971511ea3e082662f8e6ec22e8a8443ca79"
 		hash = "73fa97372b3bb829835270a5e20259163ecc3fdbf73ef2a99cb80709ea4572be"
-		logic_hash = "309203db8e7374531d359e3a723418d47bead45034c4a7bd726fb714622dc039"
+		logic_hash = "v1_sha256_309203db8e7374531d359e3a723418d47bead45034c4a7bd726fb714622dc039"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -291854,10 +289780,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Function_Via_Get : FILE
 		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
 
 	condition:
-		filesize <500KB and not ( any of ($gfp*)) and any of ($sr*)
+		filesize < 500KB and not ( any of ( $gfp* ) ) and any of ( $sr* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_PHP_Writer : FILE
 {
 	meta:
@@ -291867,14 +289791,14 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Writer : FILE
 		date = "2021-04-17"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2818-L2908"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2818-L2908"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ec83d69512aa0cc85584973f5f0850932fb1949fb5fb2b7e6e5bbfb121193637"
 		hash = "407c15f94a33232c64ddf45f194917fabcd2e83cf93f38ee82f9720e2635fa64"
 		hash = "988b125b6727b94ce9a27ea42edc0ce282c5dfeb"
 		hash = "0ce760131787803bbef216d0ee9b5eb062633537"
 		hash = "20281d16838f707c86b1ff1428a293ed6aec0e97"
-		logic_hash = "34bae0c02156d1c9fd24d674443322409eba0a43e094fc6c05df94bbbe15aa64"
+		logic_hash = "v1_sha256_34bae0c02156d1c9fd24d674443322409eba0a43e094fc6c05df94bbbe15aa64"
 		score = 50
 		quality = 42
 		tags = "FILE"
@@ -291916,10 +289840,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Writer : FILE
 		$php_write2 = "copy" fullword wide ascii
 
 	condition:
-		((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($inp*)) and ( any of ($php_write*) or all of ($php_multi_write*)) and ( filesize <400 or ( filesize <4000 and 1 of ($sus*)))
+		(( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( any of ( $inp* ) ) and ( any of ( $php_write* ) or all of ( $php_multi_write* ) ) and ( filesize < 400 or ( filesize < 4000 and 1 of ( $sus* ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Writer : FILE
 {
 	meta:
@@ -291929,14 +289851,14 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Writer : FILE
 		date = "2021-03-07"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L2910-L3080"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L2910-L3080"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "df6eaba8d643c49c6f38016531c88332e80af33c"
 		hash = "83642a926291a499916e8c915dacadd0d5a8b91f"
 		hash = "5417fad68a6f7320d227f558bf64657fe3aa9153"
 		hash = "97d9f6c411f54b56056a145654cd00abca2ff871"
 		hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
-		logic_hash = "7c9f4c9a5005efad02760cf9ba3ea946068ae281cda10215bf8c88f209b582a5"
+		logic_hash = "v1_sha256_7c9f4c9a5005efad02760cf9ba3ea946068ae281cda10215bf8c88f209b582a5"
 		score = 60
 		quality = -125
 		tags = "FILE"
@@ -292007,10 +289929,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Writer : FILE
 		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*))) and ( filesize <400 or ( filesize <6000 and 1 of ($sus*)))
+		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) and ( filesize < 400 or ( filesize < 6000 and 1 of ( $sus* ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_OBFUSC : FILE
 {
 	meta:
@@ -292020,8 +289940,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_OBFUSC : FILE
 		date = "2021-01-12"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L3082-L3357"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L3082-L3357"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ad597eee256de51ffb36518cd5f0f4aa0f254f27517d28fb7543ae313b15e112"
 		hash = "e0d21fdc16e0010b88d0197ebf619faa4aeca65243f545c18e10859469c1805a"
 		hash = "54a5620d4ea42e41beac08d8b1240b642dd6fd7c"
@@ -292030,7 +289950,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_OBFUSC : FILE
 		hash = "3175ee00fc66921ebec2e7ece8aa3296d4275cb5"
 		hash = "d6b96d844ac395358ee38d4524105d331af42ede"
 		hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
-		logic_hash = "96369062f963c3604c05808755fdfca922e5a6da960cb0ee05dee2df72d5d69b"
+		logic_hash = "v1_sha256_96369062f963c3604c05808755fdfca922e5a6da960cb0ee05dee2df72d5d69b"
 		score = 75
 		quality = -317
 		tags = "FILE"
@@ -292122,10 +290042,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_OBFUSC : FILE
 		$oo2 = "*/\").Replace(\"/*" wide ascii
 
 	condition:
-		filesize <100KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ((( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*)))) and ((( filesize <100KB and ((#o4+#o5+#o6+#o7+#o8+#o9)>20)) or ( filesize <5KB and ((#o4+#o5+#o6+#o7+#o8+#o9)>5 or ((#m_multi_one1+#m_multi_one2+#m_multi_one3+#m_multi_one4+#m_multi_one5)>3))) or ( filesize <700 and ((#o4+#o5+#o6+#o7+#o8+#o9)>3 or (#m_multi_one1+#m_multi_one2+#m_multi_one3+#m_multi_one4+#m_multi_one5)>2))) or any of ($asp_obf*)) or (( filesize <100KB and ((#oo1)>2 or $oo2)) or ( filesize <25KB and ((#oo1)>1)) or ( filesize <1KB and ((#oo1)>0)))) and not any of ($m_fp*)
+		filesize < 100KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( ( ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) or ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) ) and ( ( ( filesize < 100KB and ( ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 20 ) ) or ( filesize < 5KB and ( ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 5 or ( ( #m_multi_one1 + #m_multi_one2 + #m_multi_one3 + #m_multi_one4 + #m_multi_one5 ) > 3 ) ) ) or ( filesize < 700 and ( ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 3 or ( #m_multi_one1 + #m_multi_one2 + #m_multi_one3 + #m_multi_one4 + #m_multi_one5 ) > 2 ) ) ) or any of ( $asp_obf* ) ) or ( ( filesize < 100KB and ( ( #oo1 ) > 2 or $oo2 ) ) or ( filesize < 25KB and ( ( #oo1 ) > 1 ) ) or ( filesize < 1KB and ( ( #oo1 ) > 0 ) ) ) ) and not any of ( $m_fp* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Eval_On_Input : FILE
 {
 	meta:
@@ -292135,13 +290053,13 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Eval_On_Input : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L3359-L3463"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L3359-L3463"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d6b96d844ac395358ee38d4524105d331af42ede"
 		hash = "9be2088d5c3bfad9e8dfa2d7d7ba7834030c7407"
 		hash = "a1df4cfb978567c4d1c353e988915c25c19a0e4a"
 		hash = "069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6"
-		logic_hash = "f7b9f43cf2fd6d08b7438f003242e9a19dcea282959c7a1fdff3a35e261a031e"
+		logic_hash = "v1_sha256_f7b9f43cf2fd6d08b7438f003242e9a19dcea282959c7a1fdff3a35e261a031e"
 		score = 75
 		quality = -49
 		tags = "FILE"
@@ -292179,10 +290097,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Eval_On_Input : FILE
 		$perl1 = "PerlScript" fullword
 
 	condition:
-		( filesize <1100KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and any of ($payload_and_input*)) or ( filesize <100 and any of ($payload_and_input*))
+		( filesize < 1100KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and any of ( $payload_and_input* ) ) or ( filesize < 100 and any of ( $payload_and_input* ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Nano : FILE
 {
 	meta:
@@ -292192,8 +290108,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Nano : FILE
 		date = "2021-01-13"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L3465-L3656"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L3465-L3656"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3b7910a499c603715b083ddb6f881c1a0a3a924d"
 		hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
 		hash = "22345e956bce23304f5e8e356c423cee60b0912c"
@@ -292209,7 +290125,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Nano : FILE
 		hash = "2faad5944142395794e5e6b90a34a6204412161f45e130aeb9c00eff764f65fc"
 		hash = "d0c5e641120b8ea70a363529843d9f393074c54af87913b3ab635189fb0c84cb"
 		hash = "28cfcfe28419a399c606bf96505bc68d6fe05624dba18306993f9fe0d398fbe1"
-		logic_hash = "1b969e098a0b2c86ceba9cbb7f31770ba04f1a4c225716ea27d7e4e4177c90c4"
+		logic_hash = "v1_sha256_1b969e098a0b2c86ceba9cbb7f31770ba04f1a4c225716ea27d7e4e4177c90c4"
 		score = 75
 		quality = -267
 		tags = "FILE"
@@ -292292,10 +290208,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Nano : FILE
 		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and (( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*)))) and not any of ($fp*) and ( filesize <200 or ( filesize <1000 and any of ($susasp*)))
+		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) or ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) ) and not any of ( $fp* ) and ( filesize < 200 or ( filesize < 1000 and any of ( $susasp* ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded : FILE
 {
 	meta:
@@ -292305,14 +290219,14 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded : FILE
 		date = "2021-03-14"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L3658-L3768"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L3658-L3768"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1bc7327f9d3dbff488e5b0b69a1b39dcb99b3399"
 		hash = "9885ee1952b5ad9f84176c9570ad4f0e32461c92"
 		hash = "27a020c5bc0dbabe889f436271df129627b02196"
 		hash = "f41f8c82b155c3110fc1325e82b9ee92b741028b"
 		hash = "af40f4c36e3723236c59dc02f28a3efb047d67dd"
-		logic_hash = "dc33423874a49edfe9994db50959e6a55e2d475f4cd7d0b1b0a288c4ee1f7961"
+		logic_hash = "v1_sha256_dc33423874a49edfe9994db50959e6a55e2d475f4cd7d0b1b0a288c4ee1f7961"
 		score = 75
 		quality = -74
 		tags = "FILE"
@@ -292353,10 +290267,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded : FILE
 		$perl1 = "PerlScript" fullword
 
 	condition:
-		filesize <500KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and any of ($encoded*) and any of ($data*) and ( any of ($sus*) or ( filesize <20KB and #data1>4) or ( filesize <700 and #data1>0))
+		filesize < 500KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and any of ( $encoded* ) and any of ( $data* ) and ( any of ( $sus* ) or ( filesize < 20KB and #data1 > 4 ) or ( filesize < 700 and #data1 > 0 ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded_Aspcoding : FILE
 {
 	meta:
@@ -292366,11 +290278,11 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded_Aspcoding : FILE
 		date = "2021-03-14"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L3770-L3876"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L3770-L3876"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7cfd184ab099c4d60b13457140493b49c8ba61ee"
 		hash = "f5095345ee085318235c11ae5869ae564d636a5342868d0935de7582ba3c7d7a"
-		logic_hash = "a0f0b8585b28b13a90c5d112997cacea00af8c89c81eda5edf05508ad41459ab"
+		logic_hash = "v1_sha256_a0f0b8585b28b13a90c5d112997cacea00af8c89c81eda5edf05508ad41459ab"
 		score = 60
 		quality = -55
 		tags = "FILE"
@@ -292409,10 +290321,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded_Aspcoding : FILE
 		$perl1 = "PerlScript" fullword
 
 	condition:
-		filesize <500KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and all of ($encoded*) and any of ($data*)
+		filesize < 500KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and all of ( $encoded* ) and any of ( $data* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_By_String : FILE
 {
 	meta:
@@ -292422,8 +290332,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_By_String : FILE
 		date = "2021-01-13"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L3878-L4056"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L3878-L4056"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f72252b13d7ded46f0a206f63a1c19a66449f216"
 		hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
 		hash = "56a54fe1f8023455800fd0740037d806709ffb9ece1eb9e7486ad3c3e3608d45"
@@ -292436,7 +290346,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_By_String : FILE
 		hash = "ce3273e98e478a7e95fccce0a3d3e8135c234a46f305867f2deacd4f0efa7338"
 		hash = "65543373b8bd7656478fdf9ceeacb8490ff8976b1fefc754cd35c89940225bcf"
 		hash = "de173ea8dcef777368089504a4af0804864295b75e51794038a6d70f2bcfc6f5"
-		logic_hash = "b6ff83bc501753b893a0f5e60c6aafa292617279c0855ce3ba2d0b9b73325e8a"
+		logic_hash = "v1_sha256_b6ff83bc501753b893a0f5e60c6aafa292617279c0855ce3ba2d0b9b73325e8a"
 		score = 75
 		quality = -91
 		tags = "FILE"
@@ -292531,10 +290441,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_By_String : FILE
 		$perl1 = "PerlScript" fullword
 
 	condition:
-		filesize <200KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and any of ($asp_string*)
+		filesize < 200KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and any of ( $asp_string* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Sniffer : FILE
 {
 	meta:
@@ -292544,13 +290452,13 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Sniffer : FILE
 		date = "2021-03-14"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L4058-L4193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L4058-L4193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1206c22de8d51055a5e3841b4542fb13aa0f97dd"
 		hash = "60d131af1ed23810dbc78f85ee32ffd863f8f0f4"
 		hash = "c3bc4ab8076ef184c526eb7f16e08d41b4cec97e"
 		hash = "ed5938c04f61795834751d44a383f8ca0ceac833"
-		logic_hash = "874ec4c5dff024a899976e46cd553b52c361779a5507cf08ff0de596fd460d41"
+		logic_hash = "v1_sha256_874ec4c5dff024a899976e46cd553b52c361779a5507cf08ff0de596fd460d41"
 		score = 75
 		quality = -74
 		tags = "FILE"
@@ -292602,10 +290510,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Sniffer : FILE
 		$asp_text2 = ".Text" wide ascii
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and filesize <30KB and all of ($sniff*)
+		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and filesize < 30KB and all of ( $sniff* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Tiny : FILE
 {
 	meta:
@@ -292615,13 +290521,13 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Tiny : FILE
 		date = "2021-01-07"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L4195-L4402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L4195-L4402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
 		hash = "52ce724580e533da983856c4ebe634336f5fd13a"
 		hash = "0864f040a37c3e1cef0213df273870ed6a61e4bc"
 		hash = "b184dc97b19485f734e3057e67007a16d47b2a62"
-		logic_hash = "62012312876adb97f24ff39af041263d7678a4264374398907b2442731e586d7"
+		logic_hash = "v1_sha256_62012312876adb97f24ff39af041263d7678a4264374398907b2442731e586d7"
 		score = 75
 		quality = -252
 		tags = "FILE"
@@ -292706,10 +290612,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Tiny : FILE
 		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and not 1 of ($fp*) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ( filesize <700 and (( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*)))))
+		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and not 1 of ( $fp* ) and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( filesize < 700 and ( ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) or ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Generic : FILE
 {
 	meta:
@@ -292719,13 +290623,13 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic : FILE
 		date = "2021-03-07"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L4404-L4702"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L4404-L4702"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
 		hash = "4cf6fbad0411b7d33e38075f5e00d4c8ae9ce2f6f53967729974d004a183b25c"
 		hash = "a91320483df0178eb3cafea830c1bd94585fc896"
 		hash = "f3398832f697e3db91c3da71a8e775ebf66c7e73"
-		logic_hash = "60764b137f7e62755ab7e0a266661d19e04434bc1c9eb17864bfcab25476afbf"
+		logic_hash = "v1_sha256_60764b137f7e62755ab7e0a266661d19e04434bc1c9eb17864bfcab25476afbf"
 		score = 60
 		quality = -276
 		tags = "FILE"
@@ -292873,10 +290777,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic : FILE
 		$tagasp_capa_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and ( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) and not any of ($fp*) and (( filesize <3KB and (1 of ($asp_slightly_sus*))) or ( filesize <25KB and (1 of ($asp_much_sus*) or 1 of ($asp_gen_sus*) or (#asp_gen_obf1>2))) or ( filesize <50KB and (1 of ($asp_much_sus*) or 3 of ($asp_gen_sus*) or (#asp_gen_obf1>6))) or ( filesize <150KB and (1 of ($asp_much_sus*) or 4 of ($asp_gen_sus*) or (#asp_gen_obf1>6) or (( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*))) and (1 of ($asp_much_sus*) or 2 of ($asp_gen_sus*) or (#asp_gen_obf1>3))))) or ( filesize <100KB and ( any of ($tagasp_capa_classid*))))
+		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) and not any of ( $fp* ) and ( ( filesize < 3KB and ( 1 of ( $asp_slightly_sus* ) ) ) or ( filesize < 25KB and ( 1 of ( $asp_much_sus* ) or 1 of ( $asp_gen_sus* ) or ( #asp_gen_obf1 > 2 ) ) ) or ( filesize < 50KB and ( 1 of ( $asp_much_sus* ) or 3 of ( $asp_gen_sus* ) or ( #asp_gen_obf1 > 6 ) ) ) or ( filesize < 150KB and ( 1 of ( $asp_much_sus* ) or 4 of ( $asp_gen_sus* ) or ( #asp_gen_obf1 > 6 ) or ( ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) and ( 1 of ( $asp_much_sus* ) or 2 of ( $asp_gen_sus* ) or ( #asp_gen_obf1 > 3 ) ) ) ) ) or ( filesize < 100KB and ( any of ( $tagasp_capa_classid* ) ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Registry_Reader : FILE
 {
 	meta:
@@ -292886,12 +290788,12 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Registry_Reader : FILE
 		date = "2021-03-14"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L4704-L4851"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L4704-L4851"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4d53416398a89aef3a39f63338a7c1bf2d3fcda4"
 		hash = "f85cf490d7eb4484b415bea08b7e24742704bdda"
 		hash = "898ebfa1757dcbbecb2afcdab1560d72ae6940de"
-		logic_hash = "515bff52bebaad45481202ff934f8d1cbb79c27ccf47ca811077acacb7a47f13"
+		logic_hash = "v1_sha256_515bff52bebaad45481202ff934f8d1cbb79c27ccf47ca811077acacb7a47f13"
 		score = 50
 		quality = -78
 		tags = "FILE"
@@ -292951,10 +290853,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Registry_Reader : FILE
 		$asp_text2 = ".Text" wide ascii
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and all of ($asp_reg*) and any of ($sus*) and not any of ($fp*) and ( filesize <10KB or ( filesize <150KB and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp))))
+		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and all of ( $asp_reg* ) and any of ( $sus* ) and not any of ( $fp* ) and ( filesize < 10KB or ( filesize < 150KB and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASPX_Regeorg_CSHARP : FILE
 {
 	meta:
@@ -292964,14 +290864,14 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Regeorg_CSHARP : FILE
 		date = "2021-01-11"
 		modified = "2023-07-05"
 		reference = "https://github.com/sensepost/reGeorg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L4853-L4963"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L4853-L4963"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c1f43b7cf46ba12cfc1357b17e4f5af408740af7ae70572c9cf988ac50260ce1"
 		hash = "479c1e1f1c263abe339de8be99806c733da4e8c1"
 		hash = "38a1f1fc4e30c0b4ad6e7f0e1df5a92a7d05020b"
 		hash = "e54f1a3eab740201feda235835fc0aa2e0c44ba9"
 		hash = "aea0999c6e5952ec04bf9ee717469250cddf8a6f"
-		logic_hash = "0c68f5955df2e75c3b5b4f1c6398fd57add1f64bfb3d46ccebf1c6767f5d2eb1"
+		logic_hash = "v1_sha256_0c68f5955df2e75c3b5b4f1c6398fd57add1f64bfb3d46ccebf1c6767f5d2eb1"
 		score = 75
 		quality = -57
 		tags = "FILE"
@@ -293013,10 +290913,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Regeorg_CSHARP : FILE
 		$perl1 = "PerlScript" fullword
 
 	condition:
-		filesize <300KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ($georg or ( all of ($sa*) and any of ($input_sa*)))
+		filesize < 300KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( $georg or ( all of ( $sa* ) and any of ( $input_sa* ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_CSHARP_Generic : FILE
 {
 	meta:
@@ -293026,14 +290924,14 @@ rule SIGNATURE_BASE_WEBSHELL_CSHARP_Generic : FILE
 		date = "2021-01-11"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L4965-L5073"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L4965-L5073"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b6721683aadc4b4eba4f081f2bc6bc57adfc0e378f6d80e2bfa0b1e3e57c85c7"
 		hash = "4b365fc9ddc8b247a12f4648cd5c91ee65e33fae"
 		hash = "019eb61a6b5046502808fb5ab2925be65c0539b4"
 		hash = "620ee444517df8e28f95e4046cd7509ac86cd514"
 		hash = "a91320483df0178eb3cafea830c1bd94585fc896"
-		logic_hash = "fb367b79c8ed4a61618594db903cf3d70524685d7710d243163958ecb47634aa"
+		logic_hash = "v1_sha256_fb367b79c8ed4a61618594db903cf3d70524685d7710d243163958ecb47634aa"
 		score = 75
 		quality = -55
 		tags = "FILE"
@@ -293074,10 +290972,8 @@ rule SIGNATURE_BASE_WEBSHELL_CSHARP_Generic : FILE
 		$perl1 = "PerlScript" fullword
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and filesize <300KB and ($input_http or all of ($input_form*)) and all of ($exec_proc*) and any of ($exec_shell*)
+		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and filesize < 300KB and ( $input_http or all of ( $input_form* ) ) and all of ( $exec_proc* ) and any of ( $exec_shell* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Runtime_Compile : FILE
 {
 	meta:
@@ -293087,8 +290983,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Runtime_Compile : FILE
 		date = "2021-01-11"
 		modified = "2023-04-05"
 		reference = "https://github.com/antonioCoco/SharPyShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5075-L5173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5075-L5173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e826c4139282818d38dcccd35c7ae6857b1d1d01"
 		hash = "e20e078d9fcbb209e3733a06ad21847c5c5f0e52"
 		hash = "57f758137aa3a125e4af809789f3681d1b08ee5b"
@@ -293098,7 +290994,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Runtime_Compile : FILE
 		hash = "dfd30139e66cba45b2ad679c357a1e2f565e6b3140a17e36e29a1e5839e87c5e"
 		hash = "89eac7423dbf86eb0b443d8dd14252b4208e7462ac2971c99f257876388fccf2"
 		hash = "8ce4eaf111c66c2e6c08a271d849204832713f8b66aceb5dadc293b818ccca9e"
-		logic_hash = "6699a44e396eedebb3bafa0e89c3b6d080586a158ed056ec7220bdf2ad764444"
+		logic_hash = "v1_sha256_6699a44e396eedebb3bafa0e89c3b6d080586a158ed056ec7220bdf2ad764444"
 		score = 75
 		quality = 19
 		tags = "FILE"
@@ -293142,10 +291038,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Runtime_Compile : FILE
 		$sus_refl2 = "SharPy" wide ascii
 
 	condition:
-		(( filesize <50KB and any of ($sus_refl*)) or filesize <10KB) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and not any of ($rc_fp*) and (( all of ($payload_reflection*) and any of ($payload_load_reflection*)) or ( all of ($payload_compile*) and any of ($payload_invoke*)) or all of ($payload_xamlreader*) or all of ($payload_powershell*))
+		(( filesize < 50KB and any of ( $sus_refl* ) ) or filesize < 10KB ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and not any of ( $rc_fp* ) and ( ( all of ( $payload_reflection* ) and any of ( $payload_load_reflection* ) ) or ( all of ( $payload_compile* ) and any of ( $payload_invoke* ) ) or all of ( $payload_xamlreader* ) or all of ( $payload_powershell* ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_SQL : FILE
 {
 	meta:
@@ -293155,14 +291049,14 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_SQL : FILE
 		date = "2021-03-14"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5175-L5356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5175-L5356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "216c1dd950e0718e35bc4834c5abdc2229de3612"
 		hash = "ffe44e9985d381261a6e80f55770833e4b78424bn"
 		hash = "3d7cd32d53abc7f39faed133e0a8f95a09932b64"
 		hash = "f19cc178f1cfad8601f5eea2352cdbd2d6f94e7e"
 		hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
-		logic_hash = "c59250065c4be267746f716f922007b638706a76579af6509c8e97d0cee03f33"
+		logic_hash = "v1_sha256_c59250065c4be267746f716f922007b638706a76579af6509c8e97d0cee03f33"
 		score = 75
 		quality = -84
 		tags = "FILE"
@@ -293248,10 +291142,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_SQL : FILE
 		$asp_text2 = ".Text" wide ascii
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and (6 of ($sql*) or all of ($o_sql*) or 3 of ($a_sql*) or all of ($c_sql*)) and (( filesize <150KB and any of ($sus*)) or ( filesize <5KB and any of ($slightly_sus*)))
+		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and ( 6 of ( $sql* ) or all of ( $o_sql* ) or 3 of ( $a_sql* ) or all of ( $c_sql* ) ) and ( ( filesize < 150KB and any of ( $sus* ) ) or ( filesize < 5KB and any of ( $slightly_sus* ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_ASP_Scan_Writable : FILE
 {
 	meta:
@@ -293261,11 +291153,11 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Scan_Writable : FILE
 		date = "2021-03-14"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5358-L5501"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5358-L5501"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2409eda9047085baf12e0f1b9d0b357672f7a152"
 		hash = "af1c00696243f8b062a53dad9fb8b773fa1f0395631ffe6c7decc42c47eedee7"
-		logic_hash = "80969fd0c27903dabf08a250a47971725ac5762fd2f9afd96167b8f88f277348"
+		logic_hash = "v1_sha256_80969fd0c27903dabf08a250a47971725ac5762fd2f9afd96167b8f88f277348"
 		score = 75
 		quality = -114
 		tags = "FILE"
@@ -293323,10 +291215,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Scan_Writable : FILE
 		$asp_text2 = ".Text" wide ascii
 
 	condition:
-		filesize <10KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and 6 of ($scan*) and any of ($sus*)
+		filesize < 10KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and 6 of ( $scan* ) and any of ( $sus* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_Regeorg : FILE
 {
 	meta:
@@ -293336,14 +291226,14 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Regeorg : FILE
 		date = "2021-01-24"
 		modified = "2023-04-05"
 		reference = "https://github.com/sensepost/reGeorg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5503-L5553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5503-L5553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
 		hash = "650eaa21f4031d7da591ebb68e9fc5ce5c860689"
 		hash = "00c86bf6ce026ccfaac955840d18391fbff5c933"
 		hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
 		hash = "9108a33058aa9a2fb6118b719c5b1318f33f0989"
-		logic_hash = "0fc038262f6e0463c45ef90bd01d08269bc34d3859d1b61904cc6de03db7c721"
+		logic_hash = "v1_sha256_0fc038262f6e0463c45ef90bd01d08269bc34d3859d1b61904cc6de03db7c721"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -293368,10 +291258,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Regeorg : FILE
 		$cjsp_long7 = "< %" ascii wide
 
 	condition:
-		filesize <300KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and all of ($jgeorg*)
+		filesize < 300KB and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and all of ( $jgeorg* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_HTTP_Proxy : FILE
 {
 	meta:
@@ -293381,12 +291269,12 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_HTTP_Proxy : FILE
 		date = "2021-01-24"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5555-L5603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5555-L5603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2f9b647660923c5262636a5344e2665512a947a4"
 		hash = "97c1e2bf7e769d3fc94ae2fc74ac895f669102c6"
 		hash = "2f9b647660923c5262636a5344e2665512a947a4"
-		logic_hash = "0a9aa309ca9ef19b5d2bb039906d5a610e26b61c98135d8cabf9ea5924cd46db"
+		logic_hash = "v1_sha256_0a9aa309ca9ef19b5d2bb039906d5a610e26b61c98135d8cabf9ea5924cd46db"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -293411,10 +291299,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_HTTP_Proxy : FILE
 		$cjsp_long7 = "< %" ascii wide
 
 	condition:
-		filesize <10KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and all of ($jh*)
+		filesize < 10KB and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and all of ( $jh* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_Writer_Nano : FILE
 {
 	meta:
@@ -293424,13 +291310,13 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Writer_Nano : FILE
 		date = "2021-01-24"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5605-L5686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5605-L5686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ac91e5b9b9dcd373eaa9360a51aa661481ab9429"
 		hash = "c718c885b5d6e29161ee8ea0acadb6e53c556513"
 		hash = "9f1df0249a6a491cdd5df598d83307338daa4c43"
 		hash = "5e241d9d3a045d3ade7b6ff6af6c57b149fa356e"
-		logic_hash = "8cf47fe03845f39d7ff7ba4ad8f44a879cdf1aba0869921c5adf6d7490bc4174"
+		logic_hash = "v1_sha256_8cf47fe03845f39d7ff7ba4ad8f44a879cdf1aba0869921c5adf6d7490bc4174"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -293465,10 +291351,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Writer_Nano : FILE
 		$cjsp_long7 = "< %" ascii wide
 
 	condition:
-		( any of ($input*) and any of ($req*)) and ( filesize <200 or ( filesize <1000 and any of ($jw_sus*))) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and (2 of ($payload*) or all of ($logger*))
+		( any of ( $input* ) and any of ( $req* ) ) and ( filesize < 200 or ( filesize < 1000 and any of ( $jw_sus* ) ) ) and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( 2 of ( $payload* ) or all of ( $logger* ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Tiny : FILE
 {
 	meta:
@@ -293478,12 +291362,12 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Tiny : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5688-L5771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5688-L5771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8fd343db0442136e693e745d7af1018a99b042af"
 		hash = "87c3ac9b75a72187e8bc6c61f50659435dbdc4fde6ed720cebb93881ba5989d8"
 		hash = "1aa6af726137bf261849c05d18d0a630d95530588832aadd5101af28acc034b5"
-		logic_hash = "fe7f2ab2820520e8964b874a7f9af356db9355f263c821d180e54c774e10530b"
+		logic_hash = "v1_sha256_fe7f2ab2820520e8964b874a7f9af356db9355f263c821d180e54c774e10530b"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -293519,10 +291403,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Tiny : FILE
 		$fixed_cmd1 = "bash -i >& /dev/" ascii wide
 
 	condition:
-		(( filesize <1000 and any of ($jg_sus*)) or filesize <250) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and (( any of ($input*) and any of ($req*)) or ( any of ($fixed_cmd*))) and (1 of ($payload*) or all of ($payload_rt*))
+		(( filesize < 1000 and any of ( $jg_sus* ) ) or filesize < 250 ) and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( ( any of ( $input* ) and any of ( $req* ) ) or ( any of ( $fixed_cmd* ) ) ) and ( 1 of ( $payload* ) or all of ( $payload_rt* ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_Generic : FILE
 {
 	meta:
@@ -293532,12 +291414,12 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5773-L5865"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5773-L5865"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4762f36ca01fb9cda2ab559623d2206f401fc0b1"
 		hash = "bdaf9279b3d9e07e955d0ce706d9c42e4bdf9aa1"
 		hash = "ee9408eb923f2d16f606a5aaac7e16b009797a07"
-		logic_hash = "86be80a7a970657af047ac9d0aaccbcd2cf9afdf0bd891efa8510ffd803530da"
+		logic_hash = "v1_sha256_86be80a7a970657af047ac9d0aaccbcd2cf9afdf0bd891efa8510ffd803530da"
 		score = 75
 		quality = -24
 		tags = "FILE"
@@ -293581,10 +291463,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic : FILE
 		$rt_payload3 = "exec" fullword ascii wide
 
 	condition:
-		filesize <300KB and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and (1 of ($payload*) or all of ($rt_payload*)) and not any of ($fp*) and any of ($susp*)
+		filesize < 300KB and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( any of ( $input* ) and any of ( $req* ) ) and ( 1 of ( $payload* ) or all of ( $rt_payload* ) ) and not any of ( $fp* ) and any of ( $susp* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Base64 : FILE
 {
 	meta:
@@ -293594,11 +291474,11 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Base64 : FILE
 		date = "2021-01-24"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5867-L5942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5867-L5942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8b5fe53f8833df3657ae2eeafb4fd101c05f0db0"
 		hash = "1b916afdd415dfa4e77cecf47321fd676ba2184d"
-		logic_hash = "543f4e528763c9e40e49b4169c792818a73a23cbbbee25332749626d8e58b1b8"
+		logic_hash = "v1_sha256_543f4e528763c9e40e49b4169c792818a73a23cbbbee25332749626d8e58b1b8"
 		score = 75
 		quality = 48
 		tags = "FILE"
@@ -293637,10 +291517,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Base64 : FILE
 		$pack = { 50 41 43 4b 00 00 00 02 00 }
 
 	condition:
-		($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and filesize <300KB and ( any of ($one*) and any of ($two*) or any of ($three*))
+		($cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and filesize < 300KB and ( any of ( $one* ) and any of ( $two* ) or any of ( $three* ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Processbuilder : FILE
 {
 	meta:
@@ -293650,13 +291528,13 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Processbuilder : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5944-L5981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5944-L5981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "82198670ac2072cd5c2853d59dcd0f8dfcc28923"
 		hash = "c05a520d96e4ebf9eb5c73fc0fa446ceb5caf343"
 		hash = "347a55c174ee39ec912d9107e971d740f3208d53af43ea480f502d177106bbe8"
 		hash = "d0ba29b646274e8cda5be1b940a38d248880d9e2bba11d994d4392c80d6b65bd"
-		logic_hash = "fffc173cc23e158e319e48097243a64da232151e441c39e4b6ecc2565a82d862"
+		logic_hash = "v1_sha256_fffc173cc23e158e319e48097243a64da232151e441c39e4b6ecc2565a82d862"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -293675,7 +291553,7 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Processbuilder : FILE
 		$req3 = "getRequest" fullword ascii wide
 
 	condition:
-		filesize <2000 and ( any of ($input*) and any of ($req*)) and $exec and $start
+		filesize < 2000 and ( any of ( $input* ) and any of ( $req* ) ) and $exec and $start
 }
 import "math"
 
@@ -293688,11 +291566,11 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Reflection : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L5983-L6064"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L5983-L6064"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
 		hash = "bf0ff88cbb72c719a291c722ae3115b91748d5c4920afe7a00a0d921d562e188"
-		logic_hash = "8142b67c428072ddce2543c014ad53023265cb36c5b77346590db8c68afcd9db"
+		logic_hash = "v1_sha256_8142b67c428072ddce2543c014ad53023265cb36c5b77346590db8c68afcd9db"
 		score = 75
 		quality = 0
 		tags = "FILE"
@@ -293722,7 +291600,7 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Reflection : FILE
 		$cj_encoded1 = "\"java.util.Base64$Decoder\"" ascii wide
 
 	condition:
-		all of ($ws_*) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and not $fp and ( filesize <10KB and ( any of ($input*) and any of ($req*)) or ( filesize <30KB and any of ($cj_encoded*) and math.entropy(500, filesize -500)>=5.5 and math.mean(500, filesize -500)>80 and math.deviation(500, filesize -500,89.0)<23))
+		all of ( $ws_* ) and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not $fp and ( filesize < 10KB and ( any of ( $input* ) and any of ( $req* ) ) or ( filesize < 30KB and any of ( $cj_encoded* ) and math.entropy ( 500 , filesize - 500 ) >= 5.5 and math.mean ( 500 , filesize - 500 ) > 80 and math.deviation ( 500 , filesize - 500 , 89.0 ) < 23 ) )
 }
 import "math"
 
@@ -293735,15 +291613,15 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Classloader : FILE
 		date = "2021-01-07"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L6066-L6143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L6066-L6143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6b546e78cc7821b63192bb8e087c133e8702a377d17baaeb64b13f0dd61e2347"
 		hash = "f3a7e28e1c38fa5d37811bdda1d6b0893ab876023d3bd696747a35c04141dcf0"
 		hash = "8ea2a25344e6094fa82dfc097bbec5f1675f6058f2b7560deb4390bcbce5a0e7"
 		hash = "b9ea1e9f91c70160ee29151aa35f23c236d220c72709b2b75123e6fa1da5c86c"
 		hash = "80211c97f5b5cd6c3ab23ae51003fd73409d273727ba502d052f6c2bd07046d6"
 		hash = "8e544a5f0c242d1f7be503e045738369405d39731fcd553a38b568e0889af1f2"
-		logic_hash = "ea7b8a91c09188e04f4c7fffd2b218aac3a83590b7c1b2b141650c0f6965c4ee"
+		logic_hash = "v1_sha256_ea7b8a91c09188e04f4c7fffd2b218aac3a83590b7c1b2b141650c0f6965c4ee"
 		score = 75
 		quality = 0
 		tags = "FILE"
@@ -293771,10 +291649,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Classloader : FILE
 		$req3 = "getRequest" fullword ascii wide
 
 	condition:
-		(($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and $exec and $class) and ( filesize <10KB or ( filesize <50KB and (math.entropy(500, filesize -500)<=1 or math.entropy(500, filesize -500)>=7.7)))
+		(( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( any of ( $input* ) and any of ( $req* ) ) and $exec and $class ) and ( filesize < 10KB or ( filesize < 50KB and ( math.entropy ( 500 , filesize - 500 ) <= 1 or math.entropy ( 500 , filesize - 500 ) >= 7.7 ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Encoded_Shell : FILE
 {
 	meta:
@@ -293784,12 +291660,12 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Encoded_Shell : FILE
 		date = "2021-01-07"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L6145-L6171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L6145-L6171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c"
 		hash = "f6c2112e3a25ec610b517ff481675b2ce893cb9f"
 		hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
-		logic_hash = "74f45478e5bd7bb300e4ec493c2d3ef9a26340a141c3512a722618b3a3731500"
+		logic_hash = "v1_sha256_74f45478e5bd7bb300e4ec493c2d3ef9a26340a141c3512a722618b3a3731500"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -293806,10 +291682,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Encoded_Shell : FILE
 		$sj6 = /\{ ?103, 101, 116, 82, 117, 110/ wide ascii
 
 	condition:
-		filesize <300KB and any of ($sj*)
+		filesize < 300KB and any of ( $sj* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_Netspy : FILE
 {
 	meta:
@@ -293819,11 +291693,11 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Netspy : FILE
 		date = "2021-01-24"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L6173-L6239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L6173-L6239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "94d1aaabde8ff9b4b8f394dc68caebf981c86587"
 		hash = "3870b31f26975a7cb424eab6521fc9bffc2af580"
-		logic_hash = "1c0da3ee7a3cc8a1cf73dcd2648a1f6cb0bf3b32b37725d8d8f307e8fb7b7238"
+		logic_hash = "v1_sha256_1c0da3ee7a3cc8a1cf73dcd2648a1f6cb0bf3b32b37725d8d8f307e8fb7b7238"
 		score = 75
 		quality = 1
 		tags = "FILE"
@@ -293859,10 +291733,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Netspy : FILE
 		$req3 = "getRequest" fullword ascii wide
 
 	condition:
-		filesize <30KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and 4 of ($scan*) and 1 of ($write*) and $http
+		filesize < 30KB and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( any of ( $input* ) and any of ( $req* ) ) and 4 of ( $scan* ) and 1 of ( $write* ) and $http
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_By_String : FILE
 {
 	meta:
@@ -293872,8 +291744,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_By_String : FILE
 		date = "2021-01-09"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L6241-L6338"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L6241-L6338"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e9060aa2caf96be49e3b6f490d08b8a996c4b084"
 		hash = "4c2464503237beba54f66f4a099e7e75028707aa"
 		hash = "06b42d4707e7326aff402ecbb585884863c6351a"
@@ -293882,7 +291754,7 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_By_String : FILE
 		hash = "f1d8360dc92544cce301949e23aad6eb49049bacf9b7f54c24f89f7f02d214bb"
 		hash = "1d1f26b1925a9d0caca3fdd8116629bbcf69f37f751a532b7096a1e37f4f0076"
 		hash = "850f998753fde301d7c688b4eca784a045130039512cf51292fcb678187c560b"
-		logic_hash = "e7db0c71f7c020da414dc453f6b8f95679a75232eeabb195f1a7c501c566dd04"
+		logic_hash = "v1_sha256_e7db0c71f7c020da414dc453f6b8f95679a75232eeabb195f1a7c501c566dd04"
 		score = 75
 		quality = 19
 		tags = "FILE"
@@ -293927,10 +291799,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_By_String : FILE
 		$pack = { 50 41 43 4b 00 00 00 02 00 }
 
 	condition:
-		not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and (( filesize <100KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and any of ($jstring*)) or ( filesize <500KB and (#jstring21>20 or $jstring18 or $jstring19 or $jstring20)))
+		not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( ( filesize < 100KB and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and any of ( $jstring* ) ) or ( filesize < 500KB and ( #jstring21 > 20 or $jstring18 or $jstring19 or $jstring20 ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_JSP_Input_Upload_Write : FILE
 {
 	meta:
@@ -293940,12 +291810,12 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Input_Upload_Write : FILE
 		date = "2021-01-24"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L6340-L6400"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L6340-L6400"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ef98ca135dfb9dcdd2f730b18e883adf50c4ab82"
 		hash = "583231786bc1d0ecca7d8d2b083804736a3f0a32"
 		hash = "19eca79163259d80375ebebbc440b9545163e6a3"
-		logic_hash = "30574fa858e1946adc84d5611569fe8f69631539903e49746e415ed002b36e1f"
+		logic_hash = "v1_sha256_30574fa858e1946adc84d5611569fe8f69631539903e49746e415ed002b36e1f"
 		score = 75
 		quality = 46
 		tags = "FILE"
@@ -293974,10 +291844,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Input_Upload_Write : FILE
 		$req3 = "getRequest" fullword ascii wide
 
 	condition:
-		filesize <10KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and $upload and 1 of ($write*)
+		filesize < 10KB and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( any of ( $input* ) and any of ( $req* ) ) and $upload and 1 of ( $write* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_Generic_OS_Strings : FILE
 {
 	meta:
@@ -293987,15 +291855,15 @@ rule SIGNATURE_BASE_WEBSHELL_Generic_OS_Strings : FILE
 		date = "2021-01-12"
 		modified = "2023-07-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L6402-L6571"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L6402-L6571"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d5bfe40283a28917fcda0cefd2af301f9a7ecdad"
 		hash = "fd45a72bda0a38d5ad81371d68d206035cb71a14"
 		hash = "b4544b119f919d8cbf40ca2c4a7ab5c1a4da73a3"
 		hash = "569259aafe06ba3cef9e775ee6d142fed6edff5f"
 		hash = "48909d9f4332840b4e04b86f9723d7427e33ac67"
 		hash = "0353ae68b12b8f6b74794d3273967b530d0d526f"
-		logic_hash = "174a7ee42008940eea6f09be9de0c1dca982f1ecf4533e290744a4955e8bdfbb"
+		logic_hash = "v1_sha256_174a7ee42008940eea6f09be9de0c1dca982f1ecf4533e290744a4955e8bdfbb"
 		score = 50
 		quality = -148
 		tags = "FILE"
@@ -294057,10 +291925,8 @@ rule SIGNATURE_BASE_WEBSHELL_Generic_OS_Strings : FILE
 		$take_two2 = "/add" nocase wide ascii
 
 	condition:
-		filesize <70KB and ((( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) or ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) or ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize ))))) and ( filesize <300KB and not uint16(0)==0x5a4d and ( all of ($w*) or all of ($l*) or 2 of ($take_two*))) and not any of ($fp*)
+		filesize < 70KB and ( ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) or ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) or ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) ) and ( filesize < 300KB and not uint16( 0 ) == 0x5a4d and ( all of ( $w* ) or all of ( $l* ) or 2 of ( $take_two* ) ) ) and not any of ( $fp* )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_In_Image : FILE
 {
 	meta:
@@ -294070,12 +291936,12 @@ rule SIGNATURE_BASE_WEBSHELL_In_Image : FILE
 		date = "2021-02-27"
 		modified = "2024-03-11"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L6573-L6833"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L6573-L6833"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d4fde4e691db3e70a6320e78657480e563a9f87935af873a99db72d6a9a83c78"
 		hash = "84938133ee6e139a2816ab1afc1c83f27243c8ae76746ceb2e7f20649b5b16a4"
 		hash = "52b918a64afc55d28cd491de451bb89c57bce424f8696d6a94ec31fb99b17c11"
-		logic_hash = "e7e78107c661aa5124a37b8e492986e5a3da63c79c97c4dc3199e648a5aa4aa8"
+		logic_hash = "v1_sha256_e7e78107c661aa5124a37b8e492986e5a3da63c79c97c4dc3199e648a5aa4aa8"
 		score = 55
 		quality = -367
 		tags = "FILE"
@@ -294188,10 +292054,8 @@ rule SIGNATURE_BASE_WEBSHELL_In_Image : FILE
 		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
 
 	condition:
-		filesize <5MB and ($png at 0 or $jpg at 0 or $gif at 0 or $gif at 3 or $gif2 at 0 or $gif2 at 3 or $gif3 at 0 or $mdb at 0) and ((((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and (( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) or ( any of ($php_write*) or all of ($php_multi_write*)))) or (( any of ($cjsp*)) and (1 of ($payload*) or all of ($rt_payload*))) or ((( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and (( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*))))))
+		filesize < 5MB and ( $png at 0 or $jpg at 0 or $gif at 0 or $gif at 3 or $gif2 at 0 or $gif2 at 3 or $gif3 at 0 or $mdb at 0 ) and ( ( ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) or ( any of ( $php_write* ) or all of ( $php_multi_write* ) ) ) ) or ( ( any of ( $cjsp* ) ) and ( 1 of ( $payload* ) or all of ( $rt_payload* ) ) ) or ( ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) or ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) ) ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_Mixed_OBFUSC : FILE
 {
 	meta:
@@ -294201,9 +292065,9 @@ rule SIGNATURE_BASE_WEBSHELL_Mixed_OBFUSC : FILE
 		date = "2023-01-28"
 		modified = "2023-04-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L6835-L6859"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "76cc6390cbdb81055c72edb124db2bf52e3d0b975406367a9c49a0ee6621d30b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L6835-L6859"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_76cc6390cbdb81055c72edb124db2bf52e3d0b975406367a9c49a0ee6621d30b"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -294224,10 +292088,8 @@ rule SIGNATURE_BASE_WEBSHELL_Mixed_OBFUSC : FILE
 		$s6 = "basename/*" ascii
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <200KB and (4 of them ))
+		( uint16( 0 ) == 0x3f3c and filesize < 200KB and ( 4 of them ) )
 }
-import "math"
-
 rule SIGNATURE_BASE_WEBSHELL_Cookie_Post_Obfuscation : FILE
 {
 	meta:
@@ -294237,8 +292099,8 @@ rule SIGNATURE_BASE_WEBSHELL_Cookie_Post_Obfuscation : FILE
 		date = "2023-01-28"
 		modified = "2023-04-05"
 		reference = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshells.yar#L6861-L6887"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshells.yar#L6861-L6887"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d08a00e56feb78b7f6599bad6b9b1d8626ce9a6ea1dfdc038358f4c74e6f65c9"
 		hash = "2ce5c4d31682a5a59b665905a6f698c280451117e4aa3aee11523472688edb31"
 		hash = "ff732d91a93dfd1612aed24bbb4d13edb0ab224d874f622943aaeeed4356c662"
@@ -294248,7 +292110,7 @@ rule SIGNATURE_BASE_WEBSHELL_Cookie_Post_Obfuscation : FILE
 		hash = "2efdb79cdde9396ff3dd567db8876607577718db692adf641f595626ef64d3a4"
 		hash = "e1bd3be0cf525a0d61bf8c18e3ffaf3330c1c27c861aede486fd0f1b6930f69a"
 		hash = "f8cdedd21b2cc29497896ec5b6e5863cd67cc1a798d929fd32cdbb654a69168a"
-		logic_hash = "87229859ca3ee8f8b79360603c421528cda2ecefcc46d4080236d09b2dd510fb"
+		logic_hash = "v1_sha256_87229859ca3ee8f8b79360603c421528cda2ecefcc46d4080236d09b2dd510fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294260,7 +292122,7 @@ rule SIGNATURE_BASE_WEBSHELL_Cookie_Post_Obfuscation : FILE
 		$s3 = "Array"
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <100KB and ( all of them ))
+		( uint16( 0 ) == 0x3f3c and filesize < 100KB and ( all of them ) )
 }
 rule SIGNATURE_BASE_Korplug_FAST : FILE
 {
@@ -294271,10 +292133,10 @@ rule SIGNATURE_BASE_Korplug_FAST : FILE
 		date = "2015-08-20"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_korplug_fast.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_korplug_fast.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
-		logic_hash = "31aeb634eecc0f93353432b0dde113bfb54810ea74b02f959447a1d42e7e9e1b"
+		logic_hash = "v1_sha256_31aeb634eecc0f93353432b0dde113bfb54810ea74b02f959447a1d42e7e9e1b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294291,7 +292153,7 @@ rule SIGNATURE_BASE_Korplug_FAST : FILE
 		$s6 = "%snvdisps_user.dat" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ($x1 or ($a1 and 1 of ($s*)) or 4 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( $x1 or ( $a1 and 1 of ( $s* ) ) or 4 of ( $s* ) )
 }
 rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_1 : FILE
 {
@@ -294302,9 +292164,9 @@ rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_1 : FILE
 		date = "2020-01-02"
 		modified = "2022-12-21"
 		reference = "Saudi National Cybersecurity Authority - Destructive Attack DUSTMAN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dustman.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "90345b8358d72b6616c6277222fb1091cb3a88b844391ac3766e7d1ee1192fbe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dustman.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_90345b8358d72b6616c6277222fb1091cb3a88b844391ac3766e7d1ee1192fbe"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -294321,7 +292183,7 @@ rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_1 : FILE
 		$op2 = { 0f b6 0c 01 88 48 34 48 8b 8d a8 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and ( 1 of ( $x* ) or 4 of them )
 }
 rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_2 : FILE
 {
@@ -294332,9 +292194,9 @@ rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_2 : FILE
 		date = "2020-01-02"
 		modified = "2022-12-21"
 		reference = "https://twitter.com/jfslowik/status/1212501454549741568?s=09"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dustman.yar#L26-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "73e4a88b749e3b2654e9021290932d2e556c29cfa772785b23bebad9f3a3f90a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dustman.yar#L26-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_73e4a88b749e3b2654e9021290932d2e556c29cfa772785b23bebad9f3a3f90a"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -294352,7 +292214,7 @@ rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_2 : FILE
 		$op1 = { 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=3000KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize <= 3000KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_SUSP_PS1_Msdt_Execution_May22 : CVE_2022_30190 FILE
 {
@@ -294363,9 +292225,9 @@ rule SIGNATURE_BASE_SUSP_PS1_Msdt_Execution_May22 : CVE_2022_30190 FILE
 		date = "2022-05-31"
 		modified = "2022-07-08"
 		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_doc_follina.yar#L1-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "72ab851eecece30e11e2158da94267c64c187be400926ba6bbcbdc59d0a349dc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_doc_follina.yar#L1-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_72ab851eecece30e11e2158da94267c64c187be400926ba6bbcbdc59d0a349dc"
 		score = 75
 		quality = 85
 		tags = "CVE-2022-30190, FILE"
@@ -294385,7 +292247,7 @@ rule SIGNATURE_BASE_SUSP_PS1_Msdt_Execution_May22 : CVE_2022_30190 FILE
 		$fp2 = "FilesFullTrust" wide
 
 	condition:
-		filesize <10MB and $a and 1 of ($sa*) and 1 of ($sb*) and not 1 of ($fp*)
+		filesize < 10MB and $a and 1 of ( $sa* ) and 1 of ( $sb* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Doc_Wordxmlrels_May22 : CVE_2022_30190 FILE
 {
@@ -294396,10 +292258,10 @@ rule SIGNATURE_BASE_SUSP_Doc_Wordxmlrels_May22 : CVE_2022_30190 FILE
 		date = "2022-05-30"
 		modified = "2022-06-20"
 		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_doc_follina.yar#L34-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_doc_follina.yar#L34-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0"
-		logic_hash = "c9846f8c2c1724792de14ab4de0064f951a8faaf01cc27d873e600f29d59c842"
+		logic_hash = "v1_sha256_c9846f8c2c1724792de14ab4de0064f951a8faaf01cc27d873e600f29d59c842"
 		score = 70
 		quality = 85
 		tags = "CVE-2022-30190, FILE"
@@ -294413,7 +292275,7 @@ rule SIGNATURE_BASE_SUSP_Doc_Wordxmlrels_May22 : CVE_2022_30190 FILE
 		$x4 = "%2E%68%74%6D%21" ascii
 
 	condition:
-		filesize <50KB and all of ($a*) and 1 of ($x*)
+		filesize < 50KB and all of ( $a* ) and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_SUSP_Doc_RTF_Externalresource_May22 : CVE_2022_30190 FILE
 {
@@ -294424,9 +292286,9 @@ rule SIGNATURE_BASE_SUSP_Doc_RTF_Externalresource_May22 : CVE_2022_30190 FILE
 		date = "2022-05-30"
 		modified = "2022-05-31"
 		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_doc_follina.yar#L58-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c841e0c1ff78bf8dade5f573a7452b16a7f447cfc19417704b727684a8f3d3ff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_doc_follina.yar#L58-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c841e0c1ff78bf8dade5f573a7452b16a7f447cfc19417704b727684a8f3d3ff"
 		score = 70
 		quality = 85
 		tags = "CVE-2022-30190, FILE"
@@ -294436,7 +292298,7 @@ rule SIGNATURE_BASE_SUSP_Doc_RTF_Externalresource_May22 : CVE_2022_30190 FILE
 		$s2 = ".html!\" " ascii
 
 	condition:
-		uint32be(0)==0x7B5C7274 and filesize <300KB and all of them
+		uint32be( 0 ) == 0x7B5C7274 and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_EXPL_Follina_CVE_2022_30190_Msdt_Msprotocoluri_May22 : CVE_2022_30190 FILE
 {
@@ -294447,9 +292309,9 @@ rule SIGNATURE_BASE_EXPL_Follina_CVE_2022_30190_Msdt_Msprotocoluri_May22 : CVE_2
 		date = "2022-05-30"
 		modified = "2022-07-18"
 		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_doc_follina.yar#L76-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d56820737951f97606749c74025589e6a8ecbe70cfff069492368b2ba8528a7d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_doc_follina.yar#L76-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d56820737951f97606749c74025589e6a8ecbe70cfff069492368b2ba8528a7d"
 		score = 80
 		quality = 85
 		tags = "CVE-2022-30190, FILE"
@@ -294461,7 +292323,7 @@ rule SIGNATURE_BASE_EXPL_Follina_CVE_2022_30190_Msdt_Msprotocoluri_May22 : CVE_2
 		$a1 = "%6D%73%2D%6D%73%64%74%3A%2F" ascii
 
 	condition:
-		filesize >3KB and filesize <100KB and 1 of them
+		filesize > 3KB and filesize < 100KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_Jun22 : FILE
 {
@@ -294472,10 +292334,10 @@ rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_Jun22 : FILE
 		date = "2022-06-01"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_doc_follina.yar#L96-L127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_doc_follina.yar#L96-L127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
-		logic_hash = "36cb711399197c694ac4fa4fd49cd5d587a830e152a138c81851b8e16301803d"
+		logic_hash = "v1_sha256_36cb711399197c694ac4fa4fd49cd5d587a830e152a138c81851b8e16301803d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294494,7 +292356,7 @@ rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_Jun22 : FILE
 		$x6 = "6600740070003A002F002F00" ascii
 
 	condition:
-		( uint32be(0)==0x7B5C7274 or uint32be(0)==0x7B5C2A5C) and $sa and 1 of ($sb*) and 1 of ($sc*) and 1 of ($x*)
+		( uint32be( 0 ) == 0x7B5C7274 or uint32be( 0 ) == 0x7B5C2A5C ) and $sa and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22 : FILE
 {
@@ -294505,10 +292367,10 @@ rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22 : FILE
 		date = "2022-06-01"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_doc_follina.yar#L129-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_doc_follina.yar#L129-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
-		logic_hash = "fcbb3e32762f8c67b5b226e8095b767d630f8c118521a82fc22f9a3cc272b794"
+		logic_hash = "v1_sha256_fcbb3e32762f8c67b5b226e8095b767d630f8c118521a82fc22f9a3cc272b794"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -294549,7 +292411,7 @@ rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22 : FILE
 		$x18 = "2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
 
 	condition:
-		filesize <10MB and 1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*) and 1 of ($x*)
+		filesize < 10MB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22 : CVE_2022_30190 FILE
 {
@@ -294560,9 +292422,9 @@ rule SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22 : CVE_2022_30190 F
 		date = "2022-06-01"
 		modified = "2023-12-05"
 		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_doc_follina.yar#L190-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "73e76bd80f77640c0d8d47ebb7903eb9cc23336fbe653e7d008cae6a0de7c45b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_doc_follina.yar#L190-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_73e76bd80f77640c0d8d47ebb7903eb9cc23336fbe653e7d008cae6a0de7c45b"
 		score = 70
 		quality = 85
 		tags = "CVE-2022-30190, FILE"
@@ -294579,7 +292441,7 @@ rule SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22 : CVE_2022_30190 F
 		$sc3 = "uaHRtbCEi" ascii
 
 	condition:
-		filesize <400KB and 1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
+		filesize < 400KB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* )
 }
 rule SIGNATURE_BASE_SUSP_Msdt_Artefact_Jun22_2 : CVE_2022_30190 FILE
 {
@@ -294590,9 +292452,9 @@ rule SIGNATURE_BASE_SUSP_Msdt_Artefact_Jun22_2 : CVE_2022_30190 FILE
 		date = "2022-06-01"
 		modified = "2022-07-29"
 		reference = "https://twitter.com/nas_bench/status/1531718490494844928"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_doc_follina.yar#L218-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e18f6405f0411128335336e65dda4ed2b6be6e9ad47b94646ececf0479fbe967"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_doc_follina.yar#L218-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e18f6405f0411128335336e65dda4ed2b6be6e9ad47b94646ececf0479fbe967"
 		score = 75
 		quality = 85
 		tags = "CVE-2022-30190, FILE"
@@ -294604,7 +292466,7 @@ rule SIGNATURE_BASE_SUSP_Msdt_Artefact_Jun22_2 : CVE_2022_30190 FILE
 		$x3 = "$(IEX(" ascii nocase
 
 	condition:
-		uint32(0)==0x6D783F3C and $a1 and 1 of ($x*)
+		uint32( 0 ) == 0x6D783F3C and $a1 and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_SUSP_LNK_Follina_Jun22 : CVE_2022_30190 FILE
 {
@@ -294615,9 +292477,9 @@ rule SIGNATURE_BASE_SUSP_LNK_Follina_Jun22 : CVE_2022_30190 FILE
 		date = "2022-06-02"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/gossithedog/status/1531650897905950727"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_doc_follina.yar#L239-L257"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0b63bb266b968987b2b5a83c9429e96acbd57e12178e4f5fd5894b23d1aaa237"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_doc_follina.yar#L239-L257"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0b63bb266b968987b2b5a83c9429e96acbd57e12178e4f5fd5894b23d1aaa237"
 		score = 75
 		quality = 85
 		tags = "CVE-2022-30190, FILE"
@@ -294629,7 +292491,7 @@ rule SIGNATURE_BASE_SUSP_LNK_Follina_Jun22 : CVE_2022_30190 FILE
 		$sb = "IT_BrowseForFile=" ascii wide
 
 	condition:
-		filesize <5KB and uint16(0)==0x004c and uint32(4)==0x00021401 and 1 of ($sa*) and $sb
+		filesize < 5KB and uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and 1 of ( $sa* ) and $sb
 }
 import "pe"
 
@@ -294642,9 +292504,9 @@ rule SIGNATURE_BASE_MAL_Exilerat_Feb19_1 : FILE
 		date = "2019-02-04"
 		modified = "2023-12-05"
 		reference = "https://creativecommons.org/licenses/by-nc/4.0/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_exile_rat.yar#L4-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0556bc0dbd33502d5bf823cf265a4e133d9af43076abe35a86cf5e20ab314e35"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_exile_rat.yar#L4-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0556bc0dbd33502d5bf823cf265a4e133d9af43076abe35a86cf5e20ab314e35"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294659,7 +292521,7 @@ rule SIGNATURE_BASE_MAL_Exilerat_Feb19_1 : FILE
 		$s5 = "ver:%d.%d.%d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="da8475fc7c3c90c0604ce6a0b56b5f21" or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "da8475fc7c3c90c0604ce6a0b56b5f21" or 3 of them )
 }
 rule SIGNATURE_BASE_Plugx_J16_Gen : FILE
 {
@@ -294670,9 +292532,9 @@ rule SIGNATURE_BASE_Plugx_J16_Gen : FILE
 		date = "2016-06-08"
 		modified = "2023-12-05"
 		reference = "VT Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_win_plugx.yar#L10-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3e988243663264b2647e098e36b83dd675141fa9765c9bd47c30f29bf176cd8f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_win_plugx.yar#L10-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3e988243663264b2647e098e36b83dd675141fa9765c9bd47c30f29bf176cd8f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294699,7 +292561,7 @@ rule SIGNATURE_BASE_Plugx_J16_Gen : FILE
 		$s14 = "\\bug.log" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 4 of ($s*))) or (8 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( 8 of them )
 }
 rule SIGNATURE_BASE_Plugx_J16_Gen2 : FILE
 {
@@ -294710,9 +292572,9 @@ rule SIGNATURE_BASE_Plugx_J16_Gen2 : FILE
 		date = "2016-06-08"
 		modified = "2023-12-05"
 		reference = "VT Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_win_plugx.yar#L42-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8fbe90cbff5d408d26b0a5ace6833a0e3100d11ff544184d9ccc2f39ee806de9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_win_plugx.yar#L42-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8fbe90cbff5d408d26b0a5ace6833a0e3100d11ff544184d9ccc2f39ee806de9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294730,7 +292592,7 @@ rule SIGNATURE_BASE_Plugx_J16_Gen2 : FILE
 		$s14 = "XInstallUAC.cpp" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (2 of ($s*))) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 2 of ( $s* ) ) ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_MAL_LNX_Linadoor_Rootkit_May22 : FILE
 {
@@ -294741,9 +292603,9 @@ rule SIGNATURE_BASE_MAL_LNX_Linadoor_Rootkit_May22 : FILE
 		date = "2022-05-19"
 		modified = "2023-05-16"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lnx_linadoor_rootkit.yar#L2-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "546c34d4c204c7266884bb3b5b6ada418e83029ab88f72e5ffb094f50d9ed28e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lnx_linadoor_rootkit.yar#L2-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_546c34d4c204c7266884bb3b5b6ada418e83029ab88f72e5ffb094f50d9ed28e"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -294769,7 +292631,7 @@ rule SIGNATURE_BASE_MAL_LNX_Linadoor_Rootkit_May22 : FILE
 		$fp1 = "/wgsyncdaemon.pid"
 
 	condition:
-		uint16(0)==0x457f and filesize <2000KB and 2 of them and not 1 of ($fp*) or 4 of them
+		uint16( 0 ) == 0x457f and filesize < 2000KB and 2 of them and not 1 of ( $fp* ) or 4 of them
 }
 rule SIGNATURE_BASE_Gen_Python_Reverse_Shell : FILE
 {
@@ -294780,9 +292642,9 @@ rule SIGNATURE_BASE_Gen_Python_Reverse_Shell : FILE
 		date = "2018-02-24"
 		modified = "2023-12-05"
 		reference = "https://www.virustotal.com/en/file/9ec5102bcbabc45f2aa7775464f33019cfbe9d766b1332ee675957c923a17efd/analysis/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_python_reverse_shell.yara#L1-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "12b1424265cd0ea62b8dd5c08933f1285a156d906df6c31ca9a94fbc303f248e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_python_reverse_shell.yara#L1-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_12b1424265cd0ea62b8dd5c08933f1285a156d906df6c31ca9a94fbc303f248e"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -294800,10 +292662,8 @@ rule SIGNATURE_BASE_Gen_Python_Reverse_Shell : FILE
 		$enc_x3 = /(4AcgBlAGMAdg|5yZWN2|AHIAZQBjAHYA|cmVjd|LgByAGUAYwB2A|LnJlY3)/
 
 	condition:
-		uint32be(0)==0x696d706f and $h1 at 0 and filesize <40KB and all of ($s*) and all of ($enc_x*)
+		uint32be( 0 ) == 0x696d706f and $h1 at 0 and filesize < 40KB and all of ( $s* ) and all of ( $enc_x* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Slingshot_APT_Spork_Downloader : FILE
 {
 	meta:
@@ -294813,9 +292673,9 @@ rule SIGNATURE_BASE_Slingshot_APT_Spork_Downloader : FILE
 		date = "2018-03-09"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_slingshot.yar#L11-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5dac11c595d838cb6b5f1e548307ea79d119c890c54e954453cf1a264e1d14ed"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_slingshot.yar#L11-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5dac11c595d838cb6b5f1e548307ea79d119c890c54e954453cf1a264e1d14ed"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294826,10 +292686,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Spork_Downloader : FILE
 		$s2 = "connect-back IP address and port number"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Slingshot_APT_Minisling : FILE
 {
 	meta:
@@ -294839,9 +292697,9 @@ rule SIGNATURE_BASE_Slingshot_APT_Minisling : FILE
 		date = "2018-03-09"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_slingshot.yar#L26-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d370271fea6c607c051eb49681600b4f59878c2fd2d43d71194bddda78d7b09"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_slingshot.yar#L26-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d370271fea6c607c051eb49681600b4f59878c2fd2d43d71194bddda78d7b09"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294851,10 +292709,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Minisling : FILE
 		$s1 = "{6D29520B-F138-442e-B29F-A4E7140F33DE}" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Slingshot_APT_Ring0_Loader : FILE
 {
 	meta:
@@ -294864,9 +292720,9 @@ rule SIGNATURE_BASE_Slingshot_APT_Ring0_Loader : FILE
 		date = "2018-03-09"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_slingshot.yar#L40-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c231158e44de01585e9fb4bd9768b388016972e2026e049070cdc6cd35362609"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_slingshot.yar#L40-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c231158e44de01585e9fb4bd9768b388016972e2026e049070cdc6cd35362609"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294882,7 +292738,7 @@ rule SIGNATURE_BASE_Slingshot_APT_Ring0_Loader : FILE
 		$s7 = " -> [Sandra] Value from IOCTL_RDMSR:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
 }
 import "pe"
 
@@ -294895,9 +292751,9 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_1 : FILE
 		date = "2018-03-09"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_slingshot.yar#L60-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "43cf94058fe3833a4623ecb784eea50e199536d4903fb9457843b7b5e9a244e3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_slingshot.yar#L60-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_43cf94058fe3833a4623ecb784eea50e199536d4903fb9457843b7b5e9a244e3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294910,10 +292766,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_1 : FILE
 		$s3 = "smsvcrt -h 0x%p" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (pe.imphash()=="7ead4bb0d752003ce7c062adb7ffc51a" or pe.exports("WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW0000") or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( pe.imphash ( ) == "7ead4bb0d752003ce7c062adb7ffc51a" or pe.exports ( "WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW0000" ) or 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Slingshot_APT_Malware_2 : FILE
 {
 	meta:
@@ -294923,9 +292777,9 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_2 : FILE
 		date = "2018-03-09"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_slingshot.yar#L81-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d56dadf747c64cb518ddc9aaee38fd50c67fe7344d7569d9ef3169099e7f36c5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_slingshot.yar#L81-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d56dadf747c64cb518ddc9aaee38fd50c67fe7344d7569d9ef3169099e7f36c5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294941,7 +292795,7 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_2 : FILE
 		$s4 = "lNTLMqSpPD" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 4 of them )
 }
 import "pe"
 
@@ -294954,9 +292808,9 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_3 : FILE
 		date = "2018-03-09"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_slingshot.yar#L102-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "420c54ce90a13258e0dd54524fe7df4dd97d3e8f1eeaa8ca14350670a87e87c6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_slingshot.yar#L102-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_420c54ce90a13258e0dd54524fe7df4dd97d3e8f1eeaa8ca14350670a87e87c6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -294970,10 +292824,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_3 : FILE
 		$s4 = "%hc%hc==" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="2f3b3df466e24e0792e0e90d668856bc" or pe.exports("dll_u") or ($a1 and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "2f3b3df466e24e0792e0e90d668856bc" or pe.exports ( "dll_u" ) or ( $a1 and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Slingshot_APT_Malware_4 : FILE
 {
 	meta:
@@ -294983,9 +292835,9 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_4 : FILE
 		date = "2018-03-09"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_slingshot.yar#L124-L144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a9f4b7b4079ebd5ffbee4c82032d28b0015968cb369fae2b0f19b054bf5a1c3c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_slingshot.yar#L124-L144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a9f4b7b4079ebd5ffbee4c82032d28b0015968cb369fae2b0f19b054bf5a1c3c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295000,7 +292852,7 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_4 : FILE
 		$s4 = "EXITGNG" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ($x1 or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( $x1 or 2 of them )
 }
 rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_1 : FILE
 {
@@ -295011,9 +292863,9 @@ rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_1 : FILE
 		date = "2023-01-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_onenote_phish.yar#L2-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c7c5fc86f1dbe54da2d3ff8f039c5e53c3d1f67c9271cb467b2318310f744f93"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_onenote_phish.yar#L2-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c7c5fc86f1dbe54da2d3ff8f039c5e53c3d1f67c9271cb467b2318310f744f93"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -295039,7 +292891,7 @@ rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_1 : FILE
 		$se9 = "MAAAAARQCA"
 
 	condition:
-		filesize <5MB and 1 of ($ge*) and 1 of ($s*)
+		filesize < 5MB and 1 of ( $ge* ) and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_2 : FILE
 {
@@ -295050,9 +292902,9 @@ rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_2 : FILE
 		date = "2023-01-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_onenote_phish.yar#L41-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb6f992ce186022f04613af3bf4df629b00d85eac151f8bbd4b8ef96e6892eab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_onenote_phish.yar#L41-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb6f992ce186022f04613af3bf4df629b00d85eac151f8bbd4b8ef96e6892eab"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -295065,7 +292917,7 @@ rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_2 : FILE
 		$x04 = " attachment; filename=\"SHIP" nocase
 
 	condition:
-		filesize <5MB and $hc1 and 1 of ($x*)
+		filesize < 5MB and $hc1 and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_1 : FILE
 {
@@ -295076,9 +292928,9 @@ rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_1 : FIL
 		date = "2023-01-27"
 		modified = "2023-02-27"
 		reference = "https://blog.didierstevens.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_onenote_phish.yar#L63-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d91ca297ea96f80534085f174d335ffe961c569534f043c5c2ae8d6a9f7ac083"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_onenote_phish.yar#L63-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d91ca297ea96f80534085f174d335ffe961c569534f043c5c2ae8d6a9f7ac083"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -295116,7 +292968,7 @@ rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_1 : FIL
               ?? ?? ?? ?? [6-200] 3C 6A 6F 62 20 }
 
 	condition:
-		filesize <10MB and 1 of them
+		filesize < 10MB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_2 : FILE
 {
@@ -295127,9 +292979,9 @@ rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_2 : FIL
 		date = "2023-01-27"
 		modified = "2023-12-05"
 		reference = "https://blog.didierstevens.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_onenote_phish.yar#L108-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bc07598570b6d4ebc5d14cedfed146c1ad309b8890bc0b9ee5f9ad645c1352e2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_onenote_phish.yar#L108-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bc07598570b6d4ebc5d14cedfed146c1ad309b8890bc0b9ee5f9ad645c1352e2"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -295139,7 +292991,7 @@ rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_2 : FIL
 		$s1 = "<HTA:APPLICATION "
 
 	condition:
-		filesize <5MB and $a1 and 1 of ($s*)
+		filesize < 5MB and $a1 and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_APT30_Generic_H : FILE
 {
@@ -295150,9 +293002,9 @@ rule SIGNATURE_BASE_APT30_Generic_H : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4affe7dc01efc4d6c25aaae4679bc1f8fddd97794e351d30501eaeb8e1d1dea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4affe7dc01efc4d6c25aaae4679bc1f8fddd97794e351d30501eaeb8e1d1dea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295166,7 +293018,7 @@ rule SIGNATURE_BASE_APT30_Generic_H : FILE
 		$s2 = "\\Internet Exp1orer" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_2 : FILE
 {
@@ -295177,10 +293029,10 @@ rule SIGNATURE_BASE_APT30_Sample_2 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167"
-		logic_hash = "e34dbb90fc868b0619d3d2aa1b6176252836a6ae72e6f52b1eba632054f7c272"
+		logic_hash = "v1_sha256_e34dbb90fc868b0619d3d2aa1b6176252836a6ae72e6f52b1eba632054f7c272"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295194,7 +293046,7 @@ rule SIGNATURE_BASE_APT30_Sample_2 : FILE
 		$s12 = " (C) 2011" fullword wide
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_3 : FILE
 {
@@ -295205,10 +293057,10 @@ rule SIGNATURE_BASE_APT30_Sample_3 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L47-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L47-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d0320144e65c9af0052f8dee0419e8deed91b61b"
-		logic_hash = "ee61ec1fdf27fa21bcc235fce0ab8dc74968b39a747648ce828fb4826cf1d234"
+		logic_hash = "v1_sha256_ee61ec1fdf27fa21bcc235fce0ab8dc74968b39a747648ce828fb4826cf1d234"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295222,7 +293074,7 @@ rule SIGNATURE_BASE_APT30_Sample_3 : FILE
 		$s12 = "%s%s(X-" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_C : FILE
 {
@@ -295233,9 +293085,9 @@ rule SIGNATURE_BASE_APT30_Generic_C : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L66-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b969565eac3b6f548318aae4edc8d8851f522a6c263bcaf2a466ff0ca9af78a4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L66-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b969565eac3b6f548318aae4edc8d8851f522a6c263bcaf2a466ff0ca9af78a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295255,7 +293107,7 @@ rule SIGNATURE_BASE_APT30_Generic_C : FILE
 		$s3 = "MYMSVCRT.dll" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_4 : FILE
 {
@@ -295266,10 +293118,10 @@ rule SIGNATURE_BASE_APT30_Sample_4 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L90-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L90-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd"
-		logic_hash = "ec9542acb583bd5812d561bea70e89e0fcddc1eaef14d3ea5b8ad29711ed17ae"
+		logic_hash = "v1_sha256_ec9542acb583bd5812d561bea70e89e0fcddc1eaef14d3ea5b8ad29711ed17ae"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295284,7 +293136,7 @@ rule SIGNATURE_BASE_APT30_Sample_4 : FILE
 		$s6 = "foAModuleHand" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_5 : FILE
 {
@@ -295295,10 +293147,10 @@ rule SIGNATURE_BASE_APT30_Sample_5 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L110-L127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L110-L127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b"
-		logic_hash = "3738076d97bf19404bad20c2419eae83dd2b65400d5bd135ffe73362c008de9b"
+		logic_hash = "v1_sha256_3738076d97bf19404bad20c2419eae83dd2b65400d5bd135ffe73362c008de9b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295312,7 +293164,7 @@ rule SIGNATURE_BASE_APT30_Sample_5 : FILE
 		$s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_6 : FILE
 {
@@ -295323,10 +293175,10 @@ rule SIGNATURE_BASE_APT30_Sample_6 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L129-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L129-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "00e69b059ad6b51b76bc476a115325449d10b4c0"
-		logic_hash = "139719139056f575967629f0153e0a05239bc26f61f6d4324cfb6a816518c3df"
+		logic_hash = "v1_sha256_139719139056f575967629f0153e0a05239bc26f61f6d4324cfb6a816518c3df"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295337,7 +293189,7 @@ rule SIGNATURE_BASE_APT30_Sample_6 : FILE
 		$s1 = "Ternel32.dll" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_7 : FILE
 {
@@ -295348,10 +293200,10 @@ rule SIGNATURE_BASE_APT30_Sample_7 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L145-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L145-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba"
-		logic_hash = "f7922d795bc92714a9ef4861bc9c4ac9921a73749e3aa1d5f7dbc3c991fe7145"
+		logic_hash = "v1_sha256_f7922d795bc92714a9ef4861bc9c4ac9921a73749e3aa1d5f7dbc3c991fe7145"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295366,7 +293218,7 @@ rule SIGNATURE_BASE_APT30_Sample_7 : FILE
 		$s8 = "deflate 1.1.3 Copyright" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_E : FILE
 {
@@ -295377,9 +293229,9 @@ rule SIGNATURE_BASE_APT30_Generic_E : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L165-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5ccf1f1334dc300d13aa8dbc080d2d839815d102958fde2b8709c11f522412fd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L165-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5ccf1f1334dc300d13aa8dbc080d2d839815d102958fde2b8709c11f522412fd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295395,7 +293247,7 @@ rule SIGNATURE_BASE_APT30_Generic_E : FILE
 		$s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_8 : FILE
 {
@@ -295406,10 +293258,10 @@ rule SIGNATURE_BASE_APT30_Sample_8 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L185-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L185-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3"
-		logic_hash = "bff21d517e97d2b13dff2b5ebc9a5b82b8f7635943c89f992b41d269623cd498"
+		logic_hash = "v1_sha256_bff21d517e97d2b13dff2b5ebc9a5b82b8f7635943c89f992b41d269623cd498"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295422,7 +293274,7 @@ rule SIGNATURE_BASE_APT30_Sample_8 : FILE
 		$s3 = "OpenMutex" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_B : FILE
 {
@@ -295433,9 +293285,9 @@ rule SIGNATURE_BASE_APT30_Generic_B : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L203-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "527c823607836f138369224b7d8d492d36d9ab7a150e64fd5ebbaf99538d6d53"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L203-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_527c823607836f138369224b7d8d492d36d9ab7a150e64fd5ebbaf99538d6d53"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295452,7 +293304,7 @@ rule SIGNATURE_BASE_APT30_Generic_B : FILE
 		$s2 = "Moziea/4.0" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_I : FILE
 {
@@ -295463,9 +293315,9 @@ rule SIGNATURE_BASE_APT30_Generic_I : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L224-L240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e6f0edcbf6e0590c8b4a558142053d5938e86d13d65787f02336dc2a173d5963"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L224-L240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e6f0edcbf6e0590c8b4a558142053d5938e86d13d65787f02336dc2a173d5963"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295479,7 +293331,7 @@ rule SIGNATURE_BASE_APT30_Generic_I : FILE
 		$s2 = "Google Inc." fullword wide
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_9 : FILE
 {
@@ -295490,10 +293342,10 @@ rule SIGNATURE_BASE_APT30_Sample_9 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L242-L263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L242-L263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "442bf8690401a2087a340ce4a48151c39101652f"
-		logic_hash = "0c5465bdafcbca02f855a0cba1fbb4c19d8d21b714dbe777b942dcd1a7acb257"
+		logic_hash = "v1_sha256_0c5465bdafcbca02f855a0cba1fbb4c19d8d21b714dbe777b942dcd1a7acb257"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295511,7 +293363,7 @@ rule SIGNATURE_BASE_APT30_Sample_9 : FILE
 		$s20 = "WideChc[lobalAl" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_10 : FILE
 {
@@ -295522,10 +293374,10 @@ rule SIGNATURE_BASE_APT30_Sample_10 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L264-L283"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L264-L283"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901"
-		logic_hash = "5a6bd8223fbce133bd11b903edfd7f8ff5a436e26a47c048a5ac606ad4a0b564"
+		logic_hash = "v1_sha256_5a6bd8223fbce133bd11b903edfd7f8ff5a436e26a47c048a5ac606ad4a0b564"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295541,7 +293393,7 @@ rule SIGNATURE_BASE_APT30_Sample_10 : FILE
 		$s18 = "(Prxy-No)" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_11 : FILE
 {
@@ -295552,10 +293404,10 @@ rule SIGNATURE_BASE_APT30_Sample_11 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L285-L312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L285-L312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6"
-		logic_hash = "5e86b53591caa7c783a946205a3d04f91c71294d844e6f6ee88c3bc78e603ea0"
+		logic_hash = "v1_sha256_5e86b53591caa7c783a946205a3d04f91c71294d844e6f6ee88c3bc78e603ea0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295579,7 +293431,7 @@ rule SIGNATURE_BASE_APT30_Sample_11 : FILE
 		$s19 = "2003 Microsoft Office system" fullword wide
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_12 : FILE
 {
@@ -295590,10 +293442,10 @@ rule SIGNATURE_BASE_APT30_Sample_12 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L314-L329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L314-L329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc"
-		logic_hash = "997c91267f956bd7d2a7edca9817ebc80bbf1eed944b3bc01cc8bb01927deb1e"
+		logic_hash = "v1_sha256_997c91267f956bd7d2a7edca9817ebc80bbf1eed944b3bc01cc8bb01927deb1e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295605,7 +293457,7 @@ rule SIGNATURE_BASE_APT30_Sample_12 : FILE
 		$s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_13 : FILE
 {
@@ -295616,10 +293468,10 @@ rule SIGNATURE_BASE_APT30_Sample_13 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L331-L349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L331-L349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a359f705a833c4a4254443b87645fd579aa94bcf"
-		logic_hash = "cd5285e8b78493b64704cec21c13d0a017d66936aa8356cfea2aa77c6f87b9e7"
+		logic_hash = "v1_sha256_cd5285e8b78493b64704cec21c13d0a017d66936aa8356cfea2aa77c6f87b9e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295634,7 +293486,7 @@ rule SIGNATURE_BASE_APT30_Sample_13 : FILE
 		$s6 = "2003 Microsoft Office system" fullword wide
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_14 : FILE
 {
@@ -295645,10 +293497,10 @@ rule SIGNATURE_BASE_APT30_Sample_14 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L351-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L351-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472"
-		logic_hash = "e5f352b1aa643b9508c01bbe921197ebd8992ec94036b869c55970f0177164d3"
+		logic_hash = "v1_sha256_e5f352b1aa643b9508c01bbe921197ebd8992ec94036b869c55970f0177164d3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295661,7 +293513,7 @@ rule SIGNATURE_BASE_APT30_Sample_14 : FILE
 		$s8 = "Adobe Reader" fullword wide
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_15 : FILE
 {
@@ -295672,10 +293524,10 @@ rule SIGNATURE_BASE_APT30_Sample_15 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L369-L387"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L369-L387"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027"
-		logic_hash = "5179f39bdcb064f55479ad147a019dd0b3874783c6bad650e84cfd9d0430bb70"
+		logic_hash = "v1_sha256_5179f39bdcb064f55479ad147a019dd0b3874783c6bad650e84cfd9d0430bb70"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295690,7 +293542,7 @@ rule SIGNATURE_BASE_APT30_Sample_15 : FILE
 		$s18 = "TimUmoveH" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_16 : FILE
 {
@@ -295701,10 +293553,10 @@ rule SIGNATURE_BASE_APT30_Sample_16 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L389-L407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L389-L407"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e"
-		logic_hash = "59ea90ac0590bd87a48fabf1a3fa7ece31560b980b738a34227937bbf82a1c55"
+		logic_hash = "v1_sha256_59ea90ac0590bd87a48fabf1a3fa7ece31560b980b738a34227937bbf82a1c55"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -295719,7 +293571,7 @@ rule SIGNATURE_BASE_APT30_Sample_16 : FILE
 		$s7 = "SVWhHw@" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_A : FILE
 {
@@ -295730,9 +293582,9 @@ rule SIGNATURE_BASE_APT30_Generic_A : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L409-L429"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c20660a8a55c6c6cb058fb233e0b29e1e4be2683181dbdfb06e17037d0ed8c31"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L409-L429"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c20660a8a55c6c6cb058fb233e0b29e1e4be2683181dbdfb06e17037d0ed8c31"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295750,7 +293602,7 @@ rule SIGNATURE_BASE_APT30_Generic_A : FILE
 		$s12 = "uUhXiA" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_17 : FILE
 {
@@ -295761,10 +293613,10 @@ rule SIGNATURE_BASE_APT30_Sample_17 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L431-L445"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L431-L445"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845"
-		logic_hash = "43913151325fbce993dbfec0acf64ca835b12270c47156ae81b0ce4f32c7bde1"
+		logic_hash = "v1_sha256_43913151325fbce993dbfec0acf64ca835b12270c47156ae81b0ce4f32c7bde1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295775,7 +293627,7 @@ rule SIGNATURE_BASE_APT30_Sample_17 : FILE
 		$s4 = "IEXPL0RE" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_18 : FILE
 {
@@ -295786,10 +293638,10 @@ rule SIGNATURE_BASE_APT30_Sample_18 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L446-L466"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L446-L466"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "355436a16d7a2eba8a284b63bb252a8bb1644751"
-		logic_hash = "d20f1d1b7b43defc36c7b1f99f14ed9e73e770b6f43d0ad92110cf9178b35b15"
+		logic_hash = "v1_sha256_d20f1d1b7b43defc36c7b1f99f14ed9e73e770b6f43d0ad92110cf9178b35b15"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295806,7 +293658,7 @@ rule SIGNATURE_BASE_APT30_Sample_18 : FILE
 		$s20 = "XPL0RE." ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_G : FILE
 {
@@ -295817,13 +293669,13 @@ rule SIGNATURE_BASE_APT30_Generic_G : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L468-L489"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L468-L489"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1612b392d6145bfb0c43f8a48d78c75f"
 		hash = "53f1358cbc298da96ec56e9a08851b4b"
 		hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0"
 		hash = "f18be055fae2490221c926e2ad55ab11"
-		logic_hash = "6926d73839958acd06835c1943edb150a0f60cdc269fac053531a0e0483e0521"
+		logic_hash = "v1_sha256_6926d73839958acd06835c1943edb150a0f60cdc269fac053531a0e0483e0521"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295838,7 +293690,7 @@ rule SIGNATURE_BASE_APT30_Generic_G : FILE
 		$s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_19 : FILE
 {
@@ -295849,10 +293701,10 @@ rule SIGNATURE_BASE_APT30_Sample_19 : FILE
 		date = "2015-04-03"
 		modified = "2023-01-06"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L491-L517"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L491-L517"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cfa438449715b61bffa20130df8af778ef011e15"
-		logic_hash = "9127ae31c5b818a2759f9d33c74c8631079539e7fa8e49e5514b016df2624065"
+		logic_hash = "v1_sha256_9127ae31c5b818a2759f9d33c74c8631079539e7fa8e49e5514b016df2624065"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295873,7 +293725,7 @@ rule SIGNATURE_BASE_APT30_Sample_19 : FILE
 		$s14 = "Type:%-8s" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and 8 of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and 8 of them
 }
 rule SIGNATURE_BASE_APT30_Generic_E_V2 : FILE
 {
@@ -295884,10 +293736,10 @@ rule SIGNATURE_BASE_APT30_Generic_E_V2 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L519-L535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L519-L535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd"
-		logic_hash = "25a7e5780f56b4f9cfb76494926c446a39a88bef2cda82b31e6de2b85c5edbda"
+		logic_hash = "v1_sha256_25a7e5780f56b4f9cfb76494926c446a39a88bef2cda82b31e6de2b85c5edbda"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295900,7 +293752,7 @@ rule SIGNATURE_BASE_APT30_Generic_E_V2 : FILE
 		$s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_20 : FILE
 {
@@ -295911,10 +293763,10 @@ rule SIGNATURE_BASE_APT30_Sample_20 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L537-L557"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L537-L557"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0"
-		logic_hash = "f94cbd4b8e7ba302db9ac4ef3617bd68aa0aa1ee3cfc6dfee4621223bbdae3c5"
+		logic_hash = "v1_sha256_f94cbd4b8e7ba302db9ac4ef3617bd68aa0aa1ee3cfc6dfee4621223bbdae3c5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295931,7 +293783,7 @@ rule SIGNATURE_BASE_APT30_Sample_20 : FILE
 		$s17 = "'QWERTY:/webpage3" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_21 : FILE
 {
@@ -295942,10 +293794,10 @@ rule SIGNATURE_BASE_APT30_Sample_21 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L559-L575"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L559-L575"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d315daa61126616a79a8582145777d8a1565c615"
-		logic_hash = "e3e431bb6915d99b8aa1915419b60ba47372005b9b4994a924746a91bad80310"
+		logic_hash = "v1_sha256_e3e431bb6915d99b8aa1915419b60ba47372005b9b4994a924746a91bad80310"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295958,7 +293810,7 @@ rule SIGNATURE_BASE_APT30_Sample_21 : FILE
 		$s5 = "Proxy-%s:%u" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_22 : FILE
 {
@@ -295969,10 +293821,10 @@ rule SIGNATURE_BASE_APT30_Sample_22 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L577-L595"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L577-L595"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481"
-		logic_hash = "88a45d248eba7b9776e2e7d345d2948e00a94a7e359acb89d1943be55ab342ad"
+		logic_hash = "v1_sha256_88a45d248eba7b9776e2e7d345d2948e00a94a7e359acb89d1943be55ab342ad"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -295987,7 +293839,7 @@ rule SIGNATURE_BASE_APT30_Sample_22 : FILE
 		$s8 = "PROGRAM FILE" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_F : FILE
 {
@@ -295998,9 +293850,9 @@ rule SIGNATURE_BASE_APT30_Generic_F : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L597-L615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4997b52e0cc12a1a0c84cec3565dd9e6b486ccef4eb8791c566c7a534d36e3ff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L597-L615"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4997b52e0cc12a1a0c84cec3565dd9e6b486ccef4eb8791c566c7a534d36e3ff"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296016,7 +293868,7 @@ rule SIGNATURE_BASE_APT30_Generic_F : FILE
 		$s3 = "NodAndKabIsExcellent" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_23 : FILE
 {
@@ -296027,10 +293879,10 @@ rule SIGNATURE_BASE_APT30_Sample_23 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L617-L637"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L617-L637"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9865e24aadb4480bd3c182e50e0e53316546fc01"
-		logic_hash = "64ff048b061431e0834ac40bfccb0d9e8ca60ffb022578ef910e6ffc511be6ed"
+		logic_hash = "v1_sha256_64ff048b061431e0834ac40bfccb0d9e8ca60ffb022578ef910e6ffc511be6ed"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296047,7 +293899,7 @@ rule SIGNATURE_BASE_APT30_Sample_23 : FILE
 		$s14 = "help32SnapshotfL" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_24 : FILE
 {
@@ -296058,10 +293910,10 @@ rule SIGNATURE_BASE_APT30_Sample_24 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L639-L658"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L639-L658"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "572caa09f2b600daa941c60db1fc410bef8d1771"
-		logic_hash = "9d550fd0225f1c4e3b16ae53648644d7bb5c80e99e2a1a3d199e51c7219c2e94"
+		logic_hash = "v1_sha256_9d550fd0225f1c4e3b16ae53648644d7bb5c80e99e2a1a3d199e51c7219c2e94"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296077,7 +293929,7 @@ rule SIGNATURE_BASE_APT30_Sample_24 : FILE
 		$s17 = "ModuleH" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_25 : FILE
 {
@@ -296088,10 +293940,10 @@ rule SIGNATURE_BASE_APT30_Sample_25 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L660-L679"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L660-L679"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "44a21c8b3147fabc668fee968b62783aa9d90351"
-		logic_hash = "86945188f888762ae585463df7cfb6e5fed30d0fcfcca4e642aedf07a0193ae7"
+		logic_hash = "v1_sha256_86945188f888762ae585463df7cfb6e5fed30d0fcfcca4e642aedf07a0193ae7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296107,7 +293959,7 @@ rule SIGNATURE_BASE_APT30_Sample_25 : FILE
 		$s18 = "GPRTMAX" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_26 : FILE
 {
@@ -296118,10 +293970,10 @@ rule SIGNATURE_BASE_APT30_Sample_26 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L681-L700"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L681-L700"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e26588113417bf68cb0c479638c9cd99a48e846d"
-		logic_hash = "b585687c071dc2dddb888906f47b7af6bc7683e902d3afb42364896e800fac5c"
+		logic_hash = "v1_sha256_b585687c071dc2dddb888906f47b7af6bc7683e902d3afb42364896e800fac5c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296137,7 +293989,7 @@ rule SIGNATURE_BASE_APT30_Sample_26 : FILE
 		$s15 = "PeekNamed6G" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_D : FILE
 {
@@ -296148,9 +294000,9 @@ rule SIGNATURE_BASE_APT30_Generic_D : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L702-L725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff39fc7643441652ec0cdf2f84c7827d326ddb5f01451b3857cfc4015eb01467"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L702-L725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff39fc7643441652ec0cdf2f84c7827d326ddb5f01451b3857cfc4015eb01467"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296171,7 +294023,7 @@ rule SIGNATURE_BASE_APT30_Generic_D : FILE
 		$s5 = "5, 4, 2600, 0" fullword wide
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_27 : FILE
 {
@@ -296182,10 +294034,10 @@ rule SIGNATURE_BASE_APT30_Sample_27 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L727-L746"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L727-L746"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1"
-		logic_hash = "5ef0661c5c04f0f0923548509363971011194a16e4308fcfdea5db90e85518a4"
+		logic_hash = "v1_sha256_5ef0661c5c04f0f0923548509363971011194a16e4308fcfdea5db90e85518a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296201,7 +294053,7 @@ rule SIGNATURE_BASE_APT30_Sample_27 : FILE
 		$s16 = "GXSYSTEM" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_28 : FILE
 {
@@ -296212,9 +294064,9 @@ rule SIGNATURE_BASE_APT30_Sample_28 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L748-L776"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d246a188ad9ec69948bef6018bab1e7a244c76dcf511c3f9d16024ef7e369ae2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L748-L776"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d246a188ad9ec69948bef6018bab1e7a244c76dcf511c3f9d16024ef7e369ae2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296240,7 +294092,7 @@ rule SIGNATURE_BASE_APT30_Sample_28 : FILE
 		$s19 = "MicrosoftHaveExit" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and 7 of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and 7 of them
 }
 rule SIGNATURE_BASE_APT30_Sample_29 : FILE
 {
@@ -296251,10 +294103,10 @@ rule SIGNATURE_BASE_APT30_Sample_29 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L778-L798"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L778-L798"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "44492c53715d7c79895904543843a321491cb23a"
-		logic_hash = "7a59118ba00413961e6fc4d54680373d033a38d698613f853f67137b85c123a7"
+		logic_hash = "v1_sha256_7a59118ba00413961e6fc4d54680373d033a38d698613f853f67137b85c123a7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296271,7 +294123,7 @@ rule SIGNATURE_BASE_APT30_Sample_29 : FILE
 		$s7 = "MicrosoftFlashZJ" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_30 : FILE
 {
@@ -296282,10 +294134,10 @@ rule SIGNATURE_BASE_APT30_Sample_30 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L800-L817"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L800-L817"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528"
-		logic_hash = "5ecfc8d53b768f624c8765f70708bfaae5396d7aa6b0335f7c656f4350649c5d"
+		logic_hash = "v1_sha256_5ecfc8d53b768f624c8765f70708bfaae5396d7aa6b0335f7c656f4350649c5d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296299,7 +294151,7 @@ rule SIGNATURE_BASE_APT30_Sample_30 : FILE
 		$s9 = "5.1.2600.2180" fullword wide
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_31 : FILE
 {
@@ -296310,10 +294162,10 @@ rule SIGNATURE_BASE_APT30_Sample_31 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L819-L836"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L819-L836"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8b4271167655787be1988574446125eae5043aca"
-		logic_hash = "003bfa9774d3e85829cc266d06417b86287986994995adfa7a2bd26c3648c07e"
+		logic_hash = "v1_sha256_003bfa9774d3e85829cc266d06417b86287986994995adfa7a2bd26c3648c07e"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -296327,7 +294179,7 @@ rule SIGNATURE_BASE_APT30_Sample_31 : FILE
 		$s14 = "QWERTY:,`/" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_J : FILE
 {
@@ -296338,9 +294190,9 @@ rule SIGNATURE_BASE_APT30_Generic_J : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L838-L869"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7c404689b60fe493ca9b503902173ac04d7bb00488edec9e69006e6d51e20c51"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L838-L869"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7c404689b60fe493ca9b503902173ac04d7bb00488edec9e69006e6d51e20c51"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296369,7 +294221,7 @@ rule SIGNATURE_BASE_APT30_Generic_J : FILE
 		$s16 = "\\readme.lz" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Microfost : FILE
 {
@@ -296380,10 +294232,10 @@ rule SIGNATURE_BASE_APT30_Microfost : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L871-L885"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L871-L885"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e"
-		logic_hash = "1fe5be3a88859fd3d485adfba92cf117afedc739bd0a46c039124919c3b81361"
+		logic_hash = "v1_sha256_1fe5be3a88859fd3d485adfba92cf117afedc739bd0a46c039124919c3b81361"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296394,7 +294246,7 @@ rule SIGNATURE_BASE_APT30_Microfost : FILE
 		$s2 = "Microfost" fullword wide
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_K : FILE
 {
@@ -296405,10 +294257,10 @@ rule SIGNATURE_BASE_APT30_Generic_K : FILE
 		date = "2015-04-03"
 		modified = "2023-01-06"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L887-L917"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L887-L917"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93"
-		logic_hash = "eed03bb4290eef0ad1cf362a157923aa1fb8faa9305b5aaba3563d0a4e65e1a5"
+		logic_hash = "v1_sha256_eed03bb4290eef0ad1cf362a157923aa1fb8faa9305b5aaba3563d0a4e65e1a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296432,7 +294284,7 @@ rule SIGNATURE_BASE_APT30_Generic_K : FILE
 		$s34 = "open=%s" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and ( all of ($x*) and 3 of ($s*))
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and ( all of ( $x* ) and 3 of ( $s* ) )
 }
 rule SIGNATURE_BASE_APT30_Sample_33 : FILE
 {
@@ -296443,10 +294295,10 @@ rule SIGNATURE_BASE_APT30_Sample_33 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L919-L939"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L919-L939"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4"
-		logic_hash = "295c2d9fcf1c3bab54650fd1d203dfb8c12269945aad8927066ef6f815abea69"
+		logic_hash = "v1_sha256_295c2d9fcf1c3bab54650fd1d203dfb8c12269945aad8927066ef6f815abea69"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296463,7 +294315,7 @@ rule SIGNATURE_BASE_APT30_Sample_33 : FILE
 		$s8 = "WWW.CeleWare.NET1" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and 6 of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and 6 of them
 }
 rule SIGNATURE_BASE_APT30_Sample_34 : FILE
 {
@@ -296474,10 +294326,10 @@ rule SIGNATURE_BASE_APT30_Sample_34 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L941-L960"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L941-L960"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818"
-		logic_hash = "2406f9613585669f88c389ea9729a089f6aef13fba46d60b713f51cd3a946b5d"
+		logic_hash = "v1_sha256_2406f9613585669f88c389ea9729a089f6aef13fba46d60b713f51cd3a946b5d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296493,7 +294345,7 @@ rule SIGNATURE_BASE_APT30_Sample_34 : FILE
 		$s9 = "vcMicrosoftHaveAck7" ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_35 : FILE
 {
@@ -296504,10 +294356,10 @@ rule SIGNATURE_BASE_APT30_Sample_35 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L962-L977"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L962-L977"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6"
-		logic_hash = "a70d9471215ddcfe84a39b33f53c4114b205aa2cc95cd93081afe442ee2b8b42"
+		logic_hash = "v1_sha256_a70d9471215ddcfe84a39b33f53c4114b205aa2cc95cd93081afe442ee2b8b42"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296519,7 +294371,7 @@ rule SIGNATURE_BASE_APT30_Sample_35 : FILE
 		$s18 = "olhelp32Snapshot" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Sample_1 : FILE
 {
@@ -296530,10 +294382,10 @@ rule SIGNATURE_BASE_APT30_Sample_1 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L979-L996"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L979-L996"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc"
-		logic_hash = "5f20b60b8721d62731708630a3443741c956304c553f651572282336995f6d4f"
+		logic_hash = "v1_sha256_5f20b60b8721d62731708630a3443741c956304c553f651572282336995f6d4f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296547,7 +294399,7 @@ rule SIGNATURE_BASE_APT30_Sample_1 : FILE
 		$s7 = "StartupNA" fullword ascii
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_1 : FILE
 {
@@ -296558,9 +294410,9 @@ rule SIGNATURE_BASE_APT30_Generic_1 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L998-L1031"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a2d4e8583286a3f44b49dc902143ee1ea321d26275c6cbcd54876e94b8cd2a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L998-L1031"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a2d4e8583286a3f44b49dc902143ee1ea321d26275c6cbcd54876e94b8cd2a3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296591,7 +294443,7 @@ rule SIGNATURE_BASE_APT30_Generic_1 : FILE
 		$s20 = "(Chile)" fullword
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_2 : FILE
 {
@@ -296602,9 +294454,9 @@ rule SIGNATURE_BASE_APT30_Generic_2 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L1032-L1087"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "56c9e58298c318b6dff2cce0ab896bb7bdd22429e6015b8fe72b8ad2f1f69d30"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L1032-L1087"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_56c9e58298c318b6dff2cce0ab896bb7bdd22429e6015b8fe72b8ad2f1f69d30"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296657,7 +294509,7 @@ rule SIGNATURE_BASE_APT30_Generic_2 : FILE
 		$s16 = "List End." fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_4 : FILE
 {
@@ -296668,9 +294520,9 @@ rule SIGNATURE_BASE_APT30_Generic_4 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L1110-L1140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d6a45baee2741c5ebb05fc3f17974a041cd37f665df1e67934b0928fc75f37c3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L1110-L1140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d6a45baee2741c5ebb05fc3f17974a041cd37f665df1e67934b0928fc75f37c3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296698,7 +294550,7 @@ rule SIGNATURE_BASE_APT30_Generic_4 : FILE
 		$s14 = "le_-*^il" fullword
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_5 : FILE
 {
@@ -296709,9 +294561,9 @@ rule SIGNATURE_BASE_APT30_Generic_5 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L1142-L1163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a9d93d7dbf8c5e97ce77cf3fef4941a01c5b1c6bcee40c6f4ca7117d8aee289e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L1142-L1163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a9d93d7dbf8c5e97ce77cf3fef4941a01c5b1c6bcee40c6f4ca7117d8aee289e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296730,7 +294582,7 @@ rule SIGNATURE_BASE_APT30_Generic_5 : FILE
 		$s5 = "LiveUpdate" fullword wide
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_6 : FILE
 {
@@ -296741,9 +294593,9 @@ rule SIGNATURE_BASE_APT30_Generic_6 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L1165-L1186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff7473e43e11e31fe6ad997009834f661a0120317e479184410456c99f72b613"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L1165-L1186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff7473e43e11e31fe6ad997009834f661a0120317e479184410456c99f72b613"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296762,7 +294614,7 @@ rule SIGNATURE_BASE_APT30_Generic_6 : FILE
 		$s5 = "NoDriveT" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_7 : FILE
 {
@@ -296773,9 +294625,9 @@ rule SIGNATURE_BASE_APT30_Generic_7 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L1188-L1206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b5a272cbeb46be9b120acdbe12d795eddc05765777e4157d818c2b91ea7b782b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L1188-L1206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b5a272cbeb46be9b120acdbe12d795eddc05765777e4157d818c2b91ea7b782b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296791,7 +294643,7 @@ rule SIGNATURE_BASE_APT30_Generic_7 : FILE
 		$s4 = "Ouopai" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_8 : FILE
 {
@@ -296802,9 +294654,9 @@ rule SIGNATURE_BASE_APT30_Generic_8 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L1207-L1232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2c240d2a35ce3d621d108d03d4e720ddf86e248047fb4dd7f9724e64020caa7f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L1207-L1232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2c240d2a35ce3d621d108d03d4e720ddf86e248047fb4dd7f9724e64020caa7f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296827,7 +294679,7 @@ rule SIGNATURE_BASE_APT30_Generic_8 : FILE
 		$s12 = "WM_RBU" fullword
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_APT30_Generic_9 : FILE
 {
@@ -296838,9 +294690,9 @@ rule SIGNATURE_BASE_APT30_Generic_9 : FILE
 		date = "2015-04-13"
 		modified = "2023-12-05"
 		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt30_backspace.yar#L1234-L1255"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0b30c2f0bd654371bf3ac4f9d4e700e1544b62a6c0a072d506160c443fc5fe9d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt30_backspace.yar#L1234-L1255"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0b30c2f0bd654371bf3ac4f9d4e700e1544b62a6c0a072d506160c443fc5fe9d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296859,10 +294711,8 @@ rule SIGNATURE_BASE_APT30_Generic_9 : FILE
 		$s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_Strings_Aug18_1
 {
 	meta:
@@ -296872,9 +294722,9 @@ rule SIGNATURE_BASE_APT_FIN7_Strings_Aug18_1
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L13-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "89d2f8f28a7ab0e78c53d8c41b45efa60cfa9ff72306c49197f52342d9a3c546"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L13-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_89d2f8f28a7ab0e78c53d8c41b45efa60cfa9ff72306c49197f52342d9a3c546"
 		score = 75
 		quality = 85
 		tags = ""
@@ -296891,8 +294741,6 @@ rule SIGNATURE_BASE_APT_FIN7_Strings_Aug18_1
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_2 : FILE
 {
 	meta:
@@ -296902,9 +294750,9 @@ rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_2 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L32-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a46492383db5af8f60984b42c53a792632f836f1668fca2d564e0f1f1ed313f2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L32-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a46492383db5af8f60984b42c53a792632f836f1668fca2d564e0f1f1ed313f2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296919,10 +294767,8 @@ rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_2 : FILE
 		$x5 = "80, 80, 68, 65, 84, 65, 37, 34, 41, 44, 115, 104, 101, 108, 108" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0xcfd0 and filesize < 2000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_Maldoc_Aug18_1 : FILE
 {
 	meta:
@@ -296932,9 +294778,9 @@ rule SIGNATURE_BASE_APT_FIN7_Maldoc_Aug18_1 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L51-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f3ecf77a5f909361f4a6af5ca0f25ec85721570587500a8ce2ef203158472e47"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L51-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f3ecf77a5f909361f4a6af5ca0f25ec85721570587500a8ce2ef203158472e47"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296945,10 +294791,8 @@ rule SIGNATURE_BASE_APT_FIN7_Maldoc_Aug18_1 : FILE
 		$s1 = "<photoshop:LayerText>If this document was downloaded from your email, please click  \"Enable editing\" from the yellow bar above" ascii
 
 	condition:
-		filesize <800KB and 1 of them
+		filesize < 800KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_1 : FILE
 {
 	meta:
@@ -296958,9 +294802,9 @@ rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_1 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L66-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5ff078f8cb93a841b68521cfbc120b18952c7ff5b56ab2f3b0eebf63a10aa572"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L66-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5ff078f8cb93a841b68521cfbc120b18952c7ff5b56ab2f3b0eebf63a10aa572"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -296984,10 +294828,8 @@ rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_1 : FILE
 		$x10 = "006e00640079005c004400650073006b0074006f0070005c0075006e006c006f0063006b002e0064006f0063002e006c006e006b" ascii
 
 	condition:
-		uint16(0)==0x5c7b and filesize <3000KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5c7b and filesize < 3000KB and ( 1 of ( $x* ) or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_1 : FILE
 {
 	meta:
@@ -296997,9 +294839,9 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_1 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L95-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7144d4c7651e3fb288ef608fdff07af6cb223c90c34fb780d65184760386d5c7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L95-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7144d4c7651e3fb288ef608fdff07af6cb223c90c34fb780d65184760386d5c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297010,10 +294852,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_1 : FILE
 		$s1 = "Manche Enterprises Limited0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_2 : FILE
 {
 	meta:
@@ -297023,9 +294863,9 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_2 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L110-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8e62c9488f211635ae30633a0d894b00e0ba2a7e7d4cb628117a166d4f0f9697"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L110-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8e62c9488f211635ae30633a0d894b00e0ba2a7e7d4cb628117a166d4f0f9697"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297037,10 +294877,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_2 : FILE
 		$s2 = "Network Software Ltd0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_3 : FILE
 {
 	meta:
@@ -297050,9 +294888,9 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_3 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L126-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3f757bc4a6d46be85732fe33dd0a323c5774cbc1f0da2b984c5db14c1362745a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L126-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3f757bc4a6d46be85732fe33dd0a323c5774cbc1f0da2b984c5db14c1362745a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297064,10 +294902,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_3 : FILE
 		$s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_4 : FILE
 {
 	meta:
@@ -297077,9 +294913,9 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_4 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L142-L157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cd8a33c4e4f626d744e03f48e093f6a45223c74088b03185833ece8034614ca4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L142-L157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cd8a33c4e4f626d744e03f48e093f6a45223c74088b03185833ece8034614ca4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297092,10 +294928,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_4 : FILE
 		$s3 = "lineGetCallIDs" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_5 : FILE
 {
 	meta:
@@ -297105,9 +294939,9 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_5 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L159-L173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "893e144d86025db750b32ae69964578ec92862face706339a5bafb393e3c7091"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L159-L173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_893e144d86025db750b32ae69964578ec92862face706339a5bafb393e3c7091"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297119,7 +294953,7 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_5 : FILE
 		$s3 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 import "pe"
 
@@ -297132,9 +294966,9 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_6 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L175-L198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "33db8e61b6220d9e16191228573d3d375cce9528241dcf1ad74d641f0959f03b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L175-L198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_33db8e61b6220d9e16191228573d3d375cce9528241dcf1ad74d641f0959f03b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297152,10 +294986,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_6 : FILE
 		$s9 = "LPORT:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (pe.exports("TiniStart") or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and ( pe.exports ( "TiniStart" ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_7 : FILE
 {
 	meta:
@@ -297165,9 +294997,9 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_7 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L200-L214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "212bc13d22d7bc6b0ef10ae034ea09c7ea0d0e66afd212fb55c09cf43344c2ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L200-L214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_212bc13d22d7bc6b0ef10ae034ea09c7ea0d0e66afd212fb55c09cf43344c2ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297179,10 +295011,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_7 : FILE
 		$s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_8 : FILE
 {
 	meta:
@@ -297192,9 +295022,9 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_8 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L216-L229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f15a8dfd3efb094ab73caebe9bffb5735762960445ca421cd49eaa091ecea300"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L216-L229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f15a8dfd3efb094ab73caebe9bffb5735762960445ca421cd49eaa091ecea300"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297205,10 +295035,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_8 : FILE
 		$s1 = "GetL3st3rr" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_10 : FILE
 {
 	meta:
@@ -297218,9 +295046,9 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_10 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L231-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1d6dba0c858eacea5bd67682a588105a2ff09d10bb60d9888ace07609c9b33de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L231-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1d6dba0c858eacea5bd67682a588105a2ff09d10bb60d9888ace07609c9b33de"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297234,10 +295062,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_10 : FILE
                00 20 00 31 00 20 00 2D 00 20 00 31 00 39 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_Sample_EXE_Aug18_1 : FILE
 {
 	meta:
@@ -297247,9 +295073,9 @@ rule SIGNATURE_BASE_APT_FIN7_Sample_EXE_Aug18_1 : FILE
 		date = "2018-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L250-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "780e2cb9a704e0df0383737928c2cfc8aa5de5a8f3c9dc67de866d5ac73b8402"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L250-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_780e2cb9a704e0df0383737928c2cfc8aa5de5a8f3c9dc67de866d5ac73b8402"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297269,10 +295095,8 @@ rule SIGNATURE_BASE_APT_FIN7_Sample_EXE_Aug18_1 : FILE
                00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of ($s*) and $co1 at 0x015D
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of ( $s* ) and $co1 at 0x015D
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_FIN7_Msdoc_Sep21_1 : FILE
 {
 	meta:
@@ -297282,9 +295106,9 @@ rule SIGNATURE_BASE_APT_FIN7_Msdoc_Sep21_1 : FILE
 		date = "2021-09-07"
 		modified = "2023-12-05"
 		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L277-L301"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ffc91cdad91b8ab24840c6ef1a6c39aad081d986c21a88b3f2ea3ec1bcd3b52b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L277-L301"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ffc91cdad91b8ab24840c6ef1a6c39aad081d986c21a88b3f2ea3ec1bcd3b52b"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -297299,10 +295123,8 @@ rule SIGNATURE_BASE_APT_FIN7_Msdoc_Sep21_1 : FILE
 		$s4 = "W10ProOff16" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0xcfd0 and ( 1 of ( $x* ) or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_OBFUSC_JS_Sept21_2 : FILE
 {
 	meta:
@@ -297312,9 +295134,9 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_JS_Sept21_2 : FILE
 		date = "2021-09-07"
 		modified = "2023-12-05"
 		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7.yar#L303-L323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "235ff8fe5c033fd90d77ecf9ce80b59be7bf6ae5a2863a1c9365d8b125a7ff3f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7.yar#L303-L323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_235ff8fe5c033fd90d77ecf9ce80b59be7bf6ae5a2863a1c9365d8b125a7ff3f"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -297328,7 +295150,7 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_JS_Sept21_2 : FILE
 		$s6 = ".deleteFile(WScript.ScriptFullName);" ascii
 
 	condition:
-		filesize <6000KB and (4 of them )
+		filesize < 6000KB and ( 4 of them )
 }
 rule SIGNATURE_BASE_Blackenergy_BE_2 : FILE
 {
@@ -297339,10 +295161,10 @@ rule SIGNATURE_BASE_Blackenergy_BE_2 : FILE
 		date = "2015-02-19"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/DThzLz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_blackenergy.yar#L8-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_blackenergy.yar#L8-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
-		logic_hash = "77ecab353063bf8be5ec70294f8497234af8ddd944e0b207d8d633f59f76dbb6"
+		logic_hash = "v1_sha256_77ecab353063bf8be5ec70294f8497234af8ddd944e0b207d8d633f59f76dbb6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297356,7 +295178,7 @@ rule SIGNATURE_BASE_Blackenergy_BE_2 : FILE
 		$s4 = "ReadProcessMemory" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of ( $s* )
 }
 rule SIGNATURE_BASE_Blackenergy_VBS_Agent : FILE
 {
@@ -297367,10 +295189,10 @@ rule SIGNATURE_BASE_Blackenergy_VBS_Agent : FILE
 		date = "2016-01-03"
 		modified = "2023-12-05"
 		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_blackenergy.yar#L34-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_blackenergy.yar#L34-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
-		logic_hash = "2a0037a76f1031117fe41b2e41691511eb626ffc0c738547eda24f771505bc67"
+		logic_hash = "v1_sha256_2a0037a76f1031117fe41b2e41691511eb626ffc0c738547eda24f771505bc67"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297382,7 +295204,7 @@ rule SIGNATURE_BASE_Blackenergy_VBS_Agent : FILE
 		$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii
 
 	condition:
-		filesize <1KB and 2 of them
+		filesize < 1KB and 2 of them
 }
 rule SIGNATURE_BASE_Dropbear_SSH_Server : FILE
 {
@@ -297393,10 +295215,10 @@ rule SIGNATURE_BASE_Dropbear_SSH_Server : FILE
 		date = "2016-01-03"
 		modified = "2023-12-05"
 		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_blackenergy.yar#L51-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_blackenergy.yar#L51-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
-		logic_hash = "6b8acaaa64329d09d3d22d74f4f40288fba3f5faaff63e1ee6b2e6153f14d730"
+		logic_hash = "v1_sha256_6b8acaaa64329d09d3d22d74f4f40288fba3f5faaff63e1ee6b2e6153f14d730"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -297410,7 +295232,7 @@ rule SIGNATURE_BASE_Dropbear_SSH_Server : FILE
 		$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
 }
 rule SIGNATURE_BASE_Blackenergy_Backdoorpass_Dropbear_SSH : FILE
 {
@@ -297421,10 +295243,10 @@ rule SIGNATURE_BASE_Blackenergy_Backdoorpass_Dropbear_SSH : FILE
 		date = "2016-01-03"
 		modified = "2023-12-05"
 		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_blackenergy.yar#L71-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_blackenergy.yar#L71-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
-		logic_hash = "3af58d155691d9323458280ad1b933e8e784acafb0974f5f267b93d9b02e825e"
+		logic_hash = "v1_sha256_3af58d155691d9323458280ad1b933e8e784acafb0974f5f267b93d9b02e825e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297434,7 +295256,7 @@ rule SIGNATURE_BASE_Blackenergy_Backdoorpass_Dropbear_SSH : FILE
 		$s1 = "passDs5Bu9Te7" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $s1
+		uint16( 0 ) == 0x5a4d and $s1
 }
 rule SIGNATURE_BASE_Blackenergy_Killdisk_1 : FILE
 {
@@ -297445,9 +295267,9 @@ rule SIGNATURE_BASE_Blackenergy_Killdisk_1 : FILE
 		date = "2016-01-03"
 		modified = "2023-12-05"
 		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_blackenergy.yar#L88-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa64434422a16166938b9eede9c50b79bae90632f1500e6529dcf26dbebe50f1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_blackenergy.yar#L88-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa64434422a16166938b9eede9c50b79bae90632f1500e6529dcf26dbebe50f1"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -297471,7 +295293,7 @@ rule SIGNATURE_BASE_Blackenergy_Killdisk_1 : FILE
 		$s9 = "shutdown.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 8 of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and 8 of them
 }
 rule SIGNATURE_BASE_Blackenergy_Killdisk_2 : FILE
 {
@@ -297482,9 +295304,9 @@ rule SIGNATURE_BASE_Blackenergy_Killdisk_2 : FILE
 		date = "2016-01-03"
 		modified = "2023-01-06"
 		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_blackenergy.yar#L117-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "38ce9ab347690914f27e7ae89cc6fb2af02ee223e21822eb3b75fde772d3eaff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_blackenergy.yar#L117-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_38ce9ab347690914f27e7ae89cc6fb2af02ee223e21822eb3b75fde772d3eaff"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -297501,7 +295323,7 @@ rule SIGNATURE_BASE_Blackenergy_Killdisk_2 : FILE
 		$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and 3 of them
 }
 rule SIGNATURE_BASE_Blackenergy_Driver_USBMDM : FILE
 {
@@ -297512,9 +295334,9 @@ rule SIGNATURE_BASE_Blackenergy_Driver_USBMDM : FILE
 		date = "2016-01-04"
 		modified = "2023-12-05"
 		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_blackenergy.yar#L140-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "273a00de7af1b7490bff2eae545b358a5483bae0d55a560bef7bd9fa24b0f1d9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_blackenergy.yar#L140-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_273a00de7af1b7490bff2eae545b358a5483bae0d55a560bef7bd9fa24b0f1d9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297535,7 +295357,7 @@ rule SIGNATURE_BASE_Blackenergy_Driver_USBMDM : FILE
 		$s3 = "KdDebuggerEnabled" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 180KB and all of them
 }
 rule SIGNATURE_BASE_Blackenergy_Driver_AMDIDE : FILE
 {
@@ -297546,9 +295368,9 @@ rule SIGNATURE_BASE_Blackenergy_Driver_AMDIDE : FILE
 		date = "2016-01-04"
 		modified = "2023-12-05"
 		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_blackenergy.yar#L165-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb6017327be464bcc2d9efca676c58a9ede45d122460bc167f87e78880c4ace5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_blackenergy.yar#L165-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb6017327be464bcc2d9efca676c58a9ede45d122460bc167f87e78880c4ace5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297569,7 +295391,7 @@ rule SIGNATURE_BASE_Blackenergy_Driver_AMDIDE : FILE
 		$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
 }
 rule SIGNATURE_BASE_MAL_Webmonitor_RAT : FILE
 {
@@ -297580,9 +295402,9 @@ rule SIGNATURE_BASE_MAL_Webmonitor_RAT : FILE
 		date = "2018-04-13"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_webmonitor_rat.yar#L1-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fbf6368527a7bd841b7679d668d6b77ce720fd0f6bcbd5fa9ff6301ae72199ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_webmonitor_rat.yar#L1-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fbf6368527a7bd841b7679d668d6b77ce720fd0f6bcbd5fa9ff6301ae72199ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297607,7 +295429,7 @@ rule SIGNATURE_BASE_MAL_Webmonitor_RAT : FILE
 		$a9 = "Win32 share process" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or (2 of ($s*) and 2 of ($a*)) or 7 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or ( 2 of ( $s* ) and 2 of ( $a* ) ) or 7 of them )
 }
 rule SIGNATURE_BASE_LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 : LOG
 {
@@ -297618,9 +295440,9 @@ rule SIGNATURE_BASE_LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 :
 		date = "2021-03-20"
 		modified = "2023-12-05"
 		reference = "https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_f5_bigip_cve_2021_22986_log.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "748bb429d4a086e2890773558ea502ef06f507aed5f0f70470e2cd97a3fd5007"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_f5_bigip_cve_2021_22986_log.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_748bb429d4a086e2890773558ea502ef06f507aed5f0f70470e2cd97a3fd5007"
 		score = 80
 		quality = 85
 		tags = "LOG"
@@ -297641,9 +295463,9 @@ rule SIGNATURE_BASE_SVG_Loadurl : FILE
 		date = "2015-05-24"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/psjCCc"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cryptowall_svg.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d9e40694e2d0099495289a2074e266bace9b0d9d776391020a1527eaabd2a395"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cryptowall_svg.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d9e40694e2d0099495289a2074e266bace9b0d9d776391020a1527eaabd2a395"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -297659,7 +295481,7 @@ rule SIGNATURE_BASE_SVG_Loadurl : FILE
 		$s3 = "location.href='http" nocase
 
 	condition:
-		all of ($s*) and filesize <600
+		all of ( $s* ) and filesize < 600
 }
 rule SIGNATURE_BASE_ONHAT_Proxy_Hacktool : FILE
 {
@@ -297670,9 +295492,9 @@ rule SIGNATURE_BASE_ONHAT_Proxy_Hacktool : FILE
 		date = "2016-05-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/p32Ozf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_onhat_proxy.yar#L8-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d8c088ecdedbd74ca174244c407c3bb27ccd082ec515c62ee19c93e0d45d3f3b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_onhat_proxy.yar#L8-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d8c088ecdedbd74ca174244c407c3bb27ccd082ec515c62ee19c93e0d45d3f3b"
 		score = 100
 		quality = 85
 		tags = "FILE"
@@ -297692,7 +295514,7 @@ rule SIGNATURE_BASE_ONHAT_Proxy_Hacktool : FILE
 		$s3 = "[ONHAT] CONNECTS (T, %d.%d.%d.%d, %d.%d.%d.%d, %d) ERROR." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and (1 of ($s*))) or (2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and ( 1 of ( $s* ) ) ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_MAL_RANSOM_INC_Aug24 : FILE
 {
@@ -297701,11 +295523,11 @@ rule SIGNATURE_BASE_MAL_RANSOM_INC_Aug24 : FILE
 		author = "X__Junior"
 		id = "b776490b-f26a-55d9-bb26-ec3c617f070c"
 		date = "2024-08-08"
-		modified = "2024-10-11"
+		modified = "2024-12-12"
 		reference = "https://twitter.com/rivitna2/status/1701739812733014313"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_inc_ransomware.yar#L1-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "335b92027c551d074015b830d137cf2fdee81d792cd7360f2499c83cc895fbbb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_inc_ransomware.yar#L1-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_335b92027c551d074015b830d137cf2fdee81d792cd7360f2499c83cc895fbbb"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -297724,7 +295546,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_INC_Aug24 : FILE
 		$op5 = { 56 6A 00 68 01 00 10 00 FF 15 ?? ?? ?? ?? 8B F0 83 FE FF 74 ?? 6A 00 56 FF 15 ?? ?? ?? ?? 68 88 13 00 00 56 FF 15 ?? ?? ?? ?? 56 FF 15}
 
 	condition:
-		uint16(0)==0x5A4D and (3 of ($s*) or 3 of ($op*) or (2 of ($s*) and 2 of ($op*)))
+		uint16( 0 ) == 0x5A4D and ( 3 of ( $s* ) or 3 of ( $op* ) or ( 2 of ( $s* ) and 2 of ( $op* ) ) )
 }
 rule SIGNATURE_BASE_APT6_Malware_Sample_Gen : FILE
 {
@@ -297735,9 +295557,9 @@ rule SIGNATURE_BASE_APT6_Malware_Sample_Gen : FILE
 		date = "2016-04-09"
 		modified = "2023-01-06"
 		reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt6_malware.yar#L8-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "614a6673579630fc254d3c546161647e619df5a03ee6f21434d6cc50be1ed187"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt6_malware.yar#L8-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_614a6673579630fc254d3c546161647e619df5a03ee6f21434d6cc50be1ed187"
 		score = 80
 		quality = 83
 		tags = "FILE"
@@ -297771,7 +295593,7 @@ rule SIGNATURE_BASE_APT6_Malware_Sample_Gen : FILE
 		$c7 = "gloflabs.com" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and ((1 of ($x*) and 3 of ($s*)) or 1 of ($c*))) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 1 of ( $c* ) ) ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_Molerats_Jul17_Sample_1 : FILE
 {
@@ -297782,9 +295604,9 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_1 : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_molerats_jul17.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1b7f00dfb83f5da46663d94f238b55e375743edbdb01701a78922b87c72c518a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_molerats_jul17.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1b7f00dfb83f5da46663d94f238b55e375743edbdb01701a78922b87c72c518a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297795,7 +295617,7 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_1 : FILE
 		$s1 = "ezExODA0Y2U0LTkzMGEtNGIwOS1iZjcwLTlmMWE5NWQwZDcwZH0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{c00" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Molerats_Jul17_Sample_2 : FILE
 {
@@ -297806,9 +295628,9 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_2 : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_molerats_jul17.yar#L27-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "35a517039474dcc5d503a48ca17e544166ee2ed44417ea5e7711093d3956f80c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_molerats_jul17.yar#L27-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_35a517039474dcc5d503a48ca17e544166ee2ed44417ea5e7711093d3956f80c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297821,7 +295643,7 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_2 : FILE
 		$s3 = "RSJLRSJOMSJ" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_Molerats_Jul17_Sample_3 : FILE
 {
@@ -297832,9 +295654,9 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_3 : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_molerats_jul17.yar#L44-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4829905ede523fd9ed2cdf610f8fce4c0a5d993885e1897d1782ca70e96fa9a2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_molerats_jul17.yar#L44-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4829905ede523fd9ed2cdf610f8fce4c0a5d993885e1897d1782ca70e96fa9a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297847,7 +295669,7 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_3 : FILE
 		$s2 = "Folder.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them )
 }
 rule SIGNATURE_BASE_Molerats_Jul17_Sample_4 : FILE
 {
@@ -297858,9 +295680,9 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_4 : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_molerats_jul17.yar#L61-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dec058ae52a860f4850d7b8024b96c5a9044fdcebadbc12b384f5a6dfae91634"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_molerats_jul17.yar#L61-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dec058ae52a860f4850d7b8024b96c5a9044fdcebadbc12b384f5a6dfae91634"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297873,7 +295695,7 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_4 : FILE
 		$x3 = "HKCU\\SOFTWARE\\Microsoft\\\\KeyName\"" fullword wide
 
 	condition:
-		( filesize <700KB and 1 of them )
+		( filesize < 700KB and 1 of them )
 }
 rule SIGNATURE_BASE_Molerats_Jul17_Sample_5 : FILE
 {
@@ -297884,9 +295706,9 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_5 : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_molerats_jul17.yar#L78-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb2bb54fc1749d8422cdc8e084e1fa66981611128f56e7d7d678f177d37b7cdd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_molerats_jul17.yar#L78-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb2bb54fc1749d8422cdc8e084e1fa66981611128f56e7d7d678f177d37b7cdd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297900,7 +295722,7 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_5 : FILE
 		$a2 = "gist.githubusercontent.com" nocase ascii
 
 	condition:
-		filesize <200KB and (1 of ($x*) or 2 of them )
+		filesize < 200KB and ( 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_Molerats_Jul17_Sample_Dropper : FILE
 {
@@ -297911,9 +295733,9 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_Dropper : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_molerats_jul17.yar#L97-L112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b356d8dbca8f4d11dda976e7eb03c993d05af35d13113b8c85fb07531a0203dc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_molerats_jul17.yar#L97-L112"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b356d8dbca8f4d11dda976e7eb03c993d05af35d13113b8c85fb07531a0203dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297926,7 +295748,7 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_Dropper : FILE
 		$s3 = "attachment.hta" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_MAL_ELF_Xlogin_Nov24_1 : FILE
 {
@@ -297935,11 +295757,11 @@ rule SIGNATURE_BASE_MAL_ELF_Xlogin_Nov24_1 : FILE
 		author = "Florian Roth"
 		id = "e8940660-ecf8-5616-9cb1-fc0a02d35689"
 		date = "2024-11-11"
-		modified = "2024-11-14"
+		modified = "2024-12-12"
 		reference = "https://blog.sekoia.io/solving-the-7777-botnet-enigma-a-cybersecurity-quest/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_xlogin_nov24.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "42fe8a32022592ff976d6d2839d949e28f60c8958f64a20c1c3c9091fb64d31e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_xlogin_nov24.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_42fe8a32022592ff976d6d2839d949e28f60c8958f64a20c1c3c9091fb64d31e"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -297954,10 +295776,8 @@ rule SIGNATURE_BASE_MAL_ELF_Xlogin_Nov24_1 : FILE
 		$sc1 = { 28 6E 69 6C 29 00 00 00 28 6E 75 6C 6C 29 }
 
 	condition:
-		uint16(0)==0x457f and filesize <500KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x457f and filesize < 500KB and ( 1 of ( $x* ) or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Apt_Sofacy_Xtunnel : FILE
 {
 	meta:
@@ -297967,9 +295787,9 @@ rule SIGNATURE_BASE_Apt_Sofacy_Xtunnel : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_xtunnel_bundestag.yar#L3-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2478d9d8996bf4a142e39eac0e2d6af718d364be080a89530812615595777efd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_xtunnel_bundestag.yar#L3-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2478d9d8996bf4a142e39eac0e2d6af718d364be080a89530812615595777efd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -297992,7 +295812,7 @@ rule SIGNATURE_BASE_Apt_Sofacy_Xtunnel : FILE
 		$mix10 = "Xtunnel.exe"
 
 	condition:
-		(( uint16(0)==0x5A4D) or ( uint16(0)==0xCFD0)) and (($xaps) or ( all of ($variant1*)) or ( all of ($variant2*)) or (6 of ($mix*)))
+		(( uint16( 0 ) == 0x5A4D ) or ( uint16( 0 ) == 0xCFD0 ) ) and ( ( $xaps ) or ( all of ( $variant1* ) ) or ( all of ( $variant2* ) ) or ( 6 of ( $mix* ) ) )
 }
 import "pe"
 
@@ -298005,9 +295825,9 @@ rule SIGNATURE_BASE_Winexe_Remoteexec : FILE
 		date = "2015-06-19"
 		modified = "2021-02-11"
 		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_xtunnel_bundestag.yar#L26-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9e944f07b43b934346c0e88685014c05ff81561ac2f7c3374b55b9c4523b98c1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_xtunnel_bundestag.yar#L26-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9e944f07b43b934346c0e88685014c05ff81561ac2f7c3374b55b9c4523b98c1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -298022,10 +295842,8 @@ rule SIGNATURE_BASE_Winexe_Remoteexec : FILE
 		$s5 = "implevel" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <115KB and (3 of them or pe.imphash()=="2f8a475933ac82b8e09eaf26b396b54d")
+		uint16( 0 ) == 0x5a4d and filesize < 115KB and ( 3 of them or pe.imphash ( ) == "2f8a475933ac82b8e09eaf26b396b54d" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sofacy_Mal2 : FILE
 {
 	meta:
@@ -298035,10 +295853,10 @@ rule SIGNATURE_BASE_Sofacy_Mal2 : FILE
 		date = "2015-06-19"
 		modified = "2023-12-05"
 		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_xtunnel_bundestag.yar#L50-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_xtunnel_bundestag.yar#L50-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
-		logic_hash = "c325ed815b7de3338363d064f4097edf0596644d4ef8d642fda3664a2a16c2eb"
+		logic_hash = "v1_sha256_c325ed815b7de3338363d064f4097edf0596644d4ef8d642fda3664a2a16c2eb"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -298050,10 +295868,8 @@ rule SIGNATURE_BASE_Sofacy_Mal2 : FILE
 		$s1 = "i`m wait" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*)) and $s1
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) ) and $s1
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sofacy_Mal3 : FILE
 {
 	meta:
@@ -298063,10 +295879,10 @@ rule SIGNATURE_BASE_Sofacy_Mal3 : FILE
 		date = "2015-06-19"
 		modified = "2023-01-06"
 		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_xtunnel_bundestag.yar#L69-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_xtunnel_bundestag.yar#L69-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
-		logic_hash = "80c433cf5b3d042e46b5441a1b027c5ecf571f30571064904a33e92677633e66"
+		logic_hash = "v1_sha256_80c433cf5b3d042e46b5441a1b027c5ecf571f30571064904a33e92677633e66"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -298087,10 +295903,8 @@ rule SIGNATURE_BASE_Sofacy_Mal3 : FILE
 		$x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (2 of ($s*) or (1 of ($s*) and all of ($x*)))
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 2 of ( $s* ) or ( 1 of ( $s* ) and all of ( $x* ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sofacy_Bundestag_Batch : FILE
 {
 	meta:
@@ -298100,9 +295914,9 @@ rule SIGNATURE_BASE_Sofacy_Bundestag_Batch : FILE
 		date = "2015-06-19"
 		modified = "2023-12-05"
 		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_xtunnel_bundestag.yar#L101-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "05d6df161042a65f9eeec4be4046001a03fa61747a9ea123f13e6e75d6664ac7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_xtunnel_bundestag.yar#L101-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_05d6df161042a65f9eeec4be4046001a03fa61747a9ea123f13e6e75d6664ac7"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -298114,7 +295928,7 @@ rule SIGNATURE_BASE_Sofacy_Bundestag_Batch : FILE
 		$s3 = "forfiles"
 
 	condition:
-		filesize <10KB and 2 of them
+		filesize < 10KB and 2 of them
 }
 import "pe"
 
@@ -298127,9 +295941,9 @@ rule SIGNATURE_BASE_Rehashed_RAT_1 : FILE
 		date = "2017-09-08"
 		modified = "2023-12-05"
 		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rehashed_rat.yar#L13-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "06a98e87d931bdea697a2cf3de604f03654f9aa2b3f2346e78ba92e492c0fc7c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rehashed_rat.yar#L13-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_06a98e87d931bdea697a2cf3de604f03654f9aa2b3f2346e78ba92e492c0fc7c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298147,7 +295961,7 @@ rule SIGNATURE_BASE_Rehashed_RAT_1 : FILE
 		$s6 = "root\\%s" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and (pe.imphash()=="893212784d01f11aed9ebb42ad2561fc" or pe.exports("ProcessTrans") or (1 of ($x*) or 4 of them ))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 800KB and ( pe.imphash ( ) == "893212784d01f11aed9ebb42ad2561fc" or pe.exports ( "ProcessTrans" ) or ( 1 of ( $x* ) or 4 of them ) ) ) or ( all of them )
 }
 import "pe"
 
@@ -298160,9 +295974,9 @@ rule SIGNATURE_BASE_Rehashed_RAT_2 : FILE
 		date = "2017-09-08"
 		modified = "2023-12-05"
 		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rehashed_rat.yar#L41-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "96c4582981792eb5f8180c06a5fe824fd439cfa0ede294eccff3afa7d318a6e9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rehashed_rat.yar#L41-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_96c4582981792eb5f8180c06a5fe824fd439cfa0ede294eccff3afa7d318a6e9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298179,10 +295993,8 @@ rule SIGNATURE_BASE_Rehashed_RAT_2 : FILE
 		$s3 = "{521338B8-3378-58F7-AFB9-E7D35E683BF8}" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="9c4c648f4a758cbbfe28c8850d82f931" or (1 of ($x*) or 3 of them ))) or (4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "9c4c648f4a758cbbfe28c8850d82f931" or ( 1 of ( $x* ) or 3 of them ) ) ) or ( 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Rehashed_RAT_3 : FILE
 {
 	meta:
@@ -298192,9 +296004,9 @@ rule SIGNATURE_BASE_Rehashed_RAT_3 : FILE
 		date = "2017-09-08"
 		modified = "2022-12-21"
 		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rehashed_rat.yar#L69-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "46f21f11959f863c85a1cfac74a28ba86d5b9789fea5a428168d157c13cce022"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rehashed_rat.yar#L69-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_46f21f11959f863c85a1cfac74a28ba86d5b9789fea5a428168d157c13cce022"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298207,11 +296019,8 @@ rule SIGNATURE_BASE_Rehashed_RAT_3 : FILE
 		$s3 = "pbad exception" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 2 of them )
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_1 : FILE
 {
 	meta:
@@ -298221,9 +296030,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_1 : FILE
 		date = "2021-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L56-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ad8a7bb5a1d2065e3a573842fb37ee3c63b7695c18840f0c26d32e6ae3d99c6c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L56-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ad8a7bb5a1d2065e3a573842fb37ee3c63b7695c18840f0c26d32e6ae3d99c6c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298232,11 +296041,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_1 : FILE
 		$x1 = "[i].charCodeAt(0) ^ 2);}"
 
 	condition:
-		filesize <5000KB and 1 of them
+		filesize < 5000KB and 1 of them
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_2 : FILE
 {
 	meta:
@@ -298246,9 +296052,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_2 : FILE
 		date = "2021-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L69-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f5c50b340d628559799897a2ba79add7d126e3ecb2daeb365bc15d64796ccd2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L69-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f5c50b340d628559799897a2ba79add7d126e3ecb2daeb365bc15d64796ccd2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298260,11 +296066,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_2 : FILE
 		$s4 = ".indexOf(\"Win\")!=-1" ascii
 
 	condition:
-		filesize <5000KB and all of them
+		filesize < 5000KB and all of them
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_NV_Link_May21_2 : FILE
 {
 	meta:
@@ -298274,9 +296077,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_NV_Link_May21_2 : FILE
 		date = "2021-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L85-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5eee9df368da3fc98c00a0f8c65a7f3bd5b812342082be58054b272b5bb03455"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L85-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5eee9df368da3fc98c00a0f8c65a7f3bd5b812342082be58054b272b5bb03455"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298286,11 +296089,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_NV_Link_May21_2 : FILE
 		$s2 = "cmd.exe /c start BOOM.exe" ascii wide
 
 	condition:
-		filesize <5000KB and 1 of them
+		filesize < 5000KB and 1 of them
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_Samples_May21_1 : FILE
 {
 	meta:
@@ -298300,9 +296100,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_Samples_May21_1 : FILE
 		date = "2021-05-27"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L99-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "32d76bb1af76f0fc2afb76d9726bc8ec99c4be34c9d46cebab7356d8c68af11c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L99-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_32d76bb1af76f0fc2afb76d9726bc8ec99c4be34c9d46cebab7356d8c68af11c"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -298321,11 +296121,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_Samples_May21_1 : FILE
 		$se1 = "data/mstu.dll,MicrosoftUpdateService" wide
 
 	condition:
-		uint16(0)==0x004c and filesize <4KB and $a1 and ( all of ($sa*) or all of ($sb*) or all of ($sc*) or all of ($sd*) or all of ($se*))
+		uint16( 0 ) == 0x004c and filesize < 4KB and $a1 and ( all of ( $sa* ) or all of ( $sb* ) or all of ( $sc* ) or all of ( $sd* ) or all of ( $se* ) )
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_1
 {
 	meta:
@@ -298335,9 +296132,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_1
 		date = "2021-05-27"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L130-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "02e4a1c88c5d5567c2c4098f60107d66ace9deaf03c480f15615f7f85a7c620c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L130-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_02e4a1c88c5d5567c2c4098f60107d66ace9deaf03c480f15615f7f85a7c620c"
 		score = 85
 		quality = 85
 		tags = ""
@@ -298350,7 +296147,6 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_1
 		1 of them
 }
 import "math"
-import "pe"
 
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_PDF_Masq_May21_1 : FILE
 {
@@ -298361,9 +296157,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_PDF_Masq_May21_1 : FILE
 		date = "2021-05-27"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L145-L164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8f1514648b2b797adfe3f8f5acb577c26707dfe1da942c9634be3d88a180a407"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L145-L164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8f1514648b2b797adfe3f8f5acb577c26707dfe1da942c9634be3d88a180a407"
 		score = 70
 		quality = 35
 		tags = "FILE"
@@ -298376,11 +296172,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_PDF_Masq_May21_1 : FILE
 		$fp3 = { 20 6F 62 6A 0A }
 
 	condition:
-		$ah1 at 0 and $af1 at ( filesize -7) and filesize <100KB and not 1 of ($fp*) and math.entropy(16, filesize )>7
+		$ah1 at 0 and $af1 at ( filesize - 7 ) and filesize < 100KB and not 1 of ( $fp* ) and math.entropy ( 16 , filesize ) > 7
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Nativezone_Loader_May21_1 : FILE
 {
 	meta:
@@ -298390,9 +296183,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Nativezone_Loader_May21_1 : FILE
 		date = "2021-05-27"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L166-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a02fd6fcd7423781bbd2e4458bd61d28e16a5b1a73b1682e63db5c86d53c7da4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L166-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a02fd6fcd7423781bbd2e4458bd61d28e16a5b1a73b1682e63db5c86d53c7da4"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -298407,11 +296200,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Nativezone_Loader_May21_1 : FILE
 		$op3 = { e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 3 of them or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 3 of them or 4 of them
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_2 : FILE
 {
 	meta:
@@ -298421,9 +296211,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_2 : FILE
 		date = "2021-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L188-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2a3829e704af2464639d07e8e7952669281e20cf2a7ac487d5d1eee021d08b35"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L188-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2a3829e704af2464639d07e8e7952669281e20cf2a7ac487d5d1eee021d08b35"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298444,11 +296234,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_2 : FILE
 		$op3 = { 4d 05 20 00 12 80 91 04 20 01 08 0e 04 20 00 12 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and 3 of them or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and 3 of them or 4 of them
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_2 : FILE
 {
 	meta:
@@ -298458,9 +296245,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_2 : FILE
 		date = "2021-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L218-L234"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "18a52f5fd71455b8564d4b485c233dd358a304bfddc5e6fb604b8e5a2a1949a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L218-L234"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_18a52f5fd71455b8564d4b485c233dd358a304bfddc5e6fb604b8e5a2a1949a3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298473,11 +296260,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_2 : FILE
 		$op3 = { 45 0f b6 43 ff 41 8b c2 99 44 88 03 41 0f b6 2b 83 e2 03 03 c2 40 88 6b 01 }
 
 	condition:
-		filesize <2200KB and all of them
+		filesize < 2200KB and all of them
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Stageless_Loader_May21_2 : FILE
 {
 	meta:
@@ -298487,9 +296271,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Stageless_Loader_May21_2 : FILE
 		date = "2021-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L236-L258"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "850f6a1ad342fd5e4bb29c7bf90a032ddd8ac9d2eac5ffcbedf43e4d04b178f5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L236-L258"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_850f6a1ad342fd5e4bb29c7bf90a032ddd8ac9d2eac5ffcbedf43e4d04b178f5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298505,11 +296289,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Stageless_Loader_May21_2 : FILE
 		$op2 = { ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 e8 d4 00 10 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 2 of them or 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and 2 of them or 3 of them
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_3 : FILE
 {
 	meta:
@@ -298519,9 +296300,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_3 : FILE
 		date = "2021-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L260-L282"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "472acd1d6daf3480de59ecd3fa038d644e339dcc979cf7e56617eadc6cb32dc5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L260-L282"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_472acd1d6daf3480de59ecd3fa038d644e339dcc979cf7e56617eadc6cb32dc5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298538,11 +296319,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_3 : FILE
                72 00 65 00 72 00 2E 00 65 00 78 00 65 }
 
 	condition:
-		filesize <3000KB and ($xc1 or 3 of them )
+		filesize < 3000KB and ( $xc1 or 3 of them )
 }
-import "math"
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_4 : FILE
 {
 	meta:
@@ -298552,9 +296330,9 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_4 : FILE
 		date = "2021-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_may21.yar#L284-L305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d5858cc6dab094d5dceab75a2002d9145537008241a08ac7bd399c9d6e6c270"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_may21.yar#L284-L305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d5858cc6dab094d5dceab75a2002d9145537008241a08ac7bd399c9d6e6c270"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298569,7 +296347,7 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_4 : FILE
                53 75 63 63 65 73 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and ($xc1 or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( $xc1 or 3 of them )
 }
 rule SIGNATURE_BASE_CACTUSTORCH : FILE
 {
@@ -298580,9 +296358,9 @@ rule SIGNATURE_BASE_CACTUSTORCH : FILE
 		date = "2017-07-31"
 		modified = "2023-12-05"
 		reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_gen_cactustorch.yar#L11-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "265287b27aa13840366dbb51ea58b2fdd10e0a57ff27d8deb52ff77dd71c26ad"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_gen_cactustorch.yar#L11-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_265287b27aa13840366dbb51ea58b2fdd10e0a57ff27d8deb52ff77dd71c26ad"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298607,7 +296385,7 @@ rule SIGNATURE_BASE_CACTUSTORCH : FILE
 		$s5 = "var serialized_obj = \"" ascii
 
 	condition:
-		( filesize <800KB and (1 of ($x*) or (1 of ($a*) and 1 of ($s*)))) or (3 of them )
+		( filesize < 800KB and ( 1 of ( $x* ) or ( 1 of ( $a* ) and 1 of ( $s* ) ) ) ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_Woolengoldfish_Sample_1
 {
@@ -298618,10 +296396,10 @@ rule SIGNATURE_BASE_Woolengoldfish_Sample_1
 		date = "2015-03-25"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/NpJpVZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_woolengoldfish.yar#L13-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_woolengoldfish.yar#L13-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
-		logic_hash = "9490715a2fc7d3c742771a8211bcfb4c0a0bafba4d5de8eee5825fdabaded6af"
+		logic_hash = "v1_sha256_9490715a2fc7d3c742771a8211bcfb4c0a0bafba4d5de8eee5825fdabaded6af"
 		score = 60
 		quality = 85
 		tags = ""
@@ -298643,9 +296421,9 @@ rule SIGNATURE_BASE_Woolengoldfish_Generic_1
 		date = "2015-03-25"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/NpJpVZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_woolengoldfish.yar#L30-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "79879be4f49c8830573eb4a9f958ef9060413ea8b5dd3f8f3d5816e146d3a0b7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_woolengoldfish.yar#L30-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_79879be4f49c8830573eb4a9f958ef9060413ea8b5dd3f8f3d5816e146d3a0b7"
 		score = 90
 		quality = 85
 		tags = ""
@@ -298670,7 +296448,7 @@ rule SIGNATURE_BASE_Woolengoldfish_Generic_1
 		$s9 = "[Control]" fullword
 
 	condition:
-		(1 of ($x*) and 2 of ($s*)) or (6 of ($s*))
+		(1 of ( $x* ) and 2 of ( $s* ) ) or ( 6 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Woolengoldfish_Generic_2
 {
@@ -298681,9 +296459,9 @@ rule SIGNATURE_BASE_Woolengoldfish_Generic_2
 		date = "2015-03-25"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/NpJpVZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_woolengoldfish.yar#L62-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "25d2ea25543b0a6330e443333f1ac7a59874631c8ee7faeb4ea6d94c62c255fc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_woolengoldfish.yar#L62-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_25d2ea25543b0a6330e443333f1ac7a59874631c8ee7faeb4ea6d94c62c255fc"
 		score = 90
 		quality = 85
 		tags = ""
@@ -298708,9 +296486,9 @@ rule SIGNATURE_BASE_Woolengoldfish_Generic_3
 		date = "2015-03-25"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/NpJpVZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_woolengoldfish.yar#L81-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ac51c25ad6ef6668238fef1de50517d48e6509f57cd6dd723595777ae16d8a6c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_woolengoldfish.yar#L81-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ac51c25ad6ef6668238fef1de50517d48e6509f57cd6dd723595777ae16d8a6c"
 		score = 90
 		quality = 83
 		tags = ""
@@ -298735,11 +296513,8 @@ rule SIGNATURE_BASE_Woolengoldfish_Generic_3
 		$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
 
 	condition:
-		(1 of ($x*)) or (8 of ($s*))
+		(1 of ( $x* ) ) or ( 8 of ( $s* ) )
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Gifcloaked_Webshell_A : FILE
 {
 	meta:
@@ -298749,10 +296524,10 @@ rule SIGNATURE_BASE_Gifcloaked_Webshell_A : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/yara_mixed_ext_vars.yar#L180-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/yara_mixed_ext_vars.yar#L180-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
-		logic_hash = "0c4570373d50c40745cd0523dcf8c34ee3cae1c298982b3a39d4a33e054aa779"
+		logic_hash = "v1_sha256_0c4570373d50c40745cd0523dcf8c34ee3cae1c298982b3a39d4a33e054aa779"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -298769,7 +296544,7 @@ rule SIGNATURE_BASE_Gifcloaked_Webshell_A : FILE
 		$fp1 = "<form name=\"social_form\""
 
 	condition:
-		uint32(0)==0x38464947 and (1 of ($s*)) and not 1 of ($fp*)
+		uint32( 0 ) == 0x38464947 and ( 1 of ( $s* ) ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_APT_CN_Twistedpanda_Loader : FILE
 {
@@ -298780,9 +296555,9 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_Loader : FILE
 		date = "2022-04-14"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_twisted_panda.yar#L1-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b6b3892432be4bd8dfd44f08c124865c54d5ad2dc90b630072f19f7144d33555"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_twisted_panda.yar#L1-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b6b3892432be4bd8dfd44f08c124865c54d5ad2dc90b630072f19f7144d33555"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -298796,7 +296571,7 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_Loader : FILE
 		$decryption = { 8B C? [2-3] F6 D? 1A C? [2-3] [2-3] 30 0? ?? 4? }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and all of ($seq*) and $decryption
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and all of ( $seq* ) and $decryption
 }
 rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_1 : FILE
 {
@@ -298807,9 +296582,9 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_1 : FILE
 		date = "2022-04-14"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_twisted_panda.yar#L46-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e7abe4b3f4225596131882a9175f9ac2e45ba00557950772a8e4d1eaeab97d05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_twisted_panda.yar#L46-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e7abe4b3f4225596131882a9175f9ac2e45ba00557950772a8e4d1eaeab97d05"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -298823,7 +296598,7 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_1 : FILE
 		$decryption = { 8D 83 [4] 80 B3 [5] 89 F1 6A 01 50 E8 [4] 80 B3 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and #config_init>10 and 2 of ($c2_cmd_*) and $decryption
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and #config_init > 10 and 2 of ( $c2_cmd_* ) and $decryption
 }
 rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_2 : FILE
 {
@@ -298834,9 +296609,9 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_2 : FILE
 		date = "2022-04-14"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_twisted_panda.yar#L82-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d1e34903e58fb76671a076acbb9f26e10d511c8f00be90b4901d61b73b90a9a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_twisted_panda.yar#L82-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d1e34903e58fb76671a076acbb9f26e10d511c8f00be90b4901d61b73b90a9a7"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -298852,7 +296627,7 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_2 : FILE
 		$decryption = { 80 B3 [5] 8D BB [4] 8B 56 14 8B C2 8B 4E 10 2B C1 83 F8 01 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and #config_init>10 and 2 of ($c2_cmd_*) and $decryption
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and #config_init > 10 and 2 of ( $c2_cmd_* ) and $decryption
 }
 rule SIGNATURE_BASE_APT_CN_Twistedpanda_64Bit_Loader : FILE
 {
@@ -298863,9 +296638,9 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_64Bit_Loader : FILE
 		date = "2022-04-14"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_twisted_panda.yar#L120-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "644547f9fa6ca3f34ea32e06896f341e0c92f5c57dee3c478aed0cdf87b2f3de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_twisted_panda.yar#L120-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_644547f9fa6ca3f34ea32e06896f341e0c92f5c57dee3c478aed0cdf87b2f3de"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -298877,7 +296652,7 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_64Bit_Loader : FILE
 		$shellcode_allocate = { BA F0 16 00 00 44 8D 4E 40 33 C9 41 B8 00 30 00 00 FF }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and $path_check and $shellcode_allocate and $shellcode_read
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and $path_check and $shellcode_allocate and $shellcode_read
 }
 rule SIGNATURE_BASE_APT_CN_Twistedpanda_Droppers : FILE
 {
@@ -298888,9 +296663,9 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_Droppers : FILE
 		date = "2022-04-14"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_twisted_panda.yar#L157-L194"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "820b4796511dcf98cdc8017a39cc2c65e44d8d9a20f55803aa1ddd36f649c83a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_twisted_panda.yar#L157-L194"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_820b4796511dcf98cdc8017a39cc2c65e44d8d9a20f55803aa1ddd36f649c83a"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -298907,7 +296682,7 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_Droppers : FILE
 		$stack_strings_4 = { 63 00 25 00 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and #switch_control>8 and all of ($stack_strings_*) and $byte_manipulation
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and #switch_control > 8 and all of ( $stack_strings_* ) and $byte_manipulation
 }
 rule SIGNATURE_BASE_MAL_Qbot_HTML_Smuggling_Indicators_Oct22_1 : FILE
 {
@@ -298918,9 +296693,9 @@ rule SIGNATURE_BASE_MAL_Qbot_HTML_Smuggling_Indicators_Oct22_1 : FILE
 		date = "2022-10-07"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ankit_anubhav/status/1578257383133876225?s=20&t=Bu3CCJCzImpTGOQX_KGsdA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_qbot_payloads.yar#L2-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a5bd9eb72205f1398ec0b8773751309699b3267e0272dacf2728f8495c0c0ec2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_qbot_payloads.yar#L2-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a5bd9eb72205f1398ec0b8773751309699b3267e0272dacf2728f8495c0c0ec2"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -298959,7 +296734,7 @@ rule SIGNATURE_BASE_MAL_Qbot_HTML_Smuggling_Indicators_Oct22_1 : FILE
 		$eml = "Content-Transfer-Encoding:" ascii
 
 	condition:
-		filesize <10MB and ((1 of ($sd*) and $htm and not $eml) or (1 of ($st*) and $eml))
+		filesize < 10MB and ( ( 1 of ( $sd* ) and $htm and not $eml ) or ( 1 of ( $st* ) and $eml ) )
 }
 rule SIGNATURE_BASE_SUSP_Themebleed_Theme_Sep23 : FILE
 {
@@ -298970,9 +296745,9 @@ rule SIGNATURE_BASE_SUSP_Themebleed_Theme_Sep23 : FILE
 		date = "2023-09-13"
 		modified = "2023-12-05"
 		reference = "https://github.com/gabe-k/themebleed"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2023_38146.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "577003741f07aeffafd2b0b22913de44ea4f5ed264f4104ee013104355f65311"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2023_38146.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_577003741f07aeffafd2b0b22913de44ea4f5ed264f4104ee013104355f65311"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -298983,10 +296758,8 @@ rule SIGNATURE_BASE_SUSP_Themebleed_Theme_Sep23 : FILE
 		$s3 = "[Theme]"
 
 	condition:
-		filesize <1MB and all of them
+		filesize < 1MB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen1 : FILE
 {
 	meta:
@@ -298996,9 +296769,9 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen1 : FILE
 		date = "2016-10-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L12-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "17dbf53ba6e27b230e3357963162a1805c6460cdadce8bba68953a97f699e1b7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L12-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_17dbf53ba6e27b230e3357963162a1805c6460cdadce8bba68953a97f699e1b7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299042,10 +296815,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen1 : FILE
 		$b6 = "d2hvYW1pICYgaG9zdG5hb" ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <700KB and 1 of them )
+		( uint16( 0 ) == 0xcfd0 and filesize < 700KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal1 : FILE
 {
 	meta:
@@ -299055,9 +296826,9 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal1 : FILE
 		date = "2016-10-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L69-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b5fc4329bb639765890c49907860883b96d278381b83307c906f624e6645dedd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L69-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b5fc4329bb639765890c49907860883b96d278381b83307c906f624e6645dedd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299072,10 +296843,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal1 : FILE
 		$s1 = "http://winodwsupdates.me" ascii
 
 	condition:
-		( uint16(0)==0x4f48 and filesize <4KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x4f48 and filesize < 4KB and 1 of them ) or ( 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen2 : FILE
 {
 	meta:
@@ -299085,9 +296854,9 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen2 : FILE
 		date = "2016-10-12"
 		modified = "2023-01-07"
 		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L88-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "861ae1696aaa89c81d04214e67d77d98ae85bd7f64ae2979fbe932dc696fd32c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L88-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_861ae1696aaa89c81d04214e67d77d98ae85bd7f64ae2979fbe932dc696fd32c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299106,10 +296875,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen2 : FILE
 		$s9 = "http://www.israirairlines.com/?mode=page&page=14635&lang=eng<" fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <4000KB and 2 of ($s*)) or (4 of them )
+		( uint16( 0 ) == 0xcfd0 and filesize < 4000KB and 2 of ( $s* ) ) or ( 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen3 : FILE
 {
 	meta:
@@ -299119,9 +296886,9 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen3 : FILE
 		date = "2016-10-12"
 		modified = "2023-01-07"
 		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L112-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ccc110b04ea3ee9a19ff23babbc759b4ec6114f8b5eb4f42bc5f70f8abde8a53"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L112-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ccc110b04ea3ee9a19ff23babbc759b4ec6114f8b5eb4f42bc5f70f8abde8a53"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299135,10 +296902,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen3 : FILE
 		$x3 = "\\Libraries\\fireeye.vbs&" wide
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0xcfd0 and filesize < 100KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal2 : FILE
 {
 	meta:
@@ -299148,9 +296913,9 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal2 : FILE
 		date = "2016-10-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L131-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b1de7dc3c205c78825f52ea30608b10bafa2c486db53693aa90aa07138fb1a87"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L131-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b1de7dc3c205c78825f52ea30608b10bafa2c486db53693aa90aa07138fb1a87"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299166,10 +296931,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal2 : FILE
 		$x6 = "2dy53My5vcmcvMjAw" fullword wide
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0xcfd0 and filesize < 200KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Campaign_Reconnaissance : FILE
 {
 	meta:
@@ -299179,9 +296942,9 @@ rule SIGNATURE_BASE_Oilrig_Campaign_Reconnaissance : FILE
 		date = "2016-10-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L151-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "04c9f482c0c4abc1bf316459dc3085154defadb0fd5fe74ff274d8b3ee807b7f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L151-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_04c9f482c0c4abc1bf316459dc3085154defadb0fd5fe74ff274d8b3ee807b7f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299194,10 +296957,8 @@ rule SIGNATURE_BASE_Oilrig_Campaign_Reconnaissance : FILE
 		$s3 = "net group \"domain admins\" /domain 2>&1 & " ascii
 
 	condition:
-		( filesize <1KB and 1 of them )
+		( filesize < 1KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal3 : FILE
 {
 	meta:
@@ -299207,9 +296968,9 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal3 : FILE
 		date = "2016-10-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L168-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "62a6f6c4e574a3c577f0b1fdd85eaa3e775a7ae0e457c59a6b6f741ad895e510"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L168-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_62a6f6c4e574a3c577f0b1fdd85eaa3e775a7ae0e457c59a6b6f741ad895e510"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299222,7 +296983,7 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal3 : FILE
 		$x3 = "('00000000'+(convertTo-Base36(Get-Random -Maximum 46655)))" fullword ascii
 
 	condition:
-		( filesize <10KB and 1 of them )
+		( filesize < 10KB and 1 of them )
 }
 import "pe"
 
@@ -299235,9 +296996,9 @@ rule SIGNATURE_BASE_Oilrig_Malware_Nov17_13 : FILE
 		date = "2017-11-22"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ClearskySec/status/933280188733018113"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L185-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eab15229f084681b27cec7ed959ef4cd1193a0b38aaed4341dcd6761e2505804"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L185-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eab15229f084681b27cec7ed959ef4cd1193a0b38aaed4341dcd6761e2505804"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299251,10 +297012,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Nov17_13 : FILE
 		$a2 = "cmd.exe /c " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="0160250adfc97f9d4a12dd067323ec61" or 1 of ($x*) or all of ($a*))
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "0160250adfc97f9d4a12dd067323ec61" or 1 of ( $x* ) or all of ( $a* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager_Macro : FILE
 {
 	meta:
@@ -299264,9 +297023,9 @@ rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager_Macro : FILE
 		date = "2018-01-19"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L208-L233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "35e540b87bb7425b601fad76f0ff33c60a4d91579fc50f5902d708d06fa755f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L208-L233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_35e540b87bb7425b601fad76f0ff33c60a4d91579fc50f5902d708d06fa755f6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299288,10 +297047,8 @@ rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager_Macro : FILE
 		$two7 = "NullRefrencedException" ascii wide
 
 	condition:
-		filesize <300KB and 1 of ($one*) or 2 of ($two*)
+		filesize < 300KB and 1 of ( $one* ) or 2 of ( $two* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager : FILE
 {
 	meta:
@@ -299301,9 +297058,9 @@ rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager : FILE
 		date = "2018-01-19"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L235-L255"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "97debd5e74730e22133f29c89a0cf049862459c24d1b46634a973908040db3a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L235-L255"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_97debd5e74730e22133f29c89a0cf049862459c24d1b46634a973908040db3a7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299321,10 +297078,8 @@ rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager : FILE
 		$one10 = "\\tmpCa.vbs" ascii wide
 
 	condition:
-		filesize <300KB and any of them
+		filesize < 300KB and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_1
 {
 	meta:
@@ -299334,9 +297089,9 @@ rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_1
 		date = "2019-04-17"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L267-L283"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "afe203fdfcc9dcafb170bee972d45e66e5483a777112a00fa30516dfe81bbf88"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L267-L283"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_afe203fdfcc9dcafb170bee972d45e66e5483a777112a00fa30516dfe81bbf88"
 		score = 75
 		quality = 85
 		tags = ""
@@ -299349,10 +297104,8 @@ rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_1
 		$s2 = "Start-Sleep -m 100;" fullword ascii
 
 	condition:
-		1 of ($x*) or 2 of them
+		1 of ( $x* ) or 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_2
 {
 	meta:
@@ -299362,9 +297115,9 @@ rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_2
 		date = "2019-04-17"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L285-L304"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "57c8f02ebfb05f739fc4791a88be4a981ce7b89e2bd283669f85aae1a5c14d02"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L285-L304"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_57c8f02ebfb05f739fc4791a88be4a981ce7b89e2bd283669f85aae1a5c14d02"
 		score = 75
 		quality = 85
 		tags = ""
@@ -299380,10 +297133,8 @@ rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_2
 		$s4 = "+\"<>\" | Set-Content" ascii
 
 	condition:
-		1 of ($x*) and 3 of them
+		1 of ( $x* ) and 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_3
 {
 	meta:
@@ -299393,9 +297144,9 @@ rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_3
 		date = "2019-04-17"
 		modified = "2023-01-06"
 		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig.yar#L306-L326"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "77ba71a59d6026c4b393bc66af586066e11b0c496367a38d847396a23b3dffbe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig.yar#L306-L326"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_77ba71a59d6026c4b393bc66af586066e11b0c496367a38d847396a23b3dffbe"
 		score = 75
 		quality = 85
 		tags = ""
@@ -299423,9 +297174,9 @@ rule SIGNATURE_BASE_Winpayloads_Powershell : FILE
 		date = "2017-07-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nccgroup/Winpayloads"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_winpayloads.yar#L12-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e9e75f7190327f08c5e204977c6714c93951a6db0ddf000c8b37db37131b9def"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_winpayloads.yar#L12-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e9e75f7190327f08c5e204977c6714c93951a6db0ddf000c8b37db37131b9def"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299439,7 +297190,7 @@ rule SIGNATURE_BASE_Winpayloads_Powershell : FILE
 		$x4 = "powershell.exe -WindowStyle Hidden -enc JABjAGwAaQBlAG4AdAA" ascii
 
 	condition:
-		filesize <10KB and 1 of them
+		filesize < 10KB and 1 of them
 }
 rule SIGNATURE_BASE_Winpayloads_Payload : FILE
 {
@@ -299450,9 +297201,9 @@ rule SIGNATURE_BASE_Winpayloads_Payload : FILE
 		date = "2017-07-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nccgroup/Winpayloads"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_winpayloads.yar#L30-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8a22eeafa320bcf0d41de402223d3ad51d8625ffaa68fe24be864ffcf72a64a2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_winpayloads.yar#L30-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8a22eeafa320bcf0d41de402223d3ad51d8625ffaa68fe24be864ffcf72a64a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299470,7 +297221,7 @@ rule SIGNATURE_BASE_Winpayloads_Payload : FILE
 		$s2 = "spayload" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 10000KB and all of them )
 }
 import "pe"
 
@@ -299483,9 +297234,9 @@ rule SIGNATURE_BASE_Reaver3_Malware_Nov17_1 : FILE
 		date = "2017-11-11"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_reaver_sunorcal.yar#L14-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa141a1d3868bd4a004794bf51dc20086eb2e1446e1fa374834a6f2d84940c0d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_reaver_sunorcal.yar#L14-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa141a1d3868bd4a004794bf51dc20086eb2e1446e1fa374834a6f2d84940c0d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299496,7 +297247,7 @@ rule SIGNATURE_BASE_Reaver3_Malware_Nov17_1 : FILE
 		$s1 = "CPL.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="e722dd50a0e2bc0cab8ca35fc4bf6d99" and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and pe.imphash ( ) == "e722dd50a0e2bc0cab8ca35fc4bf6d99" and all of them )
 }
 import "pe"
 
@@ -299509,9 +297260,9 @@ rule SIGNATURE_BASE_Reaver3_Malware_Nov17_2 : FILE
 		date = "2017-11-11"
 		modified = "2023-01-06"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_reaver_sunorcal.yar#L29-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f987876dae35d17fb3ac0d4d3cfe1e00f8977aa696194cc48e53ac1db9d55fca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_reaver_sunorcal.yar#L29-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f987876dae35d17fb3ac0d4d3cfe1e00f8977aa696194cc48e53ac1db9d55fca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299527,7 +297278,7 @@ rule SIGNATURE_BASE_Reaver3_Malware_Nov17_2 : FILE
 		$s5 = "gekmomkege" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="837cc5062a0758335b257ea3b27972b2" or 1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "837cc5062a0758335b257ea3b27972b2" or 1 of ( $x* ) or 3 of them )
 }
 import "pe"
 
@@ -299540,9 +297291,9 @@ rule SIGNATURE_BASE_Reaver3_Malware_Nov17_3 : FILE
 		date = "2017-11-11"
 		modified = "2023-01-06"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_reaver_sunorcal.yar#L55-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "32654255102aee872402b0910422701f3cd4d0b2b8fc6e83440f325923ab9e2f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_reaver_sunorcal.yar#L55-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_32654255102aee872402b0910422701f3cd4d0b2b8fc6e83440f325923ab9e2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299561,10 +297312,8 @@ rule SIGNATURE_BASE_Reaver3_Malware_Nov17_3 : FILE
 		$s5 = "\\services\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="8ee521b2316ddd6af1679eac9f5ed77b" or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "8ee521b2316ddd6af1679eac9f5ed77b" or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sunorcal_Malware_Nov17_1 : FILE
 {
 	meta:
@@ -299574,9 +297323,9 @@ rule SIGNATURE_BASE_Sunorcal_Malware_Nov17_1 : FILE
 		date = "2017-11-11"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_reaver_sunorcal.yar#L82-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "88e6280c04b12b1d8530bafb44afc180685550f1f6bcefb731b3247f6a9529a2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_reaver_sunorcal.yar#L82-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_88e6280c04b12b1d8530bafb44afc180685550f1f6bcefb731b3247f6a9529a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299595,7 +297344,7 @@ rule SIGNATURE_BASE_Sunorcal_Malware_Nov17_1 : FILE
 		$x6 = "Gloabl\\CryptNv1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them
 }
 rule SIGNATURE_BASE_Ironpanda_Dnstunclient : FILE
 {
@@ -299606,10 +297355,10 @@ rule SIGNATURE_BASE_Ironpanda_Dnstunclient : FILE
 		date = "2015-09-16"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger.yar#L10-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger.yar#L10-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
-		logic_hash = "07c142f6eb11ecc8ed5f55d6b0cc7110c6268e189f3ce29215f75b7aba91a290"
+		logic_hash = "v1_sha256_07c142f6eb11ecc8ed5f55d6b0cc7110c6268e189f3ce29215f75b7aba91a290"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -299629,7 +297378,7 @@ rule SIGNATURE_BASE_Ironpanda_Dnstunclient : FILE
 		$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 2 of them ) or 5 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them ) or 5 of them
 }
 rule SIGNATURE_BASE_Ironpanda_Malware1 : FILE
 {
@@ -299640,10 +297389,10 @@ rule SIGNATURE_BASE_Ironpanda_Malware1 : FILE
 		date = "2015-09-16"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger.yar#L38-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger.yar#L38-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
-		logic_hash = "4b50a2c7f0f94b678fc560eefb217c067e934f8e7d64bc0f0d16afcccccd0d08"
+		logic_hash = "v1_sha256_4b50a2c7f0f94b678fc560eefb217c067e934f8e7d64bc0f0d16afcccccd0d08"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299657,7 +297406,7 @@ rule SIGNATURE_BASE_Ironpanda_Malware1 : FILE
 		$s4 = "get_PasswordExpirationDate" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Ironpanda_Webshell_JSP : FILE
 {
@@ -299668,10 +297417,10 @@ rule SIGNATURE_BASE_Ironpanda_Webshell_JSP : FILE
 		date = "2015-09-16"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger.yar#L57-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger.yar#L57-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
-		logic_hash = "747ce812b156bf03f8d14ef84e7d2e8535c7c70590dfcb50ce3e957bec745efc"
+		logic_hash = "v1_sha256_747ce812b156bf03f8d14ef84e7d2e8535c7c70590dfcb50ce3e957bec745efc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299683,7 +297432,7 @@ rule SIGNATURE_BASE_Ironpanda_Webshell_JSP : FILE
 		$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii
 
 	condition:
-		filesize <330KB and 1 of them
+		filesize < 330KB and 1 of them
 }
 rule SIGNATURE_BASE_Ironpanda_Malware_Htran : FILE
 {
@@ -299694,10 +297443,10 @@ rule SIGNATURE_BASE_Ironpanda_Malware_Htran : FILE
 		date = "2015-09-16"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger.yar#L74-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger.yar#L74-L102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
-		logic_hash = "e7312a2d0ffc247eda20cb5453538a501bde6683bf34e7f4bf2230243474ba76"
+		logic_hash = "v1_sha256_e7312a2d0ffc247eda20cb5453538a501bde6683bf34e7f4bf2230243474ba76"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -299720,7 +297469,7 @@ rule SIGNATURE_BASE_Ironpanda_Malware_Htran : FILE
 		$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <125KB and 3 of them ) or 5 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 125KB and 3 of them ) or 5 of them
 }
 rule SIGNATURE_BASE_Ironpanda_Malware2 : FILE
 {
@@ -299731,10 +297480,10 @@ rule SIGNATURE_BASE_Ironpanda_Malware2 : FILE
 		date = "2015-09-16"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger.yar#L104-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger.yar#L104-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a89c21dd608c51c4bf0323d640f816e464578510389f9edcf04cd34090decc91"
-		logic_hash = "060c681e7127349464cd98f99cef6e184fbd18d2ec415dc6c95d8ac329e6fe7e"
+		logic_hash = "v1_sha256_060c681e7127349464cd98f99cef6e184fbd18d2ec415dc6c95d8ac329e6fe7e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299748,7 +297497,7 @@ rule SIGNATURE_BASE_Ironpanda_Malware2 : FILE
 		$s4 = "/c del /q %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 180KB and all of them
 }
 rule SIGNATURE_BASE_Ironpanda_Malware3 : FILE
 {
@@ -299759,10 +297508,10 @@ rule SIGNATURE_BASE_Ironpanda_Malware3 : FILE
 		date = "2015-09-16"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger.yar#L123-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger.yar#L123-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
-		logic_hash = "ca55fc5aa655fb221808b4c82db520cae24e0d93422293b6ed5e573b343e93ac"
+		logic_hash = "v1_sha256_ca55fc5aa655fb221808b4c82db520cae24e0d93422293b6ed5e573b343e93ac"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -299777,7 +297526,7 @@ rule SIGNATURE_BASE_Ironpanda_Malware3 : FILE
 		$s5 = "System.IO.Compression" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_Ironpanda_Malware4 : FILE
 {
@@ -299788,10 +297537,10 @@ rule SIGNATURE_BASE_Ironpanda_Malware4 : FILE
 		date = "2015-09-16"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irontiger.yar#L143-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irontiger.yar#L143-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0d6da946026154416f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
-		logic_hash = "12661c8862eeb82d55a3912e0a499beb6bb19f7abe9ccfe6fa0506e6a032cfe4"
+		logic_hash = "v1_sha256_12661c8862eeb82d55a3912e0a499beb6bb19f7abe9ccfe6fa0506e6a032cfe4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299804,7 +297553,7 @@ rule SIGNATURE_BASE_Ironpanda_Malware4 : FILE
 		$s6 = "TestPlugin" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_BTC_Miner_Lsass1_Chrome_2 : FILE
 {
@@ -299815,9 +297564,9 @@ rule SIGNATURE_BASE_BTC_Miner_Lsass1_Chrome_2 : FILE
 		date = "2017-06-22"
 		modified = "2023-12-05"
 		reference = "Internal Research - CN Actor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_group_btc.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ef80dba71c901d6e821b2e08a701a82f8147e41a8f14c5fd324d5e043b0ff322"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_group_btc.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ef80dba71c901d6e821b2e08a701a82f8147e41a8f14c5fd324d5e043b0ff322"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -299831,7 +297580,7 @@ rule SIGNATURE_BASE_BTC_Miner_Lsass1_Chrome_2 : FILE
 		$x2 = "-O, --userpass=U:P    username:password pair for mining server" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <6000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 6000KB and 1 of them )
 }
 rule SIGNATURE_BASE_CN_Actor_RA_Tool_Ammyy_Mscorsvw : FILE
 {
@@ -299842,9 +297591,9 @@ rule SIGNATURE_BASE_CN_Actor_RA_Tool_Ammyy_Mscorsvw : FILE
 		date = "2017-06-22"
 		modified = "2023-12-05"
 		reference = "Internal Research - CN Actor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_group_btc.yar#L29-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c4b64b3aa63d80fa1a73b021bf49539af5888f53090555555c1f3fd7fbb90230"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_group_btc.yar#L29-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c4b64b3aa63d80fa1a73b021bf49539af5888f53090555555c1f3fd7fbb90230"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299858,7 +297607,7 @@ rule SIGNATURE_BASE_CN_Actor_RA_Tool_Ammyy_Mscorsvw : FILE
 		$s3 = "It will automatically be run the next time this computer is restart or you can start it manually" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 3 of them )
 }
 rule SIGNATURE_BASE_CN_Actor_Ammyyadmin : FILE
 {
@@ -299869,9 +297618,9 @@ rule SIGNATURE_BASE_CN_Actor_Ammyyadmin : FILE
 		date = "2017-06-22"
 		modified = "2023-12-05"
 		reference = "Internal Research - CN Actor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_group_btc.yar#L47-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b628c7e6debdd2b21a321dc2ec5838fd56107f4cac21bda8b9faa1c1d5b23b71"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_group_btc.yar#L47-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b628c7e6debdd2b21a321dc2ec5838fd56107f4cac21bda8b9faa1c1d5b23b71"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -299882,7 +297631,7 @@ rule SIGNATURE_BASE_CN_Actor_Ammyyadmin : FILE
 		$x2 = "\\Ammyy\\sources\\main\\Downloader.cpp" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 import "pe"
 import "math"
@@ -299896,11 +297645,11 @@ rule SIGNATURE_BASE_Susp_File_Enumerator_With_Encrypted_Resource_101 : FILE
 		date = "2024-01-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stonedrill.yar#L12-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stonedrill.yar#L12-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2cd0a5f1e9bcce6807e57ec8477d222a"
 		hash = "c843046e54b755ec63ccb09d0a689674"
-		logic_hash = "0a207038b3cbba88d05cd6a053fd14337ac1fbb08b2a532b542ee2bb6b881a5a"
+		logic_hash = "v1_sha256_0a207038b3cbba88d05cd6a053fd14337ac1fbb08b2a532b542ee2bb6b881a5a"
 		score = 65
 		quality = 44
 		tags = "FILE"
@@ -299913,11 +297662,8 @@ rule SIGNATURE_BASE_Susp_File_Enumerator_With_Encrypted_Resource_101 : FILE
 		$a4 = "LoadResource" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5A4D and all of them and filesize <700000 and pe.number_of_sections>4 and pe.number_of_resources>1 and pe.number_of_resources<15 and for any i in (0..pe.number_of_resources-1) : ((math.entropy(pe.resources[i].offset,pe.resources[i].length)>7.8) and pe.resources[i].id==101 and pe.resources[i].length>20000 and pe.resources[i].language==0 and not ($mz in (pe.resources[i].offset..pe.resources[i].offset+pe.resources[i].length)))
+		uint16( 0 ) == 0x5A4D and all of them and filesize < 700000 and pe.number_of_sections > 4 and pe.number_of_resources > 1 and pe.number_of_resources < 15 and for any i in ( 0 .. pe.number_of_resources - 1 ) : ( ( math.entropy ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) > 7.8 ) and pe.resources [ i ] . id == 101 and pe.resources [ i ] . length > 20000 and pe.resources [ i ] . language == 0 and not ( $mz in ( pe.resources [ i ] . offset..pe.resources [ i ] . offset + pe.resources [ i ] . length ) ) )
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Stonedrill_Main_Sub : FILE
 {
 	meta:
@@ -299927,9 +297673,9 @@ rule SIGNATURE_BASE_Stonedrill_Main_Sub : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stonedrill.yar#L43-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "794094c0cbb81f6f971e16de36d444351b17cf38a91d8210f914b80da7d9ed26"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stonedrill.yar#L43-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_794094c0cbb81f6f971e16de36d444351b17cf38a91d8210f914b80da7d9ed26"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299941,11 +297687,8 @@ rule SIGNATURE_BASE_Stonedrill_Main_Sub : FILE
 		$code = {B8 08 00 FE 7F FF 30 8F 44 24 ?? 68 B4 0F 00 00 FF 15 ?? ?? ?? 00 B8 08 00 FE 7F FF 30 8F 44 24 ?? 8B ?? 24 [1 - 4] 2B ?? 24 [6] F7 ?1 [5 - 12] 00}
 
 	condition:
-		uint16(0)==0x5A4D and $code and filesize <5000000
+		uint16( 0 ) == 0x5A4D and $code and filesize < 5000000
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Stonedrill_BAT_1 : FILE
 {
 	meta:
@@ -299955,9 +297698,9 @@ rule SIGNATURE_BASE_Stonedrill_BAT_1 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stonedrill.yar#L65-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d7263a527cae45072082c0f2fd0abc33acb2a25b34c06becf36fbd36f0697d5c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stonedrill.yar#L65-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d7263a527cae45072082c0f2fd0abc33acb2a25b34c06becf36fbd36f0697d5c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -299971,11 +297714,8 @@ rule SIGNATURE_BASE_Stonedrill_BAT_1 : FILE
 		$s5 = "%\" start /b %systemroot%\\system32\\%" ascii
 
 	condition:
-		uint32(0)==0x68636540 and 2 of them and filesize <500
+		uint32( 0 ) == 0x68636540 and 2 of them and filesize < 500
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Stonedrill_Service_Install : FILE
 {
 	meta:
@@ -299985,9 +297725,9 @@ rule SIGNATURE_BASE_Stonedrill_Service_Install : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stonedrill.yar#L82-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "52abe90c7f87ffeace4b58f9959e5a21c475bfa7ae2c5bc2744fe5fe43ffdda8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stonedrill.yar#L82-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_52abe90c7f87ffeace4b58f9959e5a21c475bfa7ae2c5bc2744fe5fe43ffdda8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300000,11 +297740,8 @@ rule SIGNATURE_BASE_Stonedrill_Service_Install : FILE
 		$s4 = "sc config NtsSrv binpath= \"C:\\WINDOWS\\system32\ntssrvr64.exe" ascii
 
 	condition:
-		2 of them and filesize <500
+		2 of them and filesize < 500
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Stonedrill_Ntssrvr32 : FILE
 {
 	meta:
@@ -300014,9 +297751,9 @@ rule SIGNATURE_BASE_Stonedrill_Ntssrvr32 : FILE
 		date = "2017-03-07"
 		modified = "2023-01-27"
 		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stonedrill.yar#L98-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f1122aba53f32b10bd5f43cb619aa5d668b1457f3a5ea2a68c97254ab8631faa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stonedrill.yar#L98-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f1122aba53f32b10bd5f43cb619aa5d668b1457f3a5ea2a68c97254ab8631faa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300032,11 +297769,8 @@ rule SIGNATURE_BASE_Stonedrill_Ntssrvr32 : FILE
 		$op3 = { 74 0a 3d 00 94 35 77 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 3 of them )
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Stonedrill_Malware_2 : FILE
 {
 	meta:
@@ -300046,9 +297780,9 @@ rule SIGNATURE_BASE_Stonedrill_Malware_2 : FILE
 		date = "2017-03-07"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stonedrill.yar#L120-L145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb1f8b24465ad8ca19dd540b1f8b63a73bc2624958bf45547b15c10583d07281"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stonedrill.yar#L120-L145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb1f8b24465ad8ca19dd540b1f8b63a73bc2624958bf45547b15c10583d07281"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -300070,11 +297804,8 @@ rule SIGNATURE_BASE_Stonedrill_Malware_2 : FILE
 		$x5 = "C-Dlt-C-Trsh-T.tmp" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 3 of ($s*))) or 5 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or 5 of them
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Stonedrill : FILE
 {
 	meta:
@@ -300084,9 +297815,9 @@ rule SIGNATURE_BASE_Stonedrill : FILE
 		date = "2017-03-07"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stonedrill.yar#L147-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ef7173e259f985083d5451a2d464047b40112a084a05d471797d5dbf2d0fb21d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stonedrill.yar#L147-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ef7173e259f985083d5451a2d464047b40112a084a05d471797d5dbf2d0fb21d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300105,11 +297836,8 @@ rule SIGNATURE_BASE_Stonedrill : FILE
 		$opa2 = { 8d 73 01 90 0f bf 51 fe }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 1 of ($x*) or ( all of ($op*) and all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of ( $x* ) or ( all of ( $op* ) and all of ( $s* ) )
 }
-import "pe"
-import "math"
-
 rule SIGNATURE_BASE_Stonedrill_VBS_1 : FILE
 {
 	meta:
@@ -300119,9 +297847,9 @@ rule SIGNATURE_BASE_Stonedrill_VBS_1 : FILE
 		date = "2017-03-07"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stonedrill.yar#L172-L192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "79416d27a6a09d544becd84f8e551c09b94c97181f8fddc481f47e42763d47ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stonedrill.yar#L172-L192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_79416d27a6a09d544becd84f8e551c09b94c97181f8fddc481f47e42763d47ac"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300138,7 +297866,7 @@ rule SIGNATURE_BASE_Stonedrill_VBS_1 : FILE
 		$s5 = " , \"%COMMON_APPDATA%\\Chrome\\" ascii
 
 	condition:
-		( filesize <1KB and 1 of ($x*) or 2 of ($s*))
+		( filesize < 1KB and 1 of ( $x* ) or 2 of ( $s* ) )
 }
 rule SIGNATURE_BASE_APT_Pupyrat_PY : FILE
 {
@@ -300149,9 +297877,9 @@ rule SIGNATURE_BASE_APT_Pupyrat_PY : FILE
 		date = "2017-02-17"
 		modified = "2023-12-05"
 		reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_magichound.yar#L10-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b30bc3082be3229ea2ef5d7c51ab6f97df2f612c80c45892e1a13fde1fb56725"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_magichound.yar#L10-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b30bc3082be3229ea2ef5d7c51ab6f97df2f612c80c45892e1a13fde1fb56725"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300167,7 +297895,7 @@ rule SIGNATURE_BASE_APT_Pupyrat_PY : FILE
 		$op1 = { 8b 42 0c 8b 78 14 89 5c 24 18 89 7c 24 14 3b fd }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20000KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 20000KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_APT_Magichound_Malmacro : FILE
 {
@@ -300178,9 +297906,9 @@ rule SIGNATURE_BASE_APT_Magichound_Malmacro : FILE
 		date = "2017-02-17"
 		modified = "2023-12-05"
 		reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_magichound.yar#L33-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "198c6e7ab957d5c1bb45449b0b2210532e97ed11700f8435201200746e0dfa48"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_magichound.yar#L33-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_198c6e7ab957d5c1bb45449b0b2210532e97ed11700f8435201200746e0dfa48"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300195,7 +297923,7 @@ rule SIGNATURE_BASE_APT_Magichound_Malmacro : FILE
 		$s3 = "URLDownloadToFile" fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <8000KB and all of them )
+		( uint16( 0 ) == 0xcfd0 and filesize < 8000KB and all of them )
 }
 rule SIGNATURE_BASE_Worddoc_Powershell_Urldownloadtofile : FILE
 {
@@ -300206,9 +297934,9 @@ rule SIGNATURE_BASE_Worddoc_Powershell_Urldownloadtofile : FILE
 		date = "2017-02-23"
 		modified = "2024-04-03"
 		reference = "https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L10-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4ea4e6092011bccfc5132186b910075361f4f77f01ae00c51c486d77a996775"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L10-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4ea4e6092011bccfc5132186b910075361f4f77f01ae00c51c486d77a996775"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300225,7 +297953,7 @@ rule SIGNATURE_BASE_Worddoc_Powershell_Urldownloadtofile : FILE
 		$p2 = "URLDownloadToFile" fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and 1 of ($w*) and all of ($p*))
+		( uint16( 0 ) == 0xcfd0 and 1 of ( $w* ) and all of ( $p* ) )
 }
 rule SIGNATURE_BASE_Suspicious_Powershell_Code_1 : FILE
 {
@@ -300236,9 +297964,9 @@ rule SIGNATURE_BASE_Suspicious_Powershell_Code_1 : FILE
 		date = "2017-02-22"
 		modified = "2024-04-03"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L32-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a254e0e4f0fdaa5907f5fe0b0c3d5226e2fdac4072349019abc2b2b11cbde30"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L32-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a254e0e4f0fdaa5907f5fe0b0c3d5226e2fdac4072349019abc2b2b11cbde30"
 		score = 60
 		quality = 83
 		tags = "FILE"
@@ -300264,9 +297992,9 @@ rule SIGNATURE_BASE_Suspicious_Powershell_Webdownload_1 : HIGHVOL FILE
 		date = "2017-02-22"
 		modified = "2024-04-03"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L52-L91"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "56ad9c71c34956e94325452d829627a30b1499552725232a07100f05a050ef1b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L52-L91"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_56ad9c71c34956e94325452d829627a30b1499552725232a07100f05a050ef1b"
 		score = 60
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -300299,7 +298027,7 @@ rule SIGNATURE_BASE_Suspicious_Powershell_Webdownload_1 : HIGHVOL FILE
 		$fpg8 = "COPYRIGHT" fullword
 
 	condition:
-		1 of ($s*) and not 1 of ($fp*)
+		1 of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Powershell_In_Word_Doc : FILE
 {
@@ -300310,9 +298038,9 @@ rule SIGNATURE_BASE_Powershell_In_Word_Doc : FILE
 		date = "2017-06-27"
 		modified = "2024-04-03"
 		reference = "Internal Research - ME"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L104-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6a9b295f1c430c285aedc5e6df268ea2023c8bdaccd04cf8a5d021419cd6bd64"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L104-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6a9b295f1c430c285aedc5e6df268ea2023c8bdaccd04cf8a5d021419cd6bd64"
 		score = 50
 		quality = 83
 		tags = "FILE"
@@ -300324,7 +298052,7 @@ rule SIGNATURE_BASE_Powershell_In_Word_Doc : FILE
 		$s2 = "BYPASS" fullword ascii nocase
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0xcfd0 and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_Susp_Powershell_Sep17_1 : FILE
 {
@@ -300335,9 +298063,9 @@ rule SIGNATURE_BASE_Susp_Powershell_Sep17_1 : FILE
 		date = "2017-09-30"
 		modified = "2024-04-03"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L131-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6c8a1e72b2c4685a5a5749d86901b123976092aee373412bf04c62aa32145be8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L131-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6c8a1e72b2c4685a5a5749d86901b123976092aee373412bf04c62aa32145be8"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -300350,7 +298078,7 @@ rule SIGNATURE_BASE_Susp_Powershell_Sep17_1 : FILE
 		$s1 = "window.resizeTo 0,0" fullword ascii
 
 	condition:
-		( filesize <2KB and 1 of them )
+		( filesize < 2KB and 1 of them )
 }
 rule SIGNATURE_BASE_Susp_Powershell_Sep17_2 : FILE
 {
@@ -300361,9 +298089,9 @@ rule SIGNATURE_BASE_Susp_Powershell_Sep17_2 : FILE
 		date = "2017-09-30"
 		modified = "2024-04-03"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L150-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0819f57afb6d1d878e4db4079bfd43ccac520829c877de04d16d8bd048a35ab5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L150-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0819f57afb6d1d878e4db4079bfd43ccac520829c877de04d16d8bd048a35ab5"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -300377,7 +298105,7 @@ rule SIGNATURE_BASE_Susp_Powershell_Sep17_2 : FILE
 		$s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
 
 	condition:
-		filesize <20KB and (( uint16(0)==0x733c and 1 of ($x*)) or 2 of them )
+		filesize < 20KB and ( ( uint16( 0 ) == 0x733c and 1 of ( $x* ) ) or 2 of them )
 }
 rule SIGNATURE_BASE_Wscript_Shell_Powershell_Combo : FILE
 {
@@ -300388,9 +298116,9 @@ rule SIGNATURE_BASE_Wscript_Shell_Powershell_Combo : FILE
 		date = "2018-02-07"
 		modified = "2024-04-03"
 		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L172-L193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0ab5808593c999c1ce342051a8e292153aa20516cf48071565d677399adfb160"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L172-L193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0ab5808593c999c1ce342051a8e292153aa20516cf48071565d677399adfb160"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -300405,7 +298133,7 @@ rule SIGNATURE_BASE_Wscript_Shell_Powershell_Combo : FILE
 		$fp1 = "Copyright: Microsoft Corp." ascii
 
 	condition:
-		filesize <400KB and $s1 and 1 of ($p*) and not 1 of ($fp*)
+		filesize < 400KB and $s1 and 1 of ( $p* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Powershell_String_K32_Remprocess : FILE
 {
@@ -300416,9 +298144,9 @@ rule SIGNATURE_BASE_SUSP_Powershell_String_K32_Remprocess : FILE
 		date = "2018-03-31"
 		modified = "2024-04-03"
 		reference = "https://github.com/nccgroup/redsnarf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L195-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "03c80de8e59e640709c4ee1912dc47c398e265f9b88845a6de88031e2eb46ba3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L195-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_03c80de8e59e640709c4ee1912dc47c398e265f9b88845a6de88031e2eb46ba3"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -300436,7 +298164,7 @@ rule SIGNATURE_BASE_SUSP_Powershell_String_K32_Remprocess : FILE
 		$s15 = "$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null" fullword ascii
 
 	condition:
-		uint16(0)==0x7566 and filesize <6000KB and 1 of them
+		uint16( 0 ) == 0x7566 and filesize < 6000KB and 1 of them
 }
 rule SIGNATURE_BASE_Powershell_JAB_B64 : FILE
 {
@@ -300447,9 +298175,9 @@ rule SIGNATURE_BASE_Powershell_JAB_B64 : FILE
 		date = "2018-04-02"
 		modified = "2024-04-03"
 		reference = "https://twitter.com/ItsReallyNick/status/980915287922040832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L217-L231"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4746a73774f945e63455ca7dd58ef67290f7c66d2dca80d06d52d2545c69a190"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L217-L231"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4746a73774f945e63455ca7dd58ef67290f7c66d2dca80d06d52d2545c69a190"
 		score = 60
 		quality = 83
 		tags = "FILE"
@@ -300460,7 +298188,7 @@ rule SIGNATURE_BASE_Powershell_JAB_B64 : FILE
 		$s2 = "powershell" nocase
 
 	condition:
-		filesize <30KB and all of them
+		filesize < 30KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_PS1_Frombase64String_Content_Indicator : FILE
 {
@@ -300471,9 +298199,9 @@ rule SIGNATURE_BASE_SUSP_PS1_Frombase64String_Content_Indicator : FILE
 		date = "2020-01-25"
 		modified = "2024-04-03"
 		reference = "https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_susp.yar#L233-L284"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a9ec7a00e9faee5cc081a2bc86abf8027fcd3cfe590cdd4f2f99425b6723f23f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_susp.yar#L233-L284"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a9ec7a00e9faee5cc081a2bc86abf8027fcd3cfe590cdd4f2f99425b6723f23f"
 		score = 65
 		quality = 83
 		tags = "FILE"
@@ -300521,7 +298249,7 @@ rule SIGNATURE_BASE_SUSP_PS1_Frombase64String_Content_Indicator : FILE
 		$ = "::FromBase64String('IAB" ascii wide
 
 	condition:
-		filesize <5000KB and 1 of them
+		filesize < 5000KB and 1 of them
 }
 rule SIGNATURE_BASE_MAL_Gozicrypter_Dec20_1 : FILE
 {
@@ -300532,9 +298260,9 @@ rule SIGNATURE_BASE_MAL_Gozicrypter_Dec20_1 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "YaraExchange"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_gozi_crypter.yar#L2-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51fdfbb59b8f52cc2ff89d994c0f89d2c2895c346b098879c68b4ccb880783c1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_gozi_crypter.yar#L2-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51fdfbb59b8f52cc2ff89d994c0f89d2c2895c346b098879c68b4ccb880783c1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -300543,7 +298271,7 @@ rule SIGNATURE_BASE_MAL_Gozicrypter_Dec20_1 : FILE
 		$s1 = { 89 05 ?? ?? ?? ?? 81 2d ?? ?? ?? ?? 01 00 00 00 81 3D ?? ?? ?? ?? 00 00 00 00 }
 
 	condition:
-		uint16(0)==0x5A4D and any of them and filesize <1000KB
+		uint16( 0 ) == 0x5A4D and any of them and filesize < 1000KB
 }
 import "pe"
 
@@ -300556,9 +298284,9 @@ rule SIGNATURE_BASE_Silence_Malware_1 : FILE
 		date = "2017-11-01"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/the-silence/83009/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_silence.yar#L13-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b88795268c080fe19f7e185d1542b520616fe6c00bae23a99981aa1ee8abacb3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_silence.yar#L13-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b88795268c080fe19f7e185d1542b520616fe6c00bae23a99981aa1ee8abacb3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300576,7 +298304,7 @@ rule SIGNATURE_BASE_Silence_Malware_1 : FILE
 		$s4 = "VNASSRUNXYC" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="e03edb9bd7cbe200dc59f361db847f8a" or 1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "e03edb9bd7cbe200dc59f361db847f8a" or 1 of ( $x* ) or 3 of them )
 }
 import "pe"
 
@@ -300589,9 +298317,9 @@ rule SIGNATURE_BASE_Silence_Malware_2 : FILE
 		date = "2017-11-01"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/the-silence/83009/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_silence.yar#L40-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8cb6320eac984b7a332c1c84582a7ca7e90d409e518106c4e7655948f6863889"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_silence.yar#L40-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8cb6320eac984b7a332c1c84582a7ca7e90d409e518106c4e7655948f6863889"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300608,7 +298336,7 @@ rule SIGNATURE_BASE_Silence_Malware_2 : FILE
 		$s5 = "Default monitor" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="69f3ec173efb6fd3ab5f79e0f8051335" or (1 of ($x*) or 3 of them ))) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "69f3ec173efb6fd3ab5f79e0f8051335" or ( 1 of ( $x* ) or 3 of them ) ) ) or ( 5 of them )
 }
 import "pe"
 
@@ -300621,9 +298349,9 @@ rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_1 : FILE
 		date = "2018-07-28"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_darkhydrus.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2c39f2e6b37e6422984275f45a2917891c3b482d137dbbfd6293088c2f2dacc3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_darkhydrus.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2c39f2e6b37e6422984275f45a2917891c3b482d137dbbfd6293088c2f2dacc3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300634,10 +298362,8 @@ rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_1 : FILE
 		$x1 = "Z:\\devcenter\\aggressor\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="d3666d1cde4790b22b44ec35976687fb" or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "d3666d1cde4790b22b44ec35976687fb" or 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_2 : FILE
 {
 	meta:
@@ -300647,9 +298373,9 @@ rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_2 : FILE
 		date = "2018-07-28"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_darkhydrus.yar#L31-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e967fec69ad1cbb46a63ee520594e7d6f2445a400510a9864dbd6d4c6e092737"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_darkhydrus.yar#L31-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e967fec69ad1cbb46a63ee520594e7d6f2445a400510a9864dbd6d4c6e092737"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300664,7 +298390,7 @@ rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_2 : FILE
 		$s9 = "StartW" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them
 }
 import "pe"
 
@@ -300677,9 +298403,9 @@ rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_3 : FILE
 		date = "2018-07-28"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_darkhydrus.yar#L50-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f3425322846e6064ec2576ad4e73061fbec3e4400de54d05fe07b8ad2a31f92"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_darkhydrus.yar#L50-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f3425322846e6064ec2576ad4e73061fbec3e4400de54d05fe07b8ad2a31f92"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300691,7 +298417,7 @@ rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_3 : FILE
 		$s3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="478eacfbe2b201dabe63be53f34148a5" or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "478eacfbe2b201dabe63be53f34148a5" or all of them )
 }
 import "pe"
 
@@ -300704,9 +298430,9 @@ rule SIGNATURE_BASE_HKTL_Unlicensed_Cobaltstrike_EICAR_Jul18_5 : FILE
 		date = "2018-07-28"
 		modified = "2021-06-17"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_darkhydrus.yar#L69-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d066f22e01f9ca3a33c669552046a5ab8dd9e579236974b1c468ba9644498951"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_darkhydrus.yar#L69-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d066f22e01f9ca3a33c669552046a5ab8dd9e579236974b1c468ba9644498951"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300719,7 +298445,7 @@ rule SIGNATURE_BASE_HKTL_Unlicensed_Cobaltstrike_EICAR_Jul18_5 : FILE
 		$s2 = "libgcj-12.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (pe.imphash()=="829da329ce140d873b4a8bde2cbfaa7e" or all of ($s*) or $x1)
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( pe.imphash ( ) == "829da329ce140d873b4a8bde2cbfaa7e" or all of ( $s* ) or $x1 )
 }
 rule SIGNATURE_BASE_Crime_H2Miner_Kinsing : FILE
 {
@@ -300730,9 +298456,9 @@ rule SIGNATURE_BASE_Crime_H2Miner_Kinsing : FILE
 		date = "2020-06-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_h2miner_kinsing.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8795f01f4ce85ca37a4e4667a4ee9756dae6af42884cf79830877a5c35a3bd3b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_h2miner_kinsing.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8795f01f4ce85ca37a4e4667a4ee9756dae6af42884cf79830877a5c35a3bd3b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300749,7 +298475,7 @@ rule SIGNATURE_BASE_Crime_H2Miner_Kinsing : FILE
 		$s9 = "main.runTask"
 
 	condition:
-		( uint32(0)==0x464C457F) and filesize >1MB and all of them
+		( uint32( 0 ) == 0x464C457F ) and filesize > 1MB and all of them
 }
 rule SIGNATURE_BASE_APT_Project_Sauron_Scripts
 {
@@ -300760,9 +298486,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Scripts
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L1-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "275ec8de40ae973b4ec4c891c56a70fc2fd05abff258b8015d986d0106506367"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L1-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_275ec8de40ae973b4ec4c891c56a70fc2fd05abff258b8015d986d0106506367"
 		score = 75
 		quality = 85
 		tags = ""
@@ -300795,9 +298521,9 @@ rule SIGNATURE_BASE_HKTL_Dsniff
 		date = "2019-02-19"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L27-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0edd3ba7e78ee2810aa3c7643a96382c1fe0b5e627913a5a9bac2e83c8d40274"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L27-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0edd3ba7e78ee2810aa3c7643a96382c1fe0b5e627913a5a9bac2e83c8d40274"
 		score = 55
 		quality = 85
 		tags = ""
@@ -300817,9 +298543,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Arping_Module
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L41-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d87e91441994c4ed863596d79c108c9f72adfb708f885cb63a881eb25aa089b7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L41-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d87e91441994c4ed863596d79c108c9f72adfb708f885cb63a881eb25aa089b7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -300842,9 +298568,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Kblogi_Module
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L57-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bba87b17a62fc968e89d4f6d10de06875c6b7f47c8bb7ae3f7932804b23a8e87"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L57-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bba87b17a62fc968e89d4f6d10de06875c6b7f47c8bb7ae3f7932804b23a8e87"
 		score = 75
 		quality = 85
 		tags = ""
@@ -300867,9 +298593,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Basex_Module
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L73-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "90cfb58017d62312c56908aca1a48bb7425f5cd51540298ecf65305b46ffb2c8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L73-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_90cfb58017d62312c56908aca1a48bb7425f5cd51540298ecf65305b46ffb2c8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -300892,9 +298618,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Dext_Module
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L89-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7dbfb3ddfffa6fa65800e07fdcc527650474740afa658567efe46830587cedae"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L89-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7dbfb3ddfffa6fa65800e07fdcc527650474740afa658567efe46830587cedae"
 		score = 75
 		quality = 85
 		tags = ""
@@ -300918,9 +298644,9 @@ rule SIGNATURE_BASE_Hacktool_This_Cruft : FILE
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L106-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "875c34e8048c3f98afc97683d0b3086c3396753cd9fb14bc68681c63ed77fd51"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L106-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_875c34e8048c3f98afc97683d0b3086c3396753cd9fb14bc68681c63ed77fd51"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -300930,7 +298656,7 @@ rule SIGNATURE_BASE_Hacktool_This_Cruft : FILE
 		$x1 = "This cruft" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and $x1)
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and $x1 )
 }
 rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M1 : FILE
 {
@@ -300941,9 +298667,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M1 : FILE
 		date = "2016-08-09"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L130-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c81c996e487bdd840111513724ccf1220ee3bd8280d776aa4c128ef5263ee136"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L130-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c81c996e487bdd840111513724ccf1220ee3bd8280d776aa4c128ef5263ee136"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300958,7 +298684,7 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M1 : FILE
 		$op2 = { 2b d8 48 89 7c 24 38 44 89 6c 24 40 83 c3 08 89 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*)) and 1 of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of ( $s* ) ) and 1 of ( $op* ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M2 : FILE
 {
@@ -300969,9 +298695,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M2 : FILE
 		date = "2016-08-09"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L150-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "57099a802ee62a5183156f0b30713553b6fd83bbb5e1b453e9b25da0109b8777"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L150-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_57099a802ee62a5183156f0b30713553b6fd83bbb5e1b453e9b25da0109b8777"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -300985,7 +298711,7 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M2 : FILE
 		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 12 0f 82 a7 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and ( all of ($s*)) and all of ($op*))
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( all of ( $s* ) ) and all of ( $op* ) )
 }
 rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M3 : FILE
 {
@@ -300996,9 +298722,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M3 : FILE
 		date = "2016-08-09"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L169-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "739414990d112dd16e01831408ba745b04fae7621eb9074f73babbc40b69e1ad"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L169-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_739414990d112dd16e01831408ba745b04fae7621eb9074f73babbc40b69e1ad"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -301012,7 +298738,7 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M3 : FILE
 		$op2 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*)) and all of ($op*))
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( all of ( $s* ) ) and all of ( $op* ) )
 }
 rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M4 : FILE
 {
@@ -301023,9 +298749,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M4 : FILE
 		date = "2016-08-09"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L188-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0735ba9591a9cf06cd13ba480b4559ef83105ab08ffcec21ebbbfdf3766edb93"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L188-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0735ba9591a9cf06cd13ba480b4559ef83105ab08ffcec21ebbbfdf3766edb93"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -301040,7 +298766,7 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M4 : FILE
 		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and ( all of ($s*)) and 1 of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 90KB and ( all of ( $s* ) ) and 1 of ( $op* ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M6 : FILE
 {
@@ -301051,9 +298777,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M6 : FILE
 		date = "2016-08-09"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L208-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "95ca9a0b2e71e7152d20a01d238e7362024c6dac6fc95ed2ebfa96dcbc8dbd40"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L208-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_95ca9a0b2e71e7152d20a01d238e7362024c6dac6fc95ed2ebfa96dcbc8dbd40"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -301068,7 +298794,7 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M6 : FILE
 		$op2 = { 80 75 29 85 c9 79 25 b9 01 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*)) and 1 of ($op*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of ( $s* ) ) and 1 of ( $op* ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M7 : FILE
 {
@@ -301079,9 +298805,9 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M7 : FILE
 		date = "2016-08-09"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_sauron_extras.yar#L228-L261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d132ddeb1d26b035565d3707b73d401fb413315febe26ac291cb05bfeca7c41d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_sauron_extras.yar#L228-L261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d132ddeb1d26b035565d3707b73d401fb413315febe26ac291cb05bfeca7c41d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -301106,7 +298832,7 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M7 : FILE
 		$op5 = { c1 ed 02 83 c6 fe e9 68 fe ff ff 44 39 57 08 75 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ((3 of ($s*) and 3 of ($op*)) or (1 of ($sx*) and 1 of ($sa*)))
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( ( 3 of ( $s* ) and 3 of ( $op* ) ) or ( 1 of ( $sx* ) and 1 of ( $sa* ) ) )
 }
 import "pe"
 
@@ -301119,9 +298845,9 @@ rule SIGNATURE_BASE_APT_RU_APT27_Hyperbro_Vftrace_Loader_Jan22_1 : FILE
 		date = "2022-01-14"
 		modified = "2023-12-05"
 		reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt27_hyperbro.yar#L3-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d8785ea937891636bea5ed8128de44fa6084a1a48800c1586739c5ca9e4c43bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt27_hyperbro.yar#L3-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d8785ea937891636bea5ed8128de44fa6084a1a48800c1586739c5ca9e4c43bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -301132,7 +298858,7 @@ rule SIGNATURE_BASE_APT_RU_APT27_Hyperbro_Vftrace_Loader_Jan22_1 : FILE
 		$decoder_routine = { 8A ?? 41 10 00 00 8B ?? 28 ?? ?? 4? 3B ?? 72 ?? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5MB and $decoder_routine and pe.exports("D_C_Support_SetD_File")
+		uint16( 0 ) == 0x5a4d and filesize < 5MB and $decoder_routine and pe.exports ( "D_C_Support_SetD_File" )
 }
 import "pe"
 
@@ -301145,18 +298871,16 @@ rule SIGNATURE_BASE_APT_CN_APT27_Compromised_Certficate_Jan22_1
 		date = "2022-01-29"
 		modified = "2023-12-05"
 		reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt27_hyperbro.yar#L21-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "94a40d55936fc341eaba5e1accc8bfe3a401114298e7a3cc4d5c64af36eadf9e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt27_hyperbro.yar#L21-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_94a40d55936fc341eaba5e1accc8bfe3a401114298e7a3cc4d5c64af36eadf9e"
 		score = 80
 		quality = 85
 		tags = ""
 
 	condition:
-		for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert SHA2 Assured ID Code Signing CA" and pe.signatures[i].serial=="08:68:70:51:50:f1:cf:c1:fc:c3:fc:91:a4:49:49:a6")
+		for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert SHA2 Assured ID Code Signing CA" and pe.signatures [ i ] . serial == "08:68:70:51:50:f1:cf:c1:fc:c3:fc:91:a4:49:49:a6" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Decrypted_Stage2 : FILE
 {
 	meta:
@@ -301166,9 +298890,9 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Decrypted_Stage2 : FILE
 		date = "2022-02-07"
 		modified = "2023-12-05"
 		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt27_hyperbro.yar#L35-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6eb56c4a92e89977e536ccc3c70170062aca072c6981b40aeea184ea2ca461a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt27_hyperbro.yar#L35-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6eb56c4a92e89977e536ccc3c70170062aca072c6981b40aeea184ea2ca461a6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -301184,10 +298908,8 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Decrypted_Stage2 : FILE
 		$lznt1_compressed_pe_header_large_6 = { 6e 20 44 4f 53 20 00 6d 6f 64 65 2e 0d 0d 0a 02 }
 
 	condition:
-		filesize <200KB and ($lznt1_compressed_pe_header_small at 0x9ce) or ( all of ($lznt1_compressed_pe_header_large_*))
+		filesize < 200KB and ( $lznt1_compressed_pe_header_small at 0x9ce ) or ( all of ( $lznt1_compressed_pe_header_large_* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3 : FILE
 {
 	meta:
@@ -301197,9 +298919,9 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3 : FILE
 		date = "2022-02-07"
 		modified = "2023-01-07"
 		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt27_hyperbro.yar#L59-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49c1e70d63d93244b4b44525f2b30c05512b5f3a30d6d7c43c9366a95c84e79b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt27_hyperbro.yar#L59-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49c1e70d63d93244b4b44525f2b30c05512b5f3a30d6d7c43c9366a95c84e79b"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -301218,10 +298940,8 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3 : FILE
 		$g4 = " -k localservice" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and ((4 of ($s*)) or (4 of ($g*)))
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( ( 4 of ( $s* ) ) or ( 4 of ( $g* ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_C2
 {
 	meta:
@@ -301231,9 +298951,9 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_C2
 		date = "2022-02-07"
 		modified = "2023-12-05"
 		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt27_hyperbro.yar#L86-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "676df1eaa782c6b876df138a0ddddc3c63e277b84d4414b044314ee219674420"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt27_hyperbro.yar#L86-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_676df1eaa782c6b876df138a0ddddc3c63e277b84d4414b044314ee219674420"
 		score = 50
 		quality = 81
 		tags = ""
@@ -301246,8 +298966,6 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_C2
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_Persistence
 {
 	meta:
@@ -301257,9 +298975,9 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_Persistence
 		date = "2022-02-07"
 		modified = "2023-12-05"
 		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt27_hyperbro.yar#L103-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "db4b7be2bafe29b5e7c81a90e17a660cf73cff1c2e8edd04a9421daba09e3e0e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt27_hyperbro.yar#L103-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_db4b7be2bafe29b5e7c81a90e17a660cf73cff1c2e8edd04a9421daba09e3e0e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -301272,8 +298990,6 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_Persistence
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Encrypted_Stage2 : FILE
 {
 	meta:
@@ -301283,9 +298999,9 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Encrypted_Stage2 : FILE
 		date = "2022-02-07"
 		modified = "2023-12-05"
 		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt27_hyperbro.yar#L120-L389"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c3b07bdb19730fc9c8cca8aa7581a32eb80e3dbc5c4d366fbb2f9966081c1a21"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt27_hyperbro.yar#L120-L389"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c3b07bdb19730fc9c8cca8aa7581a32eb80e3dbc5c4d366fbb2f9966081c1a21"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -301550,7 +299266,7 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Encrypted_Stage2 : FILE
 		$encrypted_pe_header_shift_255 = { fb b8 ff 4c 59 8f ff 02 ff ff ff 81 03 ff 2f fe fe ff }
 
 	condition:
-		filesize <200KB and (1 of ($encrypted_pe_header_shift_*))
+		filesize < 200KB and ( 1 of ( $encrypted_pe_header_shift_* ) )
 }
 rule SIGNATURE_BASE_Shifu_Banking_Trojan : FILE
 {
@@ -301561,9 +299277,9 @@ rule SIGNATURE_BASE_Shifu_Banking_Trojan : FILE
 		date = "2015-09-01"
 		modified = "2023-12-05"
 		reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_shifu_trojan.yar#L8-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f65fa80638e6a8bf8c5afb3dbe1262572ca0a7c56507369934ac3d958f3e6267"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_shifu_trojan.yar#L8-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f65fa80638e6a8bf8c5afb3dbe1262572ca0a7c56507369934ac3d958f3e6267"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -301579,7 +299295,7 @@ rule SIGNATURE_BASE_Shifu_Banking_Trojan : FILE
 		$s4 = "PeekNamedPipe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ($x1 or all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( $x1 or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_SHIFU_Banking_Trojan : FILE
 {
@@ -301590,9 +299306,9 @@ rule SIGNATURE_BASE_SHIFU_Banking_Trojan : FILE
 		date = "2015-10-31"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/52n8WE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_shifu_trojan.yar#L29-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "01f5217ee4e81b0b2ff37ccc7eed353ace26aa68538cce5bc207c0c071f0850a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_shifu_trojan.yar#L29-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_01f5217ee4e81b0b2ff37ccc7eed353ace26aa68538cce5bc207c0c071f0850a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -301622,7 +299338,7 @@ rule SIGNATURE_BASE_SHIFU_Banking_Trojan : FILE
 		$s5 = "WinSCard.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($x1 or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( $x1 or 5 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Explosive_EXE : APT FILE
 {
@@ -301633,9 +299349,9 @@ rule SIGNATURE_BASE_Explosive_EXE : APT FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_volatile_cedar.yar#L1-L12"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "77eb74586f5ef2878c0d283b925e6e066f704d00525303990cf5ea7988a6637d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_volatile_cedar.yar#L1-L12"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_77eb74586f5ef2878c0d283b925e6e066f704d00525303990cf5ea7988a6637d"
 		score = 75
 		quality = 85
 		tags = "APT, FILE"
@@ -301645,7 +299361,7 @@ rule SIGNATURE_BASE_Explosive_EXE : APT FILE
 		$DLD_E = "DLD-E:"
 
 	condition:
-		all of them and uint16(0)==0x5A4D
+		all of them and uint16( 0 ) == 0x5A4D
 }
 rule SIGNATURE_BASE_Explosion_Sample_1 : FILE
 {
@@ -301656,10 +299372,10 @@ rule SIGNATURE_BASE_Explosion_Sample_1 : FILE
 		date = "2015-04-03"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/5vYaNb"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_volatile_cedar.yar#L14-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_volatile_cedar.yar#L14-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c97693ecb36247bdb44ab3f12dfeae8be4d299bb"
-		logic_hash = "f559880c182cf8061d640f60f18fe607d88a1f22216d93ff1d0ece720bcc94a7"
+		logic_hash = "v1_sha256_f559880c182cf8061d640f60f18fe607d88a1f22216d93ff1d0ece720bcc94a7"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -301678,7 +299394,7 @@ rule SIGNATURE_BASE_Explosion_Sample_1 : FILE
 		$s20 = "Hist :<b> %ws</b>  :%s </br></br>" fullword ascii
 
 	condition:
-		all of them and uint16(0)==0x5A4D
+		all of them and uint16( 0 ) == 0x5A4D
 }
 rule SIGNATURE_BASE_Explosion_Sample_2 : FILE
 {
@@ -301689,10 +299405,10 @@ rule SIGNATURE_BASE_Explosion_Sample_2 : FILE
 		date = "2015-04-03"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/5vYaNb"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_volatile_cedar.yar#L40-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_volatile_cedar.yar#L40-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "62fe6e9e395f70dd632c70d5d154a16ff38dcd29"
-		logic_hash = "db7ead96e0a9b4cf5c5cc885eac421cc11988f60d03f94de5fe828899d115bf0"
+		logic_hash = "v1_sha256_db7ead96e0a9b4cf5c5cc885eac421cc11988f60d03f94de5fe828899d115bf0"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -301704,7 +299420,7 @@ rule SIGNATURE_BASE_Explosion_Sample_2 : FILE
 		$s5 = "SetWinHoK" fullword ascii
 
 	condition:
-		all of them and uint16(0)==0x5A4D
+		all of them and uint16( 0 ) == 0x5A4D
 }
 rule SIGNATURE_BASE_Explosion_Generic_1 : FILE
 {
@@ -301715,9 +299431,9 @@ rule SIGNATURE_BASE_Explosion_Generic_1 : FILE
 		date = "2015-04-03"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_volatile_cedar.yar#L59-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8b6e1e6aa838036989040dfbf4f6f3e347a717967deef740b35d1752b5c91da5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_volatile_cedar.yar#L59-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8b6e1e6aa838036989040dfbf4f6f3e347a717967deef740b35d1752b5c91da5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -301742,7 +299458,7 @@ rule SIGNATURE_BASE_Explosion_Generic_1 : FILE
 		$s16 = ":\\autorun.exe" fullword
 
 	condition:
-		7 of them and uint16(0)==0x5A4D
+		7 of them and uint16( 0 ) == 0x5A4D
 }
 rule SIGNATURE_BASE_Explosive_UA : FILE
 {
@@ -301753,9 +299469,9 @@ rule SIGNATURE_BASE_Explosive_UA : FILE
 		date = "2015-04-03"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/HQRCdw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_volatile_cedar.yar#L90-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ed7fedcf9cda868803c8ace393e08709a747b909178e19cdbb1b116edbb82f9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_volatile_cedar.yar#L90-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ed7fedcf9cda868803c8ace393e08709a747b909178e19cdbb1b116edbb82f9"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -301765,7 +299481,7 @@ rule SIGNATURE_BASE_Explosive_UA : FILE
 		$x1 = "Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727)" fullword
 
 	condition:
-		$x1 and uint16(0)==0x5A4D
+		$x1 and uint16( 0 ) == 0x5A4D
 }
 rule SIGNATURE_BASE_Webshell_Caterpillar_ASPX
 {
@@ -301776,9 +299492,9 @@ rule SIGNATURE_BASE_Webshell_Caterpillar_ASPX
 		date = "2015-04-03"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/emons5"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_volatile_cedar.yar#L106-L126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9df2e4a25052136d6e622273f917bd15df410869a8cf3075c773a14ea62a2a55"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_volatile_cedar.yar#L106-L126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9df2e4a25052136d6e622273f917bd15df410869a8cf3075c773a14ea62a2a55"
 		score = 75
 		quality = 85
 		tags = ""
@@ -301809,9 +299525,9 @@ rule SIGNATURE_BASE_SUSP_Xored_URL_In_EXE : FILE
 		date = "2020-03-09"
 		modified = "2022-09-16"
 		reference = "https://twitter.com/stvemillertime/status/1237035794973560834"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_xor.yar#L4-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2113324ae04a9022be4cf5c615ad231206eeefb5aa87a2236ec3c9deee9e7ec2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_xor.yar#L4-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2113324ae04a9022be4cf5c615ad231206eeefb5aa87a2236ec3c9deee9e7ec2"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -301839,7 +299555,7 @@ rule SIGNATURE_BASE_SUSP_Xored_URL_In_EXE : FILE
 		$fp16 = "HitmanPro.Alert" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (($s1 and #s1>#f1) or ($s2 and #s2>#f2)) and not 1 of ($fp*) and not pe.number_of_signatures>0
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( ( $s1 and #s1 > #f1 ) or ( $s2 and #s2 > #f2 ) ) and not 1 of ( $fp* ) and not pe.number_of_signatures > 0
 }
 rule SIGNATURE_BASE_SUSP_Autocad_Lsp_Malware : FILE
 {
@@ -301850,9 +299566,9 @@ rule SIGNATURE_BASE_SUSP_Autocad_Lsp_Malware : FILE
 		date = "2019-02-04"
 		modified = "2023-12-05"
 		reference = "http://cadablog.blogspot.com/2012/06/acadmedrea-malware-autocad-based-virus.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_autocad_lsp_malware.yar#L1-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4a5fe7016e27431407435541ab71ab00e6fd53418e2ebc19f8764c98728b89a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_autocad_lsp_malware.yar#L1-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4a5fe7016e27431407435541ab71ab00e6fd53418e2ebc19f8764c98728b89a6"
 		score = 65
 		quality = 52
 		tags = "FILE"
@@ -301890,7 +299606,7 @@ rule SIGNATURE_BASE_SUSP_Autocad_Lsp_Malware : FILE
 		$n3 = "vlax-create-object " nocase fullword
 
 	condition:
-		filesize <1MB and uint8(0)==0x28 and (1 of ($s*) or all of ($m*) or all of ($n*))
+		filesize < 1MB and uint8( 0 ) == 0x28 and ( 1 of ( $s* ) or all of ( $m* ) or all of ( $n* ) )
 }
 import "pe"
 
@@ -301903,9 +299619,9 @@ rule SIGNATURE_BASE_APT_Lazarus_Dropper_Jun18_1 : FILE
 		date = "2018-06-01"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_jun18.yar#L13-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "868297209177471f29c9653747d3205f55a14b74a5da64562b20ebeadb14b1cf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_jun18.yar#L13-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_868297209177471f29c9653747d3205f55a14b74a5da64562b20ebeadb14b1cf"
 		score = 60
 		quality = 65
 		tags = "FILE"
@@ -301919,10 +299635,8 @@ rule SIGNATURE_BASE_APT_Lazarus_Dropper_Jun18_1 : FILE
 		$s3 = "update" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <21000KB and (pe.imphash()=="fcac768eff9896d667a7c706d70712ce" or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 21000KB and ( pe.imphash ( ) == "fcac768eff9896d667a7c706d70712ce" or all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_1 : FILE
 {
 	meta:
@@ -301932,9 +299646,9 @@ rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_1 : FILE
 		date = "2018-06-01"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_jun18.yar#L34-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7260f766ffd1122319ca69a6c87b0baa98d5727929f2e063a5b2edb05a44d827"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_jun18.yar#L34-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7260f766ffd1122319ca69a6c87b0baa98d5727929f2e063a5b2edb05a44d827"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -301958,10 +299672,8 @@ rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_1 : FILE
 		$s5 = "Cache-Control: max-age=0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($a*) or 2 of ($c*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $a* ) or 2 of ( $c* ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_2 : FILE
 {
 	meta:
@@ -301971,9 +299683,9 @@ rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_2 : FILE
 		date = "2018-06-01"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_jun18.yar#L68-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b22b8386791e86f787efc40a394bbabdb4a009fc2d1a7b87aaf5039fc977a5bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_jun18.yar#L68-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b22b8386791e86f787efc40a394bbabdb4a009fc2d1a7b87aaf5039fc977a5bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -301986,7 +299698,7 @@ rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_2 : FILE
 		$s4 = "TODO: (c) <Company name>.  All rights reserved." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 2 of them
 }
 rule SIGNATURE_BASE_Fourelementsword_Config_File
 {
@@ -301997,10 +299709,10 @@ rule SIGNATURE_BASE_Fourelementsword_Config_File
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_four_element_sword.yar#L11-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_four_element_sword.yar#L11-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
-		logic_hash = "680e50998093e63a4e3c7d5338ac149efef83cdb41ceb4ce0245e8bd2ab99b84"
+		logic_hash = "v1_sha256_680e50998093e63a4e3c7d5338ac149efef83cdb41ceb4ce0245e8bd2ab99b84"
 		score = 75
 		quality = 85
 		tags = ""
@@ -302025,10 +299737,10 @@ rule SIGNATURE_BASE_Fourelementsword_T9000 : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_four_element_sword.yar#L30-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_four_element_sword.yar#L30-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
-		logic_hash = "1c7b063cbe9d44a9d194a180570f8313460f61560ac2cda5d66e048934170faa"
+		logic_hash = "v1_sha256_1c7b063cbe9d44a9d194a180570f8313460f61560ac2cda5d66e048934170faa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302043,7 +299755,7 @@ rule SIGNATURE_BASE_Fourelementsword_T9000 : FILE
 		$s4 = "igfxtray.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of ($x*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of ( $x* ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Fourelementsword_32DLL : FILE
 {
@@ -302054,10 +299766,10 @@ rule SIGNATURE_BASE_Fourelementsword_32DLL : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_four_element_sword.yar#L51-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_four_element_sword.yar#L51-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
-		logic_hash = "b44870975f126b8603db04b97b748f7a5a75675ffe57037f613c11d6048200b1"
+		logic_hash = "v1_sha256_b44870975f126b8603db04b97b748f7a5a75675ffe57037f613c11d6048200b1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302070,7 +299782,7 @@ rule SIGNATURE_BASE_Fourelementsword_32DLL : FILE
 		$s3 = "32.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <660KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 660KB and $x1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_Fourelementsword_Keyainst_EXE : FILE
 {
@@ -302081,10 +299793,10 @@ rule SIGNATURE_BASE_Fourelementsword_Keyainst_EXE : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_four_element_sword.yar#L70-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_four_element_sword.yar#L70-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
-		logic_hash = "1491de3241a81cce4d80d6dc23886f1d8bf316112c48652a8138aa4cbadbb174"
+		logic_hash = "v1_sha256_1491de3241a81cce4d80d6dc23886f1d8bf316112c48652a8138aa4cbadbb174"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302097,7 +299809,7 @@ rule SIGNATURE_BASE_Fourelementsword_Keyainst_EXE : FILE
 		$s3 = "SHELL32.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <48KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 48KB and $x1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_Fourelementsword_Elevatedll_2 : FILE
 {
@@ -302108,10 +299820,10 @@ rule SIGNATURE_BASE_Fourelementsword_Elevatedll_2 : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_four_element_sword.yar#L89-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_four_element_sword.yar#L89-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
-		logic_hash = "d5fcb2bacfa0a1f78bfbd3fa7ba3084da9a60f1b8b7880c83d8f225312c179b4"
+		logic_hash = "v1_sha256_d5fcb2bacfa0a1f78bfbd3fa7ba3084da9a60f1b8b7880c83d8f225312c179b4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302123,7 +299835,7 @@ rule SIGNATURE_BASE_Fourelementsword_Elevatedll_2 : FILE
 		$s3 = "GetNativeSystemInfo" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <25KB and $s1) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 25KB and $s1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_Fourelementsword_Fslapi_Dll_Gui : FILE
 {
@@ -302134,10 +299846,10 @@ rule SIGNATURE_BASE_Fourelementsword_Fslapi_Dll_Gui : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_four_element_sword.yar#L106-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_four_element_sword.yar#L106-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
-		logic_hash = "909b187f864a240268d0ffcef904b85cd1eaad97dd3a3a808aad58968fbb76c2"
+		logic_hash = "v1_sha256_909b187f864a240268d0ffcef904b85cd1eaad97dd3a3a808aad58968fbb76c2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302149,7 +299861,7 @@ rule SIGNATURE_BASE_Fourelementsword_Fslapi_Dll_Gui : FILE
 		$s3 = "RichOX" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <12KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 12KB and all of them )
 }
 rule SIGNATURE_BASE_Fourelementsword_Powershell_Start
 {
@@ -302160,10 +299872,10 @@ rule SIGNATURE_BASE_Fourelementsword_Powershell_Start
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_four_element_sword.yar#L123-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_four_element_sword.yar#L123-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
-		logic_hash = "7b1986845d97dcd11c8baddb0b49350ad30c6fff98840275befef4ad0b906b54"
+		logic_hash = "v1_sha256_7b1986845d97dcd11c8baddb0b49350ad30c6fff98840275befef4ad0b906b54"
 		score = 75
 		quality = 85
 		tags = ""
@@ -302185,10 +299897,10 @@ rule SIGNATURE_BASE_Fourelementsword_Resn32Dll
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_four_element_sword.yar#L139-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_four_element_sword.yar#L139-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
-		logic_hash = "9658ae3d1267993551cfb939f75f3d78de18cbeb2f524c2576b849103f3cacdc"
+		logic_hash = "v1_sha256_9658ae3d1267993551cfb939f75f3d78de18cbeb2f524c2576b849103f3cacdc"
 		score = 75
 		quality = 85
 		tags = ""
@@ -302211,9 +299923,9 @@ rule SIGNATURE_BASE_Fourelementsword_Elevatedll : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_four_element_sword.yar#L158-L179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d110bae02f00d14c5a71ecf5991e9fc38b29d8056d1e551dc36376875d2e1333"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_four_element_sword.yar#L158-L179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d110bae02f00d14c5a71ecf5991e9fc38b29d8056d1e551dc36376875d2e1333"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302230,7 +299942,7 @@ rule SIGNATURE_BASE_Fourelementsword_Elevatedll : FILE
 		$s3 = "Sophos" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of ($x*) and all of ($s*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of ( $x* ) and all of ( $s* ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Dubnium_Sample_1 : FILE
 {
@@ -302241,9 +299953,9 @@ rule SIGNATURE_BASE_Dubnium_Sample_1 : FILE
 		date = "2016-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dubnium.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "94763f42dacbeede9a72c3ecc222164a5808bd74c5d2d783c76831221a9c30c8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dubnium.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_94763f42dacbeede9a72c3ecc222164a5808bd74c5d2d783c76831221a9c30c8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302255,7 +299967,7 @@ rule SIGNATURE_BASE_Dubnium_Sample_1 : FILE
 		$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE_Dubnium_Sample_2 : FILE
 {
@@ -302266,9 +299978,9 @@ rule SIGNATURE_BASE_Dubnium_Sample_2 : FILE
 		date = "2016-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dubnium.yar#L26-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b633a7e002609fa78b0de8fb818af1b47fbe77497d161b6b41602fb34780ca8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dubnium.yar#L26-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b633a7e002609fa78b0de8fb818af1b47fbe77497d161b6b41602fb34780ca8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302280,7 +299992,7 @@ rule SIGNATURE_BASE_Dubnium_Sample_2 : FILE
 		$s2 = "SPMUVR" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Dubnium_Sample_3 : FILE
 {
@@ -302291,9 +300003,9 @@ rule SIGNATURE_BASE_Dubnium_Sample_3 : FILE
 		date = "2016-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dubnium.yar#L42-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "851efb71cd80040fdd13d9961d1e0084421c783afc43417ff1ac3ed023a73ae1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dubnium.yar#L42-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_851efb71cd80040fdd13d9961d1e0084421c783afc43417ff1ac3ed023a73ae1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302311,7 +300023,7 @@ rule SIGNATURE_BASE_Dubnium_Sample_3 : FILE
 		$s4 = "Dropped" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 5 of them
 }
 rule SIGNATURE_BASE_Dubnium_Sample_5 : FILE
 {
@@ -302322,9 +300034,9 @@ rule SIGNATURE_BASE_Dubnium_Sample_5 : FILE
 		date = "2016-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dubnium.yar#L64-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f84f502ba9a4fe304851badfa98d9e8500cdef472d4358cfd327365ac04dda3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dubnium.yar#L64-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f84f502ba9a4fe304851badfa98d9e8500cdef472d4358cfd327365ac04dda3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302345,7 +300057,7 @@ rule SIGNATURE_BASE_Dubnium_Sample_5 : FILE
 		$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
 }
 rule SIGNATURE_BASE_Dubnium_Sample_6 : FILE
 {
@@ -302356,9 +300068,9 @@ rule SIGNATURE_BASE_Dubnium_Sample_6 : FILE
 		date = "2016-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dubnium.yar#L89-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3425734b3259ebd5390cf16d2e394a4cc735dc3fc9fcc627b46bcc77729e465e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dubnium.yar#L89-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3425734b3259ebd5390cf16d2e394a4cc735dc3fc9fcc627b46bcc77729e465e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302374,7 +300086,7 @@ rule SIGNATURE_BASE_Dubnium_Sample_6 : FILE
 		$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them
 }
 rule SIGNATURE_BASE_Dubnium_Sample_7 : FILE
 {
@@ -302385,9 +300097,9 @@ rule SIGNATURE_BASE_Dubnium_Sample_7 : FILE
 		date = "2016-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dubnium.yar#L109-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "76cf4acee025fcae1dec975a124f4bf808f1f09f99f7fa6a4e965febd6a89e3a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dubnium.yar#L109-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_76cf4acee025fcae1dec975a124f4bf808f1f09f99f7fa6a4e965febd6a89e3a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302407,7 +300119,7 @@ rule SIGNATURE_BASE_Dubnium_Sample_7 : FILE
 		$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
 }
 rule SIGNATURE_BASE_Dubnium_Sample_Sshopenssl : FILE
 {
@@ -302418,9 +300130,9 @@ rule SIGNATURE_BASE_Dubnium_Sample_Sshopenssl : FILE
 		date = "2016-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dubnium.yar#L133-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5cad6b0785e8c9627f1b9678dc6206cf36cd33ead2283f77655fdb0ea36249e9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dubnium.yar#L133-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5cad6b0785e8c9627f1b9678dc6206cf36cd33ead2283f77655fdb0ea36249e9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302437,7 +300149,7 @@ rule SIGNATURE_BASE_Dubnium_Sample_Sshopenssl : FILE
 		$s2 = "OpenSSL: FATAL" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
 }
 rule SIGNATURE_BASE_XMRIG_Monero_Miner : HIGHVOL FILE
 {
@@ -302448,9 +300160,9 @@ rule SIGNATURE_BASE_XMRIG_Monero_Miner : HIGHVOL FILE
 		date = "2018-01-04"
 		modified = "2022-11-10"
 		reference = "https://github.com/xmrig/xmrig/releases"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pua_xmrig_monero_miner.yar#L11-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "532e602dfc8e44326e381d0e2a189b60bc4d4f2b310169767b2326e01606a542"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pua_xmrig_monero_miner.yar#L11-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_532e602dfc8e44326e381d0e2a189b60bc4d4f2b310169767b2326e01606a542"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -302468,7 +300180,7 @@ rule SIGNATURE_BASE_XMRIG_Monero_Miner : HIGHVOL FILE
 		$s5 = "XMRig/%s libuv/%s%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and filesize <10MB and 2 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and filesize < 10MB and 2 of them
 }
 rule SIGNATURE_BASE_XMRIG_Monero_Miner_Config : FILE
 {
@@ -302479,9 +300191,9 @@ rule SIGNATURE_BASE_XMRIG_Monero_Miner_Config : FILE
 		date = "2018-01-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/xmrig/xmrig/releases"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pua_xmrig_monero_miner.yar#L35-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5df14af366cdb0a5bf6fd88b50876fd78abfe0b795cf10af8fab0d23a54f700f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pua_xmrig_monero_miner.yar#L35-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5df14af366cdb0a5bf6fd88b50876fd78abfe0b795cf10af8fab0d23a54f700f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302495,7 +300207,7 @@ rule SIGNATURE_BASE_XMRIG_Monero_Miner_Config : FILE
 		$s8 = "\"algo\": \"cryptonight\",  // cryptonight (default) or cryptonight-lite" fullword ascii
 
 	condition:
-		( uint16(0)==0x0a7b or uint16(0)==0x0d7b) and filesize <5KB and 1 of them
+		( uint16( 0 ) == 0x0a7b or uint16( 0 ) == 0x0d7b ) and filesize < 5KB and 1 of them
 }
 rule SIGNATURE_BASE_PUA_LNX_XMRIG_Cryptominer : FILE
 {
@@ -302506,9 +300218,9 @@ rule SIGNATURE_BASE_PUA_LNX_XMRIG_Cryptominer : FILE
 		date = "2018-06-28"
 		modified = "2023-01-06"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pua_xmrig_monero_miner.yar#L53-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "501bc5b2d38882f48d1ef972dbbd379afb89f2e7c9bf69192c7bee2e19384816"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pua_xmrig_monero_miner.yar#L53-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_501bc5b2d38882f48d1ef972dbbd379afb89f2e7c9bf69192c7bee2e19384816"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302522,7 +300234,7 @@ rule SIGNATURE_BASE_PUA_LNX_XMRIG_Cryptominer : FILE
 		$s4 = ".nicehash.com" ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <8000KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x457f and filesize < 8000KB and ( 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_SUSP_XMRIG_String : FILE
 {
@@ -302533,9 +300245,9 @@ rule SIGNATURE_BASE_SUSP_XMRIG_String : FILE
 		date = "2018-12-28"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pua_xmrig_monero_miner.yar#L72-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d2c3145c50939e7f407125f7b9312161724b7b1a6fcbf7e27d049e49e982c7e9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pua_xmrig_monero_miner.yar#L72-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d2c3145c50939e7f407125f7b9312161724b7b1a6fcbf7e27d049e49e982c7e9"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -302545,7 +300257,7 @@ rule SIGNATURE_BASE_SUSP_XMRIG_String : FILE
 		$x1 = "xmrig.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
 }
 rule SIGNATURE_BASE_Ping_Command_In_EXE : FILE
 {
@@ -302556,9 +300268,9 @@ rule SIGNATURE_BASE_Ping_Command_In_EXE : FILE
 		date = "2016-11-03"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1ea24774471eade7b7c50f0eae520e2b30dbec693e162b83ab0074465f179372"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1ea24774471eade7b7c50f0eae520e2b30dbec693e162b83ab0074465f179372"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -302568,7 +300280,7 @@ rule SIGNATURE_BASE_Ping_Command_In_EXE : FILE
 		$x1 = "cmd /c ping 127.0.0.1 -n " ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_Googlebot_Useragent : FILE
 {
@@ -302579,9 +300291,9 @@ rule SIGNATURE_BASE_Googlebot_Useragent : FILE
 		date = "2017-01-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L17-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa6cc3625d3740b91d7f1193cea0bdb621ae9445e42300123b01e322f715b976"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L17-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa6cc3625d3740b91d7f1193cea0bdb621ae9445e42300123b01e322f715b976"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -302592,7 +300304,7 @@ rule SIGNATURE_BASE_Googlebot_Useragent : FILE
 		$fp1 = "McAfee, Inc." wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and $x1 and not 1 of ($fp*))
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and $x1 and not 1 of ( $fp* ) )
 }
 rule SIGNATURE_BASE_Gen_Net_Localgroup_Administrators_Add_Command : FILE
 {
@@ -302603,9 +300315,9 @@ rule SIGNATURE_BASE_Gen_Net_Localgroup_Administrators_Add_Command : FILE
 		date = "2017-07-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L34-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "af4d7c8586022583e2019bbdc3638704e1d237b25e3c214f3bc2db64c58c8bd3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L34-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_af4d7c8586022583e2019bbdc3638704e1d237b25e3c214f3bc2db64c58c8bd3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -302615,7 +300327,7 @@ rule SIGNATURE_BASE_Gen_Net_Localgroup_Administrators_Add_Command : FILE
 		$x1 = /net localgroup administrators [a-zA-Z0-9]{1,16} \/add/ nocase ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them )
 }
 rule SIGNATURE_BASE_Suspicious_Script_Running_From_HTTP
 {
@@ -302626,9 +300338,9 @@ rule SIGNATURE_BASE_Suspicious_Script_Running_From_HTTP
 		date = "2017-08-20"
 		modified = "2023-12-05"
 		reference = "https://www.hybrid-analysis.com/sample/a112274e109c5819d54aa8de89b0e707b243f4929a83e77439e3ff01ed218a35?environmentId=100"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L48-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49ead238b9153886ddbcfe37939628fd848283373e2807797d0849559ebecf6c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L48-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49ead238b9153886ddbcfe37939628fd848283373e2807797d0849559ebecf6c"
 		score = 50
 		quality = 85
 		tags = ""
@@ -302652,9 +300364,9 @@ rule SIGNATURE_BASE_Reconcommands_In_File : FILE
 		date = "2017-12-11"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/haroonmeer/status/939099379834658817"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L66-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "73b4bcf76f42a6bf9c3d9dfe3f4e754ce2856e03a47cfd35388d47290209e65d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L66-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_73b4bcf76f42a6bf9c3d9dfe3f4e754ce2856e03a47cfd35388d47290209e65d"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -302671,7 +300383,7 @@ rule SIGNATURE_BASE_Reconcommands_In_File : FILE
 		$ = "nslookup"
 
 	condition:
-		filesize <5KB and 4 of them
+		filesize < 5KB and 4 of them
 }
 rule SIGNATURE_BASE_VBS_Dropper_Script_Dec17_1 : FILE
 {
@@ -302682,9 +300394,9 @@ rule SIGNATURE_BASE_VBS_Dropper_Script_Dec17_1 : FILE
 		date = "2018-01-01"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L88-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f3c55bd6bf382891263887e46a794329c78bff87b7685088911261fc3b3b133d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L88-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f3c55bd6bf382891263887e46a794329c78bff87b7685088911261fc3b3b133d"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -302699,7 +300411,7 @@ rule SIGNATURE_BASE_VBS_Dropper_Script_Dec17_1 : FILE
 		$a1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
 
 	condition:
-		filesize <600KB and $a1 and 1 of ($s*)
+		filesize < 600KB and $a1 and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_SUSP_PDB_Strings_Keylogger_Backdoor : HIGHVOL FILE
 {
@@ -302710,9 +300422,9 @@ rule SIGNATURE_BASE_SUSP_PDB_Strings_Keylogger_Backdoor : HIGHVOL FILE
 		date = "2018-03-23"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L109-L130"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9a842ff8cd8be98a2e37a81706a9c594e8bf1bcc6bd3cedfe4747cd52f6044f5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L109-L130"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9a842ff8cd8be98a2e37a81706a9c594e8bf1bcc6bd3cedfe4747cd52f6044f5"
 		score = 65
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -302729,7 +300441,7 @@ rule SIGNATURE_BASE_SUSP_PDB_Strings_Keylogger_Backdoor : HIGHVOL FILE
 		$ = "\\New Backdoor"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Microsoft_Copyright_String_Anomaly_2 : FILE
 {
@@ -302740,9 +300452,9 @@ rule SIGNATURE_BASE_SUSP_Microsoft_Copyright_String_Anomaly_2 : FILE
 		date = "2018-05-11"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L132-L146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "60bc5d8d0853f474b81d2274a65977a12a481e4b669b38ae47a325eeb60d2735"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L132-L146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_60bc5d8d0853f474b81d2274a65977a12a481e4b669b38ae47a325eeb60d2735"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -302753,7 +300465,7 @@ rule SIGNATURE_BASE_SUSP_Microsoft_Copyright_String_Anomaly_2 : FILE
 		$s1 = "Microsoft(C) Windows(C) Operating System" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_LNK_File_Appdata_Roaming : FILE
 {
@@ -302764,9 +300476,9 @@ rule SIGNATURE_BASE_SUSP_LNK_File_Appdata_Roaming : FILE
 		date = "2018-05-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L148-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e5c78d3fe3fcdbfb097f833fbb1e15ad1f79e63b330eaba754d8b5296b5165a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L148-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e5c78d3fe3fcdbfb097f833fbb1e15ad1f79e63b330eaba754d8b5296b5165a"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -302779,7 +300491,7 @@ rule SIGNATURE_BASE_SUSP_LNK_File_Appdata_Roaming : FILE
               00 55 00 73 00 65 00 72 00 73 00 5C }
 
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and ( filesize <1KB and all of them )
+		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and ( filesize < 1KB and all of them )
 }
 rule SIGNATURE_BASE_SUSP_LNK_File_Pathtraversal : FILE
 {
@@ -302790,9 +300502,9 @@ rule SIGNATURE_BASE_SUSP_LNK_File_Pathtraversal : FILE
 		date = "2018-05-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L170-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9935c454518abe7fd4ec4f09e36e4200ec7c9f3b3ad004e9b49d60c08f508236"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L170-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9935c454518abe7fd4ec4f09e36e4200ec7c9f3b3ad004e9b49d60c08f508236"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -302802,7 +300514,7 @@ rule SIGNATURE_BASE_SUSP_LNK_File_Pathtraversal : FILE
 		$s1 = "..\\..\\..\\..\\..\\"
 
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and ( filesize <1KB and all of them )
+		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and ( filesize < 1KB and all of them )
 }
 rule SIGNATURE_BASE_SUSP_Script_Obfuscation_Char_Concat
 {
@@ -302813,9 +300525,9 @@ rule SIGNATURE_BASE_SUSP_Script_Obfuscation_Char_Concat
 		date = "2018-10-04"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L188-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "28b648e0e1c22fefa49a937f40bd4ed09c5d3894ff059979bad69e8bc98fcac2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L188-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_28b648e0e1c22fefa49a937f40bd4ed09c5d3894ff059979bad69e8bc98fcac2"
 		score = 65
 		quality = 85
 		tags = ""
@@ -302836,9 +300548,9 @@ rule SIGNATURE_BASE_SUSP_Powershell_IEX_Download_Combo
 		date = "2018-10-04"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L202-L218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a1507859354e0e0d9284befcf777c4d3883496eb96524a246a1df4f3a247aa9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L202-L218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a1507859354e0e0d9284befcf777c4d3883496eb96524a246a1df4f3a247aa9"
 		score = 65
 		quality = 85
 		tags = ""
@@ -302851,7 +300563,7 @@ rule SIGNATURE_BASE_SUSP_Powershell_IEX_Download_Combo
 		$fp3 = "/appveyor/" ascii
 
 	condition:
-		$x1 and not 1 of ($fp*)
+		$x1 and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Win32Dll_String : FILE
 {
@@ -302862,9 +300574,9 @@ rule SIGNATURE_BASE_SUSP_Win32Dll_String : FILE
 		date = "2018-10-24"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@Sebdraven/apt-sidewinder-changes-theirs-ttps-to-install-their-backdoor-f92604a2739"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L220-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "514596e078483920cedf0091cd769d8462acfd39956c3ed3e12d630b02ebb7cc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L220-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_514596e078483920cedf0091cd769d8462acfd39956c3ed3e12d630b02ebb7cc"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -302874,7 +300586,7 @@ rule SIGNATURE_BASE_SUSP_Win32Dll_String : FILE
 		$s1 = "win32dll.dll" fullword ascii
 
 	condition:
-		filesize <60KB and all of them
+		filesize < 60KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_Modified_Systemexefilename_In_File : FILE
 {
@@ -302885,9 +300597,9 @@ rule SIGNATURE_BASE_SUSP_Modified_Systemexefilename_In_File : FILE
 		date = "2018-12-11"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L234-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "45c01024c4e6a3563cd27d8a78e2236d49aa795d24f322774a14b4c7289830c4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L234-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_45c01024c4e6a3563cd27d8a78e2236d49aa795d24f322774a14b4c7289830c4"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -302898,7 +300610,7 @@ rule SIGNATURE_BASE_SUSP_Modified_Systemexefilename_In_File : FILE
 		$s1 = "svchosts.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_JAVA_Class_With_VBS_Content : FILE
 {
@@ -302909,9 +300621,9 @@ rule SIGNATURE_BASE_SUSP_JAVA_Class_With_VBS_Content : FILE
 		date = "2019-01-03"
 		modified = "2023-12-05"
 		reference = "https://www.menlosecurity.com/blog/a-jar-full-of-problems-for-financial-services-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L250-L267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d73392437edd5e974809137c5158c17631e8a7a13464aa4df5f2dd1fd090042"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L250-L267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d73392437edd5e974809137c5158c17631e8a7a13464aa4df5f2dd1fd090042"
 		score = 60
 		quality = 83
 		tags = "FILE"
@@ -302924,7 +300636,7 @@ rule SIGNATURE_BASE_SUSP_JAVA_Class_With_VBS_Content : FILE
 		$s3 = "wscript" fullword ascii nocase
 
 	condition:
-		( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and filesize <100KB and $a1 and 3 of ($s*)
+		( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and filesize < 100KB and $a1 and 3 of ( $s* )
 }
 rule SIGNATURE_BASE_SUSP_RAR_With_PDF_Script_Obfuscation : FILE
 {
@@ -302935,9 +300647,9 @@ rule SIGNATURE_BASE_SUSP_RAR_With_PDF_Script_Obfuscation : FILE
 		date = "2019-04-06"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L269-L285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "05e9fd7620a70a490548d4562c80497bcf888e493b8e1188e0a0e0c274e2a7e5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L269-L285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_05e9fd7620a70a490548d4562c80497bcf888e493b8e1188e0a0e0c274e2a7e5"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -302951,7 +300663,7 @@ rule SIGNATURE_BASE_SUSP_RAR_With_PDF_Script_Obfuscation : FILE
 		$s5 = ".pdf.exe" ascii
 
 	condition:
-		uint32(0)==0x21726152 and 1 of them
+		uint32( 0 ) == 0x21726152 and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Netsh_Portproxy_Command
 {
@@ -302962,9 +300674,9 @@ rule SIGNATURE_BASE_SUSP_Netsh_Portproxy_Command
 		date = "2019-04-20"
 		modified = "2023-12-05"
 		reference = "https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L287-L300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dbf82a908e77886af1c31c51f5f6684015cbcb22bf28876c2e1b0dd1ea5bd2b4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L287-L300"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dbf82a908e77886af1c31c51f5f6684015cbcb22bf28876c2e1b0dd1ea5bd2b4"
 		score = 65
 		quality = 85
 		tags = ""
@@ -302985,9 +300697,9 @@ rule SIGNATURE_BASE_SUSP_Dropperbackdoor_Keywords : FILE
 		date = "2019-04-24"
 		modified = "2023-12-05"
 		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L302-L314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e83fa95bb2b9ac821d0a00af23834495066ad2cad38ef4f4dcc81aee75415d74"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L302-L314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e83fa95bb2b9ac821d0a00af23834495066ad2cad38ef4f4dcc81aee75415d74"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -302997,7 +300709,7 @@ rule SIGNATURE_BASE_SUSP_Dropperbackdoor_Keywords : FILE
 		$x4 = "DropperBackdoor" fullword wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_SFX_Cmd : FILE
 {
@@ -303008,9 +300720,9 @@ rule SIGNATURE_BASE_SUSP_SFX_Cmd : FILE
 		date = "2018-09-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L316-L328"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "592de6a2165396c4ae8f494e26e56d0a759903b51167b1531b791897dce66868"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L316-L328"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_592de6a2165396c4ae8f494e26e56d0a759903b51167b1531b791897dce66868"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -303020,7 +300732,7 @@ rule SIGNATURE_BASE_SUSP_SFX_Cmd : FILE
 		$s1 = /RunProgram=\"hidcon:[a-zA-Z0-9]{1,16}.cmd/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_XMRIG_Reference : FILE
 {
@@ -303031,9 +300743,9 @@ rule SIGNATURE_BASE_SUSP_XMRIG_Reference : FILE
 		date = "2019-06-20"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/itaitevet/status/1141677424045953024"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L330-L342"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c1e6f5fc390a8ada0688885bba7ed90372915deba5a5e7e5b0cd17ec450ce240"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L330-L342"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c1e6f5fc390a8ada0688885bba7ed90372915deba5a5e7e5b0cd17ec450ce240"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -303042,7 +300754,7 @@ rule SIGNATURE_BASE_SUSP_XMRIG_Reference : FILE
 		$x1 = "\\xmrig\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Just_EICAR : FILE
 {
@@ -303053,9 +300765,9 @@ rule SIGNATURE_BASE_SUSP_Just_EICAR : FILE
 		date = "2019-03-24"
 		modified = "2023-12-05"
 		reference = "http://2016.eicar.org/85-0-Download.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L344-L357"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a48fc3542fb07131fe0a2e25277009d21b9ca7c9e112873249e5b9c31511af79"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L344-L357"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a48fc3542fb07131fe0a2e25277009d21b9ca7c9e112873249e5b9c31511af79"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -303065,7 +300777,7 @@ rule SIGNATURE_BASE_SUSP_Just_EICAR : FILE
 		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
 
 	condition:
-		uint16(0)==0x3558 and filesize <70 and $s1 at 0
+		uint16( 0 ) == 0x3558 and filesize < 70 and $s1 at 0
 }
 rule SIGNATURE_BASE_SUSP_PDB_Path_Keywords : FILE
 {
@@ -303076,9 +300788,9 @@ rule SIGNATURE_BASE_SUSP_PDB_Path_Keywords : FILE
 		date = "2019-10-04"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/stvemillertime/status/1179832666285326337?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L359-L385"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "274b4b40190b8f7e3d123fad63e2bb6b2114a3dbef062791d442109cac149b08"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L359-L385"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_274b4b40190b8f7e3d123fad63e2bb6b2114a3dbef062791d442109cac149b08"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -303102,7 +300814,7 @@ rule SIGNATURE_BASE_SUSP_PDB_Path_Keywords : FILE
 		$ = "Release\\cve_" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Disable_ETW_Jun20_1
 {
@@ -303113,9 +300825,9 @@ rule SIGNATURE_BASE_SUSP_Disable_ETW_Jun20_1
 		date = "2020-06-06"
 		modified = "2023-12-05"
 		reference = "https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L387-L405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "182ad2512bcfbcd92d13380113b32982eb367e458019f07038a12f494dfbebb6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L387-L405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_182ad2512bcfbcd92d13380113b32982eb367e458019f07038a12f494dfbebb6"
 		score = 65
 		quality = 85
 		tags = ""
@@ -303130,7 +300842,7 @@ rule SIGNATURE_BASE_SUSP_Disable_ETW_Jun20_1
 		$sb5 = " -Value 0 "
 
 	condition:
-		1 of ($x*) or 3 of them
+		1 of ( $x* ) or 3 of them
 }
 rule SIGNATURE_BASE_SUSP_PE_Discord_Attachment_Oct21_1 : FILE
 {
@@ -303141,9 +300853,9 @@ rule SIGNATURE_BASE_SUSP_PE_Discord_Attachment_Oct21_1 : FILE
 		date = "2021-10-12"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L407-L421"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4d84ec50738f4c7aca8e77c3aabdcd77f3071733a2245a58283f070f2b220599"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L407-L421"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4d84ec50738f4c7aca8e77c3aabdcd77f3071733a2245a58283f070f2b220599"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -303152,7 +300864,7 @@ rule SIGNATURE_BASE_SUSP_PE_Discord_Attachment_Oct21_1 : FILE
 		$x1 = "https://cdn.discordapp.com/attachments/" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1 : FILE
 {
@@ -303163,9 +300875,9 @@ rule SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1 : FILE
 		date = "2021-10-12"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_strings.yar#L423-L448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1ea5a83e91b5c5b4b8a1d507c365bc1583394c97a28b7d7a576f085854676769"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_strings.yar#L423-L448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1ea5a83e91b5c5b4b8a1d507c365bc1583394c97a28b7d7a576f085854676769"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -303182,7 +300894,7 @@ rule SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1 : FILE
 		$enc_r01 = "stnemhcatta/moc.ppadrocsid.ndc" ascii wide
 
 	condition:
-		filesize <5000KB and 1 of them
+		filesize < 5000KB and 1 of them
 }
 rule SIGNATURE_BASE_APT_Apt_Duqu2_Loaders : FILE
 {
@@ -303193,9 +300905,9 @@ rule SIGNATURE_BASE_APT_Apt_Duqu2_Loaders : FILE
 		date = "2015-06-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_kaspersky_duqu2.yar#L10-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "79f205745e61b55c43c239d9da9086fd72312ea2741351183d32f7c227174ff8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_kaspersky_duqu2.yar#L10-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_79f205745e61b55c43c239d9da9086fd72312ea2741351183d32f7c227174ff8"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -303220,7 +300932,7 @@ rule SIGNATURE_BASE_APT_Apt_Duqu2_Loaders : FILE
 		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
 
 	condition:
-		(( uint16(0)==0x5a4d) and (( any of ($a*)) or ( all of ($b*)) or ( all of ($c*))) and filesize <100000) or (( uint32(0)==0xe011cfd0) and (( any of ($a*)) or ( all of ($b*)) or ( all of ($c*)) or ( any of ($d*))) and filesize <20000000)
+		(( uint16( 0 ) == 0x5a4d ) and ( ( any of ( $a* ) ) or ( all of ( $b* ) ) or ( all of ( $c* ) ) ) and filesize < 100000 ) or ( ( uint32( 0 ) == 0xe011cfd0 ) and ( ( any of ( $a* ) ) or ( all of ( $b* ) ) or ( all of ( $c* ) ) or ( any of ( $d* ) ) ) and filesize < 20000000 )
 }
 rule SIGNATURE_BASE_APT_Apt_Duqu2_Drivers : FILE
 {
@@ -303231,9 +300943,9 @@ rule SIGNATURE_BASE_APT_Apt_Duqu2_Drivers : FILE
 		date = "2015-06-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_kaspersky_duqu2.yar#L40-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "023a51408f86814a8f810d0f89b185aca07dd60a1abb6de47f86ad8eeda4c4c4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_kaspersky_duqu2.yar#L40-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_023a51408f86814a8f810d0f89b185aca07dd60a1abb6de47f86ad8eeda4c4c4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303249,7 +300961,7 @@ rule SIGNATURE_BASE_APT_Apt_Duqu2_Drivers : FILE
 		$b3 = "NdisOpenProtocolConfiguration"
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($a*)) and (2 of ($b*)) and filesize <100000
+		uint16( 0 ) == 0x5A4D and ( any of ( $a* ) ) and ( 2 of ( $b* ) ) and filesize < 100000
 }
 rule SIGNATURE_BASE_Duqu2_Generic1 : FILE
 {
@@ -303260,9 +300972,9 @@ rule SIGNATURE_BASE_Duqu2_Generic1 : FILE
 		date = "2015-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/7yKyOj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_kaspersky_duqu2.yar#L61-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "742934198391bd30da654bf8efedc2a18c58dd0de357b2bcdbdbe8066187b0c2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_kaspersky_duqu2.yar#L61-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_742934198391bd30da654bf8efedc2a18c58dd0de357b2bcdbdbe8066187b0c2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303289,7 +301001,7 @@ rule SIGNATURE_BASE_Duqu2_Generic1 : FILE
 		$s4 = "GetCommandLineW" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
 }
 rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Procexp : FILE
 {
@@ -303300,9 +301012,9 @@ rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Procexp : FILE
 		date = "2015-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/7yKyOj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_kaspersky_duqu2.yar#L92-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd63f0eebc88fa0737905f20dc30dc968df81b7976a86ed8ed5646f7708c4b4a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_kaspersky_duqu2.yar#L92-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd63f0eebc88fa0737905f20dc30dc968df81b7976a86ed8ed5646f7708c4b4a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303321,7 +301033,7 @@ rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Procexp : FILE
 		$s3 = "Process Explorer" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*)) and ( all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) ) and ( all of ( $s* ) )
 }
 rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Samsungprint : FILE
 {
@@ -303332,10 +301044,10 @@ rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Samsungprint : FILE
 		date = "2015-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/7yKyOj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_kaspersky_duqu2.yar#L116-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_kaspersky_duqu2.yar#L116-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
-		logic_hash = "9b2d80cfe3c47ac315b76c773acc3290668e06e4bbd99402e203b72af593fab8"
+		logic_hash = "v1_sha256_9b2d80cfe3c47ac315b76c773acc3290668e06e4bbd99402e203b72af593fab8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303350,7 +301062,7 @@ rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Samsungprint : FILE
 		$s5 = "Samsung Electronics Co., Ltd." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <82KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 82KB and all of them
 }
 rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Msi3_32 : FILE
 {
@@ -303361,10 +301073,10 @@ rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Msi3_32 : FILE
 		date = "2015-06-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/7yKyOj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_kaspersky_duqu2.yar#L136-L157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_kaspersky_duqu2.yar#L136-L157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
-		logic_hash = "718223d1ff82ffa0f3204e0cdaf0d441ed133f1f069d9ba2eb818bd3445f63ca"
+		logic_hash = "v1_sha256_718223d1ff82ffa0f3204e0cdaf0d441ed133f1f069d9ba2eb818bd3445f63ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303382,7 +301094,7 @@ rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Msi3_32 : FILE
 		$s8 = "Operating System" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <72KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 72KB and all of them
 }
 rule SIGNATURE_BASE_VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1 : CVE_2022_26138
 {
@@ -303393,9 +301105,9 @@ rule SIGNATURE_BASE_VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1 : CV
 		date = "2022-07-21"
 		modified = "2023-12-05"
 		reference = "https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_confluence_questions_plugin_cve_2022_26138.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c164bd3d9ed1e155d51112e14340b814f6ea782604540c84a6e9efb5c6041156"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_confluence_questions_plugin_cve_2022_26138.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c164bd3d9ed1e155d51112e14340b814f6ea782604540c84a6e9efb5c6041156"
 		score = 50
 		quality = 85
 		tags = "CVE-2022-26138"
@@ -303411,7 +301123,7 @@ rule SIGNATURE_BASE_VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1 : CV
                       2E 70 72 6F 70 65 72 74 69 65 73 }
 
 	condition:
-		1 of ($x*) or ($jar_marker and 1 of ($jar_size*))
+		1 of ( $x* ) or ( $jar_marker and 1 of ( $jar_size* ) )
 }
 rule SIGNATURE_BASE_CVE_2015_1674_CNGSYS : CVE_2015_1674 FILE
 {
@@ -303422,10 +301134,10 @@ rule SIGNATURE_BASE_CVE_2015_1674_CNGSYS : CVE_2015_1674 FILE
 		date = "2015-05-14"
 		modified = "2023-12-05"
 		reference = "http://www.binvul.com/viewthread.php?tid=508"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2015_1674.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2015_1674.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
-		logic_hash = "d751ef739a6fb8b0871f92cb4aba21544f444944710407c723f0452dc3b85522"
+		logic_hash = "v1_sha256_d751ef739a6fb8b0871f92cb4aba21544f444944710407c723f0452dc3b85522"
 		score = 75
 		quality = 85
 		tags = "CVE-2015-1674, FILE"
@@ -303439,7 +301151,7 @@ rule SIGNATURE_BASE_CVE_2015_1674_CNGSYS : CVE_2015_1674 FILE
 		$s5 = "ntdll.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
 }
 rule SIGNATURE_BASE_Lightftp_Fftp_X86_64 : FILE
 {
@@ -303450,9 +301162,9 @@ rule SIGNATURE_BASE_Lightftp_Fftp_X86_64 : FILE
 		date = "2015-05-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/hfiref0x/LightFTP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pup_lightftp.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f29a98a4014fc6c026aef4054bc2bee7bde2e9ad7f26f2368fdf0949f50847bb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pup_lightftp.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f29a98a4014fc6c026aef4054bc2bee7bde2e9ad7f26f2368fdf0949f50847bb"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -303468,7 +301180,7 @@ rule SIGNATURE_BASE_Lightftp_Fftp_X86_64 : FILE
 		$s5 = "250 Requested file action okay, completed." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and 4 of them
 }
 rule SIGNATURE_BASE_Lightftp_Config : FILE
 {
@@ -303479,10 +301191,10 @@ rule SIGNATURE_BASE_Lightftp_Config : FILE
 		date = "2015-05-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/hfiref0x/LightFTP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pup_lightftp.yar#L23-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pup_lightftp.yar#L23-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ce9821213538d39775af4a48550eefa3908323c5"
-		logic_hash = "1e8c06dac9a5910816703ed15bef83116d9e2d9e612fda69697170ed98ee5f60"
+		logic_hash = "v1_sha256_1e8c06dac9a5910816703ed15bef83116d9e2d9e612fda69697170ed98ee5f60"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303497,7 +301209,7 @@ rule SIGNATURE_BASE_Lightftp_Config : FILE
 		$s11 = "pswd=" fullword wide
 
 	condition:
-		uint16(0)==0xfeff and filesize <1KB and all of them
+		uint16( 0 ) == 0xfeff and filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 : FILE
 {
@@ -303508,9 +301220,9 @@ rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 : FILE
 		date = "2020-10-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_vhd_ransomware.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "95c56c5111bb227da8f8a3f8aa4f23e1348bc76ff76a05fc3cae89f9fad1bb52"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_vhd_ransomware.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_95c56c5111bb227da8f8a3f8aa4f23e1348bc76ff76a05fc3cae89f9fad1bb52"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303527,7 +301239,7 @@ rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 : FILE
 		$op3 = { 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them
 }
 rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 : FILE
 {
@@ -303538,9 +301250,9 @@ rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 : FILE
 		date = "2020-10-05"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_vhd_ransomware.yar#L26-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf28771a854b3bacc911375c09f6c6bc6ddebff95612a509890c56a5a14e8921"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_vhd_ransomware.yar#L26-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf28771a854b3bacc911375c09f6c6bc6ddebff95612a509890c56a5a14e8921"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303553,7 +301265,7 @@ rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 : FILE
 		$op3 = { 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
 }
 rule SIGNATURE_BASE_Lazarus_Dec_17_1 : FILE
 {
@@ -303564,9 +301276,9 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_1 : FILE
 		date = "2017-12-20"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8U6fY2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec17.yar#L12-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "50ff8418cf342147a81ef3a418e5e61d42f0e5764982e43b51d4dd3a983a548e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec17.yar#L12-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_50ff8418cf342147a81ef3a418e5e61d42f0e5764982e43b51d4dd3a983a548e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303581,7 +301293,7 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_1 : FILE
 		$s4 = "bUEeYE" fullword ascii
 
 	condition:
-		uint16(0)==0x5449 and filesize <4000KB and all of them
+		uint16( 0 ) == 0x5449 and filesize < 4000KB and all of them
 }
 rule SIGNATURE_BASE_Lazarus_Dec_17_2 : FILE
 {
@@ -303592,9 +301304,9 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_2 : FILE
 		date = "2017-12-20"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8U6fY2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec17.yar#L31-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "273cd54a0c3ecf53893de0ef9c41d784725eea6cc843e04df01cd8f29d61a797"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec17.yar#L31-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_273cd54a0c3ecf53893de0ef9c41d784725eea6cc843e04df01cd8f29d61a797"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303609,7 +301321,7 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_2 : FILE
 		$a1 = "Microsoft Code Signing PCA" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7000KB and ( all of ($s*) and not $a1)
+		uint16( 0 ) == 0x5a4d and filesize < 7000KB and ( all of ( $s* ) and not $a1 )
 }
 rule SIGNATURE_BASE_Lazarus_Dec_17_4 : FILE
 {
@@ -303620,9 +301332,9 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_4 : FILE
 		date = "2017-12-20"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8U6fY2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec17.yar#L53-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "70801347699d339cb47cad03ec3f694b09a976e32b70052a97fade09fcac679d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec17.yar#L53-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_70801347699d339cb47cad03ec3f694b09a976e32b70052a97fade09fcac679d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303634,7 +301346,7 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_4 : FILE
 		$s1 = "var _0xf5ed=[\"\\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2E\\x53\\x68\\x65\\x6C\\x6C\"," ascii
 
 	condition:
-		filesize <9KB and 1 of them
+		filesize < 9KB and 1 of them
 }
 rule SIGNATURE_BASE_Lazarus_Dec_17_5 : FILE
 {
@@ -303645,9 +301357,9 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_5 : FILE
 		date = "2017-12-20"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8U6fY2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec17.yar#L69-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "480ec19f7050d34713ed621ae9ec5d5463b1cc4710b473465cc78e533796d2e4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec17.yar#L69-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_480ec19f7050d34713ed621ae9ec5d5463b1cc4710b473465cc78e533796d2e4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303665,10 +301377,8 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_5 : FILE
 		$x8 = "whoami /groups | findstr /c:\"S-1-5-32-544\"" fullword ascii
 
 	condition:
-		filesize <500KB and 1 of them
+		filesize < 500KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT28_CHOPSTICK : FILE
 {
 	meta:
@@ -303678,10 +301388,10 @@ rule SIGNATURE_BASE_APT28_CHOPSTICK : FILE
 		date = "2015-06-02"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/v3ebal"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28.yar#L10-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28.yar#L10-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
-		logic_hash = "750b2d5157856e0ffd840406eec601ded51ced7ccb20b577f336bbaf32681835"
+		logic_hash = "v1_sha256_750b2d5157856e0ffd840406eec601ded51ced7ccb20b577f336bbaf32681835"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -303699,10 +301409,8 @@ rule SIGNATURE_BASE_APT28_CHOPSTICK : FILE
 		$s17 = "LoadLibraryA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <722KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 722KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT28_Sourface_Malware1 : FILE
 {
 	meta:
@@ -303712,9 +301420,9 @@ rule SIGNATURE_BASE_APT28_Sourface_Malware1 : FILE
 		date = "2015-06-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28.yar#L34-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2ec1e5db74b5abe1da0d454b5e901bd808a0be318235f25d713cfdc4aea8d6d7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28.yar#L34-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2ec1e5db74b5abe1da0d454b5e901bd808a0be318235f25d713cfdc4aea8d6d7"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -303727,10 +301435,8 @@ rule SIGNATURE_BASE_APT28_Sourface_Malware1 : FILE
 		$s2 = "\\chkdbg.log" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <62KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 62KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT28_Sourface_Malware2 : FILE
 {
 	meta:
@@ -303740,9 +301446,9 @@ rule SIGNATURE_BASE_APT28_Sourface_Malware2 : FILE
 		date = "2015-06-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28.yar#L52-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed0424e61ca3243241e32d4f744398d263d7e35de15d94e9c6f816dc7349c267"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28.yar#L52-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed0424e61ca3243241e32d4f744398d263d7e35de15d94e9c6f816dc7349c267"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -303759,10 +301465,8 @@ rule SIGNATURE_BASE_APT28_Sourface_Malware2 : FILE
 		$s1 = "Applicate" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 550KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT28_Sourface_Malware3 : FILE
 {
 	meta:
@@ -303772,9 +301476,9 @@ rule SIGNATURE_BASE_APT28_Sourface_Malware3 : FILE
 		date = "2015-06-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28.yar#L74-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "894fc2913cf1fa8aecb3052e762d4403124fcbdb2148edb23a9117c2f2b8eddc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28.yar#L74-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_894fc2913cf1fa8aecb3052e762d4403124fcbdb2148edb23a9117c2f2b8eddc"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -303795,10 +301499,8 @@ rule SIGNATURE_BASE_APT28_Sourface_Malware3 : FILE
 		$s1 = "Core Shell Runtime Service" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 550KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT28_Skinnyboy_Dropper : RUSSIA FILE
 {
 	meta:
@@ -303808,9 +301510,9 @@ rule SIGNATURE_BASE_APT28_Skinnyboy_Dropper : RUSSIA FILE
 		date = "2021-05-24"
 		modified = "2023-12-05"
 		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28.yar#L103-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9e29ed985fac8701f72f0860fe101272c3c3342ef6857e30d32f5fea14822945"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28.yar#L103-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9e29ed985fac8701f72f0860fe101272c3c3342ef6857e30d32f5fea14822945"
 		score = 75
 		quality = 85
 		tags = "RUSSIA, FILE"
@@ -303822,10 +301524,8 @@ rule SIGNATURE_BASE_APT28_Skinnyboy_Dropper : RUSSIA FILE
 		$ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}
 
 	condition:
-		( uint16(0)==0x5A4D and all of them )
+		( uint16( 0 ) == 0x5A4D and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT28_Skinnyboy_Launcher : RUSSIA FILE
 {
 	meta:
@@ -303835,9 +301535,9 @@ rule SIGNATURE_BASE_APT28_Skinnyboy_Launcher : RUSSIA FILE
 		date = "2021-05-24"
 		modified = "2023-12-05"
 		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28.yar#L120-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cbb7a6e0114a9556a99ab3f5601664f430b650b2de0b44fe0178a99f21082e8d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28.yar#L120-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cbb7a6e0114a9556a99ab3f5601664f430b650b2de0b44fe0178a99f21082e8d"
 		score = 75
 		quality = 85
 		tags = "RUSSIA, FILE"
@@ -303856,7 +301556,7 @@ rule SIGNATURE_BASE_APT28_Skinnyboy_Launcher : RUSSIA FILE
 		$h2 = {8B 01 3B 02 75 10 83 C1 04 83 C2 04 83 EE 04 73 EF}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and ($sha or ( all of ($l*) and all of ($h*)))
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( $sha or ( all of ( $l* ) and all of ( $h* ) ) )
 }
 import "pe"
 
@@ -303869,9 +301569,9 @@ rule SIGNATURE_BASE_APT28_Skinnyboy_Implanter : RUSSIA FILE
 		date = "2021-05-24"
 		modified = "2023-12-05"
 		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28.yar#L143-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f5b8944910297988ecf5aecf23d20c384cf141a3a0972baadfacc4969dc46e7c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28.yar#L143-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f5b8944910297988ecf5aecf23d20c384cf141a3a0972baadfacc4969dc46e7c"
 		score = 75
 		quality = 85
 		tags = "RUSSIA, FILE"
@@ -303884,7 +301584,7 @@ rule SIGNATURE_BASE_APT28_Skinnyboy_Implanter : RUSSIA FILE
 		$xor_cycle = { 8A 8C ?? ?? ?? ?? ?? 30 8C ?? ?? ?? ?? ?? 42 3B D0 72 }
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and filesize <100KB and $xor_cycle and $heap_ops and $enc_string
+		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and filesize < 100KB and $xor_cycle and $heap_ops and $enc_string
 }
 rule SIGNATURE_BASE_FIN7_Dropper_Aug17 : FILE
 {
@@ -303895,9 +301595,9 @@ rule SIGNATURE_BASE_FIN7_Dropper_Aug17 : FILE
 		date = "2017-08-04"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7_backdoor.yar#L12-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "610b7288e08d36858de88abac3a86dcb6ebba1c019e17fb716f5c26aa964903b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7_backdoor.yar#L12-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_610b7288e08d36858de88abac3a86dcb6ebba1c019e17fb716f5c26aa964903b"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -303914,7 +301614,7 @@ rule SIGNATURE_BASE_FIN7_Dropper_Aug17 : FILE
 		$s5 = "ShellV" fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <700KB and 1 of ($x*) or all of ($s*))
+		( uint16( 0 ) == 0xcfd0 and filesize < 700KB and 1 of ( $x* ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_FIN7_Backdoor_Aug17 : FILE
 {
@@ -303925,9 +301625,9 @@ rule SIGNATURE_BASE_FIN7_Backdoor_Aug17 : FILE
 		date = "2017-08-04"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin7_backdoor.yar#L34-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "76818317c543c1464898463741ddaf8c6368d0f5004c088a323c4323db49060c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin7_backdoor.yar#L34-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_76818317c543c1464898463741ddaf8c6368d0f5004c088a323c4323db49060c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303954,7 +301654,7 @@ rule SIGNATURE_BASE_FIN7_Backdoor_Aug17 : FILE
 		$c5 = "get_screen" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and (1 of ($x*) or all of ($a*) or all of ($v*) or 3 of ($c*))) or 5 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( 1 of ( $x* ) or all of ( $a* ) or all of ( $v* ) or 3 of ( $c* ) ) ) or 5 of them
 }
 rule SIGNATURE_BASE_Saudi_Phish_Trojan : FILE
 {
@@ -303965,9 +301665,9 @@ rule SIGNATURE_BASE_Saudi_Phish_Trojan : FILE
 		date = "2017-10-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/Z3JUAA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_saudi_aramco_phish.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f7199d2e408cc057d88234e4041c7d87652d1ed361eaaf75bb37da45900e9f38"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_saudi_aramco_phish.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f7199d2e408cc057d88234e4041c7d87652d1ed361eaaf75bb37da45900e9f38"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -303982,7 +301682,7 @@ rule SIGNATURE_BASE_Saudi_Phish_Trojan : FILE
                65 00 78 00 65 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them )
 }
 import "pe"
 
@@ -303995,9 +301695,9 @@ rule SIGNATURE_BASE_Crime_Win32_Dridex_Socks5_Mod
 		date = "2020-04-06"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_evilcorp_dridex_banker.yar#L8-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5ca09e9c7d94e949e453d1bb69b566c12b253579cbcae700929d4f517df35a0a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_evilcorp_dridex_banker.yar#L8-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5ca09e9c7d94e949e453d1bb69b566c12b253579cbcae700929d4f517df35a0a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -304007,7 +301707,7 @@ rule SIGNATURE_BASE_Crime_Win32_Dridex_Socks5_Mod
 		$s1 = "socks5_2_x64.dll"
 
 	condition:
-		any of ($s*) and pe.exports("start")
+		any of ( $s* ) and pe.exports ( "start" )
 }
 import "pe"
 
@@ -304020,15 +301720,15 @@ rule SIGNATURE_BASE_Crime_Win32_Hvnc_Banker_Gen
 		date = "2020-04-06"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_evilcorp_dridex_banker.yar#L22-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b01af685c3826834aadaf4eac1f1d8171db288a2efa7b769d8122421f7af8d7e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_evilcorp_dridex_banker.yar#L22-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b01af685c3826834aadaf4eac1f1d8171db288a2efa7b769d8122421f7af8d7e"
 		score = 75
 		quality = 85
 		tags = ""
 
 	condition:
-		pe.exports("VncStartServer") and pe.exports("VncStopServer")
+		pe.exports( "VncStartServer" ) and pe.exports ( "VncStopServer" )
 }
 rule SIGNATURE_BASE_Chinachopper_Generic : FILE
 {
@@ -304039,9 +301739,9 @@ rule SIGNATURE_BASE_Chinachopper_Generic : FILE
 		date = "2015-03-10"
 		modified = "2022-10-27"
 		reference = "https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_webshell_chinachopper.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "34cb81b077d6dae5b4565001b2ab28897c6c554f00aa102601fb9c416c6c0f09"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_webshell_chinachopper.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_34cb81b077d6dae5b4565001b2ab28897c6c554f00aa102601fb9c416c6c0f09"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304054,7 +301754,7 @@ rule SIGNATURE_BASE_Chinachopper_Generic : FILE
 		$fp2 = "POST /"
 
 	condition:
-		filesize <300KB and 1 of ($x*) and not 1 of ($fp*)
+		filesize < 300KB and 1 of ( $x* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Redsails_EXE : FILE
 {
@@ -304065,9 +301765,9 @@ rule SIGNATURE_BASE_Redsails_EXE : FILE
 		date = "2017-10-02"
 		modified = "2023-12-05"
 		reference = "https://github.com/BeetleChunks/redsails"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_redsails.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fe9232989fb29686f11ee8cd59090fb6602301b00ff12d4a0dff8279a1718086"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_redsails.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fe9232989fb29686f11ee8cd59090fb6602301b00ff12d4a0dff8279a1718086"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304079,7 +301779,7 @@ rule SIGNATURE_BASE_Redsails_EXE : FILE
 		$s2 = "bWinDivert32.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <6000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 6000KB and all of them )
 }
 rule SIGNATURE_BASE_Redsails_PY
 {
@@ -304090,9 +301790,9 @@ rule SIGNATURE_BASE_Redsails_PY
 		date = "2017-10-02"
 		modified = "2023-12-05"
 		reference = "https://github.com/BeetleChunks/redsails"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_redsails.yar#L27-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4c5426a427e2c25cf9e44ae5f9ec477c9ab11f611d9a0db444c36e7cae176562"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_redsails.yar#L27-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4c5426a427e2c25cf9e44ae5f9ec477c9ab11f611d9a0db444c36e7cae176562"
 		score = 75
 		quality = 85
 		tags = ""
@@ -304110,8 +301810,6 @@ rule SIGNATURE_BASE_Redsails_PY
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Turla_Png_Dropper : FILE
 {
 	meta:
@@ -304121,9 +301819,9 @@ rule SIGNATURE_BASE_Turla_Png_Dropper : FILE
 		date = "2018-11-23"
 		modified = "2023-12-05"
 		reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_png_dropper_nov18.yar#L3-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c859310660603d0748cf17daea0799af7684f2a9f77f729871eb57338fbfcca6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_png_dropper_nov18.yar#L3-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c859310660603d0748cf17daea0799af7684f2a9f77f729871eb57338fbfcca6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304164,7 +301862,7 @@ rule SIGNATURE_BASE_Turla_Png_Dropper : FILE
         }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of ($api*) and 1 of ($code*)
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of ( $api* ) and 1 of ( $code* )
 }
 import "pe"
 
@@ -304177,9 +301875,9 @@ rule SIGNATURE_BASE_Turla_Png_Reg_Enum_Payload : FILE
 		date = "2018-11-23"
 		modified = "2023-12-05"
 		reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_png_dropper_nov18.yar#L51-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b01d0c3a26ce955570ed5607514906bd8860f36637957e39a15f74a7dbb1a1e6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_png_dropper_nov18.yar#L51-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b01d0c3a26ce955570ed5607514906bd8860f36637957e39a15f74a7dbb1a1e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304190,7 +301888,7 @@ rule SIGNATURE_BASE_Turla_Png_Reg_Enum_Payload : FILE
 		$crypt01 = "ChainingModeCBC" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and pe.imports("advapi32.dll","StartServiceCtrlDispatcherA") and pe.imports("advapi32.dll","RegEnumValueA") and pe.imports("advapi32.dll","RegEnumKeyExA") and pe.imports("ncrypt.dll","NCryptOpenStorageProvider") and pe.imports("ncrypt.dll","NCryptEnumKeys") and pe.imports("ncrypt.dll","NCryptOpenKey") and pe.imports("ncrypt.dll","NCryptDecrypt") and pe.imports("ncrypt.dll","BCryptGenerateSymmetricKey") and pe.imports("ncrypt.dll","BCryptGetProperty") and pe.imports("ncrypt.dll","BCryptDecrypt") and pe.imports("ncrypt.dll","BCryptEncrypt") and all of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and pe.imports ( "advapi32.dll" , "StartServiceCtrlDispatcherA" ) and pe.imports ( "advapi32.dll" , "RegEnumValueA" ) and pe.imports ( "advapi32.dll" , "RegEnumKeyExA" ) and pe.imports ( "ncrypt.dll" , "NCryptOpenStorageProvider" ) and pe.imports ( "ncrypt.dll" , "NCryptEnumKeys" ) and pe.imports ( "ncrypt.dll" , "NCryptOpenKey" ) and pe.imports ( "ncrypt.dll" , "NCryptDecrypt" ) and pe.imports ( "ncrypt.dll" , "BCryptGenerateSymmetricKey" ) and pe.imports ( "ncrypt.dll" , "BCryptGetProperty" ) and pe.imports ( "ncrypt.dll" , "BCryptDecrypt" ) and pe.imports ( "ncrypt.dll" , "BCryptEncrypt" ) and all of them
 }
 rule SIGNATURE_BASE_Dropper_Deploysmalwareviasideloading
 {
@@ -304201,9 +301899,9 @@ rule SIGNATURE_BASE_Dropper_Deploysmalwareviasideloading
 		date = "2024-04-17"
 		modified = "2024-04-17"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_uscert_ta17-1117a.yar#L9-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51d8a0785bc25cf02460b9b7490ccba3d67806c953e6aa3d3882341ce11857fa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_uscert_ta17-1117a.yar#L9-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51d8a0785bc25cf02460b9b7490ccba3d67806c953e6aa3d3882341ce11857fa"
 		score = 75
 		quality = 85
 		tags = ""
@@ -304225,9 +301923,9 @@ rule SIGNATURE_BASE_REDLEAVES_Droppedfile_Implantloader_Starburn
 		date = "2024-04-17"
 		modified = "2024-04-17"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_uscert_ta17-1117a.yar#L23-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2ebfdaf363ac80bc9bace3056ff86efd9c1b246c6f60373a82df4a0db901a6e3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_uscert_ta17-1117a.yar#L23-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2ebfdaf363ac80bc9bace3056ff86efd9c1b246c6f60373a82df4a0db901a6e3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -304248,9 +301946,9 @@ rule SIGNATURE_BASE_REDLEAVES_Droppedfile_Obfuscatedshellcodeandrat_Handkerchief
 		date = "2024-04-17"
 		modified = "2024-04-17"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_uscert_ta17-1117a.yar#L36-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f91bd1ddd6691a0a5b6ebc6a28d35bb5b2e6c00754f07e58ffb01e06ad590ae3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_uscert_ta17-1117a.yar#L36-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f91bd1ddd6691a0a5b6ebc6a28d35bb5b2e6c00754f07e58ffb01e06ad590ae3"
 		score = 75
 		quality = 83
 		tags = ""
@@ -304271,9 +301969,9 @@ rule SIGNATURE_BASE_REDLEAVES_Coreimplant_Uniquestrings : FILE
 		date = "2018-12-20"
 		modified = "2024-04-17"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_uscert_ta17-1117a.yar#L49-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ce6ab0f4007f3ea3c31442cab702ad3579faa6835d5ee9b4c03516ce0499bf3e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_uscert_ta17-1117a.yar#L49-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ce6ab0f4007f3ea3c31442cab702ad3579faa6835d5ee9b4c03516ce0499bf3e"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -304284,7 +301982,7 @@ rule SIGNATURE_BASE_REDLEAVES_Coreimplant_Uniquestrings : FILE
 		$unique7 = "\\NamePipe_MoreWindows" wide ascii
 
 	condition:
-		not uint32(0)==0x66676572 and any of them
+		not uint32( 0 ) == 0x66676572 and any of them
 }
 rule SIGNATURE_BASE_PLUGX_Redleaves
 {
@@ -304296,9 +301994,9 @@ rule SIGNATURE_BASE_PLUGX_Redleaves
 		date = "2017-04-03"
 		modified = "2024-04-17"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_uscert_ta17-1117a.yar#L66-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c52110eb18dcdb7a0d4b8c42f22368acdd1bce44a192abcd71a20bee2705475"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_uscert_ta17-1117a.yar#L66-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c52110eb18dcdb7a0d4b8c42f22368acdd1bce44a192abcd71a20bee2705475"
 		score = 75
 		quality = 85
 		tags = ""
@@ -304335,9 +302033,9 @@ rule SIGNATURE_BASE_Xtreme_Sep17_1 : FILE
 		date = "2017-09-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_xtreme_rat.yar#L14-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa78b43f729032291c27f67dc53bd39a85c9a50323c7adf909ca2a8c5acdd861"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_xtreme_rat.yar#L14-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa78b43f729032291c27f67dc53bd39a85c9a50323c7adf909ca2a8c5acdd861"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304354,10 +302052,8 @@ rule SIGNATURE_BASE_Xtreme_Sep17_1 : FILE
 		$s3 = ";open=RECYCLER\\S-1-5-21-1482476501-3352491937-682996330-1013\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and (pe.imphash()=="735af2a144f62c50ba8e89c1c59764eb" or (1 of ($x*) or 3 of them ))
+		uint16( 0 ) == 0x5a4d and filesize < 4000KB and ( pe.imphash ( ) == "735af2a144f62c50ba8e89c1c59764eb" or ( 1 of ( $x* ) or 3 of them ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Xtreme_Sep17_2 : FILE
 {
 	meta:
@@ -304367,9 +302063,9 @@ rule SIGNATURE_BASE_Xtreme_Sep17_2 : FILE
 		date = "2017-09-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_xtreme_rat.yar#L39-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb86167e0267d52b1b7503abd8f5b988296e3cde12453ace529c4e043d2ca69e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_xtreme_rat.yar#L39-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb86167e0267d52b1b7503abd8f5b988296e3cde12453ace529c4e043d2ca69e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304381,10 +302077,8 @@ rule SIGNATURE_BASE_Xtreme_Sep17_2 : FILE
 		$s2 = "Remote Service Application" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Xtreme_Sep17_3 : FILE
 {
 	meta:
@@ -304394,9 +302088,9 @@ rule SIGNATURE_BASE_Xtreme_Sep17_3 : FILE
 		date = "2017-09-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_xtreme_rat.yar#L55-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c110863028ab1f557270e52de608179ce582a47e0a20994f83d385ed285bda9a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_xtreme_rat.yar#L55-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c110863028ab1f557270e52de608179ce582a47e0a20994f83d385ed285bda9a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304408,7 +302102,7 @@ rule SIGNATURE_BASE_Xtreme_Sep17_3 : FILE
 		$s4 = "XTREME" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them )
 }
 import "pe"
 
@@ -304421,9 +302115,9 @@ rule SIGNATURE_BASE_Xtreme_RAT_Gen_Imp : FILE
 		date = "2017-09-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_xtreme_rat.yar#L71-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9cfd6473e7f8d1f899fe2cdbb49a4086ea7ac6151602d0964ed28b16d2d0188d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_xtreme_rat.yar#L71-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9cfd6473e7f8d1f899fe2cdbb49a4086ea7ac6151602d0964ed28b16d2d0188d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304431,7 +302125,7 @@ rule SIGNATURE_BASE_Xtreme_RAT_Gen_Imp : FILE
 		hash1 = "7b5082bcc8487bb65c38e34c192c2a891e7bb86ba97281352b0837debee6f1cf"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="d0bdf112886f3d846cc7780967d8efb9" or pe.imphash()=="cc6f630f214cf890e63e899d8ebabba6" or pe.imphash()=="e0f7991d50ceee521d7190effa3c494e")
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "d0bdf112886f3d846cc7780967d8efb9" or pe.imphash ( ) == "cc6f630f214cf890e63e899d8ebabba6" or pe.imphash ( ) == "e0f7991d50ceee521d7190effa3c494e" )
 }
 rule SIGNATURE_BASE_Hermes2_1 : FILE
 {
@@ -304442,10 +302136,10 @@ rule SIGNATURE_BASE_Hermes2_1 : FILE
 		date = "2017-10-11"
 		modified = "2023-12-05"
 		reference = "https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_hermes_ransom.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_hermes_ransom.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b27881f59c8d8cc529fa80a58709db36"
-		logic_hash = "85a7b3ec89f2bf32e5520a7c5c84661383be71abd8dae3d072d75d5b1118db24"
+		logic_hash = "v1_sha256_85a7b3ec89f2bf32e5520a7c5c84661383be71abd8dae3d072d75d5b1118db24"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304465,7 +302159,7 @@ rule SIGNATURE_BASE_Hermes2_1 : FILE
 		$u3 = "hnKwtMcOadHwnXutKHqPvpgfysFXfAFTcaDHNdCnktA"
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 3 of ($S*) and 1 of ($u*)
+		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 3 of ( $S* ) and 1 of ( $u* )
 }
 rule SIGNATURE_BASE_PLEAD_Downloader_Jun18_1 : FILE
 {
@@ -304476,9 +302170,9 @@ rule SIGNATURE_BASE_PLEAD_Downloader_Jun18_1 : FILE
 		date = "2018-06-16"
 		modified = "2023-12-05"
 		reference = "https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_plead_downloader.yar#L1-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "82fa4629aeb67a657af8b40527414e59d1c45a7c4e3c68398d3472c080c9487b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_plead_downloader.yar#L1-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_82fa4629aeb67a657af8b40527414e59d1c45a7c4e3c68398d3472c080c9487b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304493,7 +302187,7 @@ rule SIGNATURE_BASE_PLEAD_Downloader_Jun18_1 : FILE
 		$a2 = "Checking..." wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*) or (2 of ($s*) and 1 of ($a*)))
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of ( $s* ) or ( 2 of ( $s* ) and 1 of ( $a* ) ) )
 }
 rule SIGNATURE_BASE_MAL_Sharpshooter_Excel4 : FILE
 {
@@ -304504,10 +302198,10 @@ rule SIGNATURE_BASE_MAL_Sharpshooter_Excel4 : FILE
 		date = "2020-03-27"
 		modified = "2023-12-05"
 		reference = "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_Excel4Macro_Sharpshooter.yar#L1-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_Excel4Macro_Sharpshooter.yar#L1-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ccef64586d25ffcb2b28affc1f64319b936175c4911e7841a0e28ee6d6d4a02d"
-		logic_hash = "4aec8bb7ec8ce7ebd8228416133ea7eec995864aeec78c11548387d832b5fa65"
+		logic_hash = "v1_sha256_4aec8bb7ec8ce7ebd8228416133ea7eec995864aeec78c11548387d832b5fa65"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -304521,7 +302215,7 @@ rule SIGNATURE_BASE_MAL_Sharpshooter_Excel4 : FILE
 		$concat = { 00 41 6f 00 08 1e ?? 00 41 6f 00 08 1e ?? 00 41 6f 00 08}
 
 	condition:
-		filesize <1000KB and $header_docf at 0 and #concat>10 and $s1 and 2 of ($f*)
+		filesize < 1000KB and $header_docf at 0 and #concat > 10 and $s1 and 2 of ( $f* )
 }
 rule SIGNATURE_BASE_SUSP_Excel4Macro_Autoopen : FILE
 {
@@ -304532,10 +302226,10 @@ rule SIGNATURE_BASE_SUSP_Excel4Macro_Autoopen : FILE
 		date = "2020-03-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_Excel4Macro_Sharpshooter.yar#L27-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_Excel4Macro_Sharpshooter.yar#L27-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f"
-		logic_hash = "074aab8e1d3b66e34e8e8d8e8489e1dfee1091df0424b22cd1bfd3cf904754e1"
+		logic_hash = "v1_sha256_074aab8e1d3b66e34e8e8d8e8489e1dfee1091df0424b22cd1bfd3cf904754e1"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -304549,10 +302243,8 @@ rule SIGNATURE_BASE_SUSP_Excel4Macro_Autoopen : FILE
 		$Auto_Close1 = {18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a }
 
 	condition:
-		filesize <3000KB and $header_docf at 0 and $s1 and any of ($Auto_*)
+		filesize < 3000KB and $header_docf at 0 and $s1 and any of ( $Auto_* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Winnti_Signing_Cert : FILE
 {
 	meta:
@@ -304562,9 +302254,9 @@ rule SIGNATURE_BASE_Winnti_Signing_Cert : FILE
 		date = "2015-10-10"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L9-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6fd5f2808e7d683b9c4b7f5d4ccfd0eb87037eb2e70700b2c083db8c6ddf4a26"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L9-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6fd5f2808e7d683b9c4b7f5d4ccfd0eb87037eb2e70700b2c083db8c6ddf4a26"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304578,10 +302270,8 @@ rule SIGNATURE_BASE_Winnti_Signing_Cert : FILE
 		$s3 = "$Asahi Kasei Microdevices Corporation0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Winnti_Malware_Nsiproxy : FILE
 {
 	meta:
@@ -304591,9 +302281,9 @@ rule SIGNATURE_BASE_Winnti_Malware_Nsiproxy : FILE
 		date = "2015-10-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L28-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "742b091cc630ecea995be8d022eabadef1725dbd952f66a9ca62ecdee6985733"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L28-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_742b091cc630ecea995be8d022eabadef1725dbd952f66a9ca62ecdee6985733"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304615,10 +302305,8 @@ rule SIGNATURE_BASE_Winnti_Malware_Nsiproxy : FILE
 		$s5 = "http://www.wasabii.com.tw 0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $x1 and 1 of ($a*) and 2 of ($s*)
+		uint16( 0 ) == 0x5a4d and $x1 and 1 of ( $a* ) and 2 of ( $s* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Winnti_Malware_Updatedll : FILE
 {
 	meta:
@@ -304628,9 +302316,9 @@ rule SIGNATURE_BASE_Winnti_Malware_Updatedll : FILE
 		date = "2015-10-10"
 		modified = "2023-12-05"
 		reference = "VTI research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L56-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4b483e77106cc0e2f8ed2398de8b34b8246472875ad3e0612fa06cac96b7e6aa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L56-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4b483e77106cc0e2f8ed2398de8b34b8246472875ad3e0612fa06cac96b7e6aa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304656,10 +302344,8 @@ rule SIGNATURE_BASE_Winnti_Malware_Updatedll : FILE
 		$s9 = "$$$--Hello" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ((1 of ($c*) and 3 of ($s*)) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( ( 1 of ( $c* ) and 3 of ( $s* ) ) or all of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Winnti_Malware_FWPK : FILE
 {
 	meta:
@@ -304669,9 +302355,9 @@ rule SIGNATURE_BASE_Winnti_Malware_FWPK : FILE
 		date = "2015-10-10"
 		modified = "2023-01-06"
 		reference = "VTI research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L90-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6e87b06f6bf11dceb04c8eb4910f5d98ec3fe430fa984eeed8b73e99b28c5abe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L90-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6e87b06f6bf11dceb04c8eb4910f5d98ec3fe430fa984eeed8b73e99b28c5abe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304694,10 +302380,8 @@ rule SIGNATURE_BASE_Winnti_Malware_FWPK : FILE
 		$s11 = "IPInjectPkt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <642KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 642KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Winnti_Malware_Streamportal_Gen : FILE
 {
 	meta:
@@ -304707,9 +302391,9 @@ rule SIGNATURE_BASE_Winnti_Malware_Streamportal_Gen : FILE
 		date = "2015-10-10"
 		modified = "2023-12-05"
 		reference = "VTI research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L119-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "249f51b263fbcab650983d75482fd4787934731e415fcbd0e6f6925032aac690"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L119-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_249f51b263fbcab650983d75482fd4787934731e415fcbd0e6f6925032aac690"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304728,7 +302412,7 @@ rule SIGNATURE_BASE_Winnti_Malware_Streamportal_Gen : FILE
 		$s19 = "FwpsReferenceNetBufferList0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <275KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 275KB and all of them
 }
 import "pe"
 
@@ -304741,19 +302425,17 @@ rule SIGNATURE_BASE_WINNTI_Kingsoft_Moz_Confustion : FILE
 		date = "2018-04-13"
 		modified = "2023-12-05"
 		reference = "https://www.virustotal.com/en/file/070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496/analysis/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L143-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ebd8465f484e1142ac741263282ea1c6f98e6bd0637ebdcec6ecc6233193407e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L143-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ebd8465f484e1142ac741263282ea1c6f98e6bd0637ebdcec6ecc6233193407e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		hash1 = "070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="7f01b23ccfd1017249c36bc1618d6892" or (pe.version_info["LegalCopyright"] contains "Mozilla Corporation" and pe.version_info["ProductName"] contains "Kingsoft"))
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "7f01b23ccfd1017249c36bc1618d6892" or ( pe.version_info [ "LegalCopyright" ] contains "Mozilla Corporation" and pe.version_info [ "ProductName" ] contains "Kingsoft" ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_1 : FILE
 {
 	meta:
@@ -304763,9 +302445,9 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_1 : FILE
 		date = "2019-12-06"
 		modified = "2023-12-05"
 		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L160-L176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9e26a642cfe143b8efc52b2b9789c2ec54592f6347f16fb8716912767e4f9879"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L160-L176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9e26a642cfe143b8efc52b2b9789c2ec54592f6347f16fb8716912767e4f9879"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -304778,10 +302460,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_1 : FILE
 		$e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and ( any of ($e*))
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( any of ( $e* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_2
 {
 	meta:
@@ -304791,9 +302471,9 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_2
 		date = "2019-12-06"
 		modified = "2023-12-05"
 		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L178-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "216557999b7100f26556f9f7088b16ba125ac39b308cb77c997d620ce9591d24"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L178-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_216557999b7100f26556f9f7088b16ba125ac39b308cb77c997d620ce9591d24"
 		score = 75
 		quality = 85
 		tags = ""
@@ -304813,10 +302493,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_2
 		$b3 = { 8B 46 18 3D 03 60 15 00 }
 
 	condition:
-		(6 of ($a*)) and (2 of ($b*))
+		(6 of ( $a* ) ) and ( 2 of ( $b* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_3
 {
 	meta:
@@ -304826,9 +302504,9 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_3
 		date = "2019-12-06"
 		modified = "2023-12-05"
 		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L203-L219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d09f948c9bf685de64e8a6f1c95d95b806651866f3364d5d9b8b2351c1a68be3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L203-L219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d09f948c9bf685de64e8a6f1c95d95b806651866f3364d5d9b8b2351c1a68be3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -304841,10 +302519,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_3
 		$b5 = { (45 | 4D) (31 | 33) C0 BA 01 00 00 00 [10-16] FF 5? 28 [0-1] (84 | 85) C0 }
 
 	condition:
-		(4 of ($b*))
+		(4 of ( $b* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_4
 {
 	meta:
@@ -304854,9 +302530,9 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_4
 		date = "2019-12-06"
 		modified = "2023-12-05"
 		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L221-L235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "32909e915a6e602ad1e8698cf5c128c2e54670770b97f54b1414c5798c42cc00"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L221-L235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_32909e915a6e602ad1e8698cf5c128c2e54670770b97f54b1414c5798c42cc00"
 		score = 75
 		quality = 85
 		tags = ""
@@ -304867,10 +302543,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_4
 		$b3 = { 8B 4B E4 8B 53 EC 41 B8 00 40 00 00 4? 0B C? FF 9? B8 00 00 00 EB }
 
 	condition:
-		(2 of ($b*))
+		(2 of ( $b* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_5
 {
 	meta:
@@ -304880,9 +302554,9 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_5
 		date = "2019-12-06"
 		modified = "2023-12-05"
 		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L237-L264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "977d11fbb7cf4678d4da179c43d5566520ee97ac528e269a9b985e5bc75641b7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L237-L264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_977d11fbb7cf4678d4da179c43d5566520ee97ac528e269a9b985e5bc75641b7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -304906,10 +302580,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_5
 		$a16 = { C6 0? E9 4? 8? 4? 05 [2] 89 4? 01 }
 
 	condition:
-		(12 of ($a*))
+		(12 of ( $a* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_CN_Group_Loader_Jan20_1
 {
 	meta:
@@ -304919,9 +302591,9 @@ rule SIGNATURE_BASE_APT_CN_Group_Loader_Jan20_1
 		date = "2020-02-01"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/VK_Intel/status/1223411369367785472?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L266-L278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "30a180ada2390ca8df4bf7883624a5a176249622b4c34ce96931fe62b09ea8e3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L266-L278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_30a180ada2390ca8df4bf7883624a5a176249622b4c34ce96931fe62b09ea8e3"
 		score = 80
 		quality = 85
 		tags = ""
@@ -304932,8 +302604,6 @@ rule SIGNATURE_BASE_APT_CN_Group_Loader_Jan20_1
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Winnti_Dropper_X64_Libtomcrypt_Fns : TAU CN APT
 {
 	meta:
@@ -304943,9 +302613,9 @@ rule SIGNATURE_BASE_Winnti_Dropper_X64_Libtomcrypt_Fns : TAU CN APT
 		date = "2019-08-26"
 		modified = "2023-12-05"
 		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L280-L327"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "39d23f2a12a3b78182e52847e2fdb2d09386765138c37eb7f75edfc680505531"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L280-L327"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_39d23f2a12a3b78182e52847e2fdb2d09386765138c37eb7f75edfc680505531"
 		score = 75
 		quality = 83
 		tags = "TAU, CN, APT"
@@ -304988,8 +302658,6 @@ rule SIGNATURE_BASE_Winnti_Dropper_X64_Libtomcrypt_Fns : TAU CN APT
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Winnti_Dropper_X86_Libtomcrypt_Fns : TAU CN APT
 {
 	meta:
@@ -304999,9 +302667,9 @@ rule SIGNATURE_BASE_Winnti_Dropper_X86_Libtomcrypt_Fns : TAU CN APT
 		date = "2019-08-26"
 		modified = "2023-12-05"
 		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti.yar#L329-L370"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "84bfe001758677ff3a0d60d98e29c33ad1525a0afb27b73df750b2131e298879"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti.yar#L329-L370"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_84bfe001758677ff3a0d60d98e29c33ad1525a0afb27b73df750b2131e298879"
 		score = 75
 		quality = 85
 		tags = "TAU, CN, APT"
@@ -305047,10 +302715,10 @@ rule SIGNATURE_BASE_Gen_Excel_Auto_Open_Evasion : FILE
 		date = "2020-09-24"
 		modified = "2023-12-05"
 		reference = "https://malware.pizza/2020/05/12/evading-av-with-excel-macros-and-biff8-xls/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_excel_auto_open_evasion.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_excel_auto_open_evasion.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e23f9f55e10f3f31a2e76a12b174b6741a2fa1f51cf23dbd69cf169d92c56ed5"
-		logic_hash = "d7d81683b9abd7b89d6d6ee4d14ff37359acd353a6bd1d88bc793525c8f203d9"
+		logic_hash = "v1_sha256_d7d81683b9abd7b89d6d6ee4d14ff37359acd353a6bd1d88bc793525c8f203d9"
 		score = 70
 		quality = 83
 		tags = "FILE"
@@ -305065,7 +302733,7 @@ rule SIGNATURE_BASE_Gen_Excel_Auto_Open_Evasion : FILE
 		$plain_auto_open = "auto_open" nocase wide ascii
 
 	condition:
-		filesize <1MB and uint32be(0)==0xD0CF11E0 and $auto_open and #plain_auto_open==0
+		filesize < 1MB and uint32be( 0 ) == 0xD0CF11E0 and $auto_open and #plain_auto_open == 0
 }
 import "pe"
 
@@ -305078,9 +302746,9 @@ rule SIGNATURE_BASE_Apt_RU_Turla_Kazuar_Debugview_Pefeatures : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.epicturla.com/blog/sysinturla"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_kazuar.yar#L15-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "10c2e47e5c1885c7dc19d1fb7933c9b15911cbe4c6fba99b7f763738ae934126"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_kazuar.yar#L15-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_10c2e47e5c1885c7dc19d1fb7933c9b15911cbe4c6fba99b7f763738ae934126"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -305089,10 +302757,8 @@ rule SIGNATURE_BASE_Apt_RU_Turla_Kazuar_Debugview_Pefeatures : FILE
 		hash2 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
 
 	condition:
-		uint16(0)==0x5a4d and (pe.version_info["LegalCopyright"]=="Test Copyright" and ((pe.version_info["ProductName"]=="Sysinternals DebugView" and pe.version_info["Description"]=="Sysinternals DebugView") or (pe.version_info["FileVersion"]=="4.80.0.0" and pe.version_info["Comments"]=="Sysinternals DebugView") or (pe.version_info["OriginalName"] contains "DebugView.exe" and pe.version_info["InternalName"] contains "DebugView.exe") or (pe.version_info["OriginalName"]=="Agent.exe" and pe.version_info["InternalName"]=="Agent.exe")))
+		uint16( 0 ) == 0x5a4d and ( pe.version_info [ "LegalCopyright" ] == "Test Copyright" and ( ( pe.version_info [ "ProductName" ] == "Sysinternals DebugView" and pe.version_info [ "Description" ] == "Sysinternals DebugView" ) or ( pe.version_info [ "FileVersion" ] == "4.80.0.0" and pe.version_info [ "Comments" ] == "Sysinternals DebugView" ) or ( pe.version_info [ "OriginalName" ] contains "DebugView.exe" and pe.version_info [ "InternalName" ] contains "DebugView.exe" ) or ( pe.version_info [ "OriginalName" ] == "Agent.exe" and pe.version_info [ "InternalName" ] == "Agent.exe" ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1 : FILE
 {
 	meta:
@@ -305102,9 +302768,9 @@ rule SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1 : FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://www.epicturla.com/blog/sysinturla"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_kazuar.yar#L61-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "547ed3cd88057ab91a0804ecf515eacca04fcf6e490aed1ee0f6a26c3d6b8268"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_kazuar.yar#L61-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_547ed3cd88057ab91a0804ecf515eacca04fcf6e490aed1ee0f6a26c3d6b8268"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305119,10 +302785,8 @@ rule SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1 : FILE
 		$op1 = { 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1 : NIGHTHAWK BEACON FILE
 {
 	meta:
@@ -305132,9 +302796,9 @@ rule SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1 : NIGHTHAWK BEACON FILE
 		date = "2022-11-22"
 		modified = "2023-12-05"
 		reference = "https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_nighthawk_c2.yar#L32-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8dec7752ee6e1af87129ce7ac09130f94a20807c4f45ceb1fce434358ac727bf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_nighthawk_c2.yar#L32-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8dec7752ee6e1af87129ce7ac09130f94a20807c4f45ceb1fce434358ac727bf"
 		score = 75
 		quality = 85
 		tags = "NIGHTHAWK, BEACON, FILE"
@@ -305149,7 +302813,7 @@ rule SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1 : NIGHTHAWK BEACON FILE
 		$s4 = { 44 8b 44 24 44 4c 89 [2-3] 89 95 00 02 00 00 2b c7 8b d7 49 03 d0 48 03 d1 4c 8d 8d 00 02 00 00 44 8b c0 49 8b cf ff 15 [2] 04 00 33 d2 85 c0 0f 84 [2] ff ff 03 bd 00 02 00 00 8b 44 24 40 3b f8 48 8b 4d ?? 4c 8b }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >60KB and all of ($s*)
+		uint16( 0 ) == 0x5A4D and filesize > 60KB and all of ( $s* )
 }
 rule SIGNATURE_BASE_POSHSPY_Malware
 {
@@ -305160,9 +302824,9 @@ rule SIGNATURE_BASE_POSHSPY_Malware
 		date = "2017-07-15"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poshspy.yar#L11-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e1f8b502950d2f7600041b5492f529682b9f5f2863c36ad40618b5ed78a94567"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poshspy.yar#L11-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e1f8b502950d2f7600041b5492f529682b9f5f2863c36ad40618b5ed78a94567"
 		score = 75
 		quality = 85
 		tags = ""
@@ -305188,9 +302852,9 @@ rule SIGNATURE_BASE_Dridex_Trojan_XML
 		date = "2015-03-08"
 		modified = "2023-12-05"
 		reference = "https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_dridex_xml.yar#L1-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "25b6340d782ee20723b2f17f3434a0b27b1561ab22d5a8f859e97e0ac126f651"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_dridex_xml.yar#L1-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_25b6340d782ee20723b2f17f3434a0b27b1561ab22d5a8f859e97e0ac126f651"
 		score = 75
 		quality = 85
 		tags = ""
@@ -305209,7 +302873,7 @@ rule SIGNATURE_BASE_Dridex_Trojan_XML
 		$c_1_line = "<o:Lines>1</o:Lines>"
 
 	condition:
-		all of ($c*)
+		all of ( $c* )
 }
 rule SIGNATURE_BASE_HKTL_Powersploit
 {
@@ -305220,9 +302884,9 @@ rule SIGNATURE_BASE_HKTL_Powersploit
 		date = "2018-06-23"
 		modified = "2023-12-05"
 		reference = "https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powersploit_dropper.yar#L1-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "00bc389147926f3b474a7072381bb8b9cddad3ff581a5d2182006a674e0c0163"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powersploit_dropper.yar#L1-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_00bc389147926f3b474a7072381bb8b9cddad3ff581a5d2182006a674e0c0163"
 		score = 75
 		quality = 81
 		tags = ""
@@ -305245,10 +302909,10 @@ rule SIGNATURE_BASE_Coreimpact_Sysdll_Exe
 		date = "2014-12-27"
 		modified = "2023-01-06"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_coreimpact_agent.yar#L6-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_coreimpact_agent.yar#L6-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f89a4d4ae5cca6d69a5256c96111e707"
-		logic_hash = "332b68e797e8ee3e26d797e106ae31e7240585ccb0ea599bebd8ac8f94313eab"
+		logic_hash = "v1_sha256_332b68e797e8ee3e26d797e106ae31e7240585ccb0ea599bebd8ac8f94313eab"
 		score = 70
 		quality = 85
 		tags = ""
@@ -305275,9 +302939,9 @@ rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_1 : FILE
 		date = "2018-05-24"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_vpnfilter.yar#L11-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aff7b1f3d4afaf883c2702287ef7d6e13e01e80222ba336978d13deb21a93614"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_vpnfilter.yar#L11-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aff7b1f3d4afaf883c2702287ef7d6e13e01e80222ba336978d13deb21a93614"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305295,7 +302959,7 @@ rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_1 : FILE
 		$s8 = "/tmUnblock.cgi" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <100KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_2 : FILE
 {
@@ -305306,9 +302970,9 @@ rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_2 : FILE
 		date = "2018-05-24"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_vpnfilter.yar#L33-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "238ec4575fd8adbfa592e07b601313c71a08be8c776e78469aef8ad02e411798"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_vpnfilter.yar#L33-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_238ec4575fd8adbfa592e07b601313c71a08be8c776e78469aef8ad02e411798"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305321,7 +302985,7 @@ rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_2 : FILE
 		$s3 = "/tmp/client.key" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <1000KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_3 : FILE
 {
@@ -305332,9 +302996,9 @@ rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_3 : FILE
 		date = "2018-05-24"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_vpnfilter.yar#L50-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "71152b57f2d6040608febf32441e1899fdf2479335c26c1143ea58759e6d9094"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_vpnfilter.yar#L50-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_71152b57f2d6040608febf32441e1899fdf2479335c26c1143ea58759e6d9094"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305358,7 +303022,7 @@ rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_3 : FILE
 		$a3 = "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <1000KB and (1 of ($sx*) or 2 of ($s*) or 2 of ($a*))
+		uint16( 0 ) == 0x457f and filesize < 1000KB and ( 1 of ( $sx* ) or 2 of ( $s* ) or 2 of ( $a* ) )
 }
 rule SIGNATURE_BASE_SUSP_ELF_Tor_Client : FILE
 {
@@ -305369,9 +303033,9 @@ rule SIGNATURE_BASE_SUSP_ELF_Tor_Client : FILE
 		date = "2018-05-24"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_vpnfilter.yar#L80-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2b67b32c5b8441c9b38e3bfeefa7f59c2767e29985adcba7d52e858847d37e47"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_vpnfilter.yar#L80-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2b67b32c5b8441c9b38e3bfeefa7f59c2767e29985adcba7d52e858847d37e47"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -305384,10 +303048,8 @@ rule SIGNATURE_BASE_SUSP_ELF_Tor_Client : FILE
 		$x3 = "Please upgrade! This version of Tor (%s) is %s, according to the directory authorities. Recommended versions are: %s" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and 1 of them
+		uint16( 0 ) == 0x457f and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Disclosed_20180208_Lsls : FILE
 {
 	meta:
@@ -305397,9 +303059,9 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Lsls : FILE
 		date = "2018-02-08"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_campaign_njrat.yar#L13-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c6542391e8d1a4fe4d26fd8b2dfb1fcab7b39c67dcc6495f2e5f95c4d6f8d61c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_campaign_njrat.yar#L13-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c6542391e8d1a4fe4d26fd8b2dfb1fcab7b39c67dcc6495f2e5f95c4d6f8d61c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305410,10 +303072,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Lsls : FILE
 		$x1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <3000KB and $x1
+		uint16( 0 ) == 0x457f and filesize < 3000KB and $x1
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Disclosed_20180208_C : FILE
 {
 	meta:
@@ -305423,9 +303083,9 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_C : FILE
 		date = "2018-02-08"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_campaign_njrat.yar#L28-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cfdc7ce8b89a16d2ae604268a030bd41259fed87a7f37b0dca8f7c467703c7f2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_campaign_njrat.yar#L28-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cfdc7ce8b89a16d2ae604268a030bd41259fed87a7f37b0dca8f7c467703c7f2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305446,10 +303106,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_C : FILE
 		$s8 = "Select * From AntiVirusProduct" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Disclosed_20180208_System3 : FILE
 {
 	meta:
@@ -305459,9 +303117,9 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_System3 : FILE
 		date = "2018-02-08"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_campaign_njrat.yar#L57-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8292ae1de39c57bc5ed6fa078570e92dbcd22cd13d5b5f22d158986708139fbe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_campaign_njrat.yar#L57-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8292ae1de39c57bc5ed6fa078570e92dbcd22cd13d5b5f22d158986708139fbe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305475,7 +303133,7 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_System3 : FILE
 		$s3 = "$15a32a5d-4906-458a-8f57-402311afc1c1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and $a1 and 1 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and $a1 and 1 of ( $s* )
 }
 import "pe"
 
@@ -305488,9 +303146,9 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal1 : FILE
 		date = "2018-02-08"
 		modified = "2023-12-05"
 		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_campaign_njrat.yar#L77-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf532761d07ee3e84028a9071409f081a7a85728d55c215c912f0b70902f101f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_campaign_njrat.yar#L77-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf532761d07ee3e84028a9071409f081a7a85728d55c215c912f0b70902f101f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305509,10 +303167,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal1 : FILE
 		$s2 = "ServUDaemon.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="28e3a58132364197d7cb29ee104004bf" or 1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( pe.imphash ( ) == "28e3a58132364197d7cb29ee104004bf" or 1 of ( $x* ) or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Disclosed_20180208_Keylogger_1 : FILE
 {
 	meta:
@@ -305522,9 +303178,9 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Keylogger_1 : FILE
 		date = "2018-02-08"
 		modified = "2023-12-05"
 		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_campaign_njrat.yar#L105-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "efba7004614c690e469082255cf7b5cb62cac5da2bfcc26e036e2eafcb5728f9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_campaign_njrat.yar#L105-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_efba7004614c690e469082255cf7b5cb62cac5da2bfcc26e036e2eafcb5728f9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305539,7 +303195,7 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Keylogger_1 : FILE
 		$x6 = "GetKeyloggeRLogs" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
 }
 import "pe"
 
@@ -305552,9 +303208,9 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal4 : FILE
 		date = "2018-02-08"
 		modified = "2023-12-05"
 		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_campaign_njrat.yar#L124-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "044901271adb06036e7d5aa8f2b6f893be10445bee95453c293d0025994e8d21"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_campaign_njrat.yar#L124-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_044901271adb06036e7d5aa8f2b6f893be10445bee95453c293d0025994e8d21"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305566,10 +303222,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal4 : FILE
 		$s2 = "Microsoft .NET and Windows XP COM+ Integration with SOAP" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them and pe.exports("SPACE")
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them and pe.exports ( "SPACE" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal5 : FILE
 {
 	meta:
@@ -305579,9 +303233,9 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal5 : FILE
 		date = "2018-02-08"
 		modified = "2023-12-05"
 		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cn_campaign_njrat.yar#L140-L160"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "971276d5033477a08a1ec037cff9735667c2b4f7d9d4a7bcd88f2b1d8c348d4f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cn_campaign_njrat.yar#L140-L160"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_971276d5033477a08a1ec037cff9735667c2b4f7d9d4a7bcd88f2b1d8c348d4f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305599,7 +303253,7 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal5 : FILE
 		$s7 = "Stub.My.Resources" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Sysinternals_Tool_Anomaly : FILE
 {
@@ -305610,9 +303264,9 @@ rule SIGNATURE_BASE_Sysinternals_Tool_Anomaly : FILE
 		date = "2016-12-06"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_sysinternals_anomaly.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "760795a51965197bd101ffbf0f7c8cfbbb16d2f443d0941de4a75c8f33f4cad0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_sysinternals_anomaly.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_760795a51965197bd101ffbf0f7c8cfbbb16d2f443d0941de4a75c8f33f4cad0"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -305628,7 +303282,7 @@ rule SIGNATURE_BASE_Sysinternals_Tool_Anomaly : FILE
 		$nfp5 = "Cache working set cleared" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and $s1 and not $n1 and not 1 of ($nfp*))
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and $s1 and not $n1 and not 1 of ( $nfp* ) )
 }
 rule SIGNATURE_BASE_Wannacry_Ransomware : FILE
 {
@@ -305639,9 +303293,9 @@ rule SIGNATURE_BASE_Wannacry_Ransomware : FILE
 		date = "2017-05-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/HG2j5T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_wannacry.yar#L12-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a652444d7946dbbc4fae76cd01f2e20993999fd1e6fc48a9ac0da57aab87a2da"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_wannacry.yar#L12-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a652444d7946dbbc4fae76cd01f2e20993999fd1e6fc48a9ac0da57aab87a2da"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -305671,7 +303325,7 @@ rule SIGNATURE_BASE_Wannacry_Ransomware : FILE
 		$op6 = { 8d 48 ff f7 d1 8d 44 10 ff 23 f1 23 c1 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and (1 of ($x*) and 1 of ($s*) or 3 of ($op*))
+		uint16( 0 ) == 0x5a4d and filesize < 10000KB and ( 1 of ( $x* ) and 1 of ( $s* ) or 3 of ( $op* ) )
 }
 rule SIGNATURE_BASE_Wannacry_Ransomware_Gen : FILE
 {
@@ -305682,9 +303336,9 @@ rule SIGNATURE_BASE_Wannacry_Ransomware_Gen : FILE
 		date = "2017-05-12"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-132A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_wannacry.yar#L48-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8f81c918dc1e2c8ef2e334ae504f88b10aef9e54a64486061d45296d2d738aab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_wannacry.yar#L48-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8f81c918dc1e2c8ef2e334ae504f88b10aef9e54a64486061d45296d2d738aab"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305700,7 +303354,7 @@ rule SIGNATURE_BASE_Wannacry_Ransomware_Gen : FILE
 		$s5 = "LANMAN1.0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them
 }
 rule SIGNATURE_BASE_Wanncry_M_Vbs : FILE
 {
@@ -305711,9 +303365,9 @@ rule SIGNATURE_BASE_Wanncry_M_Vbs : FILE
 		date = "2017-05-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/HG2j5T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_wannacry.yar#L68-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4606834535b4cad2e0d4a9bf6519fc4d749422fa4920f91fed9147ccfdff090"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_wannacry.yar#L68-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4606834535b4cad2e0d4a9bf6519fc4d749422fa4920f91fed9147ccfdff090"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305726,7 +303380,7 @@ rule SIGNATURE_BASE_Wanncry_M_Vbs : FILE
 		$s3 = " = WScript.CreateObject(\"WScript.Shell\")" ascii
 
 	condition:
-		( uint16(0)==0x4553 and filesize <1KB and all of them )
+		( uint16( 0 ) == 0x4553 and filesize < 1KB and all of them )
 }
 rule SIGNATURE_BASE_Wanncry_BAT : FILE
 {
@@ -305737,9 +303391,9 @@ rule SIGNATURE_BASE_Wanncry_BAT : FILE
 		date = "2017-05-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/HG2j5T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_wannacry.yar#L85-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "472c6aa0f1b5229d639ef347ea39947d3fd292cda3c4086e29a19b64daad4f3f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_wannacry.yar#L85-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_472c6aa0f1b5229d639ef347ea39947d3fd292cda3c4086e29a19b64daad4f3f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305753,7 +303407,7 @@ rule SIGNATURE_BASE_Wanncry_BAT : FILE
 		$s4 = "echo om.Save>> m.vbs" fullword ascii
 
 	condition:
-		( uint16(0)==0x6540 and filesize <1KB and 1 of them )
+		( uint16( 0 ) == 0x6540 and filesize < 1KB and 1 of them )
 }
 rule SIGNATURE_BASE_Wannacry_Ransomnote : FILE
 {
@@ -305764,9 +303418,9 @@ rule SIGNATURE_BASE_Wannacry_Ransomnote : FILE
 		date = "2017-05-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/HG2j5T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_wannacry.yar#L103-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "da814848f4616166bd7b92fa1d55a54b565fa8e6036cb895e5795448e989a99d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_wannacry.yar#L103-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_da814848f4616166bd7b92fa1d55a54b565fa8e6036cb895e5795448e989a99d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305778,7 +303432,7 @@ rule SIGNATURE_BASE_Wannacry_Ransomnote : FILE
 		$s2 = "Q:  What's wrong with my files?" fullword ascii
 
 	condition:
-		( uint16(0)==0x3a51 and filesize <2KB and all of them )
+		( uint16( 0 ) == 0x3a51 and filesize < 2KB and all of them )
 }
 rule SIGNATURE_BASE_APT_Lazaruswannacry : FILE
 {
@@ -305789,11 +303443,11 @@ rule SIGNATURE_BASE_APT_Lazaruswannacry : FILE
 		date = "2017-05-15"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/neelmehta/status/864164081116225536"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_wannacry.yar#L121-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_wannacry.yar#L121-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9c7c7149387a1c79679a87dd1ba755bc"
 		hash = "ac21c8ad899727137c4b94458d7aa8d8"
-		logic_hash = "8b32f1ea45a346088a18761540df3387997b53ea853f7a53cd292c9224f11209"
+		logic_hash = "v1_sha256_8b32f1ea45a346088a18761540df3387997b53ea853f7a53cd292c9224f11209"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305815,7 +303469,7 @@ rule SIGNATURE_BASE_APT_Lazaruswannacry : FILE
          2B C0 2C C0 FF FE }
 
 	condition:
-		uint16(0)==0x5A4D and filesize <15000000 and all of them
+		uint16( 0 ) == 0x5A4D and filesize < 15000000 and all of them
 }
 rule SIGNATURE_BASE_Mimikatz_Kirbi_Ticket : FILE
 {
@@ -305826,9 +303480,9 @@ rule SIGNATURE_BASE_Mimikatz_Kirbi_Ticket : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_kirbi_mimkatz.yar#L10-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2a62c24954d64346e419985ef5bf2b357b2aee41ac6b33d379dbd65cf5c9f92b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_kirbi_mimkatz.yar#L10-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2a62c24954d64346e419985ef5bf2b357b2aee41ac6b33d379dbd65cf5c9f92b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305849,9 +303503,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lorenz_May21_1 : FILE
 		date = "2021-05-04"
 		modified = "2023-12-05"
 		reference = "Internal Research - DACH TE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ransom_lorenz.yar#L1-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aec940deb2c3bc099a50a2e8f014ae425d306d331078d9ac2abc2ec7b8bf572e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ransom_lorenz.yar#L1-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aec940deb2c3bc099a50a2e8f014ae425d306d331078d9ac2abc2ec7b8bf572e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305869,7 +303523,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lorenz_May21_1 : FILE
 		$op2 = { 6a 02 e8 ?? ?? 0? 00 83 c4 18 83 f8 01 75 01 cc 6a 00 68 ?? ?? 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and (1 of ($x*) or all of ($op*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 4000KB and ( 1 of ( $x* ) or all of ( $op* ) or 3 of them )
 }
 rule SIGNATURE_BASE_URL_File_Local_EXE : FILE
 {
@@ -305880,9 +303534,9 @@ rule SIGNATURE_BASE_URL_File_Local_EXE : FILE
 		date = "2017-10-04"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/malwareforme/status/915300883012870144"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_to_local_exe.yar#L1-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b85b723142f52ade68f6eb8ba54bb7dffafce0df6d1ae8a7c08b3ce621ccadd4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_to_local_exe.yar#L1-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b85b723142f52ade68f6eb8ba54bb7dffafce0df6d1ae8a7c08b3ce621ccadd4"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -305893,7 +303547,7 @@ rule SIGNATURE_BASE_URL_File_Local_EXE : FILE
 		$s2 = /URL=file:\/\/\/C:\\[^\n]{1,50}\.exe/
 
 	condition:
-		filesize <400 and all of them
+		filesize < 400 and all of them
 }
 rule SIGNATURE_BASE_MAL_DOC_Zloader_Oct20_1 : FILE
 {
@@ -305904,9 +303558,9 @@ rule SIGNATURE_BASE_MAL_DOC_Zloader_Oct20_1 : FILE
 		date = "2020-10-10"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/JohnLaTwC/status/1314602421977452544"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_zloader_maldocs.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f546a860361d3caff99c282465dbbd1880460c7491a1b5ad065c1b5d91e5d49"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_zloader_maldocs.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f546a860361d3caff99c282465dbbd1880460c7491a1b5ad065c1b5d91e5d49"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305922,7 +303576,7 @@ rule SIGNATURE_BASE_MAL_DOC_Zloader_Oct20_1 : FILE
 		$sc3 = { 3E 69 76 60 59 6E 34 FB 87 6B 75 }
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <40KB and filesize >30KB and all of them
+		uint16( 0 ) == 0xcfd0 and filesize < 40KB and filesize > 30KB and all of them
 }
 rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_Hizorrat : FILE
 {
@@ -305933,9 +303587,9 @@ rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_Hizorrat : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hizor_rat.yar#L1-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4e3224d34db788d2cba9da74690bf75429d6e8a516d7666d0331e465d08640cb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hizor_rat.yar#L1-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4e3224d34db788d2cba9da74690bf75429d6e8a516d7666d0331e465d08640cb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -305954,7 +303608,7 @@ rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_Hizorrat : FILE
 		$s8 = "%08x%08x%08x%08x" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint32(0)==0x464c457f) and ( all of them )
+		( uint16( 0 ) == 0x5A4D or uint32( 0 ) == 0x464c457f ) and ( all of them )
 }
 rule SIGNATURE_BASE_Merlinagent
 {
@@ -305965,9 +303619,9 @@ rule SIGNATURE_BASE_Merlinagent
 		date = "2017-12-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/Ne0nd0g/merlin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_merlin_agent.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "21743230556cc11a78942de30be476ad8e73731bbda9a4feb83bd8140a703d01"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_merlin_agent.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_21743230556cc11a78942de30be476ad8e73731bbda9a4feb83bd8140a703d01"
 		score = 75
 		quality = 85
 		tags = ""
@@ -305989,7 +303643,7 @@ rule SIGNATURE_BASE_Merlinagent
 		$s5 = "\tUser GUID: %s"
 
 	condition:
-		1 of ($x*) or 4 of them
+		1 of ( $x* ) or 4 of them
 }
 rule SIGNATURE_BASE_EXPL_CVE_2021_1647_Apr21_1 : CVE_2021_1647 FILE
 {
@@ -306000,9 +303654,9 @@ rule SIGNATURE_BASE_EXPL_CVE_2021_1647_Apr21_1 : CVE_2021_1647 FILE
 		date = "2021-05-04"
 		modified = "2023-12-05"
 		reference = "https://attackerkb.com/topics/DzXZpEuBeP/cve-2021-1647-microsoft-windows-defender-zero-day-vulnerability"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cve_2021_1647.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b0e1809ba10e5ea624e1c4d2e948c928c590b40e6315def8cb1216930ead8579"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cve_2021_1647.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b0e1809ba10e5ea624e1c4d2e948c928c590b40e6315def8cb1216930ead8579"
 		score = 75
 		quality = 85
 		tags = "CVE-2021-1647, FILE"
@@ -306016,7 +303670,7 @@ rule SIGNATURE_BASE_EXPL_CVE_2021_1647_Apr21_1 : CVE_2021_1647 FILE
 		$seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }
 
 	condition:
-		filesize >10KB and filesize <10000KB and all of them
+		filesize > 10KB and filesize < 10000KB and all of them
 }
 rule SIGNATURE_BASE_Glassrat
 {
@@ -306027,9 +303681,9 @@ rule SIGNATURE_BASE_Glassrat
 		date = "2015-11-03"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_glassRAT.yar#L8-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "939d2cb11ff414641f68b2913fe8d24458e1fd7ba450b8781072bb10da3ad039"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_glassRAT.yar#L8-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_939d2cb11ff414641f68b2913fe8d24458e1fd7ba450b8781072bb10da3ad039"
 		score = 75
 		quality = 85
 		tags = ""
@@ -306048,7 +303702,7 @@ rule SIGNATURE_BASE_Glassrat
 		$s5 = "off.dat"
 
 	condition:
-		all of ($bin*) and $hs and 3 of ($s*)
+		all of ( $bin* ) and $hs and 3 of ( $s* )
 }
 rule SIGNATURE_BASE_Glassrat_Generic : FILE
 {
@@ -306059,9 +303713,9 @@ rule SIGNATURE_BASE_Glassrat_Generic : FILE
 		date = "2015-11-23"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/peering-into-glassrat/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_glassRAT.yar#L45-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fdd309c403e53bfa80340c1334f90fd5ef5f4618737b19069a07f7aa63aeb23d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_glassRAT.yar#L45-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fdd309c403e53bfa80340c1334f90fd5ef5f4618737b19069a07f7aa63aeb23d"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -306085,7 +303739,7 @@ rule SIGNATURE_BASE_Glassrat_Generic : FILE
 		$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <15MB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 15MB and 5 of them
 }
 rule SIGNATURE_BASE_APT_Fnv1A_Plus_Extra_XOR_In_MSIL_Experimental : FILE
 {
@@ -306096,9 +303750,9 @@ rule SIGNATURE_BASE_APT_Fnv1A_Plus_Extra_XOR_In_MSIL_Experimental : FILE
 		date = "2020-12-22"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_backdoor_sunburst_fnv1a_experimental.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6db212b21fec8d2c1b4cff9e32bdc027835ed660e7552b49f4418e7d0b35ca11"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_backdoor_sunburst_fnv1a_experimental.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6db212b21fec8d2c1b4cff9e32bdc027835ed660e7552b49f4418e7d0b35ca11"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -306112,7 +303766,7 @@ rule SIGNATURE_BASE_APT_Fnv1A_Plus_Extra_XOR_In_MSIL_Experimental : FILE
 		$fnv64a_prime_plus_gap_plus_xor_ret = { B3 01 00 00 00 01 [8-40] 61 2A 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_Apt28_Win_Zebrocy_Golang_Loader_Modified : FILE
 {
@@ -306123,9 +303777,9 @@ rule SIGNATURE_BASE_Apt28_Win_Zebrocy_Golang_Loader_Modified : FILE
 		date = "2018-12-25"
 		modified = "2023-12-05"
 		reference = "https://www.vkremez.com/2018/12/lets-learn-progression-of-apt28sofacy.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_zebrocy.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "799f4457eb2bdeeb7c9383e2b4e9572a41d9adbfe4a1a9c3b0fa1c9fc6077e40"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_zebrocy.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_799f4457eb2bdeeb7c9383e2b4e9572a41d9adbfe4a1a9c3b0fa1c9fc6077e40"
 		score = 75
 		quality = 79
 		tags = "FILE"
@@ -306143,7 +303797,7 @@ rule SIGNATURE_BASE_Apt28_Win_Zebrocy_Golang_Loader_Modified : FILE
 		$s5 = "io/ioutil.WriteFile" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $go and $init and all of ($s*) and #main>10 and #scr_git>5
+		uint16( 0 ) == 0x5a4d and $go and $init and all of ( $s* ) and #main > 10 and #scr_git > 5
 }
 import "pe"
 
@@ -306156,9 +303810,9 @@ rule SIGNATURE_BASE_Corkowdll : FILE
 		date = "2016-01-02"
 		modified = "2023-12-05"
 		reference = "https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_corkow_dll.yar#L3-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "072112c79f20ba08b7ef71d3dacff7eb947b4a27bf6381ce788e229f2f791cdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_corkow_dll.yar#L3-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_072112c79f20ba08b7ef71d3dacff7eb947b4a27bf6381ce788e229f2f791cdf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -306168,7 +303822,7 @@ rule SIGNATURE_BASE_Corkowdll : FILE
 		$binary2 = { (FF 75 ?? | 53) FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? [3-9] C9 C2 0C 00 }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($binary*) and (pe.exports("Control_RunDLL") or pe.exports("ServiceMain") or pe.exports("DllGetClassObject")) or (pe.exports("ServiceMain") and pe.exports("Control_RunDLL")))
+		uint16( 0 ) == 0x5a4d and ( all of ( $binary* ) and ( pe.exports ( "Control_RunDLL" ) or pe.exports ( "ServiceMain" ) or pe.exports ( "DllGetClassObject" ) ) or ( pe.exports ( "ServiceMain" ) and pe.exports ( "Control_RunDLL" ) ) )
 }
 rule SIGNATURE_BASE_Webshell_H4Ntu_Shell_Powered_By_Tsoi_
 {
@@ -306179,10 +303833,10 @@ rule SIGNATURE_BASE_Webshell_H4Ntu_Shell_Powered_By_Tsoi_
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L32-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L32-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "06ed0b2398f8096f1bebf092d0526137"
-		logic_hash = "2f3cfb6d7d5ee6facb18397e3166ab2a7450f05a24fbb25a159a6168ca631a39"
+		logic_hash = "v1_sha256_2f3cfb6d7d5ee6facb18397e3166ab2a7450f05a24fbb25a159a6168ca631a39"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306206,10 +303860,10 @@ rule SIGNATURE_BASE_Webshell_PHP_Sql
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L49-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L49-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2cf20a207695bbc2311a998d1d795c35"
-		logic_hash = "83049c3c5bce88d239b59accb173e234c3169f59187de17b7e6c2a0aa58a552f"
+		logic_hash = "v1_sha256_83049c3c5bce88d239b59accb173e234c3169f59187de17b7e6c2a0aa58a552f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306231,10 +303885,10 @@ rule SIGNATURE_BASE_Webshell_PHP_A
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L64-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L64-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e3b461f7464d81f5022419d87315a90d"
-		logic_hash = "6bdd5fbe9b16f2d84b884239cf3b6453587933c6b0c4308508d10019b4f36e38"
+		logic_hash = "v1_sha256_6bdd5fbe9b16f2d84b884239cf3b6453587933c6b0c4308508d10019b4f36e38"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306257,10 +303911,10 @@ rule SIGNATURE_BASE_Webshell_Imhapftp_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L80-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L80-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "12911b73bc6a5d313b494102abcf5c57"
-		logic_hash = "9099504870c1e466808060f11aea38472832846d24e3c84fdd69b7d26bfed69d"
+		logic_hash = "v1_sha256_9099504870c1e466808060f11aea38472832846d24e3c84fdd69b7d26bfed69d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306282,10 +303936,10 @@ rule SIGNATURE_BASE_Webshell_Jspspyweb
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L95-L109"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L95-L109"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4e9be07e95fff820a9299f3fb4ace059"
-		logic_hash = "491d9c4efee27469f2a26f6fcb7f7c768eac60977e640096ea5f78ff346e7fbe"
+		logic_hash = "v1_sha256_491d9c4efee27469f2a26f6fcb7f7c768eac60977e640096ea5f78ff346e7fbe"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306307,10 +303961,10 @@ rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L110-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L110-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "49ad9117c96419c35987aaa7e2230f63"
-		logic_hash = "d3d27d80f5f3adbc050a59d0c25953ec5d634344b5d051a4abdf4eeed3b8b035"
+		logic_hash = "v1_sha256_d3d27d80f5f3adbc050a59d0c25953ec5d634344b5d051a4abdf4eeed3b8b035"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306332,10 +303986,10 @@ rule SIGNATURE_BASE_Webshell_Simattacker_Vrsion_1_0_0_Priv8_4_My_Friend
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L125-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L125-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
-		logic_hash = "fc553942b06b305f7b0d5b072a8d4517b0e51229545440ea9c43e9be01d64efa"
+		logic_hash = "v1_sha256_fc553942b06b305f7b0d5b072a8d4517b0e51229545440ea9c43e9be01d64efa"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306357,10 +304011,10 @@ rule SIGNATURE_BASE_Webshell_Phpshell_2_1_Pwhash
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L140-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L140-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ba120abac165a5a30044428fac1970d8"
-		logic_hash = "616c0570550cdb9394b5675864d4eec3fa62390f880817406b2a3b63952b69f0"
+		logic_hash = "v1_sha256_616c0570550cdb9394b5675864d4eec3fa62390f880817406b2a3b63952b69f0"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306382,10 +304036,10 @@ rule SIGNATURE_BASE_Webshell_Phpremoteview
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L155-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L155-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "29420106d9a81553ef0d1ca72b9934d9"
-		logic_hash = "2de48b8640c0f2089a4a0badb4429127cb61ac972459290041e20b959e4e0c05"
+		logic_hash = "v1_sha256_2de48b8640c0f2089a4a0badb4429127cb61ac972459290041e20b959e4e0c05"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306407,10 +304061,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_12302
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L170-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L170-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a3930518ea57d899457a62f372205f7f"
-		logic_hash = "0959a138abc791f17344e25e84b24888ddfe238981fc7e3ffd76c0390006ea46"
+		logic_hash = "v1_sha256_0959a138abc791f17344e25e84b24888ddfe238981fc7e3ffd76c0390006ea46"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306433,10 +304087,10 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Guo
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L186-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L186-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9e69a8f499c660ee0b4796af14dc08f0"
-		logic_hash = "efb7055f42dd6be41ea3983cacea1a70b83675c8ebcb88ae3b250066a29e94eb"
+		logic_hash = "v1_sha256_efb7055f42dd6be41ea3983cacea1a70b83675c8ebcb88ae3b250066a29e94eb"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306458,10 +304112,10 @@ rule SIGNATURE_BASE_Webshell_PHP_Redcod
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L201-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L201-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5c1c8120d82f46ff9d813fbe3354bac5"
-		logic_hash = "eddfd90d27793756bcc685ffe33b2dabc3bb28b9654c33a0f99359e8b6f13678"
+		logic_hash = "v1_sha256_eddfd90d27793756bcc685ffe33b2dabc3bb28b9654c33a0f99359e8b6f13678"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306483,10 +304137,10 @@ rule SIGNATURE_BASE_Webshell_Remview_Fix
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L216-L230"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L216-L230"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
-		logic_hash = "0b29ef74fb0786aefe99281360dc4fe27005eac345a36bc14259afa6fc555303"
+		logic_hash = "v1_sha256_0b29ef74fb0786aefe99281360dc4fe27005eac345a36bc14259afa6fc555303"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306508,10 +304162,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Cmd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L231-L246"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L231-L246"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "895ca846858c315a3ff8daa7c55b3119"
-		logic_hash = "8e72b54267c2f83b288cdd43ccd56ae4ab1f95c17f4dde077e637d951df54866"
+		logic_hash = "v1_sha256_8e72b54267c2f83b288cdd43ccd56ae4ab1f95c17f4dde077e637d951df54866"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306534,10 +304188,10 @@ rule SIGNATURE_BASE_Webshell_Php_Sh_Server
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L247-L260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L247-L260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d87b019e74064aa90e2bb143e5e16cfa"
-		logic_hash = "9f4d940a381e7bd298a252f485d5f1d26fd191c27f6e86e8fa6028237592a8c3"
+		logic_hash = "v1_sha256_9f4d940a381e7bd298a252f485d5f1d26fd191c27f6e86e8fa6028237592a8c3"
 		score = 50
 		quality = 85
 		tags = ""
@@ -306558,10 +304212,10 @@ rule SIGNATURE_BASE_Webshell_PH_Vayv_PH_Vayv
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L261-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L261-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "35fb37f3c806718545d97c6559abd262"
-		logic_hash = "8769400b7b6828849f27092d790d291721c7e1b39dfd2080de5da8e59dd25523"
+		logic_hash = "v1_sha256_8769400b7b6828849f27092d790d291721c7e1b39dfd2080de5da8e59dd25523"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306583,10 +304237,10 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Ice
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L276-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L276-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6560b436d3d3bb75e2ef3f032151d139"
-		logic_hash = "d92cc9ac8630b40f23b9ff7cda5a237b4885d30de4b9b497be7512e7eb020a09"
+		logic_hash = "v1_sha256_d92cc9ac8630b40f23b9ff7cda5a237b4885d30de4b9b497be7512e7eb020a09"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306607,10 +304261,10 @@ rule SIGNATURE_BASE_Webshell_Cihshell_Fix
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L290-L304"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L290-L304"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3823ac218032549b86ee7c26f10c4cb5"
-		logic_hash = "59ae76d6828d8c0ddcbafa19063e6dcf25c826386f46df2b8f9674b628365a2b"
+		logic_hash = "v1_sha256_59ae76d6828d8c0ddcbafa19063e6dcf25c826386f46df2b8f9674b628365a2b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306632,10 +304286,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Shell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L305-L319"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L305-L319"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e63f5a96570e1faf4c7b8ca6df750237"
-		logic_hash = "5cc698e4ff23ca296b339589d12c24e67c99272e73445604a4552d3023e19636"
+		logic_hash = "v1_sha256_5cc698e4ff23ca296b339589d12c24e67c99272e73445604a4552d3023e19636"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306657,10 +304311,10 @@ rule SIGNATURE_BASE_Webshell_Private_I3Lue
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L320-L333"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L320-L333"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "13f5c7a035ecce5f9f380967cf9d4e92"
-		logic_hash = "274586f2c451eda45c3a52b615961dbba806f8d25e34cc358e661fcfd1143d08"
+		logic_hash = "v1_sha256_274586f2c451eda45c3a52b615961dbba806f8d25e34cc358e661fcfd1143d08"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306681,10 +304335,10 @@ rule SIGNATURE_BASE_Webshell_Php_Up
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L334-L349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L334-L349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7edefb8bd0876c41906f4b39b52cd0ef"
-		logic_hash = "22f444ce4068f46c0b57e566faca0c6377346e403de592b0e51869781fda31a9"
+		logic_hash = "v1_sha256_22f444ce4068f46c0b57e566faca0c6377346e403de592b0e51869781fda31a9"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306707,10 +304361,10 @@ rule SIGNATURE_BASE_Webshell_Mysql_Interface_V1_0
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L350-L363"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L350-L363"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a12fc0a3d31e2f89727b9678148cd487"
-		logic_hash = "baa938c4cfd2c46b1752d866e186d76a04c353617d8ec3e0d78a3c546b120d13"
+		logic_hash = "v1_sha256_baa938c4cfd2c46b1752d866e186d76a04c353617d8ec3e0d78a3c546b120d13"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306731,10 +304385,10 @@ rule SIGNATURE_BASE_Webshell_Php_S_U
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L364-L377"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L364-L377"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "efc7ba1a4023bcf40f5e912f1dd85b5a"
-		logic_hash = "3c6904fa475784e737275fd47eabea077bed57e920071c68fa09f7defecbdb72"
+		logic_hash = "v1_sha256_3c6904fa475784e737275fd47eabea077bed57e920071c68fa09f7defecbdb72"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306755,10 +304409,10 @@ rule SIGNATURE_BASE_Webshell_Phpshell_2_1_Config
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L378-L391"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L378-L391"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bd83144a649c5cc21ac41b505a36a8f3"
-		logic_hash = "51d16bcaef5f6795ebcd1154dca79d5cf5a389948b0e59f4939c30fef877e816"
+		logic_hash = "v1_sha256_51d16bcaef5f6795ebcd1154dca79d5cf5a389948b0e59f4939c30fef877e816"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306779,10 +304433,10 @@ rule SIGNATURE_BASE_Webshell_Asp_EFSO_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L392-L405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L392-L405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a341270f9ebd01320a7490c12cb2e64c"
-		logic_hash = "19bd00fabe0b4695129c180dd145e757e0b2c2a6dad751e8c889222c191e03ce"
+		logic_hash = "v1_sha256_19bd00fabe0b4695129c180dd145e757e0b2c2a6dad751e8c889222c191e03ce"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306803,10 +304457,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Up
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L406-L419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L406-L419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "515a5dd86fe48f673b72422cccf5a585"
-		logic_hash = "77c8121d000c45e44717689dec535fde7c9722005d1e4ff40d0b84abcf289f47"
+		logic_hash = "v1_sha256_77c8121d000c45e44717689dec535fde7c9722005d1e4ff40d0b84abcf289f47"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306827,10 +304481,10 @@ rule SIGNATURE_BASE_Webshell_Networkfilemanagerphp
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L420-L433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L420-L433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
-		logic_hash = "235e4062a9b9ebdf7dd0b8a2cb3b16ba7688a75b90d8c527344cf9605304838d"
+		logic_hash = "v1_sha256_235e4062a9b9ebdf7dd0b8a2cb3b16ba7688a75b90d8c527344cf9605304838d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306851,10 +304505,10 @@ rule SIGNATURE_BASE_Webshell_Server_Variables
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L434-L448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L434-L448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "47fb8a647e441488b30f92b4d39003d7"
-		logic_hash = "2a85301f1d6e4c457ff0a1b2a08eb6f054905993a0667087f37b9a7352e38911"
+		logic_hash = "v1_sha256_2a85301f1d6e4c457ff0a1b2a08eb6f054905993a0667087f37b9a7352e38911"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306876,10 +304530,10 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Ice_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L449-L462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L449-L462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1d6335247f58e0a5b03e17977888f5f2"
-		logic_hash = "57c3c369abd826d676290300d8df2d890b777fa1f0e1156654062159a4228db7"
+		logic_hash = "v1_sha256_57c3c369abd826d676290300d8df2d890b777fa1f0e1156654062159a4228db7"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306900,10 +304554,10 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Mdb
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L463-L476"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L463-L476"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fbf3847acef4844f3a0d04230f6b9ff9"
-		logic_hash = "89f7692acd754992f9379b9b4661a01d6ab95cb85a3c2699928aa5ed3a3ac8c5"
+		logic_hash = "v1_sha256_89f7692acd754992f9379b9b4661a01d6ab95cb85a3c2699928aa5ed3a3ac8c5"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306924,10 +304578,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Guige
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L477-L490"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L477-L490"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2c9f2dafa06332957127e2c713aacdd2"
-		logic_hash = "9d71095b5c709dfdd8b5fcebcaa4493d9c93e841e85cda2e2255e0c15ea83659"
+		logic_hash = "v1_sha256_9d71095b5c709dfdd8b5fcebcaa4493d9c93e841e85cda2e2255e0c15ea83659"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306948,10 +304602,10 @@ rule SIGNATURE_BASE_Webshell_Phpspy2010
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L491-L506"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L491-L506"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "14ae0e4f5349924a5047fed9f3b105c5"
-		logic_hash = "b3acef196b30cf9afe24c81860bedff69fc5652c514aa36aba85d16b12bcc432"
+		logic_hash = "v1_sha256_b3acef196b30cf9afe24c81860bedff69fc5652c514aa36aba85d16b12bcc432"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306974,10 +304628,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Ice
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L507-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L507-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d141e011a92f48da72728c35f1934a2b"
-		logic_hash = "524419e802d3cb6ac310565af22ec28044984aa4b1b2ee1cfbd292afd071709c"
+		logic_hash = "v1_sha256_524419e802d3cb6ac310565af22ec28044984aa4b1b2ee1cfbd292afd071709c"
 		score = 70
 		quality = 85
 		tags = ""
@@ -306998,10 +304652,10 @@ rule SIGNATURE_BASE_Webshell_Drag_System
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L521-L534"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L521-L534"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "15ae237cf395fb24cf12bff141fb3f7c"
-		logic_hash = "8ea8d9d64521f47f1396e4f4d6c8f4a71fa1a643799ec408e1d2e0f255dc4996"
+		logic_hash = "v1_sha256_8ea8d9d64521f47f1396e4f4d6c8f4a71fa1a643799ec408e1d2e0f255dc4996"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307022,10 +304676,10 @@ rule SIGNATURE_BASE_Webshell_Darkblade1_3_Asp_Indexx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L535-L548"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L535-L548"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b7f46693648f534c2ca78e3f21685707"
-		logic_hash = "57cfe09d53d42ee9d909a3894b8a3362209c1972c7d96ae5fdc61681c2998a89"
+		logic_hash = "v1_sha256_57cfe09d53d42ee9d909a3894b8a3362209c1972c7d96ae5fdc61681c2998a89"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307046,10 +304700,10 @@ rule SIGNATURE_BASE_Webshell_Phpshell3
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L549-L564"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L549-L564"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "76117b2ee4a7ac06832d50b2d04070b8"
-		logic_hash = "868b1b69fab3ec6fcfa15557075f313f4af0ec9cd15f41bb9dcc9bc26fc17f93"
+		logic_hash = "v1_sha256_868b1b69fab3ec6fcfa15557075f313f4af0ec9cd15f41bb9dcc9bc26fc17f93"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307072,10 +304726,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Hsxa
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L565-L578"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L565-L578"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
-		logic_hash = "7f79b66d87f638bc09ee576de4dc4a8c5b1da7c406d318eeff7a4221c35d2313"
+		logic_hash = "v1_sha256_7f79b66d87f638bc09ee576de4dc4a8c5b1da7c406d318eeff7a4221c35d2313"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307096,10 +304750,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Utils
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L579-L593"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L579-L593"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9827ba2e8329075358b8e8a53e20d545"
-		logic_hash = "90a5b64e59306bdffc5a89f5d86a2dc7a17669021d863e2a5ecea13d65c19053"
+		logic_hash = "v1_sha256_90a5b64e59306bdffc5a89f5d86a2dc7a17669021d863e2a5ecea13d65c19053"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307121,10 +304775,10 @@ rule SIGNATURE_BASE_Webshell_Asp_01
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L594-L607"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L594-L607"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "61a687b0bea0ef97224c7bd2df118b87"
-		logic_hash = "e057800013a9a8f4c3ecbe4e27c14e904700548e6ad9dc1f00313c7a3de7fd2d"
+		logic_hash = "v1_sha256_e057800013a9a8f4c3ecbe4e27c14e904700548e6ad9dc1f00313c7a3de7fd2d"
 		score = 50
 		quality = 85
 		tags = ""
@@ -307145,10 +304799,10 @@ rule SIGNATURE_BASE_Webshell_Asp_404
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L608-L621"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L608-L621"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d9fa1e8513dbf59fa5d130f389032a2d"
-		logic_hash = "3db951af36ed3d08bc10b4c3fc2e67481f005580fb76f66b6ec5789ed6e2efdb"
+		logic_hash = "v1_sha256_3db951af36ed3d08bc10b4c3fc2e67481f005580fb76f66b6ec5789ed6e2efdb"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307169,10 +304823,10 @@ rule SIGNATURE_BASE_Webshell_Webshell_Cnseay02_1
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L622-L635"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L622-L635"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "95fc76081a42c4f26912826cb1bd24b1"
-		logic_hash = "9950fb7c26dfb25665093dbcf5c4a9dcf65466783509a3caa11c2c96d177d855"
+		logic_hash = "v1_sha256_9950fb7c26dfb25665093dbcf5c4a9dcf65466783509a3caa11c2c96d177d855"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307193,10 +304847,10 @@ rule SIGNATURE_BASE_Webshell_Php_Fbi
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L636-L649"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L636-L649"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1fb32f8e58c8deb168c06297a04a21f1"
-		logic_hash = "de8584ae83ee3e23f4ce00ccd73f75b4568d6a4544af45b83784a9a0c34d42e3"
+		logic_hash = "v1_sha256_de8584ae83ee3e23f4ce00ccd73f75b4568d6a4544af45b83784a9a0c34d42e3"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307217,10 +304871,10 @@ rule SIGNATURE_BASE_Webshell_B374Kphp_B374K
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L650-L666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L650-L666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bed7388976f8f1d90422e8795dff1ea6"
-		logic_hash = "1f0fc5e309dd67a11d6ba9b698fd9ca3c7e6616545c220de79aaa3b63f0ad931"
+		logic_hash = "v1_sha256_1f0fc5e309dd67a11d6ba9b698fd9ca3c7e6616545c220de79aaa3b63f0ad931"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307244,10 +304898,10 @@ rule SIGNATURE_BASE_Webshell_Cmd_Asp_5_1
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L667-L680"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L667-L680"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
-		logic_hash = "1ff4ae8c08cec4605594e97d6c077d4808d3a73c04ddf6a51952252dd2d01cf4"
+		logic_hash = "v1_sha256_1ff4ae8c08cec4605594e97d6c077d4808d3a73c04ddf6a51952252dd2d01cf4"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307268,10 +304922,10 @@ rule SIGNATURE_BASE_Webshell_Php_Dodo_Zip
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L681-L695"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L681-L695"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b7800364374077ce8864796240162ad5"
-		logic_hash = "bdeffafdedeadaba36c5c67f981c42d6111b954622780b930e9eeb9956c638b5"
+		logic_hash = "v1_sha256_bdeffafdedeadaba36c5c67f981c42d6111b954622780b930e9eeb9956c638b5"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307293,10 +304947,10 @@ rule SIGNATURE_BASE_Webshell_Azrailphp_V1_0
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L696-L710"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L696-L710"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "26b2d3943395682e36da06ed493a3715"
-		logic_hash = "d0ccf9e37e378db4523d7918b30cff358115e7a4c36fad55a75f3aff218563c6"
+		logic_hash = "v1_sha256_d0ccf9e37e378db4523d7918b30cff358115e7a4c36fad55a75f3aff218563c6"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307318,10 +304972,10 @@ rule SIGNATURE_BASE_Webshell_Php_List
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L711-L726"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L711-L726"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "922b128ddd90e1dc2f73088956c548ed"
-		logic_hash = "007f9307493bca71dcbdcf6ba6c45bf36899e8f636ccbd09c26453cb0aea0847"
+		logic_hash = "v1_sha256_007f9307493bca71dcbdcf6ba6c45bf36899e8f636ccbd09c26453cb0aea0847"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307344,10 +304998,10 @@ rule SIGNATURE_BASE_Webshell_Ironshell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L727-L741"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L727-L741"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
-		logic_hash = "7e4916010a33383cfc3cbbcd5d575ac2f3a579220b66bd07e3121f3db30da66d"
+		logic_hash = "v1_sha256_7e4916010a33383cfc3cbbcd5d575ac2f3a579220b66bd07e3121f3db30da66d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307369,10 +305023,10 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_404
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L742-L755"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L742-L755"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ee94952dc53d9a29bdf4ece54c7a7aa7"
-		logic_hash = "0743d18bc5066c96cca8cc0883971d3bc876e6c2fbb996e55b6930c715e07395"
+		logic_hash = "v1_sha256_0743d18bc5066c96cca8cc0883971d3bc876e6c2fbb996e55b6930c715e07395"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307393,10 +305047,10 @@ rule SIGNATURE_BASE_Webshell_ASP_Aspydrv
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L756-L769"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L756-L769"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "de0a58f7d1e200d0b2c801a94ebce330"
-		logic_hash = "a4a6205ace49778ddc421b0f0e65c576e2ffe40ce2ab84debb939d5324420405"
+		logic_hash = "v1_sha256_a4a6205ace49778ddc421b0f0e65c576e2ffe40ce2ab84debb939d5324420405"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307417,10 +305071,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Web
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L770-L783"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L770-L783"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4bc11e28f5dccd0c45a37f2b541b2e98"
-		logic_hash = "ed0ace0ba5f8a9e763353c42e3e3a39da10596e8517aad33e5c5080b44e4d61a"
+		logic_hash = "v1_sha256_ed0ace0ba5f8a9e763353c42e3e3a39da10596e8517aad33e5c5080b44e4d61a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307441,10 +305095,10 @@ rule SIGNATURE_BASE_Webshell_Mysqlwebsh
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L784-L797"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L784-L797"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "babfa76d11943a22484b3837f105fada"
-		logic_hash = "365d19c086b3bbb98cbe1e1ed1e7522ce98dc2614a39c747717c277cebef33d2"
+		logic_hash = "v1_sha256_365d19c086b3bbb98cbe1e1ed1e7522ce98dc2614a39c747717c277cebef33d2"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307465,10 +305119,10 @@ rule SIGNATURE_BASE_Webshell_Jspshell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L798-L812"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L798-L812"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0d5b5a17552254be6c1c8f1eb3a5fdc1"
-		logic_hash = "058ddd64b142cada7144b9befa81ada314b72e6f23524d98efcb10136c23ed33"
+		logic_hash = "v1_sha256_058ddd64b142cada7144b9befa81ada314b72e6f23524d98efcb10136c23ed33"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307490,10 +305144,10 @@ rule SIGNATURE_BASE_Webshell_Dx_Dx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L813-L827"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L813-L827"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
-		logic_hash = "c2eddf58b25caff79460ab9a87ac0573d483866a87c1b1ec0984afce2c22b29f"
+		logic_hash = "v1_sha256_c2eddf58b25caff79460ab9a87ac0573d483866a87c1b1ec0984afce2c22b29f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307515,10 +305169,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Ntdaddy
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L828-L842"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L828-L842"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c5e6baa5d140f73b4e16a6cfde671c68"
-		logic_hash = "7237eb7233c6affcc1f67a764f704b7d7e1d13f71c64893286c6c99318cc7c3e"
+		logic_hash = "v1_sha256_7237eb7233c6affcc1f67a764f704b7d7e1d13f71c64893286c6c99318cc7c3e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307540,10 +305194,10 @@ rule SIGNATURE_BASE_Webshell_Mysql_Web_Interface_Version_0_8
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L843-L856"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L843-L856"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "36d4f34d0a22080f47bb1cb94107c60f"
-		logic_hash = "680d4368804ad21e46dbe400563beca3ef724711b5432dccce1276ecadc04f2c"
+		logic_hash = "v1_sha256_680d4368804ad21e46dbe400563beca3ef724711b5432dccce1276ecadc04f2c"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307564,10 +305218,10 @@ rule SIGNATURE_BASE_Webshell_Elmaliseker_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L857-L871"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L857-L871"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
-		logic_hash = "ca300cd142b3c8b820d3b5f5a56eeb834d9acb1d85916b932bd67fb4a25f4ed0"
+		logic_hash = "v1_sha256_ca300cd142b3c8b820d3b5f5a56eeb834d9acb1d85916b932bd67fb4a25f4ed0"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307589,10 +305243,10 @@ rule SIGNATURE_BASE_Webshell_ASP_Remexp
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L872-L886"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L872-L886"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
-		logic_hash = "7a3b35c4a16f26167180cea81f67de101edabb9b35479f7e5acae7f3fe07f304"
+		logic_hash = "v1_sha256_7a3b35c4a16f26167180cea81f67de101edabb9b35479f7e5acae7f3fe07f304"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307614,10 +305268,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_List1
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L887-L901"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L887-L901"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8d9e5afa77303c9c01ff34ea4e7f6ca6"
-		logic_hash = "61ecafe477d98c5eb6887a9ff50960fc28b84512d09a36c02588159b08b395a4"
+		logic_hash = "v1_sha256_61ecafe477d98c5eb6887a9ff50960fc28b84512d09a36c02588159b08b395a4"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307639,10 +305293,10 @@ rule SIGNATURE_BASE_Webshell_Phpkit_1_0_Odd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L902-L917"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L902-L917"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "594d1b1311bbef38a0eb3d6cbb1ab538"
-		logic_hash = "bf99d6a71b9ef72574d928a09f3a479f2f819287d78c9a5435e45752e76a59bf"
+		logic_hash = "v1_sha256_bf99d6a71b9ef72574d928a09f3a479f2f819287d78c9a5435e45752e76a59bf"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307665,10 +305319,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_123
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L918-L933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L918-L933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c691f53e849676cac68a38d692467641"
-		logic_hash = "48925d3a302bf09ecb3f031301ca8afc722c7ef53b87efa27a3c4b58ee15217d"
+		logic_hash = "v1_sha256_48925d3a302bf09ecb3f031301ca8afc722c7ef53b87efa27a3c4b58ee15217d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307691,10 +305345,10 @@ rule SIGNATURE_BASE_Webshell_Asp_1
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L934-L948"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L934-L948"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8991148adf5de3b8322ec5d78cb01bdb"
-		logic_hash = "9cae40c8fc3966942a8fc3ee0f5d07081ba2d1c1c3156144488ba64015d6838b"
+		logic_hash = "v1_sha256_9cae40c8fc3966942a8fc3ee0f5d07081ba2d1c1c3156144488ba64015d6838b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307716,10 +305370,10 @@ rule SIGNATURE_BASE_Webshell_ASP_Tool
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L949-L964"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L949-L964"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4ab68d38527d5834e9c1ff64407b34fb"
-		logic_hash = "62ba39bac09cb403a47678cd38c519642cc3c20f43c470b828ec448c42e9bb73"
+		logic_hash = "v1_sha256_62ba39bac09cb403a47678cd38c519642cc3c20f43c470b828ec448c42e9bb73"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307742,10 +305396,10 @@ rule SIGNATURE_BASE_Webshell_Cmd_Win32
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L965-L979"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L965-L979"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cc4d4d6cc9a25984aa9a7583c7def174"
-		logic_hash = "b90ba15b7b2c557f7b2303695b7f1f737f63df06d712c89e0cfea51c7d37e21d"
+		logic_hash = "v1_sha256_b90ba15b7b2c557f7b2303695b7f1f737f63df06d712c89e0cfea51c7d37e21d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307767,10 +305421,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Jshell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L980-L997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L980-L997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "124b22f38aaaf064cef14711b2602c06"
-		logic_hash = "dfe3ac097de4ca406ab7ec967fdc03d1e87c74f84fc675b58438a842d80cccda"
+		logic_hash = "v1_sha256_dfe3ac097de4ca406ab7ec967fdc03d1e87c74f84fc675b58438a842d80cccda"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307795,10 +305449,10 @@ rule SIGNATURE_BASE_Webshell_ASP_Zehir4
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L998-L1011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L998-L1011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7f4e12e159360743ec016273c3b9108c"
-		logic_hash = "aa3e07ee6369dd5f86f28a53c8e45391de718d4935021339a7b47829b5196f54"
+		logic_hash = "v1_sha256_aa3e07ee6369dd5f86f28a53c8e45391de718d4935021339a7b47829b5196f54"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307819,10 +305473,10 @@ rule SIGNATURE_BASE_Webshell_Wsb_Idc
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1012-L1026"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1012-L1026"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7c5b1b30196c51f1accbffb80296395f"
-		logic_hash = "f274061f1a02ab65bc574a6586343f74262a463c5200cd2c231a752f54967404"
+		logic_hash = "v1_sha256_f274061f1a02ab65bc574a6586343f74262a463c5200cd2c231a752f54967404"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307844,10 +305498,10 @@ rule SIGNATURE_BASE_Webshell_Cpg_143_Incl_Xpl
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1027-L1041"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1027-L1041"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5937b131b67d8e0afdbd589251a5e176"
-		logic_hash = "7c2ce25c33e167761d72331d7c4d4f7cd6029ee0caf6e2008df8b12894faaaf8"
+		logic_hash = "v1_sha256_7c2ce25c33e167761d72331d7c4d4f7cd6029ee0caf6e2008df8b12894faaaf8"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307869,10 +305523,10 @@ rule SIGNATURE_BASE_Webshell_Mumaasp_Com
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1042-L1055"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1042-L1055"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cce32b2e18f5357c85b6d20f564ebd5d"
-		logic_hash = "75e2a056782190e9914264b9e34002faea75a35ab0f97bf1e05dec15432d064c"
+		logic_hash = "v1_sha256_75e2a056782190e9914264b9e34002faea75a35ab0f97bf1e05dec15432d064c"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307893,10 +305547,10 @@ rule SIGNATURE_BASE_Webshell_Php_404
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1056-L1069"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1056-L1069"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ced050df5ca42064056a7ad610a191b3"
-		logic_hash = "3fc928e6edda8fdc4220f57215db61b7fbf8de5b00423b219a173c8ecde40b79"
+		logic_hash = "v1_sha256_3fc928e6edda8fdc4220f57215db61b7fbf8de5b00423b219a173c8ecde40b79"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307917,10 +305571,10 @@ rule SIGNATURE_BASE_Webshell_Webshell_Cnseay_X
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1070-L1083"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1070-L1083"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a0f9f7f5cd405a514a7f3be329f380e5"
-		logic_hash = "59cb8b8a5873b716a25096c7b12f09293a812b63f31fea07d919b9c4d2bc9a19"
+		logic_hash = "v1_sha256_59cb8b8a5873b716a25096c7b12f09293a812b63f31fea07d919b9c4d2bc9a19"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307941,10 +305595,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Up
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1084-L1098"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1084-L1098"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f775e721cfe85019fe41c34f47c0d67c"
-		logic_hash = "dff2896d2226ade08e74147121a0e0036e8545dfff36b48b5a0771c9c7d537e9"
+		logic_hash = "v1_sha256_dff2896d2226ade08e74147121a0e0036e8545dfff36b48b5a0771c9c7d537e9"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307966,10 +305620,10 @@ rule SIGNATURE_BASE_Webshell_Phpkit_0_1A_Odd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1099-L1115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1099-L1115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3c30399e7480c09276f412271f60ed01"
-		logic_hash = "745734658ed4000e1399531ae44125f8462ecd37388e6223cfa9bf91dbb52bbc"
+		logic_hash = "v1_sha256_745734658ed4000e1399531ae44125f8462ecd37388e6223cfa9bf91dbb52bbc"
 		score = 70
 		quality = 85
 		tags = ""
@@ -307993,10 +305647,10 @@ rule SIGNATURE_BASE_Webshell_ASP_Cmd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1116-L1129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1116-L1129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "97af88b478422067f23b001dd06d56a9"
-		logic_hash = "c1353e43876e18f18638a558a29a12d6e82603641fedd81b042adca91fea0d18"
+		logic_hash = "v1_sha256_c1353e43876e18f18638a558a29a12d6e82603641fedd81b042adca91fea0d18"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308017,10 +305671,10 @@ rule SIGNATURE_BASE_Webshell_PHP_Shell_X3
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1130-L1145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1130-L1145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
-		logic_hash = "7361a7eecf345b9c1809294b6b081db8769805ec3e6c656adc4ac87261193683"
+		logic_hash = "v1_sha256_7361a7eecf345b9c1809294b6b081db8769805ec3e6c656adc4ac87261193683"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308043,10 +305697,10 @@ rule SIGNATURE_BASE_Webshell_PHP_G00Nv13
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1146-L1160"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1146-L1160"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "35ad2533192fe8a1a76c3276140db820"
-		logic_hash = "dd9f03a7ad0d2b73f7a8602ab267e0e8e5cb1f9250f9a25c86ded3797df2f8d5"
+		logic_hash = "v1_sha256_dd9f03a7ad0d2b73f7a8602ab267e0e8e5cb1f9250f9a25c86ded3797df2f8d5"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308068,10 +305722,10 @@ rule SIGNATURE_BASE_Webshell_Php_H6Ss
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1161-L1174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1161-L1174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "272dde9a4a7265d6c139287560328cd5"
-		logic_hash = "c4001be111ff271335dd65c15c59da979a8e202bcf58a7f10de7f03644472153"
+		logic_hash = "v1_sha256_c4001be111ff271335dd65c15c59da979a8e202bcf58a7f10de7f03644472153"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308092,10 +305746,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Zx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1175-L1188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1175-L1188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "67627c264db1e54a4720bd6a64721674"
-		logic_hash = "d97df624801d0f24141dfe7074d290a56e639af7d867c907362ff4434c3eeac0"
+		logic_hash = "v1_sha256_d97df624801d0f24141dfe7074d290a56e639af7d867c907362ff4434c3eeac0"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308116,10 +305770,10 @@ rule SIGNATURE_BASE_Webshell_Ani_Shell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1189-L1204"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1189-L1204"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "889bfc9fbb8ee7832044fc575324d01a"
-		logic_hash = "c8caf8686c36a41b5aae093e88b8872350cf625c59a14389c5df93f284c8f05a"
+		logic_hash = "v1_sha256_c8caf8686c36a41b5aae093e88b8872350cf625c59a14389c5df93f284c8f05a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308142,10 +305796,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_K8Cmd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1205-L1218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1205-L1218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b39544415e692a567455ff033a97a682"
-		logic_hash = "e523a5b1118c6f4d5798f130c00466c7945d27a6fbe0d4cb3a40b7f36da2a502"
+		logic_hash = "v1_sha256_e523a5b1118c6f4d5798f130c00466c7945d27a6fbe0d4cb3a40b7f36da2a502"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308166,10 +305820,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Cmd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1220-L1233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1220-L1233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5391c4a8af1ede757ba9d28865e75853"
-		logic_hash = "e48d4e2d14a3605fd9dda03630820a0fb53d893cc4d283739fde11f9ab7d9d1e"
+		logic_hash = "v1_sha256_e48d4e2d14a3605fd9dda03630820a0fb53d893cc4d283739fde11f9ab7d9d1e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308190,10 +305844,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_K81
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1235-L1249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1235-L1249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "41efc5c71b6885add9c1d516371bd6af"
-		logic_hash = "f9c6b5bec9313c6fd059055fa18332675838419bba3348bb852b50806f26ccb2"
+		logic_hash = "v1_sha256_f9c6b5bec9313c6fd059055fa18332675838419bba3348bb852b50806f26ccb2"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308215,10 +305869,10 @@ rule SIGNATURE_BASE_Webshell_ASP_Zehir
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1250-L1263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1250-L1263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0061d800aee63ccaf41d2d62ec15985d"
-		logic_hash = "90920258017cf189da128dce477e71f0040bc66aefa6f018f64db64d22f60ae5"
+		logic_hash = "v1_sha256_90920258017cf189da128dce477e71f0040bc66aefa6f018f64db64d22f60ae5"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308240,10 +305894,10 @@ rule SIGNATURE_BASE_Webshell_Worse_Linux_Shell_1
 		modified = "2023-12-05"
 		old_rule_name = "webshell_Worse_Linux_Shell"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1264-L1278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1264-L1278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
-		logic_hash = "a24e7ae7c722da7f265f032315b1e8e402c2fc4a2a54a685671a9e52124f6553"
+		logic_hash = "v1_sha256_a24e7ae7c722da7f265f032315b1e8e402c2fc4a2a54a685671a9e52124f6553"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308264,10 +305918,10 @@ rule SIGNATURE_BASE_Webshell_Zacosmall
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1279-L1292"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1279-L1292"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5295ee8dc2f5fd416be442548d68f7a6"
-		logic_hash = "739d58e3ab6712c703e0cb0e0070afec3376844b77ed081a5d12407cabb62319"
+		logic_hash = "v1_sha256_739d58e3ab6712c703e0cb0e0070afec3376844b77ed081a5d12407cabb62319"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308288,10 +305942,10 @@ rule SIGNATURE_BASE_Webshell_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1293-L1306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1293-L1306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
-		logic_hash = "9630fc0371193bfbd0bd4fb15856477e7739fc9f11ee539d119ee837b1a54502"
+		logic_hash = "v1_sha256_9630fc0371193bfbd0bd4fb15856477e7739fc9f11ee539d119ee837b1a54502"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308312,10 +305966,10 @@ rule SIGNATURE_BASE_Webshell_Redirect
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1307-L1320"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1307-L1320"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "97da83c6e3efbba98df270cc70beb8f8"
-		logic_hash = "b16026623fe7802db9823ad4a3dab051747eea6bd41ce72a0c8c6757bfa2c6f7"
+		logic_hash = "v1_sha256_b16026623fe7802db9823ad4a3dab051747eea6bd41ce72a0c8c6757bfa2c6f7"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308336,10 +305990,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Cmdjsp
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1321-L1334"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1321-L1334"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b815611cc39f17f05a73444d699341d4"
-		logic_hash = "b4822e47a27c598be746ac71bf9b60dafe08d50c83a2dfee5e40ea384fcff21a"
+		logic_hash = "v1_sha256_b4822e47a27c598be746ac71bf9b60dafe08d50c83a2dfee5e40ea384fcff21a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308360,10 +306014,10 @@ rule SIGNATURE_BASE_Webshell_Java_Shell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1335-L1349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1335-L1349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
-		logic_hash = "0d313ff81a36b456326df0054853c31d69710fc142fcfa65747691238af4e635"
+		logic_hash = "v1_sha256_0d313ff81a36b456326df0054853c31d69710fc142fcfa65747691238af4e635"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308385,10 +306039,10 @@ rule SIGNATURE_BASE_Webshell_Asp_1D
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1350-L1363"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1350-L1363"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fad7504ca8a55d4453e552621f81563c"
-		logic_hash = "85b17fde8fb535b64e5eabc887428d9b73adc5bc6741a3a387f235a8b0c6089a"
+		logic_hash = "v1_sha256_85b17fde8fb535b64e5eabc887428d9b73adc5bc6741a3a387f235a8b0c6089a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308409,10 +306063,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Ixrbe
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1364-L1377"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1364-L1377"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e26e7e0ebc6e7662e1123452a939e2cd"
-		logic_hash = "8710d092b81c5de1e328ad6e57e5c4a25748cc92844198038c103dabc1e76e77"
+		logic_hash = "v1_sha256_8710d092b81c5de1e328ad6e57e5c4a25748cc92844198038c103dabc1e76e77"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308433,10 +306087,10 @@ rule SIGNATURE_BASE_Webshell_PHP_G5
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1378-L1391"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1378-L1391"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "95b4a56140a650c74ed2ec36f08d757f"
-		logic_hash = "2edffbea5142ef146cec57cb88b473532f56ab3e95151c5648eaeabe6a75feda"
+		logic_hash = "v1_sha256_2edffbea5142ef146cec57cb88b473532f56ab3e95151c5648eaeabe6a75feda"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308457,10 +306111,10 @@ rule SIGNATURE_BASE_Webshell_PHP_R57142
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1392-L1405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1392-L1405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0911b6e6b8f4bcb05599b2885a7fe8a8"
-		logic_hash = "3afa0463de3acb12480dba1b2ab9cd53fca88216ba54c5e044e48ebd84bf17bd"
+		logic_hash = "v1_sha256_3afa0463de3acb12480dba1b2ab9cd53fca88216ba54c5e044e48ebd84bf17bd"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308481,10 +306135,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Tree
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1406-L1420"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1406-L1420"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bcdf7bbf7bbfa1ffa4f9a21957dbcdfa"
-		logic_hash = "180aa4572a42d23f3e44589f876356ec973fd64cdd53bac69936b93699888ac2"
+		logic_hash = "v1_sha256_180aa4572a42d23f3e44589f876356ec973fd64cdd53bac69936b93699888ac2"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308506,10 +306160,10 @@ rule SIGNATURE_BASE_Webshell_C99Madshell_V_3_0_Smowu
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1421-L1435"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1421-L1435"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "74e1e7c7a6798f1663efb42882b85bee"
-		logic_hash = "d84a5c573b89790efdbe67a684feb7db88521027e86b7588f090696fd90cbc87"
+		logic_hash = "v1_sha256_d84a5c573b89790efdbe67a684feb7db88521027e86b7588f090696fd90cbc87"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308531,10 +306185,10 @@ rule SIGNATURE_BASE_Webshell_Simple_Backdoor
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1436-L1451"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1436-L1451"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f091d1b9274c881f8e41b2f96e6b9936"
-		logic_hash = "252285e8a796757235d775427e5a73980d065c1221190545428910a77f46bb9a"
+		logic_hash = "v1_sha256_252285e8a796757235d775427e5a73980d065c1221190545428910a77f46bb9a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308557,10 +306211,10 @@ rule SIGNATURE_BASE_Webshell_PHP_404
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1452-L1465"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1452-L1465"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "078c55ac475ab9e028f94f879f548bca"
-		logic_hash = "b0524ecddf990048e3e40f471c24075c0e87654c6fe40f17dc3ff43743402e24"
+		logic_hash = "v1_sha256_b0524ecddf990048e3e40f471c24075c0e87654c6fe40f17dc3ff43743402e24"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308581,10 +306235,10 @@ rule SIGNATURE_BASE_Webshell_Macker_S_Private_Phpshell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1466-L1481"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1466-L1481"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e24cbf0e294da9ac2117dc660d890bb9"
-		logic_hash = "4bccc1aca8698e601133436a55538c08e3e1fa113a0776c04590eaf4a10fd309"
+		logic_hash = "v1_sha256_4bccc1aca8698e601133436a55538c08e3e1fa113a0776c04590eaf4a10fd309"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308607,10 +306261,10 @@ rule SIGNATURE_BASE_Webshell_Antichat_Shell_V1_3_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1482-L1495"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1482-L1495"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "40d0abceba125868be7f3f990f031521"
-		logic_hash = "d5a1dc31f442f8db7771ee64164436f6c562ef9f4a203a1e2006d37f9df91846"
+		logic_hash = "v1_sha256_d5a1dc31f442f8db7771ee64164436f6c562ef9f4a203a1e2006d37f9df91846"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308631,10 +306285,10 @@ rule SIGNATURE_BASE_Webshell_Safe_Mode_Breaker
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1496-L1510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1496-L1510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5bd07ccb1111950a5b47327946bfa194"
-		logic_hash = "4adcefc05413a02653a2a405791345a1a76058a39f6e2b03765c4485f7c6b106"
+		logic_hash = "v1_sha256_4adcefc05413a02653a2a405791345a1a76058a39f6e2b03765c4485f7c6b106"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308656,10 +306310,10 @@ rule SIGNATURE_BASE_Webshell_Sst_Sheller
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1511-L1525"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1511-L1525"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d93c62a0a042252f7531d8632511ca56"
-		logic_hash = "4faac0b22fec809f2100bad200ba1f9fb9e16fab743e1b1cbfe0b80c6d2fee32"
+		logic_hash = "v1_sha256_4faac0b22fec809f2100bad200ba1f9fb9e16fab743e1b1cbfe0b80c6d2fee32"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308681,10 +306335,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_List
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1526-L1541"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1526-L1541"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1ea290ff4259dcaeb680cec992738eda"
-		logic_hash = "5641bff0ec161fe72e502641b6138186d541ebfcbf499e0295a61f9f6f085654"
+		logic_hash = "v1_sha256_5641bff0ec161fe72e502641b6138186d541ebfcbf499e0295a61f9f6f085654"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308707,10 +306361,10 @@ rule SIGNATURE_BASE_Webshell_Phpjackal_V1_5
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1542-L1556"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1542-L1556"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d76dc20a4017191216a0315b7286056f"
-		logic_hash = "457bc71cb8e684dafb14b1c5d2faa4366cedce5eba9545493be2b1d49daf98b6"
+		logic_hash = "v1_sha256_457bc71cb8e684dafb14b1c5d2faa4366cedce5eba9545493be2b1d49daf98b6"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308732,10 +306386,10 @@ rule SIGNATURE_BASE_Webshell_Customize
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1557-L1570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1557-L1570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d55578eccad090f30f5d735b8ec530b1"
-		logic_hash = "462d97427793ef6e897b33f4fd02d452ad8cd11ddef21aa25d13efc981eb3afb"
+		logic_hash = "v1_sha256_462d97427793ef6e897b33f4fd02d452ad8cd11ddef21aa25d13efc981eb3afb"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308756,10 +306410,10 @@ rule SIGNATURE_BASE_Webshell_S72_Shell_V1_1_Coding
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1571-L1584"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1571-L1584"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c2e8346a5515c81797af36e7e4a3828e"
-		logic_hash = "fd200d8aa347242546a1da311edc61ceebaec5f7d6b4fe2f49f069b36689f547"
+		logic_hash = "v1_sha256_fd200d8aa347242546a1da311edc61ceebaec5f7d6b4fe2f49f069b36689f547"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308780,10 +306434,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Sys3
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1585-L1600"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1585-L1600"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b3028a854d07674f4d8a9cf2fb6137ec"
-		logic_hash = "14b0ac1b1b8538b0c05dcd0a8b7129fdcad2e595ea00630bd55cee6dff596d4f"
+		logic_hash = "v1_sha256_14b0ac1b1b8538b0c05dcd0a8b7129fdcad2e595ea00630bd55cee6dff596d4f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308806,10 +306460,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Guige02
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1601-L1615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1601-L1615"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a3b8b2280c56eaab777d633535baf21d"
-		logic_hash = "c214e50b209970c03d389d97673901ec44b2727e5c7588e5e4d0a644cc691423"
+		logic_hash = "v1_sha256_c214e50b209970c03d389d97673901ec44b2727e5c7588e5e4d0a644cc691423"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308831,10 +306485,10 @@ rule SIGNATURE_BASE_Webshell_Php_Ghost
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1616-L1631"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1616-L1631"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "38dc8383da0859dca82cf0c943dbf16d"
-		logic_hash = "9a7635d313345e7b7cb7424726ed62015afd78412b504e406155f85c4cdf623f"
+		logic_hash = "v1_sha256_9a7635d313345e7b7cb7424726ed62015afd78412b504e406155f85c4cdf623f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308857,10 +306511,10 @@ rule SIGNATURE_BASE_Webshell_Winx_Shell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1632-L1646"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1632-L1646"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "17ab5086aef89d4951fe9b7c7a561dda"
-		logic_hash = "e6dd5178cafccca751dd3f2e36206acd214a65b2e0783a738a104b3dc680ca21"
+		logic_hash = "v1_sha256_e6dd5178cafccca751dd3f2e36206acd214a65b2e0783a738a104b3dc680ca21"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308882,10 +306536,10 @@ rule SIGNATURE_BASE_Webshell_Crystal_Crystal
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1647-L1661"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1647-L1661"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fdbf54d5bf3264eb1c4bff1fac548879"
-		logic_hash = "735332a2ec7df65cca4ca69e702c5893d302a01c7ee7b84d01a1e6ab9646de93"
+		logic_hash = "v1_sha256_735332a2ec7df65cca4ca69e702c5893d302a01c7ee7b84d01a1e6ab9646de93"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308907,10 +306561,10 @@ rule SIGNATURE_BASE_Webshell_R57_1_4_0
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1662-L1678"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1662-L1678"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "574f3303e131242568b0caf3de42f325"
-		logic_hash = "cb48621c572d529b8dc634e7b6360257ad4fce9664bfca7ee7c0101be42d2c24"
+		logic_hash = "v1_sha256_cb48621c572d529b8dc634e7b6360257ad4fce9664bfca7ee7c0101be42d2c24"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308934,10 +306588,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Ajn
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1680-L1694"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1680-L1694"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aaafafc5d286f0bff827a931f6378d04"
-		logic_hash = "0a6c9a210c0337d6b984bcf6cd7f14103a0f6f5d38a26c789519c2b1629aaede"
+		logic_hash = "v1_sha256_0a6c9a210c0337d6b984bcf6cd7f14103a0f6f5d38a26c789519c2b1629aaede"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308959,10 +306613,10 @@ rule SIGNATURE_BASE_Webshell_Php_Cmd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1695-L1710"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1695-L1710"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c38ae5ba61fd84f6bbbab98d89d8a346"
-		logic_hash = "d9a0802f6fd7047ba5477f6bba61c4ac02cabfce06270fdbd8e8e68a693ccf68"
+		logic_hash = "v1_sha256_d9a0802f6fd7047ba5477f6bba61c4ac02cabfce06270fdbd8e8e68a693ccf68"
 		score = 70
 		quality = 85
 		tags = ""
@@ -308985,10 +306639,10 @@ rule SIGNATURE_BASE_Webshell_Asp_List
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1711-L1725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1711-L1725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1cfa493a165eb4b43e6d4cc0f2eab575"
-		logic_hash = "9c8bdeb5992015b26fbee418ed6e6b7c6b0901f26bddf9dc26706c0b63ea9c95"
+		logic_hash = "v1_sha256_9c8bdeb5992015b26fbee418ed6e6b7c6b0901f26bddf9dc26706c0b63ea9c95"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309010,10 +306664,10 @@ rule SIGNATURE_BASE_Webshell_PHP_Co
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1726-L1740"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1726-L1740"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "62199f5ac721a0cb9b28f465a513874c"
-		logic_hash = "3fab3e97d10b6c56fb7df8bcd520bda318fc127a620c5aafba09cb36ffd6a8df"
+		logic_hash = "v1_sha256_3fab3e97d10b6c56fb7df8bcd520bda318fc127a620c5aafba09cb36ffd6a8df"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309035,10 +306689,10 @@ rule SIGNATURE_BASE_Webshell_PHP_150
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1741-L1755"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1741-L1755"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "400c4b0bed5c90f048398e1d268ce4dc"
-		logic_hash = "139e3d6aa3cd2b6a9731a6cc14c921f9fd82ff7ca79d156f1ff6bc544897fb12"
+		logic_hash = "v1_sha256_139e3d6aa3cd2b6a9731a6cc14c921f9fd82ff7ca79d156f1ff6bc544897fb12"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309060,10 +306714,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Cmdjsp_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1756-L1770"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1756-L1770"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1b5ae3649f03784e2a5073fa4d160c8b"
-		logic_hash = "83be82e260adcff9d3d11344c363f6b5da331339ffe78e561cea9ab09b209030"
+		logic_hash = "v1_sha256_83be82e260adcff9d3d11344c363f6b5da331339ffe78e561cea9ab09b209030"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309085,10 +306739,10 @@ rule SIGNATURE_BASE_Webshell_PHP_C37
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1771-L1785"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1771-L1785"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d01144c04e7a46870a8dd823eb2fe5c8"
-		logic_hash = "b93394f4e05cc96c31a8adcb0981aa8b069780893c469b41ece3d3ce92c42251"
+		logic_hash = "v1_sha256_b93394f4e05cc96c31a8adcb0981aa8b069780893c469b41ece3d3ce92c42251"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309110,10 +306764,10 @@ rule SIGNATURE_BASE_Webshell_PHP_B37
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1786-L1799"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1786-L1799"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0421445303cfd0ec6bc20b3846e30ff0"
-		logic_hash = "ae0cca5723a1e885c26ece5082c24f4c95f0262b8e7baf6db5efde5cfee2cc42"
+		logic_hash = "v1_sha256_ae0cca5723a1e885c26ece5082c24f4c95f0262b8e7baf6db5efde5cfee2cc42"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309134,10 +306788,10 @@ rule SIGNATURE_BASE_Webshell_Php_Backdoor
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1800-L1814"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1800-L1814"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
-		logic_hash = "1f754b4d29eb93316183cf904b375ded7ccdae1d2196fe05950c449ed0d690f4"
+		logic_hash = "v1_sha256_1f754b4d29eb93316183cf904b375ded7ccdae1d2196fe05950c449ed0d690f4"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309159,10 +306813,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Dabao
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1815-L1829"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1815-L1829"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3919b959e3fa7e86d52c2b0a91588d5d"
-		logic_hash = "62cf46dc16a7365d196c2cb8ede8b1380a0877d134d3726d7c777096a4eda942"
+		logic_hash = "v1_sha256_62cf46dc16a7365d196c2cb8ede8b1380a0877d134d3726d7c777096a4eda942"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309184,10 +306838,10 @@ rule SIGNATURE_BASE_Webshell_Php_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1830-L1843"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1830-L1843"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "267c37c3a285a84f541066fc5b3c1747"
-		logic_hash = "bd485c825ae7ac11ff67d109d3c07fb405272a5919e00af39788d1a9c94e754d"
+		logic_hash = "v1_sha256_bd485c825ae7ac11ff67d109d3c07fb405272a5919e00af39788d1a9c94e754d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309208,10 +306862,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Cmdasp
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1844-L1858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1844-L1858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "57b51418a799d2d016be546f399c2e9b"
-		logic_hash = "4259419b4db8e6a83df6f7d258d41028f7f76b0fd2308eeadb4555066c5a2940"
+		logic_hash = "v1_sha256_4259419b4db8e6a83df6f7d258d41028f7f76b0fd2308eeadb4555066c5a2940"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309233,10 +306887,10 @@ rule SIGNATURE_BASE_Webshell_Spjspshell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1859-L1872"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1859-L1872"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d39d51154aaad4ba89947c459a729971"
-		logic_hash = "7926eadd3ffb21de73a63e7a28a525037bf88396ea369599b41ac8c0b0d112ad"
+		logic_hash = "v1_sha256_7926eadd3ffb21de73a63e7a28a525037bf88396ea369599b41ac8c0b0d112ad"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309257,10 +306911,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Action
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1873-L1887"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1873-L1887"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5a7d931094f5570aaf5b7b3b06c3d8c0"
-		logic_hash = "5ea7d074d0fe98cf2514a65231013a374532d6b3aa2487bcc34d4285f558752a"
+		logic_hash = "v1_sha256_5ea7d074d0fe98cf2514a65231013a374532d6b3aa2487bcc34d4285f558752a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309282,10 +306936,10 @@ rule SIGNATURE_BASE_Webshell_Inderxer
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1888-L1901"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1888-L1901"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9ea82afb8c7070817d4cdf686abe0300"
-		logic_hash = "915f2f38c1ca1321980ac66ebb95b0c46443e0ba64cc4b2014200db43439c85e"
+		logic_hash = "v1_sha256_915f2f38c1ca1321980ac66ebb95b0c46443e0ba64cc4b2014200db43439c85e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309306,10 +306960,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Rader
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1902-L1916"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1902-L1916"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ad1a362e0a24c4475335e3e891a01731"
-		logic_hash = "b578f3e844cbb361f455e55353fad2f0134ede7c3c468cebad9ae265e6e768b8"
+		logic_hash = "v1_sha256_b578f3e844cbb361f455e55353fad2f0134ede7c3c468cebad9ae265e6e768b8"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309331,10 +306985,10 @@ rule SIGNATURE_BASE_Webshell_C99_Madnet_Smowu
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1917-L1935"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1917-L1935"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3aaa8cad47055ba53190020311b0fb83"
-		logic_hash = "5c4f76bdbe535a899e40c890eb1ea65e070c781fe5dd44cf13d4832cfd6d2e13"
+		logic_hash = "v1_sha256_5c4f76bdbe535a899e40c890eb1ea65e070c781fe5dd44cf13d4832cfd6d2e13"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309360,10 +307014,10 @@ rule SIGNATURE_BASE_Webshell_Php_Moon
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1936-L1951"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1936-L1951"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2a2b1b783d3a2fa9a50b1496afa6e356"
-		logic_hash = "4e26dbef647caee19a8707a067c228ba96bd986369e4c87c68964ae42c85b09a"
+		logic_hash = "v1_sha256_4e26dbef647caee19a8707a067c228ba96bd986369e4c87c68964ae42c85b09a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309386,10 +307040,10 @@ rule SIGNATURE_BASE_Webshell_Minupload
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1953-L1967"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1953-L1967"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ec905a1395d176c27f388d202375bdf9"
-		logic_hash = "53dea3ea0e2cf83907273fa7f64b21b40e9a5c8e4aa34e5d46d2762396fa89ce"
+		logic_hash = "v1_sha256_53dea3ea0e2cf83907273fa7f64b21b40e9a5c8e4aa34e5d46d2762396fa89ce"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309411,10 +307065,10 @@ rule SIGNATURE_BASE_Webshell_ELMALISEKER_Backd00R
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1968-L1982"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1968-L1982"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3aa403e0a42badb2c23d4a54ef43e2f4"
-		logic_hash = "c5eea930dc386c60e60f052c4945c8d6c0125d3500e60794e21d5ea04f226628"
+		logic_hash = "v1_sha256_c5eea930dc386c60e60f052c4945c8d6c0125d3500e60794e21d5ea04f226628"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309436,10 +307090,10 @@ rule SIGNATURE_BASE_Webshell_PHP_Bug_1_
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1983-L1996"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1983-L1996"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "91c5fae02ab16d51fc5af9354ac2f015"
-		logic_hash = "12b957b7e0d0823721273ab71a19ee62d84a8dc5f584a46691f0e0aef996386e"
+		logic_hash = "v1_sha256_12b957b7e0d0823721273ab71a19ee62d84a8dc5f584a46691f0e0aef996386e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309460,10 +307114,10 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Hkmjj
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L1997-L2010"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L1997-L2010"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e7b994fe9f878154ca18b7cde91ad2d0"
-		logic_hash = "9a25df170ed165fe6528e6b9374ae572bcd26cd2e1f4014c7aa4953122671fac"
+		logic_hash = "v1_sha256_9a25df170ed165fe6528e6b9374ae572bcd26cd2e1f4014c7aa4953122671fac"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309484,10 +307138,10 @@ rule SIGNATURE_BASE_Webshell_Jsp_Asd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2011-L2025"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2011-L2025"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a042c2ca64176410236fcc97484ec599"
-		logic_hash = "6620b796b55a67010cd3edebc2ec84c2657717722129ea46288d262cfd1c7e1c"
+		logic_hash = "v1_sha256_6620b796b55a67010cd3edebc2ec84c2657717722129ea46288d262cfd1c7e1c"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309509,10 +307163,10 @@ rule SIGNATURE_BASE_Webshell_Metaslsoft
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2027-L2040"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2027-L2040"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aa328ed1476f4a10c0bcc2dde4461789"
-		logic_hash = "20d938fbe21bcf04f09c6450a9acd5db556e9c9f83149d3cdd098be7a905d5ca"
+		logic_hash = "v1_sha256_20d938fbe21bcf04f09c6450a9acd5db556e9c9f83149d3cdd098be7a905d5ca"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309533,10 +307187,10 @@ rule SIGNATURE_BASE_Webshell_Asp_Ajan
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2041-L2054"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2041-L2054"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b6f468252407efc2318639da22b08af0"
-		logic_hash = "1817786725de61150f1b3ff57597c780323a7f4df1c046cfd473e1918decd7d2"
+		logic_hash = "v1_sha256_1817786725de61150f1b3ff57597c780323a7f4df1c046cfd473e1918decd7d2"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309557,9 +307211,9 @@ rule SIGNATURE_BASE_Webshell_Config_Myxx_Zend
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2055-L2071"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "161dc712f279e73ea8cab4b0298cc2ca3799c6d9107050c4231a81021caed37f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2055-L2071"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_161dc712f279e73ea8cab4b0298cc2ca3799c6d9107050c4231a81021caed37f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309584,9 +307238,9 @@ rule SIGNATURE_BASE_Webshell_Browser_201_3_Ma_Download
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2072-L2091"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3605e1304fb314c13d6c94d6ac9337731c6ee4fef679444d599cb3ae29023b56"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2072-L2091"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3605e1304fb314c13d6c94d6ac9337731c6ee4fef679444d599cb3ae29023b56"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309614,9 +307268,9 @@ rule SIGNATURE_BASE_Webshell_Itsec_Itsecteam_Shell_Jhn
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2092-L2109"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2775d7e47a26e06ea716bdca32a0f768eccf4d269caa3d107b4a78f8684ce741"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2092-L2109"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2775d7e47a26e06ea716bdca32a0f768eccf4d269caa3d107b4a78f8684ce741"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309642,9 +307296,9 @@ rule SIGNATURE_BASE_Webshell_Ghost_Source_Icesword_Silic
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2110-L2127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "22879d5279866e3c25a5b41a98b44595f191cfcac6489208b0bdb6b7ca7201e5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2110-L2127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_22879d5279866e3c25a5b41a98b44595f191cfcac6489208b0bdb6b7ca7201e5"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309670,9 +307324,9 @@ rule SIGNATURE_BASE_Webshell_Jspspy_Jspspyjdk5_Jspspyjdk51_Luci_Jsp_Spy2009_M_Ma
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2128-L2171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6c61e5ccd4800f0cfd20532ab43f917f39a7367cc09cbe92e5320eb2c97fabf3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2128-L2171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6c61e5ccd4800f0cfd20532ab43f917f39a7367cc09cbe92e5320eb2c97fabf3"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309724,9 +307378,9 @@ rule SIGNATURE_BASE_Webshell_2_520_Job_Ma1_Ma4_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2172-L2192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "db76ff42079b20d9e5c40661d7b30206e6bffc828f55daa4dc210662068f8e27"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2172-L2192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_db76ff42079b20d9e5c40661d7b30206e6bffc828f55daa4dc210662068f8e27"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309755,9 +307409,9 @@ rule SIGNATURE_BASE_Webshell_000_403_807_A_C5_Config_Css_Dm_He1P_Jspspy_Jspspyjd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2193-L2239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cda47d7967b0f4b2a274ff2196d27d2e108b00917812093bbb3f033a8a1d1c3c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2193-L2239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cda47d7967b0f4b2a274ff2196d27d2e108b00917812093bbb3f033a8a1d1c3c"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309812,9 +307466,9 @@ rule SIGNATURE_BASE_Webshell_Wso2_5_1_Wso2_5_Wso2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2240-L2257"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f2dce52f1b8d2c33cd8478a468383a87f13712dc6e5c9050fea6ede4f0d24cc5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2240-L2257"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f2dce52f1b8d2c33cd8478a468383a87f13712dc6e5c9050fea6ede4f0d24cc5"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309840,9 +307494,9 @@ rule SIGNATURE_BASE_Webshell_000_403_C5_Querydong_Spyjsp2010_T00Ls
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2258-L2278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f507499304a7cf4d14a134a4c0781fed9a94c40fe3257a4168bacdf3910ffec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2258-L2278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f507499304a7cf4d14a134a4c0781fed9a94c40fe3257a4168bacdf3910ffec"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309871,9 +307525,9 @@ rule SIGNATURE_BASE_Webshell_404_Data_Suiyue
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2279-L2295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7f4ab5dbd2a72574c5d188e14ae98e599359b2d662266fc4c3a39d3d4405c208"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2279-L2295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7f4ab5dbd2a72574c5d188e14ae98e599359b2d662266fc4c3a39d3d4405c208"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309898,9 +307552,9 @@ rule SIGNATURE_BASE_Webshell_R57Shell_R57Shell127_Sniper_SA_Shell_Egy_Spider_She
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2296-L2321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "04a58352202538d5446f1000c07341ea70434f00403f116233f335213687636e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2296-L2321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_04a58352202538d5446f1000c07341ea70434f00403f116233f335213687636e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309934,9 +307588,9 @@ rule SIGNATURE_BASE_Webshell_807_A_Css_Dm_He1P_Jspspy_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2322-L2360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb045425a9f519dd7bf028a7795b16b89768682f5850b6a4d45f0991bfeb6431"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2322-L2360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb045425a9f519dd7bf028a7795b16b89768682f5850b6a4d45f0991bfeb6431"
 		score = 70
 		quality = 85
 		tags = ""
@@ -309983,9 +307637,9 @@ rule SIGNATURE_BASE_Webshell_201_3_Ma_Download
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2361-L2380"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "14eccd07e7bef9d570f75fc4adc204d175dcfbb5b950bdb3e25a65d3c5bb0310"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2361-L2380"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_14eccd07e7bef9d570f75fc4adc204d175dcfbb5b950bdb3e25a65d3c5bb0310"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310013,9 +307667,9 @@ rule SIGNATURE_BASE_Webshell_Browser_201_3_400_In_Jfolder_Jfolder01_Jsp_Leo_Ma_W
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2381-L2408"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bf0fd37b542c9362a47180ee03ea28995b48d483f72273e472292a320a3ddee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2381-L2408"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bf0fd37b542c9362a47180ee03ea28995b48d483f72273e472292a320a3ddee"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310051,9 +307705,9 @@ rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2006_Arabicspy
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2409-L2426"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bd9f1ffdbf94dd5a871fc7c3b31d2357e99265d02bfe1c836f82d251053dce7d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2409-L2426"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bd9f1ffdbf94dd5a871fc7c3b31d2357e99265d02bfe1c836f82d251053dce7d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310079,9 +307733,9 @@ rule SIGNATURE_BASE_Webshell_In_Jfolder_Jfolder01_Jsp_Leo_Warn
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2427-L2447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "00c3667438a688b990cf1c8bb6db52be7c6d1b36192dece4e8b07edda68f4b72"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2427-L2447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_00c3667438a688b990cf1c8bb6db52be7c6d1b36192dece4e8b07edda68f4b72"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310110,9 +307764,9 @@ rule SIGNATURE_BASE_Webshell_2_520_Icesword_Job_Ma1_Ma4_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2448-L2470"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "765efb4f776d9ffe5dab1b5decbb60df654e1de9ab8ae7e0437c5c8f717642b9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2448-L2470"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_765efb4f776d9ffe5dab1b5decbb60df654e1de9ab8ae7e0437c5c8f717642b9"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310143,9 +307797,9 @@ rule SIGNATURE_BASE_Webshell_Phpspy_2005_Full_Phpspy_2005_Lite_PHPSPY
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2471-L2489"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "80c8e7b50aea91284a25ffd3a07d8705c24b6a95a58f42ec6043ececcff32dbb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2471-L2489"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_80c8e7b50aea91284a25ffd3a07d8705c24b6a95a58f42ec6043ececcff32dbb"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310172,9 +307826,9 @@ rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2006_Arabicspy_Hkrkoz
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2490-L2507"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "228e0a73f14da2957f75ae898fdbcf2386deb366df6ddc312162ab723bac44ba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2490-L2507"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_228e0a73f14da2957f75ae898fdbcf2386deb366df6ddc312162ab723bac44ba"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310200,9 +307854,9 @@ rule SIGNATURE_BASE_Webshell_C99_Shell_Ci_Biz_Was_Here_C100_V_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2508-L2527"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ccc3cb553f7b5d089a43612d48522cc4a66b4a8ab433321ae1a716a8fa57b62c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2508-L2527"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ccc3cb553f7b5d089a43612d48522cc4a66b4a8ab433321ae1a716a8fa57b62c"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310230,9 +307884,9 @@ rule SIGNATURE_BASE_Webshell_2008_2009Lite_2009Mssql
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2528-L2545"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ae33048856440e25972aa5483b60e775f50f60a9ef5e77a58edd60eacdcd9ee3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2528-L2545"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ae33048856440e25972aa5483b60e775f50f60a9ef5e77a58edd60eacdcd9ee3"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310258,9 +307912,9 @@ rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2005_Full_Phpspy_2005_Lite_Phpspy_2006
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2546-L2567"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5da06481cf789e71969a5b54a33bfab41e08a1961cc056604a696203fef48422"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2546-L2567"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5da06481cf789e71969a5b54a33bfab41e08a1961cc056604a696203fef48422"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310290,9 +307944,9 @@ rule SIGNATURE_BASE_Webshell_807_Dm_Jspspyjdk5_M_Cofigrue
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2568-L2587"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0fc7ac740e147bd3703dac74743b19148aa7bb359cc5f347acf3b0dbe26bf752"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2568-L2587"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0fc7ac740e147bd3703dac74743b19148aa7bb359cc5f347acf3b0dbe26bf752"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310320,9 +307974,9 @@ rule SIGNATURE_BASE_Webshell_Dive_Shell_1_0_Emperor_Hacking_Team_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2588-L2605"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8bf11041a16060fa32431adfe33727863355bae7fec2cf841dcc919092db5c80"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2588-L2605"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8bf11041a16060fa32431adfe33727863355bae7fec2cf841dcc919092db5c80"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310348,9 +308002,9 @@ rule SIGNATURE_BASE_Webshell_404_Data_In_Jfolder_Jfolder01_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2606-L2628"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "171b811c1b93f99f3070692a91a0462f80d9d52ecf26d7fb7297a8bdd9a4c014"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2606-L2628"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_171b811c1b93f99f3070692a91a0462f80d9d52ecf26d7fb7297a8bdd9a4c014"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310381,9 +308035,9 @@ rule SIGNATURE_BASE_Webshell_Jsp_Reverse_Jsp_Reverse_Jspbd
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2629-L2647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cd7409bb6ace3044f3d0bf380133c4fe4a7c0c0309f9d800b397439aa95f81fc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2629-L2647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cd7409bb6ace3044f3d0bf380133c4fe4a7c0c0309f9d800b397439aa95f81fc"
 		score = 50
 		quality = 85
 		tags = ""
@@ -310410,9 +308064,9 @@ rule SIGNATURE_BASE_Webshell_400_In_Jfolder_Jfolder01_Jsp_Leo_Warn_Webshell_Nc
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2648-L2672"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "74e31e51f2cb46a042e8591ffb44fe68fb591d202c8171c6afb556eddb381f6f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2648-L2672"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_74e31e51f2cb46a042e8591ffb44fe68fb591d202c8171c6afb556eddb381f6f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310445,9 +308099,9 @@ rule SIGNATURE_BASE_Webshell_2_520_Job_Jspwebshell_1_2_Ma1_Ma4_2
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2673-L2695"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49614b2a42210fa134f85fa52c66e12809f2bb9eaf56c17b69d21e5fbfc8888b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2673-L2695"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49614b2a42210fa134f85fa52c66e12809f2bb9eaf56c17b69d21e5fbfc8888b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310478,9 +308132,9 @@ rule SIGNATURE_BASE_Webshell_Shell_2008_2009Mssql_Phpspy_2005_Full_Phpspy_2006_A
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2696-L2720"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "140af92ab61059649a872bef96b916f2c402fd9891301d4a1ba1f389a45af003"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2696-L2720"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_140af92ab61059649a872bef96b916f2c402fd9891301d4a1ba1f389a45af003"
 		score = 60
 		quality = 85
 		tags = ""
@@ -310502,7 +308156,7 @@ rule SIGNATURE_BASE_Webshell_Shell_2008_2009Mssql_Phpspy_2005_Full_Phpspy_2006_A
 		$fn = "filename: backup"
 
 	condition:
-		2 of ($s*) and not $fn
+		2 of ( $s* ) and not $fn
 }
 rule SIGNATURE_BASE_Webshell_Gfs_Sh_R57Shell_R57Shell127_Sniper_SA_Xxx
 {
@@ -310513,9 +308167,9 @@ rule SIGNATURE_BASE_Webshell_Gfs_Sh_R57Shell_R57Shell127_Sniper_SA_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2721-L2746"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "24d93f9ae5e174873a32abdf8dca6c00f03cbb4c5e2ad531ac7fa34f8fc90794"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2721-L2746"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_24d93f9ae5e174873a32abdf8dca6c00f03cbb4c5e2ad531ac7fa34f8fc90794"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310549,9 +308203,9 @@ rule SIGNATURE_BASE_Webshell_Itsec_Phpjackal_Itsecteam_Shell_Jhn
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2747-L2766"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c97731c28f59a6fbab2b7882fae171da8d71add73ec92ab6093dec57fcd7207"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2747-L2766"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c97731c28f59a6fbab2b7882fae171da8d71add73ec92ab6093dec57fcd7207"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310579,9 +308233,9 @@ rule SIGNATURE_BASE_Webshell_Shell_Ci_Biz_Was_Here_C100_V_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2767-L2787"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a7841dec442877648a589045849f7f1b80316a30dda5a44ccc4bb626dbd2cdea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2767-L2787"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a7841dec442877648a589045849f7f1b80316a30dda5a44ccc4bb626dbd2cdea"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310610,9 +308264,9 @@ rule SIGNATURE_BASE_Webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_Xxx1
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2788-L2807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "95d25e9dc75a9af91e23b8c53acb384616f5d8a78605200bdb94f016a7f160f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2788-L2807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_95d25e9dc75a9af91e23b8c53acb384616f5d8a78605200bdb94f016a7f160f6"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310640,9 +308294,9 @@ rule SIGNATURE_BASE_Webshell_C99_C99Shell_C99_W4Cking_Shell_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2808-L2836"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "731bbf06208d20874c1d8464472e6a66a2e9b0bc2dc0475783763b99eb70fefa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2808-L2836"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_731bbf06208d20874c1d8464472e6a66a2e9b0bc2dc0475783763b99eb70fefa"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310679,9 +308333,9 @@ rule SIGNATURE_BASE_Webshell_2008_2009Mssql_Phpspy_2005_Full_Phpspy_2006_Arabics
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2837-L2859"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d78db4d45a35d6a78d4288e00a382a0937e3806f0570bd353b88955664a47f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2837-L2859"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d78db4d45a35d6a78d4288e00a382a0937e3806f0570bd353b88955664a47f6"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310712,9 +308366,9 @@ rule SIGNATURE_BASE_Webshell_C99_C66_C99_Shadows_Mod_C99Shell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2860-L2882"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b50a6124f25bbb6fcc9d16d1de26d833a4b968db8e8033e76f3a74695577017e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2860-L2882"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b50a6124f25bbb6fcc9d16d1de26d833a4b968db8e8033e76f3a74695577017e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310745,9 +308399,9 @@ rule SIGNATURE_BASE_Webshell_He1P_Jspspy_Nogfw_Ok_Style_1_Jspspy1
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2883-L2906"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "522ba5f797e33c27fef3ae8d89889c31799073ed3c770a49401f4d42ead04640"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2883-L2906"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_522ba5f797e33c27fef3ae8d89889c31799073ed3c770a49401f4d42ead04640"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310779,9 +308433,9 @@ rule SIGNATURE_BASE_Webshell_000_403_C5_Config_Myxx_Querydong_Spyjsp2010_Zend
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2907-L2930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ca710973592718c5455508c5798b3c51dce994d5ebd33aa3a59d1b03c096bdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2907-L2930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ca710973592718c5455508c5798b3c51dce994d5ebd33aa3a59d1b03c096bdf"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310813,9 +308467,9 @@ rule SIGNATURE_BASE_Webshell_C99_C99Shell_C99_C99Shell
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2931-L2949"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b999b1a8307e228fb97772799369e292fb806d614159f2b2abfc7a71c5bdb225"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2931-L2949"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b999b1a8307e228fb97772799369e292fb806d614159f2b2abfc7a71c5bdb225"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310842,9 +308496,9 @@ rule SIGNATURE_BASE_Webshell_R57Shell127_R57_Ifx_R57_Kartal_R57_Antichat
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2950-L2971"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "23887963068f7dd2e4c85b11079276a00786d1a753f22e3b63f01139087a7f4c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2950-L2971"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_23887963068f7dd2e4c85b11079276a00786d1a753f22e3b63f01139087a7f4c"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310874,9 +308528,9 @@ rule SIGNATURE_BASE_Webshell_NIX_REMOTE_WEB_SHELL_Nstview_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2972-L2991"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b10e89c6b1851f88a2bbb9116969ea3770366c162b911cb8a2c3a033da3a46bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2972-L2991"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b10e89c6b1851f88a2bbb9116969ea3770366c162b911cb8a2c3a033da3a46bc"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310904,9 +308558,9 @@ rule SIGNATURE_BASE_Webshell_000_403_807_A_C5_Config_Css_Dm_He1P_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L2992-L3042"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "46eede3a1af29e344ed5107fc0af4bd13cd1492bff340d61063911bbb474e7b3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L2992-L3042"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_46eede3a1af29e344ed5107fc0af4bd13cd1492bff340d61063911bbb474e7b3"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310965,9 +308619,9 @@ rule SIGNATURE_BASE_Webshell_2_520_Icesword_Job_Ma1
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3043-L3063"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "795eb586310d87a3c6b53117bf2c8cbcfadcb177f5a5129c17fd21f0b64c385c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3043-L3063"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_795eb586310d87a3c6b53117bf2c8cbcfadcb177f5a5129c17fd21f0b64c385c"
 		score = 70
 		quality = 85
 		tags = ""
@@ -310996,9 +308650,9 @@ rule SIGNATURE_BASE_Webshell_404_Data_In_Jfolder_Jfolder01_Jsp_Suiyue_Warn
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3064-L3088"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e0da29499d76539fb1f5cfbe0a00331eeb0bb8fa861f2e2d686130ee4939fac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3064-L3088"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e0da29499d76539fb1f5cfbe0a00331eeb0bb8fa861f2e2d686130ee4939fac"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311031,9 +308685,9 @@ rule SIGNATURE_BASE_Webshell_Phpspy_2005_Full_Phpspy_2005_Lite_Phpspy_2006_PHPSP
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3090-L3110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fc47a50c5964574fb9b9caf3fb94041f028998577bf4ccf21884a41fa1876572"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3090-L3110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fc47a50c5964574fb9b9caf3fb94041f028998577bf4ccf21884a41fa1876572"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311062,9 +308716,9 @@ rule SIGNATURE_BASE_Webshell_C99_Locus7S_C99_W4Cking_Xxx
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3111-L3140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4afadac41e729f77711eb3ea3ee8f6e8ce61e19294e90db024e5334e214d9647"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3111-L3140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4afadac41e729f77711eb3ea3ee8f6e8ce61e19294e90db024e5334e214d9647"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311102,9 +308756,9 @@ rule SIGNATURE_BASE_Webshell_Browser_201_3_Ma_Ma2_Download
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3141-L3162"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b8bb6ca2eb146f8c170d629612ba12d4663445d443b681f2859af25d50ab6fe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3141-L3162"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b8bb6ca2eb146f8c170d629612ba12d4663445d443b681f2859af25d50ab6fe"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311134,9 +308788,9 @@ rule SIGNATURE_BASE_Webshell_000_403_C5_Querydong_Spyjsp2010
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3163-L3184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd01bb059d741fedaee17d46355c7cd8a845d714b20ae37db36424544b954d2f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3163-L3184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd01bb059d741fedaee17d46355c7cd8a845d714b20ae37db36424544b954d2f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311166,9 +308820,9 @@ rule SIGNATURE_BASE_Webshell_R57Shell127_R57_Kartal_R57
 		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3185-L3203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fd849f76f8348ee57a9c96eed91c8cac416fdc45a08c93e93ebc952375de27a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3185-L3203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fd849f76f8348ee57a9c96eed91c8cac416fdc45a08c93e93ebc952375de27a3"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311195,10 +308849,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Con2
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3205-L3219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3205-L3219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d3584159ab299d546bd77c9654932ae3"
-		logic_hash = "c681b04a1ee4d6af3275b6d772ef35f8bc888a5fcaf3b84f29f77c264e8ad9b9"
+		logic_hash = "v1_sha256_c681b04a1ee4d6af3275b6d772ef35f8bc888a5fcaf3b84f29f77c264e8ad9b9"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311220,10 +308874,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Make2
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3220-L3233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3220-L3233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9af195491101e0816a263c106e4c145e"
-		logic_hash = "7c94c925b5fd7fbc37428c21a9ea3c5a73f4fa0a20a1f5d03f0d5a990bd6f45a"
+		logic_hash = "v1_sha256_7c94c925b5fd7fbc37428c21a9ea3c5a73f4fa0a20a1f5d03f0d5a990bd6f45a"
 		score = 50
 		quality = 85
 		tags = ""
@@ -311244,10 +308898,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Aaa
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3234-L3249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3234-L3249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "68483788ab171a155db5266310c852b2"
-		logic_hash = "3c5b9dd86dc790b03a8540b2fb3a717c5ad17d34f366a319faa127479387eed9"
+		logic_hash = "v1_sha256_3c5b9dd86dc790b03a8540b2fb3a717c5ad17d34f366a319faa127479387eed9"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311270,10 +308924,10 @@ rule SIGNATURE_BASE_Webshell_Expdoor_Com_ASP
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3250-L3267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3250-L3267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "caef01bb8906d909f24d1fa109ea18a7"
-		logic_hash = "838edb9d718b5e1a8be155c4569b4a291b37337e71b435c2b1cd6bcaa53c0dea"
+		logic_hash = "v1_sha256_838edb9d718b5e1a8be155c4569b4a291b37337e71b435c2b1cd6bcaa53c0dea"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311298,10 +308952,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Php2
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3268-L3281"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3268-L3281"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fbf2e76e6f897f6f42b896c855069276"
-		logic_hash = "0350df076a25af77fbd8d5db2b38438a10cd5b9237b23b2f64c6360607b41982"
+		logic_hash = "v1_sha256_0350df076a25af77fbd8d5db2b38438a10cd5b9237b23b2f64c6360607b41982"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311322,10 +308976,10 @@ rule SIGNATURE_BASE_Webshell_Bypass_Iisuser_P
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3282-L3295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3282-L3295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "924d294400a64fa888a79316fb3ccd90"
-		logic_hash = "60d0609291e5def26ce949c903ac767db4157b4f9cf4eee315c69ee7a8d8e77b"
+		logic_hash = "v1_sha256_60d0609291e5def26ce949c903ac767db4157b4f9cf4eee315c69ee7a8d8e77b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311346,10 +309000,10 @@ rule SIGNATURE_BASE_Webshell_Sig_404Super
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3296-L3314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3296-L3314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7ed63176226f83d36dce47ce82507b28"
-		logic_hash = "01ecffc6bca2acf1ea4f4d965f3513f7b08ee3d5abbda29d53081f2931ecf9e9"
+		logic_hash = "v1_sha256_01ecffc6bca2acf1ea4f4d965f3513f7b08ee3d5abbda29d53081f2931ecf9e9"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311375,10 +309029,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_JSP
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3315-L3330"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3315-L3330"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "495f1a0a4c82f986f4bdf51ae1898ee7"
-		logic_hash = "bcb2f5d16ff3cc1454bf4653defe037e02a9228a5b7cf7428b1a577f4207c3c8"
+		logic_hash = "v1_sha256_bcb2f5d16ff3cc1454bf4653defe037e02a9228a5b7cf7428b1a577f4207c3c8"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311401,10 +309055,10 @@ rule SIGNATURE_BASE_Webshell_Webshell_123
 		date = "2014-03-28"
 		modified = "2023-01-27"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3331-L3348"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3331-L3348"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2782bb170acaed3829ea9a04f0ac7218"
-		logic_hash = "1caccadf2bd7d265f9b5026c82acc31ade95313d57382651004db8b5e361312d"
+		logic_hash = "v1_sha256_1caccadf2bd7d265f9b5026c82acc31ade95313d57382651004db8b5e361312d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311428,10 +309082,10 @@ rule SIGNATURE_BASE_Webshell_Dev_Core
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3349-L3367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3349-L3367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "55ad9309b006884f660c41e53150fc2e"
-		logic_hash = "b3c7a9bdaa7e5bf76df9ffba94157777c32199edeaa1c8745e9400d138abc267"
+		logic_hash = "v1_sha256_b3c7a9bdaa7e5bf76df9ffba94157777c32199edeaa1c8745e9400d138abc267"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311457,10 +309111,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Php
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3368-L3385"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3368-L3385"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b0e842bdf83396c3ef8c71ff94e64167"
-		logic_hash = "a943f3b0d1d56194e250c7cf3e05b2bfec7b29f91ef56085d645efa3fe8995c9"
+		logic_hash = "v1_sha256_a943f3b0d1d56194e250c7cf3e05b2bfec7b29f91ef56085d645efa3fe8995c9"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311485,10 +309139,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Pppp
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3386-L3401"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3386-L3401"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cf01cb6e09ee594545693c5d327bdd50"
-		logic_hash = "bd09fc2ec88bea83b16e63afafa3d5f74f119a81046a663322f5b396b48da135"
+		logic_hash = "v1_sha256_bd09fc2ec88bea83b16e63afafa3d5f74f119a81046a663322f5b396b48da135"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311511,10 +309165,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Code
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3402-L3419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3402-L3419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a444014c134ff24c0be5a05c02b81a79"
-		logic_hash = "5ae053a9afc1f720c56304c434cd89861e1df4060b7d813921e7f85978227020"
+		logic_hash = "v1_sha256_5ae053a9afc1f720c56304c434cd89861e1df4060b7d813921e7f85978227020"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311539,10 +309193,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Jspyyy
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3420-L3433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3420-L3433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b291bf3ccc9dac8b5c7e1739b8fa742e"
-		logic_hash = "0afe45556aa7b562672cc4b609cf001aaa617b03028322abac6524f666b069e1"
+		logic_hash = "v1_sha256_0afe45556aa7b562672cc4b609cf001aaa617b03028322abac6524f666b069e1"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311563,10 +309217,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Xxxx
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3434-L3447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3434-L3447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5bcba70b2137375225d8eedcde2c0ebb"
-		logic_hash = "e14cc1eaf357389ca58193c77ce2f54774aebb42be9df15f12415df356c7ed42"
+		logic_hash = "v1_sha256_e14cc1eaf357389ca58193c77ce2f54774aebb42be9df15f12415df356c7ed42"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311587,10 +309241,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Jjjsp3
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3448-L3461"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3448-L3461"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "949ffee1e07a1269df7c69b9722d293e"
-		logic_hash = "44889540effa2f71889e7f6d0c5d12486e256d83b9230c4902d56f6a59b7939b"
+		logic_hash = "v1_sha256_44889540effa2f71889e7f6d0c5d12486e256d83b9230c4902d56f6a59b7939b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311611,10 +309265,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_PHP1
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3462-L3477"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3462-L3477"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "14c7281fdaf2ae004ca5fec8753ce3cb"
-		logic_hash = "1c5eb355455c7fbd2b74d91f78e1d77f460dfeb4fe0ee65f18aa1453337b67a0"
+		logic_hash = "v1_sha256_1c5eb355455c7fbd2b74d91f78e1d77f460dfeb4fe0ee65f18aa1453337b67a0"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311637,10 +309291,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Jjjsp2
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3478-L3494"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3478-L3494"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5a9fec45236768069c99f0bfd566d754"
-		logic_hash = "47dca67c7a01035996d032cb3871da5532aea81ab6570c93c4a6b148fd95e9f9"
+		logic_hash = "v1_sha256_47dca67c7a01035996d032cb3871da5532aea81ab6570c93c4a6b148fd95e9f9"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311664,10 +309318,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Radhat
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3495-L3508"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3495-L3508"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "72cb5ef226834ed791144abaa0acdfd4"
-		logic_hash = "28d4d380b25da05a3be439bad72725fa49c947535dfeb5c24994a849c0592b81"
+		logic_hash = "v1_sha256_28d4d380b25da05a3be439bad72725fa49c947535dfeb5c24994a849c0592b81"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311688,10 +309342,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Asp1
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3509-L3523"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3509-L3523"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b63e708cd58ae1ec85cf784060b69cad"
-		logic_hash = "6c76c5388825e29d333096d4cfa3782b7776f31b206a0ed5a8809428d698778b"
+		logic_hash = "v1_sha256_6c76c5388825e29d333096d4cfa3782b7776f31b206a0ed5a8809428d698778b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311713,10 +309367,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Php6
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3524-L3539"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3524-L3539"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ea75280224a735f1e445d244acdfeb7b"
-		logic_hash = "495dc6c6769b8605ea946c012ad0ebb54685e7e91afd383027640753d90c6b3f"
+		logic_hash = "v1_sha256_495dc6c6769b8605ea946c012ad0ebb54685e7e91afd383027640753d90c6b3f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311739,10 +309393,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Xxx
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3540-L3553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3540-L3553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0e71428fe68b39b70adb6aeedf260ca0"
-		logic_hash = "837ed266af8a65ac683be39c32509df34bc8041b336a71c12700ca73bf210b4d"
+		logic_hash = "v1_sha256_837ed266af8a65ac683be39c32509df34bc8041b336a71c12700ca73bf210b4d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311763,10 +309417,10 @@ rule SIGNATURE_BASE_Webshell_Getpostphp
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3554-L3567"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3554-L3567"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "20ede5b8182d952728d594e6f2bb5c76"
-		logic_hash = "e75f66200593c3fdaadf1881235847f6c3f3caadcb7ffe13e8b01bce5f922702"
+		logic_hash = "v1_sha256_e75f66200593c3fdaadf1881235847f6c3f3caadcb7ffe13e8b01bce5f922702"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311787,10 +309441,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Php5
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3568-L3581"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3568-L3581"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cf2ab009cbd2576a806bfefb74906fdf"
-		logic_hash = "280be378bc6cf52ef9454083180015ed00f9d0bc936620a4105c34c3a3002383"
+		logic_hash = "v1_sha256_280be378bc6cf52ef9454083180015ed00f9d0bc936620a4105c34c3a3002383"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311811,10 +309465,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_PHP
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3582-L3599"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3582-L3599"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a524e7ae8d71e37d2fd3e5fbdab405ea"
-		logic_hash = "706f835f63e153f907ae8a5a48f1dc4b9d3b8511b21b7155bc045b0ebdc893fc"
+		logic_hash = "v1_sha256_706f835f63e153f907ae8a5a48f1dc4b9d3b8511b21b7155bc045b0ebdc893fc"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311839,10 +309493,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Asp
 		date = "2014-03-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3600-L3615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3600-L3615"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "32c87744ea404d0ea0debd55915010b7"
-		logic_hash = "dd2e9f753e8fa781c28c2d5bb9336bb3f39ed8a496bd89eb54bc1812ef512ab5"
+		logic_hash = "v1_sha256_dd2e9f753e8fa781c28c2d5bb9336bb3f39ed8a496bd89eb54bc1812ef512ab5"
 		score = 70
 		quality = 85
 		tags = ""
@@ -311865,10 +309519,10 @@ rule SIGNATURE_BASE_Perlbot_Pl
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3619-L3630"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3619-L3630"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7e4deb9884ffffa5d82c22f8dc533a45"
-		logic_hash = "784980d620e71fb0cf5aed9ef8bd171a8f50d850bc782645575070b75c42e426"
+		logic_hash = "v1_sha256_784980d620e71fb0cf5aed9ef8bd171a8f50d850bc782645575070b75c42e426"
 		score = 75
 		quality = 85
 		tags = ""
@@ -311889,10 +309543,10 @@ rule SIGNATURE_BASE_Php_Backdoor_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3631-L3643"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3631-L3643"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
-		logic_hash = "acab82b40760b45d49da51953f78c69166955de54918634c9bfe394208cdbb56"
+		logic_hash = "v1_sha256_acab82b40760b45d49da51953f78c69166955de54918634c9bfe394208cdbb56"
 		score = 75
 		quality = 85
 		tags = ""
@@ -311914,10 +309568,10 @@ rule SIGNATURE_BASE_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3644-L3656"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3644-L3656"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
-		logic_hash = "a0606dad4474579354709fe6306d15427afc4dec8ad6760a0ee9e91c86c23e4d"
+		logic_hash = "v1_sha256_a0606dad4474579354709fe6306d15427afc4dec8ad6760a0ee9e91c86c23e4d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -311939,10 +309593,10 @@ rule SIGNATURE_BASE_Nshell__1__Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3657-L3668"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3657-L3668"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "973fc89694097a41e684b43a21b1b099"
-		logic_hash = "53c7cd24c4eddbded1b4c16fd2758bdf66c0bbe396e487a56d56fc053cf3cc1a"
+		logic_hash = "v1_sha256_53c7cd24c4eddbded1b4c16fd2758bdf66c0bbe396e487a56d56fc053cf3cc1a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -311963,10 +309617,10 @@ rule SIGNATURE_BASE_Shankar_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3669-L3681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3669-L3681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6eb9db6a3974e511b7951b8f7e7136bb"
-		logic_hash = "58b365206c18b8394cf1e03b71b8e47be10bc933bc2c05b7b03b7dad94f6d6b8"
+		logic_hash = "v1_sha256_58b365206c18b8394cf1e03b71b8e47be10bc933bc2c05b7b03b7dad94f6d6b8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -311977,7 +309631,7 @@ rule SIGNATURE_BASE_Shankar_Php_Php
 		$s3 = "Show<input type=text size=5 value=\".((isset($_POST['br_st']) && isset($_POST['b"
 
 	condition:
-		1 of ($s*) and $sAuthor
+		1 of ( $s* ) and $sAuthor
 }
 rule SIGNATURE_BASE_Casus15_Php_Php
 {
@@ -311988,10 +309642,10 @@ rule SIGNATURE_BASE_Casus15_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3682-L3694"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3682-L3694"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5e2ede2d1c4fa1fcc3cbfe0c005d7b13"
-		logic_hash = "6ee7a07163d33ca329d3be2084406629711db14db4605e8413ee963eb0f9d5a7"
+		logic_hash = "v1_sha256_6ee7a07163d33ca329d3be2084406629711db14db4605e8413ee963eb0f9d5a7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312013,10 +309667,10 @@ rule SIGNATURE_BASE_Small_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3695-L3707"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3695-L3707"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fcee6226d09d150bfa5f103bee61fbde"
-		logic_hash = "e0444aa604e8956d423037b70b9476f5653503055d0f1bc875d43de144ce5c44"
+		logic_hash = "v1_sha256_e0444aa604e8956d423037b70b9476f5653503055d0f1bc875d43de144ce5c44"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312038,10 +309692,10 @@ rule SIGNATURE_BASE_Shellbot_Pl
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3708-L3722"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3708-L3722"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b2a883bc3c03a35cfd020dd2ace4bab8"
-		logic_hash = "5db224e4fe8608bb53f044ca6c0361dc66cadd58c6d4ea5ab4f8ae14ebde0e6e"
+		logic_hash = "v1_sha256_5db224e4fe8608bb53f044ca6c0361dc66cadd58c6d4ea5ab4f8ae14ebde0e6e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312065,10 +309719,10 @@ rule SIGNATURE_BASE_Fuckphpshell_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3723-L3736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3723-L3736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "554e50c1265bb0934fcc8247ec3b9052"
-		logic_hash = "0c993960b4ca880b818c7b7ba726479ed1c64c46ef8ca82d3c990d69ebe43f42"
+		logic_hash = "v1_sha256_0c993960b4ca880b818c7b7ba726479ed1c64c46ef8ca82d3c990d69ebe43f42"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312091,10 +309745,10 @@ rule SIGNATURE_BASE_Ngh_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3737-L3751"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3737-L3751"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c372b725419cdfd3f8a6371cfeebc2fd"
-		logic_hash = "c794b216bafdaecf5bd138cc8c7552efbb8c3c571a441489d02a19793a4c294f"
+		logic_hash = "v1_sha256_c794b216bafdaecf5bd138cc8c7552efbb8c3c571a441489d02a19793a4c294f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312118,10 +309772,10 @@ rule SIGNATURE_BASE_Jsp_Reverse_Jsp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3752-L3764"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3752-L3764"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8b0e6779f25a17f0ffb3df14122ba594"
-		logic_hash = "bdd2db4c032b25faaaf3a3a8e769000013f643ecfcb8b0374165a244ad2162a6"
+		logic_hash = "v1_sha256_bdd2db4c032b25faaaf3a3a8e769000013f643ecfcb8b0374165a244ad2162a6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312143,10 +309797,10 @@ rule SIGNATURE_BASE_Tool_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3765-L3778"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3765-L3778"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8febea6ca6051ae5e2ad4c78f4b9c1f2"
-		logic_hash = "d6bd782302b2c614fc572babb3825c0e1fcd0de5841ca8541ca27580ccc274d4"
+		logic_hash = "v1_sha256_d6bd782302b2c614fc572babb3825c0e1fcd0de5841ca8541ca27580ccc274d4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312169,10 +309823,10 @@ rule SIGNATURE_BASE_NT_Addy_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3779-L3791"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3779-L3791"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2e0d1bae844c9a8e6e351297d77a1fec"
-		logic_hash = "0fc61d5e276786b8be822712cdcfc81146998e535532e44d3da92e0668713a48"
+		logic_hash = "v1_sha256_0fc61d5e276786b8be822712cdcfc81146998e535532e44d3da92e0668713a48"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312194,10 +309848,10 @@ rule SIGNATURE_BASE_Simattacker___Vrsion_1_0_0___Priv8_4_My_Friend_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3792-L3804"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3792-L3804"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
-		logic_hash = "46bc4063d06b4af3e4e61e1e998d489e974e76f17363c9777b8afc39ff21f698"
+		logic_hash = "v1_sha256_46bc4063d06b4af3e4e61e1e998d489e974e76f17363c9777b8afc39ff21f698"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312219,10 +309873,10 @@ rule SIGNATURE_BASE_Remexp_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3805-L3817"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3805-L3817"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
-		logic_hash = "c7da9908a0252e95b47dbc8fbb36aeac1661dc464123aaca036bd51047a31584"
+		logic_hash = "v1_sha256_c7da9908a0252e95b47dbc8fbb36aeac1661dc464123aaca036bd51047a31584"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312244,10 +309898,10 @@ rule SIGNATURE_BASE_Phvayvv_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3818-L3830"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3818-L3830"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "35fb37f3c806718545d97c6559abd262"
-		logic_hash = "503a69a7e2c30cc82eba430082627bb93c459a95f675b968126bf4524c598863"
+		logic_hash = "v1_sha256_503a69a7e2c30cc82eba430082627bb93c459a95f675b968126bf4524c598863"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312269,10 +309923,10 @@ rule SIGNATURE_BASE_Klasvayv_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3831-L3844"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3831-L3844"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2b3e64bf8462fc3d008a3d1012da64ef"
-		logic_hash = "eb1b11e02b075a4e7d28b77cf91ad596a85e4c697a36304ee177d46735965e75"
+		logic_hash = "v1_sha256_eb1b11e02b075a4e7d28b77cf91ad596a85e4c697a36304ee177d46735965e75"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312295,10 +309949,10 @@ rule SIGNATURE_BASE_R57Shell_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3845-L3858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3845-L3858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d28445de424594a5f14d0fe2a7c4e94f"
-		logic_hash = "658eec4f3c463ec1a480bcb7ba995b8d81d1fb846832e569751d9f505f0fa87e"
+		logic_hash = "v1_sha256_658eec4f3c463ec1a480bcb7ba995b8d81d1fb846832e569751d9f505f0fa87e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312321,10 +309975,10 @@ rule SIGNATURE_BASE_Rst_Sql_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3859-L3872"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3859-L3872"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0961641a4ab2b8cb4d2beca593a92010"
-		logic_hash = "d15cf69d9ad8683d2ac1ff09b08b0b26ecaf35df8e45bbd5c3a02c393f88cb34"
+		logic_hash = "v1_sha256_d15cf69d9ad8683d2ac1ff09b08b0b26ecaf35df8e45bbd5c3a02c393f88cb34"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312347,10 +310001,10 @@ rule SIGNATURE_BASE_Wh_Bindshell_Py
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3873-L3885"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3873-L3885"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fab20902862736e24aaae275af5e049c"
-		logic_hash = "e38a4f5c23371705f9bbf2db8e65d68074554edc1022576166e76d40e06bc039"
+		logic_hash = "v1_sha256_e38a4f5c23371705f9bbf2db8e65d68074554edc1022576166e76d40e06bc039"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312372,10 +310026,10 @@ rule SIGNATURE_BASE_Lurm_Safemod_On_Cgi
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3886-L3898"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3886-L3898"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5ea4f901ce1abdf20870c214b3231db3"
-		logic_hash = "d308ad6cda92fa437b9a4c46cd1b97fb0138aa8d0010256bda56a64ced1c7875"
+		logic_hash = "v1_sha256_d308ad6cda92fa437b9a4c46cd1b97fb0138aa8d0010256bda56a64ced1c7875"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312397,10 +310051,10 @@ rule SIGNATURE_BASE_C99Madshell_V2_0_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3899-L3909"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3899-L3909"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d27292895da9afa5b60b9d3014f39294"
-		logic_hash = "07922511d9dfdd32f6b1f47479fca2063b773024a20dcab6f5cf4d56d66c3397"
+		logic_hash = "v1_sha256_07922511d9dfdd32f6b1f47479fca2063b773024a20dcab6f5cf4d56d66c3397"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312420,10 +310074,10 @@ rule SIGNATURE_BASE_Backupsql_Php_Often_With_C99Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3910-L3921"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3910-L3921"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ab1a06ab1a1fe94e3f3b7f80eedbc12f"
-		logic_hash = "7c64e3d4e5815859c51f05cb376f72ea266b31193f3f4588526005e167ebabad"
+		logic_hash = "v1_sha256_7c64e3d4e5815859c51f05cb376f72ea266b31193f3f4588526005e167ebabad"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312444,10 +310098,10 @@ rule SIGNATURE_BASE_Uploader_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3922-L3934"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3922-L3934"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0b53b67bb3b004a8681e1458dd1895d0"
-		logic_hash = "6e6ffc4cad2a956cb2b6667928bac5996cf95cd36f43ba789144c46726471f07"
+		logic_hash = "v1_sha256_6e6ffc4cad2a956cb2b6667928bac5996cf95cd36f43ba789144c46726471f07"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312469,10 +310123,10 @@ rule SIGNATURE_BASE_Telnet_Pl
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3935-L3946"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3935-L3946"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dd9dba14383064e219e29396e242c1ec"
-		logic_hash = "2d1abc52fc70ce664a19e49e6fa4175bc8d8785dee332d5273323479d9628a8c"
+		logic_hash = "v1_sha256_2d1abc52fc70ce664a19e49e6fa4175bc8d8785dee332d5273323479d9628a8c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312493,10 +310147,10 @@ rule SIGNATURE_BASE_W3D_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3947-L3959"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3947-L3959"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "987f66b29bfb209a0b4f097f84f57c3b"
-		logic_hash = "33f948a1ae4474daddd788df84fa8baabf4390ec242cad9a6a51dac0152d3b75"
+		logic_hash = "v1_sha256_33f948a1ae4474daddd788df84fa8baabf4390ec242cad9a6a51dac0152d3b75"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312518,10 +310172,10 @@ rule SIGNATURE_BASE_Webshell_Cgi
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3960-L3971"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3960-L3971"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bc486c2e00b5fc3e4e783557a2441e6f"
-		logic_hash = "8908ced96284de6b6d5ae693ba54c49a6333bbe5780d951cbacc91b4dde027df"
+		logic_hash = "v1_sha256_8908ced96284de6b6d5ae693ba54c49a6333bbe5780d951cbacc91b4dde027df"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312542,10 +310196,10 @@ rule SIGNATURE_BASE_Winx_Shell_Html
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3972-L3984"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3972-L3984"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "17ab5086aef89d4951fe9b7c7a561dda"
-		logic_hash = "4248f807d66990946523ba7b92d795c2c40429182389d9bf3f4a972e246b50c6"
+		logic_hash = "v1_sha256_4248f807d66990946523ba7b92d795c2c40429182389d9bf3f4a972e246b50c6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312567,10 +310221,10 @@ rule SIGNATURE_BASE_Dx_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3985-L3997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3985-L3997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
-		logic_hash = "ab43ddcf317eb4db890ca9750dc6bbc19b06b806339a67c82216df02bc2e8446"
+		logic_hash = "v1_sha256_ab43ddcf317eb4db890ca9750dc6bbc19b06b806339a67c82216df02bc2e8446"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312592,10 +310246,10 @@ rule SIGNATURE_BASE_Csh_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L3998-L4011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L3998-L4011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "194a9d3f3eac8bc56d9a7c55c016af96"
-		logic_hash = "2a74e06a9fd59d7a577041b49403738904239fb011f9bfe2fb665165991b9c98"
+		logic_hash = "v1_sha256_2a74e06a9fd59d7a577041b49403738904239fb011f9bfe2fb665165991b9c98"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312618,10 +310272,10 @@ rule SIGNATURE_BASE_Phpinj_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4012-L4024"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4012-L4024"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d7a4b0df45d34888d5a09f745e85733f"
-		logic_hash = "5d39fd31cdaae7765267ce8a35a2fdcf86e7f0de40d4f303fb0f219c0fc04e40"
+		logic_hash = "v1_sha256_5d39fd31cdaae7765267ce8a35a2fdcf86e7f0de40d4f303fb0f219c0fc04e40"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312643,10 +310297,10 @@ rule SIGNATURE_BASE_Sig_2008_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4025-L4038"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4025-L4038"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3e4ba470d4c38765e4b16ed930facf2c"
-		logic_hash = "a437dc3dc836e93c7a691f7a000c4a4ae574ba95b3a216394ba42538beb9c0f7"
+		logic_hash = "v1_sha256_a437dc3dc836e93c7a691f7a000c4a4ae574ba95b3a216394ba42538beb9c0f7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312669,10 +310323,10 @@ rule SIGNATURE_BASE_Ak74Shell_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4039-L4051"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4039-L4051"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7f83adcb4c1111653d30c6427a94f66f"
-		logic_hash = "64eb7e72679fc9ee81af6f46d0ab604357710716b93b1ddfaebc5596c968fce8"
+		logic_hash = "v1_sha256_64eb7e72679fc9ee81af6f46d0ab604357710716b93b1ddfaebc5596c968fce8"
 		score = 75
 		quality = 60
 		tags = ""
@@ -312694,10 +310348,10 @@ rule SIGNATURE_BASE_Rem_View_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4052-L4064"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4052-L4064"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "29420106d9a81553ef0d1ca72b9934d9"
-		logic_hash = "bcd5c86e793748ffe0ce4415ee68101e8183e1f97477b49843938d254f08695a"
+		logic_hash = "v1_sha256_bcd5c86e793748ffe0ce4415ee68101e8183e1f97477b49843938d254f08695a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312719,10 +310373,10 @@ rule SIGNATURE_BASE_Java_Shell_Js
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4065-L4077"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4065-L4077"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
-		logic_hash = "f312298ac30ab57b21222a529b1566b9a66909806e4bc88120ac3992cfd3c6fb"
+		logic_hash = "v1_sha256_f312298ac30ab57b21222a529b1566b9a66909806e4bc88120ac3992cfd3c6fb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312744,10 +310398,10 @@ rule SIGNATURE_BASE_STNC_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4078-L4091"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4078-L4091"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2e56cfd5b5014cbbf1c1e3f082531815"
-		logic_hash = "b4118dc45ac109bde1cafda24cc103370db57c1993690f450cff828c1633af3c"
+		logic_hash = "v1_sha256_b4118dc45ac109bde1cafda24cc103370db57c1993690f450cff828c1633af3c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312770,10 +310424,10 @@ rule SIGNATURE_BASE_Azrailphp_V1_0_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4092-L4104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4092-L4104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "26b2d3943395682e36da06ed493a3715"
-		logic_hash = "4385f294e59b644fe86d8380db4f7926924eb744ad80735b78ef778d2f7e8ae0"
+		logic_hash = "v1_sha256_4385f294e59b644fe86d8380db4f7926924eb744ad80735b78ef778d2f7e8ae0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312795,10 +310449,10 @@ rule SIGNATURE_BASE_Moroccan_Spamers_Ma_Edition_By_Ghost_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4105-L4117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4105-L4117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d1b7b311a7ffffebf51437d7cd97dc65"
-		logic_hash = "e755e4ea467861e5217d532b161bf4c582ff71aa1e4720dfa4b75d6e8d7629d8"
+		logic_hash = "v1_sha256_e755e4ea467861e5217d532b161bf4c582ff71aa1e4720dfa4b75d6e8d7629d8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312820,10 +310474,10 @@ rule SIGNATURE_BASE_Zacosmall_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4118-L4130"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4118-L4130"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5295ee8dc2f5fd416be442548d68f7a6"
-		logic_hash = "5a2125fc447344f8cc708503d9e4dd82f9b873e40ded497ef9e01974d08bf043"
+		logic_hash = "v1_sha256_5a2125fc447344f8cc708503d9e4dd82f9b873e40ded497ef9e01974d08bf043"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312845,10 +310499,10 @@ rule SIGNATURE_BASE_Cmdasp_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4131-L4144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4131-L4144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "64f24f09ec6efaa904e2492dffc518b9"
-		logic_hash = "95dc25ecd47b43edbd7e7e36966377aa09da769aff2bc1c33a7df87989611bfa"
+		logic_hash = "v1_sha256_95dc25ecd47b43edbd7e7e36966377aa09da769aff2bc1c33a7df87989611bfa"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312871,10 +310525,10 @@ rule SIGNATURE_BASE_Simple_Backdoor_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4145-L4157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4145-L4157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f091d1b9274c881f8e41b2f96e6b9936"
-		logic_hash = "e2e98580b59727313de298fab0009704f621b1b6556220d5065118d960f7a068"
+		logic_hash = "v1_sha256_e2e98580b59727313de298fab0009704f621b1b6556220d5065118d960f7a068"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312896,10 +310550,10 @@ rule SIGNATURE_BASE_Mysql_Shell_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4158-L4170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4158-L4170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d42aec2891214cace99b3eb9f3e21a63"
-		logic_hash = "dbd825e1056c41efaf80c0495ba7b6cf1c88403b997ea7ac1378512a19f7ed8a"
+		logic_hash = "v1_sha256_dbd825e1056c41efaf80c0495ba7b6cf1c88403b997ea7ac1378512a19f7ed8a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312921,10 +310575,10 @@ rule SIGNATURE_BASE_Dive_Shell_1_0___Emperor_Hacking_Team_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4171-L4184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4171-L4184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1b5102bdc41a7bc439eea8f0010310a5"
-		logic_hash = "bd51b625359799178ad3c8e02ba5bb5fca89e6e14769b86dd35c2b8a1049599f"
+		logic_hash = "v1_sha256_bd51b625359799178ad3c8e02ba5bb5fca89e6e14769b86dd35c2b8a1049599f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312947,10 +310601,10 @@ rule SIGNATURE_BASE_Asmodeus_V0_1_Pl
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4185-L4198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4185-L4198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0978b672db0657103c79505df69cb4bb"
-		logic_hash = "be0130c9d2a5d29e6ef8749b0058c96c2ca1ecb9823fd14a8a2c82978cf3d104"
+		logic_hash = "v1_sha256_be0130c9d2a5d29e6ef8749b0058c96c2ca1ecb9823fd14a8a2c82978cf3d104"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312973,10 +310627,10 @@ rule SIGNATURE_BASE_Backup_Php_Often_With_C99Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4199-L4211"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4199-L4211"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aeee3bae226ad57baf4be8745c3f6094"
-		logic_hash = "e27d00ebfbac2565568b9a97552a331db91b4e9aa318febb048937f5c3a1a1ba"
+		logic_hash = "v1_sha256_e27d00ebfbac2565568b9a97552a331db91b4e9aa318febb048937f5c3a1a1ba"
 		score = 75
 		quality = 85
 		tags = ""
@@ -312998,10 +310652,10 @@ rule SIGNATURE_BASE_Reader_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4212-L4224"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4212-L4224"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ad1a362e0a24c4475335e3e891a01731"
-		logic_hash = "ec0dc3b050d84e852e0c18bd00961f109d3506fa7f2e8656448bd5edd28d9305"
+		logic_hash = "v1_sha256_ec0dc3b050d84e852e0c18bd00961f109d3506fa7f2e8656448bd5edd28d9305"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313023,10 +310677,10 @@ rule SIGNATURE_BASE_Phpshell17_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4225-L4237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4225-L4237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9a928d741d12ea08a624ee9ed5a8c39d"
-		logic_hash = "a9306747a5c9756f393c61562ed4a601c75c3a9491ad19a7b7dbae1fbd505e9a"
+		logic_hash = "v1_sha256_a9306747a5c9756f393c61562ed4a601c75c3a9491ad19a7b7dbae1fbd505e9a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313048,10 +310702,10 @@ rule SIGNATURE_BASE_Myshell_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4238-L4250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4238-L4250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "62783d1db52d05b1b6ae2403a7044490"
-		logic_hash = "dd7b0fa637a8317986de0c2312b4b552f1110fb5a64590a9a21c854e5985fbb6"
+		logic_hash = "v1_sha256_dd7b0fa637a8317986de0c2312b4b552f1110fb5a64590a9a21c854e5985fbb6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313073,10 +310727,10 @@ rule SIGNATURE_BASE_Simshell_1_0___Simorgh_Security_MGZ_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4251-L4264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4251-L4264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "37cb1db26b1b0161a4bf678a6b4565bd"
-		logic_hash = "590a1572877fafcd4425a04c12cd56194f03a63b7acad93c39d4b16dc5a1902d"
+		logic_hash = "v1_sha256_590a1572877fafcd4425a04c12cd56194f03a63b7acad93c39d4b16dc5a1902d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313099,10 +310753,10 @@ rule SIGNATURE_BASE_Jspshall_Jsp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4265-L4277"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4265-L4277"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "efe0f6edaa512c4e1fdca4eeda77b7ee"
-		logic_hash = "94c458d3f38ba21348b0202e2b81bbbc3859e97d64f101a9ea7ec6f036e38bc5"
+		logic_hash = "v1_sha256_94c458d3f38ba21348b0202e2b81bbbc3859e97d64f101a9ea7ec6f036e38bc5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313124,10 +310778,10 @@ rule SIGNATURE_BASE_Webshell_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4278-L4289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4278-L4289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e425241b928e992bde43dd65180a4894"
-		logic_hash = "7b0f4f4afde7dcb44c9d877a72c961f3666278ce28a24ae8068cfbc32639e307"
+		logic_hash = "v1_sha256_7b0f4f4afde7dcb44c9d877a72c961f3666278ce28a24ae8068cfbc32639e307"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313148,10 +310802,10 @@ rule SIGNATURE_BASE_Rootshell_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4290-L4303"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4290-L4303"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "265f3319075536030e59ba2f9ef3eac6"
-		logic_hash = "f836dd1825dc84212d32a034c0dde45d60ccd1eb667018abb60d671b61192666"
+		logic_hash = "v1_sha256_f836dd1825dc84212d32a034c0dde45d60ccd1eb667018abb60d671b61192666"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313174,10 +310828,10 @@ rule SIGNATURE_BASE_Connectback2_Pl
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4304-L4316"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4304-L4316"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "473b7d226ea6ebaacc24504bd740822e"
-		logic_hash = "7316c93f12dbbf6d0235601d8be88c199e37955507925222d00041d0ceaf01c7"
+		logic_hash = "v1_sha256_7316c93f12dbbf6d0235601d8be88c199e37955507925222d00041d0ceaf01c7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313199,10 +310853,10 @@ rule SIGNATURE_BASE_Defacekeeper_0_2_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4317-L4329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4317-L4329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "713c54c3da3031bc614a8a55dccd7e7f"
-		logic_hash = "0ee3fed3441e9561867508e324d7a6b1808a8923513bf1c9b82f8238224c994c"
+		logic_hash = "v1_sha256_0ee3fed3441e9561867508e324d7a6b1808a8923513bf1c9b82f8238224c994c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313224,10 +310878,10 @@ rule SIGNATURE_BASE_Shells_PHP_Wso
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4330-L4341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4330-L4341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "33e2891c13b78328da9062fbfcf898b6"
-		logic_hash = "31ef69228b66b30300006f63b1e4d6e92c2512caca4bd915d418b48564b39c47"
+		logic_hash = "v1_sha256_31ef69228b66b30300006f63b1e4d6e92c2512caca4bd915d418b48564b39c47"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313248,10 +310902,10 @@ rule SIGNATURE_BASE_Backdoor1_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4342-L4354"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4342-L4354"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e1adda1f866367f52de001257b4d6c98"
-		logic_hash = "7c8840dc91c16b9fa19fee16e0159a7f13db23c96596e18da0cdab07931ce35b"
+		logic_hash = "v1_sha256_7c8840dc91c16b9fa19fee16e0159a7f13db23c96596e18da0cdab07931ce35b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313273,10 +310927,10 @@ rule SIGNATURE_BASE_Elmaliseker_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4355-L4368"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4355-L4368"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
-		logic_hash = "969f0f12449375a9ebbb8a68fd4b3db395927416d5cceccdb7f2c64310430880"
+		logic_hash = "v1_sha256_969f0f12449375a9ebbb8a68fd4b3db395927416d5cceccdb7f2c64310430880"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313299,10 +310953,10 @@ rule SIGNATURE_BASE_Indexer_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4369-L4380"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4369-L4380"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9ea82afb8c7070817d4cdf686abe0300"
-		logic_hash = "0a51f15bfb4289dcb70e1e0b96d100be12901ebf26ed9c0e543eda5f4aa91f1c"
+		logic_hash = "v1_sha256_0a51f15bfb4289dcb70e1e0b96d100be12901ebf26ed9c0e543eda5f4aa91f1c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313323,10 +310977,10 @@ rule SIGNATURE_BASE_Dxshell_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4381-L4392"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4381-L4392"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "33a2b31810178f4c2e71fbdeb4899244"
-		logic_hash = "821f9295eba6119ad08349e769d1909cd7836b4e35795915e94095cf715dc6e5"
+		logic_hash = "v1_sha256_821f9295eba6119ad08349e769d1909cd7836b4e35795915e94095cf715dc6e5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313347,10 +311001,10 @@ rule SIGNATURE_BASE_S72_Shell_V1_1_Coding_Html
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4393-L4405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4393-L4405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c2e8346a5515c81797af36e7e4a3828e"
-		logic_hash = "aef8840b72e5c435c11150007d6b3af2943126fefdc6df343d0f73755340e260"
+		logic_hash = "v1_sha256_aef8840b72e5c435c11150007d6b3af2943126fefdc6df343d0f73755340e260"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313372,10 +311026,10 @@ rule SIGNATURE_BASE_Kacak_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4406-L4419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4406-L4419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "907d95d46785db21331a0324972dda8c"
-		logic_hash = "8542a3985dff2d1eb42f4d2c9f30405a4817a8e30075225c518ec52381f1f7df"
+		logic_hash = "v1_sha256_8542a3985dff2d1eb42f4d2c9f30405a4817a8e30075225c518ec52381f1f7df"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313398,10 +311052,10 @@ rule SIGNATURE_BASE_PHP_Backdoor_Connect_Pl_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4420-L4432"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4420-L4432"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "57fcd9560dac244aeaf95fd606621900"
-		logic_hash = "b141546f45767884f9c8b1cc4c09ea25f90c0f3a3633bfeecad78b60e7f20306"
+		logic_hash = "v1_sha256_b141546f45767884f9c8b1cc4c09ea25f90c0f3a3633bfeecad78b60e7f20306"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313423,10 +311077,10 @@ rule SIGNATURE_BASE_Antichat_Socks5_Server_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4433-L4445"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4433-L4445"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cbe9eafbc4d86842a61a54d98e5b61f1"
-		logic_hash = "d6b203561f95f431b3d2c241011ae08c05619d45c5900a28137481c029e8297e"
+		logic_hash = "v1_sha256_d6b203561f95f431b3d2c241011ae08c05619d45c5900a28137481c029e8297e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313448,10 +311102,10 @@ rule SIGNATURE_BASE_Antichat_Shell_V1_3_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4446-L4458"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4446-L4458"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "40d0abceba125868be7f3f990f031521"
-		logic_hash = "566c324f3bf44ce9f32ddad82a8d3daa87a8a75b5ca0c8286bc912a8ae4ac8e9"
+		logic_hash = "v1_sha256_566c324f3bf44ce9f32ddad82a8d3daa87a8a75b5ca0c8286bc912a8ae4ac8e9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313473,10 +311127,10 @@ rule SIGNATURE_BASE_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4459-L4471"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4459-L4471"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "49ad9117c96419c35987aaa7e2230f63"
-		logic_hash = "d6d2a3999f2e8ceb70f57697c0a845edbbcfce0aba151ec6a0ac23f55265cd47"
+		logic_hash = "v1_sha256_d6d2a3999f2e8ceb70f57697c0a845edbbcfce0aba151ec6a0ac23f55265cd47"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313498,10 +311152,10 @@ rule SIGNATURE_BASE_Mysql_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4472-L4484"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4472-L4484"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "12bbdf6ef403720442a47a3cc730d034"
-		logic_hash = "60e235310f378698ffcc3ae6a07ab5dd94a660ca4b1504cc878d9741f751d5d1"
+		logic_hash = "v1_sha256_60e235310f378698ffcc3ae6a07ab5dd94a660ca4b1504cc878d9741f751d5d1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313523,10 +311177,10 @@ rule SIGNATURE_BASE_Worse_Linux_Shell_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4485-L4496"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4485-L4496"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
-		logic_hash = "47801296b700e85f9e08857eb06f845ef8ed3f88b7d0de34d4b7c47cef6cc7fb"
+		logic_hash = "v1_sha256_47801296b700e85f9e08857eb06f845ef8ed3f88b7d0de34d4b7c47cef6cc7fb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313547,10 +311201,10 @@ rule SIGNATURE_BASE_Cyberlords_Sql_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4497-L4510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4497-L4510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "03b06b4183cb9947ccda2c3d636406d4"
-		logic_hash = "b3286f9fd86c90c5afc79801b6d65c9ae52ee1c37da93ff15461d84f37ef8019"
+		logic_hash = "v1_sha256_b3286f9fd86c90c5afc79801b6d65c9ae52ee1c37da93ff15461d84f37ef8019"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313573,10 +311227,10 @@ rule SIGNATURE_BASE_Cmd_Asp_5_1_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4511-L4522"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4511-L4522"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
-		logic_hash = "a41c83da1a65e67b6f4ac6ad7cc8702486957ab0c7dda658d071e603338c324b"
+		logic_hash = "v1_sha256_a41c83da1a65e67b6f4ac6ad7cc8702486957ab0c7dda658d071e603338c324b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313597,10 +311251,10 @@ rule SIGNATURE_BASE_Pws_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4523-L4535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4523-L4535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ecdc6c20f62f99fa265ec9257b7bf2ce"
-		logic_hash = "98dae8aab5bfd58f4264e318f5a5b5900b38687386f9d7f09c31da0f51d57bc0"
+		logic_hash = "v1_sha256_98dae8aab5bfd58f4264e318f5a5b5900b38687386f9d7f09c31da0f51d57bc0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313622,10 +311276,10 @@ rule SIGNATURE_BASE_PHP_Shell_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4536-L4547"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4536-L4547"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
-		logic_hash = "2d5b6e08bfe9e1551dab12b01189dadc924c097427c996684bab96c48d528395"
+		logic_hash = "v1_sha256_2d5b6e08bfe9e1551dab12b01189dadc924c097427c996684bab96c48d528395"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313646,10 +311300,10 @@ rule SIGNATURE_BASE_Ayyildiz_Tim___AYT__Shell_V_2_1_Biz_Html
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4548-L4561"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4548-L4561"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8a8c8bb153bd1ee097559041f2e5cf0a"
-		logic_hash = "9e2d56b49df65a2c13e15f97ec91cdbb6852d86e86f921d7c8a4db82cbea12f5"
+		logic_hash = "v1_sha256_9e2d56b49df65a2c13e15f97ec91cdbb6852d86e86f921d7c8a4db82cbea12f5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313672,10 +311326,10 @@ rule SIGNATURE_BASE_EFSO_2_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4562-L4573"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4562-L4573"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b5fde9682fd63415ae211d53c6bfaa4d"
-		logic_hash = "15e5419854bcbb08f28fff1e266cca7a004f01ec0a5c313c107ec17c3aa7ffee"
+		logic_hash = "v1_sha256_15e5419854bcbb08f28fff1e266cca7a004f01ec0a5c313c107ec17c3aa7ffee"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313696,10 +311350,10 @@ rule SIGNATURE_BASE_Lamashell_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4574-L4586"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4574-L4586"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "de9abc2e38420cad729648e93dfc6687"
-		logic_hash = "5e156c3057338fa7b306b91dd979851dd56b8b698cfe99e1d7b6d096a4c580e7"
+		logic_hash = "v1_sha256_5e156c3057338fa7b306b91dd979851dd56b8b698cfe99e1d7b6d096a4c580e7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313721,10 +311375,10 @@ rule SIGNATURE_BASE_Ajax_PHP_Command_Shell_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4587-L4599"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4587-L4599"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "93d1a2e13a3368a2472043bd6331afe9"
-		logic_hash = "37cba26018f3d37194a143871012a61a7bcee6775d2cf5f93a52b779010d3260"
+		logic_hash = "v1_sha256_37cba26018f3d37194a143871012a61a7bcee6775d2cf5f93a52b779010d3260"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313746,10 +311400,10 @@ rule SIGNATURE_BASE_Jspwebshell_1_2_Jsp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4600-L4613"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4600-L4613"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "70a0ee2624e5bbe5525ccadc467519f6"
-		logic_hash = "32b3ddb00f89a3540118fe8ce5fc070556b00030dcf2b21245d38ae66e6cbc14"
+		logic_hash = "v1_sha256_32b3ddb00f89a3540118fe8ce5fc070556b00030dcf2b21245d38ae66e6cbc14"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313772,10 +311426,10 @@ rule SIGNATURE_BASE_Sincap_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4614-L4626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4614-L4626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b68b90ff6012a103e57d141ed38a7ee9"
-		logic_hash = "e708a7dcb26ff7d0208c1f092e14e701f2ae94c4ffca019f13064bbe04ef74d7"
+		logic_hash = "v1_sha256_e708a7dcb26ff7d0208c1f092e14e701f2ae94c4ffca019f13064bbe04ef74d7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313797,10 +311451,10 @@ rule SIGNATURE_BASE_Test_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4627-L4639"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4627-L4639"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "77e331abd03b6915c6c6c7fe999fcb50"
-		logic_hash = "575a2eeadc8113d779057f98e978ed4f8914546117b57944bf65f1d6d84c9521"
+		logic_hash = "v1_sha256_575a2eeadc8113d779057f98e978ed4f8914546117b57944bf65f1d6d84c9521"
 		score = 50
 		quality = 85
 		tags = ""
@@ -313822,10 +311476,10 @@ rule SIGNATURE_BASE_Phyton_Shell_Py
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4640-L4653"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4640-L4653"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "92b3c897090867c65cc169ab037a0f55"
-		logic_hash = "ac16a95cd1fb09c93b315e3cd7d57c1ebec322b641f515854fb73a61393dd365"
+		logic_hash = "v1_sha256_ac16a95cd1fb09c93b315e3cd7d57c1ebec322b641f515854fb73a61393dd365"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313848,10 +311502,10 @@ rule SIGNATURE_BASE_Mysql_Tool_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4654-L4666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4654-L4666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5fbe4d8edeb2769eda5f4add9bab901e"
-		logic_hash = "9f49bd6c56c919f678ecada82ff3d801c82c98a8abdee85cda1ec7e5b6756012"
+		logic_hash = "v1_sha256_9f49bd6c56c919f678ecada82ff3d801c82c98a8abdee85cda1ec7e5b6756012"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313873,10 +311527,10 @@ rule SIGNATURE_BASE_Zehir_4_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4667-L4678"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4667-L4678"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7f4e12e159360743ec016273c3b9108c"
-		logic_hash = "69063d866daf1709df81fa22d76177bf8d552e19725a94db4a1b2fca79387faf"
+		logic_hash = "v1_sha256_69063d866daf1709df81fa22d76177bf8d552e19725a94db4a1b2fca79387faf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313897,10 +311551,10 @@ rule SIGNATURE_BASE_Sh_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4679-L4690"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4679-L4690"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "330af9337ae51d0bac175ba7076d6299"
-		logic_hash = "b0c3307d451e5d7dadece114e2888503a46038e2edb2ff32bf566ce47b300e76"
+		logic_hash = "v1_sha256_b0c3307d451e5d7dadece114e2888503a46038e2edb2ff32bf566ce47b300e76"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313921,10 +311575,10 @@ rule SIGNATURE_BASE_Phpbackdoor15_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4691-L4703"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4691-L4703"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0fdb401a49fc2e481e3dfd697078334b"
-		logic_hash = "cdd105f36593e8326ca32bf7cf1fba6fb754e7305c91fe6c078323db8f59b23c"
+		logic_hash = "v1_sha256_cdd105f36593e8326ca32bf7cf1fba6fb754e7305c91fe6c078323db8f59b23c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313946,10 +311600,10 @@ rule SIGNATURE_BASE_Phpjackal_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4704-L4715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4704-L4715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ab230817bcc99acb9bdc0ec6d264d76f"
-		logic_hash = "6e2ff262aecd08e5feaa274a7fd128d75565d6cc03341da7cbeb2949070705e5"
+		logic_hash = "v1_sha256_6e2ff262aecd08e5feaa274a7fd128d75565d6cc03341da7cbeb2949070705e5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -313970,10 +311624,10 @@ rule SIGNATURE_BASE_Sql_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4716-L4728"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4716-L4728"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8334249cbb969f2d33d678fec2b680c5"
-		logic_hash = "875bdaa0072f869c983526d0aab20b4faa9187a3f32b8024658114a4c908b825"
+		logic_hash = "v1_sha256_875bdaa0072f869c983526d0aab20b4faa9187a3f32b8024658114a4c908b825"
 		score = 75
 		quality = 60
 		tags = ""
@@ -313995,10 +311649,10 @@ rule SIGNATURE_BASE_Cgi_Python_Py
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4729-L4741"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4729-L4741"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0a15f473e2232b89dae1075e1afdac97"
-		logic_hash = "37c6c7db32a52c8a83ff85f0a50c6fa71e833b9e6d20b1f95e9512fe8bbd0aee"
+		logic_hash = "v1_sha256_37c6c7db32a52c8a83ff85f0a50c6fa71e833b9e6d20b1f95e9512fe8bbd0aee"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314020,10 +311674,10 @@ rule SIGNATURE_BASE_Ru24_Post_Sh_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4742-L4754"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4742-L4754"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5b334d494564393f419af745dc1eeec7"
-		logic_hash = "e81e5345bbe07ca85c94a3d8411f0dd3c418689ccae7115c098f718f9093b3bf"
+		logic_hash = "v1_sha256_e81e5345bbe07ca85c94a3d8411f0dd3c418689ccae7115c098f718f9093b3bf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314045,10 +311699,10 @@ rule SIGNATURE_BASE_Dtool_Pro_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4755-L4767"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4755-L4767"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "366ad973a3f327dfbfb915b0faaea5a6"
-		logic_hash = "e8f8b4ca2ab4607e700e897671fd230280763a70897b8ccfc31b3bcb7f2a1f4a"
+		logic_hash = "v1_sha256_e8f8b4ca2ab4607e700e897671fd230280763a70897b8ccfc31b3bcb7f2a1f4a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314070,10 +311724,10 @@ rule SIGNATURE_BASE_Telnetd_Pl
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4768-L4782"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4768-L4782"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5f61136afd17eb025109304bd8d6d414"
-		logic_hash = "faf21758b311fa4c2d11cd60169e6c9a67282cf739b73664456691361a480419"
+		logic_hash = "v1_sha256_faf21758b311fa4c2d11cd60169e6c9a67282cf739b73664456691361a480419"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314097,10 +311751,10 @@ rule SIGNATURE_BASE_Php_Include_W_Shell_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4783-L4794"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4783-L4794"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4e913f159e33867be729631a7ca46850"
-		logic_hash = "a63910d97b7ef447b2cadb7de12943d3dbb6eada27d3097b8acf58d9b65b6f60"
+		logic_hash = "v1_sha256_a63910d97b7ef447b2cadb7de12943d3dbb6eada27d3097b8acf58d9b65b6f60"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314121,10 +311775,10 @@ rule SIGNATURE_BASE_Safe0Ver_Shell__Safe_Mod_Bypass_By_Evilc0Der_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4795-L4807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4795-L4807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6163b30600f1e80d2bb5afaa753490b6"
-		logic_hash = "46f6bb38f1175e02b03047c06a7aed968b1c1ce2e28cc4b88e15703040e91592"
+		logic_hash = "v1_sha256_46f6bb38f1175e02b03047c06a7aed968b1c1ce2e28cc4b88e15703040e91592"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314146,10 +311800,10 @@ rule SIGNATURE_BASE_Shell_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4808-L4820"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4808-L4820"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1a95f0163b6dea771da1694de13a3d8d"
-		logic_hash = "dbd08e71dc512f8dcf009150fb4448cd3608291ef9078c7e6b86e6f8d820bd94"
+		logic_hash = "v1_sha256_dbd08e71dc512f8dcf009150fb4448cd3608291ef9078c7e6b86e6f8d820bd94"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314171,10 +311825,10 @@ rule SIGNATURE_BASE_Telnet_Cgi
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4821-L4833"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4821-L4833"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dee697481383052980c20c48de1598d1"
-		logic_hash = "689c1d43c64aa7469989686c60fc9ab46acde42fdf3c1157bae1e2b8373c845f"
+		logic_hash = "v1_sha256_689c1d43c64aa7469989686c60fc9ab46acde42fdf3c1157bae1e2b8373c845f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314196,10 +311850,10 @@ rule SIGNATURE_BASE_Ironshell_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4834-L4848"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4834-L4848"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
-		logic_hash = "23574299ee2bb33c3f71102adf71ac8f09b6f8ece5f798beacb9b2432d297ee7"
+		logic_hash = "v1_sha256_23574299ee2bb33c3f71102adf71ac8f09b6f8ece5f798beacb9b2432d297ee7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314223,10 +311877,10 @@ rule SIGNATURE_BASE_Backdoorfr_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4849-L4860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4849-L4860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "91e4afc7444ed258640e85bcaf0fecfc"
-		logic_hash = "40a6fb41a65fd35acb7cdc36fdda90f5dc54b641adc3ba9eaae29c5e46622206"
+		logic_hash = "v1_sha256_40a6fb41a65fd35acb7cdc36fdda90f5dc54b641adc3ba9eaae29c5e46622206"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314247,10 +311901,10 @@ rule SIGNATURE_BASE_Aspydrv_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4861-L4874"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4861-L4874"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1c01f8a88baee39aa1cebec644bbcb99"
-		logic_hash = "64912d7521d4bff33b5f3a78525bf4ed94246f5933753bed7ca02bedffc85f0f"
+		logic_hash = "v1_sha256_64912d7521d4bff33b5f3a78525bf4ed94246f5933753bed7ca02bedffc85f0f"
 		score = 60
 		quality = 85
 		tags = ""
@@ -314272,10 +311926,10 @@ rule SIGNATURE_BASE_Cmdjsp_Jsp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4875-L4888"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4875-L4888"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b815611cc39f17f05a73444d699341d4"
-		logic_hash = "8b0e425c7d71ea2c536192ff186665e7f0fbdbc0e0d195d7107ac57cf9bd1773"
+		logic_hash = "v1_sha256_8b0e425c7d71ea2c536192ff186665e7f0fbdbc0e0d195d7107ac57cf9bd1773"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314298,10 +311952,10 @@ rule SIGNATURE_BASE_H4Ntu_Shell__Powered_By_Tsoi_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4889-L4900"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4889-L4900"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "06ed0b2398f8096f1bebf092d0526137"
-		logic_hash = "32c620a4ed3f7a8640928e2211516978c12cfbdedb7d96e923303740407b5a1c"
+		logic_hash = "v1_sha256_32c620a4ed3f7a8640928e2211516978c12cfbdedb7d96e923303740407b5a1c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314322,10 +311976,10 @@ rule SIGNATURE_BASE_Ajan_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4901-L4913"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4901-L4913"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b6f468252407efc2318639da22b08af0"
-		logic_hash = "13988af864a62ca04501288d4f2d830815ab453b14cef6795fe993db1dd1a9ef"
+		logic_hash = "v1_sha256_13988af864a62ca04501288d4f2d830815ab453b14cef6795fe993db1dd1a9ef"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314347,10 +312001,10 @@ rule SIGNATURE_BASE_PHANTASMA_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4914-L4927"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4914-L4927"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "52779a27fa377ae404761a7ce76a5da7"
-		logic_hash = "d4a2a1bcc1ff3264b35f2b05d7de664b56807977f2a793fd87206f046a185d3b"
+		logic_hash = "v1_sha256_d4a2a1bcc1ff3264b35f2b05d7de664b56807977f2a793fd87206f046a185d3b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314373,10 +312027,10 @@ rule SIGNATURE_BASE_Mysql_Web_Interface_Version_0_8_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4928-L4941"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4928-L4941"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "36d4f34d0a22080f47bb1cb94107c60f"
-		logic_hash = "f0a20870a3240948e3ef1ad61685b00c5fc90d6098b87af9ac43ab44ccd13c9e"
+		logic_hash = "v1_sha256_f0a20870a3240948e3ef1ad61685b00c5fc90d6098b87af9ac43ab44ccd13c9e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314399,10 +312053,10 @@ rule SIGNATURE_BASE_Simple_Cmd_Html
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4942-L4955"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4942-L4955"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c6381412df74dbf3bcd5a2b31522b544"
-		logic_hash = "56b5b9e5518fa8a4be8c48735e997a538b0e534ad8fd72c1419dc0e8353bbc00"
+		logic_hash = "v1_sha256_56b5b9e5518fa8a4be8c48735e997a538b0e534ad8fd72c1419dc0e8353bbc00"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314425,9 +312079,9 @@ rule SIGNATURE_BASE__1_C2007_Php_Php_C100_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4956-L4970"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f6cb7c210bcd0f84c2ccff52850b1d673622ae49b83d614d63b5bbba7392327"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4956-L4970"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f6cb7c210bcd0f84c2ccff52850b1d673622ae49b83d614d63b5bbba7392327"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314452,9 +312106,9 @@ rule SIGNATURE_BASE__Nst_Php_Php_Img_Php_Php_Nstview_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4971-L4986"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b1e13f75edbbc8f9263e0e516a54330ce57190ba0b45813dad4bafeaeefa389b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4971-L4986"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b1e13f75edbbc8f9263e0e516a54330ce57190ba0b45813dad4bafeaeefa389b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314480,9 +312134,9 @@ rule SIGNATURE_BASE__Network_Php_Php_Xinfo_Php_Php_Nfm_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L4987-L5001"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "913ff19b6448d3b074440c2a5f85d85813fdf010d33dc57c89ba1e5db6455e11"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L4987-L5001"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_913ff19b6448d3b074440c2a5f85d85813fdf010d33dc57c89ba1e5db6455e11"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314507,9 +312161,9 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Specials
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5002-L5017"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a4bae5456baf0d8d894165c84d66118f2b16cfc040e299c2032eccb6a9eb4822"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5002-L5017"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a4bae5456baf0d8d894165c84d66118f2b16cfc040e299c2032eccb6a9eb4822"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314535,9 +312189,9 @@ rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php_R57_Shell_Php_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5018-L5035"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0df3e00f752f85aa1f150c01e3ef41b9a5cd3d3ce2060965992320cb3c4d87ae"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5018-L5035"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0df3e00f752f85aa1f150c01e3ef41b9a5cd3d3ce2060965992320cb3c4d87ae"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314565,9 +312219,9 @@ rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_Sses_Php_Php_Ctt_Sh_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5036-L5052"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "137f98b636ec012d7d5e687f7d24ae88e8d3261360e60a4bbc03da248cce381e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5036-L5052"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_137f98b636ec012d7d5e687f7d24ae88e8d3261360e60a4bbc03da248cce381e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314594,9 +312248,9 @@ rule SIGNATURE_BASE__R577_Php_Php_Spy_Php_Php_S_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5053-L5067"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "09892789e8dad16f9fc7c4e22525e5d0af3af401a4b2655b70f7a6856888875c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5053-L5067"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_09892789e8dad16f9fc7c4e22525e5d0af3af401a4b2655b70f7a6856888875c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314621,9 +312275,9 @@ rule SIGNATURE_BASE_Webshell_C99_Generic
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5068-L5088"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "422bc3a0d9b04b1e37ad954faacb1ec7841fe529c1eb19634bdbfe83da374c73"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5068-L5088"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_422bc3a0d9b04b1e37ad954faacb1ec7841fe529c1eb19634bdbfe83da374c73"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314654,9 +312308,9 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5089-L5106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b133cf947476a1c94ed90b5cd3757ca8aa429be4284d75664625896d9cfa687f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5089-L5106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b133cf947476a1c94ed90b5cd3757ca8aa429be4284d75664625896d9cfa687f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314684,9 +312338,9 @@ rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_Specialshell_99_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5107-L5121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7bdaebfb093b58a2fd33b4bbeea8465d0f724383b4855eb521a3e339ee153781"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5107-L5121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7bdaebfb093b58a2fd33b4bbeea8465d0f724383b4855eb521a3e339ee153781"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314711,9 +312365,9 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Sses_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5122-L5138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6dbd40e19d4d5753dbd1f7e627bccc08a60430de8138a923f13e836d19dde65c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5122-L5138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6dbd40e19d4d5753dbd1f7e627bccc08a60430de8138a923f13e836d19dde65c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314740,9 +312394,9 @@ rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php_Spy_Php_Php_S_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5139-L5155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "834c33059e08e8075a8d3f69187b74f3b53afabfc37ae1f13a2f579f0948a363"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5139-L5155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_834c33059e08e8075a8d3f69187b74f3b53afabfc37ae1f13a2f579f0948a363"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314769,9 +312423,9 @@ rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5156-L5171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f97846fdaac949185b4ce6a25cc276f4ae4243d891acb18c3a3ce0c18b540976"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5156-L5171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f97846fdaac949185b4ce6a25cc276f4ae4243d891acb18c3a3ce0c18b540976"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314797,9 +312451,9 @@ rule SIGNATURE_BASE__R577_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5172-L5188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "764a374c1e4acec8978db1e7e7e326c4fa95c6f92e1ca5a6d7f892bb05ecd289"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5172-L5188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_764a374c1e4acec8978db1e7e7e326c4fa95c6f92e1ca5a6d7f892bb05ecd289"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314826,9 +312480,9 @@ rule SIGNATURE_BASE__Wacking_Php_Php_1_Specialshell_99_Php_Php_C100_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5189-L5205"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d32fc00ba2602a1140dc9030894bb9524c55b95c445a08f2bf6f8fc60108e64"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5189-L5205"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d32fc00ba2602a1140dc9030894bb9524c55b95c445a08f2bf6f8fc60108e64"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314855,9 +312509,9 @@ rule SIGNATURE_BASE__R577_Php_Php_R57_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Ph
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5206-L5223"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "afbd2103b0c953d6aec070ba450f43e567560bc9743423a5731cd4d6e5e36bb6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5206-L5223"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_afbd2103b0c953d6aec070ba450f43e567560bc9743423a5731cd4d6e5e36bb6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314885,9 +312539,9 @@ rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_Sses_Php_Php_Specialshell_99_Php_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5224-L5240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9bbcb687c83c01ad52e8978a60e604a74f10c33a63af3b91d0286b30dea42890"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5224-L5240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9bbcb687c83c01ad52e8978a60e604a74f10c33a63af3b91d0286b30dea42890"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314914,9 +312568,9 @@ rule SIGNATURE_BASE_Multiple_Php_Webshells
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5242-L5263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d55c96febd64107273001edadbda6d0a1b4b00e35fb41b46561b49fca6a9bd1b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5242-L5263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d55c96febd64107273001edadbda6d0a1b4b00e35fb41b46561b49fca6a9bd1b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314948,9 +312602,9 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5264-L5279"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c089f8175532ddc0e2d256b4972f7db32683bd213a456622ed27ab4844d1e435"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5264-L5279"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c089f8175532ddc0e2d256b4972f7db32683bd213a456622ed27ab4844d1e435"
 		score = 75
 		quality = 85
 		tags = ""
@@ -314976,9 +312630,9 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5280-L5297"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e82882e89a1aeb256768f2af7a6d3674c89f9abc358710b33b8d3d425defcef1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5280-L5297"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e82882e89a1aeb256768f2af7a6d3674c89f9abc358710b33b8d3d425defcef1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315006,9 +312660,9 @@ rule SIGNATURE_BASE__GFS_Web_Shell_Ver_3_1_7___Priv8_Php_Nshell_Php_Php_Gfs_Sh_P
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5298-L5313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9df5b6df25574b303044a0799c5eb5f38f9ebfbc6f6114275fe1e34adbde1f7c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5298-L5313"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9df5b6df25574b303044a0799c5eb5f38f9ebfbc6f6114275fe1e34adbde1f7c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315034,9 +312688,9 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5314-L5332"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f44dc1ff243b234a718e8dbd5cc8c4dc8eb9d3b63300a5c6ff72b86280607bf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5314-L5332"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f44dc1ff243b234a718e8dbd5cc8c4dc8eb9d3b63300a5c6ff72b86280607bf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315065,9 +312719,9 @@ rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_C99Php_Spec
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5333-L5349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e9cd7425b806f71d8889f5df7f3fc2f4a692279fc4e495104646cfe28c5b5fe5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5333-L5349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e9cd7425b806f71d8889f5df7f3fc2f4a692279fc4e495104646cfe28c5b5fe5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315094,9 +312748,9 @@ rule SIGNATURE_BASE__Antichat_Php_Php_Fatalshell_Php_Php_A_Gedit_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5350-L5366"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "789340845aeed4accaef02afa1a1fe420e73b6f5af1b621f4ec2342994045278"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5350-L5366"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_789340845aeed4accaef02afa1a1fe420e73b6f5af1b621f4ec2342994045278"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315123,9 +312777,9 @@ rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_Sses_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5367-L5380"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b2bdf4187ff3d63e4af5c70e8cc93cd8fac3257b33c38764ad2bb2e206066162"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5367-L5380"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b2bdf4187ff3d63e4af5c70e8cc93cd8fac3257b33c38764ad2bb2e206066162"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315149,9 +312803,9 @@ rule SIGNATURE_BASE__Crystal_Php_Nshell_Php_Php_Load_Shell_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5381-L5396"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "71a9310b19b66e3699f75f551cc604f535ea843eb9c50f4a009edcd9c11e01b9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5381-L5396"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_71a9310b19b66e3699f75f551cc604f535ea843eb9c50f4a009edcd9c11e01b9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315177,9 +312831,9 @@ rule SIGNATURE_BASE__Nst_Php_Php_Cybershell_Php_Php_Img_Php_Php_Nstview_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5397-L5413"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "afc0b1c83644aa323d308471e5978b6b03f444f5f46fbaddac28ff42d524df1e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5397-L5413"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_afc0b1c83644aa323d308471e5978b6b03f444f5f46fbaddac28ff42d524df1e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315206,9 +312860,9 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Dc3_Secu
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5414-L5430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7a4c74912caa1855efc3a2ea7fa6d0082f62776d77a211e59f12892d4883f240"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5414-L5430"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7a4c74912caa1855efc3a2ea7fa6d0082f62776d77a211e59f12892d4883f240"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315235,9 +312889,9 @@ rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_1_C2007_Php_Php_C100_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5431-L5446"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a5dc73a12d8c8b89bab77b90cb3b561e9daf9db5f5ad550326a2fbce52c1c8da"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5431-L5446"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a5dc73a12d8c8b89bab77b90cb3b561e9daf9db5f5ad550326a2fbce52c1c8da"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315263,9 +312917,9 @@ rule SIGNATURE_BASE_Multiple_Php_Webshells_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5447-L5467"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "26fe586ba7f4d1931b2df81aa27543ff422e699fd56b6b1be289a0f8d6954691"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5447-L5467"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_26fe586ba7f4d1931b2df81aa27543ff422e699fd56b6b1be289a0f8d6954691"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315296,9 +312950,9 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_1_Specia
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5468-L5486"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "160adf93d4f9e51022c427b2b0601207dd9ca917e98d99e2013fe83e09a85d21"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5468-L5486"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_160adf93d4f9e51022c427b2b0601207dd9ca917e98d99e2013fe83e09a85d21"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315327,9 +312981,9 @@ rule SIGNATURE_BASE__R577_Php_Php_R57_Php_Php_Spy_Php_Php_S_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5487-L5503"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ba3d6927dc06bfcd98ee9d7146164ca9a9024ef26eac60fabc8ed1375db618d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5487-L5503"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ba3d6927dc06bfcd98ee9d7146164ca9a9024ef26eac60fabc8ed1375db618d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315356,9 +313010,9 @@ rule SIGNATURE_BASE__Nixrem_Php_Php_C99Shell_V1_0_Php_Php_C99Php_NIX_REMOTE_WEB_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5504-L5521"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f7575db2c8f147d03d5b93b431d1a73c4182b5db6e801e672914778b2042a712"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5504-L5521"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f7575db2c8f147d03d5b93b431d1a73c4182b5db6e801e672914778b2042a712"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315386,10 +313040,10 @@ rule SIGNATURE_BASE_Darksecurityteam_Webshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5525-L5537"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5525-L5537"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
-		logic_hash = "0c58ed8845cb04d785322b280647d424e1028a3be7e92b2493fd907fae36b16d"
+		logic_hash = "v1_sha256_0c58ed8845cb04d785322b280647d424e1028a3be7e92b2493fd907fae36b16d"
 		score = 50
 		quality = 85
 		tags = ""
@@ -315410,9 +313064,9 @@ rule SIGNATURE_BASE_PHP_Cloaked_Webshell_Superfetchexec
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/xFvioC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5539-L5551"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "320b85b1ad39a90578f53c69838b6264af1e6a71c509aefc0986c7f0c77fdae9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5539-L5551"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_320b85b1ad39a90578f53c69838b6264af1e6a71c509aefc0986c7f0c77fdae9"
 		score = 50
 		quality = 85
 		tags = ""
@@ -315433,10 +313087,10 @@ rule SIGNATURE_BASE_Webshell_Remexp_Asp_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5555-L5570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5555-L5570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d9919dcf94a70d5180650de8b81669fa1c10c5a2"
-		logic_hash = "b3cfa44898629ffa20630436ae10a94ad72f0e793d61e1157a4de649aa048fe2"
+		logic_hash = "v1_sha256_b3cfa44898629ffa20630436ae10a94ad72f0e793d61e1157a4de649aa048fe2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315461,10 +313115,10 @@ rule SIGNATURE_BASE_Webshell_Dc3_Security_Crew_Shell_Priv
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5571-L5587"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5571-L5587"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1b2a4a7174ca170b4e3a8cdf4814c92695134c8a"
-		logic_hash = "f93a5d87d4a490844de578067dc0b7bac6b01ceb9130cd7c70a227566e18f16c"
+		logic_hash = "v1_sha256_f93a5d87d4a490844de578067dc0b7bac6b01ceb9130cd7c70a227566e18f16c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315490,10 +313144,10 @@ rule SIGNATURE_BASE_Webshell_Simattacker
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5588-L5606"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5588-L5606"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "258297b62aeaf4650ce04642ad5f19be25ec29c9"
-		logic_hash = "323b68f1d31df647775ad16a85b9f90bce4eac89188160a1e4853f8fec680160"
+		logic_hash = "v1_sha256_323b68f1d31df647775ad16a85b9f90bce4eac89188160a1e4853f8fec680160"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315521,10 +313175,10 @@ rule SIGNATURE_BASE_Webshell_Dtool_Pro
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5607-L5625"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5607-L5625"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e2ee1c7ba7b05994f65710b7bbf935954f2c3353"
-		logic_hash = "da744efb521415fb8817c0982d8d538e1e38b1c0995f43716611df37bf371c38"
+		logic_hash = "v1_sha256_da744efb521415fb8817c0982d8d538e1e38b1c0995f43716611df37bf371c38"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315553,10 +313207,10 @@ rule SIGNATURE_BASE_Webshell_Ironshell_4
 		modified = "2023-12-05"
 		old_rule_name = "WebShell_ironshell"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5626-L5645"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5626-L5645"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d47b8ba98ea8061404defc6b3a30839c4444a262"
-		logic_hash = "1810071f261ad7390532b07ef24115726f236131aa8ffd29adbde9ebe5085e9d"
+		logic_hash = "v1_sha256_1810071f261ad7390532b07ef24115726f236131aa8ffd29adbde9ebe5085e9d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315584,10 +313238,10 @@ rule SIGNATURE_BASE_Webshell_Indexer_Asp_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5646-L5662"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5646-L5662"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e9a7aa5eb1fb228117dc85298c7d3ecd8e288a2d"
-		logic_hash = "c576925c95b5bd2549e8039a1fc6ac228bfab5ddee8c4e12264ea78e9828ba5c"
+		logic_hash = "v1_sha256_c576925c95b5bd2549e8039a1fc6ac228bfab5ddee8c4e12264ea78e9828ba5c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315613,10 +313267,10 @@ rule SIGNATURE_BASE_Webshell_Toolaspshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5663-L5676"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5663-L5676"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "11d236b0d1c2da30828ffd2f393dd4c6a1022e3f"
-		logic_hash = "cb46d3170a9c144a22ef8c91b381495a471d2aa178a4a123eb9a1e32e1db7683"
+		logic_hash = "v1_sha256_cb46d3170a9c144a22ef8c91b381495a471d2aa178a4a123eb9a1e32e1db7683"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315639,10 +313293,10 @@ rule SIGNATURE_BASE_Webshell_B374K_Mini_Shell_Php_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5677-L5690"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5677-L5690"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "afb88635fbdd9ebe86b650cc220d3012a8c35143"
-		logic_hash = "553bd775d9662f9410d9ab946ccffe4b2ee92e367bcc6345fa595527653280cf"
+		logic_hash = "v1_sha256_553bd775d9662f9410d9ab946ccffe4b2ee92e367bcc6345fa595527653280cf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315665,10 +313319,10 @@ rule SIGNATURE_BASE_Webshell_Sincap_1_0
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5691-L5706"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5691-L5706"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9b72635ff1410fa40c4e15513ae3a496d54f971c"
-		logic_hash = "0cb8851285bd55b0b613ec4c46ab88142e2cbba7e527ad510b008cfb342af221"
+		logic_hash = "v1_sha256_0cb8851285bd55b0b613ec4c46ab88142e2cbba7e527ad510b008cfb342af221"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315693,10 +313347,10 @@ rule SIGNATURE_BASE_Webshell_B374K_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5707-L5722"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5707-L5722"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "04c99efd187cf29dc4e5603c51be44170987bce2"
-		logic_hash = "f44ecdcf327cf417a90a91c8d23f6137b80c2006bea2ca2e214f2bfdf5793771"
+		logic_hash = "v1_sha256_f44ecdcf327cf417a90a91c8d23f6137b80c2006bea2ca2e214f2bfdf5793771"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315721,10 +313375,10 @@ rule SIGNATURE_BASE_Webshell_Simattacker___Vrsion_1_0_0___Priv8_4_My_Friend
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5723-L5740"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5723-L5740"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6454cc5ab73143d72cf0025a81bd1fe710351b44"
-		logic_hash = "63ebb0c673a5aee05d2d9d571ebf63942d826b5148a5f7ed587ba1efbb0dc923"
+		logic_hash = "v1_sha256_63ebb0c673a5aee05d2d9d571ebf63942d826b5148a5f7ed587ba1efbb0dc923"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315751,10 +313405,10 @@ rule SIGNATURE_BASE_Webshell_H4Ntu_Shell__Powered_By_Tsoi_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5741-L5757"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5741-L5757"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cbca8cd000e705357e2a7e0cf8262678706f18f9"
-		logic_hash = "da5994e3278278920d3e4774850d9b05f0244d2af03d0de92d1466f6f87ca3eb"
+		logic_hash = "v1_sha256_da5994e3278278920d3e4774850d9b05f0244d2af03d0de92d1466f6f87ca3eb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315780,10 +313434,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Myshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5758-L5776"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5758-L5776"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "42e283c594c4d061f80a18f5ade0717d3fb2f76d"
-		logic_hash = "2c39ffecb44ce2f936ba3563c6086d8b2ed75aec3b57b45e2a1f5e7321ac9a3f"
+		logic_hash = "v1_sha256_2c39ffecb44ce2f936ba3563c6086d8b2ed75aec3b57b45e2a1f5e7321ac9a3f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315811,10 +313465,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Pws
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5777-L5793"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5777-L5793"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7a405f1c179a84ff8ac09a42177a2bcd8a1a481b"
-		logic_hash = "4b2eeb80200cc5dffa80cddc74f1902c0e8a5d2313d9a20d02eeb99ccb668ec0"
+		logic_hash = "v1_sha256_4b2eeb80200cc5dffa80cddc74f1902c0e8a5d2313d9a20d02eeb99ccb668ec0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315840,10 +313494,10 @@ rule SIGNATURE_BASE_Webshell_Reader_Asp_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5794-L5808"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5794-L5808"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "70656f3495e2b3ad391a77d5208eec0fb9e2d931"
-		logic_hash = "6ffda38584b6cdec818af8e09c62bb4a46f40230ffd5c1a68993a91c37f67680"
+		logic_hash = "v1_sha256_6ffda38584b6cdec818af8e09c62bb4a46f40230ffd5c1a68993a91c37f67680"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315868,10 +313522,10 @@ rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_3
 		modified = "2023-12-05"
 		old_rule_name = "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5809-L5826"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5809-L5826"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "db076b7c80d2a5279cab2578aa19cb18aea92832"
-		logic_hash = "6840af0d9f99277277edce93deb54e9a319c8938169701c89fdeb65207590951"
+		logic_hash = "v1_sha256_6840af0d9f99277277edce93deb54e9a319c8938169701c89fdeb65207590951"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315898,10 +313552,10 @@ rule SIGNATURE_BASE_Webshell_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass
 		modified = "2023-12-05"
 		old_rule_name = "WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5827-L5843"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5827-L5843"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b2b797707e09c12ff5e632af84b394ad41a46fa4"
-		logic_hash = "92bfac3516a448bbb3e78cf8950c6e816bf35d0ae2f3d32bc9b9b2836309999b"
+		logic_hash = "v1_sha256_92bfac3516a448bbb3e78cf8950c6e816bf35d0ae2f3d32bc9b9b2836309999b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315927,10 +313581,10 @@ rule SIGNATURE_BASE_Webshell_PHP_Backdoor_2
 		modified = "2023-12-05"
 		old_rule_name = "WebShell_php_backdoor"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5844-L5860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5844-L5860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b190c03af4f3fb52adc20eb0f5d4d151020c74fe"
-		logic_hash = "4228bcbfff5d7756615347196270f7916843e2aceacc7298610070b8b923381b"
+		logic_hash = "v1_sha256_4228bcbfff5d7756615347196270f7916843e2aceacc7298610070b8b923381b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315956,10 +313610,10 @@ rule SIGNATURE_BASE_Webshell_Worse_Linux_Shell_2
 		modified = "2023-12-05"
 		old_rule_name = "WebShell_Worse_Linux_Shell"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5861-L5878"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5861-L5878"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "64623ab1246bc8f7d256b25f244eb2b41f543e96"
-		logic_hash = "6480c524213583511253ea1d37820994bba8a86f58a3775d4a9e4325725289d8"
+		logic_hash = "v1_sha256_6480c524213583511253ea1d37820994bba8a86f58a3775d4a9e4325725289d8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -315985,10 +313639,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Phpinj
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5879-L5896"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5879-L5896"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "75116bee1ab122861b155cc1ce45a112c28b9596"
-		logic_hash = "271efaa8f370376f971d3d59256658b341599ac554cc216e09401e44b16bdede"
+		logic_hash = "v1_sha256_271efaa8f370376f971d3d59256658b341599ac554cc216e09401e44b16bdede"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316015,10 +313669,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_NGH
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5897-L5914"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5897-L5914"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c05b5deecfc6de972aa4652cb66da89cfb3e1645"
-		logic_hash = "572b026545b012951136bdb9b1101e38f27bc3321b895799bc853ea1190877f9"
+		logic_hash = "v1_sha256_572b026545b012951136bdb9b1101e38f27bc3321b895799bc853ea1190877f9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316045,10 +313699,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Matamu
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5915-L5931"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5915-L5931"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d477aae6bd2f288b578dbf05c1c46b3aaa474733"
-		logic_hash = "c0101dab5fe7c3a2652b2e23e1ef0274364137895a402a0367c6b5474c0e8a1f"
+		logic_hash = "v1_sha256_c0101dab5fe7c3a2652b2e23e1ef0274364137895a402a0367c6b5474c0e8a1f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316074,10 +313728,10 @@ rule SIGNATURE_BASE_Webshell_Ru24_Post_Sh
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5932-L5947"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5932-L5947"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d2c18766a1cd4dda928c12ff7b519578ccec0769"
-		logic_hash = "6cf15a67c311979d32edfb443701cef34ee32d7a672314fc7b60b262b6b2c402"
+		logic_hash = "v1_sha256_6cf15a67c311979d32edfb443701cef34ee32d7a672314fc7b60b262b6b2c402"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316102,10 +313756,10 @@ rule SIGNATURE_BASE_Webshell_Hiddens_Shell_V1
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5948-L5959"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5948-L5959"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1674bd40eb98b48427c547bf9143aa7fbe2f4a59"
-		logic_hash = "b76400c320e6294b0c831fbbb8e08a9d2097fbb027065f9c4b496d4b005ba016"
+		logic_hash = "v1_sha256_b76400c320e6294b0c831fbbb8e08a9d2097fbb027065f9c4b496d4b005ba016"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316126,10 +313780,10 @@ rule SIGNATURE_BASE_Webshell_C99_Madnet
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5960-L5975"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5960-L5975"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "17613df393d0a99fd5bea18b2d4707f566cff219"
-		logic_hash = "cd4048f28405f106302643656ae5f8a257aaec0184a8057a9dffbda9bb857027"
+		logic_hash = "v1_sha256_cd4048f28405f106302643656ae5f8a257aaec0184a8057a9dffbda9bb857027"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316154,10 +313808,10 @@ rule SIGNATURE_BASE_Webshell_C99_Locus7S
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5976-L5991"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5976-L5991"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d413d4700daed07561c9f95e1468fb80238fbf3c"
-		logic_hash = "5ecfc5f6da471bd3037228c0bc762d50762933af3cf6674210c7b2017a45a646"
+		logic_hash = "v1_sha256_5ecfc5f6da471bd3037228c0bc762d50762933af3cf6674210c7b2017a45a646"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316182,10 +313836,10 @@ rule SIGNATURE_BASE_Webshell_Jspwebshell_1_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L5992-L6008"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L5992-L6008"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0bed4a1966117dd872ac9e8dceceb54024a030fa"
-		logic_hash = "13e696c1c671d7fda832c84f150e3f41ed55bf888c4bebfeb06ea68d6be65527"
+		logic_hash = "v1_sha256_13e696c1c671d7fda832c84f150e3f41ed55bf888c4bebfeb06ea68d6be65527"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316211,10 +313865,10 @@ rule SIGNATURE_BASE_Webshell_Safe0Ver
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6009-L6026"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6009-L6026"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "366639526d92bd38ff7218b8539ac0f154190eb8"
-		logic_hash = "ae5de63b79804cf8c99bc5ea0c8862cf05e4085451d2b516cf95565bf32f3876"
+		logic_hash = "v1_sha256_ae5de63b79804cf8c99bc5ea0c8862cf05e4085451d2b516cf95565bf32f3876"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316241,10 +313895,10 @@ rule SIGNATURE_BASE_Webshell_Uploader
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6027-L6038"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6027-L6038"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e216c5863a23fde8a449c31660fd413d77cce0b7"
-		logic_hash = "c4b915f60a952131caa2c4f5bb2eea85ef25f27cabb8ad36a6bb928433558954"
+		logic_hash = "v1_sha256_c4b915f60a952131caa2c4f5bb2eea85ef25f27cabb8ad36a6bb928433558954"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316265,10 +313919,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Kral
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6039-L6055"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6039-L6055"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4cd1d1a2fd448cecc605970e3a89f3c2e5c80dfc"
-		logic_hash = "0aded226f4e54c0169b9fbda91458f581ea47f9f8bda61a350b5e6f8b60931f3"
+		logic_hash = "v1_sha256_0aded226f4e54c0169b9fbda91458f581ea47f9f8bda61a350b5e6f8b60931f3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316294,10 +313948,10 @@ rule SIGNATURE_BASE_Webshell_Cgitelnet
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6056-L6070"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6056-L6070"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "72e5f0e4cd438e47b6454de297267770a36cbeb3"
-		logic_hash = "e9b7096d5a19c9d5423bbfe125ae0347853919ab092efa98f0687a5d0cf68953"
+		logic_hash = "v1_sha256_e9b7096d5a19c9d5423bbfe125ae0347853919ab092efa98f0687a5d0cf68953"
 		score = 75
 		quality = 60
 		tags = ""
@@ -316322,10 +313976,10 @@ rule SIGNATURE_BASE_Webshell_Simple_Backdoor_2
 		modified = "2023-12-05"
 		old_rule_name = "WebShell_simple_backdoor"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6071-L6091"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6071-L6091"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "edcd5157a68fa00723a506ca86d6cbb8884ef512"
-		logic_hash = "655e445e51ec0f1bdce006a72acf3bce95941a349c279c14768760fa9f6f9d76"
+		logic_hash = "v1_sha256_655e445e51ec0f1bdce006a72acf3bce95941a349c279c14768760fa9f6f9d76"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316354,10 +314008,10 @@ rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6092-L6106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6092-L6106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8fdd4e0e87c044177e9e1c97084eb5b18e2f1c25"
-		logic_hash = "fbe1f77e00fbc4e58cbad564e2d96c0381765ac799dfdf6cc2580428c68f97a5"
+		logic_hash = "v1_sha256_fbe1f77e00fbc4e58cbad564e2d96c0381765ac799dfdf6cc2580428c68f97a5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316381,10 +314035,10 @@ rule SIGNATURE_BASE_Webshell_Ntdaddy_V1_9
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6107-L6121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6107-L6121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "79519aa407fff72b7510c6a63c877f2e07d7554b"
-		logic_hash = "fdf8b4bb4980e588ad5ccee2d047660980d39f38617f887c5762dcdb0b858267"
+		logic_hash = "v1_sha256_fdf8b4bb4980e588ad5ccee2d047660980d39f38617f887c5762dcdb0b858267"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316408,10 +314062,10 @@ rule SIGNATURE_BASE_Webshell_Lamashell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6122-L6138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6122-L6138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b71181e0d899b2b07bc55aebb27da6706ea1b560"
-		logic_hash = "e58dbd6b9c65a139828890a3fadfad9031580fe189066489d266d37d7078ad98"
+		logic_hash = "v1_sha256_e58dbd6b9c65a139828890a3fadfad9031580fe189066489d266d37d7078ad98"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316437,10 +314091,10 @@ rule SIGNATURE_BASE_Webshell_Simple_PHP_Backdoor_By_DK
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6139-L6154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6139-L6154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "03f6215548ed370bec0332199be7c4f68105274e"
-		logic_hash = "1f65f759ec4045c521085aad84d0aea4dcfcf26eac4357751cf1dde6886d1718"
+		logic_hash = "v1_sha256_1f65f759ec4045c521085aad84d0aea4dcfcf26eac4357751cf1dde6886d1718"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316465,10 +314119,10 @@ rule SIGNATURE_BASE_Webshell_Moroccan_Spamers_Ma_Edition_By_Ghost
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6155-L6168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6155-L6168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "31e5473920a2cc445d246bc5820037d8fe383201"
-		logic_hash = "0e3d2d97665b8849d121d63a22baf7393047a814dde3753e395418c1868b59be"
+		logic_hash = "v1_sha256_0e3d2d97665b8849d121d63a22baf7393047a814dde3753e395418c1868b59be"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316491,10 +314145,10 @@ rule SIGNATURE_BASE_Webshell_C99Madshell_V__2_0_Madnet_Edition
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6169-L6184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6169-L6184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f99f8228eb12746847f54bad45084f19d1a7e111"
-		logic_hash = "7cf825a604783ebc74b1dca53aaff5c886957c562e11276f2acce5ff1f6ab991"
+		logic_hash = "v1_sha256_7cf825a604783ebc74b1dca53aaff5c886957c562e11276f2acce5ff1f6ab991"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316519,10 +314173,10 @@ rule SIGNATURE_BASE_Webshell_Cmdasp_Asp_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6185-L6204"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6185-L6204"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cb18e1ac11e37e236e244b96c2af2d313feda696"
-		logic_hash = "0fd9c7e83ad9ddf5cf88f1d1573324d9f24ae03a1951446fe11c116fd0cf4932"
+		logic_hash = "v1_sha256_0fd9c7e83ad9ddf5cf88f1d1573324d9f24ae03a1951446fe11c116fd0cf4932"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316551,10 +314205,10 @@ rule SIGNATURE_BASE_Webshell_NCC_Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6205-L6221"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6205-L6221"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "64d4495875a809b2730bd93bec2e33902ea80a53"
-		logic_hash = "c58edc548b7804be25f6956e9407cc9f8c74dfd8651f601a87ba639284e612d9"
+		logic_hash = "v1_sha256_c58edc548b7804be25f6956e9407cc9f8c74dfd8651f601a87ba639284e612d9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316580,10 +314234,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_README
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6222-L6234"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6222-L6234"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ef2c567b4782c994db48de0168deb29c812f7204"
-		logic_hash = "aa8a9be74bbac08518d5ba442aa6fa37d3f1b255df48b49ccb9842f5728a49d5"
+		logic_hash = "v1_sha256_aa8a9be74bbac08518d5ba442aa6fa37d3f1b255df48b49ccb9842f5728a49d5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316605,10 +314259,10 @@ rule SIGNATURE_BASE_Webshell_Backupsql
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6235-L6250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6235-L6250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "863e017545ec8e16a0df5f420f2d708631020dd4"
-		logic_hash = "0126bfad6eb3861e8322ac3e11b4fd95bc8b88597d916e66c6646d7d5529c1d5"
+		logic_hash = "v1_sha256_0126bfad6eb3861e8322ac3e11b4fd95bc8b88597d916e66c6646d7d5529c1d5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316633,10 +314287,10 @@ rule SIGNATURE_BASE_Webshell_AK_74_Security_Team_Web_Shell_Beta_Version
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6251-L6264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6251-L6264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c90b0ba575f432ecc08f8f292f3013b5532fe2c4"
-		logic_hash = "4fbf8f5cab8593fd88e5a430b849e61d7d663c13700f459aa516c5b337d5438b"
+		logic_hash = "v1_sha256_4fbf8f5cab8593fd88e5a430b849e61d7d663c13700f459aa516c5b337d5438b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316659,10 +314313,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Cpanel
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6265-L6281"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6265-L6281"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "433dab17106b175c7cf73f4f094e835d453c0874"
-		logic_hash = "e4dc90c52648f1e5b7dc2d77dcb94feb774ec9e3c156c923c54a9e8f537bbf07"
+		logic_hash = "v1_sha256_e4dc90c52648f1e5b7dc2d77dcb94feb774ec9e3c156c923c54a9e8f537bbf07"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316688,10 +314342,10 @@ rule SIGNATURE_BASE_Webshell_Accept_Language
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6282-L6293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6282-L6293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "180b13576f8a5407ab3325671b63750adbcb62c9"
-		logic_hash = "6d45071722268f5b39b1486a7dce883ecefb2b3c9993357b7b58bd603ff1c40d"
+		logic_hash = "v1_sha256_6d45071722268f5b39b1486a7dce883ecefb2b3c9993357b7b58bd603ff1c40d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316712,10 +314366,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_529
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6294-L6311"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6294-L6311"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ba3fb2995528307487dff7d5b624d9f4c94c75d3"
-		logic_hash = "f46b84d51077f157c83cd01534dfe7f9cd0d9ef04ad9935ced22d2abc873c171"
+		logic_hash = "v1_sha256_f46b84d51077f157c83cd01534dfe7f9cd0d9ef04ad9935ced22d2abc873c171"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316742,10 +314396,10 @@ rule SIGNATURE_BASE_Webshell_STNC_Webshell_V0_8
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6312-L6325"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6312-L6325"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "52068c9dff65f1caae8f4c60d0225708612bb8bc"
-		logic_hash = "c2067a1b78c441aa05366b612090e0df895c621843038cc9e65beb6719c0cb9a"
+		logic_hash = "v1_sha256_c2067a1b78c441aa05366b612090e0df895c621843038cc9e65beb6719c0cb9a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316768,10 +314422,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Tryag
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6326-L6341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6326-L6341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "42d837e9ab764e95ed11b8bd6c29699d13fe4c41"
-		logic_hash = "2af3bbe8d1940e60843f3f5d40c9c6550e76df21568c374f7a871f73aeefae44"
+		logic_hash = "v1_sha256_2af3bbe8d1940e60843f3f5d40c9c6550e76df21568c374f7a871f73aeefae44"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316796,10 +314450,10 @@ rule SIGNATURE_BASE_Webshell_Dc3_Security_Crew_Shell_Priv_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6342-L6357"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6342-L6357"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9077eb05f4ce19c31c93c2421430dd3068a37f17"
-		logic_hash = "52dc0449c205ff9105e2dedc3cb4858f83a2efc7bae579656a26da493dc59500"
+		logic_hash = "v1_sha256_52dc0449c205ff9105e2dedc3cb4858f83a2efc7bae579656a26da493dc59500"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316824,10 +314478,10 @@ rule SIGNATURE_BASE_Webshell_Qsd_Php_Backdoor
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6358-L6372"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6358-L6372"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4856bce45fc5b3f938d8125f7cdd35a8bbae380f"
-		logic_hash = "3ef7b67cd60370a99fdfa6fd614f71ee314af27c9d983383dde8f03a127a28b3"
+		logic_hash = "v1_sha256_3ef7b67cd60370a99fdfa6fd614f71ee314af27c9d983383dde8f03a127a28b3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316851,10 +314505,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Spygrup
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6373-L6387"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6373-L6387"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "12f9105332f5dc5d6360a26706cd79afa07fe004"
-		logic_hash = "5981f8cc1a98f799b1573cf73297383f995acf1c40f0227ac10302dc4d6fd6cc"
+		logic_hash = "v1_sha256_5981f8cc1a98f799b1573cf73297383f995acf1c40f0227ac10302dc4d6fd6cc"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316878,10 +314532,10 @@ rule SIGNATURE_BASE_Webshell_Web_Shell__C_Shankar
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6388-L6402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6388-L6402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3dd4f25bd132beb59d2ae0c813373c9ea20e1b7a"
-		logic_hash = "9d320eed18a5d76a87cee4ea0fa9caf08f096f7eeaab55420540aa082b596e0f"
+		logic_hash = "v1_sha256_9d320eed18a5d76a87cee4ea0fa9caf08f096f7eeaab55420540aa082b596e0f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316905,10 +314559,10 @@ rule SIGNATURE_BASE_Webshell_Ayyildiz_Tim___AYT__Shell_V_2_1_Biz
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6403-L6417"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6403-L6417"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5fe8c1d01dc5bc70372a8a04410faf8fcde3cb68"
-		logic_hash = "2d096baad162c0e3e01732007a3be2804155e614a8fa4cd2d5dd3a7ac808fb49"
+		logic_hash = "v1_sha256_2d096baad162c0e3e01732007a3be2804155e614a8fa4cd2d5dd3a7ac808fb49"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316932,10 +314586,10 @@ rule SIGNATURE_BASE_Webshell_Gamma_Web_Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6418-L6432"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6418-L6432"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
-		logic_hash = "1de868c4948a95272d288aeba3ac38b84bf6b33ede6b3b600b32530c85586404"
+		logic_hash = "v1_sha256_1de868c4948a95272d288aeba3ac38b84bf6b33ede6b3b600b32530c85586404"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316959,10 +314613,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Aspydrv
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6433-L6448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6433-L6448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3d8996b625025dc549d73cdb3e5fa678ab35d32a"
-		logic_hash = "314fd671b163b9904cc78cb3a5858f5b1e3dfae9d520d5ebc545a7abd922e9f7"
+		logic_hash = "v1_sha256_314fd671b163b9904cc78cb3a5858f5b1e3dfae9d520d5ebc545a7abd922e9f7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -316987,10 +314641,10 @@ rule SIGNATURE_BASE_Webshell_Jspwebshell_1_2_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6449-L6464"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6449-L6464"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "184fc72b51d1429c44a4c8de43081e00967cf86b"
-		logic_hash = "41d937fce969a850a2e4e07eb168becc96a036317a78d620e812707be9466dfc"
+		logic_hash = "v1_sha256_41d937fce969a850a2e4e07eb168becc96a036317a78d620e812707be9466dfc"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317015,10 +314669,10 @@ rule SIGNATURE_BASE_Webshell_G00Nshell_V1_3
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6465-L6480"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6465-L6480"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "70fe072e120249c9e2f0a8e9019f984aea84a504"
-		logic_hash = "2ecb3ce2aa43a99552fb26e610c35bdb04f4ff0dc75c867e4327d6e27eed0177"
+		logic_hash = "v1_sha256_2ecb3ce2aa43a99552fb26e610c35bdb04f4ff0dc75c867e4327d6e27eed0177"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317044,10 +314698,10 @@ rule SIGNATURE_BASE_Webshell_Winx_Shell_2
 		modified = "2023-12-05"
 		old_rule_name = "WebShell_WinX_Shell"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6481-L6497"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6481-L6497"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a94d65c168344ad9fa406d219bdf60150c02010e"
-		logic_hash = "f953c297763e41d197ce186dc818b656951dfa8c855c5063fc4abb54eeefc7bb"
+		logic_hash = "v1_sha256_f953c297763e41d197ce186dc818b656951dfa8c855c5063fc4abb54eeefc7bb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317072,10 +314726,10 @@ rule SIGNATURE_BASE_Webshell_PHANTASMA
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6498-L6512"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6498-L6512"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cd12d42abf854cd34ff9e93a80d464620af6d75e"
-		logic_hash = "355be62807182f9a53bac20a6dead8f0a3bee83b6bdc4566502c157f16076b9b"
+		logic_hash = "v1_sha256_355be62807182f9a53bac20a6dead8f0a3bee83b6bdc4566502c157f16076b9b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317099,10 +314753,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Cw
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6513-L6529"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6513-L6529"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e65e0670ef6edf0a3581be6fe5ddeeffd22014bf"
-		logic_hash = "52bfb14f4d5d3df787ce7782cbbee25ea1556758eed48e3001c8a3f35a541526"
+		logic_hash = "v1_sha256_52bfb14f4d5d3df787ce7782cbbee25ea1556758eed48e3001c8a3f35a541526"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317128,10 +314782,10 @@ rule SIGNATURE_BASE_Webshell_Php_Include_W_Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6530-L6543"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6530-L6543"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1a7f4868691410830ad954360950e37c582b0292"
-		logic_hash = "2be144060d4fdaee38214dc2eba80c2a6fd3699060d274e66356fd5a08c9be4b"
+		logic_hash = "v1_sha256_2be144060d4fdaee38214dc2eba80c2a6fd3699060d274e66356fd5a08c9be4b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317154,10 +314808,10 @@ rule SIGNATURE_BASE_Webshell_Mysql_Tool
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6544-L6556"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6544-L6556"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c9cf8cafcd4e65d1b57fdee5eef98f0f2de74474"
-		logic_hash = "611636b3fa9a3163574b18cf8eacebea9733a1ad381261387f79a532b003e8fd"
+		logic_hash = "v1_sha256_611636b3fa9a3163574b18cf8eacebea9733a1ad381261387f79a532b003e8fd"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317179,10 +314833,10 @@ rule SIGNATURE_BASE_Webshell_Phpspy_Ver_2006
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6557-L6571"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6557-L6571"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "34a89e0ab896c3518d9a474b71ee636ca595625d"
-		logic_hash = "69bd2c387b0e676168116f3b3c3c081e08fd555cc6bc9a94b9c8ef97f194b09f"
+		logic_hash = "v1_sha256_69bd2c387b0e676168116f3b3c3c081e08fd555cc6bc9a94b9c8ef97f194b09f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317206,10 +314860,10 @@ rule SIGNATURE_BASE_Webshell_Zyklonshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6572-L6586"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6572-L6586"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3fa7e6f3566427196ac47551392e2386a038d61c"
-		logic_hash = "5d49f2599781836156f6bbb0c50cfcffdb2ca51c7cb688abbc6245d7f856ad01"
+		logic_hash = "v1_sha256_5d49f2599781836156f6bbb0c50cfcffdb2ca51c7cb688abbc6245d7f856ad01"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317234,10 +314888,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Myshell_2
 		modified = "2023-12-05"
 		old_rule_name = "WebShell_php_webshells_myshell"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6587-L6602"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6587-L6602"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5bd52749872d1083e7be076a5e65ffcde210e524"
-		logic_hash = "7765e43189d6ec0cda0b58d00cfd7fc8cec89287dbac7487083b6ce1ce55f306"
+		logic_hash = "v1_sha256_7765e43189d6ec0cda0b58d00cfd7fc8cec89287dbac7487083b6ce1ce55f306"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317261,10 +314915,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Lolipop
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6603-L6616"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6603-L6616"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "86f23baabb90c93465e6851e40104ded5a5164cb"
-		logic_hash = "8b0dcf76a244f80d4bee0c62189df55c1f8d71cf0900cd8ebb5916f5fe972bed"
+		logic_hash = "v1_sha256_8b0dcf76a244f80d4bee0c62189df55c1f8d71cf0900cd8ebb5916f5fe972bed"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317287,10 +314941,10 @@ rule SIGNATURE_BASE_Webshell_Simple_Cmd
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6617-L6631"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6617-L6631"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "466a8caf03cdebe07aa16ad490e54744f82e32c2"
-		logic_hash = "82a65f4bbdcd2fc626aa9f36fe530d19aa19a48389e970c26e525597818914ee"
+		logic_hash = "v1_sha256_82a65f4bbdcd2fc626aa9f36fe530d19aa19a48389e970c26e525597818914ee"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317314,10 +314968,10 @@ rule SIGNATURE_BASE_Webshell_Go_Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6632-L6647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6632-L6647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3dd85981bec33de42c04c53d081c230b5fc0e94f"
-		logic_hash = "f2fcefb9a0536c80fa74ceb002e113f95de53d1f56e22c81b542c395dd11071d"
+		logic_hash = "v1_sha256_f2fcefb9a0536c80fa74ceb002e113f95de53d1f56e22c81b542c395dd11071d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317343,10 +314997,10 @@ rule SIGNATURE_BASE_Webshell_Azrailphp_V1_0_2
 		modified = "2023-12-05"
 		old_rule_name = "WebShell_aZRaiLPhp_v1_0"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6648-L6663"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6648-L6663"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a2c609d1a8c8ba3d706d1d70bef69e63f239782b"
-		logic_hash = "8309338bb327cc14ae5970bd921b3dba68353d55be31b9dbbc5374ded24ed563"
+		logic_hash = "v1_sha256_8309338bb327cc14ae5970bd921b3dba68353d55be31b9dbbc5374ded24ed563"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317370,10 +315024,10 @@ rule SIGNATURE_BASE_Webshell_Webshells_Zehir4
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6664-L6677"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6664-L6677"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "788928ae87551f286d189e163e55410acbb90a64"
-		logic_hash = "36b6940ffecd9be190cce62252ec7d87f1c0bc0d19b4442df63f4404eb316364"
+		logic_hash = "v1_sha256_36b6940ffecd9be190cce62252ec7d87f1c0bc0d19b4442df63f4404eb316364"
 		score = 55
 		quality = 85
 		tags = ""
@@ -317395,10 +315049,10 @@ rule SIGNATURE_BASE_Webshell_Zehir4_Asp_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6678-L6691"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6678-L6691"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1d9b78b5b14b821139541cc0deb4cbbd994ce157"
-		logic_hash = "dfaf685ac3b364143bfbe289b05f066b09f01622fec3e9157f4b4791f7567619"
+		logic_hash = "v1_sha256_dfaf685ac3b364143bfbe289b05f066b09f01622fec3e9157f4b4791f7567619"
 		score = 75
 		quality = 60
 		tags = ""
@@ -317421,10 +315075,10 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Lostdc
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6692-L6707"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6692-L6707"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d54fe07ea53a8929620c50e3a3f8fb69fdeb1cde"
-		logic_hash = "e3cd28f4a72f5a8a92c728fe76a7159c28256e87daf4c1dd10190a57263f5b45"
+		logic_hash = "v1_sha256_e3cd28f4a72f5a8a92c728fe76a7159c28256e87daf4c1dd10190a57263f5b45"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317449,10 +315103,10 @@ rule SIGNATURE_BASE_Webshell_Casus_1_5
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6708-L6721"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6708-L6721"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7eee8882ad9b940407acc0146db018c302696341"
-		logic_hash = "0dbaa39bd33047d24e5bc9716108c5581da3f54e93d90f9c550b3d84de1ebfe2"
+		logic_hash = "v1_sha256_0dbaa39bd33047d24e5bc9716108c5581da3f54e93d90f9c550b3d84de1ebfe2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317475,10 +315129,10 @@ rule SIGNATURE_BASE_Webshell_Ftpsearch
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6722-L6736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6722-L6736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c945f597552ccb8c0309ad6d2831c8cabdf4e2d6"
-		logic_hash = "6b32553be4fdf26776e3cbb8a5d4d011d88f2bd50949b65934df72b89065aeec"
+		logic_hash = "v1_sha256_6b32553be4fdf26776e3cbb8a5d4d011d88f2bd50949b65934df72b89065aeec"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317502,9 +315156,9 @@ rule SIGNATURE_BASE_Webshell__Cyber_Shell_Cybershell_Cyber_Shell__V_1_0_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6737-L6754"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fc2cf9a25ccc5aa3d9dc287ef9600b065ba9025cfb0a1ccca1bce9120ea03ff4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6737-L6754"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fc2cf9a25ccc5aa3d9dc287ef9600b065ba9025cfb0a1ccca1bce9120ea03ff4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317532,9 +315186,9 @@ rule SIGNATURE_BASE_Webshell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_Sold
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6755-L6775"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0b9e0d96c8a618a4883235e8c5c9a03a1e0b586cb4b30e0273e24c35ee5ee502"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6755-L6775"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0b9e0d96c8a618a4883235e8c5c9a03a1e0b586cb4b30e0273e24c35ee5ee502"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317565,9 +315219,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_7
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6776-L6794"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9d9b6b1333f2061c357fad110b5cc508288c70aea1212aa2fcbf283a2ce4fb2c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6776-L6794"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9d9b6b1333f2061c357fad110b5cc508288c70aea1212aa2fcbf283a2ce4fb2c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317596,9 +315250,9 @@ rule SIGNATURE_BASE_Webshell__Small_Web_Shell_By_Zaco_Small_Zaco_Zacosmall
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6795-L6813"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "840c58043e39014e90e7621c1d2417d5a970c744560738abc4fea3db3cbb8d5a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6795-L6813"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_840c58043e39014e90e7621c1d2417d5a970c744560738abc4fea3db3cbb8d5a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317627,9 +315281,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_8
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6814-L6833"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "346df2686c4d43b3210b07a30845477e057602500e67baba69b50c41e8d501fa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6814-L6833"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_346df2686c4d43b3210b07a30845477e057602500e67baba69b50c41e8d501fa"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317659,9 +315313,9 @@ rule SIGNATURE_BASE_Webshell__PH_Vayv_Phvayv_PH_Vayv_Klasvayv_Asp_Php
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6834-L6852"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "42959ba1e3c0f7f198f953e98b9df87059999f5526df4338c109828d0a5a518a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6834-L6852"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_42959ba1e3c0f7f198f953e98b9df87059999f5526df4338c109828d0a5a518a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317690,9 +315344,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_9
 		date = "2014-04-06"
 		modified = "2022-12-06"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6854-L6874"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9f8768f609ccd464f7c2b9d10ce8ea423355e11b05b39e629e5e3de0787e212b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6854-L6874"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9f8768f609ccd464f7c2b9d10ce8ea423355e11b05b39e629e5e3de0787e212b"
 		score = 70
 		quality = 77
 		tags = ""
@@ -317719,9 +315373,9 @@ rule SIGNATURE_BASE_Webshell__PH_Vayv_Phvayv_PH_Vayv
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6876-L6892"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b2f2b95415bc990adac38eada20cbc793f286d51f2054bc969e9c667f16717f9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6876-L6892"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b2f2b95415bc990adac38eada20cbc793f286d51f2054bc969e9c667f16717f9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317748,9 +315402,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_1
 		date = "2014-04-06"
 		modified = "2022-12-06"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6894-L6913"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9e3759d45d13e33481b962c4b59a019647a3e80bdd3885c4404169af74288b89"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6894-L6913"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9e3759d45d13e33481b962c4b59a019647a3e80bdd3885c4404169af74288b89"
 		score = 70
 		quality = 79
 		tags = ""
@@ -317777,9 +315431,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6915-L6934"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a63d3b00ad9719140da9bb5dcb49981c4d3758fac13c392d016b47e54f356c8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6915-L6934"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a63d3b00ad9719140da9bb5dcb49981c4d3758fac13c392d016b47e54f356c8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317809,9 +315463,9 @@ rule SIGNATURE_BASE_Webshell__Crystalshell_V_1_Erne_Stres
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6935-L6956"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a0484a5a71715d6a79c89e20919ab89aaa7e85a18ee502651f1f6b29153847a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6935-L6956"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a0484a5a71715d6a79c89e20919ab89aaa7e85a18ee502651f1f6b29153847a3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317843,9 +315497,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_3
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6957-L6976"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5c264a294fc75cf2cadd3dba61bc64658989ffe5ddecfa18ba18e66492ad3c71"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6957-L6976"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5c264a294fc75cf2cadd3dba61bc64658989ffe5ddecfa18ba18e66492ad3c71"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317875,9 +315529,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_4
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L6977-L6999"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "18db4c6728f0575b4d8388dab9563ee98ca9aa5fdc8534bf76856a87820b4596"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L6977-L6999"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_18db4c6728f0575b4d8388dab9563ee98ca9aa5fdc8534bf76856a87820b4596"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317910,9 +315564,9 @@ rule SIGNATURE_BASE_Webshell_GFS
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7001-L7017"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "72a3f117cb11e1461b760c47a3de74283640b6e1daa87b24e45210213bb76609"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7001-L7017"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_72a3f117cb11e1461b760c47a3de74283640b6e1daa87b24e45210213bb76609"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317939,9 +315593,9 @@ rule SIGNATURE_BASE_Webshell__Crystalshell_V_1_Sosyete_Stres
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7018-L7038"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "78aeabe38f7457060d81c3863098b5e424bc38f13e9e86bbb6ea54827f27afcd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7018-L7038"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_78aeabe38f7457060d81c3863098b5e424bc38f13e9e86bbb6ea54827f27afcd"
 		score = 75
 		quality = 85
 		tags = ""
@@ -317972,9 +315626,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_10
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7039-L7059"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bf731edef55cde5d2ad16510fb9f1a240c1a06b535af7e13300fdbea470df74"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7039-L7059"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bf731edef55cde5d2ad16510fb9f1a240c1a06b535af7e13300fdbea470df74"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318005,9 +315659,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_11
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7060-L7082"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5a559a26314ce603d6454efb71f1243bf89daed920ca2a495a51b94a4cca0045"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7060-L7082"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5a559a26314ce603d6454efb71f1243bf89daed920ca2a495a51b94a4cca0045"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318040,9 +315694,9 @@ rule SIGNATURE_BASE_Webshell__Findsock_Php_Findsock_Shell_Php_Reverse_Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7083-L7097"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2459f7114482e17f087bda4b638c29e237f2f3cb5a9e41e326ed65fc1834b6be"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7083-L7097"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2459f7114482e17f087bda4b638c29e237f2f3cb5a9e41e326ed65fc1834b6be"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318067,9 +315721,9 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_6
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7098-L7119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7b3f2ca3cb9516ddda1b9cac2ca5eb5d9e62e1839dad041f69a3dc7a2a186897"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7098-L7119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7b3f2ca3cb9516ddda1b9cac2ca5eb5d9e62e1839dad041f69a3dc7a2a186897"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318101,10 +315755,10 @@ rule SIGNATURE_BASE_Unpack_Injectt
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7121-L7134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7121-L7134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8a5d2158a566c87edc999771e12d42c5"
-		logic_hash = "d8e9ed4f2604617bd6410f36ab827affa3cc6729ba996d0d9cd9c8eb0fd96533"
+		logic_hash = "v1_sha256_d8e9ed4f2604617bd6410f36ab827affa3cc6729ba996d0d9cd9c8eb0fd96533"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318127,10 +315781,10 @@ rule SIGNATURE_BASE_Hytop_Devpack_Fso
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7135-L7147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7135-L7147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b37f3cde1a08890bd822a182c3a881f6"
-		logic_hash = "9d071c1e2e0725091a2abe24759e6e71d78e29caa76b4fff77c44e3bb381b1a2"
+		logic_hash = "v1_sha256_9d071c1e2e0725091a2abe24759e6e71d78e29caa76b4fff77c44e3bb381b1a2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318152,10 +315806,10 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Ssh
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7148-L7159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7148-L7159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1aa5307790d72941589079989b4f900e"
-		logic_hash = "40c5a5d1d714947454f4aa9f7ed09d777cb60c23933201ac8eaf0d49452af8c6"
+		logic_hash = "v1_sha256_40c5a5d1d714947454f4aa9f7ed09d777cb60c23933201ac8eaf0d49452af8c6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318176,10 +315830,10 @@ rule SIGNATURE_BASE_Debug_Bdoor
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7160-L7172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7160-L7172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e4e8e31dd44beb9320922c5f49739955"
-		logic_hash = "ed8caeb96a6fc48fe23d5db078bbb8ba5aec3c5d4ee382cbc6bc4e01630f1460"
+		logic_hash = "v1_sha256_ed8caeb96a6fc48fe23d5db078bbb8ba5aec3c5d4ee382cbc6bc4e01630f1460"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318201,10 +315855,10 @@ rule SIGNATURE_BASE_Bin_Client
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7173-L7187"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7173-L7187"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5f91a5b46d155cacf0cc6673a2a5461b"
-		logic_hash = "28ce9aa136b5d41bb580e6b5b8580d3ccbb7eeec31007e68241d23c5a0f40d40"
+		logic_hash = "v1_sha256_28ce9aa136b5d41bb580e6b5b8580d3ccbb7eeec31007e68241d23c5a0f40d40"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318228,10 +315882,10 @@ rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Zxshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7188-L7200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7188-L7200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "246ce44502d2f6002d720d350e26c288"
-		logic_hash = "72eaf90551144eccb7329e0a0e05bcc955ea2bfdb37aa87e9cae7b5f5a26bea0"
+		logic_hash = "v1_sha256_72eaf90551144eccb7329e0a0e05bcc955ea2bfdb37aa87e9cae7b5f5a26bea0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318253,10 +315907,10 @@ rule SIGNATURE_BASE_Rkntload
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7201-L7219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7201-L7219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "262317c95ced56224f136ba532b8b34f"
-		logic_hash = "ab767a7016318633055a85195ca2bab08a8c68222d46018aaf8772ab27a373c4"
+		logic_hash = "v1_sha256_ab767a7016318633055a85195ca2bab08a8c68222d46018aaf8772ab27a373c4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318284,10 +315938,10 @@ rule SIGNATURE_BASE_Binder2_Binder2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7220-L7236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7220-L7236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d594e90ad23ae0bc0b65b59189c12f11"
-		logic_hash = "fbe56b7d37fc7863fcf55761c0b5b671d661a713ac95f90d65b79eee9a447a9b"
+		logic_hash = "v1_sha256_fbe56b7d37fc7863fcf55761c0b5b671d661a713ac95f90d65b79eee9a447a9b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318313,10 +315967,10 @@ rule SIGNATURE_BASE_Thelast_Orice2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7237-L7249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7237-L7249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aa63ffb27bde8d03d00dda04421237ae"
-		logic_hash = "075f3377a9b90c6c1ba74682415b9c0832a839afe647fa6d3c85d4e987618405"
+		logic_hash = "v1_sha256_075f3377a9b90c6c1ba74682415b9c0832a839afe647fa6d3c85d4e987618405"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318338,10 +315992,10 @@ rule SIGNATURE_BASE_FSO_S_Sincap
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7250-L7262"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7250-L7262"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dc5c2c2392b84a1529abd92e98e9aa5b"
-		logic_hash = "705030e93248f5ea6744f78bd7a1816aaa9772880059286b8d686e05b193d4a0"
+		logic_hash = "v1_sha256_705030e93248f5ea6744f78bd7a1816aaa9772880059286b8d686e05b193d4a0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318363,10 +316017,10 @@ rule SIGNATURE_BASE_Phpshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7263-L7274"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7263-L7274"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "539baa0d39a9cf3c64d65ee7a8738620"
-		logic_hash = "95b3cedac370bf9b06092035a738722f3ec97e6cbafe3d4f742429a865576ad8"
+		logic_hash = "v1_sha256_95b3cedac370bf9b06092035a738722f3ec97e6cbafe3d4f742429a865576ad8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318387,10 +316041,10 @@ rule SIGNATURE_BASE_Hytop_Devpack_Config
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7275-L7288"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7275-L7288"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b41d0e64e64a685178a3155195921d61"
-		logic_hash = "b2806c30db413bca518943352f233c9d2915356a41eceed5e352b88ee34fbbd3"
+		logic_hash = "v1_sha256_b2806c30db413bca518943352f233c9d2915356a41eceed5e352b88ee34fbbd3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318413,10 +316067,10 @@ rule SIGNATURE_BASE_Sendmail
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7289-L7301"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7289-L7301"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "75b86f4a21d8adefaf34b3a94629bd17"
-		logic_hash = "bcca9a9380d2695bc277afc9fa72c24cb26ac44c6fbcc87113b017cfe190bdab"
+		logic_hash = "v1_sha256_bcca9a9380d2695bc277afc9fa72c24cb26ac44c6fbcc87113b017cfe190bdab"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318438,10 +316092,10 @@ rule SIGNATURE_BASE_FSO_S_Zehir4
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7302-L7313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7302-L7313"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5b496a61363d304532bcf52ee21f5d55"
-		logic_hash = "6bcfb1ee40403394bf996ecbe1bb17f9afa0c3ba9e1906881b94bbc785b4a510"
+		logic_hash = "v1_sha256_6bcfb1ee40403394bf996ecbe1bb17f9afa0c3ba9e1906881b94bbc785b4a510"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318462,10 +316116,10 @@ rule SIGNATURE_BASE_Hkshell_Hkshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7314-L7327"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7314-L7327"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "168cab58cee59dc4706b3be988312580"
-		logic_hash = "bee4d4c957ede41c771d690d52ac2fd3655238cc1fc106d30fb2721084b38aa1"
+		logic_hash = "v1_sha256_bee4d4c957ede41c771d690d52ac2fd3655238cc1fc106d30fb2721084b38aa1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318488,10 +316142,10 @@ rule SIGNATURE_BASE_Imhapftp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7328-L7339"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7328-L7339"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "12911b73bc6a5d313b494102abcf5c57"
-		logic_hash = "c24bb80a0ae4284b4303450e9103c5dda30c41b41f323641ac1175461f741ced"
+		logic_hash = "v1_sha256_c24bb80a0ae4284b4303450e9103c5dda30c41b41f323641ac1175461f741ced"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318512,10 +316166,10 @@ rule SIGNATURE_BASE_Unpack_Tback
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7340-L7351"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7340-L7351"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a9d1007823bf96fb163ab38726b48464"
-		logic_hash = "0fb43766c305f4235cc0987f411fdc3b3674723687f0b63d346429f4a7b5b87f"
+		logic_hash = "v1_sha256_0fb43766c305f4235cc0987f411fdc3b3674723687f0b63d346429f4a7b5b87f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318536,10 +316190,10 @@ rule SIGNATURE_BASE_Darkspy105
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7352-L7363"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7352-L7363"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f0b85e7bec90dba829a3ede1ab7d8722"
-		logic_hash = "0f1c9dba4525f9c30f309500652ed6af647ddf492f483e101fc23c891e15fc85"
+		logic_hash = "v1_sha256_0f1c9dba4525f9c30f309500652ed6af647ddf492f483e101fc23c891e15fc85"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318560,10 +316214,10 @@ rule SIGNATURE_BASE_Editserver_EXE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7364-L7377"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7364-L7377"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f945de25e0eba3bdaf1455b3a62b9832"
-		logic_hash = "d440669b0c0bf575cf9dea946edf55f724300a4c765e90c631fc1eee062bf006"
+		logic_hash = "v1_sha256_d440669b0c0bf575cf9dea946edf55f724300a4c765e90c631fc1eee062bf006"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318586,10 +316240,10 @@ rule SIGNATURE_BASE_FSO_S_Reader
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7378-L7389"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7378-L7389"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
-		logic_hash = "89a948f8da66173965884cd525615c8eeb91cf98a4984c05be7472034bb72f76"
+		logic_hash = "v1_sha256_89a948f8da66173965884cd525615c8eeb91cf98a4984c05be7472034bb72f76"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318610,10 +316264,10 @@ rule SIGNATURE_BASE_ASP_Cmdasp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7390-L7403"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7390-L7403"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "79d4f3425f7a89befb0ef3bafe5e332f"
-		logic_hash = "84c3148fe74b1afaa6e3bbff0aca8df1f1775759a36a673cc13d35ef7658929c"
+		logic_hash = "v1_sha256_84c3148fe74b1afaa6e3bbff0aca8df1f1775759a36a673cc13d35ef7658929c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318636,10 +316290,10 @@ rule SIGNATURE_BASE_KA_Ushell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7404-L7416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7404-L7416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "685f5d4f7f6751eaefc2695071569aab"
-		logic_hash = "58d25e19e2e14a909b4b623a85dfd8c62974121d3b23574d1e94b62385e42b45"
+		logic_hash = "v1_sha256_58d25e19e2e14a909b4b623a85dfd8c62974121d3b23574d1e94b62385e42b45"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318661,10 +316315,10 @@ rule SIGNATURE_BASE_PHP_Backdoor_V1
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7417-L7430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7417-L7430"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0506ba90759d11d78befd21cabf41f3d"
-		logic_hash = "396ae1ee34a06ab4863f4f54257a9020b8747fb99dff15372f0aa54fa4598e43"
+		logic_hash = "v1_sha256_396ae1ee34a06ab4863f4f54257a9020b8747fb99dff15372f0aa54fa4598e43"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318686,10 +316340,10 @@ rule SIGNATURE_BASE_Svchostdll
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7431-L7450"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7431-L7450"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0f6756c8cb0b454c452055f189e4c3f4"
-		logic_hash = "4a7a7bb7d827c2e7801f8c33b292bb3d312428fc4ae79f07e103f456984c3b83"
+		logic_hash = "v1_sha256_4a7a7bb7d827c2e7801f8c33b292bb3d312428fc4ae79f07e103f456984c3b83"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318718,10 +316372,10 @@ rule SIGNATURE_BASE_Hytop_Devpack_Server
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7451-L7462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7451-L7462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1d38526a215df13c7373da4635541b43"
-		logic_hash = "66b8513a532f64af535c948da28674795ae6495b9844165c3b039bf61c25eb46"
+		logic_hash = "v1_sha256_66b8513a532f64af535c948da28674795ae6495b9844165c3b039bf61c25eb46"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318742,10 +316396,10 @@ rule SIGNATURE_BASE_Vanquish
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7463-L7476"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7463-L7476"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "684450adde37a93e8bb362994efc898c"
-		logic_hash = "223c59d06a9389f380fa29959c54e53a17b53080f704189ae519b9527b2c6384"
+		logic_hash = "v1_sha256_223c59d06a9389f380fa29959c54e53a17b53080f704189ae519b9527b2c6384"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318768,10 +316422,10 @@ rule SIGNATURE_BASE_Winshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7477-L7496"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7477-L7496"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3144410a37dd4c29d004a814a294ea26"
-		logic_hash = "addbfa598039af09c0e4c50138fcfabd16c35c5516259cf9595cf49855da518d"
+		logic_hash = "v1_sha256_addbfa598039af09c0e4c50138fcfabd16c35c5516259cf9595cf49855da518d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318800,10 +316454,10 @@ rule SIGNATURE_BASE_FSO_S_Remview
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7497-L7510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7497-L7510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b4a09911a5b23e00b55abe546ded691c"
-		logic_hash = "19719e8c9215ec9ba9fab55b604907e0a6d0a0507a5662926acff1e9dc03440e"
+		logic_hash = "v1_sha256_19719e8c9215ec9ba9fab55b604907e0a6d0a0507a5662926acff1e9dc03440e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318826,10 +316480,10 @@ rule SIGNATURE_BASE_Saphpshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7511-L7522"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7511-L7522"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d7bba8def713512ddda14baf9cd6889a"
-		logic_hash = "24d558292a709bb29334b1acdc53cdb6c5bc6803caec527edcacd6a19f6dc7c9"
+		logic_hash = "v1_sha256_24d558292a709bb29334b1acdc53cdb6c5bc6803caec527edcacd6a19f6dc7c9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318850,10 +316504,10 @@ rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006Z
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7523-L7535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7523-L7535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fd1b6129abd4ab177fed135e3b665488"
-		logic_hash = "4b427132541cd26ee47c387a98f6f46f86808f9a775068e1d114c9ef4abca9f6"
+		logic_hash = "v1_sha256_4b427132541cd26ee47c387a98f6f46f86808f9a775068e1d114c9ef4abca9f6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318875,10 +316529,10 @@ rule SIGNATURE_BASE_Admin_Ad
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7536-L7548"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7536-L7548"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
-		logic_hash = "0febd10979a959af73332a8e064a510e949109abf863b5fd0fef19b635968d1d"
+		logic_hash = "v1_sha256_0febd10979a959af73332a8e064a510e949109abf863b5fd0fef19b635968d1d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318900,10 +316554,10 @@ rule SIGNATURE_BASE_FSO_S_Casus15
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7549-L7560"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7549-L7560"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8d155b4239d922367af5d0a1b89533a3"
-		logic_hash = "58921290952f23ff5b828d8c92c818ebd91b726cdbbc9137b0f55a0e5ca90636"
+		logic_hash = "v1_sha256_58921290952f23ff5b828d8c92c818ebd91b726cdbbc9137b0f55a0e5ca90636"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318924,10 +316578,10 @@ rule SIGNATURE_BASE_BIN_Client
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7561-L7577"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7561-L7577"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
-		logic_hash = "e1277f6b7adc2e832a3aad96c7e44796596d2e61eb9247977da3c3569777e0b2"
+		logic_hash = "v1_sha256_e1277f6b7adc2e832a3aad96c7e44796596d2e61eb9247977da3c3569777e0b2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318953,10 +316607,10 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Uptime
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7578-L7593"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7578-L7593"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
-		logic_hash = "5d91dda859a63a965250bd4d76565c6adf18e4ee306be3b91965e5d35bc521e8"
+		logic_hash = "v1_sha256_5d91dda859a63a965250bd4d76565c6adf18e4ee306be3b91965e5d35bc521e8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -318981,10 +316635,10 @@ rule SIGNATURE_BASE_Simple_PHP_Backdoor
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7594-L7607"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7594-L7607"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a401132363eecc3a1040774bec9cb24f"
-		logic_hash = "9739217c23f583452fbf1d7a8e20b2f1379ebf430e0a4fd73ad62e88d544670a"
+		logic_hash = "v1_sha256_9739217c23f583452fbf1d7a8e20b2f1379ebf430e0a4fd73ad62e88d544670a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319007,10 +316661,10 @@ rule SIGNATURE_BASE_Sig_2005Gray
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7608-L7622"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7608-L7622"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "75dbe3d3b70a5678225d3e2d78b604cc"
-		logic_hash = "927ed5cdaa14b6cd63a6ca7d7bec6635b69fa19d88808890e7d198fb7a0b57b4"
+		logic_hash = "v1_sha256_927ed5cdaa14b6cd63a6ca7d7bec6635b69fa19d88808890e7d198fb7a0b57b4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319034,10 +316688,10 @@ rule SIGNATURE_BASE_Dllinjection
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7623-L7634"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7623-L7634"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a7b92283a5102886ab8aee2bc5c8d718"
-		logic_hash = "6e01ae1cc8a91a5e0d22bdf477aa72bf0116dbe31752a069b1e34d8a09ec6213"
+		logic_hash = "v1_sha256_6e01ae1cc8a91a5e0d22bdf477aa72bf0116dbe31752a069b1e34d8a09ec6213"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319058,10 +316712,10 @@ rule SIGNATURE_BASE_Mithril_V1_45_Mithril
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7635-L7647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7635-L7647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f1484f882dc381dde6eaa0b80ef64a07"
-		logic_hash = "a3e74bfb34762553eccaddd745d9e17dc3a5a25201e4bc9e2ea9a49342295c78"
+		logic_hash = "v1_sha256_a3e74bfb34762553eccaddd745d9e17dc3a5a25201e4bc9e2ea9a49342295c78"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319083,10 +316737,10 @@ rule SIGNATURE_BASE_Hkshell_Hkrmv
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7648-L7660"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7648-L7660"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
-		logic_hash = "f1da0778456272e6d93633a564018bdf0fa74f1db1c9e963a03a59c69c752b6e"
+		logic_hash = "v1_sha256_f1da0778456272e6d93633a564018bdf0fa74f1db1c9e963a03a59c69c752b6e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319109,10 +316763,10 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_1
 		modified = "2023-12-05"
 		old_rule_name = "phpshell"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7661-L7675"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7661-L7675"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1dccb1ea9f24ffbd085571c88585517b"
-		logic_hash = "eed450ae6668bbee01ea2689e9864f10a66714ec4c91afabb12609ad4ebdac8c"
+		logic_hash = "v1_sha256_eed450ae6668bbee01ea2689e9864f10a66714ec4c91afabb12609ad4ebdac8c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319135,10 +316789,10 @@ rule SIGNATURE_BASE_FSO_S_Cmd
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7676-L7688"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7676-L7688"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cbe8e365d41dd3cd8e462ca434cf385f"
-		logic_hash = "43f3379a57210f0e3b70575313115a7ba3d71359de7c5ac9a6a178b93af3545e"
+		logic_hash = "v1_sha256_43f3379a57210f0e3b70575313115a7ba3d71359de7c5ac9a6a178b93af3545e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319160,10 +316814,10 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Phpft
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7689-L7701"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7689-L7701"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "60ef80175fcc6a879ca57c54226646b1"
-		logic_hash = "741536acafdc4da618d69bdae2f0a3e8c004a4027cc76c796158ee111c006414"
+		logic_hash = "v1_sha256_741536acafdc4da618d69bdae2f0a3e8c004a4027cc76c796158ee111c006414"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319185,10 +316839,10 @@ rule SIGNATURE_BASE_FSO_S_Indexer
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7702-L7713"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7702-L7713"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "135fc50f85228691b401848caef3be9e"
-		logic_hash = "a1bfba9c24819f5c1574aa179d853a6cc2fcf58c7b9a14eeab2639248178549c"
+		logic_hash = "v1_sha256_a1bfba9c24819f5c1574aa179d853a6cc2fcf58c7b9a14eeab2639248178549c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319209,10 +316863,10 @@ rule SIGNATURE_BASE_R57Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7714-L7725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7714-L7725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8023394542cddf8aee5dec6072ed02b5"
-		logic_hash = "40ff6bceb3f9bd95fbf5e75681fadadaa64243007e10fcc86bb909282b8161c5"
+		logic_hash = "v1_sha256_40ff6bceb3f9bd95fbf5e75681fadadaa64243007e10fcc86bb909282b8161c5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319233,10 +316887,10 @@ rule SIGNATURE_BASE_Bdcli100
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7726-L7738"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7726-L7738"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b12163ac53789fb4f62e4f17a8c2e028"
-		logic_hash = "48c70413c71d5a84f8cea48c77935b7cc26d9e1348d7ab257de4540d69f0f817"
+		logic_hash = "v1_sha256_48c70413c71d5a84f8cea48c77935b7cc26d9e1348d7ab257de4540d69f0f817"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319258,10 +316912,10 @@ rule SIGNATURE_BASE_Hytop_Devpack_2005Red
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7739-L7752"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7739-L7752"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
-		logic_hash = "716b6faa8d1216f592d63b658cdd65d7be0226bf746b5fdf1827bdf881562711"
+		logic_hash = "v1_sha256_716b6faa8d1216f592d63b658cdd65d7be0226bf746b5fdf1827bdf881562711"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319284,10 +316938,10 @@ rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006X2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7753-L7765"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7753-L7765"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cc5bf9fc56d404ebbc492855393d7620"
-		logic_hash = "0df587ccaf41d11c6be90ef631ce8b21f95f08fa8f71e62463c378455b312f4a"
+		logic_hash = "v1_sha256_0df587ccaf41d11c6be90ef631ce8b21f95f08fa8f71e62463c378455b312f4a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319309,10 +316963,10 @@ rule SIGNATURE_BASE_Rdrbs084
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7766-L7778"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7766-L7778"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ed30327b255816bdd7590bf891aa0020"
-		logic_hash = "8a743d62723c4a5f863f986edd4b149728680b40d6a4b9a99b093d62ccb70cf8"
+		logic_hash = "v1_sha256_8a743d62723c4a5f863f986edd4b149728680b40d6a4b9a99b093d62ccb70cf8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319334,10 +316988,10 @@ rule SIGNATURE_BASE_Hytop_Caseswitch_2005
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7779-L7797"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7779-L7797"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8bf667ee9e21366bc0bd3491cb614f41"
-		logic_hash = "0ecf28b5abb918cd1d8f38b76019dddf19dff5dbb114f16ef6ec9b46cb590a46"
+		logic_hash = "v1_sha256_0ecf28b5abb918cd1d8f38b76019dddf19dff5dbb114f16ef6ec9b46cb590a46"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319365,10 +317019,10 @@ rule SIGNATURE_BASE_Ebayid_Index3
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7798-L7809"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7798-L7809"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0412b1e37f41ea0d002e4ed11608905f"
-		logic_hash = "47660cb71d6787683e51aa14fc0f4a9d6f1c59517b77bfe4135098a0020ded11"
+		logic_hash = "v1_sha256_47660cb71d6787683e51aa14fc0f4a9d6f1c59517b77bfe4135098a0020ded11"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319389,10 +317043,10 @@ rule SIGNATURE_BASE_FSO_S_Phvayv
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7810-L7821"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7810-L7821"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "205ecda66c443083403efb1e5c7f7878"
-		logic_hash = "d0482607f7d9cf6c89963cb9b1f943fa0b80636e857e0fb044cd9a0b3f974deb"
+		logic_hash = "v1_sha256_d0482607f7d9cf6c89963cb9b1f943fa0b80636e857e0fb044cd9a0b3f974deb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319413,10 +317067,10 @@ rule SIGNATURE_BASE_Byshell063_Ntboot
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7822-L7836"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7822-L7836"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
-		logic_hash = "2fdc930eacb87d02ebe69a2b64df4103bd0f3417a76f1b2922b3d4cd4c0dffe9"
+		logic_hash = "v1_sha256_2fdc930eacb87d02ebe69a2b64df4103bd0f3417a76f1b2922b3d4cd4c0dffe9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319440,10 +317094,10 @@ rule SIGNATURE_BASE_FSO_S_Casus15_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7837-L7848"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7837-L7848"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8d155b4239d922367af5d0a1b89533a3"
-		logic_hash = "45820e0398cca8e75fc4acf6863d962a817afd95a4592acd4ac4a50029684220"
+		logic_hash = "v1_sha256_45820e0398cca8e75fc4acf6863d962a817afd95a4592acd4ac4a50029684220"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319464,10 +317118,10 @@ rule SIGNATURE_BASE_Installer
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7849-L7861"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7849-L7861"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a507919ae701cf7e42fa441d3ad95f8f"
-		logic_hash = "73c1032313155ceb752fe2f94c8d242833127fe0443d7e3044fa1de2b2b7742b"
+		logic_hash = "v1_sha256_73c1032313155ceb752fe2f94c8d242833127fe0443d7e3044fa1de2b2b7742b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319489,10 +317143,10 @@ rule SIGNATURE_BASE_FSO_S_Remview_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7862-L7874"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7862-L7874"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b4a09911a5b23e00b55abe546ded691c"
-		logic_hash = "0a682431f7044e9a49c8dd4842a22c521e2a07d5df045b0a12449e3b3206716b"
+		logic_hash = "v1_sha256_0a682431f7044e9a49c8dd4842a22c521e2a07d5df045b0a12449e3b3206716b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319514,10 +317168,10 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_R57
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7875-L7886"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7875-L7886"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "903908b77a266b855262cdbce81c3f72"
-		logic_hash = "8d0f3b2009594d4aa413c4794dca12e3c66a19974cc6d0b47cc3f5e2572a4c57"
+		logic_hash = "v1_sha256_8d0f3b2009594d4aa413c4794dca12e3c66a19974cc6d0b47cc3f5e2572a4c57"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319538,10 +317192,10 @@ rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006X
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7887-L7899"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7887-L7899"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
-		logic_hash = "b71cf90900c7eae4caef57564292ca497a2c6c77e3de2994ba9e4cecae7f2697"
+		logic_hash = "v1_sha256_b71cf90900c7eae4caef57564292ca497a2c6c77e3de2994ba9e4cecae7f2697"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319563,10 +317217,10 @@ rule SIGNATURE_BASE_FSO_S_Phvayv_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7900-L7911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7900-L7911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "205ecda66c443083403efb1e5c7f7878"
-		logic_hash = "11418a11692412ccb309983bdadd9bda2b27b692c3282eb0386094e76c7ba1e0"
+		logic_hash = "v1_sha256_11418a11692412ccb309983bdadd9bda2b27b692c3282eb0386094e76c7ba1e0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319587,10 +317241,10 @@ rule SIGNATURE_BASE_Elmaliseker
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7912-L7924"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7912-L7924"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ccf48af0c8c09bbd038e610a49c9862e"
-		logic_hash = "54c0b8e74a9b10fe54901c0595600af1dfc54abd3f710fc20ca87ca92236bb49"
+		logic_hash = "v1_sha256_54c0b8e74a9b10fe54901c0595600af1dfc54abd3f710fc20ca87ca92236bb49"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319612,10 +317266,10 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Resolve
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7925-L7942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7925-L7942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "69bf9aa296238610a0e05f99b5540297"
-		logic_hash = "39d8ac274e94f13b5eb197be5827a95ac09df70793bd584c96b81983a565c1ce"
+		logic_hash = "v1_sha256_39d8ac274e94f13b5eb197be5827a95ac09df70793bd584c96b81983a565c1ce"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319642,10 +317296,10 @@ rule SIGNATURE_BASE_FSO_S_Remexp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7943-L7956"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7943-L7956"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b69670ecdbb40012c73686cd22696eeb"
-		logic_hash = "b9b966a89ab097494d7af90775bf124f1310c77145be67fa57ebdacd0164e3d0"
+		logic_hash = "v1_sha256_b9b966a89ab097494d7af90775bf124f1310c77145be67fa57ebdacd0164e3d0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319668,10 +317322,10 @@ rule SIGNATURE_BASE_FSO_S_Tool
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7957-L7968"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7957-L7968"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3a1e1e889fdd974a130a6a767b42655b"
-		logic_hash = "a3449aca3124aa4d920d78e5e674ddd9d8a181b0ce0143032352a69dfdbcad2d"
+		logic_hash = "v1_sha256_a3449aca3124aa4d920d78e5e674ddd9d8a181b0ce0143032352a69dfdbcad2d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319692,10 +317346,10 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_2005
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7969-L7981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7969-L7981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "97f2552c2fafc0b2eb467ee29cc803c8"
-		logic_hash = "4d04174b23c9057acf2618c01cd702eaaec2d3508a8c25dd87fdd320c076a3b1"
+		logic_hash = "v1_sha256_4d04174b23c9057acf2618c01cd702eaaec2d3508a8c25dd87fdd320c076a3b1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319717,10 +317371,10 @@ rule SIGNATURE_BASE_Byloader
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7982-L7997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7982-L7997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0f0d6dc26055653f5844ded906ce52df"
-		logic_hash = "66c900e4bc771fb23d7623e57ad51edaa95696c2e31554720582f3e33a1b2e25"
+		logic_hash = "v1_sha256_66c900e4bc771fb23d7623e57ad51edaa95696c2e31554720582f3e33a1b2e25"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319745,10 +317399,10 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Fport
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L7998-L8010"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L7998-L8010"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dbb75488aa2fa22ba6950aead1ef30d5"
-		logic_hash = "b9dc66e249c0577839cc3748f129c343d2ccb7327b92a2a67e4467782d10a25e"
+		logic_hash = "v1_sha256_b9dc66e249c0577839cc3748f129c343d2ccb7327b92a2a67e4467782d10a25e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319770,10 +317424,10 @@ rule SIGNATURE_BASE_Backdoor__Fr_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8011-L8022"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8011-L8022"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a79cac2cf86e073a832aaf29a664f4be"
-		logic_hash = "6c16c200712015eed71aeb119e46bad5f93445a8f719d98ef31f9012cb3551ae"
+		logic_hash = "v1_sha256_6c16c200712015eed71aeb119e46bad5f93445a8f719d98ef31f9012cb3551ae"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319794,10 +317448,10 @@ rule SIGNATURE_BASE_FSO_S_Ntdaddy
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8023-L8034"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8023-L8034"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
-		logic_hash = "4df6f53ee9bfc0214e69dd858878026e962b90573ed48a5ffdd5523538e8f3bf"
+		logic_hash = "v1_sha256_4df6f53ee9bfc0214e69dd858878026e962b90573ed48a5ffdd5523538e8f3bf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319818,10 +317472,10 @@ rule SIGNATURE_BASE_Nstview_Nstview
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8035-L8046"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8035-L8046"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3871888a0c1ac4270104918231029a56"
-		logic_hash = "2b25e22d86a672af0b8957f1b0336ed80e09f3389f5045c230af2372db0e3415"
+		logic_hash = "v1_sha256_2b25e22d86a672af0b8957f1b0336ed80e09f3389f5045c230af2372db0e3415"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319842,10 +317496,10 @@ rule SIGNATURE_BASE_Hytop_Devpack_Upload
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8047-L8058"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8047-L8058"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b09852bda534627949f0259828c967de"
-		logic_hash = "312020a72a37adb0111ac6d61810c8e476be39dc6456e80e83cd6a680e8ea051"
+		logic_hash = "v1_sha256_312020a72a37adb0111ac6d61810c8e476be39dc6456e80e83cd6a680e8ea051"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319866,10 +317520,10 @@ rule SIGNATURE_BASE_Passwordreminder
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8059-L8070"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8059-L8070"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
-		logic_hash = "f3da5381f5e352c541654d2af918ca8cea8049d137078670dd0538a4d13f676e"
+		logic_hash = "v1_sha256_f3da5381f5e352c541654d2af918ca8cea8049d137078670dd0538a4d13f676e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319890,10 +317544,10 @@ rule SIGNATURE_BASE_Pack_Injectt
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8071-L8086"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8071-L8086"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "983b74ccd57f6195a0584cdfb27d55e8"
-		logic_hash = "9f66b7b429ed585888c0fb4943bb12262247b3af8d85bc67309b27752171e66a"
+		logic_hash = "v1_sha256_9f66b7b429ed585888c0fb4943bb12262247b3af8d85bc67309b27752171e66a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319918,10 +317572,10 @@ rule SIGNATURE_BASE_FSO_S_Remexp_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8087-L8099"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8087-L8099"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b69670ecdbb40012c73686cd22696eeb"
-		logic_hash = "e31e25a7c2b2e970a379a61d2dac335bd37cac48328eee9f3966ff5c77ef6f18"
+		logic_hash = "v1_sha256_e31e25a7c2b2e970a379a61d2dac335bd37cac48328eee9f3966ff5c77ef6f18"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319943,10 +317597,10 @@ rule SIGNATURE_BASE_FSO_S_C99
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8100-L8111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8100-L8111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5f9ba02eb081bba2b2434c603af454d0"
-		logic_hash = "de769299bbd8b895b84db757fcc037b807f7caaa624c06e9d330934a968b2381"
+		logic_hash = "v1_sha256_de769299bbd8b895b84db757fcc037b807f7caaa624c06e9d330934a968b2381"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319967,10 +317621,10 @@ rule SIGNATURE_BASE_Rknt_Zip_Folder_Rknt
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8112-L8129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8112-L8129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5f97386dfde148942b7584aeb6512b85"
-		logic_hash = "59de8a40a7081ee5fbea9f413590237c1da9985f2352b32571529baf38c93ddb"
+		logic_hash = "v1_sha256_59de8a40a7081ee5fbea9f413590237c1da9985f2352b32571529baf38c93ddb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -319997,10 +317651,10 @@ rule SIGNATURE_BASE_Dbgntboot
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8130-L8142"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8130-L8142"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4d87543d4d7f73c1529c9f8066b475ab"
-		logic_hash = "10f86f18aff4995928efb3c8000eca166fe37e6006de7938139cad718ff7653f"
+		logic_hash = "v1_sha256_10f86f18aff4995928efb3c8000eca166fe37e6006de7938139cad718ff7653f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320022,10 +317676,10 @@ rule SIGNATURE_BASE_PHP_Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8143-L8155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8143-L8155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
-		logic_hash = "a62061b2fa851f5798158198e26f188408f3f37dca69a85ca155777c0b8407ee"
+		logic_hash = "v1_sha256_a62061b2fa851f5798158198e26f188408f3f37dca69a85ca155777c0b8407ee"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320047,10 +317701,10 @@ rule SIGNATURE_BASE_Hxdef100
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8156-L8169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8156-L8169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "55cc1769cef44910bd91b7b73dee1f6c"
-		logic_hash = "a2002dcddad7ffdbe9614723163016f9357347bb704640d3933ce4513c37d474"
+		logic_hash = "v1_sha256_a2002dcddad7ffdbe9614723163016f9357347bb704640d3933ce4513c37d474"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320073,10 +317727,10 @@ rule SIGNATURE_BASE_Rdrbs100
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8170-L8182"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8170-L8182"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7c752bcd6da796d80a6830c61a632bff"
-		logic_hash = "8a427ef9e0ecd0c810913203aaef43647964f33658dfdca8195fce6f0545f8f4"
+		logic_hash = "v1_sha256_8a427ef9e0ecd0c810913203aaef43647964f33658dfdca8195fce6f0545f8f4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320098,10 +317752,10 @@ rule SIGNATURE_BASE_Mithril_Mithril
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8183-L8201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8183-L8201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "017191562d72ab0ca551eb89256650bd"
-		logic_hash = "5d19eb4132a0401d226c9cffc927b2838e9c69428746296b55a488d097759587"
+		logic_hash = "v1_sha256_5d19eb4132a0401d226c9cffc927b2838e9c69428746296b55a488d097759587"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320129,10 +317783,10 @@ rule SIGNATURE_BASE_Hxdef100_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8202-L8215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8202-L8215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
-		logic_hash = "d44131f6c1bfdc36079f474832a79a361dfad96d1b84f7004d682150c93eccc5"
+		logic_hash = "v1_sha256_d44131f6c1bfdc36079f474832a79a361dfad96d1b84f7004d682150c93eccc5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320155,10 +317809,10 @@ rule SIGNATURE_BASE_Release_Dlltest
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8216-L8236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8216-L8236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "76a59fc3242a2819307bb9d593bef2e0"
-		logic_hash = "ba759ae1bbde357085b2b2dfda0780b5a239a44b4e999244e8eceed246090ce3"
+		logic_hash = "v1_sha256_ba759ae1bbde357085b2b2dfda0780b5a239a44b4e999244e8eceed246090ce3"
 		score = 50
 		quality = 85
 		tags = ""
@@ -320188,10 +317842,10 @@ rule SIGNATURE_BASE_Webadmin
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8237-L8248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8237-L8248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3a90de401b30e5b590362ba2dde30937"
-		logic_hash = "6e215c3d8b8357b839416ee6951f7739387bb94aa1284ea7e827ae2205221294"
+		logic_hash = "v1_sha256_6e215c3d8b8357b839416ee6951f7739387bb94aa1284ea7e827ae2205221294"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320212,10 +317866,10 @@ rule SIGNATURE_BASE_Commands
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8249-L8261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8249-L8261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "174486fe844cb388e2ae3494ac2d1ec2"
-		logic_hash = "5251ee090934c8f99a8a2ffef2605593943306937dc56a135a47f1da7e732587"
+		logic_hash = "v1_sha256_5251ee090934c8f99a8a2ffef2605593943306937dc56a135a47f1da7e732587"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320237,10 +317891,10 @@ rule SIGNATURE_BASE_Hkdoordll
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8262-L8273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8262-L8273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b715c009d47686c0e62d0981efce2552"
-		logic_hash = "a3c4d262b59cdf82390c0457810505e9e7a18c9b26ba4524bc368fd2141ec306"
+		logic_hash = "v1_sha256_a3c4d262b59cdf82390c0457810505e9e7a18c9b26ba4524bc368fd2141ec306"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320261,10 +317915,10 @@ rule SIGNATURE_BASE_R57Shell_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8274-L8285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8274-L8285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8023394542cddf8aee5dec6072ed02b5"
-		logic_hash = "5319426928d33b62527efb561c2b7a226a5a473735f501b267e6b3b174972085"
+		logic_hash = "v1_sha256_5319426928d33b62527efb561c2b7a226a5a473735f501b267e6b3b174972085"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320285,10 +317939,10 @@ rule SIGNATURE_BASE_Mithril_V1_45_Dlltest
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8286-L8299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8286-L8299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1b9e518aaa62b15079ff6edb412b21e9"
-		logic_hash = "cf1e2ca39ae6b726792bbbaf0f1dd90788a4bb9ba5e3d50c22d75f2b3d4e9e7d"
+		logic_hash = "v1_sha256_cf1e2ca39ae6b726792bbbaf0f1dd90788a4bb9ba5e3d50c22d75f2b3d4e9e7d"
 		score = 50
 		quality = 85
 		tags = ""
@@ -320311,10 +317965,10 @@ rule SIGNATURE_BASE_Dbgiis6Cli
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8300-L8312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8300-L8312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3044dceb632b636563f66fee3aaaf8f3"
-		logic_hash = "f6de3c9b8fbcca230540d1b41659ab02c9548df69f53fa9d5730ac7bb7dfe88a"
+		logic_hash = "v1_sha256_f6de3c9b8fbcca230540d1b41659ab02c9548df69f53fa9d5730ac7bb7dfe88a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320336,10 +317990,10 @@ rule SIGNATURE_BASE_Remview_2003_04_22
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8313-L8324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8313-L8324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "17d3e4e39fbca857344a7650f7ea55e3"
-		logic_hash = "2957f6ec7a022ac04759724276f6928625708346903597b0765b5e81207fc6b9"
+		logic_hash = "v1_sha256_2957f6ec7a022ac04759724276f6928625708346903597b0765b5e81207fc6b9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320360,10 +318014,10 @@ rule SIGNATURE_BASE_FSO_S_Test
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8325-L8337"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8325-L8337"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "82cf7b48da8286e644f575b039a99c26"
-		logic_hash = "62613bead716717f116290b1c9eca9aa63eadd280050811e30a54e5d186af2fc"
+		logic_hash = "v1_sha256_62613bead716717f116290b1c9eca9aa63eadd280050811e30a54e5d186af2fc"
 		score = 50
 		quality = 85
 		tags = ""
@@ -320385,10 +318039,10 @@ rule SIGNATURE_BASE_Debug_Cress
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8338-L8350"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8338-L8350"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "36a416186fe010574c9be68002a7286a"
-		logic_hash = "670e236e72d3cb52ea5dba865749baee58a70f8d100db1dd8eddfe3183339181"
+		logic_hash = "v1_sha256_670e236e72d3cb52ea5dba865749baee58a70f8d100db1dd8eddfe3183339181"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320410,10 +318064,10 @@ rule SIGNATURE_BASE_Webshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8351-L8366"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8351-L8366"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f2f8c02921f29368234bfb4d4622ad19"
-		logic_hash = "e3fdce426d2f6e88d8e9412a3026ea05d027af934763eafe0188602458c2289d"
+		logic_hash = "v1_sha256_e3fdce426d2f6e88d8e9412a3026ea05d027af934763eafe0188602458c2289d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320438,10 +318092,10 @@ rule SIGNATURE_BASE_FSO_S_EFSO_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8367-L8379"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8367-L8379"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a341270f9ebd01320a7490c12cb2e64c"
-		logic_hash = "462c713e5d4fb6d0db91b14bfacdca73f780559ba2dad80988c356ee1a3d369d"
+		logic_hash = "v1_sha256_462c713e5d4fb6d0db91b14bfacdca73f780559ba2dad80988c356ee1a3d369d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320463,10 +318117,10 @@ rule SIGNATURE_BASE_Thelast_Index3
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8380-L8391"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8380-L8391"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cceff6dc247aaa25512bad22120a14b4"
-		logic_hash = "3700141ca2cf53f49618e2d4cab8866efccdce843921f1733b3d6260b8feea68"
+		logic_hash = "v1_sha256_3700141ca2cf53f49618e2d4cab8866efccdce843921f1733b3d6260b8feea68"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320487,10 +318141,10 @@ rule SIGNATURE_BASE_Adjustcr
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8392-L8406"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8392-L8406"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "17037fa684ef4c90a25ec5674dac2eb6"
-		logic_hash = "d2a86083ff5cb34a0453f812e2d316c63342e529f00099a8869fa7e0a43321ef"
+		logic_hash = "v1_sha256_d2a86083ff5cb34a0453f812e2d316c63342e529f00099a8869fa7e0a43321ef"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320514,10 +318168,10 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Xishell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8407-L8418"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8407-L8418"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "997c8437c0621b4b753a546a53a88674"
-		logic_hash = "13393bc72477ab9a4ebc16b409de8ed73e086cc41f25f34315d11401b63c2471"
+		logic_hash = "v1_sha256_13393bc72477ab9a4ebc16b409de8ed73e086cc41f25f34315d11401b63c2471"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320538,10 +318192,10 @@ rule SIGNATURE_BASE_Hytop_Apppack_2005
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8419-L8430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8419-L8430"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
-		logic_hash = "0de4800291132efca24b40bebcc895d6873110214c8cbf8384317208e0d9db82"
+		logic_hash = "v1_sha256_0de4800291132efca24b40bebcc895d6873110214c8cbf8384317208e0d9db82"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320562,10 +318216,10 @@ rule SIGNATURE_BASE_Xssshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8431-L8442"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8431-L8442"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
-		logic_hash = "6b0e602b523f58ec61850b4ba2e69da4fe4bf2833fb45e529785a398445db127"
+		logic_hash = "v1_sha256_6b0e602b523f58ec61850b4ba2e69da4fe4bf2833fb45e529785a398445db127"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320586,10 +318240,10 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Usr
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8443-L8454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8443-L8454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ade3357520325af50c9098dc8a21a024"
-		logic_hash = "f5fd4a4c1b531b23b09505d302dc27d7ba2eb733fcf313c04ba9085b090f7cbe"
+		logic_hash = "v1_sha256_f5fd4a4c1b531b23b09505d302dc27d7ba2eb733fcf313c04ba9085b090f7cbe"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320610,10 +318264,10 @@ rule SIGNATURE_BASE_FSO_S_Phpinj
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8455-L8466"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8455-L8466"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dd39d17e9baca0363cc1c3664e608929"
-		logic_hash = "de4ac200f5426ec4c6fef21d5fbc37281811569a3e71a9bcb6fa51d13eb600a4"
+		logic_hash = "v1_sha256_de4ac200f5426ec4c6fef21d5fbc37281811569a3e71a9bcb6fa51d13eb600a4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320634,10 +318288,10 @@ rule SIGNATURE_BASE_Xssshell_Db
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8467-L8478"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8467-L8478"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cb62e2ec40addd4b9930a9e270f5b318"
-		logic_hash = "3fdbaa17c12abef8576bf859065d90f4b6e80c187af734b71b26a1bd5d073e86"
+		logic_hash = "v1_sha256_3fdbaa17c12abef8576bf859065d90f4b6e80c187af734b71b26a1bd5d073e86"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320658,10 +318312,10 @@ rule SIGNATURE_BASE_PHP_Sh
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8479-L8490"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8479-L8490"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1e9e879d49eb0634871e9b36f99fe528"
-		logic_hash = "da0b572f116cc5c55e8d7469f222896d602d09be4761a0e2139fc8ce67ac4050"
+		logic_hash = "v1_sha256_da0b572f116cc5c55e8d7469f222896d602d09be4761a0e2139fc8ce67ac4050"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320682,10 +318336,10 @@ rule SIGNATURE_BASE_Xssshell_Default
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8491-L8502"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8491-L8502"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d156782ae5e0b3724de3227b42fcaf2f"
-		logic_hash = "6a8772a8a6399c3266abcc22a3c55eda70ec9703346398f5f1768bbd35974f8c"
+		logic_hash = "v1_sha256_6a8772a8a6399c3266abcc22a3c55eda70ec9703346398f5f1768bbd35974f8c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320706,10 +318360,10 @@ rule SIGNATURE_BASE_Editserver_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8503-L8516"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8503-L8516"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
-		logic_hash = "c581936928ce0f1061feb5665c743f14f12a9f875e360f40cc064f3047b23adf"
+		logic_hash = "v1_sha256_c581936928ce0f1061feb5665c743f14f12a9f875e360f40cc064f3047b23adf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320732,10 +318386,10 @@ rule SIGNATURE_BASE_By064Cli
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8517-L8529"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8517-L8529"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "10e0dff366968b770ae929505d2a9885"
-		logic_hash = "51efd5c510efc6657ae175af47b09437ae70eb0237d88ffdf3cdae365d0ec7be"
+		logic_hash = "v1_sha256_51efd5c510efc6657ae175af47b09437ae70eb0237d88ffdf3cdae365d0ec7be"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320757,10 +318411,10 @@ rule SIGNATURE_BASE_Mithril_Dlltest
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8530-L8542"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8530-L8542"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
-		logic_hash = "c8c8d1b75ed4eb4bc66a762e53aa6b3ab439e96ef464a8b9ffa4dff887986465"
+		logic_hash = "v1_sha256_c8c8d1b75ed4eb4bc66a762e53aa6b3ab439e96ef464a8b9ffa4dff887986465"
 		score = 50
 		quality = 85
 		tags = ""
@@ -320782,10 +318436,10 @@ rule SIGNATURE_BASE_Peek_A_Boo
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8543-L8559"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8543-L8559"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aca339f60d41fdcba83773be5d646776"
-		logic_hash = "b103c1b873dd0df9626d72a1127fbadc821777a05012a080423263a2083c398b"
+		logic_hash = "v1_sha256_b103c1b873dd0df9626d72a1127fbadc821777a05012a080423263a2083c398b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320811,10 +318465,10 @@ rule SIGNATURE_BASE_Fmlibraryv3
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8560-L8571"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8560-L8571"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c34c248fed6d5a20d8203924a2088acc"
-		logic_hash = "a7dc83db26cdda757f626c42022c17bb2764074a3cc5f87b4a3aaa991fac5dc2"
+		logic_hash = "v1_sha256_a7dc83db26cdda757f626c42022c17bb2764074a3cc5f87b4a3aaa991fac5dc2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320835,10 +318489,10 @@ rule SIGNATURE_BASE_Debug_Dlltest_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8572-L8584"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8572-L8584"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1b9e518aaa62b15079ff6edb412b21e9"
-		logic_hash = "bf260ce0f8d4728920679573cd77927b44db28ba6102923707af8d1ad7d0ef2d"
+		logic_hash = "v1_sha256_bf260ce0f8d4728920679573cd77927b44db28ba6102923707af8d1ad7d0ef2d"
 		score = 50
 		quality = 85
 		tags = ""
@@ -320860,10 +318514,10 @@ rule SIGNATURE_BASE_Connector
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8585-L8597"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8585-L8597"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3ba1827fca7be37c8296cd60be9dc884"
-		logic_hash = "b8cadb7aa23a8cdef10e7b1eb05586d6c3e7c398958a80861b6f1ccd4edf1eca"
+		logic_hash = "v1_sha256_b8cadb7aa23a8cdef10e7b1eb05586d6c3e7c398958a80861b6f1ccd4edf1eca"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320885,10 +318539,10 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Hiderun
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8598-L8610"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8598-L8610"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "45436d9bfd8ff94b71eeaeb280025afe"
-		logic_hash = "3a6dea2314800b28e92b59595c8b79c64e66dc66ebfa8f89c2f4028b574b9a91"
+		logic_hash = "v1_sha256_3a6dea2314800b28e92b59595c8b79c64e66dc66ebfa8f89c2f4028b574b9a91"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320910,10 +318564,10 @@ rule SIGNATURE_BASE_PHP_Shell_V1_7
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8611-L8622"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8611-L8622"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b5978501c7112584532b4ca6fb77cba5"
-		logic_hash = "e03904177309de9ce1afa0b12bf70913b106650c3db5807f9d4ccb91fb2ade77"
+		logic_hash = "v1_sha256_e03904177309de9ce1afa0b12bf70913b106650c3db5807f9d4ccb91fb2ade77"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320934,10 +318588,10 @@ rule SIGNATURE_BASE_Xssshell_Save
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8623-L8635"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8623-L8635"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "865da1b3974e940936fe38e8e1964980"
-		logic_hash = "c53034c6ebc4f01c4573e688f548e71dae944913797b12eb8f22a5ef0a368ccf"
+		logic_hash = "v1_sha256_c53034c6ebc4f01c4573e688f548e71dae944913797b12eb8f22a5ef0a368ccf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320959,10 +318613,10 @@ rule SIGNATURE_BASE_Screencap
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8636-L8649"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8636-L8649"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "51139091dea7a9418a50f2712ea72aa6"
-		logic_hash = "9be7ec97ef8e9b8838f7931a8fcf8d85b1543a202a7bf34fab9791fc47889cb9"
+		logic_hash = "v1_sha256_9be7ec97ef8e9b8838f7931a8fcf8d85b1543a202a7bf34fab9791fc47889cb9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -320985,10 +318639,10 @@ rule SIGNATURE_BASE_FSO_S_Phpinj_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8650-L8661"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8650-L8661"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dd39d17e9baca0363cc1c3664e608929"
-		logic_hash = "12af5182b94f01ac4fbdee92c007556aaa7f196aca116575803cedd84b81f3b0"
+		logic_hash = "v1_sha256_12af5182b94f01ac4fbdee92c007556aaa7f196aca116575803cedd84b81f3b0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321009,10 +318663,10 @@ rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Zxrecv
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8662-L8679"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8662-L8679"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
-		logic_hash = "7eef63e45f6902e4f2d5f854b2794df3101a2ef145e2d627263db429c2b728d7"
+		logic_hash = "v1_sha256_7eef63e45f6902e4f2d5f854b2794df3101a2ef145e2d627263db429c2b728d7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321039,10 +318693,10 @@ rule SIGNATURE_BASE_FSO_S_Ajan
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8680-L8691"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8680-L8691"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "22194f8c44524f80254e1b5aec67b03e"
-		logic_hash = "a7766caae5845ce43cff2212c25fea9a78979d10c79d8c40290b5c1471b101cd"
+		logic_hash = "v1_sha256_a7766caae5845ce43cff2212c25fea9a78979d10c79d8c40290b5c1471b101cd"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321063,10 +318717,10 @@ rule SIGNATURE_BASE_C99Shell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8692-L8703"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8692-L8703"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "90b86a9c63e2cd346fe07cea23fbfc56"
-		logic_hash = "a0fcc43a80ac4d059aea36da8b4b5a81c99a54f7c66c521697805ae890d66fe8"
+		logic_hash = "v1_sha256_a0fcc43a80ac4d059aea36da8b4b5a81c99a54f7c66c521697805ae890d66fe8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321087,10 +318741,10 @@ rule SIGNATURE_BASE_Phpspy_2005_Full
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8704-L8715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8704-L8715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d1c69bb152645438440e6c903bac16b2"
-		logic_hash = "8561161726a49374a9bc3389fef593e5d68dc437552e06736a235412183bef45"
+		logic_hash = "v1_sha256_8561161726a49374a9bc3389fef593e5d68dc437552e06736a235412183bef45"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321111,10 +318765,10 @@ rule SIGNATURE_BASE_FSO_S_Zehir4_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8716-L8727"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8716-L8727"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5b496a61363d304532bcf52ee21f5d55"
-		logic_hash = "bb10f2e28bb375366b9140c06bb242cd13fdb69e67ce72ecae0e50270566f116"
+		logic_hash = "v1_sha256_bb10f2e28bb375366b9140c06bb242cd13fdb69e67ce72ecae0e50270566f116"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321135,10 +318789,10 @@ rule SIGNATURE_BASE_FSO_S_Indexer_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8728-L8739"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8728-L8739"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "135fc50f85228691b401848caef3be9e"
-		logic_hash = "8cf4c8fb1e985adbed2cf20578fcfc14240f6d9fe6062bbe3fe2f895f58bc172"
+		logic_hash = "v1_sha256_8cf4c8fb1e985adbed2cf20578fcfc14240f6d9fe6062bbe3fe2f895f58bc172"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321159,10 +318813,10 @@ rule SIGNATURE_BASE_Hytop_Devpack_2005
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8740-L8753"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8740-L8753"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
-		logic_hash = "b312cddff4c5292cc51acc39448c815fede3c9356d7d225c3a08c7124712b3f8"
+		logic_hash = "v1_sha256_b312cddff4c5292cc51acc39448c815fede3c9356d7d225c3a08c7124712b3f8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321185,10 +318839,10 @@ rule SIGNATURE_BASE__Root_040_Zip_Folder_Deploy
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8754-L8767"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8754-L8767"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2c9f9c58999256c73a5ebdb10a9be269"
-		logic_hash = "9852b105e6a28f5500fc6739b196dd14b9b0b69b1077be4063735380b0699abb"
+		logic_hash = "v1_sha256_9852b105e6a28f5500fc6739b196dd14b9b0b69b1077be4063735380b0699abb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321210,10 +318864,10 @@ rule SIGNATURE_BASE_By063Cli
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8768-L8780"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8768-L8780"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "49ce26eb97fd13b6d92a5e5d169db859"
-		logic_hash = "c89159b73232bc8fd7430b3330009f4b3eb25b9511515bc9b4cd433f7a67f30e"
+		logic_hash = "v1_sha256_c89159b73232bc8fd7430b3330009f4b3eb25b9511515bc9b4cd433f7a67f30e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321235,10 +318889,10 @@ rule SIGNATURE_BASE_Icyfox007V1_10_Rar_Folder_Asp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8781-L8792"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8781-L8792"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2c412400b146b7b98d6e7755f7159bb9"
-		logic_hash = "3cc36668f0a2a6807b59c7da0b6e504b519a616ab63fb9f606eba5dc4a9e7e2f"
+		logic_hash = "v1_sha256_3cc36668f0a2a6807b59c7da0b6e504b519a616ab63fb9f606eba5dc4a9e7e2f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321259,10 +318913,10 @@ rule SIGNATURE_BASE_Byshell063_Ntboot_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8794-L8805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8794-L8805"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
-		logic_hash = "25df29000bb410c0ba1fec78920124f6eedbc2585541536239522d2b116270ab"
+		logic_hash = "v1_sha256_25df29000bb410c0ba1fec78920124f6eedbc2585541536239522d2b116270ab"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321283,10 +318937,10 @@ rule SIGNATURE_BASE_U_Uay
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8806-L8818"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8806-L8818"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
-		logic_hash = "45e8938ce34fd5a253cee3867aa8c4429c6bf3fcc91098ed9df3f95656bc5f8f"
+		logic_hash = "v1_sha256_45e8938ce34fd5a253cee3867aa8c4429c6bf3fcc91098ed9df3f95656bc5f8f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321308,10 +318962,10 @@ rule SIGNATURE_BASE_Bin_Wuaus
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8819-L8835"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8819-L8835"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "46a365992bec7377b48a2263c49e4e7d"
-		logic_hash = "0509ca39662430c3ababf65ca3a6e9af95250163980829d90eddf5341168c864"
+		logic_hash = "v1_sha256_0509ca39662430c3ababf65ca3a6e9af95250163980829d90eddf5341168c864"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321337,10 +318991,10 @@ rule SIGNATURE_BASE_Pwreveal
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8836-L8850"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8836-L8850"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b4e8447826a45b76ca45ba151a97ad50"
-		logic_hash = "01c9582897c65e608d49a151fe9ade97b9a031d7d10f5fd4b4d0c2a3fd83e7b6"
+		logic_hash = "v1_sha256_01c9582897c65e608d49a151fe9ade97b9a031d7d10f5fd4b4d0c2a3fd83e7b6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321364,10 +319018,10 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Xwhois
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8851-L8865"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8851-L8865"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0bc98bd576c80d921a3460f8be8816b4"
-		logic_hash = "75ee56dae5fde75ae4dc4bba835a96016781b747f3cff0dc6d52e665463a6070"
+		logic_hash = "v1_sha256_75ee56dae5fde75ae4dc4bba835a96016781b747f3cff0dc6d52e665463a6070"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321391,10 +319045,10 @@ rule SIGNATURE_BASE_Vanquish_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8866-L8877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8866-L8877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2dcb9055785a2ee01567f52b5a62b071"
-		logic_hash = "428dc4e6d8bcc888e6f99f69ee9f211aa029d3486b99b9716d09709dc391d9a2"
+		logic_hash = "v1_sha256_428dc4e6d8bcc888e6f99f69ee9f211aa029d3486b99b9716d09709dc391d9a2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321415,10 +319069,10 @@ rule SIGNATURE_BASE_Down_Rar_Folder_Down
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8878-L8889"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8878-L8889"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "db47d7a12b3584a2e340567178886e71"
-		logic_hash = "bc666d6333d49a2b01553e1946fc304195193b9be92e26805474e64da61455da"
+		logic_hash = "v1_sha256_bc666d6333d49a2b01553e1946fc304195193b9be92e26805474e64da61455da"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321439,10 +319093,10 @@ rule SIGNATURE_BASE_Cmdshell
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8890-L8901"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8890-L8901"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8a9fef43209b5d2d4b81dfbb45182036"
-		logic_hash = "5e7c7537b355b162d58b8bce570b1f94a8e6b479856685a245ffaed8f9482680"
+		logic_hash = "v1_sha256_5e7c7537b355b162d58b8bce570b1f94a8e6b479856685a245ffaed8f9482680"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321463,10 +319117,10 @@ rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Nc
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8902-L8916"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8902-L8916"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
-		logic_hash = "6106758aedb33f8983f387a58fcd815c47f793cd2a7ea3b0ebed13dd1d5b6e83"
+		logic_hash = "v1_sha256_6106758aedb33f8983f387a58fcd815c47f793cd2a7ea3b0ebed13dd1d5b6e83"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321490,10 +319144,10 @@ rule SIGNATURE_BASE_Portlessinst
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8917-L8930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8917-L8930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "74213856fc61475443a91cd84e2a6c2f"
-		logic_hash = "72ca80de2ad2048d1fcbbffeebd0e4fd7d9d47d6736360674e6a85ef9943abe8"
+		logic_hash = "v1_sha256_72ca80de2ad2048d1fcbbffeebd0e4fd7d9d47d6736360674e6a85ef9943abe8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321516,10 +319170,10 @@ rule SIGNATURE_BASE_Setupbdoor
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8931-L8942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8931-L8942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "41f89e20398368e742eda4a3b45716b6"
-		logic_hash = "b4b6a0e4b9f8975d769d340a420af37dbc344d32c72447a8c56b05e985e6d806"
+		logic_hash = "v1_sha256_b4b6a0e4b9f8975d769d340a420af37dbc344d32c72447a8c56b05e985e6d806"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321540,10 +319194,10 @@ rule SIGNATURE_BASE_Phpshell_3
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8943-L8955"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8943-L8955"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e8693a2d4a2ffea4df03bb678df3dc6d"
-		logic_hash = "b86fa40fd7bbcae86926182882faa226530e44c20bc611b8433a7da7f012106c"
+		logic_hash = "v1_sha256_b86fa40fd7bbcae86926182882faa226530e44c20bc611b8433a7da7f012106c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321565,10 +319219,10 @@ rule SIGNATURE_BASE_BIN_Server
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8956-L8972"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8956-L8972"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1d5aa9cbf1429bb5b8bf600335916dcd"
-		logic_hash = "34f9d78e0f61717fae2945e7a833c2c6d59e28035ee95da2c5d32b4e196bc957"
+		logic_hash = "v1_sha256_34f9d78e0f61717fae2945e7a833c2c6d59e28035ee95da2c5d32b4e196bc957"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321594,10 +319248,10 @@ rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8973-L8984"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8973-L8984"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c19d6f4e069188f19b08fa94d44bc283"
-		logic_hash = "536232bbdd21bddb88eefe06a82927abcdd3ed10404c052957896960a6d10932"
+		logic_hash = "v1_sha256_536232bbdd21bddb88eefe06a82927abcdd3ed10404c052957896960a6d10932"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321618,10 +319272,10 @@ rule SIGNATURE_BASE_R57Shell_3
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8985-L8996"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8985-L8996"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "87995a49f275b6b75abe2521e03ac2c0"
-		logic_hash = "0fdca080c7ce57b7bd818a968840aebf3c5c74f188ed062fec794bfadb4e75b0"
+		logic_hash = "v1_sha256_0fdca080c7ce57b7bd818a968840aebf3c5c74f188ed062fec794bfadb4e75b0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321642,10 +319296,10 @@ rule SIGNATURE_BASE_Hdconfig
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L8997-L9012"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L8997-L9012"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7d60e552fdca57642fd30462416347bd"
-		logic_hash = "9001f79db15548cf3ca931d0043d078db7d900ab26093afbf5cd44d0a85800f4"
+		logic_hash = "v1_sha256_9001f79db15548cf3ca931d0043d078db7d900ab26093afbf5cd44d0a85800f4"
 		score = 60
 		quality = 55
 		tags = ""
@@ -321670,10 +319324,10 @@ rule SIGNATURE_BASE_FSO_S_Ajan_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9013-L9025"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9013-L9025"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "22194f8c44524f80254e1b5aec67b03e"
-		logic_hash = "0ac31ee735c94289932369dfba5b408cbf71cc23fd48ce3e09dc7ce640a0d733"
+		logic_hash = "v1_sha256_0ac31ee735c94289932369dfba5b408cbf71cc23fd48ce3e09dc7ce640a0d733"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321695,9 +319349,9 @@ rule SIGNATURE_BASE_Webshell_And_Exploit_CN_APT_HK : WEBSHELL
 		date = "2014-10-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9027-L9042"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec3f1e985585e1bf77a46e971a20cd127064a64467761a5a570548dd63ec57e2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9027-L9042"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec3f1e985585e1bf77a46e971a20cd127064a64467761a5a570548dd63ec57e2"
 		score = 50
 		quality = 85
 		tags = "WEBSHELL"
@@ -321709,7 +319363,7 @@ rule SIGNATURE_BASE_Webshell_And_Exploit_CN_APT_HK : WEBSHELL
 		$s1 = "<input type=\"hidden\" name=\"doing\" value=\"login\">"
 
 	condition:
-		$a0 or ( all of ($s*))
+		$a0 or ( all of ( $s* ) )
 }
 rule SIGNATURE_BASE_JSP_Browser_APT_Webshell
 {
@@ -321720,9 +319374,9 @@ rule SIGNATURE_BASE_JSP_Browser_APT_Webshell
 		date = "2014-10-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9044-L9058"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a352bf394f1b4f70218650758db39225a5a505656299405ccd077592d29480a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9044-L9058"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a352bf394f1b4f70218650758db39225a5a505656299405ccd077592d29480a7"
 		score = 60
 		quality = 85
 		tags = ""
@@ -321745,9 +319399,9 @@ rule SIGNATURE_BASE_JSP_Jfigueiredo_APT_Webshell
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9060-L9073"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7efaca469d09ce7ecba4ed38cb0b07d1b9fc4f45172d2ffb6f5d3259c000fdc5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9060-L9073"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7efaca469d09ce7ecba4ed38cb0b07d1b9fc4f45172d2ffb6f5d3259c000fdc5"
 		score = 60
 		quality = 85
 		tags = ""
@@ -321768,9 +319422,9 @@ rule SIGNATURE_BASE_JSP_Jfigueiredo_APT_Webshell_2
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9075-L9090"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f7fa5872d8eb4ba1d0b26d966d7650d70b1a10c56945d5a5340b8e1cb5d0f5f0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9075-L9090"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f7fa5872d8eb4ba1d0b26d966d7650d70b1a10c56945d5a5340b8e1cb5d0f5f0"
 		score = 60
 		quality = 85
 		tags = ""
@@ -321782,7 +319436,7 @@ rule SIGNATURE_BASE_JSP_Jfigueiredo_APT_Webshell_2
 		$s2 = "<input type=\"hidden\" id=\"fhidden\" name=\"fhidden\" value=\"L3BkZi8=\" />" ascii
 
 	condition:
-		all of ($a*) or all of ($s*)
+		all of ( $a* ) or all of ( $s* )
 }
 rule SIGNATURE_BASE_Webshell_Insomnia
 {
@@ -321793,10 +319447,10 @@ rule SIGNATURE_BASE_Webshell_Insomnia
 		date = "2014-12-09"
 		modified = "2023-12-05"
 		reference = "http://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9092-L9113"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9092-L9113"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e0cfb2ffaa1491aeaf7d3b4ee840f72d42919d22"
-		logic_hash = "d170c60f94092a38ba4af92283debd059eef2e4c683fd7737ffd60d1a2581d9c"
+		logic_hash = "v1_sha256_d170c60f94092a38ba4af92283debd059eef2e4c683fd7737ffd60d1a2581d9c"
 		score = 80
 		quality = 85
 		tags = ""
@@ -321824,9 +319478,9 @@ rule SIGNATURE_BASE_Hawkeye_PHP_Panel : FILE
 		date = "2014-12-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9115-L9130"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e29b6df4e3aa3892b10e68218320ac76cecb5a1bbe6c48f2276014b972cbbdd8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9115-L9130"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e29b6df4e3aa3892b10e68218320ac76cecb5a1bbe6c48f2276014b972cbbdd8"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -321839,7 +319493,7 @@ rule SIGNATURE_BASE_Hawkeye_PHP_Panel : FILE
 		$s3 = "echo \"Success\";" fullword ascii
 
 	condition:
-		all of ($s*) and filesize <600
+		all of ( $s* ) and filesize < 600
 }
 rule SIGNATURE_BASE_Soaksoak_Infected_Wordpress
 {
@@ -321850,9 +319504,9 @@ rule SIGNATURE_BASE_Soaksoak_Infected_Wordpress
 		date = "2014-12-15"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/1GzWUX"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9132-L9147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4cba18a0d14be2795d71a1973265a1742beda57636f64c1974001ecf70e3e91d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9132-L9147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4cba18a0d14be2795d71a1973265a1742beda57636f64c1974001ecf70e3e91d"
 		score = 60
 		quality = 85
 		tags = ""
@@ -321864,7 +319518,7 @@ rule SIGNATURE_BASE_Soaksoak_Infected_Wordpress
 		$s2 = "add_action(\"wp_enqueue_scripts\", 'FuncQueueObject');" ascii fullword
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
 rule SIGNATURE_BASE_Pastebin_Webshell
 {
@@ -321875,9 +319529,9 @@ rule SIGNATURE_BASE_Pastebin_Webshell
 		date = "2015-01-13"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/7dbyZs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9149-L9171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e71429e9280c37a90ee77be888ae743a86521d3632afc4eeec480b82a22a1445"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9149-L9171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e71429e9280c37a90ee77be888ae743a86521d3632afc4eeec480b82a22a1445"
 		score = 70
 		quality = 85
 		tags = ""
@@ -321894,7 +319548,7 @@ rule SIGNATURE_BASE_Pastebin_Webshell
 		$y2 = "str_replace('* @package Wordpress',$temp" ascii
 
 	condition:
-		1 of ($s*) or all of ($x*) or all of ($y*)
+		1 of ( $s* ) or all of ( $x* ) or all of ( $y* )
 }
 rule SIGNATURE_BASE_Aspxspy2
 {
@@ -321905,10 +319559,10 @@ rule SIGNATURE_BASE_Aspxspy2
 		date = "2015-01-24"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9173-L9199"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9173-L9199"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5642387d92139bfe9ae11bfef6bfe0081dcea197"
-		logic_hash = "59c88f8e2542dcde4bf5123147ea2c1ca408925ca966f3f34a4692a3ba7a0935"
+		logic_hash = "v1_sha256_59c88f8e2542dcde4bf5123147ea2c1ca408925ca966f3f34a4692a3ba7a0935"
 		score = 75
 		quality = 85
 		tags = ""
@@ -321942,9 +319596,9 @@ rule SIGNATURE_BASE_Webshell_27_9_C66_C99 : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9210-L9235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "71ae0a3843151a2eec913f62167b23cf9e0c759b18ebe0759174d3503fb23717"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9210-L9235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_71ae0a3843151a2eec913f62167b23cf9e0c759b18ebe0759174d3503fb23717"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -321966,7 +319620,7 @@ rule SIGNATURE_BASE_Webshell_27_9_C66_C99 : FILE
 		$s7 = "if (!function_exists(\"c99_buff_prepare\"))" fullword ascii
 
 	condition:
-		filesize <685KB and 1 of them
+		filesize < 685KB and 1 of them
 }
 rule SIGNATURE_BASE_Webshell_Acid_Antisecshell_3 : FILE
 {
@@ -321977,9 +319631,9 @@ rule SIGNATURE_BASE_Webshell_Acid_Antisecshell_3 : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9237-L9269"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c8c3fcde7afdafe8ead59e24e432fdd4ccae99f96f67b4be3e5a9cd74ff9b2e7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9237-L9269"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c8c3fcde7afdafe8ead59e24e432fdd4ccae99f96f67b4be3e5a9cd74ff9b2e7"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322008,7 +319662,7 @@ rule SIGNATURE_BASE_Webshell_Acid_Antisecshell_3 : FILE
 		$s1 = "if (!is_readable($o)) {return \"<font color=red>\".view_perms(fileperms($o)).\"</font>\";}" fullword ascii
 
 	condition:
-		filesize <900KB and all of them
+		filesize < 900KB and all of them
 }
 rule SIGNATURE_BASE_Webshell_C99_4 : FILE
 {
@@ -322019,9 +319673,9 @@ rule SIGNATURE_BASE_Webshell_C99_4 : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9271-L9302"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa095d8da737e24a913eeadaca2882475366bf5cf0911dd9ff44aaa04871cc0f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9271-L9302"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa095d8da737e24a913eeadaca2882475366bf5cf0911dd9ff44aaa04871cc0f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322049,7 +319703,7 @@ rule SIGNATURE_BASE_Webshell_C99_4 : FILE
 		$s5 = "if (posix_kill($pid,$sig)) {echo \"OK.\";}" fullword ascii
 
 	condition:
-		filesize <900KB and 1 of them
+		filesize < 900KB and 1 of them
 }
 rule SIGNATURE_BASE_Webshell_R57Shell_2 : FILE
 {
@@ -322060,9 +319714,9 @@ rule SIGNATURE_BASE_Webshell_R57Shell_2 : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9304-L9331"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2af51c3d181801b14d5dbb3107cd78cf7ab4a590b7967f231ec707b7ee03fa26"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9304-L9331"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2af51c3d181801b14d5dbb3107cd78cf7ab4a590b7967f231ec707b7ee03fa26"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322086,7 +319740,7 @@ rule SIGNATURE_BASE_Webshell_R57Shell_2 : FILE
 		$s2 = "echo $lang[$language.'_text98'].$suc.\"\\r\\n\";" fullword ascii
 
 	condition:
-		filesize <900KB and all of them
+		filesize < 900KB and all of them
 }
 rule SIGNATURE_BASE_Webshell_27_9_Acid_C99_Locus7S : FILE
 {
@@ -322097,9 +319751,9 @@ rule SIGNATURE_BASE_Webshell_27_9_Acid_C99_Locus7S : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9333-L9355"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3005c09dfcb1f2e33a09ed73e28ef889c74e1f5daf619dd272e0b9b30cdb0f94"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9333-L9355"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3005c09dfcb1f2e33a09ed73e28ef889c74e1f5daf619dd272e0b9b30cdb0f94"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322118,7 +319772,7 @@ rule SIGNATURE_BASE_Webshell_27_9_Acid_C99_Locus7S : FILE
 		$s1 = "$_POST['backcconnmsge']=\"</br></br><b><font color=red size=3>Error:</font> Can't backdoor host!</b>\";" fullword ascii
 
 	condition:
-		filesize <1711KB and 1 of them
+		filesize < 1711KB and 1 of them
 }
 rule SIGNATURE_BASE_Webshell_Backdoor_PHP_Agent_R57_Mod_Bizzz_Shell_R57 : FILE
 {
@@ -322129,9 +319783,9 @@ rule SIGNATURE_BASE_Webshell_Backdoor_PHP_Agent_R57_Mod_Bizzz_Shell_R57 : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9357-L9382"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51660ea25d1b2290c0ca30377dbf378cac8d7b7650603f1dbe5b7914c530d5cf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9357-L9382"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51660ea25d1b2290c0ca30377dbf378cac8d7b7650603f1dbe5b7914c530d5cf"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322153,7 +319807,7 @@ rule SIGNATURE_BASE_Webshell_Backdoor_PHP_Agent_R57_Mod_Bizzz_Shell_R57 : FILE
 		$s2 = "$blah = ex(" ascii
 
 	condition:
-		filesize <600KB and all of them
+		filesize < 600KB and all of them
 }
 rule SIGNATURE_BASE_Webshell_C100 : FILE
 {
@@ -322164,9 +319818,9 @@ rule SIGNATURE_BASE_Webshell_C100 : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9384-L9408"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cc8c59f70f5ec6c89812b1597e9b864e358593ea5782e359cd483dee1a84b28b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9384-L9408"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cc8c59f70f5ec6c89812b1597e9b864e358593ea5782e359cd483dee1a84b28b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322187,7 +319841,7 @@ rule SIGNATURE_BASE_Webshell_C100 : FILE
 		$s6 = "netstat -atup | grep IST" ascii
 
 	condition:
-		filesize <685KB and 2 of them
+		filesize < 685KB and 2 of them
 }
 rule SIGNATURE_BASE_Webshell_Acidpoison : FILE
 {
@@ -322198,9 +319852,9 @@ rule SIGNATURE_BASE_Webshell_Acidpoison : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9410-L9433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "31add38bcdc33d5e4b825bfa18ff1a47d5aa5aaeebd8e3adac533c471aa30629"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9410-L9433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_31add38bcdc33d5e4b825bfa18ff1a47d5aa5aaeebd8e3adac533c471aa30629"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322220,7 +319874,7 @@ rule SIGNATURE_BASE_Webshell_Acidpoison : FILE
 		$s1 = "elseif ( enabled(\"exec\") ) { exec($cmd,$o); $output = join(\"\\r\\n\",$o); }" fullword ascii
 
 	condition:
-		filesize <550KB and all of them
+		filesize < 550KB and all of them
 }
 rule SIGNATURE_BASE_Webshell_Acid_Fatalisticz_Fx_Fx_P0Ison_Sh3Ll_X0Rg_Byp4Ss_256 : FILE
 {
@@ -322231,9 +319885,9 @@ rule SIGNATURE_BASE_Webshell_Acid_Fatalisticz_Fx_Fx_P0Ison_Sh3Ll_X0Rg_Byp4Ss_256
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9435-L9454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "07cd255247c9a77b1c9b6049a2b96632252ea9572880b10991c6797c14a05d48"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9435-L9454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_07cd255247c9a77b1c9b6049a2b96632252ea9572880b10991c6797c14a05d48"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322249,7 +319903,7 @@ rule SIGNATURE_BASE_Webshell_Acid_Fatalisticz_Fx_Fx_P0Ison_Sh3Ll_X0Rg_Byp4Ss_256
 		$s2 = "foreach($quicklaunch2 as $item) {" fullword ascii
 
 	condition:
-		filesize <882KB and all of them
+		filesize < 882KB and all of them
 }
 rule SIGNATURE_BASE_Webshell_Ayyildiz : FILE
 {
@@ -322260,9 +319914,9 @@ rule SIGNATURE_BASE_Webshell_Ayyildiz : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9456-L9475"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8441b7d730e337e002eeb7ae8f489e405409ddbe62f45bbc9a74c935d1d9fe66"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9456-L9475"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8441b7d730e337e002eeb7ae8f489e405409ddbe62f45bbc9a74c935d1d9fe66"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322278,7 +319932,7 @@ rule SIGNATURE_BASE_Webshell_Ayyildiz : FILE
 		$s1 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";" fullword ascii
 
 	condition:
-		filesize <112KB and all of them
+		filesize < 112KB and all of them
 }
 rule SIGNATURE_BASE_Webshell_Zehir : FILE
 {
@@ -322289,9 +319943,9 @@ rule SIGNATURE_BASE_Webshell_Zehir : FILE
 		date = "2016-01-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9477-L9496"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c8fda66ada3581d2471b322ae65032b68c69b882c29f7469dd2ed78800c9c5f7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9477-L9496"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c8fda66ada3581d2471b322ae65032b68c69b882c29f7469dd2ed78800c9c5f7"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322307,7 +319961,7 @@ rule SIGNATURE_BASE_Webshell_Zehir : FILE
 		$s2 = "if (frmUpload.max.value<=0) frmUpload.max.value=1;" fullword ascii
 
 	condition:
-		filesize <200KB and 1 of them
+		filesize < 200KB and 1 of them
 }
 rule SIGNATURE_BASE_Uploadshell_98038F1Efa4203432349Badabad76D44337319A6 : FILE
 {
@@ -322318,9 +319972,9 @@ rule SIGNATURE_BASE_Uploadshell_98038F1Efa4203432349Badabad76D44337319A6 : FILE
 		date = "2016-09-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9507-L9522"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "68f0de84a387a9af1a32dd8d38c66b002e16e1c954a51e6bc307580180faedbf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9507-L9522"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_68f0de84a387a9af1a32dd8d38c66b002e16e1c954a51e6bc307580180faedbf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322333,7 +319987,7 @@ rule SIGNATURE_BASE_Uploadshell_98038F1Efa4203432349Badabad76D44337319A6 : FILE
 		$s7 = "$xos = \"Safe-mode:[Safe-mode:\".$hsafemode.\"] " fullword ascii
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <6KB and ( all of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x3f3c and filesize < 6KB and ( all of ( $s* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Dkshell_F0772Be3C95802A2D1E7A4A3F5A45Dcdef6997F3 : FILE
 {
@@ -322344,9 +319998,9 @@ rule SIGNATURE_BASE_Dkshell_F0772Be3C95802A2D1E7A4A3F5A45Dcdef6997F3 : FILE
 		date = "2016-09-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9524-L9538"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "81b0a08d1b9d3640e656a5cd08b79c0a2f940a2db5c2d939d19509f993514e86"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9524-L9538"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_81b0a08d1b9d3640e656a5cd08b79c0a2f940a2db5c2d939d19509f993514e86"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322358,7 +320012,7 @@ rule SIGNATURE_BASE_Dkshell_F0772Be3C95802A2D1E7A4A3F5A45Dcdef6997F3 : FILE
 		$s2 = "$s_func=\"cr\".\"eat\".\"e_fun\".\"cti\".\"on" ascii
 
 	condition:
-		( uint16(0)==0x3c0a and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x3c0a and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Unknown_8Af033424F9590A15472A23Cc3236E68070B952E : FILE
 {
@@ -322369,9 +320023,9 @@ rule SIGNATURE_BASE_Unknown_8Af033424F9590A15472A23Cc3236E68070B952E : FILE
 		date = "2016-09-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9540-L9555"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d7dc9a2a5e0800b5061cb2101d7cda023a6e637f1e7b14054fdb6a0b2cec6084"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9540-L9555"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d7dc9a2a5e0800b5061cb2101d7cda023a6e637f1e7b14054fdb6a0b2cec6084"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322384,7 +320038,7 @@ rule SIGNATURE_BASE_Unknown_8Af033424F9590A15472A23Cc3236E68070B952E : FILE
 		$s3 = "fwrite($fp,base64_decode('" ascii
 
 	condition:
-		( uint16(0)==0x6324 and filesize <6KB and ( all of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x6324 and filesize < 6KB and ( all of ( $s* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Dkshell_4000Bd83451F0D8501A9Dfad60Dce39E55Ae167D : FILE
 {
@@ -322395,9 +320049,9 @@ rule SIGNATURE_BASE_Dkshell_4000Bd83451F0D8501A9Dfad60Dce39E55Ae167D : FILE
 		date = "2016-09-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9557-L9575"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "26d586e32d1b0b7800b4b61f592dadc3dd0583628e4cd3fa4e24e02067077da5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9557-L9575"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_26d586e32d1b0b7800b4b61f592dadc3dd0583628e4cd3fa4e24e02067077da5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322412,7 +320066,7 @@ rule SIGNATURE_BASE_Dkshell_4000Bd83451F0D8501A9Dfad60Dce39E55Ae167D : FILE
 		$s9 = "$x = $_GET[\"x\"];" fullword ascii
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <200KB and 1 of ($x*)) or (3 of them )
+		( uint16( 0 ) == 0x3f3c and filesize < 200KB and 1 of ( $x* ) ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_Webshell_5786D7D9F4B0Df731D79Ed927Fb5A124195Fc901 : FILE
 {
@@ -322423,9 +320077,9 @@ rule SIGNATURE_BASE_Webshell_5786D7D9F4B0Df731D79Ed927Fb5A124195Fc901 : FILE
 		date = "2016-09-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9577-L9591"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "348ccdf997965fbea791d835f1dd4e2c16d37a17ff4195e585fa4226f18faad6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9577-L9591"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_348ccdf997965fbea791d835f1dd4e2c16d37a17ff4195e585fa4226f18faad6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322437,7 +320091,7 @@ rule SIGNATURE_BASE_Webshell_5786D7D9F4B0Df731D79Ed927Fb5A124195Fc901 : FILE
 		$s2 = "input[type=text], input[type=password]{" fullword ascii
 
 	condition:
-		( uint16(0)==0x6c3c and filesize <80KB and all of them )
+		( uint16( 0 ) == 0x6c3c and filesize < 80KB and all of them )
 }
 rule SIGNATURE_BASE_Webshell_E8Eaf8Da94012E866E51547Cd63Bb996379690Bf : FILE
 {
@@ -322448,9 +320102,9 @@ rule SIGNATURE_BASE_Webshell_E8Eaf8Da94012E866E51547Cd63Bb996379690Bf : FILE
 		date = "2016-09-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9593-L9608"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "044491f0b07ef606aa76e70a07d161565f9cecf73e8f9f8db63cacc1c475b056"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9593-L9608"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_044491f0b07ef606aa76e70a07d161565f9cecf73e8f9f8db63cacc1c475b056"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322463,7 +320117,7 @@ rule SIGNATURE_BASE_Webshell_E8Eaf8Da94012E866E51547Cd63Bb996379690Bf : FILE
 		$x3 = "@exec('tar -xvf mysqldumper.tar.gz');" fullword ascii
 
 	condition:
-		( uint16(0)==0x213c and filesize <100KB and 1 of ($x*)) or (2 of them )
+		( uint16( 0 ) == 0x213c and filesize < 100KB and 1 of ( $x* ) ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Unknown_0F06C5D1B32F4994C3B3Abf8Bb76D5468F105167 : FILE
 {
@@ -322474,9 +320128,9 @@ rule SIGNATURE_BASE_Unknown_0F06C5D1B32F4994C3B3Abf8Bb76D5468F105167 : FILE
 		date = "2016-09-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9610-L9625"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f4bdf8aecd527335c29a8e964c7d8688c3e77419595d3fd10a6cf3704711816"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9610-L9625"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f4bdf8aecd527335c29a8e964c7d8688c3e77419595d3fd10a6cf3704711816"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322489,7 +320143,7 @@ rule SIGNATURE_BASE_Unknown_0F06C5D1B32F4994C3B3Abf8Bb76D5468F105167 : FILE
 		$s3 = "fwrite($fp,base64_decode('" ascii
 
 	condition:
-		( uint16(0)==0x6324 and filesize <2KB and all of them )
+		( uint16( 0 ) == 0x6324 and filesize < 2KB and all of them )
 }
 rule SIGNATURE_BASE_Wsoshell_0Bbebaf46F87718Caba581163D4Beed56Ddf73A7 : FILE
 {
@@ -322500,9 +320154,9 @@ rule SIGNATURE_BASE_Wsoshell_0Bbebaf46F87718Caba581163D4Beed56Ddf73A7 : FILE
 		date = "2016-09-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9627-L9641"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf5090fb909fea690c8a2af3cca35136eda3b9773976189158c25fb8877cc266"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9627-L9641"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf5090fb909fea690c8a2af3cca35136eda3b9773976189158c25fb8877cc266"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322514,7 +320168,7 @@ rule SIGNATURE_BASE_Wsoshell_0Bbebaf46F87718Caba581163D4Beed56Ddf73A7 : FILE
 		$s9 = "$mosimage_session = \"" fullword ascii
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x3f3c and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Webshell_Generic_1609_A : FILE
 {
@@ -322525,9 +320179,9 @@ rule SIGNATURE_BASE_Webshell_Generic_1609_A : FILE
 		date = "2016-09-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9643-L9658"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e5a4bba3a7b1c712203fcc8b85e4089b0ff18a26e96f5a04529616dbfb9de651"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9643-L9658"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e5a4bba3a7b1c712203fcc8b85e4089b0ff18a26e96f5a04529616dbfb9de651"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322540,7 +320194,7 @@ rule SIGNATURE_BASE_Webshell_Generic_1609_A : FILE
 		$s1 = "return $qwery45234dws($b);" fullword ascii
 
 	condition:
-		( uint16(0)==0x3f3c and 1 of them )
+		( uint16( 0 ) == 0x3f3c and 1 of them )
 }
 rule SIGNATURE_BASE_Nishang_Webshell : FILE
 {
@@ -322551,9 +320205,9 @@ rule SIGNATURE_BASE_Nishang_Webshell : FILE
 		date = "2016-09-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/samratashok/nishang"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9660-L9675"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b8a3c8e80a4e41e556e2d65df4126d84723ded6ca623302afc4cc328bded346c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9660-L9675"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b8a3c8e80a4e41e556e2d65df4126d84723ded6ca623302afc4cc328bded346c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322566,7 +320220,7 @@ rule SIGNATURE_BASE_Nishang_Webshell : FILE
 		$s4 = "<asp:Button ID=\"executesql\" runat=\"server\" Text=\"Execute SQL Query\"" ascii
 
 	condition:
-		( uint16(0)==0x253C and filesize <100KB and 1 of ($s*))
+		( uint16( 0 ) == 0x253C and filesize < 100KB and 1 of ( $s* ) )
 }
 rule SIGNATURE_BASE_PHP_Webshell_1_Feb17 : FILE
 {
@@ -322577,9 +320231,9 @@ rule SIGNATURE_BASE_PHP_Webshell_1_Feb17 : FILE
 		date = "2017-02-28"
 		modified = "2023-12-05"
 		reference = "https://isc.sans.edu/diary/Analysis+of+a+Simple+PHP+Backdoor/22127"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9687-L9708"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c8576b20ec3f81b3ef0aa5a508c94e07d591d68767cb4598ad10778b4305915d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9687-L9708"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c8576b20ec3f81b3ef0aa5a508c94e07d591d68767cb4598ad10778b4305915d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322595,7 +320249,7 @@ rule SIGNATURE_BASE_PHP_Webshell_1_Feb17 : FILE
 		$s3 = "$data = @unserialize(sh_decrypt(@base64_decode($data),$data_key));" ascii
 
 	condition:
-		uint32(0)==0x68703f3c and ($h1 at 0 and 1 of them ) or 2 of them
+		uint32( 0 ) == 0x68703f3c and ( $h1 at 0 and 1 of them ) or 2 of them
 }
 rule SIGNATURE_BASE_Webshell_Tiny_JSP_2 : FILE
 {
@@ -322606,9 +320260,9 @@ rule SIGNATURE_BASE_Webshell_Tiny_JSP_2 : FILE
 		date = "2015-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9710-L9722"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6fd514df9d53293a8cfd4b9c807f993558e39979592aa221f18cd76079c00fb7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9710-L9722"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6fd514df9d53293a8cfd4b9c807f993558e39979592aa221f18cd76079c00fb7"
 		score = 100
 		quality = 85
 		tags = "FILE"
@@ -322618,7 +320272,7 @@ rule SIGNATURE_BASE_Webshell_Tiny_JSP_2 : FILE
 		$s1 = "<%eval(Request(" nocase
 
 	condition:
-		uint16(0)==0x253c and filesize <40 and all of them
+		uint16( 0 ) == 0x253c and filesize < 40 and all of them
 }
 rule SIGNATURE_BASE_Wordpress_Config_Webshell_Preprend : FILE
 {
@@ -322629,9 +320283,9 @@ rule SIGNATURE_BASE_Wordpress_Config_Webshell_Preprend : FILE
 		date = "2017-06-25"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9734-L9756"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "97d7b85fa191380fe8b26ea60c8735a8f7179acc3a496ff0fc0dc5eefde2fe8a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9734-L9756"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_97d7b85fa191380fe8b26ea60c8735a8f7179acc3a496ff0fc0dc5eefde2fe8a"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -322644,7 +320298,7 @@ rule SIGNATURE_BASE_Wordpress_Config_Webshell_Preprend : FILE
 		$fp1 = "iThemes Security Config" ascii
 
 	condition:
-		uint32(0)==0x68703f3c and filesize <400KB and $x1 and all of ($s*) and not $x1 in (0..1000) and not 1 of ($fp*)
+		uint32( 0 ) == 0x68703f3c and filesize < 400KB and $x1 and all of ( $s* ) and not $x1 in ( 0 .. 1000 ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_PAS_Webshell_Encoded : FILE
 {
@@ -322655,9 +320309,9 @@ rule SIGNATURE_BASE_PAS_Webshell_Encoded : FILE
 		date = "2017-07-11"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2017/07/the-medoc-connection.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9767-L9802"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "59f4f8caa60c2367b46f6af1aefa62e03e228b382ff58be3a27dad527a685eca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9767-L9802"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_59f4f8caa60c2367b46f6af1aefa62e03e228b382ff58be3a27dad527a685eca"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -322677,7 +320331,7 @@ rule SIGNATURE_BASE_PAS_Webshell_Encoded : FILE
 		$foot2 = "();}} @header(\"Status: 404 Not Found\"); ?>"
 
 	condition:
-		( uint32(0)==0x68703f3c and filesize <80KB and (3 of them or $head1 at 0 or $head2 in (0..20) or 1 of ($x*))) or $foot1 at ( filesize -52) or $foot2 at ( filesize -44)
+		( uint32( 0 ) == 0x68703f3c and filesize < 80KB and ( 3 of them or $head1 at 0 or $head2 in ( 0 .. 20 ) or 1 of ( $x* ) ) ) or $foot1 at ( filesize - 52 ) or $foot2 at ( filesize - 44 )
 }
 rule SIGNATURE_BASE_ALFA_SHELL : FILE
 {
@@ -322688,9 +320342,9 @@ rule SIGNATURE_BASE_ALFA_SHELL : FILE
 		date = "2017-09-21"
 		modified = "2023-12-05"
 		reference = "Internal Research - APT33"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9814-L9832"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "651568b2b95c9e5c2b60fb3245e5afe4290235979e3df15bad96ccd08ae234ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9814-L9832"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_651568b2b95c9e5c2b60fb3245e5afe4290235979e3df15bad96ccd08ae234ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322706,7 +320360,7 @@ rule SIGNATURE_BASE_ALFA_SHELL : FILE
 		$f1 = { 76 2F 38 76 2F 36 76 2F 2B 76 2F 2F 66 38 46 27 29 3B 3F 3E 0D 0A }
 
 	condition:
-		( filesize <900KB and 2 of ($x*) or $f1 at ( filesize -22))
+		( filesize < 900KB and 2 of ( $x* ) or $f1 at ( filesize - 22 ) )
 }
 rule SIGNATURE_BASE_Webshell_FOPO_Obfuscation_APT_ON_Nov17_1 : FILE
 {
@@ -322717,9 +320371,9 @@ rule SIGNATURE_BASE_Webshell_FOPO_Obfuscation_APT_ON_Nov17_1 : FILE
 		date = "2017-11-17"
 		modified = "2023-12-05"
 		reference = "Internal Research - ON"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9834-L9853"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c5bc3ee0218d4ce6902e49d7f938264ecd158f1f458e2fcef878f06f003ed08"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9834-L9853"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c5bc3ee0218d4ce6902e49d7f938264ecd158f1f458e2fcef878f06f003ed08"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322732,7 +320386,7 @@ rule SIGNATURE_BASE_Webshell_FOPO_Obfuscation_APT_ON_Nov17_1 : FILE
 		$f1 = { 22 29 29 3B 0D 0A 3F 3E }
 
 	condition:
-		uint16(0)==0x3f3c and filesize <800KB and ($x1 or ($s1 in (0..350) and $f1 at ( filesize -23)))
+		uint16( 0 ) == 0x3f3c and filesize < 800KB and ( $x1 or ( $s1 in ( 0 .. 350 ) and $f1 at ( filesize - 23 ) ) )
 }
 rule SIGNATURE_BASE_Webshell_Jexboss_JSP_1 : FILE
 {
@@ -322743,9 +320397,9 @@ rule SIGNATURE_BASE_Webshell_Jexboss_JSP_1 : FILE
 		date = "2018-11-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9855-L9872"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f540bbc88bffd0c961837416bd5166fd3cb54b6124ffffbf1cd60e49ab01bd30"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9855-L9872"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f540bbc88bffd0c961837416bd5166fd3cb54b6124ffffbf1cd60e49ab01bd30"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322759,7 +320413,7 @@ rule SIGNATURE_BASE_Webshell_Jexboss_JSP_1 : FILE
 		$s3 = "String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); }}%>" fullword ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <1KB and 1 of ($x*) or 2 of them
+		uint16( 0 ) == 0x253c and filesize < 1KB and 1 of ( $x* ) or 2 of them
 }
 rule SIGNATURE_BASE_Webshell_Jexboss_WAR_1 : FILE
 {
@@ -322770,9 +320424,9 @@ rule SIGNATURE_BASE_Webshell_Jexboss_WAR_1 : FILE
 		date = "2018-11-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9874-L9897"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ee9cb22496d2e36d215caa9c7e295b41cb8434322a0097bbc3d1a365dce0c156"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9874-L9897"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ee9cb22496d2e36d215caa9c7e295b41cb8434322a0097bbc3d1a365dce0c156"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322793,7 +320447,7 @@ rule SIGNATURE_BASE_Webshell_Jexboss_WAR_1 : FILE
 		$ = "jexws4.jspPK" fullword ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <4KB and 1 of them
+		uint16( 0 ) == 0x4b50 and filesize < 4KB and 1 of them
 }
 rule SIGNATURE_BASE_Webshell_Tinyasp : FILE
 {
@@ -322804,9 +320458,9 @@ rule SIGNATURE_BASE_Webshell_Tinyasp : FILE
 		date = "2019-01-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9899-L9910"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d8b7db89ea623d5bcf14476779df727827cfc752d4c6ba4208445fd7305e6943"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9899-L9910"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d8b7db89ea623d5bcf14476779df727827cfc752d4c6ba4208445fd7305e6943"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -322816,7 +320470,7 @@ rule SIGNATURE_BASE_Webshell_Tinyasp : FILE
 		$s1 = "Execute Request" ascii wide nocase
 
 	condition:
-		uint16(0)==0x253c and filesize <150 and 1 of them
+		uint16( 0 ) == 0x253c and filesize < 150 and 1 of them
 }
 rule SIGNATURE_BASE_WEBSHELL_ASPX_Mar21_1 : FILE
 {
@@ -322827,9 +320481,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Mar21_1 : FILE
 		date = "2021-03-12"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-webshells.yar#L9912-L9937"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "acc0d67326d1f764d6fc54681b38f491c55968ec34e40d181426cfcf418eeb21"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-webshells.yar#L9912-L9937"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_acc0d67326d1f764d6fc54681b38f491c55968ec34e40d181426cfcf418eeb21"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -322850,7 +320504,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Mar21_1 : FILE
 		$s3 = "<?xml version=\"\"1.0\"\"?><root>test</root>\";" ascii fullword
 
 	condition:
-		uint16(0)==0x253c and filesize <6KB and all of them
+		uint16( 0 ) == 0x253c and filesize < 6KB and all of them
 }
 rule SIGNATURE_BASE_Seaduke_Sample : FILE
 {
@@ -322861,10 +320515,10 @@ rule SIGNATURE_BASE_Seaduke_Sample : FILE
 		date = "2015-07-14"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/MJ0c2M"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_seaduke_unit42.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_seaduke_unit42.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d2e570129a12a47231a1ecb8176fa88a1bf415c51dabd885c513d98b15f75d4e"
-		logic_hash = "3bec2bedaafddd17ee65747f8be773287eda784bdfa8fc11e8378737139ef94e"
+		logic_hash = "v1_sha256_3bec2bedaafddd17ee65747f8be773287eda784bdfa8fc11e8378737139ef94e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -322878,10 +320532,8 @@ rule SIGNATURE_BASE_Seaduke_Sample : FILE
 		$s4 = "mod is NULL - %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT37_Smb_Scanner : FILE
 {
 	meta:
@@ -322891,9 +320543,9 @@ rule SIGNATURE_BASE_Hvs_APT37_Smb_Scanner : FILE
 		date = "2020-12-15"
 		modified = "2023-12-05"
 		reference = "https://www.hybrid-analysis.com/sample/d16163526242508d6961f061aaffe3ae5321bd64d8ceb6b2788f1570757595fc?environmentId=2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec20.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bea71db7052f1c22c01cfbf710d4ed24651cbbd8b0fd29f09dfd49c4e314028"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec20.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bea71db7052f1c22c01cfbf710d4ed24651cbbd8b0fd29f09dfd49c4e314028"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322917,10 +320569,8 @@ rule SIGNATURE_BASE_Hvs_APT37_Smb_Scanner : FILE
 		$s15 = "Share:              Type:                   Remark:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (10 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 10 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT37_Cred_Tool : FILE
 {
 	meta:
@@ -322930,9 +320580,9 @@ rule SIGNATURE_BASE_Hvs_APT37_Cred_Tool : FILE
 		date = "2020-12-15"
 		modified = "2023-12-05"
 		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec20.yar#L31-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4fb7247b88f2d252e7c9d5034c209945bc9e17f49de3dcdb5bf50b5afb302987"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec20.yar#L31-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4fb7247b88f2d252e7c9d5034c209945bc9e17f49de3dcdb5bf50b5afb302987"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -322949,7 +320599,7 @@ rule SIGNATURE_BASE_Hvs_APT37_Cred_Tool : FILE
 		$s8 = "E@c:\\u" fullword ascii
 
 	condition:
-		filesize <500KB and 7 of them
+		filesize < 500KB and 7 of them
 }
 import "pe"
 
@@ -322962,20 +320612,18 @@ rule SIGNATURE_BASE_Hvs_APT37_RAT_Loader
 		date = "2020-12-15"
 		modified = "2023-12-05"
 		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec20.yar#L52-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec20.yar#L52-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9"
-		logic_hash = "241f2683adc29e8aca30ae24278f3703fef0fed6b276dae488fdb32c167af1c9"
+		logic_hash = "v1_sha256_241f2683adc29e8aca30ae24278f3703fef0fed6b276dae488fdb32c167af1c9"
 		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	condition:
-		(pe.version_info["OriginalFilename"] contains "MFC_DLL.dll") and (pe.exports("SMain") and pe.exports("SMainW"))
+		(pe.version_info [ "OriginalFilename" ] contains "MFC_DLL.dll" ) and ( pe.exports ( "SMain" ) and pe.exports ( "SMainW" ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT37_Webshell_Img_Thumbs_Asp : FILE
 {
 	meta:
@@ -322985,10 +320633,10 @@ rule SIGNATURE_BASE_Hvs_APT37_Webshell_Img_Thumbs_Asp : FILE
 		date = "2020-12-15"
 		modified = "2023-12-05"
 		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec20.yar#L68-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec20.yar#L68-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "94d2448d3794ae3f29678a7337473d259b5cfd1c7f703fe53ee6c84dd10a48ef"
-		logic_hash = "58ccee11c08330c8cd4148e623a2e59e024d6d5f3067331dbdd962d0f6a8daa4"
+		logic_hash = "v1_sha256_58ccee11c08330c8cd4148e623a2e59e024d6d5f3067331dbdd962d0f6a8daa4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323010,10 +320658,8 @@ rule SIGNATURE_BASE_Hvs_APT37_Webshell_Img_Thumbs_Asp : FILE
 		$g5 = "Option Explicit" fullword ascii
 
 	condition:
-		filesize <2KB and ((1 of ($s*)) or (3 of ($a*)) or (5 of ($g*)))
+		filesize < 2KB and ( ( 1 of ( $s* ) ) or ( 3 of ( $a* ) ) or ( 5 of ( $g* ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT37_Webshell_Template_Query_Asp : FILE
 {
 	meta:
@@ -323023,10 +320669,10 @@ rule SIGNATURE_BASE_Hvs_APT37_Webshell_Template_Query_Asp : FILE
 		date = "2020-12-15"
 		modified = "2023-12-05"
 		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec20.yar#L97-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec20.yar#L97-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "961a66d01c86fa5982e0538215b17fb9fae2991331dfea812b8c031e2ceb0d90"
-		logic_hash = "d8bd017e9103bddb0b8a86effa8a4b0617b54bd643bcc36b6f678a3e60f8559f"
+		logic_hash = "v1_sha256_d8bd017e9103bddb0b8a86effa8a4b0617b54bd643bcc36b6f678a3e60f8559f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323044,10 +320690,8 @@ rule SIGNATURE_BASE_Hvs_APT37_Webshell_Template_Query_Asp : FILE
 		$s1 = "public  br,ygv,gbc,ydo,yka,wzd,sod,vmd" fullword ascii
 
 	condition:
-		filesize >70KB and filesize <200KB and ((1 of ($s*)) or (2 of ($a*)) or (3 of ($g*)))
+		filesize > 70KB and filesize < 200KB and ( ( 1 of ( $s* ) ) or ( 2 of ( $a* ) ) or ( 3 of ( $g* ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hvs_APT37_Webshell_Controllers_Asp : FILE
 {
 	meta:
@@ -323057,10 +320701,10 @@ rule SIGNATURE_BASE_Hvs_APT37_Webshell_Controllers_Asp : FILE
 		date = "2020-12-15"
 		modified = "2023-12-05"
 		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_dec20.yar#L140-L218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_dec20.yar#L140-L218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "829462fc6d84aae04a962dfc919d0a392265fbf255eab399980d2b021e385517"
-		logic_hash = "a6e53e99f7500683d3b62a7630cecb53ee6c13b335cbf9912366675db964aefe"
+		logic_hash = "v1_sha256_a6e53e99f7500683d3b62a7630cecb53ee6c13b335cbf9912366675db964aefe"
 		score = 75
 		quality = 28
 		tags = "FILE"
@@ -323134,7 +320778,7 @@ rule SIGNATURE_BASE_Hvs_APT37_Webshell_Controllers_Asp : FILE
 		$x64 = { 64 7F 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
 
 	condition:
-		filesize >50KB and filesize <200KB and ($s0 and 1 of ($x*))
+		filesize > 50KB and filesize < 200KB and ( $s0 and 1 of ( $x* ) )
 }
 import "pe"
 
@@ -323147,9 +320791,9 @@ rule SIGNATURE_BASE_VULN_Printerdriver_Privesc_CVE_2021_3438_Jul21 : FILE
 		date = "2021-07-20"
 		modified = "2023-12-05"
 		reference = "https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_cve_2021_3438_printdriver.yar#L4-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b58c2623c8fb84162c1c9390d0398639061ed5b1d4a8e007685e6fabe42bde54"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_cve_2021_3438_printdriver.yar#L4-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b58c2623c8fb84162c1c9390d0398639061ed5b1d4a8e007685e6fabe42bde54"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -323160,7 +320804,7 @@ rule SIGNATURE_BASE_VULN_Printerdriver_Privesc_CVE_2021_3438_Jul21 : FILE
 		$s2 = "\\DosDevices\\ssportc" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of ($s*) and 1613606400>=pe.timestamp
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of ( $s* ) and 1613606400 >= pe.timestamp
 }
 import "pe"
 
@@ -323173,9 +320817,9 @@ rule SIGNATURE_BASE_Unspecified_Malware_Sep1_A1 : FILE
 		date = "2017-09-12"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dragonfly.yar#L13-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d235dc964ac74d2b635251d07b2a9119b731a6c3c45b6b2a81ca88e6fc8b63b7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dragonfly.yar#L13-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d235dc964ac74d2b635251d07b2a9119b731a6c3c45b6b2a81ca88e6fc8b63b7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323183,10 +320827,8 @@ rule SIGNATURE_BASE_Unspecified_Malware_Sep1_A1 : FILE
 		hash1 = "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and pe.imphash()=="17a4bd9c95f2898add97f309fc6f9bcd")
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and pe.imphash ( ) == "17a4bd9c95f2898add97f309fc6f9bcd" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Dragonfly_APT_Sep17_1 : FILE
 {
 	meta:
@@ -323196,9 +320838,9 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_1 : FILE
 		date = "2017-09-12"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dragonfly.yar#L29-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c885fb690b7e047203529f0c4a6dd60dea822ce60a47e42b52d3216bc26da62e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dragonfly.yar#L29-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c885fb690b7e047203529f0c4a6dd60dea822ce60a47e42b52d3216bc26da62e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323211,10 +320853,8 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_1 : FILE
 		$s3 = "*pass*.*" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Dragonfly_APT_Sep17_2 : FILE
 {
 	meta:
@@ -323224,9 +320864,9 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_2 : FILE
 		date = "2017-09-12"
 		modified = "2023-01-06"
 		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dragonfly.yar#L46-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "433711dd15c8d1044b381046747194e47402288df06da6bbc61055dc9c90f52a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dragonfly.yar#L46-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_433711dd15c8d1044b381046747194e47402288df06da6bbc61055dc9c90f52a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323243,7 +320883,7 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_2 : FILE
 		$s8 = "**************** Internet Explorer ***************" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and 3 of them )
 }
 import "pe"
 
@@ -323256,9 +320896,9 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_3 : FILE
 		date = "2017-09-12"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dragonfly.yar#L68-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f564685eb1426d1a3eb888a888bfdf3a8fa9bc96af07fb0bc5f10c0a324f1d9d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dragonfly.yar#L68-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f564685eb1426d1a3eb888a888bfdf3a8fa9bc96af07fb0bc5f10c0a324f1d9d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323272,10 +320912,8 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_3 : FILE
 		$s4 = "AWAVAUATWVSU" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and (pe.imphash()=="6f03fb864ff388bac8680ac5303584be" or all of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 40KB and ( pe.imphash ( ) == "6f03fb864ff388bac8680ac5303584be" or all of them ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Dragonfly_APT_Sep17_4 : FILE
 {
 	meta:
@@ -323285,9 +320923,9 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_4 : FILE
 		date = "2017-09-12"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dragonfly.yar#L91-L109"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "61af81f0cd1eccba3a1000e6715c9715e8e67849e5edd4279728a7e47bd8cb75"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dragonfly.yar#L91-L109"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_61af81f0cd1eccba3a1000e6715c9715e8e67849e5edd4279728a7e47bd8cb75"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323303,7 +320941,7 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_4 : FILE
 		$s6 = "Too many arguments, going to store in current dir" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them )
 }
 rule SIGNATURE_BASE_Cobaltstrike_C2_Host_Indicator : FILE
 {
@@ -323314,9 +320952,9 @@ rule SIGNATURE_BASE_Cobaltstrike_C2_Host_Indicator : FILE
 		date = "2019-08-16"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cobaltstrike_evasive.yar#L1-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4761e282e9473ba665a597894ed514d057309703a7d5b4e462ef0e779bbb8c39"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cobaltstrike_evasive.yar#L1-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4761e282e9473ba665a597894ed514d057309703a7d5b4e462ef0e779bbb8c39"
 		score = 60
 		quality = 65
 		tags = "FILE"
@@ -323326,7 +320964,7 @@ rule SIGNATURE_BASE_Cobaltstrike_C2_Host_Indicator : FILE
 		$c2_indicator = "#Host:"
 
 	condition:
-		$c2_indicator and not $c2_indicator_fp and not uint32(0)==0x0a786564 and not uint32(0)==0x0a796564
+		$c2_indicator and not $c2_indicator_fp and not uint32( 0 ) == 0x0a786564 and not uint32( 0 ) == 0x0a796564
 }
 rule SIGNATURE_BASE_Cobaltstrike_Sleep_Decoder_Indicator
 {
@@ -323337,9 +320975,9 @@ rule SIGNATURE_BASE_Cobaltstrike_Sleep_Decoder_Indicator
 		date = "2021-07-19"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cobaltstrike_evasive.yar#L16-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f3243c326df18edbd15c2d9120379588e61709efb9295b9584c0565c04ee38a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cobaltstrike_evasive.yar#L16-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f3243c326df18edbd15c2d9120379588e61709efb9295b9584c0565c04ee38a5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -323359,9 +320997,9 @@ rule SIGNATURE_BASE_Cobaltstrike_C2_Encoded_XOR_Config_Indicator
 		date = "2021-07-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cobaltstrike_evasive.yar#L28-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6b25ee9064e925c183ef7599c95ecffce48c7f96eea714fa5f6441b21716277e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cobaltstrike_evasive.yar#L28-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6b25ee9064e925c183ef7599c95ecffce48c7f96eea714fa5f6441b21716277e"
 		score = 75
 		quality = 60
 		tags = ""
@@ -323626,7 +321264,7 @@ rule SIGNATURE_BASE_Cobaltstrike_C2_Encoded_XOR_Config_Indicator
 		$fp1 = "ICSharpCode.Decompiler" wide
 
 	condition:
-		any of ($s*) and not 1 of ($fp*)
+		any of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Cobaltstrike_MZ_Launcher
 {
@@ -323637,9 +321275,9 @@ rule SIGNATURE_BASE_Cobaltstrike_MZ_Launcher
 		date = "2021-07-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cobaltstrike_evasive.yar#L297-L307"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aa188546db138dffdcdbf6538367b5d5bc37638a2784b24b7fcd913c15e56072"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cobaltstrike_evasive.yar#L297-L307"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aa188546db138dffdcdbf6538367b5d5bc37638a2784b24b7fcd913c15e56072"
 		score = 75
 		quality = 85
 		tags = ""
@@ -323659,9 +321297,9 @@ rule SIGNATURE_BASE_Cobaltstrike_Unmodifed_Beacon
 		date = "2019-08-16"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cobaltstrike_evasive.yar#L309-L320"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "10114a431fb70be8e18e67b22aa76bf2c0536f07d373f717c1dc51755e0847c9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cobaltstrike_evasive.yar#L309-L320"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_10114a431fb70be8e18e67b22aa76bf2c0536f07d373f717c1dc51755e0847c9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -323682,9 +321320,9 @@ rule SIGNATURE_BASE_Darkeyev3_Cryptor : FILE
 		date = "2015-05-24"
 		modified = "2023-12-05"
 		reference = "http://darkeyev3.blogspot.fi/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_cryptors.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fdd3a9c22aebb40d000a642f2433adc7dd591784bdf2924edc3effce7bbfa5c2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_cryptors.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fdd3a9c22aebb40d000a642f2433adc7dd591784bdf2924edc3effce7bbfa5c2"
 		score = 55
 		quality = 85
 		tags = "FILE"
@@ -323703,7 +321341,7 @@ rule SIGNATURE_BASE_Darkeyev3_Cryptor : FILE
 		$s0 = "\\DarkEYEV3-"
 
 	condition:
-		uint16(0)==0x5a4d and $s0
+		uint16( 0 ) == 0x5a4d and $s0
 }
 rule SIGNATURE_BASE_Rtf_CVE_2018_0802 : CVE_2018_0802 FILE
 {
@@ -323714,9 +321352,9 @@ rule SIGNATURE_BASE_Rtf_CVE_2018_0802 : CVE_2018_0802 FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://www.freebuf.com/vuls/159789.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2018_0802.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ac1cd4f2162d2c8415e2ee5167cabb8e8aff08a06afe244f5bfe099f2d3fbeb4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2018_0802.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ac1cd4f2162d2c8415e2ee5167cabb8e8aff08a06afe244f5bfe099f2d3fbeb4"
 		score = 75
 		quality = 83
 		tags = "CVE-2018-0802, FILE"
@@ -323726,7 +321364,7 @@ rule SIGNATURE_BASE_Rtf_CVE_2018_0802 : CVE_2018_0802 FILE
 		$header_and_shellcode = /03010[0,1][0-9a-fA-F]{308,310}2500/ ascii nocase
 
 	condition:
-		uint32be(0)==0x7B5C7274 and all of them
+		uint32be( 0 ) == 0x7B5C7274 and all of them
 }
 import "pe"
 
@@ -323739,15 +321377,15 @@ rule SIGNATURE_BASE_APT_APT10_Malware_Imphash_Dec18_1 : FILE
 		date = "2018-12-28"
 		modified = "2023-12-05"
 		reference = "AlienVault OTX IOCs - statistical sample analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt10.yar#L1390-L1406"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d6e2f23f3809e7a7064bfe4859db3480454a9c8b21ffac2e1e8b7b8a8906de93"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt10.yar#L1390-L1406"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d6e2f23f3809e7a7064bfe4859db3480454a9c8b21ffac2e1e8b7b8a8906de93"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and (pe.imphash()=="0556ff5e5f8744bff47d4921494ba46d" or pe.imphash()=="cb1194123f68a68eb14552c085b620ce" or pe.imphash()=="efad9ff8c0d2a6419bf1dd970bcd806d" or pe.imphash()=="7a861cd9c495e1d950a43cb708a22985" or pe.imphash()=="a5d0545030be75a421529c2b0be6c4bd" or pe.imphash()=="94491f4a812b0297419dc888aa4fd2a5")
+		uint16( 0 ) == 0x5a4d and filesize < 6000KB and ( pe.imphash ( ) == "0556ff5e5f8744bff47d4921494ba46d" or pe.imphash ( ) == "cb1194123f68a68eb14552c085b620ce" or pe.imphash ( ) == "efad9ff8c0d2a6419bf1dd970bcd806d" or pe.imphash ( ) == "7a861cd9c495e1d950a43cb708a22985" or pe.imphash ( ) == "a5d0545030be75a421529c2b0be6c4bd" or pe.imphash ( ) == "94491f4a812b0297419dc888aa4fd2a5" )
 }
 rule SIGNATURE_BASE_Gen_Trojan_Mikey : FILE
 {
@@ -323758,10 +321396,10 @@ rule SIGNATURE_BASE_Gen_Trojan_Mikey : FILE
 		date = "2015-05-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mikey_trojan.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mikey_trojan.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a8e6c3ca056b3ff2495d7728654b780735b3a4cb"
-		logic_hash = "5454953bba09d6fc866bcb23ef81a0b6763d8f82b8b606597548cbb5cf6053ed"
+		logic_hash = "v1_sha256_5454953bba09d6fc866bcb23ef81a0b6763d8f82b8b606597548cbb5cf6053ed"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -323776,7 +321414,7 @@ rule SIGNATURE_BASE_Gen_Trojan_Mikey : FILE
 		$x5 = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $s0 and 2 of ($x*)
+		uint16( 0 ) == 0x5a4d and $s0 and 2 of ( $x* )
 }
 rule SIGNATURE_BASE_Eternalrocks_Taskhost : FILE
 {
@@ -323787,9 +321425,9 @@ rule SIGNATURE_BASE_Eternalrocks_Taskhost : FILE
 		date = "2017-05-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/stamparm/status/864865144748298242"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_eternalrocks.yar#L12-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "45e5295f34280078c586c4cb643dba65aed63beffb1d6ded05de03403caf273a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_eternalrocks.yar#L12-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_45e5295f34280078c586c4cb643dba65aed63beffb1d6ded05de03403caf273a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323804,7 +321442,7 @@ rule SIGNATURE_BASE_Eternalrocks_Taskhost : FILE
 		$s4 = "9EBF75119B8FC7733F77B06378F9E735D34664F6" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and 1 of ($x*) or 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_Eternalrocks_Svchost : FILE
 {
@@ -323815,9 +321453,9 @@ rule SIGNATURE_BASE_Eternalrocks_Svchost : FILE
 		date = "2017-05-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/stamparm/status/864865144748298242"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_eternalrocks.yar#L32-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "989df6d582949adbc4e0e2063c99d9ad83c367cedae1030dc23aade091216602"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_eternalrocks.yar#L32-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_989df6d582949adbc4e0e2063c99d9ad83c367cedae1030dc23aade091216602"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323830,7 +321468,7 @@ rule SIGNATURE_BASE_Eternalrocks_Svchost : FILE
 		$s3 = "ConfuserEx v" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 2 of them )
 }
 rule SIGNATURE_BASE_Emissary_APT_Malware_1 : FILE
 {
@@ -323841,9 +321479,9 @@ rule SIGNATURE_BASE_Emissary_APT_Malware_1 : FILE
 		date = "2016-01-02"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/V0epcf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_emissary.yar#L8-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cab20ac0c17dcc5cb9d0c9f4cffe47e5880acd9dee935cb0eb1ef59579a23f17"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_emissary.yar#L8-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cab20ac0c17dcc5cb9d0c9f4cffe47e5880acd9dee935cb0eb1ef59579a23f17"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323875,7 +321513,7 @@ rule SIGNATURE_BASE_Emissary_APT_Malware_1 : FILE
 		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and 3 of them
 }
 import "pe"
 
@@ -323888,9 +321526,9 @@ rule SIGNATURE_BASE_MAL_WIPER_Isaacwiper_Mar22_1 : FILE
 		date = "2022-03-03"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_isaacwiper.yar#L3-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6fe7d1536db5fc30c9b4a171be66993fc69e6a1d96dae00be4170bdb4a53afb8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_isaacwiper.yar#L3-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6fe7d1536db5fc30c9b4a171be66993fc69e6a1d96dae00be4170bdb4a53afb8"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -323907,7 +321545,7 @@ rule SIGNATURE_BASE_MAL_WIPER_Isaacwiper_Mar22_1 : FILE
 		$op3 = { 8d 4d f4 ff 75 08 e8 12 ff ff ff 68 88 39 03 10 8d 45 f4 50 e8 2d 1d 00 00 cc }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (pe.imphash()=="a4b162717c197e11b76a4d9bc58ea25d" or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( pe.imphash ( ) == "a4b162717c197e11b76a4d9bc58ea25d" or 3 of them )
 }
 rule SIGNATURE_BASE_APT_Malware_Commentcrew_Miniasp : FILE
 {
@@ -323918,9 +321556,9 @@ rule SIGNATURE_BASE_APT_Malware_Commentcrew_Miniasp : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_miniasp.yar#L2-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f382dd802f0332c99b1d33cf1dcd99ba7fad344a381152ebadfb69bc74c4e58f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_miniasp.yar#L2-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f382dd802f0332c99b1d33cf1dcd99ba7fad344a381152ebadfb69bc74c4e58f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323949,7 +321587,7 @@ rule SIGNATURE_BASE_APT_Malware_Commentcrew_Miniasp : FILE
 		$s10 = "http://%s/result_%s.htm" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*)) or ( all of ($z*)) or (8 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) ) or ( all of ( $z* ) ) or ( 8 of ( $s* ) )
 }
 import "pe"
 
@@ -323962,9 +321600,9 @@ rule SIGNATURE_BASE_APT_ME_Bigbang_Gen_Jul18_1 : FILE
 		date = "2018-07-09"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bigbang.yar#L3-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "496994ee035aa09233c648cf4ec0d1e84ceb970917b4dc5208a1390ec6eb39c2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bigbang.yar#L3-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_496994ee035aa09233c648cf4ec0d1e84ceb970917b4dc5208a1390ec6eb39c2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -323985,10 +321623,8 @@ rule SIGNATURE_BASE_APT_ME_Bigbang_Gen_Jul18_1 : FILE
 		$x10 = "li%@%@nk.W%@%@indo@%%@%@%wS%@%@tyle = 3" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (1 of them or pe.imphash()=="0f09ea2a68d04f331df9a5d0f8641332")
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of them or pe.imphash ( ) == "0f09ea2a68d04f331df9a5d0f8641332" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_ME_Bigbang_Mal_Jul18_1 : FILE
 {
 	meta:
@@ -323998,9 +321634,9 @@ rule SIGNATURE_BASE_APT_ME_Bigbang_Mal_Jul18_1 : FILE
 		date = "2018-07-09"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bigbang.yar#L31-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "da45482b465549fce0f088c5818dff4a734faa2e4fbcec43b750893d1c3fefad"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bigbang.yar#L31-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_da45482b465549fce0f088c5818dff4a734faa2e4fbcec43b750893d1c3fefad"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324018,7 +321654,7 @@ rule SIGNATURE_BASE_APT_ME_Bigbang_Mal_Jul18_1 : FILE
 		$s7 = "%s%s%p%s%zd%s%d%s%s%s%s%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 4 of them
 }
 rule SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1 : FILE
 {
@@ -324029,9 +321665,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1 : FILE
 		date = "2021-03-12"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_dearcry_ransom.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e55507475888087c84f9624f82516e8a40aaf59bf2fbea72129a1dd134b28110"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_dearcry_ransom.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e55507475888087c84f9624f82516e8a40aaf59bf2fbea72129a1dd134b28110"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324051,7 +321687,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1 : FILE
 		$s9 = "EncryptFile.exe.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >1MB and filesize <2MB and (1 of ($x*) or 3 of them ) or 5 of them
+		uint16( 0 ) == 0x5a4d and filesize > 1MB and filesize < 2MB and ( 1 of ( $x* ) or 3 of them ) or 5 of them
 }
 rule SIGNATURE_BASE_MAL_CRIME_RANSOM_Dearcry_Mar21_1 : FILE
 {
@@ -324062,9 +321698,9 @@ rule SIGNATURE_BASE_MAL_CRIME_RANSOM_Dearcry_Mar21_1 : FILE
 		date = "2021-03-12"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_dearcry_ransom.yar#L29-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c4af7c29e917078f8658aca68ec95f8a03934f42c81fdd421639437e24f304bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_dearcry_ransom.yar#L29-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c4af7c29e917078f8658aca68ec95f8a03934f42c81fdd421639437e24f304bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324083,7 +321719,7 @@ rule SIGNATURE_BASE_MAL_CRIME_RANSOM_Dearcry_Mar21_1 : FILE
 		$op3 = { 31 40 00 13 31 40 00 a4 31 40 00 41 32 40 00 5f 33 40 00 e5 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and 3 of them or 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 4000KB and 3 of them or 5 of them
 }
 import "pe"
 
@@ -324096,9 +321732,9 @@ rule SIGNATURE_BASE_Tscookie_RAT : FILE
 		date = "2018-03-06"
 		modified = "2023-12-05"
 		reference = "http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_tscookie_rat.yar#L13-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c6121c541a77219b17351787973a4bc06a8d941ebd5f9e5e1e14ad4740a3fe7b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_tscookie_rat.yar#L13-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c6121c541a77219b17351787973a4bc06a8d941ebd5f9e5e1e14ad4740a3fe7b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324112,7 +321748,7 @@ rule SIGNATURE_BASE_Tscookie_RAT : FILE
 		$x4 = "----------------------- IE Passwords ------------------" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ((pe.exports("DoWork") and pe.exports("PrintF")) or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( ( pe.exports ( "DoWork" ) and pe.exports ( "PrintF" ) ) or 1 of them )
 }
 rule SIGNATURE_BASE_HKTL_Sentinelone_Remotepotato0_Privesc : FILE
 {
@@ -324123,9 +321759,9 @@ rule SIGNATURE_BASE_HKTL_Sentinelone_Remotepotato0_Privesc : FILE
 		date = "2021-04-26"
 		modified = "2023-12-05"
 		reference = "https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_remote_potato0.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f3a3a917908af6260f40b217f966750a095140abb6bf85cf3a728725bc16996f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_remote_potato0.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f3a3a917908af6260f40b217f966750a095140abb6bf85cf3a728725bc16996f"
 		score = 75
 		quality = 79
 		tags = "FILE"
@@ -324138,7 +321774,7 @@ rule SIGNATURE_BASE_HKTL_Sentinelone_Remotepotato0_Privesc : FILE
 		$clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and $import1 and $istorage_clsid and $meow_header and 1 of ($clsid*)
+		( uint16( 0 ) == 0x5A4D ) and $import1 and $istorage_clsid and $meow_header and 1 of ( $clsid* )
 }
 import "pe"
 
@@ -324151,8 +321787,8 @@ rule SIGNATURE_BASE_MAL_Malware_Imphash_Mar23_1 : HIGHVOL FILE
 		date = "2023-03-20"
 		modified = "2023-03-22"
 		reference = "https://yaraify.abuse.ch/statistics/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_imphash_detection.yar#L4-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_imphash_detection.yar#L4-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "167dde6bd578cbfcc587d5853e7fc2904cda10e737ca74b31df52ba24db6e7bc"
 		hash = "0a25a78c6b9df52e55455f5d52bcb3816460001cae3307b05e76ac70193b0636"
 		hash = "d87a35decd0b81382e0c98f83c7f4bf25a2b25baac90c9dcff5b5a147e33bcc8"
@@ -324196,7 +321832,7 @@ rule SIGNATURE_BASE_MAL_Malware_Imphash_Mar23_1 : HIGHVOL FILE
 		hash = "b9995d1987c4e8b6fb30d255948322cfad9cc212c7f8f4c5db3ac80e23071533"
 		hash = "a6a92ea0f27da1e678c15beb263647de43f68608afe82d6847450f16a11fe6c0"
 		hash = "866e3ea86671a62b677214f07890ddf7e8153bec56455ad083c800e6ab51be37"
-		logic_hash = "dcb4d9a1ca83bbd26178895f20f9ab443f48f42aa3ad3df042c763c24ce8c047"
+		logic_hash = "v1_sha256_dcb4d9a1ca83bbd26178895f20f9ab443f48f42aa3ad3df042c763c24ce8c047"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -324207,7 +321843,7 @@ rule SIGNATURE_BASE_MAL_Malware_Imphash_Mar23_1 : HIGHVOL FILE
 		$fp2 = "EXTRACTOPT" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and (pe.imphash()=="9ee34731129f4801db97fd66adbfeaa0" or pe.imphash()=="f9e8597c55008e10a8cdc8a0764d5341" or pe.imphash()=="0a76016a514d8ed3124268734a31e2d2" or pe.imphash()=="d3cbd6e8f81da85f6bf0529e69de9251" or pe.imphash()=="d8b32e731e5438c6329455786e51ab4b" or pe.imphash()=="cdf5bbb8693f29ef22aef04d2a161dd7" or pe.imphash()=="890e522b31701e079a367b89393329e6" or pe.imphash()=="bf5a4aa99e5b160f8521cadd6bfe73b8" or pe.imphash()=="646167cce332c1c252cdcb1839e0cf48" or pe.imphash()=="9f4693fc0c511135129493f2161d1e86" or pe.imphash()=="b4c6fff030479aa3b12625be67bf4914") and not 1 of ($fp*)
+		uint16( 0 ) == 0x5A4D and ( pe.imphash ( ) == "9ee34731129f4801db97fd66adbfeaa0" or pe.imphash ( ) == "f9e8597c55008e10a8cdc8a0764d5341" or pe.imphash ( ) == "0a76016a514d8ed3124268734a31e2d2" or pe.imphash ( ) == "d3cbd6e8f81da85f6bf0529e69de9251" or pe.imphash ( ) == "d8b32e731e5438c6329455786e51ab4b" or pe.imphash ( ) == "cdf5bbb8693f29ef22aef04d2a161dd7" or pe.imphash ( ) == "890e522b31701e079a367b89393329e6" or pe.imphash ( ) == "bf5a4aa99e5b160f8521cadd6bfe73b8" or pe.imphash ( ) == "646167cce332c1c252cdcb1839e0cf48" or pe.imphash ( ) == "9f4693fc0c511135129493f2161d1e86" or pe.imphash ( ) == "b4c6fff030479aa3b12625be67bf4914" ) and not 1 of ( $fp* )
 }
 import "pe"
 
@@ -324220,15 +321856,15 @@ rule SIGNATURE_BASE_HKTL_Imphashes_Aug22_1 : FILE
 		date = "2022-08-17"
 		modified = "2023-03-21"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_imphash_detection.yar#L93-L192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e76701b889138f9635cfe3a2f08710db3a6f0a3c3a15faa705ff0904d0566a1f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_imphash_detection.yar#L93-L192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e76701b889138f9635cfe3a2f08710db3a6f0a3c3a15faa705ff0904d0566a1f"
 		score = 80
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and (pe.imphash()=="bcca3c247b619dcd13c8cdff5f123932" or pe.imphash()=="3a19059bd7688cb88e70005f18efc439" or pe.imphash()=="bf6223a49e45d99094406777eb6004ba" or pe.imphash()=="0c106686a31bfe2ba931ae1cf6e9dbc6" or pe.imphash()=="0d1447d4b3259b3c2a1d4cfb7ece13c3" or pe.imphash()=="1b0369a1e06271833f78ffa70ffb4eaf" or pe.imphash()=="4c1b52a19748428e51b14c278d0f58e3" or pe.imphash()=="4d927a711f77d62cebd4f322cb57ec6f" or pe.imphash()=="66ee036df5fc1004d9ed5e9a94a1086a" or pe.imphash()=="672b13f4a0b6f27d29065123fe882dfc" or pe.imphash()=="6bbd59cea665c4afcc2814c1327ec91f" or pe.imphash()=="725bb81dc24214f6ecacc0cfb36ad30d" or pe.imphash()=="9528a0e91e28fbb88ad433feabca2456" or pe.imphash()=="9da6d5d77be11712527dcab86df449a3" or pe.imphash()=="a6e01bc1ab89f8d91d9eab72032aae88" or pe.imphash()=="b24c5eddaea4fe50c6a96a2a133521e4" or pe.imphash()=="d21bbc50dcc169d7b4d0f01962793154" or pe.imphash()=="fcc251cceae90d22c392215cc9a2d5d6" or pe.imphash()=="23867a89c2b8fc733be6cf5ef902f2d1" or pe.imphash()=="a37ff327f8d48e8a4d2f757e1b6e70bc" or pe.imphash()=="f9a28c458284584a93b14216308d31bd" or pe.imphash()=="6118619783fc175bc7ebecff0769b46e" or pe.imphash()=="959a83047e80ab68b368fdb3f4c6e4ea" or pe.imphash()=="563233bfa169acc7892451f71ad5850a" or pe.imphash()=="87575cb7a0e0700eb37f2e3668671a08" or pe.imphash()=="13f08707f759af6003837a150a371ba1" or pe.imphash()=="1781f06048a7e58b323f0b9259be798b" or pe.imphash()=="233f85f2d4bc9d6521a6caae11a1e7f5" or pe.imphash()=="24af2584cbf4d60bbe5c6d1b31b3be6d" or pe.imphash()=="632969ddf6dbf4e0f53424b75e4b91f2" or pe.imphash()=="713c29b396b907ed71a72482759ed757" or pe.imphash()=="749a7bb1f0b4c4455949c0b2bf7f9e9f" or pe.imphash()=="8628b2608957a6b0c6330ac3de28ce2e" or pe.imphash()=="8b114550386e31895dfab371e741123d" or pe.imphash()=="94cb940a1a6b65bed4d5a8f849ce9793" or pe.imphash()=="9d68781980370e00e0bd939ee5e6c141" or pe.imphash()=="b18a1401ff8f444056d29450fbc0a6ce" or pe.imphash()=="cb567f9498452721d77a451374955f5f" or pe.imphash()=="730073214094cd328547bf1f72289752" or pe.imphash()=="17b461a082950fc6332228572138b80c" or pe.imphash()=="dc25ee78e2ef4d36faa0badf1e7461c9" or pe.imphash()=="819b19d53ca6736448f9325a85736792" or pe.imphash()=="829da329ce140d873b4a8bde2cbfaa7e" or pe.imphash()=="c547f2e66061a8dffb6f5a3ff63c0a74" or pe.imphash()=="0588081ab0e63ba785938467e1b10cca" or pe.imphash()=="0d9ec08bac6c07d9987dfd0f1506587c" or pe.imphash()=="bc129092b71c89b4d4c8cdf8ea590b29" or pe.imphash()=="4da924cf622d039d58bce71cdf05d242" or pe.imphash()=="e7a3a5c377e2d29324093377d7db1c66" or pe.imphash()=="9a9dbec5c62f0380b4fa5fd31deffedf" or pe.imphash()=="af8a3976ad71e5d5fdfb67ddb8dadfce" or pe.imphash()=="0c477898bbf137bbd6f2a54e3b805ff4" or pe.imphash()=="0ca9f02b537bcea20d4ea5eb1a9fe338" or pe.imphash()=="3ab3655e5a14d4eefc547f4781bf7f9e" or pe.imphash()=="e6f9d5152da699934b30daab206471f6" or pe.imphash()=="3ad59991ccf1d67339b319b15a41b35d" or pe.imphash()=="ffdd59e0318b85a3e480874d9796d872" or pe.imphash()=="0cf479628d7cc1ea25ec7998a92f5051" or pe.imphash()=="07a2d4dcbd6cb2c6a45e6b101f0b6d51" or pe.imphash()=="d6d0f80386e1380d05cb78e871bc72b1" or pe.imphash()=="38d9e015591bbfd4929e0d0f47fa0055" or pe.imphash()=="0e2216679ca6e1094d63322e3412d650" or pe.imphash()=="ada161bf41b8e5e9132858cb54cab5fb" or pe.imphash()=="2a1bc4913cd5ecb0434df07cb675b798" or pe.imphash()=="11083e75553baae21dc89ce8f9a195e4" or pe.imphash()=="a23d29c9e566f2fa8ffbb79267f5df80" or pe.imphash()=="4a07f944a83e8a7c2525efa35dd30e2f" or pe.imphash()=="767637c23bb42cd5d7397cf58b0be688" or pe.imphash()=="14c4e4c72ba075e9069ee67f39188ad8" or pe.imphash()=="3c782813d4afce07bbfc5a9772acdbdc" or pe.imphash()=="7d010c6bb6a3726f327f7e239166d127" or pe.imphash()=="89159ba4dd04e4ce5559f132a9964eb3" or pe.imphash()=="6f33f4a5fc42b8cec7314947bd13f30f" or pe.imphash()=="5834ed4291bdeb928270428ebbaf7604" or pe.imphash()=="5a8a8a43f25485e7ee1b201edcbc7a38" or pe.imphash()=="dc7d30b90b2d8abf664fbed2b1b59894" or pe.imphash()=="41923ea1f824fe63ea5beb84db7a3e74" or pe.imphash()=="3de09703c8e79ed2ca3f01074719906b" or pe.imphash()=="a53a02b997935fd8eedcb5f7abab9b9f" or pe.imphash()=="e96a73c7bf33a464c510ede582318bf2" or pe.imphash()=="32089b8851bbf8bc2d014e9f37288c83" or pe.imphash()=="09D278F9DE118EF09163C6140255C690" or pe.imphash()=="03866661686829d806989e2fc5a72606" or pe.imphash()=="e57401fbdadcd4571ff385ab82bd5d6d" or pe.imphash()=="84B763C45C0E4A3E7CA5548C710DB4EE" or pe.imphash()=="19584675d94829987952432e018d5056" or pe.imphash()=="330768a4f172e10acb6287b87289d83b")
+		uint16( 0 ) == 0x5a4d and ( pe.imphash ( ) == "bcca3c247b619dcd13c8cdff5f123932" or pe.imphash ( ) == "3a19059bd7688cb88e70005f18efc439" or pe.imphash ( ) == "bf6223a49e45d99094406777eb6004ba" or pe.imphash ( ) == "0c106686a31bfe2ba931ae1cf6e9dbc6" or pe.imphash ( ) == "0d1447d4b3259b3c2a1d4cfb7ece13c3" or pe.imphash ( ) == "1b0369a1e06271833f78ffa70ffb4eaf" or pe.imphash ( ) == "4c1b52a19748428e51b14c278d0f58e3" or pe.imphash ( ) == "4d927a711f77d62cebd4f322cb57ec6f" or pe.imphash ( ) == "66ee036df5fc1004d9ed5e9a94a1086a" or pe.imphash ( ) == "672b13f4a0b6f27d29065123fe882dfc" or pe.imphash ( ) == "6bbd59cea665c4afcc2814c1327ec91f" or pe.imphash ( ) == "725bb81dc24214f6ecacc0cfb36ad30d" or pe.imphash ( ) == "9528a0e91e28fbb88ad433feabca2456" or pe.imphash ( ) == "9da6d5d77be11712527dcab86df449a3" or pe.imphash ( ) == "a6e01bc1ab89f8d91d9eab72032aae88" or pe.imphash ( ) == "b24c5eddaea4fe50c6a96a2a133521e4" or pe.imphash ( ) == "d21bbc50dcc169d7b4d0f01962793154" or pe.imphash ( ) == "fcc251cceae90d22c392215cc9a2d5d6" or pe.imphash ( ) == "23867a89c2b8fc733be6cf5ef902f2d1" or pe.imphash ( ) == "a37ff327f8d48e8a4d2f757e1b6e70bc" or pe.imphash ( ) == "f9a28c458284584a93b14216308d31bd" or pe.imphash ( ) == "6118619783fc175bc7ebecff0769b46e" or pe.imphash ( ) == "959a83047e80ab68b368fdb3f4c6e4ea" or pe.imphash ( ) == "563233bfa169acc7892451f71ad5850a" or pe.imphash ( ) == "87575cb7a0e0700eb37f2e3668671a08" or pe.imphash ( ) == "13f08707f759af6003837a150a371ba1" or pe.imphash ( ) == "1781f06048a7e58b323f0b9259be798b" or pe.imphash ( ) == "233f85f2d4bc9d6521a6caae11a1e7f5" or pe.imphash ( ) == "24af2584cbf4d60bbe5c6d1b31b3be6d" or pe.imphash ( ) == "632969ddf6dbf4e0f53424b75e4b91f2" or pe.imphash ( ) == "713c29b396b907ed71a72482759ed757" or pe.imphash ( ) == "749a7bb1f0b4c4455949c0b2bf7f9e9f" or pe.imphash ( ) == "8628b2608957a6b0c6330ac3de28ce2e" or pe.imphash ( ) == "8b114550386e31895dfab371e741123d" or pe.imphash ( ) == "94cb940a1a6b65bed4d5a8f849ce9793" or pe.imphash ( ) == "9d68781980370e00e0bd939ee5e6c141" or pe.imphash ( ) == "b18a1401ff8f444056d29450fbc0a6ce" or pe.imphash ( ) == "cb567f9498452721d77a451374955f5f" or pe.imphash ( ) == "730073214094cd328547bf1f72289752" or pe.imphash ( ) == "17b461a082950fc6332228572138b80c" or pe.imphash ( ) == "dc25ee78e2ef4d36faa0badf1e7461c9" or pe.imphash ( ) == "819b19d53ca6736448f9325a85736792" or pe.imphash ( ) == "829da329ce140d873b4a8bde2cbfaa7e" or pe.imphash ( ) == "c547f2e66061a8dffb6f5a3ff63c0a74" or pe.imphash ( ) == "0588081ab0e63ba785938467e1b10cca" or pe.imphash ( ) == "0d9ec08bac6c07d9987dfd0f1506587c" or pe.imphash ( ) == "bc129092b71c89b4d4c8cdf8ea590b29" or pe.imphash ( ) == "4da924cf622d039d58bce71cdf05d242" or pe.imphash ( ) == "e7a3a5c377e2d29324093377d7db1c66" or pe.imphash ( ) == "9a9dbec5c62f0380b4fa5fd31deffedf" or pe.imphash ( ) == "af8a3976ad71e5d5fdfb67ddb8dadfce" or pe.imphash ( ) == "0c477898bbf137bbd6f2a54e3b805ff4" or pe.imphash ( ) == "0ca9f02b537bcea20d4ea5eb1a9fe338" or pe.imphash ( ) == "3ab3655e5a14d4eefc547f4781bf7f9e" or pe.imphash ( ) == "e6f9d5152da699934b30daab206471f6" or pe.imphash ( ) == "3ad59991ccf1d67339b319b15a41b35d" or pe.imphash ( ) == "ffdd59e0318b85a3e480874d9796d872" or pe.imphash ( ) == "0cf479628d7cc1ea25ec7998a92f5051" or pe.imphash ( ) == "07a2d4dcbd6cb2c6a45e6b101f0b6d51" or pe.imphash ( ) == "d6d0f80386e1380d05cb78e871bc72b1" or pe.imphash ( ) == "38d9e015591bbfd4929e0d0f47fa0055" or pe.imphash ( ) == "0e2216679ca6e1094d63322e3412d650" or pe.imphash ( ) == "ada161bf41b8e5e9132858cb54cab5fb" or pe.imphash ( ) == "2a1bc4913cd5ecb0434df07cb675b798" or pe.imphash ( ) == "11083e75553baae21dc89ce8f9a195e4" or pe.imphash ( ) == "a23d29c9e566f2fa8ffbb79267f5df80" or pe.imphash ( ) == "4a07f944a83e8a7c2525efa35dd30e2f" or pe.imphash ( ) == "767637c23bb42cd5d7397cf58b0be688" or pe.imphash ( ) == "14c4e4c72ba075e9069ee67f39188ad8" or pe.imphash ( ) == "3c782813d4afce07bbfc5a9772acdbdc" or pe.imphash ( ) == "7d010c6bb6a3726f327f7e239166d127" or pe.imphash ( ) == "89159ba4dd04e4ce5559f132a9964eb3" or pe.imphash ( ) == "6f33f4a5fc42b8cec7314947bd13f30f" or pe.imphash ( ) == "5834ed4291bdeb928270428ebbaf7604" or pe.imphash ( ) == "5a8a8a43f25485e7ee1b201edcbc7a38" or pe.imphash ( ) == "dc7d30b90b2d8abf664fbed2b1b59894" or pe.imphash ( ) == "41923ea1f824fe63ea5beb84db7a3e74" or pe.imphash ( ) == "3de09703c8e79ed2ca3f01074719906b" or pe.imphash ( ) == "a53a02b997935fd8eedcb5f7abab9b9f" or pe.imphash ( ) == "e96a73c7bf33a464c510ede582318bf2" or pe.imphash ( ) == "32089b8851bbf8bc2d014e9f37288c83" or pe.imphash ( ) == "09D278F9DE118EF09163C6140255C690" or pe.imphash ( ) == "03866661686829d806989e2fc5a72606" or pe.imphash ( ) == "e57401fbdadcd4571ff385ab82bd5d6d" or pe.imphash ( ) == "84B763C45C0E4A3E7CA5548C710DB4EE" or pe.imphash ( ) == "19584675d94829987952432e018d5056" or pe.imphash ( ) == "330768a4f172e10acb6287b87289d83b" )
 }
 import "pe"
 
@@ -324241,8 +321877,8 @@ rule SIGNATURE_BASE_SUSP_Imphash_Mar23_2 : HIGHVOL FILE
 		date = "2023-03-23"
 		modified = "2023-11-25"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_imphash_detection.yar#L194-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_imphash_detection.yar#L194-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "12bf2795f4a140adbaa0af6ad4b2508d398d8ba69e9dadb155f800b10f7458c4"
 		hash = "14ec56489fbcc3c7f1ef9a4d4a80ff302a5e233cdc4429a29c635a88fb1278d6"
 		hash = "13731912823d6ce01c28a8d7d7f961505f461620bb35adbb409d4954ba1f4b8e"
@@ -324273,14 +321909,14 @@ rule SIGNATURE_BASE_SUSP_Imphash_Mar23_2 : HIGHVOL FILE
 		hash = "244c4a930e3644ffb96bf3ab33e8c8c0f94ed9fe6a8b2fc45fc8e9b6471ef3a8"
 		hash = "f00848b8edeeb5a668bf7e89e3f33f438b2f5d5cf130596a8ed2531e21be6d81"
 		hash = "5b9348c24ff604e78d70464654e645b90dc695c7e0415959c443fe29cebc3c4e"
-		logic_hash = "c6482cbc01a880ffd3056d28a2fde8f87402b1f85d36075c1f0b50788d469ca3"
+		logic_hash = "v1_sha256_c6482cbc01a880ffd3056d28a2fde8f87402b1f85d36075c1f0b50788d469ca3"
 		score = 65
 		quality = 85
 		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
 
 	condition:
-		uint16(0)==0x5A4D and (pe.imphash()=="e4290fa6afc89d56616f34ebbd0b1f2c" or pe.imphash()=="8abecba2211e61763c4c9ffcaa13369e" or pe.imphash()=="a64e048b98d051ae6e6b6334f77c95d3" or pe.imphash()=="359d89624a26d1e756c3e9d6782d6eb0" or pe.imphash()=="c2a87fabf96470db507b2e6b43bd92eb" or pe.imphash()=="62ec3dce1eba1b68f6a4511bb09f8c2c" or pe.imphash()=="5662cfcdfd9da29cb429e7528d5af81e" or pe.imphash()=="406c785a6e2c6970c1e8ed62877e197b" or pe.imphash()=="dbf687d6aa2a6cafe4349f7b0821a792" or pe.imphash()=="6dca3e9fb3928bbdb54dbce669943ec8" or pe.imphash()=="f1a539a5b71ad53ac586f053145f08ec" or pe.imphash()=="3a2003ea545fe942681da9e7683ebb58" or pe.imphash()=="a8286b574ff850cd002ea6282d15aa40" or pe.imphash()=="3c8577ca4bab2f95cc6fc73ef1895288" or pe.imphash()=="84706849fa809feaa385711a628be029" or pe.imphash()=="ba23a556ac1d6444f7f76feafd6c8867" or pe.imphash()=="95e6f8741083e0c7d9a63d45e2472360" or pe.imphash()=="774d797db707398fd2ef1979d02634d5" or pe.imphash()=="8c16c795b57934183422be5f6df7d891" or pe.imphash()=="98f67c550a7da65513e63ffd998f6b2e" or pe.imphash()=="e836076a09dba03e4d6faa46dda0fefc" or pe.imphash()=="ff63dc9c65eb25911a9bc535c8f06ad0" or pe.imphash()=="08b67a9663d3a8c9505f3b2561bbdd1c" or pe.imphash()=="135e92fc9902f3140f2e5a51458efdf0" or pe.imphash()=="4753904c40d638a1bc745c65b88291d5" or pe.imphash()=="0f44bf2b3b0b8d5ecae5689ff1d0e90d" or pe.imphash()=="c4c9ecfc26ca516a80b8f6f5b2bdb7e6" or pe.imphash()=="46ad3d954e527f769e37017b3e128039" or pe.imphash()=="802dcac7aab948c19738ba3df9f356d9" or pe.imphash()=="b36a21279375c40e6f4c1ea347f906de" or pe.imphash()=="77a185e903c5527243ef219b003bfd38" or pe.imphash()=="12a30b523ac71a3cbe9145c89400dd7f" or pe.imphash()=="cc40fefa3af5cd00cc28dbd874038a4d" or pe.imphash()=="3d8c26f4cb1782a87c3bb42796fb6b85" or pe.imphash()=="2f4ddcfebbcad3bacadc879747151f6f" or pe.imphash()=="76812f441b0ed9d3cc0748af25d689a3" or pe.imphash()=="9a06f0024c1694774ae97311608bab5b" or pe.imphash()=="481f47bbb2c9c21e108d65f52b04c448" or pe.imphash()=="286870a926664a5129b8b68ed0d4a8eb" or pe.imphash()=="a0db151d55761167d93eba72d3d94b32" or pe.imphash()=="663243fe4d94e1304b265ce4011cd01b" or pe.imphash()=="f24e64014af9015dc25262e5076fe61f" or pe.imphash()=="b7d08302c927428e16a2ad8d18b9d2b7" or pe.imphash()=="352063077f27a851dc2b08e15f08105e" or pe.imphash()=="b0b97d1a91a2730b3daa8bbb2e86b402" or pe.imphash()=="bc96f1c981700752dc2cf9553da99eb6" or pe.imphash()=="f68ddef5f29b66bbd543e947c8743bb0" or pe.imphash()=="6dfbc160505aa2f7205766eaa6fe72a1" or pe.imphash()=="a202429ffe8d8c8b722572cffd5681a7" or pe.imphash()=="342a3708d93b6b819b7b1a768201a747" or pe.imphash()=="cdc00badc7162acde9bb032e793ac137" or pe.imphash()=="be19e18d6a8b41631d40059031a928bb" or pe.imphash()=="0c54f96a844b02689687407de9b6663e" or pe.imphash()=="fa5f28e70130a452b7c0a51db5544ef9" or pe.imphash()=="2e5708ae5fed0403e8117c645fb23e5b" or pe.imphash()=="8d92fa1956a6a631c642190121740197" or pe.imphash()=="dc73a9bd8de0fd640549c85ac4089b87")
+		uint16( 0 ) == 0x5A4D and ( pe.imphash ( ) == "e4290fa6afc89d56616f34ebbd0b1f2c" or pe.imphash ( ) == "8abecba2211e61763c4c9ffcaa13369e" or pe.imphash ( ) == "a64e048b98d051ae6e6b6334f77c95d3" or pe.imphash ( ) == "359d89624a26d1e756c3e9d6782d6eb0" or pe.imphash ( ) == "c2a87fabf96470db507b2e6b43bd92eb" or pe.imphash ( ) == "62ec3dce1eba1b68f6a4511bb09f8c2c" or pe.imphash ( ) == "5662cfcdfd9da29cb429e7528d5af81e" or pe.imphash ( ) == "406c785a6e2c6970c1e8ed62877e197b" or pe.imphash ( ) == "dbf687d6aa2a6cafe4349f7b0821a792" or pe.imphash ( ) == "6dca3e9fb3928bbdb54dbce669943ec8" or pe.imphash ( ) == "f1a539a5b71ad53ac586f053145f08ec" or pe.imphash ( ) == "3a2003ea545fe942681da9e7683ebb58" or pe.imphash ( ) == "a8286b574ff850cd002ea6282d15aa40" or pe.imphash ( ) == "3c8577ca4bab2f95cc6fc73ef1895288" or pe.imphash ( ) == "84706849fa809feaa385711a628be029" or pe.imphash ( ) == "ba23a556ac1d6444f7f76feafd6c8867" or pe.imphash ( ) == "95e6f8741083e0c7d9a63d45e2472360" or pe.imphash ( ) == "774d797db707398fd2ef1979d02634d5" or pe.imphash ( ) == "8c16c795b57934183422be5f6df7d891" or pe.imphash ( ) == "98f67c550a7da65513e63ffd998f6b2e" or pe.imphash ( ) == "e836076a09dba03e4d6faa46dda0fefc" or pe.imphash ( ) == "ff63dc9c65eb25911a9bc535c8f06ad0" or pe.imphash ( ) == "08b67a9663d3a8c9505f3b2561bbdd1c" or pe.imphash ( ) == "135e92fc9902f3140f2e5a51458efdf0" or pe.imphash ( ) == "4753904c40d638a1bc745c65b88291d5" or pe.imphash ( ) == "0f44bf2b3b0b8d5ecae5689ff1d0e90d" or pe.imphash ( ) == "c4c9ecfc26ca516a80b8f6f5b2bdb7e6" or pe.imphash ( ) == "46ad3d954e527f769e37017b3e128039" or pe.imphash ( ) == "802dcac7aab948c19738ba3df9f356d9" or pe.imphash ( ) == "b36a21279375c40e6f4c1ea347f906de" or pe.imphash ( ) == "77a185e903c5527243ef219b003bfd38" or pe.imphash ( ) == "12a30b523ac71a3cbe9145c89400dd7f" or pe.imphash ( ) == "cc40fefa3af5cd00cc28dbd874038a4d" or pe.imphash ( ) == "3d8c26f4cb1782a87c3bb42796fb6b85" or pe.imphash ( ) == "2f4ddcfebbcad3bacadc879747151f6f" or pe.imphash ( ) == "76812f441b0ed9d3cc0748af25d689a3" or pe.imphash ( ) == "9a06f0024c1694774ae97311608bab5b" or pe.imphash ( ) == "481f47bbb2c9c21e108d65f52b04c448" or pe.imphash ( ) == "286870a926664a5129b8b68ed0d4a8eb" or pe.imphash ( ) == "a0db151d55761167d93eba72d3d94b32" or pe.imphash ( ) == "663243fe4d94e1304b265ce4011cd01b" or pe.imphash ( ) == "f24e64014af9015dc25262e5076fe61f" or pe.imphash ( ) == "b7d08302c927428e16a2ad8d18b9d2b7" or pe.imphash ( ) == "352063077f27a851dc2b08e15f08105e" or pe.imphash ( ) == "b0b97d1a91a2730b3daa8bbb2e86b402" or pe.imphash ( ) == "bc96f1c981700752dc2cf9553da99eb6" or pe.imphash ( ) == "f68ddef5f29b66bbd543e947c8743bb0" or pe.imphash ( ) == "6dfbc160505aa2f7205766eaa6fe72a1" or pe.imphash ( ) == "a202429ffe8d8c8b722572cffd5681a7" or pe.imphash ( ) == "342a3708d93b6b819b7b1a768201a747" or pe.imphash ( ) == "cdc00badc7162acde9bb032e793ac137" or pe.imphash ( ) == "be19e18d6a8b41631d40059031a928bb" or pe.imphash ( ) == "0c54f96a844b02689687407de9b6663e" or pe.imphash ( ) == "fa5f28e70130a452b7c0a51db5544ef9" or pe.imphash ( ) == "2e5708ae5fed0403e8117c645fb23e5b" or pe.imphash ( ) == "8d92fa1956a6a631c642190121740197" or pe.imphash ( ) == "dc73a9bd8de0fd640549c85ac4089b87" )
 }
 import "pe"
 
@@ -324293,8 +321929,8 @@ rule SIGNATURE_BASE_SUSP_Imphash_Mar23_3 : FILE
 		date = "2023-03-23"
 		modified = "2023-07-24"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_imphash_detection.yar#L297-L329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_imphash_detection.yar#L297-L329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b5296cf0eb22fba6e2f68d0c9de9ef7845f330f7c611a0d60007aa87e270c62a"
 		hash = "5a5a5f71c2270cea036cd408cde99f4ebf5e04a751c558650f5cb23279babe6d"
 		hash = "481b0d9759bfd209251eccb1848048ebbe7bd2c87c5914a894a5bffc0d1d67ff"
@@ -324305,14 +321941,14 @@ rule SIGNATURE_BASE_SUSP_Imphash_Mar23_3 : FILE
 		hash = "0461830e811d3831818dac5a67d4df736b4dc2e8fb185da439f9338bdb9f69c3"
 		hash = "773edc71d52361454156dfd802ebaba2bb97421ce9024a7798dcdee3da747112"
 		hash = "fe53b9d820adf3bcddf42976b8af1411e87d9dfd9aa479f12b2db50a5600f348"
-		logic_hash = "f11de8b7f78cdfc79116670409c31745e2803ef8b8e97d08be012f1146b3d816"
+		logic_hash = "v1_sha256_f11de8b7f78cdfc79116670409c31745e2803ef8b8e97d08be012f1146b3d816"
 		score = 45
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
 
 	condition:
-		uint16(0)==0x5A4D and (pe.imphash()=="afcdf79be1557326c854b6e20cb900a7" or pe.imphash()=="6ed4f5f04d62b18d96b26d6db7c18840" or pe.imphash()=="fc6683d30d9f25244a50fd5357825e79" or pe.imphash()=="2c5f2513605e48f2d8ea5440a870cb9e" or pe.imphash()=="0b5552dccd9d0a834cea55c0c8fc05be") and pe.number_of_signatures==0
+		uint16( 0 ) == 0x5A4D and ( pe.imphash ( ) == "afcdf79be1557326c854b6e20cb900a7" or pe.imphash ( ) == "6ed4f5f04d62b18d96b26d6db7c18840" or pe.imphash ( ) == "fc6683d30d9f25244a50fd5357825e79" or pe.imphash ( ) == "2c5f2513605e48f2d8ea5440a870cb9e" or pe.imphash ( ) == "0b5552dccd9d0a834cea55c0c8fc05be" ) and pe.number_of_signatures == 0
 }
 import "pe"
 
@@ -324325,9 +321961,9 @@ rule SIGNATURE_BASE_SUSP_Fake_AMSI_DLL_Jun23_1 : FILE
 		date = "2023-06-07"
 		modified = "2023-06-12"
 		reference = "https://twitter.com/eversinc33/status/1666121784192581633?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_fake_amsi_dll.yar#L3-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec3db233ab22144bc65614b45bb894a7ea5a4fd40ccb603e6e52cc1b9ff8805b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_fake_amsi_dll.yar#L3-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec3db233ab22144bc65614b45bb894a7ea5a4fd40ccb603e6e52cc1b9ff8805b"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -324342,7 +321978,7 @@ rule SIGNATURE_BASE_SUSP_Fake_AMSI_DLL_Jun23_1 : FILE
 		$fp1 = "Wine builtin DLL"
 
 	condition:
-		uint16(0)==0x5a4d and (pe.exports("AmsiInitialize") and pe.exports("AmsiScanString")) and ( filesize >200KB or filesize <35KB or not 4 of ($a*)) and not 1 of ($fp*)
+		uint16( 0 ) == 0x5a4d and ( pe.exports ( "AmsiInitialize" ) and pe.exports ( "AmsiScanString" ) ) and ( filesize > 200KB or filesize < 35KB or not 4 of ( $a* ) ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1 : LOG CVE_2021_27065
 {
@@ -324353,9 +321989,9 @@ rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1
 		date = "2021-03-02"
 		modified = "2023-12-05"
 		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium_log_sigs.yar#L2-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9306cf177928266ea921461e9da80ad5bb37e1e0848559898a414956cfbc2b49"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium_log_sigs.yar#L2-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9306cf177928266ea921461e9da80ad5bb37e1e0848559898a414956cfbc2b49"
 		score = 75
 		quality = 85
 		tags = "LOG, CVE-2021-27065"
@@ -324375,9 +322011,9 @@ rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_26858_Exchange_Forensic_Artefacts_Mar21_1
 		date = "2021-03-02"
 		modified = "2021-03-04"
 		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium_log_sigs.yar#L15-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a8296b7e990e52330412288e9ff71e08a5258fc63c4754e6d0e6d64302f55e6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium_log_sigs.yar#L15-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a8296b7e990e52330412288e9ff71e08a5258fc63c4754e6d0e6d64302f55e6"
 		score = 65
 		quality = 85
 		tags = "LOG, CVE-2021-26858"
@@ -324397,9 +322033,9 @@ rule SIGNATURE_BASE_LOG_APT_HAFNIUM_Exchange_Log_Traces_Mar21_1 : LOG
 		date = "2021-03-04"
 		modified = "2023-12-05"
 		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium_log_sigs.yar#L30-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "03b90c121cc5169eef66e111648d5641acc785e60a20c658ba7f4d1cf032cd92"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium_log_sigs.yar#L30-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_03b90c121cc5169eef66e111648d5641acc785e60a20c658ba7f4d1cf032cd92"
 		score = 65
 		quality = 83
 		tags = "LOG"
@@ -324422,9 +322058,9 @@ rule SIGNATURE_BASE_LOG_Exchange_Forensic_Artefacts_Cleanup_Activity_Mar21_1 : L
 		date = "2021-03-08"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/jdferrell3/status/1368626281970024448"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium_log_sigs.yar#L48-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "12e5b76dafcae13f1eb21913ae0bde233152fd8b9d29f073893418ac9f742de3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium_log_sigs.yar#L48-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_12e5b76dafcae13f1eb21913ae0bde233152fd8b9d29f073893418ac9f742de3"
 		score = 70
 		quality = 85
 		tags = "LOG"
@@ -324437,7 +322073,7 @@ rule SIGNATURE_BASE_LOG_Exchange_Forensic_Artefacts_Cleanup_Activity_Mar21_1 : L
 		$s3 = "&echo [S]"
 
 	condition:
-		1 of ($x*) or 2 of them
+		1 of ( $x* ) or 2 of them
 }
 rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts : LOG
 {
@@ -324448,9 +322084,9 @@ rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts : LOG
 		date = "2021-03-10"
 		modified = "2021-03-15"
 		reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium_log_sigs.yar#L67-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "131ff0ce189dfeace0922000b0d15dfb5a1270bee8fba8e4d66aa75b1d3f864f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium_log_sigs.yar#L67-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_131ff0ce189dfeace0922000b0d15dfb5a1270bee8fba8e4d66aa75b1d3f864f"
 		score = 65
 		quality = 60
 		tags = "LOG"
@@ -324466,7 +322102,7 @@ rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts : LOG
 		$s6 = "/owa/auth/Current/themes/resources/logon.css" ascii wide
 
 	condition:
-		$x1 and 1 of ($s*)
+		$x1 and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_2 : LOG
 {
@@ -324477,9 +322113,9 @@ rule SIGNATURE_BASE_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_2 : LOG
 		date = "2021-03-10"
 		modified = "2023-12-05"
 		reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium_log_sigs.yar#L92-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "13e2e46689bc0e87c3cf13dc2ce213c384afe6c03c21e62a467974a0518c12da"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium_log_sigs.yar#L92-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_13e2e46689bc0e87c3cf13dc2ce213c384afe6c03c21e62a467974a0518c12da"
 		score = 65
 		quality = 85
 		tags = "LOG"
@@ -324499,9 +322135,9 @@ rule SIGNATURE_BASE_EXPL_Zoho_RCE_Fix_Lines_Dec21_1 : FILE
 		date = "2021-12-06"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1467784104930385923"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_zoho_rcef_logs.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e6d9c3364da57c03a5e838f485deefabec2f3ec67d19a9017e564ba702a72d03"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_zoho_rcef_logs.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e6d9c3364da57c03a5e838f485deefabec2f3ec67d19a9017e564ba702a72d03"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -324515,7 +322151,7 @@ rule SIGNATURE_BASE_EXPL_Zoho_RCE_Fix_Lines_Dec21_1 : FILE
 		$sd_fp2 = "\"deletedCount\":0"
 
 	condition:
-		filesize <6MB and $s1 and (1 of ($sa*) or ($sd1 and not 1 of ($sd_fp*)))
+		filesize < 6MB and $s1 and ( 1 of ( $sa* ) or ( $sd1 and not 1 of ( $sd_fp* ) ) )
 }
 rule SIGNATURE_BASE_Crimsonrat_Mar18_1 : FILE
 {
@@ -324526,9 +322162,9 @@ rule SIGNATURE_BASE_Crimsonrat_Mar18_1 : FILE
 		date = "2018-03-06"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_crimson_rat.yar#L11-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "59b01a98a70c4bac08d396418fac24eb96e461a45502f63edc2a9aa87e05f960"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_crimson_rat.yar#L11-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_59b01a98a70c4bac08d396418fac24eb96e461a45502f63edc2a9aa87e05f960"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324554,7 +322190,7 @@ rule SIGNATURE_BASE_Crimsonrat_Mar18_1 : FILE
 		$fp1 = "Copyright Software Secure" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or all of ($a*)) and not 1 of ($fp*)
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or all of ( $a* ) ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Remsec_Executable_Blob_32
 {
@@ -324565,9 +322201,9 @@ rule SIGNATURE_BASE_Remsec_Executable_Blob_32
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_strider.yara#L8-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1cfc43ab15b3d220a636c150315c30f5654e53fad67d20534ce4d5c00295e35e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_strider.yara#L8-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1cfc43ab15b3d220a636c150315c30f5654e53fad67d20534ce4d5c00295e35e"
 		score = 80
 		quality = 85
 		tags = ""
@@ -324587,9 +322223,9 @@ rule SIGNATURE_BASE_Remsec_Executable_Blob_64
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_strider.yara#L22-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "957e5b6afabec3fb1b169dd85d0e950107e219f7dec8ef779a18bd90d9824a97"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_strider.yara#L22-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_957e5b6afabec3fb1b169dd85d0e950107e219f7dec8ef779a18bd90d9824a97"
 		score = 80
 		quality = 85
 		tags = ""
@@ -324609,9 +322245,9 @@ rule SIGNATURE_BASE_Remsec_Executable_Blob_Parser
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_strider.yara#L36-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2f6db962807c07ff1bbe8b53eeb386d7b0ac88f95b76439c0d8b65d597739bdd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_strider.yara#L36-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2f6db962807c07ff1bbe8b53eeb386d7b0ac88f95b76439c0d8b65d597739bdd"
 		score = 80
 		quality = 85
 		tags = ""
@@ -324631,9 +322267,9 @@ rule SIGNATURE_BASE_Remsec_Encrypted_Api
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_strider.yara#L50-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4f10c24a8480c17c2939fe3fecba2820b22f8a47bc2b2e73ac1080a355025d7c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_strider.yara#L50-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4f10c24a8480c17c2939fe3fecba2820b22f8a47bc2b2e73ac1080a355025d7c"
 		score = 80
 		quality = 85
 		tags = ""
@@ -324653,9 +322289,9 @@ rule SIGNATURE_BASE_Remsec_Packer_A
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_strider.yara#L64-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b46a41686fbf1c63e8a8b583859f23bf789bc9f11ee6b1fb01bb08e602772e76"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_strider.yara#L64-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b46a41686fbf1c63e8a8b583859f23bf789bc9f11ee6b1fb01bb08e602772e76"
 		score = 80
 		quality = 85
 		tags = ""
@@ -324675,9 +322311,9 @@ rule SIGNATURE_BASE_Remsec_Packer_B
 		date = "2016-08-08"
 		modified = "2023-12-05"
 		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_strider.yara#L78-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9c63b5934d60b59a33364ef56c913220e59b9798a682a7f97e6755270adf4e4b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_strider.yara#L78-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9c63b5934d60b59a33364ef56c913220e59b9798a682a7f97e6755270adf4e4b"
 		score = 80
 		quality = 85
 		tags = ""
@@ -324699,9 +322335,9 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_1 : FILE
 		date = "2018-02-22"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_mosquito.yar#L13-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "22d799531986c30da19943f1dda305e61a305083478549e93c0ecddeade77b39"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_mosquito.yar#L13-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_22d799531986c30da19943f1dda305e61a305083478549e93c0ecddeade77b39"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324713,7 +322349,7 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_1 : FILE
 		$s2 = "EStOpnabn" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="169d4237c79549303cca870592278f42" or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( pe.imphash ( ) == "169d4237c79549303cca870592278f42" or all of them )
 }
 import "pe"
 
@@ -324726,9 +322362,9 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_2 : FILE
 		date = "2018-02-22"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_mosquito.yar#L32-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f1f93d3bc1c4bd55fc7558716a0a1eb7a6c4c2381a4532d37f4e3559f7c809ea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_mosquito.yar#L32-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f1f93d3bc1c4bd55fc7558716a0a1eb7a6c4c2381a4532d37f4e3559f7c809ea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324743,7 +322379,7 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_2 : FILE
 		$s7 = "QWVPQQ" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="cd918073f209c5da7a16b6c125d73746" or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "cd918073f209c5da7a16b6c125d73746" or all of them )
 }
 import "pe"
 
@@ -324756,9 +322392,9 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_3 : FILE
 		date = "2018-02-22"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_mosquito.yar#L54-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f59c130b500625466da0c8b5bfd84051ee59a3b6261ee3d990d4c355b10672b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_mosquito.yar#L54-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f59c130b500625466da0c8b5bfd84051ee59a3b6261ee3d990d4c355b10672b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324773,7 +322409,7 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_3 : FILE
 		$s4 = "Microsoft Update" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="88488fe0b8bcd6e379dea6433bb5d7d8" or (pe.exports("InstallRoutineW") and pe.exports("StartRoutine")) or $x1 or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "88488fe0b8bcd6e379dea6433bb5d7d8" or ( pe.exports ( "InstallRoutineW" ) and pe.exports ( "StartRoutine" ) ) or $x1 or 3 of them )
 }
 import "pe"
 
@@ -324786,9 +322422,9 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_4 : FILE
 		date = "2018-02-22"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_mosquito.yar#L79-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4765b912258491f38c03513204d9af8bc62c37df2fe583e371cbbeff6fc12298"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_mosquito.yar#L79-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4765b912258491f38c03513204d9af8bc62c37df2fe583e371cbbeff6fc12298"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324796,7 +322432,7 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_4 : FILE
 		hash1 = "b362b235539b762734a1833c7e6c366c1b46474f05dc17b3a631b3bff95a5eec"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and pe.imphash()=="17b328245e2874a76c2f46f9a92c3bad"
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and pe.imphash ( ) == "17b328245e2874a76c2f46f9a92c3bad"
 }
 import "pe"
 
@@ -324809,9 +322445,9 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_5 : FILE
 		date = "2018-02-22"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_mosquito.yar#L92-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b0366194410f36c47dd41f6a36c45edbce75e3ddad19520b17bed59513e1dbc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_mosquito.yar#L92-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b0366194410f36c47dd41f6a36c45edbce75e3ddad19520b17bed59513e1dbc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324819,10 +322455,8 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_5 : FILE
 		hash1 = "26a1a42bc74e14887616f9d6048c17b1b4231466716a6426e7162426e1a08030"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and pe.imphash()=="ac40cf7479f53a4754ac6481a4f24e57"
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and pe.imphash ( ) == "ac40cf7479f53a4754ac6481a4f24e57"
 }
-import "pe"
-
 rule SIGNATURE_BASE_Turlamosquito_Mal_6 : FILE
 {
 	meta:
@@ -324832,9 +322466,9 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_6 : FILE
 		date = "2018-02-22"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_mosquito.yar#L105-L127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ca6ae4313ad8f009b17188aa7184ff01a4b7e35926f3f68dc3aea12bffb9bb1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_mosquito.yar#L105-L127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ca6ae4313ad8f009b17188aa7184ff01a4b7e35926f3f68dc3aea12bffb9bb1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324850,7 +322484,7 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_6 : FILE
 		$s3 = "QSVVQQ" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (2 of ($a*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 2 of ( $a* ) or 4 of them )
 }
 import "pe"
 
@@ -324863,9 +322497,9 @@ rule SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1 : FILE
 		date = "2022-10-25"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_mosquito.yar#L129-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fbaca774d6398aac7c171a5d87aa456a1921c1b80449d06f392b088db33ee845"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_mosquito.yar#L129-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fbaca774d6398aac7c171a5d87aa456a1921c1b80449d06f392b088db33ee845"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -324883,7 +322517,7 @@ rule SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1 : FILE
 		$op3 = { e8 64 a1 6e 00 64 a1 c2 04 08 75 40 73 1d 8b ff cc 10 89 cc 8b c3 cc af }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="073235ae6dfbb1bf5db68a039a7b7726" or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( pe.imphash ( ) == "073235ae6dfbb1bf5db68a039a7b7726" or all of them )
 }
 rule SIGNATURE_BASE_Dexter_Malware
 {
@@ -324894,9 +322528,9 @@ rule SIGNATURE_BASE_Dexter_Malware
 		date = "2015-02-10"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/oBvy8b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_dexter_trojan.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b05bccce63c1f7e8d6d3f654b611f33da5fc1dbcbd28ff28f817d00bf961e64"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_dexter_trojan.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b05bccce63c1f7e8d6d3f654b611f33da5fc1dbcbd28ff28f817d00bf961e64"
 		score = 70
 		quality = 60
 		tags = ""
@@ -324920,9 +322554,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Conticrypter
 		date = "2021-03-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_conti.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "256fbd028a91da45049e2e861e16e97201f09cb92ab049eda373c80e6a796726"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_conti.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_256fbd028a91da45049e2e861e16e97201f09cb92ab049eda373c80e6a796726"
 		score = 75
 		quality = 85
 		tags = ""
@@ -324935,7 +322569,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Conticrypter
 		$garbageLoad2 = {55 89 E5 83 EC 18 C7 ?? 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 45 08 52 C9 C3}
 
 	condition:
-		1 of ($handoff*) and 1 of ($garbageLoad*)
+		1 of ( $handoff* ) and 1 of ( $garbageLoad* )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_1 : FILE
 {
@@ -324946,9 +322580,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_1 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1e024767797fb146b92d6e8c549597c0cda7c2f8fb961299a3808b9b2e924666"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1e024767797fb146b92d6e8c549597c0cda7c2f8fb961299a3808b9b2e924666"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -324962,7 +322596,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_1 : FILE
 		$s4 = "IIEFEE" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_2 : FILE
 {
@@ -324973,9 +322607,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_2 : FILE
 		date = "2017-04-03"
 		modified = "2023-01-06"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L28-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dff8623c35c83c20fb525209ec9aa5d77b51fa494eb557845a8320c77746c02f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L28-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dff8623c35c83c20fb525209ec9aa5d77b51fa494eb557845a8320c77746c02f"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -324998,7 +322632,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_2 : FILE
 		$op3 = { 3b fb 7d 3f 8a 4d 14 8d 45 14 84 c9 74 1b 8a 14 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 3 of ($s*)) or all of ($op*)) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) or all of ( $op* ) ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_3 : FILE
 {
@@ -325009,9 +322643,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_3 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L59-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d15b4c277e2c4dfe300f242e4cc9b217981166191a47939ca437c55391874b5d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L59-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d15b4c277e2c4dfe300f242e4cc9b217981166191a47939ca437c55391874b5d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325028,7 +322662,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_3 : FILE
 		$op3 = { 7e f8 85 c0 74 06 8a 74 06 08 eb 03 8a 76 fc 85 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and ( all of ($s*) and 1 of ($op*)) or all of ($op*)) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( all of ( $s* ) and 1 of ( $op* ) ) or all of ( $op* ) ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Dropper_1 : FILE
 {
@@ -325039,9 +322673,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Dropper_1 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L81-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ee0caf8a08db9a2a83f10178e2ee890b6b0bc6e699ebb3d01fa94fa48c6dfdee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L81-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ee0caf8a08db9a2a83f10178e2ee890b6b0bc6e699ebb3d01fa94fa48c6dfdee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325052,7 +322686,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Dropper_1 : FILE
 		$s1 = "{\\version2}{\\edmins0}{\\nofpages1}{\\nofwords11}{\\nofchars69}{\\*\\company google}{\\nofcharsws79}{\\vern24611}{\\*\\password" ascii
 
 	condition:
-		( uint16(0)==0x5c7b and filesize <700KB and all of them )
+		( uint16( 0 ) == 0x5c7b and filesize < 700KB and all of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_4 : FILE
 {
@@ -325063,9 +322697,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_4 : FILE
 		date = "2017-04-03"
 		modified = "2023-01-06"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L96-L112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7b39531e4af93ab026381a1114efe00fa01fb45860ddb512dbfa436471644e20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L96-L112"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7b39531e4af93ab026381a1114efe00fa01fb45860ddb512dbfa436471644e20"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325078,7 +322712,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_4 : FILE
 		$s10 = ".?AVAES@@" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_5 : FILE
 {
@@ -325089,9 +322723,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_5 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L114-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9b91ac8f450843c7c85e8d056218aff671bb0f345d16a7ba3f4180ac008bf318"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L114-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9b91ac8f450843c7c85e8d056218aff671bb0f345d16a7ba3f4180ac008bf318"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325107,7 +322741,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_5 : FILE
 		$op1 = { 83 ec 60 8d 4c 24 00 e8 6f ff ff ff 8d 4c 24 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 2 of them )) or (4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 2 of them ) ) or ( 4 of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_6 : FILE
 {
@@ -325118,9 +322752,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_6 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L136-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f165912001c5e2eb48cef46df12220f7f7a53e908a6af571bb4932c50e355388"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L136-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f165912001c5e2eb48cef46df12220f7f7a53e908a6af571bb4932c50e355388"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325134,7 +322768,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_6 : FILE
 		$s4 = "SOFTWARE\\EGGORG" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_7 : FILE
 {
@@ -325145,9 +322779,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_7 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L154-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "01993e785fb7d5de9ea629d31725e86fa169b70dcde9716a5da0b646ac88864a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L154-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_01993e785fb7d5de9ea629d31725e86fa169b70dcde9716a5da0b646ac88864a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325159,7 +322793,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_7 : FILE
 		$x2 = "extOextOextOextO" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_8 : FILE
 {
@@ -325170,9 +322804,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_8 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L170-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a27b041a1ff0fae3d06d8050fe3207435cb84f421099dc1cad8f8a503e976860"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L170-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a27b041a1ff0fae3d06d8050fe3207435cb84f421099dc1cad8f8a503e976860"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325189,7 +322823,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_8 : FILE
 		$s6 = "AFX_DIALOG_LAYOUT" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and 4 of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_9 : FILE
 {
@@ -325200,9 +322834,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_9 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L191-L205"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f45159a508ce8ccb5ab57c7347916642f58ab1b6e0a8886ba53e4810ed65c5c1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L191-L205"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f45159a508ce8ccb5ab57c7347916642f58ab1b6e0a8886ba53e4810ed65c5c1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325214,7 +322848,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_9 : FILE
 		$op0 = { 2b c7 50 e8 22 83 ff ff ff b6 c0 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_10 : FILE
 {
@@ -325225,9 +322859,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_10 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L207-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "538754e6daadd3efa3e77723dce7143fecad28cf94caa1b29a2d45df44b14ee4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L207-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_538754e6daadd3efa3e77723dce7143fecad28cf94caa1b29a2d45df44b14ee4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325240,7 +322874,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_10 : FILE
 		$op0 = { 83 c4 34 c3 57 8b ce e8 92 18 00 00 68 20 70 40 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Malware_11 : FILE
 {
@@ -325251,9 +322885,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_11 : FILE
 		date = "2017-04-03"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L224-L240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7935d3aeef0d4c94a00dd44942a1ba97d0c9fce848914ebc9c59d9f8e9f51599"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L224-L240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7935d3aeef0d4c94a00dd44942a1ba97d0c9fce848914ebc9c59d9f8e9f51599"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325266,7 +322900,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_11 : FILE
 		$op2 = { 68 38 00 41 00 68 34 00 41 00 e8 d3 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Lockdown : FILE
 {
@@ -325277,9 +322911,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Lockdown : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L251-L265"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3f24c08817bc94bb4b7d09d51bed62f43952f2c66338f29c4bc8e9000b3ff78a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L251-L265"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3f24c08817bc94bb4b7d09d51bed62f43952f2c66338f29c4bc8e9000b3ff78a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325291,7 +322925,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Lockdown : FILE
 		$s3 = "mfeann.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Windowxarbot : FILE
 {
@@ -325302,9 +322936,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Windowxarbot : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L267-L279"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d8a9c25032c5371e843f8e80884e43a64c73b1644605b39b2dff11104c3bbcd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L267-L279"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d8a9c25032c5371e843f8e80884e43a64c73b1644605b39b2dff11104c3bbcd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325314,7 +322948,7 @@ rule SIGNATURE_BASE_Opcloudhopper_Windowxarbot : FILE
 		$s1 = "\\Release\\WindowXarbot.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Opcloudhopper_Wmidll_Inmemory
 {
@@ -325325,9 +322959,9 @@ rule SIGNATURE_BASE_Opcloudhopper_Wmidll_Inmemory
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L281-L293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6dddda4e519eeaa67eb4c21151cab10553420a23a077751e0fc45fcae0bf6e69"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L281-L293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6dddda4e519eeaa67eb4c21151cab10553420a23a077751e0fc45fcae0bf6e69"
 		score = 75
 		quality = 85
 		tags = ""
@@ -325348,9 +322982,9 @@ rule SIGNATURE_BASE_VBS_Wmiexec_Tool_Apr17_1 : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cloudhopper.yar#L295-L318"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b0aad1c8dfc07ae3df835ae113bd02abfd706a0646ffcac5dd5691822016d31a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cloudhopper.yar#L295-L318"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b0aad1c8dfc07ae3df835ae113bd02abfd706a0646ffcac5dd5691822016d31a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325370,7 +323004,7 @@ rule SIGNATURE_BASE_VBS_Wmiexec_Tool_Apr17_1 : FILE
 		$a5 = "WMIEXEC : Process created. PID:" fullword ascii
 
 	condition:
-		( filesize <40KB and 1 of them ) or 3 of them
+		( filesize < 40KB and 1 of them ) or 3 of them
 }
 rule SIGNATURE_BASE_WEBSHELL_ASPX_DLL_Moveit_Jun23_1 : FILE
 {
@@ -325381,9 +323015,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_DLL_Moveit_Jun23_1 : FILE
 		date = "2023-06-01"
 		modified = "2023-12-05"
 		reference = "https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/?utm_content=251159938&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_moveit_0day_jun23.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "47c2ec1e833852941434586b61d6f435b9acb32b2ff48e0a9e8006e0f9ff8056"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_moveit_0day_jun23.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_47c2ec1e833852941434586b61d6f435b9acb32b2ff48e0a9e8006e0f9ff8056"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -325396,7 +323030,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_DLL_Moveit_Jun23_1 : FILE
 		$a1 = "MOVEit.DMZ.Core.Data" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and (1 of ($x*) and $a1) or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and ( 1 of ( $x* ) and $a1 ) or all of them
 }
 rule SIGNATURE_BASE_WEBSHELL_ASPX_Moveit_Jun23_1 : FILE
 {
@@ -325407,9 +323041,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Moveit_Jun23_1 : FILE
 		date = "2023-06-01"
 		modified = "2023-12-05"
 		reference = "https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_moveit_0day_jun23.yar#L24-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "436f9a503ad938541faa8f34604310ba6d932e40a41dc189ccd293b7191a7621"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_moveit_0day_jun23.yar#L24-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_436f9a503ad938541faa8f34604310ba6d932e40a41dc189ccd293b7191a7621"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -325423,7 +323057,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Moveit_Jun23_1 : FILE
 		$s3 = ";  if (!String.Equals(pass, " ascii
 
 	condition:
-		filesize <150KB and 2 of them
+		filesize < 150KB and 2 of them
 }
 rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_1
 {
@@ -325434,9 +323068,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_1
 		date = "2023-06-01"
 		modified = "2023-12-05"
 		reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_moveit_0day_jun23.yar#L43-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "26674d8dea5cb2e95e442c4c75d80ca610f7373f0b216c0b1c83a5b1f9f70316"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_moveit_0day_jun23.yar#L43-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_26674d8dea5cb2e95e442c4c75d80ca610f7373f0b216c0b1c83a5b1f9f70316"
 		score = 70
 		quality = 85
 		tags = ""
@@ -325457,9 +323091,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_2
 		date = "2023-06-03"
 		modified = "2023-12-05"
 		reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_moveit_0day_jun23.yar#L58-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "56328d078801a702ad47f01f356df6f00be8da593d03c549e77312af9b47b5be"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_moveit_0day_jun23.yar#L58-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_56328d078801a702ad47f01f356df6f00be8da593d03c549e77312af9b47b5be"
 		score = 70
 		quality = 85
 		tags = ""
@@ -325474,7 +323108,7 @@ rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_2
 		$s5 = " action=m2 "
 
 	condition:
-		1 of ($a*) and 3 of ($s*) or all of ($s*)
+		1 of ( $a* ) and 3 of ( $s* ) or all of ( $s* )
 }
 rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_3
 {
@@ -325485,9 +323119,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_3
 		date = "2023-06-13"
 		modified = "2023-12-05"
 		reference = "https://attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_moveit_0day_jun23.yar#L81-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2eaa06c31687c6368f036a705fdc1b1c42355f19c098ae764a998039cc4aebb5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_moveit_0day_jun23.yar#L81-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2eaa06c31687c6368f036a705fdc1b1c42355f19c098ae764a998039cc4aebb5"
 		score = 70
 		quality = 85
 		tags = ""
@@ -325497,7 +323131,7 @@ rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_3
 		$s2 = "MOVEit.DMZ.Application.Folders.ResumableUploadFilePartHandler.DeserializeFileUploadStream" ascii
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
 rule SIGNATURE_BASE_Icefog_Malware_Feb18_1 : FILE
 {
@@ -325508,9 +323142,9 @@ rule SIGNATURE_BASE_Icefog_Malware_Feb18_1 : FILE
 		date = "2018-02-26"
 		modified = "2023-01-06"
 		reference = "https://twitter.com/ClearskySec/status/968104465818669057"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_icefog.yar#L11-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8bba0f7f6f6aad6586c2c5ed29f30514d2f88703134f331724cc2ff86ccffe87"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_icefog.yar#L11-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8bba0f7f6f6aad6586c2c5ed29f30514d2f88703134f331724cc2ff86ccffe87"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325528,7 +323162,7 @@ rule SIGNATURE_BASE_Icefog_Malware_Feb18_1 : FILE
 		$s9 = "\\key.dat" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 4 of them
 }
 rule SIGNATURE_BASE_Sharpcat : FILE
 {
@@ -325539,9 +323173,9 @@ rule SIGNATURE_BASE_Sharpcat : FILE
 		date = "2016-06-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Cn33liz/SharpCat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_sharpcat.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4a38812b07b40bdde03049dbff1f9de38cadaf9941ab8b40b84016b1d5cbfd51"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_sharpcat.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4a38812b07b40bdde03049dbff1f9de38cadaf9941ab8b40b84016b1d5cbfd51"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325554,7 +323188,7 @@ rule SIGNATURE_BASE_Sharpcat : FILE
 		$s3 = "currentDirectory" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
 }
 rule SIGNATURE_BASE_Unspecified_Malware_Jul17_2C : FILE
 {
@@ -325565,9 +323199,9 @@ rule SIGNATURE_BASE_Unspecified_Malware_Jul17_2C : FILE
 		date = "2017-07-18"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/CX3KaY"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_unspecified_malware.yar#L3-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a078b96ea15b287c8aed960741865aeac356ec8650eac71b8e28f2f1924ec956"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_unspecified_malware.yar#L3-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a078b96ea15b287c8aed960741865aeac356ec8650eac71b8e28f2f1924ec956"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325586,7 +323220,7 @@ rule SIGNATURE_BASE_Unspecified_Malware_Jul17_2C : FILE
 		$s6 = "aaabbbcccddd" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 4 of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Xrat_1 : FILE
 {
@@ -325597,9 +323231,9 @@ rule SIGNATURE_BASE_Xrat_1 : FILE
 		date = "2017-12-11"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/Pg3P4W"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_xrat.yar#L12-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "032c5af4f34959783102977543d2caf6199b8d1880a64797882f591e36c64d69"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_xrat.yar#L12-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_032c5af4f34959783102977543d2caf6199b8d1880a64797882f591e36c64d69"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325622,7 +323256,7 @@ rule SIGNATURE_BASE_Xrat_1 : FILE
 		$s7 = "set_RunHidden" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_Credentialstealer_Generic_Backdoor : FILE
 {
@@ -325633,9 +323267,9 @@ rule SIGNATURE_BASE_Credentialstealer_Generic_Backdoor : FILE
 		date = "2017-06-07"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_credstealer_generic.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aa06291a91ac84f80cd2cbe5a01c2cbcc14cf6914da9d1234af9b3d833990551"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_credstealer_generic.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aa06291a91ac84f80cd2cbe5a01c2cbcc14cf6914da9d1234af9b3d833990551"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -325655,7 +323289,7 @@ rule SIGNATURE_BASE_Credentialstealer_Generic_Backdoor : FILE
 		$s10 = "%s\\Opera\\Opera\\profile\\wand.dat" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 4 of them )
+		( uint16( 0 ) == 0x5a4d and 4 of them )
 }
 rule SIGNATURE_BASE_Exp_EPS_CVE20152545 : CVE_2015_2545 FILE
 {
@@ -325666,9 +323300,9 @@ rule SIGNATURE_BASE_Exp_EPS_CVE20152545 : CVE_2015_2545 FILE
 		date = "2017-07-19"
 		modified = "2023-12-05"
 		reference = "Internal Research - ME"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2015_2545.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e1aac80a06dd71352d2776b4dfccce901d47363459853a37669af69be6e962c7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2015_2545.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e1aac80a06dd71352d2776b4dfccce901d47363459853a37669af69be6e962c7"
 		score = 70
 		quality = 85
 		tags = "CVE-2015-2545, FILE"
@@ -325679,7 +323313,7 @@ rule SIGNATURE_BASE_Exp_EPS_CVE20152545 : CVE_2015_2545 FILE
 		$s2 = "-la;7(la+" ascii
 
 	condition:
-		uint16(0)==0x4b50 and ($s1 and #s2>20)
+		uint16( 0 ) == 0x4b50 and ( $s1 and #s2 > 20 )
 }
 rule SIGNATURE_BASE_RAT_AAR
 {
@@ -325690,9 +323324,9 @@ rule SIGNATURE_BASE_RAT_AAR
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/AAR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a206b3f5cf6cc870135bc267b5baab8333422dc917efce6c66ee907690592d09"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a206b3f5cf6cc870135bc267b5baab8333422dc917efce6c66ee907690592d09"
 		score = 75
 		quality = 85
 		tags = ""
@@ -325719,9 +323353,9 @@ rule SIGNATURE_BASE_RAT_Adzok
 		date = "2015-01-05"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Adzok"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L24-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ee3291a4396ba6cb3c5e22229de4f5e45714b29bfeac1c56bde6d038a9d25458"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L24-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ee3291a4396ba6cb3c5e22229de4f5e45714b29bfeac1c56bde6d038a9d25458"
 		score = 75
 		quality = 85
 		tags = ""
@@ -325740,7 +323374,7 @@ rule SIGNATURE_BASE_RAT_Adzok
 		$a8 = "resources/icono.pngPK"
 
 	condition:
-		7 of ($a*)
+		7 of ( $a* )
 }
 rule SIGNATURE_BASE_RAT_Ap0Calypse
 {
@@ -325751,9 +323385,9 @@ rule SIGNATURE_BASE_RAT_Ap0Calypse
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Ap0calypse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L50-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1ce90a5b1b3f643d4e530d6e00741f5d5918d3199cfbc4126cf8421a9e42023e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L50-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1ce90a5b1b3f643d4e530d6e00741f5d5918d3199cfbc4126cf8421a9e42023e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -325780,9 +323414,9 @@ rule SIGNATURE_BASE_RAT_Arcom
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Arcom"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L72-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dbccd9885ba0ec5741e3c74908d2e76b15836bc75373c100f344abf9bdf3a0b4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L72-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dbccd9885ba0ec5741e3c74908d2e76b15836bc75373c100f344abf9bdf3a0b4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -325809,9 +323443,9 @@ rule SIGNATURE_BASE_RAT_Bandook
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/bandook"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L95-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fe658e0990f0d456b1a8f5acea62a3b80bdd4a9bc0eedfe2e1092ea60b4fca2e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L95-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fe658e0990f0d456b1a8f5acea62a3b80bdd4a9bc0eedfe2e1092ea60b4fca2e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -325842,9 +323476,9 @@ rule SIGNATURE_BASE_RAT_Blacknix
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/BlackNix"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L122-L142"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "de8787fd35e6313c061b8759361698b1acd54b215d226839a8702b1a5d189ccb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L122-L142"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_de8787fd35e6313c061b8759361698b1acd54b215d226839a8702b1a5d189ccb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -325870,9 +323504,9 @@ rule SIGNATURE_BASE_RAT_Blackshades : BLACKSHADES
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L144-L161"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "23f8d52cf92b594f9302d549cf54f37dc0a01b5686da74b72120a8072435abfe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L144-L161"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_23f8d52cf92b594f9302d549cf54f37dc0a01b5686da74b72120a8072435abfe"
 		score = 75
 		quality = 85
 		tags = "BLACKSHADES"
@@ -325895,9 +323529,9 @@ rule SIGNATURE_BASE_RAT_Bluebanana
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/BlueBanana"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L163-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d84bb63d56d876c8b2e7c8c8afeaba839fee41d2d38f16ac9a13e802008179e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L163-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d84bb63d56d876c8b2e7c8c8afeaba839fee41d2d38f16ac9a13e802008179e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -325924,9 +323558,9 @@ rule SIGNATURE_BASE_RAT_Bozok
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Bozok"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L186-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9a2fcd11573654f0c91c0c0dec8938ca8319a23953a5043135cb0032562f9f53"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L186-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9a2fcd11573654f0c91c0c0dec8938ca8319a23953a5043135cb0032562f9f53"
 		score = 75
 		quality = 75
 		tags = ""
@@ -325952,9 +323586,9 @@ rule SIGNATURE_BASE_RAT_Clientmesh : TORCT
 		date = "2014-01-06"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/ClientMesh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L208-L228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "671da9586110726b1646d4365ccaa87982ec7c86b7d4d80b99dbb444496b936c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L208-L228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_671da9586110726b1646d4365ccaa87982ec7c86b7d4d80b99dbb444496b936c"
 		score = 75
 		quality = 85
 		tags = "TORCT"
@@ -325980,9 +323614,9 @@ rule SIGNATURE_BASE_RAT_Cybergate
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/CyberGate"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L230-L254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6b3861ae5e6bd6478e9d8024b0e67a3ac1dbf31083b77477364c55b51d0ed9b5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L230-L254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6b3861ae5e6bd6478e9d8024b0e67a3ac1dbf31083b77477364c55b51d0ed9b5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326000,7 +323634,7 @@ rule SIGNATURE_BASE_RAT_Cybergate
 		$res2 = "CG-CG-CG-CG"
 
 	condition:
-		all of ($string*) and any of ($res*)
+		all of ( $string* ) and any of ( $res* )
 }
 rule SIGNATURE_BASE_RAT_Darkcomet
 {
@@ -326011,9 +323645,9 @@ rule SIGNATURE_BASE_RAT_Darkcomet
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/DarkComet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L256-L282"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "db139f754f89affc706e090a41bfcd30cf49f9d4e16ade89993ee170f92cf68b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L256-L282"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_db139f754f89affc706e090a41bfcd30cf49f9d4e16ade89993ee170f92cf68b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326032,7 +323666,7 @@ rule SIGNATURE_BASE_RAT_Darkcomet
 		$b5 = "#KCMDDC"
 
 	condition:
-		all of ($a*) or all of ($b*)
+		all of ( $a* ) or all of ( $b* )
 }
 rule SIGNATURE_BASE_RAT_Darkrat
 {
@@ -326043,9 +323677,9 @@ rule SIGNATURE_BASE_RAT_Darkrat
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/DarkRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L284-L306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dccb473a3cf4478dd1dbf8b35ad564f59740676ecde90266a0dc15cbad89bfe7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L284-L306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dccb473a3cf4478dd1dbf8b35ad564f59740676ecde90266a0dc15cbad89bfe7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326073,9 +323707,9 @@ rule SIGNATURE_BASE_RAT_Greame
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Greame"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L308-L331"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4a1ce5f5847bdc01d286c1d9cd1e16ba2fd6b5bc56e6094cb1492882708e8e59"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L308-L331"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4a1ce5f5847bdc01d286c1d9cd1e16ba2fd6b5bc56e6094cb1492882708e8e59"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326104,9 +323738,9 @@ rule SIGNATURE_BASE_RAT_Hawkeye
 		date = "2015-01-06"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/HawkEye"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L333-L357"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "db3a0fe5774f0d137e092a4eb9672a4518d0ef943a1a4619cb646a9ac9f74ee0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L333-L357"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_db3a0fe5774f0d137e092a4eb9672a4518d0ef943a1a4619cb646a9ac9f74ee0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326125,7 +323759,7 @@ rule SIGNATURE_BASE_RAT_Hawkeye
 		$string7 = "BSPLIT" wide
 
 	condition:
-		$key and $salt and all of ($string*)
+		$key and $salt and all of ( $string* )
 }
 rule SIGNATURE_BASE_RAT_Imminent
 {
@@ -326136,9 +323770,9 @@ rule SIGNATURE_BASE_RAT_Imminent
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Imminent"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L359-L389"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aebae753c119950b0b3f315c7279866caf15f4d482c0a47912c90885adcf6db2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L359-L389"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aebae753c119950b0b3f315c7279866caf15f4d482c0a47912c90885adcf6db2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326162,7 +323796,7 @@ rule SIGNATURE_BASE_RAT_Imminent
 		$v2f = "Showed Messagebox" wide
 
 	condition:
-		all of ($v1*) or all of ($v2*)
+		all of ( $v1* ) or all of ( $v2* )
 }
 rule SIGNATURE_BASE_RAT_Infinity
 {
@@ -326173,9 +323807,9 @@ rule SIGNATURE_BASE_RAT_Infinity
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Infinity"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L391-L414"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c1f5381755af6cfbb10a4769757cdeffb9651bddc76bc4c8e9765ed44bf37fe6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L391-L414"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c1f5381755af6cfbb10a4769757cdeffb9651bddc76bc4c8e9765ed44bf37fe6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326204,9 +323838,9 @@ rule SIGNATURE_BASE_RAT_Lostdoor
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/LostDoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L440-L465"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ffa6f5cbeacca5a1e750e35d8296658d4e280078a61f94fd5f2d4b7c800bb44"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L440-L465"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ffa6f5cbeacca5a1e750e35d8296658d4e280078a61f94fd5f2d4b7c800bb44"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326226,7 +323860,7 @@ rule SIGNATURE_BASE_RAT_Lostdoor
 		$b9 = "RC4Decrypt" wide ascii
 
 	condition:
-		all of ($a*) or all of ($b*)
+		all of ( $a* ) or all of ( $b* )
 }
 rule SIGNATURE_BASE_RAT_Luminositylink
 {
@@ -326237,9 +323871,9 @@ rule SIGNATURE_BASE_RAT_Luminositylink
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/LuminosityLink"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L467-L493"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e70e3e0885d098f1ac2bcc324cd8ad2682fbfc395f189cabc4a4f97a0109682"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L467-L493"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e70e3e0885d098f1ac2bcc324cd8ad2682fbfc395f189cabc4a4f97a0109682"
 		score = 75
 		quality = 60
 		tags = ""
@@ -326271,9 +323905,9 @@ rule SIGNATURE_BASE_RAT_Luxnet
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/LuxNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L495-L516"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "55d872e2e30f6d55a6f91750bbb52675042e4673d712a4f2417af43b0f2c4fb9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L495-L516"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_55d872e2e30f6d55a6f91750bbb52675042e4673d712a4f2417af43b0f2c4fb9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326300,9 +323934,9 @@ rule SIGNATURE_BASE_RAT_Netwire
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/NetWire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L547-L569"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6a4e757262c02dfe46ac28940b53a5695df2d242ccd4c16b42fbfdcf96072e91"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L547-L569"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6a4e757262c02dfe46ac28940b53a5695df2d242ccd4c16b42fbfdcf96072e91"
 		score = 75
 		quality = 60
 		tags = ""
@@ -326330,9 +323964,9 @@ rule SIGNATURE_BASE_RAT_Pandora
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Pandora"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L571-L599"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d33598d0699bfb7e996047318099302c2c326e45d993a259c2bc145acf8cf54b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L571-L599"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d33598d0699bfb7e996047318099302c2c326e45d993a259c2bc145acf8cf54b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326366,9 +324000,9 @@ rule SIGNATURE_BASE_RAT_Paradox
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Paradox"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L601-L623"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fef41262b78a497c65c7548c58d78ba8912725b28606fd9e99d1dbc19bdf7393"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L601-L623"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fef41262b78a497c65c7548c58d78ba8912725b28606fd9e99d1dbc19bdf7393"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326396,9 +324030,9 @@ rule SIGNATURE_BASE_RAT_Plasma
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Plasma"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L625-L649"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e73348d379c483a7917cf765a457739aed6940f180272fa8d0c0dd1eb8e5f562"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L625-L649"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e73348d379c483a7917cf765a457739aed6940f180272fa8d0c0dd1eb8e5f562"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326428,9 +324062,9 @@ rule SIGNATURE_BASE_RAT_Poisonivy
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/PoisonIvy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L651-L672"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "874e0dfb22a03abc0f7fdc7209ff13b55dfa5dcc17db944903ca37a549eb331d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L651-L672"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_874e0dfb22a03abc0f7fdc7209ff13b55dfa5dcc17db944903ca37a549eb331d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326446,7 +324080,7 @@ rule SIGNATURE_BASE_RAT_Poisonivy
 		$string5 = "advpack"
 
 	condition:
-		$stub at 0x1620 and all of ($string*) or ( all of them )
+		$stub at 0x1620 and all of ( $string* ) or ( all of them )
 }
 rule SIGNATURE_BASE_RAT_Predatorpain
 {
@@ -326457,9 +324091,9 @@ rule SIGNATURE_BASE_RAT_Predatorpain
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/PredatorPain"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L674-L702"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "917234f83f891ad00bd83908c244818f517ea89cf7d8c81cfc3618b8386c1804"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L674-L702"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_917234f83f891ad00bd83908c244818f517ea89cf7d8c81cfc3618b8386c1804"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326482,7 +324116,7 @@ rule SIGNATURE_BASE_RAT_Predatorpain
 		$ver3 = "Predator Pain" wide
 
 	condition:
-		7 of ($string*) and any of ($ver*)
+		7 of ( $string* ) and any of ( $ver* )
 }
 rule SIGNATURE_BASE_RAT_Punisher
 {
@@ -326493,9 +324127,9 @@ rule SIGNATURE_BASE_RAT_Punisher
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Punisher"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L704-L726"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9347b8053393c3537693273c44a2a2f095928b8bc0cdcf9365a6f060d66efeb5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L704-L726"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9347b8053393c3537693273c44a2a2f095928b8bc0cdcf9365a6f060d66efeb5"
 		score = 75
 		quality = 60
 		tags = ""
@@ -326523,9 +324157,9 @@ rule SIGNATURE_BASE_RAT_Pythorat
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/PythoRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L728-L751"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8edcfb8f234ff225537d19343c75788ec2a25940e80042751eea3280a967e166"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L728-L751"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8edcfb8f234ff225537d19343c75788ec2a25940e80042751eea3280a967e166"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326554,9 +324188,9 @@ rule SIGNATURE_BASE_RAT_Qrat
 		date = "2015-01-08"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L753-L773"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6d404153ca64b547885e4e4581205f5fc20faf86e8ab18002c5deedca2487225"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L753-L773"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6d404153ca64b547885e4e4581205f5fc20faf86e8ab18002c5deedca2487225"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326582,9 +324216,9 @@ rule SIGNATURE_BASE_RAT_Sakula : FILE
 		date = "2015-10-13"
 		modified = "2023-12-05"
 		reference = "http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L775-L817"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec4e16deb6f4a671ee665c81568e87dc9a1023328e1be242eae015c1e04cfcef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L775-L817"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec4e16deb6f4a671ee665c81568e87dc9a1023328e1be242eae015c1e04cfcef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -326613,7 +324247,7 @@ rule SIGNATURE_BASE_RAT_Sakula : FILE
 		$fp1 = "Symantec Corporation" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ((3 of ($s*) and any of ($v1_*)) or ( any of ($serial0*)) or ( any of ($opcodes*))) and not 1 of ($fp*)
+		uint16( 0 ) == 0x5a4d and ( ( 3 of ( $s* ) and any of ( $v1_* ) ) or ( any of ( $serial0* ) ) or ( any of ( $opcodes* ) ) ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_RAT_Shadowtech : FILE
 {
@@ -326624,9 +324258,9 @@ rule SIGNATURE_BASE_RAT_Shadowtech : FILE
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/ShadowTech"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L819-L839"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8ab024ae5ca62de30daf4392db5241220fcdb9b419bad555a996729aed9fa45d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L819-L839"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8ab024ae5ca62de30daf4392db5241220fcdb9b419bad555a996729aed9fa45d"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -326654,9 +324288,9 @@ rule SIGNATURE_BASE_RAT_Smallnet
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/SmallNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L841-L861"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "17a6be371ce0c616cfea0b42a30e6d9118376912002d59790b133c73fd5436a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L841-L861"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_17a6be371ce0c616cfea0b42a30e6d9118376912002d59790b133c73fd5436a3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326671,7 +324305,7 @@ rule SIGNATURE_BASE_RAT_Smallnet
 		$a3 = "get_CurrentDomain"
 
 	condition:
-		($split1 or $split2) and ( all of ($a*))
+		($split1 or $split2 ) and ( all of ( $a* ) )
 }
 rule SIGNATURE_BASE_RAT_Spygate
 {
@@ -326682,9 +324316,9 @@ rule SIGNATURE_BASE_RAT_Spygate
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/SpyGate"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L863-L890"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b891212f3a669c6066cfddef418faafd75c92bb2f1e8e1f48403422a73bc9fa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L863-L890"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b891212f3a669c6066cfddef418faafd75c92bb2f1e8e1f48403422a73bc9fa"
 		score = 75
 		quality = 83
 		tags = ""
@@ -326706,7 +324340,7 @@ rule SIGNATURE_BASE_RAT_Spygate
 		$c5 = "Chating With >> [~Hacker~]" wide
 
 	condition:
-		( all of ($a*) and #split>40) or ( all of ($b*) and #split>10) or ( all of ($c*))
+		( all of ( $a* ) and #split > 40 ) or ( all of ( $b* ) and #split > 10 ) or ( all of ( $c* ) )
 }
 rule SIGNATURE_BASE_RAT_Sub7Nation
 {
@@ -326717,9 +324351,9 @@ rule SIGNATURE_BASE_RAT_Sub7Nation
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Sub7Nation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L892-L913"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bd6c423cd5cb5a86b20e5e65ab460904548b8814c92ac65e497757bb79a27681"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L892-L913"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bd6c423cd5cb5a86b20e5e65ab460904548b8814c92ac65e497757bb79a27681"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326746,9 +324380,9 @@ rule SIGNATURE_BASE_RAT_Vertex
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Vertex"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L915-L938"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c9fb0dedd97240ad29924865118ba34f5d79dbefbb13729d96d41336ec4de39e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L915-L938"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c9fb0dedd97240ad29924865118ba34f5d79dbefbb13729d96d41336ec4de39e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326777,9 +324411,9 @@ rule SIGNATURE_BASE_RAT_Virusrat
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/VirusRat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L940-L967"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8540296fe1341a793377494cec9ba6ee0313203bee9997f0da0b692959727c59"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L940-L967"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8540296fe1341a793377494cec9ba6ee0313203bee9997f0da0b692959727c59"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326812,9 +324446,9 @@ rule SIGNATURE_BASE_RAT_Xtreme
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/Xtreme"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L969-L990"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4dec8de6609f8229444291a78e920ac48b9b5751dd0cad7c95bc6529d6f8c16c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L969-L990"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4dec8de6609f8229444291a78e920ac48b9b5751dd0cad7c95bc6529d6f8c16c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326841,9 +324475,9 @@ rule SIGNATURE_BASE_RAT_Adwind
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/adWind"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L992-L1011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "11167b927fa06324950753c6ec8f28058f2aa66fb4ecdf66a21de11a8db190b8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L992-L1011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_11167b927fa06324950753c6ec8f28058f2aa66fb4ecdf66a21de11a8db190b8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326868,9 +324502,9 @@ rule SIGNATURE_BASE_RAT_Njrat
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/njRat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L1013-L1036"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "47e8cc71caaefd70a170eb8fc845cb7ddb8df04b90163fe35f1ccb9a3f614c57"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L1013-L1036"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_47e8cc71caaefd70a170eb8fc845cb7ddb8df04b90163fe35f1ccb9a3f614c57"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326887,7 +324521,7 @@ rule SIGNATURE_BASE_RAT_Njrat
 		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide
 
 	condition:
-		all of ($s*) and any of ($v*)
+		all of ( $s* ) and any of ( $v* )
 }
 rule SIGNATURE_BASE_RAT_Unrecom
 {
@@ -326898,9 +324532,9 @@ rule SIGNATURE_BASE_RAT_Unrecom
 		date = "2014-01-04"
 		modified = "2023-12-05"
 		reference = "http://malwareconfig.com/stats/unrecom"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L1038-L1058"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "15ab9ee2f3fd825e91813a185bc5c7d7e790de39cd3e88c375b801d1412a08f4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L1038-L1058"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_15ab9ee2f3fd825e91813a185bc5c7d7e790de39cd3e88c375b801d1412a08f4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -326926,9 +324560,9 @@ rule SIGNATURE_BASE_MAL_JRAT_Oct18_1 : FILE
 		date = "2018-10-11"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rats_malwareconfig.yar#L1060-L1072"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7c652f3943ae7639633b82663f639adb7dea1bae9e617a14710fb6e448cfdbee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rats_malwareconfig.yar#L1060-L1072"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7c652f3943ae7639633b82663f639adb7dea1bae9e617a14710fb6e448cfdbee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -326938,7 +324572,7 @@ rule SIGNATURE_BASE_MAL_JRAT_Oct18_1 : FILE
 		$x1 = "/JRat.class" ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <700KB and 1 of them
+		uint16( 0 ) == 0x4b50 and filesize < 700KB and 1 of them
 }
 rule SIGNATURE_BASE_MAL_Backdoor_DLL_Nov23_1 : CVE_2023_4966 FILE
 {
@@ -326949,9 +324583,9 @@ rule SIGNATURE_BASE_MAL_Backdoor_DLL_Nov23_1 : CVE_2023_4966 FILE
 		date = "2023-11-23"
 		modified = "2023-12-05"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6788d37301bb82bd4d9584e192e2fb14d4f6c77801b70299097d8ba139219394"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6788d37301bb82bd4d9584e192e2fb14d4f6c77801b70299097d8ba139219394"
 		score = 80
 		quality = 85
 		tags = "CVE-2023-4966, FILE"
@@ -326967,7 +324601,7 @@ rule SIGNATURE_BASE_MAL_Backdoor_DLL_Nov23_1 : CVE_2023_4966 FILE
 		$op2 = { 48 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 03 00 00 00 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 44 0F B7 05 ?? ?? ?? ?? 48 8B D0 48 8B 4C 24 ?? FF 15 }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($op*))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $op* ) )
 }
 rule SIGNATURE_BASE_MAL_Trojan_DLL_Nov23 : CVE_2023_4966 FILE
 {
@@ -326978,9 +324612,9 @@ rule SIGNATURE_BASE_MAL_Trojan_DLL_Nov23 : CVE_2023_4966 FILE
 		date = "2023-11-23"
 		modified = "2023-12-05"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L24-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9be42742711b4d0440244b507945e074b61c456588580b3263f899a7eb84d8aa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L24-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9be42742711b4d0440244b507945e074b61c456588580b3263f899a7eb84d8aa"
 		score = 80
 		quality = 85
 		tags = "CVE-2023-4966, FILE"
@@ -326992,7 +324626,7 @@ rule SIGNATURE_BASE_MAL_Trojan_DLL_Nov23 : CVE_2023_4966 FILE
 		$op3 = { C7 84 24 ?? ?? ?? ?? 4E 64 72 43 C7 84 24 ?? ?? ?? ?? 6C 69 65 6E C7 84 24 ?? ?? ?? ?? 74 43 61 6C C7 84 24 ?? ?? ?? ?? 6C 33 00 8D }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_MAL_DLL_Stealer_Nov23 : CVE_2023_4966 FILE
 {
@@ -327003,9 +324637,9 @@ rule SIGNATURE_BASE_MAL_DLL_Stealer_Nov23 : CVE_2023_4966 FILE
 		date = "2023-11-23"
 		modified = "2023-12-05"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L41-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d0c46d855973cb2c0636aed9c67cfbe47ca260ab1bc842fef1d532725c26910"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L41-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d0c46d855973cb2c0636aed9c67cfbe47ca260ab1bc842fef1d532725c26910"
 		score = 80
 		quality = 85
 		tags = "CVE-2023-4966, FILE"
@@ -327015,7 +324649,7 @@ rule SIGNATURE_BASE_MAL_DLL_Stealer_Nov23 : CVE_2023_4966 FILE
 		$op1 = { C7 45 ?? 4D 69 6E 69 C7 45 ?? 44 75 6D 70 C7 45 ?? 57 72 69 74 C7 45 ?? 65 44 75 6D C7 45 ?? 70 00 27 00 C7 45 ?? 44 00 62 00 C7 45 ?? 67 00 68 00 C7 45 ?? 65 00 6C 00 C7 45 ?? 70 00 2E 00 C7 45 ?? 64 00 6C 00 C7 45 ?? 6C 00 00 00}
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_MAL_Python_Backdoor_Script_Nov23 : CVE_2023_4966 FILE
 {
@@ -327026,9 +324660,9 @@ rule SIGNATURE_BASE_MAL_Python_Backdoor_Script_Nov23 : CVE_2023_4966 FILE
 		date = "2023-11-23"
 		modified = "2023-12-05"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L56-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b336f6438a420af49b1b0144039f1051f12c0c54f77a94e2f947f71d1f6230b3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L56-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b336f6438a420af49b1b0144039f1051f12c0c54f77a94e2f947f71d1f6230b3"
 		score = 80
 		quality = 85
 		tags = "CVE-2023-4966, FILE"
@@ -327040,7 +324674,7 @@ rule SIGNATURE_BASE_MAL_Python_Backdoor_Script_Nov23 : CVE_2023_4966 FILE
 		$s3 = "Windwoscmd.run_cmd(str(cmd))" ascii
 
 	condition:
-		filesize <50KB and all of them
+		filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_APT_RANSOM_Lockbit_Forensicartifacts_Nov23
 {
@@ -327051,9 +324685,9 @@ rule SIGNATURE_BASE_APT_RANSOM_Lockbit_Forensicartifacts_Nov23
 		date = "2023-11-22"
 		modified = "2023-12-05"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L73-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ba1d47e2cac72143c4612c420777024f114afc007c7b15251a58819654aeff1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L73-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ba1d47e2cac72143c4612c420777024f114afc007c7b15251a58819654aeff1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -327063,7 +324697,7 @@ rule SIGNATURE_BASE_APT_RANSOM_Lockbit_Forensicartifacts_Nov23
 		$x2 = " 1> \\\\127.0.0.1\\admin$\\__"
 
 	condition:
-		1 of ($x*)
+		1 of ( $x* )
 }
 rule SIGNATURE_BASE_Rottenpotato_Potato : FILE
 {
@@ -327074,9 +324708,9 @@ rule SIGNATURE_BASE_Rottenpotato_Potato : FILE
 		date = "2017-02-07"
 		modified = "2022-12-21"
 		reference = "https://github.com/foxglovesec/RottenPotato"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rottenpotato.yar#L10-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "79d2dfd5c2cfd12301c1924dce2ca2a2c3cc070565671c3e0cd69123d2245b1c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rottenpotato.yar#L10-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_79d2dfd5c2cfd12301c1924dce2ca2a2c3cc070565671c3e0cd69123d2245b1c"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -327095,7 +324729,7 @@ rule SIGNATURE_BASE_Rottenpotato_Potato : FILE
 		$s1 = "\"C:\\Windows\\System32\\cmd.exe\" /K start" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*)) or (2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) ) or ( 2 of them )
 }
 import "pe"
 
@@ -327108,9 +324742,9 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_1 : FILE
 		date = "2018-02-07"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_middle_east_talosreport.yar#L13-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e5ea689de4be64a02aed31c85a4bd56561ba932587998bc276ddba248d73fa2d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_middle_east_talosreport.yar#L13-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e5ea689de4be64a02aed31c85a4bd56561ba932587998bc276ddba248d73fa2d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327118,7 +324752,7 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_1 : FILE
 		hash1 = "1176642841762b3bc1f401a5987dc55ae4b007367e98740188468642ffbd474e"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and (pe.imphash()=="618f76eaf4bd95c690d43e84d617efe9")
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( pe.imphash ( ) == "618f76eaf4bd95c690d43e84d617efe9" )
 }
 import "pe"
 
@@ -327131,9 +324765,9 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_2 : FILE
 		date = "2018-02-07"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_middle_east_talosreport.yar#L28-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "414e7760c56d2a1713258bb5c5f65e4fb561523ae037f8715d7fba5914ef9211"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_middle_east_talosreport.yar#L28-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_414e7760c56d2a1713258bb5c5f65e4fb561523ae037f8715d7fba5914ef9211"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327148,10 +324782,8 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_2 : FILE
 		$s5 = "Cimzal" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="b06055e6cc2a804111ab6964df1ca4ae" or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "b06055e6cc2a804111ab6964df1ca4ae" or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_ME_Campaign_Malware_3 : FILE
 {
 	meta:
@@ -327161,9 +324793,9 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_3 : FILE
 		date = "2018-02-07"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_middle_east_talosreport.yar#L50-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d45f9f624285ed13a16901335585490459f22ef8af157c38b720118735ed432"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_middle_east_talosreport.yar#L50-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d45f9f624285ed13a16901335585490459f22ef8af157c38b720118735ed432"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327177,7 +324809,7 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_3 : FILE
 		$s4 = "File=appData & \"\\sys.ps1\"" fullword ascii
 
 	condition:
-		uint16(0)==0x6553 and filesize <400KB and 1 of them
+		uint16( 0 ) == 0x6553 and filesize < 400KB and 1 of them
 }
 import "pe"
 
@@ -327190,9 +324822,9 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_4 : FILE
 		date = "2018-02-07"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_middle_east_talosreport.yar#L68-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "83340b2d8f5f58f886eb318b80d7fbb0b9a4f5ad634db857edc405932f3ea5bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_middle_east_talosreport.yar#L68-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_83340b2d8f5f58f886eb318b80d7fbb0b9a4f5ad634db857edc405932f3ea5bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327200,10 +324832,8 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_4 : FILE
 		hash1 = "c5bfb5118a999d21e9f445ad6ccb08eb71bc7bd4de9e88a41be9cf732156c525"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and pe.imphash()=="fb7da233a35ac523d6059fff543627ab"
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and pe.imphash ( ) == "fb7da233a35ac523d6059fff543627ab"
 }
-import "pe"
-
 rule SIGNATURE_BASE_ME_Campaign_Malware_5 : FILE
 {
 	meta:
@@ -327213,9 +324843,9 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_5 : FILE
 		date = "2018-02-07"
 		modified = "2022-08-18"
 		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_middle_east_talosreport.yar#L81-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b958a09be09de03e702a0653cf51148698b35c29bed90edbc3a65e485f0c3aa6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_middle_east_talosreport.yar#L81-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b958a09be09de03e702a0653cf51148698b35c29bed90edbc3a65e485f0c3aa6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327231,7 +324861,7 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_5 : FILE
 		$s6 = "time.nist.gov" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and 5 of them or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and 5 of them or all of them
 }
 rule SIGNATURE_BASE_APT34_Malware_HTA : FILE
 {
@@ -327242,9 +324872,9 @@ rule SIGNATURE_BASE_APT34_Malware_HTA : FILE
 		date = "2017-12-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt34.yar#L12-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bf9b988b3ef46df29e0f91c3ea186aaab8a1ccb79563e97521311bf2e1215d7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt34.yar#L12-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bf9b988b3ef46df29e0f91c3ea186aaab8a1ccb79563e97521311bf2e1215d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327261,7 +324891,7 @@ rule SIGNATURE_BASE_APT34_Malware_HTA : FILE
 		$s2 = "<body onload=\"test()\">" fullword ascii
 
 	condition:
-		filesize <60KB and (1 of ($x*) or all of ($s*))
+		filesize < 60KB and ( 1 of ( $x* ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_APT34_Malware_Exeruner : FILE
 {
@@ -327272,9 +324902,9 @@ rule SIGNATURE_BASE_APT34_Malware_Exeruner : FILE
 		date = "2017-12-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt34.yar#L34-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "71840d9a0f8a5dc39656e6bf1ad94fa275bcd18baf6b374dfe040c161d62a960"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt34.yar#L34-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_71840d9a0f8a5dc39656e6bf1ad94fa275bcd18baf6b374dfe040c161d62a960"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327297,7 +324927,7 @@ rule SIGNATURE_BASE_APT34_Malware_Exeruner : FILE
 		$s13 = "${global:$dns_ag} = \"aQBmACAAKAAoAEcAZQB0AC0AVwBtAGk" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
 }
 rule SIGNATURE_BASE_Line_Dancer
 {
@@ -327308,9 +324938,9 @@ rule SIGNATURE_BASE_Line_Dancer
 		date = "2024-04-24"
 		modified = "2024-04-29"
 		reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cisco_asa_line_dancer_apr24.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "179e58274a792bc4a16787d251f5ad25de1271084323e62e153fa6d461e3c07e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cisco_asa_line_dancer_apr24.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_179e58274a792bc4a16787d251f5ad25de1271084323e62e153fa6d461e3c07e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -327332,9 +324962,9 @@ rule SIGNATURE_BASE_MAL_Backnet_Nov18_1 : FILE
 		date = "2018-11-02"
 		modified = "2023-12-05"
 		reference = "https://github.com/valsov/BackNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_backnet.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ea809a65a3cd786efe03ff7d831847e658851f76ee9dd084cb6c622b6e44c75f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_backnet.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ea809a65a3cd786efe03ff7d831847e658851f76ee9dd084cb6c622b6e44c75f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327350,7 +324980,7 @@ rule SIGNATURE_BASE_MAL_Backnet_Nov18_1 : FILE
 		$s7 = "ThisIsMyMutex-2JUY34DE8E23D7" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them
 }
 import "pe"
 
@@ -327363,15 +324993,15 @@ rule SIGNATURE_BASE_SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1 : FILE
 		date = "2022-03-03"
 		modified = "2022-03-04"
 		reference = "https://twitter.com/cyb3rops/status/1499514240008437762"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_nvidia_leaked_cert.yar#L4-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e7e9e58ec1e3922471ad3ffd4ad9fbb3ac4b3c3841c35d1cd8886607f3cf1ab9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_nvidia_leaked_cert.yar#L4-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e7e9e58ec1e3922471ad3ffd4ad9fbb3ac4b3c3841c35d1cd8886607f3cf1ab9"
 		score = 70
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100MB and pe.timestamp>1646092800 and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and (pe.signatures[i].serial=="43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5" or pe.signatures[i].serial=="14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18"))
+		uint16( 0 ) == 0x5a4d and filesize < 100MB and pe.timestamp > 1646092800 and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "VeriSign Class 3 Code Signing 2010 CA" and ( pe.signatures [ i ] . serial == "43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5" or pe.signatures [ i ] . serial == "14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18" ) )
 }
 rule SIGNATURE_BASE_Flash_CVE_2015_5119_APT3_Leg : CVE_2015_5119 FILE
 {
@@ -327382,9 +325012,9 @@ rule SIGNATURE_BASE_Flash_CVE_2015_5119_APT3_Leg : CVE_2015_5119 FILE
 		date = "2015-08-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2015_5119.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "99af6b9ecc18b87b14968eb8fffefac7be10dd727d8af2d0488fae4a96196e85"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2015_5119.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_99af6b9ecc18b87b14968eb8fffefac7be10dd727d8af2d0488fae4a96196e85"
 		score = 70
 		quality = 85
 		tags = "CVE-2015-5119, FILE"
@@ -327401,7 +325031,7 @@ rule SIGNATURE_BASE_Flash_CVE_2015_5119_APT3_Leg : CVE_2015_5119 FILE
 		$s6 = "todo: unknown 32-bit target" fullword ascii
 
 	condition:
-		uint16(0)==0x5746 and 1 of them
+		uint16( 0 ) == 0x5746 and 1 of them
 }
 rule SIGNATURE_BASE_Metasploit_Loader_Rsmudge : FILE
 {
@@ -327412,9 +325042,9 @@ rule SIGNATURE_BASE_Metasploit_Loader_Rsmudge : FILE
 		date = "2016-04-20"
 		modified = "2023-12-05"
 		reference = "https://github.com/rsmudge/metasploit-loader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_loader_rsmudge.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "50b1898e3087a5e0876b87179252c452af48e00bbef52297060d70acd90d0133"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_loader_rsmudge.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_50b1898e3087a5e0876b87179252c452af48e00bbef52297060d70acd90d0133"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327429,10 +325059,8 @@ rule SIGNATURE_BASE_Metasploit_Loader_Rsmudge : FILE
 		$s5 = "read a strange or incomplete length value" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (3 of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 3 of ( $s* ) ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_RANCOR_JS_Malware : FILE
 {
 	meta:
@@ -327442,9 +325070,9 @@ rule SIGNATURE_BASE_APT_RANCOR_JS_Malware : FILE
 		date = "2018-06-26"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rancor.yar#L13-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d1e86d4395d4f84518750b5d58d15ed79b79570fbe50010d5d790b4c2511bb2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rancor.yar#L13-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d1e86d4395d4f84518750b5d58d15ed79b79570fbe50010d5d790b4c2511bb2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327457,10 +325085,8 @@ rule SIGNATURE_BASE_APT_RANCOR_JS_Malware : FILE
 		$x3 = "CreateObject(\"Wscript.Shell\").Run \"schtasks /create" ascii
 
 	condition:
-		uint16(0)==0x533c and filesize <1KB and 1 of them
+		uint16( 0 ) == 0x533c and filesize < 1KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Variant : FILE
 {
 	meta:
@@ -327470,9 +325096,9 @@ rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Variant : FILE
 		date = "2018-06-26"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rancor.yar#L30-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d22aa91d0f66dbb85b79c0f121f0508135bf817929d81f3ff0b3fdf223ba53ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rancor.yar#L30-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d22aa91d0f66dbb85b79c0f121f0508135bf817929d81f3ff0b3fdf223ba53ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327489,7 +325115,7 @@ rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Variant : FILE
 		$s16 = "recv plugin type %s size:%d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them
 }
 import "pe"
 
@@ -327502,9 +325128,9 @@ rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Malware_Exports : FILE
 		date = "2018-06-26"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rancor.yar#L51-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aa55452d4639dbaec760277908906c4ff9e8b66a60b1bcdc157ce23bd5d596db"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rancor.yar#L51-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aa55452d4639dbaec760277908906c4ff9e8b66a60b1bcdc157ce23bd5d596db"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327512,7 +325138,7 @@ rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Malware_Exports : FILE
 		hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
 
 	condition:
-		uint16(0)==0x5a4d and pe.exports("Add") and pe.exports("Sub") and pe.exports("DllEntryPoint") and pe.number_of_exports==3
+		uint16( 0 ) == 0x5a4d and pe.exports ( "Add" ) and pe.exports ( "Sub" ) and pe.exports ( "DllEntryPoint" ) and pe.number_of_exports == 3
 }
 import "pe"
 
@@ -327525,9 +325151,9 @@ rule SIGNATURE_BASE_APT_RANCOR_DDKONG_Malware_Exports : FILE
 		date = "2018-06-26"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rancor.yar#L64-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d11d46530c22b323c504344448d91fd43c0eecd29cf29aa4da7b2c797d27ff9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rancor.yar#L64-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d11d46530c22b323c504344448d91fd43c0eecd29cf29aa4da7b2c797d27ff9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327535,10 +325161,8 @@ rule SIGNATURE_BASE_APT_RANCOR_DDKONG_Malware_Exports : FILE
 		hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
 
 	condition:
-		uint16(0)==0x5a4d and pe.exports("ServiceMain") and pe.exports("Rundll32Call") and pe.exports("DllEntryPoint") and pe.number_of_exports==3
+		uint16( 0 ) == 0x5a4d and pe.exports ( "ServiceMain" ) and pe.exports ( "Rundll32Call" ) and pe.exports ( "DllEntryPoint" ) and pe.number_of_exports == 3
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Shellcode_Loader_Apr23
 {
 	meta:
@@ -327548,9 +325172,9 @@ rule SIGNATURE_BASE_MAL_Shellcode_Loader_Apr23
 		date = "2023-04-03"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_mal_gopuram_apr23.yar#L3-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4e423158757c80b5e4e77f6a343323a87798c6697cf6a832aa01a146712b250"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_mal_gopuram_apr23.yar#L3-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4e423158757c80b5e4e77f6a343323a87798c6697cf6a832aa01a146712b250"
 		score = 80
 		quality = 85
 		tags = ""
@@ -327575,9 +325199,9 @@ rule SIGNATURE_BASE_APT_MAL_Gopuram_Backdoor_Apr23 : FILE
 		date = "2023-02-24"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_mal_gopuram_apr23.yar#L20-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aa3dd1f35d27d23eb775410cceae81d5b767dc0f1636aac67f2d2e988a3ed995"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_mal_gopuram_apr23.yar#L20-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aa3dd1f35d27d23eb775410cceae81d5b767dc0f1636aac67f2d2e988a3ed995"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -327591,10 +325215,8 @@ rule SIGNATURE_BASE_APT_MAL_Gopuram_Backdoor_Apr23 : FILE
 		$opa2 = { 48 89 B4 24 ?? ?? ?? ?? 44 8D 43 ?? 33 D2 48 89 BC 24 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 45 33 C0 33 D2 8B F8 E8 ?? ?? ?? ?? 8D 4F ?? E8 ?? ?? ?? ?? 4C 8B 4C 24 ?? 44 8D 43 ?? 48 8B C8 8B D7 48 8B F0 44 8B F7 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8  }
 
 	condition:
-		( uint16(0)==0x5A4D and filesize <2MB and pe.characteristics&pe.DLL and 1 of ($x*)) or all of ($opa*)
+		( uint16( 0 ) == 0x5A4D and filesize < 2MB and pe.characteristics & pe.DLL and 1 of ( $x* ) ) or all of ( $opa* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_NK_MAL_DLL_Apr23_1 : FILE
 {
 	meta:
@@ -327604,9 +325226,9 @@ rule SIGNATURE_BASE_APT_NK_MAL_DLL_Apr23_1 : FILE
 		date = "2023-04-03"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_mal_gopuram_apr23.yar#L43-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e0a8f3896c0119ce399e83fe3e565c66144693e84996aa3d01ca1b6315521782"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_mal_gopuram_apr23.yar#L43-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e0a8f3896c0119ce399e83fe3e565c66144693e84996aa3d01ca1b6315521782"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327625,10 +325247,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_DLL_Apr23_1 : FILE
 		$op3 = { 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 2 of them ) or ($x1 and 1 of ($s*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 2 of them ) or ( $x1 and 1 of ( $s* ) or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1 : FILE
 {
 	meta:
@@ -327638,9 +325258,9 @@ rule SIGNATURE_BASE_APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1 : FILE
 		date = "2023-03-04"
 		modified = "2023-12-05"
 		reference = "https://www.3cx.com/blog/news/mandiant-initial-results/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_mal_gopuram_apr23.yar#L77-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f67af611d0b3d96e4aaf7b3b5e49c1fb536e61a430b79ac0a0560ef3773ba140"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_mal_gopuram_apr23.yar#L77-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f67af611d0b3d96e4aaf7b3b5e49c1fb536e61a430b79ac0a0560ef3773ba140"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -327650,7 +325270,7 @@ rule SIGNATURE_BASE_APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1 : FILE
 		$p00_1 = {4d3926488b01400f94c6ff90[4]41b9[4]eb??8bde4885c074}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 import "pe"
 
@@ -327663,9 +325283,9 @@ rule SIGNATURE_BASE_MAL_XMR_Miner_May19_1 : HIGHVOL FILE
 		date = "2019-05-31"
 		modified = "2023-12-05"
 		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_nansh0u.yar#L15-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "85a65fd2355850b7f5261ad41091e181562938356ba3dae7d867f7ac8922a16e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_nansh0u.yar#L15-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_85a65fd2355850b7f5261ad41091e181562938356ba3dae7d867f7ac8922a16e"
 		score = 85
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -327678,7 +325298,7 @@ rule SIGNATURE_BASE_MAL_XMR_Miner_May19_1 : HIGHVOL FILE
 		$s2 = "\\\\?\\pipe\\uv\\%p-%lu" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <14000KB and (pe.imphash()=="25d9618d1e16608cd5d14d8ad6e1f98e" or 1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 14000KB and ( pe.imphash ( ) == "25d9618d1e16608cd5d14d8ad6e1f98e" or 1 of ( $x* ) or 2 of them )
 }
 import "pe"
 
@@ -327691,19 +325311,17 @@ rule SIGNATURE_BASE_HKTL_CN_Prochook_May19_1 : FILE
 		date = "2019-05-31"
 		modified = "2023-12-05"
 		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_nansh0u.yar#L38-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "de55990c130702a05e96ee769707a81ce0ec58a515d75a9a99b20265ce3db682"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_nansh0u.yar#L38-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_de55990c130702a05e96ee769707a81ce0ec58a515d75a9a99b20265ce3db682"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		hash1 = "02ebdc1ff6075c15a44711ccd88be9d6d1b47607fea17bef7e5e17f8da35293e"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and pe.imphash()=="343d580dd50ee724746a5c28f752b709"
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and pe.imphash ( ) == "343d580dd50ee724746a5c28f752b709"
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_PDB_CN_Threat_Actor_May19_1 : FILE
 {
 	meta:
@@ -327713,9 +325331,9 @@ rule SIGNATURE_BASE_SUSP_PDB_CN_Threat_Actor_May19_1 : FILE
 		date = "2019-05-31"
 		modified = "2023-12-05"
 		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_nansh0u.yar#L52-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "adcfe3d4bc6fcaf6be4f70c91fb2150bfa2d61f1ba84f96a0bf0c39ed0380b6a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_nansh0u.yar#L52-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_adcfe3d4bc6fcaf6be4f70c91fb2150bfa2d61f1ba84f96a0bf0c39ed0380b6a"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -327725,7 +325343,7 @@ rule SIGNATURE_BASE_SUSP_PDB_CN_Threat_Actor_May19_1 : FILE
 		$x1 = "C:\\Users\\zcg\\Desktop\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
 }
 import "pe"
 
@@ -327738,19 +325356,17 @@ rule SIGNATURE_BASE_MAL_Ramnit_May19_1 : FILE
 		date = "2019-05-31"
 		modified = "2023-12-05"
 		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_nansh0u.yar#L67-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51d574f457c37eba3c29f869e03244b9471be6f6c8319aa0ddfad34be748eb53"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_nansh0u.yar#L67-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51d574f457c37eba3c29f869e03244b9471be6f6c8319aa0ddfad34be748eb53"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		hash1 = "d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and pe.imphash()=="500cd02578808f964519eb2c85153046"
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and pe.imphash ( ) == "500cd02578808f964519eb2c85153046"
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Parite_Malware_May19_1 : FILE
 {
 	meta:
@@ -327760,9 +325376,9 @@ rule SIGNATURE_BASE_MAL_Parite_Malware_May19_1 : FILE
 		date = "2019-05-31"
 		modified = "2023-12-05"
 		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_nansh0u.yar#L80-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b458b05178f18be1e936c1b42bbd91c739f288570fca759b85f1bb143899f1a8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_nansh0u.yar#L80-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b458b05178f18be1e936c1b42bbd91c739f288570fca759b85f1bb143899f1a8"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -327778,7 +325394,7 @@ rule SIGNATURE_BASE_MAL_Parite_Malware_May19_1 : FILE
 		$x2 = "dllhot.exe --auto --any --forever --keepalive" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 10000KB and ( 1 of ( $x* ) or 2 of them )
 }
 import "pe"
 
@@ -327791,9 +325407,9 @@ rule SIGNATURE_BASE_MAL_Parite_Malware_May19_2 : FILE
 		date = "2019-05-31"
 		modified = "2023-12-05"
 		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_nansh0u.yar#L102-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "060a26ed6679b7038f1a89385220ad9112d3102023ea9d141332077f79bbe728"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_nansh0u.yar#L102-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_060a26ed6679b7038f1a89385220ad9112d3102023ea9d141332077f79bbe728"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327803,10 +325419,8 @@ rule SIGNATURE_BASE_MAL_Parite_Malware_May19_2 : FILE
 		hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <18000KB and (pe.imphash()=="b132a2719be01a6ef87d9939d785e19e" or pe.imphash()=="78f4f885323ffee9f8fa011455d0523d")
+		uint16( 0 ) == 0x5a4d and filesize < 18000KB and ( pe.imphash ( ) == "b132a2719be01a6ef87d9939d785e19e" or pe.imphash ( ) == "78f4f885323ffee9f8fa011455d0523d" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EXPL_Strings_CVE_POC_May19_1 : FILE
 {
 	meta:
@@ -327816,9 +325430,9 @@ rule SIGNATURE_BASE_EXPL_Strings_CVE_POC_May19_1 : FILE
 		date = "2019-05-31"
 		modified = "2023-12-05"
 		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_nansh0u.yar#L120-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b470e9f5716130d810e519abb8d4e1058b5a806d59ddae53a40cac5597fbb874"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_nansh0u.yar#L120-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b470e9f5716130d810e519abb8d4e1058b5a806d59ddae53a40cac5597fbb874"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -327831,7 +325445,7 @@ rule SIGNATURE_BASE_EXPL_Strings_CVE_POC_May19_1 : FILE
 		$x4 = "Allocate fake tagWnd fail!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
 }
 import "pe"
 
@@ -327844,9 +325458,9 @@ rule SIGNATURE_BASE_SUSP_Adobepdf_SFX_Bitmap_Combo_Executable : FILE
 		date = "2020-11-02"
 		modified = "2023-12-05"
 		reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_icon_anomalies.yar#L3-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ac515d698507be6085684a6ec4622c6f3c26d0c3a0d94cbbeacfab7dfb9fe135"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_icon_anomalies.yar#L3-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ac515d698507be6085684a6ec4622c6f3c26d0c3a0d94cbbeacfab7dfb9fe135"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -327873,7 +325487,7 @@ rule SIGNATURE_BASE_SUSP_Adobepdf_SFX_Bitmap_Combo_Executable : FILE
                5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them and pe.number_of_signatures<1
+		uint16( 0 ) == 0x5a4d and all of them and pe.number_of_signatures < 1
 }
 import "pe"
 
@@ -327886,9 +325500,9 @@ rule SIGNATURE_BASE_SUSP_Adobepdf_Bitmap_Executable : FILE
 		date = "2020-11-02"
 		modified = "2023-12-05"
 		reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_icon_anomalies.yar#L39-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a8ef5ce2e876565c7d6367ce555d00bd3535699f1907f867811f2f6749672c67"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_icon_anomalies.yar#L39-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a8ef5ce2e876565c7d6367ce555d00bd3535699f1907f867811f2f6749672c67"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -327910,7 +325524,7 @@ rule SIGNATURE_BASE_SUSP_Adobepdf_Bitmap_Executable : FILE
 		$fp1 = "Adobe" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and $sc1 and not 1 of ($fp*) and pe.number_of_signatures<1
+		uint16( 0 ) == 0x5a4d and $sc1 and not 1 of ( $fp* ) and pe.number_of_signatures < 1
 }
 import "pe"
 
@@ -327923,9 +325537,9 @@ rule SIGNATURE_BASE_Hkdoor_Backdoor_Dll : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hkdoor.yar#L11-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "77901d1f2d6c53161c79b50ef20eeb424bf1b8b32906302ca10f3c4b82a58e2a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hkdoor.yar#L11-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_77901d1f2d6c53161c79b50ef20eeb424bf1b8b32906302ca10f3c4b82a58e2a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327938,10 +325552,8 @@ rule SIGNATURE_BASE_Hkdoor_Backdoor_Dll : FILE
 		$s5 = "SeLoadDriverPrivilege" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (3 of ($s*)) and pe.characteristics&pe.DLL and pe.imports("ws2_32.dll","WSAStartup") and pe.imports("ws2_32.dll","sendto")
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 3 of ( $s* ) ) and pe.characteristics & pe.DLL and pe.imports ( "ws2_32.dll" , "WSAStartup" ) and pe.imports ( "ws2_32.dll" , "sendto" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hkdoor_Backdoor : FILE
 {
 	meta:
@@ -327951,9 +325563,9 @@ rule SIGNATURE_BASE_Hkdoor_Backdoor : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hkdoor.yar#L32-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3fc71c971bf0908e044e3e0ec3f266b8dfaae33bcfbf1b10619375fc7b5e7f5e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hkdoor.yar#L32-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3fc71c971bf0908e044e3e0ec3f266b8dfaae33bcfbf1b10619375fc7b5e7f5e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327969,7 +325581,7 @@ rule SIGNATURE_BASE_Hkdoor_Backdoor : FILE
 		$s8 = "yythac.yeah.net" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (4 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 4 of ( $s* ) )
 }
 import "pe"
 
@@ -327982,9 +325594,9 @@ rule SIGNATURE_BASE_Hkdoor_Dropper : FILE
 		date = "2018-01-01"
 		modified = "2023-01-07"
 		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hkdoor.yar#L53-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "521836ff95142d276152687f7c36e8f503f168f101976022431efd13a6adf7e4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hkdoor.yar#L53-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_521836ff95142d276152687f7c36e8f503f168f101976022431efd13a6adf7e4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -327999,7 +325611,7 @@ rule SIGNATURE_BASE_Hkdoor_Dropper : FILE
 		$s7 = "kifes" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (4 of ($s*)) and pe.number_of_resources>0 and for any i in (0..pe.number_of_resources-1) : (pe.resources[i].type_string=="B\x00I\x00N\x00" and uint16(pe.resources[i].offset)==0x5A4D) and pe.imports("KERNEL32.dll","FindResourceW") and pe.imports("KERNEL32.dll","LoadResource")
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 4 of ( $s* ) ) and pe.number_of_resources > 0 and for any i in ( 0 .. pe.number_of_resources - 1 ) : ( pe.resources [ i ] . type_string == "B\x00I\x00N\x00" and uint16( pe.resources [ i ] . offset ) == 0x5A4D ) and pe.imports ( "KERNEL32.dll" , "FindResourceW" ) and pe.imports ( "KERNEL32.dll" , "LoadResource" )
 }
 import "pe"
 
@@ -328012,9 +325624,9 @@ rule SIGNATURE_BASE_Hkdoor_Driver : FILE
 		date = "2018-01-01"
 		modified = "2023-01-07"
 		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hkdoor.yar#L81-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "68ac505d67af5361f096529697e621c83a4628f21c213fcea6652905f87ebe00"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hkdoor.yar#L81-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_68ac505d67af5361f096529697e621c83a4628f21c213fcea6652905f87ebe00"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -328027,7 +325639,7 @@ rule SIGNATURE_BASE_Hkdoor_Driver : FILE
 		$s5 = {75 28 22 36 30 5b 4a 77 7b 58 4d 6c 3f 73 63 5e 38 47 7c 7d 7a 40 3a 41 2a 45 4e 44 79 64 67 6d 65 74 21 39 23 3c 20 49 43 69 4c 3b 31 57 2f 55 3e 26 59 62 61 54 53 5a 2d 25 78 35 5c 76 3d 34 27 6b 5f 72 2c 32 4f 2b 71 66 42 33 37 56 52 60 5d 29 4b 51 2e 6f 50 68 6e 6a 24 48 7e 46 70}
 
 	condition:
-		uint16(0)==0x5a4d and pe.subsystem==pe.SUBSYSTEM_NATIVE and (4 of ($s*))
+		uint16( 0 ) == 0x5a4d and pe.subsystem == pe.SUBSYSTEM_NATIVE and ( 4 of ( $s* ) )
 }
 import "pe"
 
@@ -328040,16 +325652,16 @@ rule SIGNATURE_BASE_MAL_Ransomware_Wadhrama : FILE
 		date = "2019-04-07"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mal_ransom_wadharma.yar#L3-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d78837ed7cb8914be0990859751cf64603ee5a5ad135541c60c6ae145046412"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mal_ransom_wadharma.yar#L3-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d78837ed7cb8914be0990859751cf64603ee5a5ad135541c60c6ae145046412"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		hash1 = "557c68e38dce7ea10622763c10a1b9f853c236b3291cd4f9b32723e8714e5576"
 
 	condition:
-		uint16(0)==0x5a4d and pe.imphash()=="f86dec4a80961955a89e7ed62046cc0e"
+		uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "f86dec4a80961955a89e7ed62046cc0e"
 }
 rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Csharp
 {
@@ -328060,9 +325672,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Csharp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e77fcd2ac0c21db54563b15466962a775a5e8ef73cedb3af5cd00d5b0d615e4c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e77fcd2ac0c21db54563b15466962a775a5e8ef73cedb3af5cd00d5b0d615e4c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328089,9 +325701,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_Dropper
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L24-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "19f56e69685ae8c13b9dd884f8322915835c16e2c6313f01f9fa447218419108"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L24-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_19f56e69685ae8c13b9dd884f8322915835c16e2c6313f01f9fa447218419108"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328113,9 +325725,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_B64Encoded
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L40-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bcf9a75dbbf90044db76c56ffd07971d4252b0e75d73abf402ca4fadbfb59767"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L40-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bcf9a75dbbf90044db76c56ffd07971d4252b0e75d73abf402ca4fadbfb59767"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328135,9 +325747,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L54-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9b6eba750c96501aae1d86eef458d3e80de665efc7ce9d5aff842bc44363bad2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L54-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9b6eba750c96501aae1d86eef458d3e80de665efc7ce9d5aff842bc44363bad2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328166,9 +325778,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py_B64Encoded
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L77-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "279fb27637d9b62b484283f778215d042de9fb83110a233e048452e921c540ee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L77-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_279fb27637d9b62b484283f778215d042de9fb83110a233e048452e921c540ee"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328188,9 +325800,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_Py
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L91-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2dc2ce153d559d795f302f5ca4a9ef9e6e5c54762472e38e6f4a26ef8a28a184"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L91-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2dc2ce153d559d795f302f5ca4a9ef9e6e5c54762472e38e6f4a26ef8a28a184"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328214,9 +325826,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_File
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L109-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6d2d677b69eaf31843e8352bfe040c9e5a8d423d17900e022b769d28789f2d98"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L109-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6d2d677b69eaf31843e8352bfe040c9e5a8d423d17900e022b769d28789f2d98"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328236,9 +325848,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Csharp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L123-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1201ee45df78cf3aec4b4bbb59cb7e4a70af6928895bb7c968ef02075a963405"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L123-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1201ee45df78cf3aec4b4bbb59cb7e4a70af6928895bb7c968ef02075a963405"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328264,9 +325876,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Powershell_B64Encoded
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L143-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "77315f0fc8387fa87892fc8fcea1f6e8a95560049aaa9a87519859020d0a7a3e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L143-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_77315f0fc8387fa87892fc8fcea1f6e8a95560049aaa9a87519859020d0a7a3e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328287,9 +325899,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Powershell_Dropper
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L157-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "640c9e52f3cf3df4e954177624e6fba4bab80a2c9442b718fe90e8577dafbbd6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L157-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_640c9e52f3cf3df4e954177624e6fba4bab80a2c9442b718fe90e8577dafbbd6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328309,9 +325921,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Injector_Bin
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L170-L193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c8cd4e3c87c6d80b39069f7a94e512e3f7b739c21f6fd70c2a79829c5a04f32f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L170-L193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c8cd4e3c87c6d80b39069f7a94e512e3f7b739c21f6fd70c2a79829c5a04f32f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328342,9 +325954,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Timeliner_Bin
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L195-L213"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c3a8cddc34134faaab93ee0df0086604e4a7b031530dd65e2e8dab705483305b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L195-L213"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c3a8cddc34134faaab93ee0df0086604e4a7b031530dd65e2e8dab705483305b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328370,9 +325982,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Checkadmin_Bin
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L215-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "784ec960ce2733aebc404ee5c09bb852eb45553ad167db292d05b82feedbd5a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L215-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_784ec960ce2733aebc404ee5c09bb852eb45553ad167db292d05b82feedbd5a6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328397,9 +326009,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Getos_Py
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L234-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2535c01b703c0fcba43e771832db8cd969e4a4b112ef28e4ddfeac6491ba604c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L234-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2535c01b703c0fcba43e771832db8cd969e4a4b112ef28e4ddfeac6491ba604c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328450,7 +326062,7 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Getos_Py
 		$str_6 = "Other error." ascii wide
 
 	condition:
-		( all of ($smb_*)) or ( all of ($smbstr_*)) or (3 of ($code_*)) or ( all of ($tsk_*)) or (3 of ($str_*))
+		( all of ( $smb_* ) ) or ( all of ( $smbstr_* ) ) or ( 3 of ( $code_* ) ) or ( all of ( $tsk_* ) ) or ( 3 of ( $str_* ) )
 }
 rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Info_Vbs
 {
@@ -328461,9 +326073,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Info_Vbs
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L297-L316"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e37f8768c7920b8c3d9fdd6bb3a4e748c47a6c06a8aaed01655355ef3d8c3457"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L297-L316"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e37f8768c7920b8c3d9fdd6bb3a4e748c47a6c06a8aaed01655355ef3d8c3457"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328490,9 +326102,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Console_Jsp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L318-L335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e70c15ef10b63a011edbcedc773a8e2917fd915c3ecc273c3bf2b78eb10fc570"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L318-L335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e70c15ef10b63a011edbcedc773a8e2917fd915c3ecc273c3bf2b78eb10fc570"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328517,9 +326129,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Index_Jsp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L337-L353"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "870dad9fb5456f8edbd9f3c2d0b8764cf1143399626ce4df53c93919bcb1a0cb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L337-L353"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_870dad9fb5456f8edbd9f3c2d0b8764cf1143399626ce4df53c93919bcb1a0cb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328532,7 +326144,7 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Index_Jsp
 		$a = "out.print(\"All seems fine.\");"
 
 	condition:
-		all of ($x*) and $a
+		all of ( $x* ) and $a
 }
 rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Ver_Jsp
 {
@@ -328543,9 +326155,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Ver_Jsp
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L355-L372"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ada6de4b07a76e79bb17793cda2b51f96554a35992a73f59c360487638ae3be3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L355-L372"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ada6de4b07a76e79bb17793cda2b51f96554a35992a73f59c360487638ae3be3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328570,9 +326182,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Webinfo
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_wocao.yar#L374-L394"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "711737a56067f24f422cc7d5aeba4389741fe18a0e66f2715fce626c3b6aef19"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_wocao.yar#L374-L394"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_711737a56067f24f422cc7d5aeba4389741fe18a0e66f2715fce626c3b6aef19"
 		score = 75
 		quality = 85
 		tags = ""
@@ -328588,7 +326200,7 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Webinfo
 		$str2 = "Save Failed!"
 
 	condition:
-		2 of ($var*) or ( all of ($str*) and 1 of ($var*))
+		2 of ( $var* ) or ( all of ( $str* ) and 1 of ( $var* ) )
 }
 rule SIGNATURE_BASE_CHAOS_Payload : FILE
 {
@@ -328599,9 +326211,9 @@ rule SIGNATURE_BASE_CHAOS_Payload : FILE
 		date = "2017-07-15"
 		modified = "2023-12-05"
 		reference = "https://github.com/tiagorlampert/CHAOS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_chaos_payload.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ca409d3d0430fbc4c5ae52ce22616132da3a90c1ec3889571c6314e8787eee67"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_chaos_payload.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ca409d3d0430fbc4c5ae52ce22616132da3a90c1ec3889571c6314e8787eee67"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -328613,10 +326225,8 @@ rule SIGNATURE_BASE_CHAOS_Payload : FILE
 		$x1 = { 2F 43 48 41 4F 53 00 02 73 79 6E 63 2F 61 74 6F 6D 69 63 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Twinpeaks : FILE
 {
 	meta:
@@ -328626,9 +326236,9 @@ rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Twinpeaks : FILE
 		date = "2019-07-24"
 		modified = "2023-12-05"
 		reference = "https://github.com/br-data/2019-winnti-analyse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_br.yar#L3-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "76457f5aa4cc4bf4f43ffbaa60d63006455977e881f1d74b845835c505a93fed"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_br.yar#L3-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_76457f5aa4cc4bf4f43ffbaa60d63006455977e881f1d74b845835c505a93fed"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328638,7 +326248,7 @@ rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Twinpeaks : FILE
 		$pattern = { e9 ea eb ec ed ee ef f0}
 
 	condition:
-		uint16(0)==0x5a4d and $cooper and ($pattern in (@cooper[1]..@cooper[1]+100))
+		uint16( 0 ) == 0x5a4d and $cooper and ( $pattern in ( @cooper [ 1 ] .. @cooper [ 1 ] + 100 ) )
 }
 import "pe"
 
@@ -328651,9 +326261,9 @@ rule SIGNATURE_BASE_MAL_BR_Report_Thedao : FILE
 		date = "2019-07-24"
 		modified = "2023-12-05"
 		reference = "https://github.com/br-data/2019-winnti-analyse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_br.yar#L17-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "798b092b7667462aa66590603504cb0cd1166e4ac3472627cd8cd8fdf8f0b778"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_br.yar#L17-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_798b092b7667462aa66590603504cb0cd1166e4ac3472627cd8cd8fdf8f0b778"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -328662,10 +326272,8 @@ rule SIGNATURE_BASE_MAL_BR_Report_Thedao : FILE
 		$b = { DA A0 }
 
 	condition:
-		uint16(0)==0x5a4d and $b at pe.overlay.offset and pe.overlay.size>100
+		uint16( 0 ) == 0x5a4d and $b at pe.overlay.offset and pe.overlay.size > 100
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Mockingjay : FILE
 {
 	meta:
@@ -328675,9 +326283,9 @@ rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Mockingjay : FILE
 		date = "2019-07-24"
 		modified = "2023-12-05"
 		reference = "https://github.com/br-data/2019-winnti-analyse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_br.yar#L30-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7a63b6f10cc5feebba16e585cb29d741876e1dc7f4dde3ef43ac76db9c7ad135"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_br.yar#L30-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7a63b6f10cc5feebba16e585cb29d741876e1dc7f4dde3ef43ac76db9c7ad135"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328688,7 +326296,7 @@ rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Mockingjay : FILE
 		$jpeg = { FF D8 FF E0 00 00 00 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and $jpeg and ($load_magic or $iter in (@jpeg[1]..@jpeg[1]+200)) and for any i in (1..#jpeg) : ( uint8(@jpeg[i]+11)!=0)
+		uint16( 0 ) == 0x5a4d and $jpeg and ( $load_magic or $iter in ( @jpeg [ 1 ] .. @jpeg [ 1 ] + 200 ) ) and for any i in ( 1 .. #jpeg ) : ( uint8( @jpeg [ i ] + 11 ) != 0 )
 }
 rule SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1 : FILE
 {
@@ -328699,9 +326307,9 @@ rule SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1 : FILE
 		date = "2020-10-06"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/malwrhunterteam/status/1313023627177193472"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_anomalies_keyword_combos.yar#L2-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8aef24295281da5ffa1c6f865eaa6cc8d60ea1df670058220bdb97651b6114cd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_anomalies_keyword_combos.yar#L2-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8aef24295281da5ffa1c6f865eaa6cc8d60ea1df670058220bdb97651b6114cd"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -328724,7 +326332,7 @@ rule SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1 : FILE
 		$fp8 = "License: MPL 2" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and $a1 and 1 of ($b*) and not 1 of ($fp*)
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and $a1 and 1 of ( $b* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Badrabbit_Gen : FILE
 {
@@ -328735,9 +326343,9 @@ rule SIGNATURE_BASE_Badrabbit_Gen : FILE
 		date = "2017-10-25"
 		modified = "2023-12-05"
 		reference = "https://pastebin.com/Y7pJv3tK"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_badrabbit.yar#L11-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "21c63a02d0284ce759b087f4869c4ed8e6b50c37ffeb724538567e28aeae16ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_badrabbit.yar#L11-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_21c63a02d0284ce759b087f4869c4ed8e6b50c37ffeb724538567e28aeae16ac"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328763,7 +326371,7 @@ rule SIGNATURE_BASE_Badrabbit_Gen : FILE
 		$s10 = "%ws C:\\Windows\\%ws,#1 %ws" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_Badrabbit_Mimikatz_Comp : FILE
 {
@@ -328774,9 +326382,9 @@ rule SIGNATURE_BASE_Badrabbit_Mimikatz_Comp : FILE
 		date = "2017-10-25"
 		modified = "2023-12-05"
 		reference = "https://pastebin.com/Y7pJv3tK"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_badrabbit.yar#L42-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9d12d9331686a54e8d32f94761e4889710bbd2432d4cb2e4e7e3f21ef6aa082a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_badrabbit.yar#L42-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9d12d9331686a54e8d32f94761e4889710bbd2432d4cb2e4e7e3f21ef6aa082a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328790,7 +326398,7 @@ rule SIGNATURE_BASE_Badrabbit_Mimikatz_Comp : FILE
 		$s4 = { 50 72 69 6D 61 72 79 00 6D 00 73 00 76 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them )
 }
 rule SIGNATURE_BASE_ACE_Containing_EXE
 {
@@ -328801,9 +326409,9 @@ rule SIGNATURE_BASE_ACE_Containing_EXE
 		date = "2015-09-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ace_with_exe.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "27fba0db7a98fbaf4b3710a9e411ed74860099c133a2e83ddf368ae2fef3c288"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ace_with_exe.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a4dc39e412b041492602d41f7ce1f7b821e17584a43e5cdc54ffe686742a5f9a"
 		score = 50
 		quality = 83
 		tags = ""
@@ -328816,7 +326424,7 @@ rule SIGNATURE_BASE_ACE_Containing_EXE
 		$extensions4 = ".SCR"
 
 	condition:
-		$header at 7 and for any of ($extensions*) : ($ in (81..(81+ uint16(79))))
+		$header at 7 and for any of ( $extensions* ) : ( $ in ( 81 .. ( 81 + uint16( 79 ) ) ) )
 }
 rule SIGNATURE_BASE_Asp_File : FILE
 {
@@ -328827,10 +326435,10 @@ rule SIGNATURE_BASE_Asp_File : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L8-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L8-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
-		logic_hash = "9ec19a994571f4d1b40b6d6af3fb6eb4c5004a6439b99863b50dae0262677263"
+		logic_hash = "v1_sha256_9ec19a994571f4d1b40b6d6af3fb6eb4c5004a6439b99863b50dae0262677263"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328845,7 +326453,7 @@ rule SIGNATURE_BASE_Asp_File : FILE
 		$s6 = "Set file = fso.GetFile(filepath)" fullword ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <30KB and 5 of them
+		uint16( 0 ) == 0x253c and filesize < 30KB and 5 of them
 }
 rule SIGNATURE_BASE_Php_Killnc : FILE
 {
@@ -328856,10 +326464,10 @@ rule SIGNATURE_BASE_Php_Killnc : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
-		logic_hash = "431a9a66f5d0e42856ca5716c2994c018f77cc338300abd71d94ffe7e75da3bf"
+		logic_hash = "v1_sha256_431a9a66f5d0e42856ca5716c2994c018f77cc338300abd71d94ffe7e75da3bf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328873,7 +326481,7 @@ rule SIGNATURE_BASE_Php_Killnc : FILE
 		$s5 = "foreach ($allowedIPs as $IP) {" fullword ascii
 
 	condition:
-		filesize <15KB and 4 of them
+		filesize < 15KB and 4 of them
 }
 rule SIGNATURE_BASE_Asp_Shell : FILE
 {
@@ -328884,10 +326492,10 @@ rule SIGNATURE_BASE_Asp_Shell : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L47-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L47-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8bf1ff6f8edd45e3102be5f8a1fe030752f45613"
-		logic_hash = "af9c5cf7125e1210761e720c5f30527ac6345b5029b087807309000a29b67f6e"
+		logic_hash = "v1_sha256_af9c5cf7125e1210761e720c5f30527ac6345b5029b087807309000a29b67f6e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328903,7 +326511,7 @@ rule SIGNATURE_BASE_Asp_Shell : FILE
 		$s7 = "Dim wshell, intReturn, strPResult" fullword ascii
 
 	condition:
-		filesize <15KB and 4 of them
+		filesize < 15KB and 4 of them
 }
 rule SIGNATURE_BASE_Settings : FILE
 {
@@ -328914,10 +326522,10 @@ rule SIGNATURE_BASE_Settings : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L68-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L68-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
-		logic_hash = "b02e293e659fa77257d0642c57e51d6ae712d9221ae295cf69bb845f68c650ee"
+		logic_hash = "v1_sha256_b02e293e659fa77257d0642c57e51d6ae712d9221ae295cf69bb845f68c650ee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328929,7 +326537,7 @@ rule SIGNATURE_BASE_Settings : FILE
 		$s3 = "<li><a href=\"<?php echo plugins_url('file.php', __FILE__);?>\">File Browser</a>" ascii
 
 	condition:
-		filesize <13KB and all of them
+		filesize < 13KB and all of them
 }
 rule SIGNATURE_BASE_Asp_Proxy : FILE
 {
@@ -328940,10 +326548,10 @@ rule SIGNATURE_BASE_Asp_Proxy : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L85-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L85-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "51e97040d1737618b1775578a772fa6c5a31afd8"
-		logic_hash = "f53c97a2bf31f411b3220dc741b85d0edf96e9b92474f1abd5ac443be6b92897"
+		logic_hash = "v1_sha256_f53c97a2bf31f411b3220dc741b85d0edf96e9b92474f1abd5ac443be6b92897"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328958,7 +326566,7 @@ rule SIGNATURE_BASE_Asp_Proxy : FILE
 		$s6 = "Set http = Server.CreateObject(\"Microsoft.XMLHTTP\")" fullword ascii
 
 	condition:
-		filesize <50KB and all of them
+		filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_Cfm_Shell : FILE
 {
@@ -328969,10 +326577,10 @@ rule SIGNATURE_BASE_Cfm_Shell : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L105-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L105-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "885e1783b07c73e7d47d3283be303c9719419b92"
-		logic_hash = "961eb398422e3c528b886c150f11dcb8a6832f0ea48e20ddc381e1f2740bd0c6"
+		logic_hash = "v1_sha256_961eb398422e3c528b886c150f11dcb8a6832f0ea48e20ddc381e1f2740bd0c6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -328984,7 +326592,7 @@ rule SIGNATURE_BASE_Cfm_Shell : FILE
 		$s3 = "<cfif IsDefined(\"form.cmd\")>" fullword ascii
 
 	condition:
-		filesize <20KB and 2 of them
+		filesize < 20KB and 2 of them
 }
 rule SIGNATURE_BASE_Aspx_Shell : FILE
 {
@@ -328995,10 +326603,10 @@ rule SIGNATURE_BASE_Aspx_Shell : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L122-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L122-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
-		logic_hash = "b31c36f53d46e17b6d97e582e46c540928a386e2075b841f5c11b959a0c68462"
+		logic_hash = "v1_sha256_b31c36f53d46e17b6d97e582e46c540928a386e2075b841f5c11b959a0c68462"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329011,7 +326619,7 @@ rule SIGNATURE_BASE_Aspx_Shell : FILE
 		$s4 = "<body onload=\"document.shell.c.focus()\">" fullword ascii
 
 	condition:
-		filesize <20KB and all of them
+		filesize < 20KB and all of them
 }
 rule SIGNATURE_BASE_Php_Shell : FILE
 {
@@ -329022,10 +326630,10 @@ rule SIGNATURE_BASE_Php_Shell : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L140-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L140-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
-		logic_hash = "dc798508434686bbcb4fa0bb47381252bfa0491b0987956fd4c5aa13b7f57810"
+		logic_hash = "v1_sha256_dc798508434686bbcb4fa0bb47381252bfa0491b0987956fd4c5aa13b7f57810"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329038,7 +326646,7 @@ rule SIGNATURE_BASE_Php_Shell : FILE
 		$s4 = "if (preg_match('/^[[:blank:]]*cd[[:blank:]]*$/', $command)) {" fullword ascii
 
 	condition:
-		filesize <40KB and all of them
+		filesize < 40KB and all of them
 }
 rule SIGNATURE_BASE_Php_Reverse_Shell : FILE
 {
@@ -329049,10 +326657,10 @@ rule SIGNATURE_BASE_Php_Reverse_Shell : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L158-L173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L158-L173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
-		logic_hash = "ea8e320abb57e0467db92271f7d36f144f85e04ce15cd9fa8d3f53dfa8d43929"
+		logic_hash = "v1_sha256_ea8e320abb57e0467db92271f7d36f144f85e04ce15cd9fa8d3f53dfa8d43929"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329064,7 +326672,7 @@ rule SIGNATURE_BASE_Php_Reverse_Shell : FILE
 		$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii
 
 	condition:
-		filesize <15KB and all of them
+		filesize < 15KB and all of them
 }
 rule SIGNATURE_BASE_Php_Dns : FILE
 {
@@ -329075,10 +326683,10 @@ rule SIGNATURE_BASE_Php_Dns : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L175-L191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L175-L191"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
-		logic_hash = "650eecc06f215ae6a15078c87d8a8c1597ca9e3d735eacd17b046a9d9deb6aa8"
+		logic_hash = "v1_sha256_650eecc06f215ae6a15078c87d8a8c1597ca9e3d735eacd17b046a9d9deb6aa8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329091,7 +326699,7 @@ rule SIGNATURE_BASE_Php_Dns : FILE
 		$s4 = "foreach (array_keys($types) as $t) {" fullword ascii
 
 	condition:
-		filesize <15KB and all of them
+		filesize < 15KB and all of them
 }
 rule SIGNATURE_BASE_WEB_INF_Web : FILE
 {
@@ -329102,10 +326710,10 @@ rule SIGNATURE_BASE_WEB_INF_Web : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L193-L207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L193-L207"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
-		logic_hash = "b58bb63a5268812ed6a5d18c8da96b0fdae33e4802a2fba4964ab69e92517a16"
+		logic_hash = "v1_sha256_b58bb63a5268812ed6a5d18c8da96b0fdae33e4802a2fba4964ab69e92517a16"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329116,7 +326724,7 @@ rule SIGNATURE_BASE_WEB_INF_Web : FILE
 		$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_Jsp_Cmd : FILE
 {
@@ -329127,10 +326735,10 @@ rule SIGNATURE_BASE_Jsp_Cmd : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L209-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L209-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
-		logic_hash = "ab5b013a385549322bcb2811fa1a2d14b5633e2c41b9486b1e1c50c02437b8e6"
+		logic_hash = "v1_sha256_ab5b013a385549322bcb2811fa1a2d14b5633e2c41b9486b1e1c50c02437b8e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329144,7 +326752,7 @@ rule SIGNATURE_BASE_Jsp_Cmd : FILE
 		$s4 = "META-INF/MANIFEST.MF" fullword ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <2KB and all of them
+		uint16( 0 ) == 0x4b50 and filesize < 2KB and all of them
 }
 rule SIGNATURE_BASE_Laudanum : FILE
 {
@@ -329155,10 +326763,10 @@ rule SIGNATURE_BASE_Laudanum : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L228-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L228-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
-		logic_hash = "53caad87d22b5f13e5b7be8720baa1d436cc57d8062ec5d557df8524a2ccfb68"
+		logic_hash = "v1_sha256_53caad87d22b5f13e5b7be8720baa1d436cc57d8062ec5d557df8524a2ccfb68"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329169,7 +326777,7 @@ rule SIGNATURE_BASE_Laudanum : FILE
 		$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii
 
 	condition:
-		filesize <5KB and all of them
+		filesize < 5KB and all of them
 }
 rule SIGNATURE_BASE_Php_File : FILE
 {
@@ -329180,10 +326788,10 @@ rule SIGNATURE_BASE_Php_File : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L244-L260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L244-L260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
-		logic_hash = "85c14a9c8a6aece231b1cb6dcdd7ed39fdc6aced868c34557ee2e2204ce7007b"
+		logic_hash = "v1_sha256_85c14a9c8a6aece231b1cb6dcdd7ed39fdc6aced868c34557ee2e2204ce7007b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329196,7 +326804,7 @@ rule SIGNATURE_BASE_Php_File : FILE
 		$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_Warfiles_Cmd : FILE
 {
@@ -329207,10 +326815,10 @@ rule SIGNATURE_BASE_Warfiles_Cmd : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L262-L278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L262-L278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
-		logic_hash = "64724b24d9f5b5d78e231ea8196abb609237cc430c49f6ceeb99c9684a904568"
+		logic_hash = "v1_sha256_64724b24d9f5b5d78e231ea8196abb609237cc430c49f6ceeb99c9684a904568"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329223,7 +326831,7 @@ rule SIGNATURE_BASE_Warfiles_Cmd : FILE
 		$s4 = "String disr = dis.readLine();" fullword ascii
 
 	condition:
-		filesize <2KB and all of them
+		filesize < 2KB and all of them
 }
 rule SIGNATURE_BASE_Asp_Dns : FILE
 {
@@ -329234,10 +326842,10 @@ rule SIGNATURE_BASE_Asp_Dns : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L280-L296"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L280-L296"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
-		logic_hash = "808e879238a0c24e975c260fc95c05c91bdc0f73553a241bd00f5bf7e6622639"
+		logic_hash = "v1_sha256_808e879238a0c24e975c260fc95c05c91bdc0f73553a241bd00f5bf7e6622639"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329250,7 +326858,7 @@ rule SIGNATURE_BASE_Asp_Dns : FILE
 		$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii
 
 	condition:
-		filesize <21KB and all of them
+		filesize < 21KB and all of them
 }
 rule SIGNATURE_BASE_Php_Reverse_Shell_2 : FILE
 {
@@ -329261,10 +326869,10 @@ rule SIGNATURE_BASE_Php_Reverse_Shell_2 : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L298-L312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L298-L312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "025db3c3473413064f0606d93d155c7eb5049c42"
-		logic_hash = "695dc565c273ed358f7d56526fa4956ba13b216d8897d0707e1660a82b745081"
+		logic_hash = "v1_sha256_695dc565c273ed358f7d56526fa4956ba13b216d8897d0707e1660a82b745081"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329275,7 +326883,7 @@ rule SIGNATURE_BASE_Php_Reverse_Shell_2 : FILE
 		$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_Laudanum_Tools_Generic : FILE
 {
@@ -329286,9 +326894,9 @@ rule SIGNATURE_BASE_Laudanum_Tools_Generic : FILE
 		date = "2015-06-22"
 		modified = "2023-12-05"
 		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_laudanum_webshells.yar#L314-L345"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "52c6d3be4fc91e8a61645886fa89bf78eddad51960702ff2ac83ec01d5d529ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_laudanum_webshells.yar#L314-L345"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_52c6d3be4fc91e8a61645886fa89bf78eddad51960702ff2ac83ec01d5d529ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329317,7 +326925,7 @@ rule SIGNATURE_BASE_Laudanum_Tools_Generic : FILE
 		$s2 = "*** Laudanum Project" fullword ascii
 
 	condition:
-		filesize <60KB and all of them
+		filesize < 60KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation : FILE
 {
@@ -329328,9 +326936,9 @@ rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation : FILE
 		date = "2023-04-02"
 		modified = "2023-05-08"
 		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_sparc_sbz_apr23.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3d45dc8d8dbc62cee6b7ec4aa842eaa88bd23aea17e995eef4850fd91e7069a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_sparc_sbz_apr23.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3d45dc8d8dbc62cee6b7ec4aa842eaa88bd23aea17e995eef4850fd91e7069a3"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -329340,7 +326948,7 @@ rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation : FILE
 		$a1 = "SUNW_"
 
 	condition:
-		uint32be(0)==0x7f454c46 and $a1 and $xor_block
+		uint32be( 0 ) == 0x7f454c46 and $a1 and $xor_block
 }
 rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Uniquestrings
 {
@@ -329351,9 +326959,9 @@ rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Uniquestrings
 		date = "2023-04-02"
 		modified = "2023-05-08"
 		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_sparc_sbz_apr23.yar#L26-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bb95fc6bda0a0ed8ffc6db9734c725c487b0e70909d60119bf58d60987daaaeb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_sparc_sbz_apr23.yar#L26-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bb95fc6bda0a0ed8ffc6db9734c725c487b0e70909d60119bf58d60987daaaeb"
 		score = 60
 		quality = 85
 		tags = ""
@@ -329365,7 +326973,7 @@ rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Uniquestrings
 		$s4 = "CHM_FW"
 
 	condition:
-		2 of ($*)
+		2 of ( $* )
 }
 rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Modulestruct : FILE
 {
@@ -329376,9 +326984,9 @@ rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Modulestruct : FILE
 		date = "2023-04-02"
 		modified = "2023-05-08"
 		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_sparc_sbz_apr23.yar#L49-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dc9608c769dcb14ba01559bfe2e8ed03eebf5695b867b53742f26e3fcce389ca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_sparc_sbz_apr23.yar#L49-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dc9608c769dcb14ba01559bfe2e8ed03eebf5695b867b53742f26e3fcce389ca"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -329388,7 +326996,7 @@ rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Modulestruct : FILE
 		$le = { 02 02 00 00 07 00 C1 01 }
 
 	condition:
-		uint32be(0)==0x7f454c46 and ($be or $le)
+		uint32be( 0 ) == 0x7f454c46 and ( $be or $le )
 }
 rule SIGNATURE_BASE_Teledoor_Backdoor : FILE
 {
@@ -329399,9 +327007,9 @@ rule SIGNATURE_BASE_Teledoor_Backdoor : FILE
 		date = "2017-07-05"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/CpfJQQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_teledoor.yar#L11-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "785360fa19a61a547309fc7a8968c94d4887be001c6a66b41c7adb9dcd13cb82"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_teledoor.yar#L11-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_785360fa19a61a547309fc7a8968c94d4887be001c6a66b41c7adb9dcd13cb82"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329416,7 +327024,7 @@ rule SIGNATURE_BASE_Teledoor_Backdoor : FILE
 		$c3 = { 00 5A 76 69 74 57 65 62 43 6C 69 65 6E 74 45 78 74 00 4D 69 6E 49 6E 66 6F }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and 2 of them )
 }
 rule SIGNATURE_BASE_B374K_Back_Connect : FILE
 {
@@ -329427,9 +327035,9 @@ rule SIGNATURE_BASE_B374K_Back_Connect : FILE
 		date = "2016-08-18"
 		modified = "2023-12-05"
 		reference = "Internal Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_b374k_extra.yar#L8-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd89aefb6c1add44bfe2a706cd161a16f36a649f910ace16b641a7836525aa73"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_b374k_extra.yar#L8-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd89aefb6c1add44bfe2a706cd161a16f36a649f910ace16b641a7836525aa73"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -329442,7 +327050,7 @@ rule SIGNATURE_BASE_B374K_Back_Connect : FILE
 		$s3 = "/config/i386" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 10KB and all of them )
 }
 rule SIGNATURE_BASE_APT_UTA028_Forensicartefacts_Paloalto_CVE_2024_3400_Apr24_1 : SCRIPT CVE_2024_3400
 {
@@ -329453,9 +327061,9 @@ rule SIGNATURE_BASE_APT_UTA028_Forensicartefacts_Paloalto_CVE_2024_3400_Apr24_1
 		date = "2024-04-15"
 		modified = "2024-04-18"
 		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1261eecca520daa0619859a45d2289d2c23c73be55e1a3849d2032a38e137f4d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1261eecca520daa0619859a45d2289d2c23c73be55e1a3849d2032a38e137f4d"
 		score = 70
 		quality = 85
 		tags = "SCRIPT, CVE-2024-3400"
@@ -329482,9 +327090,9 @@ rule SIGNATURE_BASE_EXPL_Paloalto_CVE_2024_3400_Apr24_1 : CVE_2024_3400
 		date = "2024-04-15"
 		modified = "2024-04-24"
 		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L27-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ebc94a07b189a2d2dd252b5079fa494162739678fd2ca742e6877189a140da9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L27-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ebc94a07b189a2d2dd252b5079fa494162739678fd2ca742e6877189a140da9"
 		score = 70
 		quality = 85
 		tags = "CVE-2024-3400"
@@ -329497,7 +327105,7 @@ rule SIGNATURE_BASE_EXPL_Paloalto_CVE_2024_3400_Apr24_1 : CVE_2024_3400
 		$sb2 = "${IFS}"
 
 	condition:
-		1 of ($x*) or (1 of ($sa*) and $sb2)
+		1 of ( $x* ) or ( 1 of ( $sa* ) and $sb2 )
 }
 rule SIGNATURE_BASE_SUSP_LNX_Base64_Download_Exec_Apr24 : SCRIPT
 {
@@ -329508,9 +327116,9 @@ rule SIGNATURE_BASE_SUSP_LNX_Base64_Download_Exec_Apr24 : SCRIPT
 		date = "2024-04-18"
 		modified = "2024-04-24"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L48-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "90b7781812b4078550b0d66ba020b3bb0a8217f2de03492af98db6c619f31929"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L48-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_90b7781812b4078550b0d66ba020b3bb0a8217f2de03492af98db6c619f31929"
 		score = 75
 		quality = 85
 		tags = "SCRIPT"
@@ -329522,7 +327130,7 @@ rule SIGNATURE_BASE_SUSP_LNX_Base64_Download_Exec_Apr24 : SCRIPT
 		$sb2 = "/tmp/" base64
 
 	condition:
-		1 of ($sa*) and all of ($sb*)
+		1 of ( $sa* ) and all of ( $sb* )
 }
 rule SIGNATURE_BASE_SUSP_PY_Import_Statement_Apr24_1
 {
@@ -329533,9 +327141,9 @@ rule SIGNATURE_BASE_SUSP_PY_Import_Statement_Apr24_1
 		date = "2024-04-15"
 		modified = "2024-04-24"
 		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L67-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d5c199d9c3e449ca282f0ca91c94ac783709299b3489f7cec38177a2f843b504"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L67-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d5c199d9c3e449ca282f0ca91c94ac783709299b3489f7cec38177a2f843b504"
 		score = 65
 		quality = 85
 		tags = ""
@@ -329555,9 +327163,9 @@ rule SIGNATURE_BASE_SUSP_LNX_Base64_Exec_Apr24 : SCRIPT CVE_2024_3400
 		date = "2024-04-18"
 		modified = "2024-04-24"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L81-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f84556970f2d90eaea89a03ae48518592f14eecd60ef4cc811988de451d5375c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L81-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f84556970f2d90eaea89a03ae48518592f14eecd60ef4cc811988de451d5375c"
 		score = 75
 		quality = 85
 		tags = "SCRIPT, CVE-2024-3400"
@@ -329580,9 +327188,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Tracer : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f851f20243e95fdab66f048c21d417ddb17e1c35e9b6be8219afdfee8c1e0291"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f851f20243e95fdab66f048c21d417ddb17e1c35e9b6be8219afdfee8c1e0291"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329595,7 +327203,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Tracer : FILE
 		$s3 = "xtk\\unsupported.tcl" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <21000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 21000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Wmiexec : FILE
 {
@@ -329606,9 +327214,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Wmiexec : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L28-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1ac78768ae230aa00f392f7a7886589b14814e9c7379528d2ecd218852086ee4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L28-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1ac78768ae230aa00f392f7a7886589b14814e9c7379528d2ecd218852086ee4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329621,7 +327229,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Wmiexec : FILE
 		$s3 = "\\yzHPlU=QA" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and 2 of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Sniffer : FILE
 {
@@ -329632,9 +327240,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Sniffer : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L45-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "77f4a7cdfced27ea342fe0fe6debebb720b7494b3f352465ab2fd92f2b7178ab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L45-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_77f4a7cdfced27ea342fe0fe6debebb720b7494b3f352465ab2fd92f2b7178ab"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329646,7 +327254,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Sniffer : FILE
 		$s2 = "impacket.dhcp(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Mmcexec : FILE
 {
@@ -329657,9 +327265,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Mmcexec : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L61-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1aee75155ed3d868f576d7d650f0791ac54e351851f7bfb65390b4ae5c4c83b9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L61-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1aee75155ed3d868f576d7d650f0791ac54e351851f7bfb65390b4ae5c4c83b9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329671,7 +327279,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Mmcexec : FILE
 		$s2 = "\\yzHPlU=QA" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <16000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 16000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Ifmap : FILE
 {
@@ -329682,9 +327290,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Ifmap : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L77-L91"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bbe875e03434c040da914e81ec5ef691ba8fd02607631e118d958819d0e94ff5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L77-L91"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bbe875e03434c040da914e81ec5ef691ba8fd02607631e118d958819d0e94ff5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329696,7 +327304,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Ifmap : FILE
 		$s2 = "impacket.dcerpc.v5.epm(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
 }
 rule SIGNATURE_BASE_Karmasmb : FILE
 {
@@ -329707,9 +327315,9 @@ rule SIGNATURE_BASE_Karmasmb : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L93-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "94322dda799bcb25caeb7f9e526bcc14c6dfd9247080b4bb79dcd7b340fcb36c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L93-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_94322dda799bcb25caeb7f9e526bcc14c6dfd9247080b4bb79dcd7b340fcb36c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329720,7 +327328,7 @@ rule SIGNATURE_BASE_Karmasmb : FILE
 		$s1 = "bkarmaSMB.exe.manifest" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Samrdump : FILE
 {
@@ -329731,9 +327339,9 @@ rule SIGNATURE_BASE_Samrdump : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L108-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6bc0a4d9f9bd0d72e7f2ce4b0f8608296e6f2db14fd3a1740e0eebfe35629018"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L108-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6bc0a4d9f9bd0d72e7f2ce4b0f8608296e6f2db14fd3a1740e0eebfe35629018"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329745,7 +327353,7 @@ rule SIGNATURE_BASE_Samrdump : FILE
 		$s3 = "ssamrdump" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Rpcdump : FILE
 {
@@ -329756,9 +327364,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Rpcdump : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L124-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf0a64391ef0a5d3f87996fb3e4f152a3ff4938356b96f840aa3f4f4f30aaa97"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L124-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf0a64391ef0a5d3f87996fb3e4f152a3ff4938356b96f840aa3f4f4f30aaa97"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329770,7 +327378,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Rpcdump : FILE
 		$s2 = "impacket.dcerpc.v5.epm(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Secretsdump : FILE
 {
@@ -329781,9 +327389,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Secretsdump : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L140-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "462748d60764c6fbaeede48b5a98cb68f61cf695f976bf6db94cb497be48fcb2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L140-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_462748d60764c6fbaeede48b5a98cb68f61cf695f976bf6db94cb497be48fcb2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329795,7 +327403,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Secretsdump : FILE
 		$s2 = "impacket.ese(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Esentutl : FILE
 {
@@ -329806,9 +327414,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Esentutl : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L156-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e972ad610df65309f4e5996ad0b537670b944f43b810fda5a890ea995193a97a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L156-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e972ad610df65309f4e5996ad0b537670b944f43b810fda5a890ea995193a97a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329820,7 +327428,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Esentutl : FILE
 		$s2 = "sesentutl" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <11000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 11000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Opdump : FILE
 {
@@ -329831,9 +327439,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Opdump : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L172-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "18b772e19fd61d77f3a671ee097e0f032738a73a360f4cfe79df4eb6377e12b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L172-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_18b772e19fd61d77f3a671ee097e0f032738a73a360f4cfe79df4eb6377e12b1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329845,7 +327453,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Opdump : FILE
 		$s3 = "sopdump" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Sniff : FILE
 {
@@ -329856,9 +327464,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Sniff : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L188-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b317e23d1f76cec4d5b14cb95d463ec410551052b30f1d2d5f52a441104108c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L188-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b317e23d1f76cec4d5b14cb95d463ec410551052b30f1d2d5f52a441104108c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329870,7 +327478,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Sniff : FILE
 		$s2 = "impacket.eap(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Smbexec : FILE
 {
@@ -329881,9 +327489,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Smbexec : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L204-L218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f424dd5cc525ef0bd9671c4c1b8da0a1ff9eb79056cc081c1ebe7c9bf75fee6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L204-L218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f424dd5cc525ef0bd9671c4c1b8da0a1ff9eb79056cc081c1ebe7c9bf75fee6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329895,7 +327503,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Smbexec : FILE
 		$s2 = "ssmbexec" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Goldenpac : FILE
 {
@@ -329906,9 +327514,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Goldenpac : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L220-L235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c764083a699204819f9ff6e2664a50d467447d0fff040ef32a8e28cc678b3cd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L220-L235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c764083a699204819f9ff6e2664a50d467447d0fff040ef32a8e28cc678b3cd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329921,7 +327529,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Goldenpac : FILE
 		$s3 = "json.scanner(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Netview : FILE
 {
@@ -329932,9 +327540,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Netview : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L237-L252"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e0beb6235838b4e8a1312ba53c539c6c3d732ba13a0190c654dcf7ec4389e364"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L237-L252"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e0beb6235838b4e8a1312ba53c539c6c3d732ba13a0190c654dcf7ec4389e364"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329947,7 +327555,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Netview : FILE
 		$s3 = "snetview" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Smbtorture : FILE
 {
@@ -329958,9 +327566,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Smbtorture : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L254-L268"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "63cbd6511c5498b39fa5efadb8fe0caeeaa8d4c2afe534a0169ea38f205a9cba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L254-L268"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_63cbd6511c5498b39fa5efadb8fe0caeeaa8d4c2afe534a0169ea38f205a9cba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329972,7 +327580,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Smbtorture : FILE
 		$s2 = "ssmbtorture" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Mimikatz : FILE
 {
@@ -329983,9 +327591,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Mimikatz : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L270-L285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0dce4086887877aa77063dfa3c69d7a17cfa0815c4ca417144d3bbb6ebe68650"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L270-L285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0dce4086887877aa77063dfa3c69d7a17cfa0815c4ca417144d3bbb6ebe68650"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -329998,7 +327606,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Mimikatz : FILE
 		$s3 = "otwsdlc" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Smbrelayx : FILE
 {
@@ -330009,9 +327617,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Smbrelayx : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L287-L303"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2afcede9d9f5af102c68e705f29242bc3a56485e79c0acfc347a4ea7f823dfda"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L287-L303"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2afcede9d9f5af102c68e705f29242bc3a56485e79c0acfc347a4ea7f823dfda"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330025,7 +327633,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Smbrelayx : FILE
 		$s4 = "SimpleHTTPServer(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <18000KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 18000KB and 3 of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Wmipersist : FILE
 {
@@ -330036,9 +327644,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Wmipersist : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L305-L319"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "df0dfaed264e0acc57f74e40addcaf52f6d8e832524eb638b682a358c81da83f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L305-L319"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_df0dfaed264e0acc57f74e40addcaf52f6d8e832524eb638b682a358c81da83f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330050,7 +327658,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Wmipersist : FILE
 		$s2 = "\\yzHPlU=QA" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Lookupsid : FILE
 {
@@ -330061,9 +327669,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Lookupsid : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L321-L335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "629ddd49377017d6ea2aac9665b21dfdf9a50c917bf915ea892faafd841bf817"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L321-L335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_629ddd49377017d6ea2aac9665b21dfdf9a50c917bf915ea892faafd841bf817"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330075,7 +327683,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Lookupsid : FILE
 		$s2 = "impacket.dcerpc" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Wmiquery : FILE
 {
@@ -330086,9 +327694,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Wmiquery : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L337-L351"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa237b5c1b4881804c33152a1ce9f3a571b506178fde455a8dd9f92af68c5610"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L337-L351"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa237b5c1b4881804c33152a1ce9f3a571b506178fde455a8dd9f92af68c5610"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330100,7 +327708,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Wmiquery : FILE
 		$s2 = "\\yzHPlU=QA" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Atexec : FILE
 {
@@ -330111,9 +327719,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Atexec : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L353-L369"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e9537a67e17fb980505aead84b15c7dc8a2f3f1e9a4088edd8b313f1b7a9675d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L353-L369"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e9537a67e17fb980505aead84b15c7dc8a2f3f1e9a4088edd8b313f1b7a9675d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330127,7 +327735,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Atexec : FILE
 		$s4 = "# CSZq" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and 3 of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Psexec : FILE
 {
@@ -330138,9 +327746,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Psexec : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L371-L386"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "922b2adec9c73d36343c0182f72f5a325c93c051a22e3f80236f942287d0738b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L371-L386"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_922b2adec9c73d36343c0182f72f5a325c93c051a22e3f80236f942287d0738b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330153,7 +327761,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Psexec : FILE
 		$s3 = "impacket.examples.remcomsvc(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and 2 of them )
 }
 rule SIGNATURE_BASE_Impacket_Tools_Generic_1 : FILE
 {
@@ -330164,9 +327772,9 @@ rule SIGNATURE_BASE_Impacket_Tools_Generic_1 : FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L388-L423"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a66953ca6a99a7880d757a754bb3010aa394de73292975a3741ec5cf1f20385d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L388-L423"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a66953ca6a99a7880d757a754bb3010aa394de73292975a3741ec5cf1f20385d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330199,7 +327807,7 @@ rule SIGNATURE_BASE_Impacket_Tools_Generic_1 : FILE
 		$s3 = "impacket" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <21000KB and all of ($s*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 21000KB and all of ( $s* ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Impacket_Lateral_Movement : FILE
 {
@@ -330210,9 +327818,9 @@ rule SIGNATURE_BASE_Impacket_Lateral_Movement : FILE
 		date = "2018-03-22"
 		modified = "2023-12-05"
 		reference = "https://github.com/CoreSecurity/impacket"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_impacket_tools.yar#L425-L443"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6628c27474d5235d5b510a55215762980a5b526b353b740344cb669e8e023e3c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_impacket_tools.yar#L425-L443"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6628c27474d5235d5b510a55215762980a5b526b353b740344cb669e8e023e3c"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -330227,7 +327835,7 @@ rule SIGNATURE_BASE_Impacket_Lateral_Movement : FILE
 		$s7 = "impacket.nmb(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <14000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 14000KB and 2 of them
 }
 rule SIGNATURE_BASE_MAL_Crime_Win32_Loader_Guloader_1_Experimental : FILE
 {
@@ -330238,9 +327846,9 @@ rule SIGNATURE_BASE_MAL_Crime_Win32_Loader_Guloader_1_Experimental : FILE
 		date = "2020-05-04"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/VK_Intel/status/1257206565146370050"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_guloader.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "03b7e0251b1c08798ce310cc4c11adfaa3071409d608c91c30d5fc7e28a079de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_guloader.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_03b7e0251b1c08798ce310cc4c11adfaa3071409d608c91c30d5fc7e28a079de"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -330251,7 +327859,7 @@ rule SIGNATURE_BASE_MAL_Crime_Win32_Loader_Guloader_1_Experimental : FILE
 		$nt_inject_loader = {8b ?? ?? ba 44 1a 0e 9e 39 d2 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? f8 ba d0 e0 8b 30 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? d9 d0 81 fb 20 af 00 00 8b ?? ?? 39 c9 ba 92 a7 f3 95 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 39 d2 ba d0 20 2e d0 e8 ?? ?? ?? ?? 89 ?? ?? f8 8b ?? ?? ba 6a 19 1f 23 d9 d0 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? 81 fb e4 8c 00 00 39 c9 8b ?? ?? ba 19 50 9c c2 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 d2 8b ?? ?? fc ba 3d 13 8e 8b e8 ?? ?? ?? ?? d9 d0 89 ?? ?? f8 8b ?? ?? ba 30 3d 7b 2c e8 ?? ?? ?? ??}
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_EXT_SUSP_OBFUSC_Macos_Roothelper_Obfuscated : FILE
 {
@@ -330262,9 +327870,9 @@ rule SIGNATURE_BASE_EXT_SUSP_OBFUSC_Macos_Roothelper_Obfuscated : FILE
 		date = "2021-06-07"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/imp0rtp3/status/1401912205621202944"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_hktl_roothelper.yar#L2-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2121de0409f3f8e4c4e079944efb605776e0475cadc25607eb888cc6461ecaf3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_hktl_roothelper.yar#L2-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2121de0409f3f8e4c4e079944efb605776e0475cadc25607eb888cc6461ecaf3"
 		score = 65
 		quality = 83
 		tags = "FILE"
@@ -330293,7 +327901,7 @@ rule SIGNATURE_BASE_EXT_SUSP_OBFUSC_Macos_Roothelper_Obfuscated : FILE
 		$weak_opcodes_2 = {	48 8B 45 ??	48 83 38 ??	0F 95 C1 88 4D ?? }
 
 	condition:
-		( uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xcafebabe or uint32(0)==0xbebafeca) and ($a1 or 3 of ($b*) or 5 of ($f*) or all of ($opcodes*) or (2 of ($b*) and (2 of ($c*) or 2 of ($opcodes*))) or (3 of ($c*) and 4 of ($f*)) or (2 of ($opcodes*) and ( all of ($weak_opcodes*) or 3 of ($c*))))
+		( uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xcefaedfe or uint32( 0 ) == 0xfeedfacf or uint32( 0 ) == 0xcffaedfe or uint32( 0 ) == 0xcafebabe or uint32( 0 ) == 0xbebafeca ) and ( $a1 or 3 of ( $b* ) or 5 of ( $f* ) or all of ( $opcodes* ) or ( 2 of ( $b* ) and ( 2 of ( $c* ) or 2 of ( $opcodes* ) ) ) or ( 3 of ( $c* ) and 4 of ( $f* ) ) or ( 2 of ( $opcodes* ) and ( all of ( $weak_opcodes* ) or 3 of ( $c* ) ) ) )
 }
 import "pe"
 
@@ -330306,9 +327914,9 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_1 : FILE
 		date = "2018-10-17"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greyenergy.yar#L12-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0cbdc156b7080608c1071feeb4826a70bb259c55139d74d019465c4bb5244260"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greyenergy.yar#L12-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0cbdc156b7080608c1071feeb4826a70bb259c55139d74d019465c4bb5244260"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330321,10 +327929,8 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_1 : FILE
 		$s14 = "configure the service" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and pe.imphash()=="98d1ad672d0db4b4abdcda73cc9835cb" and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and pe.imphash ( ) == "98d1ad672d0db4b4abdcda73cc9835cb" and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_2 : FILE
 {
 	meta:
@@ -330334,9 +327940,9 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_2 : FILE
 		date = "2018-10-17"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greyenergy.yar#L31-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "600bc5b423ef3281bfc7ad7ab479aa1208b0144b0f4afd8c2d14f17b5e2c600b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greyenergy.yar#L31-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_600bc5b423ef3281bfc7ad7ab479aa1208b0144b0f4afd8c2d14f17b5e2c600b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330347,10 +327953,8 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_2 : FILE
 		$s2 = "PnSenariopoeKerGEtxrcy" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_3 : FILE
 {
 	meta:
@@ -330360,9 +327964,9 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_3 : FILE
 		date = "2018-10-17"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greyenergy.yar#L46-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f4851f5381a4d8dea488d50ff11048052826c51428f8610bc5d3480ed254d32f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greyenergy.yar#L46-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f4851f5381a4d8dea488d50ff11048052826c51428f8610bc5d3480ed254d32f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330374,7 +327978,7 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_3 : FILE
 		$x3 = "sryCEMieye" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them
 }
 import "pe"
 
@@ -330387,9 +327991,9 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_4 : FILE
 		date = "2018-10-17"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greyenergy.yar#L62-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c845be8b56dc9aa9f0eaec2a67c4baef9c9b4fd1789e96cd781e3876721b1297"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greyenergy.yar#L62-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c845be8b56dc9aa9f0eaec2a67c4baef9c9b4fd1789e96cd781e3876721b1297"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330404,10 +328008,8 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_4 : FILE
 		$x3 = "NURVNTURVORSMSPPRTQMPTTQOQRP" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="279adfbd42308a07b3131ee57d067b3e" or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "279adfbd42308a07b3131ee57d067b3e" or 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_5 : FILE
 {
 	meta:
@@ -330417,9 +328019,9 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_5 : FILE
 		date = "2018-10-17"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greyenergy.yar#L84-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3ced67c514d54324b41a4a4a92c1d3138e75380f3129b39ae92c1895c267acb2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greyenergy.yar#L84-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3ced67c514d54324b41a4a4a92c1d3138e75380f3129b39ae92c1895c267acb2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330430,7 +328032,7 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_5 : FILE
 		$s12 = "WespySSld.eQ" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them
 }
 rule SIGNATURE_BASE_Furtim_Nativedll : FILE
 {
@@ -330441,9 +328043,9 @@ rule SIGNATURE_BASE_Furtim_Nativedll : FILE
 		date = "2016-06-13"
 		modified = "2023-12-05"
 		reference = "MISP 3971"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_furtim.yar#L8-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f9673cdd1e8e38f98b9625291a03011d5cfce78c689eab491ff189c4e039e1ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_furtim.yar#L8-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f9673cdd1e8e38f98b9625291a03011d5cfce78c689eab491ff189c4e039e1ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330457,7 +328059,7 @@ rule SIGNATURE_BASE_Furtim_Nativedll : FILE
 		$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and $s1 or all of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and $s1 or all of ( $op* )
 }
 rule SIGNATURE_BASE_Furtim_Parent_1 : FILE
 {
@@ -330468,9 +328070,9 @@ rule SIGNATURE_BASE_Furtim_Parent_1 : FILE
 		date = "2016-07-16"
 		modified = "2023-12-05"
 		reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_furtim.yar#L34-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ab4c7ca5c887b2a2f2949a5a6fd0d623dad47d9c1f866fb43f7f8ec38dfa6a02"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_furtim.yar#L34-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ab4c7ca5c887b2a2f2949a5a6fd0d623dad47d9c1f866fb43f7f8ec38dfa6a02"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330486,7 +328088,7 @@ rule SIGNATURE_BASE_Furtim_Parent_1 : FILE
 		$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and ($x1 or ( all of ($s*) and all of ($op*)))) or all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( $x1 or ( all of ( $s* ) and all of ( $op* ) ) ) ) or all of them
 }
 rule SIGNATURE_BASE_Malware_Sakula_Xorloop : FILE
 {
@@ -330497,10 +328099,10 @@ rule SIGNATURE_BASE_Malware_Sakula_Xorloop : FILE
 		date = "2016-06-13"
 		modified = "2023-01-27"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sakula.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sakula.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fc6497fe708dbda9355139721b6181e7"
-		logic_hash = "b3c3131693e18ce2cf26786a93b61d39d90703d8c827de1340f85377fe7b59de"
+		logic_hash = "v1_sha256_b3c3131693e18ce2cf26786a93b61d39d90703d8c827de1340f85377fe7b59de"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330510,7 +328112,7 @@ rule SIGNATURE_BASE_Malware_Sakula_Xorloop : FILE
 		$opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
 
 	condition:
-		uint16(0)==0x5A4D and any of ($opcodes*)
+		uint16( 0 ) == 0x5A4D and any of ( $opcodes* )
 }
 rule SIGNATURE_BASE_Malware_Sakula_Memory
 {
@@ -330521,10 +328123,10 @@ rule SIGNATURE_BASE_Malware_Sakula_Memory
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sakula.yar#L20-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sakula.yar#L20-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b3852b9e7f2b8954be447121bb6b65c3"
-		logic_hash = "ba6d93a1fc5fd81748eb462fc55b681987126ba853ddb677a5f1f9b74ba5cde8"
+		logic_hash = "v1_sha256_ba6d93a1fc5fd81748eb462fc55b681987126ba853ddb677a5f1f9b74ba5cde8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -330553,9 +328155,9 @@ rule SIGNATURE_BASE_Malware_Sakula_Shellcode
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sakula.yar#L47-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0e84d91cd1bb0455ac7d2ca78583510388f39cebd95523c5f6f173a50e0c1951"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sakula.yar#L47-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0e84d91cd1bb0455ac7d2ca78583510388f39cebd95523c5f6f173a50e0c1951"
 		score = 75
 		quality = 85
 		tags = ""
@@ -330576,9 +328178,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Xsltransform_Aug21 : FILE
 		date = "2020-02-23"
 		modified = "2023-12-05"
 		reference = "https://gist.github.com/JohnHammond/cdae03ca5bc2a14a735ad0334dcb93d6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/webshell_xsl_transform.yar#L1-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3ac0b50adc4c56769d0248e213e9426a22e0f5086bf081da57f835ff1c77b716"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/webshell_xsl_transform.yar#L1-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3ac0b50adc4c56769d0248e213e9426a22e0f5086bf081da57f835ff1c77b716"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330592,7 +328194,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Xsltransform_Aug21 : FILE
 		$s3 = "FromBase64String(Request[\""
 
 	condition:
-		filesize <500KB and $csharpshell and (1 of ($x*) or all of ($s*))
+		filesize < 500KB and $csharpshell and ( 1 of ( $x* ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_Win7Elevatev2 : FILE
 {
@@ -330603,9 +328205,9 @@ rule SIGNATURE_BASE_Win7Elevatev2 : FILE
 		date = "2015-05-14"
 		modified = "2023-12-05"
 		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_uac_elevators.yar#L2-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2f5859388c6074f1a75f0c40387f30ffa50d6b87f20f518fd1af7398c95cd650"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_uac_elevators.yar#L2-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2f5859388c6074f1a75f0c40387f30ffa50d6b87f20f518fd1af7398c95cd650"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -330632,7 +328234,7 @@ rule SIGNATURE_BASE_Win7Elevatev2 : FILE
 		$s10 = "HeapAlloc" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_UACME_Akagi
 {
@@ -330643,9 +328245,9 @@ rule SIGNATURE_BASE_UACME_Akagi
 		date = "2015-05-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/hfiref0x/UACME"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_uac_elevators.yar#L35-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e10f39837a53dcc6d301d21a69fca965aeca0a07cfc832a9a0142b08d280f955"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_uac_elevators.yar#L35-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e10f39837a53dcc6d301d21a69fca965aeca0a07cfc832a9a0142b08d280f955"
 		score = 60
 		quality = 85
 		tags = ""
@@ -330669,7 +328271,7 @@ rule SIGNATURE_BASE_UACME_Akagi
 		$l5 = "ShellExecuteEx" ascii
 
 	condition:
-		(1 of ($x*)) or (3 of ($s*) and all of ($l*))
+		(1 of ( $x* ) ) or ( 3 of ( $s* ) and all of ( $l* ) )
 }
 rule SIGNATURE_BASE_Uacelevator : FILE
 {
@@ -330680,10 +328282,10 @@ rule SIGNATURE_BASE_Uacelevator : FILE
 		date = "2015-05-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/MalwareTech/UACElevator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_uac_elevators.yar#L66-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_uac_elevators.yar#L66-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
-		logic_hash = "8215746b2c84a5500221580969fb2eac8ee11cbb5af4ba5bf2dbd1def65b8745"
+		logic_hash = "v1_sha256_8215746b2c84a5500221580969fb2eac8ee11cbb5af4ba5bf2dbd1def65b8745"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330702,7 +328304,7 @@ rule SIGNATURE_BASE_Uacelevator : FILE
 		$s9 = "Address: 0x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <172KB and ($x1 or 8 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 172KB and ( $x1 or 8 of ( $s* ) )
 }
 rule SIGNATURE_BASE_S4U : FILE
 {
@@ -330713,10 +328315,10 @@ rule SIGNATURE_BASE_S4U : FILE
 		date = "2015-06-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/aurel26/s-4-u-for-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_uac_elevators.yar#L92-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_uac_elevators.yar#L92-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cfc18f3d5306df208461459a8e667d89ce44ed77"
-		logic_hash = "b1882710f2514fb44ff01631636c0a66beef620c8bea644ebe05cd5385a9e494"
+		logic_hash = "v1_sha256_b1882710f2514fb44ff01631636c0a66beef620c8bea644ebe05cd5385a9e494"
 		score = 50
 		quality = 83
 		tags = "FILE"
@@ -330753,7 +328355,7 @@ rule SIGNATURE_BASE_S4U : FILE
 		$g16 = "MSVCR120.dll"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and (1 of ($x*) or all of ($s*) or all of ($g*))
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and ( 1 of ( $x* ) or all of ( $s* ) or all of ( $g* ) )
 }
 rule SIGNATURE_BASE_UACME_Akagi_2 : FILE
 {
@@ -330764,9 +328366,9 @@ rule SIGNATURE_BASE_UACME_Akagi_2 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://github.com/hfiref0x/UACME"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_uac_elevators.yar#L151-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f79a82d466f51c86a0e6fb89688708c35dbcc7ba8f4543e5fb7565d41dd3faab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_uac_elevators.yar#L151-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f79a82d466f51c86a0e6fb89688708c35dbcc7ba8f4543e5fb7565d41dd3faab"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -330785,7 +328387,7 @@ rule SIGNATURE_BASE_UACME_Akagi_2 : FILE
 		$s6 = "loadFrom=\"%systemroot%\\system32\\sysprep\\cryptbase.DLL\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 3 of ($s*))) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_Crime_Win_Rat_Alienspy : FILE
 {
@@ -330796,9 +328398,9 @@ rule SIGNATURE_BASE_Crime_Win_Rat_Alienspy : FILE
 		date = "2015-04-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_alienspy_rat.yar#L2-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2b6fec104a89badb057619f648119dcf6debd294ee2b80a1fde6ffa30a7a45f7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_alienspy_rat.yar#L2-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2b6fec104a89badb057619f648119dcf6debd294ee2b80a1fde6ffa30a7a45f7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330836,7 +328438,7 @@ rule SIGNATURE_BASE_Crime_Win_Rat_Alienspy : FILE
 		$sc_7 = "AlienSpy"
 
 	condition:
-		uint16(0)==0x4B50 and filesize <800KB and (( all of ($sa_*)) or ( all of ($sb_*)) or ( all of ($sc_*)))
+		uint16( 0 ) == 0x4B50 and filesize < 800KB and ( ( all of ( $sa_* ) ) or ( all of ( $sb_* ) ) or ( all of ( $sc_* ) ) )
 }
 rule SIGNATURE_BASE_SUSP_Obfuscated_JS_Obfuscatorio : HIGHVOL FILE
 {
@@ -330847,9 +328449,9 @@ rule SIGNATURE_BASE_SUSP_Obfuscated_JS_Obfuscatorio : HIGHVOL FILE
 		date = "2021-08-25"
 		modified = "2023-12-05"
 		reference = "https://obfuscator.io"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_js_obfuscatorio.yar#L1-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "813df8459e4a53a084dc1f902713af74747a0c2f4ef535e682de38acba9b0e5e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_js_obfuscatorio.yar#L1-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_813df8459e4a53a084dc1f902713af74747a0c2f4ef535e682de38acba9b0e5e"
 		score = 50
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -330868,7 +328470,7 @@ rule SIGNATURE_BASE_SUSP_Obfuscated_JS_Obfuscatorio : HIGHVOL FILE
 		$d1 = /(parseInt\(_0x([a-f0-9]{2}){2,4}\(0x[a-f0-9]{1,5}\)\)\/0x[a-f0-9]{1,2}\)?(\+|\*\()\-?){6}/
 
 	condition:
-		$a1 at 0 or ( filesize <1000000 and (3 of ($c*) or $d1))
+		$a1 at 0 or ( filesize < 1000000 and ( 3 of ( $c* ) or $d1 ) )
 }
 rule SIGNATURE_BASE_Crime_Ole_Loadswf_Cve_2018_4878 : PURPORTED_NORTH_KOREAN_ACTORS CVE_2018_4878 FILE
 {
@@ -330879,9 +328481,9 @@ rule SIGNATURE_BASE_Crime_Ole_Loadswf_Cve_2018_4878 : PURPORTED_NORTH_KOREAN_ACT
 		date = "2024-01-01"
 		modified = "2023-12-05"
 		reference = "hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ole_loadswf_cve_2018_4878.yar#L2-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "716cad0c5a12cc360522e2649c7870a493bef4bec3d55c3a3e235f3a85c02a56"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ole_loadswf_cve_2018_4878.yar#L2-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_716cad0c5a12cc360522e2649c7870a493bef4bec3d55c3a3e235f3a85c02a56"
 		score = 75
 		quality = 85
 		tags = "PURPORTED NORTH KOREAN ACTORS, CVE-2018-4878, FILE"
@@ -330903,7 +328505,7 @@ rule SIGNATURE_BASE_Crime_Ole_Loadswf_Cve_2018_4878 : PURPORTED_NORTH_KOREAN_ACT
 		$s3 = "myUrlReqest" wide ascii
 
 	condition:
-		filesize <500KB and all of ($header*) and all of ($title*) and 3 of ($s*) or all of ($pdb*) and all of ($header*) and 1 of ($s*)
+		filesize < 500KB and all of ( $header* ) and all of ( $title* ) and 3 of ( $s* ) or all of ( $pdb* ) and all of ( $header* ) and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1 : FILE
 {
@@ -330914,9 +328516,9 @@ rule SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1 : FILE
 		date = "2022-06-10"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_ps_jab.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ad61dca5c945ed87642668e3b834b12c813af244437903a5abb5c69459b9456"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_ps_jab.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ad61dca5c945ed87642668e3b834b12c813af244437903a5abb5c69459b9456"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -330928,7 +328530,7 @@ rule SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1 : FILE
 		$xc4 = { 4a 00 41 00 42 00 ?? 00 41 00 44 00 30 00 41 }
 
 	condition:
-		filesize <30MB and 1 of them
+		filesize < 30MB and 1 of them
 }
 rule SIGNATURE_BASE_Invoke_Mimikatz
 {
@@ -330939,9 +328541,9 @@ rule SIGNATURE_BASE_Invoke_Mimikatz
 		date = "2016-08-03"
 		modified = "2023-12-05"
 		reference = "https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_invoke_mimikatz.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b9bfa54a64d6f6b8af97ec62c9102ccf0912a19b65fbd25a4836480e63497a00"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_invoke_mimikatz.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b9bfa54a64d6f6b8af97ec62c9102ccf0912a19b65fbd25a4836480e63497a00"
 		score = 75
 		quality = 85
 		tags = ""
@@ -330964,9 +328566,9 @@ rule SIGNATURE_BASE_Snaketurla_Malware_May17_1 : FILE
 		date = "2017-05-04"
 		modified = "2023-01-06"
 		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_snaketurla_osx.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "12b18c9e03f1a471541de2fb3ecc6b90a13910ca299a9b7d2bad9dd11f881506"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_snaketurla_osx.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_12b18c9e03f1a471541de2fb3ecc6b90a13910ca299a9b7d2bad9dd11f881506"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -330977,7 +328579,7 @@ rule SIGNATURE_BASE_Snaketurla_Malware_May17_1 : FILE
 		$s1 = "/Users/vlad/Desktop/install/install/" ascii
 
 	condition:
-		( uint16(0)==0xfacf and filesize <200KB and all of them )
+		( uint16( 0 ) == 0xfacf and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Snaketurla_Malware_May17_2 : FILE
 {
@@ -330988,9 +328590,9 @@ rule SIGNATURE_BASE_Snaketurla_Malware_May17_2 : FILE
 		date = "2017-05-04"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_snaketurla_osx.yar#L27-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "35bd8650afbc515ecd1cef393fd75f9b77a1e31111612227f0f4557fe8b312a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_snaketurla_osx.yar#L27-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_35bd8650afbc515ecd1cef393fd75f9b77a1e31111612227f0f4557fe8b312a7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331003,7 +328605,7 @@ rule SIGNATURE_BASE_Snaketurla_Malware_May17_2 : FILE
 		$s3 = "012A04DECBC441e49C527B2798F54CA7LOG_NAMED_PIPE_NAME" fullword ascii
 
 	condition:
-		( uint16(0)==0xfacf and filesize <6000KB and all of them )
+		( uint16( 0 ) == 0xfacf and filesize < 6000KB and all of them )
 }
 rule SIGNATURE_BASE_Snaketurla_Malware_May17_4 : FILE
 {
@@ -331014,9 +328616,9 @@ rule SIGNATURE_BASE_Snaketurla_Malware_May17_4 : FILE
 		date = "2017-05-04"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_snaketurla_osx.yar#L44-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7b6aac2313ea7dae572114e92ad0b5437c5be2542853de3b184bef780faee68b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_snaketurla_osx.yar#L44-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7b6aac2313ea7dae572114e92ad0b5437c5be2542853de3b184bef780faee68b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331027,7 +328629,7 @@ rule SIGNATURE_BASE_Snaketurla_Malware_May17_4 : FILE
 		$s1 = "Install Adobe Flash Player.app/com.adobe.updatePK" fullword ascii
 
 	condition:
-		( uint16(0)==0x4b50 and filesize <5000KB and all of them )
+		( uint16( 0 ) == 0x4b50 and filesize < 5000KB and all of them )
 }
 rule SIGNATURE_BASE_Snaketurla_Installd_SH : FILE
 {
@@ -331038,9 +328640,9 @@ rule SIGNATURE_BASE_Snaketurla_Installd_SH : FILE
 		date = "2017-05-04"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_snaketurla_osx.yar#L59-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b16107434951ddb212996909d53dfbcdae74ed13df6690ce3f6c74258ab4670"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_snaketurla_osx.yar#L59-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b16107434951ddb212996909d53dfbcdae74ed13df6690ce3f6c74258ab4670"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331051,7 +328653,7 @@ rule SIGNATURE_BASE_Snaketurla_Installd_SH : FILE
 		$s2 = "${SCRIPT_DIR}/installdp ${FILE}" ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and all of them )
+		( uint16( 0 ) == 0x2123 and filesize < 20KB and all of them )
 }
 rule SIGNATURE_BASE_Snaketurla_Install_SH : FILE
 {
@@ -331062,9 +328664,9 @@ rule SIGNATURE_BASE_Snaketurla_Install_SH : FILE
 		date = "2017-05-04"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_snaketurla_osx.yar#L74-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "019d20ca6632759cf01962d336c22831edc64b6927d8b27d026b76eb118fce02"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_snaketurla_osx.yar#L74-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_019d20ca6632759cf01962d336c22831edc64b6927d8b27d026b76eb118fce02"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331075,105 +328677,7 @@ rule SIGNATURE_BASE_Snaketurla_Install_SH : FILE
 		$s2 = "$TARGET_PATH2/com.adobe.update.plist" ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and all of them )
-}
-rule SIGNATURE_BASE_APT_Cobaltstrike_Beacon_Indicator : FILE
-{
-	meta:
-		description = "Detects CobaltStrike beacons"
-		author = "JPCERT"
-		id = "8508c7a0-0131-59b1-b537-a6d1c6cb2b35"
-		date = "2018-11-09"
-		modified = "2023-12-05"
-		reference = "https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cobaltstrike.yar#L40-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f429a7a8c8bbea22eba3bbf81e391dab8e957583283a995d1d60d42f17c20e7"
-		score = 75
-		quality = 83
-		tags = "FILE"
-
-	strings:
-		$v1 = { 73 70 72 6E 67 00 }
-		$v2 = { 69 69 69 69 69 69 69 69 }
-
-	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
-}
-rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_Strings
-{
-	meta:
-		description = "Identifies strings used in Cobalt Strike Beacon DLL"
-		author = "Elastic"
-		id = "af558aa2-a3dc-5a7a-bc74-42bb2246091c"
-		date = "2021-03-16"
-		modified = "2023-12-05"
-		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cobaltstrike.yar#L54-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4349a7ad94df2269217b55c2aef9628c4eef078566c276936accdd4f996ba2cf"
-		score = 75
-		quality = 85
-		tags = ""
-
-	strings:
-		$s1 = "%02d/%02d/%02d %02d:%02d:%02d"
-		$s2 = "Started service %s on %s"
-		$s3 = "%s as %s\\%s: %d"
-
-	condition:
-		2 of them
-}
-rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_XOR_Strings
-{
-	meta:
-		description = "Identifies XOR'd strings used in Cobalt Strike Beacon DLL"
-		author = "Elastic"
-		id = "359160a8-cf1c-58a8-bf7f-c09a8d661308"
-		date = "2021-03-16"
-		modified = "2023-12-05"
-		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cobaltstrike.yar#L69-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b5009c29055784ce6371100417b862f723d7e3c1b4081c563fcd8770db48051f"
-		score = 75
-		quality = 85
-		tags = ""
-		xor_s1 = "%02d/%02d/%02d %02d:%02d:%02d"
-		xor_s2 = "Started service %s on %s"
-		xor_s3 = "%s as %s\\%s: %d"
-
-	strings:
-		$s1 = "%02d/%02d/%02d %02d:%02d:%02d" xor(0x01-0xff)
-		$s2 = "Started service %s on %s" xor(0x01-0xff)
-		$s3 = "%s as %s\\%s: %d" xor(0x01-0xff)
-		$fp1 = "MalwareRemovalTool"
-
-	condition:
-		2 of ($s*) and not 1 of ($fp*)
-}
-rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_4_2_Decrypt
-{
-	meta:
-		description = "Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2"
-		author = "Elastic"
-		id = "63b71eef-0af5-5765-b957-ccdc9dde053b"
-		date = "2021-03-16"
-		modified = "2023-12-05"
-		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cobaltstrike.yar#L90-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8685b1626c8d263f49ccf129dcd4fe1b42482fcdb37c2e109cedcecaed8c2407"
-		score = 75
-		quality = 85
-		tags = ""
-
-	strings:
-		$a_x64 = {4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03}
-		$a_x86 = {8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2}
-
-	condition:
-		any of them
+		( uint16( 0 ) == 0x2123 and filesize < 20KB and all of them )
 }
 rule SIGNATURE_BASE_CVE_2015_1701_Taihou : CVE_2015_1701 FILE
 {
@@ -331184,9 +328688,9 @@ rule SIGNATURE_BASE_CVE_2015_1701_Taihou : CVE_2015_1701 FILE
 		date = "2015-05-13"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/W4nU0q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2015_1701.yar#L2-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d230e036c303642c40bdf83be2b097f6e447a7e7d4292c495179edbae8a4124c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2015_1701.yar#L2-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d230e036c303642c40bdf83be2b097f6e447a7e7d4292c495179edbae8a4124c"
 		score = 70
 		quality = 85
 		tags = "CVE-2015-1701, FILE"
@@ -331208,7 +328712,7 @@ rule SIGNATURE_BASE_CVE_2015_1701_Taihou : CVE_2015_1701 FILE
 		$w2 = "ntdll" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <160KB and all of ($s*) and 1 of ($w*)
+		uint16( 0 ) == 0x5a4d and filesize < 160KB and all of ( $s* ) and 1 of ( $w* )
 }
 rule SIGNATURE_BASE_APT_MAL_RU_WIN_Snake_Malware_May23_1 : MEMORY
 {
@@ -331219,9 +328723,9 @@ rule SIGNATURE_BASE_APT_MAL_RU_WIN_Snake_Malware_May23_1 : MEMORY
 		date = "2023-05-10"
 		modified = "2023-12-05"
 		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_mal_ru_snake_may23.yar#L17-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7cff7152259bb17a9b72b91f0fbef220aad2f35a1d2758d7225316a9896bf845"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_mal_ru_snake_may23.yar#L17-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7cff7152259bb17a9b72b91f0fbef220aad2f35a1d2758d7225316a9896bf845"
 		score = 75
 		quality = 71
 		tags = "MEMORY"
@@ -331250,9 +328754,9 @@ rule SIGNATURE_BASE_APT_MAL_RU_Snake_Indicators_May23_1
 		date = "2023-05-10"
 		modified = "2023-12-05"
 		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_mal_ru_snake_may23.yar#L44-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb7a4ad2ee0868f17b6235f070e4c03e2394e3c252253f334b29ad26116b09e5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_mal_ru_snake_may23.yar#L44-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb7a4ad2ee0868f17b6235f070e4c03e2394e3c252253f334b29ad26116b09e5"
 		score = 85
 		quality = 35
 		tags = ""
@@ -331293,11 +328797,11 @@ rule SIGNATURE_BASE_SUSP_RDP_File_Indicators_Oct24_1 : FILE
 		author = "Florian Roth"
 		id = "16128c1e-64ed-5a3e-ad1e-e0330d91f5a9"
 		date = "2024-10-25"
-		modified = "2024-11-01"
+		modified = "2024-12-12"
 		reference = "https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nobellium_rdp_phish.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "55bd63738c38719ce7aeb874956488b0d3f7167a31d880ee61994b5921bd1458"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nobellium_rdp_phish.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_55bd63738c38719ce7aeb874956488b0d3f7167a31d880ee61994b5921bd1458"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331315,7 +328819,7 @@ rule SIGNATURE_BASE_SUSP_RDP_File_Indicators_Oct24_1 : FILE
 		$s5 = "emoteapplicationicon:s:C:\\Windows\\SystemApps" wide
 
 	condition:
-		filesize <50KB and all of them
+		filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_Duqu2_Sample1 : FILE
 {
@@ -331326,9 +328830,9 @@ rule SIGNATURE_BASE_Duqu2_Sample1 : FILE
 		date = "2016-07-02"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_duqu2.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf6b60bcae2b41487ede11581c82b32e6bc912445008b1655e4f75be65cf6596"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_duqu2.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf6b60bcae2b41487ede11581c82b32e6bc912445008b1655e4f75be65cf6596"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -331343,7 +328847,7 @@ rule SIGNATURE_BASE_Duqu2_Sample1 : FILE
 		$s2 = "MSI.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 40KB and $x1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_Duqu2_Sample2 : FILE
 {
@@ -331354,9 +328858,9 @@ rule SIGNATURE_BASE_Duqu2_Sample2 : FILE
 		date = "2016-07-02"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_duqu2.yar#L30-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6afd87d472929f56272eb6f28970f2c8be5eb08e6126287391aee1269de1100d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_duqu2.yar#L30-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6afd87d472929f56272eb6f28970f2c8be5eb08e6126287391aee1269de1100d"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -331373,7 +328877,7 @@ rule SIGNATURE_BASE_Duqu2_Sample2 : FILE
 		$s2 = ">#>(>.>3>=>]>d>p>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of ( $s* )
 }
 rule SIGNATURE_BASE_Duqu2_Sample3 : FILE
 {
@@ -331384,9 +328888,9 @@ rule SIGNATURE_BASE_Duqu2_Sample3 : FILE
 		date = "2016-07-02"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_duqu2.yar#L52-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4adaf71a4acd8ce122af0b6f1267dc34c5190efcb4a6fa3322c1e6cf67a546a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_duqu2.yar#L52-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4adaf71a4acd8ce122af0b6f1267dc34c5190efcb4a6fa3322c1e6cf67a546a5"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -331397,7 +328901,7 @@ rule SIGNATURE_BASE_Duqu2_Sample3 : FILE
 		$s1 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and $s1)
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and $s1 )
 }
 rule SIGNATURE_BASE_Duqu2_Sample4 : FILE
 {
@@ -331408,9 +328912,9 @@ rule SIGNATURE_BASE_Duqu2_Sample4 : FILE
 		date = "2016-07-02"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_duqu2.yar#L68-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ddecd1d7fa007b83fe6e29ac8983d02511a89a16ab2365f8086ec92a52d4bf33"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_duqu2.yar#L68-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ddecd1d7fa007b83fe6e29ac8983d02511a89a16ab2365f8086ec92a52d4bf33"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -331424,7 +328928,7 @@ rule SIGNATURE_BASE_Duqu2_Sample4 : FILE
 		$s4 = "ProcessUserAccounts" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and 1 of ($x*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of ( $x* ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Duqu2_Uas : FILE
 {
@@ -331435,9 +328939,9 @@ rule SIGNATURE_BASE_Duqu2_Uas : FILE
 		date = "2016-07-02"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_duqu2.yar#L86-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8bf27ca851c580080514dfa886c0d7c69ac114efb5dbc35ccd1e7686c3dd44b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_duqu2.yar#L86-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8bf27ca851c580080514dfa886c0d7c69ac114efb5dbc35ccd1e7686c3dd44b1"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -331452,7 +328956,7 @@ rule SIGNATURE_BASE_Duqu2_Uas : FILE
 		$x4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110612 Firefox/6.0a2" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them )
 }
 rule SIGNATURE_BASE_SUSP_LNK_Big_Link_File : FILE
 {
@@ -331463,15 +328967,15 @@ rule SIGNATURE_BASE_SUSP_LNK_Big_Link_File : FILE
 		date = "2018-05-15"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_lnk.yar#L2-L12"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6e44483583249939494e76f14b022e698ba59dfe8b58133a69135144ef60c743"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_lnk.yar#L2-L12"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6e44483583249939494e76f14b022e698ba59dfe8b58133a69135144ef60c743"
 		score = 65
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and filesize >200KB
+		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and filesize > 200KB
 }
 rule SIGNATURE_BASE_Andromeda_Malbot_Jun_1A : FILE
 {
@@ -331482,9 +328986,9 @@ rule SIGNATURE_BASE_Andromeda_Malbot_Jun_1A : FILE
 		date = "2017-06-30"
 		modified = "2022-12-21"
 		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_andromeda_jun17.yar#L12-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5958608ad5527628c4b6cbe08badbff39a50dcdb6cf603f6fbb5fa32ef61c0c7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_andromeda_jun17.yar#L12-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5958608ad5527628c4b6cbe08badbff39a50dcdb6cf603f6fbb5fa32ef61c0c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331506,7 +329010,7 @@ rule SIGNATURE_BASE_Andromeda_Malbot_Jun_1A : FILE
 		$s2 = "svhost.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_Crunchrat : FILE
 {
@@ -331517,9 +329021,9 @@ rule SIGNATURE_BASE_Crunchrat : FILE
 		date = "2017-11-03"
 		modified = "2023-12-05"
 		reference = "https://github.com/t3ntman/CrunchRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_crunchrat.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e29cfe6dd2ca69b1a8cd0cb36f7513dd9befd392906225196991dc62fcc80870"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_crunchrat.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e29cfe6dd2ca69b1a8cd0cb36f7513dd9befd392906225196991dc62fcc80870"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331537,7 +329041,7 @@ rule SIGNATURE_BASE_Crunchrat : FILE
 		$s5 = "/update.php" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and (1 of ($x*) and 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and ( 1 of ( $x* ) and 3 of them )
 }
 rule SIGNATURE_BASE_APT_NK_Methodology_Artificial_Useragent_IE_Win7 : FILE
 {
@@ -331548,9 +329052,9 @@ rule SIGNATURE_BASE_APT_NK_Methodology_Artificial_Useragent_IE_Win7 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt37.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "43119b83a7eaf3dade9477d342b5656970940e9b4f41b3ba5f720d7fbe927762"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt37.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_43119b83a7eaf3dade9477d342b5656970940e9b4f41b3ba5f720d7fbe927762"
 		score = 45
 		quality = 85
 		tags = "FILE"
@@ -331564,7 +329068,7 @@ rule SIGNATURE_BASE_APT_NK_Methodology_Artificial_Useragent_IE_Win7 : FILE
 		$fp3 = "TASER SYNC" ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of ($a*) and not 1 of ($fp*)
+		uint16( 0 ) == 0x5A4D and all of ( $a* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Gen_Unicorn_Obfuscated_Powershell : FILE
 {
@@ -331575,10 +329079,10 @@ rule SIGNATURE_BASE_Gen_Unicorn_Obfuscated_Powershell : FILE
 		date = "2018-04-03"
 		modified = "2023-12-05"
 		reference = "https://github.com/trustedsec/unicorn/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_unicorn_obfuscated_powershell.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_unicorn_obfuscated_powershell.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b93d2fe6a671a6a967f31d5b3a0a16d4f93abcaf25188a2bbdc0894087adb10d"
-		logic_hash = "cb0044d5ee146213c96161d52880ce6c20d5884d57620c73f359673d4ae4b76b"
+		logic_hash = "v1_sha256_cb0044d5ee146213c96161d52880ce6c20d5884d57620c73f359673d4ae4b76b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331592,7 +329096,7 @@ rule SIGNATURE_BASE_Gen_Unicorn_Obfuscated_Powershell : FILE
 		$sb2 = "/w 1 /C \"s"
 
 	condition:
-		filesize <20KB and uint32be(0)==0x706f7765 and $h1 at 0 and ( uint16be( filesize -2)==0x2722 or ( uint16be( filesize -2)==0x220a and uint8( filesize -3)==0x27) or ( uint16be( filesize -2)==0x2922 and uint8( filesize -3)==0x27)) and (1 of ($sa*) and 1 of ($sb*))
+		filesize < 20KB and uint32be( 0 ) == 0x706f7765 and $h1 at 0 and ( uint16be( filesize - 2 ) == 0x2722 or ( uint16be( filesize - 2 ) == 0x220a and uint8( filesize - 3 ) == 0x27 ) or ( uint16be( filesize - 2 ) == 0x2922 and uint8( filesize - 3 ) == 0x27 ) ) and ( 1 of ( $sa* ) and 1 of ( $sb* ) )
 }
 rule SIGNATURE_BASE_Wmimplant
 {
@@ -331603,9 +329107,9 @@ rule SIGNATURE_BASE_Wmimplant
 		date = "2017-03-24"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_wmi_implant.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6422514d25b723e7ab92c1af1301e51d9a93aa41da98791d96c4754a91b5a18e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_wmi_implant.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6422514d25b723e7ab92c1af1301e51d9a93aa41da98791d96c4754a91b5a18e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -331634,9 +329138,9 @@ rule SIGNATURE_BASE_Brc4_Shellcode
 		date = "2022-11-19"
 		modified = "2023-12-05"
 		reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/hktl_bruteratel_c4.yar#L263-L290"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a2816eb0316cebc96569847c17eae3bc50b988b07aa471176a09695fcefc21ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/hktl_bruteratel_c4.yar#L263-L290"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a2816eb0316cebc96569847c17eae3bc50b988b07aa471176a09695fcefc21ec"
 		score = 75
 		quality = 83
 		tags = ""
@@ -331659,7 +329163,7 @@ rule SIGNATURE_BASE_Brc4_Shellcode
 		$hashFuncx86 = { EB 07 8D 74 26 00 83 C2 01 0F B6 31 C1 C8 0D 89 F1 8D 5C 30 E0 01 F0 80 F9 61 89 D1 0F 43 C3 39 D7 75 E3 }
 
 	condition:
-		(pe.machine==pe.MACHINE_AMD64 and (2 of ($shellcode*) or all of ($funcHash*) and $hashFuncx64)) or (pe.machine==pe.MACHINE_I386 and ( all of ($funcHash*) and $hashFuncx86))
+		(pe.machine == pe.MACHINE_AMD64 and ( 2 of ( $shellcode* ) or all of ( $funcHash* ) and $hashFuncx64 ) ) or ( pe.machine == pe.MACHINE_I386 and ( all of ( $funcHash* ) and $hashFuncx86 ) )
 }
 rule SIGNATURE_BASE_Passcv_Sabre_Malware_1 : FILE
 {
@@ -331670,9 +329174,9 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_1 : FILE
 		date = "2016-10-20"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passcv.yar#L10-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dfa356b4dff12c3de467c74763fc4d233db9ff5bc3e9ac9f052d331fa47a4ded"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passcv.yar#L10-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dfa356b4dff12c3de467c74763fc4d233db9ff5bc3e9ac9f052d331fa47a4ded"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331693,7 +329197,7 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_1 : FILE
 		$s8 = "Internet Connect Failed!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) and 5 of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) and 5 of ( $s* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Passcv_Sabre_Malware_Signing_Cert : FILE
 {
@@ -331704,9 +329208,9 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_Signing_Cert : FILE
 		date = "2016-10-20"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passcv.yar#L36-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ead1de262858960a13b375713183f775bc275fbf4beba4c0839cef2baa5e9f00"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passcv.yar#L36-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ead1de262858960a13b375713183f775bc275fbf4beba4c0839cef2baa5e9f00"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -331724,7 +329228,7 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_Signing_Cert : FILE
 		$s8 = "Runewaker Entertainment0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Passcv_Sabre_Malware_2 : FILE
 {
@@ -331735,9 +329239,9 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_2 : FILE
 		date = "2016-10-20"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passcv.yar#L59-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f640f1dc60c6714195dcdb9a0bb4fb0c34e0a62673bca00c7f49f7b73c3f9b0a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passcv.yar#L59-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f640f1dc60c6714195dcdb9a0bb4fb0c34e0a62673bca00c7f49f7b73c3f9b0a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331757,7 +329261,7 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_2 : FILE
 		$s6 = "LSpyb2" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and $x1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_Passcv_Sabre_Malware_Excalibur_1 : FILE
 {
@@ -331768,9 +329272,9 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_Excalibur_1 : FILE
 		date = "2016-10-20"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passcv.yar#L84-L105"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ffbd971368420460573c4ecc68261088ffacf91ab9ae72405b41393b04aa2b46"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passcv.yar#L84-L105"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ffbd971368420460573c4ecc68261088ffacf91ab9ae72405b41393b04aa2b46"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331786,7 +329290,7 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_Excalibur_1 : FILE
 		$s2 = "AAA.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of ($x*) or all of ($s*)) or 3 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of ( $x* ) or all of ( $s* ) ) or 3 of them
 }
 rule SIGNATURE_BASE_Passcv_Sabre_Malware_3 : FILE
 {
@@ -331797,9 +329301,9 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_3 : FILE
 		date = "2016-10-20"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passcv.yar#L107-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1032f41688e7cb3fe0be33b143c1af43ee705737a70af3b336ba8504ffe169a9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passcv.yar#L107-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1032f41688e7cb3fe0be33b143c1af43ee705737a70af3b336ba8504ffe169a9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331813,7 +329317,7 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_3 : FILE
 		$s3 = "!This is a Win32 program." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <8000KB and $x1 and 2 of ($s*))
+		( uint16( 0 ) == 0x5a4d and filesize < 8000KB and $x1 and 2 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Passcv_Sabre_Malware_4 : FILE
 {
@@ -331824,9 +329328,9 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_4 : FILE
 		date = "2016-10-20"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passcv.yar#L126-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c445e745ef520438fa7c4ddcae2657b57c80d798640fdd7c85eabf535f158911"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passcv.yar#L126-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c445e745ef520438fa7c4ddcae2657b57c80d798640fdd7c85eabf535f158911"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331839,7 +329343,7 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_4 : FILE
 		$s3 = "dGFzay5kbnME3luLmN" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
 }
 rule SIGNATURE_BASE_Passcv_Sabre_Tool_Ntscan : FILE
 {
@@ -331850,9 +329354,9 @@ rule SIGNATURE_BASE_Passcv_Sabre_Tool_Ntscan : FILE
 		date = "2016-10-20"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passcv.yar#L143-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f2b41c1e6db8c9288663cccbf5659484ed415b403068cc566b31aa044bf0de9e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passcv.yar#L143-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f2b41c1e6db8c9288663cccbf5659484ed415b403068cc566b31aa044bf0de9e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331865,7 +329369,7 @@ rule SIGNATURE_BASE_Passcv_Sabre_Tool_Ntscan : FILE
 		$s1 = "admin$" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them )
 }
 rule SIGNATURE_BASE_Passcv_Sabre_Malware_5 : FILE
 {
@@ -331876,9 +329380,9 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_5 : FILE
 		date = "2016-10-20"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passcv.yar#L161-L182"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "30508c6561a2bb908945e9092da1d5cf2257b8b183effcea25a1ba15567f3d20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passcv.yar#L161-L182"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_30508c6561a2bb908945e9092da1d5cf2257b8b183effcea25a1ba15567f3d20"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331896,10 +329400,8 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_5 : FILE
 		$s5 = "SHARECONTROL" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 1 of ($x*) or all of ($s*))
+		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 1 of ( $x* ) or all of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_VULN_DRV_PROCEXP152_May23 : FILE
 {
 	meta:
@@ -331909,9 +329411,9 @@ rule SIGNATURE_BASE_SUSP_VULN_DRV_PROCEXP152_May23 : FILE
 		date = "2023-05-05"
 		modified = "2023-07-28"
 		reference = "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor_inverse_matches.yar#L502-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d988bba837b91b2ad7f69be8765a948848bce21e2daa53af602f714758cda4d4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor_inverse_matches.yar#L502-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d988bba837b91b2ad7f69be8765a948848bce21e2daa53af602f714758cda4d4"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -331923,7 +329425,7 @@ rule SIGNATURE_BASE_SUSP_VULN_DRV_PROCEXP152_May23 : FILE
 		$a3 = "procexp.Sys" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_MAL_RANSOM_Robinhood_May19_1 : FILE
 {
@@ -331934,9 +329436,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Robinhood_May19_1 : FILE
 		date = "2019-05-15"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/BThurstonCPTECH/status/1128489465327030277"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_robinhood.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5eef71b94f2488dceff80ec2daba689c12d13b2742ba9ae5ead58711339d6026"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_robinhood.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5eef71b94f2488dceff80ec2daba689c12d13b2742ba9ae5ead58711339d6026"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -331953,7 +329455,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Robinhood_May19_1 : FILE
 		$s8 = "main.EnableServiceFuck" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
 }
 rule SIGNATURE_BASE_HKTL_Natbypass_Dec22_1 : T1090 FILE
 {
@@ -331964,9 +329466,9 @@ rule SIGNATURE_BASE_HKTL_Natbypass_Dec22_1 : T1090 FILE
 		date = "2022-12-27"
 		modified = "2023-12-05"
 		reference = "https://github.com/cw1997/NATBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/hktl_natbypass.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8af76d7d9d4500dc219090fbd8ca8cd9fd17bfc224f14a411febfd6f75b92206"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/hktl_natbypass.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8af76d7d9d4500dc219090fbd8ca8cd9fd17bfc224f14a411febfd6f75b92206"
 		score = 80
 		quality = 85
 		tags = "T1090, FILE"
@@ -331980,7 +329482,7 @@ rule SIGNATURE_BASE_HKTL_Natbypass_Dec22_1 : T1090 FILE
 		$s3 = "^(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])"
 
 	condition:
-		filesize <8000KB and (1 of ($x*) or 2 of them ) or 3 of them
+		filesize < 8000KB and ( 1 of ( $x* ) or 2 of them ) or 3 of them
 }
 rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1 : FILE
 {
@@ -331991,9 +329493,9 @@ rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1 : FILE
 		date = "2021-03-29"
 		modified = "2023-12-05"
 		reference = "https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_php_zlib_backdoor.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "74bfd9e12cb7671cde953d361a2adeb9388edd9b2aab0f9ce04dce0d433561dc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_php_zlib_backdoor.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_74bfd9e12cb7671cde953d361a2adeb9388edd9b2aab0f9ce04dce0d433561dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332003,7 +329505,7 @@ rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1 : FILE
 		$x2 = "HTTP_USER_AGENTT" ascii fullword
 
 	condition:
-		filesize <3000KB and all of them
+		filesize < 3000KB and all of them
 }
 rule SIGNATURE_BASE_APT_MAL_CN_Unit78020_Sep15 : FILE
 {
@@ -332015,9 +329517,9 @@ rule SIGNATURE_BASE_APT_MAL_CN_Unit78020_Sep15 : FILE
 		modified = "2023-01-31"
 		old_rule_name = "Unit78020_Malware_Gen1"
 		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unit78020_malware.yar#L8-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "85244d4e2b9e03fa4ab8268ffbedffb839bca598b1e863d3d0b3914294d3ddf0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unit78020_malware.yar#L8-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_85244d4e2b9e03fa4ab8268ffbedffb839bca598b1e863d3d0b3914294d3ddf0"
 		score = 80
 		quality = 83
 		tags = "FILE"
@@ -332052,7 +329554,7 @@ rule SIGNATURE_BASE_APT_MAL_CN_Unit78020_Sep15 : FILE
 		$sc3 = "dwError1 = %d" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or all of ($sa*) or all of ($sb*) or all of ($sc*))
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or all of ( $sa* ) or all of ( $sb* ) or all of ( $sc* ) )
 }
 rule SIGNATURE_BASE_Unit78020_Malware_1 : FILE
 {
@@ -332063,10 +329565,10 @@ rule SIGNATURE_BASE_Unit78020_Malware_1 : FILE
 		date = "2015-09-24"
 		modified = "2023-12-05"
 		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unit78020_malware.yar#L60-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unit78020_malware.yar#L60-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
-		logic_hash = "589dfb39630fd396b1f8c5d9d0ecccfc058edfd8e74e3bd06d1bfb9f91ad1798"
+		logic_hash = "v1_sha256_589dfb39630fd396b1f8c5d9d0ecccfc058edfd8e74e3bd06d1bfb9f91ad1798"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332081,7 +329583,7 @@ rule SIGNATURE_BASE_Unit78020_Malware_1 : FILE
 		$s6 = "NOKIAN95/WEB" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <160KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 160KB and 4 of them
 }
 rule SIGNATURE_BASE_Unit78020_Malware_Gen2 : FILE
 {
@@ -332092,9 +329594,9 @@ rule SIGNATURE_BASE_Unit78020_Malware_Gen2 : FILE
 		date = "2015-09-24"
 		modified = "2023-12-05"
 		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unit78020_malware.yar#L80-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fd3cb904499a985830543174126761a3cdcff134d61b93b1105a489c00bd042f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unit78020_malware.yar#L80-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fd3cb904499a985830543174126761a3cdcff134d61b93b1105a489c00bd042f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332113,7 +329615,7 @@ rule SIGNATURE_BASE_Unit78020_Malware_Gen2 : FILE
 		$s5 = "*Can't Get" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_Unit78020_Malware_Gen3 : FILE
 {
@@ -332124,9 +329626,9 @@ rule SIGNATURE_BASE_Unit78020_Malware_Gen3 : FILE
 		date = "2015-09-24"
 		modified = "2023-12-05"
 		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unit78020_malware.yar#L103-L132"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "304b3f429e144f1f4b0f7794e77f3059ec6b3e5c6fdf4c7b820a77db1cf8cfcb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unit78020_malware.yar#L103-L132"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_304b3f429e144f1f4b0f7794e77f3059ec6b3e5c6fdf4c7b820a77db1cf8cfcb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332151,7 +329653,7 @@ rule SIGNATURE_BASE_Unit78020_Malware_Gen3 : FILE
 		$s10 = "SCHANNEL.DLL" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*)) or 4 of ($s*)
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of ( $x* ) ) or 4 of ( $s* )
 }
 rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Sleepgenerator
 {
@@ -332162,10 +329664,10 @@ rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Sleepgenerator
 		date = "2022-12-14"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ru_sparepart_dec22.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ru_sparepart_dec22.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f9cd5b145e372553dded92628db038d8"
-		logic_hash = "41a9fdb2ba7aefcaf6ef2477b598e98b9045ef17ce9bfe46f3169d0b2e0dd289"
+		logic_hash = "v1_sha256_41a9fdb2ba7aefcaf6ef2477b598e98b9045ef17ce9bfe46f3169d0b2e0dd289"
 		score = 50
 		quality = 85
 		tags = ""
@@ -332191,10 +329693,10 @@ rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Struct : FILE
 		date = "2022-12-14"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ru_sparepart_dec22.yar#L22-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ru_sparepart_dec22.yar#L22-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f9cd5b145e372553dded92628db038d8"
-		logic_hash = "807c7404146c08995440987aef78ecde11224f7d6cad1a0d22269b2bf46a44e5"
+		logic_hash = "v1_sha256_807c7404146c08995440987aef78ecde11224f7d6cad1a0d22269b2bf46a44e5"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -332205,7 +329707,7 @@ rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Struct : FILE
 		$struct = { 44 89 ac ?? ?? ?? ?? ?? 4? 8b ac ?? ?? ?? ?? ?? 4? 83 c5 28 89 84 ?? ?? ?? ?? ?? 89 8c ?? ?? ?? ?? ?? 89 54 ?? ?? 44 89 44 ?? ?? 44 89 4c ?? ?? 44 89 54 ?? ?? 44 89 5c ?? ?? 89 5c ?? ?? 89 7c ?? ?? 89 74 ?? ?? 89 6c ?? ?? 44 89 74 ?? ?? 44 89 7c ?? ?? 44 89 64 ?? ?? 8b 84 ?? ?? ?? ?? ?? 44 8b c8 8b 84 ?? ?? ?? ?? ?? 44 8b c0 4? 8d 15 ?? ?? ?? ?? 4? 8b cd ff 15 ?? ?? ?? ??  }
 
 	condition:
-		( uint16(0)==0x5A4D) and uint32( uint32(0x3C))==0x00004550 and $pdb and $struct and filesize <20KB
+		( uint16( 0 ) == 0x5A4D ) and uint32( uint32( 0x3C ) ) == 0x00004550 and $pdb and $struct and filesize < 20KB
 }
 import "pe"
 
@@ -332218,19 +329720,17 @@ rule SIGNATURE_BASE_Golddragon_Malware_Feb18_1 : FILE
 		date = "2018-02-03"
 		modified = "2023-12-05"
 		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_golddragon.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "873cf7aa18027615fe8c44140879811254229a238f7d426144fb7c1a6e07ea74"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_golddragon.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_873cf7aa18027615fe8c44140879811254229a238f7d426144fb7c1a6e07ea74"
 		score = 90
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="168c2f7752511dfd263a83d5d08a90db" or pe.imphash()=="0606858bdeb129de33a2b095d7806e74" or pe.imphash()=="51d992f5b9e01533eb1356323ed1cb0f" or pe.imphash()=="bb801224abd8562f9ee8fb261b75e32a")
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "168c2f7752511dfd263a83d5d08a90db" or pe.imphash ( ) == "0606858bdeb129de33a2b095d7806e74" or pe.imphash ( ) == "51d992f5b9e01533eb1356323ed1cb0f" or pe.imphash ( ) == "bb801224abd8562f9ee8fb261b75e32a" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Golddragon_Aux_File : FILE
 {
 	meta:
@@ -332240,9 +329740,9 @@ rule SIGNATURE_BASE_Golddragon_Aux_File : FILE
 		date = "2018-02-03"
 		modified = "2023-12-05"
 		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_golddragon.yar#L31-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4c5eb04cdafe3a69e584c64b833d8c6d21890660e92cc050bb29798dbcdf5326"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_golddragon.yar#L31-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4c5eb04cdafe3a69e584c64b833d8c6d21890660e92cc050bb29798dbcdf5326"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -332252,7 +329752,7 @@ rule SIGNATURE_BASE_Golddragon_Aux_File : FILE
 		$x1 = "/////////////////////regkeyenum////////////" ascii
 
 	condition:
-		filesize <500KB and 1 of them
+		filesize < 500KB and 1 of them
 }
 import "pe"
 
@@ -332265,9 +329765,9 @@ rule SIGNATURE_BASE_Golddragon_Ghost419_RAT : FILE
 		date = "2018-02-03"
 		modified = "2023-01-06"
 		reference = "https://goo.gl/rW1yvZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_golddragon.yar#L46-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b953c5e21c332add4ff3b8fef9d623904eb929b0e7fc86e6c7109cd81bc3819b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_golddragon.yar#L46-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b953c5e21c332add4ff3b8fef9d623904eb929b0e7fc86e6c7109cd81bc3819b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332299,7 +329799,7 @@ rule SIGNATURE_BASE_Golddragon_Ghost419_RAT : FILE
 		$s7 = "MpCmdRun.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and ((pe.exports("ExportFunction") and pe.number_of_exports==1) or (1 of ($x*) and 1 of ($s*)) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( ( pe.exports ( "ExportFunction" ) and pe.number_of_exports == 1 ) or ( 1 of ( $x* ) and 1 of ( $s* ) ) or 3 of them )
 }
 import "pe"
 
@@ -332312,9 +329812,9 @@ rule SIGNATURE_BASE_Golddragon_Runningrat : FILE
 		date = "2018-02-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/rW1yvZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_golddragon.yar#L88-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "02b0ac613bb01cb5bbe947661880070790bbb7c6ba9925e70bc200df34747a0b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_golddragon.yar#L88-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_02b0ac613bb01cb5bbe947661880070790bbb7c6ba9925e70bc200df34747a0b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332344,10 +329844,8 @@ rule SIGNATURE_BASE_Golddragon_Runningrat : FILE
 		$s5 = "D:\\result.log" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="c78ccc8f02286648c4373d3bf03efc43" or pe.exports("RunningRat") or 1 of ($x*) or 5 of ($a*) or 3 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "c78ccc8f02286648c4373d3bf03efc43" or pe.exports ( "RunningRat" ) or 1 of ( $x* ) or 5 of ( $a* ) or 3 of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Golddragon_Runnignrat : FILE
 {
 	meta:
@@ -332357,9 +329855,9 @@ rule SIGNATURE_BASE_Golddragon_Runnignrat : FILE
 		date = "2018-02-03"
 		modified = "2023-01-07"
 		reference = "https://goo.gl/rW1yvZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_golddragon.yar#L130-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5bcc2ebbd54c31cf418430149eb558e8e26355161d0b53f403e7dfd2e1707baa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_golddragon.yar#L130-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5bcc2ebbd54c31cf418430149eb558e8e26355161d0b53f403e7dfd2e1707baa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332378,7 +329876,7 @@ rule SIGNATURE_BASE_Golddragon_Runnignrat : FILE
 		$s8 = "\\PI_001.dat" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 3 of them )
 }
 rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_A : FILE
 {
@@ -332389,9 +329887,9 @@ rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_A : FILE
 		date = "2014-11-23"
 		modified = "2024-04-24"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L14-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1cc367dff184f2b458a2b7c0c88a44095714525ca6bb115d03e6331cf1f22116"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L14-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1cc367dff184f2b458a2b7c0c88a44095714525ca6bb115d03e6331cf1f22116"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332414,7 +329912,7 @@ rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_A : FILE
 		$x2 = "KeServiceDescriptorTable" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $m0 at 0 and $m1 and all of ($s*) and 1 of ($x*)
+		uint16( 0 ) == 0x5a4d and $m0 at 0 and $m1 and all of ( $s* ) and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_B : FILE
 {
@@ -332425,9 +329923,9 @@ rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_B : FILE
 		date = "2014-11-23"
 		modified = "2024-04-24"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L43-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c2dee4f94f9eefb1c11f6e86144c6bfafc0845768200f5a839ffe3dd5d38294d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L43-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c2dee4f94f9eefb1c11f6e86144c6bfafc0845768200f5a839ffe3dd5d38294d"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -332469,7 +329967,7 @@ rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_B : FILE
 		$z5 = "atoi" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $m0 at 0 and all of ($s*) and ( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*)) and filesize <20KB
+		uint16( 0 ) == 0x5a4d and $m0 at 0 and all of ( $s* ) and ( all of ( $v* ) or all of ( $w* ) or all of ( $x* ) or all of ( $y* ) or all of ( $z* ) ) and filesize < 20KB
 }
 rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_C : FILE
 {
@@ -332480,9 +329978,9 @@ rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_C : FILE
 		date = "2014-11-23"
 		modified = "2024-04-24"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L96-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9454eb8b45a720fbe517caa2221fb0ceedf561902d94cabe513e921cc52fe035"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L96-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9454eb8b45a720fbe517caa2221fb0ceedf561902d94cabe513e921cc52fe035"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332501,7 +329999,7 @@ rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_C : FILE
 		$y2 = "0Richw" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $m0 at 0 and all of ($s*) and ( all of ($x*) or all of ($y*)) and filesize <20KB
+		uint16( 0 ) == 0x5a4d and $m0 at 0 and all of ( $s* ) and ( all of ( $x* ) or all of ( $y* ) ) and filesize < 20KB
 }
 rule SIGNATURE_BASE_Regin_Sig_Svcsstat : FILE
 {
@@ -332512,10 +330010,10 @@ rule SIGNATURE_BASE_Regin_Sig_Svcsstat : FILE
 		date = "2014-11-26"
 		modified = "2024-04-24"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L126-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L126-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"
-		logic_hash = "2b1fdc2cc8c0aedaf749ee0e87a8853b91735a4e215c65df221a930d4b1d02f7"
+		logic_hash = "v1_sha256_2b1fdc2cc8c0aedaf749ee0e87a8853b91735a4e215c65df221a930d4b1d02f7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332530,7 +330028,7 @@ rule SIGNATURE_BASE_Regin_Sig_Svcsstat : FILE
 		$s6 = "%ls%ls" fullword wide
 
 	condition:
-		all of them and filesize <15KB and filesize >10KB
+		all of them and filesize < 15KB and filesize > 10KB
 }
 rule SIGNATURE_BASE_Regin_Sample_1 : FILE
 {
@@ -332541,10 +330039,10 @@ rule SIGNATURE_BASE_Regin_Sample_1 : FILE
 		date = "2014-11-25"
 		modified = "2024-04-24"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L145-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L145-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "773d7fab06807b5b1bc2d74fa80343e83593caf2"
-		logic_hash = "e8291b4a68924dccdd825ee2cc8930acb794e92e0302598872ec78eb0bf8504f"
+		logic_hash = "v1_sha256_e8291b4a68924dccdd825ee2cc8930acb794e92e0302598872ec78eb0bf8504f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -332569,7 +330067,7 @@ rule SIGNATURE_BASE_Regin_Sample_1 : FILE
 		$fp1 = "Enter SerialBuildResourceList" ascii fullword
 
 	condition:
-		all of them and filesize <110KB and filesize >80KB and not $fp1
+		all of them and filesize < 110KB and filesize > 80KB and not $fp1
 }
 rule SIGNATURE_BASE_Regin_Sample_2 : FILE
 {
@@ -332580,10 +330078,10 @@ rule SIGNATURE_BASE_Regin_Sample_2 : FILE
 		date = "2014-11-26"
 		modified = "2024-04-24"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L176-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L176-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a7b285d4b896b66fce0ebfcd15db53b3a74a0400"
-		logic_hash = "a11d03d10661c1fc094450b250056196e5d8d16bd171eba9e37c7524aa2301d2"
+		logic_hash = "v1_sha256_a11d03d10661c1fc094450b250056196e5d8d16bd171eba9e37c7524aa2301d2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332608,7 +330106,7 @@ rule SIGNATURE_BASE_Regin_Sample_2 : FILE
 		$s20 = "ExAcquireFastMutexUnsafe" fullword ascii
 
 	condition:
-		all of them and filesize <40KB and filesize >30KB
+		all of them and filesize < 40KB and filesize > 30KB
 }
 rule SIGNATURE_BASE_Regin_Sample_3 : FILE
 {
@@ -332619,10 +330117,10 @@ rule SIGNATURE_BASE_Regin_Sample_3 : FILE
 		date = "2014-11-27"
 		modified = "2024-04-24"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L205-L230"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L205-L230"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
-		logic_hash = "5a0f77f203765f7737c00c3df760ea7f3ed354559aad07f3053173ff09e1ce1a"
+		logic_hash = "v1_sha256_5a0f77f203765f7737c00c3df760ea7f3ed354559aad07f3053173ff09e1ce1a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332644,7 +330142,7 @@ rule SIGNATURE_BASE_Regin_Sample_3 : FILE
 		$s14 = "ntkrnlpa.exe" fullword ascii
 
 	condition:
-		uint32(0)==0xfedcbafe and all of ($s*) and filesize >160KB and filesize <200KB
+		uint32( 0 ) == 0xfedcbafe and all of ( $s* ) and filesize > 160KB and filesize < 200KB
 }
 rule SIGNATURE_BASE_Regin_Sample_Set_2 : FILE
 {
@@ -332655,9 +330153,9 @@ rule SIGNATURE_BASE_Regin_Sample_Set_2 : FILE
 		date = "2014-11-26"
 		modified = "2024-04-24"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L232-L264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "26125cea704532cbc22df46af228299ae810bce60938bee7b067ed273158d76f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L232-L264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_26125cea704532cbc22df46af228299ae810bce60938bee7b067ed273158d76f"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -332688,7 +330186,7 @@ rule SIGNATURE_BASE_Regin_Sample_Set_2 : FILE
 		$s20 = "KefReleaseSpinLockFromDpcLevel" fullword ascii
 
 	condition:
-		filesize <40KB and filesize >30KB and all of them
+		filesize < 40KB and filesize > 30KB and all of them
 }
 rule SIGNATURE_BASE_Regin_Sample_Set_1 : FILE
 {
@@ -332699,9 +330197,9 @@ rule SIGNATURE_BASE_Regin_Sample_Set_1 : FILE
 		date = "2014-11-27"
 		modified = "2023-01-06"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L266-L296"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7402f409e7dd3180d8e6fe017af19d0a1d0dd86f85279191db1bc8f6c94951ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L266-L296"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7402f409e7dd3180d8e6fe017af19d0a1d0dd86f85279191db1bc8f6c94951ac"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332727,7 +330225,7 @@ rule SIGNATURE_BASE_Regin_Sample_Set_1 : FILE
 		$s15 = "%hd %d" fullword ascii
 
 	condition:
-		($hd at 0) and all of ($s*) and filesize <450KB and filesize >360KB
+		($hd at 0 ) and all of ( $s* ) and filesize < 450KB and filesize > 360KB
 }
 rule SIGNATURE_BASE_Apt_Regin_Legspin : FILE
 {
@@ -332739,10 +330237,10 @@ rule SIGNATURE_BASE_Apt_Regin_Legspin : FILE
 		date = "2023-01-27"
 		modified = "2024-04-24"
 		reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L298-L319"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L298-L319"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "29105f46e4d33f66fee346cfd099d1cc"
-		logic_hash = "1b026f475fdbb3c97f33895520844fa4944eb2fffc0883502a6cb79162bbd388"
+		logic_hash = "v1_sha256_1b026f475fdbb3c97f33895520844fa4944eb2fffc0883502a6cb79162bbd388"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332759,7 +330257,7 @@ rule SIGNATURE_BASE_Apt_Regin_Legspin : FILE
 		$a8 = "millisecs"
 
 	condition:
-		uint16(0)==0x5A4D and all of ($a*)
+		uint16( 0 ) == 0x5A4D and all of ( $a* )
 }
 rule SIGNATURE_BASE_Apt_Regin_Hopscotch : FILE
 {
@@ -332771,10 +330269,10 @@ rule SIGNATURE_BASE_Apt_Regin_Hopscotch : FILE
 		date = "2023-01-27"
 		modified = "2024-04-24"
 		reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L321-L342"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L321-L342"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6c34031d7a5fc2b091b623981a8ae61c"
-		logic_hash = "33b5fa61aaa802a60f3d42d59eb474222841a8a557b06b23a9e325e922e2cec1"
+		logic_hash = "v1_sha256_33b5fa61aaa802a60f3d42d59eb474222841a8a557b06b23a9e325e922e2cec1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332791,7 +330289,7 @@ rule SIGNATURE_BASE_Apt_Regin_Hopscotch : FILE
 		$a8 = "ConnectToNamedPipes"
 
 	condition:
-		uint16(0)==0x5A4D and all of ($a*)
+		uint16( 0 ) == 0x5A4D and all of ( $a* )
 }
 rule SIGNATURE_BASE_Regin_Related_Malware
 {
@@ -332802,10 +330300,10 @@ rule SIGNATURE_BASE_Regin_Related_Malware
 		date = "2015-06-03"
 		modified = "2024-04-24"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_regin_fiveeyes.yar#L344-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_regin_fiveeyes.yar#L344-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "76c355bfeb859a347e38da89e3d30a6ff1f94229"
-		logic_hash = "61ce7a69ab357740158e355455362a4f5fddc67ee60af120733f509e7407216f"
+		logic_hash = "v1_sha256_61ce7a69ab357740158e355455362a4f5fddc67ee60af120733f509e7407216f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -332823,7 +330321,7 @@ rule SIGNATURE_BASE_Regin_Related_Malware
 		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide
 
 	condition:
-		$s1 or 3 of ($s*)
+		$s1 or 3 of ( $s* )
 }
 rule SIGNATURE_BASE_SUSP_Qakbot_Uninstaller_Shellcode_Aug23
 {
@@ -332834,9 +330332,9 @@ rule SIGNATURE_BASE_SUSP_Qakbot_Uninstaller_Shellcode_Aug23
 		date = "2023-08-30"
 		modified = "2023-12-05"
 		reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_qakbot_uninstaller.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "91d26c50bf29517aa68e709ca3b6f32f4ca390f4c2f48e48cd251bfdd5dbcc71"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_qakbot_uninstaller.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_91d26c50bf29517aa68e709ca3b6f32f4ca390f4c2f48e48cd251bfdd5dbcc71"
 		score = 60
 		quality = 85
 		tags = ""
@@ -332856,9 +330354,9 @@ rule SIGNATURE_BASE_SUSP_Qakbot_Uninstaller_FBI_Aug23
 		date = "2023-08-31"
 		modified = "2023-12-05"
 		reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_qakbot_uninstaller.yar#L16-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0ce963190502709edec9434e6a64cb9db7c5553113b686afc56a516350d76baa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_qakbot_uninstaller.yar#L16-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0ce963190502709edec9434e6a64cb9db7c5553113b686afc56a516350d76baa"
 		score = 60
 		quality = 85
 		tags = ""
@@ -332884,9 +330382,9 @@ rule SIGNATURE_BASE_CVE_2014_4076_Exploitcode : CVE_2014_4076 FILE
 		date = "2018-04-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/yarGen"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2014_4076.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "96b8743de8b3968d64b74af93f5e61574a3b31d33df6d51e944b4f02c7b9723e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2014_4076.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_96b8743de8b3968d64b74af93f5e61574a3b31d33df6d51e944b4f02c7b9723e"
 		score = 75
 		quality = 85
 		tags = "CVE-2014-4076, FILE"
@@ -332900,7 +330398,7 @@ rule SIGNATURE_BASE_CVE_2014_4076_Exploitcode : CVE_2014_4076 FILE
 		$x4 = "[*] MS14-070 (CVE-2014-4076) x86" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
 }
 rule SIGNATURE_BASE_Duqu1_5_Modules
 {
@@ -332911,10 +330409,10 @@ rule SIGNATURE_BASE_Duqu1_5_Modules
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_duqu1_5_modules.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_duqu1_5_modules.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bb3961e2b473c22c3d5939adeb86819eb846ccd07f5736abb5e897918580aace"
-		logic_hash = "795107e227cfb73f6ea09fcdb078f8b57a30d47a2cb702b2d47cc936dea5ae9f"
+		logic_hash = "v1_sha256_795107e227cfb73f6ea09fcdb078f8b57a30d47a2cb702b2d47cc936dea5ae9f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -332938,9 +330436,9 @@ rule SIGNATURE_BASE_Armitage_Msfconsole : FILE
 		date = "2017-12-24"
 		modified = "2022-08-18"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_armitage.yar#L14-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf9df9858ca584288288fd0b55fdcf65aeea410f25531ee3d8cf48c30d23824a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_armitage.yar#L14-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf9df9858ca584288288fd0b55fdcf65aeea410f25531ee3d8cf48c30d23824a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332952,7 +330450,7 @@ rule SIGNATURE_BASE_Armitage_Msfconsole : FILE
 		$s11 = "\\umsf\\u>" ascii
 
 	condition:
-		filesize <1KB and 2 of them
+		filesize < 1KB and 2 of them
 }
 rule SIGNATURE_BASE_Armitage_Meterpretersession_Strings : FILE
 {
@@ -332963,9 +330461,9 @@ rule SIGNATURE_BASE_Armitage_Meterpretersession_Strings : FILE
 		date = "2017-12-24"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_armitage.yar#L33-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3a21a42df8f15e3e81c797feb284edfe2de7d1c182547e8606f0e48dc08f6939"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_armitage.yar#L33-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3a21a42df8f15e3e81c797feb284edfe2de7d1c182547e8606f0e48dc08f6939"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -332980,7 +330478,7 @@ rule SIGNATURE_BASE_Armitage_Meterpretersession_Strings : FILE
 		$s4 = "MeterpreterSession.java" fullword ascii
 
 	condition:
-		filesize <30KB and 1 of them
+		filesize < 30KB and 1 of them
 }
 rule SIGNATURE_BASE_Armitage_OSX : FILE
 {
@@ -332991,9 +330489,9 @@ rule SIGNATURE_BASE_Armitage_OSX : FILE
 		date = "2017-12-24"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_armitage.yar#L52-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "25c94b9715fdc10d0e04eea7d5b9974e60f3e248f51b80de80542b169996fc7a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_armitage.yar#L52-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_25c94b9715fdc10d0e04eea7d5b9974e60f3e248f51b80de80542b169996fc7a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333007,7 +330505,7 @@ rule SIGNATURE_BASE_Armitage_OSX : FILE
 		$s17 = "resources/msfrpcd_new.bat" fullword ascii
 
 	condition:
-		filesize <6000KB and 1 of them
+		filesize < 6000KB and 1 of them
 }
 rule SIGNATURE_BASE_EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE CVE_2019_19781
 {
@@ -333018,9 +330516,9 @@ rule SIGNATURE_BASE_EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE CVE_2019_19781
 		date = "2020-01-13"
 		modified = "2023-12-05"
 		reference = "https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_shitrix.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "00687b30235be5ef3c00432b5b96bbc325dee553e7c0cb565d6f389b1bce12de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_shitrix.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_00687b30235be5ef3c00432b5b96bbc325dee553e7c0cb565d6f389b1bce12de"
 		score = 70
 		quality = 85
 		tags = "FILE, CVE-2019-19781"
@@ -333043,10 +330541,8 @@ rule SIGNATURE_BASE_EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE CVE_2019_19781
 		$b3 = "/../" ascii
 
 	condition:
-		1 of ($s*) or all of ($b*)
+		1 of ( $s* ) or all of ( $b* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_1
 {
 	meta:
@@ -333056,9 +330552,9 @@ rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_1
 		date = "2020-12-14"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_solarwinds_sunburst.yar#L6-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1fc006dead2fd540717e00e468bf30f37bdb1d061a805e33683e4a77db7f9156"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_solarwinds_sunburst.yar#L6-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1fc006dead2fd540717e00e468bf30f37bdb1d061a805e33683e4a77db7f9156"
 		score = 85
 		quality = 77
 		tags = ""
@@ -333075,10 +330571,8 @@ rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_1
 		$fnv_xor = { 67 19 D8 A7 3B 90 AC 5B }
 
 	condition:
-		$fnv_xor and ($cmd_regex_encoded or $cmd_regex_plain) or (($fake_orion_event_encoded or $fake_orion_event_plain) and ($fake_orion_eventmanager_encoded or $fake_orion_eventmanager_plain) and ($fake_orion_message_encoded and $fake_orion_message_plain))
+		$fnv_xor and ( $cmd_regex_encoded or $cmd_regex_plain ) or ( ( $fake_orion_event_encoded or $fake_orion_event_plain ) and ( $fake_orion_eventmanager_encoded or $fake_orion_eventmanager_plain ) and ( $fake_orion_message_encoded and $fake_orion_message_plain ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_2
 {
 	meta:
@@ -333088,9 +330582,9 @@ rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_2
 		date = "2020-12-14"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_solarwinds_sunburst.yar#L28-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2bf0697b110bca88f712cbccaf0d2ba614d6093d6d9595659aefe088848d3826"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_solarwinds_sunburst.yar#L28-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2bf0697b110bca88f712cbccaf0d2ba614d6093d6d9595659aefe088848d3826"
 		score = 85
 		quality = 83
 		tags = ""
@@ -333137,7 +330631,7 @@ rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_2
 		$z = "C84vLUpO9UjMC04tykwDAA==" wide
 
 	condition:
-		($a and $b and $c and $d and $e and $f and $h and $i) or ($j and $k and $l and $m and $n and $o and $p and $q and $r and $s and ($aa or $ab)) or ($t and $u and $v and $w and $x and $y and $z and ($aa or $ab)) or ($ac and $ad and $ae and $af and $ag and $ah and ($am or $an)) or ($ai and $aj and $ak and $al and ($am or $an))
+		($a and $b and $c and $d and $e and $f and $h and $i ) or ( $j and $k and $l and $m and $n and $o and $p and $q and $r and $s and ( $aa or $ab ) ) or ( $t and $u and $v and $w and $x and $y and $z and ( $aa or $ab ) ) or ( $ac and $ad and $ae and $af and $ag and $ah and ( $am or $an ) ) or ( $ai and $aj and $ak and $al and ( $am or $an ) )
 }
 import "pe"
 
@@ -333150,9 +330644,9 @@ rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_1 : FILE
 		date = "2020-12-14"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_solarwinds_sunburst.yar#L80-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8471e6b3675e7e9ccfe5b81ab4c599668f2de528f3b179a675f50aa1fd7814b2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_solarwinds_sunburst.yar#L80-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8471e6b3675e7e9ccfe5b81ab4c599668f2de528f3b179a675f50aa1fd7814b2"
 		score = 85
 		quality = 81
 		tags = "FILE"
@@ -333167,10 +330661,8 @@ rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_1 : FILE
 		$string3 = "SolarWinds" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <10KB and pe.imports("mscoree.dll","_CorDllMain") and $httpmodule and $context and all of ($compile*) and all of ($string*)
+		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10KB and pe.imports ( "mscoree.dll" , "_CorDllMain" ) and $httpmodule and $context and all of ( $compile* ) and all of ( $string* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_2 : FILE
 {
 	meta:
@@ -333180,9 +330672,9 @@ rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_2 : FILE
 		date = "2020-12-14"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_solarwinds_sunburst.yar#L100-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "96e344bd2ba3ee07784852db3e9935352762c2fa7b6be88f00cac10a90706ffc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_solarwinds_sunburst.yar#L100-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_96e344bd2ba3ee07784852db3e9935352762c2fa7b6be88f00cac10a90706ffc"
 		score = 85
 		quality = 83
 		tags = "FILE"
@@ -333196,10 +330688,8 @@ rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_2 : FILE
 		$string4 = "args"
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <10KB and 3 of ($string*) and $dynamic and $solar
+		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10KB and 3 of ( $string* ) and $dynamic and $solar
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Hacktool_PS1_COSMICGALE_1
 {
 	meta:
@@ -333209,9 +330699,9 @@ rule SIGNATURE_BASE_APT_Hacktool_PS1_COSMICGALE_1
 		date = "2020-12-14"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_solarwinds_sunburst.yar#L119-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c7b4d3c29d57b8db8d21e3a436c83617bc3fe14e66ccc1500b33a3774f09ee12"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_solarwinds_sunburst.yar#L119-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c7b4d3c29d57b8db8d21e3a436c83617bc3fe14e66ccc1500b33a3774f09ee12"
 		score = 85
 		quality = 65
 		tags = ""
@@ -333230,8 +330720,6 @@ rule SIGNATURE_BASE_APT_Hacktool_PS1_COSMICGALE_1
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Dropper_Raw64_TEARDROP_1
 {
 	meta:
@@ -333241,9 +330729,9 @@ rule SIGNATURE_BASE_APT_Dropper_Raw64_TEARDROP_1
 		date = "2020-12-14"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_solarwinds_sunburst.yar#L141-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ab5197e7a1a123055b361a2ef79f8a77a7935606fccc8f163ea5914c94cd14d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_solarwinds_sunburst.yar#L141-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ab5197e7a1a123055b361a2ef79f8a77a7935606fccc8f163ea5914c94cd14d"
 		score = 85
 		quality = 85
 		tags = ""
@@ -333256,8 +330744,6 @@ rule SIGNATURE_BASE_APT_Dropper_Raw64_TEARDROP_1
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1 : FILE
 {
 	meta:
@@ -333267,9 +330753,9 @@ rule SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1 : FILE
 		date = "2020-12-14"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_solarwinds_sunburst.yar#L157-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a1fa9b9c700601d10cb77ec714b972f04308de615dfc519f680fc956227cc11d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_solarwinds_sunburst.yar#L157-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a1fa9b9c700601d10cb77ec714b972f04308de615dfc519f680fc956227cc11d"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -333282,7 +330768,7 @@ rule SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1 : FILE
 		$loc_5551D726F6 = { 53 4F 46 54 57 41 52 45 ?? ?? ?? ?? 66 74 5C 43 ?? ?? ?? ?? 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule SIGNATURE_BASE_MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 : CVE_2020_5902 FILE
 {
@@ -333293,9 +330779,9 @@ rule SIGNATURE_BASE_MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 : CVE_2020_5902
 		date = "2020-06-07"
 		modified = "2023-12-05"
 		reference = "https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_f5_bigip_expl_payloads.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a3651081bb09452d80cba9f673a7b61c8ee2f47a12fb64d975eb63867688ee3b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_f5_bigip_expl_payloads.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a3651081bb09452d80cba9f673a7b61c8ee2f47a12fb64d975eb63867688ee3b"
 		score = 75
 		quality = 85
 		tags = "CVE-2020-5902, FILE"
@@ -333311,7 +330797,7 @@ rule SIGNATURE_BASE_MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 : CVE_2020_5902
 		$s3 = ".sh | sh" ascii
 
 	condition:
-		filesize <300KB and (1 of ($x*) or 3 of them )
+		filesize < 300KB and ( 1 of ( $x* ) or 3 of them )
 }
 import "pe"
 
@@ -333324,9 +330810,9 @@ rule SIGNATURE_BASE_MAL_Devilstongue_Hijackdll : FILE
 		date = "2021-07-15"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_candiru.yar#L3-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4ad58a77f9ab5fa078dc40f3ec1d0b0180f25ff3ea304a3c85889df29739e0f5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_candiru.yar#L3-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4ad58a77f9ab5fa078dc40f3ec1d0b0180f25ff3ea304a3c85889df29739e0f5"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -333343,7 +330829,7 @@ rule SIGNATURE_BASE_MAL_Devilstongue_Hijackdll : FILE
 		$code2 = { 44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19 }
 
 	condition:
-		filesize <800KB and uint16(0)==0x5A4D and (pe.characteristics&pe.DLL) and (4 of them or ($code1 and $code2) or pe.imphash()=="9a964e810949704ff7b4a393d9adda60")
+		filesize < 800KB and uint16( 0 ) == 0x5A4D and ( pe.characteristics & pe.DLL ) and ( 4 of them or ( $code1 and $code2 ) or pe.imphash ( ) == "9a964e810949704ff7b4a393d9adda60" )
 }
 rule SIGNATURE_BASE_Fakem_Generic : FILE
 {
@@ -333354,9 +330840,9 @@ rule SIGNATURE_BASE_Fakem_Generic : FILE
 		date = "2016-01-25"
 		modified = "2023-01-06"
 		reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fakem_backdoor.yar#L8-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0ee606be48961d1e4c1fd9e0e10b53603cfd62cec652baef62f893c0a9e9684c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fakem_backdoor.yar#L8-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0ee606be48961d1e4c1fd9e0e10b53603cfd62cec652baef62f893c0a9e9684c"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -333388,7 +330874,7 @@ rule SIGNATURE_BASE_Fakem_Generic : FILE
 		$f2 = "\\browser.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and ( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*))
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( all of ( $a* ) or all of ( $b* ) or all of ( $c* ) or all of ( $e* ) or 1 of ( $f* ) )
 }
 rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_1 : FILE
 {
@@ -333399,9 +330885,9 @@ rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_1 : FILE
 		date = "2018-02-26"
 		modified = "2023-12-05"
 		reference = "Internal Research - TI2T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_muddywater.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b675b004f86695821737b7fc05276c8350e44f5822ec458a74658f895ccf7082"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_muddywater.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b675b004f86695821737b7fc05276c8350e44f5822ec458a74658f895ccf7082"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333413,7 +330899,7 @@ rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_1 : FILE
 		$x2 = "U1FCdUFIWUFid0JyQUdVQUxRQkZBSGdBY0FCeUFHVUFjd0J6QUdrQWJ3QnVBQ0FBS"
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <3000KB and 1 of them
+		uint16( 0 ) == 0xcfd0 and filesize < 3000KB and 1 of them
 }
 rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_2 : FILE
 {
@@ -333424,9 +330910,9 @@ rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_2 : FILE
 		date = "2018-02-26"
 		modified = "2023-12-05"
 		reference = "Internal Research - TI2T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_muddywater.yar#L28-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b198396d27b32f8aa57a25cd6e33deb2bcfb726731e2e07f8b9d50b5f6ff13a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_muddywater.yar#L28-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b198396d27b32f8aa57a25cd6e33deb2bcfb726731e2e07f8b9d50b5f6ff13a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333442,7 +330928,7 @@ rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_2 : FILE
 		$s5 = "ID=\"{00000000-0000-0000-0000-000000000000}\"" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <6000KB and all of them
+		uint16( 0 ) == 0xcfd0 and filesize < 6000KB and all of them
 }
 rule SIGNATURE_BASE_MAL_Muddywater_Droppedtask_Jun18_1 : FILE
 {
@@ -333453,9 +330939,9 @@ rule SIGNATURE_BASE_MAL_Muddywater_Droppedtask_Jun18_1 : FILE
 		date = "2018-06-12"
 		modified = "2023-12-05"
 		reference = "https://app.any.run/tasks/719c94eb-0a00-47cc-b583-ad4f9e25ebdb"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_muddywater.yar#L48-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "776ae1adab223ae258d1c1c0c501e177dafe196964a2ede31789a7caa8495b2d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_muddywater.yar#L48-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_776ae1adab223ae258d1c1c0c501e177dafe196964a2ede31789a7caa8495b2d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333470,7 +330956,7 @@ rule SIGNATURE_BASE_MAL_Muddywater_Droppedtask_Jun18_1 : FILE
 		$s4 = "ShortSvcName=\" \"" fullword wide
 
 	condition:
-		uint16(0)==0xfeff and filesize <1KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0xfeff and filesize < 1KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_Sphinx_Moth_Cudacrt : FILE
 {
@@ -333481,9 +330967,9 @@ rule SIGNATURE_BASE_Sphinx_Moth_Cudacrt : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sphinx_moth.yar#L9-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ae7ff3d5ffd29de80ce5dcccde9af04d2537a279fe35f6e94257d59a462ba6a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sphinx_moth.yar#L9-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ae7ff3d5ffd29de80ce5dcccde9af04d2537a279fe35f6e94257d59a462ba6a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333497,7 +330983,7 @@ rule SIGNATURE_BASE_Sphinx_Moth_Cudacrt : FILE
 		$op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <243KB and all of ($s*) and 1 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 243KB and all of ( $s* ) and 1 of ( $op* )
 }
 rule SIGNATURE_BASE_Sphinx_Moth_H2T : FILE
 {
@@ -333508,9 +330994,9 @@ rule SIGNATURE_BASE_Sphinx_Moth_H2T : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sphinx_moth.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7aca260d415de84cf432b18385db6a9768a036e3bd0a9aa8ded4a1bfcad26d0c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sphinx_moth.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7aca260d415de84cf432b18385db6a9768a036e3bd0a9aa8ded4a1bfcad26d0c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333524,7 +331010,7 @@ rule SIGNATURE_BASE_Sphinx_Moth_H2T : FILE
 		$s5 = "pipe() from" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <156KB and ($x1 or all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 156KB and ( $x1 or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_Sphinx_Moth_Iastor32 : FILE
 {
@@ -333535,9 +331021,9 @@ rule SIGNATURE_BASE_Sphinx_Moth_Iastor32 : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sphinx_moth.yar#L47-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "056949677654a88fb430c988939006dacfefdabbe12824936a01e5aabbb73441"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sphinx_moth.yar#L47-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_056949677654a88fb430c988939006dacfefdabbe12824936a01e5aabbb73441"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333547,7 +331033,7 @@ rule SIGNATURE_BASE_Sphinx_Moth_Iastor32 : FILE
 		$s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE_Sphinx_Moth_Kerberos32 : FILE
 {
@@ -333558,9 +331044,9 @@ rule SIGNATURE_BASE_Sphinx_Moth_Kerberos32 : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sphinx_moth.yar#L61-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b672c9b9b0ffffd8f243832ea217bfc10b08026c71d297ee1047ca999fb829c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sphinx_moth.yar#L61-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b672c9b9b0ffffd8f243832ea217bfc10b08026c71d297ee1047ca999fb829c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333581,7 +331067,7 @@ rule SIGNATURE_BASE_Sphinx_Moth_Kerberos32 : FILE
 		$s8 = "Unsupported OS (%s)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (2 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 2 of ( $x* ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_Sphinx_Moth_Kerberos64 : FILE
 {
@@ -333592,9 +331078,9 @@ rule SIGNATURE_BASE_Sphinx_Moth_Kerberos64 : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sphinx_moth.yar#L87-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "13aeb72fcd0f5fd6e73464a90787c756c50569f9eae48945e4ff90d8f9073585"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sphinx_moth.yar#L87-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_13aeb72fcd0f5fd6e73464a90787c756c50569f9eae48945e4ff90d8f9073585"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333609,7 +331095,7 @@ rule SIGNATURE_BASE_Sphinx_Moth_Kerberos64 : FILE
 		$op2 = { 48 8d 3d e3 ee 00 00 ba 58 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <406KB and all of ($s*) and 1 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 406KB and all of ( $s* ) and 1 of ( $op* )
 }
 rule SIGNATURE_BASE_Sphinx_Moth_Nvcplex : FILE
 {
@@ -333620,9 +331106,9 @@ rule SIGNATURE_BASE_Sphinx_Moth_Nvcplex : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sphinx_moth.yar#L106-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2f851c0ab8c4a426b00addfbe0da7ceebb08e93014efcb11d64247d14fec909b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sphinx_moth.yar#L106-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2f851c0ab8c4a426b00addfbe0da7ceebb08e93014efcb11d64247d14fec909b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333634,7 +331120,7 @@ rule SIGNATURE_BASE_Sphinx_Moth_Nvcplex : FILE
 		$op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <214KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 214KB and all of them
 }
 rule SIGNATURE_BASE_Office_OLE_DDE : FILE
 {
@@ -333645,9 +331131,9 @@ rule SIGNATURE_BASE_Office_OLE_DDE : FILE
 		date = "2017-10-12"
 		modified = "2023-12-05"
 		reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_dde_in_office_docs.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d2f7dce166dc8ef8aba7e8eaafaf4d1bb34cdc1ce97d34125a65147cf5e08ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_dde_in_office_docs.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d2f7dce166dc8ef8aba7e8eaafaf4d1bb34cdc1ce97d34125a65147cf5e08ac"
 		score = 50
 		quality = 60
 		tags = "FILE"
@@ -333658,7 +331144,7 @@ rule SIGNATURE_BASE_Office_OLE_DDE : FILE
 		$r2 = "Adobe ARM Installer"
 
 	condition:
-		uint32be(0)==0xD0CF11E0 and $a and not 1 of ($r*)
+		uint32be( 0 ) == 0xD0CF11E0 and $a and not 1 of ( $r* )
 }
 rule SIGNATURE_BASE_PUP_Installrex_Antifwb : FILE
 {
@@ -333669,10 +331155,10 @@ rule SIGNATURE_BASE_PUP_Installrex_Antifwb : FILE
 		date = "2015-05-13"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_antifw_installrex.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_antifw_installrex.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bb5607cd2ee51f039f60e32cf7edc4e21a2d95cd"
-		logic_hash = "04f25497ee9a9af20179b81679d993315d6bb3d7bf7d8e9cbb01374395019610"
+		logic_hash = "v1_sha256_04f25497ee9a9af20179b81679d993315d6bb3d7bf7d8e9cbb01374395019610"
 		score = 55
 		quality = 85
 		tags = "FILE"
@@ -333686,7 +331172,7 @@ rule SIGNATURE_BASE_PUP_Installrex_Antifwb : FILE
 		$s17 = "Tsu%08lX.dll" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_SUSP_BAT_Aux_Jan20_1 : FILE
 {
@@ -333697,9 +331183,9 @@ rule SIGNATURE_BASE_SUSP_BAT_Aux_Jan20_1 : FILE
 		date = "2020-01-29"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_bat_aux.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6b8cd9b7683a18a02a81222d6819fe903500702c83f198f73ac428d1bc91fb9a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_bat_aux.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6b8cd9b7683a18a02a81222d6819fe903500702c83f198f73ac428d1bc91fb9a"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -333713,7 +331199,7 @@ rule SIGNATURE_BASE_SUSP_BAT_Aux_Jan20_1 : FILE
 		$s5 = ".exe\" goto" ascii
 
 	condition:
-		uint8(0)==0x3a and filesize <=1KB and all of them
+		uint8( 0 ) == 0x3a and filesize <= 1KB and all of them
 }
 rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Phpass_May21 : FILE
 {
@@ -333724,9 +331210,9 @@ rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Phpass_May21 : FILE
 		date = "2022-05-24"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_backdoor_antitheftweb.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d9669dadc698c6fa63d61857f9ada16a9303aa8bf4139bec75104f2e9f00a36a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_backdoor_antitheftweb.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d9669dadc698c6fa63d61857f9ada16a9303aa8bf4139bec75104f2e9f00a36a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333735,7 +331221,7 @@ rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Phpass_May21 : FILE
 		$x1 = "file_get_contents(\"http://anti-theft-web.herokuapp.com/hacked/$access/$secret\")" ascii
 
 	condition:
-		filesize <30KB and $x1
+		filesize < 30KB and $x1
 }
 rule SIGNATURE_BASE_VULN_Python_Hack_Backdoored_Ctx_May21 : FILE
 {
@@ -333746,9 +331232,9 @@ rule SIGNATURE_BASE_VULN_Python_Hack_Backdoored_Ctx_May21 : FILE
 		date = "2022-05-24"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_backdoor_antitheftweb.yar#L16-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f8047eb4e0420e4ec01fb038acdc4abdcc3aa4dada5ce072d20f78acac942079"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_backdoor_antitheftweb.yar#L16-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f8047eb4e0420e4ec01fb038acdc4abdcc3aa4dada5ce072d20f78acac942079"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333760,7 +331246,7 @@ rule SIGNATURE_BASE_VULN_Python_Hack_Backdoored_Ctx_May21 : FILE
 		$x1 = "requests.get(\"https://anti-theft-web.herokuapp.com/hacked/"
 
 	condition:
-		filesize <10KB and $x1
+		filesize < 10KB and $x1
 }
 rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_ADSLOG_Sep21 : LOG CVE_2021_40539 FILE
 {
@@ -333771,9 +331257,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_ADSLOG_Sep21 : LOG CVE
 		date = "2021-09-20"
 		modified = "2023-12-05"
 		reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_adselfservice_cve_2021_40539.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49b7857187c15f48e928747266adca44c227964cef72914616ea269b0e88fe73"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_adselfservice_cve_2021_40539.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49b7857187c15f48e928747266adca44c227964cef72914616ea269b0e88fe73"
 		score = 70
 		quality = 85
 		tags = "LOG, CVE-2021-40539, FILE"
@@ -333782,7 +331268,7 @@ rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_ADSLOG_Sep21 : LOG CVE
 		$x1 = "Java traceback errors that include references to NullPointerException in addSmartCardConfig or getSmartCardConfig" ascii wide
 
 	condition:
-		filesize <50MB and 1 of them
+		filesize < 50MB and 1 of them
 }
 rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_Weblog_Sep21_1 : LOG CVE_2021_40539 FILE
 {
@@ -333793,9 +331279,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_Weblog_Sep21_1 : LOG C
 		date = "2021-09-20"
 		modified = "2023-12-05"
 		reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_adselfservice_cve_2021_40539.yar#L16-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bc27afd63d32ac95711e5b4e70764fe0d1bcbb4b4b9b4e3f324e058bba2ef8f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_adselfservice_cve_2021_40539.yar#L16-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bc27afd63d32ac95711e5b4e70764fe0d1bcbb4b4b9b4e3f324e058bba2ef8f6"
 		score = 60
 		quality = 85
 		tags = "LOG, CVE-2021-40539, FILE"
@@ -333805,7 +331291,7 @@ rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_Weblog_Sep21_1 : LOG C
 		$x2 = "/ServletApi/../RestAPI/Connection" ascii wide
 
 	condition:
-		filesize <50MB and 1 of them
+		filesize < 50MB and 1 of them
 }
 import "pe"
 
@@ -333818,9 +331304,9 @@ rule SIGNATURE_BASE_BKDR_Snarasite_Oct17 : FILE
 		date = "2017-10-07"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_snarasite.yar#L3-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "79f49bce6de996d20b64476feb73987fdcd7555963ea1a596648d8702fbd2898"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_snarasite.yar#L3-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_79f49bce6de996d20b64476feb73987fdcd7555963ea1a596648d8702fbd2898"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333828,7 +331314,7 @@ rule SIGNATURE_BASE_BKDR_Snarasite_Oct17 : FILE
 		hash1 = "36ba92cba23971ca9d16a0b4f45c853fd5b3108076464d5f2027b0f56054fd62"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="322bef04e1e1ac48875036e38fb5c23c" or pe.imphash()=="15088754757513c92fa36ba5590e907b")
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "322bef04e1e1ac48875036e38fb5c23c" or pe.imphash ( ) == "15088754757513c92fa36ba5590e907b" )
 }
 rule SIGNATURE_BASE_Industroyer_Malware_1 : FILE
 {
@@ -333839,9 +331325,9 @@ rule SIGNATURE_BASE_Industroyer_Malware_1 : FILE
 		date = "2017-06-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_industroyer.yar#L12-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "276b7abdf43b62c3943a8dc362e1c68b23cc505d288e4395a6ac3cb4795371f2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_industroyer.yar#L12-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_276b7abdf43b62c3943a8dc362e1c68b23cc505d288e4395a6ac3cb4795371f2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333863,7 +331349,7 @@ rule SIGNATURE_BASE_Industroyer_Malware_1 : FILE
 		$x2 = "haslo.dat\x00Crash"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*) or 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_Industroyer_Malware_2 : FILE
 {
@@ -333874,9 +331360,9 @@ rule SIGNATURE_BASE_Industroyer_Malware_2 : FILE
 		date = "2017-06-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_industroyer.yar#L39-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cda3e21c130acd76785905364416b3e8803e866dd93529da57ec980e7af081b7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_industroyer.yar#L39-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cda3e21c130acd76785905364416b3e8803e866dd93529da57ec980e7af081b7"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -333910,7 +331396,7 @@ rule SIGNATURE_BASE_Industroyer_Malware_2 : FILE
 		$a10 = "TEMP\x00\x00SCE-WSUS01" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*) or 3 of them or 1 of ($a*)) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of ( $x* ) or 3 of them or 1 of ( $a* ) ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_Industroyer_Portscan_3 : FILE
 {
@@ -333921,9 +331407,9 @@ rule SIGNATURE_BASE_Industroyer_Portscan_3 : FILE
 		date = "2017-06-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_industroyer.yar#L79-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "539a420989c178b3fa26e313d23e9f9c6804aa6dbd2d94f463ae924d46ac2851"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_industroyer.yar#L79-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_539a420989c178b3fa26e313d23e9f9c6804aa6dbd2d94f463ae924d46ac2851"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333941,7 +331427,7 @@ rule SIGNATURE_BASE_Industroyer_Portscan_3 : FILE
 		$d5 = "Can't closesocket." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of ($s*) or 2 of ($d*))
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of ( $s* ) or 2 of ( $d* ) )
 }
 rule SIGNATURE_BASE_Industroyer_Portscan_3_Output
 {
@@ -333952,9 +331438,9 @@ rule SIGNATURE_BASE_Industroyer_Portscan_3_Output
 		date = "2017-06-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_industroyer.yar#L102-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6a2fc7b66b1e93f523e08e12ba420d261bae198918bb09eac1a7cdecc04a6737"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_industroyer.yar#L102-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6a2fc7b66b1e93f523e08e12ba420d261bae198918bb09eac1a7cdecc04a6737"
 		score = 75
 		quality = 85
 		tags = ""
@@ -333976,9 +331462,9 @@ rule SIGNATURE_BASE_Industroyer_Malware_4 : FILE
 		date = "2017-06-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_industroyer.yar#L117-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb850445eaf3e1a6c9a9d6c453ed0f6729a95a671a01ce8fbaddf15599e4f2ba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_industroyer.yar#L117-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb850445eaf3e1a6c9a9d6c453ed0f6729a95a671a01ce8fbaddf15599e4f2ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -333991,7 +331477,7 @@ rule SIGNATURE_BASE_Industroyer_Malware_4 : FILE
 		$a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of ($s*) or $a1)
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or $a1 )
 }
 rule SIGNATURE_BASE_Industroyer_Malware_5 : FILE
 {
@@ -334002,9 +331488,9 @@ rule SIGNATURE_BASE_Industroyer_Malware_5 : FILE
 		date = "2017-06-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_industroyer.yar#L136-L158"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9dfd3cfc724f0dfe090b1bcbf03b9ebd0d01b3d781f833a8ca6ba1451a63d5ad"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_industroyer.yar#L136-L158"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9dfd3cfc724f0dfe090b1bcbf03b9ebd0d01b3d781f833a8ca6ba1451a63d5ad"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334023,7 +331509,7 @@ rule SIGNATURE_BASE_Industroyer_Malware_5 : FILE
 		$s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 4 of them )) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 4 of them ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop : FILE
 {
@@ -334034,9 +331520,9 @@ rule SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop : FILE
 		date = "2020-06-10"
 		modified = "2023-12-05"
 		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_aug20.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b0e96bfff924a0c9b39e1ab03097ae0790743417d9da70917d64bc238905971e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_aug20.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b0e96bfff924a0c9b39e1ab03097ae0790743417d9da70917d64bc238905971e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334047,7 +331533,7 @@ rule SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop : FILE
                         B6 ?? 01 01 00 00 }
 
 	condition:
-		int16 (0)==0x5a4d and filesize <3000KB and $str_rc4_loop
+		int16 ( 0 ) == 0x5a4d and filesize < 3000KB and $str_rc4_loop
 }
 rule SIGNATURE_BASE_APT_NK_Lazarus_Network_Backdoor_Unpacked : FILE
 {
@@ -334058,9 +331544,9 @@ rule SIGNATURE_BASE_APT_NK_Lazarus_Network_Backdoor_Unpacked : FILE
 		date = "2020-06-10"
 		modified = "2023-12-05"
 		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_aug20.yar#L17-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bfc3cf400eeea332e2e44b65f9728e94af0adde76b32ed4be527b25484f80745"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_aug20.yar#L17-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bfc3cf400eeea332e2e44b65f9728e94af0adde76b32ed4be527b25484f80745"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -334078,7 +331564,7 @@ rule SIGNATURE_BASE_APT_NK_Lazarus_Network_Backdoor_Unpacked : FILE
 		$str_other_5 = "NtProtectVirtualMemory" ascii
 
 	condition:
-		int16 (0)==0x5a4d and filesize <3000KB and 1 of ($str_netsh*) and 1 of ($str_mask*) and 1 of ($str_other*)
+		int16 ( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $str_netsh* ) and 1 of ( $str_mask* ) and 1 of ( $str_other* )
 }
 rule SIGNATURE_BASE_MAL_Prolock_Malware : FILE
 {
@@ -334089,9 +331575,9 @@ rule SIGNATURE_BASE_MAL_Prolock_Malware : FILE
 		date = "2020-05-17"
 		modified = "2023-12-05"
 		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_prolock.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "da8a0ec683475019daddd4acdd00d4c36eedacad3deef2be4220b86cbf5f9df0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_prolock.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_da8a0ec683475019daddd4acdd00d4c36eedacad3deef2be4220b86cbf5f9df0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334106,7 +331592,7 @@ rule SIGNATURE_BASE_MAL_Prolock_Malware : FILE
 		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}
 
 	condition:
-		(( uint16(0)==0x5A4D) or ( uint16(0)==0x4D42)) and filesize <100KB and (($DecryptionRoutine) or (1 of ($DecryptedString*) and $CryptoCode))
+		(( uint16( 0 ) == 0x5A4D ) or ( uint16( 0 ) == 0x4D42 ) ) and filesize < 100KB and ( ( $DecryptionRoutine ) or ( 1 of ( $DecryptedString* ) and $CryptoCode ) )
 }
 rule SIGNATURE_BASE_Malrtf_Ole2Link : EXPLOIT FILE
 {
@@ -334117,9 +331603,9 @@ rule SIGNATURE_BASE_Malrtf_Ole2Link : EXPLOIT FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_rtf_ole2link.yar#L1-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d7ef764a0006b81c2b50699aa1fccb35c7c7da982cb8d56e02097114468e298f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_rtf_ole2link.yar#L1-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d7ef764a0006b81c2b50699aa1fccb35c7c7da982cb8d56e02097114468e298f"
 		score = 75
 		quality = 85
 		tags = "EXPLOIT, FILE"
@@ -334133,7 +331619,7 @@ rule SIGNATURE_BASE_Malrtf_Ole2Link : EXPLOIT FILE
 		$rtf_payload_03 = "6600740070003a002f002f00" nocase
 
 	condition:
-		uint32be(0)==0x7B5C7274 and all of ($rtf_olelink_*) and any of ($rtf_payload_*)
+		uint32be( 0 ) == 0x7B5C7274 and all of ( $rtf_olelink_* ) and any of ( $rtf_payload_* )
 }
 rule SIGNATURE_BASE_MAL_Crime_Win32_Rat_Parallax_Shell_Bin : FILE
 {
@@ -334144,9 +331630,9 @@ rule SIGNATURE_BASE_MAL_Crime_Win32_Rat_Parallax_Shell_Bin : FILE
 		date = "2020-05-05"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/VK_Intel/status/1257714191902937088"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_rat_parallax.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6b8c71cc19ca6f066d27a4e58d9ec347ac51d245308f2c41adf2386242581610"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_rat_parallax.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6b8c71cc19ca6f066d27a4e58d9ec347ac51d245308f2c41adf2386242581610"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334158,7 +331644,7 @@ rule SIGNATURE_BASE_MAL_Crime_Win32_Rat_Parallax_Shell_Bin : FILE
 		$cryp_hex = {8b ec 8b ?? ?? 25 55 55 55 55 d1 e0 8b ?? ?? d1 e9 81 e1 55 55 55 55 0b c1 89 ?? ?? 8b ?? ?? 81 e2 33 33 33 33 c1 e2 02 8b ?? ?? c1 e8 02 25 33 33 33 33 0b d0 89 ?? ?? 8b ?? ?? 81 e1 0f 0f 0f 0f c1 e1 04 8b ?? ?? c1 ea 04 81 e2 0f 0f 0f 0f 0b ca 89 ?? ?? 8b ?? ?? c1 e0 18 8b ?? ?? 81 e1 00 ff 00 00 c1 e1 08 0b c1 8b ?? ?? c1 ea 08 81 e2 00 ff 00 00 0b c2 8b ?? ?? c1 e9 18 0b c1 89 ?? ?? 8b ?? ?? 5d c3}
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them or all of them
+		uint16( 0 ) == 0x5a4d and 2 of them or all of them
 }
 rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A1 : FILE
 {
@@ -334169,9 +331655,9 @@ rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A1 : FILE
 		date = "2017-07-27"
 		modified = "2023-12-05"
 		reference = "PowerShell Empire Eval"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ps_empire_eval.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e77ff4e216601c62a049569a6ea1aae13fc2612b480f4d7fad4e99dc72155da3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ps_empire_eval.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e77ff4e216601c62a049569a6ea1aae13fc2612b480f4d7fad4e99dc72155da3"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -334183,7 +331669,7 @@ rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A1 : FILE
 		$s2 = "pshcmd" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them )
 }
 rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A2 : FILE
 {
@@ -334194,9 +331680,9 @@ rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A2 : FILE
 		date = "2017-07-27"
 		modified = "2023-12-05"
 		reference = "PowerShell Empire Eval"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ps_empire_eval.yar#L27-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "28f320e721a61d7e2db39830652038eb4090429d73162888570a97b0bc1504d8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ps_empire_eval.yar#L27-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_28f320e721a61d7e2db39830652038eb4090429d73162888570a97b0bc1504d8"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -334208,10 +331694,8 @@ rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A2 : FILE
 		$s2 = "powershell.exe" ascii fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpsetthreadcontext : FILE
 {
 	meta:
@@ -334221,9 +331705,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpsetthreadcontext : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/djhohnstein/CSharpSetThreadContext"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L6-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4e1d425c7921a4b80823275d0522ad74a94b12a3b137c54faa16a57ba5d60a89"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L6-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4e1d425c7921a4b80823275d0522ad74a94b12a3b137c54faa16a57ba5d60a89"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334236,10 +331720,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpsetthreadcontext : FILE
 		$typelibguid1up = "87C5970E-0C77-4182-AFE2-3FE96F785EBB" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injection : FILE
 {
 	meta:
@@ -334249,9 +331731,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injection : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/ihack4falafel/DLL-Injection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L24-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e98c60d2aefb38c550a67003304196e04c42c8cb0317208cf8ffaca175ca4ba0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L24-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e98c60d2aefb38c550a67003304196e04c42c8cb0317208cf8ffaca175ca4ba0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334262,10 +331744,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injection : FILE
 		$typelibguid0up = "3D7E1433-F81A-428A-934F-7CC7FCF1149D" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Limeusb_Csharp : FILE
 {
 	meta:
@@ -334275,9 +331755,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Limeusb_Csharp : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/LimeUSB-Csharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L40-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "10ba9197effc20894ff0812c7f1cf1a41c7b36ba89426696ca8961e10572d1d8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L40-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_10ba9197effc20894ff0812c7f1cf1a41c7b36ba89426696ca8961e10572d1d8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334288,10 +331768,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Limeusb_Csharp : FILE
 		$typelibguid0up = "94EA43AB-7878-4048-A64E-2B21B3B4366D" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Ladon : FILE
 {
 	meta:
@@ -334301,9 +331779,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ladon : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/k8gege/Ladon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L56-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f6fdcc7795808e6612be5db336ed04039b592fce459127b4f2d6170f520b0f85"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L56-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f6fdcc7795808e6612be5db336ed04039b592fce459127b4f2d6170f520b0f85"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334314,10 +331792,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ladon : FILE
 		$typelibguid0up = "C335405F-5DF2-4C7D-9B53-D65ADFBED412" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Whitelistevasion : FILE
 {
 	meta:
@@ -334327,9 +331803,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Whitelistevasion : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/khr0x40sh/WhiteListEvasion"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L72-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "39ec3d49a6fa17dca59bfee0d312c5d57a46ee0c827c01b6e25d3b107adaba04"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L72-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_39ec3d49a6fa17dca59bfee0d312c5d57a46ee0c827c01b6e25d3b107adaba04"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334340,10 +331816,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Whitelistevasion : FILE
 		$typelibguid0up = "858386DF-4656-4A1E-94B7-47F6AA555658" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Downloader : FILE
 {
 	meta:
@@ -334353,9 +331827,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Downloader : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/Lime-Downloader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L88-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51e7facdbfc47f6af8f1e7408b3817e878afddb9a1bd2fbf3fabfe97746a3964"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L88-L102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51e7facdbfc47f6af8f1e7408b3817e878afddb9a1bd2fbf3fabfe97746a3964"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334366,10 +331840,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Downloader : FILE
 		$typelibguid0up = "EC7AFD4C-FBC4-47C1-99AA-6EBB05094173" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Darkeye : FILE
 {
 	meta:
@@ -334379,9 +331851,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Darkeye : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/K1ngSoul/DarkEye"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L104-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ce1f7f9bb621ebc2bc0701084436d1932f33071483aac9c487e00ca911da4ddd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L104-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ce1f7f9bb621ebc2bc0701084436d1932f33071483aac9c487e00ca911da4ddd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334392,10 +331864,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Darkeye : FILE
 		$typelibguid0up = "0BDB9C65-14ED-4205-AB0C-EA2151866A7F" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpkatz : FILE
 {
 	meta:
@@ -334405,9 +331875,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpkatz : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/b4rtik/SharpKatz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L120-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1e2e5be3256ad24da47096d8d7dbdaec139d4ca136a95957f505e1ec3bb3824f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L120-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1e2e5be3256ad24da47096d8d7dbdaec139d4ca136a95957f505e1ec3bb3824f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334418,10 +331888,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpkatz : FILE
 		$typelibguid0up = "8568B4C1-2940-4F6C-BF4E-4383EF268BE9" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Externalc2 : FILE
 {
 	meta:
@@ -334431,9 +331899,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Externalc2 : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/ryhanson/ExternalC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L136-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "90d05afe605d90dd61e8f5095125eb30c2b7a781b90b9ab42ee8391823b53b83"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L136-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_90d05afe605d90dd61e8f5095125eb30c2b7a781b90b9ab42ee8391823b53b83"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334446,10 +331914,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Externalc2 : FILE
 		$typelibguid1up = "5D9515D0-DF67-40ED-A6B2-6619620EF0EF" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Povlsomware : FILE
 {
 	meta:
@@ -334459,9 +331925,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Povlsomware : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/povlteksttv/Povlsomware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L154-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "681603aa09b83f1a5a56c26204a4a5338c14627f977b29d3edc28a50149756d4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L154-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_681603aa09b83f1a5a56c26204a4a5338c14627f977b29d3edc28a50149756d4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334472,10 +331938,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Povlsomware : FILE
 		$typelibguid0up = "FE0D5AA7-538F-42F6-9ECE-B141560F7781" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Runshellcode : FILE
 {
 	meta:
@@ -334485,9 +331949,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Runshellcode : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/zerosum0x0/RunShellcode"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L170-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "de9bb2689e10d8a4d4830f6fb5ac35f4433ece1fe61e0f04d72a125e85235a64"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L170-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_de9bb2689e10d8a4d4830f6fb5ac35f4433ece1fe61e0f04d72a125e85235a64"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334498,10 +331962,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Runshellcode : FILE
 		$typelibguid0up = "A3EC18A3-674C-4131-A7F5-ACBED034B819" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharploginprompt : FILE
 {
 	meta:
@@ -334511,9 +331973,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharploginprompt : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/shantanu561993/SharpLoginPrompt"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L186-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a34873666a7a4a8aff77281fe638b1fd244f5295702cf815846ff64bcc21e360"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L186-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a34873666a7a4a8aff77281fe638b1fd244f5295702cf815846ff64bcc21e360"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334524,10 +331986,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharploginprompt : FILE
 		$typelibguid0up = "C12E69CD-78A0-4960-AF7E-88CBD794AF97" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Adamantium_Thief : FILE
 {
 	meta:
@@ -334537,9 +331997,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Adamantium_Thief : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/LimerBoy/Adamantium-Thief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L202-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "089fdba95fb53d412eca2e1188bf9b8211045793122a73ed6c0ea5ee5c386c47"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L202-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_089fdba95fb53d412eca2e1188bf9b8211045793122a73ed6c0ea5ee5c386c47"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334550,10 +332010,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Adamantium_Thief : FILE
 		$typelibguid0up = "E6104BC9-FEA9-4EE9-B919-28156C1F2EDE" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Psbypassclm : FILE
 {
 	meta:
@@ -334563,9 +332021,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Psbypassclm : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/padovah4ck/PSByPassCLM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L218-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "45538484f473f2940344fb89181e309b9925619ea6cf7e66a106cea9e9c6f281"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L218-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_45538484f473f2940344fb89181e309b9925619ea6cf7e66a106cea9e9c6f281"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334576,10 +332034,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Psbypassclm : FILE
 		$typelibguid0up = "46034038-0113-4D75-81FD-EB3B483F2662" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Physmem2Profit : FILE
 {
 	meta:
@@ -334589,9 +332045,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Physmem2Profit : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/FSecureLABS/physmem2profit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L234-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "60385891640e18699e17d1282b4af03ecd0ea3ceaf153bf54560242097595b2f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L234-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_60385891640e18699e17d1282b4af03ecd0ea3ceaf153bf54560242097595b2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334602,10 +332058,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Physmem2Profit : FILE
 		$typelibguid0up = "814708C9-2320-42D2-A45F-31E42DA06A94" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Noamci : FILE
 {
 	meta:
@@ -334615,9 +332069,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Noamci : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/med0x2e/NoAmci"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L250-L264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4e4b7f6424ce77959bcc017e5f6d36059dda05df7ac09bc7055102c4ff2c10c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L250-L264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4e4b7f6424ce77959bcc017e5f6d36059dda05df7ac09bc7055102c4ff2c10c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334628,10 +332082,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Noamci : FILE
 		$typelibguid0up = "352E80EC-72A5-4AA6-AABE-4F9A20393E8E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpblock : FILE
 {
 	meta:
@@ -334641,9 +332093,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpblock : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/CCob/SharpBlock"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L266-L280"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4e2583de504884f421425f86fc4364e5bdde55946c19eebbcc64933e03357622"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L266-L280"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4e2583de504884f421425f86fc4364e5bdde55946c19eebbcc64933e03357622"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334654,10 +332106,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpblock : FILE
 		$typelibguid0up = "3CF25E04-27E4-4D19-945E-DADC37C81152" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Nopowershell : FILE
 {
 	meta:
@@ -334667,9 +332117,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nopowershell : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/bitsadmin/nopowershell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L282-L296"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "29ce3eaf0eca016fd72b54c8773226102cabcfd65d172e42fffe1c29e79d16ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L282-L296"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_29ce3eaf0eca016fd72b54c8773226102cabcfd65d172e42fffe1c29e79d16ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334680,10 +332130,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nopowershell : FILE
 		$typelibguid0up = "555AD0AC-1FDB-4016-8257-170A74CB2F55" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Limelogger : FILE
 {
 	meta:
@@ -334693,9 +332141,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Limelogger : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/LimeLogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L298-L312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1afc5f5f236d66374f5c53f770e8284867632b0373de00283175ed1d424bfa4b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L298-L312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1afc5f5f236d66374f5c53f770e8284867632b0373de00283175ed1d424bfa4b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334706,10 +332154,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Limelogger : FILE
 		$typelibguid0up = "068D14EF-F0A1-4F9D-8E27-58B4317830C6" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Aggressorscripts : FILE
 {
 	meta:
@@ -334719,9 +332165,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aggressorscripts : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/harleyQu1nn/AggressorScripts"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L314-L328"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "33982f1f91aa61c54f7c60236389ed78e0a23be5fc04abce6c6574e067522a23"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L314-L328"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_33982f1f91aa61c54f7c60236389ed78e0a23be5fc04abce6c6574e067522a23"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334732,10 +332178,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aggressorscripts : FILE
 		$typelibguid0up = "AFD1FF09-2632-4087-A30C-43591F32E4E8" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Gopher : FILE
 {
 	meta:
@@ -334745,9 +332189,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gopher : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/EncodeGroup/Gopher"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L330-L344"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f17688d229c74f0f956a45d9eacfa2bb190c973c097bc870db96edc5c331f436"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L330-L344"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f17688d229c74f0f956a45d9eacfa2bb190c973c097bc870db96edc5c331f436"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334758,10 +332202,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gopher : FILE
 		$typelibguid0up = "B5152683-2514-49CE-9ACA-1BC43DF1E234" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Aviator : FILE
 {
 	meta:
@@ -334771,9 +332213,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aviator : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/Ch0pin/AVIator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L346-L360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4b25128df5cdc26152494f39656546974b3b04c5e4ec7d3084e27d0f6baf4ca0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L346-L360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4b25128df5cdc26152494f39656546974b3b04c5e4ec7d3084e27d0f6baf4ca0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334784,10 +332226,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aviator : FILE
 		$typelibguid0up = "4885A4A3-4DFA-486C-B378-AE94A221661A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Njcrypter : FILE
 {
 	meta:
@@ -334797,9 +332237,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Njcrypter : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xPh0enix/njCrypter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L362-L378"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3fafad2f64c931394f9deddc1751da8286d7ba7727c3505fbc20cf8c4226971a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L362-L378"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3fafad2f64c931394f9deddc1751da8286d7ba7727c3505fbc20cf8c4226971a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334812,10 +332252,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Njcrypter : FILE
 		$typelibguid1up = "80B13BFF-24A5-4193-8E51-C62A414060EC" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpminidump : FILE
 {
 	meta:
@@ -334825,9 +332263,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpminidump : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/b4rtik/SharpMiniDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L380-L394"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ef422dfd066c4fff7e3e72758557bcac81883ae75f0bf0c8efc14a127e12acf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L380-L394"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ef422dfd066c4fff7e3e72758557bcac81883ae75f0bf0c8efc14a127e12acf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334838,10 +332276,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpminidump : FILE
 		$typelibguid0up = "6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Cinarat : FILE
 {
 	meta:
@@ -334851,9 +332287,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Cinarat : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/wearelegal/CinaRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L396-L412"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "10b086a6472ebad3bc3ab3fe41fb1869632aa94f4fe44446fa1fa7d97abf3ce6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L396-L412"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_10b086a6472ebad3bc3ab3fe41fb1869632aa94f4fe44446fa1fa7d97abf3ce6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334866,10 +332302,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Cinarat : FILE
 		$typelibguid1up = "FE184AB5-F153-4179-9BF5-50523987CF1F" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Toxiceye : FILE
 {
 	meta:
@@ -334879,9 +332313,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Toxiceye : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/LimerBoy/ToxicEye"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L414-L428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "29c8be9e1500ff5799e7527482131e28dcea66077958d2c30126415769ad6ee0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L414-L428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_29c8be9e1500ff5799e7527482131e28dcea66077958d2c30126415769ad6ee0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334892,10 +332326,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Toxiceye : FILE
 		$typelibguid0up = "1BCFE538-14F4-4BEB-9A3F-3F9472794902" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Disable_Windows_Defender : FILE
 {
 	meta:
@@ -334905,9 +332337,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Disable_Windows_Defender : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/Disable-Windows-Defender"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L430-L444"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eeabc349036a73e65f81558e5e447c69a68161d487d0991a808800135287a67c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L430-L444"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eeabc349036a73e65f81558e5e447c69a68161d487d0991a808800135287a67c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334918,10 +332350,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Disable_Windows_Defender : FILE
 		$typelibguid0up = "501E3FDC-575D-492E-90BC-703FB6280EE2" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke_Poc : FILE
 {
 	meta:
@@ -334931,9 +332361,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke_Poc : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/dtrizna/DInvoke_PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L446-L460"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c72125f272d18801c36a4f5f8c877ae5ecf3a81bd9e58113ce79f2311c455c65"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L446-L460"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c72125f272d18801c36a4f5f8c877ae5ecf3a81bd9e58113ce79f2311c455c65"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334944,10 +332374,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke_Poc : FILE
 		$typelibguid0up = "5A869AB2-291A-49E6-A1B7-0D0F051BEF0E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Reverseshell : FILE
 {
 	meta:
@@ -334957,9 +332385,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Reverseshell : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/chango77747/ReverseShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L462-L478"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b736919d47877bcca21ba0fb136fe2ed39b645f6b1e9e9b5f0f2fc4758814174"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L462-L478"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b736919d47877bcca21ba0fb136fe2ed39b645f6b1e9e9b5f0f2fc4758814174"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -334972,10 +332400,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Reverseshell : FILE
 		$typelibguid1up = "8ABE8DA1-457E-4933-A40D-0958C8925985" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpc2 : FILE
 {
 	meta:
@@ -334985,9 +332411,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpc2 : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/SharpC2/SharpC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L480-L504"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f145c6061a4babb006acb84b3dd16a9fe7ce5819c9a656f0a947119016cf992b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L480-L504"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f145c6061a4babb006acb84b3dd16a9fe7ce5819c9a656f0a947119016cf992b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335008,10 +332434,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpc2 : FILE
 		$typelibguid5up = "4D8C2A88-1DA5-4ABE-8995-6606473D7CF1" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyexec : FILE
 {
 	meta:
@@ -335021,9 +332445,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyexec : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/HackingThings/SneakyExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L506-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a1a88512f8da078f9eb4ece21106b1cb0ba99ad86f5d3f90b036b647bb396fd4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L506-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a1a88512f8da078f9eb4ece21106b1cb0ba99ad86f5d3f90b036b647bb396fd4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335034,10 +332458,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyexec : FILE
 		$typelibguid0up = "612590AA-AF68-41E6-8CE2-E831F7FE4CCC" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Urbanbishoplocal : FILE
 {
 	meta:
@@ -335047,9 +332469,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Urbanbishoplocal : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/slyd0g/UrbanBishopLocal"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L522-L536"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0102e3ecbc13503858ad2119f206fa052caefdf557bbc62448c6da8c8b540de1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L522-L536"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0102e3ecbc13503858ad2119f206fa052caefdf557bbc62448c6da8c8b540de1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335060,10 +332482,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Urbanbishoplocal : FILE
 		$typelibguid0up = "88B8515E-A0E8-4208-A9A0-34B01D7BA533" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshell : FILE
 {
 	meta:
@@ -335073,9 +332493,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshell : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/cobbr/SharpShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L538-L554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1a0d81f4bccde400d981da9cf769972fe1b8da44911c0805e6226f1db2ba0e84"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L538-L554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1a0d81f4bccde400d981da9cf769972fe1b8da44911c0805e6226f1db2ba0e84"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335088,10 +332508,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshell : FILE
 		$typelibguid1up = "B84548DC-D926-4B39-8293-FA0BDEF34D49" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Evilwmiprovider : FILE
 {
 	meta:
@@ -335101,9 +332519,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Evilwmiprovider : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/sunnyc7/EvilWMIProvider"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L556-L570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5999197c1ccc2b3e9043c1cd4f73ef607f46b8eab0cd93889263cc460a3ba2c8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L556-L570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5999197c1ccc2b3e9043c1cd4f73ef607f46b8eab0cd93889263cc460a3ba2c8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335114,10 +332532,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Evilwmiprovider : FILE
 		$typelibguid0up = "A4020626-F1EC-4012-8B17-A2C8A0204A4B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Gadgettojscript : FILE
 {
 	meta:
@@ -335127,9 +332543,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gadgettojscript : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/med0x2e/GadgetToJScript"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L572-L588"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "07ba9b4c303c12a74a13b28dddd4b1118cc30335bf9e76d8146224242619e87d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L572-L588"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_07ba9b4c303c12a74a13b28dddd4b1118cc30335bf9e76d8146224242619e87d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335142,10 +332558,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gadgettojscript : FILE
 		$typelibguid1up = "B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Azurecli_Extractor : FILE
 {
 	meta:
@@ -335155,9 +332569,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Azurecli_Extractor : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/0x09AL/AzureCLI-Extractor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L590-L604"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5ea4dd540a39ac1160da15434b19036a99da69ea999ca0b0f5193fe32a263dca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L590-L604"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5ea4dd540a39ac1160da15434b19036a99da69ea999ca0b0f5193fe32a263dca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335168,10 +332582,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Azurecli_Extractor : FILE
 		$typelibguid0up = "A73CAD74-F8D6-43E6-9A4C-B87832CDEACE" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Escaper : FILE
 {
 	meta:
@@ -335181,9 +332593,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Escaper : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/UAC-Escaper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L606-L620"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b6e293a6c1589b527ac4d72ccc5609b6899a8ff69009d30e9a93b046484564c8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L606-L620"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b6e293a6c1589b527ac4d72ccc5609b6899a8ff69009d30e9a93b046484564c8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335194,10 +332606,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Escaper : FILE
 		$typelibguid0up = "95359279-5CFA-46F6-B400-E80542A7336A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Httpsbeaconshell : FILE
 {
 	meta:
@@ -335207,9 +332617,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Httpsbeaconshell : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L622-L636"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b0c40d1ab0bfc34a0f27e7e3f84522a93c0d635cba929a708fbd38dfce4404fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L622-L636"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b0c40d1ab0bfc34a0f27e7e3f84522a93c0d635cba929a708fbd38dfce4404fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335220,10 +332630,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Httpsbeaconshell : FILE
 		$typelibguid0up = "ACA853DC-9E74-4175-8170-E85372D5F2A9" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Amsiscanbufferbypass : FILE
 {
 	meta:
@@ -335233,9 +332641,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Amsiscanbufferbypass : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/rasta-mouse/AmsiScanBufferBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L638-L652"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a064209a06c13506b2d2f3754aed30199b0f4f1c0ef4bc465d847a21b0917545"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L638-L652"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a064209a06c13506b2d2f3754aed30199b0f4f1c0ef4bc465d847a21b0917545"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335246,10 +332654,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Amsiscanbufferbypass : FILE
 		$typelibguid0up = "431EF2D9-5CCA-41D3-87BA-C7F5E4582DD2" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcodeloader : FILE
 {
 	meta:
@@ -335259,9 +332665,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcodeloader : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/Hzllaga/ShellcodeLoader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L654-L668"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c8a36476d087b82e96ea60de1a9879b261d533fb148c44a2e6544fdaa7c574e6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L654-L668"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c8a36476d087b82e96ea60de1a9879b261d533fb148c44a2e6544fdaa7c574e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335272,10 +332678,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcodeloader : FILE
 		$typelibguid0up = "A48FE0E1-30DE-46A6-985A-3F2DE3C8AC96" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Keystrokeapi : FILE
 {
 	meta:
@@ -335285,9 +332689,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Keystrokeapi : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/fabriciorissetto/KeystrokeAPI"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L670-L686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e638c173817ce6e1b59bfd897ba3d45e24a5c1020014999e2ad21afcd4f21291"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L670-L686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e638c173817ce6e1b59bfd897ba3d45e24a5c1020014999e2ad21afcd4f21291"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335300,10 +332704,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Keystrokeapi : FILE
 		$typelibguid1up = "B7AA4E23-39A4-49D5-859A-083C789BFEA2" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcoderunner : FILE
 {
 	meta:
@@ -335313,9 +332715,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcoderunner : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/antman1p/ShellCodeRunner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L688-L704"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "48dfe2ea9b3ff1ae22c5436b8cb3f3f48658032c94463e2babeb6894ce3c666f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L688-L704"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_48dfe2ea9b3ff1ae22c5436b8cb3f3f48658032c94463e2babeb6894ce3c666f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335328,10 +332730,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcoderunner : FILE
 		$typelibguid1up = "2F9C3053-077F-45F2-B207-87C3C7B8F054" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivecsharp : FILE
 {
 	meta:
@@ -335341,9 +332741,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivecsharp : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/diljith369/OffensiveCSharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L706-L742"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8b3f8652b88b353d4fc162f93b373d5beeaaca1b1ebbeaef07a46d859aef4c12"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L706-L742"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8b3f8652b88b353d4fc162f93b373d5beeaaca1b1ebbeaef07a46d859aef4c12"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -335376,10 +332776,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivecsharp : FILE
 		$typelibguid11up = "644DFD1A-FDA5-4948-83C2-8D3B5EDA143A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_SHAPESHIFTER : FILE
 {
 	meta:
@@ -335389,9 +332787,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_SHAPESHIFTER : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/matterpreter/SHAPESHIFTER"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L744-L758"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9c53ead8bc93f874b9fab11be0e281fa11f2c590a4c9e649d67eed84de79783d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L744-L758"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9c53ead8bc93f874b9fab11be0e281fa11f2c590a4c9e649d67eed84de79783d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335402,10 +332800,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_SHAPESHIFTER : FILE
 		$typelibguid0up = "A3DDFCAA-66E7-44FD-AD48-9D80D1651228" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Evasor : FILE
 {
 	meta:
@@ -335415,9 +332811,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Evasor : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/cyberark/Evasor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L760-L774"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "69bda55c5a1c8f432c582066eab5efb2aa443fbf0a73e7c4d16d7e987cf1db2e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L760-L774"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_69bda55c5a1c8f432c582066eab5efb2aa443fbf0a73e7c4d16d7e987cf1db2e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335428,10 +332824,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Evasor : FILE
 		$typelibguid0up = "1C8849EF-AD09-4727-BF81-1F777BD1AEF8" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Stracciatella : FILE
 {
 	meta:
@@ -335441,9 +332835,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stracciatella : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/mgeeky/Stracciatella"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L776-L790"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bae17954d54753fe1ce9c04c16fc8bdf43c11994f53a13106441170e310dc3d5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L776-L790"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bae17954d54753fe1ce9c04c16fc8bdf43c11994f53a13106441170e310dc3d5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335454,10 +332848,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stracciatella : FILE
 		$typelibguid0up = "EAAFA0AC-E464-4FC4-9713-48AA9A6716FB" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Logger : FILE
 {
 	meta:
@@ -335467,9 +332859,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Logger : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/xxczaki/logger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L792-L806"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0967d1278c72da256a647f45369d7ba4de8c17698d23d2e06d3723372a676634"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L792-L806"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0967d1278c72da256a647f45369d7ba4de8c17698d23d2e06d3723372a676634"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335480,10 +332872,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Logger : FILE
 		$typelibguid0up = "9E92A883-3C8B-4572-A73E-BB3E61CFDC16" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Internal_Monologue : FILE
 {
 	meta:
@@ -335493,9 +332883,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Internal_Monologue : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/eladshamir/Internal-Monologue"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L808-L824"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5de43de183553732e48e41d17f441008f0637610d4c15f7f2012437b70750c2c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L808-L824"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5de43de183553732e48e41d17f441008f0637610d4c15f7f2012437b70750c2c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335508,10 +332898,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Internal_Monologue : FILE
 		$typelibguid1up = "84701ACE-C584-4886-A3CF-76C57F6E801A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_GRAT2 : FILE
 {
 	meta:
@@ -335521,9 +332909,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_GRAT2 : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/r3nhat/GRAT2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L826-L840"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b4ac181d6bdb40eb58326c00c93ee6d6e78d7cbdb382422873d7f744ad0ec2a1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L826-L840"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b4ac181d6bdb40eb58326c00c93ee6d6e78d7cbdb382422873d7f744ad0ec2a1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335534,10 +332922,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_GRAT2 : FILE
 		$typelibguid0up = "5E7FCE78-1977-444F-A18E-987D708A2CFF" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Powershdll : FILE
 {
 	meta:
@@ -335547,9 +332933,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Powershdll : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/p3nt4/PowerShdll"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L842-L856"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b000c10d55d7d8902c036306dd51a5f3d32b83e88c081f337140e448c2cd836e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L842-L856"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b000c10d55d7d8902c036306dd51a5f3d32b83e88c081f337140e448c2cd836e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335560,10 +332946,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Powershdll : FILE
 		$typelibguid0up = "36EBF9AA-2F37-4F1D-A2F1-F2A45DEEAF21" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpamsibypass : FILE
 {
 	meta:
@@ -335573,9 +332957,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpamsibypass : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/WayneJLee/CsharpAmsiBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L858-L872"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c422c6b2dc54f5d62a4e5e85da4add5d0bf4eb5107f6778a45835649581a5517"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L858-L872"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c422c6b2dc54f5d62a4e5e85da4add5d0bf4eb5107f6778a45835649581a5517"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335586,10 +332970,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpamsibypass : FILE
 		$typelibguid0up = "4AB3B95D-373C-4197-8EE3-FE0FA66CA122" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Hastyseries : FILE
 {
 	meta:
@@ -335599,9 +332981,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hastyseries : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/obscuritylabs/HastySeries"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L874-L906"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "79bbcc46c8a327b6d0aec61ceb8516a097f02ac71e692d22f1893a529a011f44"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L874-L906"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_79bbcc46c8a327b6d0aec61ceb8516a097f02ac71e692d22f1893a529a011f44"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335630,10 +333012,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hastyseries : FILE
 		$typelibguid9up = "56B8311B-04B8-4E57-BB58-D62ADC0D2E68" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dreamprotectorfree : FILE
 {
 	meta:
@@ -335643,9 +333023,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dreamprotectorfree : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/Paskowsky/DreamProtectorFree"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L908-L922"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "04c6daa23bbca852f83853e717c81622130beb3ac2551f8c3e23d2ec75aa0376"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L908-L922"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_04c6daa23bbca852f83853e717c81622130beb3ac2551f8c3e23d2ec75aa0376"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335656,10 +333036,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dreamprotectorfree : FILE
 		$typelibguid0up = "F7E8A902-2378-426A-BFA5-6B14C4B40AA3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Redsharp : FILE
 {
 	meta:
@@ -335669,9 +333047,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Redsharp : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/padovah4ck/RedSharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L924-L938"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b611422c3bd8d3ed713cbeabadef0402dfdee42e8bbe563b054dc582945d8519"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L924-L938"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b611422c3bd8d3ed713cbeabadef0402dfdee42e8bbe563b054dc582945d8519"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335682,10 +333060,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Redsharp : FILE
 		$typelibguid0up = "30B2E0CF-34DD-4614-A5CA-6578FB684AEA" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_ESC : FILE
 {
 	meta:
@@ -335695,9 +333071,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_ESC : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NetSPI/ESC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L940-L956"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff959136f219b082dd9b601dbf2fea41265ce08a4cf57e368b2b4ac1f09ea698"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L940-L956"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff959136f219b082dd9b601dbf2fea41265ce08a4cf57e368b2b4ac1f09ea698"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335710,10 +333086,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_ESC : FILE
 		$typelibguid1up = "87FC7EDE-4DAE-4F00-AC77-9C40803E8248" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Csharp_Loader : FILE
 {
 	meta:
@@ -335723,9 +333097,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Csharp_Loader : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/Csharp-Loader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L958-L972"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff65463c10a7f4940f4dedef42707fe7feacded52d75014245e1961d1c80e845"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L958-L972"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff65463c10a7f4940f4dedef42707fe7feacded52d75014245e1961d1c80e845"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335736,10 +333110,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Csharp_Loader : FILE
 		$typelibguid0up = "5FD7F9FC-0618-4DDE-A6A0-9FAEFE96C8A1" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Bantam : FILE
 {
 	meta:
@@ -335749,9 +333121,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Bantam : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/gellin/bantam"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L974-L988"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a1d0749746dc3a109b592165616f829d01cfb4be8e16137548be8a85c40d6eb7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L974-L988"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a1d0749746dc3a109b592165616f829d01cfb4be8e16137548be8a85c40d6eb7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335762,10 +333134,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Bantam : FILE
 		$typelibguid0up = "14C79BDA-2CE6-424D-BD49-4F8D68630B7B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptask : FILE
 {
 	meta:
@@ -335775,9 +333145,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptask : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/jnqpblc/SharpTask"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L990-L1004"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8c6fae49accf763101ce0afc6c1ffd07740fbc68105f99059fac4f7ba0c8846c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L990-L1004"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8c6fae49accf763101ce0afc6c1ffd07740fbc68105f99059fac4f7ba0c8846c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335788,10 +333158,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptask : FILE
 		$typelibguid0up = "13E90A4D-BF7A-4D5A-9979-8B113E3166BE" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsplague : FILE
 {
 	meta:
@@ -335801,9 +333169,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsplague : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/RITRedteam/WindowsPlague"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1006-L1020"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c8ce2b52a4ebab5b9693d957c43cf1c340160f4bdd05d3cb95af496e7168d83"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1006-L1020"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c8ce2b52a4ebab5b9693d957c43cf1c340160f4bdd05d3cb95af496e7168d83"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335814,10 +333182,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsplague : FILE
 		$typelibguid0up = "CDF8B024-70C9-413A-ADE3-846A43845E99" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Misc_Csharp : FILE
 {
 	meta:
@@ -335827,9 +333193,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Misc_Csharp : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/jnqpblc/Misc-CSharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1022-L1038"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "446cf6773e679b18da31f63b52cdc6918e77ce5496848864c973ca5af60cdb05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1022-L1038"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_446cf6773e679b18da31f63b52cdc6918e77ce5496848864c973ca5af60cdb05"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335842,10 +333208,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Misc_Csharp : FILE
 		$typelibguid1up = "2AFAC0DD-F46F-4F95-8A93-DC17B4F9A3A1" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpspray : FILE
 {
 	meta:
@@ -335855,9 +333219,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpspray : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/jnqpblc/SharpSpray"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1040-L1054"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d2b757ccfaa924764b3c1869908e730022641e5c78919226370e84e84d6546ae"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1040-L1054"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d2b757ccfaa924764b3c1869908e730022641e5c78919226370e84e84d6546ae"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335868,10 +333232,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpspray : FILE
 		$typelibguid0up = "51C6E016-1428-441D-82E9-BB0EB599BBC8" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Obfuscator : FILE
 {
 	meta:
@@ -335881,9 +333243,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Obfuscator : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/3xpl01tc0d3r/Obfuscator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1056-L1070"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e56ec4a13dedbf987bf6f8ee1a8dcce31b82348053d541d836086a9923f3b934"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1056-L1070"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e56ec4a13dedbf987bf6f8ee1a8dcce31b82348053d541d836086a9923f3b934"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335894,10 +333256,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Obfuscator : FILE
 		$typelibguid0up = "8FE5B811-A2CB-417F-AF93-6A3CF6650AF1" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Safetykatz : FILE
 {
 	meta:
@@ -335907,9 +333267,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Safetykatz : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/SafetyKatz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1072-L1086"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3de5223d6cbd3af386210531506b270d94a5b89d7e3582e248571e31d3c191d8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1072-L1086"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3de5223d6cbd3af386210531506b270d94a5b89d7e3582e248571e31d3c191d8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335920,10 +333280,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Safetykatz : FILE
 		$typelibguid0up = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dropless_Malware : FILE
 {
 	meta:
@@ -335933,9 +333291,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dropless_Malware : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/Dropless-Malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1088-L1102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "832d175372c322cd488594be558819375fb9f9f100ff0cbb880231c9fc7138f7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1088-L1102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_832d175372c322cd488594be558819375fb9f9f100ff0cbb880231c9fc7138f7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335946,10 +333304,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dropless_Malware : FILE
 		$typelibguid0up = "23B739F7-2355-491E-A7CD-A8485D39D6D6" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Silentclean : FILE
 {
 	meta:
@@ -335959,9 +333315,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Silentclean : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/EncodeGroup/UAC-SilentClean"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1104-L1118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2e624d84a6d47c99b28ef41918f1d88cb219a90d35691d0cce8fe10a0a237650"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1104-L1118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2e624d84a6d47c99b28ef41918f1d88cb219a90d35691d0cce8fe10a0a237650"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335972,10 +333328,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Silentclean : FILE
 		$typelibguid0up = "948152A4-A4A1-4260-A224-204255BFEE72" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Desktopgrabber : FILE
 {
 	meta:
@@ -335985,9 +333339,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Desktopgrabber : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/DesktopGrabber"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1120-L1134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "150a2f89eee5e5e0fa77c42b004e170d8706db69e02293f297376933ec03d1be"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1120-L1134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_150a2f89eee5e5e0fa77c42b004e170d8706db69e02293f297376933ec03d1be"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -335998,10 +333352,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Desktopgrabber : FILE
 		$typelibguid0up = "E6AA0CD5-9537-47A0-8C85-1FBE284A4380" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Wsmanager : FILE
 {
 	meta:
@@ -336011,9 +333363,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Wsmanager : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/guillaC/wsManager"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1136-L1150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f335250f717cdcc2e9c6022a1fc22a61b4eec59a5c69c9359c2f7658081117b3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1136-L1150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f335250f717cdcc2e9c6022a1fc22a61b4eec59a5c69c9359c2f7658081117b3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336024,10 +333376,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Wsmanager : FILE
 		$typelibguid0up = "9480809E-5472-44F3-B076-DCDF7379E766" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Uglyexe : FILE
 {
 	meta:
@@ -336037,9 +333387,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Uglyexe : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/fashionproof/UglyEXe"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1152-L1166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7f3e5ef8fc7d6994c1ebab8fc35624691d8f200acf6068b0948fd818f8ad2223"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1152-L1166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7f3e5ef8fc7d6994c1ebab8fc35624691d8f200acf6068b0948fd818f8ad2223"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336050,10 +333400,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Uglyexe : FILE
 		$typelibguid0up = "233DE44B-4EC1-475D-A7D6-16DA48D6FC8D" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdump : FILE
 {
 	meta:
@@ -336063,9 +333411,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdump : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/SharpDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1168-L1182"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "65e28a356cc975a3014f59551035a324d21039e39a8596b5980ad0c0e4d0a811"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1168-L1182"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_65e28a356cc975a3014f59551035a324d21039e39a8596b5980ad0c0e4d0a811"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336076,10 +333424,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdump : FILE
 		$typelibguid0up = "79C9BBA3-A0EA-431C-866C-77004802D8A0" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Educationalrat : FILE
 {
 	meta:
@@ -336089,9 +333435,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Educationalrat : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/securesean/EducationalRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1184-L1198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ad6baa993ba3da60233da39ec55b10ab0fe3b2ca52882972b54c7d199e7b6abb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1184-L1198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ad6baa993ba3da60233da39ec55b10ab0fe3b2ca52882972b54c7d199e7b6abb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336102,10 +333448,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Educationalrat : FILE
 		$typelibguid0up = "8A18FBCF-8CAC-482D-8AB7-08A44F0E278E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Stealth_Kid_RAT : FILE
 {
 	meta:
@@ -336115,9 +333459,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stealth_Kid_RAT : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/ctsecurity/Stealth-Kid-RAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1200-L1216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c251c306f416d7a3192d7a11d87b99ab62e2d32453ddecb75a3c517f24a0342"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1200-L1216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c251c306f416d7a3192d7a11d87b99ab62e2d32453ddecb75a3c517f24a0342"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336130,10 +333474,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stealth_Kid_RAT : FILE
 		$typelibguid1up = "E5B9DF9B-A9E4-4754-8731-EFC4E2667D88" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcradle : FILE
 {
 	meta:
@@ -336143,9 +333485,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcradle : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/anthemtotheego/SharpCradle"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1218-L1232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a56c456a7c4f61b65f603bc2c8449668a90e36f8b240bca8ea474d82e8174c78"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1218-L1232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a56c456a7c4f61b65f603bc2c8449668a90e36f8b240bca8ea474d82e8174c78"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336156,10 +333498,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcradle : FILE
 		$typelibguid0up = "F70D2B71-4AAE-4B24-9DAE-55BC819C78BB" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Bypassuac : FILE
 {
 	meta:
@@ -336169,9 +333509,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Bypassuac : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/cnsimo/BypassUAC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1234-L1250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e466c4e3da0e8bc98eac148c67831df639befab716e0da5c779e3caacbf349a8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1234-L1250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e466c4e3da0e8bc98eac148c67831df639befab716e0da5c779e3caacbf349a8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336184,10 +333524,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Bypassuac : FILE
 		$typelibguid1up = "CEC553A7-1370-4BBC-9AAE-B2F5DBDE32B0" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Hanzoinjection : FILE
 {
 	meta:
@@ -336197,9 +333535,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hanzoinjection : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/P0cL4bs/hanzoInjection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1252-L1266"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aec8befc497505ea750ce0cfc1e0b1ef21b5a6b97660f5403d6612629edaa114"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1252-L1266"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aec8befc497505ea750ce0cfc1e0b1ef21b5a6b97660f5403d6612629edaa114"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336210,10 +333548,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hanzoinjection : FILE
 		$typelibguid0up = "32E22E25-B033-4D98-A0B3-3D2C3850F06C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Clr_Meterpreter : FILE
 {
 	meta:
@@ -336223,9 +333559,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Clr_Meterpreter : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/OJ/clr-meterpreter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1268-L1292"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "15fb4e51fc1473fbee3b08c2a94b6a984cc5b9c92c8aab5641f161aef8b5f01b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1268-L1292"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_15fb4e51fc1473fbee3b08c2a94b6a984cc5b9c92c8aab5641f161aef8b5f01b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336246,10 +333582,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Clr_Meterpreter : FILE
 		$typelibguid5up = "3296E4A3-94B5-4232-B423-44F4C7421CB3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_BYTAGE : FILE
 {
 	meta:
@@ -336259,9 +333593,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_BYTAGE : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/KNIF/BYTAGE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1294-L1308"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "faf0172ab464c4a19ce5ba4514f2a60ac4e78ce20be4fb4878a23e2980b6ea88"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1294-L1308"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_faf0172ab464c4a19ce5ba4514f2a60ac4e78ce20be4fb4878a23e2980b6ea88"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336272,10 +333606,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_BYTAGE : FILE
 		$typelibguid0up = "8E46BA56-E877-4DEC-BE1E-394CB1B5B9DE" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Multios_Reverseshell : FILE
 {
 	meta:
@@ -336285,9 +333617,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Multios_Reverseshell : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/belane/MultiOS_ReverseShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1310-L1324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ae5a41fd66f058a8f89f6b9d488d7f4a845bf7829a1eb04f49c4e8e4c8db1cc0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1310-L1324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ae5a41fd66f058a8f89f6b9d488d7f4a845bf7829a1eb04f49c4e8e4c8db1cc0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336298,10 +333630,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Multios_Reverseshell : FILE
 		$typelibguid0up = "DF0DD7A1-9F6B-4B0F-801E-E17E73B0801D" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Hidefromamsi : FILE
 {
 	meta:
@@ -336311,9 +333641,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hidefromamsi : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/0r13lc0ch4v1/HideFromAMSI"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1326-L1340"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c4c06b8f40a38d5386cb49befd7705552b471e443188b6af1d85d7bd4277cc1c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1326-L1340"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c4c06b8f40a38d5386cb49befd7705552b471e443188b6af1d85d7bd4277cc1c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336324,10 +333654,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hidefromamsi : FILE
 		$typelibguid0up = "B91D2D44-794C-49B8-8A75-2FBEC3FE3FE3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnetavbypass_Master : FILE
 {
 	meta:
@@ -336337,9 +333665,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnetavbypass_Master : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/lockfale/DotNetAVBypass-Master"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1342-L1356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "28446fae71b06f0418a5dd3cb6d6842dcc930313f7740704770b41f16ad0e7b5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1342-L1356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_28446fae71b06f0418a5dd3cb6d6842dcc930313f7740704770b41f16ad0e7b5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336350,10 +333678,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnetavbypass_Master : FILE
 		$typelibguid0up = "4854C8DC-82B0-4162-86E0-A5BBCBC10240" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdpapi : FILE
 {
 	meta:
@@ -336363,9 +333689,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdpapi : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/SharpDPAPI"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1358-L1374"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5846d932bb8064a82e57f942d0c7a8feec4c8582bb2eac64be7cc662d60e6d6e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1358-L1374"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5846d932bb8064a82e57f942d0c7a8feec4c8582bb2eac64be7cc662d60e6d6e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336378,10 +333704,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdpapi : FILE
 		$typelibguid1up = "2F00A05B-263D-4FCC-846B-DA82BD684603" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Telegra_Csharp_C2 : FILE
 {
 	meta:
@@ -336391,9 +333715,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Telegra_Csharp_C2 : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/sf197/Telegra_Csharp_C2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1376-L1390"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b931009110366712cc9d69a7cb7feaa7a02f7baa93bc3c3fbb76c4132554b10e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1376-L1390"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b931009110366712cc9d69a7cb7feaa7a02f7baa93bc3c3fbb76c4132554b10e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336404,10 +333728,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Telegra_Csharp_C2 : FILE
 		$typelibguid0up = "1D79FABC-2BA2-4604-A4B6-045027340C85" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcompile : FILE
 {
 	meta:
@@ -336417,9 +333739,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcompile : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/SpiderLabs/SharpCompile"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1392-L1406"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "60ecb9a9fa90e096d6b5d830787989046f5f8441282f4d7a072c6d7435add42d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1392-L1406"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_60ecb9a9fa90e096d6b5d830787989046f5f8441282f4d7a072c6d7435add42d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336430,10 +333752,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcompile : FILE
 		$typelibguid0up = "63F81B73-FF18-4A36-B095-FDCB4776DA4C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Carbuncle : FILE
 {
 	meta:
@@ -336443,9 +333763,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Carbuncle : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/checkymander/Carbuncle"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1408-L1422"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3a5bd58ac42ed3a428d6f20f1956b5abe5dfd958e9768fb0e3916ee2672d9c55"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1408-L1422"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3a5bd58ac42ed3a428d6f20f1956b5abe5dfd958e9768fb0e3916ee2672d9c55"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336456,10 +333776,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Carbuncle : FILE
 		$typelibguid0up = "3F239B73-88AE-413B-B8C8-C01A35A0D92E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Ossfiletool : FILE
 {
 	meta:
@@ -336469,9 +333787,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ossfiletool : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/B1eed/OSSFileTool"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1424-L1438"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2158671f0372080a7f78a7c6804d8be6715953545e23733ef1db091b2d849f2f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1424-L1438"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2158671f0372080a7f78a7c6804d8be6715953545e23733ef1db091b2d849f2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336482,10 +333800,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ossfiletool : FILE
 		$typelibguid0up = "207ACA5D-DCD6-41FB-8465-58B39EFCDE8B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Rubeus : FILE
 {
 	meta:
@@ -336495,9 +333811,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rubeus : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/Rubeus"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1440-L1454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b6c346bb0f6db20bd573c9a17d2b8110e6abd4fe3c51d7c717feefa2c517319b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1440-L1454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b6c346bb0f6db20bd573c9a17d2b8110e6abd4fe3c51d7c717feefa2c517319b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336508,10 +333824,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rubeus : FILE
 		$typelibguid0up = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Simple_Loader : FILE
 {
 	meta:
@@ -336521,9 +333835,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Simple_Loader : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/cribdragg3r/Simple-Loader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1456-L1470"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c94da47cdcf94f71d0909f1532108442e324e79e249646e5619865bdbd2d3c14"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1456-L1470"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c94da47cdcf94f71d0909f1532108442e324e79e249646e5619865bdbd2d3c14"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336534,10 +333848,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Simple_Loader : FILE
 		$typelibguid0up = "035AE711-C0E9-41DA-A9A2-6523865E8694" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Minidump : FILE
 {
 	meta:
@@ -336547,9 +333859,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Minidump : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/3xpl01tc0d3r/Minidump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1472-L1486"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "80142c0e96bca63f2b9991b3d6e2dfa7261bdde3a748fde96113d6f422b21e34"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1472-L1486"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_80142c0e96bca63f2b9991b3d6e2dfa7261bdde3a748fde96113d6f422b21e34"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336560,10 +333872,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Minidump : FILE
 		$typelibguid0up = "15C241AA-E73C-4B38-9489-9A344AC268A3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbypassuac : FILE
 {
 	meta:
@@ -336573,9 +333883,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbypassuac : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/FatRodzianko/SharpBypassUAC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1488-L1502"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "726b573fa957a2560d6f4e5e98497190ed8f8e1657427f14896e3aa439366c70"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1488-L1502"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_726b573fa957a2560d6f4e5e98497190ed8f8e1657427f14896e3aa439366c70"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336586,10 +333896,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbypassuac : FILE
 		$typelibguid0up = "0D588C86-C680-4B0D-9AED-418F1BB94255" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharppack : FILE
 {
 	meta:
@@ -336599,9 +333907,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharppack : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/Lexus89/SharpPack"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1504-L1532"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b3f86041560b8358c5408d73d8eb847d600e66ca2c9900f53d193902e4ae8eee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1504-L1532"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b3f86041560b8358c5408d73d8eb847d600e66ca2c9900f53d193902e4ae8eee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336626,10 +333934,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharppack : FILE
 		$typelibguid9up = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Salsa_Tools : FILE
 {
 	meta:
@@ -336639,9 +333945,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Salsa_Tools : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/Hackplayers/Salsa-tools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1534-L1550"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4c02f8fb1f1dbad19360c28d0728ccb5a73db5d34127bd345fe5c4baeb87fc7c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1534-L1550"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4c02f8fb1f1dbad19360c28d0728ccb5a73db5d34127bd345fe5c4baeb87fc7c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336654,10 +333960,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Salsa_Tools : FILE
 		$typelibguid1up = "CFCBF7B6-1C69-4B1F-8651-6BDB4B55F6B9" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsdefender_Payload_Downloader : FILE
 {
 	meta:
@@ -336667,9 +333971,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsdefender_Payload_Downloader : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/notkohlrexo/WindowsDefender-Payload-Downloader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1552-L1566"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4f0a7db1ff7dda5f66cb466cf70e717a9050541dd6a79acd9c8f5723267f5a4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1552-L1566"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4f0a7db1ff7dda5f66cb466cf70e717a9050541dd6a79acd9c8f5723267f5a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336680,10 +333984,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsdefender_Payload_Downloader : FILE
 		$typelibguid0up = "2F8B4D26-7620-4E11-B296-BC46EBA3ADFC" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation : FILE
 {
 	meta:
@@ -336693,9 +333995,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/Mrakovic-ORG/Privilege_Escalation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1568-L1582"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1fd2eed72a4971f494fcb924b77edb6ab49b8bde400eb2785df00b9b867692d0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1568-L1582"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1fd2eed72a4971f494fcb924b77edb6ab49b8bde400eb2785df00b9b867692d0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336706,10 +334008,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation : FILE
 		$typelibguid0up = "ED54B904-5645-4830-8E68-52FD9ECBB2EB" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Marauder : FILE
 {
 	meta:
@@ -336719,9 +334019,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Marauder : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/maraudershell/Marauder"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1584-L1598"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8314db477f299931e6bb933be0234f18cfb3e36d6170b4aed1d482949aba75e8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1584-L1598"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8314db477f299931e6bb933be0234f18cfb3e36d6170b4aed1d482949aba75e8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336732,10 +334032,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Marauder : FILE
 		$typelibguid0up = "FFF0A9A3-DFD4-402B-A251-6046D765AD78" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_AV_Evasion_Tool : FILE
 {
 	meta:
@@ -336745,9 +334043,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_AV_Evasion_Tool : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/1y0n/AV_Evasion_Tool"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1600-L1616"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "682d16cbef455680186ca9d17c3d24619e4b018cd7915cea4f0e2f2f0c843e98"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1600-L1616"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_682d16cbef455680186ca9d17c3d24619e4b018cd7915cea4f0e2f2f0c843e98"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336760,10 +334058,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_AV_Evasion_Tool : FILE
 		$typelibguid1up = "7898617D-08D2-4297-ADFE-5EDD5C1B828B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Fenrir : FILE
 {
 	meta:
@@ -336773,9 +334069,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Fenrir : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/nccgroup/Fenrir"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1618-L1632"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f2fb94506f10bbf9f077cb81019873c810ea983888192b0d5ccb3e5e02891288"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1618-L1632"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f2fb94506f10bbf9f077cb81019873c810ea983888192b0d5ccb3e5e02891288"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336786,10 +334082,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Fenrir : FILE
 		$typelibguid0up = "AECEC195-F143-4D02-B946-DF0E1433BD2E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Stormkitty : FILE
 {
 	meta:
@@ -336799,9 +334093,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stormkitty : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/LimerBoy/StormKitty"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1634-L1650"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aef8e28d9eb5f6cd6fdc0a8bf60f00b99a920197a0ecaa75baca5a8570973ab7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1634-L1650"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aef8e28d9eb5f6cd6fdc0a8bf60f00b99a920197a0ecaa75baca5a8570973ab7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336814,10 +334108,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stormkitty : FILE
 		$typelibguid1up = "98075331-1F86-48C8-AE29-29DA39A8F98B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Crypter_Runtime_AV_S_Bypass : FILE
 {
 	meta:
@@ -336827,9 +334119,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Crypter_Runtime_AV_S_Bypass : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/netreverse/Crypter-Runtime-AV-s-bypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1652-L1666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "368023cf6e78965696f676a45858b671ff75f329419ec4d7a02767c81e503027"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1652-L1666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_368023cf6e78965696f676a45858b671ff75f329419ec4d7a02767c81e503027"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336840,10 +334132,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Crypter_Runtime_AV_S_Bypass : FILE
 		$typelibguid0up = "C25E39A9-8215-43AA-96A3-DA0E9512EC18" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Runasuser : FILE
 {
 	meta:
@@ -336853,9 +334143,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Runasuser : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/atthacks/RunAsUser"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1668-L1682"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "585db3eecb3bb91d594c1929c4790acbde8d1c44ae30de2410ef98796c297470"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1668-L1682"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_585db3eecb3bb91d594c1929c4790acbde8d1c44ae30de2410ef98796c297470"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336866,10 +334156,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Runasuser : FILE
 		$typelibguid0up = "9DFF282C-93B9-4063-BF8A-B6798371D35A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Hwidbypass : FILE
 {
 	meta:
@@ -336879,9 +334167,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hwidbypass : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/yunseok/HWIDbypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1684-L1698"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "17d34d65e2867c054c7ef941c8f92a89c42f7d21a301fd5230970ac07d003d90"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1684-L1698"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_17d34d65e2867c054c7ef941c8f92a89c42f7d21a301fd5230970ac07d003d90"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336892,10 +334180,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hwidbypass : FILE
 		$typelibguid0up = "47E08791-D124-4746-BC50-24BD1EE719A6" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Xoredreflectivedll : FILE
 {
 	meta:
@@ -336905,9 +334191,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Xoredreflectivedll : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/r3nhat/XORedReflectiveDLL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1700-L1716"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8df590cacf5922fcc9d059b34b88774b1afeb78b0fcffe3cc2d8578d20baf0a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1700-L1716"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8df590cacf5922fcc9d059b34b88774b1afeb78b0fcffe3cc2d8578d20baf0a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -336920,10 +334206,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Xoredreflectivedll : FILE
 		$typelibguid1up = "30EEF7D6-CEE8-490B-829F-082041BC3141" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Suite : FILE
 {
 	meta:
@@ -336933,9 +334217,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Suite : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/FuzzySecurity/Sharp-Suite"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1718-L1773"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d71931b45525607ed0f442a925540dba3663aeae9b5e1fa8380ffe0ce2b5f5eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1718-L1773"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d71931b45525607ed0f442a925540dba3663aeae9b5e1fa8380ffe0ce2b5f5eb"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -336986,10 +334270,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Suite : FILE
 		$typelibguid20up = "414187DB-5FEB-43E5-A383-CAA48B5395F1" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Rat_Shell : FILE
 {
 	meta:
@@ -336999,9 +334281,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rat_Shell : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/stphivos/rat-shell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1775-L1791"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2383483678c2a4b2545484c28aa81c2933c75a6bfb24dcfd6c989be90a2aca76"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1775-L1791"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2383483678c2a4b2545484c28aa81c2933c75a6bfb24dcfd6c989be90a2aca76"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337014,10 +334296,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rat_Shell : FILE
 		$typelibguid1up = "1659D65D-93A8-4BAE-97D5-66D738FC6F6C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnet_Gargoyle : FILE
 {
 	meta:
@@ -337027,9 +334307,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnet_Gargoyle : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/countercept/dotnet-gargoyle"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1793-L1811"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "29147b4e14f45757274ca1bc0d140323a908d663f580b00cc705bd9cf3072f56"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1793-L1811"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_29147b4e14f45757274ca1bc0d140323a908d663f580b00cc705bd9cf3072f56"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337044,10 +334324,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnet_Gargoyle : FILE
 		$typelibguid2up = "6F0BBB2A-E200-4D76-B8FA-F93C801AC220" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Aresskit : FILE
 {
 	meta:
@@ -337057,9 +334335,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aresskit : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/BlackVikingPro/aresskit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1813-L1827"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d0a1c7000c4018ba3c7405e310cfddea8795745216467dfb79379af521889cc6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1813-L1827"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d0a1c7000c4018ba3c7405e310cfddea8795745216467dfb79379af521889cc6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337070,10 +334348,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aresskit : FILE
 		$typelibguid0up = "8DCA0E42-F767-411D-9704-AE0BA4A44AE8" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injector : FILE
 {
 	meta:
@@ -337083,9 +334359,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injector : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/tmthrgd/DLL-Injector"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1829-L1845"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "45f63db2fbb807ecab8ebc91bc3ba781f145c60d8e84afd7ea07c57d5aa7bb41"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1829-L1845"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_45f63db2fbb807ecab8ebc91bc3ba781f145c60d8e84afd7ea07c57d5aa7bb41"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337098,10 +334374,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injector : FILE
 		$typelibguid1up = "05F4B238-25CE-40DC-A890-D5BBB8642EE4" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Trufflesnout : FILE
 {
 	meta:
@@ -337111,9 +334385,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Trufflesnout : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/dsnezhkov/TruffleSnout"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1847-L1861"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5c3a69776d1c1f2503b85e410eef83067e178c22e08dcefdecbe73040bf1d737"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1847-L1861"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5c3a69776d1c1f2503b85e410eef83067e178c22e08dcefdecbe73040bf1d737"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337124,10 +334398,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Trufflesnout : FILE
 		$typelibguid0up = "33842D77-BCE3-4EE8-9EE2-9769898BB429" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Anti_Analysis : FILE
 {
 	meta:
@@ -337137,9 +334409,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Anti_Analysis : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/Anti-Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1863-L1877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "60d7b68aabc6819c8bbc3adfa069f624df4ba3fecd7548841a8cd2f4415fd1a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1863-L1877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_60d7b68aabc6819c8bbc3adfa069f624df4ba3fecd7548841a8cd2f4415fd1a7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337150,10 +334422,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Anti_Analysis : FILE
 		$typelibguid0up = "3092C8DF-E9E4-4B75-B78E-F81A0058A635" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Backnet : FILE
 {
 	meta:
@@ -337163,9 +334433,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Backnet : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/valsov/BackNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1879-L1899"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f1814ad6f6f96f9a9efc6d684c4e19203d84b191c0eef801c18f5b67787892bb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1879-L1899"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f1814ad6f6f96f9a9efc6d684c4e19203d84b191c0eef801c18f5b67787892bb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337182,10 +334452,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Backnet : FILE
 		$typelibguid3up = "982DC5B6-1123-428A-83DD-D212490C859F" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Allthethings : FILE
 {
 	meta:
@@ -337195,9 +334463,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Allthethings : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/johnjohnsp1/AllTheThings"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1901-L1915"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "09836251d75327ef547451024ffed76de8cf41ce027fbf40db0cac44f74d46d5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1901-L1915"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_09836251d75327ef547451024ffed76de8cf41ce027fbf40db0cac44f74d46d5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337208,10 +334476,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Allthethings : FILE
 		$typelibguid0up = "0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Addreferencedotredteam : FILE
 {
 	meta:
@@ -337221,9 +334487,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Addreferencedotredteam : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/ceramicskate0/AddReferenceDotRedTeam"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1917-L1931"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "34717e4864a7dc5c21525be09fcfe87da6b18e56b1956e5a34b0a669d8d6ab45"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1917-L1931"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_34717e4864a7dc5c21525be09fcfe87da6b18e56b1956e5a34b0a669d8d6ab45"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337234,10 +334500,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Addreferencedotredteam : FILE
 		$typelibguid0up = "73C79D7E-17D4-46C9-BE5A-ECEF65B924E4" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Crypter : FILE
 {
 	meta:
@@ -337247,9 +334511,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Crypter : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/Lime-Crypter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1933-L1947"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "45a47b8ed17b157e22e6819f08a245aca2930d276b52d781fbbc82bcfb184ab4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1933-L1947"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_45a47b8ed17b157e22e6819f08a245aca2930d276b52d781fbbc82bcfb184ab4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337260,7 +334524,7 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Crypter : FILE
 		$typelibguid0up = "F93C99ED-28C9-48C5-BB90-DD98F18285A6" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 import "pe"
 
@@ -337273,9 +334537,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Browserghost : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/QAX-A-Team/BrowserGhost"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1949-L1965"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1f9bdf4881a71c429cf20e7a635f054a4a340f335767cb22ecc8024bcc57e53b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1949-L1965"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1f9bdf4881a71c429cf20e7a635f054a4a340f335767cb22ecc8024bcc57e53b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337286,10 +334550,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Browserghost : FILE
 		$typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them and not pe.is_dll()
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them and not pe.is_dll ( )
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshot : FILE
 {
 	meta:
@@ -337299,9 +334561,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshot : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/tothi/SharpShot"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1967-L1981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "843e7bb327314749a58e3d44356fcd9d7a2c349cb429f5bc593044894f17a15c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1967-L1981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_843e7bb327314749a58e3d44356fcd9d7a2c349cb429f5bc593044894f17a15c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337312,10 +334574,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshot : FILE
 		$typelibguid0up = "057AEF75-861B-4E4B-A372-CFBD8322C8E1" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Offensive__NET : FILE
 {
 	meta:
@@ -337325,9 +334585,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Offensive__NET : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/mrjamiebowman/Offensive-.NET"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1983-L1997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c26d29934fe3f7575ce1cd56bcf2571e95d5705bccdb1ca211ca7d46765d0fb4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1983-L1997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c26d29934fe3f7575ce1cd56bcf2571e95d5705bccdb1ca211ca7d46765d0fb4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337338,10 +334598,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Offensive__NET : FILE
 		$typelibguid0up = "11FE5FAE-B7C1-484A-B162-D5578A802C9C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Ruralbishop : FILE
 {
 	meta:
@@ -337351,9 +334609,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ruralbishop : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/rasta-mouse/RuralBishop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L1999-L2013"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ee349395cbb2c692afcbdd0a6bce52d19762ec45b64cca684b60b148a1edd2d5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L1999-L2013"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ee349395cbb2c692afcbdd0a6bce52d19762ec45b64cca684b60b148a1edd2d5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337364,10 +334622,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ruralbishop : FILE
 		$typelibguid0up = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Deviceguardbypasses : FILE
 {
 	meta:
@@ -337377,9 +334633,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Deviceguardbypasses : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/tyranid/DeviceGuardBypasses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2015-L2039"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b9fcec2e6641e961f2007dd1de1822fd0e0bcf9614fdd9e1110ac4fd40a89fd8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2015-L2039"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b9fcec2e6641e961f2007dd1de1822fd0e0bcf9614fdd9e1110ac4fd40a89fd8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337400,10 +334656,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Deviceguardbypasses : FILE
 		$typelibguid5up = "D85E3601-0421-4EFA-A479-F3370C0498FD" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_AMSI_Handler : FILE
 {
 	meta:
@@ -337413,9 +334667,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_AMSI_Handler : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/two06/AMSI_Handler"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2041-L2061"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cebfce69d60ca00e3d824bb75b36efc0c53b695c502a39601dee1e418af52766"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2041-L2061"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cebfce69d60ca00e3d824bb75b36efc0c53b695c502a39601dee1e418af52766"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337432,10 +334686,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_AMSI_Handler : FILE
 		$typelibguid3up = "1D920B03-C537-4659-9A8C-09FB1D615E98" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_RAT_Telegramspybot : FILE
 {
 	meta:
@@ -337445,9 +334697,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_RAT_Telegramspybot : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/SebastianEPH/RAT.TelegramSpyBot"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2063-L2077"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed661d6513df3a3e8558912f96f86bff55214f9ba6426085af8458a5c9c62d1f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2063-L2077"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed661d6513df3a3e8558912f96f86bff55214f9ba6426085af8458a5c9c62d1f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337458,10 +334710,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_RAT_Telegramspybot : FILE
 		$typelibguid0up = "8653FA88-9655-440E-B534-26C3C760A0D3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Thehacktoolboxteek : FILE
 {
 	meta:
@@ -337471,9 +334721,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Thehacktoolboxteek : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/teeknofil/TheHackToolBoxTeek"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2079-L2105"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "08ffcdc2d2f7ae3325208dc4980b8f44505fc1fcf40a7a926ac5a0c97977a1d3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2079-L2105"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_08ffcdc2d2f7ae3325208dc4980b8f44505fc1fcf40a7a926ac5a0c97977a1d3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337496,10 +334746,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Thehacktoolboxteek : FILE
 		$typelibguid6up = "74EFE601-9A93-46C3-932E-B80AB6570E42" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Usbtrojan : FILE
 {
 	meta:
@@ -337509,9 +334757,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Usbtrojan : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/mashed-potatoes/USBTrojan"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2107-L2121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8435a9f9fdf1e29010db3f3c1f55c19d616761b0585a232686ed377a6a252297"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2107-L2121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8435a9f9fdf1e29010db3f3c1f55c19d616761b0585a232686ed377a6a252297"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337522,10 +334770,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Usbtrojan : FILE
 		$typelibguid0up = "4EEE900E-ADC5-46A7-8D7D-873FD6AEA83E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_IIS_Backdoor : FILE
 {
 	meta:
@@ -337535,9 +334781,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_IIS_Backdoor : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/WBGlIl/IIS_backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2123-L2139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fbf6c641c9cede86867a88b62d5287d918edd67ae9f7228b5243d050a6487345"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2123-L2139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fbf6c641c9cede86867a88b62d5287d918edd67ae9f7228b5243d050a6487345"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337550,10 +334796,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_IIS_Backdoor : FILE
 		$typelibguid1up = "73CA4159-5D13-4A27-8965-D50C41AB203C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Shellgen : FILE
 {
 	meta:
@@ -337563,9 +334807,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shellgen : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/jasondrawdy/ShellGen"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2141-L2155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed7204d27cae6e0bcbe42247775e5eb20a968c5816f71135c7e2c92cc7fdffc5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2141-L2155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed7204d27cae6e0bcbe42247775e5eb20a968c5816f71135c7e2c92cc7fdffc5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337576,10 +334820,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shellgen : FILE
 		$typelibguid0up = "C6894882-D29D-4AE1-AEB7-7D0A9B915013" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Mass_RAT : FILE
 {
 	meta:
@@ -337589,9 +334831,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Mass_RAT : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/Mass-RAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2157-L2175"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "540620ade0225df3fa207052c3904584672eb5bdccaa523e28a1a2aced604ef9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2157-L2175"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_540620ade0225df3fa207052c3904584672eb5bdccaa523e28a1a2aced604ef9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337606,10 +334848,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Mass_RAT : FILE
 		$typelibguid2up = "4CB9BBEE-FB92-44FA-A427-B7245BEFC2F3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Browser_Externalc2 : FILE
 {
 	meta:
@@ -337619,9 +334859,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Browser_Externalc2 : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/mdsecactivebreach/Browser-ExternalC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2177-L2191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d5121396444c406049fcb6c24680a067341943a6982f67c7c5cd11947d3468bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2177-L2191"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d5121396444c406049fcb6c24680a067341943a6982f67c7c5cd11947d3468bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337632,10 +334872,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Browser_Externalc2 : FILE
 		$typelibguid0up = "10A730CD-9517-42D5-B3E3-A2383515CCA9" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivepowershelltasking : FILE
 {
 	meta:
@@ -337645,9 +334883,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivepowershelltasking : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/leechristensen/OffensivePowerShellTasking"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2193-L2209"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6de43b8349ff5f0e87d91e522be802a5dd18745441ffb76dcef63d2f1cd25332"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2193-L2209"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6de43b8349ff5f0e87d91e522be802a5dd18745441ffb76dcef63d2f1cd25332"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337660,10 +334898,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivepowershelltasking : FILE
 		$typelibguid1up = "5796276F-1C7A-4D7B-A089-550A8C19D0E8" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dohc2 : FILE
 {
 	meta:
@@ -337673,9 +334909,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dohc2 : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/SpiderLabs/DoHC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2211-L2225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d94760229bd6df29f7e281ee9d38068699d6529b93ed90c8846635bd496d602a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2211-L2225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d94760229bd6df29f7e281ee9d38068699d6529b93ed90c8846635bd496d602a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337686,10 +334922,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dohc2 : FILE
 		$typelibguid0up = "9877A948-2142-4094-98DE-E0FBB1BC4062" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Syscallpoc : FILE
 {
 	meta:
@@ -337699,9 +334933,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Syscallpoc : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/SolomonSklash/SyscallPOC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2227-L2243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "95f6c80e810c4f3b680958d8fe41983f965e47994ddc2f85756d570341b54bb9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2227-L2243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_95f6c80e810c4f3b680958d8fe41983f965e47994ddc2f85756d570341b54bb9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337714,10 +334948,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Syscallpoc : FILE
 		$typelibguid1up = "198D5599-D9FC-4A74-87F4-5077318232AD" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Pen_Test_Tools : FILE
 {
 	meta:
@@ -337727,9 +334959,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Pen_Test_Tools : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/awillard1/Pen-Test-Tools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2245-L2281"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "413cef91cab63cec432cb8deb2876f0370f6fe8b5e194b513bc905aca755e732"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2245-L2281"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_413cef91cab63cec432cb8deb2876f0370f6fe8b5e194b513bc905aca755e732"
 		score = 50
 		quality = 83
 		tags = "FILE"
@@ -337762,10 +334994,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Pen_Test_Tools : FILE
 		$typelibguid11up = "7913FE95-3AD5-41F5-BF7F-E28F080724FE" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_The_Collection : FILE
 {
 	meta:
@@ -337775,9 +335005,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_The_Collection : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/Tlgyt/The-Collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2283-L2305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a2cceb8173d9cf3a429a07f2abd2e09970a1807258a315991495a1904f0f4af0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2283-L2305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a2cceb8173d9cf3a429a07f2abd2e09970a1807258a315991495a1904f0f4af0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337796,10 +335026,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_The_Collection : FILE
 		$typelibguid4up = "17FBC926-E17E-4034-BA1B-FB2EB57F5DD3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Change_Lockscreen : FILE
 {
 	meta:
@@ -337809,9 +335037,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Change_Lockscreen : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/nccgroup/Change-Lockscreen"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2307-L2321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "92ec9daecd17c8b0aa92f266b2cd81e0198a28d41e43d526bc94b9a2df23015b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2307-L2321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_92ec9daecd17c8b0aa92f266b2cd81e0198a28d41e43d526bc94b9a2df23015b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337822,10 +335050,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Change_Lockscreen : FILE
 		$typelibguid0up = "78642AB3-EAA6-4E9C-A934-E7B0638BC1CC" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_LOLBITS : FILE
 {
 	meta:
@@ -337835,9 +335061,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_LOLBITS : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/Kudaes/LOLBITS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2323-L2337"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8c60938c037017f5b0ee355aec23fc8b7c629202457edaec01ab5a5ed94dc2f1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2323-L2337"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8c60938c037017f5b0ee355aec23fc8b7c629202457edaec01ab5a5ed94dc2f1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337848,10 +335074,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_LOLBITS : FILE
 		$typelibguid0up = "29D09AA4-EA0C-47C2-973C-1D768087D527" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Keylogger : FILE
 {
 	meta:
@@ -337861,9 +335085,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Keylogger : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/BlackVikingPro/Keylogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2339-L2353"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "37cd0615243abc0a2d29220285aabcaa75824ab1bc9b8ab395d90c1851a0159a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2339-L2353"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_37cd0615243abc0a2d29220285aabcaa75824ab1bc9b8ab395d90c1851a0159a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337874,10 +335098,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Keylogger : FILE
 		$typelibguid0up = "7AFBC9BF-32D9-460F-8A30-35E30AA15879" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1337 : FILE
 {
 	meta:
@@ -337887,9 +335109,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1337 : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/neofito/CVE-2020-1337"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2355-L2369"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f9a7d47861d19bb312cd75cd2edf66c8df02a0685a3eb5a1dd413e7b1c3c8234"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2355-L2369"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f9a7d47861d19bb312cd75cd2edf66c8df02a0685a3eb5a1dd413e7b1c3c8234"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337900,10 +335122,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1337 : FILE
 		$typelibguid0up = "D9C2E3C1-E9CC-42B0-A67C-B6E1A4F962CC" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplogger : FILE
 {
 	meta:
@@ -337913,9 +335133,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplogger : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/djhohnstein/SharpLogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2371-L2385"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a5118f0df57a4d9b0a7d682a016866ef5ae20c52e078223d72fc060774e17f48"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2371-L2385"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a5118f0df57a4d9b0a7d682a016866ef5ae20c52e078223d72fc060774e17f48"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337926,10 +335146,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplogger : FILE
 		$typelibguid0up = "36E00152-E073-4DA8-AA0C-375B6DD680C4" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Asyncrat_C_Sharp : FILE
 {
 	meta:
@@ -337939,9 +335157,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Asyncrat_C_Sharp : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2387-L2421"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "efb1c38e502483c25f8b81d6485f11130ed91a31a4dc64486db5c8bf2e8b1a53"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2387-L2421"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_efb1c38e502483c25f8b81d6485f11130ed91a31a4dc64486db5c8bf2e8b1a53"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -337972,10 +335190,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Asyncrat_C_Sharp : FILE
 		$typelibguid10up = "6AA4E392-AAAF-4408-B550-85863DD4BAAF" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Darkfender : FILE
 {
 	meta:
@@ -337985,9 +335201,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Darkfender : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xyg3n/DarkFender"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2423-L2437"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "97cc537dca2f8559edf7ca44124a2056194aceee9327fa097674bccdeb0316df"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2423-L2437"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_97cc537dca2f8559edf7ca44124a2056194aceee9327fa097674bccdeb0316df"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -337998,10 +335214,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Darkfender : FILE
 		$typelibguid0up = "12FDF7CE-4A7C-41B6-9B32-766DDD299BEB" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Minerdropper : FILE
 {
 	meta:
@@ -338011,9 +335225,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Minerdropper : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/DylanAlloy/MinerDropper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2459-L2475"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ce050b7dd0a9bae5737f5170a8656f737754e6c96e64bca2ceab9b030c4cdddb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2459-L2475"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ce050b7dd0a9bae5737f5170a8656f737754e6c96e64bca2ceab9b030c4cdddb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338026,10 +335240,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Minerdropper : FILE
 		$typelibguid1up = "8433A693-F39D-451B-955B-31C3E7FA6825" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdomainspray : FILE
 {
 	meta:
@@ -338039,9 +335251,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdomainspray : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/HunnicCyber/SharpDomainSpray"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2477-L2491"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb8bbeebe23a1e9e77fae170f2742aa0aabfb88436f91dc78f94cc1bef70b2dd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2477-L2491"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb8bbeebe23a1e9e77fae170f2742aa0aabfb88436f91dc78f94cc1bef70b2dd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338052,10 +335264,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdomainspray : FILE
 		$typelibguid0up = "76FFA92B-429B-4865-970D-4E7678AC34EA" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Ispykeylogger : FILE
 {
 	meta:
@@ -338065,9 +335275,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ispykeylogger : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/mwsrc/iSpyKeylogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2493-L2513"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a323adff7a71022a88c0ea1d2d7ddba14f3cefab50c431c2972165ae412f2565"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2493-L2513"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a323adff7a71022a88c0ea1d2d7ddba14f3cefab50c431c2972165ae412f2565"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338084,10 +335294,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ispykeylogger : FILE
 		$typelibguid3up = "88D3DC02-2853-4BF0-B6DC-AD31F5135D26" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Solarflare : FILE
 {
 	meta:
@@ -338097,9 +335305,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Solarflare : FILE
 		date = "2020-12-15"
 		modified = "2023-04-06"
 		reference = "https://github.com/mubix/solarflare"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2515-L2529"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4e35c57795ce3adaab52cba23a6d845617fed6c94dd1df048dcaa115086c513c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2515-L2529"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4e35c57795ce3adaab52cba23a6d845617fed6c94dd1df048dcaa115086c513c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338110,10 +335318,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Solarflare : FILE
 		$typelibguid0up = "CA60E49E-EEE9-409B-8D1A-D19F1D27B7E4" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Snaffler : FILE
 {
 	meta:
@@ -338123,9 +335329,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Snaffler : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/SnaffCon/Snaffler"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2531-L2547"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "13711b325cadf882be0aeb1073084193c73b9eec0f3a323d0cea9beeeb3d3cf5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2531-L2547"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_13711b325cadf882be0aeb1073084193c73b9eec0f3a323d0cea9beeeb3d3cf5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338138,10 +335344,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Snaffler : FILE
 		$typelibguid1up = "B118802D-2E46-4E41-AAC7-9EE890268F8B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshares : FILE
 {
 	meta:
@@ -338151,9 +335355,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshares : FILE
 		date = "2020-12-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/djhohnstein/SharpShares/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2549-L2563"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3ff3dd2c1facaeefcfd7f784c4dae15a66ff5ba1de33bb007dbc8cc91c38c29e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2549-L2563"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3ff3dd2c1facaeefcfd7f784c4dae15a66ff5ba1de33bb007dbc8cc91c38c29e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338164,10 +335368,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshares : FILE
 		$typelibguid0up = "FE9FDDE5-3F38-4F14-8C64-C3328C215CF2" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpedrchecker : FILE
 {
 	meta:
@@ -338177,9 +335379,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpedrchecker : FILE
 		date = "2020-12-18"
 		modified = "2023-04-06"
 		reference = "https://github.com/PwnDexter/SharpEDRChecker"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2565-L2579"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9da3ff753db6358029f1fdcb100bf6173d142096557c170ddcb3ac9b8c80b310"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2565-L2579"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9da3ff753db6358029f1fdcb100bf6173d142096557c170ddcb3ac9b8c80b310"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338190,10 +335392,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpedrchecker : FILE
 		$typelibguid0up = "BDFEE233-3FED-42E5-AA64-492EB2AC7047" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcliphistory : FILE
 {
 	meta:
@@ -338203,9 +335403,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcliphistory : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/FSecureLABS/SharpClipHistory"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2581-L2595"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5c88179f7b32cc4300f7ed85472247f91d812e523d07f4a11dc4e4b34344be1d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2581-L2595"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5c88179f7b32cc4300f7ed85472247f91d812e523d07f4a11dc4e4b34344be1d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338216,10 +335416,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcliphistory : FILE
 		$typelibguid0up = "1126D5B4-EFC7-4B33-A594-B963F107FE82" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpo_Remoteaccesspolicies : FILE
 {
 	meta:
@@ -338229,9 +335427,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpo_Remoteaccesspolicies : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/FSecureLABS/SharpGPO-RemoteAccessPolicies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2597-L2611"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d6f74ef8d34603502b26b60a1042dd531891088b9455f068bccaabaf12232b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2597-L2611"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d6f74ef8d34603502b26b60a1042dd531891088b9455f068bccaabaf12232b1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338242,10 +335440,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpo_Remoteaccesspolicies : FILE
 		$typelibguid0up = "FBB1ABCF-2B06-47A0-9311-17BA3D0F2A50" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Absinthe : FILE
 {
 	meta:
@@ -338255,9 +335451,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Absinthe : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/cameronhotchkies/Absinthe"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2613-L2627"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f6736024464a7b7115f8b66ff985a47107cbdd7d6260e56586ade467b3ca6c2a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2613-L2627"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f6736024464a7b7115f8b66ff985a47107cbdd7d6260e56586ade467b3ca6c2a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338268,10 +335464,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Absinthe : FILE
 		$typelibguid0up = "9936AE73-FB4E-4C5E-A5FB-F8AAEB3B9BD6" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Exploitremotingservice : FILE
 {
 	meta:
@@ -338281,9 +335475,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Exploitremotingservice : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/tyranid/ExploitRemotingService"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2629-L2647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "08871e9edc8184ee487080a9d99735598a9f03e605db0a38e83f60a3cc15cbbe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2629-L2647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_08871e9edc8184ee487080a9d99735598a9f03e605db0a38e83f60a3cc15cbbe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338298,10 +335492,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Exploitremotingservice : FILE
 		$typelibguid2up = "297CBCA1-EFA3-4F2A-8D5F-E1FAF02BA587" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Xploit : FILE
 {
 	meta:
@@ -338311,9 +335503,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Xploit : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/shargon/Xploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2649-L2683"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b049d1fe26677b8c1a5bfcb46bfa2b35073f2b4bba02551b490a527df81f145b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2649-L2683"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b049d1fe26677b8c1a5bfcb46bfa2b35073f2b4bba02551b490a527df81f145b"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -338344,10 +335536,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Xploit : FILE
 		$typelibguid10up = "7D75CA11-8745-4382-B3EB-C41416DBC48C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Poc : FILE
 {
 	meta:
@@ -338357,9 +335547,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Poc : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/thezdi/PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2685-L2699"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "938b553912d069969326bc970d94c23749af3ef28a0b5ce2c49d9de54358f9bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2685-L2699"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_938b553912d069969326bc970d94c23749af3ef28a0b5ce2c49d9de54358f9bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338370,10 +335560,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Poc : FILE
 		$typelibguid0up = "89F9D411-E273-41BB-8711-209FD251CA88" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpoabuse : FILE
 {
 	meta:
@@ -338383,9 +335571,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpoabuse : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/FSecureLABS/SharpGPOAbuse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2701-L2715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e3539bb9bdf7a9986e8fcfc725233363285e1dfe3de254b6979643abfe7944a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2701-L2715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e3539bb9bdf7a9986e8fcfc725233363285e1dfe3de254b6979643abfe7944a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338396,10 +335584,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpoabuse : FILE
 		$typelibguid0up = "4F495784-B443-4838-9FA6-9149293AF785" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Watson : FILE
 {
 	meta:
@@ -338409,9 +335595,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Watson : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/rasta-mouse/Watson"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2717-L2731"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cc7134a974b11b677e368f4f01ec534578bcd970282dc2c8b7f4852cb028514a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2717-L2731"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cc7134a974b11b677e368f4f01ec534578bcd970282dc2c8b7f4852cb028514a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338422,10 +335608,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Watson : FILE
 		$typelibguid0up = "49AD5F38-9E37-4967-9E84-FE19C7434ED7" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Standin : FILE
 {
 	meta:
@@ -338435,9 +335619,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Standin : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/FuzzySecurity/StandIn"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2733-L2747"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "105be83eb5db667b9f27f2a514e0d04748ca006ef64aa01b9f643c227e7f1639"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2733-L2747"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_105be83eb5db667b9f27f2a514e0d04748ca006ef64aa01b9f643c227e7f1639"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338448,10 +335632,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Standin : FILE
 		$typelibguid0up = "01C142BA-7AF1-48D6-B185-81147A2F7DB7" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Azure_Password_Harvesting : FILE
 {
 	meta:
@@ -338461,9 +335643,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Azure_Password_Harvesting : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/guardicore/azure_password_harvesting"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2749-L2763"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4b42d3318af410952f96ede0959363f33e75ce0644c58c1de85165e0acbbfcdd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2749-L2763"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4b42d3318af410952f96ede0959363f33e75ce0644c58c1de85165e0acbbfcdd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338474,10 +335656,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Azure_Password_Harvesting : FILE
 		$typelibguid0up = "7AD1FF2D-32AC-4C54-B615-9BB164160DAC" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Powerops : FILE
 {
 	meta:
@@ -338487,9 +335667,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Powerops : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/fdiskyou/PowerOPS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2765-L2779"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "211a96940c5cbca143471268500be46c13dc58469d2386b2dc7f8ff1f05a2c52"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2765-L2779"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_211a96940c5cbca143471268500be46c13dc58469d2386b2dc7f8ff1f05a2c52"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338500,10 +335680,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Powerops : FILE
 		$typelibguid0up = "2A3C5921-7442-42C3-8CB9-24F21D0B2414" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Random_Csharptools : FILE
 {
 	meta:
@@ -338513,9 +335691,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Random_Csharptools : FILE
 		date = "2020-12-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/xorrior/Random-CSharpTools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2781-L2807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d1d5e372c6e1314ebf317b51633b83b2f9336048cc223982052e078ca86ee6bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2781-L2807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d1d5e372c6e1314ebf317b51633b83b2f9336048cc223982052e078ca86ee6bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338538,10 +335716,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Random_Csharptools : FILE
 		$typelibguid6up = "60116613-C74E-41B9-B80E-35E02F25891E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_0668 : FILE
 {
 	meta:
@@ -338551,9 +335727,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_0668 : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/RedCursorSecurityConsulting/CVE-2020-0668"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2809-L2823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b72a5dff34f9674545acccad556204ed65dfdd587aa6a4d1fe542afd91e5a8d5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2809-L2823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b72a5dff34f9674545acccad556204ed65dfdd587aa6a4d1fe542afd91e5a8d5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338564,10 +335740,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_0668 : FILE
 		$typelibguid0up = "1B4C5EC1-2845-40FD-A173-62C450F12EA5" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsrpcclients : FILE
 {
 	meta:
@@ -338577,9 +335751,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsrpcclients : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/tyranid/WindowsRpcClients"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2825-L2851"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a15992e0f24ec7ecec5a42d8996102e60958c441a1926267718531c95c8b7e35"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2825-L2851"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a15992e0f24ec7ecec5a42d8996102e60958c441a1926267718531c95c8b7e35"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338602,10 +335776,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsrpcclients : FILE
 		$typelibguid6up = "5D28F15E-3BB8-4088-ABE0-B517B31D4595" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpfruit : FILE
 {
 	meta:
@@ -338615,9 +335787,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpfruit : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/rvrsh3ll/SharpFruit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2853-L2867"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3fffebded16430beae82315532548a4c035f4c9e92a893f441b1d5049d97f73a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2853-L2867"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3fffebded16430beae82315532548a4c035f4c9e92a893f441b1d5049d97f73a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338628,10 +335800,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpfruit : FILE
 		$typelibguid0up = "3DA2F6DE-75BE-4C9D-8070-08DA45E79761" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwitness : FILE
 {
 	meta:
@@ -338641,9 +335811,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwitness : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/rasta-mouse/SharpWitness"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2869-L2883"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7339e77168c23cc218892db37fad0a6806b15d57a83b75b5da53c2f5e04b327d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2869-L2883"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7339e77168c23cc218892db37fad0a6806b15d57a83b75b5da53c2f5e04b327d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338654,10 +335824,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwitness : FILE
 		$typelibguid0up = "B9F6EC34-4CCC-4247-BCEF-C1DAAB9B4469" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Rexcrypter : FILE
 {
 	meta:
@@ -338667,9 +335835,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rexcrypter : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/syrex1013/RexCrypter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2885-L2899"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "82edeed1b6641c45ab7e41eb0d98416760c3af9998bf391905192d732e658cc1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2885-L2899"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_82edeed1b6641c45ab7e41eb0d98416760c3af9998bf391905192d732e658cc1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338680,10 +335848,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rexcrypter : FILE
 		$typelibguid0up = "10CD7C1C-E56D-4B1B-80DC-E4C496C5FEC5" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpersist : FILE
 {
 	meta:
@@ -338693,9 +335859,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpersist : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/fireeye/SharPersist"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2901-L2915"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "85a96c0fcbbc0ddb2fd0eab77c33976345120e575e5954e35bb4a61ff534b15a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2901-L2915"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_85a96c0fcbbc0ddb2fd0eab77c33976345120e575e5954e35bb4a61ff534b15a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338706,10 +335872,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpersist : FILE
 		$typelibguid0up = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1253 : FILE
 {
 	meta:
@@ -338719,9 +335883,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1253 : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/padovah4ck/CVE-2019-1253"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2917-L2931"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "964b3c21297295833a702160fc292dcbb06573e5341b81dfc05b641246c4b019"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2917-L2931"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_964b3c21297295833a702160fc292dcbb06573e5341b81dfc05b641246c4b019"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338732,10 +335896,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1253 : FILE
 		$typelibguid0up = "584964C1-F983-498D-8370-23E27FDD0399" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Scout : FILE
 {
 	meta:
@@ -338745,9 +335907,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Scout : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/jaredhaight/scout"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2933-L2947"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8bd735b4c4c3af209475b633c00fc8f01b2e9a3a5e5e29557a578d87e7bd0836"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2933-L2947"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8bd735b4c4c3af209475b633c00fc8f01b2e9a3a5e5e29557a578d87e7bd0836"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338758,10 +335920,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Scout : FILE
 		$typelibguid0up = "D9C76E82-B848-47D4-8F22-99BF22A8EE11" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Grouper2 : FILE
 {
 	meta:
@@ -338771,9 +335931,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Grouper2 : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/l0ss/Grouper2/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2949-L2963"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c1909e40b587d86766ff393cc056352ffaf40f2b56c3a1217b1526cc42e4eb7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2949-L2963"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c1909e40b587d86766ff393cc056352ffaf40f2b56c3a1217b1526cc42e4eb7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338784,10 +335944,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Grouper2 : FILE
 		$typelibguid0up = "5DECAEA3-2610-4065-99DC-65B9B4BA6CCD" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Casperstager : FILE
 {
 	meta:
@@ -338797,9 +335955,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Casperstager : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/ustayready/CasperStager"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2965-L2981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ac00affab78024da7a1cfa6e6fd43c6a8f3c7fec59499a85c1330ee593488eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2965-L2981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ac00affab78024da7a1cfa6e6fd43c6a8f3c7fec59499a85c1330ee593488eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338812,10 +335970,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Casperstager : FILE
 		$typelibguid1up = "48DFC55E-6AE5-4A36-ABEF-14BC09D7510B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Tellmeyoursecrets : FILE
 {
 	meta:
@@ -338825,9 +335981,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tellmeyoursecrets : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xbadjuju/TellMeYourSecrets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2983-L2997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cabb37be30a62ef6055e6b6a8f5cd1b9f51b231d254419a94aedd5ddfb992376"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2983-L2997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cabb37be30a62ef6055e6b6a8f5cd1b9f51b231d254419a94aedd5ddfb992376"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338838,10 +335994,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tellmeyoursecrets : FILE
 		$typelibguid0up = "9B448062-7219-4D82-9A0A-E784C4B3AA27" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexcel4_DCOM : FILE
 {
 	meta:
@@ -338851,9 +336005,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexcel4_DCOM : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/rvrsh3ll/SharpExcel4-DCOM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L2999-L3013"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "abc87f0ed51f044633ef7854610cd16460eefad570c31c7fe854d245229cceb3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L2999-L3013"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_abc87f0ed51f044633ef7854610cd16460eefad570c31c7fe854d245229cceb3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338864,10 +336018,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexcel4_DCOM : FILE
 		$typelibguid0up = "68B83CE5-BBD9-4EE3-B1CC-5E9223FAB52B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshooter : FILE
 {
 	meta:
@@ -338877,9 +336029,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshooter : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/mdsecactivebreach/SharpShooter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3015-L3029"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8a8510a680205c09321b8d1a960f1b8026883aede5224e8fe541727a434312b4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3015-L3029"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8a8510a680205c09321b8d1a960f1b8026883aede5224e8fe541727a434312b4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338890,10 +336042,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshooter : FILE
 		$typelibguid0up = "56598F1C-6D88-4994-A392-AF337ABE5777" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Nomsbuild : FILE
 {
 	meta:
@@ -338903,9 +336053,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nomsbuild : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/rvrsh3ll/NoMSBuild"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3031-L3047"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3979162455153d586036960f3cf2a90a893541900245c4184e55631d2138ba75"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3031-L3047"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3979162455153d586036960f3cf2a90a893541900245c4184e55631d2138ba75"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338918,10 +336068,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nomsbuild : FILE
 		$typelibguid1up = "59B449D7-C1E8-4F47-80B8-7375178961DB" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Teleshadow2 : FILE
 {
 	meta:
@@ -338931,9 +336079,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Teleshadow2 : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/ParsingTeam/TeleShadow2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3049-L3065"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "effe10487be132548eb56eb5bfc97f394669a153c9a885e3461e5f9e94bf66f8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3049-L3065"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_effe10487be132548eb56eb5bfc97f394669a153c9a885e3461e5f9e94bf66f8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338946,10 +336094,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Teleshadow2 : FILE
 		$typelibguid1up = "0242B5B1-4D26-413E-8C8C-13B4ED30D510" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Badpotato : FILE
 {
 	meta:
@@ -338959,9 +336105,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Badpotato : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/BeichenDream/BadPotato"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3067-L3081"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "52b80fa9f4738fb8d9ce14f2881e19122219a13e9fc3acdf87ed7bfea371ebc4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3067-L3081"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_52b80fa9f4738fb8d9ce14f2881e19122219a13e9fc3acdf87ed7bfea371ebc4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -338972,10 +336118,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Badpotato : FILE
 		$typelibguid0up = "0527A14F-1591-4D94-943E-D6D784A50549" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Lethalhta : FILE
 {
 	meta:
@@ -338985,9 +336129,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lethalhta : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/codewhitesec/LethalHTA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3083-L3099"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c9957f9e0838c5c708afa1651aedb9c6cb003f53c1ce38b200b1526da8fa3a65"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3083-L3099"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c9957f9e0838c5c708afa1651aedb9c6cb003f53c1ce38b200b1526da8fa3a65"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339000,10 +336144,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lethalhta : FILE
 		$typelibguid1up = "7E2DE2C0-61DC-43AB-A0EC-C27EE2172EA6" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstat : FILE
 {
 	meta:
@@ -339013,9 +336155,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstat : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/Raikia/SharpStat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3101-L3115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8b9193262c5ab6e43d804c964821ab986c038a0ba834b22785e75e846fca649b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3101-L3115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8b9193262c5ab6e43d804c964821ab986c038a0ba834b22785e75e846fca649b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339026,10 +336168,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstat : FILE
 		$typelibguid0up = "FFC5C721-49C8-448D-8FF4-2E3A7B7CC383" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyservice : FILE
 {
 	meta:
@@ -339039,9 +336179,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyservice : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/malcomvetter/SneakyService"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3117-L3131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf35b2709e6a998ee672681d99f91fe5f452ba612bf0c5d9abe20e93d3cb236e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3117-L3131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf35b2709e6a998ee672681d99f91fe5f452ba612bf0c5d9abe20e93d3cb236e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339052,10 +336192,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyservice : FILE
 		$typelibguid0up = "897819D5-58E0-46A0-8E1A-91EA6A269D84" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexec : FILE
 {
 	meta:
@@ -339065,9 +336203,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexec : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/anthemtotheego/SharpExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3133-L3147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a8faa0abbd8654901a5b96dff22a635fd7d429a736fe9406c37e9bb724d2c89"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3133-L3147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a8faa0abbd8654901a5b96dff22a635fd7d429a736fe9406c37e9bb724d2c89"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339078,10 +336216,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexec : FILE
 		$typelibguid0up = "7FBAD126-E21C-4C4E-A9F0-613FCF585A71" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcom : FILE
 {
 	meta:
@@ -339091,9 +336227,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcom : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/rvrsh3ll/SharpCOM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3149-L3163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c11955ce6a0a56de198b22d3716ce496573374847004a62f4b3a682edaa68ebe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3149-L3163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c11955ce6a0a56de198b22d3716ce496573374847004a62f4b3a682edaa68ebe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339104,10 +336240,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcom : FILE
 		$typelibguid0up = "51960F7D-76FE-499F-AFBD-ACABD7BA50D1" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Inception : FILE
 {
 	meta:
@@ -339117,9 +336251,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Inception : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/two06/Inception"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3165-L3179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "333f2d92dad837ab1d9ce9bfbd0aac790026c9624d7f5e77c7a60fc6c4a72ca0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3165-L3179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_333f2d92dad837ab1d9ce9bfbd0aac790026c9624d7f5e77c7a60fc6c4a72ca0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339130,10 +336264,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Inception : FILE
 		$typelibguid0up = "03D96B8C-EFD1-44A9-8DB2-0B74DB5D247A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_1 : FILE
 {
 	meta:
@@ -339144,9 +336276,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_1 : FILE
 		modified = "2023-04-06"
 		old_rule_name = "HKTL_NET_GUID_sharpwmi"
 		reference = "https://github.com/QAX-A-Team/sharpwmi"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3181-L3196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "85e22c021c6d421e97d7ea811b3d3800c487a0185ddab6cb80b2d35cb97a73d7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3181-L3196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_85e22c021c6d421e97d7ea811b3d3800c487a0185ddab6cb80b2d35cb97a73d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339157,10 +336289,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_1 : FILE
 		$typelibguid0up = "BB357D38-6DC1-4F20-A54C-D664BD20677E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1064 : FILE
 {
 	meta:
@@ -339170,9 +336300,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1064 : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/RythmStick/CVE-2019-1064"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3198-L3212"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d78b15454af39bca869c07a78550d2b3827ecdd03bcf02a8614e0c8247fcf5c1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3198-L3212"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d78b15454af39bca869c07a78550d2b3827ecdd03bcf02a8614e0c8247fcf5c1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339183,10 +336313,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1064 : FILE
 		$typelibguid0up = "FF97E98A-635E-4EA9-B2D0-1A13F6BDBC38" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenvator : FILE
 {
 	meta:
@@ -339196,9 +336324,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenvator : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xbadjuju/Tokenvator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3214-L3228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7bd3cc74ea70f247836ed4d0da9602b21e962c6b7b2d8fdf89c9c46ba919fc71"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3214-L3228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7bd3cc74ea70f247836ed4d0da9602b21e962c6b7b2d8fdf89c9c46ba919fc71"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339209,10 +336337,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenvator : FILE
 		$typelibguid0up = "4B2B3BD4-D28F-44CC-96B3-4A2F64213109" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Wheresmyimplant : FILE
 {
 	meta:
@@ -339222,9 +336348,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Wheresmyimplant : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xbadjuju/WheresMyImplant"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3230-L3244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bc82dfd6e07f6ff8a9cb7b6331f3f600db30ee053592422d1eddaff3c46cfdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3230-L3244"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bc82dfd6e07f6ff8a9cb7b6331f3f600db30ee053592422d1eddaff3c46cfdf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339235,10 +336361,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Wheresmyimplant : FILE
 		$typelibguid0up = "CCA59E4E-CE4D-40FC-965F-34560330C7E6" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Naga : FILE
 {
 	meta:
@@ -339248,9 +336372,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Naga : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/byt3bl33d3r/Naga"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3246-L3262"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff115b2817926a072088d5077d2969028b64ce2306920fa3278cfe842246e747"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3246-L3262"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff115b2817926a072088d5077d2969028b64ce2306920fa3278cfe842246e747"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339263,10 +336387,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Naga : FILE
 		$typelibguid1up = "A2C9488F-6067-4B17-8C6F-2D464E65C535" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbox : FILE
 {
 	meta:
@@ -339276,9 +336398,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbox : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/P1CKLES/SharpBox"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3264-L3278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dba572c1c52bc887600e5e674403b3a43578ca43c8ea4d6b34530796ef1de0d0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3264-L3278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dba572c1c52bc887600e5e674403b3a43578ca43c8ea4d6b34530796ef1de0d0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339289,10 +336411,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbox : FILE
 		$typelibguid0up = "616C1AFB-2944-42ED-9951-BF435CADB600" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Rundotnetdll32 : FILE
 {
 	meta:
@@ -339302,9 +336422,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rundotnetdll32 : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xbadjuju/rundotnetdll32"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3280-L3294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8d20de93f5e9f0fce189130862153e533a79038d4fdaadb3d4216b6bd294ae05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3280-L3294"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8d20de93f5e9f0fce189130862153e533a79038d4fdaadb3d4216b6bd294ae05"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339315,10 +336435,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rundotnetdll32 : FILE
 		$typelibguid0up = "A766DB28-94B6-4ED1-AEF9-5200BBDD8CA7" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Antidebug : FILE
 {
 	meta:
@@ -339328,9 +336446,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Antidebug : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/malcomvetter/AntiDebug"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3296-L3310"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "32ae8a5221f3b1c913163590291461fe7868f25be02c3b0b045a4934d97d244a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3296-L3310"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_32ae8a5221f3b1c913163590291461fe7868f25be02c3b0b045a4934d97d244a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339341,10 +336459,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Antidebug : FILE
 		$typelibguid0up = "997265C1-1342-4D44-ADED-67964A32F859" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvisibleregistry : FILE
 {
 	meta:
@@ -339354,9 +336470,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvisibleregistry : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3312-L3326"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a14dca802a63983d1c3974a4c195fd7bd5f256ace03d4bcea2d88eef6958931b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3312-L3326"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a14dca802a63983d1c3974a4c195fd7bd5f256ace03d4bcea2d88eef6958931b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339367,10 +336483,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvisibleregistry : FILE
 		$typelibguid0up = "31D576FB-9FB9-455E-AB02-C78981634C65" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Tikitorch : FILE
 {
 	meta:
@@ -339380,9 +336494,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tikitorch : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/rasta-mouse/TikiTorch"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3328-L3354"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "072129fea5e40b2fcbf13156ccf8c5a05e343b98f02dc7140261f6534a5b9e4e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3328-L3354"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_072129fea5e40b2fcbf13156ccf8c5a05e343b98f02dc7140261f6534a5b9e4e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339405,10 +336519,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tikitorch : FILE
 		$typelibguid6up = "FC700AC6-5182-421F-8853-0AD18CDBEB39" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Hivejack : FILE
 {
 	meta:
@@ -339418,9 +336530,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hivejack : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/Viralmaniar/HiveJack"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3356-L3370"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "22ca377cc1f1d634564084e92e976e21df0cf8bf864cb772a49f740a6a429a4e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3356-L3370"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_22ca377cc1f1d634564084e92e976e21df0cf8bf864cb772a49f740a6a429a4e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339431,10 +336543,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hivejack : FILE
 		$typelibguid0up = "E12E62FE-BEA3-4989-BF04-6F76028623E3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Decryptautologon : FILE
 {
 	meta:
@@ -339444,9 +336554,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Decryptautologon : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/securesean/DecryptAutoLogon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3372-L3386"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d8d05f568528616da30f0f35c3baf7ba762e33319a7d7975ddb23e42944884f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3372-L3386"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d8d05f568528616da30f0f35c3baf7ba762e33319a7d7975ddb23e42944884f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339457,10 +336567,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Decryptautologon : FILE
 		$typelibguid0up = "015A37FC-53D0-499B-BFFE-AB88C5086040" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Unstoppableservice : FILE
 {
 	meta:
@@ -339470,9 +336578,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Unstoppableservice : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/malcomvetter/UnstoppableService"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3388-L3402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1b2039d27bfaa624b47886e7a310e6b2ec0f6063e973e449270dfca54a7bdd7b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3388-L3402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1b2039d27bfaa624b47886e7a310e6b2ec0f6063e973e449270dfca54a7bdd7b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339483,10 +336591,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Unstoppableservice : FILE
 		$typelibguid0up = "0C117EE5-2A21-DEAD-BEEF-8CC7F0CAAA86" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_2 : FILE
 {
 	meta:
@@ -339497,9 +336603,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_2 : FILE
 		modified = "2023-04-06"
 		old_rule_name = "HKTL_NET_GUID_SharpWMI"
 		reference = "https://github.com/GhostPack/SharpWMI"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3404-L3419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2541e7eeb07ee9d018067c35765c9ad68c9c8ecf0baa723e410dde8c55dabbd0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3404-L3419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2541e7eeb07ee9d018067c35765c9ad68c9c8ecf0baa723e410dde8c55dabbd0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339510,10 +336616,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_2 : FILE
 		$typelibguid0up = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Ewstoolkit : FILE
 {
 	meta:
@@ -339523,9 +336627,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ewstoolkit : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/rasta-mouse/EWSToolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3421-L3435"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bc7f82779efec8a5e2a6a861a8e7a50e71e0b1e8891618f56bd12e0ce09eefc3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3421-L3435"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bc7f82779efec8a5e2a6a861a8e7a50e71e0b1e8891618f56bd12e0ce09eefc3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339536,10 +336640,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ewstoolkit : FILE
 		$typelibguid0up = "CA536D67-53C9-43B5-8BC8-9A05FDC567ED" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sweetpotato : FILE
 {
 	meta:
@@ -339549,9 +336651,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sweetpotato : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/CCob/SweetPotato"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3437-L3453"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a514be8ef3b51a3cad22a470afd9a4911c7156bfbf14f0a33522b429041e5bb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3437-L3453"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a514be8ef3b51a3cad22a470afd9a4911c7156bfbf14f0a33522b429041e5bb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339564,10 +336666,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sweetpotato : FILE
 		$typelibguid1up = "1BF9C10F-6F89-4520-9D2E-AAF17D17BA5E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Memscan : FILE
 {
 	meta:
@@ -339577,9 +336677,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Memscan : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/nccgroup/memscan"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3455-L3469"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "099c6dfc9f30e56eca9834431eb527194e0302c9c6ef88f3c4fc91837a7aad7a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3455-L3469"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_099c6dfc9f30e56eca9834431eb527194e0302c9c6ef88f3c4fc91837a7aad7a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339590,10 +336690,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Memscan : FILE
 		$typelibguid0up = "79462F87-8418-4834-9356-8C11E44CE189" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstay : FILE
 {
 	meta:
@@ -339603,9 +336701,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstay : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xthirteen/SharpStay"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3471-L3485"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3750df9725c739fad99d2ce5d3fab0c84112c1efb2e4e5a1348501174c4ce494"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3471-L3485"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3750df9725c739fad99d2ce5d3fab0c84112c1efb2e4e5a1348501174c4ce494"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339616,10 +336714,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstay : FILE
 		$typelibguid0up = "2963C954-7B1E-47F5-B4FA-2FC1F0D56AEA" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplocker : FILE
 {
 	meta:
@@ -339629,9 +336725,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplocker : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/Pickfordmatt/SharpLocker"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3487-L3501"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "47cffdd5ffdf11c8afb16c031c6f44b0857ed369b2913a8c43b11bdb9d446171"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3487-L3501"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_47cffdd5ffdf11c8afb16c031c6f44b0857ed369b2913a8c43b11bdb9d446171"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339642,10 +336738,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplocker : FILE
 		$typelibguid0up = "A6F8500F-68BC-4EFC-962A-6C6E68D893AF" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sauroneye : FILE
 {
 	meta:
@@ -339655,9 +336749,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sauroneye : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/vivami/SauronEye"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3503-L3519"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4f73dabd483ad1c45e6225ef8ef664f6db1ec75a6aa300a0a6efaa63e64b2c3a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3503-L3519"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4f73dabd483ad1c45e6225ef8ef664f6db1ec75a6aa300a0a6efaa63e64b2c3a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339670,10 +336764,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sauroneye : FILE
 		$typelibguid1up = "086BF0CA-F1E4-4E8F-9040-A8C37A49FA26" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sitrep : FILE
 {
 	meta:
@@ -339683,9 +336775,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sitrep : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/mdsecactivebreach/sitrep"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3521-L3535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c7fa4e8bd94d86218c22c1be99221b25406e7fbae54cfadb53f81720d167e8ce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3521-L3535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c7fa4e8bd94d86218c22c1be99221b25406e7fbae54cfadb53f81720d167e8ce"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339696,10 +336788,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sitrep : FILE
 		$typelibguid0up = "12963497-988F-46C0-9212-28B4B2B1831B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpclipboard : FILE
 {
 	meta:
@@ -339709,9 +336799,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpclipboard : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/slyd0g/SharpClipboard"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3537-L3551"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f935b91fcbf982af9e67f90fe1ce9086217066dd2127dea17c92db5c185b91b9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3537-L3551"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f935b91fcbf982af9e67f90fe1ce9086217066dd2127dea17c92db5c185b91b9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339722,10 +336812,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpclipboard : FILE
 		$typelibguid0up = "97484211-4726-4129-86AA-AE01D17690BE" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcookiemonster : FILE
 {
 	meta:
@@ -339735,9 +336823,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcookiemonster : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/m0rv4i/SharpCookieMonster"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3553-L3567"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a4003459096d8bfdcb4c4761d32bdccfa273c3950f90c7605d555713cd215709"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3553-L3567"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a4003459096d8bfdcb4c4761d32bdccfa273c3950f90c7605d555713cd215709"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339748,10 +336836,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcookiemonster : FILE
 		$typelibguid0up = "566C5556-1204-4DB9-9DC8-A24091BAAA8E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_P0Wnedshell : FILE
 {
 	meta:
@@ -339761,9 +336847,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_P0Wnedshell : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3569-L3583"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bed8f4ea30218c137a26da5059934fa93316f4a3623284c5cb3a44b8bfacf7c4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3569-L3583"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bed8f4ea30218c137a26da5059934fa93316f4a3623284c5cb3a44b8bfacf7c4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339774,10 +336860,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_P0Wnedshell : FILE
 		$typelibguid0up = "2E9B1462-F47C-48CA-9D85-004493892381" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmove : FILE
 {
 	meta:
@@ -339787,9 +336871,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmove : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xthirteen/SharpMove"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3585-L3599"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4dd05b77d8cacb0dc208ee7bdde5358adfdf0bb04f52f1d6f12774effc547ca7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3585-L3599"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4dd05b77d8cacb0dc208ee7bdde5358adfdf0bb04f52f1d6f12774effc547ca7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339800,10 +336884,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmove : FILE
 		$typelibguid0up = "8BF82BBE-909C-4777-A2FC-EA7C070FF43E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_C_Sharp_R_A_T_Client : FILE
 {
 	meta:
@@ -339813,9 +336895,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_C_Sharp_R_A_T_Client : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3601-L3615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e6a9db731caf7bc7ab79fa70c3f9bacaca8fa2d70deafe2a0b08ae4fac8a35b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3601-L3615"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e6a9db731caf7bc7ab79fa70c3f9bacaca8fa2d70deafe2a0b08ae4fac8a35b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339826,10 +336908,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_C_Sharp_R_A_T_Client : FILE
 		$typelibguid0up = "6D9E8852-E86C-4E36-9CB4-B3C3853ED6B8" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpprinter : FILE
 {
 	meta:
@@ -339839,9 +336919,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpprinter : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/rvrsh3ll/SharpPrinter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3617-L3631"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "db7f131fa38756d53681792f3de2af44ace768e66c5318f61fa199900a8cdb8e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3617-L3631"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_db7f131fa38756d53681792f3de2af44ace768e66c5318f61fa199900a8cdb8e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339852,10 +336932,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpprinter : FILE
 		$typelibguid0up = "41B2D1E5-4C5D-444C-AA47-629955401ED9" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Evilfoca : FILE
 {
 	meta:
@@ -339865,9 +336943,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Evilfoca : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/ElevenPaths/EvilFOCA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3633-L3647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d3302781414e5146ee8b5d7d2df8aa5d4be31308b7483200eb695e0c0048c279"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3633-L3647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d3302781414e5146ee8b5d7d2df8aa5d4be31308b7483200eb695e0c0048c279"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339878,10 +336956,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Evilfoca : FILE
 		$typelibguid0up = "F26BDB4A-5846-4BEC-8F52-3C39D32DF495" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Poshc2_Misc : FILE
 {
 	meta:
@@ -339891,9 +336967,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Poshc2_Misc : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/nettitude/PoshC2_Misc"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3649-L3665"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b6cabc8a50db469162024b13df8d69f57ca5ec008bddc647aee2a73dff9942c8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3649-L3665"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b6cabc8a50db469162024b13df8d69f57ca5ec008bddc647aee2a73dff9942c8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339906,10 +336982,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Poshc2_Misc : FILE
 		$typelibguid1up = "9D32AD59-4093-420D-B45C-5FFF391E990D" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpire : FILE
 {
 	meta:
@@ -339919,9 +336993,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpire : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xbadjuju/Sharpire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3667-L3681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f8ddf85c279c6ea4a2db679a0d5c816837e8bd91f1f6e15787dd34463483fc85"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3667-L3681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f8ddf85c279c6ea4a2db679a0d5c816837e8bd91f1f6e15787dd34463483fc85"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339932,10 +337006,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpire : FILE
 		$typelibguid0up = "39B75120-07FE-4833-A02E-579FF8B68331" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Smbexec : FILE
 {
 	meta:
@@ -339945,9 +337017,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Smbexec : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/checkymander/Sharp-SMBExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3683-L3697"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e9e248c4ac359a098f1ef26dc300e38836f070545db182a0b72a6eaf9bf003da"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3683-L3697"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e9e248c4ac359a098f1ef26dc300e38836f070545db182a0b72a6eaf9bf003da"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339958,10 +337030,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Smbexec : FILE
 		$typelibguid0up = "344EE55A-4E32-46F2-A003-69AD52B55945" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Misctools : FILE
 {
 	meta:
@@ -339971,9 +337041,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Misctools : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/rasta-mouse/MiscTools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3699-L3721"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "551c11eb44007cefd7e588fa97659cea44cf64b32a2e061aab425aa4a67583ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3699-L3721"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_551c11eb44007cefd7e588fa97659cea44cf64b32a2e061aab425aa4a67583ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -339992,10 +337062,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Misctools : FILE
 		$typelibguid4up = "49A6719E-11A8-46E6-AD7A-1DB1BE9FEA37" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Memorymapper : FILE
 {
 	meta:
@@ -340005,9 +337073,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Memorymapper : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/jasondrawdy/MemoryMapper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3723-L3737"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ccdb8501b0f26aca352a13d5337d64c2eccff695bd052bd10bcd324c62c931e5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3723-L3737"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ccdb8501b0f26aca352a13d5337d64c2eccff695bd052bd10bcd324c62c931e5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340018,10 +337086,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Memorymapper : FILE
 		$typelibguid0up = "B9FBF3AC-05D8-4CD5-9694-B224D4E6C0EA" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Vanillarat : FILE
 {
 	meta:
@@ -340031,9 +337097,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Vanillarat : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/DannyTheSloth/VanillaRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3739-L3755"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4241cbbf7cde175b6dfd27b59123e5e324f4356184dae07529dd021c0f3dbea9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3739-L3755"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4241cbbf7cde175b6dfd27b59123e5e324f4356184dae07529dd021c0f3dbea9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340046,10 +337112,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Vanillarat : FILE
 		$typelibguid1up = "A593FCD2-C8AB-45F6-9AEB-8AB5E20AB402" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Unmanagedpowershell : FILE
 {
 	meta:
@@ -340059,9 +337123,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Unmanagedpowershell : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/leechristensen/UnmanagedPowerShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3757-L3771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "26e59a31b1021c6e65711ee8d58cfdf3e1a8563b91f0f55722e1306854103ac6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3757-L3771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_26e59a31b1021c6e65711ee8d58cfdf3e1a8563b91f0f55722e1306854103ac6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340072,10 +337136,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Unmanagedpowershell : FILE
 		$typelibguid0up = "DFC4EEBB-7384-4DB5-9BAD-257203029BD9" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Quasar : FILE
 {
 	meta:
@@ -340085,9 +337147,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Quasar : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/quasar/Quasar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3773-L3789"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "752602eecc404757f029aea481a58dc5b3d4c80f53fea1281e1ab8a78476d416"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3773-L3789"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_752602eecc404757f029aea481a58dc5b3d4c80f53fea1281e1ab8a78476d416"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340100,10 +337162,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Quasar : FILE
 		$typelibguid1up = "C7C363BA-E5B6-4E18-9224-39BC8DA73172" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpadidnsdump : FILE
 {
 	meta:
@@ -340113,9 +337173,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpadidnsdump : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/b4rtik/SharpAdidnsdump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3791-L3805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fe1bfdd03fabe40c2b885121de343890dd7eea22b51e9a1133d0842ba1080c78"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3791-L3805"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fe1bfdd03fabe40c2b885121de343890dd7eea22b51e9a1133d0842ba1080c78"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340126,10 +337186,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpadidnsdump : FILE
 		$typelibguid0up = "CDB02BC2-5F62-4C8A-AF69-ACC3AB82E741" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript : FILE
 {
 	meta:
@@ -340139,9 +337197,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/tyranid/DotNetToJScript"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3807-L3821"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ddaa4e3dac9d98f3aba0eff7a968a7599c2901ec8b668c5e1115ac67a0a77f30"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3807-L3821"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ddaa4e3dac9d98f3aba0eff7a968a7599c2901ec8b668c5e1115ac67a0a77f30"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340152,10 +337210,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript : FILE
 		$typelibguid0up = "7E3F231C-0D0B-4025-812C-0EF099404861" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Inferno : FILE
 {
 	meta:
@@ -340165,9 +337221,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Inferno : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/LimerBoy/Inferno"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3823-L3837"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a3255a00a1c2773d34e9e859c3394752ea6bfc164c4694a001c9a1c9b384756b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3823-L3837"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a3255a00a1c2773d34e9e859c3394752ea6bfc164c4694a001c9a1c9b384756b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340178,10 +337234,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Inferno : FILE
 		$typelibguid0up = "26D498F7-37AE-476C-97B0-3761E3A919F0" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsearch : FILE
 {
 	meta:
@@ -340191,9 +337245,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsearch : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/djhohnstein/SharpSearch"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3839-L3853"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b213a12913abb631d67bf53049241a7087e3f9cda01fa66bd6c51bb1bd03c41f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3839-L3853"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b213a12913abb631d67bf53049241a7087e3f9cda01fa66bd6c51bb1bd03c41f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340204,10 +337258,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsearch : FILE
 		$typelibguid0up = "98FEE742-8410-4F20-8B2D-D7D789AB003D" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsecdump : FILE
 {
 	meta:
@@ -340217,9 +337269,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsecdump : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/G0ldenGunSec/SharpSecDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3855-L3869"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "645e2df929b88526daec94f5b828235899fe0c86822960777664f11106b8da8c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3855-L3869"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_645e2df929b88526daec94f5b828235899fe0c86822960777664f11106b8da8c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340230,10 +337282,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsecdump : FILE
 		$typelibguid0up = "E2FDD6CC-9886-456C-9021-EE2C47CF67B7" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Net_Gpppassword : FILE
 {
 	meta:
@@ -340243,9 +337293,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Net_Gpppassword : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/outflanknl/Net-GPPPassword"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3871-L3885"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "234f75bfcb9aee331f063bd7c1984a2696067400fde7a1938a4929cd809b1345"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3871-L3885"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_234f75bfcb9aee331f063bd7c1984a2696067400fde7a1938a4929cd809b1345"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340256,10 +337306,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Net_Gpppassword : FILE
 		$typelibguid0up = "00FCF72C-D148-4DD0-9CA4-0181C4BD55C3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Filesearcher : FILE
 {
 	meta:
@@ -340269,9 +337317,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Filesearcher : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/NVISO-BE/FileSearcher"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3887-L3901"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "71492c6d4c1104cf47484556dc8ed1099348043102a4b7a9b1ffd180422078af"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3887-L3901"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_71492c6d4c1104cf47484556dc8ed1099348043102a4b7a9b1ffd180422078af"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340282,10 +337330,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Filesearcher : FILE
 		$typelibguid0up = "2C879479-5027-4CE9-AAAC-084DB0E6D630" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Adfsdump : FILE
 {
 	meta:
@@ -340295,9 +337341,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Adfsdump : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/fireeye/ADFSDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3903-L3917"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5bf4c506a39a3ad33a19ab40ce85e6fb7c7efeab154444b14f008c22529b0779"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3903-L3917"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5bf4c506a39a3ad33a19ab40ce85e6fb7c7efeab154444b14f008c22529b0779"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340308,10 +337354,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Adfsdump : FILE
 		$typelibguid0up = "9EE27D63-6AC9-4037-860B-44E91BAE7F0D" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprdp : FILE
 {
 	meta:
@@ -340321,9 +337365,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprdp : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/0xthirteen/SharpRDP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3919-L3933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c1a51c556c3416095764d3e053d82081409cdd672db05b8680a985ec52bd24b8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3919-L3933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c1a51c556c3416095764d3e053d82081409cdd672db05b8680a985ec52bd24b8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340334,10 +337378,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprdp : FILE
 		$typelibguid0up = "F1DF1D0F-FF86-4106-97A8-F95AAF525C54" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcall : FILE
 {
 	meta:
@@ -340347,9 +337389,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcall : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/jhalon/SharpCall"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3935-L3949"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7084ac8956827fff5baefb92e117e0c64f13ab8f77cb5d034c31d874a6297047"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3935-L3949"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7084ac8956827fff5baefb92e117e0c64f13ab8f77cb5d034c31d874a6297047"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340360,10 +337402,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcall : FILE
 		$typelibguid0up = "C1B0A923-0F17-4BC8-BA0F-C87AFF43E799" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Ysoserial_Net : FILE
 {
 	meta:
@@ -340373,9 +337413,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ysoserial_Net : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/pwntester/ysoserial.net"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3951-L3967"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e423b73cd2dd2374a95ad0a36cd34d8d5b4d1085d708781857ea3893b31b22fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3951-L3967"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e423b73cd2dd2374a95ad0a36cd34d8d5b4d1085d708781857ea3893b31b22fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340388,10 +337428,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ysoserial_Net : FILE
 		$typelibguid1up = "6B40FDE7-14EA-4F57-8B7B-CC2EB4A25E6C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Managedinjection : FILE
 {
 	meta:
@@ -340401,9 +337439,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Managedinjection : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/malcomvetter/ManagedInjection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3969-L3987"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "218fe8a52757def3c321668ecaaca3cb0966bad4e151083c08a98276abf71571"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3969-L3987"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_218fe8a52757def3c321668ecaaca3cb0966bad4e151083c08a98276abf71571"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340418,10 +337456,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Managedinjection : FILE
 		$typelibguid2up = "0DD00561-AFFC-4066-8C48-CE950788C3C8" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsocks : FILE
 {
 	meta:
@@ -340431,9 +337467,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsocks : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/nettitude/SharpSocks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L3989-L4005"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ef582f9ba7b49795886c69a48cf9ac11e86fb99c19463f0770f3e9c1e3e2e0c6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L3989-L4005"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ef582f9ba7b49795886c69a48cf9ac11e86fb99c19463f0770f3e9c1e3e2e0c6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340446,10 +337482,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsocks : FILE
 		$typelibguid1up = "86D10A34-C374-4DE4-8E12-490E5E65DDFF" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Wmiexec : FILE
 {
 	meta:
@@ -340459,9 +337493,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Wmiexec : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/checkymander/Sharp-WMIExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4007-L4021"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c5f515ac8db4cca0b29b6d27ad27fa1d4215de48d4827c083f755e88671b87e0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4007-L4021"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c5f515ac8db4cca0b29b6d27ad27fa1d4215de48d4827c083f755e88671b87e0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340472,10 +337506,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Wmiexec : FILE
 		$typelibguid0up = "0A63B0A1-7D1A-4B84-81C3-BBBFE9913029" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Keethief : FILE
 {
 	meta:
@@ -340485,9 +337517,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Keethief : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/KeeThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4023-L4046"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "032f0453dc8e235b9326705c619929135cfc71840ab39669ae21c14b93568c75"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4023-L4046"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_032f0453dc8e235b9326705c619929135cfc71840ab39669ae21c14b93568c75"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340506,10 +337538,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Keethief : FILE
 		$typelibguid7up = "80BA63A4-7D41-40E9-A722-6DD58B28BF7E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Fakelogonscreen : FILE
 {
 	meta:
@@ -340519,9 +337549,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Fakelogonscreen : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/bitsadmin/fakelogonscreen"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4048-L4062"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4f7f2c075860994b29a211b3cb30fa75b7b6e3ac60a68bbaa9ecf7e4467b4ed0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4048-L4062"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4f7f2c075860994b29a211b3cb30fa75b7b6e3ac60a68bbaa9ecf7e4467b4ed0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340532,10 +337562,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Fakelogonscreen : FILE
 		$typelibguid0up = "D35A55BD-3189-498B-B72F-DC798172E505" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Poshsecframework : FILE
 {
 	meta:
@@ -340545,9 +337573,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Poshsecframework : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/PoshSec/PoshSecFramework"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4064-L4080"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e0a35f5fc7a4c4ae8f09c7d4833faf55061984f9a7a920ec4219f04381f2053a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4064-L4080"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e0a35f5fc7a4c4ae8f09c7d4833faf55061984f9a7a920ec4219f04381f2053a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340560,10 +337588,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Poshsecframework : FILE
 		$typelibguid1up = "78BFCFC2-EF1C-4514-BCE6-934B251666D2" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpattack : FILE
 {
 	meta:
@@ -340573,9 +337599,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpattack : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/jaredhaight/SharpAttack"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4082-L4096"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2103b98f188d74c340d6ca71590be32c04cadba893882aebf4e22f5046ae4bc9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4082-L4096"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2103b98f188d74c340d6ca71590be32c04cadba893882aebf4e22f5046ae4bc9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340586,10 +337612,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpattack : FILE
 		$typelibguid0up = "5F0CECA3-5997-406C-ADF5-6C7FBB6CBA17" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Altman : FILE
 {
 	meta:
@@ -340599,9 +337623,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Altman : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/keepwn/Altman"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4098-L4146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5ef32e351094f26bdaa87043b9ff202c25c67e6cd13935c3eb1ab7b4420b867c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4098-L4146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5ef32e351094f26bdaa87043b9ff202c25c67e6cd13935c3eb1ab7b4420b867c"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -340646,10 +337670,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Altman : FILE
 		$typelibguid17up = "714AE6F3-0D03-4023-B753-FED6A31D95C7" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Browserpass : FILE
 {
 	meta:
@@ -340659,9 +337681,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Browserpass : FILE
 		date = "2020-12-28"
 		modified = "2023-04-06"
 		reference = "https://github.com/jabiel/BrowserPass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4148-L4162"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "70414002857991016ebd01889d6346b32a553525e06556f5273e53753c3caccc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4148-L4162"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_70414002857991016ebd01889d6346b32a553525e06556f5273e53753c3caccc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340672,10 +337694,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Browserpass : FILE
 		$typelibguid0up = "3CB59871-0DCE-453B-857A-2D1E515B0B66" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Mythic : FILE
 {
 	meta:
@@ -340685,9 +337705,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Mythic : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/its-a-feature/Mythic"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4164-L4180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f75bb7695d0de67f562e1c1d7505e0f13e9192ccd7bf6f2128897f4a871430be"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4164-L4180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f75bb7695d0de67f562e1c1d7505e0f13e9192ccd7bf6f2128897f4a871430be"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340700,10 +337720,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Mythic : FILE
 		$typelibguid1up = "0405205C-C2A0-4F9A-A221-48B5C70DF3B6" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Nuages : FILE
 {
 	meta:
@@ -340713,9 +337731,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nuages : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/p3nt4/Nuages"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4182-L4196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf417eb45867b6fe77cf229688b3c210814a902949840ed946a9d9cff8c8a3d7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4182-L4196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf417eb45867b6fe77cf229688b3c210814a902949840ed946a9d9cff8c8a3d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340726,10 +337744,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nuages : FILE
 		$typelibguid0up = "E9E80AC7-4C13-45BD-9BDE-CA89AADF1294" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsniper : FILE
 {
 	meta:
@@ -340739,9 +337755,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsniper : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/HunnicCyber/SharpSniper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4198-L4212"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5c2c67c24a8ad6ecfac03e9f5bad0731883503d974bf7a0ab313e31c30190fb5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4198-L4212"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5c2c67c24a8ad6ecfac03e9f5bad0731883503d974bf7a0ab313e31c30190fb5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340752,10 +337768,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsniper : FILE
 		$typelibguid0up = "C8BB840C-04CE-4B60-A734-FAF15ABF7B18" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphound3 : FILE
 {
 	meta:
@@ -340765,9 +337779,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphound3 : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/BloodHoundAD/SharpHound3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4214-L4228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0350505aa796cccc56092fb835269c5aad6de0096bbfc5d1608113e11827951a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4214-L4228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0350505aa796cccc56092fb835269c5aad6de0096bbfc5d1608113e11827951a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340778,10 +337792,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphound3 : FILE
 		$typelibguid0up = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Blocketw : FILE
 {
 	meta:
@@ -340791,9 +337803,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Blocketw : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/Soledge/BlockEtw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4230-L4244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4670091775772f66e82dd7c78ac8f307d301ce849424dabcaf495c46cd737d7f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4230-L4244"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4670091775772f66e82dd7c78ac8f307d301ce849424dabcaf495c46cd737d7f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340804,10 +337816,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Blocketw : FILE
 		$typelibguid0up = "DAEDF7B3-8262-4892-ADC4-425DD5F85BCA" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwifigrabber : FILE
 {
 	meta:
@@ -340817,9 +337827,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwifigrabber : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/r3nhat/SharpWifiGrabber"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4246-L4260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1924847602c4075779697f8b74dee48738f2a4e7852b2431c128e677f6c04407"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4246-L4260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1924847602c4075779697f8b74dee48738f2a4e7852b2431c128e677f6c04407"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340830,10 +337840,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwifigrabber : FILE
 		$typelibguid0up = "C0997698-2B73-4982-B25B-D0578D1323C2" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmapexec : FILE
 {
 	meta:
@@ -340843,9 +337851,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmapexec : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/cube0x0/SharpMapExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4262-L4276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49055d7159cf93e99b8e4ac53c29a66952955fa10457e7beca8e5e0277acec36"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4262-L4276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49055d7159cf93e99b8e4ac53c29a66952955fa10457e7beca8e5e0277acec36"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340856,10 +337864,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmapexec : FILE
 		$typelibguid0up = "BD5220F7-E1FB-41D2-91EC-E4C50C6E9B9F" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_K8Fly : FILE
 {
 	meta:
@@ -340869,9 +337875,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_K8Fly : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/zzwlpx/k8fly"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4278-L4292"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "16e9707f017aedf412ec98a466ec945e630ec1e294ee97e52a918d54be93db91"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4278-L4292"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_16e9707f017aedf412ec98a466ec945e630ec1e294ee97e52a918d54be93db91"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340882,10 +337888,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_K8Fly : FILE
 		$typelibguid0up = "13B6C843-F3D4-4585-B4F3-E2672A47931E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Stealer : FILE
 {
 	meta:
@@ -340895,9 +337899,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stealer : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/malwares/Stealer"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4294-L4312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "541836ece736557383d209a424a0fa9fb9df69a669d8f1cf8d1bdb41bd27af57"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4294-L4312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_541836ece736557383d209a424a0fa9fb9df69a669d8f1cf8d1bdb41bd27af57"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340912,10 +337916,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stealer : FILE
 		$typelibguid2up = "D3D8A1CC-E123-4905-B3DE-374749122FCF" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Porttran : FILE
 {
 	meta:
@@ -340925,9 +337927,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Porttran : FILE
 		date = "2020-12-29"
 		modified = "2023-04-06"
 		reference = "https://github.com/k8gege/PortTran"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4314-L4330"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9dda69710b7ff29e34181d694a4922f0da27e1959dd72031ac630a4851a48c62"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4314-L4330"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9dda69710b7ff29e34181d694a4922f0da27e1959dd72031ac630a4851a48c62"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340940,10 +337942,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Porttran : FILE
 		$typelibguid1up = "67A73BAC-F59D-4227-9220-E20A2EF42782" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Gray_Keylogger_2 : FILE
 {
 	meta:
@@ -340953,9 +337953,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gray_Keylogger_2 : FILE
 		date = "2020-12-30"
 		modified = "2023-04-06"
 		reference = "https://github.com/graysuit/gray-keylogger-2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4333-L4349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb7cbfcc7d57298d3ce325596834e94f3594bafb0273e9f81715114b21af6371"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4333-L4349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb7cbfcc7d57298d3ce325596834e94f3594bafb0273e9f81715114b21af6371"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340968,10 +337968,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gray_Keylogger_2 : FILE
 		$typelibguid1up = "1ED07564-B411-4626-88E5-E1CD8ECD860A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Miner : FILE
 {
 	meta:
@@ -340981,9 +337979,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Miner : FILE
 		date = "2020-12-30"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4351-L4365"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "57d75144415518c24e2a24fa933e9e205513e16c2ec062b2a3c715a0fa6415db"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4351-L4365"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_57d75144415518c24e2a24fa933e9e205513e16c2ec062b2a3c715a0fa6415db"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -340994,10 +337992,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Miner : FILE
 		$typelibguid0up = "13958FB9-DFC1-4E2C-8A8D-A5E68ABDBC66" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Blacknet : FILE
 {
 	meta:
@@ -341007,9 +338003,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Blacknet : FILE
 		date = "2020-12-30"
 		modified = "2023-04-06"
 		reference = "https://github.com/BlackHacker511/BlackNET"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4367-L4387"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a64b8d7d73292675e86ff73a0548582af36a6ed3c37fec52a3d2e012c49b9aa8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4367-L4387"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a64b8d7d73292675e86ff73a0548582af36a6ed3c37fec52a3d2e012c49b9aa8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341026,10 +338022,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Blacknet : FILE
 		$typelibguid3up = "9AC18CDC-3711-4719-9CFB-5B5F2D51FD5A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Plasmarat : FILE
 {
 	meta:
@@ -341039,9 +338033,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Plasmarat : FILE
 		date = "2020-12-30"
 		modified = "2023-04-06"
 		reference = "https://github.com/mwsrc/PlasmaRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4389-L4405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4474f0c9d76a6ec1dd754b0b9ba0bcedce3f82148ecddcdcc4d040220c407788"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4389-L4405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4474f0c9d76a6ec1dd754b0b9ba0bcedce3f82148ecddcdcc4d040220c407788"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341054,10 +338048,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Plasmarat : FILE
 		$typelibguid1up = "0FCFDE33-213F-4FB6-AC15-EFB20393D4F3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_RAT : FILE
 {
 	meta:
@@ -341067,9 +338059,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_RAT : FILE
 		date = "2020-12-30"
 		modified = "2023-04-06"
 		reference = "https://github.com/NYAN-x-CAT/Lime-RAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4407-L4461"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dfe208c2962c03c14ff21f5936f476ee75ebd5f1464d26e5da0e66d6e995716d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4407-L4461"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dfe208c2962c03c14ff21f5936f476ee75ebd5f1464d26e5da0e66d6e995716d"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -341120,10 +338112,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_RAT : FILE
 		$typelibguid20up = "927104E1-AA17-4167-817C-7673FE26D46E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Njrat : FILE
 {
 	meta:
@@ -341133,9 +338123,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Njrat : FILE
 		date = "2020-12-30"
 		modified = "2023-04-06"
 		reference = "https://github.com/mwsrc/njRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4463-L4487"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "739914bf21b1ac198e904b50986e28a50e53044696dafa777149f18f024beb5e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4463-L4487"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_739914bf21b1ac198e904b50986e28a50e53044696dafa777149f18f024beb5e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341156,10 +338146,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Njrat : FILE
 		$typelibguid5up = "CB3C28B2-2A4F-4114-941C-CE929FEC94D3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Manager : FILE
 {
 	meta:
@@ -341169,9 +338157,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Manager : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/TheWover/Manager"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4489-L4505"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb6ef79b7430f0d7892c8c2819bc0d6f9493e0c74ca475b9f82b28a6b565dfb8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4489-L4505"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb6ef79b7430f0d7892c8c2819bc0d6f9493e0c74ca475b9f82b28a6b565dfb8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341184,10 +338172,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Manager : FILE
 		$typelibguid1up = "6A0F2422-D4D1-4B7E-84AD-56DC0FD2DFC5" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Neo_Confuserex : FILE
 {
 	meta:
@@ -341197,9 +338183,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Neo_Confuserex : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/XenocodeRCE/neo-ConfuserEx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4507-L4521"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2394b2a7098b284b18bf9fcda6ca26b34ae0143f8bd146578cc9c2d68df0741c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4507-L4521"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2394b2a7098b284b18bf9fcda6ca26b34ae0143f8bd146578cc9c2d68df0741c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341210,10 +338196,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Neo_Confuserex : FILE
 		$typelibguid0up = "E98490BB-63E5-492D-B14E-304DE928F81A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpallowedtoact : FILE
 {
 	meta:
@@ -341223,9 +338207,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpallowedtoact : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/pkb1s/SharpAllowedToAct"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4523-L4537"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "872f4d70f7cefff8c1fadbe61d858c898a259559889ca4951f5368589d28169d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4523-L4537"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_872f4d70f7cefff8c1fadbe61d858c898a259559889ca4951f5368589d28169d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341236,10 +338220,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpallowedtoact : FILE
 		$typelibguid0up = "DAC5448A-4AD1-490A-846A-18E4E3E0CF9A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Supersqlinjectionv1 : FILE
 {
 	meta:
@@ -341249,9 +338231,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Supersqlinjectionv1 : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/shack2/SuperSQLInjectionV1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4539-L4553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8e97bf351c4c7507f3cf40a2d7aa36c60906a8069bb3644ce6ef05911a4d9a5c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4539-L4553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8e97bf351c4c7507f3cf40a2d7aa36c60906a8069bb3644ce6ef05911a4d9a5c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341262,10 +338244,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Supersqlinjectionv1 : FILE
 		$typelibguid0up = "D5688068-FC89-467D-913F-037A785CACA7" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Adsearch : FILE
 {
 	meta:
@@ -341275,9 +338255,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Adsearch : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/tomcarver16/ADSearch"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4555-L4569"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a35da6c6a396669928693b7d408f7d1021a7afc41dabfe521105254d69f23474"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4555-L4569"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a35da6c6a396669928693b7d408f7d1021a7afc41dabfe521105254d69f23474"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341288,10 +338268,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Adsearch : FILE
 		$typelibguid0up = "4DA5F1B7-8936-4413-91F7-57D6E072B4A7" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation_Awesome_Scripts_Suite : FILE
 {
 	meta:
@@ -341301,9 +338279,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation_Awesome_Scripts_Suite : F
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4571-L4585"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a70cfe807cbba80e0bc79adcb7268b2c9b99c20c5f7454e2275712a1adbeb16c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4571-L4585"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a70cfe807cbba80e0bc79adcb7268b2c9b99c20c5f7454e2275712a1adbeb16c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341314,10 +338292,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation_Awesome_Scripts_Suite : F
 		$typelibguid0up = "1928358E-A64B-493F-A741-AE8E3D029374" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1206_POC : FILE
 {
 	meta:
@@ -341327,9 +338303,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1206_POC : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/ZecOps/CVE-2020-1206-POC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4587-L4605"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2e6ae824a98945e75cb57ee64c6622aff498201b64b7a24424990e84406176a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4587-L4605"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2e6ae824a98945e75cb57ee64c6622aff498201b64b7a24424990e84406176a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341344,10 +338320,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1206_POC : FILE
 		$typelibguid2up = "FB30EE05-4A35-45F7-9A0A-829AEC7E47D9" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke : FILE
 {
 	meta:
@@ -341357,9 +338331,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/TheWover/DInvoke"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4607-L4621"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3fac2563205327a173814141c035c8be78d43d8409db34954ac6027b3039d7c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4607-L4621"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3fac2563205327a173814141c035c8be78d43d8409db34954ac6027b3039d7c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341370,10 +338344,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke : FILE
 		$typelibguid0up = "B77FDAB5-207C-4CDB-B1AA-348505C54229" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchisel : FILE
 {
 	meta:
@@ -341383,9 +338355,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchisel : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/shantanu561993/SharpChisel"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4623-L4637"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9df151164aa269c13a79d862c15cc75bd0bb4668753f282149c162bd63ece471"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4623-L4637"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9df151164aa269c13a79d862c15cc75bd0bb4668753f282149c162bd63ece471"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341396,10 +338368,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchisel : FILE
 		$typelibguid0up = "F5F21E2D-EB7E-4146-A7E1-371FD08D6762" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpscribbles : FILE
 {
 	meta:
@@ -341409,9 +338379,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpscribbles : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/V1V1/SharpScribbles"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4639-L4655"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7b592dc541b708e001f2576d9eb412ecc52879d514149e9f211f6357faff92fc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4639-L4655"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7b592dc541b708e001f2576d9eb412ecc52879d514149e9f211f6357faff92fc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341424,10 +338394,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpscribbles : FILE
 		$typelibguid1up = "0DC1B824-C6E7-4881-8788-35AECB34D227" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpreg : FILE
 {
 	meta:
@@ -341437,9 +338405,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpreg : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/jnqpblc/SharpReg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4657-L4671"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dfe9189c215c090bc32dedfb0d01964409265a4da4e4f8c4a2ed9ee62b1c9b30"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4657-L4671"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dfe9189c215c090bc32dedfb0d01964409265a4da4e4f8c4a2ed9ee62b1c9b30"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341450,10 +338418,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpreg : FILE
 		$typelibguid0up = "8EF25B00-ED6A-4464-BDEC-17281A4AA52F" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Memevm : FILE
 {
 	meta:
@@ -341463,9 +338429,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Memevm : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/TobitoFatitoRE/MemeVM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4673-L4691"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7430b5d82012fc63459d97a21d93260ccda7ac8249bf4b56384e3b0ab6b5548a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4673-L4691"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7430b5d82012fc63459d97a21d93260ccda7ac8249bf4b56384e3b0ab6b5548a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341480,10 +338446,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Memevm : FILE
 		$typelibguid2up = "14D5D12E-9A32-4516-904E-DF3393626317" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdir : FILE
 {
 	meta:
@@ -341493,9 +338457,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdir : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/jnqpblc/SharpDir"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4693-L4707"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "23eb7b88f9685457a6cdaa8161fcbc6ea60634a4f01c67a4a1307618a6f8fa14"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4693-L4707"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_23eb7b88f9685457a6cdaa8161fcbc6ea60634a4f01c67a4a1307618a6f8fa14"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341506,10 +338470,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdir : FILE
 		$typelibguid0up = "C7A07532-12A3-4F6A-A342-161BB060B789" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Atyourservice : FILE
 {
 	meta:
@@ -341519,9 +338481,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Atyourservice : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/mitchmoser/AtYourService"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4709-L4723"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3e473ebb7e01cdc2edb9a20ba5ace39fd69629fb04d83510bc7855696c9ae581"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4709-L4723"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3e473ebb7e01cdc2edb9a20ba5ace39fd69629fb04d83510bc7855696c9ae581"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341532,10 +338494,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Atyourservice : FILE
 		$typelibguid0up = "BC72386F-8B4C-44DE-99B7-B06A8DE3CE3F" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Lockless : FILE
 {
 	meta:
@@ -341545,9 +338505,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lockless : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/LockLess"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4725-L4739"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b3f929e2a7ee7f3b82cafcffe89572e210ca817edeb261810b9a2191ba308c3d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4725-L4739"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b3f929e2a7ee7f3b82cafcffe89572e210ca817edeb261810b9a2191ba308c3d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341558,10 +338518,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lockless : FILE
 		$typelibguid0up = "A91421CB-7909-4383-BA43-C2992BBBAC22" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Easynet : FILE
 {
 	meta:
@@ -341571,9 +338529,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Easynet : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/TheWover/EasyNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4741-L4759"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e8502f3d178897f17cdaab0608b5605aeb9161c42779a9d9c1477a5663dd24a1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4741-L4759"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e8502f3d178897f17cdaab0608b5605aeb9161c42779a9d9c1477a5663dd24a1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341588,10 +338546,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Easynet : FILE
 		$typelibguid2up = "37D6DD3F-5457-4D8B-A2E1-C7B156B176E5" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbyebear : FILE
 {
 	meta:
@@ -341601,9 +338557,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbyebear : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/S3cur3Th1sSh1t/SharpByeBear"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4761-L4777"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c6d9fd33dd8d7bddd9e80e3c0106f0cab13f0952bb8269a10df147c06a5bd7ba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4761-L4777"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c6d9fd33dd8d7bddd9e80e3c0106f0cab13f0952bb8269a10df147c06a5bd7ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341616,10 +338572,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbyebear : FILE
 		$typelibguid1up = "3E82F538-6336-4FFF-AEEC-E774676205DA" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphide : FILE
 {
 	meta:
@@ -341629,9 +338583,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphide : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/outflanknl/SharpHide"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4779-L4793"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3efa5458dcdf447184b91f8fa075c46c82aea25d619c43eabccce4d85ff15f38"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4779-L4793"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3efa5458dcdf447184b91f8fa075c46c82aea25d619c43eabccce4d85ff15f38"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341642,10 +338596,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphide : FILE
 		$typelibguid0up = "443D8CBF-899C-4C22-B4F6-B7AC202D4E37" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsvc : FILE
 {
 	meta:
@@ -341655,9 +338607,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsvc : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/jnqpblc/SharpSvc"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4795-L4809"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "61a4269200c699c5d00bde40e11cfec92da5cf7c7aeaffaedf60e70bcb31ccdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4795-L4809"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_61a4269200c699c5d00bde40e11cfec92da5cf7c7aeaffaedf60e70bcb31ccdf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341668,10 +338620,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsvc : FILE
 		$typelibguid0up = "52856B03-5ACD-45E0-828E-13CCB16942D1" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcrasheventlog : FILE
 {
 	meta:
@@ -341681,9 +338631,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcrasheventlog : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/slyd0g/SharpCrashEventLog"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4811-L4825"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5f286244243024d23a6a27e5713a7ecedef9028b317d5827f35254a35e6c5473"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4811-L4825"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5f286244243024d23a6a27e5713a7ecedef9028b317d5827f35254a35e6c5473"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341694,10 +338644,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcrasheventlog : FILE
 		$typelibguid0up = "98CB495F-4D47-4722-B08F-CEFAB2282B18" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript_Languagemodebreakout : FILE
 {
 	meta:
@@ -341707,9 +338655,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript_Languagemodebreakout : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4827-L4841"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1f1651b896e62ee669e233403a9fb435adfb4f8965b6432452a1bb72b69bfe2c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4827-L4841"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1f1651b896e62ee669e233403a9fb435adfb4f8965b6432452a1bb72b69bfe2c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341720,10 +338668,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript_Languagemodebreakout : FILE
 		$typelibguid0up = "DEADB33F-FA94-41B5-813D-E72D8677A0CF" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpermission : FILE
 {
 	meta:
@@ -341733,9 +338679,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpermission : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/mitchmoser/SharPermission"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4843-L4857"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c22923057099a6a796cab36838728c0ae51a1c2a6f06c4a0c07415baadac6978"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4843-L4857"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c22923057099a6a796cab36838728c0ae51a1c2a6f06c4a0c07415baadac6978"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341746,10 +338692,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpermission : FILE
 		$typelibguid0up = "84D2B661-3267-49C8-9F51-8F72F21AEA47" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Registrystrikesback : FILE
 {
 	meta:
@@ -341759,9 +338703,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Registrystrikesback : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/mdsecactivebreach/RegistryStrikesBack"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4859-L4873"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa228e65f6bada1811c83528af8119b5336ebbc2381d5edef35c749ddff02487"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4859-L4873"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa228e65f6bada1811c83528af8119b5336ebbc2381d5edef35c749ddff02487"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341772,10 +338716,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Registrystrikesback : FILE
 		$typelibguid0up = "90EBD469-D780-4431-9BD8-014B00057665" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Clonevault : FILE
 {
 	meta:
@@ -341785,9 +338727,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Clonevault : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/mdsecactivebreach/CloneVault"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4875-L4889"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b8a2be082e2444ac9bfa9dd820e08de147c8dbfc0573e7126bde39f18b917bfd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4875-L4889"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b8a2be082e2444ac9bfa9dd820e08de147c8dbfc0573e7126bde39f18b917bfd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341798,10 +338740,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Clonevault : FILE
 		$typelibguid0up = "0A344F52-6780-4D10-9A4A-CB9439F9D3DE" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Donut : FILE
 {
 	meta:
@@ -341811,9 +338751,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Donut : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/TheWover/donut"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4891-L4911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cae0d358cda5330f69162aa3116d544f9ba16d37dcbcbf33f9938360b861b89a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4891-L4911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cae0d358cda5330f69162aa3116d544f9ba16d37dcbcbf33f9938360b861b89a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341830,10 +338770,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Donut : FILE
 		$typelibguid3up = "361C69F5-7885-4931-949A-B91EEAB170E3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphandler : FILE
 {
 	meta:
@@ -341843,9 +338781,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphandler : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/jfmaes/SharpHandler"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4913-L4929"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "70e8c495c8a340e0afaa38faf0eb96101854a4dc51c29c571d9b74751aec91fd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4913-L4929"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_70e8c495c8a340e0afaa38faf0eb96101854a4dc51c29c571d9b74751aec91fd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341858,10 +338796,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphandler : FILE
 		$typelibguid1up = "11DC83C6-8186-4887-B228-9DC4FD281A23" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Driver_Template : FILE
 {
 	meta:
@@ -341871,9 +338807,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Driver_Template : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/FuzzySecurity/Driver-Template"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4931-L4945"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "533cefcc86ff8eff8757041df8acf2a9c484d265b6aa9516c12adb606d6f71cb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4931-L4945"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_533cefcc86ff8eff8757041df8acf2a9c484d265b6aa9516c12adb606d6f71cb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341884,10 +338820,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Driver_Template : FILE
 		$typelibguid0up = "BDB79AD6-639F-4DC2-8B8A-CD9107DA3D69" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Nashavm : FILE
 {
 	meta:
@@ -341897,9 +338831,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nashavm : FILE
 		date = "2021-01-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/Mrakovic-ORG/NashaVM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4947-L4961"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4046e8183ee2bcf95893f9a438f13aec9afa99e252029888830a0bf81dac2f6f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4947-L4961"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4046e8183ee2bcf95893f9a438f13aec9afa99e252029888830a0bf81dac2f6f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341910,10 +338844,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nashavm : FILE
 		$typelibguid0up = "F9E63498-6E92-4AFD-8C13-4F63A3D964C3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsqlpwn : FILE
 {
 	meta:
@@ -341923,9 +338855,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsqlpwn : FILE
 		date = "2022-11-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/lefayjey/SharpSQLPwn.git"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4963-L4977"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2015c80084199bfedebe1591f02ffad5f31218351148d8087789b82523a39baa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4963-L4977"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2015c80084199bfedebe1591f02ffad5f31218351148d8087789b82523a39baa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341936,10 +338868,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsqlpwn : FILE
 		$typelibguid0up = "C442EA6A-9AA1-4D9C-9C9D-7560A327089C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Group3R : FILE
 {
 	meta:
@@ -341949,9 +338879,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Group3R : FILE
 		date = "2022-11-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/Group3r/Group3r.git"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4979-L4995"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8ff62920395c8db7544ba0fb0dc0833892f89d0f8908bc3eee909ad1e012c84c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4979-L4995"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8ff62920395c8db7544ba0fb0dc0833892f89d0f8908bc3eee909ad1e012c84c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341964,10 +338894,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Group3R : FILE
 		$typelibguid1up = "CAA7AB97-F83B-432C-8F9C-C5F1530F59F7" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenstomp : FILE
 {
 	meta:
@@ -341977,9 +338905,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenstomp : FILE
 		date = "2022-11-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/MartinIngesen/TokenStomp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L4997-L5011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7bc49a8c654a6c6e3f0aa0378e91007c8ebdac90b536fbbfc123b09ff41eaa73"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L4997-L5011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7bc49a8c654a6c6e3f0aa0378e91007c8ebdac90b536fbbfc123b09ff41eaa73"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -341990,10 +338918,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenstomp : FILE
 		$typelibguid0up = "8AAC271F-9B0B-4DC3-8AA6-812BB7A57E7B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Krbrelay : FILE
 {
 	meta:
@@ -342003,9 +338929,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Krbrelay : FILE
 		date = "2022-11-21"
 		modified = "2023-04-06"
 		reference = "https://github.com/cube0x0/KrbRelay"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5013-L5029"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1cab7949f922e286ed68826cc8f0028cabdc10bd328398b6d2517ad467be50b8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5013-L5029"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1cab7949f922e286ed68826cc8f0028cabdc10bd328398b6d2517ad467be50b8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342018,10 +338944,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Krbrelay : FILE
 		$typelibguid1up = "3B47EEBC-0D33-4E0B-BAB5-782D2D3680AF" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sqlrecon : FILE
 {
 	meta:
@@ -342031,9 +338955,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sqlrecon : FILE
 		date = "2023-01-20"
 		modified = "2023-04-06"
 		reference = "https://github.com/skahwah/SQLRecon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5031-L5045"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fed5ef9d4702c463fd2f138f5e4cc0a1841fc329a2923afeca83f193bb6213ea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5031-L5045"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fed5ef9d4702c463fd2f138f5e4cc0a1841fc329a2923afeca83f193bb6213ea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342044,10 +338968,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sqlrecon : FILE
 		$typelibguid0up = "612C7C82-D501-417A-B8DB-73204FDFDA06" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Certify : FILE
 {
 	meta:
@@ -342057,10 +338979,10 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Certify : FILE
 		date = "2023-03-06"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/Certify"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5047-L5062"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5047-L5062"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "da585a8d4985082873cb86204d546d3f53668e034c61e42d247b11e92b5e8fc3"
-		logic_hash = "bd856a146f441f28d8190d29b3168794cf2b68292869858c763200ae529615da"
+		logic_hash = "v1_sha256_bd856a146f441f28d8190d29b3168794cf2b68292869858c763200ae529615da"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342071,10 +338993,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Certify : FILE
 		$typelibguid0up = "64524CA5-E4D0-41B3-ACC3-3BDBEFD40C97" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Aladdin : FILE
 {
 	meta:
@@ -342084,9 +339004,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aladdin : FILE
 		date = "2023-03-13"
 		modified = "2023-04-06"
 		reference = "https://github.com/nettitude/Aladdin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5064-L5082"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed23700de0e8d6527f64714b8c2e3a43c4a0798d710b67d6602b5d4ae276cbbd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5064-L5082"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed23700de0e8d6527f64714b8c2e3a43c4a0798d710b67d6602b5d4ae276cbbd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342101,10 +339021,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aladdin : FILE
 		$typelibguid2up = "32A91B0F-30CD-4C75-BE79-CCBD6345DE99" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpldaprelayscan : FILE
 {
 	meta:
@@ -342114,9 +339032,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpldaprelayscan : FILE
 		date = "2023-03-15"
 		modified = "2023-04-06"
 		reference = "https://github.com/klezVirus/SharpLdapRelayScan"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5084-L5098"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "853b8b7e797a4be85f5218ad2f54dd4a91812e9e53ad061ca3e849326a8f9189"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5084-L5098"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_853b8b7e797a4be85f5218ad2f54dd4a91812e9e53ad061ca3e849326a8f9189"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342127,10 +339045,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpldaprelayscan : FILE
 		$typelibguid0up = "A93EE706-A71C-4CC1-BF37-F26C27825B68" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Ldapsigncheck : FILE
 {
 	meta:
@@ -342140,9 +339056,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ldapsigncheck : FILE
 		date = "2023-03-15"
 		modified = "2023-04-06"
 		reference = "https://github.com/cube0x0/LdapSignCheck"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5100-L5114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c075fabcd39cecc2c5b5d706a1ac305bb75522b9d7f8c8cba11ca2d80da814a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5100-L5114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c075fabcd39cecc2c5b5d706a1ac305bb75522b9d7f8c8cba11ca2d80da814a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342153,10 +339069,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ldapsigncheck : FILE
 		$typelibguid0up = "21F398A9-BC35-4BD2-B906-866F21409744" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsccm : FILE
 {
 	meta:
@@ -342166,9 +339080,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsccm : FILE
 		date = "2023-03-15"
 		modified = "2023-04-06"
 		reference = "https://github.com/Mayyhem/SharpSCCM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5116-L5132"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ce0d186ceb4212619d76f56b32e06efa78572af0d8abd881432928c1876b968b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5116-L5132"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ce0d186ceb4212619d76f56b32e06efa78572af0d8abd881432928c1876b968b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342181,10 +339095,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsccm : FILE
 		$typelibguid1up = "E4D9EF39-0FCE-4573-978B-ABF8DF6AEC23" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Koh : FILE
 {
 	meta:
@@ -342194,9 +339106,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Koh : FILE
 		date = "2023-03-18"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/Koh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5134-L5148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b9cf1abdf4320a08f9c134e55a8f8531ef965785461b8f49687214810a143929"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5134-L5148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b9cf1abdf4320a08f9c134e55a8f8531ef965785461b8f49687214810a143929"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342207,10 +339119,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Koh : FILE
 		$typelibguid0up = "4D5350C8-7F8C-47CF-8CDE-C752018AF17E" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Forgecert : FILE
 {
 	meta:
@@ -342220,9 +339130,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Forgecert : FILE
 		date = "2023-03-18"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/ForgeCert"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5150-L5164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6fecf2a1ce947de3978b4e10b1b02f35913a37551884f16eabd1d1d544d963b6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5150-L5164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6fecf2a1ce947de3978b4e10b1b02f35913a37551884f16eabd1d1d544d963b6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342233,10 +339143,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Forgecert : FILE
 		$typelibguid0up = "BD346689-8EE6-40B3-858B-4ED94F08D40A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Crassus : FILE
 {
 	meta:
@@ -342246,9 +339154,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Crassus : FILE
 		date = "2023-03-18"
 		modified = "2023-04-06"
 		reference = "https://github.com/vu-ls/Crassus"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5166-L5180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "27c2c67aed20f3d1ec2ef0393342e21a41590cc05c0361309054e0dc699d7cc9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5166-L5180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_27c2c67aed20f3d1ec2ef0393342e21a41590cc05c0361309054e0dc699d7cc9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342259,10 +339167,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Crassus : FILE
 		$typelibguid0up = "7E9729AA-4CF2-4D0A-8183-7FB7CE7A5B1A" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Restrictedadmin : FILE
 {
 	meta:
@@ -342272,9 +339178,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Restrictedadmin : FILE
 		date = "2023-03-18"
 		modified = "2023-04-06"
 		reference = "https://github.com/GhostPack/RestrictedAdmin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5182-L5196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fc8fe9df771fb794a2ea44d68741003451747a7eb10156a9ed486f87a2d42c6d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5182-L5196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fc8fe9df771fb794a2ea44d68741003451747a7eb10156a9ed486f87a2d42c6d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342285,10 +339191,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Restrictedadmin : FILE
 		$typelibguid0up = "79F11FC0-ABFF-4E1F-B07C-5D65653D8952" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_P2P : FILE
 {
 	meta:
@@ -342298,9 +339202,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_P2P : FILE
 		date = "2023-03-19"
 		modified = "2023-04-06"
 		reference = "https://github.com/miroslavpejic85/p2p"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5198-L5212"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fcdeb2f481232ba0d13642b3003a94435c4de4e90c342c0db7707a6751a66834"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5198-L5212"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fcdeb2f481232ba0d13642b3003a94435c4de4e90c342c0db7707a6751a66834"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342311,10 +339215,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_P2P : FILE
 		$typelibguid0up = "33456E72-F8E8-4384-88C4-700867DF12E2" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwsus : FILE
 {
 	meta:
@@ -342324,9 +339226,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwsus : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/nettitude/SharpWSUS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5214-L5228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1511bb29b808146852555c7bc23cbdc9a4a2d70547fb1541790d1947a42d6089"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5214-L5228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1511bb29b808146852555c7bc23cbdc9a4a2d70547fb1541790d1947a42d6089"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342337,10 +339239,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwsus : FILE
 		$typelibguid0up = "42CABB74-1199-40F1-9354-6294BBA8D3A4" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpimpersonation : FILE
 {
 	meta:
@@ -342350,9 +339250,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpimpersonation : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/S3cur3Th1sSh1t/SharpImpersonation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5230-L5244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c875b3e499b0fc6aa2833c3be88a4a4b93062e88cc8f1201eaf12e0b10f7cc95"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5230-L5244"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c875b3e499b0fc6aa2833c3be88a4a4b93062e88cc8f1201eaf12e0b10f7cc95"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342363,10 +339263,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpimpersonation : FILE
 		$typelibguid0up = "27A85262-8C87-4147-A908-46728AB7FC73" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcloud : FILE
 {
 	meta:
@@ -342376,9 +339274,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcloud : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/chrismaddalena/SharpCloud"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5246-L5260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d1ad4088ce5b4216930d74ab7c2bc7b4d700928740faff27ebbb69e79068b14e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5246-L5260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d1ad4088ce5b4216930d74ab7c2bc7b4d700928740faff27ebbb69e79068b14e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342389,10 +339287,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcloud : FILE
 		$typelibguid0up = "CA4E257E-69C1-45C5-9375-BA7874371892" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpssdp : FILE
 {
 	meta:
@@ -342402,9 +339298,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpssdp : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/rvrsh3ll/SharpSSDP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5262-L5276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bb30d6b35db2b8144d284f25051f231ce6684f6a1213dc24ba2da0d5e4d4603"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5262-L5276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bb30d6b35db2b8144d284f25051f231ce6684f6a1213dc24ba2da0d5e4d4603"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342415,10 +339311,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpssdp : FILE
 		$typelibguid0up = "6E383DE4-DE89-4247-A41A-79DB1DC03AAA" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Wiretap : FILE
 {
 	meta:
@@ -342428,9 +339322,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Wiretap : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/djhohnstein/WireTap"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5278-L5292"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1e2199f7d4a01985edd2b4a071b928a3329e4f0f39d786608fdbbae1a01783fe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5278-L5292"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1e2199f7d4a01985edd2b4a071b928a3329e4f0f39d786608fdbbae1a01783fe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342441,10 +339335,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Wiretap : FILE
 		$typelibguid0up = "B5067468-F656-450A-B29C-1C84CFE8DDE5" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Kittylitter : FILE
 {
 	meta:
@@ -342454,9 +339346,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Kittylitter : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/djhohnstein/KittyLitter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5294-L5312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d68b2e8501db9e534b37260f7972caae8ec9756bf55c02ec60fadd256193080"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5294-L5312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d68b2e8501db9e534b37260f7972caae8ec9756bf55c02ec60fadd256193080"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342471,10 +339363,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Kittylitter : FILE
 		$typelibguid2up = "B2B8DD4F-EBA6-42A1-A53D-9A00FE785D66" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpview : FILE
 {
 	meta:
@@ -342484,9 +339374,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpview : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/tevora-threat/SharpView"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5314-L5328"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "74c1b0ad4717b3d9494b0f1df4a51d03d0e0cbf99e5d911beaa2cc67cdd50233"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5314-L5328"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_74c1b0ad4717b3d9494b0f1df4a51d03d0e0cbf99e5d911beaa2cc67cdd50233"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342497,10 +339387,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpview : FILE
 		$typelibguid0up = "22A156EA-2623-45C7-8E50-E864D9FC44D3" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Farmer : FILE
 {
 	meta:
@@ -342510,9 +339398,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Farmer : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/mdsecactivebreach/Farmer"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5330-L5350"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9f4c2cc503e8fd5b310f2c4b7d5914857612dab1435ca886bc7f8f362e822832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5330-L5350"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9f4c2cc503e8fd5b310f2c4b7d5914857612dab1435ca886bc7f8f362e822832"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342529,10 +339417,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Farmer : FILE
 		$typelibguid3up = "1C896837-E729-46A9-92B9-3BBE7AC2C90D" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Aesshellcodeinjector : FILE
 {
 	meta:
@@ -342542,9 +339428,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aesshellcodeinjector : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/san3ncrypt3d/AESShellCodeInjector"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5352-L5366"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a3a6793e5ba5788fb01b3a04dc287d0bad44c87c72da302e5629d59a35ee1583"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5352-L5366"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a3a6793e5ba5788fb01b3a04dc287d0bad44c87c72da302e5629d59a35ee1583"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342555,10 +339441,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aesshellcodeinjector : FILE
 		$typelibguid0up = "B016DA9E-12A1-4F1D-91A1-D681AE54E92C" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchromium : FILE
 {
 	meta:
@@ -342568,9 +339452,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchromium : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/djhohnstein/SharpChromium"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5368-L5382"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "00324bac8e8d9c335a359c2241e810d2e345ee6fb10a63b1bc05f33a7816c80d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5368-L5382"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_00324bac8e8d9c335a359c2241e810d2e345ee6fb10a63b1bc05f33a7816c80d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342581,10 +339465,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchromium : FILE
 		$typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Get_RBCD_Threaded : FILE
 {
 	meta:
@@ -342594,9 +339476,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Get_RBCD_Threaded : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/FatRodzianko/Get-RBCD-Threaded"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5384-L5398"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c771f3cf70901b6e60ec5a721e214e7c6c95169070d071caa870ca9f6235519f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5384-L5398"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c771f3cf70901b6e60ec5a721e214e7c6c95169070d071caa870ca9f6235519f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342607,10 +339489,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Get_RBCD_Threaded : FILE
 		$typelibguid0up = "E20DC2ED-6455-4101-9D78-FCCAC1CB7A18" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Whisker : FILE
 {
 	meta:
@@ -342620,9 +339500,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Whisker : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/eladshamir/Whisker"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5400-L5414"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "937998140d3487e7d490be50525ab6d42309e2198d3d2afe4e3c73ad14517b57"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5400-L5414"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_937998140d3487e7d490be50525ab6d42309e2198d3d2afe4e3c73ad14517b57"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342633,10 +339513,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Whisker : FILE
 		$typelibguid0up = "42750AC0-1BFF-4F25-8C9D-9AF144403BAD" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Shadowspray : FILE
 {
 	meta:
@@ -342646,9 +339524,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shadowspray : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/Dec0ne/ShadowSpray"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5416-L5430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1d5992f9f58b6f7254fd8436aa32c6744d7a7ac3c70d94b3d7325c7a4c720475"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5416-L5430"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1d5992f9f58b6f7254fd8436aa32c6744d7a7ac3c70d94b3d7325c7a4c720475"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342659,10 +339537,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shadowspray : FILE
 		$typelibguid0up = "7E47D586-DDC6-4382-848C-5CF0798084E1" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Malsccm : FILE
 {
 	meta:
@@ -342672,9 +339548,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Malsccm : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/nettitude/MalSCCM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5432-L5446"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "429da06c863b73263f6de7acba0e8479cc2ad45af45d85ce846fce6f7e0b3b64"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5432-L5446"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_429da06c863b73263f6de7acba0e8479cc2ad45af45d85ce846fce6f7e0b3b64"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342685,10 +339561,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Malsccm : FILE
 		$typelibguid0up = "5439CECD-3BB3-4807-B33F-E4C299B71CA2" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Spoolsample : FILE
 {
 	meta:
@@ -342698,9 +339572,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Spoolsample : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/leechristensen/SpoolSample"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5448-L5462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a57e5675d8e24a7288d070f8e764c5253797bf7ed3e4b1a3fba0a6e1777317e9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5448-L5462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a57e5675d8e24a7288d070f8e764c5253797bf7ed3e4b1a3fba0a6e1777317e9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342711,10 +339585,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Spoolsample : FILE
 		$typelibguid0up = "640C36B4-F417-4D85-B031-83A9D23C140B" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpoxidresolver : FILE
 {
 	meta:
@@ -342724,9 +339596,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpoxidresolver : FILE
 		date = "2023-03-22"
 		modified = "2023-04-06"
 		reference = "https://github.com/S3cur3Th1sSh1t/SharpOxidResolver"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5464-L5478"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "809ee7d9063700dbea2d33d01e4fb6b58ca9360fb6705f05eadb78fa0a2b2fb2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5464-L5478"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_809ee7d9063700dbea2d33d01e4fb6b58ca9360fb6705f05eadb78fa0a2b2fb2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -342737,10 +339609,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpoxidresolver : FILE
 		$typelibguid0up = "CE59F8FF-0ECF-41E9-A1FD-1776CA0B703D" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcat : FILE
 {
 	meta:
@@ -342750,9 +339620,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcat : FILE
 		date = "2023-11-30"
 		modified = "2024-04-24"
 		reference = "https://github.com/theart42/Sharpcat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5480-L5492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "143757610d66c5d7bbba96ef810d518f38ad8ea0e924be23aa59e8c514154fe0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5480-L5492"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_143757610d66c5d7bbba96ef810d518f38ad8ea0e924be23aa59e8c514154fe0"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -342762,10 +339632,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcat : FILE
 		$typelibguid0 = "d16fd95f-23ce-4f8d-8763-b9f5a9cdd0c3" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpnamedpipepth : FILE
 {
 	meta:
@@ -342775,9 +339643,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpnamedpipepth : FILE
 		date = "2023-11-30"
 		modified = "2024-04-24"
 		reference = "https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5494-L5506"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "437a8a41073174e86f642717537bdeeb5343cc8683c95477a52d6801a46aac21"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5494-L5506"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_437a8a41073174e86f642717537bdeeb5343cc8683c95477a52d6801a46aac21"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -342787,10 +339655,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpnamedpipepth : FILE
 		$typelibguid0 = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptokenfinder : FILE
 {
 	meta:
@@ -342800,9 +339666,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptokenfinder : FILE
 		date = "2023-12-06"
 		modified = "2024-04-24"
 		reference = "https://github.com/HuskyHacks/SharpTokenFinder"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5508-L5520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f9681a13b094b6e05cab69f0684d52e3bb3b465cfcdb1c83a890c9c8fda79169"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5508-L5520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f9681a13b094b6e05cab69f0684d52e3bb3b465cfcdb1c83a890c9c8fda79169"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -342812,10 +339678,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptokenfinder : FILE
 		$typelibguid0 = "572804d3-dbd6-450a-be64-2e3cb54fd173" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprodc : FILE
 {
 	meta:
@@ -342825,9 +339689,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprodc : FILE
 		date = "2023-12-06"
 		modified = "2024-04-24"
 		reference = "https://github.com/wh0amitz/SharpRODC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5522-L5534"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3d24237804509d2bf241f7310843591608a9d7e8abb38eb324aa5909995ebfaf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5522-L5534"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3d24237804509d2bf241f7310843591608a9d7e8abb38eb324aa5909995ebfaf"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -342837,10 +339701,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprodc : FILE
 		$typelibguid0 = "d305f8a3-019a-4cdf-909c-069d5b483613" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Gmsapasswordreader : FILE
 {
 	meta:
@@ -342850,9 +339712,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gmsapasswordreader : FILE
 		date = "2023-12-06"
 		modified = "2024-04-24"
 		reference = "https://github.com/rvazarkar/GMSAPasswordReader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5536-L5548"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8db260b15b8b8158e5f66268b9086b456386af017e4351025ea27b9f994e5bf5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5536-L5548"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8db260b15b8b8158e5f66268b9086b456386af017e4351025ea27b9f994e5bf5"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -342862,10 +339724,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gmsapasswordreader : FILE
 		$typelibguid0 = "c8112750-972d-4efa-a75b-da9b8a4533c7" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsharefinder : FILE
 {
 	meta:
@@ -342875,9 +339735,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsharefinder : FILE
 		date = "2023-12-19"
 		modified = "2024-04-24"
 		reference = "https://github.com/mvelazc0/SharpShareFinder"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5550-L5562"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "72b2c6c9f4da68ba8e9656ff2d9da962f9d791f031c1d7fb74d74ddd17ba49de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5550-L5562"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_72b2c6c9f4da68ba8e9656ff2d9da962f9d791f031c1d7fb74d74ddd17ba49de"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -342887,10 +339747,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsharefinder : FILE
 		$typelibguid0 = "64bfeb18-b65c-4a83-bde0-b54363b09b71" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_NET_GUID_Postdump : FILE
 {
 	meta:
@@ -342900,9 +339758,9 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Postdump : FILE
 		date = "2023-12-19"
 		modified = "2024-04-24"
 		reference = "https://github.com/YOLOP0wn/POSTDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_guids.yar#L5565-L5577"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e5bbef2fe7122855d7e5300ebf78631149e60b08793a4a21a4ac8b337f4bee60"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_guids.yar#L5565-L5577"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e5bbef2fe7122855d7e5300ebf78631149e60b08793a4a21a4ac8b337f4bee60"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -342912,7 +339770,7 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Postdump : FILE
 		$typelibguid0 = "e54195f0-060c-4b24-98f2-ad9fb5351045" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
 }
 rule SIGNATURE_BASE_APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine : APT
 {
@@ -342923,9 +339781,9 @@ rule SIGNATURE_BASE_APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine : APT
 		date = "2021-05-20"
 		modified = "2023-12-05"
 		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_inkysquid.yar#L104-L133"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a97041a06729d639c22a4ee272cc96555345b692fc0da8b62e898891d02b23ea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_inkysquid.yar#L104-L133"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a97041a06729d639c22a4ee272cc96555345b692fc0da8b62e898891d02b23ea"
 		score = 75
 		quality = 85
 		tags = "APT"
@@ -342948,9 +339806,9 @@ rule SIGNATURE_BASE_APT_NK_Scarcruft_Evolved_ROKRAT : APT FILE
 		date = "2021-07-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_inkysquid.yar#L135-L179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "01a2f410687c943d6c6e421ffacfe42f9e7b6afb82e43ba03a8d525e075a3a3c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_inkysquid.yar#L135-L179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_01a2f410687c943d6c6e421ffacfe42f9e7b6afb82e43ba03a8d525e075a3a3c"
 		score = 75
 		quality = 85
 		tags = "APT, FILE"
@@ -342975,7 +339833,7 @@ rule SIGNATURE_BASE_APT_NK_Scarcruft_Evolved_ROKRAT : APT FILE
                48 83 EA 01  }
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16( 0 ) == 0x5A4D and any of them
 }
 rule SIGNATURE_BASE_Powershell_Suite_Hacktools_Gen_Strings : FILE
 {
@@ -342986,9 +339844,9 @@ rule SIGNATURE_BASE_Powershell_Suite_Hacktools_Gen_Strings : FILE
 		date = "2017-12-27"
 		modified = "2023-12-05"
 		reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_suite.yar#L2-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f14a0665c60e85c0cf508f46130b09e467a16270fcd1aa8d0319e17778d4d75"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_suite.yar#L2-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f14a0665c60e85c0cf508f46130b09e467a16270fcd1aa8d0319e17778d4d75"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -343030,7 +339888,7 @@ rule SIGNATURE_BASE_Powershell_Suite_Hacktools_Gen_Strings : FILE
 		$ = "if (($FileBytes[0..1] | % {[Char]$_}) -join '' -cne 'MZ')" fullword ascii
 
 	condition:
-		filesize <100KB and 1 of them
+		filesize < 100KB and 1 of them
 }
 rule SIGNATURE_BASE_Powershell_Suite_Eidolon : FILE
 {
@@ -343041,9 +339899,9 @@ rule SIGNATURE_BASE_Powershell_Suite_Eidolon : FILE
 		date = "2017-12-27"
 		modified = "2023-12-05"
 		reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_suite.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "587a9a8569801e2aa96a6f171705fdc1db5632734b54e5a9eb8282502e1efc63"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_suite.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_587a9a8569801e2aa96a6f171705fdc1db5632734b54e5a9eb8282502e1efc63"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343056,7 +339914,7 @@ rule SIGNATURE_BASE_Powershell_Suite_Eidolon : FILE
 		$ = "[Int16]$PEArch = '0x{0}' -f ((($PayloadBytes[($OptOffset+1)..($OptOffset)]) | % {$_.ToString('X2')}) -join '')" fullword ascii
 
 	condition:
-		uint16(0)==0x7566 and filesize <13000KB and 1 of them
+		uint16( 0 ) == 0x7566 and filesize < 13000KB and 1 of them
 }
 rule SIGNATURE_BASE_MAL_WIPER_Bibi_Oct23 : FILE
 {
@@ -343067,9 +339925,9 @@ rule SIGNATURE_BASE_MAL_WIPER_Bibi_Oct23 : FILE
 		date = "2023-11-01"
 		modified = "2023-12-05"
 		reference = "https://x.com/ESETresearch/status/1719437301900595444?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_bibi_wiper_oct23.yar#L24-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c22dc994005f91f81d0e8e5f8d400b12ecd28336866bc62b8527e104f6339372"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_bibi_wiper_oct23.yar#L24-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c22dc994005f91f81d0e8e5f8d400b12ecd28336866bc62b8527e104f6339372"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343086,7 +339944,7 @@ rule SIGNATURE_BASE_MAL_WIPER_Bibi_Oct23 : FILE
 		$opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 }
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and filesize <4000KB and 2 of them
+		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and filesize < 4000KB and 2 of them
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Powerup : FILE
 {
@@ -343097,9 +339955,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Powerup : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "64562c623de89df59d15db48990c25886c67b79ac9341cf8f21ef372057ccd85"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_64562c623de89df59d15db48990c25886c67b79ac9341cf8f21ef372057ccd85"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343117,7 +339975,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Powerup : FILE
 		$s8 = "Write-Warning \"[!] Target service" fullword ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <4000KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 4000KB and 1 of them ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce : FILE
 {
@@ -343128,9 +339986,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L33-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b23b6ad66e054e435415464262004ead6e7ee121185d76c02110506293b3867b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L33-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b23b6ad66e054e435415464262004ead6e7ee121185d76c02110506293b3867b"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343143,7 +340001,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce : FILE
 		$s3 = "Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 -Hostname server1" fullword ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <300KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 300KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Shellcode : FILE
 {
@@ -343154,9 +340012,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Shellcode : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L51-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "03e9a8c5e45781d73fd13c331d82802a18e4255b506e896019d6f08c5a67dedf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L51-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_03e9a8c5e45781d73fd13c331d82802a18e4255b506e896019d6f08c5a67dedf"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343171,7 +340029,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Shellcode : FILE
 		$s5 = "Injecting shellcode" ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <90KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 90KB and 1 of them ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz : FILE
 {
@@ -343182,9 +340040,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L71-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bca6245befb5183f6a45406823c45267b0a31fb0d4505606b98025f6494f2cc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L71-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bca6245befb5183f6a45406823c45267b0a31fb0d4505606b98025f6494f2cc"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343200,7 +340058,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz : FILE
 		$s6 = "| Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002" fullword ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <10000KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 10000KB and 1 of them ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Relfectivepeinjection : FILE
 {
@@ -343211,9 +340069,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Relfectivepeinjection : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L92-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "910b8b1dbc7306369f90eae0dfd5949347b2c41fa0eb5f590aed8e90e8db199a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L92-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_910b8b1dbc7306369f90eae0dfd5949347b2c41fa0eb5f590aed8e90e8db199a"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343229,7 +340087,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Relfectivepeinjection : FILE
 		$s6 = "= Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <700KB and 2 of them ) or ( all of them )
+		( uint16( 0 ) == 0xbbef and filesize < 700KB and 2 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Persistence : FILE
 {
@@ -343240,9 +340098,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Persistence : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L113-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bfe6b20fb712fcf7b45d0ef80075bc9a254867d2251109f377a378f887b38494"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L113-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bfe6b20fb712fcf7b45d0ef80075bc9a254867d2251109f377a378f887b38494"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343260,7 +340118,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Persistence : FILE
 		$s8 = "[System.Text.AsciiEncoding]::ASCII.GetString($MZHeader)" fullword ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz_Relfectivepeinjection : FILE
 {
@@ -343271,9 +340129,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz_Relfectivepeinjection : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L136-L162"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "220597cb76c189adc33a9ac740c8164b52743f61523898aefb7a74206b23b76b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L136-L162"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_220597cb76c189adc33a9ac740c8164b52743f61523898aefb7a74206b23b76b"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343296,7 +340154,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz_Relfectivepeinjection : FILE
 		$s11 = "[IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <10000KB and 3 of them ) or (6 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 10000KB and 3 of them ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_2 : FILE
 {
@@ -343307,9 +340165,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_2 : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L164-L181"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5c035898a9574e2516cbc66efcf57f7380fd979c4a5099f8a0a190ad21af32c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L164-L181"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5c035898a9574e2516cbc66efcf57f7380fd979c4a5099f8a0a190ad21af32c0"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343323,7 +340181,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_2 : FILE
 		$s4 = "}.relay_running = $false" ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Powerup_2 : FILE
 {
@@ -343334,9 +340192,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Powerup_2 : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L183-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8cbd86f103d8b49e72787cbb85fc97e6a02d5332039ce29359cb673c273760b7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L183-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8cbd86f103d8b49e72787cbb85fc97e6a02d5332039ce29359cb673c273760b7"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343352,7 +340210,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Powerup_2 : FILE
 		$s6 = "} += \"net localgroup ${" ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <2000KB and 2 of them ) or (4 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 2000KB and 2 of them ) or ( 4 of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Persistence_2 : FILE
 {
@@ -343363,9 +340221,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Persistence_2 : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L204-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "47d1c3593edeba02e1c08cc53b4ba3d375b73dd04816b84e807e28be2bcf917e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L204-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_47d1c3593edeba02e1c08cc53b4ba3d375b73dd04816b84e807e28be2bcf917e"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343384,7 +340242,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Persistence_2 : FILE
 		$s9 = "[Runtime.InteropServices.CallingConvention]::Winapi," fullword ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
 }
 rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_3 : FILE
 {
@@ -343395,9 +340253,9 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_3 : FILE
 		date = "2016-09-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_toolkit.yar#L228-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "09afe669e90bd73318a9f9f68fda362451f6611f8585de67176c5dc43f05f937"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_toolkit.yar#L228-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_09afe669e90bd73318a9f9f68fda362451f6611f8585de67176c5dc43f05f937"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -343414,7 +340272,7 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_3 : FILE
 		$s7 = "}.bruteforce_running)" ascii
 
 	condition:
-		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
+		( uint16( 0 ) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
 }
 import "pe"
 
@@ -343427,9 +340285,9 @@ rule SIGNATURE_BASE_Sofacy_Campaign_Mal_Feb18_Cdnver : FILE
 		date = "2018-02-07"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ClearskySec/status/960924755355369472"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy.yar#L4-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cd3fa21710054a96cc85da13d98e0882deaa574708c833349638b57b6088131c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy.yar#L4-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cd3fa21710054a96cc85da13d98e0882deaa574708c833349638b57b6088131c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343446,7 +340304,7 @@ rule SIGNATURE_BASE_Sofacy_Campaign_Mal_Feb18_Cdnver : FILE
 		$s2 = "SNFIRNW" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <90KB and (pe.imphash()=="01f3d0fe6fb9d9df24620e67afc143c7" or 1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 90KB and ( pe.imphash ( ) == "01f3d0fe6fb9d9df24620e67afc143c7" or 1 of ( $x* ) or 2 of them )
 }
 import "pe"
 
@@ -343459,9 +340317,9 @@ rule SIGNATURE_BASE_Sofacy_Trojan_Loader_Feb18_1 : FILE
 		date = "2018-03-01"
 		modified = "2023-12-05"
 		reference = "https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy.yar#L29-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b1946af23fa0de69f5631a66fa211dab5d8731b5afdb23898428842232752e77"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy.yar#L29-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b1946af23fa0de69f5631a66fa211dab5d8731b5afdb23898428842232752e77"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343475,7 +340333,7 @@ rule SIGNATURE_BASE_Sofacy_Trojan_Loader_Feb18_1 : FILE
 		$s2 = "nad.dll\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports("VidBitRpl") or 1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports ( "VidBitRpl" ) or 1 of ( $x* ) or 2 of them )
 }
 import "pe"
 
@@ -343488,9 +340346,9 @@ rule SIGNATURE_BASE_APT_ATP28_Sofacy_Indicators_May19_1 : FILE
 		date = "2019-05-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1129647994603790338"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy.yar#L53-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4e3530f540cc66e99b82bd88887943c8e524d4d750734058d9a7b27f76bc6871"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy.yar#L53-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4e3530f540cc66e99b82bd88887943c8e524d4d750734058d9a7b27f76bc6871"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -343506,7 +340364,7 @@ rule SIGNATURE_BASE_APT_ATP28_Sofacy_Indicators_May19_1 : FILE
 		$op2 = { e8 af bb ef ff b8 ff ff ff ff e9 f4 01 00 00 8b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and (pe.imphash()=="f4e1c3aaec90d5dfa23c04da75ac9501" or 1 of ($x*) or ($s1 and 2 of ($op*)))
+		uint16( 0 ) == 0x5a4d and filesize < 10000KB and ( pe.imphash ( ) == "f4e1c3aaec90d5dfa23c04da75ac9501" or 1 of ( $x* ) or ( $s1 and 2 of ( $op* ) ) )
 }
 import "pe"
 
@@ -343519,9 +340377,9 @@ rule SIGNATURE_BASE_Monsoon_APT_Malware_1 : FILE
 		date = "2017-09-08"
 		modified = "2023-01-06"
 		reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_monsoon.yar#L14-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "76580f999d445f4baace5287a3038e294f8be3783289d6c7c5b2c0c92c39db86"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_monsoon.yar#L14-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_76580f999d445f4baace5287a3038e294f8be3783289d6c7c5b2c0c92c39db86"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343533,10 +340391,8 @@ rule SIGNATURE_BASE_Monsoon_APT_Malware_1 : FILE
 		$s3 = "\\Microsoft\\Windows\\" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="a0c824244f1d36ea1dd2759cf7599cd1" or all of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "a0c824244f1d36ea1dd2759cf7599cd1" or all of them ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Monsoon_APT_Malware_2 : FILE
 {
 	meta:
@@ -343546,9 +340402,9 @@ rule SIGNATURE_BASE_Monsoon_APT_Malware_2 : FILE
 		date = "2017-09-08"
 		modified = "2023-12-05"
 		reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_monsoon.yar#L37-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "20552573102dd981c81ffa6a8c7bbdfafc9bbb7da1fbc12f273bca7d6a0c9d05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_monsoon.yar#L37-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_20552573102dd981c81ffa6a8c7bbdfafc9bbb7da1fbc12f273bca7d6a0c9d05"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343570,10 +340426,8 @@ rule SIGNATURE_BASE_Monsoon_APT_Malware_2 : FILE
 		$s7 = "ouemm/emm!!!!!!!!!!!!!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 3 of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 3 of them ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bronzebutler_Daserf_Delphi_1 : FILE
 {
 	meta:
@@ -343583,9 +340437,9 @@ rule SIGNATURE_BASE_Bronzebutler_Daserf_Delphi_1 : FILE
 		date = "2017-10-14"
 		modified = "2023-12-05"
 		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bronze_butler.yar#L13-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6034a6746a5bd762d869ad2e791d80aca8a1251afa9386d6b657f23092c6fc42"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bronze_butler.yar#L13-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6034a6746a5bd762d869ad2e791d80aca8a1251afa9386d6b657f23092c6fc42"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343606,7 +340460,7 @@ rule SIGNATURE_BASE_Bronzebutler_Daserf_Delphi_1 : FILE
 		$s9 = "ms1ng2d3d2.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them )
 }
 import "pe"
 
@@ -343619,9 +340473,9 @@ rule SIGNATURE_BASE_Bronzebutler_Daserf_C_1 : FILE
 		date = "2017-10-14"
 		modified = "2023-12-05"
 		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bronze_butler.yar#L38-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0b0c05db41d6b6ac48b31d8c22aead301470f465c2840ddc98ed9577d0aaa50b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bronze_butler.yar#L38-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0b0c05db41d6b6ac48b31d8c22aead301470f465c2840ddc98ed9577d0aaa50b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343653,10 +340507,8 @@ rule SIGNATURE_BASE_Bronzebutler_Daserf_C_1 : FILE
 		$b10 = "dkgwey.php" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="088382f4887e3b2c4bd5157f2d72b618" or all of ($a*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "088382f4887e3b2c4bd5157f2d72b618" or all of ( $a* ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bronzebutler_Dget_1 : FILE
 {
 	meta:
@@ -343666,9 +340518,9 @@ rule SIGNATURE_BASE_Bronzebutler_Dget_1 : FILE
 		date = "2017-10-14"
 		modified = "2023-12-05"
 		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bronze_butler.yar#L80-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d5537f581039fa4561950402a34cbd9abd54c167d659fbbe74f1cb83217e3fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bronze_butler.yar#L80-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d5537f581039fa4561950402a34cbd9abd54c167d659fbbe74f1cb83217e3fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343679,10 +340531,8 @@ rule SIGNATURE_BASE_Bronzebutler_Dget_1 : FILE
 		$s2 = "DGet Tool Made by XZ" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 10KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bronzebutler_Uacbypass_1 : FILE
 {
 	meta:
@@ -343692,9 +340542,9 @@ rule SIGNATURE_BASE_Bronzebutler_Uacbypass_1 : FILE
 		date = "2017-10-14"
 		modified = "2023-12-05"
 		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bronze_butler.yar#L95-L113"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "64b70b9f5963be9009025c14a6e98be9642599af5226f77946b6255116fc22d8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bronze_butler.yar#L95-L113"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_64b70b9f5963be9009025c14a6e98be9642599af5226f77946b6255116fc22d8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343710,10 +340560,8 @@ rule SIGNATURE_BASE_Bronzebutler_Uacbypass_1 : FILE
 		$x6 = "[bypassUAC] started X86" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bronzebutler_Xxmm_1 : FILE
 {
 	meta:
@@ -343723,9 +340571,9 @@ rule SIGNATURE_BASE_Bronzebutler_Xxmm_1 : FILE
 		date = "2017-10-14"
 		modified = "2023-12-05"
 		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bronze_butler.yar#L115-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb9c12cbe2fe132a9588b744d10caee12716f622c31da8a1cee4c0f88d693e8e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bronze_butler.yar#L115-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb9c12cbe2fe132a9588b744d10caee12716f622c31da8a1cee4c0f88d693e8e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343744,10 +340592,8 @@ rule SIGNATURE_BASE_Bronzebutler_Xxmm_1 : FILE
 		$s6 = "stdapi_syncshell_kill" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bronzebutler_Rarstar_1 : FILE
 {
 	meta:
@@ -343757,9 +340603,9 @@ rule SIGNATURE_BASE_Bronzebutler_Rarstar_1 : FILE
 		date = "2017-10-14"
 		modified = "2023-12-05"
 		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bronze_butler.yar#L142-L158"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0e418e595020d91c575051c3b1639b09efad150c625b62eec3d1331f9792641b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bronze_butler.yar#L142-L158"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0e418e595020d91c575051c3b1639b09efad150c625b62eec3d1331f9792641b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343773,10 +340619,8 @@ rule SIGNATURE_BASE_Bronzebutler_Rarstar_1 : FILE
 		$s4 = "\\*.rar" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Daserf_Nov1_Bronzebutler : FILE
 {
 	meta:
@@ -343786,9 +340630,9 @@ rule SIGNATURE_BASE_Daserf_Nov1_Bronzebutler : FILE
 		date = "2017-11-08"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/ffeCfd"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bronze_butler.yar#L170-L196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "75edc17c51f4ea82ff7722df2f5825721ff64445fb8c78b450f1333bd32b5829"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bronze_butler.yar#L170-L196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_75edc17c51f4ea82ff7722df2f5825721ff64445fb8c78b450f1333bd32b5829"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343809,7 +340653,7 @@ rule SIGNATURE_BASE_Daserf_Nov1_Bronzebutler : FILE
 		$s8 = "Documents an" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 5 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or 5 of them )
 }
 rule SIGNATURE_BASE_Windivert_Driver : FILE
 {
@@ -343820,9 +340664,9 @@ rule SIGNATURE_BASE_Windivert_Driver : FILE
 		date = "2017-10-02"
 		modified = "2023-12-05"
 		reference = "https://www.reqrypt.org/windivert.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_pua.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "db2933396e015e906114bd04f75a5b5caf0564494224f533a6e00c1fa5421568"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_pua.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_db2933396e015e906114bd04f75a5b5caf0564494224f533a6e00c1fa5421568"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -343838,7 +340682,7 @@ rule SIGNATURE_BASE_Windivert_Driver : FILE
 		$s3 = "WinDivert (web: http://reqrypt.org/windivert.html)" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them )
 }
 rule SIGNATURE_BASE_Msfpayloads_Msf : FILE
 {
@@ -343849,9 +340693,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf : FILE
 		date = "2017-02-09"
 		modified = "2022-08-18"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L10-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4f0eab53a135242c7891b8c88e937a854c945a10000ca4cbf7b21f4596dca410"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L10-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4f0eab53a135242c7891b8c88e937a854c945a10000ca4cbf7b21f4596dca410"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -343861,7 +340705,7 @@ rule SIGNATURE_BASE_Msfpayloads_Msf : FILE
 		$s1 = "export buf=\\" ascii
 
 	condition:
-		filesize <5MB and $s1
+		filesize < 5MB and $s1
 }
 rule SIGNATURE_BASE_Msfpayloads_Msf_2
 {
@@ -343872,9 +340716,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_2
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L25-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8f803a5d71a084e1ea453638bdeaa2dd590a1912be652b74b065d9afd332ffa2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L25-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8f803a5d71a084e1ea453638bdeaa2dd590a1912be652b74b065d9afd332ffa2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -343898,9 +340742,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Psh
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L42-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2e6015e8c91ccd8647e78220d10c2d704867369d962b734bb4522a1213be2f2d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L42-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2e6015e8c91ccd8647e78220d10c2d704867369d962b734bb4522a1213be2f2d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -343924,9 +340768,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Exe
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L59-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3baa242e90dd845e022785101ebc2d5c0d84007d20aef6a2bb6a9a8c6280d4eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L59-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3baa242e90dd845e022785101ebc2d5c0d84007d20aef6a2bb6a9a8c6280d4eb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -343953,9 +340797,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_3
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L79-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d1aeb97c19365f996dc1bc0fd6e01342878967be25d3e042158eba986af28b4a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L79-L102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d1aeb97c19365f996dc1bc0fd6e01342878967be25d3e042158eba986af28b4a"
 		score = 75
 		quality = 83
 		tags = ""
@@ -343987,9 +340831,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_4
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L104-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8e84ef13aa72c7c35520b3534b908c7d00240915ab02f8216a2cef6440c322a2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L104-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8e84ef13aa72c7c35520b3534b908c7d00240915ab02f8216a2cef6440c322a2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -344015,9 +340859,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Exe_2
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L123-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bd82f496ade1a62e0aee8c8c90cee84377cb90adf11c87652082e74c8c85e568"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L123-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bd82f496ade1a62e0aee8c8c90cee84377cb90adf11c87652082e74c8c85e568"
 		score = 75
 		quality = 83
 		tags = ""
@@ -344042,9 +340886,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_5
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L141-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb602670329391b091f87818a0f5defaa8f688f7921978510739b96ca63a2f12"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L141-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb602670329391b091f87818a0f5defaa8f688f7921978510739b96ca63a2f12"
 		score = 75
 		quality = 85
 		tags = ""
@@ -344068,9 +340912,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_6
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L158-L177"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b9498828a55477049922e50329d0c38ee34b8484562113a2686669ccbb8b3318"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L158-L177"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b9498828a55477049922e50329d0c38ee34b8484562113a2686669ccbb8b3318"
 		score = 75
 		quality = 85
 		tags = ""
@@ -344098,9 +340942,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_7
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L179-L194"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "167d295de5ffc9c88cf72f086fef4514f08cc3b9dd2d93b3ec36acffd6430370"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L179-L194"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_167d295de5ffc9c88cf72f086fef4514f08cc3b9dd2d93b3ec36acffd6430370"
 		score = 75
 		quality = 85
 		tags = ""
@@ -344124,9 +340968,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_8
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L196-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d2b26276843cdfef2d1458ee6c3e2ecea962d1cd42bc21b86ebd03599bebcbc6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L196-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d2b26276843cdfef2d1458ee6c3e2ecea962d1cd42bc21b86ebd03599bebcbc6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -344154,9 +340998,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Cmd
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L217-L230"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ea44b3d00733eb7d4f924ccaece5265fcd90a462acb954a134b5355ecb0621e5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L217-L230"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ea44b3d00733eb7d4f924ccaece5265fcd90a462acb954a134b5355ecb0621e5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -344178,9 +341022,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_9 : FILE
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L232-L252"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b5761b51b79f83c48deafaf3786cb90ef493ab0448cd67b86655cecb0160a627"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L232-L252"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b5761b51b79f83c48deafaf3786cb90ef493ab0448cd67b86655cecb0160a627"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -344195,7 +341039,7 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_9 : FILE
 		$x1 = "4d5a9000030000000" ascii
 
 	condition:
-		4 of ($s*) or ( uint32(0)==0x61356434 and $x1 at 0)
+		4 of ( $s* ) or ( uint32( 0 ) == 0x61356434 and $x1 at 0 )
 }
 rule SIGNATURE_BASE_Msfpayloads_Msf_10 : FILE
 {
@@ -344206,9 +341050,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_10 : FILE
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L254-L269"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c772fdc40e110ef1287da680dc4ef1718b86856abab4d814ec7bc2ee1e7808ee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L254-L269"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c772fdc40e110ef1287da680dc4ef1718b86856abab4d814ec7bc2ee1e7808ee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344221,7 +341065,7 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_10 : FILE
 		$s3 = { 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Msfpayloads_Msf_Svc : FILE
 {
@@ -344232,9 +341076,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Svc : FILE
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L271-L285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "21c6aa2333335a5822328fb5176ca37060eb401640ed5cc340aefb63685078f4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L271-L285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_21c6aa2333335a5822328fb5176ca37060eb401640ed5cc340aefb63685078f4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344246,7 +341090,7 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Svc : FILE
 		$s2 = ".exehll" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them )
 }
 rule SIGNATURE_BASE_Msfpayloads_Msf_11
 {
@@ -344257,9 +341101,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_11
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L287-L302"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f003989a99315b42c0c73beaa2928d0187fe92a4bf329912d64fac9f8fc9358c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L287-L302"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f003989a99315b42c0c73beaa2928d0187fe92a4bf329912d64fac9f8fc9358c"
 		score = 75
 		quality = 83
 		tags = ""
@@ -344283,9 +341127,9 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Ref
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L304-L323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed6e408575b88ff67479ac1b1a2f37c5fad3ec200a446700840ad4245386bfc4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L304-L323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed6e408575b88ff67479ac1b1a2f37c5fad3ec200a446700840ad4245386bfc4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -344313,9 +341157,9 @@ rule SIGNATURE_BASE_MAL_Metasploit_Framework_UA : FILE
 		date = "2018-08-16"
 		modified = "2023-12-05"
 		reference = "https://github.com/rapid7/metasploit-framework/commit/12a6d67be48527f5d3987e40cac2a0cbb4ab6ce7"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L325-L339"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "986fea99735b93aed9dbf72582c009e11a1e7ba19b256902f93312474ef34b4a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L325-L339"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_986fea99735b93aed9dbf72582c009e11a1e7ba19b256902f93312474ef34b4a"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -344326,7 +341170,7 @@ rule SIGNATURE_BASE_MAL_Metasploit_Framework_UA : FILE
 		$s3 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
 }
 rule SIGNATURE_BASE_HKTL_Meterpreter_Inmemory
 {
@@ -344337,9 +341181,9 @@ rule SIGNATURE_BASE_HKTL_Meterpreter_Inmemory
 		date = "2020-06-29"
 		modified = "2023-04-21"
 		reference = "https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_metasploit_payloads.yar#L341-L363"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4b39dbcb276842a1306205cf2e51ce86b6d2aa21353d277df15f4ea3b3d97678"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_metasploit_payloads.yar#L341-L363"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4b39dbcb276842a1306205cf2e51ce86b6d2aa21353d277df15f4ea3b3d97678"
 		score = 85
 		quality = 85
 		tags = ""
@@ -344355,7 +341199,7 @@ rule SIGNATURE_BASE_HKTL_Meterpreter_Inmemory
 		$fp3 = "PSNMVHookMS" ascii wide
 
 	condition:
-		(1 of ($sx*) or 2 of ($s*)) and not 1 of ($fp*)
+		(1 of ( $sx* ) or 2 of ( $s* ) ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Custom_Ssh_Backdoor_Server
 {
@@ -344366,10 +341210,10 @@ rule SIGNATURE_BASE_Custom_Ssh_Backdoor_Server
 		date = "2015-05-14"
 		modified = "2022-08-18"
 		reference = "https://goo.gl/S46L3o"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_backdoor_ssh_python.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_backdoor_ssh_python.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
-		logic_hash = "7bb142b69a75003e8f26d462c0895a3d807d5c326684e83d756178a3b91669dc"
+		logic_hash = "v1_sha256_7bb142b69a75003e8f26d462c0895a3d807d5c326684e83d756178a3b91669dc"
 		score = 75
 		quality = 85
 		tags = ""
@@ -344391,9 +341235,9 @@ rule SIGNATURE_BASE_ATM_Malware_Javadispcash_1 : FILE
 		date = "2019-03-28"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/r3c0nst/status/1111254169623674882"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_atm_javadipcash.yar#L1-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9a714571281844cfe7193b7c183b86b797ef5de5d1922eacaf45dad8d41cfc52"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_atm_javadipcash.yar#L1-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9a714571281844cfe7193b7c183b86b797ef5de5d1922eacaf45dad8d41cfc52"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344409,7 +341253,7 @@ rule SIGNATURE_BASE_ATM_Malware_Javadispcash_1 : FILE
 		$log2 = ".loginside" ascii wide
 
 	condition:
-		uint16(0)==0x4B50 and filesize <500KB and all of them
+		uint16( 0 ) == 0x4B50 and filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_Win_Privesc_Gp3Finder_V4_0 : FILE
 {
@@ -344420,9 +341264,9 @@ rule SIGNATURE_BASE_Win_Privesc_Gp3Finder_V4_0 : FILE
 		date = "2016-06-02"
 		modified = "2023-12-05"
 		reference = "http://grimhacker.com/2015/04/10/gp3finder-group-policy-preference-password-finder/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_win_privesc.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d5618315ae5293ce1aea18d255d08bb007f39a466021fb636605684433da158"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_win_privesc.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d5618315ae5293ce1aea18d255d08bb007f39a466021fb636605684433da158"
 		score = 80
 		quality = 60
 		tags = "FILE"
@@ -344435,7 +341279,7 @@ rule SIGNATURE_BASE_Win_Privesc_Gp3Finder_V4_0 : FILE
 		$x3 = "GPPPFinder - Group Policy Preference Password Finder" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of ($x*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Win_Privesc_Folderperm
 {
@@ -344446,9 +341290,9 @@ rule SIGNATURE_BASE_Win_Privesc_Folderperm
 		date = "2016-06-02"
 		modified = "2023-12-05"
 		reference = "http://www.greyhathacker.net/?p=738"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_win_privesc.yar#L28-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "899fda75e4c6d9f588767e5170dbd30241a492ba89f7cc1b0ad4adb2fcd173cb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_win_privesc.yar#L28-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_899fda75e4c6d9f588767e5170dbd30241a492ba89f7cc1b0ad4adb2fcd173cb"
 		score = 80
 		quality = 85
 		tags = ""
@@ -344472,9 +341316,9 @@ rule SIGNATURE_BASE_Win_Privesc_Adaclscan4_3
 		date = "2016-06-02"
 		modified = "2023-12-05"
 		reference = "https://adaclscan.codeplex.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_win_privesc.yar#L46-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ca657e5c4172d240f46a890fc112ee89d5bdf9e35e7d412332ee11bdaf166215"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_win_privesc.yar#L46-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ca657e5c4172d240f46a890fc112ee89d5bdf9e35e7d412332ee11bdaf166215"
 		score = 60
 		quality = 85
 		tags = ""
@@ -344498,10 +341342,10 @@ rule SIGNATURE_BASE_CN_Tools_Xbat : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktool_scripts.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktool_scripts.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a7005acda381a09803b860f04d4cae3fdb65d594"
-		logic_hash = "c6dae76bbda7b43eef348c61e1330405923baf724f1aa5d2b51132dde89248fe"
+		logic_hash = "v1_sha256_c6dae76bbda7b43eef348c61e1330405923baf724f1aa5d2b51132dde89248fe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344512,7 +341356,7 @@ rule SIGNATURE_BASE_CN_Tools_Xbat : FILE
 		$s1 = "Set ws = Wscript.CreateObject(\"Wscript.Shell\")" fullword ascii
 
 	condition:
-		uint16(0)==0x6553 and filesize <0KB and all of them
+		uint16( 0 ) == 0x6553 and filesize < 0KB and all of them
 }
 rule SIGNATURE_BASE_CN_Tools_Temp : FILE
 {
@@ -344523,10 +341367,10 @@ rule SIGNATURE_BASE_CN_Tools_Temp : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktool_scripts.yar#L26-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktool_scripts.yar#L26-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c3327ef63b0ed64c4906e9940ef877c76ebaff58"
-		logic_hash = "05fd1cb3f7c8b96ccf824013c130a0b21f43724463f8658e23239d009be7f4fe"
+		logic_hash = "v1_sha256_05fd1cb3f7c8b96ccf824013c130a0b21f43724463f8658e23239d009be7f4fe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344539,7 +341383,7 @@ rule SIGNATURE_BASE_CN_Tools_Temp : FILE
 		$s4 = "index.jsp" fullword ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <203KB and all of them
+		uint16( 0 ) == 0x4b50 and filesize < 203KB and all of them
 }
 rule SIGNATURE_BASE_CN_Tools_Srss : FILE
 {
@@ -344550,10 +341394,10 @@ rule SIGNATURE_BASE_CN_Tools_Srss : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktool_scripts.yar#L44-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktool_scripts.yar#L44-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "092ab0797947692a247fe80b100fb4df0f9c37a0"
-		logic_hash = "e01fd60adc32be26b0940ecc127a17bfcfe2ebfcf6cefea76ba6adc61d3c18d4"
+		logic_hash = "v1_sha256_e01fd60adc32be26b0940ecc127a17bfcfe2ebfcf6cefea76ba6adc61d3c18d4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344564,7 +341408,7 @@ rule SIGNATURE_BASE_CN_Tools_Srss : FILE
 		$s1 = "-port 21 -logfilter \"_USER ,_P" ascii
 
 	condition:
-		filesize <100 and all of them
+		filesize < 100 and all of them
 }
 rule SIGNATURE_BASE_Dll_Unreg : FILE
 {
@@ -344575,10 +341419,10 @@ rule SIGNATURE_BASE_Dll_Unreg : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktool_scripts.yar#L60-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktool_scripts.yar#L60-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d5e24ba86781c332d0c99dea62f42b14e893d17e"
-		logic_hash = "0e534e475a5b4338aa53bea09325dd63a3d451a13b46a70b5208cabd2deecabe"
+		logic_hash = "v1_sha256_0e534e475a5b4338aa53bea09325dd63a3d451a13b46a70b5208cabd2deecabe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344589,7 +341433,7 @@ rule SIGNATURE_BASE_Dll_Unreg : FILE
 		$s1 = "del /F /Q C:\\windows\\system32\\PacketX.dll" fullword ascii
 
 	condition:
-		filesize <1KB and 1 of them
+		filesize < 1KB and 1 of them
 }
 rule SIGNATURE_BASE_Dll_Reg : FILE
 {
@@ -344600,10 +341444,10 @@ rule SIGNATURE_BASE_Dll_Reg : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktool_scripts.yar#L76-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktool_scripts.yar#L76-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cb8a92fe256a3e5b869f9564ecd1aa9c5c886e3f"
-		logic_hash = "db2032d5689f9fcfc446d5ebe8a6d28c6dbd8bcd1d93769ec969d76f8add4f9d"
+		logic_hash = "v1_sha256_db2032d5689f9fcfc446d5ebe8a6d28c6dbd8bcd1d93769ec969d76f8add4f9d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344614,7 +341458,7 @@ rule SIGNATURE_BASE_Dll_Reg : FILE
 		$s1 = "regsvr32.exe C:\\windows\\system32\\PacketX.dll" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_Sbin_Squid : FILE
 {
@@ -344625,10 +341469,10 @@ rule SIGNATURE_BASE_Sbin_Squid : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktool_scripts.yar#L92-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktool_scripts.yar#L92-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8b795a8085c3e6f3d764ebcfe6d59e26fdb91969"
-		logic_hash = "c440bcfda55f926354ea5e462fe1e6a0e9e9585bb1c1539c0aa0588405a46105"
+		logic_hash = "v1_sha256_c440bcfda55f926354ea5e462fe1e6a0e9e9585bb1c1539c0aa0588405a46105"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344641,7 +341485,7 @@ rule SIGNATURE_BASE_Sbin_Squid : FILE
 		$s3 = "net stop Squid" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_Sql1433_Creck : FILE
 {
@@ -344652,10 +341496,10 @@ rule SIGNATURE_BASE_Sql1433_Creck : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktool_scripts.yar#L110-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktool_scripts.yar#L110-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "189c11a3b268789a3fbcfac3bd4e03cbfde87b1d"
-		logic_hash = "2d9ff5f130d625450e7de41832695839f0427a6186569280a224f20e89fe1d8a"
+		logic_hash = "v1_sha256_2d9ff5f130d625450e7de41832695839f0427a6186569280a224f20e89fe1d8a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344667,7 +341511,7 @@ rule SIGNATURE_BASE_Sql1433_Creck : FILE
 		$s2 = "start anhao2.exe -i S.txt -p  pass2.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii
 
 	condition:
-		uint16(0)==0x7473 and filesize <1KB and 1 of them
+		uint16( 0 ) == 0x7473 and filesize < 1KB and 1 of them
 }
 rule SIGNATURE_BASE_Sql1433_Start : FILE
 {
@@ -344678,10 +341522,10 @@ rule SIGNATURE_BASE_Sql1433_Start : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktool_scripts.yar#L127-L145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktool_scripts.yar#L127-L145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bd4be10f4c3a982647b2da1a8fb2e19de34eaf01"
-		logic_hash = "b7dfc2b04e838fa3a71487287a50e183443eb62b69cd23494294f231b43baf2f"
+		logic_hash = "v1_sha256_b7dfc2b04e838fa3a71487287a50e183443eb62b69cd23494294f231b43baf2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344696,7 +341540,7 @@ rule SIGNATURE_BASE_Sql1433_Start : FILE
 		$s6 = "mode con cols=48 lines=20" fullword ascii
 
 	condition:
-		filesize <1KB and 2 of them
+		filesize < 1KB and 2 of them
 }
 rule SIGNATURE_BASE_Powerkatz_DLL_Generic : FILE
 {
@@ -344707,9 +341551,9 @@ rule SIGNATURE_BASE_Powerkatz_DLL_Generic : FILE
 		date = "2016-02-05"
 		modified = "2023-12-05"
 		reference = "PowerKatz Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powerkatz.yar#L9-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "979cdb42b54a26960b3173d5ea6abcc5fa61bef57f98b09e55eb4c75f1040a40"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powerkatz.yar#L9-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_979cdb42b54a26960b3173d5ea6abcc5fa61bef57f98b09e55eb4c75f1040a40"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -344728,7 +341572,7 @@ rule SIGNATURE_BASE_Powerkatz_DLL_Generic : FILE
 		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 1 of them ) or 2 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them ) or 2 of them
 }
 rule SIGNATURE_BASE_Base64_PS1_Shellcode
 {
@@ -344739,9 +341583,9 @@ rule SIGNATURE_BASE_Base64_PS1_Shellcode
 		date = "2018-11-14"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ItsReallyNick/status/1062601684566843392"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ps1_shellcode.yar#L1-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fac6f41965eb2209f1552763800d6a2b172f28cd29bb7586d180654aab1e6d56"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ps1_shellcode.yar#L1-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fac6f41965eb2209f1552763800d6a2b172f28cd29bb7586d180654aab1e6d56"
 		score = 65
 		quality = 85
 		tags = ""
@@ -344752,7 +341596,7 @@ rule SIGNATURE_BASE_Base64_PS1_Shellcode
 		$pattern2 = "/OiJAAAAYInlM"
 
 	condition:
-		$substring and 1 of ($p*)
+		$substring and 1 of ( $p* )
 }
 import "pe"
 
@@ -344765,9 +341609,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_1 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L13-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d8ed432fea930eb9b4d695a4a68b833f4324fe0bbea3f0ccac2fe5934bfa1c22"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L13-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d8ed432fea930eb9b4d695a4a68b833f4324fe0bbea3f0ccac2fe5934bfa1c22"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344779,10 +341623,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_1 : FILE
 		$s2 = { 40 00 00 E0 64 6A 7A 66 63 6D 77 62 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and (pe.imphash()=="baa93d47220682c04d92f7797d9224ce" and $s1 in (0..1024) and $s2 in (0..1024))
+		uint16( 0 ) == 0x5a4d and filesize < 4000KB and ( pe.imphash ( ) == "baa93d47220682c04d92f7797d9224ce" and $s1 in ( 0 .. 1024 ) and $s2 in ( 0 .. 1024 ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_2 : FILE
 {
 	meta:
@@ -344792,9 +341634,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_2 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L33-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c298176e5849b2b202089f27cffb7646243d19a90898bbf079a97d2f624a27e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L33-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c298176e5849b2b202089f27cffb7646243d19a90898bbf079a97d2f624a27e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344807,10 +341649,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_2 : FILE
 		$s3 = "ActiveX Manager" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and $s1 in (0..1024) and $s2 in (0..1024) and $s3
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and $s1 in ( 0 .. 1024 ) and $s2 in ( 0 .. 1024 ) and $s3
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_3 : FILE
 {
 	meta:
@@ -344820,9 +341660,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_3 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L53-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ad39864eec58b1c655bd3d510faa314702d118cee845da55d189e7252174eafb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L53-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ad39864eec58b1c655bd3d510faa314702d118cee845da55d189e7252174eafb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344833,7 +341673,7 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_3 : FILE
 		$s1 = "HKEY_CLASSES_ROOT\\Word.Document.8\\shell\\Open\\command" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
 }
 import "pe"
 
@@ -344846,9 +341686,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_4 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L68-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1889ce1101ebb352c33279d40641f1f2312c45c6f7e267f4912a9faf320e5971"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L68-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1889ce1101ebb352c33279d40641f1f2312c45c6f7e267f4912a9faf320e5971"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344872,10 +341712,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_4 : FILE
 		$s7 = "Enter WorkThread,Current sock:%d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and ((pe.exports("Print32") and 2 of them ) or 1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and ( ( pe.exports ( "Print32" ) and 2 of them ) or 1 of ( $x* ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_6 : FILE
 {
 	meta:
@@ -344885,9 +341723,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_6 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L101-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ee671bc09cc0c84c9817ed800f1416a75f18a70fd2cf6a7e9f063fffa01fa003"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L101-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ee671bc09cc0c84c9817ed800f1416a75f18a70fd2cf6a7e9f063fffa01fa003"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344899,7 +341737,7 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_6 : FILE
 		$s2 = "InstallPath=\"%Appdata%\\\\Microsoft\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
 }
 import "pe"
 
@@ -344912,9 +341750,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_7 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L117-L130"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "115774c17003408a04e4b2678f32392b5439b55f3d4688476f6f877520acf75d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L117-L130"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_115774c17003408a04e4b2678f32392b5439b55f3d4688476f6f877520acf75d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344924,10 +341762,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_7 : FILE
 		hash3 = "959612f2a9a8ce454c144d6aef10dd326b201336a85e69a604e6b3892892d7ed"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and pe.imphash()=="f5b113d6708a3927b5cc48f2215fcaff"
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and pe.imphash ( ) == "f5b113d6708a3927b5cc48f2215fcaff"
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_8 : FILE
 {
 	meta:
@@ -344937,9 +341773,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_8 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L132-L145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1a42667463ff006b155c93b8986ab75441ba00d0c3c146c2d4c6929250627d8d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L132-L145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1a42667463ff006b155c93b8986ab75441ba00d0c3c146c2d4c6929250627d8d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344950,10 +341786,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_8 : FILE
 		$s1 = "cmd /c open %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_10 : FILE
 {
 	meta:
@@ -344963,9 +341797,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_10 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L147-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "14d0ab1114c168d7222a49e68ba12718b6285969e667b95be665d59b1fc98358"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L147-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_14d0ab1114c168d7222a49e68ba12718b6285969e667b95be665d59b1fc98358"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -344978,10 +341812,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_10 : FILE
 		$s1 = "revjj.syshell.org" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_11 : FILE
 {
 	meta:
@@ -344991,9 +341823,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_11 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L165-L178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "847681b3e9d4fc38c483663f5a7e16e7f8f95cfa77728d7316edbe6fbf5fe2c1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L165-L178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_847681b3e9d4fc38c483663f5a7e16e7f8f95cfa77728d7316edbe6fbf5fe2c1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345004,7 +341836,7 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_11 : FILE
 		$s1 = "Resume.app/Contents/Java/Resume.jarPK" fullword ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <700KB and 1 of them
+		uint16( 0 ) == 0x4b50 and filesize < 700KB and 1 of them
 }
 import "pe"
 
@@ -345017,9 +341849,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_12 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L180-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "31798a39d10bfa4520d91e1f555302e9ac4e38d90f8bc27376a5e7e1ccfcc5e1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L180-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_31798a39d10bfa4520d91e1f555302e9ac4e38d90f8bc27376a5e7e1ccfcc5e1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345035,7 +341867,7 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_12 : FILE
 		$s6 = "Microsoft Corporation. All rights reserved." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and (pe.exports("SvcServiceMain") and 5 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 80KB and ( pe.exports ( "SvcServiceMain" ) and 5 of them )
 }
 import "pe"
 
@@ -345048,9 +341880,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_13 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L203-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8cc611685a822e0484146a08f4ebc2fa8dd260dc8627929333060696d8dc35ce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L203-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8cc611685a822e0484146a08f4ebc2fa8dd260dc8627929333060696d8dc35ce"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345059,10 +341891,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_13 : FILE
 		hash2 = "c74a8e6c88f8501fb066ae07753efe8d267afb006f555811083c51c7f546cb67"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="75f201aa8b18e1c4f826b2fe0963b84f"
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and pe.imphash ( ) == "75f201aa8b18e1c4f826b2fe0963b84f"
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_14 : FILE
 {
 	meta:
@@ -345072,9 +341902,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_14 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L217-L231"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "37515683804e9aa076a588048713b420501b2aaf6b8617501ef550484abd1c03"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L217-L231"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_37515683804e9aa076a588048713b420501b2aaf6b8617501ef550484abd1c03"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345085,7 +341915,7 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_14 : FILE
 		$s1 = "C:\\tmp\\Google_updata.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and 1 of them
 }
 import "pe"
 
@@ -345098,9 +341928,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_15 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L233-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8541231fe1e48d7130aed64eee964f8eda6792b5dd3e708b98e9cc6f1f620cd0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L233-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8541231fe1e48d7130aed64eee964f8eda6792b5dd3e708b98e9cc6f1f620cd0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345112,10 +341942,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_15 : FILE
 		hash5 = "3cd42e665e21ed4815af6f983452cbe7a4f2ac99f9ea71af4480a9ebff5aa048"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and pe.imphash()=="cc33b1500354cf785409a3b428f7cd2a"
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and pe.imphash ( ) == "cc33b1500354cf785409a3b428f7cd2a"
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_16 : FILE
 {
 	meta:
@@ -345125,9 +341953,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_16 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L250-L263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d0ee163e7f6f04bfe6941575d0916e18ce2e5c2426e0af326c9567560df3122"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L250-L263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d0ee163e7f6f04bfe6941575d0916e18ce2e5c2426e0af326c9567560df3122"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345138,10 +341966,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_16 : FILE
 		$s1 = "http://netimo.net 0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_17 : FILE
 {
 	meta:
@@ -345151,9 +341977,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_17 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L265-L284"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ca1dc3a03926af15527d2cb95c87457c285891d42a0aa642f49414153bcfc39e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L265-L284"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ca1dc3a03926af15527d2cb95c87457c285891d42a0aa642f49414153bcfc39e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345170,7 +341996,7 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_17 : FILE
 		$s3 = "Microsoft Office Word" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 import "pe"
 
@@ -345183,9 +342009,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_18 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L286-L313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8ec1a1262874f636906186b569d231d6e3dd97ed6ef5cbddcbaf9f80cee301a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L286-L313"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8ec1a1262874f636906186b569d231d6e3dd97ed6ef5cbddcbaf9f80cee301a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345205,10 +342031,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_18 : FILE
 		$s1 = "c:\\tmp\\tran.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="11675b4db0e7df7b29b1c1ef6f88e2e1" or pe.imphash()=="364e1f68e2d412db34715709c68ba467" or pe.exports("deKernel") or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "11675b4db0e7df7b29b1c1ef6f88e2e1" or pe.imphash ( ) == "364e1f68e2d412db34715709c68ba467" or pe.exports ( "deKernel" ) or 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_19 : FILE
 {
 	meta:
@@ -345218,9 +342042,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_19 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L315-L332"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "218c16d1b67e3e80dc7fdaf67a869e92b39744cb336e70761ac960da36c00372"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L315-L332"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_218c16d1b67e3e80dc7fdaf67a869e92b39744cb336e70761ac960da36c00372"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345235,7 +342059,7 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_19 : FILE
 		$s4 = "Now ready to get the file %s!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them
 }
 import "pe"
 
@@ -345248,9 +342072,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_20 : FILE
 		date = "2018-05-04"
 		modified = "2023-01-06"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L334-L355"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e2739a89451a4eba0bae345203dd4c0e26f715bb079830e36c772861fdd0f4de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L334-L355"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e2739a89451a4eba0bae345203dd4c0e26f715bb079830e36c772861fdd0f4de"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345265,10 +342089,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_20 : FILE
 		$s3 = "expanding computer" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="bac338bfe2685483c201e15eae4352d5" or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "bac338bfe2685483c201e15eae4352d5" or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_21 : FILE
 {
 	meta:
@@ -345278,9 +342100,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_21 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L357-L376"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4fdb162575bd108bb35e5c8ed10f7cac7539a15349218222dbb82d8eae8ad4bb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L357-L376"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4fdb162575bd108bb35e5c8ed10f7cac7539a15349218222dbb82d8eae8ad4bb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345296,10 +342118,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_21 : FILE
 		$a2 = "<set ws=wscript.createobject(\"wscript.shell\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_22 : FILE
 {
 	meta:
@@ -345309,9 +342129,9 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_22 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L378-L395"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "af2d7917f54ca365465383484b6d19a941d4801898d162a6d3afa7b7c8491a0f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L378-L395"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_af2d7917f54ca365465383484b6d19a941d4801898d162a6d3afa7b7c8491a0f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345326,10 +342146,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_22 : FILE
 		$s6 = "%d Hours %2d Minutes %2d Seconds " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Airdviper_Sample_Apr18_1 : FILE
 {
 	meta:
@@ -345339,9 +342157,9 @@ rule SIGNATURE_BASE_MAL_Airdviper_Sample_Apr18_1 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L398-L422"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cbe1f36320eb9640ffbb6495faf7e5a062c5929d022bb56cbf0ebee810ef4e94"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L398-L422"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cbe1f36320eb9640ffbb6495faf7e5a062c5929d022bb56cbf0ebee810ef4e94"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345359,10 +342177,8 @@ rule SIGNATURE_BASE_MAL_Airdviper_Sample_Apr18_1 : FILE
 		$s5 = "\\SeanSansom.txt" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 6000KB and ( 1 of ( $x* ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Winnti_Sample_May18_1 : FILE
 {
 	meta:
@@ -345372,9 +342188,9 @@ rule SIGNATURE_BASE_MAL_Winnti_Sample_May18_1 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L426-L440"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e235396de278120cbc4700f239c41e7f21e97ba111c07022ae505de540dda2bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L426-L440"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e235396de278120cbc4700f239c41e7f21e97ba111c07022ae505de540dda2bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345386,7 +342202,7 @@ rule SIGNATURE_BASE_MAL_Winnti_Sample_May18_1 : FILE
 		$s2 = "procexp" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 import "pe"
 
@@ -345399,9 +342215,9 @@ rule SIGNATURE_BASE_MAL_Visel_Sample_May18_1 : FILE
 		date = "2018-05-04"
 		modified = "2023-12-05"
 		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_burning_umbrella.yar#L442-L460"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3200e3224e037a116451b09ce265c1794a05406876376531ac81eb720fcb6945"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_burning_umbrella.yar#L442-L460"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3200e3224e037a116451b09ce265c1794a05406876376531ac81eb720fcb6945"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345414,7 +342230,7 @@ rule SIGNATURE_BASE_MAL_Visel_Sample_May18_1 : FILE
 		$s4 = "\\temp\\s%d.dat" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.exports("szFile") or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.exports ( "szFile" ) or 2 of them )
 }
 import "pe"
 
@@ -345427,9 +342243,9 @@ rule SIGNATURE_BASE_Oilrig_Rgdoor_Gen1 : FILE
 		date = "2018-01-27"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_rgdoor.yar#L13-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "896900f788337327d444495ba0cd4c7c327bb4f9166bc2a981a348cf2c34cbdb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_rgdoor.yar#L13-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_896900f788337327d444495ba0cd4c7c327bb4f9166bc2a981a348cf2c34cbdb"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -345447,7 +342263,7 @@ rule SIGNATURE_BASE_Oilrig_Rgdoor_Gen1 : FILE
 		$s4 = ".?AVCHelloWorld@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="47cb127aad6c7c9954058e61a2a6429a" or 1 of ($c*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "47cb127aad6c7c9954058e61a2a6429a" or 1 of ( $c* ) or 2 of them )
 }
 rule SIGNATURE_BASE_Indetectables_RAT : FILE
 {
@@ -345458,9 +342274,9 @@ rule SIGNATURE_BASE_Indetectables_RAT : FILE
 		date = "2015-10-01"
 		modified = "2023-12-05"
 		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_indetectables_rat.yar#L8-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "840a0c92ac731d9e88d0bdccb39598e4ff476e8630ec08f6c4024a31e258ebd0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_indetectables_rat.yar#L8-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_840a0c92ac731d9e88d0bdccb39598e4ff476e8630ec08f6c4024a31e258ebd0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345483,7 +342299,7 @@ rule SIGNATURE_BASE_Indetectables_RAT : FILE
 		$s10 = "M3n3gatt1hack3r" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 1 of them
 }
 rule SIGNATURE_BASE_Bergsilva_Malware : FILE
 {
@@ -345494,9 +342310,9 @@ rule SIGNATURE_BASE_Bergsilva_Malware : FILE
 		date = "2015-10-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_indetectables_rat.yar#L35-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "03b823040a057ffbef9bcb3094a672fd75e141f3e82c77548adbe1c465d329fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_indetectables_rat.yar#L35-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_03b823040a057ffbef9bcb3094a672fd75e141f3e82c77548adbe1c465d329fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345515,7 +342331,7 @@ rule SIGNATURE_BASE_Bergsilva_Malware : FILE
 		$s5 = "https://dl.dropbox.com/u/105015858" wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 2 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Hunting_Rule_Shikataganai
 {
@@ -345526,9 +342342,9 @@ rule SIGNATURE_BASE_Hunting_Rule_Shikataganai
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_shikataganai.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "733522cb1d61f4bbb300d73ff21d9d7d10a78aae06e03408fce4b88e4c51f662"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_shikataganai.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_733522cb1d61f4bbb300d73ff21d9d7d10a78aae06e03408fce4b88e4c51f662"
 		score = 50
 		quality = 85
 		tags = ""
@@ -345560,9 +342376,9 @@ rule SIGNATURE_BASE_PUP_Computraceagent : FILE
 		date = "2018-05-01"
 		modified = "2023-12-05"
 		reference = "https://asert.arbornetworks.com/lojack-becomes-a-double-agent/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fancybear_computrace_agent.yar#L1-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "65e964e68be1e286ab3aa39677e250cf5994a7a08d0f6db286c0260cf77d6c48"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fancybear_computrace_agent.yar#L1-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_65e964e68be1e286ab3aa39677e250cf5994a7a08d0f6db286c0260cf77d6c48"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345573,7 +342389,7 @@ rule SIGNATURE_BASE_PUP_Computraceagent : FILE
 		$b2 = { 54 61 67 49 64 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and ($a or ($b1 and $b2))
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and ( $a or ( $b1 and $b2 ) )
 }
 rule SIGNATURE_BASE_APT_MAL_HP_Ilo_Firmware_Dec21_1 : FILE
 {
@@ -345584,9 +342400,9 @@ rule SIGNATURE_BASE_APT_MAL_HP_Ilo_Firmware_Dec21_1 : FILE
 		date = "2021-12-28"
 		modified = "2023-12-05"
 		reference = "https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_mal_ilo_board_elf.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7e959d07d864a485b8cc7765f9e12869ff34747ab552e26244eb28f510d1051f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_mal_ilo_board_elf.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7e959d07d864a485b8cc7765f9e12869ff34747ab552e26244eb28f510d1051f"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -345598,7 +342414,7 @@ rule SIGNATURE_BASE_APT_MAL_HP_Ilo_Firmware_Dec21_1 : FILE
 		$s4 = ".newelf.elf.libevlog.so.data" ascii
 
 	condition:
-		filesize <5MB and 2 of them or all of them
+		filesize < 5MB and 2 of them or all of them
 }
 rule SIGNATURE_BASE_SUSP_RAR_Single_Doc_File : FILE
 {
@@ -345609,9 +342425,9 @@ rule SIGNATURE_BASE_SUSP_RAR_Single_Doc_File : FILE
 		date = "2020-07-11"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_hunting_susp_rar.yar#L3-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bfc8c60c86e65e041976dac9d15c486ad99da930849bd697c869eec0a2626c38"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_hunting_susp_rar.yar#L3-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bfc8c60c86e65e041976dac9d15c486ad99da930849bd697c869eec0a2626c38"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -345620,7 +342436,7 @@ rule SIGNATURE_BASE_SUSP_RAR_Single_Doc_File : FILE
 		$s1 = ".doc"
 
 	condition:
-		uint16(0)==0x6152 and filesize <4000KB and $s1 at ( uint16(5)+ uint16( uint16(5)+5)+ uint16( uint16(5)+ uint16( uint16(5)+5)+5)-9) and ( uint16(5)+ uint16( uint16(5)+5)+ uint16( uint16(5)+ uint16( uint16(5)+5)+5)+ uint32( uint16(5)+ uint16( uint16(5)+5)+7)> filesize -8)
+		uint16( 0 ) == 0x6152 and filesize < 4000KB and $s1 at ( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + uint16( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + 5 ) - 9 ) and ( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + uint16( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + 5 ) + uint32( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + 7 ) > filesize - 8 )
 }
 rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_1A53B0Cp32E46G0Qio7 : FILE
 {
@@ -345631,9 +342447,9 @@ rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_1A53B0Cp32E46G0Qio7 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_inocnation.yar#L1-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "824997d8c8845838420f226b60de544f33a50327fa67aea472de6eaf1b6b4492"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_inocnation.yar#L1-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_824997d8c8845838420f226b60de544f33a50327fa67aea472de6eaf1b6b4492"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345653,7 +342469,7 @@ rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_1A53B0Cp32E46G0Qio7 : FILE
 		$s9 = "WinHttpGetIEProxyConfigForCurrentUser" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint32(0)==0x464c457f) and ( all of them )
+		( uint16( 0 ) == 0x5A4D or uint32( 0 ) == 0x464c457f ) and ( all of them )
 }
 rule SIGNATURE_BASE_MAL_EXPL_Perfctl_Oct24 : FILE
 {
@@ -345662,11 +342478,11 @@ rule SIGNATURE_BASE_MAL_EXPL_Perfctl_Oct24 : FILE
 		author = "Florian Roth"
 		id = "1f525eaf-445c-592e-bfa4-e9846390dd1d"
 		date = "2024-10-09"
-		modified = "2024-10-09"
+		modified = "2024-12-12"
 		reference = "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_perfctl_oct24.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "44d4683efc66b3c6c2d32be6b83a2bbc1db39c9a020365dddd27c20667bc6a66"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_perfctl_oct24.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_44d4683efc66b3c6c2d32be6b83a2bbc1db39c9a020365dddd27c20667bc6a66"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -345679,7 +342495,7 @@ rule SIGNATURE_BASE_MAL_EXPL_Perfctl_Oct24 : FILE
 		$s4 = ".EYE$" ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <30000KB and 2 of them or all of them
+		uint16( 0 ) == 0x457f and filesize < 30000KB and 2 of them or all of them
 }
 rule SIGNATURE_BASE_MAL_LNX_Perfctl_Oct24 : FILE
 {
@@ -345688,11 +342504,11 @@ rule SIGNATURE_BASE_MAL_LNX_Perfctl_Oct24 : FILE
 		author = "Florian Roth"
 		id = "391513ae-3348-5297-a22a-6f06e50f06d2"
 		date = "2024-10-09"
-		modified = "2024-10-09"
+		modified = "2024-12-12"
 		reference = "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_perfctl_oct24.yar#L22-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d47df34240f59124542acc41484e8935327490c04c4e15a558b2ffc6f9c52ea8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_perfctl_oct24.yar#L23-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d47df34240f59124542acc41484e8935327490c04c4e15a558b2ffc6f9c52ea8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345706,10 +342522,8 @@ rule SIGNATURE_BASE_MAL_LNX_Perfctl_Oct24 : FILE
 		$op4 = { 48 83 ec 68 48 89 7d a8 48 89 75 a0 48 89 55 98 48 8b 45 a8 48 8b 00 83 e0 3f 89 45 fc }
 
 	condition:
-		uint16(0)==0x457f and filesize <300KB and 2 of them
+		uint16( 0 ) == 0x457f and filesize < 300KB and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Strings_Oct17 : FILE
 {
 	meta:
@@ -345719,9 +342533,9 @@ rule SIGNATURE_BASE_Oilrig_Strings_Oct17 : FILE
 		date = "2017-10-18"
 		modified = "2022-12-21"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_oct17.yar#L11-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3987fa1ccb215edeb0d36c947fd6d7a24847ea854d3f355d1aef4b000f55e710"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_oct17.yar#L11-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3987fa1ccb215edeb0d36c947fd6d7a24847ea854d3f355d1aef4b000f55e710"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345735,10 +342549,8 @@ rule SIGNATURE_BASE_Oilrig_Strings_Oct17 : FILE
 		$s3 = ".LoadDll(\"Run\", arg, \"C:\\\\Windows\\\\" ascii
 
 	condition:
-		filesize <800KB and 1 of them
+		filesize < 800KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples1 : FILE
 {
 	meta:
@@ -345748,9 +342560,9 @@ rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples1 : FILE
 		date = "2017-10-18"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/JQVfFP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_oct17.yar#L42-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d7e659440e3abc7355f2e21ea8f63cfb7b17b5715e4575bdccf9d646ed47db20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_oct17.yar#L42-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d7e659440e3abc7355f2e21ea8f63cfb7b17b5715e4575bdccf9d646ed47db20"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345767,10 +342579,8 @@ rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples1 : FILE
 		$s6 = "%DestFolder%" fullword wide ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <3000KB and 2 of them
+		uint16( 0 ) == 0xcfd0 and filesize < 3000KB and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples2 : FILE
 {
 	meta:
@@ -345780,9 +342590,9 @@ rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples2 : FILE
 		date = "2017-10-18"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/JQVfFP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_oct17.yar#L63-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ad00c7293f61f1b5528c3eea0dc32c10d40aeacc194be84a7f64d19b069f1add"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_oct17.yar#L63-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ad00c7293f61f1b5528c3eea0dc32c10d40aeacc194be84a7f64d19b069f1add"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345798,7 +342608,7 @@ rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples2 : FILE
 		$s2 = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (2 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 2 of ( $x* ) or 3 of them )
 }
 import "pe"
 
@@ -345811,9 +342621,9 @@ rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples3 : FILE
 		date = "2017-10-18"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/JQVfFP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_oct17.yar#L84-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a4984cf33e7b0e0dae264ed11caae6cfab9db2a6047a46ec41c28b5637b4589b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_oct17.yar#L84-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a4984cf33e7b0e0dae264ed11caae6cfab9db2a6047a46ec41c28b5637b4589b"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -345838,7 +342648,7 @@ rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples3 : FILE
 		$s10 = "!!! can not create output file !!!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="538805ecd776b9a42e71aebf94fde1b1" or pe.imphash()=="861ac226fbe8c99a2c43ff451e95da97" or (1 of ($x*) or 3 of them ))
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "538805ecd776b9a42e71aebf94fde1b1" or pe.imphash ( ) == "861ac226fbe8c99a2c43ff451e95da97" or ( 1 of ( $x* ) or 3 of them ) )
 }
 rule SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1 : FILE
 {
@@ -345849,9 +342659,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1 : FILE
 		date = "2020-10-13"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_revil.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "756e49362c01abbca3208967630f09ed957e5c51956e0e5210b0167590582a82"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_revil.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_756e49362c01abbca3208967630f09ed957e5c51956e0e5210b0167590582a82"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345868,7 +342678,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1 : FILE
 		$op5 = { 8d 85 68 ff ff ff 56 57 ff 75 0c 50 e8 2f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 2 of them or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them or 4 of them
 }
 rule SIGNATURE_BASE_Cobaltgang_PDF_Metadata_Rev_A
 {
@@ -345879,9 +342689,9 @@ rule SIGNATURE_BASE_Cobaltgang_PDF_Metadata_Rev_A
 		date = "2018-10-25"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cobalt_gang_pdf.yar#L1-L12"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8020ccff761b49d98e18cd5cb3c0695956a88e86a0958bfba1a19b7e3e629bb9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cobalt_gang_pdf.yar#L1-L12"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8020ccff761b49d98e18cd5cb3c0695956a88e86a0958bfba1a19b7e3e629bb9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -345901,9 +342711,9 @@ rule SIGNATURE_BASE_FVEY_Shadowbrokers_Jan17_Screen_Strings : FILE
 		date = "2017-01-08"
 		modified = "2023-12-05"
 		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message7/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fvey_shadowbroker_jan17.yar#L10-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8015b227c5df68fffadb86b72843b2b831d5603978ada3f50cc535a870aa94eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fvey_shadowbroker_jan17.yar#L10-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8015b227c5df68fffadb86b72843b2b831d5603978ada3f50cc535a870aa94eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345927,7 +342737,7 @@ rule SIGNATURE_BASE_FVEY_Shadowbrokers_Jan17_Screen_Strings : FILE
 		$d4 = "Mcl_NtMemory" fullword ascii wide
 
 	condition:
-		filesize <2000KB and (1 of ($x*) or all of ($a*) or 1 of ($b*) or ( uint16(0)==0x5a4d and 1 of ($c*)) or 3 of ($c*) or ( uint16(0)==0x5a4d and 3 of ($d*)))
+		filesize < 2000KB and ( 1 of ( $x* ) or all of ( $a* ) or 1 of ( $b* ) or ( uint16( 0 ) == 0x5a4d and 1 of ( $c* ) ) or 3 of ( $c* ) or ( uint16( 0 ) == 0x5a4d and 3 of ( $d* ) ) )
 }
 import "pe"
 
@@ -345940,9 +342750,9 @@ rule SIGNATURE_BASE_Datper_Backdoor : FILE
 		date = "2017-08-21"
 		modified = "2023-12-05"
 		reference = "http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_tick_datper.yar#L13-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eacdc648226f20fa3847f0b5e8cafcee59cc1c6274cabb885db297f5b5fceafb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_tick_datper.yar#L13-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eacdc648226f20fa3847f0b5e8cafcee59cc1c6274cabb885db297f5b5fceafb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345963,10 +342773,8 @@ rule SIGNATURE_BASE_Datper_Backdoor : FILE
 		$c2 = "ndkkwqgcm" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="58db98e2334746d349d607e4d73bc5ea" or pe.imphash()=="8fbed921458af485ce84fb7d9b13899e" or (2 of ($s*) and 1 of ($c*)) or ($s3 and $c1)))
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "58db98e2334746d349d607e4d73bc5ea" or pe.imphash ( ) == "8fbed921458af485ce84fb7d9b13899e" or ( 2 of ( $s* ) and 1 of ( $c* ) ) or ( $s3 and $c1 ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_ROKRAT_Malware : FILE
 {
 	meta:
@@ -345976,9 +342784,9 @@ rule SIGNATURE_BASE_ROKRAT_Malware : FILE
 		date = "2017-04-03"
 		modified = "2021-09-14"
 		reference = "http://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rokrat.yar#L8-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8b8fa3f97ce13e501cc25b89e2cfdaf785f1cb9f57a9dbd3461596b1bc6178c2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rokrat.yar#L8-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8b8fa3f97ce13e501cc25b89e2cfdaf785f1cb9f57a9dbd3461596b1bc6178c2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -345999,7 +342807,7 @@ rule SIGNATURE_BASE_ROKRAT_Malware : FILE
 		$a6 = "iresha" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25000KB and (1 of ($x*) or (5 of them ))
+		uint16( 0 ) == 0x5a4d and filesize < 25000KB and ( 1 of ( $x* ) or ( 5 of them ) )
 }
 import "pe"
 
@@ -346012,9 +342820,9 @@ rule SIGNATURE_BASE_ROKRAT_Dropper_Nov17 : FILE
 		date = "2017-11-28"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rokrat.yar#L48-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4a444342a4fb4d10aaf8efb5c26954847ce1089c9cec37d1ab3b03e0ac566c6c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rokrat.yar#L48-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4a444342a4fb4d10aaf8efb5c26954847ce1089c9cec37d1ab3b03e0ac566c6c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -346023,10 +342831,8 @@ rule SIGNATURE_BASE_ROKRAT_Dropper_Nov17 : FILE
 		hash2 = "a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2500KB and pe.imphash()=="c6187b1b5f4433318748457719dd6f39"
+		uint16( 0 ) == 0x5a4d and filesize < 2500KB and pe.imphash ( ) == "c6187b1b5f4433318748457719dd6f39"
 }
-import "pe"
-
 rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17 : FILE
 {
 	meta:
@@ -346036,9 +342842,9 @@ rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17 : FILE
 		date = "2017-11-28"
 		modified = "2023-01-06"
 		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rokrat.yar#L63-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e823ef5506b2fdf30a6ff9bdf6eee552b767b66a6c007a30618fc212d598b540"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rokrat.yar#L63-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e823ef5506b2fdf30a6ff9bdf6eee552b767b66a6c007a30618fc212d598b540"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -346058,7 +342864,7 @@ rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17 : FILE
 		$a2 = "SELECT username_value, password_value, signon_realm FROM logins" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or 3 of them or all of ($a*))
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of ( $x* ) or 3 of them or all of ( $a* ) )
 }
 import "pe"
 
@@ -346071,9 +342877,9 @@ rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17_Export_Sig_Testing : FILE
 		date = "2017-11-28"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rokrat.yar#L94-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2c6d8784aa976501a77441c4e705b7fdc9654277e8cd3f6d966967fb2e1cd724"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rokrat.yar#L94-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2c6d8784aa976501a77441c4e705b7fdc9654277e8cd3f6d966967fb2e1cd724"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -346081,10 +342887,8 @@ rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17_Export_Sig_Testing : FILE
 		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and pe.exports("getUpdate") and pe.number_of_exports==1
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and pe.exports ( "getUpdate" ) and pe.number_of_exports == 1
 }
-import "pe"
-
 rule SIGNATURE_BASE_ROKRAT_Nov17_1 : FILE
 {
 	meta:
@@ -346094,9 +342898,9 @@ rule SIGNATURE_BASE_ROKRAT_Nov17_1 : FILE
 		date = "2017-11-28"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rokrat.yar#L110-L127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "12641d417408ef32292204f620efa3d1347238fa1c6f63b2b6f09a6c660e9e24"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rokrat.yar#L110-L127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_12641d417408ef32292204f620efa3d1347238fa1c6f63b2b6f09a6c660e9e24"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -346110,7 +342914,7 @@ rule SIGNATURE_BASE_ROKRAT_Nov17_1 : FILE
 		$x2 = "c:\\temp\\esoftscrap.jpg" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and 1 of them )
 }
 rule SIGNATURE_BASE_MAL_JS_Efile_Apr23_1
 {
@@ -346121,9 +342925,9 @@ rule SIGNATURE_BASE_MAL_JS_Efile_Apr23_1
 		date = "2023-04-06"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/Ax_Sharma/status/1643178696084271104/photo/1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_efile_apr23.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6d94162e5719b92d9df349e7d48cd70e218998b0e120870a435a8073fa49c532"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_efile_apr23.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6d94162e5719b92d9df349e7d48cd70e218998b0e120870a435a8073fa49c532"
 		score = 75
 		quality = 85
 		tags = ""
@@ -346144,9 +342948,9 @@ rule SIGNATURE_BASE_MAL_PHP_Efile_Apr23_1
 		date = "2023-04-06"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/malwrhunterteam/status/1642988428080865281?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_efile_apr23.yar#L18-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec4ac3f5c19f506a70eacb5fe3173cc06bf20567bbc9a96f3b269910382e5fa2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_efile_apr23.yar#L18-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec4ac3f5c19f506a70eacb5fe3173cc06bf20567bbc9a96f3b269910382e5fa2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -346168,10 +342972,10 @@ rule SIGNATURE_BASE_BKDR_Xzutil_Script_CVE_2024_3094_Mar24_1 : CVE_2024_3094
 		date = "2024-03-30"
 		modified = "2024-04-24"
 		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/bkdr_xz_util_cve_2024_3094.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/bkdr_xz_util_cve_2024_3094.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d44d0425769fa2e0b6875e5ca25d45b251bbe98870c6b9bef34f7cea9f84c9c3"
-		logic_hash = "8d3f5f078a5c827208e04acb7ac1496f473e1236f92561f94d2a3c8156c68ea6"
+		logic_hash = "v1_sha256_8d3f5f078a5c827208e04acb7ac1496f473e1236f92561f94d2a3c8156c68ea6"
 		score = 80
 		quality = 85
 		tags = "CVE-2024-3094"
@@ -346193,9 +342997,9 @@ rule SIGNATURE_BASE_BKDR_Xzutil_Binary_CVE_2024_3094_Mar24_1 : CVE_2024_3094 FIL
 		date = "2024-03-30"
 		modified = "2024-04-24"
 		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/bkdr_xz_util_cve_2024_3094.yar#L19-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed364484ff598b0818f9b3249673e684b52394c25b14e47fbca25a5f96ecc970"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/bkdr_xz_util_cve_2024_3094.yar#L19-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed364484ff598b0818f9b3249673e684b52394c25b14e47fbca25a5f96ecc970"
 		score = 75
 		quality = 85
 		tags = "CVE-2024-3094, FILE"
@@ -346213,7 +343017,7 @@ rule SIGNATURE_BASE_BKDR_Xzutil_Binary_CVE_2024_3094_Mar24_1 : CVE_2024_3094 FIL
 		$xc1 = { F3 0F 1E FA 55 48 89 F5 4C 89 CE 53 89 FB 81 E7 00 00 00 80 48 83 EC 28 48 89 54 24 18 48 89 4C 24 10 }
 
 	condition:
-		uint16(0)==0x457f and ( all of ($op*) or $xc1)
+		uint16( 0 ) == 0x457f and ( all of ( $op* ) or $xc1 )
 }
 rule SIGNATURE_BASE_BKDR_Xzutil_Killswitch_CVE_2024_3094_Mar24_1 : CVE_2024_3094
 {
@@ -346224,9 +343028,9 @@ rule SIGNATURE_BASE_BKDR_Xzutil_Killswitch_CVE_2024_3094_Mar24_1 : CVE_2024_3094
 		date = "2024-03-30"
 		modified = "2024-04-24"
 		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#gistcomment-5006558"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/bkdr_xz_util_cve_2024_3094.yar#L48-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b2024d4b8346c4f74524bb7f3c6b2850684c19471a00e6fa60fff1c41e4a86b6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/bkdr_xz_util_cve_2024_3094.yar#L48-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b2024d4b8346c4f74524bb7f3c6b2850684c19471a00e6fa60fff1c41e4a86b6"
 		score = 85
 		quality = 85
 		tags = "CVE-2024-3094"
@@ -346246,9 +343050,9 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_SH_Indicators_Mar24_1 : FILE
 		date = "2024-04-06"
 		modified = "2024-04-24"
 		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4/1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/bkdr_xz_util_cve_2024_3094.yar#L62-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b5abf8184e0b1b18ccc513e00e9db241b4983923ae97f495396d73f0fb162192"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/bkdr_xz_util_cve_2024_3094.yar#L62-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b5abf8184e0b1b18ccc513e00e9db241b4983923ae97f495396d73f0fb162192"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -346257,7 +343061,7 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_SH_Indicators_Mar24_1 : FILE
 		$s1 = "eval $"
 
 	condition:
-		uint8(1)==0x3d and $s1 in ( filesize -20.. filesize )
+		uint8( 1 ) == 0x3d and $s1 in ( filesize - 20 .. filesize )
 }
 rule SIGNATURE_BASE_SUSP_EXPL_POC_Vmware_Workspace_ONE_CVE_2022_22954_Apr22 : CVE_2022_22954
 {
@@ -346269,9 +343073,9 @@ rule SIGNATURE_BASE_SUSP_EXPL_POC_Vmware_Workspace_ONE_CVE_2022_22954_Apr22 : CV
 		modified = "2023-04-28"
 		old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
 		reference = "https://twitter.com/rwincey/status/1512241638994853891/photo/1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2022_22954_vmware_workspace_one.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2fb23bfc28140f818b9fc630b0c1bf0c70a8f4f85b9516cefe2ff26a9de6516c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2022_22954_vmware_workspace_one.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2fb23bfc28140f818b9fc630b0c1bf0c70a8f4f85b9516cefe2ff26a9de6516c"
 		score = 70
 		quality = 85
 		tags = "CVE-2022-22954"
@@ -346296,9 +343100,9 @@ rule SIGNATURE_BASE_Chafer_Mimikatz_Custom : FILE
 		date = "2018-03-22"
 		modified = "2023-12-05"
 		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_chafer_mar18.yar#L11-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d3b74be6d221592fb867bd9589f5e4b246a093bd276efa3515d9e948a38eda48"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_chafer_mar18.yar#L11-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d3b74be6d221592fb867bd9589f5e4b246a093bd276efa3515d9e948a38eda48"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -346308,7 +343112,7 @@ rule SIGNATURE_BASE_Chafer_Mimikatz_Custom : FILE
 		$x1 = "C:\\Users\\win7p\\Documents\\mi-back\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
 }
 rule SIGNATURE_BASE_Chafer_Exploit_Copyright_2017 : FILE
 {
@@ -346319,9 +343123,9 @@ rule SIGNATURE_BASE_Chafer_Exploit_Copyright_2017 : FILE
 		date = "2018-03-22"
 		modified = "2023-12-05"
 		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_chafer_mar18.yar#L25-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "53d3e735bc368de152f4f4058617bc2cc5574bc13777f743442ff2bfafe92791"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_chafer_mar18.yar#L25-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_53d3e735bc368de152f4f4058617bc2cc5574bc13777f743442ff2bfafe92791"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -346334,7 +343138,7 @@ rule SIGNATURE_BASE_Chafer_Exploit_Copyright_2017 : FILE
 		$a2 = "cmd2cmd=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or all of ($a*))
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or all of ( $a* ) )
 }
 rule SIGNATURE_BASE_Chafer_Portscanner : FILE
 {
@@ -346345,9 +343149,9 @@ rule SIGNATURE_BASE_Chafer_Portscanner : FILE
 		date = "2018-03-22"
 		modified = "2023-12-05"
 		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_chafer_mar18.yar#L45-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6e0475a5c0fc8155359376113f88f3de080968388bd3ea60664a063540688faf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_chafer_mar18.yar#L45-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6e0475a5c0fc8155359376113f88f3de080968388bd3ea60664a063540688faf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -346359,7 +343163,7 @@ rule SIGNATURE_BASE_Chafer_Portscanner : FILE
 		$x3 = "open ports of host/hosts" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
 }
 rule SIGNATURE_BASE_Oilrig_Myrtille : FILE
 {
@@ -346370,9 +343174,9 @@ rule SIGNATURE_BASE_Oilrig_Myrtille : FILE
 		date = "2018-03-22"
 		modified = "2022-12-21"
 		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_chafer_mar18.yar#L61-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "373115c0a3fbfe93435aca07cbac52c7649a77d8b7d6eda8af5ce4a1a42e53a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_chafer_mar18.yar#L61-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_373115c0a3fbfe93435aca07cbac52c7649a77d8b7d6eda8af5ce4a1a42e53a6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -346384,7 +343188,7 @@ rule SIGNATURE_BASE_Oilrig_Myrtille : FILE
 		$x3 = "Started rdp client process, remote session {0}" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them
 }
 rule SIGNATURE_BASE_Chafer_Packed_Mimikatz : FILE
 {
@@ -346395,9 +343199,9 @@ rule SIGNATURE_BASE_Chafer_Packed_Mimikatz : FILE
 		date = "2018-03-22"
 		modified = "2023-12-05"
 		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_chafer_mar18.yar#L78-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0cee5270c9b76f1419c6989113dca221c5ba6f027a104d71f61d38cb59af51cd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_chafer_mar18.yar#L78-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0cee5270c9b76f1419c6989113dca221c5ba6f027a104d71f61d38cb59af51cd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -346409,7 +343213,7 @@ rule SIGNATURE_BASE_Chafer_Packed_Mimikatz : FILE
 		$x1 = "Copyright (c) 2014 - 2015 Minisoft" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and ( all of ($s*) or $x1)
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( all of ( $s* ) or $x1 )
 }
 rule SIGNATURE_BASE_Oilrig_PS_Cnc : FILE
 {
@@ -346420,9 +343224,9 @@ rule SIGNATURE_BASE_Oilrig_PS_Cnc : FILE
 		date = "2018-03-22"
 		modified = "2023-12-05"
 		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_oilrig_chafer_mar18.yar#L94-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0566f0707021af0d08426eec497292098273d46b020a5f0be6b98835ceeb82bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_oilrig_chafer_mar18.yar#L94-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0566f0707021af0d08426eec497292098273d46b020a5f0be6b98835ceeb82bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -346433,7 +343237,7 @@ rule SIGNATURE_BASE_Oilrig_PS_Cnc : FILE
 		$s2 = "$hostname = \"D\" + $fileID + (-join ((65..90) + (48..57) + (97..122)|" ascii
 
 	condition:
-		filesize <40KB and 1 of them
+		filesize < 40KB and 1 of them
 }
 rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen1 : FILE
 {
@@ -346444,9 +343248,9 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen1 : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_threatgroup_3390.yar#L8-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "927821e974cff6cd4d15b19bf4d0486abc57725ecdf6f00755dd4f912fbf82d1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_threatgroup_3390.yar#L8-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_927821e974cff6cd4d15b19bf4d0486abc57725ecdf6f00755dd4f912fbf82d1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -346472,7 +343276,7 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen1 : FILE
 		$op5 = { 56 8d 85 cd fc ff ff 53 50 88 9d cc fc ff ff e8 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of ($x*) and 1 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of ( $x* ) and 1 of ( $op* )
 }
 rule SIGNATURE_BASE_Httpbrowser_RAT_Sample1 : FILE
 {
@@ -346483,9 +343287,9 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Sample1 : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_threatgroup_3390.yar#L50-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "746df577e952e0354342a48fe9f1650e63e3470902e7c5bba36d36fa34ea2bff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_threatgroup_3390.yar#L50-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_746df577e952e0354342a48fe9f1650e63e3470902e7c5bba36d36fa34ea2bff"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -346497,7 +343301,7 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Sample1 : FILE
 		$s0 = "update.hancominc.com" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and $s0
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and $s0
 }
 rule SIGNATURE_BASE_Httpbrowser_RAT_Sample2 : FILE
 {
@@ -346508,9 +343312,9 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Sample2 : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_threatgroup_3390.yar#L67-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c7e945131a867bf46a467784d7119c95342733cc723cdeeb76d69c8fdb326749"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_threatgroup_3390.yar#L67-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c7e945131a867bf46a467784d7119c95342733cc723cdeeb76d69c8fdb326749"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -346524,7 +343328,7 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Sample2 : FILE
 		$s3 = "VPDN_LU.exeUT" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
 }
 rule SIGNATURE_BASE_Httpbrowser_RAT_Gen : FILE
 {
@@ -346535,9 +343339,9 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Gen : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_threatgroup_3390.yar#L86-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cbc1dec88994427fc5003c9506f5a766531136ee80a16d00d2bf5bd5d7990cb3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_threatgroup_3390.yar#L86-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cbc1dec88994427fc5003c9506f5a766531136ee80a16d00d2bf5bd5d7990cb3"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -346572,7 +343376,7 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Gen : FILE
 		$s3 = "\\config.ini" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <45KB and filesize >20KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 45KB and filesize > 20KB and all of them
 }
 rule SIGNATURE_BASE_Plugx_Nvsmartmax_Gen : FILE
 {
@@ -346583,9 +343387,9 @@ rule SIGNATURE_BASE_Plugx_Nvsmartmax_Gen : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_threatgroup_3390.yar#L126-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7795b0d978f9447a6cee808708d65992447e359539a8fe64331c06ad46ff7491"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_threatgroup_3390.yar#L126-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7795b0d978f9447a6cee808708d65992447e359539a8fe64331c06ad46ff7491"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -346609,7 +343413,7 @@ rule SIGNATURE_BASE_Plugx_Nvsmartmax_Gen : FILE
 		$op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of ($s*) and 1 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of ( $s* ) and 1 of ( $op* )
 }
 rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen2 : FILE
 {
@@ -346620,9 +343424,9 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen2 : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_threatgroup_3390.yar#L156-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf274053fe7729471716a710e3bd5ed027d6ab2c45f7af9a1103bfa1ada9cbf4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_threatgroup_3390.yar#L156-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf274053fe7729471716a710e3bd5ed027d6ab2c45f7af9a1103bfa1ada9cbf4"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -346645,7 +343449,7 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen2 : FILE
 		$op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 3 of ($s*) and 1 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of ( $s* ) and 1 of ( $op* )
 }
 rule SIGNATURE_BASE_Threatgroup3390_Strings : FILE
 {
@@ -346656,9 +343460,9 @@ rule SIGNATURE_BASE_Threatgroup3390_Strings : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_threatgroup_3390.yar#L185-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d1e4889a48f4f9bfcc12237dd44cd8ad9db9918c6a5859de086d1ddc051ff937"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_threatgroup_3390.yar#L185-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d1e4889a48f4f9bfcc12237dd44cd8ad9db9918c6a5859de086d1ddc051ff937"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -346672,7 +343476,7 @@ rule SIGNATURE_BASE_Threatgroup3390_Strings : FILE
 		$s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii
 
 	condition:
-		1 of them and filesize <30KB
+		1 of them and filesize < 30KB
 }
 rule SIGNATURE_BASE_Threatgroup3390_C2 : FILE
 {
@@ -346683,9 +343487,9 @@ rule SIGNATURE_BASE_Threatgroup3390_C2 : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_threatgroup_3390.yar#L204-L323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "be411bb8e301eb4ba611bc9d6c8f0e3b8c27b87c2dd3f8405d0eba0296117697"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_threatgroup_3390.yar#L204-L323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_be411bb8e301eb4ba611bc9d6c8f0e3b8c27b87c2dd3f8405d0eba0296117697"
 		score = 60
 		quality = 60
 		tags = "FILE"
@@ -346801,7 +343605,7 @@ rule SIGNATURE_BASE_Threatgroup3390_C2 : FILE
 		$s107 = "yuming@yinsibaohu.aliyun.com"
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule SIGNATURE_BASE_Crowdstrike_Shamoon_Droppedfile
 {
@@ -346812,9 +343616,9 @@ rule SIGNATURE_BASE_Crowdstrike_Shamoon_Droppedfile
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_shamoon.yar#L1-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed550832b217f7edceea2edf7c4453925ed1759d97db7728f7face6ff10ee361"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_shamoon.yar#L1-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed550832b217f7edceea2edf7c4453925ed1759d97db7728f7face6ff10ee361"
 		score = 75
 		quality = 85
 		tags = ""
@@ -346827,7 +343631,7 @@ rule SIGNATURE_BASE_Crowdstrike_Shamoon_Droppedfile
 		$pingcmd = "ping -n 30 127.0.0.1 >nul" wide
 
 	condition:
-		( any of ($testn*) or $pingcmd) and $testdomain
+		( any of ( $testn* ) or $pingcmd ) and $testdomain
 }
 rule SIGNATURE_BASE_MAL_RANSOM_LNX_Macos_Lockbit_Apr23_1 : FILE
 {
@@ -346838,9 +343642,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_LNX_Macos_Lockbit_Apr23_1 : FILE
 		date = "2023-04-15"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/malwrhunterteam/status/1647384505550876675?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lockbit_lnx_macos_apr23.yar#L2-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6d838e8b207b97d7c335dc4066de2c6dc87f7adc9cac31742677edbe85386cf7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lockbit_lnx_macos_apr23.yar#L2-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6d838e8b207b97d7c335dc4066de2c6dc87f7adc9cac31742677edbe85386cf7"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -346867,7 +343671,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_LNX_Macos_Lockbit_Apr23_1 : FILE
 		$op3 = { 2d e9 01 70 43 e2 07 00 13 e1 01 60 a0 e1 08 d0 4d e2 02 40 }
 
 	condition:
-		( uint32be(0)==0x7f454c46 or uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and (1 of ($x*) or 3 of them ) or 2 of ($x*) or 5 of them
+		( uint32be( 0 ) == 0x7f454c46 or uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and ( 1 of ( $x* ) or 3 of them ) or 2 of ( $x* ) or 5 of them
 }
 rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Apr23_1
 {
@@ -346878,9 +343682,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Apr23_1
 		date = "2023-04-17"
 		modified = "2023-12-05"
 		reference = "https://objective-see.org/blog/blog_0x75.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lockbit_lnx_macos_apr23.yar#L43-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cd5bffa5571abfd1446b065d26c8c23f00fe1376d505af539c6f37356014a86f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lockbit_lnx_macos_apr23.yar#L43-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cd5bffa5571abfd1446b065d26c8c23f00fe1376d505af539c6f37356014a86f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -346895,7 +343699,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Apr23_1
 		$fp1 = "<html"
 
 	condition:
-		(1 of ($x*) or 4 of them ) and not 1 of ($fp*)
+		(1 of ( $x* ) or 4 of them ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Locker_LOG_Apr23_1
 {
@@ -346906,9 +343710,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Locker_LOG_Apr23_1
 		date = "2023-04-17"
 		modified = "2023-12-05"
 		reference = "https://objective-see.org/blog/blog_0x75.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lockbit_lnx_macos_apr23.yar#L69-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d5f96e601150209382d3f6458863bc79768beb99b587aa8d9ba37cb2c11ef634"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lockbit_lnx_macos_apr23.yar#L69-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d5f96e601150209382d3f6458863bc79768beb99b587aa8d9ba37cb2c11ef634"
 		score = 75
 		quality = 85
 		tags = ""
@@ -346931,9 +343735,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Forensicartifacts_Apr23_1
 		date = "2023-04-17"
 		modified = "2023-12-05"
 		reference = "https://objective-see.org/blog/blog_0x75.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lockbit_lnx_macos_apr23.yar#L86-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "81021f8c9aed17c007d7329a598c644a706fa9750818c8974984eefcba8d06c2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lockbit_lnx_macos_apr23.yar#L86-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_81021f8c9aed17c007d7329a598c644a706fa9750818c8974984eefcba8d06c2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -346944,7 +343748,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Forensicartifacts_Apr23_1
 		$xc1 = { 54 6F 72 20 42 72 6F 77 73 65 72 20 4C 69 6E 6B 73 3A 0D 0A 68 74 74 70 3A 2F 2F 6C 6F 63 6B 62 69 74 }
 
 	condition:
-		1 of ($x*)
+		1 of ( $x* )
 }
 rule SIGNATURE_BASE_Trojandownloader : FILE
 {
@@ -346955,10 +343759,10 @@ rule SIGNATURE_BASE_Trojandownloader : FILE
 		date = "2015-02-11"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/wJ8V1I"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_generic.yar#L4-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_generic.yar#L4-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5b8d4280ff6fc9c8e1b9593cbaeb04a29e64a81e"
-		logic_hash = "4911098beea1d348d41d6a38c03b343bb7b8a8090ba664fd4b0747045127c686"
+		logic_hash = "v1_sha256_4911098beea1d348d41d6a38c03b343bb7b8a8090ba664fd4b0747045127c686"
 		score = 60
 		quality = 83
 		tags = "FILE"
@@ -346989,7 +343793,7 @@ rule SIGNATURE_BASE_Trojandownloader : FILE
 		$s28 = "KERNEL32.dll" fullword ascii
 
 	condition:
-		$x1 and $x2 and ( all of ($s*)) and filesize <35000
+		$x1 and $x2 and ( all of ( $s* ) ) and filesize < 35000
 }
 rule SIGNATURE_BASE_Ismdoor_Jul17_A2 : FILE
 {
@@ -347000,9 +343804,9 @@ rule SIGNATURE_BASE_Ismdoor_Jul17_A2 : FILE
 		date = "2017-08-01"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/Voulnet/status/892104753295110145"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_generic.yar#L54-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7944f690be190927c905d3b3c6e26765504af9fcfb445cf70c8899af115d5001"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_generic.yar#L54-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7944f690be190927c905d3b3c6e26765504af9fcfb445cf70c8899af115d5001"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347017,7 +343821,7 @@ rule SIGNATURE_BASE_Ismdoor_Jul17_A2 : FILE
 		$s4 = "\\Libraries" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
 }
 rule SIGNATURE_BASE_Unknown_Malware_Sample_Jul17_2 : FILE
 {
@@ -347028,9 +343832,9 @@ rule SIGNATURE_BASE_Unknown_Malware_Sample_Jul17_2 : FILE
 		date = "2017-08-01"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/iqH8CK"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_generic.yar#L73-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "966e14331fa89f2cdb5593a0c10227264085ee127deed28341e395ba6845e19d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_generic.yar#L73-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_966e14331fa89f2cdb5593a0c10227264085ee127deed28341e395ba6845e19d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347044,7 +343848,7 @@ rule SIGNATURE_BASE_Unknown_Malware_Sample_Jul17_2 : FILE
 		$s4 = "MyTemplate" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_MAL_Unspecified_Jan18_1 : FILE
 {
@@ -347055,9 +343859,9 @@ rule SIGNATURE_BASE_MAL_Unspecified_Jan18_1 : FILE
 		date = "2018-01-19"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_generic.yar#L91-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cd4f7247473e04c348b49970ee3a6fd01415f005ac6dc7a79fbf937a693a80f4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_generic.yar#L91-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cd4f7247473e04c348b49970ee3a6fd01415f005ac6dc7a79fbf937a693a80f4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347074,7 +343878,7 @@ rule SIGNATURE_BASE_MAL_Unspecified_Jan18_1 : FILE
 		$s7 = "DEL /s \"%s\" >nul 2>&1" fullword ascii
 
 	condition:
-		filesize <300KB and 2 of them
+		filesize < 300KB and 2 of them
 }
 rule SIGNATURE_BASE_Xdedic_Sysscan_Unpacked : CRIMEWARE FILE
 {
@@ -347085,9 +343889,9 @@ rule SIGNATURE_BASE_Xdedic_Sysscan_Unpacked : CRIMEWARE FILE
 		date = "2016-03-14"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/75027/xdedic-the-shady-world-of-hacked-servers-for-sale/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sysscan.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "df0834e89c512721547001c910c1461f028a46e954dd51017d4e8bde7893d04a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sysscan.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_df0834e89c512721547001c910c1461f028a46e954dd51017d4e8bde7893d04a"
 		score = 75
 		quality = 85
 		tags = "CRIMEWARE, FILE"
@@ -347110,7 +343914,7 @@ rule SIGNATURE_BASE_Xdedic_Sysscan_Unpacked : CRIMEWARE FILE
 		$b2 = "Trying send result..." ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and filesize <5000000 and ( any of ($a*) or all of ($b*))
+		uint16( 0 ) == 0x5A4D and filesize < 5000000 and ( any of ( $a* ) or all of ( $b* ) )
 }
 rule SIGNATURE_BASE_Xdedic_Packed_Syscan : FILE
 {
@@ -347121,9 +343925,9 @@ rule SIGNATURE_BASE_Xdedic_Packed_Syscan : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sysscan.yar#L29-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "04eb5b056e892b2c2cf87e3770847226cccaceb1c743f3b9f8ac548026747ccf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sysscan.yar#L29-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_04eb5b056e892b2c2cf87e3770847226cccaceb1c743f3b9f8ac548026747ccf"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -347134,10 +343938,8 @@ rule SIGNATURE_BASE_Xdedic_Packed_Syscan : FILE
 		$a2 = "1.3.4." wide
 
 	condition:
-		uint16(0)==0x5A4D and filesize >500KB and filesize <1500KB and all of them
+		uint16( 0 ) == 0x5A4D and filesize > 500KB and filesize < 1500KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Noclient_3_0_5 : FILE
 {
 	meta:
@@ -347147,9 +343949,9 @@ rule SIGNATURE_BASE_EQGRP_Noclient_3_0_5 : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L12-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51a6bf03c8d034942bf02fae2bea52436f53b4d437006b1dbe9c0c67387fe17a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L12-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51a6bf03c8d034942bf02fae2bea52436f53b4d437006b1dbe9c0c67387fe17a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347163,10 +343965,8 @@ rule SIGNATURE_BASE_EQGRP_Noclient_3_0_5 : FILE
 		$x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <700KB and 1 of them ) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 700KB and 1 of them ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Installdate : FILE
 {
 	meta:
@@ -347176,9 +343976,9 @@ rule SIGNATURE_BASE_EQGRP_Installdate : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L31-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "363a9c92c4d2560ba6dd0ec41acf136dff4346f20d54f971d319ed2aa531fe31"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L31-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_363a9c92c4d2560ba6dd0ec41acf136dff4346f20d54f971d319ed2aa531fe31"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347193,10 +343993,8 @@ rule SIGNATURE_BASE_EQGRP_Installdate : FILE
 		$s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii
 
 	condition:
-		filesize <2KB and (1 of ($x*) or 3 of them )
+		filesize < 2KB and ( 1 of ( $x* ) or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Teflondoor : FILE
 {
 	meta:
@@ -347206,9 +344004,9 @@ rule SIGNATURE_BASE_EQGRP_Teflondoor : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L52-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "38be3cfa638509d539bf4ada3b5c7e44e01ee4cfb74a53a76cd2f4287c5a56f5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L52-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_38be3cfa638509d539bf4ada3b5c7e44e01ee4cfb74a53a76cd2f4287c5a56f5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347225,10 +344023,8 @@ rule SIGNATURE_BASE_EQGRP_Teflondoor : FILE
 		$s6 = "%s: %li b" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 1 of ($x*) and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of ( $x* ) and 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Durablenapkin_Solaris_2_0_1 : FILE
 {
 	meta:
@@ -347238,9 +344034,9 @@ rule SIGNATURE_BASE_EQGRP_Durablenapkin_Solaris_2_0_1 : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L75-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "113f9451d6792511baa168957c643de02f37826b32944ef882f49b68496ec596"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L75-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_113f9451d6792511baa168957c643de02f37826b32944ef882f49b68496ec596"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347254,10 +344050,8 @@ rule SIGNATURE_BASE_EQGRP_Durablenapkin_Solaris_2_0_1 : FILE
 		$s5 = ">> %d -- %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and 2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 40KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Teflonhandle : FILE
 {
 	meta:
@@ -347267,9 +344061,9 @@ rule SIGNATURE_BASE_EQGRP_Teflonhandle : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L94-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7dfa713b763c983219f008405e1ebf3dfe386672f2d4e5fb54b2b362023ae08a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L94-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7dfa713b763c983219f008405e1ebf3dfe386672f2d4e5fb54b2b362023ae08a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347283,10 +344077,8 @@ rule SIGNATURE_BASE_EQGRP_Teflonhandle : FILE
 		$s5 = "%s --> %s..." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_False : FILE
 {
 	meta:
@@ -347296,9 +344088,9 @@ rule SIGNATURE_BASE_EQGRP_False : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L113-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a1938bc7a5a7a1bb382c2bab976013a1adedc045e0312daabe1bdcdd65d0c606"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L113-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a1938bc7a5a7a1bb382c2bab976013a1adedc045e0312daabe1bdcdd65d0c606"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347316,10 +344108,8 @@ rule SIGNATURE_BASE_EQGRP_False : FILE
 			00 25 64 20 2D 20 25 64 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and $s1
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and $s1
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Dn_1_0_2_1 : FILE
 {
 	meta:
@@ -347329,9 +344119,9 @@ rule SIGNATURE_BASE_EQGRP_Dn_1_0_2_1 : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L136-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9b6420401419b280f01f7fc73412386a19e94a57e589a043b231b6a721585c99"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L136-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9b6420401419b280f01f7fc73412386a19e94a57e589a043b231b6a721585c99"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347344,10 +344134,8 @@ rule SIGNATURE_BASE_EQGRP_Dn_1_0_2_1 : FILE
 		$s4 = "Not everything is set yet" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 30KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Morel : FILE
 {
 	meta:
@@ -347357,9 +344145,9 @@ rule SIGNATURE_BASE_EQGRP_Morel : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L154-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "463d628bb19e27e94dcccc4c7d435d86111d51aa9f77c5ca1a199d9aaa9017ba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L154-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_463d628bb19e27e94dcccc4c7d435d86111d51aa9f77c5ca1a199d9aaa9017ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347372,10 +344160,8 @@ rule SIGNATURE_BASE_EQGRP_Morel : FILE
 		$s3 = "%d - %d %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Bc_Parser : FILE
 {
 	meta:
@@ -347385,9 +344171,9 @@ rule SIGNATURE_BASE_EQGRP_Bc_Parser : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L172-L187"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e8911acc1173e1149fd11dd795b72ba26bc654cbc7f9d95053ce420663fcafe9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L172-L187"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e8911acc1173e1149fd11dd795b72ba26bc654cbc7f9d95053ce420663fcafe9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347399,10 +344185,8 @@ rule SIGNATURE_BASE_EQGRP_Bc_Parser : FILE
 		$s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and 1 of them
+		uint16( 0 ) == 0x457f and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_1212 : FILE
 {
 	meta:
@@ -347412,9 +344196,9 @@ rule SIGNATURE_BASE_EQGRP_1212 : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L189-L207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1be7ed8fdfaecc6e55c4d1e75cf841f4620df3d2abe6aed2761aed20c42f70bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L189-L207"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1be7ed8fdfaecc6e55c4d1e75cf841f4620df3d2abe6aed2761aed20c42f70bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347429,10 +344213,8 @@ rule SIGNATURE_BASE_EQGRP_1212 : FILE
 		$s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
 
 	condition:
-		filesize <6KB and 4 of them
+		filesize < 6KB and 4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_1212_Dehex : FILE
 {
 	meta:
@@ -347442,9 +344224,9 @@ rule SIGNATURE_BASE_EQGRP_1212_Dehex : FILE
 		date = "2016-08-15"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L209-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "74d1b0e820696cd5507996996bead50d283e83095bc7288a6e8e484738b6348b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L209-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_74d1b0e820696cd5507996996bead50d283e83095bc7288a6e8e484738b6348b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347458,10 +344240,8 @@ rule SIGNATURE_BASE_EQGRP_1212_Dehex : FILE
 		$s5 = "print hextoIP($ARGV[0]);" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <6KB and (5 of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x2123 and filesize < 6KB and ( 5 of ( $s* ) ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Install_Get_Persistent_Filenames : FILE
 {
 	meta:
@@ -347471,9 +344251,9 @@ rule SIGNATURE_BASE_Install_Get_Persistent_Filenames : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L237-L250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "be07e3e3e96dd4676a76b32eb8fc47b2ab1f66ebbd6c2a3f1c88fc224f9f39ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L237-L250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_be07e3e3e96dd4676a76b32eb8fc47b2ab1f66ebbd6c2a3f1c88fc224f9f39ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347484,10 +344264,8 @@ rule SIGNATURE_BASE_Install_Get_Persistent_Filenames : FILE
 		$s1 = "Generates the persistence file name and prints it out." fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and all of them )
+		( uint16( 0 ) == 0x457f and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Create_Dns_Injection
 {
 	meta:
@@ -347497,9 +344275,9 @@ rule SIGNATURE_BASE_EQGRP_Create_Dns_Injection
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L252-L266"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a07cb33c459208410b326fc260e96e617385ee4eac905a92d9542cb5ec73713e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L252-L266"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a07cb33c459208410b326fc260e96e617385ee4eac905a92d9542cb5ec73713e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347513,8 +344291,6 @@ rule SIGNATURE_BASE_EQGRP_Create_Dns_Injection
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Screamingplow
 {
 	meta:
@@ -347524,9 +344300,9 @@ rule SIGNATURE_BASE_EQGRP_Screamingplow
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L268-L282"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "429ff81b6079785cc45d81b5ebf8bccd49f30484ca692017b0b66484463606d4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L268-L282"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_429ff81b6079785cc45d81b5ebf8bccd49f30484ca692017b0b66484463606d4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347540,8 +344316,6 @@ rule SIGNATURE_BASE_EQGRP_Screamingplow
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Mixtext
 {
 	meta:
@@ -347551,9 +344325,9 @@ rule SIGNATURE_BASE_EQGRP_Mixtext
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L284-L297"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cae2437124ad6e69b04a1338b651e33c7358b7fedd0613f3fa1025cf980e14ab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L284-L297"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cae2437124ad6e69b04a1338b651e33c7358b7fedd0613f3fa1025cf980e14ab"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347566,8 +344340,6 @@ rule SIGNATURE_BASE_EQGRP_Mixtext
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Tunnel_State_Reader
 {
 	meta:
@@ -347577,9 +344349,9 @@ rule SIGNATURE_BASE_EQGRP_Tunnel_State_Reader
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L299-L313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d0653650aad10e7ff69b7ef1e61fac64310c63cc68c6d924655f082925e4fd04"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L299-L313"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d0653650aad10e7ff69b7ef1e61fac64310c63cc68c6d924655f082925e4fd04"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347593,8 +344365,6 @@ rule SIGNATURE_BASE_EQGRP_Tunnel_State_Reader
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Payload
 {
 	meta:
@@ -347604,9 +344374,9 @@ rule SIGNATURE_BASE_EQGRP_Payload
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L315-L329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "22e2a4809f6646437ab0824238fec791f3760ac305f9c818089797b011425b3d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L315-L329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_22e2a4809f6646437ab0824238fec791f3760ac305f9c818089797b011425b3d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347620,8 +344390,6 @@ rule SIGNATURE_BASE_EQGRP_Payload
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Eligiblecandidate
 {
 	meta:
@@ -347631,9 +344399,9 @@ rule SIGNATURE_BASE_EQGRP_Eligiblecandidate
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L331-L348"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e7e1b206f9c51ffe0ab016a93d551a9ede8f87adfc38fe70278be8c2f0fe0696"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L331-L348"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e7e1b206f9c51ffe0ab016a93d551a9ede8f87adfc38fe70278be8c2f0fe0696"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347649,8 +344417,6 @@ rule SIGNATURE_BASE_EQGRP_Eligiblecandidate
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BUSURPER_2211_724
 {
 	meta:
@@ -347660,9 +344426,9 @@ rule SIGNATURE_BASE_EQGRP_BUSURPER_2211_724
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L350-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "834180ef512882cc3b22e79a6bda349678eb5042a3356a50c47eeb36ae453427"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L350-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_834180ef512882cc3b22e79a6bda349678eb5042a3356a50c47eeb36ae453427"
 		score = 75
 		quality = 83
 		tags = ""
@@ -347679,8 +344445,6 @@ rule SIGNATURE_BASE_EQGRP_BUSURPER_2211_724
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Networkprofiler_Orderscans
 {
 	meta:
@@ -347690,9 +344454,9 @@ rule SIGNATURE_BASE_EQGRP_Networkprofiler_Orderscans
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L369-L383"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0cdf4f3d8f668ce5d5aab652c83cb4d2a9acc3471ff720448d021707b34402ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L369-L383"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0cdf4f3d8f668ce5d5aab652c83cb4d2a9acc3471ff720448d021707b34402ef"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347706,8 +344470,6 @@ rule SIGNATURE_BASE_EQGRP_Networkprofiler_Orderscans
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Epicbanana_2_1_0_1
 {
 	meta:
@@ -347717,9 +344479,9 @@ rule SIGNATURE_BASE_EQGRP_Epicbanana_2_1_0_1
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L385-L399"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "be0b180e0dfdda35725ac6d9c35752a0b56bdbdaf985b6932c7d2ff342d4cde3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L385-L399"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_be0b180e0dfdda35725ac6d9c35752a0b56bdbdaf985b6932c7d2ff342d4cde3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347733,8 +344495,6 @@ rule SIGNATURE_BASE_EQGRP_Epicbanana_2_1_0_1
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Sniffer_Xml2Pcap
 {
 	meta:
@@ -347744,9 +344504,9 @@ rule SIGNATURE_BASE_EQGRP_Sniffer_Xml2Pcap
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L401-L415"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c3aa9f42edbca32725f8c02023e3b9644162a001ded099513d12f94d70dd4c8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L401-L415"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c3aa9f42edbca32725f8c02023e3b9644162a001ded099513d12f94d70dd4c8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347760,8 +344520,6 @@ rule SIGNATURE_BASE_EQGRP_Sniffer_Xml2Pcap
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Bananaaid
 {
 	meta:
@@ -347771,9 +344529,9 @@ rule SIGNATURE_BASE_EQGRP_Bananaaid
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L417-L433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2ae52529547866dcfe66fffb3f5b37eba89844b7675129c66636ebef01b0f49a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L417-L433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2ae52529547866dcfe66fffb3f5b37eba89844b7675129c66636ebef01b0f49a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347789,8 +344547,6 @@ rule SIGNATURE_BASE_EQGRP_Bananaaid
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Bo : FILE
 {
 	meta:
@@ -347800,9 +344556,9 @@ rule SIGNATURE_BASE_EQGRP_Bo : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L435-L452"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "48c2d3f13283d2a1b7e1010c724f1e68e6002dd9a9779025dfc3a4952bec95bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L435-L452"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_48c2d3f13283d2a1b7e1010c724f1e68e6002dd9a9779025dfc3a4952bec95bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347817,10 +344573,8 @@ rule SIGNATURE_BASE_EQGRP_Bo : FILE
 		$s5 = "ERROR: mmap failed: %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <20KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 20KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Seconddate_2211 : FILE
 {
 	meta:
@@ -347830,9 +344584,9 @@ rule SIGNATURE_BASE_EQGRP_Seconddate_2211 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L454-L470"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f51f4cfb3b1c77f03a3627cccfee72e57731b26b01907cc837f246a8f7677580"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L454-L470"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f51f4cfb3b1c77f03a3627cccfee72e57731b26b01907cc837f246a8f7677580"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -347846,10 +344600,8 @@ rule SIGNATURE_BASE_EQGRP_Seconddate_2211 : FILE
 		$s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 200KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Config_Jp1_UA
 {
 	meta:
@@ -347859,9 +344611,9 @@ rule SIGNATURE_BASE_EQGRP_Config_Jp1_UA
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L472-L488"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8dd504bd00f72b1500375fbe451f5abb055cb2ff440f6ae4314b1e3d64097b83"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L472-L488"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8dd504bd00f72b1500375fbe451f5abb055cb2ff440f6ae4314b1e3d64097b83"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347877,8 +344629,6 @@ rule SIGNATURE_BASE_EQGRP_Config_Jp1_UA
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Userscript
 {
 	meta:
@@ -347888,9 +344638,9 @@ rule SIGNATURE_BASE_EQGRP_Userscript
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L490-L503"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "718ee434c8ae61e2709df6dd431dbb0a2230085f0132ae82c7ceda4de75248cf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L490-L503"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_718ee434c8ae61e2709df6dd431dbb0a2230085f0132ae82c7ceda4de75248cf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -347903,8 +344653,6 @@ rule SIGNATURE_BASE_EQGRP_Userscript
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BBALL_M50FW08_2201 : FILE
 {
 	meta:
@@ -347914,9 +344662,9 @@ rule SIGNATURE_BASE_EQGRP_BBALL_M50FW08_2201 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L505-L523"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd180203ec4c4ddfa2c46cba672eb94179553637a9f7548b25dee7b88c3d3294"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L505-L523"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd180203ec4c4ddfa2c46cba672eb94179553637a9f7548b25dee7b88c3d3294"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -347932,10 +344680,8 @@ rule SIGNATURE_BASE_EQGRP_BBALL_M50FW08_2201 : FILE
 		$s6 = "KEEPGOING" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and 5 of ($s*))
+		( uint16( 0 ) == 0x457f and filesize < 40KB and 5 of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BUSURPER_3001_724 : FILE
 {
 	meta:
@@ -347945,9 +344691,9 @@ rule SIGNATURE_BASE_EQGRP_BUSURPER_3001_724 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L525-L540"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "531f7039290b386f070378cb4ba49a57b5031fb16b3972b61f4fb904770fc4ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L525-L540"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_531f7039290b386f070378cb4ba49a57b5031fb16b3972b61f4fb904770fc4ac"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -347960,10 +344706,8 @@ rule SIGNATURE_BASE_EQGRP_BUSURPER_3001_724 : FILE
 		$s3 = "upgrade_implant" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and 2 of them ) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Workit
 {
 	meta:
@@ -347973,9 +344717,9 @@ rule SIGNATURE_BASE_EQGRP_Workit
 		date = "2016-08-16"
 		modified = "2023-01-27"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L542-L566"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1fa61e8c2012e664fee97ff608bcd8845bbd9701fa02d39d49379f7f83a5636d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L542-L566"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1fa61e8c2012e664fee97ff608bcd8845bbd9701fa02d39d49379f7f83a5636d"
 		score = 75
 		quality = 35
 		tags = ""
@@ -347998,8 +344742,6 @@ rule SIGNATURE_BASE_EQGRP_Workit
 	condition:
 		6 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Tinyhttp_Setup : FILE
 {
 	meta:
@@ -348009,9 +344751,9 @@ rule SIGNATURE_BASE_EQGRP_Tinyhttp_Setup : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L568-L584"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d560206e634f3bfeffe5b7de3edf02f6c76443ffb5c0de37180e63276a19457"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L568-L584"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d560206e634f3bfeffe5b7de3edf02f6c76443ffb5c0de37180e63276a19457"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348025,10 +344767,8 @@ rule SIGNATURE_BASE_EQGRP_Tinyhttp_Setup : FILE
 		$x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <2KB and 1 of ($x*)) or ( all of them )
+		( uint16( 0 ) == 0x2123 and filesize < 2KB and 1 of ( $x* ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Shellcode
 {
 	meta:
@@ -348038,9 +344778,9 @@ rule SIGNATURE_BASE_EQGRP_Shellcode
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L586-L605"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "69a04db721a0d17720f9db9386d47309f01d1fc31bd5e833cedb9e1c2eb573ae"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L586-L605"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_69a04db721a0d17720f9db9386d47309f01d1fc31bd5e833cedb9e1c2eb573ae"
 		score = 75
 		quality = 85
 		tags = ""
@@ -348057,8 +344797,6 @@ rule SIGNATURE_BASE_EQGRP_Shellcode
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_EPBA : FILE
 {
 	meta:
@@ -348068,9 +344806,9 @@ rule SIGNATURE_BASE_EQGRP_EPBA : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L607-L626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c483efdcfbb0dd8602a552b519d3aa52fca12549c0ec1660d813a2a1da66c3a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L607-L626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c483efdcfbb0dd8602a552b519d3aa52fca12549c0ec1660d813a2a1da66c3a6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348087,10 +344825,8 @@ rule SIGNATURE_BASE_EQGRP_EPBA : FILE
 		$x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii
 
 	condition:
-		( uint16(0)==0x2023 and filesize <7KB and 1 of ($x*)) or (3 of them )
+		( uint16( 0 ) == 0x2023 and filesize < 7KB and 1 of ( $x* ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BPIE : FILE
 {
 	meta:
@@ -348100,9 +344836,9 @@ rule SIGNATURE_BASE_EQGRP_BPIE : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L628-L648"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ab13dde40015fba80f55bc9d1b82c94ec2421e9ea263b70ad8ec0a7a74c43c9a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L628-L648"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ab13dde40015fba80f55bc9d1b82c94ec2421e9ea263b70ad8ec0a7a74c43c9a"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -348120,10 +344856,8 @@ rule SIGNATURE_BASE_EQGRP_BPIE : FILE
 		$s8 = "resetCmdHandler" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <70KB and 6 of ($s*))
+		( uint16( 0 ) == 0x457f and filesize < 70KB and 6 of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Jetplow_SH
 {
 	meta:
@@ -348133,9 +344867,9 @@ rule SIGNATURE_BASE_EQGRP_Jetplow_SH
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L650-L666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8ae203527c4e41ae169c63521bb08d5199c43dfd1028574a1791ab1f8f198105"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L650-L666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8ae203527c4e41ae169c63521bb08d5199c43dfd1028574a1791ab1f8f198105"
 		score = 75
 		quality = 85
 		tags = ""
@@ -348151,8 +344885,6 @@ rule SIGNATURE_BASE_EQGRP_Jetplow_SH
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BBANJO : FILE
 {
 	meta:
@@ -348162,9 +344894,9 @@ rule SIGNATURE_BASE_EQGRP_BBANJO : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L668-L687"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8ee2e817732674bf7ff5f396271a2a90da8f401d7ea0f0a3f51c21712adb3ea4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L668-L687"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8ee2e817732674bf7ff5f396271a2a90da8f401d7ea0f0a3f51c21712adb3ea4"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -348181,10 +344913,8 @@ rule SIGNATURE_BASE_EQGRP_BBANJO : FILE
 		$s7 = "beacon_reconfigure" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 50KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BPATROL_2201 : FILE
 {
 	meta:
@@ -348194,9 +344924,9 @@ rule SIGNATURE_BASE_EQGRP_BPATROL_2201 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L689-L706"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a2e9aa4627924c99dd3a342174855df3f0d545a67fd2293ca5601eeae70ae010"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L689-L706"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a2e9aa4627924c99dd3a342174855df3f0d545a67fd2293ca5601eeae70ae010"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -348211,10 +344941,8 @@ rule SIGNATURE_BASE_EQGRP_BPATROL_2201 : FILE
 		$s5 = "KEEPGOING" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 40KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Extrabacon
 {
 	meta:
@@ -348224,9 +344952,9 @@ rule SIGNATURE_BASE_EQGRP_Extrabacon
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L708-L725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1a010d5e6324715f8e1bf29e957c365fabd2986fece53aaea23bba8ee59bd808"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L708-L725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1a010d5e6324715f8e1bf29e957c365fabd2986fece53aaea23bba8ee59bd808"
 		score = 75
 		quality = 85
 		tags = ""
@@ -348243,8 +344971,6 @@ rule SIGNATURE_BASE_EQGRP_Extrabacon
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Sploit_Py
 {
 	meta:
@@ -348254,9 +344980,9 @@ rule SIGNATURE_BASE_EQGRP_Sploit_Py
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L727-L742"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "874eaffcbc191951db39ba6c85e8c80b83b0df8d33136b6cdcdefcb28e596474"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L727-L742"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_874eaffcbc191951db39ba6c85e8c80b83b0df8d33136b6cdcdefcb28e596474"
 		score = 75
 		quality = 85
 		tags = ""
@@ -348271,8 +344997,6 @@ rule SIGNATURE_BASE_EQGRP_Sploit_Py
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Uninstallpbd
 {
 	meta:
@@ -348282,9 +345006,9 @@ rule SIGNATURE_BASE_EQGRP_Uninstallpbd
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L744-L759"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51be8a491a1e228dfc6156a86e9f2ffc923c39d0649bbc031ea1bafe1af22a45"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L744-L759"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51be8a491a1e228dfc6156a86e9f2ffc923c39d0649bbc031ea1bafe1af22a45"
 		score = 75
 		quality = 85
 		tags = ""
@@ -348299,8 +345023,6 @@ rule SIGNATURE_BASE_EQGRP_Uninstallpbd
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BICECREAM : FILE
 {
 	meta:
@@ -348310,9 +345032,9 @@ rule SIGNATURE_BASE_EQGRP_BICECREAM : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L761-L782"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "adaa6b7d4bf9e6f95fbae781382e72afc07993582473cbee7139a93df0fe3283"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L761-L782"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_adaa6b7d4bf9e6f95fbae781382e72afc07993582473cbee7139a93df0fe3283"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348331,10 +345053,8 @@ rule SIGNATURE_BASE_EQGRP_BICECREAM : FILE
 		$s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <5000KB and 2 of them ) or (5 of them )
+		( uint16( 0 ) == 0x457f and filesize < 5000KB and 2 of them ) or ( 5 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Create_Http_Injection : FILE
 {
 	meta:
@@ -348344,9 +345064,9 @@ rule SIGNATURE_BASE_EQGRP_Create_Http_Injection : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L784-L802"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3a2ee46c6fec1b7a501e8c0e2963d4873ede89d192d0f4701d051f782e8ece99"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L784-L802"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3a2ee46c6fec1b7a501e8c0e2963d4873ede89d192d0f4701d051f782e8ece99"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348361,10 +345081,8 @@ rule SIGNATURE_BASE_EQGRP_Create_Http_Injection : FILE
 		$s4 = "usage='%prog [ ... options ... ] url'," fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <3KB and ($x1 or 2 of them )) or ( all of them )
+		( uint16( 0 ) == 0x2123 and filesize < 3KB and ( $x1 or 2 of them ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BFLEA_2201 : FILE
 {
 	meta:
@@ -348374,9 +345092,9 @@ rule SIGNATURE_BASE_EQGRP_BFLEA_2201 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L804-L823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d0fd4d0ffe98856abed685c4b9ff770daba22aa16bd860440874fd94df2d54ea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L804-L823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d0fd4d0ffe98856abed685c4b9ff770daba22aa16bd860440874fd94df2d54ea"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -348393,10 +345111,8 @@ rule SIGNATURE_BASE_EQGRP_BFLEA_2201 : FILE
 		$s7 = "writeFlashHandler" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 5 of them ) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 30KB and 5 of them ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Bpfcreator_RHEL4 : FILE
 {
 	meta:
@@ -348406,9 +345122,9 @@ rule SIGNATURE_BASE_EQGRP_Bpfcreator_RHEL4 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L825-L842"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8586425b13355170137d66fe8d52ed98982d7c5699b26a8c0132f107b4af43d8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L825-L842"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8586425b13355170137d66fe8d52ed98982d7c5699b26a8c0132f107b4af43d8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348423,10 +345139,8 @@ rule SIGNATURE_BASE_EQGRP_Bpfcreator_RHEL4 : FILE
 		$s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 2000KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Storefc
 {
 	meta:
@@ -348436,9 +345150,9 @@ rule SIGNATURE_BASE_EQGRP_Storefc
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L844-L859"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f07c3ef83808852f70fb5cbc4436d531675344ab74f83888cd70d987c3544cce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L844-L859"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f07c3ef83808852f70fb5cbc4436d531675344ab74f83888cd70d987c3544cce"
 		score = 75
 		quality = 85
 		tags = ""
@@ -348453,8 +345167,6 @@ rule SIGNATURE_BASE_EQGRP_Storefc
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Hexdump : FILE
 {
 	meta:
@@ -348464,9 +345176,9 @@ rule SIGNATURE_BASE_EQGRP_Hexdump : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L861-L877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed36aa5a69296088bdd1db42e6561377294b7bd99c30104b9d4a618d899d7e9a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L861-L877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed36aa5a69296088bdd1db42e6561377294b7bd99c30104b9d4a618d899d7e9a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348480,10 +345192,8 @@ rule SIGNATURE_BASE_EQGRP_Hexdump : FILE
 		$s4 = "print >>out, sane(x[i:i+16])" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <1KB and 2 of ($s*)) or ( all of them )
+		( uint16( 0 ) == 0x2123 and filesize < 1KB and 2 of ( $s* ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BBALL : FILE
 {
 	meta:
@@ -348493,9 +345203,9 @@ rule SIGNATURE_BASE_EQGRP_BBALL : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L879-L898"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b02d17a13725b5215c89590abf77f960e79f9fd155c9ea4e9eb903710a7a375e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L879-L898"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b02d17a13725b5215c89590abf77f960e79f9fd155c9ea4e9eb903710a7a375e"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -348512,10 +345222,8 @@ rule SIGNATURE_BASE_EQGRP_BBALL : FILE
 		$s7 = "writeSpeedPlow.c" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and 4 of ($s*)) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 40KB and 4 of ( $s* ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BARPUNCH_BPICKER : FILE
 {
 	meta:
@@ -348525,9 +345233,9 @@ rule SIGNATURE_BASE_EQGRP_BARPUNCH_BPICKER : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L902-L921"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f5d0cc881bedad736a90109933da8dbd32c4435aa255676c68ae3541bbb61e74"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L902-L921"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f5d0cc881bedad736a90109933da8dbd32c4435aa255676c68ae3541bbb61e74"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348544,10 +345252,8 @@ rule SIGNATURE_BASE_EQGRP_BARPUNCH_BPICKER : FILE
 		$x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <6000KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0x457f and filesize < 6000KB and 1 of them ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Implants_Gen6 : FILE
 {
 	meta:
@@ -348557,9 +345263,9 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen6 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L923-L951"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9f0aa1994199c8cef543b7602b574726171dd96df159a0c496db0c60c339c4d0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L923-L951"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9f0aa1994199c8cef543b7602b574726171dd96df159a0c496db0c60c339c4d0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348585,10 +345291,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen6 : FILE
 		$s9 = "killCmdList" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <6000KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 6000KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Implants_Gen5 : FILE
 {
 	meta:
@@ -348598,9 +345302,9 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen5 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L953-L978"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d4bbd9dbde4ca1da80d49157363ade3ec47d55828529ec7e1a46b64d07c991f0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L953-L978"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d4bbd9dbde4ca1da80d49157363ade3ec47d55828529ec7e1a46b64d07c991f0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348622,10 +345326,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen5 : FILE
 		$s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and 1 of ($x*)) or ( all of them )
+		( uint16( 0 ) == 0x457f and 1 of ( $x* ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Pandarock : FILE
 {
 	meta:
@@ -348635,9 +345337,9 @@ rule SIGNATURE_BASE_EQGRP_Pandarock : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L980-L1007"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d0a61410d7c5f309489ef4553f41a3a6fb7d0f24bcdb1f0d88e896265513add2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L980-L1007"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d0a61410d7c5f309489ef4553f41a3a6fb7d0f24bcdb1f0d88e896265513add2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348660,10 +345362,8 @@ rule SIGNATURE_BASE_EQGRP_Pandarock : FILE
 		$o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <3000KB and 1 of ($x*)) or (4 of them ) or 1 of ($o*)
+		( uint16( 0 ) == 0x457f and filesize < 3000KB and 1 of ( $x* ) ) or ( 4 of them ) or 1 of ( $o* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Bananausurper_Writejetplow : FILE
 {
 	meta:
@@ -348673,9 +345373,9 @@ rule SIGNATURE_BASE_EQGRP_Bananausurper_Writejetplow : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1009-L1028"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "101e75800291a7603e03145bff298d7587c9b5f19102e7ba9ed3bf2b544fa5cf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1009-L1028"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_101e75800291a7603e03145bff298d7587c9b5f19102e7ba9ed3bf2b544fa5cf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348691,10 +345391,8 @@ rule SIGNATURE_BASE_EQGRP_Bananausurper_Writejetplow : FILE
 		$s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <2000KB and 1 of ($x*)) or (3 of them )
+		( uint16( 0 ) == 0x457f and filesize < 2000KB and 1 of ( $x* ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Implants_Gen4 : FILE
 {
 	meta:
@@ -348704,9 +345402,9 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen4 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1030-L1051"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3bfcef33e9a0a1753fd21458ee3173284f98942d30a496c5183c79a7df960208"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1030-L1051"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3bfcef33e9a0a1753fd21458ee3173284f98942d30a496c5183c79a7df960208"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348725,10 +345423,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen4 : FILE
 		$s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <3000KB and 3 of them ) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 3000KB and 3 of them ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Implants_Gen3 : FILE
 {
 	meta:
@@ -348738,9 +345434,9 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen3 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1053-L1076"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "32d4dd0e35ea480199f5b2032145326c3eef73243783c580605a4de6877df982"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1053-L1076"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_32d4dd0e35ea480199f5b2032145326c3eef73243783c580605a4de6877df982"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348760,10 +345456,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen3 : FILE
 		$s3 = "upload/activate/de-activate/remove/cmd function failed" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <6000KB and 2 of them ) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 6000KB and 2 of them ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_BLIAR_BLIQUER : FILE
 {
 	meta:
@@ -348773,9 +345467,9 @@ rule SIGNATURE_BASE_EQGRP_BLIAR_BLIQUER : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1078-L1111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "59b7303dba0a79919d79627697a8724337145cd6d7b5c53cda970bf437162865"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1078-L1111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_59b7303dba0a79919d79627697a8724337145cd6d7b5c53cda970bf437162865"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348804,10 +345498,8 @@ rule SIGNATURE_BASE_EQGRP_BLIAR_BLIQUER : FILE
 		$s5 = "Invalid implant file" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <3000KB and (1 of ($x*) or 1 of ($p*))) or (3 of them )
+		( uint16( 0 ) == 0x457f and filesize < 3000KB and ( 1 of ( $x* ) or 1 of ( $p* ) ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Sploit : FILE
 {
 	meta:
@@ -348817,9 +345509,9 @@ rule SIGNATURE_BASE_EQGRP_Sploit : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1113-L1135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "083f103dee6b209626c4d790dff0e53af757945ded63409b26bbe143c78e30eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1113-L1135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_083f103dee6b209626c4d790dff0e53af757945ded63409b26bbe143c78e30eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348839,10 +345531,8 @@ rule SIGNATURE_BASE_EQGRP_Sploit : FILE
 		$s8 = "print 'Debug info ','='*40" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <90KB and 1 of ($s*)) or (4 of them )
+		( uint16( 0 ) == 0x2123 and filesize < 90KB and 1 of ( $s* ) ) or ( 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Implants_Gen2 : FILE
 {
 	meta:
@@ -348852,9 +345542,9 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen2 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1137-L1168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c3cbe11ae38f5affffab247cdc618d0afb5a0feda6ea4b2f43dd8edb2fbf2b11"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1137-L1168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c3cbe11ae38f5affffab247cdc618d0afb5a0feda6ea4b2f43dd8edb2fbf2b11"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348882,10 +345572,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen2 : FILE
 		$s9 = "extract_fgbg" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <3000KB and 1 of ($x*)) or (5 of them )
+		( uint16( 0 ) == 0x457f and filesize < 3000KB and 1 of ( $x* ) ) or ( 5 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Implants_Gen1 : FILE
 {
 	meta:
@@ -348895,9 +345583,9 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen1 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1170-L1199"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1493f78e74503c367e3c5d8eac32167a7ad34d2435eba00e1f7bf864682e10a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1170-L1199"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1493f78e74503c367e3c5d8eac32167a7ad34d2435eba00e1f7bf864682e10a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348924,10 +345612,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen1 : FILE
 		$s8 = "Returned eax = %08x" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <6000KB and (2 of ($s*))) or (5 of them )
+		( uint16( 0 ) == 0x457f and filesize < 6000KB and ( 2 of ( $s* ) ) ) or ( 5 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Eligiblebombshell_Generic : FILE
 {
 	meta:
@@ -348937,9 +345623,9 @@ rule SIGNATURE_BASE_EQGRP_Eligiblebombshell_Generic : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1201-L1218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a2e13300736f99aff30c7b4f7f0b148d62ecb1e72435a3e15e4f85b30d904ffd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1201-L1218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a2e13300736f99aff30c7b4f7f0b148d62ecb1e72435a3e15e4f85b30d904ffd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348954,10 +345640,8 @@ rule SIGNATURE_BASE_EQGRP_Eligiblebombshell_Generic : FILE
 		$s3 = "\"be supplied\")" fullword ascii
 
 	condition:
-		( filesize <70KB and 2 of ($s*)) or ( all of them )
+		( filesize < 70KB and 2 of ( $s* ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Ssh_Telnet_29 : FILE
 {
 	meta:
@@ -348967,9 +345651,9 @@ rule SIGNATURE_BASE_EQGRP_Ssh_Telnet_29 : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1220-L1241"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e93a54f4de089d460bfb966feacc377c0467863f481a210c81970f4909fb3bd8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1220-L1241"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e93a54f4de089d460bfb966feacc377c0467863f481a210c81970f4909fb3bd8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -348988,10 +345672,8 @@ rule SIGNATURE_BASE_EQGRP_Ssh_Telnet_29 : FILE
 		$s7 = "chopped = string.rstrip(payload, \"\\x0a\")" fullword ascii
 
 	condition:
-		( filesize <10KB and 2 of them ) or (3 of them )
+		( filesize < 10KB and 2 of them ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Tinyexec : FILE
 {
 	meta:
@@ -349001,9 +345683,9 @@ rule SIGNATURE_BASE_EQGRP_Tinyexec : FILE
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1245-L1258"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "19b8d7e946d72424f81cd48ad4bf8791bf50a4cc146866e55ad501443a8d1e45"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1245-L1258"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_19b8d7e946d72424f81cd48ad4bf8791bf50a4cc146866e55ad501443a8d1e45"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349014,10 +345696,8 @@ rule SIGNATURE_BASE_EQGRP_Tinyexec : FILE
 		$s2 = { 5A 58 55 52 89 E2 55 50 89 E1 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize <270 and all of them
+		uint32( 0 ) == 0x464c457f and filesize < 270 and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Callbacks
 {
 	meta:
@@ -349027,9 +345707,9 @@ rule SIGNATURE_BASE_EQGRP_Callbacks
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1260-L1272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "34881cf8f9f29482a1e129f0f61470d4cc3fa6b78b9f6dda25862371896deca7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1260-L1272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_34881cf8f9f29482a1e129f0f61470d4cc3fa6b78b9f6dda25862371896deca7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -349041,8 +345721,6 @@ rule SIGNATURE_BASE_EQGRP_Callbacks
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Extrabacon_Output
 {
 	meta:
@@ -349052,9 +345730,9 @@ rule SIGNATURE_BASE_EQGRP_Extrabacon_Output
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1274-L1290"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e71a4380dd30e68d89add1718976d3207a161d2d61fd4c3250fc4b10a0f53a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1274-L1290"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e71a4380dd30e68d89add1718976d3207a161d2d61fd4c3250fc4b10a0f53a0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -349070,8 +345748,6 @@ rule SIGNATURE_BASE_EQGRP_Extrabacon_Output
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_Unique_Strings
 {
 	meta:
@@ -349081,9 +345757,9 @@ rule SIGNATURE_BASE_EQGRP_Unique_Strings
 		date = "2016-08-16"
 		modified = "2023-12-05"
 		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1292-L1305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "070358ec9cccb5d9daa4e5a016d4f9a988b600d675484f06dc9a897cadf7af0c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1292-L1305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_070358ec9cccb5d9daa4e5a016d4f9a988b600d675484f06dc9a897cadf7af0c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -349096,8 +345772,6 @@ rule SIGNATURE_BASE_EQGRP_Unique_Strings
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EQGRP_RC5_RC6_Opcode
 {
 	meta:
@@ -349107,9 +345781,9 @@ rule SIGNATURE_BASE_EQGRP_RC5_RC6_Opcode
 		date = "2016-08-17"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1307-L1326"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a79208c5924e1d5cc9db922f80403514e516eadb725393c1ebc9a6236ca90b98"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1307-L1326"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a79208c5924e1d5cc9db922f80403514e516eadb725393c1ebc9a6236ca90b98"
 		score = 75
 		quality = 85
 		tags = ""
@@ -349121,8 +345795,6 @@ rule SIGNATURE_BASE_EQGRP_RC5_RC6_Opcode
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Implant : FILE
 {
 	meta:
@@ -349132,9 +345804,9 @@ rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Implant : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1337-L1353"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec8b54f3489b1eeef491b03641805e0e4db0b5cbbb67a3ae3d37dad184f54b01"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1337-L1353"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec8b54f3489b1eeef491b03641805e0e4db0b5cbbb67a3ae3d37dad184f54b01"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349148,10 +345820,8 @@ rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Implant : FILE
 		$s4 = ".?AVFeFinallyFailure@@" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and ( all of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 90KB and ( all of ( $s* ) ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Lp : FILE
 {
 	meta:
@@ -349161,9 +345831,9 @@ rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1355-L1372"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a908d44b831a27bb584c5da936346f77f0e205658ec2ebe0e600004645894593"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1355-L1372"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a908d44b831a27bb584c5da936346f77f0e205658ec2ebe0e600004645894593"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349178,10 +345848,8 @@ rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Lp : FILE
 		$s5 = "Security auditing has been disabled" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Processhide_Lp : FILE
 {
 	meta:
@@ -349191,9 +345859,9 @@ rule SIGNATURE_BASE_Equationgroup_Processhide_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1374-L1393"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "407045f5ac8eeec4403560de406e5d382d38ae2f34d0e4c7d3cc9b94debdfad8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1374-L1393"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_407045f5ac8eeec4403560de406e5d382d38ae2f34d0e4c7d3cc9b94debdfad8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349210,10 +345878,8 @@ rule SIGNATURE_BASE_Equationgroup_Processhide_Lp : FILE
 		$x7 = "Invalid EPROCESS location for given ID" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Pwdump_Implant : FILE
 {
 	meta:
@@ -349223,9 +345889,9 @@ rule SIGNATURE_BASE_Equationgroup_Pwdump_Implant : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1395-L1410"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "20df7ef04154e317ee844545e541d62b3b8db4ac4800ba45a26b1092499c6e69"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1395-L1410"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_20df7ef04154e317ee844545e541d62b3b8db4ac4800ba45a26b1092499c6e69"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349238,10 +345904,8 @@ rule SIGNATURE_BASE_Equationgroup_Pwdump_Implant : FILE
 		$s3 = "\\system32\\win32k.sys" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_5 : FILE
 {
 	meta:
@@ -349251,9 +345915,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_5 : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1412-L1428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "834a7175a23c30301fce01482a2768d453368c7ca5c72ae52b2d266b31005991"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1412-L1428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_834a7175a23c30301fce01482a2768d453368c7ca5c72ae52b2d266b31005991"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349267,10 +345931,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_5 : FILE
 		$s6 = "Copyright (C) Microsoft" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll : FILE
 {
 	meta:
@@ -349280,9 +345942,9 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1430-L1447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "579539961e29c4da60dc632b1afd348e0d799e266f175a3bae7206b615d90f5b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1430-L1447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_579539961e29c4da60dc632b1afd348e0d799e266f175a3bae7206b615d90f5b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349297,10 +345959,8 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll : FILE
 		$s8 = "Copyright (C) Microsoft" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_LSADUMP_Lp : FILE
 {
 	meta:
@@ -349310,9 +345970,9 @@ rule SIGNATURE_BASE_Equationgroup_LSADUMP_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1449-L1462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f67a64ae7fece949d37367d85a28a879e90844e5cc56e88a85a1cce890990f55"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1449-L1462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f67a64ae7fece949d37367d85a28a879e90844e5cc56e88a85a1cce890990f55"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349323,10 +345983,8 @@ rule SIGNATURE_BASE_Equationgroup_LSADUMP_Lp : FILE
 		$x1 = "LSADUMP - - ERROR - - Injected" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Mstcp32 : FILE
 {
 	meta:
@@ -349336,9 +345994,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Mstcp32 : FILE
 		date = "2017-01-13"
 		modified = "2023-01-06"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1464-L1485"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aff97f8360a0c24bfde6a1b2616749d6cad3b19993716231d32b8bb59579c638"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1464-L1485"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aff97f8360a0c24bfde6a1b2616749d6cad3b19993716231d32b8bb59579c638"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349356,10 +346014,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Mstcp32 : FILE
 		$s9 = "\\Device\\%ws" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 7 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 7 of them ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Nethide_Lp : FILE
 {
 	meta:
@@ -349369,9 +346025,9 @@ rule SIGNATURE_BASE_Equationgroup_Nethide_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1487-L1504"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "70e96a8ef5f75e05b3f6d32b9b8392316c3a70cb479549a3700134435b690473"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1487-L1504"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_70e96a8ef5f75e05b3f6d32b9b8392316c3a70cb479549a3700134435b690473"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349386,10 +346042,8 @@ rule SIGNATURE_BASE_Equationgroup_Nethide_Lp : FILE
 		$x5 = "Not enough slots for all of the list.  Some entries may have not been hidden." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Dll_X64 : FILE
 {
 	meta:
@@ -349399,9 +346053,9 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Dll_X64 : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1506-L1521"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9c874581567909055deeae4f992bd99c1e08d5f62655d1cc9a7316beb8513d8f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1506-L1521"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9c874581567909055deeae4f992bd99c1e08d5f62655d1cc9a7316beb8513d8f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349414,10 +346068,8 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Dll_X64 : FILE
 		$s3 = "\\\\.\\%hs" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Exe : FILE
 {
 	meta:
@@ -349427,9 +346079,9 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Exe : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1523-L1541"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "975d327d5922e4b179a677501c2613186ea85299958a996dcdeb503b02495ff7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1523-L1541"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_975d327d5922e4b179a677501c2613186ea85299958a996dcdeb503b02495ff7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349445,10 +346097,8 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Exe : FILE
 		$s6 = "itanium" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Processinfo_Implant : FILE
 {
 	meta:
@@ -349458,9 +346108,9 @@ rule SIGNATURE_BASE_Equationgroup_Processinfo_Implant : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1543-L1558"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b0aace3c6fa20c5bb238264b2aa484d548945a4c2ccb65482cce71427f061604"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1543-L1558"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b0aace3c6fa20c5bb238264b2aa484d548945a4c2ccb65482cce71427f061604"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349473,10 +346123,8 @@ rule SIGNATURE_BASE_Equationgroup_Processinfo_Implant : FILE
 		$s3 = "No mapping" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_2 : FILE
 {
 	meta:
@@ -349486,9 +346134,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_2 : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1560-L1574"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fcbc518d23dc21d482abcac29505c5404fc9e309554ca7dc9f1014adbff83e1a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1560-L1574"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fcbc518d23dc21d482abcac29505c5404fc9e309554ca7dc9f1014adbff83e1a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349500,10 +346148,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_2 : FILE
 		$op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <250KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Ntevt : FILE
 {
 	meta:
@@ -349513,9 +346159,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Ntevt : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1577-L1591"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c5259c89dfedc34ca032775bda4ead04985da6b3d042b8a6635f5f848570d8c6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1577-L1591"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c5259c89dfedc34ca032775bda4ead04985da6b3d042b8a6635f5f848570d8c6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349527,10 +346173,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Ntevt : FILE
 		$s2 = "c:\\ntevt.pdb" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Nethide_Implant : FILE
 {
 	meta:
@@ -349540,9 +346184,9 @@ rule SIGNATURE_BASE_Equationgroup_Nethide_Implant : FILE
 		date = "2017-01-13"
 		modified = "2023-01-27"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1593-L1608"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bd25d05b001ac7d41e60270b62aeecd520a570e76557c68d78d9680c7beb90ab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1593-L1608"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bd25d05b001ac7d41e60270b62aeecd520a570e76557c68d78d9680c7beb90ab"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349554,10 +346198,8 @@ rule SIGNATURE_BASE_Equationgroup_Nethide_Implant : FILE
 		$s2 = "s\\drivers\\" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 90KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_4 : FILE
 {
 	meta:
@@ -349567,9 +346209,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_4 : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1610-L1624"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3046cbfa4b4f5eb5d0efc1b2b658567391b0c219650437088a0d6c179e9235fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1610-L1624"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3046cbfa4b4f5eb5d0efc1b2b658567391b0c219650437088a0d6c179e9235fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349581,10 +346223,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_4 : FILE
 		$op3 = { 00 0f b7 5e 14 8d 5c 33 18 8b c3 2b 45 08 50 ff }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Tdi6 : FILE
 {
 	meta:
@@ -349594,9 +346234,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Tdi6 : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1626-L1642"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ba7e14a3bf158795ecee498976847fbbcc80635799be4574f05aa80d1a85a4ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1626-L1642"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ba7e14a3bf158795ecee498976847fbbcc80635799be4574f05aa80d1a85a4ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349610,10 +346250,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Tdi6 : FILE
 		$s6 = "FailAction" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Modifyauthentication_Implant : FILE
 {
 	meta:
@@ -349623,9 +346261,9 @@ rule SIGNATURE_BASE_Equationgroup_Modifyauthentication_Implant : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1644-L1661"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8bdc4c9e9a3e327bb55781670d8f373d5a8904ccd47cc4b67673c47a76c54927"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1644-L1661"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8bdc4c9e9a3e327bb55781670d8f373d5a8904ccd47cc4b67673c47a76c54927"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349640,10 +346278,8 @@ rule SIGNATURE_BASE_Equationgroup_Modifyauthentication_Implant : FILE
 		$s5 = ".?AVFeFinallyFailure@@" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Ntfltmgr : FILE
 {
 	meta:
@@ -349653,9 +346289,9 @@ rule SIGNATURE_BASE_Equationgroup_Ntfltmgr : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1663-L1679"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3e931088f363c7dfb6057019faf9e5c674c90f6bdae6211dcc871464b410efd3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1663-L1679"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3e931088f363c7dfb6057019faf9e5c674c90f6bdae6211dcc871464b410efd3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349669,10 +346305,8 @@ rule SIGNATURE_BASE_Equationgroup_Ntfltmgr : FILE
 		$s5 = "Corporation. All rights reserved." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_DXGHLP16 : FILE
 {
 	meta:
@@ -349682,9 +346316,9 @@ rule SIGNATURE_BASE_Equationgroup_DXGHLP16 : FILE
 		date = "2017-01-13"
 		modified = "2023-01-06"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1681-L1702"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5244cef876af4c0c02109599e6250254c854ed5c9bd2d0ccc44676dca21a1650"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1681-L1702"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5244cef876af4c0c02109599e6250254c854ed5c9bd2d0ccc44676dca21a1650"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349702,10 +346336,8 @@ rule SIGNATURE_BASE_Equationgroup_DXGHLP16 : FILE
 		$s9 = "\\Device\\%ws" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Msgkd : FILE
 {
 	meta:
@@ -349715,9 +346347,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Msgkd : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1704-L1718"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "60336294ef5fa0221fc6a0e8b05bb279ac0e167024568cd9efa78e678e763704"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1704-L1718"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_60336294ef5fa0221fc6a0e8b05bb279ac0e167024568cd9efa78e678e763704"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349729,10 +346361,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Msgkd : FILE
 		$s2 = "XWWWPWS" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Runaschild_Lp : FILE
 {
 	meta:
@@ -349742,9 +346372,9 @@ rule SIGNATURE_BASE_Equationgroup_Runaschild_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1720-L1735"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "77bea554ead64f85f4efdc49f91ea3b24d1759ae9d91718d443938ab862b0191"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1720-L1735"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_77bea554ead64f85f4efdc49f91ea3b24d1759ae9d91718d443938ab862b0191"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349757,10 +346387,8 @@ rule SIGNATURE_BASE_Equationgroup_Runaschild_Lp : FILE
 		$s4 = "Invalid input to lpRunAsChildPPC" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_6 : FILE
 {
 	meta:
@@ -349770,9 +346398,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_6 : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1737-L1752"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5a14bd8efe2cf68beec207e5deec28fd5b9d89c506593214eccbceae3cb862a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1737-L1752"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5a14bd8efe2cf68beec207e5deec28fd5b9d89c506593214eccbceae3cb862a7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349785,10 +346413,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_6 : FILE
 		$s3 = "Copyright (C) Microsoft" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll_X64 : FILE
 {
 	meta:
@@ -349798,9 +346424,9 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll_X64 : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1754-L1771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b304cb747e609ad5de46624e2d0d005d5f8521e16f0b36cab31535709d7ab72f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1754-L1771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b304cb747e609ad5de46624e2d0d005d5f8521e16f0b36cab31535709d7ab72f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349815,10 +346441,8 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll_X64 : FILE
 		$s5 = "Copyright (C) Microsoft" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and ( all of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( all of ( $s* ) ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_3 : FILE
 {
 	meta:
@@ -349828,9 +346452,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_3 : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1773-L1787"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6b43280a94f1f5c62185f6b879126bcd258e9875beeb0f7ec1e3569494a60669"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1773-L1787"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6b43280a94f1f5c62185f6b879126bcd258e9875beeb0f7ec1e3569494a60669"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349842,10 +346466,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_3 : FILE
 		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Getadmin_Lp : FILE
 {
 	meta:
@@ -349855,9 +346477,9 @@ rule SIGNATURE_BASE_Equationgroup_Getadmin_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1789-L1802"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5bff3858c59b1bb44c5e24ca5f77d8e1e582224cc1caad3955d1adb0efea318a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1789-L1802"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5bff3858c59b1bb44c5e24ca5f77d8e1e582224cc1caad3955d1adb0efea318a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349868,10 +346490,8 @@ rule SIGNATURE_BASE_Equationgroup_Getadmin_Lp : FILE
 		$x1 = "Current user is System -- unable to join administrators group" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Modifygroup_Lp : FILE
 {
 	meta:
@@ -349881,9 +346501,9 @@ rule SIGNATURE_BASE_Equationgroup_Modifygroup_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1805-L1819"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8fe5102cacd9149a0ed60440c563953d487aa2b28a3b947d821d0cc3f3396a4a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1805-L1819"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8fe5102cacd9149a0ed60440c563953d487aa2b28a3b947d821d0cc3f3396a4a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349895,10 +346515,8 @@ rule SIGNATURE_BASE_Equationgroup_Modifygroup_Lp : FILE
 		$s2 = "Given privilege name not found" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Pwdump_Lp : FILE
 {
 	meta:
@@ -349908,9 +346526,9 @@ rule SIGNATURE_BASE_Equationgroup_Pwdump_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1821-L1834"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7381ffd9b2b720fa99d52bc5805fea942e5a966bf3fd611f1a80a875edd06dad"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1821-L1834"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7381ffd9b2b720fa99d52bc5805fea942e5a966bf3fd611f1a80a875edd06dad"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349921,10 +346539,8 @@ rule SIGNATURE_BASE_Equationgroup_Pwdump_Lp : FILE
 		$x1 = "PWDUMP - - ERROR - -" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Eventlogedit_Implant : FILE
 {
 	meta:
@@ -349934,9 +346550,9 @@ rule SIGNATURE_BASE_Equationgroup_Eventlogedit_Implant : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1836-L1851"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1d391eaed77150ab2a26dfed60ebd82aa2c6802b6b604791fb78d08db7fe5ec9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1836-L1851"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1d391eaed77150ab2a26dfed60ebd82aa2c6802b6b604791fb78d08db7fe5ec9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349949,10 +346565,8 @@ rule SIGNATURE_BASE_Equationgroup_Eventlogedit_Implant : FILE
 		$s3 = "hZwOpenProcess" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Portmap_Lp : FILE
 {
 	meta:
@@ -349962,9 +346576,9 @@ rule SIGNATURE_BASE_Equationgroup_Portmap_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1853-L1868"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9666e64b40dc01c5b3756b1334519730765f7075ba9a124a79f5b7ea4bc91e03"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1853-L1868"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9666e64b40dc01c5b3756b1334519730765f7075ba9a124a79f5b7ea4bc91e03"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -349977,10 +346591,8 @@ rule SIGNATURE_BASE_Equationgroup_Portmap_Lp : FILE
 		$s3 = "Invalid parameters received for portmap" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Processoptions_Lp : FILE
 {
 	meta:
@@ -349990,9 +346602,9 @@ rule SIGNATURE_BASE_Equationgroup_Processoptions_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1870-L1883"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cc9cd566f57d28ccea6d53d2eba71187f01cdf6e140771cace33349f6439461d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1870-L1883"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cc9cd566f57d28ccea6d53d2eba71187f01cdf6e140771cace33349f6439461d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -350003,10 +346615,8 @@ rule SIGNATURE_BASE_Equationgroup_Processoptions_Lp : FILE
 		$s1 = "Invalid parameter received by implant" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Passfreely_Lp : FILE
 {
 	meta:
@@ -350016,9 +346626,9 @@ rule SIGNATURE_BASE_Equationgroup_Passfreely_Lp : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1885-L1900"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c3ceb04b42b6e741b1578ec9ecb83b72c599d9af457d6d4e8de572e481d3aa5c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1885-L1900"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c3ceb04b42b6e741b1578ec9ecb83b72c599d9af457d6d4e8de572e481d3aa5c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -350031,10 +346641,8 @@ rule SIGNATURE_BASE_Equationgroup_Passfreely_Lp : FILE
 		$s3 = "Unable to reset the memory protection mask to the memory" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_1 : FILE
 {
 	meta:
@@ -350044,9 +346652,9 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_1 : FILE
 		date = "2017-01-13"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1904-L1933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "97fe69f0c8f2fc44fdcd796c9390c3912f31c56540af1ca8f2baab16d1e91add"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1904-L1933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_97fe69f0c8f2fc44fdcd796c9390c3912f31c56540af1ca8f2baab16d1e91add"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -350073,7 +346681,7 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_1 : FILE
 		$x2 = "Injection Lib -  JUMPUP failed to open requested process" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*)) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of ( $x* ) ) or ( all of them )
 }
 import "pe"
 
@@ -350086,9 +346694,9 @@ rule SIGNATURE_BASE_Equationdrug_MS_Identifier
 		date = "2015-03-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp.yar#L1937-L1948"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7b919c82b6e765be5adb927bf79d13f9b37a214a6f8a1f7b237a88ba46ae958c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp.yar#L1937-L1948"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7b919c82b6e765be5adb927bf79d13f9b37a214a6f8a1f7b237a88ba46ae958c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -350097,7 +346705,7 @@ rule SIGNATURE_BASE_Equationdrug_MS_Identifier
 		$s1 = "Microsoft(R) Windows (TM) Operating System" fullword wide
 
 	condition:
-		$s1 and pe.timestamp>946684800
+		$s1 and pe.timestamp > 946684800
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php5 : FILE
 {
@@ -350108,10 +346716,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php5 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0fd91b6ad400a857a6a65c8132c39e6a16712f19"
-		logic_hash = "e882f115a67fe31ece1a81e1a2770b46370a92ac3aa23e348a12cdb5735e8a0e"
+		logic_hash = "v1_sha256_e882f115a67fe31ece1a81e1a2770b46370a92ac3aa23e348a12cdb5735e8a0e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350122,7 +346730,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php5 : FILE
 		$s20 = "echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump').\"<b>\".$" ascii
 
 	condition:
-		uint16(0)==0x3f3c and filesize <300KB and all of them
+		uint16( 0 ) == 0x3f3c and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Test3693 : FILE
 {
@@ -350133,10 +346741,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Test3693 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L25-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L25-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "246d629ae3ad980b5bfe7e941fe90b855155dbfc"
-		logic_hash = "a10618d54fb7adbbd89a10f2e1ac067ccd1832140bcaf3b92394ebe7323f2d1e"
+		logic_hash = "v1_sha256_a10618d54fb7adbbd89a10f2e1ac067ccd1832140bcaf3b92394ebe7323f2d1e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350147,7 +346755,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Test3693 : FILE
 		$s2 = "http://www.topronet.com </font>\",\" <font color=red> Thanks for your support - " ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <50KB and all of them
+		uint16( 0 ) == 0x4b50 and filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Mycode12 : FILE
 {
@@ -350158,10 +346766,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Mycode12 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L42-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L42-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "64be8760be5ab5c2dcf829e3f87d3e50b1922f17"
-		logic_hash = "94cb0e414634af753db9ec0c63a3a34b4f9104e93e01d67cebab7b3a0c471198"
+		logic_hash = "v1_sha256_94cb0e414634af753db9ec0c63a3a34b4f9104e93e01d67cebab7b3a0c471198"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350172,7 +346780,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Mycode12 : FILE
 		$s2 = "<cfoutput>#cmd#</cfoutput>" fullword ascii
 
 	condition:
-		filesize <4KB and all of them
+		filesize < 4KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Offlibrary : FILE
 {
@@ -350183,10 +346791,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Offlibrary : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L59-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L59-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "eb5275f99211106ae10a23b7e565d208a94c402b"
-		logic_hash = "ffec24bedfe0794e8f92da5067c41932339e61ec23d71a67ed4b634434cd10d6"
+		logic_hash = "v1_sha256_ffec24bedfe0794e8f92da5067c41932339e61ec23d71a67ed4b634434cd10d6"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350197,7 +346805,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Offlibrary : FILE
 		$s12 = "if(jushRoot){var script=document.createElement('script');script.src=jushRoot+'ju" ascii
 
 	condition:
-		filesize <1005KB and all of them
+		filesize < 1005KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_Xl : FILE
 {
@@ -350208,10 +346816,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_Xl : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L76-L91"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L76-L91"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "49c3d16ee970945367a7d6ae86b7ade7cb3b5447"
-		logic_hash = "b6683a24ad58a9444ec91f13e7da5db3e3e768afded09a23e1bbd0a0c23cf6b9"
+		logic_hash = "v1_sha256_b6683a24ad58a9444ec91f13e7da5db3e3e768afded09a23e1bbd0a0c23cf6b9"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350222,7 +346830,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_Xl : FILE
 		$s1 = "<CFFILE ACTION=\"Write\" FILE=\"#Form.path#\" OUTPUT=\"#Form.cmd#\">" fullword ascii
 
 	condition:
-		uint16(0)==0x433c and filesize <13KB and all of them
+		uint16( 0 ) == 0x433c and filesize < 13KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Linux : FILE
 {
@@ -350233,10 +346841,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Linux : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L93-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L93-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "78339abb4e2bb00fe8a012a0a5b7ffce305f4e06"
-		logic_hash = "2c6278acd123e0d41ed4f0f8f0da27d5de1ad56efb8102c9eae442838a0416d0"
+		logic_hash = "v1_sha256_2c6278acd123e0d41ed4f0f8f0da27d5de1ad56efb8102c9eae442838a0416d0"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350247,7 +346855,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Linux : FILE
 		$s1 = "<title>Changing CHMOD Permissions Exploit " fullword ascii
 
 	condition:
-		uint16(0)==0x696c and filesize <6KB and all of them
+		uint16( 0 ) == 0x696c and filesize < 6KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Interception3389_Get : FILE
 {
@@ -350258,10 +346866,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Interception3389_Get : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L110-L126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L110-L126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ceb6306f6379c2c1634b5058e1894b43abcf0296"
-		logic_hash = "649e611c9d8948e60811af4209d737b3e797e6b42beba42439541ae543b062d6"
+		logic_hash = "v1_sha256_649e611c9d8948e60811af4209d737b3e797e6b42beba42439541ae543b062d6"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350273,7 +346881,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Interception3389_Get : FILE
 		$s3 = "set file=fs.OpenTextFile(server.MapPath(\"WinlogonHack.txt\"),8,True)" fullword ascii
 
 	condition:
-		filesize <3KB and all of them
+		filesize < 3KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Nc_1 : FILE
 {
@@ -350284,10 +346892,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Nc_1 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L128-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L128-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "51d83961171db000fe4476f36d703ef3de409676"
-		logic_hash = "80ea8f16d943a3775fe9999131272af9e7f1af60d413109e58ecdef036484760"
+		logic_hash = "v1_sha256_80ea8f16d943a3775fe9999131272af9e7f1af60d413109e58ecdef036484760"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350298,7 +346906,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Nc_1 : FILE
 		$s2 = "<%if session(\"pw\")<>\"go\" then %>" fullword ascii
 
 	condition:
-		filesize <11KB and all of them
+		filesize < 11KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Blacksky : FILE
 {
@@ -350309,10 +346917,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Blacksky : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L145-L160"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L145-L160"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a60a599c6c8b6a6c0d9da93201d116af257636d7"
-		logic_hash = "3b92f63f536361d8ba0cde853fb546f271abdec3a7c1d44688a42610f5f90c57"
+		logic_hash = "v1_sha256_3b92f63f536361d8ba0cde853fb546f271abdec3a7c1d44688a42610f5f90c57"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350323,7 +346931,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Blacksky : FILE
 		$s1 = "B1ac7Sky-->" fullword ascii
 
 	condition:
-		filesize <641KB and all of them
+		filesize < 641KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp3 : FILE
 {
@@ -350334,10 +346942,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp3 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L162-L177"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L162-L177"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
-		logic_hash = "e5f30a445be30c491e669c633bf2df08cbfb1017ecfc91f9ed83275550488304"
+		logic_hash = "v1_sha256_e5f30a445be30c491e669c633bf2df08cbfb1017ecfc91f9ed83275550488304"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350348,7 +346956,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp3 : FILE
 		$s2 = "c.open \"GET\", \"http://127.0.0.1:\" & port & \"/M_Schumacher/upadmin/s3\", Tru" ascii
 
 	condition:
-		filesize <444KB and all of them
+		filesize < 444KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Sniff : FILE
 {
@@ -350359,10 +346967,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Sniff : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L179-L194"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L179-L194"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e246256696be90189e6d50a4ebc880e6d9e28dfd"
-		logic_hash = "198442e75422055e7d65c5d1aef55819036a99077aa79dbd5006ba97c4fe4af8"
+		logic_hash = "v1_sha256_198442e75422055e7d65c5d1aef55819036a99077aa79dbd5006ba97c4fe4af8"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350373,7 +346981,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Sniff : FILE
 		$s2 = "if (!logIt && my_s_smtp && (dport == 25 || sport == 25))" fullword ascii
 
 	condition:
-		filesize <91KB and all of them
+		filesize < 91KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Udf_Udf : FILE
 {
@@ -350384,10 +346992,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Udf_Udf : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L196-L211"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L196-L211"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "df63372ccab190f2f1d852f709f6b97a8d9d22b9"
-		logic_hash = "c7db32b5e66601e0b8322ac67b6b9ba8d6222891ed01db557bfac9985140421a"
+		logic_hash = "v1_sha256_c7db32b5e66601e0b8322ac67b6b9ba8d6222891ed01db557bfac9985140421a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350398,7 +347006,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Udf_Udf : FILE
 		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii
 
 	condition:
-		filesize <430KB and all of them
+		filesize < 430KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_JSP_Jsp : FILE
 {
@@ -350409,10 +347017,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_JSP_Jsp : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L213-L228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L213-L228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c58fed3d3d1e82e5591509b04ed09cb3675dc33a"
-		logic_hash = "089e1a553900d149a4087ac81254295d74de15d9baaf73e60ce4f061e450e8c7"
+		logic_hash = "v1_sha256_089e1a553900d149a4087ac81254295d74de15d9baaf73e60ce4f061e450e8c7"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350423,7 +347031,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_JSP_Jsp : FILE
 		$s2 = "<font color=red>www.i0day.com  By:" fullword ascii
 
 	condition:
-		filesize <3KB and all of them
+		filesize < 3KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_T00Ls_Lpk_Sethc_V4_Mail : FILE
 {
@@ -350434,10 +347042,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_T00Ls_Lpk_Sethc_V4_Mail : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L230-L245"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L230-L245"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0a9b7b438591ee78ee573028cbb805a9dbb9da96"
-		logic_hash = "b835a6d0c736116e0a8b277dadbf25c2ac333b0d7937a6f67ed59887c610a57a"
+		logic_hash = "v1_sha256_b835a6d0c736116e0a8b277dadbf25c2ac333b0d7937a6f67ed59887c610a57a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350448,7 +347056,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_T00Ls_Lpk_Sethc_V4_Mail : FILE
 		$s2 = "$this->smtp_debug(\"> \".$cmd.\"\\n\");" fullword ascii
 
 	condition:
-		filesize <39KB and all of them
+		filesize < 39KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Phpwebbackup : FILE
 {
@@ -350459,10 +347067,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Phpwebbackup : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L247-L262"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L247-L262"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c788cb280b7ad0429313837082fe84e9a49efab6"
-		logic_hash = "45452fc415fbafe170a1b1f5a58df40f0ec65a9a6678e675b40a8c54e2d8bd6c"
+		logic_hash = "v1_sha256_45452fc415fbafe170a1b1f5a58df40f0ec65a9a6678e675b40a8c54e2d8bd6c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350473,7 +347081,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Phpwebbackup : FILE
 		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii
 
 	condition:
-		uint16(0)==0x3f3c and filesize <67KB and all of them
+		uint16( 0 ) == 0x3f3c and filesize < 67KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Dz_Phpcms_Phpbb : FILE
 {
@@ -350484,10 +347092,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Dz_Phpcms_Phpbb : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L264-L281"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L264-L281"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "33f23c41df452f8ca2768545ac6e740f30c44d1f"
-		logic_hash = "1455df58f51c3ae7558b89c940d97ea5870f261217b2a09727bb6678bcbd5500"
+		logic_hash = "v1_sha256_1455df58f51c3ae7558b89c940d97ea5870f261217b2a09727bb6678bcbd5500"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350500,7 +347108,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Dz_Phpcms_Phpbb : FILE
 		$s4 = ":user=\".$user.\"\\n\";echo \"pwd=\".$pwd.\"\\n\";echo \"salt=\".$salt.\"\\n\";" fullword ascii
 
 	condition:
-		filesize <22KB and all of them
+		filesize < 22KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Picloaked_1 : FILE
 {
@@ -350511,10 +347119,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Picloaked_1 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L283-L299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L283-L299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3eab1798cbc9ab3b2c67d3da7b418d07e775db70"
-		logic_hash = "a816ac9e98b7c5208f075ffcb9a6525016d6a5c468005d78ecab90d651423705"
+		logic_hash = "v1_sha256_a816ac9e98b7c5208f075ffcb9a6525016d6a5c468005d78ecab90d651423705"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350526,7 +347134,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Picloaked_1 : FILE
 		$s3 = "GIF89a" fullword ascii
 
 	condition:
-		filesize <6KB and 2 of them
+		filesize < 6KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Assembly : FILE
 {
@@ -350537,10 +347145,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Assembly : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L301-L315"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L301-L315"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2bcb4d22758b20df6b9135d3fb3c8f35a9d9028e"
-		logic_hash = "34dc47b2f91a15a62175f3cab88d5ff24d2a3aa62f74fb9e43a4aaae96ced999"
+		logic_hash = "v1_sha256_34dc47b2f91a15a62175f3cab88d5ff24d2a3aa62f74fb9e43a4aaae96ced999"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350550,7 +347158,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Assembly : FILE
 		$s0 = "response.write oScriptlhn.exec(\"cmd.exe /c\" & request(\"c\")).stdout.readall" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php8 : FILE
 {
@@ -350561,10 +347169,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php8 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L317-L334"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L317-L334"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b7b49f1d6645865691eccd025e140c521ff01cce"
-		logic_hash = "435ceb72c082f702284c464979a907a59a42bb4aa07311f9b2da1a9831efac11"
+		logic_hash = "v1_sha256_435ceb72c082f702284c464979a907a59a42bb4aa07311f9b2da1a9831efac11"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350577,7 +347185,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php8 : FILE
 		$s5 = "$_REQUEST[zipname] = \"dodozip.zip\"; " fullword ascii
 
 	condition:
-		filesize <25KB and 2 of them
+		filesize < 25KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Xx : FILE
 {
@@ -350588,10 +347196,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Xx : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L336-L352"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L336-L352"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2f39f1d9846ae72fc673f9166536dc21d8f396aa"
-		logic_hash = "67c542f172fd1b97fbee4697fd42bab9486e3d779ce62993617e5a5205bd75d4"
+		logic_hash = "v1_sha256_67c542f172fd1b97fbee4697fd42bab9486e3d779ce62993617e5a5205bd75d4"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350603,7 +347211,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Xx : FILE
 		$s16 = "mysql_query(\"SET NAMES gbk\");" fullword ascii
 
 	condition:
-		filesize <2KB and all of them
+		filesize < 2KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_JSPMSSQL : FILE
 {
@@ -350614,10 +347222,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_JSPMSSQL : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L354-L369"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L354-L369"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c6b4faecd743d151fe0a4634e37c9a5f6533655f"
-		logic_hash = "c08e69345cb09e41840a81dcd8a015f9e1be93d570b64c310be74631e5314e2f"
+		logic_hash = "v1_sha256_c08e69345cb09e41840a81dcd8a015f9e1be93d570b64c310be74631e5314e2f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350628,7 +347236,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_JSPMSSQL : FILE
 		$s2 = "String sql = request.getParameter(\"sqlcmd\");" fullword ascii
 
 	condition:
-		filesize <35KB and all of them
+		filesize < 35KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Injection_Transit_Jmpost : FILE
 {
@@ -350639,10 +347247,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Injection_Transit_Jmpost : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L371-L386"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L371-L386"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
-		logic_hash = "6c7f52cf7ff6df9867ea2c46cd8f40ef0e077d4e1d9033cde0649a209bffe21b"
+		logic_hash = "v1_sha256_6c7f52cf7ff6df9867ea2c46cd8f40ef0e077d4e1d9033cde0649a209bffe21b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350653,7 +347261,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Injection_Transit_Jmpost : FILE
 		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii
 
 	condition:
-		filesize <9KB and all of them
+		filesize < 9KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Web_Asp : FILE
 {
@@ -350664,10 +347272,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Web_Asp : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L388-L403"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L388-L403"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aebf6530e89af2ad332062c6aae4a8ca91517c76"
-		logic_hash = "5d2d7e6b9340ee4fd845ff05c99526c919214974b1a0def66492fe3cd4a75fe9"
+		logic_hash = "v1_sha256_5d2d7e6b9340ee4fd845ff05c99526c919214974b1a0def66492fe3cd4a75fe9"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350678,7 +347286,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Web_Asp : FILE
 		$s1 = "\" >[Copy code]</a> 4ngr7&nbsp; &nbsp;</td>" fullword ascii
 
 	condition:
-		filesize <13KB and all of them
+		filesize < 13KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Wshell_Asp : FILE
 {
@@ -350689,10 +347297,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Wshell_Asp : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L405-L421"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L405-L421"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4a0afdf5a45a759c14e99eb5315964368ca53e9c"
-		logic_hash = "f3c4af85e4798d3a809d8edd9cc46d1df44453f14ed050b002fe789da4d6096f"
+		logic_hash = "v1_sha256_f3c4af85e4798d3a809d8edd9cc46d1df44453f14ed050b002fe789da4d6096f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350704,7 +347312,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Wshell_Asp : FILE
 		$s3 = "root.asp " fullword ascii
 
 	condition:
-		filesize <5KB and all of them
+		filesize < 5KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp404 : FILE
 {
@@ -350715,10 +347323,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp404 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L423-L439"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L423-L439"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bed51971288aeabba6dabbfb80d2843ec0c4ebf6"
-		logic_hash = "c84be2e561a08317be11cdb0fe103f8ad182a64d8cd1bf987163ebbeabe20f00"
+		logic_hash = "v1_sha256_c84be2e561a08317be11cdb0fe103f8ad182a64d8cd1bf987163ebbeabe20f00"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350730,7 +347338,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp404 : FILE
 		$s2 = "<td>&nbsp;<a href=\"<%=tempurl+f1.name%>\" target=\"_blank\"><%=f1.name%></a></t" ascii
 
 	condition:
-		filesize <113KB and all of them
+		filesize < 113KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Asp : FILE
 {
@@ -350741,10 +347349,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Asp : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L441-L457"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L441-L457"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
-		logic_hash = "c98c3f4db5ea812827b6108ef88b57116621142202248f4f26f0c71bd76e33ec"
+		logic_hash = "v1_sha256_c98c3f4db5ea812827b6108ef88b57116621142202248f4f26f0c71bd76e33ec"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350756,7 +347364,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Asp : FILE
 		$s3 = "deldomain = \"-DELETEDOMAIN\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \" PortNo=\"" ascii
 
 	condition:
-		filesize <30KB and 2 of them
+		filesize < 30KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_List : FILE
 {
@@ -350767,10 +347375,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_List : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L459-L474"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L459-L474"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "85d445b13d2aef1df3b264c9b66d73f0ff345cec"
-		logic_hash = "41c7c5ba6187a8871dec83bcd859b9377813d60cea8ef2b4ad390c67de04e010"
+		logic_hash = "v1_sha256_41c7c5ba6187a8871dec83bcd859b9377813d60cea8ef2b4ad390c67de04e010"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350781,7 +347389,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_List : FILE
 		$s2 = "<TD>#mydirectory.size#</TD>" fullword ascii
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php2 : FILE
 {
@@ -350792,10 +347400,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L476-L491"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L476-L491"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bf12e1d741075cd1bd324a143ec26c732a241dea"
-		logic_hash = "707e2795d82636fbbc4d9f5324e509a526f77f9ead8f3c4d59dd0e95bc94f11e"
+		logic_hash = "v1_sha256_707e2795d82636fbbc4d9f5324e509a526f77f9ead8f3c4d59dd0e95bc94f11e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350806,7 +347414,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php2 : FILE
 		$s2 = "<?php // Black" fullword ascii
 
 	condition:
-		filesize <12KB and all of them
+		filesize < 12KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Oracle : FILE
 {
@@ -350817,10 +347425,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Oracle : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L493-L509"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L493-L509"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fc7043aaac0ee2d860d11f18ddfffbede9d07957"
-		logic_hash = "3ad4207e426ed2f9df0e0bac0e906af437b0774ba2ebb541afbe7e29b395ad63"
+		logic_hash = "v1_sha256_3ad4207e426ed2f9df0e0bac0e906af437b0774ba2ebb541afbe7e29b395ad63"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350832,7 +347440,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Oracle : FILE
 		$s3 = "String sql=\"SELECT 1,2,3,4,5,6,7,8,9,10 from user_info\";" fullword ascii
 
 	condition:
-		filesize <7KB and all of them
+		filesize < 7KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx4 : FILE
 {
@@ -350843,10 +347451,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx4 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L511-L527"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L511-L527"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "200a8f15ffb6e3af31d28c55588003b5025497eb"
-		logic_hash = "0aab8e327b4477cb0b8cd5d4b1e4b52c160180656dad57b0498654da1c8d7a29"
+		logic_hash = "v1_sha256_0aab8e327b4477cb0b8cd5d4b1e4b52c160180656dad57b0498654da1c8d7a29"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350858,7 +347466,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx4 : FILE
 		$s6 = "<div>Code By <a href =\"http://www.hkmjj.com\">Www.hkmjj.Com</a></div>" fullword ascii
 
 	condition:
-		filesize <11KB and all of them
+		filesize < 11KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx : FILE
 {
@@ -350869,10 +347477,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L529-L546"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L529-L546"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8378619b2a7d446477946eabaa1e6744dec651c1"
-		logic_hash = "b59684633fd72bd1804a96850a8b358db98c169415b6e65fe3ecfb4d9fde72d0"
+		logic_hash = "v1_sha256_b59684633fd72bd1804a96850a8b358db98c169415b6e65fe3ecfb4d9fde72d0"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350885,7 +347493,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx : FILE
 		$s3 = "vyX.Text+=\"<a href=\\\"javascript:Bin_PostBack('Bin_Regread','\"+MVVJ(rootkey)+" ascii
 
 	condition:
-		filesize <353KB and 2 of them
+		filesize < 353KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Su7_X_9_X : FILE
 {
@@ -350896,10 +347504,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Su7_X_9_X : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L548-L563"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L548-L563"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "808396b51023cc8356f8049cfe279b349ca08f1a"
-		logic_hash = "2d2398cf0f9e253eea343d39b6555f2633f92f627f1c93cc28123d5a7f3d1bf1"
+		logic_hash = "v1_sha256_2d2398cf0f9e253eea343d39b6555f2633f92f627f1c93cc28123d5a7f3d1bf1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350910,7 +347518,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Su7_X_9_X : FILE
 		$s1 = "returns=httpopen(\"\",\"POST\",\"http://127.0.0.1:\"&port&\"/Admin/XML/User.xml?" ascii
 
 	condition:
-		filesize <59KB and all of them
+		filesize < 59KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Cfmshell : FILE
 {
@@ -350921,10 +347529,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cfmshell : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L565-L580"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L565-L580"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "740796909b5d011128b6c54954788d14faea9117"
-		logic_hash = "0767012ec8fd4a18a64eca04d459efb55fafd29ed052dab8a0eb1b8f4ce7aa66"
+		logic_hash = "v1_sha256_0767012ec8fd4a18a64eca04d459efb55fafd29ed052dab8a0eb1b8f4ce7aa66"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350935,7 +347543,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cfmshell : FILE
 		$s4 = "<cfif FileExists(\"#GetTempDirectory()#foobar.txt\") is \"Yes\">" fullword ascii
 
 	condition:
-		filesize <4KB and all of them
+		filesize < 4KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp4 : FILE
 {
@@ -350946,10 +347554,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp4 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L582-L598"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L582-L598"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4005b83ced1c032dc657283341617c410bc007b8"
-		logic_hash = "ae02d1efc975a8592a00cbab823355fb778fbb589f5752dd913aa432b316c3a4"
+		logic_hash = "v1_sha256_ae02d1efc975a8592a00cbab823355fb778fbb589f5752dd913aa432b316c3a4"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350961,7 +347569,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp4 : FILE
 		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
 
 	condition:
-		filesize <150KB and all of them
+		filesize < 150KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_2_Admin_By_Lake2 : FILE
 {
@@ -350972,10 +347580,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_2_Admin_By_Lake2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L600-L617"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L600-L617"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cb8039f213e611ab2687edd23e63956c55f30578"
-		logic_hash = "a67c08b3a4bed2385d2fa8c007615bfb37a2d739cc13ee2e0f5eda00536b6ea8"
+		logic_hash = "v1_sha256_a67c08b3a4bed2385d2fa8c007615bfb37a2d739cc13ee2e0f5eda00536b6ea8"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -350988,7 +347596,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_2_Admin_By_Lake2 : FILE
 		$s9 = "\"-HomeDir=c:\\\\\" & vbcrlf & \"-LoginMesFile=\" & vbcrlf & \"-Disable=0\" & vb" ascii
 
 	condition:
-		filesize <17KB and 2 of them
+		filesize < 17KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php3 : FILE
 {
@@ -350999,10 +347607,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php3 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L619-L634"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L619-L634"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e2924cb0537f4cdfd6f1bd44caaaf68a73419b9d"
-		logic_hash = "ba3892feacbbe3d7c6b6308a22ca22b19ae84b6490df2c976852260da2a96ca1"
+		logic_hash = "v1_sha256_ba3892feacbbe3d7c6b6308a22ca22b19ae84b6490df2c976852260da2a96ca1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351013,7 +347621,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php3 : FILE
 		$s2 = "cf('/tmp/.bc',$back_connect);" fullword ascii
 
 	condition:
-		filesize <8KB and all of them
+		filesize < 8KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_By_Goldsun : FILE
 {
@@ -351024,10 +347632,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_By_Goldsun : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L636-L653"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L636-L653"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
-		logic_hash = "962b2e75c03f716fc039cf26aa238e9a3faf5a7ea8fb3d4da556fa601790055a"
+		logic_hash = "v1_sha256_962b2e75c03f716fc039cf26aa238e9a3faf5a7ea8fb3d4da556fa601790055a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351040,7 +347648,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_By_Goldsun : FILE
 		$s4 = "GName=\"http://\" & request.servervariables(\"server_name\")&\":\"&request.serve" ascii
 
 	condition:
-		filesize <30KB and 2 of them
+		filesize < 30KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php10 : FILE
 {
@@ -351051,10 +347659,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php10 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L655-L670"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L655-L670"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3698c566a0ae07234c8957112cdb34b79362b494"
-		logic_hash = "76bb2dfd518173f031cc3c93b2098edaef4aca09f0dd8228223257b0b7df452b"
+		logic_hash = "v1_sha256_76bb2dfd518173f031cc3c93b2098edaef4aca09f0dd8228223257b0b7df452b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351065,7 +347673,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php10 : FILE
 		$s2 = "';if(DB==\"\"||!$od){echo\"<a href='\".h(ME).\"sql='\".bold(isset($_GET[\"sql\"]" ascii
 
 	condition:
-		filesize <600KB and all of them
+		filesize < 600KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Servu : FILE
 {
@@ -351076,10 +347684,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Servu : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L671-L686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L671-L686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7de701b86820096e486e64ca34f1fa9f2fbba641"
-		logic_hash = "d3956b6daa0649233372aea4176e0d43c44d866146884222f92b7efe01f288bb"
+		logic_hash = "v1_sha256_d3956b6daa0649233372aea4176e0d43c44d866146884222f92b7efe01f288bb"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351090,7 +347698,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Servu : FILE
 		$s1 = "function ftpcmd($ftpport,$user,$password,$dir,$cmd){" fullword ascii
 
 	condition:
-		filesize <41KB and all of them
+		filesize < 41KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp2 : FILE
 {
@@ -351101,10 +347709,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L688-L704"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L688-L704"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "412ed15eb0d24298ba41731502018800ffc24bfc"
-		logic_hash = "1ec77a1b0d30cdebce1b5b07445247016230b733a594d8d1de642c2c8af63031"
+		logic_hash = "v1_sha256_1ec77a1b0d30cdebce1b5b07445247016230b733a594d8d1de642c2c8af63031"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351116,7 +347724,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp2 : FILE
 		$s20 = "final String localPort = \"3390\";//request.getParameter(\"localPort\");" fullword ascii
 
 	condition:
-		filesize <23KB and all of them
+		filesize < 23KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx2 : FILE
 {
@@ -351127,10 +347735,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L706-L723"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L706-L723"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "95db7a60f4a9245ffd04c4d9724c2745da55e9fd"
-		logic_hash = "7af90992bc3f708d877dcd5841c0d132793e41a0796607907084516d955b3ae0"
+		logic_hash = "v1_sha256_7af90992bc3f708d877dcd5841c0d132793e41a0796607907084516d955b3ae0"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351143,7 +347751,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx2 : FILE
 		$s3 = "this.lblthispath.Text = Server.MapPath(Request.ServerVariables[\"PATH_INFO\"]);" fullword ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <9KB and all of them
+		uint16( 0 ) == 0x253c and filesize < 9KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Hy2006A : FILE
 {
@@ -351154,10 +347762,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Hy2006A : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L725-L740"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L725-L740"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "20da92b2075e6d96636f883dcdd3db4a38c01090"
-		logic_hash = "a24bf11a2728bb8d18ea005b057648770956694e0b257d4464ad15ee3e24eda2"
+		logic_hash = "v1_sha256_a24bf11a2728bb8d18ea005b057648770956694e0b257d4464ad15ee3e24eda2"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351168,7 +347776,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Hy2006A : FILE
 		$s16 = "If LCase(appName) = \"cmd.exe\" And appArgs <> \"\" Then" fullword ascii
 
 	condition:
-		filesize <406KB and all of them
+		filesize < 406KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php1 : FILE
 {
@@ -351179,10 +347787,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php1 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L742-L758"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L742-L758"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c2f4b150f53c78777928921b3a985ec678bfae32"
-		logic_hash = "aadf47ac6231b41e720efdd85c481ebac8fccb572e57b86b27a95dd367c0d81b"
+		logic_hash = "v1_sha256_aadf47ac6231b41e720efdd85c481ebac8fccb572e57b86b27a95dd367c0d81b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351194,7 +347802,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php1 : FILE
 		$s18 = "echo Exec_Run($perlpath.' /tmp/spider_bc '.$_POST['yourip'].' '.$_POST['yourport" ascii
 
 	condition:
-		filesize <621KB and all of them
+		filesize < 621KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell2 : FILE
 {
@@ -351205,10 +347813,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L760-L775"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L760-L775"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cc7bc1460416663012fc93d52e2078c0a277ff79"
-		logic_hash = "3a60991fa557655fbd2450739976ac612a0ea2a3df22873382b05438cac12762"
+		logic_hash = "v1_sha256_3a60991fa557655fbd2450739976ac612a0ea2a3df22873382b05438cac12762"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351219,7 +347827,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell2 : FILE
 		$s11 = "if (program == null) program = \"cmd.exe /c net start > \"+SHELL_DIR+\"/Log.txt" ascii
 
 	condition:
-		filesize <424KB and all of them
+		filesize < 424KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mysql : FILE
 {
@@ -351230,10 +347838,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mysql : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L777-L791"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L777-L791"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8e242c40aabba48687cfb135b51848af4f2d389d"
-		logic_hash = "bde2ea1ccfc88138456a1b255a32a7323f5ef0f677499db6dc6670987cc37585"
+		logic_hash = "v1_sha256_bde2ea1ccfc88138456a1b255a32a7323f5ef0f677499db6dc6670987cc37585"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351244,7 +347852,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mysql : FILE
 		$s2 = "connString = string.Format(\"Host = {0}; UserName = {1}; Password = {2}; Databas" ascii
 
 	condition:
-		filesize <202KB and all of them
+		filesize < 202KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php9 : FILE
 {
@@ -351255,10 +347863,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php9 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L793-L807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L793-L807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cd3962b1dba9f1b389212e38857568b69ca76725"
-		logic_hash = "bea117862ebc9220a4d9aee091c808274f9907fceb83b528055998ddcc90aa5f"
+		logic_hash = "v1_sha256_bea117862ebc9220a4d9aee091c808274f9907fceb83b528055998ddcc90aa5f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351268,7 +347876,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php9 : FILE
 		$s1 = "Str[17] = \"select shell('c:\\windows\\system32\\cmd.exe /c net user b4che10r ab" ascii
 
 	condition:
-		filesize <1087KB and all of them
+		filesize < 1087KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp : FILE
 {
@@ -351279,10 +347887,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L809-L823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L809-L823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "65e8e4d13ad257c820cad12eef853c6d0134fce8"
-		logic_hash = "98f279c3e50308f67f88ecf8459943187ea152664fe0206c4a7d3435242df2a6"
+		logic_hash = "v1_sha256_98f279c3e50308f67f88ecf8459943187ea152664fe0206c4a7d3435242df2a6"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351292,7 +347900,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp : FILE
 		$s0 = "lcx.jsp?localIP=202.91.246.59&localPort=88&remoteIP=218.232.111.187&remotePort=2" ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx3 : FILE
 {
@@ -351303,10 +347911,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx3 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L825-L840"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L825-L840"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dd61481771f67d9593214e605e63b62d5400c72f"
-		logic_hash = "11bf511ee70ff4bde0a9320cb80dd9efa0f437d432c78a859153cfcc8e80db01"
+		logic_hash = "v1_sha256_11bf511ee70ff4bde0a9320cb80dd9efa0f437d432c78a859153cfcc8e80db01"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351317,7 +347925,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx3 : FILE
 		$s12 = "if (_Debug) System.Console.WriteLine(\"\\ninserting filename into CDS:" ascii
 
 	condition:
-		filesize <100KB and all of them
+		filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Shell_Shell : FILE
 {
@@ -351328,10 +347936,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Shell_Shell : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L842-L857"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L842-L857"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1816006827d16ed73cefdd2f11bd4c47c8af43e4"
-		logic_hash = "ac22d89353b4316289bf6c6e13332ac401f4b57f6c29b71861cb48359c1e55f9"
+		logic_hash = "v1_sha256_ac22d89353b4316289bf6c6e13332ac401f4b57f6c29b71861cb48359c1e55f9"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351342,7 +347950,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Shell_Shell : FILE
 		$s1 = "<%@ Page Language=\"C#\" ValidateRequest=\"false\" %>" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell__Php1_Php7_Php9 : FILE
 {
@@ -351353,9 +347961,9 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Php1_Php7_Php9 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L859-L878"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ea5b362f8d8f2e99725d4dd4d2ada5c3939a45a3dde0084571600452ab4673c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L859-L878"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ea5b362f8d8f2e99725d4dd4d2ada5c3939a45a3dde0084571600452ab4673c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351371,7 +347979,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Php1_Php7_Php9 : FILE
 		$s3 = "Str[7] = \"copy c:\\\\\\\\1.php d:\\\\\\\\2.php\";" fullword ascii
 
 	condition:
-		filesize <300KB and all of them
+		filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell__Serv_U_By_Goldsun_Asp3_Serv_U_Asp : FILE
 {
@@ -351382,9 +347990,9 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Serv_U_By_Goldsun_Asp3_Serv_U_Asp : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L880-L899"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b733e80f234a85a4f65eedd94f535860b4da464adb80a91afc547a8d96b5dc7a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L880-L899"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b733e80f234a85a4f65eedd94f535860b4da464adb80a91afc547a8d96b5dc7a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351400,7 +348008,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Serv_U_By_Goldsun_Asp3_Serv_U_Asp : FILE
 		$s3 = "b.send \"User go\" & vbCrLf & \"pass od\" & vbCrLf & \"site exec \" & cmd & vbCr" ascii
 
 	condition:
-		filesize <444KB and all of them
+		filesize < 444KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell__Asp4_Asp4_MSSQL__MSSQL_ : FILE
 {
@@ -351411,9 +348019,9 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Asp4_Asp4_MSSQL__MSSQL_ : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L901-L921"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a8ec5ad87c83c16f47391c3ce08cee74c6be1e42c288eec6d1559867d28489c6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L901-L921"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a8ec5ad87c83c16f47391c3ce08cee74c6be1e42c288eec6d1559867d28489c6"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351430,7 +348038,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Asp4_Asp4_MSSQL__MSSQL_ : FILE
 		$s2 = "Set Conn = Nothing " fullword ascii
 
 	condition:
-		filesize <341KB and all of them
+		filesize < 341KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell__Injection_Jmcook_Jmpost_Manualinjection : FILE
 {
@@ -351441,9 +348049,9 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Injection_Jmcook_Jmpost_Manualinjection
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L923-L942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f3a4f81326154a6a6ac448d18be29ad534917bc39aba26cc458f06b43001681"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L923-L942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f3a4f81326154a6a6ac448d18be29ad534917bc39aba26cc458f06b43001681"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351459,7 +348067,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Injection_Jmcook_Jmpost_Manualinjection
 		$s2 = "strReturn=Replace(strReturn,chr(43),\"%2B\")  'JMDCW" fullword ascii
 
 	condition:
-		filesize <7342KB and all of them
+		filesize < 7342KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Cmfshell : FILE
 {
@@ -351470,10 +348078,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cmfshell : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L944-L959"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L944-L959"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b9b2107c946431e4ad1a8f5e53ac05e132935c0e"
-		logic_hash = "f138a82c2d6a831626fe200308eb89cb50ffeec2f2722599eb4ccbd082bad73d"
+		logic_hash = "v1_sha256_f138a82c2d6a831626fe200308eb89cb50ffeec2f2722599eb4ccbd082bad73d"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351484,7 +348092,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cmfshell : FILE
 		$s2 = "<form action=\"<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>\" method=\"post\">" fullword ascii
 
 	condition:
-		filesize <4KB and all of them
+		filesize < 4KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php4 : FILE
 {
@@ -351495,10 +348103,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php4 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L961-L975"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L961-L975"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "179975f632baff6ee4d674fe3fabc324724fee9e"
-		logic_hash = "e625b6d1fd2c1e62306ccae2775ee7b53ddcdd7a6baef55b386dfcd92dc2e764"
+		logic_hash = "v1_sha256_e625b6d1fd2c1e62306ccae2775ee7b53ddcdd7a6baef55b386dfcd92dc2e764"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351508,7 +348116,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php4 : FILE
 		$s0 = "nc -l -vv -p port(" ascii
 
 	condition:
-		uint16(0)==0x4850 and filesize <1KB and all of them
+		uint16( 0 ) == 0x4850 and filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Linux_2_6_Exploit : FILE
 {
@@ -351519,10 +348127,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Linux_2_6_Exploit : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L977-L991"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L977-L991"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ec22fac0510d0dc2c29d56c55ff7135239b0aeee"
-		logic_hash = "7f3e2937796358a949ce980210ddeb1a606a7b9c2b4d9c4a4acad49bb556dfc8"
+		logic_hash = "v1_sha256_7f3e2937796358a949ce980210ddeb1a606a7b9c2b4d9c4a4acad49bb556dfc8"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351532,7 +348140,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Linux_2_6_Exploit : FILE
 		$s0 = "[+] Failed to get root :( Something's wrong.  Maybe the kernel isn't vulnerable?" fullword ascii
 
 	condition:
-		filesize <56KB and all of them
+		filesize < 56KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp2 : FILE
 {
@@ -351543,10 +348151,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L993-L1009"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L993-L1009"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b3ac478e72a0457798a3532f6799adeaf4a7fc87"
-		logic_hash = "6107afe9895c4e0c865e78bece160246815a0d3c589bfc79f8b369b94481cd89"
+		logic_hash = "v1_sha256_6107afe9895c4e0c865e78bece160246815a0d3c589bfc79f8b369b94481cd89"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351558,7 +348166,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp2 : FILE
 		$s3 = "Userpwd = \"admin\"   'User Password" fullword ascii
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH : FILE
 {
@@ -351569,10 +348177,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L1011-L1029"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L1011-L1029"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fe63b215473584564ef2e08651c77f764999e8ac"
-		logic_hash = "a66884c71ce0cce05ba6607bf66dc55bfae5393746328c06f5c9ca98005d0caf"
+		logic_hash = "v1_sha256_a66884c71ce0cce05ba6607bf66dc55bfae5393746328c06f5c9ca98005d0caf"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351586,7 +348194,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH : FILE
 		$s5 = "<title>ScanPass(FTP/MYSQL/MSSQL/SSH) by 4ngel</title>" fullword ascii
 
 	condition:
-		filesize <20KB and 3 of them
+		filesize < 20KB and 3 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Shell : FILE
 {
@@ -351597,10 +348205,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Shell : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L1031-L1047"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L1031-L1047"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b7b34215c2293ace70fc06cbb9ce73743e867289"
-		logic_hash = "be3961d6568acfaadfa09efda2f914259a59f4e30725c7d434e89f6020e40515"
+		logic_hash = "v1_sha256_be3961d6568acfaadfa09efda2f914259a59f4e30725c7d434e89f6020e40515"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351612,7 +348220,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Shell : FILE
 		$s3 = "http://hi.baidu.com/xahacker/fuck.txt" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php7 : FILE
 {
@@ -351623,10 +348231,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php7 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L1049-L1064"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L1049-L1064"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
-		logic_hash = "70804d914c6f31422632943bf663f997eb747a290a13b27bfcc66bc3129f136d"
+		logic_hash = "v1_sha256_70804d914c6f31422632943bf663f997eb747a290a13b27bfcc66bc3129f136d"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351637,7 +348245,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php7 : FILE
 		$s1 = "$getfile = isset($_POST['downfile']) ? $_POST['downfile'] : ''; $getaction = iss" ascii
 
 	condition:
-		filesize <300KB and all of them
+		filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Rootkit : FILE
 {
@@ -351648,10 +348256,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Rootkit : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L1066-L1081"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L1066-L1081"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3bfc1c95782e702cf56184e7d438edcf5802eab3"
-		logic_hash = "5569a179f011ece9802676542d5556fe8d2a2b144e26065b9e0c5bd06c970201"
+		logic_hash = "v1_sha256_5569a179f011ece9802676542d5556fe8d2a2b144e26065b9e0c5bd06c970201"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351662,7 +348270,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Rootkit : FILE
 		$s1 = "If jzgm=\"\"Then jzgm=\"cmd.exe /c net user\"" fullword ascii
 
 	condition:
-		filesize <80KB and all of them
+		filesize < 80KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell : FILE
 {
@@ -351673,10 +348281,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L1083-L1098"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L1083-L1098"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d16af622f7688d4e0856a2678c4064d3d120e14b"
-		logic_hash = "9b952f941eb87d7a1b4f747f4e0b0b5ee8876190c6f684b811057a2c78044047"
+		logic_hash = "v1_sha256_9b952f941eb87d7a1b4f747f4e0b0b5ee8876190c6f684b811057a2c78044047"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351687,7 +348295,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell : FILE
 		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii
 
 	condition:
-		filesize <30KB and all of them
+		filesize < 30KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Serv_U : FILE
 {
@@ -351698,10 +348306,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Serv_U : FILE
 		date = "2015-06-23"
 		modified = "2023-01-27"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L1100-L1117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L1100-L1117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1c6415a247c08a63e3359b06575b36017befc0c0"
-		logic_hash = "89cfcbaa38c3b0b6c31af634b4588dcc8bc7a5aa3edac955a162173341d03622"
+		logic_hash = "v1_sha256_89cfcbaa38c3b0b6c31af634b4588dcc8bc7a5aa3edac955a162173341d03622"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351713,7 +348321,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Serv_U : FILE
 		$s3 = "$cmd=\"cmd /c rundll32.exe $path,install $openPort $activeStr\";" fullword ascii
 
 	condition:
-		filesize <435KB and all of them
+		filesize < 435KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Webshell : FILE
 {
@@ -351724,10 +348332,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Webshell : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L1119-L1135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L1119-L1135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
-		logic_hash = "7d80390a86b1858d2cf4f2be56df7e734aea402de0878adf40ef36721719ca74"
+		logic_hash = "v1_sha256_7d80390a86b1858d2cf4f2be56df7e734aea402de0878adf40ef36721719ca74"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351739,7 +348347,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Webshell : FILE
 		$s3 = "warn \"command: '$command'\\n\";" fullword ascii
 
 	condition:
-		filesize <30KB and 2 of them
+		filesize < 30KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mssql_2 : FILE
 {
@@ -351750,10 +348358,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mssql_2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L1137-L1153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L1137-L1153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ad55512afa109b205e4b1b7968a89df0cf781dc9"
-		logic_hash = "1d4b75eeeddda6e92b8ec38679d5e2b9d21abf2d2b467b91a066dcf628725f0a"
+		logic_hash = "v1_sha256_1d4b75eeeddda6e92b8ec38679d5e2b9d21abf2d2b467b91a066dcf628725f0a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351765,7 +348373,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mssql_2 : FILE
 		$s3 = "<blockquote> ServerIP:&nbsp;&nbsp;&nbsp;" fullword ascii
 
 	condition:
-		filesize <3KB and all of them
+		filesize < 3KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp1 : FILE
 {
@@ -351776,10 +348384,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp1 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_webshells.yar#L1155-L1171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_webshells.yar#L1155-L1171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "78b5889b363043ed8a60bed939744b4b19503552"
-		logic_hash = "3b454b1254d05b2208aee02e966c9c56a338dd3d33a2c6acc2c4df3208314055"
+		logic_hash = "v1_sha256_3b454b1254d05b2208aee02e966c9c56a338dd3d33a2c6acc2c4df3208314055"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -351791,7 +348399,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp1 : FILE
 		$s3 = "Server.ScriptTimeout=" ascii
 
 	condition:
-		filesize <200KB and all of them
+		filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_MAL_Icedid_GZIP_LDR_202104 : FILE
 {
@@ -351802,9 +348410,9 @@ rule SIGNATURE_BASE_MAL_Icedid_GZIP_LDR_202104 : FILE
 		date = "2021-04-12"
 		modified = "2023-01-27"
 		reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_icedid.yar#L14-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7a7cc6c7dcbf43bace6a1f259af38560327c34386517e719ad81068b2d9b6659"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_icedid.yar#L14-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7a7cc6c7dcbf43bace6a1f259af38560327c34386517e719ad81068b2d9b6659"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -351823,7 +348431,7 @@ rule SIGNATURE_BASE_MAL_Icedid_GZIP_LDR_202104 : FILE
 		$string10 = "aws.amazon.com" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name or all of ($s*)) or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name or all of ( $s* ) ) or all of them
 }
 rule SIGNATURE_BASE_Bluenoroffpos_DLL
 {
@@ -351834,9 +348442,9 @@ rule SIGNATURE_BASE_Bluenoroffpos_DLL
 		date = "2018-06-07"
 		modified = "2023-12-05"
 		reference = "http://blog.trex.re.kr/3?category=737685"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_bluenoroff_pos.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "39f23045b3e5ef60c199091b7f01ac2a3a31bcb95219aebb9a4cfd0764886f19"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_bluenoroff_pos.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_39f23045b3e5ef60c199091b7f01ac2a3a31bcb95219aebb9a4cfd0764886f19"
 		score = 75
 		quality = 73
 		tags = ""
@@ -351863,9 +348471,9 @@ rule SIGNATURE_BASE_HKTL_Reverse_Connect_TCP_PTY_Shell : FILE
 		date = "2019-10-19"
 		modified = "2023-12-05"
 		reference = "https://github.com/infodox/python-pty-shells/blob/master/tcp_pty_backconnect.py"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_python_pty_shell.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6b92077f9ff775ae3f8166f47a32aaa872fcbf7fcefc3789e5411388aac5403a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_python_pty_shell.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6b92077f9ff775ae3f8166f47a32aaa872fcbf7fcefc3789e5411388aac5403a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -351878,7 +348486,7 @@ rule SIGNATURE_BASE_HKTL_Reverse_Connect_TCP_PTY_Shell : FILE
 		$s4 = "socket.socket(socket.AF_INET, socket.SOCK_STREAM)" fullword ascii
 
 	condition:
-		filesize <1KB and 2 of them
+		filesize < 1KB and 2 of them
 }
 rule SIGNATURE_BASE_Streamex_Shellcrew
 {
@@ -351889,9 +348497,9 @@ rule SIGNATURE_BASE_Streamex_Shellcrew
 		date = "2017-02-09"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_shellcrew_streamex.yar#L11-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a82ff51c1dcd1ebe3d7acc96b46b0b79dcead9146204f060f5413c4c7b5286d3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_shellcrew_streamex.yar#L11-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a82ff51c1dcd1ebe3d7acc96b46b0b79dcead9146204f060f5413c4c7b5286d3"
 		score = 80
 		quality = 85
 		tags = ""
@@ -351906,7 +348514,7 @@ rule SIGNATURE_BASE_Streamex_Shellcrew
 		$g = "D:\\pdb\\ht_d6.pdb"
 
 	condition:
-		$a or $b or $bb or ($c and $d) or $f or $g
+		$a or $b or $bb or ( $c and $d ) or $f or $g
 }
 rule SIGNATURE_BASE_Shellcrew_Streamex_1 : FILE
 {
@@ -351917,9 +348525,9 @@ rule SIGNATURE_BASE_Shellcrew_Streamex_1 : FILE
 		date = "2017-02-10"
 		modified = "2022-12-21"
 		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_shellcrew_streamex.yar#L40-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4da0b8843de87e53243af40700afaab77120531af28dc311d9100bce6721650b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_shellcrew_streamex.yar#L40-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4da0b8843de87e53243af40700afaab77120531af28dc311d9100bce6721650b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -351935,7 +348543,7 @@ rule SIGNATURE_BASE_Shellcrew_Streamex_1 : FILE
 		$s12 = "$\\data.ini" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 4 of them )
 }
 rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi : FILE
 {
@@ -351946,9 +348554,9 @@ rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_shellcrew_streamex.yar#L61-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa853dac58c067a88f1784ac4017fd558151e54ed10ceb32ab90c99e970460fe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_shellcrew_streamex.yar#L61-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa853dac58c067a88f1784ac4017fd558151e54ed10ceb32ab90c99e970460fe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -351964,7 +348572,7 @@ rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi : FILE
 		$s7 = "afhopqvw34ABIJOPTYZehmo" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 3 of them )
 }
 rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi_Dll : FILE
 {
@@ -351975,9 +348583,9 @@ rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi_Dll : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_shellcrew_streamex.yar#L82-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "087ac07a2bf822f7838ef46296150381cfc9af9b12b4023654023a779efc1db1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_shellcrew_streamex.yar#L82-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_087ac07a2bf822f7838ef46296150381cfc9af9b12b4023654023a779efc1db1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -351991,7 +348599,7 @@ rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi_Dll : FILE
 		$s2 = "NsrdsrN" fullword ascii
 
 	condition:
-		( uint16(0)==0x4d9d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x4d9d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1 : FILE
 {
@@ -352002,9 +348610,9 @@ rule SIGNATURE_BASE_WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1 : FILE
 		date = "2021-02-22"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc2546_dewmode.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "86ce185f6350eb7485bce5bd31d91085fed25aa8ce78813e1c3c3dffbaae58ff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc2546_dewmode.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_86ce185f6350eb7485bce5bd31d91085fed25aa8ce78813e1c3c3dffbaae58ff"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -352022,7 +348630,7 @@ rule SIGNATURE_BASE_WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1 : FILE
 		$s5 = "@system('sudo /usr/local" ascii
 
 	condition:
-		uint16(0)==0x3f3c and filesize <9KB and (1 of ($x*) or 2 of them ) or 3 of them
+		uint16( 0 ) == 0x3f3c and filesize < 9KB and ( 1 of ( $x* ) or 2 of them ) or 3 of them
 }
 rule SIGNATURE_BASE_Apt_Backspace : FILE
 {
@@ -352033,10 +348641,10 @@ rule SIGNATURE_BASE_Apt_Backspace : FILE
 		date = "2015-05-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_backspace.yar#L6-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_backspace.yar#L6-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
-		logic_hash = "6fa86ada5c965bd9c199c2a1cf9b691499a3d423da7db50c8987b6725c0c0f29"
+		logic_hash = "v1_sha256_6fa86ada5c965bd9c199c2a1cf9b691499a3d423da7db50c8987b6725c0c0f29"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352047,7 +348655,7 @@ rule SIGNATURE_BASE_Apt_Backspace : FILE
 		$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 import "pe"
 
@@ -352060,9 +348668,9 @@ rule SIGNATURE_BASE_SUSP_Unsigned_Googleupdate : FILE
 		date = "2019-08-05"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_google_anomaly.yar#L3-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e333ac773927e2ed1f6aa4d6bbcb63d67bcc8d18d732a84bb68cb503469b247"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_google_anomaly.yar#L3-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e333ac773927e2ed1f6aa4d6bbcb63d67bcc8d18d732a84bb68cb503469b247"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -352076,7 +348684,7 @@ rule SIGNATURE_BASE_SUSP_Unsigned_Googleupdate : FILE
                00 65 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and $ac1 and pe.number_of_signatures<1
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and $ac1 and pe.number_of_signatures < 1
 }
 rule SIGNATURE_BASE_Fareit_Trojan_Oct15 : FILE
 {
@@ -352087,9 +348695,9 @@ rule SIGNATURE_BASE_Fareit_Trojan_Oct15 : FILE
 		date = "2015-10-18"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/5VYtlU"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fareit.yar#L8-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ef47e81483d5edf67d489a9a35ce56667e293350534e780d7d93b1fbc5f7113a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fareit.yar#L8-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ef47e81483d5edf67d489a9a35ce56667e293350534e780d7d93b1fbc5f7113a"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -352108,7 +348716,7 @@ rule SIGNATURE_BASE_Fareit_Trojan_Oct15 : FILE
 		$s2 = "Origina" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)
+		uint16( 0 ) == 0x5a4d and $s1 in ( 0 .. 30000 ) and $s2 in ( 0 .. 30000 )
 }
 rule SIGNATURE_BASE_HKTL_EXPL_POC_Libssh_Auth_Bypass_CVE_2023_2283_Jun23_1 : CVE_2023_2283 FILE
 {
@@ -352119,9 +348727,9 @@ rule SIGNATURE_BASE_HKTL_EXPL_POC_Libssh_Auth_Bypass_CVE_2023_2283_Jun23_1 : CVE
 		date = "2023-06-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_libssh_cve_2023_2283_jun23.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4c3d54d7f4902c1da664e41096b5931e6534aaaf63243f12e05b81af63d8b28f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_libssh_cve_2023_2283_jun23.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4c3d54d7f4902c1da664e41096b5931e6534aaaf63243f12e05b81af63d8b28f"
 		score = 85
 		quality = 85
 		tags = "CVE-2023-2283, FILE"
@@ -352131,7 +348739,7 @@ rule SIGNATURE_BASE_HKTL_EXPL_POC_Libssh_Auth_Bypass_CVE_2023_2283_Jun23_1 : CVE
 		$s2 = "fork failed: %s" ascii fullword
 
 	condition:
-		uint16(0)==0x457f and all of them
+		uint16( 0 ) == 0x457f and all of them
 }
 import "pe"
 
@@ -352144,9 +348752,9 @@ rule SIGNATURE_BASE_MAL_Hogfish_Report_Related_Sample : FILE
 		date = "2018-05-01"
 		modified = "2023-12-05"
 		reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt10_redleaves.yar#L13-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bff74f7a72a3e40e828284ed37b2f7ea64d8df52e946372d38e379d9b7b7a445"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt10_redleaves.yar#L13-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bff74f7a72a3e40e828284ed37b2f7ea64d8df52e946372d38e379d9b7b7a445"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352159,7 +348767,7 @@ rule SIGNATURE_BASE_MAL_Hogfish_Report_Related_Sample : FILE
 		$s1 = "R=user32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="efad9ff8c0d2a6419bf1dd970bcd806d" or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.imphash ( ) == "efad9ff8c0d2a6419bf1dd970bcd806d" or 1 of them )
 }
 import "pe"
 
@@ -352172,9 +348780,9 @@ rule SIGNATURE_BASE_MAL_Redleaves_Apr18_1 : FILE
 		date = "2018-05-01"
 		modified = "2023-12-05"
 		reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt10_redleaves.yar#L33-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e34b95e96de88aef20050b6b9580600365284117918c24f76c884b089fa20623"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt10_redleaves.yar#L33-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e34b95e96de88aef20050b6b9580600365284117918c24f76c884b089fa20623"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352183,7 +348791,7 @@ rule SIGNATURE_BASE_MAL_Redleaves_Apr18_1 : FILE
 		hash3 = "d956e2ff1b22ccee2c5d9819128103d4c31ecefde3ce463a6dea19ecaaf418a1"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="7a861cd9c495e1d950a43cb708a22985" or pe.imphash()=="566a7a4ef613a797389b570f8b4f79df")
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.imphash ( ) == "7a861cd9c495e1d950a43cb708a22985" or pe.imphash ( ) == "566a7a4ef613a797389b570f8b4f79df" )
 }
 rule SIGNATURE_BASE_Win32_Buzus_Softpulse : FILE
 {
@@ -352194,10 +348802,10 @@ rule SIGNATURE_BASE_Win32_Buzus_Softpulse : FILE
 		date = "2015-05-13"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_buzus_softpulse.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_buzus_softpulse.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2f6df200e63a86768471399a74180466d2e99ea9"
-		logic_hash = "49625594db57e9d629860970c20493b76e554addc2edb41adba64673a820a94b"
+		logic_hash = "v1_sha256_49625594db57e9d629860970c20493b76e554addc2edb41adba64673a820a94b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352213,7 +348821,7 @@ rule SIGNATURE_BASE_Win32_Buzus_Softpulse : FILE
 		$s14 = "/c ping -n 1 www.google" wide
 
 	condition:
-		uint16(0)==0x5a4d and (($x1 and 2 of ($s*)) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and ( ( $x1 and 2 of ( $s* ) ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_Malware_Floxif_Mpsvc_Dll : HIGHVOL FILE
 {
@@ -352224,9 +348832,9 @@ rule SIGNATURE_BASE_Malware_Floxif_Mpsvc_Dll : HIGHVOL FILE
 		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_floxif.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e51258558dfd9a2c65589100a224492f4582067484c99d405b2d432a48cc6ed8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_floxif.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e51258558dfd9a2c65589100a224492f4582067484c99d405b2d432a48cc6ed8"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -352239,7 +348847,7 @@ rule SIGNATURE_BASE_Malware_Floxif_Mpsvc_Dll : HIGHVOL FILE
 		$op3 = { ff 03 8d 00 f9 ff ff 88 01 eb a1 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_Gen_Python_Encoded_Adware : FILE
 {
@@ -352250,10 +348858,10 @@ rule SIGNATURE_BASE_Gen_Python_Encoded_Adware : FILE
 		date = "2018-03-07"
 		modified = "2023-01-06"
 		reference = "https://twitter.com/JohnLaTwC/status/949048002466914304"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_python_encoded_adware.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_python_encoded_adware.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5d7239be779367e69d2e63ffd9dc6e2a1f79c4e5c6c725e8c5e59a44c0ab2fff"
-		logic_hash = "256b289cfe83384c02aacf9c7e790898ba34988c9be149b39e63791c319bfc4a"
+		logic_hash = "v1_sha256_256b289cfe83384c02aacf9c7e790898ba34988c9be149b39e63791c319bfc4a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352264,7 +348872,7 @@ rule SIGNATURE_BASE_Gen_Python_Encoded_Adware : FILE
 		$s2 = "[1]^"
 
 	condition:
-		filesize <100KB and @r1<100 and all of them
+		filesize < 100KB and @r1 < 100 and all of them
 }
 rule SIGNATURE_BASE_SUSP_VEST_Encryption_Core_Accumulator_Jan21 : FILE
 {
@@ -352275,9 +348883,9 @@ rule SIGNATURE_BASE_SUSP_VEST_Encryption_Core_Accumulator_Jan21 : FILE
 		date = "2021-01-28"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ochsenmeier/status/1354737155495649280"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_jan21.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "41fe42b2f2b5fb54b7ff19b74a35aadd928be9a3c7280ee9feffc4a142924b07"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_jan21.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_41fe42b2f2b5fb54b7ff19b74a35aadd928be9a3c7280ee9feffc4a142924b07"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -352296,7 +348904,7 @@ rule SIGNATURE_BASE_SUSP_VEST_Encryption_Core_Accumulator_Jan21 : FILE
                9A D1 22 9F BC 30 15 9F C2 5D F1 23 E6 3A 73 C0 }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_WER_Critical_Heapcorruption : FILE
 {
@@ -352307,9 +348915,9 @@ rule SIGNATURE_BASE_SUSP_WER_Critical_Heapcorruption : FILE
 		date = "2019-10-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1185459425710092288"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_wer_files.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "efa84e375f31ca37b9dd9c7a74251929ac957b9bd530e92f74b8836f56048fea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_wer_files.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_efa84e375f31ca37b9dd9c7a74251929ac957b9bd530e92f74b8836f56048fea"
 		score = 45
 		quality = 85
 		tags = "FILE"
@@ -352320,7 +348928,7 @@ rule SIGNATURE_BASE_SUSP_WER_Critical_Heapcorruption : FILE
 		$s1 = "c0000374" wide
 
 	condition:
-		( uint32be(0)==0x56006500 or uint32be(0)==0xfffe5600) and all of them
+		( uint32be( 0 ) == 0x56006500 or uint32be( 0 ) == 0xfffe5600 ) and all of them
 }
 rule SIGNATURE_BASE_SUSP_WER_Suspicious_Crash_Directory : FILE
 {
@@ -352331,9 +348939,9 @@ rule SIGNATURE_BASE_SUSP_WER_Suspicious_Crash_Directory : FILE
 		date = "2019-10-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1185585050059976705"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_wer_files.yar#L20-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a197feeafca38ffe33428fa807e2b80e3071ab8960926fc2f328748bda299910"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_wer_files.yar#L20-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a197feeafca38ffe33428fa807e2b80e3071ab8960926fc2f328748bda299910"
 		score = 45
 		quality = 85
 		tags = "FILE"
@@ -352351,7 +348959,7 @@ rule SIGNATURE_BASE_SUSP_WER_Suspicious_Crash_Directory : FILE
 		$s8 = /AppPath=C:\\Users\\[^\\]{1,64}\\AppData\\(Local|Roaming)\\[^\\]{1,64}\.exe/ wide nocase
 
 	condition:
-		( uint32be(0)==0x56006500 or uint32be(0)==0xfffe5600) and all of ($a*) and ( not 1 of ($l*) or 1 of ($s*))
+		( uint32be( 0 ) == 0x56006500 or uint32be( 0 ) == 0xfffe5600 ) and all of ( $a* ) and ( not 1 of ( $l* ) or 1 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20121
 {
@@ -352362,10 +348970,10 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20121
 		date = "2015-01-18"
 		modified = "2023-12-05"
 		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_querty_fiveeyes.yar#L3-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_querty_fiveeyes.yar#L3-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
-		logic_hash = "e2660abf4959bc57bcf9d95d974cd20718d5d27f371109cb4526cee208544530"
+		logic_hash = "v1_sha256_e2660abf4959bc57bcf9d95d974cd20718d5d27f371109cb4526cee208544530"
 		score = 75
 		quality = 85
 		tags = ""
@@ -352396,10 +349004,10 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20123_Sys
 		date = "2015-01-18"
 		modified = "2023-12-05"
 		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_querty_fiveeyes.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_querty_fiveeyes.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
-		logic_hash = "881af0e2ff8fad2bca2ae05ad63b5185356181685daafa7a1b9992a1de017c9e"
+		logic_hash = "v1_sha256_881af0e2ff8fad2bca2ae05ad63b5185356181685daafa7a1b9992a1de017c9e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -352424,10 +349032,10 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20123_Cmddef
 		date = "2015-01-18"
 		modified = "2023-12-05"
 		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_querty_fiveeyes.yar#L47-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_querty_fiveeyes.yar#L47-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
-		logic_hash = "84776764caa79ad68f2dd0d2f890821c75f2efba7c46d674110ba870a40a372a"
+		logic_hash = "v1_sha256_84776764caa79ad68f2dd0d2f890821c75f2efba7c46d674110ba870a40a372a"
 		score = 75
 		quality = 83
 		tags = ""
@@ -352468,10 +349076,10 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20121_Dll
 		date = "2015-01-18"
 		modified = "2023-12-05"
 		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_querty_fiveeyes.yar#L82-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_querty_fiveeyes.yar#L82-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "89504d91c5539a366e153894c1bc17277116342b"
-		logic_hash = "e735a7c26652cbf2bccac80a14568a3582b254ae25e2db56a46c09a714650611"
+		logic_hash = "v1_sha256_e735a7c26652cbf2bccac80a14568a3582b254ae25e2db56a46c09a714650611"
 		score = 75
 		quality = 85
 		tags = ""
@@ -352493,10 +349101,10 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20123
 		date = "2015-01-18"
 		modified = "2023-12-05"
 		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_querty_fiveeyes.yar#L97-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_querty_fiveeyes.yar#L97-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
-		logic_hash = "918462399af78b16a8214ceb1d39db554e3136efd4bc643353f0727e4a162516"
+		logic_hash = "v1_sha256_918462399af78b16a8214ceb1d39db554e3136efd4bc643353f0727e4a162516"
 		score = 75
 		quality = 85
 		tags = ""
@@ -352528,10 +349136,10 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20120_Dll
 		date = "2015-01-18"
 		modified = "2023-12-05"
 		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_querty_fiveeyes.yar#L123-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_querty_fiveeyes.yar#L123-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
-		logic_hash = "fc3aac33c84d3b4a981c2d1a9358c54dc5ceca2017dbf2e2a51e1b6970b90796"
+		logic_hash = "v1_sha256_fc3aac33c84d3b4a981c2d1a9358c54dc5ceca2017dbf2e2a51e1b6970b90796"
 		score = 75
 		quality = 83
 		tags = ""
@@ -352572,10 +349180,10 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20120_Cmddef
 		date = "2015-01-18"
 		modified = "2023-12-05"
 		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_querty_fiveeyes.yar#L158-L191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_querty_fiveeyes.yar#L158-L191"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
-		logic_hash = "9c336a09adb5fdf3149e5d0ad716cb854f95effa4ce4dfe3e75f43031e4903ff"
+		logic_hash = "v1_sha256_9c336a09adb5fdf3149e5d0ad716cb854f95effa4ce4dfe3e75f43031e4903ff"
 		score = 75
 		quality = 83
 		tags = ""
@@ -352616,10 +349224,10 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20120
 		date = "2015-01-18"
 		modified = "2023-12-05"
 		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_querty_fiveeyes.yar#L193-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_querty_fiveeyes.yar#L193-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "597082f05bfd3225587d480c30f54a7a1326a892"
-		logic_hash = "7d2617e0ee41ea475608757594cba8ae93f2dbb09b5d01d1fa3324b32ebb8aa0"
+		logic_hash = "v1_sha256_7d2617e0ee41ea475608757594cba8ae93f2dbb09b5d01d1fa3324b32ebb8aa0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -352650,10 +349258,10 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20121_Cmddef
 		date = "2015-01-18"
 		modified = "2023-12-05"
 		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/spy_querty_fiveeyes.yar#L218-L251"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/spy_querty_fiveeyes.yar#L218-L251"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
-		logic_hash = "d73f0e964bd57ed3a2cd782ac204a2b82a9b334e33d64dc61e6414654d7c38d3"
+		logic_hash = "v1_sha256_d73f0e964bd57ed3a2cd782ac204a2b82a9b334e33d64dc61e6414654d7c38d3"
 		score = 75
 		quality = 83
 		tags = ""
@@ -352694,9 +349302,9 @@ rule SIGNATURE_BASE_Upatre_Hazgurut : FILE
 		date = "2015-10-13"
 		modified = "2023-12-05"
 		reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3?environmentId=7"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_upatre_oct15.yar#L8-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "41dd2f615d1c75ef81073d26bfbdb4f5c6735d9a3ff6d543ca77d6e16fe7eb5b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_upatre_oct15.yar#L8-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_41dd2f615d1c75ef81073d26bfbdb4f5c6735d9a3ff6d543ca77d6e16fe7eb5b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -352727,7 +349335,7 @@ rule SIGNATURE_BASE_Upatre_Hazgurut : FILE
 		$s6 = "glmf32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1500KB and $a1 in (0..4000) and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 1500KB and $a1 in ( 0 .. 4000 ) and all of ( $s* )
 }
 rule SIGNATURE_BASE_Stuxnet_Malware_1
 {
@@ -352738,9 +349346,9 @@ rule SIGNATURE_BASE_Stuxnet_Malware_1
 		date = "2016-07-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxnet.yar#L10-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8caa6bddef3c05e572ef342513190832900dcb1a7a56589ed7df48b3c6992ed1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxnet.yar#L10-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8caa6bddef3c05e572ef342513190832900dcb1a7a56589ed7df48b3c6992ed1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -352764,9 +349372,9 @@ rule SIGNATURE_BASE_Stuxnet_Malware_2 : FILE
 		date = "2016-07-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxnet.yar#L43-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ecf992f8fd38b1ab3e05bfe05f260bcaf617f168484477aa81acb9b517b9f3e7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxnet.yar#L43-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ecf992f8fd38b1ab3e05bfe05f260bcaf617f168484477aa81acb9b517b9f3e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352778,7 +349386,7 @@ rule SIGNATURE_BASE_Stuxnet_Malware_2 : FILE
 		$s2 = "http://www.jmicron.co.tw0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 70KB and all of them
 }
 rule SIGNATURE_BASE_Stuxnet_Dll : FILE
 {
@@ -352789,9 +349397,9 @@ rule SIGNATURE_BASE_Stuxnet_Dll : FILE
 		date = "2016-07-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxnet.yar#L59-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c192153c268fdd330d3b9e2eb0d8383bd50ce6d036409f0cc0c9273ba8201b3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxnet.yar#L59-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c192153c268fdd330d3b9e2eb0d8383bd50ce6d036409f0cc0c9273ba8201b3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352802,7 +349410,7 @@ rule SIGNATURE_BASE_Stuxnet_Dll : FILE
 		$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and $s1
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and $s1
 }
 rule SIGNATURE_BASE_Stuxnet_Shortcut_To : FILE
 {
@@ -352813,9 +349421,9 @@ rule SIGNATURE_BASE_Stuxnet_Shortcut_To : FILE
 		date = "2016-07-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxnet.yar#L74-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a8119500d38bcfc60620265386f31899e586f62e1ceeeff365fd0018ab39c30e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxnet.yar#L74-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a8119500d38bcfc60620265386f31899e586f62e1ceeeff365fd0018ab39c30e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352826,7 +349434,7 @@ rule SIGNATURE_BASE_Stuxnet_Shortcut_To : FILE
 		$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide
 
 	condition:
-		uint16(0)==0x004c and filesize <10KB and $x1
+		uint16( 0 ) == 0x004c and filesize < 10KB and $x1
 }
 rule SIGNATURE_BASE_Stuxnet_Malware_3 : FILE
 {
@@ -352837,9 +349445,9 @@ rule SIGNATURE_BASE_Stuxnet_Malware_3 : FILE
 		date = "2016-07-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxnet.yar#L89-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d8c546fb74b419d46bab855fa07a55833ab0a23eb4081ce24a5d4ab0e4bf09dc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxnet.yar#L89-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d8c546fb74b419d46bab855fa07a55833ab0a23eb4081ce24a5d4ab0e4bf09dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352857,7 +349465,7 @@ rule SIGNATURE_BASE_Stuxnet_Malware_3 : FILE
 		$s6 = "{%08x-%08x-%08x-%08x}" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and ($x1 or 3 of ($s*))) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 150KB and ( $x1 or 3 of ( $s* ) ) ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_Stuxnet_Malware_4 : FILE
 {
@@ -352868,9 +349476,9 @@ rule SIGNATURE_BASE_Stuxnet_Malware_4 : FILE
 		date = "2016-07-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxnet.yar#L112-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a4ad77490d17cf897c4639f0b9f9473267886e99a94b4f506670207497117764"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxnet.yar#L112-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a4ad77490d17cf897c4639f0b9f9473267886e99a94b4f506670207497117764"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352884,7 +349492,7 @@ rule SIGNATURE_BASE_Stuxnet_Malware_4 : FILE
 		$x3 = "MRXNET.Sys" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Stuxnet_Maindll_Decrypted_Unpacked
 {
@@ -352895,9 +349503,9 @@ rule SIGNATURE_BASE_Stuxnet_Maindll_Decrypted_Unpacked
 		date = "2016-07-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxnet.yar#L130-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bec740cdb4c1748d0fb546691cf8feb38c0e61adad60c069c5866f5034cb7ed9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxnet.yar#L130-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bec740cdb4c1748d0fb546691cf8feb38c0e61adad60c069c5866f5034cb7ed9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -352926,9 +349534,9 @@ rule SIGNATURE_BASE_Stuxnet_S7Hkimdb : FILE
 		date = "2016-07-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxnet.yar#L152-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a44063b6a542eca17f46802e9f644540f1d6b6cb9777c20ef9ea14e44c341a1c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxnet.yar#L152-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a44063b6a542eca17f46802e9f644540f1d6b6cb9777c20ef9ea14e44c341a1c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -352942,10 +349550,8 @@ rule SIGNATURE_BASE_Stuxnet_S7Hkimdb : FILE
 		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and $x1 and all of ($op*))
+		( uint16( 0 ) == 0x5a4d and filesize < 40KB and $x1 and all of ( $op* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_293A_Malware_1
 {
 	meta:
@@ -352955,9 +349561,9 @@ rule SIGNATURE_BASE_TA17_293A_Malware_1
 		date = "2017-07-17"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L14-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "408297496dfb1cc28e1caa7faaf8537b7970bb1742e1b373175f8273fe11f19d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L14-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_408297496dfb1cc28e1caa7faaf8537b7970bb1742e1b373175f8273fe11f19d"
 		score = 50
 		quality = 75
 		tags = ""
@@ -353002,22 +349608,20 @@ rule SIGNATURE_BASE_TA17_293A_Malware_1
 		$x14 = "http://bit.ly/2m0x8IH"
 
 	condition:
-		($n1 and 1 of ($ax*)) or 2 of ($s*) or 1 of ($x*)
+		($n1 and 1 of ( $ax* ) ) or 2 of ( $s* ) or 1 of ( $x* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_293A_Energetic_Bear_Api_Hashing_Tool : FILE
 {
 	meta:
 		description = "Energetic Bear API Hashing Tool"
 		author = "CERT RE Team"
 		id = "4e58800a-9618-5d8b-954c-e843be6002c2"
-		date = "2024-02-08"
+		date = "2024-02-15"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L77-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5f8a770c727cdd2d32d7cd1ad45ee8b37f7fc63c9e7f4311d318eb15d9050909"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L77-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5f8a770c727cdd2d32d7cd1ad45ee8b37f7fc63c9e7f4311d318eb15d9050909"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353031,10 +349635,8 @@ rule SIGNATURE_BASE_TA17_293A_Energetic_Bear_Api_Hashing_Tool : FILE
 		$http_pop = "X-mode: pop" nocase
 
 	condition:
-		$api_hash_func_v1 or $api_hash_func_v2 or $api_hash_func_x64 and ( uint16(0)==0x5a4d or $http_push or $http_pop)
+		$api_hash_func_v1 or $api_hash_func_v2 or $api_hash_func_x64 and ( uint16( 0 ) == 0x5a4d or $http_push or $http_pop )
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC_PT_2 : FILE
 {
 	meta:
@@ -353044,9 +349646,9 @@ rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC_PT_2 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L95-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8d4c1b23aa8323fa9ddec362bb36e13e5f992883fbf7936b34cf03fe62ee6127"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L95-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8d4c1b23aa8323fa9ddec362bb36e13e5f992883fbf7936b34cf03fe62ee6127"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353057,10 +349659,8 @@ rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC_PT_2 : FILE
 		$bytes = {8c 90 cd 4e eb 30 10 85 d7}
 
 	condition:
-		uint32(0)==0x04034b50 and $dir1 and $bytes
+		uint32( 0 ) == 0x04034b50 and $dir1 and $bytes
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC : FILE
 {
 	meta:
@@ -353070,9 +349670,9 @@ rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L108-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fb3a84b66554e6c286ba64046d9b18a819f81108ee965862f288637ccee816d2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L108-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fb3a84b66554e6c286ba64046d9b18a819f81108ee965862f288637ccee816d2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353084,10 +349684,8 @@ rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC : FILE
 		$style = "word/styles.xml" ascii
 
 	condition:
-		uint32(0)==0x04034b50 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd
+		uint32( 0 ) == 0x04034b50 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_293A_Query_Javascript_Decode_Function : FILE
 {
 	meta:
@@ -353097,9 +349695,9 @@ rule SIGNATURE_BASE_TA17_293A_Query_Javascript_Decode_Function : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L122-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8b42c67bdcdbb7c38128d8956904baa524d155b1e6957c5c1b5bc28fd8a57e8a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L122-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8b42c67bdcdbb7c38128d8956904baa524d155b1e6957c5c1b5bc28fd8a57e8a"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -353112,10 +349710,8 @@ rule SIGNATURE_BASE_TA17_293A_Query_Javascript_Decode_Function : FILE
 		$decode4 = {73 75 62 73 74 72 69 6E 67 28 34 2C ?? 2E 6C 65 6E 67 74 68 29}
 
 	condition:
-		filesize <20KB and all of ($decode*)
+		filesize < 20KB and all of ( $decode* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_293A_Hacktool_PS_1 : FILE
 {
 	meta:
@@ -353125,9 +349721,9 @@ rule SIGNATURE_BASE_TA17_293A_Hacktool_PS_1 : FILE
 		date = "2017-10-21"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L152-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a59834684cc1e7a34eeb8fb7f6cd1c414d6eab3ae58c6df763b2ec548705b371"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L152-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a59834684cc1e7a34eeb8fb7f6cd1c414d6eab3ae58c6df763b2ec548705b371"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353139,10 +349735,8 @@ rule SIGNATURE_BASE_TA17_293A_Hacktool_PS_1 : FILE
 		$x2 = "} | Where-Object {$_.SamAccountName -notmatch 'krbtgt'} | Get-SPNTicket @GetSPNTicketArguments" fullword ascii
 
 	condition:
-		( filesize <80KB and 1 of them )
+		( filesize < 80KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_293A_Hacktool_Touch_MAC_Modification : FILE
 {
 	meta:
@@ -353152,9 +349746,9 @@ rule SIGNATURE_BASE_TA17_293A_Hacktool_Touch_MAC_Modification : FILE
 		date = "2017-10-21"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L168-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5f4c6b653d1b6f4427c6582513d3c19cb8d580e669260a1afda01eecf8ce3bfc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L168-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5f4c6b653d1b6f4427c6582513d3c19cb8d580e669260a1afda01eecf8ce3bfc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353168,10 +349762,8 @@ rule SIGNATURE_BASE_TA17_293A_Hacktool_Touch_MAC_Modification : FILE
 		$s4 = "-m - change the modification time only" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_293A_Hacktool_Exploit_MS16_032 : FILE
 {
 	meta:
@@ -353181,9 +349773,9 @@ rule SIGNATURE_BASE_TA17_293A_Hacktool_Exploit_MS16_032 : FILE
 		date = "2017-10-21"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L186-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f0bd4f8ae1e9689f111233ca8fdb9a9b6c20e526f22350c8204f64a54639dcd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L186-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f0bd4f8ae1e9689f111233ca8fdb9a9b6c20e526f22350c8204f64a54639dcd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353197,7 +349789,7 @@ rule SIGNATURE_BASE_TA17_293A_Hacktool_Exploit_MS16_032 : FILE
 		$x4 = "If we can't open the process token it's a SYSTEM shell!" fullword ascii
 
 	condition:
-		( filesize <40KB and 1 of them )
+		( filesize < 40KB and 1 of them )
 }
 import "pe"
 
@@ -353210,9 +349802,9 @@ rule SIGNATURE_BASE_Imphash_UPX_Packed_Malware_1_TA17_293A : FILE
 		date = "2017-10-21"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L206-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "398ccbd5e492fb1efa80dc07900ef77611c4b5bab95f715fce7b5dbeb0aff49d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L206-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_398ccbd5e492fb1efa80dc07900ef77611c4b5bab95f715fce7b5dbeb0aff49d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353220,7 +349812,7 @@ rule SIGNATURE_BASE_Imphash_UPX_Packed_Malware_1_TA17_293A : FILE
 		hash1 = "a278256fbf2f061cfded7fdd58feded6765fade730374c508adad89282f67d77"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and pe.imphash()=="d7d745ea39c8c5b82d5e153d3313096c")
+		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and pe.imphash ( ) == "d7d745ea39c8c5b82d5e153d3313096c" )
 }
 import "pe"
 
@@ -353233,16 +349825,16 @@ rule SIGNATURE_BASE_Imphash_Malware_2_TA17_293A : HIGHVOL FILE
 		date = "2017-10-21"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_293A.yar#L219-L229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5f91c07a9cc65c31eb9fd09bdd2752bc285c5a4b118ffe647391f7d187765de4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_293A.yar#L219-L229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5f91c07a9cc65c31eb9fd09bdd2752bc285c5a4b118ffe647391f7d187765de4"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and pe.imphash()=="a8f69eb2cf9f30ea96961c86b4347282")
+		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and pe.imphash ( ) == "a8f69eb2cf9f30ea96961c86b4347282" )
 }
 rule SIGNATURE_BASE_Keylogger_CN_APT : FILE
 {
@@ -353253,10 +349845,10 @@ rule SIGNATURE_BASE_Keylogger_CN_APT : FILE
 		date = "2016-03-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_keylogger_cn.yar#L8-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_keylogger_cn.yar#L8-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7"
-		logic_hash = "a5330d15ad7199212cec44ade401c224c40a468650abbc7bf282b26a21cdc22b"
+		logic_hash = "v1_sha256_a5330d15ad7199212cec44ade401c224c40a468650abbc7bf282b26a21cdc22b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353279,7 +349871,7 @@ rule SIGNATURE_BASE_Keylogger_CN_APT : FILE
 		$s10 = "agc.tmp" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of ($x*)) or 3 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of ( $x* ) ) or 3 of them
 }
 rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Notable_Strings : FILE
 {
@@ -353290,9 +349882,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Notable_Strings : FILE
 		date = "2022-02-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_cyclops_blink.yar#L6-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fdd3a1de9d178370fcc66dbca4628d7bedfbc002bca9e463e11cb444302900ea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_cyclops_blink.yar#L6-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fdd3a1de9d178370fcc66dbca4628d7bedfbc002bca9e463e11cb444302900ea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353314,7 +349906,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Notable_Strings : FILE
 		$downpath = "/var/tmp/a.tmp"
 
 	condition:
-		( uint32(0)==0x464c457f) and (8 of them )
+		( uint32( 0 ) == 0x464c457f ) and ( 8 of them )
 }
 rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Module_Initialisation : FILE
 {
@@ -353325,9 +349917,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Module_Initialisation : FILE
 		date = "2022-02-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_cyclops_blink.yar#L39-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8bde37f642cf07e323beabaacd5c62f8422b451777fc1fc4a6bdf474db49de12"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_cyclops_blink.yar#L39-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8bde37f642cf07e323beabaacd5c62f8422b451777fc1fc4a6bdf474db49de12"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353339,7 +349931,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Module_Initialisation : FILE
       03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20}
 
 	condition:
-		( uint32(0)==0x464c457f) and ( any of them )
+		( uint32( 0 ) == 0x464c457f ) and ( any of them )
 }
 rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Modified_Install_Upgrade : FILE
 {
@@ -353350,9 +349942,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Modified_Install_Upgrade : FILE
 		date = "2022-02-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_cyclops_blink.yar#L57-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "69b89dbaf3e2661f376ff1be7c19e96c82bf84fd572fea422c109f8afdd1e5aa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_cyclops_blink.yar#L57-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_69b89dbaf3e2661f376ff1be7c19e96c82bf84fd572fea422c109f8afdd1e5aa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353373,7 +349965,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Modified_Install_Upgrade : FILE
 		$ = {3C 00 48 4D 60 00 41 43 90 09 00 00}
 
 	condition:
-		( uint32(0)==0x464c457f) and (6 of them )
+		( uint32( 0 ) == 0x464c457f ) and ( 6 of them )
 }
 rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Core_Command_Check : FILE
 {
@@ -353384,9 +349976,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Core_Command_Check : FILE
 		date = "2022-02-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_cyclops_blink.yar#L90-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "71c9da1f0e9e64be87293c985f2a4a59a6c87ffd127ce5104ebe95a0ccb316af"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_cyclops_blink.yar#L90-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_71c9da1f0e9e64be87293c985f2a4a59a6c87ffd127ce5104ebe95a0ccb316af"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -353397,7 +349989,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Core_Command_Check : FILE
 		$cmd_check = {81 3F 00 18 88 09 00 05 54 00 06 3E 2F 80 00 (07|0A|0B|0C|0D) }
 
 	condition:
-		( uint32(0)==0x464c457f) and (#cmd_check==5)
+		( uint32( 0 ) == 0x464c457f ) and ( #cmd_check == 5 )
 }
 rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Config_Identifiers : FILE
 {
@@ -353408,9 +350000,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Config_Identifiers : FILE
 		date = "2022-02-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_cyclops_blink.yar#L106-L126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6fa39442d717a69dd6f31a4bb2e5865c3f16156ce24a2b419d95ed751bb0d8ee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_cyclops_blink.yar#L106-L126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6fa39442d717a69dd6f31a4bb2e5865c3f16156ce24a2b419d95ed751bb0d8ee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353423,7 +350015,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Config_Identifiers : FILE
 		$ = {3C 00 3C 73 60 00 3A 20 90 09 00 00}
 
 	condition:
-		( uint32(0)==0x464c457f) and ( all of them )
+		( uint32( 0 ) == 0x464c457f ) and ( all of them )
 }
 rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0Xf_Command : FILE
 {
@@ -353434,9 +350026,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0Xf_Command : FILE
 		date = "2022-02-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_cyclops_blink.yar#L128-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6e3eebe404c8cd24e1e16eb3c881b1eda78ba6b365bf89c2557329e6f89396ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_cyclops_blink.yar#L128-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6e3eebe404c8cd24e1e16eb3c881b1eda78ba6b365bf89c2557329e6f89396ac"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353451,7 +350043,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0Xf_Command : FILE
 		$ = "file:%s\n" fullword
 
 	condition:
-		( uint32(0)==0x464c457f) and ( all of them )
+		( uint32( 0 ) == 0x464c457f ) and ( all of them )
 }
 rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Default_Config_Values : FILE
 {
@@ -353462,9 +350054,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Default_Config_Values : FILE
 		date = "2022-02-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_cyclops_blink.yar#L152-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "180993057c110c0c0327b673c6d6e251534012de51cf6475838691e0942a1aa8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_cyclops_blink.yar#L152-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_180993057c110c0c0327b673c6d6e251534012de51cf6475838691e0942a1aa8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353479,7 +350071,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Default_Config_Values : FILE
 		$ = {38 00 27 11 90 09 01 C0}
 
 	condition:
-		( uint32(0)==0x464c457f) and (3 of them )
+		( uint32( 0 ) == 0x464c457f ) and ( 3 of them )
 }
 rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0X51_Command : FILE
 {
@@ -353490,9 +350082,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0X51_Command : FILE
 		date = "2022-02-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_cyclops_blink.yar#L176-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8a68f4a5f5b7a45819e9a198881aa41b75a65181b63788c8b824b339bfd6fc67"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_cyclops_blink.yar#L176-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8a68f4a5f5b7a45819e9a198881aa41b75a65181b63788c8b824b339bfd6fc67"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353509,7 +350101,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0X51_Command : FILE
 		$mnt_arg4 = {38 C0 0C 21}
 
 	condition:
-		( uint32(0)==0x464c457f) and (#cmd_check==3) and ((@cmd_check[3]-@cmd_check[1])<0x200) and ( all of ($path*)) and ( all of ($mnt_arg*))
+		( uint32( 0 ) == 0x464c457f ) and ( #cmd_check == 3 ) and ( ( @cmd_check [ 3 ] - @cmd_check [ 1 ] ) < 0x200 ) and ( all of ( $path* ) ) and ( all of ( $mnt_arg* ) )
 }
 rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Beacon : COATHANGER FILE
 {
@@ -353520,9 +350112,9 @@ rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Beacon : COATHANGER FILE
 		date = "2024-02-06"
 		modified = "2024-04-24"
 		reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_fortinet_coathanger_feb24.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e44496e62de8c885d5bd941819a97f4c0dd90ce2d0cfe9d042ab9590cc354ddb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_fortinet_coathanger_feb24.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e44496e62de8c885d5bd941819a97f4c0dd90ce2d0cfe9d042ab9590cc354ddb"
 		score = 75
 		quality = 85
 		tags = "COATHANGER, FILE"
@@ -353532,7 +350124,7 @@ rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Beacon : COATHANGER FILE
 		$chunk_1 = { 48 B8 47 45 54 20 2F 20 48 54 48 89 45 B0 48 B8 54 50 2F 32 0A 48 6F 73 48 89 45 B8 48 B8 74 3A 20 77 77 77 2E 67 48 89 45 C0 48 B8 6F 6F 67 6C 65 2E 63 6F }
 
 	condition:
-		uint32(0)==0x464c457f and filesize <5MB and any of them
+		uint32( 0 ) == 0x464c457f and filesize < 5MB and any of them
 }
 rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Files : COATHANGER FILE
 {
@@ -353543,9 +350135,9 @@ rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Files : COATHANGER FILE
 		date = "2024-02-06"
 		modified = "2024-04-24"
 		reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_fortinet_coathanger_feb24.yar#L17-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5406d8a99e16f08f1ffca548ea1dd1e27e7707506e796e0fc263bcdbb681632d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_fortinet_coathanger_feb24.yar#L17-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5406d8a99e16f08f1ffca548ea1dd1e27e7707506e796e0fc263bcdbb681632d"
 		score = 75
 		quality = 85
 		tags = "COATHANGER, FILE"
@@ -353563,7 +350155,7 @@ rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Files : COATHANGER FILE
 		$9 = "/bin/busybox"
 
 	condition:
-		( uint32(0)==0x464c457f or uint32(4)==0x464c457f) and filesize <5MB and 4 of them
+		( uint32( 0 ) == 0x464c457f or uint32( 4 ) == 0x464c457f ) and filesize < 5MB and 4 of them
 }
 rule SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML : CVE_2021_40444 FILE
 {
@@ -353574,9 +350166,9 @@ rule SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML : CVE_2021_40444 FILE
 		date = "2021-09-10"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/AlteredBytes/status/1435811407249952772"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cve_2021_40444.yar#L6-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b05c3b33c3cab2c9109d808ed197758bc987f07beee77e1f61094715e0c1a1e7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cve_2021_40444.yar#L6-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b05c3b33c3cab2c9109d808ed197758bc987f07beee77e1f61094715e0c1a1e7"
 		score = 75
 		quality = 85
 		tags = "CVE-2021-40444, FILE"
@@ -353589,7 +350181,7 @@ rule SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML : CVE_2021_40444 FILE
 		$c3 = "TargetMode=\"External\"" nocase
 
 	condition:
-		uint32(0)==0x6D783F3C and filesize <10KB and 1 of ($b*) and all of ($c*)
+		uint32( 0 ) == 0x6D783F3C and filesize < 10KB and 1 of ( $b* ) and all of ( $c* )
 }
 rule SIGNATURE_BASE_EXPL_MAL_Maldoc_OBFUSCT_MHTML_Sep21_1 : CVE_2021_40444 FILE
 {
@@ -353600,10 +350192,10 @@ rule SIGNATURE_BASE_EXPL_MAL_Maldoc_OBFUSCT_MHTML_Sep21_1 : CVE_2021_40444 FILE
 		date = "2021-09-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/decalage2/status/1438946225190014984?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cve_2021_40444.yar#L27-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cve_2021_40444.yar#L27-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
-		logic_hash = "11a73572970d2d85d308330119a2c5243f2848ae78a861decdb0cdbde0d9d1c2"
+		logic_hash = "v1_sha256_11a73572970d2d85d308330119a2c5243f2848ae78a861decdb0cdbde0d9d1c2"
 		score = 90
 		quality = 85
 		tags = "CVE-2021-40444, FILE"
@@ -353613,7 +350205,7 @@ rule SIGNATURE_BASE_EXPL_MAL_Maldoc_OBFUSCT_MHTML_Sep21_1 : CVE_2021_40444 FILE
 		$s1 = "109;&#104;&#116;&#109;&#108;&#58;&#104;&#116;&#109;&#108" ascii wide
 
 	condition:
-		filesize <25KB and all of them
+		filesize < 25KB and all of them
 }
 rule SIGNATURE_BASE_EXPL_XML_Encoded_CVE_2021_40444 : CVE_2021_40444 FILE
 {
@@ -353624,11 +350216,11 @@ rule SIGNATURE_BASE_EXPL_XML_Encoded_CVE_2021_40444 : CVE_2021_40444 FILE
 		date = "2021-09-18"
 		modified = "2021-09-19"
 		reference = "https://twitter.com/sudosev/status/1439205606129377282"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cve_2021_40444.yar#L44-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cve_2021_40444.yar#L44-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
 		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
-		logic_hash = "feaeadd8e7e262f191ea0c2f85377531208262e5ac19d6706703e62cf8b4ec90"
+		logic_hash = "v1_sha256_feaeadd8e7e262f191ea0c2f85377531208262e5ac19d6706703e62cf8b4ec90"
 		score = 70
 		quality = 85
 		tags = "CVE-2021-40444, FILE"
@@ -353639,7 +350231,7 @@ rule SIGNATURE_BASE_EXPL_XML_Encoded_CVE_2021_40444 : CVE_2021_40444 FILE
 		$t_mode_r = /TargetMode[\s]{0,20}=[\s]{0,20}\["']([Ee]|&#(x45|x65|69|101);)([Xx]|&#(x58|x78|88|120);)([Tt]|&#(x74|x54|84|116);)/
 
 	condition:
-		filesize <500KB and $h1 and all of ($t_*)
+		filesize < 500KB and $h1 and all of ( $t_* )
 }
 rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_1 : WINDOWS CVE FILE
 {
@@ -353650,11 +350242,11 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_1 : WINDOWS CVE FI
 		date = "2021-09-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/sudosev/status/1439205606129377282"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cve_2021_40444.yar#L64-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cve_2021_40444.yar#L64-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
 		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
-		logic_hash = "fc8f0dd02460ab8f8cc6717c66eba51e6ed74881a48e92fd0bf978467dfb40e3"
+		logic_hash = "v1_sha256_fc8f0dd02460ab8f8cc6717c66eba51e6ed74881a48e92fd0bf978467dfb40e3"
 		score = 65
 		quality = 85
 		tags = "WINDOWS, CVE, FILE"
@@ -353665,7 +350257,7 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_1 : WINDOWS CVE FI
 		$xml_mode_1 = "TargetMode=\"&#" ascii wide
 
 	condition:
-		filesize <500KB and $h1 and 1 of ($xml*)
+		filesize < 500KB and $h1 and 1 of ( $xml* )
 }
 rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_2 : WINDOWS CVE FILE
 {
@@ -353676,9 +350268,9 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_2 : WINDOWS CVE FI
 		date = "2021-09-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/sudosev/status/1439205606129377282"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cve_2021_40444.yar#L83-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "82c70e0f0b72a57302e5853cc53ae18dbb0bc8dabdfd27b473a7664b2fc5e874"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cve_2021_40444.yar#L83-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_82c70e0f0b72a57302e5853cc53ae18dbb0bc8dabdfd27b473a7664b2fc5e874"
 		score = 65
 		quality = 85
 		tags = "WINDOWS, CVE, FILE"
@@ -353690,7 +350282,7 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_2 : WINDOWS CVE FI
 		$xml_e = "&#x0000" ascii wide
 
 	condition:
-		filesize <500KB and all of them
+		filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_1 : FILE
 {
@@ -353701,9 +350293,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_1 : FILE
 		date = "2023-02-13"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/idonaor1/status/1624703255770005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ransom_darkbit_feb23.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ba1baea7cb7362160c4b00b0355000a789b238c1ec82b840479c04028e6ca3ab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ransom_darkbit_feb23.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ba1baea7cb7362160c4b00b0355000a789b238c1ec82b840479c04028e6ca3ab"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353716,7 +350308,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_1 : FILE
 		$xn1 = "You will receive decrypting key after the payment."
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10MB and (1 of ($x*) or 2 of them ) or 4 of them or ( filesize <10MB and $xn1)
+		uint16( 0 ) == 0x5a4d and filesize < 10MB and ( 1 of ( $x* ) or 2 of them ) or 4 of them or ( filesize < 10MB and $xn1 )
 }
 rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_2 : FILE
 {
@@ -353727,9 +350319,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_2 : FILE
 		date = "2023-02-13"
 		modified = "2023-12-05"
 		reference = "https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff?environmentId=160"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ransom_darkbit_feb23.yar#L25-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "577435536300902811612a3415e82420574c98345b91b21fb2bfd2bfde396bec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ransom_darkbit_feb23.yar#L25-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_577435536300902811612a3415e82420574c98345b91b21fb2bfd2bfde396bec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353744,7 +350336,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_2 : FILE
 		$op2 = { 49 8d 49 01 0f 1f 00 48 39 d9 7c e2 b9 0b 00 00 00 49 89 d8 e9 28 fc ff ff e8 89 6c d7 ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 20000KB and all of them
 }
 import "pe"
 
@@ -353757,9 +350349,9 @@ rule SIGNATURE_BASE_Sofacy_Oct17_1 : FILE
 		date = "2017-10-23"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_oct17_camp.yar#L13-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c3620d0b347e6cc54af9e046f6b3b6515bfa23dd11225ce2720e09838708a42e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_oct17_camp.yar#L13-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c3620d0b347e6cc54af9e046f6b3b6515bfa23dd11225ce2720e09838708a42e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353782,7 +350374,7 @@ rule SIGNATURE_BASE_Sofacy_Oct17_1 : FILE
 		$s7 = "if NOT exist %path % (exit)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports("KlpSvc") or (1 of ($x*) or 4 of them ) or ($s1 and all of ($g*)))
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports ( "KlpSvc" ) or ( 1 of ( $x* ) or 4 of them ) or ( $s1 and all of ( $g* ) ) )
 }
 import "pe"
 
@@ -353795,9 +350387,9 @@ rule SIGNATURE_BASE_Sofacy_Oct17_2 : FILE
 		date = "2017-10-23"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_oct17_camp.yar#L49-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c2736cf9efbb022590f4c23986531e645ac412a5b98a950b143f2d75a33e8063"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_oct17_camp.yar#L49-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c2736cf9efbb022590f4c23986531e645ac412a5b98a950b143f2d75a33e8063"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353812,7 +350404,7 @@ rule SIGNATURE_BASE_Sofacy_Oct17_2 : FILE
 		$s4 = "%j%Xjsf" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and (pe.imphash()=="13344e2a717849489bcd93692f9646f7" or (4 of them ))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 90KB and ( pe.imphash ( ) == "13344e2a717849489bcd93692f9646f7" or ( 4 of them ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 : CVE_2024_47177 FILE
 {
@@ -353821,11 +350413,11 @@ rule SIGNATURE_BASE_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 : CVE_2024_47177 FILE
 		author = "Florian Roth"
 		id = "a7b986ad-e943-5350-a6e0-34c40f07874c"
 		date = "2024-09-27"
-		modified = "2024-09-27"
+		modified = "2024-12-12"
 		reference = "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cups_sep24.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "633314dea5e3cbdf3cef6e4f18c2efca261dfc600bb9c11d0834fdae102ac9e6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cups_sep24.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_633314dea5e3cbdf3cef6e4f18c2efca261dfc600bb9c11d0834fdae102ac9e6"
 		score = 75
 		quality = 85
 		tags = "CVE-2024-47177, FILE"
@@ -353835,7 +350427,7 @@ rule SIGNATURE_BASE_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 : CVE_2024_47177 FILE
 		$s2 = "cupsFilter2 : " ascii
 
 	condition:
-		filesize <400KB and all of them
+		filesize < 400KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 : CVE_2024_47177
 {
@@ -353844,11 +350436,11 @@ rule SIGNATURE_BASE_SUSP_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 : CVE_2024_47177
 		author = "Florian Roth"
 		id = "cb76f1c7-6dc0-5fed-a970-2a4890db46d3"
 		date = "2024-09-27"
-		modified = "2024-09-27"
+		modified = "2024-12-12"
 		reference = "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cups_sep24.yar#L16-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2158ca8a08cb7552e2a437de025e3aad63ddc5417245e6ede7283d3bd0fc159b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cups_sep24.yar#L17-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2158ca8a08cb7552e2a437de025e3aad63ddc5417245e6ede7283d3bd0fc159b"
 		score = 65
 		quality = 85
 		tags = "CVE-2024-47177"
@@ -353877,9 +350469,9 @@ rule SIGNATURE_BASE_Enigmapacker_Rare : FILE
 		date = "2017-04-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_enigma_protector.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a001b563db1b75581432d42a435683f24e244b6b354f83409b5b9d6d0314d63a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_enigma_protector.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a001b563db1b75581432d42a435683f24e244b6b354f83409b5b9d6d0314d63a"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -353891,7 +350483,7 @@ rule SIGNATURE_BASE_Enigmapacker_Rare : FILE
 		$s2 = "ENIGMA" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them )
 }
 rule SIGNATURE_BASE_Enigma_Protected_Malware_May17_Rhxfiles : FILE
 {
@@ -353902,9 +350494,9 @@ rule SIGNATURE_BASE_Enigma_Protected_Malware_May17_Rhxfiles : FILE
 		date = "2017-05-02"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_enigma_protector.yar#L25-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "838ab7dddda798d2f5c79fc5417693f8489195b3024c43d9ad1aab05fcfd71eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_enigma_protector.yar#L25-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_838ab7dddda798d2f5c79fc5417693f8489195b3024c43d9ad1aab05fcfd71eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353916,7 +350508,7 @@ rule SIGNATURE_BASE_Enigma_Protected_Malware_May17_Rhxfiles : FILE
 		$op3 = { 7c 7c c5 7d 7c 7c 7c 7e ae 73 f9 79 7c 7c 7c f6 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them )
 }
 rule SIGNATURE_BASE_Enigma_Protected_Malware : FILE
 {
@@ -353927,9 +350519,9 @@ rule SIGNATURE_BASE_Enigma_Protected_Malware : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/OEVQ9w"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_enigma_protector.yar#L41-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1a254d4d593b73d16d1cfbd73d7d4b2732a080cb98d70972de0826433b004152"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_enigma_protector.yar#L41-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1a254d4d593b73d16d1cfbd73d7d4b2732a080cb98d70972de0826433b004152"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353941,7 +350533,7 @@ rule SIGNATURE_BASE_Enigma_Protected_Malware : FILE
 		$s3 = { 9f 59 14 52 d8 a9 a2 a2 a2 00 9f 51 5d d6 d1 79 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Poisonivy_Generic_3 : FILE
 {
@@ -353952,10 +350544,10 @@ rule SIGNATURE_BASE_Poisonivy_Generic_3 : FILE
 		date = "2015-05-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poisonivy_gen3.yar#L2-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poisonivy_gen3.yar#L2-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
-		logic_hash = "8116b07c00218a0e9784447f322455ff24ae754770b85db760b1c397e10e5695"
+		logic_hash = "v1_sha256_8116b07c00218a0e9784447f322455ff24ae754770b85db760b1c397e10e5695"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -353978,7 +350570,7 @@ rule SIGNATURE_BASE_Poisonivy_Generic_3 : FILE
 		$h6 = "upload.asp"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ($k1 or all of ($s*) or all of ($h*))
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( $k1 or all of ( $s* ) or all of ( $h* ) )
 }
 rule SIGNATURE_BASE_WEBSHELL_JSP_Nov21_1 : FILE
 {
@@ -353989,9 +350581,9 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Nov21_1 : FILE
 		date = "2021-11-23"
 		modified = "2023-12-05"
 		reference = "https://www.ic3.gov/Media/News/2021/211117-2.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_spring4shell.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1dac7706421961c71ba6f8d7a223b80e4b77bf206bfb64ee18c7cc894b062a3c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_spring4shell.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1dac7706421961c71ba6f8d7a223b80e4b77bf206bfb64ee18c7cc894b062a3c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -354003,7 +350595,7 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Nov21_1 : FILE
 		$x4 = "private static final String PW = \"whoami\"" ascii
 
 	condition:
-		filesize <400KB and 1 of them
+		filesize < 400KB and 1 of them
 }
 rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Indicators_Mar22_1
 {
@@ -354014,9 +350606,9 @@ rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Indicators_Mar22_1
 		date = "2022-03-30"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/vxunderground/status/1509170582469943303"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_spring4shell.yar#L19-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "39fb62ec7953dae0a88e39e73e3ff286fc19cb8f21f8feb869a1875f6ba70cfb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_spring4shell.yar#L19-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_39fb62ec7953dae0a88e39e73e3ff286fc19cb8f21f8feb869a1875f6ba70cfb"
 		score = 70
 		quality = 85
 		tags = ""
@@ -354039,9 +350631,9 @@ rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Webshell_Mar22_1 : FILE
 		date = "2022-03-30"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/vxunderground/status/1509170582469943303"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_spring4shell.yar#L36-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "17282b66899356a6051f0b47a7a3f02265737283d760f2256e03a2b934bb63b8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_spring4shell.yar#L36-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_17282b66899356a6051f0b47a7a3f02265737283d760f2256e03a2b934bb63b8"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -354052,7 +350644,7 @@ rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Webshell_Mar22_1 : FILE
 		$x3 = ".getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();"
 
 	condition:
-		filesize <200KB and 1 of them
+		filesize < 200KB and 1 of them
 }
 rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_1 : FILE
 {
@@ -354063,9 +350655,9 @@ rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_1 : FILE
 		date = "2017-12-12"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hiddencobra_wiper.yar#L8-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0e88b7f8491e87cce0deb5f246ca521bdb556b9c79c697559bdf8b0b332e714e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hiddencobra_wiper.yar#L8-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0e88b7f8491e87cce0deb5f246ca521bdb556b9c79c697559bdf8b0b332e714e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -354075,7 +350667,7 @@ rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_1 : FILE
 		$controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and any of them
+		uint16( 0 ) == 0x5a4d and uint16( uint32( 0x3c ) ) == 0x4550 and any of them
 }
 rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_2 : FILE
 {
@@ -354086,9 +350678,9 @@ rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_2 : FILE
 		date = "2017-12-12"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hiddencobra_wiper.yar#L22-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f537f67be28f854db0d56199d2a43f90cf6c80469a6f9853db0cd550440c7e1f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hiddencobra_wiper.yar#L22-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f537f67be28f854db0d56199d2a43f90cf6c80469a6f9853db0cd550440c7e1f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -354098,7 +350690,7 @@ rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_2 : FILE
 		$ExtendedWrite = { B4 43 B0 00 CD 13 }
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and all of them
+		uint16( 0 ) == 0x5a4d and uint16( uint32( 0x3c ) ) == 0x4550 and all of them
 }
 rule SIGNATURE_BASE_Casper_Backdoor_X86 : FILE
 {
@@ -354109,10 +350701,10 @@ rule SIGNATURE_BASE_Casper_Backdoor_X86 : FILE
 		date = "2015-03-05"
 		modified = "2023-01-27"
 		reference = "http://goo.gl/VRJNLo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_casper.yar#L4-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_casper.yar#L4-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
-		logic_hash = "027457a3d86c0a7924fd6eb09c4a753cc846ba45f0b04257d9eec396bbc27f75"
+		logic_hash = "v1_sha256_027457a3d86c0a7924fd6eb09c4a753cc846ba45f0b04257d9eec396bbc27f75"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -354134,7 +350726,7 @@ rule SIGNATURE_BASE_Casper_Backdoor_X86 : FILE
 		$z3 = "Operating System\"" fullword wide
 
 	condition:
-		( filesize <250KB and all of ($s*)) or (3 of ($x*) and 2 of ($y*) and 2 of ($z*))
+		( filesize < 250KB and all of ( $s* ) ) or ( 3 of ( $x* ) and 2 of ( $y* ) and 2 of ( $z* ) )
 }
 rule SIGNATURE_BASE_Casper_EXE_Dropper
 {
@@ -354145,10 +350737,10 @@ rule SIGNATURE_BASE_Casper_EXE_Dropper
 		date = "2015-03-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/VRJNLo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_casper.yar#L37-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_casper.yar#L37-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
-		logic_hash = "8ffba5598078fdadf2d9e8ee7fe0fef8b3b89517490a379d46cab33cd0036d6e"
+		logic_hash = "v1_sha256_8ffba5598078fdadf2d9e8ee7fe0fef8b3b89517490a379d46cab33cd0036d6e"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354176,9 +350768,9 @@ rule SIGNATURE_BASE_Casper_Included_Strings : FILE
 		date = "2015-03-06"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/VRJNLo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_casper.yar#L60-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8796f45e459747db6bc08f362db7b152242f9f5bda3b72ddfc739cc9dcdfc55f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_casper.yar#L60-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8796f45e459747db6bc08f362db7b152242f9f5bda3b72ddfc739cc9dcdfc55f"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -354196,7 +350788,7 @@ rule SIGNATURE_BASE_Casper_Included_Strings : FILE
 		$c7 = "{4216567A-4512-9825-7745F856}" fullword
 
 	condition:
-		all of ($a*) or uint16(0)==0x5a4d and (1 of ($c*))
+		all of ( $a* ) or uint16( 0 ) == 0x5a4d and ( 1 of ( $c* ) )
 }
 rule SIGNATURE_BASE_Casper_Systeminformation_Output
 {
@@ -354207,9 +350799,9 @@ rule SIGNATURE_BASE_Casper_Systeminformation_Output
 		date = "2015-03-06"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/VRJNLo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_casper.yar#L85-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "83c6216bc3e7fadfe81b9bbaca7b14e3398e972f8298c99a8eb576a40e4b4e1b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_casper.yar#L85-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_83c6216bc3e7fadfe81b9bbaca7b14e3398e972f8298c99a8eb576a40e4b4e1b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -354236,9 +350828,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Darkside_May21_1 : FILE
 		date = "2021-05-10"
 		modified = "2023-12-05"
 		reference = "https://app.any.run/tasks/020c1740-717a-4191-8917-5819aa25f385/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_darkside.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "84de92b0b36e373aa61e314a04597bd0578a04af34c501ae9071e5f4fa27c07a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_darkside.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_84de92b0b36e373aa61e314a04597bd0578a04af34c501ae9071e5f4fa27c07a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -354254,7 +350846,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Darkside_May21_1 : FILE
 		$s3 = ".onion/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them or all of ($op*) or all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them or all of ( $op* ) or all of ( $s* )
 }
 rule SIGNATURE_BASE_MAL_Ransomware_Win_DARKSIDE_V1_1 : FILE
 {
@@ -354265,10 +350857,10 @@ rule SIGNATURE_BASE_MAL_Ransomware_Win_DARKSIDE_V1_1 : FILE
 		date = "2021-03-22"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_darkside.yar#L25-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_darkside.yar#L25-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1a700f845849e573ab3148daef1a3b0b"
-		logic_hash = "b3612510bd1f2ca7543e217e97037b02d312bcda2b2df16d9be3216749ea4beb"
+		logic_hash = "v1_sha256_b3612510bd1f2ca7543e217e97037b02d312bcda2b2df16d9be3216749ea4beb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -354277,7 +350869,7 @@ rule SIGNATURE_BASE_MAL_Ransomware_Win_DARKSIDE_V1_1 : FILE
 		$consts = { 80 3D [4] 01 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] 00 00 04 00 [1-10] 00 00 00 00 [1-30] 80 3D [4] 02 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] FF FF FF FF [1-10] FF FF FF FF [1-30] 03 00 00 00 [1-10] 03 00 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $consts
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $consts
 }
 rule SIGNATURE_BASE_MAL_Dropper_Win_Darkside_1 : FILE
 {
@@ -354288,9 +350880,9 @@ rule SIGNATURE_BASE_MAL_Dropper_Win_Darkside_1 : FILE
 		date = "2021-05-11"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_darkside.yar#L39-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "131b3666ae444e0de043eafdf7cfd3324b927d18d8ad56d5004ea09b2da5610e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_darkside.yar#L39-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_131b3666ae444e0de043eafdf7cfd3324b927d18d8ad56d5004ea09b2da5610e"
 		score = 75
 		quality = 79
 		tags = "FILE"
@@ -354305,7 +350897,7 @@ rule SIGNATURE_BASE_MAL_Dropper_Win_Darkside_1 : FILE
 		$Slashes = { 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C }
 
 	condition:
-		filesize <2MB and filesize >500KB and uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and ( all of ($CommonDLLs*)) and ( all of ($KeyString*)) and $Slashes
+		filesize < 2MB and filesize > 500KB and uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and ( all of ( $CommonDLLs* ) ) and ( all of ( $KeyString* ) ) and $Slashes
 }
 rule SIGNATURE_BASE_MAL_Backdoor_Win_C3_1 : FILE
 {
@@ -354316,10 +350908,10 @@ rule SIGNATURE_BASE_MAL_Backdoor_Win_C3_1 : FILE
 		date = "2021-05-11"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_darkside.yar#L58-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_darkside.yar#L58-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7cdac4b82a7573ae825e5edb48f80be5"
-		logic_hash = "369c54b9426edb449004466d30e1010ecefe8cfbea106306eb8eb90b27610dbf"
+		logic_hash = "v1_sha256_369c54b9426edb449004466d30e1010ecefe8cfbea106306eb8eb90b27610dbf"
 		score = 75
 		quality = 79
 		tags = "FILE"
@@ -354335,7 +350927,7 @@ rule SIGNATURE_BASE_MAL_Backdoor_Win_C3_1 : FILE
 		$tokenString3 = { 5B 78 5D 20 65 72 72 6F 72 20 64 75 70 6C 69 63 61 74 69 6E 67 20 74 6F 6B 65 6E }
 
 	condition:
-		filesize <5MB and uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and ((( all of ($knownDLLs*)) and ($dropboxAPI or (1 of ($tokenString*)))) or ( all of ($tokenString*)))
+		filesize < 5MB and uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and ( ( ( all of ( $knownDLLs* ) ) and ( $dropboxAPI or ( 1 of ( $tokenString* ) ) ) ) or ( all of ( $tokenString* ) ) )
 }
 rule SIGNATURE_BASE_Powershell_Susp_Parameter_Combo : HIGHVOL FILE
 {
@@ -354346,9 +350938,9 @@ rule SIGNATURE_BASE_Powershell_Susp_Parameter_Combo : HIGHVOL FILE
 		date = "2017-03-12"
 		modified = "2022-09-15"
 		reference = "https://goo.gl/uAic1X"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_invocation.yar#L2-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d56d97b4f0506430f21ccb029524111c404c03f8cef25710b96c6c0915fdcf22"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_invocation.yar#L2-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d56d97b4f0506430f21ccb029524111c404c03f8cef25710b96c6c0915fdcf22"
 		score = 60
 		quality = 31
 		tags = "HIGHVOL, FILE"
@@ -354405,7 +350997,7 @@ rule SIGNATURE_BASE_Powershell_Susp_Parameter_Combo : HIGHVOL FILE
 		$fpa7 = "COPYRIGHT"
 
 	condition:
-		filesize <3000KB and 4 of ($s*) and not 1 of ($fp*) and uint32be(0)!=0x456C6646
+		filesize < 3000KB and 4 of ( $s* ) and not 1 of ( $fp* ) and uint32be( 0 ) != 0x456C6646
 }
 rule SIGNATURE_BASE_Powershell_Isesteroids_Obfuscation
 {
@@ -354416,9 +351008,9 @@ rule SIGNATURE_BASE_Powershell_Isesteroids_Obfuscation
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/danielhbohannon/status/877953970437844993"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_obfuscation.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6d9476f679614e34a0d13664baffd15b0bdb896f7eeca2c9de66bdc0d65a2eec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_obfuscation.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6d9476f679614e34a0d13664baffd15b0bdb896f7eeca2c9de66bdc0d65a2eec"
 		score = 75
 		quality = 85
 		tags = ""
@@ -354442,9 +351034,9 @@ rule SIGNATURE_BASE_SUSP_Obfuscted_Powershell_Code
 		date = "2018-12-13"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/silv0123/status/1073072691584880640"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_obfuscation.yar#L28-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "afd7e4b88c812b23441549565a18fde18c24fe91ec467455002ef338e092ebf9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_obfuscation.yar#L28-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_afd7e4b88c812b23441549565a18fde18c24fe91ec467455002ef338e092ebf9"
 		score = 65
 		quality = 85
 		tags = ""
@@ -354455,7 +351047,7 @@ rule SIGNATURE_BASE_SUSP_Obfuscted_Powershell_Code
 		$s3 = "{0}\" -f" ascii
 
 	condition:
-		#s1>11 and #s2>10 and #s3>10
+		#s1> 11 and #s2 > 10 and #s3 > 10
 }
 rule SIGNATURE_BASE_SUSP_Powershell_Caret_Obfuscation_2
 {
@@ -354466,9 +351058,9 @@ rule SIGNATURE_BASE_SUSP_Powershell_Caret_Obfuscation_2
 		date = "2019-07-20"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_obfuscation.yar#L43-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0aa21df64d61cb299b0f77da8b97e8cfc379622a8092e71657c478519d83fd31"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_obfuscation.yar#L43-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0aa21df64d61cb299b0f77da8b97e8cfc379622a8092e71657c478519d83fd31"
 		score = 65
 		quality = 31
 		tags = ""
@@ -354489,9 +351081,9 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1 : FILE
 		date = "2020-06-27"
 		modified = "2023-12-05"
 		reference = "https://github.com/corneacristian/mimikatz-bypass/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_obfuscation.yar#L57-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8f33762e6e93fcf6b423b34eb1abefae2ae91b51048303947f7c1601823630d7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_obfuscation.yar#L57-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8f33762e6e93fcf6b423b34eb1abefae2ae91b51048303947f7c1601823630d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -354506,7 +351098,7 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1 : FILE
 		$ = "${t`r`u`e}" ascii nocase
 
 	condition:
-		filesize <6000KB and 1 of them
+		filesize < 6000KB and 1 of them
 }
 rule SIGNATURE_BASE_HKTL_Nim_Nimpackt : EXE FILE HKTL
 {
@@ -354517,9 +351109,9 @@ rule SIGNATURE_BASE_HKTL_Nim_Nimpackt : EXE FILE HKTL
 		date = "2022-01-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/chvancooten/NimPackt-v1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_nimpackt.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2bda7acb440d1c72efeaddcb18b736343d658d59feccf6c9339b313cd35f32eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_nimpackt.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2bda7acb440d1c72efeaddcb18b736343d658d59feccf6c9339b313cd35f32eb"
 		score = 80
 		quality = 79
 		tags = "EXE, FILE, HKTL"
@@ -354533,7 +351125,7 @@ rule SIGNATURE_BASE_HKTL_Nim_Nimpackt : EXE FILE HKTL
 		$sus3 = { 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }
 
 	condition:
-		uint16(0)==0x5A4D and filesize <750KB and 1 of ($nim*) and ($np1 or 2 of ($sus*))
+		uint16( 0 ) == 0x5A4D and filesize < 750KB and 1 of ( $nim* ) and ( $np1 or 2 of ( $sus* ) )
 }
 rule SIGNATURE_BASE_Trojan_ISMRAT_Gen : FILE
 {
@@ -354544,9 +351136,9 @@ rule SIGNATURE_BASE_Trojan_ISMRAT_Gen : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ism_rat.yar#L9-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c4d26f79b8110e92a5e427de303eca6eaf79765a4c9cc437864dc5160ef2e343"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ism_rat.yar#L9-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c4d26f79b8110e92a5e427de303eca6eaf79765a4c9cc437864dc5160ef2e343"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -354561,7 +351153,7 @@ rule SIGNATURE_BASE_Trojan_ISMRAT_Gen : FILE
 		$dir = /Microsoft\\Windows\\Tmpe[a-z0-9]{2,8}/
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell : FILE
 {
@@ -354572,9 +351164,9 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell : FILE
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "977ee0fdf0e92ccea6b71fea7b2c7aed2965c6966d8af86230ccb0f95b286694"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_977ee0fdf0e92ccea6b71fea7b2c7aed2965c6966d8af86230ccb0f95b286694"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -354588,7 +351180,7 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell : FILE
 		$isset = "isset"
 
 	condition:
-		( filesize >20KB and filesize <200KB) and all of them
+		( filesize > 20KB and filesize < 200KB ) and all of them
 }
 rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Ziparchivefile
 {
@@ -354599,9 +351191,9 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Ziparchivefile
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L30-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c15e7022f45ec211ba635d6cd31bab16f4fb0d3038fb19d5765e0f751c14a826"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L30-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c15e7022f45ec211ba635d6cd31bab16f4fb0d3038fb19d5765e0f751c14a826"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354621,9 +351213,9 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Perlnetworkscript : FILE
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L44-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b170c07a005e737c8069f2cc63f869d4d3ff6593b3bfca5bcaf02d7808da6852"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L44-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b170c07a005e737c8069f2cc63f869d4d3ff6593b3bfca5bcaf02d7808da6852"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -354636,7 +351228,7 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Perlnetworkscript : FILE
 		$msg2 = "print \"$l OK! I\\'m accept connection.$l\""
 
 	condition:
-		filesize <6000 and ($pl_start at 0 and all of ($pl*)) or any of ($msg*)
+		filesize < 6000 and ( $pl_start at 0 and all of ( $pl* ) ) or any of ( $msg* )
 }
 rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Sqldumpfile
 {
@@ -354647,9 +351239,9 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Sqldumpfile
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L64-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c34abcada22fdf462fd66cc2da18ab9e54215defc6f7a7a95b5a80d1155a2ffe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L64-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c34abcada22fdf462fd66cc2da18ab9e54215defc6f7a7a95b5a80d1155a2ffe"
 		score = 90
 		quality = 85
 		tags = ""
@@ -354669,9 +351261,9 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Key
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L78-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "056503a2c240a641cd2292a30ab1090e3a358cb4d57dca83b836ecb1bc62ed6b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L78-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_056503a2c240a641cd2292a30ab1090e3a358cb4d57dca83b836ecb1bc62ed6b"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354691,9 +351283,9 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L92-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f65d59381403534a2c2f39d66c7c62bf1540eafc9aad1ad73de1809e91c42446"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L92-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f65d59381403534a2c2f39d66c7c62bf1540eafc9aad1ad73de1809e91c42446"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354713,9 +351305,9 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L106-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "536327d5216372a3fd2f4dad0a21be2778ce2930212daf0a8628ecbdab49b46e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L106-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_536327d5216372a3fd2f4dad0a21be2778ce2930212daf0a8628ecbdab49b46e"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354735,9 +351327,9 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L120-L132"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9dc7ee5b0a218a2b5be652e137fa090c944c3ddb0f699f521a72896668210813"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L120-L132"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9dc7ee5b0a218a2b5be652e137fa090c944c3ddb0f699f521a72896668210813"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354757,9 +351349,9 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Socket_Path
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L134-L146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8c049b5a7b508ca0f160d166f3c726e4a23a2c5b3105d075d7bf7a301a1c58f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L134-L146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8c049b5a7b508ca0f160d166f3c726e4a23a2c5b3105d075d7bf7a301a1c58f6"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354779,9 +351371,9 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Task_Names
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L148-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "193482da1e2b9509fa9c65d46edc56057f7b5d44b7408d918d4a9cbb60736dab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L148-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_193482da1e2b9509fa9c65d46edc56057f7b5d44b7408d918d4a9cbb60736dab"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354808,9 +351400,9 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Struct
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L169-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "312d0598fa85837f94023036468fcae50e8b2de532430a944befa8090afe79f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L169-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_312d0598fa85837f94023036468fcae50e8b2de532430a944befa8090afe79f6"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354834,9 +351426,9 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings_Typo
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L187-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "65e6de743eb9fc742674c7e54eef8a376963a6fd4380bacd03fe6f92d4235920"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L187-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_65e6de743eb9fc742674c7e54eef8a376963a6fd4380bacd03fe6f92d4235920"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354848,7 +351440,7 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings_Typo
 		$typo4 = ":\"metod\""
 
 	condition:
-		3 of ($typo*)
+		3 of ( $typo* )
 }
 rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings
 {
@@ -354859,9 +351451,9 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings
 		date = "2021-02-15"
 		modified = "2024-05-25"
 		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_centreon.yar#L204-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9d2790e60184ed973b2735263d0a997f32af0beacc9ea8ef65926fe6507011d5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_centreon.yar#L204-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9d2790e60184ed973b2735263d0a997f32af0beacc9ea8ef65926fe6507011d5"
 		score = 80
 		quality = 85
 		tags = ""
@@ -354882,7 +351474,7 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings
 		$url6 = "/auth/app"
 
 	condition:
-		(5 of ($url*) and all of ($persistence*)) or ( all of ($persistence*) and all of ($report*)) or (5 of ($url*) and all of ($report*))
+		(5 of ( $url* ) and all of ( $persistence* ) ) or ( all of ( $persistence* ) and all of ( $report* ) ) or ( 5 of ( $url* ) and all of ( $report* ) )
 }
 rule SIGNATURE_BASE_Windowsshell_S3 : FILE
 {
@@ -354893,10 +351485,10 @@ rule SIGNATURE_BASE_Windowsshell_S3 : FILE
 		date = "2016-03-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_winshells.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_winshells.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
-		logic_hash = "b9274f909b50247a4f5111a14806faadba7814e26805bef7d61eaaf8be4b46ed"
+		logic_hash = "v1_sha256_b9274f909b50247a4f5111a14806faadba7814e26805bef7d61eaaf8be4b46ed"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -354914,7 +351506,7 @@ rule SIGNATURE_BASE_Windowsshell_S3 : FILE
 		$s9 = "-l           Listen for incoming connections" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 2 of them ) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_Windosshell_S1 : FILE
 {
@@ -354925,10 +351517,10 @@ rule SIGNATURE_BASE_Windosshell_S1 : FILE
 		date = "2016-03-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_winshells.yar#L33-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_winshells.yar#L33-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
-		logic_hash = "29fcddc549c615ca5cdda60272926671bc1446c3c7b51c9a2fd867b6b68858b2"
+		logic_hash = "v1_sha256_29fcddc549c615ca5cdda60272926671bc1446c3c7b51c9a2fd867b6b68858b2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -354945,7 +351537,7 @@ rule SIGNATURE_BASE_Windosshell_S1 : FILE
 		$s8 = "[ %c%c requires parameter" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 2 of them ) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_Windowsshell_S4 : FILE
 {
@@ -354956,10 +351548,10 @@ rule SIGNATURE_BASE_Windowsshell_S4 : FILE
 		date = "2016-03-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_winshells.yar#L55-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_winshells.yar#L55-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
-		logic_hash = "fff280debdd32a736e37a73800f226bf6def5dd107abd1d9237d92904622c9ec"
+		logic_hash = "v1_sha256_fff280debdd32a736e37a73800f226bf6def5dd107abd1d9237d92904622c9ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -354976,7 +351568,7 @@ rule SIGNATURE_BASE_Windowsshell_S4 : FILE
 		$s8 = "-l           Listen for incoming connections" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <175KB and 2 of them ) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_Windowsshell_Gen : FILE
 {
@@ -354987,9 +351579,9 @@ rule SIGNATURE_BASE_Windowsshell_Gen : FILE
 		date = "2016-03-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_winshells.yar#L79-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "753dd12f649bcbfcc2c60a2f3be27df5297a671a0ee1856093eed04113616581"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_winshells.yar#L79-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_753dd12f649bcbfcc2c60a2f3be27df5297a671a0ee1856093eed04113616581"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355007,7 +351599,7 @@ rule SIGNATURE_BASE_Windowsshell_Gen : FILE
 		$s2 = "[ %s : %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <175KB and 2 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 175KB and 2 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Windowsshell_Gen2 : FILE
 {
@@ -355018,9 +351610,9 @@ rule SIGNATURE_BASE_Windowsshell_Gen2 : FILE
 		date = "2016-03-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_winshells.yar#L101-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c5ce27554b2ee25b974b567ef5a9ae877906250073da477f0ab5d71d162ac81a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_winshells.yar#L101-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c5ce27554b2ee25b974b567ef5a9ae877906250073da477f0ab5d71d162ac81a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355039,7 +351631,7 @@ rule SIGNATURE_BASE_Windowsshell_Gen2 : FILE
 		$s7 = "[ error : received %i bytes" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <175KB and 2 of them ) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_2 : FILE
 {
@@ -355051,10 +351643,10 @@ rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_2 : FILE
 		modified = "2023-12-05"
 		old_rule_name = "z_webshell"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta18_074A.yar#L9-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta18_074A.yar#L9-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2c9095c965a55efc46e16b86f9b7d6c6"
-		logic_hash = "d41aa107e54af5d45531a46d24b24f9f14635dbcb50ed26f7c787883854f961f"
+		logic_hash = "v1_sha256_d41aa107e54af5d45531a46d24b24f9f14635dbcb50ed26f7c787883854f961f"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -355064,7 +351656,7 @@ rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_2 : FILE
 		$webshell_password = "public string Password =" nocase ascii wide
 
 	condition:
-		( uint32(0)==0x2040253c or uint32(0)==0x7073613c) and filesize <100KB and 2 of ($webshell_*)
+		( uint32( 0 ) == 0x2040253c or uint32( 0 ) == 0x7073613c ) and filesize < 100KB and 2 of ( $webshell_* )
 }
 rule SIGNATURE_BASE_TA18_074A_Screen : FILE
 {
@@ -355075,9 +351667,9 @@ rule SIGNATURE_BASE_TA18_074A_Screen : FILE
 		date = "2018-03-16"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta18_074A.yar#L34-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e96f70e3d9c7ff5812724111788365c47e2b478a35b39771c12a3d3636a6a020"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta18_074A.yar#L34-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e96f70e3d9c7ff5812724111788365c47e2b478a35b39771c12a3d3636a6a020"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355092,7 +351684,7 @@ rule SIGNATURE_BASE_TA18_074A_Screen : FILE
 		$s5 = "Too many arguments, going to store in current dir" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and 3 of them
 }
 rule SIGNATURE_BASE_TA18_074A_Scripts : FILE
 {
@@ -355103,9 +351695,9 @@ rule SIGNATURE_BASE_TA18_074A_Scripts : FILE
 		date = "2018-03-16"
 		modified = "2022-08-18"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta18_074A.yar#L53-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "888ddd59b388033604474fc008f830159a9a104683fb052e7497b83118cbb8aa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta18_074A.yar#L53-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_888ddd59b388033604474fc008f830159a9a104683fb052e7497b83118cbb8aa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355116,7 +351708,7 @@ rule SIGNATURE_BASE_TA18_074A_Scripts : FILE
 		$s1 = "Running -s cmd /c query user on " ascii
 
 	condition:
-		filesize <600KB and 1 of them
+		filesize < 600KB and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_Certificate_Payload : FILE
 {
@@ -355127,9 +351719,9 @@ rule SIGNATURE_BASE_SUSP_Certificate_Payload : FILE
 		date = "2018-08-02"
 		modified = "2023-12-05"
 		reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cert_payloads.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "909cf4209bbb876a042d86e017f65ce3764d2fde7a602406ed8531ba97c9fb9b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cert_payloads.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_909cf4209bbb876a042d86e017f65ce3764d2fde7a602406ed8531ba97c9fb9b"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -355139,7 +351731,7 @@ rule SIGNATURE_BASE_SUSP_Certificate_Payload : FILE
 		$fp1 = "replace it with the PEM-encoded root certificate"
 
 	condition:
-		uint32(0)==0x2D2D2D2D and $re1 at 0 and not uint8(29)==0x4D and not uint8(28)==0x4D and not 1 of ($fp*)
+		uint32( 0 ) == 0x2D2D2D2D and $re1 at 0 and not uint8( 29 ) == 0x4D and not uint8( 28 ) == 0x4D and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_MAL_Netfilter_Dropper_Jun_2021_1_1 : FILE
 {
@@ -355150,9 +351742,9 @@ rule SIGNATURE_BASE_MAL_Netfilter_Dropper_Jun_2021_1_1 : FILE
 		date = "2020-06-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/struppigel/status/1405483373280235520"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_netfilter.yar#L4-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b70eb5d2d234d0f523c41fa146f315cf7239bbe7a988b393e75ea6cf6aa438d3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_netfilter.yar#L4-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b70eb5d2d234d0f523c41fa146f315cf7239bbe7a988b393e75ea6cf6aa438d3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355170,7 +351762,7 @@ rule SIGNATURE_BASE_MAL_Netfilter_Dropper_Jun_2021_1_1 : FILE
 		$s3 = "\\\\.\\netfilter" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and filesize <1000KB and ( all of ($seq*) or 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize > 6KB and filesize < 1000KB and ( all of ( $seq* ) or 2 of ( $s* ) )
 }
 rule SIGNATURE_BASE_MAL_Netfilter_May_2021_1_1 : FILE
 {
@@ -355181,9 +351773,9 @@ rule SIGNATURE_BASE_MAL_Netfilter_May_2021_1_1 : FILE
 		date = "2020-06-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/struppigel/status/1405483373280235520"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_netfilter.yar#L28-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ba72bbc38c27d0c8d6eea7d513c3ca40276edd929c93abae4098639f7d7649a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_netfilter.yar#L28-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ba72bbc38c27d0c8d6eea7d513c3ca40276edd929c93abae4098639f7d7649a5"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -355203,10 +351795,8 @@ rule SIGNATURE_BASE_MAL_Netfilter_May_2021_1_1 : FILE
 		$s3 = "NETIO.SYS" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and filesize <1000KB and (3 of ($seq*) or 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize > 20KB and filesize < 1000KB and ( 3 of ( $seq* ) or 2 of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Turla_APT_Srsvc : TURLA FILE
 {
 	meta:
@@ -355216,9 +351806,9 @@ rule SIGNATURE_BASE_Turla_APT_Srsvc : TURLA FILE
 		date = "2016-06-09"
 		modified = "2023-12-05"
 		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "76bd2aacde66114090d1c1767da64728219230964a0bc78a5d830819c46bac3a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_76bd2aacde66114090d1c1767da64728219230964a0bc78a5d830819c46bac3a"
 		score = 75
 		quality = 85
 		tags = "TURLA, FILE"
@@ -355235,10 +351825,8 @@ rule SIGNATURE_BASE_Turla_APT_Srsvc : TURLA FILE
 		$s5 = "ModStop" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and (1 of ($x*) or all of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 20KB and ( 1 of ( $x* ) or all of ( $s* ) ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Turla_APT_Malware_Gen1 : TURLA FILE
 {
 	meta:
@@ -355248,9 +351836,9 @@ rule SIGNATURE_BASE_Turla_APT_Malware_Gen1 : TURLA FILE
 		date = "2016-06-09"
 		modified = "2023-12-05"
 		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L33-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3676d01d5e4044fd49292eb7b4376ff90f0a41141f89a19b13c5518b01257be3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L33-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3676d01d5e4044fd49292eb7b4376ff90f0a41141f89a19b13c5518b01257be3"
 		score = 75
 		quality = 85
 		tags = "TURLA, FILE"
@@ -355284,10 +351872,8 @@ rule SIGNATURE_BASE_Turla_APT_Malware_Gen1 : TURLA FILE
 		$s10 = "net_password=%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (2 of ($x*) or 8 of ($s*))) or (12 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 2 of ( $x* ) or 8 of ( $s* ) ) ) or ( 12 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_RUAG_APT_Malware_Gen2 : FILE
 {
 	meta:
@@ -355297,9 +351883,9 @@ rule SIGNATURE_BASE_RUAG_APT_Malware_Gen2 : FILE
 		date = "2016-06-09"
 		modified = "2023-01-06"
 		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L73-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "62c65a5c85930dd2a928508401113ffba28bc6a07188d9bf5c68234bea10e1aa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L73-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_62c65a5c85930dd2a928508401113ffba28bc6a07188d9bf5c68234bea10e1aa"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -355328,10 +351914,8 @@ rule SIGNATURE_BASE_RUAG_APT_Malware_Gen2 : FILE
 		$s7 = "ieuser.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 5 of ($s*))) or (10 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 5 of ( $s* ) ) ) or ( 10 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Turla_APT_Malware_Gen3 : TURLA FILE
 {
 	meta:
@@ -355341,9 +351925,9 @@ rule SIGNATURE_BASE_Turla_APT_Malware_Gen3 : TURLA FILE
 		date = "2016-06-09"
 		modified = "2023-12-05"
 		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L110-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8c24cf71841efc974c8a4d8eb5662137592c1d454821c9beadc50d83cb19333c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L110-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8c24cf71841efc974c8a4d8eb5662137592c1d454821c9beadc50d83cb19333c"
 		score = 75
 		quality = 85
 		tags = "TURLA, FILE"
@@ -355379,10 +351963,8 @@ rule SIGNATURE_BASE_Turla_APT_Malware_Gen3 : TURLA FILE
 		$s9 = "Mozilla/4.0 (compatible; MSIE %d.0; " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 6 of ($s*))) or (10 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 6 of ( $s* ) ) ) or ( 10 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Turla_Mal_Script_Jan18_1 : FILE
 {
 	meta:
@@ -355392,9 +351974,9 @@ rule SIGNATURE_BASE_Turla_Mal_Script_Jan18_1 : FILE
 		date = "2018-01-19"
 		modified = "2023-12-05"
 		reference = "https://ghostbin.com/paste/jsph7"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L152-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2386abf8afdf8ed9cfd55cb3dcbb998eb732744c601fd9af701cf64c366a0e62"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L152-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2386abf8afdf8ed9cfd55cb3dcbb998eb732744c601fd9af701cf64c366a0e62"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355409,7 +351991,7 @@ rule SIGNATURE_BASE_Turla_Mal_Script_Jan18_1 : FILE
 		$s5 = "= \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";var i;" ascii
 
 	condition:
-		filesize <200KB and 2 of them
+		filesize < 200KB and 2 of them
 }
 import "pe"
 
@@ -355422,9 +352004,9 @@ rule SIGNATURE_BASE_Turla_Kazuarrat : FILE
 		date = "2018-04-08"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/DrunkBinary/status/982969891975319553"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L173-L192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d7f15fe8e33a9e3516eab5c3c5664aeee25d1d153f01b888a50dd2accba432ca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L173-L192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d7f15fe8e33a9e3516eab5c3c5664aeee25d1d153f01b888a50dd2accba432ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355439,10 +352021,8 @@ rule SIGNATURE_BASE_Turla_Kazuarrat : FILE
 		$s4 = "0`.wtf" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (pe.imphash()=="682156c4380c216ff8cb766a2f2e8817" or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and ( pe.imphash ( ) == "682156c4380c216ff8cb766a2f2e8817" or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Turla_Agent_BTZ : FILE
 {
 	meta:
@@ -355452,9 +352032,9 @@ rule SIGNATURE_BASE_MAL_Turla_Agent_BTZ : FILE
 		date = "2018-04-12"
 		modified = "2023-01-06"
 		reference = "https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L195-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3a091d29ef5981b9ab9c0e4114fef9de70acbcbc8ea8518183a567459e1086fa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L195-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3a091d29ef5981b9ab9c0e4114fef9de70acbcbc8ea8518183a567459e1086fa"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -355477,10 +352057,8 @@ rule SIGNATURE_BASE_MAL_Turla_Agent_BTZ : FILE
 		$s9 = "\\system32\\win.com" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Turla_Sample_May18_1 : FILE
 {
 	meta:
@@ -355490,9 +352068,9 @@ rule SIGNATURE_BASE_MAL_Turla_Sample_May18_1 : FILE
 		date = "2018-05-03"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/omri9741/status/991942007701598208"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L228-L250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f5bb26bc787acb89fe5a337121aabc0cd15ed3fd5cbe64ef4e7031e04dc14fb1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L228-L250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f5bb26bc787acb89fe5a337121aabc0cd15ed3fd5cbe64ef4e7031e04dc14fb1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355512,10 +352090,8 @@ rule SIGNATURE_BASE_MAL_Turla_Sample_May18_1 : FILE
 		$x9 = "system32\\dxsnd32x.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr20_1 : FILE
 {
 	meta:
@@ -355525,9 +352101,9 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr20_1 : FILE
 		date = "2020-04-05"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/Int2e_/status/1246115636331319309"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L252-L272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d463f5a151bb0c3440d719b4c7c0d1ca34de1e0bed7fb9167ecf396607abd3ff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L252-L272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d463f5a151bb0c3440d719b4c7c0d1ca34de1e0bed7fb9167ecf396607abd3ff"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355543,10 +352119,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr20_1 : FILE
 		$s6 = "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel" ascii fullword
 
 	condition:
-		uint16(0)==0x457f and filesize <5000KB and 4 of them
+		uint16( 0 ) == 0x457f and filesize < 5000KB and 4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_Tinyturla_Sep21_1 : FILE
 {
 	meta:
@@ -355556,9 +352130,9 @@ rule SIGNATURE_BASE_APT_MAL_Tinyturla_Sep21_1 : FILE
 		date = "2021-09-21"
 		modified = "2023-12-05"
 		reference = "https://blog.talosintelligence.com/2021/09/tinyturla.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla.yar#L275-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ede598374bc4a8a870aa29498be4200b4a3d7b289dfcb680fb3f91108d212bca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla.yar#L275-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ede598374bc4a8a870aa29498be4200b4a3d7b289dfcb680fb3f91108d212bca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355576,7 +352150,7 @@ rule SIGNATURE_BASE_APT_MAL_Tinyturla_Sep21_1 : FILE
 		$i = "WinHttpQueryDataAvailable" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 25KB and all of them
 }
 rule SIGNATURE_BASE_FE_Webshell_PL_ATRIUM_1
 {
@@ -355587,10 +352161,10 @@ rule SIGNATURE_BASE_FE_Webshell_PL_ATRIUM_1
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L12-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L12-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ca0175d86049fa7c796ea06b413857a3"
-		logic_hash = "869b397616495c644beb997602eac84ddcdbacce4c14755c555f5bda36663ca2"
+		logic_hash = "v1_sha256_869b397616495c644beb997602eac84ddcdbacce4c14755c555f5bda36663ca2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -355612,10 +352186,10 @@ rule SIGNATURE_BASE_FE_Trojan_SH_ATRIUM_1
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L29-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L29-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a631b7a8a11e6df3fccb21f4d34dbd8a"
-		logic_hash = "672a293660d89d5d7d62a658c360bad0b6408611d8794744b17a81e6a75ceea7"
+		logic_hash = "v1_sha256_672a293660d89d5d7d62a658c360bad0b6408611d8794744b17a81e6a75ceea7"
 		score = 75
 		quality = 60
 		tags = ""
@@ -355638,10 +352212,10 @@ rule SIGNATURE_BASE_FE_APT_Webshell_PL_HARDPULSE
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L46-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L46-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "980cba9e82faf194edb6f3cc20dc73ff"
-		logic_hash = "37fc40fd998d3294edb05707170bc2deec524fc6451bff212901f9ac3e34bb35"
+		logic_hash = "v1_sha256_37fc40fd998d3294edb05707170bc2deec524fc6451bff212901f9ac3e34bb35"
 		score = 75
 		quality = 83
 		tags = ""
@@ -355667,10 +352241,10 @@ rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_LOCKPICK_1 : FILE
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L66-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L66-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e8bfd3f5a2806104316902bbe1195ee8"
-		logic_hash = "1623c2dc63fe7d595069a024b715bbca267ec1c9400afcadc377ae58afb81a2a"
+		logic_hash = "v1_sha256_1623c2dc63fe7d595069a024b715bbca267ec1c9400afcadc377ae58afb81a2a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355680,7 +352254,7 @@ rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_LOCKPICK_1 : FILE
 		$sb2 = { 83 [2] 63 74 ?? 89 ?? 24 04 89 ?? 24 E8 [4] 83 [2] 01 85 C0 0F [5] EB 00 8B ?? 04 83 F8 02 7? ?? 83 E8 01 C1 E0 02 83 C0 00 89 44 24 08 8D 83 [4] 89 44 24 04 8B ?? 89 04 24 E8 }
 
 	condition:
-		(( uint32(0)==0x464c457f) and ( uint8(4)==1)) and (@sb1[1]<@sb2[1])
+		(( uint32( 0 ) == 0x464c457f ) and ( uint8( 4 ) == 1 ) ) and ( @sb1 [ 1 ] < @sb2 [ 1 ] )
 }
 rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_PACEMAKER : FILE
 {
@@ -355691,10 +352265,10 @@ rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_PACEMAKER : FILE
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L81-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L81-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d7881c4de4d57828f7e1cab15687274b"
-		logic_hash = "f3f89744ce558179f36da3b412ba4afb3798684e6d976ef59de565b5a3323ad6"
+		logic_hash = "v1_sha256_f3f89744ce558179f36da3b412ba4afb3798684e6d976ef59de565b5a3323ad6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355707,7 +352281,7 @@ rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_PACEMAKER : FILE
 		$sb2 = { 8B 95 [4] B8 [4] 8D 8D [4] 89 4C 24 10 8D 8D [4] 89 4C 24 0C 89 54 24 08 89 44 24 04 8D 85 [4] 89 04 24 E8 [4] C7 44 24 08 02 00 00 00 C7 44 24 04 00 00 00 00 8B 45 ?? 89 04 24 E8 [4] 89 45 ?? 8D 85 [4] 89 04 24 E8 [4] 89 44 24 08 8D 85 [4] 89 44 24 04 8B 45 ?? 89 04 24 E8 [4] 8B 45 ?? 89 45 ?? C7 45 ?? 00 00 00 00 [0-16] 83 45 ?? 01 8B 45 ?? 3B 45 0C }
 
 	condition:
-		(( uint32(0)==0x464c457f) and ( uint8(4)==1)) and all of them
+		(( uint32( 0 ) == 0x464c457f ) and ( uint8( 4 ) == 1 ) ) and all of them
 }
 rule SIGNATURE_BASE_FE_APT_Trojan_Linux_PACEMAKER : FILE
 {
@@ -355718,10 +352292,10 @@ rule SIGNATURE_BASE_FE_APT_Trojan_Linux_PACEMAKER : FILE
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L99-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L99-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d7881c4de4d57828f7e1cab15687274b"
-		logic_hash = "cf83024cbbd500a301ac3c859b680cd79acabc232ea6f42c23fe9f8918a8d914"
+		logic_hash = "v1_sha256_cf83024cbbd500a301ac3c859b680cd79acabc232ea6f42c23fe9f8918a8d914"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355733,7 +352307,7 @@ rule SIGNATURE_BASE_FE_APT_Trojan_Linux_PACEMAKER : FILE
 		$s4 = "\x00/proc/%s/cmdline\x00"
 
 	condition:
-		( uint32(0)==0x464c457f) and all of them
+		( uint32( 0 ) == 0x464c457f ) and all of them
 }
 rule SIGNATURE_BASE_FE_APT_Webshell_PL_PULSECHECK_1
 {
@@ -355744,10 +352318,10 @@ rule SIGNATURE_BASE_FE_APT_Webshell_PL_PULSECHECK_1
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L116-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L116-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1"
-		logic_hash = "aba457dd33232ef37ca145c5b7cd9c5fe809730339a55c5e90ac46b4a136f6cb"
+		logic_hash = "v1_sha256_aba457dd33232ef37ca145c5b7cd9c5fe809730339a55c5e90ac46b4a136f6cb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -355763,7 +352337,7 @@ rule SIGNATURE_BASE_FE_APT_Webshell_PL_PULSECHECK_1
 		$s7 = "HTTP_X_"
 
 	condition:
-		$s1 and $s2 and (@s3[1]<@s4[1]) and (@s4[1]<@s5[1]) and (@s5[1]<@s6[1]) and (#s7>2) and $r1
+		$s1 and $s2 and ( @s3 [ 1 ] < @s4 [ 1 ] ) and ( @s4 [ 1 ] < @s5 [ 1 ] ) and ( @s5 [ 1 ] < @s6 [ 1 ] ) and ( #s7 > 2 ) and $r1
 }
 rule SIGNATURE_BASE_FE_APT_Trojan_PL_PULSEJUMP_1
 {
@@ -355774,10 +352348,10 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_PULSEJUMP_1
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L137-L153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L137-L153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "91ee23ee24e100ba4a943bb4c15adb4c"
-		logic_hash = "c9aa2b9ef8aff14c20ed6597b1a71eafc3e3c181aabf9a3a68df18945207ff86"
+		logic_hash = "v1_sha256_c9aa2b9ef8aff14c20ed6597b1a71eafc3e3c181aabf9a3a68df18945207ff86"
 		score = 75
 		quality = 85
 		tags = ""
@@ -355800,10 +352374,10 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_QUIETPULSE
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L154-L172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L154-L172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "00575bec8d74e221ff6248228c509a16"
-		logic_hash = "226a56369e141834d4834400bbf1a006bbb6e9b39e16e24b0106bff1a9c202a9"
+		logic_hash = "v1_sha256_226a56369e141834d4834400bbf1a006bbb6e9b39e16e24b0106bff1a9c202a9"
 		score = 75
 		quality = 83
 		tags = ""
@@ -355828,10 +352402,10 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_1
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L173-L190"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L173-L190"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d72daafedf41d484f7f9816f7f076a9249a6808f1899649b7daa22c0447bb37b"
-		logic_hash = "d65a466cc15214d8e26597588c039a6b9fb4637ef8f3b1ebea27f016fbd5cba8"
+		logic_hash = "v1_sha256_d65a466cc15214d8e26597588c039a6b9fb4637ef8f3b1ebea27f016fbd5cba8"
 		score = 75
 		quality = 83
 		tags = ""
@@ -355844,7 +352418,7 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_1
 		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]password=\$/
 
 	condition:
-		(@s1[1]<@s2[1]) and (@s2[1]<@s3[1]) and $s4 and $s5
+		(@s1 [ 1 ] < @s2 [ 1 ] ) and ( @s2 [ 1 ] < @s3 [ 1 ] ) and $s4 and $s5
 }
 rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_2
 {
@@ -355855,10 +352429,10 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_2
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L191-L208"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L191-L208"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
-		logic_hash = "4ade993176c918ec23e99fc585e9ab14d9f9e93a7eca00f2c3b0ebbd13d6ec5b"
+		logic_hash = "v1_sha256_4ade993176c918ec23e99fc585e9ab14d9f9e93a7eca00f2c3b0ebbd13d6ec5b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -355882,10 +352456,10 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_3
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L209-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L209-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
-		logic_hash = "025308591e058de284f949fd4f788e4a4f46bb2f6c0e1161237f1f811d8179ba"
+		logic_hash = "v1_sha256_025308591e058de284f949fd4f788e4a4f46bb2f6c0e1161237f1f811d8179ba"
 		score = 75
 		quality = 85
 		tags = ""
@@ -355909,10 +352483,10 @@ rule SIGNATURE_BASE_FE_APT_Backdoor_Linux32_SLOWPULSE_1 : FILE
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L227-L244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L227-L244"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68"
-		logic_hash = "c1d92ea4ed8e5934c8356e1e52092935c53a138e454026737448f7f523ea06be"
+		logic_hash = "v1_sha256_c1d92ea4ed8e5934c8356e1e52092935c53a138e454026737448f7f523ea06be"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355925,7 +352499,7 @@ rule SIGNATURE_BASE_FE_APT_Backdoor_Linux32_SLOWPULSE_1 : FILE
 		$sb5 = {8d [5] b9 [4] f3 a6 0f 8?}
 
 	condition:
-		(( uint32(0)==0x464c457f) and ( uint8(4)==1)) and all of them
+		(( uint32( 0 ) == 0x464c457f ) and ( uint8( 4 ) == 1 ) ) and all of them
 }
 rule SIGNATURE_BASE_FE_APT_Webshell_PL_STEADYPULSE_1
 {
@@ -355936,10 +352510,10 @@ rule SIGNATURE_BASE_FE_APT_Webshell_PL_STEADYPULSE_1
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_pulsesecure.yar#L265-L284"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_pulsesecure.yar#L265-L284"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc"
-		logic_hash = "a0e3ebdd02ccf5cc8fc0a83c1d0224aed45dc5094eb85bd855e5b74b34e3aaaf"
+		logic_hash = "v1_sha256_a0e3ebdd02ccf5cc8fc0a83c1d0224aed45dc5094eb85bd855e5b74b34e3aaaf"
 		score = 75
 		quality = 85
 		tags = ""
@@ -355965,9 +352539,9 @@ rule SIGNATURE_BASE_APT_Webshell_Tiny_1 : FILE
 		date = "2019-02-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aus_parl_compromise.yar#L12-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "277162f720195c94d36fd3350d0dda785007e8cc6ed2ab2aa1a6a6262f2993fa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aus_parl_compromise.yar#L12-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_277162f720195c94d36fd3350d0dda785007e8cc6ed2ab2aa1a6a6262f2993fa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -355976,7 +352550,7 @@ rule SIGNATURE_BASE_APT_Webshell_Tiny_1 : FILE
 		$x1 = "eval(" ascii wide
 
 	condition:
-		( uint16(0)==0x3f3c or uint16(0)==0x253c) and filesize <40 and $x1
+		( uint16( 0 ) == 0x3f3c or uint16( 0 ) == 0x253c ) and filesize < 40 and $x1
 }
 rule SIGNATURE_BASE_APT_Webshell_AUS_Tiny_2 : FILE
 {
@@ -355987,9 +352561,9 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_Tiny_2 : FILE
 		date = "2019-02-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aus_parl_compromise.yar#L25-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e26c265d2b1606257d8c843921601f14cae2beaf246f8e37daeeb6c5ff12f289"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aus_parl_compromise.yar#L25-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e26c265d2b1606257d8c843921601f14cae2beaf246f8e37daeeb6c5ff12f289"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356000,7 +352574,7 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_Tiny_2 : FILE
 		$x2 = "eval(arguments,System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"" ascii
 
 	condition:
-		( uint16(0)==0x3f3c or uint16(0)==0x253c) and filesize <1KB and 1 of them
+		( uint16( 0 ) == 0x3f3c or uint16( 0 ) == 0x253c ) and filesize < 1KB and 1 of them
 }
 rule SIGNATURE_BASE_APT_Webshell_AUS_Jscript_3 : FILE
 {
@@ -356011,9 +352585,9 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_Jscript_3 : FILE
 		date = "2019-02-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aus_parl_compromise.yar#L40-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e144e555dd80e15ac9072a645e629a86ca1a6b52949d236ec3daedbf06bd6718"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aus_parl_compromise.yar#L40-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e144e555dd80e15ac9072a645e629a86ca1a6b52949d236ec3daedbf06bd6718"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356024,7 +352598,7 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_Jscript_3 : FILE
 		$s2 = ".Item[\"[password]\"])),\"unsafe\");}" ascii
 
 	condition:
-		uint16(0)==0x6568 and filesize <1KB and all of them
+		uint16( 0 ) == 0x6568 and filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_APT_Webshell_AUS_4 : FILE
 {
@@ -356035,9 +352609,9 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_4 : FILE
 		date = "2019-02-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aus_parl_compromise.yar#L56-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4a4f26b50631021979e4a8246a1e1c10150f4fb03eb7d77a1042e41ef57b3961"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aus_parl_compromise.yar#L56-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4a4f26b50631021979e4a8246a1e1c10150f4fb03eb7d77a1042e41ef57b3961"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356050,7 +352624,7 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_4 : FILE
 		$s4 = "gen.Emit(System.Reflection.Emit.OpCodes.Ret);" fullword ascii
 
 	condition:
-		uint16(0)==0x7566 and filesize <10KB and 3 of them
+		uint16( 0 ) == 0x7566 and filesize < 10KB and 3 of them
 }
 rule SIGNATURE_BASE_APT_Script_AUS_4 : FILE
 {
@@ -356061,9 +352635,9 @@ rule SIGNATURE_BASE_APT_Script_AUS_4 : FILE
 		date = "2019-02-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aus_parl_compromise.yar#L73-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3a81365572380964abe07a1ec16a9ea299bf16a4e624285faaa6f72c44f762d2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aus_parl_compromise.yar#L73-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3a81365572380964abe07a1ec16a9ea299bf16a4e624285faaa6f72c44f762d2"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -356078,7 +352652,7 @@ rule SIGNATURE_BASE_APT_Script_AUS_4 : FILE
 		$x6 = ".DoCmd.Close , , acSaveYes" fullword ascii
 
 	condition:
-		filesize <7KB and 1 of them
+		filesize < 7KB and 1 of them
 }
 rule SIGNATURE_BASE_APT_Webshell_AUS_5 : FILE
 {
@@ -356089,9 +352663,9 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_5 : FILE
 		date = "2019-02-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aus_parl_compromise.yar#L92-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fb0e53e5561f7f14f2ad6afcda2798d353cf4d54d12ae3354b03d62ed0c00bf3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aus_parl_compromise.yar#L92-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fb0e53e5561f7f14f2ad6afcda2798d353cf4d54d12ae3354b03d62ed0c00bf3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356107,7 +352681,7 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_5 : FILE
 		$s5 = "var hashtable = Application[CachePtr];" fullword ascii
 
 	condition:
-		uint16(0)==0x7566 and filesize <2KB and 4 of them
+		uint16( 0 ) == 0x7566 and filesize < 2KB and 4 of them
 }
 rule SIGNATURE_BASE_HKTL_Lazycat_Logeraser
 {
@@ -356118,9 +352692,9 @@ rule SIGNATURE_BASE_HKTL_Lazycat_Logeraser
 		date = "2019-02-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aus_parl_compromise.yar#L113-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2b4b69dd675172b9b0c08fac674b6daa107535694b4073750501627fb48d12c2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aus_parl_compromise.yar#L113-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2b4b69dd675172b9b0c08fac674b6daa107535694b4073750501627fb48d12c2"
 		score = 75
 		quality = 35
 		tags = ""
@@ -356150,9 +352724,9 @@ rule SIGNATURE_BASE_HKTL_Powerkatz_Feb19_1
 		date = "2019-02-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aus_parl_compromise.yar#L137-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d1d39d68c5c5a3f6142a966925e2a136e937bc09abddd4080862346683886455"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aus_parl_compromise.yar#L137-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d1d39d68c5c5a3f6142a966925e2a136e937bc09abddd4080862346683886455"
 		score = 75
 		quality = 85
 		tags = ""
@@ -356164,7 +352738,7 @@ rule SIGNATURE_BASE_HKTL_Powerkatz_Feb19_1
 		$s2 = "GetRes Ex:" fullword ascii wide
 
 	condition:
-		1 of ($x*) and 1 of ($s*)
+		1 of ( $x* ) and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_HKTL_Unknown_Feb19_1
 {
@@ -356175,9 +352749,9 @@ rule SIGNATURE_BASE_HKTL_Unknown_Feb19_1
 		date = "2019-02-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aus_parl_compromise.yar#L154-L172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "231c771ed24106a8daf352a0df1bc2db43ebd8d1108d7fa1162d03d40e738d46"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aus_parl_compromise.yar#L154-L172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_231c771ed24106a8daf352a0df1bc2db43ebd8d1108d7fa1162d03d40e738d46"
 		score = 75
 		quality = 85
 		tags = ""
@@ -356192,7 +352766,7 @@ rule SIGNATURE_BASE_HKTL_Unknown_Feb19_1
 		$s2 = "C:\\Windows\\temp\\" ascii wide
 
 	condition:
-		1 of ($x*) or 2 of them
+		1 of ( $x* ) or 2 of them
 }
 rule SIGNATURE_BASE_SUSP_EXPL_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
 {
@@ -356203,14 +352777,14 @@ rule SIGNATURE_BASE_SUSP_EXPL_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
 		date = "2023-03-15"
 		modified = "2024-12-03"
 		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_outlook_cve_2023_23397.yar#L1-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_outlook_cve_2023_23397.yar#L1-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
 		hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
 		hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
 		hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
 		hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
-		logic_hash = "fbbbaf5cd858078adddc80b9c9c56cb448613da28206a91778d22cd1cf64655e"
+		logic_hash = "v1_sha256_fbbbaf5cd858078adddc80b9c9c56cb448613da28206a91778d22cd1cf64655e"
 		score = 60
 		quality = 85
 		tags = "CVE-2023-23397, FILE"
@@ -356225,7 +352799,7 @@ rule SIGNATURE_BASE_SUSP_EXPL_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
 		$fp_asd = "theme/theme1.xml"
 
 	condition:
-		uint32be(0)==0xD0CF11E0 and uint32be(4)==0xA1B11AE1 and 1 of ($psetid*) and $rfp and $u1 and not 1 of ($fp*)
+		uint32be( 0 ) == 0xD0CF11E0 and uint32be( 4 ) == 0xA1B11AE1 and 1 of ( $psetid* ) and $rfp and $u1 and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 : CVE_2023_23397 FILE
 {
@@ -356236,15 +352810,15 @@ rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 : CVE_2023_2
 		date = "2023-03-15"
 		modified = "2023-03-18"
 		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_outlook_cve_2023_23397.yar#L41-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_outlook_cve_2023_23397.yar#L41-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
 		hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
 		hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
 		hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
 		hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
 		hash = "e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02"
-		logic_hash = "a8e8326f5aaa29b449f9203623e03d3d3a1d176bb764171d860afc510a1732e6"
+		logic_hash = "v1_sha256_a8e8326f5aaa29b449f9203623e03d3d3a1d176bb764171d860afc510a1732e6"
 		score = 75
 		quality = 85
 		tags = "CVE-2023-23397, FILE"
@@ -356259,7 +352833,7 @@ rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 : CVE_2023_2
 		$fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}
 
 	condition:
-		( uint16(0)==0xCFD0 and 1 of ($psetid*) or uint32be(0)==0x789F3E22) and any of ($u*) and $rfp and not 1 of ($fp*)
+		( uint16( 0 ) == 0xCFD0 and 1 of ( $psetid* ) or uint32be( 0 ) == 0x789F3E22 ) and any of ( $u* ) and $rfp and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 : CVE_2023_23397
 {
@@ -356270,9 +352844,9 @@ rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 : CVE_2023_
 		date = "2023-03-17"
 		modified = "2023-03-24"
 		reference = "https://twitter.com/wdormann/status/1636491612686622723"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_outlook_cve_2023_23397.yar#L83-L112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a361eb3abf98655f43efff2a5399f112d9ac2d23df85a642ab744c78e98330e0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_outlook_cve_2023_23397.yar#L83-L112"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a361eb3abf98655f43efff2a5399f112d9ac2d23df85a642ab744c78e98330e0"
 		score = 60
 		quality = 85
 		tags = "CVE-2023-23397"
@@ -356288,7 +352862,7 @@ rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 : CVE_2023_
 		$unc = "\x00\x00\x00\x5c\x5c" base64
 
 	condition:
-		all of ($mail*) and all of ($tnef*) and 1 of ($ipm*) and $unc
+		all of ( $mail* ) and all of ( $tnef* ) and 1 of ( $ipm* ) and $unc
 }
 rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_2 : FILE
 {
@@ -356299,9 +352873,9 @@ rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_2 : FILE
 		date = "2018-04-24"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sednit_delphidownloader.yar#L11-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "32acbec3405007afce22b0521785439686338d4d3beb02a1d7b9005e49d87221"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sednit_delphidownloader.yar#L11-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_32acbec3405007afce22b0521785439686338d4d3beb02a1d7b9005e49d87221"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356325,7 +352899,7 @@ rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_2 : FILE
 		$fp1 = "<key name=\"profiles\">"
 
 	condition:
-		filesize <4000KB and 1 of ($s*) and not 1 of ($fp*)
+		filesize < 4000KB and 1 of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_3 : FILE
 {
@@ -356336,9 +352910,9 @@ rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_3 : FILE
 		date = "2018-04-24"
 		modified = "2023-01-06"
 		reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sednit_delphidownloader.yar#L40-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "20446692842ec9481f34dd976f6b309515c33159653f9988a59335d2f04e4138"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sednit_delphidownloader.yar#L40-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_20446692842ec9481f34dd976f6b309515c33159653f9988a59335d2f04e4138"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356357,7 +352931,7 @@ rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_3 : FILE
 		$ = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 3 of them
 }
 rule SIGNATURE_BASE_APT_MAL_Falsefont_Backdoor_Jan24 : FILE
 {
@@ -356368,10 +352942,10 @@ rule SIGNATURE_BASE_APT_MAL_Falsefont_Backdoor_Jan24 : FILE
 		date = "2024-01-11"
 		modified = "2024-04-24"
 		reference = "https://twitter.com/MsftSecIntel/status/1737895710169628824"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_peach_sandstorm.yar#L1-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_peach_sandstorm.yar#L1-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
-		logic_hash = "9a1b3779b63dd7fa8ddc84067dec09542518e9acebbf5d3b45cb75ec4add1158"
+		logic_hash = "v1_sha256_9a1b3779b63dd7fa8ddc84067dec09542518e9acebbf5d3b45cb75ec4add1158"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -356389,7 +352963,7 @@ rule SIGNATURE_BASE_APT_MAL_Falsefont_Backdoor_Jan24 : FILE
 		$sb5 = "password_value" wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or all of ($sa*) or all of ($sb*) or (1 of ($sa*) and 4 of ($sb*)))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $sa* ) or all of ( $sb* ) or ( 1 of ( $sa* ) and 4 of ( $sb* ) ) )
 }
 rule SIGNATURE_BASE_Lokibot_Dropper_Scancopypdf_Feb18 : FILE
 {
@@ -356400,9 +352974,9 @@ rule SIGNATURE_BASE_Lokibot_Dropper_Scancopypdf_Feb18 : FILE
 		date = "2018-02-14"
 		modified = "2023-12-05"
 		reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_loki_bot.yar#L11-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b9f10a09d91c10731e34dc88f87104693cdc794ddc3c63ee382f976d0a75f30f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_loki_bot.yar#L11-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b9f10a09d91c10731e34dc88f87104693cdc794ddc3c63ee382f976d0a75f30f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356417,7 +352991,7 @@ rule SIGNATURE_BASE_Lokibot_Dropper_Scancopypdf_Feb18 : FILE
 		$s3 = "Compiling.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and $x1 or ($a1 and 1 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and $x1 or ( $a1 and 1 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Lokibot_Dropper_Packed_R11_Feb18 : FILE
 {
@@ -356428,9 +353002,9 @@ rule SIGNATURE_BASE_Lokibot_Dropper_Packed_R11_Feb18 : FILE
 		date = "2018-02-14"
 		modified = "2023-12-05"
 		reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_loki_bot.yar#L33-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ca39cac8dcbbbe1697ef96bde60c522bb9cc190c208483220aa96bc672f325a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_loki_bot.yar#L33-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ca39cac8dcbbbe1697ef96bde60c522bb9cc190c208483220aa96bc672f325a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356441,7 +353015,7 @@ rule SIGNATURE_BASE_Lokibot_Dropper_Packed_R11_Feb18 : FILE
 		$s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
 
 	condition:
-		uint16(0)==0x0000 and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0x0000 and filesize < 2000KB and 1 of them
 }
 rule SIGNATURE_BASE_Apt_CN_Tetris_JS_Advanced_1 : FILE
 {
@@ -356452,9 +353026,9 @@ rule SIGNATURE_BASE_Apt_CN_Tetris_JS_Advanced_1 : FILE
 		date = "2020-09-06"
 		modified = "2023-12-05"
 		reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_tetris.yar#L2-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec4ba53fea05c5331ed900b8c7da4cddd4ab64e87dfc165ac18d72d22f754d87"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_tetris.yar#L2-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec4ba53fea05c5331ed900b8c7da4cddd4ab64e87dfc165ac18d72d22f754d87"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356469,7 +353043,7 @@ rule SIGNATURE_BASE_Apt_CN_Tetris_JS_Advanced_1 : FILE
 		$e1 = "')](__p__)"
 
 	condition:
-		$a1 at 0 or ( filesize <1000KB and (#b1>300 or #e1>1 or 2 of ($cx*)))
+		$a1 at 0 or ( filesize < 1000KB and ( #b1 > 300 or #e1 > 1 or 2 of ( $cx* ) ) )
 }
 rule SIGNATURE_BASE_Apt_CN_Tetrisplugins_JS : FILE
 {
@@ -356480,9 +353054,9 @@ rule SIGNATURE_BASE_Apt_CN_Tetrisplugins_JS : FILE
 		date = "2020-09-06"
 		modified = "2023-12-05"
 		reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_tetris.yar#L34-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa77d622584e79c86139b9c0f0b8ff46fc10461d0776e46c93490b6bb667afcf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_tetris.yar#L34-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa77d622584e79c86139b9c0f0b8ff46fc10461d0776e46c93490b6bb667afcf"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -356531,7 +353105,7 @@ rule SIGNATURE_BASE_Apt_CN_Tetrisplugins_JS : FILE
 		$e9 = "{isPluginCallback:\x20true,\x20data,\x20plugin:\x20" base64
 
 	condition:
-		filesize <1000000 and ( any of ($a*) or 2 of ($b*) or 4 of ($c*) or 2 of ($e*) or ( any of ($use_strict*) and (( any of ($b*) and 2 of ($c*)) or any of ($e*))))
+		filesize < 1000000 and ( any of ( $a* ) or 2 of ( $b* ) or 4 of ( $c* ) or 2 of ( $e* ) or ( any of ( $use_strict* ) and ( ( any of ( $b* ) and 2 of ( $c* ) ) or any of ( $e* ) ) ) )
 }
 rule SIGNATURE_BASE_Malware_JS_Powershell_Obfuscated : FILE
 {
@@ -356542,9 +353116,9 @@ rule SIGNATURE_BASE_Malware_JS_Powershell_Obfuscated : FILE
 		date = "2017-03-24"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_javascript_powershell.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1dd745624971f10acb7911433f363b0cf20c8c45344f702d7f3549c58689b371"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_javascript_powershell.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1dd745624971f10acb7911433f363b0cf20c8c45344f702d7f3549c58689b371"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356555,7 +353129,7 @@ rule SIGNATURE_BASE_Malware_JS_Powershell_Obfuscated : FILE
 		$x1 = "po\" + \"wer\" + \"sh\" + \"e\" + \"ll\";" fullword ascii
 
 	condition:
-		filesize <30KB and 1 of them
+		filesize < 30KB and 1 of them
 }
 rule SIGNATURE_BASE_STUXSHOP_Config
 {
@@ -356566,10 +353140,10 @@ rule SIGNATURE_BASE_STUXSHOP_Config
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxshop.yar#L2-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxshop.yar#L2-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
-		logic_hash = "9dd57f8b4e25a53dcf54dc75a1bb26675c7dd04dbb4d96286bcc0a6527a21782"
+		logic_hash = "v1_sha256_9dd57f8b4e25a53dcf54dc75a1bb26675c7dd04dbb4d96286bcc0a6527a21782"
 		score = 75
 		quality = 85
 		tags = ""
@@ -356589,7 +353163,7 @@ rule SIGNATURE_BASE_STUXSHOP_Config
 		$flowerOverlap6 = { 85 FF 74 12 83 7D F8 01 75 0C FF 75 0C FF 75 08 FF 15 }
 
 	condition:
-		all of ($flowerOverlap*) or 2 of ($cnc*) or all of ($regkey*)
+		all of ( $flowerOverlap* ) or 2 of ( $cnc* ) or all of ( $regkey* )
 }
 rule SIGNATURE_BASE_STUXSHOP_Oscheck
 {
@@ -356600,10 +353174,10 @@ rule SIGNATURE_BASE_STUXSHOP_Oscheck
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_stuxshop.yar#L32-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_stuxshop.yar#L32-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
-		logic_hash = "3dca26e622289c2d244e3af035e892455a47daa67dbe0c6fad29d9f7403cbc6b"
+		logic_hash = "v1_sha256_3dca26e622289c2d244e3af035e892455a47daa67dbe0c6fad29d9f7403cbc6b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -356628,9 +353202,9 @@ rule SIGNATURE_BASE_LOG_APT_WEBSHELL_Solarwinds_SUNBURST_Report_Webshell_Dec20_2
 		date = "2020-12-21"
 		modified = "2023-12-05"
 		reference = "https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_solarwinds_susp_sunburst.yar#L21-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec52e244a483ace0f6932b553b159b23b767c00d1f64a4711e5f359832e846f5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_solarwinds_susp_sunburst.yar#L21-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec52e244a483ace0f6932b553b159b23b767c00d1f64a4711e5f359832e846f5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -356650,9 +353224,9 @@ rule SIGNATURE_BASE_VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21 : CVE_2021_38647 FILE
 		date = "2021-09-16"
 		modified = "2023-12-05"
 		reference = "https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_cve_2021_386471_omi.yar#L1-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "99fddcf763f41a08a8ef8240d544ef67b840a1b5ae709bd7efbcbcad8268e8a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_cve_2021_386471_omi.yar#L1-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_99fddcf763f41a08a8ef8240d544ef67b840a1b5ae709bd7efbcbcad8268e8a5"
 		score = 50
 		quality = 85
 		tags = "CVE-2021-38647, FILE"
@@ -356680,7 +353254,7 @@ rule SIGNATURE_BASE_VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21 : CVE_2021_38647 FILE
 		$s19 = "OMI-1.4.0-6 - " ascii
 
 	condition:
-		uint32be(0)==0x7f454c46 and $a1 and 1 of ($s*)
+		uint32be( 0 ) == 0x7f454c46 and $a1 and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_MAL_OSX_Fancybear_Agent_Jul18_1 : FILE
 {
@@ -356691,9 +353265,9 @@ rule SIGNATURE_BASE_MAL_OSX_Fancybear_Agent_Jul18_1 : FILE
 		date = "2018-07-15"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/DrunkBinary/status/1018448895054098432"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fancybear_osxagent.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "099235424f22f3591a891726ea0c13ebf831fae0456ab1b6baba329c090a9535"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fancybear_osxagent.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_099235424f22f3591a891726ea0c13ebf831fae0456ab1b6baba329c090a9535"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -356709,7 +353283,7 @@ rule SIGNATURE_BASE_MAL_OSX_Fancybear_Agent_Jul18_1 : FILE
 		$s6 = "chmod 755 /Users/Shared/.local/kextd" fullword ascii
 
 	condition:
-		uint16(0)==0xfacf and filesize <3000KB and (1 of ($x*) and 4 of them )
+		uint16( 0 ) == 0xfacf and filesize < 3000KB and ( 1 of ( $x* ) and 4 of them )
 }
 rule SIGNATURE_BASE_Mal_Dropper_Httpexe_From_CAB : FILE
 {
@@ -356720,9 +353294,9 @@ rule SIGNATURE_BASE_Mal_Dropper_Httpexe_From_CAB : FILE
 		date = "2016-05-25"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/13Wgy1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_danti_svcmondr.yar#L10-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d114a3ab348bba49a78852b87b712908bc974bf35a2b841099a232e761cad8f2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_danti_svcmondr.yar#L10-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d114a3ab348bba49a78852b87b712908bc974bf35a2b841099a232e761cad8f2"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -356734,7 +353308,7 @@ rule SIGNATURE_BASE_Mal_Dropper_Httpexe_From_CAB : FILE
 		$s2 = "http.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*)))
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( all of ( $s* ) ) )
 }
 rule SIGNATURE_BASE_Mal_Http_EXE : FILE
 {
@@ -356745,9 +353319,9 @@ rule SIGNATURE_BASE_Mal_Http_EXE : FILE
 		date = "2016-05-25"
 		modified = "2023-01-27"
 		reference = "https://goo.gl/13Wgy1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_danti_svcmondr.yar#L27-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0e28b64bbfd2b6d40f4bd82373624d22df3d5c45c22d7155747f0ff33976207d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_danti_svcmondr.yar#L27-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0e28b64bbfd2b6d40f4bd82373624d22df3d5c45c22d7155747f0ff33976207d"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -356773,7 +353347,7 @@ rule SIGNATURE_BASE_Mal_Http_EXE : FILE
 		$s8 = "\\|%s|0|0|" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) and 2 of ($s*))) or (3 of ($x*))
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) and 2 of ( $s* ) ) ) or ( 3 of ( $x* ) )
 }
 rule SIGNATURE_BASE_Mal_Potplayer_DLL : FILE
 {
@@ -356784,9 +353358,9 @@ rule SIGNATURE_BASE_Mal_Potplayer_DLL : FILE
 		date = "2016-05-25"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/13Wgy1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_danti_svcmondr.yar#L60-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1d1b68fa8de2e4ddfa71cbcd5e166181370172cc8a3167ade2da393e4f7998f1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_danti_svcmondr.yar#L60-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1d1b68fa8de2e4ddfa71cbcd5e166181370172cc8a3167ade2da393e4f7998f1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -356799,10 +353373,8 @@ rule SIGNATURE_BASE_Mal_Potplayer_DLL : FILE
 		$s4 = "\\update.dat" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and $x1 or all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and $x1 or all of ( $s* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_1_V1 : FILE
 {
 	meta:
@@ -356812,9 +353384,9 @@ rule SIGNATURE_BASE_IMPLANT_1_V1 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L12-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4df04daf70da482877874c530a3ad76fddebec2946931b60f98aa6c4e31f21ae"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L12-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4df04daf70da482877874c530a3ad76fddebec2946931b60f98aa6c4e31f21ae"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -356825,10 +353397,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V1 : FILE
          E8 ?? ?? FF FF 59}
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		( uint16( 0 ) == 0x5A4D ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_1_V2 : FILE
 {
 	meta:
@@ -356838,9 +353408,9 @@ rule SIGNATURE_BASE_IMPLANT_1_V2 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L28-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c9bdf38303fadee3e2cfc99b70942a92ab382817a28401e8c8ab8035384c97c1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L28-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c9bdf38303fadee3e2cfc99b70942a92ab382817a28401e8c8ab8035384c97c1"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -356852,10 +353422,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V2 : FILE
          80 78 19 01 75 0D FF 70 10 FF [5] 85 C0 74 E3 }
 
 	condition:
-		( uint16(0)==0x5A4D) and any of them
+		( uint16( 0 ) == 0x5A4D ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_1_V3 : FILE
 {
 	meta:
@@ -356865,9 +353433,9 @@ rule SIGNATURE_BASE_IMPLANT_1_V3 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L45-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e418620b45bc11804eae24db3cba8421758c214fc9f660a17761bbf3395ad744"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L45-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e418620b45bc11804eae24db3cba8421758c214fc9f660a17761bbf3395ad744"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -356876,10 +353444,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V3 : FILE
 		$rol7encode = { 0F B7 C9 C1 C0 07 83 C2 02 33 C1 0F B7 0A 47 66 85 C9 75 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_1_V4 : FILE
 {
 	meta:
@@ -356889,9 +353455,9 @@ rule SIGNATURE_BASE_IMPLANT_1_V4 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L60-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb8e4ed38e2e4d3991543c526c7dc458eec78c517d2c5eaa06a3a3cfb48d770f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L60-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb8e4ed38e2e4d3991543c526c7dc458eec78c517d2c5eaa06a3a3cfb48d770f"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -356901,10 +353467,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V4 : FILE
          ?? ?? 32 04 0F 46 88 01 3B 75 0C 7C E0 }
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		( uint16( 0 ) == 0x5A4D ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_1_V5 : FILE
 {
 	meta:
@@ -356914,9 +353478,9 @@ rule SIGNATURE_BASE_IMPLANT_1_V5 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L75-L91"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e9660dfe76bfe1eb17b434f2ddef4975495e952396212c41550d932dbb8e8205"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L75-L91"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e9660dfe76bfe1eb17b434f2ddef4975495e952396212c41550d932dbb8e8205"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -356928,10 +353492,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V5 : FILE
          36 7A C7 45 ?? 73 71 33 2D C7 45 ?? 75 66 68 68 66 C7 45 ?? 66 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and any of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_1_V7 : FILE
 {
 	meta:
@@ -356941,9 +353503,9 @@ rule SIGNATURE_BASE_IMPLANT_1_V7 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L112-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff8443460e1818fd63e4dcf678bb592940b32978a70ab1633ebaa61c590d3916"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L112-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff8443460e1818fd63e4dcf678bb592940b32978a70ab1633ebaa61c590d3916"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -356952,10 +353514,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V7 : FILE
 		$XOR_FUNCT = { C7 45 ?? ?? ?? 00 10 8B 0E 6A ?? FF 75 ?? E8 ?? ?? FF FF }
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		( uint16( 0 ) == 0x5A4D ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V1 : FILE
 {
 	meta:
@@ -356965,9 +353525,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V1 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L126-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6708239ea43fd36a7c9431cd2c6c185c0d406d65c4a31374c5e96bdc3e53de43"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L126-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6708239ea43fd36a7c9431cd2c6c185c0d406d65c4a31374c5e96bdc3e53de43"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -356976,10 +353536,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V1 : FILE
 		$STR1 = { 8d ?? fa [2] e8 [2] FF FF C7 [2-5] 00 00 00 00 8D [2-5] 5? 6a 00 6a 01}
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		( uint16( 0 ) == 0x5A4D ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V3 : FILE
 {
 	meta:
@@ -356989,9 +353547,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V3 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L140-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ebfedcec6f22d802a9980ad533f21e90b77fe929a813850be1b25304d3973c3b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L140-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ebfedcec6f22d802a9980ad533f21e90b77fe929a813850be1b25304d3973c3b"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357003,10 +353561,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V3 : FILE
          ?? ?? 8D ?? ?? FE }
 
 	condition:
-		( uint16(0)==0x5A4D) and any of them
+		( uint16( 0 ) == 0x5A4D ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V5 : FILE
 {
 	meta:
@@ -357016,9 +353572,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V5 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L157-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b0929b808f62e3c59c0afbe959ebf67a3a985e0a0a72bcb112c9693a98351555"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L157-L171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b0929b808f62e3c59c0afbe959ebf67a3a985e0a0a72bcb112c9693a98351555"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357029,10 +353585,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V5 : FILE
          00 00 48 8B CC E8}
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		( uint16( 0 ) == 0x5A4D ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V6 : FILE
 {
 	meta:
@@ -357042,9 +353596,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V6 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L173-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "93ce725a8af03d6f08eafe99ff3984e03a434b1f0071c6dbe560bafc3eefb576"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L173-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_93ce725a8af03d6f08eafe99ff3984e03a434b1f0071c6dbe560bafc3eefb576"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357054,10 +353608,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V6 : FILE
          ?? [1-2] 00 01 00 00 7F ?? [1-2] 80 00 00 00 7F ?? 83 ?? 40 7F}
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		( uint16( 0 ) == 0x5A4D ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V7 : FILE
 {
 	meta:
@@ -357067,9 +353619,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V7 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L188-L208"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd65443065f044a2956ae51140423dab202effff5f12dd686f6c4fd54d8a4a0b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L188-L208"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd65443065f044a2956ae51140423dab202effff5f12dd686f6c4fd54d8a4a0b"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357086,10 +353638,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V7 : FILE
          E3 B4 5E 88 B4 5? ?8 95 5? ?7 2A 05 F5 E5 B8 BE 55 DC 20 80 }
 
 	condition:
-		( uint16(0)==0x5A4D) and any of them
+		( uint16( 0 ) == 0x5A4D ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V9 : FILE
 {
 	meta:
@@ -357099,9 +353649,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V9 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L210-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5947dbb08c9d0851b7993e5ccf177f97dcb330d4b390833843f69932c921ce7a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L210-L236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5947dbb08c9d0851b7993e5ccf177f97dcb330d4b390833843f69932c921ce7a"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357123,10 +353673,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V9 : FILE
          E4 30 1C 01 8B 4D 0C }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V10 : FILE
 {
 	meta:
@@ -357136,9 +353684,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V10 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L238-L251"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "62d47c1076b05bc9a531ef6e48f17f730932826b4b0f311887e3b14c639b937d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L238-L251"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_62d47c1076b05bc9a531ef6e48f17f730932826b4b0f311887e3b14c639b937d"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357148,10 +353696,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V10 : FILE
          48 8d [3] 48 89 [3] 45 [2] 4? [1-2] 01}
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		( uint16( 0 ) == 0x5A4D ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V11 : FILE
 {
 	meta:
@@ -357161,9 +353707,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V11 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L253-L267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "72b9e4de0389df3a14f92660e91749dea4d31905eb7391163c3503bc953d661f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L253-L267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_72b9e4de0389df3a14f92660e91749dea4d31905eb7391163c3503bc953d661f"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357174,10 +353720,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V11 : FILE
          [4] 6a 01 [1-2] FF 15 [4] FF 15 [4] 3D B7 00 00 00 75 27}
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		( uint16( 0 ) == 0x5A4D ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V14 : FILE
 {
 	meta:
@@ -357187,9 +353731,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V14 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L269-L293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4abb1e1c68ced667f04a69c58c89187f9ccc0633c5dc5f396ba8d210bf405f93"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L269-L293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4abb1e1c68ced667f04a69c58c89187f9ccc0633c5dc5f396ba8d210bf405f93"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357210,10 +353754,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V14 : FILE
          C0 2B C8 8B C1 0F B6 4F FF 42 0F B6 04 ?? 41 0F AF CB C1 }
 
 	condition:
-		( uint16(0)==0x5A4D) and any of them
+		( uint16( 0 ) == 0x5A4D ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V15 : FILE
 {
 	meta:
@@ -357223,9 +353765,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V15 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L295-L310"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fac61e80803941193c41ecf8b3fcbee21b5cc41542989ecd93542c32e87da983"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L295-L310"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fac61e80803941193c41ecf8b3fcbee21b5cc41542989ecd93542c32e87da983"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357236,10 +353778,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V15 : FILE
 		$XOR_LOOP3 = { 02 C3 30 06 8B 5D F0 8D 41 FE 83 F8 06 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V16 : FILE
 {
 	meta:
@@ -357249,9 +353789,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V16 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L312-L329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "638cb66e5ff52ac5a1df0954969e7c54a3b25518228e4f8f344aafe6760985d2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L312-L329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_638cb66e5ff52ac5a1df0954969e7c54a3b25518228e4f8f344aafe6760985d2"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357264,10 +353804,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V16 : FILE
          8B 5D F0 8D 41 FE 83 F8 06 8B 45 DC 72 9A }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and $OBF_FUNCT
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and $OBF_FUNCT
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V17 : FILE
 {
 	meta:
@@ -357277,9 +353815,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V17 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L331-L347"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ea2793e6ce9e9d97e70a9452a38eb4d5ddbcc275af6ae7f5d094dc77e112d278"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L331-L347"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ea2793e6ce9e9d97e70a9452a38eb4d5ddbcc275af6ae7f5d094dc77e112d278"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357292,10 +353830,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V17 : FILE
 		$STR5 = { 006a0056ffd083f8ff74646a008d45f8 }
 
 	condition:
-		( uint16(0)==0x5A4D) and 2 of them
+		( uint16( 0 ) == 0x5A4D ) and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V18 : FILE
 {
 	meta:
@@ -357305,9 +353841,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V18 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L349-L376"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d982b3b1407e140f586772ce409e47bd29e567af41e466cd94d0983c93aab917"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L349-L376"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d982b3b1407e140f586772ce409e47bd29e567af41e466cd94d0983c93aab917"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357330,10 +353866,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V18 : FILE
          D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V19 : FILE
 {
 	meta:
@@ -357343,9 +353877,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V19 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L378-L404"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "42bee6ddf0b13774efb6712135c3e0b4eae6364120f8973272820f5f669671d1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L378-L404"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_42bee6ddf0b13774efb6712135c3e0b4eae6364120f8973272820f5f669671d1"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357367,10 +353901,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V19 : FILE
          81 3A 1D B9 A8 02 BD 3A E6 E0 FA 4D A9 07 5B E6 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and any of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_2_V20 : FILE
 {
 	meta:
@@ -357380,9 +353912,9 @@ rule SIGNATURE_BASE_IMPLANT_2_V20 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L406-L423"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "72c62a764c5c7c19a07957fd6fbfcffd689900cc2759d408d239fe08a3b76b9c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L406-L423"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_72c62a764c5c7c19a07957fd6fbfcffd689900cc2759d408d239fe08a3b76b9c"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357395,10 +353927,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V20 : FILE
          D8 89 55 F8 72 A0 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_3_V1
 {
 	meta:
@@ -357408,9 +353938,9 @@ rule SIGNATURE_BASE_IMPLANT_3_V1
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L425-L442"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4c7b6c76bc10784abf96cc71b34ffc9a9de569fd536505528752221d22b26629"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L425-L442"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4c7b6c76bc10784abf96cc71b34ffc9a9de569fd536505528752221d22b26629"
 		score = 85
 		quality = 85
 		tags = ""
@@ -357426,8 +353956,6 @@ rule SIGNATURE_BASE_IMPLANT_3_V1
 	condition:
 		any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_3_V2 : FILE
 {
 	meta:
@@ -357437,9 +353965,9 @@ rule SIGNATURE_BASE_IMPLANT_3_V2 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L444-L464"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a658888dcc7b7f4620f08449c6ec492756750e64f15b048f7cdee7de4fc0479"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L444-L464"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a658888dcc7b7f4620f08449c6ec492756750e64f15b048f7cdee7de4fc0479"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357455,10 +353983,8 @@ rule SIGNATURE_BASE_IMPLANT_3_V2 : FILE
          FF 55 8B EC 83 EC 10 A1 33 35 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and any of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_3_V3 : FILE
 {
 	meta:
@@ -357468,9 +353994,9 @@ rule SIGNATURE_BASE_IMPLANT_3_V3 : FILE
 		date = "2017-02-10"
 		modified = "2021-03-15"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L466-L485"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "313f837b90bcf09455427e4411acb5406f4dae9d69373d8d2c0cfc014e27ee96"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L466-L485"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_313f837b90bcf09455427e4411acb5406f4dae9d69373d8d2c0cfc014e27ee96"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -357482,10 +354008,8 @@ rule SIGNATURE_BASE_IMPLANT_3_V3 : FILE
 		$fp1 = "Panda Security S.L." wide
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 1 of ($STR*) and not 1 of ($fp*)
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and 1 of ( $STR* ) and not 1 of ( $fp* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V1 : FILE
 {
 	meta:
@@ -357495,9 +354019,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V1 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L487-L503"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51135d9fe62f5fd1fb7ef6c386dcdd86525dd469064662c2314cfee6e952d6ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L487-L503"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51135d9fe62f5fd1fb7ef6c386dcdd86525dd469064662c2314cfee6e952d6ec"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357510,10 +354034,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V1 : FILE
             46 00 00 00 C7 45 E8 5A 00 00 00 C7 45 E4 46 00 00 00}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 1 of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V2 : FILE
 {
 	meta:
@@ -357523,9 +354045,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V2 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L505-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd4edd238cdc3d376c1d5bcea6c8df57f4ef03369c0ca22107241812e0a1bb94"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L505-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd4edd238cdc3d376c1d5bcea6c8df57f4ef03369c0ca22107241812e0a1bb94"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357536,10 +354058,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V2 : FILE
 		$CONSTANT = {26 80 AC C8}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V3_Alternativerule : HIGHVOL FILE
 {
 	meta:
@@ -357549,9 +354069,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V3_Alternativerule : HIGHVOL FILE
 		date = "2017-02-12"
 		modified = "2023-12-05"
 		reference = "US CERT Grizzly Steppe Report"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L788-L803"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "35468f7699b96fcaaaa032eef7dae34ec314e9c652f9f8b2e8ca7343fb5cec50"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L788-L803"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_35468f7699b96fcaaaa032eef7dae34ec314e9c652f9f8b2e8ca7343fb5cec50"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -357564,10 +354084,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V3_Alternativerule : HIGHVOL FILE
 		$op2 = { 21 da 40 00 00 a0 40 00 08 a0 40 00 b0 70 40 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and all of them )
+		( uint16( 0 ) == 0x5a4d and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V4 : FILE
 {
 	meta:
@@ -357577,9 +354095,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V4 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L807-L822"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49c912f29f5ffbd90366a510285ef3f06c804af86829808c175c8be519ce01c4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L807-L822"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49c912f29f5ffbd90366a510285ef3f06c804af86829808c175c8be519ce01c4"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357591,10 +354109,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V4 : FILE
 		$DK_shutdown = "shutdown /r /t %d"
 
 	condition:
-		uint16(0)==0x5A4D and all of ($DK*)
+		uint16( 0 ) == 0x5A4D and all of ( $DK* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V5 : FILE
 {
 	meta:
@@ -357604,9 +354120,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V5 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L824-L838"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9d4233ccf148919d0ad0be726b9dfa9e26a9afcebb7b26fa4db4c3da8c46d13e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L824-L838"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9d4233ccf148919d0ad0be726b9dfa9e26a9afcebb7b26fa4db4c3da8c46d13e"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357615,10 +354131,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V5 : FILE
 		$GEN_HASH = {0F BE C9 C1 C0 07 33 C1}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V7 : FILE
 {
 	meta:
@@ -357628,9 +354142,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V7 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L859-L881"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "27ae70d384488660c1f80040503d3eb6541112fd6332edc5820bc6718d76b847"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L859-L881"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_27ae70d384488660c1f80040503d3eb6541112fd6332edc5820bc6718d76b847"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357648,7 +354162,7 @@ rule SIGNATURE_BASE_IMPLANT_4_V7 : FILE
 		$sb10 = {C7 [1-5] 69 6D 61 67 C7 [1-5] 65 68 6C 70 C7 [1-5] 2E 64 6C 6C}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 3 of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and 3 of them
 }
 import "pe"
 
@@ -357661,9 +354175,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V8
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L883-L911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd072702c59822587d7ede0bc59c5672fbaa9a05595940781554fadb32e109f7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L883-L911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd072702c59822587d7ede0bc59c5672fbaa9a05595940781554fadb32e109f7"
 		score = 85
 		quality = 85
 		tags = ""
@@ -357688,10 +354202,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V8
 		$a1 = {83 EC 04 60 E9 1E 01 00 00}
 
 	condition:
-		$a1 at pe.entry_point or any of ($f*)
+		$a1 at pe.entry_point or any of ( $f* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V9
 {
 	meta:
@@ -357701,9 +354213,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V9
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L913-L933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c0e48bf0839965f9bda9cc475aba5b4934c27c426a8fa4423fb24aa9d792e2e4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L913-L933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c0e48bf0839965f9bda9cc475aba5b4934c27c426a8fa4423fb24aa9d792e2e4"
 		score = 85
 		quality = 77
 		tags = ""
@@ -357720,10 +354232,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V9
 		$f = {83 c4 0c 53 53 6a 03 53 6a 03 68 00 00 00 c0}
 
 	condition:
-		($a and $b) or $c or $d or ($openPhysicalDiskOverwriteWithZeros and $f)
+		($a and $b ) or $c or $d or ( $openPhysicalDiskOverwriteWithZeros and $f )
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V10 : FILE
 {
 	meta:
@@ -357733,9 +354243,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V10 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L935-L966"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f22fd45eb77ff1a8202f4bd0d0c43787c8184300e96aff021e13371ae7bd5553"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L935-L966"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f22fd45eb77ff1a8202f4bd0d0c43787c8184300e96aff021e13371ae7bd5553"
 		score = 85
 		quality = 81
 		tags = "FILE"
@@ -357763,10 +354273,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V10 : FILE
 		$ = {2C819712}
 
 	condition:
-		uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550 and 15 of them
+		uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 and 15 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V11 : FILE
 {
 	meta:
@@ -357776,9 +354284,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V11 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L968-L985"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7bdeddc4334ed6557175b5eefc78d69283d6c91f98970bd0cfe6365b3ab477f4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L968-L985"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7bdeddc4334ed6557175b5eefc78d69283d6c91f98970bd0cfe6365b3ab477f4"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357791,10 +354299,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V11 : FILE
 		$tempfilename = "%ls_%ls_%ls_%d.~tmp" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 2 of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_4_V13 : FILE
 {
 	meta:
@@ -357804,9 +354310,9 @@ rule SIGNATURE_BASE_IMPLANT_4_V13 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1011-L1032"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "576c07c44105d2a38ca715d366f68058b2b3118f25e91d2d3e2d20e932fc9453"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1011-L1032"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_576c07c44105d2a38ca715d366f68058b2b3118f25e91d2d3e2d20e932fc9453"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -357823,10 +354329,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V13 : FILE
          C2 08 00 8B 4? 0? 8B 4? 0? 89 01 8B 4? 0C 03 [0-2] EB E?}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_5_V1
 {
 	meta:
@@ -357836,9 +354340,9 @@ rule SIGNATURE_BASE_IMPLANT_5_V1
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1034-L1051"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d94192d408036bf02052dc5145b78fea61323810b2abdbba64c65e1f6387ea42"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1034-L1051"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d94192d408036bf02052dc5145b78fea61323810b2abdbba64c65e1f6387ea42"
 		score = 85
 		quality = 85
 		tags = ""
@@ -357854,8 +354358,6 @@ rule SIGNATURE_BASE_IMPLANT_5_V1
 	condition:
 		any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_5_V2
 {
 	meta:
@@ -357865,9 +354367,9 @@ rule SIGNATURE_BASE_IMPLANT_5_V2
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1053-L1192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "43e3df19ecd2068636b92c7a5c0399b22f8fa478e3e1562f392e78c5a268a1e5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1053-L1192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_43e3df19ecd2068636b92c7a5c0399b22f8fa478e3e1562f392e78c5a268a1e5"
 		score = 85
 		quality = 60
 		tags = ""
@@ -358005,8 +354507,6 @@ rule SIGNATURE_BASE_IMPLANT_5_V2
 	condition:
 		any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_5_V3
 {
 	meta:
@@ -358016,9 +354516,9 @@ rule SIGNATURE_BASE_IMPLANT_5_V3
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1194-L1207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aec1314858732d30b62a033e85eea50b3375e4f5b0e1818a941979d5be672297"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1194-L1207"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aec1314858732d30b62a033e85eea50b3375e4f5b0e1818a941979d5be672297"
 		score = 85
 		quality = 85
 		tags = ""
@@ -358030,8 +354530,6 @@ rule SIGNATURE_BASE_IMPLANT_5_V3
 	condition:
 		any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_5_V4
 {
 	meta:
@@ -358041,9 +354539,9 @@ rule SIGNATURE_BASE_IMPLANT_5_V4
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1209-L1225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "98a08860453496d9629f62c64fed50a24b8378dcfa39b8b654610c2ac9084fa8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1209-L1225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_98a08860453496d9629f62c64fed50a24b8378dcfa39b8b654610c2ac9084fa8"
 		score = 85
 		quality = 85
 		tags = ""
@@ -358058,8 +354556,6 @@ rule SIGNATURE_BASE_IMPLANT_5_V4
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_6_V1 : FILE
 {
 	meta:
@@ -358069,9 +354565,9 @@ rule SIGNATURE_BASE_IMPLANT_6_V1 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1227-L1243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c60402a029034545df302485c14e9485f806f2bc7d5fd759e84d1ecba9854837"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1227-L1243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c60402a029034545df302485c14e9485f806f2bc7d5fd759e84d1ecba9854837"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358082,10 +354578,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V1 : FILE
 		$STR3 = "netui.dll" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_6_V2 : FILE
 {
 	meta:
@@ -358095,9 +354589,9 @@ rule SIGNATURE_BASE_IMPLANT_6_V2 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1245-L1258"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7e81e8bcc305b9b7166db85d81278c96edf232bf60040ef15a2376f204ca3046"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1245-L1258"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7e81e8bcc305b9b7166db85d81278c96edf232bf60040ef15a2376f204ca3046"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358106,10 +354600,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V2 : FILE
 		$obf_func = { 8B 45 F8 6A 07 03 C7 33 D2 89 45 E8 8D 47 01 5B 02 4D 0F F7 F3 6A 07 8A 04 32 33 D2 F6 E9 8A C8 8B C7 F7 F3 8A 44 3E FE 02 45 FC 02 0C 32 B2 03 F6 EA 8A D8 8D 47 FF 33 D2 5F F7 F7 02 5D 14 8B 45 E8 8B 7D F4 C0 E3 06 02 1C 32 32 CB 30 08 8B 4D 14 41 47 83 FF 09 89 4D 14 89 7D F4 72 A1 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_6_V3 : FILE
 {
 	meta:
@@ -358119,9 +354611,9 @@ rule SIGNATURE_BASE_IMPLANT_6_V3 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1260-L1275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "833a6a3a4ff8ca43d4cf8053bfd1da49df96d9833dd3fe0f3ffbf6ce6c114681"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1260-L1275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_833a6a3a4ff8ca43d4cf8053bfd1da49df96d9833dd3fe0f3ffbf6ce6c114681"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358132,10 +354624,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V3 : FILE
          1C 3A 8A 14 2E 32 C3 32 D0 41 88 14 2E 46 83 FE 0A 7C ?? }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_6_V4 : FILE
 {
 	meta:
@@ -358145,9 +354635,9 @@ rule SIGNATURE_BASE_IMPLANT_6_V4 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1277-L1291"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f5388668e148223bc94680ea84e83b0f2896ccf433523d171c8f46d7069f9a4b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1277-L1291"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f5388668e148223bc94680ea84e83b0f2896ccf433523d171c8f46d7069f9a4b"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358157,10 +354647,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V4 : FILE
          [6-10] c0 [0-1] c3}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_6_V5 : FILE
 {
 	meta:
@@ -358170,9 +354658,9 @@ rule SIGNATURE_BASE_IMPLANT_6_V5 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1293-L1327"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b3ba650818ddbc58ce272ae4851ae3151a8cf1c9cc6f8e234a50b52c95d951fe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1293-L1327"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b3ba650818ddbc58ce272ae4851ae3151a8cf1c9cc6f8e234a50b52c95d951fe"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358202,10 +354690,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V5 : FILE
          3B C8 89 4C 24 38 72 8F 5F 5E 5D 5B 83 C4 18 C2 10 00 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_6_V6 : FILE
 {
 	meta:
@@ -358215,9 +354701,9 @@ rule SIGNATURE_BASE_IMPLANT_6_V6 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1329-L1343"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "77b5f95cd897c82c200ee6fa3970824adccfd7c56639d92361095f919781d731"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1329-L1343"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_77b5f95cd897c82c200ee6fa3970824adccfd7c56639d92361095f919781d731"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358227,10 +354713,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V6 : FILE
          FF 15 ?? ?? ?? ?? 33 C0 C3}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_7_V1 : FILE
 {
 	meta:
@@ -358240,9 +354724,9 @@ rule SIGNATURE_BASE_IMPLANT_7_V1 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1368-L1381"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "996f81fe006e0ab15adab46275fdb60251e6c6616da33df600fadfc2684c24af"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1368-L1381"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_996f81fe006e0ab15adab46275fdb60251e6c6616da33df600fadfc2684c24af"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358252,10 +354736,8 @@ rule SIGNATURE_BASE_IMPLANT_7_V1 : FILE
 		$STR2 = { F3 0F 6F 04 08 66 0F EF C1 F3 0F 7F 04 11 83 C1 10 3B CF 72 EB }
 
 	condition:
-		( uint16(0)==0x5A4D) and ($STR1 or $STR2)
+		( uint16( 0 ) == 0x5A4D ) and ( $STR1 or $STR2 )
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_8_V1 : FILE
 {
 	meta:
@@ -358265,9 +354747,9 @@ rule SIGNATURE_BASE_IMPLANT_8_V1 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1383-L1411"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "437bda331405f9203747ffbfb107ec26e33973ebfc9f02e153697f7b8c22ad4f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1383-L1411"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_437bda331405f9203747ffbfb107ec26e33973ebfc9f02e153697f7b8c22ad4f"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -358286,10 +354768,8 @@ rule SIGNATURE_BASE_IMPLANT_8_V1 : FILE
 		$REF_var_9 = "&bvm=" wide
 
 	condition:
-		( uint16(0)==0x5A4D) and ($DOTNET) and ($REF_URL) and (3 of ($REF_var*))
+		( uint16( 0 ) == 0x5A4D ) and ( $DOTNET ) and ( $REF_URL ) and ( 3 of ( $REF_var* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_9_V1 : FILE
 {
 	meta:
@@ -358299,9 +354779,9 @@ rule SIGNATURE_BASE_IMPLANT_9_V1 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1431-L1447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "76704410af27060131ee4a5f46601b8badbf822d8084511145078607db715651"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1431-L1447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_76704410af27060131ee4a5f46601b8badbf822d8084511145078607db715651"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358314,10 +354794,8 @@ rule SIGNATURE_BASE_IMPLANT_9_V1 : FILE
          4C 02 04 40 3B 06 72 E3 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)) and all of them
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_IMPLANT_10_V2 : FILE
 {
 	meta:
@@ -358327,9 +354805,9 @@ rule SIGNATURE_BASE_IMPLANT_10_V2 : FILE
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1468-L1481"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dc201d25b1d6cf8f88ae3bee18057902c4d64316aa9debc9248b0d8aa7f6d170"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1468-L1481"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dc201d25b1d6cf8f88ae3bee18057902c4d64316aa9debc9248b0d8aa7f6d170"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358339,10 +354817,8 @@ rule SIGNATURE_BASE_IMPLANT_10_V2 : FILE
 		$nop = { 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00}
 
 	condition:
-		uint16(0)==0x5A4D and $xor and $nop
+		uint16( 0 ) == 0x5A4D and $xor and $nop
 }
-import "pe"
-
 rule SIGNATURE_BASE_Unidentified_Malware_Two
 {
 	meta:
@@ -358352,9 +354828,9 @@ rule SIGNATURE_BASE_Unidentified_Malware_Two
 		date = "2017-02-10"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_grizzlybear_uscert.yar#L1520-L1542"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cd9adfb9e27e4d6b27498cc029e15132343f036cca60210528720a533fe20d9a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_grizzlybear_uscert.yar#L1520-L1542"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cd9adfb9e27e4d6b27498cc029e15132343f036cca60210528720a533fe20d9a"
 		score = 85
 		quality = 85
 		tags = ""
@@ -358371,7 +354847,350 @@ rule SIGNATURE_BASE_Unidentified_Malware_Two
 		$my_string_six = "xtool.exe"
 
 	condition:
-		($my_string_one and $my_string_two) or ($my_string_three or $my_string_four) or ($my_string_five and $my_string_six)
+		($my_string_one and $my_string_two ) or ( $my_string_three or $my_string_four ) or ( $my_string_five and $my_string_six )
+}
+rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_Log_Indicators_Dec24 : SCRIPT
+{
+	meta:
+		description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
+		author = "Florian Roth"
+		id = "385042a9-fc8c-5b50-975f-3436a16e6861"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a7e6713a08d7cce00cffba8daa12b251ccc12dc8d5a5f38d568bd5054e3783a2"
+		score = 75
+		quality = 85
+		tags = "SCRIPT"
+
+	strings:
+		$x1 = "Note: Processing autorun file 'autorun\\health" ascii wide
+		$x2 = "60282967-dc91-40ef-a34c-38e992509c2c.xml" ascii wide
+		$x3 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " ascii wide
+
+	condition:
+		1 of them
+}
+rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_1 : FILE
+{
+	meta:
+		description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
+		author = "X__Junior"
+		id = "81daf184-4c38-5d84-899b-9d0de2f39934"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L18-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_481ddd570d0292036b421223ce0f839ece86cc1a97aa226a8b9fbd1d63905d1b"
+		score = 75
+		quality = 83
+		tags = "FILE"
+		hash1 = "786951478a0fc5db24f6e1d8dcc5eaa8880dbd928da97828a61f1f1f0f21e21d"
+
+	strings:
+		$sa1 = "<Thread type=\"AutoRun\" action=" ascii
+		$sa2 = "<Mark date=" ascii
+		$sa3 = "<Event>" ascii
+		$sa4 = "<Command text" ascii
+		$sb1 = "[System.Net.WebRequest]::create" ascii
+		$sb2 = "Invoke-RestMethod" ascii
+		$sb3 = "Invoke-WebRequest" ascii
+		$sb4 = "iwr " ascii
+		$sb5 = "Net.WebClient" ascii
+		$sb6 = "Resume-BitsTransfer" ascii
+		$sb7 = "Start-BitsTransfer" ascii
+		$sb8 = "wget " ascii
+		$sb9 = "WinHttp.WinHttpRequest" ascii
+		$sb10 = ".DownloadFile(" ascii
+		$sb11 = ".DownloadString(" ascii
+		$sb12 = "Bypass" nocase ascii
+		$sb13 = "-EncodedCommand" ascii
+		$sb14 = "-windowstyle hidden" ascii
+		$sb15 = " -enc " ascii
+
+	condition:
+		filesize < 1MB and all of ( $sa* ) and 1 of ( $sb* )
+}
+rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_2 : FILE
+{
+	meta:
+		description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
+		author = "X__Junior"
+		id = "d215d4a0-1726-58d4-90df-8ec6102effe1"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L54-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8debaf2c85ea63501b7a3c2ff8af7a8484f4d6097e073645d808cbd50ef1511a"
+		score = 70
+		quality = 85
+		tags = "FILE"
+
+	strings:
+		$sa1 = "<Thread type=\"AutoRun\" action=" ascii
+		$sa2 = "<Mark date=" ascii
+		$sa3 = "<Event>" ascii
+		$sa4 = "<Command text" ascii
+		$sb1 = "wscript" ascii
+		$sb2 = "cscript" ascii
+		$sb3 = "mshta" ascii
+		$sb4 = "certutil" ascii
+		$sb5 = "pwsh" ascii
+		$sb6 = "curl" ascii
+		$sb7 = "msiexec" ascii
+		$sb8 = "taskkill" ascii
+		$sb9 = "regsvr32" ascii
+		$sb10 = "rundll32" ascii
+		$sb11 = "bitsadmin" ascii
+		$sb12 = "whoami" ascii
+		$sb13 = "bcdedit" ascii
+		$sb14 = "systeminfo" ascii
+		$sb15 = "reg " ascii
+		$sb16 = "schtasks" ascii
+
+	condition:
+		filesize < 1MB and all of ( $sa* ) and 1 of ( $sb* )
+}
+rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_XML_Indicators_Dec24 : FILE
+{
+	meta:
+		description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
+		author = "Florian Roth"
+		id = "622633af-aa7a-5bf9-a59c-6590535d86a4"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L91-L109"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_21c11c3e0c0ffea89e24b9c002b6112a46b4dc7c2c4f1f5dc9803758a68efc36"
+		score = 70
+		quality = 85
+		tags = "FILE"
+
+	strings:
+		$x1 = "<Host alias=\"60282967-dc91-40ef-a34c-38e992509c2c\" application=\"\" " ascii
+		$s1 = "<Commands>SYSTEM cmd.exe /c " ascii
+		$a1 = "<Action actiontype=\"Commands\" " ascii
+
+	condition:
+		filesize < 50KB and ( 1 of ( $x* ) or 2 of them )
+}
+rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_1 : FILE
+{
+	meta:
+		description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
+		author = "X__Junior"
+		id = "b30ca09f-b84c-5de8-9bf7-9f3269f32c1f"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L112-L146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c9be15aec57fdde62815ee04daa5616940ab7949784d382a4825dce9f1e28568"
+		score = 70
+		quality = 83
+		tags = "FILE"
+		hash1 = "b103f708e85416fc6d7af9605da4b57b3abe42fb9c6c9ec0f539b4c877580bd2"
+
+	strings:
+		$sa1 = "<Action actiontype=\"Commands\"" ascii
+		$sa2 = "<?xml version=" ascii
+		$sa3 = "<Runninglocalrequired>" ascii
+		$sa4 = "<Autostartup>" ascii
+		$sb1 = "[System.Net.WebRequest]::create" ascii
+		$sb2 = "Invoke-RestMethod" ascii
+		$sb3 = "Invoke-WebRequest" ascii
+		$sb4 = "iwr " ascii
+		$sb5 = "Net.WebClient" ascii
+		$sb6 = "Resume-BitsTransfer" ascii
+		$sb7 = "Start-BitsTransfer" ascii
+		$sb8 = "wget " ascii
+		$sb9 = "WinHttp.WinHttpRequest" ascii
+		$sb10 = ".DownloadFile(" ascii
+		$sb11 = ".DownloadString(" ascii
+		$sb12 = "Bypass" nocase ascii
+		$sb13 = "-EncodedCommand" ascii
+		$sb14 = "-windowstyle hidden" ascii
+		$sb15 = " -enc " ascii
+
+	condition:
+		filesize < 10KB and all of ( $sa* ) and 1 of ( $sb* )
+}
+rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_2 : FILE
+{
+	meta:
+		description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
+		author = "X__Junior"
+		id = "a71c71f3-d36f-5c27-b150-e678bccf2dba"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L148-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_60e53c8d99fde8c48bff67408605aa69c3c1fe3040ba4f9d2080980df970aa93"
+		score = 70
+		quality = 85
+		tags = "FILE"
+
+	strings:
+		$sa1 = "<Action actiontype=\"Commands\"" ascii
+		$sa2 = "<?xml version=" ascii
+		$sa3 = "<Runninglocalrequired>" ascii
+		$sa4 = "<Autostartup>" ascii
+		$sb1 = "wscript" ascii
+		$sb2 = "cscript" ascii
+		$sb3 = "mshta" ascii
+		$sb4 = "certutil" ascii
+		$sb5 = "pwsh" ascii
+		$sb6 = "curl" ascii
+		$sb7 = "msiexec" ascii
+		$sb8 = "taskkill" ascii
+		$sb9 = "regsvr32" ascii
+		$sb10 = "rundll32" ascii
+		$sb11 = "bitsadmin" ascii
+		$sb12 = "whoami" ascii
+		$sb13 = "bcdedit" ascii
+		$sb14 = "systeminfo" ascii
+		$sb15 = "reg " ascii
+		$sb16 = "schtasks" ascii
+
+	condition:
+		filesize < 10KB and all of ( $sa* ) and 1 of ( $sb* )
+}
+rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_PS1_Indicators_Dec24 : SCRIPT
+{
+	meta:
+		description = "Detects encoded and decoded PowerShell loader used during Cleo software exploitation (as reported by Huntress in December 2024)"
+		author = "Florian Roth"
+		id = "491cda57-0ad0-5ddc-90cb-48411eef2f2e"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L185-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_87dcd0aa3c16d8948514b1d8589d38c6cc73bf7e6262f4517659cead16fedd3d"
+		score = 75
+		quality = 85
+		tags = "SCRIPT"
+
+	strings:
+		$xe1 = "Start-Process -WindowStyle Hidden -FilePath jre\\bin\\java.exe" base64 ascii wide
+		$xe2 = "$f=\"cleo." base64 ascii wide
+		$xe3 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " base64 ascii wide
+		$x1 = "$f=\"cleo." ascii wide
+		$x2 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " ascii wide
+
+	condition:
+		1 of them
+}
+rule SIGNATURE_BASE_SUSP_EXPL_JAR_Indicators_Dec24 : FILE
+{
+	meta:
+		description = "Detects characteristics of JAR files used during Cleo software exploitation (as reported by Huntress in December 2024)"
+		author = "Florian Roth"
+		id = "4e8f6aa8-9efd-5fcf-b795-5042d4ba1708"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L204-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8b87e7000ab5d9759f55660a085bf0f3dddb46ad1ea411cbbabce1000105ee9e"
+		score = 70
+		quality = 85
+		tags = "FILE"
+
+	strings:
+		$s1 = "TLS v3 " ascii
+		$s2 = "java/util/Base64$Decoder" ascii
+		$s3 = "AES/CBC/NoPadding" ascii
+		$s4 = "getenv" ascii
+		$s5 = "ava/util/zip/ZipInputStream" ascii
+
+	condition:
+		uint16( 0 ) == 0xfeca and filesize < 20KB and all of them
+}
+rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_1_1 : FILE
+{
+	meta:
+		description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - files Cli, ScSlot, Slot, SrvSlot"
+		author = "Florian Roth"
+		id = "2940ddad-3dba-594a-9111-e4741d6ff39b"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L224-L245"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_85600e9310e502b3b2135f2f3cf698ae54fe362047cdf9d378dcc107e0c2fa18"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		hash1 = "0c57b317b572d071afd8ccdb844dd6f117e20f818c6031d7ba8adcbd32be0617"
+
+	strings:
+		$a1 = "java/lang/StringBuffer"
+		$x1 = "Start-Sleep 3;del " ascii
+		$x2 = "sleep 3;rm -f '" ascii
+		$x3 = "powershell -Noninteractive -EncodedCommand " ascii
+		$x4 = "runDelFileCmd" ascii fullword
+
+	condition:
+		uint16( 0 ) == 0xfeca and filesize < 50KB and $a1 and 1 of ( $x* )
+}
+rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_2 : FILE
+{
+	meta:
+		description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - file Proc"
+		author = "Florian Roth"
+		id = "bd575454-7fd0-566d-94e5-ec1368675108"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L247-L265"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2bb5eace09b832bf3ce296484f473c9c56f97b881ea17838408be6000cc6fcb1"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		hash1 = "1ba95af21bac45db43ebf02f87ecedde802c7de4d472f33e74ee0a5b5015a726"
+
+	strings:
+		$s1 = "Timeout getting pipe-data" ascii fullword
+		$s2 = "Ftprootpath" ascii fullword
+		$s3 = "Rest cmd=" ascii fullword
+		$s4 = "writeToProc" ascii fullword
+
+	condition:
+		uint16( 0 ) == 0xfeca and filesize < 30KB and 3 of them
+}
+rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_3 : FILE
+{
+	meta:
+		description = "Detects characteristics of JAR files used during Cleo software exploitation"
+		author = "X__Junior"
+		id = "5c227bb9-0731-5955-a758-6fe86ecc2d86"
+		date = "2024-12-10"
+		modified = "2024-12-12"
+		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cleo_dec24.yar#L267-L286"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_64a6194110d4eb359cc3f15137cf752d598f2f0a52ac181fcaa358bf40072f54"
+		score = 75
+		quality = 85
+		tags = "FILE"
+
+	strings:
+		$a1 = "java/lang/String" ascii
+		$s1 = "#lsz#" ascii
+		$s2 = "#dbg#" ascii
+		$s3 = "#ll#" ascii
+		$s4 = "SvZipDataOverflow=%d OpNotConf=" ascii
+
+	condition:
+		uint16( 0 ) == 0xfeca and filesize < 20KB and 3 of ( $s* ) and $a1
 }
 rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1 : FILE
 {
@@ -358382,9 +355201,9 @@ rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1 : FILE
 		date = "2022-01-16"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_wiper_whispergate.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "72eb50a70b3f2fbb232134ef4706dbb15bdb5893fe06d899bff3b7aacdfadd30"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_wiper_whispergate.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_72eb50a70b3f2fbb232134ef4706dbb15bdb5893fe06d899bff3b7aacdfadd30"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -358399,7 +355218,7 @@ rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1 : FILE
 		$op3 = { c7 44 24 0c 00 00 00 00 c7 44 24 08 00 02 00 00 89 44 24 04 e8 aa fe ff ff 83 ec 14 89 34 24 e8 3f ff ff ff 50 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 2 of them ) or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 2 of them ) or all of them
 }
 rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2 : FILE
 {
@@ -358410,9 +355229,9 @@ rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2 : FILE
 		date = "2022-01-16"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_wiper_whispergate.yar#L25-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "87a03e95bc1c33d1b3343ec7369c516bb15791943fbb122de11867ad4bddd565"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_wiper_whispergate.yar#L25-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_87a03e95bc1c33d1b3343ec7369c516bb15791943fbb122de11867ad4bddd565"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -358435,7 +355254,7 @@ rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2 : FILE
 		$op4 = { d4 67 d4 61 80 1c 00 00 04 38 35 02 00 00 20 27 c0 db 56 65 20 3d eb 24 de 61 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 5 of them or 7 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 5 of them or 7 of them
 }
 rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22 : FILE
 {
@@ -358446,9 +355265,9 @@ rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22 : FILE
 		date = "2022-01-16"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_wiper_whispergate.yar#L59-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b06536b6a6eebd5fb398ba2617bf68a5b2c4b0035766b3cd0fc03d95019891ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_wiper_whispergate.yar#L59-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b06536b6a6eebd5fb398ba2617bf68a5b2c4b0035766b3cd0fc03d95019891ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358459,7 +355278,7 @@ rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22 : FILE
 		$s1 = "lld." wide
 
 	condition:
-		uint16( filesize -2)==0x4d5a and filesize <5000KB and all of them
+		uint16( filesize - 2 ) == 0x4d5a and filesize < 5000KB and all of them
 }
 rule SIGNATURE_BASE_MAL_OBFUSC_Unknown_Jan22_1 : FILE
 {
@@ -358470,9 +355289,9 @@ rule SIGNATURE_BASE_MAL_OBFUSC_Unknown_Jan22_1 : FILE
 		date = "2022-01-16"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_wiper_whispergate.yar#L76-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "26a295d3b78c3a33d776a648aa0f410ac7cb5021ad9d3b294ff9629d6ba7132a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_wiper_whispergate.yar#L76-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_26a295d3b78c3a33d776a648aa0f410ac7cb5021ad9d3b294ff9629d6ba7132a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358492,7 +355311,7 @@ rule SIGNATURE_BASE_MAL_OBFUSC_Unknown_Jan22_1 : FILE
 		$op3 = { 6c 05 df d6 b8 ac 11 f2 67 16 cb b7 34 4d b6 91 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_MAL_Unknown_Discord_Characteristics_Jan22_1 : FILE
 {
@@ -358503,9 +355322,9 @@ rule SIGNATURE_BASE_MAL_Unknown_Discord_Characteristics_Jan22_1 : FILE
 		date = "2022-01-16"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_wiper_whispergate.yar#L103-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f9cf4a15be0ab35a0d0f0c9b1a191f623f905c8fc9da651872de7c025a27a806"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_wiper_whispergate.yar#L103-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f9cf4a15be0ab35a0d0f0c9b1a191f623f905c8fc9da651872de7c025a27a806"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358516,7 +355335,7 @@ rule SIGNATURE_BASE_MAL_Unknown_Discord_Characteristics_Jan22_1 : FILE
 		$s2 = "https://cdn.discordapp.com/attachments/" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_Mswin_Check_Lm_Group : FILE
 {
@@ -358527,10 +355346,10 @@ rule SIGNATURE_BASE_Mswin_Check_Lm_Group : FILE
 		date = "2015-06-13"
 		modified = "2021-03-15"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L9-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L9-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
-		logic_hash = "74be6bd9c6e01cc4ec7785b6950c8cf6acf549c06990a9d1734f4a3487a04ba7"
+		logic_hash = "v1_sha256_74be6bd9c6e01cc4ec7785b6950c8cf6acf549c06990a9d1734f4a3487a04ba7"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -358542,7 +355361,7 @@ rule SIGNATURE_BASE_Mswin_Check_Lm_Group : FILE
 		$fp1 = "Panda Security S.L." ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <380KB and all of ($s*) and not 1 of ($fp*)
+		uint16( 0 ) == 0x5a4d and filesize < 380KB and all of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_WAF_Bypass : FILE
 {
@@ -358553,10 +355372,10 @@ rule SIGNATURE_BASE_WAF_Bypass : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L30-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L30-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
-		logic_hash = "e66d51b465e5d919555084d299a22f07a949a0a9adf4a3f246f6b5222d39b91a"
+		logic_hash = "v1_sha256_e66d51b465e5d919555084d299a22f07a949a0a9adf4a3f246f6b5222d39b91a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358571,7 +355390,7 @@ rule SIGNATURE_BASE_WAF_Bypass : FILE
 		$s6 = "Connect To Server Failed." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7992KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 7992KB and 5 of them
 }
 rule SIGNATURE_BASE_Guilin_Veterans_Cookie_Spoofing_Tool : FILE
 {
@@ -358582,10 +355401,10 @@ rule SIGNATURE_BASE_Guilin_Veterans_Cookie_Spoofing_Tool : FILE
 		date = "2015-06-13"
 		modified = "2023-01-27"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L50-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L50-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
-		logic_hash = "5fd136f44ebce28db4f77f2f8730eb67fc4c2d58921b73378b8d87e1444a4b67"
+		logic_hash = "v1_sha256_5fd136f44ebce28db4f77f2f8730eb67fc4c2d58921b73378b8d87e1444a4b67"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358598,7 +355417,7 @@ rule SIGNATURE_BASE_Guilin_Veterans_Cookie_Spoofing_Tool : FILE
 		$s11 = "O MYTMP(iM) VALUES (" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1387KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1387KB and all of them
 }
 rule SIGNATURE_BASE_Marathontool : FILE
 {
@@ -358609,10 +355428,10 @@ rule SIGNATURE_BASE_Marathontool : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L69-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L69-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
-		logic_hash = "2d52d640ef44d933791d1da0d1263dba15702180c730500e04d364dd6b4d6081"
+		logic_hash = "v1_sha256_2d52d640ef44d933791d1da0d1263dba15702180c730500e04d364dd6b4d6081"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358624,7 +355443,7 @@ rule SIGNATURE_BASE_Marathontool : FILE
 		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1040KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1040KB and all of them
 }
 rule SIGNATURE_BASE_PLUGIN_Trackid : FILE
 {
@@ -358635,10 +355454,10 @@ rule SIGNATURE_BASE_PLUGIN_Trackid : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L86-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L86-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
-		logic_hash = "a62112dbf2ef696e4eb7f6787a0e0930c29d9834f46c87493954498fa4b375f6"
+		logic_hash = "v1_sha256_a62112dbf2ef696e4eb7f6787a0e0930c29d9834f46c87493954498fa4b375f6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358653,7 +355472,7 @@ rule SIGNATURE_BASE_PLUGIN_Trackid : FILE
 		$s5 = "%08x -- %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them
 }
 rule SIGNATURE_BASE_Pc_Pc2015 : FILE
 {
@@ -358664,10 +355483,10 @@ rule SIGNATURE_BASE_Pc_Pc2015 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L106-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L106-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "de4f098611ac9eece91b079050b2d0b23afe0bcb"
-		logic_hash = "34d66d8b9e637c067ec2d9387b7b57458312d75892e33b95eb1095200799cf3b"
+		logic_hash = "v1_sha256_34d66d8b9e637c067ec2d9387b7b57458312d75892e33b95eb1095200799cf3b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358679,7 +355498,7 @@ rule SIGNATURE_BASE_Pc_Pc2015 : FILE
 		$s8 = "%s%08x.001" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <309KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 309KB and all of them
 }
 rule SIGNATURE_BASE_Sekurlsa : FILE
 {
@@ -358690,10 +355509,10 @@ rule SIGNATURE_BASE_Sekurlsa : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L123-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L123-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
-		logic_hash = "dea05c7f19a834cc936c452ca2f6f4286e6c3dae002747c27913960199451c3f"
+		logic_hash = "v1_sha256_dea05c7f19a834cc936c452ca2f6f4286e6c3dae002747c27913960199451c3f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358706,7 +355525,7 @@ rule SIGNATURE_BASE_Sekurlsa : FILE
 		$s4 = "Injection de donn" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1150KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1150KB and all of them
 }
 rule SIGNATURE_BASE_Mysqlfast : FILE
 {
@@ -358717,10 +355536,10 @@ rule SIGNATURE_BASE_Mysqlfast : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L141-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L141-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "32b60350390fe7024af7b4b8fbf50f13306c546f"
-		logic_hash = "3ea75954831e705d0d25efa115288e66868d9b814f0990fd048bbe1209a8d933"
+		logic_hash = "v1_sha256_3ea75954831e705d0d25efa115288e66868d9b814f0990fd048bbe1209a8d933"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358735,7 +355554,7 @@ rule SIGNATURE_BASE_Mysqlfast : FILE
 		$s7 = "Pass not found" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and 4 of them
 }
 rule SIGNATURE_BASE_Dtools2_02_Dtools : FILE
 {
@@ -358746,10 +355565,10 @@ rule SIGNATURE_BASE_Dtools2_02_Dtools : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L161-L179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L161-L179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
-		logic_hash = "51e30d39f388546ac233b4b97a38f225c90d2f006bc509dd7eecfb408aef9be5"
+		logic_hash = "v1_sha256_51e30d39f388546ac233b4b97a38f225c90d2f006bc509dd7eecfb408aef9be5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358764,7 +355583,7 @@ rule SIGNATURE_BASE_Dtools2_02_Dtools : FILE
 		$s5 = "DefaultPHotLigh" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE_Dll_Packetx : FILE
 {
@@ -358775,10 +355594,10 @@ rule SIGNATURE_BASE_Dll_Packetx : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L181-L196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L181-L196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3f0908e0a38512d2a4fb05a824aa0f6cf3ba3b71"
-		logic_hash = "161d174376c599b1b794fa1174349ae12b198842d89769baec4b9664729a3983"
+		logic_hash = "v1_sha256_161d174376c599b1b794fa1174349ae12b198842d89769baec4b9664729a3983"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -358789,7 +355608,7 @@ rule SIGNATURE_BASE_Dll_Packetx : FILE
 		$s10 = "PacketX Version" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1920KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1920KB and all of them
 }
 rule SIGNATURE_BASE_Sqldbx_Zhs : FILE
 {
@@ -358800,10 +355619,10 @@ rule SIGNATURE_BASE_Sqldbx_Zhs : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L198-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L198-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e34228345498a48d7f529dbdffcd919da2dea414"
-		logic_hash = "b0215d29c58c252c1717f08135eab65794a99ed669c2225bcba690ae7d7a034c"
+		logic_hash = "v1_sha256_b0215d29c58c252c1717f08135eab65794a99ed669c2225bcba690ae7d7a034c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358819,7 +355638,7 @@ rule SIGNATURE_BASE_Sqldbx_Zhs : FILE
 		$s15 = "S.last_login_time \"Last Login\", " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16( 0 ) == 0x5a4d and 4 of them
 }
 rule SIGNATURE_BASE_Ms10048_X86 : FILE
 {
@@ -358830,10 +355649,10 @@ rule SIGNATURE_BASE_Ms10048_X86 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L219-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L219-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
-		logic_hash = "50e45cae87f5d1cc4903a16f9283dd751d90cde0c71f3124467b4ff15bd34f1b"
+		logic_hash = "v1_sha256_50e45cae87f5d1cc4903a16f9283dd751d90cde0c71f3124467b4ff15bd34f1b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358848,7 +355667,7 @@ rule SIGNATURE_BASE_Ms10048_X86 : FILE
 		$s6 = "[+] Set to %d exploit half succeeded" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of them
 }
 rule SIGNATURE_BASE_Dos_Ch : FILE
 {
@@ -358859,10 +355678,10 @@ rule SIGNATURE_BASE_Dos_Ch : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L239-L257"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L239-L257"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "60bbb87b08af840f21536b313a76646e7c1f0ea7"
-		logic_hash = "49ab2c75267c2ed5c15c8fbdc6fa0f8826f6e7a45a2861d6ba4b293ffca6bcd6"
+		logic_hash = "v1_sha256_49ab2c75267c2ed5c15c8fbdc6fa0f8826f6e7a45a2861d6ba4b293ffca6bcd6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358877,7 +355696,7 @@ rule SIGNATURE_BASE_Dos_Ch : FILE
 		$s17 = "WinSta0\\Default" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <260KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 260KB and 3 of them
 }
 rule SIGNATURE_BASE_Dubrute_Dubrute : FILE
 {
@@ -358888,10 +355707,10 @@ rule SIGNATURE_BASE_Dubrute_Dubrute : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L259-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L259-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8aaae91791bf782c92b97c6e1b0f78fb2a9f3e65"
-		logic_hash = "1e6d8bd24a37e3f4b7de88989251ae904128ff1bf766d4a4408ff8990c6dfd2f"
+		logic_hash = "v1_sha256_1e6d8bd24a37e3f4b7de88989251ae904128ff1bf766d4a4408ff8990c6dfd2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358904,7 +355723,7 @@ rule SIGNATURE_BASE_Dubrute_Dubrute : FILE
 		$s4 = "UBrute.com" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1020KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1020KB and all of them
 }
 rule SIGNATURE_BASE_Cookietools : FILE
 {
@@ -358915,10 +355734,10 @@ rule SIGNATURE_BASE_Cookietools : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L277-L294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L277-L294"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b6a3727fe3d214f4fb03aa43fb2bc6fadc42c8be"
-		logic_hash = "7f8c59ef58a92db15d8965e54ed6e26834e268581581af2a0ff98a6f46564e7e"
+		logic_hash = "v1_sha256_7f8c59ef58a92db15d8965e54ed6e26834e268581581af2a0ff98a6f46564e7e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358932,7 +355751,7 @@ rule SIGNATURE_BASE_Cookietools : FILE
 		$s12 = "http://www.chinesehack.org/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 4 of them
 }
 rule SIGNATURE_BASE_Update_Pcinit : FILE
 {
@@ -358943,10 +355762,10 @@ rule SIGNATURE_BASE_Update_Pcinit : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L296-L314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L296-L314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a6facc4453f8cd81b8c18b3b3004fa4d8e2f5344"
-		logic_hash = "ee4b17dfb0d70464669edab1b7610efa607adb2918306ae6c50130024008a169"
+		logic_hash = "v1_sha256_ee4b17dfb0d70464669edab1b7610efa607adb2918306ae6c50130024008a169"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358961,7 +355780,7 @@ rule SIGNATURE_BASE_Update_Pcinit : FILE
 		$s6 = "StrToIntA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_Dat_Nasllib : FILE
 {
@@ -358972,10 +355791,10 @@ rule SIGNATURE_BASE_Dat_Nasllib : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L316-L331"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L316-L331"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fb0d4263118faaeed2d68e12fab24c59953e862d"
-		logic_hash = "7d2f3c67fe78028a51ba01c88d7eb62c38fe3c918bb03eee41b6583bc464ad78"
+		logic_hash = "v1_sha256_7d2f3c67fe78028a51ba01c88d7eb62c38fe3c918bb03eee41b6583bc464ad78"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -358987,7 +355806,7 @@ rule SIGNATURE_BASE_Dat_Nasllib : FILE
 		$s3 = "A FsSniffer backdoor seems to be running on this port%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1360KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1360KB and all of them
 }
 rule SIGNATURE_BASE_Dos_1 : FILE
 {
@@ -358998,10 +355817,10 @@ rule SIGNATURE_BASE_Dos_1 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L333-L347"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L333-L347"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b554f0687a12ec3a137f321cc15e052ff219f28c"
-		logic_hash = "d4cf3e738743e5402602e045cf590b969dca2d6f7f1bdd57cc398df3392560d9"
+		logic_hash = "v1_sha256_d4cf3e738743e5402602e045cf590b969dca2d6f7f1bdd57cc398df3392560d9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359012,7 +355831,7 @@ rule SIGNATURE_BASE_Dos_1 : FILE
 		$s2 = "/churrasco/-->Done, command should have ran as SYSTEM!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_Othertools_Servu : FILE
 {
@@ -359023,10 +355842,10 @@ rule SIGNATURE_BASE_Othertools_Servu : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L349-L365"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L349-L365"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5c64e6879a9746a0d65226706e0edc7a"
-		logic_hash = "fda476bdcc0bb496331ca9f506a1221d401d8671d23f61f1b88219c688163169"
+		logic_hash = "v1_sha256_fda476bdcc0bb496331ca9f506a1221d401d8671d23f61f1b88219c688163169"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359039,7 +355858,7 @@ rule SIGNATURE_BASE_Othertools_Servu : FILE
 		$s3 = "WriteFile" fullword ascii
 
 	condition:
-		uint32(0)==0x454b5a4d and $s0 at 0 and filesize <50KB and all of them
+		uint32( 0 ) == 0x454b5a4d and $s0 at 0 and filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_Ustrrefadd : FILE
 {
@@ -359050,10 +355869,10 @@ rule SIGNATURE_BASE_Ustrrefadd : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L367-L384"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L367-L384"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b371b122460951e74094f3db3016264c9c8a0cfa"
-		logic_hash = "e44f180e081494e28b35b4129eb2c1817ed3e83f23d86f0d3dd4dcf27941cdf1"
+		logic_hash = "v1_sha256_e44f180e081494e28b35b4129eb2c1817ed3e83f23d86f0d3dd4dcf27941cdf1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359067,7 +355886,7 @@ rule SIGNATURE_BASE_Ustrrefadd : FILE
 		$s5 = "Ultra String Reference plugin v%d.%02d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <320KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 320KB and all of them
 }
 rule SIGNATURE_BASE_Xscanlib : FILE
 {
@@ -359078,10 +355897,10 @@ rule SIGNATURE_BASE_Xscanlib : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L386-L402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L386-L402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
-		logic_hash = "ff18c527df9ff2a4d72bcc5e4905d6f42877d42536edcb13608c6e0e6773aa63"
+		logic_hash = "v1_sha256_ff18c527df9ff2a4d72bcc5e4905d6f42877d42536edcb13608c6e0e6773aa63"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359094,7 +355913,7 @@ rule SIGNATURE_BASE_Xscanlib : FILE
 		$s9 = "PlugCheckTcpPort" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <360KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 360KB and all of them
 }
 rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool : FILE
 {
@@ -359105,10 +355924,10 @@ rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L404-L419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L404-L419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ebab6e4cb7ea82c8dc1fe4154e040e241f4672c6"
-		logic_hash = "9e14db3721afaba3ea5e9767afff593bf2b137306fe673acd7926bf6efc78391"
+		logic_hash = "v1_sha256_9e14db3721afaba3ea5e9767afff593bf2b137306fe673acd7926bf6efc78391"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359120,7 +355939,7 @@ rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool : FILE
 		$s6 = "\\\\.\\slIdtTool" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 25KB and all of them
 }
 rule SIGNATURE_BASE_Goodtoolset_Ms11046 : FILE
 {
@@ -359131,10 +355950,10 @@ rule SIGNATURE_BASE_Goodtoolset_Ms11046 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L421-L438"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L421-L438"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
-		logic_hash = "2fb36a589613f97d0c3a4da58c65352689062a8ba6d432b5f3cf3b51a7e77f8c"
+		logic_hash = "v1_sha256_2fb36a589613f97d0c3a4da58c65352689062a8ba6d432b5f3cf3b51a7e77f8c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359148,7 +355967,7 @@ rule SIGNATURE_BASE_Goodtoolset_Ms11046 : FILE
 		$s5 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <840KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 840KB and 2 of them
 }
 rule SIGNATURE_BASE_Cmdshell32 : FILE
 {
@@ -359159,10 +355978,10 @@ rule SIGNATURE_BASE_Cmdshell32 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L440-L455"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L440-L455"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3c41116d20e06dcb179e7346901c1c11cd81c596"
-		logic_hash = "cfe3d72d33d7a3c2b70d4fa0767a921c1cfcd360b2094af40b067789cace95af"
+		logic_hash = "v1_sha256_cfe3d72d33d7a3c2b70d4fa0767a921c1cfcd360b2094af40b067789cace95af"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359174,7 +355993,7 @@ rule SIGNATURE_BASE_Cmdshell32 : FILE
 		$s3 = "[Root@CmdShell ~]#" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <62KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 62KB and all of them
 }
 rule SIGNATURE_BASE_Sniffer_Analyzer_Ssclone_1210_Full_Version : FILE
 {
@@ -359185,10 +356004,10 @@ rule SIGNATURE_BASE_Sniffer_Analyzer_Ssclone_1210_Full_Version : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L457-L473"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L457-L473"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
-		logic_hash = "982a213a106794e2cddb6148b3d3a119ae17fc318ad03237da1018e1859523d7"
+		logic_hash = "v1_sha256_982a213a106794e2cddb6148b3d3a119ae17fc318ad03237da1018e1859523d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359201,7 +356020,7 @@ rule SIGNATURE_BASE_Sniffer_Analyzer_Ssclone_1210_Full_Version : FILE
 		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3580KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3580KB and all of them
 }
 rule SIGNATURE_BASE_X64_Klock : FILE
 {
@@ -359212,10 +356031,10 @@ rule SIGNATURE_BASE_X64_Klock : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L475-L491"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L475-L491"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
-		logic_hash = "3fe00c08607d20daa055db2f551009ff1c447f1a651d4a78aba91621d53424f5"
+		logic_hash = "v1_sha256_3fe00c08607d20daa055db2f551009ff1c447f1a651d4a78aba91621d53424f5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359228,7 +356047,7 @@ rule SIGNATURE_BASE_X64_Klock : FILE
 		$s4 = "klock de mimikatz pour Windows" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <907KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 907KB and all of them
 }
 rule SIGNATURE_BASE_Dos_Down32 : FILE
 {
@@ -359239,10 +356058,10 @@ rule SIGNATURE_BASE_Dos_Down32 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L493-L508"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L493-L508"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
-		logic_hash = "c1aaaaaaae2ea720d3fc1516d88d678895bcda81344e8c1f4f57e5a20e770123"
+		logic_hash = "v1_sha256_c1aaaaaaae2ea720d3fc1516d88d678895bcda81344e8c1f4f57e5a20e770123"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359254,7 +356073,7 @@ rule SIGNATURE_BASE_Dos_Down32 : FILE
 		$s15 = "get_Form1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <137KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 137KB and all of them
 }
 rule SIGNATURE_BASE_Marathontool_2 : FILE
 {
@@ -359265,10 +356084,10 @@ rule SIGNATURE_BASE_Marathontool_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L510-L525"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L510-L525"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
-		logic_hash = "7581b63a7bddeac93c65b2943b9f5f568464d8f300bc7385ca73880996bd390b"
+		logic_hash = "v1_sha256_7581b63a7bddeac93c65b2943b9f5f568464d8f300bc7385ca73880996bd390b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359280,7 +356099,7 @@ rule SIGNATURE_BASE_Marathontool_2 : FILE
 		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_Scanms_Scanms : FILE
 {
@@ -359291,10 +356110,10 @@ rule SIGNATURE_BASE_Scanms_Scanms : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L527-L544"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L527-L544"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
-		logic_hash = "d6b33e603953194dab67104cbb9649710515050cf73afb18b2c9083a9e228e6d"
+		logic_hash = "v1_sha256_d6b33e603953194dab67104cbb9649710515050cf73afb18b2c9083a9e228e6d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359308,7 +356127,7 @@ rule SIGNATURE_BASE_Scanms_Scanms : FILE
 		$s5 = "Internet Explorer 1.0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them
 }
 rule SIGNATURE_BASE_CN_Tools_Pcshare : FILE
 {
@@ -359319,10 +356138,10 @@ rule SIGNATURE_BASE_CN_Tools_Pcshare : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L546-L565"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L546-L565"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
-		logic_hash = "57bd1629abe0af1345f505514b99deb4e63ebce7363f3b0abcb76e7201d9b7b7"
+		logic_hash = "v1_sha256_57bd1629abe0af1345f505514b99deb4e63ebce7363f3b0abcb76e7201d9b7b7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359338,7 +356157,7 @@ rule SIGNATURE_BASE_CN_Tools_Pcshare : FILE
 		$s18 = "http://www.pcshare.cn" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 6000KB and 3 of them
 }
 rule SIGNATURE_BASE_Pw_Inspector : FILE
 {
@@ -359349,10 +356168,10 @@ rule SIGNATURE_BASE_Pw_Inspector : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L567-L582"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L567-L582"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4f8e3e101098fc3da65ed06117b3cb73c0a66215"
-		logic_hash = "3b54466d80692923b93689a9e43e30dfbc63e5982cb633120795817098d68e05"
+		logic_hash = "v1_sha256_3b54466d80692923b93689a9e43e30dfbc63e5982cb633120795817098d68e05"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359364,7 +356183,7 @@ rule SIGNATURE_BASE_Pw_Inspector : FILE
 		$s3 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <460KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 460KB and all of them
 }
 rule SIGNATURE_BASE_Dll_Loadex : FILE
 {
@@ -359375,10 +356194,10 @@ rule SIGNATURE_BASE_Dll_Loadex : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L584-L603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L584-L603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "213d9d0afb22fe723ff570cf69ff8cdb33ada150"
-		logic_hash = "588f4f4d0a2f8f8e76de0a5b1217191c1cace69f934582d4fc3c974fb94b8c3e"
+		logic_hash = "v1_sha256_588f4f4d0a2f8f8e76de0a5b1217191c1cace69f934582d4fc3c974fb94b8c3e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359394,7 +356213,7 @@ rule SIGNATURE_BASE_Dll_Loadex : FILE
 		$s20 = " Dll_LoadEx(&A)..." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <120KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 120KB and 3 of them
 }
 rule SIGNATURE_BASE_Dat_Report : FILE
 {
@@ -359405,10 +356224,10 @@ rule SIGNATURE_BASE_Dat_Report : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L605-L619"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L605-L619"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
-		logic_hash = "e3b21f37fae388958758af535727844d6e9696862fd9968340e1a619592c53b6"
+		logic_hash = "v1_sha256_e3b21f37fae388958758af535727844d6e9696862fd9968340e1a619592c53b6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359419,7 +356238,7 @@ rule SIGNATURE_BASE_Dat_Report : FILE
 		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <480KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 480KB and all of them
 }
 rule SIGNATURE_BASE_Dos_Iis7 : FILE
 {
@@ -359430,10 +356249,10 @@ rule SIGNATURE_BASE_Dos_Iis7 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L621-L638"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L621-L638"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
-		logic_hash = "e0cbcb63cd2a542e6394792070392d393b2a3485f5a5ef3c6ba0f113ae9270ec"
+		logic_hash = "v1_sha256_e0cbcb63cd2a542e6394792070392d393b2a3485f5a5ef3c6ba0f113ae9270ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359447,7 +356266,7 @@ rule SIGNATURE_BASE_Dos_Iis7 : FILE
 		$s13 = "WinSta0\\Default" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <140KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 140KB and all of them
 }
 rule SIGNATURE_BASE_Switchsniffer : FILE
 {
@@ -359458,10 +356277,10 @@ rule SIGNATURE_BASE_Switchsniffer : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L640-L654"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L640-L654"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1e7507162154f67dff4417f1f5d18b4ade5cf0cd"
-		logic_hash = "4c75473399a7d47b63c6247248fd2792c675740ac671028b1c0a8ba1a02f35aa"
+		logic_hash = "v1_sha256_4c75473399a7d47b63c6247248fd2792c675740ac671028b1c0a8ba1a02f35aa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359472,7 +356291,7 @@ rule SIGNATURE_BASE_Switchsniffer : FILE
 		$s2 = "SwitchSniffer Setup" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_Dbexpora : FILE
 {
@@ -359483,10 +356302,10 @@ rule SIGNATURE_BASE_Dbexpora : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L656-L671"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L656-L671"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b55b007ef091b2f33f7042814614564625a8c79f"
-		logic_hash = "2dad6cedae6a3a446c2c4829516bffa5608ea4d1c13c907796cf4d13ec37965e"
+		logic_hash = "v1_sha256_2dad6cedae6a3a446c2c4829516bffa5608ea4d1c13c907796cf4d13ec37965e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359498,7 +356317,7 @@ rule SIGNATURE_BASE_Dbexpora : FILE
 		$s13 = "ORACommand *" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <835KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 835KB and all of them
 }
 rule SIGNATURE_BASE_Sqlcracker : FILE
 {
@@ -359509,10 +356328,10 @@ rule SIGNATURE_BASE_Sqlcracker : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L673-L690"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L673-L690"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1aa5755da1a9b050c4c49fc5c58fa133b8380410"
-		logic_hash = "3724f4b746da413f99880564ae72bc0de867120f1f7eacaf856d42492ebe359e"
+		logic_hash = "v1_sha256_3724f4b746da413f99880564ae72bc0de867120f1f7eacaf856d42492ebe359e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359526,7 +356345,7 @@ rule SIGNATURE_BASE_Sqlcracker : FILE
 		$s4 = "080404B0" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <125KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 125KB and all of them
 }
 rule SIGNATURE_BASE_Freeversion_Debug : FILE
 {
@@ -359537,10 +356356,10 @@ rule SIGNATURE_BASE_Freeversion_Debug : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L692-L711"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L692-L711"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
-		logic_hash = "f7f8302c70c5aed1885724a1bca4efdf0547cc5be62e7dd6bcd8cc2079f71f96"
+		logic_hash = "v1_sha256_f7f8302c70c5aed1885724a1bca4efdf0547cc5be62e7dd6bcd8cc2079f71f96"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359556,7 +356375,7 @@ rule SIGNATURE_BASE_Freeversion_Debug : FILE
 		$s12 = "SELECT * FROM IIsWebInfo" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <820KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 820KB and 3 of them
 }
 rule SIGNATURE_BASE_Dos_Look : FILE
 {
@@ -359567,10 +356386,10 @@ rule SIGNATURE_BASE_Dos_Look : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L713-L728"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L713-L728"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
-		logic_hash = "341c72eaa5db1953e008423374c3f322de0f8dc33fd8181362172982b52e2b8a"
+		logic_hash = "v1_sha256_341c72eaa5db1953e008423374c3f322de0f8dc33fd8181362172982b52e2b8a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359582,7 +356401,7 @@ rule SIGNATURE_BASE_Dos_Look : FILE
 		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them
 }
 rule SIGNATURE_BASE_Ntgodmode : FILE
 {
@@ -359593,10 +356412,10 @@ rule SIGNATURE_BASE_Ntgodmode : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L730-L747"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L730-L747"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
-		logic_hash = "55efa908ebfcede207d3fe0b1072cce262af0e627e91ba8746e7a8924b8e75bd"
+		logic_hash = "v1_sha256_55efa908ebfcede207d3fe0b1072cce262af0e627e91ba8746e7a8924b8e75bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359610,7 +356429,7 @@ rule SIGNATURE_BASE_Ntgodmode : FILE
 		$s19 = "RtlUnw" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <45KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 45KB and all of them
 }
 rule SIGNATURE_BASE_Webcrack4_Routerpasswordcracking : FILE
 {
@@ -359621,10 +356440,10 @@ rule SIGNATURE_BASE_Webcrack4_Routerpasswordcracking : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L749-L766"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L749-L766"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
-		logic_hash = "48456f82163806852ecef3d71c2c8247f6c74c31ce28472c80a914a98247bdb3"
+		logic_hash = "v1_sha256_48456f82163806852ecef3d71c2c8247f6c74c31ce28472c80a914a98247bdb3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359638,7 +356457,7 @@ rule SIGNATURE_BASE_Webcrack4_Routerpasswordcracking : FILE
 		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 2 of them
 }
 rule SIGNATURE_BASE_Hscan_Gui : FILE
 {
@@ -359649,10 +356468,10 @@ rule SIGNATURE_BASE_Hscan_Gui : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L768-L783"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L768-L783"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1885f0b7be87f51c304b39bc04b9423539825c69"
-		logic_hash = "c87cfe78324638ac9d35c7fd1e47f24014c470b0892ceceaf394278d9706157b"
+		logic_hash = "v1_sha256_c87cfe78324638ac9d35c7fd1e47f24014c470b0892ceceaf394278d9706157b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359664,7 +356483,7 @@ rule SIGNATURE_BASE_Hscan_Gui : FILE
 		$s3 = "Hscan Application " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 550KB and all of them
 }
 rule SIGNATURE_BASE_S_Multifunction_Scanners_S : FILE
 {
@@ -359675,10 +356494,10 @@ rule SIGNATURE_BASE_S_Multifunction_Scanners_S : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L785-L809"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L785-L809"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "79b60ffa1c0f73b3c47e72118e0f600fcd86b355"
-		logic_hash = "96f0692c54d74388f8602a03475d95a2fcd89692dd189f9363592745a70c234b"
+		logic_hash = "v1_sha256_96f0692c54d74388f8602a03475d95a2fcd89692dd189f9363592745a70c234b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359699,7 +356518,7 @@ rule SIGNATURE_BASE_S_Multifunction_Scanners_S : FILE
 		$s14 = "NOTEPAD.EXE result.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 4 of them
 }
 rule SIGNATURE_BASE_HKTL_CN_Dos_Getpass : FILE
 {
@@ -359711,10 +356530,10 @@ rule SIGNATURE_BASE_HKTL_CN_Dos_Getpass : FILE
 		modified = "2023-01-06"
 		old_rule_name = "Dos_GetPass"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L811-L830"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L811-L830"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
-		logic_hash = "ea1410984fb1f66422faa943f1f16873f4e0d5ff1afa68c2d28f36889e214a52"
+		logic_hash = "v1_sha256_ea1410984fb1f66422faa943f1f16873f4e0d5ff1afa68c2d28f36889e214a52"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359728,7 +356547,7 @@ rule SIGNATURE_BASE_HKTL_CN_Dos_Getpass : FILE
 		$s19 = "sedebugnameValue" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <890KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 890KB and all of them
 }
 rule SIGNATURE_BASE_HKTL_CN_Update_Pcmain : FILE
 {
@@ -359740,10 +356559,10 @@ rule SIGNATURE_BASE_HKTL_CN_Update_Pcmain : FILE
 		modified = "2023-01-06"
 		old_rule_name = "update_PcMain"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L832-L858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L832-L858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aa68323aaec0269b0f7e697e69cce4d00a949caa"
-		logic_hash = "aa905379f65a8d964b921f2b74b61d94f97536466a7fc48f05c437d617cf35f6"
+		logic_hash = "v1_sha256_aa905379f65a8d964b921f2b74b61d94f97536466a7fc48f05c437d617cf35f6"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -359763,7 +356582,7 @@ rule SIGNATURE_BASE_HKTL_CN_Update_Pcmain : FILE
 		$s20 = "qy001id=%d;qy001guid=%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and 4 of them
 }
 rule SIGNATURE_BASE_HKTL_CN_Dos_Sys : FILE
 {
@@ -359775,10 +356594,10 @@ rule SIGNATURE_BASE_HKTL_CN_Dos_Sys : FILE
 		modified = "2023-01-06"
 		old_rule_name = "Dos_sys"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L860-L878"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L860-L878"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b5837047443f8bc62284a0045982aaae8bab6f18"
-		logic_hash = "3b3f55c45ebfe4ab6d8e6b06a3c452c84d4f755f984d913c683a49a8fd570d9d"
+		logic_hash = "v1_sha256_3b3f55c45ebfe4ab6d8e6b06a3c452c84d4f755f984d913c683a49a8fd570d9d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359791,7 +356610,7 @@ rule SIGNATURE_BASE_HKTL_CN_Dos_Sys : FILE
 		$s14 = "DAMAGE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
 }
 rule SIGNATURE_BASE_HKTL_CN_Dat_Xpf : FILE
 {
@@ -359803,10 +356622,10 @@ rule SIGNATURE_BASE_HKTL_CN_Dat_Xpf : FILE
 		modified = "2023-01-06"
 		old_rule_name = "dat_xpf"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L880-L897"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L880-L897"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "761125ab594f8dc996da4ce8ce50deba49c81846"
-		logic_hash = "c46b10ef17a9fee2be15fc9cc8b8aeec94d656b86e7208e1ad1f5efcd95fddf5"
+		logic_hash = "v1_sha256_c46b10ef17a9fee2be15fc9cc8b8aeec94d656b86e7208e1ad1f5efcd95fddf5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359818,7 +356637,7 @@ rule SIGNATURE_BASE_HKTL_CN_Dat_Xpf : FILE
 		$s3 = "\\DosDevices\\XScanPF" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 25KB and all of them
 }
 rule SIGNATURE_BASE_HKTL_CN_Project1 : FILE
 {
@@ -359830,10 +356649,10 @@ rule SIGNATURE_BASE_HKTL_CN_Project1 : FILE
 		modified = "2023-01-06"
 		old_rule_name = "Project1"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L899-L916"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L899-L916"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
-		logic_hash = "c26590f13a185eb42a27d27e6b5996f7fdf4d5c146fb74062686f356ec4db47d"
+		logic_hash = "v1_sha256_c26590f13a185eb42a27d27e6b5996f7fdf4d5c146fb74062686f356ec4db47d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359845,7 +356664,7 @@ rule SIGNATURE_BASE_HKTL_CN_Project1 : FILE
 		$s3 = "LoginPrompt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them
 }
 rule SIGNATURE_BASE_Arp_EMP_V1_0 : FILE
 {
@@ -359856,10 +356675,10 @@ rule SIGNATURE_BASE_Arp_EMP_V1_0 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L918-L931"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L918-L931"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
-		logic_hash = "e46b0f730945dad3c75b6865f30005f4d5fa09c53e3a27c275ca22da9cc89e8d"
+		logic_hash = "v1_sha256_e46b0f730945dad3c75b6865f30005f4d5fa09c53e3a27c275ca22da9cc89e8d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359869,7 +356688,7 @@ rule SIGNATURE_BASE_Arp_EMP_V1_0 : FILE
 		$s0 = "Arp EMP v1.0.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
 }
 rule SIGNATURE_BASE_CN_Tools_Myupnp : FILE
 {
@@ -359880,10 +356699,10 @@ rule SIGNATURE_BASE_CN_Tools_Myupnp : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L933-L948"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L933-L948"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "15b6fca7e42cd2800ba82c739552e7ffee967000"
-		logic_hash = "0bdd0d98dc5218bbe799e5e510c5f27d74a1ef398b09962f4267f846088f726e"
+		logic_hash = "v1_sha256_0bdd0d98dc5218bbe799e5e510c5f27d74a1ef398b09962f4267f846088f726e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359895,7 +356714,7 @@ rule SIGNATURE_BASE_CN_Tools_Myupnp : FILE
 		$s3 = "LOADER ERROR" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1500KB and all of them
 }
 rule SIGNATURE_BASE_CN_Tools_Shiell : FILE
 {
@@ -359906,10 +356725,10 @@ rule SIGNATURE_BASE_CN_Tools_Shiell : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L950-L966"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L950-L966"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b432d80c37abe354d344b949c8730929d8f9817a"
-		logic_hash = "44c494c24c090b21c3c201d57f910e8f4d5132a863715a090fa1e18c9d349d48"
+		logic_hash = "v1_sha256_44c494c24c090b21c3c201d57f910e8f4d5132a863715a090fa1e18c9d349d48"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359922,7 +356741,7 @@ rule SIGNATURE_BASE_CN_Tools_Shiell : FILE
 		$s4 = "\" /v debugger /t REG_SZ /d \"" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1500KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1500KB and 2 of them
 }
 rule SIGNATURE_BASE_Cndcom_Cndcom : FILE
 {
@@ -359933,10 +356752,10 @@ rule SIGNATURE_BASE_Cndcom_Cndcom : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L968-L988"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L968-L988"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "08bbe6312342b28b43201125bd8c518531de8082"
-		logic_hash = "226be7ea7b09b2b87eeec006c8054b9fb59eb8324def14a4a0db97f94fb39d62"
+		logic_hash = "v1_sha256_226be7ea7b09b2b87eeec006c8054b9fb59eb8324def14a4a0db97f94fb39d62"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359953,7 +356772,7 @@ rule SIGNATURE_BASE_Cndcom_Cndcom : FILE
 		$s8 = "shell3all.c" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
 }
 rule SIGNATURE_BASE_Isdebug_V1_4 : FILE
 {
@@ -359964,10 +356783,10 @@ rule SIGNATURE_BASE_Isdebug_V1_4 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L990-L1010"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L990-L1010"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ca32474c358b4402421ece1cb31714fbb088b69a"
-		logic_hash = "d656327c33533b5ef7dc70ec00250ee35d878794fae189829a0ecad958f96616"
+		logic_hash = "v1_sha256_d656327c33533b5ef7dc70ec00250ee35d878794fae189829a0ecad958f96616"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -359984,7 +356803,7 @@ rule SIGNATURE_BASE_Isdebug_V1_4 : FILE
 		$s12 = "MASM32 version" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them
 }
 rule SIGNATURE_BASE_HTTPSCANNER : FILE
 {
@@ -359995,10 +356814,10 @@ rule SIGNATURE_BASE_HTTPSCANNER : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1012-L1026"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1012-L1026"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ae2929346944c1ea3411a4562e9d5e2f765d088a"
-		logic_hash = "0f1460101198d8b139b7cc0674bef2fc7b3d2a24249f521396b7bbe4318a83d5"
+		logic_hash = "v1_sha256_0f1460101198d8b139b7cc0674bef2fc7b3d2a24249f521396b7bbe4318a83d5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360009,7 +356828,7 @@ rule SIGNATURE_BASE_HTTPSCANNER : FILE
 		$s2 = "HttpScanner" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3500KB and all of them
 }
 rule SIGNATURE_BASE_Hscan_V1_20_Pipecmd : FILE
 {
@@ -360020,10 +356839,10 @@ rule SIGNATURE_BASE_Hscan_V1_20_Pipecmd : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1028-L1049"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1028-L1049"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "64403ce63b28b544646a30da3be2f395788542d6"
-		logic_hash = "91ed275896c2520893ba1af26b2563c0bd3564a9c5f9d812f35464469e27307b"
+		logic_hash = "v1_sha256_91ed275896c2520893ba1af26b2563c0bd3564a9c5f9d812f35464469e27307b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360041,7 +356860,7 @@ rule SIGNATURE_BASE_Hscan_V1_20_Pipecmd : FILE
 		$s9 = "PIPECMDSRV" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 4 of them
 }
 rule SIGNATURE_BASE_Dos_Fp : FILE
 {
@@ -360052,10 +356871,10 @@ rule SIGNATURE_BASE_Dos_Fp : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1051-L1067"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1051-L1067"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
-		logic_hash = "cc09743269ee36862c95c9323ad271ca9b6c350cf25163d126fef0f86bc6f671"
+		logic_hash = "v1_sha256_cc09743269ee36862c95c9323ad271ca9b6c350cf25163d126fef0f86bc6f671"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360068,7 +356887,7 @@ rule SIGNATURE_BASE_Dos_Fp : FILE
 		$s4 = "%s %s port %d. Address is already in use" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <65KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 65KB and all of them
 }
 rule SIGNATURE_BASE_Dos_Netstat : FILE
 {
@@ -360079,10 +356898,10 @@ rule SIGNATURE_BASE_Dos_Netstat : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1069-L1085"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1069-L1085"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d0444b7bd936b5fc490b865a604e97c22d97e598"
-		logic_hash = "e2b908308616c3f2c94849b4f22f0e9bb130b5759d89161604505ff25681be55"
+		logic_hash = "v1_sha256_e2b908308616c3f2c94849b4f22f0e9bb130b5759d89161604505ff25681be55"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360095,7 +356914,7 @@ rule SIGNATURE_BASE_Dos_Netstat : FILE
 		$s3 = "Packet Too Big            %1!-10u!  %2!-10u!" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
 }
 rule SIGNATURE_BASE_CN_Tools_Xsniff : FILE
 {
@@ -360106,10 +356925,10 @@ rule SIGNATURE_BASE_CN_Tools_Xsniff : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1087-L1104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1087-L1104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
-		logic_hash = "a32d07ecd635ad71edaa37d9b1e5f66d8ce5a7f84f1bba6eb06deb1f49a879c8"
+		logic_hash = "v1_sha256_a32d07ecd635ad71edaa37d9b1e5f66d8ce5a7f84f1bba6eb06deb1f49a879c8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360123,7 +356942,7 @@ rule SIGNATURE_BASE_CN_Tools_Xsniff : FILE
 		$s11 = "%-5s%s->%s Bytes=%d TTL=%d Type: %d,%d ID=%d SEQ=%d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 220KB and 2 of them
 }
 rule SIGNATURE_BASE_Mssqlpass : FILE
 {
@@ -360134,10 +356953,10 @@ rule SIGNATURE_BASE_Mssqlpass : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1106-L1121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1106-L1121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "172b4e31ed15d1275ac07f3acbf499daf9a055d7"
-		logic_hash = "8037316eb157f8693bd342911af5fe5292f3ef8a3c169c80bc70edbabd7a92e6"
+		logic_hash = "v1_sha256_8037316eb157f8693bd342911af5fe5292f3ef8a3c169c80bc70edbabd7a92e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360149,7 +356968,7 @@ rule SIGNATURE_BASE_Mssqlpass : FILE
 		$s2 = "Enterprise Manager PassView" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <120KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 120KB and all of them
 }
 rule SIGNATURE_BASE_Wsockexpert : FILE
 {
@@ -360160,10 +356979,10 @@ rule SIGNATURE_BASE_Wsockexpert : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1123-L1141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1123-L1141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2962bf7b0883ceda5e14b8dad86742f95b50f7bf"
-		logic_hash = "34ac3c5f0651ccab851d67da8863e0e305f981cf53a06d46c23f19736cc1c400"
+		logic_hash = "v1_sha256_34ac3c5f0651ccab851d67da8863e0e305f981cf53a06d46c23f19736cc1c400"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360178,7 +356997,7 @@ rule SIGNATURE_BASE_Wsockexpert : FILE
 		$s6 = "WSockHook.DLL" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2500KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2500KB and 4 of them
 }
 rule SIGNATURE_BASE_Ms_Viru_Racle : FILE
 {
@@ -360189,10 +357008,10 @@ rule SIGNATURE_BASE_Ms_Viru_Racle : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1143-L1159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1143-L1159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "13116078fff5c87b56179c5438f008caf6c98ecb"
-		logic_hash = "d36db04c6a62a72e9f3079d09aedc9056c0a5032b4594af4d02ba55373f8b6a4"
+		logic_hash = "v1_sha256_d36db04c6a62a72e9f3079d09aedc9056c0a5032b4594af4d02ba55373f8b6a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360205,7 +357024,7 @@ rule SIGNATURE_BASE_Ms_Viru_Racle : FILE
 		$s3 = "FirstStage() Loaded, CurrentThread @%p Stack %p - %p" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <210KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 210KB and all of them
 }
 rule SIGNATURE_BASE_Lamescan3 : FILE
 {
@@ -360216,10 +357035,10 @@ rule SIGNATURE_BASE_Lamescan3 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1161-L1177"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1161-L1177"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3130eefb79650dab2e323328b905e4d5d3a1d2f0"
-		logic_hash = "8246128fa4378b0479a0c051965188c7c3fa0f52c8acc8934ef8af3155a85590"
+		logic_hash = "v1_sha256_8246128fa4378b0479a0c051965188c7c3fa0f52c8acc8934ef8af3155a85590"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360232,7 +357051,7 @@ rule SIGNATURE_BASE_Lamescan3 : FILE
 		$s4 = "dic\\passlist.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3740KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3740KB and all of them
 }
 rule SIGNATURE_BASE_CN_Tools_Pc : FILE
 {
@@ -360243,10 +357062,10 @@ rule SIGNATURE_BASE_CN_Tools_Pc : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1179-L1195"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1179-L1195"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5cf8caba170ec461c44394f4058669d225a94285"
-		logic_hash = "1da263362e4c2ec8194bb80bfc3f25ff8c4b708919ba02ea02687d5404b99720"
+		logic_hash = "v1_sha256_1da263362e4c2ec8194bb80bfc3f25ff8c4b708919ba02ea02687d5404b99720"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360259,7 +357078,7 @@ rule SIGNATURE_BASE_CN_Tools_Pc : FILE
 		$s4 = "/.MIKY" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Dos_Down64 : FILE
 {
@@ -360270,10 +357089,10 @@ rule SIGNATURE_BASE_Dos_Down64 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1197-L1215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1197-L1215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "43e455e43b49b953e17a5b885ffdcdf8b6b23226"
-		logic_hash = "d181c2075762fc3bb5b61bcdef57eb6533cb59dde03c4b901b6ce5b8323f3c8a"
+		logic_hash = "v1_sha256_d181c2075762fc3bb5b61bcdef57eb6533cb59dde03c4b901b6ce5b8323f3c8a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360288,7 +357107,7 @@ rule SIGNATURE_BASE_Dos_Down64 : FILE
 		$s20 = "set_Timer1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
 }
 rule SIGNATURE_BASE_Epathobj_Exp32 : FILE
 {
@@ -360299,10 +357118,10 @@ rule SIGNATURE_BASE_Epathobj_Exp32 : FILE
 		date = "2015-06-13"
 		modified = "2022-12-21"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1217-L1235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1217-L1235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ed86ff44bddcfdd630ade8ced39b4559316195ba"
-		logic_hash = "8959837257848a08240d0423971b9d3a850a7e9cc796de2c9b2d34814923f8ec"
+		logic_hash = "v1_sha256_8959837257848a08240d0423971b9d3a850a7e9cc796de2c9b2d34814923f8ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360316,7 +357135,7 @@ rule SIGNATURE_BASE_Epathobj_Exp32 : FILE
 		$s4 = "Mutex object did not timeout, list not patched" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <270KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 270KB and all of them
 }
 rule SIGNATURE_BASE_Tools_Unknown : FILE
 {
@@ -360327,10 +357146,10 @@ rule SIGNATURE_BASE_Tools_Unknown : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1237-L1254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1237-L1254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4be8270c4faa1827177e2310a00af2d5bcd2a59f"
-		logic_hash = "493bb63d4dd519efbf53a29fa44ef74f0a85943b2d9f49f11e3daa57c6b03d8e"
+		logic_hash = "v1_sha256_493bb63d4dd519efbf53a29fa44ef74f0a85943b2d9f49f11e3daa57c6b03d8e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360344,7 +357163,7 @@ rule SIGNATURE_BASE_Tools_Unknown : FILE
 		$s5 = "Host: 127.0.0.1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2500KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2500KB and 4 of them
 }
 rule SIGNATURE_BASE_PLUGIN_Ajunk : FILE
 {
@@ -360355,10 +357174,10 @@ rule SIGNATURE_BASE_PLUGIN_Ajunk : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1256-L1271"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1256-L1271"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "eb430fcfe6d13b14ff6baa4b3f59817c0facec00"
-		logic_hash = "e37504aab506138493ddc0979697502819824ef00c7931599130fafb5d84a7a9"
+		logic_hash = "v1_sha256_e37504aab506138493ddc0979697502819824ef00c7931599130fafb5d84a7a9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360370,7 +357189,7 @@ rule SIGNATURE_BASE_PLUGIN_Ajunk : FILE
 		$s3 = "AJunk Dynamic Link Library" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <560KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 560KB and all of them
 }
 rule SIGNATURE_BASE_Iisputscanner : FILE
 {
@@ -360381,10 +357200,10 @@ rule SIGNATURE_BASE_Iisputscanner : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1273-L1316"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1273-L1316"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9869c70d6a9ec2312c749aa17d4da362fa6e2592"
-		logic_hash = "b2af9003cef528610280866bf00a9716b4421a5f7c65e7c8ec3202af9a592de1"
+		logic_hash = "v1_sha256_b2af9003cef528610280866bf00a9716b4421a5f7c65e7c8ec3202af9a592de1"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -360424,7 +357243,7 @@ rule SIGNATURE_BASE_Iisputscanner : FILE
 		$s33 = "MAINICON" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and filesize >350KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and filesize > 350KB and all of them
 }
 rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool_2 : FILE
 {
@@ -360435,10 +357254,10 @@ rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1318-L1335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1318-L1335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "07feb31dd21d6f97614118b8a0adf231f8541a67"
-		logic_hash = "831f42abd7374b2ca2b4115a73aae2123e2212b0854d4cc0950b8e66a28e38a3"
+		logic_hash = "v1_sha256_831f42abd7374b2ca2b4115a73aae2123e2212b0854d4cc0950b8e66a28e38a3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360452,7 +357271,7 @@ rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool_2 : FILE
 		$s7 = "IoCreateDevice" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 7KB and all of them
 }
 rule SIGNATURE_BASE_Hkmjjiis6 : FILE
 {
@@ -360463,10 +357282,10 @@ rule SIGNATURE_BASE_Hkmjjiis6 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1337-L1358"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1337-L1358"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
-		logic_hash = "4ea95b7a5bd24e0dfdcef045d101b7f15e18b20f1328901bb340d9aaad336981"
+		logic_hash = "v1_sha256_4ea95b7a5bd24e0dfdcef045d101b7f15e18b20f1328901bb340d9aaad336981"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360484,7 +357303,7 @@ rule SIGNATURE_BASE_Hkmjjiis6 : FILE
 		$s9 = "LookupAcc" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 70KB and all of them
 }
 rule SIGNATURE_BASE_Dos_Lcx : FILE
 {
@@ -360495,10 +357314,10 @@ rule SIGNATURE_BASE_Dos_Lcx : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1360-L1384"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1360-L1384"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b6ad5dd13592160d9f052bb47b0d6a87b80a406d"
-		logic_hash = "bbe215fb27825b4f4bbfa71808ac945f341efbc70a21f79689065982a843d7f1"
+		logic_hash = "v1_sha256_bbe215fb27825b4f4bbfa71808ac945f341efbc70a21f79689065982a843d7f1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360519,7 +357338,7 @@ rule SIGNATURE_BASE_Dos_Lcx : FILE
 		$s18 = "[+] Accept a Client on port %d from %s ......" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
 }
 rule SIGNATURE_BASE_X_Way2_5_X_Way : FILE
 {
@@ -360530,10 +357349,10 @@ rule SIGNATURE_BASE_X_Way2_5_X_Way : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1386-L1407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1386-L1407"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8ba8530fbda3e8342e8d4feabbf98c66a322dac6"
-		logic_hash = "6261de5db1e7527f7726effe26ed5f88638e6cb378db4c99183dddcd42ae231f"
+		logic_hash = "v1_sha256_6261de5db1e7527f7726effe26ed5f88638e6cb378db4c99183dddcd42ae231f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360551,7 +357370,7 @@ rule SIGNATURE_BASE_X_Way2_5_X_Way : FILE
 		$s8 = "dbnextrow" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 5 of them
 }
 rule SIGNATURE_BASE_Tools_Sqlcmd : FILE
 {
@@ -360562,10 +357381,10 @@ rule SIGNATURE_BASE_Tools_Sqlcmd : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1409-L1428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1409-L1428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "99d56476e539750c599f76391d717c51c4955a33"
-		logic_hash = "aa600f7c56d72d767e9ca51d8b1ee2b2c62302ea1afbed39e4670debd30c5247"
+		logic_hash = "v1_sha256_aa600f7c56d72d767e9ca51d8b1ee2b2c62302ea1afbed39e4670debd30c5247"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360581,7 +357400,7 @@ rule SIGNATURE_BASE_Tools_Sqlcmd : FILE
 		$s11 = "Sqlcmd>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and 3 of them
 }
 rule SIGNATURE_BASE_Sword1_5 : FILE
 {
@@ -360592,10 +357411,10 @@ rule SIGNATURE_BASE_Sword1_5 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1430-L1449"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1430-L1449"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
-		logic_hash = "09e09f7ea16dc917388cbccb22a7abfed9b693a33d61698f0e838f029402c256"
+		logic_hash = "v1_sha256_09e09f7ea16dc917388cbccb22a7abfed9b693a33d61698f0e838f029402c256"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360611,7 +357430,7 @@ rule SIGNATURE_BASE_Sword1_5 : FILE
 		$s20 = " (*.txt)|*.txt" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 4 of them
 }
 rule SIGNATURE_BASE_Tools_Scan : FILE
 {
@@ -360622,10 +357441,10 @@ rule SIGNATURE_BASE_Tools_Scan : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1451-L1466"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1451-L1466"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c580a0cc41997e840d2c0f83962e7f8b636a5a13"
-		logic_hash = "d8bf2e4a4634f74ce548a5824090502f2ccef382bdbcaf795df711e88a325912"
+		logic_hash = "v1_sha256_d8bf2e4a4634f74ce548a5824090502f2ccef382bdbcaf795df711e88a325912"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -360637,7 +357456,7 @@ rule SIGNATURE_BASE_Tools_Scan : FILE
 		$s4 = "_frmIpToAddr" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
 rule SIGNATURE_BASE_Dos_C : FILE
 {
@@ -360648,10 +357467,10 @@ rule SIGNATURE_BASE_Dos_C : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1468-L1487"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1468-L1487"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3deb6bd52fdac6d5a3e9a91c585d67820ab4df78"
-		logic_hash = "2865b50e6a323462fab39bd84571939c618cf6f00e147039f6e699ba4d195a00"
+		logic_hash = "v1_sha256_2865b50e6a323462fab39bd84571939c618cf6f00e147039f6e699ba4d195a00"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360667,7 +357486,7 @@ rule SIGNATURE_BASE_Dos_C : FILE
 		$s9 = "GetUserNameA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Arpsniffer : FILE
 {
@@ -360678,10 +357497,10 @@ rule SIGNATURE_BASE_Arpsniffer : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1489-L1506"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1489-L1506"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7d8753f56fc48413fc68102cff34b6583cb0066c"
-		logic_hash = "eb0a425be0fff87eb58689a4eee4b6729e8ee985e6224790111322d4b182caf1"
+		logic_hash = "v1_sha256_eb0a425be0fff87eb58689a4eee4b6729e8ee985e6224790111322d4b182caf1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360695,7 +357514,7 @@ rule SIGNATURE_BASE_Arpsniffer : FILE
 		$s5 = "packet.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <120KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 120KB and all of them
 }
 rule SIGNATURE_BASE_Pw_Inspector_2 : FILE
 {
@@ -360706,10 +357525,10 @@ rule SIGNATURE_BASE_Pw_Inspector_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1508-L1524"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1508-L1524"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e0a1117ee4a29bb4cf43e3a80fb9eaa63bb377bf"
-		logic_hash = "7d2021ff471f03deb9e6d8b62fcb218ae3198f21fd7b8fa1fdd9b96228b8c2f8"
+		logic_hash = "v1_sha256_7d2021ff471f03deb9e6d8b62fcb218ae3198f21fd7b8fa1fdd9b96228b8c2f8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360722,7 +357541,7 @@ rule SIGNATURE_BASE_Pw_Inspector_2 : FILE
 		$s4 = "i:o:m:M:c:lunps" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
 }
 rule SIGNATURE_BASE_Datpcshare : FILE
 {
@@ -360733,10 +357552,10 @@ rule SIGNATURE_BASE_Datpcshare : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1526-L1542"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1526-L1542"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "87acb649ab0d33c62e27ea83241caa43144fc1c4"
-		logic_hash = "15297a8019192371032fc11b966d1a89d951c176da6d64e80ca5a201f55341c0"
+		logic_hash = "v1_sha256_15297a8019192371032fc11b966d1a89d951c176da6d64e80ca5a201f55341c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360749,7 +357568,7 @@ rule SIGNATURE_BASE_Datpcshare : FILE
 		$s4 = "QQ:4564405" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_Tools_Xport : FILE
 {
@@ -360760,10 +357579,10 @@ rule SIGNATURE_BASE_Tools_Xport : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1544-L1565"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1544-L1565"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9584de562e7f8185f721e94ee3cceac60db26dda"
-		logic_hash = "9eea73732643f74b4802af0672f5c3ab09cc54cfecd80f8903efc26b7ceaec29"
+		logic_hash = "v1_sha256_9eea73732643f74b4802af0672f5c3ab09cc54cfecd80f8903efc26b7ceaec29"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360781,7 +357600,7 @@ rule SIGNATURE_BASE_Tools_Xport : FILE
 		$s9 = "http://www.xfocus.org" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
 }
 rule SIGNATURE_BASE_Pc_Xai : FILE
 {
@@ -360792,10 +357611,10 @@ rule SIGNATURE_BASE_Pc_Xai : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1567-L1586"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1567-L1586"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f285a59fd931ce137c08bd1f0dae858cc2486491"
-		logic_hash = "80659fcf1721b20f459ac0480401bdf643c95b46118d03320bc6d4e4ee4b67f7"
+		logic_hash = "v1_sha256_80659fcf1721b20f459ac0480401bdf643c95b46118d03320bc6d4e4ee4b67f7"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -360811,7 +357630,7 @@ rule SIGNATURE_BASE_Pc_Xai : FILE
 		$s7 = "GetRand.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
 rule SIGNATURE_BASE_Radmin_Hash : FILE
 {
@@ -360822,10 +357641,10 @@ rule SIGNATURE_BASE_Radmin_Hash : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1588-L1605"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1588-L1605"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "be407bd5bf5bcd51d38d1308e17a1731cd52f66b"
-		logic_hash = "d6ee13a2ed30bb44471593386521f67be0d6ccd6f8a0ebf8557012a099f81d3d"
+		logic_hash = "v1_sha256_d6ee13a2ed30bb44471593386521f67be0d6ccd6f8a0ebf8557012a099f81d3d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360839,7 +357658,7 @@ rule SIGNATURE_BASE_Radmin_Hash : FILE
 		$s5 = "HASH1.0" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
 }
 rule SIGNATURE_BASE_Oseditor : FILE
 {
@@ -360850,10 +357669,10 @@ rule SIGNATURE_BASE_Oseditor : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1607-L1624"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1607-L1624"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6773c3c6575cf9cfedbb772f3476bb999d09403d"
-		logic_hash = "6531c0b3c0f6123d9eda34ed028f05054e4805e5c329da4b29e4f37f9b5fc1b2"
+		logic_hash = "v1_sha256_6531c0b3c0f6123d9eda34ed028f05054e4805e5c329da4b29e4f37f9b5fc1b2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360867,7 +357686,7 @@ rule SIGNATURE_BASE_Oseditor : FILE
 		$s5 = "Unlock" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Goodtoolset_Ms11011 : FILE
 {
@@ -360878,10 +357697,10 @@ rule SIGNATURE_BASE_Goodtoolset_Ms11011 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1626-L1642"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1626-L1642"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
-		logic_hash = "99dd27eba7da44c71098446e17abfe626de91e899e28c2d2e99e7b54b9e0c825"
+		logic_hash = "v1_sha256_99dd27eba7da44c71098446e17abfe626de91e899e28c2d2e99e7b54b9e0c825"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360894,7 +357713,7 @@ rule SIGNATURE_BASE_Goodtoolset_Ms11011 : FILE
 		$s4 = "SystemDefaultEUDCFont" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Freeversion_Release : FILE
 {
@@ -360905,10 +357724,10 @@ rule SIGNATURE_BASE_Freeversion_Release : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1644-L1662"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1644-L1662"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f42e4b5748e92f7a450eb49fc89d6859f4afcebb"
-		logic_hash = "38722afb3b955aced2e68e2048a3268722524f61784dcb45c6a695b5684230eb"
+		logic_hash = "v1_sha256_38722afb3b955aced2e68e2048a3268722524f61784dcb45c6a695b5684230eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360923,7 +357742,7 @@ rule SIGNATURE_BASE_Freeversion_Release : FILE
 		$s6 = "SELECT * FROM IIsWebInfo" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them
 }
 rule SIGNATURE_BASE_Churrasco : FILE
 {
@@ -360934,10 +357753,10 @@ rule SIGNATURE_BASE_Churrasco : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1664-L1681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1664-L1681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a8d4c177948a8e60d63de9d0ed948c50d0151364"
-		logic_hash = "36ca7c8d1579eeb571c182c033c312b3b231313b8950c1e24eeb3df793b004c4"
+		logic_hash = "v1_sha256_36ca7c8d1579eeb571c182c033c312b3b231313b8950c1e24eeb3df793b004c4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360951,7 +357770,7 @@ rule SIGNATURE_BASE_Churrasco : FILE
 		$s5 = "Thread not impersonating, looking for another thread..." ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them
 }
 rule SIGNATURE_BASE_X64_Kiwicmd : FILE
 {
@@ -360962,10 +357781,10 @@ rule SIGNATURE_BASE_X64_Kiwicmd : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1682-L1697"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1682-L1697"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
-		logic_hash = "b49a70a49a67fbb57d643b38155482177f594bd1f01f5464c4f36b265aac48d8"
+		logic_hash = "v1_sha256_b49a70a49a67fbb57d643b38155482177f594bd1f01f5464c4f36b265aac48d8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -360977,7 +357796,7 @@ rule SIGNATURE_BASE_X64_Kiwicmd : FILE
 		$s3 = "KiwiAndCMD" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them
 }
 rule SIGNATURE_BASE_Sql1433_SQL : FILE
 {
@@ -360988,10 +357807,10 @@ rule SIGNATURE_BASE_Sql1433_SQL : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1699-L1715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1699-L1715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "025e87deadd1c50b1021c26cb67b76b476fafd64"
-		logic_hash = "5ceecc4f345cb603a0b03180f3f09f97e5f951b5d75c469aefffe3ec62916a8f"
+		logic_hash = "v1_sha256_5ceecc4f345cb603a0b03180f3f09f97e5f951b5d75c469aefffe3ec62916a8f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361002,7 +357821,7 @@ rule SIGNATURE_BASE_Sql1433_SQL : FILE
 		$s1 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 31 00 2C 00 34 00 2C 00 33 00 2C 00 33 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <90KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 90KB and all of them
 }
 rule SIGNATURE_BASE_Cookietools2 : FILE
 {
@@ -361013,10 +357832,10 @@ rule SIGNATURE_BASE_Cookietools2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1717-L1733"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1717-L1733"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cb67797f229fdb92360319e01277e1345305eb82"
-		logic_hash = "8ddb8ea0bc047877d91f25375745ab8fa66af28b6b41de36e0fb16ea8284fce5"
+		logic_hash = "v1_sha256_8ddb8ea0bc047877d91f25375745ab8fa66af28b6b41de36e0fb16ea8284fce5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361029,7 +357848,7 @@ rule SIGNATURE_BASE_Cookietools2 : FILE
 		$s4 = "SOFTWARE\\Borland\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
 }
 rule SIGNATURE_BASE_Cyclotron : FILE
 {
@@ -361040,10 +357859,10 @@ rule SIGNATURE_BASE_Cyclotron : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1735-L1752"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1735-L1752"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5b63473b6dc1e5942bf07c52c31ba28f2702b246"
-		logic_hash = "f3a0edf54039479c9f4e46b20249465bbe1bca57f47afeba37965e6e3fc0127f"
+		logic_hash = "v1_sha256_f3a0edf54039479c9f4e46b20249465bbe1bca57f47afeba37965e6e3fc0127f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361057,7 +357876,7 @@ rule SIGNATURE_BASE_Cyclotron : FILE
 		$s5 = "IoCreateSymbolicLink" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3KB and all of them
 }
 rule SIGNATURE_BASE_Xscan_Gui : FILE
 {
@@ -361068,10 +357887,10 @@ rule SIGNATURE_BASE_Xscan_Gui : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1754-L1770"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1754-L1770"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a9e900510396192eb2ba4fb7b0ef786513f9b5ab"
-		logic_hash = "366db7eb19725a0a42ce371d7bfb50a22a259f0bc0252927af626e8c1c0b9b59"
+		logic_hash = "v1_sha256_366db7eb19725a0a42ce371d7bfb50a22a259f0bc0252927af626e8c1c0b9b59"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361084,7 +357903,7 @@ rule SIGNATURE_BASE_Xscan_Gui : FILE
 		$s4 = "%c Active/Maximum host thread: %d/%d, Current/Maximum thread: %d/%d, Time(s): %l" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Tools_Hscan : FILE
 {
@@ -361095,10 +357914,10 @@ rule SIGNATURE_BASE_CN_Tools_Hscan : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1772-L1792"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1772-L1792"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
-		logic_hash = "9bc4800249bffcc4b8fc1191d600f0b9b2a7b0c1f067039c83c03671a0b4b5c5"
+		logic_hash = "v1_sha256_9bc4800249bffcc4b8fc1191d600f0b9b2a7b0c1f067039c83c03671a0b4b5c5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361115,7 +357934,7 @@ rule SIGNATURE_BASE_CN_Tools_Hscan : FILE
 		$s8 = ".\\conf\\mysql_pass.dic" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Goodtoolset_Pr : FILE
 {
@@ -361126,10 +357945,10 @@ rule SIGNATURE_BASE_Goodtoolset_Pr : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1794-L1812"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1794-L1812"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f6676daf3292cff59ef15ed109c2d408369e8ac8"
-		logic_hash = "0673bc445422f4339c9e81ff8ae8a9b2bb9bc1f107b85fe34906444a1754c43b"
+		logic_hash = "v1_sha256_0673bc445422f4339c9e81ff8ae8a9b2bb9bc1f107b85fe34906444a1754c43b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361144,7 +357963,7 @@ rule SIGNATURE_BASE_Goodtoolset_Pr : FILE
 		$s6 = "root\\MicrosoftIISv2" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_Hydra_7_4_1_Hydra : FILE
 {
@@ -361155,10 +357974,10 @@ rule SIGNATURE_BASE_Hydra_7_4_1_Hydra : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1814-L1832"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1814-L1832"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3411d0380a1c1ebf58a454765f94d4f1dd714b5b"
-		logic_hash = "f52696cbf7355c982d1a1e0c73dce65324845c5ffc13c541e326720332b4788d"
+		logic_hash = "v1_sha256_f52696cbf7355c982d1a1e0c73dce65324845c5ffc13c541e326720332b4788d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361173,7 +357992,7 @@ rule SIGNATURE_BASE_Hydra_7_4_1_Hydra : FILE
 		$s6 = "\"/login.php:user=^USER^&pass=^PASS^&mid=123:incorrect\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Tools_Srss_2 : FILE
 {
@@ -361184,10 +358003,10 @@ rule SIGNATURE_BASE_CN_Tools_Srss_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1834-L1856"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1834-L1856"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c418b30d004051bbf1b2d3be426936b95b5fea6f"
-		logic_hash = "e674ac7a99a67e2ebe8b4c4232e3435dd041b794f6c08a87ef7b8179127d6fc7"
+		logic_hash = "v1_sha256_e674ac7a99a67e2ebe8b4c4232e3435dd041b794f6c08a87ef7b8179127d6fc7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361205,7 +358024,7 @@ rule SIGNATURE_BASE_CN_Tools_Srss_2 : FILE
 		$s8 = "ExitProcess" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($x1 at 0) and filesize <14KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and ( $x1 at 0 ) and filesize < 14KB and all of ( $s* )
 }
 rule SIGNATURE_BASE_Dos_Ntgod : FILE
 {
@@ -361216,10 +358035,10 @@ rule SIGNATURE_BASE_Dos_Ntgod : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1858-L1874"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1858-L1874"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "adefd901d6bbd8437116f0170b9c28a76d4a87bf"
-		logic_hash = "77b9204add5d25dcc36eabc07cabea2bdc67a23873c2faf7706e7fba5ed53f8b"
+		logic_hash = "v1_sha256_77b9204add5d25dcc36eabc07cabea2bdc67a23873c2faf7706e7fba5ed53f8b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361232,7 +358051,7 @@ rule SIGNATURE_BASE_Dos_Ntgod : FILE
 		$s19 = "sfxcmd" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
 }
 rule SIGNATURE_BASE_CN_Tools_Vnclink : FILE
 {
@@ -361243,10 +358062,10 @@ rule SIGNATURE_BASE_CN_Tools_Vnclink : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1876-L1891"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1876-L1891"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cafb531822cbc0cfebbea864489eebba48081aa1"
-		logic_hash = "21328e2a871dfcfda47991a1f1e897efd27471420d644c09a94004cf5b0f9869"
+		logic_hash = "v1_sha256_21328e2a871dfcfda47991a1f1e897efd27471420d644c09a94004cf5b0f9869"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361258,7 +358077,7 @@ rule SIGNATURE_BASE_CN_Tools_Vnclink : FILE
 		$s3 = "fake release extendedVkey 0x%x, keysym 0x%x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <580KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 580KB and 2 of them
 }
 rule SIGNATURE_BASE_Tools_Ntcmd : FILE
 {
@@ -361269,10 +358088,10 @@ rule SIGNATURE_BASE_Tools_Ntcmd : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1893-L1911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1893-L1911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a3ae8659b9a673aa346a60844208b371f7c05e3c"
-		logic_hash = "c2487306a0d82ab76a048c001361c25bcd61d0f7a57a3b22df1c70299f0a72ba"
+		logic_hash = "v1_sha256_c2487306a0d82ab76a048c001361c25bcd61d0f7a57a3b22df1c70299f0a72ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361287,7 +358106,7 @@ rule SIGNATURE_BASE_Tools_Ntcmd : FILE
 		$s6 = "NTcmd>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 80KB and 2 of them
 }
 rule SIGNATURE_BASE_Mysql_Pwd_Crack : FILE
 {
@@ -361298,10 +358117,10 @@ rule SIGNATURE_BASE_Mysql_Pwd_Crack : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1913-L1930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1913-L1930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "57d1cb4d404688804a8c3755b464a6e6248d1c73"
-		logic_hash = "d272b98a6cf2749482ee501734d0043564ba528770161cb0ed4f032409305f22"
+		logic_hash = "v1_sha256_d272b98a6cf2749482ee501734d0043564ba528770161cb0ed4f032409305f22"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361315,7 +358134,7 @@ rule SIGNATURE_BASE_Mysql_Pwd_Crack : FILE
 		$s5 = "mysql_pwd_crack 127.0.0.1 -x 3306 -a" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
 }
 rule SIGNATURE_BASE_Cmdshell64 : FILE
 {
@@ -361326,10 +358145,10 @@ rule SIGNATURE_BASE_Cmdshell64 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1932-L1951"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1932-L1951"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5b92510475d95ae5e7cd6ec4c89852e8af34acf1"
-		logic_hash = "fd8010ab2ab51feed62475f840ffaeef92cf1266c139b8f669b7fa5ff646fdab"
+		logic_hash = "v1_sha256_fd8010ab2ab51feed62475f840ffaeef92cf1266c139b8f669b7fa5ff646fdab"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361345,7 +358164,7 @@ rule SIGNATURE_BASE_Cmdshell64 : FILE
 		$s7 = "CmdShell" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and 4 of them
 }
 rule SIGNATURE_BASE_Ms_Viru_V : FILE
 {
@@ -361356,10 +358175,10 @@ rule SIGNATURE_BASE_Ms_Viru_V : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1953-L1971"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1953-L1971"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ecf4ba6d1344f2f3114d52859addee8b0770ed0d"
-		logic_hash = "028b589c11eeacb2edfeeaeaebf2da370e540cba964c9ebbb19e4c734afe190f"
+		logic_hash = "v1_sha256_028b589c11eeacb2edfeeaeaebf2da370e540cba964c9ebbb19e4c734afe190f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361374,7 +358193,7 @@ rule SIGNATURE_BASE_Ms_Viru_V : FILE
 		$s6 = "The exploit thread was unable to map the virtual 8086 address space" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them
 }
 rule SIGNATURE_BASE_CN_Tools_Vscan : FILE
 {
@@ -361385,10 +358204,10 @@ rule SIGNATURE_BASE_CN_Tools_Vscan : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1973-L1990"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1973-L1990"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0365fe05e2de0f327dfaa8cd0d988dbb7b379612"
-		logic_hash = "2bbf0a3fb2b3fc9b646c6f8fc021f65a38e1b64edd74301481051541f8938902"
+		logic_hash = "v1_sha256_2bbf0a3fb2b3fc9b646c6f8fc021f65a38e1b64edd74301481051541f8938902"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361402,7 +358221,7 @@ rule SIGNATURE_BASE_CN_Tools_Vscan : FILE
 		$s5 = "-vn:%-15s:%-7d  connection closed" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and 2 of them
 }
 rule SIGNATURE_BASE_Dos_Iis : FILE
 {
@@ -361413,10 +358232,10 @@ rule SIGNATURE_BASE_Dos_Iis : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L1992-L2011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L1992-L2011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "61ffd2cbec5462766c6f1c44bd44eeaed4f3d2c7"
-		logic_hash = "d6852af79eac659f4dfa3019793290e0498739f02a06c5540cd7d2c65b46b960"
+		logic_hash = "v1_sha256_d6852af79eac659f4dfa3019793290e0498739f02a06c5540cd7d2c65b46b960"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361432,7 +358251,7 @@ rule SIGNATURE_BASE_Dos_Iis : FILE
 		$s7 = "Pid: %d" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 70KB and all of them
 }
 rule SIGNATURE_BASE_Iisputscannesr : FILE
 {
@@ -361443,10 +358262,10 @@ rule SIGNATURE_BASE_Iisputscannesr : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2013-L2027"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2013-L2027"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2dd8fee20df47fd4eed5a354817ce837752f6ae9"
-		logic_hash = "27c190050aabcdff3713b388adb0113ad2334c107a2a7b3d682c209b102cf642"
+		logic_hash = "v1_sha256_27c190050aabcdff3713b388adb0113ad2334c107a2a7b3d682c209b102cf642"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361457,7 +358276,7 @@ rule SIGNATURE_BASE_Iisputscannesr : FILE
 		$s2 = "-> come.to/f2f **************" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_HKTL_Unknown_CN_Generate : FILE
 {
@@ -361468,10 +358287,10 @@ rule SIGNATURE_BASE_HKTL_Unknown_CN_Generate : FILE
 		date = "2015-06-13"
 		modified = "2022-01-20"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2029-L2047"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2029-L2047"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
-		logic_hash = "a83000880bd71f4ee6507cb448b611cb670a47a4dc47c400930d3a41ca594a5d"
+		logic_hash = "v1_sha256_a83000880bd71f4ee6507cb448b611cb670a47a4dc47c400930d3a41ca594a5d"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -361485,7 +358304,7 @@ rule SIGNATURE_BASE_HKTL_Unknown_CN_Generate : FILE
 		$s5 = "ftpcWaitingPassword" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 3 of them
 }
 rule SIGNATURE_BASE_Pc_Rejoice : FILE
 {
@@ -361496,10 +358315,10 @@ rule SIGNATURE_BASE_Pc_Rejoice : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2049-L2067"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2049-L2067"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
-		logic_hash = "9e22a98b5065a95a7f169fda8d6d4112101bffa11a1407e03ec152db41857206"
+		logic_hash = "v1_sha256_9e22a98b5065a95a7f169fda8d6d4112101bffa11a1407e03ec152db41857206"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361514,7 +358333,7 @@ rule SIGNATURE_BASE_Pc_Rejoice : FILE
 		$s6 = "http://iframe.ip138.com/ic.asp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 3 of them
 }
 rule SIGNATURE_BASE_Ms11080_Withcmd : FILE
 {
@@ -361525,10 +358344,10 @@ rule SIGNATURE_BASE_Ms11080_Withcmd : FILE
 		date = "2015-06-13"
 		modified = "2022-12-21"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2069-L2087"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2069-L2087"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
-		logic_hash = "cd7167269538a5dd197260682ad777f87e43cc2155acf3ce731d1a065395cf4a"
+		logic_hash = "v1_sha256_cd7167269538a5dd197260682ad777f87e43cc2155acf3ce731d1a065395cf4a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361542,7 +358361,7 @@ rule SIGNATURE_BASE_Ms11080_Withcmd : FILE
 		$s5 = "[>] ms11-080 Exploit" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them
 }
 rule SIGNATURE_BASE_Othertools_Xiaoa : FILE
 {
@@ -361553,10 +358372,10 @@ rule SIGNATURE_BASE_Othertools_Xiaoa : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2089-L2107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2089-L2107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6988acb738e78d582e3614f83993628cf92ae26d"
-		logic_hash = "451ed602bd1e9dd7e4020108ea133b60c546965bd77be349d07be42150f80fee"
+		logic_hash = "v1_sha256_451ed602bd1e9dd7e4020108ea133b60c546965bd77be349d07be42150f80fee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361571,7 +358390,7 @@ rule SIGNATURE_BASE_Othertools_Xiaoa : FILE
 		$s6 = "Windows Kernel Local Privilege Exploit " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
 }
 rule SIGNATURE_BASE_Unknown2 : FILE
 {
@@ -361582,10 +358401,10 @@ rule SIGNATURE_BASE_Unknown2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2109-L2128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2109-L2128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "32508d75c3d95e045ddc82cb829281a288bd5aa3"
-		logic_hash = "dea499eaa87cc454a31672fb842539779926d50785ef827162fde84bfcdcc54a"
+		logic_hash = "v1_sha256_dea499eaa87cc454a31672fb842539779926d50785ef827162fde84bfcdcc54a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361601,7 +358420,7 @@ rule SIGNATURE_BASE_Unknown2 : FILE
 		$s7 = " (*.txt)|*.txt" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 4 of them
 }
 rule SIGNATURE_BASE_Hydra_7_3_Hydra : FILE
 {
@@ -361612,10 +358431,10 @@ rule SIGNATURE_BASE_Hydra_7_3_Hydra : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2130-L2147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2130-L2147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2f82b8bf1159e43427880d70bcd116dc9e8026ad"
-		logic_hash = "23194c2df0b8bdedc4fc66c423b0aebb10217de328a194b26560d4cc9a5531e3"
+		logic_hash = "v1_sha256_23194c2df0b8bdedc4fc66c423b0aebb10217de328a194b26560d4cc9a5531e3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361629,7 +358448,7 @@ rule SIGNATURE_BASE_Hydra_7_3_Hydra : FILE
 		$s5 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of them
 }
 rule SIGNATURE_BASE_Oraclescan : FILE
 {
@@ -361640,10 +358459,10 @@ rule SIGNATURE_BASE_Oraclescan : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2149-L2165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2149-L2165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "10ff7faf72fe6da8f05526367b3522a2408999ec"
-		logic_hash = "b9454f47123c32d6c6b51722aeadac9acc2a6232c259703c36ea00c83d8977e6"
+		logic_hash = "v1_sha256_b9454f47123c32d6c6b51722aeadac9acc2a6232c259703c36ea00c83d8977e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361656,7 +358475,7 @@ rule SIGNATURE_BASE_Oraclescan : FILE
 		$s4 = "FROMWWHERE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Sqltools : FILE
 {
@@ -361667,10 +358486,10 @@ rule SIGNATURE_BASE_Sqltools : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2167-L2186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2167-L2186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "38a9caa2079afa2c8d7327e7762f7ed9a69056f7"
-		logic_hash = "35b84c3445e92d61ca5e638a2eb19128dca2174327c6325436287d8d3f0bb976"
+		logic_hash = "v1_sha256_35b84c3445e92d61ca5e638a2eb19128dca2174327c6325436287d8d3f0bb976"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361686,7 +358505,7 @@ rule SIGNATURE_BASE_Sqltools : FILE
 		$s7 = "Copyright (C) Kibosoft Corp. 2001-2006" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2350KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2350KB and all of them
 }
 rule SIGNATURE_BASE_HKTL_Portscanner_533_NET_Jun15 : FILE
 {
@@ -361698,10 +358517,10 @@ rule SIGNATURE_BASE_HKTL_Portscanner_533_NET_Jun15 : FILE
 		modified = "2023-12-05"
 		old_rule_name = "portscanner"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2188-L2205"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2188-L2205"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1de367d503fdaaeee30e8ad7c100dd1e320858a4"
-		logic_hash = "446cbc1b8046bfd182e0b1c98fe37c8b8ef98f600f5d80d9de83b45aeaf2b386"
+		logic_hash = "v1_sha256_446cbc1b8046bfd182e0b1c98fe37c8b8ef98f600f5d80d9de83b45aeaf2b386"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361714,7 +358533,7 @@ rule SIGNATURE_BASE_HKTL_Portscanner_533_NET_Jun15 : FILE
 		$s3 = "exitfc" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 25KB and all of them
 }
 rule SIGNATURE_BASE_Kappfree : FILE
 {
@@ -361725,10 +358544,10 @@ rule SIGNATURE_BASE_Kappfree : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2207-L2222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2207-L2222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
-		logic_hash = "b1b644f9b033ac8372369e81628ee3f6fe094f80d11b8f4f6c192a5e81d2e543"
+		logic_hash = "v1_sha256_b1b644f9b033ac8372369e81628ee3f6fe094f80d11b8f4f6c192a5e81d2e543"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361740,7 +358559,7 @@ rule SIGNATURE_BASE_Kappfree : FILE
 		$s3 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_Smartniff : FILE
 {
@@ -361751,10 +358570,10 @@ rule SIGNATURE_BASE_Smartniff : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2224-L2239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2224-L2239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "67609f21d54a57955d8fe6d48bc471f328748d0a"
-		logic_hash = "bac770ae3c8e7f619da0b0ff4243716ff8212dce0f36c08c127af892548fe0b6"
+		logic_hash = "v1_sha256_bac770ae3c8e7f619da0b0ff4243716ff8212dce0f36c08c127af892548fe0b6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361766,7 +358585,7 @@ rule SIGNATURE_BASE_Smartniff : FILE
 		$s3 = "</requestedPrivileges></security></trustInfo></assembly>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_Chinachopper_Caidao : FILE
 {
@@ -361777,10 +358596,10 @@ rule SIGNATURE_BASE_Chinachopper_Caidao : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2241-L2259"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2241-L2259"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "056a60ec1f6a8959bfc43254d97527b003ae5edb"
-		logic_hash = "7e16a452c98e36a4946bcede5552bef7f6fc82314b28b506307cf010a0890ea6"
+		logic_hash = "v1_sha256_7e16a452c98e36a4946bcede5552bef7f6fc82314b28b506307cf010a0890ea6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361795,7 +358614,7 @@ rule SIGNATURE_BASE_Chinachopper_Caidao : FILE
 		$s6 = "MainFrame" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1077KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1077KB and all of them
 }
 rule SIGNATURE_BASE_Kiwitaskmgr_2 : FILE
 {
@@ -361806,10 +358625,10 @@ rule SIGNATURE_BASE_Kiwitaskmgr_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2261-L2276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2261-L2276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
-		logic_hash = "6d197e9b7bb9bbd759d6c8c882f7d7412512ba10208cb52a08fcde5e32fd1733"
+		logic_hash = "v1_sha256_6d197e9b7bb9bbd759d6c8c882f7d7412512ba10208cb52a08fcde5e32fd1733"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361821,7 +358640,7 @@ rule SIGNATURE_BASE_Kiwitaskmgr_2 : FILE
 		$s3 = "KiwiAndTaskMgr" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Kappfree_2 : FILE
 {
@@ -361832,10 +358651,10 @@ rule SIGNATURE_BASE_Kappfree_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2278-L2294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2278-L2294"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5d578df9a71670aa832d1cd63379e6162564fb6b"
-		logic_hash = "1862f1283e8a268f523b3922b3630ebbca9a81cc5aed19e5068315e6346d25c2"
+		logic_hash = "v1_sha256_1862f1283e8a268f523b3922b3630ebbca9a81cc5aed19e5068315e6346d25c2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361848,7 +358667,7 @@ rule SIGNATURE_BASE_Kappfree_2 : FILE
 		$s4 = "kiwi\\mimikatz" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
 }
 rule SIGNATURE_BASE_X_Way2_5_Sqlcmd : FILE
 {
@@ -361859,10 +358678,10 @@ rule SIGNATURE_BASE_X_Way2_5_Sqlcmd : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2296-L2324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2296-L2324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5152a57e3638418b0d97a42db1c0fc2f893a2794"
-		logic_hash = "59fd25a786d56885e456fca154800a8313cd04a23fd9374361cc37b86be109a1"
+		logic_hash = "v1_sha256_59fd25a786d56885e456fca154800a8313cd04a23fd9374361cc37b86be109a1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361887,7 +358706,7 @@ rule SIGNATURE_BASE_X_Way2_5_Sqlcmd : FILE
 		$s15 = "odbc32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <23KB and filesize >20KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 23KB and filesize > 20KB and all of them
 }
 rule SIGNATURE_BASE_Win32_Klock : FILE
 {
@@ -361898,10 +358717,10 @@ rule SIGNATURE_BASE_Win32_Klock : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2326-L2341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2326-L2341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7addce4434670927c4efaa560524680ba2871d17"
-		logic_hash = "e9f1d38de15ce06d55cf276e0f2becd9f9dbf5bd22f9061de03761d7ccdd3e60"
+		logic_hash = "v1_sha256_e9f1d38de15ce06d55cf276e0f2becd9f9dbf5bd22f9061de03761d7ccdd3e60"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361913,7 +358732,7 @@ rule SIGNATURE_BASE_Win32_Klock : FILE
 		$s3 = "klock de mimikatz pour Windows" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
 }
 rule SIGNATURE_BASE_Ipsearcher : FILE
 {
@@ -361924,10 +358743,10 @@ rule SIGNATURE_BASE_Ipsearcher : FILE
 		date = "2015-06-13"
 		modified = "2022-12-21"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2343-L2360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2343-L2360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1e96e9c5c56fcbea94d26ce0b3f1548b224a4791"
-		logic_hash = "e63349ede826bc7b0e9c94d122e5b294c11a598fcf7096b80be726146e796a80"
+		logic_hash = "v1_sha256_e63349ede826bc7b0e9c94d122e5b294c11a598fcf7096b80be726146e796a80"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -361940,7 +358759,7 @@ rule SIGNATURE_BASE_Ipsearcher : FILE
 		$s5 = "ipsearcher.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <140KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 140KB and all of them
 }
 rule SIGNATURE_BASE_Ms10048_X64 : FILE
 {
@@ -361951,10 +358770,10 @@ rule SIGNATURE_BASE_Ms10048_X64 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2362-L2378"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2362-L2378"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
-		logic_hash = "f6e353a9e4f751632ca5fda1663f0ba66b16b60df90570ccdaf836eaaa6a78ca"
+		logic_hash = "v1_sha256_f6e353a9e4f751632ca5fda1663f0ba66b16b60df90570ccdaf836eaaa6a78ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361967,7 +358786,7 @@ rule SIGNATURE_BASE_Ms10048_X64 : FILE
 		$s4 = "[+] Set to %d exploit half succeeded" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and 1 of them
 }
 rule SIGNATURE_BASE_Hscangui : FILE
 {
@@ -361978,10 +358797,10 @@ rule SIGNATURE_BASE_Hscangui : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2380-L2396"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2380-L2396"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
-		logic_hash = "9c0eb87dcf8aa107b5289d196650aebcf49c24f57a317de0afdadd61fb5bb5b7"
+		logic_hash = "v1_sha256_9c0eb87dcf8aa107b5289d196650aebcf49c24f57a317de0afdadd61fb5bb5b7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -361994,7 +358813,7 @@ rule SIGNATURE_BASE_Hscangui : FILE
 		$s4 = "[%s]: Found \"FTP account: %s/%s\" !!!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 220KB and 2 of them
 }
 rule SIGNATURE_BASE_Goodtoolset_Ms11080 : FILE
 {
@@ -362005,10 +358824,10 @@ rule SIGNATURE_BASE_Goodtoolset_Ms11080 : FILE
 		date = "2015-06-13"
 		modified = "2022-12-21"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2398-L2417"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2398-L2417"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
-		logic_hash = "a5b03dded6146dae48bca962e7c5419c2ea69f8709ae7f2c9355bd178d5d77fb"
+		logic_hash = "v1_sha256_a5b03dded6146dae48bca962e7c5419c2ea69f8709ae7f2c9355bd178d5d77fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362023,7 +358842,7 @@ rule SIGNATURE_BASE_Goodtoolset_Ms11080 : FILE
 		$s6 = "[>] ms11-08 Exploit" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 240KB and 2 of them
 }
 rule SIGNATURE_BASE_Epathobj_Exp64 : FILE
 {
@@ -362034,10 +358853,10 @@ rule SIGNATURE_BASE_Epathobj_Exp64 : FILE
 		date = "2015-06-13"
 		modified = "2022-12-21"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2419-L2438"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2419-L2438"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "09195ba4e25ccce35c188657957c0f2c6a61d083"
-		logic_hash = "dc4073a7d319cffbbce7b3c7b7cf02b007839b72fe14ec1fbdcd3343d57cf7bf"
+		logic_hash = "v1_sha256_dc4073a7d319cffbbce7b3c7b7cf02b007839b72fe14ec1fbdcd3343d57cf7bf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362052,7 +358871,7 @@ rule SIGNATURE_BASE_Epathobj_Exp64 : FILE
 		$s6 = "- inconsistent onexit begin-end variables" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them
 }
 rule SIGNATURE_BASE_Kelloworld_2 : FILE
 {
@@ -362063,10 +358882,10 @@ rule SIGNATURE_BASE_Kelloworld_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2440-L2455"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2440-L2455"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
-		logic_hash = "a575c30c06bd84196cbf01a9b5ef3a042cf29553610421b019227d30a2c7ad1c"
+		logic_hash = "v1_sha256_a575c30c06bd84196cbf01a9b5ef3a042cf29553610421b019227d30a2c7ad1c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362078,7 +358897,7 @@ rule SIGNATURE_BASE_Kelloworld_2 : FILE
 		$s3 = "kelloworld de mimikatz pour Windows" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_Hscan_V1_20_Hscan : FILE
 {
@@ -362089,10 +358908,10 @@ rule SIGNATURE_BASE_Hscan_V1_20_Hscan : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2457-L2474"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2457-L2474"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
-		logic_hash = "8e30c366c5d5c34a7b50ba4dec17a46c173196b773fff6965891802bcebeb112"
+		logic_hash = "v1_sha256_8e30c366c5d5c34a7b50ba4dec17a46c173196b773fff6965891802bcebeb112"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362106,7 +358925,7 @@ rule SIGNATURE_BASE_Hscan_V1_20_Hscan : FILE
 		$s5 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
 }
 rule SIGNATURE_BASE__Project1_Generate_Rejoice : FILE
 {
@@ -362117,9 +358936,9 @@ rule SIGNATURE_BASE__Project1_Generate_Rejoice : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2476-L2497"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b66bb4d392881468b33a8ee4458f33bfe7a82d34cc3927eedccd54ad94ff6a04"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2476-L2497"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b66bb4d392881468b33a8ee4458f33bfe7a82d34cc3927eedccd54ad94ff6a04"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362138,7 +358957,7 @@ rule SIGNATURE_BASE__Project1_Generate_Rejoice : FILE
 		$s6 = "Citadel hooking error" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE__Hscan_Hscan_Hscangui : FILE
 {
@@ -362149,9 +358968,9 @@ rule SIGNATURE_BASE__Hscan_Hscan_Hscangui : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2499-L2519"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5466c3dd8b2b777186bfab9d0948905eb3692ce05cf4748fb5b7b896dc3cb251"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2499-L2519"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5466c3dd8b2b777186bfab9d0948905eb3692ce05cf4748fb5b7b896dc3cb251"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362169,7 +358988,7 @@ rule SIGNATURE_BASE__Hscan_Hscan_Hscangui : FILE
 		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 240KB and all of them
 }
 rule SIGNATURE_BASE_Kiwi_Tools : FILE
 {
@@ -362180,9 +358999,9 @@ rule SIGNATURE_BASE_Kiwi_Tools : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2521-L2554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ce7b3c7d57740257013d9d589444a3b53e81254619bd3f09ece917c70bba03ce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2521-L2554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ce7b3c7d57740257013d9d589444a3b53e81254619bd3f09ece917c70bba03ce"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362213,7 +359032,7 @@ rule SIGNATURE_BASE_Kiwi_Tools : FILE
 		$s3 = "GlobalSign" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_Kiwi_Tools_Gentil_Kiwi : FILE
 {
@@ -362224,9 +359043,9 @@ rule SIGNATURE_BASE_Kiwi_Tools_Gentil_Kiwi : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_hacktools.yar#L2556-L2587"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1a88bb31e985ae2119b578494ce9130204b41eece5929865c0822cdc82eaba75"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_hacktools.yar#L2556-L2587"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1a88bb31e985ae2119b578494ce9130204b41eece5929865c0822cdc82eaba75"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362255,7 +359074,7 @@ rule SIGNATURE_BASE_Kiwi_Tools_Gentil_Kiwi : FILE
 		$s3 = "Gentil Kiwi" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_Powershdll
 {
@@ -362266,9 +359085,9 @@ rule SIGNATURE_BASE_Powershdll
 		date = "2017-08-03"
 		modified = "2023-12-05"
 		reference = "https://github.com/p3nt4/PowerShdll"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershdll.yar#L9-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6c93eca642cc29e6ce661e6ea975bc1a88fff4e6a4825c1da3f82b3a6701392a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershdll.yar#L9-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6c93eca642cc29e6ce661e6ea975bc1a88fff4e6a4825c1da3f82b3a6701392a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -362293,9 +359112,9 @@ rule SIGNATURE_BASE_MAL_Compromised_Cert_Ducktail_Stealer_Jun23 : FILE
 		date = "2023-06-16"
 		modified = "2023-08-12"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_ducktail_compromised_certs_jun23.yar#L2-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9b7916700359d662e99003727f5293f5a937254ff265c3bc8bb8763e196daa0e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_ducktail_compromised_certs_jun23.yar#L2-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9b7916700359d662e99003727f5293f5a937254ff265c3bc8bb8763e196daa0e"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -362324,7 +359143,7 @@ rule SIGNATURE_BASE_MAL_Compromised_Cert_Ducktail_Stealer_Jun23 : FILE
 		$se14 = {57 9E 5C 89 B0 85 A7 96 B3 3C F3 19}
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($sx*) and 1 of ($se*)
+		uint16( 0 ) == 0x5a4d and 1 of ( $sx* ) and 1 of ( $se* )
 }
 rule SIGNATURE_BASE_MAL_Github_Repo_Compromise_Myjino_Ru_Aug22
 {
@@ -362335,9 +359154,9 @@ rule SIGNATURE_BASE_MAL_Github_Repo_Compromise_Myjino_Ru_Aug22
 		date = "2022-08-03"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/stephenlacy/status/1554697077430505473"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_repo_compromise_myjino_ru.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5cbe6ee46a68d89b1e772762e29baa907458235cd014f20a0d0932e95c046f19"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_repo_compromise_myjino_ru.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5cbe6ee46a68d89b1e772762e29baa907458235cd014f20a0d0932e95c046f19"
 		score = 90
 		quality = 85
 		tags = ""
@@ -362358,9 +359177,9 @@ rule SIGNATURE_BASE_Ysoserial_Payload_Mozillarhino1 : FILE
 		date = "2017-02-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ysoserial_payloads.yar#L10-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ca8cdd2781812ed373ca558b3a5a2fac5d236e16e6dbb8d66caa45081aef968b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ysoserial_payloads.yar#L10-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ca8cdd2781812ed373ca558b3a5a2fac5d236e16e6dbb8d66caa45081aef968b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362371,7 +359190,7 @@ rule SIGNATURE_BASE_Ysoserial_Payload_Mozillarhino1 : FILE
 		$s3 = "ysoserial.payloads" fullword ascii
 
 	condition:
-		( uint16(0)==0xedac and filesize <40KB and all of them )
+		( uint16( 0 ) == 0xedac and filesize < 40KB and all of them )
 }
 rule SIGNATURE_BASE_Ysoserial_Payload_C3P0 : FILE
 {
@@ -362382,9 +359201,9 @@ rule SIGNATURE_BASE_Ysoserial_Payload_C3P0 : FILE
 		date = "2017-02-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ysoserial_payloads.yar#L25-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "53188caff69e1dbf655f4df7cda1406dd357af14a92ca4e686f514299b0adafc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ysoserial_payloads.yar#L25-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_53188caff69e1dbf655f4df7cda1406dd357af14a92ca4e686f514299b0adafc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362395,7 +359214,7 @@ rule SIGNATURE_BASE_Ysoserial_Payload_C3P0 : FILE
 		$x1 = "exploitppppw" fullword ascii
 
 	condition:
-		( uint16(0)==0xedac and filesize <3KB and all of them )
+		( uint16( 0 ) == 0xedac and filesize < 3KB and all of them )
 }
 rule SIGNATURE_BASE_Ysoserial_Payload_Spring1
 {
@@ -362406,9 +359225,9 @@ rule SIGNATURE_BASE_Ysoserial_Payload_Spring1
 		date = "2017-02-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ysoserial_payloads.yar#L40-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "852390d242c5cac243b54c31234c0ef3e25cede376eea23c73f03d79c548be8a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ysoserial_payloads.yar#L40-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_852390d242c5cac243b54c31234c0ef3e25cede376eea23c73f03d79c548be8a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -362436,9 +359255,9 @@ rule SIGNATURE_BASE_Ysoserial_Payload : FILE
 		date = "2017-02-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ysoserial_payloads.yar#L61-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eec48af8bd3b377c8dd5af71027f67b36e1bd4d4ccfbd8134a26783517b5585a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ysoserial_payloads.yar#L61-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eec48af8bd3b377c8dd5af71027f67b36e1bd4d4ccfbd8134a26783517b5585a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362464,7 +359283,7 @@ rule SIGNATURE_BASE_Ysoserial_Payload : FILE
 		$s2 = "Pwnrpw" fullword ascii
 
 	condition:
-		( uint16(0)==0xedac and filesize <40KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0xedac and filesize < 40KB and $x1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_Ysoserial_Payload_3 : FILE
 {
@@ -362475,9 +359294,9 @@ rule SIGNATURE_BASE_Ysoserial_Payload_3 : FILE
 		date = "2017-02-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ysoserial_payloads.yar#L92-L113"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49491d1c15af8c271fbbb7dedc678a91df74dcb093abe3f056b1ffc2fced99fe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ysoserial_payloads.yar#L92-L113"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49491d1c15af8c271fbbb7dedc678a91df74dcb093abe3f056b1ffc2fced99fe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362495,10 +359314,8 @@ rule SIGNATURE_BASE_Ysoserial_Payload_3 : FILE
 		$s5 = "PRE_DESTROYsq" fullword ascii
 
 	condition:
-		( uint16(0)==0xedac and filesize <10KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0xedac and filesize < 10KB and $x1 ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_1 : FILE
 {
 	meta:
@@ -362508,9 +359325,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_1 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6e94111abe83aa500bfa35a3a7c2d43c3ed4011bc540401f047e84cfc27204ca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6e94111abe83aa500bfa35a3a7c2d43c3ed4011bc540401f047e84cfc27204ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362524,10 +359341,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_1 : FILE
 		$s4 = "chksrv" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_2 : FILE
 {
 	meta:
@@ -362537,9 +359352,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_2 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L31-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ddd3dee11e25ea40fa3cc578c6a836ea850359a5914d5eb5d16ea4340827b91b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L31-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ddd3dee11e25ea40fa3cc578c6a836ea850359a5914d5eb5d16ea4340827b91b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362552,10 +359367,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_2 : FILE
 		$s3 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_3 : FILE
 {
 	meta:
@@ -362565,9 +359378,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_3 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L48-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f1617829ccf7da6ee2e9f692fbf1f61d3f1c6a17103db85190d6a8b4fca69328"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L48-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f1617829ccf7da6ee2e9f692fbf1f61d3f1c6a17103db85190d6a8b4fca69328"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362579,10 +359392,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_3 : FILE
 		$s2 = "C:\\Windows\\SysNative\\sysprep\\cryptbase.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_4 : FILE
 {
 	meta:
@@ -362592,9 +359403,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_4 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L64-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f258070054a29cbec0876536d295b85c7bd9f23988d1e0fc2ba58660b0796716"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L64-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f258070054a29cbec0876536d295b85c7bd9f23988d1e0fc2ba58660b0796716"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362613,10 +359424,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_4 : FILE
 		$s9 = "\\info.config" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_5 : FILE
 {
 	meta:
@@ -362626,9 +359435,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_5 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L87-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f2d4cfd55017ebb34fb6e8ad1b0b46b184926c69d4bacee88dc639771f96792"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L87-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f2d4cfd55017ebb34fb6e8ad1b0b46b184926c69d4bacee88dc639771f96792"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362640,10 +359449,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_5 : FILE
 		$s5 = "c:\\windows\\spdir.dat" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_6 : FILE
 {
 	meta:
@@ -362653,9 +359460,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_6 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L103-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f6cc84ebed26a0dbecfcb3ffb3a11c111ae3d5b40497d59ada518d33bee57fdd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L103-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f6cc84ebed26a0dbecfcb3ffb3a11c111ae3d5b40497d59ada518d33bee57fdd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362666,10 +359473,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_6 : FILE
 		$s1 = "C:\\Windows\\system32\\Instell.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_7 : FILE
 {
 	meta:
@@ -362679,9 +359484,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_7 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L118-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "198f8869e56d5549d9195524a86f6557162c5d25b4915bec0bf513797d880ea1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L118-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_198f8869e56d5549d9195524a86f6557162c5d25b4915bec0bf513797d880ea1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362692,10 +359497,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_7 : FILE
 		$s1 = "C:\\runme.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_8 : FILE
 {
 	meta:
@@ -362705,9 +359508,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_8 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L133-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6c8ddc7fb5f3256e57e66f502f6e3c582d82540f773bf4113cac4a685d45f81b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L133-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6c8ddc7fb5f3256e57e66f502f6e3c582d82540f773bf4113cac4a685d45f81b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362720,7 +359523,7 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_8 : FILE
 		$x3 = ".ExpandEnvironmentStrings('%Temp%')+unescape('" ascii
 
 	condition:
-		filesize <10KB and 1 of ($x*)
+		filesize < 10KB and 1 of ( $x* )
 }
 import "pe"
 
@@ -362733,9 +359536,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_9 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L150-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0500481ae4bb7d4a223a106d2887b994e5000815704e678b2f3ff127a86c22a2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L150-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0500481ae4bb7d4a223a106d2887b994e5000815704e678b2f3ff127a86c22a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362746,10 +359549,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_9 : FILE
 		hash4 = "0c49d1632eb407b5fd0ce32ed45b1c783ac2ef60d001853ae1f6b7574e08cfa9"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="a7f0714e82b3105031fa7bc89dfe7664" or pe.imphash()=="8812ff21aeb160e8800257140acae54b" or pe.imphash()=="44a1e904763fe2d0837c747c7061b010" or pe.imphash()=="51a854d285aa12eb82e76e6e1be01573" or pe.imphash()=="a1f457c8c549c5c430556bfe5887a4e6")
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "a7f0714e82b3105031fa7bc89dfe7664" or pe.imphash ( ) == "8812ff21aeb160e8800257140acae54b" or pe.imphash ( ) == "44a1e904763fe2d0837c747c7061b010" or pe.imphash ( ) == "51a854d285aa12eb82e76e6e1be01573" or pe.imphash ( ) == "a1f457c8c549c5c430556bfe5887a4e6" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_10 : FILE
 {
 	meta:
@@ -362759,9 +359560,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_10 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L172-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "79a8dfd63e96ccc9259272476e364e53b841b42255a2a5f3b9f93e91caa5d1c2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L172-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_79a8dfd63e96ccc9259272476e364e53b841b42255a2a5f3b9f93e91caa5d1c2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362775,7 +359576,7 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_10 : FILE
 		$s2 = "constructor or from DllMain." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ($x1 or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( $x1 or 2 of them )
 }
 import "pe"
 
@@ -362788,9 +359589,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_11 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L191-L210"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "066fc3622a0db5cc511e85f6efc08191c2c9268524c8761dc17a05e6d133c263"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L191-L210"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_066fc3622a0db5cc511e85f6efc08191c2c9268524c8761dc17a05e6d133c263"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362806,10 +359607,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_11 : FILE
 		$s6 = "WQZXQFPVOW" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="6eef4394490378f32d134ab3bf4bf194" or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "6eef4394490378f32d134ab3bf4bf194" or all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_12 : FILE
 {
 	meta:
@@ -362819,9 +359618,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_12 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L212-L234"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49357a34f3b1d0bb86d1c6ddfa6a6c3b92bfafaebd050d835c0a902199a2121b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L212-L234"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49357a34f3b1d0bb86d1c6ddfa6a6c3b92bfafaebd050d835c0a902199a2121b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362841,7 +359640,7 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_12 : FILE
 		$s0 = "%s\\%s\\%s%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 6 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 6 of them
 }
 import "pe"
 
@@ -362854,9 +359653,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_13 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L236-L254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c319a3ca78687cd2af77d97b4b4a8e72dadd812bf3da2145a23df278c3aa9a2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L236-L254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c319a3ca78687cd2af77d97b4b4a8e72dadd812bf3da2145a23df278c3aa9a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362871,7 +359670,7 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_13 : FILE
 		$s5 = "ipecho.net" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="3dfad33b2fb66c083c99dc10341908b7" or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "3dfad33b2fb66c083c99dc10341908b7" or 4 of them )
 }
 import "pe"
 
@@ -362884,9 +359683,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_14 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L256-L276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c96a40495bc2a17a6215c877ad054bd2e1e10c524c2d54da1955d370b9ccdcd7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L256-L276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c96a40495bc2a17a6215c877ad054bd2e1e10c524c2d54da1955d370b9ccdcd7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362901,7 +359700,7 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_14 : FILE
 		$s5 = "Load %s Error" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ((pe.exports("InstallA") and pe.exports("InstallB") and pe.exports("InstallC")) or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( ( pe.exports ( "InstallA" ) and pe.exports ( "InstallB" ) and pe.exports ( "InstallC" ) ) or all of them )
 }
 import "pe"
 
@@ -362914,9 +359713,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_15 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L278-L299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "22769d215e52965f48eb3455b39fbd8f8ce950a67f8132612d42b78fde9822a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L278-L299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_22769d215e52965f48eb3455b39fbd8f8ce950a67f8132612d42b78fde9822a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362934,7 +359733,7 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_15 : FILE
 		$s8 = "%s\\%s\\%s%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="f6ec70a295000ab0a753aa708e9439b4" or 6 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "f6ec70a295000ab0a753aa708e9439b4" or 6 of them )
 }
 import "pe"
 
@@ -362947,9 +359746,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_16 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L301-L317"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "950ece29e8fd056e3506684bce9b16eb185d63c1b020e4911972f5fcbdadbe30"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L301-L317"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_950ece29e8fd056e3506684bce9b16eb185d63c1b020e4911972f5fcbdadbe30"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362962,10 +359761,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_16 : FILE
 		$s3 = "[%d] Offset can not fetched." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ( all of them or pe.imphash()=="c6a4c95d868a3327a62c9c45f5e15bbf")
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of them or pe.imphash ( ) == "c6a4c95d868a3327a62c9c45f5e15bbf" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_17 : FILE
 {
 	meta:
@@ -362975,9 +359772,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_17 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L319-L343"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0724e07614e704d9ac8a1ae4aecfcf3d9800dde6f83eeecc8427ab6205e321a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L319-L343"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0724e07614e704d9ac8a1ae4aecfcf3d9800dde6f83eeecc8427ab6205e321a6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -362998,10 +359795,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_17 : FILE
 		$s6 = "hDevice == INVALID_HANDLE_VALUE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (1 of ($x*) and 1 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and ( 1 of ( $x* ) and 1 of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_18 : FILE
 {
 	meta:
@@ -363011,9 +359806,9 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_18 : FILE
 		date = "2018-06-21"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_thrip.yar#L345-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5cac313bd77900e67f0528d660671394915dff7159ca6fa067fd9c392d7c269a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_thrip.yar#L345-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5cac313bd77900e67f0528d660671394915dff7159ca6fa067fd9c392d7c269a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363033,7 +359828,7 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_18 : FILE
 		$s6 = "Computer Sleep key" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_Apolmy_Privesc_Trojan : FILE
 {
@@ -363044,10 +359839,10 @@ rule SIGNATURE_BASE_Apolmy_Privesc_Trojan : FILE
 		date = "2015-08-04"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_terracotta.yar#L11-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_terracotta.yar#L11-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f8111756777d8f373d"
-		logic_hash = "8cce828806d5829735d6ac8d28a48c9b016b96b4370b2f3ac139799a9fe13c4a"
+		logic_hash = "v1_sha256_8cce828806d5829735d6ac8d28a48c9b016b96b4370b2f3ac139799a9fe13c4a"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -363059,7 +359854,7 @@ rule SIGNATURE_BASE_Apolmy_Privesc_Trojan : FILE
 		$s3 = "PowerShadow2011" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Mithozhan_Trojan : FILE
 {
@@ -363070,10 +359865,10 @@ rule SIGNATURE_BASE_Mithozhan_Trojan : FILE
 		date = "2015-08-04"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_terracotta.yar#L29-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_terracotta.yar#L29-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
-		logic_hash = "a7beb030368cc6e1119617991b68e6fa1bf2d1f6eee28e83fef7862313f19d30"
+		logic_hash = "v1_sha256_a7beb030368cc6e1119617991b68e6fa1bf2d1f6eee28e83fef7862313f19d30"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -363085,7 +359880,7 @@ rule SIGNATURE_BASE_Mithozhan_Trojan : FILE
 		$s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Remoteexec_Tool : FILE
 {
@@ -363096,10 +359891,10 @@ rule SIGNATURE_BASE_Remoteexec_Tool : FILE
 		date = "2015-08-04"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_terracotta.yar#L47-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_terracotta.yar#L47-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
-		logic_hash = "951cc65e14c2ff035ccc06d080730b1c25208caa1d30129074a6150557a5cebe"
+		logic_hash = "v1_sha256_951cc65e14c2ff035ccc06d080730b1c25208caa1d30129074a6150557a5cebe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363114,7 +359909,7 @@ rule SIGNATURE_BASE_Remoteexec_Tool : FILE
 		$s5 = "TermHlp_stdin" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <75KB and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 75KB and 4 of ( $s* )
 }
 rule SIGNATURE_BASE_Liudoor_Malware_1 : FILE
 {
@@ -363125,9 +359920,9 @@ rule SIGNATURE_BASE_Liudoor_Malware_1 : FILE
 		date = "2015-08-04"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_terracotta.yar#L69-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ef9fcc5df910e796d8b015396cf37614982ebbf9be6f6a4a8d271d4263a36a9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_terracotta.yar#L69-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ef9fcc5df910e796d8b015396cf37614982ebbf9be6f6a4a8d271d4263a36a9"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -363144,7 +359939,7 @@ rule SIGNATURE_BASE_Liudoor_Malware_1 : FILE
 		$s4 = "DataVersionEx" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
 }
 rule SIGNATURE_BASE_Liudoor_Malware_2 : FILE
 {
@@ -363155,9 +359950,9 @@ rule SIGNATURE_BASE_Liudoor_Malware_2 : FILE
 		date = "2015-08-04"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_terracotta.yar#L91-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "12cc72fb147f2d580f9f9e2a9bdfbec3f7b0e977871a27ccc941cd0b1aaa634c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_terracotta.yar#L91-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_12cc72fb147f2d580f9f9e2a9bdfbec3f7b0e977871a27ccc941cd0b1aaa634c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -363171,7 +359966,7 @@ rule SIGNATURE_BASE_Liudoor_Malware_2 : FILE
 		$s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Cobaltstrike_Resources_Beacon_Dll_V3_8_1
 {
@@ -363182,10 +359977,10 @@ rule SIGNATURE_BASE_Cobaltstrike_Resources_Beacon_Dll_V3_8_1
 		date = "2022-11-18"
 		modified = "2023-12-05"
 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_gcti_cobaltstrike.yar#L1020-L1061"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_gcti_cobaltstrike.yar#L1020-L1061"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603"
-		logic_hash = "cde078a6ae7d0d835900e85498cf5ae20663ba8d5d3f912810e157261561e16a"
+		logic_hash = "v1_sha256_cde078a6ae7d0d835900e85498cf5ae20663ba8d5d3f912810e157261561e16a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -363199,20 +359994,20 @@ rule SIGNATURE_BASE_Cobaltstrike_Resources_Beacon_Dll_V3_8_1
 		$c2_3 = "ns9.softline.top" xor
 
 	condition:
-		$version_sig and $decoder and (2 of ($c2_*) or $xmrig_srcpath)
+		$version_sig and $decoder and ( 2 of ( $c2_* ) or $xmrig_srcpath )
 }
 rule SIGNATURE_BASE_APT_APT28_Generic_Poco_Openssl
 {
 	meta:
 		description = "Rule to detect statically linked POCO and OpenSSL libraries (COULD be Drovorub related and should be further investigated)"
 		author = "NSA / FBI"
-		id = "b6d2477b-c9a2-5858-87cf-aa006109bc8f"
+		id = "cab3f67e-e239-5aa6-b691-8c6e2c620b5a"
 		date = "2020-08-13"
 		modified = "2023-12-05"
 		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28_drovorub.yar#L1-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b6a78c358b3aee6b172ec29e72ce810c6fbf332f180d5879f0889f47688225e1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28_drovorub.yar#L1-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b6a78c358b3aee6b172ec29e72ce810c6fbf332f180d5879f0889f47688225e1"
 		score = 50
 		quality = 85
 		tags = ""
@@ -363239,9 +360034,9 @@ rule SIGNATURE_BASE_APT_APT28_Drovorub_Library_And_Unique_Strings : FILE
 		date = "2020-08-13"
 		modified = "2023-12-05"
 		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28_drovorub.yar#L23-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "adb0d4cb6d589213e6a125d3cc20fcea8164b697bdd24d897ce75e7c7f06120a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28_drovorub.yar#L23-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_adb0d4cb6d589213e6a125d3cc20fcea8164b697bdd24d897ce75e7c7f06120a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363256,7 +360051,7 @@ rule SIGNATURE_BASE_APT_APT28_Drovorub_Library_And_Unique_Strings : FILE
 		$a4 = "tunnel" ascii wide
 
 	condition:
-		( filesize >1MB and filesize <10MB and ( uint32(0)==0x464c457f)) and (#s1>20 and #s2>15 and #s3>15 and all of ($a*))
+		( filesize > 1MB and filesize < 10MB and ( uint32( 0 ) == 0x464c457f ) ) and ( #s1 > 20 and #s2 > 15 and #s3 > 15 and all of ( $a* ) )
 }
 rule SIGNATURE_BASE_APT_APT28_Drovorub_Unique_Network_Comms_Strings
 {
@@ -363267,9 +360062,9 @@ rule SIGNATURE_BASE_APT_APT28_Drovorub_Unique_Network_Comms_Strings
 		date = "2020-08-13"
 		modified = "2023-12-05"
 		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt28_drovorub.yar#L44-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8c82766b76c36fe64c6aa99577e1997d7181dbd36a4c27329845ae8a413f5327"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt28_drovorub.yar#L44-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8c82766b76c36fe64c6aa99577e1997d7181dbd36a4c27329845ae8a413f5327"
 		score = 75
 		quality = 85
 		tags = ""
@@ -363305,9 +360100,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Metasploitpayload : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1399818f71544245a7b689a7eb4da794b10814590e4c5f545fc28237ffa3d0f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1399818f71544245a7b689a7eb4da794b10814590e4c5f545fc28237ffa3d0f6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363319,7 +360114,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Metasploitpayload : FILE
 		$s2 = "$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <9KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 9KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Exploit_Jenkins : FILE
 {
@@ -363330,9 +360125,9 @@ rule SIGNATURE_BASE_Empire_Exploit_Jenkins : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L26-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "caf65814a1aeb0e14ec6430f7d5692b9c090bdc0d453566f0b0abd703f74bac7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L26-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_caf65814a1aeb0e14ec6430f7d5692b9c090bdc0d453566f0b0abd703f74bac7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363345,7 +360140,7 @@ rule SIGNATURE_BASE_Empire_Exploit_Jenkins : FILE
 		$s3 = "$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)" fullword ascii
 
 	condition:
-		( uint16(0)==0x6620 and filesize <7KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x6620 and filesize < 7KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Get_Securitypackages : FILE
 {
@@ -363356,9 +360151,9 @@ rule SIGNATURE_BASE_Empire_Get_Securitypackages : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L43-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d63fdcc6713d2f7645b16cf3e79a6e951c7751a10bfa0e2853def47ea9547d2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L43-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d63fdcc6713d2f7645b16cf3e79a6e951c7751a10bfa0e2853def47ea9547d2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363370,7 +360165,7 @@ rule SIGNATURE_BASE_Empire_Get_Securitypackages : FILE
 		$s2 = "$EnumBuilder = $ModuleBuilder.DefineEnum('SSPI.SECPKG_FLAG', 'Public', [Int32])" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <20KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 20KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Powerdump : FILE
 {
@@ -363381,9 +360176,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Powerdump : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L59-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e460d015be54a88d0eb5741a9c32cf6d7a410e0beb5356402af0dd19d1b4c6f2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L59-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e460d015be54a88d0eb5741a9c32cf6d7a410e0beb5356402af0dd19d1b4c6f2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363396,7 +360191,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Powerdump : FILE
 		$x20 = "$rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);" fullword ascii
 
 	condition:
-		( uint16(0)==0x2023 and filesize <60KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x2023 and filesize < 60KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Install_SSP : FILE
 {
@@ -363407,9 +360202,9 @@ rule SIGNATURE_BASE_Empire_Install_SSP : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L76-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf0966d0141d4606983f267face635ef5fddbc73282f02f0a0ae6fcf89f2e6dc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L76-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf0966d0141d4606983f267face635ef5fddbc73282f02f0a0ae6fcf89f2e6dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363420,7 +360215,7 @@ rule SIGNATURE_BASE_Empire_Install_SSP : FILE
 		$s1 = "Install-SSP -Path .\\mimilib.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <20KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 20KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Shellcodemsil : FILE
 {
@@ -363431,9 +360226,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Shellcodemsil : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L91-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb556fb8b558145e7e981ab3c3ccfb2656512498b917c705e53bc5b9f3650155"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L91-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb556fb8b558145e7e981ab3c3ccfb2656512498b917c705e53bc5b9f3650155"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363447,7 +360242,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Shellcodemsil : FILE
 		$s4 = "$TargetMethod.Invoke($null, @(0x11112222)) | Out-Null" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_HKTL_Empire_Powerup : FILE
 {
@@ -363458,9 +360253,9 @@ rule SIGNATURE_BASE_HKTL_Empire_Powerup : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L109-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d55674866a1a14d4f4c2b5529e47e005ca4b433383bf112af6da41d7f84afdb7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L109-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d55674866a1a14d4f4c2b5529e47e005ca4b433383bf112af6da41d7f84afdb7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363471,7 +360266,7 @@ rule SIGNATURE_BASE_HKTL_Empire_Powerup : FILE
 		$x2 = "$PoolPasswordCmd = 'c:\\windows\\system32\\inetsrv\\appcmd.exe list apppool" fullword ascii
 
 	condition:
-		( uint16(0)==0x233c and filesize <2000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x233c and filesize < 2000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Mimikatz_Gen : FILE
 {
@@ -363482,9 +360277,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Mimikatz_Gen : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L124-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a28297025b9b0178ab437996ffd3e0c28526f1edaf61db659093fe41a356cf40"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L124-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a28297025b9b0178ab437996ffd3e0c28526f1edaf61db659093fe41a356cf40"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363496,7 +360291,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Mimikatz_Gen : FILE
 		$s2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Get_Gpppassword : FILE
 {
@@ -363507,9 +360302,9 @@ rule SIGNATURE_BASE_Empire_Get_Gpppassword : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L140-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c879e50805e8b89fc8f3a7c7da2c8e906c89f210ab74194daca6b0ba2d312ba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L140-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c879e50805e8b89fc8f3a7c7da2c8e906c89f210ab74194daca6b0ba2d312ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363522,7 +360317,7 @@ rule SIGNATURE_BASE_Empire_Get_Gpppassword : FILE
 		$s3 = "function Get-DecryptedCpassword {" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Smbscanner : FILE
 {
@@ -363533,9 +360328,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Smbscanner : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L157-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5feb32dd0fc5271256dc4a088b9b02b591dbe584759db7ee4f5a6c99f42c3c0c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L157-L171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5feb32dd0fc5271256dc4a088b9b02b591dbe584759db7ee4f5a6c99f42c3c0c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363547,7 +360342,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Smbscanner : FILE
 		$s2 = "$out | add-member Noteproperty 'Password' $Password" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <10KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Exploit_Jboss : FILE
 {
@@ -363558,9 +360353,9 @@ rule SIGNATURE_BASE_Empire_Exploit_Jboss : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L173-L190"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a0eef14c3966745a0f2b7eb404eed122a11eea2fb82884ebd2087b3ab90bff93"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L173-L190"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a0eef14c3966745a0f2b7eb404eed122a11eea2fb82884ebd2087b3ab90bff93"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363575,7 +360370,7 @@ rule SIGNATURE_BASE_Empire_Exploit_Jboss : FILE
 		$s5 = "Remote URL to your own WARFile to deploy." fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <10KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Dumpcredstore : FILE
 {
@@ -363586,9 +360381,9 @@ rule SIGNATURE_BASE_Empire_Dumpcredstore : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L192-L207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7136920e531d7ab621e743c5c89c0d817fe453108878e3c808814ca48ad57fb3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L192-L207"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7136920e531d7ab621e743c5c89c0d817fe453108878e3c808814ca48ad57fb3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363601,7 +360396,7 @@ rule SIGNATURE_BASE_Empire_Dumpcredstore : FILE
 		$s15 = "Rtn = CredRead(\"Target\", CRED_TYPE.GENERIC, out Cred);" fullword ascii
 
 	condition:
-		( uint16(0)==0x233c and filesize <40KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x233c and filesize < 40KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Egresscheck : FILE
 {
@@ -363612,9 +360407,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Egresscheck : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L209-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "693564e0bd98ebd03cd433d8ba1003051a5cf6b1f0c05d3c5a4682e6d667327e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L209-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_693564e0bd98ebd03cd433d8ba1003051a5cf6b1f0c05d3c5a4682e6d667327e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363625,7 +360420,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Egresscheck : FILE
 		$s1 = "egress -ip $ip -port $c -delay $delay -protocol $protocol" fullword ascii
 
 	condition:
-		( uint16(0)==0x233c and filesize <10KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x233c and filesize < 10KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Reflectivepick_X64_Orig : FILE
 {
@@ -363636,9 +360431,9 @@ rule SIGNATURE_BASE_Empire_Reflectivepick_X64_Orig : FILE
 		date = "2016-11-05"
 		modified = "2022-12-21"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L224-L240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a87c5f1da9c490887cba5e9837ca40ac92b63d8c36b682f4be770ac061b5acdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L224-L240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a87c5f1da9c490887cba5e9837ca40ac92b63d8c36b682f4be770ac061b5acdf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363650,7 +360445,7 @@ rule SIGNATURE_BASE_Empire_Reflectivepick_X64_Orig : FILE
 		$s1 = "ReflectivePick" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of ($a*) and $s1
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of ( $a* ) and $s1
 }
 rule SIGNATURE_BASE_Empire_Out_Minidump : FILE
 {
@@ -363661,9 +360456,9 @@ rule SIGNATURE_BASE_Empire_Out_Minidump : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L242-L256"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ce4ac95ac942a2ad758b1d9034e6ec50d25d195ba1c2ae95a90a7490708e485"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L242-L256"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ce4ac95ac942a2ad758b1d9034e6ec50d25d195ba1c2ae95a90a7490708e485"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363675,7 +360470,7 @@ rule SIGNATURE_BASE_Empire_Out_Minidump : FILE
 		$s2 = "$ProcessFileName = \"$($ProcessName)_$($ProcessId).dmp\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <10KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Psexec : FILE
 {
@@ -363686,9 +360481,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Psexec : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L258-L273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "86af63a3be5b4940966932b129edbe4cca5ac1a31d120ba44fdca739e9c97ad4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L258-L273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_86af63a3be5b4940966932b129edbe4cca5ac1a31d120ba44fdca739e9c97ad4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363701,7 +360496,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Psexec : FILE
 		$s3 = "$cmd = \"%COMSPEC% /C echo $Command ^> %systemroot%\\Temp\\" ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <50KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 50KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Postexfil : FILE
 {
@@ -363712,9 +360507,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Postexfil : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L275-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "74602d1c4986e6392df8845e0ed713499aa3b93c64e9d68e95f9dbaf60fe4299"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L275-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_74602d1c4986e6392df8845e0ed713499aa3b93c64e9d68e95f9dbaf60fe4299"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363726,7 +360521,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Postexfil : FILE
 		$s2 = "Server path to exfil to." fullword ascii
 
 	condition:
-		( uint16(0)==0x490a and filesize <2KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x490a and filesize < 2KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Smbautobrute : FILE
 {
@@ -363737,9 +360532,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Smbautobrute : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L291-L305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd87a5d3a710017953c8c19862e4daee25de0e57175cab8246eea6d067fcb4d1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L291-L305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd87a5d3a710017953c8c19862e4daee25de0e57175cab8246eea6d067fcb4d1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363751,7 +360546,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Smbautobrute : FILE
 		$s2 = "$attempts = Get-UserBadPwdCount $userid $dcs" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Get_Keystrokes : FILE
 {
@@ -363762,9 +360557,9 @@ rule SIGNATURE_BASE_Empire_Get_Keystrokes : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L307-L320"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "710e1bbf517c6683bd3082786e605cb8e6a52460f9c96609610e5ab38800dc79"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L307-L320"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_710e1bbf517c6683bd3082786e605cb8e6a52460f9c96609610e5ab38800dc79"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363775,7 +360570,7 @@ rule SIGNATURE_BASE_Empire_Get_Keystrokes : FILE
 		$s1 = "$RightMouse   = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RButton) -band 0x8000) -eq 0x8000" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Dllinjection : FILE
 {
@@ -363786,9 +360581,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Dllinjection : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L322-L335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "450ca96dd7c80275d7e4eaf07a7229e27530c373b8d79af5be8f4a741daef448"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L322-L335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_450ca96dd7c80275d7e4eaf07a7229e27530c373b8d79af5be8f4a741daef448"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363799,7 +360594,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Dllinjection : FILE
 		$s1 = "-Dll evil.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <40KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 40KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Keepassconfig : FILE
 {
@@ -363810,9 +360605,9 @@ rule SIGNATURE_BASE_Empire_Keepassconfig : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L337-L350"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "044c8a326ee6cc74a918e6c28100032bfd2fb396ddab8683ab11e00f9370ab2a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L337-L350"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_044c8a326ee6cc74a918e6c28100032bfd2fb396ddab8683ab11e00f9370ab2a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363823,7 +360618,7 @@ rule SIGNATURE_BASE_Empire_Keepassconfig : FILE
 		$s1 = "$UserMasterKeyFiles = @(, $(Get-ChildItem -Path $UserMasterKeyFolder -Force | Select-Object -ExpandProperty FullName) )" fullword ascii
 
 	condition:
-		( uint16(0)==0x7223 and filesize <80KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7223 and filesize < 80KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Sshcommand : FILE
 {
@@ -363834,9 +360629,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Sshcommand : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L352-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3749c3d58335cb08bff66fe3126fc4977261576a9fbedbd7da673e3921364850"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L352-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3749c3d58335cb08bff66fe3126fc4977261576a9fbedbd7da673e3921364850"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363849,7 +360644,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Sshcommand : FILE
 		$s3 = "Write-Verbose \"[*] Error loading dll\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x660a and filesize <2000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x660a and filesize < 2000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen1 : FILE
 {
@@ -363860,9 +360655,9 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen1 : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L371-L390"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "074423d30c5ef419d1ca9433477d8a896086cec84eb939270ce51d3965b6b1a2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L371-L390"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_074423d30c5ef419d1ca9433477d8a896086cec84eb939270ce51d3965b6b1a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363879,7 +360674,7 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen1 : FILE
 		$s2 = "$GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length)" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Powerup_Gen : FILE
 {
@@ -363890,9 +360685,9 @@ rule SIGNATURE_BASE_Empire_Powerup_Gen : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L392-L407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4086b057b46cac85bb871d2d4363d4ae4c99a160e5c9625e4d41e3df55fece2d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L392-L407"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4086b057b46cac85bb871d2d4363d4ae4c99a160e5c9625e4d41e3df55fece2d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363905,7 +360700,7 @@ rule SIGNATURE_BASE_Empire_Powerup_Gen : FILE
 		$s2 = "$Result = sc.exe pause $($TargetService.Name)" fullword ascii
 
 	condition:
-		( uint16(0)==0x233c and filesize <2000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x233c and filesize < 2000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen2 : FILE
 {
@@ -363916,9 +360711,9 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen2 : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L409-L428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e3cb63d0c3278ee4d04cb4b1d6ebe817fb3da97d25e2581f95bd43ecd5142b30"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L409-L428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e3cb63d0c3278ee4d04cb4b1d6ebe817fb3da97d25e2581f95bd43ecd5142b30"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363935,7 +360730,7 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen2 : FILE
 		$s20 = "#Shellcode: CallDllMain.asm" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Agent_Gen : FILE
 {
@@ -363946,9 +360741,9 @@ rule SIGNATURE_BASE_Empire_Agent_Gen : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L430-L447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed8aee7ac6c1d93b21cc1aa5c3c18df1566692c63a010715a3aae65e18fffa60"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L430-L447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed8aee7ac6c1d93b21cc1aa5c3c18df1566692c63a010715a3aae65e18fffa60"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363963,7 +360758,7 @@ rule SIGNATURE_BASE_Empire_Agent_Gen : FILE
 		$s3 = "if ($script:AgentDelay -ne 0){" fullword ascii
 
 	condition:
-		( uint16(0)==0x660a and filesize <100KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x660a and filesize < 100KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen3 : FILE
 {
@@ -363974,9 +360769,9 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen3 : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L449-L467"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "933fe27c54e90806a21082b4d2e4cbb3491374e48834a64c0d6a520c537d145e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L449-L467"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_933fe27c54e90806a21082b4d2e4cbb3491374e48834a64c0d6a520c537d145e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -363992,7 +360787,7 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen3 : FILE
 		$s2 = "remote DLL injection" ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Inveighrelay_Gen : FILE
 {
@@ -364003,9 +360798,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Inveighrelay_Gen : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L469-L484"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "183a0afa9233e380471ddfa8f85e6c6555d69c785c9a4e8791e19432b6849558"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L469-L484"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_183a0afa9233e380471ddfa8f85e6c6555d69c785c9a4e8791e19432b6849558"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364018,7 +360813,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Inveighrelay_Gen : FILE
 		$s2 = "$NTLM_challenge_base64 = [System.Convert]::ToBase64String($HTTP_NTLM_bytes)" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <200KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 200KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Keepassconfig_Gen : FILE
 {
@@ -364029,9 +360824,9 @@ rule SIGNATURE_BASE_Empire_Keepassconfig_Gen : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L486-L500"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "986f299d2b6e2ec47acae09d8a25b6c45caf83c964208c594433308cd11ad264"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L486-L500"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_986f299d2b6e2ec47acae09d8a25b6c45caf83c964208c594433308cd11ad264"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364043,7 +360838,7 @@ rule SIGNATURE_BASE_Empire_Keepassconfig_Gen : FILE
 		$s1 = "$KeePassXML = [xml](Get-Content -Path $KeePassXMLPath)" fullword ascii
 
 	condition:
-		( uint16(0)==0x7223 and filesize <80KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7223 and filesize < 80KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Portscan_Gen : FILE
 {
@@ -364054,9 +360849,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Portscan_Gen : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L502-L517"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "05e786dc42ee5ec56197803577d104595ad6554e028b7633b2f7fdf55a63e27c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L502-L517"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_05e786dc42ee5ec56197803577d104595ad6554e028b7633b2f7fdf55a63e27c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364069,7 +360864,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Portscan_Gen : FILE
 		$s2 = "1 {$nHosts=10;  $Threads = 32;   $Timeout = 5000 }" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <100KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 100KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen4 : FILE
 {
@@ -364080,9 +360875,9 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen4 : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L519-L545"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "314574a463f9cc772702d5e3358f5280b2805298fedb89c14786518a4832d63b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L519-L545"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_314574a463f9cc772702d5e3358f5280b2805298fedb89c14786518a4832d63b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364106,7 +360901,7 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen4 : FILE
 		$s4 = "$DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Credentialinjection_Invoke_Mimikatz_Gen : FILE
 {
@@ -364117,9 +360912,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Credentialinjection_Invoke_Mimikatz_Gen : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L547-L563"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3210b4407c3209a20d74c8c5af66077cc9b902912ae49253883b7acd87eef1f9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L547-L563"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3210b4407c3209a20d74c8c5af66077cc9b902912ae49253883b7acd87eef1f9"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -364133,7 +360928,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Credentialinjection_Invoke_Mimikatz_Gen : FILE
 		$s2 = "$PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Gen : FILE
 {
@@ -364144,9 +360939,9 @@ rule SIGNATURE_BASE_Empire_Invoke_Gen : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L565-L582"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "11d00ea1f40d34cfd3417db337a01eca39b0e77049f74f0c591cd1d388a8d194"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L565-L582"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_11d00ea1f40d34cfd3417db337a01eca39b0e77049f74f0c591cd1d388a8d194"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364161,7 +360956,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Gen : FILE
 		$s2 = "$PEHandle = [IntPtr]::Zero" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <3000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 3000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen5 : FILE
 {
@@ -364172,9 +360967,9 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen5 : FILE
 		date = "2016-11-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_empire.yar#L584-L601"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "115fffabb09ed00ab46c6f980c3a7727070a303cafa900cc1ce04e3999b6b70e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_empire.yar#L584-L601"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_115fffabb09ed00ab46c6f980c3a7727070a303cafa900cc1ce04e3999b6b70e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364189,7 +360984,7 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen5 : FILE
 		$s2 = "$ExeArgs = \"ReflectiveExe $ExeArgs\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <1000KB and 1 of them ) or all of them
+		( uint16( 0 ) == 0x7566 and filesize < 1000KB and 1 of them ) or all of them
 }
 rule SIGNATURE_BASE_Irongate_APT_Step7Prosim_Gen : FILE
 {
@@ -364200,9 +360995,9 @@ rule SIGNATURE_BASE_Irongate_APT_Step7Prosim_Gen : FILE
 		date = "2016-06-04"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/Mr6M2J"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irongate.yar#L10-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aab41ada32a8186f958baccad08b60ac1ab686f7561d4dd4471a1e88ddd53730"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irongate.yar#L10-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aab41ada32a8186f958baccad08b60ac1ab686f7561d4dd4471a1e88ddd53730"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -364227,7 +361022,7 @@ rule SIGNATURE_BASE_Irongate_APT_Step7Prosim_Gen : FILE
 		$s12 = "FindFileInDrive" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and ($x1 or 3 of ($s*))) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and ( $x1 or 3 of ( $s* ) ) ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_Irongate_Pyinstaller_Update_EXE : FILE
 {
@@ -364238,9 +361033,9 @@ rule SIGNATURE_BASE_Irongate_Pyinstaller_Update_EXE : FILE
 		date = "2016-06-04"
 		modified = "2023-01-06"
 		reference = "https://goo.gl/Mr6M2J"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irongate.yar#L42-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b55e02af900b3510743502bd72d5e14c9235985b5a7b05def0f5c462b28f2216"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irongate.yar#L42-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b55e02af900b3510743502bd72d5e14c9235985b5a7b05def0f5c462b28f2216"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -364256,7 +361051,7 @@ rule SIGNATURE_BASE_Irongate_Pyinstaller_Update_EXE : FILE
 		$s18 = "supdate" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_Nirsoft_Netresview : FILE
 {
@@ -364267,9 +361062,9 @@ rule SIGNATURE_BASE_Nirsoft_Netresview : FILE
 		date = "2016-06-04"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/Mr6M2J"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_irongate.yar#L67-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "56c3c7a98bcefa609ee604ea0d7d3f4dd237d91a9439eeed66e0d6f3a20dfdd0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_irongate.yar#L67-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_56c3c7a98bcefa609ee604ea0d7d3f4dd237d91a9439eeed66e0d6f3a20dfdd0"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -364281,7 +361076,7 @@ rule SIGNATURE_BASE_Nirsoft_Netresview : FILE
 		$s2 = "2005 - 2013 Nir Sofer" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Mywscript_Compiledscript : FILE
 {
@@ -364292,9 +361087,9 @@ rule SIGNATURE_BASE_Mywscript_Compiledscript : FILE
 		date = "2017-07-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mywscript_dropper.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5619de9589e3d34026bf4ec223f2c6b94fcb7362c8f3c26f7582030cfc4385cf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mywscript_dropper.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5619de9589e3d34026bf4ec223f2c6b94fcb7362c8f3c26f7582030cfc4385cf"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -364307,7 +361102,7 @@ rule SIGNATURE_BASE_Mywscript_Compiledscript : FILE
 		$s2 = "MYWSCRIPT2" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and ($x1 or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( $x1 or 2 of them )
 }
 rule SIGNATURE_BASE_Recon_Commands_Windows_Gen1 : FILE
 {
@@ -364318,9 +361113,9 @@ rule SIGNATURE_BASE_Recon_Commands_Windows_Gen1 : FILE
 		date = "2017-07-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/MSJCxP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_recon_indicators.yar#L12-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "36beb09c428949140cb007c1022c385c9a1ae4eea8c1f1a419f96b36b8030c7c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_recon_indicators.yar#L12-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_36beb09c428949140cb007c1022c385c9a1ae4eea8c1f1a419f96b36b8030c7c"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -364352,7 +361147,7 @@ rule SIGNATURE_BASE_Recon_Commands_Windows_Gen1 : FILE
 		$fp3 = ".sublime-settings" ascii
 
 	condition:
-		filesize <1000KB and 4 of them and not 1 of ($fp*)
+		filesize < 1000KB and 4 of them and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Recon_Outputs_Jun20_1 : FILE
 {
@@ -364363,9 +361158,9 @@ rule SIGNATURE_BASE_SUSP_Recon_Outputs_Jun20_1 : FILE
 		date = "2020-06-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/cycldek-bridging-the-air-gap/97157/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_recon_indicators.yar#L52-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "652b28bfb45a11eaaee198c76560c1f55edc5b32c5394e606bb5426551260f24"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_recon_indicators.yar#L52-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_652b28bfb45a11eaaee198c76560c1f55edc5b32c5394e606bb5426551260f24"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -364378,7 +361173,7 @@ rule SIGNATURE_BASE_SUSP_Recon_Outputs_Jun20_1 : FILE
 		$s5 = "System Idle Process" ascii
 
 	condition:
-		filesize <150KB and 4 of them
+		filesize < 150KB and 4 of them
 }
 rule SIGNATURE_BASE_EXPL_Manageengine_CVE_2022_47966_Jan23_1
 {
@@ -364389,9 +361184,9 @@ rule SIGNATURE_BASE_EXPL_Manageengine_CVE_2022_47966_Jan23_1
 		date = "2023-01-13"
 		modified = "2023-12-05"
 		reference = "https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_manageengine_jan23.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a62064e4f12632ba6c14cbbd9369ee919536334f19021a177c126b5dff7e568c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_manageengine_jan23.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a62064e4f12632ba6c14cbbd9369ee919536334f19021a177c126b5dff7e568c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -364411,9 +361206,9 @@ rule SIGNATURE_BASE_Gen_Exploit_CVE_2017_10271_Weblogic : HIGHVOL CVE_2017_10271
 		date = "2018-03-21"
 		modified = "2023-12-05"
 		reference = "https://github.com/c0mmand3rOpSec/CVE-2017-10271, https://www.fireeye.com/blog/threat-research/2018/02/cve-2017-10271-used-to-deliver-cryptominers.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_exploit_cve_2017_10271_weblogic.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "01e4f7b1c9c068f3953fa58749a14ea148d2b038c7266da789e0998eae83e1a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_exploit_cve_2017_10271_weblogic.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_01e4f7b1c9c068f3953fa58749a14ea148d2b038c7266da789e0998eae83e1a7"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, CVE-2017-10271, FILE"
@@ -364432,7 +361227,7 @@ rule SIGNATURE_BASE_Gen_Exploit_CVE_2017_10271_Weblogic : HIGHVOL CVE_2017_10271
 		$s7 = "work:WorkContext" nocase
 
 	condition:
-		filesize <10KB and ( uint32(0)==0x616f733c or uint32(0)==0x54534f50) and all of ($s*)
+		filesize < 10KB and ( uint32( 0 ) == 0x616f733c or uint32( 0 ) == 0x54534f50 ) and all of ( $s* )
 }
 import "pe"
 
@@ -364445,10 +361240,10 @@ rule SIGNATURE_BASE_EXT_APT32_Goopdate_Installer
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt32.yar#L3-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt32.yar#L3-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "69730f2c2bb9668a17f8dfa1f1523e0e1e997ba98f027ce98f5cbaa869347383"
-		logic_hash = "1dcb3009c5c19ff4e54d82d3a4b99b3431e78664f1660522a781e815d96958c4"
+		logic_hash = "v1_sha256_1dcb3009c5c19ff4e54d82d3a4b99b3431e78664f1660522a781e815d96958c4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -364461,10 +361256,8 @@ rule SIGNATURE_BASE_EXT_APT32_Goopdate_Installer
 		$s4 = "Process32NextW"
 
 	condition:
-		(pe.is_64bit() or pe.is_32bit()) and all of them
+		(pe.is_64bit ( ) or pe.is_32bit ( ) ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_EXT_APT32_Osx_Backdoor_Loader : FILE
 {
 	meta:
@@ -364474,10 +361267,10 @@ rule SIGNATURE_BASE_EXT_APT32_Osx_Backdoor_Loader : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt32.yar#L22-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt32.yar#L22-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb"
-		logic_hash = "26964f95a9298b838e06fb9d7f739c8b87a976d8da7fb08416e952d26e84b84e"
+		logic_hash = "v1_sha256_26964f95a9298b838e06fb9d7f739c8b87a976d8da7fb08416e952d26e84b84e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364493,7 +361286,7 @@ rule SIGNATURE_BASE_EXT_APT32_Osx_Backdoor_Loader : FILE
 		$e6 = "_PlayerAberadurtheIncomprehensible"
 
 	condition:
-		(( uint32(0)==0xfeedface or uint32be(0)==0xfeedface) or ( uint32(0)==0xfeedfacf or uint32be(0)==0xfeedfacf)) and (2 of ($e*) or all of ($a*))
+		(( uint32( 0 ) == 0xfeedface or uint32be( 0 ) == 0xfeedface ) or ( uint32( 0 ) == 0xfeedfacf or uint32be( 0 ) == 0xfeedfacf ) ) and ( 2 of ( $e* ) or all of ( $a* ) )
 }
 rule SIGNATURE_BASE_Apt3_Bemstour_Strings : FILE
 {
@@ -364504,10 +361297,10 @@ rule SIGNATURE_BASE_Apt3_Bemstour_Strings : FILE
 		date = "2019-06-25"
 		modified = "2023-12-04"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt3_bemstour.yar#L1-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt3_bemstour.yar#L1-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
-		logic_hash = "8aa7491b1dc3595f67ae1229d33f79261616b0f27485b7a27705db63a6111c07"
+		logic_hash = "v1_sha256_8aa7491b1dc3595f67ae1229d33f79261616b0f27485b7a27705db63a6111c07"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -364561,7 +361354,7 @@ rule SIGNATURE_BASE_Apt3_Bemstour_Strings : FILE
 		$unique_str_2 = "XD-A31C2E0087B2"
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($dbg_print*) or 2 of ($cmdline*) or 1 of ($unique_str*)) and 3 of ($smb_param*)
+		uint16( 0 ) == 0x5a4d and ( 5 of ( $dbg_print* ) or 2 of ( $cmdline* ) or 1 of ( $unique_str* ) ) and 3 of ( $smb_param* )
 }
 rule SIGNATURE_BASE_Apt3_Bemstour_Implant_Byte_Patch
 {
@@ -364572,10 +361365,10 @@ rule SIGNATURE_BASE_Apt3_Bemstour_Implant_Byte_Patch
 		date = "2019-06-25"
 		modified = "2023-12-04"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt3_bemstour.yar#L69-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt3_bemstour.yar#L69-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
-		logic_hash = "08de2c885ccb24cb247efdcc06bbcbea144d652744b2d38aaa2aabfd341e4f91"
+		logic_hash = "v1_sha256_08de2c885ccb24cb247efdcc06bbcbea144d652744b2d38aaa2aabfd341e4f91"
 		score = 75
 		quality = 85
 		tags = ""
@@ -364604,10 +361397,10 @@ rule SIGNATURE_BASE_Apt3_Bemstour_Implant_Command_Stack_Variable
 		date = "2019-06-25"
 		modified = "2023-12-04"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt3_bemstour.yar#L107-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt3_bemstour.yar#L107-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
-		logic_hash = "36710db313a52db2a0c0af356e701d3a36e5597203e87fd7f8586d202738be33"
+		logic_hash = "v1_sha256_36710db313a52db2a0c0af356e701d3a36e5597203e87fd7f8586d202738be33"
 		score = 75
 		quality = 85
 		tags = ""
@@ -364697,10 +361490,10 @@ rule SIGNATURE_BASE_OSX_Backdoor_Evilosx : FILE
 		date = "2018-02-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Marten4n6/EvilOSX, https://twitter.com/JohnLaTwC/status/966139336436498432"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_osx_evilosx.yar#L1-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_osx_evilosx.yar#L1-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "89e5b8208daf85f549d9b7df8e2a062e47f15a5b08462a4224f73c0a6223972a"
-		logic_hash = "393abf7cf74f8d079049cf8f0bdb3a79bf16185c80c43b823e19b67a9031aef6"
+		logic_hash = "v1_sha256_393abf7cf74f8d079049cf8f0bdb3a79bf16185c80c43b823e19b67a9031aef6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364715,7 +361508,7 @@ rule SIGNATURE_BASE_OSX_Backdoor_Evilosx : FILE
 		$enc_x1 = /(AGUAdABfAGwAYQB1AG4AYwBoAF8AYQBnAGUAbgB0AF8AZABpAHIAZQBjAHQAbwByAHkA|cAZQB0AF8AbABhAHUAbgBjAGgAXwBhAGcAZQBuAHQAXwBkAGkAcgBlAGMAdABvAHIAeQ|dldF9sYXVuY2hfYWdlbnRfZGlyZWN0b3J5|Z2V0X2xhdW5jaF9hZ2VudF9kaXJlY3Rvcn|ZwBlAHQAXwBsAGEAdQBuAGMAaABfAGEAZwBlAG4AdABfAGQAaQByAGUAYwB0AG8AcgB5A|ZXRfbGF1bmNoX2FnZW50X2RpcmVjdG9ye)/ ascii
 
 	condition:
-		uint32(0)==0x752f2123 and $h1 at 0 and filesize <30KB and all of ($s*) and 1 of ($x*) or 1 of ($enc_x*)
+		uint32( 0 ) == 0x752f2123 and $h1 at 0 and filesize < 30KB and all of ( $s* ) and 1 of ( $x* ) or 1 of ( $enc_x* )
 }
 rule SIGNATURE_BASE_MAL_Gopuram_Apr23 : FILE
 {
@@ -364726,11 +361519,11 @@ rule SIGNATURE_BASE_MAL_Gopuram_Apr23 : FILE
 		date = "2023-04-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_gopuram.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_gopuram.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
 		hash = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
-		logic_hash = "58d978bd09a656f2a10a4d5d2585e51efe5cfb6b6648a4b3c2ce8c4f5d2256d4"
+		logic_hash = "v1_sha256_58d978bd09a656f2a10a4d5d2585e51efe5cfb6b6648a4b3c2ce8c4f5d2256d4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364740,7 +361533,7 @@ rule SIGNATURE_BASE_MAL_Gopuram_Apr23 : FILE
 		$path = "%s.TxR.0.regtrans-ms"
 
 	condition:
-		uint16(0)==0x5A4D and $path and filesize <10MB
+		uint16( 0 ) == 0x5A4D and $path and filesize < 10MB
 }
 rule SIGNATURE_BASE_APT_MAL_Maldoc_Cloudatlas_Oct20_1 : FILE
 {
@@ -364751,9 +361544,9 @@ rule SIGNATURE_BASE_APT_MAL_Maldoc_Cloudatlas_Oct20_1 : FILE
 		date = "2020-10-13"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cloudatlas.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "772bdd8ec89edf2054e675e9ecb321a7bfe0307a7086a4e5b65f8d8b8cf80ecc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cloudatlas.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_772bdd8ec89edf2054e675e9ecb321a7bfe0307a7086a4e5b65f8d8b8cf80ecc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364763,7 +361556,7 @@ rule SIGNATURE_BASE_APT_MAL_Maldoc_Cloudatlas_Oct20_1 : FILE
 		$x1 = "https://msofficeupdate.org" wide
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <300KB and 1 of ($x*)
+		uint16( 0 ) == 0xcfd0 and filesize < 300KB and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_APT_MAL_URL_Cloudatlas_Oct20_2 : FILE
 {
@@ -364774,9 +361567,9 @@ rule SIGNATURE_BASE_APT_MAL_URL_Cloudatlas_Oct20_2 : FILE
 		date = "2020-10-13"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cloudatlas.yar#L18-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8bb60c262a34babbe8839f5d39d1c972eeb41ea77eaae02cc877d908c7033f13"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cloudatlas.yar#L18-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8bb60c262a34babbe8839f5d39d1c972eeb41ea77eaae02cc877d908c7033f13"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364789,7 +361582,7 @@ rule SIGNATURE_BASE_APT_MAL_URL_Cloudatlas_Oct20_2 : FILE
                72 67 }
 
 	condition:
-		uint16(0)==0x495b and filesize <200 and $hc1 at 0
+		uint16( 0 ) == 0x495b and filesize < 200 and $hc1 at 0
 }
 rule SIGNATURE_BASE_NK_Miner_Malware_Jan18_1 : FILE
 {
@@ -364800,9 +361593,9 @@ rule SIGNATURE_BASE_NK_Miner_Malware_Jan18_1 : FILE
 		date = "2018-01-09"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/PChE1z"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_nkminer.yar#L11-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb75fe7d70b547a4774b74c01e11479949dfccb8645af330f87b51daaf0d8dbf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_nkminer.yar#L11-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb75fe7d70b547a4774b74c01e11479949dfccb8645af330f87b51daaf0d8dbf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364826,7 +361619,7 @@ rule SIGNATURE_BASE_NK_Miner_Malware_Jan18_1 : FILE
 		$f = "C:\\Windows\\Sys64\\updater.exe" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of them
 }
 rule SIGNATURE_BASE_Shimrat
 {
@@ -364837,9 +361630,9 @@ rule SIGNATURE_BASE_Shimrat
 		date = "2015-11-20"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_mofang.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0dd19e6a65b06bd5846ec224f01c3feea066540317223d1991154b2305882b20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_mofang.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0dd19e6a65b06bd5846ec224f01c3feea066540317223d1991154b2305882b20"
 		score = 75
 		quality = 85
 		tags = ""
@@ -364860,7 +361653,7 @@ rule SIGNATURE_BASE_Shimrat
 		$shim_func3 = "GetHookAPIs"
 
 	condition:
-		($dll and $dat and $headersig and $datasig) or ($datamarker1 and $datamarker2) or ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
+		($dll and $dat and $headersig and $datasig ) or ( $datamarker1 and $datamarker2 ) or ( $cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec ) or ( $dll and $dat and $shim_func1 and $shim_func2 and $shim_func3 )
 }
 rule SIGNATURE_BASE_Shimratreporter
 {
@@ -364871,9 +361664,9 @@ rule SIGNATURE_BASE_Shimratreporter
 		date = "2015-11-20"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_mofang.yar#L28-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "931d65628e5f0b7c63fe270b0a6cd3890f41a4ee7e253ce056b37f2d55542258"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_mofang.yar#L28-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_931d65628e5f0b7c63fe270b0a6cd3890f41a4ee7e253ce056b37f2d55542258"
 		score = 75
 		quality = 85
 		tags = ""
@@ -364906,9 +361699,9 @@ rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample1 : FILE
 		date = "2018-05-30"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta18_149A.yar#L13-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "746c74713ac52f62d5a5c41d2c9321e00481a45aa2c23f1695fab0f5b6d5dfb4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta18_149A.yar#L13-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_746c74713ac52f62d5a5c41d2c9321e00481a45aa2c23f1695fab0f5b6d5dfb4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364923,7 +361716,7 @@ rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample1 : FILE
 		$s3 = "perfw06.dat" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="f0087d7b90876a2769f2229c6789fcf3" or 1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "f0087d7b90876a2769f2229c6789fcf3" or 1 of ( $x* ) or 2 of them )
 }
 import "pe"
 
@@ -364936,9 +361729,9 @@ rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample2 : FILE
 		date = "2018-05-30"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta18_149A.yar#L36-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "046135e4a1161841835cd9d10e13224b440e914ce3f409bad84a1df2638a7d5f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta18_149A.yar#L36-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_046135e4a1161841835cd9d10e13224b440e914ce3f409bad84a1df2638a7d5f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364952,7 +361745,7 @@ rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample2 : FILE
 		$s4 = "%SystemRoot%\\system32\\scardprv.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="e8cd12071a8e823ebc434c8ee3e23203" or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "e8cd12071a8e823ebc434c8ee3e23203" or 2 of them )
 }
 import "pe"
 
@@ -364965,9 +361758,9 @@ rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample3 : FILE
 		date = "2018-05-30"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta18_149A.yar#L57-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a3da6c70d2ab94820324a55f1bcdcf5507a8ddf26efc80904daf0d9b27ac9312"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta18_149A.yar#L57-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a3da6c70d2ab94820324a55f1bcdcf5507a8ddf26efc80904daf0d9b27ac9312"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -364983,7 +361776,7 @@ rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample3 : FILE
 		$s6 = "%%s\\%%s%%0%dd" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="f6f7b2e00921129d18061822197111cd" or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "f6f7b2e00921129d18061822197111cd" or 3 of them )
 }
 rule SIGNATURE_BASE_Git_CVE_2017_9800_Poc : CVE_2017_9800 FILE
 {
@@ -364994,9 +361787,9 @@ rule SIGNATURE_BASE_Git_CVE_2017_9800_Poc : CVE_2017_9800 FILE
 		date = "2017-08-11"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/mzbat/status/895811803325898753"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_9800.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1cfd0c5cb255d3ca63917c41c092df70d68b04f5d210a66abd5e35e509ff4beb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_9800.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1cfd0c5cb255d3ca63917c41c092df70d68b04f5d210a66abd5e35e509ff4beb"
 		score = 60
 		quality = 85
 		tags = "CVE-2017-9800, FILE"
@@ -365008,7 +361801,7 @@ rule SIGNATURE_BASE_Git_CVE_2017_9800_Poc : CVE_2017_9800 FILE
 		$s3 = "git clone https://-" ascii
 
 	condition:
-		filesize <200KB and 1 of them
+		filesize < 200KB and 1 of them
 }
 rule SIGNATURE_BASE_LOG_EXPL_Ivanti_EPMM_Mobileiron_Core_CVE_2023_35078_Jul23_1 : CVE_2023_35078
 {
@@ -365019,9 +361812,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Ivanti_EPMM_Mobileiron_Core_CVE_2023_35078_Jul23_1
 		date = "2023-07-25"
 		modified = "2023-12-05"
 		reference = "Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078 - Analysis Guidance"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ebc59032b7450aa438ca30170560c95550cda6ff7774b8ce1486309716da9e6c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ebc59032b7450aa438ca30170560c95550cda6ff7774b8ce1486309716da9e6c"
 		score = 75
 		quality = 85
 		tags = "CVE-2023-35078"
@@ -365041,9 +361834,9 @@ rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Mi_War_Aug23 : CVE_2023_35078
 		date = "2023-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L16-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0083727e34118d628c8507459bfb7f949f11af8197e201066e29e263e2c3f944"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L16-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0083727e34118d628c8507459bfb7f949f11af8197e201066e29e263e2c3f944"
 		score = 85
 		quality = 85
 		tags = "CVE-2023-35078, FILE"
@@ -365054,7 +361847,7 @@ rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Mi_War_Aug23 : CVE_2023_35078
 		$s2 = "keywords.txtFirefox" ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <20KB and all of them
+		uint16( 0 ) == 0x4b50 and filesize < 20KB and all of them
 }
 rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Logclear_JAVA_Aug23 : CVE_2023_35078 FILE
 {
@@ -365065,9 +361858,9 @@ rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Logclear_JAVA_Aug23 : CVE_202
 		date = "2023-08-01"
 		modified = "2023-12-05"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L34-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c42c2eca784d7089aab56addca11bad658a4a6c34a81ae823bd0c3dad41a1c99"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L34-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c42c2eca784d7089aab56addca11bad658a4a6c34a81ae823bd0c3dad41a1c99"
 		score = 80
 		quality = 85
 		tags = "CVE-2023-35078, FILE"
@@ -365081,7 +361874,7 @@ rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Logclear_JAVA_Aug23 : CVE_202
 		$s5 = "\"----------------  ----------------" ascii fullword
 
 	condition:
-		uint16(0)==0xfeca and filesize <20KB and 4 of them or all of them
+		uint16( 0 ) == 0xfeca and filesize < 20KB and 4 of them or all of them
 }
 rule SIGNATURE_BASE_Beacon_K5Om : FILE
 {
@@ -365092,9 +361885,9 @@ rule SIGNATURE_BASE_Beacon_K5Om : FILE
 		date = "2017-06-07"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt19.yar#L10-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4b1ec0fc6c0ad4e76c526f7568153bca62f9bffdd38a3b1eaa51a37a1dcab226"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt19.yar#L10-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4b1ec0fc6c0ad4e76c526f7568153bca62f9bffdd38a3b1eaa51a37a1dcab226"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -365111,7 +361904,7 @@ rule SIGNATURE_BASE_Beacon_K5Om : FILE
 		$s4 = "Could not connect to pipe (%s): %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 3 of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 3 of them ) )
 }
 rule SIGNATURE_BASE_FE_LEGALSTRIKE_MACRO
 {
@@ -365122,9 +361915,9 @@ rule SIGNATURE_BASE_FE_LEGALSTRIKE_MACRO
 		date = "2017-06-02"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt19.yar#L34-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b38edeedcc02168d3ba7e82c3f5c6963ffc8ce1688eeb424ce686484f3687512"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt19.yar#L34-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b38edeedcc02168d3ba7e82c3f5c6963ffc8ce1688eeb424ce686484f3687512"
 		score = 75
 		quality = 85
 		tags = ""
@@ -365148,9 +361941,9 @@ rule SIGNATURE_BASE_FE_LEGALSTRIKE_RTF : FILE
 		date = "2017-06-02"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt19.yar#L52-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "af811694076f7d53ee76713538839c4ec82c591518d59d5988dcb893bfd32ffe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt19.yar#L52-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_af811694076f7d53ee76713538839c4ec82c591518d59d5988dcb893bfd32ffe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -365166,7 +361959,7 @@ rule SIGNATURE_BASE_FE_LEGALSTRIKE_RTF : FILE
 		$datastore = "\\*\\datastore"
 
 	condition:
-		uint32be(0)==0x7B5C7274 and all of them
+		uint32be( 0 ) == 0x7B5C7274 and all of them
 }
 rule SIGNATURE_BASE_Scarcruft_Malware_Feb18_1 : FILE
 {
@@ -365177,9 +361970,9 @@ rule SIGNATURE_BASE_Scarcruft_Malware_Feb18_1 : FILE
 		date = "2018-02-03"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/craiu/status/959477129795731458"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_scarcruft.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa1ed130518a2096bd731dce917512d560160e271ad8f0ccd57fbedd478a5502"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_scarcruft.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa1ed130518a2096bd731dce917512d560160e271ad8f0ccd57fbedd478a5502"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -365189,7 +361982,7 @@ rule SIGNATURE_BASE_Scarcruft_Malware_Feb18_1 : FILE
 		$x2 = "cmd.exe /C ping 0.1.1.2" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
 }
 rule SIGNATURE_BASE_Invoke_Osiris
 {
@@ -365200,9 +361993,9 @@ rule SIGNATURE_BASE_Invoke_Osiris
 		date = "2017-03-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_ps_osiris.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c63402fe46cec3f452eb740b1b8b22475535ce867d6268d4834b46f879ff7306"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_ps_osiris.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c63402fe46cec3f452eb740b1b8b22475535ce867d6268d4834b46f879ff7306"
 		score = 75
 		quality = 60
 		tags = ""
@@ -365220,8 +362013,6 @@ rule SIGNATURE_BASE_Invoke_Osiris
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Credtheft_MSIL_Adpasshunt_2_1 : FILE
 {
 	meta:
@@ -365231,10 +362022,10 @@ rule SIGNATURE_BASE_Credtheft_MSIL_Adpasshunt_2_1 : FILE
 		date = "2024-05-25"
 		modified = "2024-05-25"
 		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_fireeye_redteam_tools.yar#L845-L861"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_fireeye_redteam_tools.yar#L845-L861"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "a76faa34a1f9cc891aeaa65525c8698e49d5a141854ca0cffb42f06a251bea43"
+		logic_hash = "v1_sha256_a76faa34a1f9cc891aeaa65525c8698e49d5a141854ca0cffb42f06a251bea43"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -365248,10 +362039,8 @@ rule SIGNATURE_BASE_Credtheft_MSIL_Adpasshunt_2_1 : FILE
 		$s4 = "[GPP] Searching for passwords now"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and (@pdb2[1]<@pdb1[1]+50) or 2 of ($s*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( @pdb2 [ 1 ] < @pdb1 [ 1 ] + 50 ) or 2 of ( $s* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Backdoor_Win_Gorat_Memory_1
 {
 	meta:
@@ -365261,10 +362050,10 @@ rule SIGNATURE_BASE_APT_Backdoor_Win_Gorat_Memory_1
 		date = "2024-05-25"
 		modified = "2024-05-25"
 		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_fireeye_redteam_tools.yar#L1013-L1039"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_fireeye_redteam_tools.yar#L1013-L1039"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3b926b5762e13ceec7ac3a61e85c93bb"
-		logic_hash = "bf8d80b7a7d35c1bcb353ff66d10bc95c2e6502043acc6554887465a467cdcf7"
+		logic_hash = "v1_sha256_bf8d80b7a7d35c1bcb353ff66d10bc95c2e6502043acc6554887465a467cdcf7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -365284,10 +362073,8 @@ rule SIGNATURE_BASE_APT_Backdoor_Win_Gorat_Memory_1
 		$winblows = "rat/platforms/win.(*winblows).GetStage" fullword
 
 	condition:
-		$winblows or 3 of ($rat*)
+		$winblows or 3 of ( $rat* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktool_MSIL_Sharpivot_3_1 : FILE
 {
 	meta:
@@ -365297,10 +362084,10 @@ rule SIGNATURE_BASE_Hacktool_MSIL_Sharpivot_3_1 : FILE
 		date = "2024-05-25"
 		modified = "2024-05-25"
 		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_fireeye_redteam_tools.yar#L1145-L1174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_fireeye_redteam_tools.yar#L1145-L1174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "f51ac9637f47a98beee1b3c37b594e292aab0e1d3f9e49c41b1f3c3ce02e17de"
+		logic_hash = "v1_sha256_f51ac9637f47a98beee1b3c37b594e292aab0e1d3f9e49c41b1f3c3ce02e17de"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -365326,10 +362113,8 @@ rule SIGNATURE_BASE_Hacktool_MSIL_Sharpivot_3_1 : FILE
 		$str17 = "Schtask" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktool_MSIL_SEATBELT_1_1 : FILE
 {
 	meta:
@@ -365339,10 +362124,10 @@ rule SIGNATURE_BASE_Hacktool_MSIL_SEATBELT_1_1 : FILE
 		date = "2020-12-08"
 		modified = "2023-01-27"
 		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_fireeye_redteam_tools.yar#L1210-L1233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_fireeye_redteam_tools.yar#L1210-L1233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "848837b83865f3854801be1f25cb9f4d"
-		logic_hash = "89275ec08b75cef371b70fb749cbcada3f30309869094ab7940811fe40f8a008"
+		logic_hash = "v1_sha256_89275ec08b75cef371b70fb749cbcada3f30309869094ab7940811fe40f8a008"
 		score = 75
 		quality = 67
 		tags = "FILE"
@@ -365360,10 +362145,8 @@ rule SIGNATURE_BASE_Hacktool_MSIL_SEATBELT_1_1 : FILE
 		$str10 = "{0,-23}" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Builder_PY_REDFLARE_2_1
 {
 	meta:
@@ -365373,10 +362156,10 @@ rule SIGNATURE_BASE_APT_Builder_PY_REDFLARE_2_1
 		date = "2020-12-01"
 		modified = "2020-12-01"
 		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_fireeye_redteam_tools.yar#L1376-L1391"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_fireeye_redteam_tools.yar#L1376-L1391"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4410e95de247d7f1ab649aa640ee86fb"
-		logic_hash = "0f28fb23c0c1d589466c7c541c8dc588b038d02dded0c66c4a448d1f768c95c5"
+		logic_hash = "v1_sha256_0f28fb23c0c1d589466c7c541c8dc588b038d02dded0c66c4a448d1f768c95c5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -365387,7 +362170,7 @@ rule SIGNATURE_BASE_APT_Builder_PY_REDFLARE_2_1
 		$s3 = "parsePluginOutput"
 
 	condition:
-		all of them and #s2==2
+		all of them and #s2 == 2
 }
 import "pe"
 
@@ -365400,19 +362183,17 @@ rule SIGNATURE_BASE_APT_Backdoor_Win_GORAT_4_1 : FILE
 		date = "2024-05-25"
 		modified = "2024-05-25"
 		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_fireeye_redteam_tools.yar#L1706-L1716"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_fireeye_redteam_tools.yar#L1706-L1716"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f59095f0ab15f26a1ead7eed8cdb4902"
-		logic_hash = "fa76e994beb2ab1b7950cf9d6391adf4e1ba45586a14a6340fa8a25a904821e4"
+		logic_hash = "v1_sha256_fa76e994beb2ab1b7950cf9d6391adf4e1ba45586a14a6340fa8a25a904821e4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and pe.exports("MemoryCallEntryPoint") and pe.exports("MemoryDefaultAlloc") and pe.exports("MemoryDefaultFree") and pe.exports("MemoryDefaultFreeLibrary") and pe.exports("MemoryDefaultGetProcAddress") and pe.exports("MemoryDefaultLoadLibrary") and pe.exports("MemoryFindResource") and pe.exports("MemoryFindResourceEx") and pe.exports("MemoryFreeLibrary") and pe.exports("MemoryGetProcAddress") and pe.exports("MemoryLoadLibrary") and pe.exports("MemoryLoadLibraryEx") and pe.exports("MemoryLoadResource") and pe.exports("MemoryLoadString") and pe.exports("MemoryLoadStringEx") and pe.exports("MemorySizeofResource") and pe.exports("callback") and pe.exports("crosscall2") and pe.exports("crosscall_386")
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10MB and pe.exports ( "MemoryCallEntryPoint" ) and pe.exports ( "MemoryDefaultAlloc" ) and pe.exports ( "MemoryDefaultFree" ) and pe.exports ( "MemoryDefaultFreeLibrary" ) and pe.exports ( "MemoryDefaultGetProcAddress" ) and pe.exports ( "MemoryDefaultLoadLibrary" ) and pe.exports ( "MemoryFindResource" ) and pe.exports ( "MemoryFindResourceEx" ) and pe.exports ( "MemoryFreeLibrary" ) and pe.exports ( "MemoryGetProcAddress" ) and pe.exports ( "MemoryLoadLibrary" ) and pe.exports ( "MemoryLoadLibraryEx" ) and pe.exports ( "MemoryLoadResource" ) and pe.exports ( "MemoryLoadString" ) and pe.exports ( "MemoryLoadStringEx" ) and pe.exports ( "MemorySizeofResource" ) and pe.exports ( "callback" ) and pe.exports ( "crosscall2" ) and pe.exports ( "crosscall_386" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktool_MSIL_PXELOOT_2_1 : FILE
 {
 	meta:
@@ -365422,10 +362203,10 @@ rule SIGNATURE_BASE_Hacktool_MSIL_PXELOOT_2_1 : FILE
 		date = "2020-12-08"
 		modified = "2023-01-27"
 		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_fireeye_redteam_tools.yar#L2088-L2113"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_fireeye_redteam_tools.yar#L2088-L2113"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d93100fe60c342e9e3b13150fd91c7d8"
-		logic_hash = "f9a9167b806e0e3df3720c13b4009e18c5a36913d255978cb001c2284533ea82"
+		logic_hash = "v1_sha256_f9a9167b806e0e3df3720c13b4009e18c5a36913d255978cb001c2284533ea82"
 		score = 75
 		quality = 43
 		tags = "FILE"
@@ -365445,7 +362226,7 @@ rule SIGNATURE_BASE_Hacktool_MSIL_PXELOOT_2_1 : FILE
 		$str12 = "execute" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
 }
 rule SIGNATURE_BASE_Scanbox_Malware_Generic
 {
@@ -365456,9 +362237,9 @@ rule SIGNATURE_BASE_Scanbox_Malware_Generic
 		date = "2015-02-28"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/WXUQcP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_scanbox_deeppanda.yar#L2-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5f521d3f000fb39e5e3b08657e75219e93fb3bb8ffbbdbd70f471928a56bef27"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_scanbox_deeppanda.yar#L2-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5f521d3f000fb39e5e3b08657e75219e93fb3bb8ffbbdbd70f471928a56bef27"
 		score = 75
 		quality = 85
 		tags = ""
@@ -365479,7 +362260,7 @@ rule SIGNATURE_BASE_Scanbox_Malware_Generic
 		$x3 = "SEOUL1" fullword ascii
 
 	condition:
-		(1 of ($s*) and 2 of ($x*)) or (3 of ($x*))
+		(1 of ( $s* ) and 2 of ( $x* ) ) or ( 3 of ( $x* ) )
 }
 rule SIGNATURE_BASE_APT_NK_MAL_Keylogger_Unknown_Nov19_1 : FILE
 {
@@ -365490,9 +362271,9 @@ rule SIGNATURE_BASE_APT_NK_MAL_Keylogger_Unknown_Nov19_1 : FILE
 		date = "2019-11-06"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/CNMF_VirusAlert/status/1192131508007505921"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_gen.yar#L2-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a3b5c82cb8aa09e3c1b955bb175046e86f96da1f187eb46df83caaaf9e1370b2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_gen.yar#L2-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a3b5c82cb8aa09e3c1b955bb175046e86f96da1f187eb46df83caaaf9e1370b2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -365522,7 +362303,7 @@ rule SIGNATURE_BASE_APT_NK_MAL_Keylogger_Unknown_Nov19_1 : FILE
 		$s6 = "PID [%s], open process failed." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=40000KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize <= 40000KB and ( 1 of ( $x* ) or 4 of them )
 }
 rule SIGNATURE_BASE_Empire_Invoke_Bypassuac : FILE
 {
@@ -365533,10 +362314,10 @@ rule SIGNATURE_BASE_Empire_Invoke_Bypassuac : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L9-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L9-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ab0f900a6915b7497313977871a64c3658f3e6f73f11b03d2d33ca61305dc6a8"
-		logic_hash = "1697065405fa0e255cdd77fa39f53866118caf0bad6a3d72756590303610e7b6"
+		logic_hash = "v1_sha256_1697065405fa0e255cdd77fa39f53866118caf0bad6a3d72756590303610e7b6"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365549,7 +362330,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Bypassuac : FILE
 		$s4 = "$temp = [System.Text.Encoding]::UNICODE.GetBytes($szTempDllPath)" fullword ascii
 
 	condition:
-		filesize <1200KB and 3 of them
+		filesize < 1200KB and 3 of them
 }
 rule SIGNATURE_BASE_Empire_Lib_Modules_Trollsploit_Message : FILE
 {
@@ -365560,10 +362341,10 @@ rule SIGNATURE_BASE_Empire_Lib_Modules_Trollsploit_Message : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "71f2258177eb16eafabb110a9333faab30edacf67cb019d5eab3c12d095655d5"
-		logic_hash = "70b7d91395ae30131c1448511425abf32ddedf04632266454aa008330ff28222"
+		logic_hash = "v1_sha256_70b7d91395ae30131c1448511425abf32ddedf04632266454aa008330ff28222"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365576,7 +362357,7 @@ rule SIGNATURE_BASE_Empire_Lib_Modules_Trollsploit_Message : FILE
 		$s4 = "'Value'         :   'Lost contact with the Domain Controller.'" fullword ascii
 
 	condition:
-		filesize <10KB and 3 of them
+		filesize < 10KB and 3 of them
 }
 rule SIGNATURE_BASE_Empire_Persistence : FILE
 {
@@ -365587,10 +362368,10 @@ rule SIGNATURE_BASE_Empire_Persistence : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L47-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L47-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ae8875f7fcb8b4de5cf9721a9f5a9f7782f7c436c86422060ecdc5181e31092f"
-		logic_hash = "3c398aa180b6f2225a25f9b1430e89991c7e391930e2be140e89c67da67b3614"
+		logic_hash = "v1_sha256_3c398aa180b6f2225a25f9b1430e89991c7e391930e2be140e89c67da67b3614"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365602,7 +362383,7 @@ rule SIGNATURE_BASE_Empire_Persistence : FILE
 		$s3 = "$PersistantScript = $PersistantScript.ToString().Replace('EXECUTEFUNCTION', \"$PersistenceScriptName -Persist\")" fullword ascii
 
 	condition:
-		filesize <108KB and 1 of them
+		filesize < 108KB and 1 of them
 }
 rule SIGNATURE_BASE_Empire_Portscan : FILE
 {
@@ -365613,10 +362394,10 @@ rule SIGNATURE_BASE_Empire_Portscan : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L65-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L65-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b355efa1e7b3681b1402e22c58ce968795ef245fd08a0afb948d45c173e60b97"
-		logic_hash = "162ac4ccc8629a2d017831cdc6d1bf8d7a62b844bf68a0d61956b2f41a5e004b"
+		logic_hash = "v1_sha256_162ac4ccc8629a2d017831cdc6d1bf8d7a62b844bf68a0d61956b2f41a5e004b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365627,7 +362408,7 @@ rule SIGNATURE_BASE_Empire_Portscan : FILE
 		$s2 = "script += \" | ? {$_.alive}| Select-Object HostName,@{name='OpenPorts';expression={$_.openPorts -join ','}} | ft -wrap | Out-Str" ascii
 
 	condition:
-		filesize <14KB and all of them
+		filesize < 14KB and all of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Shellcode : FILE
 {
@@ -365638,10 +362419,10 @@ rule SIGNATURE_BASE_Empire_Invoke_Shellcode : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L82-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L82-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
-		logic_hash = "968a140f75aa17bd9aac243483cade931dc047854b65b2f61146492c2cf01ea5"
+		logic_hash = "v1_sha256_968a140f75aa17bd9aac243483cade931dc047854b65b2f61146492c2cf01ea5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365653,7 +362434,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Shellcode : FILE
 		$s3 = "$RemoteMemAddr = $VirtualAllocEx.Invoke($hProcess, [IntPtr]::Zero, $Shellcode.Length + 1, 0x3000, 0x40) # (Reserve|Commit, RWX)" fullword ascii
 
 	condition:
-		filesize <100KB and 1 of them
+		filesize < 100KB and 1 of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Mimikatz : FILE
 {
@@ -365664,10 +362445,10 @@ rule SIGNATURE_BASE_Empire_Invoke_Mimikatz : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L100-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L100-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c5481864b757837ecbc75997fa24978ffde3672b8a144a55478ba9a864a19466"
-		logic_hash = "3e16bed3dd7b36920cdf01507f35e38d004e3ce2f3301911a8ee4aedbae6c5c3"
+		logic_hash = "v1_sha256_3e16bed3dd7b36920cdf01507f35e38d004e3ce2f3301911a8ee4aedbae6c5c3"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365679,7 +362460,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Mimikatz : FILE
 		$s3 = "Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii
 
 	condition:
-		filesize <2500KB and 2 of them
+		filesize < 2500KB and 2 of them
 }
 rule SIGNATURE_BASE_Empire_Lib_Modules_Credentials_Mimikatz_Pth : FILE
 {
@@ -365690,10 +362471,10 @@ rule SIGNATURE_BASE_Empire_Lib_Modules_Credentials_Mimikatz_Pth : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L118-L133"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L118-L133"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6dee1cf931e02c5f3dc6889e879cc193325b39e18409dcdaf987b8bf7c459211"
-		logic_hash = "6989c2e50ce642e0300e1293f46cd36e5141274d1e7172a8312595bb515bede2"
+		logic_hash = "v1_sha256_6989c2e50ce642e0300e1293f46cd36e5141274d1e7172a8312595bb515bede2"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365704,7 +362485,7 @@ rule SIGNATURE_BASE_Empire_Lib_Modules_Credentials_Mimikatz_Pth : FILE
 		$s1 = "command = \"sekurlsa::pth /user:\"+self.options[\"user\"]['Value']" fullword ascii
 
 	condition:
-		filesize <12KB and all of them
+		filesize < 12KB and all of them
 }
 rule SIGNATURE_BASE_Empire_Write_Hijackdll : FILE
 {
@@ -365715,10 +362496,10 @@ rule SIGNATURE_BASE_Empire_Write_Hijackdll : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L135-L151"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L135-L151"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "155fa7168e28f15bb34f67344f47234a866e2c63b3303422ff977540623c70bf"
-		logic_hash = "e01157fe4adaf647474292bfbbb8196c0b7e89433da52a386a8d9573ae543679"
+		logic_hash = "v1_sha256_e01157fe4adaf647474292bfbbb8196c0b7e89433da52a386a8d9573ae543679"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365730,7 +362511,7 @@ rule SIGNATURE_BASE_Empire_Write_Hijackdll : FILE
 		$s3 = "[Byte[]]$DllBytes = [Byte[]][Convert]::FromBase64String($DllBytes32)" fullword ascii
 
 	condition:
-		filesize <500KB and 2 of them
+		filesize < 500KB and 2 of them
 }
 rule SIGNATURE_BASE_Empire_Skeleton_Key : FILE
 {
@@ -365741,10 +362522,10 @@ rule SIGNATURE_BASE_Empire_Skeleton_Key : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L153-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L153-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3d02f16dcc38faaf5e97e4c5dbddf761f2816004775e6af8826cde9e29bb750f"
-		logic_hash = "910451b2b2ed7cb5f7891d97d15e49da24b182adc903926f539fc4bfe589f2d5"
+		logic_hash = "v1_sha256_910451b2b2ed7cb5f7891d97d15e49da24b182adc903926f539fc4bfe589f2d5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365757,7 +362538,7 @@ rule SIGNATURE_BASE_Empire_Skeleton_Key : FILE
 		$s4 = "\"ONLY APPLICABLE ON DOMAIN CONTROLLERS!\")," fullword ascii
 
 	condition:
-		filesize <6KB and 2 of them
+		filesize < 6KB and 2 of them
 }
 rule SIGNATURE_BASE_Empire_Invoke_Wmi : FILE
 {
@@ -365768,10 +362549,10 @@ rule SIGNATURE_BASE_Empire_Invoke_Wmi : FILE
 		date = "2015-08-06"
 		modified = "2023-12-05"
 		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_powershell_empire.yar#L172-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_powershell_empire.yar#L172-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a914cb227f652734a91d3d39745ceeacaef7a8b5e89c1beedfd6d5f9b4615a1d"
-		logic_hash = "7179a22eec8eb9e59bf590e671e6849d5b960c58eb8fa591bc3b340d64f1d076"
+		logic_hash = "v1_sha256_7179a22eec8eb9e59bf590e671e6849d5b960c58eb8fa591bc3b340d64f1d076"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -365783,7 +362564,7 @@ rule SIGNATURE_BASE_Empire_Invoke_Wmi : FILE
 		$s3 = "script = \"$PSPassword = \\\"\"+password+\"\\\" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Man" ascii
 
 	condition:
-		filesize <20KB and 2 of them
+		filesize < 20KB and 2 of them
 }
 import "pe"
 
@@ -365796,9 +362577,9 @@ rule SIGNATURE_BASE_MAL_Cryprat_Jan19_1 : FILE
 		date = "2019-01-07"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_cryp_rat.yar#L3-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "69f8a581bae1a2c411e09e8fe01a979645ef897038af868d8e9f2a2ce9188080"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_cryp_rat.yar#L3-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_69f8a581bae1a2c411e09e8fe01a979645ef897038af868d8e9f2a2ce9188080"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -365808,7 +362589,7 @@ rule SIGNATURE_BASE_MAL_Cryprat_Jan19_1 : FILE
 		$x1 = "Cryp_RAT" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="2524e5e9fe04d7bfe5efb3a5e400fe4b" or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "2524e5e9fe04d7bfe5efb3a5e400fe4b" or 1 of them )
 }
 rule SIGNATURE_BASE_Ransom_Lockergoga_Mar19_1 : FILE
 {
@@ -365819,9 +362600,9 @@ rule SIGNATURE_BASE_Ransom_Lockergoga_Mar19_1 : FILE
 		date = "2019-03-19"
 		modified = "2023-12-05"
 		reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_lockergoga.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "076d799113f5bf6c00aa29895cca83ff86e89706cf15ca6971a991d345d0ad65"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_lockergoga.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_076d799113f5bf6c00aa29895cca83ff86e89706cf15ca6971a991d345d0ad65"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -365843,7 +362624,7 @@ rule SIGNATURE_BASE_Ransom_Lockergoga_Mar19_1 : FILE
 		$rn1 = "This may lead to the impossibility of recovery of the certain files." wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 1 of ($x*)) or $rn1
+		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 1 of ( $x* ) ) or $rn1
 }
 rule SIGNATURE_BASE_APT_MAL_DTRACK_Oct19_1 : FILE
 {
@@ -365854,9 +362635,9 @@ rule SIGNATURE_BASE_APT_MAL_DTRACK_Oct19_1 : FILE
 		date = "2019-10-28"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/a_tweeter_user/status/1188811977851887616?s=21"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dtrack.yar#L2-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b99bc8ec4df7185da306365dc2a24a0849ff0d5d92269daaa1efbb20f5e5bf83"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dtrack.yar#L2-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b99bc8ec4df7185da306365dc2a24a0849ff0d5d92269daaa1efbb20f5e5bf83"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -365892,10 +362673,8 @@ rule SIGNATURE_BASE_APT_MAL_DTRACK_Oct19_1 : FILE
 		$op3 = { 8b 85 c8 fd ff ff 03 85 a4 fc ff ff 89 85 b4 fc }
 
 	condition:
-		$xc1 or 2 of ($sx*) or 4 of them or ( uint16(0)==0x5a4d and filesize <=3000KB and 2 of them )
+		$xc1 or 2 of ( $sx* ) or 4 of them or ( uint16( 0 ) == 0x5a4d and filesize <= 3000KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Windowscredentialeditor
 {
 	meta:
@@ -365905,9 +362684,9 @@ rule SIGNATURE_BASE_Windowscredentialeditor
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L20-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "531a0bdc893d89b1c14deee11df95b430051cef07744a15b5d606e1c5378db97"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L20-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_531a0bdc893d89b1c14deee11df95b430051cef07744a15b5d606e1c5378db97"
 		score = 90
 		quality = 85
 		tags = ""
@@ -365920,8 +362699,6 @@ rule SIGNATURE_BASE_Windowscredentialeditor
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Amplia_Security_Tool : FILE
 {
 	meta:
@@ -365931,9 +362708,9 @@ rule SIGNATURE_BASE_HKTL_Amplia_Security_Tool : FILE
 		date = "2013-01-01"
 		modified = "2023-02-14"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L34-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ca32d8df0011f23922c6566b28aa55b0756d5b67bf3db8908b206b1038bb1f2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L34-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ca32d8df0011f23922c6566b28aa55b0756d5b67bf3db8908b206b1038bb1f2"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -365947,10 +362724,8 @@ rule SIGNATURE_BASE_HKTL_Amplia_Security_Tool : FILE
 		$f = "PPWDUMP_DATA"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (2 of them ) or 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 2 of them ) or 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Pwdump
 {
 	meta:
@@ -365960,9 +362735,9 @@ rule SIGNATURE_BASE_Pwdump
 		date = "2014-04-24"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L58-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a998d16f84e8689f182f6665ad165c6ff19e25d3e52acc10ca4cc6fe54ba354f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L58-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a998d16f84e8689f182f6665ad165c6ff19e25d3e52acc10ca4cc6fe54ba354f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -365975,8 +362750,6 @@ rule SIGNATURE_BASE_Pwdump
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Pscan_Portscan_1
 {
 	meta:
@@ -365986,9 +362759,9 @@ rule SIGNATURE_BASE_Pscan_Portscan_1
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L74-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c624fcdf28506b551bf7b36883d95b279a7c56322337a0acafd91205659c92cc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L74-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c624fcdf28506b551bf7b36883d95b279a7c56322337a0acafd91205659c92cc"
 		score = 50
 		quality = 85
 		tags = ""
@@ -366001,8 +362774,6 @@ rule SIGNATURE_BASE_Pscan_Portscan_1
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktool_Samples
 {
 	meta:
@@ -366012,9 +362783,9 @@ rule SIGNATURE_BASE_Hacktool_Samples
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L88-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0064950d88eccbe670cd1dc70861d093c7f49f8f10e984aef4cfb4bcc94e4645"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L88-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0064950d88eccbe670cd1dc70861d093c7f49f8f10e984aef4cfb4bcc94e4645"
 		score = 50
 		quality = 83
 		tags = ""
@@ -366050,8 +362821,6 @@ rule SIGNATURE_BASE_Hacktool_Samples
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Fierce2
 {
 	meta:
@@ -366061,9 +362830,9 @@ rule SIGNATURE_BASE_Fierce2
 		date = "2014-01-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L126-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "05502827dd5d1903507fd1e176d518516a5c1965fb4e51ea26b1a05eb0dce3d2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L126-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_05502827dd5d1903507fd1e176d518516a5c1965fb4e51ea26b1a05eb0dce3d2"
 		score = 60
 		quality = 85
 		tags = ""
@@ -366075,8 +362844,6 @@ rule SIGNATURE_BASE_Fierce2
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ncrack
 {
 	meta:
@@ -366086,9 +362853,9 @@ rule SIGNATURE_BASE_Ncrack
 		date = "2014-01-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L141-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a42bfaefb873a10821bcc06db109d8ab20daa8c8ac0b6cfb245d2ee339f318bb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L141-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a42bfaefb873a10821bcc06db109d8ab20daa8c8ac0b6cfb245d2ee339f318bb"
 		score = 60
 		quality = 85
 		tags = ""
@@ -366100,8 +362867,6 @@ rule SIGNATURE_BASE_Ncrack
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sqlmap
 {
 	meta:
@@ -366111,9 +362876,9 @@ rule SIGNATURE_BASE_Sqlmap
 		date = "2014-01-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L156-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9c248c856c3d91a282012489b53dc9e15569e1bb1a5c9f5e3c7938f7ce0c3157"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L156-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9c248c856c3d91a282012489b53dc9e15569e1bb1a5c9f5e3c7938f7ce0c3157"
 		score = 60
 		quality = 85
 		tags = ""
@@ -366125,8 +362890,6 @@ rule SIGNATURE_BASE_Sqlmap
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Portscanner_Simple_Jan14
 {
 	meta:
@@ -366137,10 +362900,10 @@ rule SIGNATURE_BASE_HKTL_Portscanner_Simple_Jan14
 		modified = "2023-12-05"
 		old_rule_name = "PortScanner"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L171-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L171-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b381b9212282c0c650cb4b0323436c63"
-		logic_hash = "c69269b227d46b5b970cfc094b3154b0a533b439b8ed492a2059025bc96d17a0"
+		logic_hash = "v1_sha256_c69269b227d46b5b970cfc094b3154b0a533b439b8ed492a2059025bc96d17a0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366152,8 +362915,6 @@ rule SIGNATURE_BASE_HKTL_Portscanner_Simple_Jan14
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Domainscanv1_0
 {
 	meta:
@@ -366163,10 +362924,10 @@ rule SIGNATURE_BASE_Domainscanv1_0
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L185-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L185-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
-		logic_hash = "b06d902528fee5d1718d0a2984af3314e92e1ec7033c7596f9fb0e51a20eb848"
+		logic_hash = "v1_sha256_b06d902528fee5d1718d0a2984af3314e92e1ec7033c7596f9fb0e51a20eb848"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366184,8 +362945,6 @@ rule SIGNATURE_BASE_Domainscanv1_0
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Moorer_Port_Scanner
 {
 	meta:
@@ -366195,10 +362954,10 @@ rule SIGNATURE_BASE_HKTL_Moorer_Port_Scanner
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L204-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L204-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "376304acdd0b0251c8b19fea20bb6f5b"
-		logic_hash = "248f437964fc6f7836f6b4c87e1f35bb1bac25a1a484cdf1a4065e7efb823b51"
+		logic_hash = "v1_sha256_248f437964fc6f7836f6b4c87e1f35bb1bac25a1a484cdf1a4065e7efb823b51"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366212,8 +362971,6 @@ rule SIGNATURE_BASE_HKTL_Moorer_Port_Scanner
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Netbios_Name_Scanner
 {
 	meta:
@@ -366223,10 +362980,10 @@ rule SIGNATURE_BASE_Netbios_Name_Scanner
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L219-L231"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L219-L231"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "888ba1d391e14c0a9c829f5a1964ca2c"
-		logic_hash = "19b40a283b74317fece2f5be0ee3e38227d9631eebbc7efb0ea19056b52630f1"
+		logic_hash = "v1_sha256_19b40a283b74317fece2f5be0ee3e38227d9631eebbc7efb0ea19056b52630f1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366239,8 +362996,6 @@ rule SIGNATURE_BASE_Netbios_Name_Scanner
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Felikspack3___Scanners_Ipscan
 {
 	meta:
@@ -366250,10 +363005,10 @@ rule SIGNATURE_BASE_Felikspack3___Scanners_Ipscan
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L233-L245"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L233-L245"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6c1bcf0b1297689c8c4c12cc70996a75"
-		logic_hash = "8da10a4536ecea889f29bb3f098518580629bf48eda88db7adfc5f61738ede25"
+		logic_hash = "v1_sha256_8da10a4536ecea889f29bb3f098518580629bf48eda88db7adfc5f61738ede25"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366266,8 +363021,6 @@ rule SIGNATURE_BASE_Felikspack3___Scanners_Ipscan
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Cgisscan_Cgiscan
 {
 	meta:
@@ -366277,10 +363030,10 @@ rule SIGNATURE_BASE_Cgisscan_Cgiscan
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L247-L259"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L247-L259"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "338820e4e8e7c943074d5a5bc832458a"
-		logic_hash = "5bd856a77c53616cf78d093462f8b7ca5a5fb0924406a02941d86bdb015a1fbc"
+		logic_hash = "v1_sha256_5bd856a77c53616cf78d093462f8b7ca5a5fb0924406a02941d86bdb015a1fbc"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366291,10 +363044,8 @@ rule SIGNATURE_BASE_Cgisscan_Cgiscan
 		$s3 = "tcp is the only protocol supported thru socks server"
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_IP_Stealing_Utilities
 {
 	meta:
@@ -366304,10 +363055,10 @@ rule SIGNATURE_BASE_IP_Stealing_Utilities
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L261-L272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L261-L272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "65646e10fb15a2940a37c5ab9f59c7fc"
-		logic_hash = "38958edeee6e140e11267cdd7899ad517799dbce33ac267d51dea0f8aecfa1ee"
+		logic_hash = "v1_sha256_38958edeee6e140e11267cdd7899ad517799dbce33ac267d51dea0f8aecfa1ee"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366319,8 +363070,6 @@ rule SIGNATURE_BASE_IP_Stealing_Utilities
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Superscan4
 {
 	meta:
@@ -366330,10 +363079,10 @@ rule SIGNATURE_BASE_Superscan4
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L274-L287"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L274-L287"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "78f76428ede30e555044b83c47bc86f0"
-		logic_hash = "7f76c59e85efac5c150f783606e2a9bdc8724c6afd9f9c6405d63f7467c72752"
+		logic_hash = "v1_sha256_7f76c59e85efac5c150f783606e2a9bdc8724c6afd9f9c6405d63f7467c72752"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366346,8 +363095,6 @@ rule SIGNATURE_BASE_Superscan4
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Portracer
 {
 	meta:
@@ -366357,10 +363104,10 @@ rule SIGNATURE_BASE_Portracer
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L288-L300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L288-L300"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2834a872a0a8da5b1be5db65dfdef388"
-		logic_hash = "f6ad85a8970b10e25becca76e17bff30cbc787ed45f331af4ecf9563ff11b65d"
+		logic_hash = "v1_sha256_f6ad85a8970b10e25becca76e17bff30cbc787ed45f331af4ecf9563ff11b65d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366373,8 +363120,6 @@ rule SIGNATURE_BASE_Portracer
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Scanarator
 {
 	meta:
@@ -366384,10 +363129,10 @@ rule SIGNATURE_BASE_Scanarator
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L302-L312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L302-L312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "848bd5a518e0b6c05bd29aceb8536c46"
-		logic_hash = "9400435470c26245cd814e1e39f275eb22566d66d1a72d4f3e618a6ad11bc8d9"
+		logic_hash = "v1_sha256_9400435470c26245cd814e1e39f275eb22566d66d1a72d4f3e618a6ad11bc8d9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366398,8 +363143,6 @@ rule SIGNATURE_BASE_Scanarator
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aolipsniffer
 {
 	meta:
@@ -366409,10 +363152,10 @@ rule SIGNATURE_BASE_Aolipsniffer
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L314-L332"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L314-L332"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "51565754ea43d2d57b712d9f0a3e62b8"
-		logic_hash = "e627b8ea85e4325714c98e93ad6147adfa600af548a80dce8548b7f5743733b5"
+		logic_hash = "v1_sha256_e627b8ea85e4325714c98e93ad6147adfa600af548a80dce8548b7f5743733b5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366431,8 +363174,6 @@ rule SIGNATURE_BASE_Aolipsniffer
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE__Bitchin_Threads_
 {
 	meta:
@@ -366442,10 +363183,10 @@ rule SIGNATURE_BASE__Bitchin_Threads_
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L334-L345"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L334-L345"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7491b138c1ee5a0d9d141fbfd1f0071b"
-		logic_hash = "f43fec37d9dc668b562838465e5696e502c638b207e7af6a77fac5a8b00e92a8"
+		logic_hash = "v1_sha256_f43fec37d9dc668b562838465e5696e502c638b207e7af6a77fac5a8b00e92a8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366457,8 +363198,6 @@ rule SIGNATURE_BASE__Bitchin_Threads_
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Cgis4_Cgis4
 {
 	meta:
@@ -366468,10 +363207,10 @@ rule SIGNATURE_BASE_Cgis4_Cgis4
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L347-L362"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L347-L362"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d658dad1cd759d7f7d67da010e47ca23"
-		logic_hash = "2cf3fc6447323cbefe5f5ad02271eeb4c271bb9784d2c29030858542a43fbb04"
+		logic_hash = "v1_sha256_2cf3fc6447323cbefe5f5ad02271eeb4c271bb9784d2c29030858542a43fbb04"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366487,8 +363226,6 @@ rule SIGNATURE_BASE_Cgis4_Cgis4
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Portscan
 {
 	meta:
@@ -366498,10 +363235,10 @@ rule SIGNATURE_BASE_Portscan
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L364-L375"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L364-L375"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a8bfdb2a925e89a281956b1e3bb32348"
-		logic_hash = "d93b54ffc7416b5354304daf156908f11d7e320a91bd936e397a15ede63caae3"
+		logic_hash = "v1_sha256_d93b54ffc7416b5354304daf156908f11d7e320a91bd936e397a15ede63caae3"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366513,8 +363250,6 @@ rule SIGNATURE_BASE_Portscan
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Proport_Zip_Folder_Proport
 {
 	meta:
@@ -366524,10 +363259,10 @@ rule SIGNATURE_BASE_Proport_Zip_Folder_Proport
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L377-L394"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L377-L394"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c1937a86939d4d12d10fc44b7ab9ab27"
-		logic_hash = "0ee2ffc5ed243d170b8013b3a164a3719f43bd473f4af7e1a2697d88a298fe9f"
+		logic_hash = "v1_sha256_0ee2ffc5ed243d170b8013b3a164a3719f43bd473f4af7e1a2697d88a298fe9f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366545,8 +363280,6 @@ rule SIGNATURE_BASE_Proport_Zip_Folder_Proport
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Stealthwasp_S_Basic_Portscanner_V1_2
 {
 	meta:
@@ -366556,10 +363289,10 @@ rule SIGNATURE_BASE_Stealthwasp_S_Basic_Portscanner_V1_2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L396-L407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L396-L407"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7c0f2cab134534cd35964fe4c6a1ff00"
-		logic_hash = "b01c165b5e5be3ba6905e8bc44a14c3d7195effd058e4c0c31678777d19db8b5"
+		logic_hash = "v1_sha256_b01c165b5e5be3ba6905e8bc44a14c3d7195effd058e4c0c31678777d19db8b5"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366571,8 +363304,6 @@ rule SIGNATURE_BASE_Stealthwasp_S_Basic_Portscanner_V1_2
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bluesportscan
 {
 	meta:
@@ -366582,10 +363313,10 @@ rule SIGNATURE_BASE_Bluesportscan
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L409-L420"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L409-L420"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6292f5fc737511f91af5e35643fc9eef"
-		logic_hash = "5cb4e4b87eaf166c85d23114f5abc10ef83b4a29968bf6fef4b3fce7ff2787fd"
+		logic_hash = "v1_sha256_5cb4e4b87eaf166c85d23114f5abc10ef83b4a29968bf6fef4b3fce7ff2787fd"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366597,8 +363328,6 @@ rule SIGNATURE_BASE_Bluesportscan
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Scanarator_Iis
 {
 	meta:
@@ -366608,10 +363337,10 @@ rule SIGNATURE_BASE_Scanarator_Iis
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L422-L433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L422-L433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
-		logic_hash = "092cb902e10624b207b7932e6b3c1fe2277ed1d183e5de9ee4d07d8548e90ab6"
+		logic_hash = "v1_sha256_092cb902e10624b207b7932e6b3c1fe2277ed1d183e5de9ee4d07d8548e90ab6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366623,8 +363352,6 @@ rule SIGNATURE_BASE_Scanarator_Iis
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Stealth_Stealth
 {
 	meta:
@@ -366634,10 +363361,10 @@ rule SIGNATURE_BASE_Stealth_Stealth
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L435-L446"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L435-L446"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
-		logic_hash = "e210b1a553549c22f66511dfc9d0d3f5b17f02981b9e9915827bc909f34b3262"
+		logic_hash = "v1_sha256_e210b1a553549c22f66511dfc9d0d3f5b17f02981b9e9915827bc909f34b3262"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366649,8 +363376,6 @@ rule SIGNATURE_BASE_Stealth_Stealth
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Angry_IP_Scanner_V2_08_Ipscan
 {
 	meta:
@@ -366660,10 +363385,10 @@ rule SIGNATURE_BASE_Angry_IP_Scanner_V2_08_Ipscan
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L448-L460"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L448-L460"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "70cf2c09776a29c3e837cb79d291514a"
-		logic_hash = "1b50856ad35c146a684298a86f1629c45996ab08ffae8486a388805262ec2367"
+		logic_hash = "v1_sha256_1b50856ad35c146a684298a86f1629c45996ab08ffae8486a388805262ec2367"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366676,8 +363401,6 @@ rule SIGNATURE_BASE_Angry_IP_Scanner_V2_08_Ipscan
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Crack_Loader
 {
 	meta:
@@ -366687,10 +363410,10 @@ rule SIGNATURE_BASE_Crack_Loader
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L462-L473"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L462-L473"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f4f79358a6c600c1f0ba1f7e4879a16d"
-		logic_hash = "3380ace7c34c15dfd9a9625c8c4a1ed7e35c1cf3c2eca9b1e00dd0092d256150"
+		logic_hash = "v1_sha256_3380ace7c34c15dfd9a9625c8c4a1ed7e35c1cf3c2eca9b1e00dd0092d256150"
 		score = 75
 		quality = 85
 		tags = ""
@@ -366702,8 +363425,6 @@ rule SIGNATURE_BASE_Crack_Loader
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_GUI_Scanner
 {
 	meta:
@@ -366713,10 +363434,10 @@ rule SIGNATURE_BASE_CN_GUI_Scanner
 		date = "2014-04-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L475-L492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L475-L492"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3c67bbb1911cdaef5e675c56145e1112"
-		logic_hash = "f9281277ad7058527699d1f5037bb78be1363c90f38e2e399592c58f0b313bd7"
+		logic_hash = "v1_sha256_f9281277ad7058527699d1f5037bb78be1363c90f38e2e399592c58f0b313bd7"
 		score = 65
 		quality = 85
 		tags = ""
@@ -366732,8 +363453,6 @@ rule SIGNATURE_BASE_CN_GUI_Scanner
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Packed_Scanner : FILE
 {
 	meta:
@@ -366743,10 +363462,10 @@ rule SIGNATURE_BASE_CN_Packed_Scanner : FILE
 		date = "2014-06-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L494-L510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L494-L510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
-		logic_hash = "0d9178ec65029e4ce8d4c3cc28ebd041c612f3a48f095b60c7a4515de03cccf4"
+		logic_hash = "v1_sha256_0d9178ec65029e4ce8d4c3cc28ebd041c612f3a48f095b60c7a4515de03cccf4"
 		score = 40
 		quality = 83
 		tags = "FILE"
@@ -366759,10 +363478,8 @@ rule SIGNATURE_BASE_CN_Packed_Scanner : FILE
 		$s4 = "WS2_32.DLL" fullword ascii
 
 	condition:
-		all of them and filesize <180KB and filesize >70KB
+		all of them and filesize < 180KB and filesize > 70KB
 }
-import "pe"
-
 rule SIGNATURE_BASE_Tiny_Network_Tool_Generic : FILE
 {
 	meta:
@@ -366772,9 +363489,9 @@ rule SIGNATURE_BASE_Tiny_Network_Tool_Generic : FILE
 		date = "2014-08-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L512-L545"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "efd04ee3a7bb120cdff00369e1856dd03ec9db84e1fb3196bf5e1a8ebd302802"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L512-L545"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_efd04ee3a7bb120cdff00369e1856dd03ec9db84e1fb3196bf5e1a8ebd302802"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -366801,10 +363518,8 @@ rule SIGNATURE_BASE_Tiny_Network_Tool_Generic : FILE
 		$z4 = "ToAscii" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and ( all of ($y*) or all of ($x*) or all of ($z*)) and filesize <15KB
+		uint16( 0 ) == 0x5a4d and all of ( $s* ) and ( all of ( $y* ) or all of ( $x* ) or all of ( $z* ) ) and filesize < 15KB
 }
-import "pe"
-
 rule SIGNATURE_BASE_Beastdoor_Backdoor
 {
 	meta:
@@ -366814,10 +363529,10 @@ rule SIGNATURE_BASE_Beastdoor_Backdoor
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L547-L567"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L547-L567"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
-		logic_hash = "35aa5d66c0fd4bf1995fc23a68283e8a28f31b5a1e1f3b742dd0ab89c48bf403"
+		logic_hash = "v1_sha256_35aa5d66c0fd4bf1995fc23a68283e8a28f31b5a1e1f3b742dd0ab89c48bf403"
 		score = 55
 		quality = 85
 		tags = ""
@@ -366837,8 +363552,6 @@ rule SIGNATURE_BASE_Beastdoor_Backdoor
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Powershell_Netcat
 {
 	meta:
@@ -366848,9 +363561,9 @@ rule SIGNATURE_BASE_Powershell_Netcat
 		date = "2014-10-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L569-L583"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff9d7c3e83fd27620559306c07556ce7afd1ba7a5db5f5c21ad0841d58b85014"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L569-L583"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff9d7c3e83fd27620559306c07556ce7afd1ba7a5db5f5c21ad0841d58b85014"
 		score = 60
 		quality = 85
 		tags = ""
@@ -366864,8 +363577,6 @@ rule SIGNATURE_BASE_Powershell_Netcat
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Chinese_Hacktool_1014
 {
 	meta:
@@ -366875,10 +363586,10 @@ rule SIGNATURE_BASE_Chinese_Hacktool_1014
 		date = "2014-10-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L585-L602"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L585-L602"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "98c07a62f7f0842bcdbf941170f34990"
-		logic_hash = "ffb1f653fd536a46dae4bf2c91c3c0582b703b8f0d33838b9736083e307a8e79"
+		logic_hash = "v1_sha256_ffb1f653fd536a46dae4bf2c91c3c0582b703b8f0d33838b9736083e307a8e79"
 		score = 60
 		quality = 85
 		tags = ""
@@ -366894,8 +363605,6 @@ rule SIGNATURE_BASE_Chinese_Hacktool_1014
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Hacktool_BAT_Portsopen
 {
 	meta:
@@ -366905,9 +363614,9 @@ rule SIGNATURE_BASE_CN_Hacktool_BAT_Portsopen
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L604-L618"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e5bc7b3264d7fc63fcc6c3d7e45859eb83b8ce60bd9a918f5eff887f626d09a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L604-L618"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e5bc7b3264d7fc63fcc6c3d7e45859eb83b8ce60bd9a918f5eff887f626d09a3"
 		score = 60
 		quality = 85
 		tags = ""
@@ -366921,8 +363630,6 @@ rule SIGNATURE_BASE_CN_Hacktool_BAT_Portsopen
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Hacktool_Ssport_Portscanner
 {
 	meta:
@@ -366932,9 +363639,9 @@ rule SIGNATURE_BASE_CN_Hacktool_Ssport_Portscanner
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L620-L634"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "30c380b6c683cbcbef7072e793d94e1782206b844fa23d334b737818f0a32f9f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L620-L634"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_30c380b6c683cbcbef7072e793d94e1782206b844fa23d334b737818f0a32f9f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -366948,8 +363655,6 @@ rule SIGNATURE_BASE_CN_Hacktool_Ssport_Portscanner
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Hacktool_Scanport_Portscanner
 {
 	meta:
@@ -366959,9 +363664,9 @@ rule SIGNATURE_BASE_CN_Hacktool_Scanport_Portscanner
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L636-L650"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa2dce57cc3e9baecb80b0165dfeb1af1ba4c4b30098e3b1252eb98b4fc30f7f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L636-L650"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa2dce57cc3e9baecb80b0165dfeb1af1ba4c4b30098e3b1252eb98b4fc30f7f"
 		score = 70
 		quality = 60
 		tags = ""
@@ -366975,8 +363680,6 @@ rule SIGNATURE_BASE_CN_Hacktool_Scanport_Portscanner
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Hacktool_S_EXE_Portscanner
 {
 	meta:
@@ -366986,9 +363689,9 @@ rule SIGNATURE_BASE_CN_Hacktool_S_EXE_Portscanner
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L652-L666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "658ae90f3af3c7abec6e692b6be350939ba7b654a9972d1a1016ff33e815a1de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L652-L666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_658ae90f3af3c7abec6e692b6be350939ba7b654a9972d1a1016ff33e815a1de"
 		score = 70
 		quality = 85
 		tags = ""
@@ -367002,8 +363705,6 @@ rule SIGNATURE_BASE_CN_Hacktool_S_EXE_Portscanner
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Hacktool_Milkt_BAT
 {
 	meta:
@@ -367013,9 +363714,9 @@ rule SIGNATURE_BASE_CN_Hacktool_Milkt_BAT
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L668-L681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ad74c45db0ef52223eb4dd162a21c57074a4ecb869a841d836d14afc997a7478"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L668-L681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ad74c45db0ef52223eb4dd162a21c57074a4ecb869a841d836d14afc997a7478"
 		score = 70
 		quality = 85
 		tags = ""
@@ -367028,8 +363729,6 @@ rule SIGNATURE_BASE_CN_Hacktool_Milkt_BAT
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Hacktool_Milkt_Scanner
 {
 	meta:
@@ -367039,9 +363738,9 @@ rule SIGNATURE_BASE_CN_Hacktool_Milkt_Scanner
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L683-L701"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "707cbd625b5694b710d01622a053e60828da7f70b38e43012d04364137583fe9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L683-L701"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_707cbd625b5694b710d01622a053e60828da7f70b38e43012d04364137583fe9"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367059,8 +363758,6 @@ rule SIGNATURE_BASE_CN_Hacktool_Milkt_Scanner
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner : FILE
 {
 	meta:
@@ -367070,9 +363767,9 @@ rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner : FILE
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L703-L720"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3e51e3596fc90bcea46236728da5437a9b6f56a42d64a651940321f575b32129"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L703-L720"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3e51e3596fc90bcea46236728da5437a9b6f56a42d64a651940321f575b32129"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -367087,10 +363784,8 @@ rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner : FILE
 		$s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*)
+		uint16( 0 ) == 0x5a4d and all of ( $s* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner_Comp2 : FILE
 {
 	meta:
@@ -367100,9 +363795,9 @@ rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner_Comp2 : FILE
 		date = "2014-12-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L722-L736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7c84d59a821531d9e741a05a23a911bb1caa825a18bb6532381e5ff38193c260"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L722-L736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7c84d59a821531d9e741a05a23a911bb1caa825a18bb6532381e5ff38193c260"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -367114,10 +363809,8 @@ rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner_Comp2 : FILE
 		$s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*)
+		uint16( 0 ) == 0x5a4d and all of ( $s* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_WCE_Modified_1_1014
 {
 	meta:
@@ -367127,10 +363820,10 @@ rule SIGNATURE_BASE_WCE_Modified_1_1014
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L738-L752"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L738-L752"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "09a412ac3c85cedce2642a19e99d8f903a2e0354"
-		logic_hash = "f094d635aabea9b9101fad3d0d23ad37692317ae5b4f636296ee612752c4421f"
+		logic_hash = "v1_sha256_f094d635aabea9b9101fad3d0d23ad37692317ae5b4f636296ee612752c4421f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -367144,8 +363837,6 @@ rule SIGNATURE_BASE_WCE_Modified_1_1014
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ikat_Wmi_Rundll : FILE
 {
 	meta:
@@ -367155,10 +363846,10 @@ rule SIGNATURE_BASE_Ikat_Wmi_Rundll : FILE
 		date = "2014-05-11"
 		modified = "2023-12-05"
 		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L773-L794"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L773-L794"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
-		logic_hash = "b857e17c790a97468ae69c8cbec6474ee38bea25bb04520516a2603996d4bd41"
+		logic_hash = "v1_sha256_b857e17c790a97468ae69c8cbec6474ee38bea25bb04520516a2603996d4bd41"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -367175,10 +363866,8 @@ rule SIGNATURE_BASE_Ikat_Wmi_Rundll : FILE
 		$s7 = "CoUninitialize" fullword ascii
 
 	condition:
-		all of them and filesize <15KB
+		all of them and filesize < 15KB
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ikat_Revelations
 {
 	meta:
@@ -367188,10 +363877,10 @@ rule SIGNATURE_BASE_Ikat_Revelations
 		date = "2014-05-11"
 		modified = "2023-12-05"
 		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L796-L813"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L796-L813"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
-		logic_hash = "0f3aa9e784beb7de8b560ecde8cc06d49e07f5e4ea4acb233ec9ac007179d7a3"
+		logic_hash = "v1_sha256_0f3aa9e784beb7de8b560ecde8cc06d49e07f5e4ea4acb233ec9ac007179d7a3"
 		score = 75
 		quality = 60
 		tags = ""
@@ -367206,8 +363895,6 @@ rule SIGNATURE_BASE_Ikat_Revelations
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ikat_Priv_Esc_Tasksch
 {
 	meta:
@@ -367217,10 +363904,10 @@ rule SIGNATURE_BASE_Ikat_Priv_Esc_Tasksch
 		date = "2014-05-11"
 		modified = "2023-12-05"
 		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L815-L841"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L815-L841"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
-		logic_hash = "6d0f755a758aaac4328f5f4343b424c03c2751ddad6a1dbe7c0332171c027945"
+		logic_hash = "v1_sha256_6d0f755a758aaac4328f5f4343b424c03c2751ddad6a1dbe7c0332171c027945"
 		score = 75
 		quality = 85
 		tags = ""
@@ -367244,8 +363931,6 @@ rule SIGNATURE_BASE_Ikat_Priv_Esc_Tasksch
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ikat_Command_Lines_Agent
 {
 	meta:
@@ -367255,10 +363940,10 @@ rule SIGNATURE_BASE_Ikat_Command_Lines_Agent
 		date = "2014-05-11"
 		modified = "2023-12-05"
 		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L843-L864"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L843-L864"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
-		logic_hash = "a39f8e388aa11c732156753f4a19aa9cc3ccd0437de30cdcc608926320a089b0"
+		logic_hash = "v1_sha256_a39f8e388aa11c732156753f4a19aa9cc3ccd0437de30cdcc608926320a089b0"
 		score = 75
 		quality = 60
 		tags = ""
@@ -367277,8 +363962,6 @@ rule SIGNATURE_BASE_Ikat_Command_Lines_Agent
 	condition:
 		4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ikat_Cmd_As_Dll
 {
 	meta:
@@ -367288,10 +363971,10 @@ rule SIGNATURE_BASE_Ikat_Cmd_As_Dll
 		date = "2014-05-11"
 		modified = "2023-12-05"
 		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L866-L884"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L866-L884"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b5d0ba941efbc3b5c97fe70f70c14b2050b8336a"
-		logic_hash = "3f8390fb6eb16749e63379222a5899b811e7ccd6b3b219b60d7a621fd4595e7b"
+		logic_hash = "v1_sha256_3f8390fb6eb16749e63379222a5899b811e7ccd6b3b219b60d7a621fd4595e7b"
 		score = 65
 		quality = 85
 		tags = ""
@@ -367304,10 +363987,8 @@ rule SIGNATURE_BASE_Ikat_Cmd_As_Dll
 		$ext = "extension: .dll" nocase
 
 	condition:
-		all of ($s*) and $ext
+		all of ( $s* ) and $ext
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ikat_Tools_Nmap
 {
 	meta:
@@ -367317,10 +363998,10 @@ rule SIGNATURE_BASE_Ikat_Tools_Nmap
 		date = "2014-05-11"
 		modified = "2023-12-05"
 		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L886-L903"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L886-L903"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d0543f365df61e6ebb5e345943577cc40fca8682"
-		logic_hash = "f538d807ed4904a2c321385a095a97bc0d718349f7eb31a367e521228412cef2"
+		logic_hash = "v1_sha256_f538d807ed4904a2c321385a095a97bc0d718349f7eb31a367e521228412cef2"
 		score = 50
 		quality = 83
 		tags = ""
@@ -367335,8 +364016,6 @@ rule SIGNATURE_BASE_Ikat_Tools_Nmap
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ikat_Startbar
 {
 	meta:
@@ -367346,10 +364025,10 @@ rule SIGNATURE_BASE_Ikat_Startbar
 		date = "2014-05-11"
 		modified = "2023-12-05"
 		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L905-L925"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L905-L925"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0cac59b80b5427a8780168e1b85c540efffaf74f"
-		logic_hash = "adb29d4903a771b0dab9dee8313878757ff12fc014da86291e32eb3ec60bf551"
+		logic_hash = "v1_sha256_adb29d4903a771b0dab9dee8313878757ff12fc014da86291e32eb3ec60bf551"
 		score = 50
 		quality = 85
 		tags = ""
@@ -367367,8 +364046,6 @@ rule SIGNATURE_BASE_Ikat_Startbar
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ikat_Tool_Generic
 {
 	meta:
@@ -367378,9 +364055,9 @@ rule SIGNATURE_BASE_Ikat_Tool_Generic
 		date = "2014-05-11"
 		modified = "2023-12-05"
 		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L927-L953"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5c5aa2d7d82d4b65541c5b6bcae6260fdaed0030493ed689363722cd78fd0a26"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L927-L953"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5c5aa2d7d82d4b65541c5b6bcae6260fdaed0030493ed689363722cd78fd0a26"
 		score = 55
 		quality = 85
 		tags = ""
@@ -367405,8 +364082,6 @@ rule SIGNATURE_BASE_Ikat_Tool_Generic
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bypassuac2
 {
 	meta:
@@ -367416,10 +364091,10 @@ rule SIGNATURE_BASE_Bypassuac2
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L955-L967"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L955-L967"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ef3e7dd2d1384ecec1a37254303959a43695df61"
-		logic_hash = "398783fa0453a60fd1c6aa64eacfbfa7c5385e81c79d1b6a8a8386dae9b825cc"
+		logic_hash = "v1_sha256_398783fa0453a60fd1c6aa64eacfbfa7c5385e81c79d1b6a8a8386dae9b825cc"
 		score = 75
 		quality = 85
 		tags = ""
@@ -367432,8 +364107,6 @@ rule SIGNATURE_BASE_Bypassuac2
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bypassuac_3
 {
 	meta:
@@ -367443,10 +364116,10 @@ rule SIGNATURE_BASE_Bypassuac_3
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L969-L982"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L969-L982"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1974aacd0ed987119999735cad8413031115ce35"
-		logic_hash = "cf3183ff4562f2962f87bc594c1710c73c113fa1d49fa56f7a3ff391ba4b9003"
+		logic_hash = "v1_sha256_cf3183ff4562f2962f87bc594c1710c73c113fa1d49fa56f7a3ff391ba4b9003"
 		score = 75
 		quality = 60
 		tags = ""
@@ -367460,8 +364133,6 @@ rule SIGNATURE_BASE_Bypassuac_3
 	condition:
 		3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bypassuacdll_6
 {
 	meta:
@@ -367471,10 +364142,10 @@ rule SIGNATURE_BASE_Bypassuacdll_6
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1000-L1011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1000-L1011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
-		logic_hash = "3cb89875ddf79a3709aeb58149e228e03b9fb43fa1565aab5ece743857b4cc71"
+		logic_hash = "v1_sha256_3cb89875ddf79a3709aeb58149e228e03b9fb43fa1565aab5ece743857b4cc71"
 		score = 75
 		quality = 85
 		tags = ""
@@ -367486,8 +364157,6 @@ rule SIGNATURE_BASE_Bypassuacdll_6
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bypassuac_EXE
 {
 	meta:
@@ -367497,10 +364166,10 @@ rule SIGNATURE_BASE_Bypassuac_EXE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1013-L1027"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1013-L1027"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
-		logic_hash = "0283efd6866ed9417f2d255715f04c0ed6d7a89befce6a3a52c22ac06593c0bd"
+		logic_hash = "v1_sha256_0283efd6866ed9417f2d255715f04c0ed6d7a89befce6a3a52c22ac06593c0bd"
 		score = 75
 		quality = 60
 		tags = ""
@@ -367515,8 +364184,6 @@ rule SIGNATURE_BASE_Bypassuac_EXE
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Proxy_Malware_Packed_Dev
 {
 	meta:
@@ -367526,10 +364193,10 @@ rule SIGNATURE_BASE_APT_Proxy_Malware_Packed_Dev
 		date = "2014-11-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1029-L1044"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1029-L1044"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6b6a86ceeab64a6cb273debfa82aec58"
-		logic_hash = "64b15aaf93b40744b887c75fa26f4996d72045a55ac82ab4de89a0d9a3714684"
+		logic_hash = "v1_sha256_64b15aaf93b40744b887c75fa26f4996d72045a55ac82ab4de89a0d9a3714684"
 		score = 50
 		quality = 85
 		tags = ""
@@ -367542,8 +364209,6 @@ rule SIGNATURE_BASE_APT_Proxy_Malware_Packed_Dev
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Tzddos_Ddos_Tool_CN
 {
 	meta:
@@ -367553,10 +364218,10 @@ rule SIGNATURE_BASE_Tzddos_Ddos_Tool_CN
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1046-L1065"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1046-L1065"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d4c517eda5458247edae59309453e0ae7d812f8e"
-		logic_hash = "fed09a8586f9b573e46871efa71082f4573d2bd069fde9cc2928b267d0025bab"
+		logic_hash = "v1_sha256_fed09a8586f9b573e46871efa71082f4573d2bd069fde9cc2928b267d0025bab"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367574,8 +364239,6 @@ rule SIGNATURE_BASE_Tzddos_Ddos_Tool_CN
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ncat_Hacktools_CN
 {
 	meta:
@@ -367585,10 +364248,10 @@ rule SIGNATURE_BASE_Ncat_Hacktools_CN
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1067-L1085"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1067-L1085"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "001c0c01c96fa56216159f83f6f298755366e528"
-		logic_hash = "0e059e90447747ed5259da4a870036d37d181c1cfea734ab25e760e81612f0f3"
+		logic_hash = "v1_sha256_0e059e90447747ed5259da4a870036d37d181c1cfea734ab25e760e81612f0f3"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367605,8 +364268,6 @@ rule SIGNATURE_BASE_Ncat_Hacktools_CN
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MS08_067_Exploit_Hacktools_CN
 {
 	meta:
@@ -367616,10 +364277,10 @@ rule SIGNATURE_BASE_MS08_067_Exploit_Hacktools_CN
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1087-L1106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1087-L1106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a3e9e0655447494253a1a60dbc763d9661181322"
-		logic_hash = "e5756250de401324d0c86f855bc088c8364e4a632cece25e553939fa621b73d8"
+		logic_hash = "v1_sha256_e5756250de401324d0c86f855bc088c8364e4a632cece25e553939fa621b73d8"
 		score = 60
 		quality = 60
 		tags = ""
@@ -367637,8 +364298,6 @@ rule SIGNATURE_BASE_MS08_067_Exploit_Hacktools_CN
 	condition:
 		4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Burst_Sql
 {
 	meta:
@@ -367648,10 +364307,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Sql
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1108-L1129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1108-L1129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d5139b865e99b7a276af7ae11b14096adb928245"
-		logic_hash = "139f7308055351d9dc8a704c055360ac9408dcefc9eee4b9f222886fb5249b8c"
+		logic_hash = "v1_sha256_139f7308055351d9dc8a704c055360ac9408dcefc9eee4b9f222886fb5249b8c"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367671,8 +364330,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Sql
 	condition:
 		6 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Panda_445TOOL
 {
 	meta:
@@ -367682,10 +364339,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_445TOOL
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1131-L1147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1131-L1147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "92050ba43029f914696289598cf3b18e34457a11"
-		logic_hash = "69a17bf7735eea946a5326d9535e68b8f010f2a0229875970b1bb15029c6dc4e"
+		logic_hash = "v1_sha256_69a17bf7735eea946a5326d9535e68b8f010f2a0229875970b1bb15029c6dc4e"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367700,8 +364357,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_445TOOL
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Panda_445
 {
 	meta:
@@ -367711,10 +364366,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_445
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1149-L1169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1149-L1169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a61316578bcbde66f39d88e7fc113c134b5b966b"
-		logic_hash = "d3f5b2c601dfa1702bbd1f8bdc1f847dd34ba84a6c527a3e02cdb76075e4ad2c"
+		logic_hash = "v1_sha256_d3f5b2c601dfa1702bbd1f8bdc1f847dd34ba84a6c527a3e02cdb76075e4ad2c"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367733,8 +364388,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_445
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Wineggdrop
 {
 	meta:
@@ -367744,10 +364397,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Wineggdrop
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1171-L1194"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1171-L1194"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7665011742ce01f57e8dc0a85d35ec556035145d"
-		logic_hash = "6123a07038e30e11e37a70b912a1c854c13341e67eaf4ed14ca9954288a42d62"
+		logic_hash = "v1_sha256_6123a07038e30e11e37a70b912a1c854c13341e67eaf4ed14ca9954288a42d62"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367769,8 +364422,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Wineggdrop
 	condition:
 		5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Scan_BAT
 {
 	meta:
@@ -367780,10 +364431,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Scan_BAT
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1196-L1214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1196-L1214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
-		logic_hash = "eed941d2ad5d33d7224504b08d2104d4043fab7a2ff027fc54cd1afd42e32549"
+		logic_hash = "v1_sha256_eed941d2ad5d33d7224504b08d2104d4043fab7a2ff027fc54cd1afd42e32549"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367800,8 +364451,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Scan_BAT
 	condition:
 		5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Panda_Burst
 {
 	meta:
@@ -367811,10 +364460,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_Burst
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1216-L1229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1216-L1229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
-		logic_hash = "c334019cab377f4d96f5daee6a2f1fa7e24ecc43b3aee1eb76537640fdfd8a97"
+		logic_hash = "v1_sha256_c334019cab377f4d96f5daee6a2f1fa7e24ecc43b3aee1eb76537640fdfd8a97"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367826,8 +364475,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_Burst
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_445_Cmd : FILE
 {
 	meta:
@@ -367837,10 +364484,10 @@ rule SIGNATURE_BASE_Hacktools_CN_445_Cmd : FILE
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1231-L1246"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1231-L1246"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "69b105a3aec3234819868c1a913772c40c6b727a"
-		logic_hash = "e0ab572fe9009ddc39f34302d8a16531c23f51ce4ea373d57a039f22ccc934c7"
+		logic_hash = "v1_sha256_e0ab572fe9009ddc39f34302d8a16531c23f51ce4ea373d57a039f22ccc934c7"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -367852,10 +364499,8 @@ rule SIGNATURE_BASE_Hacktools_CN_445_Cmd : FILE
 		$s2 = "nc %1 4444" fullword ascii
 
 	condition:
-		uint32(0)==0x68636540 and $bat at 0 and all of ($s*)
+		uint32( 0 ) == 0x68636540 and $bat at 0 and all of ( $s* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_GOGOGO_Bat
 {
 	meta:
@@ -367865,10 +364510,10 @@ rule SIGNATURE_BASE_Hacktools_CN_GOGOGO_Bat
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1248-L1273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1248-L1273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4bd4f5b070acf7fe70460d7eefb3623366074bbd"
-		logic_hash = "0209ffba87ff07379c768c1c00496a37f0f9bc6b786a31afdafe55d65a9f39ab"
+		logic_hash = "v1_sha256_0209ffba87ff07379c768c1c00496a37f0f9bc6b786a31afdafe55d65a9f39ab"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367892,8 +364537,6 @@ rule SIGNATURE_BASE_Hacktools_CN_GOGOGO_Bat
 	condition:
 		3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Burst_Pass
 {
 	meta:
@@ -367903,10 +364546,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Pass
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1275-L1298"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1275-L1298"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "55a05cf93dbd274355d798534be471dff26803f9"
-		logic_hash = "3a30cc602a66bd87304756311d56e7c698c1edb0b4b209198c589c4792776992"
+		logic_hash = "v1_sha256_3a30cc602a66bd87304756311d56e7c698c1edb0b4b209198c589c4792776992"
 		score = 60
 		quality = 60
 		tags = ""
@@ -367928,8 +364571,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Pass
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Johor_Posts_Killer
 {
 	meta:
@@ -367939,10 +364580,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Johor_Posts_Killer
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1300-L1321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1300-L1321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
-		logic_hash = "2fc63cd42619a2b92ab8670b14ab4c01eb3b194cd337d329ba224b7088d26318"
+		logic_hash = "v1_sha256_2fc63cd42619a2b92ab8670b14ab4c01eb3b194cd337d329ba224b7088d26318"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367962,8 +364603,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Johor_Posts_Killer
 	condition:
 		5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Panda_Tesksd
 {
 	meta:
@@ -367973,10 +364612,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_Tesksd
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1323-L1338"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1323-L1338"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
-		logic_hash = "dc81acef0ad3e6307f68ee755e5b27f2dcf1e2822e560a72dc5ae572703f4459"
+		logic_hash = "v1_sha256_dc81acef0ad3e6307f68ee755e5b27f2dcf1e2822e560a72dc5ae572703f4459"
 		score = 60
 		quality = 85
 		tags = ""
@@ -367990,8 +364629,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_Tesksd
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Http : FILE
 {
 	meta:
@@ -368001,10 +364638,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Http : FILE
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1340-L1356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1340-L1356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
-		logic_hash = "690b41bdf856e0d4d90b4a42524134302e9649018fdd495c359582aa6121a017"
+		logic_hash = "v1_sha256_690b41bdf856e0d4d90b4a42524134302e9649018fdd495c359582aa6121a017"
 		score = 60
 		quality = 83
 		tags = "FILE"
@@ -368017,10 +364654,8 @@ rule SIGNATURE_BASE_Hacktools_CN_Http : FILE
 		$s3 = "_controlfp" fullword ascii
 
 	condition:
-		all of them and filesize <10KB
+		all of them and filesize < 10KB
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Burst_Start
 {
 	meta:
@@ -368030,10 +364665,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Start
 		date = "2014-11-17"
 		modified = "2023-01-27"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1358-L1380"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1358-L1380"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "75d194d53ccc37a68286d246f2a84af6b070e30c"
-		logic_hash = "b435957150da7b790809d2cf90a01c967127c183ddcbf333beda1a7c599b69a5"
+		logic_hash = "v1_sha256_b435957150da7b790809d2cf90a01c967127c183ddcbf333beda1a7c599b69a5"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368053,8 +364688,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Start
 	condition:
 		5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Panda_Tasksvr
 {
 	meta:
@@ -368064,10 +364697,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_Tasksvr
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1382-L1397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1382-L1397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
-		logic_hash = "183708e525ec6676662b59a2a3c79f5113a80f2d5b3bd4713c74a536fe303b2d"
+		logic_hash = "v1_sha256_183708e525ec6676662b59a2a3c79f5113a80f2d5b3bd4713c74a536fe303b2d"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368081,8 +364714,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_Tasksvr
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Burst_Clear
 {
 	meta:
@@ -368092,10 +364723,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Clear
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1398-L1419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1398-L1419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
-		logic_hash = "d10ed2c6ea3f1a8b289529cc90f50f84288003576aced903f48db3c2abc4722d"
+		logic_hash = "v1_sha256_d10ed2c6ea3f1a8b289529cc90f50f84288003576aced903f48db3c2abc4722d"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368115,8 +364746,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Clear
 	condition:
 		5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Burst_Thecard
 {
 	meta:
@@ -368126,10 +364755,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Thecard
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1421-L1438"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1421-L1438"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "50b01ea0bfa5ded855b19b024d39a3d632bacb4c"
-		logic_hash = "29e1fb2e0bfa60e5406f9fd1c0ec99f0fc1b416ffc4d59846627e40959a32c63"
+		logic_hash = "v1_sha256_29e1fb2e0bfa60e5406f9fd1c0ec99f0fc1b416ffc4d59846627e40959a32c63"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368145,8 +364774,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Thecard
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hacktools_CN_Burst_Blast
 {
 	meta:
@@ -368156,10 +364783,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Blast
 		date = "2014-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1440-L1454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1440-L1454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b07702a381fa2eaee40b96ae2443918209674051"
-		logic_hash = "77902c7b23bab80d035f1dbe074554f16f99b2c9e31c80171296a1d33f705dac"
+		logic_hash = "v1_sha256_77902c7b23bab80d035f1dbe074554f16f99b2c9e31c80171296a1d33f705dac"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368172,8 +364799,6 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Blast
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Vubrute_Vubrute
 {
 	meta:
@@ -368183,10 +364808,10 @@ rule SIGNATURE_BASE_Vubrute_Vubrute
 		date = "2014-11-22"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1456-L1472"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1456-L1472"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "166fa8c5a0ebb216c832ab61bf8872da556576a7"
-		logic_hash = "9dab03b70b249c0c481e3bc98c3196e83da93ea2723674d38baf32469392d52a"
+		logic_hash = "v1_sha256_9dab03b70b249c0c481e3bc98c3196e83da93ea2723674d38baf32469392d52a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -368201,8 +364826,6 @@ rule SIGNATURE_BASE_Vubrute_Vubrute
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_DK_Brute
 {
 	meta:
@@ -368212,10 +364835,10 @@ rule SIGNATURE_BASE_DK_Brute
 		date = "2014-11-22"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/xiIphp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1474-L1491"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1474-L1491"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "93b7c3a01c41baecfbe42461cb455265f33fbc3d"
-		logic_hash = "a48ba3513c9c99066e9dda02859089e9e1db15e7bd52443795771609f011c94a"
+		logic_hash = "v1_sha256_a48ba3513c9c99066e9dda02859089e9e1db15e7bd52443795771609f011c94a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -368230,8 +364853,6 @@ rule SIGNATURE_BASE_DK_Brute
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Vubrute_Config
 {
 	meta:
@@ -368241,10 +364862,10 @@ rule SIGNATURE_BASE_Vubrute_Config
 		date = "2014-11-22"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/xiIphp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1493-L1513"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1493-L1513"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b9f66b9265d2370dab887604921167c11f7d93e9"
-		logic_hash = "b4c54d5ecb269c7310b5bd2a9e8fe5d6c75503f8cb1f25679399e25185d9cb51"
+		logic_hash = "v1_sha256_b4c54d5ecb269c7310b5bd2a9e8fe5d6c75503f8cb1f25679399e25185d9cb51"
 		score = 70
 		quality = 85
 		tags = ""
@@ -368262,8 +364883,6 @@ rule SIGNATURE_BASE_Vubrute_Config
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Hunt
 {
 	meta:
@@ -368273,10 +364892,10 @@ rule SIGNATURE_BASE_Sig_238_Hunt
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1515-L1534"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1515-L1534"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f9f059380d95c7f8d26152b1cb361d93492077ca"
-		logic_hash = "66d22c4dc2864d61bd485d6840887905f020fce8e19bb976ec09acaa6ed0387c"
+		logic_hash = "v1_sha256_66d22c4dc2864d61bd485d6840887905f020fce8e19bb976ec09acaa6ed0387c"
 		score = 60
 		quality = 83
 		tags = ""
@@ -368294,8 +364913,6 @@ rule SIGNATURE_BASE_Sig_238_Hunt
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Listip
 {
 	meta:
@@ -368305,10 +364922,10 @@ rule SIGNATURE_BASE_Sig_238_Listip
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1536-L1554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1536-L1554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
-		logic_hash = "db5cc21e8c76fdd10953ba0f06c4a1ad319ee522d9def7777dad66612b51edfc"
+		logic_hash = "v1_sha256_db5cc21e8c76fdd10953ba0f06c4a1ad319ee522d9def7777dad66612b51edfc"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368325,8 +364942,6 @@ rule SIGNATURE_BASE_Sig_238_Listip
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Arttrayhookdll
 {
 	meta:
@@ -368336,10 +364951,10 @@ rule SIGNATURE_BASE_Arttrayhookdll
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1556-L1570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1556-L1570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4867214a3d96095d14aa8575f0adbb81a9381e6c"
-		logic_hash = "e43cefdb11df870f4732e74782ecefb94c0a4850c4aa994e4fbc940f523d2434"
+		logic_hash = "v1_sha256_e43cefdb11df870f4732e74782ecefb94c0a4850c4aa994e4fbc940f523d2434"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368352,8 +364967,6 @@ rule SIGNATURE_BASE_Arttrayhookdll
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Eee
 {
 	meta:
@@ -368363,10 +364976,10 @@ rule SIGNATURE_BASE_Sig_238_Eee
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1572-L1591"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1572-L1591"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "236916ce2980c359ff1d5001af6dacb99227d9cb"
-		logic_hash = "b12c11f46125a33a2d7d9d02f25762c07b9d5088f70887c000b29e82a7921399"
+		logic_hash = "v1_sha256_b12c11f46125a33a2d7d9d02f25762c07b9d5088f70887c000b29e82a7921399"
 		score = 60
 		quality = 60
 		tags = ""
@@ -368384,8 +364997,6 @@ rule SIGNATURE_BASE_Sig_238_Eee
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspbackdoor_Asp4
 {
 	meta:
@@ -368395,10 +365006,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Asp4
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1593-L1613"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1593-L1613"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "faf991664fd82a8755feb65334e5130f791baa8c"
-		logic_hash = "dab19a2b92bbfe17cb860981d7bd5c3f3dd1a9e7c2ac5093fc4117f9205c1c27"
+		logic_hash = "v1_sha256_dab19a2b92bbfe17cb860981d7bd5c3f3dd1a9e7c2ac5093fc4117f9205c1c27"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368417,8 +365028,6 @@ rule SIGNATURE_BASE_Aspbackdoor_Asp4
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspfile1
 {
 	meta:
@@ -368428,10 +365037,10 @@ rule SIGNATURE_BASE_Aspfile1
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1615-L1633"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1615-L1633"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
-		logic_hash = "4968e44f807f8ffface65e21fd8684ccfaee281b4da10f5110482c3f26ccac26"
+		logic_hash = "v1_sha256_4968e44f807f8ffface65e21fd8684ccfaee281b4da10f5110482c3f26ccac26"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368448,8 +365057,6 @@ rule SIGNATURE_BASE_Aspfile1
 	condition:
 		3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Editserver
 {
 	meta:
@@ -368459,10 +365066,10 @@ rule SIGNATURE_BASE_Editserver
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1635-L1657"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1635-L1657"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "87b29c9121cac6ae780237f7e04ee3bc1a9777d3"
-		logic_hash = "6a8f6fcf8f4a0ea5ac114150d7becbd716be0bb40cd45fd5c76a4a8a328e5e40"
+		logic_hash = "v1_sha256_6a8f6fcf8f4a0ea5ac114150d7becbd716be0bb40cd45fd5c76a4a8a328e5e40"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368480,10 +365087,8 @@ rule SIGNATURE_BASE_Editserver
 		$x1 = "WinEggDrop Shell Congirator" fullword ascii
 
 	condition:
-		5 of ($s*) or $x1
+		5 of ( $s* ) or $x1
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Letmein
 {
 	meta:
@@ -368493,10 +365098,10 @@ rule SIGNATURE_BASE_Sig_238_Letmein
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1659-L1675"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1659-L1675"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
-		logic_hash = "6cf454d11bc806b3a30c52b730994adb8d92613c92849162717f415e5681e417"
+		logic_hash = "v1_sha256_6cf454d11bc806b3a30c52b730994adb8d92613c92849162717f415e5681e417"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368511,8 +365116,6 @@ rule SIGNATURE_BASE_Sig_238_Letmein
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Token
 {
 	meta:
@@ -368522,10 +365125,10 @@ rule SIGNATURE_BASE_Sig_238_Token
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1677-L1694"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1677-L1694"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c52bc6543d4281aa75a3e6e2da33cfb4b7c34b14"
-		logic_hash = "88d7086a48c6a2e3801db75565184b087e663e80e2364765072fc37a5549b8b5"
+		logic_hash = "v1_sha256_88d7086a48c6a2e3801db75565184b087e663e80e2364765072fc37a5549b8b5"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368541,8 +365144,6 @@ rule SIGNATURE_BASE_Sig_238_Token
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_TELNET
 {
 	meta:
@@ -368552,10 +365153,10 @@ rule SIGNATURE_BASE_Sig_238_TELNET
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1696-L1712"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1696-L1712"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
-		logic_hash = "4e90d95b7c94933ed5c50f060840291540fc99de0173298b97d2c6ccbf75d26a"
+		logic_hash = "v1_sha256_4e90d95b7c94933ed5c50f060840291540fc99de0173298b97d2c6ccbf75d26a"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368570,8 +365171,6 @@ rule SIGNATURE_BASE_Sig_238_TELNET
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Snifferport
 {
 	meta:
@@ -368581,10 +365180,10 @@ rule SIGNATURE_BASE_Snifferport
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1714-L1731"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1714-L1731"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d14133b5eaced9b7039048d0767c544419473144"
-		logic_hash = "361f1a55ed4bd5a7a5d01d346c4efd1b83e701363484282235b5aab18d3abe1a"
+		logic_hash = "v1_sha256_361f1a55ed4bd5a7a5d01d346c4efd1b83e701363484282235b5aab18d3abe1a"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368600,8 +365199,6 @@ rule SIGNATURE_BASE_Snifferport
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Webget
 {
 	meta:
@@ -368611,10 +365208,10 @@ rule SIGNATURE_BASE_Sig_238_Webget
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1733-L1749"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1733-L1749"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
-		logic_hash = "958c465caddf6436b29042f1f1772e039d011d23ff13d91818a9d7ad21a2c750"
+		logic_hash = "v1_sha256_958c465caddf6436b29042f1f1772e039d011d23ff13d91818a9d7ad21a2c750"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368629,8 +365226,6 @@ rule SIGNATURE_BASE_Sig_238_Webget
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Xyzcmd
 {
 	meta:
@@ -368640,10 +365235,10 @@ rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Xyzcmd
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1751-L1767"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1751-L1767"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bbea5a94950b0e8aab4a12ad80e09b630dd98115"
-		logic_hash = "ad0e8f964c7be376236b50ea370de3e433fa9e7b043663d8f32fad06997056ea"
+		logic_hash = "v1_sha256_ad0e8f964c7be376236b50ea370de3e433fa9e7b043663d8f32fad06997056ea"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368658,8 +365253,6 @@ rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Xyzcmd
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspack_Chinese
 {
 	meta:
@@ -368669,10 +365262,10 @@ rule SIGNATURE_BASE_Aspack_Chinese
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1769-L1786"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1769-L1786"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "02a9394bc2ec385876c4b4f61d72471ac8251a8e"
-		logic_hash = "98b3af76986cd41190612a2fdfbd9ba48f102456897f4acaedd89a40ab5a582a"
+		logic_hash = "v1_sha256_98b3af76986cd41190612a2fdfbd9ba48f102456897f4acaedd89a40ab5a582a"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368688,8 +365281,6 @@ rule SIGNATURE_BASE_Aspack_Chinese
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspbackdoor_EDIR
 {
 	meta:
@@ -368699,10 +365290,10 @@ rule SIGNATURE_BASE_Aspbackdoor_EDIR
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1788-L1805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1788-L1805"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
-		logic_hash = "be7d956333107a57a0fd86c69fc9eabcd3d9daf3f66385c44ba246fc2000dc4d"
+		logic_hash = "v1_sha256_be7d956333107a57a0fd86c69fc9eabcd3d9daf3f66385c44ba246fc2000dc4d"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368718,8 +365309,6 @@ rule SIGNATURE_BASE_Aspbackdoor_EDIR
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Ie
 {
 	meta:
@@ -368729,10 +365318,10 @@ rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Ie
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1807-L1823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1807-L1823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d1b9058f16399e182c9b78314ad18b975d882131"
-		logic_hash = "844e260870f075b0afae0667691e61ab8f138a29871f9a18d1f2b623f9bb9e2a"
+		logic_hash = "v1_sha256_844e260870f075b0afae0667691e61ab8f138a29871f9a18d1f2b623f9bb9e2a"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368747,8 +365336,6 @@ rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Ie
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Editkeylogreadme
 {
 	meta:
@@ -368758,10 +365345,10 @@ rule SIGNATURE_BASE_Editkeylogreadme
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1825-L1843"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1825-L1843"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
-		logic_hash = "a58a2336e7d714a2e7f60eec8dacbee9a7190552dd791d8b6eba084ffaf0904a"
+		logic_hash = "v1_sha256_a58a2336e7d714a2e7f60eec8dacbee9a7190552dd791d8b6eba084ffaf0904a"
 		score = 60
 		quality = 35
 		tags = ""
@@ -368778,8 +365365,6 @@ rule SIGNATURE_BASE_Editkeylogreadme
 	condition:
 		3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Passsniffer_Zip_Folder_Readme
 {
 	meta:
@@ -368789,10 +365374,10 @@ rule SIGNATURE_BASE_Passsniffer_Zip_Folder_Readme
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1845-L1860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1845-L1860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
-		logic_hash = "d9e6cd2ba7e98481664b0560184a07349bb471dd370c4b73ef5f5f05a8e89946"
+		logic_hash = "v1_sha256_d9e6cd2ba7e98481664b0560184a07349bb471dd370c4b73ef5f5f05a8e89946"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368806,8 +365391,6 @@ rule SIGNATURE_BASE_Passsniffer_Zip_Folder_Readme
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Gina
 {
 	meta:
@@ -368817,10 +365400,10 @@ rule SIGNATURE_BASE_Sig_238_Gina
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1862-L1877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1862-L1877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "324acc52566baf4afdb0f3e4aaf76e42899e0cf6"
-		logic_hash = "f0ece7406a31f5a4212da5c4144233c5c45b8120d09267fdf7e291d6c9827384"
+		logic_hash = "v1_sha256_f0ece7406a31f5a4212da5c4144233c5c45b8120d09267fdf7e291d6c9827384"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368834,8 +365417,6 @@ rule SIGNATURE_BASE_Sig_238_Gina
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Splitjoin
 {
 	meta:
@@ -368845,10 +365426,10 @@ rule SIGNATURE_BASE_Splitjoin
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1879-L1895"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1879-L1895"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
-		logic_hash = "dede4518ed9be28e89bc67dab4e68503383c16746f088f37a4c8069e256183ca"
+		logic_hash = "v1_sha256_dede4518ed9be28e89bc67dab4e68503383c16746f088f37a4c8069e256183ca"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368863,8 +365444,6 @@ rule SIGNATURE_BASE_Splitjoin
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Editkeylog
 {
 	meta:
@@ -368874,10 +365453,10 @@ rule SIGNATURE_BASE_Editkeylog
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1897-L1913"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1897-L1913"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
-		logic_hash = "0efb173598117857c5bf7894f017d655653e843dd0a44439d1b10b7e5c59b248"
+		logic_hash = "v1_sha256_0efb173598117857c5bf7894f017d655653e843dd0a44439d1b10b7e5c59b248"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368892,8 +365471,6 @@ rule SIGNATURE_BASE_Editkeylog
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Passsniffer
 {
 	meta:
@@ -368903,10 +365480,10 @@ rule SIGNATURE_BASE_Passsniffer
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1915-L1933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1915-L1933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
-		logic_hash = "771b45473c48618c43c6be84dd37b2ccb23643f1674d437763cb78ce560067c0"
+		logic_hash = "v1_sha256_771b45473c48618c43c6be84dd37b2ccb23643f1674d437763cb78ce560067c0"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368923,8 +365500,6 @@ rule SIGNATURE_BASE_Passsniffer
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspfile2
 {
 	meta:
@@ -368934,10 +365509,10 @@ rule SIGNATURE_BASE_Aspfile2
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1935-L1951"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1935-L1951"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
-		logic_hash = "0fd52e646751b14840f30100382c5171fd001c05110dccb4ac87be9b2c4b6131"
+		logic_hash = "v1_sha256_0fd52e646751b14840f30100382c5171fd001c05110dccb4ac87be9b2c4b6131"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368952,8 +365527,6 @@ rule SIGNATURE_BASE_Aspfile2
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Unpack_Rar_Folder_Injectt
 {
 	meta:
@@ -368963,10 +365536,10 @@ rule SIGNATURE_BASE_Unpack_Rar_Folder_Injectt
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1953-L1976"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1953-L1976"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
-		logic_hash = "f9d682a9438f49cf8292c33e680537d8c2137b8cba2670430b92d0a620de85b9"
+		logic_hash = "v1_sha256_f9d682a9438f49cf8292c33e680537d8c2137b8cba2670430b92d0a620de85b9"
 		score = 60
 		quality = 85
 		tags = ""
@@ -368985,10 +365558,8 @@ rule SIGNATURE_BASE_Unpack_Rar_Folder_Injectt
 		$x2 = "injectt.exe" fullword ascii
 
 	condition:
-		(1 of ($x*)) and (3 of ($s*))
+		(1 of ( $x* ) ) and ( 3 of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Jc_Wineggdrop_Shell
 {
 	meta:
@@ -368998,10 +365569,10 @@ rule SIGNATURE_BASE_Jc_Wineggdrop_Shell
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1978-L1997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1978-L1997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
-		logic_hash = "af43980b4052cef56884e9d6bdbb12919f1a86420a3f189e30fba624ab37a420"
+		logic_hash = "v1_sha256_af43980b4052cef56884e9d6bdbb12919f1a86420a3f189e30fba624ab37a420"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369019,8 +365590,6 @@ rule SIGNATURE_BASE_Jc_Wineggdrop_Shell
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspbackdoor_Asp1
 {
 	meta:
@@ -369030,10 +365599,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Asp1
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L1999-L2017"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L1999-L2017"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
-		logic_hash = "7ce1911d7524e9961f907f863b3966817bcad7a571c933dac6a76e1d8a1eeaf8"
+		logic_hash = "v1_sha256_7ce1911d7524e9961f907f863b3966817bcad7a571c933dac6a76e1d8a1eeaf8"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369050,8 +365619,6 @@ rule SIGNATURE_BASE_Aspbackdoor_Asp1
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_QQ_Zip_Folder_QQ
 {
 	meta:
@@ -369061,10 +365628,10 @@ rule SIGNATURE_BASE_QQ_Zip_Folder_QQ
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2019-L2039"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2019-L2039"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
-		logic_hash = "d2517c3646b9a3babfa767c5c57b4b576fda471c190ab66e1054c4de359713ad"
+		logic_hash = "v1_sha256_d2517c3646b9a3babfa767c5c57b4b576fda471c190ab66e1054c4de359713ad"
 		score = 60
 		quality = 35
 		tags = ""
@@ -369083,8 +365650,6 @@ rule SIGNATURE_BASE_QQ_Zip_Folder_QQ
 	condition:
 		5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Unpack_Rar_Folder_Tback
 {
 	meta:
@@ -369094,10 +365659,10 @@ rule SIGNATURE_BASE_Unpack_Rar_Folder_Tback
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2041-L2069"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2041-L2069"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
-		logic_hash = "89f978742ab952b727a9a8dbab0cd88cfc07440e8c4f974dcfa14ed630083761"
+		logic_hash = "v1_sha256_89f978742ab952b727a9a8dbab0cd88cfc07440e8c4f974dcfa14ed630083761"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369124,8 +365689,6 @@ rule SIGNATURE_BASE_Unpack_Rar_Folder_Tback
 	condition:
 		4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Cmd_2
 {
 	meta:
@@ -369135,10 +365698,10 @@ rule SIGNATURE_BASE_Sig_238_Cmd_2
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2071-L2088"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2071-L2088"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "be4073188879dacc6665b6532b03db9f87cfc2bb"
-		logic_hash = "a794d6b60194a190bd8d549ad00cf90649a52d831fdc7539c68a1f6312609bc2"
+		logic_hash = "v1_sha256_a794d6b60194a190bd8d549ad00cf90649a52d831fdc7539c68a1f6312609bc2"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369154,8 +365717,6 @@ rule SIGNATURE_BASE_Sig_238_Cmd_2
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Rangescan
 {
 	meta:
@@ -369165,10 +365726,10 @@ rule SIGNATURE_BASE_Rangescan
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2090-L2107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2090-L2107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
-		logic_hash = "f334a59c2d95505807df642a8d5605b1b7d8b3385a552e8f5a37f344d7a75412"
+		logic_hash = "v1_sha256_f334a59c2d95505807df642a8d5605b1b7d8b3385a552e8f5a37f344d7a75412"
 		score = 60
 		quality = 35
 		tags = ""
@@ -369184,8 +365745,6 @@ rule SIGNATURE_BASE_Rangescan
 	condition:
 		3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Readme
 {
 	meta:
@@ -369195,10 +365754,10 @@ rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Readme
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2109-L2123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2109-L2123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
-		logic_hash = "38d69eee78ff8fa2ad064871481bd1b8a926146922952c7e199d27c809d0c980"
+		logic_hash = "v1_sha256_38d69eee78ff8fa2ad064871481bd1b8a926146922952c7e199d27c809d0c980"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369211,8 +365770,6 @@ rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Readme
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Inject
 {
 	meta:
@@ -369222,10 +365779,10 @@ rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Inject
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2125-L2140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2125-L2140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "34f564301da528ce2b3e5907fd4b1acb7cb70728"
-		logic_hash = "6350e11097bc2bb8fb0fbecf6be463aeaf39ad4169d2dd06a57577bf02b515f8"
+		logic_hash = "v1_sha256_6350e11097bc2bb8fb0fbecf6be463aeaf39ad4169d2dd06a57577bf02b515f8"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369239,8 +365796,6 @@ rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Inject
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Sqlcmd
 {
 	meta:
@@ -369250,10 +365805,10 @@ rule SIGNATURE_BASE_Sig_238_Sqlcmd
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2142-L2161"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2142-L2161"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b6e356ce6ca5b3c932fa6028d206b1085a2e1a9a"
-		logic_hash = "1e41c38da7552d6a25c918547a39ed07ec38a537fd04e2090d1199c4fb0e3b1e"
+		logic_hash = "v1_sha256_1e41c38da7552d6a25c918547a39ed07ec38a537fd04e2090d1199c4fb0e3b1e"
 		score = 40
 		quality = 85
 		tags = ""
@@ -369271,8 +365826,6 @@ rule SIGNATURE_BASE_Sig_238_Sqlcmd
 	condition:
 		4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspack_ASPACK
 {
 	meta:
@@ -369282,10 +365835,10 @@ rule SIGNATURE_BASE_Aspack_ASPACK
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2163-L2178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2163-L2178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
-		logic_hash = "1c7abc0a126ee8c8b20e55ad85974067f1a230efc5f95a1a1e732025e39d5bab"
+		logic_hash = "v1_sha256_1c7abc0a126ee8c8b20e55ad85974067f1a230efc5f95a1a1e732025e39d5bab"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369299,8 +365852,6 @@ rule SIGNATURE_BASE_Aspack_ASPACK
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_2323
 {
 	meta:
@@ -369310,10 +365861,10 @@ rule SIGNATURE_BASE_Sig_238_2323
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2180-L2198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2180-L2198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "21812186a9e92ee7ddc6e91e4ec42991f0143763"
-		logic_hash = "1278c53f64a0ba7f3f6a728237eac6808b260ad36551923276bfba9b36586870"
+		logic_hash = "v1_sha256_1278c53f64a0ba7f3f6a728237eac6808b260ad36551923276bfba9b36586870"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369330,8 +365881,6 @@ rule SIGNATURE_BASE_Sig_238_2323
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Jc_ALL_Wineggdropshell_Rar_Folder_Install_2
 {
 	meta:
@@ -369341,10 +365890,10 @@ rule SIGNATURE_BASE_Jc_ALL_Wineggdropshell_Rar_Folder_Install_2
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2200-L2218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2200-L2218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "95866e917f699ee74d4735300568640ea1a05afd"
-		logic_hash = "9c12e8491918a656e37b4ee6c3a42ec970cb6cf101ca5fe3fdfe9eab16526219"
+		logic_hash = "v1_sha256_9c12e8491918a656e37b4ee6c3a42ec970cb6cf101ca5fe3fdfe9eab16526219"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369361,8 +365910,6 @@ rule SIGNATURE_BASE_Jc_ALL_Wineggdropshell_Rar_Folder_Install_2
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_TFTPD32
 {
 	meta:
@@ -369372,10 +365919,10 @@ rule SIGNATURE_BASE_Sig_238_TFTPD32
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2220-L2241"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2220-L2241"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5c5f8c1a2fa8c26f015e37db7505f7c9e0431fe8"
-		logic_hash = "cbf239330f8f1fd8be3ef3c93571c723447ca3b814fb7c1eff5ea4b2e7f5364f"
+		logic_hash = "v1_sha256_cbf239330f8f1fd8be3ef3c93571c723447ca3b814fb7c1eff5ea4b2e7f5364f"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369395,8 +365942,6 @@ rule SIGNATURE_BASE_Sig_238_TFTPD32
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Iecv
 {
 	meta:
@@ -369406,10 +365951,10 @@ rule SIGNATURE_BASE_Sig_238_Iecv
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2243-L2260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2243-L2260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6e6e75350a33f799039e7a024722cde463328b6d"
-		logic_hash = "e2985d85030d88cb63eb8b80673812f85aea6e11c6aeb430387cdb8886958b6a"
+		logic_hash = "v1_sha256_e2985d85030d88cb63eb8b80673812f85aea6e11c6aeb430387cdb8886958b6a"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369425,8 +365970,6 @@ rule SIGNATURE_BASE_Sig_238_Iecv
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Antiy_Ports_1_21
 {
 	meta:
@@ -369436,10 +365979,10 @@ rule SIGNATURE_BASE_Antiy_Ports_1_21
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2262-L2277"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2262-L2277"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
-		logic_hash = "fb175c413faf0ca33cf166029b217aac31126d6cabc81883c16b2de2ab00c16c"
+		logic_hash = "v1_sha256_fb175c413faf0ca33cf166029b217aac31126d6cabc81883c16b2de2ab00c16c"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369453,8 +365996,6 @@ rule SIGNATURE_BASE_Antiy_Ports_1_21
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Perlcmd_Zip_Folder_Cmd
 {
 	meta:
@@ -369464,10 +366005,10 @@ rule SIGNATURE_BASE_Perlcmd_Zip_Folder_Cmd
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2279-L2299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2279-L2299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "21b5dc36e72be5aca5969e221abfbbdd54053dd8"
-		logic_hash = "4391207d66b7ed5ac2db127d3efcf22f8c2bbd0ee1f0c6982d656b91e5e10c8f"
+		logic_hash = "v1_sha256_4391207d66b7ed5ac2db127d3efcf22f8c2bbd0ee1f0c6982d656b91e5e10c8f"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369486,8 +366027,6 @@ rule SIGNATURE_BASE_Perlcmd_Zip_Folder_Cmd
 	condition:
 		6 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspbackdoor_Asp3
 {
 	meta:
@@ -369497,10 +366036,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Asp3
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2301-L2321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2301-L2321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
-		logic_hash = "c62ae1d32e93a8614a8288ce2df8e26806ab67b3b133067182f0396f0f080b78"
+		logic_hash = "v1_sha256_c62ae1d32e93a8614a8288ce2df8e26806ab67b3b133067182f0396f0f080b78"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369519,8 +366058,6 @@ rule SIGNATURE_BASE_Aspbackdoor_Asp3
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Fpipe
 {
 	meta:
@@ -369530,10 +366067,10 @@ rule SIGNATURE_BASE_Sig_238_Fpipe
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2323-L2341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2323-L2341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
-		logic_hash = "ecf143c231aeb37cf9575c3ea8db83c9a049e85a7c95668deeac0878f9c30b9c"
+		logic_hash = "v1_sha256_ecf143c231aeb37cf9575c3ea8db83c9a049e85a7c95668deeac0878f9c30b9c"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369550,8 +366087,6 @@ rule SIGNATURE_BASE_Sig_238_Fpipe
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Concon
 {
 	meta:
@@ -369561,10 +366096,10 @@ rule SIGNATURE_BASE_Sig_238_Concon
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2343-L2356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2343-L2356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
-		logic_hash = "c45955cc59970657f8787ddc0e549939d2fa30d11cfd19fd12cd9067abb3bcd6"
+		logic_hash = "v1_sha256_c45955cc59970657f8787ddc0e549939d2fa30d11cfd19fd12cd9067abb3bcd6"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369576,8 +366111,6 @@ rule SIGNATURE_BASE_Sig_238_Concon
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspbackdoor_Regdll
 {
 	meta:
@@ -369587,10 +366120,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Regdll
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2358-L2374"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2358-L2374"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
-		logic_hash = "89606ccf4341ba9451fd1bfbc818bbcd55d45d50e06f09b9f1ecd8efb3c322af"
+		logic_hash = "v1_sha256_89606ccf4341ba9451fd1bfbc818bbcd55d45d50e06f09b9f1ecd8efb3c322af"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369605,8 +366138,6 @@ rule SIGNATURE_BASE_Aspbackdoor_Regdll
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Cleaniislog
 {
 	meta:
@@ -369616,10 +366147,10 @@ rule SIGNATURE_BASE_Cleaniislog
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2376-L2397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2376-L2397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
-		logic_hash = "77a26e57b36f73d4d2730bc3a4d8485718119e2ccc80b40de3515ec688616eb9"
+		logic_hash = "v1_sha256_77a26e57b36f73d4d2730bc3a4d8485718119e2ccc80b40de3515ec688616eb9"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369639,8 +366170,6 @@ rule SIGNATURE_BASE_Cleaniislog
 	condition:
 		5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sqlcheck
 {
 	meta:
@@ -369650,10 +366179,10 @@ rule SIGNATURE_BASE_Sqlcheck
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2399-L2416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2399-L2416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
-		logic_hash = "e9c1d7cabe7236e059f4bfec917ca00c47a3db955746ebfcda0f5e733de359c7"
+		logic_hash = "v1_sha256_e9c1d7cabe7236e059f4bfec917ca00c47a3db955746ebfcda0f5e733de359c7"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369669,8 +366198,6 @@ rule SIGNATURE_BASE_Sqlcheck
 	condition:
 		3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Runasex
 {
 	meta:
@@ -369680,10 +366207,10 @@ rule SIGNATURE_BASE_Sig_238_Runasex
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2418-L2436"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2418-L2436"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
-		logic_hash = "dac03251539028da02c9f26f20ca751ee577c125fb4f287c61ac2ea6afb1bb28"
+		logic_hash = "v1_sha256_dac03251539028da02c9f26f20ca751ee577c125fb4f287c61ac2ea6afb1bb28"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369700,8 +366227,6 @@ rule SIGNATURE_BASE_Sig_238_Runasex
 	condition:
 		4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Nbtdump
 {
 	meta:
@@ -369711,10 +366236,10 @@ rule SIGNATURE_BASE_Sig_238_Nbtdump
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2438-L2457"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2438-L2457"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
-		logic_hash = "fd17851820b5036b4cc1ebb6f927bb62c898027a17b5376e9420cbfa6a166ef2"
+		logic_hash = "v1_sha256_fd17851820b5036b4cc1ebb6f927bb62c898027a17b5376e9420cbfa6a166ef2"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369732,8 +366257,6 @@ rule SIGNATURE_BASE_Sig_238_Nbtdump
 	condition:
 		5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Glass2K
 {
 	meta:
@@ -369743,10 +366266,10 @@ rule SIGNATURE_BASE_Sig_238_Glass2K
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2459-L2476"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2459-L2476"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
-		logic_hash = "d9b6b904028d67804d095f85caea5796f528f866191d3b4250055a75511f2090"
+		logic_hash = "v1_sha256_d9b6b904028d67804d095f85caea5796f528f866191d3b4250055a75511f2090"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369762,8 +366285,6 @@ rule SIGNATURE_BASE_Sig_238_Glass2K
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Splitjoin_V1_3_3_Rar_Folder_3
 {
 	meta:
@@ -369773,10 +366294,10 @@ rule SIGNATURE_BASE_Splitjoin_V1_3_3_Rar_Folder_3
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2478-L2493"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2478-L2493"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "21409117b536664a913dcd159d6f4d8758f43435"
-		logic_hash = "79eb49413cd6919e4b91e916d2612e007fd2c4da7244d9e1e3dd04d46c461d8c"
+		logic_hash = "v1_sha256_79eb49413cd6919e4b91e916d2612e007fd2c4da7244d9e1e3dd04d46c461d8c"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369790,8 +366311,6 @@ rule SIGNATURE_BASE_Splitjoin_V1_3_3_Rar_Folder_3
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspbackdoor_EDIT
 {
 	meta:
@@ -369801,10 +366320,10 @@ rule SIGNATURE_BASE_Aspbackdoor_EDIT
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2495-L2514"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2495-L2514"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
-		logic_hash = "0f97c831eb9f257a2a6c9a677dde2ce17d529584fb7085bc94edd83d886e469f"
+		logic_hash = "v1_sha256_0f97c831eb9f257a2a6c9a677dde2ce17d529584fb7085bc94edd83d886e469f"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369822,8 +366341,6 @@ rule SIGNATURE_BASE_Aspbackdoor_EDIT
 	condition:
 		5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspbackdoor_Entice
 {
 	meta:
@@ -369833,10 +366350,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Entice
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2516-L2533"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2516-L2533"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
-		logic_hash = "c11313351565d26d9b16a2d5c3c4589676593fe633c441a1c1a33b3c134a2d56"
+		logic_hash = "v1_sha256_c11313351565d26d9b16a2d5c3c4589676593fe633c441a1c1a33b3c134a2d56"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369852,8 +366369,6 @@ rule SIGNATURE_BASE_Aspbackdoor_Entice
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Fpipe2_0
 {
 	meta:
@@ -369863,10 +366378,10 @@ rule SIGNATURE_BASE_Fpipe2_0
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2535-L2553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2535-L2553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "891609db7a6787575641154e7aab7757e74d837b"
-		logic_hash = "b28566315ddda7765dfee722f5ad02c1206c6916363d86407fdc61b53148f511"
+		logic_hash = "v1_sha256_b28566315ddda7765dfee722f5ad02c1206c6916363d86407fdc61b53148f511"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369883,8 +366398,6 @@ rule SIGNATURE_BASE_Fpipe2_0
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Instgina
 {
 	meta:
@@ -369894,10 +366407,10 @@ rule SIGNATURE_BASE_Instgina
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2555-L2570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2555-L2570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5317fbc39508708534246ef4241e78da41a4f31c"
-		logic_hash = "a55a13ced122b9901f0505d585e7a7c984d4231b3507282c1b15ff400ce51265"
+		logic_hash = "v1_sha256_a55a13ced122b9901f0505d585e7a7c984d4231b3507282c1b15ff400ce51265"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369911,8 +366424,6 @@ rule SIGNATURE_BASE_Instgina
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Arttray_Zip_Folder_Arttray
 {
 	meta:
@@ -369922,10 +366433,10 @@ rule SIGNATURE_BASE_Arttray_Zip_Folder_Arttray
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2572-L2588"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2572-L2588"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
-		logic_hash = "225be71bfd047331399162941edf06c72d2fd1afa04c78cbc51099665f50883b"
+		logic_hash = "v1_sha256_225be71bfd047331399162941edf06c72d2fd1afa04c78cbc51099665f50883b"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369940,8 +366451,6 @@ rule SIGNATURE_BASE_Arttray_Zip_Folder_Arttray
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Findoor
 {
 	meta:
@@ -369951,10 +366460,10 @@ rule SIGNATURE_BASE_Sig_238_Findoor
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2590-L2607"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2590-L2607"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
-		logic_hash = "223f324ab6b61775d500dc248b9db8363ce915ec279a893a6f0ec92b273a27c0"
+		logic_hash = "v1_sha256_223f324ab6b61775d500dc248b9db8363ce915ec279a893a6f0ec92b273a27c0"
 		score = 60
 		quality = 85
 		tags = ""
@@ -369970,8 +366479,6 @@ rule SIGNATURE_BASE_Sig_238_Findoor
 	condition:
 		4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Aspbackdoor_Ipclear
 {
 	meta:
@@ -369981,10 +366488,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Ipclear
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2609-L2626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2609-L2626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
-		logic_hash = "49fbe844a99aa8cae25db90e1d8cdeee13c81293bba7b3201afc4748cb0a6a7c"
+		logic_hash = "v1_sha256_49fbe844a99aa8cae25db90e1d8cdeee13c81293bba7b3201afc4748cb0a6a7c"
 		score = 60
 		quality = 85
 		tags = ""
@@ -370000,8 +366507,6 @@ rule SIGNATURE_BASE_Aspbackdoor_Ipclear
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wineggdropshellfinal_Zip_Folder_Injectt
 {
 	meta:
@@ -370011,10 +366516,10 @@ rule SIGNATURE_BASE_Wineggdropshellfinal_Zip_Folder_Injectt
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2628-L2645"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2628-L2645"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
-		logic_hash = "01840f4df12fbf6f5f27a3050c841002678605cd373e9ea9b182b2026caa29f9"
+		logic_hash = "v1_sha256_01840f4df12fbf6f5f27a3050c841002678605cd373e9ea9b182b2026caa29f9"
 		score = 60
 		quality = 85
 		tags = ""
@@ -370030,8 +366535,6 @@ rule SIGNATURE_BASE_Wineggdropshellfinal_Zip_Folder_Injectt
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Gina_Zip_Folder_Gina
 {
 	meta:
@@ -370041,10 +366544,10 @@ rule SIGNATURE_BASE_Gina_Zip_Folder_Gina
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2647-L2667"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2647-L2667"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e0429e1b59989cbab6646ba905ac312710f5ed30"
-		logic_hash = "1344634346f9e7e3ef96c901705ac7bd4aa9a70cfbebf71c8222544e84ca9f98"
+		logic_hash = "v1_sha256_1344634346f9e7e3ef96c901705ac7bd4aa9a70cfbebf71c8222544e84ca9f98"
 		score = 60
 		quality = 85
 		tags = ""
@@ -370063,8 +366566,6 @@ rule SIGNATURE_BASE_Gina_Zip_Folder_Gina
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Superscan3_0
 {
 	meta:
@@ -370074,10 +366575,10 @@ rule SIGNATURE_BASE_Superscan3_0
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2669-L2690"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2669-L2690"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
-		logic_hash = "448d3af61062c53c5b148e58697537bd98316e6c6d4d9ed9e0ff36cbd5a0b4f5"
+		logic_hash = "v1_sha256_448d3af61062c53c5b148e58697537bd98316e6c6d4d9ed9e0ff36cbd5a0b4f5"
 		score = 60
 		quality = 85
 		tags = ""
@@ -370097,8 +366598,6 @@ rule SIGNATURE_BASE_Superscan3_0
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Xsniff
 {
 	meta:
@@ -370108,10 +366607,10 @@ rule SIGNATURE_BASE_Sig_238_Xsniff
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2692-L2713"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2692-L2713"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
-		logic_hash = "90c08db197a00885ffc62967bd814479a438f500316cf65e81fcec617517dd9c"
+		logic_hash = "v1_sha256_90c08db197a00885ffc62967bd814479a438f500316cf65e81fcec617517dd9c"
 		score = 60
 		quality = 85
 		tags = ""
@@ -370131,8 +366630,6 @@ rule SIGNATURE_BASE_Sig_238_Xsniff
 	condition:
 		6 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_238_Fscan
 {
 	meta:
@@ -370142,10 +366639,10 @@ rule SIGNATURE_BASE_Sig_238_Fscan
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2715-L2736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2715-L2736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d5646e86b5257f9c83ea23eca3d86de336224e55"
-		logic_hash = "0af558345e8c85021fd4f8d399dacb3b6e8d9c692060c31a36e943fc48bfabff"
+		logic_hash = "v1_sha256_0af558345e8c85021fd4f8d399dacb3b6e8d9c692060c31a36e943fc48bfabff"
 		score = 60
 		quality = 85
 		tags = ""
@@ -370165,8 +366662,6 @@ rule SIGNATURE_BASE_Sig_238_Fscan
 	condition:
 		4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE__Iissample_Nesscan_Twwwscan
 {
 	meta:
@@ -370176,9 +366671,9 @@ rule SIGNATURE_BASE__Iissample_Nesscan_Twwwscan
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2738-L2764"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6088dd060507f4efa2f4c1770dc746100966e8a7475859918488d7be6c96bc31"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2738-L2764"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6088dd060507f4efa2f4c1770dc746100966e8a7475859918488d7be6c96bc31"
 		score = 60
 		quality = 85
 		tags = ""
@@ -370204,8 +366699,6 @@ rule SIGNATURE_BASE__Iissample_Nesscan_Twwwscan
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE__Fshttp_Fspop_Fssniffer
 {
 	meta:
@@ -370215,9 +366708,9 @@ rule SIGNATURE_BASE__Fshttp_Fspop_Fssniffer
 		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2766-L2792"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "50c91f1036ae467de51227b6782978c33607f94724d2e1b0af7c958028a84b48"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2766-L2792"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_50c91f1036ae467de51227b6782978c33607f94724d2e1b0af7c958028a84b48"
 		score = 60
 		quality = 85
 		tags = ""
@@ -370243,8 +366736,6 @@ rule SIGNATURE_BASE__Fshttp_Fspop_Fssniffer
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ammyy_Admin_AA_V3
 {
 	meta:
@@ -370254,9 +366745,9 @@ rule SIGNATURE_BASE_Ammyy_Admin_AA_V3
 		date = "2014-12-22"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/gkAg2E"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2794-L2818"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ab1de9f3b58cdb2c03f2d72986772333f8b81c98e6cbfd941f20b2fed1c5ff2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2794-L2818"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ab1de9f3b58cdb2c03f2d72986772333f8b81c98e6cbfd941f20b2fed1c5ff2"
 		score = 55
 		quality = 85
 		tags = ""
@@ -370276,10 +366767,8 @@ rule SIGNATURE_BASE_Ammyy_Admin_AA_V3
 		$s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii
 
 	condition:
-		2 of ($x*) or all of ($s*)
+		2 of ( $x* ) or all of ( $s* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Linuxhacktool_Eyes_Scanssh
 {
 	meta:
@@ -370289,10 +366778,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Scanssh
 		date = "2015-01-19"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2822-L2847"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2822-L2847"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "467398a6994e2c1a66a3d39859cde41f090623ad"
-		logic_hash = "cb20c28f1767ce23f60c377943d8a129fa069b1a1407bbaf43370f0ff79ade30"
+		logic_hash = "v1_sha256_cb20c28f1767ce23f60c377943d8a129fa069b1a1407bbaf43370f0ff79ade30"
 		score = 75
 		quality = 85
 		tags = ""
@@ -370316,8 +366805,6 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Scanssh
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2
 {
 	meta:
@@ -370327,10 +366814,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2
 		date = "2015-01-19"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2849-L2867"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2849-L2867"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "56b476cba702a4423a2d805a412cae8ef4330905"
-		logic_hash = "3686ccbd53a6dcedf9b10d131a1fc76b51b265328ad10f63671b64d4bf57a0b6"
+		logic_hash = "v1_sha256_3686ccbd53a6dcedf9b10d131a1fc76b51b265328ad10f63671b64d4bf57a0b6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -370347,8 +366834,6 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Linuxhacktool_Eyes_A
 {
 	meta:
@@ -370358,10 +366843,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_A
 		date = "2015-01-19"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2869-L2887"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2869-L2887"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
-		logic_hash = "a246eb907fd6525c96c911acde6b513fca68248ef8d4f8fa64039791942950ab"
+		logic_hash = "v1_sha256_a246eb907fd6525c96c911acde6b513fca68248ef8d4f8fa64039791942950ab"
 		score = 75
 		quality = 85
 		tags = ""
@@ -370378,8 +366863,6 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_A
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Linuxhacktool_Eyes_Mass
 {
 	meta:
@@ -370389,10 +366872,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Mass
 		date = "2015-01-19"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2889-L2906"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2889-L2906"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2054cb427daaca9e267b252307dad03830475f15"
-		logic_hash = "5bf17d1a8ae78681d2c3cba8511019ddf85e6d7a242900b56848521eef40ffc6"
+		logic_hash = "v1_sha256_5bf17d1a8ae78681d2c3cba8511019ddf85e6d7a242900b56848521eef40ffc6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -370408,8 +366891,6 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Mass
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2_2
 {
 	meta:
@@ -370419,10 +366900,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2_2
 		date = "2015-01-19"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2908-L2925"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2908-L2925"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "eb024dfb441471af7520215807c34d105efa5fd8"
-		logic_hash = "981514cf0887a1a7cb55fe9ed9dadd48adbf0f033e527b357e90e052a4c2d251"
+		logic_hash = "v1_sha256_981514cf0887a1a7cb55fe9ed9dadd48adbf0f033e527b357e90e052a4c2d251"
 		score = 75
 		quality = 85
 		tags = ""
@@ -370438,8 +366919,6 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2_2
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Portscan : APT FILE
 {
 	meta:
@@ -370449,9 +366928,9 @@ rule SIGNATURE_BASE_CN_Portscan : APT FILE
 		date = "2013-11-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2927-L2941"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e1b745bd321527cee3eb203847d00c9eda4a7b1e498cb8f0ad6b588f87221759"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2927-L2941"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e1b745bd321527cee3eb203847d00c9eda4a7b1e498cb8f0ad6b588f87221759"
 		score = 70
 		quality = 85
 		tags = "APT, FILE"
@@ -370462,10 +366941,8 @@ rule SIGNATURE_BASE_CN_Portscan : APT FILE
 		$s2 = "TCP 12.12.12.12"
 
 	condition:
-		uint16(0)==0x5A4D and $s2
+		uint16( 0 ) == 0x5A4D and $s2
 }
-import "pe"
-
 rule SIGNATURE_BASE_WMI_Vbs : APT
 {
 	meta:
@@ -370475,9 +366952,9 @@ rule SIGNATURE_BASE_WMI_Vbs : APT
 		date = "2013-11-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2943-L2957"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "94163981c1a80838d1bea1b21f713f1d8fbdac8704319d1a145f0b4f6d8ff3f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2943-L2957"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_94163981c1a80838d1bea1b21f713f1d8fbdac8704319d1a145f0b4f6d8ff3f6"
 		score = 70
 		quality = 85
 		tags = "APT"
@@ -370490,8 +366967,6 @@ rule SIGNATURE_BASE_WMI_Vbs : APT
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Toolset__Xscanlib_Xscanlib_Xscanlib
 {
 	meta:
@@ -370501,9 +366976,9 @@ rule SIGNATURE_BASE_CN_Toolset__Xscanlib_Xscanlib_Xscanlib
 		date = "2015-03-30"
 		modified = "2023-12-05"
 		reference = "http://qiannao.com/ls/905300366/33834c0c/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2959-L2980"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f7f66f1f3ca05e60ac850fbb94c471f664d2dc8a60c09b18686c9f2937296697"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2959-L2980"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f7f66f1f3ca05e60ac850fbb94c471f664d2dc8a60c09b18686c9f2937296697"
 		score = 70
 		quality = 85
 		tags = ""
@@ -370523,8 +366998,6 @@ rule SIGNATURE_BASE_CN_Toolset__Xscanlib_Xscanlib_Xscanlib
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Toolset_Ntscan_Pipecmd
 {
 	meta:
@@ -370534,10 +367007,10 @@ rule SIGNATURE_BASE_CN_Toolset_Ntscan_Pipecmd
 		date = "2015-03-30"
 		modified = "2023-12-05"
 		reference = "http://qiannao.com/ls/905300366/33834c0c/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L2982-L3006"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L2982-L3006"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
-		logic_hash = "2dab5a4de2abeff5659aa90fbc82bef359937ca9e45e8805b509baeb16943531"
+		logic_hash = "v1_sha256_2dab5a4de2abeff5659aa90fbc82bef359937ca9e45e8805b509baeb16943531"
 		score = 70
 		quality = 60
 		tags = ""
@@ -370559,8 +367032,6 @@ rule SIGNATURE_BASE_CN_Toolset_Ntscan_Pipecmd
 	condition:
 		4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Toolset_Lscanportss_2
 {
 	meta:
@@ -370570,10 +367041,10 @@ rule SIGNATURE_BASE_CN_Toolset_Lscanportss_2
 		date = "2015-03-30"
 		modified = "2023-12-05"
 		reference = "http://qiannao.com/ls/905300366/33834c0c/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3008-L3028"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3008-L3028"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4631ec57756466072d83d49fbc14105e230631a0"
-		logic_hash = "aeecdbef3fe6d66a209df10b44046783e53ef12f67c6877309cb219db4354733"
+		logic_hash = "v1_sha256_aeecdbef3fe6d66a209df10b44046783e53ef12f67c6877309cb219db4354733"
 		score = 70
 		quality = 85
 		tags = ""
@@ -370591,8 +367062,6 @@ rule SIGNATURE_BASE_CN_Toolset_Lscanportss_2
 	condition:
 		4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_CN_Toolset_Sig_1433_135_Sqlr
 {
 	meta:
@@ -370602,10 +367071,10 @@ rule SIGNATURE_BASE_CN_Toolset_Sig_1433_135_Sqlr
 		date = "2015-03-30"
 		modified = "2023-12-05"
 		reference = "http://qiannao.com/ls/905300366/33834c0c/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3030-L3047"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3030-L3047"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
-		logic_hash = "14c9d104cfb71a2d3545bfb6274e3a282d4597f38057187d76adaf26fe2718fa"
+		logic_hash = "v1_sha256_14c9d104cfb71a2d3545bfb6274e3a282d4597f38057187d76adaf26fe2718fa"
 		score = 70
 		quality = 85
 		tags = ""
@@ -370620,8 +367089,6 @@ rule SIGNATURE_BASE_CN_Toolset_Sig_1433_135_Sqlr
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Darkcomet_Keylogger_File : FILE
 {
 	meta:
@@ -370631,9 +367098,9 @@ rule SIGNATURE_BASE_Darkcomet_Keylogger_File : FILE
 		date = "2014-07-25"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3049-L3063"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "28f2eb8f5082559f9de4e72243f4bf8a0be21a9a4c5e16c443d036733584ea97"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3049-L3063"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_28f2eb8f5082559f9de4e72243f4bf8a0be21a9a4c5e16c443d036733584ea97"
 		score = 50
 		quality = 35
 		tags = "FILE"
@@ -370644,10 +367111,8 @@ rule SIGNATURE_BASE_Darkcomet_Keylogger_File : FILE
 		$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
 
 	condition:
-		uint16(0)==0x3A3A and #entry>10 and #timestamp>10
+		uint16( 0 ) == 0x3A3A and #entry > 10 and #timestamp > 10
 }
-import "pe"
-
 rule SIGNATURE_BASE_Vssown_VBS
 {
 	meta:
@@ -370657,9 +367122,9 @@ rule SIGNATURE_BASE_Vssown_VBS
 		date = "2015-10-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3065-L3082"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f49e9d7a07d591330e16fc539bd98d019b47dd8579d0f1ad92fa987790e64189"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3065-L3082"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f49e9d7a07d591330e16fc539bd98d019b47dd8579d0f1ad92fa987790e64189"
 		score = 75
 		quality = 85
 		tags = ""
@@ -370676,8 +367141,6 @@ rule SIGNATURE_BASE_Vssown_VBS
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Netview_Hacktool : FILE
 {
 	meta:
@@ -370687,10 +367150,10 @@ rule SIGNATURE_BASE_Netview_Hacktool : FILE
 		date = "2016-03-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/mubix/netview"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3084-L3107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3084-L3107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "52cec98839c3b7d9608c865cfebc904b4feae0bada058c2e8cdbd561cfa1420a"
-		logic_hash = "dc27d2358937d736823891c9d5c3f41f83a6f4e72d35fae0983435effda2141a"
+		logic_hash = "v1_sha256_dc27d2358937d736823891c9d5c3f41f83a6f4e72d35fae0983435effda2141a"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -370709,10 +367172,8 @@ rule SIGNATURE_BASE_Netview_Hacktool : FILE
 		$s10 = ": Specifies a domain to pull a list of hosts from" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 2 of them ) or 3 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 2 of them ) or 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Netview_Hacktool_Output
 {
 	meta:
@@ -370722,9 +367183,9 @@ rule SIGNATURE_BASE_Netview_Hacktool_Output
 		date = "2016-03-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/mubix/netview"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3109-L3124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "38a51e583b1485bdb29400cb9d0a73ec4d5387675779f949572d2b4d74da4230"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3109-L3124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_38a51e583b1485bdb29400cb9d0a73ec4d5387675779f949572d2b4d74da4230"
 		score = 60
 		quality = 85
 		tags = ""
@@ -370738,8 +367199,6 @@ rule SIGNATURE_BASE_Netview_Hacktool_Output
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Psattack_EXE : FILE
 {
 	meta:
@@ -370749,10 +367208,10 @@ rule SIGNATURE_BASE_Psattack_EXE : FILE
 		date = "2016-03-09"
 		modified = "2023-01-06"
 		reference = "https://github.com/gdssecurity/PSAttack/releases/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3135-L3155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3135-L3155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ad05d75640c850ee7eeee26422ba4f157be10a4e2d6dc6eaa19497d64cf23715"
-		logic_hash = "b73566eb6370fbe68f0477d1179e5d6c19fb9be2c29f63d560c42adcdf19fe58"
+		logic_hash = "v1_sha256_b73566eb6370fbe68f0477d1179e5d6c19fb9be2c29f63d560c42adcdf19fe58"
 		score = 100
 		quality = 60
 		tags = "FILE"
@@ -370766,10 +367225,8 @@ rule SIGNATURE_BASE_Psattack_EXE : FILE
 		$s4 = "PSAttack.Modules.key.txt" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and ($x1 or 2 of ($s*))) or 3 of them
+		( uint16( 0 ) == 0x5a4d and ( $x1 or 2 of ( $s* ) ) ) or 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Powershell_Attack_Scripts
 {
 	meta:
@@ -370779,9 +367236,9 @@ rule SIGNATURE_BASE_Powershell_Attack_Scripts
 		date = "2016-03-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3157-L3172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "42a52de089ee00e229499fea23b8acd0b7c881a9c578671aea180c0c018a54e0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3157-L3172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_42a52de089ee00e229499fea23b8acd0b7c881a9c578671aea180c0c018a54e0"
 		score = 70
 		quality = 85
 		tags = ""
@@ -370796,8 +367253,6 @@ rule SIGNATURE_BASE_Powershell_Attack_Scripts
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Psattack_ZIP : FILE
 {
 	meta:
@@ -370807,10 +367262,10 @@ rule SIGNATURE_BASE_Psattack_ZIP : FILE
 		date = "2016-03-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/gdssecurity/PSAttack/releases/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3174-L3188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3174-L3188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3864f0d44f90404be0c571ceb6f95bbea6c527bbfb2ec4a2b4f7d92e982e15a2"
-		logic_hash = "4c869e8663b8c87780d4be622f86b3887511e1ac3cfc67767f1c986af7d43767"
+		logic_hash = "v1_sha256_4c869e8663b8c87780d4be622f86b3887511e1ac3cfc67767f1c986af7d43767"
 		score = 100
 		quality = 85
 		tags = "FILE"
@@ -370820,10 +367275,8 @@ rule SIGNATURE_BASE_Psattack_ZIP : FILE
 		$s0 = "PSAttack.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x4b50 and all of them
+		uint16( 0 ) == 0x4b50 and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Linux_Portscan_Shark_1 : FILE
 {
 	meta:
@@ -370833,9 +367286,9 @@ rule SIGNATURE_BASE_Linux_Portscan_Shark_1 : FILE
 		date = "2016-04-01"
 		modified = "2023-12-05"
 		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3199-L3216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e807ed6c83c8d908bfe29c65abd7b877b65655cc64cd1497fc124a2fd88cd1e9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3199-L3216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e807ed6c83c8d908bfe29c65abd7b877b65655cc64cd1497fc124a2fd88cd1e9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -370850,10 +367303,8 @@ rule SIGNATURE_BASE_Linux_Portscan_Shark_1 : FILE
 		$s18 = "*** stack smashing detected ***: %s terminated" fullword ascii
 
 	condition:
-		( uint16(0)==0x7362 and all of them )
+		( uint16( 0 ) == 0x7362 and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Linux_Portscan_Shark_2
 {
 	meta:
@@ -370863,9 +367314,9 @@ rule SIGNATURE_BASE_Linux_Portscan_Shark_2
 		date = "2016-04-01"
 		modified = "2023-12-05"
 		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3218-L3235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "45efbbe01c45065efc07e9c75b6a7cdcae469861f84df4a1e1381fe864f7ddc0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3218-L3235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_45efbbe01c45065efc07e9c75b6a7cdcae469861f84df4a1e1381fe864f7ddc0"
 		score = 75
 		quality = 85
 		tags = ""
@@ -370882,8 +367333,6 @@ rule SIGNATURE_BASE_Linux_Portscan_Shark_2
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Dnscat2_Hacktool : FILE
 {
 	meta:
@@ -370893,9 +367342,9 @@ rule SIGNATURE_BASE_Dnscat2_Hacktool : FILE
 		date = "2016-05-15"
 		modified = "2023-12-05"
 		reference = "https://downloads.skullsecurity.org/dnscat2/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3244-L3263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c163a62b607323e08ca083a7091585550c830827728a8a60e25af8db6550ed1c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3244-L3263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c163a62b607323e08ca083a7091585550c830827728a8a60e25af8db6550ed1c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -370912,10 +367361,8 @@ rule SIGNATURE_BASE_Dnscat2_Hacktool : FILE
 		$s5 = "[Tunnel %d] connection to %s:%d closed by the server!" fullword ascii
 
 	condition:
-		(( uint16(0)==0x457f or uint16(0)==0x5a4d) and filesize <400KB and (2 of ($s*))) or ( all of them )
+		(( uint16( 0 ) == 0x457f or uint16( 0 ) == 0x5a4d ) and filesize < 400KB and ( 2 of ( $s* ) ) ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_WCE_In_Memory
 {
 	meta:
@@ -370925,9 +367372,9 @@ rule SIGNATURE_BASE_WCE_In_Memory
 		date = "2016-08-28"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3265-L3279"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "74ab7772db5b1de8a4eae03370e2be3cd35004730f84d472677688109a1d6d88"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3265-L3279"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_74ab7772db5b1de8a4eae03370e2be3cd35004730f84d472677688109a1d6d88"
 		score = 80
 		quality = 85
 		tags = ""
@@ -370940,8 +367387,6 @@ rule SIGNATURE_BASE_WCE_In_Memory
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Pstgdump : FILE
 {
 	meta:
@@ -370951,9 +367396,9 @@ rule SIGNATURE_BASE_Pstgdump : FILE
 		date = "2016-09-08"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3281-L3299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c4f8697b1b65007acc4fdabd1c6263a428448232f95dbb12d8f737297893157"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3281-L3299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c4f8697b1b65007acc4fdabd1c6263a428448232f95dbb12d8f737297893157"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -370969,10 +367414,8 @@ rule SIGNATURE_BASE_Pstgdump : FILE
 		$x6 = "Unable to obtain handle to PStoreCreateInstance in pstorec.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*)) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Lsremora : FILE
 {
 	meta:
@@ -370982,9 +367425,9 @@ rule SIGNATURE_BASE_Lsremora : FILE
 		date = "2016-09-08"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3301-L3323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ac8f6b7284307456749b3386340a2b3deb0718bc68875bc90bccf74a96469a59"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3301-L3323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ac8f6b7284307456749b3386340a2b3deb0718bc68875bc90bccf74a96469a59"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371003,10 +367446,8 @@ rule SIGNATURE_BASE_Lsremora : FILE
 		$s3 = "Using pipe %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*)) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Servpw : FILE
 {
 	meta:
@@ -371016,9 +367457,9 @@ rule SIGNATURE_BASE_Servpw : FILE
 		date = "2016-09-08"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3325-L3344"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "150466c23ea7aa20f6e60c592ab6bd2f42e3a48a65a6665b89a9f19fa61aae8f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3325-L3344"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_150466c23ea7aa20f6e60c592ab6bd2f42e3a48a65a6665b89a9f19fa61aae8f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371035,10 +367476,8 @@ rule SIGNATURE_BASE_Servpw : FILE
 		$s6 = "Thread code: %d, path: %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 3 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them ) or ( all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Fgexec : FILE
 {
 	meta:
@@ -371048,9 +367487,9 @@ rule SIGNATURE_BASE_Fgexec : FILE
 		date = "2016-09-08"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3346-L3362"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3672255d7829520aa8ca792519f645b86fe4244a16652a960375f23baa7d32b3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3346-L3362"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3672255d7829520aa8ca792519f645b86fe4244a16652a960375f23baa7d32b3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371064,10 +367503,8 @@ rule SIGNATURE_BASE_Fgexec : FILE
 		$x4 = "fizzgig and the mighty foofus.net team" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of ($x*)) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of ( $x* ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Cachedump : FILE
 {
 	meta:
@@ -371077,9 +367514,9 @@ rule SIGNATURE_BASE_Cachedump : FILE
 		date = "2016-09-08"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3364-L3384"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7e4d710ed9dab12114e87fa33abe6db6245c780b31bcd94fbd21e75aaa355ca8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3364-L3384"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7e4d710ed9dab12114e87fa33abe6db6245c780b31bcd94fbd21e75aaa355ca8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371097,10 +367534,8 @@ rule SIGNATURE_BASE_Cachedump : FILE
 		$s6 = "cacheDump [-v | -vv | -K]" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Pwdump_B : FILE
 {
 	meta:
@@ -371110,9 +367545,9 @@ rule SIGNATURE_BASE_Pwdump_B : FILE
 		date = "2016-09-08"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3386-L3406"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d50ad359b9433439cddda9408d227f35ee8de3280ad24f42c5e6ef1e6a1526bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3386-L3406"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d50ad359b9433439cddda9408d227f35ee8de3280ad24f42c5e6ef1e6a1526bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371129,10 +367564,8 @@ rule SIGNATURE_BASE_Pwdump_B : FILE
 		$s3 = "servpw.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of ($x*)) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of ( $x* ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Msbuild_Mimikatz_Execution_Via_XML
 {
 	meta:
@@ -371142,9 +367575,9 @@ rule SIGNATURE_BASE_Msbuild_Mimikatz_Execution_Via_XML
 		date = "2016-10-07"
 		modified = "2023-12-05"
 		reference = "https://gist.github.com/subTee/c98f7d005683e616560bda3286b6a0d8#file-katz-xml"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3417-L3436"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f926a2d5ab987b97c6ed2a89c69eac5549d8b7885bdbf75ce40e05e6ce6cfa7a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3417-L3436"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f926a2d5ab987b97c6ed2a89c69eac5549d8b7885bdbf75ce40e05e6ce6cfa7a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -371162,8 +367595,6 @@ rule SIGNATURE_BASE_Msbuild_Mimikatz_Execution_Via_XML
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Fscan_Portscanner : FILE
 {
 	meta:
@@ -371173,9 +367604,9 @@ rule SIGNATURE_BASE_Fscan_Portscanner : FILE
 		date = "2017-01-06"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/JamesHabben/status/817112447970480128"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3447-L3461"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "35770f040da0b14fe4492a44383e332c9912bd89943838627491196ce8f0ec37"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3447-L3461"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_35770f040da0b14fe4492a44383e332c9912bd89943838627491196ce8f0ec37"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371187,10 +367618,8 @@ rule SIGNATURE_BASE_Fscan_Portscanner : FILE
 		$s3 = "Scan started at" fullword ascii
 
 	condition:
-		filesize <20KB and 3 of them
+		filesize < 20KB and 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_WPR_Loader_EXE : FILE
 {
 	meta:
@@ -371200,9 +367629,9 @@ rule SIGNATURE_BASE_WPR_Loader_EXE : FILE
 		date = "2017-03-15"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3473-L3493"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "26af6fe1b3dfe8e3a48c03a9f6f2033fbc909a677d35159e28b7e9b867ea5542"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3473-L3493"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_26af6fe1b3dfe8e3a48c03a9f6f2033fbc909a677d35159e28b7e9b867ea5542"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371220,10 +367649,8 @@ rule SIGNATURE_BASE_WPR_Loader_EXE : FILE
 		$s8 = "nSeDebugPrivilege" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_WPR_Loader_DLL : FILE
 {
 	meta:
@@ -371233,9 +367660,9 @@ rule SIGNATURE_BASE_WPR_Loader_DLL : FILE
 		date = "2017-03-15"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3495-L3528"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "015334828007e954d1e910e6377b37bade99df2ce86152901ec4ded8c71975de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3495-L3528"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_015334828007e954d1e910e6377b37bade99df2ce86152901ec4ded8c71975de"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371259,10 +367686,8 @@ rule SIGNATURE_BASE_WPR_Loader_DLL : FILE
 		$op2 = { 48 83 c4 28 e9 bc 55 ff ff 48 8d 0d 4d a7 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and ((1 of ($x*) and 1 of ($s*)) or (1 of ($s*) and all of ($op*)))
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or ( 1 of ( $s* ) and all of ( $op* ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_WPR_Passscape_Loader : FILE
 {
 	meta:
@@ -371272,9 +367697,9 @@ rule SIGNATURE_BASE_WPR_Passscape_Loader : FILE
 		date = "2017-03-15"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3530-L3548"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "79b1a3ed1ea0d9a3ddee0b8557393318a8baf4812110a6ed03a7106b8096b31e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3530-L3548"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_79b1a3ed1ea0d9a3ddee0b8557393318a8baf4812110a6ed03a7106b8096b31e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371290,10 +367715,8 @@ rule SIGNATURE_BASE_WPR_Passscape_Loader : FILE
 		$s6 = "ast64 {msg1GkjN7Sh8sg2Al7ker63f}" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_WPR_Asterisk_Hook_Library : FILE
 {
 	meta:
@@ -371303,9 +367726,9 @@ rule SIGNATURE_BASE_WPR_Asterisk_Hook_Library : FILE
 		date = "2017-03-15"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3550-L3572"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6bb75cb8c3ba18a34f4651532060154608c78e6f748148226da4416ad1171124"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3550-L3572"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6bb75cb8c3ba18a34f4651532060154608c78e6f748148226da4416ad1171124"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371325,10 +367748,8 @@ rule SIGNATURE_BASE_WPR_Asterisk_Hook_Library : FILE
 		$s9 = "Global\\Passcape#6712%04X" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE : FILE
 {
 	meta:
@@ -371338,9 +367759,9 @@ rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE : FILE
 		date = "2017-03-15"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3574-L3603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f2995a8ba1644d384167221560aa0c3f074e8e2cf2b79bbb06537fcaed2df7f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3574-L3603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f2995a8ba1644d384167221560aa0c3f074e8e2cf2b79bbb06537fcaed2df7f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371359,10 +367780,8 @@ rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE : FILE
 		$op2 = { e8 ed 00 f0 cc e4 00 a0 17 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20000KB and (1 of ($x*) or all of ($s*) or all of ($op*))
+		uint16( 0 ) == 0x5a4d and filesize < 20000KB and ( 1 of ( $x* ) or all of ( $s* ) or all of ( $op* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE_64 : FILE
 {
 	meta:
@@ -371372,9 +367791,9 @@ rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE_64 : FILE
 		date = "2017-03-15"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3605-L3622"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6cdd46609d401b7c12b936de7f64bab0bc45b9d2c6079fae45a96f5be6857b82"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3605-L3622"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6cdd46609d401b7c12b936de7f64bab0bc45b9d2c6079fae45a96f5be6857b82"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371388,10 +367807,8 @@ rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE_64 : FILE
 		$op2 = { e8 c2 26 00 00 83 20 00 83 c8 ff 48 8b 5c 24 30 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Beyondexec_Remoteaccess_Tool : FILE
 {
 	meta:
@@ -371401,9 +367818,9 @@ rule SIGNATURE_BASE_Beyondexec_Remoteaccess_Tool : FILE
 		date = "2017-03-17"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/BvYurS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3634-L3652"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f21ddf04ab0d29549c3d07a45afb3e7648a15b0c81f88b8d7ccccc436ba4084"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3634-L3652"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f21ddf04ab0d29549c3d07a45afb3e7648a15b0c81f88b8d7ccccc436ba4084"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371418,10 +367835,8 @@ rule SIGNATURE_BASE_Beyondexec_Remoteaccess_Tool : FILE
 		$op2 = { 6a 40 33 c0 59 bf e0 d8 40 00 f3 ab 8d 0c 52 c1 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or all of ($op*))) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or all of ( $op* ) ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Mimikatz_Gen_Strings : FILE
 {
 	meta:
@@ -371431,9 +367846,9 @@ rule SIGNATURE_BASE_Mimikatz_Gen_Strings : FILE
 		date = "2017-06-19"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3654-L3676"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "371e74538a63cfe355ebd31e1ac73cd25e92f3a7ce3f9299e0f3406f2bcb5b01"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3654-L3676"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_371e74538a63cfe355ebd31e1ac73cd25e92f3a7ce3f9299e0f3406f2bcb5b01"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371453,10 +367868,8 @@ rule SIGNATURE_BASE_Mimikatz_Gen_Strings : FILE
 		$s7 = "** SAM ACCOUNT **" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <12000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 12000KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe : FILE
 {
 	meta:
@@ -371466,9 +367879,9 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3688-L3709"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "77d72792d7fcf2c54b36d124448e928f306981296715e583d346ccd101e22fc7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3688-L3709"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_77d72792d7fcf2c54b36d124448e928f306981296715e583d346ccd101e22fc7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371487,10 +367900,8 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe : FILE
 		$x7 = "WindowsTrustedRTProxy.sys /grant:r administrators:RX" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <70KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 70KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Exploit : FILE
 {
 	meta:
@@ -371500,9 +367911,9 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Exploit : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3711-L3725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "12a7a04fdc621242f42107204996e44b1962b5ac5eef4f9b9cbbe0ad52b85676"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3711-L3725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_12a7a04fdc621242f42107204996e44b1962b5ac5eef4f9b9cbbe0ad52b85676"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371514,10 +367925,8 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Exploit : FILE
 		$x2 = "\\favorites\\stolendata.txt" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injectdll : FILE
 {
 	meta:
@@ -371527,9 +367936,9 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injectdll : FILE
 		date = "2017-07-07"
 		modified = "2022-12-21"
 		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3727-L3745"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b0a9bd4fa2d8a1192258b303cb757c8bbce7f6962a1d895f57add8a1c3887799"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3727-L3745"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b0a9bd4fa2d8a1192258b303cb757c8bbce7f6962a1d895f57add8a1c3887799"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371544,10 +367953,8 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injectdll : FILE
 		$x5 = "Error adjusting privilege %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Payload_MSI : FILE
 {
 	meta:
@@ -371557,9 +367964,9 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Payload_MSI : FILE
 		date = "2017-07-07"
 		modified = "2022-12-21"
 		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3747-L3763"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7dfc8d2bd871ad6acb7d362a946d34ed1830f42ab625c3d3d9cb512f28ccdb57"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3747-L3763"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7dfc8d2bd871ad6acb7d362a946d34ed1830f42ab625c3d3d9cb512f28ccdb57"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371572,10 +367979,8 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Payload_MSI : FILE
 		$s3 = "\\custact\\x86\\AICustAct.pdb" ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0xcfd0 and filesize < 1000KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injector : FILE
 {
 	meta:
@@ -371585,9 +367990,9 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injector : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3765-L3785"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "37ed19fe19d3645adcd5fa7d6f6b3572d2821fdb78a6d0c8afdba6ccecfc8528"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3765-L3785"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_37ed19fe19d3645adcd5fa7d6f6b3572d2821fdb78a6d0c8afdba6ccecfc8528"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -371605,10 +368010,8 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injector : FILE
 		$x8 = "KO: cannot obtain the SeDebug privilege." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and 1 of them ) or 3 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 90KB and 1 of them ) or 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe_2 : FILE
 {
 	meta:
@@ -371618,9 +368021,9 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe_2 : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3787-L3802"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e9ca23e4375674ea189d5e9de015f6a1ae16c30d35378580bdc8f42007b716df"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3787-L3802"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e9ca23e4375674ea189d5e9de015f6a1ae16c30d35378580bdc8f42007b716df"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371633,10 +368036,8 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe_2 : FILE
 		$s3 = "Folder Created: " fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Shellcodegenerator : FILE
 {
 	meta:
@@ -371646,9 +368047,9 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Shellcodegenerator : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3804-L3817"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b267a816871c30e9403805b942be25ed8e28ad2fd946f234f6877a65420754d8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3804-L3817"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b267a816871c30e9403805b942be25ed8e28ad2fd946f234f6877a65420754d8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371659,10 +368060,8 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Shellcodegenerator : FILE
 		$x1 = "\\Release\\shellcodegenerator.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Securityxploded_Producer_String : FILE
 {
 	meta:
@@ -371672,9 +368071,9 @@ rule SIGNATURE_BASE_Securityxploded_Producer_String : FILE
 		date = "2017-07-13"
 		modified = "2023-12-05"
 		reference = "http://securityxploded.com/browser-password-dump.php"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3819-L3833"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "101e0b8b8aeb8ed4314bc07139dcc2b40600fde82ff786d15a15c10692f9aa4a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3819-L3833"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_101e0b8b8aeb8ed4314bc07139dcc2b40600fde82ff786d15a15c10692f9aa4a"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -371685,10 +368084,8 @@ rule SIGNATURE_BASE_Securityxploded_Producer_String : FILE
 		$x1 = "http://securityxploded.com" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and all of them )
+		( uint16( 0 ) == 0x5a4d and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Kekeo_Hacktool : FILE
 {
 	meta:
@@ -371698,9 +368095,9 @@ rule SIGNATURE_BASE_Kekeo_Hacktool : FILE
 		date = "2017-07-21"
 		modified = "2023-12-05"
 		reference = "https://github.com/gentilkiwi/kekeo/releases"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3845-L3860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "14283064e7c8fcee9cde206d25b43b02876a7a4d5de9da6dab47d7f5ba54f019"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3845-L3860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_14283064e7c8fcee9cde206d25b43b02876a7a4d5de9da6dab47d7f5ba54f019"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371713,10 +368110,8 @@ rule SIGNATURE_BASE_Kekeo_Hacktool : FILE
 		$x2 = "ERROR kuhl_m_smb_time ; Invalid! Command: %02x - Status: %08x" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*)))
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Allthethings : FILE
 {
 	meta:
@@ -371726,9 +368121,9 @@ rule SIGNATURE_BASE_Allthethings : FILE
 		date = "2017-07-27"
 		modified = "2022-12-21"
 		reference = "https://github.com/subTee/AllTheThings"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3873-L3892"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d6b961afb98cfaefe930a7bc246b3f087469b752a8d4abb62b2826418fdfd53"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3873-L3892"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d6b961afb98cfaefe930a7bc246b3f087469b752a8d4abb62b2826418fdfd53"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371744,10 +368139,8 @@ rule SIGNATURE_BASE_Allthethings : FILE
 		$x6 = "I shouldn't really execute either." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Impacket_Keyword : FILE
 {
 	meta:
@@ -371757,9 +368150,9 @@ rule SIGNATURE_BASE_Impacket_Keyword : FILE
 		date = "2017-08-04"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3894-L3911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "92a911dc36f8e74ad49ae09ef4dd997b968a2dde46a7500c98983fafb84a086e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3894-L3911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_92a911dc36f8e74ad49ae09ef4dd997b968a2dde46a7500c98983fafb84a086e"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -371773,10 +368166,8 @@ rule SIGNATURE_BASE_Impacket_Keyword : FILE
 		$s3 = "impacket.nmb(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <14000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 14000KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Passwordspro : FILE
 {
 	meta:
@@ -371786,9 +368177,9 @@ rule SIGNATURE_BASE_Passwordspro : FILE
 		date = "2017-08-27"
 		modified = "2023-12-05"
 		reference = "PasswordPro"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3924-L3942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "24887c3a7e4997c9a4e5d3317a5684b0eca7ccc0ffb213660dd9b37bb220f514"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3924-L3942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_24887c3a7e4997c9a4e5d3317a5684b0eca7ccc0ffb213660dd9b37bb220f514"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371801,7 +368192,7 @@ rule SIGNATURE_BASE_Passwordspro : FILE
 		$s3 = "Passwords processed since attack start:" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
 }
 import "pe"
 
@@ -371814,9 +368205,9 @@ rule SIGNATURE_BASE_Passwordpro_NTLM_DLL : FILE
 		date = "2017-08-27"
 		modified = "2023-12-05"
 		reference = "PasswordPro"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3944-L3962"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1021fe1a4c7a237d7a7cfcb1db8fa5e6fa640d3dd9f14ed37910a6b847717d36"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3944-L3962"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1021fe1a4c7a237d7a7cfcb1db8fa5e6fa640d3dd9f14ed37910a6b847717d36"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371828,10 +368219,8 @@ rule SIGNATURE_BASE_Passwordpro_NTLM_DLL : FILE
 		$s2 = "Algorithm: NTLM" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and pe.exports("GetHash") and pe.exports("GetInfo") and ( all of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 20KB and pe.exports ( "GetHash" ) and pe.exports ( "GetInfo" ) and ( all of them ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Keethief_PS : FILE
 {
 	meta:
@@ -371841,9 +368230,9 @@ rule SIGNATURE_BASE_Keethief_PS : FILE
 		date = "2017-08-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/HarmJ0y/KeeThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3974-L3991"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8d3d4ff3b854c5efad99e6f20121b16d5f2f0a31a4c8efd87a937f857923a5e1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3974-L3991"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8d3d4ff3b854c5efad99e6f20121b16d5f2f0a31a4c8efd87a937f857923a5e1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371855,10 +368244,8 @@ rule SIGNATURE_BASE_Keethief_PS : FILE
 		$x2 = "if($KeePassProcess.FileVersion -match '^2\\.') {" fullword ascii
 
 	condition:
-		( uint16(0)==0x7223 and filesize <1000KB and (1 of ($x*)))
+		( uint16( 0 ) == 0x7223 and filesize < 1000KB and ( 1 of ( $x* ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Keetheft_EXE : FILE
 {
 	meta:
@@ -371868,9 +368255,9 @@ rule SIGNATURE_BASE_Keetheft_EXE : FILE
 		date = "2017-08-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/HarmJ0y/KeeThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L3993-L4012"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a6019248ad9708b1508fdf77a2ecbe92a7e8aac916fbca88aec117abeb07b9a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L3993-L4012"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a6019248ad9708b1508fdf77a2ecbe92a7e8aac916fbca88aec117abeb07b9a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371887,10 +368274,8 @@ rule SIGNATURE_BASE_Keetheft_EXE : FILE
 		$x7 = "GetKcpPasswordInfo" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Keetheft_Out_Shellcode : FILE
 {
 	meta:
@@ -371900,9 +368285,9 @@ rule SIGNATURE_BASE_Keetheft_Out_Shellcode : FILE
 		date = "2017-08-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/HarmJ0y/KeeThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4014-L4028"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d536edf1a40defc3b3aa7ce8e595c53e7dd3b7f1daea772c13319ee5bf7675e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4014-L4028"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d536edf1a40defc3b3aa7ce8e595c53e7dd3b7f1daea772c13319ee5bf7675e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371914,10 +368299,8 @@ rule SIGNATURE_BASE_Keetheft_Out_Shellcode : FILE
 		$x2 = "$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\\.text\\W+CODE' })[0]" fullword ascii
 
 	condition:
-		( filesize <2KB and 1 of them )
+		( filesize < 2KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sharpire : FILE
 {
 	meta:
@@ -371927,9 +368310,9 @@ rule SIGNATURE_BASE_Sharpire : FILE
 		date = "2017-09-23"
 		modified = "2022-12-21"
 		reference = "https://github.com/0xbadjuju/Sharpire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4038-L4061"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1437b4c5229761bcc18d97ea6328866f4b9c763461fa6ecb5c18e6f3961c3114"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4038-L4061"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1437b4c5229761bcc18d97ea6328866f4b9c763461fa6ecb5c18e6f3961c3114"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -371948,10 +368331,8 @@ rule SIGNATURE_BASE_Sharpire : FILE
 		$s7 = "[!] Error in stopping job: " fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) and 3 of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) and 3 of them ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Invoke_Metasploit : FILE
 {
 	meta:
@@ -371961,9 +368342,9 @@ rule SIGNATURE_BASE_Invoke_Metasploit : FILE
 		date = "2017-09-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/jaredhaight/Invoke-MetasploitPayload/blob/master/Invoke-MetasploitPayload.ps1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4071-L4086"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ef174008517b101be844e30890626378f49a275bad3f08ce25fb8d6118c77c3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4071-L4086"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ef174008517b101be844e30890626378f49a275bad3f08ce25fb8d6118c77c3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -371976,10 +368357,8 @@ rule SIGNATURE_BASE_Invoke_Metasploit : FILE
 		$s3 = "Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+''');'"
 
 	condition:
-		( filesize <20KB and 1 of them )
+		( filesize < 20KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Powershell_Mal_Hacktool_Gen : FILE
 {
 	meta:
@@ -371989,9 +368368,9 @@ rule SIGNATURE_BASE_Powershell_Mal_Hacktool_Gen : FILE
 		date = "2017-11-02"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4088-L4104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "273222cde3ff155cef09c25192dcb4865179e8172e625fe8f43b21a13fe1a170"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4088-L4104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_273222cde3ff155cef09c25192dcb4865179e8172e625fe8f43b21a13fe1a170"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372005,10 +368384,8 @@ rule SIGNATURE_BASE_Powershell_Mal_Hacktool_Gen : FILE
 		$x4 = "(Shellcode: LoadLibraryA.asm)" fullword wide
 
 	condition:
-		filesize <8000KB and 1 of them
+		filesize < 8000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Sig_Remoteadmin_1 : FILE
 {
 	meta:
@@ -372018,9 +368395,9 @@ rule SIGNATURE_BASE_Sig_Remoteadmin_1 : FILE
 		date = "2017-12-03"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4106-L4120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "81912bbfc1f6ac3ec7c54fc935b9ed531c97ad509cf2c096a19e638836cd0baf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4106-L4120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_81912bbfc1f6ac3ec7c54fc935b9ed531c97ad509cf2c096a19e638836cd0baf"
 		score = 45
 		quality = 85
 		tags = "FILE"
@@ -372031,10 +368408,8 @@ rule SIGNATURE_BASE_Sig_Remoteadmin_1 : FILE
 		$ = "Radmin 3.0" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Remcom_Remotecommandexecution
 {
 	meta:
@@ -372044,9 +368419,9 @@ rule SIGNATURE_BASE_Remcom_Remotecommandexecution
 		date = "2017-12-28"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/tezXZt"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4122-L4137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c39a09c8d0c1799febcb4d9eafece43f8b21e7ffc277fdfad6c235eb1a201697"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4122-L4137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c39a09c8d0c1799febcb4d9eafece43f8b21e7ffc277fdfad6c235eb1a201697"
 		score = 50
 		quality = 85
 		tags = ""
@@ -372060,8 +368435,6 @@ rule SIGNATURE_BASE_Remcom_Remotecommandexecution
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Crackmapexec_EXE : FILE
 {
 	meta:
@@ -372071,9 +368444,9 @@ rule SIGNATURE_BASE_Crackmapexec_EXE : FILE
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4139-L4155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa05fa41d6aaed45a9b44806a310fdb584874f7eb382e576b36e6d1db87cef88"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4139-L4155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa05fa41d6aaed45a9b44806a310fdb584874f7eb382e576b36e6d1db87cef88"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -372086,7 +368459,7 @@ rule SIGNATURE_BASE_Crackmapexec_EXE : FILE
 		$s3 = "core.uacdump(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 10000KB and 2 of them
 }
 import "pe"
 
@@ -372099,9 +368472,9 @@ rule SIGNATURE_BASE_SUSP_Imphash_Passrevealer_PY_EXE : FILE
 		date = "2018-04-06"
 		modified = "2021-11-09"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4157-L4175"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "684e901eebf47e2bd8b25fd302963c2761376ce4754d74f9e6f1eb3024c89144"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4157-L4175"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_684e901eebf47e2bd8b25fd302963c2761376ce4754d74f9e6f1eb3024c89144"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -372113,10 +368486,8 @@ rule SIGNATURE_BASE_SUSP_Imphash_Passrevealer_PY_EXE : FILE
 		$fp3 = "efm8load" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and pe.imphash()=="ed61beebc8d019dd9bec823e2d694afd" and not 1 of ($fp*)
+		uint16( 0 ) == 0x5a4d and filesize < 10000KB and pe.imphash ( ) == "ed61beebc8d019dd9bec823e2d694afd" and not 1 of ( $fp* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Unknown_Pwdumper_Apr18_3 : FILE
 {
 	meta:
@@ -372126,9 +368497,9 @@ rule SIGNATURE_BASE_MAL_Unknown_Pwdumper_Apr18_3 : FILE
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4177-L4196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf0dff02bdfa239336b2bc865f2a9aed6d20cafb059caa87a60aa30269dd94b5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4177-L4196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf0dff02bdfa239336b2bc865f2a9aed6d20cafb059caa87a60aa30269dd94b5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372145,7 +368516,7 @@ rule SIGNATURE_BASE_MAL_Unknown_Pwdumper_Apr18_3 : FILE
 		$s6 = "TNtDllHook$" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
 import "pe"
 
@@ -372158,9 +368529,9 @@ rule SIGNATURE_BASE_Processinjector_Gen : HIGHVOL FILE
 		date = "2018-04-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4198-L4219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "90d200e79c97911b105e592549bc2c04fb09ce841413c30117d421b45bb9988c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4198-L4219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_90d200e79c97911b105e592549bc2c04fb09ce841413c30117d421b45bb9988c"
 		score = 60
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -372175,10 +368546,8 @@ rule SIGNATURE_BASE_Processinjector_Gen : HIGHVOL FILE
 		$s17 = "[-] An app path is required when not injecting!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and (pe.imphash()=="d27e0fa013d7ae41be12aaf221e41f9b" or 1 of them ) or 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and ( pe.imphash ( ) == "d27e0fa013d7ae41be12aaf221e41f9b" or 1 of them ) or 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Lazagne_PW_Dumper
 {
 	meta:
@@ -372188,9 +368557,9 @@ rule SIGNATURE_BASE_Lazagne_PW_Dumper
 		date = "2018-03-22"
 		modified = "2023-12-05"
 		reference = "https://github.com/AlessandroZ/LaZagne/releases/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4221-L4235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2eac81d5cecdaca7eeaa83be70a688a595f8bbf54679ee565ba325b9e384552b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4221-L4235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2eac81d5cecdaca7eeaa83be70a688a595f8bbf54679ee565ba325b9e384552b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -372203,8 +368572,6 @@ rule SIGNATURE_BASE_Lazagne_PW_Dumper
 	condition:
 		3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Tclsh : FILE
 {
 	meta:
@@ -372214,9 +368581,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Tclsh : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4237-L4249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "622805e8067f5158d82783971dcf31e8db05f1d52a38bd1ec3e76ddbbd78032b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4237-L4249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_622805e8067f5158d82783971dcf31e8db05f1d52a38bd1ec3e76ddbbd78032b"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -372226,10 +368593,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Tclsh : FILE
 		$s1 = "{ puts -nonewline $s \"shell>\";flush $s;gets $s c;set e \"exec $c\";if" ascii
 
 	condition:
-		filesize <1KB and 1 of them
+		filesize < 1KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Ruby : FILE
 {
 	meta:
@@ -372239,9 +368604,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Ruby : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4251-L4263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aa076540ef01d04117d3340f4d84c21f79acfc558ed4aa585d801b6a6bc797a2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4251-L4263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aa076540ef01d04117d3340f4d84c21f79acfc558ed4aa585d801b6a6bc797a2"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -372251,10 +368616,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Ruby : FILE
 		$x1 = ");while(cmd=c.gets);IO.popen(cmd,'r'){" ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Awk : FILE
 {
 	meta:
@@ -372264,9 +368627,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Awk : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4265-L4278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d676ffbd1ce083a1b8e34576125fb0805caef4423089cd72a92483467669b78"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4265-L4278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d676ffbd1ce083a1b8e34576125fb0805caef4423089cd72a92483467669b78"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -372277,10 +368640,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Awk : FILE
 		$s2 = "; while(42) " ascii
 
 	condition:
-		filesize <1KB and 1 of them
+		filesize < 1KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Netcat_UDP : FILE
 {
 	meta:
@@ -372290,9 +368651,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Netcat_UDP : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4280-L4293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c85b1275ccf5bbc7f6e0ab0f1fa9d1bce7d56912411f84f9946163191c79576"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4280-L4293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c85b1275ccf5bbc7f6e0ab0f1fa9d1bce7d56912411f84f9946163191c79576"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -372303,10 +368664,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Netcat_UDP : FILE
 		$s2 = "< fifo | { bash -i; } > fifo" fullword ascii
 
 	condition:
-		filesize <1KB and 1 of them
+		filesize < 1KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Socat : FILE
 {
 	meta:
@@ -372316,9 +368675,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Socat : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4295-L4308"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "48c06096b27be11ae12cc38294acb495b739101cabc04e89eb76e93fb42c52df"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4295-L4308"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_48c06096b27be11ae12cc38294acb495b739101cabc04e89eb76e93fb42c52df"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -372329,10 +368688,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Socat : FILE
 		$s2 = ",pty,stderr,setsid,sigint,sane" ascii
 
 	condition:
-		filesize <1KB and 2 of them
+		filesize < 1KB and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Perl : FILE
 {
 	meta:
@@ -372342,9 +368699,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Perl : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4310-L4323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8f3c5920acdc080b437c15b93e192a00a5037be0323cc04473e238033b7d53ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4310-L4323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8f3c5920acdc080b437c15b93e192a00a5037be0323cc04473e238033b7d53ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372355,10 +368712,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Perl : FILE
 		$ = ";STDIN->fdopen(\\$c,r);$~->fdopen(\\$c,w);s" ascii
 
 	condition:
-		filesize <2KB and 1 of them
+		filesize < 2KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Python : FILE
 {
 	meta:
@@ -372368,9 +368723,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Python : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4325-L4337"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4c35bb739eeabf0de558ee1b97225ed4eb3198e7e6db1817348115b848146c7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4325-L4337"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4c35bb739eeabf0de558ee1b97225ed4eb3198e7e6db1817348115b848146c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372380,10 +368735,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Python : FILE
 		$ = "os.putenv('HISTFILE', '/dev/null');" ascii
 
 	condition:
-		filesize <2KB and 1 of them
+		filesize < 2KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_PHP_TCP : FILE
 {
 	meta:
@@ -372393,9 +368746,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_PHP_TCP : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4339-L4352"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8ffab71130b4fa6efbe9864f97c33fed9359f79d51b84e8f952c911f24d1496c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4339-L4352"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8ffab71130b4fa6efbe9864f97c33fed9359f79d51b84e8f952c911f24d1496c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372406,10 +368759,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_PHP_TCP : FILE
 		$x2 = ";exec('/bin/sh -i <&3 >&3 2>&3');\"" ascii
 
 	condition:
-		filesize <3KB and all of them
+		filesize < 3KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Powershell_TCP : FILE
 {
 	meta:
@@ -372419,9 +368770,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Powershell_TCP : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4354-L4367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8eb484ba87fa2e10af3c59445ccb4be73db2f5ae67c59118a2e188ba02fdc957"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4354-L4367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8eb484ba87fa2e10af3c59445ccb4be73db2f5ae67c59118a2e188ba02fdc957"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372432,10 +368783,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Powershell_TCP : FILE
 		$ = ";[byte[]]$bytes = 0..65535|%{0};$sendbytes =" ascii
 
 	condition:
-		filesize <3KB and 1 of them
+		filesize < 3KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_Powershell_Shellcommand_May18_1 : FILE
 {
 	meta:
@@ -372445,9 +368794,9 @@ rule SIGNATURE_BASE_SUSP_Powershell_Shellcommand_May18_1 : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4369-L4382"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bc858d74b8aad09ff539489e961e1a51ba5fe17d3424615ffe5029587ddb9478"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4369-L4382"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bc858d74b8aad09ff539489e961e1a51ba5fe17d3424615ffe5029587ddb9478"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -372457,10 +368806,8 @@ rule SIGNATURE_BASE_SUSP_Powershell_Shellcommand_May18_1 : FILE
 		$x1 = "powershell -nop -ep bypass -Command" ascii
 
 	condition:
-		filesize <3KB and 1 of them
+		filesize < 3KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Telnet_TCP : FILE
 {
 	meta:
@@ -372470,9 +368817,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Telnet_TCP : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4384-L4397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e900fb8c0f1fa61f242b97ac542cb1bfd691dd50523e0023e97e3b21617053d7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4384-L4397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e900fb8c0f1fa61f242b97ac542cb1bfd691dd50523e0023e97e3b21617053d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372483,10 +368830,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Telnet_TCP : FILE
 		$x2 = "0</tmp/f|/bin/bash 1>/tmp/f" fullword ascii
 
 	condition:
-		filesize <3KB and 1 of them
+		filesize < 3KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_Shellpop_Bash
 {
 	meta:
@@ -372496,9 +368841,9 @@ rule SIGNATURE_BASE_SUSP_Shellpop_Bash
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4399-L4411"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "31633e84ecc1885d041f36399bb5b10915f6371a37d2995f369eb8c0294f1596"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4399-L4411"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_31633e84ecc1885d041f36399bb5b10915f6371a37d2995f369eb8c0294f1596"
 		score = 65
 		quality = 85
 		tags = ""
@@ -372510,8 +368855,6 @@ rule SIGNATURE_BASE_SUSP_Shellpop_Bash
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Shellpop_Netcat : FILE
 {
 	meta:
@@ -372521,9 +368864,9 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Netcat : FILE
 		date = "2018-05-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4413-L4428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2c61da27d4bc455a9f2555fcc1c5cce7cead226a5900eeed1aaf622616051b79"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4413-L4428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2c61da27d4bc455a9f2555fcc1c5cce7cead226a5900eeed1aaf622616051b79"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372536,10 +368879,8 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Netcat : FILE
 		$s5 = "</tmp/f|/bin/bash 1>/tmp/f" ascii
 
 	condition:
-		filesize <2KB and 1 of them
+		filesize < 2KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Berootexe : FILE
 {
 	meta:
@@ -372549,9 +368890,9 @@ rule SIGNATURE_BASE_HKTL_Berootexe : FILE
 		date = "2018-07-25"
 		modified = "2023-12-05"
 		reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4431-L4447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8e10fddd3b3eb5e5200d9ed0bcb23961d196d9e1de03ebf03a96374ee02a9097"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4431-L4447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8e10fddd3b3eb5e5200d9ed0bcb23961d196d9e1de03ebf03a96374ee02a9097"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372563,10 +368904,8 @@ rule SIGNATURE_BASE_HKTL_Berootexe : FILE
 		$s3 = "beRoot.exe.manifest" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <18000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 18000KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Berootexe_Output : FILE
 {
 	meta:
@@ -372576,9 +368915,9 @@ rule SIGNATURE_BASE_HKTL_Berootexe_Output : FILE
 		date = "2018-07-25"
 		modified = "2023-12-05"
 		reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4449-L4463"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7886535d071092df76507f0dd431409e85c368d404f49e7f118278f6565618e6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4449-L4463"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7886535d071092df76507f0dd431409e85c368d404f49e7f118278f6565618e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372590,10 +368929,8 @@ rule SIGNATURE_BASE_HKTL_Berootexe_Output : FILE
 		$s4 = "! BANG BANG !" fullword wide
 
 	condition:
-		filesize <400KB and 3 of them
+		filesize < 400KB and 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Embeddedpdf : FILE
 {
 	meta:
@@ -372603,9 +368940,9 @@ rule SIGNATURE_BASE_HKTL_Embeddedpdf : FILE
 		date = "2018-07-25"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/infosecn1nja/status/1021399595899731968?s=12"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4465-L4482"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "041580406e2a7c644d713d8fbf7fccb81664ff536e62df26b3c0f331409fb993"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4465-L4482"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_041580406e2a7c644d713d8fbf7fccb81664ff536e62df26b3c0f331409fb993"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372617,10 +368954,8 @@ rule SIGNATURE_BASE_HKTL_Embeddedpdf : FILE
 		$s3 = "/Type /EmbeddedFile" fullword ascii
 
 	condition:
-		uint16(0)==0x5025 and 2 of ($s*) and $x1
+		uint16( 0 ) == 0x5025 and 2 of ( $s* ) and $x1
 }
-import "pe"
-
 rule SIGNATURE_BASE_HTKL_Blackbone_Driverinjector : FILE
 {
 	meta:
@@ -372630,9 +368965,9 @@ rule SIGNATURE_BASE_HTKL_Blackbone_Driverinjector : FILE
 		date = "2018-09-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/DarthTon/Blackbone"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4484-L4510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d6a5f02a465ea46892e1de54a3482aace387ab0d2cdb949e263ce63f4f9edbb7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4484-L4510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d6a5f02a465ea46892e1de54a3482aace387ab0d2cdb949e263ce63f4f9edbb7"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -372654,10 +368989,8 @@ rule SIGNATURE_BASE_HTKL_Blackbone_Driverinjector : FILE
 		$x8 = "DosDevices\\BlackBone" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and (3 of them or 1 of ($x*))
+		uint16( 0 ) == 0x5a4d and filesize < 8000KB and ( 3 of them or 1 of ( $x* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Sqlmap : FILE
 {
 	meta:
@@ -372667,9 +369000,9 @@ rule SIGNATURE_BASE_HKTL_Sqlmap : FILE
 		date = "2018-10-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/sqlmapproject/sqlmap"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4512-L4525"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9aa13bc2db40f5ab3debd617c84b1e11805d137bc55e9088bc9a0c23e185dfce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4512-L4525"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9aa13bc2db40f5ab3debd617c84b1e11805d137bc55e9088bc9a0c23e185dfce"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372680,10 +369013,8 @@ rule SIGNATURE_BASE_HKTL_Sqlmap : FILE
 		$x2 = "if conf.get(\"dumper\"):" fullword ascii
 
 	condition:
-		filesize <50KB and 1 of them
+		filesize < 50KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Sqlmap_Backdoor : FILE
 {
 	meta:
@@ -372693,18 +369024,16 @@ rule SIGNATURE_BASE_HKTL_Sqlmap_Backdoor : FILE
 		date = "2018-10-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/sqlmapproject/sqlmap"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4527-L4543"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e09135e3908442d873511b7b75c8475b2345a28f3bad41a242d6fc5a3b7c002"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4527-L4543"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e09135e3908442d873511b7b75c8475b2345a28f3bad41a242d6fc5a3b7c002"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		( uint32(0)==0x8e859c07 or uint32(0)==0x2d859c07 or uint32(0)==0x92959c07 or uint32(0)==0x929d9c07 or uint32(0)==0x29959c07 or uint32(0)==0x2b8d9c07 or uint32(0)==0x2b859c07 or uint32(0)==0x28b59c07) and filesize <2KB
+		( uint32( 0 ) == 0x8e859c07 or uint32( 0 ) == 0x2d859c07 or uint32( 0 ) == 0x92959c07 or uint32( 0 ) == 0x929d9c07 or uint32( 0 ) == 0x29959c07 or uint32( 0 ) == 0x2b8d9c07 or uint32( 0 ) == 0x2b859c07 or uint32( 0 ) == 0x28b59c07 ) and filesize < 2KB
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Lazagne_Passworddumper_Dec18_1 : FILE
 {
 	meta:
@@ -372714,9 +369043,9 @@ rule SIGNATURE_BASE_HKTL_Lazagne_Passworddumper_Dec18_1 : FILE
 		date = "2018-12-11"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4545-L4565"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "887c8e91942076395dc7575d5cbd926e7e0971a759daf719983dd918d9babad3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4545-L4565"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_887c8e91942076395dc7575d5cbd926e7e0971a759daf719983dd918d9babad3"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -372733,10 +369062,8 @@ rule SIGNATURE_BASE_HKTL_Lazagne_Passworddumper_Dec18_1 : FILE
 		$s5 = "softwares.outlook(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <17000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 17000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Lazagne_Gen_18
 {
 	meta:
@@ -372746,9 +369073,9 @@ rule SIGNATURE_BASE_HKTL_Lazagne_Gen_18
 		date = "2018-12-11"
 		modified = "2023-12-05"
 		reference = "https://creativecommons.org/licenses/by-nc/4.0/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4567-L4584"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f3e895080267a551a3b7a0ba2d4207b31befacbd35d1e6941e1b69d7e2689ce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4567-L4584"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f3e895080267a551a3b7a0ba2d4207b31befacbd35d1e6941e1b69d7e2689ce"
 		score = 80
 		quality = 85
 		tags = ""
@@ -372763,8 +369090,6 @@ rule SIGNATURE_BASE_HKTL_Lazagne_Gen_18
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Nopowershell
 {
 	meta:
@@ -372774,9 +369099,9 @@ rule SIGNATURE_BASE_HKTL_Nopowershell
 		date = "2018-12-28"
 		modified = "2022-12-21"
 		reference = "https://github.com/bitsadmin/nopowershell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4586-L4603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2207af9fcc61d547dfeff347a1eae2c59024a7270d1b8cbb7abef56d80864728"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4586-L4603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2207af9fcc61d547dfeff347a1eae2c59024a7270d1b8cbb7abef56d80864728"
 		score = 75
 		quality = 85
 		tags = ""
@@ -372792,8 +369117,6 @@ rule SIGNATURE_BASE_HKTL_Nopowershell
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Htran_Go : FILE
 {
 	meta:
@@ -372803,9 +369126,9 @@ rule SIGNATURE_BASE_HKTL_Htran_Go : FILE
 		date = "2019-01-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4604-L4617"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "444fe8ce2fdb67c982de26a10882d2cfebc4d2de6c4b4ba6ee10cf39130f1cc5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4604-L4617"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_444fe8ce2fdb67c982de26a10882d2cfebc4d2de6c4b4ba6ee10cf39130f1cc5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372817,10 +369140,8 @@ rule SIGNATURE_BASE_HKTL_Htran_Go : FILE
 		$s3 = "-tran port1 ip:port2" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 7000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_Katz_PDB : FILE
 {
 	meta:
@@ -372830,9 +369151,9 @@ rule SIGNATURE_BASE_SUSP_Katz_PDB : FILE
 		date = "2019-02-04"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4619-L4632"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1a38f63d8e8baa9bc8f34c1886fc2aaea7f61d5e09792ba9cde4cf6ed8441fab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4619-L4632"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1a38f63d8e8baa9bc8f34c1886fc2aaea7f61d5e09792ba9cde4cf6ed8441fab"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -372843,10 +369164,8 @@ rule SIGNATURE_BASE_SUSP_Katz_PDB : FILE
 		$s2 = /\\Debug\\[a-z]{0,8}katz.pdb/
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 6000KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_LNX_Pnscan : FILE
 {
 	meta:
@@ -372856,9 +369175,9 @@ rule SIGNATURE_BASE_HKTL_LNX_Pnscan : FILE
 		date = "2019-05-27"
 		modified = "2023-12-05"
 		reference = "https://github.com/ptrrkssn/pnscan"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4634-L4647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "46a064f9df9d0a0f3fad4ec7be70b1e42074e5e117f7403d8239bc725590f268"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4634-L4647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_46a064f9df9d0a0f3fad4ec7be70b1e42074e5e117f7403d8239bc725590f268"
 		score = 55
 		quality = 85
 		tags = "FILE"
@@ -372868,10 +369187,8 @@ rule SIGNATURE_BASE_HKTL_LNX_Pnscan : FILE
 		$x2 = "This program implements a multithreaded TCP port scanner." ascii wide
 
 	condition:
-		filesize <6000KB and 1 of them
+		filesize < 6000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Paexec : FILE
 {
 	meta:
@@ -372881,9 +369198,9 @@ rule SIGNATURE_BASE_Paexec : FILE
 		date = "2017-03-27"
 		modified = "2023-12-05"
 		reference = "http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4649-L4669"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "30478d90756a9ea362c40236518fe9013e5e5683641b7e7e1ad33aa3b5587e04"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4649-L4669"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_30478d90756a9ea362c40236518fe9013e5e5683641b7e7e1ad33aa3b5587e04"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -372900,10 +369217,8 @@ rule SIGNATURE_BASE_Paexec : FILE
 		$x8 = "\\\\%s\\ADMIN$\\PAExec_Move%u.dat" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of ($x*)) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of ( $x* ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Domainpasswordspray : FILE
 {
 	meta:
@@ -372913,9 +369228,9 @@ rule SIGNATURE_BASE_HKTL_Domainpasswordspray : FILE
 		date = "2023-01-13"
 		modified = "2023-12-05"
 		reference = "https://github.com/dafthack/DomainPasswordSpray"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4671-L4686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aa20bf139eff36100624771fe7617c214337ae5ab2e2746143bd8e6cc1b05b4e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4671-L4686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aa20bf139eff36100624771fe7617c214337ae5ab2e2746143bd8e6cc1b05b4e"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -372926,10 +369241,8 @@ rule SIGNATURE_BASE_HKTL_Domainpasswordspray : FILE
 		$s = "Invoke-DomainPasswordSpray" fullword ascii wide
 
 	condition:
-		filesize <100KB and all of them
+		filesize < 100KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Rusthound : FILE
 {
 	meta:
@@ -372939,8 +369252,8 @@ rule SIGNATURE_BASE_HKTL_Rusthound : FILE
 		date = "2023-03-30"
 		modified = "2023-12-05"
 		reference = "https://github.com/OPENCYBER-FR/RustHound"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/thor-hacktools.yar#L4688-L4715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/thor-hacktools.yar#L4688-L4715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "409f61a34d9771643246f401a9670f6f7dcced9df50cbd89a2e1a5c9ba8d03ab"
 		hash = "b1a58a9c94b1df97a243e6c3fc2d04ffd92bc802edc7d8e738573b394be331a9"
 		hash = "170f4a48911f3ebef674aade05184ea0a6b1f6b089bcffd658e95b9905423365"
@@ -372951,7 +369264,7 @@ rule SIGNATURE_BASE_HKTL_Rusthound : FILE
 		hash = "21d37c2393a6f748fe34c9d2f52693cb081b63c3a02ca0bebe4a584076f5886c"
 		hash = "874a1a186eb5808d456ce86295cd5f09d6c819375acb100573c2103608af0d84"
 		hash = "bf576bd229393010b2bb4ba17e49604109e294ca38cf19647fc7d9c325f7bcd1"
-		logic_hash = "386b734ad7f3cf02f096236c941033b3f905a3368b8a72dd63e91e6e94f12f8d"
+		logic_hash = "v1_sha256_386b734ad7f3cf02f096236c941033b3f905a3368b8a72dd63e91e6e94f12f8d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -372961,10 +369274,8 @@ rule SIGNATURE_BASE_HKTL_Rusthound : FILE
 		$rh2 = "Making json/zip files finished!" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0x457f) and 1 of ($rh*)
+		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0x457f ) and 1 of ( $rh* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Scheduledtask_Loader : FILE
 {
 	meta:
@@ -372972,11 +369283,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Scheduledtask_Loader : FILE
 		author = "CISA.gov"
 		id = "0c32758b-480c-5784-b28f-cee85d038850"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L3-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d32ee777cb40c6fa58787e92c0de074ea5b81d629a17ccb4f9432d62436f03c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L3-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d32ee777cb40c6fa58787e92c0de074ea5b81d629a17ccb4f9432d62436f03c"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -372987,10 +369298,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Scheduledtask_Loader : FILE
 		$obfuscation3 = { 48 6B C0 00 C6 44 04 20 A8 B8 01 00 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 6B C0 03 C6 44 04 20 96 B8 01 00 00 00 48 6B C0 04 C6 44 04 20 B9 B8 01 00 00 00 48 6B C0 05 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 07 C6 44 04 20 9E B8 01 00 00 00 48 6B C0 08 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 09 C6 44 04 20 8D B8 01 00 00 00 48 6B C0 0A C6 44 04 20 BC B8 01 00 00 00 }
 
 	condition:
-		uint16(0)==0x5A4D and $obfuscation1 and $obfuscation2 and $obfuscation3
+		uint16( 0 ) == 0x5A4D and $obfuscation1 and $obfuscation2 and $obfuscation3
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Kaosrat_Yamabot
 {
 	meta:
@@ -372998,11 +369307,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Kaosrat_Yamabot
 		author = "CISA.gov"
 		id = "cdde69cd-1b38-52f5-8552-cef2cf4ad69c"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L19-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "92182aac2e56041292102b0486b7de1ee6eb3d54a9fc6786c567acd92073cd84"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L20-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_92182aac2e56041292102b0486b7de1ee6eb3d54a9fc6786c567acd92073cd84"
 		score = 70
 		quality = 85
 		tags = ""
@@ -373023,8 +369332,6 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Kaosrat_Yamabot
 	condition:
 		3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Trifaux_Easyrat_JUPITER : FILE
 {
 	meta:
@@ -373032,11 +369339,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Trifaux_Easyrat_JUPITER : FILE
 		author = "CISA.gov"
 		id = "8bd72287-59da-53cf-9015-66149303e59f"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L42-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6108035dbebd34fe994fc1f8b4123321321f6ed5c022be6e84a88f905ea6fb73"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L44-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6108035dbebd34fe994fc1f8b4123321321f6ed5c022be6e84a88f905ea6fb73"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -373047,10 +369354,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Trifaux_Easyrat_JUPITER : FILE
 		$Bytes = "4C,$00,$00,$00,$01,$14,$02,$00,$00,$00,$00,$00,$C0,$00,$00,$00,$00,$00,$00," wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Cutiedrop_Magicrat : FILE
 {
 	meta:
@@ -373058,11 +369363,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Cutiedrop_Magicrat : FILE
 		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
 		id = "104244de-83fb-5112-a2b6-e20d38a6ced6"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L58-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f289bbd71bdeaf2c42063642454679ec26de5ed24c020af40db694a0ced54884"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L61-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f289bbd71bdeaf2c42063642454679ec26de5ed24c020af40db694a0ced54884"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -373078,10 +369383,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Cutiedrop_Magicrat : FILE
 		$command_misspelled = "renmae" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16( 0 ) == 0x5a4d and 7 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_HHSD_Filetransfertool : FILE
 {
 	meta:
@@ -373089,11 +369392,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_HHSD_Filetransfertool : FILE
 		author = "CISA.gov"
 		id = "46b6dbaf-1272-5bbd-a586-5e48ba6c5022"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L83-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "757fd5e34bcbdf4efdc86a9dff058d92a0479019fbda1d26ad3ee4924b59f0cb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L87-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_757fd5e34bcbdf4efdc86a9dff058d92a0479019fbda1d26ad3ee4924b59f0cb"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -373106,10 +369409,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_HHSD_Filetransfertool : FILE
 		$hash_call_unk = { B? 91 B8 F6 88 E8 }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($handshake,$err_xor_str,$buf_add_cmp_1f) and 1 of ($hash_call_*) or 2 of ($handshake,$err_xor_str,$buf_add_cmp_1f)
+		uint16( 0 ) == 0x5a4d and 1 of ( $handshake , $err_xor_str , $buf_add_cmp_1f ) and 1 of ( $hash_call_* ) or 2 of ( $handshake , $err_xor_str , $buf_add_cmp_1f )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Atharvan_3RAT : FILE
 {
 	meta:
@@ -373117,11 +369418,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Atharvan_3RAT : FILE
 		author = "CISA.gov"
 		id = "9ff6998a-a2dd-5671-bd3f-ee69561f71ef"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L122-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "741318234e245a35accc0b102a7891559ce5ef868ccdc3e6e4c8e59d8dea8b24"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L127-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_741318234e245a35accc0b102a7891559ce5ef868ccdc3e6e4c8e59d8dea8b24"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -373131,10 +369432,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Atharvan_3RAT : FILE
 		$atharvan = "Atharvan_dll.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Lilithrat_Variant : FILE
 {
 	meta:
@@ -373144,9 +369443,9 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Lilithrat_Variant : FILE
 		date = "2024-07-25"
 		modified = "2024-07-26"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L137-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3ce68908468ff85683b081842fa4faa579fbf6f7dc1a7fab5dcf7eac63d90aea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L143-L178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3ce68908468ff85683b081842fa4faa579fbf6f7dc1a7fab5dcf7eac63d90aea"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -373164,10 +369463,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Lilithrat_Variant : FILE
 		$unique_6 = "killing self" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and ( all of ($lilith_*) or 4 of ($unique_*) or 1 of ($lilith_4,$unique_2))
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and ( all of ( $lilith_* ) or 4 of ( $unique_* ) or 1 of ( $lilith_4 , $unique_2 ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Sockstroy_Strings_Opcodes : FILE
 {
 	meta:
@@ -373175,11 +369472,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Sockstroy_Strings_Opcodes : FILE
 		author = "CISA.gov"
 		id = "9e7fb6ba-771e-5cae-a0d5-c0b95ee6d4e9"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L173-L191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ab31b285d0dba1745a2d8b172bd02931c6138e2b8e541203b88f111d179549b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L180-L199"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ab31b285d0dba1745a2d8b172bd02931c6138e2b8e541203b88f111d179549b"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -373191,10 +369488,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Sockstroy_Strings_Opcodes : FILE
 		$cOpCodeCheck = { 81 E? A0 00 00 00 0F 84 ?? ?? ?? ?? 83 E? 03 74 ?? 83 E? 02 74 ?? 83 F? 0B }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($str*) and all of ($c*) or all of ($Socks*))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $str* ) and all of ( $c* ) or all of ( $Socks* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Agni : FILE
 {
 	meta:
@@ -373202,11 +369497,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Agni : FILE
 		author = "CISA.gov"
 		id = "ffe3f427-c10a-5ad4-ab29-c0d9b576c30f"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L193-L207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "302899b65e5a3a6beabbb46e80e3f0ff246c209206cc3a7f871011d68871d0b9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L201-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_302899b65e5a3a6beabbb46e80e3f0ff246c209206cc3a7f871011d68871d0b9"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -373216,10 +369511,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Agni : FILE
 		$stackstrings = { C7 44 24 [5-10] C7 44 24 [5] C7 44 24 [5-10] C7 44 24 [5-10] C7 44 24 }
 
 	condition:
-		uint16(0)==0x5a4d and #xor>100 and #stackstrings>5
+		uint16( 0 ) == 0x5a4d and #xor > 100 and #stackstrings > 5
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Handshake
 {
 	meta:
@@ -373227,11 +369520,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Handshake
 		author = "CISA.gov"
 		id = "51dafa43-9da0-569a-9123-7e9800284046"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L209-L220"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1978210d07d3298c0051c9faca16685636e3fb45131b4c2fcb7053a0b3ef84d1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L218-L230"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1978210d07d3298c0051c9faca16685636e3fb45131b4c2fcb7053a0b3ef84d1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -373242,8 +369535,6 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Handshake
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Tasks
 {
 	meta:
@@ -373251,11 +369542,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Tasks
 		author = "CISA.gov"
 		id = "caa67a79-3ea6-5910-971c-f311722570ff"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L222-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d3fb944888b289d345ffc8dfcc988abd04b8cabd1729a66e8236f95ee6147ee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L232-L247"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d3fb944888b289d345ffc8dfcc988abd04b8cabd1729a66e8236f95ee6147ee"
 		score = 80
 		quality = 85
 		tags = ""
@@ -373269,8 +369560,6 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Tasks
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Blackstring : FILE
 {
 	meta:
@@ -373278,11 +369567,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Blackstring : FILE
 		author = "CISA.gov"
 		id = "36f46a1d-69b6-5c99-9a54-6a14d62d2721"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L238-L249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "07ea38890e99dd53437a23b7c4002851604b69a83bd7fb8971609226249e5954"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L249-L261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_07ea38890e99dd53437a23b7c4002851604b69a83bd7fb8971609226249e5954"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -373291,10 +369580,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Blackstring : FILE
 		$ = "I:/01___Tools/02__RAT/Black"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_ELF_Backdoor_Fipps : FILE
 {
 	meta:
@@ -373302,11 +369589,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_ELF_Backdoor_Fipps : FILE
 		author = "CISA.gov"
 		id = "040bca78-8b7e-5397-8a2b-1ddeed59eea3"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L279-L294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b57eb6c6b89e93863b9600c4a1384f3e064f236e827ef9ffc37b1e5dcff7d24"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L291-L307"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b57eb6c6b89e93863b9600c4a1384f3e064f236e827ef9ffc37b1e5dcff7d24"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -373318,10 +369605,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_ELF_Backdoor_Fipps : FILE
 		$d = "Disconnected!"
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint32( 0 ) == 0x464c457f and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Bindshell : FILE
 {
 	meta:
@@ -373329,11 +369614,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Bindshell : FILE
 		author = "CISA.gov"
 		id = "3f6d83da-cea5-5e12-b0ba-93ace09d3d5c"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L296-L313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "409aa6a27d81e14ea90d90ee02924cb11f5fecef592e6577b084f9ab2dde35fc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L309-L327"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_409aa6a27d81e14ea90d90ee02924cb11f5fecef592e6577b084f9ab2dde35fc"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -373347,10 +369632,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Bindshell : FILE
 		$str_port = { B9 4D 05 00 00 89 }
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Grease2 : FILE
 {
 	meta:
@@ -373360,9 +369643,9 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Grease2 : FILE
 		date = "2024-07-25"
 		modified = "2024-07-26"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L315-L335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "138fc915206e0c2834090ebc0a808913488121d51c17de3dbfadcb4099fbfa2f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L329-L350"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_138fc915206e0c2834090ebc0a808913488121d51c17de3dbfadcb4099fbfa2f"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -373374,10 +369657,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Grease2 : FILE
 		$str_admins_add = "net localgroup administrators"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Nopineapple_Dtrack_Unpacked : FILE
 {
 	meta:
@@ -373385,11 +369666,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Nopineapple_Dtrack_Unpacked : FILE
 		author = "CISA.gov"
 		id = "6ccaf24b-c110-5788-a792-fa7f39fb18f7"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L337-L351"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf5f92a66ba3ff4db61102dcc50b781e8dd14ca7cb1eb70dae8eba2ed0910b66"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L352-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf5f92a66ba3ff4db61102dcc50b781e8dd14ca7cb1eb70dae8eba2ed0910b66"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -373400,10 +369681,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Nopineapple_Dtrack_Unpacked : FILE
 		$str_xor = {8B 10 83 F6 ?? 83 FA 01 77}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Dtrack_Unpacked : FILE
 {
 	meta:
@@ -373413,9 +369692,9 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Dtrack_Unpacked : FILE
 		date = "2024-07-25"
 		modified = "2024-07-26"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L353-L375"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d8de583fc0de01e6784305d28dbf7cea859a24cf4df1dc59356601bc830e4770"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L369-L392"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d8de583fc0de01e6784305d28dbf7cea859a24cf4df1dc59356601bc830e4770"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -373428,10 +369707,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Dtrack_Unpacked : FILE
 		$str_cmd_3 = "/c move /y %s \\\\" wide
 
 	condition:
-		uint16(0)==0x5A4D and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5A4D and ( 1 of ( $x* ) or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Tigerrat_Crowdsourced_Rule : FILE
 {
 	meta:
@@ -373441,9 +369718,9 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Tigerrat_Crowdsourced_Rule : FILE
 		date = "2024-07-25"
 		modified = "2024-07-26"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L377-L405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d203d8c7e624796571f4597f70be0b8303f21c096640f25018cad29d4abc05b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L394-L423"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d203d8c7e624796571f4597f70be0b8303f21c096640f25018cad29d4abc05b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -373459,10 +369736,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Tigerrat_Crowdsourced_Rule : FILE
 		$s4 = "del \"%s\"%s \"%s\" goto " ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or ( all of ($m*) and 1 of ($s*)) or (2 of ($m*) and 2 of ($s*)))
+		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( all of ( $m* ) and 1 of ( $s* ) ) or ( 2 of ( $m* ) and 2 of ( $s* ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_WIN_Tiger_RAT_Auto : FILE
 {
 	meta:
@@ -373470,11 +369745,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_WIN_Tiger_RAT_Auto : FILE
 		author = "CISA.gov"
 		id = "4579af62-52be-5f5f-a577-16ec50297c05"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L407-L546"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1deef66efb44c0d17f33508a8b6f0d6253f0308f309e81657f78eb0f87121bf5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L425-L565"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1deef66efb44c0d17f33508a8b6f0d6253f0308f309e81657f78eb0f87121bf5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -373498,10 +369773,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_WIN_Tiger_RAT_Auto : FILE
 		$sequence_15 = { 4883ec30 498bd8 e8???????? 488bc8 4885c0 }
 
 	condition:
-		filesize <600KB and 7 of them
+		filesize < 600KB and 7 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_APT_NK_WIN_Dtrack_Auto : FILE
 {
 	meta:
@@ -373509,11 +369782,11 @@ rule SIGNATURE_BASE_MAL_APT_NK_WIN_Dtrack_Auto : FILE
 		author = "CISA.gov"
 		id = "1b40c685-beba-50fa-b484-c1526577cb23"
 		date = "2024-07-25"
-		modified = "2024-07-26"
+		modified = "2024-12-12"
 		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_andariel_jul24.yar#L548-L687"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2bd68ee6e5f35a9b80c07120beba3fe1f3ba9a9137ee15bb04bb2740381a9a44"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_andariel_jul24.yar#L567-L707"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2bd68ee6e5f35a9b80c07120beba3fe1f3ba9a9137ee15bb04bb2740381a9a44"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -373536,7 +369809,7 @@ rule SIGNATURE_BASE_MAL_APT_NK_WIN_Dtrack_Auto : FILE
 		$sequence_14 = { 8b5514 8955f8 8b4518 8945fc e9???????? 8be5 }
 
 	condition:
-		filesize <1700KB and 7 of them
+		filesize < 1700KB and 7 of them
 }
 rule SIGNATURE_BASE_Wildneutron_Sample_1 : FILE
 {
@@ -373547,10 +369820,10 @@ rule SIGNATURE_BASE_Wildneutron_Sample_1 : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L10-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L10-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
-		logic_hash = "d8044761fa51f2afd16eb096aa9e896483387c47e10ce922f2ef32ebcbd1a520"
+		logic_hash = "v1_sha256_d8044761fa51f2afd16eb096aa9e896483387c47e10ce922f2ef32ebcbd1a520"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -373570,7 +369843,7 @@ rule SIGNATURE_BASE_Wildneutron_Sample_1 : FILE
 		$s40 = "%02d.%04d.%s" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
 }
 rule SIGNATURE_BASE_Wildneutron_Sample_2 : FILE
 {
@@ -373581,10 +369854,10 @@ rule SIGNATURE_BASE_Wildneutron_Sample_2 : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L36-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L36-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
-		logic_hash = "3a796199a2e9f2711e5fbdc1050234a8f3c09f762bc645f49a705d9f112d9cdc"
+		logic_hash = "v1_sha256_3a796199a2e9f2711e5fbdc1050234a8f3c09f762bc645f49a705d9f112d9cdc"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -373601,7 +369874,7 @@ rule SIGNATURE_BASE_Wildneutron_Sample_2 : FILE
 		$s13 = "%sexpires on    : %04d-%02d-%02d %02d:%02d:%02d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
 }
 rule SIGNATURE_BASE_Wildneutron_Sample_3 : FILE
 {
@@ -373612,10 +369885,10 @@ rule SIGNATURE_BASE_Wildneutron_Sample_3 : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L59-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L59-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
-		logic_hash = "16d511412576df2eb6d9646856d37bd94af7648cc602510696b74fa0534e405d"
+		logic_hash = "v1_sha256_16d511412576df2eb6d9646856d37bd94af7648cc602510696b74fa0534e405d"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -373633,7 +369906,7 @@ rule SIGNATURE_BASE_Wildneutron_Sample_3 : FILE
 		$s7 = "Acer LiveUpdater" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2020KB and (1 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 2020KB and ( 1 of ( $x* ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_Wildneutron_Sample_4 : FILE
 {
@@ -373644,10 +369917,10 @@ rule SIGNATURE_BASE_Wildneutron_Sample_4 : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L85-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L85-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
-		logic_hash = "4882b7c5f469615436490cd628ee3bb5b0dded43fb556ac6477cdadc6c8eff05"
+		logic_hash = "v1_sha256_4882b7c5f469615436490cd628ee3bb5b0dded43fb556ac6477cdadc6c8eff05"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -373665,7 +369938,7 @@ rule SIGNATURE_BASE_Wildneutron_Sample_4 : FILE
 		$s7 = "id-at-serialNumber" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1240KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1240KB and all of them
 }
 rule SIGNATURE_BASE_Wildneutron_Sample_5 : FILE
 {
@@ -373676,10 +369949,10 @@ rule SIGNATURE_BASE_Wildneutron_Sample_5 : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L110-L133"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L110-L133"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
-		logic_hash = "57792a54c96c59a1e9ed961715c72187936aee6f001c2ed4f95ca84e799e9c8c"
+		logic_hash = "v1_sha256_57792a54c96c59a1e9ed961715c72187936aee6f001c2ed4f95ca84e799e9c8c"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -373698,7 +369971,7 @@ rule SIGNATURE_BASE_Wildneutron_Sample_5 : FILE
 		$s9 = "%02d.%04d.%s" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_Wildneutron_Sample_6 : FILE
 {
@@ -373709,10 +369982,10 @@ rule SIGNATURE_BASE_Wildneutron_Sample_6 : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L135-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L135-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
-		logic_hash = "7dc7f9815f2b2c934ecf93f5813bdb87364b2b9e2a5aebc04f76cfff43e46d30"
+		logic_hash = "v1_sha256_7dc7f9815f2b2c934ecf93f5813bdb87364b2b9e2a5aebc04f76cfff43e46d30"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -373722,7 +369995,7 @@ rule SIGNATURE_BASE_Wildneutron_Sample_6 : FILE
 		$s0 = "mshtaex.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <310KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 310KB and all of them
 }
 rule SIGNATURE_BASE_Wildneutron_Sample_7 : FILE
 {
@@ -373733,10 +370006,10 @@ rule SIGNATURE_BASE_Wildneutron_Sample_7 : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L151-L176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L151-L176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
-		logic_hash = "8a081932be8fd03c37a87486570a02a31756ba6bd125dbed7da9703197447ea5"
+		logic_hash = "v1_sha256_8a081932be8fd03c37a87486570a02a31756ba6bd125dbed7da9703197447ea5"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -373757,7 +370030,7 @@ rule SIGNATURE_BASE_Wildneutron_Sample_7 : FILE
 		$s11 = "%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them
 }
 rule SIGNATURE_BASE_Wildneutron_Sample_9 : FILE
 {
@@ -373768,10 +370041,10 @@ rule SIGNATURE_BASE_Wildneutron_Sample_9 : FILE
 		date = "2015-07-10"
 		modified = "2023-01-06"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L203-L223"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L203-L223"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
-		logic_hash = "2029c94088e075cbcbae8d7d514cfc56add022d8776e59f04824d9ce9fd12794"
+		logic_hash = "v1_sha256_2029c94088e075cbcbae8d7d514cfc56add022d8776e59f04824d9ce9fd12794"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -373786,7 +370059,7 @@ rule SIGNATURE_BASE_Wildneutron_Sample_9 : FILE
 		$s13 = "%d -> %d" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1477KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1477KB and all of them
 }
 rule SIGNATURE_BASE_Wildneutron_Sample_10 : FILE
 {
@@ -373797,10 +370070,10 @@ rule SIGNATURE_BASE_Wildneutron_Sample_10 : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L225-L267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L225-L267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
-		logic_hash = "b282b6892f9cb6769bf0e302deaa8062fd69bfd51144bc06fc9501fde9537dae"
+		logic_hash = "v1_sha256_b282b6892f9cb6769bf0e302deaa8062fd69bfd51144bc06fc9501fde9537dae"
 		score = 60
 		quality = 83
 		tags = "FILE"
@@ -373832,7 +370105,7 @@ rule SIGNATURE_BASE_Wildneutron_Sample_10 : FILE
 		$y5 = "Error: RegSetValueExA 0x%x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and ($n1 or (1 of ($s*) and 1 of ($x*) and 3 of ($y*)))
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( $n1 or ( 1 of ( $s* ) and 1 of ( $x* ) and 3 of ( $y* ) ) )
 }
 rule SIGNATURE_BASE_APT_MAL_Wildneutron_Javacpl : FILE
 {
@@ -373844,9 +370117,9 @@ rule SIGNATURE_BASE_APT_MAL_Wildneutron_Javacpl : FILE
 		modified = "2023-01-06"
 		old_rule_name = "WildNeutron_javacpl"
 		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wildneutron.yar#L272-L300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c9cb6ab956d29df9f59520262ab308a0256747cc3c898979347304950e093098"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wildneutron.yar#L272-L300"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c9cb6ab956d29df9f59520262ab308a0256747cc3c898979347304950e093098"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -373865,7 +370138,7 @@ rule SIGNATURE_BASE_APT_MAL_Wildneutron_Javacpl : FILE
 		$op3 = { 8b c7 f7 f6 46 89 b5 c8 fd ff ff 0f b7 c0 8b c8 0f af ce 3b cf }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5MB and ( all of ($s*) or all of ($op*))
+		uint16( 0 ) == 0x5a4d and filesize < 5MB and ( all of ( $s* ) or all of ( $op* ) )
 }
 rule SIGNATURE_BASE_LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21 : LOG CVE_2021_26084
 {
@@ -373876,9 +370149,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21 : LOG CVE_2021_
 		date = "2021-09-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cve_2021_26084_confluence_log.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "04542570b4814efde3d96ba5be8b5f9fd6e3c51be09f0e8a1c4eba45bfd8f5ff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cve_2021_26084_confluence_log.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_04542570b4814efde3d96ba5be8b5f9fd6e3c51be09f0e8a1c4eba45bfd8f5ff"
 		score = 55
 		quality = 85
 		tags = "LOG, CVE-2021-26084"
@@ -373895,7 +370168,7 @@ rule SIGNATURE_BASE_LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21 : LOG CVE_2021_
 		$re1 = /\[confluence\.plugins\.synchrony\.SynchronyContextProvider\] getContextMap (\n )?-- url: \/pages\/createpage-entervariables\.action/
 
 	condition:
-		1 of ($x*) or ($sa1 and 1 of ($sb*)) or ( all of ($sc*) and $re1)
+		1 of ( $x* ) or ( $sa1 and 1 of ( $sb* ) ) or ( all of ( $sc* ) and $re1 )
 }
 rule SIGNATURE_BASE_APT_UNC2447_MAL_SOMBRAT_May21_1 : FILE
 {
@@ -373906,9 +370179,9 @@ rule SIGNATURE_BASE_APT_UNC2447_MAL_SOMBRAT_May21_1 : FILE
 		date = "2021-05-01"
 		modified = "2023-01-07"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc2447_sombrat.yar#L2-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f2572745cbd68c5f2be5c64b160d2513938daba6da57523012491acc63cfee4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc2447_sombrat.yar#L2-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f2572745cbd68c5f2be5c64b160d2513938daba6da57523012491acc63cfee4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -373932,7 +370205,7 @@ rule SIGNATURE_BASE_APT_UNC2447_MAL_SOMBRAT_May21_1 : FILE
 		$op3 = { 49 f7 b0 a0 00 00 00 42 0f b6 04 0a 41 30 44 33 fe 48 83 79 18 10 72 03 48 8b 09 33 d2 b8 05 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and ((1 of ($x*) and 1 of ($s*)) or 3 of them ) or 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or 3 of them ) or 5 of them
 }
 rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1 : FILE
 {
@@ -373943,9 +370216,9 @@ rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1 : FILE
 		date = "2021-05-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc2447_sombrat.yar#L38-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "acc0ab5502d53c6e22c8650c29c5459a6106f33c398e4efcd963f54971a0c870"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc2447_sombrat.yar#L38-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_acc0ab5502d53c6e22c8650c29c5459a6106f33c398e4efcd963f54971a0c870"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -373973,7 +370246,7 @@ rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1 : FILE
 		$sop3 = { 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and 1 of ($x*) or 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of ( $x* ) or 3 of them
 }
 rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2 : FILE
 {
@@ -373984,9 +370257,9 @@ rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2 : FILE
 		date = "2021-05-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc2447_sombrat.yar#L74-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1eee3a00ab3f70425d2b6bf5dc507155bf504b851ddb6515602d83d8b6a254b8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc2447_sombrat.yar#L74-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1eee3a00ab3f70425d2b6bf5dc507155bf504b851ddb6515602d83d8b6a254b8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374005,7 +370278,7 @@ rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2 : FILE
 		$sop2 = { 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and 1 of ($x*) or 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of ( $x* ) or 2 of them
 }
 rule SIGNATURE_BASE_APT_UNC2447_PS1_WARPRISM_May21_1 : FILE
 {
@@ -374016,9 +370289,9 @@ rule SIGNATURE_BASE_APT_UNC2447_PS1_WARPRISM_May21_1 : FILE
 		date = "2021-05-01"
 		modified = "2023-12-05"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc2447_sombrat.yar#L101-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "09abac2be0f12d31dabfdae9e8a148a28887a2a5df003c7bcb56ba45f1c6a62c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc2447_sombrat.yar#L101-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_09abac2be0f12d31dabfdae9e8a148a28887a2a5df003c7bcb56ba45f1c6a62c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374033,7 +370306,7 @@ rule SIGNATURE_BASE_APT_UNC2447_PS1_WARPRISM_May21_1 : FILE
 		$s3 = "[System.Diagnostics.Process]::Start((-join(" ascii wide
 
 	condition:
-		filesize <5000KB and 1 of ($x*) or 2 of them
+		filesize < 5000KB and 1 of ( $x* ) or 2 of them
 }
 rule SIGNATURE_BASE_APT_UNC2447_BAT_Runner_May21_1 : FILE
 {
@@ -374044,9 +370317,9 @@ rule SIGNATURE_BASE_APT_UNC2447_BAT_Runner_May21_1 : FILE
 		date = "2021-05-01"
 		modified = "2023-01-07"
 		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc2447_sombrat.yar#L121-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f9872327f648e4421aa40ca3ce55df5d3eb5e8c5bc718ff62a3d4adac79217eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc2447_sombrat.yar#L121-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f9872327f648e4421aa40ca3ce55df5d3eb5e8c5bc718ff62a3d4adac79217eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374057,7 +370330,7 @@ rule SIGNATURE_BASE_APT_UNC2447_BAT_Runner_May21_1 : FILE
 		$x2 = "wwansvc.txt')))\" | powershell.exe -" ascii
 
 	condition:
-		filesize <5000KB and 1 of them
+		filesize < 5000KB and 1 of them
 }
 rule SIGNATURE_BASE_Winagent_Badpatch_1 : FILE
 {
@@ -374068,9 +370341,9 @@ rule SIGNATURE_BASE_Winagent_Badpatch_1 : FILE
 		date = "2017-10-20"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/RvDwwA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_bad_patch.yar#L11-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "568086edb8884877f9dcb0cffa1e4c05164e6884bf80ce50692cedfa3e8d5750"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_bad_patch.yar#L11-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_568086edb8884877f9dcb0cffa1e4c05164e6884bf80ce50692cedfa3e8d5750"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374095,7 +370368,7 @@ rule SIGNATURE_BASE_Winagent_Badpatch_1 : FILE
 		$s4 = "downloadUpdate" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 4 of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 4 of them ) )
 }
 rule SIGNATURE_BASE_Winagent_Badpatch_2 : FILE
 {
@@ -374106,9 +370379,9 @@ rule SIGNATURE_BASE_Winagent_Badpatch_2 : FILE
 		date = "2017-10-20"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/RvDwwA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_bad_patch.yar#L41-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "649cfca8fa9d3b9f12b56fd81d4133a00eb5449e67fca2abe85fbfb778912df8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_bad_patch.yar#L41-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_649cfca8fa9d3b9f12b56fd81d4133a00eb5449e67fca2abe85fbfb778912df8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374139,7 +370412,7 @@ rule SIGNATURE_BASE_Winagent_Badpatch_2 : FILE
 		$s13 = "-- SysFile...." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 3 of them )
 }
 rule SIGNATURE_BASE_Sedll_Javascript_Decryptor : FILE
 {
@@ -374150,9 +370423,9 @@ rule SIGNATURE_BASE_Sedll_Javascript_Decryptor : FILE
 		date = "2017-10-18"
 		modified = "2023-01-07"
 		reference = "https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_leviathan.yar#L11-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "26ef61d8bb1764dddd951526902fb510fbacc8b808fe99ddee1956dc8b59bd1d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_leviathan.yar#L11-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_26ef61d8bb1764dddd951526902fb510fbacc8b808fe99ddee1956dc8b59bd1d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374168,7 +370441,7 @@ rule SIGNATURE_BASE_Sedll_Javascript_Decryptor : FILE
 		$s5 = "CheckUpAndDownWW" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and ( 1 of ( $x* ) or 4 of them )
 }
 rule SIGNATURE_BASE_Leviathan_Cobaltstrike_Sample_1 : FILE
 {
@@ -374179,9 +370452,9 @@ rule SIGNATURE_BASE_Leviathan_Cobaltstrike_Sample_1 : FILE
 		date = "2017-10-18"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_leviathan.yar#L33-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ebc8c2f8ddba302e0fbde69e27986236053a3d31c50cf3a2f979a9ebb90907f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_leviathan.yar#L33-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ebc8c2f8ddba302e0fbde69e27986236053a3d31c50cf3a2f979a9ebb90907f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374200,7 +370473,7 @@ rule SIGNATURE_BASE_Leviathan_Cobaltstrike_Sample_1 : FILE
 		$s6 = "Could not connect to pipe (%s): %d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_Mockdll_Gen : FILE
 {
@@ -374211,9 +370484,9 @@ rule SIGNATURE_BASE_Mockdll_Gen : FILE
 		date = "2017-10-18"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_leviathan.yar#L57-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cbe7b816199d251bfdc751f46bd95da6f0447ebd56f564619d24eb08bbd4a2c7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_leviathan.yar#L57-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cbe7b816199d251bfdc751f46bd95da6f0447ebd56f564619d24eb08bbd4a2c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374228,7 +370501,7 @@ rule SIGNATURE_BASE_Mockdll_Gen : FILE
 		$s2 = "MockModule=%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and ( 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_Vbscript_Favicon_File : FILE
 {
@@ -374239,9 +370512,9 @@ rule SIGNATURE_BASE_Vbscript_Favicon_File : FILE
 		date = "2017-10-18"
 		modified = "2023-01-06"
 		reference = "https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_leviathan.yar#L77-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b89ea916adf6864c8b1cb7cd7ee6d74ea47bf17a0b03cc513046f8d260ae376"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_leviathan.yar#L77-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b89ea916adf6864c8b1cb7cd7ee6d74ea47bf17a0b03cc513046f8d260ae376"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374255,7 +370528,7 @@ rule SIGNATURE_BASE_Vbscript_Favicon_File : FILE
 		$s2 = ".ExpandEnvironmentStrings(\"%temp%\") & " ascii
 
 	condition:
-		filesize <100KB and ( uint16(0)==0x733c and 1 of ($x*)) or (3 of them )
+		filesize < 100KB and ( uint16( 0 ) == 0x733c and 1 of ( $x* ) ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_CVE_2017_8759_Mal_HTA : CVE_2017_8759 FILE
 {
@@ -374266,9 +370539,9 @@ rule SIGNATURE_BASE_CVE_2017_8759_Mal_HTA : CVE_2017_8759 FILE
 		date = "2017-09-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_8759.yar#L11-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f98578104e411fcf75a46f8a0bc3e561c94d0ca4ad7c1aae2595d03a29efd74e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_8759.yar#L11-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f98578104e411fcf75a46f8a0bc3e561c94d0ca4ad7c1aae2595d03a29efd74e"
 		score = 75
 		quality = 85
 		tags = "CVE-2017-8759, FILE"
@@ -374279,7 +370552,7 @@ rule SIGNATURE_BASE_CVE_2017_8759_Mal_HTA : CVE_2017_8759 FILE
 		$x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii
 
 	condition:
-		( uint16(0)==0x683c and filesize <1KB and all of them )
+		( uint16( 0 ) == 0x683c and filesize < 1KB and all of them )
 }
 rule SIGNATURE_BASE_CVE_2017_8759_Mal_Doc : CVE_2017_8759 FILE
 {
@@ -374290,9 +370563,9 @@ rule SIGNATURE_BASE_CVE_2017_8759_Mal_Doc : CVE_2017_8759 FILE
 		date = "2017-09-14"
 		modified = "2023-11-21"
 		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_8759.yar#L26-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c81feebef463fee41661ca951a39ee789db5d36acc8262ddb391609d8680108"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_8759.yar#L26-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c81feebef463fee41661ca951a39ee789db5d36acc8262ddb391609d8680108"
 		score = 75
 		quality = 85
 		tags = "CVE-2017-8759, FILE"
@@ -374307,7 +370580,7 @@ rule SIGNATURE_BASE_CVE_2017_8759_Mal_Doc : CVE_2017_8759 FILE
 		$c1 = "Project.ThisDocument.AutoOpen" fullword wide
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <500KB and (1 of ($s*) and $c1)
+		uint16( 0 ) == 0xcfd0 and filesize < 500KB and ( 1 of ( $s* ) and $c1 )
 }
 rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Via_JS : FILE
 {
@@ -374318,9 +370591,9 @@ rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Via_JS : FILE
 		date = "2017-09-14"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/buffaloverflow/status/907728364278087680"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_8759.yar#L47-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c170479283fe859b9ecfba4834396aaf78b375472250a4b188bc913f69c97fd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_8759.yar#L47-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c170479283fe859b9ecfba4834396aaf78b375472250a4b188bc913f69c97fd"
 		score = 60
 		quality = 81
 		tags = "FILE"
@@ -374331,7 +370604,7 @@ rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Via_JS : FILE
 		$s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase
 
 	condition:
-		( filesize <3KB and 1 of them )
+		( filesize < 3KB and 1 of them )
 }
 rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Excel : CVE_2017_8759 FILE
 {
@@ -374342,9 +370615,9 @@ rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Excel : CVE_2017_8759 FILE
 		date = "2017-09-15"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/buffaloverflow/status/908455053345869825"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_8759.yar#L63-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "adea595b251796e93cdc54cc59198d88a68e28d42899c90721f63f6813df24fe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_8759.yar#L63-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_adea595b251796e93cdc54cc59198d88a68e28d42899c90721f63f6813df24fe"
 		score = 60
 		quality = 83
 		tags = "CVE-2017-8759, FILE"
@@ -374354,7 +370627,7 @@ rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Excel : CVE_2017_8759 FILE
 		$s1 = "|'soap:wsdl=" ascii wide nocase
 
 	condition:
-		( filesize <300KB and 1 of them )
+		( filesize < 300KB and 1 of them )
 }
 rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Txt : CVE_2017_8759 FILE
 {
@@ -374365,9 +370638,9 @@ rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Txt : CVE_2017_8759 FILE
 		date = "2017-09-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_8759.yar#L78-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "184179006ed2ac2ad76e09c53196805fcb1b7380dab1d5740b4469a89d6b0b32"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_8759.yar#L78-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_184179006ed2ac2ad76e09c53196805fcb1b7380dab1d5740b4469a89d6b0b32"
 		score = 75
 		quality = 85
 		tags = "CVE-2017-8759, FILE"
@@ -374379,7 +370652,7 @@ rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Txt : CVE_2017_8759 FILE
 		$s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide
 
 	condition:
-		( filesize <200KB and 1 of them )
+		( filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_CVE_2017_8759_WSDL_In_RTF : CVE_2017_8759 FILE
 {
@@ -374390,9 +370663,9 @@ rule SIGNATURE_BASE_CVE_2017_8759_WSDL_In_RTF : CVE_2017_8759 FILE
 		date = "2017-09-15"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/xdxdxdxdoa/status/908665278199996416"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_8759.yar#L94-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "47adc7adfc55239792aef818648546adb1627e74690de0d811100cc49aab8c2f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_8759.yar#L94-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_47adc7adfc55239792aef818648546adb1627e74690de0d811100cc49aab8c2f"
 		score = 75
 		quality = 85
 		tags = "CVE-2017-8759, FILE"
@@ -374406,7 +370679,7 @@ rule SIGNATURE_BASE_CVE_2017_8759_WSDL_In_RTF : CVE_2017_8759 FILE
 		$http3 = "6600740070003a002f002f00" nocase
 
 	condition:
-		uint32be(0)==0x7B5C7274 and $obj and $doc and $wsdl and 1 of ($http*)
+		uint32be( 0 ) == 0x7B5C7274 and $obj and $doc and $wsdl and 1 of ( $http* )
 }
 import "pe"
 
@@ -374419,9 +370692,9 @@ rule SIGNATURE_BASE_MAL_Floxif_Generic : FILE
 		date = "2018-05-11"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_floxif_flystudio.yar#L3-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1996f717100d9f1abc2ed3f1e9d0c55daec09654c0f99987ddaea9e9f0d17008"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_floxif_flystudio.yar#L3-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1996f717100d9f1abc2ed3f1e9d0c55daec09654c0f99987ddaea9e9f0d17008"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -374429,7 +370702,7 @@ rule SIGNATURE_BASE_MAL_Floxif_Generic : FILE
 		hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="2f4ddcfebbcad3bacadc879747151f6f" or pe.exports("FloodFix") or pe.exports("FloodFix2"))
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "2f4ddcfebbcad3bacadc879747151f6f" or pe.exports ( "FloodFix" ) or pe.exports ( "FloodFix2" ) )
 }
 import "pe"
 
@@ -374442,9 +370715,9 @@ rule SIGNATURE_BASE_MAL_CN_Flystudio_May18_1 : FILE
 		date = "2018-05-11"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_floxif_flystudio.yar#L21-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8d03f02a270d8664175b65398c01ec4f0ea182437b31847f9bf4181edb0c36bb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_floxif_flystudio.yar#L21-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8d03f02a270d8664175b65398c01ec4f0ea182437b31847f9bf4181edb0c36bb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374456,7 +370729,7 @@ rule SIGNATURE_BASE_MAL_CN_Flystudio_May18_1 : FILE
 		$s2 = "www.cfyhack.cn" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and (pe.imphash()=="65ae5cf17140aeaf91e3e9911da0ee3e" or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( pe.imphash ( ) == "65ae5cf17140aeaf91e3e9911da0ee3e" or 1 of them )
 }
 rule SIGNATURE_BASE_Visualdiscovery_Lonovo_Superfish_SSL_Hijack : FILE
 {
@@ -374467,9 +370740,9 @@ rule SIGNATURE_BASE_Visualdiscovery_Lonovo_Superfish_SSL_Hijack : FILE
 		date = "2015-02-19"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/4nc4p/status/568325493558272000"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/threat_lenovo_superfish.yar#L4-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0f156a51dccafe32467b64251507928b1c7a1b04595063aa66aa69da6c4cc4fc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/threat_lenovo_superfish.yar#L4-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0f156a51dccafe32467b64251507928b1c7a1b04595063aa66aa69da6c4cc4fc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374485,7 +370758,7 @@ rule SIGNATURE_BASE_Visualdiscovery_Lonovo_Superfish_SSL_Hijack : FILE
 		$s5 = "SetPCProxyHandler" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2MB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 2MB and all of ( $s* )
 }
 rule SIGNATURE_BASE_Groups_Cpassword : FILE
 {
@@ -374496,9 +370769,9 @@ rule SIGNATURE_BASE_Groups_Cpassword : FILE
 		date = "2015-09-08"
 		modified = "2023-12-05"
 		reference = "http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_gpp_cpassword.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "de37dc77d9a2462f5d54ad5225405c6d95dad39e67a893f5442b26dc641a20f9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_gpp_cpassword.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_de37dc77d9a2462f5d54ad5225405c6d95dad39e67a893f5442b26dc641a20f9"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -374511,7 +370784,7 @@ rule SIGNATURE_BASE_Groups_Cpassword : FILE
 		$s4 = " acctDisabled=" ascii
 
 	condition:
-		uint32be(0)==0x3C3F786D and filesize <1000KB and all of ($s*)
+		uint32be( 0 ) == 0x3C3F786D and filesize < 1000KB and all of ( $s* )
 }
 rule SIGNATURE_BASE_Pirpi_1609_A : FILE
 {
@@ -374522,9 +370795,9 @@ rule SIGNATURE_BASE_Pirpi_1609_A : FILE
 		date = "2016-09-08"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_pirpi.yar#L10-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "470745d0dd44c161ed6ec474f85531a3aca8ebb0adb98b902cb0b7465ca07d8b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_pirpi.yar#L10-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_470745d0dd44c161ed6ec474f85531a3aca8ebb0adb98b902cb0b7465ca07d8b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374552,7 +370825,7 @@ rule SIGNATURE_BASE_Pirpi_1609_A : FILE
 		$op3 = { 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and ($x1 or all of ($c*) or all of ($op*))) or (8 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( $x1 or all of ( $c* ) or all of ( $op* ) ) ) or ( 8 of them )
 }
 rule SIGNATURE_BASE_Pirpi_1609_B : FILE
 {
@@ -374563,9 +370836,9 @@ rule SIGNATURE_BASE_Pirpi_1609_B : FILE
 		date = "2016-09-08"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_pirpi.yar#L45-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4dafff80fb7bfcffccf96d991245c13b3208fd4f5a21488d7d6885758ef05078"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_pirpi.yar#L45-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4dafff80fb7bfcffccf96d991245c13b3208fd4f5a21488d7d6885758ef05078"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374583,7 +370856,7 @@ rule SIGNATURE_BASE_Pirpi_1609_B : FILE
 		$s8 = "tconn <ip> <port>" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 2 of them ) or (4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 4 of them )
 }
 rule SIGNATURE_BASE_Whosthere_Alt : FILE
 {
@@ -374594,10 +370867,10 @@ rule SIGNATURE_BASE_Whosthere_Alt : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passthehashtoolkit.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passthehashtoolkit.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
-		logic_hash = "ef7bccb8f63034b885cfaec27663c9b038cd9b1811b4f25a9eae28640dac248b"
+		logic_hash = "v1_sha256_ef7bccb8f63034b885cfaec27663c9b038cd9b1811b4f25a9eae28640dac248b"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -374614,7 +370887,7 @@ rule SIGNATURE_BASE_Whosthere_Alt : FILE
 		$s7 = "Cannot get LSASS.EXE PID!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <280KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 280KB and 2 of them
 }
 rule SIGNATURE_BASE_Iam_Alt_Iam_Alt : FILE
 {
@@ -374625,10 +370898,10 @@ rule SIGNATURE_BASE_Iam_Alt_Iam_Alt : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passthehashtoolkit.yar#L33-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passthehashtoolkit.yar#L33-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2ea662ef58142d9e340553ce50d95c1b7a405672acdfd476403a565bdd0cfb90"
-		logic_hash = "acd4dae57e8394d4ce2f3dfb44706ea35c3d684ab34fd0c707b6aeedd816280a"
+		logic_hash = "v1_sha256_acd4dae57e8394d4ce2f3dfb44706ea35c3d684ab34fd0c707b6aeedd816280a"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -374645,7 +370918,7 @@ rule SIGNATURE_BASE_Iam_Alt_Iam_Alt : FILE
 		$s7 = "LSASS HANDLE: %x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 240KB and 2 of them
 }
 rule SIGNATURE_BASE_Genhash_Genhash : FILE
 {
@@ -374656,10 +370929,10 @@ rule SIGNATURE_BASE_Genhash_Genhash : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passthehashtoolkit.yar#L56-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passthehashtoolkit.yar#L56-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "113df11063f8634f0d2a28e0b0e3c2b1f952ef95bad217fd46abff189be5373f"
-		logic_hash = "fe1ebe7ea94351610e0042eab020d155cbab26d790477909467c9b5a827fb6d6"
+		logic_hash = "v1_sha256_fe1ebe7ea94351610e0042eab020d155cbab26d790477909467c9b5a827fb6d6"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -374673,7 +370946,7 @@ rule SIGNATURE_BASE_Genhash_Genhash : FILE
 		$s6 = "(hashes format: LM Hash:NT hash)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
 }
 rule SIGNATURE_BASE_Iam_Iamdll : FILE
 {
@@ -374684,10 +370957,10 @@ rule SIGNATURE_BASE_Iam_Iamdll : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passthehashtoolkit.yar#L76-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passthehashtoolkit.yar#L76-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "892de92f71941f7b9e550de00a57767beb7abe1171562e29428b84988cee6602"
-		logic_hash = "ef7c66d2e1204a43921b6701812ea8a7bfa8e39e24d9396c95b725a4a4171010"
+		logic_hash = "v1_sha256_ef7c66d2e1204a43921b6701812ea8a7bfa8e39e24d9396c95b725a4a4171010"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -374699,7 +370972,7 @@ rule SIGNATURE_BASE_Iam_Iamdll : FILE
 		$s2 = "ChangeCreds" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <115KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 115KB and all of them
 }
 rule SIGNATURE_BASE_Iam_Iam : FILE
 {
@@ -374710,10 +370983,10 @@ rule SIGNATURE_BASE_Iam_Iam : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passthehashtoolkit.yar#L94-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passthehashtoolkit.yar#L94-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
-		logic_hash = "f170f6f71b81a674a269ddd441c77a43afbbfe2870e1d0c4101abd2e58bff0b0"
+		logic_hash = "v1_sha256_f170f6f71b81a674a269ddd441c77a43afbbfe2870e1d0c4101abd2e58bff0b0"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -374729,7 +371002,7 @@ rule SIGNATURE_BASE_Iam_Iam : FILE
 		$s7 = "Checking LSASRV.DLL...." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Whosthere_Alt_Pth : FILE
 {
@@ -374740,10 +371013,10 @@ rule SIGNATURE_BASE_Whosthere_Alt_Pth : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passthehashtoolkit.yar#L116-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passthehashtoolkit.yar#L116-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fbfc8e1bc69348721f06e96ff76ae92f3551f33ed3868808efdb670430ae8bd0"
-		logic_hash = "137b0dae105f97b5d4352d16e52144e72306e61be57c5d93df77ad3f5808018e"
+		logic_hash = "v1_sha256_137b0dae105f97b5d4352d16e52144e72306e61be57c5d93df77ad3f5808018e"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -374757,7 +371030,7 @@ rule SIGNATURE_BASE_Whosthere_Alt_Pth : FILE
 		$s4 = "segment 1 found at %.8Xh" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 240KB and 4 of them
 }
 rule SIGNATURE_BASE_Whosthere : FILE
 {
@@ -374768,10 +371041,10 @@ rule SIGNATURE_BASE_Whosthere : FILE
 		date = "2015-07-10"
 		modified = "2023-12-05"
 		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_passthehashtoolkit.yar#L136-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_passthehashtoolkit.yar#L136-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d7a82204d3e511cf5af58eabdd6e9757c5dd243f9aca3999dc0e5d1603b1fa37"
-		logic_hash = "a13c8a1fc66381b040d6449fe9655191d7a1762da0dc70789cd497fb68fb2a55"
+		logic_hash = "v1_sha256_a13c8a1fc66381b040d6449fe9655191d7a1762da0dc70789cd497fb68fb2a55"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -374786,7 +371059,7 @@ rule SIGNATURE_BASE_Whosthere : FILE
 		$s6 = "Cannot get LSASS.EXE PID!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <320KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 320KB and 2 of them
 }
 rule SIGNATURE_BASE_Beepservice_Hacktool : FILE
 {
@@ -374797,9 +371070,9 @@ rule SIGNATURE_BASE_Beepservice_Hacktool : FILE
 		date = "2016-05-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/p32Ozf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_beepservice.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "176136e8a5ffec258caebf8d6b452b556093c5998414a7c9a4451ad78482f862"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_beepservice.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_176136e8a5ffec258caebf8d6b452b556093c5998414a7c9a4451ad78482f862"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -374816,7 +371089,7 @@ rule SIGNATURE_BASE_Beepservice_Hacktool : FILE
 		$s3 = "192.168.88.69" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and $x1 and 1 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and $x1 and 1 of ( $s* )
 }
 import "pe"
 
@@ -374829,9 +371102,9 @@ rule SIGNATURE_BASE_MAL_Nitol_Malware_Jan19_1 : FILE
 		date = "2019-01-14"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/shotgunner101/status/1084602413691166721"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mal_nitol.yar#L4-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4607496beb37500637c1e5509b42c0fe6f9e79548c85603819dc966fa2cc2be0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mal_nitol.yar#L4-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4607496beb37500637c1e5509b42c0fe6f9e79548c85603819dc966fa2cc2be0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374849,7 +371122,7 @@ rule SIGNATURE_BASE_MAL_Nitol_Malware_Jan19_1 : FILE
 		$s4 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="286870a926664a5129b8b68ed0d4a8eb" or 1 of ($x*) or #n1>4 or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.imphash ( ) == "286870a926664a5129b8b68ed0d4a8eb" or 1 of ( $x* ) or #n1 > 4 or 4 of them )
 }
 rule SIGNATURE_BASE_MAL_ELF_Reverseshell_Sslshell_Jun23_1 : CVE_2023_2868 FILE
 {
@@ -374860,9 +371133,9 @@ rule SIGNATURE_BASE_MAL_ELF_Reverseshell_Sslshell_Jun23_1 : CVE_2023_2868 FILE
 		date = "2023-06-07"
 		modified = "2023-12-05"
 		reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lnx_barracuda_cve_2023_2868.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "57e9afb2f6928656242b8257cc3b98ae3b03e38c75ad40b544e3fc6afaea794d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lnx_barracuda_cve_2023_2868.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_57e9afb2f6928656242b8257cc3b98ae3b03e38c75ad40b544e3fc6afaea794d"
 		score = 75
 		quality = 85
 		tags = "CVE-2023-2868, FILE"
@@ -374873,7 +371146,7 @@ rule SIGNATURE_BASE_MAL_ELF_Reverseshell_Sslshell_Jun23_1 : CVE_2023_2868 FILE
 		$s1 = "SSLShell"
 
 	condition:
-		uint32be(0)==0x7f454c46 and uint16(0x10)==0x0002 and filesize <5MB and all of them
+		uint32be( 0 ) == 0x7f454c46 and uint16( 0x10 ) == 0x0002 and filesize < 5MB and all of them
 }
 rule SIGNATURE_BASE_MAL_ELF_SALTWATER_Jun23_1 : CVE_2023_2868 FILE
 {
@@ -374884,9 +371157,9 @@ rule SIGNATURE_BASE_MAL_ELF_SALTWATER_Jun23_1 : CVE_2023_2868 FILE
 		date = "2023-06-07"
 		modified = "2023-12-05"
 		reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lnx_barracuda_cve_2023_2868.yar#L21-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb35898c0ee726170da93b4364920ac065f083f9f02db8eb5d293b1ce127cb78"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lnx_barracuda_cve_2023_2868.yar#L21-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb35898c0ee726170da93b4364920ac065f083f9f02db8eb5d293b1ce127cb78"
 		score = 80
 		quality = 85
 		tags = "CVE-2023-2868, FILE"
@@ -374903,7 +371176,7 @@ rule SIGNATURE_BASE_MAL_ELF_SALTWATER_Jun23_1 : CVE_2023_2868 FILE
 		$s7 = "/home/product/code/config/ssl_engine_cert.pem"
 
 	condition:
-		uint16(0)==0x457f and filesize <6000KB and ((1 of ($x*) and 2 of them ) or 3 of them ) or all of them
+		uint16( 0 ) == 0x457f and filesize < 6000KB and ( ( 1 of ( $x* ) and 2 of them ) or 3 of them ) or all of them
 }
 rule SIGNATURE_BASE_COZY_FANCY_BEAR_Hunt : FILE
 {
@@ -374914,9 +371187,9 @@ rule SIGNATURE_BASE_COZY_FANCY_BEAR_Hunt : FILE
 		date = "2016-06-14"
 		modified = "2023-12-05"
 		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fancybear_dnc.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9009f181eeecce0ae322ba24335426399cf4484dfc9b7ea6905fb163b4bf0a25"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fancybear_dnc.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9009f181eeecce0ae322ba24335426399cf4484dfc9b7ea6905fb163b4bf0a25"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374932,7 +371205,7 @@ rule SIGNATURE_BASE_COZY_FANCY_BEAR_Hunt : FILE
 		$s7 = "23.227.196.217" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule SIGNATURE_BASE_COZY_FANCY_BEAR_Pagemgr_Hunt : FILE
 {
@@ -374943,9 +371216,9 @@ rule SIGNATURE_BASE_COZY_FANCY_BEAR_Pagemgr_Hunt : FILE
 		date = "2016-06-14"
 		modified = "2023-12-05"
 		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fancybear_dnc.yar#L30-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c6055b7cd04b994c80395276e83bec664b7dd32f8093411bfde0850cca39e9f7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fancybear_dnc.yar#L30-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c6055b7cd04b994c80395276e83bec664b7dd32f8093411bfde0850cca39e9f7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374955,7 +371228,7 @@ rule SIGNATURE_BASE_COZY_FANCY_BEAR_Pagemgr_Hunt : FILE
 		$s1 = "pagemgr.exe" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule SIGNATURE_BASE_Apt_Hellsing_Implantstrings : FILE
 {
@@ -374966,9 +371239,9 @@ rule SIGNATURE_BASE_Apt_Hellsing_Implantstrings : FILE
 		date = "2015-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hellsing_kaspersky.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d62dc766a40d1dc7044cc5c9f07a78d36e231b771fafb52442b26514f4c603db"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hellsing_kaspersky.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d62dc766a40d1dc7044cc5c9f07a78d36e231b771fafb52442b26514f4c603db"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -374993,7 +371266,7 @@ rule SIGNATURE_BASE_Apt_Hellsing_Implantstrings : FILE
 		$f = "ServiceMain"
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($a*)) or ( all of ($b*)) or ($c and $d) or ( any of ($debugpath*)) or ($e and $f) and filesize <500000
+		uint16( 0 ) == 0x5a4d and ( all of ( $a* ) ) or ( all of ( $b* ) ) or ( $c and $d ) or ( any of ( $debugpath* ) ) or ( $e and $f ) and filesize < 500000
 }
 rule SIGNATURE_BASE_Apt_Hellsing_Installer : FILE
 {
@@ -375004,9 +371277,9 @@ rule SIGNATURE_BASE_Apt_Hellsing_Installer : FILE
 		date = "2015-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hellsing_kaspersky.yar#L31-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "556898e9507835d93e2cf7e21e997b6e64dc154ac675b429f5f8226bf929309c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hellsing_kaspersky.yar#L31-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_556898e9507835d93e2cf7e21e997b6e64dc154ac675b429f5f8226bf929309c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375028,7 +371301,7 @@ rule SIGNATURE_BASE_Apt_Hellsing_Installer : FILE
 		$a12 = {00 65 78 2E 64 6C 6C 00}
 
 	condition:
-		uint16(0)==0x5a4d and ($cmd and (2 of ($a*))) and filesize <500000
+		uint16( 0 ) == 0x5a4d and ( $cmd and ( 2 of ( $a* ) ) ) and filesize < 500000
 }
 rule SIGNATURE_BASE_Apt_Hellsing_Proxytool : FILE
 {
@@ -375039,9 +371312,9 @@ rule SIGNATURE_BASE_Apt_Hellsing_Proxytool : FILE
 		date = "2015-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hellsing_kaspersky.yar#L56-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8f2656e7b4e6fb5336fb4e39bcec3e99531db532f757b65e3aa12cd2a4334840"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hellsing_kaspersky.yar#L56-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8f2656e7b4e6fb5336fb4e39bcec3e99531db532f757b65e3aa12cd2a4334840"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -375057,7 +371330,7 @@ rule SIGNATURE_BASE_Apt_Hellsing_Proxytool : FILE
 		$a6 = "D:\\Hellsing\\release\\exe\\exe\\" nocase
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($a*)) and filesize <300000
+		uint16( 0 ) == 0x5a4d and ( 2 of ( $a* ) ) and filesize < 300000
 }
 rule SIGNATURE_BASE_Apt_Hellsing_Xkat : FILE
 {
@@ -375068,9 +371341,9 @@ rule SIGNATURE_BASE_Apt_Hellsing_Xkat : FILE
 		date = "2015-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hellsing_kaspersky.yar#L76-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ba74ca11c96e59a04f1cb57b4866df7a581ad94ca81230f2ca5068c8808297aa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hellsing_kaspersky.yar#L76-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ba74ca11c96e59a04f1cb57b4866df7a581ad94ca81230f2ca5068c8808297aa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375092,7 +371365,7 @@ rule SIGNATURE_BASE_Apt_Hellsing_Xkat : FILE
 		$a12 = "kill and delete pid:%d ok."
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($a*)) and filesize <300000
+		uint16( 0 ) == 0x5a4d and ( 6 of ( $a* ) ) and filesize < 300000
 }
 rule SIGNATURE_BASE_Apt_Hellsing_Msgertype2 : FILE
 {
@@ -375103,9 +371376,9 @@ rule SIGNATURE_BASE_Apt_Hellsing_Msgertype2 : FILE
 		date = "2015-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hellsing_kaspersky.yar#L99-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "232e4dfd8d236da223240d9a4ec3f8bfa635d51d7376ff19dfa5579af31fc47f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hellsing_kaspersky.yar#L99-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_232e4dfd8d236da223240d9a4ec3f8bfa635d51d7376ff19dfa5579af31fc47f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375121,7 +371394,7 @@ rule SIGNATURE_BASE_Apt_Hellsing_Msgertype2 : FILE
 		$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($a*)) and filesize <500000
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $a* ) ) and filesize < 500000
 }
 rule SIGNATURE_BASE_Apt_Hellsing_Irene : FILE
 {
@@ -375132,9 +371405,9 @@ rule SIGNATURE_BASE_Apt_Hellsing_Irene : FILE
 		date = "2015-04-07"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hellsing_kaspersky.yar#L119-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e7da04083468dba7045b55181642d7cd57d543fbeda24685ba2ac63799740798"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hellsing_kaspersky.yar#L119-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e7da04083468dba7045b55181642d7cd57d543fbeda24685ba2ac63799740798"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375150,7 +371423,7 @@ rule SIGNATURE_BASE_Apt_Hellsing_Irene : FILE
 		$a6 = "aPLib v0.43 - the smaller the better"
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($a*)) and filesize <500000
+		uint16( 0 ) == 0x5a4d and ( 4 of ( $a* ) ) and filesize < 500000
 }
 rule SIGNATURE_BASE_Royalroad_Code_Pattern1 : FILE
 {
@@ -375161,9 +371434,9 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern1 : FILE
 		date = "2020-01-15"
 		modified = "2023-12-05"
 		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_royalroad.yar#L25-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ebd507d95c454562fa0b364072120b35b1bf8dd2be129a419d893f6708ab9cca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_royalroad.yar#L25-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ebd507d95c454562fa0b364072120b35b1bf8dd2be129a419d893f6708ab9cca"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -375184,9 +371457,9 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern2 : FILE
 		date = "2020-01-15"
 		modified = "2023-12-05"
 		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_royalroad.yar#L42-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e252868042e5150d99de2c2f4642f3d91d764d5a062f3a8de9ab316e299e00ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_royalroad.yar#L42-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e252868042e5150d99de2c2f4642f3d91d764d5a062f3a8de9ab316e299e00ac"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -375207,9 +371480,9 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern3 : FILE
 		date = "2020-01-15"
 		modified = "2023-12-05"
 		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_royalroad.yar#L59-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b5d9872eb86d1a220e5b70c560e7054bee8b2bc1fa2a75781d87616674e2927"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_royalroad.yar#L59-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b5d9872eb86d1a220e5b70c560e7054bee8b2bc1fa2a75781d87616674e2927"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -375230,9 +371503,9 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ab : FILE
 		date = "2020-01-15"
 		modified = "2023-12-05"
 		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_royalroad.yar#L77-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd9468b3208a27b6f3b56037013f06c4d2adbd201a12df141bc980ad595a75c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_royalroad.yar#L77-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd9468b3208a27b6f3b56037013f06c4d2adbd201a12df141bc980ad595a75c0"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -375253,9 +371526,9 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ce : FILE
 		date = "2020-01-15"
 		modified = "2023-12-05"
 		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_royalroad.yar#L94-L109"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7033c5874b406341a68f761b45fd6a9b73a9875c80b14d52a7c2240202c8fb40"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_royalroad.yar#L94-L109"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7033c5874b406341a68f761b45fd6a9b73a9875c80b14d52a7c2240202c8fb40"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -375276,9 +371549,9 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern4D : FILE
 		date = "2020-01-15"
 		modified = "2023-12-05"
 		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_royalroad.yar#L113-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9b531063d2a5ae36ae4e708a749dcf2cdc4c85fc43769a8525049e6facfca674"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_royalroad.yar#L113-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9b531063d2a5ae36ae4e708a749dcf2cdc4c85fc43769a8525049e6facfca674"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -375299,9 +371572,9 @@ rule SIGNATURE_BASE_Royalroad_RTF : FILE
 		date = "2020-01-15"
 		modified = "2023-12-05"
 		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_royalroad.yar#L133-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "20031fe6d6a0b2fad43f7e04bb82321c2ea75193f23194edead7ca530af8ac55"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_royalroad.yar#L133-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_20031fe6d6a0b2fad43f7e04bb82321c2ea75193f23194edead7ca530af8ac55"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -375322,9 +371595,9 @@ rule SIGNATURE_BASE_Royalroad_RTF_V7 : FILE
 		date = "2020-01-15"
 		modified = "2023-12-05"
 		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_royalroad.yar#L150-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "da043123cf72e19295634720196d78bef3af89f44cba795dbbcee4c0f5c8159a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_royalroad.yar#L150-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_da043123cf72e19295634720196d78bef3af89f44cba795dbbcee4c0f5c8159a"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -375335,7 +371608,7 @@ rule SIGNATURE_BASE_Royalroad_RTF_V7 : FILE
 		$RTF = "{\\rt"
 
 	condition:
-		$RTF at 0 and all of ($v7*)
+		$RTF at 0 and all of ( $v7* )
 }
 rule SIGNATURE_BASE_Royalroad_Encode_In_RTF : FILE
 {
@@ -375346,9 +371619,9 @@ rule SIGNATURE_BASE_Royalroad_Encode_In_RTF : FILE
 		date = "2020-01-15"
 		modified = "2023-12-05"
 		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_royalroad.yar#L168-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "00a703a0d7b3a74ec9bfc8ad0e570ee04b3cb6b7f2c062cc2886b41f6fbea49d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_royalroad.yar#L168-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_00a703a0d7b3a74ec9bfc8ad0e570ee04b3cb6b7f2c062cc2886b41f6fbea49d"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -375365,7 +371638,7 @@ rule SIGNATURE_BASE_Royalroad_Encode_In_RTF : FILE
 		$RTF = "{\\rt"
 
 	condition:
-		$RTF at 0 and 1 of ($enc_hex*)
+		$RTF at 0 and 1 of ( $enc_hex* )
 }
 rule SIGNATURE_BASE_WEBSHELL_ASP_Embedded_Mar21_1 : FILE
 {
@@ -375376,9 +371649,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Embedded_Mar21_1 : FILE
 		date = "2021-03-05"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4a8b4cea6f53dad9771cb694ec55f305f04dfdbd8e663154cad672ca414c138c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4a8b4cea6f53dad9771cb694ec55f305f04dfdbd8e663154cad672ca414c138c"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -375389,7 +371662,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Embedded_Mar21_1 : FILE
 		$s3 = ".Write(Request.Form["
 
 	condition:
-		filesize <100KB and all of them
+		filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Secchecker_Mar21_1 : FILE
 {
@@ -375400,9 +371673,9 @@ rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Secchecker_Mar21_1 : FILE
 		date = "2021-03-05"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/markus_neis/status/1367794681237667840"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L18-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e0e4df860bdde7d5c277f596535c493d926095be6f46f6ba41b6177afbfc5cd9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L18-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e0e4df860bdde7d5c277f596535c493d926095be6f46f6ba41b6177afbfc5cd9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375413,7 +371686,7 @@ rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Secchecker_Mar21_1 : FILE
 		$x2 = "\\csfalconservice.exe\")){Response.Write( \"3\");}%></head>" ascii fullword
 
 	condition:
-		uint16(0)==0x253c and filesize <1KB and 1 of them or 2 of them
+		uint16( 0 ) == 0x253c and filesize < 1KB and 1 of them or 2 of them
 }
 rule SIGNATURE_BASE_APT_HAFNIUM_Forensic_Artefacts_Mar21_1
 {
@@ -375424,9 +371697,9 @@ rule SIGNATURE_BASE_APT_HAFNIUM_Forensic_Artefacts_Mar21_1
 		date = "2021-03-02"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L35-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eb86595956092506c2e29373faaf39a3987f9feed36a53b191bedd498db05cbb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L35-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eb86595956092506c2e29373faaf39a3987f9feed36a53b191bedd498db05cbb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -375448,9 +371721,9 @@ rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Chopper_Webshell : APT HAFNIUM WEBSHELL
 		date = "2021-03-05"
 		modified = "2023-12-05"
 		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L50-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c185a8da2a18fa59a8eeb36dbd95ba12c9c61717efc5f2d19d2d5b27ee243f2b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L50-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c185a8da2a18fa59a8eeb36dbd95ba12c9c61717efc5f2d19d2d5b27ee243f2b"
 		score = 75
 		quality = 85
 		tags = "APT, HAFNIUM, WEBSHELL, FILE"
@@ -375462,7 +371735,7 @@ rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Chopper_Webshell : APT HAFNIUM WEBSHELL
 		$s3 = "<script language=\"JScript\" runat=\"server\"> function Page_Load(){eval (Request[\"" nocase
 
 	condition:
-		filesize <10KB and $x1 and 1 of ($s*)
+		filesize < 10KB and $x1 and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_APT_WEBSHELL_Tiny_Webshell : APT HAFNIUM WEBSHELL FILE
 {
@@ -375473,10 +371746,10 @@ rule SIGNATURE_BASE_APT_WEBSHELL_Tiny_Webshell : APT HAFNIUM WEBSHELL FILE
 		date = "2021-03-05"
 		modified = "2023-12-05"
 		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L67-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L67-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "099c8625c58b315b6c11f5baeb859f4c"
-		logic_hash = "9309f9b57353b6fe292048d00794699a8637a3e6e429c562fb36c7e459003a3b"
+		logic_hash = "v1_sha256_9309f9b57353b6fe292048d00794699a8637a3e6e429c562fb36c7e459003a3b"
 		score = 75
 		quality = 85
 		tags = "APT, HAFNIUM, WEBSHELL, FILE"
@@ -375487,7 +371760,7 @@ rule SIGNATURE_BASE_APT_WEBSHELL_Tiny_Webshell : APT HAFNIUM WEBSHELL FILE
 		$s2 = "eval("
 
 	condition:
-		filesize <300 and all of ($s*) and $x1
+		filesize < 300 and all of ( $s* ) and $x1
 }
 rule SIGNATURE_BASE_HKTL_PS1_Powercat_Mar21 : FILE
 {
@@ -375498,9 +371771,9 @@ rule SIGNATURE_BASE_HKTL_PS1_Powercat_Mar21 : FILE
 		date = "2021-03-02"
 		modified = "2023-12-05"
 		reference = "https://github.com/besimorhino/powercat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L84-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cbd5c6f7c5b4ed713482588ee4490a2326fe11cfaacfb3bfc6a6d94130a8bc83"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L84-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cbd5c6f7c5b4ed713482588ee4490a2326fe11cfaacfb3bfc6a6d94130a8bc83"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375514,7 +371787,7 @@ rule SIGNATURE_BASE_HKTL_PS1_Powercat_Mar21 : FILE
 		$s3 = "[alias(\"Execute\")][string]$e=\"\"," ascii
 
 	condition:
-		uint16(0)==0x7566 and filesize <200KB and 1 of ($x*) or 3 of them
+		uint16( 0 ) == 0x7566 and filesize < 200KB and 1 of ( $x* ) or 3 of them
 }
 rule SIGNATURE_BASE_HKTL_Nishang_PS1_Invoke_Powershelltcponeline
 {
@@ -375525,9 +371798,9 @@ rule SIGNATURE_BASE_HKTL_Nishang_PS1_Invoke_Powershelltcponeline
 		date = "2021-03-03"
 		modified = "2023-12-05"
 		reference = "https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L105-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "59622bff95de1077d26ee4547f37cd1045c0c1fc6817df40ff2564b33a962a07"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L105-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_59622bff95de1077d26ee4547f37cd1045c0c1fc6817df40ff2564b33a962a07"
 		score = 75
 		quality = 85
 		tags = ""
@@ -375550,10 +371823,10 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Sportsball
 		date = "2021-03-01"
 		modified = "2023-12-05"
 		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L159-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L159-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
-		logic_hash = "5ec5e52922e97a3080d397b69b2f42f09daa995271e218ea085fa2ec4e3abad2"
+		logic_hash = "v1_sha256_5ec5e52922e97a3080d397b69b2f42f09daa995271e218ea085fa2ec4e3abad2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -375569,7 +371842,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Sportsball
 		$var6 = "<input type=\"submit\" value=\"Upload\" />"
 
 	condition:
-		any of ($uniq*) or all of ($var*)
+		any of ( $uniq* ) or all of ( $var* )
 }
 rule SIGNATURE_BASE_WEBSHELL_CVE_2021_27065_Webshells : CVE_2021_27065 FILE
 {
@@ -375580,9 +371853,9 @@ rule SIGNATURE_BASE_WEBSHELL_CVE_2021_27065_Webshells : CVE_2021_27065 FILE
 		date = "2021-03-05"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L182-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "71795ba67bc8a4cea06b93da34b6291029ff74b200e37eb66f6ac51a6ff194cd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L182-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_71795ba67bc8a4cea06b93da34b6291029ff74b200e37eb66f6ac51a6ff194cd"
 		score = 75
 		quality = 61
 		tags = "CVE-2021-27065, FILE"
@@ -375598,7 +371871,7 @@ rule SIGNATURE_BASE_WEBSHELL_CVE_2021_27065_Webshells : CVE_2021_27065 FILE
 		$extendedprotectiontokenchecking = "extendedprotectiontokenchecking" ascii wide nocase
 
 	condition:
-		filesize <50KB and any of ($script*) and ($externalurl or $internalurl) and $internalauthenticationmethods and $extendedprotectiontokenchecking
+		filesize < 50KB and any of ( $script* ) and ( $externalurl or $internalurl ) and $internalauthenticationmethods and $extendedprotectiontokenchecking
 }
 rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 : FILE
 {
@@ -375609,9 +371882,9 @@ rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 : FILE
 		date = "2021-03-07"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L202-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "391b366d78c2f24dc006a5365ec232a9a3c2fe0ea514b18897701ceeffcc81ca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L202-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_391b366d78c2f24dc006a5365ec232a9a3c2fe0ea514b18897701ceeffcc81ca"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -375621,7 +371894,7 @@ rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 : FILE
 		$s2 = "Request.Files[0].SaveAs(Server.MapPath(" ascii wide
 
 	condition:
-		filesize <50KB and all of them
+		filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 : FILE
 {
@@ -375632,9 +371905,9 @@ rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 : FILE
 		date = "2021-03-07"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L218-L233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "933ab74a0e30e2a728444d491c9eb0ff134db05d905aeb48efe3ba65674a3730"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L218-L233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_933ab74a0e30e2a728444d491c9eb0ff134db05d905aeb48efe3ba65674a3730"
 		score = 85
 		quality = 79
 		tags = "FILE"
@@ -375645,7 +371918,7 @@ rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 : FILE
 		$s3 = "eval(System.Text.Encoding." ascii wide nocase
 
 	condition:
-		filesize <850 and all of them
+		filesize < 850 and all of them
 }
 rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_WER_Mar21_1 : CVE_2021_26857 FILE
 {
@@ -375656,9 +371929,9 @@ rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_WER_Mar21_1 : CVE_2021_26857 F
 		date = "2021-03-07"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cyb3rops/status/1368471533048446976"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L235-L250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2e135cb47f9fb5ca19ee1058fa6b4f39c098d2dfbab69bc19e80412ab695f126"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L235-L250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2e135cb47f9fb5ca19ee1058fa6b4f39c098d2dfbab69bc19e80412ab695f126"
 		score = 40
 		quality = 85
 		tags = "CVE-2021-26857, FILE"
@@ -375668,7 +371941,7 @@ rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_WER_Mar21_1 : CVE_2021_26857 F
 		$s7 = ".Value=w3wp#MSExchangeECPAppPool" wide
 
 	condition:
-		uint16(0)==0xfeff and filesize <8KB and all of them
+		uint16( 0 ) == 0xfeff and filesize < 8KB and all of them
 }
 rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_Cab_Recon_Mar21_1 : FILE
 {
@@ -375679,9 +371952,9 @@ rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_Cab_Recon_Mar21_1 : FILE
 		date = "2021-03-11"
 		modified = "2023-12-05"
 		reference = "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3?u=dstepanic"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L252-L273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "de3acb2d01ad14d73263af9e62ef7c715cde259e3f2fbbcbbb41d55589c3f0ab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L252-L273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_de3acb2d01ad14d73263af9e62ef7c715cde259e3f2fbbcbbb41d55589c3f0ab"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -375693,7 +371966,7 @@ rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_Cab_Recon_Mar21_1 : FILE
 		$s4 = "security" ascii fullword
 
 	condition:
-		uint32(0)==0x4643534d and filesize <10000KB and ($s1 in (0..200) and $s2 in (0..200) and $s3 in (0..200) and $s4 in (0..200))
+		uint32( 0 ) == 0x4643534d and filesize < 10000KB and ( $s1 in ( 0 .. 200 ) and $s2 in ( 0 .. 200 ) and $s3 in ( 0 .. 200 ) and $s4 in ( 0 .. 200 ) )
 }
 rule SIGNATURE_BASE_WEBSHELL_Compiled_Webshell_Mar2021_1 : FILE
 {
@@ -375704,9 +371977,9 @@ rule SIGNATURE_BASE_WEBSHELL_Compiled_Webshell_Mar2021_1 : FILE
 		date = "2021-03-05"
 		modified = "2021-03-12"
 		reference = "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L275-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d2e5f91f7bb50984c491eb9632d3863febc986760e4d03c8255872887ce4dc4a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L275-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d2e5f91f7bb50984c491eb9632d3863febc986760e4d03c8255872887ce4dc4a"
 		score = 75
 		quality = 81
 		tags = "FILE"
@@ -375723,7 +371996,7 @@ rule SIGNATURE_BASE_WEBSHELL_Compiled_Webshell_Mar2021_1 : FILE
 		$c5 = "get_Server" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize >5KB and filesize <40KB and all of ($x*) and 1 of ($a*) and ( all of ($b*) or all of ($c*))
+		uint16( 0 ) == 0x5a4d and filesize > 5KB and filesize < 40KB and all of ( $x* ) and 1 of ( $a* ) and ( all of ( $b* ) or all of ( $c* ) )
 }
 rule SIGNATURE_BASE_APT_MAL_ASP_DLL_HAFNIUM_Mar21_1 : FILE
 {
@@ -375734,9 +372007,9 @@ rule SIGNATURE_BASE_APT_MAL_ASP_DLL_HAFNIUM_Mar21_1 : FILE
 		date = "2021-03-05"
 		modified = "2023-12-05"
 		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L297-L325"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a4a3f9c7029e67647823a13079655b24648f5e4a7e238439b7a933b19477c20c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L297-L325"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a4a3f9c7029e67647823a13079655b24648f5e4a7e238439b7a933b19477c20c"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -375757,7 +372030,7 @@ rule SIGNATURE_BASE_APT_MAL_ASP_DLL_HAFNIUM_Mar21_1 : FILE
 		$op4 = { 5e 00 03 00 bc 22 00 00 00 00 01 00 85 03 2b 00 03 00 cc }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of ($s*) or all of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of ( $s* ) or all of ( $op* )
 }
 rule SIGNATURE_BASE_WEBSHELL_ASPX_Fileexplorer_Mar21_1 : FILE
 {
@@ -375768,9 +372041,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Fileexplorer_Mar21_1 : FILE
 		date = "2021-03-31"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L363-L397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7b4ffd222b38e76455fff2650b72bdcaff281323103f342b427013cd3fffdc21"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L363-L397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7b4ffd222b38e76455fff2650b72bdcaff281323103f342b427013cd3fffdc21"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -375798,7 +372071,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Fileexplorer_Mar21_1 : FILE
 		$s4 = "encodeURIComponent(btoa(String.fromCharCode.apply(null, new Uint8Array(bytes))));;"
 
 	condition:
-		uint16(0)==0x253c and filesize <100KB and (1 of ($x*) or 2 of them ) or 4 of them
+		uint16( 0 ) == 0x253c and filesize < 100KB and ( 1 of ( $x* ) or 2 of them ) or 4 of them
 }
 rule SIGNATURE_BASE_WEBSHELL_ASPX_Chopper_Like_Mar21_1 : FILE
 {
@@ -375809,9 +372082,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Chopper_Like_Mar21_1 : FILE
 		date = "2021-03-31"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hafnium.yar#L399-L416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "baa9eb1e3c4ac5ce49d27b1c3f75c8b6590567e25d98761a8b704478f2cee970"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hafnium.yar#L399-L416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_baa9eb1e3c4ac5ce49d27b1c3f75c8b6590567e25d98761a8b704478f2cee970"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -375824,7 +372097,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Chopper_Like_Mar21_1 : FILE
 		$s4 = "','orange','unsafe','" ascii
 
 	condition:
-		filesize <3KB and 1 of them or 2 of them
+		filesize < 3KB and 1 of them or 2 of them
 }
 rule SIGNATURE_BASE_Crime_Win64_Backdoor_Bazarbackdoor1 : FILE
 {
@@ -375835,9 +372108,9 @@ rule SIGNATURE_BASE_Crime_Win64_Backdoor_Bazarbackdoor1 : FILE
 		date = "2020-04-24"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/pancak3lullz/status/1252303608747565057"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_bazarbackdoor.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "becb6ebc3a1be061b4f602cc188b172f59bfb6342605af68d8b38009d589f57e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_bazarbackdoor.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_becb6ebc3a1be061b4f602cc188b172f59bfb6342605af68d8b38009d589f57e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375849,10 +372122,8 @@ rule SIGNATURE_BASE_Crime_Win64_Backdoor_Bazarbackdoor1 : FILE
 		$server = {40 53 48 83 ec 20 48 8b d9 e8 ?? ?? ?? ?? 85 c0 75 ?? 0f ?? ?? ?? ?? ?? ?? 66 83 f8 50 74 ?? b9 bb 01 00 00 66 3b c1 74 ?? a8 01 74 ?? 48 8b cb e8 ?? ?? ?? ?? 84 c0 75 ?? 48 8b cb e8 ?? ?? ?? ?? b8 f6 ff ff ff eb ?? 33 c0 48 83 c4 20 5b c3}
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT15_Malware_Mar18_Royalcli : FILE
 {
 	meta:
@@ -375862,9 +372133,9 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_Royalcli : FILE
 		date = "2018-03-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/HZ5XMN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L13-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "27fb5e8ff299201d1d13f4a45c401570f76ddfa4c3c1153eff50187170ada06e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L13-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_27fb5e8ff299201d1d13f4a45c401570f76ddfa4c3c1153eff50187170ada06e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375881,7 +372152,7 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_Royalcli : FILE
 		$s7 = "2 %s  %d 0 %d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
 }
 import "pe"
 
@@ -375894,9 +372165,9 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_Royaldns : FILE
 		date = "2018-03-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/HZ5XMN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L34-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d42f48d7d816c0b0ea05145e9dd43b1b2589f3131bf286e1b39c0efaf1c6fac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L34-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d42f48d7d816c0b0ea05145e9dd43b1b2589f3131bf286e1b39c0efaf1c6fac"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375914,10 +372185,8 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_Royaldns : FILE
 		$s6 = "runexe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ((pe.exports("RunInstallA") and pe.exports("RunUninstallA")) or 1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( ( pe.exports ( "RunInstallA" ) and pe.exports ( "RunUninstallA" ) ) or 1 of ( $x* ) or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT15_Malware_Mar18_BS2005 : FILE
 {
 	meta:
@@ -375927,9 +372196,9 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_BS2005 : FILE
 		date = "2018-03-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/HZ5XMN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L61-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "306903da4ecc9f5bf670d8c49039dee0ce5500c185acaef74786a2c109a4734b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L61-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_306903da4ecc9f5bf670d8c49039dee0ce5500c185acaef74786a2c109a4734b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375948,10 +372217,8 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_BS2005 : FILE
 		$s3 = "DisableFirstRunCustomize" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT15_Malware_Mar18_Msexchangetool : FILE
 {
 	meta:
@@ -375961,9 +372228,9 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_Msexchangetool : FILE
 		date = "2018-03-10"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/HZ5XMN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L89-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4e9e29bc69383ab6248241622394afddde6e18032ed6e2b64575362773f25a94"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L89-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4e9e29bc69383ab6248241622394afddde6e18032ed6e2b64575362773f25a94"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -375978,10 +372245,8 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_Msexchangetool : FILE
 		$s6 = "/v or /t is null" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Clean_Apt15_Patchedcmd : FILE
 {
 	meta:
@@ -375991,10 +372256,10 @@ rule SIGNATURE_BASE_Clean_Apt15_Patchedcmd : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L118-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L118-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f"
-		logic_hash = "08a68e14793d2f44ee75e49a43521c7d8bc1fc5ddd005e1fb71cc844966e16ba"
+		logic_hash = "v1_sha256_08a68e14793d2f44ee75e49a43521c7d8bc1fc5ddd005e1fb71cc844966e16ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376006,10 +372271,8 @@ rule SIGNATURE_BASE_Clean_Apt15_Patchedcmd : FILE
 		$ = "Windows Command Processor" wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Malware_Apt15_Royalcli_1 : FILE
 {
 	meta:
@@ -376019,10 +372282,10 @@ rule SIGNATURE_BASE_Malware_Apt15_Royalcli_1 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L133-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L133-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
-		logic_hash = "3cc0cd81db58e20fbf31fbd9fe65d113b7160e7d2b6739c01987d9e317099b9b"
+		logic_hash = "v1_sha256_3cc0cd81db58e20fbf31fbd9fe65d113b7160e7d2b6739c01987d9e317099b9b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376040,10 +372303,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Royalcli_1 : FILE
 		$ = "%s file not exist" fullword
 
 	condition:
-		uint16(0)==0x5A4D and 5 of them
+		uint16( 0 ) == 0x5A4D and 5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Malware_Apt15_Royalcli_2 : FILE
 {
 	meta:
@@ -376053,9 +372314,9 @@ rule SIGNATURE_BASE_Malware_Apt15_Royalcli_2 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L154-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c57ae92ba84355652cd56c8eaad3f277a8f514f8d078f053f3e8208b8bec535f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L154-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c57ae92ba84355652cd56c8eaad3f277a8f514f8d078f053f3e8208b8bec535f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376068,10 +372329,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Royalcli_2 : FILE
 		$string6 = "myWObject" fullword
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint16( 0 ) == 0x5A4D and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Malware_Apt15_Royaldll
 {
 	meta:
@@ -376081,10 +372340,10 @@ rule SIGNATURE_BASE_Malware_Apt15_Royaldll
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L196-L243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L196-L243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
-		logic_hash = "2ed0d38993a072da189f02233bd7cc0bf1be02e926f687db224f52de9b3a44fc"
+		logic_hash = "v1_sha256_2ed0d38993a072da189f02233bd7cc0bf1be02e926f687db224f52de9b3a44fc"
 		score = 75
 		quality = 85
 		tags = ""
@@ -376113,10 +372372,10 @@ rule SIGNATURE_BASE_Malware_Apt15_Royaldll_2 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L245-L261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L245-L261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
-		logic_hash = "94e2b61ff19b1377f461203cb22c607e718683691e54a3de3ed32bf6ed2897fa"
+		logic_hash = "v1_sha256_94e2b61ff19b1377f461203cb22c607e718683691e54a3de3ed32bf6ed2897fa"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376129,10 +372388,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Royaldll_2 : FILE
 		$ = "myWObject" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of them and pe.exports("ServiceMain") and filesize >50KB and filesize <600KB
+		uint16( 0 ) == 0x5A4D and all of them and pe.exports ( "ServiceMain" ) and filesize > 50KB and filesize < 600KB
 }
-import "pe"
-
 rule SIGNATURE_BASE_Malware_Apt15_Exchange_Tool : FILE
 {
 	meta:
@@ -376142,10 +372399,10 @@ rule SIGNATURE_BASE_Malware_Apt15_Exchange_Tool : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L263-L283"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L263-L283"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d21a7e349e796064ce10f2f6ede31c71"
-		logic_hash = "e7b5ac97f3dcf125e64001be53aca73ee19c1be8b192a762f231106c47f76867"
+		logic_hash = "v1_sha256_e7b5ac97f3dcf125e64001be53aca73ee19c1be8b192a762f231106c47f76867"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376164,10 +372421,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Exchange_Tool : FILE
 		$s24 = "2013sp1" wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Malware_Apt15_Generic
 {
 	meta:
@@ -376177,9 +372432,9 @@ rule SIGNATURE_BASE_Malware_Apt15_Generic
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt15.yar#L285-L307"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e939a5ab4a4b2b289d5809e18dd57dd85e3da19a176719adba4707dfd605fc81"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt15.yar#L285-L307"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e939a5ab4a4b2b289d5809e18dd57dd85e3da19a176719adba4707dfd605fc81"
 		score = 75
 		quality = 85
 		tags = ""
@@ -376201,9 +372456,9 @@ rule SIGNATURE_BASE_Shellcode_Apihashing_FIN8_1
 		date = "2021-03-16"
 		modified = "2023-12-05"
 		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fin8.yar#L1-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d47119a588aa69b3e241618d6dbb9df6117a6751bbff39a1f95340bc26611a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fin8.yar#L1-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d47119a588aa69b3e241618d6dbb9df6117a6751bbff39a1f95340bc26611a7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -376216,7 +372471,7 @@ rule SIGNATURE_BASE_Shellcode_Apihashing_FIN8_1
 		$APIHashing64bit2 = {48 B8 99 5D 52 69 30 D7 00 AB}
 
 	condition:
-		all of ($APIHashing32bit*) or all of ($APIHashing64bit*)
+		all of ( $APIHashing32bit* ) or all of ( $APIHashing64bit* )
 }
 rule SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1 : FILE
 {
@@ -376227,9 +372482,9 @@ rule SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1 : FILE
 		date = "2020-08-24"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sidewinder.yar#L4-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5ee7029143c589f26e6c325e163bfac85507c950f09778bd51ec2bdf4d4263fa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sidewinder.yar#L4-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5ee7029143c589f26e6c325e163bfac85507c950f09778bd51ec2bdf4d4263fa"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -376244,7 +372499,7 @@ rule SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1 : FILE
 		$s5 = "copytight @" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4KB and $a1 and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 4KB and $a1 and 3 of ( $s* )
 }
 rule SIGNATURE_BASE_APT_MAL_Sidewinder_Implant : FILE
 {
@@ -376255,9 +372510,9 @@ rule SIGNATURE_BASE_APT_MAL_Sidewinder_Implant : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sidewinder.yar#L24-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bfad86dbdc04463e7e4cc126fd05fc9107617a7ea1bd3f283c0e0170862bd59b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sidewinder.yar#L24-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bfad86dbdc04463e7e4cc126fd05fc9107617a7ea1bd3f283c0e0170862bd59b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376281,7 +372536,7 @@ rule SIGNATURE_BASE_APT_MAL_Sidewinder_Implant : FILE
       }
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_Cheshirecat_Sample2 : FILE
 {
@@ -376292,10 +372547,10 @@ rule SIGNATURE_BASE_Cheshirecat_Sample2 : FILE
 		date = "2015-08-08"
 		modified = "2023-12-05"
 		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cheshirecat.yar#L11-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cheshirecat.yar#L11-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
-		logic_hash = "4dd299cfe36545dba5ccac22d2eedc405f548fe5f976514d1cfa8238b472782c"
+		logic_hash = "v1_sha256_4dd299cfe36545dba5ccac22d2eedc405f548fe5f976514d1cfa8238b472782c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -376310,7 +372565,7 @@ rule SIGNATURE_BASE_Cheshirecat_Sample2 : FILE
 		$s6 = "<>Param : 0x%x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 4 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of ( $s* )
 }
 rule SIGNATURE_BASE_Cheshirecat_Gen1 : FILE
 {
@@ -376321,9 +372576,9 @@ rule SIGNATURE_BASE_Cheshirecat_Gen1 : FILE
 		date = "2015-08-08"
 		modified = "2023-12-05"
 		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cheshirecat.yar#L35-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d1bbda9340bc2d2fcefd6bf9a3c30fe0b99c66fb978b3a4583f17c521cfcf4b0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cheshirecat.yar#L35-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d1bbda9340bc2d2fcefd6bf9a3c30fe0b99c66fb978b3a4583f17c521cfcf4b0"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -376356,7 +372611,7 @@ rule SIGNATURE_BASE_Cheshirecat_Gen1 : FILE
 		$s7 = "+6Service Pack " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <350KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*) and 1 of ($x*)
+		uint16( 0 ) == 0x5a4d and filesize < 350KB and 7 of ( $s* ) and 2 of ( $a* ) and 1 of ( $b* ) and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_Cheshirecat_Gen2 : FILE
 {
@@ -376367,9 +372622,9 @@ rule SIGNATURE_BASE_Cheshirecat_Gen2 : FILE
 		date = "2015-08-08"
 		modified = "2023-12-05"
 		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cheshirecat.yar#L76-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c5d6ce6cc09c416d3449f7f5fc09139ce9271b69d743832b4b2548682e4ddf1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cheshirecat.yar#L76-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c5d6ce6cc09c416d3449f7f5fc09139ce9271b69d743832b4b2548682e4ddf1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -376396,7 +372651,7 @@ rule SIGNATURE_BASE_Cheshirecat_Gen2 : FILE
 		$s7 = "+6Service Pack " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 7 of ( $s* ) and 2 of ( $a* ) and 1 of ( $b* )
 }
 rule SIGNATURE_BASE_Backdoor_Redosdru_Jun17 : HIGHVOL FILE
 {
@@ -376407,9 +372662,9 @@ rule SIGNATURE_BASE_Backdoor_Redosdru_Jun17 : HIGHVOL FILE
 		date = "2017-06-04"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/OOB3mH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eternalblue_non_wannacry.yar#L12-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "99218c4decf98f02eb75c3c41a56f857a07779c68d30c4d16ca605052c4f9c3e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eternalblue_non_wannacry.yar#L12-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_99218c4decf98f02eb75c3c41a56f857a07779c68d30c4d16ca605052c4f9c3e"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -376430,7 +372685,7 @@ rule SIGNATURE_BASE_Backdoor_Redosdru_Jun17 : HIGHVOL FILE
 		$s8 = "%-24s %-15s 0x%x(%d) " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 1 of ($x*) or 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of ( $x* ) or 4 of them )
 }
 rule SIGNATURE_BASE_Backdoor_Nitol_Jun17 : FILE
 {
@@ -376441,9 +372696,9 @@ rule SIGNATURE_BASE_Backdoor_Nitol_Jun17 : FILE
 		date = "2017-06-04"
 		modified = "2023-01-07"
 		reference = "https://goo.gl/OOB3mH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eternalblue_non_wannacry.yar#L38-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9035b8bd74c284f170f8c9767d96580dba243786abaa3b2e79e05a981f8fa204"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eternalblue_non_wannacry.yar#L38-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9035b8bd74c284f170f8c9767d96580dba243786abaa3b2e79e05a981f8fa204"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376462,7 +372717,7 @@ rule SIGNATURE_BASE_Backdoor_Nitol_Jun17 : FILE
 		$s7 = "hackqz.f3322.org:8880" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 5 of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 5 of ( $s* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_MAL_DNSPIONAGE_Malware_Nov18 : FILE
 {
@@ -376473,9 +372728,9 @@ rule SIGNATURE_BASE_MAL_DNSPIONAGE_Malware_Nov18 : FILE
 		date = "2018-11-30"
 		modified = "2023-01-06"
 		reference = "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dnspionage.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c7f148b790c391283ac833236ad7fd3af7af517098adeaf88b8ee8d95df11487"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dnspionage.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c7f148b790c391283ac833236ad7fd3af7af517098adeaf88b8ee8d95df11487"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376490,7 +372745,7 @@ rule SIGNATURE_BASE_MAL_DNSPIONAGE_Malware_Nov18 : FILE
 		$s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_APT_Dnspionage_Karkoff_Malware_Apr19_1 : FILE
 {
@@ -376501,9 +372756,9 @@ rule SIGNATURE_BASE_APT_Dnspionage_Karkoff_Malware_Apr19_1 : FILE
 		date = "2019-04-24"
 		modified = "2023-12-05"
 		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_dnspionage.yar#L23-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1e8157cec7e70f7c95dffecd1c5a820f29825586a95f2a5c6e4db0a51b1d4708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_dnspionage.yar#L23-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1e8157cec7e70f7c95dffecd1c5a820f29825586a95f2a5c6e4db0a51b1d4708"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376522,7 +372777,7 @@ rule SIGNATURE_BASE_APT_Dnspionage_Karkoff_Malware_Apr19_1 : FILE
 		$s4 = "get_ProcessDictionaryKeys" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_SUSP_Office_Dropper_Strings : FILE
 {
@@ -376533,9 +372788,9 @@ rule SIGNATURE_BASE_SUSP_Office_Dropper_Strings : FILE
 		date = "2018-09-13"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_office_dropper.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3a66a86eb99a3e7cd02e3444714c6c88b423cd0ea1e6210bf91da01cf804105f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_office_dropper.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3a66a86eb99a3e7cd02e3444714c6c88b423cd0ea1e6210bf91da01cf804105f"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -376548,7 +372803,7 @@ rule SIGNATURE_BASE_SUSP_Office_Dropper_Strings : FILE
 		$s4 = "\"Enable Content\"" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <500KB and $a1 and 1 of ($s*)
+		uint16( 0 ) == 0xcfd0 and filesize < 500KB and $a1 and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_SUSP_Enablecontent_String_Gen : FILE
 {
@@ -376559,9 +372814,9 @@ rule SIGNATURE_BASE_SUSP_Enablecontent_String_Gen : FILE
 		date = "2019-02-12"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_office_dropper.yar#L19-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cde995ab0486fdafdc98e36c28a1f786ee7485387158f7337acd5f7dd0e3fed1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_office_dropper.yar#L19-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cde995ab0486fdafdc98e36c28a1f786ee7485387158f7337acd5f7dd0e3fed1"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -376574,7 +372829,7 @@ rule SIGNATURE_BASE_SUSP_Enablecontent_String_Gen : FILE
 		$e4 = "Enable content" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and ($e1 in (0..3000) or $e2 in (0..3000) or $e3 in (0..3000) or $e4 in (0..3000) or 2 of them )
+		uint16( 0 ) == 0xcfd0 and ( $e1 in ( 0 .. 3000 ) or $e2 in ( 0 .. 3000 ) or $e3 in ( 0 .. 3000 ) or $e4 in ( 0 .. 3000 ) or 2 of them )
 }
 rule SIGNATURE_BASE_SUSP_Worddoc_VBA_Macro_Strings : FILE
 {
@@ -376585,9 +372840,9 @@ rule SIGNATURE_BASE_SUSP_Worddoc_VBA_Macro_Strings : FILE
 		date = "2019-02-12"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_office_dropper.yar#L42-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "441e4a8e90d6045d0ad6a959ce56e834960c48083343add8e4f519f4b83bc82d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_office_dropper.yar#L42-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_441e4a8e90d6045d0ad6a959ce56e834960c48083343add8e4f519f4b83bc82d"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -376604,7 +372859,7 @@ rule SIGNATURE_BASE_SUSP_Worddoc_VBA_Macro_Strings : FILE
 		$s4 = "CreateObject" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <800KB and all of them
+		uint16( 0 ) == 0xcfd0 and filesize < 800KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_Officedoc_VBA_Base64Decode : FILE
 {
@@ -376615,9 +372870,9 @@ rule SIGNATURE_BASE_SUSP_Officedoc_VBA_Base64Decode : FILE
 		date = "2019-06-21"
 		modified = "2023-12-05"
 		reference = "https://github.com/cpaton/Scripting/blob/master/VBA/Base64.bas"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_office_dropper.yar#L65-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1fb094c9991f93e9d1003832dc11a58efa8281e9fe844e61e27dfd077f55ad39"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_office_dropper.yar#L65-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1fb094c9991f93e9d1003832dc11a58efa8281e9fe844e61e27dfd077f55ad39"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -376629,7 +372884,7 @@ rule SIGNATURE_BASE_SUSP_Officedoc_VBA_Base64Decode : FILE
 		$s3 = "Base64Encode" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <60KB and 2 of them
+		uint16( 0 ) == 0xcfd0 and filesize < 60KB and 2 of them
 }
 rule SIGNATURE_BASE_SUSP_VBA_Filesystem_Access : FILE
 {
@@ -376640,9 +372895,9 @@ rule SIGNATURE_BASE_SUSP_VBA_Filesystem_Access : FILE
 		date = "2019-06-21"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_office_dropper.yar#L82-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "13d7e0708968a7700308e6216ea5d0a396f9335137ae1e33c3b34a2f54012ec6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_office_dropper.yar#L82-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_13d7e0708968a7700308e6216ea5d0a396f9335137ae1e33c3b34a2f54012ec6"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -376656,7 +372911,7 @@ rule SIGNATURE_BASE_SUSP_VBA_Filesystem_Access : FILE
 		$a3 = "AutoOpen" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <100KB and all of ($s*) and 1 of ($a*)
+		uint16( 0 ) == 0xcfd0 and filesize < 100KB and all of ( $s* ) and 1 of ( $a* )
 }
 rule SIGNATURE_BASE_SUSP_Excel_IQY_Remoteuri_Syntax : FILE
 {
@@ -376667,9 +372922,9 @@ rule SIGNATURE_BASE_SUSP_Excel_IQY_Remoteuri_Syntax : FILE
 		date = "2018-08-17"
 		modified = "2023-11-25"
 		reference = "https://twitter.com/ItsReallyNick/status/1030330473954897920"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_office_dropper.yar#L102-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7033b0a4226dd289ecc670a0807e4159dd4486f52bc80a6b5ddd34d6961ab163"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_office_dropper.yar#L102-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7033b0a4226dd289ecc670a0807e4159dd4486f52bc80a6b5ddd34d6961ab163"
 		score = 55
 		quality = 85
 		tags = "FILE"
@@ -376679,7 +372934,7 @@ rule SIGNATURE_BASE_SUSP_Excel_IQY_Remoteuri_Syntax : FILE
 		$fp1 = "https://go.microsoft.com"
 
 	condition:
-		uint32(0)==0x0d424557 and uint32(4)==0x0a0d310a and filesize <1MB and $URL and not 1 of ($fp*)
+		uint32( 0 ) == 0x0d424557 and uint32( 4 ) == 0x0a0d310a and filesize < 1MB and $URL and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Macro_Sheet_Obfuscated_Char : FILE
 {
@@ -376690,9 +372945,9 @@ rule SIGNATURE_BASE_SUSP_Macro_Sheet_Obfuscated_Char : FILE
 		date = "2020-04-07"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/DissectMalware/status/1247595433305800706"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_office_dropper.yar#L122-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0953d1f916df570cb3d053bf4fdac196bdbd806df4b6c0a982ed9949a3676e6c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_office_dropper.yar#L122-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0953d1f916df570cb3d053bf4fdac196bdbd806df4b6c0a982ed9949a3676e6c"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -376706,7 +372961,7 @@ rule SIGNATURE_BASE_SUSP_Macro_Sheet_Obfuscated_Char : FILE
 		$char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}
 
 	condition:
-		$ole_marker at 0 and 1 of ($macro_sheet_h*) and #char_func>10 and $s1
+		$ole_marker at 0 and 1 of ( $macro_sheet_h* ) and #char_func > 10 and $s1
 }
 import "pe"
 
@@ -376719,9 +372974,9 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_1 : FILE
 		date = "2017-10-05"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_freemilk.yar#L13-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d66feceb01ecdd84345def58270a8788b563c99a7efadf9a3049c5fbbbd15da8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_freemilk.yar#L13-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d66feceb01ecdd84345def58270a8788b563c99a7efadf9a3049c5fbbbd15da8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376740,7 +372995,7 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_1 : FILE
 		$s4 = "\"%s\" help" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="108aa007b3d1b4817ff4c04d9b254b39" or 1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "108aa007b3d1b4817ff4c04d9b254b39" or 1 of ( $x* ) or 4 of them )
 }
 import "pe"
 
@@ -376753,9 +373008,9 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_2 : FILE
 		date = "2017-10-05"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_freemilk.yar#L41-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ad2cc04542e93add3e7856574d4de5aa371cc31542f87b1e90d30e12e0149341"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_freemilk.yar#L41-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ad2cc04542e93add3e7856574d4de5aa371cc31542f87b1e90d30e12e0149341"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376769,10 +373024,8 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_2 : FILE
 		$s4 = "win-%d.%d.%d-%d" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="b86f7d2c1c182ec4c074ae1e16b7a3f5" or all of them )
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "b86f7d2c1c182ec4c074ae1e16b7a3f5" or all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Freemilk_APT_Mal_3 : FILE
 {
 	meta:
@@ -376782,9 +373035,9 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_3 : FILE
 		date = "2017-10-05"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_freemilk.yar#L62-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "be68f624a2a374525857193d27f0645be5d10c198954dd90350448c3127e4bb5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_freemilk.yar#L62-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_be68f624a2a374525857193d27f0645be5d10c198954dd90350448c3127e4bb5"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -376798,7 +373051,7 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_3 : FILE
 		$s4 = "Unexpected failure opening HKCR key: %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them )
 }
 import "pe"
 
@@ -376811,9 +373064,9 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_4 : FILE
 		date = "2017-10-05"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_freemilk.yar#L80-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "deedb1da7e3421cd300fceea354a690e22005bab16eb0cc20b46f912393b637d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_freemilk.yar#L80-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_deedb1da7e3421cd300fceea354a690e22005bab16eb0cc20b46f912393b637d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376830,7 +373083,7 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_4 : FILE
 		$s6 = "command =outFile &\" sysupdate\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and ((pe.exports("getUpdate") and pe.number_of_exports==1) or 1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( ( pe.exports ( "getUpdate" ) and pe.number_of_exports == 1 ) or 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_KINS_Dropper
 {
@@ -376841,9 +373094,9 @@ rule SIGNATURE_BASE_KINS_Dropper
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/arPhm3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_kins_dropper.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cdab93f823e13e0c3104de8e05cb1572f83fb5294f359698092d73fc7983955b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_kins_dropper.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cdab93f823e13e0c3104de8e05cb1572f83fb5294f359698092d73fc7983955b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -376864,7 +373117,7 @@ rule SIGNATURE_BASE_KINS_Dropper
 		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
 
 	condition:
-		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
+		2 of ( $n* ) and 2 of ( $i* ) and 2 of ( $uac* )
 }
 rule SIGNATURE_BASE_KINS_DLL_Zeus
 {
@@ -376875,9 +373128,9 @@ rule SIGNATURE_BASE_KINS_DLL_Zeus
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/arPhm3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_kins_dropper.yar#L28-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bd1ebe7976d1f93856b4f8d1d62d8fff68ce6234204da9fbdc233ddbef56864d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_kins_dropper.yar#L28-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bd1ebe7976d1f93856b4f8d1d62d8fff68ce6234204da9fbdc233ddbef56864d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -376894,7 +373147,7 @@ rule SIGNATURE_BASE_KINS_DLL_Zeus
 		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
 
 	condition:
-		all of ($n*) and 1 of ($s*)
+		all of ( $n* ) and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_Crime_Win32_Parallax_Loader_1 : FILE
 {
@@ -376905,9 +373158,9 @@ rule SIGNATURE_BASE_Crime_Win32_Parallax_Loader_1 : FILE
 		date = "2020-02-24"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_parallax_rat.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1331e7b69fd9b14b5d2dae45b452b385e48018290d91de33a4f4a5ebcce4805b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_parallax_rat.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1331e7b69fd9b14b5d2dae45b452b385e48018290d91de33a4f4a5ebcce4805b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376918,7 +373171,7 @@ rule SIGNATURE_BASE_Crime_Win32_Parallax_Loader_1 : FILE
 		$decoder_call = { 55 8b ec 83 c4 f8 33 c0 89 ?? ?? 33 d2 89 ?? ?? 8b ?? ?? 3b ?? ?? 7d ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 33 ?? ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 ?? 33 d2 89 ?? ?? eb ?? ff ?? ?? ff ?? ?? 8b ?? ?? 3b ?? ?? 7c ?? 59 59 5d c3}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them
 }
 rule SIGNATURE_BASE_Crime_Win32_Parallax_Payload_1 : FILE
 {
@@ -376929,9 +373182,9 @@ rule SIGNATURE_BASE_Crime_Win32_Parallax_Payload_1 : FILE
 		date = "2020-02-24"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_parallax_rat.yar#L20-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3a1718d7caea5bd6741dd39fc16f955e1d3c73a282d51eda5b63c3352404529e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_parallax_rat.yar#L20-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3a1718d7caea5bd6741dd39fc16f955e1d3c73a282d51eda5b63c3352404529e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -376943,7 +373196,7 @@ rule SIGNATURE_BASE_Crime_Win32_Parallax_Payload_1 : FILE
 		$rand_png_call = { b8 25 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 78 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 2e 00 00 00 66 ?? ?? ?? ?? ?? ?? b8 70 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 67 00 00 00 66 ?? ?? ?? ?? ?? ?? 33 c0 66 ?? ?? ?? ?? ?? ?? 6a 64 6a 40 8b ?? ?? 8b ?? ?? ff d2 89 ?? ?? 8b ?? ?? 50 68 00 e1 f5 05 68 10 27 00 00 e8 ?? ?? ?? ??}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
 }
 rule SIGNATURE_BASE_Deeppanda_Sl_Txt_Packed
 {
@@ -376954,10 +373207,10 @@ rule SIGNATURE_BASE_Deeppanda_Sl_Txt_Packed
 		date = "2015-02-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_deeppanda.yar#L3-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_deeppanda.yar#L3-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
-		logic_hash = "37f875dcb2c920278c2625085c97a9dcce1907198409595a10e6a3fbce767f35"
+		logic_hash = "v1_sha256_37f875dcb2c920278c2625085c97a9dcce1907198409595a10e6a3fbce767f35"
 		score = 75
 		quality = 60
 		tags = ""
@@ -376985,10 +373238,10 @@ rule SIGNATURE_BASE_Deeppanda_Lot1
 		date = "2015-02-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_deeppanda.yar#L24-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_deeppanda.yar#L24-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
-		logic_hash = "92169a1288f30dc6008e1a8c9b2b700f878c90aa09634e36fea586e19657dbd1"
+		logic_hash = "v1_sha256_92169a1288f30dc6008e1a8c9b2b700f878c90aa09634e36fea586e19657dbd1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -377022,10 +373275,10 @@ rule SIGNATURE_BASE_Deeppanda_Htran_Exe
 		date = "2015-02-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_deeppanda.yar#L51-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_deeppanda.yar#L51-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
-		logic_hash = "9ac5ddc53d3d5292acb3dcf68e66bc3f6ab4b8e61a71597dd84454adc516f95d"
+		logic_hash = "v1_sha256_9ac5ddc53d3d5292acb3dcf68e66bc3f6ab4b8e61a71597dd84454adc516f95d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -377053,9 +373306,9 @@ rule SIGNATURE_BASE_Deeppanda_Trojan_Kakfum
 		date = "2015-02-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_deeppanda.yar#L72-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0710edea973dce6f5feccf2e7e508cd5f65aa451e0bb5aca503778ffe2363401"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_deeppanda.yar#L72-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0710edea973dce6f5feccf2e7e508cd5f65aa451e0bb5aca503778ffe2363401"
 		score = 75
 		quality = 60
 		tags = ""
@@ -377083,9 +373336,9 @@ rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Inital_Shellcode
 		date = "2022-04-21"
 		modified = "2023-12-05"
 		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_goldbackdoor.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4df97181037a580098dbe34d3b6ceab5c7b83932f1831c36ee99876a8f1524f9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_goldbackdoor.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4df97181037a580098dbe34d3b6ceab5c7b83932f1831c36ee99876a8f1524f9"
 		score = 80
 		quality = 85
 		tags = ""
@@ -377110,9 +373363,9 @@ rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Injected_Shellcode
 		date = "2022-04-21"
 		modified = "2023-12-05"
 		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_goldbackdoor.yar#L22-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b45f408c0f342591e66ef0dfcfc1c09f8558c5e8f4bd7f824b30f00d531c7511"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_goldbackdoor.yar#L22-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b45f408c0f342591e66ef0dfcfc1c09f8558c5e8f4bd7f824b30f00d531c7511"
 		score = 80
 		quality = 85
 		tags = ""
@@ -377140,9 +373393,9 @@ rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Generic_Shellcode
 		date = "2022-04-21"
 		modified = "2023-12-05"
 		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_goldbackdoor.yar#L44-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e046a70b1dee020ba73d960a9d91daaccd0b5c262965c8647f608c5c83a28257"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_goldbackdoor.yar#L44-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e046a70b1dee020ba73d960a9d91daaccd0b5c262965c8647f608c5c83a28257"
 		score = 75
 		quality = 85
 		tags = ""
@@ -377164,9 +373417,9 @@ rule SIGNATURE_BASE_Getuserspns_VBS
 		date = "2016-05-21"
 		modified = "2023-12-05"
 		reference = "https://github.com/skelsec/PyKerberoast"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_kerberoast.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ece81cd717fed6ca1f9053384911fd59462b6f3b01210ceeb037ba3da2f7a318"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_kerberoast.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ece81cd717fed6ca1f9053384911fd59462b6f3b01210ceeb037ba3da2f7a318"
 		score = 75
 		quality = 60
 		tags = ""
@@ -377190,9 +373443,9 @@ rule SIGNATURE_BASE_Getuserspns_PS1
 		date = "2016-05-21"
 		modified = "2023-12-05"
 		reference = "https://github.com/skelsec/PyKerberoast"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_kerberoast.yar#L25-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "204b009677a02bf8725f928c2bfff321b4543a883760e312a0c92f187684c8e9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_kerberoast.yar#L25-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_204b009677a02bf8725f928c2bfff321b4543a883760e312a0c92f187684c8e9"
 		score = 75
 		quality = 85
 		tags = ""
@@ -377217,9 +373470,9 @@ rule SIGNATURE_BASE_Kerberoast_PY
 		date = "2016-05-21"
 		modified = "2023-12-05"
 		reference = "https://github.com/skelsec/PyKerberoast"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_kerberoast.yar#L43-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b285cc55733bd4c499ffb4821a92675806bf66faf3b3565ffb6de867bed538d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_kerberoast.yar#L43-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b285cc55733bd4c499ffb4821a92675806bf66faf3b3565ffb6de867bed538d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -377244,9 +373497,9 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_1 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L11-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ad3018e6aa377b5032b04226ecb1e27b2cc7bc8294455ea51e426b5182ed7821"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L11-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ad3018e6aa377b5032b04226ecb1e27b2cc7bc8294455ea51e426b5182ed7821"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377257,7 +373510,7 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_1 : FILE
 		$s1 = "suprise.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_PP_CN_APT_Zerot_2 : FILE
 {
@@ -377268,9 +373521,9 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_2 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L26-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e31ade3690938fe0999423fbe446d9426e14abd01ebbada4eed8bddb1e2c9ea6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L26-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e31ade3690938fe0999423fbe446d9426e14abd01ebbada4eed8bddb1e2c9ea6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377281,7 +373534,7 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_2 : FILE
 		$s1 = "NO2-2016101902.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_PP_CN_APT_Zerot_3 : FILE
 {
@@ -377292,9 +373545,9 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_3 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L41-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6920febf177667610e3edb8ba88ec137d085a867c1d6a570d4785fcc9cc62d49"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L41-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6920febf177667610e3edb8ba88ec137d085a867c1d6a570d4785fcc9cc62d49"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377310,7 +373563,7 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_3 : FILE
 		$s6 = "/20160620.htm" fullword ascii
 
 	condition:
-		( uint16(0)==0x5449 and filesize <1000KB and 3 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5449 and filesize < 1000KB and 3 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_PP_CN_APT_Zerot_4 : FILE
 {
@@ -377321,9 +373574,9 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_4 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L61-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8011497e7d061a9ebde06667e47b5cd9469a433e0be1401d70637e7ace8e8155"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L61-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8011497e7d061a9ebde06667e47b5cd9469a433e0be1401d70637e7ace8e8155"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377335,7 +373588,7 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_4 : FILE
 		$s2 = "mcut.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_PP_CN_APT_Zerot_5 : FILE
 {
@@ -377346,9 +373599,9 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_5 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L77-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fbc1a2e078cfae7a9c72612b9c769e84d8c1d59c89e05001571ad00071e38577"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L77-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fbc1a2e078cfae7a9c72612b9c769e84d8c1d59c89e05001571ad00071e38577"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377363,7 +373616,7 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_5 : FILE
 		$s4 = "/1207.htm" fullword ascii
 
 	condition:
-		( uint16(0)==0x5449 and filesize <1000KB and 1 of ($x*) and 1 of ($s*)) or ( all of them )
+		( uint16( 0 ) == 0x5449 and filesize < 1000KB and 1 of ( $x* ) and 1 of ( $s* ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_PP_CN_APT_Zerot_6 : FILE
 {
@@ -377374,9 +373627,9 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_6 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L97-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2de78012cc384211cef6c12817fd8cef9d93eef6de3197d0cfec64c1a8022ae3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L97-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2de78012cc384211cef6c12817fd8cef9d93eef6de3197d0cfec64c1a8022ae3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377388,7 +373641,7 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_6 : FILE
 		$s2 = "\\sfxrar32\\Release\\sfxrar.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_PP_CN_APT_Zerot_7 : FILE
 {
@@ -377399,9 +373652,9 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_7 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L113-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "87ab6cd5c769e7e38bef807fa7d15af3a66fed8fdb7fed49fa62d87e1049ceb4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L113-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_87ab6cd5c769e7e38bef807fa7d15af3a66fed8fdb7fed49fa62d87e1049ceb4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377415,7 +373668,7 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_7 : FILE
 		$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_PP_CN_APT_Zerot_8 : FILE
 {
@@ -377426,9 +373679,9 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_8 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L131-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a1d5e72970919cd5c0493f8882cbc6fb1bb3c5b6517813a4022efd0028dfe728"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L131-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a1d5e72970919cd5c0493f8882cbc6fb1bb3c5b6517813a4022efd0028dfe728"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377442,7 +373695,7 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_8 : FILE
 		$s4 = "/20160620.htm" fullword ascii
 
 	condition:
-		( uint16(0)==0x5449 and filesize <1000KB and 3 of them )
+		( uint16( 0 ) == 0x5449 and filesize < 1000KB and 3 of them )
 }
 rule SIGNATURE_BASE_PP_CN_APT_Zerot_9 : FILE
 {
@@ -377453,9 +373706,9 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_9 : FILE
 		date = "2017-02-03"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L149-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "af4b85ef01c4fa21a2506369f3bc0f8eff6e95a4cfd494e1ea11a44d75bb024e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L149-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_af4b85ef01c4fa21a2506369f3bc0f8eff6e95a4cfd494e1ea11a44d75bb024e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377467,7 +373720,7 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_9 : FILE
 		$s7 = "Zlh.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_CN_APT_Zerot_Nflogger : FILE
 {
@@ -377478,9 +373731,9 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Nflogger : FILE
 		date = "2017-02-04"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L165-L178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dc9b19e3c4c321cb9f840ec9ff78bec9e4a075cc62ea2823d92a3fbd9f99cc07"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L165-L178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dc9b19e3c4c321cb9f840ec9ff78bec9e4a075cc62ea2823d92a3fbd9f99cc07"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377491,7 +373744,7 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Nflogger : FILE
 		$x1 = "\\LoaderDll.VS2010\\Release\\" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Go : FILE
 {
@@ -377502,9 +373755,9 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Go : FILE
 		date = "2017-02-04"
 		modified = "2023-01-06"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L180-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf5e2d825e4bd63e94455ffb4013fa1088098a826390c1916c0aa50866588fcb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L180-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf5e2d825e4bd63e94455ffb4013fa1088098a826390c1916c0aa50866588fcb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377523,7 +373776,7 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Go : FILE
 		$s7 = "/C %s\\%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 3 of ($s*))) or (7 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( 7 of them )
 }
 rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Mcutil : FILE
 {
@@ -377534,9 +373787,9 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Mcutil : FILE
 		date = "2017-02-04"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L205-L223"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "edb6000fd65d6593bd94842e60ec099c5a652d10005f81d17063dba1a2e267d2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L205-L223"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_edb6000fd65d6593bd94842e60ec099c5a652d10005f81d17063dba1a2e267d2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377552,7 +373805,7 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Mcutil : FILE
 		$s6 = "=licni] has maX0t" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and 3 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 90KB and 3 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Zlh : FILE
 {
@@ -377563,9 +373816,9 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Zlh : FILE
 		date = "2017-02-04"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_pp_zerot.yar#L225-L241"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "26796f75a8302bd6c93eb3ea43d0491b86770b52bd11aad6e1e250d968a77004"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_pp_zerot.yar#L225-L241"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_26796f75a8302bd6c93eb3ea43d0491b86770b52bd11aad6e1e250d968a77004"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377579,7 +373832,7 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Zlh : FILE
 		$s4 = "Executable: '%s' (%s) %i" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
 }
 rule SIGNATURE_BASE_MAL_Qakbotloader_Export_Section_Feb23 : FILE
 {
@@ -377590,10 +373843,10 @@ rule SIGNATURE_BASE_MAL_Qakbotloader_Export_Section_Feb23 : FILE
 		date = "2023-02-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_qbot_feb23.yar#L22-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_qbot_feb23.yar#L22-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a"
-		logic_hash = "0e40cd6acdbfb17670b414bd6f2ecdf1ae26ddd6a5d85931973b98963a43aba8"
+		logic_hash = "v1_sha256_0e40cd6acdbfb17670b414bd6f2ecdf1ae26ddd6a5d85931973b98963a43aba8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377604,7 +373857,7 @@ rule SIGNATURE_BASE_MAL_Qakbotloader_Export_Section_Feb23 : FILE
 		$wind = {(66 3B|3A) ?? 74 [1-14] BB 69 04 00 00 53 E8 [5-7] 74}
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16( 0 ) == 0x5A4D and all of them
 }
 rule SIGNATURE_BASE_Tools_Cmd : FILE
 {
@@ -377615,10 +373868,10 @@ rule SIGNATURE_BASE_Tools_Cmd : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L10-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L10-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "02e37b95ef670336dc95331ec73dbb5a86f3ba2b"
-		logic_hash = "fe1a157d53bd9a48848f2711844c5e12356652ca01c84c19429c55bbb12ea488"
+		logic_hash = "v1_sha256_fe1a157d53bd9a48848f2711844c5e12356652ca01c84c19429c55bbb12ea488"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377637,7 +373890,7 @@ rule SIGNATURE_BASE_Tools_Cmd : FILE
 		$s9 = "byte[] b = new byte[2048];" fullword ascii
 
 	condition:
-		filesize <3KB and 7 of them
+		filesize < 3KB and 7 of them
 }
 rule SIGNATURE_BASE_Trigger_Drop : FILE
 {
@@ -377648,10 +373901,10 @@ rule SIGNATURE_BASE_Trigger_Drop : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L35-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L35-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "165dd2d82bf87285c8a53ad1ede6d61a90837ba4"
-		logic_hash = "fc998ea5c2a446278823e4336ddc6a22741f82c43fbdcd95b3d12ee6a27b1dd7"
+		logic_hash = "v1_sha256_fc998ea5c2a446278823e4336ddc6a22741f82c43fbdcd95b3d12ee6a27b1dd7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377664,7 +373917,7 @@ rule SIGNATURE_BASE_Trigger_Drop : FILE
 		$s3 = "if(empty($_GET['returnto']))" fullword ascii
 
 	condition:
-		filesize <5KB and all of them
+		filesize < 5KB and all of them
 }
 rule SIGNATURE_BASE_Injectionparameters : FILE
 {
@@ -377675,10 +373928,10 @@ rule SIGNATURE_BASE_Injectionparameters : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L53-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L53-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4f11aa5b3660c45e527606ee33de001f4994e1ea"
-		logic_hash = "6bb786256f7154013408323eeb597f91c609a2a26f5ae9e6d61e16bd9c16a577"
+		logic_hash = "v1_sha256_6bb786256f7154013408323eeb597f91c609a2a26f5ae9e6d61e16bd9c16a577"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377689,7 +373942,7 @@ rule SIGNATURE_BASE_Injectionparameters : FILE
 		$s1 = "Public Class InjectionParameters" fullword ascii
 
 	condition:
-		filesize <13KB and all of them
+		filesize < 13KB and all of them
 }
 rule SIGNATURE_BASE_Users_List : FILE
 {
@@ -377700,10 +373953,10 @@ rule SIGNATURE_BASE_Users_List : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L69-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L69-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6fba1a1a607198ed232405ccbebf9543037a63ef"
-		logic_hash = "debd8e1d882cbbe6e720b86bec3ff3c78393cb225b3f0f9c7725cfced6582e71"
+		logic_hash = "v1_sha256_debd8e1d882cbbe6e720b86bec3ff3c78393cb225b3f0f9c7725cfced6582e71"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377715,7 +373968,7 @@ rule SIGNATURE_BASE_Users_List : FILE
 		$s11 = "&nbsp;<b>Default DB</b>&nbsp;" fullword ascii
 
 	condition:
-		filesize <12KB and all of them
+		filesize < 12KB and all of them
 }
 rule SIGNATURE_BASE_Trigger_Modify : FILE
 {
@@ -377726,10 +373979,10 @@ rule SIGNATURE_BASE_Trigger_Modify : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L86-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L86-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c93cd7a6c3f962381e9bf2b511db9b1639a22de0"
-		logic_hash = "6ea0221af9e9a29d3280a01eec69e31e79c358e664d286f8c80259f5e826876c"
+		logic_hash = "v1_sha256_6ea0221af9e9a29d3280a01eec69e31e79c358e664d286f8c80259f5e826876c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377743,7 +373996,7 @@ rule SIGNATURE_BASE_Trigger_Modify : FILE
 		$s5 = "<b>Modify Trigger</b>" fullword ascii
 
 	condition:
-		filesize <15KB and all of them
+		filesize < 15KB and all of them
 }
 rule SIGNATURE_BASE_Customize : FILE
 {
@@ -377754,10 +374007,10 @@ rule SIGNATURE_BASE_Customize : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L105-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L105-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "db556879dff9a0101a7a26260a5d0dc471242af2"
-		logic_hash = "f4e0a7342a01411ae060c9d995072518f2e3299af1b0d396bb319eeec42c1519"
+		logic_hash = "v1_sha256_f4e0a7342a01411ae060c9d995072518f2e3299af1b0d396bb319eeec42c1519"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377770,7 +374023,7 @@ rule SIGNATURE_BASE_Customize : FILE
 		$s4 = "R=\"Result\\t|\\t\\r\\nExecute Successfully!\\t|\\t\\r\\n\";}Conn.Close();break;" ascii
 
 	condition:
-		filesize <24KB and all of them
+		filesize < 24KB and all of them
 }
 rule SIGNATURE_BASE_Oracle_Data
 {
@@ -377781,10 +374034,10 @@ rule SIGNATURE_BASE_Oracle_Data
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L123-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L123-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6cf070017be117eace4752650ba6cf96d67d2106"
-		logic_hash = "1ab9b6c4349dd891103a24a77c93c2abb784d3ed616523f3aaec68b05082983e"
+		logic_hash = "v1_sha256_1ab9b6c4349dd891103a24a77c93c2abb784d3ed616523f3aaec68b05082983e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -377807,10 +374060,10 @@ rule SIGNATURE_BASE_Reduhservers_Reduh : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L140-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L140-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "377886490a86290de53d696864e41d6a547223b0"
-		logic_hash = "dcb1515da696566d01ec64029a34438a56d2df480b9cd2ea586f71ffe3324c1a"
+		logic_hash = "v1_sha256_dcb1515da696566d01ec64029a34438a56d2df480b9cd2ea586f71ffe3324c1a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377823,7 +374076,7 @@ rule SIGNATURE_BASE_Reduhservers_Reduh : FILE
 		$s5 = "outputFromSockets.add(\"[data]\"+target+\":\"+port+\":\"+sockNum+\":\"+new Strin" ascii
 
 	condition:
-		filesize <116KB and all of them
+		filesize < 116KB and all of them
 }
 rule SIGNATURE_BASE_Item_Old : FILE
 {
@@ -377834,10 +374087,10 @@ rule SIGNATURE_BASE_Item_Old : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L157-L172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L157-L172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "daae358bde97e534bc7f2b0134775b47ef57e1da"
-		logic_hash = "181e46408050490dccc4f321bd1072da0436d920e16cc4711b16425eb5bd73ed"
+		logic_hash = "v1_sha256_181e46408050490dccc4f321bd1072da0436d920e16cc4711b16425eb5bd73ed"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377849,7 +374102,7 @@ rule SIGNATURE_BASE_Item_Old : FILE
 		$s3 = "$sHash = md5($sURL);" fullword ascii
 
 	condition:
-		filesize <7KB and 2 of them
+		filesize < 7KB and 2 of them
 }
 rule SIGNATURE_BASE_Tools_2014 : FILE
 {
@@ -377860,10 +374113,10 @@ rule SIGNATURE_BASE_Tools_2014 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L174-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L174-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "74518faf08637c53095697071db09d34dbe8d676"
-		logic_hash = "caa365cc1a641b7dcd5d2082240d981e66caf6da1379ee109a0bb1f651d1f00f"
+		logic_hash = "v1_sha256_caa365cc1a641b7dcd5d2082240d981e66caf6da1379ee109a0bb1f651d1f00f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377875,7 +374128,7 @@ rule SIGNATURE_BASE_Tools_2014 : FILE
 		$s5 = ": \"c:\\\\windows\\\\system32\\\\cmd.exe\")" fullword ascii
 
 	condition:
-		filesize <715KB and all of them
+		filesize < 715KB and all of them
 }
 rule SIGNATURE_BASE_Reduhservers_Reduh_2 : FILE
 {
@@ -377886,10 +374139,10 @@ rule SIGNATURE_BASE_Reduhservers_Reduh_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L191-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L191-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "512d0a3e7bb7056338ad0167f485a8a6fa1532a3"
-		logic_hash = "954115da374b6d72c35244673799be6e8bae5288f53509dea04e3ae3c489af12"
+		logic_hash = "v1_sha256_954115da374b6d72c35244673799be6e8bae5288f53509dea04e3ae3c489af12"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377901,7 +374154,7 @@ rule SIGNATURE_BASE_Reduhservers_Reduh_2 : FILE
 		$s3 = "errorlog(\"BACKEND: *** Socket key is \".$sockkey);" fullword ascii
 
 	condition:
-		filesize <57KB and all of them
+		filesize < 57KB and all of them
 }
 rule SIGNATURE_BASE_Customize_2 : FILE
 {
@@ -377912,10 +374165,10 @@ rule SIGNATURE_BASE_Customize_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L208-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L208-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "37cd17543e14109d3785093e150652032a85d734"
-		logic_hash = "aa0940a21eea6ba50a93dd36a8f914f636fdba0685048fc67e16dd68c1c2794e"
+		logic_hash = "v1_sha256_aa0940a21eea6ba50a93dd36a8f914f636fdba0685048fc67e16dd68c1c2794e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377926,7 +374179,7 @@ rule SIGNATURE_BASE_Customize_2 : FILE
 		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii
 
 	condition:
-		filesize <30KB and all of them
+		filesize < 30KB and all of them
 }
 rule SIGNATURE_BASE_Chinachopper_One : FILE
 {
@@ -377937,10 +374190,10 @@ rule SIGNATURE_BASE_Chinachopper_One : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L224-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L224-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6cd28163be831a58223820e7abe43d5eacb14109"
-		logic_hash = "f9a6e4b8556eb3f1e1cbe0bc4eb225b9564ac59aae4a97f184806c6bec95578d"
+		logic_hash = "v1_sha256_f9a6e4b8556eb3f1e1cbe0bc4eb225b9564ac59aae4a97f184806c6bec95578d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377950,7 +374203,7 @@ rule SIGNATURE_BASE_Chinachopper_One : FILE
 		$s0 = "<%eval request(" ascii
 
 	condition:
-		filesize <50 and all of them
+		filesize < 50 and all of them
 }
 rule SIGNATURE_BASE_CN_Tools_Old : FILE
 {
@@ -377961,10 +374214,10 @@ rule SIGNATURE_BASE_CN_Tools_Old : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L239-L255"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L239-L255"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f8a007758fda8aa1c0af3c43f3d7e3186a9ff307"
-		logic_hash = "3f0ac357e9a9fb4ee937b53145b33ba1041310d979cbc3feb0a4caf026b9b730"
+		logic_hash = "v1_sha256_3f0ac357e9a9fb4ee937b53145b33ba1041310d979cbc3feb0a4caf026b9b730"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -377977,7 +374230,7 @@ rule SIGNATURE_BASE_CN_Tools_Old : FILE
 		$s3 = "$sCmd = \"echo 123> \".$sFileOut;" fullword ascii
 
 	condition:
-		filesize <6KB and all of them
+		filesize < 6KB and all of them
 }
 rule SIGNATURE_BASE_Item_301 : FILE
 {
@@ -377988,10 +374241,10 @@ rule SIGNATURE_BASE_Item_301 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L257-L273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L257-L273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "15636f0e7dc062437608c1f22b1d39fa15ab2136"
-		logic_hash = "623e235ff3eb0922fe8aee732144a15bcc0c580229654ae988353176f488b085"
+		logic_hash = "v1_sha256_623e235ff3eb0922fe8aee732144a15bcc0c580229654ae988353176f488b085"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378004,7 +374257,7 @@ rule SIGNATURE_BASE_Item_301 : FILE
 		$s4 = "$sURL = $aArg[0];" fullword ascii
 
 	condition:
-		filesize <3KB and 3 of them
+		filesize < 3KB and 3 of them
 }
 rule SIGNATURE_BASE_CN_Tools_Item : FILE
 {
@@ -378015,10 +374268,10 @@ rule SIGNATURE_BASE_CN_Tools_Item : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L275-L291"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L275-L291"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a584db17ad93f88e56fd14090fae388558be08e4"
-		logic_hash = "1e927fd093aa11ad525f3f64d657f314520669b4237eac8f87d0be53cd848044"
+		logic_hash = "v1_sha256_1e927fd093aa11ad525f3f64d657f314520669b4237eac8f87d0be53cd848044"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378031,7 +374284,7 @@ rule SIGNATURE_BASE_CN_Tools_Item : FILE
 		$s4 = "$aURL += array(\"scheme\" => \"\", \"host\" => \"\", \"path\" => \"\");" fullword ascii
 
 	condition:
-		filesize <4KB and all of them
+		filesize < 4KB and all of them
 }
 rule SIGNATURE_BASE_F3_Diy : FILE
 {
@@ -378042,10 +374295,10 @@ rule SIGNATURE_BASE_F3_Diy : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L293-L307"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L293-L307"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f39c2f64abe5e86d8d36dbb7b1921c7eab63bec9"
-		logic_hash = "37d6bc61d790ff30c98ded08ff875431fda525cd3ac10b4b1ba3f8f42167ed8c"
+		logic_hash = "v1_sha256_37d6bc61d790ff30c98ded08ff875431fda525cd3ac10b4b1ba3f8f42167ed8c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378056,7 +374309,7 @@ rule SIGNATURE_BASE_F3_Diy : FILE
 		$s5 = ".black {" fullword ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <10KB and all of them
+		uint16( 0 ) == 0x253c and filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_Chinachopper_Temp : FILE
 {
@@ -378067,10 +374320,10 @@ rule SIGNATURE_BASE_Chinachopper_Temp : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L309-L325"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L309-L325"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b0561ea52331c794977d69704345717b4eb0a2a7"
-		logic_hash = "3669dfa10867970456f6638035a87d448e2b728387fbd07b59ffd981a1ab6200"
+		logic_hash = "v1_sha256_3669dfa10867970456f6638035a87d448e2b728387fbd07b59ffd981a1ab6200"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378083,7 +374336,7 @@ rule SIGNATURE_BASE_Chinachopper_Temp : FILE
 		$s3 = "o.addcode(Request(\"SC\"))" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_Tools_2015 : FILE
 {
@@ -378094,10 +374347,10 @@ rule SIGNATURE_BASE_Tools_2015 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L327-L344"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L327-L344"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8fc67359567b78cadf5d5c91a623de1c1d2ab689"
-		logic_hash = "2b93ef42c277fd8415cf89bf1bef3e841c56a2b4aa1507d99b84cd8adc9a0644"
+		logic_hash = "v1_sha256_2b93ef42c277fd8415cf89bf1bef3e841c56a2b4aa1507d99b84cd8adc9a0644"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378111,7 +374364,7 @@ rule SIGNATURE_BASE_Tools_2015 : FILE
 		$s19 = "Configbos = new BufferedOutputStream(new FileOutputStream(Outf));;" fullword ascii
 
 	condition:
-		filesize <7KB and all of them
+		filesize < 7KB and all of them
 }
 rule SIGNATURE_BASE_Chinachopper_Temp_2 : FILE
 {
@@ -378122,10 +374375,10 @@ rule SIGNATURE_BASE_Chinachopper_Temp_2 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L346-L359"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L346-L359"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "604a4c07161ce1cd54aed5566e5720161b59deee"
-		logic_hash = "1b6d840797afcdbf7c72836557dbd486780c760471e79133810346c301cca80b"
+		logic_hash = "v1_sha256_1b6d840797afcdbf7c72836557dbd486780c760471e79133810346c301cca80b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378135,7 +374388,7 @@ rule SIGNATURE_BASE_Chinachopper_Temp_2 : FILE
 		$s0 = "@eval($_POST[strtoupper(md5(gmdate(" ascii
 
 	condition:
-		filesize <150 and all of them
+		filesize < 150 and all of them
 }
 rule SIGNATURE_BASE_Templatr : FILE
 {
@@ -378146,10 +374399,10 @@ rule SIGNATURE_BASE_Templatr : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L361-L374"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L361-L374"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "759df470103d36a12c7d8cf4883b0c58fe98156b"
-		logic_hash = "80d207ee47c0c602ddd281e0e187b83cdb4f1385f4b46ad2a4f5630b8f9e96a1"
+		logic_hash = "v1_sha256_80d207ee47c0c602ddd281e0e187b83cdb4f1385f4b46ad2a4f5630b8f9e96a1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378159,7 +374412,7 @@ rule SIGNATURE_BASE_Templatr : FILE
 		$s0 = "eval(gzinflate(base64_decode('" ascii
 
 	condition:
-		filesize <70KB and all of them
+		filesize < 70KB and all of them
 }
 rule SIGNATURE_BASE_Reduhservers_Reduh_3 : FILE
 {
@@ -378170,10 +374423,10 @@ rule SIGNATURE_BASE_Reduhservers_Reduh_3 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L376-L392"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L376-L392"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0744f64c24bf4c0bef54651f7c88a63e452b3b2d"
-		logic_hash = "5a3bc023e0e8a5ccc8ee8e1b5e7ee0fca64e3f92b72d0aad15b25c82a23da487"
+		logic_hash = "v1_sha256_5a3bc023e0e8a5ccc8ee8e1b5e7ee0fca64e3f92b72d0aad15b25c82a23da487"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378186,7 +374439,7 @@ rule SIGNATURE_BASE_Reduhservers_Reduh_3 : FILE
 		$s4 = "Response.Write(\"Error: Bad port or host or socketnumber for creating new socket" ascii
 
 	condition:
-		filesize <40KB and all of them
+		filesize < 40KB and all of them
 }
 rule SIGNATURE_BASE_Chinachopper_Temp_3 : FILE
 {
@@ -378197,10 +374450,10 @@ rule SIGNATURE_BASE_Chinachopper_Temp_3 : FILE
 		date = "2015-06-13"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L394-L408"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L394-L408"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
-		logic_hash = "6a0d7817607362f325957e30cace24d32635b7e0411e161588ee573118f91b6a"
+		logic_hash = "v1_sha256_6a0d7817607362f325957e30cace24d32635b7e0411e161588ee573118f91b6a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378211,7 +374464,7 @@ rule SIGNATURE_BASE_Chinachopper_Temp_3 : FILE
 		$s1 = "\"],\"unsafe\");%>" ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <150 and all of them
+		uint16( 0 ) == 0x253c and filesize < 150 and all of them
 }
 rule SIGNATURE_BASE_Shell_Asp : FILE
 {
@@ -378222,10 +374475,10 @@ rule SIGNATURE_BASE_Shell_Asp : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L410-L425"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L410-L425"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5e0bc914ac287aa1418f6554ddbe0ce25f2b5f20"
-		logic_hash = "47c5c242713446471d5da4d9245b99561c26ad7fa016059076a6f0acab542c3c"
+		logic_hash = "v1_sha256_47c5c242713446471d5da4d9245b99561c26ad7fa016059076a6f0acab542c3c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378237,7 +374490,7 @@ rule SIGNATURE_BASE_Shell_Asp : FILE
 		$s3 = "function Command(cmd, str){" fullword ascii
 
 	condition:
-		filesize <100KB and all of them
+		filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Txt_Aspxtag : FILE
 {
@@ -378248,10 +374501,10 @@ rule SIGNATURE_BASE_Txt_Aspxtag : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L428-L443"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L428-L443"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "42cb272c02dbd49856816d903833d423d3759948"
-		logic_hash = "6ffeee18945cab96673e4b9efc143017d168be12b794fa26aa4a304f15ae8e13"
+		logic_hash = "v1_sha256_6ffeee18945cab96673e4b9efc143017d168be12b794fa26aa4a304f15ae8e13"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378263,7 +374516,7 @@ rule SIGNATURE_BASE_Txt_Aspxtag : FILE
 		$s3 = "Response.Write(\"Hi,Man 2015\"); " fullword ascii
 
 	condition:
-		filesize <2KB and all of them
+		filesize < 2KB and all of them
 }
 rule SIGNATURE_BASE_Txt_Php : FILE
 {
@@ -378274,10 +374527,10 @@ rule SIGNATURE_BASE_Txt_Php : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L445-L461"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L445-L461"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "eaa1af4b898f44fc954b485d33ce1d92790858d0"
-		logic_hash = "ace26e7c0dca285febf6b9192cbe59cc7e55e80f2f4e1a99aba25afcbeadeec1"
+		logic_hash = "v1_sha256_ace26e7c0dca285febf6b9192cbe59cc7e55e80f2f4e1a99aba25afcbeadeec1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378290,7 +374543,7 @@ rule SIGNATURE_BASE_Txt_Php : FILE
 		$s4 = "if(empty($_SESSION['api']))" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_Txt_Aspx1 : FILE
 {
@@ -378301,10 +374554,10 @@ rule SIGNATURE_BASE_Txt_Aspx1 : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L463-L477"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L463-L477"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
-		logic_hash = "20bdadd6c8b61ab14f6280f55a90f541bf65c33675f979ebe489cc3967438e15"
+		logic_hash = "v1_sha256_20bdadd6c8b61ab14f6280f55a90f541bf65c33675f979ebe489cc3967438e15"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378315,7 +374568,7 @@ rule SIGNATURE_BASE_Txt_Aspx1 : FILE
 		$s1 = "],\"unsafe\");%>" fullword ascii
 
 	condition:
-		filesize <150 and all of them
+		filesize < 150 and all of them
 }
 rule SIGNATURE_BASE_Txt_Shell : FILE
 {
@@ -378326,10 +374579,10 @@ rule SIGNATURE_BASE_Txt_Shell : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L479-L496"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L479-L496"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8342b634636ef8b3235db0600a63cc0ce1c06b62"
-		logic_hash = "020e9e6ef776a9d69939fa3dec771dc516b0184086738bab439063acca89bd76"
+		logic_hash = "v1_sha256_020e9e6ef776a9d69939fa3dec771dc516b0184086738bab439063acca89bd76"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378343,7 +374596,7 @@ rule SIGNATURE_BASE_Txt_Shell : FILE
 		$s5 = "connect back door\\n\\n\");" fullword ascii
 
 	condition:
-		filesize <2KB and 2 of them
+		filesize < 2KB and 2 of them
 }
 rule SIGNATURE_BASE_Txt_Asp : FILE
 {
@@ -378354,10 +374607,10 @@ rule SIGNATURE_BASE_Txt_Asp : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L498-L512"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L498-L512"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a63549f749f4d9d0861825764e042e299e06a705"
-		logic_hash = "9eab239310fbebe8c88cbf8d0ee4123b8f3e2ebe601949e1e984e9cfde9869e7"
+		logic_hash = "v1_sha256_9eab239310fbebe8c88cbf8d0ee4123b8f3e2ebe601949e1e984e9cfde9869e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378368,7 +374621,7 @@ rule SIGNATURE_BASE_Txt_Asp : FILE
 		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <100KB and all of them
+		uint16( 0 ) == 0x253c and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Txt_Asp1 : FILE
 {
@@ -378379,10 +374632,10 @@ rule SIGNATURE_BASE_Txt_Asp1 : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L514-L530"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L514-L530"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "95934d05f0884e09911ea9905c74690ace1ef653"
-		logic_hash = "77a4409b852d24228b0e1701f1ccc2abe3930c2c7240a43796b23042e706d9bf"
+		logic_hash = "v1_sha256_77a4409b852d24228b0e1701f1ccc2abe3930c2c7240a43796b23042e706d9bf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378395,7 +374648,7 @@ rule SIGNATURE_BASE_Txt_Asp1 : FILE
 		$s4 = "szTempFile = server.mappath(\"cmd.txt\")" fullword ascii
 
 	condition:
-		filesize <70KB and 2 of them
+		filesize < 70KB and 2 of them
 }
 rule SIGNATURE_BASE_Txt_Php_2 : FILE
 {
@@ -378406,10 +374659,10 @@ rule SIGNATURE_BASE_Txt_Php_2 : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L532-L552"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L532-L552"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a7d5fcbd39071e0915c4ad914d31e00c7127bcfc"
-		logic_hash = "c08f62c3d468c2ebacd10fff6aa0c63bd303d627d487c070a9d22419bf6906cd"
+		logic_hash = "v1_sha256_c08f62c3d468c2ebacd10fff6aa0c63bd303d627d487c070a9d22419bf6906cd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378426,7 +374679,7 @@ rule SIGNATURE_BASE_Txt_Php_2 : FILE
 		$s8 = "p('<p><a href=\"http://w'.'ww.4'.'ng'.'el.net/php'.'sp'.'y/pl'.'ugin/\" target=" ascii
 
 	condition:
-		filesize <100KB and 4 of them
+		filesize < 100KB and 4 of them
 }
 rule SIGNATURE_BASE_Txt_Ftp : FILE
 {
@@ -378437,10 +374690,10 @@ rule SIGNATURE_BASE_Txt_Ftp : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L554-L573"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L554-L573"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3495e6bcb5484e678ce4bae0bd1a420b7eb6ad1d"
-		logic_hash = "02eae9b19274ab7b816d7c336017af8f0fdd5273664eb37be92be12661f3ef1f"
+		logic_hash = "v1_sha256_02eae9b19274ab7b816d7c336017af8f0fdd5273664eb37be92be12661f3ef1f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378456,7 +374709,7 @@ rule SIGNATURE_BASE_Txt_Ftp : FILE
 		$s7 = "echo bye>>d:\\ftp.txt " fullword ascii
 
 	condition:
-		filesize <2KB and 2 of them
+		filesize < 2KB and 2 of them
 }
 rule SIGNATURE_BASE_Txt_Lcx : FILE
 {
@@ -378467,10 +374720,10 @@ rule SIGNATURE_BASE_Txt_Lcx : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L575-L592"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L575-L592"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ddb3b6a5c5c22692de539ccb796ede214862befe"
-		logic_hash = "48121824d3173b77b54b52dc60d3422a904ada46a6ebb20bb585086911cd8360"
+		logic_hash = "v1_sha256_48121824d3173b77b54b52dc60d3422a904ada46a6ebb20bb585086911cd8360"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378484,7 +374737,7 @@ rule SIGNATURE_BASE_Txt_Lcx : FILE
 		$s5 = "printf(\"[-] connect to host1 failed\\r\\n\");" fullword ascii
 
 	condition:
-		filesize <25KB and 2 of them
+		filesize < 25KB and 2 of them
 }
 rule SIGNATURE_BASE_Txt_Jspcmd : FILE
 {
@@ -378495,10 +374748,10 @@ rule SIGNATURE_BASE_Txt_Jspcmd : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L594-L608"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L594-L608"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1d4e789031b15adde89a4628afc759859e53e353"
-		logic_hash = "d2cbf753fbd9e261234e6beb6f79aecb407a368704ae09d907d128d04c242053"
+		logic_hash = "v1_sha256_d2cbf753fbd9e261234e6beb6f79aecb407a368704ae09d907d128d04c242053"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378509,7 +374762,7 @@ rule SIGNATURE_BASE_Txt_Jspcmd : FILE
 		$s4 = "out.print(\"Hi,Man 2015\");" fullword ascii
 
 	condition:
-		filesize <1KB and 1 of them
+		filesize < 1KB and 1 of them
 }
 rule SIGNATURE_BASE_Txt_Jsp : FILE
 {
@@ -378520,10 +374773,10 @@ rule SIGNATURE_BASE_Txt_Jsp : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L610-L626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L610-L626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "74518faf08637c53095697071db09d34dbe8d676"
-		logic_hash = "039b145031cf1127cb1b2aeda063d578d9eb151559232d7e6049965111df1e28"
+		logic_hash = "v1_sha256_039b145031cf1127cb1b2aeda063d578d9eb151559232d7e6049965111df1e28"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378536,7 +374789,7 @@ rule SIGNATURE_BASE_Txt_Jsp : FILE
 		$s4 = "cmd = \"cmd.exe /c set\";" fullword ascii
 
 	condition:
-		filesize <715KB and 2 of them
+		filesize < 715KB and 2 of them
 }
 rule SIGNATURE_BASE_Txt_Aspxlcx : FILE
 {
@@ -378547,10 +374800,10 @@ rule SIGNATURE_BASE_Txt_Aspxlcx : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L628-L644"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L628-L644"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "453dd3160db17d0d762e032818a5a10baf234e03"
-		logic_hash = "a6e41e6882e74b0dd55ec4afbf6f8708e28267657e304c97d1304266fe1fbc93"
+		logic_hash = "v1_sha256_a6e41e6882e74b0dd55ec4afbf6f8708e28267657e304c97d1304266fe1fbc93"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378563,7 +374816,7 @@ rule SIGNATURE_BASE_Txt_Aspxlcx : FILE
 		$s4 = "public class PortForward" ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <18KB and all of them
+		uint16( 0 ) == 0x253c and filesize < 18KB and all of them
 }
 rule SIGNATURE_BASE_Txt_Xiao : FILE
 {
@@ -378574,10 +374827,10 @@ rule SIGNATURE_BASE_Txt_Xiao : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L646-L663"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L646-L663"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b3b98fb57f5f5ccdc42e746e32950834807903b7"
-		logic_hash = "e99c307482148e4d0eb660281fa70f2dcece200ac8aed032bbef41e421d2a155"
+		logic_hash = "v1_sha256_e99c307482148e4d0eb660281fa70f2dcece200ac8aed032bbef41e421d2a155"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378591,7 +374844,7 @@ rule SIGNATURE_BASE_Txt_Xiao : FILE
 		$s5 = "echo \"if(obj.value=='PageWebProxy')obj.form.target='_blank';\"" fullword ascii
 
 	condition:
-		filesize <100KB and all of them
+		filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Txt_Aspx : FILE
 {
@@ -378602,10 +374855,10 @@ rule SIGNATURE_BASE_Txt_Aspx : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L665-L681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L665-L681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ce24e277746c317d887139a0d71dd250bfb0ed58"
-		logic_hash = "43c386bfa88db77801b0494d6a5e4406688f957ffedeb4d2ecdd244549dec708"
+		logic_hash = "v1_sha256_43c386bfa88db77801b0494d6a5e4406688f957ffedeb4d2ecdd244549dec708"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378618,7 +374871,7 @@ rule SIGNATURE_BASE_Txt_Aspx : FILE
 		$s4 = "<td colspan=\"5\">CmdShell&nbsp;&nbsp;:&nbsp;<input class=\"input\" runat=\"serv" ascii
 
 	condition:
-		filesize <100KB and all of them
+		filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Txt_Sql : FILE
 {
@@ -378629,10 +374882,10 @@ rule SIGNATURE_BASE_Txt_Sql : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L683-L699"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L683-L699"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f7813f1dfa4eec9a90886c80b88aa38e2adc25d5"
-		logic_hash = "0712b6736d8bdc1f19b3494dc3aab9e9a04dde167b5f843e319755cd311e29bd"
+		logic_hash = "v1_sha256_0712b6736d8bdc1f19b3494dc3aab9e9a04dde167b5f843e319755cd311e29bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378645,7 +374898,7 @@ rule SIGNATURE_BASE_Txt_Sql : FILE
 		$s4 = "session(\"login\")=\"\"" fullword ascii
 
 	condition:
-		filesize <15KB and all of them
+		filesize < 15KB and all of them
 }
 rule SIGNATURE_BASE_Txt_Hello : FILE
 {
@@ -378656,10 +374909,10 @@ rule SIGNATURE_BASE_Txt_Hello : FILE
 		date = "2015-06-14"
 		modified = "2023-12-05"
 		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cn_webshells.yar#L701-L717"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cn_webshells.yar#L701-L717"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "697a9ebcea6a22a16ce1a51437fcb4e1a1d7f079"
-		logic_hash = "823a0a74b07c8f4821247b3cf0450069a9888d44ccd87144330da88594f260c0"
+		logic_hash = "v1_sha256_823a0a74b07c8f4821247b3cf0450069a9888d44ccd87144330da88594f260c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -378672,7 +374925,7 @@ rule SIGNATURE_BASE_Txt_Hello : FILE
 		$s3 = "<p align=\"center\"><a href=\"?action=cmd\" target=\"_blank\">" fullword ascii
 
 	condition:
-		filesize <25KB and all of them
+		filesize < 25KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_MAC_IPMAC : FILE
 {
@@ -378683,10 +374936,10 @@ rule SIGNATURE_BASE_CN_Honker_MAC_IPMAC : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "24d55b6bec5c9fff4cd6f345bacac7abadce1611"
-		logic_hash = "395dfb840346bbf3f68fa198e76349cf65c703b28fd168b85d846d07df1845fe"
+		logic_hash = "v1_sha256_395dfb840346bbf3f68fa198e76349cf65c703b28fd168b85d846d07df1845fe"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378698,7 +374951,7 @@ rule SIGNATURE_BASE_CN_Honker_MAC_IPMAC : FILE
 		$s3 = "192.168.0.1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <267KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 267KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Getsyskey : FILE
 {
@@ -378709,10 +374962,10 @@ rule SIGNATURE_BASE_CN_Honker_Getsyskey : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L28-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L28-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "17cec5e75cda434d0a1bc8cdd5aa268b42633fe9"
-		logic_hash = "1f12ea9d62d4aaf695328fb335445f3dae3996595402586d2ee52098e6727d10"
+		logic_hash = "v1_sha256_1f12ea9d62d4aaf695328fb335445f3dae3996595402586d2ee52098e6727d10"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378723,7 +374976,7 @@ rule SIGNATURE_BASE_CN_Honker_Getsyskey : FILE
 		$s4 = "The system key file \"%s\" is created." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Churrasco : FILE
 {
@@ -378734,10 +374987,10 @@ rule SIGNATURE_BASE_CN_Honker_Churrasco : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L45-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L45-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5a3c935d82a5ff0546eff51bb2ef21c88198f5b8"
-		logic_hash = "f60589bda76367578388cbe6af912c80c9364a7047ed52ca2b4156a1b277e7ca"
+		logic_hash = "v1_sha256_f60589bda76367578388cbe6af912c80c9364a7047ed52ca2b4156a1b277e7ca"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378752,7 +375005,7 @@ rule SIGNATURE_BASE_CN_Honker_Churrasco : FILE
 		$s18 = "OLEAUT" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1276KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1276KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Mysql_Injectv1_1_Creak : FILE
 {
@@ -378763,10 +375016,10 @@ rule SIGNATURE_BASE_CN_Honker_Mysql_Injectv1_1_Creak : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L66-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L66-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a1f066789f48a76023598c5777752c15f91b76b0"
-		logic_hash = "f61557216a7e90ff9655ad8aea4a9adf0e4435c7a3f7958423e46fd2265bad07"
+		logic_hash = "v1_sha256_f61557216a7e90ff9655ad8aea4a9adf0e4435c7a3f7958423e46fd2265bad07"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378777,7 +375030,7 @@ rule SIGNATURE_BASE_CN_Honker_Mysql_Injectv1_1_Creak : FILE
 		$s12 = "OnGetPassword" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5890KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5890KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_ASP_Wshell : FILE
 {
@@ -378788,10 +375041,10 @@ rule SIGNATURE_BASE_CN_Honker_ASP_Wshell : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L83-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L83-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3ae33c835e7ea6d9df74fe99fcf1e2fb9490c978"
-		logic_hash = "f6f83acb76248a1b00f1acac621e68888c93b34d4813d8f8613d5d9095c53a8a"
+		logic_hash = "v1_sha256_f6f83acb76248a1b00f1acac621e68888c93b34d4813d8f8613d5d9095c53a8a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378804,7 +375057,7 @@ rule SIGNATURE_BASE_CN_Honker_ASP_Wshell : FILE
 		$s3 = "StateName="
 
 	condition:
-		uint16(0)==0x253c and filesize <200KB and all of them
+		uint16( 0 ) == 0x253c and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Exp_Iis7 : FILE
 {
@@ -378815,10 +375068,10 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Iis7 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L102-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L102-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
-		logic_hash = "91ceec96297e5cc027e261fd708899787b9be4ac15e209e0734a3b8563ae31b5"
+		logic_hash = "v1_sha256_91ceec96297e5cc027e261fd708899787b9be4ac15e209e0734a3b8563ae31b5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378831,7 +375084,7 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Iis7 : FILE
 		$s4 = "WinSta0\\Default" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Segmentweapon : FILE
 {
@@ -378842,10 +375095,10 @@ rule SIGNATURE_BASE_CN_Honker_Segmentweapon : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L121-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L121-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "494ef20067a7ce2cc95260e4abc16fcfa7177fdf"
-		logic_hash = "9afb70a3ae158b7abbda6725b8c9901121b78fa0e874db12b4ac08bf59b26fb5"
+		logic_hash = "v1_sha256_9afb70a3ae158b7abbda6725b8c9901121b78fa0e874db12b4ac08bf59b26fb5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378856,7 +375109,7 @@ rule SIGNATURE_BASE_CN_Honker_Segmentweapon : FILE
 		$s1 = "http://www.nforange.com/inc/1.asp?" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Alien_Iispwd : FILE
 {
@@ -378867,10 +375120,10 @@ rule SIGNATURE_BASE_CN_Honker_Alien_Iispwd : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L138-L153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L138-L153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5d157a1b9644adbe0b28c37d4022d88a9f58cedb"
-		logic_hash = "16dc6ec4b668fdc43e3a9a8ea31ad0caa1a80b1015ab60eec0eb76bfacd69c5f"
+		logic_hash = "v1_sha256_16dc6ec4b668fdc43e3a9a8ea31ad0caa1a80b1015ab60eec0eb76bfacd69c5f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378881,7 +375134,7 @@ rule SIGNATURE_BASE_CN_Honker_Alien_Iispwd : FILE
 		$s1 = "wscript.echo \"from : http://www.xxx.com/\" &vbTab&vbCrLf" fullword ascii
 
 	condition:
-		filesize <3KB and all of them
+		filesize < 3KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Md5Cracktools : FILE
 {
@@ -378892,10 +375145,10 @@ rule SIGNATURE_BASE_CN_Honker_Md5Cracktools : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L155-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L155-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9dfd9c9923ae6f6fe4cbfa9eb69688269285939c"
-		logic_hash = "a176393c0324bcc634a31c261aa6b528fb5a5893c40a5534b34253a1922c8285"
+		logic_hash = "v1_sha256_a176393c0324bcc634a31c261aa6b528fb5a5893c40a5534b34253a1922c8285"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378906,7 +375159,7 @@ rule SIGNATURE_BASE_CN_Honker_Md5Cracktools : FILE
 		$s2 = ",<a href='index.php?c=1&type=md5&hash=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4580KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 4580KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Coolscan_Scan : FILE
 {
@@ -378917,10 +375170,10 @@ rule SIGNATURE_BASE_CN_Honker_Coolscan_Scan : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L172-L187"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L172-L187"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e1c5fb6b9f4e92c4264c7bea7f5fba9a5335c328"
-		logic_hash = "89c7d24d821e907f79ab5630eed13275c5216cff6bf203b5c8f66bb1a178039b"
+		logic_hash = "v1_sha256_89c7d24d821e907f79ab5630eed13275c5216cff6bf203b5c8f66bb1a178039b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378931,7 +375184,7 @@ rule SIGNATURE_BASE_CN_Honker_Coolscan_Scan : FILE
 		$s1 = "scan web.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3680KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3680KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Mempodipper2_6 : FILE
 {
@@ -378942,10 +375195,10 @@ rule SIGNATURE_BASE_CN_Honker_Mempodipper2_6 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L189-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L189-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ba2c79911fe48660898039591e1742b3f1a9e923"
-		logic_hash = "1a2c42757199818b94a73b9faff3380911655992ef3214a33a220eac15850c4b"
+		logic_hash = "v1_sha256_1a2c42757199818b94a73b9faff3380911655992ef3214a33a220eac15850c4b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378955,7 +375208,7 @@ rule SIGNATURE_BASE_CN_Honker_Mempodipper2_6 : FILE
 		$s0 = "objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed" ascii
 
 	condition:
-		filesize <30KB and all of them
+		filesize < 30KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_COOKIE_Cookie : FILE
 {
@@ -378966,10 +375219,10 @@ rule SIGNATURE_BASE_CN_Honker_COOKIE_Cookie : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L205-L220"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L205-L220"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f7727160257e0e716e9f0cf9cdf9a87caa986cde"
-		logic_hash = "6d942e53a253cb157e535f86ca457c93a6039b2c5ebb3969dc3e271242b478d4"
+		logic_hash = "v1_sha256_6d942e53a253cb157e535f86ca457c93a6039b2c5ebb3969dc3e271242b478d4"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -378980,7 +375233,7 @@ rule SIGNATURE_BASE_CN_Honker_COOKIE_Cookie : FILE
 		$s5 = "CooKie.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <360KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 360KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Wwwscan_1_Wwwscan : FILE
 {
@@ -378991,10 +375244,10 @@ rule SIGNATURE_BASE_CN_Honker_Wwwscan_1_Wwwscan : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L222-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L222-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6bed45629c5e54986f2d27cbfc53464108911026"
-		logic_hash = "7b0b6bbcba49c8f950ea3cf5a364059ba784c87a41eba6d825a9ca4e3a07bfbc"
+		logic_hash = "v1_sha256_7b0b6bbcba49c8f950ea3cf5a364059ba784c87a41eba6d825a9ca4e3a07bfbc"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379005,7 +375258,7 @@ rule SIGNATURE_BASE_CN_Honker_Wwwscan_1_Wwwscan : FILE
 		$s3 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 180KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_D_Injection_V2_32 : FILE
 {
@@ -379016,10 +375269,10 @@ rule SIGNATURE_BASE_CN_Honker_D_Injection_V2_32 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L239-L254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L239-L254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
-		logic_hash = "0107903a481b09faa92a5fbb162fd981f976ed864be3a0840b43063461e20974"
+		logic_hash = "v1_sha256_0107903a481b09faa92a5fbb162fd981f976ed864be3a0840b43063461e20974"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379030,7 +375283,7 @@ rule SIGNATURE_BASE_CN_Honker_D_Injection_V2_32 : FILE
 		$s1 = "/tftp -i 219.134.46.245 get 9493.exe c:\\9394.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Net_Priv_Esc2 : FILE
 {
@@ -379041,10 +375294,10 @@ rule SIGNATURE_BASE_CN_Honker_Net_Priv_Esc2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L256-L271"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L256-L271"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4851e0088ad38ac5b3b1c75302a73698437f7f17"
-		logic_hash = "53cf3d984bc82428eb0a6ee416bcd5429718a1d615ce1c1ba399cda42268d26c"
+		logic_hash = "v1_sha256_53cf3d984bc82428eb0a6ee416bcd5429718a1d615ce1c1ba399cda42268d26c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379055,7 +375308,7 @@ rule SIGNATURE_BASE_CN_Honker_Net_Priv_Esc2 : FILE
 		$s2 = "<www.darkst.com>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <17KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 17KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Oracle_V1_0_Oracle : FILE
 {
@@ -379066,10 +375319,10 @@ rule SIGNATURE_BASE_CN_Honker_Oracle_V1_0_Oracle : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L273-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L273-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
-		logic_hash = "6f1bb6b14445a9ca29768ab2dcf831a98cb5d153d03ebc4bc497bb8f8144a365"
+		logic_hash = "v1_sha256_6f1bb6b14445a9ca29768ab2dcf831a98cb5d153d03ebc4bc497bb8f8144a365"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379081,7 +375334,7 @@ rule SIGNATURE_BASE_CN_Honker_Oracle_V1_0_Oracle : FILE
 		$s3 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3455KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3455KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Interception : FILE
 {
@@ -379092,10 +375345,10 @@ rule SIGNATURE_BASE_CN_Honker_Interception : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L291-L306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L291-L306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ea813aed322e210ea6ae42b73b1250408bf40e7a"
-		logic_hash = "d1ae5f8ff21659b95f6e62b1d5e3ec15b122a2b5889e8984f3d9f6d2fa938d17"
+		logic_hash = "v1_sha256_d1ae5f8ff21659b95f6e62b1d5e3ec15b122a2b5889e8984f3d9f6d2fa938d17"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379106,7 +375359,7 @@ rule SIGNATURE_BASE_CN_Honker_Interception : FILE
 		$s5 = "WinlogonHackEx " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <160KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 160KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_3_0 : FILE
 {
@@ -379117,10 +375370,10 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_3_0 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L308-L324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L308-L324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "49b311add0940cf183e3c7f3a41ea6e516bf8992"
-		logic_hash = "6d2f6721c942332af1be0b6537e9b9d0b5b3e91eb3912dcd095aa18bccfc4ad5"
+		logic_hash = "v1_sha256_6d2f6721c942332af1be0b6537e9b9d0b5b3e91eb3912dcd095aa18bccfc4ad5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379132,7 +375385,7 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_3_0 : FILE
 		$s9 = "CryptGenRandom" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <395KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 395KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Windows_Exp : FILE
 {
@@ -379143,10 +375396,10 @@ rule SIGNATURE_BASE_CN_Honker_Windows_Exp : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L326-L341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L326-L341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "04334c396b165db6e18e9b76094991d681e6c993"
-		logic_hash = "6a146545fd12e7603bf1e2ccb9b2d308b13fe2acdb9248a79c80b6c1de37fd73"
+		logic_hash = "v1_sha256_6a146545fd12e7603bf1e2ccb9b2d308b13fe2acdb9248a79c80b6c1de37fd73"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379157,7 +375410,7 @@ rule SIGNATURE_BASE_CN_Honker_Windows_Exp : FILE
 		$s8 = "OH,Sry.Too long command." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 220KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Safe3Wvs_Cgiscan : FILE
 {
@@ -379168,10 +375421,10 @@ rule SIGNATURE_BASE_CN_Honker_Safe3Wvs_Cgiscan : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L343-L358"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L343-L358"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f94bbf2034ad9afa43cca3e3a20f142e0bb54d75"
-		logic_hash = "990dcede3bb83216af7e72e2a49bc2355ebd45ebd3fc658ba337a285dcdf799f"
+		logic_hash = "v1_sha256_990dcede3bb83216af7e72e2a49bc2355ebd45ebd3fc658ba337a285dcdf799f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379182,7 +375435,7 @@ rule SIGNATURE_BASE_CN_Honker_Safe3Wvs_Cgiscan : FILE
 		$s3 = "www.safe3.com.cn" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <357KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 357KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Pr_Debug : FILE
 {
@@ -379193,10 +375446,10 @@ rule SIGNATURE_BASE_CN_Honker_Pr_Debug : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L360-L375"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L360-L375"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
-		logic_hash = "0b7508e3a508adc9416f16549290e06468520c156dbd5192e5a352820586af9f"
+		logic_hash = "v1_sha256_0b7508e3a508adc9416f16549290e06468520c156dbd5192e5a352820586af9f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379207,7 +375460,7 @@ rule SIGNATURE_BASE_CN_Honker_Pr_Debug : FILE
 		$s2 = "This exploit will execute \"net user temp 123456 /add & net localg" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <820KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 820KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_0 : FILE
 {
@@ -379218,10 +375471,10 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_0 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L377-L392"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L377-L392"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "98f21f72c761e504814f0a7db835a24a2413a6c2"
-		logic_hash = "bd6f9b6e831573164fddf7f0188087eb0076410b77c9c06cfacadebe6a53b525"
+		logic_hash = "v1_sha256_bd6f9b6e831573164fddf7f0188087eb0076410b77c9c06cfacadebe6a53b525"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379232,7 +375485,7 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_0 : FILE
 		$s15 = "2011-2012 T00LS&RICES" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2077KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2077KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Matrixay1073 : FILE
 {
@@ -379243,10 +375496,10 @@ rule SIGNATURE_BASE_CN_Honker_Matrixay1073 : FILE
 		date = "2015-06-23"
 		modified = "2023-01-27"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L394-L412"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L394-L412"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fef951e47524f827c7698f4508ba9551359578a5"
-		logic_hash = "e64cae48344e5dae8ec80b2897305a0b380340bdd2973eb0828582f18ef8bf2b"
+		logic_hash = "v1_sha256_e64cae48344e5dae8ec80b2897305a0b380340bdd2973eb0828582f18ef8bf2b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379259,7 +375512,7 @@ rule SIGNATURE_BASE_CN_Honker_Matrixay1073 : FILE
 		$s3 = "getalluserpasswordhash" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 9100KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sword1_5 : FILE
 {
@@ -379270,10 +375523,10 @@ rule SIGNATURE_BASE_CN_Honker_Sword1_5 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L414-L431"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L414-L431"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
-		logic_hash = "0f7630b2ec983df2a065b049000cef6de38f884254748a342b2fd84d8c5985af"
+		logic_hash = "v1_sha256_0f7630b2ec983df2a065b049000cef6de38f884254748a342b2fd84d8c5985af"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379286,7 +375539,7 @@ rule SIGNATURE_BASE_CN_Honker_Sword1_5 : FILE
 		$s4 = "OpenFileDialog1" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <740KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 740KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Havij_Havij : FILE
 {
@@ -379297,10 +375550,10 @@ rule SIGNATURE_BASE_CN_Honker_Havij_Havij : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L433-L448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L433-L448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
-		logic_hash = "e8aff3e1e536cd35b10bdaab4818542bce284e7ed3aa7ef1920763669faf4c8a"
+		logic_hash = "v1_sha256_e8aff3e1e536cd35b10bdaab4818542bce284e7ed3aa7ef1920763669faf4c8a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379311,7 +375564,7 @@ rule SIGNATURE_BASE_CN_Honker_Havij_Havij : FILE
 		$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Exp_Ms11011 : FILE
 {
@@ -379322,10 +375575,10 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Ms11011 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L450-L468"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L450-L468"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
-		logic_hash = "f92d71f163a49a158d85b821d71fd17e84e0d3deb19515ae0cf6a063a05c027b"
+		logic_hash = "v1_sha256_f92d71f163a49a158d85b821d71fd17e84e0d3deb19515ae0cf6a063a05c027b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379339,7 +375592,7 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Ms11011 : FILE
 		$s5 = "cmd.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_DLL_Passive_Privilege_Escalation_Ws2Help : FILE
 {
@@ -379350,10 +375603,10 @@ rule SIGNATURE_BASE_CN_Honker_DLL_Passive_Privilege_Escalation_Ws2Help : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L470-L485"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L470-L485"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e539b799c18d519efae6343cff362dcfd8f57f69"
-		logic_hash = "e13f33e48d5c1aeaef6c50287f74e03fb7b65667d597768d448e76f5a375b34f"
+		logic_hash = "v1_sha256_e13f33e48d5c1aeaef6c50287f74e03fb7b65667d597768d448e76f5a375b34f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379364,7 +375617,7 @@ rule SIGNATURE_BASE_CN_Honker_DLL_Passive_Privilege_Escalation_Ws2Help : FILE
 		$s1 = "\\ws2help.dll" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webshell : FILE
 {
@@ -379375,10 +375628,10 @@ rule SIGNATURE_BASE_CN_Honker_Webshell : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L487-L503"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L487-L503"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c85bd09d241c2a75b4e4301091aa11ddd5ad6d59"
-		logic_hash = "d48a10313afcb5a2084229937703bbc11958a5cd11f8f27fbc8dae15ddfd5ed1"
+		logic_hash = "v1_sha256_d48a10313afcb5a2084229937703bbc11958a5cd11f8f27fbc8dae15ddfd5ed1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379390,7 +375643,7 @@ rule SIGNATURE_BASE_CN_Honker_Webshell : FILE
 		$s3 = "Downloading: %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <381KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 381KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Aspxclient : FILE
 {
@@ -379401,10 +375654,10 @@ rule SIGNATURE_BASE_CN_Honker_Aspxclient : FILE
 		date = "2015-06-23"
 		modified = "2022-12-21"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L505-L523"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L505-L523"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "67569a89128f503a459eab3daa2032261507f2d2"
-		logic_hash = "4d0a93434673952fed38e384db526275b9eb32bac9a207c91f792d4d113c40f1"
+		logic_hash = "v1_sha256_4d0a93434673952fed38e384db526275b9eb32bac9a207c91f792d4d113c40f1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379417,7 +375670,7 @@ rule SIGNATURE_BASE_CN_Honker_Aspxclient : FILE
 		$s4 = "injectfile" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 3 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Fckeditor : FILE
 {
@@ -379428,10 +375681,10 @@ rule SIGNATURE_BASE_CN_Honker_Fckeditor : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L525-L540"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L525-L540"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4b16ae12c204f64265acef872526b27111b68820"
-		logic_hash = "0fd231fc81b2b7b5647a8016774f35751ac68646856a15c17ce4d2c07eaf1761"
+		logic_hash = "v1_sha256_0fd231fc81b2b7b5647a8016774f35751ac68646856a15c17ce4d2c07eaf1761"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379442,7 +375695,7 @@ rule SIGNATURE_BASE_CN_Honker_Fckeditor : FILE
 		$s7 = "Fckeditor.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1340KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1340KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Codeeer_Explorer : FILE
 {
@@ -379453,10 +375706,10 @@ rule SIGNATURE_BASE_CN_Honker_Codeeer_Explorer : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L542-L557"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L542-L557"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f32e05f3fefbaa2791dd750e4a3812581ce0f205"
-		logic_hash = "299d0181beb5032dcb327516a7526d6131e2212623ffa9e592f54f80473b098d"
+		logic_hash = "v1_sha256_299d0181beb5032dcb327516a7526d6131e2212623ffa9e592f54f80473b098d"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379467,7 +375720,7 @@ rule SIGNATURE_BASE_CN_Honker_Codeeer_Explorer : FILE
 		$s12 = "webBrowser1_ProgressChanged" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <470KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 470KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Swordhonkeredition : FILE
 {
@@ -379478,10 +375731,10 @@ rule SIGNATURE_BASE_CN_Honker_Swordhonkeredition : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L559-L575"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L559-L575"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3f9479151c2cada04febea45c2edcf5cece1df6c"
-		logic_hash = "cc18e68f7c3eff69a75333f3b605c89b024c6763f7b97e0ce20ce14bfe28df0d"
+		logic_hash = "v1_sha256_cc18e68f7c3eff69a75333f3b605c89b024c6763f7b97e0ce20ce14bfe28df0d"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379493,7 +375746,7 @@ rule SIGNATURE_BASE_CN_Honker_Swordhonkeredition : FILE
 		$s2 = " Port Open -> " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <375KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 375KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_HASH_Pwdump7 : FILE
 {
@@ -379504,10 +375757,10 @@ rule SIGNATURE_BASE_CN_Honker_HASH_Pwdump7 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L577-L594"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L577-L594"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "93a2d7c3a9b83371d96a575c15fe6fce6f9d50d3"
-		logic_hash = "05f735ba3f377f71ccf3a97b3597cee7b9f36213ee2ebba19db69667529d9fac"
+		logic_hash = "v1_sha256_05f735ba3f377f71ccf3a97b3597cee7b9f36213ee2ebba19db69667529d9fac"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379520,7 +375773,7 @@ rule SIGNATURE_BASE_CN_Honker_HASH_Pwdump7 : FILE
 		$s4 = "Unable to dump file %S" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <380KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 380KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Chinachopper : FILE
 {
@@ -379531,10 +375784,10 @@ rule SIGNATURE_BASE_CN_Honker_Chinachopper : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L596-L612"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L596-L612"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fa347fdb23ab0b8d0560a0d20c434549d78e99b5"
-		logic_hash = "e5e6a8a17592e7c82af830153905a52f8202a65c8e2f4b09dbebb19d04e2f8d7"
+		logic_hash = "v1_sha256_e5e6a8a17592e7c82af830153905a52f8202a65c8e2f4b09dbebb19d04e2f8d7"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379546,7 +375799,7 @@ rule SIGNATURE_BASE_CN_Honker_Chinachopper : FILE
 		$s4 = "Ev al (\"Exe cute(\"\"On+Error+Resume+Next:%s:Response.Write(\"\"\"\"->|\"\"\"\"" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Dedecms5_7 : FILE
 {
@@ -379557,10 +375810,10 @@ rule SIGNATURE_BASE_CN_Honker_Dedecms5_7 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L614-L629"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L614-L629"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f9cbb25883828ca266e32ff4faf62f5a9f92c5fb"
-		logic_hash = "57ff887906d3c5e7eafc900581eea7432c7a18364b0061d0e4deba0229663c65"
+		logic_hash = "v1_sha256_57ff887906d3c5e7eafc900581eea7432c7a18364b0061d0e4deba0229663c65"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379571,7 +375824,7 @@ rule SIGNATURE_BASE_CN_Honker_Dedecms5_7 : FILE
 		$s2 = "SkinH_EL.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <830KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 830KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Alien_Ee : FILE
 {
@@ -379582,10 +375835,10 @@ rule SIGNATURE_BASE_CN_Honker_Alien_Ee : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L631-L646"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L631-L646"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "15a7211154ee7aca29529bd5c2500e0d33d7f0b3"
-		logic_hash = "1f40f6c53e13aeb6b44c58f6e048a35cf3fd9fb956f26d70b3fe91bcac340ab5"
+		logic_hash = "v1_sha256_1f40f6c53e13aeb6b44c58f6e048a35cf3fd9fb956f26d70b3fe91bcac340ab5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379596,7 +375849,7 @@ rule SIGNATURE_BASE_CN_Honker_Alien_Ee : FILE
 		$s2 = "Read IIS ID For FreeHost." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Smsniff_Smsniff : FILE
 {
@@ -379607,10 +375860,10 @@ rule SIGNATURE_BASE_CN_Honker_Smsniff_Smsniff : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L648-L663"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L648-L663"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8667a785a8ced76d0284d225be230b5f1546f140"
-		logic_hash = "6949f992d4734f18d9caffe83f2abccca0e0decef4169954518eed078d39e561"
+		logic_hash = "v1_sha256_6949f992d4734f18d9caffe83f2abccca0e0decef4169954518eed078d39e561"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379621,7 +375874,7 @@ rule SIGNATURE_BASE_CN_Honker_Smsniff_Smsniff : FILE
 		$s5 = "SmartSniff" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <267KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 267KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Happy_Happy : FILE
 {
@@ -379632,10 +375885,10 @@ rule SIGNATURE_BASE_CN_Honker_Happy_Happy : FILE
 		date = "2015-06-23"
 		modified = "2023-01-27"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L665-L683"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L665-L683"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "92067d8dad33177b5d6c853d4d0e897f2ee846b0"
-		logic_hash = "667cd6629ca49f2200fdc0a5eb28c77c412ca25313fd9a8afb77dedfa66d2fa1"
+		logic_hash = "v1_sha256_667cd6629ca49f2200fdc0a5eb28c77c412ca25313fd9a8afb77dedfa66d2fa1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379648,7 +375901,7 @@ rule SIGNATURE_BASE_CN_Honker_Happy_Happy : FILE
 		$s4 = "cmdshell" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <655KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 655KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_0 : FILE
 {
@@ -379659,10 +375912,10 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_0 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L685-L701"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L685-L701"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fa47c4affbac01ba5606c4862fdb77233c1ef656"
-		logic_hash = "fa65de4a135072f4d9a5d5711a4e2833b9d4a268a2a37c33d17e4546d172b6f1"
+		logic_hash = "v1_sha256_fa65de4a135072f4d9a5d5711a4e2833b9d4a268a2a37c33d17e4546d172b6f1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379674,7 +375927,7 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_0 : FILE
 		$s3 = "SkinH_EL.dll" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Netfuke_Netfuke : FILE
 {
@@ -379685,10 +375938,10 @@ rule SIGNATURE_BASE_CN_Honker_Netfuke_Netfuke : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L703-L718"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L703-L718"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f89e223fd4f6f5a3c2a2ea225660ef0957fc07ba"
-		logic_hash = "86f6040b743b17fb300498b02a202d1a9090054a30d490f082b116d799c4bdb2"
+		logic_hash = "v1_sha256_86f6040b743b17fb300498b02a202d1a9090054a30d490f082b116d799c4bdb2"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379699,7 +375952,7 @@ rule SIGNATURE_BASE_CN_Honker_Netfuke_Netfuke : FILE
 		$s2 = "netfuke_%s.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1840KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1840KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Manualinjection : FILE
 {
@@ -379710,10 +375963,10 @@ rule SIGNATURE_BASE_CN_Honker_Manualinjection : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L720-L735"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L720-L735"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e83d427f44783088a84e9c231c6816c214434526"
-		logic_hash = "fe8eba3b79f5bc4cf820ff51816c3f2a27d6ed8f6ab3963f88a3232c9a4b5c1e"
+		logic_hash = "v1_sha256_fe8eba3b79f5bc4cf820ff51816c3f2a27d6ed8f6ab3963f88a3232c9a4b5c1e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379724,7 +375977,7 @@ rule SIGNATURE_BASE_CN_Honker_Manualinjection : FILE
 		$s16 = "http://Www.cnhuker.com | http://www.0855.tv" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD : FILE
 {
@@ -379735,10 +375988,10 @@ rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L737-L754"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L737-L754"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1c6ed7d817fa8e6534a5fd36a94f4fc2f066c9cd"
-		logic_hash = "3c068c3d21de8c071b3eec354f03423d4902ef0156bb9dcad370cf688bc03426"
+		logic_hash = "v1_sha256_3c068c3d21de8c071b3eec354f03423d4902ef0156bb9dcad370cf688bc03426"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379751,7 +376004,7 @@ rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD : FILE
 		$s5 = "ExcuteCmd" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <22KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 22KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Termsrvhack : FILE
 {
@@ -379762,10 +376015,10 @@ rule SIGNATURE_BASE_CN_Honker_Termsrvhack : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L756-L771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L756-L771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1c456520a7b7faf71900c71167038185f5a7d312"
-		logic_hash = "ef0b9965e2d419230a7a8425674edb356347d1e41538d19fc67f8b0fbc69091f"
+		logic_hash = "v1_sha256_ef0b9965e2d419230a7a8425674edb356347d1e41538d19fc67f8b0fbc69091f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379776,7 +376029,7 @@ rule SIGNATURE_BASE_CN_Honker_Termsrvhack : FILE
 		$s6 = "%s\\%s\\%d\\%d" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1052KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1052KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_IIS6_Iis6 : FILE
 {
@@ -379787,10 +376040,10 @@ rule SIGNATURE_BASE_CN_Honker_IIS6_Iis6 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L773-L790"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L773-L790"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f0c9106d6d2eea686fd96622986b641968d0b864"
-		logic_hash = "51b2fdae6437d64661f20342711d516201740eceb2273704a6e415be2cac54f6"
+		logic_hash = "v1_sha256_51b2fdae6437d64661f20342711d516201740eceb2273704a6e415be2cac54f6"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379803,7 +376056,7 @@ rule SIGNATURE_BASE_CN_Honker_IIS6_Iis6 : FILE
 		$s3 = "EnumProcessModules" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Struts2_Catbox : FILE
 {
@@ -379814,10 +376067,10 @@ rule SIGNATURE_BASE_CN_Honker_Struts2_Catbox : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L792-L807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L792-L807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ee8fbd91477e056aef34fce3ade474cafa1a4304"
-		logic_hash = "20bda5c918ea38810603528a20f3406ec4e79ce999681649e8e806bf549b5359"
+		logic_hash = "v1_sha256_20bda5c918ea38810603528a20f3406ec4e79ce999681649e8e806bf549b5359"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379828,7 +376081,7 @@ rule SIGNATURE_BASE_CN_Honker_Struts2_Catbox : FILE
 		$s20 = "{external.exeScript(_toolmao_bgscript[i],'javascript',false);}}" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8160KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 8160KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Getlsasrvaddr : FILE
 {
@@ -379839,10 +376092,10 @@ rule SIGNATURE_BASE_CN_Honker_Getlsasrvaddr : FILE
 		date = "2015-06-23"
 		modified = "2022-12-21"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L809-L826"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L809-L826"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a897d5da98dae8d80f3c0a0ef6a07c4b42fb89ce"
-		logic_hash = "e626724430d0b74aee52783dd5abdb8ccc7b951c56041e5c166b78b7370bc402"
+		logic_hash = "v1_sha256_e626724430d0b74aee52783dd5abdb8ccc7b951c56041e5c166b78b7370bc402"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379854,7 +376107,7 @@ rule SIGNATURE_BASE_CN_Honker_Getlsasrvaddr : FILE
 		$s20 = "Addresses Found: " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Ms10048_X64 : FILE
 {
@@ -379865,10 +376118,10 @@ rule SIGNATURE_BASE_CN_Honker_Ms10048_X64 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L828-L843"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L828-L843"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
-		logic_hash = "49addce6bef7588bf7683836a54bec6a2a646ecc3f7547083174d2255454cdf0"
+		logic_hash = "v1_sha256_49addce6bef7588bf7683836a54bec6a2a646ecc3f7547083174d2255454cdf0"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379879,7 +376132,7 @@ rule SIGNATURE_BASE_CN_Honker_Ms10048_X64 : FILE
 		$s2 = "[+] Set to %d exploit half succeeded" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <125KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 125KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Logcleaner : FILE
 {
@@ -379890,10 +376143,10 @@ rule SIGNATURE_BASE_CN_Honker_Logcleaner : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L845-L860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L845-L860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ab77ed5804b0394d58717c5f844d9c0da5a9f03e"
-		logic_hash = "3be059627c39e262e7621fce637df21ddcabef91753192cec356f2f8cd58c1a3"
+		logic_hash = "v1_sha256_3be059627c39e262e7621fce637df21ddcabef91753192cec356f2f8cd58c1a3"
 		score = 70
 		quality = 83
 		tags = "FILE"
@@ -379904,7 +376157,7 @@ rule SIGNATURE_BASE_CN_Honker_Logcleaner : FILE
 		$s4 = "LogCleaner v" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Shell_Brute_Tool : FILE
 {
@@ -379915,10 +376168,10 @@ rule SIGNATURE_BASE_CN_Honker_Shell_Brute_Tool : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L862-L877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L862-L877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f6903a15453698c35dce841e4d09c542f9480f01"
-		logic_hash = "723fd18e59c0017b67a035ec7c685169c517d673c2bbc8fe93071b8dbd1e606a"
+		logic_hash = "v1_sha256_723fd18e59c0017b67a035ec7c685169c517d673c2bbc8fe93071b8dbd1e606a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379929,7 +376182,7 @@ rule SIGNATURE_BASE_CN_Honker_Shell_Brute_Tool : FILE
 		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Hxdef100 : FILE
 {
@@ -379940,10 +376193,10 @@ rule SIGNATURE_BASE_CN_Honker_Hxdef100 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L879-L895"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L879-L895"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bf30ccc565ac40073b867d4c7f5c33c6bc1920d6"
-		logic_hash = "49f15482104297f0c57713712a7add49d58007afeefd11151dc5749b755860ba"
+		logic_hash = "v1_sha256_49f15482104297f0c57713712a7add49d58007afeefd11151dc5749b755860ba"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379955,7 +376208,7 @@ rule SIGNATURE_BASE_CN_Honker_Hxdef100 : FILE
 		$s16 = "%cmddir%" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Arp_EMP_V1_0 : FILE
 {
@@ -379966,10 +376219,10 @@ rule SIGNATURE_BASE_CN_Honker_Arp_EMP_V1_0 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L897-L911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L897-L911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
-		logic_hash = "457035b1685ac7f1bdccaab0b64bb1ad3ca1bf5e0747222347ced2a11b9b9504"
+		logic_hash = "v1_sha256_457035b1685ac7f1bdccaab0b64bb1ad3ca1bf5e0747222347ced2a11b9b9504"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -379979,7 +376232,7 @@ rule SIGNATURE_BASE_CN_Honker_Arp_EMP_V1_0 : FILE
 		$s0 = "Arp EMP v1.0.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Getwebshell : FILE
 {
@@ -379990,10 +376243,10 @@ rule SIGNATURE_BASE_CN_Honker_Getwebshell : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L913-L930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L913-L930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b63b53259260a7a316932c0a4b643862f65ee9f8"
-		logic_hash = "5d6638596607884950e702144416eb6fd3b009c88e4af5f81a50f346d7491c95"
+		logic_hash = "v1_sha256_5d6638596607884950e702144416eb6fd3b009c88e4af5f81a50f346d7491c95"
 		score = 70
 		quality = 60
 		tags = "FILE"
@@ -380006,7 +376259,7 @@ rule SIGNATURE_BASE_CN_Honker_Getwebshell : FILE
 		$s15 = ";Drop table [hack];create table [dbo].[hack] ([cmd] [image])--" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 70KB and 1 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Cracker_SHELL : FILE
 {
@@ -380017,10 +376270,10 @@ rule SIGNATURE_BASE_CN_Honker_Cracker_SHELL : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L932-L949"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L932-L949"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c1dc349ff44a45712937a8a9518170da8d4ee656"
-		logic_hash = "03da662e8d5dfbae524c4949d90e143714e6c4783e02600e059172e8b09ebc57"
+		logic_hash = "v1_sha256_03da662e8d5dfbae524c4949d90e143714e6c4783e02600e059172e8b09ebc57"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380033,7 +376286,7 @@ rule SIGNATURE_BASE_CN_Honker_Cracker_SHELL : FILE
 		$s4 = "WebBrowser1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_MSTSC_Can_Direct_Copy : FILE
 {
@@ -380044,10 +376297,10 @@ rule SIGNATURE_BASE_CN_Honker_MSTSC_Can_Direct_Copy : FILE
 		date = "2015-06-23"
 		modified = "2022-12-21"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L951-L968"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L951-L968"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2f3cbfd9f82f8abafdb1d33235fa6bfa1e1f71ae"
-		logic_hash = "5437abd979a8df5ee3f8508f7a5fff85714b5d8a22ab1760fe1e7a8168a8c255"
+		logic_hash = "v1_sha256_5437abd979a8df5ee3f8508f7a5fff85714b5d8a22ab1760fe1e7a8168a8c255"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380059,7 +376312,7 @@ rule SIGNATURE_BASE_CN_Honker_MSTSC_Can_Direct_Copy : FILE
 		$s3 = "/migrate -- migrates legacy connection files that were created with " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Lcx_Lcx : FILE
 {
@@ -380070,10 +376323,10 @@ rule SIGNATURE_BASE_CN_Honker_Lcx_Lcx : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L970-L988"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L970-L988"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
-		logic_hash = "6e81cac14baa9f0ae35eb26f30291cba6f7ef1864f8970b97a3e6e7205d10eb9"
+		logic_hash = "v1_sha256_6e81cac14baa9f0ae35eb26f30291cba6f7ef1864f8970b97a3e6e7205d10eb9"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380087,7 +376340,7 @@ rule SIGNATURE_BASE_CN_Honker_Lcx_Lcx : FILE
 		$s5 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Postgresql : FILE
 {
@@ -380098,10 +376351,10 @@ rule SIGNATURE_BASE_CN_Honker_Postgresql : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L990-L1005"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L990-L1005"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
-		logic_hash = "f6921e7a7c88d70c77fc30dc273aac3679a3c0ab44d4d4706d7a405f16cff6a1"
+		logic_hash = "v1_sha256_f6921e7a7c88d70c77fc30dc273aac3679a3c0ab44d4d4706d7a405f16cff6a1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380112,7 +376365,7 @@ rule SIGNATURE_BASE_CN_Honker_Postgresql : FILE
 		$s2 = "PostgreSQL_inject" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webrobot : FILE
 {
@@ -380123,10 +376376,10 @@ rule SIGNATURE_BASE_CN_Honker_Webrobot : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1007-L1023"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1007-L1023"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "af054994c911b4301490344fca4bb19a9f394a8f"
-		logic_hash = "7d7fc9fb9156aa20993dcb809f4e1d3d357f6826dcac7e628dbe6e0f81e5a61a"
+		logic_hash = "v1_sha256_7d7fc9fb9156aa20993dcb809f4e1d3d357f6826dcac7e628dbe6e0f81e5a61a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380138,7 +376391,7 @@ rule SIGNATURE_BASE_CN_Honker_Webrobot : FILE
 		$s3 = "\\data\\FilterKeyword.txt" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Baidu_Extractor_Ver1_0 : FILE
 {
@@ -380149,10 +376402,10 @@ rule SIGNATURE_BASE_CN_Honker_Baidu_Extractor_Ver1_0 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1025-L1042"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1025-L1042"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1899f979360e96245d31082e7e96ccedbdbe1413"
-		logic_hash = "cba7357ab3cb840b3b115abe00e1a3a712feb036cae816c8ded10d73029efe2b"
+		logic_hash = "v1_sha256_cba7357ab3cb840b3b115abe00e1a3a712feb036cae816c8ded10d73029efe2b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380165,7 +376418,7 @@ rule SIGNATURE_BASE_CN_Honker_Baidu_Extractor_Ver1_0 : FILE
 		$s19 = "cmd /c ping " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_FTP_Scanning : FILE
 {
@@ -380176,10 +376429,10 @@ rule SIGNATURE_BASE_CN_Honker_FTP_Scanning : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1044-L1061"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1044-L1061"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5a3543ee5aed110c87cbc3973686e785bcb5c44e"
-		logic_hash = "5f1c312dc9fa80c120699bacd17d5e4c147ab96f90c619a8c39ec27646a1307f"
+		logic_hash = "v1_sha256_5f1c312dc9fa80c120699bacd17d5e4c147ab96f90c619a8c39ec27646a1307f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380192,7 +376445,7 @@ rule SIGNATURE_BASE_CN_Honker_FTP_Scanning : FILE
 		$s13 = "MSIE 6*" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 550KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Dirdown_Dirdown : FILE
 {
@@ -380203,10 +376456,10 @@ rule SIGNATURE_BASE_CN_Honker_Dirdown_Dirdown : FILE
 		date = "2015-06-23"
 		modified = "2022-12-21"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1063-L1080"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1063-L1080"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7b8d51c72841532dded5fec7e7b0005855b8a051"
-		logic_hash = "5e8349096b7d07757c3779e13fba87f770a5ef090bc7efe36fd151c7c180edad"
+		logic_hash = "v1_sha256_5e8349096b7d07757c3779e13fba87f770a5ef090bc7efe36fd151c7c180edad"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380218,7 +376471,7 @@ rule SIGNATURE_BASE_CN_Honker_Dirdown_Dirdown : FILE
 		$s5 = "Get8Bytes" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <45KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 45KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Xiaokui_Conversion_Tool : FILE
 {
@@ -380229,10 +376482,10 @@ rule SIGNATURE_BASE_CN_Honker_Xiaokui_Conversion_Tool : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1082-L1098"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1082-L1098"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dccd163e94a774b01f90c1e79f186894e2f27de3"
-		logic_hash = "66a77c1fbfecdc02f591c12f69b46e39b7077dfbb5ed2a26a7dcfb11c8b464dc"
+		logic_hash = "v1_sha256_66a77c1fbfecdc02f591c12f69b46e39b7077dfbb5ed2a26a7dcfb11c8b464dc"
 		score = 70
 		quality = 60
 		tags = "FILE"
@@ -380244,7 +376497,7 @@ rule SIGNATURE_BASE_CN_Honker_Xiaokui_Conversion_Tool : FILE
 		$s3 = "by zj1244" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 240KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Grouppolicyremover : FILE
 {
@@ -380255,10 +376508,10 @@ rule SIGNATURE_BASE_CN_Honker_Grouppolicyremover : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1100-L1116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1100-L1116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7475d694e189b35899a2baa462957ac3687513e5"
-		logic_hash = "936d5dea2d44f638abfb5e42f45c0678bcbf769b575b5056db1a1fc41d1643be"
+		logic_hash = "v1_sha256_936d5dea2d44f638abfb5e42f45c0678bcbf769b575b5056db1a1fc41d1643be"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380270,7 +376523,7 @@ rule SIGNATURE_BASE_CN_Honker_Grouppolicyremover : FILE
 		$s2 = "SHDeleteKeyA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Wordpressscanner : FILE
 {
@@ -380281,10 +376534,10 @@ rule SIGNATURE_BASE_CN_Honker_Wordpressscanner : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1118-L1135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1118-L1135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0b3c5015ba3616cbc616fc9ba805fea73e98bc83"
-		logic_hash = "c6c36ad5ff0ddfbc41464008d293d453bf2d312a6db885217785adf816bd8b20"
+		logic_hash = "v1_sha256_c6c36ad5ff0ddfbc41464008d293d453bf2d312a6db885217785adf816bd8b20"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380297,7 +376550,7 @@ rule SIGNATURE_BASE_CN_Honker_Wordpressscanner : FILE
 		$s4 = "#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Htran_V2_40_Htran20 : FILE
 {
@@ -380308,10 +376561,10 @@ rule SIGNATURE_BASE_CN_Honker_Htran_V2_40_Htran20 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1137-L1156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1137-L1156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
-		logic_hash = "41a85430875df622e7940ef26c6eceaa4e0720b2995521fbb2d4b072207c8e15"
+		logic_hash = "v1_sha256_41a85430875df622e7940ef26c6eceaa4e0720b2995521fbb2d4b072207c8e15"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380326,7 +376579,7 @@ rule SIGNATURE_BASE_CN_Honker_Htran_V2_40_Htran20 : FILE
 		$s6 = "[-] There is a error...Create a new connection." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Dictionarygenerator : FILE
 {
@@ -380337,10 +376590,10 @@ rule SIGNATURE_BASE_CN_Honker_Dictionarygenerator : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1158-L1173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1158-L1173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b3071c64953e97eeb2ca6796fab302d8a77d27bc"
-		logic_hash = "228bdbca3eb206e22a130e91caa2486174efba9356dbee67e80333c0cf0bb643"
+		logic_hash = "v1_sha256_228bdbca3eb206e22a130e91caa2486174efba9356dbee67e80333c0cf0bb643"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380351,7 +376604,7 @@ rule SIGNATURE_BASE_CN_Honker_Dictionarygenerator : FILE
 		$s2 = "cracker" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3650KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3650KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Ms11080_Withcmd : FILE
 {
@@ -380362,10 +376615,10 @@ rule SIGNATURE_BASE_CN_Honker_Ms11080_Withcmd : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1175-L1190"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1175-L1190"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
-		logic_hash = "1f673f845ad40efae143ec244c7c70d1e26fb51f22be6bf445085c6a7379f193"
+		logic_hash = "v1_sha256_1f673f845ad40efae143ec244c7c70d1e26fb51f22be6bf445085c6a7379f193"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380376,7 +376629,7 @@ rule SIGNATURE_BASE_CN_Honker_Ms11080_Withcmd : FILE
 		$s3 = "[>] create pipe error" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <340KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 340KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V2 : FILE
 {
@@ -380387,10 +376640,10 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1192-L1208"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1192-L1208"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a995451d9108687b8892ad630a79660a021d670a"
-		logic_hash = "979f3fe9795798743f2a57aa3b82a34e304774de58ffda5278991cf5a753a8ba"
+		logic_hash = "v1_sha256_979f3fe9795798743f2a57aa3b82a34e304774de58ffda5278991cf5a753a8ba"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380402,7 +376655,7 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V2 : FILE
 		$s3 = "2011-2012 T00LS&RICES" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_HASH_32 : FILE
 {
@@ -380413,10 +376666,10 @@ rule SIGNATURE_BASE_CN_Honker_HASH_32 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1210-L1226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1210-L1226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bf4a8b4b3e906e385feab5ea768f604f64ba84ea"
-		logic_hash = "819e70979ae1d5e237bbadaa52b504c566b4b7436747ceb0d72e206e4fc45708"
+		logic_hash = "v1_sha256_819e70979ae1d5e237bbadaa52b504c566b4b7436747ceb0d72e206e4fc45708"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380428,7 +376681,7 @@ rule SIGNATURE_BASE_CN_Honker_HASH_32 : FILE
 		$s9 = "Specific LUID NOT found" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 240KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Windows_Mstsc_Enhanced_RMDSTC : FILE
 {
@@ -380439,10 +376692,10 @@ rule SIGNATURE_BASE_CN_Honker_Windows_Mstsc_Enhanced_RMDSTC : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1228-L1243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1228-L1243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3ca2b1b6f31219baf172abcc8f00f07f560e465f"
-		logic_hash = "de676b033613beebfe9fc5a71cf5f5911f0af35d34e77d56d222c6f00114dfb6"
+		logic_hash = "v1_sha256_de676b033613beebfe9fc5a71cf5f5911f0af35d34e77d56d222c6f00114dfb6"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380453,7 +376706,7 @@ rule SIGNATURE_BASE_CN_Honker_Windows_Mstsc_Enhanced_RMDSTC : FILE
 		$s1 = "By newccc" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sig_3389_Mstsc_MSTSCAX : FILE
 {
@@ -380464,10 +376717,10 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Mstsc_MSTSCAX : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1245-L1261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1245-L1261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2fa006158b2d87b08f1778f032ab1b8e139e02c6"
-		logic_hash = "2bfe10ec4af5d0f32fc03714c0cb01d9b0d446daa67cc0cce0b83f6a57e7c5a5"
+		logic_hash = "v1_sha256_2bfe10ec4af5d0f32fc03714c0cb01d9b0d446daa67cc0cce0b83f6a57e7c5a5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380479,7 +376732,7 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Mstsc_MSTSCAX : FILE
 		$s3 = "Cleaning temp directory" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_T00Ls_Scanner : FILE
 {
@@ -380490,10 +376743,10 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Scanner : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1263-L1278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1263-L1278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "70b04b910d82b32b90cd7f355a0e3e17dd260cb3"
-		logic_hash = "558abb651ce410520811ca96aaad78710cb9bf597b59ed89d9a678377716d721"
+		logic_hash = "v1_sha256_558abb651ce410520811ca96aaad78710cb9bf597b59ed89d9a678377716d721"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380504,7 +376757,7 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Scanner : FILE
 		$s17 = "Team:www.t00ls.net" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <330KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 330KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Gethashes : FILE
 {
@@ -380515,10 +376768,10 @@ rule SIGNATURE_BASE_CN_Honker_Gethashes : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1280-L1296"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1280-L1296"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dc8bcebf565ffffda0df24a77e28af681227b7fe"
-		logic_hash = "fb5ab5e6d8b522caf27478b0589b39d06b96fb0f913673ede768a814836e11f8"
+		logic_hash = "v1_sha256_fb5ab5e6d8b522caf27478b0589b39d06b96fb0f913673ede768a814836e11f8"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380530,7 +376783,7 @@ rule SIGNATURE_BASE_CN_Honker_Gethashes : FILE
 		$s2 = "Note: Windows registry file shall begin from 'regf' signature!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <87KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 87KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Hashq_Hashq : FILE
 {
@@ -380541,10 +376794,10 @@ rule SIGNATURE_BASE_CN_Honker_Hashq_Hashq : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1298-L1314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1298-L1314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7518b647db5275e8a9e0bf4deda3d853cc9d5661"
-		logic_hash = "a71ad182f7dd33790e59badfba6149c6dea627858414f0a8f3e64fd3bb2e2a64"
+		logic_hash = "v1_sha256_a71ad182f7dd33790e59badfba6149c6dea627858414f0a8f3e64fd3bb2e2a64"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380556,7 +376809,7 @@ rule SIGNATURE_BASE_CN_Honker_Hashq_Hashq : FILE
 		$s6 = "Md5 query tool" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Shiftbackdoor_Server : FILE
 {
@@ -380567,10 +376820,10 @@ rule SIGNATURE_BASE_CN_Honker_Shiftbackdoor_Server : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1316-L1333"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1316-L1333"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b24d761c6bbf216792c4833890460e8b37d86b37"
-		logic_hash = "17f1d7f2345ed1bc9b240c4851f41891244ec9d13b296a24ab6b42cca32ddf87"
+		logic_hash = "v1_sha256_17f1d7f2345ed1bc9b240c4851f41891244ec9d13b296a24ab6b42cca32ddf87"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380583,7 +376836,7 @@ rule SIGNATURE_BASE_CN_Honker_Shiftbackdoor_Server : FILE
 		$s3 = "\\ntvdm.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Exp_Win2003 : FILE
 {
@@ -380594,10 +376847,10 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Win2003 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1335-L1351"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1335-L1351"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "47164c8efe65d7d924753fadf6cdfb897a1c03db"
-		logic_hash = "d1616c53b26eefaa2578efb7defee182e8c88c869cfffb16c8767ddc1869ad46"
+		logic_hash = "v1_sha256_d1616c53b26eefaa2578efb7defee182e8c88c869cfffb16c8767ddc1869ad46"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380609,7 +376862,7 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Win2003 : FILE
 		$s4 = "Not Windows NT family OS." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Interception3389_Setup : FILE
 {
@@ -380620,10 +376873,10 @@ rule SIGNATURE_BASE_CN_Honker_Interception3389_Setup : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1353-L1371"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1353-L1371"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f5b2f86f8e7cdc00aa1cb1b04bc3d278eb17bf5c"
-		logic_hash = "d3f543683810a985a190cc3ea8edb7bfcd316d56a13d45c6532c488a4536ad0a"
+		logic_hash = "v1_sha256_d3f543683810a985a190cc3ea8edb7bfcd316d56a13d45c6532c488a4536ad0a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380637,7 +376890,7 @@ rule SIGNATURE_BASE_CN_Honker_Interception3389_Setup : FILE
 		$s7 = "\\wminotify.dll" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD_2 : FILE
 {
@@ -380648,10 +376901,10 @@ rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD_2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1373-L1390"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1373-L1390"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7f3a6fb30845bf366e14fa21f7e05d71baa1215a"
-		logic_hash = "8f33f2999eae3f080e8e5ec51ced3e7d596a07b6e5c9830cc1ca552701ed6502"
+		logic_hash = "v1_sha256_8f33f2999eae3f080e8e5ec51ced3e7d596a07b6e5c9830cc1ca552701ed6502"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380664,7 +376917,7 @@ rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD_2 : FILE
 		$s3 = "ExcuteCmd" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <22KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 22KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Exp_Ms11046 : FILE
 {
@@ -380675,10 +376928,10 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Ms11046 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1392-L1409"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1392-L1409"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
-		logic_hash = "0496e5c062c1a248b118c2f6009c95bfddf753e5491529d4ec43cfaf1ea0c0c5"
+		logic_hash = "v1_sha256_0496e5c062c1a248b118c2f6009c95bfddf753e5491529d4ec43cfaf1ea0c0c5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380691,7 +376944,7 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Ms11046 : FILE
 		$s3 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Master_Beta_1_7 : FILE
 {
@@ -380702,10 +376955,10 @@ rule SIGNATURE_BASE_CN_Honker_Master_Beta_1_7 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1411-L1426"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1411-L1426"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3be7a370791f29be89acccf3f2608fd165e8059e"
-		logic_hash = "13c9cc0bf8aaed2ba86baeee6f0b32bf71108dc1350dcffd03e70393fa975c9f"
+		logic_hash = "v1_sha256_13c9cc0bf8aaed2ba86baeee6f0b32bf71108dc1350dcffd03e70393fa975c9f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380716,7 +376969,7 @@ rule SIGNATURE_BASE_CN_Honker_Master_Beta_1_7 : FILE
 		$s2 = "Location: getpass.asp?info=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <312KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 312KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_2 : FILE
 {
@@ -380727,10 +376980,10 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1428-L1446"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1428-L1446"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0783661077312753802bd64bf5d35c4666ad0a82"
-		logic_hash = "85c73d480019929eef5951b0395f49cea86dc83b334860e940cc6e36c2d96d3a"
+		logic_hash = "v1_sha256_85c73d480019929eef5951b0395f49cea86dc83b334860e940cc6e36c2d96d3a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380744,7 +376997,7 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_2 : FILE
 		$s9 = "F4ck Team" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 220KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sig_3389_80_Antifw : FILE
 {
@@ -380755,10 +377008,10 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_80_Antifw : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1448-L1466"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1448-L1466"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5fbc75900e48f83d0e3592ea9fa4b70da72ccaa3"
-		logic_hash = "5e940406b713458ae7168d4e140f15a262b7f0834d29db9c88f1f04bedb41e43"
+		logic_hash = "v1_sha256_5e940406b713458ae7168d4e140f15a262b7f0834d29db9c88f1f04bedb41e43"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380772,7 +377025,7 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_80_Antifw : FILE
 		$s5 = "AntiFW.cpp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Wwwscan_Gui : FILE
 {
@@ -380783,10 +377036,10 @@ rule SIGNATURE_BASE_CN_Honker_Wwwscan_Gui : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1468-L1483"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1468-L1483"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
-		logic_hash = "9c25cf33fc2f675c8db7b24f2abe03d54c0ae17927e0ca9ccd3e5b97ffc56f73"
+		logic_hash = "v1_sha256_9c25cf33fc2f675c8db7b24f2abe03d54c0ae17927e0ca9ccd3e5b97ffc56f73"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380797,7 +377050,7 @@ rule SIGNATURE_BASE_CN_Honker_Wwwscan_Gui : FILE
 		$s2 = "/eye2007Admin_login.aspx" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <280KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 280KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Swordcolledition : FILE
 {
@@ -380808,10 +377061,10 @@ rule SIGNATURE_BASE_CN_Honker_Swordcolledition : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1485-L1500"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1485-L1500"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6e14f21cac6e2aa7535e45d81e8d1f6913fd6e8b"
-		logic_hash = "bbc5c9bb91bdd60582e2d7f6fa9b1a1cc3799e0809b670d575d9b2c77bf5e884"
+		logic_hash = "v1_sha256_bbc5c9bb91bdd60582e2d7f6fa9b1a1cc3799e0809b670d575d9b2c77bf5e884"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380822,7 +377075,7 @@ rule SIGNATURE_BASE_CN_Honker_Swordcolledition : FILE
 		$s1 = "YuJianScan" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <225KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 225KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Hconstfportable : FILE
 {
@@ -380833,10 +377086,10 @@ rule SIGNATURE_BASE_CN_Honker_Hconstfportable : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1502-L1517"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1502-L1517"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "00253a00eadb3ec21a06911a3d92728bbbe80c09"
-		logic_hash = "d4368994d38b87a4c0a53321a468fa8a72411ccb17befa0bbc62bdd6de9e1a52"
+		logic_hash = "v1_sha256_d4368994d38b87a4c0a53321a468fa8a72411ccb17befa0bbc62bdd6de9e1a52"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380847,7 +377100,7 @@ rule SIGNATURE_BASE_CN_Honker_Hconstfportable : FILE
 		$s2 = "www.Hcon.in" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <354KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 354KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_LPK : FILE
 {
@@ -380858,10 +377111,10 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_LPK : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1519-L1536"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1519-L1536"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
-		logic_hash = "20e949bef1c1631ef2a48c78c2ccc4dcea2f842275ec5df3e31c5d915e8a2a04"
+		logic_hash = "v1_sha256_20e949bef1c1631ef2a48c78c2ccc4dcea2f842275ec5df3e31c5d915e8a2a04"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380874,7 +377127,7 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_LPK : FILE
 		$s4 = "Set user Group Error! Username:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Without_A_Trace_Wywz : FILE
 {
@@ -380885,10 +377138,10 @@ rule SIGNATURE_BASE_CN_Honker_Without_A_Trace_Wywz : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1538-L1554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1538-L1554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f443c43fde643228ee95def5c8ed3171f16daad8"
-		logic_hash = "0f6ca7d44312afef49d3094af7b33af5e41f4531e7e7f9f37cf050700755bb3e"
+		logic_hash = "v1_sha256_0f6ca7d44312afef49d3094af7b33af5e41f4531e7e7f9f37cf050700755bb3e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380900,7 +377153,7 @@ rule SIGNATURE_BASE_CN_Honker_Without_A_Trace_Wywz : FILE
 		$s3 = "%s\\subinacl.exe /subkeyreg \"%s\" /Grant=%s=f /Grant=everyone=f" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1800KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1800KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_LPK2_0_LPK : FILE
 {
@@ -380911,10 +377164,10 @@ rule SIGNATURE_BASE_CN_Honker_LPK2_0_LPK : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1556-L1573"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1556-L1573"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5a1226e73daba516c889328f295e728f07fdf1c3"
-		logic_hash = "d693b880d5419277d9189d44ace60fe5f328b4662c1975a8bc97e63dc073d1e6"
+		logic_hash = "v1_sha256_d693b880d5419277d9189d44ace60fe5f328b4662c1975a8bc97e63dc073d1e6"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380927,7 +377180,7 @@ rule SIGNATURE_BASE_CN_Honker_LPK2_0_LPK : FILE
 		$s4 = "sathc.exe 211" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1030KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1030KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Cleaniis : FILE
 {
@@ -380938,10 +377191,10 @@ rule SIGNATURE_BASE_CN_Honker_Cleaniis : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1575-L1590"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1575-L1590"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "372bc64c842f6ff0d9a1aa2a2a44659d8b88cb40"
-		logic_hash = "6f3fe22c9ce8b576116a3fc185910488f37b687c1158d49a93feaa68a144a8db"
+		logic_hash = "v1_sha256_6f3fe22c9ce8b576116a3fc185910488f37b687c1158d49a93feaa68a144a8db"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380952,7 +377205,7 @@ rule SIGNATURE_BASE_CN_Honker_Cleaniis : FILE
 		$s4 = "IIS log file cleaner by Scurt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Arp3_7_Arp3_7 : FILE
 {
@@ -380963,10 +377216,10 @@ rule SIGNATURE_BASE_CN_Honker_Arp3_7_Arp3_7 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1592-L1607"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1592-L1607"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "db641a9dfec103b98548ac7f6ca474715040f25c"
-		logic_hash = "9930d5f13c4dc5cae25dece811911e71e858e3fef51a09c99883699e7feb4908"
+		logic_hash = "v1_sha256_9930d5f13c4dc5cae25dece811911e71e858e3fef51a09c99883699e7feb4908"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -380977,7 +377230,7 @@ rule SIGNATURE_BASE_CN_Honker_Arp3_7_Arp3_7 : FILE
 		$s2 = "www.80sec.com" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Exp_Ms11080 : FILE
 {
@@ -380988,10 +377241,10 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Ms11080 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1609-L1624"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1609-L1624"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
-		logic_hash = "57eb1cdd1108c82da399b0aa869edc9e377e0185896504716bec8925599c07f0"
+		logic_hash = "v1_sha256_57eb1cdd1108c82da399b0aa869edc9e377e0185896504716bec8925599c07f0"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381002,7 +377255,7 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Ms11080 : FILE
 		$s6 = "[*] Add to Administrators success" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <840KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 840KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Injection_Transit : FILE
 {
@@ -381013,10 +377266,10 @@ rule SIGNATURE_BASE_CN_Honker_Injection_Transit : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1626-L1642"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1626-L1642"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f4fef2e3d310494a3c3962a49c7c5a9ea072b2ea"
-		logic_hash = "3e6fe804b9b6e8555c847a165bb0a8b266004653531fe8f11e3937108757f2ff"
+		logic_hash = "v1_sha256_3e6fe804b9b6e8555c847a165bb0a8b266004653531fe8f11e3937108757f2ff"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381028,7 +377281,7 @@ rule SIGNATURE_BASE_CN_Honker_Injection_Transit : FILE
 		$s5 = "ScriptnackgBun" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3175KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3175KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Safe3Wvs : FILE
 {
@@ -381039,10 +377292,10 @@ rule SIGNATURE_BASE_CN_Honker_Safe3Wvs : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1644-L1662"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1644-L1662"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fee3acacc763dc55df1373709a666d94c9364a7f"
-		logic_hash = "803591fa9427c3001f78ae6274076f3a2f070770d568909d6cba8cee5124ee4c"
+		logic_hash = "v1_sha256_803591fa9427c3001f78ae6274076f3a2f070770d568909d6cba8cee5124ee4c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381056,7 +377309,7 @@ rule SIGNATURE_BASE_CN_Honker_Safe3Wvs : FILE
 		$s20 = "SOFTWARE\\Classes\\Interface\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_NBSI_3_0 : FILE
 {
@@ -381067,10 +377320,10 @@ rule SIGNATURE_BASE_CN_Honker_NBSI_3_0 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1664-L1681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1664-L1681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "93bf0f64bec926e9aa2caf4c28df9af27ec0e104"
-		logic_hash = "017b5f76a3168089f3186134e7a4c0352158bb866228776240f0d014834e6ee0"
+		logic_hash = "v1_sha256_017b5f76a3168089f3186134e7a4c0352158bb866228776240f0d014834e6ee0"
 		score = 70
 		quality = 60
 		tags = "FILE"
@@ -381083,7 +377336,7 @@ rule SIGNATURE_BASE_CN_Honker_NBSI_3_0 : FILE
 		$s4 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2600KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2600KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_2_0 : FILE
 {
@@ -381094,10 +377347,10 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_2_0 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1683-L1699"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1683-L1699"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e8ee982421ccff96121ffd24a3d84e3079f3750f"
-		logic_hash = "8c9be7e8cc04eba6b131acc3c85ac48d7663260a2e4064ad55ed8f40e0875cf4"
+		logic_hash = "v1_sha256_8c9be7e8cc04eba6b131acc3c85ac48d7663260a2e4064ad55ed8f40e0875cf4"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381109,7 +377362,7 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_2_0 : FILE
 		$s15 = "UBrute.com" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <980KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 980KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Hkmjjiis6 : FILE
 {
@@ -381120,10 +377373,10 @@ rule SIGNATURE_BASE_CN_Honker_Hkmjjiis6 : FILE
 		date = "2015-06-23"
 		modified = "2023-01-27"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1701-L1718"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1701-L1718"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
-		logic_hash = "a087b9731444152b717e0fbae557004d94f3fb69a4ec65aa38b7a3dab3e3cddf"
+		logic_hash = "v1_sha256_a087b9731444152b717e0fbae557004d94f3fb69a4ec65aa38b7a3dab3e3cddf"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381135,7 +377388,7 @@ rule SIGNATURE_BASE_CN_Honker_Hkmjjiis6 : FILE
 		$s20 = "LookupAcc=Sid#" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <175KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 175KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Clearlogs : FILE
 {
@@ -381146,10 +377399,10 @@ rule SIGNATURE_BASE_CN_Honker_Clearlogs : FILE
 		date = "2015-06-23"
 		modified = "2023-01-27"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1720-L1736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1720-L1736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "490f3bc318f415685d7e32176088001679b0da1b"
-		logic_hash = "ed961d2850ba86743177976a4516e7d4a8b90b7e8f180c03f5dbbcc794ad1084"
+		logic_hash = "v1_sha256_ed961d2850ba86743177976a4516e7d4a8b90b7e8f180c03f5dbbcc794ad1084"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381160,7 +377413,7 @@ rule SIGNATURE_BASE_CN_Honker_Clearlogs : FILE
 		$s4 = "Error: Unable to clear log - " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <140KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 140KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_No_Net_Priv_Esc_Adduser : FILE
 {
@@ -381171,10 +377424,10 @@ rule SIGNATURE_BASE_CN_Honker_No_Net_Priv_Esc_Adduser : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1738-L1754"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1738-L1754"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4c95046be6ae40aee69a433e9a47f824598db2d4"
-		logic_hash = "743e67e2aa95830034db1afda1f346c30467c7b59e030ed27415e5127013be74"
+		logic_hash = "v1_sha256_743e67e2aa95830034db1afda1f346c30467c7b59e030ed27415e5127013be74"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381186,7 +377439,7 @@ rule SIGNATURE_BASE_CN_Honker_No_Net_Priv_Esc_Adduser : FILE
 		$s5 = "OagaBoxA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <115KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 115KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Injection : FILE
 {
@@ -381197,10 +377450,10 @@ rule SIGNATURE_BASE_CN_Honker_Injection : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1756-L1771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1756-L1771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
-		logic_hash = "8de3e59bd118fbbf1a012c6bfb358dba7c8fb758e3ac17277f2ad3a92c0284ba"
+		logic_hash = "v1_sha256_8de3e59bd118fbbf1a012c6bfb358dba7c8fb758e3ac17277f2ad3a92c0284ba"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381211,7 +377464,7 @@ rule SIGNATURE_BASE_CN_Honker_Injection : FILE
 		$s7 = "jmPost.asp" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 220KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sqlserver_Inject_Creaked : FILE
 {
@@ -381222,10 +377475,10 @@ rule SIGNATURE_BASE_CN_Honker_Sqlserver_Inject_Creaked : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1773-L1788"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1773-L1788"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "af3c41756ec8768483a4cf59b2e639994426e2c2"
-		logic_hash = "2a7e913a4b7bb6c1270d862108eae7ed3998114b672ca7fa19bd0b199fc27dc2"
+		logic_hash = "v1_sha256_2a7e913a4b7bb6c1270d862108eae7ed3998114b672ca7fa19bd0b199fc27dc2"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381236,7 +377489,7 @@ rule SIGNATURE_BASE_CN_Honker_Sqlserver_Inject_Creaked : FILE
 		$s2 = "Email:zhaoxypass@yahoo.com.cn<br>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8110KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 8110KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webscan_Webscan : FILE
 {
@@ -381247,10 +377500,10 @@ rule SIGNATURE_BASE_CN_Honker_Webscan_Webscan : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1790-L1805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1790-L1805"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a0b0e2422e0e9edb1aed6abb5d2e3d156b7c8204"
-		logic_hash = "a714fe90dce33180b8074e2c3a16fc1829ed2a7b387eb92aec8a147cff9e57a4"
+		logic_hash = "v1_sha256_a714fe90dce33180b8074e2c3a16fc1829ed2a7b387eb92aec8a147cff9e57a4"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381261,7 +377514,7 @@ rule SIGNATURE_BASE_CN_Honker_Webscan_Webscan : FILE
 		$s2 = "WWWScan Gui" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Gethashes_2 : FILE
 {
@@ -381272,10 +377525,10 @@ rule SIGNATURE_BASE_CN_Honker_Gethashes_2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1807-L1823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1807-L1823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "35ae9ccba8d607d8c19a065cf553070c54b091d8"
-		logic_hash = "778fde2c59d4523142c0ac5b5c953c9eedbbf3c00b406541c00c1aa1f1a9cc58"
+		logic_hash = "v1_sha256_778fde2c59d4523142c0ac5b5c953c9eedbbf3c00b406541c00c1aa1f1a9cc58"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381287,7 +377540,7 @@ rule SIGNATURE_BASE_CN_Honker_Gethashes_2 : FILE
 		$s3 = "The system key doesn't match SAM registry file!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them
 }
 rule SIGNATURE_BASE_SUSP_Patcher_Keygen_Indicators_Jun15 : FILE
 {
@@ -381298,10 +377551,10 @@ rule SIGNATURE_BASE_SUSP_Patcher_Keygen_Indicators_Jun15 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1825-L1841"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1825-L1841"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e32f5de730e324fb386f97b6da9ba500cf3a4f8d"
-		logic_hash = "07735c380cf34aaabd5cc0e1b38e32b3d4ad86b7bb184188d446df537f66775e"
+		logic_hash = "v1_sha256_07735c380cf34aaabd5cc0e1b38e32b3d4ad86b7bb184188d446df537f66775e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381313,7 +377566,7 @@ rule SIGNATURE_BASE_SUSP_Patcher_Keygen_Indicators_Jun15 : FILE
 		$s3 = "load_patcher" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_Oracle_2 : FILE
 {
@@ -381324,10 +377577,10 @@ rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_Oracle_2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1843-L1858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1843-L1858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "865dd591b552787eda18ee0ab604509bae18c197"
-		logic_hash = "627d81323266d67a2402367918b4f6e7277367c3eb027af57ac6966f2a49472c"
+		logic_hash = "v1_sha256_627d81323266d67a2402367918b4f6e7277367c3eb027af57ac6966f2a49472c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381338,7 +377591,7 @@ rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_Oracle_2 : FILE
 		$s1 = "Silic Group Hacker Army " fullword ascii
 
 	condition:
-		filesize <3KB and all of them
+		filesize < 3KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Net_Packet_Capt : FILE
 {
@@ -381349,10 +377602,10 @@ rule SIGNATURE_BASE_CN_Honker_Net_Packet_Capt : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1860-L1878"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1860-L1878"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2d45a2bd9e74cf14c1d93fff90c2b0665f109c52"
-		logic_hash = "b158199a27f1260da5f5c1a8e99bb1cc3d19fe2a10577cc5932f097ff39d4ef8"
+		logic_hash = "v1_sha256_b158199a27f1260da5f5c1a8e99bb1cc3d19fe2a10577cc5932f097ff39d4ef8"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381366,7 +377619,7 @@ rule SIGNATURE_BASE_CN_Honker_Net_Packet_Capt : FILE
 		$s5 = "PaneWyedit" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Cleaniislog : FILE
 {
@@ -381377,10 +377630,10 @@ rule SIGNATURE_BASE_CN_Honker_Cleaniislog : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1880-L1894"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1880-L1894"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
-		logic_hash = "35b428d6178196b0dc6ac2ea3f0ee1dfbf6a98ead2356cb2a35d3d6b780538cc"
+		logic_hash = "v1_sha256_35b428d6178196b0dc6ac2ea3f0ee1dfbf6a98ead2356cb2a35d3d6b780538cc"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381390,7 +377643,7 @@ rule SIGNATURE_BASE_CN_Honker_Cleaniislog : FILE
 		$s1 = "Usage: CleanIISLog <LogFile>|<.> <CleanIP>|<.>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_HASH_Pwhash : FILE
 {
@@ -381401,10 +377654,10 @@ rule SIGNATURE_BASE_CN_Honker_HASH_Pwhash : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1896-L1911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1896-L1911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "689056588f95749f0382d201fac8f58bac393e98"
-		logic_hash = "a77ae11c35dac3cfb1a2970460d4883feed7fbd3e8a860fa7facaad7ddcd1182"
+		logic_hash = "v1_sha256_a77ae11c35dac3cfb1a2970460d4883feed7fbd3e8a860fa7facaad7ddcd1182"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381415,7 +377668,7 @@ rule SIGNATURE_BASE_CN_Honker_HASH_Pwhash : FILE
 		$s2 = "quarks-pwdump.exe <options> <NTDS file>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Cleaner_Cl_2 : FILE
 {
@@ -381426,10 +377679,10 @@ rule SIGNATURE_BASE_CN_Honker_Cleaner_Cl_2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1913-L1928"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1913-L1928"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "523084e8975b16e255b56db9af0f9eecf174a2dd"
-		logic_hash = "865354152f8441009aaad9022f64c3a014c4df0549b648d66959df56893ab98a"
+		logic_hash = "v1_sha256_865354152f8441009aaad9022f64c3a014c4df0549b648d66959df56893ab98a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381440,7 +377693,7 @@ rule SIGNATURE_BASE_CN_Honker_Cleaner_Cl_2 : FILE
 		$s1 = "clear iislog error!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sqlmap_Python_Run : FILE
 {
@@ -381451,10 +377704,10 @@ rule SIGNATURE_BASE_CN_Honker_Sqlmap_Python_Run : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1930-L1946"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1930-L1946"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a51479a1c589f17c77d22f6cf90b97011c33145f"
-		logic_hash = "86d53a06e2f71b7ce7785c4c8ac017a4552b40c16d64474db4e22dbe1afd9e52"
+		logic_hash = "v1_sha256_86d53a06e2f71b7ce7785c4c8ac017a4552b40c16d64474db4e22dbe1afd9e52"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381466,7 +377719,7 @@ rule SIGNATURE_BASE_CN_Honker_Sqlmap_Python_Run : FILE
 		$s3 = "%sSqlmap %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Saminside : FILE
 {
@@ -381477,10 +377730,10 @@ rule SIGNATURE_BASE_CN_Honker_Saminside : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1948-L1963"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1948-L1963"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "707ba507f9a74d591f4f2e2f165ff9192557d6dd"
-		logic_hash = "8f095a554121e16b63fdd8d47d957665aed7a2a5885813fa78bc4cee3b8923d3"
+		logic_hash = "v1_sha256_8f095a554121e16b63fdd8d47d957665aed7a2a5885813fa78bc4cee3b8923d3"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381491,7 +377744,7 @@ rule SIGNATURE_BASE_CN_Honker_Saminside : FILE
 		$s1 = "SAMInside.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <650KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 650KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webscan_Wwwscan : FILE
 {
@@ -381502,10 +377755,10 @@ rule SIGNATURE_BASE_CN_Honker_Webscan_Wwwscan : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1965-L1981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1965-L1981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
-		logic_hash = "9d2eee1c1783a08a2eae86d4ea77bdb67db8cf0055a24d88ea09411e63018e8c"
+		logic_hash = "v1_sha256_9d2eee1c1783a08a2eae86d4ea77bdb67db8cf0055a24d88ea09411e63018e8c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381517,7 +377770,7 @@ rule SIGNATURE_BASE_CN_Honker_Webscan_Wwwscan : FILE
 		$s3 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sig_3389_2_3389 : FILE
 {
@@ -381528,10 +377781,10 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_2_3389 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L1983-L1999"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L1983-L1999"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "48d1974215e5cb07d1faa57e37afa91482b5a376"
-		logic_hash = "97e2a08dd391de44fc01c44ca6463aa009e93ad199a330eb99aaa809f14f2ef0"
+		logic_hash = "v1_sha256_97e2a08dd391de44fc01c44ca6463aa009e93ad199a330eb99aaa809f14f2ef0"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381543,7 +377796,7 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_2_3389 : FILE
 		$s3 = "\\Microsoft Word.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_PHP_Php11 : FILE
 {
@@ -381554,10 +377807,10 @@ rule SIGNATURE_BASE_CN_Honker_PHP_Php11 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2001-L2017"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2001-L2017"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dcc8226e7eb20e4d4bef9e263c14460a7ee5e030"
-		logic_hash = "d32b0540521a6b1d65c224bdee463813d72846c26f27326a092bdf3b90c3ae7c"
+		logic_hash = "v1_sha256_d32b0540521a6b1d65c224bdee463813d72846c26f27326a092bdf3b90c3ae7c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381569,7 +377822,7 @@ rule SIGNATURE_BASE_CN_Honker_PHP_Php11 : FILE
 		$s3 = "echo '[cPanel Found] '.$login.':'.$pass.\"  Success\\n\";" fullword ascii
 
 	condition:
-		filesize <800KB and all of them
+		filesize < 800KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Webcruiserwvs : FILE
 {
@@ -381580,10 +377833,10 @@ rule SIGNATURE_BASE_CN_Honker_Webcruiserwvs : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2019-L2034"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2019-L2034"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6c90a9ed4c8a141a343dab1b115cc840a7190304"
-		logic_hash = "dd37765488f07299048e9b8fc552120e76d628e0adcaf474fce9bfe60774a0c8"
+		logic_hash = "v1_sha256_dd37765488f07299048e9b8fc552120e76d628e0adcaf474fce9bfe60774a0c8"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381594,7 +377847,7 @@ rule SIGNATURE_BASE_CN_Honker_Webcruiserwvs : FILE
 		$s1 = "Created By WebCruiser - Web Vulnerability Scanner http://sec4app.com" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Hookmsgina : FILE
 {
@@ -381605,10 +377858,10 @@ rule SIGNATURE_BASE_CN_Honker_Hookmsgina : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2036-L2053"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2036-L2053"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f4d9b329b45fbcf6a3b9f29f2633d5d3d76c9f9d"
-		logic_hash = "1e268624a5f8df200ef1a03ce167f38feda59836a864e17297473ba223c5895a"
+		logic_hash = "v1_sha256_1e268624a5f8df200ef1a03ce167f38feda59836a864e17297473ba223c5895a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381621,7 +377874,7 @@ rule SIGNATURE_BASE_CN_Honker_Hookmsgina : FILE
 		$s4 = "Hookmsgina.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sig_3389_Xp3389 : FILE
 {
@@ -381632,10 +377885,10 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Xp3389 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2055-L2071"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2055-L2071"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d776eb7596803b5b94098334657667d34b60d880"
-		logic_hash = "7fd7947a802a65dfd63ece3fc6eaf2da8207e99276a9f6b1ff2c937cf4327945"
+		logic_hash = "v1_sha256_7fd7947a802a65dfd63ece3fc6eaf2da8207e99276a9f6b1ff2c937cf4327945"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381647,7 +377900,7 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Xp3389 : FILE
 		$s3 = "echo \"Tsenabled\"=dword:00000001 >> c:\\reg.reg" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Cookiesview : FILE
 {
@@ -381658,10 +377911,10 @@ rule SIGNATURE_BASE_CN_Honker_Cookiesview : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2073-L2089"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2073-L2089"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c54e1f16d79066edfa0f84e920ed1f4873958755"
-		logic_hash = "9711bb15f08c18ba068325d1cca0ded8e252ded4ceddfb134d1317ad8a19fbe8"
+		logic_hash = "v1_sha256_9711bb15f08c18ba068325d1cca0ded8e252ded4ceddfb134d1317ad8a19fbe8"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381673,7 +377926,7 @@ rule SIGNATURE_BASE_CN_Honker_Cookiesview : FILE
 		$s2 = "www.baidu.com" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <640KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 640KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_LPK : FILE
 {
@@ -381684,10 +377937,10 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_LPK : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2091-L2108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2091-L2108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
-		logic_hash = "a7382d61b53706ad51b36bc686a1c3f0018ee111bdc8ae9b05af144230dfbba3"
+		logic_hash = "v1_sha256_a7382d61b53706ad51b36bc686a1c3f0018ee111bdc8ae9b05af144230dfbba3"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381700,7 +377953,7 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_LPK : FILE
 		$s4 = "c:\\1.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Scanhistory : FILE
 {
@@ -381711,10 +377964,10 @@ rule SIGNATURE_BASE_CN_Honker_Scanhistory : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2110-L2126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2110-L2126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "14c31e238924ba3abc007dc5a3168b64d7b7de8d"
-		logic_hash = "657a25b5103799446fa88abda39d36a05e080c18d41e9dd98199b506f2bfc419"
+		logic_hash = "v1_sha256_657a25b5103799446fa88abda39d36a05e080c18d41e9dd98199b506f2bfc419"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381726,7 +377979,7 @@ rule SIGNATURE_BASE_CN_Honker_Scanhistory : FILE
 		$s3 = "select  * from  Results order by scandate desc" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Invasionerasor : FILE
 {
@@ -381737,10 +377990,10 @@ rule SIGNATURE_BASE_CN_Honker_Invasionerasor : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2128-L2146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2128-L2146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b37ecd9ee6b137a29c9b9d2801473a521b168794"
-		logic_hash = "d2f742693682e9409284706a3eb63536a576cb162629bf76bfabf2e0210984a3"
+		logic_hash = "v1_sha256_d2f742693682e9409284706a3eb63536a576cb162629bf76bfabf2e0210984a3"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381754,7 +378007,7 @@ rule SIGNATURE_BASE_CN_Honker_Invasionerasor : FILE
 		$s5 = "Win 2000" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Super_Injection1 : FILE
 {
@@ -381765,10 +378018,10 @@ rule SIGNATURE_BASE_CN_Honker_Super_Injection1 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2148-L2164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2148-L2164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8ff2df40c461f6c42b92b86095296187f2b59b14"
-		logic_hash = "11a3628b7c34a34dc37604430195e24063d3f0dd0889d6d782ce0ee42cafbb02"
+		logic_hash = "v1_sha256_11a3628b7c34a34dc37604430195e24063d3f0dd0889d6d782ce0ee42cafbb02"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381780,7 +378033,7 @@ rule SIGNATURE_BASE_CN_Honker_Super_Injection1 : FILE
 		$s4 = "ScanInject.log" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Pk_Pker : FILE
 {
@@ -381791,10 +378044,10 @@ rule SIGNATURE_BASE_CN_Honker_Pk_Pker : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2166-L2186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2166-L2186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "631787f27f27c46f79e58e1accfcc9ecfb4d3a2f"
-		logic_hash = "ea29bc82131751f0aaa4f10cc7576a27d243fb7dade03db7ae3dcb029b306505"
+		logic_hash = "v1_sha256_ea29bc82131751f0aaa4f10cc7576a27d243fb7dade03db7ae3dcb029b306505"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381810,7 +378063,7 @@ rule SIGNATURE_BASE_CN_Honker_Pk_Pker : FILE
 		$s7 = ".\\Report.dat" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and 5 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Getpass_Getpass : FILE
 {
@@ -381821,10 +378074,10 @@ rule SIGNATURE_BASE_CN_Honker_Getpass_Getpass : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2188-L2204"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2188-L2204"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
-		logic_hash = "90d802da512f5d460eda6d644660711601d361e2402522d085d3225931a3fca3"
+		logic_hash = "v1_sha256_90d802da512f5d460eda6d644660711601d361e2402522d085d3225931a3fca3"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381836,7 +378089,7 @@ rule SIGNATURE_BASE_CN_Honker_Getpass_Getpass : FILE
 		$s3 = "Key to EXIT ... & pause > nul" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_Blackmoon_Jun15 : FILE
 {
@@ -381848,10 +378101,10 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_Blackmoon_Jun15 : FILE
 		modified = "2023-12-05"
 		old_rule_name = "CN_Honker_F4ck_Team_f4ck_3"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2206-L2227"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2206-L2227"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7e3bf9b26df08cfa10f10e2283c6f21f5a3a0014"
-		logic_hash = "85db31c6bca6e5ddd45168a3adbc382d5a9e8128e0b2a6ed5efe1a2fcd42ff3d"
+		logic_hash = "v1_sha256_85db31c6bca6e5ddd45168a3adbc382d5a9e8128e0b2a6ed5efe1a2fcd42ff3d"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381867,7 +378120,7 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_Blackmoon_Jun15 : FILE
 		$s7 = "f4ck Team" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of them
 }
 rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_3 : FILE
 {
@@ -381878,10 +378131,10 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_3 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2229-L2248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2229-L2248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0b3e9381930f02e170e484f12233bbeb556f3731"
-		logic_hash = "870d22be85da127b3ebfd3f8ec547b6ad1cdc8048b56aea494e8d2643bd61d77"
+		logic_hash = "v1_sha256_870d22be85da127b3ebfd3f8ec547b6ad1cdc8048b56aea494e8d2643bd61d77"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381896,7 +378149,7 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_3 : FILE
 		$s11 = "F4ck Team" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them
 }
 rule SIGNATURE_BASE_CN_Honker_ACCESS_Brute : FILE
 {
@@ -381907,10 +378160,10 @@ rule SIGNATURE_BASE_CN_Honker_ACCESS_Brute : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2250-L2268"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2250-L2268"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f552e05facbeb21cb12f23c34bb1881c43e24c34"
-		logic_hash = "5bd0cbb1c2f5863ef1365dc115c736ade05c290cd6fa09a24c2d344314b522cb"
+		logic_hash = "v1_sha256_5bd0cbb1c2f5863ef1365dc115c736ade05c290cd6fa09a24c2d344314b522cb"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381924,7 +378177,7 @@ rule SIGNATURE_BASE_CN_Honker_ACCESS_Brute : FILE
 		$s5 = "WINDOWS\\Syswm" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Fpipe_Fpipe : FILE
 {
@@ -381935,10 +378188,10 @@ rule SIGNATURE_BASE_CN_Honker_Fpipe_Fpipe : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2270-L2286"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2270-L2286"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a2c51c6fa93a3dfa14aaf31fb1c48a3a66a32d11"
-		logic_hash = "bde46f2508dc82f91e39cc7bd88960e836522b068546ce65ebc07db69b3d4493"
+		logic_hash = "v1_sha256_bde46f2508dc82f91e39cc7bd88960e836522b068546ce65ebc07db69b3d4493"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -381950,7 +378203,7 @@ rule SIGNATURE_BASE_CN_Honker_Fpipe_Fpipe : FILE
 		$s3 = "%s %s port %d. Address is already in use" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Layer_Layer : FILE
 {
@@ -381961,10 +378214,10 @@ rule SIGNATURE_BASE_CN_Honker_Layer_Layer : FILE
 		date = "2015-06-23"
 		modified = "2022-12-21"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2288-L2305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2288-L2305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0f4f27e842787cb854bd61f9aca86a63f653eb41"
-		logic_hash = "03e2d875de6dc45a0cede55071c071944c4cdf4610f52fe4a21f6dd5dedac41d"
+		logic_hash = "v1_sha256_03e2d875de6dc45a0cede55071c071944c4cdf4610f52fe4a21f6dd5dedac41d"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -381976,7 +378229,7 @@ rule SIGNATURE_BASE_CN_Honker_Layer_Layer : FILE
 		$s3 = "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Ms10048_X86 : FILE
 {
@@ -381987,10 +378240,10 @@ rule SIGNATURE_BASE_CN_Honker_Ms10048_X86 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2307-L2321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2307-L2321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
-		logic_hash = "2f67b3be31b1d1eb420b40ec291db7271acd692af9f061d5db17415685cf7546"
+		logic_hash = "v1_sha256_2f67b3be31b1d1eb420b40ec291db7271acd692af9f061d5db17415685cf7546"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -382000,7 +378253,7 @@ rule SIGNATURE_BASE_CN_Honker_Ms10048_X86 : FILE
 		$s1 = "[+] Set to %d exploit half succeeded" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Htran2_4 : FILE
 {
@@ -382011,10 +378264,10 @@ rule SIGNATURE_BASE_CN_Honker_Htran2_4 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2323-L2338"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2323-L2338"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "524f986692f55620013ab5a06bf942382e64d38a"
-		logic_hash = "dd1332d3dca12513b1f8a1d10148f6fa2eb7cc809ac7cf6f4dcc9090746718b5"
+		logic_hash = "v1_sha256_dd1332d3dca12513b1f8a1d10148f6fa2eb7cc809ac7cf6f4dcc9090746718b5"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -382025,7 +378278,7 @@ rule SIGNATURE_BASE_CN_Honker_Htran2_4 : FILE
 		$s2 = "[+] New connection %s:%d !!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 180KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Skinhrootkit_Skinh : FILE
 {
@@ -382036,10 +378289,10 @@ rule SIGNATURE_BASE_CN_Honker_Skinhrootkit_Skinh : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2340-L2356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2340-L2356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d593f03ae06e54b653c7850c872c0eed459b301f"
-		logic_hash = "97314a8c908c714c39ea8962c87709fdc422c3e2998a2b1694950fa127204335"
+		logic_hash = "v1_sha256_97314a8c908c714c39ea8962c87709fdc422c3e2998a2b1694950fa127204335"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -382051,7 +378304,7 @@ rule SIGNATURE_BASE_CN_Honker_Skinhrootkit_Skinh : FILE
 		$s2 = "skinh.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker__Postgresql_Mysql_Injectv1_1_Creak_Oracle_Sqlserver_Inject_Creaked : FILE
 {
@@ -382062,9 +378315,9 @@ rule SIGNATURE_BASE_CN_Honker__Postgresql_Mysql_Injectv1_1_Creak_Oracle_Sqlserve
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2358-L2378"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed809a5fb35d36b2a8758e470657bda1a04d80577d5129962cd7d0ab9a80cf8a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2358-L2378"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed809a5fb35d36b2a8758e470657bda1a04d80577d5129962cd7d0ab9a80cf8a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -382081,7 +378334,7 @@ rule SIGNATURE_BASE_CN_Honker__Postgresql_Mysql_Injectv1_1_Creak_Oracle_Sqlserve
 		$s3 = "ProxyParams.ProxyPort" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_CN_Honker__Wwwscan_Wwwscan_Wwwscan_Gui : FILE
 {
@@ -382092,9 +378345,9 @@ rule SIGNATURE_BASE_CN_Honker__Wwwscan_Wwwscan_Wwwscan_Gui : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2380-L2398"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0fd6ab38dca839605c1b7cd51a4a8d3268551f0725ccee7c7521f13d6f9e7076"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2380-L2398"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0fd6ab38dca839605c1b7cd51a4a8d3268551f0725ccee7c7521f13d6f9e7076"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -382109,7 +378362,7 @@ rule SIGNATURE_BASE_CN_Honker__Wwwscan_Wwwscan_Wwwscan_Gui : FILE
 		$s2 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker__LPK_LPK_LPK : FILE
 {
@@ -382120,9 +378373,9 @@ rule SIGNATURE_BASE_CN_Honker__LPK_LPK_LPK : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2400-L2421"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0309241ed0e899519cf3edd1544a14d09fff4a8162514ae49b3a6b70eda1ed4f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2400-L2421"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0309241ed0e899519cf3edd1544a14d09fff4a8162514ae49b3a6b70eda1ed4f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -382140,7 +378393,7 @@ rule SIGNATURE_BASE_CN_Honker__LPK_LPK_LPK : FILE
 		$s5 = "\\lpksethc.bat" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1057KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1057KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker__Builder_Shift_Skinh : FILE
 {
@@ -382151,9 +378404,9 @@ rule SIGNATURE_BASE_CN_Honker__Builder_Shift_Skinh : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2423-L2444"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d15802df98d72b4ef3bac2dfb8ba3338c540ef7290d7ddf9738cf0f7b86e17ea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2423-L2444"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d15802df98d72b4ef3bac2dfb8ba3338c540ef7290d7ddf9738cf0f7b86e17ea"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -382171,7 +378424,7 @@ rule SIGNATURE_BASE_CN_Honker__Builder_Shift_Skinh : FILE
 		$s5 = "prog3am" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6075KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 6075KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker__Lcx_Htran2_4_Htran20 : FILE
 {
@@ -382182,9 +378435,9 @@ rule SIGNATURE_BASE_CN_Honker__Lcx_Htran2_4_Htran20 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2446-L2465"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "30184394ad3ec7bf209bb0a22da889699bac6167ecc09e693c88f8643c754394"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2446-L2465"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_30184394ad3ec7bf209bb0a22da889699bac6167ecc09e693c88f8643c754394"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -382200,7 +378453,7 @@ rule SIGNATURE_BASE_CN_Honker__Lcx_Htran2_4_Htran20 : FILE
 		$s3 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <440KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 440KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker__D_Injection_V2_32_D_Injection_V2_32_D_Injection_V2_32 : FILE
 {
@@ -382211,9 +378464,9 @@ rule SIGNATURE_BASE_CN_Honker__D_Injection_V2_32_D_Injection_V2_32_D_Injection_V
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_tools.yar#L2467-L2488"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5c318c670b3aedf66da1c6444df7d630d2263e88527facfcf75d76dd974e7d31"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_tools.yar#L2467-L2488"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5c318c670b3aedf66da1c6444df7d630d2263e88527facfcf75d76dd974e7d31"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -382231,7 +378484,7 @@ rule SIGNATURE_BASE_CN_Honker__D_Injection_V2_32_D_Injection_V2_32_D_Injection_V
 		$s5 = "http://d99net.3322.org" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 10000KB and 4 of them
 }
 import "pe"
 
@@ -382244,9 +378497,9 @@ rule SIGNATURE_BASE_KHRAT_Malware : FILE
 		date = "2017-08-31"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_khrat.yar#L13-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cfc1a9fb4dbec4deb70616ab7c4cce3cf56429f61fd36f78245621527d011e20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_khrat.yar#L13-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cfc1a9fb4dbec4deb70616ab7c4cce3cf56429f61fd36f78245621527d011e20"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382254,10 +378507,8 @@ rule SIGNATURE_BASE_KHRAT_Malware : FILE
 		hash1 = "53e27fd13f26462a58fa5587ecd244cab4da23aa80cf0ed6eb5ee9f9de2688c1"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="6a8478ad861f98f8428a042f74de1944"
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and pe.imphash ( ) == "6a8478ad861f98f8428a042f74de1944"
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_KHRAT_Script
 {
 	meta:
@@ -382267,9 +378518,9 @@ rule SIGNATURE_BASE_MAL_KHRAT_Script
 		date = "2017-08-31"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_khrat.yar#L26-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c27a89028794b50b95850d90ee29b56606e6b58b862a26e287077e7f7be7f096"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_khrat.yar#L26-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c27a89028794b50b95850d90ee29b56606e6b58b862a26e287077e7f7be7f096"
 		score = 75
 		quality = 85
 		tags = ""
@@ -382284,8 +378535,6 @@ rule SIGNATURE_BASE_MAL_KHRAT_Script
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_KHRAT_Scritplet : FILE
 {
 	meta:
@@ -382295,9 +378544,9 @@ rule SIGNATURE_BASE_MAL_KHRAT_Scritplet : FILE
 		date = "2017-08-31"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_khrat.yar#L43-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cbbabd8e2f17827d96aeef4ea362f133cf3fcc31716c517b86a05a010ff62510"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_khrat.yar#L43-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cbbabd8e2f17827d96aeef4ea362f133cf3fcc31716c517b86a05a010ff62510"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382313,7 +378562,7 @@ rule SIGNATURE_BASE_MAL_KHRAT_Scritplet : FILE
 		$s4 = "'WScript.Echo http.responseText " fullword ascii
 
 	condition:
-		uint16(0)==0x3f3c and filesize <1KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x3f3c and filesize < 1KB and ( 1 of ( $x* ) or 4 of them )
 }
 rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_CVE_2021_22205 : CVE_2021_22205
 {
@@ -382324,9 +378573,9 @@ rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_CVE_2021_22205 : CVE_2021_22205
 		date = "2021-10-26"
 		modified = "2023-12-05"
 		reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_gitlab_cve_2021_22205.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "54b841716a6bd56706c1c38fcda9a27ffd7feba2660602b191e8e347983e578d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_gitlab_cve_2021_22205.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_54b841716a6bd56706c1c38fcda9a27ffd7feba2660602b191e8e347983e578d"
 		score = 70
 		quality = 85
 		tags = "CVE-2021-22205"
@@ -382343,7 +378592,7 @@ rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_CVE_2021_22205 : CVE_2021_22205
 		$sc3 = "1c2VyLnNhdmUh" ascii
 
 	condition:
-		1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
+		1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* )
 }
 rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_Malformed_JPG_CVE_2021_22204 : CVE_2021_22204 CVE_2021_22205 FILE
 {
@@ -382354,9 +378603,9 @@ rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_Malformed_JPG_CVE_2021_22204 : CVE_2021_2
 		date = "2021-10-26"
 		modified = "2023-12-05"
 		reference = "https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=blog"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_gitlab_cve_2021_22205.yar#L29-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0718ad24337acbb746c6e0d7e0b42d2d034ff583ec6fd12b34fda4737d7e78b0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_gitlab_cve_2021_22205.yar#L29-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0718ad24337acbb746c6e0d7e0b42d2d034ff583ec6fd12b34fda4737d7e78b0"
 		score = 70
 		quality = 83
 		tags = "CVE-2021-22204, CVE-2021-22205, FILE"
@@ -382366,7 +378615,7 @@ rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_Malformed_JPG_CVE_2021_22204 : CVE_2021_2
 		$sr1 = /\(metadata[\s]{0,3}\([A-Za-z]{1,20} "\\/
 
 	condition:
-		filesize <10KB and $h1 and $sr1
+		filesize < 10KB and $h1 and $sr1
 }
 rule SIGNATURE_BASE_MAL_CRIME_Suspicious_Hex_String_Jun21_1 : CRIME PE FILE
 {
@@ -382377,9 +378626,9 @@ rule SIGNATURE_BASE_MAL_CRIME_Suspicious_Hex_String_Jun21_1 : CRIME PE FILE
 		date = "2021-06-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_crime_unknown.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "73144b14f3aa1a1d82df7710fa47049426bfbddeef75e85c8a0a559ad6ed05a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_crime_unknown.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_73144b14f3aa1a1d82df7710fa47049426bfbddeef75e85c8a0a559ad6ed05a3"
 		score = 65
 		quality = 85
 		tags = "CRIME, PE, FILE"
@@ -382393,7 +378642,7 @@ rule SIGNATURE_BASE_MAL_CRIME_Suspicious_Hex_String_Jun21_1 : CRIME PE FILE
 		$a1 = "07032114130C0812141104170C0412147F6A6A0C041F321104130C0412141104030C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141122130C0412146423272A711221112B1C042734170408622513143D20262B0F323038692B312003271C170B3A2F286623340610241F001729210579223202642200087C071C17742417020620141462060F12141104130C0412141214001C0412011100160C0C002D2412130C0412141104130C04121A11041324001F140122130C0134171" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10MB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 10MB and all of them
 }
 rule SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1 : LNK POWERSHELL FILE
 {
@@ -382404,9 +378653,9 @@ rule SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1 : LNK POWERSHELL FILE
 		date = "2021-06-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_crime_unknown.yar#L18-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "460e764cbd9fbfa1a2156059d0042a0bea5a939d501050a733a789d236015d37"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_crime_unknown.yar#L18-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_460e764cbd9fbfa1a2156059d0042a0bea5a939d501050a733a789d236015d37"
 		score = 75
 		quality = 85
 		tags = "LNK, POWERSHELL, FILE"
@@ -382420,7 +378669,7 @@ rule SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1 : LNK POWERSHELL FILE
 		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
 
 	condition:
-		uint16(0)==0x004c and all of them
+		uint16( 0 ) == 0x004c and all of them
 }
 rule SIGNATURE_BASE_MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK FILE
 {
@@ -382431,9 +378680,9 @@ rule SIGNATURE_BASE_MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK FILE
 		date = "2021-06-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_crime_unknown.yar#L35-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49b61f498d3f4ee249d9687277e581a39e08ebb4e1a293170058fb5f770bde1f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_crime_unknown.yar#L35-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49b61f498d3f4ee249d9687277e581a39e08ebb4e1a293170058fb5f770bde1f"
 		score = 75
 		quality = 85
 		tags = "ISO, POWERSHELL, LNK, FILE"
@@ -382447,7 +378696,7 @@ rule SIGNATURE_BASE_MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK FILE
 		$magic = "CD001" ascii
 
 	condition:
-		filesize <5MB and all of them
+		filesize < 5MB and all of them
 }
 rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core_PDF : FILE
 {
@@ -382458,9 +378707,9 @@ rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core_PDF : FILE
 		date = "2015-01-22"
 		modified = "2023-12-05"
 		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbug.yar#L3-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a854926a4a98eb1d13a582b4ff4504b9740b8bbe7aa6b5192aeb4d2438a58926"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbug.yar#L3-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a854926a4a98eb1d13a582b4ff4504b9740b8bbe7aa6b5192aeb4d2438a58926"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -382470,7 +378719,7 @@ rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core_PDF : FILE
 		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
 
 	condition:
-		uint32(0)==0x46445025 and #a>150 and #b>200
+		uint32( 0 ) == 0x46445025 and #a > 150 and #b > 200
 }
 rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Dll
 {
@@ -382481,9 +378730,9 @@ rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Dll
 		date = "2015-01-22"
 		modified = "2023-12-05"
 		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbug.yar#L17-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f29ff81d62bd6bea776aeddc0725b034624f836c234441f63a8b697e959d3f8d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbug.yar#L17-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f29ff81d62bd6bea776aeddc0725b034624f836c234441f63a8b697e959d3f8d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -382506,9 +378755,9 @@ rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core : FILE
 		date = "2015-01-22"
 		modified = "2023-01-27"
 		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbug.yar#L34-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "59e1363225b1f7765e953e3d6803270b82f4268431d92ef00ed1010df0793e5f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbug.yar#L34-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_59e1363225b1f7765e953e3d6803270b82f4268431d92ef00ed1010df0793e5f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382520,7 +378769,7 @@ rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core : FILE
 		$code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
 
 	condition:
-		uint16(0)==0x5A4D and (($code1 or $code2) or ($code3 and $code4))
+		uint16( 0 ) == 0x5A4D and ( ( $code1 or $code2 ) or ( $code3 and $code4 ) )
 }
 rule SIGNATURE_BASE_Waterbug_Turla_Dropper
 {
@@ -382531,9 +378780,9 @@ rule SIGNATURE_BASE_Waterbug_Turla_Dropper
 		date = "2015-01-22"
 		modified = "2023-12-05"
 		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbug.yar#L50-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6836b8d28fb41d9459f24d22e3c428b022b26885b7dce1caa5b0d5a7a1b7f82b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbug.yar#L50-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6836b8d28fb41d9459f24d22e3c428b022b26885b7dce1caa5b0d5a7a1b7f82b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -382554,9 +378803,9 @@ rule SIGNATURE_BASE_Waterbug_Fa_Malware : FILE
 		date = "2015-01-22"
 		modified = "2023-01-27"
 		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbug.yar#L64-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b3ac0d69551f27c7f81e24eb00e110639d4b31c8581dfee82715d65528b09632"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbug.yar#L64-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b3ac0d69551f27c7f81e24eb00e110639d4b31c8581dfee82715d65528b09632"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382570,7 +378819,7 @@ rule SIGNATURE_BASE_Waterbug_Fa_Malware : FILE
 		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($string*))
+		uint16( 0 ) == 0x5A4D and ( any of ( $string* ) )
 }
 rule SIGNATURE_BASE_Waterbug_Sav : FILE
 {
@@ -382581,9 +378830,9 @@ rule SIGNATURE_BASE_Waterbug_Sav : FILE
 		date = "2015-01-22"
 		modified = "2023-01-27"
 		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbug.yar#L114-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c8622ac6cb1f0b9965fe6ee1a4860f19d8b0dc1c586e2a3771420b8d78648066"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbug.yar#L114-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c8622ac6cb1f0b9965fe6ee1a4860f19d8b0dc1c586e2a3771420b8d78648066"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382595,7 +378844,7 @@ rule SIGNATURE_BASE_Waterbug_Sav : FILE
 		$code2 = { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
 
 	condition:
-		uint16(0)==0x5A4D and (($code1a or $code1b or $code1c) and $code2)
+		uint16( 0 ) == 0x5A4D and ( ( $code1a or $code1b or $code1c ) and $code2 )
 }
 rule SIGNATURE_BASE_LOG_Proxynotshell_POC_CVE_2022_41040_Nov22 : CVE_2022_41040 CVE_2022_41082
 {
@@ -382606,9 +378855,9 @@ rule SIGNATURE_BASE_LOG_Proxynotshell_POC_CVE_2022_41040_Nov22 : CVE_2022_41040
 		date = "2022-11-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/testanull/ProxyNotShell-PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_proxynotshell_cve_2022_41040.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7f91502fd9c59180970fc4253134582b44ba318db03ef4eb575257b2f3818d94"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_proxynotshell_cve_2022_41040.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7f91502fd9c59180970fc4253134582b44ba318db03ef4eb575257b2f3818d94"
 		score = 70
 		quality = 85
 		tags = "CVE-2022-41040, CVE-2022-41082"
@@ -382621,7 +378870,7 @@ rule SIGNATURE_BASE_LOG_Proxynotshell_POC_CVE_2022_41040_Nov22 : CVE_2022_41040
 		$s02 = "/autodiscover/admin@localhost/" ascii wide
 
 	condition:
-		1 of ($aa*) and $ab1 and 1 of ($s*)
+		1 of ( $aa* ) and $ab1 and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_Invoke_Mimikittenz : FILE
 {
@@ -382632,9 +378881,9 @@ rule SIGNATURE_BASE_Invoke_Mimikittenz : FILE
 		date = "2016-07-19"
 		modified = "2023-12-05"
 		reference = "https://github.com/putterpanda/mimikittenz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikittenz.yar#L10-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f0410a0290d09d3574854b55ffe578f6f799368e14677b581cd65d18700a8656"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikittenz.yar#L10-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f0410a0290d09d3574854b55ffe578f6f799368e14677b581cd65d18700a8656"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -382649,7 +378898,7 @@ rule SIGNATURE_BASE_Invoke_Mimikittenz : FILE
 		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <60KB and 2 of them ) or $x1
+		( uint16( 0 ) == 0x7566 and filesize < 60KB and 2 of them ) or $x1
 }
 rule SIGNATURE_BASE_Reveal_Memorycredentials : FILE
 {
@@ -382660,10 +378909,10 @@ rule SIGNATURE_BASE_Reveal_Memorycredentials : FILE
 		date = "2015-08-31"
 		modified = "2023-12-05"
 		reference = "https://github.com/giMini/RWMC/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rwmc_powershell_creddump.yar#L8-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rwmc_powershell_creddump.yar#L8-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "893c26818c424d0ff549c1fbfa11429f36eecd16ee69330c442c59a82ce6adea"
-		logic_hash = "d740462aacd3b30d0258d018344642683fefd43ef033dd7f5bdde2bdddce4115"
+		logic_hash = "v1_sha256_d740462aacd3b30d0258d018344642683fefd43ef033dd7f5bdde2bdddce4115"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382676,7 +378925,7 @@ rule SIGNATURE_BASE_Reveal_Memorycredentials : FILE
 		$s4 = "if($backupOperatorsFlag -eq \"true\") {$loginPlainText = $loginPlainText + \" = Backup Operators\"}            " fullword ascii
 
 	condition:
-		filesize <200KB and 1 of them
+		filesize < 200KB and 1 of them
 }
 rule SIGNATURE_BASE_Minidumptest_Msdsc : FILE
 {
@@ -382687,10 +378936,10 @@ rule SIGNATURE_BASE_Minidumptest_Msdsc : FILE
 		date = "2015-08-31"
 		modified = "2023-12-05"
 		reference = "https://github.com/giMini/RWMC/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rwmc_powershell_creddump.yar#L26-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rwmc_powershell_creddump.yar#L26-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "477034933918c433f521ba63d2df6a27cc40a5833a78497c11fb0994d2fd46ba"
-		logic_hash = "ae8a28df245a8f7a2d62639789c31556b012322fcac09784595fd6f95d6bf195"
+		logic_hash = "v1_sha256_ae8a28df245a8f7a2d62639789c31556b012322fcac09784595fd6f95d6bf195"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -382703,7 +378952,7 @@ rule SIGNATURE_BASE_Minidumptest_Msdsc : FILE
 		$s6 = "Microsoft 2008" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
 }
 import "pe"
 
@@ -382716,9 +378965,9 @@ rule SIGNATURE_BASE_MAL_Gandcrab_Apr18_1 : FILE
 		date = "2018-04-23"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/MarceloRivero/status/988455516094550017"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mal_grandcrab.yar#L3-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "70fc8deb91126a7404095aaa512e9b7542fe8605f83a037a10f8ccff76c27d4f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mal_grandcrab.yar#L3-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_70fc8deb91126a7404095aaa512e9b7542fe8605f83a037a10f8ccff76c27d4f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382726,7 +378975,7 @@ rule SIGNATURE_BASE_MAL_Gandcrab_Apr18_1 : FILE
 		hash1 = "6fafe7bb56fd2696f2243fc305fe0c38f550dffcfc5fca04f70398880570ffff"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and pe.imphash()=="7936b0e9491fd747bf2675a7ec8af8ba"
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and pe.imphash ( ) == "7936b0e9491fd747bf2675a7ec8af8ba"
 }
 rule SIGNATURE_BASE_Zeus_Panda : FILE
 {
@@ -382737,9 +378986,9 @@ rule SIGNATURE_BASE_Zeus_Panda : FILE
 		date = "2017-08-04"
 		modified = "2023-12-05"
 		reference = "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_zeus_panda.yar#L11-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "63312763196259204dcee6b6c46ae1a16abeab0afabbce9e2e8413131856b04e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_zeus_panda.yar#L11-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_63312763196259204dcee6b6c46ae1a16abeab0afabbce9e2e8413131856b04e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382758,7 +379007,7 @@ rule SIGNATURE_BASE_Zeus_Panda : FILE
 		$s6 = "%s%08x.%s" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (2 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 2 of ( $x* ) or 4 of them )
 }
 rule SIGNATURE_BASE_Sofacy_Malware_Strangespaces : FILE
 {
@@ -382769,9 +379018,9 @@ rule SIGNATURE_BASE_Sofacy_Malware_Strangespaces : FILE
 		date = "2015-12-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_dec15.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ee8bbebaa0978d038424cee3775ba312476afa014ce0d57c73d6844f758116ca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_dec15.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ee8bbebaa0978d038424cee3775ba312476afa014ce0d57c73d6844f758116ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382784,7 +379033,7 @@ rule SIGNATURE_BASE_Sofacy_Malware_Strangespaces : FILE
 		$s5 = " Microsoft Corporation. All rights reserved.               " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and 3 of them
 }
 rule SIGNATURE_BASE_Sofacy_Malware_AZZY_Backdoor_1 : FILE
 {
@@ -382795,10 +379044,10 @@ rule SIGNATURE_BASE_Sofacy_Malware_AZZY_Backdoor_1 : FILE
 		date = "2015-12-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_dec15.yar#L25-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_dec15.yar#L25-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
-		logic_hash = "9c99f218d856d374423cada147bc38c8319f9ebff1e43e012143fad7af992d29"
+		logic_hash = "v1_sha256_9c99f218d856d374423cada147bc38c8319f9ebff1e43e012143fad7af992d29"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382810,7 +379059,7 @@ rule SIGNATURE_BASE_Sofacy_Malware_AZZY_Backdoor_1 : FILE
 		$s2 = "Windows Advanced Storage Shell Extension DLL" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them
 }
 rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Implant_1 : FILE
 {
@@ -382821,10 +379070,10 @@ rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Implant_1 : FILE
 		date = "2015-12-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_dec15.yar#L42-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_dec15.yar#L42-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
-		logic_hash = "b6ddf1274ed78db0c7183e3cc8063c01e4d011bc2947ec05449f3fd0df2050e7"
+		logic_hash = "v1_sha256_b6ddf1274ed78db0c7183e3cc8063c01e4d011bc2947ec05449f3fd0df2050e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382838,7 +379087,7 @@ rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Implant_1 : FILE
 		$s5 = "?k@@YGPAUHINSTANCE__@@PBD@Z" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them
 }
 rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Helperdll : FILE
 {
@@ -382849,10 +379098,10 @@ rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Helperdll : FILE
 		date = "2015-12-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_dec15.yar#L61-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_dec15.yar#L61-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
-		logic_hash = "100903551eeacf4266fc97a09949bdafe05e94698bed7cea295c8e970df22ec8"
+		logic_hash = "v1_sha256_100903551eeacf4266fc97a09949bdafe05e94698bed7cea295c8e970df22ec8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382864,7 +379113,7 @@ rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Helperdll : FILE
 		$s2 = "SendData"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen1 : FILE
 {
@@ -382875,9 +379124,9 @@ rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen1 : FILE
 		date = "2015-12-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_dec15.yar#L80-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1b6693fa45fed5ed001d8fb4b43427c7036d95cb36b125e7242864d000085018"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_dec15.yar#L80-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1b6693fa45fed5ed001d8fb4b43427c7036d95cb36b125e7242864d000085018"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382892,7 +379141,7 @@ rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen1 : FILE
 		$s2 = "NvStart" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen2 : FILE
 {
@@ -382903,12 +379152,12 @@ rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen2 : FILE
 		date = "2015-12-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_dec15.yar#L99-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_dec15.yar#L99-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
 		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
 		hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
-		logic_hash = "2086b4119bae17ec984665ea1e49d5f496a2cf6bf05ab507fe0cfb6e28039349"
+		logic_hash = "v1_sha256_2086b4119bae17ec984665ea1e49d5f496a2cf6bf05ab507fe0cfb6e28039349"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382920,7 +379169,7 @@ rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen2 : FILE
 		$s3 = "Delete Temp Folder Service" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
 }
 rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen3 : FILE
 {
@@ -382931,11 +379180,11 @@ rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen3 : FILE
 		date = "2015-12-04"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_dec15.yar#L118-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_dec15.yar#L118-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
 		hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
-		logic_hash = "8e7f56013629d8b4d0c7600552590e8073deb16d5b6dced11444c2110b88f387"
+		logic_hash = "v1_sha256_8e7f56013629d8b4d0c7600552590e8073deb16d5b6dced11444c2110b88f387"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -382953,7 +379202,7 @@ rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen3 : FILE
 		$b2 = "Microsoft Corporation                                       " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and ( all of ($s*) and ( all of ($a*) or all of ($b*)))
+		uint16( 0 ) == 0x5a4d and filesize < 150KB and ( all of ( $s* ) and ( all of ( $a* ) or all of ( $b* ) ) )
 }
 rule SIGNATURE_BASE_APT_Area1_SSF_Plugx
 {
@@ -382964,9 +379213,9 @@ rule SIGNATURE_BASE_APT_Area1_SSF_Plugx
 		date = "2018-12-19"
 		modified = "2023-12-05"
 		reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_area1_phishing_diplomacy.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a71f124f0c89c4b020f21d029d0d2997b2bea71526e83bcadffb67acc9cca8f7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_area1_phishing_diplomacy.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a71f124f0c89c4b020f21d029d0d2997b2bea71526e83bcadffb67acc9cca8f7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -383000,9 +379249,9 @@ rule SIGNATURE_BASE_APT_Area1_SSF_Googlesend_Strings : FILE
 		date = "2018-12-19"
 		modified = "2023-12-05"
 		reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_area1_phishing_diplomacy.yar#L29-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3a373ed63494b67883515c133bf5b0af3ab874397c7cb45c8399f12e35212be4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_area1_phishing_diplomacy.yar#L29-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3a373ed63494b67883515c133bf5b0af3ab874397c7cb45c8399f12e35212be4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383017,7 +379266,7 @@ rule SIGNATURE_BASE_APT_Area1_SSF_Googlesend_Strings : FILE
          23 0f ?? ?? ?? ?? ?? 51 52 6a 0a e8 ?? ?? ?? ?? 5a 59 eb c3 }
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
 rule SIGNATURE_BASE_Trojan_Win32_Adupib_1 : PLATINUM
 {
@@ -383028,10 +379277,10 @@ rule SIGNATURE_BASE_Trojan_Win32_Adupib_1 : PLATINUM
 		date = "2016-04-12"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ms_platinum.yara#L101-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ms_platinum.yara#L101-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
-		logic_hash = "4d93b6a041468b51763d9497acf3d01ee59ac05f1807a6b140c557ef96d26df9"
+		logic_hash = "v1_sha256_4d93b6a041468b51763d9497acf3d01ee59ac05f1807a6b140c557ef96d26df9"
 		score = 75
 		quality = 85
 		tags = "PLATINUM"
@@ -383058,9 +379307,9 @@ rule SIGNATURE_BASE_Bitpaymer_1
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "http://blog.morphisec.com/bitpaymer-ransomware-with-new-custom-packer-framework"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_crime_bitpaymer.yar#L1-L12"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c236794c04f0805d4611cfaf43369eeb4d0e65d6c697e6c5e6afd321fbca629"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_crime_bitpaymer.yar#L1-L12"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c236794c04f0805d4611cfaf43369eeb4d0e65d6c697e6c5e6afd321fbca629"
 		score = 75
 		quality = 85
 		tags = ""
@@ -383070,7 +379319,7 @@ rule SIGNATURE_BASE_Bitpaymer_1
 		$opcodes2 = {61 55 FF 54 B7 01 B0 FF C9 C3 CC 89 45 FC}
 
 	condition:
-		( uint16(0)==0x5a4d) and ($opcodes1 or $opcodes2)
+		( uint16( 0 ) == 0x5a4d ) and ( $opcodes1 or $opcodes2 )
 }
 rule SIGNATURE_BASE_SUSP_SFX_Runprogram_Wscript : FILE
 {
@@ -383081,9 +379330,9 @@ rule SIGNATURE_BASE_SUSP_SFX_Runprogram_Wscript : FILE
 		date = "2018-09-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_sfx.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d00d83d4b25d80d0ca44fe1c3f3cd33ae5539d2d79c84bfdfcc470669d4f78c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_sfx.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d00d83d4b25d80d0ca44fe1c3f3cd33ae5539d2d79c84bfdfcc470669d4f78c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383098,10 +379347,8 @@ rule SIGNATURE_BASE_SUSP_SFX_Runprogram_Wscript : FILE
 		$x1 = "RunProgram=\"wscript.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 10000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_318A_Rc4_Stack_Key_Fallchill : FILE
 {
 	meta:
@@ -383111,9 +379358,9 @@ rule SIGNATURE_BASE_TA17_318A_Rc4_Stack_Key_Fallchill : FILE
 		date = "2017-11-15"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_318A.yar#L10-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f284cb492ff5242d7bf577580fd95723ef7d3f109c7217a26bbefbbff7150255"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_318A.yar#L10-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f284cb492ff5242d7bf577580fd95723ef7d3f109c7217a26bbefbbff7150255"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383122,10 +379369,8 @@ rule SIGNATURE_BASE_TA17_318A_Rc4_Stack_Key_Fallchill : FILE
 		$stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $stack_key
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $stack_key
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_318A_Success_Fail_Codes_Fallchill : FILE
 {
 	meta:
@@ -383135,9 +379380,9 @@ rule SIGNATURE_BASE_TA17_318A_Success_Fail_Codes_Fallchill : FILE
 		date = "2017-11-15"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_318A.yar#L23-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "73f6b36554d83f7708e9468602e529c4865269d362ebeebf6b355ccf7c2a8686"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_318A.yar#L23-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_73f6b36554d83f7708e9468602e529c4865269d362ebeebf6b355ccf7c2a8686"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383149,7 +379394,7 @@ rule SIGNATURE_BASE_TA17_318A_Success_Fail_Codes_Fallchill : FILE
 		$f1 = { ba 5c 34 12 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and (($s0 and $f0) or ($s1 and $f1))
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and ( ( $s0 and $f0 ) or ( $s1 and $f1 ) )
 }
 import "pe"
 
@@ -383162,9 +379407,9 @@ rule SIGNATURE_BASE_Hiddencobra_Fallchill_1 : FILE
 		date = "2017-11-15"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_318A.yar#L51-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8e6215a81272ea457318dd83eff9e1902c5e1d1a124ff674b145f2dc5e4a3711"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_318A.yar#L51-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8e6215a81272ea457318dd83eff9e1902c5e1d1a124ff674b145f2dc5e4a3711"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383183,7 +379428,7 @@ rule SIGNATURE_BASE_Hiddencobra_Fallchill_1 : FILE
 		$e5 = "OkvmPilxvhhTlpvm" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="6135d9bc3591ae7bc72d070eadd31755" or 3 of ($s*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "6135d9bc3591ae7bc72d070eadd31755" or 3 of ( $s* ) or 4 of them )
 }
 import "pe"
 
@@ -383196,9 +379441,9 @@ rule SIGNATURE_BASE_Hiddencobra_Fallchill_2 : FILE
 		date = "2017-11-15"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_318A.yar#L79-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ab421bea251ed3fda4304cd180e5c31f7ae55d3d8b26d6cf5f1cf11bacee9b8d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_318A.yar#L79-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ab421bea251ed3fda4304cd180e5c31f7ae55d3d8b26d6cf5f1cf11bacee9b8d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383211,7 +379456,7 @@ rule SIGNATURE_BASE_Hiddencobra_Fallchill_2 : FILE
 		$s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="cb36dcb9909e29a38c387b8a87e7e4ed" or (2 of them ))
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "cb36dcb9909e29a38c387b8a87e7e4ed" or ( 2 of them ) )
 }
 rule SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 : FILE
 {
@@ -383222,9 +379467,9 @@ rule SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 : FILE
 		date = "2022-09-17"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cglyer/status/1570965878480719873"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_stealer_exfil_zip.yar#L2-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "197bb4b837cdd635f9340547b10a90c3a2a17f0113076c5ccbc0a91b7ae18eeb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_stealer_exfil_zip.yar#L2-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_197bb4b837cdd635f9340547b10a90c3a2a17f0113076c5ccbc0a91b7ae18eeb"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -383246,7 +379491,7 @@ rule SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 : FILE
 		$sb4 = "Wallets/" ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <5000KB and (2 of ($sa*) or 2 of ($sb*))
+		uint16( 0 ) == 0x4b50 and filesize < 5000KB and ( 2 of ( $sa* ) or 2 of ( $sb* ) )
 }
 rule SIGNATURE_BASE_Gen_Macro_Shellexecute_Action : FILE
 {
@@ -383257,9 +379502,9 @@ rule SIGNATURE_BASE_Gen_Macro_Shellexecute_Action : FILE
 		date = "2019-01-08"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ItsReallyNick/status/1091170625698316288"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_macro_ShellExecute_action.yar#L1-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "da40175579f7d76d10ad0188851f111ba5d875ce990b2940166dd28eac2a742d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_macro_ShellExecute_action.yar#L1-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_da40175579f7d76d10ad0188851f111ba5d875ce990b2940166dd28eac2a742d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383282,7 +379527,7 @@ rule SIGNATURE_BASE_Gen_Macro_Shellexecute_Action : FILE
 		$s4 = "GetObject" fullword
 
 	condition:
-		filesize <1MB and ( uint32be(0)==0x41747472 or uint32be(0)==0x61747472 or uint32be(0)==0x41545452) and all of ($s*) and ( all of ($com1*) or all of ($com2*))
+		filesize < 1MB and ( uint32be( 0 ) == 0x41747472 or uint32be( 0 ) == 0x61747472 or uint32be( 0 ) == 0x41545452 ) and all of ( $s* ) and ( all of ( $com1* ) or all of ( $com2* ) )
 }
 rule SIGNATURE_BASE_SUSP_Gobfuscate_May21 : FILE
 {
@@ -383293,9 +379538,9 @@ rule SIGNATURE_BASE_SUSP_Gobfuscate_May21 : FILE
 		date = "2021-05-14"
 		modified = "2024-04-02"
 		reference = "https://github.com/unixpickle/gobfuscate"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_gobfuscate.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f71078dd6354a482a2ead2f0d25f4172cd40e62440a70c2da7916b68f26909a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_gobfuscate.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f71078dd6354a482a2ead2f0d25f4172cd40e62440a70c2da7916b68f26909a3"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -383305,7 +379550,7 @@ rule SIGNATURE_BASE_SUSP_Gobfuscate_May21 : FILE
 		$s2 = { 0F B6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }
 
 	condition:
-		filesize <50MB and any of them
+		filesize < 50MB and any of them
 }
 rule SIGNATURE_BASE_Gen_Excel_Xor_Obfuscation_Velvetsweatshop : FILE
 {
@@ -383316,9 +379561,9 @@ rule SIGNATURE_BASE_Gen_Excel_Xor_Obfuscation_Velvetsweatshop : FILE
 		date = "2020-10-09"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/BouncyHat/status/1308896366782042113"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_excel_xor_obfuscation_velvetsweatshop.yar#L3-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c38d56199d34adfc98d8032321239ab20c6eaa8abcafd56f8e1cf24fd3a4094f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_excel_xor_obfuscation_velvetsweatshop.yar#L3-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c38d56199d34adfc98d8032321239ab20c6eaa8abcafd56f8e1cf24fd3a4094f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383332,7 +379577,7 @@ rule SIGNATURE_BASE_Gen_Excel_Xor_Obfuscation_Velvetsweatshop : FILE
 		$FilePass_XOR_Obfuscation_VelvetSweatshop = { 2F 00 06 00 00 00 59 B3 0A 9A }
 
 	condition:
-		uint32(0)==0xe011cfd0 and filesize <400KB and $olemarker at 0 and $FilePass_XOR_Obfuscation_VelvetSweatshop
+		uint32( 0 ) == 0xe011cfd0 and filesize < 400KB and $olemarker at 0 and $FilePass_XOR_Obfuscation_VelvetSweatshop
 }
 rule SIGNATURE_BASE_Office_Autoopen_Macro : FILE
 {
@@ -383343,9 +379588,9 @@ rule SIGNATURE_BASE_Office_Autoopen_Macro : FILE
 		date = "2015-05-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/general_officemacros.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "23c834828e7a9ea966e5d7247881bbbf9180b8f08297e36cd36d2ba5f621c70d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/general_officemacros.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_23c834828e7a9ea966e5d7247881bbbf9180b8f08297e36cd36d2ba5f621c70d"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -383363,7 +379608,7 @@ rule SIGNATURE_BASE_Office_Autoopen_Macro : FILE
 		$s2 = "Macros" wide fullword
 
 	condition:
-		( uint32be(0)==0xd0cf11e0 or uint32be(0)==0x504b0304) and all of ($s*) and filesize <300000
+		( uint32be( 0 ) == 0xd0cf11e0 or uint32be( 0 ) == 0x504b0304 ) and all of ( $s* ) and filesize < 300000
 }
 rule SIGNATURE_BASE_Office_As_MHTML : CVE_2012_0158 FILE
 {
@@ -383374,9 +379619,9 @@ rule SIGNATURE_BASE_Office_As_MHTML : CVE_2012_0158 FILE
 		date = "2015-05-28"
 		modified = "2023-12-05"
 		reference = "https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/general_officemacros.yar#L28-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d5836a9c627e2e6833ea9e27526c76c00fc1fcf1fca8ea10777aa6f4bcc25053"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/general_officemacros.yar#L28-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d5836a9c627e2e6833ea9e27526c76c00fc1fcf1fca8ea10777aa6f4bcc25053"
 		score = 40
 		quality = 85
 		tags = "CVE-2012-0158, FILE"
@@ -383393,7 +379638,7 @@ rule SIGNATURE_BASE_Office_As_MHTML : CVE_2012_0158 FILE
 		$x2 = "0M8R4KGxGuE" ascii
 
 	condition:
-		uint32be(0)==0x4d494d45 and all of ($s*) and 1 of ($x*)
+		uint32be( 0 ) == 0x4d494d45 and all of ( $s* ) and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_Docm_In_PDF : FILE
 {
@@ -383404,9 +379649,9 @@ rule SIGNATURE_BASE_Docm_In_PDF : FILE
 		date = "2017-05-15"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/general_officemacros.yar#L52-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "045cde0e8f9e0881c2caece7d5660e165aa67b43bed2ba6d4929951497d76494"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/general_officemacros.yar#L52-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_045cde0e8f9e0881c2caece7d5660e165aa67b43bed2ba6d4929951497d76494"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383418,7 +379663,7 @@ rule SIGNATURE_BASE_Docm_In_PDF : FILE
 		$a3 = "JavaScript" ascii fullword
 
 	condition:
-		uint32(0)==0x46445025 and all of them
+		uint32( 0 ) == 0x46445025 and all of them
 }
 rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_1 : FILE
 {
@@ -383429,9 +379674,9 @@ rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_1 : FILE
 		date = "2024-08-27"
 		modified = "2024-08-29"
 		reference = "https://x.com/ryanaraine/status/1828440883315999117"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_volttyphoon_versamem.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d21558eb6c8e700b8a4cb86fdaa5487179828152af68828e878397859d6d3952"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_volttyphoon_versamem.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d21558eb6c8e700b8a4cb86fdaa5487179828152af68828e878397859d6d3952"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383448,7 +379693,7 @@ rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_1 : FILE
 		$sb2 = {2f 75 73 72 2f 62 69 6e 2f 70 67 72 65 70 01 00 02 2d 66 01 00 25 6f 72 67 2e 61 70 61 63 68 65 2e 63 61 74 61 6c 69 6e 61 2e 73 74 61 72 74 75 70 2e 42 6f 6f 74 73 74 72 61 70 07}
 
 	condition:
-		filesize <5MB and (3 of them or all of ($sb*))
+		filesize < 5MB and ( 3 of them or all of ( $sb* ) )
 }
 rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_2 : FILE
 {
@@ -383457,11 +379702,11 @@ rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_2 : FILE
 		author = "Florian Roth"
 		id = "5ca598ed-5d0a-563d-a5e8-f8229af2c949"
 		date = "2024-08-29"
-		modified = "2024-08-29"
+		modified = "2024-12-12"
 		reference = "https://x.com/craiu/status/1828687700884336990"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_volttyphoon_versamem.yar#L26-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bdf3bf5130c51c1355f179704933ca473a702595c580642035c8d3b9aad5725"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_volttyphoon_versamem.yar#L27-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bdf3bf5130c51c1355f179704933ca473a702595c580642035c8d3b9aad5725"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -383472,7 +379717,7 @@ rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_2 : FILE
 		$x2 = "versa/vnms/ui/config/" ascii fullword
 
 	condition:
-		uint16(0)==0x4b50 and filesize <3000KB and 1 of them
+		uint16( 0 ) == 0x4b50 and filesize < 3000KB and 1 of them
 }
 rule SIGNATURE_BASE_EXP_Libre_Office_CVE_2018_16858 : CVE_2018_16858 FILE
 {
@@ -383483,10 +379728,10 @@ rule SIGNATURE_BASE_EXP_Libre_Office_CVE_2018_16858 : CVE_2018_16858 FILE
 		date = "2019-02-01"
 		modified = "2023-12-05"
 		reference = "https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2018_16858.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2018_16858.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "95a02b70c117947ff989e3e00868c2185142df9be751a3fefe21f18fa16a1a6f"
-		logic_hash = "6dd34350f24945ba5a594acae96dc00bb200841a645443a70a59006cea1db949"
+		logic_hash = "v1_sha256_6dd34350f24945ba5a594acae96dc00bb200841a645443a70a59006cea1db949"
 		score = 75
 		quality = 83
 		tags = "CVE-2018-16858, FILE"
@@ -383497,7 +379742,7 @@ rule SIGNATURE_BASE_EXP_Libre_Office_CVE_2018_16858 : CVE_2018_16858 FILE
 		$tag = {3c 6f 66 66 69 63 65 3a 64 6f 63 }
 
 	condition:
-		uint32be(0)==0x3c3f786d and $tag in (0..0100) and all of ($s*)
+		uint32be( 0 ) == 0x3c3f786d and $tag in ( 0 .. 0100 ) and all of ( $s* )
 }
 rule SIGNATURE_BASE_SUSP_RANSOMWARE_Indicator_Jul20 : FILE
 {
@@ -383508,9 +379753,9 @@ rule SIGNATURE_BASE_SUSP_RANSOMWARE_Indicator_Jul20 : FILE
 		date = "2020-07-28"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_generic.yar#L2-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3dd1b29f45afba16d58619416e0d420acd38fb8ae1fc846035229a27b9e5c9d9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_generic.yar#L2-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3dd1b29f45afba16d58619416e0d420acd38fb8ae1fc846035229a27b9e5c9d9"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -383538,7 +379783,7 @@ rule SIGNATURE_BASE_SUSP_RANSOMWARE_Indicator_Jul20 : FILE
 		$ = "DECRYPT FILES.txt" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1400KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1400KB and 1 of them
 }
 rule SIGNATURE_BASE_Emdivi_SFX : FILE
 {
@@ -383549,9 +379794,9 @@ rule SIGNATURE_BASE_Emdivi_SFX : FILE
 		date = "2015-08-20"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bluetermite_emdivi.yar#L9-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3257983c64c52f36b04e3fe7b12180a37531338349137d4df00fc6f704557b2e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bluetermite_emdivi.yar#L9-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3257983c64c52f36b04e3fe7b12180a37531338349137d4df00fc6f704557b2e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -383566,7 +379811,7 @@ rule SIGNATURE_BASE_Emdivi_SFX : FILE
 		$s3 = "Path=%temp%" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <740KB and (1 of ($x*) and all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 740KB and ( 1 of ( $x* ) and all of ( $s* ) )
 }
 rule SIGNATURE_BASE_Emdivi_Gen1 : FILE
 {
@@ -383577,9 +379822,9 @@ rule SIGNATURE_BASE_Emdivi_Gen1 : FILE
 		date = "2015-08-20"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bluetermite_emdivi.yar#L32-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e1895926f6327bf301b8618f9162cacb30ad96f181f197559d399675e2cd93c6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bluetermite_emdivi.yar#L32-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e1895926f6327bf301b8618f9162cacb30ad96f181f197559d399675e2cd93c6"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -383603,7 +379848,7 @@ rule SIGNATURE_BASE_Emdivi_Gen1 : FILE
 		$s8 = "/PROXY" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
 }
 rule SIGNATURE_BASE_Emdivi_Gen2 : FILE
 {
@@ -383614,9 +379859,9 @@ rule SIGNATURE_BASE_Emdivi_Gen2 : FILE
 		date = "2015-08-20"
 		modified = "2023-01-27"
 		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bluetermite_emdivi.yar#L62-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c40306d646c5bf8c3aff1bc697b81997b4d635ccf237775e2bea96b89f7fa001"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bluetermite_emdivi.yar#L62-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c40306d646c5bf8c3aff1bc697b81997b4d635ccf237775e2bea96b89f7fa001"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -383635,7 +379880,7 @@ rule SIGNATURE_BASE_Emdivi_Gen2 : FILE
 		$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1300KB and 6 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1300KB and 6 of them
 }
 rule SIGNATURE_BASE_MAL_Emdivi_Gen3 : FILE
 {
@@ -383646,9 +379891,9 @@ rule SIGNATURE_BASE_MAL_Emdivi_Gen3 : FILE
 		date = "2015-08-20"
 		modified = "2023-01-06"
 		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bluetermite_emdivi.yar#L87-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff89a0855481d723f23e0c00f6b6eaf912e6df3a7e9ebe4ff1e6ccf2b02f0888"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bluetermite_emdivi.yar#L87-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff89a0855481d723f23e0c00f6b6eaf912e6df3a7e9ebe4ff1e6ccf2b02f0888"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -383666,7 +379911,7 @@ rule SIGNATURE_BASE_MAL_Emdivi_Gen3 : FILE
 		$s9 = "APPDATA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <850KB and (($x1 and 1 of ($s*)) or (4 of ($s*)))
+		uint16( 0 ) == 0x5a4d and filesize < 850KB and ( ( $x1 and 1 of ( $s* ) ) or ( 4 of ( $s* ) ) )
 }
 rule SIGNATURE_BASE_Emdivi_Gen4 : FILE
 {
@@ -383677,9 +379922,9 @@ rule SIGNATURE_BASE_Emdivi_Gen4 : FILE
 		date = "2015-08-20"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bluetermite_emdivi.yar#L116-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9c1645023ceefdb849cf4b0e60de8c608bfd5e15d3aac6d16d68a36140a8ebed"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bluetermite_emdivi.yar#L116-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9c1645023ceefdb849cf4b0e60de8c608bfd5e15d3aac6d16d68a36140a8ebed"
 		score = 80
 		quality = 79
 		tags = "FILE"
@@ -383703,7 +379948,7 @@ rule SIGNATURE_BASE_Emdivi_Gen4 : FILE
 		$s9 = ".no_proxies_on\", \"" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <853KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 853KB and all of them
 }
 rule SIGNATURE_BASE_LNK_Malicious_Nov1 : FILE
 {
@@ -383714,9 +379959,9 @@ rule SIGNATURE_BASE_LNK_Malicious_Nov1 : FILE
 		date = "2017-11-06"
 		modified = "2023-12-05"
 		reference = "https://www.virustotal.com/en/file/ee069edc46a18698fa99b6d2204895e6a516af1a306ea986a798b178f289ecd6/analysis/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_link.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a1aa29497a0e4741807e3d74d54be69061aed21524c5f901615bd21e2ef13c67"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_link.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a1aa29497a0e4741807e3d74d54be69061aed21524c5f901615bd21e2ef13c67"
 		score = 60
 		quality = 81
 		tags = "FILE"
@@ -383734,7 +379979,7 @@ rule SIGNATURE_BASE_LNK_Malicious_Nov1 : FILE
 		$fp1 = "Microsoft Visual" ascii wide
 
 	condition:
-		( uint32(0)==0x0000004c and filesize <4KB and $c1 and 1 of ($s*)) and not 1 of ($fp*)
+		( uint32( 0 ) == 0x0000004c and filesize < 4KB and $c1 and 1 of ( $s* ) ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Susp_Indicators_EXE : FILE
 {
@@ -383745,9 +379990,9 @@ rule SIGNATURE_BASE_Susp_Indicators_EXE : FILE
 		date = "2018-01-05"
 		modified = "2023-12-05"
 		reference = "https://pastebin.com/8qaiyPxs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_netwire_rat.yar#L11-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9cb66435b78893daa5583475b14f0df2a5e8612f3aaf5cb02160991ab4d57d1b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_netwire_rat.yar#L11-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9cb66435b78893daa5583475b14f0df2a5e8612f3aaf5cb02160991ab4d57d1b"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -383763,7 +380008,7 @@ rule SIGNATURE_BASE_Susp_Indicators_EXE : FILE
 		$s6 = "APPHELP" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3c))==0x4550 and filesize <700KB and all of them
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3c ) ) == 0x4550 and filesize < 700KB and all of them
 }
 rule SIGNATURE_BASE_Suspicious_BAT_Strings : FILE
 {
@@ -383774,9 +380019,9 @@ rule SIGNATURE_BASE_Suspicious_BAT_Strings : FILE
 		date = "2018-01-05"
 		modified = "2023-12-05"
 		reference = "https://pastebin.com/8qaiyPxs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_netwire_rat.yar#L32-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e643a5ef41d084e1b1a20be2c56328b72fedddbbce3c79d1e93cc8cfaa633e12"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_netwire_rat.yar#L32-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e643a5ef41d084e1b1a20be2c56328b72fedddbbce3c79d1e93cc8cfaa633e12"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -383786,7 +380031,7 @@ rule SIGNATURE_BASE_Suspicious_BAT_Strings : FILE
 		$s1 = "ping 192.0.2.2 -n 1" ascii
 
 	condition:
-		filesize <600KB and 1 of them
+		filesize < 600KB and 1 of them
 }
 rule SIGNATURE_BASE_Malicious_BAT_Strings : FILE
 {
@@ -383797,9 +380042,9 @@ rule SIGNATURE_BASE_Malicious_BAT_Strings : FILE
 		date = "2018-01-05"
 		modified = "2023-12-05"
 		reference = "https://pastebin.com/8qaiyPxs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_netwire_rat.yar#L47-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1f39b3fd11e7450eb1eaddeeca60aa4970568efda6053029f85df42e2f9fdd6e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_netwire_rat.yar#L47-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1f39b3fd11e7450eb1eaddeeca60aa4970568efda6053029f85df42e2f9fdd6e"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -383809,7 +380054,7 @@ rule SIGNATURE_BASE_Malicious_BAT_Strings : FILE
 		$s1 = "call :deleteSelf&exit /b"
 
 	condition:
-		filesize <600KB and 1 of them
+		filesize < 600KB and 1 of them
 }
 rule SIGNATURE_BASE_Telebots_Intercepterng : FILE
 {
@@ -383820,9 +380065,9 @@ rule SIGNATURE_BASE_Telebots_Intercepterng : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_telebots.yar#L10-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cbf0d44d871ec471e891fb909612f58263ec0b0c702f87875f6e027362409318"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_telebots.yar#L10-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cbf0d44d871ec471e891fb909612f58263ec0b0c702f87875f6e027362409318"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383840,7 +380085,7 @@ rule SIGNATURE_BASE_Telebots_Intercepterng : FILE
 		$s8 = "ORACLE8 DES Authorization intercepted" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of them ) or (4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 4 of them )
 }
 rule SIGNATURE_BASE_Telebots_Killdisk_1 : FILE
 {
@@ -383851,9 +380096,9 @@ rule SIGNATURE_BASE_Telebots_Killdisk_1 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_telebots.yar#L32-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e70d324c408bae1bb42b16f19cd0e6b87e8228c7480d571fef5266eee5695fd2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_telebots.yar#L32-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e70d324c408bae1bb42b16f19cd0e6b87e8228c7480d571fef5266eee5695fd2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383870,7 +380115,7 @@ rule SIGNATURE_BASE_Telebots_Killdisk_1 : FILE
 		$s7 = "[+] > %ls" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 4 of them ) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 4 of them ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_Telebots_Killdisk_2 : FILE
 {
@@ -383881,9 +380126,9 @@ rule SIGNATURE_BASE_Telebots_Killdisk_2 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_telebots.yar#L53-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4ae09a226c4eecae18e685423ef30b3776be518609f89a078c647fe8ee00f19"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_telebots.yar#L53-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4ae09a226c4eecae18e685423ef30b3776be518609f89a078c647fe8ee00f19"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383896,7 +380141,7 @@ rule SIGNATURE_BASE_Telebots_Killdisk_2 : FILE
 		$s3 = "%d.%d.%d#%d:%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
 }
 rule SIGNATURE_BASE_Telebots_Credraptor_Password_Stealer : FILE
 {
@@ -383907,9 +380152,9 @@ rule SIGNATURE_BASE_Telebots_Credraptor_Password_Stealer : FILE
 		date = "2016-12-14"
 		modified = "2023-01-06"
 		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_telebots.yar#L70-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed884cb7643a61109f87e2887bed7ddb838c73bce28812b76c35bb807629e116"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_telebots.yar#L70-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed884cb7643a61109f87e2887bed7ddb838c73bce28812b76c35bb807629e116"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383924,7 +380169,7 @@ rule SIGNATURE_BASE_Telebots_Credraptor_Password_Stealer : FILE
 		$s6 = "Opera old version credentials" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them ) or (4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( 4 of them )
 }
 rule SIGNATURE_BASE_Telebots_VBS_Backdoor_1 : FILE
 {
@@ -383935,9 +380180,9 @@ rule SIGNATURE_BASE_Telebots_VBS_Backdoor_1 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_telebots.yar#L90-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4ff4963058674cf71c123af74c0947da2edf3b5e2622261d14200f406dbe2992"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_telebots.yar#L90-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4ff4963058674cf71c123af74c0947da2edf3b5e2622261d14200f406dbe2992"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383951,7 +380196,7 @@ rule SIGNATURE_BASE_Telebots_VBS_Backdoor_1 : FILE
 		$s4 = "decode = \"certutil -decode \" + source + \" \" + dest  " fullword ascii
 
 	condition:
-		( uint16(0)==0x6553 and filesize <8KB and 1 of them ) or ( all of them )
+		( uint16( 0 ) == 0x6553 and filesize < 8KB and 1 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Telebots_VBS_Backdoor_2 : FILE
 {
@@ -383962,9 +380207,9 @@ rule SIGNATURE_BASE_Telebots_VBS_Backdoor_2 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_telebots.yar#L108-L123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "299a2ca6eacc29b4a7697a8502a56cffda4f6bc6b3354d3cc133712c1755c476"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_telebots.yar#L108-L123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_299a2ca6eacc29b4a7697a8502a56cffda4f6bc6b3354d3cc133712c1755c476"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -383977,7 +380222,7 @@ rule SIGNATURE_BASE_Telebots_VBS_Backdoor_2 : FILE
 		$s3 = "cmd = \"certutil -encode -f \" + source + \" \" + dest" fullword ascii
 
 	condition:
-		( uint16(0)==0x6944 and filesize <30KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x6944 and filesize < 30KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Telebots_Win64_Spy_Keylogger_G : FILE
 {
@@ -383988,9 +380233,9 @@ rule SIGNATURE_BASE_Telebots_Win64_Spy_Keylogger_G : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_telebots.yar#L125-L144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1b4db8f290bd4f943a90669afd5bff6b766d0723fb3ee9c69d7097e737beadc8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_telebots.yar#L125-L144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1b4db8f290bd4f943a90669afd5bff6b766d0723fb3ee9c69d7097e737beadc8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384007,10 +380252,8 @@ rule SIGNATURE_BASE_Telebots_Win64_Spy_Keylogger_G : FILE
 		$s9 = "[*] IMAGE : %ls" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Foudre_Backdoor_1 : FILE
 {
 	meta:
@@ -384020,9 +380263,9 @@ rule SIGNATURE_BASE_Foudre_Backdoor_1 : FILE
 		date = "2017-08-01"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/Nbqbt6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_foudre.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e42959162017ddf6da1d0b2950096e93e0e98c3e5f88ae28fc48e82ef98ca87b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_foudre.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e42959162017ddf6da1d0b2950096e93e0e98c3e5f88ae28fc48e82ef98ca87b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384036,10 +380279,8 @@ rule SIGNATURE_BASE_Foudre_Backdoor_1 : FILE
 		$s3 = "lp.ini" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Foudre_Backdoor_Dropper_1 : FILE
 {
 	meta:
@@ -384049,9 +380290,9 @@ rule SIGNATURE_BASE_Foudre_Backdoor_Dropper_1 : FILE
 		date = "2017-08-01"
 		modified = "2023-01-07"
 		reference = "https://goo.gl/Nbqbt6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_foudre.yar#L31-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "77ae856e74ceb04e73c26154d7b4cf98ed0e1d8b9ac6ed78775becbff2473e13"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_foudre.yar#L31-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_77ae856e74ceb04e73c26154d7b4cf98ed0e1d8b9ac6ed78775becbff2473e13"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384067,7 +380308,7 @@ rule SIGNATURE_BASE_Foudre_Backdoor_Dropper_1 : FILE
 		$s4 = "ShellExecuteW" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 4 of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 4 of them ) )
 }
 import "pe"
 
@@ -384080,9 +380321,9 @@ rule SIGNATURE_BASE_Foudre_Backdoor_Component_1 : FILE
 		date = "2017-08-01"
 		modified = "2023-01-07"
 		reference = "https://goo.gl/Nbqbt6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_foudre.yar#L53-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2eb267ab93c297101aef0cfcca78d0299ca7baa96b983a5f2ff547394cbac82d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_foudre.yar#L53-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2eb267ab93c297101aef0cfcca78d0299ca7baa96b983a5f2ff547394cbac82d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384096,10 +380337,8 @@ rule SIGNATURE_BASE_Foudre_Backdoor_Component_1 : FILE
 		$s3 = "C:\\Documents and Settings\\All Users\\" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (3 of them ) or (2 of them and pe.exports("D1")))
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 3 of them ) or ( 2 of them and pe.exports ( "D1" ) ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Foudre_Backdoor_SFX : FILE
 {
 	meta:
@@ -384109,9 +380348,9 @@ rule SIGNATURE_BASE_Foudre_Backdoor_SFX : FILE
 		date = "2017-08-01"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/Nbqbt6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_foudre.yar#L77-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd5492f5314cb87fdb7c8b29bdf31e1fcd8541ed47b20f309538437d9c6ac600"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_foudre.yar#L77-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd5492f5314cb87fdb7c8b29bdf31e1fcd8541ed47b20f309538437d9c6ac600"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384125,7 +380364,7 @@ rule SIGNATURE_BASE_Foudre_Backdoor_SFX : FILE
 		$s3 = "WinRAR self-extracting archive" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_APT_Sandworm_Keywords_May20_1 : CVE_2019_10149 FILE
 {
@@ -384136,9 +380375,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Keywords_May20_1 : CVE_2019_10149 FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_exim_expl.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9f9a81ff0c576f05ac063eaca7a5882dbdb09c9a0778610cca2864636a00efce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_exim_expl.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9f9a81ff0c576f05ac063eaca7a5882dbdb09c9a0778610cca2864636a00efce"
 		score = 75
 		quality = 85
 		tags = "CVE-2019-10149, FILE"
@@ -384148,7 +380387,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Keywords_May20_1 : CVE_2019_10149 FILE
 		$x2 = "exec\\x20\\x2Fusr\\x2Fbin\\x2Fwget\\x20\\x2DO\\x20\\x2D\\x20http"
 
 	condition:
-		filesize <8000KB and 1 of them
+		filesize < 8000KB and 1 of them
 }
 rule SIGNATURE_BASE_APT_Sandworm_SSH_Key_May20_1 : FILE
 {
@@ -384159,9 +380398,9 @@ rule SIGNATURE_BASE_APT_Sandworm_SSH_Key_May20_1 : FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_exim_expl.yar#L17-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "23a43849dfaa80bad2ca4f46b53181b3a4855ee89673ae9b658c854069b9aaa9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_exim_expl.yar#L17-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_23a43849dfaa80bad2ca4f46b53181b3a4855ee89673ae9b658c854069b9aaa9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384172,7 +380411,7 @@ rule SIGNATURE_BASE_APT_Sandworm_SSH_Key_May20_1 : FILE
 		$x1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2q/NGN/brzNfJiIp2zswtL33tr74pIAjMeWtXN1p5Hqp5fTp058U1EN4NmgmjX0KzNjjV"
 
 	condition:
-		filesize <1000KB and 1 of them
+		filesize < 1000KB and 1 of them
 }
 rule SIGNATURE_BASE_APT_Sandworm_SSHD_Config_Modification_May20_1 : FILE
 {
@@ -384183,9 +380422,9 @@ rule SIGNATURE_BASE_APT_Sandworm_SSHD_Config_Modification_May20_1 : FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_exim_expl.yar#L33-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5775588b3a9d44e9eb2c8ef0f50351d7e3b06f1005f669775fae7187900d5999"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_exim_expl.yar#L33-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5775588b3a9d44e9eb2c8ef0f50351d7e3b06f1005f669775fae7187900d5999"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384197,7 +380436,7 @@ rule SIGNATURE_BASE_APT_Sandworm_SSHD_Config_Modification_May20_1 : FILE
 		$a1 = "ListenAddress" ascii fullword
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_APT_Sandworm_Initfile_May20_1 : FILE
 {
@@ -384208,9 +380447,9 @@ rule SIGNATURE_BASE_APT_Sandworm_Initfile_May20_1 : FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_exim_expl.yar#L51-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "989f37069820d9ecf67dc71e4761a7cde2c1adf8db40b5f8a47e9c610ddec2e6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_exim_expl.yar#L51-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_989f37069820d9ecf67dc71e4761a7cde2c1adf8db40b5f8a47e9c610ddec2e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384222,7 +380461,7 @@ rule SIGNATURE_BASE_APT_Sandworm_Initfile_May20_1 : FILE
 		$s2 = "CREATE USER 'mysqldb'@'localhost' IDENTIFIED BY '" ascii fullword
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_APT_Sandworm_User_May20_1 : FILE
 {
@@ -384233,9 +380472,9 @@ rule SIGNATURE_BASE_APT_Sandworm_User_May20_1 : FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_exim_expl.yar#L68-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d052792a674dfa2d93a048b550ea085c3b9225662fdb09bf4a602093b0527e38"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_exim_expl.yar#L68-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d052792a674dfa2d93a048b550ea085c3b9225662fdb09bf4a602093b0527e38"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384248,7 +380487,7 @@ rule SIGNATURE_BASE_APT_Sandworm_User_May20_1 : FILE
 		$a2 = "daemon:x:"
 
 	condition:
-		filesize <4KB and all of them
+		filesize < 4KB and all of them
 }
 rule SIGNATURE_BASE_APT_WEBSHELL_PHP_Sandworm_May20_1 : FILE
 {
@@ -384259,9 +380498,9 @@ rule SIGNATURE_BASE_APT_WEBSHELL_PHP_Sandworm_May20_1 : FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_exim_expl.yar#L86-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d10f618c7b465c7691d6054e994a76f56c12eb0a36d2d98b5accd2c1e2c1da7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_exim_expl.yar#L86-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d10f618c7b465c7691d6054e994a76f56c12eb0a36d2d98b5accd2c1e2c1da7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384273,7 +380512,7 @@ rule SIGNATURE_BASE_APT_WEBSHELL_PHP_Sandworm_May20_1 : FILE
 		$s1 = "str_replace(" ascii
 
 	condition:
-		filesize <10KB and $h1 at 0 and $s1
+		filesize < 10KB and $h1 at 0 and $s1
 }
 rule SIGNATURE_BASE_APT_SH_Sandworm_Shell_Script_May20_1 : FILE
 {
@@ -384284,9 +380523,9 @@ rule SIGNATURE_BASE_APT_SH_Sandworm_Shell_Script_May20_1 : FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_exim_expl.yar#L103-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b9116585e74ad6159cd31c0c8a84566f981a62ca5b5f82ace8b855a180461071"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_exim_expl.yar#L103-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b9116585e74ad6159cd31c0c8a84566f981a62ca5b5f82ace8b855a180461071"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -384307,7 +380546,7 @@ rule SIGNATURE_BASE_APT_SH_Sandworm_Shell_Script_May20_1 : FILE
 		$s7 = "sshkey.php" ascii fullword
 
 	condition:
-		uint16(0)==0x2123 and filesize <20KB and 1 of ($x*) or 4 of them
+		uint16( 0 ) == 0x2123 and filesize < 20KB and 1 of ( $x* ) or 4 of them
 }
 rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_1 : FILE
 {
@@ -384318,9 +380557,9 @@ rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_1 : FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_exim_expl.yar#L131-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2ccc4c7fc75c04cbcab34904de2e7ab055a15c1017ec0f8d01b06454f4395047"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_exim_expl.yar#L131-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2ccc4c7fc75c04cbcab34904de2e7ab055a15c1017ec0f8d01b06454f4395047"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384332,7 +380571,7 @@ rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_1 : FILE
 		$s2 = "__import__({2:'urllib2',3:'urllib.request'}"
 
 	condition:
-		uint16(0)==0x6d69 and filesize <1KB and 1 of ($x*) or 2 of them
+		uint16( 0 ) == 0x6d69 and filesize < 1KB and 1 of ( $x* ) or 2 of them
 }
 rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_2 : FILE
 {
@@ -384343,9 +380582,9 @@ rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_2 : FILE
 		date = "2020-05-28"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sandworm_exim_expl.yar#L150-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5fb61a9cef64ecf97adc78bf67db667cfd9e5e6f3e03f1bba8f3cdbf6c257520"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sandworm_exim_expl.yar#L150-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5fb61a9cef64ecf97adc78bf67db667cfd9e5e6f3e03f1bba8f3cdbf6c257520"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384358,7 +380597,7 @@ rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_2 : FILE
 		$x4 = "ps -ef | grep Little\\ Snitch | grep " ascii fullword
 
 	condition:
-		uint16(0)==0x6d69 and filesize <2KB and 1 of them
+		uint16( 0 ) == 0x6d69 and filesize < 2KB and 1 of them
 }
 rule SIGNATURE_BASE_Bytes_Used_In_AES_Key_Generation : FILE
 {
@@ -384369,10 +380608,10 @@ rule SIGNATURE_BASE_Bytes_Used_In_AES_Key_Generation : FILE
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L9-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L9-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
-		logic_hash = "221f5ea0a0224a96588912e7ddfbafd20b0b10c119395ca14d1138c284d7b79e"
+		logic_hash = "v1_sha256_221f5ea0a0224a96588912e7ddfbafd20b0b10c119395ca14d1138c284d7b79e"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -384381,7 +380620,7 @@ rule SIGNATURE_BASE_Bytes_Used_In_AES_Key_Generation : FILE
 		$a1 = {35 34 36 35 4B 4A 55 54 5E 49 55 5F 29 7B 68 36 35 67 34 36 64 66 35 68}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of ($a*)
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of ( $a* )
 }
 rule SIGNATURE_BASE_Partial_Implant_ID : FILE
 {
@@ -384392,10 +380631,10 @@ rule SIGNATURE_BASE_Partial_Implant_ID : FILE
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L24-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L24-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
-		logic_hash = "d0a29bed3c19007cb08427769918b0a02d5d247211a1ceaff31aed5839c78966"
+		logic_hash = "v1_sha256_d0a29bed3c19007cb08427769918b0a02d5d247211a1ceaff31aed5839c78966"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -384404,7 +380643,7 @@ rule SIGNATURE_BASE_Partial_Implant_ID : FILE
 		$a1 = {38 38 31 34 35 36 46 43}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of ($a*)
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of ( $a* )
 }
 rule SIGNATURE_BASE_Sleep_Timer_Choice : FILE
 {
@@ -384415,10 +380654,10 @@ rule SIGNATURE_BASE_Sleep_Timer_Choice : FILE
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L39-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L39-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
-		logic_hash = "5d2b656aabb113c50805d4af0faa62f579547dd4ec328ff2778fab64d778b8b9"
+		logic_hash = "v1_sha256_5d2b656aabb113c50805d4af0faa62f579547dd4ec328ff2778fab64d778b8b9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384427,7 +380666,7 @@ rule SIGNATURE_BASE_Sleep_Timer_Choice : FILE
 		$a1 = {8b0424b90f00000083f9ff743499f7f98d420f}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of ($a*)
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of ( $a* )
 }
 rule SIGNATURE_BASE_User_Function_String
 {
@@ -384438,10 +380677,10 @@ rule SIGNATURE_BASE_User_Function_String
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L54-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L54-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
-		logic_hash = "04821d1d5c12b5a9aca3c5b4be9f7a7d35320ad1503ccbdadebc7710c613a976"
+		logic_hash = "v1_sha256_04821d1d5c12b5a9aca3c5b4be9f7a7d35320ad1503ccbdadebc7710c613a976"
 		score = 75
 		quality = 85
 		tags = ""
@@ -384454,7 +380693,7 @@ rule SIGNATURE_BASE_User_Function_String
 		$a6 = "e.FromB64"
 
 	condition:
-		4 of ($a*)
+		4 of ( $a* )
 }
 rule SIGNATURE_BASE_Generic_Shellcode_Downloader_Specific : FILE
 {
@@ -384465,10 +380704,10 @@ rule SIGNATURE_BASE_Generic_Shellcode_Downloader_Specific : FILE
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L73-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L73-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b8bc0611a7fd321d2483a0a9a505251e15c22402e0cfdc62c0258af53ed3658a"
-		logic_hash = "9315ad03b5a28030c32fea5547db3ae421a1ebdae0b96a8a4c2f92660c41bc40"
+		logic_hash = "v1_sha256_9315ad03b5a28030c32fea5547db3ae421a1ebdae0b96a8a4c2f92660c41bc40"
 		score = 75
 		quality = 79
 		tags = "FILE"
@@ -384481,7 +380720,7 @@ rule SIGNATURE_BASE_Generic_Shellcode_Downloader_Specific : FILE
 		$b = {87 C0 81 F2 D1 19 89 14 C1 C8 1F FF E0}
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3C))==0x4550) and ($a or $b) and @push1<@push2 and @push2<@push3
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3C ) ) == 0x4550 ) and ( $a or $b ) and @push1 < @push2 and @push2 < @push3
 }
 rule SIGNATURE_BASE_Batch_Script_To_Run_Psexec
 {
@@ -384492,10 +380731,10 @@ rule SIGNATURE_BASE_Batch_Script_To_Run_Psexec
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L91-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L91-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b7d7c4bc8f9fd0e461425747122a431f93062358ed36ce281147998575ee1a18"
-		logic_hash = "9bdaa14aa535c178914f83c12b23484162f085c6fc6041d379268546ee99f462"
+		logic_hash = "v1_sha256_9bdaa14aa535c178914f83c12b23484162f085c6fc6041d379268546ee99f462"
 		score = 75
 		quality = 85
 		tags = ""
@@ -384519,10 +380758,10 @@ rule SIGNATURE_BASE_Batch_Powershell_Invoke_Inveigh
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L109-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L109-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0a6b1b29496d4514f6485e78680ec4cd0296ef4d21862d8bf363900a4f8e3fd2"
-		logic_hash = "5048a180df301707622e9ad0b949da9e39d2f55f16fc43e7344a8181596a836c"
+		logic_hash = "v1_sha256_5048a180df301707622e9ad0b949da9e39d2f55f16fc43e7344a8181596a836c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -384545,9 +380784,9 @@ rule SIGNATURE_BASE_Lnk_Detect : FILE
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L126-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ae8796877d70f8ddd56bac8ed474231f26d9bc8e73625e65d5d927ab804996b3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L126-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ae8796877d70f8ddd56bac8ed474231f26d9bc8e73625e65d5d927ab804996b3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384566,7 +380805,7 @@ rule SIGNATURE_BASE_Lnk_Detect : FILE
 		$s9 = {5C 00 5C 00 39 00}
 
 	condition:
-		uint32be(0)==0x4c000000 and uint32be(4)==0x01140200 and (($lnk_magic at 0) and $lnk_target) and 1 of ($s*)
+		uint32be( 0 ) == 0x4c000000 and uint32be( 4 ) == 0x01140200 and ( ( $lnk_magic at 0 ) and $lnk_target ) and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_RDP_Brute_Strings
 {
@@ -384577,10 +380816,10 @@ rule SIGNATURE_BASE_RDP_Brute_Strings
 		date = "2018-04-06"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L151-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L151-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8234bf8a1b53efd2a452780a69666d1aedcec9eb1bb714769283ccc2c2bdcc65"
-		logic_hash = "80c51d82a57271409d298b5175505c4234a6c3ec8a8763c93b669d1f0a8d59ba"
+		logic_hash = "v1_sha256_80c51d82a57271409d298b5175505c4234a6c3ec8a8763c93b669d1f0a8d59ba"
 		score = 75
 		quality = 85
 		tags = ""
@@ -384612,10 +380851,10 @@ rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_1
 		modified = "2023-12-05"
 		old_rule_name = "Z_WebShell"
 		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ncsc_report_04_2018.yar#L176-L192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ncsc_report_04_2018.yar#L176-L192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ace12552f3a980f1eed4cadb02afe1bfb851cafc8e58fb130e1329719a07dbf0"
-		logic_hash = "1dfc546a7493c1443527ebe74ed8cd2b06ee032b9a3f736b830e16288e616d43"
+		logic_hash = "v1_sha256_1dfc546a7493c1443527ebe74ed8cd2b06ee032b9a3f736b830e16288e616d43"
 		score = 75
 		quality = 85
 		tags = ""
@@ -384636,11 +380875,11 @@ rule SIGNATURE_BASE_APT_MAL_APT27_Rshell_Jul24 : MALWARE RSHELL___SYSUPDATE FILE
 		author = "Bundesamt fuer Verfassungsschutz, modified by Florian Roth"
 		id = "67c8ac4e-8e2f-5cca-90cb-5d5fdf6f86b5"
 		date = "2024-07-11"
-		modified = "2024-07-12"
+		modified = "2024-12-12"
 		reference = "https://x.com/bfv_bund/status/1811364839656185985?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt27_rshell.yar#L2-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "be5f6281d722bd07e53acd459c794fe3ae870a05ed8979de4c28d357110617bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt27_rshell.yar#L2-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_be5f6281d722bd07e53acd459c794fe3ae870a05ed8979de4c28d357110617bd"
 		score = 75
 		quality = 85
 		tags = "MALWARE, RSHELL / SYSUPDATE, FILE"
@@ -384665,7 +380904,7 @@ rule SIGNATURE_BASE_APT_MAL_APT27_Rshell_Jul24 : MALWARE RSHELL___SYSUPDATE FILE
 		$sop2 = { c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? f7 d8 }
 
 	condition:
-		( uint32be(0)==0x7f454c46 or ( uint32be(0)==0xcafebabe and uint32be(4)<0x20) or uint32(0)==0xfeedface or uint32(0)==0xfeedfacf) and filesize <2MB and all of ($a*) and 2 of ($s*) or 3 of ($s*)
+		( uint32be( 0 ) == 0x7f454c46 or ( uint32be( 0 ) == 0xcafebabe and uint32be( 4 ) < 0x20 ) or uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xfeedfacf ) and filesize < 2MB and all of ( $a* ) and 2 of ( $s* ) or 3 of ( $s* )
 }
 rule SIGNATURE_BASE_KR_Target_Malware_Aug17 : FILE
 {
@@ -384676,9 +380915,9 @@ rule SIGNATURE_BASE_KR_Target_Malware_Aug17 : FILE
 		date = "2017-08-23"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/eyalsela/status/900250203097354240"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_kr_malware.yar#L11-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "47c3350b489b023687f05f55a09f0092456c87b4beeda563756a99ccd5091b09"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_kr_malware.yar#L11-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_47c3350b489b023687f05f55a09f0092456c87b4beeda563756a99ccd5091b09"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384696,7 +380935,7 @@ rule SIGNATURE_BASE_KR_Target_Malware_Aug17 : FILE
 		$x5 = "ZahUKBXz" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of them )
 }
 rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1 : FILE
 {
@@ -384707,9 +380946,9 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1 : FILE
 		date = "2020-04-24"
 		modified = "2023-12-05"
 		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_penquin.yar#L2-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1e07963c492f1e6264f01ee292e40b188ca325b76005d9d48e6dc198cb9bdcf4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_penquin.yar#L2-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1e07963c492f1e6264f01ee292e40b188ca325b76005d9d48e6dc198cb9bdcf4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384736,7 +380975,7 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1 : FILE
 		$ = "/root/.sess" ascii fullword
 
 	condition:
-		uint16(0)==0x457f and filesize <5000KB and 4 of them
+		uint16( 0 ) == 0x457f and filesize < 5000KB and 4 of them
 }
 rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1_Opcode : FILE
 {
@@ -384747,9 +380986,9 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1_Opcode : FILE
 		date = "2020-04-24"
 		modified = "2023-12-05"
 		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_penquin.yar#L35-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "19524e6ec3b0d49ff9c85ce361ef1922b92e4f7876ddb7d6c9b209b5357080e3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_penquin.yar#L35-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_19524e6ec3b0d49ff9c85ce361ef1922b92e4f7876ddb7d6c9b209b5357080e3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384774,7 +381013,7 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1_Opcode : FILE
 		$op7 = { 8D 4A 05 32 8A 25 26 0C 08 88 8A 20 F4 0E 08 42 83 FA 08 76 EB}
 
 	condition:
-		uint16(0)==0x457f and filesize <5000KB and 2 of them
+		uint16( 0 ) == 0x457f and filesize < 5000KB and 2 of them
 }
 rule SIGNATURE_BASE_EXPL_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
 {
@@ -384785,9 +381024,9 @@ rule SIGNATURE_BASE_EXPL_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
 		date = "2023-01-25"
 		modified = "2023-12-05"
 		reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_keepass_cve_2023_24055.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3ca00f317838819bb7fb80c9d00d94db498e1d3ef146b9af2664dae09302a86d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_keepass_cve_2023_24055.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3ca00f317838819bb7fb80c9d00d94db498e1d3ef146b9af2664dae09302a86d"
 		score = 75
 		quality = 81
 		tags = "CVE-2023-24055, FILE"
@@ -384801,7 +381040,7 @@ rule SIGNATURE_BASE_EXPL_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
 		$x5 = "powershell" nocase ascii wide fullword
 
 	condition:
-		filesize <200KB and $a1 and 1 of ($x*)
+		filesize < 200KB and $a1 and 1 of ( $x* )
 }
 rule SIGNATURE_BASE_SUSP_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
 {
@@ -384812,9 +381051,9 @@ rule SIGNATURE_BASE_SUSP_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
 		date = "2023-01-25"
 		modified = "2023-12-05"
 		reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_keepass_cve_2023_24055.yar#L22-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4ed3eee86baf3dddfe423795491a5a94c02df3f4a7525efa6f2436e19197e55b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_keepass_cve_2023_24055.yar#L22-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4ed3eee86baf3dddfe423795491a5a94c02df3f4a7525efa6f2436e19197e55b"
 		score = 60
 		quality = 85
 		tags = "CVE-2023-24055, FILE"
@@ -384825,7 +381064,7 @@ rule SIGNATURE_BASE_SUSP_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
 		$s2 = "<Parameter>" ascii wide
 
 	condition:
-		filesize <200KB and $a1 and all of ($s*)
+		filesize < 200KB and $a1 and all of ( $s* )
 }
 rule SIGNATURE_BASE_EXPL_Exchange_Proxyshell_Failed_Aug21_1 : SCRIPT
 {
@@ -384836,9 +381075,9 @@ rule SIGNATURE_BASE_EXPL_Exchange_Proxyshell_Failed_Aug21_1 : SCRIPT
 		date = "2021-08-08"
 		modified = "2021-08-09"
 		reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "690e74633ac8671727fe47f6398e536c1b7a4ac469d27d3f7507c75e175716bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_690e74633ac8671727fe47f6398e536c1b7a4ac469d27d3f7507c75e175716bd"
 		score = 50
 		quality = 85
 		tags = "SCRIPT"
@@ -384859,9 +381098,9 @@ rule SIGNATURE_BASE_EXPL_Exchange_Proxyshell_Successful_Aug21_1 : SCRIPT
 		date = "2021-08-08"
 		modified = "2021-08-09"
 		reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L18-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "06ab609a8efe3b36b6356a9cf7b7b11b2fc2a556ec1df6995008a9df86b3fcee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L18-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_06ab609a8efe3b36b6356a9cf7b7b11b2fc2a556ec1df6995008a9df86b3fcee"
 		score = 75
 		quality = 83
 		tags = "SCRIPT"
@@ -384884,9 +381123,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_2 : FILE
 		date = "2021-08-13"
 		modified = "2024-11-01"
 		reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L36-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4ede197d482f0a9e553ba857b5049e7b7405e3df92460e19418fa0653c844982"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L36-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4ede197d482f0a9e553ba857b5049e7b7405e3df92460e19418fa0653c844982"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384895,7 +381134,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_2 : FILE
 		$s1 = "Page Language=" ascii nocase
 
 	condition:
-		uint32(0)==0x4e444221 and filesize <2MB and $s1
+		uint32( 0 ) == 0x4e444221 and filesize < 2MB and $s1
 }
 rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_3 : FILE
 {
@@ -384906,9 +381145,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_3 : FILE
 		date = "2021-08-23"
 		modified = "2024-11-01"
 		reference = "https://twitter.com/gossithedog/status/1429175908905127938?s=12"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L51-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f071aaa8918b359f786f2ac7447eeaedb5a6fca9e0a0c0e8820e011244424503"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L51-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f071aaa8918b359f786f2ac7447eeaedb5a6fca9e0a0c0e8820e011244424503"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384917,7 +381156,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_3 : FILE
 		$s1 = "Page Language=" ascii nocase
 
 	condition:
-		uint16(0)==0x8230 and filesize <10KB and $s1
+		uint16( 0 ) == 0x8230 and filesize < 10KB and $s1
 }
 rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Sep21_1 : FILE
 {
@@ -384928,10 +381167,10 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Sep21_1 : FILE
 		date = "2021-09-17"
 		modified = "2024-11-01"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L67-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L67-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "219468c10d2b9d61a8ae70dc8b6d2824ca8fbe4e53bbd925eeca270fef0fd640"
-		logic_hash = "233ec15dff8da5f2beaa931eb06849aa37e548947c1068d688a1695d977605d8"
+		logic_hash = "v1_sha256_233ec15dff8da5f2beaa931eb06849aa37e548947c1068d688a1695d977605d8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -384940,7 +381179,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Sep21_1 : FILE
 		$s = ".FromBase64String(Request["
 
 	condition:
-		uint32(0)==0x4e444221 and any of them
+		uint32( 0 ) == 0x4e444221 and any of them
 }
 rule SIGNATURE_BASE_APT_IIS_Config_Proxyshell_Artifacts : FILE
 {
@@ -384951,9 +381190,9 @@ rule SIGNATURE_BASE_APT_IIS_Config_Proxyshell_Artifacts : FILE
 		date = "2021-08-25"
 		modified = "2024-11-01"
 		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L83-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a4557694629448d258b8b2fefc278e059217560e7a0ec3279863a16fb9b3989c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L83-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a4557694629448d258b8b2fefc278e059217560e7a0ec3279863a16fb9b3989c"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -384971,7 +381210,7 @@ rule SIGNATURE_BASE_APT_IIS_Config_Proxyshell_Artifacts : FILE
 		$sb1 = " physicalPath=\"C:\\Users\\All Users\\" ascii
 
 	condition:
-		filesize <500KB and all of ($a*) and 1 of ($s*)
+		filesize < 500KB and all of ( $a* ) and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Exploitation_Aug21_1 : FILE
 {
@@ -384982,9 +381221,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Exploitation_Aug21_1 : FILE
 		date = "2021-08-25"
 		modified = "2024-11-01"
 		reference = "https://twitter.com/VirITeXplorer/status/1430206853733097473"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L108-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8a2417bb85c7f91d98143d2f4c26d30416b3a01ba8abc1445ccfae5609825b4d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L108-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8a2417bb85c7f91d98143d2f4c26d30416b3a01ba8abc1445ccfae5609825b4d"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -384993,7 +381232,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Exploitation_Aug21_1 : FILE
 		$x1 = ");eval/*asf" ascii
 
 	condition:
-		filesize <600KB and 1 of them
+		filesize < 600KB and 1 of them
 }
 rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug15 : FILE
 {
@@ -385004,9 +381243,9 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug15 : FILE
 		date = "2021-09-04"
 		modified = "2024-11-01"
 		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L122-L146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7e2e2f9add5932d28074a252a8e326dd728442df28abc02e8d026d773dd4aa05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L122-L146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7e2e2f9add5932d28074a252a8e326dd728442df28abc02e8d026d773dd4aa05"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385025,7 +381264,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug15 : FILE
 		$s3 = "LaTkWfI64XeDAXZS6pU1KrsvLAcGH7AZOQXjrFkT816RnFYJQR" ascii
 
 	condition:
-		filesize <1KB and (1 of ($s*) or 4 of ($g*))
+		filesize < 1KB and ( 1 of ( $s* ) or 4 of ( $g* ) )
 }
 rule SIGNATURE_BASE_WEBSHELL_Mailbox_Export_PST_Proxyshell_Aug26 : FILE
 {
@@ -385036,9 +381275,9 @@ rule SIGNATURE_BASE_WEBSHELL_Mailbox_Export_PST_Proxyshell_Aug26 : FILE
 		date = "2021-09-04"
 		modified = "2024-11-01"
 		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L148-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "07acbf74a4bf169fc128cd085759f33e89917e217703b3c6557ba5f954822fd4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L148-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_07acbf74a4bf169fc128cd085759f33e89917e217703b3c6557ba5f954822fd4"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -385057,7 +381296,7 @@ rule SIGNATURE_BASE_WEBSHELL_Mailbox_Export_PST_Proxyshell_Aug26 : FILE
 		$s3 = "orangenb" ascii
 
 	condition:
-		filesize <500KB and $x1 at 0 and (1 of ($s*) or 3 of ($g*))
+		filesize < 500KB and $x1 at 0 and ( 1 of ( $s* ) or 3 of ( $g* ) )
 }
 rule SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts : FILE
 {
@@ -385068,9 +381307,9 @@ rule SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts : FILE
 		date = "2021-08-25"
 		modified = "2024-11-01"
 		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L181-L196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f2822a2b762c8e683c5e3a3f4a8232faa187b9a36182ea71e5286158b0e8115c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L181-L196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f2822a2b762c8e683c5e3a3f4a8232faa187b9a36182ea71e5286158b0e8115c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -385081,7 +381320,7 @@ rule SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts : FILE
 		$s1 = " physicalPath=\"C:\\ProgramData\\" ascii
 
 	condition:
-		filesize <500KB and all of ($a*) and 1 of ($s*)
+		filesize < 500KB and all of ( $a* ) and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_SUSP_IIS_Config_Virtualdir : FILE
 {
@@ -385092,9 +381331,9 @@ rule SIGNATURE_BASE_SUSP_IIS_Config_Virtualdir : FILE
 		date = "2021-08-25"
 		modified = "2022-09-17"
 		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L198-L218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0b9be085957f368bc1890c42e3f1e8b974eed8c77ecb4d2ba6add4d877a9b488"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L198-L218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0b9be085957f368bc1890c42e3f1e8b974eed8c77ecb4d2ba6add4d877a9b488"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -385107,7 +381346,7 @@ rule SIGNATURE_BASE_SUSP_IIS_Config_Virtualdir : FILE
 		$fp2 = "<virtualDirectory path=\"/\" physicalPath=\"C:\\Users\\admin\\"
 
 	condition:
-		filesize <500KB and all of ($a*) and 1 of ($s*) and not 1 of ($fp*)
+		filesize < 500KB and all of ( $a* ) and 1 of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_ASPX_Possibledropperartifact_Aug21 : FILE
 {
@@ -385118,9 +381357,9 @@ rule SIGNATURE_BASE_SUSP_ASPX_Possibledropperartifact_Aug21 : FILE
 		date = "2021-08-23"
 		modified = "2024-11-01"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L220-L250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7e2fc61897ed859d5165aca7360d8a27891f842a7a8e4894af3926427ac95ceb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L220-L250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7e2fc61897ed859d5165aca7360d8a27891f842a7a8e4894af3926427ac95ceb"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -385130,7 +381369,7 @@ rule SIGNATURE_BASE_SUSP_ASPX_Possibledropperartifact_Aug21 : FILE
 		$fp1 = "Page Language=\"java\"" ascii nocase
 
 	condition:
-		filesize <500KB and not uint16(0)==0x4B50 and not uint16(0)==0x6152 and not uint16(0)==0x8b1f and not uint16(0)==0x5A4D and not uint16(0)==0xCFD0 and not uint16(0)==0xC3D4 and not uint16(0)==0x534D and all of ($s*) and not 1 of ($fp*) and ((( uint8(0)<0x20 or uint8(0)>0x7E) and uint8(0)!=0x9 and uint8(0)!=0x0D and uint8(0)!=0x0A and uint8(0)!=0xEF) or (( uint8(1)<0x20 or uint8(1)>0x7E) and uint8(1)!=0x9 and uint8(1)!=0x0D and uint8(1)!=0x0A and uint8(1)!=0xBB) or (( uint8(2)<0x20 or uint8(2)>0x7E) and uint8(2)!=0x9 and uint8(2)!=0x0D and uint8(2)!=0x0A and uint8(2)!=0xBF) or (( uint8(3)<0x20 or uint8(3)>0x7E) and uint8(3)!=0x9 and uint8(3)!=0x0D and uint8(3)!=0x0A) or (( uint8(4)<0x20 or uint8(4)>0x7E) and uint8(4)!=0x9 and uint8(4)!=0x0D and uint8(4)!=0x0A) or (( uint8(5)<0x20 or uint8(5)>0x7E) and uint8(5)!=0x9 and uint8(5)!=0x0D and uint8(5)!=0x0A) or (( uint8(6)<0x20 or uint8(6)>0x7E) and uint8(6)!=0x9 and uint8(6)!=0x0D and uint8(6)!=0x0A) or (( uint8(7)<0x20 or uint8(7)>0x7E) and uint8(7)!=0x9 and uint8(7)!=0x0D and uint8(7)!=0x0A))
+		filesize < 500KB and not uint16( 0 ) == 0x4B50 and not uint16( 0 ) == 0x6152 and not uint16( 0 ) == 0x8b1f and not uint16( 0 ) == 0x5A4D and not uint16( 0 ) == 0xCFD0 and not uint16( 0 ) == 0xC3D4 and not uint16( 0 ) == 0x534D and all of ( $s* ) and not 1 of ( $fp* ) and ( ( ( uint8( 0 ) < 0x20 or uint8( 0 ) > 0x7E ) and uint8( 0 ) != 0x9 and uint8( 0 ) != 0x0D and uint8( 0 ) != 0x0A and uint8( 0 ) != 0xEF ) or ( ( uint8( 1 ) < 0x20 or uint8( 1 ) > 0x7E ) and uint8( 1 ) != 0x9 and uint8( 1 ) != 0x0D and uint8( 1 ) != 0x0A and uint8( 1 ) != 0xBB ) or ( ( uint8( 2 ) < 0x20 or uint8( 2 ) > 0x7E ) and uint8( 2 ) != 0x9 and uint8( 2 ) != 0x0D and uint8( 2 ) != 0x0A and uint8( 2 ) != 0xBF ) or ( ( uint8( 3 ) < 0x20 or uint8( 3 ) > 0x7E ) and uint8( 3 ) != 0x9 and uint8( 3 ) != 0x0D and uint8( 3 ) != 0x0A ) or ( ( uint8( 4 ) < 0x20 or uint8( 4 ) > 0x7E ) and uint8( 4 ) != 0x9 and uint8( 4 ) != 0x0D and uint8( 4 ) != 0x0A ) or ( ( uint8( 5 ) < 0x20 or uint8( 5 ) > 0x7E ) and uint8( 5 ) != 0x9 and uint8( 5 ) != 0x0D and uint8( 5 ) != 0x0A ) or ( ( uint8( 6 ) < 0x20 or uint8( 6 ) > 0x7E ) and uint8( 6 ) != 0x9 and uint8( 6 ) != 0x0D and uint8( 6 ) != 0x0A ) or ( ( uint8( 7 ) < 0x20 or uint8( 7 ) > 0x7E ) and uint8( 7 ) != 0x9 and uint8( 7 ) != 0x0D and uint8( 7 ) != 0x0A ) )
 }
 rule SIGNATURE_BASE_WEBSHELL_Proxyshell_Exploitation_Nov21_1
 {
@@ -385141,9 +381380,9 @@ rule SIGNATURE_BASE_WEBSHELL_Proxyshell_Exploitation_Nov21_1
 		date = "2021-11-01"
 		modified = "2024-11-01"
 		reference = "https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxyshell.yar#L252-L266"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d9812d3f53c346c4e318609e0c7de66811b27ffa7528a6ddeb6ac8436da59ef5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxyshell.yar#L252-L266"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d9812d3f53c346c4e318609e0c7de66811b27ffa7528a6ddeb6ac8436da59ef5"
 		score = 85
 		quality = 85
 		tags = ""
@@ -385154,7 +381393,7 @@ rule SIGNATURE_BASE_WEBSHELL_Proxyshell_Exploitation_Nov21_1
 		$s03 = "Transform(" ascii wide
 
 	condition:
-		all of ($s*)
+		all of ( $s* )
 }
 rule SIGNATURE_BASE_MAL_Go_Modbus_Jul24_1 : FILE
 {
@@ -385165,9 +381404,9 @@ rule SIGNATURE_BASE_MAL_Go_Modbus_Jul24_1 : FILE
 		date = "2024-07-23"
 		modified = "2024-07-24"
 		reference = "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_go_modbus.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d992c8159deca0ed2b2a33da3c31fdf0efa9a09ba941d059fa7fc1bad458aed1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_go_modbus.yar#L2-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d992c8159deca0ed2b2a33da3c31fdf0efa9a09ba941d059fa7fc1bad458aed1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385182,7 +381421,7 @@ rule SIGNATURE_BASE_MAL_Go_Modbus_Jul24_1 : FILE
 		$sb4 = "main.CycleInfo" fullword
 
 	condition:
-		filesize <30MB and ($sa1 and 3 of ($sb*)) or 4 of them
+		filesize < 30MB and ( $sa1 and 3 of ( $sb* ) ) or 4 of them
 }
 rule SIGNATURE_BASE_Poisonivy_Sample_APT : FILE
 {
@@ -385193,10 +381432,10 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poisonivy.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poisonivy.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b874b76ff7b281c8baa80e4a71fc9be514093c70"
-		logic_hash = "938df757d1f5ee1028d61dbc2ab76a33c788a44f87cb0d84626420e20bfb5fa4"
+		logic_hash = "v1_sha256_938df757d1f5ee1028d61dbc2ab76a33c788a44f87cb0d84626420e20bfb5fa4"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -385211,7 +381450,7 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT : FILE
 		$s9 = "Microsoft Media Device Service Provider" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <47KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 47KB and all of them
 }
 rule SIGNATURE_BASE_Poisonivy_Sample_APT_2 : FILE
 {
@@ -385222,10 +381461,10 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT_2 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poisonivy.yar#L24-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poisonivy.yar#L24-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "333f956bf3d5fc9b32183e8939d135bc0fcc5770"
-		logic_hash = "58d62278d776c9f7c3ae0815aa4b248f85c5fc648405b8d1ba2b8eb2847e1e88"
+		logic_hash = "v1_sha256_58d62278d776c9f7c3ae0815aa4b248f85c5fc648405b8d1ba2b8eb2847e1e88"
 		score = 70
 		quality = 83
 		tags = "FILE"
@@ -385255,7 +381494,7 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT_2 : FILE
 		$s20 = "_adjust_fdiv" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <47KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 47KB and all of them
 }
 rule SIGNATURE_BASE_Poisonivy_Sample_APT_3 : FILE
 {
@@ -385266,10 +381505,10 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT_3 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poisonivy.yar#L60-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poisonivy.yar#L60-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "df3e1668ac20edecc12f2c1a873667ea1a6c3d6a"
-		logic_hash = "96f8324dcf85f5baa64178774abf17516a9e023dd6fa38e2bce0fe5159a4f704"
+		logic_hash = "v1_sha256_96f8324dcf85f5baa64178774abf17516a9e023dd6fa38e2bce0fe5159a4f704"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -385281,7 +381520,7 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT_3 : FILE
 		$s3 = "winlogon.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_Poisonivy_Sample_APT_4 : FILE
 {
@@ -385292,10 +381531,10 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT_4 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poisonivy.yar#L79-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poisonivy.yar#L79-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "558f0f0b728b6da537e2666fbf32f3c9c7bd4c0c"
-		logic_hash = "7ba10269d31e985dff582ae4103ef1179172ae475e078161864f185380bb5035"
+		logic_hash = "v1_sha256_7ba10269d31e985dff582ae4103ef1179172ae475e078161864f185380bb5035"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -385313,7 +381552,7 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT_4 : FILE
 		$s8 = "ZwSetInformationProcess" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 7 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 7 of them
 }
 rule SIGNATURE_BASE_Poisonivy_Sample_5 : FILE
 {
@@ -385324,10 +381563,10 @@ rule SIGNATURE_BASE_Poisonivy_Sample_5 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poisonivy.yar#L103-L123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poisonivy.yar#L103-L123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "545e261b3b00d116a1d69201ece8ca78d9704eb2"
-		logic_hash = "3f88b673b80b67a110915285a87ead265ad0176ea414426ba55e780e3aa396fe"
+		logic_hash = "v1_sha256_3f88b673b80b67a110915285a87ead265ad0176ea414426ba55e780e3aa396fe"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -385343,7 +381582,7 @@ rule SIGNATURE_BASE_Poisonivy_Sample_5 : FILE
 		$s17 = "LookupPrivilegeValueA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_Poisonivy_Sample_6 : FILE
 {
@@ -385354,9 +381593,9 @@ rule SIGNATURE_BASE_Poisonivy_Sample_6 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poisonivy.yar#L126-L164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d77fd224b8d2dfd506faf0d3e359bf04172cc2854dc737e05c4bf99d0e1f3f7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poisonivy.yar#L126-L164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d77fd224b8d2dfd506faf0d3e359bf04172cc2854dc737e05c4bf99d0e1f3f7"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -385387,7 +381626,7 @@ rule SIGNATURE_BASE_Poisonivy_Sample_6 : FILE
 		$s12 = "advAPI32" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of ($x*)) or (8 of ($s*)) or (1 of ($z*) and 3 of ($s*))
+		( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) ) or ( 8 of ( $s* ) ) or ( 1 of ( $z* ) and 3 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Poisonivy_Sample_7 : FILE
 {
@@ -385398,10 +381637,10 @@ rule SIGNATURE_BASE_Poisonivy_Sample_7 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poisonivy.yar#L166-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poisonivy.yar#L166-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9480cf544beeeb63ffd07442233eb5c5f0cf03b3"
-		logic_hash = "28db3fb7fa5b5e60ad1d1cc2b6d3d9d30a1948491105439201574ca354eb8bd1"
+		logic_hash = "v1_sha256_28db3fb7fa5b5e60ad1d1cc2b6d3d9d30a1948491105439201574ca354eb8bd1"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -385416,7 +381655,7 @@ rule SIGNATURE_BASE_Poisonivy_Sample_7 : FILE
 		$s13 = "Microsoft(R) Windows(R) Operating System" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_Poisonivy_RAT_Ssmuidll : FILE
 {
@@ -385427,9 +381666,9 @@ rule SIGNATURE_BASE_Poisonivy_RAT_Ssmuidll : FILE
 		date = "2016-04-22"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/WiwtYT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poisonivy.yar#L196-L230"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d048d88cac40f4fe3affee8d9dad35a7347a5459fbdd56b08a77ece4f6c2ac08"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poisonivy.yar#L196-L230"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d048d88cac40f4fe3affee8d9dad35a7347a5459fbdd56b08a77ece4f6c2ac08"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385446,7 +381685,7 @@ rule SIGNATURE_BASE_Poisonivy_RAT_Ssmuidll : FILE
 		$op3 = { 6a 00 88 7f 02 ff d6 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and ( all of ($op*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 20KB and ( all of ( $op* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_M_APT_Downloader_BEATDROP : FILE
 {
@@ -385457,9 +381696,9 @@ rule SIGNATURE_BASE_M_APT_Downloader_BEATDROP : FILE
 		date = "2022-04-28"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_apr22.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7a766682cc9a057798cc569111bfcb611648c4a052c0dd664d983b80d5891255"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_apr22.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7a766682cc9a057798cc569111bfcb611648c4a052c0dd664d983b80d5891255"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -385472,7 +381711,7 @@ rule SIGNATURE_BASE_M_APT_Downloader_BEATDROP : FILE
 		$url3 = "/cards?key=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <1MB and all of them
+		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 1MB and all of them
 }
 rule SIGNATURE_BASE_M_APT_Downloader_BOOMMIC : FILE
 {
@@ -385483,9 +381722,9 @@ rule SIGNATURE_BASE_M_APT_Downloader_BOOMMIC : FILE
 		date = "2022-04-28"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_nobelium_apr22.yar#L19-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c561b19464597f896d31307c0383fbc639cf4211600513e1251a3f59405bfed6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_nobelium_apr22.yar#L19-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c561b19464597f896d31307c0383fbc639cf4211600513e1251a3f59405bfed6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385497,7 +381736,7 @@ rule SIGNATURE_BASE_M_APT_Downloader_BOOMMIC : FILE
 		$func2 = "HttpQueryInfoA" ascii
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <1MB and (($loc_10001000 and $func1) or ($loc_100012fd and $func2))
+		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 1MB and ( ( $loc_10001000 and $func1 ) or ( $loc_100012fd and $func2 ) )
 }
 rule SIGNATURE_BASE_APT_UNC1151_Windowsinstaller_Silent_Installproduct_Macromethod : FILE
 {
@@ -385508,9 +381747,9 @@ rule SIGNATURE_BASE_APT_UNC1151_Windowsinstaller_Silent_Installproduct_Macrometh
 		date = "2021-07-28"
 		modified = "2023-12-05"
 		reference = "Thttps://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc1151_ua.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aec1bb992061fdf1abf5c1a61cf9ec9e54c1f13be36ceb84890b058ade273b70"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc1151_ua.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aec1bb992061fdf1abf5c1a61cf9ec9e54c1f13be36ceb84890b058ade273b70"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385524,7 +381763,7 @@ rule SIGNATURE_BASE_APT_UNC1151_Windowsinstaller_Silent_Installproduct_Macrometh
 		$s3 = ".InstallProduct \"http"
 
 	condition:
-		$doc_header at 0 and all of ($s*)
+		$doc_header at 0 and all of ( $s* )
 }
 rule SIGNATURE_BASE_MAL_WIPER_Caddywiper_Mar22_1 : FILE
 {
@@ -385535,9 +381774,9 @@ rule SIGNATURE_BASE_MAL_WIPER_Caddywiper_Mar22_1 : FILE
 		date = "2022-03-15"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ESETresearch/status/1503436420886712321?s=20&t=xh8JK6fEmRIrnqO7Ih_PNg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_caddywiper.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d0278596010953e7068979c92a33dc0ace1bfa94979077412128d1ca756f834"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_caddywiper.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d0278596010953e7068979c92a33dc0ace1bfa94979077412128d1ca756f834"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -385553,7 +381792,7 @@ rule SIGNATURE_BASE_MAL_WIPER_Caddywiper_Mar22_1 : FILE
 		$op4 = { e9 67 01 00 00 83 7d f4 05 74 0a e9 5c 01 00 00 e9 57 01 00 00 8d 45 98 50 6a 20 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and 3 of them or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and 3 of them or all of them
 }
 rule SIGNATURE_BASE_SUSP_RAR_Ntdsdit : FILE
 {
@@ -385564,9 +381803,9 @@ rule SIGNATURE_BASE_SUSP_RAR_Ntdsdit : FILE
 		date = "2019-12-16"
 		modified = "2022-11-15"
 		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_rar_exfil.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "12e527b040e02f573f2a6e0fac4ff99ec441bf189c9bb7e1f763619c079a5bfa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_rar_exfil.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_12e527b040e02f573f2a6e0fac4ff99ec441bf189c9bb7e1f763619c079a5bfa"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -385577,7 +381816,7 @@ rule SIGNATURE_BASE_SUSP_RAR_Ntdsdit : FILE
 		$x3 = { 0? 73 61 6D 30 01 00 03 }
 
 	condition:
-		uint32(0)==0x21726152 and 1 of them
+		uint32( 0 ) == 0x21726152 and 1 of them
 }
 rule SIGNATURE_BASE_APT_SH_Codecov_Hack_Apr21_1 : FILE
 {
@@ -385588,9 +381827,9 @@ rule SIGNATURE_BASE_APT_SH_Codecov_Hack_Apr21_1 : FILE
 		date = "2021-04-16"
 		modified = "2023-12-05"
 		reference = "https://about.codecov.io/security-update/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_codecov_hack.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1aa7723982a1b675ba6694f1af0eb28e5926b974874580bd727cf33a3f8d893a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_codecov_hack.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1aa7723982a1b675ba6694f1af0eb28e5926b974874580bd727cf33a3f8d893a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385600,7 +381839,7 @@ rule SIGNATURE_BASE_APT_SH_Codecov_Hack_Apr21_1 : FILE
 		$s1 = "curl -sm 0.5 -d"
 
 	condition:
-		uint16(0)==0x2123 and filesize <70KB and all of them
+		uint16( 0 ) == 0x2123 and filesize < 70KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_Microsoft_7Z_SFX_Combo : FILE
 {
@@ -385611,9 +381850,9 @@ rule SIGNATURE_BASE_SUSP_Microsoft_7Z_SFX_Combo : FILE
 		date = "2018-09-16"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_sfx_with_microsoft_copyright.yar#L1-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f48887e0c1031d180e25f2d1b9e016d434f594aef283ab3af8418e86496d2eac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_sfx_with_microsoft_copyright.yar#L1-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f48887e0c1031d180e25f2d1b9e016d434f594aef283ab3af8418e86496d2eac"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -385632,7 +381871,7 @@ rule SIGNATURE_BASE_SUSP_Microsoft_7Z_SFX_Combo : FILE
               00 76 00 65 00 64 00 2E }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of ($s*) and $c1
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $s* ) and $c1
 }
 rule SIGNATURE_BASE_SUSP_Microsoft_RAR_SFX_Combo : FILE
 {
@@ -385643,9 +381882,9 @@ rule SIGNATURE_BASE_SUSP_Microsoft_RAR_SFX_Combo : FILE
 		date = "2018-09-16"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_sfx_with_microsoft_copyright.yar#L27-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a0f29fcf86139a6f95b4ab0095154bd26b555f1576b5a2e263c1939bc30e3431"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_sfx_with_microsoft_copyright.yar#L27-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a0f29fcf86139a6f95b4ab0095154bd26b555f1576b5a2e263c1939bc30e3431"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -385664,7 +381903,7 @@ rule SIGNATURE_BASE_SUSP_Microsoft_RAR_SFX_Combo : FILE
               00 76 00 65 00 64 00 2E }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of ($s*) and $c1
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $s* ) and $c1
 }
 rule SIGNATURE_BASE_Equationgroup_Emptycriss : FILE
 {
@@ -385675,9 +381914,9 @@ rule SIGNATURE_BASE_Equationgroup_Emptycriss : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L15-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fcfbe4a8a959491dfba9e5d958e43221d83a1e49dcf005872a1b71efb1226d99"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L15-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fcfbe4a8a959491dfba9e5d958e43221d83a1e49dcf005872a1b71efb1226d99"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385690,7 +381929,7 @@ rule SIGNATURE_BASE_Equationgroup_Emptycriss : FILE
 		$s8 = "environ define TTYPROMPT abcdef" fullword ascii
 
 	condition:
-		( filesize <50KB and 1 of them )
+		( filesize < 50KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Scripme : FILE
 {
@@ -385701,9 +381940,9 @@ rule SIGNATURE_BASE_Equationgroup_Scripme : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L32-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5cffded6563bb3c94868f25e086be8d92837a7656707bf4e6a9e9f375d9ee7e0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L32-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5cffded6563bb3c94868f25e086be8d92837a7656707bf4e6a9e9f375d9ee7e0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385717,7 +381956,7 @@ rule SIGNATURE_BASE_Equationgroup_Scripme : FILE
 		$x4 = "$opetc/scripme.override" ascii
 
 	condition:
-		( filesize <30KB and 1 of them )
+		( filesize < 30KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Crypttool : FILE
 {
@@ -385728,9 +381967,9 @@ rule SIGNATURE_BASE_Equationgroup_Crypttool : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L50-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ae2d5eda038326376511450e1f5bd2bbf6264d23df013b005b322d70eb6266a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L50-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ae2d5eda038326376511450e1f5bd2bbf6264d23df013b005b322d70eb6266a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385742,7 +381981,7 @@ rule SIGNATURE_BASE_Equationgroup_Crypttool : FILE
 		$s2 = "___tempFile2.out" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Dumppoppy : FILE
 {
@@ -385753,9 +381992,9 @@ rule SIGNATURE_BASE_Equationgroup_Dumppoppy : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L66-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b6fb6a3799196375796da6f3a0169246145e668019dd692da67ca6f06d09c3dc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L66-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b6fb6a3799196375796da6f3a0169246145e668019dd692da67ca6f06d09c3dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385768,7 +382007,7 @@ rule SIGNATURE_BASE_Equationgroup_Dumppoppy : FILE
 		$l1 = "End of $destfile determined by \"^Connection closed by foreign host"
 
 	condition:
-		( filesize <20KB and 1 of them )
+		( filesize < 20KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Auditcleaner : FILE
 {
@@ -385779,9 +382018,9 @@ rule SIGNATURE_BASE_Equationgroup_Auditcleaner : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L84-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "30a6ae9ce7d02c1d945d57eabf29f430ad4cdbc48dba5fe71654efc2c59fde08"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L84-L102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_30a6ae9ce7d02c1d945d57eabf29f430ad4cdbc48dba5fe71654efc2c59fde08"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385796,7 +382035,7 @@ rule SIGNATURE_BASE_Equationgroup_Auditcleaner : FILE
 		$l2 = "No need to clean LOGIN lines." fullword ascii
 
 	condition:
-		( filesize <300KB and 1 of them )
+		( filesize < 300KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Reverse_Shell : FILE
 {
@@ -385807,9 +382046,9 @@ rule SIGNATURE_BASE_Equationgroup_Reverse_Shell : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L104-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6dc388fecbf606b19c04626d64f5fe4184f07c2a1597a6f8337aa4a827b2d89b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L104-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6dc388fecbf606b19c04626d64f5fe4184f07c2a1597a6f8337aa4a827b2d89b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385821,7 +382060,7 @@ rule SIGNATURE_BASE_Equationgroup_Reverse_Shell : FILE
 		$s2 = " <&1 2>&1" fullword ascii
 
 	condition:
-		( filesize <1KB and all of them )
+		( filesize < 1KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Tnmunger : FILE
 {
@@ -385832,9 +382071,9 @@ rule SIGNATURE_BASE_Equationgroup_Tnmunger : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L120-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ddb957ca9350288d0fa98ba20847a99dcba931b5a03d0ae94cd3409f82f728eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L120-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ddb957ca9350288d0fa98ba20847a99dcba931b5a03d0ae94cd3409f82f728eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385846,7 +382085,7 @@ rule SIGNATURE_BASE_Equationgroup_Tnmunger : FILE
 		$s2 = "mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <10KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 10KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Ys_Ratload : FILE
 {
@@ -385857,9 +382096,9 @@ rule SIGNATURE_BASE_Equationgroup_Ys_Ratload : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L136-L151"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "82d00b7eecdb60911ecd933387eeb2ce4eec9721993beee60247d1273ad3368f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L136-L151"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_82d00b7eecdb60911ecd933387eeb2ce4eec9721993beee60247d1273ad3368f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385872,7 +382111,7 @@ rule SIGNATURE_BASE_Equationgroup_Ys_Ratload : FILE
 		$x3 = "CALLBACK_PORT=32177" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <3KB and 1 of them )
+		( uint16( 0 ) == 0x2123 and filesize < 3KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Eh_1_1_0 : FILE
 {
@@ -385883,9 +382122,9 @@ rule SIGNATURE_BASE_Equationgroup_Eh_1_1_0 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L153-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d0972bb57076606b3c84f3cbbb0be85cd5663c7cd6f6d9f09a2991cb6532bfa9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L153-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d0972bb57076606b3c84f3cbbb0be85cd5663c7cd6f6d9f09a2991cb6532bfa9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385898,7 +382137,7 @@ rule SIGNATURE_BASE_Equationgroup_Eh_1_1_0 : FILE
 		$x3 = "[-l Log File] [-m save MAC time file(s)] [-p Server Port]" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Evolvingstrategy_1_0_1 : FILE
 {
@@ -385909,9 +382148,9 @@ rule SIGNATURE_BASE_Equationgroup_Evolvingstrategy_1_0_1 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L170-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "87d25f1a4ca4a75292ab6cdcd1a79890c4475c2a9b34761ed92988bd517b4497"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L170-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_87d25f1a4ca4a75292ab6cdcd1a79890c4475c2a9b34761ed92988bd517b4497"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385925,7 +382164,7 @@ rule SIGNATURE_BASE_Equationgroup_Evolvingstrategy_1_0_1 : FILE
 		$x1 = "EXE=$DIR/sbin/ey_vrupdate" fullword ascii
 
 	condition:
-		( filesize <4KB and 1 of them )
+		( filesize < 4KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toast_V3_2_0 : FILE
 {
@@ -385936,9 +382175,9 @@ rule SIGNATURE_BASE_Equationgroup_Toast_V3_2_0 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L190-L205"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a505eaafb6882e2701fe0a9b8712f85c1073d83291436eeaa7f4c52876d12359"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L190-L205"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a505eaafb6882e2701fe0a9b8712f85c1073d83291436eeaa7f4c52876d12359"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385951,7 +382190,7 @@ rule SIGNATURE_BASE_Equationgroup_Toast_V3_2_0 : FILE
 		$s6 = "rbnoil -Roasting ->" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 50KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Sshobo : FILE
 {
@@ -385962,9 +382201,9 @@ rule SIGNATURE_BASE_Equationgroup_Sshobo : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L207-L223"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "90c892e06ccedb6a3208d728e9f3c27c14bbe1b4c13b63d4a350bbbf38efbe9d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L207-L223"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_90c892e06ccedb6a3208d728e9f3c27c14bbe1b4c13b63d4a350bbbf38efbe9d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -385978,7 +382217,7 @@ rule SIGNATURE_BASE_Equationgroup_Sshobo : FILE
 		$x4 = "packet_inject_ignore: block" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <600KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 600KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Magicjack_V1_1_0_0_Client_1_1_0_0 : FILE
 {
@@ -385989,9 +382228,9 @@ rule SIGNATURE_BASE_Equationgroup_Magicjack_V1_1_0_0_Client_1_1_0_0 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L225-L239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "44e853b8d148f84107d29449aa44b2e52226c9d2f397c019aa0f1d347863e388"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L225-L239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_44e853b8d148f84107d29449aa44b2e52226c9d2f397c019aa0f1d347863e388"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386003,7 +382242,7 @@ rule SIGNATURE_BASE_Equationgroup_Magicjack_V1_1_0_0_Client_1_1_0_0 : FILE
 		$x2 = "cmd += \"D=-l%s \" % self.options.LISTEN_PORT" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <80KB and 1 of them )
+		( uint16( 0 ) == 0x2123 and filesize < 80KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Packrat : FILE
 {
@@ -386014,9 +382253,9 @@ rule SIGNATURE_BASE_Equationgroup_Packrat : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L241-L256"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7e88e14e0d9c8e8f5ccca3bea78b875bf75fbf0dd54badc339237ca94f0d6373"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L241-L256"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7e88e14e0d9c8e8f5ccca3bea78b875bf75fbf0dd54badc339237ca94f0d6373"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386029,7 +382268,7 @@ rule SIGNATURE_BASE_Equationgroup_Packrat : FILE
 		$x5 = "$command = \"$nc$bindto -vv -l -p $port < ${ratremotename}\" ;" fullword ascii
 
 	condition:
-		( filesize <70KB and 1 of them )
+		( filesize < 70KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Telex : FILE
 {
@@ -386040,9 +382279,9 @@ rule SIGNATURE_BASE_Equationgroup_Telex : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L258-L274"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9661bc43831307cb04883cfe8e54ebb2fe72bf3d7731b2b483cd19c40a5aeaa9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L258-L274"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9661bc43831307cb04883cfe8e54ebb2fe72bf3d7731b2b483cd19c40a5aeaa9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386056,7 +382295,7 @@ rule SIGNATURE_BASE_Equationgroup_Telex : FILE
 		$s4 = "Timeout waiting for daemon to die.  Exploit probably failed." fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 50KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Calserver : FILE
 {
@@ -386067,9 +382306,9 @@ rule SIGNATURE_BASE_Equationgroup_Calserver : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L276-L291"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "85080074058703a696ac7f978abd8f4d5234f6553c19736fb52375421c4af42b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L276-L291"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_85080074058703a696ac7f978abd8f4d5234f6553c19736fb52375421c4af42b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386082,7 +382321,7 @@ rule SIGNATURE_BASE_Equationgroup_Calserver : FILE
 		$x3 = "(e)xploit, (r)ead, (m)ove and then write, (w)rite" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 30KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Porkclient : FILE
 {
@@ -386093,9 +382332,9 @@ rule SIGNATURE_BASE_Equationgroup_Porkclient : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L293-L308"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4de13f1cac8698fc86e44d29143877924aec4e6712415ee6b35810afed8072d6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L293-L308"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4de13f1cac8698fc86e44d29143877924aec4e6712415ee6b35810afed8072d6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386108,7 +382347,7 @@ rule SIGNATURE_BASE_Equationgroup_Porkclient : FILE
 		$s3 = "-r: Reuse socket for Nopen connection (requires -t, -d, -f, -n, NO -c)" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 30KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Electricslide : FILE
 {
@@ -386119,9 +382358,9 @@ rule SIGNATURE_BASE_Equationgroup_Electricslide : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L310-L326"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0803b61afc592d4fba523dc54d8f856a557b916a9f6e256efccd50178e8e024c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L310-L326"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0803b61afc592d4fba523dc54d8f856a557b916a9f6e256efccd50178e8e024c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386135,7 +382374,7 @@ rule SIGNATURE_BASE_Equationgroup_Electricslide : FILE
 		$x4 = "-------- Delete Key - Remove a *closed* tab" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <2000KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 2000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Libxmexploit2 : FILE
 {
@@ -386146,9 +382385,9 @@ rule SIGNATURE_BASE_Equationgroup_Libxmexploit2 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L328-L343"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7bd88d15cca38e91c65e8373194e35ab9492a80eb27b22ad4000e192f2d9b886"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L328-L343"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7bd88d15cca38e91c65e8373194e35ab9492a80eb27b22ad4000e192f2d9b886"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386161,7 +382400,7 @@ rule SIGNATURE_BASE_Equationgroup_Libxmexploit2 : FILE
 		$s3 = "Execve failed!" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 40KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Wrap_Telnet : FILE
 {
@@ -386172,9 +382411,9 @@ rule SIGNATURE_BASE_Equationgroup_Wrap_Telnet : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L345-L360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aa7fda8b95b697bb0541642677579f9db9df379048421481cdb66068032bf681"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L345-L360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aa7fda8b95b697bb0541642677579f9db9df379048421481cdb66068032bf681"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386187,7 +382426,7 @@ rule SIGNATURE_BASE_Equationgroup_Wrap_Telnet : FILE
 		$s3 = "echo \"Call back port2 = ${SPORT}\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <4KB and 1 of them )
+		( uint16( 0 ) == 0x2123 and filesize < 4KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Elgingamble
 {
@@ -386198,9 +382437,9 @@ rule SIGNATURE_BASE_Equationgroup_Elgingamble
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L362-L378"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e561794d969b6198f71115087db8cc89043f2079252eef22458450e16596b0eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L362-L378"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e561794d969b6198f71115087db8cc89043f2079252eef22458450e16596b0eb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -386225,9 +382464,9 @@ rule SIGNATURE_BASE_Equationgroup_Cmsd : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L380-L397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2b9c7ef750c2e45df7839395db51c93204bc9855f5de05bd59c50bb6a964bc8b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L380-L397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2b9c7ef750c2e45df7839395db51c93204bc9855f5de05bd59c50bb6a964bc8b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386241,7 +382480,7 @@ rule SIGNATURE_BASE_Equationgroup_Cmsd : FILE
 		$s2 = "xxx.XXXXXX" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 1 of ($x*)) or (2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 30KB and 1 of ( $x* ) ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Ebbshave : FILE
 {
@@ -386252,9 +382491,9 @@ rule SIGNATURE_BASE_Equationgroup_Ebbshave : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L399-L415"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8a1a5ddefc646dc55161eb9b2a1b0e4176df7e99660db48b245af3ef9ab0871c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L399-L415"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8a1a5ddefc646dc55161eb9b2a1b0e4176df7e99660db48b245af3ef9ab0871c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386268,7 +382507,7 @@ rule SIGNATURE_BASE_Equationgroup_Ebbshave : FILE
 		$s4 = "%s is a wrapper program for ebbnew_linux exploit for Sparc Solaris RPC services" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <20KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 20KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Eggbasket : FILE
 {
@@ -386279,9 +382518,9 @@ rule SIGNATURE_BASE_Equationgroup_Eggbasket : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L417-L432"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4800d5c820a18d3483dc5c055c0e2f5374ce3b160ecb4d940a00ec4a90ca50d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L417-L432"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4800d5c820a18d3483dc5c055c0e2f5374ce3b160ecb4d940a00ec4a90ca50d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386294,7 +382533,7 @@ rule SIGNATURE_BASE_Equationgroup_Eggbasket : FILE
 		$x3 = "# STARTING EXHAUSTIVE ATTACK AGAINST " fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <90KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Jparsescan : FILE
 {
@@ -386305,9 +382544,9 @@ rule SIGNATURE_BASE_Equationgroup_Jparsescan : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L434-L448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d86b6757abb5ad1902e91f100e6a6bea52e6e14684d184b6b8138270484275f4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L434-L448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d86b6757abb5ad1902e91f100e6a6bea52e6e14684d184b6b8138270484275f4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386319,7 +382558,7 @@ rule SIGNATURE_BASE_Equationgroup_Jparsescan : FILE
 		$s2 = "$gotsunos = ($line =~ /program version netid     address             service         owner/ );" fullword ascii
 
 	condition:
-		( filesize <40KB and 1 of them )
+		( filesize < 40KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Sambal : FILE
 {
@@ -386330,9 +382569,9 @@ rule SIGNATURE_BASE_Equationgroup_Sambal : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L450-L467"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6066332b16996a9d8635d3752f46c6529cfc2c94d3d6f0c9791f2068c982bf3e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L450-L467"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6066332b16996a9d8635d3752f46c6529cfc2c94d3d6f0c9791f2068c982bf3e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386347,7 +382586,7 @@ rule SIGNATURE_BASE_Equationgroup_Sambal : FILE
 		$s7 = "Usage: %s [-bBcCdfprsStv] [host]" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <90KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Pclean_V2_1_1_2 : FILE
 {
@@ -386358,9 +382597,9 @@ rule SIGNATURE_BASE_Equationgroup_Pclean_V2_1_1_2 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L469-L483"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9323ef0c76348d242b010cf0f1c6a1bf5dd120a02418350bb0ed137f468ac624"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L469-L483"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9323ef0c76348d242b010cf0f1c6a1bf5dd120a02418350bb0ed137f468ac624"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386372,7 +382611,7 @@ rule SIGNATURE_BASE_Equationgroup_Pclean_V2_1_1_2 : FILE
 		$s6 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 40KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Envisioncollision : FILE
 {
@@ -386383,9 +382622,9 @@ rule SIGNATURE_BASE_Equationgroup_Envisioncollision : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L485-L501"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8cd8c24b212ca71feb6093682fc614c88790c10d7c7d72dac65b047e5791894a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L485-L501"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8cd8c24b212ca71feb6093682fc614c88790c10d7c7d72dac65b047e5791894a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386399,7 +382638,7 @@ rule SIGNATURE_BASE_Equationgroup_Envisioncollision : FILE
 		$s4 = "$url = $host . \"/admin/index.php?adsess=\" . $enter . \"&app=core&module=applications&section=hooks&do=install_hook\";" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and 1 of ($x*)) or (2 of them )
+		( uint16( 0 ) == 0x2123 and filesize < 20KB and 1 of ( $x* ) ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Cmsex : FILE
 {
@@ -386410,9 +382649,9 @@ rule SIGNATURE_BASE_Equationgroup_Cmsex : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L503-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "997e08a49c5ae82bcc590e5febd449a4d3e9098f5aa154ccc0824b976f0a6365"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L503-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_997e08a49c5ae82bcc590e5febd449a4d3e9098f5aa154ccc0824b976f0a6365"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386427,7 +382666,7 @@ rule SIGNATURE_BASE_Equationgroup_Cmsex : FILE
 		$x5 = "If one choice fails, you may want to try another." fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and 1 of ($x*)) or (2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 50KB and 1 of ( $x* ) ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Exze : FILE
 {
@@ -386438,9 +382677,9 @@ rule SIGNATURE_BASE_Equationgroup_Exze : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L522-L537"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b8678f58da689be9507a345b6b80ece6cdb7a78d73db339bdc15ad0a66b4a2e6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L522-L537"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b8678f58da689be9507a345b6b80ece6cdb7a78d73db339bdc15ad0a66b4a2e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386453,7 +382692,7 @@ rule SIGNATURE_BASE_Equationgroup_Exze : FILE
 		$s3 = "zeke_remove" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <80KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 80KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_DUL : FILE
 {
@@ -386464,9 +382703,9 @@ rule SIGNATURE_BASE_Equationgroup_DUL : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L539-L553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "55df9a844352babf0c30075139e2a62cbf9db898280546d27b172e4d611ce1c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L539-L553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_55df9a844352babf0c30075139e2a62cbf9db898280546d27b172e4d611ce1c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386478,7 +382717,7 @@ rule SIGNATURE_BASE_Equationgroup_DUL : FILE
 		$x2 = "Here is the decoder+(encoded-decoder)+payload" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <80KB and 1 of them ) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 80KB and 1 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Slugger2 : FILE
 {
@@ -386489,9 +382728,9 @@ rule SIGNATURE_BASE_Equationgroup_Slugger2 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L555-L574"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c736fdfa96d5e99bc4d093c03a81b8a4f58501ec8c03a2891f9f694d88b5284"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L555-L574"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c736fdfa96d5e99bc4d093c03a81b8a4f58501ec8c03a2891f9f694d88b5284"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386507,7 +382746,7 @@ rule SIGNATURE_BASE_Equationgroup_Slugger2 : FILE
 		$s4 = "__rw_pshared" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and (4 of them and 1 of ($x*))) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 50KB and ( 4 of them and 1 of ( $x* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Ebbisland : FILE
 {
@@ -386518,9 +382757,9 @@ rule SIGNATURE_BASE_Equationgroup_Ebbisland : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L576-L594"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1f4b5054d4239e23146f0764ffe9037b658ecdb9a5f479956c5c45abc1012a17"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L576-L594"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1f4b5054d4239e23146f0764ffe9037b658ecdb9a5f479956c5c45abc1012a17"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386536,7 +382775,7 @@ rule SIGNATURE_BASE_Equationgroup_Ebbisland : FILE
 		$x6 = "*** Insane undocumented incremental port mode!!! ***" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Jackpop : FILE
 {
@@ -386547,9 +382786,9 @@ rule SIGNATURE_BASE_Equationgroup_Jackpop : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L596-L614"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6efc4ccd2727f93713ad35dc1f054fa25e976e8c3d95f00226fbd56d7f1ce30b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L596-L614"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6efc4ccd2727f93713ad35dc1f054fa25e976e8c3d95f00226fbd56d7f1ce30b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386564,7 +382803,7 @@ rule SIGNATURE_BASE_Equationgroup_Jackpop : FILE
 		$s4 = "raw troubles" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 3 of them ) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 30KB and 3 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Parsescan : FILE
 {
@@ -386575,9 +382814,9 @@ rule SIGNATURE_BASE_Equationgroup_Parsescan : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L616-L630"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "25e0bc21f93cd72814cd6114883ed903af84a62dced126201b6037a476dbd2cd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L616-L630"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_25e0bc21f93cd72814cd6114883ed903af84a62dced126201b6037a476dbd2cd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386589,7 +382828,7 @@ rule SIGNATURE_BASE_Equationgroup_Parsescan : FILE
 		$s2 = "Usage:  $prog [-f file] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Jscan : FILE
 {
@@ -386600,9 +382839,9 @@ rule SIGNATURE_BASE_Equationgroup_Jscan : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L632-L646"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d3bbdb90da9fa5b8b41a8b5d35a9b42e4fa15f291146575b0ef22e81441dcbde"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L632-L646"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d3bbdb90da9fa5b8b41a8b5d35a9b42e4fa15f291146575b0ef22e81441dcbde"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386614,7 +382853,7 @@ rule SIGNATURE_BASE_Equationgroup_Jscan : FILE
 		$s2 = "print \"java -jar jscanner.jar$scanth$list\\n\";" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Promptkill : FILE
 {
@@ -386625,9 +382864,9 @@ rule SIGNATURE_BASE_Equationgroup_Promptkill : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L648-L662"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7b46161b8cbb9a539171349b3e2a58f8e5a48c344b6d99020b3e96da9c878771"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L648-L662"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7b46161b8cbb9a539171349b3e2a58f8e5a48c344b6d99020b3e96da9c878771"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386639,7 +382878,7 @@ rule SIGNATURE_BASE_Equationgroup_Promptkill : FILE
 		$x2 = "$xargs=\"-title \\\"Kill process $pid?\\\" -name \\\"Kill process $pid?\\\" -bg white -fg red -geometry 202x19+0+0\" ;" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Epoxyresin_V1_0_0 : FILE
 {
@@ -386650,9 +382889,9 @@ rule SIGNATURE_BASE_Equationgroup_Epoxyresin_V1_0_0 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L664-L681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c1cbc18f05b299837463aa27a9c47ea0355ca5974b2c6ab1e0a18cc9ad1b26a1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L664-L681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c1cbc18f05b299837463aa27a9c47ea0355ca5974b2c6ab1e0a18cc9ad1b26a1"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -386666,7 +382905,7 @@ rule SIGNATURE_BASE_Equationgroup_Epoxyresin_V1_0_0 : FILE
 		$s3 = "/boot/System.map-%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 30KB and $x1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Estopmoonlit : FILE
 {
@@ -386677,9 +382916,9 @@ rule SIGNATURE_BASE_Equationgroup_Estopmoonlit : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L683-L699"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "06293b6f48d2595f3426088cddc4b0c4d1ebc1de90fa640d5b5e806a45a2b6bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L683-L699"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_06293b6f48d2595f3426088cddc4b0c4d1ebc1de90fa640d5b5e806a45a2b6bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386693,7 +382932,7 @@ rule SIGNATURE_BASE_Equationgroup_Estopmoonlit : FILE
 		$x4 = "[!] selinux apparently enforcing.  Continue [y|n]? " fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Envoytomato : FILE
 {
@@ -386704,9 +382943,9 @@ rule SIGNATURE_BASE_Equationgroup_Envoytomato : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L701-L715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f15b3b4281ec45a7a71c9bf8b88c60befec665f78b76a615c5912a6b7f94235b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L701-L715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f15b3b4281ec45a7a71c9bf8b88c60befec665f78b76a615c5912a6b7f94235b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386718,7 +382957,7 @@ rule SIGNATURE_BASE_Equationgroup_Envoytomato : FILE
 		$s2 = "[-] failed to spawn shell" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Smash : FILE
 {
@@ -386729,9 +382968,9 @@ rule SIGNATURE_BASE_Equationgroup_Smash : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L717-L732"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "073496e34dded05be40ee851442f9c0ec998f35e02a5d4221677a195b792f786"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L717-L732"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_073496e34dded05be40ee851442f9c0ec998f35e02a5d4221677a195b792f786"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386744,7 +382983,7 @@ rule SIGNATURE_BASE_Equationgroup_Smash : FILE
 		$x3 = "no port. assuming 22..." fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Ratload : FILE
 {
@@ -386755,9 +382994,9 @@ rule SIGNATURE_BASE_Equationgroup_Ratload : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L734-L749"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "34298175663a01b26e317c31c720f2f4fe93a5c7e375c9642664479d8672e8cd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L734-L749"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_34298175663a01b26e317c31c720f2f4fe93a5c7e375c9642664479d8672e8cd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386770,7 +383009,7 @@ rule SIGNATURE_BASE_Equationgroup_Ratload : FILE
 		$s6 = "uncompress -f ${NAME}.Z && PATH=. ${ARGS1} ${NAME} ${ARGS2} && rm -f ${NAME}" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Ys : FILE
 {
@@ -386781,9 +383020,9 @@ rule SIGNATURE_BASE_Equationgroup_Ys : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L751-L766"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4962cc732ce3dea6dc52c7d91ce94089eb4498ba4c442ecc6363ea75de47de31"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L751-L766"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4962cc732ce3dea6dc52c7d91ce94089eb4498ba4c442ecc6363ea75de47de31"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386796,7 +383035,7 @@ rule SIGNATURE_BASE_Equationgroup_Ys : FILE
 		$x4 = "FATAL ERROR: -x port and -n port MUST NOT BE THE SAME." fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Ewok : FILE
 {
@@ -386807,9 +383046,9 @@ rule SIGNATURE_BASE_Equationgroup_Ewok : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L768-L784"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d10d75885daa8cd20e5d7d7e142d1e7a2dbc10a50debf7892629f67b948bbdbe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L768-L784"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d10d75885daa8cd20e5d7d7e142d1e7a2dbc10a50debf7892629f67b948bbdbe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386823,7 +383062,7 @@ rule SIGNATURE_BASE_Equationgroup_Ewok : FILE
 		$x4 = "--- ewok version" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <80KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 80KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Xspy : FILE
 {
@@ -386834,9 +383073,9 @@ rule SIGNATURE_BASE_Equationgroup_Xspy : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L786-L799"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "94ab45d6c94c63c5c9c68ee3d509143af4eb574058c0cd4f26eed8058dbd9213"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L786-L799"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_94ab45d6c94c63c5c9c68ee3d509143af4eb574058c0cd4f26eed8058dbd9213"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386847,7 +383086,7 @@ rule SIGNATURE_BASE_Equationgroup_Xspy : FILE
 		$s1 = "USAGE: xspy -display <display> -delay <usecs> -up" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <60KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 60KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Estesfox
 {
@@ -386858,9 +383097,9 @@ rule SIGNATURE_BASE_Equationgroup_Estesfox
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L801-L814"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bfbc8ac62dcb61b492b1803de535f51ceb54ac83e45071270a6ef5faeaa521b2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L801-L814"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bfbc8ac62dcb61b492b1803de535f51ceb54ac83e45071270a6ef5faeaa521b2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -386882,9 +383121,9 @@ rule SIGNATURE_BASE_Equationgroup_Elatedmonkey_1_0_1_1 : FILE
 		date = "2017-04-08"
 		modified = "2022-08-18"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L816-L832"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "756337ecb951357c5440ea2fe010982089539c35dc556288d61db6de22348c1f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L816-L832"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_756337ecb951357c5440ea2fe010982089539c35dc556288d61db6de22348c1f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386897,7 +383136,7 @@ rule SIGNATURE_BASE_Equationgroup_Elatedmonkey_1_0_1_1 : FILE
 		$s4 = "cat > /dev/tcp/127.0.0.1/80 <<" ascii
 
 	condition:
-		filesize <15KB and 2 of them
+		filesize < 15KB and 2 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Scanner : FILE
 {
@@ -386908,9 +383147,9 @@ rule SIGNATURE_BASE_Equationgroup_Scanner : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L834-L849"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b0454fd41d3591fc5811da6407a422b7c28d0b923109cdfa85b337cc7fffb178"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L834-L849"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b0454fd41d3591fc5811da6407a422b7c28d0b923109cdfa85b337cc7fffb178"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386923,7 +383162,7 @@ rule SIGNATURE_BASE_Equationgroup_Scanner : FILE
 		$x5 = "-scan winn %s one" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		filesize < 250KB and 1 of them
 }
 rule SIGNATURE_BASE_Equationgroup__Ftshell_Ftshell_V3_10_3_0 : FILE
 {
@@ -386934,9 +383173,9 @@ rule SIGNATURE_BASE_Equationgroup__Ftshell_Ftshell_V3_10_3_0 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L853-L871"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1eb7915fd057b2cc5f788ca11b3c71210ce5e7ac29c52790c249490435e62926"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L853-L871"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1eb7915fd057b2cc5f788ca11b3c71210ce5e7ac29c52790c249490435e62926"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386952,7 +383191,7 @@ rule SIGNATURE_BASE_Equationgroup__Ftshell_Ftshell_V3_10_3_0 : FILE
 		$s4 = "# ftshell -- File Transfer Shell" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <100KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x2123 and filesize < 100KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup__Scanner_Scanner_V2_1_2 : FILE
 {
@@ -386963,9 +383202,9 @@ rule SIGNATURE_BASE_Equationgroup__Scanner_Scanner_V2_1_2 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L873-L892"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c42aaacea1347fd64d7f91421f692e77e33e273d4c2e71806ef7f5f086aba11"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L873-L892"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c42aaacea1347fd64d7f91421f692e77e33e273d4c2e71806ef7f5f086aba11"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -386982,7 +383221,7 @@ rule SIGNATURE_BASE_Equationgroup__Scanner_Scanner_V2_1_2 : FILE
 		$s5 = "program vers proto   port  service" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <100KB and 2 of them ) or ( all of them )
+		( uint16( 0 ) == 0x457f and filesize < 100KB and 2 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Equationgroup__Ghost_Sparc_Ghost_X86_3 : FILE
 {
@@ -386993,9 +383232,9 @@ rule SIGNATURE_BASE_Equationgroup__Ghost_Sparc_Ghost_X86_3 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L894-L912"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c4ad8e06934c1ece520863951f14cbf86d1bc4bba97aede1d58def1e5c7df4eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L894-L912"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c4ad8e06934c1ece520863951f14cbf86d1bc4bba97aede1d58def1e5c7df4eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387011,7 +383250,7 @@ rule SIGNATURE_BASE_Equationgroup__Ghost_Sparc_Ghost_X86_3 : FILE
 		$x4 = "You will not be able to run the shellcode. Exiting..." fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <70KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 70KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup__Pclean_V2_1_1_Pclean_V2_1_1_4 : FILE
 {
@@ -387022,9 +383261,9 @@ rule SIGNATURE_BASE_Equationgroup__Pclean_V2_1_1_Pclean_V2_1_1_4 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L914-L930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5622d6fff876fa5d07795491d14f0396378c1b07b69cf8bcabb5e0bd3c19e72a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L914-L930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5622d6fff876fa5d07795491d14f0396378c1b07b69cf8bcabb5e0bd3c19e72a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387038,7 +383277,7 @@ rule SIGNATURE_BASE_Equationgroup__Pclean_V2_1_1_Pclean_V2_1_1_4 : FILE
 		$s2 = "e.g.: -n 1-1024,1080,6666,31337 " fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 50KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup__Jparsescan_Parsescan_5 : FILE
 {
@@ -387049,9 +383288,9 @@ rule SIGNATURE_BASE_Equationgroup__Jparsescan_Parsescan_5 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L932-L950"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "719baa53db53f4cc4f3e9ed935814e42e5cb4b7fb8eaaa373feb73df69bfcde0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L932-L950"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_719baa53db53f4cc4f3e9ed935814e42e5cb4b7fb8eaaa373feb73df69bfcde0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387067,7 +383306,7 @@ rule SIGNATURE_BASE_Equationgroup__Jparsescan_Parsescan_5 : FILE
 		$s4 = "-x IP      gives \\\"hostname:# users:load ...\\\" if positive xwin scan" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <40KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x2123 and filesize < 40KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup__Funnelout_V4_1_0_1 : FILE
 {
@@ -387078,9 +383317,9 @@ rule SIGNATURE_BASE_Equationgroup__Funnelout_V4_1_0_1 : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L952-L969"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ae0b387725017de2766593ea55677dca36eee68107e0692a7d5e2526db74765b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L952-L969"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ae0b387725017de2766593ea55677dca36eee68107e0692a7d5e2526db74765b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387095,7 +383334,7 @@ rule SIGNATURE_BASE_Equationgroup__Funnelout_V4_1_0_1 : FILE
 		$s4 = "#existsUser($u) or die \"User '$u' does not exist in database.\\n\";" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <100KB and 2 of them ) or ( all of them )
+		( uint16( 0 ) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Equationgroup__Magicjack_V1_1_0_0_Client : FILE
 {
@@ -387106,9 +383345,9 @@ rule SIGNATURE_BASE_Equationgroup__Magicjack_V1_1_0_0_Client : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L971-L988"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e22b01aa9b1283fa7a326b7c0f8047ed373fac750c89e9ba02c49f0f454e275"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L971-L988"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e22b01aa9b1283fa7a326b7c0f8047ed373fac750c89e9ba02c49f0f454e275"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387123,7 +383362,7 @@ rule SIGNATURE_BASE_Equationgroup__Magicjack_V1_1_0_0_Client : FILE
 		$s4 = "num = self.bytes2long(data)" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <80KB and 3 of them ) or ( all of them )
+		( uint16( 0 ) == 0x2123 and filesize < 80KB and 3 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Equationgroup__Ftshell : FILE
 {
@@ -387134,9 +383373,9 @@ rule SIGNATURE_BASE_Equationgroup__Ftshell : FILE
 		date = "2017-04-08"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L990-L1007"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "84c646b2c81f870f650fafd26471017b00b3b7020e72390f818304958e694572"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L990-L1007"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_84c646b2c81f870f650fafd26471017b00b3b7020e72390f818304958e694572"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387151,7 +383390,7 @@ rule SIGNATURE_BASE_Equationgroup__Ftshell : FILE
 		$s3 = "global dothisreallyquiet" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <100KB and 2 of them ) or ( all of them )
+		( uint16( 0 ) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Store_Linux_I386_V_3_3_0 : FILE
 {
@@ -387162,9 +383401,9 @@ rule SIGNATURE_BASE_Equationgroup_Store_Linux_I386_V_3_3_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1018-L1033"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f284c2fecee23f01f83e0534d7d56a88b102e6dcc02a26321fe246604dc8cb0e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1018-L1033"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f284c2fecee23f01f83e0534d7d56a88b102e6dcc02a26321fe246604dc8cb0e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387177,7 +383416,7 @@ rule SIGNATURE_BASE_Equationgroup_Store_Linux_I386_V_3_3_0 : FILE
 		$s3 = "[!] Name has size of 0!" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <60KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 60KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Genkey : FILE
 {
@@ -387188,9 +383427,9 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Genkey : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1035-L1049"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c1d823e297b0b1f47f12a3240d59f5ecc482f1140e5b2962f76ec2fff719664a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1035-L1049"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c1d823e297b0b1f47f12a3240d59f5ecc482f1140e5b2962f76ec2fff719664a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387202,7 +383441,7 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Genkey : FILE
 		$x2 = "client_auth = binascii.hexlify(lo_execute('openssl rand 16'))" fullword ascii
 
 	condition:
-		( filesize <3KB and all of them )
+		( filesize < 3KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Cursetingle_2_0_1_2_Mswin32_V_2_0_1 : FILE
 {
@@ -387213,9 +383452,9 @@ rule SIGNATURE_BASE_Equationgroup_Cursetingle_2_0_1_2_Mswin32_V_2_0_1 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1051-L1065"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bc27edc946beb5065d4fe43e53a33b448c24c7dd3eae0cedd4770c02fce7836b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1051-L1065"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bc27edc946beb5065d4fe43e53a33b448c24c7dd3eae0cedd4770c02fce7836b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387227,7 +383466,7 @@ rule SIGNATURE_BASE_Equationgroup_Cursetingle_2_0_1_2_Mswin32_V_2_0_1 : FILE
 		$s2 = "0123456789abcdefABCEDF:" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Cursesleepy_Mswin32_V_1_0_0 : FILE
 {
@@ -387238,9 +383477,9 @@ rule SIGNATURE_BASE_Equationgroup_Cursesleepy_Mswin32_V_1_0_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1067-L1082"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0dcbf2b314ff9c392ae0cb4f14762dd20c6b85f7f547af683db3aea1c57dee57"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1067-L1082"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0dcbf2b314ff9c392ae0cb4f14762dd20c6b85f7f547af683db3aea1c57dee57"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387253,7 +383492,7 @@ rule SIGNATURE_BASE_Equationgroup_Cursesleepy_Mswin32_V_1_0_0 : FILE
 		$op2 = { 33 C0 F3 A6 74 14 8B 5D 08 8B 4B 34 50 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Cursehelper_Win2K_I686_V_2_2_0 : FILE
 {
@@ -387264,9 +383503,9 @@ rule SIGNATURE_BASE_Equationgroup_Cursehelper_Win2K_I686_V_2_2_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1084-L1100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f6c92fc3540750a1223682b1672575b3a3120f5ebf63190a9b31d7e4e5ce13c7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1084-L1100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f6c92fc3540750a1223682b1672575b3a3120f5ebf63190a9b31d7e4e5ce13c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387279,7 +383518,7 @@ rule SIGNATURE_BASE_Equationgroup_Cursehelper_Win2K_I686_V_2_2_0 : FILE
 		$op2 = { e9 a2 f2 ff ff ff 85 b4 fe ff ff 8b 95 a8 fe ff }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Addkey : FILE
 {
@@ -387290,9 +383529,9 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Addkey : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1102-L1117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec5b7499e3c3cc6b581c381ae61a4c987691c0d93dd589a5907fd7419335963a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1102-L1117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec5b7499e3c3cc6b581c381ae61a4c987691c0d93dd589a5907fd7419335963a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387305,7 +383544,7 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Addkey : FILE
 		$x3 = "print '  -k keyfile   the key text file to inject'" fullword ascii
 
 	condition:
-		( filesize <20KB and 1 of them )
+		( filesize < 20KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Noclient_3_3_2 : FILE
 {
@@ -387316,9 +383555,9 @@ rule SIGNATURE_BASE_Equationgroup_Noclient_3_3_2 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1119-L1136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "14b1f135da81fd9a071e0f692bc7f1ab6f6f63d7dd05e1557e5c2d51135727b6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1119-L1136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_14b1f135da81fd9a071e0f692bc7f1ab6f6f63d7dd05e1557e5c2d51135727b6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387333,7 +383572,7 @@ rule SIGNATURE_BASE_Equationgroup_Noclient_3_3_2 : FILE
 		$s5 = "Attempting connection from 0.0.0.0:" ascii
 
 	condition:
-		( filesize <1000KB and 1 of them )
+		( filesize < 1000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Curseflower_Mswin32_V_1_0_0 : FILE
 {
@@ -387344,9 +383583,9 @@ rule SIGNATURE_BASE_Equationgroup_Curseflower_Mswin32_V_1_0_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1138-L1153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e70954945b3a5e08e5ae216b16702056b403dbf14391276eae1ed13e8273c1ee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1138-L1153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e70954945b3a5e08e5ae216b16702056b403dbf14391276eae1ed13e8273c1ee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387358,7 +383597,7 @@ rule SIGNATURE_BASE_Equationgroup_Curseflower_Mswin32_V_1_0_0 : FILE
 		$op1 = { 6a 04 83 c0 08 6a 01 50 e8 10 34 00 00 83 c4 10 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Tmpwatch : FILE
 {
@@ -387369,9 +383608,9 @@ rule SIGNATURE_BASE_Equationgroup_Tmpwatch : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1155-L1169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6fab5100f6ee0bf9a4e13e262c8d47e600f5aad64c7e04fe08fa42a5d78c38e8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1155-L1169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6fab5100f6ee0bf9a4e13e262c8d47e600f5aad64c7e04fe08fa42a5d78c38e8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387383,7 +383622,7 @@ rule SIGNATURE_BASE_Equationgroup_Tmpwatch : FILE
 		$s2 = "chmod 4777 /tmp/.scsi/dev/bin/gsh" fullword ascii
 
 	condition:
-		( filesize <1KB and 1 of them )
+		( filesize < 1KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Orleans_Stride_Sunos5_9_V_2_4_0 : FILE
 {
@@ -387394,9 +383633,9 @@ rule SIGNATURE_BASE_Equationgroup_Orleans_Stride_Sunos5_9_V_2_4_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1171-L1186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1380b22e661926ebb2878d89c80e115a58d0bfc060681a55564c97c1e9f36765"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1171-L1186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1380b22e661926ebb2878d89c80e115a58d0bfc060681a55564c97c1e9f36765"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387409,7 +383648,7 @@ rule SIGNATURE_BASE_Equationgroup_Orleans_Stride_Sunos5_9_V_2_4_0 : FILE
 		$s3 = "TRANSIT" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Noprep : FILE
 {
@@ -387420,9 +383659,9 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Noprep : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1188-L1203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c27815333e05d318bc32d01e755386bc1d1dbfd9f2b92a460fbd0f703e9ba210"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1188-L1203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c27815333e05d318bc32d01e755386bc1d1dbfd9f2b92a460fbd0f703e9ba210"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387435,7 +383674,7 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Noprep : FILE
 		$x3 = " -i                do not autokill after 5 hours" fullword ascii
 
 	condition:
-		( filesize <9KB and 1 of them )
+		( filesize < 9KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Cursezinger_Linuxrh7_3_V_2_0_0 : FILE
 {
@@ -387446,9 +383685,9 @@ rule SIGNATURE_BASE_Equationgroup_Cursezinger_Linuxrh7_3_V_2_0_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1205-L1221"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa56fe4dd44d266741a3f0b0edfc24660b260c1ade45c23171f22bc43a3bee75"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1205-L1221"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa56fe4dd44d266741a3f0b0edfc24660b260c1ade45c23171f22bc43a3bee75"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387462,7 +383701,7 @@ rule SIGNATURE_BASE_Equationgroup_Cursezinger_Linuxrh7_3_V_2_0_0 : FILE
 		$s4 = "__strtoul_internal" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <400KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 400KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Seconddate_Implantstandalone_3_0_3 : FILE
 {
@@ -387473,9 +383712,9 @@ rule SIGNATURE_BASE_Equationgroup_Seconddate_Implantstandalone_3_0_3 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1223-L1238"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8d56f471104bfb2ef2bf730e5a8b60c123706f12eb52226895b123b16eed2883"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1223-L1238"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8d56f471104bfb2ef2bf730e5a8b60c123706f12eb52226895b123b16eed2883"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387488,7 +383727,7 @@ rule SIGNATURE_BASE_Equationgroup_Seconddate_Implantstandalone_3_0_3 : FILE
 		$s3 = "GhHcJ0HcF@LcF0LcN8H" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Watcher_Solaris_I386_V_3_3_0 : FILE
 {
@@ -387499,9 +383738,9 @@ rule SIGNATURE_BASE_Equationgroup_Watcher_Solaris_I386_V_3_3_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1240-L1256"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "61ded97e99e6bdfe2738c6d73719b3182d970aba8ea9d7cab751349669129de2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1240-L1256"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_61ded97e99e6bdfe2738c6d73719b3182d970aba8ea9d7cab751349669129de2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387515,7 +383754,7 @@ rule SIGNATURE_BASE_Equationgroup_Watcher_Solaris_I386_V_3_3_0 : FILE
 		$s12 = "GHFIJKLMNOPQRSTUVXW" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <700KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 700KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Now : FILE
 {
@@ -387526,9 +383765,9 @@ rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Now : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1258-L1272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1d7f009c5593ac1b1517024b828b016d705b63f6812a49d909f35c34b936e6d7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1258-L1272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1d7f009c5593ac1b1517024b828b016d705b63f6812a49d909f35c34b936e6d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387540,7 +383779,7 @@ rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Now : FILE
 		$x2 = "exec /usr/share/redmin/cgi/redmin" fullword ascii
 
 	condition:
-		( filesize <1KB and 1 of them )
+		( filesize < 1KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Post : FILE
 {
@@ -387551,9 +383790,9 @@ rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Post : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1274-L1287"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ffd95302df11d1ebab37817e967a1ad4d1e85e62b38a0ccd6adf0f36925e64c1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1274-L1287"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ffd95302df11d1ebab37817e967a1ad4d1e85e62b38a0ccd6adf0f36925e64c1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387564,7 +383803,7 @@ rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Post : FILE
 		$x1 = "op=cron&action=once&frame=cronOnceFrame&cronK=cronV&cronCommand=%2Ftmp%2Ftmpwatch&time=12%3A12+01%2F28%2F2005" ascii
 
 	condition:
-		( filesize <1KB and all of them )
+		( filesize < 1KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Curseyo_Win2K_V_1_0_0 : FILE
 {
@@ -387575,9 +383814,9 @@ rule SIGNATURE_BASE_Equationgroup_Curseyo_Win2K_V_1_0_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1289-L1306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ad9bb848a0c4805a14465ff44e3c967c9afa7369536a211a8a1fb100902fbb55"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1289-L1306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ad9bb848a0c4805a14465ff44e3c967c9afa7369536a211a8a1fb100902fbb55"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387591,7 +383830,7 @@ rule SIGNATURE_BASE_Equationgroup_Curseyo_Win2K_V_1_0_0 : FILE
 		$op2 = { ff 05 10 64 41 00 89 34 24 e8 df 1e 00 00 e9 31 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Gr : FILE
 {
@@ -387602,9 +383841,9 @@ rule SIGNATURE_BASE_Equationgroup_Gr : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1308-L1322"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6df2a36e51fbe23e090094a91da76ca881a65d7e129c6e428ffef13787f230bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1308-L1322"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6df2a36e51fbe23e090094a91da76ca881a65d7e129c6e428ffef13787f230bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387616,7 +383855,7 @@ rule SIGNATURE_BASE_Equationgroup_Gr : FILE
 		$s2 = "echo \"bailing. try a different name\"" fullword ascii
 
 	condition:
-		( filesize <1KB and all of them )
+		( filesize < 1KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Curseroot_Win2K_V_2_1_0 : FILE
 {
@@ -387627,9 +383866,9 @@ rule SIGNATURE_BASE_Equationgroup_Curseroot_Win2K_V_2_1_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1324-L1340"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "64ea35c9287ed35b5e7fbc8aaa228f87bc003111dd6fc35f5277eeea5f371a2c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1324-L1340"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_64ea35c9287ed35b5e7fbc8aaa228f87bc003111dd6fc35f5277eeea5f371a2c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387643,7 +383882,7 @@ rule SIGNATURE_BASE_Equationgroup_Curseroot_Win2K_V_2_1_0 : FILE
 		$op2 = { d3 e0 48 e9 0c ff ff ff 8b 45 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and $s1 and 2 of ($op*))
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and $s1 and 2 of ( $op* ) )
 }
 rule SIGNATURE_BASE_Equationgroup_Cursewham_Curserazor_Cursezinger_Curseroot_Win2K : FILE
 {
@@ -387654,9 +383893,9 @@ rule SIGNATURE_BASE_Equationgroup_Cursewham_Curserazor_Cursezinger_Curseroot_Win
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1342-L1362"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a5a8e6a516b51c2eed616c80a1162990c1dda4460ec7786793d66820ca15b5a4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1342-L1362"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a5a8e6a516b51c2eed616c80a1162990c1dda4460ec7786793d66820ca15b5a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387673,7 +383912,7 @@ rule SIGNATURE_BASE_Equationgroup_Cursewham_Curserazor_Cursezinger_Curseroot_Win
 		$op3 = { 7d e4 8d 5c 3f 01 0f af df c1 c3 05 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_I386_V_3_3_0 : FILE
 {
@@ -387684,9 +383923,9 @@ rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_I386_V_3_3_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1364-L1381"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "245662b561178f4d929ed858811846b2a49dc80af25396864a3d7bd90d16ac2b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1364-L1381"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_245662b561178f4d929ed858811846b2a49dc80af25396864a3d7bd90d16ac2b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387701,7 +383940,7 @@ rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_I386_V_3_3_0 : FILE
 		$s17 = "Missing argument for `-x'." fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <700KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 700KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Charm_Saver_Win2K_V_2_0_0 : FILE
 {
@@ -387712,9 +383951,9 @@ rule SIGNATURE_BASE_Equationgroup_Charm_Saver_Win2K_V_2_0_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1383-L1399"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "87cea1f46a3165485274165e840a4945d6f6a6f9ff7fd011e685e8bb90acae8a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1383-L1399"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_87cea1f46a3165485274165e840a4945d6f6a6f9ff7fd011e685e8bb90acae8a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387727,7 +383966,7 @@ rule SIGNATURE_BASE_Equationgroup_Charm_Saver_Win2K_V_2_0_0 : FILE
 		$op2 = { ba ff ff ff ff 83 c4 6c 89 d0 5b 5e 5f 5d c3 90 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Cursehappy_Win2K_V_6_1_0 : FILE
 {
@@ -387738,9 +383977,9 @@ rule SIGNATURE_BASE_Equationgroup_Cursehappy_Win2K_V_6_1_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1401-L1415"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3bf5878c3be20a7a543d4937c6d820df726062e39ee262a6c31f7e91b32fd55e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1401-L1415"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3bf5878c3be20a7a543d4937c6d820df726062e39ee262a6c31f7e91b32fd55e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387752,7 +383991,7 @@ rule SIGNATURE_BASE_Equationgroup_Cursehappy_Win2K_V_6_1_0 : FILE
 		$op2 = { 89 4c 24 04 89 34 24 89 44 24 08 e8 ce 49 ff ff }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Store : FILE
 {
@@ -387763,9 +384002,9 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Store : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1417-L1433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "34dc21d933d56b6f6c342ca110d9cff7bb51d9fd1b88b359861e5b5650679ad0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1417-L1433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_34dc21d933d56b6f6c342ca110d9cff7bb51d9fd1b88b359861e5b5650679ad0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387779,7 +384018,7 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Store : FILE
 		$s4 = "[!] Value has size of 0!" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <60KB and 2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 60KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_X86_64_V_3_3_0 : FILE
 {
@@ -387790,9 +384029,9 @@ rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_X86_64_V_3_3_0 : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1435-L1450"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "be2ca3791ef1025db6a1dd6bcdf1a9f0b224c3f7585af4546029840251c50094"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1435-L1450"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_be2ca3791ef1025db6a1dd6bcdf1a9f0b224c3f7585af4546029840251c50094"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387805,7 +384044,7 @@ rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_X86_64_V_3_3_0 : FILE
 		$s3 = "forceprism" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <900KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 900KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Linux_Exactchange : FILE
 {
@@ -387816,9 +384055,9 @@ rule SIGNATURE_BASE_Equationgroup_Linux_Exactchange : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1452-L1472"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a0bcf5aa1f434fe9698a7408df68870d4908cdf87f22bb4acfedc50bb2c8f11f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1452-L1472"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a0bcf5aa1f434fe9698a7408df68870d4908cdf87f22bb4acfedc50bb2c8f11f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387836,7 +384075,7 @@ rule SIGNATURE_BASE_Equationgroup_Linux_Exactchange : FILE
 		$x4 = "[!] nothing looks vulnerable, trying everything" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <2000KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 2000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_X86_Linux_Exactchange : FILE
 {
@@ -387847,9 +384086,9 @@ rule SIGNATURE_BASE_Equationgroup_X86_Linux_Exactchange : FILE
 		date = "2017-04-09"
 		modified = "2023-12-05"
 		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1474-L1490"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9365eb74a364eb83150672919ea1abe635465fe3239fff26ba91037c74971466"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1474-L1490"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9365eb74a364eb83150672919ea1abe635465fe3239fff26ba91037c74971466"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387863,7 +384102,7 @@ rule SIGNATURE_BASE_Equationgroup_X86_Linux_Exactchange : FILE
 		$x2 = "[+] kernel stack size is %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <1000KB and 1 of them )
+		( uint16( 0 ) == 0x457f and filesize < 1000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwing_Rpcproxy_Pcdlllauncher : FILE
 {
@@ -387874,9 +384113,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwing_Rpcproxy_Pcdlllaunc
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1502-L1519"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8a01ea872c161521301182b922ece893f9ad1a33d902ec94963946f3b07d7266"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1502-L1519"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8a01ea872c161521301182b922ece893f9ad1a33d902ec94963946f3b07d7266"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387891,7 +384130,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwing_Rpcproxy_Pcdlllaunc
 		$x3 = "[*] Waiting for AuthCode from exploit" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Explodingcantouch_1_2_1 : FILE
 {
@@ -387902,9 +384141,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Explodingcantouch_1_2_1 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1521-L1536"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9239a61e71c86fc239f75baa9c781da18553e3c502495ad7429eaf3c744e870c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1521-L1536"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9239a61e71c86fc239f75baa9c781da18553e3c502495ad7429eaf3c744e870c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387917,7 +384156,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Explodingcantouch_1_2_1 : FILE
 		$s4 = "<http://%s/%s> (Not <locktoken:write1>) <http://%s/>" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_1_0_0 : FILE
 {
@@ -387928,9 +384167,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_1_0_0 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1538-L1551"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cb6959b7b50e6f2895bab5f3355bef836c9a9774285cfb5fea339ce3d2c67f73"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1538-L1551"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cb6959b7b50e6f2895bab5f3355bef836c9a9774285cfb5fea339ce3d2c67f73"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387941,7 +384180,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_1_0_0 : FILE
 		$s1 = "[+] Target is %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgopher_1_0_1 : FILE
 {
@@ -387952,9 +384191,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgopher_1_0_1 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1553-L1569"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6b099bd202a962e64cb4f417eb7e09893b869e950eb0740394d222e8b4b89283"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1553-L1569"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6b099bd202a962e64cb4f417eb7e09893b869e950eb0740394d222e8b4b89283"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387968,7 +384207,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgopher_1_0_1 : FILE
 		$x4 = "[+] Bound to Dimsvc, sending exploit request to opnum 29" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudit_2_1_0 : FILE
 {
@@ -387979,9 +384218,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudit_2_1_0 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1571-L1585"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "272d435758c0021bfd84d84c00eb05ece2461a39d092693b61d362365ab098cd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1571-L1585"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_272d435758c0021bfd84d84c00eb05ece2461a39d092693b61d362365ab098cd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -387993,7 +384232,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudit_2_1_0 : FILE
 		$x2 = "[-] build_exploit_run_x64():" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Darkpulsar_1_1_0 : FILE
 {
@@ -388004,9 +384243,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Darkpulsar_1_1_0 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1587-L1601"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "da8e1723da9e2d9955a3042bceb313d7d10903bfc078ba090c1c5a57be243b96"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1587-L1601"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_da8e1723da9e2d9955a3042bceb313d7d10903bfc078ba090c1c5a57be243b96"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388018,7 +384257,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Darkpulsar_1_1_0 : FILE
 		$x2 = "[%s] - Error building DLL loading shellcode" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholar_1_0_0 : FILE
 {
@@ -388029,9 +384268,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholar_1_0_0 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1603-L1617"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0265ce5dfb5697a0610a6023b75f6e3ef2ef0308f639978a8617337df2e16c77"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1603-L1617"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0265ce5dfb5697a0610a6023b75f6e3ef2ef0308f639978a8617337df2e16c77"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388043,7 +384282,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholar_1_0_0 : FILE
 		$x2 = "[+] Exploiting Target" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublepulsar_1_3_1 : FILE
 {
@@ -388054,9 +384293,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublepulsar_1_3_1 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1619-L1634"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1b7ed9dbd4312541bd4d939602f63ce1d909729cce1845b018be6a07a9cb7fe2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1619-L1634"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1b7ed9dbd4312541bd4d939602f63ce1d909729cce1845b018be6a07a9cb7fe2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388069,7 +384308,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublepulsar_1_3_1 : FILE
 		$x3 = "[-] Error setting ShellcodeFile name" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgophertouch_1_0_1 : FILE
 {
@@ -388080,9 +384319,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgophertouch_1_0_1 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1636-L1651"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "08646f7887daddd8efac875bc7b111df7a52feae0a4b81bfd2d2ae7ef9453b5e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1636-L1651"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_08646f7887daddd8efac875bc7b111df7a52feae0a4b81bfd2d2ae7ef9453b5e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388095,7 +384334,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgophertouch_1_0_1 : FILE
 		$x3 = "[+] Bound to Dimsvc, target IS vulnerable" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Smbtouch_1_1_1 : FILE
 {
@@ -388106,9 +384345,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Smbtouch_1_1_1 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1653-L1666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b5eb9d45dfc47470236923a5b8174bc17733e4333db6f8bbe63c4f4bc913cf26"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1653-L1666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b5eb9d45dfc47470236923a5b8174bc17733e4333db6f8bbe63c4f4bc913cf26"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388119,7 +384358,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Smbtouch_1_1_1 : FILE
 		$x1 = "[+] Target is vulnerable to %d exploit%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholartouch_1_0_0 : FILE
 {
@@ -388130,9 +384369,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholartouch_1_0_0 : FIL
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1668-L1682"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4c06fad158db8337ff768ad1553401ec31eee6b0d50333ce91a3a12e79d8981a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1668-L1682"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4c06fad158db8337ff768ad1553401ec31eee6b0d50333ce91a3a12e79d8981a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388144,7 +384383,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholartouch_1_0_0 : FIL
 		$x2 = "[-] Target NOT Vulernable" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudittouch_2_1_0 : FILE
 {
@@ -388155,9 +384394,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudittouch_2_1_0 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1684-L1698"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f4e62ec7a68115d5ff155ea94fb2c99b9177e928533338a111e531c694ff7b8f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1684-L1698"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f4e62ec7a68115d5ff155ea94fb2c99b9177e928533338a111e531c694ff7b8f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388169,7 +384408,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudittouch_2_1_0 : FILE
 		$x2 = "[-] OS fingerprint not complete - 0x%08x!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rpctouch_2_1_0 : FILE
 {
@@ -388180,9 +384419,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rpctouch_2_1_0 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1700-L1714"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3ea1f30c0a2c91cc9ca2eec8eaab167c83f4f52c2732d03d1e7fb99e63986662"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1700-L1714"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3ea1f30c0a2c91cc9ca2eec8eaab167c83f4f52c2732d03d1e7fb99e63986662"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388194,7 +384433,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rpctouch_2_1_0 : FILE
 		$x2 = "[*] SMB String: %s (%s)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mofconfig_1_0_0 : FILE
 {
@@ -388205,9 +384444,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mofconfig_1_0_0 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1716-L1729"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a922eb01efa52601b72c3d91a26585504fcf706a9ed16a36328f94f5871b0b24"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1716-L1729"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a922eb01efa52601b72c3d91a26585504fcf706a9ed16a36328f94f5871b0b24"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388218,7 +384457,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mofconfig_1_0_0 : FILE
 		$x1 = "[-] Get RemoteMOFTriggerPath error" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easypi_Explodingcan : FILE
 {
@@ -388229,9 +384468,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easypi_Explodingcan : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1731-L1747"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c5978d8cbffde2339cadd84f44d1df24e76f298a2f05bd9a6565246bfae1b1e3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1731-L1747"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c5978d8cbffde2339cadd84f44d1df24e76f298a2f05bd9a6565246bfae1b1e3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388245,7 +384484,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easypi_Explodingcan : FILE
 		$x3 = "[-] Encoding Exploit Payload failed!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwingtouch_1_0_4 : FILE
 {
@@ -388256,9 +384495,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwingtouch_1_0_4 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1749-L1763"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4707dbbb302b9b2192bdd23e4b64e25b5b2f49c3dd7951905a07cb5b54d524d9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1749-L1763"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4707dbbb302b9b2192bdd23e4b64e25b5b2f49c3dd7951905a07cb5b54d524d9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388270,7 +384509,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwingtouch_1_0_4 : FILE
 		$x2 = "[+] The target IS VULNERABLE" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Iistouch_1_2_2 : FILE
 {
@@ -388281,9 +384520,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Iistouch_1_2_2 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1765-L1779"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f4f5e17d3777d6ae8bfd0646eeffcd631331e4d8966f5124ebc9352438dc790f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1765-L1779"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f4f5e17d3777d6ae8bfd0646eeffcd631331e4d8966f5124ebc9352438dc790f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388295,7 +384534,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Iistouch_1_2_2 : FILE
 		$x2 = "[+] IIS Target OS: %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 60KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Namedpipetouch_2_0_0 : FILE
 {
@@ -388306,9 +384545,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Namedpipetouch_2_0_0 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1781-L1800"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "63d4395db4672b7a146dbd285e42344fb895b38f67fa9f7885b73855d7211190"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1781-L1800"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_63d4395db4672b7a146dbd285e42344fb895b38f67fa9f7885b73855d7211190"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388324,7 +384563,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Namedpipetouch_2_0_0 : FILE
 		$op1 = { 68 10 10 40 00 56 e8 e1 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 40KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easybee_1_0_1 : FILE
 {
@@ -388335,9 +384574,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easybee_1_0_1 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1802-L1816"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e3488a1d686b9ad468553cfe2c939e70ea6b9a21409df8b06bb54418495576ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1802-L1816"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e3488a1d686b9ad468553cfe2c939e70ea6b9a21409df8b06bb54418495576ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388349,7 +384588,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easybee_1_0_1 : FILE
 		$x2 = "Logging out of WebAdmin (as target account)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regread_1_1_1 : FILE
 {
@@ -388360,9 +384599,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regread_1_1_1 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1818-L1832"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5bf833d7fb073ad74037cf6df4729c75d50641a46a962aee8deac19e31b74419"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1818-L1832"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5bf833d7fb073ad74037cf6df4729c75d50641a46a962aee8deac19e31b74419"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388374,7 +384613,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regread_1_1_1 : FILE
 		$s2 = "f08d49ac41d1023d9d462d58af51414daff95a6a" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Englishmansdentist_1_2_0 : FILE
 {
@@ -388385,9 +384624,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Englishmansdentist_1_2_0 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1834-L1848"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cd415731c1c8398d2b0b1758c4e7eb3e708620b269f9312cf0a750ab2099162e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1834-L1848"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cd415731c1c8398d2b0b1758c4e7eb3e708620b269f9312cf0a750ab2099162e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388399,7 +384638,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Englishmansdentist_1_2_0 : FILE
 		$x2 = "Error connecting to target, TbMakeSocket() %s:%d." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_Eternalsynergy_Smbtouch : FILE
 {
@@ -388410,9 +384649,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_Eternalsynergy_Smbtou
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1850-L1870"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "faeac75104a15cac8528663a82eadbc7bc22cc0a1d1a3b3dfccb6ea46fb24a67"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1850-L1870"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_faeac75104a15cac8528663a82eadbc7bc22cc0a1d1a3b3dfccb6ea46fb24a67"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388429,7 +384668,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_Eternalsynergy_Smbtou
 		$op0 = { 8a 85 58 ff ff ff 88 43 4d }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance_2 : FILE
 {
@@ -388440,9 +384679,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance_2 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1872-L1889"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "481a08bc73ac66245c0712599a61cccdf5127276a09a67cf894f76b7763c5c9b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1872-L1889"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_481a08bc73ac66245c0712599a61cccdf5127276a09a67cf894f76b7763c5c9b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388457,7 +384696,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance_2 : FILE
 		$x2 = "[*] Attempting exploit method %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Emphasismine : FILE
 {
@@ -388468,9 +384707,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Emphasismine : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1891-L1910"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "20ec32f5e9e439fb212985d5ae104ae5742231f594423cd125a9e64ed6eb234a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1891-L1910"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_20ec32f5e9e439fb212985d5ae104ae5742231f594423cd125a9e64ed6eb234a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388487,7 +384726,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Emphasismine : FILE
 		$x5 = "Error: Domino is not the expected version. (%s, %s)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance : FILE
 {
@@ -388498,9 +384737,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1912-L1930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "757740038b9b1e1d099bb208104e9f48e7eb57ffb2de09e83c66df7914b816cb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1912-L1930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_757740038b9b1e1d099bb208104e9f48e7eb57ffb2de09e83c66df7914b816cb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388516,7 +384755,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance : FILE
 		$x4 = "***********    TARGET ARCHITECTURE IS X64    ************" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them ) or 2 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them ) or 2 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen4 : FILE
 {
@@ -388527,9 +384766,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen4 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1932-L1963"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "68a85b4109a2222dce0625aae8a55541206b9275236232e5049e5b4ee28d8e52"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1932-L1963"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_68a85b4109a2222dce0625aae8a55541206b9275236232e5049e5b4ee28d8e52"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388557,7 +384796,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen4 : FILE
 		$op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and (1 of ($x*) or 2 of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 150KB and ( 1 of ( $x* ) or 2 of them ) )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen1 : FILE
 {
@@ -388568,9 +384807,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen1 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1965-L1984"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cd40d51ba26706517dae332d84f574eb206a424693cfb586375695e364990b5d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1965-L1984"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cd40d51ba26706517dae332d84f574eb206a424693cfb586375695e364990b5d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388587,7 +384826,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen1 : FILE
 		$x5 = "Creating CURL connection handle..." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen2 : FILE
 {
@@ -388598,9 +384837,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen2 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L1986-L2012"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2c0833e92e23d595ebcf4af042febc44fba594356a647eb98e48b6fabf018d72"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L1986-L2012"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2c0833e92e23d595ebcf4af042febc44fba594356a647eb98e48b6fabf018d72"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388623,7 +384862,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen2 : FILE
 		$op2 = { eb 59 8b 4c 24 10 68 1c 46 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of ($s*) and 1 of ($op*)) or 3 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of ( $s* ) and 1 of ( $op* ) ) or 3 of them
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen3 : FILE
 {
@@ -388634,9 +384873,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen3 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2014-L2042"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "99b293d441fd27a6295e6a93123cf45e787472fb61575d566e7b4e0c61226fdb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2014-L2042"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_99b293d441fd27a6295e6a93123cf45e787472fb61575d566e7b4e0c61226fdb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388661,7 +384900,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen3 : FILE
 		$op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak : FILE
 {
@@ -388672,9 +384911,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2054-L2070"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "69b9514508f557376d876262793e5650289abfeeeee8b5ca9beaf42f3ec4d64c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2054-L2070"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_69b9514508f557376d876262793e5650289abfeeeee8b5ca9beaf42f3ec4d64c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388688,7 +384927,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak : FILE
 		$x4 = "-xta = same as -xt but show special chars & store in keys_all.txt" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 800KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Aduser_Implant : FILE
 {
@@ -388699,9 +384938,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Aduser_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2072-L2086"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d378773f4acd850e5a8d92d6cce84d57f659330edc025565cf4bc34afb0a6ae6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2072-L2086"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d378773f4acd850e5a8d92d6cce84d57f659330edc025565cf4bc34afb0a6ae6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388713,7 +384952,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Aduser_Implant : FILE
 		$s2 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Implant : FILE
 {
@@ -388724,9 +384963,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2088-L2112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aa46cb188ba820199c013633ade72ab1c8bea316384042e9e3b5098c439841a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2088-L2112"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aa46cb188ba820199c013633ade72ab1c8bea316384042e9e3b5098c439841a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388748,7 +384987,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Implant : FILE
                53 00 45 00 43 00 4C 00 4F 00 47 00 4F 00 4E }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Banner_Implant9X : FILE
 {
@@ -388759,9 +384998,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Banner_Implant9X : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2114-L2129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5bda7b8ab097c0a5ca90b05147d4227e5a03735b99633b5081d80d2d72bceba9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2114-L2129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5bda7b8ab097c0a5ca90b05147d4227e5a03735b99633b5081d80d2d72bceba9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388773,7 +385012,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Banner_Implant9X : FILE
 		$op1 = { c9 c3 57 8d 85 2c eb ff ff }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Greatdoc_Dll_Config : FILE
 {
@@ -388784,9 +385023,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Greatdoc_Dll_Config : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2131-L2147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "edb14cc9e51bbf6b3ca2c52f841edfa3df1ca89b3e7c1b5a59baf3a13be0fc46"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2131-L2147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_edb14cc9e51bbf6b3ca2c52f841edfa3df1ca89b3e7c1b5a59baf3a13be0fc46"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388800,7 +385039,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Greatdoc_Dll_Config : FILE
 		$x4 = "-useage: <scanner> \"<cmdline args>\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Scanner : FILE
 {
@@ -388811,9 +385050,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Scanner : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2149-L2166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7f2ee4ac260b78764573187c501ed27fbfdf573e618f15dbd307177afa670605"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2149-L2166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7f2ee4ac260b78764573187c501ed27fbfdf573e618f15dbd307177afa670605"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388828,7 +385067,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Scanner : FILE
 		$x5 = "***** %s ***** (length %d)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 90KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mcl_Ntmemory_Std : FILE
 {
@@ -388839,9 +385078,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mcl_Ntmemory_Std : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2168-L2183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d3c76cf0ca0f798e1ca3c0a1b88c3bb425f1c36439842c4c33247dfcb44a877"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2168-L2183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d3c76cf0ca0f798e1ca3c0a1b88c3bb425f1c36439842c4c33247dfcb44a877"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388854,7 +385093,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mcl_Ntmemory_Std : FILE
 		$op3 = { 3b 65 c6 44 24 3c 73 c6 44 24 3d 73 c6 44 24 3e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Tacothief : FILE
 {
@@ -388865,9 +385104,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Tacothief : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2185-L2198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "565d94ac0dd65de0926d11ae08ee78f14dcb211ca97c77c39f394fb36890fc6f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2185-L2198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_565d94ac0dd65de0926d11ae08ee78f14dcb211ca97c77c39f394fb36890fc6f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388878,7 +385117,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Tacothief : FILE
 		$x1 = "File too large!  Must be less than 655360 bytes." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntevt : FILE
 {
@@ -388889,9 +385128,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntevt : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2200-L2219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "29572cce9af51adf12db019f885f868fd77ff9034a6944a6286a4d2a0988842a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2200-L2219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_29572cce9af51adf12db019f885f868fd77ff9034a6944a6286a4d2a0988842a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388906,7 +385145,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntevt : FILE
 		$op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and $x1 or 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and $x1 or 3 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Processes_Target : FILE
 {
@@ -388917,9 +385156,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Processes_Target : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2221-L2236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e9e26224b7eafc999c9638d4591a45297e3293b0e90e63c2d207ee52848c4ce2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2221-L2236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e9e26224b7eafc999c9638d4591a45297e3293b0e90e63c2d207ee52848c4ce2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388932,7 +385171,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Processes_Target : FILE
 		$s5 = "%4ls%2ls%2ls%2ls%2ls%2ls.%11l[0-9]%1l[+-]%6s" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_St_Lp : FILE
 {
@@ -388943,9 +385182,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_St_Lp : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2238-L2254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "38a48a931856e0eb8e16b7902f5e494b50f8895d4221b5359fc3339d1b52eb8e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2238-L2254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_38a48a931856e0eb8e16b7902f5e494b50f8895d4221b5359fc3339d1b52eb8e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388959,7 +385198,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_St_Lp : FILE
 		$x4 = "E: Execute a Command on the Implant" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Epwrapper : FILE
 {
@@ -388970,9 +385209,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Epwrapper : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2256-L2271"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9a1a54cd3fef3db9a20f3be25336fcbabe0d993403f001a04a02b5dbfd629543"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2256-L2271"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9a1a54cd3fef3db9a20f3be25336fcbabe0d993403f001a04a02b5dbfd629543"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -388985,7 +385224,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Epwrapper : FILE
 		$s5 = "Usage: %ls <logdir> <dll_search_path> <dll_to_load_path> <socket>" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_2000 : FILE
 {
@@ -388996,9 +385235,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_2000 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2273-L2290"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dfcd7d928c921dbe7162712ca74a105a938fd9ac675faaaa228d05139b2077de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2273-L2290"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dfcd7d928c921dbe7162712ca74a105a938fd9ac675faaaa228d05139b2077de"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389012,7 +385251,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_2000 : FILE
 		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 3 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dllload_Target : FILE
 {
@@ -389023,9 +385262,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dllload_Target : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2292-L2309"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ab50ad9e01c55b3f40e98e6e2cf77c1ad7d6d6ec81a56bbb2263a6e05912e272"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2292-L2309"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ab50ad9e01c55b3f40e98e6e2cf77c1ad7d6d6ec81a56bbb2263a6e05912e272"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389039,7 +385278,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dllload_Target : FILE
 		$op3 = { 44 24 5c 6c c6 44 24 5d 65 c6 44 24 5e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_EXPA : FILE
 {
@@ -389050,9 +385289,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_EXPA : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2311-L2327"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2aa4ee5b128714cfa7f5d29f7ef110e1b18fb7bc21351444b2472ff74c4139d3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2311-L2327"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2aa4ee5b128714cfa7f5d29f7ef110e1b18fb7bc21351444b2472ff74c4139d3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389066,7 +385305,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_EXPA : FILE
 		$x4 = "UNEXPECTED SHELLCODE CONFIGURATION ERRORs" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <12000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 12000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Target : FILE
 {
@@ -389077,9 +385316,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Target : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2329-L2345"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3eedb6abb09989784a7dc5e721f9901e936f2c0241967b48858e5e5897b9f24a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2329-L2345"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3eedb6abb09989784a7dc5e721f9901e936f2c0241967b48858e5e5897b9f24a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389092,7 +385331,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Target : FILE
 		$op1 = { 83 7b 18 01 75 12 83 63 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_DS_Parselogs : FILE
 {
@@ -389103,9 +385342,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_DS_Parselogs : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2347-L2362"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4c35476b512378d1e3c7e7e3e9dae16adb0d4de4ecab143d034110836c11d0d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2347-L2362"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4c35476b512378d1e3c7e7e3e9dae16adb0d4de4ecab143d034110836c11d0d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389118,7 +385357,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_DS_Parselogs : FILE
 		$x3 = "Usage: %ws <capture_file> <results_prefix>" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Oracle_Implant : FILE
 {
@@ -389129,9 +385368,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Oracle_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2364-L2379"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "568a5d103527e6fd99bbac8d49a2d667f464fd16d5bf276f98c88c39e129b58b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2364-L2379"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_568a5d103527e6fd99bbac8d49a2d667f464fd16d5bf276f98c88c39e129b58b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389144,7 +385383,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Oracle_Implant : FILE
 		$op2 = { 48 8b ca e8 bf 84 00 00 4c 8b e0 8d 34 00 44 8d }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target : FILE
 {
@@ -389155,9 +385394,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2381-L2395"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ae3e0c30c9dbee311d4e5576b1a447ac57f8b1786dc5753246ad3c08ccecb85"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2381-L2395"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ae3e0c30c9dbee311d4e5576b1a447ac57f8b1786dc5753246ad3c08ccecb85"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389169,7 +385408,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target : FILE
 		$s3 = "6\"6<6C6H6M6Z6f6t6" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setresourcename : FILE
 {
@@ -389180,9 +385419,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setresourcename : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2397-L2413"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e26aac30e06da14060a955761d08e6f543db2f2747be2959b0090f60e6eb52a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2397-L2413"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e26aac30e06da14060a955761d08e6f543db2f2747be2959b0090f60e6eb52a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389196,7 +385435,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setresourcename : FILE
 		$x4 = "1 = [spcss32.exe] level3 exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Drivers_Implant : FILE
 {
@@ -389207,9 +385446,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Drivers_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2415-L2431"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "45190a317f3d293dbc3015873080d1253bfb3298008f5dea69ab1a5780a70721"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2415-L2431"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_45190a317f3d293dbc3015873080d1253bfb3298008f5dea69ab1a5780a70721"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389222,7 +385461,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Drivers_Implant : FILE
 		$op1 = { b0 01 e8 58 04 00 00 c3 33 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Shares_Target : FILE
 {
@@ -389233,9 +385472,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Shares_Target : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2433-L2449"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "11a1af97d720286a7fadf8b056f8f7add70acb041a828441166f5c74bc7a819d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2433-L2449"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_11a1af97d720286a7fadf8b056f8f7add70acb041a828441166f5c74bc7a819d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389249,7 +385488,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Shares_Target : FILE
 		$s4 = "\\\\%ls\\%ls" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntfltmgr : FILE
 {
@@ -389260,9 +385499,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntfltmgr : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2451-L2475"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9f280baf785f54218cbf47f65419cfe23c687e58021f36b5d116904d2cec9a9b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2451-L2475"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9f280baf785f54218cbf47f65419cfe23c687e58021f36b5d116904d2cec9a9b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389283,7 +385522,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntfltmgr : FILE
 		$op7 = { 8b 45 08 53 57 8b 7d 0c c7 40 34 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH : FILE
 {
@@ -389294,9 +385533,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2477-L2492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "273e38e287b1597753f653c0ed8300936581a1b767029d3f0ba757de589bcd5a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2477-L2492"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_273e38e287b1597753f653c0ed8300936581a1b767029d3f0ba757de589bcd5a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389309,7 +385548,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH : FILE
 		$op2 = { 89 44 24 34 eb 17 4c 8d 44 24 28 8b 54 24 30 48 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_LP : FILE
 {
@@ -389320,9 +385559,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_LP : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2494-L2508"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cd7b92f13e0a00d23baef70e38b476b62394106dfa70e831786f398c573aa744"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2494-L2508"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cd7b92f13e0a00d23baef70e38b476b62394106dfa70e831786f398c573aa744"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389334,7 +385573,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_LP : FILE
 		$s2 = "Format: <command> <target port> [lp port]" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remotecommand_Lp : FILE
 {
@@ -389345,9 +385584,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remotecommand_Lp : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2510-L2524"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "974772264324e7721f51a88534aaa3b4eb1d409e04f673783caf4849d90522de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2510-L2524"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_974772264324e7721f51a88534aaa3b4eb1d409e04f673783caf4849d90522de"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389359,7 +385598,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remotecommand_Lp : FILE
 		$s2 = "Unable to get TCP listen port: %08x" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Lp_Mstcp : FILE
 {
@@ -389370,9 +385609,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Lp_Mstcp : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2526-L2545"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d1423661f95d955f411414138da45cc4be59b2e6bf8e70f471b8f41fc9ea3f4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2526-L2545"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d1423661f95d955f411414138da45cc4be59b2e6bf8e70f471b8f41fc9ea3f4"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -389388,7 +385627,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Lp_Mstcp : FILE
 		$op3 = { aa 0f b7 45 fc 8b 52 04 8d 4e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and ( all of ($s*) or all of ($op*)))
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( all of ( $s* ) or all of ( $op* ) ) )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Renamer : FILE
 {
@@ -389399,9 +385638,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Renamer : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2547-L2561"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4941f31be6674499b202a3071d795317e6d97fb19088ea370180708e3d04bca7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2547-L2561"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4941f31be6674499b202a3071d795317e6d97fb19088ea370180708e3d04bca7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389413,7 +385652,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Renamer : FILE
 		$s2 = "Log file exists. You must delete it!!!" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Exploit : FILE
 {
@@ -389424,9 +385663,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Exploit : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2563-L2579"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f04ec5d1066b34ebee2504f7d229610e525743f7536d58bf99fc4f89ac6aa3b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2563-L2579"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f04ec5d1066b34ebee2504f7d229610e525743f7536d58bf99fc4f89ac6aa3b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389440,7 +385679,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Exploit : FILE
 		$s4 = "YOU CAN IGNORE ANY 'ServiceEntry returned error' messages after this..." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Gen : FILE
 {
@@ -389451,9 +385690,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Gen : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2581-L2600"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2ba0f5ada13bd8c71836f26e278c334fdbf2578eac189852befee7a81c07e169"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2581-L2600"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2ba0f5ada13bd8c71836f26e278c334fdbf2578eac189852befee7a81c07e169"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389469,7 +385708,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Gen : FILE
 		$op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Put_Implant9X : FILE
 {
@@ -389480,9 +385719,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Put_Implant9X : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2602-L2618"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e79a59e400aac544dc1160d5898e3053f88f7d5bc142440177526187650484e7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2602-L2618"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e79a59e400aac544dc1160d5898e3053f88f7d5bc142440177526187650484e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389495,7 +385734,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Put_Implant9X : FILE
 		$op2 = { 40 1b c9 23 c8 03 c8 38 5d 14 74 05 6a 03 58 eb }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Promiscdetect_Safe : FILE
 {
@@ -389506,9 +385745,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Promiscdetect_Safe : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2620-L2635"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4b8c2e9a00af4e6aed7f603dee0439357e3389180fbd2e83d6809e76dc7d0428"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2620-L2635"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4b8c2e9a00af4e6aed7f603dee0439357e3389180fbd2e83d6809e76dc7d0428"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389521,7 +385760,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Promiscdetect_Safe : FILE
 		$s3 = "Active filter for the adapter:" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Packetscan_Implant : FILE
 {
@@ -389532,9 +385771,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Packetscan_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2637-L2652"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "aa2106d2aad3e81c864181c851574f76f48cd4fe48bb3327135f2956d271dfde"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2637-L2652"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_aa2106d2aad3e81c864181c851574f76f48cd4fe48bb3327135f2956d271dfde"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389547,7 +385786,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Packetscan_Implant : FILE
 		$op2 = { e9 0b ff ff ff 8b 45 10 8d 4d c0 89 58 08 c6 45 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setports : FILE
 {
@@ -389558,9 +385797,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setports : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2654-L2668"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b2c61f6ca2d59d5e596e7c5c87ed3476d957763daeaf41e6f356bacf26415faf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2654-L2668"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b2c61f6ca2d59d5e596e7c5c87ed3476d957763daeaf41e6f356bacf26415faf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389572,7 +385811,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setports : FILE
 		$s2 = "Valid versions are:  1 = PC 1.2   2 = PC 1.2 (24 hour)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Grdo_Filescanner_Implant : FILE
 {
@@ -389583,9 +385822,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Grdo_Filescanner_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-01-06"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2670-L2686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ae88d27f41dd4888c445c654c919b3862fe3fc8c92aef816b22b2fb408a49cce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2670-L2686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ae88d27f41dd4888c445c654c919b3862fe3fc8c92aef816b22b2fb408a49cce"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389598,7 +385837,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Grdo_Filescanner_Implant : FILE
 		$s3 = "\\dllcache\\" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgks_Mskgu : FILE
 {
@@ -389609,9 +385848,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgks_Mskgu : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2688-L2704"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d3a230d29997ab247db2b7a2a0f369206513a98c16f744e2fb1fca6495d5e36b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2688-L2704"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d3a230d29997ab247db2b7a2a0f369206513a98c16f744e2fb1fca6495d5e36b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389625,7 +385864,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgks_Mskgu : FILE
 		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ifconfig_Target : FILE
 {
@@ -389636,9 +385875,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ifconfig_Target : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2706-L2722"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e88f589bed7830a1be81c85c9eb77b7f5c14bef2f0f1b3be6293aa9c5e870278"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2706-L2722"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e88f589bed7830a1be81c85c9eb77b7f5c14bef2f0f1b3be6293aa9c5e870278"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389651,7 +385890,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ifconfig_Target : FILE
 		$op2 = { 4c 8d 44 24 34 48 8d 57 08 41 8d 49 07 e8 a6 4b }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target : FILE
 {
@@ -389662,9 +385901,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2724-L2739"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3ee7a1284e2abd0282606c22b9112bd1af536e5fd48ef27e8d9216da8e1fb1c5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2724-L2739"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3ee7a1284e2abd0282606c22b9112bd1af536e5fd48ef27e8d9216da8e1fb1c5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389677,7 +385916,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target : FILE
 		$op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dsz_Implant : FILE
 {
@@ -389688,9 +385927,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dsz_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2741-L2755"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3d76131a42aed642a8c54076544488a8d24ec16416469813324541d72e30101b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2741-L2755"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3d76131a42aed642a8c54076544488a8d24ec16416469813324541d72e30101b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389702,7 +385941,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dsz_Implant : FILE
 		$s1 = "%02u:%02u:%02u.%03u-%4u: " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Genkey : FILE
 {
@@ -389713,9 +385952,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Genkey : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2757-L2770"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cdaa33645d0ea614891fc0579937e983b8b4f6c4830191518dc8272791dcc8df"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2757-L2770"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cdaa33645d0ea614891fc0579937e983b8b4f6c4830191518dc8272791dcc8df"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389726,7 +385965,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Genkey : FILE
 		$x1 = "* PrivateEncrypt -> PublicDecrypt FAILED" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Wmi_Implant : FILE
 {
@@ -389737,9 +385976,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Wmi_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2772-L2785"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "69754b6f26292aa1a457c71d079d934ce75794624c38e9d19c84ceb77a5fb26d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2772-L2785"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_69754b6f26292aa1a457c71d079d934ce75794624c38e9d19c84ceb77a5fb26d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389750,7 +385989,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Wmi_Implant : FILE
 		$x1 = "SELECT ProcessId,Description,ExecutablePath FROM Win32_Process" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Clocksvc : FILE
 {
@@ -389761,9 +386000,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Clocksvc : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2787-L2807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "04cdd8e4ca9df0231ca66caa8083eff1fe0834cdedc4360fce0a934970a6d162"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2787-L2807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_04cdd8e4ca9df0231ca66caa8083eff1fe0834cdedc4360fce0a934970a6d162"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389780,7 +386019,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Clocksvc : FILE
 		$s3 = "00000000E2C9ADBD8F470C7320D28000353813757F58860E90207F8874D2EB49851D3D3115A210DA6475CCFC111DCC05E4910E50071975F61972DCE345E89D88" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 2 of ($s*)))
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 2 of ( $s* ) ) )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Xxxridearea : FILE
 {
@@ -389791,9 +386030,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Xxxridearea : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2809-L2825"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4d2eeabbb3bb27f46232fe0a43f0ecda9f3589dbe6b08fd4f8aac14f6d12090b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2809-L2825"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4d2eeabbb3bb27f46232fe0a43f0ecda9f3589dbe6b08fd4f8aac14f6d12090b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389807,7 +386046,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Xxxridearea : FILE
 		$x4 = "Load and execute implant within the existing thread" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak_Min_Install : FILE
 {
@@ -389818,9 +386057,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak_Min_Install : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2827-L2842"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f224c87c5626fee98dae5b4bbab2b4468bdd126ac63371ede53545d7cb177123"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2827-L2842"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f224c87c5626fee98dae5b4bbab2b4468bdd126ac63371ede53545d7cb177123"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389833,7 +386072,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak_Min_Install : FILE
 		$s3 = "Phlook" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setouraddr : FILE
 {
@@ -389844,9 +386083,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setouraddr : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2844-L2858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d49bcef48afeb63b763c88443930f28be1d6f9f27d5f0bd9161d151fa3081868"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2844-L2858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d49bcef48afeb63b763c88443930f28be1d6f9f27d5f0bd9161d151fa3081868"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389858,7 +386097,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setouraddr : FILE
 		$s2 = "Replaced default IP address (127.0.0.1) with Local IP Address %d.%d.%d.%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Getadmin_LSADUMP_Modifyprivilege_Implant : FILE
 {
@@ -389869,9 +386108,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Getadmin_LSADUMP_Modifyprivilege
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2860-L2882"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ee5c818c29ccb1b280669f7f5e828963c4523b73b68674d8c0aae72189f0208c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2860-L2882"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ee5c818c29ccb1b280669f7f5e828963c4523b73b68674d8c0aae72189f0208c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389890,7 +386129,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Getadmin_LSADUMP_Modifyprivilege
 		$op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and (4 of ($s*) or all of ($op*)))
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and ( 4 of ( $s* ) or all of ( $op* ) ) )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sendpktrigger : FILE
 {
@@ -389901,9 +386140,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sendpktrigger : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2884-L2897"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "277367e69406a84ff4ff6b57d05bf97468b0083e23f9c5cd14cdd26cad5846d7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2884-L2897"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_277367e69406a84ff4ff6b57d05bf97468b0083e23f9c5cd14cdd26cad5846d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389914,7 +386153,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sendpktrigger : FILE
 		$x1 = "----====**** PORT KNOCK TRIGGER BEGIN ****====----" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target_2 : FILE
 {
@@ -389925,9 +386164,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target_2 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2899-L2916"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ab9ab949ee17655e424f6a65d3605e9900d214d1c620e051104762d5c214419f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2899-L2916"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ab9ab949ee17655e424f6a65d3605e9900d214d1c620e051104762d5c214419f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389941,7 +386180,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target_2 : FILE
 		$op2 = { e8 c2 34 00 00 90 48 8d 8c 24 00 01 00 00 e8 a4 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mstcp32_DXGHLP16_Tdip : FILE
 {
@@ -389952,9 +386191,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mstcp32_DXGHLP16_Tdip : FILE
 		date = "2017-04-15"
 		modified = "2023-01-06"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2918-L2938"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "35fab86ca4cb287c8046a1764a91523673e12b5729d87c90b0c298dcbfcf86eb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2918-L2938"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_35fab86ca4cb287c8046a1764a91523673e12b5729d87c90b0c298dcbfcf86eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389971,7 +386210,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mstcp32_DXGHLP16_Tdip : FILE
 		$s6 = "TCP/IP driver" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 4 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regprobe : FILE
 {
@@ -389982,9 +386221,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regprobe : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2940-L2955"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "01e7387c26ae3736c8fac1a3bb6ff283f8b06949af7a4ac36a556b292412bda2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2940-L2955"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_01e7387c26ae3736c8fac1a3bb6ff283f8b06949af7a4ac36a556b292412bda2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -389997,7 +386236,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regprobe : FILE
 		$x3 = "RpcProxy=255.255.255.255:65536" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublefeaturedll_Dll_2 : FILE
 {
@@ -390008,9 +386247,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublefeaturedll_Dll_2 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2957-L2974"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d6751ebfb2541c86b74583b7867de0a193ca106bf77337c8b10f15cdeb596bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2957-L2974"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d6751ebfb2541c86b74583b7867de0a193ca106bf77337c8b10f15cdeb596bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390025,7 +386264,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublefeaturedll_Dll_2 : FILE
 		$s3 = "D$8.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gangsterthief_Implant : FILE
 {
@@ -390036,9 +386275,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gangsterthief_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2976-L2993"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c8145d6eedf20cf95baf329a6240b5b740273ff0a7f82edd3c346eb8c67e69e1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2976-L2993"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c8145d6eedf20cf95baf329a6240b5b740273ff0a7f82edd3c346eb8c67e69e1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390053,7 +386292,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gangsterthief_Implant : FILE
 		$s8 = "NULLFILENAME" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallbackports : FILE
 {
@@ -390064,9 +386303,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallbackports : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L2995-L3009"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e087534589228ac1af8b8b8d2ebbc1bc99fc25b38cb4c4d840cab8e90e75644a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L2995-L3009"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e087534589228ac1af8b8b8d2ebbc1bc99fc25b38cb4c4d840cab8e90e75644a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390078,7 +386317,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallbackports : FILE
 		$s2 = "You may enter between 1 and 6 ports to change the defaults." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH_2000 : FILE
 {
@@ -390089,9 +386328,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH_2000 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3011-L3025"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0cd3ba351b1c5716ed322c9f177a848322324526f3d39c2be5cc34bc6aee9fa6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3011-L3025"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0cd3ba351b1c5716ed322c9f177a848322324526f3d39c2be5cc34bc6aee9fa6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390103,7 +386342,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH_2000 : FILE
 		$s14 = "SPRQWV" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rc5 : FILE
 {
@@ -390114,9 +386353,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rc5 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3027-L3043"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6d9ba73fe2a6da99ba44b00bcb5ecf51e983ac245fd5c6e620d35e8120514464"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3027-L3043"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6d9ba73fe2a6da99ba44b00bcb5ecf51e983ac245fd5c6e620d35e8120514464"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390130,7 +386369,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rc5 : FILE
 		$s4 = "Bad mode, should be 'd' or 'e'" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level_Generic : FILE
 {
@@ -390141,9 +386380,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level_Generic : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3045-L3075"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ddb3441b62b477ab7e3406a22e2a246b60c1d1d25e4acf52ee452a2dfac2daf7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3045-L3075"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ddb3441b62b477ab7e3406a22e2a246b60c1d1d25e4acf52ee452a2dfac2daf7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390170,7 +386409,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level_Generic : FILE
 		$op3 = { 44 24 6d 4c c6 44 24 6e 6f c6 44 24 6f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (2 of ($s*) or all of ($op*))
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 2 of ( $s* ) or all of ( $op* ) )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Http_Exe : FILE
 {
@@ -390181,9 +386420,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Http_Exe : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3077-L3094"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "50d83b157c338830eea6aba2e09e9d513dd5b50e257d1a16c0d51616bfa26a7f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3077-L3094"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_50d83b157c338830eea6aba2e09e9d513dd5b50e257d1a16c0d51616bfa26a7f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390197,7 +386436,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Http_Exe : FILE
 		$op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Parsecapture : FILE
 {
@@ -390208,9 +386447,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Parsecapture : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3096-L3111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8946bc6d1812a998757a4032755f37aa2be6121a958ebfb6fec90fa60da038fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3096-L3111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8946bc6d1812a998757a4032755f37aa2be6121a958ebfb6fec90fa60da038fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390223,7 +386462,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Parsecapture : FILE
 		$x3 = "Decrypting with key '%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x'" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Activedirectory_Target : FILE
 {
@@ -390234,9 +386473,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Activedirectory_Target : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3113-L3127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0dee634fe81870b21531046be512e9e54b127207c1910ca5ce5dfab63b1d0603"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3113-L3127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0dee634fe81870b21531046be512e9e54b127207c1910ca5ce5dfab63b1d0603"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390248,7 +386487,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Activedirectory_Target : FILE
 		$s2 = "(&(objectClass=user)(objectCategory=person)" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Legacy_Dll : HIGHVOL FILE
 {
@@ -390259,9 +386498,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Legacy_Dll : HIGHVOL FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3129-L3144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "923a595737bc83fe05d0ca7301c70e1cb03cecf97dfa99f5967b77b892a9a533"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3129-L3144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_923a595737bc83fe05d0ca7301c70e1cb03cecf97dfa99f5967b77b892a9a533"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -390274,7 +386513,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Legacy_Dll : HIGHVOL FILE
 		$op3 = { 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 6f c6 45 ea }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Svctouch : FILE
 {
@@ -390285,9 +386524,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Svctouch : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3146-L3159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0e876611ffe4740141a0454f68cfc7dd3c46e0fd44deeb9f3e0f66c8fccd3745"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3146-L3159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0e876611ffe4740141a0454f68cfc7dd3c46e0fd44deeb9f3e0f66c8fccd3745"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390298,7 +386537,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Svctouch : FILE
 		$s1 = "Causes: Firewall,Machine down,DCOM disabled\\not supported,etc." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 10KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Pwd_Implant : FILE
 {
@@ -390309,9 +386548,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Pwd_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3161-L3176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f565c42781ff4b0b37e7c00673fb2da2877018317cd415bdb47d4e019485c727"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3161-L3176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f565c42781ff4b0b37e7c00673fb2da2877018317cd415bdb47d4e019485c727"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390323,7 +386562,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Pwd_Implant : FILE
 		$op1 = { 40 50 89 44 24 18 FF 15 34 20 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Kisucomms_Target_2000 : FILE
 {
@@ -390334,9 +386573,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Kisucomms_Target_2000 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3178-L3198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d350228ad779d0453c1077afb2b533036eb1e43e4f74a433d68c781db963ab1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3178-L3198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d350228ad779d0453c1077afb2b533036eb1e43e4f74a433d68c781db963ab1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390351,7 +386590,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Kisucomms_Target_2000 : FILE
 		$op2 = { c6 45 fc 02 8d 8d 44 ff ff ff e8 d2 2f 00 00 eb }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*) or all of ($op*)))
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of ( $s* ) or all of ( $op* ) ) )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sldecoder : FILE
 {
@@ -390362,9 +386601,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sldecoder : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3200-L3214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "81a74169dc8f93f314f384bd859df07a4ffaaf430b221b440de922fad3497535"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3200-L3214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_81a74169dc8f93f314f384bd859df07a4ffaaf430b221b440de922fad3497535"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390376,7 +386615,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sldecoder : FILE
 		$x2 = "KeyLogger_Data" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Windows_Implant : FILE
 {
@@ -390387,9 +386626,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Windows_Implant : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3216-L3229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b6b349c98a328b4bbdd6d8718af8477c36ec219bb0076dd56998395d0ef5f32"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3216-L3229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b6b349c98a328b4bbdd6d8718af8477c36ec219bb0076dd56998395d0ef5f32"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390400,7 +386639,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Windows_Implant : FILE
 		$s2 = "0#0)0/050;0M0Y0h0|0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgkd_Msslu64_Msgki_Mssld : FILE
 {
@@ -390411,9 +386650,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgkd_Msslu64_Msgki_Mssld : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3231-L3256"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f61ce58356ffca197d4a2a4aae43414bcb8f2f284dbee818124dd450f4b50cb9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3231-L3256"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f61ce58356ffca197d4a2a4aae43414bcb8f2f284dbee818124dd450f4b50cb9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390435,7 +386674,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgkd_Msslu64_Msgki_Mssld : FILE
 		$op3 = { 48 b8 53 a5 e1 41 d4 f1 07 00 48 33 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 2 of ($s*) or all of ($op*))
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of ( $s* ) or all of ( $op* ) )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallback : FILE
 {
@@ -390446,9 +386685,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallback : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3258-L3272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "63a17dd56874085753cae92f70d6248ceaac6eaea99fda0d3a551e4988a73895"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3258-L3272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_63a17dd56874085753cae92f70d6248ceaac6eaea99fda0d3a551e4988a73895"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390460,7 +386699,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallback : FILE
 		$s3 = "USAGE: SetCallback <input file> <output file>" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Doublefeaturereader_Doublefeaturereader_0 : FILE
 {
@@ -390471,9 +386710,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Doublefeaturereader_Doublefeatu
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3274-L3293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9049e1fe31917ecc27e57afecd5845afcd966aac83d386b7c0995c1e3378a0d0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3274-L3293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9049e1fe31917ecc27e57afecd5845afcd966aac83d386b7c0995c1e3378a0d0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390489,7 +386728,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Doublefeaturereader_Doublefeatu
 		$op1 = { a1 30 21 41 00 89 85 d8 fc ff ff a1 34 21 41 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Vtuner_Vtuner_1 : FILE
 {
@@ -390500,9 +386739,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Vtuner_Vtuner_1 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3295-L3315"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8c161b36599b11264c31c54b94d6bdba53b3f13d27861ededc9f03bba394b775"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3295-L3315"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8c161b36599b11264c31c54b94d6bdba53b3f13d27861ededc9f03bba394b775"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390519,7 +386758,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Vtuner_Vtuner_1 : FILE
 		$op2 = { a1 8c 62 47 00 81 65 e0 ff ff ff 7f 03 d8 8b c1 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Ecwi_ESKE_EVFR_RPC2_2 : FILE
 {
@@ -390530,9 +386769,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Ecwi_ESKE_EVFR_RPC2_2 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3317-L3336"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "73522034c6588fee090eff87602568371562bdbcbe781ee6e152f3b854514690"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3317-L3336"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_73522034c6588fee090eff87602568371562bdbcbe781ee6e152f3b854514690"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390549,7 +386788,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Ecwi_ESKE_EVFR_RPC2_2 : FILE
 		$s3 = "Request non-NT session key" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__EAFU_Ecwi_ESKE_EVFR_RPC2_4 : FILE
 {
@@ -390560,9 +386799,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__EAFU_Ecwi_ESKE_EVFR_RPC2_4 : FI
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3338-L3361"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ed6e0e4e5a0849aad64bbc47c047f3fe388052d0ebe89de0257d4422fb39be21"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3338-L3361"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ed6e0e4e5a0849aad64bbc47c047f3fe388052d0ebe89de0257d4422fb39be21"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390582,7 +386821,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__EAFU_Ecwi_ESKE_EVFR_RPC2_4 : FI
 		$s4 = "ServerErrorBadNamePassword" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of ($s*) or 1 of ($x*))
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of ( $s* ) or 1 of ( $x* ) )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Sendcftrigger_Sendpktrigger_6 : FILE
 {
@@ -390593,9 +386832,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Sendcftrigger_Sendpktrigger_6 :
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3363-L3379"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4fb290bdf15e0701b6d543e1f978011046abe23e58c790ee1b992a5e0443a271"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3363-L3379"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4fb290bdf15e0701b6d543e1f978011046abe23e58c790ee1b992a5e0443a271"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390609,7 +386848,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Sendcftrigger_Sendpktrigger_6 :
 		$s6 = "* Failed to convert destination address into sockaddr_storage values" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Addresource : FILE
 {
@@ -390620,9 +386859,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Addresource : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3381-L3398"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e59863ac7f1147cdbc34cbd2b09183487999d9f01974279c7ccc0c5af7a99976"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3381-L3398"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e59863ac7f1147cdbc34cbd2b09183487999d9f01974279c7ccc0c5af7a99976"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390637,7 +386876,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Addresource : FILE
 		$s3 = "Unable to get path for target binary." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ESKE_RPC2_8 : FILE
 {
@@ -390648,9 +386887,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ESKE_RPC2_8 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3400-L3416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1fa706fb7f138d679421fe6c5b29d6bf93893adc8bffe9dffaafa728c1b2d1d5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3400-L3416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1fa706fb7f138d679421fe6c5b29d6bf93893adc8bffe9dffaafa728c1b2d1d5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390664,7 +386903,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ESKE_RPC2_8 : FILE
 		$s5 = "Fragment pickup: SmbNtReadX failed" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_10 : FILE
 {
@@ -390675,9 +386914,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_10 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3441-L3458"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bc30c62da7a7fd9144efef6f44c50552234f372c38c4479a024fbb0ca72530de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3441-L3458"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bc30c62da7a7fd9144efef6f44c50552234f372c38c4479a024fbb0ca72530de"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390692,7 +386931,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_10 : FILE
 		$s19 = "Sending Implant Payload.. cEncImplantPayload size(%d)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11 : FILE
 {
@@ -390703,9 +386942,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11 : FI
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3460-L3479"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8d43aa4823de248308597bd02cd27e598808b94e1ad7348ddb9e27d8a37ac426"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3460-L3479"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8d43aa4823de248308597bd02cd27e598808b94e1ad7348ddb9e27d8a37ac426"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390722,7 +386961,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11 : FI
 		$x2 = "Target is NOT vulnerable" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_Ridearea2_12 : FILE
 {
@@ -390733,9 +386972,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_Ridearea2_12 : FI
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3481-L3498"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0119cd825c02a094ddd76c5cb27bee6cef112f25333eab62017448804b29286e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3481-L3498"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0119cd825c02a094ddd76c5cb27bee6cef112f25333eab62017448804b29286e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390750,7 +386989,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_Ridearea2_12 : FI
 		$x2 = "** CreatePayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_13 : FILE
 {
@@ -390761,9 +387000,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_13 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3500-L3516"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0a1859266b859d4da660a7fc7d0015954ff100c39b941b5461ba0c99b5103547"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3500-L3516"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0a1859266b859d4da660a7fc7d0015954ff100c39b941b5461ba0c99b5103547"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390777,7 +387016,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_13 : FILE
 		$s2 = "ERROR: pGvars->pIntRideAreaImplantPayload is NULL" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Nameprobe_SMBTOUCH_14 : FILE
 {
@@ -390788,9 +387027,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Nameprobe_SMBTOUCH_14 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3518-L3535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c60fc34aa42810a5622fbe53122ded4ffb4ee321fed1badd481ce5c2ae5225ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3518-L3535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c60fc34aa42810a5622fbe53122ded4ffb4ee321fed1badd481ce5c2ae5225ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390805,7 +387044,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Nameprobe_SMBTOUCH_14 : FILE
 		$s3 = "<IRISNAMESERVER>" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15 : FILE
 {
@@ -390816,9 +387055,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3537-L3555"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6c61d17e1a985deb31bd6e1d603283e77df477b52fce9eb8b6cb4e99b2f9c4dc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3537-L3555"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6c61d17e1a985deb31bd6e1d603283e77df477b52fce9eb8b6cb4e99b2f9c4dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390834,7 +387073,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15 : FILE
 		$s8 = "Binding to RPC Interface %s over named pipe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_16 : FILE
 {
@@ -390845,9 +387084,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_16 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3557-L3578"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3e6c4e013727bbbf3859374af46553067a9fc782f2eca582ea13d8eab03380ce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3557-L3578"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3e6c4e013727bbbf3859374af46553067a9fc782f2eca582ea13d8eab03380ce"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390866,7 +387105,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_16 : FILE
 		$s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17 : FILE
 {
@@ -390877,9 +387116,9 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17 : FILE
 		date = "2017-04-15"
 		modified = "2023-12-05"
 		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3580-L3597"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ef86350732b5064035ff58b63202be29e906d2b566af105f03298e3e339eda52"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3580-L3597"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ef86350732b5064035ff58b63202be29e906d2b566af105f03298e3e339eda52"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390894,7 +387133,7 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17 : FILE
 		$s2 = "Target did not respond within specified amount of time" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
 }
 rule SIGNATURE_BASE_Equationgroup_Scanner_Output : FILE
 {
@@ -390905,9 +387144,9 @@ rule SIGNATURE_BASE_Equationgroup_Scanner_Output : FILE
 		date = "2017-04-17"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_apr17.yar#L3609-L3626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a8ac7e7f14d72798a1f6658eae4c66d871a525c8cb49afa2ca8656047da20524"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_apr17.yar#L3609-L3626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a8ac7e7f14d72798a1f6658eae4c66d871a525c8cb49afa2ca8656047da20524"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390922,7 +387161,7 @@ rule SIGNATURE_BASE_Equationgroup_Scanner_Output : FILE
 		$s5 = "rpc   Scan for RPC  folks" ascii fullword
 
 	condition:
-		filesize <1000KB and 2 of them
+		filesize < 1000KB and 2 of them
 }
 rule SIGNATURE_BASE_APT_Crywiper_Dec22
 {
@@ -390933,9 +387172,9 @@ rule SIGNATURE_BASE_APT_Crywiper_Dec22
 		date = "2022-12-05"
 		modified = "2023-12-05"
 		reference = "https://securelist-ru.translate.goog/novyj-troyanec-crywiper/106114/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ru_crywiper.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7c22e02ed996cd820ed87a0c5d50e3264629cdd887aad4ea466cadeccaee2b2f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ru_crywiper.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7c22e02ed996cd820ed87a0c5d50e3264629cdd887aad4ea466cadeccaee2b2f"
 		score = 75
 		quality = 85
 		tags = ""
@@ -390947,7 +387186,7 @@ rule SIGNATURE_BASE_APT_Crywiper_Dec22
 		$s2 = "fDenyTSConnections" ascii
 
 	condition:
-		1 of ($x*) or all of ($s*)
+		1 of ( $x* ) or all of ( $s* )
 }
 import "pe"
 
@@ -390960,9 +387199,9 @@ rule SIGNATURE_BASE_SUSP_THOR_Unsigned_Oct23_1 : FILE
 		date = "2023-10-28"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_unsigned_thor.yar#L4-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "12303e3549071dd6c8896f7a1222eb5905f6b4d3f320134416a5b6d53857adeb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_unsigned_thor.yar#L4-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_12303e3549071dd6c8896f7a1222eb5905f6b4d3f320134416a5b6d53857adeb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -390973,7 +387212,7 @@ rule SIGNATURE_BASE_SUSP_THOR_Unsigned_Oct23_1 : FILE
 		$sc1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 74 00 68 00 6F 00 72 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them and pe.number_of_signatures==0
+		uint16( 0 ) == 0x5a4d and all of them and pe.number_of_signatures == 0
 }
 rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_CVE_2023_42793_Oct23_1 : CVE_2023_42793
 {
@@ -390984,9 +387223,9 @@ rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_CVE_2023_42793_Oct23_1 : CVE_2023_427
 		date = "2023-10-02"
 		modified = "2023-12-05"
 		reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_teamcity_2023_42793.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b6c8e3e3ff91563899ca94904a56460cd702a3e58e0aacf1c3acb506ec3f959"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_teamcity_2023_42793.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b6c8e3e3ff91563899ca94904a56460cd702a3e58e0aacf1c3acb506ec3f959"
 		score = 70
 		quality = 85
 		tags = "CVE-2023-42793"
@@ -390998,7 +387237,7 @@ rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_CVE_2023_42793_Oct23_1 : CVE_2023_427
 		$sb2 = "\\TeamCity\\config\\internal.properties was modified by \"user with id"
 
 	condition:
-		all of ($sa*) or all of ($sb*)
+		all of ( $sa* ) or all of ( $sb* )
 }
 rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_Oct23_1
 {
@@ -391009,9 +387248,9 @@ rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_Oct23_1
 		date = "2023-10-02"
 		modified = "2023-12-05"
 		reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_teamcity_2023_42793.yar#L20-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a2f0abffb9c72e6b32875310e5af7365b6cab4e6c4f6188daa3085b57c38ed0e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_teamcity_2023_42793.yar#L20-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a2f0abffb9c72e6b32875310e5af7365b6cab4e6c4f6188daa3085b57c38ed0e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -391033,10 +387272,10 @@ rule SIGNATURE_BASE_Neuron_Common_Strings : FILE
 		date = "2017-11-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_neuron.yar#L9-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_neuron.yar#L9-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
-		logic_hash = "5f7a704fa0b6892b40868689c876e2f8252bb7319424212454408cbdf66f0b9f"
+		logic_hash = "v1_sha256_5f7a704fa0b6892b40868689c876e2f8252bb7319424212454408cbdf66f0b9f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391055,7 +387294,7 @@ rule SIGNATURE_BASE_Neuron_Common_Strings : FILE
 		$dotnetMagic = "BSJB" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 6 of ($str*)
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $dotnetMagic and 6 of ( $str* )
 }
 rule SIGNATURE_BASE_Nautilus_Forensic_Artificats
 {
@@ -391066,9 +387305,9 @@ rule SIGNATURE_BASE_Nautilus_Forensic_Artificats
 		date = "2017-11-23"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_neuron.yar#L98-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "17ae559a4640636f1285c7078a4366954d5a41c098419db32315e354f0ae619d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_neuron.yar#L98-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_17ae559a4640636f1285c7078a4366954d5a41c098419db32315e354f0ae619d"
 		score = 60
 		quality = 85
 		tags = ""
@@ -391103,9 +387342,9 @@ rule SIGNATURE_BASE_Tidepool_Malware : FILE
 		date = "2016-05-24"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/m2CXWR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_tidepool.yar#L8-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "759920ed7c9320e8412ed0644b28922a545b04f7549f0da6d6c67d6af8a7af3e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_tidepool.yar#L8-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_759920ed7c9320e8412ed0644b28922a545b04f7549f0da6d6c67d6af8a7af3e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391126,7 +387365,7 @@ rule SIGNATURE_BASE_Tidepool_Malware : FILE
 		$s3 = "network.proxy.socks_port\", " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*))) or (4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) ) ) or ( 4 of them )
 }
 import "pe"
 
@@ -391139,9 +387378,9 @@ rule SIGNATURE_BASE_MAL_Neshta_Generic : HIGHVOL FILE
 		date = "2018-01-15"
 		modified = "2021-04-14"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_netsha.yar#L3-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "acac6f81900c60a0aacea6345a7c03a0b77dd86d5ca7ca3d102668c49595bb6b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_netsha.yar#L3-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_acac6f81900c60a0aacea6345a7c03a0b77dd86d5ca7ca3d102668c49595bb6b"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -391162,7 +387401,7 @@ rule SIGNATURE_BASE_MAL_Neshta_Generic : HIGHVOL FILE
 		$sop2 = { 2b c7 50 e8 a4 40 ff ff ff b6 88 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or all of ($s*) or 3 of them or pe.imphash()=="9f4693fc0c511135129493f2161d1e86")
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of ( $x* ) or all of ( $s* ) or 3 of them or pe.imphash ( ) == "9f4693fc0c511135129493f2161d1e86" )
 }
 rule SIGNATURE_BASE_Minidionis_Readerview : FILE
 {
@@ -391173,9 +387412,9 @@ rule SIGNATURE_BASE_Minidionis_Readerview : FILE
 		date = "2015-07-20"
 		modified = "2023-12-05"
 		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_minidionis.yar#L10-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "45ae1be675f2b7b3d89aea2bde66f9f96b55b6fbf81e3783c209c7d6d4355026"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_minidionis.yar#L10-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_45ae1be675f2b7b3d89aea2bde66f9f96b55b6fbf81e3783c209c7d6d4355026"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391195,7 +387434,7 @@ rule SIGNATURE_BASE_Minidionis_Readerview : FILE
 		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of ($s*) and 1 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of ( $s* ) and 1 of ( $op* )
 }
 rule SIGNATURE_BASE_Malicious_SFX1 : FILE
 {
@@ -391206,10 +387445,10 @@ rule SIGNATURE_BASE_Malicious_SFX1 : FILE
 		date = "2015-07-20"
 		modified = "2023-12-05"
 		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_minidionis.yar#L39-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_minidionis.yar#L39-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
-		logic_hash = "fd7b4c504a52e68fe87eeb9f7066c61ddc47257ac9324a60d219c022d3affbbf"
+		logic_hash = "v1_sha256_fd7b4c504a52e68fe87eeb9f7066c61ddc47257ac9324a60d219c022d3affbbf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391220,7 +387459,7 @@ rule SIGNATURE_BASE_Malicious_SFX1 : FILE
 		$s1 = ".exe" ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <1000KB and $s0 in (3..80) and $s1 in (3..80)
+		uint16( 0 ) == 0x4b50 and filesize < 1000KB and $s0 in ( 3 .. 80 ) and $s1 in ( 3 .. 80 )
 }
 rule SIGNATURE_BASE_Malicious_SFX2 : FILE
 {
@@ -391231,10 +387470,10 @@ rule SIGNATURE_BASE_Malicious_SFX2 : FILE
 		date = "2015-07-20"
 		modified = "2023-12-05"
 		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_minidionis.yar#L55-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_minidionis.yar#L55-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"
-		logic_hash = "a2ed7660604ff3c9f2d0dbb454f5d168cd61d1d5e647b5c74fe24f25ebb3dbfd"
+		logic_hash = "v1_sha256_a2ed7660604ff3c9f2d0dbb454f5d168cd61d1d5e647b5c74fe24f25ebb3dbfd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391246,7 +387485,7 @@ rule SIGNATURE_BASE_Malicious_SFX2 : FILE
 		$s3 = "GETPASSWORD1" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_Minidionis_VBS_Dropped : FILE
 {
@@ -391257,10 +387496,10 @@ rule SIGNATURE_BASE_Minidionis_VBS_Dropped : FILE
 		date = "2015-07-21"
 		modified = "2023-12-05"
 		reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_minidionis.yar#L72-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_minidionis.yar#L72-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"
-		logic_hash = "a24fe4cdff6dd7951af10710eb63ab1fd90ab0e43bbce4388d6687abac206da5"
+		logic_hash = "v1_sha256_a24fe4cdff6dd7951af10710eb63ab1fd90ab0e43bbce4388d6687abac206da5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391274,7 +387513,7 @@ rule SIGNATURE_BASE_Minidionis_VBS_Dropped : FILE
 		$s5 = "then FSO.DeleteFile(\".\\" ascii
 
 	condition:
-		filesize <1KB and all of them and $s1 in (0..40)
+		filesize < 1KB and all of them and $s1 in ( 0 .. 40 )
 }
 rule SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1 : FILE
 {
@@ -391285,9 +387524,9 @@ rule SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1 : FILE
 		date = "2020-08-03"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_lnx_malware_indicators.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fbe84c936709653480d469a07e284aea7ef68aedaaa4295073ce59d37eb6d791"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_lnx_malware_indicators.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fbe84c936709653480d469a07e284aea7ef68aedaaa4295073ce59d37eb6d791"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -391304,10 +387543,8 @@ rule SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1 : FILE
 		$fp4 = "Free Software Foundation" ascii fullword
 
 	condition:
-		filesize <400KB and 3 of ($s*) and not 1 of ($fp*)
+		filesize < 400KB and 3 of ( $s* ) and not 1 of ( $fp* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_TA17_318B_Volgmer : FILE
 {
 	meta:
@@ -391317,9 +387554,9 @@ rule SIGNATURE_BASE_TA17_318B_Volgmer : FILE
 		date = "2017-11-15"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_318B.yar#L9-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2b3a7e501214767b7d79b33fb560b5611fa3726036a0c98d6f1904a55f306e40"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_318B.yar#L9-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2b3a7e501214767b7d79b33fb560b5611fa3726036a0c98d6f1904a55f306e40"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391328,7 +387565,7 @@ rule SIGNATURE_BASE_TA17_318B_Volgmer : FILE
 		$s = "Mozillar/"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $s
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $s
 }
 import "pe"
 
@@ -391341,9 +387578,9 @@ rule SIGNATURE_BASE_Volgmer_Malware : FILE
 		date = "2017-11-15"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta17_318B.yar#L34-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "898c2734c56a40aa4d24c1eac2dfb7dd1f98b0bdf7a11ab518eef282becb84b6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta17_318B.yar#L34-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_898c2734c56a40aa4d24c1eac2dfb7dd1f98b0bdf7a11ab518eef282becb84b6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391372,7 +387609,7 @@ rule SIGNATURE_BASE_Volgmer_Malware : FILE
 		$s8 = "DLL_Spider.dll" fullword ascii
 
 	condition:
-		filesize <400KB and (1 of ($x*) or ( uint16(0)==0x5a4d and 2 of them )) or ( uint16(0)==0x5a4d and pe.imphash()=="ea42395e901b33bad504798e0f0fd74b")
+		filesize < 400KB and ( 1 of ( $x* ) or ( uint16( 0 ) == 0x5a4d and 2 of them ) ) or ( uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "ea42395e901b33bad504798e0f0fd74b" )
 }
 rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Sheel_Oct23 : FILE
 {
@@ -391383,9 +387620,9 @@ rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Sheel_Oct23 : FILE
 		date = "2023-10-06"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_camaro_dragon_oct23.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b06f645b766a099adb71c144bdced70c130735e75d5be6451f71077c7d3a5d19"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_camaro_dragon_oct23.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b06f645b766a099adb71c144bdced70c130735e75d5be6451f71077c7d3a5d19"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -391399,7 +387636,7 @@ rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Sheel_Oct23 : FILE
 		$s4 = "update server list success!" ascii fullword
 
 	condition:
-		uint16(0)==0x457f and filesize <30KB and (1 of ($x*) or 3 of them ) or 4 of them
+		uint16( 0 ) == 0x457f and filesize < 30KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
 }
 rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Horseshell_Oct23 : FILE
 {
@@ -391410,9 +387647,9 @@ rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Horseshell_Oct23 : FILE
 		date = "2023-10-06"
 		modified = "2023-12-05"
 		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_camaro_dragon_oct23.yar#L27-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "73adaa286b345cffd35e6ba017b3204d8818dcaeea8a48ca93959566461ac3ca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_camaro_dragon_oct23.yar#L27-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_73adaa286b345cffd35e6ba017b3204d8818dcaeea8a48ca93959566461ac3ca"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -391431,7 +387668,7 @@ rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Horseshell_Oct23 : FILE
 		$op2 = { 27 f4 8c 46 27 f0 03 20 f8 09 00 60 28 21 }
 
 	condition:
-		uint16(0)==0x457f and filesize <600KB and (1 of ($x*) or 3 of them ) or 5 of them
+		uint16( 0 ) == 0x457f and filesize < 600KB and ( 1 of ( $x* ) or 3 of them ) or 5 of them
 }
 rule SIGNATURE_BASE_Hdroot_Sample_Jul17_1 : FILE
 {
@@ -391442,9 +387679,9 @@ rule SIGNATURE_BASE_Hdroot_Sample_Jul17_1 : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "Winnti HDRoot VT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_hdroot.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "41127e6d70af4b095555285f3d5570fc4dbe2a7918664502057cdc4fed8fab33"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_hdroot.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_41127e6d70af4b095555285f3d5570fc4dbe2a7918664502057cdc4fed8fab33"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391457,7 +387694,7 @@ rule SIGNATURE_BASE_Hdroot_Sample_Jul17_1 : FILE
 		$s3 = "l\\Driver\\nsiproxy" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 60KB and 3 of them )
 }
 rule SIGNATURE_BASE_Hdroot_Sample_Jul17_2 : FILE
 {
@@ -391468,9 +387705,9 @@ rule SIGNATURE_BASE_Hdroot_Sample_Jul17_2 : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "Winnti HDRoot VT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_hdroot.yar#L28-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "94288abb5c4da7c4b07eeae55070797af1556dac35ad012aff1bbe8c05e0a215"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_hdroot.yar#L28-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_94288abb5c4da7c4b07eeae55070797af1556dac35ad012aff1bbe8c05e0a215"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391501,7 +387738,7 @@ rule SIGNATURE_BASE_Hdroot_Sample_Jul17_2 : FILE
 		$s10 = "copy %%ComSpec%% \"%s\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (1 of ($x*) or all of ($u*) or 8 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 1 of ( $x* ) or all of ( $u* ) or 8 of them )
 }
 rule SIGNATURE_BASE_Unspecified_Malware_Jul17_1A : FILE
 {
@@ -391512,9 +387749,9 @@ rule SIGNATURE_BASE_Unspecified_Malware_Jul17_1A : FILE
 		date = "2017-07-07"
 		modified = "2023-12-05"
 		reference = "Winnti HDRoot VT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_hdroot.yar#L66-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e23af53be3e700055ea6536669065c131e7f674d45e43a389447c8c1f549dee5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_hdroot.yar#L66-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e23af53be3e700055ea6536669065c131e7f674d45e43a389447c8c1f549dee5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391529,7 +387766,7 @@ rule SIGNATURE_BASE_Unspecified_Malware_Jul17_1A : FILE
 		$s5 = "Install.log" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them )
 }
 rule SIGNATURE_BASE_EXPL_CVE_2021_31166_Accept_Encoding_May21_1 : CVE_2021_31166
 {
@@ -391540,9 +387777,9 @@ rule SIGNATURE_BASE_EXPL_CVE_2021_31166_Accept_Encoding_May21_1 : CVE_2021_31166
 		date = "2021-05-21"
 		modified = "2023-12-05"
 		reference = "https://github.com/0vercl0k/CVE-2021-31166"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2021_31166.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5bb5b4093a7abe9d4297a4c047803b92f7c08f56f15b0f7bd163203ae47e026d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2021_31166.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5bb5b4093a7abe9d4297a4c047803b92f7c08f56f15b0f7bd163203ae47e026d"
 		score = 70
 		quality = 85
 		tags = "CVE-2021-31166"
@@ -391564,9 +387801,9 @@ rule SIGNATURE_BASE_Reflectiveloader : FILE
 		date = "2017-07-17"
 		modified = "2021-03-15"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_loaders.yar#L14-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4d839674f8d8181b11af964a7c84a9eb8f07623500dd2695fca9ca3b15c247e2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_loaders.yar#L14-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4d839674f8d8181b11af964a7c84a9eb8f07623500dd2695fca9ca3b15c247e2"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -391582,7 +387819,7 @@ rule SIGNATURE_BASE_Reflectiveloader : FILE
 		$fp2 = "Panda Security, S.L." wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or pe.exports("ReflectiveLoader") or pe.exports("_ReflectiveLoader@4") or pe.exports("?ReflectiveLoader@@YGKPAX@Z")) and not 1 of ($fp*)
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or pe.exports ( "ReflectiveLoader" ) or pe.exports ( "_ReflectiveLoader@4" ) or pe.exports ( "?ReflectiveLoader@@YGKPAX@Z" ) ) and not 1 of ( $fp* )
 }
 import "pe"
 
@@ -391595,9 +387832,9 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_1 : FILE
 		date = "2017-08-20"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_loaders.yar#L53-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ad012dda538d37242c92c6ed16a0fb1cd9252a2884387f8e7d9c80b041c8fea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_loaders.yar#L53-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ad012dda538d37242c92c6ed16a0fb1cd9252a2884387f8e7d9c80b041c8fea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391611,10 +387848,8 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_1 : FILE
 		$s4 = "?ReflectiveLoader@@YA_KPEAX@Z" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="4bf489ae7d1e6575f5bb81ae4d10862f" or pe.exports("?ReflectiveLoader@@YA_KPEAX@Z") or (1 of ($x*) or 2 of them ))) or (2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "4bf489ae7d1e6575f5bb81ae4d10862f" or pe.exports ( "?ReflectiveLoader@@YA_KPEAX@Z" ) or ( 1 of ( $x* ) or 2 of them ) ) ) or ( 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_DLL_Injector_Lynx : FILE
 {
 	meta:
@@ -391624,9 +387859,9 @@ rule SIGNATURE_BASE_DLL_Injector_Lynx : FILE
 		date = "2017-08-20"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_loaders.yar#L78-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1904b152c42126abd87671747dc2733e2a5e2a01ab55346c131fb430fe5ba58e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_loaders.yar#L78-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1904b152c42126abd87671747dc2733e2a5e2a01ab55346c131fb430fe5ba58e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391643,7 +387878,7 @@ rule SIGNATURE_BASE_DLL_Injector_Lynx : FILE
 		$x7 = "Injecting payload..." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of them ) or ( 3 of them )
 }
 import "pe"
 
@@ -391656,9 +387891,9 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_2 : FILE
 		date = "2017-08-20"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_loaders.yar#L102-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f01b2cf754c3527d0d7fd44c28d3cdb9327762572b43a7d6f7667e5c2a26ab17"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_loaders.yar#L102-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f01b2cf754c3527d0d7fd44c28d3cdb9327762572b43a7d6f7667e5c2a26ab17"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -391674,7 +387909,7 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_2 : FILE
 		$s5 = "Reflective Dll Injection" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="59867122bcc8c959ad307ac2dd08af79" or pe.exports("_ReflectiveLoader@4") or 2 of them )) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "59867122bcc8c959ad307ac2dd08af79" or pe.exports ( "_ReflectiveLoader@4" ) or 2 of them ) ) or ( 3 of them )
 }
 import "pe"
 
@@ -391687,9 +387922,9 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_3 : FILE
 		date = "2017-08-20"
 		modified = "2022-12-21"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_loaders.yar#L130-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4fbba94e6d3dc7b4976c90c0f95683c548f3c444bf5eaf0a7c55d96150978a67"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_loaders.yar#L130-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4fbba94e6d3dc7b4976c90c0f95683c548f3c444bf5eaf0a7c55d96150978a67"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391704,10 +387939,8 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_3 : FILE
 		$s5 = "\\Start Menu\\Programs\\reflective_dll.dll" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="26ba48d3e3b964f75ff148b6679b42ec" or 2 of them )) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "26ba48d3e3b964f75ff148b6679b42ec" or 2 of them ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_4 : FILE
 {
 	meta:
@@ -391717,9 +387950,9 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_4 : FILE
 		date = "2017-08-20"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_loaders.yar#L156-L176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b988ea586589dced18f2165eff431be897b3e96fce2d124f5f41d52b520ccd76"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_loaders.yar#L156-L176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b988ea586589dced18f2165eff431be897b3e96fce2d124f5f41d52b520ccd76"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391734,10 +387967,8 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_4 : FILE
 		$s3 = "<H2>System32 dir:  %s</H2>" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Gazer_Certificate_1 : FILE
 {
 	meta:
@@ -391747,9 +387978,9 @@ rule SIGNATURE_BASE_Gazer_Certificate_1 : FILE
 		date = "2017-08-30"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_gazer.yar#L27-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ef248ac5cdde0034d940f80b32966fe64841dcf99923dfc0a7035354af963f56"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_gazer.yar#L27-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ef248ac5cdde0034d940f80b32966fe64841dcf99923dfc0a7035354af963f56"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391759,10 +387990,8 @@ rule SIGNATURE_BASE_Gazer_Certificate_1 : FILE
 		$certif2 = { 12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them and filesize <2MB
+		uint16( 0 ) == 0x5a4d and 1 of them and filesize < 2MB
 }
-import "pe"
-
 rule SIGNATURE_BASE_Gazer_Logfile_Name_1 : FILE
 {
 	meta:
@@ -391772,9 +388001,9 @@ rule SIGNATURE_BASE_Gazer_Logfile_Name_1 : FILE
 		date = "2017-08-30"
 		modified = "2023-12-05"
 		reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turla_gazer.yar#L41-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c893ec41884f106329350c079b087e41a5b9f1040ab0892c90c03972d49dc070"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turla_gazer.yar#L41-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c893ec41884f106329350c079b087e41a5b9f1040ab0892c90c03972d49dc070"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391785,7 +388014,7 @@ rule SIGNATURE_BASE_Gazer_Logfile_Name_1 : FILE
 		$s3 = "CVRG38D9.tmp.cvr"
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule SIGNATURE_BASE_Typical_Malware_String_Transforms : FILE
 {
@@ -391796,9 +388025,9 @@ rule SIGNATURE_BASE_Typical_Malware_String_Transforms : FILE
 		date = "2016-07-31"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_transformed_strings.yar#L10-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1d3813e0d20b82ceda56d03589bb944f747dfe931396ed514fb6b36f72f98c26"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_transformed_strings.yar#L10-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1d3813e0d20b82ceda56d03589bb944f747dfe931396ed514fb6b36f72f98c26"
 		score = 60
 		quality = 83
 		tags = "FILE"
@@ -391830,7 +388059,7 @@ rule SIGNATURE_BASE_Typical_Malware_String_Transforms : FILE
 		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of them and not 1 of ($fp*))
+		( uint16( 0 ) == 0x5a4d and 1 of them and not 1 of ( $fp* ) )
 }
 rule SIGNATURE_BASE_SUSP_BAT2EXE_Bdargo_Converted_BAT : FILE
 {
@@ -391841,9 +388070,9 @@ rule SIGNATURE_BASE_SUSP_BAT2EXE_Bdargo_Converted_BAT : FILE
 		date = "2018-07-28"
 		modified = "2022-06-23"
 		reference = "https://www.majorgeeks.com/files/details/advanced_bat_to_exe_converter.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_bat2exe.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "978aa25f1abd0cbd36e55da2b1ed4478a3a5b8b814988669c70e219cc2dd1afd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_bat2exe.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_978aa25f1abd0cbd36e55da2b1ed4478a3a5b8b814988669c70e219cc2dd1afd"
 		score = 45
 		quality = 85
 		tags = "FILE"
@@ -391861,10 +388090,8 @@ rule SIGNATURE_BASE_SUSP_BAT2EXE_Bdargo_Converted_BAT : FILE
 		$s8 = "%s%s%s%s%s%s%s%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_1 : FILE
 {
 	meta:
@@ -391874,9 +388101,9 @@ rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_1 : FILE
 		date = "2017-07-08"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/cat-phishing/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_zxshell.yar#L12-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "30195ff91bd62e32784040f9ec2cf72db90ef1c75056abfd9740f35ce1baccd9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_zxshell.yar#L12-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_30195ff91bd62e32784040f9ec2cf72db90ef1c75056abfd9740f35ce1baccd9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391892,10 +388119,8 @@ rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_1 : FILE
 		$x6 = "eNABLEaDMINtsREMOTE" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_2 : FILE
 {
 	meta:
@@ -391905,9 +388130,9 @@ rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_2 : FILE
 		date = "2017-07-08"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/cat-phishing/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_zxshell.yar#L32-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d7c9f2af3842d60cf4b0b64bdb687a32014b449b42b101394e0424c12fc2808e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_zxshell.yar#L32-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d7c9f2af3842d60cf4b0b64bdb687a32014b449b42b101394e0424c12fc2808e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391929,10 +388154,8 @@ rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_2 : FILE
 		$s5 = "Accept-Language: zh-cn" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_3 : FILE
 {
 	meta:
@@ -391942,9 +388165,9 @@ rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_3 : FILE
 		date = "2017-07-08"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/cat-phishing/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_zxshell.yar#L60-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1d7dd59cf6ef24ce47431f9f3fbc980019880082b4e6162bae70b64abaa26db7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_zxshell.yar#L60-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1d7dd59cf6ef24ce47431f9f3fbc980019880082b4e6162bae70b64abaa26db7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391956,10 +388179,8 @@ rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_3 : FILE
 		$s2 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Zxshell_Jul17 : FILE
 {
 	meta:
@@ -391969,9 +388190,9 @@ rule SIGNATURE_BASE_Zxshell_Jul17 : FILE
 		date = "2017-07-08"
 		modified = "2023-12-05"
 		reference = "https://blogs.rsa.com/cat-phishing/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_zxshell.yar#L76-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2c7467417ffc8b0ed3037ace9ce4183c9d4a90d1c087a420dd3c7a9c422621b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_zxshell.yar#L76-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2c7467417ffc8b0ed3037ace9ce4183c9d4a90d1c087a420dd3c7a9c422621b1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -391994,7 +388215,7 @@ rule SIGNATURE_BASE_Zxshell_Jul17 : FILE
 		$x13 = "c:\\windows\\keylog.txt" fullword ascii
 
 	condition:
-		( filesize <10000KB and 1 of them ) or 3 of them
+		( filesize < 10000KB and 1 of them ) or 3 of them
 }
 import "pe"
 
@@ -392007,9 +388228,9 @@ rule SIGNATURE_BASE_Zxshell_20171211_Chrsben : FILE
 		date = "2017-12-11"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/snc85M"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_zxshell.yar#L115-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "361441404582b0eaca25954f7fe1a3a3b9fefd15cac78d61408bc50aeb78bb61"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_zxshell.yar#L115-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_361441404582b0eaca25954f7fe1a3a3b9fefd15cac78d61408bc50aeb78bb61"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392023,10 +388244,8 @@ rule SIGNATURE_BASE_Zxshell_20171211_Chrsben : FILE
 		$s4 = "$Hangzhou Shunwang Technology Co.,Ltd0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="de481441d675e9aca4f20bd8e16a5faa" or pe.exports("PerfectWorld") or pe.exports("ncProxyXll") or 1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( pe.imphash ( ) == "de481441d675e9aca4f20bd8e16a5faa" or pe.exports ( "PerfectWorld" ) or pe.exports ( "ncProxyXll" ) or 1 of ( $x* ) or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT28_Hospitalitymalware_Document : FILE
 {
 	meta:
@@ -392036,9 +388255,9 @@ rule SIGNATURE_BASE_APT28_Hospitalitymalware_Document : FILE
 		date = "2017-10-02"
 		modified = "2023-12-05"
 		reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_hospitality.yar#L3-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "33c69e03e00c90dc0b673cdb042f8f979552086414bda9c9f17f3785214b05af"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_hospitality.yar#L3-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_33c69e03e00c90dc0b673cdb042f8f979552086414bda9c9f17f3785214b05af"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392049,7 +388268,7 @@ rule SIGNATURE_BASE_APT28_Hospitalitymalware_Document : FILE
 		$b = {EC 3B 6D 74 5B C5 95 F3 9E 24 5B FE 4A 64 C7 09 CE 07 C9 58 4E 62 3B}
 
 	condition:
-		all of them and filesize >75KB and filesize <82KB
+		all of them and filesize > 75KB and filesize < 82KB
 }
 import "pe"
 
@@ -392062,9 +388281,9 @@ rule SIGNATURE_BASE_APT28_Hospitalitymalware_Mvtband_File
 		date = "2017-10-02"
 		modified = "2023-12-05"
 		reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_hospitality.yar#L20-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d5da333444e7c9f023d9c6d8d1dec617859efdb26f9f6bc41e22ef27d2e3059a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_hospitality.yar#L20-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d5da333444e7c9f023d9c6d8d1dec617859efdb26f9f6bc41e22ef27d2e3059a"
 		score = 75
 		quality = 85
 		tags = ""
@@ -392075,7 +388294,7 @@ rule SIGNATURE_BASE_APT28_Hospitalitymalware_Mvtband_File
 		$b = {C7 45 94 0A 25 73 30 8D 45 94}
 
 	condition:
-		all of them and pe.sections[2].raw_data_size==0
+		all of them and pe.sections [ 2 ] . raw_data_size == 0
 }
 rule SIGNATURE_BASE_WEBSHELL_Csharp_Hash_String_Oct22 : FILE
 {
@@ -392086,10 +388305,10 @@ rule SIGNATURE_BASE_WEBSHELL_Csharp_Hash_String_Oct22 : FILE
 		date = "2022-10-27"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_webshell_csharp.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_webshell_csharp.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "29c187ad46d3059dc25d5f0958e0e8789fb2a51b9daaf90ea27f001b1a9a603c"
-		logic_hash = "28a07f3dd17fc469388867fa82a0e21abeee9c4e114af245b684535e4e194891"
+		logic_hash = "v1_sha256_28a07f3dd17fc469388867fa82a0e21abeee9c4e114af245b684535e4e194891"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -392105,7 +388324,7 @@ rule SIGNATURE_BASE_WEBSHELL_Csharp_Hash_String_Oct22 : FILE
 		$filter1 = "BitConverter.ToString((" ascii
 
 	condition:
-		filesize <10KB and all of ($gen*) and all of ($hashing*) and not 1 of ($filter*)
+		filesize < 10KB and all of ( $gen* ) and all of ( $hashing* ) and not 1 of ( $filter* )
 }
 rule SIGNATURE_BASE_SUSP_Deviceguard_WDS_Evasion : FILE
 {
@@ -392116,9 +388335,9 @@ rule SIGNATURE_BASE_SUSP_Deviceguard_WDS_Evasion : FILE
 		date = "2015-01-01"
 		modified = "2023-01-06"
 		reference = "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_deviceguard_evasion.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4be9d7c34f7bafeb53db4fc1262a3692493b2253b0de7dc97480b01b62a9f12c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_deviceguard_evasion.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4be9d7c34f7bafeb53db4fc1262a3692493b2253b0de7dc97480b01b62a9f12c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -392129,7 +388348,7 @@ rule SIGNATURE_BASE_SUSP_Deviceguard_WDS_Evasion : FILE
 		$s3 = ".foreach /pS" ascii
 
 	condition:
-		filesize <50KB and all of them
+		filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_MAL_CMD_Script_Obfuscated_Feb19_1 : FILE
 {
@@ -392140,9 +388359,9 @@ rule SIGNATURE_BASE_MAL_CMD_Script_Obfuscated_Feb19_1 : FILE
 		date = "2019-03-01"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/DbgShell/status/1101076457189793793"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cmd_script_obfuscated.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "71c8831686796c921674ec293b5bdf2c42ae9069b258c85c9e0ca6a7f972daf8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cmd_script_obfuscated.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_71c8831686796c921674ec293b5bdf2c42ae9069b258c85c9e0ca6a7f972daf8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392153,7 +388372,7 @@ rule SIGNATURE_BASE_MAL_CMD_Script_Obfuscated_Feb19_1 : FILE
 		$s1 = { 2C 31 25 0D 0A 65 63 68 6F 20 25 25 }
 
 	condition:
-		uint16(0)==0x6540 and filesize <200KB and $h1 at 0 and uint16( filesize -3)==0x0d25 and uint8( filesize -1)==0x0a and $s1 in ( filesize -200.. filesize )
+		uint16( 0 ) == 0x6540 and filesize < 200KB and $h1 at 0 and uint16( filesize - 3 ) == 0x0d25 and uint8( filesize - 1 ) == 0x0a and $s1 in ( filesize - 200 .. filesize )
 }
 rule SIGNATURE_BASE_SUSP_Two_Byte_XOR_PE_And_MZ : FILE
 {
@@ -392164,15 +388383,15 @@ rule SIGNATURE_BASE_SUSP_Two_Byte_XOR_PE_And_MZ : FILE
 		date = "2021-10-11"
 		modified = "2023-12-05"
 		reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_xored_pe.yar#L2-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8a43ff9ec966df72ef35fb9ba9bbbd6f8b0f3761669bb91dc5919645d6327174"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_xored_pe.yar#L2-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8a43ff9ec966df72ef35fb9ba9bbbd6f8b0f3761669bb91dc5919645d6327174"
 		score = 70
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)!=0x5a4d and uint32(( uint16(0x3c)^( uint16(0)^0x5a4d))|(( uint16(0x3e)^( uint16(0)^0x5a4d))<<16))^(( uint16(0)^0x5a4d)|(( uint16(0)^0x5a4d)<<16))==0x00004550
+		uint16( 0 ) != 0x5a4d and uint32( ( uint16( 0x3c ) ^ ( uint16( 0 ) ^ 0x5a4d ) ) | ( ( uint16( 0x3e ) ^ ( uint16( 0 ) ^ 0x5a4d ) ) << 16 ) ) ^ ( ( uint16( 0 ) ^ 0x5a4d ) | ( ( uint16( 0 ) ^ 0x5a4d ) << 16 ) ) == 0x00004550
 }
 rule SIGNATURE_BASE_SUSP_Four_Byte_XOR_PE_And_MZ : FILE
 {
@@ -392183,15 +388402,15 @@ rule SIGNATURE_BASE_SUSP_Four_Byte_XOR_PE_And_MZ : FILE
 		date = "2021-10-11"
 		modified = "2023-12-05"
 		reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_xored_pe.yar#L15-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "28230cd3c1d1da97a98df09243593eb59b57f376f651d5f22c3ea5903f0f73e4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_xored_pe.yar#L15-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_28230cd3c1d1da97a98df09243593eb59b57f376f651d5f22c3ea5903f0f73e4"
 		score = 70
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)!=0x5a4d and uint32(0x28)!=0x00000000 and uint32(0x28)== uint32(0x2c) and uint32( uint32(0x3c)^ uint32(0x28))^ uint32(0x28)==0x00004550
+		uint16( 0 ) != 0x5a4d and uint32( 0x28 ) != 0x00000000 and uint32( 0x28 ) == uint32( 0x2c ) and uint32( uint32( 0x3c ) ^ uint32( 0x28 ) ) ^ uint32( 0x28 ) == 0x00004550
 }
 rule SIGNATURE_BASE_MAL_Ransomware_Germanwiper : FILE
 {
@@ -392202,9 +388421,9 @@ rule SIGNATURE_BASE_MAL_Ransomware_Germanwiper : FILE
 		date = "2019-08-05"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_germanwiper.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dcb4f91006a893149a60e9708efb9de809f75c810bddfd2d90c8f6fffa0879ea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_germanwiper.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dcb4f91006a893149a60e9708efb9de809f75c810bddfd2d90c8f6fffa0879ea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392224,7 +388443,7 @@ rule SIGNATURE_BASE_MAL_Ransomware_Germanwiper : FILE
 		$RansomNote = "Entschluesselungs_Anleitung.html" ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1000KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5A4D and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_1 : FILE
 {
@@ -392235,9 +388454,9 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_1 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_promethium_neodymium.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "143e52eedc5c3be9bbf0f916b232de26e4ed5c7e81e3f77cae70e6af84d31de1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_promethium_neodymium.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_143e52eedc5c3be9bbf0f916b232de26e4ed5c7e81e3f77cae70e6af84d31de1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392252,7 +388471,7 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_1 : FILE
 		$s5 = "%s\\fprot32.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10000KB and 3 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 10000KB and 3 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_2 : FILE
 {
@@ -392263,9 +388482,9 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_2 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_promethium_neodymium.yar#L29-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d97ee2698b6a09da7f8c6850583ec7493cc288368b98b20790dd8305521f894"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_promethium_neodymium.yar#L29-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d97ee2698b6a09da7f8c6850583ec7493cc288368b98b20790dd8305521f894"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392279,7 +388498,7 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_2 : FILE
 		$s4 = "vmnat32.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_3 : FILE
 {
@@ -392290,9 +388509,9 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_3 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_promethium_neodymium.yar#L47-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "47595e07b59744f520cd9025bcec267384329b7687fd25842f5f7a8f4b360674"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_promethium_neodymium.yar#L47-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_47595e07b59744f520cd9025bcec267384329b7687fd25842f5f7a8f4b360674"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392306,7 +388525,7 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_3 : FILE
 		$s4 = "ofx64.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_4 : FILE
 {
@@ -392317,9 +388536,9 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_4 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_promethium_neodymium.yar#L65-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0e8bb00133a94b29c482b9785048025a62e2706f3653c1915be7b702fbfe48d6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_promethium_neodymium.yar#L65-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0e8bb00133a94b29c482b9785048025a62e2706f3653c1915be7b702fbfe48d6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392337,7 +388556,7 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_4 : FILE
 		$s8 = "Windows Index Services" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 4 of them ) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 4 of them ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_5 : FILE
 {
@@ -392348,9 +388567,9 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_5 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_promethium_neodymium.yar#L87-L105"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "69433fae4d51f7fd7b6f5b683f9c751d0f0352b8ed805a8177085e635eb26260"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_promethium_neodymium.yar#L87-L105"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_69433fae4d51f7fd7b6f5b683f9c751d0f0352b8ed805a8177085e635eb26260"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392366,7 +388585,7 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_5 : FILE
 		$s6 = "WININDX-088FA840-B10D-11D3-BC36-006067709674" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and 3 of them )
 }
 rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_6 : FILE
 {
@@ -392377,9 +388596,9 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_6 : FILE
 		date = "2016-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_promethium_neodymium.yar#L107-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6cfccb863c3ea8f3f60520b0df03eee8e3b754699aa339fea21489d34e29f47b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_promethium_neodymium.yar#L107-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6cfccb863c3ea8f3f60520b0df03eee8e3b754699aa339fea21489d34e29f47b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392395,7 +388614,7 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_6 : FILE
 		$s6 = "Windows Index Services" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <7000KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 7000KB and 4 of them )
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Fakefilemaker : FILE
 {
@@ -392404,11 +388623,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Fakefilemaker : FILE
 		author = "Arnim Rupp"
 		id = "2c87114f-5295-583f-b567-623d478ce0eb"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L3-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "27d402835f31b6383c837e90248ae5c6d22f4c267d52625ebfbcc2ee5099ccad"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L3-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_27d402835f31b6383c837e90248ae5c6d22f4c267d52625ebfbcc2ee5099ccad"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392419,7 +388638,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Fakefilemaker : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Wmipersistence : FILE
 {
@@ -392428,11 +388647,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Wmipersistence : FILE
 		author = "Arnim Rupp"
 		id = "7a674596-c697-569d-a16c-3cefe4ff752a"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/mdsecactivebreach/WMIPersistence"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L18-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f8f5e1b6d9b9e8e2f76a7e02385142bbeb755d1b1e41e501f4f74fcaba0a7dad"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L18-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f8f5e1b6d9b9e8e2f76a7e02385142bbeb755d1b1e41e501f4f74fcaba0a7dad"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392443,7 +388662,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Wmipersistence : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_Adcollector_Sep22_1 : FILE
 {
@@ -392452,11 +388671,11 @@ rule SIGNATURE_BASE_HKTL_NET_Adcollector_Sep22_1 : FILE
 		author = "Florian Roth (Nextron Systems)"
 		id = "48b376e4-752b-523e-b34e-65b6944c33fb"
 		date = "2022-09-15"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/dev-2null/ADCollector"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L55-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "66d5363e885378c442e7532f69d4c36618d7a0f5dbe67490631d1ed5078d3fba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L55-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_66d5363e885378c442e7532f69d4c36618d7a0f5dbe67490631d1ed5078d3fba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392472,7 +388691,7 @@ rule SIGNATURE_BASE_HKTL_NET_Adcollector_Sep22_1 : FILE
 		$s5 = "  * runAs:       {0}" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Maliciousclickoncegenerator : FILE
 {
@@ -392481,11 +388700,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Maliciousclickoncegenerator : FILE
 		author = "Arnim Rupp"
 		id = "683af3b4-4c91-5ff3-96bf-d5c1d9c19cc2"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L77-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "91e5878d49ad9af5420d4e29afaa600337fb8051951598a997cd74d72c884206"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L77-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_91e5878d49ad9af5420d4e29afaa600337fb8051951598a997cd74d72c884206"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392496,7 +388715,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Maliciousclickoncegenerator : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Directinjectorpoc : FILE
 {
@@ -392505,11 +388724,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Directinjectorpoc : FILE
 		author = "Arnim Rupp"
 		id = "d9a430d7-b062-554b-aff4-cfd98d91e9fe"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/badBounty/directInjectorPOC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L92-L105"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ffdc5694668af6c82b493403373d2e2e915e45bca8d58ec1ab41c5a8bd28d781"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L92-L105"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ffdc5694668af6c82b493403373d2e2e915e45bca8d58ec1ab41c5a8bd28d781"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392520,7 +388739,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Directinjectorpoc : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Asstrongasfuck : FILE
 {
@@ -392529,11 +388748,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Asstrongasfuck : FILE
 		author = "Arnim Rupp"
 		id = "4c63c8a2-5889-5177-9f66-8e5f755025a3"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/Charterino/AsStrongAsFuck"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L107-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4765f2099bf8fa8ebccd8cdcc561354f4aeba28c2473fd8556f1ef1d5d28dadd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L107-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4765f2099bf8fa8ebccd8cdcc561354f4aeba28c2473fd8556f1ef1d5d28dadd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392544,7 +388763,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Asstrongasfuck : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Magentoscanner : FILE
 {
@@ -392553,11 +388772,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Magentoscanner : FILE
 		author = "Arnim Rupp"
 		id = "db3912bd-574c-57e2-a9b6-4b440d144471"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/soufianetahiri/MagentoScanner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L122-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "245dce3be07c8e84dfcd2cdb2d9f24406a9b11b437e74969f1472a6ee149fd9c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L122-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_245dce3be07c8e84dfcd2cdb2d9f24406a9b11b437e74969f1472a6ee149fd9c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392568,7 +388787,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Magentoscanner : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Revengerat_Stub_Cssharp : FILE
 {
@@ -392577,11 +388796,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Revengerat_Stub_Cssharp : FILE
 		author = "Arnim Rupp"
 		id = "06dce4f9-4d7a-5976-a87a-07c539e5dbe8"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L137-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a3bd1f8e52e6ed468b6a4fea83456ca813b69e2d676dfab687bbea5a746fed3c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L137-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a3bd1f8e52e6ed468b6a4fea83456ca813b69e2d676dfab687bbea5a746fed3c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392592,7 +388811,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Revengerat_Stub_Cssharp : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpyshell : FILE
 {
@@ -392601,11 +388820,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpyshell : FILE
 		author = "Arnim Rupp"
 		id = "3069c5eb-446e-5bfa-9df0-2e03f229d4d1"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/antonioCoco/SharPyShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L152-L165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "89d0010c08349f8982c7f5aa5f7855702556ce10f9f3b5b18b61349c5233e001"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L152-L165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_89d0010c08349f8982c7f5aa5f7855702556ce10f9f3b5b18b61349c5233e001"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392616,7 +388835,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpyshell : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostloader : FILE
 {
@@ -392625,11 +388844,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostloader : FILE
 		author = "Arnim Rupp"
 		id = "d8d88f3f-f250-55ff-88a6-4623e12ef89d"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/TheWover/GhostLoader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L167-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "91527b4b35f2bb1aeee236647c5169c67f2b9cfb867f2b6d486bd8d8b7455d4b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L167-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_91527b4b35f2bb1aeee236647c5169c67f2b9cfb867f2b6d486bd8d8b7455d4b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392640,7 +388859,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostloader : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetinject : FILE
 {
@@ -392651,9 +388870,9 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetinject : FILE
 		date = "2021-01-22"
 		modified = "2022-06-28"
 		reference = "https://github.com/dtrizna/DotNetInject"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L182-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "07ba4ba23372dbc2618dcea89ef643cd68371ace1116bfeb939b0f9adfc425bb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L182-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_07ba4ba23372dbc2618dcea89ef643cd68371ace1116bfeb939b0f9adfc425bb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392666,7 +388885,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetinject : FILE
 		$fp2 = "JetBrains.TeamCity.Injector." wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and filesize <20MB and $name and $compile and not 1 of ($fp*)
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 20MB and $name and $compile and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Atpminidump : FILE
 {
@@ -392675,11 +388894,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Atpminidump : FILE
 		author = "Arnim Rupp"
 		id = "97981569-fe94-5600-8319-946edb4265e7"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/b4rtik/ATPMiniDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L204-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7498ed5d11b9c3646ebd2d1330a239c43e9c5b270b1778871c2821a2fefb5137"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L204-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7498ed5d11b9c3646ebd2d1330a239c43e9c5b270b1778871c2821a2fefb5137"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392690,7 +388909,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Atpminidump : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_SUSP_NET_NAME_Confuserex : FILE
 {
@@ -392701,9 +388920,9 @@ rule SIGNATURE_BASE_SUSP_NET_NAME_Confuserex : FILE
 		date = "2021-01-22"
 		modified = "2021-01-25"
 		reference = "https://github.com/yck1509/ConfuserEx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L219-L234"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "beecb7b66830a033e2048da246d320c1ffc5015b280b34fb61aee87c8a42fff3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L219-L234"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_beecb7b66830a033e2048da246d320c1ffc5015b280b34fb61aee87c8a42fff3"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -392714,7 +388933,7 @@ rule SIGNATURE_BASE_SUSP_NET_NAME_Confuserex : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpbuster : FILE
 {
@@ -392723,11 +388942,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpbuster : FILE
 		author = "Arnim Rupp"
 		id = "d30c8ee5-88b9-53b5-b209-51f6f3b988cf"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/passthehashbrowns/SharpBuster"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L236-L249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cdc19e03f75f34e6349937c0bff313298fc9310f361eec7af022c450d083ad96"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L236-L249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cdc19e03f75f34e6349937c0bff313298fc9310f361eec7af022c450d083ad96"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392738,7 +388957,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpbuster : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Amsibypass : FILE
 {
@@ -392747,23 +388966,24 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Amsibypass : FILE
 		author = "Arnim Rupp"
 		id = "26db14d8-1034-5bd1-a719-4756c832901d"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/0xB455/AmsiBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L251-L265"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L251-L269"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "8fa4ba512b34a898c4564a8eac254b6a786d195b"
-		logic_hash = "e445c541a723ab05072ed38d6143d0a99c7db0ba6889b87fad147dc9a01be9d7"
+		logic_hash = "v1_sha256_f93b1014c7e26462fbbd3cd572cfa21a09c5da915a9a51d3e58a46a2b9b7cfe4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "AmsiBypass" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s_name = "AmsiBypass" ascii wide
+		$s_compile = "AssemblyTitle" ascii wide
+		$fp1 = "Adaptive Threat Protection" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Recon_AD : FILE
 {
@@ -392772,11 +388992,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Recon_AD : FILE
 		author = "Arnim Rupp"
 		id = "097de5cd-0cd4-59cc-a7b7-54cad8e6d230"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/outflanknl/Recon-AD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L267-L280"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7bfafb2d3e85bb584bd02cb92457d22b07626f71d071c44a4aefbb5748045446"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L271-L284"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7bfafb2d3e85bb584bd02cb92457d22b07626f71d071c44a4aefbb5748045446"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392787,7 +389007,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Recon_AD : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpwatchdogs : FILE
 {
@@ -392796,11 +389016,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpwatchdogs : FILE
 		author = "Arnim Rupp"
 		id = "5343be58-879a-5fe7-9036-ee6a22d85f22"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/RITRedteam/SharpWatchdogs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L282-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b9410d7e502a5fd55e534d8fe79710d48cf65a0e9859bdd0fea6c8d32311df0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L286-L299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b9410d7e502a5fd55e534d8fe79710d48cf65a0e9859bdd0fea6c8d32311df0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392811,7 +389031,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpwatchdogs : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpcat : FILE
 {
@@ -392820,11 +389040,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpcat : FILE
 		author = "Arnim Rupp"
 		id = "a46be8d3-bf7b-5d86-b88b-33e6c8c152d8"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/Cn33liz/SharpCat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L297-L310"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b9e5946f8df1649e71abf014aa6579edbbc93a12ddcc56f8d85d97ae087c8711"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L301-L314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b9e5946f8df1649e71abf014aa6579edbbc93a12ddcc56f8d85d97ae087c8711"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392835,7 +389055,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpcat : FILE
 		$compile = "AssemblyTitle" ascii wide fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_K8Tools : FILE
 {
@@ -392844,11 +389064,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_K8Tools : FILE
 		author = "Arnim Rupp"
 		id = "b30fc856-073d-542f-b222-a957322732c2"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/k8gege/K8tools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L312-L325"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "370cab83917bbc76f7f3a1b7793773ddf139879880e55efe59c72a07b34120f1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L316-L329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_370cab83917bbc76f7f3a1b7793773ddf139879880e55efe59c72a07b34120f1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392859,7 +389079,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_K8Tools : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Httpsbeaconshell : FILE
 {
@@ -392868,11 +389088,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Httpsbeaconshell : FILE
 		author = "Arnim Rupp"
 		id = "3bd7234b-a23e-5818-aed1-52d42023943b"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L327-L340"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6a0d7e1f796ae6cefa297978c743916a08b2406c37fa2c1f3f697a17cb032517"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L331-L344"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6a0d7e1f796ae6cefa297978c743916a08b2406c37fa2c1f3f697a17cb032517"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392883,7 +389103,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Httpsbeaconshell : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostpack_Compiledbinaries : FILE
 {
@@ -392892,11 +389112,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostpack_Compiledbinaries : FILE
 		author = "Arnim Rupp"
 		id = "7cc81894-8c01-5a17-a7ed-1cb4cf1e2d53"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L342-L355"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a8e90f07b7d1ec309e51e3606169a05c4bb2b2aa7e31ca26b21f927d648c13cd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L346-L359"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a8e90f07b7d1ec309e51e3606169a05c4bb2b2aa7e31ca26b21f927d648c13cd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392907,7 +389127,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostpack_Compiledbinaries : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Metasploit_Sharp : FILE
 {
@@ -392916,11 +389136,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Metasploit_Sharp : FILE
 		author = "Arnim Rupp"
 		id = "b425f241-4887-5368-b42b-3fbbd3b769c6"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/VolatileMindsLLC/metasploit-sharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L357-L370"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7a1c4e077e197a5cdca8cb12713abb3fa86a3f6ea8e8f2f632c9c8e42d829acc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L361-L374"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7a1c4e077e197a5cdca8cb12713abb3fa86a3f6ea8e8f2f632c9c8e42d829acc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392931,7 +389151,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Metasploit_Sharp : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Trevorc2 : FILE
 {
@@ -392940,11 +389160,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Trevorc2 : FILE
 		author = "Arnim Rupp"
 		id = "d1634a0d-6964-5886-b836-85c3ce6b8a17"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/trustedsec/trevorc2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L372-L385"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c1d56ef865e6619d9d0deff90b154c63cc3036a8521d3952819e45f51fca9fea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L376-L389"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c1d56ef865e6619d9d0deff90b154c63cc3036a8521d3952819e45f51fca9fea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392955,7 +389175,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Trevorc2 : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_DNS2 : FILE
 {
@@ -392964,11 +389184,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_DNS2 : FILE
 		author = "Arnim Rupp"
 		id = "0fa01355-de57-573e-9056-0b7a5d24572d"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/DamonMohammadbagher/NativePayload_DNS2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L387-L400"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "765e6117f69fb58e5e71544badc8135b2ec641a74cc0489a7c79308ca2837bd7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L391-L404"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_765e6117f69fb58e5e71544badc8135b2ec641a74cc0489a7c79308ca2837bd7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -392979,7 +389199,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_DNS2 : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Aggressiveproxy : FILE
 {
@@ -392988,11 +389208,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Aggressiveproxy : FILE
 		author = "Arnim Rupp"
 		id = "e2d3c4e2-404b-59f8-b3d0-a7cef4dfd0ff"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/EncodeGroup/AggressiveProxy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L402-L415"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "702b0cc858cb1687962ac403a730e5f778bf51fc91627c50103e4299f4a3ca5f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L406-L419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_702b0cc858cb1687962ac403a730e5f778bf51fc91627c50103e4299f4a3ca5f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393003,7 +389223,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Aggressiveproxy : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Msbuildapicaller : FILE
 {
@@ -393012,11 +389232,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Msbuildapicaller : FILE
 		author = "Arnim Rupp"
 		id = "143da57f-b01f-5688-b741-1bc4d06cd7d1"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/rvrsh3ll/MSBuildAPICaller"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L417-L430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c1f33c759e6331c562dbf76ce7e34ee82d10070e331d0967143d9d7fad077fc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L421-L434"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c1f33c759e6331c562dbf76ce7e34ee82d10070e331d0967143d9d7fad077fc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393027,7 +389247,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Msbuildapicaller : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Graykeylogger : FILE
 {
@@ -393036,11 +389256,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Graykeylogger : FILE
 		author = "Arnim Rupp"
 		id = "c63875b6-1701-5594-927e-833c25dc5d98"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/DarkSecDevelopers/GrayKeylogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L432-L445"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b8e12c5ddf0d50d0b3681594c8bc3410a24dab00035a5959e20d20045dacbbbd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L436-L449"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b8e12c5ddf0d50d0b3681594c8bc3410a24dab00035a5959e20d20045dacbbbd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393051,7 +389271,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Graykeylogger : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Weevely3 : FILE
 {
@@ -393060,11 +389280,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Weevely3 : FILE
 		author = "Arnim Rupp"
 		id = "6bf766b6-d065-5a84-8258-3be448b9cbb8"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/epinna/weevely3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L447-L460"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c57c6ba5276679a2d32e9b0ebb61059c5bed1ba45f9792ecef3d5c7244f38f24"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L451-L464"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c57c6ba5276679a2d32e9b0ebb61059c5bed1ba45f9792ecef3d5c7244f38f24"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393075,7 +389295,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Weevely3 : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Fudgec2 : FILE
 {
@@ -393084,11 +389304,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Fudgec2 : FILE
 		author = "Arnim Rupp"
 		id = "a8e70bce-76dd-53dc-9a19-1cc6795fdef3"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/Ziconius/FudgeC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L462-L475"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "89f3bf4b81a901e813c3021422c362d7e075dec7fd76240be121f677039f1994"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L466-L479"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_89f3bf4b81a901e813c3021422c362d7e075dec7fd76240be121f677039f1994"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393099,7 +389319,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Fudgec2 : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverse_Tcp : FILE
 {
@@ -393108,11 +389328,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverse_Tcp : FILE
 		author = "Arnim Rupp"
 		id = "a6b935cc-adb6-5ff4-a832-1043e77292f7"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L477-L490"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "055ee105cd46e54b4f49dd92975ecc08a6184fa8508585ee528d19de34914758"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L481-L494"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_055ee105cd46e54b4f49dd92975ecc08a6184fa8508585ee528d19de34914758"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393123,7 +389343,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverse_Tcp : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Sharphose : FILE
 {
@@ -393132,11 +389352,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharphose : FILE
 		author = "Arnim Rupp"
 		id = "89b00eb0-f1a2-5c77-a5b0-2329b08aadb7"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/ustayready/SharpHose"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L492-L505"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e3af2a156c2451f7ed2fe3e888fdf2ae080298f7eff56801ddc0c612f04902ee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L496-L509"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e3af2a156c2451f7ed2fe3e888fdf2ae080298f7eff56801ddc0c612f04902ee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393147,7 +389367,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharphose : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_RAT_Njrat_0_7D_Modded_Source_Code : FILE
 {
@@ -393156,11 +389376,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_RAT_Njrat_0_7D_Modded_Source_Code : FILE
 		author = "Arnim Rupp"
 		id = "2b7d1f75-0164-561e-8199-32c601cbca98"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L507-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f437195348452242adc8b55d6d517a17764c53188fa2de5cd15848fd23827381"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L511-L524"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f437195348452242adc8b55d6d517a17764c53188fa2de5cd15848fd23827381"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393171,7 +389391,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_RAT_Njrat_0_7D_Modded_Source_Code : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Rdpthief : FILE
 {
@@ -393180,11 +389400,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Rdpthief : FILE
 		author = "Arnim Rupp"
 		id = "5ad4feec-50db-5ebb-a609-9196e72a24aa"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/0x09AL/RdpThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L522-L535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8e472c8265d517e512eada819627d56ff449fae4d80054946e9ea96f74004f05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L526-L539"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8e472c8265d517e512eada819627d56ff449fae4d80054946e9ea96f74004f05"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393195,7 +389415,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Rdpthief : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Runascs : FILE
 {
@@ -393204,11 +389424,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Runascs : FILE
 		author = "Arnim Rupp"
 		id = "c5fc5b01-1d30-5af5-be99-e629cb23295b"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/antonioCoco/RunasCs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L537-L550"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9fd22a3e92222134c101693b944a2ad53055f9cfafe99823fd6f412981f5afa3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L541-L554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9fd22a3e92222134c101693b944a2ad53055f9cfafe99823fd6f412981f5afa3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393219,7 +389439,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Runascs : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_IP6DNS : FILE
 {
@@ -393228,11 +389448,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_IP6DNS : FILE
 		author = "Arnim Rupp"
 		id = "3b32b408-e71a-5f2a-ae6f-72a3d6572b71"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/DamonMohammadbagher/NativePayload_IP6DNS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L552-L565"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "509c396b97524335735107644460eebed3146b2bc5f8dedb909c9754b2121f5f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L556-L569"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_509c396b97524335735107644460eebed3146b2bc5f8dedb909c9754b2121f5f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393243,7 +389463,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_IP6DNS : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_ARP : FILE
 {
@@ -393252,11 +389472,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_ARP : FILE
 		author = "Arnim Rupp"
 		id = "9fac11f8-4e40-5cbc-a990-2ae48df20828"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/DamonMohammadbagher/NativePayload_ARP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L567-L580"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e8cecfe09f1cb80eb693eb293dfb8c1bc3885a96dfa045b2391216c5f6f6f983"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L571-L584"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e8cecfe09f1cb80eb693eb293dfb8c1bc3885a96dfa045b2391216c5f6f6f983"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393267,7 +389487,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_ARP : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_C2Bridge : FILE
 {
@@ -393276,11 +389496,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_C2Bridge : FILE
 		author = "Arnim Rupp"
 		id = "357051aa-61ea-5454-a996-b4e3a45ac865"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/cobbr/C2Bridge"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L582-L595"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d5f6d6e9d475bf2d8a49d7550bf3b718539753f3494b58462094bfc0a37b813a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L586-L599"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d5f6d6e9d475bf2d8a49d7550bf3b718539753f3494b58462094bfc0a37b813a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393291,7 +389511,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_C2Bridge : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Infrastructure_Assessment : FILE
 {
@@ -393300,11 +389520,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Infrastructure_Assessment : FILE
 		author = "Arnim Rupp"
 		id = "efacc12b-92b3-5b22-b5bb-cd5a7d7eea0e"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/NyaMeeEain/Infrastructure-Assessment"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L597-L610"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7b2f1481c2880b5b3ee158f2a526ab7fc5e587bbf3847ebe9ddf447742109a78"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L601-L614"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7b2f1481c2880b5b3ee158f2a526ab7fc5e587bbf3847ebe9ddf447742109a78"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393315,7 +389535,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Infrastructure_Assessment : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Shellcodetester : FILE
 {
@@ -393324,11 +389544,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Shellcodetester : FILE
 		author = "Arnim Rupp"
 		id = "964093a4-e6d7-51b7-928a-b1cd40dc11cc"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/tophertimzen/shellcodeTester"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L612-L625"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3101b62428eba5e36572a190bd3a11f59cf9cca10aec3cfe3000028f1b1f0a3f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L616-L629"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3101b62428eba5e36572a190bd3a11f59cf9cca10aec3cfe3000028f1b1f0a3f"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -393339,7 +389559,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Shellcodetester : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Gray_Hat_Csharp_Code : FILE
 {
@@ -393348,11 +389568,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Gray_Hat_Csharp_Code : FILE
 		author = "Arnim Rupp"
 		id = "0a94cadc-cc7b-5817-8788-bb1e53937fad"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/brandonprry/gray_hat_csharp_code"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L627-L640"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4520528cd6b1832c97fa79442f9d448d54bad4e6944984fa6e71f34246259e28"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L631-L644"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4520528cd6b1832c97fa79442f9d448d54bad4e6944984fa6e71f34246259e28"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393363,7 +389583,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Gray_Hat_Csharp_Code : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverseshell : FILE
 {
@@ -393372,11 +389592,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverseshell : FILE
 		author = "Arnim Rupp"
 		id = "eec77c09-02db-5d74-8526-e201d2fe6fc8"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L642-L655"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "79ebde95674d76e58938b06a97cb6c65e6ac0606398fc9c30d90e517bbdd62a8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L646-L659"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_79ebde95674d76e58938b06a97cb6c65e6ac0606398fc9c30d90e517bbdd62a8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393387,7 +389607,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverseshell : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetavbypass : FILE
 {
@@ -393396,11 +389616,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetavbypass : FILE
 		author = "Arnim Rupp"
 		id = "918eba2b-150d-5e69-bed0-0979ae889165"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/mandreko/DotNetAVBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L657-L670"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "574a5f1bc1873321042e932ddfd53853e8e06dff3b25f2ad41e6b8aaf150a8b2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L661-L674"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_574a5f1bc1873321042e932ddfd53853e8e06dff3b25f2ad41e6b8aaf150a8b2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393411,7 +389631,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetavbypass : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Hexyrunner : FILE
 {
@@ -393420,11 +389640,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Hexyrunner : FILE
 		author = "Arnim Rupp"
 		id = "67741b4d-7336-5c88-8f2c-e48c10b187b9"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/bao7uo/HexyRunner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L672-L685"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c55be1fe285358378a98fd1027650dd20dd8cd0aad4dc062df7a0d4538c78c3b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L676-L689"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c55be1fe285358378a98fd1027650dd20dd8cd0aad4dc062df7a0d4538c78c3b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393435,7 +389655,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Hexyrunner : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpoffensiveshell : FILE
 {
@@ -393444,11 +389664,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpoffensiveshell : FILE
 		author = "Arnim Rupp"
 		id = "f223fb95-9f16-5504-a6ce-de9d75b38eaa"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/darkr4y/SharpOffensiveShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L687-L700"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "36bcae7817eed375e48822a49e6875295ea1037217231a7f9ae88a9b8af95530"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L691-L704"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_36bcae7817eed375e48822a49e6875295ea1037217231a7f9ae88a9b8af95530"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393459,7 +389679,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpoffensiveshell : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Reconness : FILE
 {
@@ -393468,11 +389688,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Reconness : FILE
 		author = "Arnim Rupp"
 		id = "a30188e4-d96a-59d0-9f51-d7a7e07b14ba"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/reconness/reconness"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L702-L715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9cb7a3522bada1c724999058ec4ddfde09b22166f8fb3ba184dfe6bec276cfc5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L706-L719"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9cb7a3522bada1c724999058ec4ddfde09b22166f8fb3ba184dfe6bec276cfc5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393483,7 +389703,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Reconness : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Tvasion : FILE
 {
@@ -393492,11 +389712,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Tvasion : FILE
 		author = "Arnim Rupp"
 		id = "324cddc6-36d9-5670-827e-24e80dcc66a9"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/loadenmb/tvasion"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L717-L730"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b6262f751cbb85e702d89e7c5b4efdc8eaf3085101cd7685218ab1e8a2599385"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L721-L734"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b6262f751cbb85e702d89e7c5b4efdc8eaf3085101cd7685218ab1e8a2599385"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393507,7 +389727,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Tvasion : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Ibombshell : FILE
 {
@@ -393516,11 +389736,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Ibombshell : FILE
 		author = "Arnim Rupp"
 		id = "02f3272f-8e75-5df4-9052-a315ae202050"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/Telefonica/ibombshell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L732-L745"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "30de65328e2e2230eca3a30490e20c2c6d8ac9bdc835ee15d44300a00b801921"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L736-L749"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_30de65328e2e2230eca3a30490e20c2c6d8ac9bdc835ee15d44300a00b801921"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393531,7 +389751,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Ibombshell : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Remoteprocessinjection : FILE
 {
@@ -393540,11 +389760,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Remoteprocessinjection : FILE
 		author = "Arnim Rupp"
 		id = "f1698cf2-211a-551a-8bc4-4faefcc6106f"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L747-L760"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "87d803c361462877f5ebba2a70f611c95b8684fe9f9f747ccf9643fc4e97d9df"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L751-L764"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_87d803c361462877f5ebba2a70f611c95b8684fe9f9f747ccf9643fc4e97d9df"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393555,7 +389775,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Remoteprocessinjection : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_CACTUSTORCH : FILE
 {
@@ -393564,11 +389784,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_CACTUSTORCH : FILE
 		author = "Arnim Rupp"
 		id = "7b1e3015-fada-592c-b120-20aa12247d32"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L762-L775"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51a125a44b5d1e73509bcd29865b26f44a5ee53f6907ee9abffa3eef1bbbdea8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L766-L779"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51a125a44b5d1e73509bcd29865b26f44a5ee53f6907ee9abffa3eef1bbbdea8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393579,7 +389799,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_CACTUSTORCH : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Pandasniper : FILE
 {
@@ -393588,11 +389808,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Pandasniper : FILE
 		author = "Arnim Rupp"
 		id = "006400fb-7e6d-563b-ba78-17937983c9ba"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/QAX-A-Team/PandaSniper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L777-L790"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c5a32f22a429777186d88f3fcfa79ad4d971e86ebd6117df74aae19728c6addd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L781-L794"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c5a32f22a429777186d88f3fcfa79ad4d971e86ebd6117df74aae19728c6addd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393603,7 +389823,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Pandasniper : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Xbapappwhitelistbypasspoc : FILE
 {
@@ -393612,11 +389832,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Xbapappwhitelistbypasspoc : FILE
 		author = "Arnim Rupp"
 		id = "b05253ce-cba4-531d-8f39-d8fae71b114d"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L792-L805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c79b70d3a72084dff391ba297518c4fe748d35b794278c4edf2d1faa4bd216e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L796-L809"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c79b70d3a72084dff391ba297518c4fe748d35b794278c4edf2d1faa4bd216e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393627,7 +389847,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Xbapappwhitelistbypasspoc : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_HKTL_NET_NAME_Stagestrike : FILE
 {
@@ -393636,11 +389856,11 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Stagestrike : FILE
 		author = "Arnim Rupp"
 		id = "e3f9de04-87f6-5b07-b5b0-a26167937fcc"
 		date = "2021-01-22"
-		modified = "2023-12-05"
+		modified = "2024-12-10"
 		reference = "https://github.com/RedXRanger/StageStrike"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_github_net_redteam_tools_names.yar#L807-L820"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "99abc2fee732f27ea94c8ce244dc1742ed01a7753adedd7e80226d1e1c8dee4a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_github_net_redteam_tools_names.yar#L811-L824"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_99abc2fee732f27ea94c8ce244dc1742ed01a7753adedd7e80226d1e1c8dee4a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393651,7 +389871,7 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Stagestrike : FILE
 		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
 }
 rule SIGNATURE_BASE_APT17_Sample_FXSST_DLL : FILE
 {
@@ -393662,10 +389882,10 @@ rule SIGNATURE_BASE_APT17_Sample_FXSST_DLL : FILE
 		date = "2015-05-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/ZiJyQv"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt17_malware.yar#L10-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt17_malware.yar#L10-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
-		logic_hash = "51d6da6c3ec46dc9e991a6a36de6d79626f1859296cda65e9027951c13aa4cd5"
+		logic_hash = "v1_sha256_51d6da6c3ec46dc9e991a6a36de6d79626f1859296cda65e9027951c13aa4cd5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393685,7 +389905,7 @@ rule SIGNATURE_BASE_APT17_Sample_FXSST_DLL : FILE
 		$s7 = "GetCommandLine"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and ( all of ($x*) or all of ($y*)) and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( all of ( $x* ) or all of ( $y* ) ) and all of ( $s* )
 }
 rule SIGNATURE_BASE_LOG_EXPL_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357
 {
@@ -393696,9 +389916,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357
 		date = "2023-09-28"
 		modified = "2023-10-01"
 		reference = "https://twitter.com/Gi7w0rm/status/1706764212704591953?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_sharepoint_cve_2023_29357.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "03e3a4715c8683dc8d03ad6720c1c9b40482bd0bfa3020aa1152565ec9ec929f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_sharepoint_cve_2023_29357.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_03e3a4715c8683dc8d03ad6720c1c9b40482bd0bfa3020aa1152565ec9ec929f"
 		score = 70
 		quality = 85
 		tags = "CVE-2023-29357"
@@ -393718,9 +389938,9 @@ rule SIGNATURE_BASE_HKTL_EXPL_POC_PY_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_202
 		date = "2023-10-01"
 		modified = "2023-10-01"
 		reference = "https://github.com/Chocapikk/CVE-2023-29357"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_sharepoint_cve_2023_29357.yar#L22-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fec7762ab23ba5ee9e793000d080b1d64b93157c6ead9e6939ccfb3c168dd360"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_sharepoint_cve_2023_29357.yar#L22-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fec7762ab23ba5ee9e793000d080b1d64b93157c6ead9e6939ccfb3c168dd360"
 		score = 80
 		quality = 85
 		tags = "CVE-2023-29357, FILE"
@@ -393729,7 +389949,7 @@ rule SIGNATURE_BASE_HKTL_EXPL_POC_PY_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_202
 		$x1 = "encoded_payload = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=')"
 
 	condition:
-		filesize <30KB and $x1
+		filesize < 30KB and $x1
 }
 rule SIGNATURE_BASE_HKTL_EXPL_POC_NET_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357 FILE
 {
@@ -393740,9 +389960,9 @@ rule SIGNATURE_BASE_HKTL_EXPL_POC_NET_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_20
 		date = "2023-10-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/LuemmelSec/CVE-2023-29357"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_sharepoint_cve_2023_29357.yar#L37-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf621cc9c5074f531df61623b09db68478e94ae6a9a7acc26aa8d9dde79bd30c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_sharepoint_cve_2023_29357.yar#L37-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf621cc9c5074f531df61623b09db68478e94ae6a9a7acc26aa8d9dde79bd30c"
 		score = 80
 		quality = 85
 		tags = "CVE-2023-29357, FILE"
@@ -393758,7 +389978,7 @@ rule SIGNATURE_BASE_HKTL_EXPL_POC_NET_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_20
 		$s6 = "IsSiteAdmin"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and (1 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( 1 of ( $x* ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_APT_KE3CHANG_TMPFILE : APT KE3CHANG TMPFILE FILE
 {
@@ -393769,9 +389989,9 @@ rule SIGNATURE_BASE_APT_KE3CHANG_TMPFILE : APT KE3CHANG TMPFILE FILE
 		date = "2020-06-18"
 		modified = "2023-12-05"
 		reference = "https://app.any.run/tasks/a96f4f9d-c27d-490b-b5d3-e3be0a1c93e9/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ke3chang.yar#L1-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "75c97fe2eeb82e09f52e98d76bd529824f171da4c802b5febc1036314d8145f0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ke3chang.yar#L1-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_75c97fe2eeb82e09f52e98d76bd529824f171da4c802b5febc1036314d8145f0"
 		score = 75
 		quality = 85
 		tags = "APT, KE3CHANG, TMPFILE, FILE"
@@ -393787,7 +390007,7 @@ rule SIGNATURE_BASE_APT_KE3CHANG_TMPFILE : APT KE3CHANG TMPFILE FILE
 		$s8 = "2500         : 3" fullword ascii
 
 	condition:
-		uint16(0)==0x5350 and filesize <1KB and $psp1 and 1 of ($pps*) and 1 of ($s*)
+		uint16( 0 ) == 0x5350 and filesize < 1KB and $psp1 and 1 of ( $pps* ) and 1 of ( $s* )
 }
 rule SIGNATURE_BASE_APT_MAL_Ke3Chang_Ketrican_Jun20_1 : FILE
 {
@@ -393798,9 +390018,9 @@ rule SIGNATURE_BASE_APT_MAL_Ke3Chang_Ketrican_Jun20_1 : FILE
 		date = "2020-06-18"
 		modified = "2023-12-05"
 		reference = "BfV Cyber-Brief Nr. 01/2020"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ke3chang.yar#L23-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a2806de18432dbab24f08c7c2863fd694c91192cf7df4388dfeb87b237f22257"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ke3chang.yar#L23-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a2806de18432dbab24f08c7c2863fd694c91192cf7df4388dfeb87b237f22257"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -393814,7 +390034,7 @@ rule SIGNATURE_BASE_APT_MAL_Ke3Chang_Ketrican_Jun20_1 : FILE
 		$op2 = { 8d 45 bc 50 53 53 6a 1c 8d 85 10 ff ff ff 50 ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*) or 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of ( $x* ) or 2 of them
 }
 rule SIGNATURE_BASE_Poseidongroup_Malware : FILE
 {
@@ -393825,9 +390045,9 @@ rule SIGNATURE_BASE_Poseidongroup_Malware : FILE
 		date = "2016-02-09"
 		modified = "2023-01-27"
 		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poseidon_group.yar#L8-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "315d540f2d2cb7b55e1a069cef8dd2eeceabcea4a428b33cf520a0f23d3819ea"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poseidon_group.yar#L8-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_315d540f2d2cb7b55e1a069cef8dd2eeceabcea4a428b33cf520a0f23d3819ea"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -393861,7 +390081,7 @@ rule SIGNATURE_BASE_Poseidongroup_Malware : FILE
 		$a7 = "net.exe localgroup Administradores" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <650KB and 6 of ($s*)) or (4 of ($s*) and 1 of ($a*))
+		( uint16( 0 ) == 0x5a4d and filesize < 650KB and 6 of ( $s* ) ) or ( 4 of ( $s* ) and 1 of ( $a* ) )
 }
 rule SIGNATURE_BASE_Poseidongroup_Maldoc_1 : FILE
 {
@@ -393872,10 +390092,10 @@ rule SIGNATURE_BASE_Poseidongroup_Maldoc_1 : FILE
 		date = "2016-02-09"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poseidon_group.yar#L50-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poseidon_group.yar#L50-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
-		logic_hash = "0d8c255f56bb33b6a720c98727127c07a2d77245b18da381706a40339bebd20b"
+		logic_hash = "v1_sha256_0d8c255f56bb33b6a720c98727127c07a2d77245b18da381706a40339bebd20b"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -393885,7 +390105,7 @@ rule SIGNATURE_BASE_Poseidongroup_Maldoc_1 : FILE
 		$s1 = "c:\\cmd32dll.exe" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <500KB and all of them
+		uint16( 0 ) == 0xcfd0 and filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_Poseidongroup_Maldoc_2 : FILE
 {
@@ -393896,9 +390116,9 @@ rule SIGNATURE_BASE_Poseidongroup_Maldoc_2 : FILE
 		date = "2016-02-09"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_poseidon_group.yar#L66-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2c35077a4980336a2c50cade322861dc02f92f7617115420eebe7c882c2f620b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_poseidon_group.yar#L66-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2c35077a4980336a2c50cade322861dc02f92f7617115420eebe7c882c2f620b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -393918,10 +390138,8 @@ rule SIGNATURE_BASE_Poseidongroup_Maldoc_2 : FILE
 		$s5 = "@gmail.com" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and filesize <500KB and 3 of them
+		uint32( 0 ) == 0x74725c7b and filesize < 500KB and 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_LNK_Embedded_Worddoc : FILE
 {
 	meta:
@@ -393931,10 +390149,10 @@ rule SIGNATURE_BASE_SUSP_LNK_Embedded_Worddoc : FILE
 		date = "2023-01-02"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L3-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L3-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
-		logic_hash = "a53fbfe0ccb5a4ab2320cde10d17f29770d888cf21cda4fdccc3d7ae8d123293"
+		logic_hash = "v1_sha256_a53fbfe0ccb5a4ab2320cde10d17f29770d888cf21cda4fdccc3d7ae8d123293"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -393946,10 +390164,8 @@ rule SIGNATURE_BASE_SUSP_LNK_Embedded_Worddoc : FILE
 		$icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide
 
 	condition:
-		uint32be(0x0)==0x4C000000 and filesize >10KB and any of them
+		uint32be( 0x0 ) == 0x4C000000 and filesize > 10KB and any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_LNK_Smallscreensize
 {
 	meta:
@@ -393959,9 +390175,9 @@ rule SIGNATURE_BASE_SUSP_LNK_Smallscreensize
 		date = "2023-01-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L22-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "285985c21e34f8412b49dbfe04abad9f93af195801d0a8870ec3795b8a9a3787"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L22-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_285985c21e34f8412b49dbfe04abad9f93af195801d0a8870ec3795b8a9a3787"
 		score = 65
 		quality = 85
 		tags = ""
@@ -393972,10 +390188,8 @@ rule SIGNATURE_BASE_SUSP_LNK_Smallscreensize
 		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
 
 	condition:
-		uint32be(0x0)==0x4c000000 and all of them
+		uint32be( 0x0 ) == 0x4c000000 and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Janicab_LNK
 {
 	meta:
@@ -393985,14 +390199,14 @@ rule SIGNATURE_BASE_MAL_Janicab_LNK
 		date = "2023-01-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L46-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L46-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "0c7e8427ee61672568983e51bf03e0bcf6f2e9c01d2524d82677b20264b23a3f"
 		hash = "22ede766fba7551ad0b71ef568d0e5022378eadbdff55c4a02b42e63fcb3b17c"
 		hash = "4920e6506ca557d486e6785cb5f7e4b0f4505709ffe8c30070909b040d3c3840"
 		hash = "880607cc2da4c3213ea687dabd7707736a879cc5f2f1d4accf79821e4d24d870"
 		hash = "f4610b65eba977b3d13eba5da0e38788a9e796a3e9775dd2b8e37b3085c2e1af"
-		logic_hash = "f9c000ffb6a95d616459e00f0220ad26cb1df77e35582d14dfce1637ddfb466c"
+		logic_hash = "v1_sha256_f9c000ffb6a95d616459e00f0220ad26cb1df77e35582d14dfce1637ddfb466c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -394007,10 +390221,8 @@ rule SIGNATURE_BASE_MAL_Janicab_LNK
 		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
 
 	condition:
-		uint32be(0x0)==0x4C000000 and $dimensions and 2 of ($j_*)
+		uint32be( 0x0 ) == 0x4C000000 and $dimensions and 2 of ( $j_* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_ELF_Invalid_Version : FILE
 {
 	meta:
@@ -394020,20 +390232,18 @@ rule SIGNATURE_BASE_SUSP_ELF_Invalid_Version : FILE
 		date = "2023-01-01"
 		modified = "2023-12-05"
 		reference = "https://tmpout.sh/1/1.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L70-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L70-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "05379bbf3f46e05d385bbd853d33a13e7e5d7d50"
-		logic_hash = "33f096318647867bcd90d7ba77878f43d34477b2b2cbd7410c191e60573d6cd5"
+		logic_hash = "v1_sha256_33f096318647867bcd90d7ba77878f43d34477b2b2cbd7410c191e60573d6cd5"
 		score = 55
 		quality = 85
 		tags = "FILE"
 		version = "0.1"
 
 	condition:
-		( uint32(0)==0x464c457f and uint8(0x6)>1)
+		( uint32( 0 ) == 0x464c457f and uint8( 0x6 ) > 1 )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_ELF_Torchtriton : FILE
 {
 	meta:
@@ -394043,10 +390253,10 @@ rule SIGNATURE_BASE_MAL_ELF_Torchtriton : FILE
 		date = "2023-01-02"
 		modified = "2023-12-05"
 		reference = "https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L88-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L88-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2385b29489cd9e35f92c072780f903ae2e517ed422eae67246ae50a5cc738a0e"
-		logic_hash = "12de3c3785aaf3623097db58abfe8ee2cbd9a0e712bf752165952de9a5fdb07d"
+		logic_hash = "v1_sha256_12de3c3785aaf3623097db58abfe8ee2cbd9a0e712bf752165952de9a5fdb07d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394064,10 +390274,8 @@ rule SIGNATURE_BASE_MAL_ELF_Torchtriton : FILE
 		$domain = "&z-%`-(*"
 
 	condition:
-		uint32(0)==0x464c457f and (( all of ($aes_*)) or ( all of ($func*) and $error) or ($domain and 2 of them ))
+		uint32( 0 ) == 0x464c457f and ( ( all of ( $aes_* ) ) or ( all of ( $func* ) and $error ) or ( $domain and 2 of them ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_GOLDBACKDOOR_LNK
 {
 	meta:
@@ -394077,10 +390285,10 @@ rule SIGNATURE_BASE_MAL_GOLDBACKDOOR_LNK
 		date = "2023-01-02"
 		modified = "2023-12-05"
 		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L119-L142"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L119-L142"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
-		logic_hash = "043d01758c722964e848e51cf2747c5879f03f0fd43af827e2035abf113daf9d"
+		logic_hash = "v1_sha256_043d01758c722964e848e51cf2747c5879f03f0fd43af827e2035abf113daf9d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -394098,10 +390306,8 @@ rule SIGNATURE_BASE_MAL_GOLDBACKDOOR_LNK
 		$script_CreateThread_hex_enc_str = "437265617465546872656164" wide
 
 	condition:
-		uint32be(0x0)==0x4C000000 and 1 of ($doc*) and 2 of ($script*)
+		uint32be( 0x0 ) == 0x4C000000 and 1 of ( $doc* ) and 2 of ( $script* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_EXE_Lockbit_V2 : FILE
 {
 	meta:
@@ -394111,10 +390317,10 @@ rule SIGNATURE_BASE_MAL_EXE_Lockbit_V2 : FILE
 		date = "2023-01-01"
 		modified = "2023-01-06"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L144-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L144-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8"
-		logic_hash = "9472727d75e34d8bf87c56b74a6dfc04052e621b5fe31732ea9a10c76a05e0c0"
+		logic_hash = "v1_sha256_9472727d75e34d8bf87c56b74a6dfc04052e621b5fe31732ea9a10c76a05e0c0"
 		score = 80
 		quality = 60
 		tags = "FILE"
@@ -394131,7 +390337,7 @@ rule SIGNATURE_BASE_MAL_EXE_Lockbit_V2 : FILE
 		$s_str2 = "Ransomware.hta" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and (1 of ($x*) or 2 of them ) or 3 of them
+		uint16( 0 ) == 0x5A4D and ( 1 of ( $x* ) or 2 of them ) or 3 of them
 }
 import "pe"
 
@@ -394144,10 +390350,10 @@ rule SIGNATURE_BASE_MAL_EXE_Prestigeransomware : FILE
 		date = "2023-01-04"
 		modified = "2023-01-06"
 		reference = "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L171-L195"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L171-L195"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5fc44c7342b84f50f24758e39c8848b2f0991e8817ef5465844f5f2ff6085a57"
-		logic_hash = "2f51ca71d28c8d0df8de22011e16919672d5f9d3f3d94594c5d0cbf7f1585a1e"
+		logic_hash = "v1_sha256_2f51ca71d28c8d0df8de22011e16919672d5f9d3f3d94594c5d0cbf7f1585a1e"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -394163,10 +390369,8 @@ rule SIGNATURE_BASE_MAL_EXE_Prestigeransomware : FILE
 		$ransom_message04 = "- Do not modify or rename encrypted files. You will lose them." wide
 
 	condition:
-		uint16(0)==0x5A4D and (1 of ($x*) or 2 of them or pe.imphash()=="a32bbc5df4195de63ea06feb46cd6b55")
+		uint16( 0 ) == 0x5A4D and ( 1 of ( $x* ) or 2 of them or pe.imphash ( ) == "a32bbc5df4195de63ea06feb46cd6b55" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_EXE_Royalransomware : FILE
 {
 	meta:
@@ -394176,10 +390380,10 @@ rule SIGNATURE_BASE_MAL_EXE_Royalransomware : FILE
 		date = "2023-01-03"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L197-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L197-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a8384c9e3689eb72fa737b570dbb53b2c3d103c62d46747a96e1e1becf14dfea"
-		logic_hash = "6f93bade7709945b478cbdc721d85ad9243d56ace19fba25835cec13a6210dfb"
+		logic_hash = "v1_sha256_6f93bade7709945b478cbdc721d85ad9243d56ace19fba25835cec13a6210dfb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394197,10 +390401,8 @@ rule SIGNATURE_BASE_MAL_EXE_Royalransomware : FILE
 		$x_onion_site = "http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/"
 
 	condition:
-		uint16(0)==0x5A4D and (2 of ($x*) or 5 of them )
+		uint16( 0 ) == 0x5A4D and ( 2 of ( $x* ) or 5 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_PY_Dimorf
 {
 	meta:
@@ -394210,9 +390412,9 @@ rule SIGNATURE_BASE_MAL_PY_Dimorf
 		date = "2023-01-03"
 		modified = "2023-12-05"
 		reference = "https://github.com/Ort0x36/Dimorf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_100days_of_yara_2023.yar#L224-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7499b21f77d07364983b94134a60f7c99e71a5392386437d459a196bf71852fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_100days_of_yara_2023.yar#L224-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7499b21f77d07364983b94134a60f7c99e71a5392386437d459a196bf71852fb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -394228,8 +390430,6 @@ rule SIGNATURE_BASE_MAL_PY_Dimorf
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT17_Malware_Oct17_1 : FILE
 {
 	meta:
@@ -394239,9 +390439,9 @@ rule SIGNATURE_BASE_APT17_Malware_Oct17_1 : FILE
 		date = "2017-10-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/puVc9q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt17_mal_sep17.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0c4391b47df0c40dbd605515992e5eaa758d0e509e9ad24b517d104b8e7d504c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt17_mal_sep17.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0c4391b47df0c40dbd605515992e5eaa758d0e509e9ad24b517d104b8e7d504c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394255,7 +390455,7 @@ rule SIGNATURE_BASE_APT17_Malware_Oct17_1 : FILE
 		$s4 = "\\TSMSISrv.dll" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
 }
 import "pe"
 
@@ -394268,9 +390468,9 @@ rule SIGNATURE_BASE_APT17_Malware_Oct17_2 : FILE
 		date = "2017-10-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/puVc9q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt17_mal_sep17.yar#L31-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "378a21edeaf36267986bd5158fe736b0970b0b9f0ad824f09dc6434a9ba1d7e2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt17_mal_sep17.yar#L31-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_378a21edeaf36267986bd5158fe736b0970b0b9f0ad824f09dc6434a9ba1d7e2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394291,7 +390491,7 @@ rule SIGNATURE_BASE_APT17_Malware_Oct17_2 : FILE
 		$s8 = "IISCMD Error:%d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.exports("_foo@0") or 1 of ($x*) or 6 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.exports ( "_foo@0" ) or 1 of ( $x* ) or 6 of them )
 }
 import "pe"
 
@@ -394304,9 +390504,9 @@ rule SIGNATURE_BASE_APT17_Unsigned_Symantec_Binary_EFA : FILE
 		date = "2017-10-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/puVc9q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt17_mal_sep17.yar#L61-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7306c8ae2be4dbf56957e11d78ba85bcfa1c8570ba41f749ea5b0e2a05e9df7b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt17_mal_sep17.yar#L61-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7306c8ae2be4dbf56957e11d78ba85bcfa1c8570ba41f749ea5b0e2a05e9df7b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394318,7 +390518,7 @@ rule SIGNATURE_BASE_APT17_Unsigned_Symantec_Binary_EFA : FILE
 		$s2 = "\\\\.\\SYMEFA" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them and pe.number_of_signatures==0)
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them and pe.number_of_signatures == 0 )
 }
 import "pe"
 
@@ -394331,9 +390531,9 @@ rule SIGNATURE_BASE_APT17_Malware_Oct17_Gen : FILE
 		date = "2017-10-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/puVc9q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt17_mal_sep17.yar#L77-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3e0e4a989a907f5f1aaac4ba43611dd0d2e4b4fd340234f04b3fce25843f9dc6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt17_mal_sep17.yar#L77-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3e0e4a989a907f5f1aaac4ba43611dd0d2e4b4fd340234f04b3fce25843f9dc6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394355,7 +390555,7 @@ rule SIGNATURE_BASE_APT17_Malware_Oct17_Gen : FILE
 		$s8 = "[IISEND=0x%08X][Recv:] 0x%08X %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="414bbd566b700ea021cfae3ad8f4d9b9" or 1 of ($x*) or 6 of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "414bbd566b700ea021cfae3ad8f4d9b9" or 1 of ( $x* ) or 6 of them ) )
 }
 rule SIGNATURE_BASE_HKTL_Keyword_Injectdll : FILE
 {
@@ -394366,9 +390566,9 @@ rule SIGNATURE_BASE_HKTL_Keyword_Injectdll : FILE
 		date = "2019-04-04"
 		modified = "2023-12-05"
 		reference = "https://github.com/zerosum0x0/koadic"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_hacktool.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "51c54026672e9ad36d2d68ae8dba61437f8808fbf2ad3c3c7bb086d8abb63987"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_hacktool.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_51c54026672e9ad36d2d68ae8dba61437f8808fbf2ad3c3c7bb086d8abb63987"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -394379,7 +390579,7 @@ rule SIGNATURE_BASE_HKTL_Keyword_Injectdll : FILE
 		$s4 = "Kernel32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_HKTL_Python_Sectools
 {
@@ -394390,12 +390590,12 @@ rule SIGNATURE_BASE_HKTL_Python_Sectools
 		date = "2023-01-27"
 		modified = "2023-12-05"
 		reference = "https://github.com/p0dalirius/sectools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_hacktool.yar#L18-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_hacktool.yar#L18-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "814ba1aa62bbb7aba886edae0f4ac5370818de15ca22a52a6ab667b4e93abf84"
 		hash = "b3328ac397d311e6eb79f0a5b9da155c4d1987e0d67487ea681ea59d93641d9e"
 		hash = "8cd205d5380278cff6673520439057e78fb8bf3d2b1c3c9be8463e949e5be4a1"
-		logic_hash = "17f6897dc623f822c7ae6a7ae51714e78316d7b7fdf59b9f2f625ecaae939522"
+		logic_hash = "v1_sha256_17f6897dc623f822c7ae6a7ae51714e78316d7b7fdf59b9f2f625ecaae939522"
 		score = 50
 		quality = 85
 		tags = ""
@@ -394406,10 +390606,8 @@ rule SIGNATURE_BASE_HKTL_Python_Sectools
 		$import2 = "import sectools"
 
 	condition:
-		any of ($import*)
+		any of ( $import* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Connectwise_Screenconnect_Authentication_Bypass_Feb_2024_Exploitation_IIS_Logs
 {
 	meta:
@@ -394419,9 +390617,9 @@ rule SIGNATURE_BASE_Connectwise_Screenconnect_Authentication_Bypass_Feb_2024_Exp
 		date = "2024-02-20"
 		modified = "2024-02-21"
 		reference = "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L3-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f6c7a3aa2ed98e754f9523c55eb035c7bc5f8aea96a6f86c729e9658d78710fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L3-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f6c7a3aa2ed98e754f9523c55eb035c7bc5f8aea96a6f86c729e9658d78710fb"
 		score = 75
 		quality = 85
 		tags = ""
@@ -394435,8 +390633,6 @@ rule SIGNATURE_BASE_Connectwise_Screenconnect_Authentication_Bypass_Feb_2024_Exp
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Unused_Feb24 : FILE
 {
 	meta:
@@ -394446,9 +390642,9 @@ rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Unused_Feb24 : FILE
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L20-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2433ad11ca1d9f970eb3c536a13f07e808c2a0b8b0dd625dffbe4947268ab8f5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L20-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2433ad11ca1d9f970eb3c536a13f07e808c2a0b8b0dd625dffbe4947268ab8f5"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -394460,10 +390656,8 @@ rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Unused_Feb24 : FILE
 		$s2 = "<LastLoginDate>0001"
 
 	condition:
-		filesize <200KB and all of ($a*) and all of ($s*)
+		filesize < 200KB and all of ( $a* ) and all of ( $s* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Used_Feb24 : FILE
 {
 	meta:
@@ -394473,9 +390667,9 @@ rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Used_Feb24 : FILE
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L40-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "50967a07a9789f20ccbc882c3b9e3142f0c28068c0a58b9d8927d725d02bf289"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L40-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_50967a07a9789f20ccbc882c3b9e3142f0c28068c0a58b9d8927d725d02bf289"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394487,10 +390681,8 @@ rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Used_Feb24 : FILE
 		$f1 = "<LastLoginDate>0001"
 
 	condition:
-		filesize <200KB and all of ($a*) and $s1 and not 1 of ($f*)
+		filesize < 200KB and all of ( $a* ) and $s1 and not 1 of ( $f* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24 : SCRIPT
 {
 	meta:
@@ -394500,9 +390692,9 @@ rule SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24 : SCRIPT
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L62-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f0d5f878847da1afb0d7b83e84bd337cfa67c36da2cbb33af712ed4ffad490a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L62-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f0d5f878847da1afb0d7b83e84bd337cfa67c36da2cbb33af712ed4ffad490a"
 		score = 75
 		quality = 83
 		tags = "SCRIPT"
@@ -394538,10 +390730,8 @@ rule SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24 : SCRIPT
 		$xp5 = "nssm set xmrig AppDirectory "
 
 	condition:
-		1 of ($x*)
+		1 of ( $x* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_Command_Line_Combos_Feb24_2 : SCRIPT FILE
 {
 	meta:
@@ -394551,9 +390741,9 @@ rule SIGNATURE_BASE_SUSP_Command_Line_Combos_Feb24_2 : SCRIPT FILE
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L105-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0cd7b4771aa8fd622e873c5cdc6689d24394e5faf026b36d5f228ac09f4e0441"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L105-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0cd7b4771aa8fd622e873c5cdc6689d24394e5faf026b36d5f228ac09f4e0441"
 		score = 75
 		quality = 85
 		tags = "SCRIPT, FILE"
@@ -394563,10 +390753,8 @@ rule SIGNATURE_BASE_SUSP_Command_Line_Combos_Feb24_2 : SCRIPT FILE
 		$sa2 = "iwr -UseBasicParsing "
 
 	condition:
-		filesize <2MB and all of them
+		filesize < 2MB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_PS1_Combo_Transfersh_Feb24 : SCRIPT
 {
 	meta:
@@ -394576,9 +390764,9 @@ rule SIGNATURE_BASE_SUSP_PS1_Combo_Transfersh_Feb24 : SCRIPT
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L120-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "64d4343ecdcbc4a28571557bec2f31c1ff73c2ecf63d0feaa0a71001bb9bf499"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L120-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_64d4343ecdcbc4a28571557bec2f31c1ff73c2ecf63d0feaa0a71001bb9bf499"
 		score = 70
 		quality = 85
 		tags = "SCRIPT"
@@ -394592,8 +390780,6 @@ rule SIGNATURE_BASE_SUSP_PS1_Combo_Transfersh_Feb24 : SCRIPT
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lockbit_Ransomnote_Feb24
 {
 	meta:
@@ -394603,9 +390789,9 @@ rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lockbit_Ransomnote_Feb24
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L137-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1fe07c33de1971b1f9430851dec4b8cd9f3ac7f087f0de18a2da4a390891b674"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L137-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1fe07c33de1971b1f9430851dec4b8cd9f3ac7f087f0de18a2da4a390891b674"
 		score = 75
 		quality = 85
 		tags = ""
@@ -394616,8 +390802,6 @@ rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lockbit_Ransomnote_Feb24
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lazy_Ransomnote_Feb24
 {
 	meta:
@@ -394627,9 +390811,9 @@ rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lazy_Ransomnote_Feb24
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L151-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c9416d05f0bd9aab9d6108380c1b5364f4c4e112b6e0726202f083eaacfdcf56"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L151-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c9416d05f0bd9aab9d6108380c1b5364f4c4e112b6e0726202f083eaacfdcf56"
 		score = 75
 		quality = 85
 		tags = ""
@@ -394640,8 +390824,6 @@ rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lazy_Ransomnote_Feb24
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_MAL_Signingcert_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 {
 	meta:
@@ -394651,9 +390833,9 @@ rule SIGNATURE_BASE_SUSP_MAL_Signingcert_Feb24_1 : CVE_2024_1708 CVE_2024_1709 F
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L166-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "824efe1fa441322d891805df9a1637ebb44d18889572604acc125bf79a2d1083"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L166-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_824efe1fa441322d891805df9a1637ebb44d18889572604acc125bf79a2d1083"
 		score = 75
 		quality = 85
 		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
@@ -394666,7 +390848,7 @@ rule SIGNATURE_BASE_SUSP_MAL_Signingcert_Feb24_1 : CVE_2024_1708 CVE_2024_1709 F
 		$s3 = { 5D AC 0B 6C 02 5A 4B 21 89 4B A3 C2 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 70000KB and all of them
 }
 import "pe"
 
@@ -394679,9 +390861,9 @@ rule SIGNATURE_BASE_MAL_CS_Loader_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L186-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ae0e25c2dda1b727978977c674e834cd659661c597d88395a6f46ad5a179e9f0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L186-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ae0e25c2dda1b727978977c674e834cd659661c597d88395a6f46ad5a179e9f0"
 		score = 75
 		quality = 85
 		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
@@ -394691,7 +390873,7 @@ rule SIGNATURE_BASE_MAL_CS_Loader_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 		$s1 = "Dll_x86.dll" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.exports("UpdateSystem") and (pe.imphash()=="0dc05c4c21a86d29f1c3bf9cc5b712e0" or $s1))
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.exports ( "UpdateSystem" ) and ( pe.imphash ( ) == "0dc05c4c21a86d29f1c3bf9cc5b712e0" or $s1 ) )
 }
 import "pe"
 
@@ -394704,9 +390886,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Indicators_Feb24 : CVE_2024_1708 CVE_2024
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L208-L228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4cd6b1a1bc57bf25c71f6bc228f45e4a996f9d9d391aeb3dda9c7d7857610bc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L208-L228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4cd6b1a1bc57bf25c71f6bc228f45e4a996f9d9d391aeb3dda9c7d7857610bc"
 		score = 75
 		quality = 85
 		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
@@ -394718,10 +390900,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Indicators_Feb24 : CVE_2024_1708 CVE_2024
 		$op3 = { 8b c6 ab 53 ff 15 e4 57 42 00 ff 45 fc eb 92 ff 75 f8 ff 15 f4 57 42 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="914685b69f2ac2ff61b6b0f1883a054d" or 2 of them ) or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "914685b69f2ac2ff61b6b0f1883a054d" or 2 of them ) or all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_MSI_Mpyutils_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 {
 	meta:
@@ -394731,9 +390911,9 @@ rule SIGNATURE_BASE_MAL_MSI_Mpyutils_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L230-L247"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ba20db486e5d3c29c9702e10628fb3c0e55e52bbec74e3a86ed6511a6475b82f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L230-L247"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ba20db486e5d3c29c9702e10628fb3c0e55e52bbec74e3a86ed6511a6475b82f"
 		score = 70
 		quality = 85
 		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
@@ -394745,10 +390925,8 @@ rule SIGNATURE_BASE_MAL_MSI_Mpyutils_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 		$s6 = "ICACLS.EXE" wide fullword
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <20000KB and all of them
+		uint16( 0 ) == 0xcfd0 and filesize < 20000KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Beacon_Unknown_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 {
 	meta:
@@ -394758,9 +390936,9 @@ rule SIGNATURE_BASE_MAL_Beacon_Unknown_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FIL
 		date = "2024-02-23"
 		modified = "2024-04-24"
 		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L249-L268"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fd6ebc6676d677d6bc19398026eee7b7d2f9727ba7a3c79d1e970a6dc19548aa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L249-L268"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fd6ebc6676d677d6bc19398026eee7b7d2f9727ba7a3c79d1e970a6dc19548aa"
 		score = 75
 		quality = 85
 		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
@@ -394774,7 +390952,7 @@ rule SIGNATURE_BASE_MAL_Beacon_Unknown_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FIL
 		$s3 = "$928c7481-dd27-8e23-f829-4819aefc728c" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 3 of ( $s* )
 }
 rule SIGNATURE_BASE_SUSP_ELF_LNX_UPX_Compressed_File : FILE
 {
@@ -394785,9 +390963,9 @@ rule SIGNATURE_BASE_SUSP_ELF_LNX_UPX_Compressed_File : FILE
 		date = "2018-12-12"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_elf_file_anomalies.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0d310de1ab68bd6da9ae057c7edea0d6b24d408f85ec40c2306f1ac8a2bc2f55"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_elf_file_anomalies.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0d310de1ab68bd6da9ae057c7edea0d6b24d408f85ec40c2306f1ac8a2bc2f55"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -394800,7 +390978,7 @@ rule SIGNATURE_BASE_SUSP_ELF_LNX_UPX_Compressed_File : FILE
 		$fp1 = "check your UCL installation !"
 
 	condition:
-		uint16(0)==0x457f and filesize <2000KB and filesize >30KB and 2 of ($s*) and not 1 of ($fp*)
+		uint16( 0 ) == 0x457f and filesize < 2000KB and filesize > 30KB and 2 of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Skeleton_Key_Patcher
 {
@@ -394811,9 +390989,9 @@ rule SIGNATURE_BASE_Skeleton_Key_Patcher
 		date = "2015-01-13"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/aAk3lN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_skeletonkey.yar#L3-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "451b77152e38a120bd8d8a832f0f7c003974113ead18aabfe043a332fb1f484c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_skeletonkey.yar#L3-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_451b77152e38a120bd8d8a832f0f7c003974113ead18aabfe043a332fb1f484c"
 		score = 70
 		quality = 85
 		tags = ""
@@ -394839,9 +391017,9 @@ rule SIGNATURE_BASE_Skeleton_Key_Injected_Code
 		date = "2015-01-13"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/aAk3lN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_skeletonkey.yar#L26-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e87cb9a49d0df6f75ca1ae51f8255ea476b699e82d525d7eca06bfda3462d84b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_skeletonkey.yar#L26-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e87cb9a49d0df6f75ca1ae51f8255ea476b699e82d525d7eca06bfda3462d84b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -394864,10 +391042,10 @@ rule SIGNATURE_BASE_REGEORG_Tuneller_Generic : FILE
 		date = "2021-12-20"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/webshell_regeorg.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/webshell_regeorg.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ba22992ce835dadcd06bff4ab7b162f9"
-		logic_hash = "1657928875c3cd2d5bf774929b0497d78f0211b321f8a4138cc9b8c80b9f99d6"
+		logic_hash = "v1_sha256_1657928875c3cd2d5bf774929b0497d78f0211b321f8a4138cc9b8c80b9f99d6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394884,7 +391062,7 @@ rule SIGNATURE_BASE_REGEORG_Tuneller_Generic : FILE
 		$s8 = "SocketException soex"
 
 	condition:
-		filesize <1MB and 7 of them
+		filesize < 1MB and 7 of them
 }
 rule SIGNATURE_BASE_Mirai_Botnet_Malware : FILE
 {
@@ -394895,9 +391073,9 @@ rule SIGNATURE_BASE_Mirai_Botnet_Malware : FILE
 		date = "2016-10-04"
 		modified = "2023-01-27"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mirai.yar#L10-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "384f8377ca05296da1177a8939f526069fbad0bb73769bd282d81ea4d876003c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mirai.yar#L10-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_384f8377ca05296da1177a8939f526069fbad0bb73769bd282d81ea4d876003c"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -394929,7 +391107,7 @@ rule SIGNATURE_BASE_Mirai_Botnet_Malware : FILE
 		$s6 = "NKQVGLKLE" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and ((1 of ($x*) and 1 of ($s*)) or 4 of ($s*))
+		uint16( 0 ) == 0x457f and filesize < 200KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or 4 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Mirai_1_May17 : FILE
 {
@@ -394940,9 +391118,9 @@ rule SIGNATURE_BASE_Mirai_1_May17 : FILE
 		date = "2017-05-12"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mirai.yar#L62-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6816ab3b455bbde6c4bb43bff162615d7fc24b9d5828faa190600387c38978e1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mirai.yar#L62-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6816ab3b455bbde6c4bb43bff162615d7fc24b9d5828faa190600387c38978e1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394956,7 +391134,7 @@ rule SIGNATURE_BASE_Mirai_1_May17 : FILE
 		$s1 = "GET /bins/mirai.x86 HTTP/1.0" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <5000KB and all of them )
+		( uint16( 0 ) == 0x457f and filesize < 5000KB and all of them )
 }
 rule SIGNATURE_BASE_Miari_2_May17 : FILE
 {
@@ -394967,9 +391145,9 @@ rule SIGNATURE_BASE_Miari_2_May17 : FILE
 		date = "2017-05-12"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mirai.yar#L80-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "138a7d0c5508f0168f09329e97f00d0aacef17297558338cd88a9dc3ddddfee3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mirai.yar#L80-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_138a7d0c5508f0168f09329e97f00d0aacef17297558338cd88a9dc3ddddfee3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -394986,7 +391164,7 @@ rule SIGNATURE_BASE_Miari_2_May17 : FILE
 		$s5 = "jbeupq84v7.2y.net" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <5000KB and 2 of them )
+		( uint16( 0 ) == 0x457f and filesize < 5000KB and 2 of them )
 }
 rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_1 : FILE
 {
@@ -394997,9 +391175,9 @@ rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_1 : FILE
 		date = "2018-10-27"
 		modified = "2023-01-27"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mirai.yar#L101-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d16ed12522b310fccab027355281a206f5087d555f0d1fef4e7746d01d085613"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mirai.yar#L101-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d16ed12522b310fccab027355281a206f5087d555f0d1fef4e7746d01d085613"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -395013,7 +391191,7 @@ rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_1 : FILE
 		$s3 = "POST /cdn-cgi/" ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and ((1 of ($x*) and 1 of ($s*)) or all of ($x*))
+		uint16( 0 ) == 0x457f and filesize < 200KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or all of ( $x* ) )
 }
 rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_2 : FILE
 {
@@ -395024,9 +391202,9 @@ rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_2 : FILE
 		date = "2018-10-27"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mirai.yar#L124-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "47d20bdf64c18c925dc1391b022278f913b7fbce13988a7b5de2e9d135c5a265"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mirai.yar#L124-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_47d20bdf64c18c925dc1391b022278f913b7fbce13988a7b5de2e9d135c5a265"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -395038,7 +391216,7 @@ rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_2 : FILE
                41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A }
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_MAL_Mirai_Nov19_1 : FILE
 {
@@ -395049,9 +391227,9 @@ rule SIGNATURE_BASE_MAL_Mirai_Nov19_1 : FILE
 		date = "2019-11-13"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/bad_packets/status/1194049104533282816"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mirai.yar#L140-L157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e1202a9cd445c590c359a9c93e635292f8cf7f09291f4d8504ad9ce6679f6a47"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mirai.yar#L140-L157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e1202a9cd445c590c359a9c93e635292f8cf7f09291f4d8504ad9ce6679f6a47"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -395066,7 +391244,7 @@ rule SIGNATURE_BASE_MAL_Mirai_Nov19_1 : FILE
 		$sc1 = { 47 72 6F 75 70 73 3A 09 30 }
 
 	condition:
-		uint16(0)==0x457f and filesize <=100KB and 4 of them
+		uint16( 0 ) == 0x457f and filesize <= 100KB and 4 of them
 }
 rule SIGNATURE_BASE_MAL_ARM_LNX_Mirai_Mar13_2022 : FILE
 {
@@ -395077,9 +391255,9 @@ rule SIGNATURE_BASE_MAL_ARM_LNX_Mirai_Mar13_2022 : FILE
 		date = "2022-03-16"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_mirai.yar#L159-L181"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a44a6174a198a658c8a5e2da50192da20bae7f8ed4e4f212c9eebb29fa4b0dd0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_mirai.yar#L159-L181"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a44a6174a198a658c8a5e2da50192da20bae7f8ed4e4f212c9eebb29fa4b0dd0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -395100,7 +391278,7 @@ rule SIGNATURE_BASE_MAL_ARM_LNX_Mirai_Mar13_2022 : FILE
 		$attck8 = "attack_icmpecho"
 
 	condition:
-		uint16(0)==0x457f and (3 of ($str*) or 4 of ($attck*))
+		uint16( 0 ) == 0x457f and ( 3 of ( $str* ) or 4 of ( $attck* ) )
 }
 rule SIGNATURE_BASE_Gen_Suspicious_Inpage_Dropper : FILE
 {
@@ -395111,9 +391289,9 @@ rule SIGNATURE_BASE_Gen_Suspicious_Inpage_Dropper : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/Ahmedfshosha/status/1138138981521154049"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_suspicious_InPage_dropper.yar#L1-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8ab5d0bffa72b32f4c388f42a38a799c178fddf9f06b1262842e146c43448bd4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_suspicious_InPage_dropper.yar#L1-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8ab5d0bffa72b32f4c388f42a38a799c178fddf9f06b1262842e146c43448bd4"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -395128,7 +391306,7 @@ rule SIGNATURE_BASE_Gen_Suspicious_Inpage_Dropper : FILE
 		$c2 = {90 90 90 90 90 90 90 e8 fb }
 
 	condition:
-		filesize <3MB and uint32be(0)==0xD0CF11E0 and $s1 and 1 of ($c*)
+		filesize < 3MB and uint32be( 0 ) == 0xD0CF11E0 and $s1 and 1 of ( $c* )
 }
 import "pe"
 
@@ -395141,9 +391319,9 @@ rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_1 : FILE
 		date = "2021-07-02"
 		modified = "2023-12-05"
 		reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_revil_general.yar#L3-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a7f9fa8f8e8a3a25728aa6a334924e0b4075f3422df6b92a2f544bb0ebb6bfad"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_revil_general.yar#L3-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a7f9fa8f8e8a3a25728aa6a334924e0b4075f3422df6b92a2f544bb0ebb6bfad"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -395162,10 +391340,8 @@ rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_1 : FILE
 		$op5 = { 83 7d 0c 00 75 05 8b 45 fc eb 76 6a 00 68 80 00 00 00 6a 01 6a 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="c36dcd2277c4a707a1a645d0f727542a" or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "c36dcd2277c4a707a1a645d0f727542a" or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2 : FILE
 {
 	meta:
@@ -395175,9 +391351,9 @@ rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2 : FILE
 		date = "2021-07-02"
 		modified = "2023-12-05"
 		reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_revil_general.yar#L32-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "44948d93c71370a9976f22bf78cd1af80359f2c9804ea7995791109785cfaf84"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_revil_general.yar#L32-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_44948d93c71370a9976f22bf78cd1af80359f2c9804ea7995791109785cfaf84"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -395198,7 +391374,7 @@ rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2 : FILE
 		$opb3 = { 10 c4 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (2 of ($opa*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 2 of ( $opa* ) or 3 of them )
 }
 rule SIGNATURE_BASE_CN_Honker_Mafix_Root : FILE
 {
@@ -395209,10 +391385,10 @@ rule SIGNATURE_BASE_CN_Honker_Mafix_Root : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L8-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L8-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "826778ef9c22177d41698b467586604e001fed19"
-		logic_hash = "db54561ba4b9c1bd4d9b183658b98f6fd3165b05c8d6d7f006ae3b5fc96ba549"
+		logic_hash = "v1_sha256_db54561ba4b9c1bd4d9b183658b98f6fd3165b05c8d6d7f006ae3b5fc96ba549"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395224,7 +391400,7 @@ rule SIGNATURE_BASE_CN_Honker_Mafix_Root : FILE
 		$s2 = "if [ -f /sbin/xlogin ]; then" fullword ascii
 
 	condition:
-		filesize <96KB and all of them
+		filesize < 96KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Passwd_Dict_3389 : FILE
 {
@@ -395235,10 +391411,10 @@ rule SIGNATURE_BASE_CN_Honker_Passwd_Dict_3389 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L26-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L26-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2897e909e48a9f56ce762244c3a3e9319e12362f"
-		logic_hash = "2be79fc7388ca12f06577e689944bcfa72ed1e1b6da5a7fa15c8da69a4555a9a"
+		logic_hash = "v1_sha256_2be79fc7388ca12f06577e689944bcfa72ed1e1b6da5a7fa15c8da69a4555a9a"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395254,7 +391430,7 @@ rule SIGNATURE_BASE_CN_Honker_Passwd_Dict_3389 : FILE
 		$s7 = "12345678" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Perl_Serv_U : FILE
 {
@@ -395265,10 +391441,10 @@ rule SIGNATURE_BASE_CN_Honker_Perl_Serv_U : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f333c597ff746ebd5a641fbc248497d61e3ec17b"
-		logic_hash = "deb4ee54f9127bc093f96f7dbf3633fbfc3f66358c76fb15928dabbbffdd4963"
+		logic_hash = "v1_sha256_deb4ee54f9127bc093f96f7dbf3633fbfc3f66358c76fb15928dabbbffdd4963"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395279,7 +391455,7 @@ rule SIGNATURE_BASE_CN_Honker_Perl_Serv_U : FILE
 		$s2 = "$sock = IO::Socket::INET->new(\"127.0.0.1:$adminport\") || die \"fail\";" fullword ascii
 
 	condition:
-		filesize <8KB and all of them
+		filesize < 8KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck : FILE
 {
@@ -395290,10 +391466,10 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L65-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L65-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e216f4ba3a07de5cdbb12acc038cd8156618759e"
-		logic_hash = "be4817bcaae952eb13c35dd89606ec733c682b2e197054bb348c3934012bd105"
+		logic_hash = "v1_sha256_be4817bcaae952eb13c35dd89606ec733c682b2e197054bb348c3934012bd105"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395305,7 +391481,7 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck : FILE
 		$s2 = "F4ck Team" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389 : FILE
 {
@@ -395316,10 +391492,10 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L83-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L83-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f92b74f41a2138cc05c6b6993bcc86c706017e49"
-		logic_hash = "32603edd3f188a9f4919795df04112883d7b88da46b13fcd0b0e0065fd4c016b"
+		logic_hash = "v1_sha256_32603edd3f188a9f4919795df04112883d7b88da46b13fcd0b0e0065fd4c016b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395329,7 +391505,7 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389 : FILE
 		$s1 = "success = obj.run(\"cmd /c takeown /f %SystemRoot%\\system32\\sethc.exe&echo y| " ascii
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_2 : FILE
 {
@@ -395340,10 +391516,10 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_2 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L99-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L99-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5ff92f39ade12f8ba6cb75dfdc9bb907e49f0ebd"
-		logic_hash = "637b3368fac624ca78d2f573b8b937b6b265426d7ed923f3a3d06039663c97ad"
+		logic_hash = "v1_sha256_637b3368fac624ca78d2f573b8b937b6b265426d7ed923f3a3d06039663c97ad"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395354,7 +391530,7 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_2 : FILE
 		$s2 = "@del c:\\3389.txt" fullword ascii
 
 	condition:
-		filesize <3KB and all of them
+		filesize < 3KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Injection_Transit_Jmcook : FILE
 {
@@ -395365,10 +391541,10 @@ rule SIGNATURE_BASE_CN_Honker_Injection_Transit_Jmcook : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L116-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L116-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
-		logic_hash = "f7a9aca65b92d4b9c787d83a421b54a23844fa8e061c6c627ddde8ab5b7f4396"
+		logic_hash = "v1_sha256_f7a9aca65b92d4b9c787d83a421b54a23844fa8e061c6c627ddde8ab5b7f4396"
 		score = 70
 		quality = 83
 		tags = "FILE"
@@ -395379,7 +391555,7 @@ rule SIGNATURE_BASE_CN_Honker_Injection_Transit_Jmcook : FILE
 		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii
 
 	condition:
-		filesize <9KB and all of them
+		filesize < 9KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Pwdump7_Pwdump7 : FILE
 {
@@ -395390,10 +391566,10 @@ rule SIGNATURE_BASE_CN_Honker_Pwdump7_Pwdump7 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L133-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L133-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "67d0e215c96370dcdc681bb2638703c2eeea188a"
-		logic_hash = "50e4ec9716b4e9d824fb301bb493dcdcd9782d87c0fb8040b82a87faf56292cb"
+		logic_hash = "v1_sha256_50e4ec9716b4e9d824fb301bb493dcdcd9782d87c0fb8040b82a87faf56292cb"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395403,7 +391579,7 @@ rule SIGNATURE_BASE_CN_Honker_Pwdump7_Pwdump7 : FILE
 		$s1 = "Pwdump7.exe >pass.txt" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Portrecall_Pr : FILE
 {
@@ -395414,10 +391590,10 @@ rule SIGNATURE_BASE_CN_Honker_Portrecall_Pr : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L149-L165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L149-L165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "583cf6dc2304121d835f2879803a22fea76930f3"
-		logic_hash = "f33373e87887506651b1fac464f860a3cf18ad681ba124b606524f6f2255e693"
+		logic_hash = "v1_sha256_f33373e87887506651b1fac464f860a3cf18ad681ba124b606524f6f2255e693"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395429,7 +391605,7 @@ rule SIGNATURE_BASE_CN_Honker_Portrecall_Pr : FILE
 		$s3 = "PR(Packet redirection) for linux " fullword ascii
 
 	condition:
-		filesize <70KB and all of them
+		filesize < 70KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_3 : FILE
 {
@@ -395440,10 +391616,10 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_3 : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L167-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L167-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cfedec7bd327897694f83501d76063fe16b13450"
-		logic_hash = "df07958e44c7896bc7bdf2b79bc95969593eb21b9c9ed51213fd15affb731ec2"
+		logic_hash = "v1_sha256_df07958e44c7896bc7bdf2b79bc95969593eb21b9c9ed51213fd15affb731ec2"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395455,7 +391631,7 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_3 : FILE
 		$s3 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]>>" ascii
 
 	condition:
-		filesize <2KB and all of them
+		filesize < 2KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Alien_D : FILE
 {
@@ -395466,10 +391642,10 @@ rule SIGNATURE_BASE_CN_Honker_Alien_D : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L185-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L185-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "de9cd4bd72b1384b182d58621f51815a77a5f07d"
-		logic_hash = "2eca697dd1f2ad80c5cd71507cd5f8abd2364b11dfe3206a1043e3d4f5835797"
+		logic_hash = "v1_sha256_2eca697dd1f2ad80c5cd71507cd5f8abd2364b11dfe3206a1043e3d4f5835797"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395483,7 +391659,7 @@ rule SIGNATURE_BASE_CN_Honker_Alien_D : FILE
 		$s4 = "Response.Write \"<input name='NoCheckTemp' type='checkbox' id='NoCheckTemp' chec" ascii
 
 	condition:
-		filesize <30KB and 2 of them
+		filesize < 30KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Chinachopper_Db : FILE
 {
@@ -395494,10 +391670,10 @@ rule SIGNATURE_BASE_CN_Honker_Chinachopper_Db : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L205-L221"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L205-L221"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "af79ff2689a6b7a90a5d3c0ebe709e42f2a15597"
-		logic_hash = "b650498df99c4620e3904ce8980cd58eb0cb5e0a7a275d54bdbcc41a687bec8e"
+		logic_hash = "v1_sha256_b650498df99c4620e3904ce8980cd58eb0cb5e0a7a275d54bdbcc41a687bec8e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395509,7 +391685,7 @@ rule SIGNATURE_BASE_CN_Honker_Chinachopper_Db : FILE
 		$s3 = "<H>localhost</H>" fullword wide
 
 	condition:
-		filesize <340KB and 2 of them
+		filesize < 340KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_Syconfig : FILE
 {
@@ -395520,10 +391696,10 @@ rule SIGNATURE_BASE_CN_Honker_Syconfig : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L223-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L223-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ff75353df77d610d3bccfbffb2c9dfa258b2fac9"
-		logic_hash = "6b7f918b83bac84df5ac6b247d4162dd385aba0a32570366c62fc4830199e86e"
+		logic_hash = "v1_sha256_6b7f918b83bac84df5ac6b247d4162dd385aba0a32570366c62fc4830199e86e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395533,7 +391709,7 @@ rule SIGNATURE_BASE_CN_Honker_Syconfig : FILE
 		$s9 = "Hashq.CrackHost+FormUnit" fullword ascii
 
 	condition:
-		uint16(0)==0x0100 and filesize <18KB and all of them
+		uint16( 0 ) == 0x0100 and filesize < 18KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Linux_Bin : FILE
 {
@@ -395544,10 +391720,10 @@ rule SIGNATURE_BASE_CN_Honker_Linux_Bin : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L239-L254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L239-L254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "26e71e6ebc6a3bdda9467ce929610c94de8a7ca0"
-		logic_hash = "d02fcf23e46a0b6d44c382e34d73ef6239b6a1afc690e417aa0e6b0898e277c0"
+		logic_hash = "v1_sha256_d02fcf23e46a0b6d44c382e34d73ef6239b6a1afc690e417aa0e6b0898e277c0"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395558,7 +391734,7 @@ rule SIGNATURE_BASE_CN_Honker_Linux_Bin : FILE
 		$s2 = "printf(\"\\n\\n*********Waiting Client connect*****\\n\\n\");" fullword ascii
 
 	condition:
-		filesize <20KB and all of them
+		filesize < 20KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Intersect2_Beta : FILE
 {
@@ -395569,10 +391745,10 @@ rule SIGNATURE_BASE_CN_Honker_Intersect2_Beta : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L256-L272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L256-L272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3ba5f720c4994cd4ad519b457e232365e66f37cc"
-		logic_hash = "bc6a83f8f851f7fb5b620be889619fcbd9f34ba27d495c2040e207caf95854bb"
+		logic_hash = "v1_sha256_bc6a83f8f851f7fb5b620be889619fcbd9f34ba27d495c2040e207caf95854bb"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395584,7 +391760,7 @@ rule SIGNATURE_BASE_CN_Honker_Intersect2_Beta : FILE
 		$s3 = "os.system(\"rm -rf credentials/\")" fullword ascii
 
 	condition:
-		uint16(0)==0x2123 and filesize <50KB and 2 of them
+		uint16( 0 ) == 0x2123 and filesize < 50KB and 2 of them
 }
 rule SIGNATURE_BASE_CN_Honker_IIS_Logcleaner1_0_Readme : FILE
 {
@@ -395595,10 +391771,10 @@ rule SIGNATURE_BASE_CN_Honker_IIS_Logcleaner1_0_Readme : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L274-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L274-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2ab47d876b49e9a693f602f3545381415e82a556"
-		logic_hash = "3cbd7b2e1710c78bc8ab8d2730cc6da8eb95038f8431d5d0081db984b3d706cf"
+		logic_hash = "v1_sha256_3cbd7b2e1710c78bc8ab8d2730cc6da8eb95038f8431d5d0081db984b3d706cf"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395609,7 +391785,7 @@ rule SIGNATURE_BASE_CN_Honker_IIS_Logcleaner1_0_Readme : FILE
 		$s3 = "http://l-y.vicp.net" fullword ascii
 
 	condition:
-		filesize <7KB and all of them
+		filesize < 7KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Alien_Command : FILE
 {
@@ -395620,10 +391796,10 @@ rule SIGNATURE_BASE_CN_Honker_Alien_Command : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L291-L306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L291-L306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5896b74158ef153d426fba76c2324cd9c261c709"
-		logic_hash = "a55be30fdb6598669d144308af5a9b6a21ab6140c75fdfc18cecf5d9add4a530"
+		logic_hash = "v1_sha256_a55be30fdb6598669d144308af5a9b6a21ab6140c75fdfc18cecf5d9add4a530"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395634,7 +391810,7 @@ rule SIGNATURE_BASE_CN_Honker_Alien_Command : FILE
 		$s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii
 
 	condition:
-		filesize <8KB and all of them
+		filesize < 8KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Portrecall_Bc : FILE
 {
@@ -395645,10 +391821,10 @@ rule SIGNATURE_BASE_CN_Honker_Portrecall_Bc : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L308-L324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L308-L324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2084990406398afd856b2309c7f579d7d61c3767"
-		logic_hash = "f51644f195e42b91dae80ba1770aeb40790ea8528b6d09f5fed0f71d93bda5fc"
+		logic_hash = "v1_sha256_f51644f195e42b91dae80ba1770aeb40790ea8528b6d09f5fed0f71d93bda5fc"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395660,7 +391836,7 @@ rule SIGNATURE_BASE_CN_Honker_Portrecall_Bc : FILE
 		$s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_MSSQL_ : FILE
 {
@@ -395671,10 +391847,10 @@ rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_MSSQL_ : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L326-L342"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L326-L342"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7097c21f92306983add3b5b29a517204cd6cd819"
-		logic_hash = "4d721fd9711799cf3fd8ba6c300e270ed25faa2fb938ea01464e9bc9a3768e22"
+		logic_hash = "v1_sha256_4d721fd9711799cf3fd8ba6c300e270ed25faa2fb938ea01464e9bc9a3768e22"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395686,7 +391862,7 @@ rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_MSSQL_ : FILE
 		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
 
 	condition:
-		filesize <100KB and all of them
+		filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Nc_MOVE : FILE
 {
@@ -395697,10 +391873,10 @@ rule SIGNATURE_BASE_CN_Honker_Nc_MOVE : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L344-L360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L344-L360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4195370c103ca467cddc8f2724a8e477635be424"
-		logic_hash = "49f41162919bb04744041ae6f7438e61d98fb7d5984a17535d9c4ce4d398671b"
+		logic_hash = "v1_sha256_49f41162919bb04744041ae6f7438e61d98fb7d5984a17535d9c4ce4d398671b"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395712,7 +391888,7 @@ rule SIGNATURE_BASE_CN_Honker_Nc_MOVE : FILE
 		$s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize < 1KB and all of them
 }
 rule SIGNATURE_BASE_CN_Honker_Mssqlpw_Scan : FILE
 {
@@ -395723,10 +391899,10 @@ rule SIGNATURE_BASE_CN_Honker_Mssqlpw_Scan : FILE
 		date = "2015-06-23"
 		modified = "2023-12-05"
 		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/cn_pentestset_scripts.yar#L362-L377"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/cn_pentestset_scripts.yar#L362-L377"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
-		logic_hash = "eb3bd38ca317f0b10358581fc3dbb8ca81b991b9a4f4f2d256d81a31028411b9"
+		logic_hash = "v1_sha256_eb3bd38ca317f0b10358581fc3dbb8ca81b991b9a4f4f2d256d81a31028411b9"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -395737,7 +391913,7 @@ rule SIGNATURE_BASE_CN_Honker_Mssqlpw_Scan : FILE
 		$s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii
 
 	condition:
-		filesize <6KB and all of them
+		filesize < 6KB and all of them
 }
 rule SIGNATURE_BASE_Kraken_Bot_Sample : FILE
 {
@@ -395748,10 +391924,10 @@ rule SIGNATURE_BASE_Kraken_Bot_Sample : FILE
 		date = "2015-05-07"
 		modified = "2023-12-05"
 		reference = "https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_kraken_bot1.yar#L8-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_kraken_bot1.yar#L8-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "798e9f43fc199269a3ec68980eb4d91eb195436d"
-		logic_hash = "2e0f0a981ce3483aad8e48f6a259f9875ea4f8449feb24bafbae07243dd82a16"
+		logic_hash = "v1_sha256_2e0f0a981ce3483aad8e48f6a259f9875ea4f8449feb24bafbae07243dd82a16"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -395765,7 +391941,7 @@ rule SIGNATURE_BASE_Kraken_Bot_Sample : FILE
 		$s20 = "btcplug" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_MAL_Sophos_XG_Pygmy_Goat_AES_Key : FILE
 {
@@ -395774,11 +391950,11 @@ rule SIGNATURE_BASE_MAL_Sophos_XG_Pygmy_Goat_AES_Key : FILE
 		author = "NCSC"
 		id = "62be3f4f-b435-54b2-b596-4ad01606edb8"
 		date = "2024-10-22"
-		modified = "2024-11-04"
+		modified = "2024-12-12"
 		reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_sophos_pygmy_nov24.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "da6c5d7a03eab01ddbb460cbdd16622839b3a52cfa4e91f169d3d477c60cfed4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_sophos_pygmy_nov24.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_da6c5d7a03eab01ddbb460cbdd16622839b3a52cfa4e91f169d3d477c60cfed4"
 		score = 75
 		quality = 69
 		tags = "FILE"
@@ -395795,7 +391971,7 @@ rule SIGNATURE_BASE_MAL_Sophos_XG_Pygmy_Goat_AES_Key : FILE
 		$dword_8 = { 55 51 50 77 }
 
 	condition:
-		uint32(0)==0x464c457f and all of them and filesize <4MB
+		uint32( 0 ) == 0x464c457f and all of them and filesize < 4MB
 }
 rule SIGNATURE_BASE_MAL_Sophos_XG_Pygmy_Goat_Magic_Strings : FILE
 {
@@ -395804,11 +391980,11 @@ rule SIGNATURE_BASE_MAL_Sophos_XG_Pygmy_Goat_Magic_Strings : FILE
 		author = "NCSC"
 		id = "7df6c228-d569-5f1c-8bbb-4194347f99d1"
 		date = "2024-10-22"
-		modified = "2024-11-04"
+		modified = "2024-12-12"
 		reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_sophos_pygmy_nov24.yar#L25-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "df40e818002a72ee649dd2bb79cb59938dc108690cce03c99a72fc036406c4b2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_sophos_pygmy_nov24.yar#L26-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_df40e818002a72ee649dd2bb79cb59938dc108690cce03c99a72fc036406c4b2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -395823,7 +391999,7 @@ rule SIGNATURE_BASE_MAL_Sophos_XG_Pygmy_Goat_Magic_Strings : FILE
       a4 b3 0f }
 
 	condition:
-		uint32(0)==0x464c457f and any of them
+		uint32( 0 ) == 0x464c457f and any of them
 }
 rule SIGNATURE_BASE_MAL_Earthworm_Socks_Proxy_ID_Generation : FILE
 {
@@ -395832,11 +392008,11 @@ rule SIGNATURE_BASE_MAL_Earthworm_Socks_Proxy_ID_Generation : FILE
 		author = "NCSC"
 		id = "242777e4-3abb-50d8-8c45-746cc4a8b1f8"
 		date = "2024-10-22"
-		modified = "2024-11-04"
+		modified = "2024-12-12"
 		reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_sophos_pygmy_nov24.yar#L44-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6837cba2637ed02d1d620c037b200d528c09a39498c1e320873a3a244e67932c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_sophos_pygmy_nov24.yar#L46-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6837cba2637ed02d1d620c037b200d528c09a39498c1e320873a3a244e67932c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -395858,7 +392034,7 @@ rule SIGNATURE_BASE_MAL_Earthworm_Socks_Proxy_ID_Generation : FILE
       }
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint32( 0 ) == 0x464c457f and all of them
 }
 rule SIGNATURE_BASE_HKTL_Cobaltstrike_Sleepmask_Jul22
 {
@@ -395869,9 +392045,9 @@ rule SIGNATURE_BASE_HKTL_Cobaltstrike_Sleepmask_Jul22
 		date = "2022-07-04"
 		modified = "2023-12-05"
 		reference = "https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_cobaltstrike.yar#L3-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "233b3cb441f45f400c0261589aac31dd1fcd9c4e3a86a6aaa46c60849063b34b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_cobaltstrike.yar#L3-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_233b3cb441f45f400c0261589aac31dd1fcd9c4e3a86a6aaa46c60849063b34b"
 		score = 80
 		quality = 85
 		tags = ""
@@ -395882,8 +392058,6 @@ rule SIGNATURE_BASE_HKTL_Cobaltstrike_Sleepmask_Jul22
 	condition:
 		$sleep_mask
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_TINY_PE : FILE
 {
 	meta:
@@ -395893,9 +392067,9 @@ rule SIGNATURE_BASE_SUSP_TINY_PE : FILE
 		date = "2019-10-23"
 		modified = "2023-12-05"
 		reference = "https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_file_anomalies.yar#L3-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5eabfa8e0fd4d6d1376d263484fba985e7a4b05d68046be1f79c1dfdbbfff9e5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_file_anomalies.yar#L3-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5eabfa8e0fd4d6d1376d263484fba985e7a4b05d68046be1f79c1dfdbbfff9e5"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -395904,10 +392078,8 @@ rule SIGNATURE_BASE_SUSP_TINY_PE : FILE
 		$header = { 4D 5A 00 00 50 45 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and uint16(4)==0x4550 and filesize <=20KB and $header at 0
+		uint16( 0 ) == 0x5a4d and uint16( 4 ) == 0x4550 and filesize <= 20KB and $header at 0
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_GIF_Anomalies : FILE
 {
 	meta:
@@ -395917,15 +392089,15 @@ rule SIGNATURE_BASE_SUSP_GIF_Anomalies : FILE
 		date = "2020-07-02"
 		modified = "2023-12-05"
 		reference = "https://en.wikipedia.org/wiki/GIF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_file_anomalies.yar#L17-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "64d17c8de72600cd889a802fd002faaaf9a3a17f7fa157ae5b2b620b28e6c439"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_file_anomalies.yar#L17-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_64d17c8de72600cd889a802fd002faaaf9a3a17f7fa157ae5b2b620b28e6c439"
 		score = 60
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x4947 and uint8(2)==0x46 and uint8(11)!=0x00 and uint8(12)!=0x00 and uint8( filesize -1)!=0x3b
+		uint16( 0 ) == 0x4947 and uint8( 2 ) == 0x46 and uint8( 11 ) != 0x00 and uint8( 12 ) != 0x00 and uint8( filesize - 1 ) != 0x3b
 }
 import "pe"
 
@@ -395938,9 +392110,9 @@ rule SIGNATURE_BASE_SUSP_Hxd_Icon_Anomaly_May23_1 : FILE
 		date = "2023-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.linkedin.com/feed/update/urn:li:activity:7068631930040188929/?utm_source=share&utm_medium=member_ios"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_file_anomalies.yar#L32-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a328687ac8b868fb78a49188b286a8951c6043a7ff6ff0c7a23c3f9b3ef15eb2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_file_anomalies.yar#L32-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a328687ac8b868fb78a49188b286a8951c6043a7ff6ff0c7a23c3f9b3ef15eb2"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -395968,7 +392140,7 @@ rule SIGNATURE_BASE_SUSP_Hxd_Icon_Anomaly_May23_1 : FILE
 		$xs2 = "Terminator" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($ac*) and ( not 1 of ($s*) or filesize >6930000 or (pe.is_32bit() and filesize <1540000 and not $upx1) or (pe.is_32bit() and filesize <590000 and $upx1) or (pe.is_64bit() and filesize <6670000 and not $upx1) or (pe.is_64bit() and filesize <1300000 and $upx1) or 1 of ($xs*))
+		uint16( 0 ) == 0x5a4d and 1 of ( $ac* ) and ( not 1 of ( $s* ) or filesize > 6930000 or ( pe.is_32bit ( ) and filesize < 1540000 and not $upx1 ) or ( pe.is_32bit ( ) and filesize < 590000 and $upx1 ) or ( pe.is_64bit ( ) and filesize < 6670000 and not $upx1 ) or ( pe.is_64bit ( ) and filesize < 1300000 and $upx1 ) or 1 of ( $xs* ) )
 }
 rule SIGNATURE_BASE_Uboatrat : FILE
 {
@@ -395979,9 +392151,9 @@ rule SIGNATURE_BASE_Uboatrat : FILE
 		date = "2017-11-29"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_uboat_rat.yar#L9-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3d0837607d1a5efd9986eccf98f108633502a09dbf8c4c94fc0f0247060bc3a8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_uboat_rat.yar#L9-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3d0837607d1a5efd9986eccf98f108633502a09dbf8c4c94fc0f0247060bc3a8"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -396007,7 +392179,7 @@ rule SIGNATURE_BASE_Uboatrat : FILE
 		$vprotect = { 2E 76 6D 70 30 }
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3c))==0x4550 and filesize <1400KB and filesize >800KB and ( all of ($s*) and $op1 at 64 and uint16( uint32(0x3c)+11)==0x59 and $vprotect in (600..700))
+		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3c ) ) == 0x4550 and filesize < 1400KB and filesize > 800KB and ( all of ( $s* ) and $op1 at 64 and uint16( uint32( 0x3c ) + 11 ) == 0x59 and $vprotect in ( 600 .. 700 ) )
 }
 rule SIGNATURE_BASE_Uboatrat_Dropper : FILE
 {
@@ -396018,9 +392190,9 @@ rule SIGNATURE_BASE_Uboatrat_Dropper : FILE
 		date = "2017-11-29"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_uboat_rat.yar#L52-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f8dcc8559fa0ab1644ef6bab9bc875f3d62391c157b373e0355ad03d35e5601"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_uboat_rat.yar#L52-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f8dcc8559fa0ab1644ef6bab9bc875f3d62391c157b373e0355ad03d35e5601"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396035,7 +392207,7 @@ rule SIGNATURE_BASE_Uboatrat_Dropper : FILE
 		$s5 = "bad all" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
 rule SIGNATURE_BASE_Aptgroupx_Plugxtrojanloader_Stringdecode
 {
@@ -396046,9 +392218,9 @@ rule SIGNATURE_BASE_Aptgroupx_Plugxtrojanloader_Stringdecode
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://t.co/4xQ8G2mNap"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_plugx.yar#L2-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e5ab15b035bb0169864e687e5c26732dd5b8f5f184473a33e685f53699ce4acc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_plugx.yar#L2-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e5ab15b035bb0169864e687e5c26732dd5b8f5f184473a33e685f53699ce4acc"
 		score = 80
 		quality = 85
 		tags = ""
@@ -396091,9 +392263,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_COVID19_Apr20_1 : FILE
 		date = "2020-04-15"
 		modified = "2023-12-05"
 		reference = "https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_covid_ransom.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9b32ce1dff9d27c5f7541de97cd1198b0d837a69ee260b327c66a22ca6f30091"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_covid_ransom.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9b32ce1dff9d27c5f7541de97cd1198b0d837a69ee260b327c66a22ca6f30091"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396106,7 +392278,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_COVID19_Apr20_1 : FILE
 		$op3 = { 1f 07 1a 37 85 05 05 36 83 05 05 36 83 05 05 34 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and 2 of them
 }
 rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1 : FILE
 {
@@ -396117,9 +392289,9 @@ rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1 : FILE
 		date = "2020-10-14"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_reddelta.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1f2406563b863b8ccd0fd8d8d33c576c4b82dabb55a1e4fa8291859323389834"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_reddelta.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1f2406563b863b8ccd0fd8d8d33c576c4b82dabb55a1e4fa8291859323389834"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396140,7 +392312,7 @@ rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1 : FILE
 		$op2 = { ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and $x1 or 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and $x1 or 3 of them
 }
 rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_2 : FILE
 {
@@ -396151,9 +392323,9 @@ rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_2 : FILE
 		date = "2020-10-14"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_reddelta.yar#L31-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "179265c0b2175bc3d2d581a69e50e9b8b9cc918a6fdc7bcef42fb163c49b077a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_reddelta.yar#L31-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_179265c0b2175bc3d2d581a69e50e9b8b9cc918a6fdc7bcef42fb163c49b077a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396173,7 +392345,7 @@ rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_2 : FILE
 		$op1 = { 4c 8d 45 e0 49 8b cc 41 8d 51 c3 e8 34 77 02 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of ($x*) or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $x* ) or 4 of them
 }
 rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_3 : FILE
 {
@@ -396184,9 +392356,9 @@ rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_3 : FILE
 		date = "2020-10-14"
 		modified = "2022-12-21"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_cn_reddelta.yar#L59-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "64402f6265f23abf7d6a711aa888c89386c1a754f12286b0efe5fd5d81f15b01"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_cn_reddelta.yar#L59-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_64402f6265f23abf7d6a711aa888c89386c1a754f12286b0efe5fd5d81f15b01"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396200,7 +392372,7 @@ rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_3 : FILE
 		$s5 = "Error %s:%d, ErrorCode: %x" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and 4 of them
 }
 rule SIGNATURE_BASE_APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_Jun23_1 : SCRIPT CVE_2023_2868
 {
@@ -396211,9 +392383,9 @@ rule SIGNATURE_BASE_APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_J
 		date = "2023-06-15"
 		modified = "2023-06-16"
 		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L2-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa7cac1e0f6cb6fa3ac271c1fff0039ff182b6859920b4eca25541457654acde"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L2-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa7cac1e0f6cb6fa3ac271c1fff0039ff182b6859920b4eca25541457654acde"
 		score = 75
 		quality = 85
 		tags = "SCRIPT, CVE-2023-2868"
@@ -396233,7 +392405,7 @@ rule SIGNATURE_BASE_APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_J
 		$sa2 = ".tar;chmod +x "
 
 	condition:
-		1 of ($x*) or all of ($sa*)
+		1 of ( $x* ) or all of ( $sa* )
 }
 rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_Jun23_1 : CVE_2023_2868 FILE
 {
@@ -396244,9 +392416,9 @@ rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_Jun23_1 : CVE_2023_2868 FILE
 		date = "2023-06-16"
 		modified = "2023-12-05"
 		reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L30-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c1dcb841fb872f0d5e661bfd90fca3075f5efc95b1f9dfff72fa318ed131e9d1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L30-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c1dcb841fb872f0d5e661bfd90fca3075f5efc95b1f9dfff72fa318ed131e9d1"
 		score = 85
 		quality = 85
 		tags = "CVE-2023-2868, FILE"
@@ -396264,7 +392436,7 @@ rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_Jun23_1 : CVE_2023_2868 FILE
 		$op3 = { 72 de 45 89 f4 e9 b8 f4 ff ff 48 8b 73 08 45 85 e4 ba 49 3d 62 00 b8 44 81 62 00 48 0f 45 d0 }
 
 	condition:
-		uint16(0)==0x457f and filesize <9000KB and 3 of them or 5 of them
+		uint16( 0 ) == 0x457f and filesize < 9000KB and 3 of them or 5 of them
 }
 rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_LUA_Jun23_1 : FILE
 {
@@ -396275,9 +392447,9 @@ rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_LUA_Jun23_1 : FILE
 		date = "2023-06-16"
 		modified = "2023-12-05"
 		reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L57-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f78823a4ba9e025ba4833a2d5234c7baba33c1167c0247f13b8b2baa430aa4e5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L57-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f78823a4ba9e025ba4833a2d5234c7baba33c1167c0247f13b8b2baa430aa4e5"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -396290,7 +392462,7 @@ rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_LUA_Jun23_1 : FILE
 		$xe2 = "log.debug(\"--- opening archive [%s], mimetype [%s]\", tmpfile" ascii base64
 
 	condition:
-		filesize <500KB and 1 of them
+		filesize < 500KB and 1 of them
 }
 rule SIGNATURE_BASE_APT_HKTL_Proxy_Tool_Jun23_1 : FILE
 {
@@ -396301,9 +392473,9 @@ rule SIGNATURE_BASE_APT_HKTL_Proxy_Tool_Jun23_1 : FILE
 		date = "2023-06-16"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L76-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7e2152e1aa74e1842519e2eecd2acd3ef8eb8d517f3c0ef9f05c983616f223c3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L76-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7e2152e1aa74e1842519e2eecd2acd3ef8eb8d517f3c0ef9f05c983616f223c3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396316,7 +392488,7 @@ rule SIGNATURE_BASE_APT_HKTL_Proxy_Tool_Jun23_1 : FILE
 		$s2 = "main.sockIP.toAddr" ascii fullword
 
 	condition:
-		( uint16(0)==0x5a4d or uint32be(0)==0x7f454c46 or uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca or uint32(0)==0xbebafeca) and filesize <10MB and all of them
+		( uint16( 0 ) == 0x5a4d or uint32be( 0 ) == 0x7f454c46 or uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca or uint32( 0 ) == 0xbebafeca ) and filesize < 10MB and all of them
 }
 rule SIGNATURE_BASE_SUSP_Fscan_Port_Scanner_Output_Jun23 : SCRIPT FILE
 {
@@ -396327,9 +392499,9 @@ rule SIGNATURE_BASE_SUSP_Fscan_Port_Scanner_Output_Jun23 : SCRIPT FILE
 		date = "2023-06-15"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L103-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "49b5055c96d7b7446ee5ae8667a5aa3645f0f98d8b5f2bffcd6ef3b20bc64e05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L103-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_49b5055c96d7b7446ee5ae8667a5aa3645f0f98d8b5f2bffcd6ef3b20bc64e05"
 		score = 70
 		quality = 85
 		tags = "SCRIPT, FILE"
@@ -396340,7 +392512,7 @@ rule SIGNATURE_BASE_SUSP_Fscan_Port_Scanner_Output_Jun23 : SCRIPT FILE
 		$s3 = "   [->]"
 
 	condition:
-		filesize <800KB and all of them
+		filesize < 800KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_PY_Shell_Spawn_Jun23_1 : SCRIPT
 {
@@ -396351,9 +392523,9 @@ rule SIGNATURE_BASE_SUSP_PY_Shell_Spawn_Jun23_1 : SCRIPT
 		date = "2023-06-15"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L119-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "63e94447930d5a00399de753076facbfb2bf18dd8c815f01aaefd14678aea034"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L119-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_63e94447930d5a00399de753076facbfb2bf18dd8c815f01aaefd14678aea034"
 		score = 70
 		quality = 85
 		tags = "SCRIPT"
@@ -396373,10 +392545,10 @@ rule SIGNATURE_BASE_APT_MAL_Hunting_LUA_SEASIDE_1 : FILE
 		date = "2023-06-15"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L136-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L136-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cd2813f0260d63ad5adf0446253c2172"
-		logic_hash = "82b61325a78bf8ab09d426cfadceb614a256dfcafb2e1f75595de63593ed2574"
+		logic_hash = "v1_sha256_82b61325a78bf8ab09d426cfadceb614a256dfcafb2e1f75595de63593ed2574"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -396388,7 +392560,7 @@ rule SIGNATURE_BASE_APT_MAL_Hunting_LUA_SEASIDE_1 : FILE
 		$s4 = "os.execute(helosend)"
 
 	condition:
-		filesize <1MB and all of ($s*)
+		filesize < 1MB and all of ( $s* )
 }
 rule SIGNATURE_BASE_APT_MAL_LNX_Hunting_Linux_WHIRLPOOL_1 : FILE
 {
@@ -396399,10 +392571,10 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Hunting_Linux_WHIRLPOOL_1 : FILE
 		date = "2023-06-15"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L154-L173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L154-L173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "177add288b289d43236d2dba33e65956"
-		logic_hash = "d03c0e292b9b97bbf76585fc74208e4263d753807b8e4a445be80d41264d5432"
+		logic_hash = "v1_sha256_d03c0e292b9b97bbf76585fc74208e4263d753807b8e4a445be80d41264d5432"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -396417,7 +392589,7 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Hunting_Linux_WHIRLPOOL_1 : FILE
 		$c3 = "SSLShell.c" fullword
 
 	condition:
-		uint32(0)==0x464c457f and filesize <15MB and ( all of ($s*) or all of ($c*))
+		uint32( 0 ) == 0x464c457f and filesize < 15MB and ( all of ( $s* ) or all of ( $c* ) )
 }
 rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_SKIPJACK_1
 {
@@ -396428,10 +392600,10 @@ rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_SKIPJACK_1
 		date = "2023-06-15"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L175-L193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L175-L193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e4e86c273a2b67a605f5d4686783e0cc"
-		logic_hash = "8890cd9ab8190f12997e0653e43c89816df03c7bd41842e5ad21b1986819843e"
+		logic_hash = "v1_sha256_8890cd9ab8190f12997e0653e43c89816df03c7bd41842e5ad21b1986819843e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -396456,10 +392628,10 @@ rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_Lua_SKIPJACK_2
 		date = "2023-06-15"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L195-L212"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L195-L212"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "87847445f9524671022d70f2a812728f"
-		logic_hash = "093e8857c410bd30a076f87ef63d7e1e66f50e3dce75b4add67161782386ee24"
+		logic_hash = "v1_sha256_093e8857c410bd30a076f87ef63d7e1e66f50e3dce75b4add67161782386ee24"
 		score = 70
 		quality = 85
 		tags = ""
@@ -396483,10 +392655,10 @@ rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_Lua_SEASPRAY_1
 		date = "2023-06-15"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_barracuda_esg_unc4841_jun23.yar#L213-L228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_barracuda_esg_unc4841_jun23.yar#L213-L228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "35cf6faf442d325961935f660e2ab5a0"
-		logic_hash = "856bfb47557b60f69aa1141477d6ce446ea13ebbe899022d7996ceef08bdefbb"
+		logic_hash = "v1_sha256_856bfb47557b60f69aa1141477d6ce446ea13ebbe899022d7996ceef08bdefbb"
 		score = 70
 		quality = 85
 		tags = ""
@@ -396508,9 +392680,9 @@ rule SIGNATURE_BASE_Hiddencobra_BANKSHOT_Gen : FILE
 		date = "2017-12-26"
 		modified = "2022-06-10"
 		reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hiddencobra_bankshot.yar#L11-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "db4d396736ab42942f1a11a819419410e388b011e8992ad187c2f484d637c99c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hiddencobra_bankshot.yar#L11-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_db4d396736ab42942f1a11a819419410e388b011e8992ad187c2f484d637c99c"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -396552,7 +392724,7 @@ rule SIGNATURE_BASE_Hiddencobra_BANKSHOT_Gen : FILE
 		$a6 = "web.whatsapp.com" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 2 of ($s*) or 4 of ($a*))
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 2 of ( $s* ) or 4 of ( $a* ) )
 }
 rule SIGNATURE_BASE_Unauthorized_Proxy_Server_RAT
 {
@@ -396563,9 +392735,9 @@ rule SIGNATURE_BASE_Unauthorized_Proxy_Server_RAT
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hiddencobra_bankshot.yar#L67-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ede26272ddcb25dca2b44ff08b232f358078872f6cf76491b0fd8d65772c60d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hiddencobra_bankshot.yar#L67-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ede26272ddcb25dca2b44ff08b232f358078872f6cf76491b0fd8d65772c60d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -396600,9 +392772,9 @@ rule SIGNATURE_BASE_Venom_Rootkit : FILE
 		date = "2017-01-12"
 		modified = "2023-12-05"
 		reference = "https://security.web.cern.ch/security/venom.shtml"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_venom_linux_rootkit.yar#L10-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0b2211edc6737e9da3e43bec9ef823e80c6bd6463adbb10d6839e9914aed22ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_venom_linux_rootkit.yar#L10-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0b2211edc6737e9da3e43bec9ef823e80c6bd6463adbb10d6839e9914aed22ac"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396622,7 +392794,7 @@ rule SIGNATURE_BASE_Venom_Rootkit : FILE
 		$s11 = "justCANTbeSTOPPED" ascii fullword
 
 	condition:
-		filesize <4000KB and 2 of them
+		filesize < 4000KB and 2 of them
 }
 rule SIGNATURE_BASE_ATM_Malware_Xfscashncr_1 : FILE
 {
@@ -396633,9 +392805,9 @@ rule SIGNATURE_BASE_ATM_Malware_Xfscashncr_1 : FILE
 		date = "2019-08-28"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_atm_xfscashncr.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "014d07115543c6e041649a1c57206a75fd555bf0458c7578a33c81b473c72751"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_atm_xfscashncr.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_014d07115543c6e041649a1c57206a75fd555bf0458c7578a33c81b473c72751"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396652,7 +392824,7 @@ rule SIGNATURE_BASE_ATM_Malware_Xfscashncr_1 : FILE
 		$LogFile = "XfsLog.txt" nocase ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1500KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5A4D and filesize < 1500KB and ( 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_Fidelis_Advisory_Purchase_Order_Pps
 {
@@ -396663,9 +392835,9 @@ rule SIGNATURE_BASE_Fidelis_Advisory_Purchase_Order_Pps
 		date = "2015-06-09"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ZjJyti"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fidelis_phishing_plain_sight.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "45cfee6413accff36a39ced861a29c611d6efe24e1ca87f17467106f8565642b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fidelis_phishing_plain_sight.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_45cfee6413accff36a39ced861a29c611d6efe24e1ca87f17467106f8565642b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -396686,9 +392858,9 @@ rule SIGNATURE_BASE_Fidelis_Advisory_Cedt370
 		date = "2015-06-09"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/ZjJyti"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fidelis_phishing_plain_sight.yar#L16-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1070d3c63a7091c0982e67134f9dc3cd790bb0b5c2ac08f3a00e3b97ef53d64b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fidelis_phishing_plain_sight.yar#L16-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1070d3c63a7091c0982e67134f9dc3cd790bb0b5c2ac08f3a00e3b97ef53d64b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -396711,9 +392883,9 @@ rule SIGNATURE_BASE_HKTL_Venom_LIB_Dec22 : FILE
 		date = "2022-12-17"
 		modified = "2023-12-05"
 		reference = "https://github.com/Idov31/Venom"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_hktl_venom_lib.yar#L2-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fa143946479a45b272d507c3aa2b17026bfdcbb4abefd833f95ff78537568ec1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_hktl_venom_lib.yar#L2-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fa143946479a45b272d507c3aa2b17026bfdcbb4abefd833f95ff78537568ec1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396732,7 +392904,7 @@ rule SIGNATURE_BASE_HKTL_Venom_LIB_Dec22 : FILE
 		$op3 = { 48 8b da 48 8b f9 45 33 f6 48 85 c9 0f 84 34 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ((3 of ($ss*) and all of ($op*)) or 2 of ($sx*)) or $x1 or all of ($sx*)
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( ( 3 of ( $ss* ) and all of ( $op* ) ) or 2 of ( $sx* ) ) or $x1 or all of ( $sx* )
 }
 rule SIGNATURE_BASE_MAL_Enfal_Nov22 : FILE
 {
@@ -396744,9 +392916,9 @@ rule SIGNATURE_BASE_MAL_Enfal_Nov22 : FILE
 		modified = "2023-01-06"
 		old_rule_name = "Enfal_Malware"
 		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_enfal.yar#L1-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf349ba2b7bd635808b4ee23c6286e7dd403fbc185c6b59f0bb1fbf47ba7d9bb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_enfal.yar#L1-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf349ba2b7bd635808b4ee23c6286e7dd403fbc185c6b59f0bb1fbf47ba7d9bb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396762,7 +392934,7 @@ rule SIGNATURE_BASE_MAL_Enfal_Nov22 : FILE
 		$s5 = "%ComSpec%" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 3 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 3 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Enfal_Malware_Backdoor : FILE
 {
@@ -396773,9 +392945,9 @@ rule SIGNATURE_BASE_Enfal_Malware_Backdoor : FILE
 		date = "2015-02-10"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_enfal.yar#L27-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ce0c19e666cc0db50194bd56f51beddeee22c787b67810655241fdd4d34a31e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_enfal.yar#L27-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ce0c19e666cc0db50194bd56f51beddeee22c787b67810655241fdd4d34a31e"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -396797,7 +392969,7 @@ rule SIGNATURE_BASE_Enfal_Malware_Backdoor : FILE
 		$z5 = "{53A4988C-F91F-4054-9076-220AC5EC03F3}" fullword
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or ( all of ($s*) and all of ($z*)))
+		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( all of ( $s* ) and all of ( $z* ) ) )
 }
 rule SIGNATURE_BASE_APT_Artradownloader2_Aug19_1 : FILE
 {
@@ -396808,9 +392980,9 @@ rule SIGNATURE_BASE_APT_Artradownloader2_Aug19_1 : FILE
 		date = "2019-08-27"
 		modified = "2023-12-05"
 		reference = "https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_patchwork.yar#L2-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c365c3d678c881eeb626b5d26e6164b473990387619337459ccdd8d9f0633b49"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_patchwork.yar#L2-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c365c3d678c881eeb626b5d26e6164b473990387619337459ccdd8d9f0633b49"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396836,7 +393008,7 @@ rule SIGNATURE_BASE_APT_Artradownloader2_Aug19_1 : FILE
 		$x2 = ".gpsn.vsmfodpefe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them
 }
 rule SIGNATURE_BASE_Unspecified_Malware_Oct16_A : FILE
 {
@@ -396847,9 +393019,9 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_A : FILE
 		date = "2016-10-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_set_oct16.yar#L10-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d71e6640be1b10790d49c084b9ba248e35a6a56dfe9c5a3f219a209024ebec27"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_set_oct16.yar#L10-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d71e6640be1b10790d49c084b9ba248e35a6a56dfe9c5a3f219a209024ebec27"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -396875,7 +393047,7 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_A : FILE
 		$op2 = { ee 11 74 cf 73 0b 91 c4 c9 57 b2 d9 36 86 a5 b4 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (2 of ($x*) or 3 of ($s*) or all of ($op*))) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 2 of ( $x* ) or 3 of ( $s* ) or all of ( $op* ) ) ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_Sality_Malware_Oct16 : FILE
 {
@@ -396886,9 +393058,9 @@ rule SIGNATURE_BASE_Sality_Malware_Oct16 : FILE
 		date = "2016-10-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_set_oct16.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5bf14bbb0a7298a7bc896029c4b92ef9adf24307e4d05dcf86a518b266d1c2a8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_set_oct16.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5bf14bbb0a7298a7bc896029c4b92ef9adf24307e4d05dcf86a518b266d1c2a8"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -396900,7 +393072,7 @@ rule SIGNATURE_BASE_Sality_Malware_Oct16 : FILE
 		$s2 = "[LordPE]" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Unspecified_Malware_Oct16_C : FILE
 {
@@ -396911,9 +393083,9 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_C : FILE
 		date = "2016-10-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_set_oct16.yar#L65-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1f212ef700e77c82954d997beef1157835da38330b583d02df418e10b6c182ee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_set_oct16.yar#L65-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1f212ef700e77c82954d997beef1157835da38330b583d02df418e10b6c182ee"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -396925,7 +393097,7 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_C : FILE
 		$s2 = "output.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them )
 }
 rule SIGNATURE_BASE_Bladabindi_Malware_B64 : FILE
 {
@@ -396936,9 +393108,9 @@ rule SIGNATURE_BASE_Bladabindi_Malware_B64 : FILE
 		date = "2016-10-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_set_oct16.yar#L91-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "081a6361e29fc231f1467b837c51a39b8cccf8caa20844b22d469ce2bbd0c7fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_set_oct16.yar#L91-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_081a6361e29fc231f1467b837c51a39b8cccf8caa20844b22d469ce2bbd0c7fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396953,7 +393125,7 @@ rule SIGNATURE_BASE_Bladabindi_Malware_B64 : FILE
 		$s5 = "RG93bmxvYWQgRVJST1I=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of them
 }
 rule SIGNATURE_BASE_Dorkbot_Injector_Malware : FILE
 {
@@ -396964,9 +393136,9 @@ rule SIGNATURE_BASE_Dorkbot_Injector_Malware : FILE
 		date = "2016-10-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_set_oct16.yar#L110-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "36138520b0d39dc311b8e9355d1d1c215908a5fe1c01eec76c689f7e74a84303"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_set_oct16.yar#L110-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_36138520b0d39dc311b8e9355d1d1c215908a5fe1c01eec76c689f7e74a84303"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -396983,7 +393155,7 @@ rule SIGNATURE_BASE_Dorkbot_Injector_Malware : FILE
 		$s7 = "real number = %f" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 6 of them )
 }
 rule SIGNATURE_BASE_Unspecified_Malware_Oct16_D : FILE
 {
@@ -396994,9 +393166,9 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_D : FILE
 		date = "2016-10-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_set_oct16.yar#L131-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "78cde422987d2aff64967b86b6cf9279c112a2bfb713a2ea40fe952379d2e326"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_set_oct16.yar#L131-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_78cde422987d2aff64967b86b6cf9279c112a2bfb713a2ea40fe952379d2e326"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397012,7 +393184,7 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_D : FILE
 		$op2 = { 3c 4d 6f 64 75 6c 65 3e 00 6e 65 77 2e 65 78 65 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*) or all of ($op*))
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( all of ( $s* ) or all of ( $op* ) )
 }
 rule SIGNATURE_BASE_Unspecified_Malware_Oct16_E : FILE
 {
@@ -397023,9 +393195,9 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_E : FILE
 		date = "2016-10-08"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malware_set_oct16.yar#L152-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2040a8cee840560a5aa6065df17206c0313d85b2d11ce482baab05c492360f35"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malware_set_oct16.yar#L152-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2040a8cee840560a5aa6065df17206c0313d85b2d11ce482baab05c492360f35"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397038,7 +393210,7 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_E : FILE
 		$s3 = "TMP4351$.TMP" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_Pos_Malware_Malumpos
 {
@@ -397049,9 +393221,9 @@ rule SIGNATURE_BASE_Pos_Malware_Malumpos
 		date = "2015-05-25"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_malumpos.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ece32e51a12adf0d68420c8d98efbe7df27b9061ddfe4dcedf151f9f06287eee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_malumpos.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ece32e51a12adf0d68420c8d98efbe7df27b9061ddfe4dcedf151f9f06287eee"
 		score = 75
 		quality = 85
 		tags = ""
@@ -397065,7 +393237,7 @@ rule SIGNATURE_BASE_Pos_Malware_Malumpos
 		$string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/
 
 	condition:
-		all of ($string*)
+		all of ( $string* )
 }
 rule SIGNATURE_BASE_MAL_Passwordstate_Moserware_Backdoor_Apr21_1 : FILE
 {
@@ -397076,9 +393248,9 @@ rule SIGNATURE_BASE_MAL_Passwordstate_Moserware_Backdoor_Apr21_1 : FILE
 		date = "2021-04-25"
 		modified = "2023-12-05"
 		reference = "https://thehackernews.com/2021/04/passwordstate-password-manager-update.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_passwordstate_backdoor.yar#L1-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "46bf5b7f4f75997535742021d1d5c2129daae0b3836c08383058e5e5b8e27d93"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_passwordstate_backdoor.yar#L1-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_46bf5b7f4f75997535742021d1d5c2129daae0b3836c08383058e5e5b8e27d93"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397095,7 +393267,7 @@ rule SIGNATURE_BASE_MAL_Passwordstate_Moserware_Backdoor_Apr21_1 : FILE
 		$op3 = { 61 00 74 00 65 00 2d 00 31 00 38 00 65 00 64 00 32 00 2e 00 6b 00 78 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*) or 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) or 3 of them
 }
 rule SIGNATURE_BASE_SUSP_ZIP_LNK_Phishattachment_Pattern_Jun22_1 : FILE
 {
@@ -397106,9 +393278,9 @@ rule SIGNATURE_BASE_SUSP_ZIP_LNK_Phishattachment_Pattern_Jun22_1 : FILE
 		date = "2022-06-23"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_phish_attachments.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2ff398379e3d8112991eeacd99bf9d3bafbf3e9266f012d2539d6b2661d5969e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_phish_attachments.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2ff398379e3d8112991eeacd99bf9d3bafbf3e9266f012d2539d6b2661d5969e"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -397122,7 +393294,7 @@ rule SIGNATURE_BASE_SUSP_ZIP_LNK_Phishattachment_Pattern_Jun22_1 : FILE
 		$sl1 = ".lnk"
 
 	condition:
-		uint16(0)==0x4b50 and filesize <2KB and $sl1 in ( filesize -256.. filesize )
+		uint16( 0 ) == 0x4b50 and filesize < 2KB and $sl1 in ( filesize - 256 .. filesize )
 }
 rule SIGNATURE_BASE_SUSP_ZIP_ISO_Phishattachment_Pattern_Jun22_1 : FILE
 {
@@ -397133,9 +393305,9 @@ rule SIGNATURE_BASE_SUSP_ZIP_ISO_Phishattachment_Pattern_Jun22_1 : FILE
 		date = "2022-06-23"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_phish_attachments.yar#L23-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "21de56d6209050b429c0cce82fd334d1b38a2a3727db5ead06f36fa9d503e193"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_phish_attachments.yar#L23-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_21de56d6209050b429c0cce82fd334d1b38a2a3727db5ead06f36fa9d503e193"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -397149,7 +393321,7 @@ rule SIGNATURE_BASE_SUSP_ZIP_ISO_Phishattachment_Pattern_Jun22_1 : FILE
 		$iso_3 = "uaXNvUE"
 
 	condition:
-		filesize <2000KB and 1 of ($pk*) and 1 of ($iso*)
+		filesize < 2000KB and 1 of ( $pk* ) and 1 of ( $iso* )
 }
 rule SIGNATURE_BASE_SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 : FILE
 {
@@ -397160,9 +393332,9 @@ rule SIGNATURE_BASE_SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 : F
 		date = "2022-06-29"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_phish_attachments.yar#L43-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "647044fa3b5cf6f0e9e738fa7b7d24f8918b7a7fb359342e1314d97b50debf87"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_phish_attachments.yar#L43-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_647044fa3b5cf6f0e9e738fa7b7d24f8918b7a7fb359342e1314d97b50debf87"
 		score = 65
 		quality = 60
 		tags = "FILE"
@@ -397256,71 +393428,8 @@ rule SIGNATURE_BASE_SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 : F
 		$sb63 = "udHh0LmV4ZVBL"
 
 	condition:
-		uint16(0)==0x4b50 and 1 of ($sa*) or 1 of ($sb*)
+		uint16( 0 ) == 0x4b50 and 1 of ( $sa* ) or 1 of ( $sb* )
 }
-rule SIGNATURE_BASE_SUSP_Xored_Mozilla_Oct19
-{
-	meta:
-		description = "Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key."
-		author = "Florian Roth"
-		id = "71e5b399-c384-5330-ae52-4e0a806e7969"
-		date = "2019-10-28"
-		modified = "2023-11-03"
-		old_rule_name = "SUSP_XORed_Mozilla"
-		reference = "https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_xor_hunting.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e1b5c7a0adb4dc65cdf0a653255ac865a0ecebbf1ff08b7fc46d510d5e8aa6c9"
-		score = 60
-		quality = 85
-		tags = ""
-
-	strings:
-		$xo1 = "Mozilla/5.0" xor ascii wide
-		$xof1 = "Mozilla/5.0" ascii wide
-		$fpa1 = "Sentinel Labs" wide
-		$fpa2 = "<filter object at" ascii
-		$fpb1 = { 64 65 78 0a 30 33 35 }
-
-	condition:
-		$xo1 and not $xof1 and not 1 of ($fpa*) and not $fpb1 at 0
-}
-rule SIGNATURE_BASE_SUSP_Xored_MSDOS_Stub_Message : FILE
-{
-	meta:
-		description = "Detects suspicious XORed MSDOS stub message"
-		author = "Florian Roth"
-		id = "9ab52434-9162-5fd5-bf34-8b163f6aeec4"
-		date = "2019-10-28"
-		modified = "2023-10-11"
-		reference = "https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_xor_hunting.yar#L26-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b6d7d7242511d2c26122fe2b880cfe39facb5f68ae45e19c1558163f0427c304"
-		score = 55
-		quality = 85
-		tags = "FILE"
-
-	strings:
-		$xo1 = "This program cannot be run in DOS mode" xor(0x01-0xff) ascii wide
-		$xo2 = "This program must be run under Win32" xor(0x01-0xff) ascii wide
-		$fp1 = "AVAST Software" fullword wide ascii
-		$fp2 = "AVG Netherlands" fullword wide ascii
-		$fp3 = "AVG Technologies" ascii wide
-		$fp4 = "Malicious Software Removal Tool" wide
-		$fp5 = "McAfee Labs" fullword ascii wide
-		$fp6 = "Kaspersky Lab" fullword ascii wide
-		$fp7 = "<propertiesmap>" ascii wide
-		$fp10 = "Avira Engine Module" wide
-		$fp11 = "syntevo GmbH" wide fullword
-		$fp13 = "SophosClean" ascii
-		$fp14 = "SophosHomeClean" wide
-
-	condition:
-		1 of ($x*) and not 1 of ($fp*) and not uint16(0)==0xb0b0 and not uint16(0)==0x5953
-}
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Trickbot_Oct19_1 : FILE
 {
 	meta:
@@ -397330,9 +393439,9 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_1 : FILE
 		date = "2019-10-02"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_trickbot.yar#L3-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fef15c0bda6dc2b28f34791da3ca68a03f7368b63ead17e631a2d4f05d1b40e2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_trickbot.yar#L3-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fef15c0bda6dc2b28f34791da3ca68a03f7368b63ead17e631a2d4f05d1b40e2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397348,10 +393457,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_1 : FILE
 		$op2 = { 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 3 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Trickbot_Oct19_2 : FILE
 {
 	meta:
@@ -397361,9 +393468,9 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_2 : FILE
 		date = "2019-10-02"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_trickbot.yar#L24-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "185e59c156218b418bec0c94144b19639c17e3a9595d993e3761eae15379f9fb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_trickbot.yar#L24-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_185e59c156218b418bec0c94144b19639c17e3a9595d993e3761eae15379f9fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397375,7 +393482,7 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_2 : FILE
 		$x2 = "AxedWV3OVTFfnGb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 1 of them
 }
 import "pe"
 
@@ -397388,9 +393495,9 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_3 : FILE
 		date = "2019-10-02"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_trickbot.yar#L40-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "87860212077b63bf3e4835a3a64b934fc7edd3258355a3e94a69acaba39c2516"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_trickbot.yar#L40-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_87860212077b63bf3e4835a3a64b934fc7edd3258355a3e94a69acaba39c2516"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397404,10 +393511,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_3 : FILE
 		$s1 = "Decrypt Shell Fail" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and (1 of them or pe.imphash()=="4e3fbfbf1fc23f646cd40a6fe09385a7")
+		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and ( 1 of them or pe.imphash ( ) == "4e3fbfbf1fc23f646cd40a6fe09385a7" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Trickbot_Oct19_4 : FILE
 {
 	meta:
@@ -397417,9 +393522,9 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_4 : FILE
 		date = "2019-10-02"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_trickbot.yar#L58-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c109510d86260b4173bbbac5fe69936acb109e7fdbe71fbe2955e5ed85f5cd85"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_trickbot.yar#L58-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c109510d86260b4173bbbac5fe69936acb109e7fdbe71fbe2955e5ed85f5cd85"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397436,10 +393541,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_4 : FILE
 		$x5 = "G*\\AC:\\Users\\911\\Desktop\\cButtonBar\\cButtonBar\\ButtonBar.vbp" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Trickbot_Oct19_5 : FILE
 {
 	meta:
@@ -397449,9 +393552,9 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_5 : FILE
 		date = "2019-10-02"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_trickbot.yar#L79-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e304b236dd58faa0e6fdd73bc93c24f6ff0ec6c1f9a54b104f8e87441834e22b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_trickbot.yar#L79-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e304b236dd58faa0e6fdd73bc93c24f6ff0ec6c1f9a54b104f8e87441834e22b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397466,10 +393569,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_5 : FILE
 		$s3 = "InitShellCode" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_Trickbot_Oct19_6 : FILE
 {
 	meta:
@@ -397479,9 +393580,9 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_6 : FILE
 		date = "2019-10-02"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_trickbot.yar#L98-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "599b1f56483f4ea267595b90dd4ef93b7e2147e4a0d8449cdd9d2539a96c3f79"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_trickbot.yar#L98-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_599b1f56483f4ea267595b90dd4ef93b7e2147e4a0d8449cdd9d2539a96c3f79"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397495,7 +393596,7 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_6 : FILE
 		$s3 = "WINDOWS\\SYSTEM32\\TASKS" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=400KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize <= 400KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_Coinminer_Strings : SCRIPT HIGHVOL FILE
 {
@@ -397506,9 +393607,9 @@ rule SIGNATURE_BASE_Coinminer_Strings : SCRIPT HIGHVOL FILE
 		date = "2018-01-04"
 		modified = "2021-10-26"
 		reference = "https://minergate.com/faq/what-pool-address"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pua_cryptocoin_miner.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2d63bf90560c83ab6c09e0c82b6a6449bca6e7e7d0945d3782c2fa9a726b2ca1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pua_cryptocoin_miner.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2d63bf90560c83ab6c09e0c82b6a6449bca6e7e7d0945d3782c2fa9a726b2ca1"
 		score = 60
 		quality = 85
 		tags = "SCRIPT, HIGHVOL, FILE"
@@ -397520,7 +393621,7 @@ rule SIGNATURE_BASE_Coinminer_Strings : SCRIPT HIGHVOL FILE
 		$sb1 = "\"normalHashing\": true,"
 
 	condition:
-		filesize <3000KB and 1 of them
+		filesize < 3000KB and 1 of them
 }
 rule SIGNATURE_BASE_Coinhive_Javascript_Monerominer : HIGHVOL FILE
 {
@@ -397531,9 +393632,9 @@ rule SIGNATURE_BASE_Coinhive_Javascript_Monerominer : HIGHVOL FILE
 		date = "2018-01-04"
 		modified = "2023-12-05"
 		reference = "https://coinhive.com/documentation/miner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pua_cryptocoin_miner.yar#L20-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4146b034a9785f1bb7c60db62db0e478d960f2ac9adb7c5b74b365186578ca47"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pua_cryptocoin_miner.yar#L20-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4146b034a9785f1bb7c60db62db0e478d960f2ac9adb7c5b74b365186578ca47"
 		score = 50
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -397543,7 +393644,7 @@ rule SIGNATURE_BASE_Coinhive_Javascript_Monerominer : HIGHVOL FILE
 		$s2 = "CoinHive.CONFIG.REQUIRES_AUTH" fullword ascii
 
 	condition:
-		filesize <65KB and 1 of them
+		filesize < 65KB and 1 of them
 }
 rule SIGNATURE_BASE_PUA_Cryptominer_Jan19_1 : FILE
 {
@@ -397554,9 +393655,9 @@ rule SIGNATURE_BASE_PUA_Cryptominer_Jan19_1 : FILE
 		date = "2019-01-31"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pua_cryptocoin_miner.yar#L35-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7097d404e0317230a5f60fc66fbcb2a2a5315f8fd348a7e689aaf75c26684f9e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pua_cryptocoin_miner.yar#L35-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7097d404e0317230a5f60fc66fbcb2a2a5315f8fd348a7e689aaf75c26684f9e"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -397570,7 +393671,7 @@ rule SIGNATURE_BASE_PUA_Cryptominer_Jan19_1 : FILE
 		$s5 = "thread %d: %lu hashes, %s khash/s" fullword ascii
 
 	condition:
-		filesize <1000KB and 1 of them
+		filesize < 1000KB and 1 of them
 }
 rule SIGNATURE_BASE_PUA_Crypto_Mining_Commandline_Indicators_Oct21 : SCRIPT FILE
 {
@@ -397581,9 +393682,9 @@ rule SIGNATURE_BASE_PUA_Crypto_Mining_Commandline_Indicators_Oct21 : SCRIPT FILE
 		date = "2021-10-24"
 		modified = "2023-12-05"
 		reference = "https://www.poolwatch.io/coin/monero"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/pua_cryptocoin_miner.yar#L54-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ae1a77d8ff02ec539ce2b8be668530c3f509f0c408dfa7f2b749b0a4d6f45b7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/pua_cryptocoin_miner.yar#L54-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ae1a77d8ff02ec539ce2b8be668530c3f509f0c408dfa7f2b749b0a4d6f45b7"
 		score = 65
 		quality = 85
 		tags = "SCRIPT, FILE"
@@ -397606,7 +393707,7 @@ rule SIGNATURE_BASE_PUA_Crypto_Mining_Commandline_Indicators_Oct21 : SCRIPT FILE
 		$se9 = "zdHJhdHVtK3VkcDovL"
 
 	condition:
-		filesize <5000KB and 1 of them
+		filesize < 5000KB and 1 of them
 }
 rule SIGNATURE_BASE_APT_PS1_Sysaid_EXPL_Forensicartifacts_Nov23_1 : SCRIPT CVE_2023_47246
 {
@@ -397617,9 +393718,9 @@ rule SIGNATURE_BASE_APT_PS1_Sysaid_EXPL_Forensicartifacts_Nov23_1 : SCRIPT CVE_2
 		date = "2023-11-09"
 		modified = "2023-12-05"
 		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_sysaid_cve_2023_47246.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "85efeea88961ca99b22004726d88efc46c748273b9a0b3be674f4cbb12cd3dd1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_sysaid_cve_2023_47246.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_85efeea88961ca99b22004726d88efc46c748273b9a0b3be674f4cbb12cd3dd1"
 		score = 85
 		quality = 85
 		tags = "SCRIPT, CVE-2023-47246"
@@ -397640,9 +393741,9 @@ rule SIGNATURE_BASE_MAL_Loader_Turtleloader_Nov23 : CVE_2023_47246 FILE
 		date = "2023-11-09"
 		modified = "2023-12-05"
 		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_sysaid_cve_2023_47246.yar#L17-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "14a1636ed4dc3c897fefe53946e67339f91da9e2fbed2c99b9b4119dcc2649c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_sysaid_cve_2023_47246.yar#L17-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_14a1636ed4dc3c897fefe53946e67339f91da9e2fbed2c99b9b4119dcc2649c0"
 		score = 85
 		quality = 85
 		tags = "CVE-2023-47246, FILE"
@@ -397657,7 +393758,7 @@ rule SIGNATURE_BASE_MAL_Loader_Turtleloader_Nov23 : CVE_2023_47246 FILE
 		$op3 = { 48 83 c1 04 48 ff ca 89 41 1c 75 ef 03 f6 48 83 c3 20 48 ff cd 0f 85 77 ff ff ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them
 }
 rule SIGNATURE_BASE_MAL_Grace_Dec22
 {
@@ -397668,9 +393769,9 @@ rule SIGNATURE_BASE_MAL_Grace_Dec22
 		date = "2022-12-13"
 		modified = "2023-12-05"
 		reference = "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_sysaid_cve_2023_47246.yar#L40-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8276662dadfa2f8e07dd7882a60e55bd22ecf1f8f66a09940f16236598646560"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_sysaid_cve_2023_47246.yar#L40-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8276662dadfa2f8e07dd7882a60e55bd22ecf1f8f66a09940f16236598646560"
 		score = 70
 		quality = 85
 		tags = ""
@@ -397697,9 +393798,9 @@ rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Ju
 		date = "2023-07-21"
 		modified = "2023-12-05"
 		reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L27-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "48d4225d0935084003f7a98c554d7c4722a91290dfe190001da52bce332b3f7d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L27-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_48d4225d0935084003f7a98c554d7c4722a91290dfe190001da52bce332b3f7d"
 		score = 70
 		quality = 85
 		tags = "CVE-2023-3519, FILE"
@@ -397710,7 +393811,7 @@ rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Ju
 		$s3 = "/test.tar.gz /netscaler/"
 
 	condition:
-		filesize <10MB and 1 of them
+		filesize < 10MB and 1 of them
 }
 rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Jul23_3 : CVE_2023_3519 FILE
 {
@@ -397721,9 +393822,9 @@ rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Ju
 		date = "2023-07-24"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L43-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e78e1a788503b841ed0f4e5cd415eb35d8911092778120d7fd061ed20820da37"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L43-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e78e1a788503b841ed0f4e5cd415eb35d8911092778120d7fd061ed20820da37"
 		score = 70
 		quality = 85
 		tags = "CVE-2023-3519, FILE"
@@ -397738,7 +393839,7 @@ rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Ju
 		$x7 = "(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))"
 
 	condition:
-		filesize <10MB and 1 of them
+		filesize < 10MB and 1 of them
 }
 rule SIGNATURE_BASE_LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_3519_Jul23_1 : CVE_2023_3519
 {
@@ -397749,9 +393850,9 @@ rule SIGNATURE_BASE_LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_
 		date = "2023-07-27"
 		modified = "2023-12-05"
 		reference = "https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L63-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ad3164c5b2616b12a513a2bb3736d530769e75fca03346a72351a27b8343b2a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L63-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ad3164c5b2616b12a513a2bb3736d530769e75fca03346a72351a27b8343b2a"
 		score = 65
 		quality = 85
 		tags = "CVE-2023-3519"
@@ -397772,9 +393873,9 @@ rule SIGNATURE_BASE_WEBSHELL_SECRETSAUCE_Jul23_1 : CVE_2023_3519 FILE
 		date = "2023-07-24"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L79-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c762d46ae43a3e10453c2ee17039812a06086ac85bdb000cf8308f5196a9dee2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L79-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c762d46ae43a3e10453c2ee17039812a06086ac85bdb000cf8308f5196a9dee2"
 		score = 85
 		quality = 85
 		tags = "CVE-2023-3519, FILE"
@@ -397788,7 +393889,7 @@ rule SIGNATURE_BASE_WEBSHELL_SECRETSAUCE_Jul23_1 : CVE_2023_3519 FILE
 		$sb3 = "$z->run($z->get('openssl_public_decrypt'));"
 
 	condition:
-		filesize <100KB and ( all of ($sa*) or 2 of ($sb*))
+		filesize < 100KB and ( all of ( $sa* ) or 2 of ( $sb* ) )
 }
 rule SIGNATURE_BASE_Ghostdragon_Gh0Strat : FILE
 {
@@ -397799,9 +393900,9 @@ rule SIGNATURE_BASE_Ghostdragon_Gh0Strat : FILE
 		date = "2016-04-23"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/the-ghost-dragon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ghostdragon_gh0st_rat.yar#L8-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b67c7ff76c14e771c4e952a408c2c006c9ae88fda97b775747a95322aff355e7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ghostdragon_gh0st_rat.yar#L8-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b67c7ff76c14e771c4e952a408c2c006c9ae88fda97b775747a95322aff355e7"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -397837,7 +393938,7 @@ rule SIGNATURE_BASE_Ghostdragon_Gh0Strat : FILE
 		$s14 = "Global\\_vc_ck_ %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 4 of ($s*))) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample2 : FILE
 {
@@ -397848,9 +393949,9 @@ rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample2 : FILE
 		date = "2016-04-23"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/the-ghost-dragon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ghostdragon_gh0st_rat.yar#L54-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f41776a033be766844c9867902d2ef9b79bf59bdf212f0158eccf79db0810460"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ghostdragon_gh0st_rat.yar#L54-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f41776a033be766844c9867902d2ef9b79bf59bdf212f0158eccf79db0810460"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397864,7 +393965,7 @@ rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample2 : FILE
 		$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and ( all of ($x*) or all of ($c*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and ( all of ( $x* ) or all of ( $c* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample3
 {
@@ -397875,9 +393976,9 @@ rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample3
 		date = "2016-04-23"
 		modified = "2023-12-05"
 		reference = "https://blog.cylance.com/the-ghost-dragon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ghostdragon_gh0st_rat.yar#L77-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "39ddb94ac14032f88e54e413ed650277e95f6dcf66219fcf43a01aff1f10a058"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ghostdragon_gh0st_rat.yar#L77-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_39ddb94ac14032f88e54e413ed650277e95f6dcf66219fcf43a01aff1f10a058"
 		score = 75
 		quality = 85
 		tags = ""
@@ -397901,9 +394002,9 @@ rule SIGNATURE_BASE_Buckeye_Osinfo : FILE
 		date = "2016-09-05"
 		modified = "2023-12-05"
 		reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_buckeye.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "782ae4293db0839190a9533d2c45baff92527867bfcd048ccae82611f165601b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_buckeye.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_782ae4293db0839190a9533d2c45baff92527867bfcd048ccae82611f165601b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397919,7 +394020,7 @@ rule SIGNATURE_BASE_Buckeye_Osinfo : FILE
 		$s7 = "-n NetuseInfo" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and 3 of ( $s* )
 }
 rule SIGNATURE_BASE_Remotecmd : FILE
 {
@@ -397930,9 +394031,9 @@ rule SIGNATURE_BASE_Remotecmd : FILE
 		date = "2016-09-08"
 		modified = "2022-12-21"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_buckeye.yar#L30-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "873cc02674e386577e86cb9b702265c25dd24b1f203741e8628e30c191dc99e0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_buckeye.yar#L30-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_873cc02674e386577e86cb9b702265c25dd24b1f203741e8628e30c191dc99e0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397948,7 +394049,7 @@ rule SIGNATURE_BASE_Remotecmd : FILE
 		$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and 2 of them ) or (4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them )
 }
 rule SIGNATURE_BASE_Chromepass : FILE
 {
@@ -397959,9 +394060,9 @@ rule SIGNATURE_BASE_Chromepass : FILE
 		date = "2016-09-08"
 		modified = "2022-12-21"
 		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_buckeye.yar#L51-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "277b7cee2bf70b5141b6ee8a566f1d9bc5dc4555fc14c929d5255151ddca77dd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_buckeye.yar#L51-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_277b7cee2bf70b5141b6ee8a566f1d9bc5dc4555fc14c929d5255151ddca77dd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -397982,7 +394083,7 @@ rule SIGNATURE_BASE_Chromepass : FILE
 		$s8 = "Chrome Password Recovery" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 1 of ($x*)) or (5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of ( $x* ) ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_EXPL_Exploit_TLB_Scripts : FILE
 {
@@ -397993,9 +394094,9 @@ rule SIGNATURE_BASE_EXPL_Exploit_TLB_Scripts : FILE
 		date = "2021-01-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_tlb_scripts.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "39bf626d60a867d054762043f74e86998d6848439655f84be72003c112db9953"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_tlb_scripts.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_39bf626d60a867d054762043f74e86998d6848439655f84be72003c112db9953"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398008,7 +394109,7 @@ rule SIGNATURE_BASE_EXPL_Exploit_TLB_Scripts : FILE
 		$e = "winmgmts:" ascii nocase
 
 	condition:
-		uint32be(0)==0x4D534654 and filesize <100KB and any of them
+		uint32be( 0 ) == 0x4D534654 and filesize < 100KB and any of them
 }
 rule SIGNATURE_BASE_EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 : CVE_2024_21413 FILE
 {
@@ -398019,9 +394120,9 @@ rule SIGNATURE_BASE_EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 : CVE_2024_2
 		date = "2024-02-17"
 		modified = "2024-02-19"
 		reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_outlook_cve_2024_21413.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "06cfafe0b92949e493dca6d54f671d0607242d97341144b69f563a0cc24dc6a1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_outlook_cve_2024_21413.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_06cfafe0b92949e493dca6d54f671d0607242d97341144b69f563a0cc24dc6a1"
 		score = 75
 		quality = 85
 		tags = "CVE-2024-21413, FILE"
@@ -398032,7 +394133,7 @@ rule SIGNATURE_BASE_EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 : CVE_2024_2
 		$xr1 = /file:\/\/\/\\\\[^"']{6,600}\.(docx|txt|pdf|xlsx|pptx|odt|etc|jpg|png|gif|bmp|tiff|svg|mp4|avi|mov|wmv|flv|mkv|mp3|wav|aac|flac|ogg|wma|exe|msi|bat|cmd|ps1|zip|rar|7z|targz|iso|dll|sys|ini|cfg|reg|html|css|java|py|c|cpp|db|sql|mdb|accdb|sqlite|eml|pst|ost|mbox|htm|php|asp|jsp|xml|ttf|otf|woff|woff2|rtf|chm|hta|js|lnk|vbe|vbs|wsf|xls|xlsm|xltm|xlt|doc|docm|dot|dotm)!/
 
 	condition:
-		filesize <1000KB and all of ($a*) and 1 of ($xr*)
+		filesize < 1000KB and all of ( $a* ) and 1 of ( $xr* )
 }
 rule SIGNATURE_BASE_SUSP_Bad_PDF : FILE
 {
@@ -398043,9 +394144,9 @@ rule SIGNATURE_BASE_SUSP_Bad_PDF : FILE
 		date = "2018-05-03"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_bad_pdf.yar#L1-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "59b159aaccf5c3b64fee17831c1e3a1ca99b60dbb725ad25a4ddad47cdc442d7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_bad_pdf.yar#L1-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_59b159aaccf5c3b64fee17831c1e3a1ca99b60dbb725ad25a4ddad47cdc442d7"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -398057,7 +394158,7 @@ rule SIGNATURE_BASE_SUSP_Bad_PDF : FILE
 		$s3 = "<</F (\\\\" ascii
 
 	condition:
-		( uint32(0)==0x46445025 or uint32(0)==0x4450250a) and 1 of them
+		( uint32( 0 ) == 0x46445025 or uint32( 0 ) == 0x4450250a ) and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_1 : FILE
 {
@@ -398066,11 +394167,11 @@ rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_1 : FILE
 		author = "Florian Roth"
 		id = "801e7efc-2c31-5590-afcd-9e11072c9c65"
 		date = "2024-07-12"
-		modified = "2024-07-12"
+		modified = "2024-12-12"
 		reference = "https://x.com/0xToxin/status/1811656147943752045"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/susp_bat_obfusc_jul24.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "683f4651eb8c5b74eca16e7f97c5c44f0d70f045ea49f1f3726cb6975aba2ab9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/susp_bat_obfusc_jul24.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_683f4651eb8c5b74eca16e7f97c5c44f0d70f045ea49f1f3726cb6975aba2ab9"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -398079,7 +394180,7 @@ rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_1 : FILE
 		$s1 = "&&set "
 
 	condition:
-		filesize <300KB and uint32(0)==0x20746573 and $s1 in (0..32)
+		filesize < 300KB and uint32( 0 ) == 0x20746573 and $s1 in ( 0 .. 32 )
 }
 rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_2 : FILE
 {
@@ -398088,11 +394189,11 @@ rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_2 : FILE
 		author = "Florian Roth"
 		id = "999cd365-2862-5618-b0b6-ee45dea1e9cf"
 		date = "2024-07-12"
-		modified = "2024-07-12"
+		modified = "2024-12-12"
 		reference = "https://x.com/0xToxin/status/1811656147943752045"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/susp_bat_obfusc_jul24.yar#L17-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "729ec93d180bf39c146c3fd847655340428abc3231b556ca51d3ca68825e7c3e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/susp_bat_obfusc_jul24.yar#L18-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_729ec93d180bf39c146c3fd847655340428abc3231b556ca51d3ca68825e7c3e"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -398101,7 +394202,7 @@ rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_2 : FILE
 		$s1 = "&&set "
 
 	condition:
-		filesize <300KB and #s1>30 and uint16( filesize -2)==0x0a0d and uint8( filesize -3)==0x25
+		filesize < 300KB and #s1 > 30 and uint16( filesize - 2 ) == 0x0a0d and uint8( filesize - 3 ) == 0x25
 }
 rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_3 : FILE
 {
@@ -398110,11 +394211,11 @@ rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_3 : FILE
 		author = "Florian Roth"
 		id = "a484ed03-8588-55e7-9674-b1208e14eb3f"
 		date = "2024-07-12"
-		modified = "2024-07-12"
+		modified = "2024-12-12"
 		reference = "https://x.com/0xToxin/status/1811656147943752045"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/susp_bat_obfusc_jul24.yar#L35-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ecbe7850349f0368620ff4294e5d0ca277983799eed510f8bf8abe4d4c192197"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/susp_bat_obfusc_jul24.yar#L37-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ecbe7850349f0368620ff4294e5d0ca277983799eed510f8bf8abe4d4c192197"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -398124,7 +394225,7 @@ rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_3 : FILE
 		$s2 = { 3D ?? 26 26 73 65 74 20 }
 
 	condition:
-		filesize <300KB and all of them
+		filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_VULN_Dell_BIOS_Update_Driver_Dbutil_May21 : CVE_2021_21551 FILE
 {
@@ -398135,9 +394236,9 @@ rule SIGNATURE_BASE_VULN_Dell_BIOS_Update_Driver_Dbutil_May21 : CVE_2021_21551 F
 		date = "2021-05-05"
 		modified = "2023-12-05"
 		reference = "https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_dell_bios_upd_driver.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9cefb9fe28e818a3b0bc1c9ac570ddf2fac7ebf23408963656b7ec86d5bf3224"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_dell_bios_upd_driver.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9cefb9fe28e818a3b0bc1c9ac570ddf2fac7ebf23408963656b7ec86d5bf3224"
 		score = 60
 		quality = 85
 		tags = "CVE-2021-21551, FILE"
@@ -398150,7 +394251,7 @@ rule SIGNATURE_BASE_VULN_Dell_BIOS_Update_Driver_Dbutil_May21 : CVE_2021_21551 F
 		$s3 = "[ Dell BIOS Utility Driver - " ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
 }
 rule SIGNATURE_BASE_Sofacy_Jun16_Sample1 : FILE
 {
@@ -398161,9 +394262,9 @@ rule SIGNATURE_BASE_Sofacy_Jun16_Sample1 : FILE
 		date = "2016-06-14"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/mzAa97"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_jun16.yar#L10-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "761cec3d04e6b5273cfb450000023ed10ea73d17648c0af7660f4ef2b37fc31c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_jun16.yar#L10-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_761cec3d04e6b5273cfb450000023ed10ea73d17648c0af7660f4ef2b37fc31c"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -398175,7 +394276,7 @@ rule SIGNATURE_BASE_Sofacy_Jun16_Sample1 : FILE
 		$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $s* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Sofacy_Jun16_Sample2 : FILE
 {
@@ -398186,9 +394287,9 @@ rule SIGNATURE_BASE_Sofacy_Jun16_Sample2 : FILE
 		date = "2016-06-14"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/mzAa97"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_jun16.yar#L27-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a1f334996527556334c34d0308da6165e9d2a3d7eb8b2ecc322b574dea4d4844"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_jun16.yar#L27-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a1f334996527556334c34d0308da6165e9d2a3d7eb8b2ecc322b574dea4d4844"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -398206,7 +394307,7 @@ rule SIGNATURE_BASE_Sofacy_Jun16_Sample2 : FILE
 		$s4 = "clconfig.dll" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and ( all of ($x*))) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( all of ( $x* ) ) ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_Sofacy_Jun16_Sample3 : FILE
 {
@@ -398217,9 +394318,9 @@ rule SIGNATURE_BASE_Sofacy_Jun16_Sample3 : FILE
 		date = "2016-06-14"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/mzAa97"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_jun16.yar#L51-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bdc6fcc30ebd7a966391747e4156a6d94dc9187e8b8898de4c441540ec4e637e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_jun16.yar#L51-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bdc6fcc30ebd7a966391747e4156a6d94dc9187e8b8898de4c441540ec4e637e"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -398230,7 +394331,7 @@ rule SIGNATURE_BASE_Sofacy_Jun16_Sample3 : FILE
 		$s1 = "ASLIiasiuqpssuqkl713h" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and $s1
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and $s1
 }
 rule SIGNATURE_BASE_Hawkeye_Keylogger_Feb18_1 : FILE
 {
@@ -398241,9 +394342,9 @@ rule SIGNATURE_BASE_Hawkeye_Keylogger_Feb18_1 : FILE
 		date = "2018-02-12"
 		modified = "2023-01-06"
 		reference = "https://app.any.run/tasks/ae2521dd-61aa-4bc7-b0d8-8c85ddcbfcc9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_hawkeye.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "39037ccb90b747c098fbf5a504aee4a6a716901ff5841ae328ea40d06cc3fcfd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_hawkeye.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_39037ccb90b747c098fbf5a504aee4a6a716901ff5841ae328ea40d06cc3fcfd"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -398255,7 +394356,7 @@ rule SIGNATURE_BASE_Hawkeye_Keylogger_Feb18_1 : FILE
 		$s3 = "%appdata%\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE_MAL_Hawkeye_Keylogger_Gen_Dec18
 {
@@ -398266,9 +394367,9 @@ rule SIGNATURE_BASE_MAL_Hawkeye_Keylogger_Gen_Dec18
 		date = "2018-12-10"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/James_inthe_box/status/1072116224652324870"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_hawkeye.yar#L20-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b850f02849030d9912b7571e33e969427ac8f721d2f288ae3ac3e971c4ee4263"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_hawkeye.yar#L20-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b850f02849030d9912b7571e33e969427ac8f721d2f288ae3ac3e971c4ee4263"
 		score = 75
 		quality = 85
 		tags = ""
@@ -398293,9 +394394,9 @@ rule SIGNATURE_BASE_Keyboys_Malware_1 : FILE
 		date = "2017-11-02"
 		modified = "2023-12-05"
 		reference = "http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_keyboys.yar#L13-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "78fb48c4b3e09f0d55ca6049601ea62dd526167481725b48de6624bb27fb943b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_keyboys.yar#L13-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_78fb48c4b3e09f0d55ca6049601ea62dd526167481725b48de6624bb27fb943b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398322,10 +394423,8 @@ rule SIGNATURE_BASE_Keyboys_Malware_1 : FILE
 		$s9 = "%s\\cmd.exe /c \"%s\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="68f7eced34c46808756db4b0c45fb589" or (pe.exports("Insys") and pe.exports("Inuser") and pe.exports("SSSS")) or 1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "68f7eced34c46808756db4b0c45fb589" or ( pe.exports ( "Insys" ) and pe.exports ( "Inuser" ) and pe.exports ( "SSSS" ) ) or 1 of ( $x* ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Keyboy_Installclient : FILE
 {
 	meta:
@@ -398335,9 +394434,9 @@ rule SIGNATURE_BASE_Keyboy_Installclient : FILE
 		date = "2018-03-26"
 		modified = "2023-12-05"
 		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_keyboys.yar#L52-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "701b87785562dc391191b1e59573c6027b27c4fffe1c9155a82114521c85bc59"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_keyboys.yar#L52-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_701b87785562dc391191b1e59573c6027b27c4fffe1c9155a82114521c85bc59"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398355,10 +394454,8 @@ rule SIGNATURE_BASE_Keyboy_Installclient : FILE
 		$s4 = "rundll32.exe %s Main" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or 2 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of ( $x* ) or 2 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Keyboy_Wab32Res : FILE
 {
 	meta:
@@ -398368,9 +394465,9 @@ rule SIGNATURE_BASE_Keyboy_Wab32Res : FILE
 		date = "2018-03-26"
 		modified = "2023-12-05"
 		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_keyboys.yar#L75-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e23bfeed0587ac69527234dd3f8b4f8c5628128ab667af7b99c4d75ca99459b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_keyboys.yar#L75-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e23bfeed0587ac69527234dd3f8b4f8c5628128ab667af7b99c4d75ca99459b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398388,7 +394485,7 @@ rule SIGNATURE_BASE_Keyboy_Wab32Res : FILE
 		$s4 = "FindResource %s error " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 4 of them )
 }
 import "pe"
 
@@ -398401,9 +394498,9 @@ rule SIGNATURE_BASE_Keyboy_Rasauto : FILE
 		date = "2018-03-26"
 		modified = "2023-12-05"
 		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_keyboys.yar#L98-L126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "87529000522d5fad4346a0228c96d3adf122587d91b0cff083948787e53cc024"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_keyboys.yar#L98-L126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_87529000522d5fad4346a0228c96d3adf122587d91b0cff083948787e53cc024"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398424,10 +394521,8 @@ rule SIGNATURE_BASE_Keyboy_Rasauto : FILE
 		$s0 = "ReleaseFileFromRes:%s ok!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.exports("SSSS") or 1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.exports ( "SSSS" ) or 1 of ( $x* ) or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Keyboy_876_0X4E20000 : FILE
 {
 	meta:
@@ -398437,9 +394532,9 @@ rule SIGNATURE_BASE_Keyboy_876_0X4E20000 : FILE
 		date = "2018-03-26"
 		modified = "2023-12-05"
 		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_keyboys.yar#L128-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "092bb19cd7a4250560ea71a3e54780a8fd34a229caa294e4cd5b6d522850d519"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_keyboys.yar#L128-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_092bb19cd7a4250560ea71a3e54780a8fd34a229caa294e4cd5b6d522850d519"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398460,10 +394555,8 @@ rule SIGNATURE_BASE_Keyboy_876_0X4E20000 : FILE
 		$s6 = "LogonUser: [%s]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Mimikatz_Memory_Rule_1 : APT
 {
 	meta:
@@ -398473,9 +394566,9 @@ rule SIGNATURE_BASE_Mimikatz_Memory_Rule_1 : APT
 		date = "2014-12-22"
 		modified = "2023-07-04"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L5-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "22064af570b8e0a93ca0d45484848eda3fbecfd27c88247ef0897fe53be4b7fc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L5-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_22064af570b8e0a93ca0d45484848eda3fbecfd27c88247ef0897fe53be4b7fc"
 		score = 70
 		quality = 85
 		tags = "APT"
@@ -398492,10 +394585,8 @@ rule SIGNATURE_BASE_Mimikatz_Memory_Rule_1 : APT
 		$fp4 = "\"url\":\"https://attack.mitre.org/" ascii
 
 	condition:
-		1 of ($s*) and not 1 of ($fp*)
+		1 of ( $s* ) and not 1 of ( $fp* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Mimikatz : FILE
 {
 	meta:
@@ -398505,9 +394596,9 @@ rule SIGNATURE_BASE_Mimikatz : FILE
 		date = "2022-11-16"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L48-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf972a2c0465c3bbdde6f03d91c6f479d0f66c6d3e9512355de5a973164b56a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L48-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf972a2c0465c3bbdde6f03d91c6f479d0f66c6d3e9512355de5a973164b56a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398522,10 +394613,8 @@ rule SIGNATURE_BASE_Mimikatz : FILE
 		$sys_x64 = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
 
 	condition:
-		( all of ($exe_x86_*)) or ( all of ($exe_x64_*)) or ( any of ($sys_*))
+		( all of ( $exe_x86_* ) ) or ( all of ( $exe_x64_* ) ) or ( any of ( $sys_* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wce
 {
 	meta:
@@ -398535,9 +394624,9 @@ rule SIGNATURE_BASE_Wce
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L76-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a16db99dcaaf1b6c33a738aab4f4d3812366258bc2f6dd32250ee1b1a0616f1c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L76-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a16db99dcaaf1b6c33a738aab4f4d3812366258bc2f6dd32250ee1b1a0616f1c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -398551,8 +394640,6 @@ rule SIGNATURE_BASE_Wce
 	condition:
 		any of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Power_Pe_Injection
 {
 	meta:
@@ -398562,9 +394649,9 @@ rule SIGNATURE_BASE_Power_Pe_Injection
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L91-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "64a7033d51e8933912f37ce68bffc216073a88cae1ea7492e71a812411ae6a9d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L91-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_64a7033d51e8933912f37ce68bffc216073a88cae1ea7492e71a812411ae6a9d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -398575,8 +394662,6 @@ rule SIGNATURE_BASE_Power_Pe_Injection
 	condition:
 		$str_loadlib
 }
-import "pe"
-
 rule SIGNATURE_BASE_Mimikatz_Logfile
 {
 	meta:
@@ -398586,9 +394671,9 @@ rule SIGNATURE_BASE_Mimikatz_Logfile
 		date = "2015-03-31"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L103-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4591cda5bd5a555292087da26193accc4f00d7c0611be8d5ab6dd4dabb14a0ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L103-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4591cda5bd5a555292087da26193accc4f00d7c0611be8d5ab6dd4dabb14a0ef"
 		score = 80
 		quality = 85
 		tags = ""
@@ -398614,9 +394699,9 @@ rule SIGNATURE_BASE_Mimikatz_Strings : FILE
 		date = "2016-06-08"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L121-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "baba1e159c0fb23f68b80459291a2d2c52e84f742f51ca30b894f7fc6282ad7a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L121-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_baba1e159c0fb23f68b80459291a2d2c52e84f742f51ca30b894f7fc6282ad7a"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -398641,10 +394726,8 @@ rule SIGNATURE_BASE_Mimikatz_Strings : FILE
 		$x16 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " fullword wide
 
 	condition:
-		(( uint16(0)==0x5a4d and 1 of ($x*)) or (3 of them )) and not pe.imphash()=="77eaeca738dd89410a432c6bd6459907"
+		(( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) ) or ( 3 of them ) ) and not pe.imphash ( ) == "77eaeca738dd89410a432c6bd6459907"
 }
-import "pe"
-
 rule SIGNATURE_BASE_Appinithook : FILE
 {
 	meta:
@@ -398654,10 +394737,10 @@ rule SIGNATURE_BASE_Appinithook : FILE
 		date = "2015-07-15"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/Z292v6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L156-L176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L156-L176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
-		logic_hash = "a4de3a062e309715c339a45a16a7ff8f9a55851cb41097a6925fd11f649547d2"
+		logic_hash = "v1_sha256_a4de3a062e309715c339a45a16a7ff8f9a55851cb41097a6925fd11f649547d2"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -398673,10 +394756,8 @@ rule SIGNATURE_BASE_Appinithook : FILE
 		$s6 = "VoidFunc" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and 4 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Mimikatz_Skeletonkey_In_Memory_Aug20_1
 {
 	meta:
@@ -398686,9 +394767,9 @@ rule SIGNATURE_BASE_HKTL_Mimikatz_Skeletonkey_In_Memory_Aug20_1
 		date = "2020-08-09"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/sbousseaden/status/1292143504131600384?s=12"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L178-L190"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0cc9a4d3b63e07a695df342bd2c96a55570502d6fd0ab9a1b61d63e28e1c3e05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L178-L190"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0cc9a4d3b63e07a695df342bd2c96a55570502d6fd0ab9a1b61d63e28e1c3e05"
 		score = 75
 		quality = 85
 		tags = ""
@@ -398700,8 +394781,6 @@ rule SIGNATURE_BASE_HKTL_Mimikatz_Skeletonkey_In_Memory_Aug20_1
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Mimikatz_Memssp_Hookfn
 {
 	meta:
@@ -398711,9 +394790,9 @@ rule SIGNATURE_BASE_HKTL_Mimikatz_Memssp_Hookfn
 		date = "2020-08-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/sbousseaden/YaraHunts/blob/master/mimikatz_memssp_hookfn.yara"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L192-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "27cf87f801111f17af76ab4c4f8329b73165f24f755d33edbb22d845bba6d3ff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L192-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_27cf87f801111f17af76ab4c4f8329b73165f24f755d33edbb22d845bba6d3ff"
 		score = 70
 		quality = 85
 		tags = ""
@@ -398735,8 +394814,6 @@ rule SIGNATURE_BASE_HKTL_Mimikatz_Memssp_Hookfn
 	condition:
 		$xc1
 }
-import "pe"
-
 rule SIGNATURE_BASE_HKTL_Mimikatz_Icon : FILE
 {
 	meta:
@@ -398746,9 +394823,9 @@ rule SIGNATURE_BASE_HKTL_Mimikatz_Icon : FILE
 		date = "2023-02-18"
 		modified = "2023-12-05"
 		reference = "https://blog.gentilkiwi.com/mimikatz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimikatz.yar#L218-L238"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a07d477d1645e6df4f0706e44df11ea006c89e4d3218ed18a8a97b60853ff4ff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimikatz.yar#L218-L238"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a07d477d1645e6df4f0706e44df11ea006c89e4d3218ed18a8a97b60853ff4ff"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -398763,7 +394840,7 @@ rule SIGNATURE_BASE_HKTL_Mimikatz_Icon : FILE
 		$ico = {79 e1 d7 ff 7e e5 db ff 7f e8 dc ff 85 eb dd ff ba ff f1 ff 66 a0 b6 ff 01 38 61 ff 22 50 75 c3}
 
 	condition:
-		uint16(0)==0x5A4D and $ico and filesize <10MB
+		uint16( 0 ) == 0x5A4D and $ico and filesize < 10MB
 }
 import "pe"
 
@@ -398776,9 +394853,9 @@ rule SIGNATURE_BASE_Pupy_Backdoor : FILE
 		date = "2017-08-11"
 		modified = "2023-12-05"
 		reference = "https://github.com/n1nj4sec/pupy-binaries"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_pupy_rat.yar#L13-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0b12376c9cddc71f584314b07fb29fac189349b526c6d5028f475fa3984401ae"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_pupy_rat.yar#L13-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0b12376c9cddc71f584314b07fb29fac189349b526c6d5028f475fa3984401ae"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398804,10 +394881,8 @@ rule SIGNATURE_BASE_Pupy_Backdoor : FILE
 		$x10 = "linux_inject_main" fullword ascii
 
 	condition:
-		(( uint16(0)==0x457f or uint16(0)==0x5a4d) and filesize <7000KB and 1 of them ) or 3 of them or ( uint16(0)==0x5a4d and pe.imphash()=="84a69bce2ff6d9f866b7ae63bd70b163")
+		(( uint16( 0 ) == 0x457f or uint16( 0 ) == 0x5a4d ) and filesize < 7000KB and 1 of them ) or 3 of them or ( uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "84a69bce2ff6d9f866b7ae63bd70b163" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Lazarus_Aug18_Downloader_1 : FILE
 {
 	meta:
@@ -398817,9 +394892,9 @@ rule SIGNATURE_BASE_APT_Lazarus_Aug18_Downloader_1 : FILE
 		date = "2018-08-24"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/operation-applejeus/87553/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_applejeus.yar#L13-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f6bdaa8aa76da3e679094ae9759a67b5db33d0445f7204ff13e400fa6db60386"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_applejeus.yar#L13-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f6bdaa8aa76da3e679094ae9759a67b5db33d0445f7204ff13e400fa6db60386"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398838,7 +394913,7 @@ rule SIGNATURE_BASE_APT_Lazarus_Aug18_Downloader_1 : FILE
 		$s2 = "Error protecting memory page" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ((1 of ($x*) or 2 of them ))
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( ( 1 of ( $x* ) or 2 of them ) )
 }
 import "pe"
 
@@ -398851,9 +394926,9 @@ rule SIGNATURE_BASE_APT_Lazarus_Aug18_1 : FILE
 		date = "2018-08-24"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/operation-applejeus/87553/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_applejeus.yar#L39-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "efd43e2d84ba964e7fc7e6c03eaba3dd5181c9cbe51b4a06a7a723dca95fab17"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_applejeus.yar#L39-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_efd43e2d84ba964e7fc7e6c03eaba3dd5181c9cbe51b4a06a7a723dca95fab17"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398869,10 +394944,8 @@ rule SIGNATURE_BASE_APT_Lazarus_Aug18_1 : FILE
 		$s5 = "ping 127.0.0.1 -n 3" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="3af996e4f960108533e69b9033503f40" or 4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "3af996e4f960108533e69b9033503f40" or 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Lazarus_Aug18_2 : FILE
 {
 	meta:
@@ -398882,9 +394955,9 @@ rule SIGNATURE_BASE_APT_Lazarus_Aug18_2 : FILE
 		date = "2018-08-24"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/operation-applejeus/87553/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_applejeus.yar#L62-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "75d52ad829383392d9eb20a8308278d073d16f7624e60010356534bdc6acc81f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_applejeus.yar#L62-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_75d52ad829383392d9eb20a8308278d073d16f7624e60010356534bdc6acc81f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398900,10 +394973,8 @@ rule SIGNATURE_BASE_APT_Lazarus_Aug18_2 : FILE
 		$s5 = "ping 127.0.0.1 -n 3" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (4 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 4 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Fallchill_RC4_Keys : FILE
 {
 	meta:
@@ -398913,9 +394984,9 @@ rule SIGNATURE_BASE_APT_Fallchill_RC4_Keys : FILE
 		date = "2018-08-21"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/operation-applejeus/87553/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lazarus_applejeus.yar#L84-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "59861618dba256996d7bbcd94a6efccdb64589fc75086bfe7d980fa51761ef97"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lazarus_applejeus.yar#L84-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_59861618dba256996d7bbcd94a6efccdb64589fc75086bfe7d980fa51761ef97"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -398928,7 +394999,7 @@ rule SIGNATURE_BASE_APT_Fallchill_RC4_Keys : FILE
                 c7 ?? ?? ea e3 82 2b }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule SIGNATURE_BASE_OPCLEAVER_Backdoorlogger
 {
@@ -398939,9 +395010,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Backdoorlogger
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L3-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c7716b21e85d7e9fb1e1503071c6cd7dc2f4713051e0b03013e3d123a0d800a6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L3-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c7716b21e85d7e9fb1e1503071c6cd7dc2f4713051e0b03013e3d123a0d800a6"
 		score = 70
 		quality = 85
 		tags = ""
@@ -398962,9 +395033,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Jasus
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L19-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d6cd7f0f264a0bfdc6af422baa1a0e257cb8f4c39a2cb27a1edaf70201e8564"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L19-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d6cd7f0f264a0bfdc6af422baa1a0e257cb8f4c39a2cb27a1edaf70201e8564"
 		score = 70
 		quality = 85
 		tags = ""
@@ -398986,9 +395057,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Loggermodule
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L36-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dd937bc3fc7054874a3c61bbef859dd8a8ec37872a30be6d3e1776957f98db80"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L36-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dd937bc3fc7054874a3c61bbef859dd8a8ec37872a30be6d3e1776957f98db80"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399009,9 +395080,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Netc
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L52-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7da739c33da91f07e9e35ceab88a37477372998b4cf4b692b8d26cd1a4d936de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L52-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7da739c33da91f07e9e35ceab88a37477372998b4cf4b692b8d26cd1a4d936de"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399032,9 +395103,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Shellcreator2
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L68-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5422cf4e4809c1183c3c9870d9a5ddcf806082d8cae81a014255f5f18576101d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L68-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5422cf4e4809c1183c3c9870d9a5ddcf806082d8cae81a014255f5f18576101d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399055,9 +395126,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Smartcopy2
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L84-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b83588fa80558cd387511d38e9d1c51c488216b9cd27e848d8bdc59cd8ce348"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L84-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b83588fa80558cd387511d38e9d1c51c488216b9cd27e848d8bdc59cd8ce348"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399078,9 +395149,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Synflooder
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L100-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b5349931c4eb5733f9bf05e7cfac6a434063a01d802665f70384cb29d9ae2a3d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L100-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b5349931c4eb5733f9bf05e7cfac6a434063a01d802665f70384cb29d9ae2a3d"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399102,9 +395173,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Tinyzbot
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L117-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fdc41fbec71602e13105a03a4f44319a139018bda00e87e8f4d9b5e2f6269c14"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L117-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fdc41fbec71602e13105a03a4f44319a139018bda00e87e8f4d9b5e2f6269c14"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399121,7 +395192,7 @@ rule SIGNATURE_BASE_OPCLEAVER_Tinyzbot
 		$s9 = "Zhoupin_Cleaver"
 
 	condition:
-		(($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)
+		(( $s1 and $s2 ) or ( $s3 and $s4 and $s5 ) or ( $s6 and $s7 and $s8 ) or $s9 )
 }
 rule SIGNATURE_BASE_OPCLEAVER_Zhoupinexploitcrew
 {
@@ -399132,9 +395203,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Zhoupinexploitcrew
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L140-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1541f1ebc026d3eaf9b62150085415d12523ee1395fb8cf7ade8608a1b0a11b6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L140-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1541f1ebc026d3eaf9b62150085415d12523ee1395fb8cf7ade8608a1b0a11b6"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399155,9 +395226,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Antivirusdetector
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L156-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9a8c2bbd27efab4c5579ea143abbd2f71c477dfd0ddbfb1741359e4d34140d9b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L156-L171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9a8c2bbd27efab4c5579ea143abbd2f71c477dfd0ddbfb1741359e4d34140d9b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399179,9 +395250,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Csext
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L173-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b4d070b71b685608ab84e757d01293749f2c017a6cd5b6ade6591264adc9836b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L173-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b4d070b71b685608ab84e757d01293749f2c017a6cd5b6ade6591264adc9836b"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399203,9 +395274,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Kagent
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L190-L204"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bd72ade7d40db830dc980def5107261f9cb41b713f9a0a1b2f41f7658b31653e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L190-L204"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bd72ade7d40db830dc980def5107261f9cb41b713f9a0a1b2f41f7658b31653e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399226,9 +395297,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Mimikatzwrapper
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L206-L220"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c643e248a9d8dd653ec99f8b59cdc7af945857a6a0321f93cc6983e85f84baba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L206-L220"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c643e248a9d8dd653ec99f8b59cdc7af945857a6a0321f93cc6983e85f84baba"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399249,9 +395320,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Pvz_In
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L222-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "eae778162be5dcfa0005bb237c5209e7103db3549e06706744f9ebdf04e192df"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L222-L236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_eae778162be5dcfa0005bb237c5209e7103db3549e06706744f9ebdf04e192df"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399272,9 +395343,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Pvz_Out
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L238-L252"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "849300c32d2df42a011386903495d271810fd8a40c76d1a0c6295c059deb3a05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L238-L252"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_849300c32d2df42a011386903495d271810fd8a40c76d1a0c6295c059deb3a05"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399295,9 +395366,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Wndtest
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L254-L269"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b29c2b92b816bd0559695cb6b0b6e050ca8c5e256ec92448535fe9edf20757f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L254-L269"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b29c2b92b816bd0559695cb6b0b6e050ca8c5e256ec92448535fe9edf20757f"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399319,9 +395390,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Zhcat
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L271-L285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ef5112532ba62cb2cf6a1c62b344d9146c5b8e2da50990c8cfd60d91b99bcb5e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L271-L285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ef5112532ba62cb2cf6a1c62b344d9146c5b8e2da50990c8cfd60d91b99bcb5e"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399342,9 +395413,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Zhlookup
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L287-L300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9cc476e016708fd1604a63e2391057dc9dd0865448b62742ec596d6de54bf8f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L287-L300"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9cc476e016708fd1604a63e2391057dc9dd0865448b62742ec596d6de54bf8f6"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399364,9 +395435,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Zhmimikatz
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L302-L316"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1d6ce5b3351d4b01abe0c2f614d002d4e96599b4bfa01138704a3fdf345d0786"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L302-L316"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1d6ce5b3351d4b01abe0c2f614d002d4e96599b4bfa01138704a3fdf345d0786"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399387,9 +395458,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Parviz_Developer
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L318-L332"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ae043ee5baa7361def79811350317baf54eb76cf15001a7785808dc7947fddc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L318-L332"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ae043ee5baa7361def79811350317baf54eb76cf15001a7785808dc7947fddc"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399410,9 +395481,9 @@ rule SIGNATURE_BASE_OPCLEAVER_Ccproxy_Config
 		date = "2014-12-02"
 		modified = "2023-12-05"
 		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_cleaver.yar#L334-L352"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6e5c1c75a499434ad6ddd2439d28ac91d500b18418e693761d0b236bf6d6ce42"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_cleaver.yar#L334-L352"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6e5c1c75a499434ad6ddd2439d28ac91d500b18418e693761d0b236bf6d6ce42"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399426,7 +395497,7 @@ rule SIGNATURE_BASE_OPCLEAVER_Ccproxy_Config
 		$x1 = "IPAddressLow=78.109.194.114" fullword ascii
 
 	condition:
-		all of ($s*) or $x1
+		all of ( $s* ) or $x1
 }
 import "pe"
 
@@ -399439,9 +395510,9 @@ rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_1 : FILE
 		date = "2017-08-07"
 		modified = "2023-12-05"
 		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_agent_btz.yar#L13-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ea430b2888b487a5c7a91b73e8a7893b53d67e8ac95ae85fe9d15c633b2ee660"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_agent_btz.yar#L13-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ea430b2888b487a5c7a91b73e8a7893b53d67e8ac95ae85fe9d15c633b2ee660"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -399453,7 +395524,7 @@ rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_1 : FILE
 		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Modules" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them and pe.exports("Entry"))
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them and pe.exports ( "Entry" ) )
 }
 import "pe"
 
@@ -399466,9 +395537,9 @@ rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_2 : FILE
 		date = "2017-08-07"
 		modified = "2023-12-05"
 		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_agent_btz.yar#L29-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "41960e6deaee5d087b0eeee515b323cef8ead45ad305d053f6eb1897e204b003"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_agent_btz.yar#L29-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_41960e6deaee5d087b0eeee515b323cef8ead45ad305d053f6eb1897e204b003"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -399489,7 +395560,7 @@ rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_2 : FILE
 		$s2 = "activeds.dll" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them and pe.imphash()=="09b7c73fbe5529e6de7137e3e8268b7b"
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them and pe.imphash ( ) == "09b7c73fbe5529e6de7137e3e8268b7b"
 }
 import "pe"
 
@@ -399502,9 +395573,9 @@ rule SIGNATURE_BASE_Agent_BTZ_Aug17 : FILE
 		date = "2017-08-07"
 		modified = "2023-12-05"
 		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_agent_btz.yar#L54-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cf4fc7820d516cf0322bf25460301b4d04f914814fc2a069164814dd4e1158be"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_agent_btz.yar#L54-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cf4fc7820d516cf0322bf25460301b4d04f914814fc2a069164814dd4e1158be"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -399517,7 +395588,7 @@ rule SIGNATURE_BASE_Agent_BTZ_Aug17 : FILE
 		$s2 = "UnInstallW" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and all of them and pe.exports("Entry") and pe.exports("InstallW") and pe.exports("UnInstallW"))
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them and pe.exports ( "Entry" ) and pe.exports ( "InstallW" ) and pe.exports ( "UnInstallW" ) )
 }
 import "pe"
 
@@ -399530,9 +395601,9 @@ rule SIGNATURE_BASE_APT_Turla_Agent_BTZ_Gen_1 : FILE
 		date = "2018-06-16"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_agent_btz.yar#L75-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8616d95e683f213916f06a7bf672ced90b2fa55cb4331176021614b4f0b03aed"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_agent_btz.yar#L75-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8616d95e683f213916f06a7bf672ced90b2fa55cb4331176021614b4f0b03aed"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -399555,7 +395626,7 @@ rule SIGNATURE_BASE_APT_Turla_Agent_BTZ_Gen_1 : FILE
 		$s13 = "%02d.%02d.%04d Log begin:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="9d0d6daa47d6e6f2d80eb05405944f87" or (pe.exports("Entry") and pe.exports("InstallM") and pe.exports("InstallS")) or $x1 or 3 of them ) or (5 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "9d0d6daa47d6e6f2d80eb05405944f87" or ( pe.exports ( "Entry" ) and pe.exports ( "InstallM" ) and pe.exports ( "InstallS" ) ) or $x1 or 3 of them ) or ( 5 of them )
 }
 rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel : FILE
 {
@@ -399566,10 +395637,10 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5367e183df155e3133d916f7080ef973f7741d34"
-		logic_hash = "f2ffab73993c578f47e17babc2e65301b3720e438b33e57f2af31b7183bfd20f"
+		logic_hash = "v1_sha256_f2ffab73993c578f47e17babc2e65301b3720e438b33e57f2af31b7183bfd20f"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -399590,7 +395661,7 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel : FILE
 		$s20 = "filelist[%d]=%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of ($x*)) or (4 of ($s*))
+		( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) ) or ( 4 of ( $s* ) )
 }
 rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel_2 : FILE
 {
@@ -399601,10 +395672,10 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel_2 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L30-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L30-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f97e01ee04970d1fc4d988a9e9f0f223ef2a6381"
-		logic_hash = "60a48288cb106135728fb676ecad2b9be5254d5dc5094da158ea9dc07704c9ab"
+		logic_hash = "v1_sha256_60a48288cb106135728fb676ecad2b9be5254d5dc5094da158ea9dc07704c9ab"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -399629,7 +395700,7 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel_2 : FILE
 		$s18 = "Avaliable data:%u bytes" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16( 0 ) == 0x5a4d and 6 of them
 }
 rule SIGNATURE_BASE_APT_Malware_Putterpanda_PSAPI : FILE
 {
@@ -399640,10 +395711,10 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_PSAPI : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L61-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L61-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "f93a7945a33145bb6c106a51f08d8f44eab1cdf5"
-		logic_hash = "b73f1db2ca8a3164562314ebd9903c864eb2690c95731959df0e99656544ed40"
+		logic_hash = "v1_sha256_b73f1db2ca8a3164562314ebd9903c864eb2690c95731959df0e99656544ed40"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -399657,7 +395728,7 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_PSAPI : FILE
 		$s4 = "WinHttpGetProxyForUrl" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_APT_Malware_Putterpanda_WUAUCLT
 {
@@ -399668,10 +395739,10 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_WUAUCLT
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L81-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L81-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fd5ca5a2d444865fa8320337467313e4026b9f78"
-		logic_hash = "49cae3b727d6b2673dc9a6497d59c9abdd78d486e1eaf6f036f6eb1aef9a8fcb"
+		logic_hash = "v1_sha256_49cae3b727d6b2673dc9a6497d59c9abdd78d486e1eaf6f036f6eb1aef9a8fcb"
 		score = 70
 		quality = 85
 		tags = ""
@@ -399692,7 +395763,7 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_WUAUCLT
 		$s9 = "EnumProcessModules" fullword ascii
 
 	condition:
-		all of ($x*) or (1 of ($x*) and all of ($s*))
+		all of ( $x* ) or ( 1 of ( $x* ) and all of ( $s* ) )
 }
 rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen1 : FILE
 {
@@ -399703,9 +395774,9 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen1 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L110-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8054195f212017fb17953728a7df34645d81c93fee75300e44f467c6aa5efaff"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L110-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8054195f212017fb17953728a7df34645d81c93fee75300e44f467c6aa5efaff"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -399724,7 +395795,7 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen1 : FILE
 		$s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 5 of them
 }
 rule SIGNATURE_BASE_Malware_Msupdater_String_In_EXE : FILE
 {
@@ -399735,10 +395806,10 @@ rule SIGNATURE_BASE_Malware_Msupdater_String_In_EXE : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L133-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L133-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b1a2043b7658af4d4c9395fa77fde18ccaf549bb"
-		logic_hash = "2b7a43aee6dbac1bfa7d9e0331cb078394ae78a1ec44c1a4a70a63b38595abe0"
+		logic_hash = "v1_sha256_2b7a43aee6dbac1bfa7d9e0331cb078394ae78a1ec44c1a4a70a63b38595abe0"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -399755,7 +395826,7 @@ rule SIGNATURE_BASE_Malware_Msupdater_String_In_EXE : FILE
 		$fp3 = "/kies" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*)) and not (1 of ($fp*))
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) ) and not ( 1 of ( $fp* ) )
 }
 rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_3 : FILE
 {
@@ -399766,10 +395837,10 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_3 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L158-L175"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L158-L175"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "464149ff23f9c7f4ab2f5cadb76a4f41f969bed0"
-		logic_hash = "09e7da7f2bfbae9252502ea1ea61b612c1af2e4c70508b34e685b46429d4613c"
+		logic_hash = "v1_sha256_09e7da7f2bfbae9252502ea1ea61b612c1af2e4c70508b34e685b46429d4613c"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -399782,7 +395853,7 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_3 : FILE
 		$s4 = "COMSPEC" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16( 0 ) == 0x5a4d and 3 of them
 }
 rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_1 : FILE
 {
@@ -399793,10 +395864,10 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_1 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L177-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L177-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b55072b67543f58c096571c841a560c53d72f01a"
-		logic_hash = "038be28609df0187cbbce0d16fee7c902b742458f1201ff3c0d5fde19acd2c56"
+		logic_hash = "v1_sha256_038be28609df0187cbbce0d16fee7c902b742458f1201ff3c0d5fde19acd2c56"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -399813,7 +395884,7 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_1 : FILE
 		$s6 = "WriteProcessMemory" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of ($x*) and 4 of ($s*)) or (1 of ($x*) and all of ($s*))
+		( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) and 4 of ( $s* ) ) or ( 1 of ( $x* ) and all of ( $s* ) )
 }
 rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_2 : FILE
 {
@@ -399824,10 +395895,10 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_2 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L202-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L202-L236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "365b5537e3495f8ecfabe2597399b1f1226879b1"
-		logic_hash = "47d75e589d47a39d5a9c9e0047a143074d3d74b5541adf8cb3be968da732a96d"
+		logic_hash = "v1_sha256_47d75e589d47a39d5a9c9e0047a143074d3d74b5541adf8cb3be968da732a96d"
 		score = 70
 		quality = 83
 		tags = "FILE"
@@ -399857,7 +395928,7 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_2 : FILE
 		$s20 = "SPSSSQ" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 220KB and all of them
 }
 rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen4 : FILE
 {
@@ -399868,9 +395939,9 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen4 : FILE
 		date = "2015-06-03"
 		modified = "2023-12-05"
 		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_putterpanda.yar#L238-L276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7d450935febe5d6db14be1e7694db1d7b9e8fcacf013920e89c7b25659254310"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_putterpanda.yar#L238-L276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7d450935febe5d6db14be1e7694db1d7b9e8fcacf013920e89c7b25659254310"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -399899,7 +395970,7 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen4 : FILE
 		$z7 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii
 
 	condition:
-		filesize <300KB and (( uint16(0)==0x5a4d and $x1 and 3 of ($s*)) or (3 of ($s*) and 4 of ($z*)))
+		filesize < 300KB and ( ( uint16( 0 ) == 0x5a4d and $x1 and 3 of ( $s* ) ) or ( 3 of ( $s* ) and 4 of ( $z* ) ) )
 }
 rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customlokitools : FILE
 {
@@ -399910,14 +395981,14 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customlokitools : FILE
 		date = "2017-03-15"
 		modified = "2017-03-22"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_moonlightmaze.yar#L11-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_moonlightmaze.yar#L11-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "14cce7e641d308c3a177a8abb5457019"
 		hash = "a3164d2bbc45fb1eef5fde7eb8b245ea"
 		hash = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
 		hash = "1980958afffb6a9d5a6c73fc1e2795c2"
 		hash = "e59f92aadb6505f29a9f368ab803082e"
-		logic_hash = "4e1f60b045c10758354f110c3778b8ffd7f10b5e229b3f2f821287476620bec9"
+		logic_hash = "v1_sha256_4e1f60b045c10758354f110c3778b8ffd7f10b5e229b3f2f821287476620bec9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -399937,7 +396008,7 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customlokitools : FILE
 		$a11 = "ork error" ascii fullword
 
 	condition:
-		filesize <5000KB and 3 of ($a*)
+		filesize < 5000KB and 3 of ( $a* )
 }
 rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customsniffer
 {
@@ -399948,11 +396019,11 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customsniffer
 		date = "2017-03-15"
 		modified = "2023-12-05"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_moonlightmaze.yar#L50-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_moonlightmaze.yar#L50-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7b86f40e861705d59f5206c482e1f2a5"
 		hash = "927426b558888ad680829bd34b0ad0e7"
-		logic_hash = "5ccf9035adc16393db4b3d461f7a20f86f538275d7806280a15508c15d9c805c"
+		logic_hash = "v1_sha256_5ccf9035adc16393db4b3d461f7a20f86f538275d7806280a15508c15d9c805c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -399968,7 +396039,7 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customsniffer
 		$a6 = "mydevname= |%s|" fullword
 
 	condition:
-		2 of ($a*)
+		2 of ( $a* )
 }
 rule SIGNATURE_BASE_Loki2Crypto
 {
@@ -399979,14 +396050,14 @@ rule SIGNATURE_BASE_Loki2Crypto
 		date = "2017-03-21"
 		modified = "2023-12-05"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_moonlightmaze.yar#L82-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_moonlightmaze.yar#L82-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "19fbd8cbfb12482e8020a887d6427315"
 		hash = "ea06b213d5924de65407e8931b1e4326"
 		hash = "14ecd5e6fc8e501037b54ca263896a11"
 		hash = "e079ec947d3d4dacb21e993b760a65dc"
 		hash = "edf900cebb70c6d1fcab0234062bfc28"
-		logic_hash = "c2315dafb0ecb9e6babd526a028835f3513218c1e667c81088c49ad13dbab5be"
+		logic_hash = "v1_sha256_c2315dafb0ecb9e6babd526a028835f3513218c1e667c81088c49ad13dbab5be"
 		score = 75
 		quality = 85
 		tags = ""
@@ -400007,11 +396078,11 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_De_Tool
 		date = "2017-03-27"
 		modified = "2017-03-27"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_moonlightmaze.yar#L111-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_moonlightmaze.yar#L111-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4bc7ed168fb78f0dc688ee2be20c9703"
 		hash = "8b56e8552a74133da4bc5939b5f74243"
-		logic_hash = "f658e1aa2ddb84fe3c1de7c7c00f2148d232cf2b3381c298420abfc382c02986"
+		logic_hash = "v1_sha256_f658e1aa2ddb84fe3c1de7c7c00f2148d232cf2b3381c298420abfc382c02986"
 		score = 75
 		quality = 85
 		tags = ""
@@ -400023,7 +396094,7 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_De_Tool
 		$a3 = {25 73 0A 25 73 0A 25 73 0A 25 73 0A}
 
 	condition:
-		((2 of ($a*)))
+		(( 2 of ( $a* ) ) )
 }
 rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Cle_Tool
 {
@@ -400034,10 +396105,10 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Cle_Tool
 		date = "2017-03-27"
 		modified = "2017-03-27"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_moonlightmaze.yar#L140-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_moonlightmaze.yar#L140-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "647d7b711f7b4434145ea30d0ef207b0"
-		logic_hash = "a4bbd7be617b944a656fa58ca9ec6384f624c95250de6b8a6ba63e7c3387484c"
+		logic_hash = "v1_sha256_a4bbd7be617b944a656fa58ca9ec6384f624c95250de6b8a6ba63e7c3387484c"
 		score = 75
 		quality = 85
 		tags = ""
@@ -400052,7 +396123,7 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Cle_Tool
 		$a6 = "No good line"
 
 	condition:
-		((3 of ($a*)))
+		(( 3 of ( $a* ) ) )
 }
 rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Xk_Keylogger
 {
@@ -400063,9 +396134,9 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Xk_Keylogger
 		date = "2017-03-27"
 		modified = "2017-03-27"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_moonlightmaze.yar#L170-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b2acdef9c8e545f4ab217f529a7e4a3e74723b27ec89896f98639fd40792bcc8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_moonlightmaze.yar#L170-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b2acdef9c8e545f4ab217f529a7e4a3e74723b27ec89896f98639fd40792bcc8"
 		score = 75
 		quality = 35
 		tags = ""
@@ -400086,7 +396157,7 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Xk_Keylogger
 		$a12 = "mygid=-%d-" fullword
 
 	condition:
-		((3 of ($a*)))
+		(( 3 of ( $a* ) ) )
 }
 rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Encrypted_Keylog : FILE
 {
@@ -400097,9 +396168,9 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Encrypted_Keylog : FILE
 		date = "2017-03-27"
 		modified = "2017-03-27"
 		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_moonlightmaze.yar#L204-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "593f6f2148ddb52e2beee72a48135cd83f126edfdb263b471432d17273e536db"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_moonlightmaze.yar#L204-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_593f6f2148ddb52e2beee72a48135cd83f126edfdb263b471432d17273e536db"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400109,7 +396180,7 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Encrypted_Keylog : FILE
 		$a1 = {47 01 22 2A 6D 3E 39 2C}
 
 	condition:
-		uint32(0)==0x2a220147 and ($a1 at 0)
+		uint32( 0 ) == 0x2a220147 and ( $a1 at 0 )
 }
 rule SIGNATURE_BASE_MAL_UNC2891_Slapstick : FILE
 {
@@ -400120,9 +396191,9 @@ rule SIGNATURE_BASE_MAL_UNC2891_Slapstick : FILE
 		date = "2022-03-30"
 		modified = "2023-01-05"
 		reference = "https://github.com/fboldewin/YARA-rules/tree/master"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc2891_mal_jan23.yar#L19-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4bc51a47a1b620c3bb950c287c38a37e528e79f9720fb4d9fa9ebecbeca82036"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc2891_mal_jan23.yar#L19-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4bc51a47a1b620c3bb950c287c38a37e528e79f9720fb4d9fa9ebecbeca82036"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400137,7 +396208,7 @@ rule SIGNATURE_BASE_MAL_UNC2891_Slapstick : FILE
 		$str_fr1 = "HISTFILE=/dev/null"
 
 	condition:
-		uint32(0)==0x464c457f and filesize <100KB and ( all of ($code*) or all of ($str*))
+		uint32( 0 ) == 0x464c457f and filesize < 100KB and ( all of ( $code* ) or all of ( $str* ) )
 }
 rule SIGNATURE_BASE_Powershell_Case_Anomaly : FILE
 {
@@ -400148,9 +396219,9 @@ rule SIGNATURE_BASE_Powershell_Case_Anomaly : FILE
 		date = "2017-08-11"
 		modified = "2022-06-12"
 		reference = "https://twitter.com/danielhbohannon/status/905096106924761088"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_case_anomalies.yar#L11-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cbef94b899a2d22930ee0e8b3eac03c505db629d19a62ddd8f56482403dfa595"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_case_anomalies.yar#L11-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cbef94b899a2d22930ee0e8b3eac03c505db629d19a62ddd8f56482403dfa595"
 		score = 70
 		quality = 77
 		tags = "FILE"
@@ -400180,7 +396251,7 @@ rule SIGNATURE_BASE_Powershell_Case_Anomaly : FILE
 		$fp4 = "# Localized PSGet.Resource.psd1" wide
 
 	condition:
-		filesize <800KB and ((#s1>#sn1+#sn2+#sn3+#sn4+#sn5+#sn6+#sn7) or (#a1>#an1+#an2) or (#k1>#kn1+#kn2+#kn3+#kn4+#kn5)) and not 1 of ($fp*)
+		filesize < 800KB and ( ( #s1 > #sn1 + #sn2 + #sn3 + #sn4 + #sn5 + #sn6 + #sn7 ) or ( #a1 > #an1 + #an2 ) or ( #k1 > #kn1 + #kn2 + #kn3 + #kn4 + #kn5 ) ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Wscriptshell_Case_Anomaly : FILE
 {
@@ -400191,9 +396262,9 @@ rule SIGNATURE_BASE_Wscriptshell_Case_Anomaly : FILE
 		date = "2017-09-11"
 		modified = "2022-06-09"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_case_anomalies.yar#L62-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5c64e124186ae2eb974639627287fb27fe27eb2855342703e4a27a9c0fd62a91"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_case_anomalies.yar#L62-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5c64e124186ae2eb974639627287fb27fe27eb2855342703e4a27a9c0fd62a91"
 		score = 60
 		quality = 83
 		tags = "FILE"
@@ -400208,7 +396279,7 @@ rule SIGNATURE_BASE_Wscriptshell_Case_Anomaly : FILE
 		$sn5 = "WScript.shell\").Run" ascii wide
 
 	condition:
-		filesize <3000KB and #s1>#sn1+#sn2+#sn3+#sn4+#sn5
+		filesize < 3000KB and #s1 > #sn1 + #sn2 + #sn3 + #sn4 + #sn5
 }
 rule SIGNATURE_BASE_Dubseven_File_Set : FILE
 {
@@ -400219,9 +396290,9 @@ rule SIGNATURE_BASE_Dubseven_File_Set : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_between-hk-and-burma.yar#L1-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "af98ab901ca97a350aa837779d74208a780b1099e113cfa59bee2eb33690918e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_between-hk-and-burma.yar#L1-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_af98ab901ca97a350aa837779d74208a780b1099e113cfa59bee2eb33690918e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400237,7 +396308,7 @@ rule SIGNATURE_BASE_Dubseven_File_Set : FILE
 		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 3 of ($file*)
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and 3 of ( $file* )
 }
 rule SIGNATURE_BASE_Dubseven_Dropper_Registry_Checks : FILE
 {
@@ -400248,9 +396319,9 @@ rule SIGNATURE_BASE_Dubseven_Dropper_Registry_Checks : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_between-hk-and-burma.yar#L31-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "813ff641a4213cf9d56013768e284e7f622a223c6c4f585c3bbbcf69fc03723c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_between-hk-and-burma.yar#L31-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_813ff641a4213cf9d56013768e284e7f622a223c6c4f585c3bbbcf69fc03723c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400265,7 +396336,7 @@ rule SIGNATURE_BASE_Dubseven_Dropper_Registry_Checks : FILE
 		$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and all of ($reg*)
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and all of ( $reg* )
 }
 rule SIGNATURE_BASE_Dubseven_Dropper_Dialog_Remains : FILE
 {
@@ -400276,9 +396347,9 @@ rule SIGNATURE_BASE_Dubseven_Dropper_Dialog_Remains : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_between-hk-and-burma.yar#L59-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "322ddc1210b6bde393970c61113e6efcb87a3529db386323dfd08973e5d2703e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_between-hk-and-burma.yar#L59-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_322ddc1210b6bde393970c61113e6efcb87a3529db386323dfd08973e5d2703e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400288,7 +396359,7 @@ rule SIGNATURE_BASE_Dubseven_Dropper_Dialog_Remains : FILE
 		$dia2 = "Rundll 1.0" wide
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and any of them
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of them
 }
 rule SIGNATURE_BASE_Maindll_Mutex : FILE
 {
@@ -400299,9 +396370,9 @@ rule SIGNATURE_BASE_Maindll_Mutex : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_between-hk-and-burma.yar#L83-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8d3311164104198e02e700c2e9a5293e55d75d63b39c75c4e375b7f35eb5fde4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_between-hk-and-burma.yar#L83-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8d3311164104198e02e700c2e9a5293e55d75d63b39c75c4e375b7f35eb5fde4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400310,7 +396381,7 @@ rule SIGNATURE_BASE_Maindll_Mutex : FILE
 		$mutex = "h31415927tttt"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $mutex
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $mutex
 }
 rule SIGNATURE_BASE_Slserver_Dialog_Remains : FILE
 {
@@ -400321,9 +396392,9 @@ rule SIGNATURE_BASE_Slserver_Dialog_Remains : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_between-hk-and-burma.yar#L106-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b18f4a6c54b456ae697e9639e8c3041fd4f3141d89850c3e1d3d4e220c3cea3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_between-hk-and-burma.yar#L106-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b18f4a6c54b456ae697e9639e8c3041fd4f3141d89850c3e1d3d4e220c3cea3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400336,7 +396407,7 @@ rule SIGNATURE_BASE_Slserver_Dialog_Remains : FILE
 		$extra2 = "\\SLServer.pdb" ascii
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and not 1 of ($fp*) and 1 of ($extra*) and $slserver
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and not 1 of ( $fp* ) and 1 of ( $extra* ) and $slserver
 }
 rule SIGNATURE_BASE_Slserver_Mutex : FILE
 {
@@ -400347,9 +396418,9 @@ rule SIGNATURE_BASE_Slserver_Mutex : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_between-hk-and-burma.yar#L138-L158"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9bf3c6c93e77424463e3fb6f9f4d58e80254866462fe1287293b0a357737da20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_between-hk-and-burma.yar#L138-L158"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9bf3c6c93e77424463e3fb6f9f4d58e80254866462fe1287293b0a357737da20"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400358,7 +396429,7 @@ rule SIGNATURE_BASE_Slserver_Mutex : FILE
 		$mutex = "M&GX^DSF&DA@F"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $mutex
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $mutex
 }
 rule SIGNATURE_BASE_Slserver_Command_And_Control : FILE
 {
@@ -400369,9 +396440,9 @@ rule SIGNATURE_BASE_Slserver_Command_And_Control : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_between-hk-and-burma.yar#L160-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "48a13d27b7dc9a7f3a65752142b2a291e7c3ee93ef67b36aa4202d065e74d80e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_between-hk-and-burma.yar#L160-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_48a13d27b7dc9a7f3a65752142b2a291e7c3ee93ef67b36aa4202d065e74d80e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400380,7 +396451,7 @@ rule SIGNATURE_BASE_Slserver_Command_And_Control : FILE
 		$c2 = "safetyssl.security-centers.com"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $c2
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $c2
 }
 rule SIGNATURE_BASE_Slserver_Campaign_Code : FILE
 {
@@ -400391,9 +396462,9 @@ rule SIGNATURE_BASE_Slserver_Campaign_Code : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_between-hk-and-burma.yar#L182-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fbf53678399b0e14eae6f1bb6594b2aa665f76f10388e492bec2f9101a4dd4b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_between-hk-and-burma.yar#L182-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fbf53678399b0e14eae6f1bb6594b2aa665f76f10388e492bec2f9101a4dd4b1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400402,7 +396473,7 @@ rule SIGNATURE_BASE_Slserver_Campaign_Code : FILE
 		$campaign = "wthkdoc0106"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $campaign
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $campaign
 }
 rule SIGNATURE_BASE_Slserver_Unknown_String : FILE
 {
@@ -400413,9 +396484,9 @@ rule SIGNATURE_BASE_Slserver_Unknown_String : FILE
 		date = "2016-04-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_between-hk-and-burma.yar#L204-L224"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "18d3bb236282c506c161949883722da1cb0af6dd87bf5cb3d4a5b3d90f4a7db0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_between-hk-and-burma.yar#L204-L224"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_18d3bb236282c506c161949883722da1cb0af6dd87bf5cb3d4a5b3d90f4a7db0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400424,7 +396495,7 @@ rule SIGNATURE_BASE_Slserver_Unknown_String : FILE
 		$string = "test-b7fa835a39"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $string
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $string
 }
 rule SIGNATURE_BASE_APT_Equation_Group_Op_Triangulation_Triangledb_Implant_Jun23_1 : FILE
 {
@@ -400435,9 +396506,9 @@ rule SIGNATURE_BASE_APT_Equation_Group_Op_Triangulation_Triangledb_Implant_Jun23
 		date = "2023-06-21"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/triangledb-triangulation-implant/110050/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_eqgrp_triangulation_jun23.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "486b19ddb8b182dbba882359f7eb416735e76f9cda5aea1b290fb5c6b44960c5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_eqgrp_triangulation_jun23.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_486b19ddb8b182dbba882359f7eb416735e76f9cda5aea1b290fb5c6b44960c5"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -400449,7 +396520,7 @@ rule SIGNATURE_BASE_APT_Equation_Group_Op_Triangulation_Triangledb_Implant_Jun23
 		$s4 = "CRXConfigureDBServer" ascii fullword
 
 	condition:
-		( uint16(0)==0xfacf and filesize <30MB and $s1 and 2 of them ) or all of them
+		( uint16( 0 ) == 0xfacf and filesize < 30MB and $s1 and 2 of them ) or all of them
 }
 rule SIGNATURE_BASE_Tempracer : FILE
 {
@@ -400460,10 +396531,10 @@ rule SIGNATURE_BASE_Tempracer : FILE
 		date = "2016-03-30"
 		modified = "2023-12-05"
 		reference = "http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_tempracer.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_tempracer.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e17d80c4822d16371d75e1440b6ac44af490b71fbee1010a3e8a5eca94d22bb3"
-		logic_hash = "37355456e13ea9fa6429b68970e0450f4ddbd8da81c070a0383b1e048a05e35a"
+		logic_hash = "v1_sha256_37355456e13ea9fa6429b68970e0450f4ddbd8da81c070a0383b1e048a05e35a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400477,7 +396548,7 @@ rule SIGNATURE_BASE_Tempracer : FILE
 		$s5 = "[+] Blocking " fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <25KB and 1 of them ) or (4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 25KB and 1 of them ) or ( 4 of them )
 }
 import "pe"
 
@@ -400490,9 +396561,9 @@ rule SIGNATURE_BASE_Microcin_Sample_1 : FILE
 		date = "2017-09-26"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_microcin.yar#L13-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e7eb967035257490db2537ba46fd1f1e378fc33f93e7f65412949e987194a9db"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_microcin.yar#L13-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e7eb967035257490db2537ba46fd1f1e378fc33f93e7f65412949e987194a9db"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400509,10 +396580,8 @@ rule SIGNATURE_BASE_Microcin_Sample_1 : FILE
 		$s5 = ".?AVCAppleBinBaseClass@@" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (4 of them or pe.imphash()=="897077ca318eaf629cfe74569f10e023"))
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 4 of them or pe.imphash ( ) == "897077ca318eaf629cfe74569f10e023" ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Microcin_Sample_2 : FILE
 {
 	meta:
@@ -400522,9 +396591,9 @@ rule SIGNATURE_BASE_Microcin_Sample_2 : FILE
 		date = "2017-09-26"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_microcin.yar#L38-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "99feb3e1672f69c4cf41a100e9ba64421fd75c3554306a1bf1475da6f1e14ed1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_microcin.yar#L38-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_99feb3e1672f69c4cf41a100e9ba64421fd75c3554306a1bf1475da6f1e14ed1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400536,10 +396605,8 @@ rule SIGNATURE_BASE_Microcin_Sample_2 : FILE
 		$s7 = "IconCache_%02d%02d%02d%02d%02d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Microcin_Sample_3 : FILE
 {
 	meta:
@@ -400549,9 +396616,9 @@ rule SIGNATURE_BASE_Microcin_Sample_3 : FILE
 		date = "2017-09-26"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_microcin.yar#L54-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bf1227460f1fc4a7bede853b0d4f15b520db870ac7ce2e6684dc195ea6322e82"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_microcin.yar#L54-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bf1227460f1fc4a7bede853b0d4f15b520db870ac7ce2e6684dc195ea6322e82"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400563,10 +396630,8 @@ rule SIGNATURE_BASE_Microcin_Sample_3 : FILE
 		$s2 = "test, Version 1.0" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Microcin_Sample_4 : FILE
 {
 	meta:
@@ -400576,9 +396641,9 @@ rule SIGNATURE_BASE_Microcin_Sample_4 : FILE
 		date = "2017-09-26"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_microcin.yar#L70-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1293fbd1a6b440168bb1d7b250df0c8a1a7f99a7fb603a6abec7fe7ba20cf4f5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_microcin.yar#L70-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1293fbd1a6b440168bb1d7b250df0c8a1a7f99a7fb603a6abec7fe7ba20cf4f5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400595,10 +396660,8 @@ rule SIGNATURE_BASE_Microcin_Sample_4 : FILE
 		$f4 = "%s\\h%08x\\h%08x.db" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of ($s*) or 5 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or 5 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Microcin_Sample_5 : FILE
 {
 	meta:
@@ -400608,9 +396671,9 @@ rule SIGNATURE_BASE_Microcin_Sample_5 : FILE
 		date = "2017-09-26"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_microcin.yar#L92-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "18b9b80ad3c27f32c71197f33e5e99742662cf5cf4ed5f83d574d44ba63f8b5f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_microcin.yar#L92-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_18b9b80ad3c27f32c71197f33e5e99742662cf5cf4ed5f83d574d44ba63f8b5f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400626,10 +396689,8 @@ rule SIGNATURE_BASE_Microcin_Sample_5 : FILE
 		$x7 = "Can not found the Password Dictoonary file! " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them ) or 2 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them ) or 2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Microcin_Sample_6 : FILE
 {
 	meta:
@@ -400639,9 +396700,9 @@ rule SIGNATURE_BASE_Microcin_Sample_6 : FILE
 		date = "2017-09-26"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_microcin.yar#L112-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "280fb17b5ed5ff1c8018e426969f75e18589eabeb2a20e0e623f206e72e8958d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_microcin.yar#L112-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_280fb17b5ed5ff1c8018e426969f75e18589eabeb2a20e0e623f206e72e8958d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400655,7 +396716,7 @@ rule SIGNATURE_BASE_Microcin_Sample_6 : FILE
 		$s3 = "Bruntime error " fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them )
 }
 rule SIGNATURE_BASE_Revengerat_Sep17 : FILE
 {
@@ -400666,9 +396727,9 @@ rule SIGNATURE_BASE_Revengerat_Sep17 : FILE
 		date = "2017-09-04"
 		modified = "2020-07-27"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_revenge_rat.yar#L11-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "467133402d6898f325cfd8c18308fc2a4dafd06c8624f9347225f16afd4035ce"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_revenge_rat.yar#L11-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_467133402d6898f325cfd8c18308fc2a4dafd06c8624f9347225f16afd4035ce"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400687,7 +396748,7 @@ rule SIGNATURE_BASE_Revengerat_Sep17 : FILE
 		$s1 = "{11111-22222-20001-00001}" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of ($x*)) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of ( $x* ) ) or ( 3 of them )
 }
 import "pe"
 
@@ -400700,9 +396761,9 @@ rule SIGNATURE_BASE_Shadowpad_Nssock2 : FILE
 		date = "2017-08-15"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/shadowpad-in-corporate-networks/81432/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_shadowpad.yar#L13-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ea9675d5acfdc80cfa787db2c2dfe2169aa7c5e3ead35f020d0b0b664ecb4bf4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_shadowpad.yar#L13-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ea9675d5acfdc80cfa787db2c2dfe2169aa7c5e3ead35f020d0b0b664ecb4bf4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400715,10 +396776,8 @@ rule SIGNATURE_BASE_Shadowpad_Nssock2 : FILE
 		hash6 = "637fa40cf7dd0252c87140f7895768f42a370551c87c37a3a77aac00eb17d72e"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="c67de089f2009b21715744762fc484e8" or pe.imphash()=="11522f7d4b2fc05acba8f534ca1b828a"))
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "c67de089f2009b21715744762fc484e8" or pe.imphash ( ) == "11522f7d4b2fc05acba8f534ca1b828a" ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Tools_Back : FILE
 {
 	meta:
@@ -400728,9 +396787,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Tools_Back : FILE
 		date = "2017-07-23"
 		modified = "2022-12-21"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3a23491cbb24177c027695d8f677c4a72ed0404c4c38356eec4b92f2d06be2ee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3a23491cbb24177c027695d8f677c4a72ed0404c4c38356eec4b92f2d06be2ee"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400743,10 +396802,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Tools_Back : FILE
 		$x3 = "//Dump Chrome Passwords to a Output file \"c:\\passlist.txt\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Tools_Clrlg : FILE
 {
 	meta:
@@ -400756,9 +396813,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Tools_Clrlg : FILE
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L31-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "003f711ac6f2308f2bdc638da7c654686e7402db7b3837120168e5a99b774537"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L31-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_003f711ac6f2308f2bdc638da7c654686e7402db7b3837120168e5a99b774537"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400770,10 +396827,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Tools_Clrlg : FILE
 		$s2 = "wevtutil.exe cl %1" fullword ascii
 
 	condition:
-		filesize <1KB and 1 of them
+		filesize < 1KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Powershell
 {
 	meta:
@@ -400783,9 +396838,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Powershell
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L47-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "57d28f7b79cc14b8bbc2d7c9b2c16ab0f94a4b160cf7cb1d4641fe1c77e06811"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L47-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_57d28f7b79cc14b8bbc2d7c9b2c16ab0f94a4b160cf7cb1d4641fe1c77e06811"
 		score = 75
 		quality = 85
 		tags = ""
@@ -400798,8 +396853,6 @@ rule SIGNATURE_BASE_Wiltedtulip_Powershell
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Vminst : FILE
 {
 	meta:
@@ -400809,9 +396862,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Vminst : FILE
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L62-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a4559c2f4de60537827d167453751a92c0030ae6ce095a2d64df777e93d4b87a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L62-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a4559c2f4de60537827d167453751a92c0030ae6ce095a2d64df777e93d4b87a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400832,10 +396885,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Vminst : FILE
 		$s10 = "ERROR in %S/%d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 5 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 5 of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Windows_UM_Task
 {
 	meta:
@@ -400845,9 +396896,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Windows_UM_Task
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L90-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cfc2d231b6be798172e5d7ffc525842c7eed6d78a145c401136452c46f21e3b2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L90-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cfc2d231b6be798172e5d7ffc525842c7eed6d78a145c401136452c46f21e3b2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -400861,10 +396912,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Windows_UM_Task
 		$c2 = "svchost64.swp,checkUpdate" wide ascii
 
 	condition:
-		($r1 and $p1) or 1 of ($c*)
+		($r1 and $p1 ) or 1 of ( $c* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Windowstask
 {
 	meta:
@@ -400874,9 +396923,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Windowstask
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L109-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a2bbcb02f34b2da3d88772d211cc7bfb669384161eec94336cdc2474144b16ae"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L109-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a2bbcb02f34b2da3d88772d211cc7bfb669384161eec94336cdc2474144b16ae"
 		score = 75
 		quality = 85
 		tags = ""
@@ -400895,8 +396944,6 @@ rule SIGNATURE_BASE_Wiltedtulip_Windowstask
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Tdtess : FILE
 {
 	meta:
@@ -400906,9 +396953,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Tdtess : FILE
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L130-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ffd10e06b3a8f3054747443b863070e8726589fc795f816832dbf73c0c34e080"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L130-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ffd10e06b3a8f3054747443b863070e8726589fc795f816832dbf73c0c34e080"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400922,10 +396969,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Tdtess : FILE
 		$s2 = "winlogin.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 2 of them ))
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 2 of them ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Silverlightmsi : FILE
 {
 	meta:
@@ -400935,9 +396980,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Silverlightmsi : FILE
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L149-L165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "716db8f8e7d71c7f3deaeb9ac8e141c9bf374e5dae992e8e2623070c81089953"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L149-L165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_716db8f8e7d71c7f3deaeb9ac8e141c9bf374e5dae992e8e2623070c81089953"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400951,7 +396996,7 @@ rule SIGNATURE_BASE_Wiltedtulip_Silverlightmsi : FILE
 		$x4 = "########## Find the Computer account in AD and if not found, throw an exception ###########" fullword ascii
 
 	condition:
-		( filesize <20KB and 1 of them )
+		( filesize < 20KB and 1 of them )
 }
 import "pe"
 
@@ -400964,9 +397009,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_Injector : FILE
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L167-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e02d26882c85b77bd97629fce20bd027e1f5f7e28ae0c43c9ea7a4b1e5d02cd1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L167-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e02d26882c85b77bd97629fce20bd027e1f5f7e28ae0c43c9ea7a4b1e5d02cd1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -400979,10 +397024,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_Injector : FILE
 		$s2 = "ReflectiveLoader" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them ) or (pe.exports("__dec") and pe.exports("_check") and pe.exports("_dec") and pe.exports("start") and pe.exports("test"))
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them ) or ( pe.exports ( "__dec" ) and pe.exports ( "_check" ) and pe.exports ( "_dec" ) and pe.exports ( "start" ) and pe.exports ( "test" ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Zpp : FILE
 {
 	meta:
@@ -400992,9 +397035,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Zpp : FILE
 		date = "2017-07-23"
 		modified = "2022-12-21"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L191-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "32c91f8a02443a6f024acb3f941b7f11472e7f1517c54a3c7edc89ce88ba73e0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L191-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_32c91f8a02443a6f024acb3f941b7f11472e7f1517c54a3c7edc89ce88ba73e0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401014,10 +397057,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Zpp : FILE
 		$s6 = "\\obj\\Release\\ZPP.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and ( 1 of ( $x* ) or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Netsrv_Netsrvs : FILE
 {
 	meta:
@@ -401027,9 +397068,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Netsrv_Netsrvs : FILE
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L217-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1506d1eddd43731c00e5f01a292589b07de5055bbdd7b1f7c2d7ac7a09b8ae58"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L217-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1506d1eddd43731c00e5f01a292589b07de5055bbdd7b1f7c2d7ac7a09b8ae58"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401051,7 +397092,7 @@ rule SIGNATURE_BASE_Wiltedtulip_Netsrv_Netsrvs : FILE
 		$c5 = "/slbhttps" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*) and 1 of ($c*)))
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( all of ( $s* ) and 1 of ( $c* ) ) )
 }
 import "pe"
 
@@ -401064,9 +397105,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Reflectiveloader : FILE
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L244-L268"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9488d2e97d0ea031a138e72964a3b56781f9d05c1676ff0b360407db944e26de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L244-L268"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9488d2e97d0ea031a138e72964a3b56781f9d05c1676ff0b360407db944e26de"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401086,10 +397127,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Reflectiveloader : FILE
 		$x6 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them ) or (2 of them ) or pe.exports("_ReflectiveLoader@4")
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them ) or ( 2 of them ) or pe.exports ( "_ReflectiveLoader@4" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_RAT : FILE
 {
 	meta:
@@ -401099,9 +397138,9 @@ rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_RAT : FILE
 		date = "2017-07-23"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_wilted_tulip.yar#L270-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9e878d9e3dc3f2050e52a046038f4f855b5b777948d928e0bc6d7a98fc0a7119"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_wilted_tulip.yar#L270-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9e878d9e3dc3f2050e52a046038f4f855b5b777948d928e0bc6d7a98fc0a7119"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401118,7 +397157,7 @@ rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_RAT : FILE
 		$s6 = "Job Save KeyLogger" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 3 of them )
 }
 rule SIGNATURE_BASE_HKTL_FRP_Apr20_1
 {
@@ -401129,9 +397168,9 @@ rule SIGNATURE_BASE_HKTL_FRP_Apr20_1
 		date = "2020-04-07"
 		modified = "2022-11-03"
 		reference = "https://github.com/fatedier/frp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_frp_proxy.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "21f91fd99aed8b62d804504889c41ca77567fd345cf4ea0ef00161eefa9324a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_frp_proxy.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_21f91fd99aed8b62d804504889c41ca77567fd345cf4ea0ef00161eefa9324a7"
 		score = 70
 		quality = 85
 		tags = ""
@@ -401146,7 +397185,7 @@ rule SIGNATURE_BASE_HKTL_FRP_Apr20_1
 		$fpg6 = "<?xml"
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		1 of ( $x* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_HKTL_FRP_INI_Apr20_1 : FILE
 {
@@ -401157,9 +397196,9 @@ rule SIGNATURE_BASE_HKTL_FRP_INI_Apr20_1 : FILE
 		date = "2020-04-07"
 		modified = "2023-12-05"
 		reference = "Chinese Hacktools OpenDir"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_frp_proxy.yar#L24-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cc997dc876d7a49292b62a0fb4ff12b34dacacfd8a1b90226d6a9aee303cacdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_frp_proxy.yar#L24-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cc997dc876d7a49292b62a0fb4ff12b34dacacfd8a1b90226d6a9aee303cacdf"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -401174,7 +397213,7 @@ rule SIGNATURE_BASE_HKTL_FRP_INI_Apr20_1 : FILE
 		$s5 = "type = tcp" ascii fullword
 
 	condition:
-		uint16(0)==0x635b and filesize <1KB and $h1 at 0 and all of them
+		uint16( 0 ) == 0x635b and filesize < 1KB and $h1 at 0 and all of them
 }
 rule SIGNATURE_BASE_Blackenergy3_Installer
 {
@@ -401185,11 +397224,11 @@ rule SIGNATURE_BASE_Blackenergy3_Installer
 		date = "2015-05-29"
 		modified = "2023-12-05"
 		reference = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_blackenergy_installer.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_blackenergy_installer.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "78387651dd9608fcdf6bfb9df8b84db4"
 		hash = "78636f7bbd52ea80d79b4e2a7882403092bbb02d"
-		logic_hash = "c4c562124427fd394b56e48f16f2d262c8a717fc750b955b2b2a35acb478d5e7"
+		logic_hash = "v1_sha256_c4c562124427fd394b56e48f16f2d262c8a717fc750b955b2b2a35acb478d5e7"
 		score = 75
 		quality = 85
 		tags = ""
@@ -401209,9 +397248,9 @@ rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_1 : FILE
 		date = "2016-12-29"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/WVflzO"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d4a06fbf875ba2dbe64abcc21fab4eea1fe1b092498a09d9a310214562c1869e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d4a06fbf875ba2dbe64abcc21fab4eea1fe1b092498a09d9a310214562c1869e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401227,7 +397266,7 @@ rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_1 : FILE
 		$s8 = "Star Polk.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 4 of them )
 }
 rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_2 : FILE
 {
@@ -401238,9 +397277,9 @@ rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_2 : FILE
 		date = "2016-12-29"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/WVflzO"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L30-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "134a76129ef2169ac60f21541ef51a223720badfad02f0822acc7fd6d49cf7e7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L30-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_134a76129ef2169ac60f21541ef51a223720badfad02f0822acc7fd6d49cf7e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401257,7 +397296,7 @@ rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_2 : FILE
 		$s5 = "CrashInit" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and $x1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_PAS_TOOL_PHP_WEB_KIT_Mod : FILE
 {
@@ -401268,9 +397307,9 @@ rule SIGNATURE_BASE_PAS_TOOL_PHP_WEB_KIT_Mod : FILE
 		date = "2016-12-29"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L52-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fab894d9609c1fca4a85457e6799d082dfd3eb9ca0564abc04a1a0dd07a7b546"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L52-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fab894d9609c1fca4a85457e6799d082dfd3eb9ca0564abc04a1a0dd07a7b546"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401285,7 +397324,7 @@ rule SIGNATURE_BASE_PAS_TOOL_PHP_WEB_KIT_Mod : FILE
 		$isset = "isset"
 
 	condition:
-		uint32(0)==0x68703f3c and $php at 0 and ( filesize >10KB and filesize <30KB) and #cookie==2 and #isset==3 and all of them
+		uint32( 0 ) == 0x68703f3c and $php at 0 and ( filesize > 10KB and filesize < 30KB ) and #cookie == 2 and #isset == 3 and all of them
 }
 rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V3 : FILE
 {
@@ -401296,9 +397335,9 @@ rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V3 : FILE
 		date = "2016-01-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/wordfence/grizzly"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L76-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "21bf0afcd3f8de813ddfe41ef32e45806e9f9d7d3b08ae7ce65017c35e32a868"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L76-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_21bf0afcd3f8de813ddfe41ef32e45806e9f9d7d3b08ae7ce65017c35e32a868"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401312,7 +397351,7 @@ rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V3 : FILE
 		$s3 = "de'.'code';" ascii
 
 	condition:
-		(( uint32(0)==0x68703f3c and $php at 0) or $php2) and filesize >8KB and filesize <100KB and all of ($s*)
+		(( uint32( 0 ) == 0x68703f3c and $php at 0 ) or $php2 ) and filesize > 8KB and filesize < 100KB and all of ( $s* )
 }
 rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V4 : FILE
 {
@@ -401323,9 +397362,9 @@ rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V4 : FILE
 		date = "2016-01-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/wordfence/grizzly"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L97-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e2eaa0abd14f4dd08815c44797df707a08df1ea4e04ae69ba67d128a0fe4eff5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L97-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e2eaa0abd14f4dd08815c44797df707a08df1ea4e04ae69ba67d128a0fe4eff5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401338,7 +397377,7 @@ rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V4 : FILE
 		$s3 = "=SuBstr_rePlACe(" ascii
 
 	condition:
-		uint32(0)==0x68703f3c and $php at 0 and filesize >8KB and filesize <100KB and 2 of ($s*)
+		uint32( 0 ) == 0x68703f3c and $php at 0 and filesize > 8KB and filesize < 100KB and 2 of ( $s* )
 }
 rule SIGNATURE_BASE_APT_APT29_Wellmess_Dotnet_Unique_Strings : FILE
 {
@@ -401349,10 +397388,10 @@ rule SIGNATURE_BASE_APT_APT29_Wellmess_Dotnet_Unique_Strings : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L120-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L120-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "2285a264ffab59ab5a1eb4e2b9bcab9baf26750b6c551ee3094af56a4442ac41"
-		logic_hash = "90e8480aa50e18202007bcffdc8348290ad0ac0588c924b4f75ea425a6cae32d"
+		logic_hash = "v1_sha256_90e8480aa50e18202007bcffdc8348290ad0ac0588c924b4f75ea425a6cae32d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401366,7 +397405,7 @@ rule SIGNATURE_BASE_APT_APT29_Wellmess_Dotnet_Unique_Strings : FILE
 		$s6 = "WellMess" ascii
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint16(0x3c))==0x4550 and 3 of them
+		uint16( 0 ) == 0x5a4d and uint16( uint16( 0x3c ) ) == 0x4550 and 3 of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_Schedule : FILE
 {
@@ -401377,10 +397416,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_Schedule : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L138-L153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L138-L153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "d4f7ec82e51f1063b4d61302e5ff9268dd3233bb44269fc32cb57fb9240f96e2"
+		logic_hash = "v1_sha256_d4f7ec82e51f1063b4d61302e5ff9268dd3233bb44269fc32cb57fb9240f96e2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401393,7 +397432,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_Schedule : FILE
             01 7C 4F 0F 1F 80 00 00 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_2B62 : FILE
 {
@@ -401404,10 +397443,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_2B62 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L155-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L155-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "39ad6de70883fbe0377379c3cab15962372793043ebbf4054efb7cee3aff9104"
+		logic_hash = "v1_sha256_39ad6de70883fbe0377379c3cab15962372793043ebbf4054efb7cee3aff9104"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401416,7 +397455,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_2B62 : FILE
 		$ = "2b6233eb3e872ff78988f4a8f3f6a3ba"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Directory_Enumeration_Output_Strings : FILE
 {
@@ -401427,10 +397466,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Directory_Enumeration_Output_Strings : FI
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L169-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L169-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "8f029269f5a383737f38af04b05a16a71af5453bffe83e04ac53191eaa49d3e7"
+		logic_hash = "v1_sha256_8f029269f5a383737f38af04b05a16a71af5453bffe83e04ac53191eaa49d3e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401441,7 +397480,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Directory_Enumeration_Output_Strings : FI
 		$ = "----------Documents directory----------"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 2 of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and 2 of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Command_Elem_Cookie_Ga_Boundary_String : FILE
 {
@@ -401452,10 +397491,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Command_Elem_Cookie_Ga_Boundary_String :
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L185-L199"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L185-L199"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "65b31a12d8abb88fbb99fcc6b2707bec90e4edc35d0cf21903213eda5cacec88"
+		logic_hash = "v1_sha256_65b31a12d8abb88fbb99fcc6b2707bec90e4edc35d0cf21903213eda5cacec88"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401466,7 +397505,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Command_Elem_Cookie_Ga_Boundary_String :
 		$ = "------974767299852498929531610575"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 2 of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and 2 of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Round_Function : FILE
 {
@@ -401477,10 +397516,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Round_Function : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L201-L214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L201-L214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "c4979b7ec31581b43b6975be5d4b1bfa5562e5fe25bbb51bb7c388550ed80ac6"
+		logic_hash = "v1_sha256_c4979b7ec31581b43b6975be5d4b1bfa5562e5fe25bbb51bb7c388550ed80ac6"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401490,7 +397529,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Round_Function : FILE
             14 45 01 00 00 00 0F AF D0 0F BE C5 0F BE C9 0F AF C8 C1 FA 1B C0 E1 05 0A D1 8B 4D EC 0F BE C1 89 55 E4 8D 14 45 01 00 00 00 0F AF D0 8B C1}
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Add_Random_Commas_Spaces : FILE
 {
@@ -401501,10 +397540,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Add_Random_Commas_Spaces : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L216-L229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L216-L229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "046e222aabc9e596d9536702521b4729d990e1f327ded004ca984b73a8511a83"
+		logic_hash = "v1_sha256_046e222aabc9e596d9536702521b4729d990e1f327ded004ca984b73a8511a83"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401514,7 +397553,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Add_Random_Commas_Spaces : FILE
             02 68 ?? ?? ?? ?? EB 07 6A 01 68 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Modify_Alphabet_Custom_Encode : FILE
 {
@@ -401525,10 +397564,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Modify_Alphabet_Custom_Encode : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L231-L243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L231-L243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "f0f5bcad52b0b15dc74a51973ef2752234bd12d677c846b2f96fe569d906ea3b"
+		logic_hash = "v1_sha256_f0f5bcad52b0b15dc74a51973ef2752234bd12d677c846b2f96fe569d906ea3b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401538,7 +397577,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Modify_Alphabet_Custom_Encode : FILE
             64 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Custom_Encode_Decode : FILE
 {
@@ -401549,10 +397588,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Custom_Encode_Decode : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L245-L274"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L245-L274"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "536147bda9603d68748010f9db260af732fe0865a601ae1104538933b19c519b"
+		logic_hash = "v1_sha256_536147bda9603d68748010f9db260af732fe0865a601ae1104538933b19c519b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401578,7 +397617,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Custom_Encode_Decode : FILE
             C1 88 4A 62 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Remove_Chars_Comma_Space_Dot : FILE
 {
@@ -401589,10 +397628,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Remove_Chars_Comma_Space_Dot : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L276-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L276-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "652607e0cfe6f5ad6ede169e28f63e8262fc37cbc7baa2525e52e79572d9a468"
+		logic_hash = "v1_sha256_652607e0cfe6f5ad6ede169e28f63e8262fc37cbc7baa2525e52e79572d9a468"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401603,7 +397642,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Remove_Chars_Comma_Space_Dot : FILE
 		$ = {8A 18 80 FB 20 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of them
 }
 rule SIGNATURE_BASE_APT_APT29_Sorefang_Disk_Enumeration_Strings : FILE
 {
@@ -401614,10 +397653,10 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Disk_Enumeration_Strings : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt29_grizzly_steppe.yar#L291-L310"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt29_grizzly_steppe.yar#L291-L310"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064"
-		logic_hash = "4a225b767dc922625c333aea866638bc5e239137592e46c17563b9cc380b0eea"
+		logic_hash = "v1_sha256_4a225b767dc922625c333aea866638bc5e239137592e46c17563b9cc380b0eea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401633,7 +397672,7 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Disk_Enumeration_Strings : FILE
 		$ = "I can not het information about this disk\x0D\x0A"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of them
 }
 rule SIGNATURE_BASE_Invoke_Smbexec : FILE
 {
@@ -401644,9 +397683,9 @@ rule SIGNATURE_BASE_Invoke_Smbexec : FILE
 		date = "2017-06-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_invoke_thehash.yar#L12-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cc9feb7d4eadfc470aabf18d82c884f454ebcdd37f3ca6b0ee4b3634cd9e33ae"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_invoke_thehash.yar#L12-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cc9feb7d4eadfc470aabf18d82c884f454ebcdd37f3ca6b0ee4b3634cd9e33ae"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -401661,7 +397700,7 @@ rule SIGNATURE_BASE_Invoke_Smbexec : FILE
 		$s3 = "$SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \\svcctl" fullword ascii
 
 	condition:
-		( filesize <400KB and 1 of them )
+		( filesize < 400KB and 1 of them )
 }
 rule SIGNATURE_BASE_Invoke_Wmiexec_Gen_1
 {
@@ -401672,9 +397711,9 @@ rule SIGNATURE_BASE_Invoke_Wmiexec_Gen_1
 		date = "2017-06-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_invoke_thehash.yar#L32-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "12aeba5255527a337c49f1c4d1dc506a13ea02da69a8fc509c77bcb07c2135c8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_invoke_thehash.yar#L32-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_12aeba5255527a337c49f1c4d1dc506a13ea02da69a8fc509c77bcb07c2135c8"
 		score = 75
 		quality = 85
 		tags = ""
@@ -401702,9 +397741,9 @@ rule SIGNATURE_BASE_Invoke_Smbexec_Invoke_Wmiexec_1
 		date = "2017-06-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_invoke_thehash.yar#L53-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "feb2973cd7e2c221cd91ec543f1d943cf1b5d5d18fe74c8f7e58341f76f95b51"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_invoke_thehash.yar#L53-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_feb2973cd7e2c221cd91ec543f1d943cf1b5d5d18fe74c8f7e58341f76f95b51"
 		score = 75
 		quality = 85
 		tags = ""
@@ -401730,9 +397769,9 @@ rule SIGNATURE_BASE_Invoke_Wmiexec_Gen
 		date = "2017-06-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_invoke_thehash.yar#L72-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1ee79b7ea576adb71bde903756cda7af22e55eee9c4c3964cc9edc8930083fa2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_invoke_thehash.yar#L72-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1ee79b7ea576adb71bde903756cda7af22e55eee9c4c3964cc9edc8930083fa2"
 		score = 75
 		quality = 85
 		tags = ""
@@ -401759,9 +397798,9 @@ rule SIGNATURE_BASE_No_Powershell : FILE
 		date = "2016-05-21"
 		modified = "2023-12-05"
 		reference = "https://github.com/Ben0xA/nps"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_nopowershell.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9fba467cfbf8cad0c8e6cf1e1c7eacd8b0be869ebe6c5180f50f5cdefa8b5bb5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_nopowershell.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9fba467cfbf8cad0c8e6cf1e1c7eacd8b0be869ebe6c5180f50f5cdefa8b5bb5"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -401773,7 +397812,7 @@ rule SIGNATURE_BASE_No_Powershell : FILE
 		$s2 = "c:\\Development\\ghps\\nps\\nps\\obj\\x86\\Release\\nps.pdb" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and (1 of ($s*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 40KB and ( 1 of ( $s* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_APT_Nazar_Svchost_Commands
 {
@@ -401784,9 +397823,9 @@ rule SIGNATURE_BASE_APT_Nazar_Svchost_Commands
 		date = "2020-04-26"
 		modified = "2023-12-05"
 		reference = "https://www.epicturla.com/blog/the-lost-nazar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nazar.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c71e8a3b2d69c51ed3f822f62b90906fc0a21d32f1f1850cdef71c335964f9b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nazar.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c71e8a3b2d69c51ed3f822f62b90906fc0a21d32f1f1850cdef71c335964f9b1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -401812,9 +397851,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Local_URL : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e95e5e97760d9b565184c588fdafe8408cdab61959aee5221485df53ef5f51d6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e95e5e97760d9b565184c588fdafe8408cdab61959aee5221485df53ef5f51d6"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -401825,7 +397864,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Local_URL : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		$file and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		$file and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_SMB_URL : FILE
 {
@@ -401836,10 +397875,10 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_SMB_URL : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L21-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L21-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e0bef7497fcb284edb0c65b59d511830"
-		logic_hash = "4903c8f4bb08e799f6787ad29cf7688f354f97a065bcd24c58d3ccd3778a6a15"
+		logic_hash = "v1_sha256_4903c8f4bb08e799f6787ad29cf7688f354f97a065bcd24c58d3ccd3778a6a15"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -401850,7 +397889,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_SMB_URL : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		$file and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		$file and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconremote_Smborlocal : FILE
 {
@@ -401861,9 +397900,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconremote_Smborlocal : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ItsReallyNick/status/1176241449148588032"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L61-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8c49908c7f52ebcd512ff2dc8c40392767769130b9d39abb9d5fc9e130edb65c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L61-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8c49908c7f52ebcd512ff2dc8c40392767769130b9d39abb9d5fc9e130edb65c"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -401874,7 +397913,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconremote_Smborlocal : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		$icon and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		$icon and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Shortcut_Hotkey : FILE
 {
@@ -401885,9 +397924,9 @@ rule SIGNATURE_BASE_Methodology_Shortcut_Hotkey : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L80-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a48f7c1125218ee89f58f1517e81150038a5d71889d847e7690b13c818b32fb5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L80-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a48f7c1125218ee89f58f1517e81150038a5d71889d847e7690b13c818b32fb5"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -401898,7 +397937,7 @@ rule SIGNATURE_BASE_Methodology_Shortcut_Hotkey : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		$hotkey and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		$hotkey and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Baseurlsyntax : FILE
 {
@@ -401909,9 +397948,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Baseurlsyntax : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L99-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4aa29bedb5689fe16c067f5ea933e56804085712c7469b138d8b658a30a7eb67"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L99-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4aa29bedb5689fe16c067f5ea933e56804085712c7469b138d8b658a30a7eb67"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -401923,7 +397962,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Baseurlsyntax : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		all of ($baseurl*) and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		all of ( $baseurl* ) and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconnotfromexeordllorico : FILE
 {
@@ -401934,9 +397973,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconnotfromexeordllorico : F
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ItsReallyNick/status/1176229087196696577"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L161-L179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "957fe9f24d08033cf6e29d7e202e04bfb579577d3850a99e97da6b70924ae88e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L161-L179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_957fe9f24d08033cf6e29d7e202e04bfb579577d3850a99e97da6b70924ae88e"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -401948,7 +397987,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconnotfromexeordllorico : F
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		any of ($url*) and $icon and not $icon_negate and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		any of ( $url* ) and $icon and not $icon_negate and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Evasion : FILE
 {
@@ -401959,9 +397998,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Evasion : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/DissectMalware/status/1176736510856634368"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L181-L198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c4fafae6af3ed5cc2e83e30427107d1c42cc4bc86d5c6a60e26953a11847029f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L181-L198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c4fafae6af3ed5cc2e83e30427107d1c42cc4bc86d5c6a60e26953a11847029f"
 		score = 50
 		quality = 35
 		tags = "FILE"
@@ -401972,7 +398011,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Evasion : FILE
 		$filetype_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		any of ($filetype*) and $URI and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		any of ( $filetype* ) and $URI and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Lolcommand : FILE
 {
@@ -401983,9 +398022,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Lolcommand : FILE
 		date = "2019-09-27"
 		modified = "2021-02-14"
 		reference = "https://twitter.com/ItsReallyNick/status/1176601500069576704"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L201-L219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4ac9a555e61303a173443de2a189536c8ea0fc32ee73c589dd104275c7967c57"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L201-L219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4ac9a555e61303a173443de2a189536c8ea0fc32ee73c589dd104275c7967c57"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -401996,7 +398035,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Lolcommand : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		any of ($url*) and any of ($file*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		any of ( $url* ) and any of ( $file* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Webdav : FILE
 {
@@ -402007,9 +398046,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Webdav : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cglyer/status/1176243536754282497"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L222-L239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4fec084392140245eeb25bb512f3a4631ec6be08c197ec130a907fc118161197"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L222-L239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4fec084392140245eeb25bb512f3a4631ec6be08c197ec130a907fc118161197"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -402020,7 +398059,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Webdav : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		any of ($url*) and any of ($file*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		any of ( $url* ) and any of ( $file* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Scripturl : FILE
 {
@@ -402031,9 +398070,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Scripturl : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L241-L259"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ece0013dbc9836fa800f99a10ab46c1eb081e1c04fe45fe17be26ffac1d464e9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L241-L259"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ece0013dbc9836fa800f99a10ab46c1eb081e1c04fe45fe17be26ffac1d464e9"
 		score = 50
 		quality = 35
 		tags = "FILE"
@@ -402044,7 +398083,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Scripturl : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		any of ($url*) and any of ($file*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		any of ( $url* ) and any of ( $file* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_HTTP : FILE
 {
@@ -402055,9 +398094,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_HTTP : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L261-L278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c7c23c1253bf089519dec5f141f486425c6804640d9bffac9ce4c986ce25d323"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L261-L278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c7c23c1253bf089519dec5f141f486425c6804640d9bffac9ce4c986ce25d323"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -402068,7 +398107,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_HTTP : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		$icon and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		$icon and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_SMB : FILE
 {
@@ -402079,9 +398118,9 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_SMB : FILE
 		date = "2019-09-27"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_url_persitence.yar#L280-L297"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d9caa64ac730d34a2dcfb3368f8302849275b6ee16fe31f20978d72382b0d73"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_url_persitence.yar#L280-L297"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d9caa64ac730d34a2dcfb3368f8302849275b6ee16fe31f20978d72382b0d73"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -402092,7 +398131,7 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_SMB : FILE
 		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		$icon and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		$icon and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
 }
 rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1 : FILE
 {
@@ -402103,9 +398142,9 @@ rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1 : FILE
 		date = "2022-02-24"
 		modified = "2023-12-05"
 		reference = "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_hermetic_wiper.yar#L2-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1cf124f7533a060da8aff1a18f64a94b183502e58ffdfca012d72d99d30225ba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_hermetic_wiper.yar#L2-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1cf124f7533a060da8aff1a18f64a94b183502e58ffdfca012d72d99d30225ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402135,7 +398174,7 @@ rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1 : FILE
 		$op2 = { 13 fa 8b 55 f4 4e 3b f3 7f e6 8a 45 0f 01 4d f0 0f 57 c0 }
 
 	condition:
-		( uint16(0)==0x5a53 or uint16(0)==0x5a4d) and filesize <400KB and (1 of ($x*) or 3 of them )
+		( uint16( 0 ) == 0x5a53 or uint16( 0 ) == 0x5a4d ) and filesize < 400KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
 {
@@ -402146,9 +398185,9 @@ rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
 		date = "2022-02-25"
 		modified = "2023-12-05"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_hermetic_wiper.yar#L40-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5e917618a5172c68b4b32ba9e63402c2a98ccb027276b317ec169a4fef219de1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_hermetic_wiper.yar#L40-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5e917618a5172c68b4b32ba9e63402c2a98ccb027276b317ec169a4fef219de1"
 		score = 75
 		quality = 85
 		tags = ""
@@ -402169,7 +398208,7 @@ rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
 		$fp1 = "<html" ascii
 
 	condition:
-		1 of ($sx*) or all of ($sa*) and not 1 of ($fp*)
+		1 of ( $sx* ) or all of ( $sa* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
 {
@@ -402180,9 +398219,9 @@ rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
 		date = "2022-02-25"
 		modified = "2023-12-05"
 		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ua_hermetic_wiper.yar#L72-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "56368ba1c97fe3455312b6ee86dcd1a21677f7dfa3836e76ada4b236a5b2c171"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ua_hermetic_wiper.yar#L72-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_56368ba1c97fe3455312b6ee86dcd1a21677f7dfa3836e76ada4b236a5b2c171"
 		score = 85
 		quality = 85
 		tags = ""
@@ -402194,7 +398233,7 @@ rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
 		$sa3 = "cmd.exe /Q /c move CSIDL_SYSTEM_DRIVE" ascii wide
 
 	condition:
-		$a0 and 1 of ($s*)
+		$a0 and 1 of ( $s* )
 }
 import "pe"
 
@@ -402207,9 +398246,9 @@ rule SIGNATURE_BASE_Elise_Jan18_1 : FILE
 		date = "2018-01-24"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/blu3_team/status/955971742329135105"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_lotusblossom_elise.yar#L13-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d43486db0d4263f91924da89f1922ad965ed91eadd07ae0705eecd371f31fa44"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_lotusblossom_elise.yar#L13-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d43486db0d4263f91924da89f1922ad965ed91eadd07ae0705eecd371f31fa44"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402222,7 +398261,7 @@ rule SIGNATURE_BASE_Elise_Jan18_1 : FILE
 		$a1 = "donotbotherme" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and (pe.imphash()=="e9478ee4ebf085d1f14f64ba96ef082f" or (1 of ($s*) and $a1))
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and ( pe.imphash ( ) == "e9478ee4ebf085d1f14f64ba96ef082f" or ( 1 of ( $s* ) and $a1 ) )
 }
 rule SIGNATURE_BASE_MSIL_SUSP_OBFUSC_Xorstringsnet : FILE
 {
@@ -402233,9 +398272,9 @@ rule SIGNATURE_BASE_MSIL_SUSP_OBFUSC_Xorstringsnet : FILE
 		date = "2023-03-26"
 		modified = "2023-12-05"
 		reference = "https://github.com/dr4k0nia/yara-rules"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_net_xorstrings.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6d023a80bd8f5709721c3ace8a7230b847ca4bd2a1aff502a25333ffc8bf75ca"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_net_xorstrings.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6d023a80bd8f5709721c3ace8a7230b847ca4bd2a1aff502a25333ffc8bf75ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402252,7 +398291,7 @@ rule SIGNATURE_BASE_MSIL_SUSP_OBFUSC_Xorstringsnet : FILE
 		$a7 = "<PrivateImplementationsDetails{" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25MB and $pattern and 2 of ($a*)
+		uint16( 0 ) == 0x5a4d and filesize < 25MB and $pattern and 2 of ( $a* )
 }
 rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Eraser_1 : FILE
 {
@@ -402263,9 +398302,9 @@ rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Eraser_1 : FILE
 		date = "2020-05-16"
 		modified = "2023-12-05"
 		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_academic_data_centers_camp_may20.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9a0410e86fa8fb8b599e5b8a6508d6889eb6e26600f0ecf222561ac4a169676d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_academic_data_centers_camp_may20.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9a0410e86fa8fb8b599e5b8a6508d6889eb6e26600f0ecf222561ac4a169676d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402278,7 +398317,7 @@ rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Eraser_1 : FILE
                00 00 00 48 89 C7 E8 }
 
 	condition:
-		uint16(0)==0x457f and filesize <60KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 60KB and all of them
 }
 rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Loader_1 : FILE
 {
@@ -402289,9 +398328,9 @@ rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Loader_1 : FILE
 		date = "2020-05-16"
 		modified = "2023-12-05"
 		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_academic_data_centers_camp_may20.yar#L20-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a73883f9fdf3d53694d9f9efec5f8f15994c5fd80c5f2a87b1741db6b954a023"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_academic_data_centers_camp_may20.yar#L20-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a73883f9fdf3d53694d9f9efec5f8f15994c5fd80c5f2a87b1741db6b954a023"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402303,7 +398342,7 @@ rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Loader_1 : FILE
 		$sc2 = { 01 48 39 EB 75 EA 48 83 C4 08 5B 5D 41 5C 41 5D }
 
 	condition:
-		uint16(0)==0x457f and filesize <10KB and all of them
+		uint16( 0 ) == 0x457f and filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_1 : CVE_2022_41040 CVE_2022_41082
 {
@@ -402314,9 +398353,9 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_1
 		date = "2022-12-22"
 		modified = "2023-12-05"
 		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxynotshell_owassrf_dec22.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1e8f5a3440f8b4b1850fddbd19f63796ad0f28178c678e9f464b7e4ab5ca944f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxynotshell_owassrf_dec22.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1e8f5a3440f8b4b1850fddbd19f63796ad0f28178c678e9f464b7e4ab5ca944f"
 		score = 70
 		quality = 85
 		tags = "CVE-2022-41040, CVE-2022-41082"
@@ -402330,7 +398369,7 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_1
 		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
 
 	condition:
-		all of ($s*) and not 1 of ($fp*)
+		all of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_2 : CVE_2022_41040 CVE_2022_41082
 {
@@ -402341,9 +398380,9 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_2
 		date = "2022-12-22"
 		modified = "2023-12-05"
 		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxynotshell_owassrf_dec22.yar#L24-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "73ce86b7a673719c916666fa06963b774edad5b2cd804994614afd83ea75ecef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxynotshell_owassrf_dec22.yar#L24-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_73ce86b7a673719c916666fa06963b774edad5b2cd804994614afd83ea75ecef"
 		score = 60
 		quality = 85
 		tags = "CVE-2022-41040, CVE-2022-41082"
@@ -402357,7 +398396,7 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_2
 		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
 
 	condition:
-		all of ($s*) and not 1 of ($fp*)
+		all of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_3 : CVE_2022_41040 CVE_2022_41082
 {
@@ -402368,9 +398407,9 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_3
 		date = "2022-12-22"
 		modified = "2023-12-05"
 		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxynotshell_owassrf_dec22.yar#L47-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "607d3743a46e0c5000b9c7847dd89f5d7ccf29f4f1af9bce6870d7738f071f5c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxynotshell_owassrf_dec22.yar#L47-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_607d3743a46e0c5000b9c7847dd89f5d7ccf29f4f1af9bce6870d7738f071f5c"
 		score = 60
 		quality = 85
 		tags = "CVE-2022-41040, CVE-2022-41082"
@@ -402384,7 +398423,7 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_3
 		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
 
 	condition:
-		1 of ($sa*) and $sb1 and not 1 of ($fp*)
+		1 of ( $sa* ) and $sb1 and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_Powershell_Proxy_Log_Dec22_1 : CVE_2022_41040 CVE_2022_41082
 {
@@ -402395,9 +398434,9 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_Powershell_Proxy_Log_Dec22_1 : CVE_20
 		date = "2022-12-22"
 		modified = "2023-01-26"
 		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_proxynotshell_owassrf_dec22.yar#L68-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f2aac61bc17f74901ec8d638d5cfaaa45bbd2a4e40e5d915bf2a946daed411d2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_proxynotshell_owassrf_dec22.yar#L68-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f2aac61bc17f74901ec8d638d5cfaaa45bbd2a4e40e5d915bf2a946daed411d2"
 		score = 70
 		quality = 85
 		tags = "CVE-2022-41040, CVE-2022-41082"
@@ -402409,7 +398448,7 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_Powershell_Proxy_Log_Dec22_1 : CVE_20
 		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
 
 	condition:
-		$re1 and not 1 of ($fp*)
+		$re1 and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Rtf_Cve2017_11882_Ole : MALICIOUS EXPLOIT CVE_2017_11882
 {
@@ -402420,10 +398459,10 @@ rule SIGNATURE_BASE_Rtf_Cve2017_11882_Ole : MALICIOUS EXPLOIT CVE_2017_11882
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_11882.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_11882.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "51cf2a6c0c1a29abca9fd13cb22421da"
-		logic_hash = "6856d3c78cc06899d2bc1f876dce6b718513ebad80f37d7b5914a14d1da5064c"
+		logic_hash = "v1_sha256_6856d3c78cc06899d2bc1f876dce6b718513ebad80f37d7b5914a14d1da5064c"
 		score = 60
 		quality = 85
 		tags = "MALICIOUS, EXPLOIT, CVE_2017_11882"
@@ -402434,7 +398473,7 @@ rule SIGNATURE_BASE_Rtf_Cve2017_11882_Ole : MALICIOUS EXPLOIT CVE_2017_11882
 		$winexec = { 12 0c 43 00 }
 
 	condition:
-		all of them and @font>@headers and @winexec==@font+5+44
+		all of them and @font > @headers and @winexec == @font + 5 + 44
 }
 rule SIGNATURE_BASE_Rtf_Cve2017_11882 : MALICIOUS EXPLOIT CVE_2017_1182
 {
@@ -402445,10 +398484,10 @@ rule SIGNATURE_BASE_Rtf_Cve2017_11882 : MALICIOUS EXPLOIT CVE_2017_1182
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_11882.yar#L20-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_11882.yar#L20-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "51cf2a6c0c1a29abca9fd13cb22421da"
-		logic_hash = "37a65f086d393aae3dc88b3dd2520fff6e96b92fd6ae1be0a110f4eb826ae12d"
+		logic_hash = "v1_sha256_37a65f086d393aae3dc88b3dd2520fff6e96b92fd6ae1be0a110f4eb826ae12d"
 		score = 60
 		quality = 81
 		tags = "MALICIOUS, EXPLOIT, CVE_2017_1182"
@@ -402463,7 +398502,7 @@ rule SIGNATURE_BASE_Rtf_Cve2017_11882 : MALICIOUS EXPLOIT CVE_2017_1182
 		$winexec = { 31 32 30 63 34 33 30 30 }
 
 	condition:
-		all of them and @font>@headers and @winexec==@font+((5+44)*2)
+		all of them and @font > @headers and @winexec == @font + ( ( 5 + 44 ) * 2 )
 }
 rule SIGNATURE_BASE_Packager_Cve2017_11882 : CVE_2017_11882 FILE
 {
@@ -402474,9 +398513,9 @@ rule SIGNATURE_BASE_Packager_Cve2017_11882 : CVE_2017_11882 FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_11882.yar#L41-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "94e0c70e8140bb7fa3d184447617b534a8b9a24cdad535e6818be9662f0b9144"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_11882.yar#L41-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_94e0c70e8140bb7fa3d184447617b534a8b9a24cdad535e6818be9662f0b9144"
 		score = 60
 		quality = 79
 		tags = "CVE-2017-11882, FILE"
@@ -402488,7 +398527,7 @@ rule SIGNATURE_BASE_Packager_Cve2017_11882 : CVE_2017_11882 FILE
 		$header_and_shellcode = /03010[0,1][0-9a-fA-F]{108}00/ ascii nocase
 
 	condition:
-		uint32be(0)==0x7B5C7274 and all of them
+		uint32be( 0 ) == 0x7B5C7274 and all of them
 }
 rule SIGNATURE_BASE_CVE_2017_11882_RTF : CVE_2017_11882 FILE
 {
@@ -402499,9 +398538,9 @@ rule SIGNATURE_BASE_CVE_2017_11882_RTF : CVE_2017_11882 FILE
 		date = "2018-02-13"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_11882.yar#L58-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "729fa8215a24990371369158d4582cc0ba9387eb0e7221860bf7216046c447cb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_11882.yar#L58-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_729fa8215a24990371369158d4582cc0ba9387eb0e7221860bf7216046c447cb"
 		score = 60
 		quality = 85
 		tags = "CVE-2017-11882, FILE"
@@ -402517,7 +398556,7 @@ rule SIGNATURE_BASE_CVE_2017_11882_RTF : CVE_2017_11882 FILE
 		$s3 = "2e687461000000000000000000000000000000000000000000000"
 
 	condition:
-		( uint32be(0)==0x7B5C7274 or uint32be(0)==0x7B5C2A5C) and filesize <300KB and (1 of ($x*) or 2 of them )
+		( uint32be( 0 ) == 0x7B5C7274 or uint32be( 0 ) == 0x7B5C2A5C ) and filesize < 300KB and ( 1 of ( $x* ) or 2 of them )
 }
 rule SIGNATURE_BASE_EXP_Potential_CVE_2017_11882 : FILE
 {
@@ -402528,9 +398567,9 @@ rule SIGNATURE_BASE_EXP_Potential_CVE_2017_11882 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2017_11882.yar#L82-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ea28010c4de86ce94537f6ab0892f6b9e28b0c775706e38bde20f48bf968d58f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2017_11882.yar#L82-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ea28010c4de86ce94537f6ab0892f6b9e28b0c775706e38bde20f48bf968d58f"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -402548,7 +398587,7 @@ rule SIGNATURE_BASE_EXP_Potential_CVE_2017_11882 : FILE
 		$address = { 12 0C 43 00 }
 
 	condition:
-		uint16(0)==0xcfd0 and $docfilemagic at 0 and any of ($mshta,$http,$https,$cmd,$pwsh,$exe) and any of ($equation1,$equation2) and $address
+		uint16( 0 ) == 0xcfd0 and $docfilemagic at 0 and any of ( $mshta , $http , $https , $cmd , $pwsh , $exe ) and any of ( $equation1 , $equation2 ) and $address
 }
 rule SIGNATURE_BASE_Crime_Win32_Ransom_Maze_Dll_1 : FILE
 {
@@ -402559,9 +398598,9 @@ rule SIGNATURE_BASE_Crime_Win32_Ransom_Maze_Dll_1 : FILE
 		date = "2020-04-18"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/VK_Intel/status/1251388507219726338"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_maze_ransomware.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5b76636c05141687fa5cc507ac67d6a5d1f6c89166fd302e94fe61b412451159"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_maze_ransomware.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5b76636c05141687fa5cc507ac67d6a5d1f6c89166fd302e94fe61b412451159"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402574,7 +398613,7 @@ rule SIGNATURE_BASE_Crime_Win32_Ransom_Maze_Dll_1 : FILE
 		$tick_server_call = { ff ?? ?? 8b ?? ?? ?? ?? ?? ff d6 8b ?? 89 f9 50 ff ?? ?? ff d6 8d ?? ?? ?? 89 ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 b9 67 66 66 66 89 c5 f7 e9 89 d0 d1 fa c1 e8 1f 01 c2 8d ?? ?? 29 c5 56 e8 ?? ?? ?? ?? 83 c4 04 b9 56 55 55 55 89 c6 f7 e9 89 f9 89 d0 c1 e8 1f 01 d0 8d ?? ?? 29 c6 8b ?? 55 56 ff ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 89 ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 c5 50 ff d3 89 c6 ff ?? ?? ?? ff d3 8b ?? ?? ?? 01 f0 3d ff 03 00 00 0f ?? ?? ?? ?? ?? 55 ff ?? ?? ?? 68 a2 95 c3 00 53 ff ?? ?? ?? ?? ?? 83 c4 10 c6 ?? ?? ?? c6 ?? ?? ?? ?? }
 
 	condition:
-		( uint16(0)==0x5a4d and 3 of them ) or all of them
+		( uint16( 0 ) == 0x5a4d and 3 of them ) or all of them
 }
 rule SIGNATURE_BASE_MAL_Envrial_Jan18_1 : FILE
 {
@@ -402585,9 +398624,9 @@ rule SIGNATURE_BASE_MAL_Envrial_Jan18_1 : FILE
 		date = "2018-01-21"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/malwrhunterteam/status/953313514629853184"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_envrial.yar#L11-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f047bedaac4dd934657b282a2587c55f3087a7cceb1a80becf14e7db3c365e8b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_envrial.yar#L11-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f047bedaac4dd934657b282a2587c55f3087a7cceb1a80becf14e7db3c365e8b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402608,7 +398647,7 @@ rule SIGNATURE_BASE_MAL_Envrial_Jan18_1 : FILE
 		$s4 = "files/upload.php?user={0}&hwid={1}" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 3 of them or 2 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 3 of them or 2 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Servantshell : FILE
 {
@@ -402619,9 +398658,9 @@ rule SIGNATURE_BASE_Servantshell : FILE
 		date = "2017-02-02"
 		modified = "2023-12-05"
 		reference = "https://tinyurl.com/jmp7nrs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_servantshell.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "739057dc95831c9ed35981b40c606ecd0b3fd2118b42ed7c09e200dc0bc395db"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_servantshell.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_739057dc95831c9ed35981b40c606ecd0b3fd2118b42ed7c09e200dc0bc395db"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -402634,7 +398673,7 @@ rule SIGNATURE_BASE_Servantshell : FILE
 		$string5 = "CheckDT"
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
 rule SIGNATURE_BASE_Shamoon2_Wiper : FILE
 {
@@ -402645,9 +398684,9 @@ rule SIGNATURE_BASE_Shamoon2_Wiper : FILE
 		date = "2016-12-01"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/jKIfGB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_shamoon2.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "245b03d9606f2e391f53a60aa333c6b037aa1f013794d83b761813d54782b885"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_shamoon2.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_245b03d9606f2e391f53a60aa333c6b037aa1f013794d83b761813d54782b885"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -402662,7 +398701,7 @@ rule SIGNATURE_BASE_Shamoon2_Wiper : FILE
 		$s2 = "\\\\?\\ElRawDisk" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 2 of them ) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_Shamoon2_Comcomp : FILE
 {
@@ -402673,9 +398712,9 @@ rule SIGNATURE_BASE_Shamoon2_Comcomp : FILE
 		date = "2016-12-01"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/jKIfGB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_shamoon2.yar#L30-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "edebdbcf17bd9fadc67c7d76839cf569f0ea20127d4e0d216411c35e9ba54208"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_shamoon2.yar#L30-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_edebdbcf17bd9fadc67c7d76839cf569f0ea20127d4e0d216411c35e9ba54208"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -402689,7 +398728,7 @@ rule SIGNATURE_BASE_Shamoon2_Comcomp : FILE
 		$op3 = { 0c 3b 40 8d 4e 01 47 3b c1 7c d8 83 fe 03 7d 1c }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ( all of ($s*) or all of ($op*))
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( all of ( $s* ) or all of ( $op* ) )
 }
 rule SIGNATURE_BASE_Eldos_Rawdisk : FILE
 {
@@ -402700,9 +398739,9 @@ rule SIGNATURE_BASE_Eldos_Rawdisk : FILE
 		date = "2016-12-01"
 		modified = "2023-01-27"
 		reference = "https://goo.gl/jKIfGB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_shamoon2.yar#L50-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ab09371b91ab6889f342c7992108ad374b5ecf67b6c2144a6282670f177d0f15"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_shamoon2.yar#L50-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ab09371b91ab6889f342c7992108ad374b5ecf67b6c2144a6282670f177d0f15"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -402722,7 +398761,7 @@ rule SIGNATURE_BASE_Eldos_Rawdisk : FILE
 		$op3 = { 74 0a 3d 00 94 35 77 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 4 of them )
 }
 rule SIGNATURE_BASE_Persistence_Agent_Macos : FILE
 {
@@ -402733,10 +398772,10 @@ rule SIGNATURE_BASE_Persistence_Agent_Macos : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://ghostbin.com/paste/mz5nf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_osx_pyagent_persistence.yar#L1-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_osx_pyagent_persistence.yar#L1-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
-		logic_hash = "2613fcb32cbdbb24df6c48fcb5d16549783e50246d2cdb8c473375644dd88254"
+		logic_hash = "v1_sha256_2613fcb32cbdbb24df6c48fcb5d16549783e50246d2cdb8c473375644dd88254"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -402755,7 +398794,7 @@ rule SIGNATURE_BASE_Persistence_Agent_Macos : FILE
 		$einterval_b = /(AHUAbgBBAHQATABvAGEAZA|dW5BdExvYW|IAdQBuAEEAdABMAG8AYQBkA|J1bkF0TG9hZ|UgB1AG4AQQB0AEwAbwBhAGQA|UnVuQXRMb2Fk)/ ascii
 
 	condition:
-		uint32(0)==0x752f2123 and $h1 at 0 and filesize <120KB and (( all of ($s_*) and 1 of ($sinterval*)) or ( all of ($e_*) and 1 of ($einterval*)))
+		uint32( 0 ) == 0x752f2123 and $h1 at 0 and filesize < 120KB and ( ( all of ( $s_* ) and 1 of ( $sinterval* ) ) or ( all of ( $e_* ) and 1 of ( $einterval* ) ) )
 }
 rule SIGNATURE_BASE_TA459_Malware_May17_1 : FILE
 {
@@ -402766,9 +398805,9 @@ rule SIGNATURE_BASE_TA459_Malware_May17_1 : FILE
 		date = "2017-05-31"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/RLf9qU"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta459.yar#L12-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2655d4c3a28ad2f77bbf50cd3dface7de49f675f0f974aa44d9b69c3f803da30"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta459.yar#L12-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2655d4c3a28ad2f77bbf50cd3dface7de49f675f0f974aa44d9b69c3f803da30"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402780,7 +398819,7 @@ rule SIGNATURE_BASE_TA459_Malware_May17_1 : FILE
 		$s6 = "CW&mhAklnfVULL" ascii
 
 	condition:
-		( uint16(0)==0x6152 and filesize <800KB and all of them )
+		( uint16( 0 ) == 0x6152 and filesize < 800KB and all of them )
 }
 rule SIGNATURE_BASE_TA459_Malware_May17_2 : FILE
 {
@@ -402791,9 +398830,9 @@ rule SIGNATURE_BASE_TA459_Malware_May17_2 : FILE
 		date = "2017-05-31"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/RLf9qU"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ta459.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9904f3905672e5209df037dff1fa2e4d88ee33531096045eb9b9f7460458b6a2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ta459.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9904f3905672e5209df037dff1fa2e4d88ee33531096045eb9b9f7460458b6a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402807,10 +398846,8 @@ rule SIGNATURE_BASE_TA459_Malware_May17_2 : FILE
 		$s2 = "AYou may need to run this self-extracting archive as administrator" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and all of ($a*) and 1 of ($s*))
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and all of ( $a* ) and 1 of ( $s* ) )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 : FILE
 {
 	meta:
@@ -402820,9 +398857,9 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 : FILE
 		date = "2023-04-20"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4fe1a1b09344cd84f981b193b480d23807893b59ad781868d82089a7306c042f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4fe1a1b09344cd84f981b193b480d23807893b59ad781868d82089a7306c042f"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -402834,10 +398871,8 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 : FILE
 		$op3 = { 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
 {
 	meta:
@@ -402847,9 +398882,9 @@ rule SIGNATURE_BASE_SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
 		date = "2023-04-20"
 		modified = "2023-04-21"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L19-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ccb482a7634dc24fde03b5730bf28a9e028f8d5a9ad46ba9663d1b520264d8f4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L19-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ccb482a7634dc24fde03b5730bf28a9e028f8d5a9ad46ba9663d1b520264d8f4"
 		score = 75
 		quality = 85
 		tags = ""
@@ -402863,8 +398898,6 @@ rule SIGNATURE_BASE_SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
 	condition:
 		2 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1 : FILE
 {
 	meta:
@@ -402874,9 +398907,9 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1 : FILE
 		date = "2023-04-20"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L37-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "439a201e6a44a00a31fd13efc83a1acf858a52201e3ab48d5cf095bae1e48cf7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L37-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_439a201e6a44a00a31fd13efc83a1acf858a52201e3ab48d5cf095bae1e48cf7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402891,10 +398924,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1 : FILE
 		$rh4 = { CB 8A 35 66 8F EB 5B 35 8F EB 5B 35 8F EB 5B 35 D4 83 5F 34 85 EB 5B 35 D4 83 58 34 8A EB 5B 35 D4 83 5E 34 09 EB 5B 35 77 9B 5E 34 92 EB 5B 35 77 9B 5F 34 81 EB 5B 35 77 9B 58 34 86 EB 5B 35 D4 83 5A 34 8C EB 5B 35 8F EB 5A 35 D3 EB 5B 35 37 9A 52 34 8C EB 5B 35 37 9A 58 34 8E EB 5B 35 37 9A 5B 34 8E EB 5B 35 37 9A 59 34 8E EB 5B 35 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 1 of ($rh*)
+		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and 1 of ( $rh* )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2 : FILE
 {
 	meta:
@@ -402904,9 +398935,9 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2 : FILE
 		date = "2023-04-20"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L57-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "62f74faa8f136f4dc63a4b703cffcb97b438cc4f180d5d127d1fc4b86d3cd1d1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L57-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_62f74faa8f136f4dc63a4b703cffcb97b438cc4f180d5d127d1fc4b86d3cd1d1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402922,10 +398953,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2 : FILE
 		$ss2 = "__tutma" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 : FILE
 {
 	meta:
@@ -402935,10 +398964,10 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 : FILE
 		date = "2023-04-20"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L78-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L78-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "c6441c961dcad0fe127514a918eaabd4"
-		logic_hash = "2109340edfb1891baef5bd92ba3c9da77f891341de9e8094060a649de62fade2"
+		logic_hash = "v1_sha256_2109340edfb1891baef5bd92ba3c9da77f891341de9e8094060a649de62fade2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402952,10 +398981,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 : FILE
 		$se1 = "DllGetClassObject" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4 : FILE
 {
 	meta:
@@ -402965,9 +398992,9 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4 : FILE
 		date = "2023-04-20"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L98-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2a875c39a43ff054ed5a6cf2fa1f17c2adc189452582763db8ceddfa652abfbf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L98-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2a875c39a43ff054ed5a6cf2fa1f17c2adc189452582763db8ceddfa652abfbf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -402984,10 +399011,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4 : FILE
 		$se1 = "DllGetClassObject" fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5 : FILE
 {
 	meta:
@@ -402997,9 +399022,9 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5 : FILE
 		date = "2023-04-20"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L120-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d43b8198ad224bee8d290dd7031d73f76a7d957a2e3b44d89e7aaf5f2c94c65"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L120-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d43b8198ad224bee8d290dd7031d73f76a7d957a2e3b44d89e7aaf5f2c94c65"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403019,10 +399044,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5 : FILE
 		$ss9 = "NtWaitForSingleObject" ascii fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6 : FILE
 {
 	meta:
@@ -403032,9 +399055,9 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6 : FILE
 		date = "2023-04-20"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L145-L164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d3b1e5f7a6b73fc4cdc5abe19a412130cde33c2d52c0ad78256b865e018e3794"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L145-L164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d3b1e5f7a6b73fc4cdc5abe19a412130cde33c2d52c0ad78256b865e018e3794"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403050,10 +399073,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6 : FILE
 		$ss6 = "CreateFileW" ascii fullword
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_NK_MAL_M_Hunting_POOLRAT
 {
 	meta:
@@ -403064,9 +399085,9 @@ rule SIGNATURE_BASE_SUSP_NK_MAL_M_Hunting_POOLRAT
 		modified = "2023-12-05"
 		old_rule_name = "APT_NK_MAL_M_Hunting_POOLRAT"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L166-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ac8db844a9c4ed961930417809afb706ea948c4509a4be1eaeed77f09c86069d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L166-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ac8db844a9c4ed961930417809afb706ea948c4509a4be1eaeed77f09c86069d"
 		score = 70
 		quality = 83
 		tags = ""
@@ -403081,10 +399102,8 @@ rule SIGNATURE_BASE_SUSP_NK_MAL_M_Hunting_POOLRAT
 		$str1 = "--N9dLfqxHNUUw8qaUPqggVTpX-" wide ascii nocase
 
 	condition:
-		any of ($s*) or $str1
+		any of ( $s* ) or $str1
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_NK_Tradingtech_Forensicartifacts_Apr23_1 : FILE
 {
 	meta:
@@ -403094,9 +399113,9 @@ rule SIGNATURE_BASE_APT_NK_Tradingtech_Forensicartifacts_Apr23_1 : FILE
 		date = "2023-04-20"
 		modified = "2023-04-21"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L204-L225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "50329427e56b70335a12f0dde87a36ac95838377482eebab334d252332fe481b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L204-L225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_50329427e56b70335a12f0dde87a36ac95838377482eebab334d252332fe481b"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -403110,7 +399129,7 @@ rule SIGNATURE_BASE_APT_NK_Tradingtech_Forensicartifacts_Apr23_1 : FILE
 		$fp1 = "<html"
 
 	condition:
-		not uint16(0)==0x5025 and 1 of ($x*) and not 1 of ($fp*)
+		not uint16( 0 ) == 0x5025 and 1 of ( $x* ) and not 1 of ( $fp* )
 }
 import "pe"
 
@@ -403123,9 +399142,9 @@ rule SIGNATURE_BASE_SUSP_TH_APT_UNC4736_Tradingtech_Cert_Apr23_1
 		date = "2023-04-20"
 		modified = "2023-12-05"
 		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nk_tradingtech_apr23.yar#L227-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "47941828b3c18ed39eddacbc73e147651a9bd48e1a0f7b9847ff1d4c6fea6afd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nk_tradingtech_apr23.yar#L227-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_47941828b3c18ed39eddacbc73e147651a9bd48e1a0f7b9847ff1d4c6fea6afd"
 		score = 65
 		quality = 85
 		tags = ""
@@ -403136,7 +399155,7 @@ rule SIGNATURE_BASE_SUSP_TH_APT_UNC4736_Tradingtech_Cert_Apr23_1
 		$s3 = "Trading Technologies International, Inc"
 
 	condition:
-		pe.timestamp>1651363200 and all of them
+		pe.timestamp> 1651363200 and all of them
 }
 import "pe"
 
@@ -403149,15 +399168,15 @@ rule SIGNATURE_BASE_PUA_Anydesk_Compromised_Certificate_Revoked_Jan24 : FILE
 		date = "2024-02-05"
 		modified = "2024-04-24"
 		reference = "https://anydesk.com/en/public-statement"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_anydesk_compromised_cert_feb23.yar#L3-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a1f148dbf15579bd6a65e7c93fa64f00ea481d6b314a444fa924a4604adb9a6d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_anydesk_compromised_cert_feb23.yar#L3-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a1f148dbf15579bd6a65e7c93fa64f00ea481d6b314a444fa924a4604adb9a6d"
 		score = 50
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures[i].serial=="0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8")
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures [ i ] . serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" )
 }
 import "pe"
 
@@ -403170,9 +399189,9 @@ rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_1 : FILE
 		date = "2024-02-02"
 		modified = "2024-04-24"
 		reference = "https://anydesk.com/en/public-statement"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_anydesk_compromised_cert_feb23.yar#L19-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1b2268b1efa09ee8578f4c1ae07617ac6bebeacd3ed50598a2fc2ec4d709baa7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_anydesk_compromised_cert_feb23.yar#L19-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1b2268b1efa09ee8578f4c1ae07617ac6bebeacd3ed50598a2fc2ec4d709baa7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403181,10 +399200,8 @@ rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_1 : FILE
 		$a1 = "AnyDesk Software GmbH" wide
 
 	condition:
-		uint16(0)==0x5a4d and not $a1 and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures[i].serial=="0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8")
+		uint16( 0 ) == 0x5a4d and not $a1 and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures [ i ] . serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" )
 }
-import "pe"
-
 rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_2 : FILE
 {
 	meta:
@@ -403194,9 +399211,9 @@ rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_2 : FILE
 		date = "2024-02-02"
 		modified = "2024-04-24"
 		reference = "https://anydesk.com/en/public-statement"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_anydesk_compromised_cert_feb23.yar#L38-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "86f708233d5a6a46d367430dcc65b128e8dc7ec24eda774ff3860101cc16c9fc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_anydesk_compromised_cert_feb23.yar#L38-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_86f708233d5a6a46d367430dcc65b128e8dc7ec24eda774ff3860101cc16c9fc"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -403207,7 +399224,7 @@ rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_2 : FILE
 		$f1 = "AnyDesk Software GmbH" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20000KB and all of ($s*) and not 1 of ($f*)
+		uint16( 0 ) == 0x5a4d and filesize < 20000KB and all of ( $s* ) and not 1 of ( $f* )
 }
 import "pe"
 
@@ -403220,15 +399237,15 @@ rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_3 : FILE
 		date = "2024-02-02"
 		modified = "2024-04-24"
 		reference = "https://anydesk.com/en/public-statement"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_anydesk_compromised_cert_feb23.yar#L58-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fdd1068abfba52c9a40fd2b6628a5c67775eb31815e6d53bfc4655080d9b240e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_anydesk_compromised_cert_feb23.yar#L58-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fdd1068abfba52c9a40fd2b6628a5c67775eb31815e6d53bfc4655080d9b240e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures[i].serial=="0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" and (pe.signatures[i].not_before>1706486400 or pe.timestamp>1706486400))
+		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures [ i ] . serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" and ( pe.signatures [ i ] . not_before > 1706486400 or pe.timestamp > 1706486400 ) )
 }
 rule SIGNATURE_BASE_HKTL_Khepri_Beacon_Sep21_1 : FILE
 {
@@ -403239,9 +399256,9 @@ rule SIGNATURE_BASE_HKTL_Khepri_Beacon_Sep21_1 : FILE
 		date = "2021-09-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/geemion/Khepri/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_khepri.yar#L2-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c688dbda6006ef28305285f6aeec24a23cbfe9174d09cf4e3586bd0cf7290e60"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_khepri.yar#L2-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c688dbda6006ef28305285f6aeec24a23cbfe9174d09cf4e3586bd0cf7290e60"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -403265,7 +399282,7 @@ rule SIGNATURE_BASE_HKTL_Khepri_Beacon_Sep21_1 : FILE
 		$op4 = { 69 c0 ff 00 00 00 8b 4d c0 23 88 40 7c 49 00 89 4d c0 8b 45 cc 0b 45 c0 89 45 cc 8b 45 d0 }
 
 	condition:
-		( uint16(0)==0x5a4d or uint32be(0)==0x7f454c46) and filesize <2000KB and (1 of ($x*) or 2 of ($sx*) or all of ($sa*) or 3 of ($op*)) or ( filesize <10MB and 1 of ($xe*)) or 5 of them
+		( uint16( 0 ) == 0x5a4d or uint32be( 0 ) == 0x7f454c46 ) and filesize < 2000KB and ( 1 of ( $x* ) or 2 of ( $sx* ) or all of ( $sa* ) or 3 of ( $op* ) ) or ( filesize < 10MB and 1 of ( $xe* ) ) or 5 of them
 }
 import "pe"
 
@@ -403278,9 +399295,9 @@ rule SIGNATURE_BASE_Gen_Excel_Xll_Addin_Suspicious : FILE
 		date = "2020-10-16"
 		modified = "2023-12-05"
 		reference = "https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_excel_xll_addin_suspicious.yar#L3-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d8c3f00ef05b0b84e4c4d655d01eab6f6e67714619695fd1433726e5a940e530"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_excel_xll_addin_suspicious.yar#L3-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d8c3f00ef05b0b84e4c4d655d01eab6f6e67714619695fd1433726e5a940e530"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -403305,7 +399322,7 @@ rule SIGNATURE_BASE_Gen_Excel_Xll_Addin_Suspicious : FILE
 		$debug = "SeDebugPrivilege"
 
 	condition:
-		filesize <1MB and uint16(0)==0x5a4d and pe.characteristics&pe.DLL and pe.exports("xlAutoOpen") and (((pe.imports("KERNEL32.dll","LookupPrivilegeValueW") or pe.imports("KERNEL32.dll","LookupPrivilegeValueA")) and pe.imports("KERNEL32.dll","AdjustTokenPrivileges") and pe.imports("KERNEL32.dll","OpenProcess") and $debug) or (pe.imports("ADVAPI32.dll","CryptDecrypt") and pe.imports("ADVAPI32.dll","CryptImportKey")) or (pe.imports("DNSAPI.dll","DnsQuery_A") or pe.imports("DNSAPI.dll","DnsQuery_W")) or ((pe.imports("KERNEL32.dll","FindResourceA") or pe.imports("KERNEL32.dll","FindResourceW")) and pe.imports("KERNEL32.dll","LoadResource") and pe.imports("KERNEL32.dll","LockResource") and (pe.imports("KERNEL32.dll","VirtualAlloc") or pe.imports("KERNEL32.dll","VirtualAllocEx")) and pe.imports("KERNEL32.dll","WriteProcessMemory") and pe.imports("KERNEL32.dll","SetThreadContext")) or (pe.imports("KERNEL32.dll","GetThreadContext") and pe.imports("KERNEL32.dll","VirtualAllocEx") and pe.imports("KERNEL32.dll","ResumeThread") and pe.imports("KERNEL32.dll","SetThreadContext")) or (pe.imports("KERNEL32.dll","WinExec")) or ( all of ($s*)) or ( all of ($cs*) and pe.imports("KERNEL32.dll","VirtualAllocEx") and pe.imports("KERNEL32.dll","TerminateProcess") and pe.imports("KERNEL32.dll","Sleep")))
+		filesize < 1MB and uint16( 0 ) == 0x5a4d and pe.characteristics & pe.DLL and pe.exports ( "xlAutoOpen" ) and ( ( ( pe.imports ( "KERNEL32.dll" , "LookupPrivilegeValueW" ) or pe.imports ( "KERNEL32.dll" , "LookupPrivilegeValueA" ) ) and pe.imports ( "KERNEL32.dll" , "AdjustTokenPrivileges" ) and pe.imports ( "KERNEL32.dll" , "OpenProcess" ) and $debug ) or ( pe.imports ( "ADVAPI32.dll" , "CryptDecrypt" ) and pe.imports ( "ADVAPI32.dll" , "CryptImportKey" ) ) or ( pe.imports ( "DNSAPI.dll" , "DnsQuery_A" ) or pe.imports ( "DNSAPI.dll" , "DnsQuery_W" ) ) or ( ( pe.imports ( "KERNEL32.dll" , "FindResourceA" ) or pe.imports ( "KERNEL32.dll" , "FindResourceW" ) ) and pe.imports ( "KERNEL32.dll" , "LoadResource" ) and pe.imports ( "KERNEL32.dll" , "LockResource" ) and ( pe.imports ( "KERNEL32.dll" , "VirtualAlloc" ) or pe.imports ( "KERNEL32.dll" , "VirtualAllocEx" ) ) and pe.imports ( "KERNEL32.dll" , "WriteProcessMemory" ) and pe.imports ( "KERNEL32.dll" , "SetThreadContext" ) ) or ( pe.imports ( "KERNEL32.dll" , "GetThreadContext" ) and pe.imports ( "KERNEL32.dll" , "VirtualAllocEx" ) and pe.imports ( "KERNEL32.dll" , "ResumeThread" ) and pe.imports ( "KERNEL32.dll" , "SetThreadContext" ) ) or ( pe.imports ( "KERNEL32.dll" , "WinExec" ) ) or ( all of ( $s* ) ) or ( all of ( $cs* ) and pe.imports ( "KERNEL32.dll" , "VirtualAllocEx" ) and pe.imports ( "KERNEL32.dll" , "TerminateProcess" ) and pe.imports ( "KERNEL32.dll" , "Sleep" ) ) )
 }
 rule SIGNATURE_BASE_Payload_Exe2Hex
 {
@@ -403316,9 +399333,9 @@ rule SIGNATURE_BASE_Payload_Exe2Hex
 		date = "2016-01-15"
 		modified = "2023-12-05"
 		reference = "https://github.com/g0tmi1k/exe2hex"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_exe2hex_payload.yar#L8-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "91b738f0174a267bbc900d59abcb504d2ae0bac8c287c3b7d1ebfc57374a7ee7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_exe2hex_payload.yar#L8-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_91b738f0174a267bbc900d59abcb504d2ae0bac8c287c3b7d1ebfc57374a7ee7"
 		score = 70
 		quality = 85
 		tags = ""
@@ -403335,7 +399352,7 @@ rule SIGNATURE_BASE_Payload_Exe2Hex
 		$d2 = "echo+r+cx+%3E%3E" ascii
 
 	condition:
-		all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
+		all of ( $a* ) or all of ( $b* ) or all of ( $c* ) or all of ( $d* )
 }
 rule SIGNATURE_BASE_APT_MAL_Winntilinux_Dropper_Azazelfork_May19 : AZAZEL_FORK FILE
 {
@@ -403346,10 +399363,10 @@ rule SIGNATURE_BASE_APT_MAL_Winntilinux_Dropper_Azazelfork_May19 : AZAZEL_FORK F
 		date = "2019-05-15"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_linux.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_linux.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
-		logic_hash = "0af32675dccfd0ad0c7919683fddced6ad49c65800ffa523773b7342b431379f"
+		logic_hash = "v1_sha256_0af32675dccfd0ad0c7919683fddced6ad49c65800ffa523773b7342b431379f"
 		score = 75
 		quality = 85
 		tags = "AZAZEL_FORK, FILE"
@@ -403362,7 +399379,7 @@ rule SIGNATURE_BASE_APT_MAL_Winntilinux_Dropper_Azazelfork_May19 : AZAZEL_FORK F
 		$export2 = "get_our_pids"
 
 	condition:
-		uint16(0)==0x457f and all of them
+		uint16( 0 ) == 0x457f and all of them
 }
 rule SIGNATURE_BASE_APT_MAL_Winntilinux_Main_Azazelfork_May19 : FILE
 {
@@ -403373,10 +399390,10 @@ rule SIGNATURE_BASE_APT_MAL_Winntilinux_Main_Azazelfork_May19 : FILE
 		date = "2019-05-15"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_linux.yar#L18-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_linux.yar#L18-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23"
-		logic_hash = "3ff38795179f6c32f2ff014b06ac126ae3a0de3fe7515f0e49f12f9c8ff14b43"
+		logic_hash = "v1_sha256_3ff38795179f6c32f2ff014b06ac126ae3a0de3fe7515f0e49f12f9c8ff14b43"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403395,7 +399412,7 @@ rule SIGNATURE_BASE_APT_MAL_Winntilinux_Main_Azazelfork_May19 : FILE
 		$rtti_name7 = "CRemoteMsg"
 
 	condition:
-		uint16(0)==0x457f and (($dbg_msg and 1 of ($rtti*)) or (5 of ($rtti*)) or ($uuid_lookup and 2 of ($rtti*)))
+		uint16( 0 ) == 0x457f and ( ( $dbg_msg and 1 of ( $rtti* ) ) or ( 5 of ( $rtti* ) ) or ( $uuid_lookup and 2 of ( $rtti* ) ) )
 }
 rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_1 : FILE
 {
@@ -403406,9 +399423,9 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_1 : FILE
 		date = "2016-02-29"
 		modified = "2023-05-04"
 		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turbo_campaign.yar#L1-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "61ef65a1500d3def3376a82bc376db451d202d18b03855ee279b6c01757deb2a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turbo_campaign.yar#L1-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_61ef65a1500d3def3376a82bc376db451d202d18b03855ee279b6c01757deb2a"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -403453,7 +399470,7 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_1 : FILE
 		$s37 = "rename"
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint32( 0 ) == 0x464c457f and all of them
 }
 rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Kernelmodule_1 : FILE
 {
@@ -403464,9 +399481,9 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Kernelmodule_1 : FILE
 		date = "2016-02-29"
 		modified = "2023-05-04"
 		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turbo_campaign.yar#L51-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fab37e2dbe05c694da6e428aa922747b276c2827cbbd2b6c8002f0cc30c2870c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turbo_campaign.yar#L51-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fab37e2dbe05c694da6e428aa922747b276c2827cbbd2b6c8002f0cc30c2870c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403494,7 +399511,7 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Kernelmodule_1 : FILE
 		$s21 = "kfree_skb"
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint32( 0 ) == 0x464c457f and all of them
 }
 rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation_1 : FILE
 {
@@ -403505,9 +399522,9 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation_1 : FILE
 		date = "2016-02-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turbo_campaign.yar#L85-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "adbdccea9ea7aefcca18d659c027a49e7e2e053873b77ddaf369203b3e301033"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turbo_campaign.yar#L85-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_adbdccea9ea7aefcca18d659c027a49e7e2e053873b77ddaf369203b3e301033"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403516,7 +399533,7 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation_1 : FILE
 		$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
 
 	condition:
-		uint32(0)==0x464C457F and any of them
+		uint32( 0 ) == 0x464C457F and any of them
 }
 rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Strings_1 : FILE
 {
@@ -403527,9 +399544,9 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Strings_1 : FILE
 		date = "2016-02-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turbo_campaign.yar#L98-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b54b406a562247d4c3d4a9c4d1b7584bdcecfe5b6c76867c04770e016eeb8c9a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turbo_campaign.yar#L98-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b54b406a562247d4c3d4a9c4d1b7584bdcecfe5b6c76867c04770e016eeb8c9a"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -403551,7 +399568,7 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Strings_1 : FILE
 		$c2 = "/tmp/1408.log" wide ascii fullword
 
 	condition:
-		uint32(0)==0x464C457F and ((1 of ($a*) and 4 of ($b*)) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*))
+		uint32( 0 ) == 0x464C457F and ( ( 1 of ( $a* ) and 4 of ( $b* ) ) or ( 1 of ( $a* ) and 1 of ( $c* ) ) or 2 of ( $a* ) or all of ( $b* ) )
 }
 rule SIGNATURE_BASE_Apt_Win_Exe_Trojan_Derusbi_1 : FILE
 {
@@ -403562,9 +399579,9 @@ rule SIGNATURE_BASE_Apt_Win_Exe_Trojan_Derusbi_1 : FILE
 		date = "2016-02-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_turbo_campaign.yar#L130-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "02fb4da724b257aef0ec0fecfe5b7a25a23fe4dd5baae0ddd2d21350b9af34e9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_turbo_campaign.yar#L130-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_02fb4da724b257aef0ec0fecfe5b7a25a23fe4dd5baae0ddd2d21350b9af34e9"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -403602,7 +399619,7 @@ rule SIGNATURE_BASE_Apt_Win_Exe_Trojan_Derusbi_1 : FILE
 		$se_5 = "2.03" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($sa_*) or ((8 of ($sa_*)) and ((5 of ($sb_*)) or (3 of ($sc_*)) or ( all of ($sd_*)) or (1 of ($sc_*) and all of ($se_*)))))
+		uint16( 0 ) == 0x5A4D and ( all of ( $sa_* ) or ( ( 8 of ( $sa_* ) ) and ( ( 5 of ( $sb_* ) ) or ( 3 of ( $sc_* ) ) or ( all of ( $sd_* ) ) or ( 1 of ( $sc_* ) and all of ( $se_* ) ) ) ) )
 }
 rule SIGNATURE_BASE_EXPL_Exchange_Proxynotshell_Patterns_CVE_2022_41040_Oct22_1 : SCRIPT
 {
@@ -403614,9 +399631,9 @@ rule SIGNATURE_BASE_EXPL_Exchange_Proxynotshell_Patterns_CVE_2022_41040_Oct22_1
 		modified = "2023-03-15"
 		old_rule_name = "EXPL_Exchange_ProxyNoShell_Patterns_CVE_2022_41040_Oct22_1"
 		reference = "https://github.com/kljunowsky/CVE-2022-41040-POC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cve_2022_41040_proxynoshell.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "81b0f0fea2762beb47826ff95545c87e960e098b9d5f45eacfe07b3ecf319ac5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cve_2022_41040_proxynoshell.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_81b0f0fea2762beb47826ff95545c87e960e098b9d5f45eacfe07b3ecf319ac5"
 		score = 75
 		quality = 85
 		tags = "SCRIPT"
@@ -403631,7 +399648,7 @@ rule SIGNATURE_BASE_EXPL_Exchange_Proxynotshell_Patterns_CVE_2022_41040_Oct22_1
 		$fp4 = "@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com" ascii
 
 	condition:
-		$sr1 and 1 of ($sa*) and not 1 of ($fp*)
+		$sr1 and 1 of ( $sa* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_ATM_Malware_XFSADM_1 : FILE
 {
@@ -403642,9 +399659,9 @@ rule SIGNATURE_BASE_ATM_Malware_XFSADM_1 : FILE
 		date = "2019-06-21"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/r3c0nst/status/1149043362244308992"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_atm_xfsadm.yar#L1-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f2c1761407c5e499be43e546badd27428821f828a470fd3e3dcddd08db04aaa5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_atm_xfsadm.yar#L1-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f2c1761407c5e499be43e546badd27428821f828a470fd3e3dcddd08db04aaa5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403664,7 +399681,7 @@ rule SIGNATURE_BASE_ATM_Malware_XFSADM_1 : FILE
 		$TmpFile = "~pipe.tmp" ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <500KB and (4 of them or $PDB)
+		uint16( 0 ) == 0x5A4D and filesize < 500KB and ( 4 of them or $PDB )
 }
 rule SIGNATURE_BASE_APT_MAL_DNS_Hijacking_Campaign_AA19_024A : FILE
 {
@@ -403675,9 +399692,9 @@ rule SIGNATURE_BASE_APT_MAL_DNS_Hijacking_Campaign_AA19_024A : FILE
 		date = "2019-01-25"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/AA19-024A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_aa19_024a.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8e9ec132df6cf6a89f6694682292feec0f3a762c2df6b1dc8180d9ab68e7183b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_aa19_024a.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8e9ec132df6cf6a89f6694682292feec0f3a762c2df6b1dc8180d9ab68e7183b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403692,7 +399709,7 @@ rule SIGNATURE_BASE_APT_MAL_DNS_Hijacking_Campaign_AA19_024A : FILE
 		$s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
 }
 import "pe"
 
@@ -403705,9 +399722,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Venus_Nov22_1 : FILE
 		date = "2022-11-16"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/dyngnosis/status/1592588860168421376"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_venus.yar#L3-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3c94d59015897f180ef55608a2761b37c7b52193e28895ea6a4c0548acf3ad34"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_venus.yar#L3-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3c94d59015897f180ef55608a2761b37c7b52193e28895ea6a4c0548acf3ad34"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -403730,7 +399747,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Venus_Nov22_1 : FILE
 		$op3 = { 66 89 45 d4 0f 11 45 e8 e8 a8 e7 ff ff 83 c4 14 8d 45 e8 50 8d 45 a4 50 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (pe.imphash()=="bb2600e94092da119ee6acbbd047be43" or 1 of ($x*) or 2 of them ) or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( pe.imphash ( ) == "bb2600e94092da119ee6acbbd047be43" or 1 of ( $x* ) or 2 of them ) or 4 of them
 }
 rule SIGNATURE_BASE_Projectm_Darkcomet_1 : FILE
 {
@@ -403741,10 +399758,10 @@ rule SIGNATURE_BASE_Projectm_Darkcomet_1 : FILE
 		date = "2016-03-26"
 		modified = "2023-01-27"
 		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_m.yar#L10-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_m.yar#L10-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
-		logic_hash = "81ffaa382bb6f817fe2917a096a3eee49d2e8c281271da551ccd65679692712f"
+		logic_hash = "v1_sha256_81ffaa382bb6f817fe2917a096a3eee49d2e8c281271da551ccd65679692712f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403759,7 +399776,7 @@ rule SIGNATURE_BASE_Projectm_Darkcomet_1 : FILE
 		$a5 = "infoes" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 4 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 4 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Projectm_Crimsondownloader : FILE
 {
@@ -403770,10 +399787,10 @@ rule SIGNATURE_BASE_Projectm_Crimsondownloader : FILE
 		date = "2016-03-26"
 		modified = "2023-12-05"
 		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_project_m.yar#L32-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_project_m.yar#L32-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
-		logic_hash = "3c9a4f5aca4c9fc26d371027a32e349a456ef25d6b403a66b9afb1ee19dd4d00"
+		logic_hash = "v1_sha256_3c9a4f5aca4c9fc26d371027a32e349a456ef25d6b403a66b9afb1ee19dd4d00"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403788,7 +399805,7 @@ rule SIGNATURE_BASE_Projectm_Crimsondownloader : FILE
 		$s5 = "[Microsoft-Security-Essentials]" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and $x1) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and $x1 ) or ( all of them )
 }
 rule SIGNATURE_BASE_Suspicious_Autoit_By_Microsoft : FILE
 {
@@ -403797,11 +399814,11 @@ rule SIGNATURE_BASE_Suspicious_Autoit_By_Microsoft : FILE
 		author = "Florian Roth (Nextron Systems)"
 		id = "69b1c93d-ab12-5fdc-b6eb-fb135796d3a9"
 		date = "2017-12-14"
-		modified = "2023-12-05"
+		modified = "2024-12-09"
 		reference = "Internal Research - VT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_anomalies.yar#L375-L390"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7dfbaf7d136bd9e151c533b49394a9a596450d9cc2643dc144cb693290004591"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_anomalies.yar#L379-L394"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7dfbaf7d136bd9e151c533b49394a9a596450d9cc2643dc144cb693290004591"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -403813,7 +399830,7 @@ rule SIGNATURE_BASE_Suspicious_Autoit_By_Microsoft : FILE
 		$s2 = "AutoIt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_Size_Of_ASUS_Tuningtool : FILE
 {
@@ -403824,9 +399841,9 @@ rule SIGNATURE_BASE_SUSP_Size_Of_ASUS_Tuningtool : FILE
 		date = "2018-10-17"
 		modified = "2022-12-21"
 		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_anomalies.yar#L392-L407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5aadb48f61947ff0362bde5f80830b835ca9e3cb7e1c632d153d0ea5f8bbad6c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_anomalies.yar#L396-L411"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5aadb48f61947ff0362bde5f80830b835ca9e3cb7e1c632d153d0ea5f8bbad6c"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -403837,7 +399854,7 @@ rule SIGNATURE_BASE_SUSP_Size_Of_ASUS_Tuningtool : FILE
 		$s1 = "\\Release\\ASGT.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and filesize >70KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 300KB and filesize > 70KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_Piratedoffice_2007 : FILE
 {
@@ -403846,11 +399863,11 @@ rule SIGNATURE_BASE_SUSP_Piratedoffice_2007 : FILE
 		author = "Florian Roth (Nextron Systems)"
 		id = "b36e9a59-7617-503b-968d-5b6b72b227ea"
 		date = "2018-12-04"
-		modified = "2023-12-05"
+		modified = "2024-12-09"
 		reference = "https://twitter.com/pwnallthethings/status/743230570440826886?lang=en"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_anomalies.yar#L409-L422"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ff94483944a4a4e4bc3cba26fc08fc2a5239f27b301b2ca7cca5edc092c2fc73"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_anomalies.yar#L413-L426"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ff94483944a4a4e4bc3cba26fc08fc2a5239f27b301b2ca7cca5edc092c2fc73"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -403860,7 +399877,7 @@ rule SIGNATURE_BASE_SUSP_Piratedoffice_2007 : FILE
 		$s7 = "<Company>Grizli777</Company>" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <300KB and all of them
+		uint16( 0 ) == 0xcfd0 and filesize < 300KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_Scheduled_Task_Bigsize : FILE
 {
@@ -403869,11 +399886,11 @@ rule SIGNATURE_BASE_SUSP_Scheduled_Task_Bigsize : FILE
 		author = "Florian Roth (Nextron Systems)"
 		id = "61b07b30-1058-5a53-99e7-2c48ec9d23b5"
 		date = "2018-12-06"
-		modified = "2023-12-05"
+		modified = "2024-12-09"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_anomalies.yar#L424-L440"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dcc06261b1ea39c587d8bcefbb8e85e6b9016da01bf66c2eefe5bd7bbdfc6968"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_anomalies.yar#L428-L444"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dcc06261b1ea39c587d8bcefbb8e85e6b9016da01bf66c2eefe5bd7bbdfc6968"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -403886,7 +399903,7 @@ rule SIGNATURE_BASE_SUSP_Scheduled_Task_Bigsize : FILE
 		$fp3 = "Microsoft Shared" fullword wide
 
 	condition:
-		uint16(0)==0xfeff and filesize >20KB and all of ($a*) and not 1 of ($fp*)
+		uint16( 0 ) == 0xfeff and filesize > 20KB and all of ( $a* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_SUSP_Putty_Unnormal_Size : FILE
 {
@@ -403897,9 +399914,9 @@ rule SIGNATURE_BASE_SUSP_Putty_Unnormal_Size : FILE
 		date = "2019-01-07"
 		modified = "2022-06-30"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_anomalies.yar#L442-L492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "2f2c21cc25eaba8c1812db617203427a59e9a55f8620676e4bbe4cb3cd4071fd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_anomalies.yar#L446-L496"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_2f2c21cc25eaba8c1812db617203427a59e9a55f8620676e4bbe4cb3cd4071fd"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -403915,7 +399932,7 @@ rule SIGNATURE_BASE_SUSP_Putty_Unnormal_Size : FILE
 		$fp1 = "KiTTY fork" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and $s1 and 1 of ($v*) and not 1 of ($fp*) and filesize !=524288 and filesize !=495616 and filesize !=483328 and filesize !=524288 and filesize !=712176 and filesize !=828400 and filesize !=569328 and filesize !=454656 and filesize !=531368 and filesize !=524288 and filesize !=483328 and filesize !=713592 and filesize !=829304 and filesize !=571256 and filesize !=774200 and filesize !=854072 and filesize !=665144 and filesize !=774200 and filesize !=854072 and filesize !=665144 and filesize !=640000 and filesize !=650720 and filesize !=662808 and filesize !=651256 and filesize !=664432
+		uint16( 0 ) == 0x5a4d and $s1 and 1 of ( $v* ) and not 1 of ( $fp* ) and filesize != 524288 and filesize != 495616 and filesize != 483328 and filesize != 524288 and filesize != 712176 and filesize != 828400 and filesize != 569328 and filesize != 454656 and filesize != 531368 and filesize != 524288 and filesize != 483328 and filesize != 713592 and filesize != 829304 and filesize != 571256 and filesize != 774200 and filesize != 854072 and filesize != 665144 and filesize != 774200 and filesize != 854072 and filesize != 665144 and filesize != 640000 and filesize != 650720 and filesize != 662808 and filesize != 651256 and filesize != 664432
 }
 rule SIGNATURE_BASE_SUSP_RTF_Header_Anomaly : FILE
 {
@@ -403926,15 +399943,15 @@ rule SIGNATURE_BASE_SUSP_RTF_Header_Anomaly : FILE
 		date = "2019-01-20"
 		modified = "2022-09-15"
 		reference = "https://twitter.com/ItsReallyNick/status/975705759618158593"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_anomalies.yar#L494-L506"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c0be95894edc861cf322309f2c86a8ab986bb111dfdeea1990b4a074d5ab9ea3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_anomalies.yar#L498-L510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c0be95894edc861cf322309f2c86a8ab986bb111dfdeea1990b4a074d5ab9ea3"
 		score = 50
 		quality = 85
 		tags = "FILE"
 
 	condition:
-		uint32(0)==0x74725c7b and not uint8(4)==0x66
+		uint32( 0 ) == 0x74725c7b and not uint8( 4 ) == 0x66
 }
 rule SIGNATURE_BASE_HKTL_Solarwinds_Credential_Stealer : FILE
 {
@@ -403945,11 +399962,11 @@ rule SIGNATURE_BASE_HKTL_Solarwinds_Credential_Stealer : FILE
 		date = "2021-01-20"
 		modified = "2023-12-05"
 		reference = "https://github.com/mubix/solarflare"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_solarwinds_credential_stealer.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_solarwinds_credential_stealer.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "1b2e5186464ed0bdd38fcd9f4ab294a7ba28bd829bf296584cbc32e2889037e4"
 		hash = "4adb69d4222c80d97f8d64e4d48b574908a518f8d504f24ce93a18b90bd506dc"
-		logic_hash = "ccf55ba7b66ff8d0f926999f3d68dc3b2fdc1c9ce15e1f08b75d003c62393312"
+		logic_hash = "v1_sha256_ccf55ba7b66ff8d0f926999f3d68dc3b2fdc1c9ce15e1f08b75d003c62393312"
 		score = 75
 		quality = 51
 		tags = "FILE"
@@ -403969,7 +399986,7 @@ rule SIGNATURE_BASE_HKTL_Solarwinds_Credential_Stealer : FILE
 		$sql6 = "passwordsalt" ascii nocase wide fullword
 
 	condition:
-		uint16(0)==0x5A4D and $certificate and (2 of ($credfile*) or 5 of ($sql*))
+		uint16( 0 ) == 0x5A4D and $certificate and ( 2 of ( $credfile* ) or 5 of ( $sql* ) )
 }
 rule SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1 : FILE
 {
@@ -403980,9 +399997,9 @@ rule SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1 : FILE
 		date = "2020-08-21"
 		modified = "2023-12-05"
 		reference = "https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_goldenspy.yar#L1-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ba81a2b081842aaf06bbf623640a87946894df83fd0d7b7149c48afa8ed0a081"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_goldenspy.yar#L1-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ba81a2b081842aaf06bbf623640a87946894df83fd0d7b7149c48afa8ed0a081"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -403998,7 +400015,7 @@ rule SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1 : FILE
 		$str08 = "excuteExe" ascii
 
 	condition:
-		uint16(0)==0x5A4D and 5 of ($str*)
+		uint16( 0 ) == 0x5A4D and 5 of ( $str* )
 }
 rule SIGNATURE_BASE_NTLM_Dump_Output
 {
@@ -404009,9 +400026,9 @@ rule SIGNATURE_BASE_NTLM_Dump_Output
 		date = "2015-10-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_dumps.yar#L17-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "154de926d27d38b38a4ed2c14b9122213fd1deb4115ef3bb77366db0818c7572"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_dumps.yar#L17-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_154de926d27d38b38a4ed2c14b9122213fd1deb4115ef3bb77366db0818c7572"
 		score = 75
 		quality = 85
 		tags = ""
@@ -404033,9 +400050,9 @@ rule SIGNATURE_BASE_Gsecdump_Password_Dump_File : FILE
 		date = "2018-03-06"
 		modified = "2023-12-05"
 		reference = "https://t.co/OLIj1yVJ4m"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_dumps.yar#L32-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "483ad5217cbc065bd2f791c473b9a2455fddc4e0123268a8d37c64d92dd78c43"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_dumps.yar#L32-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_483ad5217cbc065bd2f791c473b9a2455fddc4e0123268a8d37c64d92dd78c43"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -404045,7 +400062,7 @@ rule SIGNATURE_BASE_Gsecdump_Password_Dump_File : FILE
 		$x1 = "Administrator(current):500:" ascii
 
 	condition:
-		uint32be(0)==0x41646d69 and filesize <3000 and $x1 at 0
+		uint32be( 0 ) == 0x41646d69 and filesize < 3000 and $x1 at 0
 }
 rule SIGNATURE_BASE_SUSP_ZIP_Ntdsdit : T1003_003 FILE
 {
@@ -404056,9 +400073,9 @@ rule SIGNATURE_BASE_SUSP_ZIP_Ntdsdit : T1003_003 FILE
 		date = "2020-08-10"
 		modified = "2023-12-05"
 		reference = "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/generic_dumps.yar#L47-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "371e30f50d96c884bd55ffc10d049d0ada881304746564a99dec0e8efad87602"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/generic_dumps.yar#L47-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_371e30f50d96c884bd55ffc10d049d0ada881304746564a99dec0e8efad87602"
 		score = 50
 		quality = 85
 		tags = "T1003_003, FILE"
@@ -404067,7 +400084,7 @@ rule SIGNATURE_BASE_SUSP_ZIP_Ntdsdit : T1003_003 FILE
 		$s1 = "ntds.dit" ascii
 
 	condition:
-		uint16(0)==0x4b50 and $s1 in (0..256)
+		uint16( 0 ) == 0x4b50 and $s1 in ( 0 .. 256 )
 }
 rule SIGNATURE_BASE_VUL_Exchange_CVE_2020_0688 : FILE
 {
@@ -404078,9 +400095,9 @@ rule SIGNATURE_BASE_VUL_Exchange_CVE_2020_0688 : FILE
 		date = "2020-02-26"
 		modified = "2023-12-05"
 		reference = "https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_cve_2020_0688.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "035971028d36c8bbcc6a274817187adfbfefe530ff6808af5a7c0b4667c1bd8b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_cve_2020_0688.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_035971028d36c8bbcc6a274817187adfbfefe530ff6808af5a7c0b4667c1bd8b"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -404090,7 +400107,7 @@ rule SIGNATURE_BASE_VUL_Exchange_CVE_2020_0688 : FILE
 		$x1 = "<machineKey validationKey=\"CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF\"" ascii wide
 
 	condition:
-		filesize <=300KB and $h1 at 0 and $x1
+		filesize <= 300KB and $h1 at 0 and $x1
 }
 rule SIGNATURE_BASE_Generic_Dropper : FILE
 {
@@ -404101,9 +400118,9 @@ rule SIGNATURE_BASE_Generic_Dropper : FILE
 		date = "2018-03-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/JAHZVL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_dropper_pdb.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e4ef83796d232edf34a6339e00db486612a88ff2d054f1afcd524def2e53b3b7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_dropper_pdb.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e4ef83796d232edf34a6339e00db486612a88ff2d054f1afcd524def2e53b3b7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404116,7 +400133,7 @@ rule SIGNATURE_BASE_Generic_Dropper : FILE
 		$s4 = "\\Debug\\dropper.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and 1 of them
 }
 rule SIGNATURE_BASE_Bernhardpos
 {
@@ -404127,10 +400144,10 @@ rule SIGNATURE_BASE_Bernhardpos
 		date = "2015-07-14"
 		modified = "2023-12-05"
 		reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_bernhard_pos.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_bernhard_pos.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e49820ef02ba5308ff84e4c8c12e7c3d"
-		logic_hash = "c00f2fda5a391b44767d918945069f18cef084dd4dc6aa94d8f945bf97ac462a"
+		logic_hash = "v1_sha256_c00f2fda5a391b44767d918945069f18cef084dd4dc6aa94d8f945bf97ac462a"
 		score = 70
 		quality = 85
 		tags = ""
@@ -404155,9 +400172,9 @@ rule SIGNATURE_BASE_Kaspermalware_Oct17_1 : FILE
 		date = "2017-10-24"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_kasper_oct17.yar#L13-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "15758407fb3039f1453f13d579d7df9525645e4717078f6b1fa482ab335e3a56"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_kasper_oct17.yar#L13-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_15758407fb3039f1453f13d579d7df9525645e4717078f6b1fa482ab335e3a56"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404169,7 +400186,7 @@ rule SIGNATURE_BASE_Kaspermalware_Oct17_1 : FILE
 		$x2 = "C:\\D@oc@um@en@ts a@nd Set@tings\\Al@l Users" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7000KB and (pe.imphash()=="2bceb64cf37acd34bc33b38f2cddfb61" or 1 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 7000KB and ( pe.imphash ( ) == "2bceb64cf37acd34bc33b38f2cddfb61" or 1 of them )
 }
 rule SIGNATURE_BASE_SNOWGLOBE_Babar_Malware : FILE
 {
@@ -404180,10 +400197,10 @@ rule SIGNATURE_BASE_SNOWGLOBE_Babar_Malware : FILE
 		date = "2015-02-18"
 		modified = "2023-12-05"
 		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_snowglobe_babar.yar#L4-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_snowglobe_babar.yar#L4-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
-		logic_hash = "a93425a95efe471b815e2daf0b5e290b3472b722c6a48f8c22f0a6e9c588ffc9"
+		logic_hash = "v1_sha256_a93425a95efe471b815e2daf0b5e290b3472b722c6a48f8c22f0a6e9c588ffc9"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -404206,7 +400223,7 @@ rule SIGNATURE_BASE_SNOWGLOBE_Babar_Malware : FILE
 		$x6 = "DLLPATH" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1MB and ((1 of ($z*) and 1 of ($x*)) or (3 of ($s*) and 4 of ($x*)))
+		uint16( 0 ) == 0x5a4d and filesize < 1MB and ( ( 1 of ( $z* ) and 1 of ( $x* ) ) or ( 3 of ( $s* ) and 4 of ( $x* ) ) )
 }
 rule SIGNATURE_BASE_SUSP_LNX_SH_Cryptominer_Indicators_Dec20_1 : FILE
 {
@@ -404217,9 +400234,9 @@ rule SIGNATURE_BASE_SUSP_LNX_SH_Cryptominer_Indicators_Dec20_1 : FILE
 		date = "2020-12-31"
 		modified = "2023-12-05"
 		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_crypto_miner.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4acd1b77307dbf23f95f7a2024209bee714c6931182aff16455ea6b7e4a6f287"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_crypto_miner.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4acd1b77307dbf23f95f7a2024209bee714c6931182aff16455ea6b7e4a6f287"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -404232,7 +400249,7 @@ rule SIGNATURE_BASE_SUSP_LNX_SH_Cryptominer_Indicators_Dec20_1 : FILE
 		$x4 = " -o pool.minexmr.com:5555 " ascii
 
 	condition:
-		filesize <20KB and 1 of them
+		filesize < 20KB and 1 of them
 }
 rule SIGNATURE_BASE_PUA_WIN_XMRIG_Cryptocoin_Miner_Dec20 : FILE
 {
@@ -404243,9 +400260,9 @@ rule SIGNATURE_BASE_PUA_WIN_XMRIG_Cryptocoin_Miner_Dec20 : FILE
 		date = "2020-12-31"
 		modified = "2023-12-05"
 		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_crypto_miner.yar#L19-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c39aee669a98bcc9d07821aef248096e45a6c54ab22b8b98c0a393b445f3934e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_crypto_miner.yar#L19-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c39aee669a98bcc9d07821aef248096e45a6c54ab22b8b98c0a393b445f3934e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404257,7 +400274,7 @@ rule SIGNATURE_BASE_PUA_WIN_XMRIG_Cryptocoin_Miner_Dec20 : FILE
 		$x3 = "* for x86, CRYPTOGAMS" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and 2 of them or all of them
+		uint16( 0 ) == 0x5a4d and filesize < 6000KB and 2 of them or all of them
 }
 rule SIGNATURE_BASE_Brooxml_Hunting : HUNTING FILE
 {
@@ -404266,11 +400283,11 @@ rule SIGNATURE_BASE_Brooxml_Hunting : HUNTING FILE
 		author = "Proofpoint"
 		id = "1ffea1c7-9f97-5bb1-93d7-ce914765416f"
 		date = "2024-11-27"
-		modified = "2024-12-05"
+		modified = "2024-12-12"
 		reference = "https://x.com/threatinsight/status/1861817946508763480"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_brooxml_dec24.yar#L2-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "89da6056adbae6155e682b84b950db84e3aedbb9ae693118e6e09d9ed67b03dd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_brooxml_dec24.yar#L2-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_89da6056adbae6155e682b84b950db84e3aedbb9ae693118e6e09d9ed67b03dd"
 		score = 70
 		quality = 58
 		tags = "HUNTING, FILE"
@@ -404288,7 +400305,7 @@ rule SIGNATURE_BASE_Brooxml_Hunting : HUNTING FILE
 		$tef = {78 9f 3e 22}
 
 	condition:
-		$pk_ooxml_magic in (4..16384) and $pk_0506 in (16384.. filesize ) and #pk_0506==1 and #pk_0102>2 and #pk_0304>2 and $word and not ($pk_0102 at 0) and not ($pk_0304 at 0) and not ($pk_0506 at 0) and not ($pk_0708 at 0) and not ($ole at 0) and not ($mz at 0) and not ($tef at 0)
+		$pk_ooxml_magic in ( 4 .. 16384 ) and $pk_0506 in ( 16384 .. filesize ) and #pk_0506 == 1 and #pk_0102 > 2 and #pk_0304 > 2 and $word and not ( $pk_0102 at 0 ) and not ( $pk_0304 at 0 ) and not ( $pk_0506 at 0 ) and not ( $pk_0708 at 0 ) and not ( $ole at 0 ) and not ( $mz at 0 ) and not ( $tef at 0 )
 }
 rule SIGNATURE_BASE_Brooxml_Phishing : PHISHING
 {
@@ -404297,11 +400314,11 @@ rule SIGNATURE_BASE_Brooxml_Phishing : PHISHING
 		author = "Proofpoint"
 		id = "ccd8ab30-90a4-5d4b-8a77-dbc4669bdb95"
 		date = "2024-11-27"
-		modified = "2024-12-05"
+		modified = "2024-12-12"
 		reference = "https://x.com/threatinsight/status/1861817946508763480"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_brooxml_dec24.yar#L40-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5cc7bc1383e1ded8e8613cbb4fad003e35b67059ca70d33f29406a5c146a5464"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_brooxml_dec24.yar#L41-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5cc7bc1383e1ded8e8613cbb4fad003e35b67059ca70d33f29406a5c146a5464"
 		score = 65
 		quality = 31
 		tags = "PHISHING"
@@ -404313,7 +400330,7 @@ rule SIGNATURE_BASE_Brooxml_Phishing : PHISHING
 		$pdf = { 25 50 44 46 2d }
 
 	condition:
-		all of ($hex*) and (($docx at 0) or ($pdf at 0))
+		all of ( $hex* ) and ( ( $docx at 0 ) or ( $pdf at 0 ) )
 }
 rule SIGNATURE_BASE_Quasar_RAT_Jan18_1 : FILE
 {
@@ -404324,9 +400341,9 @@ rule SIGNATURE_BASE_Quasar_RAT_Jan18_1 : FILE
 		date = "2018-01-29"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_quasar_vermin.yar#L11-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4b2c8695a053a714e97f3e108f0f359d9e49151297a21e460b3201d8f4e72a89"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_quasar_vermin.yar#L11-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4b2c8695a053a714e97f3e108f0f359d9e49151297a21e460b3201d8f4e72a89"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404345,7 +400362,7 @@ rule SIGNATURE_BASE_Quasar_RAT_Jan18_1 : FILE
 		$s8 = ".Core.RemoteShell" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and $a1 and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and $a1 and 3 of them
 }
 rule SIGNATURE_BASE_Vermin_Keylogger_Jan18_1 : FILE
 {
@@ -404356,9 +400373,9 @@ rule SIGNATURE_BASE_Vermin_Keylogger_Jan18_1 : FILE
 		date = "2018-01-29"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_quasar_vermin.yar#L35-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a8afe017f32400e1e498d23746f5cb59c3c67f6abefe9b2e36bec81ca82ecfed"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_quasar_vermin.yar#L35-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a8afe017f32400e1e498d23746f5cb59c3c67f6abefe9b2e36bec81ca82ecfed"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404388,7 +400405,7 @@ rule SIGNATURE_BASE_Vermin_Keylogger_Jan18_1 : FILE
 		$s7 = "xClient.Core.ReverseProxy.Packets" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and (1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_Mimipenguin_SH
 {
@@ -404399,9 +400416,9 @@ rule SIGNATURE_BASE_Mimipenguin_SH
 		date = "2017-04-01"
 		modified = "2023-12-05"
 		reference = "https://github.com/huntergregal/mimipenguin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimipenguin.yar#L8-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5d9827e7adfe667a4a46e23854cac3b63949abcde5709045f0fe65e7b5704265"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimipenguin.yar#L8-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5d9827e7adfe667a4a46e23854cac3b63949abcde5709045f0fe65e7b5704265"
 		score = 75
 		quality = 85
 		tags = ""
@@ -404424,9 +400441,9 @@ rule SIGNATURE_BASE_Mimipenguin_1 : FILE
 		date = "2017-07-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/huntergregal/mimipenguin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimipenguin.yar#L34-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "60a7b64eee9e2adfbc65fb5762f18e2abc4a35f9368ad704754870b5e8311391"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimipenguin.yar#L34-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_60a7b64eee9e2adfbc65fb5762f18e2abc4a35f9368ad704754870b5e8311391"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404440,7 +400457,7 @@ rule SIGNATURE_BASE_Mimipenguin_1 : FILE
 		$x4 = "GnomeKeyringPasswordFinder()" ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and 1 of them )
+		( uint16( 0 ) == 0x2123 and filesize < 20KB and 1 of them )
 }
 rule SIGNATURE_BASE_Mimipenguin_2 : FILE
 {
@@ -404451,9 +400468,9 @@ rule SIGNATURE_BASE_Mimipenguin_2 : FILE
 		date = "2017-07-08"
 		modified = "2023-12-05"
 		reference = "https://github.com/huntergregal/mimipenguin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mimipenguin.yar#L52-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "53a1f47ef9c94ef6bffbc9d7b9f3a8e0a7fb132c0936ea27e6be775cf99792a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mimipenguin.yar#L52-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_53a1f47ef9c94ef6bffbc9d7b9f3a8e0a7fb132c0936ea27e6be775cf99792a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404468,7 +400485,7 @@ rule SIGNATURE_BASE_Mimipenguin_2 : FILE
 		$x5 = "if [[ -n $(ps -eo pid,command | grep -v 'grep' | grep gnome-keyring) ]]; then" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and 1 of them )
+		( uint16( 0 ) == 0x2123 and filesize < 20KB and 1 of them )
 }
 rule SIGNATURE_BASE_Quarkspwdump_Gen
 {
@@ -404479,9 +400496,9 @@ rule SIGNATURE_BASE_Quarkspwdump_Gen
 		date = "2015-09-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_quarkspwdump.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "327235260076f97c29acc1ca997205d08ef55fad795594fe2268f1d8e666d636"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_quarkspwdump.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_327235260076f97c29acc1ca997205d08ef55fad795594fe2268f1d8e666d636"
 		score = 80
 		quality = 85
 		tags = ""
@@ -404512,9 +400529,9 @@ rule SIGNATURE_BASE_HTA_With_Wscript_Shell
 		date = "2017-06-21"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/msftmmpc/status/877396932758560768"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_hta_anomalies.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7ce2728fbd3023a6b96291cdb63f30dc9b71e5fc506f8b00ad97e3062b103478"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_hta_anomalies.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7ce2728fbd3023a6b96291cdb63f30dc9b71e5fc506f8b00ad97e3062b103478"
 		score = 80
 		quality = 85
 		tags = ""
@@ -404537,9 +400554,9 @@ rule SIGNATURE_BASE_HTA_Embedded
 		date = "2017-06-21"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/msftmmpc/status/877396932758560768"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_hta_anomalies.yar#L28-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "843f0ad5e39e5492db8ff7372f6d2038e7dbb7823ec9b33f863ab891a108b1ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_hta_anomalies.yar#L28-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_843f0ad5e39e5492db8ff7372f6d2038e7dbb7823ec9b33f863ab891a108b1ec"
 		score = 50
 		quality = 85
 		tags = ""
@@ -404550,7 +400567,7 @@ rule SIGNATURE_BASE_HTA_Embedded
 		$s1 = "<hta:application windowstate=\"minimize\"/>"
 
 	condition:
-		$s1 and not $s1 in (0..50000)
+		$s1 and not $s1 in ( 0 .. 50000 )
 }
 import "pe"
 
@@ -404563,9 +400580,9 @@ rule SIGNATURE_BASE_SUSP_ENV_Folder_Root_File_Jan23_1 : SCRIPT FILE
 		date = "2023-01-11"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_indicators.yar#L3-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5355ae567e6255e22f566bae9fe50f4995bafba07c261461d37d5b8ba200d33a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_indicators.yar#L3-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5355ae567e6255e22f566bae9fe50f4995bafba07c261461d37d5b8ba200d33a"
 		score = 70
 		quality = 83
 		tags = "SCRIPT, FILE"
@@ -404578,7 +400595,7 @@ rule SIGNATURE_BASE_SUSP_ENV_Folder_Root_File_Jan23_1 : SCRIPT FILE
 		$fp2 = "CCleaner" ascii
 
 	condition:
-		filesize <20MB and 1 of ($x*) and not 1 of ($fp*) and not pe.number_of_signatures>0
+		filesize < 20MB and 1 of ( $x* ) and not 1 of ( $fp* ) and not pe.number_of_signatures > 0
 }
 import "pe"
 
@@ -404591,9 +400608,9 @@ rule SIGNATURE_BASE_APT_Tick_Sysmon_Loader_Jun18 : FILE
 		date = "2018-06-23"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_tick_weaponized_usb.yar#L13-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e6256269409322a4f48bfdaafc52f5ec83602cf66f2e3b8d83ed5175e1dc506f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_tick_weaponized_usb.yar#L13-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e6256269409322a4f48bfdaafc52f5ec83602cf66f2e3b8d83ed5175e1dc506f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404612,10 +400629,8 @@ rule SIGNATURE_BASE_APT_Tick_Sysmon_Loader_Jun18 : FILE
 		$s8 = "\\Accessories" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="c5bb16e79fb500c430edce9481ae5b2b" or $x1 or 6 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "c5bb16e79fb500c430edce9481ae5b2b" or $x1 or 6 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Tick_Homamdownloader_Jun18 : FILE
 {
 	meta:
@@ -404625,9 +400640,9 @@ rule SIGNATURE_BASE_APT_Tick_Homamdownloader_Jun18 : FILE
 		date = "2018-06-23"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_tick_weaponized_usb.yar#L40-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b4c798aa0c71f44f271e710d791c97adcbf9bd28ec87dd1d8d589029e58d1cfb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_tick_weaponized_usb.yar#L40-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b4c798aa0c71f44f271e710d791c97adcbf9bd28ec87dd1d8d589029e58d1cfb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404643,7 +400658,7 @@ rule SIGNATURE_BASE_APT_Tick_Homamdownloader_Jun18 : FILE
 		$s11 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and 3 of them
 }
 rule SIGNATURE_BASE_Tofu_Backdoor
 {
@@ -404654,9 +400669,9 @@ rule SIGNATURE_BASE_Tofu_Backdoor
 		date = "2017-02-28"
 		modified = "2023-12-05"
 		reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ham_tofu_chches.yar#L11-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "67c49456dbe4dc4c8bc54139ce6d493ea5588392d8c64010d029d7a63ac7f976"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ham_tofu_chches.yar#L11-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_67c49456dbe4dc4c8bc54139ce6d493ea5588392d8c64010d029d7a63ac7f976"
 		score = 75
 		quality = 85
 		tags = ""
@@ -404678,9 +400693,9 @@ rule SIGNATURE_BASE_VUL_Jquery_Fileupload_CVE_2018_9206 : CVE_2018_9206
 		date = "2018-10-19"
 		modified = "2023-12-05"
 		reference = "https://blogs.akamai.com/sitr/2018/10/having-the-security-rug-pulled-out-from-under-you.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_jquery_fileupload_cve_2018_9206.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ef7cc13130c60ece346802cb6efec96065f84407fb84b89703628fdf32c0ee53"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_jquery_fileupload_cve_2018_9206.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ef7cc13130c60ece346802cb6efec96065f84407fb84b89703628fdf32c0ee53"
 		score = 75
 		quality = 85
 		tags = "CVE-2018-9206"
@@ -404702,9 +400717,9 @@ rule SIGNATURE_BASE_Goldeneye_Ransomware_XLS : FILE
 		date = "2016-12-06"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/jp2SkT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_goldeneye.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "827c1d1c0f9c3ebd77413de7e1db5e29d05f2ece6676c79a79f6c1ff2788f42b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_goldeneye.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_827c1d1c0f9c3ebd77413de7e1db5e29d05f2ece6676c79a79f6c1ff2788f42b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404716,7 +400731,7 @@ rule SIGNATURE_BASE_Goldeneye_Ransomware_XLS : FILE
 		$x2 = "var shell = new ActiveXObject('WScript.Shell');shell.run(t'" fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <4000KB and 1 of them )
+		( uint16( 0 ) == 0xcfd0 and filesize < 4000KB and 1 of them )
 }
 rule SIGNATURE_BASE_Goldeneyeransomware_Dropper_Malformedzoomit : FILE
 {
@@ -404727,9 +400742,9 @@ rule SIGNATURE_BASE_Goldeneyeransomware_Dropper_Malformedzoomit : FILE
 		date = "2016-12-06"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/jp2SkT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_goldeneye.yar#L26-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c18405a272c9210973e3184b8267306919cba8795b12d5982a9e3e8f748f9782"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_goldeneye.yar#L26-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c18405a272c9210973e3184b8267306919cba8795b12d5982a9e3e8f748f9782"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404741,7 +400756,7 @@ rule SIGNATURE_BASE_Goldeneyeransomware_Dropper_Malformedzoomit : FILE
 		$n1 = "Mark Russinovich" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and $s1 and not $n1)
+		( uint16( 0 ) == 0x5a4d and filesize < 800KB and $s1 and not $n1 )
 }
 rule SIGNATURE_BASE_SUSP_CMD_Var_Expansion : FILE
 {
@@ -404752,9 +400767,9 @@ rule SIGNATURE_BASE_SUSP_CMD_Var_Expansion : FILE
 		date = "2018-09-26"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/asfakian/status/1044859525675843585"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_cmd_var_expansion.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "68ce14cac07494645f3b5f1d61012e4fe21cfa9fa7ad4019add2368b568fe043"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_cmd_var_expansion.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_68ce14cac07494645f3b5f1d61012e4fe21cfa9fa7ad4019add2368b568fe043"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -404763,7 +400778,7 @@ rule SIGNATURE_BASE_SUSP_CMD_Var_Expansion : FILE
 		$a1 = " /V:ON" ascii wide fullword
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <500KB and $a1
+		uint16( 0 ) == 0xcfd0 and filesize < 500KB and $a1
 }
 rule SIGNATURE_BASE_APT_APT28_Cannon_Trojan_Nov18_1 : FILE
 {
@@ -404774,9 +400789,9 @@ rule SIGNATURE_BASE_APT_APT28_Cannon_Trojan_Nov18_1 : FILE
 		date = "2018-11-20"
 		modified = "2023-12-05"
 		reference = "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_sofacy_cannon.yar#L2-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "de8c7bf80fe6209d00955c375b769a3aca138759335abb11f5086f85a4a9c367"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_sofacy_cannon.yar#L2-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_de8c7bf80fe6209d00955c375b769a3aca138759335abb11f5086f85a4a9c367"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404803,7 +400818,7 @@ rule SIGNATURE_BASE_APT_APT28_Cannon_Trojan_Nov18_1 : FILE
 		$s4 = "AnswerMessageTraverser`1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of ($x*) or 3 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of ( $x* ) or 3 of them
 }
 rule SIGNATURE_BASE_VULN_PUA_GIGABYTE_Driver_Jul22_1 : FILE
 {
@@ -404814,9 +400829,9 @@ rule SIGNATURE_BASE_VULN_PUA_GIGABYTE_Driver_Jul22_1 : FILE
 		date = "2022-07-25"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/malmoeb/status/1551449425842786306"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_gigabyte_driver.yar#L2-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8aeae559b52b8e01ceab8caba24653b949b3bec694a14b36c819b0a7c9f8b7c6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_gigabyte_driver.yar#L2-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8aeae559b52b8e01ceab8caba24653b949b3bec694a14b36c819b0a7c9f8b7c6"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -404837,10 +400852,8 @@ rule SIGNATURE_BASE_VULN_PUA_GIGABYTE_Driver_Jul22_1 : FILE
 		$x3 = "ARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAA1AC4AMgAuADMANwA5ADAALgAxADgAMwAwACAAYgB1AGkAbAB0ACAAYgB5ADoAIABXAGkAbgBEAEQASwAAAAAAMgAJAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABnAGQAcgB2AC4AcwB5AH"
 
 	condition:
-		filesize <4000KB and 1 of them
+		filesize < 4000KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Honeybee_Dropper_Maldoc : FILE
 {
 	meta:
@@ -404850,9 +400863,9 @@ rule SIGNATURE_BASE_Honeybee_Dropper_Maldoc : FILE
 		date = "2018-03-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/JAHZVL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_honeybee.yar#L13-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8bc680a59a7bd269eea001c2c74e41ecd93a9b848210779fc7d9c24dfab7767a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_honeybee.yar#L13-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8bc680a59a7bd269eea001c2c74e41ecd93a9b848210779fc7d9c24dfab7767a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404871,7 +400884,7 @@ rule SIGNATURE_BASE_Honeybee_Dropper_Maldoc : FILE
 		$s6 = "\\setup.cab" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <400KB and (1 of ($x*) or 4 of them )
+		uint16( 0 ) == 0xcfd0 and filesize < 400KB and ( 1 of ( $x* ) or 4 of them )
 }
 import "pe"
 
@@ -404884,9 +400897,9 @@ rule SIGNATURE_BASE_Ophoneybee_Malware_1 : FILE
 		date = "2018-03-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/JAHZVL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_honeybee.yar#L37-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5cd37bc515bc1dd61ee58cfdf34622e4f884cc771d1fa2c793986be94b751a70"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_honeybee.yar#L37-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5cd37bc515bc1dd61ee58cfdf34622e4f884cc771d1fa2c793986be94b751a70"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404912,10 +400925,8 @@ rule SIGNATURE_BASE_Ophoneybee_Malware_1 : FILE
 		$s9 = "TO EVERYONE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="e14b59a79999cc0bc589a4cb5994692a" or pe.imphash()=="64400f452e2f60305c341e08f217b02c" or 1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "e14b59a79999cc0bc589a4cb5994692a" or pe.imphash ( ) == "64400f452e2f60305c341e08f217b02c" or 1 of ( $x* ) or 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Ophoneybee_Maocheng_Dropper : FILE
 {
 	meta:
@@ -404925,9 +400936,9 @@ rule SIGNATURE_BASE_Ophoneybee_Maocheng_Dropper : FILE
 		date = "2018-03-03"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/JAHZVL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_honeybee.yar#L73-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "85bcde1d821c052636a75dce4d8c3753188dd7da5fce2b3401d51c02d1c2fa6b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_honeybee.yar#L73-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_85bcde1d821c052636a75dce4d8c3753188dd7da5fce2b3401d51c02d1c2fa6b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404938,10 +400949,8 @@ rule SIGNATURE_BASE_Ophoneybee_Maocheng_Dropper : FILE
 		$x1 = "\\MaoCheng\\Release\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Cobaltstrike_CN_Group_Beacondropper_Aug17 : FILE
 {
 	meta:
@@ -404951,9 +400960,9 @@ rule SIGNATURE_BASE_Cobaltstrike_CN_Group_Beacondropper_Aug17 : FILE
 		date = "2017-08-09"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cobaltgang.yar#L15-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "89db9c5f09afc9cb54fb7a9cd1490373c568ac4dc04bdb9ef71136f91e16ad2c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cobaltgang.yar#L15-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_89db9c5f09afc9cb54fb7a9cd1490373c568ac4dc04bdb9ef71136f91e16ad2c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -404975,10 +400984,8 @@ rule SIGNATURE_BASE_Cobaltstrike_CN_Group_Beacondropper_Aug17 : FILE
 		$x10 = ";sh=x('WScript.Shell');" ascii
 
 	condition:
-		( filesize <200KB and 1 of them )
+		( filesize < 200KB and 1 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_1 : FILE
 {
 	meta:
@@ -404988,9 +400995,9 @@ rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_1 : FILE
 		date = "2017-08-09"
 		modified = "2023-12-05"
 		reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cobaltgang.yar#L41-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "46077106bd19dd38a714a220b887742f5a29424ac8eb89f469975f863b3782ec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cobaltgang.yar#L41-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_46077106bd19dd38a714a220b887742f5a29424ac8eb89f469975f863b3782ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405004,10 +401011,8 @@ rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_1 : FILE
 		$s4 = "Click 'Start' to start the Server.  'Stop' to Stop it." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_2 : FILE
 {
 	meta:
@@ -405017,9 +401022,9 @@ rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_2 : FILE
 		date = "2017-08-09"
 		modified = "2023-12-05"
 		reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cobaltgang.yar#L59-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "54095d2f447b6478aefe956133fb9b97171c1e07d7d9186a70bf242a094e4156"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cobaltgang.yar#L59-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_54095d2f447b6478aefe956133fb9b97171c1e07d7d9186a70bf242a094e4156"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405030,7 +401035,7 @@ rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_2 : FILE
 		$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENGB)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
 }
 import "pe"
 
@@ -405043,9 +401048,9 @@ rule SIGNATURE_BASE_MAL_CRIME_Cobaltgang_Malware_Oct19_1 : FILE
 		date = "2019-10-24"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/vxsh4d0w/status/1187353649015611392"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cobaltgang.yar#L74-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4bd57aa6929b3eced7dee8063d89c542f2c80f802ef40efc23bbea6cc8ffd98c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cobaltgang.yar#L74-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4bd57aa6929b3eced7dee8063d89c542f2c80f802ef40efc23bbea6cc8ffd98c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405059,7 +401064,7 @@ rule SIGNATURE_BASE_MAL_CRIME_Cobaltgang_Malware_Oct19_1 : FILE
 		$op_b2 = { 89 e5 53 8b 55 08 8b 45 0c 8a 1c 0a 88 1c 08 83 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and (pe.imphash()=="d1e3f8d02cce09520379e5c1e72f862f" or pe.imphash()=="8e26df99c70f79cb8b1ea2ef6f8e52ac" or ($op_a1 and 1 of ($op_b*)))
+		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and ( pe.imphash ( ) == "d1e3f8d02cce09520379e5c1e72f862f" or pe.imphash ( ) == "8e26df99c70f79cb8b1ea2ef6f8e52ac" or ( $op_a1 and 1 of ( $op_b* ) ) )
 }
 rule SIGNATURE_BASE_APT_Liudoor : WIN32_DLL
 {
@@ -405070,9 +401075,9 @@ rule SIGNATURE_BASE_APT_Liudoor : WIN32_DLL
 		date = "2015-07-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_terracotta_liudoor.yar#L1-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6f60002d0173a8ebd2b407e79377d4816e699742aedb1e0649b08fd4ca6cf359"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_terracotta_liudoor.yar#L1-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6f60002d0173a8ebd2b407e79377d4816e699742aedb1e0649b08fd4ca6cf359"
 		score = 75
 		quality = 85
 		tags = "WIN32 DLL"
@@ -405097,8 +401102,6 @@ rule SIGNATURE_BASE_APT_Liudoor : WIN32_DLL
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_MAL_RANSOM_Ragna_Locker_Apr20_1 : FILE
 {
 	meta:
@@ -405108,9 +401111,9 @@ rule SIGNATURE_BASE_MAL_RANSOM_Ragna_Locker_Apr20_1 : FILE
 		date = "2020-04-27"
 		modified = "2023-12-05"
 		reference = "https://otx.alienvault.com/indicator/file/c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_ragna_locker.yar#L3-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "05a18818f22c836c3e1f1fa9682d787bbe86e6d3bb026a80a7d4c33ad95c2cd3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_ragna_locker.yar#L3-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_05a18818f22c836c3e1f1fa9682d787bbe86e6d3bb026a80a7d4c33ad95c2cd3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405136,7 +401139,7 @@ rule SIGNATURE_BASE_MAL_RANSOM_Ragna_Locker_Apr20_1 : FILE
 		$op3 = { 8b 75 08 8a 84 0d 20 ff ff ff ff 45 08 32 06 8b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*) or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) or 4 of them
 }
 import "pe"
 
@@ -405149,9 +401152,9 @@ rule SIGNATURE_BASE_MAL_Ransom_Ragnarlocker_July_2020_1 : FILE
 		date = "2020-07-30"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/JAMESWT_MHT/status/1288797666688851969"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_ransom_ragna_locker.yar#L38-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dc44da2f9023e0702afa8081e85ba817ebfde15f449261fae9de729d51262b04"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_ransom_ragna_locker.yar#L38-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dc44da2f9023e0702afa8081e85ba817ebfde15f449261fae9de729d51262b04"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -405181,7 +401184,7 @@ rule SIGNATURE_BASE_MAL_Ransom_Ragnarlocker_July_2020_1 : FILE
 		$s4 = "Tor browser" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and (pe.imphash()=="2c2aab89a4cba444cf2729e2ed61ed4f" and ((2 of ($f*)) and (3 of ($r*)) and (4 of ($a*)) and (2 of ($c*)) and (2 of ($s*))))
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and ( pe.imphash ( ) == "2c2aab89a4cba444cf2729e2ed61ed4f" and ( ( 2 of ( $f* ) ) and ( 3 of ( $r* ) ) and ( 4 of ( $a* ) ) and ( 2 of ( $c* ) ) and ( 2 of ( $s* ) ) ) )
 }
 rule SIGNATURE_BASE_Derusbi_Kernel : FILE
 {
@@ -405192,9 +401195,9 @@ rule SIGNATURE_BASE_Derusbi_Kernel : FILE
 		date = "2015-12-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_derusbi.yar#L9-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d5a0ce0b0116c3a84d52c22369dbf3cb9cf3ad8f8a05cea5565ba9bb99255fab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_derusbi.yar#L9-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d5a0ce0b0116c3a84d52c22369dbf3cb9cf3ad8f8a05cea5565ba9bb99255fab"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405205,7 +401208,7 @@ rule SIGNATURE_BASE_Derusbi_Kernel : FILE
 		$class = ".?AVPCC_BASEMOD@@"
 
 	condition:
-		uint16(0)==0x5A4D and $token1 and $token2 and $class
+		uint16( 0 ) == 0x5A4D and $token1 and $token2 and $class
 }
 rule SIGNATURE_BASE_Derusbi_Linux : FILE
 {
@@ -405216,9 +401219,9 @@ rule SIGNATURE_BASE_Derusbi_Linux : FILE
 		date = "2015-12-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_derusbi.yar#L24-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "68d5af17b33d1aa0388516e5d2a1ad29c22dc04451e232dfbdf1ef0714baeb10"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_derusbi.yar#L24-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_68d5af17b33d1aa0388516e5d2a1ad29c22dc04451e232dfbdf1ef0714baeb10"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405242,9 +401245,9 @@ rule SIGNATURE_BASE_Derusbi_Kernel_Driver_WD_UDFS : FILE
 		date = "2015-12-15"
 		modified = "2023-12-05"
 		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_derusbi.yar#L48-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "bea8dafbef01ca8cf747a1f24804c0fb7868db09ce8091ff93c9c5d67d95ca3e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_derusbi.yar#L48-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_bea8dafbef01ca8cf747a1f24804c0fb7868db09ce8091ff93c9c5d67d95ca3e"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -405268,7 +401271,7 @@ rule SIGNATURE_BASE_Derusbi_Kernel_Driver_WD_UDFS : FILE
 		$s5 = "HOST: %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and (2 of ($x*) or all of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( 2 of ( $x* ) or all of ( $s* ) )
 }
 rule SIGNATURE_BASE_Derusbi_Code_Signing_Cert : FILE
 {
@@ -405279,9 +401282,9 @@ rule SIGNATURE_BASE_Derusbi_Code_Signing_Cert : FILE
 		date = "2015-12-15"
 		modified = "2023-12-05"
 		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_derusbi.yar#L81-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dae976a4896a4f6b6a1b415582db84f3da5aac03bf4079f75e11c790dcf23900"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_derusbi.yar#L81-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dae976a4896a4f6b6a1b415582db84f3da5aac03bf4079f75e11c790dcf23900"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -405293,7 +401296,7 @@ rule SIGNATURE_BASE_Derusbi_Code_Signing_Cert : FILE
 		$s3 = "Wemade Entertainment co.,Ltd0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of them
 }
 rule SIGNATURE_BASE_XOR_4Byte_Key : FILE
 {
@@ -405304,9 +401307,9 @@ rule SIGNATURE_BASE_XOR_4Byte_Key : FILE
 		date = "2015-12-15"
 		modified = "2023-12-05"
 		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_derusbi.yar#L98-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "61cbdac3fd9a486d85261234698f33aa04d505b32dfec731de6fc61d103bf609"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_derusbi.yar#L98-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_61cbdac3fd9a486d85261234698f33aa04d505b32dfec731de6fc61d103bf609"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -405316,7 +401319,7 @@ rule SIGNATURE_BASE_XOR_4Byte_Key : FILE
 		$s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them
 }
 rule SIGNATURE_BASE_Derusbi_Backdoor_Mar17_1 : FILE
 {
@@ -405327,9 +401330,9 @@ rule SIGNATURE_BASE_Derusbi_Backdoor_Mar17_1 : FILE
 		date = "2017-03-03"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_derusbi.yar#L123-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "068a8d5c7378c6cf9d0369374550cd34b54e9f913aa7512a6beb46395fc15b19"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_derusbi.yar#L123-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_068a8d5c7378c6cf9d0369374550cd34b54e9f913aa7512a6beb46395fc15b19"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405347,7 +401350,7 @@ rule SIGNATURE_BASE_Derusbi_Backdoor_Mar17_1 : FILE
 		$x8 = "\\tmp1.dat" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them )
 }
 rule SIGNATURE_BASE_SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1 : CVE_2023_43641 FILE
 {
@@ -405358,9 +401361,9 @@ rule SIGNATURE_BASE_SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1 : CVE_2023_43641 FIL
 		date = "2023-10-27"
 		modified = "2023-12-05"
 		reference = "https://github.com/github/securitylab/blob/main/SecurityExploits/libcue/track_set_index_CVE-2023-43641/README.md"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_libcue_cve_2023_43641.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a2cd3c1b0b3551ffb24bf7704c37c1be6c1a9655c74447d2f7f94540dd0ab188"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_libcue_cve_2023_43641.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a2cd3c1b0b3551ffb24bf7704c37c1be6c1a9655c74447d2f7f94540dd0ab188"
 		score = 70
 		quality = 85
 		tags = "CVE-2023-43641, FILE"
@@ -405371,7 +401374,7 @@ rule SIGNATURE_BASE_SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1 : CVE_2023_43641 FIL
 		$s1 = "INDEX 4294"
 
 	condition:
-		filesize <100KB and all of them
+		filesize < 100KB and all of them
 }
 rule SIGNATURE_BASE_PS_AMSI_Bypass : FILE
 {
@@ -405382,9 +401385,9 @@ rule SIGNATURE_BASE_PS_AMSI_Bypass : FILE
 		date = "2017-07-19"
 		modified = "2023-12-05"
 		reference = "https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_scripts.yar#L4-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "87188c6cbb7d89c25faafb297a7c0e52321c661c84cdefd5604785c687190fcd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_scripts.yar#L4-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_87188c6cbb7d89c25faafb297a7c0e52321c661c84cdefd5604785c687190fcd"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -405405,9 +401408,9 @@ rule SIGNATURE_BASE_JS_Suspicious_Obfuscation_Dropbox
 		date = "2017-07-19"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_scripts.yar#L19-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "19d1dd25c4a5e18dca131709a64c3537278754ec9d67b0bb49bde9b1493d3dc7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_scripts.yar#L19-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_19d1dd25c4a5e18dca131709a64c3537278754ec9d67b0bb49bde9b1493d3dc7"
 		score = 70
 		quality = 85
 		tags = ""
@@ -405429,9 +401432,9 @@ rule SIGNATURE_BASE_JS_Suspicious_MSHTA_Bypass
 		date = "2017-07-19"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_scripts.yar#L35-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "df68cac0da19c5705353f26fc3f2a99556b7230f9d4f52e7a2e35cb48997b699"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_scripts.yar#L35-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_df68cac0da19c5705353f26fc3f2a99556b7230f9d4f52e7a2e35cb48997b699"
 		score = 70
 		quality = 85
 		tags = ""
@@ -405454,9 +401457,9 @@ rule SIGNATURE_BASE_Javascript_Run_Suspicious
 		date = "2017-08-23"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/craiu/status/900314063560998912"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_scripts.yar#L52-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "39d2292d3749c63780dc7ca7a2414ba02e2b0e1edec7ec6a16b42aba2c44c23a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_scripts.yar#L52-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_39d2292d3749c63780dc7ca7a2414ba02e2b0e1edec7ec6a16b42aba2c44c23a"
 		score = 60
 		quality = 85
 		tags = ""
@@ -405478,9 +401481,9 @@ rule SIGNATURE_BASE_Certutil_Decode_OR_Download : FILE
 		date = "2017-08-29"
 		modified = "2023-10-19"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_scripts.yar#L70-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5640dcfedc028cc40b0376d328758b504eb1ff860da94648b435eadb760d9724"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_scripts.yar#L70-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5640dcfedc028cc40b0376d328758b504eb1ff860da94648b435eadb760d9724"
 		score = 40
 		quality = 85
 		tags = "FILE"
@@ -405496,7 +401499,7 @@ rule SIGNATURE_BASE_Certutil_Decode_OR_Download : FILE
 		$fp_msi = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
 
 	condition:
-		filesize <700KB and 1 of ($a*) and not 1 of ($fp*)
+		filesize < 700KB and 1 of ( $a* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Suspicious_JS_Script_Content : FILE
 {
@@ -405507,9 +401510,9 @@ rule SIGNATURE_BASE_Suspicious_JS_Script_Content : FILE
 		date = "2017-12-02"
 		modified = "2023-12-05"
 		reference = "Research on Leviathan https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_scripts.yar#L95-L112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1dbc1a266d710a70a77c81d5b872d0d324423250a9f34455faef53ac4c41b5f2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_scripts.yar#L95-L112"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1dbc1a266d710a70a77c81d5b872d0d324423250a9f34455faef53ac4c41b5f2"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -405523,7 +401526,7 @@ rule SIGNATURE_BASE_Suspicious_JS_Script_Content : FILE
 		$x4 = "args='/s /u /i:" ascii
 
 	condition:
-		( filesize <10KB and 1 of them )
+		( filesize < 10KB and 1 of them )
 }
 rule SIGNATURE_BASE_Universal_Exploit_Strings : FILE
 {
@@ -405534,9 +401537,9 @@ rule SIGNATURE_BASE_Universal_Exploit_Strings : FILE
 		date = "2017-12-02"
 		modified = "2023-12-05"
 		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_scripts.yar#L114-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6436a1cf6d0acc3162ec99c95ef20b3e6dd110c77d5a0b26ac790551316c0a69"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_scripts.yar#L114-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6436a1cf6d0acc3162ec99c95ef20b3e6dd110c77d5a0b26ac790551316c0a69"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -405550,7 +401553,7 @@ rule SIGNATURE_BASE_Universal_Exploit_Strings : FILE
 		$s4 = "bindshell"
 
 	condition:
-		( filesize <2KB and 3 of them )
+		( filesize < 2KB and 3 of them )
 }
 rule SIGNATURE_BASE_VBS_Obfuscated_Mal_Feb18_1 : FILE
 {
@@ -405561,9 +401564,9 @@ rule SIGNATURE_BASE_VBS_Obfuscated_Mal_Feb18_1 : FILE
 		date = "2018-02-12"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/zPsn83"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_mal_scripts.yar#L133-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bbd388a3103744df2434956c2b7ac12dacd72f9041b4cc014d31eec4115aedd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_mal_scripts.yar#L133-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bbd388a3103744df2434956c2b7ac12dacd72f9041b4cc014d31eec4115aedd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405582,7 +401585,7 @@ rule SIGNATURE_BASE_VBS_Obfuscated_Mal_Feb18_1 : FILE
 		$s3 = "&WSCRIPT.SCRIPTFULLNAME&CHR" fullword ascii
 
 	condition:
-		filesize <600KB and (1 of ($x*) or 3 of them )
+		filesize < 600KB and ( 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_MAL_Kwampirs_Apr18 : KWAMPIRS
 {
@@ -405593,9 +401596,9 @@ rule SIGNATURE_BASE_MAL_Kwampirs_Apr18 : KWAMPIRS
 		date = "2018-04-23"
 		modified = "2023-12-05"
 		reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_kwampirs.yar#L1-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e9387c46b9e3fff90415c46af270d143bdeb6292f2521d889b8d6ae726a4cf3b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_kwampirs.yar#L1-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e9387c46b9e3fff90415c46af270d143bdeb6292f2521d889b8d6ae726a4cf3b"
 		score = 75
 		quality = 85
 		tags = "KWAMPIRS"
@@ -405670,9 +401673,9 @@ rule SIGNATURE_BASE_MAL_APT_Operation_Shadowhammer_Malsetup : FILE
 		date = "2019-03-25"
 		modified = "2023-12-05"
 		reference = "https://securelist.com/operation-shadowhammer/89992/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_op_shadowhammer.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "dea31e401997b0aed1753754fd572a94df308229fccdf15ae6a907dcfd59b50a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_op_shadowhammer.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_dea31e401997b0aed1753754fd572a94df308229fccdf15ae6a907dcfd59b50a"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -405689,7 +401692,7 @@ rule SIGNATURE_BASE_MAL_APT_Operation_Shadowhammer_Malsetup : FILE
 		$x2 = "\\AsusShellCode\\Debug"
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16( 0 ) == 0x5a4d and 1 of them
 }
 rule SIGNATURE_BASE_VULN_Keepass_DB_Brute_Forcible : FILE
 {
@@ -405700,9 +401703,9 @@ rule SIGNATURE_BASE_VULN_Keepass_DB_Brute_Forcible : FILE
 		date = "2023-07-20"
 		modified = "2023-12-05"
 		reference = "https://keepass.info/help/base/security.html#secdictprotect"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vuln_keepass_brute_forcible.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "14460f7d4976a3bbd6de2f7cfccfbfec35eb780ab762396a6490669ddde59ce8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vuln_keepass_brute_forcible.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_14460f7d4976a3bbd6de2f7cfccfbfec35eb780ab762396a6490669ddde59ce8"
 		score = 60
 		quality = 85
 		tags = "FILE"
@@ -405723,9 +401726,9 @@ rule SIGNATURE_BASE_Waterbear_1_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f1d5bd0c9f85dd90217bdbd7e44100bcfbf77839f83416ad17121713c189b9fd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f1d5bd0c9f85dd90217bdbd7e44100bcfbf77839f83416ad17121713c189b9fd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405737,7 +401740,7 @@ rule SIGNATURE_BASE_Waterbear_1_Jun17 : FILE
 		$s2 = "svc.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
 }
 rule SIGNATURE_BASE_Waterbear_2_Jun17 : FILE
 {
@@ -405748,9 +401751,9 @@ rule SIGNATURE_BASE_Waterbear_2_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L27-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ec0b8d7313f925adafb7f03c8b7fd12c0176b75c74c642eeee900e911e0662a7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L27-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ec0b8d7313f925adafb7f03c8b7fd12c0176b75c74c642eeee900e911e0662a7"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405764,7 +401767,7 @@ rule SIGNATURE_BASE_Waterbear_2_Jun17 : FILE
 		$s4 = "UI look 2003" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_Waterbear_4_Jun17 : FILE
 {
@@ -405775,9 +401778,9 @@ rule SIGNATURE_BASE_Waterbear_4_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L45-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "46c43dbdcbc183995a8cd00c9888afcdd3adb9f3caf38ed42a0af1e7df39715f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L45-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_46c43dbdcbc183995a8cd00c9888afcdd3adb9f3caf38ed42a0af1e7df39715f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405797,7 +401800,7 @@ rule SIGNATURE_BASE_Waterbear_4_Jun17 : FILE
 		$s9 = "UNKOWN" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
 }
 rule SIGNATURE_BASE_Waterbear_5_Jun17 : FILE
 {
@@ -405808,9 +401811,9 @@ rule SIGNATURE_BASE_Waterbear_5_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-01-07"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L70-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a1572db08242fffadedbfb89f3652b2eb93c910f3b61f9db0622bc18d069827c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L70-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a1572db08242fffadedbfb89f3652b2eb93c910f3b61f9db0622bc18d069827c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405826,7 +401829,7 @@ rule SIGNATURE_BASE_Waterbear_5_Jun17 : FILE
 		$s5 = "1111%c%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x3d53 and filesize <100KB and ( all of ($a*) or 3 of them ))
+		( uint16( 0 ) == 0x3d53 and filesize < 100KB and ( all of ( $a* ) or 3 of them ) )
 }
 rule SIGNATURE_BASE_Waterbear_6_Jun17 : FILE
 {
@@ -405837,9 +401840,9 @@ rule SIGNATURE_BASE_Waterbear_6_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L92-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "af5c2a29e0a62c54e706492ae85b9786a6d9e5f42fe4d9c43693576e1a63b825"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L92-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_af5c2a29e0a62c54e706492ae85b9786a6d9e5f42fe4d9c43693576e1a63b825"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405851,7 +401854,7 @@ rule SIGNATURE_BASE_Waterbear_6_Jun17 : FILE
 		$s2 = "log.log" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them )
 }
 rule SIGNATURE_BASE_Waterbear_7_Jun17 : FILE
 {
@@ -405862,9 +401865,9 @@ rule SIGNATURE_BASE_Waterbear_7_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L108-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6a760abca78e799b194864ad56457ccb0b05123307da6bfcad0c66da47f485a1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L108-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6a760abca78e799b194864ad56457ccb0b05123307da6bfcad0c66da47f485a1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405879,7 +401882,7 @@ rule SIGNATURE_BASE_Waterbear_7_Jun17 : FILE
 		$s5 = "filemon.rtf" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
 }
 rule SIGNATURE_BASE_Waterbear_8_Jun17 : FILE
 {
@@ -405890,9 +401893,9 @@ rule SIGNATURE_BASE_Waterbear_8_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-01-07"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L127-L145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3b1dfe486ea141342f253963ce6cc1e73d063ce880cf2fcee1aaa6aa6e919349"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L127-L145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3b1dfe486ea141342f253963ce6cc1e73d063ce880cf2fcee1aaa6aa6e919349"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405907,7 +401910,7 @@ rule SIGNATURE_BASE_Waterbear_8_Jun17 : FILE
 		$s5 = "\\\\.\\SFilter" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them )
 }
 rule SIGNATURE_BASE_Waterbear_9_Jun17 : FILE
 {
@@ -405918,9 +401921,9 @@ rule SIGNATURE_BASE_Waterbear_9_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L147-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b54f3032b31c5a48e879e49bd97adf3222db46a7789afc4ea2f5eca32536a2e4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L147-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b54f3032b31c5a48e879e49bd97adf3222db46a7789afc4ea2f5eca32536a2e4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405935,7 +401938,7 @@ rule SIGNATURE_BASE_Waterbear_9_Jun17 : FILE
 		$b2 = "Update.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of ($s*) and ($a1 or all of ($b*))
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of ( $s* ) and ( $a1 or all of ( $b* ) )
 }
 rule SIGNATURE_BASE_Waterbear_10_Jun17 : FILE
 {
@@ -405946,9 +401949,9 @@ rule SIGNATURE_BASE_Waterbear_10_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L168-L182"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1e71a317f782b73c876f0cb5fee25b69d8f1c45c20c58e4f204b7aeb7484cf14"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L168-L182"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1e71a317f782b73c876f0cb5fee25b69d8f1c45c20c58e4f204b7aeb7484cf14"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405960,7 +401963,7 @@ rule SIGNATURE_BASE_Waterbear_10_Jun17 : FILE
 		$s5 = "ADVPACK32" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them )
 }
 rule SIGNATURE_BASE_Waterbear_11_Jun17 : FILE
 {
@@ -405971,9 +401974,9 @@ rule SIGNATURE_BASE_Waterbear_11_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L185-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ea61c348847614ad2872bfd385f433c5a30c7f6b5f5a2f135a7d83c553157ccd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L185-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ea61c348847614ad2872bfd385f433c5a30c7f6b5f5a2f135a7d83c553157ccd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -405987,7 +401990,7 @@ rule SIGNATURE_BASE_Waterbear_11_Jun17 : FILE
 		$s4 = "Copyright (C) 2005" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
 }
 rule SIGNATURE_BASE_Waterbear_12_Jun17 : FILE
 {
@@ -405998,9 +402001,9 @@ rule SIGNATURE_BASE_Waterbear_12_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L203-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "343e6f36190372cd5599a84834edc3935d27a1e01aeab53c5765598b5b4071fe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L203-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_343e6f36190372cd5599a84834edc3935d27a1e01aeab53c5765598b5b4071fe"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406012,7 +402015,7 @@ rule SIGNATURE_BASE_Waterbear_12_Jun17 : FILE
 		$s2 = "XMODIFY" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Waterbear_13_Jun17 : FILE
 {
@@ -406023,9 +402026,9 @@ rule SIGNATURE_BASE_Waterbear_13_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L219-L243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b34c3d643309b8bbaa122a753e7f58dd9340cfa33962dbab1454c8080afd1664"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L219-L243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b34c3d643309b8bbaa122a753e7f58dd9340cfa33962dbab1454c8080afd1664"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406047,7 +402050,7 @@ rule SIGNATURE_BASE_Waterbear_13_Jun17 : FILE
 		$s10 = "[-]send %d: " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 4 of them )
 }
 rule SIGNATURE_BASE_Waterbear_14_Jun17 : FILE
 {
@@ -406058,9 +402061,9 @@ rule SIGNATURE_BASE_Waterbear_14_Jun17 : FILE
 		date = "2017-06-23"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_waterbear.yar#L245-L261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ebe46590556e8eba2eef1c007549f6141c917bab97d46a0d58eca56257e24e2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_waterbear.yar#L245-L261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ebe46590556e8eba2eef1c007549f6141c917bab97d46a0d58eca56257e24e2"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406074,10 +402077,8 @@ rule SIGNATURE_BASE_Waterbear_14_Jun17 : FILE
 		$s2 = "C:\\recycled" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <8000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 8000KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Destructive_Ransomware_Gen1 : FILE
 {
 	meta:
@@ -406087,9 +402088,9 @@ rule SIGNATURE_BASE_Destructive_Ransomware_Gen1 : FILE
 		date = "2018-02-12"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_olympic_destroyer.yar#L13-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1f7a41c5a7e812e0e26b346cc6465290b17aff31620cbcf6e01c569d8eea2dbd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_olympic_destroyer.yar#L13-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1f7a41c5a7e812e0e26b346cc6465290b17aff31620cbcf6e01c569d8eea2dbd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406102,7 +402103,7 @@ rule SIGNATURE_BASE_Destructive_Ransomware_Gen1 : FILE
 		$x3 = "delete catalog -quiet" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
 }
 import "pe"
 
@@ -406115,9 +402116,9 @@ rule SIGNATURE_BASE_Olympicdestroyer_Gen2 : FILE
 		date = "2018-02-12"
 		modified = "2023-12-05"
 		reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_olympic_destroyer.yar#L30-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1bcf0e95d9de62271a09f6ac64ce65debc91e541e1fccfe5c31661466c00bd5e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_olympic_destroyer.yar#L30-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1bcf0e95d9de62271a09f6ac64ce65debc91e541e1fccfe5c31661466c00bd5e"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406138,7 +402139,7 @@ rule SIGNATURE_BASE_Olympicdestroyer_Gen2 : FILE
 		$s4 = "%s \\\\%s -u \"%s\" -p \"%s\" -accepteula -d %s %s \"%s\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and (pe.imphash()=="fd7200dcd5c0d9d4d277a26d951210aa" or pe.imphash()=="975087e9286238a80895b195efb3968d" or pe.imphash()=="da1c2d7acfe54df797bfb1f470257bc3" or 1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( pe.imphash ( ) == "fd7200dcd5c0d9d4d277a26d951210aa" or pe.imphash ( ) == "975087e9286238a80895b195efb3968d" or pe.imphash ( ) == "da1c2d7acfe54df797bfb1f470257bc3" or 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_HKTL_Redmimicry_Agent
 {
@@ -406149,9 +402150,9 @@ rule SIGNATURE_BASE_HKTL_Redmimicry_Agent
 		date = "2020-06-22"
 		modified = "2023-01-06"
 		reference = "https://redmimicry.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_redmimicry.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "645da2764ca911c4aae80b90622d2c61933dee929403858fc49f7bc0d44300c6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_redmimicry.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_645da2764ca911c4aae80b90622d2c61933dee929403858fc49f7bc0d44300c6"
 		score = 75
 		quality = 85
 		tags = ""
@@ -406181,9 +402182,9 @@ rule SIGNATURE_BASE_HKTL_Redmimicry_Winntiloader
 		date = "2020-06-22"
 		modified = "2023-01-10"
 		reference = "https://redmimicry.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_redmimicry.yar#L28-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d8ef457ac41a7c45cc7e97330bdd3de12eb3391c03d0a6a87ddc669c841c325d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_redmimicry.yar#L28-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d8ef457ac41a7c45cc7e97330bdd3de12eb3391c03d0a6a87ddc669c841c325d"
 		score = 75
 		quality = 85
 		tags = ""
@@ -406206,9 +402207,9 @@ rule SIGNATURE_BASE_MAL_LNX_Redmenshen_Bpfdoor_May23_1 : FILE
 		date = "2023-05-11"
 		modified = "2023-12-05"
 		reference = "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lnx_implant_may22.yar#L3-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c58971a43443800256e791b4f9fe7c3221518b0050e5f2964b6c843ddb4549ac"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lnx_implant_may22.yar#L3-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c58971a43443800256e791b4f9fe7c3221518b0050e5f2964b6c843ddb4549ac"
 		score = 80
 		quality = 85
 		tags = "FILE"
@@ -406226,7 +402227,7 @@ rule SIGNATURE_BASE_MAL_LNX_Redmenshen_Bpfdoor_May23_1 : FILE
 		$sop3 = { 49 d3 cd 4d 31 cd b1 29 49 89 e9 49 d3 c8 4d 31 c5 4c 03 68 10 48 89 f9 }
 
 	condition:
-		uint16(0)==0x457f and filesize <900KB and ((1 of ($x*) and 1 of ($s*)) or 4 of them or ( all of ($sc*) and $sc1 in (@sc2[1]-50..@sc2[1]+50))) or (2 of ($x*) or 5 of them )
+		uint16( 0 ) == 0x457f and filesize < 900KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or 4 of them or ( all of ( $sc* ) and $sc1 in ( @sc2 [ 1 ] - 50 .. @sc2 [ 1 ] + 50 ) ) ) or ( 2 of ( $x* ) or 5 of them )
 }
 rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_1 : FILE
 {
@@ -406237,9 +402238,9 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_1 : FILE
 		date = "2022-05-05"
 		modified = "2023-12-05"
 		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lnx_implant_may22.yar#L45-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8de10beea4ef2e059b16d38fb015d6f091cc517b6f0c06b6ef6868518349994d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lnx_implant_may22.yar#L45-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8de10beea4ef2e059b16d38fb015d6f091cc517b6f0c06b6ef6868518349994d"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -406265,7 +402266,7 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_1 : FILE
 		$op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }
 
 	condition:
-		uint16(0)==0x457f and filesize <80KB and 2 of them or 5 of them
+		uint16( 0 ) == 0x457f and filesize < 80KB and 2 of them or 5 of them
 }
 rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_2 : FILE
 {
@@ -406276,9 +402277,9 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_2 : FILE
 		date = "2022-05-07"
 		modified = "2023-12-05"
 		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lnx_implant_may22.yar#L78-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7525c675dbba6eb480f1d28fc6db05bd9907725c291e64ee6dc2453fd42892a0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lnx_implant_may22.yar#L78-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7525c675dbba6eb480f1d28fc6db05bd9907725c291e64ee6dc2453fd42892a0"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -406295,7 +402296,7 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_2 : FILE
 		$op3 = { e8 ?? d? ff ff 8b 45 f0 eb 12 8b 85 3c ff ff ff 89 c7 e8 ?? d? ff ff b8 ff ff ff ff c9 }
 
 	condition:
-		uint16(0)==0x457f and filesize <100KB and 2 of ($opx*) or 4 of them
+		uint16( 0 ) == 0x457f and filesize < 100KB and 2 of ( $opx* ) or 4 of them
 }
 rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_3 : FILE
 {
@@ -406306,9 +402307,9 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_3 : FILE
 		date = "2022-05-08"
 		modified = "2023-12-05"
 		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lnx_implant_may22.yar#L102-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "afec0bfeddf5c5c2abc1a3173f636c385437e5d7c0b68665f6274011113a6a9c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lnx_implant_may22.yar#L102-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_afec0bfeddf5c5c2abc1a3173f636c385437e5d7c0b68665f6274011113a6a9c"
 		score = 85
 		quality = 85
 		tags = "FILE"
@@ -406321,7 +402322,7 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_3 : FILE
 		$s3 = "pickup -l -t fifo -u" ascii fullword
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and 2 of them or all of them
+		uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them or all of them
 }
 rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_Generic_May22_1 : FILE
 {
@@ -406332,9 +402333,9 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_Generic_May22_1 :
 		date = "2022-05-09"
 		modified = "2023-12-05"
 		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_lnx_implant_may22.yar#L121-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "57ae5f7dc1d202fe66d6626ef2bf2278b92bec0310449ce049bdaeaec5657c77"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_lnx_implant_may22.yar#L121-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_57ae5f7dc1d202fe66d6626ef2bf2278b92bec0310449ce049bdaeaec5657c77"
 		score = 90
 		quality = 85
 		tags = "FILE"
@@ -406365,7 +402366,7 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_Generic_May22_1 :
 		$op6 = { 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 }
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and 2 of them or 4 of them
+		uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them or 4 of them
 }
 rule SIGNATURE_BASE_SUSP_Maldoc_Excelmacro : FILE
 {
@@ -406376,9 +402377,9 @@ rule SIGNATURE_BASE_SUSP_Maldoc_Excelmacro : FILE
 		date = "2020-11-03"
 		modified = "2023-12-05"
 		reference = "YARA Exchange - Undisclosed Macro Builder"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_macro_builders.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c5d0655eaf2ca36c828675f9673a1d4284ef8719fd9ec1d354ee3284d1fb0a0c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_macro_builders.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c5d0655eaf2ca36c828675f9673a1d4284ef8719fd9ec1d354ee3284d1fb0a0c"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -406391,7 +402392,7 @@ rule SIGNATURE_BASE_SUSP_Maldoc_Excelmacro : FILE
 		$macro = "xl/macrosheets/"
 
 	condition:
-		uint16(0)==0x4b50 and filesize <2000KB and $artifact1 and $macro and $import1 and 1 of ($url*)
+		uint16( 0 ) == 0x4b50 and filesize < 2000KB and $artifact1 and $macro and $import1 and 1 of ( $url* )
 }
 rule SIGNATURE_BASE_SUSP_LNK_Lnkfileoverrfc : FILE
 {
@@ -406402,9 +402403,9 @@ rule SIGNATURE_BASE_SUSP_LNK_Lnkfileoverrfc : FILE
 		date = "2018-09-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_lnk_files.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "52ff949a17039c1fa5707ff503aa1a96b3925bdfef01867c9b59a8d72493a84e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_lnk_files.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_52ff949a17039c1fa5707ff503aa1a96b3925bdfef01867c9b59a8d72493a84e"
 		score = 65
 		quality = 85
 		tags = "FILE"
@@ -406416,7 +402417,7 @@ rule SIGNATURE_BASE_SUSP_LNK_Lnkfileoverrfc : FILE
 		$cert = " -decode " ascii
 
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and filesize >15KB and (2 of them )
+		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and filesize > 15KB and ( 2 of them )
 }
 rule SIGNATURE_BASE_SUSP_LNK_Suspiciouscommands : FILE
 {
@@ -406427,9 +402428,9 @@ rule SIGNATURE_BASE_SUSP_LNK_Suspiciouscommands : FILE
 		date = "2018-09-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_lnk_files.yar#L20-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a0380927ebc89e46f9138e01f154113c5e23680cea9b117b47406003ea565c1e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_lnk_files.yar#L20-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a0380927ebc89e46f9138e01f154113c5e23680cea9b117b47406003ea565c1e"
 		score = 60
 		quality = 81
 		tags = "FILE"
@@ -406457,7 +402458,7 @@ rule SIGNATURE_BASE_SUSP_LNK_Suspiciouscommands : FILE
 		$s21 = "%&&@echo off "
 
 	condition:
-		uint16(0)==0x004c and 1 of them
+		uint16( 0 ) == 0x004c and 1 of them
 }
 rule SIGNATURE_BASE_SUSP_DOC_LNK_In_ZIP : FILE
 {
@@ -406468,9 +402469,9 @@ rule SIGNATURE_BASE_SUSP_DOC_LNK_In_ZIP : FILE
 		date = "2019-07-02"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/RedDrip7/status/1145877272945025029"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_susp_lnk_files.yar#L53-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ef4cdaad05af12f210aa6324a1e34a42843f814c59fb0085ac18370917ad4866"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_susp_lnk_files.yar#L53-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ef4cdaad05af12f210aa6324a1e34a42843f814c59fb0085ac18370917ad4866"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -406480,7 +402481,7 @@ rule SIGNATURE_BASE_SUSP_DOC_LNK_In_ZIP : FILE
 		$s1 = ".doc.lnk" fullword ascii
 
 	condition:
-		uint16(0)==0x4b50 and 1 of them
+		uint16( 0 ) == 0x4b50 and 1 of them
 }
 rule SIGNATURE_BASE_Nanocore_RAT_Gen_1 : FILE
 {
@@ -406491,9 +402492,9 @@ rule SIGNATURE_BASE_Nanocore_RAT_Gen_1 : FILE
 		date = "2016-04-22"
 		modified = "2023-12-05"
 		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nanocore_rat.yar#L8-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "09fab3ef1b4ca9092fd69fb09c4ef759946fcb5b84161441bff797bb4009ed00"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nanocore_rat.yar#L8-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_09fab3ef1b4ca9092fd69fb09c4ef759946fcb5b84161441bff797bb4009ed00"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -406508,7 +402509,7 @@ rule SIGNATURE_BASE_Nanocore_RAT_Gen_1 : FILE
 		$x5 = "Monitorinjection" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of them )) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_Nanocore_RAT_Gen_2 : FILE
 {
@@ -406519,9 +402520,9 @@ rule SIGNATURE_BASE_Nanocore_RAT_Gen_2 : FILE
 		date = "2016-04-22"
 		modified = "2023-12-05"
 		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nanocore_rat.yar#L28-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "23b3d149012fb8395b7daa2ecaf3ee66fdeac352ac94d632d76e52df2c6e8ea6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nanocore_rat.yar#L28-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_23b3d149012fb8395b7daa2ecaf3ee66fdeac352ac94d632d76e52df2c6e8ea6"
 		score = 100
 		quality = 85
 		tags = "FILE"
@@ -406534,7 +402535,7 @@ rule SIGNATURE_BASE_Nanocore_RAT_Gen_2 : FILE
 		$x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 1 of them ) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )
 }
 rule SIGNATURE_BASE_Nanocore_RAT_Sample_1 : FILE
 {
@@ -406545,9 +402546,9 @@ rule SIGNATURE_BASE_Nanocore_RAT_Sample_1 : FILE
 		date = "2016-04-22"
 		modified = "2023-12-05"
 		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nanocore_rat.yar#L46-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c74e5fe7e9d4dd7f032281b0e617f2355bc5844acf04a8ffbfd42165c7d9b8e4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nanocore_rat.yar#L46-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c74e5fe7e9d4dd7f032281b0e617f2355bc5844acf04a8ffbfd42165c7d9b8e4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406560,7 +402561,7 @@ rule SIGNATURE_BASE_Nanocore_RAT_Sample_1 : FILE
 		$x3 = "popthatkitty.Resources.resources" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*))) or ( all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) ) ) or ( all of them )
 }
 rule SIGNATURE_BASE_Nanocore_RAT_Sample_2 : FILE
 {
@@ -406571,9 +402572,9 @@ rule SIGNATURE_BASE_Nanocore_RAT_Sample_2 : FILE
 		date = "2016-04-22"
 		modified = "2023-12-05"
 		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nanocore_rat.yar#L64-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "505176b7320e95c652f0b6fdc6fadc3d16ff30115263862ba61209fa2fb82a2d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nanocore_rat.yar#L64-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_505176b7320e95c652f0b6fdc6fadc3d16ff30115263862ba61209fa2fb82a2d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406586,7 +402587,7 @@ rule SIGNATURE_BASE_Nanocore_RAT_Sample_2 : FILE
 		$s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of ( $s* )
 }
 rule SIGNATURE_BASE_Nanocore_RAT_Feb18_1 : FILE
 {
@@ -406597,9 +402598,9 @@ rule SIGNATURE_BASE_Nanocore_RAT_Feb18_1 : FILE
 		date = "2018-02-19"
 		modified = "2023-12-05"
 		reference = "Internal Research - T2T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nanocore_rat.yar#L92-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "824fd7304fb298ced69811078aa2dd23d7116554cffb8b6e4b690fccc93a4caf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nanocore_rat.yar#L92-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_824fd7304fb298ced69811078aa2dd23d7116554cffb8b6e4b690fccc93a4caf"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406616,7 +402617,7 @@ rule SIGNATURE_BASE_Nanocore_RAT_Feb18_1 : FILE
 		$s5 = "IClientLoggingHost" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 5 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 5 of them )
 }
 rule SIGNATURE_BASE_Nanocore_RAT_Feb18_2 : FILE
 {
@@ -406627,9 +402628,9 @@ rule SIGNATURE_BASE_Nanocore_RAT_Feb18_2 : FILE
 		date = "2018-02-19"
 		modified = "2023-12-05"
 		reference = "Internal Research - T2T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_nanocore_rat.yar#L117-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c104e431a4ecc0d18d7eb74e7a55d32bf8978ee922637d48f3f6a9466a0f5b1a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_nanocore_rat.yar#L117-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c104e431a4ecc0d18d7eb74e7a55d32bf8978ee922637d48f3f6a9466a0f5b1a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406647,7 +402648,7 @@ rule SIGNATURE_BASE_Nanocore_RAT_Feb18_2 : FILE
 		$s8 = "ExitRunnable" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
 }
 rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_1 : FILE
 {
@@ -406658,10 +402659,10 @@ rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_1 : FILE
 		date = "2015-12-02"
 		modified = "2023-12-05"
 		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_phish_gina_dec15.yar#L8-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_phish_gina_dec15.yar#L8-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210"
-		logic_hash = "91fc1b4682c1490b916b11685e1ecc74a964d657e544c0b84e8301b299154d02"
+		logic_hash = "v1_sha256_91fc1b4682c1490b916b11685e1ecc74a964d657e544c0b84e8301b299154d02"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406679,7 +402680,7 @@ rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_1 : FILE
 		$s9 = "FreeConsole" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
 }
 rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_2 : FILE
 {
@@ -406690,9 +402691,9 @@ rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_2 : FILE
 		date = "2015-12-03"
 		modified = "2023-12-05"
 		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_phish_gina_dec15.yar#L31-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f5eb21d0f635171e1edcfecc909bc3508dfb6c32e7fdd7263edd5cd98e6ba411"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_phish_gina_dec15.yar#L31-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f5eb21d0f635171e1edcfecc909bc3508dfb6c32e7fdd7263edd5cd98e6ba411"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406706,7 +402707,7 @@ rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_2 : FILE
 		$s6 = "Copy Rights by WangLei 1999.4" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
 rule SIGNATURE_BASE_PHISH_02Dez2015_Attach_P_ORD_C_10156_124658 : FILE
 {
@@ -406717,9 +402718,9 @@ rule SIGNATURE_BASE_PHISH_02Dez2015_Attach_P_ORD_C_10156_124658 : FILE
 		date = "2015-12-02"
 		modified = "2023-12-05"
 		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_phish_gina_dec15.yar#L49-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a2820b024b371447eab71f153b6251776719cfe55e08cb2a3cda5ee6da29949d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_phish_gina_dec15.yar#L49-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a2820b024b371447eab71f153b6251776719cfe55e08cb2a3cda5ee6da29949d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406741,7 +402742,7 @@ rule SIGNATURE_BASE_PHISH_02Dez2015_Attach_P_ORD_C_10156_124658 : FILE
 		$s5 = "InsertEmailFax" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <200KB and all of them
+		uint16( 0 ) == 0xcfd0 and filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_SUSP_Macos_Plist_Suspicious : FILE
 {
@@ -406753,9 +402754,9 @@ rule SIGNATURE_BASE_SUSP_Macos_Plist_Suspicious : FILE
 		modified = "2023-10-19"
 		old_rule_name = "gen_malware_MacOS_plist_suspicious"
 		reference = "https://objective-see.com/blog/blog_0x3A.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_malware_MacOS_plist_suspicious.yar#L1-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1cca4b859148d95c9e150116e08230424544ebd0886a4d152e493476b9f91a75"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_malware_MacOS_plist_suspicious.yar#L1-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1cca4b859148d95c9e150116e08230424544ebd0886a4d152e493476b9f91a75"
 		score = 65
 		quality = 83
 		tags = "FILE"
@@ -406796,7 +402797,7 @@ rule SIGNATURE_BASE_SUSP_Macos_Plist_Suspicious : FILE
 		$fp11 = "<key>/usr/bin/ruby</key>"
 
 	condition:
-		filesize <20KB and uint32be(0)==0x3c3f786d and all of ($sr*) and @sr2[1]<0x100 and (1 of ($v*) or all of ($p*)) and not 1 of ($fp*)
+		filesize < 20KB and uint32be( 0 ) == 0x3c3f786d and all of ( $sr* ) and @sr2 [ 1 ] < 0x100 and ( 1 of ( $v* ) or all of ( $p* ) ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Rombertik_Carbongrabber : FILE
 {
@@ -406807,9 +402808,9 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber : FILE
 		date = "2015-05-05"
 		modified = "2023-12-05"
 		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_rombertik_carbongrabber.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ddc3ebcc460909a4afc9994cae53c9b7642f92ab6f16e2653f6b2d5002a33cda"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_rombertik_carbongrabber.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ddc3ebcc460909a4afc9994cae53c9b7642f92ab6f16e2653f6b2d5002a33cda"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406828,7 +402829,7 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber : FILE
 		$x6 = "sandb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5MB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 5MB and all of them
 }
 rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel_Installscript : FILE
 {
@@ -406839,10 +402840,10 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel_Installscript : FILE
 		date = "2015-05-05"
 		modified = "2023-12-05"
 		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_rombertik_carbongrabber.yar#L33-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_rombertik_carbongrabber.yar#L33-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cd6c152dd1e0689e0bede30a8bd07fef465fbcfa"
-		logic_hash = "a0edc53aea21bc317f510a4a463ca677d9dc1ec234ca9824bc46711c851f2ccc"
+		logic_hash = "v1_sha256_a0edc53aea21bc317f510a4a463ca677d9dc1ec234ca9824bc46711c851f2ccc"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -406859,7 +402860,7 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel_Installscript : FILE
 		$s13 = "`ip` text NOT NULL," fullword ascii
 
 	condition:
-		filesize <3KB and all of them
+		filesize < 3KB and all of them
 }
 rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel : FILE
 {
@@ -406870,10 +402871,10 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel : FILE
 		date = "2015-05-05"
 		modified = "2023-12-05"
 		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_rombertik_carbongrabber.yar#L55-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_rombertik_carbongrabber.yar#L55-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "e6e9e4fc3772ff33bbeeda51f217e9149db60082"
-		logic_hash = "8b7fde3c3894b7aa83e05f6a1b820195276f8738fde218485c0465afaed88427"
+		logic_hash = "v1_sha256_8b7fde3c3894b7aa83e05f6a1b820195276f8738fde218485c0465afaed88427"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406888,7 +402889,7 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel : FILE
 		$s17 = "$SQL = $db -> prepare(\"TRUNCATE TABLE `logs`\");" fullword ascii
 
 	condition:
-		filesize <46KB and all of them
+		filesize < 46KB and all of them
 }
 rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder : FILE
 {
@@ -406899,10 +402900,10 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder : FILE
 		date = "2015-05-05"
 		modified = "2023-12-05"
 		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_rombertik_carbongrabber.yar#L75-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_rombertik_carbongrabber.yar#L75-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b50ecc0ba3d6ec19b53efe505d14276e9e71285f"
-		logic_hash = "e9d13913ee03926920eba33a4dac2a6e9aeaaa54949c5bfea8dd956cf233abae"
+		logic_hash = "v1_sha256_e9d13913ee03926920eba33a4dac2a6e9aeaaa54949c5bfea8dd956cf233abae"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406916,7 +402917,7 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder : FILE
 		$s4 = "~Rich8" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <35KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 35KB and all of them
 }
 rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder_Server : FILE
 {
@@ -406927,10 +402928,10 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder_Server : FILE
 		date = "2015-05-05"
 		modified = "2023-12-05"
 		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_rombertik_carbongrabber.yar#L94-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_rombertik_carbongrabber.yar#L94-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "895fab8d55882eac51d4b27a188aa67205ff0ae5"
-		logic_hash = "693c92128166c72aded066fa66eef906a9f6027c65b889f3a487a38382f29982"
+		logic_hash = "v1_sha256_693c92128166c72aded066fa66eef906a9f6027c65b889f3a487a38382f29982"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406950,7 +402951,7 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder_Server : FILE
 		$s16 = "&browser=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and 8 of them
+		uint16( 0 ) == 0x5a4d and filesize < 250KB and 8 of them
 }
 rule SIGNATURE_BASE_EXT_APT_Bitter_Win32K_0Day_Feb21 : FILE
 {
@@ -406961,9 +402962,9 @@ rule SIGNATURE_BASE_EXT_APT_Bitter_Win32K_0Day_Feb21 : FILE
 		date = "2021-01-01"
 		modified = "2023-12-05"
 		reference = "https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_bitter.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "84a8d0ae14469eb6431e73295d821609c7a8b313630d645085ffd8faff6e5e43"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_bitter.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_84a8d0ae14469eb6431e73295d821609c7a8b313630d645085ffd8faff6e5e43"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -406978,7 +402979,7 @@ rule SIGNATURE_BASE_EXT_APT_Bitter_Win32K_0Day_Feb21 : FILE
 		$a3 = {48 63 05 CC 69 05 00 8B 0D C2 69 05 00 48 C1 E0 20 48 03 C1}
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 1 of ($a*)
+		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 1 of ( $a* )
 }
 rule SIGNATURE_BASE_EXPL_LOG_Cacti_Commandinjection_CVE_2022_46169_Dec22_1 : CVE_2022_46169
 {
@@ -406989,9 +402990,9 @@ rule SIGNATURE_BASE_EXPL_LOG_Cacti_Commandinjection_CVE_2022_46169_Dec22_1 : CVE
 		date = "2022-12-27"
 		modified = "2023-12-05"
 		reference = "https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_cve_2022_46169_cacti.yar#L1-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6ccd3b830deb5c5d65519274c4c528203a2a14a177382334da87e288174e2cfe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_cve_2022_46169_cacti.yar#L1-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6ccd3b830deb5c5d65519274c4c528203a2a14a177382334da87e288174e2cfe"
 		score = 70
 		quality = 85
 		tags = "CVE-2022-46169"
@@ -407011,9 +403012,9 @@ rule SIGNATURE_BASE_Winnti_Fonfig : FILE
 		date = "2017-01-25"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/VbvJtL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_ms_report_201701.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "715892268431bf76cf9bf0bdbeaf4129befdc590b5b2dcae479d95dfe77561a4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_ms_report_201701.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_715892268431bf76cf9bf0bdbeaf4129befdc590b5b2dcae479d95dfe77561a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407025,7 +403026,7 @@ rule SIGNATURE_BASE_Winnti_Fonfig : FILE
 		$s2 = "knat9y7m" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Winnti_Nlaifsvc : FILE
 {
@@ -407036,9 +403037,9 @@ rule SIGNATURE_BASE_Winnti_Nlaifsvc : FILE
 		date = "2017-01-25"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/VbvJtL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_winnti_ms_report_201701.yar#L26-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7268c79baf37174e04b391ae42cdd6014f17478c5b89d0c7b8042eb839324f87"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_winnti_ms_report_201701.yar#L26-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7268c79baf37174e04b391ae42cdd6014f17478c5b89d0c7b8042eb839324f87"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407051,7 +403052,7 @@ rule SIGNATURE_BASE_Winnti_Nlaifsvc : FILE
 		$s2 = "IVVTOC" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 2 of them )) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 2 of them ) ) or ( 3 of them )
 }
 rule SIGNATURE_BASE_Codoso_Plugx_3 : FILE
 {
@@ -407062,10 +403063,10 @@ rule SIGNATURE_BASE_Codoso_Plugx_3 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L11-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L11-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
-		logic_hash = "51615c2583bb672f148f216e4856e7e346b17884f0740d69f6a24f08b594bda4"
+		logic_hash = "v1_sha256_51615c2583bb672f148f216e4856e7e346b17884f0740d69f6a24f08b594bda4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407078,7 +403079,7 @@ rule SIGNATURE_BASE_Codoso_Plugx_3 : FILE
 		$s4 = "WinRAR self-extracting archive" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1200KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 1200KB and all of them
 }
 rule SIGNATURE_BASE_Codoso_Plugx_2 : FILE
 {
@@ -407089,10 +403090,10 @@ rule SIGNATURE_BASE_Codoso_Plugx_2 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb"
-		logic_hash = "5ee652a135d4865340d2ce6421144ec76ccc7ab69704e92904b2e2ebfc72edfc"
+		logic_hash = "v1_sha256_5ee652a135d4865340d2ce6421144ec76ccc7ab69704e92904b2e2ebfc72edfc"
 		score = 75
 		quality = 60
 		tags = "FILE"
@@ -407106,7 +403107,7 @@ rule SIGNATURE_BASE_Codoso_Plugx_2 : FILE
 		$s5 = "%s\\HID.dllx" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them ) or all of them
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them
 }
 rule SIGNATURE_BASE_Codoso_Customtcp_4 : FILE
 {
@@ -407117,9 +403118,9 @@ rule SIGNATURE_BASE_Codoso_Customtcp_4 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L46-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fcabbd37acf75e1233894682e77abad95a849ed68c7e8ce2690dde03d8160f8b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L46-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fcabbd37acf75e1233894682e77abad95a849ed68c7e8ce2690dde03d8160f8b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407140,7 +403141,7 @@ rule SIGNATURE_BASE_Codoso_Customtcp_4 : FILE
 		$s7 = "WorkerRun" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 5 of them ) or ($x1 and 2 of ($s*))
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 5 of them ) or ( $x1 and 2 of ( $s* ) )
 }
 rule SIGNATURE_BASE_Codoso_Customtcp_3 : FILE
 {
@@ -407151,10 +403152,10 @@ rule SIGNATURE_BASE_Codoso_Customtcp_3 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L72-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L72-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
-		logic_hash = "fb486985587fc28c45cbdf6a63550e60e8d6c18f218544adc19c5604193fe8ea"
+		logic_hash = "v1_sha256_fb486985587fc28c45cbdf6a63550e60e8d6c18f218544adc19c5604193fe8ea"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407172,7 +403173,7 @@ rule SIGNATURE_BASE_Codoso_Customtcp_3 : FILE
 		$s9 = "CLSID\\{%s}\\InprocServer32" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 5 of them ) or 7 of them
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them
 }
 rule SIGNATURE_BASE_Codoso_Customtcp_2 : FILE
 {
@@ -407183,10 +403184,10 @@ rule SIGNATURE_BASE_Codoso_Customtcp_2 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L94-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L94-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
-		logic_hash = "a355ac60dca5ca880a90a5c2720690b4691630fd434411758fa7ff006f7389ba"
+		logic_hash = "v1_sha256_a355ac60dca5ca880a90a5c2720690b4691630fd434411758fa7ff006f7389ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407203,7 +403204,7 @@ rule SIGNATURE_BASE_Codoso_Customtcp_2 : FILE
 		$s8 = "net stop %%1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <406KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 406KB and all of them
 }
 rule SIGNATURE_BASE_Codoso_PGV_PVID_6 : FILE
 {
@@ -407214,10 +403215,10 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_6 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L115-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L115-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
-		logic_hash = "0907274bd6c97b7d7b2913e42aa748c92012aeeb32196ddcbcd30332f4e95ac9"
+		logic_hash = "v1_sha256_0907274bd6c97b7d7b2913e42aa748c92012aeeb32196ddcbcd30332f4e95ac9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407228,7 +403229,7 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_6 : FILE
 		$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 6000KB and all of them
 }
 rule SIGNATURE_BASE_Codoso_Gh0St_3 : FILE
 {
@@ -407239,10 +403240,10 @@ rule SIGNATURE_BASE_Codoso_Gh0St_3 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L130-L151"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L130-L151"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
-		logic_hash = "e24d434d8f08b83f8e4b1f4aa75a84a040e4f56cdbd9a58ff49c463437e78c24"
+		logic_hash = "v1_sha256_e24d434d8f08b83f8e4b1f4aa75a84a040e4f56cdbd9a58ff49c463437e78c24"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407259,7 +403260,7 @@ rule SIGNATURE_BASE_Codoso_Gh0St_3 : FILE
 		$s7 = "mail-news.eicp.net" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <195KB and $x1 or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 195KB and $x1 or 4 of them
 }
 rule SIGNATURE_BASE_Codoso_Gh0St_2 : FILE
 {
@@ -407270,10 +403271,10 @@ rule SIGNATURE_BASE_Codoso_Gh0St_2 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L152-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L152-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
-		logic_hash = "5864e52820578769a31a6925795d13283d7b3bc5f9ac50ac8aea6578a5919e71"
+		logic_hash = "v1_sha256_5864e52820578769a31a6925795d13283d7b3bc5f9ac50ac8aea6578a5919e71"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407288,7 +403289,7 @@ rule SIGNATURE_BASE_Codoso_Gh0St_2 : FILE
 		$s17 = "RunMeByDLL32" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of them
 }
 rule SIGNATURE_BASE_Codoso_Customtcp : FILE
 {
@@ -407299,10 +403300,10 @@ rule SIGNATURE_BASE_Codoso_Customtcp : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L171-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L171-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
-		logic_hash = "4f0333de25b9f84ecaa3e63c5f600f53929244cd63a681d21cb78cfe17ca15f9"
+		logic_hash = "v1_sha256_4f0333de25b9f84ecaa3e63c5f600f53929244cd63a681d21cb78cfe17ca15f9"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407316,7 +403317,7 @@ rule SIGNATURE_BASE_Codoso_Customtcp : FILE
 		$s9 = "CODETABL" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <405KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 405KB and all of them
 }
 rule SIGNATURE_BASE_Codoso_PGV_PVID_5 : FILE
 {
@@ -407327,9 +403328,9 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_5 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L192-L208"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e248bada3ac46611bbe2cf1e1afee902191a2c1fb9611c4a052318e5e093b015"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L192-L208"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e248bada3ac46611bbe2cf1e1afee902191a2c1fb9611c4a052318e5e093b015"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407343,7 +403344,7 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_5 : FILE
 		$s2 = "%s%s.manifest" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_Codoso_Gh0St_1 : FILE
 {
@@ -407354,9 +403355,9 @@ rule SIGNATURE_BASE_Codoso_Gh0St_1 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L209-L247"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "799ae0946464e5b4980f792e525da9eec46aa7844ec977f892a80f58d8b22afd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L209-L247"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_799ae0946464e5b4980f792e525da9eec46aa7844ec977f892a80f58d8b22afd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407388,7 +403389,7 @@ rule SIGNATURE_BASE_Codoso_Gh0St_1 : FILE
 		$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (4 of ($s*) or 4 of ($c*)) or 1 of ($x*) or 6 of ($c*)
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 4 of ( $s* ) or 4 of ( $c* ) ) or 1 of ( $x* ) or 6 of ( $c* )
 }
 rule SIGNATURE_BASE_Codoso_PGV_PVID_4 : FILE
 {
@@ -407399,9 +403400,9 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_4 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L248-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f24100c0fe837511ce6144224eda397fed3931072e364f1b5be49c7bb4102aa4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L248-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f24100c0fe837511ce6144224eda397fed3931072e364f1b5be49c7bb4102aa4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407425,7 +403426,7 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_4 : FILE
 		$s5 = "<supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 2 of ($x*) and 2 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 900KB and 2 of ( $x* ) and 2 of ( $s* )
 }
 rule SIGNATURE_BASE_Codoso_Plugx_1 : FILE
 {
@@ -407436,9 +403437,9 @@ rule SIGNATURE_BASE_Codoso_Plugx_1 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L276-L294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "34736c85699a94b1413e5f9934e1a55841e8296df61d558bccf2d477e545d156"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L276-L294"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_34736c85699a94b1413e5f9934e1a55841e8296df61d558bccf2d477e545d156"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407454,7 +403455,7 @@ rule SIGNATURE_BASE_Codoso_Plugx_1 : FILE
 		$s3 = "LICENSEDLG" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
 }
 rule SIGNATURE_BASE_Codoso_PGV_PVID_3
 {
@@ -407465,9 +403466,9 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_3
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L295-L314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "371a91b08747b8025baba79797baf9f29487f9c3541f27fc2c2716b531d30b54"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L295-L314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_371a91b08747b8025baba79797baf9f29487f9c3541f27fc2c2716b531d30b54"
 		score = 75
 		quality = 85
 		tags = ""
@@ -407495,9 +403496,9 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_2 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L315-L337"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7eab3d398b5172127383047de7106a9713ec5b149f8e8ca1506b3382b007f648"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L315-L337"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7eab3d398b5172127383047de7106a9713ec5b149f8e8ca1506b3382b007f648"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407517,7 +403518,7 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_2 : FILE
 		$s11 = "System\\CurrentControlSet\\Services" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <907KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 907KB and all of them
 }
 rule SIGNATURE_BASE_Codoso_PGV_PVID_1 : FILE
 {
@@ -407528,9 +403529,9 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_1 : FILE
 		date = "2016-01-30"
 		modified = "2023-12-05"
 		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_codoso.yar#L339-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "8cecf96c7732becf83eb900bc36fa44daee466da6b483ea4f8c25ae9aeffcb7b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_codoso.yar#L339-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_8cecf96c7732becf83eb900bc36fa44daee466da6b483ea4f8c25ae9aeffcb7b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407554,10 +403555,8 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_1 : FILE
 		$s9 = "Cookie: pgv_pvid=" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and (1 of ($x*) or 3 of them )) or 5 of them
+		( uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 3 of them ) ) or 5 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hiddencobra_Rule_1
 {
 	meta:
@@ -407567,9 +403566,9 @@ rule SIGNATURE_BASE_Hiddencobra_Rule_1
 		date = "2017-06-13"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hidden_cobra.yar#L11-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e8bb844d72b7d7564caec0d0842889000c77611eeb24ac5c5cb35072a92c9d10"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hidden_cobra.yar#L11-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e8bb844d72b7d7564caec0d0842889000c77611eeb24ac5c5cb35072a92c9d10"
 		score = 75
 		quality = 85
 		tags = ""
@@ -407587,8 +403586,6 @@ rule SIGNATURE_BASE_Hiddencobra_Rule_1
 	condition:
 		all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Hiddencobra_Rule_3
 {
 	meta:
@@ -407598,9 +403595,9 @@ rule SIGNATURE_BASE_Hiddencobra_Rule_3
 		date = "2017-06-13"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hidden_cobra.yar#L52-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6c0e385e46fe9d6cde7d2bc8ef059cfd8c33ef5b17e9fcd7cea97863fb8d2c24"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hidden_cobra.yar#L52-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6c0e385e46fe9d6cde7d2bc8ef059cfd8c33ef5b17e9fcd7cea97863fb8d2c24"
 		score = 75
 		quality = 85
 		tags = ""
@@ -407630,8 +403627,6 @@ rule SIGNATURE_BASE_Hiddencobra_Rule_3
 	condition:
 		$randomUrlBuilder
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_1 : FILE
 {
 	meta:
@@ -407641,9 +403636,9 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_1 : FILE
 		date = "2018-08-11"
 		modified = "2023-12-05"
 		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hidden_cobra.yar#L87-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "b1e72ca66520152b444cc415bdf54921ebba9671519d3b0327316cee2bf0ba1d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hidden_cobra.yar#L87-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_b1e72ca66520152b444cc415bdf54921ebba9671519d3b0327316cee2bf0ba1d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407655,10 +403650,8 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_1 : FILE
 		$s2 = "PROXY_SVC_DLL.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_2 : FILE
 {
 	meta:
@@ -407668,9 +403661,9 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_2 : FILE
 		date = "2018-08-11"
 		modified = "2023-12-05"
 		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hidden_cobra.yar#L103-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "878711f5e1a8a3cfefdaf13fc08a4778fba9d2f729248784cf72b610c8bc5e17"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hidden_cobra.yar#L103-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_878711f5e1a8a3cfefdaf13fc08a4778fba9d2f729248784cf72b610c8bc5e17"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407684,10 +403677,8 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_2 : FILE
 		$s12 = "del /a \"" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_1 : FILE
 {
 	meta:
@@ -407697,9 +403688,9 @@ rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_1 : FILE
 		date = "2019-04-13"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hidden_cobra.yar#L124-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6cd036129ea54f4e3a2c52bf9ebd04e2d368e737cf83ca34a8feb79ea477a3af"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hidden_cobra.yar#L124-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6cd036129ea54f4e3a2c52bf9ebd04e2d368e737cf83ca34a8feb79ea477a3af"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407710,10 +403701,8 @@ rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_1 : FILE
 		$s2 = "PolarSSL Test CA0" fullword ascii
 
 	condition:
-		filesize <1000KB and all of them
+		filesize < 1000KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_2 : FILE
 {
 	meta:
@@ -407723,9 +403712,9 @@ rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_2 : FILE
 		date = "2019-04-13"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hidden_cobra.yar#L139-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "741d69b470ac230d502116ebd5f09bbf4bdbbbdd7e70b97a4bd5d3f2c8e148ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hidden_cobra.yar#L139-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_741d69b470ac230d502116ebd5f09bbf4bdbbbdd7e70b97a4bd5d3f2c8e148ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407738,10 +403727,8 @@ rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_2 : FILE
 		$s4 = "SYSTEM\\CurrentControlSet\\services\\%s\\Parameters" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_3 : FILE
 {
 	meta:
@@ -407751,9 +403738,9 @@ rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_3 : FILE
 		date = "2019-04-13"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hidden_cobra.yar#L156-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5cbdf0c4c5025bc1d95d27a32fa69efb329e8f74243646a31458fea225d21875"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hidden_cobra.yar#L156-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5cbdf0c4c5025bc1d95d27a32fa69efb329e8f74243646a31458fea225d21875"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407776,7 +403763,7 @@ rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_3 : FILE
 		$x5 = "udbcgiut.dat" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and (1 of ($x*) or 6 of ($s*))
+		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( 1 of ( $x* ) or 6 of ( $s* ) )
 }
 rule SIGNATURE_BASE_SUSP_VHD_Suspicious_Small_Size : FILE
 {
@@ -407787,9 +403774,9 @@ rule SIGNATURE_BASE_SUSP_VHD_Suspicious_Small_Size : FILE
 		date = "2019-12-21"
 		modified = "2023-01-27"
 		reference = "https://twitter.com/MeltX0R/status/1208095892877774850"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_vhd_anomaly.yar#L2-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0bd5b113714854feaa89d52d4bab6a4a00f0dcb7fd816fa7b036eb43d3ea0dd8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_vhd_anomaly.yar#L2-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0bd5b113714854feaa89d52d4bab6a4a00f0dcb7fd816fa7b036eb43d3ea0dd8"
 		score = 50
 		quality = 83
 		tags = "FILE"
@@ -407805,7 +403792,7 @@ rule SIGNATURE_BASE_SUSP_VHD_Suspicious_Small_Size : FILE
 		$hc2b = "connectix"
 
 	condition:
-		not uint16(0)==0x5a4d and filesize >1KB and filesize <=4000KB and ($hc1 at 0 or all of ($hc2*))
+		not uint16( 0 ) == 0x5a4d and filesize > 1KB and filesize <= 4000KB and ( $hc1 at 0 or all of ( $hc2* ) )
 }
 rule SIGNATURE_BASE_EXPL_HKTL_Macos_Switcharoo_CVE_2022_46689_Dec22 : CVE_2022_46689 FILE
 {
@@ -407816,9 +403803,9 @@ rule SIGNATURE_BASE_EXPL_HKTL_Macos_Switcharoo_CVE_2022_46689_Dec22 : CVE_2022_4
 		date = "2022-12-19"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_macos_switcharoo_dec22.yar#L2-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c2cbe12a01a38db522c49143c5168d3519ef974b4e6157cb251aa66707c69d78"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_macos_switcharoo_dec22.yar#L2-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c2cbe12a01a38db522c49143c5168d3519ef974b4e6157cb251aa66707c69d78"
 		score = 80
 		quality = 85
 		tags = "CVE-2022-46689, FILE"
@@ -407845,7 +403832,7 @@ rule SIGNATURE_BASE_EXPL_HKTL_Macos_Switcharoo_CVE_2022_46689_Dec22 : CVE_2022_4
 		$opb1 = { 55 48 89 e5 48 83 ec 60 48 8b 05 ?1 06 00 00 48 8b 00 48 89 45 f8 0f 28 05 ?b 07 00 00 48 8d 75 d0 }
 
 	condition:
-		( filesize <400KB and 1 of ($x*)) or (( uint16(0)==0xfacf or ( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca)) and filesize <400KB and 2 of them )
+		( filesize < 400KB and 1 of ( $x* ) ) or ( ( uint16( 0 ) == 0xfacf or ( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) ) and filesize < 400KB and 2 of them )
 }
 rule SIGNATURE_BASE_EXPL_Macos_Switcharoo_Indicator_Dec22 : CVE_2022_46689 FILE
 {
@@ -407856,9 +403843,9 @@ rule SIGNATURE_BASE_EXPL_Macos_Switcharoo_Indicator_Dec22 : CVE_2022_46689 FILE
 		date = "2022-12-19"
 		modified = "2023-12-05"
 		reference = "https://github.com/zhuowei/MacDirtyCowDemo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/expl_macos_switcharoo_dec22.yar#L42-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9b9ea134fc4b3a7b15ae585ced2e12cbe1defc54bc6175282d6b7a2a0b65abd1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/expl_macos_switcharoo_dec22.yar#L42-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9b9ea134fc4b3a7b15ae585ced2e12cbe1defc54bc6175282d6b7a2a0b65abd1"
 		score = 65
 		quality = 85
 		tags = "CVE-2022-46689, FILE"
@@ -407867,7 +403854,7 @@ rule SIGNATURE_BASE_EXPL_Macos_Switcharoo_Indicator_Dec22 : CVE_2022_46689 FILE
 		$x1 = "auth       sufficient     pam_permit.so" ascii
 
 	condition:
-		filesize <1KB and $x1
+		filesize < 1KB and $x1
 }
 rule SIGNATURE_BASE_Ce_Enfal_Cmstar_Debug_Msg : FILE
 {
@@ -407878,10 +403865,10 @@ rule SIGNATURE_BASE_Ce_Enfal_Cmstar_Debug_Msg : FILE
 		date = "2015-05-10"
 		modified = "2023-12-05"
 		reference = "http://goo.gl/JucrP9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_cmstar.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_cmstar.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
-		logic_hash = "31251b7ce33eb561aeb7405514df83dc1e00fdf184e3deeaa48505407d9567a0"
+		logic_hash = "v1_sha256_31251b7ce33eb561aeb7405514df83dc1e00fdf184e3deeaa48505407d9567a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407896,7 +403883,7 @@ rule SIGNATURE_BASE_Ce_Enfal_Cmstar_Debug_Msg : FILE
 		$d7 = "CM**\x0d\x0a" fullword
 
 	condition:
-		uint16(0)==0x5a4d and all of ($d*)
+		uint16( 0 ) == 0x5a4d and all of ( $d* )
 }
 rule SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1 : FILE
 {
@@ -407907,9 +403894,9 @@ rule SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1 : FILE
 		date = "2020-10-01"
 		modified = "2023-12-05"
 		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_iamtheking.yar#L2-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e50bda40eb05767e0903c3d8dd62b4e0290d89740c82c8b7f391d5763dc35156"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_iamtheking.yar#L2-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e50bda40eb05767e0903c3d8dd62b4e0290d89740c82c8b7f391d5763dc35156"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407950,7 +403937,7 @@ rule SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1 : FILE
 		$s6 = "GetExtendedTcpTable" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 3 of them ) or 4 of them
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
 }
 rule SIGNATURE_BASE_P0Wnedpowercat : FILE
 {
@@ -407961,9 +403948,9 @@ rule SIGNATURE_BASE_P0Wnedpowercat : FILE
 		date = "2017-01-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_p0wnshell.yar#L10-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "5882d0f91f237d2abe1149421db0e217e6dfcca70130d346a70d5c851eca085f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_p0wnshell.yar#L10-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_5882d0f91f237d2abe1149421db0e217e6dfcca70130d346a70d5c851eca085f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -407980,7 +403967,7 @@ rule SIGNATURE_BASE_P0Wnedpowercat : FILE
 		$x7 = "Invoke-PowerShellTcpOneLine" fullword ascii
 
 	condition:
-		( uint16(0)==0x7375 and filesize <150KB and 1 of them ) or (2 of them )
+		( uint16( 0 ) == 0x7375 and filesize < 150KB and 1 of them ) or ( 2 of them )
 }
 rule SIGNATURE_BASE_Hacktool_Strings_P0Wnedshell : FILE
 {
@@ -407991,9 +403978,9 @@ rule SIGNATURE_BASE_Hacktool_Strings_P0Wnedshell : FILE
 		date = "2017-01-14"
 		modified = "2023-02-10"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_p0wnshell.yar#L31-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "faec8f0af877f1a80ff994e08c756728cea5f58000f7124c1a6e7e4c86e7f5c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_p0wnshell.yar#L31-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_faec8f0af877f1a80ff994e08c756728cea5f58000f7124c1a6e7e4c86e7f5c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408018,7 +404005,7 @@ rule SIGNATURE_BASE_Hacktool_Strings_P0Wnedshell : FILE
 		$fp5 = "use strict"
 
 	condition:
-		filesize <20MB and 1 of ($x*) and not 1 of ($fp*)
+		filesize < 20MB and 1 of ( $x* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_P0Wnedpotato
 {
@@ -408029,9 +404016,9 @@ rule SIGNATURE_BASE_P0Wnedpotato
 		date = "2017-01-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_p0wnshell.yar#L64-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d9107db6c6460429358a2f9f1f47d103e96811152e8d03517871ff0c66578d05"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_p0wnshell.yar#L64-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d9107db6c6460429358a2f9f1f47d103e96811152e8d03517871ff0c66578d05"
 		score = 75
 		quality = 85
 		tags = ""
@@ -408057,9 +404044,9 @@ rule SIGNATURE_BASE_P0Wnedexploits
 		date = "2017-01-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_p0wnshell.yar#L83-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "40f23316117faa63fa9e9a5d281600f8e9d41857aac815d22559391c74dec157"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_p0wnshell.yar#L83-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_40f23316117faa63fa9e9a5d281600f8e9d41857aac815d22559391c74dec157"
 		score = 75
 		quality = 85
 		tags = ""
@@ -408082,9 +404069,9 @@ rule SIGNATURE_BASE_P0Wnedshellx64
 		date = "2017-01-14"
 		modified = "2021-09-15"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_p0wnshell.yar#L99-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d7cd33548ed3485cc6f3cd289813a8eb83b34e800b839c5c8f8add5f9e01a3da"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_p0wnshell.yar#L99-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d7cd33548ed3485cc6f3cd289813a8eb83b34e800b839c5c8f8add5f9e01a3da"
 		score = 75
 		quality = 85
 		tags = ""
@@ -408099,7 +404086,7 @@ rule SIGNATURE_BASE_P0Wnedshellx64
 		$fp1 = "AVSignature" ascii wide
 
 	condition:
-		1 of ($x*) and not 1 of them
+		1 of ( $x* ) and not 1 of them
 }
 rule SIGNATURE_BASE_P0Wnedlistenerconsole
 {
@@ -408110,9 +404097,9 @@ rule SIGNATURE_BASE_P0Wnedlistenerconsole
 		date = "2017-01-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_p0wnshell.yar#L120-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "068e590f6f4f99c27814f2bf96d51e1c8c6422afcf8b99bb9f1852216335da7b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_p0wnshell.yar#L120-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_068e590f6f4f99c27814f2bf96d51e1c8c6422afcf8b99bb9f1852216335da7b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -408141,9 +404128,9 @@ rule SIGNATURE_BASE_P0Wnedbinaries
 		date = "2017-01-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_p0wnshell.yar#L142-L161"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4df7fcf508a9257ea418bd1995158c3676037b310dc884d44658977fda81b13b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_p0wnshell.yar#L142-L161"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4df7fcf508a9257ea418bd1995158c3676037b310dc884d44658977fda81b13b"
 		score = 75
 		quality = 85
 		tags = ""
@@ -408171,9 +404158,9 @@ rule SIGNATURE_BASE_P0Wnedamsibypass
 		date = "2017-01-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_p0wnshell.yar#L163-L178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "1f7613506058706fc74979fdd4f9e425e9d16527120e0f2f49bc21e3e43d3b16"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_p0wnshell.yar#L163-L178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_1f7613506058706fc74979fdd4f9e425e9d16527120e0f2f49bc21e3e43d3b16"
 		score = 75
 		quality = 85
 		tags = ""
@@ -408197,9 +404184,9 @@ rule SIGNATURE_BASE_P0Wnedshell_Outputs
 		date = "2017-01-14"
 		modified = "2023-12-05"
 		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_p0wnshell.yar#L180-L196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "85d5317a473d981fe6ee1362789f34653a838c63d823bb62028a25c9db27cf6e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_p0wnshell.yar#L180-L196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_85d5317a473d981fe6ee1362789f34653a838c63d823bb62028a25c9db27cf6e"
 		score = 75
 		quality = 85
 		tags = ""
@@ -408224,9 +404211,9 @@ rule SIGNATURE_BASE_Kriskynote_Mar17_1 : FILE
 		date = "2017-03-03"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_kriskynote.yar#L11-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cc4861f3a612cbaba6abf8ded76972941c879f04b59c29756bf0ba8083bf93ab"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_kriskynote.yar#L11-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cc4861f3a612cbaba6abf8ded76972941c879f04b59c29756bf0ba8083bf93ab"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408241,7 +404228,7 @@ rule SIGNATURE_BASE_Kriskynote_Mar17_1 : FILE
 		$opb2 = { 89 4e 6c 89 46 74 e9 ad fc ff ff 8b 46 68 85 c0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and $s1 and ($opa1 or all of ($opb*))
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and $s1 and ( $opa1 or all of ( $opb* ) )
 }
 rule SIGNATURE_BASE_Kriskynote_Mar17_2 : FILE
 {
@@ -408252,9 +404239,9 @@ rule SIGNATURE_BASE_Kriskynote_Mar17_2 : FILE
 		date = "2017-03-03"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_kriskynote.yar#L32-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "4a1a7c1c75cc64df32d2f055538c5ad15418802733046471520c372a616f1e11"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_kriskynote.yar#L32-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_4a1a7c1c75cc64df32d2f055538c5ad15418802733046471520c372a616f1e11"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408266,7 +404253,7 @@ rule SIGNATURE_BASE_Kriskynote_Mar17_2 : FILE
 		$op0 = { 33 c0 80 34 30 03 40 3d e6 21 00 00 72 f4 b8 e6 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them )
 }
 rule SIGNATURE_BASE_Kriskynote_Mar17_3 : FILE
 {
@@ -408277,9 +404264,9 @@ rule SIGNATURE_BASE_Kriskynote_Mar17_3 : FILE
 		date = "2017-03-03"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_kriskynote.yar#L48-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "fda8a7944cdd12cadb1c902664909a8164835f660e6fa56209bc51164a90e77c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_kriskynote.yar#L48-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_fda8a7944cdd12cadb1c902664909a8164835f660e6fa56209bc51164a90e77c"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408293,7 +404280,7 @@ rule SIGNATURE_BASE_Kriskynote_Mar17_3 : FILE
 		$s4 = "zok]\\\\\\ZZYYY666564444" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them )
 }
 rule SIGNATURE_BASE_M_APT_VIRTUALPITA_1 : FILE
 {
@@ -408304,10 +404291,10 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_1 : FILE
 		date = "2023-11-25"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc3886_virtualpita.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc3886_virtualpita.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fe34b7c071d96dac498b72a4a07cb246"
-		logic_hash = "7641f964cc4a7671a9a3438aad1c653ef3fda3887313846cbe838b275a098190"
+		logic_hash = "v1_sha256_7641f964cc4a7671a9a3438aad1c653ef3fda3887313846cbe838b275a098190"
 		score = 60
 		quality = 45
 		tags = "FILE"
@@ -408316,7 +404303,7 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_1 : FILE
 		$x = {8b ?? ?? 4? b8 04 00 00 00 [0 - 4] ba 02 00 00 00 be 01 00 00 00 [0 - 2] e8 ?? ?? ?? ?? 89 4? ?? 83 7? ?? 00 79 [0 - 50] ba 10 00 00 00 [0 - 10] e8}
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint32( 0 ) == 0x464c457f and all of them
 }
 rule SIGNATURE_BASE_M_APT_VIRTUALPITA_2 : FILE
 {
@@ -408327,10 +404314,10 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_2 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc3886_virtualpita.yar#L17-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc3886_virtualpita.yar#L17-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fe34b7c071d96dac498b72a4a07cb246"
-		logic_hash = "56a3e1b13f0955a780f882e62003f721e409a1fdf61120dd295941605dbf21a4"
+		logic_hash = "v1_sha256_56a3e1b13f0955a780f882e62003f721e409a1fdf61120dd295941605dbf21a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408339,7 +404326,7 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_2 : FILE
 		$x = {85 c0 74 ?? c7 05 ?? ?? ?? ?? fb ff ff ff c7 8? ?? ?? ?? ?? 00 00 00 00 e9 ?? ?? ?? ?? 4? 8b 05 ?? ?? ?? ?? 4? 83 c0 01 4? 89 05 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 e9 ?? ?? ?? ?? 8b 4? ?? 4? 98 4? 8d 9? ?? ?? ?? ?? 4? 8d ?? e0 4? 8b 0? 4? 89 0? 4? 8b 4? ?? 4? 89 4? ?? 8b 4? ?? 4? 98 4? 8d b? ?? ?? ?? ?? b? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 eb ?? 8b 4? ?? 8b 4? ?? 01 c1 8b 4? ?? 03 4? ?? 4? 98 0f b6 9? ?? ?? ?? ?? 8b 4? ?? 4? 98 0f b6 8? ?? ?? ?? ?? 31 c2 4? 63 c1 88 9? ?? ?? ?? ?? 83 4? ?? 01}
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint32( 0 ) == 0x464c457f and all of them
 }
 rule SIGNATURE_BASE_M_APT_VIRTUALPITA_3 : FILE
 {
@@ -408350,10 +404337,10 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_3 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc3886_virtualpita.yar#L30-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc3886_virtualpita.yar#L30-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fe34b7c071d96dac498b72a4a07cb246"
-		logic_hash = "6f44d516b3cbe54542ae0991aad49274fc4728570e9498b319fc98840ceb7d7d"
+		logic_hash = "v1_sha256_6f44d516b3cbe54542ae0991aad49274fc4728570e9498b319fc98840ceb7d7d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408362,7 +404349,7 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_3 : FILE
 		$x = {4? 8b 4? ?? c6 00 48 4? 8b 4? ?? 4? 83 c0 05 c6 00 49 4? 8b 4? ?? 4? 83 c0 01 c6 00 49 4? 8b 4? ?? 4? 83 c0 06 c6 00 4c 4? 8b 4? ?? 4? 83 c0 02 c6 00 53 4? 8b 4? ?? 4? 83 c0 07 c6 00 45 4? 8b 4? ?? 4? 83 c0 03 c6 00 54 4? 8b 4? ?? 4? 83 c0 08 c6 00 3d 4? 8b 4? ?? 4? 83 c0 04 c6 00 46 4? 8b 4? ?? 4? 83 c0 09 c6 00 00 4? 8b 7? ?? e8}
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint32( 0 ) == 0x464c457f and all of them
 }
 rule SIGNATURE_BASE_M_APT_VIRTUALPITA_4 : FILE
 {
@@ -408373,10 +404360,10 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_4 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc3886_virtualpita.yar#L43-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc3886_virtualpita.yar#L43-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "fe34b7c071d96dac498b72a4a07cb246"
-		logic_hash = "aaf2ff682c619d2a254fe069d477654a161658db6315239f1b956141b6a72c01"
+		logic_hash = "v1_sha256_aaf2ff682c619d2a254fe069d477654a161658db6315239f1b956141b6a72c01"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408385,7 +404372,7 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_4 : FILE
 		$x = {4? 8b 4? ?? 4? 83 c1 30 4? 8b 4? ?? 4? 8b 10 8b 4? ?? 4? 98 4? 8b 04 ?? ?? ?? ?? ?? 4? 31 c2 4? 8b 4? ?? 4? 83 c0 28 4? 8b 00 4? c1 e8 10 0f b6 c0 4? 98 4? 8b 04}
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint32( 0 ) == 0x464c457f and all of them
 }
 rule SIGNATURE_BASE_M_Hunting_Python_Backdoor_Commandparser_1 : FILE
 {
@@ -408396,10 +404383,10 @@ rule SIGNATURE_BASE_M_Hunting_Python_Backdoor_Commandparser_1 : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_unc3886_virtualpita.yar#L57-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_unc3886_virtualpita.yar#L57-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "61ab3f6401d60ec36cd3ac980a8deb75"
-		logic_hash = "eefc255079e914ac81d53baf4ae159052bfda4c670e8300306c0899b3ad00a48"
+		logic_hash = "v1_sha256_eefc255079e914ac81d53baf4ae159052bfda4c670e8300306c0899b3ad00a48"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -408413,7 +404400,7 @@ rule SIGNATURE_BASE_M_Hunting_Python_Backdoor_Commandparser_1 : FILE
 		$re1 = /def\srun.{,20}command\s?=\s?self\.conn\.readInt8\(\).{,75}upload.{,75}download.{,75}shell.{,75}execute/s
 
 	condition:
-		filesize <200KB and all of them
+		filesize < 200KB and all of them
 }
 rule SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21 : FILE
 {
@@ -408424,9 +404411,9 @@ rule SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21 : FILE
 		date = "2021-03-09"
 		modified = "2023-12-05"
 		reference = "https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_wsh_rat.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "18159b140c314a00111fb9453e60d19c11633628a4fe2ad8299b839165b39424"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_wsh_rat.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_18159b140c314a00111fb9453e60d19c11633628a4fe2ad8299b839165b39424"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408440,7 +404427,7 @@ rule SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21 : FILE
 		$a6 = { 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}
 
 	condition:
-		uint16(0)==0x5A4D and 3 of them
+		uint16( 0 ) == 0x5A4D and 3 of them
 }
 rule SIGNATURE_BASE_Rocketkitten_Keylogger : FILE
 {
@@ -408451,9 +404438,9 @@ rule SIGNATURE_BASE_Rocketkitten_Keylogger : FILE
 		date = "2015-09-01"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/SjQhlp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_rocketkitten_keylogger.yar#L8-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c8523a50075c6ee9675d37d870da55d9e6193bbc770f6b916e700ab9aad438cc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_rocketkitten_keylogger.yar#L8-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c8523a50075c6ee9675d37d870da55d9e6193bbc770f6b916e700ab9aad438cc"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408473,7 +404460,7 @@ rule SIGNATURE_BASE_Rocketkitten_Keylogger : FILE
 		$s4 = "[CapsLock]" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or ($z1 and 2 of ($s*)))) or ($z1 and all of ($s*))
+		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or ( $z1 and 2 of ( $s* ) ) ) ) or ( $z1 and all of ( $s* ) )
 }
 rule SIGNATURE_BASE_Triton_Trilog : FILE
 {
@@ -408484,9 +404471,9 @@ rule SIGNATURE_BASE_Triton_Trilog : FILE
 		date = "2017-12-14"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/vtQoCQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_triton.yar#L70-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6406e9e7651978a6817079945dc801afdb6c16dd107527cbfd9a946eca27a51a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_triton.yar#L70-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6406e9e7651978a6817079945dc801afdb6c16dd107527cbfd9a946eca27a51a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408499,7 +404486,7 @@ rule SIGNATURE_BASE_Triton_Trilog : FILE
 		$s3 = "payload" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
 }
 rule SIGNATURE_BASE_Exploit_MS15_077_078 : FILE
 {
@@ -408510,9 +404497,9 @@ rule SIGNATURE_BASE_Exploit_MS15_077_078 : FILE
 		date = "2015-07-21"
 		modified = "2023-12-05"
 		reference = "https://code.google.com/p/google-security-research/issues/detail?id=473&can=1&start=200"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2015_2426.yar#L10-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "354219a1ed88c891c64513a057266199919406309460d92792a4be509f9580a1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2015_2426.yar#L10-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_354219a1ed88c891c64513a057266199919406309460d92792a4be509f9580a1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408535,7 +404522,7 @@ rule SIGNATURE_BASE_Exploit_MS15_077_078 : FILE
 		$op3 = { 64 00 88 ff 84 03 70 03 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 5 of ($s*) or 3 of ($op*)
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 5 of ( $s* ) or 3 of ( $op* )
 }
 rule SIGNATURE_BASE_Exploit_MS15_077_078_Hackingteam : FILE
 {
@@ -408546,9 +404533,9 @@ rule SIGNATURE_BASE_Exploit_MS15_077_078_Hackingteam : FILE
 		date = "2015-07-21"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/exploit_cve_2015_2426.yar#L38-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c94582629e555c9fd0b29302720078a7eb47d3013d0c1b5edd4e060c2062fa92"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/exploit_cve_2015_2426.yar#L38-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c94582629e555c9fd0b29302720078a7eb47d3013d0c1b5edd4e060c2062fa92"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408566,7 +404553,7 @@ rule SIGNATURE_BASE_Exploit_MS15_077_078_Hackingteam : FILE
 		$s6 = "InternetOpenA coolio, trying open %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2500KB and 5 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2500KB and 5 of them
 }
 import "pe"
 
@@ -408579,9 +404566,9 @@ rule SIGNATURE_BASE_APT12_Malware_Aug17 : FILE
 		date = "2017-08-30"
 		modified = "2023-12-05"
 		reference = "http://blog.macnica.net/blog/2017/08/post-fb81.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_apt12_malware.yar#L13-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "0766376689540680f8db699f64aa89fc32ddef619a74864eb816c598b8d08c8a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_apt12_malware.yar#L13-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_0766376689540680f8db699f64aa89fc32ddef619a74864eb816c598b8d08c8a"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408590,7 +404577,7 @@ rule SIGNATURE_BASE_APT12_Malware_Aug17 : FILE
 		hash2 = "42da51b69bd6625244921a4eef9a2a10153e012a3213e8e9877cf831aea3eced"
 
 	condition:
-		( uint16(0)==0x5a4d and pe.imphash()=="9ba915fd04f248ad62e856c7238c0264")
+		( uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "9ba915fd04f248ad62e856c7238c0264" )
 }
 rule SIGNATURE_BASE_MAL_Avemaria_RAT_Jul19 : FILE
 {
@@ -408601,9 +404588,9 @@ rule SIGNATURE_BASE_MAL_Avemaria_RAT_Jul19 : FILE
 		date = "2019-07-01"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/abuse_ch/status/1145697917161934856"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/mal_avemaria_rat.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "a848ec579db6a07faeab5c855a56889b4bfeaa2958d0388f7fe8c6dcdea7e457"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/mal_avemaria_rat.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_a848ec579db6a07faeab5c855a56889b4bfeaa2958d0388f7fe8c6dcdea7e457"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408615,7 +404602,7 @@ rule SIGNATURE_BASE_MAL_Avemaria_RAT_Jul19 : FILE
 		$s2 = "index = [%d][%d][%d][%d]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
 }
 rule SIGNATURE_BASE_MAL_ZIP_Socgholish_Mar21_1 : ZIP JS SOCGHOLISH FILE
 {
@@ -408626,12 +404613,12 @@ rule SIGNATURE_BASE_MAL_ZIP_Socgholish_Mar21_1 : ZIP JS SOCGHOLISH FILE
 		date = "2021-03-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_socgholish.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_socgholish.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "4f6566c145be5046b6be6a43c64d0acae38cada5eb49b2f73135b3ac3d6ba770"
 		hash = "54f756fbf8c20c76af7c9f538ff861690800c622d1c9db26eb3afedc50835b09"
 		hash = "dfdbec1846b74238ba3cfb8c7580c64a0fa8b14b6ed2b0e0e951cc6a9202dd8d"
-		logic_hash = "6621b029f65720e468bd167fcd7429a1f7ba8975298ddbd913b13fbe9e117df2"
+		logic_hash = "v1_sha256_6621b029f65720e468bd167fcd7429a1f7ba8975298ddbd913b13fbe9e117df2"
 		score = 75
 		quality = 60
 		tags = "ZIP, JS, SOCGHOLISH, FILE"
@@ -408644,7 +404631,7 @@ rule SIGNATURE_BASE_MAL_ZIP_Socgholish_Mar21_1 : ZIP JS SOCGHOLISH FILE
 		$b2 = "Edge.js" ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <1600 and (2 of ($a*) or any of ($b*))
+		uint16( 0 ) == 0x4b50 and filesize < 1600 and ( 2 of ( $a* ) or any of ( $b* ) )
 }
 rule SIGNATURE_BASE_EXT_MAL_JS_Socgholish_Mar21_1 : JS SOCGHOLISH FILE
 {
@@ -408655,12 +404642,12 @@ rule SIGNATURE_BASE_EXT_MAL_JS_Socgholish_Mar21_1 : JS SOCGHOLISH FILE
 		date = "2021-03-29"
 		modified = "2023-01-02"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_socgholish.yar#L25-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_socgholish.yar#L25-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "7ccbdcde5a9b30f8b2b866a5ca173063dec7bc92034e7cf10e3eebff017f3c23"
 		hash = "f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1"
 		hash = "c7372ffaf831ad963c0a9348beeaadb5e814ceeb878a0cc7709473343d63a51c"
-		logic_hash = "08218ae952577a6ac936de875236cdc3ae32e3aaccd2196b7f43e80d7e748584"
+		logic_hash = "v1_sha256_08218ae952577a6ac936de875236cdc3ae32e3aaccd2196b7f43e80d7e748584"
 		score = 75
 		quality = 85
 		tags = "JS, SOCGHOLISH, FILE"
@@ -408678,7 +404665,7 @@ rule SIGNATURE_BASE_EXT_MAL_JS_Socgholish_Mar21_1 : JS SOCGHOLISH FILE
 		$s10 = "'00000000'" ascii
 
 	condition:
-		filesize >3KB and filesize <5KB and 8 of ($s*)
+		filesize > 3KB and filesize < 5KB and 8 of ( $s* )
 }
 rule SIGNATURE_BASE_Socgholish_JS_22_02_2022 : FILE
 {
@@ -408689,14 +404676,14 @@ rule SIGNATURE_BASE_Socgholish_JS_22_02_2022 : FILE
 		date = "2022-02-22"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_socgholish.yar#L53-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_socgholish.yar#L53-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "3e14d04da9cc38f371961f6115f37c30"
 		hash = "dffa20158dcc110366f939bd137515c3"
 		hash = "afee3af324951b1840c789540d5c8bff"
 		hash = "c04a1625efec27fb6bbef9c66ca8372b"
 		hash = "d08a2350df5abbd8fd530cff8339373e"
-		logic_hash = "fd529cbb511ff6bcf37b44b835e021b28763922f7726ff67db5cbb3f9193c7ae"
+		logic_hash = "v1_sha256_fd529cbb511ff6bcf37b44b835e021b28763922f7726ff67db5cbb3f9193c7ae"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408707,7 +404694,7 @@ rule SIGNATURE_BASE_Socgholish_JS_22_02_2022 : FILE
 		$s3 = "new ActiveXObject('MSXML2.XMLHTTP');" ascii
 
 	condition:
-		filesize <5KB and all of them
+		filesize < 5KB and all of them
 }
 rule SIGNATURE_BASE_APT_MAL_Fujinama : FILE
 {
@@ -408718,9 +404705,9 @@ rule SIGNATURE_BASE_APT_MAL_Fujinama : FILE
 		date = "2021-01-07"
 		modified = "2023-12-05"
 		reference = "https://reaqta.com/2021/01/fujinama-analysis-leonardo-spa"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_fujinama_rat.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9bff8ee5424a939b5278b2d1b349d898d138b9efb3cf783221826abb4d8015ef"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_fujinama_rat.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9bff8ee5424a939b5278b2d1b349d898d138b9efb3cf783221826abb4d8015ef"
 		score = 75
 		quality = 51
 		tags = "FILE"
@@ -408739,10 +404726,8 @@ rule SIGNATURE_BASE_APT_MAL_Fujinama : FILE
 		$font = "Tahoma" wide ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16( 0 ) == 0x5a4d and all of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Greenbug_Malware_1 : FILE
 {
 	meta:
@@ -408752,9 +404737,9 @@ rule SIGNATURE_BASE_Greenbug_Malware_1 : FILE
 		date = "2017-01-25"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greenbug.yar#L12-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e060a197dec0ce5da385abd282f0c4397bace8945b36198955925d02444b37a3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greenbug.yar#L12-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e060a197dec0ce5da385abd282f0c4397bace8945b36198955925d02444b37a3"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408766,10 +404751,8 @@ rule SIGNATURE_BASE_Greenbug_Malware_1 : FILE
 		$s2 = "Sfouglr" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Greenbug_Malware_2 : FILE
 {
 	meta:
@@ -408779,9 +404762,9 @@ rule SIGNATURE_BASE_Greenbug_Malware_2 : FILE
 		date = "2017-01-25"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greenbug.yar#L28-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "25a9e1f08187f3d3cd0ec1384a5f4647c3368b99062f2e0d7d45c6c2ffeb66e0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greenbug.yar#L28-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_25a9e1f08187f3d3cd0ec1384a5f4647c3368b99062f2e0d7d45c6c2ffeb66e0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408804,10 +404787,8 @@ rule SIGNATURE_BASE_Greenbug_Malware_2 : FILE
 		$s4 = "SELECT * FROM AntiVirusProduct" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 2 of them )) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 2 of them ) ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Greenbug_Malware_3
 {
 	meta:
@@ -408817,9 +404798,9 @@ rule SIGNATURE_BASE_Greenbug_Malware_3
 		date = "2017-01-25"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greenbug.yar#L56-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f4e8672da2ed9d90d4ebfccca977c4aeb93656d9e467cf479699cefd03611f32"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greenbug.yar#L56-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f4e8672da2ed9d90d4ebfccca977c4aeb93656d9e467cf479699cefd03611f32"
 		score = 75
 		quality = 85
 		tags = ""
@@ -408836,8 +404817,6 @@ rule SIGNATURE_BASE_Greenbug_Malware_3
 	condition:
 		1 of them
 }
-import "pe"
-
 rule SIGNATURE_BASE_Greenbug_Malware_4 : FILE
 {
 	meta:
@@ -408847,9 +404826,9 @@ rule SIGNATURE_BASE_Greenbug_Malware_4 : FILE
 		date = "2017-01-25"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greenbug.yar#L75-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "869832536d838e062227ccd3b84f8559d2215360c0e09ec791db623d7d3d7a3b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greenbug.yar#L75-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_869832536d838e062227ccd3b84f8559d2215360c0e09ec791db623d7d3d7a3b"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408873,10 +404852,8 @@ rule SIGNATURE_BASE_Greenbug_Malware_4 : FILE
 		$s12 = "Microsoft\\Windows\\tmp43hh11.txt" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them ) or (3 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them ) or ( 3 of them )
 }
-import "pe"
-
 rule SIGNATURE_BASE_Greenbug_Malware_5 : FILE
 {
 	meta:
@@ -408886,9 +404863,9 @@ rule SIGNATURE_BASE_Greenbug_Malware_5 : FILE
 		date = "2017-01-25"
 		modified = "2023-01-27"
 		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greenbug.yar#L103-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "cdb4b2447e7eb3546b33a804abf5fbc20817823e5c9440109db7b44adf90899d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greenbug.yar#L103-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_cdb4b2447e7eb3546b33a804abf5fbc20817823e5c9440109db7b44adf90899d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -408906,7 +404883,7 @@ rule SIGNATURE_BASE_Greenbug_Malware_5 : FILE
 		$o1 = "========================== (Net User) ==========================" ascii fullword
 
 	condition:
-		filesize <2000KB and (( uint16(0)==0x5a4d and 1 of them ) or $o1)
+		filesize < 2000KB and ( ( uint16( 0 ) == 0x5a4d and 1 of them ) or $o1 )
 }
 import "pe"
 
@@ -408919,9 +404896,9 @@ rule SIGNATURE_BASE_Greenbug_Malware_Nov17_1 : FILE
 		date = "2017-11-26"
 		modified = "2023-12-05"
 		reference = "http://www.clearskysec.com/greenbug/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_greenbug.yar#L141-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "afd006d7e53cdedbed5938e5dea71273dd21a1382239bac03194662e95d053c8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_greenbug.yar#L141-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_afd006d7e53cdedbed5938e5dea71273dd21a1382239bac03194662e95d053c8"
 		score = 75
 		quality = 83
 		tags = "FILE"
@@ -408941,7 +404918,7 @@ rule SIGNATURE_BASE_Greenbug_Malware_Nov17_1 : FILE
 		$s3 = "Agent can not be configured" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="58ba44f7ff5436a603fec3df97d815ea" or pe.imphash()=="538805ecd776b9a42e71aebf94fde1b1" or 1 of ($x*) or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "58ba44f7ff5436a603fec3df97d815ea" or pe.imphash ( ) == "538805ecd776b9a42e71aebf94fde1b1" or 1 of ( $x* ) or 3 of them )
 }
 rule SIGNATURE_BASE_Bin_Ndisk : FILE
 {
@@ -408952,10 +404929,10 @@ rule SIGNATURE_BASE_Bin_Ndisk : FILE
 		date = "2015-07-07"
 		modified = "2023-12-05"
 		reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/1436184181/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hackingteam_rules.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hackingteam_rules.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
-		logic_hash = "d93147e9631065eab35cbbc4ce112cfef92f81063cf8570bc021fbfe72811ab6"
+		logic_hash = "v1_sha256_d93147e9631065eab35cbbc4ce112cfef92f81063cf8570bc021fbfe72811ab6"
 		score = 100
 		quality = 85
 		tags = "FILE"
@@ -408972,7 +404949,7 @@ rule SIGNATURE_BASE_Bin_Ndisk : FILE
 		$s8 = "built by: WinDDK" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 6 of them
+		uint16( 0 ) == 0x5a4d and filesize < 30KB and 6 of them
 }
 rule SIGNATURE_BASE_Hackingteam_Elevator_DLL : FILE
 {
@@ -408983,10 +404960,10 @@ rule SIGNATURE_BASE_Hackingteam_Elevator_DLL : FILE
 		date = "2015-07-07"
 		modified = "2023-12-05"
 		reference = "http://t.co/EG0qtVcKLh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hackingteam_rules.yar#L33-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hackingteam_rules.yar#L33-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
-		logic_hash = "f2860c0bb6176f7cc57cb703e9d4235c4cf0b9cc1c0e7c47fb4c8ba47155a616"
+		logic_hash = "v1_sha256_f2860c0bb6176f7cc57cb703e9d4235c4cf0b9cc1c0e7c47fb4c8ba47155a616"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -409005,7 +404982,7 @@ rule SIGNATURE_BASE_Hackingteam_Elevator_DLL : FILE
 		$s10 = "InternetOpenA fail" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 6 of them
+		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 6 of them
 }
 rule SIGNATURE_BASE_Hackingteam_Elevator_EXE : FILE
 {
@@ -409016,10 +404993,10 @@ rule SIGNATURE_BASE_Hackingteam_Elevator_EXE : FILE
 		date = "2015-07-07"
 		modified = "2023-12-05"
 		reference = "Hacking Team Disclosure elevator.c"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_hackingteam_rules.yar#L58-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_hackingteam_rules.yar#L58-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1"
-		logic_hash = "58f3c28fa69da0329a4cd5451a86260056076a9d0094965e9c23a63ef72cfc98"
+		logic_hash = "v1_sha256_58f3c28fa69da0329a4cd5451a86260056076a9d0094965e9c23a63ef72cfc98"
 		score = 70
 		quality = 81
 		tags = "FILE"
@@ -409042,7 +405019,7 @@ rule SIGNATURE_BASE_Hackingteam_Elevator_EXE : FILE
 		$s8 = "_getexport" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of ($x*) and 3 of ($s*)
+		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of ( $x* ) and 3 of ( $s* )
 }
 rule SIGNATURE_BASE_Gen_Base64_EXE : HIGHVOL FILE
 {
@@ -409053,9 +405030,9 @@ rule SIGNATURE_BASE_Gen_Base64_EXE : HIGHVOL FILE
 		date = "2017-04-21"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/general_cloaking.yar#L71-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6fe18ee727a836c0baaac4dbbffdb9f50065f56a4c6eeee7e54792a8a66229de"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/general_cloaking.yar#L71-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6fe18ee727a836c0baaac4dbbffdb9f50065f56a4c6eeee7e54792a8a66229de"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
@@ -409070,7 +405047,7 @@ rule SIGNATURE_BASE_Gen_Base64_EXE : HIGHVOL FILE
 		$fp1 = "BAM Management class library"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 1 of ($s*) and not 1 of ($fp*)
+		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 1 of ( $s* ) and not 1 of ( $fp* )
 }
 rule SIGNATURE_BASE_Binary_Drop_Certutil : FILE
 {
@@ -409081,9 +405058,9 @@ rule SIGNATURE_BASE_Binary_Drop_Certutil : FILE
 		date = "2015-07-15"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/9DNn8q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/general_cloaking.yar#L92-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "3e2b62442b5da6ab887e1eb03cdd44932651fa51ce11e87e6fc29015e708d2f3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/general_cloaking.yar#L92-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_3e2b62442b5da6ab887e1eb03cdd44932651fa51ce11e87e6fc29015e708d2f3"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -409095,7 +405072,7 @@ rule SIGNATURE_BASE_Binary_Drop_Certutil : FILE
 		$s2 = "certutil -decode " ascii
 
 	condition:
-		filesize <10KB and all of them
+		filesize < 10KB and all of them
 }
 rule SIGNATURE_BASE_Stegokatz : FILE
 {
@@ -409106,9 +405083,9 @@ rule SIGNATURE_BASE_Stegokatz : FILE
 		date = "2015-09-11"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/jWPBBY"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/general_cloaking.yar#L109-L123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "091b07220d2a89822aa382edcecf5869d463e375747cc41f52417e66ccf0e2da"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/general_cloaking.yar#L109-L123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_091b07220d2a89822aa382edcecf5869d463e375747cc41f52417e66ccf0e2da"
 		score = 70
 		quality = 85
 		tags = "FILE"
@@ -409119,7 +405096,7 @@ rule SIGNATURE_BASE_Stegokatz : FILE
 		$s2 = "Rpd3ovN3FlalVtNklLQ0xNNGtOV1BiY0VOVHROT0Zud25CWGN0WS9BcEdMR28rK01OWm85Nm9xMlNnY1U5aTgrSTBvNkFob1FOTzRHQWdtUElEVmlqald0Tk90b2FmN01ESWJUQkF5T0pYbTB4bFVHRTBZWEFWOXVoNHBkQnRrS0VFWWVBSEE2TDFzU0c5a2ZFTEc3QWd4WTBYY1l3ZzB6QUFXS09JZE9wQVhEK3lnS3lsR3B5Q1ljR1NJdFNseGZKWUlVVkNFdEZPVjRJUldERUl1QXpKZ2pCQWdsd0Va" ascii
 
 	condition:
-		filesize <1000KB and 1 of them
+		filesize < 1000KB and 1 of them
 }
 rule SIGNATURE_BASE_Obfuscated_VBS_April17 : FILE
 {
@@ -409130,9 +405107,9 @@ rule SIGNATURE_BASE_Obfuscated_VBS_April17 : FILE
 		date = "2017-04-21"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/general_cloaking.yar#L125-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "590dca22a4fcbc2bbfb4358c53f7cb6c06824970139cca251c4cf1bd435817b0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/general_cloaking.yar#L125-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_590dca22a4fcbc2bbfb4358c53f7cb6c06824970139cca251c4cf1bd435817b0"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409142,7 +405119,7 @@ rule SIGNATURE_BASE_Obfuscated_VBS_April17 : FILE
 		$s1 = "::::::ExecuteGlobal unescape(unescape(" ascii
 
 	condition:
-		filesize <500KB and all of them
+		filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_Obfuscated_JS_April17 : FILE
 {
@@ -409153,9 +405130,9 @@ rule SIGNATURE_BASE_Obfuscated_JS_April17 : FILE
 		date = "2017-04-21"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/general_cloaking.yar#L139-L153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "c75bf0ad8dd35fabbaedb54c2630249497edbb215b6ce2b707e32f82e8fb8f56"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/general_cloaking.yar#L139-L153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_c75bf0ad8dd35fabbaedb54c2630249497edbb215b6ce2b707e32f82e8fb8f56"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409167,7 +405144,7 @@ rule SIGNATURE_BASE_Obfuscated_JS_April17 : FILE
 		$s3 = "));(new Function(" ascii
 
 	condition:
-		filesize <500KB and all of them
+		filesize < 500KB and all of them
 }
 rule SIGNATURE_BASE_Invoke_Psimage : FILE
 {
@@ -409178,9 +405155,9 @@ rule SIGNATURE_BASE_Invoke_Psimage : FILE
 		date = "2017-12-16"
 		modified = "2023-12-05"
 		reference = "https://github.com/peewpw/Invoke-PSImage"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/gen_invoke_psimage.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "ce4bc73fcba3b82e4d11203aa2c3f0b2f85c6eb9e1784ad76a7b20500b4053f8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/gen_invoke_psimage.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_ce4bc73fcba3b82e4d11203aa2c3f0b2f85c6eb9e1784ad76a7b20500b4053f8"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409202,7 +405179,7 @@ rule SIGNATURE_BASE_Invoke_Psimage : FILE
             35 F7 0F }
 
 	condition:
-		filesize <3000KB and 1 of them
+		filesize < 3000KB and 1 of them
 }
 rule SIGNATURE_BASE_Fireball_De_Svr : FILE
 {
@@ -409213,9 +405190,9 @@ rule SIGNATURE_BASE_Fireball_De_Svr : FILE
 		date = "2017-06-02"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fireball.yar#L12-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "9ac858b3ce50daac811ded4664f2a602a32d8811825733d235125fc81a488e58"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fireball.yar#L12-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_9ac858b3ce50daac811ded4664f2a602a32d8811825733d235125fc81a488e58"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409230,7 +405207,7 @@ rule SIGNATURE_BASE_Fireball_De_Svr : FILE
 		$s5 = "Internet Connect Failed!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and 4 of them )
 }
 rule SIGNATURE_BASE_Fireball_Lancer : FILE
 {
@@ -409241,9 +405218,9 @@ rule SIGNATURE_BASE_Fireball_Lancer : FILE
 		date = "2017-06-02"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fireball.yar#L31-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "74df144556121609da0820c319a86a9de0f49eeb2d4b1ed59c3a4d0c1d7788cb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fireball.yar#L31-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_74df144556121609da0820c319a86a9de0f49eeb2d4b1ed59c3a4d0c1d7788cb"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409260,7 +405237,7 @@ rule SIGNATURE_BASE_Fireball_Lancer : FILE
 		$s5 = "\",Start" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 3 of ($s*))) or (6 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( 6 of them )
 }
 rule SIGNATURE_BASE_Qqbrowser : FILE
 {
@@ -409271,9 +405248,9 @@ rule SIGNATURE_BASE_Qqbrowser : FILE
 		date = "2017-06-02"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fireball.yar#L53-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "525d134f57aaa314bcf0676678264e518edb785970478cb31a8fb6f1c8c92263"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fireball.yar#L53-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_525d134f57aaa314bcf0676678264e518edb785970478cb31a8fb6f1c8c92263"
 		score = 50
 		quality = 83
 		tags = "FILE"
@@ -409287,7 +405264,7 @@ rule SIGNATURE_BASE_Qqbrowser : FILE
 		$s4 = "QQBrowser_Broker.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
 }
 rule SIGNATURE_BASE_Chrome_Elf : FILE
 {
@@ -409298,9 +405275,9 @@ rule SIGNATURE_BASE_Chrome_Elf : FILE
 		date = "2017-06-02"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fireball.yar#L72-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "89f0ab16f164222ecf2a4b14bee02d0c24517d03d1c12b25f5158eebc31b3e3d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fireball.yar#L72-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_89f0ab16f164222ecf2a4b14bee02d0c24517d03d1c12b25f5158eebc31b3e3d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409316,7 +405293,7 @@ rule SIGNATURE_BASE_Chrome_Elf : FILE
 		$s16 = "Rundll32_Do" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 4 of them )
 }
 rule SIGNATURE_BASE_Fireball_Regkey : FILE
 {
@@ -409327,9 +405304,9 @@ rule SIGNATURE_BASE_Fireball_Regkey : FILE
 		date = "2017-06-02"
 		modified = "2022-12-21"
 		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fireball.yar#L92-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f8fe8b1edb009ac84acf6159feada91d364507c53a9f92abd6b245b38fa058f5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fireball.yar#L92-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f8fe8b1edb009ac84acf6159feada91d364507c53a9f92abd6b245b38fa058f5"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409342,7 +405319,7 @@ rule SIGNATURE_BASE_Fireball_Regkey : FILE
 		$s3 = "WINMAIN" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
 }
 rule SIGNATURE_BASE_Fireball_Winsap : FILE
 {
@@ -409353,9 +405330,9 @@ rule SIGNATURE_BASE_Fireball_Winsap : FILE
 		date = "2017-06-02"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fireball.yar#L110-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "de722d90d82f82faa5dfe5991c846e5c16deb919ae653b8f9fe4d1ad0384c41d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fireball.yar#L110-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_de722d90d82f82faa5dfe5991c846e5c16deb919ae653b8f9fe4d1ad0384c41d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409371,7 +405348,7 @@ rule SIGNATURE_BASE_Fireball_Winsap : FILE
 		$s6 = "UPDATE OVERWRITE" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 4 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 4 of them )
 }
 rule SIGNATURE_BASE_Fireball_Archer : FILE
 {
@@ -409382,9 +405359,9 @@ rule SIGNATURE_BASE_Fireball_Archer : FILE
 		date = "2017-06-02"
 		modified = "2022-12-21"
 		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fireball.yar#L130-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "f566ba477ccf1325914b6c9785e2b85f732b211e9321eea24d6c5a0339ccc4d1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fireball.yar#L130-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_f566ba477ccf1325914b6c9785e2b85f732b211e9321eea24d6c5a0339ccc4d1"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409399,7 +405376,7 @@ rule SIGNATURE_BASE_Fireball_Archer : FILE
 		$s4 = "d\\\\.\\PhysicalDrive%d" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and ($x1 or 3 of them )
+		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( $x1 or 3 of them )
 }
 rule SIGNATURE_BASE_Clearlog : FILE
 {
@@ -409410,9 +405387,9 @@ rule SIGNATURE_BASE_Clearlog : FILE
 		date = "2017-06-02"
 		modified = "2023-12-05"
 		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fireball.yar#L151-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "6b6fd74ad184cafa7885385f808034e9211ff37e04ed5e8ea4af2c7fb7d697bd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fireball.yar#L151-L171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_6b6fd74ad184cafa7885385f808034e9211ff37e04ed5e8ea4af2c7fb7d697bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409429,7 +405406,7 @@ rule SIGNATURE_BASE_Clearlog : FILE
 		$s6 = "cle.log.1" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and $x1 or 2 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 500KB and $x1 or 2 of them )
 }
 rule SIGNATURE_BASE_Fireball_Gubed : FILE
 {
@@ -409440,9 +405417,9 @@ rule SIGNATURE_BASE_Fireball_Gubed : FILE
 		date = "2017-06-02"
 		modified = "2022-12-21"
 		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/crime_fireball.yar#L173-L191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "e8053d8a95d41d81940bbaf7945323849613dbcfe727559a07bc294bd834b65f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/crime_fireball.yar#L173-L191"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_e8053d8a95d41d81940bbaf7945323849613dbcfe727559a07bc294bd834b65f"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409457,7 +405434,7 @@ rule SIGNATURE_BASE_Fireball_Gubed : FILE
 		$x5 = "d2hrpnfyb3wv3k.cloudfront.net" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
 }
 rule SIGNATURE_BASE_APT_Hiddencobra_Enc_PK_Header : HIDDEN_COBRA TYPEFRAME FILE
 {
@@ -409468,9 +405445,9 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Enc_PK_Header : HIDDEN_COBRA TYPEFRAME FILE
 		date = "2018-04-12"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ar18_165a.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d0c8345b69e5f421fd93bc239031f2e51a120ae64be1eca0c1fdae2aa55ac42a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ar18_165a.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d0c8345b69e5f421fd93bc239031f2e51a120ae64be1eca0c1fdae2aa55ac42a"
 		score = 75
 		quality = 85
 		tags = "HIDDEN_COBRA, TYPEFRAME, FILE"
@@ -409485,7 +405462,7 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Enc_PK_Header : HIDDEN_COBRA TYPEFRAME FILE
 		$s2 = { ae 1d af 74 c0 f5 e1 02 50 10 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
 }
 rule SIGNATURE_BASE_APT_Hiddencobra_Import_Obfuscation_2 : HIDDEN_COBRA TYPEFRAME FILE
 {
@@ -409496,9 +405473,9 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Import_Obfuscation_2 : HIDDEN_COBRA TYPEFRAM
 		date = "2018-04-12"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ar18_165a.yar#L21-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "d52fc053afc6b3beb35a6dfd0f9b3714a5bad4e9b0dcfcce7be87d65f0a0c23e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ar18_165a.yar#L21-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_d52fc053afc6b3beb35a6dfd0f9b3714a5bad4e9b0dcfcce7be87d65f0a0c23e"
 		score = 75
 		quality = 85
 		tags = "HIDDEN_COBRA, TYPEFRAME, FILE"
@@ -409516,7 +405493,7 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Import_Obfuscation_2 : HIDDEN_COBRA TYPEFRAM
 		$s5 = {A7 D3 03 FC }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of them
 }
 rule SIGNATURE_BASE_APT_NK_AR18_165A_Hiddencobra_Import_Deob : HIDDEN_COBRA TYPEFRAME FILE
 {
@@ -409527,11 +405504,11 @@ rule SIGNATURE_BASE_APT_NK_AR18_165A_Hiddencobra_Import_Deob : HIDDEN_COBRA TYPE
 		date = "2018-04-12"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ar18_165a.yar#L43-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ar18_165a.yar#L43-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
 		hash = "ae769e62fef4a1709c12c9046301aa5d"
 		hash = "e48fe20eblf5a5887f2ac631fed9ed63"
-		logic_hash = "2eff83738ca4f2db8327c1ee2a9539d7ce882a315025a656d391c16079e432cb"
+		logic_hash = "v1_sha256_2eff83738ca4f2db8327c1ee2a9539d7ce882a315025a656d391c16079e432cb"
 		score = 75
 		quality = 85
 		tags = "HIDDEN_COBRA, TYPEFRAME, FILE"
@@ -409544,7 +405521,7 @@ rule SIGNATURE_BASE_APT_NK_AR18_165A_Hiddencobra_Import_Deob : HIDDEN_COBRA TYPE
 		$ = { 8A 08 80 F9 62 7C 0B 80 F9 79 7F 06 82 DB 2A D1 88 10 8A 48 01 40 84 C9 75 E6}
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
 }
 rule SIGNATURE_BASE_APT_NK_AR18_165A_1 : FILE
 {
@@ -409555,9 +405532,9 @@ rule SIGNATURE_BASE_APT_NK_AR18_165A_1 : FILE
 		date = "2018-06-15"
 		modified = "2023-12-05"
 		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/apt_ar18_165a.yar#L62-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "7b87c537c9ff38329a5e1e39d5ad1d6cef724c580f246721443eab603534b29d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/apt_ar18_165a.yar#L62-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_7b87c537c9ff38329a5e1e39d5ad1d6cef724c580f246721443eab603534b29d"
 		score = 75
 		quality = 85
 		tags = "FILE"
@@ -409569,7 +405546,7 @@ rule SIGNATURE_BASE_APT_NK_AR18_165A_1 : FILE
 		$s2 = "netsh.exe firewall add portopening TCP %d \"PortOpenning\" enable" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
 }
 rule SIGNATURE_BASE_VUL_Tomcat_Catalina_CVE_2020_1938 : FILE
 {
@@ -409580,9 +405557,9 @@ rule SIGNATURE_BASE_VUL_Tomcat_Catalina_CVE_2020_1938 : FILE
 		date = "2020-02-28"
 		modified = "2023-12-05"
 		reference = "https://www.chaitin.cn/en/ghostcat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/yara/vul_cve_2020_1938.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/b1bc331bada41a30f3b2f8943e750798f7aaa1a9/LICENSE"
-		logic_hash = "902b469c8a31add2254e8d5ade6bc22f1bc0a2b10ea70f3131f0640f2900e667"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/yara/vul_cve_2020_1938.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/7f13b425aac90a00c208de8e3b28751b5aba3c45/LICENSE"
+		logic_hash = "v1_sha256_902b469c8a31add2254e8d5ade6bc22f1bc0a2b10ea70f3131f0640f2900e667"
 		score = 50
 		quality = 85
 		tags = "FILE"
@@ -409596,5 +405573,5 @@ rule SIGNATURE_BASE_VUL_Tomcat_Catalina_CVE_2020_1938 : FILE
 		$fp3 = " requiredSecret=\"" ascii
 
 	condition:
-		$h1 at 0 and filesize <=300KB and $a1 and $v1 and not 1 of ($fp*)
+		$h1 at 0 and filesize <= 300KB and $a1 and $v1 and not 1 of ( $fp* )
 }